No OneTemporary
Actions

Size

4 MB

Referenced Files

None

Subscribers

None

View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	Index: vendor-sys/openzfs/dist/META
	===================================================================
	--- vendor-sys/openzfs/dist/META (revision 365891)
	+++ vendor-sys/openzfs/dist/META (revision 365892)
	@@ -1,10 +1,10 @@
	Meta: 1
	Name: zfs
	Branch: 1.0
	Version: 2.0.0
	-Release: rc1
	+Release: rc2
	Release-Tags: relext
	License: CDDL
	Author: OpenZFS
	Linux-Maximum: 5.8
	Linux-Minimum: 3.10
	Index: vendor-sys/openzfs/dist/cmd/mount_zfs/mount_zfs.c
	===================================================================
	--- vendor-sys/openzfs/dist/cmd/mount_zfs/mount_zfs.c (revision 365891)
	+++ vendor-sys/openzfs/dist/cmd/mount_zfs/mount_zfs.c (revision 365892)
	@@ -1,408 +1,409 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011 Lawrence Livermore National Security, LLC.
	*/

	#include <libintl.h>
	#include <unistd.h>
	#include <sys/file.h>
	#include <sys/mount.h>
	#include <sys/mntent.h>
	#include <sys/stat.h>
	#include <libzfs.h>
	#include <libzutil.h>
	#include <locale.h>
	#include <getopt.h>
	#include <fcntl.h>
	#include <errno.h>

	#define ZS_COMMENT 0x00000000 /* comment */
	#define ZS_ZFSUTIL 0x00000001 /* caller is zfs(8) */

	libzfs_handle_t *g_zfs;

	/*
	* Return the pool/dataset to mount given the name passed to mount. This
	* is expected to be of the form pool/dataset, however may also refer to
	* a block device if that device contains a valid zfs label.
	*/
	static char *
	parse_dataset(char *dataset)
	{
	char cwd[PATH_MAX];
	struct stat64 statbuf;
	int error;
	int len;

	/*
	* We expect a pool/dataset to be provided, however if we're
	* given a device which is a member of a zpool we attempt to
	* extract the pool name stored in the label. Given the pool
	* name we can mount the root dataset.
	*/
	error = stat64(dataset, &statbuf);
	if (error == 0) {
	nvlist_t *config;
	char *name;
	int fd;

	fd = open(dataset, O_RDONLY);
	if (fd < 0)
	goto out;

	error = zpool_read_label(fd, &config, NULL);
	(void) close(fd);
	if (error)
	goto out;

	error = nvlist_lookup_string(config,
	ZPOOL_CONFIG_POOL_NAME, &name);
	if (error) {
	nvlist_free(config);
	} else {
	dataset = strdup(name);
	nvlist_free(config);
	return (dataset);
	}
	}
	out:
	/*
	* If a file or directory in your current working directory is
	* named 'dataset' then mount(8) will prepend your current working
	* directory to the dataset. There is no way to prevent this
	* behavior so we simply check for it and strip the prepended
	* patch when it is added.
	*/
	if (getcwd(cwd, PATH_MAX) == NULL)
	return (dataset);

	len = strlen(cwd);

	/* Do not add one when cwd already ends in a trailing '/' */
	if (strncmp(cwd, dataset, len) == 0)
	return (dataset + len + (cwd[len-1] != '/'));

	return (dataset);
	}

	/*
	* Update the mtab_* code to use the libmount library when it is commonly
	* available otherwise fallback to legacy mode. The mount(8) utility will
	* manage the lock file for us to prevent racing updates to /etc/mtab.
	*/
	static int
	mtab_is_writeable(void)
	{
	struct stat st;
	int error, fd;

	error = lstat("/etc/mtab", &st);
	if (error \|\| S_ISLNK(st.st_mode))
	return (0);

	fd = open("/etc/mtab", O_RDWR \| O_CREAT, 0644);
	if (fd < 0)
	return (0);

	close(fd);
	return (1);
	}

	static int
	mtab_update(char dataset, char mntpoint, char type, char mntopts)
	{
	struct mntent mnt;
	FILE *fp;
	int error;

	mnt.mnt_fsname = dataset;
	mnt.mnt_dir = mntpoint;
	mnt.mnt_type = type;
	mnt.mnt_opts = mntopts ? mntopts : "";
	mnt.mnt_freq = 0;
	mnt.mnt_passno = 0;

	fp = setmntent("/etc/mtab", "a+");
	if (!fp) {
	(void) fprintf(stderr, gettext(
	"filesystem '%s' was mounted, but /etc/mtab "
	"could not be opened due to error %d\n"),
	dataset, errno);
	return (MOUNT_FILEIO);
	}

	error = addmntent(fp, &mnt);
	if (error) {
	(void) fprintf(stderr, gettext(
	"filesystem '%s' was mounted, but /etc/mtab "
	"could not be updated due to error %d\n"),
	dataset, errno);
	return (MOUNT_FILEIO);
	}

	(void) endmntent(fp);

	return (MOUNT_SUCCESS);
	}

	int
	main(int argc, char **argv)
	{
	zfs_handle_t *zhp;
	char prop[ZFS_MAXPROPLEN];
	uint64_t zfs_version = 0;
	char mntopts[MNT_LINE_MAX] = { '\0' };
	char badopt[MNT_LINE_MAX] = { '\0' };
	char mtabopt[MNT_LINE_MAX] = { '\0' };
	char mntpoint[PATH_MAX];
	char *dataset;
	unsigned long mntflags = 0, zfsflags = 0, remount = 0;
	int sloppy = 0, fake = 0, verbose = 0, nomtab = 0, zfsutil = 0;
	int error, c;

	(void) setlocale(LC_ALL, "");
	+ (void) setlocale(LC_NUMERIC, "C");
	(void) textdomain(TEXT_DOMAIN);

	opterr = 0;

	/* check options */
	while ((c = getopt_long(argc, argv, "sfnvo:h?", 0, 0)) != -1) {
	switch (c) {
	case 's':
	sloppy = 1;
	break;
	case 'f':
	fake = 1;
	break;
	case 'n':
	nomtab = 1;
	break;
	case 'v':
	verbose++;
	break;
	case 'o':
	(void) strlcpy(mntopts, optarg, sizeof (mntopts));
	break;
	case 'h':
	case '?':
	(void) fprintf(stderr, gettext("Invalid option '%c'\n"),
	optopt);
	(void) fprintf(stderr, gettext("Usage: mount.zfs "
	"[-sfnv] [-o options] <dataset> <mountpoint>\n"));
	return (MOUNT_USAGE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check that we only have two arguments */
	if (argc != 2) {
	if (argc == 0)
	(void) fprintf(stderr, gettext("missing dataset "
	"argument\n"));
	else if (argc == 1)
	(void) fprintf(stderr,
	gettext("missing mountpoint argument\n"));
	else
	(void) fprintf(stderr, gettext("too many arguments\n"));
	(void) fprintf(stderr, "usage: mount <dataset> <mountpoint>\n");
	return (MOUNT_USAGE);
	}

	dataset = parse_dataset(argv[0]);

	/* canonicalize the mount point */
	if (realpath(argv[1], mntpoint) == NULL) {
	(void) fprintf(stderr, gettext("filesystem '%s' cannot be "
	"mounted at '%s' due to canonicalization error %d.\n"),
	dataset, argv[1], errno);
	return (MOUNT_SYSERR);
	}

	/* validate mount options and set mntflags */
	error = zfs_parse_mount_options(mntopts, &mntflags, &zfsflags, sloppy,
	badopt, mtabopt);
	if (error) {
	switch (error) {
	case ENOMEM:
	(void) fprintf(stderr, gettext("filesystem '%s' "
	"cannot be mounted due to a memory allocation "
	"failure.\n"), dataset);
	return (MOUNT_SYSERR);
	case ENOENT:
	(void) fprintf(stderr, gettext("filesystem '%s' "
	"cannot be mounted due to invalid option "
	"'%s'.\n"), dataset, badopt);
	(void) fprintf(stderr, gettext("Use the '-s' option "
	"to ignore the bad mount option.\n"));
	return (MOUNT_USAGE);
	default:
	(void) fprintf(stderr, gettext("filesystem '%s' "
	"cannot be mounted due to internal error %d.\n"),
	dataset, error);
	return (MOUNT_SOFTWARE);
	}
	}

	if (verbose)
	(void) fprintf(stdout, gettext("mount.zfs:\n"
	" dataset: \"%s\"\n mountpoint: \"%s\"\n"
	" mountflags: 0x%lx\n zfsflags: 0x%lx\n"
	" mountopts: \"%s\"\n mtabopts: \"%s\"\n"),
	dataset, mntpoint, mntflags, zfsflags, mntopts, mtabopt);

	if (mntflags & MS_REMOUNT) {
	nomtab = 1;
	remount = 1;
	}

	if (zfsflags & ZS_ZFSUTIL)
	zfsutil = 1;

	if ((g_zfs = libzfs_init()) == NULL) {
	(void) fprintf(stderr, "%s\n", libzfs_error_init(errno));
	return (MOUNT_SYSERR);
	}

	/* try to open the dataset to access the mount point */
	if ((zhp = zfs_open(g_zfs, dataset,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT)) == NULL) {
	(void) fprintf(stderr, gettext("filesystem '%s' cannot be "
	"mounted, unable to open the dataset\n"), dataset);
	libzfs_fini(g_zfs);
	return (MOUNT_USAGE);
	}

	zfs_adjust_mount_options(zhp, mntpoint, mntopts, mtabopt);

	/* treat all snapshots as legacy mount points */
	if (zfs_get_type(zhp) == ZFS_TYPE_SNAPSHOT)
	(void) strlcpy(prop, ZFS_MOUNTPOINT_LEGACY, ZFS_MAXPROPLEN);
	else
	(void) zfs_prop_get(zhp, ZFS_PROP_MOUNTPOINT, prop,
	sizeof (prop), NULL, NULL, 0, B_FALSE);

	/*
	* Fetch the max supported zfs version in case we get ENOTSUP
	* back from the mount command, since we need the zfs handle
	* to do so.
	*/
	zfs_version = zfs_prop_get_int(zhp, ZFS_PROP_VERSION);
	if (zfs_version == 0) {
	fprintf(stderr, gettext("unable to fetch "
	"ZFS version for filesystem '%s'\n"), dataset);
	return (MOUNT_SYSERR);
	}

	zfs_close(zhp);
	libzfs_fini(g_zfs);

	/*
	* Legacy mount points may only be mounted using 'mount', never using
	* 'zfs mount'. However, since 'zfs mount' actually invokes 'mount'
	* we differentiate the two cases using the 'zfsutil' mount option.
	* This mount option should only be supplied by the 'zfs mount' util.
	*
	* The only exception to the above rule is '-o remount' which is
	* always allowed for non-legacy datasets. This is done because when
	* using zfs as your root file system both rc.sysinit/umountroot and
	* systemd depend on 'mount -o remount <mountpoint>' to work.
	*/
	if (zfsutil && (strcmp(prop, ZFS_MOUNTPOINT_LEGACY) == 0)) {
	(void) fprintf(stderr, gettext(
	"filesystem '%s' cannot be mounted using 'zfs mount'.\n"
	"Use 'zfs set mountpoint=%s' or 'mount -t zfs %s %s'.\n"
	"See zfs(8) for more information.\n"),
	dataset, mntpoint, dataset, mntpoint);
	return (MOUNT_USAGE);
	}

	if (!zfsutil && !(remount \|\| fake) &&
	strcmp(prop, ZFS_MOUNTPOINT_LEGACY)) {
	(void) fprintf(stderr, gettext(
	"filesystem '%s' cannot be mounted using 'mount'.\n"
	"Use 'zfs set mountpoint=%s' or 'zfs mount %s'.\n"
	"See zfs(8) for more information.\n"),
	dataset, "legacy", dataset);
	return (MOUNT_USAGE);
	}

	if (!fake) {
	error = mount(dataset, mntpoint, MNTTYPE_ZFS,
	mntflags, mntopts);
	}

	if (error) {
	switch (errno) {
	case ENOENT:
	(void) fprintf(stderr, gettext("mount point "
	"'%s' does not exist\n"), mntpoint);
	return (MOUNT_SYSERR);
	case EBUSY:
	(void) fprintf(stderr, gettext("filesystem "
	"'%s' is already mounted\n"), dataset);
	return (MOUNT_BUSY);
	case ENOTSUP:
	if (zfs_version > ZPL_VERSION) {
	(void) fprintf(stderr,
	gettext("filesystem '%s' (v%d) is not "
	"supported by this implementation of "
	"ZFS (max v%d).\n"), dataset,
	(int)zfs_version, (int)ZPL_VERSION);
	} else {
	(void) fprintf(stderr,
	gettext("filesystem '%s' mount "
	"failed for unknown reason.\n"), dataset);
	}
	return (MOUNT_SYSERR);
	#ifdef MS_MANDLOCK
	case EPERM:
	if (mntflags & MS_MANDLOCK) {
	(void) fprintf(stderr, gettext("filesystem "
	"'%s' has the 'nbmand=on' property set, "
	"this mount\noption may be disabled in "
	"your kernel. Use 'zfs set nbmand=off'\n"
	"to disable this option and try to "
	"mount the filesystem again.\n"), dataset);
	return (MOUNT_SYSERR);
	}
	/* fallthru */
	#endif
	default:
	(void) fprintf(stderr, gettext("filesystem "
	"'%s' can not be mounted: %s\n"), dataset,
	strerror(errno));
	return (MOUNT_USAGE);
	}
	}

	if (!nomtab && mtab_is_writeable()) {
	error = mtab_update(dataset, mntpoint, MNTTYPE_ZFS, mtabopt);
	if (error)
	return (error);
	}

	return (MOUNT_SUCCESS);
	}
	Index: vendor-sys/openzfs/dist/cmd/zdb/zdb.c
	===================================================================
	--- vendor-sys/openzfs/dist/cmd/zdb/zdb.c (revision 365891)
	+++ vendor-sys/openzfs/dist/cmd/zdb/zdb.c (revision 365892)
	@@ -1,8606 +1,8598 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2019 by Delphix. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright 2016 Nexenta Systems, Inc.
	* Copyright (c) 2017, 2018 Lawrence Livermore National Security, LLC.
	* Copyright (c) 2015, 2017, Intel Corporation.
	* Copyright (c) 2020 Datto Inc.
	* Copyright (c) 2020, The FreeBSD Foundation [1]
	*
	* [1] Portions of this software were developed by Allan Jude
	* under sponsorship from the FreeBSD Foundation.
	*/

	#include <stdio.h>
	#include <unistd.h>
	#include <stdlib.h>
	#include <ctype.h>
	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/dmu.h>
	#include <sys/zap.h>
	#include <sys/fs/zfs.h>
	#include <sys/zfs_znode.h>
	#include <sys/zfs_sa.h>
	#include <sys/sa.h>
	#include <sys/sa_impl.h>
	#include <sys/vdev.h>
	#include <sys/vdev_impl.h>
	#include <sys/metaslab_impl.h>
	#include <sys/dmu_objset.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_pool.h>
	#include <sys/dsl_bookmark.h>
	#include <sys/dbuf.h>
	#include <sys/zil.h>
	#include <sys/zil_impl.h>
	#include <sys/stat.h>
	#include <sys/resource.h>
	#include <sys/dmu_send.h>
	#include <sys/dmu_traverse.h>
	#include <sys/zio_checksum.h>
	#include <sys/zio_compress.h>
	#include <sys/zfs_fuid.h>
	#include <sys/arc.h>
	#include <sys/arc_impl.h>
	#include <sys/ddt.h>
	#include <sys/zfeature.h>
	#include <sys/abd.h>
	#include <sys/blkptr.h>
	#include <sys/dsl_crypt.h>
	#include <sys/dsl_scan.h>
	#include <sys/btree.h>
	#include <zfs_comutil.h>
	#include <sys/zstd/zstd.h>

	#include <libnvpair.h>
	#include <libzutil.h>

	#include "zdb.h"

	#define ZDB_COMPRESS_NAME(idx) ((idx) < ZIO_COMPRESS_FUNCTIONS ? \
	zio_compress_table[(idx)].ci_name : "UNKNOWN")
	#define ZDB_CHECKSUM_NAME(idx) ((idx) < ZIO_CHECKSUM_FUNCTIONS ? \
	zio_checksum_table[(idx)].ci_name : "UNKNOWN")
	#define ZDB_OT_TYPE(idx) ((idx) < DMU_OT_NUMTYPES ? (idx) : \
	(idx) == DMU_OTN_ZAP_DATA \|\| (idx) == DMU_OTN_ZAP_METADATA ? \
	DMU_OT_ZAP_OTHER : \
	(idx) == DMU_OTN_UINT64_DATA \|\| (idx) == DMU_OTN_UINT64_METADATA ? \
	DMU_OT_UINT64_OTHER : DMU_OT_NUMTYPES)

	static char *
	zdb_ot_name(dmu_object_type_t type)
	{
	if (type < DMU_OT_NUMTYPES)
	return (dmu_ot[type].ot_name);
	else if ((type & DMU_OT_NEWTYPE) &&
	((type & DMU_OT_BYTESWAP_MASK) < DMU_BSWAP_NUMFUNCS))
	return (dmu_ot_byteswap[type & DMU_OT_BYTESWAP_MASK].ob_name);
	else
	return ("UNKNOWN");
	}

	extern int reference_tracking_enable;
	extern int zfs_recover;
	extern unsigned long zfs_arc_meta_min, zfs_arc_meta_limit;
	extern int zfs_vdev_async_read_max_active;
	extern boolean_t spa_load_verify_dryrun;
	extern int zfs_reconstruct_indirect_combinations_max;
	extern int zfs_btree_verify_intensity;

	static const char cmdname[] = "zdb";
	uint8_t dump_opt[256];

	typedef void object_viewer_t(objset_t , uint64_t, void data, size_t size);

	uint64_t *zopt_metaslab = NULL;
	static unsigned zopt_metaslab_args = 0;

	typedef struct zopt_object_range {
	uint64_t zor_obj_start;
	uint64_t zor_obj_end;
	uint64_t zor_flags;
	} zopt_object_range_t;
	zopt_object_range_t *zopt_object_ranges = NULL;
	static unsigned zopt_object_args = 0;

	static int flagbits[256];

	#define ZOR_FLAG_PLAIN_FILE 0x0001
	#define ZOR_FLAG_DIRECTORY 0x0002
	#define ZOR_FLAG_SPACE_MAP 0x0004
	#define ZOR_FLAG_ZAP 0x0008
	#define ZOR_FLAG_ALL_TYPES -1
	#define ZOR_SUPPORTED_FLAGS (ZOR_FLAG_PLAIN_FILE \| \
	ZOR_FLAG_DIRECTORY \| \
	ZOR_FLAG_SPACE_MAP \| \
	ZOR_FLAG_ZAP)

	#define ZDB_FLAG_CHECKSUM 0x0001
	#define ZDB_FLAG_DECOMPRESS 0x0002
	#define ZDB_FLAG_BSWAP 0x0004
	#define ZDB_FLAG_GBH 0x0008
	#define ZDB_FLAG_INDIRECT 0x0010
	#define ZDB_FLAG_RAW 0x0020
	#define ZDB_FLAG_PRINT_BLKPTR 0x0040
	#define ZDB_FLAG_VERBOSE 0x0080

	uint64_t max_inflight_bytes = 256 * 1024 * 1024; /* 256MB */
	static int leaked_objects = 0;
	static range_tree_t *mos_refd_objs;

	static void snprintf_blkptr_compact(char , size_t, const blkptr_t ,
	boolean_t);
	static void mos_obj_refd(uint64_t);
	static void mos_obj_refd_multiple(uint64_t);
	static int dump_bpobj_cb(void arg, const blkptr_t bp, boolean_t free,
	dmu_tx_t *tx);

	typedef struct sublivelist_verify {
	/* all ALLOC'd blkptr_t in one sub-livelist */
	zfs_btree_t sv_all_allocs;

	/* all FREE'd blkptr_t in one sub-livelist */
	zfs_btree_t sv_all_frees;

	/* FREE's that haven't yet matched to an ALLOC, in one sub-livelist */
	zfs_btree_t sv_pair;

	/* ALLOC's without a matching FREE, accumulates across sub-livelists */
	zfs_btree_t sv_leftover;
	} sublivelist_verify_t;

	static int
	livelist_compare(const void larg, const void rarg)
	{
	const blkptr_t *l = larg;
	const blkptr_t *r = rarg;

	/* Sort them according to dva[0] */
	uint64_t l_dva0_vdev, r_dva0_vdev;
	l_dva0_vdev = DVA_GET_VDEV(&l->blk_dva[0]);
	r_dva0_vdev = DVA_GET_VDEV(&r->blk_dva[0]);
	if (l_dva0_vdev < r_dva0_vdev)
	return (-1);
	else if (l_dva0_vdev > r_dva0_vdev)
	return (+1);

	/* if vdevs are equal, sort by offsets. */
	uint64_t l_dva0_offset;
	uint64_t r_dva0_offset;
	l_dva0_offset = DVA_GET_OFFSET(&l->blk_dva[0]);
	r_dva0_offset = DVA_GET_OFFSET(&r->blk_dva[0]);
	if (l_dva0_offset < r_dva0_offset) {
	return (-1);
	} else if (l_dva0_offset > r_dva0_offset) {
	return (+1);
	}

	/*
	* Since we're storing blkptrs without cancelling FREE/ALLOC pairs,
	* it's possible the offsets are equal. In that case, sort by txg
	*/
	if (l->blk_birth < r->blk_birth) {
	return (-1);
	} else if (l->blk_birth > r->blk_birth) {
	return (+1);
	}
	return (0);
	}

	typedef struct sublivelist_verify_block {
	dva_t svb_dva;

	/*
	* We need this to check if the block marked as allocated
	* in the livelist was freed (and potentially reallocated)
	* in the metaslab spacemaps at a later TXG.
	*/
	uint64_t svb_allocated_txg;
	} sublivelist_verify_block_t;

	static void zdb_print_blkptr(const blkptr_t *bp, int flags);

	static int
	sublivelist_verify_blkptr(void arg, const blkptr_t bp, boolean_t free,
	dmu_tx_t *tx)
	{
	ASSERT3P(tx, ==, NULL);
	struct sublivelist_verify *sv = arg;
	char blkbuf[BP_SPRINTF_LEN];
	zfs_btree_index_t where;
	if (free) {
	zfs_btree_add(&sv->sv_pair, bp);
	/* Check if the FREE is a duplicate */
	if (zfs_btree_find(&sv->sv_all_frees, bp, &where) != NULL) {
	snprintf_blkptr_compact(blkbuf, sizeof (blkbuf), bp,
	free);
	(void) printf("\tERROR: Duplicate FREE: %s\n", blkbuf);
	} else {
	zfs_btree_add_idx(&sv->sv_all_frees, bp, &where);
	}
	} else {
	/* Check if the ALLOC has been freed */
	if (zfs_btree_find(&sv->sv_pair, bp, &where) != NULL) {
	zfs_btree_remove_idx(&sv->sv_pair, &where);
	} else {
	for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
	if (DVA_IS_EMPTY(&bp->blk_dva[i]))
	break;
	sublivelist_verify_block_t svb = {
	.svb_dva = bp->blk_dva[i],
	.svb_allocated_txg = bp->blk_birth
	};

	if (zfs_btree_find(&sv->sv_leftover, &svb,
	&where) == NULL) {
	zfs_btree_add_idx(&sv->sv_leftover,
	&svb, &where);
	}
	}
	}
	/* Check if the ALLOC is a duplicate */
	if (zfs_btree_find(&sv->sv_all_allocs, bp, &where) != NULL) {
	snprintf_blkptr_compact(blkbuf, sizeof (blkbuf), bp,
	free);
	(void) printf("\tERROR: Duplicate ALLOC: %s\n", blkbuf);
	} else {
	zfs_btree_add_idx(&sv->sv_all_allocs, bp, &where);
	}
	}
	return (0);
	}

	static int
	sublivelist_verify_func(void args, dsl_deadlist_entry_t dle)
	{
	int err;
	char blkbuf[BP_SPRINTF_LEN];
	struct sublivelist_verify *sv = args;

	zfs_btree_create(&sv->sv_all_allocs, livelist_compare,
	sizeof (blkptr_t));

	zfs_btree_create(&sv->sv_all_frees, livelist_compare,
	sizeof (blkptr_t));

	zfs_btree_create(&sv->sv_pair, livelist_compare,
	sizeof (blkptr_t));

	err = bpobj_iterate_nofree(&dle->dle_bpobj, sublivelist_verify_blkptr,
	sv, NULL);

	zfs_btree_clear(&sv->sv_all_allocs);
	zfs_btree_destroy(&sv->sv_all_allocs);

	zfs_btree_clear(&sv->sv_all_frees);
	zfs_btree_destroy(&sv->sv_all_frees);

	blkptr_t *e;
	zfs_btree_index_t *cookie = NULL;
	while ((e = zfs_btree_destroy_nodes(&sv->sv_pair, &cookie)) != NULL) {
	snprintf_blkptr_compact(blkbuf, sizeof (blkbuf), e, B_TRUE);
	(void) printf("\tERROR: Unmatched FREE: %s\n", blkbuf);
	}
	zfs_btree_destroy(&sv->sv_pair);

	return (err);
	}

	static int
	livelist_block_compare(const void larg, const void rarg)
	{
	const sublivelist_verify_block_t *l = larg;
	const sublivelist_verify_block_t *r = rarg;

	if (DVA_GET_VDEV(&l->svb_dva) < DVA_GET_VDEV(&r->svb_dva))
	return (-1);
	else if (DVA_GET_VDEV(&l->svb_dva) > DVA_GET_VDEV(&r->svb_dva))
	return (+1);

	if (DVA_GET_OFFSET(&l->svb_dva) < DVA_GET_OFFSET(&r->svb_dva))
	return (-1);
	else if (DVA_GET_OFFSET(&l->svb_dva) > DVA_GET_OFFSET(&r->svb_dva))
	return (+1);

	if (DVA_GET_ASIZE(&l->svb_dva) < DVA_GET_ASIZE(&r->svb_dva))
	return (-1);
	else if (DVA_GET_ASIZE(&l->svb_dva) > DVA_GET_ASIZE(&r->svb_dva))
	return (+1);

	return (0);
	}

	/*
	* Check for errors in a livelist while tracking all unfreed ALLOCs in the
	* sublivelist_verify_t: sv->sv_leftover
	*/
	static void
	livelist_verify(dsl_deadlist_t dl, void arg)
	{
	sublivelist_verify_t *sv = arg;
	dsl_deadlist_iterate(dl, sublivelist_verify_func, sv);
	}

	/*
	* Check for errors in the livelist entry and discard the intermediary
	* data structures
	*/
	/* ARGSUSED */
	static int
	sublivelist_verify_lightweight(void args, dsl_deadlist_entry_t dle)
	{
	sublivelist_verify_t sv;
	zfs_btree_create(&sv.sv_leftover, livelist_block_compare,
	sizeof (sublivelist_verify_block_t));
	int err = sublivelist_verify_func(&sv, dle);
	zfs_btree_clear(&sv.sv_leftover);
	zfs_btree_destroy(&sv.sv_leftover);
	return (err);
	}

	typedef struct metaslab_verify {
	/*
	* Tree containing all the leftover ALLOCs from the livelists
	* that are part of this metaslab.
	*/
	zfs_btree_t mv_livelist_allocs;

	/*
	* Metaslab information.
	*/
	uint64_t mv_vdid;
	uint64_t mv_msid;
	uint64_t mv_start;
	uint64_t mv_end;

	/*
	* What's currently allocated for this metaslab.
	*/
	range_tree_t *mv_allocated;
	} metaslab_verify_t;

	typedef void ll_iter_t(dsl_deadlist_t ll, void arg);

	typedef int (zdb_log_sm_cb_t)(spa_t spa, space_map_entry_t *sme, uint64_t txg,
	void *arg);

	typedef struct unflushed_iter_cb_arg {
	spa_t *uic_spa;
	uint64_t uic_txg;
	void *uic_arg;
	zdb_log_sm_cb_t uic_cb;
	} unflushed_iter_cb_arg_t;

	static int
	iterate_through_spacemap_logs_cb(space_map_entry_t sme, void arg)
	{
	unflushed_iter_cb_arg_t *uic = arg;
	return (uic->uic_cb(uic->uic_spa, sme, uic->uic_txg, uic->uic_arg));
	}

	static void
	iterate_through_spacemap_logs(spa_t spa, zdb_log_sm_cb_t cb, void arg)
	{
	if (!spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP))
	return;

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	for (spa_log_sm_t *sls = avl_first(&spa->spa_sm_logs_by_txg);
	sls; sls = AVL_NEXT(&spa->spa_sm_logs_by_txg, sls)) {
	space_map_t *sm = NULL;
	VERIFY0(space_map_open(&sm, spa_meta_objset(spa),
	sls->sls_sm_obj, 0, UINT64_MAX, SPA_MINBLOCKSHIFT));

	unflushed_iter_cb_arg_t uic = {
	.uic_spa = spa,
	.uic_txg = sls->sls_txg,
	.uic_arg = arg,
	.uic_cb = cb
	};
	VERIFY0(space_map_iterate(sm, space_map_length(sm),
	iterate_through_spacemap_logs_cb, &uic));
	space_map_close(sm);
	}
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	}

	static void
	verify_livelist_allocs(metaslab_verify_t *mv, uint64_t txg,
	uint64_t offset, uint64_t size)
	{
	sublivelist_verify_block_t svb;
	DVA_SET_VDEV(&svb.svb_dva, mv->mv_vdid);
	DVA_SET_OFFSET(&svb.svb_dva, offset);
	DVA_SET_ASIZE(&svb.svb_dva, size);
	zfs_btree_index_t where;
	uint64_t end_offset = offset + size;

	/*
	* Look for an exact match for spacemap entry in the livelist entries.
	* Then, look for other livelist entries that fall within the range
	* of the spacemap entry as it may have been condensed
	*/
	sublivelist_verify_block_t *found =
	zfs_btree_find(&mv->mv_livelist_allocs, &svb, &where);
	if (found == NULL) {
	found = zfs_btree_next(&mv->mv_livelist_allocs, &where, &where);
	}
	for (; found != NULL && DVA_GET_VDEV(&found->svb_dva) == mv->mv_vdid &&
	DVA_GET_OFFSET(&found->svb_dva) < end_offset;
	found = zfs_btree_next(&mv->mv_livelist_allocs, &where, &where)) {
	if (found->svb_allocated_txg <= txg) {
	(void) printf("ERROR: Livelist ALLOC [%llx:%llx] "
	"from TXG %llx FREED at TXG %llx\n",
	(u_longlong_t)DVA_GET_OFFSET(&found->svb_dva),
	(u_longlong_t)DVA_GET_ASIZE(&found->svb_dva),
	(u_longlong_t)found->svb_allocated_txg,
	(u_longlong_t)txg);
	}
	}
	}

	static int
	metaslab_spacemap_validation_cb(space_map_entry_t sme, void arg)
	{
	metaslab_verify_t *mv = arg;
	uint64_t offset = sme->sme_offset;
	uint64_t size = sme->sme_run;
	uint64_t txg = sme->sme_txg;

	if (sme->sme_type == SM_ALLOC) {
	if (range_tree_contains(mv->mv_allocated,
	offset, size)) {
	(void) printf("ERROR: DOUBLE ALLOC: "
	"%llu [%llx:%llx] "
	"%llu:%llu LOG_SM\n",
	(u_longlong_t)txg, (u_longlong_t)offset,
	(u_longlong_t)size, (u_longlong_t)mv->mv_vdid,
	(u_longlong_t)mv->mv_msid);
	} else {
	range_tree_add(mv->mv_allocated,
	offset, size);
	}
	} else {
	if (!range_tree_contains(mv->mv_allocated,
	offset, size)) {
	(void) printf("ERROR: DOUBLE FREE: "
	"%llu [%llx:%llx] "
	"%llu:%llu LOG_SM\n",
	(u_longlong_t)txg, (u_longlong_t)offset,
	(u_longlong_t)size, (u_longlong_t)mv->mv_vdid,
	(u_longlong_t)mv->mv_msid);
	} else {
	range_tree_remove(mv->mv_allocated,
	offset, size);
	}
	}

	if (sme->sme_type != SM_ALLOC) {
	/*
	* If something is freed in the spacemap, verify that
	* it is not listed as allocated in the livelist.
	*/
	verify_livelist_allocs(mv, txg, offset, size);
	}
	return (0);
	}

	static int
	spacemap_check_sm_log_cb(spa_t spa, space_map_entry_t sme,
	uint64_t txg, void *arg)
	{
	metaslab_verify_t *mv = arg;
	uint64_t offset = sme->sme_offset;
	uint64_t vdev_id = sme->sme_vdev;

	vdev_t *vd = vdev_lookup_top(spa, vdev_id);

	/* skip indirect vdevs */
	if (!vdev_is_concrete(vd))
	return (0);

	if (vdev_id != mv->mv_vdid)
	return (0);

	metaslab_t *ms = vd->vdev_ms[offset >> vd->vdev_ms_shift];
	if (ms->ms_id != mv->mv_msid)
	return (0);

	if (txg < metaslab_unflushed_txg(ms))
	return (0);


	ASSERT3U(txg, ==, sme->sme_txg);
	return (metaslab_spacemap_validation_cb(sme, mv));
	}

	static void
	spacemap_check_sm_log(spa_t spa, metaslab_verify_t mv)
	{
	iterate_through_spacemap_logs(spa, spacemap_check_sm_log_cb, mv);
	}

	static void
	spacemap_check_ms_sm(space_map_t sm, metaslab_verify_t mv)
	{
	if (sm == NULL)
	return;

	VERIFY0(space_map_iterate(sm, space_map_length(sm),
	metaslab_spacemap_validation_cb, mv));
	}

	static void iterate_deleted_livelists(spa_t spa, ll_iter_t func, void arg);

	/*
	* Transfer blocks from sv_leftover tree to the mv_livelist_allocs if
	* they are part of that metaslab (mv_msid).
	*/
	static void
	mv_populate_livelist_allocs(metaslab_verify_t mv, sublivelist_verify_t sv)
	{
	zfs_btree_index_t where;
	sublivelist_verify_block_t *svb;
	ASSERT3U(zfs_btree_numnodes(&mv->mv_livelist_allocs), ==, 0);
	for (svb = zfs_btree_first(&sv->sv_leftover, &where);
	svb != NULL;
	svb = zfs_btree_next(&sv->sv_leftover, &where, &where)) {
	if (DVA_GET_VDEV(&svb->svb_dva) != mv->mv_vdid)
	continue;

	if (DVA_GET_OFFSET(&svb->svb_dva) < mv->mv_start &&
	(DVA_GET_OFFSET(&svb->svb_dva) +
	DVA_GET_ASIZE(&svb->svb_dva)) > mv->mv_start) {
	(void) printf("ERROR: Found block that crosses "
	"metaslab boundary: <%llu:%llx:%llx>\n",
	(u_longlong_t)DVA_GET_VDEV(&svb->svb_dva),
	(u_longlong_t)DVA_GET_OFFSET(&svb->svb_dva),
	(u_longlong_t)DVA_GET_ASIZE(&svb->svb_dva));
	continue;
	}

	if (DVA_GET_OFFSET(&svb->svb_dva) < mv->mv_start)
	continue;

	if (DVA_GET_OFFSET(&svb->svb_dva) >= mv->mv_end)
	continue;

	if ((DVA_GET_OFFSET(&svb->svb_dva) +
	DVA_GET_ASIZE(&svb->svb_dva)) > mv->mv_end) {
	(void) printf("ERROR: Found block that crosses "
	"metaslab boundary: <%llu:%llx:%llx>\n",
	(u_longlong_t)DVA_GET_VDEV(&svb->svb_dva),
	(u_longlong_t)DVA_GET_OFFSET(&svb->svb_dva),
	(u_longlong_t)DVA_GET_ASIZE(&svb->svb_dva));
	continue;
	}

	zfs_btree_add(&mv->mv_livelist_allocs, svb);
	}

	for (svb = zfs_btree_first(&mv->mv_livelist_allocs, &where);
	svb != NULL;
	svb = zfs_btree_next(&mv->mv_livelist_allocs, &where, &where)) {
	zfs_btree_remove(&sv->sv_leftover, svb);
	}
	}

	/*
	* [Livelist Check]
	* Iterate through all the sublivelists and:
	* - report leftover frees
	* - report double ALLOCs/FREEs
	* - record leftover ALLOCs together with their TXG [see Cross Check]
	*
	* [Spacemap Check]
	* for each metaslab:
	* - iterate over spacemap and then the metaslab's entries in the
	* spacemap log, then report any double FREEs and ALLOCs (do not
	* blow up).
	*
	* [Cross Check]
	* After finishing the Livelist Check phase and while being in the
	* Spacemap Check phase, we find all the recorded leftover ALLOCs
	* of the livelist check that are part of the metaslab that we are
	* currently looking at in the Spacemap Check. We report any entries
	* that are marked as ALLOCs in the livelists but have been actually
	* freed (and potentially allocated again) after their TXG stamp in
	* the spacemaps. Also report any ALLOCs from the livelists that
	* belong to indirect vdevs (e.g. their vdev completed removal).
	*
	* Note that this will miss Log Spacemap entries that cancelled each other
	* out before being flushed to the metaslab, so we are not guaranteed
	* to match all erroneous ALLOCs.
	*/
	static void
	livelist_metaslab_validate(spa_t *spa)
	{
	(void) printf("Verifying deleted livelist entries\n");

	sublivelist_verify_t sv;
	zfs_btree_create(&sv.sv_leftover, livelist_block_compare,
	sizeof (sublivelist_verify_block_t));
	iterate_deleted_livelists(spa, livelist_verify, &sv);

	(void) printf("Verifying metaslab entries\n");
	vdev_t *rvd = spa->spa_root_vdev;
	for (uint64_t c = 0; c < rvd->vdev_children; c++) {
	vdev_t *vd = rvd->vdev_child[c];

	if (!vdev_is_concrete(vd))
	continue;

	for (uint64_t mid = 0; mid < vd->vdev_ms_count; mid++) {
	metaslab_t *m = vd->vdev_ms[mid];

	(void) fprintf(stderr,
	"\rverifying concrete vdev %llu, "
	"metaslab %llu of %llu ...",
	(longlong_t)vd->vdev_id,
	(longlong_t)mid,
	(longlong_t)vd->vdev_ms_count);

	uint64_t shift, start;
	range_seg_type_t type =
	metaslab_calculate_range_tree_type(vd, m,
	&start, &shift);
	metaslab_verify_t mv;
	mv.mv_allocated = range_tree_create(NULL,
	type, NULL, start, shift);
	mv.mv_vdid = vd->vdev_id;
	mv.mv_msid = m->ms_id;
	mv.mv_start = m->ms_start;
	mv.mv_end = m->ms_start + m->ms_size;
	zfs_btree_create(&mv.mv_livelist_allocs,
	livelist_block_compare,
	sizeof (sublivelist_verify_block_t));

	mv_populate_livelist_allocs(&mv, &sv);

	spacemap_check_ms_sm(m->ms_sm, &mv);
	spacemap_check_sm_log(spa, &mv);

	range_tree_vacate(mv.mv_allocated, NULL, NULL);
	range_tree_destroy(mv.mv_allocated);
	zfs_btree_clear(&mv.mv_livelist_allocs);
	zfs_btree_destroy(&mv.mv_livelist_allocs);
	}
	}
	(void) fprintf(stderr, "\n");

	/*
	* If there are any segments in the leftover tree after we walked
	* through all the metaslabs in the concrete vdevs then this means
	* that we have segments in the livelists that belong to indirect
	* vdevs and are marked as allocated.
	*/
	if (zfs_btree_numnodes(&sv.sv_leftover) == 0) {
	zfs_btree_destroy(&sv.sv_leftover);
	return;
	}
	(void) printf("ERROR: Found livelist blocks marked as allocated "
	"for indirect vdevs:\n");

	zfs_btree_index_t *where = NULL;
	sublivelist_verify_block_t *svb;
	while ((svb = zfs_btree_destroy_nodes(&sv.sv_leftover, &where)) !=
	NULL) {
	int vdev_id = DVA_GET_VDEV(&svb->svb_dva);
	ASSERT3U(vdev_id, <, rvd->vdev_children);
	vdev_t *vd = rvd->vdev_child[vdev_id];
	ASSERT(!vdev_is_concrete(vd));
	(void) printf("<%d:%llx:%llx> TXG %llx\n",
	vdev_id, (u_longlong_t)DVA_GET_OFFSET(&svb->svb_dva),
	(u_longlong_t)DVA_GET_ASIZE(&svb->svb_dva),
	(u_longlong_t)svb->svb_allocated_txg);
	}
	(void) printf("\n");
	zfs_btree_destroy(&sv.sv_leftover);
	}

	/*
	* These libumem hooks provide a reasonable set of defaults for the allocator's
	* debugging facilities.
	*/
	const char *
	_umem_debug_init(void)
	{
	return ("default,verbose"); /* $UMEM_DEBUG setting */
	}

	const char *
	_umem_logging_init(void)
	{
	return ("fail,contents"); /* $UMEM_LOGGING setting */
	}

	static void
	usage(void)
	{
	(void) fprintf(stderr,
	"Usage:\t%s [-AbcdDFGhikLMPsvXy] [-e [-V] [-p <path> ...]] "
	"[-I <inflight I/Os>]\n"
	"\t\t[-o <var>=<value>]... [-t <txg>] [-U <cache>] [-x <dumpdir>]\n"
	"\t\t[<poolname>[/<dataset \| objset id>] [<object \| range> ...]]\n"
	"\t%s [-AdiPv] [-e [-V] [-p <path> ...]] [-U <cache>]\n"
	"\t\t[<poolname>[/<dataset \| objset id>] [<object \| range> ...]\n"
	"\t%s [-v] <bookmark>\n"
	"\t%s -C [-A] [-U <cache>]\n"
	"\t%s -l [-Aqu] <device>\n"
	"\t%s -m [-AFLPX] [-e [-V] [-p <path> ...]] [-t <txg>] "
	"[-U <cache>]\n\t\t<poolname> [<vdev> [<metaslab> ...]]\n"
	"\t%s -O <dataset> <path>\n"
	"\t%s -R [-A] [-e [-V] [-p <path> ...]] [-U <cache>]\n"
	"\t\t<poolname> <vdev>:<offset>:<size>[:<flags>]\n"
	"\t%s -E [-A] word0:word1:...:word15\n"
	"\t%s -S [-AP] [-e [-V] [-p <path> ...]] [-U <cache>] "
	"<poolname>\n\n",
	cmdname, cmdname, cmdname, cmdname, cmdname, cmdname, cmdname,
	cmdname, cmdname, cmdname);

	(void) fprintf(stderr, " Dataset name must include at least one "
	"separator character '/' or '@'\n");
	(void) fprintf(stderr, " If dataset name is specified, only that "
	"dataset is dumped\n");
	(void) fprintf(stderr, " If object numbers or object number "
	"ranges are specified, only those\n"
	" objects or ranges are dumped.\n\n");
	(void) fprintf(stderr,
	" Object ranges take the form <start>:<end>[:<flags>]\n"
	" start Starting object number\n"
	" end Ending object number, or -1 for no upper bound\n"
	" flags Optional flags to select object types:\n"
	" A All objects (this is the default)\n"
	" d ZFS directories\n"
	" f ZFS files \n"
	" m SPA space maps\n"
	" z ZAPs\n"
	" - Negate effect of next flag\n\n");
	(void) fprintf(stderr, " Options to control amount of output:\n");
	(void) fprintf(stderr, " -b block statistics\n");
	(void) fprintf(stderr, " -c checksum all metadata (twice for "
	"all data) blocks\n");
	(void) fprintf(stderr, " -C config (or cachefile if alone)\n");
	(void) fprintf(stderr, " -d dataset(s)\n");
	(void) fprintf(stderr, " -D dedup statistics\n");
	(void) fprintf(stderr, " -E decode and display block from an "
	"embedded block pointer\n");
	(void) fprintf(stderr, " -h pool history\n");
	(void) fprintf(stderr, " -i intent logs\n");
	(void) fprintf(stderr, " -l read label contents\n");
	(void) fprintf(stderr, " -k examine the checkpointed state "
	"of the pool\n");
	(void) fprintf(stderr, " -L disable leak tracking (do not "
	"load spacemaps)\n");
	(void) fprintf(stderr, " -m metaslabs\n");
	(void) fprintf(stderr, " -M metaslab groups\n");
	(void) fprintf(stderr, " -O perform object lookups by path\n");
	(void) fprintf(stderr, " -R read and display block from a "
	"device\n");
	(void) fprintf(stderr, " -s report stats on zdb's I/O\n");
	(void) fprintf(stderr, " -S simulate dedup to measure effect\n");
	(void) fprintf(stderr, " -v verbose (applies to all "
	"others)\n");
	(void) fprintf(stderr, " -y perform livelist and metaslab "
	"validation on any livelists being deleted\n\n");
	(void) fprintf(stderr, " Below options are intended for use "
	"with other options:\n");
	(void) fprintf(stderr, " -A ignore assertions (-A), enable "
	"panic recovery (-AA) or both (-AAA)\n");
	(void) fprintf(stderr, " -e pool is exported/destroyed/"
	"has altroot/not in a cachefile\n");
	(void) fprintf(stderr, " -F attempt automatic rewind within "
	"safe range of transaction groups\n");
	(void) fprintf(stderr, " -G dump zfs_dbgmsg buffer before "
	"exiting\n");
	(void) fprintf(stderr, " -I <number of inflight I/Os> -- "
	"specify the maximum number of\n "
	"checksumming I/Os [default is 200]\n");
	(void) fprintf(stderr, " -o <variable>=<value> set global "
	"variable to an unsigned 32-bit integer\n");
	(void) fprintf(stderr, " -p <path> -- use one or more with "
	"-e to specify path to vdev dir\n");
	(void) fprintf(stderr, " -P print numbers in parseable form\n");
	(void) fprintf(stderr, " -q don't print label contents\n");
	(void) fprintf(stderr, " -t <txg> -- highest txg to use when "
	"searching for uberblocks\n");
	(void) fprintf(stderr, " -u uberblock\n");
	(void) fprintf(stderr, " -U <cachefile_path> -- use alternate "
	"cachefile\n");
	(void) fprintf(stderr, " -V do verbatim import\n");
	(void) fprintf(stderr, " -x <dumpdir> -- "
	"dump all read blocks into specified directory\n");
	(void) fprintf(stderr, " -X attempt extreme rewind (does not "
	"work with dataset)\n");
	(void) fprintf(stderr, " -Y attempt all reconstruction "
	"combinations for split blocks\n");
	(void) fprintf(stderr, " -Z show ZSTD headers \n");
	(void) fprintf(stderr, "Specify an option more than once (e.g. -bb) "
	"to make only that option verbose\n");
	(void) fprintf(stderr, "Default is to dump everything non-verbosely\n");
	exit(1);
	}

	static void
	dump_debug_buffer(void)
	{
	if (dump_opt['G']) {
	(void) printf("\n");
	(void) fflush(stdout);
	zfs_dbgmsg_print("zdb");
	}
	}

	/*
	* Called for usage errors that are discovered after a call to spa_open(),
	* dmu_bonus_hold(), or pool_match(). abort() is called for other errors.
	*/

	static void
	fatal(const char *fmt, ...)
	{
	va_list ap;

	va_start(ap, fmt);
	(void) fprintf(stderr, "%s: ", cmdname);
	(void) vfprintf(stderr, fmt, ap);
	va_end(ap);
	(void) fprintf(stderr, "\n");

	dump_debug_buffer();

	exit(1);
	}

	/* ARGSUSED */
	static void
	dump_packed_nvlist(objset_t os, uint64_t object, void data, size_t size)
	{
	nvlist_t *nv;
	size_t nvsize = (uint64_t )data;
	char *packed = umem_alloc(nvsize, UMEM_NOFAIL);

	VERIFY(0 == dmu_read(os, object, 0, nvsize, packed, DMU_READ_PREFETCH));

	VERIFY(nvlist_unpack(packed, nvsize, &nv, 0) == 0);

	umem_free(packed, nvsize);

	dump_nvlist(nv, 8);

	nvlist_free(nv);
	}

	/* ARGSUSED */
	static void
	dump_history_offsets(objset_t os, uint64_t object, void data, size_t size)
	{
	spa_history_phys_t *shp = data;

	if (shp == NULL)
	return;

	(void) printf("\t\tpool_create_len = %llu\n",
	(u_longlong_t)shp->sh_pool_create_len);
	(void) printf("\t\tphys_max_off = %llu\n",
	(u_longlong_t)shp->sh_phys_max_off);
	(void) printf("\t\tbof = %llu\n",
	(u_longlong_t)shp->sh_bof);
	(void) printf("\t\teof = %llu\n",
	(u_longlong_t)shp->sh_eof);
	(void) printf("\t\trecords_lost = %llu\n",
	(u_longlong_t)shp->sh_records_lost);
	}

	static void
	zdb_nicenum(uint64_t num, char *buf, size_t buflen)
	{
	if (dump_opt['P'])
	(void) snprintf(buf, buflen, "%llu", (longlong_t)num);
	else
	nicenum(num, buf, sizeof (buf));
	}

	static const char histo_stars[] = "****************************************";
	static const uint64_t histo_width = sizeof (histo_stars) - 1;

	static void
	dump_histogram(const uint64_t *histo, int size, int offset)
	{
	int i;
	int minidx = size - 1;
	int maxidx = 0;
	uint64_t max = 0;

	for (i = 0; i < size; i++) {
	if (histo[i] > max)
	max = histo[i];
	if (histo[i] > 0 && i > maxidx)
	maxidx = i;
	if (histo[i] > 0 && i < minidx)
	minidx = i;
	}

	if (max < histo_width)
	max = histo_width;

	for (i = minidx; i <= maxidx; i++) {
	(void) printf("\t\t\t%3u: %6llu %s\n",
	i + offset, (u_longlong_t)histo[i],
	&histo_stars[(max - histo[i]) * histo_width / max]);
	}
	}

	static void
	dump_zap_stats(objset_t *os, uint64_t object)
	{
	int error;
	zap_stats_t zs;

	error = zap_get_stats(os, object, &zs);
	if (error)
	return;

	if (zs.zs_ptrtbl_len == 0) {
	ASSERT(zs.zs_num_blocks == 1);
	(void) printf("\tmicrozap: %llu bytes, %llu entries\n",
	(u_longlong_t)zs.zs_blocksize,
	(u_longlong_t)zs.zs_num_entries);
	return;
	}

	(void) printf("\tFat ZAP stats:\n");

	(void) printf("\t\tPointer table:\n");
	(void) printf("\t\t\t%llu elements\n",
	(u_longlong_t)zs.zs_ptrtbl_len);
	(void) printf("\t\t\tzt_blk: %llu\n",
	(u_longlong_t)zs.zs_ptrtbl_zt_blk);
	(void) printf("\t\t\tzt_numblks: %llu\n",
	(u_longlong_t)zs.zs_ptrtbl_zt_numblks);
	(void) printf("\t\t\tzt_shift: %llu\n",
	(u_longlong_t)zs.zs_ptrtbl_zt_shift);
	(void) printf("\t\t\tzt_blks_copied: %llu\n",
	(u_longlong_t)zs.zs_ptrtbl_blks_copied);
	(void) printf("\t\t\tzt_nextblk: %llu\n",
	(u_longlong_t)zs.zs_ptrtbl_nextblk);

	(void) printf("\t\tZAP entries: %llu\n",
	(u_longlong_t)zs.zs_num_entries);
	(void) printf("\t\tLeaf blocks: %llu\n",
	(u_longlong_t)zs.zs_num_leafs);
	(void) printf("\t\tTotal blocks: %llu\n",
	(u_longlong_t)zs.zs_num_blocks);
	(void) printf("\t\tzap_block_type: 0x%llx\n",
	(u_longlong_t)zs.zs_block_type);
	(void) printf("\t\tzap_magic: 0x%llx\n",
	(u_longlong_t)zs.zs_magic);
	(void) printf("\t\tzap_salt: 0x%llx\n",
	(u_longlong_t)zs.zs_salt);

	(void) printf("\t\tLeafs with 2^n pointers:\n");
	dump_histogram(zs.zs_leafs_with_2n_pointers, ZAP_HISTOGRAM_SIZE, 0);

	(void) printf("\t\tBlocks with n*5 entries:\n");
	dump_histogram(zs.zs_blocks_with_n5_entries, ZAP_HISTOGRAM_SIZE, 0);

	(void) printf("\t\tBlocks n/10 full:\n");
	dump_histogram(zs.zs_blocks_n_tenths_full, ZAP_HISTOGRAM_SIZE, 0);

	(void) printf("\t\tEntries with n chunks:\n");
	dump_histogram(zs.zs_entries_using_n_chunks, ZAP_HISTOGRAM_SIZE, 0);

	(void) printf("\t\tBuckets with n entries:\n");
	dump_histogram(zs.zs_buckets_with_n_entries, ZAP_HISTOGRAM_SIZE, 0);
	}

	/ARGSUSED/
	static void
	dump_none(objset_t os, uint64_t object, void data, size_t size)
	{
	}

	/ARGSUSED/
	static void
	dump_unknown(objset_t os, uint64_t object, void data, size_t size)
	{
	(void) printf("\tUNKNOWN OBJECT TYPE\n");
	}

	/ARGSUSED/
	static void
	dump_uint8(objset_t os, uint64_t object, void data, size_t size)
	{
	}

	/ARGSUSED/
	static void
	dump_uint64(objset_t os, uint64_t object, void data, size_t size)
	{
	uint64_t *arr;
	uint64_t oursize;
	if (dump_opt['d'] < 6)
	return;

	if (data == NULL) {
	dmu_object_info_t doi;

	VERIFY0(dmu_object_info(os, object, &doi));
	size = doi.doi_max_offset;
	/*
	* We cap the size at 1 mebibyte here to prevent
	* allocation failures and nigh-infinite printing if the
	* object is extremely large.
	*/
	oursize = MIN(size, 1 << 20);
	arr = kmem_alloc(oursize, KM_SLEEP);

	int err = dmu_read(os, object, 0, oursize, arr, 0);
	if (err != 0) {
	(void) printf("got error %u from dmu_read\n", err);
	kmem_free(arr, oursize);
	return;
	}
	} else {
	/*
	* Even though the allocation is already done in this code path,
	* we still cap the size to prevent excessive printing.
	*/
	oursize = MIN(size, 1 << 20);
	arr = data;
	}

	if (size == 0) {
	(void) printf("\t\t[]\n");
	return;
	}

	(void) printf("\t\t[%0llx", (u_longlong_t)arr[0]);
	for (size_t i = 1; i * sizeof (uint64_t) < oursize; i++) {
	if (i % 4 != 0)
	(void) printf(", %0llx", (u_longlong_t)arr[i]);
	else
	(void) printf(",\n\t\t%0llx", (u_longlong_t)arr[i]);
	}
	if (oursize != size)
	(void) printf(", ... ");
	(void) printf("]\n");

	if (data == NULL)
	kmem_free(arr, oursize);
	}

	/ARGSUSED/
	static void
	dump_zap(objset_t os, uint64_t object, void data, size_t size)
	{
	zap_cursor_t zc;
	zap_attribute_t attr;
	void *prop;
	unsigned i;

	dump_zap_stats(os, object);
	(void) printf("\n");

	for (zap_cursor_init(&zc, os, object);
	zap_cursor_retrieve(&zc, &attr) == 0;
	zap_cursor_advance(&zc)) {
	(void) printf("\t\t%s = ", attr.za_name);
	if (attr.za_num_integers == 0) {
	(void) printf("\n");
	continue;
	}
	prop = umem_zalloc(attr.za_num_integers *
	attr.za_integer_length, UMEM_NOFAIL);
	(void) zap_lookup(os, object, attr.za_name,
	attr.za_integer_length, attr.za_num_integers, prop);
	if (attr.za_integer_length == 1) {
	(void) printf("%s", (char *)prop);
	} else {
	for (i = 0; i < attr.za_num_integers; i++) {
	switch (attr.za_integer_length) {
	case 2:
	(void) printf("%u ",
	((uint16_t *)prop)[i]);
	break;
	case 4:
	(void) printf("%u ",
	((uint32_t *)prop)[i]);
	break;
	case 8:
	(void) printf("%lld ",
	(u_longlong_t)((int64_t *)prop)[i]);
	break;
	}
	}
	}
	(void) printf("\n");
	umem_free(prop, attr.za_num_integers * attr.za_integer_length);
	}
	zap_cursor_fini(&zc);
	}

	static void
	dump_bpobj(objset_t os, uint64_t object, void data, size_t size)
	{
	bpobj_phys_t *bpop = data;
	uint64_t i;
	char bytes[32], comp[32], uncomp[32];

	/* make sure the output won't get truncated */
	CTASSERT(sizeof (bytes) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (comp) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (uncomp) >= NN_NUMBUF_SZ);

	if (bpop == NULL)
	return;

	zdb_nicenum(bpop->bpo_bytes, bytes, sizeof (bytes));
	zdb_nicenum(bpop->bpo_comp, comp, sizeof (comp));
	zdb_nicenum(bpop->bpo_uncomp, uncomp, sizeof (uncomp));

	(void) printf("\t\tnum_blkptrs = %llu\n",
	(u_longlong_t)bpop->bpo_num_blkptrs);
	(void) printf("\t\tbytes = %s\n", bytes);
	if (size >= BPOBJ_SIZE_V1) {
	(void) printf("\t\tcomp = %s\n", comp);
	(void) printf("\t\tuncomp = %s\n", uncomp);
	}
	if (size >= BPOBJ_SIZE_V2) {
	(void) printf("\t\tsubobjs = %llu\n",
	(u_longlong_t)bpop->bpo_subobjs);
	(void) printf("\t\tnum_subobjs = %llu\n",
	(u_longlong_t)bpop->bpo_num_subobjs);
	}
	if (size >= sizeof (*bpop)) {
	(void) printf("\t\tnum_freed = %llu\n",
	(u_longlong_t)bpop->bpo_num_freed);
	}

	if (dump_opt['d'] < 5)
	return;

	for (i = 0; i < bpop->bpo_num_blkptrs; i++) {
	char blkbuf[BP_SPRINTF_LEN];
	blkptr_t bp;

	int err = dmu_read(os, object,
	i * sizeof (bp), sizeof (bp), &bp, 0);
	if (err != 0) {
	(void) printf("got error %u from dmu_read\n", err);
	break;
	}
	snprintf_blkptr_compact(blkbuf, sizeof (blkbuf), &bp,
	BP_GET_FREE(&bp));
	(void) printf("\t%s\n", blkbuf);
	}
	}

	/* ARGSUSED */
	static void
	dump_bpobj_subobjs(objset_t os, uint64_t object, void data, size_t size)
	{
	dmu_object_info_t doi;
	int64_t i;

	VERIFY0(dmu_object_info(os, object, &doi));
	uint64_t *subobjs = kmem_alloc(doi.doi_max_offset, KM_SLEEP);

	int err = dmu_read(os, object, 0, doi.doi_max_offset, subobjs, 0);
	if (err != 0) {
	(void) printf("got error %u from dmu_read\n", err);
	kmem_free(subobjs, doi.doi_max_offset);
	return;
	}

	int64_t last_nonzero = -1;
	for (i = 0; i < doi.doi_max_offset / 8; i++) {
	if (subobjs[i] != 0)
	last_nonzero = i;
	}

	for (i = 0; i <= last_nonzero; i++) {
	(void) printf("\t%llu\n", (u_longlong_t)subobjs[i]);
	}
	kmem_free(subobjs, doi.doi_max_offset);
	}

	/ARGSUSED/
	static void
	dump_ddt_zap(objset_t os, uint64_t object, void data, size_t size)
	{
	dump_zap_stats(os, object);
	/* contents are printed elsewhere, properly decoded */
	}

	/ARGSUSED/
	static void
	dump_sa_attrs(objset_t os, uint64_t object, void data, size_t size)
	{
	zap_cursor_t zc;
	zap_attribute_t attr;

	dump_zap_stats(os, object);
	(void) printf("\n");

	for (zap_cursor_init(&zc, os, object);
	zap_cursor_retrieve(&zc, &attr) == 0;
	zap_cursor_advance(&zc)) {
	(void) printf("\t\t%s = ", attr.za_name);
	if (attr.za_num_integers == 0) {
	(void) printf("\n");
	continue;
	}
	(void) printf(" %llx : [%d:%d:%d]\n",
	(u_longlong_t)attr.za_first_integer,
	(int)ATTR_LENGTH(attr.za_first_integer),
	(int)ATTR_BSWAP(attr.za_first_integer),
	(int)ATTR_NUM(attr.za_first_integer));
	}
	zap_cursor_fini(&zc);
	}

	/ARGSUSED/
	static void
	dump_sa_layouts(objset_t os, uint64_t object, void data, size_t size)
	{
	zap_cursor_t zc;
	zap_attribute_t attr;
	uint16_t *layout_attrs;
	unsigned i;

	dump_zap_stats(os, object);
	(void) printf("\n");

	for (zap_cursor_init(&zc, os, object);
	zap_cursor_retrieve(&zc, &attr) == 0;
	zap_cursor_advance(&zc)) {
	(void) printf("\t\t%s = [", attr.za_name);
	if (attr.za_num_integers == 0) {
	(void) printf("\n");
	continue;
	}

	VERIFY(attr.za_integer_length == 2);
	layout_attrs = umem_zalloc(attr.za_num_integers *
	attr.za_integer_length, UMEM_NOFAIL);

	VERIFY(zap_lookup(os, object, attr.za_name,
	attr.za_integer_length,
	attr.za_num_integers, layout_attrs) == 0);

	for (i = 0; i != attr.za_num_integers; i++)
	(void) printf(" %d ", (int)layout_attrs[i]);
	(void) printf("]\n");
	umem_free(layout_attrs,
	attr.za_num_integers * attr.za_integer_length);
	}
	zap_cursor_fini(&zc);
	}

	/ARGSUSED/
	static void
	dump_zpldir(objset_t os, uint64_t object, void data, size_t size)
	{
	zap_cursor_t zc;
	zap_attribute_t attr;
	const char *typenames[] = {
	/* 0 */ "not specified",
	/* 1 */ "FIFO",
	/* 2 */ "Character Device",
	/* 3 */ "3 (invalid)",
	/* 4 */ "Directory",
	/* 5 */ "5 (invalid)",
	/* 6 */ "Block Device",
	/* 7 */ "7 (invalid)",
	/* 8 */ "Regular File",
	/* 9 */ "9 (invalid)",
	/* 10 */ "Symbolic Link",
	/* 11 */ "11 (invalid)",
	/* 12 */ "Socket",
	/* 13 */ "Door",
	/* 14 */ "Event Port",
	/* 15 */ "15 (invalid)",
	};

	dump_zap_stats(os, object);
	(void) printf("\n");

	for (zap_cursor_init(&zc, os, object);
	zap_cursor_retrieve(&zc, &attr) == 0;
	zap_cursor_advance(&zc)) {
	(void) printf("\t\t%s = %lld (type: %s)\n",
	attr.za_name, ZFS_DIRENT_OBJ(attr.za_first_integer),
	typenames[ZFS_DIRENT_TYPE(attr.za_first_integer)]);
	}
	zap_cursor_fini(&zc);
	}

	static int
	get_dtl_refcount(vdev_t *vd)
	{
	int refcount = 0;

	if (vd->vdev_ops->vdev_op_leaf) {
	space_map_t *sm = vd->vdev_dtl_sm;

	if (sm != NULL &&
	sm->sm_dbuf->db_size == sizeof (space_map_phys_t))
	return (1);
	return (0);
	}

	for (unsigned c = 0; c < vd->vdev_children; c++)
	refcount += get_dtl_refcount(vd->vdev_child[c]);
	return (refcount);
	}

	static int
	get_metaslab_refcount(vdev_t *vd)
	{
	int refcount = 0;

	if (vd->vdev_top == vd) {
	for (uint64_t m = 0; m < vd->vdev_ms_count; m++) {
	space_map_t *sm = vd->vdev_ms[m]->ms_sm;

	if (sm != NULL &&
	sm->sm_dbuf->db_size == sizeof (space_map_phys_t))
	refcount++;
	}
	}
	for (unsigned c = 0; c < vd->vdev_children; c++)
	refcount += get_metaslab_refcount(vd->vdev_child[c]);

	return (refcount);
	}

	static int
	get_obsolete_refcount(vdev_t *vd)
	{
	uint64_t obsolete_sm_object;
	int refcount = 0;

	VERIFY0(vdev_obsolete_sm_object(vd, &obsolete_sm_object));
	if (vd->vdev_top == vd && obsolete_sm_object != 0) {
	dmu_object_info_t doi;
	VERIFY0(dmu_object_info(vd->vdev_spa->spa_meta_objset,
	obsolete_sm_object, &doi));
	if (doi.doi_bonus_size == sizeof (space_map_phys_t)) {
	refcount++;
	}
	} else {
	ASSERT3P(vd->vdev_obsolete_sm, ==, NULL);
	ASSERT3U(obsolete_sm_object, ==, 0);
	}
	for (unsigned c = 0; c < vd->vdev_children; c++) {
	refcount += get_obsolete_refcount(vd->vdev_child[c]);
	}

	return (refcount);
	}

	static int
	get_prev_obsolete_spacemap_refcount(spa_t *spa)
	{
	uint64_t prev_obj =
	spa->spa_condensing_indirect_phys.scip_prev_obsolete_sm_object;
	if (prev_obj != 0) {
	dmu_object_info_t doi;
	VERIFY0(dmu_object_info(spa->spa_meta_objset, prev_obj, &doi));
	if (doi.doi_bonus_size == sizeof (space_map_phys_t)) {
	return (1);
	}
	}
	return (0);
	}

	static int
	get_checkpoint_refcount(vdev_t *vd)
	{
	int refcount = 0;

	if (vd->vdev_top == vd && vd->vdev_top_zap != 0 &&
	zap_contains(spa_meta_objset(vd->vdev_spa),
	vd->vdev_top_zap, VDEV_TOP_ZAP_POOL_CHECKPOINT_SM) == 0)
	refcount++;

	for (uint64_t c = 0; c < vd->vdev_children; c++)
	refcount += get_checkpoint_refcount(vd->vdev_child[c]);

	return (refcount);
	}

	static int
	get_log_spacemap_refcount(spa_t *spa)
	{
	return (avl_numnodes(&spa->spa_sm_logs_by_txg));
	}

	static int
	verify_spacemap_refcounts(spa_t *spa)
	{
	uint64_t expected_refcount = 0;
	uint64_t actual_refcount;

	(void) feature_get_refcount(spa,
	&spa_feature_table[SPA_FEATURE_SPACEMAP_HISTOGRAM],
	&expected_refcount);
	actual_refcount = get_dtl_refcount(spa->spa_root_vdev);
	actual_refcount += get_metaslab_refcount(spa->spa_root_vdev);
	actual_refcount += get_obsolete_refcount(spa->spa_root_vdev);
	actual_refcount += get_prev_obsolete_spacemap_refcount(spa);
	actual_refcount += get_checkpoint_refcount(spa->spa_root_vdev);
	actual_refcount += get_log_spacemap_refcount(spa);

	if (expected_refcount != actual_refcount) {
	(void) printf("space map refcount mismatch: expected %lld != "
	"actual %lld\n",
	(longlong_t)expected_refcount,
	(longlong_t)actual_refcount);
	return (2);
	}
	return (0);
	}

	static void
	dump_spacemap(objset_t os, space_map_t sm)
	{
	const char *ddata[] = { "ALLOC", "FREE", "CONDENSE", "INVALID",
	"INVALID", "INVALID", "INVALID", "INVALID" };

	if (sm == NULL)
	return;

	(void) printf("space map object %llu:\n",
	(longlong_t)sm->sm_object);
	(void) printf(" smp_length = 0x%llx\n",
	(longlong_t)sm->sm_phys->smp_length);
	(void) printf(" smp_alloc = 0x%llx\n",
	(longlong_t)sm->sm_phys->smp_alloc);

	if (dump_opt['d'] < 6 && dump_opt['m'] < 4)
	return;

	/*
	* Print out the freelist entries in both encoded and decoded form.
	*/
	uint8_t mapshift = sm->sm_shift;
	int64_t alloc = 0;
	uint64_t word, entry_id = 0;
	for (uint64_t offset = 0; offset < space_map_length(sm);
	offset += sizeof (word)) {

	VERIFY0(dmu_read(os, space_map_object(sm), offset,
	sizeof (word), &word, DMU_READ_PREFETCH));

	if (sm_entry_is_debug(word)) {
	uint64_t de_txg = SM_DEBUG_TXG_DECODE(word);
	uint64_t de_sync_pass = SM_DEBUG_SYNCPASS_DECODE(word);
	if (de_txg == 0) {
	(void) printf(
	"\t [%6llu] PADDING\n",
	(u_longlong_t)entry_id);
	} else {
	(void) printf(
	"\t [%6llu] %s: txg %llu pass %llu\n",
	(u_longlong_t)entry_id,
	ddata[SM_DEBUG_ACTION_DECODE(word)],
	(u_longlong_t)de_txg,
	(u_longlong_t)de_sync_pass);
	}
	entry_id++;
	continue;
	}

	uint8_t words;
	char entry_type;
	uint64_t entry_off, entry_run, entry_vdev = SM_NO_VDEVID;

	if (sm_entry_is_single_word(word)) {
	entry_type = (SM_TYPE_DECODE(word) == SM_ALLOC) ?
	'A' : 'F';
	entry_off = (SM_OFFSET_DECODE(word) << mapshift) +
	sm->sm_start;
	entry_run = SM_RUN_DECODE(word) << mapshift;
	words = 1;
	} else {
	/* it is a two-word entry so we read another word */
	ASSERT(sm_entry_is_double_word(word));

	uint64_t extra_word;
	offset += sizeof (extra_word);
	VERIFY0(dmu_read(os, space_map_object(sm), offset,
	sizeof (extra_word), &extra_word,
	DMU_READ_PREFETCH));

	ASSERT3U(offset, <=, space_map_length(sm));

	entry_run = SM2_RUN_DECODE(word) << mapshift;
	entry_vdev = SM2_VDEV_DECODE(word);
	entry_type = (SM2_TYPE_DECODE(extra_word) == SM_ALLOC) ?
	'A' : 'F';
	entry_off = (SM2_OFFSET_DECODE(extra_word) <<
	mapshift) + sm->sm_start;
	words = 2;
	}

	(void) printf("\t [%6llu] %c range:"
	" %010llx-%010llx size: %06llx vdev: %06llu words: %u\n",
	(u_longlong_t)entry_id,
	entry_type, (u_longlong_t)entry_off,
	(u_longlong_t)(entry_off + entry_run),
	(u_longlong_t)entry_run,
	(u_longlong_t)entry_vdev, words);

	if (entry_type == 'A')
	alloc += entry_run;
	else
	alloc -= entry_run;
	entry_id++;
	}
	if (alloc != space_map_allocated(sm)) {
	(void) printf("space_map_object alloc (%lld) INCONSISTENT "
	"with space map summary (%lld)\n",
	(longlong_t)space_map_allocated(sm), (longlong_t)alloc);
	}
	}

	static void
	dump_metaslab_stats(metaslab_t *msp)
	{
	char maxbuf[32];
	range_tree_t *rt = msp->ms_allocatable;
	zfs_btree_t *t = &msp->ms_allocatable_by_size;
	int free_pct = range_tree_space(rt) * 100 / msp->ms_size;

	/* max sure nicenum has enough space */
	CTASSERT(sizeof (maxbuf) >= NN_NUMBUF_SZ);

	zdb_nicenum(metaslab_largest_allocatable(msp), maxbuf, sizeof (maxbuf));

	(void) printf("\t %25s %10lu %7s %6s %4s %4d%%\n",
	"segments", zfs_btree_numnodes(t), "maxsize", maxbuf,
	"freepct", free_pct);
	(void) printf("\tIn-memory histogram:\n");
	dump_histogram(rt->rt_histogram, RANGE_TREE_HISTOGRAM_SIZE, 0);
	}

	static void
	dump_metaslab(metaslab_t *msp)
	{
	vdev_t *vd = msp->ms_group->mg_vd;
	spa_t *spa = vd->vdev_spa;
	space_map_t *sm = msp->ms_sm;
	char freebuf[32];

	zdb_nicenum(msp->ms_size - space_map_allocated(sm), freebuf,
	sizeof (freebuf));

	(void) printf(
	"\tmetaslab %6llu offset %12llx spacemap %6llu free %5s\n",
	(u_longlong_t)msp->ms_id, (u_longlong_t)msp->ms_start,
	(u_longlong_t)space_map_object(sm), freebuf);

	if (dump_opt['m'] > 2 && !dump_opt['L']) {
	mutex_enter(&msp->ms_lock);
	VERIFY0(metaslab_load(msp));
	range_tree_stat_verify(msp->ms_allocatable);
	dump_metaslab_stats(msp);
	metaslab_unload(msp);
	mutex_exit(&msp->ms_lock);
	}

	if (dump_opt['m'] > 1 && sm != NULL &&
	spa_feature_is_active(spa, SPA_FEATURE_SPACEMAP_HISTOGRAM)) {
	/*
	* The space map histogram represents free space in chunks
	* of sm_shift (i.e. bucket 0 refers to 2^sm_shift).
	*/
	(void) printf("\tOn-disk histogram:\t\tfragmentation %llu\n",
	(u_longlong_t)msp->ms_fragmentation);
	dump_histogram(sm->sm_phys->smp_histogram,
	SPACE_MAP_HISTOGRAM_SIZE, sm->sm_shift);
	}

	ASSERT(msp->ms_size == (1ULL << vd->vdev_ms_shift));
	dump_spacemap(spa->spa_meta_objset, msp->ms_sm);

	if (spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP)) {
	(void) printf("\tFlush data:\n\tunflushed txg=%llu\n\n",
	(u_longlong_t)metaslab_unflushed_txg(msp));
	}
	}

	static void
	print_vdev_metaslab_header(vdev_t *vd)
	{
	vdev_alloc_bias_t alloc_bias = vd->vdev_alloc_bias;
	const char *bias_str = "";
	if (alloc_bias == VDEV_BIAS_LOG \|\| vd->vdev_islog) {
	bias_str = VDEV_ALLOC_BIAS_LOG;
	} else if (alloc_bias == VDEV_BIAS_SPECIAL) {
	bias_str = VDEV_ALLOC_BIAS_SPECIAL;
	} else if (alloc_bias == VDEV_BIAS_DEDUP) {
	bias_str = VDEV_ALLOC_BIAS_DEDUP;
	}

	uint64_t ms_flush_data_obj = 0;
	if (vd->vdev_top_zap != 0) {
	int error = zap_lookup(spa_meta_objset(vd->vdev_spa),
	vd->vdev_top_zap, VDEV_TOP_ZAP_MS_UNFLUSHED_PHYS_TXGS,
	sizeof (uint64_t), 1, &ms_flush_data_obj);
	if (error != ENOENT) {
	ASSERT0(error);
	}
	}

	(void) printf("\tvdev %10llu %s",
	(u_longlong_t)vd->vdev_id, bias_str);

	if (ms_flush_data_obj != 0) {
	(void) printf(" ms_unflushed_phys object %llu",
	(u_longlong_t)ms_flush_data_obj);
	}

	(void) printf("\n\t%-10s%5llu %-19s %-15s %-12s\n",
	"metaslabs", (u_longlong_t)vd->vdev_ms_count,
	"offset", "spacemap", "free");
	(void) printf("\t%15s %19s %15s %12s\n",
	"---------------", "-------------------",
	"---------------", "------------");
	}

	static void
	dump_metaslab_groups(spa_t *spa)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	metaslab_class_t *mc = spa_normal_class(spa);
	uint64_t fragmentation;

	metaslab_class_histogram_verify(mc);

	for (unsigned c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];
	metaslab_group_t *mg = tvd->vdev_mg;

	if (mg == NULL \|\| mg->mg_class != mc)
	continue;

	metaslab_group_histogram_verify(mg);
	mg->mg_fragmentation = metaslab_group_fragmentation(mg);

	(void) printf("\tvdev %10llu\t\tmetaslabs%5llu\t\t"
	"fragmentation",
	(u_longlong_t)tvd->vdev_id,
	(u_longlong_t)tvd->vdev_ms_count);
	if (mg->mg_fragmentation == ZFS_FRAG_INVALID) {
	(void) printf("%3s\n", "-");
	} else {
	(void) printf("%3llu%%\n",
	(u_longlong_t)mg->mg_fragmentation);
	}
	dump_histogram(mg->mg_histogram, RANGE_TREE_HISTOGRAM_SIZE, 0);
	}

	(void) printf("\tpool %s\tfragmentation", spa_name(spa));
	fragmentation = metaslab_class_fragmentation(mc);
	if (fragmentation == ZFS_FRAG_INVALID)
	(void) printf("\t%3s\n", "-");
	else
	(void) printf("\t%3llu%%\n", (u_longlong_t)fragmentation);
	dump_histogram(mc->mc_histogram, RANGE_TREE_HISTOGRAM_SIZE, 0);
	}

	static void
	print_vdev_indirect(vdev_t *vd)
	{
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	vdev_indirect_births_t *vib = vd->vdev_indirect_births;

	if (vim == NULL) {
	ASSERT3P(vib, ==, NULL);
	return;
	}

	ASSERT3U(vdev_indirect_mapping_object(vim), ==,
	vic->vic_mapping_object);
	ASSERT3U(vdev_indirect_births_object(vib), ==,
	vic->vic_births_object);

	(void) printf("indirect births obj %llu:\n",
	(longlong_t)vic->vic_births_object);
	(void) printf(" vib_count = %llu\n",
	(longlong_t)vdev_indirect_births_count(vib));
	for (uint64_t i = 0; i < vdev_indirect_births_count(vib); i++) {
	vdev_indirect_birth_entry_phys_t *cur_vibe =
	&vib->vib_entries[i];
	(void) printf("\toffset %llx -> txg %llu\n",
	(longlong_t)cur_vibe->vibe_offset,
	(longlong_t)cur_vibe->vibe_phys_birth_txg);
	}
	(void) printf("\n");

	(void) printf("indirect mapping obj %llu:\n",
	(longlong_t)vic->vic_mapping_object);
	(void) printf(" vim_max_offset = 0x%llx\n",
	(longlong_t)vdev_indirect_mapping_max_offset(vim));
	(void) printf(" vim_bytes_mapped = 0x%llx\n",
	(longlong_t)vdev_indirect_mapping_bytes_mapped(vim));
	(void) printf(" vim_count = %llu\n",
	(longlong_t)vdev_indirect_mapping_num_entries(vim));

	if (dump_opt['d'] <= 5 && dump_opt['m'] <= 3)
	return;

	uint32_t *counts = vdev_indirect_mapping_load_obsolete_counts(vim);

	for (uint64_t i = 0; i < vdev_indirect_mapping_num_entries(vim); i++) {
	vdev_indirect_mapping_entry_phys_t *vimep =
	&vim->vim_entries[i];
	(void) printf("\t<%llx:%llx:%llx> -> "
	"<%llx:%llx:%llx> (%x obsolete)\n",
	(longlong_t)vd->vdev_id,
	(longlong_t)DVA_MAPPING_GET_SRC_OFFSET(vimep),
	(longlong_t)DVA_GET_ASIZE(&vimep->vimep_dst),
	(longlong_t)DVA_GET_VDEV(&vimep->vimep_dst),
	(longlong_t)DVA_GET_OFFSET(&vimep->vimep_dst),
	(longlong_t)DVA_GET_ASIZE(&vimep->vimep_dst),
	counts[i]);
	}
	(void) printf("\n");

	uint64_t obsolete_sm_object;
	VERIFY0(vdev_obsolete_sm_object(vd, &obsolete_sm_object));
	if (obsolete_sm_object != 0) {
	objset_t *mos = vd->vdev_spa->spa_meta_objset;
	(void) printf("obsolete space map object %llu:\n",
	(u_longlong_t)obsolete_sm_object);
	ASSERT(vd->vdev_obsolete_sm != NULL);
	ASSERT3U(space_map_object(vd->vdev_obsolete_sm), ==,
	obsolete_sm_object);
	dump_spacemap(mos, vd->vdev_obsolete_sm);
	(void) printf("\n");
	}
	}

	static void
	dump_metaslabs(spa_t *spa)
	{
	vdev_t vd, rvd = spa->spa_root_vdev;
	uint64_t m, c = 0, children = rvd->vdev_children;

	(void) printf("\nMetaslabs:\n");

	if (!dump_opt['d'] && zopt_metaslab_args > 0) {
	c = zopt_metaslab[0];

	if (c >= children)
	(void) fatal("bad vdev id: %llu", (u_longlong_t)c);

	if (zopt_metaslab_args > 1) {
	vd = rvd->vdev_child[c];
	print_vdev_metaslab_header(vd);

	for (m = 1; m < zopt_metaslab_args; m++) {
	if (zopt_metaslab[m] < vd->vdev_ms_count)
	dump_metaslab(
	vd->vdev_ms[zopt_metaslab[m]]);
	else
	(void) fprintf(stderr, "bad metaslab "
	"number %llu\n",
	(u_longlong_t)zopt_metaslab[m]);
	}
	(void) printf("\n");
	return;
	}
	children = c + 1;
	}
	for (; c < children; c++) {
	vd = rvd->vdev_child[c];
	print_vdev_metaslab_header(vd);

	print_vdev_indirect(vd);

	for (m = 0; m < vd->vdev_ms_count; m++)
	dump_metaslab(vd->vdev_ms[m]);
	(void) printf("\n");
	}
	}

	static void
	dump_log_spacemaps(spa_t *spa)
	{
	if (!spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP))
	return;

	(void) printf("\nLog Space Maps in Pool:\n");
	for (spa_log_sm_t *sls = avl_first(&spa->spa_sm_logs_by_txg);
	sls; sls = AVL_NEXT(&spa->spa_sm_logs_by_txg, sls)) {
	space_map_t *sm = NULL;
	VERIFY0(space_map_open(&sm, spa_meta_objset(spa),
	sls->sls_sm_obj, 0, UINT64_MAX, SPA_MINBLOCKSHIFT));

	(void) printf("Log Spacemap object %llu txg %llu\n",
	(u_longlong_t)sls->sls_sm_obj, (u_longlong_t)sls->sls_txg);
	dump_spacemap(spa->spa_meta_objset, sm);
	space_map_close(sm);
	}
	(void) printf("\n");
	}

	static void
	dump_dde(const ddt_t ddt, const ddt_entry_t dde, uint64_t index)
	{
	const ddt_phys_t *ddp = dde->dde_phys;
	const ddt_key_t *ddk = &dde->dde_key;
	const char *types[4] = { "ditto", "single", "double", "triple" };
	char blkbuf[BP_SPRINTF_LEN];
	blkptr_t blk;
	int p;

	for (p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
	if (ddp->ddp_phys_birth == 0)
	continue;
	ddt_bp_create(ddt->ddt_checksum, ddk, ddp, &blk);
	snprintf_blkptr(blkbuf, sizeof (blkbuf), &blk);
	(void) printf("index %llx refcnt %llu %s %s\n",
	(u_longlong_t)index, (u_longlong_t)ddp->ddp_refcnt,
	types[p], blkbuf);
	}
	}

	static void
	dump_dedup_ratio(const ddt_stat_t *dds)
	{
	double rL, rP, rD, D, dedup, compress, copies;

	if (dds->dds_blocks == 0)
	return;

	rL = (double)dds->dds_ref_lsize;
	rP = (double)dds->dds_ref_psize;
	rD = (double)dds->dds_ref_dsize;
	D = (double)dds->dds_dsize;

	dedup = rD / D;
	compress = rL / rP;
	copies = rD / rP;

	(void) printf("dedup = %.2f, compress = %.2f, copies = %.2f, "
	"dedup * compress / copies = %.2f\n\n",
	dedup, compress, copies, dedup * compress / copies);
	}

	static void
	dump_ddt(ddt_t *ddt, enum ddt_type type, enum ddt_class class)
	{
	char name[DDT_NAMELEN];
	ddt_entry_t dde;
	uint64_t walk = 0;
	dmu_object_info_t doi;
	uint64_t count, dspace, mspace;
	int error;

	error = ddt_object_info(ddt, type, class, &doi);

	if (error == ENOENT)
	return;
	ASSERT(error == 0);

	error = ddt_object_count(ddt, type, class, &count);
	ASSERT(error == 0);
	if (count == 0)
	return;

	dspace = doi.doi_physical_blocks_512 << 9;
	mspace = doi.doi_fill_count * doi.doi_data_block_size;

	ddt_object_name(ddt, type, class, name);

	(void) printf("%s: %llu entries, size %llu on disk, %llu in core\n",
	name,
	(u_longlong_t)count,
	(u_longlong_t)(dspace / count),
	(u_longlong_t)(mspace / count));

	if (dump_opt['D'] < 3)
	return;

	zpool_dump_ddt(NULL, &ddt->ddt_histogram[type][class]);

	if (dump_opt['D'] < 4)
	return;

	if (dump_opt['D'] < 5 && class == DDT_CLASS_UNIQUE)
	return;

	(void) printf("%s contents:\n\n", name);

	while ((error = ddt_object_walk(ddt, type, class, &walk, &dde)) == 0)
	dump_dde(ddt, &dde, walk);

	ASSERT3U(error, ==, ENOENT);

	(void) printf("\n");
	}

	static void
	dump_all_ddts(spa_t *spa)
	{
	ddt_histogram_t ddh_total;
	ddt_stat_t dds_total;

	bzero(&ddh_total, sizeof (ddh_total));
	bzero(&dds_total, sizeof (dds_total));

	for (enum zio_checksum c = 0; c < ZIO_CHECKSUM_FUNCTIONS; c++) {
	ddt_t *ddt = spa->spa_ddt[c];
	for (enum ddt_type type = 0; type < DDT_TYPES; type++) {
	for (enum ddt_class class = 0; class < DDT_CLASSES;
	class++) {
	dump_ddt(ddt, type, class);
	}
	}
	}

	ddt_get_dedup_stats(spa, &dds_total);

	if (dds_total.dds_blocks == 0) {
	(void) printf("All DDTs are empty\n");
	return;
	}

	(void) printf("\n");

	if (dump_opt['D'] > 1) {
	(void) printf("DDT histogram (aggregated over all DDTs):\n");
	ddt_get_dedup_histogram(spa, &ddh_total);
	zpool_dump_ddt(&dds_total, &ddh_total);
	}

	dump_dedup_ratio(&dds_total);
	}

	static void
	dump_dtl_seg(void *arg, uint64_t start, uint64_t size)
	{
	char *prefix = arg;

	(void) printf("%s [%llu,%llu) length %llu\n",
	prefix,
	(u_longlong_t)start,
	(u_longlong_t)(start + size),
	(u_longlong_t)(size));
	}

	static void
	dump_dtl(vdev_t *vd, int indent)
	{
	spa_t *spa = vd->vdev_spa;
	boolean_t required;
	const char *name[DTL_TYPES] = { "missing", "partial", "scrub",
	"outage" };
	char prefix[256];

	spa_vdev_state_enter(spa, SCL_NONE);
	required = vdev_dtl_required(vd);
	(void) spa_vdev_state_exit(spa, NULL, 0);

	if (indent == 0)
	(void) printf("\nDirty time logs:\n\n");

	(void) printf("\t%*s%s [%s]\n", indent, "",
	vd->vdev_path ? vd->vdev_path :
	vd->vdev_parent ? vd->vdev_ops->vdev_op_type : spa_name(spa),
	required ? "DTL-required" : "DTL-expendable");

	for (int t = 0; t < DTL_TYPES; t++) {
	range_tree_t *rt = vd->vdev_dtl[t];
	if (range_tree_space(rt) == 0)
	continue;
	(void) snprintf(prefix, sizeof (prefix), "\t%*s%s",
	indent + 2, "", name[t]);
	range_tree_walk(rt, dump_dtl_seg, prefix);
	if (dump_opt['d'] > 5 && vd->vdev_children == 0)
	dump_spacemap(spa->spa_meta_objset,
	vd->vdev_dtl_sm);
	}

	for (unsigned c = 0; c < vd->vdev_children; c++)
	dump_dtl(vd->vdev_child[c], indent + 4);
	}

	static void
	dump_history(spa_t *spa)
	{
	nvlist_t **events = NULL;
	char *buf;
	uint64_t resid, len, off = 0;
	uint_t num = 0;
	int error;
	time_t tsec;
	struct tm t;
	char tbuf[30];
	char internalstr[MAXPATHLEN];

	if ((buf = malloc(SPA_OLD_MAXBLOCKSIZE)) == NULL) {
	(void) fprintf(stderr, "%s: unable to allocate I/O buffer\n",
	__func__);
	return;
	}

	do {
	len = SPA_OLD_MAXBLOCKSIZE;

	if ((error = spa_history_get(spa, &off, &len, buf)) != 0) {
	(void) fprintf(stderr, "Unable to read history: "
	"error %d\n", error);
	free(buf);
	return;
	}

	if (zpool_history_unpack(buf, len, &resid, &events, &num) != 0)
	break;

	off -= resid;
	} while (len != 0);

	(void) printf("\nHistory:\n");
	for (unsigned i = 0; i < num; i++) {
	uint64_t time, txg, ievent;
	char cmd, intstr;
	boolean_t printed = B_FALSE;

	if (nvlist_lookup_uint64(events[i], ZPOOL_HIST_TIME,
	&time) != 0)
	goto next;
	if (nvlist_lookup_string(events[i], ZPOOL_HIST_CMD,
	&cmd) != 0) {
	if (nvlist_lookup_uint64(events[i],
	ZPOOL_HIST_INT_EVENT, &ievent) != 0)
	goto next;
	verify(nvlist_lookup_uint64(events[i],
	ZPOOL_HIST_TXG, &txg) == 0);
	verify(nvlist_lookup_string(events[i],
	ZPOOL_HIST_INT_STR, &intstr) == 0);
	if (ievent >= ZFS_NUM_LEGACY_HISTORY_EVENTS)
	goto next;

	(void) snprintf(internalstr,
	sizeof (internalstr),
	"[internal %s txg:%lld] %s",
	zfs_history_event_names[ievent],
	(longlong_t)txg, intstr);
	cmd = internalstr;
	}
	tsec = time;
	(void) localtime_r(&tsec, &t);
	(void) strftime(tbuf, sizeof (tbuf), "%F.%T", &t);
	(void) printf("%s %s\n", tbuf, cmd);
	printed = B_TRUE;

	next:
	if (dump_opt['h'] > 1) {
	if (!printed)
	(void) printf("unrecognized record:\n");
	dump_nvlist(events[i], 2);
	}
	}
	free(buf);
	}

	/ARGSUSED/
	static void
	dump_dnode(objset_t os, uint64_t object, void data, size_t size)
	{
	}

	static uint64_t
	blkid2offset(const dnode_phys_t dnp, const blkptr_t bp,
	const zbookmark_phys_t *zb)
	{
	if (dnp == NULL) {
	ASSERT(zb->zb_level < 0);
	if (zb->zb_object == 0)
	return (zb->zb_blkid);
	return (zb->zb_blkid * BP_GET_LSIZE(bp));
	}

	ASSERT(zb->zb_level >= 0);

	return ((zb->zb_blkid <<
	(zb->zb_level * (dnp->dn_indblkshift - SPA_BLKPTRSHIFT))) *
	dnp->dn_datablkszsec << SPA_MINBLOCKSHIFT);
	}

	static void
	snprintf_zstd_header(spa_t spa, char blkbuf, size_t buflen,
	const blkptr_t *bp)
	{
	abd_t *pabd;
	void *buf;
	zio_t *zio;
	zfs_zstdhdr_t zstd_hdr;
	int error;

	if (BP_GET_COMPRESS(bp) != ZIO_COMPRESS_ZSTD)
	return;

	if (BP_IS_HOLE(bp))
	return;

	if (BP_IS_EMBEDDED(bp)) {
	buf = malloc(SPA_MAXBLOCKSIZE);
	if (buf == NULL) {
	(void) fprintf(stderr, "out of memory\n");
	exit(1);
	}
	decode_embedded_bp_compressed(bp, buf);
	memcpy(&zstd_hdr, buf, sizeof (zstd_hdr));
	free(buf);
	zstd_hdr.c_len = BE_32(zstd_hdr.c_len);
	zstd_hdr.raw_version_level = BE_32(zstd_hdr.raw_version_level);
	(void) snprintf(blkbuf + strlen(blkbuf),
	buflen - strlen(blkbuf),
	" ZSTD:size=%u:version=%u:level=%u:EMBEDDED",
	zstd_hdr.c_len, zstd_hdr.version, zstd_hdr.level);
	return;
	}

	pabd = abd_alloc_for_io(SPA_MAXBLOCKSIZE, B_FALSE);
	zio = zio_root(spa, NULL, NULL, 0);

	/* Decrypt but don't decompress so we can read the compression header */
	zio_nowait(zio_read(zio, spa, bp, pabd, BP_GET_PSIZE(bp), NULL, NULL,
	ZIO_PRIORITY_SYNC_READ, ZIO_FLAG_CANFAIL \| ZIO_FLAG_RAW_COMPRESS,
	NULL));
	error = zio_wait(zio);
	if (error) {
	(void) fprintf(stderr, "read failed: %d\n", error);
	return;
	}
	buf = abd_borrow_buf_copy(pabd, BP_GET_LSIZE(bp));
	memcpy(&zstd_hdr, buf, sizeof (zstd_hdr));
	zstd_hdr.c_len = BE_32(zstd_hdr.c_len);
	zstd_hdr.raw_version_level = BE_32(zstd_hdr.raw_version_level);

	(void) snprintf(blkbuf + strlen(blkbuf),
	buflen - strlen(blkbuf),
	" ZSTD:size=%u:version=%u:level=%u:NORMAL",
	zstd_hdr.c_len, zstd_hdr.version, zstd_hdr.level);

	abd_return_buf_copy(pabd, buf, BP_GET_LSIZE(bp));
	}

	static void
	snprintf_blkptr_compact(char blkbuf, size_t buflen, const blkptr_t bp,
	boolean_t bp_freed)
	{
	const dva_t *dva = bp->blk_dva;
	int ndvas = dump_opt['d'] > 5 ? BP_GET_NDVAS(bp) : 1;
	int i;

	if (dump_opt['b'] >= 6) {
	snprintf_blkptr(blkbuf, buflen, bp);
	if (bp_freed) {
	(void) snprintf(blkbuf + strlen(blkbuf),
	buflen - strlen(blkbuf), " %s", "FREE");
	}
	return;
	}

	if (BP_IS_EMBEDDED(bp)) {
	(void) sprintf(blkbuf,
	"EMBEDDED et=%u %llxL/%llxP B=%llu",
	(int)BPE_GET_ETYPE(bp),
	(u_longlong_t)BPE_GET_LSIZE(bp),
	(u_longlong_t)BPE_GET_PSIZE(bp),
	(u_longlong_t)bp->blk_birth);
	return;
	}

	blkbuf[0] = '\0';

	for (i = 0; i < ndvas; i++)
	(void) snprintf(blkbuf + strlen(blkbuf),
	buflen - strlen(blkbuf), "%llu:%llx:%llx ",
	(u_longlong_t)DVA_GET_VDEV(&dva[i]),
	(u_longlong_t)DVA_GET_OFFSET(&dva[i]),
	(u_longlong_t)DVA_GET_ASIZE(&dva[i]));

	if (BP_IS_HOLE(bp)) {
	(void) snprintf(blkbuf + strlen(blkbuf),
	buflen - strlen(blkbuf),
	"%llxL B=%llu",
	(u_longlong_t)BP_GET_LSIZE(bp),
	(u_longlong_t)bp->blk_birth);
	} else {
	(void) snprintf(blkbuf + strlen(blkbuf),
	buflen - strlen(blkbuf),
	"%llxL/%llxP F=%llu B=%llu/%llu",
	(u_longlong_t)BP_GET_LSIZE(bp),
	(u_longlong_t)BP_GET_PSIZE(bp),
	(u_longlong_t)BP_GET_FILL(bp),
	(u_longlong_t)bp->blk_birth,
	(u_longlong_t)BP_PHYSICAL_BIRTH(bp));
	if (bp_freed)
	(void) snprintf(blkbuf + strlen(blkbuf),
	buflen - strlen(blkbuf), " %s", "FREE");
	(void) snprintf(blkbuf + strlen(blkbuf),
	buflen - strlen(blkbuf), " cksum=%llx:%llx:%llx:%llx",
	(u_longlong_t)bp->blk_cksum.zc_word[0],
	(u_longlong_t)bp->blk_cksum.zc_word[1],
	(u_longlong_t)bp->blk_cksum.zc_word[2],
	(u_longlong_t)bp->blk_cksum.zc_word[3]);
	}
	}

	static void
	print_indirect(spa_t spa, blkptr_t bp, const zbookmark_phys_t *zb,
	const dnode_phys_t *dnp)
	{
	char blkbuf[BP_SPRINTF_LEN];
	int l;

	if (!BP_IS_EMBEDDED(bp)) {
	ASSERT3U(BP_GET_TYPE(bp), ==, dnp->dn_type);
	ASSERT3U(BP_GET_LEVEL(bp), ==, zb->zb_level);
	}

	(void) printf("%16llx ", (u_longlong_t)blkid2offset(dnp, bp, zb));

	ASSERT(zb->zb_level >= 0);

	for (l = dnp->dn_nlevels - 1; l >= -1; l--) {
	if (l == zb->zb_level) {
	(void) printf("L%llx", (u_longlong_t)zb->zb_level);
	} else {
	(void) printf(" ");
	}
	}

	snprintf_blkptr_compact(blkbuf, sizeof (blkbuf), bp, B_FALSE);
	if (dump_opt['Z'] && BP_GET_COMPRESS(bp) == ZIO_COMPRESS_ZSTD)
	snprintf_zstd_header(spa, blkbuf, sizeof (blkbuf), bp);
	(void) printf("%s\n", blkbuf);
	}

	static int
	visit_indirect(spa_t spa, const dnode_phys_t dnp,
	blkptr_t bp, const zbookmark_phys_t zb)
	{
	int err = 0;

	if (bp->blk_birth == 0)
	return (0);

	print_indirect(spa, bp, zb, dnp);

	if (BP_GET_LEVEL(bp) > 0 && !BP_IS_HOLE(bp)) {
	arc_flags_t flags = ARC_FLAG_WAIT;
	int i;
	blkptr_t *cbp;
	int epb = BP_GET_LSIZE(bp) >> SPA_BLKPTRSHIFT;
	arc_buf_t *buf;
	uint64_t fill = 0;
	ASSERT(!BP_IS_REDACTED(bp));

	err = arc_read(NULL, spa, bp, arc_getbuf_func, &buf,
	ZIO_PRIORITY_ASYNC_READ, ZIO_FLAG_CANFAIL, &flags, zb);
	if (err)
	return (err);
	ASSERT(buf->b_data);

	/* recursively visit blocks below this */
	cbp = buf->b_data;
	for (i = 0; i < epb; i++, cbp++) {
	zbookmark_phys_t czb;

	SET_BOOKMARK(&czb, zb->zb_objset, zb->zb_object,
	zb->zb_level - 1,
	zb->zb_blkid * epb + i);
	err = visit_indirect(spa, dnp, cbp, &czb);
	if (err)
	break;
	fill += BP_GET_FILL(cbp);
	}
	if (!err)
	ASSERT3U(fill, ==, BP_GET_FILL(bp));
	arc_buf_destroy(buf, &buf);
	}

	return (err);
	}

	/ARGSUSED/
	static void
	dump_indirect(dnode_t *dn)
	{
	dnode_phys_t *dnp = dn->dn_phys;
	int j;
	zbookmark_phys_t czb;

	(void) printf("Indirect blocks:\n");

	SET_BOOKMARK(&czb, dmu_objset_id(dn->dn_objset),
	dn->dn_object, dnp->dn_nlevels - 1, 0);
	for (j = 0; j < dnp->dn_nblkptr; j++) {
	czb.zb_blkid = j;
	(void) visit_indirect(dmu_objset_spa(dn->dn_objset), dnp,
	&dnp->dn_blkptr[j], &czb);
	}

	(void) printf("\n");
	}

	/ARGSUSED/
	static void
	dump_dsl_dir(objset_t os, uint64_t object, void data, size_t size)
	{
	dsl_dir_phys_t *dd = data;
	time_t crtime;
	char nice[32];

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (nice) >= NN_NUMBUF_SZ);

	if (dd == NULL)
	return;

	ASSERT3U(size, >=, sizeof (dsl_dir_phys_t));

	crtime = dd->dd_creation_time;
	(void) printf("\t\tcreation_time = %s", ctime(&crtime));
	(void) printf("\t\thead_dataset_obj = %llu\n",
	(u_longlong_t)dd->dd_head_dataset_obj);
	(void) printf("\t\tparent_dir_obj = %llu\n",
	(u_longlong_t)dd->dd_parent_obj);
	(void) printf("\t\torigin_obj = %llu\n",
	(u_longlong_t)dd->dd_origin_obj);
	(void) printf("\t\tchild_dir_zapobj = %llu\n",
	(u_longlong_t)dd->dd_child_dir_zapobj);
	zdb_nicenum(dd->dd_used_bytes, nice, sizeof (nice));
	(void) printf("\t\tused_bytes = %s\n", nice);
	zdb_nicenum(dd->dd_compressed_bytes, nice, sizeof (nice));
	(void) printf("\t\tcompressed_bytes = %s\n", nice);
	zdb_nicenum(dd->dd_uncompressed_bytes, nice, sizeof (nice));
	(void) printf("\t\tuncompressed_bytes = %s\n", nice);
	zdb_nicenum(dd->dd_quota, nice, sizeof (nice));
	(void) printf("\t\tquota = %s\n", nice);
	zdb_nicenum(dd->dd_reserved, nice, sizeof (nice));
	(void) printf("\t\treserved = %s\n", nice);
	(void) printf("\t\tprops_zapobj = %llu\n",
	(u_longlong_t)dd->dd_props_zapobj);
	(void) printf("\t\tdeleg_zapobj = %llu\n",
	(u_longlong_t)dd->dd_deleg_zapobj);
	(void) printf("\t\tflags = %llx\n",
	(u_longlong_t)dd->dd_flags);

	#define DO(which) \
	zdb_nicenum(dd->dd_used_breakdown[DD_USED_ ## which], nice, \
	sizeof (nice)); \
	(void) printf("\t\tused_breakdown[" #which "] = %s\n", nice)
	DO(HEAD);
	DO(SNAP);
	DO(CHILD);
	DO(CHILD_RSRV);
	DO(REFRSRV);
	#undef DO
	(void) printf("\t\tclones = %llu\n",
	(u_longlong_t)dd->dd_clones);
	}

	/ARGSUSED/
	static void
	dump_dsl_dataset(objset_t os, uint64_t object, void data, size_t size)
	{
	dsl_dataset_phys_t *ds = data;
	time_t crtime;
	char used[32], compressed[32], uncompressed[32], unique[32];
	char blkbuf[BP_SPRINTF_LEN];

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (used) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (compressed) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (uncompressed) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (unique) >= NN_NUMBUF_SZ);

	if (ds == NULL)
	return;

	ASSERT(size == sizeof (*ds));
	crtime = ds->ds_creation_time;
	zdb_nicenum(ds->ds_referenced_bytes, used, sizeof (used));
	zdb_nicenum(ds->ds_compressed_bytes, compressed, sizeof (compressed));
	zdb_nicenum(ds->ds_uncompressed_bytes, uncompressed,
	sizeof (uncompressed));
	zdb_nicenum(ds->ds_unique_bytes, unique, sizeof (unique));
	snprintf_blkptr(blkbuf, sizeof (blkbuf), &ds->ds_bp);

	(void) printf("\t\tdir_obj = %llu\n",
	(u_longlong_t)ds->ds_dir_obj);
	(void) printf("\t\tprev_snap_obj = %llu\n",
	(u_longlong_t)ds->ds_prev_snap_obj);
	(void) printf("\t\tprev_snap_txg = %llu\n",
	(u_longlong_t)ds->ds_prev_snap_txg);
	(void) printf("\t\tnext_snap_obj = %llu\n",
	(u_longlong_t)ds->ds_next_snap_obj);
	(void) printf("\t\tsnapnames_zapobj = %llu\n",
	(u_longlong_t)ds->ds_snapnames_zapobj);
	(void) printf("\t\tnum_children = %llu\n",
	(u_longlong_t)ds->ds_num_children);
	(void) printf("\t\tuserrefs_obj = %llu\n",
	(u_longlong_t)ds->ds_userrefs_obj);
	(void) printf("\t\tcreation_time = %s", ctime(&crtime));
	(void) printf("\t\tcreation_txg = %llu\n",
	(u_longlong_t)ds->ds_creation_txg);
	(void) printf("\t\tdeadlist_obj = %llu\n",
	(u_longlong_t)ds->ds_deadlist_obj);
	(void) printf("\t\tused_bytes = %s\n", used);
	(void) printf("\t\tcompressed_bytes = %s\n", compressed);
	(void) printf("\t\tuncompressed_bytes = %s\n", uncompressed);
	(void) printf("\t\tunique = %s\n", unique);
	(void) printf("\t\tfsid_guid = %llu\n",
	(u_longlong_t)ds->ds_fsid_guid);
	(void) printf("\t\tguid = %llu\n",
	(u_longlong_t)ds->ds_guid);
	(void) printf("\t\tflags = %llx\n",
	(u_longlong_t)ds->ds_flags);
	(void) printf("\t\tnext_clones_obj = %llu\n",
	(u_longlong_t)ds->ds_next_clones_obj);
	(void) printf("\t\tprops_obj = %llu\n",
	(u_longlong_t)ds->ds_props_obj);
	(void) printf("\t\tbp = %s\n", blkbuf);
	}

	/* ARGSUSED */
	static int
	dump_bptree_cb(void arg, const blkptr_t bp, dmu_tx_t *tx)
	{
	char blkbuf[BP_SPRINTF_LEN];

	if (bp->blk_birth != 0) {
	snprintf_blkptr(blkbuf, sizeof (blkbuf), bp);
	(void) printf("\t%s\n", blkbuf);
	}
	return (0);
	}

	static void
	dump_bptree(objset_t os, uint64_t obj, const char name)
	{
	char bytes[32];
	bptree_phys_t *bt;
	dmu_buf_t *db;

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (bytes) >= NN_NUMBUF_SZ);

	if (dump_opt['d'] < 3)
	return;

	VERIFY3U(0, ==, dmu_bonus_hold(os, obj, FTAG, &db));
	bt = db->db_data;
	zdb_nicenum(bt->bt_bytes, bytes, sizeof (bytes));
	(void) printf("\n %s: %llu datasets, %s\n",
	name, (unsigned long long)(bt->bt_end - bt->bt_begin), bytes);
	dmu_buf_rele(db, FTAG);

	if (dump_opt['d'] < 5)
	return;

	(void) printf("\n");

	(void) bptree_iterate(os, obj, B_FALSE, dump_bptree_cb, NULL, NULL);
	}

	/* ARGSUSED */
	static int
	dump_bpobj_cb(void arg, const blkptr_t bp, boolean_t bp_freed, dmu_tx_t *tx)
	{
	char blkbuf[BP_SPRINTF_LEN];

	ASSERT(bp->blk_birth != 0);
	snprintf_blkptr_compact(blkbuf, sizeof (blkbuf), bp, bp_freed);
	(void) printf("\t%s\n", blkbuf);
	return (0);
	}

	static void
	dump_full_bpobj(bpobj_t bpo, const char name, int indent)
	{
	char bytes[32];
	char comp[32];
	char uncomp[32];
	uint64_t i;

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (bytes) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (comp) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (uncomp) >= NN_NUMBUF_SZ);

	if (dump_opt['d'] < 3)
	return;

	zdb_nicenum(bpo->bpo_phys->bpo_bytes, bytes, sizeof (bytes));
	if (bpo->bpo_havesubobj && bpo->bpo_phys->bpo_subobjs != 0) {
	zdb_nicenum(bpo->bpo_phys->bpo_comp, comp, sizeof (comp));
	zdb_nicenum(bpo->bpo_phys->bpo_uncomp, uncomp, sizeof (uncomp));
	if (bpo->bpo_havefreed) {
	(void) printf(" %*s: object %llu, %llu local "
	"blkptrs, %llu freed, %llu subobjs in object %llu, "
	"%s (%s/%s comp)\n",
	indent * 8, name,
	(u_longlong_t)bpo->bpo_object,
	(u_longlong_t)bpo->bpo_phys->bpo_num_blkptrs,
	(u_longlong_t)bpo->bpo_phys->bpo_num_freed,
	(u_longlong_t)bpo->bpo_phys->bpo_num_subobjs,
	(u_longlong_t)bpo->bpo_phys->bpo_subobjs,
	bytes, comp, uncomp);
	} else {
	(void) printf(" %*s: object %llu, %llu local "
	"blkptrs, %llu subobjs in object %llu, "
	"%s (%s/%s comp)\n",
	indent * 8, name,
	(u_longlong_t)bpo->bpo_object,
	(u_longlong_t)bpo->bpo_phys->bpo_num_blkptrs,
	(u_longlong_t)bpo->bpo_phys->bpo_num_subobjs,
	(u_longlong_t)bpo->bpo_phys->bpo_subobjs,
	bytes, comp, uncomp);
	}

	for (i = 0; i < bpo->bpo_phys->bpo_num_subobjs; i++) {
	uint64_t subobj;
	bpobj_t subbpo;
	int error;
	VERIFY0(dmu_read(bpo->bpo_os,
	bpo->bpo_phys->bpo_subobjs,
	i * sizeof (subobj), sizeof (subobj), &subobj, 0));
	error = bpobj_open(&subbpo, bpo->bpo_os, subobj);
	if (error != 0) {
	(void) printf("ERROR %u while trying to open "
	"subobj id %llu\n",
	error, (u_longlong_t)subobj);
	continue;
	}
	dump_full_bpobj(&subbpo, "subobj", indent + 1);
	bpobj_close(&subbpo);
	}
	} else {
	if (bpo->bpo_havefreed) {
	(void) printf(" %*s: object %llu, %llu blkptrs, "
	"%llu freed, %s\n",
	indent * 8, name,
	(u_longlong_t)bpo->bpo_object,
	(u_longlong_t)bpo->bpo_phys->bpo_num_blkptrs,
	(u_longlong_t)bpo->bpo_phys->bpo_num_freed,
	bytes);
	} else {
	(void) printf(" %*s: object %llu, %llu blkptrs, "
	"%s\n",
	indent * 8, name,
	(u_longlong_t)bpo->bpo_object,
	(u_longlong_t)bpo->bpo_phys->bpo_num_blkptrs,
	bytes);
	}
	}

	if (dump_opt['d'] < 5)
	return;


	if (indent == 0) {
	(void) bpobj_iterate_nofree(bpo, dump_bpobj_cb, NULL, NULL);
	(void) printf("\n");
	}
	}

	static int
	dump_bookmark(dsl_pool_t dp, char name, boolean_t print_redact,
	boolean_t print_list)
	{
	int err = 0;
	zfs_bookmark_phys_t prop;
	objset_t *mos = dp->dp_spa->spa_meta_objset;
	err = dsl_bookmark_lookup(dp, name, NULL, &prop);

	if (err != 0) {
	return (err);
	}

	(void) printf("\t#%s: ", strchr(name, '#') + 1);
	(void) printf("{guid: %llx creation_txg: %llu creation_time: "
	"%llu redaction_obj: %llu}\n", (u_longlong_t)prop.zbm_guid,
	(u_longlong_t)prop.zbm_creation_txg,
	(u_longlong_t)prop.zbm_creation_time,
	(u_longlong_t)prop.zbm_redaction_obj);

	IMPLY(print_list, print_redact);
	if (!print_redact \|\| prop.zbm_redaction_obj == 0)
	return (0);

	redaction_list_t *rl;
	VERIFY0(dsl_redaction_list_hold_obj(dp,
	prop.zbm_redaction_obj, FTAG, &rl));

	redaction_list_phys_t *rlp = rl->rl_phys;
	(void) printf("\tRedacted:\n\t\tProgress: ");
	if (rlp->rlp_last_object != UINT64_MAX \|\|
	rlp->rlp_last_blkid != UINT64_MAX) {
	(void) printf("%llu %llu (incomplete)\n",
	(u_longlong_t)rlp->rlp_last_object,
	(u_longlong_t)rlp->rlp_last_blkid);
	} else {
	(void) printf("complete\n");
	}
	(void) printf("\t\tSnapshots: [");
	for (unsigned int i = 0; i < rlp->rlp_num_snaps; i++) {
	if (i > 0)
	(void) printf(", ");
	(void) printf("%0llu",
	(u_longlong_t)rlp->rlp_snaps[i]);
	}
	(void) printf("]\n\t\tLength: %llu\n",
	(u_longlong_t)rlp->rlp_num_entries);

	if (!print_list) {
	dsl_redaction_list_rele(rl, FTAG);
	return (0);
	}

	if (rlp->rlp_num_entries == 0) {
	dsl_redaction_list_rele(rl, FTAG);
	(void) printf("\t\tRedaction List: []\n\n");
	return (0);
	}

	redact_block_phys_t *rbp_buf;
	uint64_t size;
	dmu_object_info_t doi;

	VERIFY0(dmu_object_info(mos, prop.zbm_redaction_obj, &doi));
	size = doi.doi_max_offset;
	rbp_buf = kmem_alloc(size, KM_SLEEP);

	err = dmu_read(mos, prop.zbm_redaction_obj, 0, size,
	rbp_buf, 0);
	if (err != 0) {
	dsl_redaction_list_rele(rl, FTAG);
	kmem_free(rbp_buf, size);
	return (err);
	}

	(void) printf("\t\tRedaction List: [{object: %llx, offset: "
	"%llx, blksz: %x, count: %llx}",
	(u_longlong_t)rbp_buf[0].rbp_object,
	(u_longlong_t)rbp_buf[0].rbp_blkid,
	(uint_t)(redact_block_get_size(&rbp_buf[0])),
	(u_longlong_t)redact_block_get_count(&rbp_buf[0]));

	for (size_t i = 1; i < rlp->rlp_num_entries; i++) {
	(void) printf(",\n\t\t{object: %llx, offset: %llx, "
	"blksz: %x, count: %llx}",
	(u_longlong_t)rbp_buf[i].rbp_object,
	(u_longlong_t)rbp_buf[i].rbp_blkid,
	(uint_t)(redact_block_get_size(&rbp_buf[i])),
	(u_longlong_t)redact_block_get_count(&rbp_buf[i]));
	}
	dsl_redaction_list_rele(rl, FTAG);
	kmem_free(rbp_buf, size);
	(void) printf("]\n\n");
	return (0);
	}

	static void
	dump_bookmarks(objset_t *os, int verbosity)
	{
	zap_cursor_t zc;
	zap_attribute_t attr;
	dsl_dataset_t *ds = dmu_objset_ds(os);
	dsl_pool_t *dp = spa_get_dsl(os->os_spa);
	objset_t *mos = os->os_spa->spa_meta_objset;
	if (verbosity < 4)
	return;
	dsl_pool_config_enter(dp, FTAG);

	for (zap_cursor_init(&zc, mos, ds->ds_bookmarks_obj);
	zap_cursor_retrieve(&zc, &attr) == 0;
	zap_cursor_advance(&zc)) {
	char osname[ZFS_MAX_DATASET_NAME_LEN];
	char buf[ZFS_MAX_DATASET_NAME_LEN];
	dmu_objset_name(os, osname);
	VERIFY3S(0, <=, snprintf(buf, sizeof (buf), "%s#%s", osname,
	attr.za_name));
	(void) dump_bookmark(dp, buf, verbosity >= 5, verbosity >= 6);
	}
	zap_cursor_fini(&zc);
	dsl_pool_config_exit(dp, FTAG);
	}

	static void
	bpobj_count_refd(bpobj_t *bpo)
	{
	mos_obj_refd(bpo->bpo_object);

	if (bpo->bpo_havesubobj && bpo->bpo_phys->bpo_subobjs != 0) {
	mos_obj_refd(bpo->bpo_phys->bpo_subobjs);
	for (uint64_t i = 0; i < bpo->bpo_phys->bpo_num_subobjs; i++) {
	uint64_t subobj;
	bpobj_t subbpo;
	int error;
	VERIFY0(dmu_read(bpo->bpo_os,
	bpo->bpo_phys->bpo_subobjs,
	i * sizeof (subobj), sizeof (subobj), &subobj, 0));
	error = bpobj_open(&subbpo, bpo->bpo_os, subobj);
	if (error != 0) {
	(void) printf("ERROR %u while trying to open "
	"subobj id %llu\n",
	error, (u_longlong_t)subobj);
	continue;
	}
	bpobj_count_refd(&subbpo);
	bpobj_close(&subbpo);
	}
	}
	}

	static int
	dsl_deadlist_entry_count_refd(void arg, dsl_deadlist_entry_t dle)
	{
	spa_t *spa = arg;
	uint64_t empty_bpobj = spa->spa_dsl_pool->dp_empty_bpobj;
	if (dle->dle_bpobj.bpo_object != empty_bpobj)
	bpobj_count_refd(&dle->dle_bpobj);
	return (0);
	}

	static int
	dsl_deadlist_entry_dump(void arg, dsl_deadlist_entry_t dle)
	{
	ASSERT(arg == NULL);
	if (dump_opt['d'] >= 5) {
	char buf[128];
	(void) snprintf(buf, sizeof (buf),
	"mintxg %llu -> obj %llu",
	(longlong_t)dle->dle_mintxg,
	(longlong_t)dle->dle_bpobj.bpo_object);

	dump_full_bpobj(&dle->dle_bpobj, buf, 0);
	} else {
	(void) printf("mintxg %llu -> obj %llu\n",
	(longlong_t)dle->dle_mintxg,
	(longlong_t)dle->dle_bpobj.bpo_object);
	}
	return (0);
	}

	static void
	dump_blkptr_list(dsl_deadlist_t dl, char name)
	{
	char bytes[32];
	char comp[32];
	char uncomp[32];
	char entries[32];
	spa_t *spa = dmu_objset_spa(dl->dl_os);
	uint64_t empty_bpobj = spa->spa_dsl_pool->dp_empty_bpobj;

	if (dl->dl_oldfmt) {
	if (dl->dl_bpobj.bpo_object != empty_bpobj)
	bpobj_count_refd(&dl->dl_bpobj);
	} else {
	mos_obj_refd(dl->dl_object);
	dsl_deadlist_iterate(dl, dsl_deadlist_entry_count_refd, spa);
	}

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (bytes) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (comp) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (uncomp) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (entries) >= NN_NUMBUF_SZ);

	if (dump_opt['d'] < 3)
	return;

	if (dl->dl_oldfmt) {
	dump_full_bpobj(&dl->dl_bpobj, "old-format deadlist", 0);
	return;
	}

	zdb_nicenum(dl->dl_phys->dl_used, bytes, sizeof (bytes));
	zdb_nicenum(dl->dl_phys->dl_comp, comp, sizeof (comp));
	zdb_nicenum(dl->dl_phys->dl_uncomp, uncomp, sizeof (uncomp));
	zdb_nicenum(avl_numnodes(&dl->dl_tree), entries, sizeof (entries));
	(void) printf("\n %s: %s (%s/%s comp), %s entries\n",
	name, bytes, comp, uncomp, entries);

	if (dump_opt['d'] < 4)
	return;

	(void) printf("\n");

	dsl_deadlist_iterate(dl, dsl_deadlist_entry_dump, NULL);
	}

	static int
	verify_dd_livelist(objset_t *os)
	{
	uint64_t ll_used, used, ll_comp, comp, ll_uncomp, uncomp;
	dsl_pool_t *dp = spa_get_dsl(os->os_spa);
	dsl_dir_t *dd = os->os_dsl_dataset->ds_dir;

	ASSERT(!dmu_objset_is_snapshot(os));
	if (!dsl_deadlist_is_open(&dd->dd_livelist))
	return (0);

	/* Iterate through the livelist to check for duplicates */
	dsl_deadlist_iterate(&dd->dd_livelist, sublivelist_verify_lightweight,
	NULL);

	dsl_pool_config_enter(dp, FTAG);
	dsl_deadlist_space(&dd->dd_livelist, &ll_used,
	&ll_comp, &ll_uncomp);

	dsl_dataset_t *origin_ds;
	ASSERT(dsl_pool_config_held(dp));
	VERIFY0(dsl_dataset_hold_obj(dp,
	dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin_ds));
	VERIFY0(dsl_dataset_space_written(origin_ds, os->os_dsl_dataset,
	&used, &comp, &uncomp));
	dsl_dataset_rele(origin_ds, FTAG);
	dsl_pool_config_exit(dp, FTAG);
	/*
	* It's possible that the dataset's uncomp space is larger than the
	* livelist's because livelists do not track embedded block pointers
	*/
	if (used != ll_used \|\| comp != ll_comp \|\| uncomp < ll_uncomp) {
	char nice_used[32], nice_comp[32], nice_uncomp[32];
	(void) printf("Discrepancy in space accounting:\n");
	zdb_nicenum(used, nice_used, sizeof (nice_used));
	zdb_nicenum(comp, nice_comp, sizeof (nice_comp));
	zdb_nicenum(uncomp, nice_uncomp, sizeof (nice_uncomp));
	(void) printf("dir: used %s, comp %s, uncomp %s\n",
	nice_used, nice_comp, nice_uncomp);
	zdb_nicenum(ll_used, nice_used, sizeof (nice_used));
	zdb_nicenum(ll_comp, nice_comp, sizeof (nice_comp));
	zdb_nicenum(ll_uncomp, nice_uncomp, sizeof (nice_uncomp));
	(void) printf("livelist: used %s, comp %s, uncomp %s\n",
	nice_used, nice_comp, nice_uncomp);
	return (1);
	}
	return (0);
	}

	static avl_tree_t idx_tree;
	static avl_tree_t domain_tree;
	static boolean_t fuid_table_loaded;
	static objset_t *sa_os = NULL;
	static sa_attr_type_t *sa_attr_table = NULL;

	static int
	open_objset(const char path, void tag, objset_t **osp)
	{
	int err;
	uint64_t sa_attrs = 0;
	uint64_t version = 0;

	VERIFY3P(sa_os, ==, NULL);
	/*
	* We can't own an objset if it's redacted. Therefore, we do this
	* dance: hold the objset, then acquire a long hold on its dataset, then
	* release the pool (which is held as part of holding the objset).
	*/
	err = dmu_objset_hold(path, tag, osp);
	if (err != 0) {
	(void) fprintf(stderr, "failed to hold dataset '%s': %s\n",
	path, strerror(err));
	return (err);
	}
	dsl_dataset_long_hold(dmu_objset_ds(*osp), tag);
	dsl_pool_rele(dmu_objset_pool(*osp), tag);

	if (dmu_objset_type(osp) == DMU_OST_ZFS && !(osp)->os_encrypted) {
	(void) zap_lookup(*osp, MASTER_NODE_OBJ, ZPL_VERSION_STR,
	8, 1, &version);
	if (version >= ZPL_VERSION_SA) {
	(void) zap_lookup(*osp, MASTER_NODE_OBJ, ZFS_SA_ATTRS,
	8, 1, &sa_attrs);
	}
	err = sa_setup(*osp, sa_attrs, zfs_attr_table, ZPL_END,
	&sa_attr_table);
	if (err != 0) {
	(void) fprintf(stderr, "sa_setup failed: %s\n",
	strerror(err));
	dsl_dataset_long_rele(dmu_objset_ds(*osp), tag);
	dsl_dataset_rele(dmu_objset_ds(*osp), tag);
	*osp = NULL;
	}
	}
	sa_os = *osp;

	return (0);
	}

	static void
	close_objset(objset_t os, void tag)
	{
	VERIFY3P(os, ==, sa_os);
	if (os->os_sa != NULL)
	sa_tear_down(os);
	dsl_dataset_long_rele(dmu_objset_ds(os), tag);
	dsl_dataset_rele(dmu_objset_ds(os), tag);
	sa_attr_table = NULL;
	sa_os = NULL;
	}

	static void
	fuid_table_destroy(void)
	{
	if (fuid_table_loaded) {
	zfs_fuid_table_destroy(&idx_tree, &domain_tree);
	fuid_table_loaded = B_FALSE;
	}
	}

	/*
	* print uid or gid information.
	* For normal POSIX id just the id is printed in decimal format.
	* For CIFS files with FUID the fuid is printed in hex followed by
	* the domain-rid string.
	*/
	static void
	print_idstr(uint64_t id, const char *id_type)
	{
	if (FUID_INDEX(id)) {
	char *domain;

	domain = zfs_fuid_idx_domain(&idx_tree, FUID_INDEX(id));
	(void) printf("\t%s %llx [%s-%d]\n", id_type,
	(u_longlong_t)id, domain, (int)FUID_RID(id));
	} else {
	(void) printf("\t%s %llu\n", id_type, (u_longlong_t)id);
	}

	}

	static void
	dump_uidgid(objset_t *os, uint64_t uid, uint64_t gid)
	{
	uint32_t uid_idx, gid_idx;

	uid_idx = FUID_INDEX(uid);
	gid_idx = FUID_INDEX(gid);

	/* Load domain table, if not already loaded */
	if (!fuid_table_loaded && (uid_idx \|\| gid_idx)) {
	uint64_t fuid_obj;

	/* first find the fuid object. It lives in the master node */
	VERIFY(zap_lookup(os, MASTER_NODE_OBJ, ZFS_FUID_TABLES,
	8, 1, &fuid_obj) == 0);
	zfs_fuid_avl_tree_create(&idx_tree, &domain_tree);
	(void) zfs_fuid_table_load(os, fuid_obj,
	&idx_tree, &domain_tree);
	fuid_table_loaded = B_TRUE;
	}

	print_idstr(uid, "uid");
	print_idstr(gid, "gid");
	}

	static void
	dump_znode_sa_xattr(sa_handle_t *hdl)
	{
	nvlist_t *sa_xattr;
	nvpair_t *elem = NULL;
	int sa_xattr_size = 0;
	int sa_xattr_entries = 0;
	int error;
	char *sa_xattr_packed;

	error = sa_size(hdl, sa_attr_table[ZPL_DXATTR], &sa_xattr_size);
	if (error \|\| sa_xattr_size == 0)
	return;

	sa_xattr_packed = malloc(sa_xattr_size);
	if (sa_xattr_packed == NULL)
	return;

	error = sa_lookup(hdl, sa_attr_table[ZPL_DXATTR],
	sa_xattr_packed, sa_xattr_size);
	if (error) {
	free(sa_xattr_packed);
	return;
	}

	error = nvlist_unpack(sa_xattr_packed, sa_xattr_size, &sa_xattr, 0);
	if (error) {
	free(sa_xattr_packed);
	return;
	}

	while ((elem = nvlist_next_nvpair(sa_xattr, elem)) != NULL)
	sa_xattr_entries++;

	(void) printf("\tSA xattrs: %d bytes, %d entries\n\n",
	sa_xattr_size, sa_xattr_entries);
	while ((elem = nvlist_next_nvpair(sa_xattr, elem)) != NULL) {
	uchar_t *value;
	uint_t cnt, idx;

	(void) printf("\t\t%s = ", nvpair_name(elem));
	nvpair_value_byte_array(elem, &value, &cnt);
	for (idx = 0; idx < cnt; ++idx) {
	if (isprint(value[idx]))
	(void) putchar(value[idx]);
	else
	(void) printf("\\%3.3o", value[idx]);
	}
	(void) putchar('\n');
	}

	nvlist_free(sa_xattr);
	free(sa_xattr_packed);
	}

	static void
	dump_znode_symlink(sa_handle_t *hdl)
	{
	int sa_symlink_size = 0;
	char linktarget[MAXPATHLEN];
	linktarget[0] = '\0';
	int error;

	error = sa_size(hdl, sa_attr_table[ZPL_SYMLINK], &sa_symlink_size);
	if (error \|\| sa_symlink_size == 0) {
	return;
	}
	if (sa_lookup(hdl, sa_attr_table[ZPL_SYMLINK],
	&linktarget, sa_symlink_size) == 0)
	(void) printf("\ttarget %s\n", linktarget);
	}

	/ARGSUSED/
	static void
	dump_znode(objset_t os, uint64_t object, void data, size_t size)
	{
	char path[MAXPATHLEN * 2]; /* allow for xattr and failure prefix */
	sa_handle_t *hdl;
	uint64_t xattr, rdev, gen;
	uint64_t uid, gid, mode, fsize, parent, links;
	uint64_t pflags;
	uint64_t acctm[2], modtm[2], chgtm[2], crtm[2];
	time_t z_crtime, z_atime, z_mtime, z_ctime;
	sa_bulk_attr_t bulk[12];
	int idx = 0;
	int error;

	VERIFY3P(os, ==, sa_os);
	if (sa_handle_get(os, object, NULL, SA_HDL_PRIVATE, &hdl)) {
	(void) printf("Failed to get handle for SA znode\n");
	return;
	}

	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_UID], NULL, &uid, 8);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_GID], NULL, &gid, 8);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_LINKS], NULL,
	&links, 8);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_GEN], NULL, &gen, 8);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_MODE], NULL,
	&mode, 8);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_PARENT],
	NULL, &parent, 8);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_SIZE], NULL,
	&fsize, 8);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_ATIME], NULL,
	acctm, 16);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_MTIME], NULL,
	modtm, 16);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_CRTIME], NULL,
	crtm, 16);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_CTIME], NULL,
	chgtm, 16);
	SA_ADD_BULK_ATTR(bulk, idx, sa_attr_table[ZPL_FLAGS], NULL,
	&pflags, 8);

	if (sa_bulk_lookup(hdl, bulk, idx)) {
	(void) sa_handle_destroy(hdl);
	return;
	}

	z_crtime = (time_t)crtm[0];
	z_atime = (time_t)acctm[0];
	z_mtime = (time_t)modtm[0];
	z_ctime = (time_t)chgtm[0];

	if (dump_opt['d'] > 4) {
	error = zfs_obj_to_path(os, object, path, sizeof (path));
	if (error == ESTALE) {
	(void) snprintf(path, sizeof (path), "on delete queue");
	} else if (error != 0) {
	leaked_objects++;
	(void) snprintf(path, sizeof (path),
	"path not found, possibly leaked");
	}
	(void) printf("\tpath %s\n", path);
	}

	if (S_ISLNK(mode))
	dump_znode_symlink(hdl);
	dump_uidgid(os, uid, gid);
	(void) printf("\tatime %s", ctime(&z_atime));
	(void) printf("\tmtime %s", ctime(&z_mtime));
	(void) printf("\tctime %s", ctime(&z_ctime));
	(void) printf("\tcrtime %s", ctime(&z_crtime));
	(void) printf("\tgen %llu\n", (u_longlong_t)gen);
	(void) printf("\tmode %llo\n", (u_longlong_t)mode);
	(void) printf("\tsize %llu\n", (u_longlong_t)fsize);
	(void) printf("\tparent %llu\n", (u_longlong_t)parent);
	(void) printf("\tlinks %llu\n", (u_longlong_t)links);
	(void) printf("\tpflags %llx\n", (u_longlong_t)pflags);
	if (dmu_objset_projectquota_enabled(os) && (pflags & ZFS_PROJID)) {
	uint64_t projid;

	if (sa_lookup(hdl, sa_attr_table[ZPL_PROJID], &projid,
	sizeof (uint64_t)) == 0)
	(void) printf("\tprojid %llu\n", (u_longlong_t)projid);
	}
	if (sa_lookup(hdl, sa_attr_table[ZPL_XATTR], &xattr,
	sizeof (uint64_t)) == 0)
	(void) printf("\txattr %llu\n", (u_longlong_t)xattr);
	if (sa_lookup(hdl, sa_attr_table[ZPL_RDEV], &rdev,
	sizeof (uint64_t)) == 0)
	(void) printf("\trdev 0x%016llx\n", (u_longlong_t)rdev);
	dump_znode_sa_xattr(hdl);
	sa_handle_destroy(hdl);
	}

	/ARGSUSED/
	static void
	dump_acl(objset_t os, uint64_t object, void data, size_t size)
	{
	}

	/ARGSUSED/
	static void
	dump_dmu_objset(objset_t os, uint64_t object, void data, size_t size)
	{
	}

	static object_viewer_t *object_viewer[DMU_OT_NUMTYPES + 1] = {
	dump_none, /* unallocated */
	dump_zap, /* object directory */
	dump_uint64, /* object array */
	dump_none, /* packed nvlist */
	dump_packed_nvlist, /* packed nvlist size */
	dump_none, /* bpobj */
	dump_bpobj, /* bpobj header */
	dump_none, /* SPA space map header */
	dump_none, /* SPA space map */
	dump_none, /* ZIL intent log */
	dump_dnode, /* DMU dnode */
	dump_dmu_objset, /* DMU objset */
	dump_dsl_dir, /* DSL directory */
	dump_zap, /* DSL directory child map */
	dump_zap, /* DSL dataset snap map */
	dump_zap, /* DSL props */
	dump_dsl_dataset, /* DSL dataset */
	dump_znode, /* ZFS znode */
	dump_acl, /* ZFS V0 ACL */
	dump_uint8, /* ZFS plain file */
	dump_zpldir, /* ZFS directory */
	dump_zap, /* ZFS master node */
	dump_zap, /* ZFS delete queue */
	dump_uint8, /* zvol object */
	dump_zap, /* zvol prop */
	dump_uint8, /* other uint8[] */
	dump_uint64, /* other uint64[] */
	dump_zap, /* other ZAP */
	dump_zap, /* persistent error log */
	dump_uint8, /* SPA history */
	dump_history_offsets, /* SPA history offsets */
	dump_zap, /* Pool properties */
	dump_zap, /* DSL permissions */
	dump_acl, /* ZFS ACL */
	dump_uint8, /* ZFS SYSACL */
	dump_none, /* FUID nvlist */
	dump_packed_nvlist, /* FUID nvlist size */
	dump_zap, /* DSL dataset next clones */
	dump_zap, /* DSL scrub queue */
	dump_zap, /* ZFS user/group/project used */
	dump_zap, /* ZFS user/group/project quota */
	dump_zap, /* snapshot refcount tags */
	dump_ddt_zap, /* DDT ZAP object */
	dump_zap, /* DDT statistics */
	dump_znode, /* SA object */
	dump_zap, /* SA Master Node */
	dump_sa_attrs, /* SA attribute registration */
	dump_sa_layouts, /* SA attribute layouts */
	dump_zap, /* DSL scrub translations */
	dump_none, /* fake dedup BP */
	dump_zap, /* deadlist */
	dump_none, /* deadlist hdr */
	dump_zap, /* dsl clones */
	dump_bpobj_subobjs, /* bpobj subobjs */
	dump_unknown, /* Unknown type, must be last */
	};

	static boolean_t
	match_object_type(dmu_object_type_t obj_type, uint64_t flags)
	{
	boolean_t match = B_TRUE;

	switch (obj_type) {
	case DMU_OT_DIRECTORY_CONTENTS:
	if (!(flags & ZOR_FLAG_DIRECTORY))
	match = B_FALSE;
	break;
	case DMU_OT_PLAIN_FILE_CONTENTS:
	if (!(flags & ZOR_FLAG_PLAIN_FILE))
	match = B_FALSE;
	break;
	case DMU_OT_SPACE_MAP:
	if (!(flags & ZOR_FLAG_SPACE_MAP))
	match = B_FALSE;
	break;
	default:
	if (strcmp(zdb_ot_name(obj_type), "zap") == 0) {
	if (!(flags & ZOR_FLAG_ZAP))
	match = B_FALSE;
	break;
	}

	/*
	* If all bits except some of the supported flags are
	* set, the user combined the all-types flag (A) with
	* a negated flag to exclude some types (e.g. A-f to
	* show all object types except plain files).
	*/
	if ((flags \| ZOR_SUPPORTED_FLAGS) != ZOR_FLAG_ALL_TYPES)
	match = B_FALSE;

	break;
	}

	return (match);
	}

	static void
	dump_object(objset_t *os, uint64_t object, int verbosity,
	boolean_t print_header, uint64_t dnode_slots_used, uint64_t flags)
	{
	dmu_buf_t *db = NULL;
	dmu_object_info_t doi;
	dnode_t *dn;
	boolean_t dnode_held = B_FALSE;
	void *bonus = NULL;
	size_t bsize = 0;
	char iblk[32], dblk[32], lsize[32], asize[32], fill[32], dnsize[32];
	char bonus_size[32];
	char aux[50];
	int error;

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (iblk) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (dblk) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (lsize) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (asize) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (bonus_size) >= NN_NUMBUF_SZ);

	if (*print_header) {
	(void) printf("\n%10s %3s %5s %5s %5s %6s %5s %6s %s\n",
	"Object", "lvl", "iblk", "dblk", "dsize", "dnsize",
	"lsize", "%full", "type");
	*print_header = 0;
	}

	if (object == 0) {
	dn = DMU_META_DNODE(os);
	dmu_object_info_from_dnode(dn, &doi);
	} else {
	/*
	* Encrypted datasets will have sensitive bonus buffers
	* encrypted. Therefore we cannot hold the bonus buffer and
	* must hold the dnode itself instead.
	*/
	error = dmu_object_info(os, object, &doi);
	if (error)
	fatal("dmu_object_info() failed, errno %u", error);

	if (os->os_encrypted &&
	DMU_OT_IS_ENCRYPTED(doi.doi_bonus_type)) {
	error = dnode_hold(os, object, FTAG, &dn);
	if (error)
	fatal("dnode_hold() failed, errno %u", error);
	dnode_held = B_TRUE;
	} else {
	error = dmu_bonus_hold(os, object, FTAG, &db);
	if (error)
	fatal("dmu_bonus_hold(%llu) failed, errno %u",
	object, error);
	bonus = db->db_data;
	bsize = db->db_size;
	dn = DB_DNODE((dmu_buf_impl_t *)db);
	}
	}

	/*
	* Default to showing all object types if no flags were specified.
	*/
	if (flags != 0 && flags != ZOR_FLAG_ALL_TYPES &&
	!match_object_type(doi.doi_type, flags))
	goto out;

	if (dnode_slots_used)
	*dnode_slots_used = doi.doi_dnodesize / DNODE_MIN_SIZE;

	zdb_nicenum(doi.doi_metadata_block_size, iblk, sizeof (iblk));
	zdb_nicenum(doi.doi_data_block_size, dblk, sizeof (dblk));
	zdb_nicenum(doi.doi_max_offset, lsize, sizeof (lsize));
	zdb_nicenum(doi.doi_physical_blocks_512 << 9, asize, sizeof (asize));
	zdb_nicenum(doi.doi_bonus_size, bonus_size, sizeof (bonus_size));
	zdb_nicenum(doi.doi_dnodesize, dnsize, sizeof (dnsize));
	(void) sprintf(fill, "%6.2f", 100.0 * doi.doi_fill_count *
	doi.doi_data_block_size / (object == 0 ? DNODES_PER_BLOCK : 1) /
	doi.doi_max_offset);

	aux[0] = '\0';

	if (doi.doi_checksum != ZIO_CHECKSUM_INHERIT \|\| verbosity >= 6) {
	(void) snprintf(aux + strlen(aux), sizeof (aux) - strlen(aux),
	" (K=%s)", ZDB_CHECKSUM_NAME(doi.doi_checksum));
	}

	if (doi.doi_compress == ZIO_COMPRESS_INHERIT &&
	ZIO_COMPRESS_HASLEVEL(os->os_compress) && verbosity >= 6) {
	const char *compname = NULL;
	if (zfs_prop_index_to_string(ZFS_PROP_COMPRESSION,
	ZIO_COMPRESS_RAW(os->os_compress, os->os_complevel),
	&compname) == 0) {
	(void) snprintf(aux + strlen(aux),
	sizeof (aux) - strlen(aux), " (Z=inherit=%s)",
	compname);
	} else {
	(void) snprintf(aux + strlen(aux),
	sizeof (aux) - strlen(aux),
	" (Z=inherit=%s-unknown)",
	ZDB_COMPRESS_NAME(os->os_compress));
	}
	} else if (doi.doi_compress == ZIO_COMPRESS_INHERIT && verbosity >= 6) {
	(void) snprintf(aux + strlen(aux), sizeof (aux) - strlen(aux),
	" (Z=inherit=%s)", ZDB_COMPRESS_NAME(os->os_compress));
	} else if (doi.doi_compress != ZIO_COMPRESS_INHERIT \|\| verbosity >= 6) {
	(void) snprintf(aux + strlen(aux), sizeof (aux) - strlen(aux),
	" (Z=%s)", ZDB_COMPRESS_NAME(doi.doi_compress));
	}

	(void) printf("%10lld %3u %5s %5s %5s %6s %5s %6s %s%s\n",
	(u_longlong_t)object, doi.doi_indirection, iblk, dblk,
	asize, dnsize, lsize, fill, zdb_ot_name(doi.doi_type), aux);

	if (doi.doi_bonus_type != DMU_OT_NONE && verbosity > 3) {
	(void) printf("%10s %3s %5s %5s %5s %5s %5s %6s %s\n",
	"", "", "", "", "", "", bonus_size, "bonus",
	zdb_ot_name(doi.doi_bonus_type));
	}

	if (verbosity >= 4) {
	(void) printf("\tdnode flags: %s%s%s%s\n",
	(dn->dn_phys->dn_flags & DNODE_FLAG_USED_BYTES) ?
	"USED_BYTES " : "",
	(dn->dn_phys->dn_flags & DNODE_FLAG_USERUSED_ACCOUNTED) ?
	"USERUSED_ACCOUNTED " : "",
	(dn->dn_phys->dn_flags & DNODE_FLAG_USEROBJUSED_ACCOUNTED) ?
	"USEROBJUSED_ACCOUNTED " : "",
	(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR) ?
	"SPILL_BLKPTR" : "");
	(void) printf("\tdnode maxblkid: %llu\n",
	(longlong_t)dn->dn_phys->dn_maxblkid);

	if (!dnode_held) {
	object_viewer[ZDB_OT_TYPE(doi.doi_bonus_type)](os,
	object, bonus, bsize);
	} else {
	(void) printf("\t\t(bonus encrypted)\n");
	}

	if (!os->os_encrypted \|\| !DMU_OT_IS_ENCRYPTED(doi.doi_type)) {
	object_viewer[ZDB_OT_TYPE(doi.doi_type)](os, object,
	NULL, 0);
	} else {
	(void) printf("\t\t(object encrypted)\n");
	}

	*print_header = B_TRUE;
	}

	if (verbosity >= 5)
	dump_indirect(dn);

	if (verbosity >= 5) {
	/*
	* Report the list of segments that comprise the object.
	*/
	uint64_t start = 0;
	uint64_t end;
	uint64_t blkfill = 1;
	int minlvl = 1;

	if (dn->dn_type == DMU_OT_DNODE) {
	minlvl = 0;
	blkfill = DNODES_PER_BLOCK;
	}

	for (;;) {
	char segsize[32];
	/* make sure nicenum has enough space */
	CTASSERT(sizeof (segsize) >= NN_NUMBUF_SZ);
	error = dnode_next_offset(dn,
	0, &start, minlvl, blkfill, 0);
	if (error)
	break;
	end = start;
	error = dnode_next_offset(dn,
	DNODE_FIND_HOLE, &end, minlvl, blkfill, 0);
	zdb_nicenum(end - start, segsize, sizeof (segsize));
	(void) printf("\t\tsegment [%016llx, %016llx)"
	" size %5s\n", (u_longlong_t)start,
	(u_longlong_t)end, segsize);
	if (error)
	break;
	start = end;
	}
	}

	out:
	if (db != NULL)
	dmu_buf_rele(db, FTAG);
	if (dnode_held)
	dnode_rele(dn, FTAG);
	}

	static void
	count_dir_mos_objects(dsl_dir_t *dd)
	{
	mos_obj_refd(dd->dd_object);
	mos_obj_refd(dsl_dir_phys(dd)->dd_child_dir_zapobj);
	mos_obj_refd(dsl_dir_phys(dd)->dd_deleg_zapobj);
	mos_obj_refd(dsl_dir_phys(dd)->dd_props_zapobj);
	mos_obj_refd(dsl_dir_phys(dd)->dd_clones);

	/*
	* The dd_crypto_obj can be referenced by multiple dsl_dir's.
	* Ignore the references after the first one.
	*/
	mos_obj_refd_multiple(dd->dd_crypto_obj);
	}

	static void
	count_ds_mos_objects(dsl_dataset_t *ds)
	{
	mos_obj_refd(ds->ds_object);
	mos_obj_refd(dsl_dataset_phys(ds)->ds_next_clones_obj);
	mos_obj_refd(dsl_dataset_phys(ds)->ds_props_obj);
	mos_obj_refd(dsl_dataset_phys(ds)->ds_userrefs_obj);
	mos_obj_refd(dsl_dataset_phys(ds)->ds_snapnames_zapobj);
	mos_obj_refd(ds->ds_bookmarks_obj);

	if (!dsl_dataset_is_snapshot(ds)) {
	count_dir_mos_objects(ds->ds_dir);
	}
	}

	static const char *objset_types[DMU_OST_NUMTYPES] = {
	"NONE", "META", "ZPL", "ZVOL", "OTHER", "ANY" };

	/*
	* Parse a string denoting a range of object IDs of the form
	* <start>[:<end>[:flags]], and store the results in zor.
	* Return 0 on success. On error, return 1 and update the msg
	* pointer to point to a descriptive error message.
	*/
	static int
	parse_object_range(char range, zopt_object_range_t zor, char **msg)
	{
	uint64_t flags = 0;
	char p, s, dup, flagstr;
	size_t len;
	int i;
	int rc = 0;

	if (strchr(range, ':') == NULL) {
	zor->zor_obj_start = strtoull(range, &p, 0);
	if (*p != '\0') {
	*msg = "Invalid characters in object ID";
	rc = 1;
	}
	zor->zor_obj_end = zor->zor_obj_start;
	return (rc);
	}

	if (strchr(range, ':') == range) {
	*msg = "Invalid leading colon";
	rc = 1;
	return (rc);
	}

	len = strlen(range);
	if (range[len - 1] == ':') {
	*msg = "Invalid trailing colon";
	rc = 1;
	return (rc);
	}

	dup = strdup(range);
	s = strtok(dup, ":");
	zor->zor_obj_start = strtoull(s, &p, 0);

	if (*p != '\0') {
	*msg = "Invalid characters in start object ID";
	rc = 1;
	goto out;
	}

	s = strtok(NULL, ":");
	zor->zor_obj_end = strtoull(s, &p, 0);

	if (*p != '\0') {
	*msg = "Invalid characters in end object ID";
	rc = 1;
	goto out;
	}

	if (zor->zor_obj_start > zor->zor_obj_end) {
	*msg = "Start object ID may not exceed end object ID";
	rc = 1;
	goto out;
	}

	s = strtok(NULL, ":");
	if (s == NULL) {
	zor->zor_flags = ZOR_FLAG_ALL_TYPES;
	goto out;
	} else if (strtok(NULL, ":") != NULL) {
	*msg = "Invalid colon-delimited field after flags";
	rc = 1;
	goto out;
	}

	flagstr = s;
	for (i = 0; flagstr[i]; i++) {
	int bit;
	boolean_t negation = (flagstr[i] == '-');

	if (negation) {
	i++;
	if (flagstr[i] == '\0') {
	*msg = "Invalid trailing negation operator";
	rc = 1;
	goto out;
	}
	}
	bit = flagbits[(uchar_t)flagstr[i]];
	if (bit == 0) {
	*msg = "Invalid flag";
	rc = 1;
	goto out;
	}
	if (negation)
	flags &= ~bit;
	else
	flags \|= bit;
	}
	zor->zor_flags = flags;

	out:
	free(dup);
	return (rc);
	}

	static void
	dump_objset(objset_t *os)
	{
	dmu_objset_stats_t dds = { 0 };
	uint64_t object, object_count;
	uint64_t refdbytes, usedobjs, scratch;
	char numbuf[32];
	char blkbuf[BP_SPRINTF_LEN + 20];
	char osname[ZFS_MAX_DATASET_NAME_LEN];
	const char *type = "UNKNOWN";
	int verbosity = dump_opt['d'];
	boolean_t print_header;
	unsigned i;
	int error;
	uint64_t total_slots_used = 0;
	uint64_t max_slot_used = 0;
	uint64_t dnode_slots;
	uint64_t obj_start;
	uint64_t obj_end;
	uint64_t flags;

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (numbuf) >= NN_NUMBUF_SZ);

	dsl_pool_config_enter(dmu_objset_pool(os), FTAG);
	dmu_objset_fast_stat(os, &dds);
	dsl_pool_config_exit(dmu_objset_pool(os), FTAG);

	print_header = B_TRUE;

	if (dds.dds_type < DMU_OST_NUMTYPES)
	type = objset_types[dds.dds_type];

	if (dds.dds_type == DMU_OST_META) {
	dds.dds_creation_txg = TXG_INITIAL;
	usedobjs = BP_GET_FILL(os->os_rootbp);
	refdbytes = dsl_dir_phys(os->os_spa->spa_dsl_pool->dp_mos_dir)->
	dd_used_bytes;
	} else {
	dmu_objset_space(os, &refdbytes, &scratch, &usedobjs, &scratch);
	}

	ASSERT3U(usedobjs, ==, BP_GET_FILL(os->os_rootbp));

	zdb_nicenum(refdbytes, numbuf, sizeof (numbuf));

	if (verbosity >= 4) {
	(void) snprintf(blkbuf, sizeof (blkbuf), ", rootbp ");
	(void) snprintf_blkptr(blkbuf + strlen(blkbuf),
	sizeof (blkbuf) - strlen(blkbuf), os->os_rootbp);
	} else {
	blkbuf[0] = '\0';
	}

	dmu_objset_name(os, osname);

	(void) printf("Dataset %s [%s], ID %llu, cr_txg %llu, "
	"%s, %llu objects%s%s\n",
	osname, type, (u_longlong_t)dmu_objset_id(os),
	(u_longlong_t)dds.dds_creation_txg,
	numbuf, (u_longlong_t)usedobjs, blkbuf,
	(dds.dds_inconsistent) ? " (inconsistent)" : "");

	for (i = 0; i < zopt_object_args; i++) {
	obj_start = zopt_object_ranges[i].zor_obj_start;
	obj_end = zopt_object_ranges[i].zor_obj_end;
	flags = zopt_object_ranges[i].zor_flags;

	object = obj_start;
	if (object == 0 \|\| obj_start == obj_end)
	dump_object(os, object, verbosity, &print_header, NULL,
	flags);
	else
	object--;

	while ((dmu_object_next(os, &object, B_FALSE, 0) == 0) &&
	object <= obj_end) {
	dump_object(os, object, verbosity, &print_header, NULL,
	flags);
	}
	}

	if (zopt_object_args > 0) {
	(void) printf("\n");
	return;
	}

	if (dump_opt['i'] != 0 \|\| verbosity >= 2)
	dump_intent_log(dmu_objset_zil(os));

	if (dmu_objset_ds(os) != NULL) {
	dsl_dataset_t *ds = dmu_objset_ds(os);
	dump_blkptr_list(&ds->ds_deadlist, "Deadlist");
	if (dsl_deadlist_is_open(&ds->ds_dir->dd_livelist) &&
	!dmu_objset_is_snapshot(os)) {
	dump_blkptr_list(&ds->ds_dir->dd_livelist, "Livelist");
	if (verify_dd_livelist(os) != 0)
	fatal("livelist is incorrect");
	}

	if (dsl_dataset_remap_deadlist_exists(ds)) {
	(void) printf("ds_remap_deadlist:\n");
	dump_blkptr_list(&ds->ds_remap_deadlist, "Deadlist");
	}
	count_ds_mos_objects(ds);
	}

	if (dmu_objset_ds(os) != NULL)
	dump_bookmarks(os, verbosity);

	if (verbosity < 2)
	return;

	if (BP_IS_HOLE(os->os_rootbp))
	return;

	dump_object(os, 0, verbosity, &print_header, NULL, 0);
	object_count = 0;
	if (DMU_USERUSED_DNODE(os) != NULL &&
	DMU_USERUSED_DNODE(os)->dn_type != 0) {
	dump_object(os, DMU_USERUSED_OBJECT, verbosity, &print_header,
	NULL, 0);
	dump_object(os, DMU_GROUPUSED_OBJECT, verbosity, &print_header,
	NULL, 0);
	}

	if (DMU_PROJECTUSED_DNODE(os) != NULL &&
	DMU_PROJECTUSED_DNODE(os)->dn_type != 0)
	dump_object(os, DMU_PROJECTUSED_OBJECT, verbosity,
	&print_header, NULL, 0);

	object = 0;
	while ((error = dmu_object_next(os, &object, B_FALSE, 0)) == 0) {
	dump_object(os, object, verbosity, &print_header, &dnode_slots,
	0);
	object_count++;
	total_slots_used += dnode_slots;
	max_slot_used = object + dnode_slots - 1;
	}

	(void) printf("\n");

	(void) printf(" Dnode slots:\n");
	(void) printf("\tTotal used: %10llu\n",
	(u_longlong_t)total_slots_used);
	(void) printf("\tMax used: %10llu\n",
	(u_longlong_t)max_slot_used);
	(void) printf("\tPercent empty: %10lf\n",
	(double)(max_slot_used - total_slots_used)*100 /
	(double)max_slot_used);
	(void) printf("\n");

	if (error != ESRCH) {
	(void) fprintf(stderr, "dmu_object_next() = %d\n", error);
	abort();
	}

	ASSERT3U(object_count, ==, usedobjs);

	if (leaked_objects != 0) {
	(void) printf("%d potentially leaked objects detected\n",
	leaked_objects);
	leaked_objects = 0;
	}
	}

	static void
	dump_uberblock(uberblock_t ub, const char header, const char *footer)
	{
	time_t timestamp = ub->ub_timestamp;

	(void) printf("%s", header ? header : "");
	(void) printf("\tmagic = %016llx\n", (u_longlong_t)ub->ub_magic);
	(void) printf("\tversion = %llu\n", (u_longlong_t)ub->ub_version);
	(void) printf("\ttxg = %llu\n", (u_longlong_t)ub->ub_txg);
	(void) printf("\tguid_sum = %llu\n", (u_longlong_t)ub->ub_guid_sum);
	(void) printf("\ttimestamp = %llu UTC = %s",
	(u_longlong_t)ub->ub_timestamp, asctime(localtime(&timestamp)));

	(void) printf("\tmmp_magic = %016llx\n",
	(u_longlong_t)ub->ub_mmp_magic);
	if (MMP_VALID(ub)) {
	(void) printf("\tmmp_delay = %0llu\n",
	(u_longlong_t)ub->ub_mmp_delay);
	if (MMP_SEQ_VALID(ub))
	(void) printf("\tmmp_seq = %u\n",
	(unsigned int) MMP_SEQ(ub));
	if (MMP_FAIL_INT_VALID(ub))
	(void) printf("\tmmp_fail = %u\n",
	(unsigned int) MMP_FAIL_INT(ub));
	if (MMP_INTERVAL_VALID(ub))
	(void) printf("\tmmp_write = %u\n",
	(unsigned int) MMP_INTERVAL(ub));
	/* After MMP_* to make summarize_uberblock_mmp cleaner */
	(void) printf("\tmmp_valid = %x\n",
	(unsigned int) ub->ub_mmp_config & 0xFF);
	}

	if (dump_opt['u'] >= 4) {
	char blkbuf[BP_SPRINTF_LEN];
	snprintf_blkptr(blkbuf, sizeof (blkbuf), &ub->ub_rootbp);
	(void) printf("\trootbp = %s\n", blkbuf);
	}
	(void) printf("\tcheckpoint_txg = %llu\n",
	(u_longlong_t)ub->ub_checkpoint_txg);
	(void) printf("%s", footer ? footer : "");
	}

	static void
	dump_config(spa_t *spa)
	{
	dmu_buf_t *db;
	size_t nvsize = 0;
	int error = 0;


	error = dmu_bonus_hold(spa->spa_meta_objset,
	spa->spa_config_object, FTAG, &db);

	if (error == 0) {
	nvsize = (uint64_t )db->db_data;
	dmu_buf_rele(db, FTAG);

	(void) printf("\nMOS Configuration:\n");
	dump_packed_nvlist(spa->spa_meta_objset,
	spa->spa_config_object, (void *)&nvsize, 1);
	} else {
	(void) fprintf(stderr, "dmu_bonus_hold(%llu) failed, errno %d",
	(u_longlong_t)spa->spa_config_object, error);
	}
	}

	static void
	dump_cachefile(const char *cachefile)
	{
	int fd;
	struct stat64 statbuf;
	char *buf;
	nvlist_t *config;

	if ((fd = open64(cachefile, O_RDONLY)) < 0) {
	(void) printf("cannot open '%s': %s\n", cachefile,
	strerror(errno));
	exit(1);
	}

	if (fstat64(fd, &statbuf) != 0) {
	(void) printf("failed to stat '%s': %s\n", cachefile,
	strerror(errno));
	exit(1);
	}

	if ((buf = malloc(statbuf.st_size)) == NULL) {
	(void) fprintf(stderr, "failed to allocate %llu bytes\n",
	(u_longlong_t)statbuf.st_size);
	exit(1);
	}

	if (read(fd, buf, statbuf.st_size) != statbuf.st_size) {
	(void) fprintf(stderr, "failed to read %llu bytes\n",
	(u_longlong_t)statbuf.st_size);
	exit(1);
	}

	(void) close(fd);

	if (nvlist_unpack(buf, statbuf.st_size, &config, 0) != 0) {
	(void) fprintf(stderr, "failed to unpack nvlist\n");
	exit(1);
	}

	free(buf);

	dump_nvlist(config, 0);

	nvlist_free(config);
	}

	/*
	* ZFS label nvlist stats
	*/
	typedef struct zdb_nvl_stats {
	int zns_list_count;
	int zns_leaf_count;
	size_t zns_leaf_largest;
	size_t zns_leaf_total;
	nvlist_t *zns_string;
	nvlist_t *zns_uint64;
	nvlist_t *zns_boolean;
	} zdb_nvl_stats_t;

	static void
	collect_nvlist_stats(nvlist_t nvl, zdb_nvl_stats_t stats)
	{
	nvlist_t list, *array;
	nvpair_t *nvp = NULL;
	char *name;
	uint_t i, items;

	stats->zns_list_count++;

	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
	name = nvpair_name(nvp);

	switch (nvpair_type(nvp)) {
	case DATA_TYPE_STRING:
	fnvlist_add_string(stats->zns_string, name,
	fnvpair_value_string(nvp));
	break;
	case DATA_TYPE_UINT64:
	fnvlist_add_uint64(stats->zns_uint64, name,
	fnvpair_value_uint64(nvp));
	break;
	case DATA_TYPE_BOOLEAN:
	fnvlist_add_boolean(stats->zns_boolean, name);
	break;
	case DATA_TYPE_NVLIST:
	if (nvpair_value_nvlist(nvp, &list) == 0)
	collect_nvlist_stats(list, stats);
	break;
	case DATA_TYPE_NVLIST_ARRAY:
	if (nvpair_value_nvlist_array(nvp, &array, &items) != 0)
	break;

	for (i = 0; i < items; i++) {
	collect_nvlist_stats(array[i], stats);

	/* collect stats on leaf vdev */
	if (strcmp(name, "children") == 0) {
	size_t size;

	(void) nvlist_size(array[i], &size,
	NV_ENCODE_XDR);
	stats->zns_leaf_total += size;
	if (size > stats->zns_leaf_largest)
	stats->zns_leaf_largest = size;
	stats->zns_leaf_count++;
	}
	}
	break;
	default:
	(void) printf("skip type %d!\n", (int)nvpair_type(nvp));
	}
	}
	}

	static void
	dump_nvlist_stats(nvlist_t *nvl, size_t cap)
	{
	zdb_nvl_stats_t stats = { 0 };
	size_t size, sum = 0, total;
	size_t noise;

	/* requires nvlist with non-unique names for stat collection */
	VERIFY0(nvlist_alloc(&stats.zns_string, 0, 0));
	VERIFY0(nvlist_alloc(&stats.zns_uint64, 0, 0));
	VERIFY0(nvlist_alloc(&stats.zns_boolean, 0, 0));
	VERIFY0(nvlist_size(stats.zns_boolean, &noise, NV_ENCODE_XDR));

	(void) printf("\n\nZFS Label NVList Config Stats:\n");

	VERIFY0(nvlist_size(nvl, &total, NV_ENCODE_XDR));
	(void) printf(" %d bytes used, %d bytes free (using %4.1f%%)\n\n",
	(int)total, (int)(cap - total), 100.0 * total / cap);

	collect_nvlist_stats(nvl, &stats);

	VERIFY0(nvlist_size(stats.zns_uint64, &size, NV_ENCODE_XDR));
	size -= noise;
	sum += size;
	(void) printf("%12s %4d %6d bytes (%5.2f%%)\n", "integers:",
	(int)fnvlist_num_pairs(stats.zns_uint64),
	(int)size, 100.0 * size / total);

	VERIFY0(nvlist_size(stats.zns_string, &size, NV_ENCODE_XDR));
	size -= noise;
	sum += size;
	(void) printf("%12s %4d %6d bytes (%5.2f%%)\n", "strings:",
	(int)fnvlist_num_pairs(stats.zns_string),
	(int)size, 100.0 * size / total);

	VERIFY0(nvlist_size(stats.zns_boolean, &size, NV_ENCODE_XDR));
	size -= noise;
	sum += size;
	(void) printf("%12s %4d %6d bytes (%5.2f%%)\n", "booleans:",
	(int)fnvlist_num_pairs(stats.zns_boolean),
	(int)size, 100.0 * size / total);

	size = total - sum; /* treat remainder as nvlist overhead */
	(void) printf("%12s %4d %6d bytes (%5.2f%%)\n\n", "nvlists:",
	stats.zns_list_count, (int)size, 100.0 * size / total);

	if (stats.zns_leaf_count > 0) {
	size_t average = stats.zns_leaf_total / stats.zns_leaf_count;

	(void) printf("%12s %4d %6d bytes average\n", "leaf vdevs:",
	stats.zns_leaf_count, (int)average);
	(void) printf("%24d bytes largest\n",
	(int)stats.zns_leaf_largest);

	if (dump_opt['l'] >= 3 && average > 0)
	(void) printf(" space for %d additional leaf vdevs\n",
	(int)((cap - total) / average));
	}
	(void) printf("\n");

	nvlist_free(stats.zns_string);
	nvlist_free(stats.zns_uint64);
	nvlist_free(stats.zns_boolean);
	}

	typedef struct cksum_record {
	zio_cksum_t cksum;
	boolean_t labels[VDEV_LABELS];
	avl_node_t link;
	} cksum_record_t;

	static int
	cksum_record_compare(const void x1, const void x2)
	{
	const cksum_record_t l = (cksum_record_t )x1;
	const cksum_record_t r = (cksum_record_t )x2;
	int arraysize = ARRAY_SIZE(l->cksum.zc_word);
	int difference;

	for (int i = 0; i < arraysize; i++) {
	difference = TREE_CMP(l->cksum.zc_word[i], r->cksum.zc_word[i]);
	if (difference)
	break;
	}

	return (difference);
	}

	static cksum_record_t *
	cksum_record_alloc(zio_cksum_t *cksum, int l)
	{
	cksum_record_t *rec;

	rec = umem_zalloc(sizeof (*rec), UMEM_NOFAIL);
	rec->cksum = *cksum;
	rec->labels[l] = B_TRUE;

	return (rec);
	}

	static cksum_record_t *
	cksum_record_lookup(avl_tree_t tree, zio_cksum_t cksum)
	{
	cksum_record_t lookup = { .cksum = *cksum };
	avl_index_t where;

	return (avl_find(tree, &lookup, &where));
	}

	static cksum_record_t *
	cksum_record_insert(avl_tree_t tree, zio_cksum_t cksum, int l)
	{
	cksum_record_t *rec;

	rec = cksum_record_lookup(tree, cksum);
	if (rec) {
	rec->labels[l] = B_TRUE;
	} else {
	rec = cksum_record_alloc(cksum, l);
	avl_add(tree, rec);
	}

	return (rec);
	}

	static int
	first_label(cksum_record_t *rec)
	{
	for (int i = 0; i < VDEV_LABELS; i++)
	if (rec->labels[i])
	return (i);

	return (-1);
	}

	static void
	print_label_numbers(char prefix, cksum_record_t rec)
	{
	printf("%s", prefix);
	for (int i = 0; i < VDEV_LABELS; i++)
	if (rec->labels[i] == B_TRUE)
	printf("%d ", i);
	printf("\n");
	}

	#define MAX_UBERBLOCK_COUNT (VDEV_UBERBLOCK_RING >> UBERBLOCK_SHIFT)

	typedef struct zdb_label {
	vdev_label_t label;
	nvlist_t *config_nv;
	cksum_record_t *config;
	cksum_record_t *uberblocks[MAX_UBERBLOCK_COUNT];
	boolean_t header_printed;
	boolean_t read_failed;
	} zdb_label_t;

	static void
	print_label_header(zdb_label_t *label, int l)
	{

	if (dump_opt['q'])
	return;

	if (label->header_printed == B_TRUE)
	return;

	(void) printf("------------------------------------\n");
	(void) printf("LABEL %d\n", l);
	(void) printf("------------------------------------\n");

	label->header_printed = B_TRUE;
	}

	static void
	print_l2arc_header(void)
	{
	(void) printf("------------------------------------\n");
	(void) printf("L2ARC device header\n");
	(void) printf("------------------------------------\n");
	}

	static void
	print_l2arc_log_blocks(void)
	{
	(void) printf("------------------------------------\n");
	(void) printf("L2ARC device log blocks\n");
	(void) printf("------------------------------------\n");
	}

	static void
	dump_l2arc_log_entries(uint64_t log_entries,
	l2arc_log_ent_phys_t *le, uint64_t i)
	{
	for (int j = 0; j < log_entries; j++) {
	dva_t dva = le[j].le_dva;
	(void) printf("lb[%4llu]\tle[%4d]\tDVA asize: %llu, "
	"vdev: %llu, offset: %llu\n",
	(u_longlong_t)i, j + 1,
	(u_longlong_t)DVA_GET_ASIZE(&dva),
	(u_longlong_t)DVA_GET_VDEV(&dva),
	(u_longlong_t)DVA_GET_OFFSET(&dva));
	(void) printf("\|\t\t\t\tbirth: %llu\n",
	(u_longlong_t)le[j].le_birth);
	(void) printf("\|\t\t\t\tlsize: %llu\n",
	(u_longlong_t)L2BLK_GET_LSIZE((&le[j])->le_prop));
	(void) printf("\|\t\t\t\tpsize: %llu\n",
	(u_longlong_t)L2BLK_GET_PSIZE((&le[j])->le_prop));
	(void) printf("\|\t\t\t\tcompr: %llu\n",
	(u_longlong_t)L2BLK_GET_COMPRESS((&le[j])->le_prop));
	(void) printf("\|\t\t\t\tcomplevel: %llu\n",
	(u_longlong_t)(&le[j])->le_complevel);
	(void) printf("\|\t\t\t\ttype: %llu\n",
	(u_longlong_t)L2BLK_GET_TYPE((&le[j])->le_prop));
	(void) printf("\|\t\t\t\tprotected: %llu\n",
	(u_longlong_t)L2BLK_GET_PROTECTED((&le[j])->le_prop));
	(void) printf("\|\t\t\t\tprefetch: %llu\n",
	(u_longlong_t)L2BLK_GET_PREFETCH((&le[j])->le_prop));
	(void) printf("\|\t\t\t\taddress: %llu\n",
	(u_longlong_t)le[j].le_daddr);
	(void) printf("\|\n");
	}
	(void) printf("\n");
	}

	static void
	dump_l2arc_log_blkptr(l2arc_log_blkptr_t lbps)
	{
	(void) printf("\|\t\tdaddr: %llu\n", (u_longlong_t)lbps.lbp_daddr);
	(void) printf("\|\t\tpayload_asize: %llu\n",
	(u_longlong_t)lbps.lbp_payload_asize);
	(void) printf("\|\t\tpayload_start: %llu\n",
	(u_longlong_t)lbps.lbp_payload_start);
	(void) printf("\|\t\tlsize: %llu\n",
	(u_longlong_t)L2BLK_GET_LSIZE((&lbps)->lbp_prop));
	(void) printf("\|\t\tasize: %llu\n",
	(u_longlong_t)L2BLK_GET_PSIZE((&lbps)->lbp_prop));
	(void) printf("\|\t\tcompralgo: %llu\n",
	(u_longlong_t)L2BLK_GET_COMPRESS((&lbps)->lbp_prop));
	(void) printf("\|\t\tcksumalgo: %llu\n",
	(u_longlong_t)L2BLK_GET_CHECKSUM((&lbps)->lbp_prop));
	(void) printf("\|\n\n");
	}

	static void
	dump_l2arc_log_blocks(int fd, l2arc_dev_hdr_phys_t l2dhdr,
	l2arc_dev_hdr_phys_t *rebuild)
	{
	l2arc_log_blk_phys_t this_lb;
	uint64_t asize;
	l2arc_log_blkptr_t lbps[2];
	abd_t *abd;
	zio_cksum_t cksum;
	int failed = 0;
	l2arc_dev_t dev;

	if (!dump_opt['q'])
	print_l2arc_log_blocks();
	bcopy((&l2dhdr)->dh_start_lbps, lbps, sizeof (lbps));

	dev.l2ad_evict = l2dhdr.dh_evict;
	dev.l2ad_start = l2dhdr.dh_start;
	dev.l2ad_end = l2dhdr.dh_end;

	if (l2dhdr.dh_start_lbps[0].lbp_daddr == 0) {
	/* no log blocks to read */
	if (!dump_opt['q']) {
	(void) printf("No log blocks to read\n");
	(void) printf("\n");
	}
	return;
	} else {
	dev.l2ad_hand = lbps[0].lbp_daddr +
	L2BLK_GET_PSIZE((&lbps[0])->lbp_prop);
	}

	dev.l2ad_first = !!(l2dhdr.dh_flags & L2ARC_DEV_HDR_EVICT_FIRST);

	for (;;) {
	if (!l2arc_log_blkptr_valid(&dev, &lbps[0]))
	break;

	/* L2BLK_GET_PSIZE returns aligned size for log blocks */
	asize = L2BLK_GET_PSIZE((&lbps[0])->lbp_prop);
	if (pread64(fd, &this_lb, asize, lbps[0].lbp_daddr) != asize) {
	if (!dump_opt['q']) {
	(void) printf("Error while reading next log "
	"block\n\n");
	}
	break;
	}

	fletcher_4_native_varsize(&this_lb, asize, &cksum);
	if (!ZIO_CHECKSUM_EQUAL(cksum, lbps[0].lbp_cksum)) {
	failed++;
	if (!dump_opt['q']) {
	(void) printf("Invalid cksum\n");
	dump_l2arc_log_blkptr(lbps[0]);
	}
	break;
	}

	switch (L2BLK_GET_COMPRESS((&lbps[0])->lbp_prop)) {
	case ZIO_COMPRESS_OFF:
	break;
	default:
	abd = abd_alloc_for_io(asize, B_TRUE);
	abd_copy_from_buf_off(abd, &this_lb, 0, asize);
	zio_decompress_data(L2BLK_GET_COMPRESS(
	(&lbps[0])->lbp_prop), abd, &this_lb,
	asize, sizeof (this_lb), NULL);
	abd_free(abd);
	break;
	}

	if (this_lb.lb_magic == BSWAP_64(L2ARC_LOG_BLK_MAGIC))
	byteswap_uint64_array(&this_lb, sizeof (this_lb));
	if (this_lb.lb_magic != L2ARC_LOG_BLK_MAGIC) {
	if (!dump_opt['q'])
	(void) printf("Invalid log block magic\n\n");
	break;
	}

	rebuild->dh_lb_count++;
	rebuild->dh_lb_asize += asize;
	if (dump_opt['l'] > 1 && !dump_opt['q']) {
	(void) printf("lb[%4llu]\tmagic: %llu\n",
	(u_longlong_t)rebuild->dh_lb_count,
	(u_longlong_t)this_lb.lb_magic);
	dump_l2arc_log_blkptr(lbps[0]);
	}

	if (dump_opt['l'] > 2 && !dump_opt['q'])
	dump_l2arc_log_entries(l2dhdr.dh_log_entries,
	this_lb.lb_entries,
	rebuild->dh_lb_count);

	if (l2arc_range_check_overlap(lbps[1].lbp_payload_start,
	lbps[0].lbp_payload_start, dev.l2ad_evict) &&
	!dev.l2ad_first)
	break;

	lbps[0] = lbps[1];
	lbps[1] = this_lb.lb_prev_lbp;
	}

	if (!dump_opt['q']) {
	(void) printf("log_blk_count:\t %llu with valid cksum\n",
	(u_longlong_t)rebuild->dh_lb_count);
	(void) printf("\t\t %d with invalid cksum\n", failed);
	(void) printf("log_blk_asize:\t %llu\n\n",
	(u_longlong_t)rebuild->dh_lb_asize);
	}
	}

	static int
	dump_l2arc_header(int fd)
	{
	l2arc_dev_hdr_phys_t l2dhdr, rebuild;
	int error = B_FALSE;

	bzero(&l2dhdr, sizeof (l2dhdr));
	bzero(&rebuild, sizeof (rebuild));

	if (pread64(fd, &l2dhdr, sizeof (l2dhdr),
	VDEV_LABEL_START_SIZE) != sizeof (l2dhdr)) {
	error = B_TRUE;
	} else {
	if (l2dhdr.dh_magic == BSWAP_64(L2ARC_DEV_HDR_MAGIC))
	byteswap_uint64_array(&l2dhdr, sizeof (l2dhdr));

	if (l2dhdr.dh_magic != L2ARC_DEV_HDR_MAGIC)
	error = B_TRUE;
	}

	if (error) {
	(void) printf("L2ARC device header not found\n\n");
	/* Do not return an error here for backward compatibility */
	return (0);
	} else if (!dump_opt['q']) {
	print_l2arc_header();

	(void) printf(" magic: %llu\n",
	(u_longlong_t)l2dhdr.dh_magic);
	(void) printf(" version: %llu\n",
	(u_longlong_t)l2dhdr.dh_version);
	(void) printf(" pool_guid: %llu\n",
	(u_longlong_t)l2dhdr.dh_spa_guid);
	(void) printf(" flags: %llu\n",
	(u_longlong_t)l2dhdr.dh_flags);
	(void) printf(" start_lbps[0]: %llu\n",
	(u_longlong_t)
	l2dhdr.dh_start_lbps[0].lbp_daddr);
	(void) printf(" start_lbps[1]: %llu\n",
	(u_longlong_t)
	l2dhdr.dh_start_lbps[1].lbp_daddr);
	(void) printf(" log_blk_ent: %llu\n",
	(u_longlong_t)l2dhdr.dh_log_entries);
	(void) printf(" start: %llu\n",
	(u_longlong_t)l2dhdr.dh_start);
	(void) printf(" end: %llu\n",
	(u_longlong_t)l2dhdr.dh_end);
	(void) printf(" evict: %llu\n",
	(u_longlong_t)l2dhdr.dh_evict);
	(void) printf(" lb_asize_refcount: %llu\n",
	(u_longlong_t)l2dhdr.dh_lb_asize);
	(void) printf(" lb_count_refcount: %llu\n",
	(u_longlong_t)l2dhdr.dh_lb_count);
	(void) printf(" trim_action_time: %llu\n",
	(u_longlong_t)l2dhdr.dh_trim_action_time);
	(void) printf(" trim_state: %llu\n\n",
	(u_longlong_t)l2dhdr.dh_trim_state);
	}

	dump_l2arc_log_blocks(fd, l2dhdr, &rebuild);
	/*
	* The total aligned size of log blocks and the number of log blocks
	* reported in the header of the device may be less than what zdb
	* reports by dump_l2arc_log_blocks() which emulates l2arc_rebuild().
	* This happens because dump_l2arc_log_blocks() lacks the memory
	* pressure valve that l2arc_rebuild() has. Thus, if we are on a system
	* with low memory, l2arc_rebuild will exit prematurely and dh_lb_asize
	* and dh_lb_count will be lower to begin with than what exists on the
	* device. This is normal and zdb should not exit with an error. The
	* opposite case should never happen though, the values reported in the
	* header should never be higher than what dump_l2arc_log_blocks() and
	* l2arc_rebuild() report. If this happens there is a leak in the
	* accounting of log blocks.
	*/
	if (l2dhdr.dh_lb_asize > rebuild.dh_lb_asize \|\|
	l2dhdr.dh_lb_count > rebuild.dh_lb_count)
	return (1);

	return (0);
	}

	static void
	dump_config_from_label(zdb_label_t *label, size_t buflen, int l)
	{
	if (dump_opt['q'])
	return;

	if ((dump_opt['l'] < 3) && (first_label(label->config) != l))
	return;

	print_label_header(label, l);
	dump_nvlist(label->config_nv, 4);
	print_label_numbers(" labels = ", label->config);

	if (dump_opt['l'] >= 2)
	dump_nvlist_stats(label->config_nv, buflen);
	}

	#define ZDB_MAX_UB_HEADER_SIZE 32

	static void
	dump_label_uberblocks(zdb_label_t *label, uint64_t ashift, int label_num)
	{

	vdev_t vd;
	char header[ZDB_MAX_UB_HEADER_SIZE];

	vd.vdev_ashift = ashift;
	vd.vdev_top = &vd;

	for (int i = 0; i < VDEV_UBERBLOCK_COUNT(&vd); i++) {
	uint64_t uoff = VDEV_UBERBLOCK_OFFSET(&vd, i);
	uberblock_t ub = (void )((char *)&label->label + uoff);
	cksum_record_t *rec = label->uberblocks[i];

	if (rec == NULL) {
	if (dump_opt['u'] >= 2) {
	print_label_header(label, label_num);
	(void) printf(" Uberblock[%d] invalid\n", i);
	}
	continue;
	}

	if ((dump_opt['u'] < 3) && (first_label(rec) != label_num))
	continue;

	if ((dump_opt['u'] < 4) &&
	(ub->ub_mmp_magic == MMP_MAGIC) && ub->ub_mmp_delay &&
	(i >= VDEV_UBERBLOCK_COUNT(&vd) - MMP_BLOCKS_PER_LABEL))
	continue;

	print_label_header(label, label_num);
	(void) snprintf(header, ZDB_MAX_UB_HEADER_SIZE,
	" Uberblock[%d]\n", i);
	dump_uberblock(ub, header, "");
	print_label_numbers(" labels = ", rec);
	}
	}

	static char curpath[PATH_MAX];

	/*
	* Iterate through the path components, recursively passing
	* current one's obj and remaining path until we find the obj
	* for the last one.
	*/
	static int
	dump_path_impl(objset_t os, uint64_t obj, char name)
	{
	int err;
	boolean_t header = B_TRUE;
	uint64_t child_obj;
	char *s;
	dmu_buf_t *db;
	dmu_object_info_t doi;

	if ((s = strchr(name, '/')) != NULL)
	*s = '\0';
	err = zap_lookup(os, obj, name, 8, 1, &child_obj);

	(void) strlcat(curpath, name, sizeof (curpath));

	if (err != 0) {
	(void) fprintf(stderr, "failed to lookup %s: %s\n",
	curpath, strerror(err));
	return (err);
	}

	child_obj = ZFS_DIRENT_OBJ(child_obj);
	err = sa_buf_hold(os, child_obj, FTAG, &db);
	if (err != 0) {
	(void) fprintf(stderr,
	"failed to get SA dbuf for obj %llu: %s\n",
	(u_longlong_t)child_obj, strerror(err));
	return (EINVAL);
	}
	dmu_object_info_from_db(db, &doi);
	sa_buf_rele(db, FTAG);

	if (doi.doi_bonus_type != DMU_OT_SA &&
	doi.doi_bonus_type != DMU_OT_ZNODE) {
	(void) fprintf(stderr, "invalid bonus type %d for obj %llu\n",
	doi.doi_bonus_type, (u_longlong_t)child_obj);
	return (EINVAL);
	}

	if (dump_opt['v'] > 6) {
	(void) printf("obj=%llu %s type=%d bonustype=%d\n",
	(u_longlong_t)child_obj, curpath, doi.doi_type,
	doi.doi_bonus_type);
	}

	(void) strlcat(curpath, "/", sizeof (curpath));

	switch (doi.doi_type) {
	case DMU_OT_DIRECTORY_CONTENTS:
	if (s != NULL && *(s + 1) != '\0')
	return (dump_path_impl(os, child_obj, s + 1));
	/FALLTHROUGH/
	case DMU_OT_PLAIN_FILE_CONTENTS:
	dump_object(os, child_obj, dump_opt['v'], &header, NULL, 0);
	return (0);
	default:
	(void) fprintf(stderr, "object %llu has non-file/directory "
	"type %d\n", (u_longlong_t)obj, doi.doi_type);
	break;
	}

	return (EINVAL);
	}

	/*
	* Dump the blocks for the object specified by path inside the dataset.
	*/
	static int
	dump_path(char ds, char path)
	{
	int err;
	objset_t *os;
	uint64_t root_obj;

	err = open_objset(ds, FTAG, &os);
	if (err != 0)
	return (err);

	err = zap_lookup(os, MASTER_NODE_OBJ, ZFS_ROOT_OBJ, 8, 1, &root_obj);
	if (err != 0) {
	(void) fprintf(stderr, "can't lookup root znode: %s\n",
	strerror(err));
	close_objset(os, FTAG);
	return (EINVAL);
	}

	(void) snprintf(curpath, sizeof (curpath), "dataset=%s path=/", ds);

	err = dump_path_impl(os, root_obj, path);

	close_objset(os, FTAG);
	return (err);
	}

	static int
	dump_label(const char *dev)
	{
	char path[MAXPATHLEN];
	zdb_label_t labels[VDEV_LABELS];
	uint64_t psize, ashift, l2cache;
	struct stat64 statbuf;
	boolean_t config_found = B_FALSE;
	boolean_t error = B_FALSE;
	boolean_t read_l2arc_header = B_FALSE;
	avl_tree_t config_tree;
	avl_tree_t uberblock_tree;
	void node, cookie;
	int fd;

	bzero(labels, sizeof (labels));

	/*
	* Check if we were given absolute path and use it as is.
	* Otherwise if the provided vdev name doesn't point to a file,
	* try prepending expected disk paths and partition numbers.
	*/
	(void) strlcpy(path, dev, sizeof (path));
	if (dev[0] != '/' && stat64(path, &statbuf) != 0) {
	int error;

	error = zfs_resolve_shortname(dev, path, MAXPATHLEN);
	if (error == 0 && zfs_dev_is_whole_disk(path)) {
	if (zfs_append_partition(path, MAXPATHLEN) == -1)
	error = ENOENT;
	}

	if (error \|\| (stat64(path, &statbuf) != 0)) {
	(void) printf("failed to find device %s, try "
	"specifying absolute path instead\n", dev);
	return (1);
	}
	}

	if ((fd = open64(path, O_RDONLY)) < 0) {
	(void) printf("cannot open '%s': %s\n", path, strerror(errno));
	exit(1);
	}

	if (fstat64_blk(fd, &statbuf) != 0) {
	(void) printf("failed to stat '%s': %s\n", path,
	strerror(errno));
	(void) close(fd);
	exit(1);
	}

	if (S_ISBLK(statbuf.st_mode) && zfs_dev_flush(fd) != 0)
	(void) printf("failed to invalidate cache '%s' : %s\n", path,
	strerror(errno));

	avl_create(&config_tree, cksum_record_compare,
	sizeof (cksum_record_t), offsetof(cksum_record_t, link));
	avl_create(&uberblock_tree, cksum_record_compare,
	sizeof (cksum_record_t), offsetof(cksum_record_t, link));

	psize = statbuf.st_size;
	psize = P2ALIGN(psize, (uint64_t)sizeof (vdev_label_t));
	ashift = SPA_MINBLOCKSHIFT;

	/*
	* 1. Read the label from disk
	* 2. Unpack the configuration and insert in config tree.
	* 3. Traverse all uberblocks and insert in uberblock tree.
	*/
	for (int l = 0; l < VDEV_LABELS; l++) {
	zdb_label_t *label = &labels[l];
	char *buf = label->label.vl_vdev_phys.vp_nvlist;
	size_t buflen = sizeof (label->label.vl_vdev_phys.vp_nvlist);
	nvlist_t *config;
	cksum_record_t *rec;
	zio_cksum_t cksum;
	vdev_t vd;

	if (pread64(fd, &label->label, sizeof (label->label),
	vdev_label_offset(psize, l, 0)) != sizeof (label->label)) {
	if (!dump_opt['q'])
	(void) printf("failed to read label %d\n", l);
	label->read_failed = B_TRUE;
	error = B_TRUE;
	continue;
	}

	label->read_failed = B_FALSE;

	if (nvlist_unpack(buf, buflen, &config, 0) == 0) {
	nvlist_t *vdev_tree = NULL;
	size_t size;

	if ((nvlist_lookup_nvlist(config,
	ZPOOL_CONFIG_VDEV_TREE, &vdev_tree) != 0) \|\|
	(nvlist_lookup_uint64(vdev_tree,
	ZPOOL_CONFIG_ASHIFT, &ashift) != 0))
	ashift = SPA_MINBLOCKSHIFT;

	if (nvlist_size(config, &size, NV_ENCODE_XDR) != 0)
	size = buflen;

	/* If the device is a cache device clear the header. */
	if (!read_l2arc_header) {
	if (nvlist_lookup_uint64(config,
	ZPOOL_CONFIG_POOL_STATE, &l2cache) == 0 &&
	l2cache == POOL_STATE_L2CACHE) {
	read_l2arc_header = B_TRUE;
	}
	}

	fletcher_4_native_varsize(buf, size, &cksum);
	rec = cksum_record_insert(&config_tree, &cksum, l);

	label->config = rec;
	label->config_nv = config;
	config_found = B_TRUE;
	} else {
	error = B_TRUE;
	}

	vd.vdev_ashift = ashift;
	vd.vdev_top = &vd;

	for (int i = 0; i < VDEV_UBERBLOCK_COUNT(&vd); i++) {
	uint64_t uoff = VDEV_UBERBLOCK_OFFSET(&vd, i);
	uberblock_t ub = (void )((char *)label + uoff);

	if (uberblock_verify(ub))
	continue;

	fletcher_4_native_varsize(ub, sizeof (*ub), &cksum);
	rec = cksum_record_insert(&uberblock_tree, &cksum, l);

	label->uberblocks[i] = rec;
	}
	}

	/*
	* Dump the label and uberblocks.
	*/
	for (int l = 0; l < VDEV_LABELS; l++) {
	zdb_label_t *label = &labels[l];
	size_t buflen = sizeof (label->label.vl_vdev_phys.vp_nvlist);

	if (label->read_failed == B_TRUE)
	continue;

	if (label->config_nv) {
	dump_config_from_label(label, buflen, l);
	} else {
	if (!dump_opt['q'])
	(void) printf("failed to unpack label %d\n", l);
	}

	if (dump_opt['u'])
	dump_label_uberblocks(label, ashift, l);

	nvlist_free(label->config_nv);
	}

	/*
	* Dump the L2ARC header, if existent.
	*/
	if (read_l2arc_header)
	error \|= dump_l2arc_header(fd);

	cookie = NULL;
	while ((node = avl_destroy_nodes(&config_tree, &cookie)) != NULL)
	umem_free(node, sizeof (cksum_record_t));

	cookie = NULL;
	while ((node = avl_destroy_nodes(&uberblock_tree, &cookie)) != NULL)
	umem_free(node, sizeof (cksum_record_t));

	avl_destroy(&config_tree);
	avl_destroy(&uberblock_tree);

	(void) close(fd);

	return (config_found == B_FALSE ? 2 :
	(error == B_TRUE ? 1 : 0));
	}

	static uint64_t dataset_feature_count[SPA_FEATURES];
	static uint64_t global_feature_count[SPA_FEATURES];
	static uint64_t remap_deadlist_count = 0;

	/ARGSUSED/
	static int
	dump_one_objset(const char dsname, void arg)
	{
	int error;
	objset_t *os;
	spa_feature_t f;

	error = open_objset(dsname, FTAG, &os);
	if (error != 0)
	return (0);

	for (f = 0; f < SPA_FEATURES; f++) {
	if (!dsl_dataset_feature_is_active(dmu_objset_ds(os), f))
	continue;
	ASSERT(spa_feature_table[f].fi_flags &
	ZFEATURE_FLAG_PER_DATASET);
	dataset_feature_count[f]++;
	}

	if (dsl_dataset_remap_deadlist_exists(dmu_objset_ds(os))) {
	remap_deadlist_count++;
	}

	for (dsl_bookmark_node_t *dbn =
	avl_first(&dmu_objset_ds(os)->ds_bookmarks); dbn != NULL;
	dbn = AVL_NEXT(&dmu_objset_ds(os)->ds_bookmarks, dbn)) {
	mos_obj_refd(dbn->dbn_phys.zbm_redaction_obj);
	if (dbn->dbn_phys.zbm_redaction_obj != 0)
	global_feature_count[SPA_FEATURE_REDACTION_BOOKMARKS]++;
	if (dbn->dbn_phys.zbm_flags & ZBM_FLAG_HAS_FBN)
	global_feature_count[SPA_FEATURE_BOOKMARK_WRITTEN]++;
	}

	if (dsl_deadlist_is_open(&dmu_objset_ds(os)->ds_dir->dd_livelist) &&
	!dmu_objset_is_snapshot(os)) {
	global_feature_count[SPA_FEATURE_LIVELIST]++;
	}

	dump_objset(os);
	close_objset(os, FTAG);
	fuid_table_destroy();
	return (0);
	}

	/*
	* Block statistics.
	*/
	#define PSIZE_HISTO_SIZE (SPA_OLD_MAXBLOCKSIZE / SPA_MINBLOCKSIZE + 2)
	typedef struct zdb_blkstats {
	uint64_t zb_asize;
	uint64_t zb_lsize;
	uint64_t zb_psize;
	uint64_t zb_count;
	uint64_t zb_gangs;
	uint64_t zb_ditto_samevdev;
	uint64_t zb_ditto_same_ms;
	uint64_t zb_psize_histogram[PSIZE_HISTO_SIZE];
	} zdb_blkstats_t;

	/*
	* Extended object types to report deferred frees and dedup auto-ditto blocks.
	*/
	#define ZDB_OT_DEFERRED (DMU_OT_NUMTYPES + 0)
	#define ZDB_OT_DITTO (DMU_OT_NUMTYPES + 1)
	#define ZDB_OT_OTHER (DMU_OT_NUMTYPES + 2)
	#define ZDB_OT_TOTAL (DMU_OT_NUMTYPES + 3)

	static const char *zdb_ot_extname[] = {
	"deferred free",
	"dedup ditto",
	"other",
	"Total",
	};

	#define ZB_TOTAL DN_MAX_LEVELS
	#define SPA_MAX_FOR_16M (SPA_MAXBLOCKSHIFT+1)

	typedef struct zdb_cb {
	zdb_blkstats_t zcb_type[ZB_TOTAL + 1][ZDB_OT_TOTAL + 1];
	uint64_t zcb_removing_size;
	uint64_t zcb_checkpoint_size;
	uint64_t zcb_dedup_asize;
	uint64_t zcb_dedup_blocks;
	uint64_t zcb_psize_count[SPA_MAX_FOR_16M];
	uint64_t zcb_lsize_count[SPA_MAX_FOR_16M];
	uint64_t zcb_asize_count[SPA_MAX_FOR_16M];
	uint64_t zcb_psize_len[SPA_MAX_FOR_16M];
	uint64_t zcb_lsize_len[SPA_MAX_FOR_16M];
	uint64_t zcb_asize_len[SPA_MAX_FOR_16M];
	uint64_t zcb_psize_total;
	uint64_t zcb_lsize_total;
	uint64_t zcb_asize_total;
	uint64_t zcb_embedded_blocks[NUM_BP_EMBEDDED_TYPES];
	uint64_t zcb_embedded_histogram[NUM_BP_EMBEDDED_TYPES]
	[BPE_PAYLOAD_SIZE + 1];
	uint64_t zcb_start;
	hrtime_t zcb_lastprint;
	uint64_t zcb_totalasize;
	uint64_t zcb_errors[256];
	int zcb_readfails;
	int zcb_haderrors;
	spa_t *zcb_spa;
	uint32_t **zcb_vd_obsolete_counts;
	} zdb_cb_t;

	/* test if two DVA offsets from same vdev are within the same metaslab */
	static boolean_t
	same_metaslab(spa_t *spa, uint64_t vdev, uint64_t off1, uint64_t off2)
	{
	vdev_t *vd = vdev_lookup_top(spa, vdev);
	uint64_t ms_shift = vd->vdev_ms_shift;

	return ((off1 >> ms_shift) == (off2 >> ms_shift));
	}

	/*
	* Used to simplify reporting of the histogram data.
	*/
	typedef struct one_histo {
	char *name;
	uint64_t *count;
	uint64_t *len;
	uint64_t cumulative;
	} one_histo_t;

	/*
	* The number of separate histograms processed for psize, lsize and asize.
	*/
	#define NUM_HISTO 3

	/*
	* This routine will create a fixed column size output of three different
	* histograms showing by blocksize of 512 - 2^ SPA_MAX_FOR_16M
	* the count, length and cumulative length of the psize, lsize and
	* asize blocks.
	*
	* All three types of blocks are listed on a single line
	*
	* By default the table is printed in nicenumber format (e.g. 123K) but
	* if the '-P' parameter is specified then the full raw number (parseable)
	* is printed out.
	*/
	static void
	dump_size_histograms(zdb_cb_t *zcb)
	{
	/*
	* A temporary buffer that allows us to convert a number into
	* a string using zdb_nicenumber to allow either raw or human
	* readable numbers to be output.
	*/
	char numbuf[32];

	/*
	* Define titles which are used in the headers of the tables
	* printed by this routine.
	*/
	const char blocksize_title1[] = "block";
	const char blocksize_title2[] = "size";
	const char count_title[] = "Count";
	const char length_title[] = "Size";
	const char cumulative_title[] = "Cum.";

	/*
	* Setup the histogram arrays (psize, lsize, and asize).
	*/
	one_histo_t parm_histo[NUM_HISTO];

	parm_histo[0].name = "psize";
	parm_histo[0].count = zcb->zcb_psize_count;
	parm_histo[0].len = zcb->zcb_psize_len;
	parm_histo[0].cumulative = 0;

	parm_histo[1].name = "lsize";
	parm_histo[1].count = zcb->zcb_lsize_count;
	parm_histo[1].len = zcb->zcb_lsize_len;
	parm_histo[1].cumulative = 0;

	parm_histo[2].name = "asize";
	parm_histo[2].count = zcb->zcb_asize_count;
	parm_histo[2].len = zcb->zcb_asize_len;
	parm_histo[2].cumulative = 0;


	(void) printf("\nBlock Size Histogram\n");
	/*
	* Print the first line titles
	*/
	if (dump_opt['P'])
	(void) printf("\n%s\t", blocksize_title1);
	else
	(void) printf("\n%7s ", blocksize_title1);

	for (int j = 0; j < NUM_HISTO; j++) {
	if (dump_opt['P']) {
	if (j < NUM_HISTO - 1) {
	(void) printf("%s\t\t\t", parm_histo[j].name);
	} else {
	/* Don't print trailing spaces */
	(void) printf(" %s", parm_histo[j].name);
	}
	} else {
	if (j < NUM_HISTO - 1) {
	/* Left aligned strings in the output */
	(void) printf("%-7s ",
	parm_histo[j].name);
	} else {
	/* Don't print trailing spaces */
	(void) printf("%s", parm_histo[j].name);
	}
	}
	}
	(void) printf("\n");

	/*
	* Print the second line titles
	*/
	if (dump_opt['P']) {
	(void) printf("%s\t", blocksize_title2);
	} else {
	(void) printf("%7s ", blocksize_title2);
	}

	for (int i = 0; i < NUM_HISTO; i++) {
	if (dump_opt['P']) {
	(void) printf("%s\t%s\t%s\t",
	count_title, length_title, cumulative_title);
	} else {
	(void) printf("%7s%7s%7s",
	count_title, length_title, cumulative_title);
	}
	}
	(void) printf("\n");

	/*
	* Print the rows
	*/
	for (int i = SPA_MINBLOCKSHIFT; i < SPA_MAX_FOR_16M; i++) {

	/*
	* Print the first column showing the blocksize
	*/
	zdb_nicenum((1ULL << i), numbuf, sizeof (numbuf));

	if (dump_opt['P']) {
	printf("%s", numbuf);
	} else {
	printf("%7s:", numbuf);
	}

	/*
	* Print the remaining set of 3 columns per size:
	* for psize, lsize and asize
	*/
	for (int j = 0; j < NUM_HISTO; j++) {
	parm_histo[j].cumulative += parm_histo[j].len[i];

	zdb_nicenum(parm_histo[j].count[i],
	numbuf, sizeof (numbuf));
	if (dump_opt['P'])
	(void) printf("\t%s", numbuf);
	else
	(void) printf("%7s", numbuf);

	zdb_nicenum(parm_histo[j].len[i],
	numbuf, sizeof (numbuf));
	if (dump_opt['P'])
	(void) printf("\t%s", numbuf);
	else
	(void) printf("%7s", numbuf);

	zdb_nicenum(parm_histo[j].cumulative,
	numbuf, sizeof (numbuf));
	if (dump_opt['P'])
	(void) printf("\t%s", numbuf);
	else
	(void) printf("%7s", numbuf);
	}
	(void) printf("\n");
	}
	}

	static void
	zdb_count_block(zdb_cb_t zcb, zilog_t zilog, const blkptr_t *bp,
	dmu_object_type_t type)
	{
	uint64_t refcnt = 0;
	int i;

	ASSERT(type < ZDB_OT_TOTAL);

	if (zilog && zil_bp_tree_add(zilog, bp) != 0)
	return;

	spa_config_enter(zcb->zcb_spa, SCL_CONFIG, FTAG, RW_READER);

	for (i = 0; i < 4; i++) {
	int l = (i < 2) ? BP_GET_LEVEL(bp) : ZB_TOTAL;
	int t = (i & 1) ? type : ZDB_OT_TOTAL;
	int equal;
	zdb_blkstats_t *zb = &zcb->zcb_type[l][t];

	zb->zb_asize += BP_GET_ASIZE(bp);
	zb->zb_lsize += BP_GET_LSIZE(bp);
	zb->zb_psize += BP_GET_PSIZE(bp);
	zb->zb_count++;

	/*
	* The histogram is only big enough to record blocks up to
	* SPA_OLD_MAXBLOCKSIZE; larger blocks go into the last,
	* "other", bucket.
	*/
	unsigned idx = BP_GET_PSIZE(bp) >> SPA_MINBLOCKSHIFT;
	idx = MIN(idx, SPA_OLD_MAXBLOCKSIZE / SPA_MINBLOCKSIZE + 1);
	zb->zb_psize_histogram[idx]++;

	zb->zb_gangs += BP_COUNT_GANG(bp);

	switch (BP_GET_NDVAS(bp)) {
	case 2:
	if (DVA_GET_VDEV(&bp->blk_dva[0]) ==
	DVA_GET_VDEV(&bp->blk_dva[1])) {
	zb->zb_ditto_samevdev++;

	if (same_metaslab(zcb->zcb_spa,
	DVA_GET_VDEV(&bp->blk_dva[0]),
	DVA_GET_OFFSET(&bp->blk_dva[0]),
	DVA_GET_OFFSET(&bp->blk_dva[1])))
	zb->zb_ditto_same_ms++;
	}
	break;
	case 3:
	equal = (DVA_GET_VDEV(&bp->blk_dva[0]) ==
	DVA_GET_VDEV(&bp->blk_dva[1])) +
	(DVA_GET_VDEV(&bp->blk_dva[0]) ==
	DVA_GET_VDEV(&bp->blk_dva[2])) +
	(DVA_GET_VDEV(&bp->blk_dva[1]) ==
	DVA_GET_VDEV(&bp->blk_dva[2]));
	if (equal != 0) {
	zb->zb_ditto_samevdev++;

	if (DVA_GET_VDEV(&bp->blk_dva[0]) ==
	DVA_GET_VDEV(&bp->blk_dva[1]) &&
	same_metaslab(zcb->zcb_spa,
	DVA_GET_VDEV(&bp->blk_dva[0]),
	DVA_GET_OFFSET(&bp->blk_dva[0]),
	DVA_GET_OFFSET(&bp->blk_dva[1])))
	zb->zb_ditto_same_ms++;
	else if (DVA_GET_VDEV(&bp->blk_dva[0]) ==
	DVA_GET_VDEV(&bp->blk_dva[2]) &&
	same_metaslab(zcb->zcb_spa,
	DVA_GET_VDEV(&bp->blk_dva[0]),
	DVA_GET_OFFSET(&bp->blk_dva[0]),
	DVA_GET_OFFSET(&bp->blk_dva[2])))
	zb->zb_ditto_same_ms++;
	else if (DVA_GET_VDEV(&bp->blk_dva[1]) ==
	DVA_GET_VDEV(&bp->blk_dva[2]) &&
	same_metaslab(zcb->zcb_spa,
	DVA_GET_VDEV(&bp->blk_dva[1]),
	DVA_GET_OFFSET(&bp->blk_dva[1]),
	DVA_GET_OFFSET(&bp->blk_dva[2])))
	zb->zb_ditto_same_ms++;
	}
	break;
	}
	}

	spa_config_exit(zcb->zcb_spa, SCL_CONFIG, FTAG);

	if (BP_IS_EMBEDDED(bp)) {
	zcb->zcb_embedded_blocks[BPE_GET_ETYPE(bp)]++;
	zcb->zcb_embedded_histogram[BPE_GET_ETYPE(bp)]
	[BPE_GET_PSIZE(bp)]++;
	return;
	}
	/*
	* The binning histogram bins by powers of two up to
	* SPA_MAXBLOCKSIZE rather than creating bins for
	* every possible blocksize found in the pool.
	*/
	int bin = highbit64(BP_GET_PSIZE(bp)) - 1;

	zcb->zcb_psize_count[bin]++;
	zcb->zcb_psize_len[bin] += BP_GET_PSIZE(bp);
	zcb->zcb_psize_total += BP_GET_PSIZE(bp);

	bin = highbit64(BP_GET_LSIZE(bp)) - 1;

	zcb->zcb_lsize_count[bin]++;
	zcb->zcb_lsize_len[bin] += BP_GET_LSIZE(bp);
	zcb->zcb_lsize_total += BP_GET_LSIZE(bp);

	bin = highbit64(BP_GET_ASIZE(bp)) - 1;

	zcb->zcb_asize_count[bin]++;
	zcb->zcb_asize_len[bin] += BP_GET_ASIZE(bp);
	zcb->zcb_asize_total += BP_GET_ASIZE(bp);

	if (dump_opt['L'])
	return;

	if (BP_GET_DEDUP(bp)) {
	ddt_t *ddt;
	ddt_entry_t *dde;

	ddt = ddt_select(zcb->zcb_spa, bp);
	ddt_enter(ddt);
	dde = ddt_lookup(ddt, bp, B_FALSE);

	if (dde == NULL) {
	refcnt = 0;
	} else {
	ddt_phys_t *ddp = ddt_phys_select(dde, bp);
	ddt_phys_decref(ddp);
	refcnt = ddp->ddp_refcnt;
	if (ddt_phys_total_refcnt(dde) == 0)
	ddt_remove(ddt, dde);
	}
	ddt_exit(ddt);
	}

	VERIFY3U(zio_wait(zio_claim(NULL, zcb->zcb_spa,
	refcnt ? 0 : spa_min_claim_txg(zcb->zcb_spa),
	bp, NULL, NULL, ZIO_FLAG_CANFAIL)), ==, 0);
	}

	static void
	zdb_blkptr_done(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	blkptr_t *bp = zio->io_bp;
	int ioerr = zio->io_error;
	zdb_cb_t *zcb = zio->io_private;
	zbookmark_phys_t *zb = &zio->io_bookmark;

	abd_free(zio->io_abd);

	mutex_enter(&spa->spa_scrub_lock);
	spa->spa_load_verify_bytes -= BP_GET_PSIZE(bp);
	cv_broadcast(&spa->spa_scrub_io_cv);

	if (ioerr && !(zio->io_flags & ZIO_FLAG_SPECULATIVE)) {
	char blkbuf[BP_SPRINTF_LEN];

	zcb->zcb_haderrors = 1;
	zcb->zcb_errors[ioerr]++;

	if (dump_opt['b'] >= 2)
	snprintf_blkptr(blkbuf, sizeof (blkbuf), bp);
	else
	blkbuf[0] = '\0';

	(void) printf("zdb_blkptr_cb: "
	"Got error %d reading "
	"<%llu, %llu, %lld, %llx> %s -- skipping\n",
	ioerr,
	(u_longlong_t)zb->zb_objset,
	(u_longlong_t)zb->zb_object,
	(u_longlong_t)zb->zb_level,
	(u_longlong_t)zb->zb_blkid,
	blkbuf);
	}
	mutex_exit(&spa->spa_scrub_lock);
	}

	static int
	zdb_blkptr_cb(spa_t spa, zilog_t zilog, const blkptr_t *bp,
	const zbookmark_phys_t zb, const dnode_phys_t dnp, void *arg)
	{
	zdb_cb_t *zcb = arg;
	dmu_object_type_t type;
	boolean_t is_metadata;

	if (zb->zb_level == ZB_DNODE_LEVEL)
	return (0);

	if (dump_opt['b'] >= 5 && bp->blk_birth > 0) {
	char blkbuf[BP_SPRINTF_LEN];
	snprintf_blkptr(blkbuf, sizeof (blkbuf), bp);
	(void) printf("objset %llu object %llu "
	"level %lld offset 0x%llx %s\n",
	(u_longlong_t)zb->zb_objset,
	(u_longlong_t)zb->zb_object,
	(longlong_t)zb->zb_level,
	(u_longlong_t)blkid2offset(dnp, bp, zb),
	blkbuf);
	}

	if (BP_IS_HOLE(bp) \|\| BP_IS_REDACTED(bp))
	return (0);

	type = BP_GET_TYPE(bp);

	zdb_count_block(zcb, zilog, bp,
	(type & DMU_OT_NEWTYPE) ? ZDB_OT_OTHER : type);

	is_metadata = (BP_GET_LEVEL(bp) != 0 \|\| DMU_OT_IS_METADATA(type));

	if (!BP_IS_EMBEDDED(bp) &&
	(dump_opt['c'] > 1 \|\| (dump_opt['c'] && is_metadata))) {
	size_t size = BP_GET_PSIZE(bp);
	abd_t *abd = abd_alloc(size, B_FALSE);
	int flags = ZIO_FLAG_CANFAIL \| ZIO_FLAG_SCRUB \| ZIO_FLAG_RAW;

	/* If it's an intent log block, failure is expected. */
	if (zb->zb_level == ZB_ZIL_LEVEL)
	flags \|= ZIO_FLAG_SPECULATIVE;

	mutex_enter(&spa->spa_scrub_lock);
	while (spa->spa_load_verify_bytes > max_inflight_bytes)
	cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
	spa->spa_load_verify_bytes += size;
	mutex_exit(&spa->spa_scrub_lock);

	zio_nowait(zio_read(NULL, spa, bp, abd, size,
	zdb_blkptr_done, zcb, ZIO_PRIORITY_ASYNC_READ, flags, zb));
	}

	zcb->zcb_readfails = 0;

	/* only call gethrtime() every 100 blocks */
	static int iters;
	if (++iters > 100)
	iters = 0;
	else
	return (0);

	if (dump_opt['b'] < 5 && gethrtime() > zcb->zcb_lastprint + NANOSEC) {
	uint64_t now = gethrtime();
	char buf[10];
	uint64_t bytes = zcb->zcb_type[ZB_TOTAL][ZDB_OT_TOTAL].zb_asize;
	int kb_per_sec =
	1 + bytes / (1 + ((now - zcb->zcb_start) / 1000 / 1000));
	int sec_remaining =
	(zcb->zcb_totalasize - bytes) / 1024 / kb_per_sec;

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (buf) >= NN_NUMBUF_SZ);

	zfs_nicebytes(bytes, buf, sizeof (buf));
	(void) fprintf(stderr,
	"\r%5s completed (%4dMB/s) "
	"estimated time remaining: %uhr %02umin %02usec ",
	buf, kb_per_sec / 1024,
	sec_remaining / 60 / 60,
	sec_remaining / 60 % 60,
	sec_remaining % 60);

	zcb->zcb_lastprint = now;
	}

	return (0);
	}

	static void
	zdb_leak(void *arg, uint64_t start, uint64_t size)
	{
	vdev_t *vd = arg;

	(void) printf("leaked space: vdev %llu, offset 0x%llx, size %llu\n",
	(u_longlong_t)vd->vdev_id, (u_longlong_t)start, (u_longlong_t)size);
	}

	static metaslab_ops_t zdb_metaslab_ops = {
	NULL /* alloc */
	};

	/* ARGSUSED */
	static int
	load_unflushed_svr_segs_cb(spa_t spa, space_map_entry_t sme,
	uint64_t txg, void *arg)
	{
	spa_vdev_removal_t *svr = arg;

	uint64_t offset = sme->sme_offset;
	uint64_t size = sme->sme_run;

	/* skip vdevs we don't care about */
	if (sme->sme_vdev != svr->svr_vdev_id)
	return (0);

	vdev_t *vd = vdev_lookup_top(spa, sme->sme_vdev);
	metaslab_t *ms = vd->vdev_ms[offset >> vd->vdev_ms_shift];
	ASSERT(sme->sme_type == SM_ALLOC \|\| sme->sme_type == SM_FREE);

	if (txg < metaslab_unflushed_txg(ms))
	return (0);

	- vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	- ASSERT(vim != NULL);
	- if (offset >= vdev_indirect_mapping_max_offset(vim))
	- return (0);
	-
	if (sme->sme_type == SM_ALLOC)
	range_tree_add(svr->svr_allocd_segs, offset, size);
	else
	range_tree_remove(svr->svr_allocd_segs, offset, size);

	return (0);
	}

	/* ARGSUSED */
	static void
	claim_segment_impl_cb(uint64_t inner_offset, vdev_t *vd, uint64_t offset,
	uint64_t size, void *arg)
	{
	/*
	* This callback was called through a remap from
	* a device being removed. Therefore, the vdev that
	* this callback is applied to is a concrete
	* vdev.
	*/
	ASSERT(vdev_is_concrete(vd));

	VERIFY0(metaslab_claim_impl(vd, offset, size,
	spa_min_claim_txg(vd->vdev_spa)));
	}

	static void
	claim_segment_cb(void *arg, uint64_t offset, uint64_t size)
	{
	vdev_t *vd = arg;

	vdev_indirect_ops.vdev_op_remap(vd, offset, size,
	claim_segment_impl_cb, NULL);
	}

	/*
	* After accounting for all allocated blocks that are directly referenced,
	* we might have missed a reference to a block from a partially complete
	* (and thus unused) indirect mapping object. We perform a secondary pass
	* through the metaslabs we have already mapped and claim the destination
	* blocks.
	*/
	static void
	zdb_claim_removing(spa_t spa, zdb_cb_t zcb)
	{
	if (dump_opt['L'])
	return;

	if (spa->spa_vdev_removal == NULL)
	return;

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	spa_vdev_removal_t *svr = spa->spa_vdev_removal;
	vdev_t *vd = vdev_lookup_top(spa, svr->svr_vdev_id);
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;

	ASSERT0(range_tree_space(svr->svr_allocd_segs));

	range_tree_t *allocs = range_tree_create(NULL, RANGE_SEG64, NULL, 0, 0);
	for (uint64_t msi = 0; msi < vd->vdev_ms_count; msi++) {
	metaslab_t *msp = vd->vdev_ms[msi];
	-
	- if (msp->ms_start >= vdev_indirect_mapping_max_offset(vim))
	- break;

	ASSERT0(range_tree_space(allocs));
	if (msp->ms_sm != NULL)
	VERIFY0(space_map_load(msp->ms_sm, allocs, SM_ALLOC));
	range_tree_vacate(allocs, range_tree_add, svr->svr_allocd_segs);
	}
	range_tree_destroy(allocs);

	iterate_through_spacemap_logs(spa, load_unflushed_svr_segs_cb, svr);

	/*
	* Clear everything past what has been synced,
	* because we have not allocated mappings for
	* it yet.
	*/
	range_tree_clear(svr->svr_allocd_segs,
	vdev_indirect_mapping_max_offset(vim),
	vd->vdev_asize - vdev_indirect_mapping_max_offset(vim));

	zcb->zcb_removing_size += range_tree_space(svr->svr_allocd_segs);
	range_tree_vacate(svr->svr_allocd_segs, claim_segment_cb, vd);

	spa_config_exit(spa, SCL_CONFIG, FTAG);
	}

	/* ARGSUSED */
	static int
	increment_indirect_mapping_cb(void arg, const blkptr_t bp, boolean_t bp_freed,
	dmu_tx_t *tx)
	{
	zdb_cb_t *zcb = arg;
	spa_t *spa = zcb->zcb_spa;
	vdev_t *vd;
	const dva_t *dva = &bp->blk_dva[0];

	ASSERT(!bp_freed);
	ASSERT(!dump_opt['L']);
	ASSERT3U(BP_GET_NDVAS(bp), ==, 1);

	spa_config_enter(spa, SCL_VDEV, FTAG, RW_READER);
	vd = vdev_lookup_top(zcb->zcb_spa, DVA_GET_VDEV(dva));
	ASSERT3P(vd, !=, NULL);
	spa_config_exit(spa, SCL_VDEV, FTAG);

	ASSERT(vd->vdev_indirect_config.vic_mapping_object != 0);
	ASSERT3P(zcb->zcb_vd_obsolete_counts[vd->vdev_id], !=, NULL);

	vdev_indirect_mapping_increment_obsolete_count(
	vd->vdev_indirect_mapping,
	DVA_GET_OFFSET(dva), DVA_GET_ASIZE(dva),
	zcb->zcb_vd_obsolete_counts[vd->vdev_id]);

	return (0);
	}

	static uint32_t *
	zdb_load_obsolete_counts(vdev_t *vd)
	{
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	spa_t *spa = vd->vdev_spa;
	spa_condensing_indirect_phys_t *scip =
	&spa->spa_condensing_indirect_phys;
	uint64_t obsolete_sm_object;
	uint32_t *counts;

	VERIFY0(vdev_obsolete_sm_object(vd, &obsolete_sm_object));
	EQUIV(obsolete_sm_object != 0, vd->vdev_obsolete_sm != NULL);
	counts = vdev_indirect_mapping_load_obsolete_counts(vim);
	if (vd->vdev_obsolete_sm != NULL) {
	vdev_indirect_mapping_load_obsolete_spacemap(vim, counts,
	vd->vdev_obsolete_sm);
	}
	if (scip->scip_vdev == vd->vdev_id &&
	scip->scip_prev_obsolete_sm_object != 0) {
	space_map_t *prev_obsolete_sm = NULL;
	VERIFY0(space_map_open(&prev_obsolete_sm, spa->spa_meta_objset,
	scip->scip_prev_obsolete_sm_object, 0, vd->vdev_asize, 0));
	vdev_indirect_mapping_load_obsolete_spacemap(vim, counts,
	prev_obsolete_sm);
	space_map_close(prev_obsolete_sm);
	}
	return (counts);
	}

	static void
	zdb_ddt_leak_init(spa_t spa, zdb_cb_t zcb)
	{
	ddt_bookmark_t ddb;
	ddt_entry_t dde;
	int error;
	int p;

	ASSERT(!dump_opt['L']);

	bzero(&ddb, sizeof (ddb));
	while ((error = ddt_walk(spa, &ddb, &dde)) == 0) {
	blkptr_t blk;
	ddt_phys_t *ddp = dde.dde_phys;

	if (ddb.ddb_class == DDT_CLASS_UNIQUE)
	return;

	ASSERT(ddt_phys_total_refcnt(&dde) > 1);

	for (p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
	if (ddp->ddp_phys_birth == 0)
	continue;
	ddt_bp_create(ddb.ddb_checksum,
	&dde.dde_key, ddp, &blk);
	if (p == DDT_PHYS_DITTO) {
	zdb_count_block(zcb, NULL, &blk, ZDB_OT_DITTO);
	} else {
	zcb->zcb_dedup_asize +=
	BP_GET_ASIZE(&blk) * (ddp->ddp_refcnt - 1);
	zcb->zcb_dedup_blocks++;
	}
	}
	ddt_t *ddt = spa->spa_ddt[ddb.ddb_checksum];
	ddt_enter(ddt);
	VERIFY(ddt_lookup(ddt, &blk, B_TRUE) != NULL);
	ddt_exit(ddt);
	}

	ASSERT(error == ENOENT);
	}

	typedef struct checkpoint_sm_exclude_entry_arg {
	vdev_t *cseea_vd;
	uint64_t cseea_checkpoint_size;
	} checkpoint_sm_exclude_entry_arg_t;

	static int
	checkpoint_sm_exclude_entry_cb(space_map_entry_t sme, void arg)
	{
	checkpoint_sm_exclude_entry_arg_t *cseea = arg;
	vdev_t *vd = cseea->cseea_vd;
	metaslab_t *ms = vd->vdev_ms[sme->sme_offset >> vd->vdev_ms_shift];
	uint64_t end = sme->sme_offset + sme->sme_run;

	ASSERT(sme->sme_type == SM_FREE);

	/*
	* Since the vdev_checkpoint_sm exists in the vdev level
	* and the ms_sm space maps exist in the metaslab level,
	* an entry in the checkpoint space map could theoretically
	* cross the boundaries of the metaslab that it belongs.
	*
	* In reality, because of the way that we populate and
	* manipulate the checkpoint's space maps currently,
	* there shouldn't be any entries that cross metaslabs.
	* Hence the assertion below.
	*
	* That said, there is no fundamental requirement that
	* the checkpoint's space map entries should not cross
	* metaslab boundaries. So if needed we could add code
	* that handles metaslab-crossing segments in the future.
	*/
	VERIFY3U(sme->sme_offset, >=, ms->ms_start);
	VERIFY3U(end, <=, ms->ms_start + ms->ms_size);

	/*
	* By removing the entry from the allocated segments we
	* also verify that the entry is there to begin with.
	*/
	mutex_enter(&ms->ms_lock);
	range_tree_remove(ms->ms_allocatable, sme->sme_offset, sme->sme_run);
	mutex_exit(&ms->ms_lock);

	cseea->cseea_checkpoint_size += sme->sme_run;
	return (0);
	}

	static void
	zdb_leak_init_vdev_exclude_checkpoint(vdev_t vd, zdb_cb_t zcb)
	{
	spa_t *spa = vd->vdev_spa;
	space_map_t *checkpoint_sm = NULL;
	uint64_t checkpoint_sm_obj;

	/*
	* If there is no vdev_top_zap, we are in a pool whose
	* version predates the pool checkpoint feature.
	*/
	if (vd->vdev_top_zap == 0)
	return;

	/*
	* If there is no reference of the vdev_checkpoint_sm in
	* the vdev_top_zap, then one of the following scenarios
	* is true:
	*
	* 1] There is no checkpoint
	* 2] There is a checkpoint, but no checkpointed blocks
	* have been freed yet
	* 3] The current vdev is indirect
	*
	* In these cases we return immediately.
	*/
	if (zap_contains(spa_meta_objset(spa), vd->vdev_top_zap,
	VDEV_TOP_ZAP_POOL_CHECKPOINT_SM) != 0)
	return;

	VERIFY0(zap_lookup(spa_meta_objset(spa), vd->vdev_top_zap,
	VDEV_TOP_ZAP_POOL_CHECKPOINT_SM, sizeof (uint64_t), 1,
	&checkpoint_sm_obj));

	checkpoint_sm_exclude_entry_arg_t cseea;
	cseea.cseea_vd = vd;
	cseea.cseea_checkpoint_size = 0;

	VERIFY0(space_map_open(&checkpoint_sm, spa_meta_objset(spa),
	checkpoint_sm_obj, 0, vd->vdev_asize, vd->vdev_ashift));

	VERIFY0(space_map_iterate(checkpoint_sm,
	space_map_length(checkpoint_sm),
	checkpoint_sm_exclude_entry_cb, &cseea));
	space_map_close(checkpoint_sm);

	zcb->zcb_checkpoint_size += cseea.cseea_checkpoint_size;
	}

	static void
	zdb_leak_init_exclude_checkpoint(spa_t spa, zdb_cb_t zcb)
	{
	ASSERT(!dump_opt['L']);

	vdev_t *rvd = spa->spa_root_vdev;
	for (uint64_t c = 0; c < rvd->vdev_children; c++) {
	ASSERT3U(c, ==, rvd->vdev_child[c]->vdev_id);
	zdb_leak_init_vdev_exclude_checkpoint(rvd->vdev_child[c], zcb);
	}
	}

	static int
	count_unflushed_space_cb(spa_t spa, space_map_entry_t sme,
	uint64_t txg, void *arg)
	{
	int64_t *ualloc_space = arg;

	uint64_t offset = sme->sme_offset;
	uint64_t vdev_id = sme->sme_vdev;

	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	if (!vdev_is_concrete(vd))
	return (0);

	metaslab_t *ms = vd->vdev_ms[offset >> vd->vdev_ms_shift];
	ASSERT(sme->sme_type == SM_ALLOC \|\| sme->sme_type == SM_FREE);

	if (txg < metaslab_unflushed_txg(ms))
	return (0);

	if (sme->sme_type == SM_ALLOC)
	*ualloc_space += sme->sme_run;
	else
	*ualloc_space -= sme->sme_run;

	return (0);
	}

	static int64_t
	get_unflushed_alloc_space(spa_t *spa)
	{
	if (dump_opt['L'])
	return (0);

	int64_t ualloc_space = 0;
	iterate_through_spacemap_logs(spa, count_unflushed_space_cb,
	&ualloc_space);
	return (ualloc_space);
	}

	static int
	load_unflushed_cb(spa_t spa, space_map_entry_t sme, uint64_t txg, void *arg)
	{
	maptype_t *uic_maptype = arg;

	uint64_t offset = sme->sme_offset;
	uint64_t size = sme->sme_run;
	uint64_t vdev_id = sme->sme_vdev;

	vdev_t *vd = vdev_lookup_top(spa, vdev_id);

	/* skip indirect vdevs */
	if (!vdev_is_concrete(vd))
	return (0);

	metaslab_t *ms = vd->vdev_ms[offset >> vd->vdev_ms_shift];

	ASSERT(sme->sme_type == SM_ALLOC \|\| sme->sme_type == SM_FREE);
	ASSERT(uic_maptype == SM_ALLOC \|\| uic_maptype == SM_FREE);

	if (txg < metaslab_unflushed_txg(ms))
	return (0);

	if (*uic_maptype == sme->sme_type)
	range_tree_add(ms->ms_allocatable, offset, size);
	else
	range_tree_remove(ms->ms_allocatable, offset, size);

	return (0);
	}

	static void
	load_unflushed_to_ms_allocatables(spa_t *spa, maptype_t maptype)
	{
	iterate_through_spacemap_logs(spa, load_unflushed_cb, &maptype);
	}

	static void
	load_concrete_ms_allocatable_trees(spa_t *spa, maptype_t maptype)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
	vdev_t *vd = rvd->vdev_child[i];

	ASSERT3U(i, ==, vd->vdev_id);

	if (vd->vdev_ops == &vdev_indirect_ops)
	continue;

	for (uint64_t m = 0; m < vd->vdev_ms_count; m++) {
	metaslab_t *msp = vd->vdev_ms[m];

	(void) fprintf(stderr,
	"\rloading concrete vdev %llu, "
	"metaslab %llu of %llu ...",
	(longlong_t)vd->vdev_id,
	(longlong_t)msp->ms_id,
	(longlong_t)vd->vdev_ms_count);

	mutex_enter(&msp->ms_lock);
	range_tree_vacate(msp->ms_allocatable, NULL, NULL);

	/*
	* We don't want to spend the CPU manipulating the
	* size-ordered tree, so clear the range_tree ops.
	*/
	msp->ms_allocatable->rt_ops = NULL;

	if (msp->ms_sm != NULL) {
	VERIFY0(space_map_load(msp->ms_sm,
	msp->ms_allocatable, maptype));
	}
	if (!msp->ms_loaded)
	msp->ms_loaded = B_TRUE;
	mutex_exit(&msp->ms_lock);
	}
	}

	load_unflushed_to_ms_allocatables(spa, maptype);
	}

	/*
	* vm_idxp is an in-out parameter which (for indirect vdevs) is the
	* index in vim_entries that has the first entry in this metaslab.
	* On return, it will be set to the first entry after this metaslab.
	*/
	static void
	load_indirect_ms_allocatable_tree(vdev_t vd, metaslab_t msp,
	uint64_t *vim_idxp)
	{
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;

	mutex_enter(&msp->ms_lock);
	range_tree_vacate(msp->ms_allocatable, NULL, NULL);

	/*
	* We don't want to spend the CPU manipulating the
	* size-ordered tree, so clear the range_tree ops.
	*/
	msp->ms_allocatable->rt_ops = NULL;

	for (; *vim_idxp < vdev_indirect_mapping_num_entries(vim);
	(*vim_idxp)++) {
	vdev_indirect_mapping_entry_phys_t *vimep =
	&vim->vim_entries[*vim_idxp];
	uint64_t ent_offset = DVA_MAPPING_GET_SRC_OFFSET(vimep);
	uint64_t ent_len = DVA_GET_ASIZE(&vimep->vimep_dst);
	ASSERT3U(ent_offset, >=, msp->ms_start);
	if (ent_offset >= msp->ms_start + msp->ms_size)
	break;

	/*
	* Mappings do not cross metaslab boundaries,
	* because we create them by walking the metaslabs.
	*/
	ASSERT3U(ent_offset + ent_len, <=,
	msp->ms_start + msp->ms_size);
	range_tree_add(msp->ms_allocatable, ent_offset, ent_len);
	}

	if (!msp->ms_loaded)
	msp->ms_loaded = B_TRUE;
	mutex_exit(&msp->ms_lock);
	}

	static void
	zdb_leak_init_prepare_indirect_vdevs(spa_t spa, zdb_cb_t zcb)
	{
	ASSERT(!dump_opt['L']);

	vdev_t *rvd = spa->spa_root_vdev;
	for (uint64_t c = 0; c < rvd->vdev_children; c++) {
	vdev_t *vd = rvd->vdev_child[c];

	ASSERT3U(c, ==, vd->vdev_id);

	if (vd->vdev_ops != &vdev_indirect_ops)
	continue;

	/*
	* Note: we don't check for mapping leaks on
	* removing vdevs because their ms_allocatable's
	* are used to look for leaks in allocated space.
	*/
	zcb->zcb_vd_obsolete_counts[c] = zdb_load_obsolete_counts(vd);

	/*
	* Normally, indirect vdevs don't have any
	* metaslabs. We want to set them up for
	* zio_claim().
	*/
	VERIFY0(vdev_metaslab_init(vd, 0));

	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	uint64_t vim_idx = 0;
	for (uint64_t m = 0; m < vd->vdev_ms_count; m++) {

	(void) fprintf(stderr,
	"\rloading indirect vdev %llu, "
	"metaslab %llu of %llu ...",
	(longlong_t)vd->vdev_id,
	(longlong_t)vd->vdev_ms[m]->ms_id,
	(longlong_t)vd->vdev_ms_count);

	load_indirect_ms_allocatable_tree(vd, vd->vdev_ms[m],
	&vim_idx);
	}
	ASSERT3U(vim_idx, ==, vdev_indirect_mapping_num_entries(vim));
	}
	}

	static void
	zdb_leak_init(spa_t spa, zdb_cb_t zcb)
	{
	zcb->zcb_spa = spa;

	if (dump_opt['L'])
	return;

	dsl_pool_t *dp = spa->spa_dsl_pool;
	vdev_t *rvd = spa->spa_root_vdev;

	/*
	* We are going to be changing the meaning of the metaslab's
	* ms_allocatable. Ensure that the allocator doesn't try to
	* use the tree.
	*/
	spa->spa_normal_class->mc_ops = &zdb_metaslab_ops;
	spa->spa_log_class->mc_ops = &zdb_metaslab_ops;

	zcb->zcb_vd_obsolete_counts =
	umem_zalloc(rvd->vdev_children * sizeof (uint32_t *),
	UMEM_NOFAIL);

	/*
	* For leak detection, we overload the ms_allocatable trees
	* to contain allocated segments instead of free segments.
	* As a result, we can't use the normal metaslab_load/unload
	* interfaces.
	*/
	zdb_leak_init_prepare_indirect_vdevs(spa, zcb);
	load_concrete_ms_allocatable_trees(spa, SM_ALLOC);

	/*
	* On load_concrete_ms_allocatable_trees() we loaded all the
	* allocated entries from the ms_sm to the ms_allocatable for
	* each metaslab. If the pool has a checkpoint or is in the
	* middle of discarding a checkpoint, some of these blocks
	* may have been freed but their ms_sm may not have been
	* updated because they are referenced by the checkpoint. In
	* order to avoid false-positives during leak-detection, we
	* go through the vdev's checkpoint space map and exclude all
	* its entries from their relevant ms_allocatable.
	*
	* We also aggregate the space held by the checkpoint and add
	* it to zcb_checkpoint_size.
	*
	* Note that at this point we are also verifying that all the
	* entries on the checkpoint_sm are marked as allocated in
	* the ms_sm of their relevant metaslab.
	* [see comment in checkpoint_sm_exclude_entry_cb()]
	*/
	zdb_leak_init_exclude_checkpoint(spa, zcb);
	ASSERT3U(zcb->zcb_checkpoint_size, ==, spa_get_checkpoint_space(spa));

	/* for cleaner progress output */
	(void) fprintf(stderr, "\n");

	if (bpobj_is_open(&dp->dp_obsolete_bpobj)) {
	ASSERT(spa_feature_is_enabled(spa,
	SPA_FEATURE_DEVICE_REMOVAL));
	(void) bpobj_iterate_nofree(&dp->dp_obsolete_bpobj,
	increment_indirect_mapping_cb, zcb, NULL);
	}

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	zdb_ddt_leak_init(spa, zcb);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	}

	static boolean_t
	zdb_check_for_obsolete_leaks(vdev_t vd, zdb_cb_t zcb)
	{
	boolean_t leaks = B_FALSE;
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	uint64_t total_leaked = 0;
	boolean_t are_precise = B_FALSE;

	ASSERT(vim != NULL);

	for (uint64_t i = 0; i < vdev_indirect_mapping_num_entries(vim); i++) {
	vdev_indirect_mapping_entry_phys_t *vimep =
	&vim->vim_entries[i];
	uint64_t obsolete_bytes = 0;
	uint64_t offset = DVA_MAPPING_GET_SRC_OFFSET(vimep);
	metaslab_t *msp = vd->vdev_ms[offset >> vd->vdev_ms_shift];

	/*
	* This is not very efficient but it's easy to
	* verify correctness.
	*/
	for (uint64_t inner_offset = 0;
	inner_offset < DVA_GET_ASIZE(&vimep->vimep_dst);
	inner_offset += 1 << vd->vdev_ashift) {
	if (range_tree_contains(msp->ms_allocatable,
	offset + inner_offset, 1 << vd->vdev_ashift)) {
	obsolete_bytes += 1 << vd->vdev_ashift;
	}
	}

	int64_t bytes_leaked = obsolete_bytes -
	zcb->zcb_vd_obsolete_counts[vd->vdev_id][i];
	ASSERT3U(DVA_GET_ASIZE(&vimep->vimep_dst), >=,
	zcb->zcb_vd_obsolete_counts[vd->vdev_id][i]);

	VERIFY0(vdev_obsolete_counts_are_precise(vd, &are_precise));
	if (bytes_leaked != 0 && (are_precise \|\| dump_opt['d'] >= 5)) {
	(void) printf("obsolete indirect mapping count "
	"mismatch on %llu:%llx:%llx : %llx bytes leaked\n",
	(u_longlong_t)vd->vdev_id,
	(u_longlong_t)DVA_MAPPING_GET_SRC_OFFSET(vimep),
	(u_longlong_t)DVA_GET_ASIZE(&vimep->vimep_dst),
	(u_longlong_t)bytes_leaked);
	}
	total_leaked += ABS(bytes_leaked);
	}

	VERIFY0(vdev_obsolete_counts_are_precise(vd, &are_precise));
	if (!are_precise && total_leaked > 0) {
	int pct_leaked = total_leaked * 100 /
	vdev_indirect_mapping_bytes_mapped(vim);
	(void) printf("cannot verify obsolete indirect mapping "
	"counts of vdev %llu because precise feature was not "
	"enabled when it was removed: %d%% (%llx bytes) of mapping"
	"unreferenced\n",
	(u_longlong_t)vd->vdev_id, pct_leaked,
	(u_longlong_t)total_leaked);
	} else if (total_leaked > 0) {
	(void) printf("obsolete indirect mapping count mismatch "
	"for vdev %llu -- %llx total bytes mismatched\n",
	(u_longlong_t)vd->vdev_id,
	(u_longlong_t)total_leaked);
	leaks \|= B_TRUE;
	}

	vdev_indirect_mapping_free_obsolete_counts(vim,
	zcb->zcb_vd_obsolete_counts[vd->vdev_id]);
	zcb->zcb_vd_obsolete_counts[vd->vdev_id] = NULL;

	return (leaks);
	}

	static boolean_t
	zdb_leak_fini(spa_t spa, zdb_cb_t zcb)
	{
	if (dump_opt['L'])
	return (B_FALSE);

	boolean_t leaks = B_FALSE;
	vdev_t *rvd = spa->spa_root_vdev;
	for (unsigned c = 0; c < rvd->vdev_children; c++) {
	vdev_t *vd = rvd->vdev_child[c];
	metaslab_group_t *mg __maybe_unused = vd->vdev_mg;

	if (zcb->zcb_vd_obsolete_counts[c] != NULL) {
	leaks \|= zdb_check_for_obsolete_leaks(vd, zcb);
	}

	for (uint64_t m = 0; m < vd->vdev_ms_count; m++) {
	metaslab_t *msp = vd->vdev_ms[m];
	ASSERT3P(mg, ==, msp->ms_group);

	/*
	* ms_allocatable has been overloaded
	* to contain allocated segments. Now that
	* we finished traversing all blocks, any
	* block that remains in the ms_allocatable
	* represents an allocated block that we
	* did not claim during the traversal.
	* Claimed blocks would have been removed
	* from the ms_allocatable. For indirect
	* vdevs, space remaining in the tree
	* represents parts of the mapping that are
	* not referenced, which is not a bug.
	*/
	if (vd->vdev_ops == &vdev_indirect_ops) {
	range_tree_vacate(msp->ms_allocatable,
	NULL, NULL);
	} else {
	range_tree_vacate(msp->ms_allocatable,
	zdb_leak, vd);
	}
	if (msp->ms_loaded) {
	msp->ms_loaded = B_FALSE;
	}
	}
	}

	umem_free(zcb->zcb_vd_obsolete_counts,
	rvd->vdev_children * sizeof (uint32_t *));
	zcb->zcb_vd_obsolete_counts = NULL;

	return (leaks);
	}

	/* ARGSUSED */
	static int
	count_block_cb(void arg, const blkptr_t bp, dmu_tx_t *tx)
	{
	zdb_cb_t *zcb = arg;

	if (dump_opt['b'] >= 5) {
	char blkbuf[BP_SPRINTF_LEN];
	snprintf_blkptr(blkbuf, sizeof (blkbuf), bp);
	(void) printf("[%s] %s\n",
	"deferred free", blkbuf);
	}
	zdb_count_block(zcb, NULL, bp, ZDB_OT_DEFERRED);
	return (0);
	}

	/*
	* Iterate over livelists which have been destroyed by the user but
	* are still present in the MOS, waiting to be freed
	*/
	static void
	iterate_deleted_livelists(spa_t spa, ll_iter_t func, void arg)
	{
	objset_t *mos = spa->spa_meta_objset;
	uint64_t zap_obj;
	int err = zap_lookup(mos, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_DELETED_CLONES, sizeof (uint64_t), 1, &zap_obj);
	if (err == ENOENT)
	return;
	ASSERT0(err);

	zap_cursor_t zc;
	zap_attribute_t attr;
	dsl_deadlist_t ll;
	/* NULL out os prior to dsl_deadlist_open in case it's garbage */
	ll.dl_os = NULL;
	for (zap_cursor_init(&zc, mos, zap_obj);
	zap_cursor_retrieve(&zc, &attr) == 0;
	(void) zap_cursor_advance(&zc)) {
	dsl_deadlist_open(&ll, mos, attr.za_first_integer);
	func(&ll, arg);
	dsl_deadlist_close(&ll);
	}
	zap_cursor_fini(&zc);
	}

	static int
	bpobj_count_block_cb(void arg, const blkptr_t bp, boolean_t bp_freed,
	dmu_tx_t *tx)
	{
	ASSERT(!bp_freed);
	return (count_block_cb(arg, bp, tx));
	}

	static int
	livelist_entry_count_blocks_cb(void args, dsl_deadlist_entry_t dle)
	{
	zdb_cb_t *zbc = args;
	bplist_t blks;
	bplist_create(&blks);
	/* determine which blocks have been alloc'd but not freed */
	VERIFY0(dsl_process_sub_livelist(&dle->dle_bpobj, &blks, NULL, NULL));
	/* count those blocks */
	(void) bplist_iterate(&blks, count_block_cb, zbc, NULL);
	bplist_destroy(&blks);
	return (0);
	}

	static void
	livelist_count_blocks(dsl_deadlist_t ll, void arg)
	{
	dsl_deadlist_iterate(ll, livelist_entry_count_blocks_cb, arg);
	}

	/*
	* Count the blocks in the livelists that have been destroyed by the user
	* but haven't yet been freed.
	*/
	static void
	deleted_livelists_count_blocks(spa_t spa, zdb_cb_t zbc)
	{
	iterate_deleted_livelists(spa, livelist_count_blocks, zbc);
	}

	static void
	dump_livelist_cb(dsl_deadlist_t ll, void arg)
	{
	ASSERT3P(arg, ==, NULL);
	global_feature_count[SPA_FEATURE_LIVELIST]++;
	dump_blkptr_list(ll, "Deleted Livelist");
	dsl_deadlist_iterate(ll, sublivelist_verify_lightweight, NULL);
	}

	/*
	* Print out, register object references to, and increment feature counts for
	* livelists that have been destroyed by the user but haven't yet been freed.
	*/
	static void
	deleted_livelists_dump_mos(spa_t *spa)
	{
	uint64_t zap_obj;
	objset_t *mos = spa->spa_meta_objset;
	int err = zap_lookup(mos, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_DELETED_CLONES, sizeof (uint64_t), 1, &zap_obj);
	if (err == ENOENT)
	return;
	mos_obj_refd(zap_obj);
	iterate_deleted_livelists(spa, dump_livelist_cb, NULL);
	}

	static int
	dump_block_stats(spa_t *spa)
	{
	zdb_cb_t zcb;
	zdb_blkstats_t zb, tzb;
	uint64_t norm_alloc, norm_space, total_alloc, total_found;
	int flags = TRAVERSE_PRE \| TRAVERSE_PREFETCH_METADATA \|
	TRAVERSE_NO_DECRYPT \| TRAVERSE_HARD;
	boolean_t leaks = B_FALSE;
	int e, c, err;
	bp_embedded_type_t i;

	bzero(&zcb, sizeof (zcb));
	(void) printf("\nTraversing all blocks %s%s%s%s%s...\n\n",
	(dump_opt['c'] \|\| !dump_opt['L']) ? "to verify " : "",
	(dump_opt['c'] == 1) ? "metadata " : "",
	dump_opt['c'] ? "checksums " : "",
	(dump_opt['c'] && !dump_opt['L']) ? "and verify " : "",
	!dump_opt['L'] ? "nothing leaked " : "");

	/*
	* When leak detection is enabled we load all space maps as SM_ALLOC
	* maps, then traverse the pool claiming each block we discover. If
	* the pool is perfectly consistent, the segment trees will be empty
	* when we're done. Anything left over is a leak; any block we can't
	* claim (because it's not part of any space map) is a double
	* allocation, reference to a freed block, or an unclaimed log block.
	*
	* When leak detection is disabled (-L option) we still traverse the
	* pool claiming each block we discover, but we skip opening any space
	* maps.
	*/
	bzero(&zcb, sizeof (zdb_cb_t));
	zdb_leak_init(spa, &zcb);

	/*
	* If there's a deferred-free bplist, process that first.
	*/
	(void) bpobj_iterate_nofree(&spa->spa_deferred_bpobj,
	bpobj_count_block_cb, &zcb, NULL);

	if (spa_version(spa) >= SPA_VERSION_DEADLISTS) {
	(void) bpobj_iterate_nofree(&spa->spa_dsl_pool->dp_free_bpobj,
	bpobj_count_block_cb, &zcb, NULL);
	}

	zdb_claim_removing(spa, &zcb);

	if (spa_feature_is_active(spa, SPA_FEATURE_ASYNC_DESTROY)) {
	VERIFY3U(0, ==, bptree_iterate(spa->spa_meta_objset,
	spa->spa_dsl_pool->dp_bptree_obj, B_FALSE, count_block_cb,
	&zcb, NULL));
	}

	deleted_livelists_count_blocks(spa, &zcb);

	if (dump_opt['c'] > 1)
	flags \|= TRAVERSE_PREFETCH_DATA;

	zcb.zcb_totalasize = metaslab_class_get_alloc(spa_normal_class(spa));
	zcb.zcb_totalasize += metaslab_class_get_alloc(spa_special_class(spa));
	zcb.zcb_totalasize += metaslab_class_get_alloc(spa_dedup_class(spa));
	zcb.zcb_start = zcb.zcb_lastprint = gethrtime();
	err = traverse_pool(spa, 0, flags, zdb_blkptr_cb, &zcb);

	/*
	* If we've traversed the data blocks then we need to wait for those
	* I/Os to complete. We leverage "The Godfather" zio to wait on
	* all async I/Os to complete.
	*/
	if (dump_opt['c']) {
	for (c = 0; c < max_ncpus; c++) {
	(void) zio_wait(spa->spa_async_zio_root[c]);
	spa->spa_async_zio_root[c] = zio_root(spa, NULL, NULL,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE \|
	ZIO_FLAG_GODFATHER);
	}
	}
	ASSERT0(spa->spa_load_verify_bytes);

	/*
	* Done after zio_wait() since zcb_haderrors is modified in
	* zdb_blkptr_done()
	*/
	zcb.zcb_haderrors \|= err;

	if (zcb.zcb_haderrors) {
	(void) printf("\nError counts:\n\n");
	(void) printf("\t%5s %s\n", "errno", "count");
	for (e = 0; e < 256; e++) {
	if (zcb.zcb_errors[e] != 0) {
	(void) printf("\t%5d %llu\n",
	e, (u_longlong_t)zcb.zcb_errors[e]);
	}
	}
	}

	/*
	* Report any leaked segments.
	*/
	leaks \|= zdb_leak_fini(spa, &zcb);

	tzb = &zcb.zcb_type[ZB_TOTAL][ZDB_OT_TOTAL];

	norm_alloc = metaslab_class_get_alloc(spa_normal_class(spa));
	norm_space = metaslab_class_get_space(spa_normal_class(spa));

	total_alloc = norm_alloc +
	metaslab_class_get_alloc(spa_log_class(spa)) +
	metaslab_class_get_alloc(spa_special_class(spa)) +
	metaslab_class_get_alloc(spa_dedup_class(spa)) +
	get_unflushed_alloc_space(spa);
	total_found = tzb->zb_asize - zcb.zcb_dedup_asize +
	zcb.zcb_removing_size + zcb.zcb_checkpoint_size;

	if (total_found == total_alloc && !dump_opt['L']) {
	(void) printf("\n\tNo leaks (block sum matches space"
	" maps exactly)\n");
	} else if (!dump_opt['L']) {
	(void) printf("block traversal size %llu != alloc %llu "
	"(%s %lld)\n",
	(u_longlong_t)total_found,
	(u_longlong_t)total_alloc,
	(dump_opt['L']) ? "unreachable" : "leaked",
	(longlong_t)(total_alloc - total_found));
	leaks = B_TRUE;
	}

	if (tzb->zb_count == 0)
	return (2);

	(void) printf("\n");
	(void) printf("\t%-16s %14llu\n", "bp count:",
	(u_longlong_t)tzb->zb_count);
	(void) printf("\t%-16s %14llu\n", "ganged count:",
	(longlong_t)tzb->zb_gangs);
	(void) printf("\t%-16s %14llu avg: %6llu\n", "bp logical:",
	(u_longlong_t)tzb->zb_lsize,
	(u_longlong_t)(tzb->zb_lsize / tzb->zb_count));
	(void) printf("\t%-16s %14llu avg: %6llu compression: %6.2f\n",
	"bp physical:", (u_longlong_t)tzb->zb_psize,
	(u_longlong_t)(tzb->zb_psize / tzb->zb_count),
	(double)tzb->zb_lsize / tzb->zb_psize);
	(void) printf("\t%-16s %14llu avg: %6llu compression: %6.2f\n",
	"bp allocated:", (u_longlong_t)tzb->zb_asize,
	(u_longlong_t)(tzb->zb_asize / tzb->zb_count),
	(double)tzb->zb_lsize / tzb->zb_asize);
	(void) printf("\t%-16s %14llu ref>1: %6llu deduplication: %6.2f\n",
	"bp deduped:", (u_longlong_t)zcb.zcb_dedup_asize,
	(u_longlong_t)zcb.zcb_dedup_blocks,
	(double)zcb.zcb_dedup_asize / tzb->zb_asize + 1.0);
	(void) printf("\t%-16s %14llu used: %5.2f%%\n", "Normal class:",
	(u_longlong_t)norm_alloc, 100.0 * norm_alloc / norm_space);

	if (spa_special_class(spa)->mc_rotor != NULL) {
	uint64_t alloc = metaslab_class_get_alloc(
	spa_special_class(spa));
	uint64_t space = metaslab_class_get_space(
	spa_special_class(spa));

	(void) printf("\t%-16s %14llu used: %5.2f%%\n",
	"Special class", (u_longlong_t)alloc,
	100.0 * alloc / space);
	}

	if (spa_dedup_class(spa)->mc_rotor != NULL) {
	uint64_t alloc = metaslab_class_get_alloc(
	spa_dedup_class(spa));
	uint64_t space = metaslab_class_get_space(
	spa_dedup_class(spa));

	(void) printf("\t%-16s %14llu used: %5.2f%%\n",
	"Dedup class", (u_longlong_t)alloc,
	100.0 * alloc / space);
	}

	for (i = 0; i < NUM_BP_EMBEDDED_TYPES; i++) {
	if (zcb.zcb_embedded_blocks[i] == 0)
	continue;
	(void) printf("\n");
	(void) printf("\tadditional, non-pointer bps of type %u: "
	"%10llu\n",
	i, (u_longlong_t)zcb.zcb_embedded_blocks[i]);

	if (dump_opt['b'] >= 3) {
	(void) printf("\t number of (compressed) bytes: "
	"number of bps\n");
	dump_histogram(zcb.zcb_embedded_histogram[i],
	sizeof (zcb.zcb_embedded_histogram[i]) /
	sizeof (zcb.zcb_embedded_histogram[i][0]), 0);
	}
	}

	if (tzb->zb_ditto_samevdev != 0) {
	(void) printf("\tDittoed blocks on same vdev: %llu\n",
	(longlong_t)tzb->zb_ditto_samevdev);
	}
	if (tzb->zb_ditto_same_ms != 0) {
	(void) printf("\tDittoed blocks in same metaslab: %llu\n",
	(longlong_t)tzb->zb_ditto_same_ms);
	}

	for (uint64_t v = 0; v < spa->spa_root_vdev->vdev_children; v++) {
	vdev_t *vd = spa->spa_root_vdev->vdev_child[v];
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;

	if (vim == NULL) {
	continue;
	}

	char mem[32];
	zdb_nicenum(vdev_indirect_mapping_num_entries(vim),
	mem, vdev_indirect_mapping_size(vim));

	(void) printf("\tindirect vdev id %llu has %llu segments "
	"(%s in memory)\n",
	(longlong_t)vd->vdev_id,
	(longlong_t)vdev_indirect_mapping_num_entries(vim), mem);
	}

	if (dump_opt['b'] >= 2) {
	int l, t, level;
	(void) printf("\nBlocks\tLSIZE\tPSIZE\tASIZE"
	"\t avg\t comp\t%%Total\tType\n");

	for (t = 0; t <= ZDB_OT_TOTAL; t++) {
	char csize[32], lsize[32], psize[32], asize[32];
	char avg[32], gang[32];
	const char *typename;

	/* make sure nicenum has enough space */
	CTASSERT(sizeof (csize) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (lsize) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (psize) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (asize) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (avg) >= NN_NUMBUF_SZ);
	CTASSERT(sizeof (gang) >= NN_NUMBUF_SZ);

	if (t < DMU_OT_NUMTYPES)
	typename = dmu_ot[t].ot_name;
	else
	typename = zdb_ot_extname[t - DMU_OT_NUMTYPES];

	if (zcb.zcb_type[ZB_TOTAL][t].zb_asize == 0) {
	(void) printf("%6s\t%5s\t%5s\t%5s"
	"\t%5s\t%5s\t%6s\t%s\n",
	"-",
	"-",
	"-",
	"-",
	"-",
	"-",
	"-",
	typename);
	continue;
	}

	for (l = ZB_TOTAL - 1; l >= -1; l--) {
	level = (l == -1 ? ZB_TOTAL : l);
	zb = &zcb.zcb_type[level][t];

	if (zb->zb_asize == 0)
	continue;

	if (dump_opt['b'] < 3 && level != ZB_TOTAL)
	continue;

	if (level == 0 && zb->zb_asize ==
	zcb.zcb_type[ZB_TOTAL][t].zb_asize)
	continue;

	zdb_nicenum(zb->zb_count, csize,
	sizeof (csize));
	zdb_nicenum(zb->zb_lsize, lsize,
	sizeof (lsize));
	zdb_nicenum(zb->zb_psize, psize,
	sizeof (psize));
	zdb_nicenum(zb->zb_asize, asize,
	sizeof (asize));
	zdb_nicenum(zb->zb_asize / zb->zb_count, avg,
	sizeof (avg));
	zdb_nicenum(zb->zb_gangs, gang, sizeof (gang));

	(void) printf("%6s\t%5s\t%5s\t%5s\t%5s"
	"\t%5.2f\t%6.2f\t",
	csize, lsize, psize, asize, avg,
	(double)zb->zb_lsize / zb->zb_psize,
	100.0 * zb->zb_asize / tzb->zb_asize);

	if (level == ZB_TOTAL)
	(void) printf("%s\n", typename);
	else
	(void) printf(" L%d %s\n",
	level, typename);

	if (dump_opt['b'] >= 3 && zb->zb_gangs > 0) {
	(void) printf("\t number of ganged "
	"blocks: %s\n", gang);
	}

	if (dump_opt['b'] >= 4) {
	(void) printf("psize "
	"(in 512-byte sectors): "
	"number of blocks\n");
	dump_histogram(zb->zb_psize_histogram,
	PSIZE_HISTO_SIZE, 0);
	}
	}
	}

	/* Output a table summarizing block sizes in the pool */
	if (dump_opt['b'] >= 2) {
	dump_size_histograms(&zcb);
	}
	}

	(void) printf("\n");

	if (leaks)
	return (2);

	if (zcb.zcb_haderrors)
	return (3);

	return (0);
	}

	typedef struct zdb_ddt_entry {
	ddt_key_t zdde_key;
	uint64_t zdde_ref_blocks;
	uint64_t zdde_ref_lsize;
	uint64_t zdde_ref_psize;
	uint64_t zdde_ref_dsize;
	avl_node_t zdde_node;
	} zdb_ddt_entry_t;

	/* ARGSUSED */
	static int
	zdb_ddt_add_cb(spa_t spa, zilog_t zilog, const blkptr_t *bp,
	const zbookmark_phys_t zb, const dnode_phys_t dnp, void *arg)
	{
	avl_tree_t *t = arg;
	avl_index_t where;
	zdb_ddt_entry_t *zdde, zdde_search;

	if (zb->zb_level == ZB_DNODE_LEVEL \|\| BP_IS_HOLE(bp) \|\|
	BP_IS_EMBEDDED(bp))
	return (0);

	if (dump_opt['S'] > 1 && zb->zb_level == ZB_ROOT_LEVEL) {
	(void) printf("traversing objset %llu, %llu objects, "
	"%lu blocks so far\n",
	(u_longlong_t)zb->zb_objset,
	(u_longlong_t)BP_GET_FILL(bp),
	avl_numnodes(t));
	}

	if (BP_IS_HOLE(bp) \|\| BP_GET_CHECKSUM(bp) == ZIO_CHECKSUM_OFF \|\|
	BP_GET_LEVEL(bp) > 0 \|\| DMU_OT_IS_METADATA(BP_GET_TYPE(bp)))
	return (0);

	ddt_key_fill(&zdde_search.zdde_key, bp);

	zdde = avl_find(t, &zdde_search, &where);

	if (zdde == NULL) {
	zdde = umem_zalloc(sizeof (*zdde), UMEM_NOFAIL);
	zdde->zdde_key = zdde_search.zdde_key;
	avl_insert(t, zdde, where);
	}

	zdde->zdde_ref_blocks += 1;
	zdde->zdde_ref_lsize += BP_GET_LSIZE(bp);
	zdde->zdde_ref_psize += BP_GET_PSIZE(bp);
	zdde->zdde_ref_dsize += bp_get_dsize_sync(spa, bp);

	return (0);
	}

	static void
	dump_simulated_ddt(spa_t *spa)
	{
	avl_tree_t t;
	void *cookie = NULL;
	zdb_ddt_entry_t *zdde;
	ddt_histogram_t ddh_total;
	ddt_stat_t dds_total;

	bzero(&ddh_total, sizeof (ddh_total));
	bzero(&dds_total, sizeof (dds_total));
	avl_create(&t, ddt_entry_compare,
	sizeof (zdb_ddt_entry_t), offsetof(zdb_ddt_entry_t, zdde_node));

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	(void) traverse_pool(spa, 0, TRAVERSE_PRE \| TRAVERSE_PREFETCH_METADATA \|
	TRAVERSE_NO_DECRYPT, zdb_ddt_add_cb, &t);

	spa_config_exit(spa, SCL_CONFIG, FTAG);

	while ((zdde = avl_destroy_nodes(&t, &cookie)) != NULL) {
	ddt_stat_t dds;
	uint64_t refcnt = zdde->zdde_ref_blocks;
	ASSERT(refcnt != 0);

	dds.dds_blocks = zdde->zdde_ref_blocks / refcnt;
	dds.dds_lsize = zdde->zdde_ref_lsize / refcnt;
	dds.dds_psize = zdde->zdde_ref_psize / refcnt;
	dds.dds_dsize = zdde->zdde_ref_dsize / refcnt;

	dds.dds_ref_blocks = zdde->zdde_ref_blocks;
	dds.dds_ref_lsize = zdde->zdde_ref_lsize;
	dds.dds_ref_psize = zdde->zdde_ref_psize;
	dds.dds_ref_dsize = zdde->zdde_ref_dsize;

	ddt_stat_add(&ddh_total.ddh_stat[highbit64(refcnt) - 1],
	&dds, 0);

	umem_free(zdde, sizeof (*zdde));
	}

	avl_destroy(&t);

	ddt_histogram_stat(&dds_total, &ddh_total);

	(void) printf("Simulated DDT histogram:\n");

	zpool_dump_ddt(&dds_total, &ddh_total);

	dump_dedup_ratio(&dds_total);
	}

	static int
	verify_device_removal_feature_counts(spa_t *spa)
	{
	uint64_t dr_feature_refcount = 0;
	uint64_t oc_feature_refcount = 0;
	uint64_t indirect_vdev_count = 0;
	uint64_t precise_vdev_count = 0;
	uint64_t obsolete_counts_object_count = 0;
	uint64_t obsolete_sm_count = 0;
	uint64_t obsolete_counts_count = 0;
	uint64_t scip_count = 0;
	uint64_t obsolete_bpobj_count = 0;
	int ret = 0;

	spa_condensing_indirect_phys_t *scip =
	&spa->spa_condensing_indirect_phys;
	if (scip->scip_next_mapping_object != 0) {
	vdev_t *vd = spa->spa_root_vdev->vdev_child[scip->scip_vdev];
	ASSERT(scip->scip_prev_obsolete_sm_object != 0);
	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);

	(void) printf("Condensing indirect vdev %llu: new mapping "
	"object %llu, prev obsolete sm %llu\n",
	(u_longlong_t)scip->scip_vdev,
	(u_longlong_t)scip->scip_next_mapping_object,
	(u_longlong_t)scip->scip_prev_obsolete_sm_object);
	if (scip->scip_prev_obsolete_sm_object != 0) {
	space_map_t *prev_obsolete_sm = NULL;
	VERIFY0(space_map_open(&prev_obsolete_sm,
	spa->spa_meta_objset,
	scip->scip_prev_obsolete_sm_object,
	0, vd->vdev_asize, 0));
	dump_spacemap(spa->spa_meta_objset, prev_obsolete_sm);
	(void) printf("\n");
	space_map_close(prev_obsolete_sm);
	}

	scip_count += 2;
	}

	for (uint64_t i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
	vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;

	if (vic->vic_mapping_object != 0) {
	ASSERT(vd->vdev_ops == &vdev_indirect_ops \|\|
	vd->vdev_removing);
	indirect_vdev_count++;

	if (vd->vdev_indirect_mapping->vim_havecounts) {
	obsolete_counts_count++;
	}
	}

	boolean_t are_precise;
	VERIFY0(vdev_obsolete_counts_are_precise(vd, &are_precise));
	if (are_precise) {
	ASSERT(vic->vic_mapping_object != 0);
	precise_vdev_count++;
	}

	uint64_t obsolete_sm_object;
	VERIFY0(vdev_obsolete_sm_object(vd, &obsolete_sm_object));
	if (obsolete_sm_object != 0) {
	ASSERT(vic->vic_mapping_object != 0);
	obsolete_sm_count++;
	}
	}

	(void) feature_get_refcount(spa,
	&spa_feature_table[SPA_FEATURE_DEVICE_REMOVAL],
	&dr_feature_refcount);
	(void) feature_get_refcount(spa,
	&spa_feature_table[SPA_FEATURE_OBSOLETE_COUNTS],
	&oc_feature_refcount);

	if (dr_feature_refcount != indirect_vdev_count) {
	ret = 1;
	(void) printf("Number of indirect vdevs (%llu) " \
	"does not match feature count (%llu)\n",
	(u_longlong_t)indirect_vdev_count,
	(u_longlong_t)dr_feature_refcount);
	} else {
	(void) printf("Verified device_removal feature refcount " \
	"of %llu is correct\n",
	(u_longlong_t)dr_feature_refcount);
	}

	if (zap_contains(spa_meta_objset(spa), DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_OBSOLETE_BPOBJ) == 0) {
	obsolete_bpobj_count++;
	}


	obsolete_counts_object_count = precise_vdev_count;
	obsolete_counts_object_count += obsolete_sm_count;
	obsolete_counts_object_count += obsolete_counts_count;
	obsolete_counts_object_count += scip_count;
	obsolete_counts_object_count += obsolete_bpobj_count;
	obsolete_counts_object_count += remap_deadlist_count;

	if (oc_feature_refcount != obsolete_counts_object_count) {
	ret = 1;
	(void) printf("Number of obsolete counts objects (%llu) " \
	"does not match feature count (%llu)\n",
	(u_longlong_t)obsolete_counts_object_count,
	(u_longlong_t)oc_feature_refcount);
	(void) printf("pv:%llu os:%llu oc:%llu sc:%llu "
	"ob:%llu rd:%llu\n",
	(u_longlong_t)precise_vdev_count,
	(u_longlong_t)obsolete_sm_count,
	(u_longlong_t)obsolete_counts_count,
	(u_longlong_t)scip_count,
	(u_longlong_t)obsolete_bpobj_count,
	(u_longlong_t)remap_deadlist_count);
	} else {
	(void) printf("Verified indirect_refcount feature refcount " \
	"of %llu is correct\n",
	(u_longlong_t)oc_feature_refcount);
	}
	return (ret);
	}

	static void
	zdb_set_skip_mmp(char *target)
	{
	spa_t *spa;

	/*
	* Disable the activity check to allow examination of
	* active pools.
	*/
	mutex_enter(&spa_namespace_lock);
	if ((spa = spa_lookup(target)) != NULL) {
	spa->spa_import_flags \|= ZFS_IMPORT_SKIP_MMP;
	}
	mutex_exit(&spa_namespace_lock);
	}

	#define BOGUS_SUFFIX "_CHECKPOINTED_UNIVERSE"
	/*
	* Import the checkpointed state of the pool specified by the target
	* parameter as readonly. The function also accepts a pool config
	* as an optional parameter, else it attempts to infer the config by
	* the name of the target pool.
	*
	* Note that the checkpointed state's pool name will be the name of
	* the original pool with the above suffix appended to it. In addition,
	* if the target is not a pool name (e.g. a path to a dataset) then
	* the new_path parameter is populated with the updated path to
	* reflect the fact that we are looking into the checkpointed state.
	*
	* The function returns a newly-allocated copy of the name of the
	* pool containing the checkpointed state. When this copy is no
	* longer needed it should be freed with free(3C). Same thing
	* applies to the new_path parameter if allocated.
	*/
	static char *
	import_checkpointed_state(char target, nvlist_t cfg, char **new_path)
	{
	int error = 0;
	char poolname, bogus_name = NULL;

	/* If the target is not a pool, the extract the pool name */
	char *path_start = strchr(target, '/');
	if (path_start != NULL) {
	size_t poolname_len = path_start - target;
	poolname = strndup(target, poolname_len);
	} else {
	poolname = target;
	}

	if (cfg == NULL) {
	zdb_set_skip_mmp(poolname);
	error = spa_get_stats(poolname, &cfg, NULL, 0);
	if (error != 0) {
	fatal("Tried to read config of pool \"%s\" but "
	"spa_get_stats() failed with error %d\n",
	poolname, error);
	}
	}

	if (asprintf(&bogus_name, "%s%s", poolname, BOGUS_SUFFIX) == -1)
	return (NULL);
	fnvlist_add_string(cfg, ZPOOL_CONFIG_POOL_NAME, bogus_name);

	error = spa_import(bogus_name, cfg, NULL,
	ZFS_IMPORT_MISSING_LOG \| ZFS_IMPORT_CHECKPOINT \|
	ZFS_IMPORT_SKIP_MMP);
	if (error != 0) {
	fatal("Tried to import pool \"%s\" but spa_import() failed "
	"with error %d\n", bogus_name, error);
	}

	if (new_path != NULL && path_start != NULL) {
	if (asprintf(new_path, "%s%s", bogus_name, path_start) == -1) {
	if (path_start != NULL)
	free(poolname);
	return (NULL);
	}
	}

	if (target != poolname)
	free(poolname);

	return (bogus_name);
	}

	typedef struct verify_checkpoint_sm_entry_cb_arg {
	vdev_t *vcsec_vd;

	/* the following fields are only used for printing progress */
	uint64_t vcsec_entryid;
	uint64_t vcsec_num_entries;
	} verify_checkpoint_sm_entry_cb_arg_t;

	#define ENTRIES_PER_PROGRESS_UPDATE 10000

	static int
	verify_checkpoint_sm_entry_cb(space_map_entry_t sme, void arg)
	{
	verify_checkpoint_sm_entry_cb_arg_t *vcsec = arg;
	vdev_t *vd = vcsec->vcsec_vd;
	metaslab_t *ms = vd->vdev_ms[sme->sme_offset >> vd->vdev_ms_shift];
	uint64_t end = sme->sme_offset + sme->sme_run;

	ASSERT(sme->sme_type == SM_FREE);

	if ((vcsec->vcsec_entryid % ENTRIES_PER_PROGRESS_UPDATE) == 0) {
	(void) fprintf(stderr,
	"\rverifying vdev %llu, space map entry %llu of %llu ...",
	(longlong_t)vd->vdev_id,
	(longlong_t)vcsec->vcsec_entryid,
	(longlong_t)vcsec->vcsec_num_entries);
	}
	vcsec->vcsec_entryid++;

	/*
	* See comment in checkpoint_sm_exclude_entry_cb()
	*/
	VERIFY3U(sme->sme_offset, >=, ms->ms_start);
	VERIFY3U(end, <=, ms->ms_start + ms->ms_size);

	/*
	* The entries in the vdev_checkpoint_sm should be marked as
	* allocated in the checkpointed state of the pool, therefore
	* their respective ms_allocateable trees should not contain them.
	*/
	mutex_enter(&ms->ms_lock);
	range_tree_verify_not_present(ms->ms_allocatable,
	sme->sme_offset, sme->sme_run);
	mutex_exit(&ms->ms_lock);

	return (0);
	}

	/*
	* Verify that all segments in the vdev_checkpoint_sm are allocated
	* according to the checkpoint's ms_sm (i.e. are not in the checkpoint's
	* ms_allocatable).
	*
	* Do so by comparing the checkpoint space maps (vdev_checkpoint_sm) of
	* each vdev in the current state of the pool to the metaslab space maps
	* (ms_sm) of the checkpointed state of the pool.
	*
	* Note that the function changes the state of the ms_allocatable
	* trees of the current spa_t. The entries of these ms_allocatable
	* trees are cleared out and then repopulated from with the free
	* entries of their respective ms_sm space maps.
	*/
	static void
	verify_checkpoint_vdev_spacemaps(spa_t checkpoint, spa_t current)
	{
	vdev_t *ckpoint_rvd = checkpoint->spa_root_vdev;
	vdev_t *current_rvd = current->spa_root_vdev;

	load_concrete_ms_allocatable_trees(checkpoint, SM_FREE);

	for (uint64_t c = 0; c < ckpoint_rvd->vdev_children; c++) {
	vdev_t *ckpoint_vd = ckpoint_rvd->vdev_child[c];
	vdev_t *current_vd = current_rvd->vdev_child[c];

	space_map_t *checkpoint_sm = NULL;
	uint64_t checkpoint_sm_obj;

	if (ckpoint_vd->vdev_ops == &vdev_indirect_ops) {
	/*
	* Since we don't allow device removal in a pool
	* that has a checkpoint, we expect that all removed
	* vdevs were removed from the pool before the
	* checkpoint.
	*/
	ASSERT3P(current_vd->vdev_ops, ==, &vdev_indirect_ops);
	continue;
	}

	/*
	* If the checkpoint space map doesn't exist, then nothing
	* here is checkpointed so there's nothing to verify.
	*/
	if (current_vd->vdev_top_zap == 0 \|\|
	zap_contains(spa_meta_objset(current),
	current_vd->vdev_top_zap,
	VDEV_TOP_ZAP_POOL_CHECKPOINT_SM) != 0)
	continue;

	VERIFY0(zap_lookup(spa_meta_objset(current),
	current_vd->vdev_top_zap, VDEV_TOP_ZAP_POOL_CHECKPOINT_SM,
	sizeof (uint64_t), 1, &checkpoint_sm_obj));

	VERIFY0(space_map_open(&checkpoint_sm, spa_meta_objset(current),
	checkpoint_sm_obj, 0, current_vd->vdev_asize,
	current_vd->vdev_ashift));

	verify_checkpoint_sm_entry_cb_arg_t vcsec;
	vcsec.vcsec_vd = ckpoint_vd;
	vcsec.vcsec_entryid = 0;
	vcsec.vcsec_num_entries =
	space_map_length(checkpoint_sm) / sizeof (uint64_t);
	VERIFY0(space_map_iterate(checkpoint_sm,
	space_map_length(checkpoint_sm),
	verify_checkpoint_sm_entry_cb, &vcsec));
	if (dump_opt['m'] > 3)
	dump_spacemap(current->spa_meta_objset, checkpoint_sm);
	space_map_close(checkpoint_sm);
	}

	/*
	* If we've added vdevs since we took the checkpoint, ensure
	* that their checkpoint space maps are empty.
	*/
	if (ckpoint_rvd->vdev_children < current_rvd->vdev_children) {
	for (uint64_t c = ckpoint_rvd->vdev_children;
	c < current_rvd->vdev_children; c++) {
	vdev_t *current_vd = current_rvd->vdev_child[c];
	ASSERT3P(current_vd->vdev_checkpoint_sm, ==, NULL);
	}
	}

	/* for cleaner progress output */
	(void) fprintf(stderr, "\n");
	}

	/*
	* Verifies that all space that's allocated in the checkpoint is
	* still allocated in the current version, by checking that everything
	* in checkpoint's ms_allocatable (which is actually allocated, not
	* allocatable/free) is not present in current's ms_allocatable.
	*
	* Note that the function changes the state of the ms_allocatable
	* trees of both spas when called. The entries of all ms_allocatable
	* trees are cleared out and then repopulated from their respective
	* ms_sm space maps. In the checkpointed state we load the allocated
	* entries, and in the current state we load the free entries.
	*/
	static void
	verify_checkpoint_ms_spacemaps(spa_t checkpoint, spa_t current)
	{
	vdev_t *ckpoint_rvd = checkpoint->spa_root_vdev;
	vdev_t *current_rvd = current->spa_root_vdev;

	load_concrete_ms_allocatable_trees(checkpoint, SM_ALLOC);
	load_concrete_ms_allocatable_trees(current, SM_FREE);

	for (uint64_t i = 0; i < ckpoint_rvd->vdev_children; i++) {
	vdev_t *ckpoint_vd = ckpoint_rvd->vdev_child[i];
	vdev_t *current_vd = current_rvd->vdev_child[i];

	if (ckpoint_vd->vdev_ops == &vdev_indirect_ops) {
	/*
	* See comment in verify_checkpoint_vdev_spacemaps()
	*/
	ASSERT3P(current_vd->vdev_ops, ==, &vdev_indirect_ops);
	continue;
	}

	for (uint64_t m = 0; m < ckpoint_vd->vdev_ms_count; m++) {
	metaslab_t *ckpoint_msp = ckpoint_vd->vdev_ms[m];
	metaslab_t *current_msp = current_vd->vdev_ms[m];

	(void) fprintf(stderr,
	"\rverifying vdev %llu of %llu, "
	"metaslab %llu of %llu ...",
	(longlong_t)current_vd->vdev_id,
	(longlong_t)current_rvd->vdev_children,
	(longlong_t)current_vd->vdev_ms[m]->ms_id,
	(longlong_t)current_vd->vdev_ms_count);

	/*
	* We walk through the ms_allocatable trees that
	* are loaded with the allocated blocks from the
	* ms_sm spacemaps of the checkpoint. For each
	* one of these ranges we ensure that none of them
	* exists in the ms_allocatable trees of the
	* current state which are loaded with the ranges
	* that are currently free.
	*
	* This way we ensure that none of the blocks that
	* are part of the checkpoint were freed by mistake.
	*/
	range_tree_walk(ckpoint_msp->ms_allocatable,
	(range_tree_func_t *)range_tree_verify_not_present,
	current_msp->ms_allocatable);
	}
	}

	/* for cleaner progress output */
	(void) fprintf(stderr, "\n");
	}

	static void
	verify_checkpoint_blocks(spa_t *spa)
	{
	ASSERT(!dump_opt['L']);

	spa_t *checkpoint_spa;
	char *checkpoint_pool;
	nvlist_t *config = NULL;
	int error = 0;

	/*
	* We import the checkpointed state of the pool (under a different
	* name) so we can do verification on it against the current state
	* of the pool.
	*/
	checkpoint_pool = import_checkpointed_state(spa->spa_name, config,
	NULL);
	ASSERT(strcmp(spa->spa_name, checkpoint_pool) != 0);

	error = spa_open(checkpoint_pool, &checkpoint_spa, FTAG);
	if (error != 0) {
	fatal("Tried to open pool \"%s\" but spa_open() failed with "
	"error %d\n", checkpoint_pool, error);
	}

	/*
	* Ensure that ranges in the checkpoint space maps of each vdev
	* are allocated according to the checkpointed state's metaslab
	* space maps.
	*/
	verify_checkpoint_vdev_spacemaps(checkpoint_spa, spa);

	/*
	* Ensure that allocated ranges in the checkpoint's metaslab
	* space maps remain allocated in the metaslab space maps of
	* the current state.
	*/
	verify_checkpoint_ms_spacemaps(checkpoint_spa, spa);

	/*
	* Once we are done, we get rid of the checkpointed state.
	*/
	spa_close(checkpoint_spa, FTAG);
	free(checkpoint_pool);
	}

	static void
	dump_leftover_checkpoint_blocks(spa_t *spa)
	{
	vdev_t *rvd = spa->spa_root_vdev;

	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
	vdev_t *vd = rvd->vdev_child[i];

	space_map_t *checkpoint_sm = NULL;
	uint64_t checkpoint_sm_obj;

	if (vd->vdev_top_zap == 0)
	continue;

	if (zap_contains(spa_meta_objset(spa), vd->vdev_top_zap,
	VDEV_TOP_ZAP_POOL_CHECKPOINT_SM) != 0)
	continue;

	VERIFY0(zap_lookup(spa_meta_objset(spa), vd->vdev_top_zap,
	VDEV_TOP_ZAP_POOL_CHECKPOINT_SM,
	sizeof (uint64_t), 1, &checkpoint_sm_obj));

	VERIFY0(space_map_open(&checkpoint_sm, spa_meta_objset(spa),
	checkpoint_sm_obj, 0, vd->vdev_asize, vd->vdev_ashift));
	dump_spacemap(spa->spa_meta_objset, checkpoint_sm);
	space_map_close(checkpoint_sm);
	}
	}

	static int
	verify_checkpoint(spa_t *spa)
	{
	uberblock_t checkpoint;
	int error;

	if (!spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT))
	return (0);

	error = zap_lookup(spa->spa_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_ZPOOL_CHECKPOINT, sizeof (uint64_t),
	sizeof (uberblock_t) / sizeof (uint64_t), &checkpoint);

	if (error == ENOENT && !dump_opt['L']) {
	/*
	* If the feature is active but the uberblock is missing
	* then we must be in the middle of discarding the
	* checkpoint.
	*/
	(void) printf("\nPartially discarded checkpoint "
	"state found:\n");
	if (dump_opt['m'] > 3)
	dump_leftover_checkpoint_blocks(spa);
	return (0);
	} else if (error != 0) {
	(void) printf("lookup error %d when looking for "
	"checkpointed uberblock in MOS\n", error);
	return (error);
	}
	dump_uberblock(&checkpoint, "\nCheckpointed uberblock found:\n", "\n");

	if (checkpoint.ub_checkpoint_txg == 0) {
	(void) printf("\nub_checkpoint_txg not set in checkpointed "
	"uberblock\n");
	error = 3;
	}

	if (error == 0 && !dump_opt['L'])
	verify_checkpoint_blocks(spa);

	return (error);
	}

	/* ARGSUSED */
	static void
	mos_leaks_cb(void *arg, uint64_t start, uint64_t size)
	{
	for (uint64_t i = start; i < size; i++) {
	(void) printf("MOS object %llu referenced but not allocated\n",
	(u_longlong_t)i);
	}
	}

	static void
	mos_obj_refd(uint64_t obj)
	{
	if (obj != 0 && mos_refd_objs != NULL)
	range_tree_add(mos_refd_objs, obj, 1);
	}

	/*
	* Call on a MOS object that may already have been referenced.
	*/
	static void
	mos_obj_refd_multiple(uint64_t obj)
	{
	if (obj != 0 && mos_refd_objs != NULL &&
	!range_tree_contains(mos_refd_objs, obj, 1))
	range_tree_add(mos_refd_objs, obj, 1);
	}

	static void
	mos_leak_vdev_top_zap(vdev_t *vd)
	{
	uint64_t ms_flush_data_obj;
	int error = zap_lookup(spa_meta_objset(vd->vdev_spa),
	vd->vdev_top_zap, VDEV_TOP_ZAP_MS_UNFLUSHED_PHYS_TXGS,
	sizeof (ms_flush_data_obj), 1, &ms_flush_data_obj);
	if (error == ENOENT)
	return;
	ASSERT0(error);

	mos_obj_refd(ms_flush_data_obj);
	}

	static void
	mos_leak_vdev(vdev_t *vd)
	{
	mos_obj_refd(vd->vdev_dtl_object);
	mos_obj_refd(vd->vdev_ms_array);
	mos_obj_refd(vd->vdev_indirect_config.vic_births_object);
	mos_obj_refd(vd->vdev_indirect_config.vic_mapping_object);
	mos_obj_refd(vd->vdev_leaf_zap);
	if (vd->vdev_checkpoint_sm != NULL)
	mos_obj_refd(vd->vdev_checkpoint_sm->sm_object);
	if (vd->vdev_indirect_mapping != NULL) {
	mos_obj_refd(vd->vdev_indirect_mapping->
	vim_phys->vimp_counts_object);
	}
	if (vd->vdev_obsolete_sm != NULL)
	mos_obj_refd(vd->vdev_obsolete_sm->sm_object);

	for (uint64_t m = 0; m < vd->vdev_ms_count; m++) {
	metaslab_t *ms = vd->vdev_ms[m];
	mos_obj_refd(space_map_object(ms->ms_sm));
	}

	if (vd->vdev_top_zap != 0) {
	mos_obj_refd(vd->vdev_top_zap);
	mos_leak_vdev_top_zap(vd);
	}

	for (uint64_t c = 0; c < vd->vdev_children; c++) {
	mos_leak_vdev(vd->vdev_child[c]);
	}
	}

	static void
	mos_leak_log_spacemaps(spa_t *spa)
	{
	uint64_t spacemap_zap;
	int error = zap_lookup(spa_meta_objset(spa),
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_LOG_SPACEMAP_ZAP,
	sizeof (spacemap_zap), 1, &spacemap_zap);
	if (error == ENOENT)
	return;
	ASSERT0(error);

	mos_obj_refd(spacemap_zap);
	for (spa_log_sm_t *sls = avl_first(&spa->spa_sm_logs_by_txg);
	sls; sls = AVL_NEXT(&spa->spa_sm_logs_by_txg, sls))
	mos_obj_refd(sls->sls_sm_obj);
	}

	static int
	dump_mos_leaks(spa_t *spa)
	{
	int rv = 0;
	objset_t *mos = spa->spa_meta_objset;
	dsl_pool_t *dp = spa->spa_dsl_pool;

	/* Visit and mark all referenced objects in the MOS */

	mos_obj_refd(DMU_POOL_DIRECTORY_OBJECT);
	mos_obj_refd(spa->spa_pool_props_object);
	mos_obj_refd(spa->spa_config_object);
	mos_obj_refd(spa->spa_ddt_stat_object);
	mos_obj_refd(spa->spa_feat_desc_obj);
	mos_obj_refd(spa->spa_feat_enabled_txg_obj);
	mos_obj_refd(spa->spa_feat_for_read_obj);
	mos_obj_refd(spa->spa_feat_for_write_obj);
	mos_obj_refd(spa->spa_history);
	mos_obj_refd(spa->spa_errlog_last);
	mos_obj_refd(spa->spa_errlog_scrub);
	mos_obj_refd(spa->spa_all_vdev_zaps);
	mos_obj_refd(spa->spa_dsl_pool->dp_bptree_obj);
	mos_obj_refd(spa->spa_dsl_pool->dp_tmp_userrefs_obj);
	mos_obj_refd(spa->spa_dsl_pool->dp_scan->scn_phys.scn_queue_obj);
	bpobj_count_refd(&spa->spa_deferred_bpobj);
	mos_obj_refd(dp->dp_empty_bpobj);
	bpobj_count_refd(&dp->dp_obsolete_bpobj);
	bpobj_count_refd(&dp->dp_free_bpobj);
	mos_obj_refd(spa->spa_l2cache.sav_object);
	mos_obj_refd(spa->spa_spares.sav_object);

	if (spa->spa_syncing_log_sm != NULL)
	mos_obj_refd(spa->spa_syncing_log_sm->sm_object);
	mos_leak_log_spacemaps(spa);

	mos_obj_refd(spa->spa_condensing_indirect_phys.
	scip_next_mapping_object);
	mos_obj_refd(spa->spa_condensing_indirect_phys.
	scip_prev_obsolete_sm_object);
	if (spa->spa_condensing_indirect_phys.scip_next_mapping_object != 0) {
	vdev_indirect_mapping_t *vim =
	vdev_indirect_mapping_open(mos,
	spa->spa_condensing_indirect_phys.scip_next_mapping_object);
	mos_obj_refd(vim->vim_phys->vimp_counts_object);
	vdev_indirect_mapping_close(vim);
	}
	deleted_livelists_dump_mos(spa);

	if (dp->dp_origin_snap != NULL) {
	dsl_dataset_t *ds;

	dsl_pool_config_enter(dp, FTAG);
	VERIFY0(dsl_dataset_hold_obj(dp,
	dsl_dataset_phys(dp->dp_origin_snap)->ds_next_snap_obj,
	FTAG, &ds));
	count_ds_mos_objects(ds);
	dump_blkptr_list(&ds->ds_deadlist, "Deadlist");
	dsl_dataset_rele(ds, FTAG);
	dsl_pool_config_exit(dp, FTAG);

	count_ds_mos_objects(dp->dp_origin_snap);
	dump_blkptr_list(&dp->dp_origin_snap->ds_deadlist, "Deadlist");
	}
	count_dir_mos_objects(dp->dp_mos_dir);
	if (dp->dp_free_dir != NULL)
	count_dir_mos_objects(dp->dp_free_dir);
	if (dp->dp_leak_dir != NULL)
	count_dir_mos_objects(dp->dp_leak_dir);

	mos_leak_vdev(spa->spa_root_vdev);

	for (uint64_t class = 0; class < DDT_CLASSES; class++) {
	for (uint64_t type = 0; type < DDT_TYPES; type++) {
	for (uint64_t cksum = 0;
	cksum < ZIO_CHECKSUM_FUNCTIONS; cksum++) {
	ddt_t *ddt = spa->spa_ddt[cksum];
	mos_obj_refd(ddt->ddt_object[type][class]);
	}
	}
	}

	/*
	* Visit all allocated objects and make sure they are referenced.
	*/
	uint64_t object = 0;
	while (dmu_object_next(mos, &object, B_FALSE, 0) == 0) {
	if (range_tree_contains(mos_refd_objs, object, 1)) {
	range_tree_remove(mos_refd_objs, object, 1);
	} else {
	dmu_object_info_t doi;
	const char *name;
	dmu_object_info(mos, object, &doi);
	if (doi.doi_type & DMU_OT_NEWTYPE) {
	dmu_object_byteswap_t bswap =
	DMU_OT_BYTESWAP(doi.doi_type);
	name = dmu_ot_byteswap[bswap].ob_name;
	} else {
	name = dmu_ot[doi.doi_type].ot_name;
	}

	(void) printf("MOS object %llu (%s) leaked\n",
	(u_longlong_t)object, name);
	rv = 2;
	}
	}
	(void) range_tree_walk(mos_refd_objs, mos_leaks_cb, NULL);
	if (!range_tree_is_empty(mos_refd_objs))
	rv = 2;
	range_tree_vacate(mos_refd_objs, NULL, NULL);
	range_tree_destroy(mos_refd_objs);
	return (rv);
	}

	typedef struct log_sm_obsolete_stats_arg {
	uint64_t lsos_current_txg;

	uint64_t lsos_total_entries;
	uint64_t lsos_valid_entries;

	uint64_t lsos_sm_entries;
	uint64_t lsos_valid_sm_entries;
	} log_sm_obsolete_stats_arg_t;

	static int
	log_spacemap_obsolete_stats_cb(spa_t spa, space_map_entry_t sme,
	uint64_t txg, void *arg)
	{
	log_sm_obsolete_stats_arg_t *lsos = arg;

	uint64_t offset = sme->sme_offset;
	uint64_t vdev_id = sme->sme_vdev;

	if (lsos->lsos_current_txg == 0) {
	/* this is the first log */
	lsos->lsos_current_txg = txg;
	} else if (lsos->lsos_current_txg < txg) {
	/* we just changed log - print stats and reset */
	(void) printf("%-8llu valid entries out of %-8llu - txg %llu\n",
	(u_longlong_t)lsos->lsos_valid_sm_entries,
	(u_longlong_t)lsos->lsos_sm_entries,
	(u_longlong_t)lsos->lsos_current_txg);
	lsos->lsos_valid_sm_entries = 0;
	lsos->lsos_sm_entries = 0;
	lsos->lsos_current_txg = txg;
	}
	ASSERT3U(lsos->lsos_current_txg, ==, txg);

	lsos->lsos_sm_entries++;
	lsos->lsos_total_entries++;

	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	if (!vdev_is_concrete(vd))
	return (0);

	metaslab_t *ms = vd->vdev_ms[offset >> vd->vdev_ms_shift];
	ASSERT(sme->sme_type == SM_ALLOC \|\| sme->sme_type == SM_FREE);

	if (txg < metaslab_unflushed_txg(ms))
	return (0);
	lsos->lsos_valid_sm_entries++;
	lsos->lsos_valid_entries++;
	return (0);
	}

	static void
	dump_log_spacemap_obsolete_stats(spa_t *spa)
	{
	if (!spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP))
	return;

	log_sm_obsolete_stats_arg_t lsos;
	bzero(&lsos, sizeof (lsos));

	(void) printf("Log Space Map Obsolete Entry Statistics:\n");

	iterate_through_spacemap_logs(spa,
	log_spacemap_obsolete_stats_cb, &lsos);

	/* print stats for latest log */
	(void) printf("%-8llu valid entries out of %-8llu - txg %llu\n",
	(u_longlong_t)lsos.lsos_valid_sm_entries,
	(u_longlong_t)lsos.lsos_sm_entries,
	(u_longlong_t)lsos.lsos_current_txg);

	(void) printf("%-8llu valid entries out of %-8llu - total\n\n",
	(u_longlong_t)lsos.lsos_valid_entries,
	(u_longlong_t)lsos.lsos_total_entries);
	}

	static void
	dump_zpool(spa_t *spa)
	{
	dsl_pool_t *dp = spa_get_dsl(spa);
	int rc = 0;

	if (dump_opt['y']) {
	livelist_metaslab_validate(spa);
	}

	if (dump_opt['S']) {
	dump_simulated_ddt(spa);
	return;
	}

	if (!dump_opt['e'] && dump_opt['C'] > 1) {
	(void) printf("\nCached configuration:\n");
	dump_nvlist(spa->spa_config, 8);
	}

	if (dump_opt['C'])
	dump_config(spa);

	if (dump_opt['u'])
	dump_uberblock(&spa->spa_uberblock, "\nUberblock:\n", "\n");

	if (dump_opt['D'])
	dump_all_ddts(spa);

	if (dump_opt['d'] > 2 \|\| dump_opt['m'])
	dump_metaslabs(spa);
	if (dump_opt['M'])
	dump_metaslab_groups(spa);
	if (dump_opt['d'] > 2 \|\| dump_opt['m']) {
	dump_log_spacemaps(spa);
	dump_log_spacemap_obsolete_stats(spa);
	}

	if (dump_opt['d'] \|\| dump_opt['i']) {
	spa_feature_t f;
	mos_refd_objs = range_tree_create(NULL, RANGE_SEG64, NULL, 0,
	0);
	dump_objset(dp->dp_meta_objset);

	if (dump_opt['d'] >= 3) {
	dsl_pool_t *dp = spa->spa_dsl_pool;
	dump_full_bpobj(&spa->spa_deferred_bpobj,
	"Deferred frees", 0);
	if (spa_version(spa) >= SPA_VERSION_DEADLISTS) {
	dump_full_bpobj(&dp->dp_free_bpobj,
	"Pool snapshot frees", 0);
	}
	if (bpobj_is_open(&dp->dp_obsolete_bpobj)) {
	ASSERT(spa_feature_is_enabled(spa,
	SPA_FEATURE_DEVICE_REMOVAL));
	dump_full_bpobj(&dp->dp_obsolete_bpobj,
	"Pool obsolete blocks", 0);
	}

	if (spa_feature_is_active(spa,
	SPA_FEATURE_ASYNC_DESTROY)) {
	dump_bptree(spa->spa_meta_objset,
	dp->dp_bptree_obj,
	"Pool dataset frees");
	}
	dump_dtl(spa->spa_root_vdev, 0);
	}

	for (spa_feature_t f = 0; f < SPA_FEATURES; f++)
	global_feature_count[f] = UINT64_MAX;
	global_feature_count[SPA_FEATURE_REDACTION_BOOKMARKS] = 0;
	global_feature_count[SPA_FEATURE_BOOKMARK_WRITTEN] = 0;
	global_feature_count[SPA_FEATURE_LIVELIST] = 0;

	(void) dmu_objset_find(spa_name(spa), dump_one_objset,
	NULL, DS_FIND_SNAPSHOTS \| DS_FIND_CHILDREN);

	if (rc == 0 && !dump_opt['L'])
	rc = dump_mos_leaks(spa);

	for (f = 0; f < SPA_FEATURES; f++) {
	uint64_t refcount;

	uint64_t *arr;
	if (!(spa_feature_table[f].fi_flags &
	ZFEATURE_FLAG_PER_DATASET)) {
	if (global_feature_count[f] == UINT64_MAX)
	continue;
	if (!spa_feature_is_enabled(spa, f)) {
	ASSERT0(global_feature_count[f]);
	continue;
	}
	arr = global_feature_count;
	} else {
	if (!spa_feature_is_enabled(spa, f)) {
	ASSERT0(dataset_feature_count[f]);
	continue;
	}
	arr = dataset_feature_count;
	}
	if (feature_get_refcount(spa, &spa_feature_table[f],
	&refcount) == ENOTSUP)
	continue;
	if (arr[f] != refcount) {
	(void) printf("%s feature refcount mismatch: "
	"%lld consumers != %lld refcount\n",
	spa_feature_table[f].fi_uname,
	(longlong_t)arr[f], (longlong_t)refcount);
	rc = 2;
	} else {
	(void) printf("Verified %s feature refcount "
	"of %llu is correct\n",
	spa_feature_table[f].fi_uname,
	(longlong_t)refcount);
	}
	}

	if (rc == 0)
	rc = verify_device_removal_feature_counts(spa);
	}

	if (rc == 0 && (dump_opt['b'] \|\| dump_opt['c']))
	rc = dump_block_stats(spa);

	if (rc == 0)
	rc = verify_spacemap_refcounts(spa);

	if (dump_opt['s'])
	show_pool_stats(spa);

	if (dump_opt['h'])
	dump_history(spa);

	if (rc == 0)
	rc = verify_checkpoint(spa);

	if (rc != 0) {
	dump_debug_buffer();
	exit(rc);
	}
	}

	#define ZDB_FLAG_CHECKSUM 0x0001
	#define ZDB_FLAG_DECOMPRESS 0x0002
	#define ZDB_FLAG_BSWAP 0x0004
	#define ZDB_FLAG_GBH 0x0008
	#define ZDB_FLAG_INDIRECT 0x0010
	#define ZDB_FLAG_RAW 0x0020
	#define ZDB_FLAG_PRINT_BLKPTR 0x0040
	#define ZDB_FLAG_VERBOSE 0x0080

	static int flagbits[256];
	static char flagbitstr[16];

	static void
	zdb_print_blkptr(const blkptr_t *bp, int flags)
	{
	char blkbuf[BP_SPRINTF_LEN];

	if (flags & ZDB_FLAG_BSWAP)
	byteswap_uint64_array((void *)bp, sizeof (blkptr_t));

	snprintf_blkptr(blkbuf, sizeof (blkbuf), bp);
	(void) printf("%s\n", blkbuf);
	}

	static void
	zdb_dump_indirect(blkptr_t *bp, int nbps, int flags)
	{
	int i;

	for (i = 0; i < nbps; i++)
	zdb_print_blkptr(&bp[i], flags);
	}

	static void
	zdb_dump_gbh(void *buf, int flags)
	{
	zdb_dump_indirect((blkptr_t *)buf, SPA_GBH_NBLKPTRS, flags);
	}

	static void
	zdb_dump_block_raw(void *buf, uint64_t size, int flags)
	{
	if (flags & ZDB_FLAG_BSWAP)
	byteswap_uint64_array(buf, size);
	VERIFY(write(fileno(stdout), buf, size) == size);
	}

	static void
	zdb_dump_block(char label, void buf, uint64_t size, int flags)
	{
	uint64_t d = (uint64_t )buf;
	unsigned nwords = size / sizeof (uint64_t);
	int do_bswap = !!(flags & ZDB_FLAG_BSWAP);
	unsigned i, j;
	const char *hdr;
	char *c;


	if (do_bswap)
	hdr = " 7 6 5 4 3 2 1 0 f e d c b a 9 8";
	else
	hdr = " 0 1 2 3 4 5 6 7 8 9 a b c d e f";

	(void) printf("\n%s\n%6s %s 0123456789abcdef\n", label, "", hdr);

	#ifdef _LITTLE_ENDIAN
	/* correct the endianness */
	do_bswap = !do_bswap;
	#endif
	for (i = 0; i < nwords; i += 2) {
	(void) printf("%06llx: %016llx %016llx ",
	(u_longlong_t)(i * sizeof (uint64_t)),
	(u_longlong_t)(do_bswap ? BSWAP_64(d[i]) : d[i]),
	(u_longlong_t)(do_bswap ? BSWAP_64(d[i + 1]) : d[i + 1]));

	c = (char *)&d[i];
	for (j = 0; j < 2 * sizeof (uint64_t); j++)
	(void) printf("%c", isprint(c[j]) ? c[j] : '.');
	(void) printf("\n");
	}
	}

	/*
	* There are two acceptable formats:
	* leaf_name - For example: c1t0d0 or /tmp/ztest.0a
	* child[.child]* - For example: 0.1.1
	*
	* The second form can be used to specify arbitrary vdevs anywhere
	* in the hierarchy. For example, in a pool with a mirror of
	* RAID-Zs, you can specify either RAID-Z vdev with 0.0 or 0.1 .
	*/
	static vdev_t *
	zdb_vdev_lookup(vdev_t vdev, const char path)
	{
	char s, p, *q;
	unsigned i;

	if (vdev == NULL)
	return (NULL);

	/* First, assume the x.x.x.x format */
	i = strtoul(path, &s, 10);
	if (s == path \|\| (s && s != '.' && s != '\0'))
	goto name;
	if (i >= vdev->vdev_children)
	return (NULL);

	vdev = vdev->vdev_child[i];
	if (s && *s == '\0')
	return (vdev);
	return (zdb_vdev_lookup(vdev, s+1));

	name:
	for (i = 0; i < vdev->vdev_children; i++) {
	vdev_t *vc = vdev->vdev_child[i];

	if (vc->vdev_path == NULL) {
	vc = zdb_vdev_lookup(vc, path);
	if (vc == NULL)
	continue;
	else
	return (vc);
	}

	p = strrchr(vc->vdev_path, '/');
	p = p ? p + 1 : vc->vdev_path;
	q = &vc->vdev_path[strlen(vc->vdev_path) - 2];

	if (strcmp(vc->vdev_path, path) == 0)
	return (vc);
	if (strcmp(p, path) == 0)
	return (vc);
	if (strcmp(q, "s0") == 0 && strncmp(p, path, q - p) == 0)
	return (vc);
	}

	return (NULL);
	}

	static int
	name_from_objset_id(spa_t spa, uint64_t objset_id, char outstr)
	{
	dsl_dataset_t *ds;

	dsl_pool_config_enter(spa->spa_dsl_pool, FTAG);
	int error = dsl_dataset_hold_obj(spa->spa_dsl_pool, objset_id,
	NULL, &ds);
	if (error != 0) {
	(void) fprintf(stderr, "failed to hold objset %llu: %s\n",
	(u_longlong_t)objset_id, strerror(error));
	dsl_pool_config_exit(spa->spa_dsl_pool, FTAG);
	return (error);
	}
	dsl_dataset_name(ds, outstr);
	dsl_dataset_rele(ds, NULL);
	dsl_pool_config_exit(spa->spa_dsl_pool, FTAG);
	return (0);
	}

	static boolean_t
	zdb_parse_block_sizes(char sizes, uint64_t lsize, uint64_t *psize)
	{
	char s0, s1;

	if (sizes == NULL)
	return (B_FALSE);

	s0 = strtok(sizes, "/");
	if (s0 == NULL)
	return (B_FALSE);
	s1 = strtok(NULL, "/");
	*lsize = strtoull(s0, NULL, 16);
	psize = s1 ? strtoull(s1, NULL, 16) : lsize;
	return (lsize >= psize && *psize > 0);
	}

	#define ZIO_COMPRESS_MASK(alg) (1ULL << (ZIO_COMPRESS_##alg))

	static boolean_t
	zdb_decompress_block(abd_t pabd, void buf, void *lbuf, uint64_t lsize,
	uint64_t psize, int flags)
	{
	boolean_t exceeded = B_FALSE;
	/*
	* We don't know how the data was compressed, so just try
	* every decompress function at every inflated blocksize.
	*/
	void *lbuf2 = umem_alloc(SPA_MAXBLOCKSIZE, UMEM_NOFAIL);
	int cfuncs[ZIO_COMPRESS_FUNCTIONS] = { 0 };
	int *cfuncp = cfuncs;
	uint64_t maxlsize = SPA_MAXBLOCKSIZE;
	uint64_t mask = ZIO_COMPRESS_MASK(ON) \| ZIO_COMPRESS_MASK(OFF) \|
	ZIO_COMPRESS_MASK(INHERIT) \| ZIO_COMPRESS_MASK(EMPTY) \|
	(getenv("ZDB_NO_ZLE") ? ZIO_COMPRESS_MASK(ZLE) : 0);
	*cfuncp++ = ZIO_COMPRESS_LZ4;
	*cfuncp++ = ZIO_COMPRESS_LZJB;
	mask \|= ZIO_COMPRESS_MASK(LZ4) \| ZIO_COMPRESS_MASK(LZJB);
	for (int c = 0; c < ZIO_COMPRESS_FUNCTIONS; c++)
	if (((1ULL << c) & mask) == 0)
	*cfuncp++ = c;

	/*
	* On the one hand, with SPA_MAXBLOCKSIZE at 16MB, this
	* could take a while and we should let the user know
	* we are not stuck. On the other hand, printing progress
	* info gets old after a while. User can specify 'v' flag
	* to see the progression.
	*/
	if (lsize == psize)
	lsize += SPA_MINBLOCKSIZE;
	else
	maxlsize = lsize;
	for (; lsize <= maxlsize; lsize += SPA_MINBLOCKSIZE) {
	for (cfuncp = cfuncs; *cfuncp; cfuncp++) {
	if (flags & ZDB_FLAG_VERBOSE) {
	(void) fprintf(stderr,
	"Trying %05llx -> %05llx (%s)\n",
	(u_longlong_t)psize,
	(u_longlong_t)lsize,
	zio_compress_table[*cfuncp].\
	ci_name);
	}

	/*
	* We randomize lbuf2, and decompress to both
	* lbuf and lbuf2. This way, we will know if
	* decompression fill exactly to lsize.
	*/
	VERIFY0(random_get_pseudo_bytes(lbuf2, lsize));

	if (zio_decompress_data(*cfuncp, pabd,
	lbuf, psize, lsize, NULL) == 0 &&
	zio_decompress_data(*cfuncp, pabd,
	lbuf2, psize, lsize, NULL) == 0 &&
	bcmp(lbuf, lbuf2, lsize) == 0)
	break;
	}
	if (*cfuncp != 0)
	break;
	}
	umem_free(lbuf2, SPA_MAXBLOCKSIZE);

	if (lsize > maxlsize) {
	exceeded = B_TRUE;
	}
	buf = lbuf;
	if (*cfuncp == ZIO_COMPRESS_ZLE) {
	printf("\nZLE decompression was selected. If you "
	"suspect the results are wrong,\ntry avoiding ZLE "
	"by setting and exporting ZDB_NO_ZLE=\"true\"\n");
	}

	return (exceeded);
	}

	/*
	* Read a block from a pool and print it out. The syntax of the
	* block descriptor is:
	*
	* pool:vdev_specifier:offset:[lsize/]psize[:flags]
	*
	* pool - The name of the pool you wish to read from
	* vdev_specifier - Which vdev (see comment for zdb_vdev_lookup)
	* offset - offset, in hex, in bytes
	* size - Amount of data to read, in hex, in bytes
	* flags - A string of characters specifying options
	* b: Decode a blkptr at given offset within block
	* c: Calculate and display checksums
	* d: Decompress data before dumping
	* e: Byteswap data before dumping
	* g: Display data as a gang block header
	* i: Display as an indirect block
	* r: Dump raw data to stdout
	* v: Verbose
	*
	*/
	static void
	zdb_read_block(char thing, spa_t spa)
	{
	blkptr_t blk, *bp = &blk;
	dva_t *dva = bp->blk_dva;
	int flags = 0;
	uint64_t offset = 0, psize = 0, lsize = 0, blkptr_offset = 0;
	zio_t *zio;
	vdev_t *vd;
	abd_t *pabd;
	void lbuf, buf;
	char s, p, dup, vdev, flagstr, sizes;
	int i, error;
	boolean_t borrowed = B_FALSE, found = B_FALSE;

	dup = strdup(thing);
	s = strtok(dup, ":");
	vdev = s ? s : "";
	s = strtok(NULL, ":");
	offset = strtoull(s ? s : "", NULL, 16);
	sizes = strtok(NULL, ":");
	s = strtok(NULL, ":");
	flagstr = strdup(s ? s : "");

	s = NULL;
	if (!zdb_parse_block_sizes(sizes, &lsize, &psize))
	s = "invalid size(s)";
	if (!IS_P2ALIGNED(psize, DEV_BSIZE) \|\| !IS_P2ALIGNED(lsize, DEV_BSIZE))
	s = "size must be a multiple of sector size";
	if (!IS_P2ALIGNED(offset, DEV_BSIZE))
	s = "offset must be a multiple of sector size";
	if (s) {
	(void) printf("Invalid block specifier: %s - %s\n", thing, s);
	goto done;
	}

	for (s = strtok(flagstr, ":"); s; s = strtok(NULL, ":")) {
	for (i = 0; i < strlen(flagstr); i++) {
	int bit = flagbits[(uchar_t)flagstr[i]];

	if (bit == 0) {
	(void) printf("***Ignoring flag: %c\n",
	(uchar_t)flagstr[i]);
	continue;
	}
	found = B_TRUE;
	flags \|= bit;

	p = &flagstr[i + 1];
	if (p != ':' && p != '\0') {
	int j = 0, nextbit = flagbits[(uchar_t)*p];
	char *end, offstr[8] = { 0 };
	if ((bit == ZDB_FLAG_PRINT_BLKPTR) &&
	(nextbit == 0)) {
	/* look ahead to isolate the offset */
	while (nextbit == 0 &&
	strchr(flagbitstr, *p) == NULL) {
	offstr[j] = *p;
	j++;
	if (i + j > strlen(flagstr))
	break;
	p++;
	nextbit = flagbits[(uchar_t)*p];
	}
	blkptr_offset = strtoull(offstr, &end,
	16);
	i += j;
	} else if (nextbit == 0) {
	(void) printf("***Ignoring flag arg:"
	" '%c'\n", (uchar_t)*p);
	}
	}
	}
	}
	if (blkptr_offset % sizeof (blkptr_t)) {
	printf("Block pointer offset 0x%llx "
	"must be divisible by 0x%x\n",
	(longlong_t)blkptr_offset, (int)sizeof (blkptr_t));
	goto done;
	}
	if (found == B_FALSE && strlen(flagstr) > 0) {
	printf("Invalid flag arg: '%s'\n", flagstr);
	goto done;
	}

	vd = zdb_vdev_lookup(spa->spa_root_vdev, vdev);
	if (vd == NULL) {
	(void) printf("***Invalid vdev: %s\n", vdev);
	free(dup);
	return;
	} else {
	if (vd->vdev_path)
	(void) fprintf(stderr, "Found vdev: %s\n",
	vd->vdev_path);
	else
	(void) fprintf(stderr, "Found vdev type: %s\n",
	vd->vdev_ops->vdev_op_type);
	}

	pabd = abd_alloc_for_io(SPA_MAXBLOCKSIZE, B_FALSE);
	lbuf = umem_alloc(SPA_MAXBLOCKSIZE, UMEM_NOFAIL);

	BP_ZERO(bp);

	DVA_SET_VDEV(&dva[0], vd->vdev_id);
	DVA_SET_OFFSET(&dva[0], offset);
	DVA_SET_GANG(&dva[0], !!(flags & ZDB_FLAG_GBH));
	DVA_SET_ASIZE(&dva[0], vdev_psize_to_asize(vd, psize));

	BP_SET_BIRTH(bp, TXG_INITIAL, TXG_INITIAL);

	BP_SET_LSIZE(bp, lsize);
	BP_SET_PSIZE(bp, psize);
	BP_SET_COMPRESS(bp, ZIO_COMPRESS_OFF);
	BP_SET_CHECKSUM(bp, ZIO_CHECKSUM_OFF);
	BP_SET_TYPE(bp, DMU_OT_NONE);
	BP_SET_LEVEL(bp, 0);
	BP_SET_DEDUP(bp, 0);
	BP_SET_BYTEORDER(bp, ZFS_HOST_BYTEORDER);

	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);
	zio = zio_root(spa, NULL, NULL, 0);

	if (vd == vd->vdev_top) {
	/*
	* Treat this as a normal block read.
	*/
	zio_nowait(zio_read(zio, spa, bp, pabd, psize, NULL, NULL,
	ZIO_PRIORITY_SYNC_READ,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_RAW, NULL));
	} else {
	/*
	* Treat this as a vdev child I/O.
	*/
	zio_nowait(zio_vdev_child_io(zio, bp, vd, offset, pabd,
	psize, ZIO_TYPE_READ, ZIO_PRIORITY_SYNC_READ,
	ZIO_FLAG_DONT_CACHE \| ZIO_FLAG_DONT_PROPAGATE \|
	ZIO_FLAG_DONT_RETRY \| ZIO_FLAG_CANFAIL \| ZIO_FLAG_RAW \|
	ZIO_FLAG_OPTIONAL, NULL, NULL));
	}

	error = zio_wait(zio);
	spa_config_exit(spa, SCL_STATE, FTAG);

	if (error) {
	(void) printf("Read of %s failed, error: %d\n", thing, error);
	goto out;
	}

	uint64_t orig_lsize = lsize;
	buf = lbuf;
	if (flags & ZDB_FLAG_DECOMPRESS) {
	boolean_t failed = zdb_decompress_block(pabd, buf, lbuf,
	lsize, psize, flags);
	if (failed) {
	(void) printf("Decompress of %s failed\n", thing);
	goto out;
	}
	} else {
	buf = abd_borrow_buf_copy(pabd, lsize);
	borrowed = B_TRUE;
	}
	/*
	* Try to detect invalid block pointer. If invalid, try
	* decompressing.
	*/
	if ((flags & ZDB_FLAG_PRINT_BLKPTR \|\| flags & ZDB_FLAG_INDIRECT) &&
	!(flags & ZDB_FLAG_DECOMPRESS)) {
	const blkptr_t b = (const blkptr_t )(void *)
	((uintptr_t)buf + (uintptr_t)blkptr_offset);
	if (zfs_blkptr_verify(spa, b, B_FALSE, BLK_VERIFY_ONLY) ==
	B_FALSE) {
	abd_return_buf_copy(pabd, buf, lsize);
	borrowed = B_FALSE;
	buf = lbuf;
	boolean_t failed = zdb_decompress_block(pabd, buf,
	lbuf, lsize, psize, flags);
	b = (const blkptr_t )(void )
	((uintptr_t)buf + (uintptr_t)blkptr_offset);
	if (failed \|\| zfs_blkptr_verify(spa, b, B_FALSE,
	BLK_VERIFY_LOG) == B_FALSE) {
	printf("invalid block pointer at this DVA\n");
	goto out;
	}
	}
	}

	if (flags & ZDB_FLAG_PRINT_BLKPTR)
	zdb_print_blkptr((blkptr_t )(void )
	((uintptr_t)buf + (uintptr_t)blkptr_offset), flags);
	else if (flags & ZDB_FLAG_RAW)
	zdb_dump_block_raw(buf, lsize, flags);
	else if (flags & ZDB_FLAG_INDIRECT)
	zdb_dump_indirect((blkptr_t *)buf,
	orig_lsize / sizeof (blkptr_t), flags);
	else if (flags & ZDB_FLAG_GBH)
	zdb_dump_gbh(buf, flags);
	else
	zdb_dump_block(thing, buf, lsize, flags);

	/*
	* If :c was specified, iterate through the checksum table to
	* calculate and display each checksum for our specified
	* DVA and length.
	*/
	if ((flags & ZDB_FLAG_CHECKSUM) && !(flags & ZDB_FLAG_RAW) &&
	!(flags & ZDB_FLAG_GBH)) {
	zio_t *czio;
	(void) printf("\n");
	for (enum zio_checksum ck = ZIO_CHECKSUM_LABEL;
	ck < ZIO_CHECKSUM_FUNCTIONS; ck++) {

	if ((zio_checksum_table[ck].ci_flags &
	ZCHECKSUM_FLAG_EMBEDDED) \|\|
	ck == ZIO_CHECKSUM_NOPARITY) {
	continue;
	}
	BP_SET_CHECKSUM(bp, ck);
	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);
	czio = zio_root(spa, NULL, NULL, ZIO_FLAG_CANFAIL);
	czio->io_bp = bp;

	if (vd == vd->vdev_top) {
	zio_nowait(zio_read(czio, spa, bp, pabd, psize,
	NULL, NULL,
	ZIO_PRIORITY_SYNC_READ,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_RAW \|
	ZIO_FLAG_DONT_RETRY, NULL));
	} else {
	zio_nowait(zio_vdev_child_io(czio, bp, vd,
	offset, pabd, psize, ZIO_TYPE_READ,
	ZIO_PRIORITY_SYNC_READ,
	ZIO_FLAG_DONT_CACHE \|
	ZIO_FLAG_DONT_PROPAGATE \|
	ZIO_FLAG_DONT_RETRY \|
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_RAW \|
	ZIO_FLAG_SPECULATIVE \|
	ZIO_FLAG_OPTIONAL, NULL, NULL));
	}
	error = zio_wait(czio);
	if (error == 0 \|\| error == ECKSUM) {
	zio_t *ck_zio = zio_root(spa, NULL, NULL, 0);
	ck_zio->io_offset =
	DVA_GET_OFFSET(&bp->blk_dva[0]);
	ck_zio->io_bp = bp;
	zio_checksum_compute(ck_zio, ck, pabd, lsize);
	printf("%12s\tcksum=%llx:%llx:%llx:%llx\n",
	zio_checksum_table[ck].ci_name,
	(u_longlong_t)bp->blk_cksum.zc_word[0],
	(u_longlong_t)bp->blk_cksum.zc_word[1],
	(u_longlong_t)bp->blk_cksum.zc_word[2],
	(u_longlong_t)bp->blk_cksum.zc_word[3]);
	zio_wait(ck_zio);
	} else {
	printf("error %d reading block\n", error);
	}
	spa_config_exit(spa, SCL_STATE, FTAG);
	}
	}

	if (borrowed)
	abd_return_buf_copy(pabd, buf, lsize);

	out:
	abd_free(pabd);
	umem_free(lbuf, SPA_MAXBLOCKSIZE);
	done:
	free(flagstr);
	free(dup);
	}

	static void
	zdb_embedded_block(char *thing)
	{
	blkptr_t bp;
	unsigned long long words = (void )&bp;
	char *buf;
	int err;

	bzero(&bp, sizeof (bp));
	err = sscanf(thing, "%llx:%llx:%llx:%llx:%llx:%llx:%llx:%llx:"
	"%llx:%llx:%llx:%llx:%llx:%llx:%llx:%llx",
	words + 0, words + 1, words + 2, words + 3,
	words + 4, words + 5, words + 6, words + 7,
	words + 8, words + 9, words + 10, words + 11,
	words + 12, words + 13, words + 14, words + 15);
	if (err != 16) {
	(void) fprintf(stderr, "invalid input format\n");
	exit(1);
	}
	ASSERT3U(BPE_GET_LSIZE(&bp), <=, SPA_MAXBLOCKSIZE);
	buf = malloc(SPA_MAXBLOCKSIZE);
	if (buf == NULL) {
	(void) fprintf(stderr, "out of memory\n");
	exit(1);
	}
	err = decode_embedded_bp(&bp, buf, BPE_GET_LSIZE(&bp));
	if (err != 0) {
	(void) fprintf(stderr, "decode failed: %u\n", err);
	exit(1);
	}
	zdb_dump_block_raw(buf, BPE_GET_LSIZE(&bp), 0);
	free(buf);
	}

	int
	main(int argc, char **argv)
	{
	int c;
	struct rlimit rl = { 1024, 1024 };
	spa_t *spa = NULL;
	objset_t *os = NULL;
	int dump_all = 1;
	int verbose = 0;
	int error = 0;
	char **searchdirs = NULL;
	int nsearch = 0;
	char target, target_pool, dsname[ZFS_MAX_DATASET_NAME_LEN];
	nvlist_t *policy = NULL;
	uint64_t max_txg = UINT64_MAX;
	int64_t objset_id = -1;
	int flags = ZFS_IMPORT_MISSING_LOG;
	int rewind = ZPOOL_NEVER_REWIND;
	char spa_config_path_env, objset_str;
	boolean_t target_is_spa = B_TRUE, dataset_lookup = B_FALSE;
	nvlist_t *cfg = NULL;

	(void) setrlimit(RLIMIT_NOFILE, &rl);
	(void) enable_extended_FILE_stdio(-1, -1);

	dprintf_setup(&argc, argv);

	/*
	* If there is an environment variable SPA_CONFIG_PATH it overrides
	* default spa_config_path setting. If -U flag is specified it will
	* override this environment variable settings once again.
	*/
	spa_config_path_env = getenv("SPA_CONFIG_PATH");
	if (spa_config_path_env != NULL)
	spa_config_path = spa_config_path_env;

	/*
	* For performance reasons, we set this tunable down. We do so before
	* the arg parsing section so that the user can override this value if
	* they choose.
	*/
	zfs_btree_verify_intensity = 3;

	while ((c = getopt(argc, argv,
	"AbcCdDeEFGhiI:klLmMo:Op:PqRsSt:uU:vVx:XYyZ")) != -1) {
	switch (c) {
	case 'b':
	case 'c':
	case 'C':
	case 'd':
	case 'D':
	case 'E':
	case 'G':
	case 'h':
	case 'i':
	case 'l':
	case 'm':
	case 'M':
	case 'O':
	case 'R':
	case 's':
	case 'S':
	case 'u':
	case 'y':
	case 'Z':
	dump_opt[c]++;
	dump_all = 0;
	break;
	case 'A':
	case 'e':
	case 'F':
	case 'k':
	case 'L':
	case 'P':
	case 'q':
	case 'X':
	dump_opt[c]++;
	break;
	case 'Y':
	zfs_reconstruct_indirect_combinations_max = INT_MAX;
	zfs_deadman_enabled = 0;
	break;
	/* NB: Sort single match options below. */
	case 'I':
	max_inflight_bytes = strtoull(optarg, NULL, 0);
	if (max_inflight_bytes == 0) {
	(void) fprintf(stderr, "maximum number "
	"of inflight bytes must be greater "
	"than 0\n");
	usage();
	}
	break;
	case 'o':
	error = set_global_var(optarg);
	if (error != 0)
	usage();
	break;
	case 'p':
	if (searchdirs == NULL) {
	searchdirs = umem_alloc(sizeof (char *),
	UMEM_NOFAIL);
	} else {
	char *tmp = umem_alloc((nsearch + 1)
	sizeof (char *), UMEM_NOFAIL);
	bcopy(searchdirs, tmp, nsearch *
	sizeof (char *));
	umem_free(searchdirs,
	nsearch * sizeof (char *));
	searchdirs = tmp;
	}
	searchdirs[nsearch++] = optarg;
	break;
	case 't':
	max_txg = strtoull(optarg, NULL, 0);
	if (max_txg < TXG_INITIAL) {
	(void) fprintf(stderr, "incorrect txg "
	"specified: %s\n", optarg);
	usage();
	}
	break;
	case 'U':
	spa_config_path = optarg;
	if (spa_config_path[0] != '/') {
	(void) fprintf(stderr,
	"cachefile must be an absolute path "
	"(i.e. start with a slash)\n");
	usage();
	}
	break;
	case 'v':
	verbose++;
	break;
	case 'V':
	flags = ZFS_IMPORT_VERBATIM;
	break;
	case 'x':
	vn_dumpdir = optarg;
	break;
	default:
	usage();
	break;
	}
	}

	if (!dump_opt['e'] && searchdirs != NULL) {
	(void) fprintf(stderr, "-p option requires use of -e\n");
	usage();
	}
	if (dump_opt['d']) {
	/* <pool>[/<dataset \| objset id> is accepted */
	if (argv[2] && (objset_str = strchr(argv[2], '/')) != NULL &&
	objset_str++ != NULL) {
	char *endptr;
	errno = 0;
	objset_id = strtoull(objset_str, &endptr, 0);
	/* dataset 0 is the same as opening the pool */
	if (errno == 0 && endptr != objset_str &&
	objset_id != 0) {
	target_is_spa = B_FALSE;
	dataset_lookup = B_TRUE;
	} else if (objset_id != 0) {
	printf("failed to open objset %s "
	"%llu %s", objset_str,
	(u_longlong_t)objset_id,
	strerror(errno));
	exit(1);
	}
	/* normal dataset name not an objset ID */
	if (endptr == objset_str) {
	objset_id = -1;
	}
	}
	}

	#if defined(_LP64)
	/*
	* ZDB does not typically re-read blocks; therefore limit the ARC
	* to 256 MB, which can be used entirely for metadata.
	*/
	zfs_arc_min = zfs_arc_meta_min = 2ULL << SPA_MAXBLOCKSHIFT;
	zfs_arc_max = zfs_arc_meta_limit = 256 * 1024 * 1024;
	#endif

	/*
	* "zdb -c" uses checksum-verifying scrub i/os which are async reads.
	* "zdb -b" uses traversal prefetch which uses async reads.
	* For good performance, let several of them be active at once.
	*/
	zfs_vdev_async_read_max_active = 10;

	/*
	* Disable reference tracking for better performance.
	*/
	reference_tracking_enable = B_FALSE;

	/*
	* Do not fail spa_load when spa_load_verify fails. This is needed
	* to load non-idle pools.
	*/
	spa_load_verify_dryrun = B_TRUE;

	kernel_init(SPA_MODE_READ);

	if (dump_all)
	verbose = MAX(verbose, 1);

	for (c = 0; c < 256; c++) {
	if (dump_all && strchr("AeEFklLOPRSXy", c) == NULL)
	dump_opt[c] = 1;
	if (dump_opt[c])
	dump_opt[c] += verbose;
	}

	aok = (dump_opt['A'] == 1) \|\| (dump_opt['A'] > 2);
	zfs_recover = (dump_opt['A'] > 1);

	argc -= optind;
	argv += optind;
	if (argc < 2 && dump_opt['R'])
	usage();

	if (dump_opt['E']) {
	if (argc != 1)
	usage();
	zdb_embedded_block(argv[0]);
	return (0);
	}

	if (argc < 1) {
	if (!dump_opt['e'] && dump_opt['C']) {
	dump_cachefile(spa_config_path);
	return (0);
	}
	usage();
	}

	if (dump_opt['l'])
	return (dump_label(argv[0]));

	if (dump_opt['O']) {
	if (argc != 2)
	usage();
	dump_opt['v'] = verbose + 3;
	return (dump_path(argv[0], argv[1]));
	}

	if (dump_opt['X'] \|\| dump_opt['F'])
	rewind = ZPOOL_DO_REWIND \|
	(dump_opt['X'] ? ZPOOL_EXTREME_REWIND : 0);

	if (nvlist_alloc(&policy, NV_UNIQUE_NAME_TYPE, 0) != 0 \|\|
	nvlist_add_uint64(policy, ZPOOL_LOAD_REQUEST_TXG, max_txg) != 0 \|\|
	nvlist_add_uint32(policy, ZPOOL_LOAD_REWIND_POLICY, rewind) != 0)
	fatal("internal error: %s", strerror(ENOMEM));

	error = 0;
	target = argv[0];

	if (strpbrk(target, "/@") != NULL) {
	size_t targetlen;

	target_pool = strdup(target);
	*strpbrk(target_pool, "/@") = '\0';

	target_is_spa = B_FALSE;
	targetlen = strlen(target);
	if (targetlen && target[targetlen - 1] == '/')
	target[targetlen - 1] = '\0';
	} else {
	target_pool = target;
	}

	if (dump_opt['e']) {
	importargs_t args = { 0 };

	args.paths = nsearch;
	args.path = searchdirs;
	args.can_be_active = B_TRUE;

	error = zpool_find_config(NULL, target_pool, &cfg, &args,
	&libzpool_config_ops);

	if (error == 0) {

	if (nvlist_add_nvlist(cfg,
	ZPOOL_LOAD_POLICY, policy) != 0) {
	fatal("can't open '%s': %s",
	target, strerror(ENOMEM));
	}

	if (dump_opt['C'] > 1) {
	(void) printf("\nConfiguration for import:\n");
	dump_nvlist(cfg, 8);
	}

	/*
	* Disable the activity check to allow examination of
	* active pools.
	*/
	error = spa_import(target_pool, cfg, NULL,
	flags \| ZFS_IMPORT_SKIP_MMP);
	}
	}

	/*
	* import_checkpointed_state makes the assumption that the
	* target pool that we pass it is already part of the spa
	* namespace. Because of that we need to make sure to call
	* it always after the -e option has been processed, which
	* imports the pool to the namespace if it's not in the
	* cachefile.
	*/
	char *checkpoint_pool = NULL;
	char *checkpoint_target = NULL;
	if (dump_opt['k']) {
	checkpoint_pool = import_checkpointed_state(target, cfg,
	&checkpoint_target);

	if (checkpoint_target != NULL)
	target = checkpoint_target;
	}

	if (target_pool != target)
	free(target_pool);

	if (error == 0) {
	if (dump_opt['k'] && (target_is_spa \|\| dump_opt['R'])) {
	ASSERT(checkpoint_pool != NULL);
	ASSERT(checkpoint_target == NULL);

	error = spa_open(checkpoint_pool, &spa, FTAG);
	if (error != 0) {
	fatal("Tried to open pool \"%s\" but "
	"spa_open() failed with error %d\n",
	checkpoint_pool, error);
	}

	} else if (target_is_spa \|\| dump_opt['R'] \|\| objset_id == 0) {
	zdb_set_skip_mmp(target);
	error = spa_open_rewind(target, &spa, FTAG, policy,
	NULL);
	if (error) {
	/*
	* If we're missing the log device then
	* try opening the pool after clearing the
	* log state.
	*/
	mutex_enter(&spa_namespace_lock);
	if ((spa = spa_lookup(target)) != NULL &&
	spa->spa_log_state == SPA_LOG_MISSING) {
	spa->spa_log_state = SPA_LOG_CLEAR;
	error = 0;
	}
	mutex_exit(&spa_namespace_lock);

	if (!error) {
	error = spa_open_rewind(target, &spa,
	FTAG, policy, NULL);
	}
	}
	} else if (strpbrk(target, "#") != NULL) {
	dsl_pool_t *dp;
	error = dsl_pool_hold(target, FTAG, &dp);
	if (error != 0) {
	fatal("can't dump '%s': %s", target,
	strerror(error));
	}
	error = dump_bookmark(dp, target, B_TRUE, verbose > 1);
	dsl_pool_rele(dp, FTAG);
	if (error != 0) {
	fatal("can't dump '%s': %s", target,
	strerror(error));
	}
	return (error);
	} else {
	zdb_set_skip_mmp(target);
	if (dataset_lookup == B_TRUE) {
	/*
	* Use the supplied id to get the name
	* for open_objset.
	*/
	error = spa_open(target, &spa, FTAG);
	if (error == 0) {
	error = name_from_objset_id(spa,
	objset_id, dsname);
	spa_close(spa, FTAG);
	if (error == 0)
	target = dsname;
	}
	}
	if (error == 0)
	error = open_objset(target, FTAG, &os);
	if (error == 0)
	spa = dmu_objset_spa(os);
	}
	}
	nvlist_free(policy);

	if (error)
	fatal("can't open '%s': %s", target, strerror(error));

	/*
	* Set the pool failure mode to panic in order to prevent the pool
	* from suspending. A suspended I/O will have no way to resume and
	* can prevent the zdb(8) command from terminating as expected.
	*/
	if (spa != NULL)
	spa->spa_failmode = ZIO_FAILURE_MODE_PANIC;

	argv++;
	argc--;
	if (!dump_opt['R']) {
	flagbits['d'] = ZOR_FLAG_DIRECTORY;
	flagbits['f'] = ZOR_FLAG_PLAIN_FILE;
	flagbits['m'] = ZOR_FLAG_SPACE_MAP;
	flagbits['z'] = ZOR_FLAG_ZAP;
	flagbits['A'] = ZOR_FLAG_ALL_TYPES;

	if (argc > 0 && dump_opt['d']) {
	zopt_object_args = argc;
	zopt_object_ranges = calloc(zopt_object_args,
	sizeof (zopt_object_range_t));
	for (unsigned i = 0; i < zopt_object_args; i++) {
	int err;
	char *msg = NULL;

	err = parse_object_range(argv[i],
	&zopt_object_ranges[i], &msg);
	if (err != 0)
	fatal("Bad object or range: '%s': %s\n",
	argv[i], msg ? msg : "");
	}
	} else if (argc > 0 && dump_opt['m']) {
	zopt_metaslab_args = argc;
	zopt_metaslab = calloc(zopt_metaslab_args,
	sizeof (uint64_t));
	for (unsigned i = 0; i < zopt_metaslab_args; i++) {
	errno = 0;
	zopt_metaslab[i] = strtoull(argv[i], NULL, 0);
	if (zopt_metaslab[i] == 0 && errno != 0)
	fatal("bad number %s: %s", argv[i],
	strerror(errno));
	}
	}
	if (os != NULL) {
	dump_objset(os);
	} else if (zopt_object_args > 0 && !dump_opt['m']) {
	dump_objset(spa->spa_meta_objset);
	} else {
	dump_zpool(spa);
	}
	} else {
	flagbits['b'] = ZDB_FLAG_PRINT_BLKPTR;
	flagbits['c'] = ZDB_FLAG_CHECKSUM;
	flagbits['d'] = ZDB_FLAG_DECOMPRESS;
	flagbits['e'] = ZDB_FLAG_BSWAP;
	flagbits['g'] = ZDB_FLAG_GBH;
	flagbits['i'] = ZDB_FLAG_INDIRECT;
	flagbits['r'] = ZDB_FLAG_RAW;
	flagbits['v'] = ZDB_FLAG_VERBOSE;

	for (int i = 0; i < argc; i++)
	zdb_read_block(argv[i], spa);
	}

	if (dump_opt['k']) {
	free(checkpoint_pool);
	if (!target_is_spa)
	free(checkpoint_target);
	}

	if (os != NULL) {
	close_objset(os, FTAG);
	} else {
	spa_close(spa, FTAG);
	}

	fuid_table_destroy();

	dump_debug_buffer();

	kernel_fini();

	return (error);
	}
	Index: vendor-sys/openzfs/dist/cmd/zfs/zfs_main.c
	===================================================================
	--- vendor-sys/openzfs/dist/cmd/zfs/zfs_main.c (revision 365891)
	+++ vendor-sys/openzfs/dist/cmd/zfs/zfs_main.c (revision 365892)
	@@ -1,8637 +1,8638 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright 2012 Milan Jurik. All rights reserved.
	* Copyright (c) 2012, Joyent, Inc. All rights reserved.
	* Copyright (c) 2013 Steven Hartland. All rights reserved.
	* Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>.
	* Copyright 2016 Nexenta Systems, Inc.
	* Copyright (c) 2019 Datto Inc.
	* Copyright (c) 2019, loli10K <ezomori.nozomu@gmail.com>
	* Copyright 2019 Joyent, Inc.
	* Copyright (c) 2019, 2020 by Christian Schwarz. All rights reserved.
	*/

	#include <assert.h>
	#include <ctype.h>
	#include <sys/debug.h>
	#include <errno.h>
	#include <getopt.h>
	#include <libgen.h>
	#include <libintl.h>
	#include <libuutil.h>
	#include <libnvpair.h>
	#include <locale.h>
	#include <stddef.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <strings.h>
	#include <unistd.h>
	#include <fcntl.h>
	#include <zone.h>
	#include <grp.h>
	#include <pwd.h>
	#include <signal.h>
	#include <sys/debug.h>
	#include <sys/list.h>
	#include <sys/mkdev.h>
	#include <sys/mntent.h>
	#include <sys/mnttab.h>
	#include <sys/mount.h>
	#include <sys/stat.h>
	#include <sys/fs/zfs.h>
	#include <sys/systeminfo.h>
	#include <sys/types.h>
	#include <time.h>
	#include <sys/zfs_project.h>

	#include <libzfs.h>
	#include <libzfs_core.h>
	#include <zfs_prop.h>
	#include <zfs_deleg.h>
	#include <libzutil.h>
	#include <libuutil.h>
	#ifdef HAVE_IDMAP
	#include <aclutils.h>
	#include <directory.h>
	#endif /* HAVE_IDMAP */

	#include "zfs_iter.h"
	#include "zfs_util.h"
	#include "zfs_comutil.h"
	#include "libzfs_impl.h"
	#include "zfs_projectutil.h"

	libzfs_handle_t *g_zfs;

	static FILE *mnttab_file;
	static char history_str[HIS_MAX_RECORD_LEN];
	static boolean_t log_history = B_TRUE;

	static int zfs_do_clone(int argc, char **argv);
	static int zfs_do_create(int argc, char **argv);
	static int zfs_do_destroy(int argc, char **argv);
	static int zfs_do_get(int argc, char **argv);
	static int zfs_do_inherit(int argc, char **argv);
	static int zfs_do_list(int argc, char **argv);
	static int zfs_do_mount(int argc, char **argv);
	static int zfs_do_rename(int argc, char **argv);
	static int zfs_do_rollback(int argc, char **argv);
	static int zfs_do_set(int argc, char **argv);
	static int zfs_do_upgrade(int argc, char **argv);
	static int zfs_do_snapshot(int argc, char **argv);
	static int zfs_do_unmount(int argc, char **argv);
	static int zfs_do_share(int argc, char **argv);
	static int zfs_do_unshare(int argc, char **argv);
	static int zfs_do_send(int argc, char **argv);
	static int zfs_do_receive(int argc, char **argv);
	static int zfs_do_promote(int argc, char **argv);
	static int zfs_do_userspace(int argc, char **argv);
	static int zfs_do_allow(int argc, char **argv);
	static int zfs_do_unallow(int argc, char **argv);
	static int zfs_do_hold(int argc, char **argv);
	static int zfs_do_holds(int argc, char **argv);
	static int zfs_do_release(int argc, char **argv);
	static int zfs_do_diff(int argc, char **argv);
	static int zfs_do_bookmark(int argc, char **argv);
	static int zfs_do_channel_program(int argc, char **argv);
	static int zfs_do_load_key(int argc, char **argv);
	static int zfs_do_unload_key(int argc, char **argv);
	static int zfs_do_change_key(int argc, char **argv);
	static int zfs_do_project(int argc, char **argv);
	static int zfs_do_version(int argc, char **argv);
	static int zfs_do_redact(int argc, char **argv);
	static int zfs_do_wait(int argc, char **argv);

	#ifdef __FreeBSD__
	static int zfs_do_jail(int argc, char **argv);
	static int zfs_do_unjail(int argc, char **argv);
	#endif

	/*
	* Enable a reasonable set of defaults for libumem debugging on DEBUG builds.
	*/

	#ifdef DEBUG
	const char *
	_umem_debug_init(void)
	{
	return ("default,verbose"); /* $UMEM_DEBUG setting */
	}

	const char *
	_umem_logging_init(void)
	{
	return ("fail,contents"); /* $UMEM_LOGGING setting */
	}
	#endif

	typedef enum {
	HELP_CLONE,
	HELP_CREATE,
	HELP_DESTROY,
	HELP_GET,
	HELP_INHERIT,
	HELP_UPGRADE,
	HELP_LIST,
	HELP_MOUNT,
	HELP_PROMOTE,
	HELP_RECEIVE,
	HELP_RENAME,
	HELP_ROLLBACK,
	HELP_SEND,
	HELP_SET,
	HELP_SHARE,
	HELP_SNAPSHOT,
	HELP_UNMOUNT,
	HELP_UNSHARE,
	HELP_ALLOW,
	HELP_UNALLOW,
	HELP_USERSPACE,
	HELP_GROUPSPACE,
	HELP_PROJECTSPACE,
	HELP_PROJECT,
	HELP_HOLD,
	HELP_HOLDS,
	HELP_RELEASE,
	HELP_DIFF,
	HELP_BOOKMARK,
	HELP_CHANNEL_PROGRAM,
	HELP_LOAD_KEY,
	HELP_UNLOAD_KEY,
	HELP_CHANGE_KEY,
	HELP_VERSION,
	HELP_REDACT,
	HELP_JAIL,
	HELP_UNJAIL,
	HELP_WAIT,
	} zfs_help_t;

	typedef struct zfs_command {
	const char *name;
	int (func)(int argc, char *argv);
	zfs_help_t usage;
	} zfs_command_t;

	/*
	* Master command table. Each ZFS command has a name, associated function, and
	* usage message. The usage messages need to be internationalized, so we have
	* to have a function to return the usage message based on a command index.
	*
	* These commands are organized according to how they are displayed in the usage
	* message. An empty command (one with a NULL name) indicates an empty line in
	* the generic usage message.
	*/
	static zfs_command_t command_table[] = {
	{ "version", zfs_do_version, HELP_VERSION },
	{ NULL },
	{ "create", zfs_do_create, HELP_CREATE },
	{ "destroy", zfs_do_destroy, HELP_DESTROY },
	{ NULL },
	{ "snapshot", zfs_do_snapshot, HELP_SNAPSHOT },
	{ "rollback", zfs_do_rollback, HELP_ROLLBACK },
	{ "clone", zfs_do_clone, HELP_CLONE },
	{ "promote", zfs_do_promote, HELP_PROMOTE },
	{ "rename", zfs_do_rename, HELP_RENAME },
	{ "bookmark", zfs_do_bookmark, HELP_BOOKMARK },
	{ "program", zfs_do_channel_program, HELP_CHANNEL_PROGRAM },
	{ NULL },
	{ "list", zfs_do_list, HELP_LIST },
	{ NULL },
	{ "set", zfs_do_set, HELP_SET },
	{ "get", zfs_do_get, HELP_GET },
	{ "inherit", zfs_do_inherit, HELP_INHERIT },
	{ "upgrade", zfs_do_upgrade, HELP_UPGRADE },
	{ NULL },
	{ "userspace", zfs_do_userspace, HELP_USERSPACE },
	{ "groupspace", zfs_do_userspace, HELP_GROUPSPACE },
	{ "projectspace", zfs_do_userspace, HELP_PROJECTSPACE },
	{ NULL },
	{ "project", zfs_do_project, HELP_PROJECT },
	{ NULL },
	{ "mount", zfs_do_mount, HELP_MOUNT },
	{ "unmount", zfs_do_unmount, HELP_UNMOUNT },
	{ "share", zfs_do_share, HELP_SHARE },
	{ "unshare", zfs_do_unshare, HELP_UNSHARE },
	{ NULL },
	{ "send", zfs_do_send, HELP_SEND },
	{ "receive", zfs_do_receive, HELP_RECEIVE },
	{ NULL },
	{ "allow", zfs_do_allow, HELP_ALLOW },
	{ NULL },
	{ "unallow", zfs_do_unallow, HELP_UNALLOW },
	{ NULL },
	{ "hold", zfs_do_hold, HELP_HOLD },
	{ "holds", zfs_do_holds, HELP_HOLDS },
	{ "release", zfs_do_release, HELP_RELEASE },
	{ "diff", zfs_do_diff, HELP_DIFF },
	{ "load-key", zfs_do_load_key, HELP_LOAD_KEY },
	{ "unload-key", zfs_do_unload_key, HELP_UNLOAD_KEY },
	{ "change-key", zfs_do_change_key, HELP_CHANGE_KEY },
	{ "redact", zfs_do_redact, HELP_REDACT },
	{ "wait", zfs_do_wait, HELP_WAIT },

	#ifdef __FreeBSD__
	{ "jail", zfs_do_jail, HELP_JAIL },
	{ "unjail", zfs_do_unjail, HELP_UNJAIL },
	#endif
	};

	#define NCOMMAND (sizeof (command_table) / sizeof (command_table[0]))

	zfs_command_t *current_command;

	static const char *
	get_usage(zfs_help_t idx)
	{
	switch (idx) {
	case HELP_CLONE:
	return (gettext("\tclone [-p] [-o property=value] ... "
	"<snapshot> <filesystem\|volume>\n"));
	case HELP_CREATE:
	return (gettext("\tcreate [-Pnpv] [-o property=value] ... "
	"<filesystem>\n"
	"\tcreate [-Pnpsv] [-b blocksize] [-o property=value] ... "
	"-V <size> <volume>\n"));
	case HELP_DESTROY:
	return (gettext("\tdestroy [-fnpRrv] <filesystem\|volume>\n"
	"\tdestroy [-dnpRrv] "
	"<filesystem\|volume>@<snap>[%<snap>][,...]\n"
	"\tdestroy <filesystem\|volume>#<bookmark>\n"));
	case HELP_GET:
	return (gettext("\tget [-rHp] [-d max] "
	"[-o \"all\" \| field[,...]]\n"
	"\t [-t type[,...]] [-s source[,...]]\n"
	"\t <\"all\" \| property[,...]> "
	"[filesystem\|volume\|snapshot\|bookmark] ...\n"));
	case HELP_INHERIT:
	return (gettext("\tinherit [-rS] <property> "
	"<filesystem\|volume\|snapshot> ...\n"));
	case HELP_UPGRADE:
	return (gettext("\tupgrade [-v]\n"
	"\tupgrade [-r] [-V version] <-a \| filesystem ...>\n"));
	case HELP_LIST:
	return (gettext("\tlist [-Hp] [-r\|-d max] [-o property[,...]] "
	"[-s property]...\n\t [-S property]... [-t type[,...]] "
	"[filesystem\|volume\|snapshot] ...\n"));
	case HELP_MOUNT:
	return (gettext("\tmount\n"
	"\tmount [-flvO] [-o opts] <-a \| filesystem>\n"));
	case HELP_PROMOTE:
	return (gettext("\tpromote <clone-filesystem>\n"));
	case HELP_RECEIVE:
	return (gettext("\treceive [-vMnsFhu] "
	"[-o <property>=<value>] ... [-x <property>] ...\n"
	"\t <filesystem\|volume\|snapshot>\n"
	"\treceive [-vMnsFhu] [-o <property>=<value>] ... "
	"[-x <property>] ... \n"
	"\t [-d \| -e] <filesystem>\n"
	"\treceive -A <filesystem\|volume>\n"));
	case HELP_RENAME:
	return (gettext("\trename [-f] <filesystem\|volume\|snapshot> "
	"<filesystem\|volume\|snapshot>\n"
	"\trename -p [-f] <filesystem\|volume> <filesystem\|volume>\n"
	"\trename -u [-f] <filesystem> <filesystem>\n"
	"\trename -r <snapshot> <snapshot>\n"));
	case HELP_ROLLBACK:
	return (gettext("\trollback [-rRf] <snapshot>\n"));
	case HELP_SEND:
	return (gettext("\tsend [-DnPpRvLecwhb] [-[i\|I] snapshot] "
	"<snapshot>\n"
	"\tsend [-nvPLecw] [-i snapshot\|bookmark] "
	"<filesystem\|volume\|snapshot>\n"
	"\tsend [-DnPpvLec] [-i bookmark\|snapshot] "
	"--redact <bookmark> <snapshot>\n"
	"\tsend [-nvPe] -t <receive_resume_token>\n"
	"\tsend [-Pnv] --saved filesystem\n"));
	case HELP_SET:
	return (gettext("\tset <property=value> ... "
	"<filesystem\|volume\|snapshot> ...\n"));
	case HELP_SHARE:
	return (gettext("\tshare [-l] <-a [nfs\|smb] \| filesystem>\n"));
	case HELP_SNAPSHOT:
	return (gettext("\tsnapshot [-r] [-o property=value] ... "
	"<filesystem\|volume>@<snap> ...\n"));
	case HELP_UNMOUNT:
	return (gettext("\tunmount [-fu] "
	"<-a \| filesystem\|mountpoint>\n"));
	case HELP_UNSHARE:
	return (gettext("\tunshare "
	"<-a [nfs\|smb] \| filesystem\|mountpoint>\n"));
	case HELP_ALLOW:
	return (gettext("\tallow <filesystem\|volume>\n"
	"\tallow [-ldug] "
	"<\"everyone\"\|user\|group>[,...] <perm\|@setname>[,...]\n"
	"\t <filesystem\|volume>\n"
	"\tallow [-ld] -e <perm\|@setname>[,...] "
	"<filesystem\|volume>\n"
	"\tallow -c <perm\|@setname>[,...] <filesystem\|volume>\n"
	"\tallow -s @setname <perm\|@setname>[,...] "
	"<filesystem\|volume>\n"));
	case HELP_UNALLOW:
	return (gettext("\tunallow [-rldug] "
	"<\"everyone\"\|user\|group>[,...]\n"
	"\t [<perm\|@setname>[,...]] <filesystem\|volume>\n"
	"\tunallow [-rld] -e [<perm\|@setname>[,...]] "
	"<filesystem\|volume>\n"
	"\tunallow [-r] -c [<perm\|@setname>[,...]] "
	"<filesystem\|volume>\n"
	"\tunallow [-r] -s @setname [<perm\|@setname>[,...]] "
	"<filesystem\|volume>\n"));
	case HELP_USERSPACE:
	return (gettext("\tuserspace [-Hinp] [-o field[,...]] "
	"[-s field] ...\n"
	"\t [-S field] ... [-t type[,...]] "
	"<filesystem\|snapshot>\n"));
	case HELP_GROUPSPACE:
	return (gettext("\tgroupspace [-Hinp] [-o field[,...]] "
	"[-s field] ...\n"
	"\t [-S field] ... [-t type[,...]] "
	"<filesystem\|snapshot>\n"));
	case HELP_PROJECTSPACE:
	return (gettext("\tprojectspace [-Hp] [-o field[,...]] "
	"[-s field] ... \n"
	"\t [-S field] ... <filesystem\|snapshot>\n"));
	case HELP_PROJECT:
	return (gettext("\tproject [-d\|-r] <directory\|file ...>\n"
	"\tproject -c [-0] [-d\|-r] [-p id] <directory\|file ...>\n"
	"\tproject -C [-k] [-r] <directory ...>\n"
	"\tproject [-p id] [-r] [-s] <directory ...>\n"));
	case HELP_HOLD:
	return (gettext("\thold [-r] <tag> <snapshot> ...\n"));
	case HELP_HOLDS:
	return (gettext("\tholds [-rH] <snapshot> ...\n"));
	case HELP_RELEASE:
	return (gettext("\trelease [-r] <tag> <snapshot> ...\n"));
	case HELP_DIFF:
	return (gettext("\tdiff [-FHt] <snapshot> "
	"[snapshot\|filesystem]\n"));
	case HELP_BOOKMARK:
	return (gettext("\tbookmark <snapshot\|bookmark> "
	"<newbookmark>\n"));
	case HELP_CHANNEL_PROGRAM:
	return (gettext("\tprogram [-jn] [-t <instruction limit>] "
	"[-m <memory limit (b)>]\n"
	"\t <pool> <program file> [lua args...]\n"));
	case HELP_LOAD_KEY:
	return (gettext("\tload-key [-rn] [-L <keylocation>] "
	"<-a \| filesystem\|volume>\n"));
	case HELP_UNLOAD_KEY:
	return (gettext("\tunload-key [-r] "
	"<-a \| filesystem\|volume>\n"));
	case HELP_CHANGE_KEY:
	return (gettext("\tchange-key [-l] [-o keyformat=<value>]\n"
	"\t [-o keylocation=<value>] [-o pbkdf2iters=<value>]\n"
	"\t <filesystem\|volume>\n"
	"\tchange-key -i [-l] <filesystem\|volume>\n"));
	case HELP_VERSION:
	return (gettext("\tversion\n"));
	case HELP_REDACT:
	return (gettext("\tredact <snapshot> <bookmark> "
	"<redaction_snapshot> ...\n"));
	case HELP_JAIL:
	return (gettext("\tjail <jailid\|jailname> <filesystem>\n"));
	case HELP_UNJAIL:
	return (gettext("\tunjail <jailid\|jailname> <filesystem>\n"));
	case HELP_WAIT:
	return (gettext("\twait [-t <activity>] <filesystem>\n"));
	}

	abort();
	/* NOTREACHED */
	}

	void
	nomem(void)
	{
	(void) fprintf(stderr, gettext("internal error: out of memory\n"));
	exit(1);
	}

	/*
	* Utility function to guarantee malloc() success.
	*/

	void *
	safe_malloc(size_t size)
	{
	void *data;

	if ((data = calloc(1, size)) == NULL)
	nomem();

	return (data);
	}

	static void *
	safe_realloc(void *data, size_t size)
	{
	void *newp;
	if ((newp = realloc(data, size)) == NULL) {
	free(data);
	nomem();
	}

	return (newp);
	}

	static char *
	safe_strdup(char *str)
	{
	char *dupstr = strdup(str);

	if (dupstr == NULL)
	nomem();

	return (dupstr);
	}

	/*
	* Callback routine that will print out information for each of
	* the properties.
	*/
	static int
	usage_prop_cb(int prop, void *cb)
	{
	FILE *fp = cb;

	(void) fprintf(fp, "\t%-15s ", zfs_prop_to_name(prop));

	if (zfs_prop_readonly(prop))
	(void) fprintf(fp, " NO ");
	else
	(void) fprintf(fp, "YES ");

	if (zfs_prop_inheritable(prop))
	(void) fprintf(fp, " YES ");
	else
	(void) fprintf(fp, " NO ");

	if (zfs_prop_values(prop) == NULL)
	(void) fprintf(fp, "-\n");
	else
	(void) fprintf(fp, "%s\n", zfs_prop_values(prop));

	return (ZPROP_CONT);
	}

	/*
	* Display usage message. If we're inside a command, display only the usage for
	* that command. Otherwise, iterate over the entire command table and display
	* a complete usage message.
	*/
	static void
	usage(boolean_t requested)
	{
	int i;
	boolean_t show_properties = B_FALSE;
	FILE *fp = requested ? stdout : stderr;

	if (current_command == NULL) {

	(void) fprintf(fp, gettext("usage: zfs command args ...\n"));
	(void) fprintf(fp,
	gettext("where 'command' is one of the following:\n\n"));

	for (i = 0; i < NCOMMAND; i++) {
	if (command_table[i].name == NULL)
	(void) fprintf(fp, "\n");
	else
	(void) fprintf(fp, "%s",
	get_usage(command_table[i].usage));
	}

	(void) fprintf(fp, gettext("\nEach dataset is of the form: "
	"pool/[dataset/]*dataset[@name]\n"));
	} else {
	(void) fprintf(fp, gettext("usage:\n"));
	(void) fprintf(fp, "%s", get_usage(current_command->usage));
	}

	if (current_command != NULL &&
	(strcmp(current_command->name, "set") == 0 \|\|
	strcmp(current_command->name, "get") == 0 \|\|
	strcmp(current_command->name, "inherit") == 0 \|\|
	strcmp(current_command->name, "list") == 0))
	show_properties = B_TRUE;

	if (show_properties) {
	(void) fprintf(fp,
	gettext("\nThe following properties are supported:\n"));

	(void) fprintf(fp, "\n\t%-14s %s %s %s\n\n",
	"PROPERTY", "EDIT", "INHERIT", "VALUES");

	/* Iterate over all properties */
	(void) zprop_iter(usage_prop_cb, fp, B_FALSE, B_TRUE,
	ZFS_TYPE_DATASET);

	(void) fprintf(fp, "\t%-15s ", "userused@...");
	(void) fprintf(fp, " NO NO <size>\n");
	(void) fprintf(fp, "\t%-15s ", "groupused@...");
	(void) fprintf(fp, " NO NO <size>\n");
	(void) fprintf(fp, "\t%-15s ", "projectused@...");
	(void) fprintf(fp, " NO NO <size>\n");
	(void) fprintf(fp, "\t%-15s ", "userobjused@...");
	(void) fprintf(fp, " NO NO <size>\n");
	(void) fprintf(fp, "\t%-15s ", "groupobjused@...");
	(void) fprintf(fp, " NO NO <size>\n");
	(void) fprintf(fp, "\t%-15s ", "projectobjused@...");
	(void) fprintf(fp, " NO NO <size>\n");
	(void) fprintf(fp, "\t%-15s ", "userquota@...");
	(void) fprintf(fp, "YES NO <size> \| none\n");
	(void) fprintf(fp, "\t%-15s ", "groupquota@...");
	(void) fprintf(fp, "YES NO <size> \| none\n");
	(void) fprintf(fp, "\t%-15s ", "projectquota@...");
	(void) fprintf(fp, "YES NO <size> \| none\n");
	(void) fprintf(fp, "\t%-15s ", "userobjquota@...");
	(void) fprintf(fp, "YES NO <size> \| none\n");
	(void) fprintf(fp, "\t%-15s ", "groupobjquota@...");
	(void) fprintf(fp, "YES NO <size> \| none\n");
	(void) fprintf(fp, "\t%-15s ", "projectobjquota@...");
	(void) fprintf(fp, "YES NO <size> \| none\n");
	(void) fprintf(fp, "\t%-15s ", "written@<snap>");
	(void) fprintf(fp, " NO NO <size>\n");
	(void) fprintf(fp, "\t%-15s ", "written#<bookmark>");
	(void) fprintf(fp, " NO NO <size>\n");

	(void) fprintf(fp, gettext("\nSizes are specified in bytes "
	"with standard units such as K, M, G, etc.\n"));
	(void) fprintf(fp, gettext("\nUser-defined properties can "
	"be specified by using a name containing a colon (:).\n"));
	(void) fprintf(fp, gettext("\nThe {user\|group\|project}"
	"[obj]{used\|quota}@ properties must be appended with\n"
	"a user\|group\|project specifier of one of these forms:\n"
	" POSIX name (eg: \"matt\")\n"
	" POSIX id (eg: \"126829\")\n"
	" SMB name@domain (eg: \"matt@sun\")\n"
	" SMB SID (eg: \"S-1-234-567-89\")\n"));
	} else {
	(void) fprintf(fp,
	gettext("\nFor the property list, run: %s\n"),
	"zfs set\|get");
	(void) fprintf(fp,
	gettext("\nFor the delegated permission list, run: %s\n"),
	"zfs allow\|unallow");
	}

	/*
	* See comments at end of main().
	*/
	if (getenv("ZFS_ABORT") != NULL) {
	(void) printf("dumping core by request\n");
	abort();
	}

	exit(requested ? 0 : 2);
	}

	/*
	* Take a property=value argument string and add it to the given nvlist.
	* Modifies the argument inplace.
	*/
	static boolean_t
	parseprop(nvlist_t props, char propname)
	{
	char *propval;

	if ((propval = strchr(propname, '=')) == NULL) {
	(void) fprintf(stderr, gettext("missing "
	"'=' for property=value argument\n"));
	return (B_FALSE);
	}
	*propval = '\0';
	propval++;
	if (nvlist_exists(props, propname)) {
	(void) fprintf(stderr, gettext("property '%s' "
	"specified multiple times\n"), propname);
	return (B_FALSE);
	}
	if (nvlist_add_string(props, propname, propval) != 0)
	nomem();
	return (B_TRUE);
	}

	/*
	* Take a property name argument and add it to the given nvlist.
	* Modifies the argument inplace.
	*/
	static boolean_t
	parsepropname(nvlist_t props, char propname)
	{
	if (strchr(propname, '=') != NULL) {
	(void) fprintf(stderr, gettext("invalid character "
	"'=' in property argument\n"));
	return (B_FALSE);
	}
	if (nvlist_exists(props, propname)) {
	(void) fprintf(stderr, gettext("property '%s' "
	"specified multiple times\n"), propname);
	return (B_FALSE);
	}
	if (nvlist_add_boolean(props, propname) != 0)
	nomem();
	return (B_TRUE);
	}

	static int
	parse_depth(char opt, int flags)
	{
	char *tmp;
	int depth;

	depth = (int)strtol(opt, &tmp, 0);
	if (*tmp) {
	(void) fprintf(stderr,
	gettext("%s is not an integer\n"), optarg);
	usage(B_FALSE);
	}
	if (depth < 0) {
	(void) fprintf(stderr,
	gettext("Depth can not be negative.\n"));
	usage(B_FALSE);
	}
	*flags \|= (ZFS_ITER_DEPTH_LIMIT\|ZFS_ITER_RECURSE);
	return (depth);
	}

	#define PROGRESS_DELAY 2 /* seconds */

	static char *pt_reverse = "\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b";
	static time_t pt_begin;
	static char *pt_header = NULL;
	static boolean_t pt_shown;

	static void
	start_progress_timer(void)
	{
	pt_begin = time(NULL) + PROGRESS_DELAY;
	pt_shown = B_FALSE;
	}

	static void
	set_progress_header(char *header)
	{
	assert(pt_header == NULL);
	pt_header = safe_strdup(header);
	if (pt_shown) {
	(void) printf("%s: ", header);
	(void) fflush(stdout);
	}
	}

	static void
	update_progress(char *update)
	{
	if (!pt_shown && time(NULL) > pt_begin) {
	int len = strlen(update);

	(void) printf("%s: %s%.s", pt_header, update, len, len,
	pt_reverse);
	(void) fflush(stdout);
	pt_shown = B_TRUE;
	} else if (pt_shown) {
	int len = strlen(update);

	(void) printf("%s%.s", update, len, len, pt_reverse);
	(void) fflush(stdout);
	}
	}

	static void
	finish_progress(char *done)
	{
	if (pt_shown) {
	(void) printf("%s\n", done);
	(void) fflush(stdout);
	}
	free(pt_header);
	pt_header = NULL;
	}

	static int
	zfs_mount_and_share(libzfs_handle_t hdl, const char dataset, zfs_type_t type)
	{
	zfs_handle_t *zhp = NULL;
	int ret = 0;

	zhp = zfs_open(hdl, dataset, type);
	if (zhp == NULL)
	return (1);

	/*
	* Volumes may neither be mounted or shared. Potentially in the
	* future filesystems detected on these volumes could be mounted.
	*/
	if (zfs_get_type(zhp) == ZFS_TYPE_VOLUME) {
	zfs_close(zhp);
	return (0);
	}

	/*
	* Mount and/or share the new filesystem as appropriate. We provide a
	* verbose error message to let the user know that their filesystem was
	* in fact created, even if we failed to mount or share it.
	*
	* If the user doesn't want the dataset automatically mounted, then
	* skip the mount/share step
	*/
	if (zfs_prop_valid_for_type(ZFS_PROP_CANMOUNT, type, B_FALSE) &&
	zfs_prop_get_int(zhp, ZFS_PROP_CANMOUNT) == ZFS_CANMOUNT_ON) {
	if (zfs_mount_delegation_check()) {
	(void) fprintf(stderr, gettext("filesystem "
	"successfully created, but it may only be "
	"mounted by root\n"));
	ret = 1;
	} else if (zfs_mount(zhp, NULL, 0) != 0) {
	(void) fprintf(stderr, gettext("filesystem "
	"successfully created, but not mounted\n"));
	ret = 1;
	} else if (zfs_share(zhp) != 0) {
	(void) fprintf(stderr, gettext("filesystem "
	"successfully created, but not shared\n"));
	ret = 1;
	}
	zfs_commit_all_shares();
	}

	zfs_close(zhp);

	return (ret);
	}

	/*
	* zfs clone [-p] [-o prop=value] ... <snap> <fs \| vol>
	*
	* Given an existing dataset, create a writable copy whose initial contents
	* are the same as the source. The newly created dataset maintains a
	* dependency on the original; the original cannot be destroyed so long as
	* the clone exists.
	*
	* The '-p' flag creates all the non-existing ancestors of the target first.
	*/
	static int
	zfs_do_clone(int argc, char **argv)
	{
	zfs_handle_t *zhp = NULL;
	boolean_t parents = B_FALSE;
	nvlist_t *props;
	int ret = 0;
	int c;

	if (nvlist_alloc(&props, NV_UNIQUE_NAME, 0) != 0)
	nomem();

	/* check options */
	while ((c = getopt(argc, argv, "o:p")) != -1) {
	switch (c) {
	case 'o':
	if (!parseprop(props, optarg)) {
	nvlist_free(props);
	return (1);
	}
	break;
	case 'p':
	parents = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	goto usage;
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing source dataset "
	"argument\n"));
	goto usage;
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing target dataset "
	"argument\n"));
	goto usage;
	}
	if (argc > 2) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	goto usage;
	}

	/* open the source dataset */
	if ((zhp = zfs_open(g_zfs, argv[0], ZFS_TYPE_SNAPSHOT)) == NULL) {
	nvlist_free(props);
	return (1);
	}

	if (parents && zfs_name_valid(argv[1], ZFS_TYPE_FILESYSTEM \|
	ZFS_TYPE_VOLUME)) {
	/*
	* Now create the ancestors of the target dataset. If the
	* target already exists and '-p' option was used we should not
	* complain.
	*/
	if (zfs_dataset_exists(g_zfs, argv[1], ZFS_TYPE_FILESYSTEM \|
	ZFS_TYPE_VOLUME)) {
	zfs_close(zhp);
	nvlist_free(props);
	return (0);
	}
	if (zfs_create_ancestors(g_zfs, argv[1]) != 0) {
	zfs_close(zhp);
	nvlist_free(props);
	return (1);
	}
	}

	/* pass to libzfs */
	ret = zfs_clone(zhp, argv[1], props);

	/* create the mountpoint if necessary */
	if (ret == 0) {
	if (log_history) {
	(void) zpool_log_history(g_zfs, history_str);
	log_history = B_FALSE;
	}

	ret = zfs_mount_and_share(g_zfs, argv[1], ZFS_TYPE_DATASET);
	}

	zfs_close(zhp);
	nvlist_free(props);

	return (!!ret);

	usage:
	ASSERT3P(zhp, ==, NULL);
	nvlist_free(props);
	usage(B_FALSE);
	return (-1);
	}

	/*
	* zfs create [-Pnpv] [-o prop=value] ... fs
	* zfs create [-Pnpsv] [-b blocksize] [-o prop=value] ... -V vol size
	*
	* Create a new dataset. This command can be used to create filesystems
	* and volumes. Snapshot creation is handled by 'zfs snapshot'.
	* For volumes, the user must specify a size to be used.
	*
	* The '-s' flag applies only to volumes, and indicates that we should not try
	* to set the reservation for this volume. By default we set a reservation
	* equal to the size for any volume. For pools with SPA_VERSION >=
	* SPA_VERSION_REFRESERVATION, we set a refreservation instead.
	*
	* The '-p' flag creates all the non-existing ancestors of the target first.
	*
	* The '-n' flag is no-op (dry run) mode. This will perform a user-space sanity
	* check of arguments and properties, but does not check for permissions,
	* available space, etc.
	*
	* The '-v' flag is for verbose output.
	*
	* The '-P' flag is used for parseable output. It implies '-v'.
	*/
	static int
	zfs_do_create(int argc, char **argv)
	{
	zfs_type_t type = ZFS_TYPE_FILESYSTEM;
	zpool_handle_t *zpool_handle = NULL;
	nvlist_t *real_props = NULL;
	uint64_t volsize = 0;
	int c;
	boolean_t noreserve = B_FALSE;
	boolean_t bflag = B_FALSE;
	boolean_t parents = B_FALSE;
	boolean_t dryrun = B_FALSE;
	boolean_t verbose = B_FALSE;
	boolean_t parseable = B_FALSE;
	int ret = 1;
	nvlist_t *props;
	uint64_t intval;

	if (nvlist_alloc(&props, NV_UNIQUE_NAME, 0) != 0)
	nomem();

	/* check options */
	while ((c = getopt(argc, argv, ":PV:b:nso:pv")) != -1) {
	switch (c) {
	case 'V':
	type = ZFS_TYPE_VOLUME;
	if (zfs_nicestrtonum(g_zfs, optarg, &intval) != 0) {
	(void) fprintf(stderr, gettext("bad volume "
	"size '%s': %s\n"), optarg,
	libzfs_error_description(g_zfs));
	goto error;
	}

	if (nvlist_add_uint64(props,
	zfs_prop_to_name(ZFS_PROP_VOLSIZE), intval) != 0)
	nomem();
	volsize = intval;
	break;
	case 'P':
	verbose = B_TRUE;
	parseable = B_TRUE;
	break;
	case 'p':
	parents = B_TRUE;
	break;
	case 'b':
	bflag = B_TRUE;
	if (zfs_nicestrtonum(g_zfs, optarg, &intval) != 0) {
	(void) fprintf(stderr, gettext("bad volume "
	"block size '%s': %s\n"), optarg,
	libzfs_error_description(g_zfs));
	goto error;
	}

	if (nvlist_add_uint64(props,
	zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
	intval) != 0)
	nomem();
	break;
	case 'n':
	dryrun = B_TRUE;
	break;
	case 'o':
	if (!parseprop(props, optarg))
	goto error;
	break;
	case 's':
	noreserve = B_TRUE;
	break;
	case 'v':
	verbose = B_TRUE;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing size "
	"argument\n"));
	goto badusage;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	goto badusage;
	}
	}

	if ((bflag \|\| noreserve) && type != ZFS_TYPE_VOLUME) {
	(void) fprintf(stderr, gettext("'-s' and '-b' can only be "
	"used when creating a volume\n"));
	goto badusage;
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc == 0) {
	(void) fprintf(stderr, gettext("missing %s argument\n"),
	zfs_type_to_name(type));
	goto badusage;
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	goto badusage;
	}

	if (dryrun \|\| (type == ZFS_TYPE_VOLUME && !noreserve)) {
	char msg[ZFS_MAX_DATASET_NAME_LEN * 2];
	char *p;

	if ((p = strchr(argv[0], '/')) != NULL)
	*p = '\0';
	zpool_handle = zpool_open(g_zfs, argv[0]);
	if (p != NULL)
	*p = '/';
	if (zpool_handle == NULL)
	goto error;

	(void) snprintf(msg, sizeof (msg),
	dryrun ? gettext("cannot verify '%s'") :
	gettext("cannot create '%s'"), argv[0]);
	if (props && (real_props = zfs_valid_proplist(g_zfs, type,
	props, 0, NULL, zpool_handle, B_TRUE, msg)) == NULL) {
	zpool_close(zpool_handle);
	goto error;
	}
	}

	/*
	* if volsize is not a multiple of volblocksize, round it up to the
	* nearest multiple of the volblocksize
	*/
	if (type == ZFS_TYPE_VOLUME) {
	uint64_t volblocksize;

	if (nvlist_lookup_uint64(props,
	zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
	&volblocksize) != 0)
	volblocksize = ZVOL_DEFAULT_BLOCKSIZE;

	if (volsize % volblocksize) {
	volsize = P2ROUNDUP_TYPED(volsize, volblocksize,
	uint64_t);

	if (nvlist_add_uint64(props,
	zfs_prop_to_name(ZFS_PROP_VOLSIZE), volsize) != 0) {
	nvlist_free(props);
	nomem();
	}
	}
	}


	if (type == ZFS_TYPE_VOLUME && !noreserve) {
	uint64_t spa_version;
	zfs_prop_t resv_prop;
	char *strval;

	spa_version = zpool_get_prop_int(zpool_handle,
	ZPOOL_PROP_VERSION, NULL);
	if (spa_version >= SPA_VERSION_REFRESERVATION)
	resv_prop = ZFS_PROP_REFRESERVATION;
	else
	resv_prop = ZFS_PROP_RESERVATION;

	volsize = zvol_volsize_to_reservation(zpool_handle, volsize,
	real_props);

	if (nvlist_lookup_string(props, zfs_prop_to_name(resv_prop),
	&strval) != 0) {
	if (nvlist_add_uint64(props,
	zfs_prop_to_name(resv_prop), volsize) != 0) {
	nvlist_free(props);
	nomem();
	}
	}
	}
	if (zpool_handle != NULL) {
	zpool_close(zpool_handle);
	nvlist_free(real_props);
	}

	if (parents && zfs_name_valid(argv[0], type)) {
	/*
	* Now create the ancestors of target dataset. If the target
	* already exists and '-p' option was used we should not
	* complain.
	*/
	if (zfs_dataset_exists(g_zfs, argv[0], type)) {
	ret = 0;
	goto error;
	}
	if (verbose) {
	(void) printf(parseable ? "create_ancestors\t%s\n" :
	dryrun ? "would create ancestors of %s\n" :
	"create ancestors of %s\n", argv[0]);
	}
	if (!dryrun) {
	if (zfs_create_ancestors(g_zfs, argv[0]) != 0) {
	goto error;
	}
	}
	}

	if (verbose) {
	nvpair_t *nvp = NULL;
	(void) printf(parseable ? "create\t%s\n" :
	dryrun ? "would create %s\n" : "create %s\n", argv[0]);
	while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
	uint64_t uval;
	char *sval;

	switch (nvpair_type(nvp)) {
	case DATA_TYPE_UINT64:
	VERIFY0(nvpair_value_uint64(nvp, &uval));
	(void) printf(parseable ?
	"property\t%s\t%llu\n" : "\t%s=%llu\n",
	nvpair_name(nvp), (u_longlong_t)uval);
	break;
	case DATA_TYPE_STRING:
	VERIFY0(nvpair_value_string(nvp, &sval));
	(void) printf(parseable ?
	"property\t%s\t%s\n" : "\t%s=%s\n",
	nvpair_name(nvp), sval);
	break;
	default:
	(void) fprintf(stderr, "property '%s' "
	"has illegal type %d\n",
	nvpair_name(nvp), nvpair_type(nvp));
	abort();
	}
	}
	}
	if (dryrun) {
	ret = 0;
	goto error;
	}

	/* pass to libzfs */
	if (zfs_create(g_zfs, argv[0], type, props) != 0)
	goto error;

	if (log_history) {
	(void) zpool_log_history(g_zfs, history_str);
	log_history = B_FALSE;
	}

	ret = zfs_mount_and_share(g_zfs, argv[0], ZFS_TYPE_DATASET);
	error:
	nvlist_free(props);
	return (ret);
	badusage:
	nvlist_free(props);
	usage(B_FALSE);
	return (2);
	}

	/*
	* zfs destroy [-rRf] <fs, vol>
	* zfs destroy [-rRd] <snap>
	*
	* -r Recursively destroy all children
	* -R Recursively destroy all dependents, including clones
	* -f Force unmounting of any dependents
	* -d If we can't destroy now, mark for deferred destruction
	*
	* Destroys the given dataset. By default, it will unmount any filesystems,
	* and refuse to destroy a dataset that has any dependents. A dependent can
	* either be a child, or a clone of a child.
	*/
	typedef struct destroy_cbdata {
	boolean_t cb_first;
	boolean_t cb_force;
	boolean_t cb_recurse;
	boolean_t cb_error;
	boolean_t cb_doclones;
	zfs_handle_t *cb_target;
	boolean_t cb_defer_destroy;
	boolean_t cb_verbose;
	boolean_t cb_parsable;
	boolean_t cb_dryrun;
	nvlist_t *cb_nvl;
	nvlist_t *cb_batchedsnaps;

	/* first snap in contiguous run */
	char *cb_firstsnap;
	/* previous snap in contiguous run */
	char *cb_prevsnap;
	int64_t cb_snapused;
	char *cb_snapspec;
	char *cb_bookmark;
	uint64_t cb_snap_count;
	} destroy_cbdata_t;

	/*
	* Check for any dependents based on the '-r' or '-R' flags.
	*/
	static int
	destroy_check_dependent(zfs_handle_t zhp, void data)
	{
	destroy_cbdata_t *cbp = data;
	const char *tname = zfs_get_name(cbp->cb_target);
	const char *name = zfs_get_name(zhp);

	if (strncmp(tname, name, strlen(tname)) == 0 &&
	(name[strlen(tname)] == '/' \|\| name[strlen(tname)] == '@')) {
	/*
	* This is a direct descendant, not a clone somewhere else in
	* the hierarchy.
	*/
	if (cbp->cb_recurse)
	goto out;

	if (cbp->cb_first) {
	(void) fprintf(stderr, gettext("cannot destroy '%s': "
	"%s has children\n"),
	zfs_get_name(cbp->cb_target),
	zfs_type_to_name(zfs_get_type(cbp->cb_target)));
	(void) fprintf(stderr, gettext("use '-r' to destroy "
	"the following datasets:\n"));
	cbp->cb_first = B_FALSE;
	cbp->cb_error = B_TRUE;
	}

	(void) fprintf(stderr, "%s\n", zfs_get_name(zhp));
	} else {
	/*
	* This is a clone. We only want to report this if the '-r'
	* wasn't specified, or the target is a snapshot.
	*/
	if (!cbp->cb_recurse &&
	zfs_get_type(cbp->cb_target) != ZFS_TYPE_SNAPSHOT)
	goto out;

	if (cbp->cb_first) {
	(void) fprintf(stderr, gettext("cannot destroy '%s': "
	"%s has dependent clones\n"),
	zfs_get_name(cbp->cb_target),
	zfs_type_to_name(zfs_get_type(cbp->cb_target)));
	(void) fprintf(stderr, gettext("use '-R' to destroy "
	"the following datasets:\n"));
	cbp->cb_first = B_FALSE;
	cbp->cb_error = B_TRUE;
	cbp->cb_dryrun = B_TRUE;
	}

	(void) fprintf(stderr, "%s\n", zfs_get_name(zhp));
	}

	out:
	zfs_close(zhp);
	return (0);
	}

	static int
	destroy_batched(destroy_cbdata_t *cb)
	{
	int error = zfs_destroy_snaps_nvl(g_zfs,
	cb->cb_batchedsnaps, B_FALSE);
	fnvlist_free(cb->cb_batchedsnaps);
	cb->cb_batchedsnaps = fnvlist_alloc();
	return (error);
	}

	static int
	destroy_callback(zfs_handle_t zhp, void data)
	{
	destroy_cbdata_t *cb = data;
	const char *name = zfs_get_name(zhp);
	int error;

	if (cb->cb_verbose) {
	if (cb->cb_parsable) {
	(void) printf("destroy\t%s\n", name);
	} else if (cb->cb_dryrun) {
	(void) printf(gettext("would destroy %s\n"),
	name);
	} else {
	(void) printf(gettext("will destroy %s\n"),
	name);
	}
	}

	/*
	* Ignore pools (which we've already flagged as an error before getting
	* here).
	*/
	if (strchr(zfs_get_name(zhp), '/') == NULL &&
	zfs_get_type(zhp) == ZFS_TYPE_FILESYSTEM) {
	zfs_close(zhp);
	return (0);
	}
	if (cb->cb_dryrun) {
	zfs_close(zhp);
	return (0);
	}

	/*
	* We batch up all contiguous snapshots (even of different
	* filesystems) and destroy them with one ioctl. We can't
	* simply do all snap deletions and then all fs deletions,
	* because we must delete a clone before its origin.
	*/
	if (zfs_get_type(zhp) == ZFS_TYPE_SNAPSHOT) {
	cb->cb_snap_count++;
	fnvlist_add_boolean(cb->cb_batchedsnaps, name);
	if (cb->cb_snap_count % 10 == 0 && cb->cb_defer_destroy)
	error = destroy_batched(cb);
	} else {
	error = destroy_batched(cb);
	if (error != 0 \|\|
	zfs_unmount(zhp, NULL, cb->cb_force ? MS_FORCE : 0) != 0 \|\|
	zfs_destroy(zhp, cb->cb_defer_destroy) != 0) {
	zfs_close(zhp);
	/*
	* When performing a recursive destroy we ignore errors
	* so that the recursive destroy could continue
	* destroying past problem datasets
	*/
	if (cb->cb_recurse) {
	cb->cb_error = B_TRUE;
	return (0);
	}
	return (-1);
	}
	}

	zfs_close(zhp);
	return (0);
	}

	static int
	destroy_print_cb(zfs_handle_t zhp, void arg)
	{
	destroy_cbdata_t *cb = arg;
	const char *name = zfs_get_name(zhp);
	int err = 0;

	if (nvlist_exists(cb->cb_nvl, name)) {
	if (cb->cb_firstsnap == NULL)
	cb->cb_firstsnap = strdup(name);
	if (cb->cb_prevsnap != NULL)
	free(cb->cb_prevsnap);
	/* this snap continues the current range */
	cb->cb_prevsnap = strdup(name);
	if (cb->cb_firstsnap == NULL \|\| cb->cb_prevsnap == NULL)
	nomem();
	if (cb->cb_verbose) {
	if (cb->cb_parsable) {
	(void) printf("destroy\t%s\n", name);
	} else if (cb->cb_dryrun) {
	(void) printf(gettext("would destroy %s\n"),
	name);
	} else {
	(void) printf(gettext("will destroy %s\n"),
	name);
	}
	}
	} else if (cb->cb_firstsnap != NULL) {
	/* end of this range */
	uint64_t used = 0;
	err = lzc_snaprange_space(cb->cb_firstsnap,
	cb->cb_prevsnap, &used);
	cb->cb_snapused += used;
	free(cb->cb_firstsnap);
	cb->cb_firstsnap = NULL;
	free(cb->cb_prevsnap);
	cb->cb_prevsnap = NULL;
	}
	zfs_close(zhp);
	return (err);
	}

	static int
	destroy_print_snapshots(zfs_handle_t fs_zhp, destroy_cbdata_t cb)
	{
	int err;
	assert(cb->cb_firstsnap == NULL);
	assert(cb->cb_prevsnap == NULL);
	err = zfs_iter_snapshots_sorted(fs_zhp, destroy_print_cb, cb, 0, 0);
	if (cb->cb_firstsnap != NULL) {
	uint64_t used = 0;
	if (err == 0) {
	err = lzc_snaprange_space(cb->cb_firstsnap,
	cb->cb_prevsnap, &used);
	}
	cb->cb_snapused += used;
	free(cb->cb_firstsnap);
	cb->cb_firstsnap = NULL;
	free(cb->cb_prevsnap);
	cb->cb_prevsnap = NULL;
	}
	return (err);
	}

	static int
	snapshot_to_nvl_cb(zfs_handle_t zhp, void arg)
	{
	destroy_cbdata_t *cb = arg;
	int err = 0;

	/* Check for clones. */
	if (!cb->cb_doclones && !cb->cb_defer_destroy) {
	cb->cb_target = zhp;
	cb->cb_first = B_TRUE;
	err = zfs_iter_dependents(zhp, B_TRUE,
	destroy_check_dependent, cb);
	}

	if (err == 0) {
	if (nvlist_add_boolean(cb->cb_nvl, zfs_get_name(zhp)))
	nomem();
	}
	zfs_close(zhp);
	return (err);
	}

	static int
	gather_snapshots(zfs_handle_t zhp, void arg)
	{
	destroy_cbdata_t *cb = arg;
	int err = 0;

	err = zfs_iter_snapspec(zhp, cb->cb_snapspec, snapshot_to_nvl_cb, cb);
	if (err == ENOENT)
	err = 0;
	if (err != 0)
	goto out;

	if (cb->cb_verbose) {
	err = destroy_print_snapshots(zhp, cb);
	if (err != 0)
	goto out;
	}

	if (cb->cb_recurse)
	err = zfs_iter_filesystems(zhp, gather_snapshots, cb);

	out:
	zfs_close(zhp);
	return (err);
	}

	static int
	destroy_clones(destroy_cbdata_t *cb)
	{
	nvpair_t *pair;
	for (pair = nvlist_next_nvpair(cb->cb_nvl, NULL);
	pair != NULL;
	pair = nvlist_next_nvpair(cb->cb_nvl, pair)) {
	zfs_handle_t *zhp = zfs_open(g_zfs, nvpair_name(pair),
	ZFS_TYPE_SNAPSHOT);
	if (zhp != NULL) {
	boolean_t defer = cb->cb_defer_destroy;
	int err;

	/*
	* We can't defer destroy non-snapshots, so set it to
	* false while destroying the clones.
	*/
	cb->cb_defer_destroy = B_FALSE;
	err = zfs_iter_dependents(zhp, B_FALSE,
	destroy_callback, cb);
	cb->cb_defer_destroy = defer;
	zfs_close(zhp);
	if (err != 0)
	return (err);
	}
	}
	return (0);
	}

	static int
	zfs_do_destroy(int argc, char **argv)
	{
	destroy_cbdata_t cb = { 0 };
	int rv = 0;
	int err = 0;
	int c;
	zfs_handle_t *zhp = NULL;
	char at, pound;
	zfs_type_t type = ZFS_TYPE_DATASET;

	/* check options */
	while ((c = getopt(argc, argv, "vpndfrR")) != -1) {
	switch (c) {
	case 'v':
	cb.cb_verbose = B_TRUE;
	break;
	case 'p':
	cb.cb_verbose = B_TRUE;
	cb.cb_parsable = B_TRUE;
	break;
	case 'n':
	cb.cb_dryrun = B_TRUE;
	break;
	case 'd':
	cb.cb_defer_destroy = B_TRUE;
	type = ZFS_TYPE_SNAPSHOT;
	break;
	case 'f':
	cb.cb_force = B_TRUE;
	break;
	case 'r':
	cb.cb_recurse = B_TRUE;
	break;
	case 'R':
	cb.cb_recurse = B_TRUE;
	cb.cb_doclones = B_TRUE;
	break;
	case '?':
	default:
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc == 0) {
	(void) fprintf(stderr, gettext("missing dataset argument\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	at = strchr(argv[0], '@');
	pound = strchr(argv[0], '#');
	if (at != NULL) {

	/* Build the list of snaps to destroy in cb_nvl. */
	cb.cb_nvl = fnvlist_alloc();

	*at = '\0';
	zhp = zfs_open(g_zfs, argv[0],
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL) {
	nvlist_free(cb.cb_nvl);
	return (1);
	}

	cb.cb_snapspec = at + 1;
	if (gather_snapshots(zfs_handle_dup(zhp), &cb) != 0 \|\|
	cb.cb_error) {
	rv = 1;
	goto out;
	}

	if (nvlist_empty(cb.cb_nvl)) {
	(void) fprintf(stderr, gettext("could not find any "
	"snapshots to destroy; check snapshot names.\n"));
	rv = 1;
	goto out;
	}

	if (cb.cb_verbose) {
	char buf[16];
	zfs_nicebytes(cb.cb_snapused, buf, sizeof (buf));
	if (cb.cb_parsable) {
	(void) printf("reclaim\t%llu\n",
	(u_longlong_t)cb.cb_snapused);
	} else if (cb.cb_dryrun) {
	(void) printf(gettext("would reclaim %s\n"),
	buf);
	} else {
	(void) printf(gettext("will reclaim %s\n"),
	buf);
	}
	}

	if (!cb.cb_dryrun) {
	if (cb.cb_doclones) {
	cb.cb_batchedsnaps = fnvlist_alloc();
	err = destroy_clones(&cb);
	if (err == 0) {
	err = zfs_destroy_snaps_nvl(g_zfs,
	cb.cb_batchedsnaps, B_FALSE);
	}
	if (err != 0) {
	rv = 1;
	goto out;
	}
	}
	if (err == 0) {
	err = zfs_destroy_snaps_nvl(g_zfs, cb.cb_nvl,
	cb.cb_defer_destroy);
	}
	}

	if (err != 0)
	rv = 1;
	} else if (pound != NULL) {
	int err;
	nvlist_t *nvl;

	if (cb.cb_dryrun) {
	(void) fprintf(stderr,
	"dryrun is not supported with bookmark\n");
	return (-1);
	}

	if (cb.cb_defer_destroy) {
	(void) fprintf(stderr,
	"defer destroy is not supported with bookmark\n");
	return (-1);
	}

	if (cb.cb_recurse) {
	(void) fprintf(stderr,
	"recursive is not supported with bookmark\n");
	return (-1);
	}

	/*
	* Unfortunately, zfs_bookmark() doesn't honor the
	* casesensitivity setting. However, we can't simply
	* remove this check, because lzc_destroy_bookmarks()
	* ignores non-existent bookmarks, so this is necessary
	* to get a proper error message.
	*/
	if (!zfs_bookmark_exists(argv[0])) {
	(void) fprintf(stderr, gettext("bookmark '%s' "
	"does not exist.\n"), argv[0]);
	return (1);
	}

	nvl = fnvlist_alloc();
	fnvlist_add_boolean(nvl, argv[0]);

	err = lzc_destroy_bookmarks(nvl, NULL);
	if (err != 0) {
	(void) zfs_standard_error(g_zfs, err,
	"cannot destroy bookmark");
	}

	nvlist_free(nvl);

	return (err);
	} else {
	/* Open the given dataset */
	if ((zhp = zfs_open(g_zfs, argv[0], type)) == NULL)
	return (1);

	cb.cb_target = zhp;

	/*
	* Perform an explicit check for pools before going any further.
	*/
	if (!cb.cb_recurse && strchr(zfs_get_name(zhp), '/') == NULL &&
	zfs_get_type(zhp) == ZFS_TYPE_FILESYSTEM) {
	(void) fprintf(stderr, gettext("cannot destroy '%s': "
	"operation does not apply to pools\n"),
	zfs_get_name(zhp));
	(void) fprintf(stderr, gettext("use 'zfs destroy -r "
	"%s' to destroy all datasets in the pool\n"),
	zfs_get_name(zhp));
	(void) fprintf(stderr, gettext("use 'zpool destroy %s' "
	"to destroy the pool itself\n"), zfs_get_name(zhp));
	rv = 1;
	goto out;
	}

	/*
	* Check for any dependents and/or clones.
	*/
	cb.cb_first = B_TRUE;
	if (!cb.cb_doclones &&
	zfs_iter_dependents(zhp, B_TRUE, destroy_check_dependent,
	&cb) != 0) {
	rv = 1;
	goto out;
	}

	if (cb.cb_error) {
	rv = 1;
	goto out;
	}
	cb.cb_batchedsnaps = fnvlist_alloc();
	if (zfs_iter_dependents(zhp, B_FALSE, destroy_callback,
	&cb) != 0) {
	rv = 1;
	goto out;
	}

	/*
	* Do the real thing. The callback will close the
	* handle regardless of whether it succeeds or not.
	*/
	err = destroy_callback(zhp, &cb);
	zhp = NULL;
	if (err == 0) {
	err = zfs_destroy_snaps_nvl(g_zfs,
	cb.cb_batchedsnaps, cb.cb_defer_destroy);
	}
	if (err != 0 \|\| cb.cb_error == B_TRUE)
	rv = 1;
	}

	out:
	fnvlist_free(cb.cb_batchedsnaps);
	fnvlist_free(cb.cb_nvl);
	if (zhp != NULL)
	zfs_close(zhp);
	return (rv);
	}

	static boolean_t
	is_recvd_column(zprop_get_cbdata_t *cbp)
	{
	int i;
	zfs_get_column_t col;

	for (i = 0; i < ZFS_GET_NCOLS &&
	(col = cbp->cb_columns[i]) != GET_COL_NONE; i++)
	if (col == GET_COL_RECVD)
	return (B_TRUE);
	return (B_FALSE);
	}

	/*
	* zfs get [-rHp] [-o all \| field[,field]...] [-s source[,source]...]
	* < all \| property[,property]... > < fs \| snap \| vol > ...
	*
	* -r recurse over any child datasets
	* -H scripted mode. Headers are stripped, and fields are separated
	* by tabs instead of spaces.
	* -o Set of fields to display. One of "name,property,value,
	* received,source". Default is "name,property,value,source".
	* "all" is an alias for all five.
	* -s Set of sources to allow. One of
	* "local,default,inherited,received,temporary,none". Default is
	* all six.
	* -p Display values in parsable (literal) format.
	*
	* Prints properties for the given datasets. The user can control which
	* columns to display as well as which property types to allow.
	*/

	/*
	* Invoked to display the properties for a single dataset.
	*/
	static int
	get_callback(zfs_handle_t zhp, void data)
	{
	char buf[ZFS_MAXPROPLEN];
	char rbuf[ZFS_MAXPROPLEN];
	zprop_source_t sourcetype;
	char source[ZFS_MAX_DATASET_NAME_LEN];
	zprop_get_cbdata_t *cbp = data;
	nvlist_t *user_props = zfs_get_user_props(zhp);
	zprop_list_t *pl = cbp->cb_proplist;
	nvlist_t *propval;
	char *strval;
	char *sourceval;
	boolean_t received = is_recvd_column(cbp);

	for (; pl != NULL; pl = pl->pl_next) {
	char *recvdval = NULL;
	/*
	* Skip the special fake placeholder. This will also skip over
	* the name property when 'all' is specified.
	*/
	if (pl->pl_prop == ZFS_PROP_NAME &&
	pl == cbp->cb_proplist)
	continue;

	if (pl->pl_prop != ZPROP_INVAL) {
	if (zfs_prop_get(zhp, pl->pl_prop, buf,
	sizeof (buf), &sourcetype, source,
	sizeof (source),
	cbp->cb_literal) != 0) {
	if (pl->pl_all)
	continue;
	if (!zfs_prop_valid_for_type(pl->pl_prop,
	ZFS_TYPE_DATASET, B_FALSE)) {
	(void) fprintf(stderr,
	gettext("No such property '%s'\n"),
	zfs_prop_to_name(pl->pl_prop));
	continue;
	}
	sourcetype = ZPROP_SRC_NONE;
	(void) strlcpy(buf, "-", sizeof (buf));
	}

	if (received && (zfs_prop_get_recvd(zhp,
	zfs_prop_to_name(pl->pl_prop), rbuf, sizeof (rbuf),
	cbp->cb_literal) == 0))
	recvdval = rbuf;

	zprop_print_one_property(zfs_get_name(zhp), cbp,
	zfs_prop_to_name(pl->pl_prop),
	buf, sourcetype, source, recvdval);
	} else if (zfs_prop_userquota(pl->pl_user_prop)) {
	sourcetype = ZPROP_SRC_LOCAL;

	if (zfs_prop_get_userquota(zhp, pl->pl_user_prop,
	buf, sizeof (buf), cbp->cb_literal) != 0) {
	sourcetype = ZPROP_SRC_NONE;
	(void) strlcpy(buf, "-", sizeof (buf));
	}

	zprop_print_one_property(zfs_get_name(zhp), cbp,
	pl->pl_user_prop, buf, sourcetype, source, NULL);
	} else if (zfs_prop_written(pl->pl_user_prop)) {
	sourcetype = ZPROP_SRC_LOCAL;

	if (zfs_prop_get_written(zhp, pl->pl_user_prop,
	buf, sizeof (buf), cbp->cb_literal) != 0) {
	sourcetype = ZPROP_SRC_NONE;
	(void) strlcpy(buf, "-", sizeof (buf));
	}

	zprop_print_one_property(zfs_get_name(zhp), cbp,
	pl->pl_user_prop, buf, sourcetype, source, NULL);
	} else {
	if (nvlist_lookup_nvlist(user_props,
	pl->pl_user_prop, &propval) != 0) {
	if (pl->pl_all)
	continue;
	sourcetype = ZPROP_SRC_NONE;
	strval = "-";
	} else {
	verify(nvlist_lookup_string(propval,
	ZPROP_VALUE, &strval) == 0);
	verify(nvlist_lookup_string(propval,
	ZPROP_SOURCE, &sourceval) == 0);

	if (strcmp(sourceval,
	zfs_get_name(zhp)) == 0) {
	sourcetype = ZPROP_SRC_LOCAL;
	} else if (strcmp(sourceval,
	ZPROP_SOURCE_VAL_RECVD) == 0) {
	sourcetype = ZPROP_SRC_RECEIVED;
	} else {
	sourcetype = ZPROP_SRC_INHERITED;
	(void) strlcpy(source,
	sourceval, sizeof (source));
	}
	}

	if (received && (zfs_prop_get_recvd(zhp,
	pl->pl_user_prop, rbuf, sizeof (rbuf),
	cbp->cb_literal) == 0))
	recvdval = rbuf;

	zprop_print_one_property(zfs_get_name(zhp), cbp,
	pl->pl_user_prop, strval, sourcetype,
	source, recvdval);
	}
	}

	return (0);
	}

	static int
	zfs_do_get(int argc, char **argv)
	{
	zprop_get_cbdata_t cb = { 0 };
	int i, c, flags = ZFS_ITER_ARGS_CAN_BE_PATHS;
	int types = ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK;
	char value, fields;
	int ret = 0;
	int limit = 0;
	zprop_list_t fake_name = { 0 };

	/*
	* Set up default columns and sources.
	*/
	cb.cb_sources = ZPROP_SRC_ALL;
	cb.cb_columns[0] = GET_COL_NAME;
	cb.cb_columns[1] = GET_COL_PROPERTY;
	cb.cb_columns[2] = GET_COL_VALUE;
	cb.cb_columns[3] = GET_COL_SOURCE;
	cb.cb_type = ZFS_TYPE_DATASET;

	/* check options */
	while ((c = getopt(argc, argv, ":d:o:s:rt:Hp")) != -1) {
	switch (c) {
	case 'p':
	cb.cb_literal = B_TRUE;
	break;
	case 'd':
	limit = parse_depth(optarg, &flags);
	break;
	case 'r':
	flags \|= ZFS_ITER_RECURSE;
	break;
	case 'H':
	cb.cb_scripted = B_TRUE;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case 'o':
	/*
	* Process the set of columns to display. We zero out
	* the structure to give us a blank slate.
	*/
	bzero(&cb.cb_columns, sizeof (cb.cb_columns));
	i = 0;
	while (*optarg != '\0') {
	static char *col_subopts[] =
	{ "name", "property", "value", "received",
	"source", "all", NULL };

	if (i == ZFS_GET_NCOLS) {
	(void) fprintf(stderr, gettext("too "
	"many fields given to -o "
	"option\n"));
	usage(B_FALSE);
	}

	switch (getsubopt(&optarg, col_subopts,
	&value)) {
	case 0:
	cb.cb_columns[i++] = GET_COL_NAME;
	break;
	case 1:
	cb.cb_columns[i++] = GET_COL_PROPERTY;
	break;
	case 2:
	cb.cb_columns[i++] = GET_COL_VALUE;
	break;
	case 3:
	cb.cb_columns[i++] = GET_COL_RECVD;
	flags \|= ZFS_ITER_RECVD_PROPS;
	break;
	case 4:
	cb.cb_columns[i++] = GET_COL_SOURCE;
	break;
	case 5:
	if (i > 0) {
	(void) fprintf(stderr,
	gettext("\"all\" conflicts "
	"with specific fields "
	"given to -o option\n"));
	usage(B_FALSE);
	}
	cb.cb_columns[0] = GET_COL_NAME;
	cb.cb_columns[1] = GET_COL_PROPERTY;
	cb.cb_columns[2] = GET_COL_VALUE;
	cb.cb_columns[3] = GET_COL_RECVD;
	cb.cb_columns[4] = GET_COL_SOURCE;
	flags \|= ZFS_ITER_RECVD_PROPS;
	i = ZFS_GET_NCOLS;
	break;
	default:
	(void) fprintf(stderr,
	gettext("invalid column name "
	"'%s'\n"), value);
	usage(B_FALSE);
	}
	}
	break;

	case 's':
	cb.cb_sources = 0;
	while (*optarg != '\0') {
	static char *source_subopts[] = {
	"local", "default", "inherited",
	"received", "temporary", "none",
	NULL };

	switch (getsubopt(&optarg, source_subopts,
	&value)) {
	case 0:
	cb.cb_sources \|= ZPROP_SRC_LOCAL;
	break;
	case 1:
	cb.cb_sources \|= ZPROP_SRC_DEFAULT;
	break;
	case 2:
	cb.cb_sources \|= ZPROP_SRC_INHERITED;
	break;
	case 3:
	cb.cb_sources \|= ZPROP_SRC_RECEIVED;
	break;
	case 4:
	cb.cb_sources \|= ZPROP_SRC_TEMPORARY;
	break;
	case 5:
	cb.cb_sources \|= ZPROP_SRC_NONE;
	break;
	default:
	(void) fprintf(stderr,
	gettext("invalid source "
	"'%s'\n"), value);
	usage(B_FALSE);
	}
	}
	break;

	case 't':
	types = 0;
	flags &= ~ZFS_ITER_PROP_LISTSNAPS;
	while (*optarg != '\0') {
	static char *type_subopts[] = { "filesystem",
	"volume", "snapshot", "snap", "bookmark",
	"all", NULL };

	switch (getsubopt(&optarg, type_subopts,
	&value)) {
	case 0:
	types \|= ZFS_TYPE_FILESYSTEM;
	break;
	case 1:
	types \|= ZFS_TYPE_VOLUME;
	break;
	case 2:
	case 3:
	types \|= ZFS_TYPE_SNAPSHOT;
	break;
	case 4:
	types \|= ZFS_TYPE_BOOKMARK;
	break;
	case 5:
	types = ZFS_TYPE_DATASET \|
	ZFS_TYPE_BOOKMARK;
	break;

	default:
	(void) fprintf(stderr,
	gettext("invalid type '%s'\n"),
	value);
	usage(B_FALSE);
	}
	}
	break;

	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing property "
	"argument\n"));
	usage(B_FALSE);
	}

	fields = argv[0];

	/*
	* Handle users who want to get all snapshots or bookmarks
	* of a dataset (ex. 'zfs get -t snapshot refer <dataset>').
	*/
	if ((types == ZFS_TYPE_SNAPSHOT \|\| types == ZFS_TYPE_BOOKMARK) &&
	argc > 1 && (flags & ZFS_ITER_RECURSE) == 0 && limit == 0) {
	flags \|= (ZFS_ITER_DEPTH_LIMIT \| ZFS_ITER_RECURSE);
	limit = 1;
	}

	if (zprop_get_list(g_zfs, fields, &cb.cb_proplist, ZFS_TYPE_DATASET)
	!= 0)
	usage(B_FALSE);

	argc--;
	argv++;

	/*
	* As part of zfs_expand_proplist(), we keep track of the maximum column
	* width for each property. For the 'NAME' (and 'SOURCE') columns, we
	* need to know the maximum name length. However, the user likely did
	* not specify 'name' as one of the properties to fetch, so we need to
	* make sure we always include at least this property for
	* print_get_headers() to work properly.
	*/
	if (cb.cb_proplist != NULL) {
	fake_name.pl_prop = ZFS_PROP_NAME;
	fake_name.pl_width = strlen(gettext("NAME"));
	fake_name.pl_next = cb.cb_proplist;
	cb.cb_proplist = &fake_name;
	}

	cb.cb_first = B_TRUE;

	/* run for each object */
	ret = zfs_for_each(argc, argv, flags, types, NULL,
	&cb.cb_proplist, limit, get_callback, &cb);

	if (cb.cb_proplist == &fake_name)
	zprop_free_list(fake_name.pl_next);
	else
	zprop_free_list(cb.cb_proplist);

	return (ret);
	}

	/*
	* inherit [-rS] <property> <fs\|vol> ...
	*
	* -r Recurse over all children
	* -S Revert to received value, if any
	*
	* For each dataset specified on the command line, inherit the given property
	* from its parent. Inheriting a property at the pool level will cause it to
	* use the default value. The '-r' flag will recurse over all children, and is
	* useful for setting a property on a hierarchy-wide basis, regardless of any
	* local modifications for each dataset.
	*/

	typedef struct inherit_cbdata {
	const char *cb_propname;
	boolean_t cb_received;
	} inherit_cbdata_t;

	static int
	inherit_recurse_cb(zfs_handle_t zhp, void data)
	{
	inherit_cbdata_t *cb = data;
	zfs_prop_t prop = zfs_name_to_prop(cb->cb_propname);

	/*
	* If we're doing it recursively, then ignore properties that
	* are not valid for this type of dataset.
	*/
	if (prop != ZPROP_INVAL &&
	!zfs_prop_valid_for_type(prop, zfs_get_type(zhp), B_FALSE))
	return (0);

	return (zfs_prop_inherit(zhp, cb->cb_propname, cb->cb_received) != 0);
	}

	static int
	inherit_cb(zfs_handle_t zhp, void data)
	{
	inherit_cbdata_t *cb = data;

	return (zfs_prop_inherit(zhp, cb->cb_propname, cb->cb_received) != 0);
	}

	static int
	zfs_do_inherit(int argc, char **argv)
	{
	int c;
	zfs_prop_t prop;
	inherit_cbdata_t cb = { 0 };
	char *propname;
	int ret = 0;
	int flags = 0;
	boolean_t received = B_FALSE;

	/* check options */
	while ((c = getopt(argc, argv, "rS")) != -1) {
	switch (c) {
	case 'r':
	flags \|= ZFS_ITER_RECURSE;
	break;
	case 'S':
	received = B_TRUE;
	break;
	case '?':
	default:
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing property argument\n"));
	usage(B_FALSE);
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing dataset argument\n"));
	usage(B_FALSE);
	}

	propname = argv[0];
	argc--;
	argv++;

	if ((prop = zfs_name_to_prop(propname)) != ZPROP_INVAL) {
	if (zfs_prop_readonly(prop)) {
	(void) fprintf(stderr, gettext(
	"%s property is read-only\n"),
	propname);
	return (1);
	}
	if (!zfs_prop_inheritable(prop) && !received) {
	(void) fprintf(stderr, gettext("'%s' property cannot "
	"be inherited\n"), propname);
	if (prop == ZFS_PROP_QUOTA \|\|
	prop == ZFS_PROP_RESERVATION \|\|
	prop == ZFS_PROP_REFQUOTA \|\|
	prop == ZFS_PROP_REFRESERVATION) {
	(void) fprintf(stderr, gettext("use 'zfs set "
	"%s=none' to clear\n"), propname);
	(void) fprintf(stderr, gettext("use 'zfs "
	"inherit -S %s' to revert to received "
	"value\n"), propname);
	}
	return (1);
	}
	if (received && (prop == ZFS_PROP_VOLSIZE \|\|
	prop == ZFS_PROP_VERSION)) {
	(void) fprintf(stderr, gettext("'%s' property cannot "
	"be reverted to a received value\n"), propname);
	return (1);
	}
	} else if (!zfs_prop_user(propname)) {
	(void) fprintf(stderr, gettext("invalid property '%s'\n"),
	propname);
	usage(B_FALSE);
	}

	cb.cb_propname = propname;
	cb.cb_received = received;

	if (flags & ZFS_ITER_RECURSE) {
	ret = zfs_for_each(argc, argv, flags, ZFS_TYPE_DATASET,
	NULL, NULL, 0, inherit_recurse_cb, &cb);
	} else {
	ret = zfs_for_each(argc, argv, flags, ZFS_TYPE_DATASET,
	NULL, NULL, 0, inherit_cb, &cb);
	}

	return (ret);
	}

	typedef struct upgrade_cbdata {
	uint64_t cb_numupgraded;
	uint64_t cb_numsamegraded;
	uint64_t cb_numfailed;
	uint64_t cb_version;
	boolean_t cb_newer;
	boolean_t cb_foundone;
	char cb_lastfs[ZFS_MAX_DATASET_NAME_LEN];
	} upgrade_cbdata_t;

	static int
	same_pool(zfs_handle_t zhp, const char name)
	{
	int len1 = strcspn(name, "/@");
	const char *zhname = zfs_get_name(zhp);
	int len2 = strcspn(zhname, "/@");

	if (len1 != len2)
	return (B_FALSE);
	return (strncmp(name, zhname, len1) == 0);
	}

	static int
	upgrade_list_callback(zfs_handle_t zhp, void data)
	{
	upgrade_cbdata_t *cb = data;
	int version = zfs_prop_get_int(zhp, ZFS_PROP_VERSION);

	/* list if it's old/new */
	if ((!cb->cb_newer && version < ZPL_VERSION) \|\|
	(cb->cb_newer && version > ZPL_VERSION)) {
	char *str;
	if (cb->cb_newer) {
	str = gettext("The following filesystems are "
	"formatted using a newer software version and\n"
	"cannot be accessed on the current system.\n\n");
	} else {
	str = gettext("The following filesystems are "
	"out of date, and can be upgraded. After being\n"
	"upgraded, these filesystems (and any 'zfs send' "
	"streams generated from\n"
	"subsequent snapshots) will no longer be "
	"accessible by older software versions.\n\n");
	}

	if (!cb->cb_foundone) {
	(void) puts(str);
	(void) printf(gettext("VER FILESYSTEM\n"));
	(void) printf(gettext("--- ------------\n"));
	cb->cb_foundone = B_TRUE;
	}

	(void) printf("%2u %s\n", version, zfs_get_name(zhp));
	}

	return (0);
	}

	static int
	upgrade_set_callback(zfs_handle_t zhp, void data)
	{
	upgrade_cbdata_t *cb = data;
	int version = zfs_prop_get_int(zhp, ZFS_PROP_VERSION);
	int needed_spa_version;
	int spa_version;

	if (zfs_spa_version(zhp, &spa_version) < 0)
	return (-1);

	needed_spa_version = zfs_spa_version_map(cb->cb_version);

	if (needed_spa_version < 0)
	return (-1);

	if (spa_version < needed_spa_version) {
	/* can't upgrade */
	(void) printf(gettext("%s: can not be "
	"upgraded; the pool version needs to first "
	"be upgraded\nto version %d\n\n"),
	zfs_get_name(zhp), needed_spa_version);
	cb->cb_numfailed++;
	return (0);
	}

	/* upgrade */
	if (version < cb->cb_version) {
	char verstr[16];
	(void) snprintf(verstr, sizeof (verstr),
	"%llu", (u_longlong_t)cb->cb_version);
	if (cb->cb_lastfs[0] && !same_pool(zhp, cb->cb_lastfs)) {
	/*
	* If they did "zfs upgrade -a", then we could
	* be doing ioctls to different pools. We need
	* to log this history once to each pool, and bypass
	* the normal history logging that happens in main().
	*/
	(void) zpool_log_history(g_zfs, history_str);
	log_history = B_FALSE;
	}
	if (zfs_prop_set(zhp, "version", verstr) == 0)
	cb->cb_numupgraded++;
	else
	cb->cb_numfailed++;
	(void) strcpy(cb->cb_lastfs, zfs_get_name(zhp));
	} else if (version > cb->cb_version) {
	/* can't downgrade */
	(void) printf(gettext("%s: can not be downgraded; "
	"it is already at version %u\n"),
	zfs_get_name(zhp), version);
	cb->cb_numfailed++;
	} else {
	cb->cb_numsamegraded++;
	}
	return (0);
	}

	/*
	* zfs upgrade
	* zfs upgrade -v
	* zfs upgrade [-r] [-V <version>] <-a \| filesystem>
	*/
	static int
	zfs_do_upgrade(int argc, char **argv)
	{
	boolean_t all = B_FALSE;
	boolean_t showversions = B_FALSE;
	int ret = 0;
	upgrade_cbdata_t cb = { 0 };
	int c;
	int flags = ZFS_ITER_ARGS_CAN_BE_PATHS;

	/* check options */
	while ((c = getopt(argc, argv, "rvV:a")) != -1) {
	switch (c) {
	case 'r':
	flags \|= ZFS_ITER_RECURSE;
	break;
	case 'v':
	showversions = B_TRUE;
	break;
	case 'V':
	if (zfs_prop_string_to_index(ZFS_PROP_VERSION,
	optarg, &cb.cb_version) != 0) {
	(void) fprintf(stderr,
	gettext("invalid version %s\n"), optarg);
	usage(B_FALSE);
	}
	break;
	case 'a':
	all = B_TRUE;
	break;
	case '?':
	default:
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if ((!all && !argc) && ((flags & ZFS_ITER_RECURSE) \| cb.cb_version))
	usage(B_FALSE);
	if (showversions && (flags & ZFS_ITER_RECURSE \|\| all \|\|
	cb.cb_version \|\| argc))
	usage(B_FALSE);
	if ((all \|\| argc) && (showversions))
	usage(B_FALSE);
	if (all && argc)
	usage(B_FALSE);

	if (showversions) {
	/* Show info on available versions. */
	(void) printf(gettext("The following filesystem versions are "
	"supported:\n\n"));
	(void) printf(gettext("VER DESCRIPTION\n"));
	(void) printf("--- -----------------------------------------"
	"---------------\n");
	(void) printf(gettext(" 1 Initial ZFS filesystem version\n"));
	(void) printf(gettext(" 2 Enhanced directory entries\n"));
	(void) printf(gettext(" 3 Case insensitive and filesystem "
	"user identifier (FUID)\n"));
	(void) printf(gettext(" 4 userquota, groupquota "
	"properties\n"));
	(void) printf(gettext(" 5 System attributes\n"));
	(void) printf(gettext("\nFor more information on a particular "
	"version, including supported releases,\n"));
	(void) printf("see the ZFS Administration Guide.\n\n");
	ret = 0;
	} else if (argc \|\| all) {
	/* Upgrade filesystems */
	if (cb.cb_version == 0)
	cb.cb_version = ZPL_VERSION;
	ret = zfs_for_each(argc, argv, flags, ZFS_TYPE_FILESYSTEM,
	NULL, NULL, 0, upgrade_set_callback, &cb);
	(void) printf(gettext("%llu filesystems upgraded\n"),
	(u_longlong_t)cb.cb_numupgraded);
	if (cb.cb_numsamegraded) {
	(void) printf(gettext("%llu filesystems already at "
	"this version\n"),
	(u_longlong_t)cb.cb_numsamegraded);
	}
	if (cb.cb_numfailed != 0)
	ret = 1;
	} else {
	/* List old-version filesystems */
	boolean_t found;
	(void) printf(gettext("This system is currently running "
	"ZFS filesystem version %llu.\n\n"), ZPL_VERSION);

	flags \|= ZFS_ITER_RECURSE;
	ret = zfs_for_each(0, NULL, flags, ZFS_TYPE_FILESYSTEM,
	NULL, NULL, 0, upgrade_list_callback, &cb);

	found = cb.cb_foundone;
	cb.cb_foundone = B_FALSE;
	cb.cb_newer = B_TRUE;

	ret = zfs_for_each(0, NULL, flags, ZFS_TYPE_FILESYSTEM,
	NULL, NULL, 0, upgrade_list_callback, &cb);

	if (!cb.cb_foundone && !found) {
	(void) printf(gettext("All filesystems are "
	"formatted with the current version.\n"));
	}
	}

	return (ret);
	}

	/*
	* zfs userspace [-Hinp] [-o field[,...]] [-s field [-s field]...]
	* [-S field [-S field]...] [-t type[,...]] filesystem \| snapshot
	* zfs groupspace [-Hinp] [-o field[,...]] [-s field [-s field]...]
	* [-S field [-S field]...] [-t type[,...]] filesystem \| snapshot
	* zfs projectspace [-Hp] [-o field[,...]] [-s field [-s field]...]
	* [-S field [-S field]...] filesystem \| snapshot
	*
	* -H Scripted mode; elide headers and separate columns by tabs.
	* -i Translate SID to POSIX ID.
	* -n Print numeric ID instead of user/group name.
	* -o Control which fields to display.
	* -p Use exact (parsable) numeric output.
	* -s Specify sort columns, descending order.
	* -S Specify sort columns, ascending order.
	* -t Control which object types to display.
	*
	* Displays space consumed by, and quotas on, each user in the specified
	* filesystem or snapshot.
	*/

	/* us_field_types, us_field_hdr and us_field_names should be kept in sync */
	enum us_field_types {
	USFIELD_TYPE,
	USFIELD_NAME,
	USFIELD_USED,
	USFIELD_QUOTA,
	USFIELD_OBJUSED,
	USFIELD_OBJQUOTA
	};
	static char *us_field_hdr[] = { "TYPE", "NAME", "USED", "QUOTA",
	"OBJUSED", "OBJQUOTA" };
	static char *us_field_names[] = { "type", "name", "used", "quota",
	"objused", "objquota" };
	#define USFIELD_LAST (sizeof (us_field_names) / sizeof (char *))

	#define USTYPE_PSX_GRP (1 << 0)
	#define USTYPE_PSX_USR (1 << 1)
	#define USTYPE_SMB_GRP (1 << 2)
	#define USTYPE_SMB_USR (1 << 3)
	#define USTYPE_PROJ (1 << 4)
	#define USTYPE_ALL \
	(USTYPE_PSX_GRP \| USTYPE_PSX_USR \| USTYPE_SMB_GRP \| USTYPE_SMB_USR \| \
	USTYPE_PROJ)

	static int us_type_bits[] = {
	USTYPE_PSX_GRP,
	USTYPE_PSX_USR,
	USTYPE_SMB_GRP,
	USTYPE_SMB_USR,
	USTYPE_ALL
	};
	static char *us_type_names[] = { "posixgroup", "posixuser", "smbgroup",
	"smbuser", "all" };

	typedef struct us_node {
	nvlist_t *usn_nvl;
	uu_avl_node_t usn_avlnode;
	uu_list_node_t usn_listnode;
	} us_node_t;

	typedef struct us_cbdata {
	nvlist_t **cb_nvlp;
	uu_avl_pool_t *cb_avl_pool;
	uu_avl_t *cb_avl;
	boolean_t cb_numname;
	boolean_t cb_nicenum;
	boolean_t cb_sid2posix;
	zfs_userquota_prop_t cb_prop;
	zfs_sort_column_t *cb_sortcol;
	size_t cb_width[USFIELD_LAST];
	} us_cbdata_t;

	static boolean_t us_populated = B_FALSE;

	typedef struct {
	zfs_sort_column_t *si_sortcol;
	boolean_t si_numname;
	} us_sort_info_t;

	static int
	us_field_index(char *field)
	{
	int i;

	for (i = 0; i < USFIELD_LAST; i++) {
	if (strcmp(field, us_field_names[i]) == 0)
	return (i);
	}

	return (-1);
	}

	static int
	us_compare(const void larg, const void rarg, void *unused)
	{
	const us_node_t *l = larg;
	const us_node_t *r = rarg;
	us_sort_info_t si = (us_sort_info_t )unused;
	zfs_sort_column_t *sortcol = si->si_sortcol;
	boolean_t numname = si->si_numname;
	nvlist_t *lnvl = l->usn_nvl;
	nvlist_t *rnvl = r->usn_nvl;
	int rc = 0;
	boolean_t lvb, rvb;

	for (; sortcol != NULL; sortcol = sortcol->sc_next) {
	char *lvstr = "";
	char *rvstr = "";
	uint32_t lv32 = 0;
	uint32_t rv32 = 0;
	uint64_t lv64 = 0;
	uint64_t rv64 = 0;
	zfs_prop_t prop = sortcol->sc_prop;
	const char *propname = NULL;
	boolean_t reverse = sortcol->sc_reverse;

	switch (prop) {
	case ZFS_PROP_TYPE:
	propname = "type";
	(void) nvlist_lookup_uint32(lnvl, propname, &lv32);
	(void) nvlist_lookup_uint32(rnvl, propname, &rv32);
	if (rv32 != lv32)
	rc = (rv32 < lv32) ? 1 : -1;
	break;
	case ZFS_PROP_NAME:
	propname = "name";
	if (numname) {
	compare_nums:
	(void) nvlist_lookup_uint64(lnvl, propname,
	&lv64);
	(void) nvlist_lookup_uint64(rnvl, propname,
	&rv64);
	if (rv64 != lv64)
	rc = (rv64 < lv64) ? 1 : -1;
	} else {
	if ((nvlist_lookup_string(lnvl, propname,
	&lvstr) == ENOENT) \|\|
	(nvlist_lookup_string(rnvl, propname,
	&rvstr) == ENOENT)) {
	goto compare_nums;
	}
	rc = strcmp(lvstr, rvstr);
	}
	break;
	case ZFS_PROP_USED:
	case ZFS_PROP_QUOTA:
	if (!us_populated)
	break;
	if (prop == ZFS_PROP_USED)
	propname = "used";
	else
	propname = "quota";
	(void) nvlist_lookup_uint64(lnvl, propname, &lv64);
	(void) nvlist_lookup_uint64(rnvl, propname, &rv64);
	if (rv64 != lv64)
	rc = (rv64 < lv64) ? 1 : -1;
	break;

	default:
	break;
	}

	if (rc != 0) {
	if (rc < 0)
	return (reverse ? 1 : -1);
	else
	return (reverse ? -1 : 1);
	}
	}

	/*
	* If entries still seem to be the same, check if they are of the same
	* type (smbentity is added only if we are doing SID to POSIX ID
	* translation where we can have duplicate type/name combinations).
	*/
	if (nvlist_lookup_boolean_value(lnvl, "smbentity", &lvb) == 0 &&
	nvlist_lookup_boolean_value(rnvl, "smbentity", &rvb) == 0 &&
	lvb != rvb)
	return (lvb < rvb ? -1 : 1);

	return (0);
	}

	static boolean_t
	zfs_prop_is_user(unsigned p)
	{
	return (p == ZFS_PROP_USERUSED \|\| p == ZFS_PROP_USERQUOTA \|\|
	p == ZFS_PROP_USEROBJUSED \|\| p == ZFS_PROP_USEROBJQUOTA);
	}

	static boolean_t
	zfs_prop_is_group(unsigned p)
	{
	return (p == ZFS_PROP_GROUPUSED \|\| p == ZFS_PROP_GROUPQUOTA \|\|
	p == ZFS_PROP_GROUPOBJUSED \|\| p == ZFS_PROP_GROUPOBJQUOTA);
	}

	static boolean_t
	zfs_prop_is_project(unsigned p)
	{
	return (p == ZFS_PROP_PROJECTUSED \|\| p == ZFS_PROP_PROJECTQUOTA \|\|
	p == ZFS_PROP_PROJECTOBJUSED \|\| p == ZFS_PROP_PROJECTOBJQUOTA);
	}

	static inline const char *
	us_type2str(unsigned field_type)
	{
	switch (field_type) {
	case USTYPE_PSX_USR:
	return ("POSIX User");
	case USTYPE_PSX_GRP:
	return ("POSIX Group");
	case USTYPE_SMB_USR:
	return ("SMB User");
	case USTYPE_SMB_GRP:
	return ("SMB Group");
	case USTYPE_PROJ:
	return ("Project");
	default:
	return ("Undefined");
	}
	}

	static int
	userspace_cb(void arg, const char domain, uid_t rid, uint64_t space)
	{
	us_cbdata_t cb = (us_cbdata_t )arg;
	zfs_userquota_prop_t prop = cb->cb_prop;
	char *name = NULL;
	char *propname;
	char sizebuf[32];
	us_node_t *node;
	uu_avl_pool_t *avl_pool = cb->cb_avl_pool;
	uu_avl_t *avl = cb->cb_avl;
	uu_avl_index_t idx;
	nvlist_t *props;
	us_node_t *n;
	zfs_sort_column_t *sortcol = cb->cb_sortcol;
	unsigned type = 0;
	const char *typestr;
	size_t namelen;
	size_t typelen;
	size_t sizelen;
	int typeidx, nameidx, sizeidx;
	us_sort_info_t sortinfo = { sortcol, cb->cb_numname };
	boolean_t smbentity = B_FALSE;

	if (nvlist_alloc(&props, NV_UNIQUE_NAME, 0) != 0)
	nomem();
	node = safe_malloc(sizeof (us_node_t));
	uu_avl_node_init(node, &node->usn_avlnode, avl_pool);
	node->usn_nvl = props;

	if (domain != NULL && domain[0] != '\0') {
	#ifdef HAVE_IDMAP
	/* SMB */
	char sid[MAXNAMELEN + 32];
	uid_t id;
	uint64_t classes;
	int err;
	directory_error_t e;

	smbentity = B_TRUE;

	(void) snprintf(sid, sizeof (sid), "%s-%u", domain, rid);

	if (prop == ZFS_PROP_GROUPUSED \|\| prop == ZFS_PROP_GROUPQUOTA) {
	type = USTYPE_SMB_GRP;
	err = sid_to_id(sid, B_FALSE, &id);
	} else {
	type = USTYPE_SMB_USR;
	err = sid_to_id(sid, B_TRUE, &id);
	}

	if (err == 0) {
	rid = id;
	if (!cb->cb_sid2posix) {
	e = directory_name_from_sid(NULL, sid, &name,
	&classes);
	if (e != NULL)
	directory_error_free(e);
	if (name == NULL)
	name = sid;
	}
	}
	#else
	nvlist_free(props);
	free(node);

	return (-1);
	#endif /* HAVE_IDMAP */
	}

	if (cb->cb_sid2posix \|\| domain == NULL \|\| domain[0] == '\0') {
	/* POSIX or -i */
	if (zfs_prop_is_group(prop)) {
	type = USTYPE_PSX_GRP;
	if (!cb->cb_numname) {
	struct group *g;

	if ((g = getgrgid(rid)) != NULL)
	name = g->gr_name;
	}
	} else if (zfs_prop_is_user(prop)) {
	type = USTYPE_PSX_USR;
	if (!cb->cb_numname) {
	struct passwd *p;

	if ((p = getpwuid(rid)) != NULL)
	name = p->pw_name;
	}
	} else {
	type = USTYPE_PROJ;
	}
	}

	/*
	* Make sure that the type/name combination is unique when doing
	* SID to POSIX ID translation (hence changing the type from SMB to
	* POSIX).
	*/
	if (cb->cb_sid2posix &&
	nvlist_add_boolean_value(props, "smbentity", smbentity) != 0)
	nomem();

	/* Calculate/update width of TYPE field */
	typestr = us_type2str(type);
	typelen = strlen(gettext(typestr));
	typeidx = us_field_index("type");
	if (typelen > cb->cb_width[typeidx])
	cb->cb_width[typeidx] = typelen;
	if (nvlist_add_uint32(props, "type", type) != 0)
	nomem();

	/* Calculate/update width of NAME field */
	if ((cb->cb_numname && cb->cb_sid2posix) \|\| name == NULL) {
	if (nvlist_add_uint64(props, "name", rid) != 0)
	nomem();
	namelen = snprintf(NULL, 0, "%u", rid);
	} else {
	if (nvlist_add_string(props, "name", name) != 0)
	nomem();
	namelen = strlen(name);
	}
	nameidx = us_field_index("name");
	if (nameidx >= 0 && namelen > cb->cb_width[nameidx])
	cb->cb_width[nameidx] = namelen;

	/*
	* Check if this type/name combination is in the list and update it;
	* otherwise add new node to the list.
	*/
	if ((n = uu_avl_find(avl, node, &sortinfo, &idx)) == NULL) {
	uu_avl_insert(avl, node, idx);
	} else {
	nvlist_free(props);
	free(node);
	node = n;
	props = node->usn_nvl;
	}

	/* Calculate/update width of USED/QUOTA fields */
	if (cb->cb_nicenum) {
	if (prop == ZFS_PROP_USERUSED \|\| prop == ZFS_PROP_GROUPUSED \|\|
	prop == ZFS_PROP_USERQUOTA \|\| prop == ZFS_PROP_GROUPQUOTA \|\|
	prop == ZFS_PROP_PROJECTUSED \|\|
	prop == ZFS_PROP_PROJECTQUOTA) {
	zfs_nicebytes(space, sizebuf, sizeof (sizebuf));
	} else {
	zfs_nicenum(space, sizebuf, sizeof (sizebuf));
	}
	} else {
	(void) snprintf(sizebuf, sizeof (sizebuf), "%llu",
	(u_longlong_t)space);
	}
	sizelen = strlen(sizebuf);
	if (prop == ZFS_PROP_USERUSED \|\| prop == ZFS_PROP_GROUPUSED \|\|
	prop == ZFS_PROP_PROJECTUSED) {
	propname = "used";
	if (!nvlist_exists(props, "quota"))
	(void) nvlist_add_uint64(props, "quota", 0);
	} else if (prop == ZFS_PROP_USERQUOTA \|\| prop == ZFS_PROP_GROUPQUOTA \|\|
	prop == ZFS_PROP_PROJECTQUOTA) {
	propname = "quota";
	if (!nvlist_exists(props, "used"))
	(void) nvlist_add_uint64(props, "used", 0);
	} else if (prop == ZFS_PROP_USEROBJUSED \|\|
	prop == ZFS_PROP_GROUPOBJUSED \|\| prop == ZFS_PROP_PROJECTOBJUSED) {
	propname = "objused";
	if (!nvlist_exists(props, "objquota"))
	(void) nvlist_add_uint64(props, "objquota", 0);
	} else if (prop == ZFS_PROP_USEROBJQUOTA \|\|
	prop == ZFS_PROP_GROUPOBJQUOTA \|\|
	prop == ZFS_PROP_PROJECTOBJQUOTA) {
	propname = "objquota";
	if (!nvlist_exists(props, "objused"))
	(void) nvlist_add_uint64(props, "objused", 0);
	} else {
	return (-1);
	}
	sizeidx = us_field_index(propname);
	if (sizeidx >= 0 && sizelen > cb->cb_width[sizeidx])
	cb->cb_width[sizeidx] = sizelen;

	if (nvlist_add_uint64(props, propname, space) != 0)
	nomem();

	return (0);
	}

	static void
	print_us_node(boolean_t scripted, boolean_t parsable, int *fields, int types,
	size_t width, us_node_t node)
	{
	nvlist_t *nvl = node->usn_nvl;
	char valstr[MAXNAMELEN];
	boolean_t first = B_TRUE;
	int cfield = 0;
	int field;
	uint32_t ustype;

	/* Check type */
	(void) nvlist_lookup_uint32(nvl, "type", &ustype);
	if (!(ustype & types))
	return;

	while ((field = fields[cfield]) != USFIELD_LAST) {
	nvpair_t *nvp = NULL;
	data_type_t type;
	uint32_t val32;
	uint64_t val64;
	char *strval = "-";

	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
	if (strcmp(nvpair_name(nvp),
	us_field_names[field]) == 0)
	break;
	}

	type = nvp == NULL ? DATA_TYPE_UNKNOWN : nvpair_type(nvp);
	switch (type) {
	case DATA_TYPE_UINT32:
	(void) nvpair_value_uint32(nvp, &val32);
	break;
	case DATA_TYPE_UINT64:
	(void) nvpair_value_uint64(nvp, &val64);
	break;
	case DATA_TYPE_STRING:
	(void) nvpair_value_string(nvp, &strval);
	break;
	case DATA_TYPE_UNKNOWN:
	break;
	default:
	(void) fprintf(stderr, "invalid data type\n");
	}

	switch (field) {
	case USFIELD_TYPE:
	if (type == DATA_TYPE_UINT32)
	strval = (char *)us_type2str(val32);
	break;
	case USFIELD_NAME:
	if (type == DATA_TYPE_UINT64) {
	(void) sprintf(valstr, "%llu",
	(u_longlong_t)val64);
	strval = valstr;
	}
	break;
	case USFIELD_USED:
	case USFIELD_QUOTA:
	if (type == DATA_TYPE_UINT64) {
	if (parsable) {
	(void) sprintf(valstr, "%llu",
	(u_longlong_t)val64);
	strval = valstr;
	} else if (field == USFIELD_QUOTA &&
	val64 == 0) {
	strval = "none";
	} else {
	zfs_nicebytes(val64, valstr,
	sizeof (valstr));
	strval = valstr;
	}
	}
	break;
	case USFIELD_OBJUSED:
	case USFIELD_OBJQUOTA:
	if (type == DATA_TYPE_UINT64) {
	if (parsable) {
	(void) sprintf(valstr, "%llu",
	(u_longlong_t)val64);
	strval = valstr;
	} else if (field == USFIELD_OBJQUOTA &&
	val64 == 0) {
	strval = "none";
	} else {
	zfs_nicenum(val64, valstr,
	sizeof (valstr));
	strval = valstr;
	}
	}
	break;
	}

	if (!first) {
	if (scripted)
	(void) printf("\t");
	else
	(void) printf(" ");
	}
	if (scripted)
	(void) printf("%s", strval);
	else if (field == USFIELD_TYPE \|\| field == USFIELD_NAME)
	(void) printf("%-*s", (int)width[field], strval);
	else
	(void) printf("%*s", (int)width[field], strval);

	first = B_FALSE;
	cfield++;
	}

	(void) printf("\n");
	}

	static void
	print_us(boolean_t scripted, boolean_t parsable, int *fields, int types,
	size_t width, boolean_t rmnode, uu_avl_t avl)
	{
	us_node_t *node;
	const char *col;
	int cfield = 0;
	int field;

	if (!scripted) {
	boolean_t first = B_TRUE;

	while ((field = fields[cfield]) != USFIELD_LAST) {
	col = gettext(us_field_hdr[field]);
	if (field == USFIELD_TYPE \|\| field == USFIELD_NAME) {
	(void) printf(first ? "%-s" : " %-s",
	(int)width[field], col);
	} else {
	(void) printf(first ? "%s" : " %s",
	(int)width[field], col);
	}
	first = B_FALSE;
	cfield++;
	}
	(void) printf("\n");
	}

	for (node = uu_avl_first(avl); node; node = uu_avl_next(avl, node)) {
	print_us_node(scripted, parsable, fields, types, width, node);
	if (rmnode)
	nvlist_free(node->usn_nvl);
	}
	}

	static int
	zfs_do_userspace(int argc, char **argv)
	{
	zfs_handle_t *zhp;
	zfs_userquota_prop_t p;
	uu_avl_pool_t *avl_pool;
	uu_avl_t *avl_tree;
	uu_avl_walk_t *walk;
	char *delim;
	char deffields[] = "type,name,used,quota,objused,objquota";
	char *ofield = NULL;
	char *tfield = NULL;
	int cfield = 0;
	int fields[256];
	int i;
	boolean_t scripted = B_FALSE;
	boolean_t prtnum = B_FALSE;
	boolean_t parsable = B_FALSE;
	boolean_t sid2posix = B_FALSE;
	int ret = 0;
	int c;
	zfs_sort_column_t *sortcol = NULL;
	int types = USTYPE_PSX_USR \| USTYPE_SMB_USR;
	us_cbdata_t cb;
	us_node_t *node;
	us_node_t *rmnode;
	uu_list_pool_t *listpool;
	uu_list_t *list;
	uu_avl_index_t idx = 0;
	uu_list_index_t idx2 = 0;

	if (argc < 2)
	usage(B_FALSE);

	if (strcmp(argv[0], "groupspace") == 0) {
	/* Toggle default group types */
	types = USTYPE_PSX_GRP \| USTYPE_SMB_GRP;
	} else if (strcmp(argv[0], "projectspace") == 0) {
	types = USTYPE_PROJ;
	prtnum = B_TRUE;
	}

	while ((c = getopt(argc, argv, "nHpo:s:S:t:i")) != -1) {
	switch (c) {
	case 'n':
	if (types == USTYPE_PROJ) {
	(void) fprintf(stderr,
	gettext("invalid option 'n'\n"));
	usage(B_FALSE);
	}
	prtnum = B_TRUE;
	break;
	case 'H':
	scripted = B_TRUE;
	break;
	case 'p':
	parsable = B_TRUE;
	break;
	case 'o':
	ofield = optarg;
	break;
	case 's':
	case 'S':
	if (zfs_add_sort_column(&sortcol, optarg,
	c == 's' ? B_FALSE : B_TRUE) != 0) {
	(void) fprintf(stderr,
	gettext("invalid field '%s'\n"), optarg);
	usage(B_FALSE);
	}
	break;
	case 't':
	if (types == USTYPE_PROJ) {
	(void) fprintf(stderr,
	gettext("invalid option 't'\n"));
	usage(B_FALSE);
	}
	tfield = optarg;
	break;
	case 'i':
	if (types == USTYPE_PROJ) {
	(void) fprintf(stderr,
	gettext("invalid option 'i'\n"));
	usage(B_FALSE);
	}
	sid2posix = B_TRUE;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing dataset name\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	/* Use default output fields if not specified using -o */
	if (ofield == NULL)
	ofield = deffields;
	do {
	if ((delim = strchr(ofield, ',')) != NULL)
	*delim = '\0';
	if ((fields[cfield++] = us_field_index(ofield)) == -1) {
	(void) fprintf(stderr, gettext("invalid type '%s' "
	"for -o option\n"), ofield);
	return (-1);
	}
	if (delim != NULL)
	ofield = delim + 1;
	} while (delim != NULL);
	fields[cfield] = USFIELD_LAST;

	/* Override output types (-t option) */
	if (tfield != NULL) {
	types = 0;

	do {
	boolean_t found = B_FALSE;

	if ((delim = strchr(tfield, ',')) != NULL)
	*delim = '\0';
	for (i = 0; i < sizeof (us_type_bits) / sizeof (int);
	i++) {
	if (strcmp(tfield, us_type_names[i]) == 0) {
	found = B_TRUE;
	types \|= us_type_bits[i];
	break;
	}
	}
	if (!found) {
	(void) fprintf(stderr, gettext("invalid type "
	"'%s' for -t option\n"), tfield);
	return (-1);
	}
	if (delim != NULL)
	tfield = delim + 1;
	} while (delim != NULL);
	}

	if ((zhp = zfs_open(g_zfs, argv[0], ZFS_TYPE_FILESYSTEM \|
	ZFS_TYPE_SNAPSHOT)) == NULL)
	return (1);
	if (zhp->zfs_head_type != ZFS_TYPE_FILESYSTEM) {
	(void) fprintf(stderr, gettext("operation is only applicable "
	"to filesystems and their snapshots\n"));
	zfs_close(zhp);
	return (1);
	}

	if ((avl_pool = uu_avl_pool_create("us_avl_pool", sizeof (us_node_t),
	offsetof(us_node_t, usn_avlnode), us_compare, UU_DEFAULT)) == NULL)
	nomem();
	if ((avl_tree = uu_avl_create(avl_pool, NULL, UU_DEFAULT)) == NULL)
	nomem();

	/* Always add default sorting columns */
	(void) zfs_add_sort_column(&sortcol, "type", B_FALSE);
	(void) zfs_add_sort_column(&sortcol, "name", B_FALSE);

	cb.cb_sortcol = sortcol;
	cb.cb_numname = prtnum;
	cb.cb_nicenum = !parsable;
	cb.cb_avl_pool = avl_pool;
	cb.cb_avl = avl_tree;
	cb.cb_sid2posix = sid2posix;

	for (i = 0; i < USFIELD_LAST; i++)
	cb.cb_width[i] = strlen(gettext(us_field_hdr[i]));

	for (p = 0; p < ZFS_NUM_USERQUOTA_PROPS; p++) {
	if ((zfs_prop_is_user(p) &&
	!(types & (USTYPE_PSX_USR \| USTYPE_SMB_USR))) \|\|
	(zfs_prop_is_group(p) &&
	!(types & (USTYPE_PSX_GRP \| USTYPE_SMB_GRP))) \|\|
	(zfs_prop_is_project(p) && types != USTYPE_PROJ))
	continue;

	cb.cb_prop = p;
	if ((ret = zfs_userspace(zhp, p, userspace_cb, &cb)) != 0) {
	zfs_close(zhp);
	return (ret);
	}
	}
	zfs_close(zhp);

	/* Sort the list */
	if ((node = uu_avl_first(avl_tree)) == NULL)
	return (0);

	us_populated = B_TRUE;

	listpool = uu_list_pool_create("tmplist", sizeof (us_node_t),
	offsetof(us_node_t, usn_listnode), NULL, UU_DEFAULT);
	list = uu_list_create(listpool, NULL, UU_DEFAULT);
	uu_list_node_init(node, &node->usn_listnode, listpool);

	while (node != NULL) {
	rmnode = node;
	node = uu_avl_next(avl_tree, node);
	uu_avl_remove(avl_tree, rmnode);
	if (uu_list_find(list, rmnode, NULL, &idx2) == NULL)
	uu_list_insert(list, rmnode, idx2);
	}

	for (node = uu_list_first(list); node != NULL;
	node = uu_list_next(list, node)) {
	us_sort_info_t sortinfo = { sortcol, cb.cb_numname };

	if (uu_avl_find(avl_tree, node, &sortinfo, &idx) == NULL)
	uu_avl_insert(avl_tree, node, idx);
	}

	uu_list_destroy(list);
	uu_list_pool_destroy(listpool);

	/* Print and free node nvlist memory */
	print_us(scripted, parsable, fields, types, cb.cb_width, B_TRUE,
	cb.cb_avl);

	zfs_free_sort_columns(sortcol);

	/* Clean up the AVL tree */
	if ((walk = uu_avl_walk_start(cb.cb_avl, UU_WALK_ROBUST)) == NULL)
	nomem();

	while ((node = uu_avl_walk_next(walk)) != NULL) {
	uu_avl_remove(cb.cb_avl, node);
	free(node);
	}

	uu_avl_walk_end(walk);
	uu_avl_destroy(avl_tree);
	uu_avl_pool_destroy(avl_pool);

	return (ret);
	}

	/*
	* list [-Hp][-r\|-d max] [-o property[,...]] [-s property] ... [-S property]
	* [-t type[,...]] [filesystem\|volume\|snapshot] ...
	*
	* -H Scripted mode; elide headers and separate columns by tabs
	* -p Display values in parsable (literal) format.
	* -r Recurse over all children
	* -d Limit recursion by depth.
	* -o Control which fields to display.
	* -s Specify sort columns, descending order.
	* -S Specify sort columns, ascending order.
	* -t Control which object types to display.
	*
	* When given no arguments, list all filesystems in the system.
	* Otherwise, list the specified datasets, optionally recursing down them if
	* '-r' is specified.
	*/
	typedef struct list_cbdata {
	boolean_t cb_first;
	boolean_t cb_literal;
	boolean_t cb_scripted;
	zprop_list_t *cb_proplist;
	} list_cbdata_t;

	/*
	* Given a list of columns to display, output appropriate headers for each one.
	*/
	static void
	print_header(list_cbdata_t *cb)
	{
	zprop_list_t *pl = cb->cb_proplist;
	char headerbuf[ZFS_MAXPROPLEN];
	const char *header;
	int i;
	boolean_t first = B_TRUE;
	boolean_t right_justify;

	for (; pl != NULL; pl = pl->pl_next) {
	if (!first) {
	(void) printf(" ");
	} else {
	first = B_FALSE;
	}

	right_justify = B_FALSE;
	if (pl->pl_prop != ZPROP_INVAL) {
	header = zfs_prop_column_name(pl->pl_prop);
	right_justify = zfs_prop_align_right(pl->pl_prop);
	} else {
	for (i = 0; pl->pl_user_prop[i] != '\0'; i++)
	headerbuf[i] = toupper(pl->pl_user_prop[i]);
	headerbuf[i] = '\0';
	header = headerbuf;
	}

	if (pl->pl_next == NULL && !right_justify)
	(void) printf("%s", header);
	else if (right_justify)
	(void) printf("%*s", (int)pl->pl_width, header);
	else
	(void) printf("%-*s", (int)pl->pl_width, header);
	}

	(void) printf("\n");
	}

	/*
	* Given a dataset and a list of fields, print out all the properties according
	* to the described layout.
	*/
	static void
	print_dataset(zfs_handle_t zhp, list_cbdata_t cb)
	{
	zprop_list_t *pl = cb->cb_proplist;
	boolean_t first = B_TRUE;
	char property[ZFS_MAXPROPLEN];
	nvlist_t *userprops = zfs_get_user_props(zhp);
	nvlist_t *propval;
	char *propstr;
	boolean_t right_justify;

	for (; pl != NULL; pl = pl->pl_next) {
	if (!first) {
	if (cb->cb_scripted)
	(void) printf("\t");
	else
	(void) printf(" ");
	} else {
	first = B_FALSE;
	}

	if (pl->pl_prop == ZFS_PROP_NAME) {
	(void) strlcpy(property, zfs_get_name(zhp),
	sizeof (property));
	propstr = property;
	right_justify = zfs_prop_align_right(pl->pl_prop);
	} else if (pl->pl_prop != ZPROP_INVAL) {
	if (zfs_prop_get(zhp, pl->pl_prop, property,
	sizeof (property), NULL, NULL, 0,
	cb->cb_literal) != 0)
	propstr = "-";
	else
	propstr = property;
	right_justify = zfs_prop_align_right(pl->pl_prop);
	} else if (zfs_prop_userquota(pl->pl_user_prop)) {
	if (zfs_prop_get_userquota(zhp, pl->pl_user_prop,
	property, sizeof (property), cb->cb_literal) != 0)
	propstr = "-";
	else
	propstr = property;
	right_justify = B_TRUE;
	} else if (zfs_prop_written(pl->pl_user_prop)) {
	if (zfs_prop_get_written(zhp, pl->pl_user_prop,
	property, sizeof (property), cb->cb_literal) != 0)
	propstr = "-";
	else
	propstr = property;
	right_justify = B_TRUE;
	} else {
	if (nvlist_lookup_nvlist(userprops,
	pl->pl_user_prop, &propval) != 0)
	propstr = "-";
	else
	verify(nvlist_lookup_string(propval,
	ZPROP_VALUE, &propstr) == 0);
	right_justify = B_FALSE;
	}

	/*
	* If this is being called in scripted mode, or if this is the
	* last column and it is left-justified, don't include a width
	* format specifier.
	*/
	if (cb->cb_scripted \|\| (pl->pl_next == NULL && !right_justify))
	(void) printf("%s", propstr);
	else if (right_justify)
	(void) printf("%*s", (int)pl->pl_width, propstr);
	else
	(void) printf("%-*s", (int)pl->pl_width, propstr);
	}

	(void) printf("\n");
	}

	/*
	* Generic callback function to list a dataset or snapshot.
	*/
	static int
	list_callback(zfs_handle_t zhp, void data)
	{
	list_cbdata_t *cbp = data;

	if (cbp->cb_first) {
	if (!cbp->cb_scripted)
	print_header(cbp);
	cbp->cb_first = B_FALSE;
	}

	print_dataset(zhp, cbp);

	return (0);
	}

	static int
	zfs_do_list(int argc, char **argv)
	{
	int c;
	static char default_fields[] =
	"name,used,available,referenced,mountpoint";
	int types = ZFS_TYPE_DATASET;
	boolean_t types_specified = B_FALSE;
	char *fields = NULL;
	list_cbdata_t cb = { 0 };
	char *value;
	int limit = 0;
	int ret = 0;
	zfs_sort_column_t *sortcol = NULL;
	int flags = ZFS_ITER_PROP_LISTSNAPS \| ZFS_ITER_ARGS_CAN_BE_PATHS;

	/* check options */
	while ((c = getopt(argc, argv, "HS:d:o:prs:t:")) != -1) {
	switch (c) {
	case 'o':
	fields = optarg;
	break;
	case 'p':
	cb.cb_literal = B_TRUE;
	flags \|= ZFS_ITER_LITERAL_PROPS;
	break;
	case 'd':
	limit = parse_depth(optarg, &flags);
	break;
	case 'r':
	flags \|= ZFS_ITER_RECURSE;
	break;
	case 'H':
	cb.cb_scripted = B_TRUE;
	break;
	case 's':
	if (zfs_add_sort_column(&sortcol, optarg,
	B_FALSE) != 0) {
	(void) fprintf(stderr,
	gettext("invalid property '%s'\n"), optarg);
	usage(B_FALSE);
	}
	break;
	case 'S':
	if (zfs_add_sort_column(&sortcol, optarg,
	B_TRUE) != 0) {
	(void) fprintf(stderr,
	gettext("invalid property '%s'\n"), optarg);
	usage(B_FALSE);
	}
	break;
	case 't':
	types = 0;
	types_specified = B_TRUE;
	flags &= ~ZFS_ITER_PROP_LISTSNAPS;
	while (*optarg != '\0') {
	static char *type_subopts[] = { "filesystem",
	"volume", "snapshot", "snap", "bookmark",
	"all", NULL };

	switch (getsubopt(&optarg, type_subopts,
	&value)) {
	case 0:
	types \|= ZFS_TYPE_FILESYSTEM;
	break;
	case 1:
	types \|= ZFS_TYPE_VOLUME;
	break;
	case 2:
	case 3:
	types \|= ZFS_TYPE_SNAPSHOT;
	break;
	case 4:
	types \|= ZFS_TYPE_BOOKMARK;
	break;
	case 5:
	types = ZFS_TYPE_DATASET \|
	ZFS_TYPE_BOOKMARK;
	break;
	default:
	(void) fprintf(stderr,
	gettext("invalid type '%s'\n"),
	value);
	usage(B_FALSE);
	}
	}
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (fields == NULL)
	fields = default_fields;

	/*
	* If we are only going to list snapshot names and sort by name,
	* then we can use faster version.
	*/
	if (strcmp(fields, "name") == 0 && zfs_sort_only_by_name(sortcol))
	flags \|= ZFS_ITER_SIMPLE;

	/*
	* If "-o space" and no types were specified, don't display snapshots.
	*/
	if (strcmp(fields, "space") == 0 && types_specified == B_FALSE)
	types &= ~ZFS_TYPE_SNAPSHOT;

	/*
	* Handle users who want to list all snapshots or bookmarks
	* of the current dataset (ex. 'zfs list -t snapshot <dataset>').
	*/
	if ((types == ZFS_TYPE_SNAPSHOT \|\| types == ZFS_TYPE_BOOKMARK) &&
	argc > 0 && (flags & ZFS_ITER_RECURSE) == 0 && limit == 0) {
	flags \|= (ZFS_ITER_DEPTH_LIMIT \| ZFS_ITER_RECURSE);
	limit = 1;
	}

	/*
	* If the user specifies '-o all', the zprop_get_list() doesn't
	* normally include the name of the dataset. For 'zfs list', we always
	* want this property to be first.
	*/
	if (zprop_get_list(g_zfs, fields, &cb.cb_proplist, ZFS_TYPE_DATASET)
	!= 0)
	usage(B_FALSE);

	cb.cb_first = B_TRUE;

	ret = zfs_for_each(argc, argv, flags, types, sortcol, &cb.cb_proplist,
	limit, list_callback, &cb);

	zprop_free_list(cb.cb_proplist);
	zfs_free_sort_columns(sortcol);

	if (ret == 0 && cb.cb_first && !cb.cb_scripted)
	(void) fprintf(stderr, gettext("no datasets available\n"));

	return (ret);
	}

	/*
	* zfs rename [-fu] <fs \| snap \| vol> <fs \| snap \| vol>
	* zfs rename [-f] -p <fs \| vol> <fs \| vol>
	* zfs rename [-u] -r <snap> <snap>
	*
	* Renames the given dataset to another of the same type.
	*
	* The '-p' flag creates all the non-existing ancestors of the target first.
	* The '-u' flag prevents file systems from being remounted during rename.
	*/
	/* ARGSUSED */
	static int
	zfs_do_rename(int argc, char **argv)
	{
	zfs_handle_t *zhp;
	renameflags_t flags = { 0 };
	int c;
	int ret = 0;
	int types;
	boolean_t parents = B_FALSE;

	/* check options */
	while ((c = getopt(argc, argv, "pruf")) != -1) {
	switch (c) {
	case 'p':
	parents = B_TRUE;
	break;
	case 'r':
	flags.recursive = B_TRUE;
	break;
	case 'u':
	flags.nounmount = B_TRUE;
	break;
	case 'f':
	flags.forceunmount = B_TRUE;
	break;
	case '?':
	default:
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing source dataset "
	"argument\n"));
	usage(B_FALSE);
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing target dataset "
	"argument\n"));
	usage(B_FALSE);
	}
	if (argc > 2) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	if (flags.recursive && parents) {
	(void) fprintf(stderr, gettext("-p and -r options are mutually "
	"exclusive\n"));
	usage(B_FALSE);
	}

	if (flags.nounmount && parents) {
	(void) fprintf(stderr, gettext("-u and -p options are mutually "
	"exclusive\n"));
	usage(B_FALSE);
	}

	if (flags.recursive && strchr(argv[0], '@') == 0) {
	(void) fprintf(stderr, gettext("source dataset for recursive "
	"rename must be a snapshot\n"));
	usage(B_FALSE);
	}

	if (flags.nounmount)
	types = ZFS_TYPE_FILESYSTEM;
	else if (parents)
	types = ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME;
	else
	types = ZFS_TYPE_DATASET;

	if ((zhp = zfs_open(g_zfs, argv[0], types)) == NULL)
	return (1);

	/* If we were asked and the name looks good, try to create ancestors. */
	if (parents && zfs_name_valid(argv[1], zfs_get_type(zhp)) &&
	zfs_create_ancestors(g_zfs, argv[1]) != 0) {
	zfs_close(zhp);
	return (1);
	}

	ret = (zfs_rename(zhp, argv[1], flags) != 0);

	zfs_close(zhp);
	return (ret);
	}

	/*
	* zfs promote <fs>
	*
	* Promotes the given clone fs to be the parent
	*/
	/* ARGSUSED */
	static int
	zfs_do_promote(int argc, char **argv)
	{
	zfs_handle_t *zhp;
	int ret = 0;

	/* check options */
	if (argc > 1 && argv[1][0] == '-') {
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	argv[1][1]);
	usage(B_FALSE);
	}

	/* check number of arguments */
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing clone filesystem"
	" argument\n"));
	usage(B_FALSE);
	}
	if (argc > 2) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	zhp = zfs_open(g_zfs, argv[1], ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL)
	return (1);

	ret = (zfs_promote(zhp) != 0);


	zfs_close(zhp);
	return (ret);
	}

	static int
	zfs_do_redact(int argc, char **argv)
	{
	char *snap = NULL;
	char *bookname = NULL;
	char **rsnaps = NULL;
	int numrsnaps = 0;
	argv++;
	argc--;
	if (argc < 3) {
	(void) fprintf(stderr, gettext("too few arguments\n"));
	usage(B_FALSE);
	}

	snap = argv[0];
	bookname = argv[1];
	rsnaps = argv + 2;
	numrsnaps = argc - 2;

	nvlist_t *rsnapnv = fnvlist_alloc();

	for (int i = 0; i < numrsnaps; i++) {
	fnvlist_add_boolean(rsnapnv, rsnaps[i]);
	}

	int err = lzc_redact(snap, bookname, rsnapnv);
	fnvlist_free(rsnapnv);

	switch (err) {
	case 0:
	break;
	case ENOENT:
	(void) fprintf(stderr,
	gettext("provided snapshot %s does not exist\n"), snap);
	break;
	case EEXIST:
	(void) fprintf(stderr, gettext("specified redaction bookmark "
	"(%s) provided already exists\n"), bookname);
	break;
	case ENAMETOOLONG:
	(void) fprintf(stderr, gettext("provided bookmark name cannot "
	"be used, final name would be too long\n"));
	break;
	case E2BIG:
	(void) fprintf(stderr, gettext("too many redaction snapshots "
	"specified\n"));
	break;
	case EINVAL:
	if (strchr(bookname, '#') != NULL)
	(void) fprintf(stderr, gettext(
	"redaction bookmark name must not contain '#'\n"));
	else
	(void) fprintf(stderr, gettext(
	"redaction snapshot must be descendent of "
	"snapshot being redacted\n"));
	break;
	case EALREADY:
	(void) fprintf(stderr, gettext("attempted to redact redacted "
	"dataset or with respect to redacted dataset\n"));
	break;
	case ENOTSUP:
	(void) fprintf(stderr, gettext("redaction bookmarks feature "
	"not enabled\n"));
	break;
	case EXDEV:
	(void) fprintf(stderr, gettext("potentially invalid redaction "
	"snapshot; full dataset names required\n"));
	break;
	default:
	(void) fprintf(stderr, gettext("internal error: %s\n"),
	strerror(errno));
	}

	return (err);
	}

	/*
	* zfs rollback [-rRf] <snapshot>
	*
	* -r Delete any intervening snapshots before doing rollback
	* -R Delete any snapshots and their clones
	* -f ignored for backwards compatibility
	*
	* Given a filesystem, rollback to a specific snapshot, discarding any changes
	* since then and making it the active dataset. If more recent snapshots exist,
	* the command will complain unless the '-r' flag is given.
	*/
	typedef struct rollback_cbdata {
	uint64_t cb_create;
	uint8_t cb_younger_ds_printed;
	boolean_t cb_first;
	int cb_doclones;
	char *cb_target;
	int cb_error;
	boolean_t cb_recurse;
	} rollback_cbdata_t;

	static int
	rollback_check_dependent(zfs_handle_t zhp, void data)
	{
	rollback_cbdata_t *cbp = data;

	if (cbp->cb_first && cbp->cb_recurse) {
	(void) fprintf(stderr, gettext("cannot rollback to "
	"'%s': clones of previous snapshots exist\n"),
	cbp->cb_target);
	(void) fprintf(stderr, gettext("use '-R' to "
	"force deletion of the following clones and "
	"dependents:\n"));
	cbp->cb_first = 0;
	cbp->cb_error = 1;
	}

	(void) fprintf(stderr, "%s\n", zfs_get_name(zhp));

	zfs_close(zhp);
	return (0);
	}


	/*
	* Report some snapshots/bookmarks more recent than the one specified.
	* Used when '-r' is not specified. We reuse this same callback for the
	* snapshot dependents - if 'cb_dependent' is set, then this is a
	* dependent and we should report it without checking the transaction group.
	*/
	static int
	rollback_check(zfs_handle_t zhp, void data)
	{
	rollback_cbdata_t *cbp = data;
	/*
	* Max number of younger snapshots and/or bookmarks to display before
	* we stop the iteration.
	*/
	const uint8_t max_younger = 32;

	if (cbp->cb_doclones) {
	zfs_close(zhp);
	return (0);
	}

	if (zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG) > cbp->cb_create) {
	if (cbp->cb_first && !cbp->cb_recurse) {
	(void) fprintf(stderr, gettext("cannot "
	"rollback to '%s': more recent snapshots "
	"or bookmarks exist\n"),
	cbp->cb_target);
	(void) fprintf(stderr, gettext("use '-r' to "
	"force deletion of the following "
	"snapshots and bookmarks:\n"));
	cbp->cb_first = 0;
	cbp->cb_error = 1;
	}

	if (cbp->cb_recurse) {
	if (zfs_iter_dependents(zhp, B_TRUE,
	rollback_check_dependent, cbp) != 0) {
	zfs_close(zhp);
	return (-1);
	}
	} else {
	(void) fprintf(stderr, "%s\n",
	zfs_get_name(zhp));
	cbp->cb_younger_ds_printed++;
	}
	}
	zfs_close(zhp);

	if (cbp->cb_younger_ds_printed == max_younger) {
	/*
	* This non-recursive rollback is going to fail due to the
	* presence of snapshots and/or bookmarks that are younger than
	* the rollback target.
	* We printed some of the offending objects, now we stop
	* zfs_iter_snapshot/bookmark iteration so we can fail fast and
	* avoid iterating over the rest of the younger objects
	*/
	(void) fprintf(stderr, gettext("Output limited to %d "
	"snapshots/bookmarks\n"), max_younger);
	return (-1);
	}
	return (0);
	}

	static int
	zfs_do_rollback(int argc, char **argv)
	{
	int ret = 0;
	int c;
	boolean_t force = B_FALSE;
	rollback_cbdata_t cb = { 0 };
	zfs_handle_t zhp, snap;
	char parentname[ZFS_MAX_DATASET_NAME_LEN];
	char *delim;
	uint64_t min_txg = 0;

	/* check options */
	while ((c = getopt(argc, argv, "rRf")) != -1) {
	switch (c) {
	case 'r':
	cb.cb_recurse = 1;
	break;
	case 'R':
	cb.cb_recurse = 1;
	cb.cb_doclones = 1;
	break;
	case 'f':
	force = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing dataset argument\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	/* open the snapshot */
	if ((snap = zfs_open(g_zfs, argv[0], ZFS_TYPE_SNAPSHOT)) == NULL)
	return (1);

	/* open the parent dataset */
	(void) strlcpy(parentname, argv[0], sizeof (parentname));
	verify((delim = strrchr(parentname, '@')) != NULL);
	*delim = '\0';
	if ((zhp = zfs_open(g_zfs, parentname, ZFS_TYPE_DATASET)) == NULL) {
	zfs_close(snap);
	return (1);
	}

	/*
	* Check for more recent snapshots and/or clones based on the presence
	* of '-r' and '-R'.
	*/
	cb.cb_target = argv[0];
	cb.cb_create = zfs_prop_get_int(snap, ZFS_PROP_CREATETXG);
	cb.cb_first = B_TRUE;
	cb.cb_error = 0;

	if (cb.cb_create > 0)
	min_txg = cb.cb_create;

	if ((ret = zfs_iter_snapshots(zhp, B_FALSE, rollback_check, &cb,
	min_txg, 0)) != 0)
	goto out;
	if ((ret = zfs_iter_bookmarks(zhp, rollback_check, &cb)) != 0)
	goto out;

	if ((ret = cb.cb_error) != 0)
	goto out;

	/*
	* Rollback parent to the given snapshot.
	*/
	ret = zfs_rollback(zhp, snap, force);

	out:
	zfs_close(snap);
	zfs_close(zhp);

	if (ret == 0)
	return (0);
	else
	return (1);
	}

	/*
	* zfs set property=value ... { fs \| snap \| vol } ...
	*
	* Sets the given properties for all datasets specified on the command line.
	*/

	static int
	set_callback(zfs_handle_t zhp, void data)
	{
	nvlist_t *props = data;

	if (zfs_prop_set_list(zhp, props) != 0) {
	switch (libzfs_errno(g_zfs)) {
	case EZFS_MOUNTFAILED:
	(void) fprintf(stderr, gettext("property may be set "
	"but unable to remount filesystem\n"));
	break;
	case EZFS_SHARENFSFAILED:
	(void) fprintf(stderr, gettext("property may be set "
	"but unable to reshare filesystem\n"));
	break;
	}
	return (1);
	}
	return (0);
	}

	static int
	zfs_do_set(int argc, char **argv)
	{
	nvlist_t *props = NULL;
	int ds_start = -1; /* argv idx of first dataset arg */
	int ret = 0;
	int i;

	/* check for options */
	if (argc > 1 && argv[1][0] == '-') {
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	argv[1][1]);
	usage(B_FALSE);
	}

	/* check number of arguments */
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing arguments\n"));
	usage(B_FALSE);
	}
	if (argc < 3) {
	if (strchr(argv[1], '=') == NULL) {
	(void) fprintf(stderr, gettext("missing property=value "
	"argument(s)\n"));
	} else {
	(void) fprintf(stderr, gettext("missing dataset "
	"name(s)\n"));
	}
	usage(B_FALSE);
	}

	/* validate argument order: prop=val args followed by dataset args */
	for (i = 1; i < argc; i++) {
	if (strchr(argv[i], '=') != NULL) {
	if (ds_start > 0) {
	/* out-of-order prop=val argument */
	(void) fprintf(stderr, gettext("invalid "
	"argument order\n"));
	usage(B_FALSE);
	}
	} else if (ds_start < 0) {
	ds_start = i;
	}
	}
	if (ds_start < 0) {
	(void) fprintf(stderr, gettext("missing dataset name(s)\n"));
	usage(B_FALSE);
	}

	/* Populate a list of property settings */
	if (nvlist_alloc(&props, NV_UNIQUE_NAME, 0) != 0)
	nomem();
	for (i = 1; i < ds_start; i++) {
	if (!parseprop(props, argv[i])) {
	ret = -1;
	goto error;
	}
	}

	ret = zfs_for_each(argc - ds_start, argv + ds_start, 0,
	ZFS_TYPE_DATASET, NULL, NULL, 0, set_callback, props);

	error:
	nvlist_free(props);
	return (ret);
	}

	typedef struct snap_cbdata {
	nvlist_t *sd_nvl;
	boolean_t sd_recursive;
	const char *sd_snapname;
	} snap_cbdata_t;

	static int
	zfs_snapshot_cb(zfs_handle_t zhp, void arg)
	{
	snap_cbdata_t *sd = arg;
	char *name;
	int rv = 0;
	int error;

	if (sd->sd_recursive &&
	zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT) != 0) {
	zfs_close(zhp);
	return (0);
	}

	error = asprintf(&name, "%s@%s", zfs_get_name(zhp), sd->sd_snapname);
	if (error == -1)
	nomem();
	fnvlist_add_boolean(sd->sd_nvl, name);
	free(name);

	if (sd->sd_recursive)
	rv = zfs_iter_filesystems(zhp, zfs_snapshot_cb, sd);
	zfs_close(zhp);
	return (rv);
	}

	/*
	* zfs snapshot [-r] [-o prop=value] ... <fs@snap>
	*
	* Creates a snapshot with the given name. While functionally equivalent to
	* 'zfs create', it is a separate command to differentiate intent.
	*/
	static int
	zfs_do_snapshot(int argc, char **argv)
	{
	int ret = 0;
	int c;
	nvlist_t *props;
	snap_cbdata_t sd = { 0 };
	boolean_t multiple_snaps = B_FALSE;

	if (nvlist_alloc(&props, NV_UNIQUE_NAME, 0) != 0)
	nomem();
	if (nvlist_alloc(&sd.sd_nvl, NV_UNIQUE_NAME, 0) != 0)
	nomem();

	/* check options */
	while ((c = getopt(argc, argv, "ro:")) != -1) {
	switch (c) {
	case 'o':
	if (!parseprop(props, optarg)) {
	nvlist_free(sd.sd_nvl);
	nvlist_free(props);
	return (1);
	}
	break;
	case 'r':
	sd.sd_recursive = B_TRUE;
	multiple_snaps = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	goto usage;
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing snapshot argument\n"));
	goto usage;
	}

	if (argc > 1)
	multiple_snaps = B_TRUE;
	for (; argc > 0; argc--, argv++) {
	char *atp;
	zfs_handle_t *zhp;

	atp = strchr(argv[0], '@');
	if (atp == NULL)
	goto usage;
	*atp = '\0';
	sd.sd_snapname = atp + 1;
	zhp = zfs_open(g_zfs, argv[0],
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL)
	goto usage;
	if (zfs_snapshot_cb(zhp, &sd) != 0)
	goto usage;
	}

	ret = zfs_snapshot_nvl(g_zfs, sd.sd_nvl, props);
	nvlist_free(sd.sd_nvl);
	nvlist_free(props);
	if (ret != 0 && multiple_snaps)
	(void) fprintf(stderr, gettext("no snapshots were created\n"));
	return (ret != 0);

	usage:
	nvlist_free(sd.sd_nvl);
	nvlist_free(props);
	usage(B_FALSE);
	return (-1);
	}


	/*
	* Send a backup stream to stdout.
	*/
	static int
	zfs_do_send(int argc, char **argv)
	{
	char *fromname = NULL;
	char *toname = NULL;
	char *resume_token = NULL;
	char *cp;
	zfs_handle_t *zhp;
	sendflags_t flags = { 0 };
	int c, err;
	nvlist_t *dbgnv = NULL;
	char *redactbook = NULL;

	struct option long_options[] = {
	{"replicate", no_argument, NULL, 'R'},
	{"redact", required_argument, NULL, 'd'},
	{"props", no_argument, NULL, 'p'},
	{"parsable", no_argument, NULL, 'P'},
	{"dedup", no_argument, NULL, 'D'},
	{"verbose", no_argument, NULL, 'v'},
	{"dryrun", no_argument, NULL, 'n'},
	{"large-block", no_argument, NULL, 'L'},
	{"embed", no_argument, NULL, 'e'},
	{"resume", required_argument, NULL, 't'},
	{"compressed", no_argument, NULL, 'c'},
	{"raw", no_argument, NULL, 'w'},
	{"backup", no_argument, NULL, 'b'},
	{"holds", no_argument, NULL, 'h'},
	{"saved", no_argument, NULL, 'S'},
	{0, 0, 0, 0}
	};

	/* check options */
	while ((c = getopt_long(argc, argv, ":i:I:RDpvnPLeht:cwbd:S",
	long_options, NULL)) != -1) {
	switch (c) {
	case 'i':
	if (fromname)
	usage(B_FALSE);
	fromname = optarg;
	break;
	case 'I':
	if (fromname)
	usage(B_FALSE);
	fromname = optarg;
	flags.doall = B_TRUE;
	break;
	case 'R':
	flags.replicate = B_TRUE;
	break;
	case 'd':
	redactbook = optarg;
	break;
	case 'p':
	flags.props = B_TRUE;
	break;
	case 'b':
	flags.backup = B_TRUE;
	break;
	case 'h':
	flags.holds = B_TRUE;
	break;
	case 'P':
	flags.parsable = B_TRUE;
	break;
	case 'v':
	flags.verbosity++;
	flags.progress = B_TRUE;
	break;
	case 'D':
	(void) fprintf(stderr,
	gettext("WARNING: deduplicated send is no "
	"longer supported. A regular,\n"
	"non-deduplicated stream will be generated.\n\n"));
	break;
	case 'n':
	flags.dryrun = B_TRUE;
	break;
	case 'L':
	flags.largeblock = B_TRUE;
	break;
	case 'e':
	flags.embed_data = B_TRUE;
	break;
	case 't':
	resume_token = optarg;
	break;
	case 'c':
	flags.compress = B_TRUE;
	break;
	case 'w':
	flags.raw = B_TRUE;
	flags.compress = B_TRUE;
	flags.embed_data = B_TRUE;
	flags.largeblock = B_TRUE;
	break;
	case 'S':
	flags.saved = B_TRUE;
	break;
	case ':':
	/*
	* If a parameter was not passed, optopt contains the
	* value that would normally lead us into the
	* appropriate case statement. If it's > 256, then this
	* must be a longopt and we should look at argv to get
	* the string. Otherwise it's just the character, so we
	* should use it directly.
	*/
	if (optopt <= UINT8_MAX) {
	(void) fprintf(stderr,
	gettext("missing argument for '%c' "
	"option\n"), optopt);
	} else {
	(void) fprintf(stderr,
	gettext("missing argument for '%s' "
	"option\n"), argv[optind - 1]);
	}
	usage(B_FALSE);
	break;
	case '?':
	/FALLTHROUGH/
	default:
	/*
	* If an invalid flag was passed, optopt contains the
	* character if it was a short flag, or 0 if it was a
	* longopt.
	*/
	if (optopt != 0) {
	(void) fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	} else {
	(void) fprintf(stderr,
	gettext("invalid option '%s'\n"),
	argv[optind - 1]);

	}
	usage(B_FALSE);
	}
	}

	if (flags.parsable && flags.verbosity == 0)
	flags.verbosity = 1;

	argc -= optind;
	argv += optind;

	if (resume_token != NULL) {
	if (fromname != NULL \|\| flags.replicate \|\| flags.props \|\|
	flags.backup \|\| flags.holds \|\|
	flags.saved \|\| redactbook != NULL) {
	(void) fprintf(stderr,
	gettext("invalid flags combined with -t\n"));
	usage(B_FALSE);
	}
	if (argc > 0) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}
	} else {
	if (argc < 1) {
	(void) fprintf(stderr,
	gettext("missing snapshot argument\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}
	}

	if (flags.saved) {
	if (fromname != NULL \|\| flags.replicate \|\| flags.props \|\|
	flags.doall \|\| flags.backup \|\|
	flags.holds \|\| flags.largeblock \|\| flags.embed_data \|\|
	flags.compress \|\| flags.raw \|\| redactbook != NULL) {
	(void) fprintf(stderr, gettext("incompatible flags "
	"combined with saved send flag\n"));
	usage(B_FALSE);
	}
	if (strchr(argv[0], '@') != NULL) {
	(void) fprintf(stderr, gettext("saved send must "
	"specify the dataset with partially-received "
	"state\n"));
	usage(B_FALSE);
	}
	}

	if (flags.raw && redactbook != NULL) {
	(void) fprintf(stderr,
	gettext("Error: raw sends may not be redacted.\n"));
	return (1);
	}

	if (!flags.dryrun && isatty(STDOUT_FILENO)) {
	(void) fprintf(stderr,
	gettext("Error: Stream can not be written to a terminal.\n"
	"You must redirect standard output.\n"));
	return (1);
	}

	if (flags.saved) {
	zhp = zfs_open(g_zfs, argv[0], ZFS_TYPE_DATASET);
	if (zhp == NULL)
	return (1);

	err = zfs_send_saved(zhp, &flags, STDOUT_FILENO,
	resume_token);
	zfs_close(zhp);
	return (err != 0);
	} else if (resume_token != NULL) {
	return (zfs_send_resume(g_zfs, &flags, STDOUT_FILENO,
	resume_token));
	}

	/*
	* For everything except -R and -I, use the new, cleaner code path.
	*/
	if (!(flags.replicate \|\| flags.doall)) {
	char frombuf[ZFS_MAX_DATASET_NAME_LEN];

	if (fromname != NULL && (strchr(fromname, '#') == NULL &&
	strchr(fromname, '@') == NULL)) {
	/*
	* Neither bookmark or snapshot was specified. Print a
	* warning, and assume snapshot.
	*/
	(void) fprintf(stderr, "Warning: incremental source "
	"didn't specify type, assuming snapshot. Use '@' "
	"or '#' prefix to avoid ambiguity.\n");
	(void) snprintf(frombuf, sizeof (frombuf), "@%s",
	fromname);
	fromname = frombuf;
	}
	if (fromname != NULL &&
	(fromname[0] == '#' \|\| fromname[0] == '@')) {
	/*
	* Incremental source name begins with # or @.
	* Default to same fs as target.
	*/
	char tmpbuf[ZFS_MAX_DATASET_NAME_LEN];
	(void) strlcpy(tmpbuf, fromname, sizeof (tmpbuf));
	(void) strlcpy(frombuf, argv[0], sizeof (frombuf));
	cp = strchr(frombuf, '@');
	if (cp != NULL)
	*cp = '\0';
	(void) strlcat(frombuf, tmpbuf, sizeof (frombuf));
	fromname = frombuf;
	}

	zhp = zfs_open(g_zfs, argv[0], ZFS_TYPE_DATASET);
	if (zhp == NULL)
	return (1);
	err = zfs_send_one(zhp, fromname, STDOUT_FILENO, &flags,
	redactbook);
	zfs_close(zhp);
	return (err != 0);
	}

	if (fromname != NULL && strchr(fromname, '#')) {
	(void) fprintf(stderr,
	gettext("Error: multiple snapshots cannot be "
	"sent from a bookmark.\n"));
	return (1);
	}

	if (redactbook != NULL) {
	(void) fprintf(stderr, gettext("Error: multiple snapshots "
	"cannot be sent redacted.\n"));
	return (1);
	}

	if ((cp = strchr(argv[0], '@')) == NULL) {
	(void) fprintf(stderr, gettext("Error: "
	"Unsupported flag with filesystem or bookmark.\n"));
	return (1);
	}
	*cp = '\0';
	toname = cp + 1;
	zhp = zfs_open(g_zfs, argv[0], ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL)
	return (1);

	/*
	* If they specified the full path to the snapshot, chop off
	* everything except the short name of the snapshot, but special
	* case if they specify the origin.
	*/
	if (fromname && (cp = strchr(fromname, '@')) != NULL) {
	char origin[ZFS_MAX_DATASET_NAME_LEN];
	zprop_source_t src;

	(void) zfs_prop_get(zhp, ZFS_PROP_ORIGIN,
	origin, sizeof (origin), &src, NULL, 0, B_FALSE);

	if (strcmp(origin, fromname) == 0) {
	fromname = NULL;
	flags.fromorigin = B_TRUE;
	} else {
	*cp = '\0';
	if (cp != fromname && strcmp(argv[0], fromname)) {
	(void) fprintf(stderr,
	gettext("incremental source must be "
	"in same filesystem\n"));
	usage(B_FALSE);
	}
	fromname = cp + 1;
	if (strchr(fromname, '@') \|\| strchr(fromname, '/')) {
	(void) fprintf(stderr,
	gettext("invalid incremental source\n"));
	usage(B_FALSE);
	}
	}
	}

	if (flags.replicate && fromname == NULL)
	flags.doall = B_TRUE;

	err = zfs_send(zhp, fromname, toname, &flags, STDOUT_FILENO, NULL, 0,
	flags.verbosity >= 3 ? &dbgnv : NULL);

	if (flags.verbosity >= 3 && dbgnv != NULL) {
	/*
	* dump_nvlist prints to stdout, but that's been
	* redirected to a file. Make it print to stderr
	* instead.
	*/
	(void) dup2(STDERR_FILENO, STDOUT_FILENO);
	dump_nvlist(dbgnv, 0);
	nvlist_free(dbgnv);
	}
	zfs_close(zhp);

	return (err != 0);
	}

	/*
	* Restore a backup stream from stdin.
	*/
	static int
	zfs_do_receive(int argc, char **argv)
	{
	int c, err = 0;
	recvflags_t flags = { 0 };
	boolean_t abort_resumable = B_FALSE;
	nvlist_t *props;

	if (nvlist_alloc(&props, NV_UNIQUE_NAME, 0) != 0)
	nomem();

	/* check options */
	while ((c = getopt(argc, argv, ":o:x:dehMnuvFsA")) != -1) {
	switch (c) {
	case 'o':
	if (!parseprop(props, optarg)) {
	nvlist_free(props);
	usage(B_FALSE);
	}
	break;
	case 'x':
	if (!parsepropname(props, optarg)) {
	nvlist_free(props);
	usage(B_FALSE);
	}
	break;
	case 'd':
	if (flags.istail) {
	(void) fprintf(stderr, gettext("invalid option "
	"combination: -d and -e are mutually "
	"exclusive\n"));
	usage(B_FALSE);
	}
	flags.isprefix = B_TRUE;
	break;
	case 'e':
	if (flags.isprefix) {
	(void) fprintf(stderr, gettext("invalid option "
	"combination: -d and -e are mutually "
	"exclusive\n"));
	usage(B_FALSE);
	}
	flags.istail = B_TRUE;
	break;
	case 'h':
	flags.skipholds = B_TRUE;
	break;
	case 'M':
	flags.forceunmount = B_TRUE;
	break;
	case 'n':
	flags.dryrun = B_TRUE;
	break;
	case 'u':
	flags.nomount = B_TRUE;
	break;
	case 'v':
	flags.verbose = B_TRUE;
	break;
	case 's':
	flags.resumable = B_TRUE;
	break;
	case 'F':
	flags.force = B_TRUE;
	break;
	case 'A':
	abort_resumable = B_TRUE;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* zfs recv -e (use "tail" name) implies -d (remove dataset "head") */
	if (flags.istail)
	flags.isprefix = B_TRUE;

	/* check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing snapshot argument\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	if (abort_resumable) {
	if (flags.isprefix \|\| flags.istail \|\| flags.dryrun \|\|
	flags.resumable \|\| flags.nomount) {
	(void) fprintf(stderr, gettext("invalid option\n"));
	usage(B_FALSE);
	}

	char namebuf[ZFS_MAX_DATASET_NAME_LEN];
	(void) snprintf(namebuf, sizeof (namebuf),
	"%s/%%recv", argv[0]);

	if (zfs_dataset_exists(g_zfs, namebuf,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME)) {
	zfs_handle_t *zhp = zfs_open(g_zfs,
	namebuf, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL) {
	nvlist_free(props);
	return (1);
	}
	err = zfs_destroy(zhp, B_FALSE);
	zfs_close(zhp);
	} else {
	zfs_handle_t *zhp = zfs_open(g_zfs,
	argv[0], ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL)
	usage(B_FALSE);
	if (!zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT) \|\|
	zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
	NULL, 0, NULL, NULL, 0, B_TRUE) == -1) {
	(void) fprintf(stderr,
	gettext("'%s' does not have any "
	"resumable receive state to abort\n"),
	argv[0]);
	nvlist_free(props);
	zfs_close(zhp);
	return (1);
	}
	err = zfs_destroy(zhp, B_FALSE);
	zfs_close(zhp);
	}
	nvlist_free(props);
	return (err != 0);
	}

	if (isatty(STDIN_FILENO)) {
	(void) fprintf(stderr,
	gettext("Error: Backup stream can not be read "
	"from a terminal.\n"
	"You must redirect standard input.\n"));
	nvlist_free(props);
	return (1);
	}
	err = zfs_receive(g_zfs, argv[0], props, &flags, STDIN_FILENO, NULL);
	nvlist_free(props);

	return (err != 0);
	}

	/*
	* allow/unallow stuff
	*/
	/* copied from zfs/sys/dsl_deleg.h */
	#define ZFS_DELEG_PERM_CREATE "create"
	#define ZFS_DELEG_PERM_DESTROY "destroy"
	#define ZFS_DELEG_PERM_SNAPSHOT "snapshot"
	#define ZFS_DELEG_PERM_ROLLBACK "rollback"
	#define ZFS_DELEG_PERM_CLONE "clone"
	#define ZFS_DELEG_PERM_PROMOTE "promote"
	#define ZFS_DELEG_PERM_RENAME "rename"
	#define ZFS_DELEG_PERM_MOUNT "mount"
	#define ZFS_DELEG_PERM_SHARE "share"
	#define ZFS_DELEG_PERM_SEND "send"
	#define ZFS_DELEG_PERM_RECEIVE "receive"
	#define ZFS_DELEG_PERM_ALLOW "allow"
	#define ZFS_DELEG_PERM_USERPROP "userprop"
	#define ZFS_DELEG_PERM_VSCAN "vscan" /* ??? */
	#define ZFS_DELEG_PERM_USERQUOTA "userquota"
	#define ZFS_DELEG_PERM_GROUPQUOTA "groupquota"
	#define ZFS_DELEG_PERM_USERUSED "userused"
	#define ZFS_DELEG_PERM_GROUPUSED "groupused"
	#define ZFS_DELEG_PERM_USEROBJQUOTA "userobjquota"
	#define ZFS_DELEG_PERM_GROUPOBJQUOTA "groupobjquota"
	#define ZFS_DELEG_PERM_USEROBJUSED "userobjused"
	#define ZFS_DELEG_PERM_GROUPOBJUSED "groupobjused"

	#define ZFS_DELEG_PERM_HOLD "hold"
	#define ZFS_DELEG_PERM_RELEASE "release"
	#define ZFS_DELEG_PERM_DIFF "diff"
	#define ZFS_DELEG_PERM_BOOKMARK "bookmark"
	#define ZFS_DELEG_PERM_LOAD_KEY "load-key"
	#define ZFS_DELEG_PERM_CHANGE_KEY "change-key"

	#define ZFS_DELEG_PERM_PROJECTUSED "projectused"
	#define ZFS_DELEG_PERM_PROJECTQUOTA "projectquota"
	#define ZFS_DELEG_PERM_PROJECTOBJUSED "projectobjused"
	#define ZFS_DELEG_PERM_PROJECTOBJQUOTA "projectobjquota"

	#define ZFS_NUM_DELEG_NOTES ZFS_DELEG_NOTE_NONE

	static zfs_deleg_perm_tab_t zfs_deleg_perm_tbl[] = {
	{ ZFS_DELEG_PERM_ALLOW, ZFS_DELEG_NOTE_ALLOW },
	{ ZFS_DELEG_PERM_CLONE, ZFS_DELEG_NOTE_CLONE },
	{ ZFS_DELEG_PERM_CREATE, ZFS_DELEG_NOTE_CREATE },
	{ ZFS_DELEG_PERM_DESTROY, ZFS_DELEG_NOTE_DESTROY },
	{ ZFS_DELEG_PERM_DIFF, ZFS_DELEG_NOTE_DIFF},
	{ ZFS_DELEG_PERM_HOLD, ZFS_DELEG_NOTE_HOLD },
	{ ZFS_DELEG_PERM_MOUNT, ZFS_DELEG_NOTE_MOUNT },
	{ ZFS_DELEG_PERM_PROMOTE, ZFS_DELEG_NOTE_PROMOTE },
	{ ZFS_DELEG_PERM_RECEIVE, ZFS_DELEG_NOTE_RECEIVE },
	{ ZFS_DELEG_PERM_RELEASE, ZFS_DELEG_NOTE_RELEASE },
	{ ZFS_DELEG_PERM_RENAME, ZFS_DELEG_NOTE_RENAME },
	{ ZFS_DELEG_PERM_ROLLBACK, ZFS_DELEG_NOTE_ROLLBACK },
	{ ZFS_DELEG_PERM_SEND, ZFS_DELEG_NOTE_SEND },
	{ ZFS_DELEG_PERM_SHARE, ZFS_DELEG_NOTE_SHARE },
	{ ZFS_DELEG_PERM_SNAPSHOT, ZFS_DELEG_NOTE_SNAPSHOT },
	{ ZFS_DELEG_PERM_BOOKMARK, ZFS_DELEG_NOTE_BOOKMARK },
	{ ZFS_DELEG_PERM_LOAD_KEY, ZFS_DELEG_NOTE_LOAD_KEY },
	{ ZFS_DELEG_PERM_CHANGE_KEY, ZFS_DELEG_NOTE_CHANGE_KEY },

	{ ZFS_DELEG_PERM_GROUPQUOTA, ZFS_DELEG_NOTE_GROUPQUOTA },
	{ ZFS_DELEG_PERM_GROUPUSED, ZFS_DELEG_NOTE_GROUPUSED },
	{ ZFS_DELEG_PERM_USERPROP, ZFS_DELEG_NOTE_USERPROP },
	{ ZFS_DELEG_PERM_USERQUOTA, ZFS_DELEG_NOTE_USERQUOTA },
	{ ZFS_DELEG_PERM_USERUSED, ZFS_DELEG_NOTE_USERUSED },
	{ ZFS_DELEG_PERM_USEROBJQUOTA, ZFS_DELEG_NOTE_USEROBJQUOTA },
	{ ZFS_DELEG_PERM_USEROBJUSED, ZFS_DELEG_NOTE_USEROBJUSED },
	{ ZFS_DELEG_PERM_GROUPOBJQUOTA, ZFS_DELEG_NOTE_GROUPOBJQUOTA },
	{ ZFS_DELEG_PERM_GROUPOBJUSED, ZFS_DELEG_NOTE_GROUPOBJUSED },
	{ ZFS_DELEG_PERM_PROJECTUSED, ZFS_DELEG_NOTE_PROJECTUSED },
	{ ZFS_DELEG_PERM_PROJECTQUOTA, ZFS_DELEG_NOTE_PROJECTQUOTA },
	{ ZFS_DELEG_PERM_PROJECTOBJUSED, ZFS_DELEG_NOTE_PROJECTOBJUSED },
	{ ZFS_DELEG_PERM_PROJECTOBJQUOTA, ZFS_DELEG_NOTE_PROJECTOBJQUOTA },
	{ NULL, ZFS_DELEG_NOTE_NONE }
	};

	/* permission structure */
	typedef struct deleg_perm {
	zfs_deleg_who_type_t dp_who_type;
	const char *dp_name;
	boolean_t dp_local;
	boolean_t dp_descend;
	} deleg_perm_t;

	/* */
	typedef struct deleg_perm_node {
	deleg_perm_t dpn_perm;

	uu_avl_node_t dpn_avl_node;
	} deleg_perm_node_t;

	typedef struct fs_perm fs_perm_t;

	/* permissions set */
	typedef struct who_perm {
	zfs_deleg_who_type_t who_type;
	const char who_name; / id */
	char who_ug_name[256]; /* user/group name */
	fs_perm_t who_fsperm; / uplink */

	uu_avl_t who_deleg_perm_avl; / permissions */
	} who_perm_t;

	/* */
	typedef struct who_perm_node {
	who_perm_t who_perm;
	uu_avl_node_t who_avl_node;
	} who_perm_node_t;

	typedef struct fs_perm_set fs_perm_set_t;
	/* fs permissions */
	struct fs_perm {
	const char *fsp_name;

	uu_avl_t fsp_sc_avl; / sets,create */
	uu_avl_t fsp_uge_avl; / user,group,everyone */

	fs_perm_set_t fsp_set; / uplink */
	};

	/* */
	typedef struct fs_perm_node {
	fs_perm_t fspn_fsperm;
	uu_avl_t *fspn_avl;

	uu_list_node_t fspn_list_node;
	} fs_perm_node_t;

	/* top level structure */
	struct fs_perm_set {
	uu_list_pool_t *fsps_list_pool;
	uu_list_t fsps_list; / list of fs_perms */

	uu_avl_pool_t *fsps_named_set_avl_pool;
	uu_avl_pool_t *fsps_who_perm_avl_pool;
	uu_avl_pool_t *fsps_deleg_perm_avl_pool;
	};

	static inline const char *
	deleg_perm_type(zfs_deleg_note_t note)
	{
	/* subcommands */
	switch (note) {
	/* SUBCOMMANDS */
	/* OTHER */
	case ZFS_DELEG_NOTE_GROUPQUOTA:
	case ZFS_DELEG_NOTE_GROUPUSED:
	case ZFS_DELEG_NOTE_USERPROP:
	case ZFS_DELEG_NOTE_USERQUOTA:
	case ZFS_DELEG_NOTE_USERUSED:
	case ZFS_DELEG_NOTE_USEROBJQUOTA:
	case ZFS_DELEG_NOTE_USEROBJUSED:
	case ZFS_DELEG_NOTE_GROUPOBJQUOTA:
	case ZFS_DELEG_NOTE_GROUPOBJUSED:
	case ZFS_DELEG_NOTE_PROJECTUSED:
	case ZFS_DELEG_NOTE_PROJECTQUOTA:
	case ZFS_DELEG_NOTE_PROJECTOBJUSED:
	case ZFS_DELEG_NOTE_PROJECTOBJQUOTA:
	/* other */
	return (gettext("other"));
	default:
	return (gettext("subcommand"));
	}
	}

	static int
	who_type2weight(zfs_deleg_who_type_t who_type)
	{
	int res;
	switch (who_type) {
	case ZFS_DELEG_NAMED_SET_SETS:
	case ZFS_DELEG_NAMED_SET:
	res = 0;
	break;
	case ZFS_DELEG_CREATE_SETS:
	case ZFS_DELEG_CREATE:
	res = 1;
	break;
	case ZFS_DELEG_USER_SETS:
	case ZFS_DELEG_USER:
	res = 2;
	break;
	case ZFS_DELEG_GROUP_SETS:
	case ZFS_DELEG_GROUP:
	res = 3;
	break;
	case ZFS_DELEG_EVERYONE_SETS:
	case ZFS_DELEG_EVERYONE:
	res = 4;
	break;
	default:
	res = -1;
	}

	return (res);
	}

	/* ARGSUSED */
	static int
	who_perm_compare(const void larg, const void rarg, void *unused)
	{
	const who_perm_node_t *l = larg;
	const who_perm_node_t *r = rarg;
	zfs_deleg_who_type_t ltype = l->who_perm.who_type;
	zfs_deleg_who_type_t rtype = r->who_perm.who_type;
	int lweight = who_type2weight(ltype);
	int rweight = who_type2weight(rtype);
	int res = lweight - rweight;
	if (res == 0)
	res = strncmp(l->who_perm.who_name, r->who_perm.who_name,
	ZFS_MAX_DELEG_NAME-1);

	if (res == 0)
	return (0);
	if (res > 0)
	return (1);
	else
	return (-1);
	}

	/* ARGSUSED */
	static int
	deleg_perm_compare(const void larg, const void rarg, void *unused)
	{
	const deleg_perm_node_t *l = larg;
	const deleg_perm_node_t *r = rarg;
	int res = strncmp(l->dpn_perm.dp_name, r->dpn_perm.dp_name,
	ZFS_MAX_DELEG_NAME-1);

	if (res == 0)
	return (0);

	if (res > 0)
	return (1);
	else
	return (-1);
	}

	static inline void
	fs_perm_set_init(fs_perm_set_t *fspset)
	{
	bzero(fspset, sizeof (fs_perm_set_t));

	if ((fspset->fsps_list_pool = uu_list_pool_create("fsps_list_pool",
	sizeof (fs_perm_node_t), offsetof(fs_perm_node_t, fspn_list_node),
	NULL, UU_DEFAULT)) == NULL)
	nomem();
	if ((fspset->fsps_list = uu_list_create(fspset->fsps_list_pool, NULL,
	UU_DEFAULT)) == NULL)
	nomem();

	if ((fspset->fsps_named_set_avl_pool = uu_avl_pool_create(
	"named_set_avl_pool", sizeof (who_perm_node_t), offsetof(
	who_perm_node_t, who_avl_node), who_perm_compare,
	UU_DEFAULT)) == NULL)
	nomem();

	if ((fspset->fsps_who_perm_avl_pool = uu_avl_pool_create(
	"who_perm_avl_pool", sizeof (who_perm_node_t), offsetof(
	who_perm_node_t, who_avl_node), who_perm_compare,
	UU_DEFAULT)) == NULL)
	nomem();

	if ((fspset->fsps_deleg_perm_avl_pool = uu_avl_pool_create(
	"deleg_perm_avl_pool", sizeof (deleg_perm_node_t), offsetof(
	deleg_perm_node_t, dpn_avl_node), deleg_perm_compare, UU_DEFAULT))
	== NULL)
	nomem();
	}

	static inline void fs_perm_fini(fs_perm_t *);
	static inline void who_perm_fini(who_perm_t *);

	static inline void
	fs_perm_set_fini(fs_perm_set_t *fspset)
	{
	fs_perm_node_t *node = uu_list_first(fspset->fsps_list);

	while (node != NULL) {
	fs_perm_node_t *next_node =
	uu_list_next(fspset->fsps_list, node);
	fs_perm_t *fsperm = &node->fspn_fsperm;
	fs_perm_fini(fsperm);
	uu_list_remove(fspset->fsps_list, node);
	free(node);
	node = next_node;
	}

	uu_avl_pool_destroy(fspset->fsps_named_set_avl_pool);
	uu_avl_pool_destroy(fspset->fsps_who_perm_avl_pool);
	uu_avl_pool_destroy(fspset->fsps_deleg_perm_avl_pool);
	}

	static inline void
	deleg_perm_init(deleg_perm_t *deleg_perm, zfs_deleg_who_type_t type,
	const char *name)
	{
	deleg_perm->dp_who_type = type;
	deleg_perm->dp_name = name;
	}

	static inline void
	who_perm_init(who_perm_t who_perm, fs_perm_t fsperm,
	zfs_deleg_who_type_t type, const char *name)
	{
	uu_avl_pool_t *pool;
	pool = fsperm->fsp_set->fsps_deleg_perm_avl_pool;

	bzero(who_perm, sizeof (who_perm_t));

	if ((who_perm->who_deleg_perm_avl = uu_avl_create(pool, NULL,
	UU_DEFAULT)) == NULL)
	nomem();

	who_perm->who_type = type;
	who_perm->who_name = name;
	who_perm->who_fsperm = fsperm;
	}

	static inline void
	who_perm_fini(who_perm_t *who_perm)
	{
	deleg_perm_node_t *node = uu_avl_first(who_perm->who_deleg_perm_avl);

	while (node != NULL) {
	deleg_perm_node_t *next_node =
	uu_avl_next(who_perm->who_deleg_perm_avl, node);

	uu_avl_remove(who_perm->who_deleg_perm_avl, node);
	free(node);
	node = next_node;
	}

	uu_avl_destroy(who_perm->who_deleg_perm_avl);
	}

	static inline void
	fs_perm_init(fs_perm_t fsperm, fs_perm_set_t fspset, const char *fsname)
	{
	uu_avl_pool_t *nset_pool = fspset->fsps_named_set_avl_pool;
	uu_avl_pool_t *who_pool = fspset->fsps_who_perm_avl_pool;

	bzero(fsperm, sizeof (fs_perm_t));

	if ((fsperm->fsp_sc_avl = uu_avl_create(nset_pool, NULL, UU_DEFAULT))
	== NULL)
	nomem();

	if ((fsperm->fsp_uge_avl = uu_avl_create(who_pool, NULL, UU_DEFAULT))
	== NULL)
	nomem();

	fsperm->fsp_set = fspset;
	fsperm->fsp_name = fsname;
	}

	static inline void
	fs_perm_fini(fs_perm_t *fsperm)
	{
	who_perm_node_t *node = uu_avl_first(fsperm->fsp_sc_avl);
	while (node != NULL) {
	who_perm_node_t *next_node = uu_avl_next(fsperm->fsp_sc_avl,
	node);
	who_perm_t *who_perm = &node->who_perm;
	who_perm_fini(who_perm);
	uu_avl_remove(fsperm->fsp_sc_avl, node);
	free(node);
	node = next_node;
	}

	node = uu_avl_first(fsperm->fsp_uge_avl);
	while (node != NULL) {
	who_perm_node_t *next_node = uu_avl_next(fsperm->fsp_uge_avl,
	node);
	who_perm_t *who_perm = &node->who_perm;
	who_perm_fini(who_perm);
	uu_avl_remove(fsperm->fsp_uge_avl, node);
	free(node);
	node = next_node;
	}

	uu_avl_destroy(fsperm->fsp_sc_avl);
	uu_avl_destroy(fsperm->fsp_uge_avl);
	}

	static void
	set_deleg_perm_node(uu_avl_t avl, deleg_perm_node_t node,
	zfs_deleg_who_type_t who_type, const char *name, char locality)
	{
	uu_avl_index_t idx = 0;

	deleg_perm_node_t *found_node = NULL;
	deleg_perm_t *deleg_perm = &node->dpn_perm;

	deleg_perm_init(deleg_perm, who_type, name);

	if ((found_node = uu_avl_find(avl, node, NULL, &idx))
	== NULL)
	uu_avl_insert(avl, node, idx);
	else {
	node = found_node;
	deleg_perm = &node->dpn_perm;
	}


	switch (locality) {
	case ZFS_DELEG_LOCAL:
	deleg_perm->dp_local = B_TRUE;
	break;
	case ZFS_DELEG_DESCENDENT:
	deleg_perm->dp_descend = B_TRUE;
	break;
	case ZFS_DELEG_NA:
	break;
	default:
	assert(B_FALSE); /* invalid locality */
	}
	}

	static inline int
	parse_who_perm(who_perm_t who_perm, nvlist_t nvl, char locality)
	{
	nvpair_t *nvp = NULL;
	fs_perm_set_t *fspset = who_perm->who_fsperm->fsp_set;
	uu_avl_t *avl = who_perm->who_deleg_perm_avl;
	zfs_deleg_who_type_t who_type = who_perm->who_type;

	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
	const char *name = nvpair_name(nvp);
	data_type_t type = nvpair_type(nvp);
	uu_avl_pool_t *avl_pool = fspset->fsps_deleg_perm_avl_pool;
	deleg_perm_node_t *node =
	safe_malloc(sizeof (deleg_perm_node_t));

	VERIFY(type == DATA_TYPE_BOOLEAN);

	uu_avl_node_init(node, &node->dpn_avl_node, avl_pool);
	set_deleg_perm_node(avl, node, who_type, name, locality);
	}

	return (0);
	}

	static inline int
	parse_fs_perm(fs_perm_t fsperm, nvlist_t nvl)
	{
	nvpair_t *nvp = NULL;
	fs_perm_set_t *fspset = fsperm->fsp_set;

	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
	nvlist_t *nvl2 = NULL;
	const char *name = nvpair_name(nvp);
	uu_avl_t *avl = NULL;
	uu_avl_pool_t *avl_pool = NULL;
	zfs_deleg_who_type_t perm_type = name[0];
	char perm_locality = name[1];
	const char *perm_name = name + 3;
	who_perm_t *who_perm = NULL;

	assert('$' == name[2]);

	if (nvpair_value_nvlist(nvp, &nvl2) != 0)
	return (-1);

	switch (perm_type) {
	case ZFS_DELEG_CREATE:
	case ZFS_DELEG_CREATE_SETS:
	case ZFS_DELEG_NAMED_SET:
	case ZFS_DELEG_NAMED_SET_SETS:
	avl_pool = fspset->fsps_named_set_avl_pool;
	avl = fsperm->fsp_sc_avl;
	break;
	case ZFS_DELEG_USER:
	case ZFS_DELEG_USER_SETS:
	case ZFS_DELEG_GROUP:
	case ZFS_DELEG_GROUP_SETS:
	case ZFS_DELEG_EVERYONE:
	case ZFS_DELEG_EVERYONE_SETS:
	avl_pool = fspset->fsps_who_perm_avl_pool;
	avl = fsperm->fsp_uge_avl;
	break;

	default:
	assert(!"unhandled zfs_deleg_who_type_t");
	}

	who_perm_node_t *found_node = NULL;
	who_perm_node_t *node = safe_malloc(
	sizeof (who_perm_node_t));
	who_perm = &node->who_perm;
	uu_avl_index_t idx = 0;

	uu_avl_node_init(node, &node->who_avl_node, avl_pool);
	who_perm_init(who_perm, fsperm, perm_type, perm_name);

	if ((found_node = uu_avl_find(avl, node, NULL, &idx))
	== NULL) {
	if (avl == fsperm->fsp_uge_avl) {
	uid_t rid = 0;
	struct passwd *p = NULL;
	struct group *g = NULL;
	const char *nice_name = NULL;

	switch (perm_type) {
	case ZFS_DELEG_USER_SETS:
	case ZFS_DELEG_USER:
	rid = atoi(perm_name);
	p = getpwuid(rid);
	if (p)
	nice_name = p->pw_name;
	break;
	case ZFS_DELEG_GROUP_SETS:
	case ZFS_DELEG_GROUP:
	rid = atoi(perm_name);
	g = getgrgid(rid);
	if (g)
	nice_name = g->gr_name;
	break;

	default:
	break;
	}

	if (nice_name != NULL) {
	(void) strlcpy(
	node->who_perm.who_ug_name,
	nice_name, 256);
	} else {
	/* User or group unknown */
	(void) snprintf(
	node->who_perm.who_ug_name,
	sizeof (node->who_perm.who_ug_name),
	"(unknown: %d)", rid);
	}
	}

	uu_avl_insert(avl, node, idx);
	} else {
	node = found_node;
	who_perm = &node->who_perm;
	}

	assert(who_perm != NULL);
	(void) parse_who_perm(who_perm, nvl2, perm_locality);
	}

	return (0);
	}

	static inline int
	parse_fs_perm_set(fs_perm_set_t fspset, nvlist_t nvl)
	{
	nvpair_t *nvp = NULL;
	uu_avl_index_t idx = 0;

	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
	nvlist_t *nvl2 = NULL;
	const char *fsname = nvpair_name(nvp);
	data_type_t type = nvpair_type(nvp);
	fs_perm_t *fsperm = NULL;
	fs_perm_node_t *node = safe_malloc(sizeof (fs_perm_node_t));
	if (node == NULL)
	nomem();

	fsperm = &node->fspn_fsperm;

	VERIFY(DATA_TYPE_NVLIST == type);

	uu_list_node_init(node, &node->fspn_list_node,
	fspset->fsps_list_pool);

	idx = uu_list_numnodes(fspset->fsps_list);
	fs_perm_init(fsperm, fspset, fsname);

	if (nvpair_value_nvlist(nvp, &nvl2) != 0)
	return (-1);

	(void) parse_fs_perm(fsperm, nvl2);

	uu_list_insert(fspset->fsps_list, node, idx);
	}

	return (0);
	}

	static inline const char *
	deleg_perm_comment(zfs_deleg_note_t note)
	{
	const char *str = "";

	/* subcommands */
	switch (note) {
	/* SUBCOMMANDS */
	case ZFS_DELEG_NOTE_ALLOW:
	str = gettext("Must also have the permission that is being"
	"\n\t\t\t\tallowed");
	break;
	case ZFS_DELEG_NOTE_CLONE:
	str = gettext("Must also have the 'create' ability and 'mount'"
	"\n\t\t\t\tability in the origin file system");
	break;
	case ZFS_DELEG_NOTE_CREATE:
	str = gettext("Must also have the 'mount' ability");
	break;
	case ZFS_DELEG_NOTE_DESTROY:
	str = gettext("Must also have the 'mount' ability");
	break;
	case ZFS_DELEG_NOTE_DIFF:
	str = gettext("Allows lookup of paths within a dataset;"
	"\n\t\t\t\tgiven an object number. Ordinary users need this"
	"\n\t\t\t\tin order to use zfs diff");
	break;
	case ZFS_DELEG_NOTE_HOLD:
	str = gettext("Allows adding a user hold to a snapshot");
	break;
	case ZFS_DELEG_NOTE_MOUNT:
	str = gettext("Allows mount/umount of ZFS datasets");
	break;
	case ZFS_DELEG_NOTE_PROMOTE:
	str = gettext("Must also have the 'mount'\n\t\t\t\tand"
	" 'promote' ability in the origin file system");
	break;
	case ZFS_DELEG_NOTE_RECEIVE:
	str = gettext("Must also have the 'mount' and 'create'"
	" ability");
	break;
	case ZFS_DELEG_NOTE_RELEASE:
	str = gettext("Allows releasing a user hold which\n\t\t\t\t"
	"might destroy the snapshot");
	break;
	case ZFS_DELEG_NOTE_RENAME:
	str = gettext("Must also have the 'mount' and 'create'"
	"\n\t\t\t\tability in the new parent");
	break;
	case ZFS_DELEG_NOTE_ROLLBACK:
	str = gettext("");
	break;
	case ZFS_DELEG_NOTE_SEND:
	str = gettext("");
	break;
	case ZFS_DELEG_NOTE_SHARE:
	str = gettext("Allows sharing file systems over NFS or SMB"
	"\n\t\t\t\tprotocols");
	break;
	case ZFS_DELEG_NOTE_SNAPSHOT:
	str = gettext("");
	break;
	case ZFS_DELEG_NOTE_LOAD_KEY:
	str = gettext("Allows loading or unloading an encryption key");
	break;
	case ZFS_DELEG_NOTE_CHANGE_KEY:
	str = gettext("Allows changing or adding an encryption key");
	break;
	/*
	* case ZFS_DELEG_NOTE_VSCAN:
	* str = gettext("");
	* break;
	*/
	/* OTHER */
	case ZFS_DELEG_NOTE_GROUPQUOTA:
	str = gettext("Allows accessing any groupquota@... property");
	break;
	case ZFS_DELEG_NOTE_GROUPUSED:
	str = gettext("Allows reading any groupused@... property");
	break;
	case ZFS_DELEG_NOTE_USERPROP:
	str = gettext("Allows changing any user property");
	break;
	case ZFS_DELEG_NOTE_USERQUOTA:
	str = gettext("Allows accessing any userquota@... property");
	break;
	case ZFS_DELEG_NOTE_USERUSED:
	str = gettext("Allows reading any userused@... property");
	break;
	case ZFS_DELEG_NOTE_USEROBJQUOTA:
	str = gettext("Allows accessing any userobjquota@... property");
	break;
	case ZFS_DELEG_NOTE_GROUPOBJQUOTA:
	str = gettext("Allows accessing any \n\t\t\t\t"
	"groupobjquota@... property");
	break;
	case ZFS_DELEG_NOTE_GROUPOBJUSED:
	str = gettext("Allows reading any groupobjused@... property");
	break;
	case ZFS_DELEG_NOTE_USEROBJUSED:
	str = gettext("Allows reading any userobjused@... property");
	break;
	case ZFS_DELEG_NOTE_PROJECTQUOTA:
	str = gettext("Allows accessing any projectquota@... property");
	break;
	case ZFS_DELEG_NOTE_PROJECTOBJQUOTA:
	str = gettext("Allows accessing any \n\t\t\t\t"
	"projectobjquota@... property");
	break;
	case ZFS_DELEG_NOTE_PROJECTUSED:
	str = gettext("Allows reading any projectused@... property");
	break;
	case ZFS_DELEG_NOTE_PROJECTOBJUSED:
	str = gettext("Allows accessing any \n\t\t\t\t"
	"projectobjused@... property");
	break;
	/* other */
	default:
	str = "";
	}

	return (str);
	}

	struct allow_opts {
	boolean_t local;
	boolean_t descend;
	boolean_t user;
	boolean_t group;
	boolean_t everyone;
	boolean_t create;
	boolean_t set;
	boolean_t recursive; /* unallow only */
	boolean_t prt_usage;

	boolean_t prt_perms;
	char *who;
	char *perms;
	const char *dataset;
	};

	static inline int
	prop_cmp(const void a, const void b)
	{
	const char str1 = (const char **)a;
	const char str2 = (const char **)b;
	return (strcmp(str1, str2));
	}

	static void
	allow_usage(boolean_t un, boolean_t requested, const char *msg)
	{
	const char *opt_desc[] = {
	"-h", gettext("show this help message and exit"),
	"-l", gettext("set permission locally"),
	"-d", gettext("set permission for descents"),
	"-u", gettext("set permission for user"),
	"-g", gettext("set permission for group"),
	"-e", gettext("set permission for everyone"),
	"-c", gettext("set create time permission"),
	"-s", gettext("define permission set"),
	/* unallow only */
	"-r", gettext("remove permissions recursively"),
	};
	size_t unallow_size = sizeof (opt_desc) / sizeof (char *);
	size_t allow_size = unallow_size - 2;
	const char *props[ZFS_NUM_PROPS];
	int i;
	size_t count = 0;
	FILE *fp = requested ? stdout : stderr;
	zprop_desc_t *pdtbl = zfs_prop_get_table();
	const char *fmt = gettext("%-16s %-14s\t%s\n");

	(void) fprintf(fp, gettext("Usage: %s\n"), get_usage(un ? HELP_UNALLOW :
	HELP_ALLOW));
	(void) fprintf(fp, gettext("Options:\n"));
	for (i = 0; i < (un ? unallow_size : allow_size); i += 2) {
	const char *opt = opt_desc[i];
	const char *optdsc = opt_desc[i + 1];
	(void) fprintf(fp, gettext(" %-10s %s\n"), opt, optdsc);
	}

	(void) fprintf(fp, gettext("\nThe following permissions are "
	"supported:\n\n"));
	(void) fprintf(fp, fmt, gettext("NAME"), gettext("TYPE"),
	gettext("NOTES"));
	for (i = 0; i < ZFS_NUM_DELEG_NOTES; i++) {
	const char *perm_name = zfs_deleg_perm_tbl[i].z_perm;
	zfs_deleg_note_t perm_note = zfs_deleg_perm_tbl[i].z_note;
	const char *perm_type = deleg_perm_type(perm_note);
	const char *perm_comment = deleg_perm_comment(perm_note);
	(void) fprintf(fp, fmt, perm_name, perm_type, perm_comment);
	}

	for (i = 0; i < ZFS_NUM_PROPS; i++) {
	zprop_desc_t *pd = &pdtbl[i];
	if (pd->pd_visible != B_TRUE)
	continue;

	if (pd->pd_attr == PROP_READONLY)
	continue;

	props[count++] = pd->pd_name;
	}
	props[count] = NULL;

	qsort(props, count, sizeof (char *), prop_cmp);

	for (i = 0; i < count; i++)
	(void) fprintf(fp, fmt, props[i], gettext("property"), "");

	if (msg != NULL)
	(void) fprintf(fp, gettext("\nzfs: error: %s"), msg);

	exit(requested ? 0 : 2);
	}

	static inline const char *
	munge_args(int argc, char **argv, boolean_t un, size_t expected_argc,
	char **permsp)
	{
	if (un && argc == expected_argc - 1)
	*permsp = NULL;
	else if (argc == expected_argc)
	*permsp = argv[argc - 2];
	else
	allow_usage(un, B_FALSE,
	gettext("wrong number of parameters\n"));

	return (argv[argc - 1]);
	}

	static void
	parse_allow_args(int argc, char *argv, boolean_t un, struct allow_opts opts)
	{
	int uge_sum = opts->user + opts->group + opts->everyone;
	int csuge_sum = opts->create + opts->set + uge_sum;
	int ldcsuge_sum = csuge_sum + opts->local + opts->descend;
	int all_sum = un ? ldcsuge_sum + opts->recursive : ldcsuge_sum;

	if (uge_sum > 1)
	allow_usage(un, B_FALSE,
	gettext("-u, -g, and -e are mutually exclusive\n"));

	if (opts->prt_usage) {
	if (argc == 0 && all_sum == 0)
	allow_usage(un, B_TRUE, NULL);
	else
	usage(B_FALSE);
	}

	if (opts->set) {
	if (csuge_sum > 1)
	allow_usage(un, B_FALSE,
	gettext("invalid options combined with -s\n"));

	opts->dataset = munge_args(argc, argv, un, 3, &opts->perms);
	if (argv[0][0] != '@')
	allow_usage(un, B_FALSE,
	gettext("invalid set name: missing '@' prefix\n"));
	opts->who = argv[0];
	} else if (opts->create) {
	if (ldcsuge_sum > 1)
	allow_usage(un, B_FALSE,
	gettext("invalid options combined with -c\n"));
	opts->dataset = munge_args(argc, argv, un, 2, &opts->perms);
	} else if (opts->everyone) {
	if (csuge_sum > 1)
	allow_usage(un, B_FALSE,
	gettext("invalid options combined with -e\n"));
	opts->dataset = munge_args(argc, argv, un, 2, &opts->perms);
	} else if (uge_sum == 0 && argc > 0 && strcmp(argv[0], "everyone")
	== 0) {
	opts->everyone = B_TRUE;
	argc--;
	argv++;
	opts->dataset = munge_args(argc, argv, un, 2, &opts->perms);
	} else if (argc == 1 && !un) {
	opts->prt_perms = B_TRUE;
	opts->dataset = argv[argc-1];
	} else {
	opts->dataset = munge_args(argc, argv, un, 3, &opts->perms);
	opts->who = argv[0];
	}

	if (!opts->local && !opts->descend) {
	opts->local = B_TRUE;
	opts->descend = B_TRUE;
	}
	}

	static void
	store_allow_perm(zfs_deleg_who_type_t type, boolean_t local, boolean_t descend,
	const char who, char perms, nvlist_t *top_nvl)
	{
	int i;
	char ld[2] = { '\0', '\0' };
	char who_buf[MAXNAMELEN + 32];
	char base_type = '\0';
	char set_type = '\0';
	nvlist_t *base_nvl = NULL;
	nvlist_t *set_nvl = NULL;
	nvlist_t *nvl;

	if (nvlist_alloc(&base_nvl, NV_UNIQUE_NAME, 0) != 0)
	nomem();
	if (nvlist_alloc(&set_nvl, NV_UNIQUE_NAME, 0) != 0)
	nomem();

	switch (type) {
	case ZFS_DELEG_NAMED_SET_SETS:
	case ZFS_DELEG_NAMED_SET:
	set_type = ZFS_DELEG_NAMED_SET_SETS;
	base_type = ZFS_DELEG_NAMED_SET;
	ld[0] = ZFS_DELEG_NA;
	break;
	case ZFS_DELEG_CREATE_SETS:
	case ZFS_DELEG_CREATE:
	set_type = ZFS_DELEG_CREATE_SETS;
	base_type = ZFS_DELEG_CREATE;
	ld[0] = ZFS_DELEG_NA;
	break;
	case ZFS_DELEG_USER_SETS:
	case ZFS_DELEG_USER:
	set_type = ZFS_DELEG_USER_SETS;
	base_type = ZFS_DELEG_USER;
	if (local)
	ld[0] = ZFS_DELEG_LOCAL;
	if (descend)
	ld[1] = ZFS_DELEG_DESCENDENT;
	break;
	case ZFS_DELEG_GROUP_SETS:
	case ZFS_DELEG_GROUP:
	set_type = ZFS_DELEG_GROUP_SETS;
	base_type = ZFS_DELEG_GROUP;
	if (local)
	ld[0] = ZFS_DELEG_LOCAL;
	if (descend)
	ld[1] = ZFS_DELEG_DESCENDENT;
	break;
	case ZFS_DELEG_EVERYONE_SETS:
	case ZFS_DELEG_EVERYONE:
	set_type = ZFS_DELEG_EVERYONE_SETS;
	base_type = ZFS_DELEG_EVERYONE;
	if (local)
	ld[0] = ZFS_DELEG_LOCAL;
	if (descend)
	ld[1] = ZFS_DELEG_DESCENDENT;
	break;

	default:
	assert(set_type != '\0' && base_type != '\0');
	}

	if (perms != NULL) {
	char *curr = perms;
	char *end = curr + strlen(perms);

	while (curr < end) {
	char *delim = strchr(curr, ',');
	if (delim == NULL)
	delim = end;
	else
	*delim = '\0';

	if (curr[0] == '@')
	nvl = set_nvl;
	else
	nvl = base_nvl;

	(void) nvlist_add_boolean(nvl, curr);
	if (delim != end)
	*delim = ',';
	curr = delim + 1;
	}

	for (i = 0; i < 2; i++) {
	char locality = ld[i];
	if (locality == 0)
	continue;

	if (!nvlist_empty(base_nvl)) {
	if (who != NULL)
	(void) snprintf(who_buf,
	sizeof (who_buf), "%c%c$%s",
	base_type, locality, who);
	else
	(void) snprintf(who_buf,
	sizeof (who_buf), "%c%c$",
	base_type, locality);

	(void) nvlist_add_nvlist(top_nvl, who_buf,
	base_nvl);
	}


	if (!nvlist_empty(set_nvl)) {
	if (who != NULL)
	(void) snprintf(who_buf,
	sizeof (who_buf), "%c%c$%s",
	set_type, locality, who);
	else
	(void) snprintf(who_buf,
	sizeof (who_buf), "%c%c$",
	set_type, locality);

	(void) nvlist_add_nvlist(top_nvl, who_buf,
	set_nvl);
	}
	}
	} else {
	for (i = 0; i < 2; i++) {
	char locality = ld[i];
	if (locality == 0)
	continue;

	if (who != NULL)
	(void) snprintf(who_buf, sizeof (who_buf),
	"%c%c$%s", base_type, locality, who);
	else
	(void) snprintf(who_buf, sizeof (who_buf),
	"%c%c$", base_type, locality);
	(void) nvlist_add_boolean(top_nvl, who_buf);

	if (who != NULL)
	(void) snprintf(who_buf, sizeof (who_buf),
	"%c%c$%s", set_type, locality, who);
	else
	(void) snprintf(who_buf, sizeof (who_buf),
	"%c%c$", set_type, locality);
	(void) nvlist_add_boolean(top_nvl, who_buf);
	}
	}
	}

	static int
	construct_fsacl_list(boolean_t un, struct allow_opts opts, nvlist_t *nvlp)
	{
	if (nvlist_alloc(nvlp, NV_UNIQUE_NAME, 0) != 0)
	nomem();

	if (opts->set) {
	store_allow_perm(ZFS_DELEG_NAMED_SET, opts->local,
	opts->descend, opts->who, opts->perms, *nvlp);
	} else if (opts->create) {
	store_allow_perm(ZFS_DELEG_CREATE, opts->local,
	opts->descend, NULL, opts->perms, *nvlp);
	} else if (opts->everyone) {
	store_allow_perm(ZFS_DELEG_EVERYONE, opts->local,
	opts->descend, NULL, opts->perms, *nvlp);
	} else {
	char *curr = opts->who;
	char *end = curr + strlen(curr);

	while (curr < end) {
	const char *who;
	zfs_deleg_who_type_t who_type = ZFS_DELEG_WHO_UNKNOWN;
	char *endch;
	char *delim = strchr(curr, ',');
	char errbuf[256];
	char id[64];
	struct passwd *p = NULL;
	struct group *g = NULL;

	uid_t rid;
	if (delim == NULL)
	delim = end;
	else
	*delim = '\0';

	rid = (uid_t)strtol(curr, &endch, 0);
	if (opts->user) {
	who_type = ZFS_DELEG_USER;
	if (*endch != '\0')
	p = getpwnam(curr);
	else
	p = getpwuid(rid);

	if (p != NULL)
	rid = p->pw_uid;
	else if (*endch != '\0') {
	(void) snprintf(errbuf, 256, gettext(
	"invalid user %s\n"), curr);
	allow_usage(un, B_TRUE, errbuf);
	}
	} else if (opts->group) {
	who_type = ZFS_DELEG_GROUP;
	if (*endch != '\0')
	g = getgrnam(curr);
	else
	g = getgrgid(rid);

	if (g != NULL)
	rid = g->gr_gid;
	else if (*endch != '\0') {
	(void) snprintf(errbuf, 256, gettext(
	"invalid group %s\n"), curr);
	allow_usage(un, B_TRUE, errbuf);
	}
	} else {
	if (*endch != '\0') {
	p = getpwnam(curr);
	} else {
	p = getpwuid(rid);
	}

	if (p == NULL) {
	if (*endch != '\0') {
	g = getgrnam(curr);
	} else {
	g = getgrgid(rid);
	}
	}

	if (p != NULL) {
	who_type = ZFS_DELEG_USER;
	rid = p->pw_uid;
	} else if (g != NULL) {
	who_type = ZFS_DELEG_GROUP;
	rid = g->gr_gid;
	} else {
	(void) snprintf(errbuf, 256, gettext(
	"invalid user/group %s\n"), curr);
	allow_usage(un, B_TRUE, errbuf);
	}
	}

	(void) sprintf(id, "%u", rid);
	who = id;

	store_allow_perm(who_type, opts->local,
	opts->descend, who, opts->perms, *nvlp);
	curr = delim + 1;
	}
	}

	return (0);
	}

	static void
	print_set_creat_perms(uu_avl_t *who_avl)
	{
	const char *sc_title[] = {
	gettext("Permission sets:\n"),
	gettext("Create time permissions:\n"),
	NULL
	};
	who_perm_node_t *who_node = NULL;
	int prev_weight = -1;

	for (who_node = uu_avl_first(who_avl); who_node != NULL;
	who_node = uu_avl_next(who_avl, who_node)) {
	uu_avl_t *avl = who_node->who_perm.who_deleg_perm_avl;
	zfs_deleg_who_type_t who_type = who_node->who_perm.who_type;
	const char *who_name = who_node->who_perm.who_name;
	int weight = who_type2weight(who_type);
	boolean_t first = B_TRUE;
	deleg_perm_node_t *deleg_node;

	if (prev_weight != weight) {
	(void) printf("%s", sc_title[weight]);
	prev_weight = weight;
	}

	if (who_name == NULL \|\| strnlen(who_name, 1) == 0)
	(void) printf("\t");
	else
	(void) printf("\t%s ", who_name);

	for (deleg_node = uu_avl_first(avl); deleg_node != NULL;
	deleg_node = uu_avl_next(avl, deleg_node)) {
	if (first) {
	(void) printf("%s",
	deleg_node->dpn_perm.dp_name);
	first = B_FALSE;
	} else
	(void) printf(",%s",
	deleg_node->dpn_perm.dp_name);
	}

	(void) printf("\n");
	}
	}

	static void
	print_uge_deleg_perms(uu_avl_t *who_avl, boolean_t local, boolean_t descend,
	const char *title)
	{
	who_perm_node_t *who_node = NULL;
	boolean_t prt_title = B_TRUE;
	uu_avl_walk_t *walk;

	if ((walk = uu_avl_walk_start(who_avl, UU_WALK_ROBUST)) == NULL)
	nomem();

	while ((who_node = uu_avl_walk_next(walk)) != NULL) {
	const char *who_name = who_node->who_perm.who_name;
	const char *nice_who_name = who_node->who_perm.who_ug_name;
	uu_avl_t *avl = who_node->who_perm.who_deleg_perm_avl;
	zfs_deleg_who_type_t who_type = who_node->who_perm.who_type;
	char delim = ' ';
	deleg_perm_node_t *deleg_node;
	boolean_t prt_who = B_TRUE;

	for (deleg_node = uu_avl_first(avl);
	deleg_node != NULL;
	deleg_node = uu_avl_next(avl, deleg_node)) {
	if (local != deleg_node->dpn_perm.dp_local \|\|
	descend != deleg_node->dpn_perm.dp_descend)
	continue;

	if (prt_who) {
	const char *who = NULL;
	if (prt_title) {
	prt_title = B_FALSE;
	(void) printf("%s", title);
	}

	switch (who_type) {
	case ZFS_DELEG_USER_SETS:
	case ZFS_DELEG_USER:
	who = gettext("user");
	if (nice_who_name)
	who_name = nice_who_name;
	break;
	case ZFS_DELEG_GROUP_SETS:
	case ZFS_DELEG_GROUP:
	who = gettext("group");
	if (nice_who_name)
	who_name = nice_who_name;
	break;
	case ZFS_DELEG_EVERYONE_SETS:
	case ZFS_DELEG_EVERYONE:
	who = gettext("everyone");
	who_name = NULL;
	break;

	default:
	assert(who != NULL);
	}

	prt_who = B_FALSE;
	if (who_name == NULL)
	(void) printf("\t%s", who);
	else
	(void) printf("\t%s %s", who, who_name);
	}

	(void) printf("%c%s", delim,
	deleg_node->dpn_perm.dp_name);
	delim = ',';
	}

	if (!prt_who)
	(void) printf("\n");
	}

	uu_avl_walk_end(walk);
	}

	static void
	print_fs_perms(fs_perm_set_t *fspset)
	{
	fs_perm_node_t *node = NULL;
	char buf[MAXNAMELEN + 32];
	const char *dsname = buf;

	for (node = uu_list_first(fspset->fsps_list); node != NULL;
	node = uu_list_next(fspset->fsps_list, node)) {
	uu_avl_t *sc_avl = node->fspn_fsperm.fsp_sc_avl;
	uu_avl_t *uge_avl = node->fspn_fsperm.fsp_uge_avl;
	int left = 0;

	(void) snprintf(buf, sizeof (buf),
	gettext("---- Permissions on %s "),
	node->fspn_fsperm.fsp_name);
	(void) printf("%s", dsname);
	left = 70 - strlen(buf);
	while (left-- > 0)
	(void) printf("-");
	(void) printf("\n");

	print_set_creat_perms(sc_avl);
	print_uge_deleg_perms(uge_avl, B_TRUE, B_FALSE,
	gettext("Local permissions:\n"));
	print_uge_deleg_perms(uge_avl, B_FALSE, B_TRUE,
	gettext("Descendent permissions:\n"));
	print_uge_deleg_perms(uge_avl, B_TRUE, B_TRUE,
	gettext("Local+Descendent permissions:\n"));
	}
	}

	static fs_perm_set_t fs_perm_set = { NULL, NULL, NULL, NULL };

	struct deleg_perms {
	boolean_t un;
	nvlist_t *nvl;
	};

	static int
	set_deleg_perms(zfs_handle_t zhp, void data)
	{
	struct deleg_perms perms = (struct deleg_perms )data;
	zfs_type_t zfs_type = zfs_get_type(zhp);

	if (zfs_type != ZFS_TYPE_FILESYSTEM && zfs_type != ZFS_TYPE_VOLUME)
	return (0);

	return (zfs_set_fsacl(zhp, perms->un, perms->nvl));
	}

	static int
	zfs_do_allow_unallow_impl(int argc, char **argv, boolean_t un)
	{
	zfs_handle_t *zhp;
	nvlist_t *perm_nvl = NULL;
	nvlist_t *update_perm_nvl = NULL;
	int error = 1;
	int c;
	struct allow_opts opts = { 0 };

	const char *optstr = un ? "ldugecsrh" : "ldugecsh";

	/* check opts */
	while ((c = getopt(argc, argv, optstr)) != -1) {
	switch (c) {
	case 'l':
	opts.local = B_TRUE;
	break;
	case 'd':
	opts.descend = B_TRUE;
	break;
	case 'u':
	opts.user = B_TRUE;
	break;
	case 'g':
	opts.group = B_TRUE;
	break;
	case 'e':
	opts.everyone = B_TRUE;
	break;
	case 's':
	opts.set = B_TRUE;
	break;
	case 'c':
	opts.create = B_TRUE;
	break;
	case 'r':
	opts.recursive = B_TRUE;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case 'h':
	opts.prt_usage = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check arguments */
	parse_allow_args(argc, argv, un, &opts);

	/* try to open the dataset */
	if ((zhp = zfs_open(g_zfs, opts.dataset, ZFS_TYPE_FILESYSTEM \|
	ZFS_TYPE_VOLUME)) == NULL) {
	(void) fprintf(stderr, "Failed to open dataset: %s\n",
	opts.dataset);
	return (-1);
	}

	if (zfs_get_fsacl(zhp, &perm_nvl) != 0)
	goto cleanup2;

	fs_perm_set_init(&fs_perm_set);
	if (parse_fs_perm_set(&fs_perm_set, perm_nvl) != 0) {
	(void) fprintf(stderr, "Failed to parse fsacl permissions\n");
	goto cleanup1;
	}

	if (opts.prt_perms)
	print_fs_perms(&fs_perm_set);
	else {
	(void) construct_fsacl_list(un, &opts, &update_perm_nvl);
	if (zfs_set_fsacl(zhp, un, update_perm_nvl) != 0)
	goto cleanup0;

	if (un && opts.recursive) {
	struct deleg_perms data = { un, update_perm_nvl };
	if (zfs_iter_filesystems(zhp, set_deleg_perms,
	&data) != 0)
	goto cleanup0;
	}
	}

	error = 0;

	cleanup0:
	nvlist_free(perm_nvl);
	nvlist_free(update_perm_nvl);
	cleanup1:
	fs_perm_set_fini(&fs_perm_set);
	cleanup2:
	zfs_close(zhp);

	return (error);
	}

	static int
	zfs_do_allow(int argc, char **argv)
	{
	return (zfs_do_allow_unallow_impl(argc, argv, B_FALSE));
	}

	static int
	zfs_do_unallow(int argc, char **argv)
	{
	return (zfs_do_allow_unallow_impl(argc, argv, B_TRUE));
	}

	static int
	zfs_do_hold_rele_impl(int argc, char **argv, boolean_t holding)
	{
	int errors = 0;
	int i;
	const char *tag;
	boolean_t recursive = B_FALSE;
	const char *opts = holding ? "rt" : "r";
	int c;

	/* check options */
	while ((c = getopt(argc, argv, opts)) != -1) {
	switch (c) {
	case 'r':
	recursive = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc < 2)
	usage(B_FALSE);

	tag = argv[0];
	--argc;
	++argv;

	if (holding && tag[0] == '.') {
	/* tags starting with '.' are reserved for libzfs */
	(void) fprintf(stderr, gettext("tag may not start with '.'\n"));
	usage(B_FALSE);
	}

	for (i = 0; i < argc; ++i) {
	zfs_handle_t *zhp;
	char parent[ZFS_MAX_DATASET_NAME_LEN];
	const char *delim;
	char *path = argv[i];

	delim = strchr(path, '@');
	if (delim == NULL) {
	(void) fprintf(stderr,
	gettext("'%s' is not a snapshot\n"), path);
	++errors;
	continue;
	}
	(void) strncpy(parent, path, delim - path);
	parent[delim - path] = '\0';

	zhp = zfs_open(g_zfs, parent,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL) {
	++errors;
	continue;
	}
	if (holding) {
	if (zfs_hold(zhp, delim+1, tag, recursive, -1) != 0)
	++errors;
	} else {
	if (zfs_release(zhp, delim+1, tag, recursive) != 0)
	++errors;
	}
	zfs_close(zhp);
	}

	return (errors != 0);
	}

	/*
	* zfs hold [-r] [-t] <tag> <snap> ...
	*
	* -r Recursively hold
	*
	* Apply a user-hold with the given tag to the list of snapshots.
	*/
	static int
	zfs_do_hold(int argc, char **argv)
	{
	return (zfs_do_hold_rele_impl(argc, argv, B_TRUE));
	}

	/*
	* zfs release [-r] <tag> <snap> ...
	*
	* -r Recursively release
	*
	* Release a user-hold with the given tag from the list of snapshots.
	*/
	static int
	zfs_do_release(int argc, char **argv)
	{
	return (zfs_do_hold_rele_impl(argc, argv, B_FALSE));
	}

	typedef struct holds_cbdata {
	boolean_t cb_recursive;
	const char *cb_snapname;
	nvlist_t **cb_nvlp;
	size_t cb_max_namelen;
	size_t cb_max_taglen;
	} holds_cbdata_t;

	#define STRFTIME_FMT_STR "%a %b %e %H:%M %Y"
	#define DATETIME_BUF_LEN (32)
	/*
	*
	*/
	static void
	print_holds(boolean_t scripted, int nwidth, int tagwidth, nvlist_t *nvl)
	{
	int i;
	nvpair_t *nvp = NULL;
	char *hdr_cols[] = { "NAME", "TAG", "TIMESTAMP" };
	const char *col;

	if (!scripted) {
	for (i = 0; i < 3; i++) {
	col = gettext(hdr_cols[i]);
	if (i < 2)
	(void) printf("%-*s ", i ? tagwidth : nwidth,
	col);
	else
	(void) printf("%s\n", col);
	}
	}

	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
	char *zname = nvpair_name(nvp);
	nvlist_t *nvl2;
	nvpair_t *nvp2 = NULL;
	(void) nvpair_value_nvlist(nvp, &nvl2);
	while ((nvp2 = nvlist_next_nvpair(nvl2, nvp2)) != NULL) {
	char tsbuf[DATETIME_BUF_LEN];
	char *tagname = nvpair_name(nvp2);
	uint64_t val = 0;
	time_t time;
	struct tm t;

	(void) nvpair_value_uint64(nvp2, &val);
	time = (time_t)val;
	(void) localtime_r(&time, &t);
	(void) strftime(tsbuf, DATETIME_BUF_LEN,
	gettext(STRFTIME_FMT_STR), &t);

	if (scripted) {
	(void) printf("%s\t%s\t%s\n", zname,
	tagname, tsbuf);
	} else {
	(void) printf("%-s %-s %s\n", nwidth,
	zname, tagwidth, tagname, tsbuf);
	}
	}
	}
	}

	/*
	* Generic callback function to list a dataset or snapshot.
	*/
	static int
	holds_callback(zfs_handle_t zhp, void data)
	{
	holds_cbdata_t *cbp = data;
	nvlist_t top_nvl = cbp->cb_nvlp;
	nvlist_t *nvl = NULL;
	nvpair_t *nvp = NULL;
	const char *zname = zfs_get_name(zhp);
	size_t znamelen = strlen(zname);

	if (cbp->cb_recursive) {
	const char *snapname;
	char *delim = strchr(zname, '@');
	if (delim == NULL)
	return (0);

	snapname = delim + 1;
	if (strcmp(cbp->cb_snapname, snapname))
	return (0);
	}

	if (zfs_get_holds(zhp, &nvl) != 0)
	return (-1);

	if (znamelen > cbp->cb_max_namelen)
	cbp->cb_max_namelen = znamelen;

	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
	const char *tag = nvpair_name(nvp);
	size_t taglen = strlen(tag);
	if (taglen > cbp->cb_max_taglen)
	cbp->cb_max_taglen = taglen;
	}

	return (nvlist_add_nvlist(top_nvl, zname, nvl));
	}

	/*
	* zfs holds [-rH] <snap> ...
	*
	* -r Lists holds that are set on the named snapshots recursively.
	* -H Scripted mode; elide headers and separate columns by tabs.
	*/
	static int
	zfs_do_holds(int argc, char **argv)
	{
	int errors = 0;
	int c;
	int i;
	boolean_t scripted = B_FALSE;
	boolean_t recursive = B_FALSE;
	const char *opts = "rH";
	nvlist_t *nvl;

	int types = ZFS_TYPE_SNAPSHOT;
	holds_cbdata_t cb = { 0 };

	int limit = 0;
	int ret = 0;
	int flags = 0;

	/* check options */
	while ((c = getopt(argc, argv, opts)) != -1) {
	switch (c) {
	case 'r':
	recursive = B_TRUE;
	break;
	case 'H':
	scripted = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	if (recursive) {
	types \|= ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME;
	flags \|= ZFS_ITER_RECURSE;
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc < 1)
	usage(B_FALSE);

	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0)
	nomem();

	for (i = 0; i < argc; ++i) {
	char *snapshot = argv[i];
	const char *delim;
	const char *snapname;

	delim = strchr(snapshot, '@');
	if (delim == NULL) {
	(void) fprintf(stderr,
	gettext("'%s' is not a snapshot\n"), snapshot);
	++errors;
	continue;
	}
	snapname = delim + 1;
	if (recursive)
	snapshot[delim - snapshot] = '\0';

	cb.cb_recursive = recursive;
	cb.cb_snapname = snapname;
	cb.cb_nvlp = &nvl;

	/*
	* 1. collect holds data, set format options
	*/
	ret = zfs_for_each(argc, argv, flags, types, NULL, NULL, limit,
	holds_callback, &cb);
	if (ret != 0)
	++errors;
	}

	/*
	* 2. print holds data
	*/
	print_holds(scripted, cb.cb_max_namelen, cb.cb_max_taglen, nvl);

	if (nvlist_empty(nvl))
	(void) fprintf(stderr, gettext("no datasets available\n"));

	nvlist_free(nvl);

	return (0 != errors);
	}

	#define CHECK_SPINNER 30
	#define SPINNER_TIME 3 /* seconds */
	#define MOUNT_TIME 1 /* seconds */

	typedef struct get_all_state {
	boolean_t ga_verbose;
	get_all_cb_t *ga_cbp;
	} get_all_state_t;

	static int
	get_one_dataset(zfs_handle_t zhp, void data)
	{
	static char *spin[] = { "-", "\\", "\|", "/" };
	static int spinval = 0;
	static int spincheck = 0;
	static time_t last_spin_time = (time_t)0;
	get_all_state_t *state = data;
	zfs_type_t type = zfs_get_type(zhp);

	if (state->ga_verbose) {
	if (--spincheck < 0) {
	time_t now = time(NULL);
	if (last_spin_time + SPINNER_TIME < now) {
	update_progress(spin[spinval++ % 4]);
	last_spin_time = now;
	}
	spincheck = CHECK_SPINNER;
	}
	}

	/*
	* Iterate over any nested datasets.
	*/
	if (zfs_iter_filesystems(zhp, get_one_dataset, data) != 0) {
	zfs_close(zhp);
	return (1);
	}

	/*
	* Skip any datasets whose type does not match.
	*/
	if ((type & ZFS_TYPE_FILESYSTEM) == 0) {
	zfs_close(zhp);
	return (0);
	}
	libzfs_add_handle(state->ga_cbp, zhp);
	assert(state->ga_cbp->cb_used <= state->ga_cbp->cb_alloc);

	return (0);
	}

	static void
	get_all_datasets(get_all_cb_t *cbp, boolean_t verbose)
	{
	get_all_state_t state = {
	.ga_verbose = verbose,
	.ga_cbp = cbp
	};

	if (verbose)
	set_progress_header(gettext("Reading ZFS config"));
	(void) zfs_iter_root(g_zfs, get_one_dataset, &state);

	if (verbose)
	finish_progress(gettext("done."));
	}

	/*
	* Generic callback for sharing or mounting filesystems. Because the code is so
	* similar, we have a common function with an extra parameter to determine which
	* mode we are using.
	*/
	typedef enum { OP_SHARE, OP_MOUNT } share_mount_op_t;

	typedef struct share_mount_state {
	share_mount_op_t sm_op;
	boolean_t sm_verbose;
	int sm_flags;
	char *sm_options;
	char sm_proto; / only valid for OP_SHARE */
	pthread_mutex_t sm_lock; /* protects the remaining fields */
	uint_t sm_total; /* number of filesystems to process */
	uint_t sm_done; /* number of filesystems processed */
	int sm_status; /* -1 if any of the share/mount operations failed */
	} share_mount_state_t;

	/*
	* Share or mount a dataset.
	*/
	static int
	share_mount_one(zfs_handle_t zhp, int op, int flags, char protocol,
	boolean_t explicit, const char *options)
	{
	char mountpoint[ZFS_MAXPROPLEN];
	char shareopts[ZFS_MAXPROPLEN];
	char smbshareopts[ZFS_MAXPROPLEN];
	const char *cmdname = op == OP_SHARE ? "share" : "mount";
	struct mnttab mnt;
	uint64_t zoned, canmount;
	boolean_t shared_nfs, shared_smb;

	assert(zfs_get_type(zhp) & ZFS_TYPE_FILESYSTEM);

	/*
	* Check to make sure we can mount/share this dataset. If we
	* are in the global zone and the filesystem is exported to a
	* local zone, or if we are in a local zone and the
	* filesystem is not exported, then it is an error.
	*/
	zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);

	if (zoned && getzoneid() == GLOBAL_ZONEID) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot %s '%s': "
	"dataset is exported to a local zone\n"), cmdname,
	zfs_get_name(zhp));
	return (1);

	} else if (!zoned && getzoneid() != GLOBAL_ZONEID) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot %s '%s': "
	"permission denied\n"), cmdname,
	zfs_get_name(zhp));
	return (1);
	}

	/*
	* Ignore any filesystems which don't apply to us. This
	* includes those with a legacy mountpoint, or those with
	* legacy share options.
	*/
	verify(zfs_prop_get(zhp, ZFS_PROP_MOUNTPOINT, mountpoint,
	sizeof (mountpoint), NULL, NULL, 0, B_FALSE) == 0);
	verify(zfs_prop_get(zhp, ZFS_PROP_SHARENFS, shareopts,
	sizeof (shareopts), NULL, NULL, 0, B_FALSE) == 0);
	verify(zfs_prop_get(zhp, ZFS_PROP_SHARESMB, smbshareopts,
	sizeof (smbshareopts), NULL, NULL, 0, B_FALSE) == 0);

	if (op == OP_SHARE && strcmp(shareopts, "off") == 0 &&
	strcmp(smbshareopts, "off") == 0) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot share '%s': "
	"legacy share\n"), zfs_get_name(zhp));
	(void) fprintf(stderr, gettext("use share(1M) to "
	"share this filesystem, or set "
	"sharenfs property on\n"));
	return (1);
	}

	/*
	* We cannot share or mount legacy filesystems. If the
	* shareopts is non-legacy but the mountpoint is legacy, we
	* treat it as a legacy share.
	*/
	if (strcmp(mountpoint, "legacy") == 0) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot %s '%s': "
	"legacy mountpoint\n"), cmdname, zfs_get_name(zhp));
	(void) fprintf(stderr, gettext("use %s(1M) to "
	"%s this filesystem\n"), cmdname, cmdname);
	return (1);
	}

	if (strcmp(mountpoint, "none") == 0) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot %s '%s': no "
	"mountpoint set\n"), cmdname, zfs_get_name(zhp));
	return (1);
	}

	/*
	* canmount explicit outcome
	* on no pass through
	* on yes pass through
	* off no return 0
	* off yes display error, return 1
	* noauto no return 0
	* noauto yes pass through
	*/
	canmount = zfs_prop_get_int(zhp, ZFS_PROP_CANMOUNT);
	if (canmount == ZFS_CANMOUNT_OFF) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot %s '%s': "
	"'canmount' property is set to 'off'\n"), cmdname,
	zfs_get_name(zhp));
	return (1);
	} else if (canmount == ZFS_CANMOUNT_NOAUTO && !explicit) {
	/*
	* When performing a 'zfs mount -a', we skip any mounts for
	* datasets that have 'noauto' set. Sharing a dataset with
	* 'noauto' set is only allowed if it's mounted.
	*/
	if (op == OP_MOUNT)
	return (0);
	if (op == OP_SHARE && !zfs_is_mounted(zhp, NULL)) {
	/* also purge it from existing exports */
	zfs_unshareall_bypath(zhp, mountpoint);
	return (0);
	}
	}

	/*
	* If this filesystem is encrypted and does not have
	* a loaded key, we can not mount it.
	*/
	if ((flags & MS_CRYPT) == 0 &&
	zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF &&
	zfs_prop_get_int(zhp, ZFS_PROP_KEYSTATUS) ==
	ZFS_KEYSTATUS_UNAVAILABLE) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot %s '%s': "
	"encryption key not loaded\n"), cmdname, zfs_get_name(zhp));
	return (1);
	}

	/*
	* If this filesystem is inconsistent and has a receive resume
	* token, we can not mount it.
	*/
	if (zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT) &&
	zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
	NULL, 0, NULL, NULL, 0, B_TRUE) == 0) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot %s '%s': "
	"Contains partially-completed state from "
	"\"zfs receive -s\", which can be resumed with "
	"\"zfs send -t\"\n"),
	cmdname, zfs_get_name(zhp));
	return (1);
	}

	if (zfs_prop_get_int(zhp, ZFS_PROP_REDACTED) && !(flags & MS_FORCE)) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot %s '%s': "
	"Dataset is not complete, was created by receiving "
	"a redacted zfs send stream.\n"), cmdname,
	zfs_get_name(zhp));
	return (1);
	}

	/*
	* At this point, we have verified that the mountpoint and/or
	* shareopts are appropriate for auto management. If the
	* filesystem is already mounted or shared, return (failing
	* for explicit requests); otherwise mount or share the
	* filesystem.
	*/
	switch (op) {
	case OP_SHARE:

	shared_nfs = zfs_is_shared_nfs(zhp, NULL);
	shared_smb = zfs_is_shared_smb(zhp, NULL);

	if ((shared_nfs && shared_smb) \|\|
	(shared_nfs && strcmp(shareopts, "on") == 0 &&
	strcmp(smbshareopts, "off") == 0) \|\|
	(shared_smb && strcmp(smbshareopts, "on") == 0 &&
	strcmp(shareopts, "off") == 0)) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot share "
	"'%s': filesystem already shared\n"),
	zfs_get_name(zhp));
	return (1);
	}

	if (!zfs_is_mounted(zhp, NULL) &&
	zfs_mount(zhp, NULL, flags) != 0)
	return (1);

	if (protocol == NULL) {
	if (zfs_shareall(zhp) != 0)
	return (1);
	} else if (strcmp(protocol, "nfs") == 0) {
	if (zfs_share_nfs(zhp))
	return (1);
	} else if (strcmp(protocol, "smb") == 0) {
	if (zfs_share_smb(zhp))
	return (1);
	} else {
	(void) fprintf(stderr, gettext("cannot share "
	"'%s': invalid share type '%s' "
	"specified\n"),
	zfs_get_name(zhp), protocol);
	return (1);
	}

	break;

	case OP_MOUNT:
	if (options == NULL)
	mnt.mnt_mntopts = "";
	else
	mnt.mnt_mntopts = (char *)options;

	if (!hasmntopt(&mnt, MNTOPT_REMOUNT) &&
	zfs_is_mounted(zhp, NULL)) {
	if (!explicit)
	return (0);

	(void) fprintf(stderr, gettext("cannot mount "
	"'%s': filesystem already mounted\n"),
	zfs_get_name(zhp));
	return (1);
	}

	if (zfs_mount(zhp, options, flags) != 0)
	return (1);
	break;
	}

	return (0);
	}

	/*
	* Reports progress in the form "(current/total)". Not thread-safe.
	*/
	static void
	report_mount_progress(int current, int total)
	{
	static time_t last_progress_time = 0;
	time_t now = time(NULL);
	char info[32];

	/* report 1..n instead of 0..n-1 */
	++current;

	/* display header if we're here for the first time */
	if (current == 1) {
	set_progress_header(gettext("Mounting ZFS filesystems"));
	} else if (current != total && last_progress_time + MOUNT_TIME >= now) {
	/* too soon to report again */
	return;
	}

	last_progress_time = now;

	(void) sprintf(info, "(%d/%d)", current, total);

	if (current == total)
	finish_progress(info);
	else
	update_progress(info);
	}

	/*
	* zfs_foreach_mountpoint() callback that mounts or shares one filesystem and
	* updates the progress meter.
	*/
	static int
	share_mount_one_cb(zfs_handle_t zhp, void arg)
	{
	share_mount_state_t *sms = arg;
	int ret;

	ret = share_mount_one(zhp, sms->sm_op, sms->sm_flags, sms->sm_proto,
	B_FALSE, sms->sm_options);

	pthread_mutex_lock(&sms->sm_lock);
	if (ret != 0)
	sms->sm_status = ret;
	sms->sm_done++;
	if (sms->sm_verbose)
	report_mount_progress(sms->sm_done, sms->sm_total);
	pthread_mutex_unlock(&sms->sm_lock);
	return (ret);
	}

	static void
	append_options(char mntopts, char newopts)
	{
	int len = strlen(mntopts);

	/* original length plus new string to append plus 1 for the comma */
	if (len + 1 + strlen(newopts) >= MNT_LINE_MAX) {
	(void) fprintf(stderr, gettext("the opts argument for "
	"'%s' option is too long (more than %d chars)\n"),
	"-o", MNT_LINE_MAX);
	usage(B_FALSE);
	}

	if (*mntopts)
	mntopts[len++] = ',';

	(void) strcpy(&mntopts[len], newopts);
	}

	static int
	share_mount(int op, int argc, char **argv)
	{
	int do_all = 0;
	boolean_t verbose = B_FALSE;
	int c, ret = 0;
	char *options = NULL;
	int flags = 0;

	/* check options */
	while ((c = getopt(argc, argv, op == OP_MOUNT ? ":alvo:Of" : "al"))
	!= -1) {
	switch (c) {
	case 'a':
	do_all = 1;
	break;
	case 'v':
	verbose = B_TRUE;
	break;
	case 'l':
	flags \|= MS_CRYPT;
	break;
	case 'o':
	if (*optarg == '\0') {
	(void) fprintf(stderr, gettext("empty mount "
	"options (-o) specified\n"));
	usage(B_FALSE);
	}

	if (options == NULL)
	options = safe_malloc(MNT_LINE_MAX + 1);

	/* option validation is done later */
	append_options(options, optarg);
	break;
	case 'O':
	flags \|= MS_OVERLAY;
	break;
	case 'f':
	flags \|= MS_FORCE;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (do_all) {
	char *protocol = NULL;

	if (op == OP_SHARE && argc > 0) {
	if (strcmp(argv[0], "nfs") != 0 &&
	strcmp(argv[0], "smb") != 0) {
	(void) fprintf(stderr, gettext("share type "
	"must be 'nfs' or 'smb'\n"));
	usage(B_FALSE);
	}
	protocol = argv[0];
	argc--;
	argv++;
	}

	if (argc != 0) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	start_progress_timer();
	get_all_cb_t cb = { 0 };
	get_all_datasets(&cb, verbose);

	if (cb.cb_used == 0) {
	if (options != NULL)
	free(options);
	return (0);
	}

	share_mount_state_t share_mount_state = { 0 };
	share_mount_state.sm_op = op;
	share_mount_state.sm_verbose = verbose;
	share_mount_state.sm_flags = flags;
	share_mount_state.sm_options = options;
	share_mount_state.sm_proto = protocol;
	share_mount_state.sm_total = cb.cb_used;
	pthread_mutex_init(&share_mount_state.sm_lock, NULL);

	/*
	* libshare isn't mt-safe, so only do the operation in parallel
	* if we're mounting. Additionally, the key-loading option must
	* be serialized so that we can prompt the user for their keys
	* in a consistent manner.
	*/
	zfs_foreach_mountpoint(g_zfs, cb.cb_handles, cb.cb_used,
	share_mount_one_cb, &share_mount_state,
	op == OP_MOUNT && !(flags & MS_CRYPT));
	zfs_commit_all_shares();

	ret = share_mount_state.sm_status;

	for (int i = 0; i < cb.cb_used; i++)
	zfs_close(cb.cb_handles[i]);
	free(cb.cb_handles);
	} else if (argc == 0) {
	struct mnttab entry;

	if ((op == OP_SHARE) \|\| (options != NULL)) {
	(void) fprintf(stderr, gettext("missing filesystem "
	"argument (specify -a for all)\n"));
	usage(B_FALSE);
	}

	/*
	* When mount is given no arguments, go through
	* /proc/self/mounts and display any active ZFS mounts.
	* We hide any snapshots, since they are controlled
	* automatically.
	*/

	/* Reopen MNTTAB to prevent reading stale data from open file */
	if (freopen(MNTTAB, "r", mnttab_file) == NULL) {
	if (options != NULL)
	free(options);
	return (ENOENT);
	}

	while (getmntent(mnttab_file, &entry) == 0) {
	if (strcmp(entry.mnt_fstype, MNTTYPE_ZFS) != 0 \|\|
	strchr(entry.mnt_special, '@') != NULL)
	continue;

	(void) printf("%-30s %s\n", entry.mnt_special,
	entry.mnt_mountp);
	}

	} else {
	zfs_handle_t *zhp;

	if (argc > 1) {
	(void) fprintf(stderr,
	gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	if ((zhp = zfs_open(g_zfs, argv[0],
	ZFS_TYPE_FILESYSTEM)) == NULL) {
	ret = 1;
	} else {
	ret = share_mount_one(zhp, op, flags, NULL, B_TRUE,
	options);
	zfs_commit_all_shares();
	zfs_close(zhp);
	}
	}

	if (options != NULL)
	free(options);

	return (ret);
	}

	/*
	* zfs mount -a [nfs]
	* zfs mount filesystem
	*
	* Mount all filesystems, or mount the given filesystem.
	*/
	static int
	zfs_do_mount(int argc, char **argv)
	{
	return (share_mount(OP_MOUNT, argc, argv));
	}

	/*
	* zfs share -a [nfs \| smb]
	* zfs share filesystem
	*
	* Share all filesystems, or share the given filesystem.
	*/
	static int
	zfs_do_share(int argc, char **argv)
	{
	return (share_mount(OP_SHARE, argc, argv));
	}

	typedef struct unshare_unmount_node {
	zfs_handle_t *un_zhp;
	char *un_mountp;
	uu_avl_node_t un_avlnode;
	} unshare_unmount_node_t;

	/* ARGSUSED */
	static int
	unshare_unmount_compare(const void larg, const void rarg, void *unused)
	{
	const unshare_unmount_node_t *l = larg;
	const unshare_unmount_node_t *r = rarg;

	return (strcmp(l->un_mountp, r->un_mountp));
	}

	/*
	* Convenience routine used by zfs_do_umount() and manual_unmount(). Given an
	* absolute path, find the entry /proc/self/mounts, verify that it's a
	* ZFS filesystem, and unmount it appropriately.
	*/
	static int
	unshare_unmount_path(int op, char *path, int flags, boolean_t is_manual)
	{
	zfs_handle_t *zhp;
	int ret = 0;
	struct stat64 statbuf;
	struct extmnttab entry;
	const char *cmdname = (op == OP_SHARE) ? "unshare" : "unmount";
	ino_t path_inode;

	/*
	* Search for the given (major,minor) pair in the mount table.
	*/

	/* Reopen MNTTAB to prevent reading stale data from open file */
	if (freopen(MNTTAB, "r", mnttab_file) == NULL)
	return (ENOENT);

	if (getextmntent(path, &entry, &statbuf) != 0) {
	if (op == OP_SHARE) {
	(void) fprintf(stderr, gettext("cannot %s '%s': not "
	"currently mounted\n"), cmdname, path);
	return (1);
	}
	(void) fprintf(stderr, gettext("warning: %s not in"
	"/proc/self/mounts\n"), path);
	if ((ret = umount2(path, flags)) != 0)
	(void) fprintf(stderr, gettext("%s: %s\n"), path,
	strerror(errno));
	return (ret != 0);
	}
	path_inode = statbuf.st_ino;

	if (strcmp(entry.mnt_fstype, MNTTYPE_ZFS) != 0) {
	(void) fprintf(stderr, gettext("cannot %s '%s': not a ZFS "
	"filesystem\n"), cmdname, path);
	return (1);
	}

	if ((zhp = zfs_open(g_zfs, entry.mnt_special,
	ZFS_TYPE_FILESYSTEM)) == NULL)
	return (1);

	ret = 1;
	if (stat64(entry.mnt_mountp, &statbuf) != 0) {
	(void) fprintf(stderr, gettext("cannot %s '%s': %s\n"),
	cmdname, path, strerror(errno));
	goto out;
	} else if (statbuf.st_ino != path_inode) {
	(void) fprintf(stderr, gettext("cannot "
	"%s '%s': not a mountpoint\n"), cmdname, path);
	goto out;
	}

	if (op == OP_SHARE) {
	char nfs_mnt_prop[ZFS_MAXPROPLEN];
	char smbshare_prop[ZFS_MAXPROPLEN];

	verify(zfs_prop_get(zhp, ZFS_PROP_SHARENFS, nfs_mnt_prop,
	sizeof (nfs_mnt_prop), NULL, NULL, 0, B_FALSE) == 0);
	verify(zfs_prop_get(zhp, ZFS_PROP_SHARESMB, smbshare_prop,
	sizeof (smbshare_prop), NULL, NULL, 0, B_FALSE) == 0);

	if (strcmp(nfs_mnt_prop, "off") == 0 &&
	strcmp(smbshare_prop, "off") == 0) {
	(void) fprintf(stderr, gettext("cannot unshare "
	"'%s': legacy share\n"), path);
	(void) fprintf(stderr, gettext("use exportfs(8) "
	"or smbcontrol(1) to unshare this filesystem\n"));
	} else if (!zfs_is_shared(zhp)) {
	(void) fprintf(stderr, gettext("cannot unshare '%s': "
	"not currently shared\n"), path);
	} else {
	ret = zfs_unshareall_bypath(zhp, path);
	zfs_commit_all_shares();
	}
	} else {
	char mtpt_prop[ZFS_MAXPROPLEN];

	verify(zfs_prop_get(zhp, ZFS_PROP_MOUNTPOINT, mtpt_prop,
	sizeof (mtpt_prop), NULL, NULL, 0, B_FALSE) == 0);

	if (is_manual) {
	ret = zfs_unmount(zhp, NULL, flags);
	} else if (strcmp(mtpt_prop, "legacy") == 0) {
	(void) fprintf(stderr, gettext("cannot unmount "
	"'%s': legacy mountpoint\n"),
	zfs_get_name(zhp));
	(void) fprintf(stderr, gettext("use umount(8) "
	"to unmount this filesystem\n"));
	} else {
	ret = zfs_unmountall(zhp, flags);
	}
	}

	out:
	zfs_close(zhp);

	return (ret != 0);
	}

	/*
	* Generic callback for unsharing or unmounting a filesystem.
	*/
	static int
	unshare_unmount(int op, int argc, char **argv)
	{
	int do_all = 0;
	int flags = 0;
	int ret = 0;
	int c;
	zfs_handle_t *zhp;
	char nfs_mnt_prop[ZFS_MAXPROPLEN];
	char sharesmb[ZFS_MAXPROPLEN];

	/* check options */
	while ((c = getopt(argc, argv, op == OP_SHARE ? ":a" : "afu")) != -1) {
	switch (c) {
	case 'a':
	do_all = 1;
	break;
	case 'f':
	flags \|= MS_FORCE;
	break;
	case 'u':
	flags \|= MS_CRYPT;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (do_all) {
	/*
	* We could make use of zfs_for_each() to walk all datasets in
	* the system, but this would be very inefficient, especially
	* since we would have to linearly search /proc/self/mounts for
	* each one. Instead, do one pass through /proc/self/mounts
	* looking for zfs entries and call zfs_unmount() for each one.
	*
	* Things get a little tricky if the administrator has created
	* mountpoints beneath other ZFS filesystems. In this case, we
	* have to unmount the deepest filesystems first. To accomplish
	* this, we place all the mountpoints in an AVL tree sorted by
	* the special type (dataset name), and walk the result in
	* reverse to make sure to get any snapshots first.
	*/
	struct mnttab entry;
	uu_avl_pool_t *pool;
	uu_avl_t *tree = NULL;
	unshare_unmount_node_t *node;
	uu_avl_index_t idx;
	uu_avl_walk_t *walk;
	char *protocol = NULL;

	if (op == OP_SHARE && argc > 0) {
	if (strcmp(argv[0], "nfs") != 0 &&
	strcmp(argv[0], "smb") != 0) {
	(void) fprintf(stderr, gettext("share type "
	"must be 'nfs' or 'smb'\n"));
	usage(B_FALSE);
	}
	protocol = argv[0];
	argc--;
	argv++;
	}

	if (argc != 0) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	if (((pool = uu_avl_pool_create("unmount_pool",
	sizeof (unshare_unmount_node_t),
	offsetof(unshare_unmount_node_t, un_avlnode),
	unshare_unmount_compare, UU_DEFAULT)) == NULL) \|\|
	((tree = uu_avl_create(pool, NULL, UU_DEFAULT)) == NULL))
	nomem();

	/* Reopen MNTTAB to prevent reading stale data from open file */
	if (freopen(MNTTAB, "r", mnttab_file) == NULL)
	return (ENOENT);

	while (getmntent(mnttab_file, &entry) == 0) {

	/* ignore non-ZFS entries */
	if (strcmp(entry.mnt_fstype, MNTTYPE_ZFS) != 0)
	continue;

	/* ignore snapshots */
	if (strchr(entry.mnt_special, '@') != NULL)
	continue;

	if ((zhp = zfs_open(g_zfs, entry.mnt_special,
	ZFS_TYPE_FILESYSTEM)) == NULL) {
	ret = 1;
	continue;
	}

	/*
	* Ignore datasets that are excluded/restricted by
	* parent pool name.
	*/
	if (zpool_skip_pool(zfs_get_pool_name(zhp))) {
	zfs_close(zhp);
	continue;
	}

	switch (op) {
	case OP_SHARE:
	verify(zfs_prop_get(zhp, ZFS_PROP_SHARENFS,
	nfs_mnt_prop,
	sizeof (nfs_mnt_prop),
	NULL, NULL, 0, B_FALSE) == 0);
	if (strcmp(nfs_mnt_prop, "off") != 0)
	break;
	verify(zfs_prop_get(zhp, ZFS_PROP_SHARESMB,
	nfs_mnt_prop,
	sizeof (nfs_mnt_prop),
	NULL, NULL, 0, B_FALSE) == 0);
	if (strcmp(nfs_mnt_prop, "off") == 0)
	continue;
	break;
	case OP_MOUNT:
	/* Ignore legacy mounts */
	verify(zfs_prop_get(zhp, ZFS_PROP_MOUNTPOINT,
	nfs_mnt_prop,
	sizeof (nfs_mnt_prop),
	NULL, NULL, 0, B_FALSE) == 0);
	if (strcmp(nfs_mnt_prop, "legacy") == 0)
	continue;
	/* Ignore canmount=noauto mounts */
	if (zfs_prop_get_int(zhp, ZFS_PROP_CANMOUNT) ==
	ZFS_CANMOUNT_NOAUTO)
	continue;
	default:
	break;
	}

	node = safe_malloc(sizeof (unshare_unmount_node_t));
	node->un_zhp = zhp;
	node->un_mountp = safe_strdup(entry.mnt_mountp);

	uu_avl_node_init(node, &node->un_avlnode, pool);

	if (uu_avl_find(tree, node, NULL, &idx) == NULL) {
	uu_avl_insert(tree, node, idx);
	} else {
	zfs_close(node->un_zhp);
	free(node->un_mountp);
	free(node);
	}
	}

	/*
	* Walk the AVL tree in reverse, unmounting each filesystem and
	* removing it from the AVL tree in the process.
	*/
	if ((walk = uu_avl_walk_start(tree,
	UU_WALK_REVERSE \| UU_WALK_ROBUST)) == NULL)
	nomem();

	while ((node = uu_avl_walk_next(walk)) != NULL) {
	const char *mntarg = NULL;

	uu_avl_remove(tree, node);
	switch (op) {
	case OP_SHARE:
	if (zfs_unshareall_bytype(node->un_zhp,
	node->un_mountp, protocol) != 0)
	ret = 1;
	break;

	case OP_MOUNT:
	if (zfs_unmount(node->un_zhp,
	mntarg, flags) != 0)
	ret = 1;
	break;
	}

	zfs_close(node->un_zhp);
	free(node->un_mountp);
	free(node);
	}

	if (op == OP_SHARE)
	zfs_commit_shares(protocol);

	uu_avl_walk_end(walk);
	uu_avl_destroy(tree);
	uu_avl_pool_destroy(pool);

	} else {
	if (argc != 1) {
	if (argc == 0)
	(void) fprintf(stderr,
	gettext("missing filesystem argument\n"));
	else
	(void) fprintf(stderr,
	gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	/*
	* We have an argument, but it may be a full path or a ZFS
	* filesystem. Pass full paths off to unmount_path() (shared by
	* manual_unmount), otherwise open the filesystem and pass to
	* zfs_unmount().
	*/
	if (argv[0][0] == '/')
	return (unshare_unmount_path(op, argv[0],
	flags, B_FALSE));

	if ((zhp = zfs_open(g_zfs, argv[0],
	ZFS_TYPE_FILESYSTEM)) == NULL)
	return (1);

	verify(zfs_prop_get(zhp, op == OP_SHARE ?
	ZFS_PROP_SHARENFS : ZFS_PROP_MOUNTPOINT,
	nfs_mnt_prop, sizeof (nfs_mnt_prop), NULL,
	NULL, 0, B_FALSE) == 0);

	switch (op) {
	case OP_SHARE:
	verify(zfs_prop_get(zhp, ZFS_PROP_SHARENFS,
	nfs_mnt_prop,
	sizeof (nfs_mnt_prop),
	NULL, NULL, 0, B_FALSE) == 0);
	verify(zfs_prop_get(zhp, ZFS_PROP_SHARESMB,
	sharesmb, sizeof (sharesmb), NULL, NULL,
	0, B_FALSE) == 0);

	if (strcmp(nfs_mnt_prop, "off") == 0 &&
	strcmp(sharesmb, "off") == 0) {
	(void) fprintf(stderr, gettext("cannot "
	"unshare '%s': legacy share\n"),
	zfs_get_name(zhp));
	(void) fprintf(stderr, gettext("use "
	"unshare(1M) to unshare this "
	"filesystem\n"));
	ret = 1;
	} else if (!zfs_is_shared(zhp)) {
	(void) fprintf(stderr, gettext("cannot "
	"unshare '%s': not currently "
	"shared\n"), zfs_get_name(zhp));
	ret = 1;
	} else if (zfs_unshareall(zhp) != 0) {
	ret = 1;
	}
	break;

	case OP_MOUNT:
	if (strcmp(nfs_mnt_prop, "legacy") == 0) {
	(void) fprintf(stderr, gettext("cannot "
	"unmount '%s': legacy "
	"mountpoint\n"), zfs_get_name(zhp));
	(void) fprintf(stderr, gettext("use "
	"umount(1M) to unmount this "
	"filesystem\n"));
	ret = 1;
	} else if (!zfs_is_mounted(zhp, NULL)) {
	(void) fprintf(stderr, gettext("cannot "
	"unmount '%s': not currently "
	"mounted\n"),
	zfs_get_name(zhp));
	ret = 1;
	} else if (zfs_unmountall(zhp, flags) != 0) {
	ret = 1;
	}
	break;
	}

	zfs_close(zhp);
	}

	return (ret);
	}

	/*
	* zfs unmount [-fu] -a
	* zfs unmount [-fu] filesystem
	*
	* Unmount all filesystems, or a specific ZFS filesystem.
	*/
	static int
	zfs_do_unmount(int argc, char **argv)
	{
	return (unshare_unmount(OP_MOUNT, argc, argv));
	}

	/*
	* zfs unshare -a
	* zfs unshare filesystem
	*
	* Unshare all filesystems, or a specific ZFS filesystem.
	*/
	static int
	zfs_do_unshare(int argc, char **argv)
	{
	return (unshare_unmount(OP_SHARE, argc, argv));
	}

	static int
	find_command_idx(char command, int idx)
	{
	int i;

	for (i = 0; i < NCOMMAND; i++) {
	if (command_table[i].name == NULL)
	continue;

	if (strcmp(command, command_table[i].name) == 0) {
	*idx = i;
	return (0);
	}
	}
	return (1);
	}

	static int
	zfs_do_diff(int argc, char **argv)
	{
	zfs_handle_t *zhp;
	int flags = 0;
	char *tosnap = NULL;
	char *fromsnap = NULL;
	char atp, copy;
	int err = 0;
	int c;
	struct sigaction sa;

	while ((c = getopt(argc, argv, "FHt")) != -1) {
	switch (c) {
	case 'F':
	flags \|= ZFS_DIFF_CLASSIFY;
	break;
	case 'H':
	flags \|= ZFS_DIFF_PARSEABLE;
	break;
	case 't':
	flags \|= ZFS_DIFF_TIMESTAMP;
	break;
	default:
	(void) fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr,
	gettext("must provide at least one snapshot name\n"));
	usage(B_FALSE);
	}

	if (argc > 2) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	fromsnap = argv[0];
	tosnap = (argc == 2) ? argv[1] : NULL;

	copy = NULL;
	if (*fromsnap != '@')
	copy = strdup(fromsnap);
	else if (tosnap)
	copy = strdup(tosnap);
	if (copy == NULL)
	usage(B_FALSE);

	if ((atp = strchr(copy, '@')) != NULL)
	*atp = '\0';

	if ((zhp = zfs_open(g_zfs, copy, ZFS_TYPE_FILESYSTEM)) == NULL) {
	free(copy);
	return (1);
	}
	free(copy);

	/*
	* Ignore SIGPIPE so that the library can give us
	* information on any failure
	*/
	if (sigemptyset(&sa.sa_mask) == -1) {
	err = errno;
	goto out;
	}
	sa.sa_flags = 0;
	sa.sa_handler = SIG_IGN;
	if (sigaction(SIGPIPE, &sa, NULL) == -1) {
	err = errno;
	goto out;
	}

	err = zfs_show_diffs(zhp, STDOUT_FILENO, fromsnap, tosnap, flags);
	out:
	zfs_close(zhp);

	return (err != 0);
	}

	/*
	* zfs bookmark <fs@source>\|<fs#source> <fs#bookmark>
	*
	* Creates a bookmark with the given name from the source snapshot
	* or creates a copy of an existing source bookmark.
	*/
	static int
	zfs_do_bookmark(int argc, char **argv)
	{
	char source, bookname;
	char expbuf[ZFS_MAX_DATASET_NAME_LEN];
	int source_type;
	nvlist_t *nvl;
	int ret = 0;
	int c;

	/* check options */
	while ((c = getopt(argc, argv, "")) != -1) {
	switch (c) {
	case '?':
	(void) fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	goto usage;
	}
	}

	argc -= optind;
	argv += optind;

	/* check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing source argument\n"));
	goto usage;
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing bookmark argument\n"));
	goto usage;
	}

	source = argv[0];
	bookname = argv[1];

	if (strchr(source, '@') == NULL && strchr(source, '#') == NULL) {
	(void) fprintf(stderr,
	gettext("invalid source name '%s': "
	"must contain a '@' or '#'\n"), source);
	goto usage;
	}
	if (strchr(bookname, '#') == NULL) {
	(void) fprintf(stderr,
	gettext("invalid bookmark name '%s': "
	"must contain a '#'\n"), bookname);
	goto usage;
	}

	/*
	* expand source or bookname to full path:
	* one of them may be specified as short name
	*/
	{
	char **expand;
	char source_short, bookname_short;
	source_short = strpbrk(source, "@#");
	bookname_short = strpbrk(bookname, "#");
	if (source_short == source &&
	bookname_short == bookname) {
	(void) fprintf(stderr, gettext(
	"either source or bookmark must be specified as "
	"full dataset paths"));
	goto usage;
	} else if (source_short != source &&
	bookname_short != bookname) {
	expand = NULL;
	} else if (source_short != source) {
	strlcpy(expbuf, source, sizeof (expbuf));
	expand = &bookname;
	} else if (bookname_short != bookname) {
	strlcpy(expbuf, bookname, sizeof (expbuf));
	expand = &source;
	} else {
	abort();
	}
	if (expand != NULL) {
	strpbrk(expbuf, "@#") = '\0'; / dataset name in buf */
	(void) strlcat(expbuf, *expand, sizeof (expbuf));
	*expand = expbuf;
	}
	}

	/* determine source type */
	switch (*strpbrk(source, "@#")) {
	case '@': source_type = ZFS_TYPE_SNAPSHOT; break;
	case '#': source_type = ZFS_TYPE_BOOKMARK; break;
	default: abort();
	}

	/* test the source exists */
	zfs_handle_t *zhp;
	zhp = zfs_open(g_zfs, source, source_type);
	if (zhp == NULL)
	goto usage;
	zfs_close(zhp);

	nvl = fnvlist_alloc();
	fnvlist_add_string(nvl, bookname, source);
	ret = lzc_bookmark(nvl, NULL);
	fnvlist_free(nvl);

	if (ret != 0) {
	const char *err_msg = NULL;
	char errbuf[1024];

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot create bookmark '%s'"), bookname);

	switch (ret) {
	case EXDEV:
	err_msg = "bookmark is in a different pool";
	break;
	case ZFS_ERR_BOOKMARK_SOURCE_NOT_ANCESTOR:
	err_msg = "source is not an ancestor of the "
	"new bookmark's dataset";
	break;
	case EEXIST:
	err_msg = "bookmark exists";
	break;
	case EINVAL:
	err_msg = "invalid argument";
	break;
	case ENOTSUP:
	err_msg = "bookmark feature not enabled";
	break;
	case ENOSPC:
	err_msg = "out of space";
	break;
	case ENOENT:
	err_msg = "dataset does not exist";
	break;
	default:
	(void) zfs_standard_error(g_zfs, ret, errbuf);
	break;
	}
	if (err_msg != NULL) {
	(void) fprintf(stderr, "%s: %s\n", errbuf,
	dgettext(TEXT_DOMAIN, err_msg));
	}
	}

	return (ret != 0);

	usage:
	usage(B_FALSE);
	return (-1);
	}

	static int
	zfs_do_channel_program(int argc, char **argv)
	{
	int ret, fd, c;
	char progbuf, filename, *poolname;
	size_t progsize, progread;
	nvlist_t *outnvl = NULL;
	uint64_t instrlimit = ZCP_DEFAULT_INSTRLIMIT;
	uint64_t memlimit = ZCP_DEFAULT_MEMLIMIT;
	boolean_t sync_flag = B_TRUE, json_output = B_FALSE;
	zpool_handle_t *zhp;

	/* check options */
	while ((c = getopt(argc, argv, "nt:m:j")) != -1) {
	switch (c) {
	case 't':
	case 'm': {
	uint64_t arg;
	char *endp;

	errno = 0;
	arg = strtoull(optarg, &endp, 0);
	if (errno != 0 \|\| *endp != '\0') {
	(void) fprintf(stderr, gettext(
	"invalid argument "
	"'%s': expected integer\n"), optarg);
	goto usage;
	}

	if (c == 't') {
	instrlimit = arg;
	} else {
	ASSERT3U(c, ==, 'm');
	memlimit = arg;
	}
	break;
	}
	case 'n': {
	sync_flag = B_FALSE;
	break;
	}
	case 'j': {
	json_output = B_TRUE;
	break;
	}
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	goto usage;
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 2) {
	(void) fprintf(stderr,
	gettext("invalid number of arguments\n"));
	goto usage;
	}

	poolname = argv[0];
	filename = argv[1];
	if (strcmp(filename, "-") == 0) {
	fd = 0;
	filename = "standard input";
	} else if ((fd = open(filename, O_RDONLY)) < 0) {
	(void) fprintf(stderr, gettext("cannot open '%s': %s\n"),
	filename, strerror(errno));
	return (1);
	}

	if ((zhp = zpool_open(g_zfs, poolname)) == NULL) {
	(void) fprintf(stderr, gettext("cannot open pool '%s'\n"),
	poolname);
	if (fd != 0)
	(void) close(fd);
	return (1);
	}
	zpool_close(zhp);

	/*
	* Read in the channel program, expanding the program buffer as
	* necessary.
	*/
	progread = 0;
	progsize = 1024;
	progbuf = safe_malloc(progsize);
	do {
	ret = read(fd, progbuf + progread, progsize - progread);
	progread += ret;
	if (progread == progsize && ret > 0) {
	progsize *= 2;
	progbuf = safe_realloc(progbuf, progsize);
	}
	} while (ret > 0);

	if (fd != 0)
	(void) close(fd);
	if (ret < 0) {
	free(progbuf);
	(void) fprintf(stderr,
	gettext("cannot read '%s': %s\n"),
	filename, strerror(errno));
	return (1);
	}
	progbuf[progread] = '\0';

	/*
	* Any remaining arguments are passed as arguments to the lua script as
	* a string array:
	* {
	* "argv" -> [ "arg 1", ... "arg n" ],
	* }
	*/
	nvlist_t *argnvl = fnvlist_alloc();
	fnvlist_add_string_array(argnvl, ZCP_ARG_CLIARGV, argv + 2, argc - 2);

	if (sync_flag) {
	ret = lzc_channel_program(poolname, progbuf,
	instrlimit, memlimit, argnvl, &outnvl);
	} else {
	ret = lzc_channel_program_nosync(poolname, progbuf,
	instrlimit, memlimit, argnvl, &outnvl);
	}

	if (ret != 0) {
	/*
	* On error, report the error message handed back by lua if one
	* exists. Otherwise, generate an appropriate error message,
	* falling back on strerror() for an unexpected return code.
	*/
	char *errstring = NULL;
	const char *msg = gettext("Channel program execution failed");
	uint64_t instructions = 0;
	if (outnvl != NULL && nvlist_exists(outnvl, ZCP_RET_ERROR)) {
	(void) nvlist_lookup_string(outnvl,
	ZCP_RET_ERROR, &errstring);
	if (errstring == NULL)
	errstring = strerror(ret);
	if (ret == ETIME) {
	(void) nvlist_lookup_uint64(outnvl,
	ZCP_ARG_INSTRLIMIT, &instructions);
	}
	} else {
	switch (ret) {
	case EINVAL:
	errstring =
	"Invalid instruction or memory limit.";
	break;
	case ENOMEM:
	errstring = "Return value too large.";
	break;
	case ENOSPC:
	errstring = "Memory limit exhausted.";
	break;
	case ETIME:
	errstring = "Timed out.";
	break;
	case EPERM:
	errstring = "Permission denied. Channel "
	"programs must be run as root.";
	break;
	default:
	(void) zfs_standard_error(g_zfs, ret, msg);
	}
	}
	if (errstring != NULL)
	(void) fprintf(stderr, "%s:\n%s\n", msg, errstring);

	if (ret == ETIME && instructions != 0)
	(void) fprintf(stderr,
	gettext("%llu Lua instructions\n"),
	(u_longlong_t)instructions);
	} else {
	if (json_output) {
	(void) nvlist_print_json(stdout, outnvl);
	} else if (nvlist_empty(outnvl)) {
	(void) fprintf(stdout, gettext("Channel program fully "
	"executed and did not produce output.\n"));
	} else {
	(void) fprintf(stdout, gettext("Channel program fully "
	"executed and produced output:\n"));
	dump_nvlist(outnvl, 4);
	}
	}

	free(progbuf);
	fnvlist_free(outnvl);
	fnvlist_free(argnvl);
	return (ret != 0);

	usage:
	usage(B_FALSE);
	return (-1);
	}


	typedef struct loadkey_cbdata {
	boolean_t cb_loadkey;
	boolean_t cb_recursive;
	boolean_t cb_noop;
	char *cb_keylocation;
	uint64_t cb_numfailed;
	uint64_t cb_numattempted;
	} loadkey_cbdata_t;

	static int
	load_key_callback(zfs_handle_t zhp, void data)
	{
	int ret;
	boolean_t is_encroot;
	loadkey_cbdata_t *cb = data;
	uint64_t keystatus = zfs_prop_get_int(zhp, ZFS_PROP_KEYSTATUS);

	/*
	* If we are working recursively, we want to skip loading / unloading
	* keys for non-encryption roots and datasets whose keys are already
	* in the desired end-state.
	*/
	if (cb->cb_recursive) {
	ret = zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);
	if (ret != 0)
	return (ret);
	if (!is_encroot)
	return (0);

	if ((cb->cb_loadkey && keystatus == ZFS_KEYSTATUS_AVAILABLE) \|\|
	(!cb->cb_loadkey && keystatus == ZFS_KEYSTATUS_UNAVAILABLE))
	return (0);
	}

	cb->cb_numattempted++;

	if (cb->cb_loadkey)
	ret = zfs_crypto_load_key(zhp, cb->cb_noop, cb->cb_keylocation);
	else
	ret = zfs_crypto_unload_key(zhp);

	if (ret != 0) {
	cb->cb_numfailed++;
	return (ret);
	}

	return (0);
	}

	static int
	load_unload_keys(int argc, char **argv, boolean_t loadkey)
	{
	int c, ret = 0, flags = 0;
	boolean_t do_all = B_FALSE;
	loadkey_cbdata_t cb = { 0 };

	cb.cb_loadkey = loadkey;

	while ((c = getopt(argc, argv, "anrL:")) != -1) {
	/* noop and alternate keylocations only apply to zfs load-key */
	if (loadkey) {
	switch (c) {
	case 'n':
	cb.cb_noop = B_TRUE;
	continue;
	case 'L':
	cb.cb_keylocation = optarg;
	continue;
	default:
	break;
	}
	}

	switch (c) {
	case 'a':
	do_all = B_TRUE;
	cb.cb_recursive = B_TRUE;
	break;
	case 'r':
	flags \|= ZFS_ITER_RECURSE;
	cb.cb_recursive = B_TRUE;
	break;
	default:
	(void) fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (!do_all && argc == 0) {
	(void) fprintf(stderr,
	gettext("Missing dataset argument or -a option\n"));
	usage(B_FALSE);
	}

	if (do_all && argc != 0) {
	(void) fprintf(stderr,
	gettext("Cannot specify dataset with -a option\n"));
	usage(B_FALSE);
	}

	if (cb.cb_recursive && cb.cb_keylocation != NULL &&
	strcmp(cb.cb_keylocation, "prompt") != 0) {
	(void) fprintf(stderr, gettext("alternate keylocation may only "
	"be 'prompt' with -r or -a\n"));
	usage(B_FALSE);
	}

	ret = zfs_for_each(argc, argv, flags,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, NULL, NULL, 0,
	load_key_callback, &cb);

	if (cb.cb_noop \|\| (cb.cb_recursive && cb.cb_numattempted != 0)) {
	(void) printf(gettext("%llu / %llu key(s) successfully %s\n"),
	(u_longlong_t)(cb.cb_numattempted - cb.cb_numfailed),
	(u_longlong_t)cb.cb_numattempted,
	loadkey ? (cb.cb_noop ? "verified" : "loaded") :
	"unloaded");
	}

	if (cb.cb_numfailed != 0)
	ret = -1;

	return (ret);
	}

	static int
	zfs_do_load_key(int argc, char **argv)
	{
	return (load_unload_keys(argc, argv, B_TRUE));
	}


	static int
	zfs_do_unload_key(int argc, char **argv)
	{
	return (load_unload_keys(argc, argv, B_FALSE));
	}

	static int
	zfs_do_change_key(int argc, char **argv)
	{
	int c, ret;
	uint64_t keystatus;
	boolean_t loadkey = B_FALSE, inheritkey = B_FALSE;
	zfs_handle_t *zhp = NULL;
	nvlist_t *props = fnvlist_alloc();

	while ((c = getopt(argc, argv, "lio:")) != -1) {
	switch (c) {
	case 'l':
	loadkey = B_TRUE;
	break;
	case 'i':
	inheritkey = B_TRUE;
	break;
	case 'o':
	if (!parseprop(props, optarg)) {
	nvlist_free(props);
	return (1);
	}
	break;
	default:
	(void) fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	usage(B_FALSE);
	}
	}

	if (inheritkey && !nvlist_empty(props)) {
	(void) fprintf(stderr,
	gettext("Properties not allowed for inheriting\n"));
	usage(B_FALSE);
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("Missing dataset argument\n"));
	usage(B_FALSE);
	}

	if (argc > 1) {
	(void) fprintf(stderr, gettext("Too many arguments\n"));
	usage(B_FALSE);
	}

	zhp = zfs_open(g_zfs, argv[argc - 1],
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL)
	usage(B_FALSE);

	if (loadkey) {
	keystatus = zfs_prop_get_int(zhp, ZFS_PROP_KEYSTATUS);
	if (keystatus != ZFS_KEYSTATUS_AVAILABLE) {
	ret = zfs_crypto_load_key(zhp, B_FALSE, NULL);
	if (ret != 0) {
	nvlist_free(props);
	zfs_close(zhp);
	return (-1);
	}
	}

	/* refresh the properties so the new keystatus is visible */
	zfs_refresh_properties(zhp);
	}

	ret = zfs_crypto_rewrap(zhp, props, inheritkey);
	if (ret != 0) {
	nvlist_free(props);
	zfs_close(zhp);
	return (-1);
	}

	nvlist_free(props);
	zfs_close(zhp);
	return (0);
	}

	/*
	* 1) zfs project [-d\|-r] <file\|directory ...>
	* List project ID and inherit flag of file(s) or directories.
	* -d: List the directory itself, not its children.
	* -r: List subdirectories recursively.
	*
	* 2) zfs project -C [-k] [-r] <file\|directory ...>
	* Clear project inherit flag and/or ID on the file(s) or directories.
	* -k: Keep the project ID unchanged. If not specified, the project ID
	* will be reset as zero.
	* -r: Clear on subdirectories recursively.
	*
	* 3) zfs project -c [-0] [-d\|-r] [-p id] <file\|directory ...>
	* Check project ID and inherit flag on the file(s) or directories,
	* report the outliers.
	* -0: Print file name followed by a NUL instead of newline.
	* -d: Check the directory itself, not its children.
	* -p: Specify the referenced ID for comparing with the target file(s)
	* or directories' project IDs. If not specified, the target (top)
	* directory's project ID will be used as the referenced one.
	* -r: Check subdirectories recursively.
	*
	* 4) zfs project [-p id] [-r] [-s] <file\|directory ...>
	* Set project ID and/or inherit flag on the file(s) or directories.
	* -p: Set the project ID as the given id.
	* -r: Set on subdirectories recursively. If not specify "-p" option,
	* it will use top-level directory's project ID as the given id,
	* then set both project ID and inherit flag on all descendants
	* of the top-level directory.
	* -s: Set project inherit flag.
	*/
	static int
	zfs_do_project(int argc, char **argv)
	{
	zfs_project_control_t zpc = {
	.zpc_expected_projid = ZFS_INVALID_PROJID,
	.zpc_op = ZFS_PROJECT_OP_DEFAULT,
	.zpc_dironly = B_FALSE,
	.zpc_keep_projid = B_FALSE,
	.zpc_newline = B_TRUE,
	.zpc_recursive = B_FALSE,
	.zpc_set_flag = B_FALSE,
	};
	int ret = 0, c;

	if (argc < 2)
	usage(B_FALSE);

	while ((c = getopt(argc, argv, "0Ccdkp:rs")) != -1) {
	switch (c) {
	case '0':
	zpc.zpc_newline = B_FALSE;
	break;
	case 'C':
	if (zpc.zpc_op != ZFS_PROJECT_OP_DEFAULT) {
	(void) fprintf(stderr, gettext("cannot "
	"specify '-C' '-c' '-s' together\n"));
	usage(B_FALSE);
	}

	zpc.zpc_op = ZFS_PROJECT_OP_CLEAR;
	break;
	case 'c':
	if (zpc.zpc_op != ZFS_PROJECT_OP_DEFAULT) {
	(void) fprintf(stderr, gettext("cannot "
	"specify '-C' '-c' '-s' together\n"));
	usage(B_FALSE);
	}

	zpc.zpc_op = ZFS_PROJECT_OP_CHECK;
	break;
	case 'd':
	zpc.zpc_dironly = B_TRUE;
	/* overwrite "-r" option */
	zpc.zpc_recursive = B_FALSE;
	break;
	case 'k':
	zpc.zpc_keep_projid = B_TRUE;
	break;
	case 'p': {
	char *endptr;

	errno = 0;
	zpc.zpc_expected_projid = strtoull(optarg, &endptr, 0);
	if (errno != 0 \|\| *endptr != '\0') {
	(void) fprintf(stderr,
	gettext("project ID must be less than "
	"%u\n"), UINT32_MAX);
	usage(B_FALSE);
	}
	if (zpc.zpc_expected_projid >= UINT32_MAX) {
	(void) fprintf(stderr,
	gettext("invalid project ID\n"));
	usage(B_FALSE);
	}
	break;
	}
	case 'r':
	zpc.zpc_recursive = B_TRUE;
	/* overwrite "-d" option */
	zpc.zpc_dironly = B_FALSE;
	break;
	case 's':
	if (zpc.zpc_op != ZFS_PROJECT_OP_DEFAULT) {
	(void) fprintf(stderr, gettext("cannot "
	"specify '-C' '-c' '-s' together\n"));
	usage(B_FALSE);
	}

	zpc.zpc_set_flag = B_TRUE;
	zpc.zpc_op = ZFS_PROJECT_OP_SET;
	break;
	default:
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	if (zpc.zpc_op == ZFS_PROJECT_OP_DEFAULT) {
	if (zpc.zpc_expected_projid != ZFS_INVALID_PROJID)
	zpc.zpc_op = ZFS_PROJECT_OP_SET;
	else
	zpc.zpc_op = ZFS_PROJECT_OP_LIST;
	}

	switch (zpc.zpc_op) {
	case ZFS_PROJECT_OP_LIST:
	if (zpc.zpc_keep_projid) {
	(void) fprintf(stderr,
	gettext("'-k' is only valid together with '-C'\n"));
	usage(B_FALSE);
	}
	if (!zpc.zpc_newline) {
	(void) fprintf(stderr,
	gettext("'-0' is only valid together with '-c'\n"));
	usage(B_FALSE);
	}
	break;
	case ZFS_PROJECT_OP_CHECK:
	if (zpc.zpc_keep_projid) {
	(void) fprintf(stderr,
	gettext("'-k' is only valid together with '-C'\n"));
	usage(B_FALSE);
	}
	break;
	case ZFS_PROJECT_OP_CLEAR:
	if (zpc.zpc_dironly) {
	(void) fprintf(stderr,
	gettext("'-d' is useless together with '-C'\n"));
	usage(B_FALSE);
	}
	if (!zpc.zpc_newline) {
	(void) fprintf(stderr,
	gettext("'-0' is only valid together with '-c'\n"));
	usage(B_FALSE);
	}
	if (zpc.zpc_expected_projid != ZFS_INVALID_PROJID) {
	(void) fprintf(stderr,
	gettext("'-p' is useless together with '-C'\n"));
	usage(B_FALSE);
	}
	break;
	case ZFS_PROJECT_OP_SET:
	if (zpc.zpc_dironly) {
	(void) fprintf(stderr,
	gettext("'-d' is useless for set project ID and/or "
	"inherit flag\n"));
	usage(B_FALSE);
	}
	if (zpc.zpc_keep_projid) {
	(void) fprintf(stderr,
	gettext("'-k' is only valid together with '-C'\n"));
	usage(B_FALSE);
	}
	if (!zpc.zpc_newline) {
	(void) fprintf(stderr,
	gettext("'-0' is only valid together with '-c'\n"));
	usage(B_FALSE);
	}
	break;
	default:
	ASSERT(0);
	break;
	}

	argv += optind;
	argc -= optind;
	if (argc == 0) {
	(void) fprintf(stderr,
	gettext("missing file or directory target(s)\n"));
	usage(B_FALSE);
	}

	for (int i = 0; i < argc; i++) {
	int err;

	err = zfs_project_handle(argv[i], &zpc);
	if (err && !ret)
	ret = err;
	}

	return (ret);
	}

	static int
	zfs_do_wait(int argc, char **argv)
	{
	boolean_t enabled[ZFS_WAIT_NUM_ACTIVITIES];
	int error, i;
	char c;

	/* By default, wait for all types of activity. */
	for (i = 0; i < ZFS_WAIT_NUM_ACTIVITIES; i++)
	enabled[i] = B_TRUE;

	while ((c = getopt(argc, argv, "t:")) != -1) {
	switch (c) {
	case 't':
	{
	static char *col_subopts[] = { "deleteq", NULL };
	char *value;

	/* Reset activities array */
	bzero(&enabled, sizeof (enabled));
	while (*optarg != '\0') {
	int activity = getsubopt(&optarg, col_subopts,
	&value);

	if (activity < 0) {
	(void) fprintf(stderr,
	gettext("invalid activity '%s'\n"),
	value);
	usage(B_FALSE);
	}

	enabled[activity] = B_TRUE;
	}
	break;
	}
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argv += optind;
	argc -= optind;
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing 'filesystem' "
	"argument\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	zfs_handle_t *zhp = zfs_open(g_zfs, argv[0], ZFS_TYPE_FILESYSTEM);
	if (zhp == NULL)
	return (1);

	for (;;) {
	boolean_t missing = B_FALSE;
	boolean_t any_waited = B_FALSE;

	for (int i = 0; i < ZFS_WAIT_NUM_ACTIVITIES; i++) {
	boolean_t waited;

	if (!enabled[i])
	continue;

	error = zfs_wait_status(zhp, i, &missing, &waited);
	if (error != 0 \|\| missing)
	break;

	any_waited = (any_waited \|\| waited);
	}

	if (error != 0 \|\| missing \|\| !any_waited)
	break;
	}

	zfs_close(zhp);

	return (error);
	}

	/*
	* Display version message
	*/
	static int
	zfs_do_version(int argc, char **argv)
	{
	if (zfs_version_print() == -1)
	return (1);

	return (0);
	}

	int
	main(int argc, char **argv)
	{
	int ret = 0;
	int i = 0;
	char *cmdname;
	char **newargv;

	(void) setlocale(LC_ALL, "");
	+ (void) setlocale(LC_NUMERIC, "C");
	(void) textdomain(TEXT_DOMAIN);

	opterr = 0;

	/*
	* Make sure the user has specified some command.
	*/
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing command\n"));
	usage(B_FALSE);
	}

	cmdname = argv[1];

	/*
	* The 'umount' command is an alias for 'unmount'
	*/
	if (strcmp(cmdname, "umount") == 0)
	cmdname = "unmount";

	/*
	* The 'recv' command is an alias for 'receive'
	*/
	if (strcmp(cmdname, "recv") == 0)
	cmdname = "receive";

	/*
	* The 'snap' command is an alias for 'snapshot'
	*/
	if (strcmp(cmdname, "snap") == 0)
	cmdname = "snapshot";

	/*
	* Special case '-?'
	*/
	if ((strcmp(cmdname, "-?") == 0) \|\|
	(strcmp(cmdname, "--help") == 0))
	usage(B_TRUE);

	/*
	* Special case '-V\|--version'
	*/
	if ((strcmp(cmdname, "-V") == 0) \|\| (strcmp(cmdname, "--version") == 0))
	return (zfs_do_version(argc, argv));

	if ((g_zfs = libzfs_init()) == NULL) {
	(void) fprintf(stderr, "%s\n", libzfs_error_init(errno));
	return (1);
	}

	mnttab_file = g_zfs->libzfs_mnttab;

	zfs_save_arguments(argc, argv, history_str, sizeof (history_str));

	libzfs_print_on_error(g_zfs, B_TRUE);

	/*
	* Many commands modify input strings for string parsing reasons.
	* We create a copy to protect the original argv.
	*/
	newargv = malloc((argc + 1) * sizeof (newargv[0]));
	for (i = 0; i < argc; i++)
	newargv[i] = strdup(argv[i]);
	newargv[argc] = NULL;

	/*
	* Run the appropriate command.
	*/
	libzfs_mnttab_cache(g_zfs, B_TRUE);
	if (find_command_idx(cmdname, &i) == 0) {
	current_command = &command_table[i];
	ret = command_table[i].func(argc - 1, newargv + 1);
	} else if (strchr(cmdname, '=') != NULL) {
	verify(find_command_idx("set", &i) == 0);
	current_command = &command_table[i];
	ret = command_table[i].func(argc, newargv);
	} else {
	(void) fprintf(stderr, gettext("unrecognized "
	"command '%s'\n"), cmdname);
	usage(B_FALSE);
	ret = 1;
	}

	for (i = 0; i < argc; i++)
	free(newargv[i]);
	free(newargv);

	if (ret == 0 && log_history)
	(void) zpool_log_history(g_zfs, history_str);

	libzfs_fini(g_zfs);

	/*
	* The 'ZFS_ABORT' environment variable causes us to dump core on exit
	* for the purposes of running ::findleaks.
	*/
	if (getenv("ZFS_ABORT") != NULL) {
	(void) printf("dumping core by request\n");
	abort();
	}

	return (ret);
	}

	#ifdef __FreeBSD__
	#include <sys/jail.h>
	#include <jail.h>
	/*
	* Attach/detach the given dataset to/from the given jail
	*/
	/* ARGSUSED */
	static int
	zfs_do_jail_impl(int argc, char **argv, boolean_t attach)
	{
	zfs_handle_t *zhp;
	int jailid, ret;

	/* check number of arguments */
	if (argc < 3) {
	(void) fprintf(stderr, gettext("missing argument(s)\n"));
	usage(B_FALSE);
	}
	if (argc > 3) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	jailid = jail_getid(argv[1]);
	if (jailid < 0) {
	(void) fprintf(stderr, gettext("invalid jail id or name\n"));
	usage(B_FALSE);
	}

	zhp = zfs_open(g_zfs, argv[2], ZFS_TYPE_FILESYSTEM);
	if (zhp == NULL)
	return (1);

	ret = (zfs_jail(zhp, jailid, attach) != 0);

	zfs_close(zhp);
	return (ret);
	}

	/*
	* zfs jail jailid filesystem
	*
	* Attach the given dataset to the given jail
	*/
	/* ARGSUSED */
	static int
	zfs_do_jail(int argc, char **argv)
	{
	return (zfs_do_jail_impl(argc, argv, B_TRUE));
	}

	/*
	* zfs unjail jailid filesystem
	*
	* Detach the given dataset from the given jail
	*/
	/* ARGSUSED */
	static int
	zfs_do_unjail(int argc, char **argv)
	{
	return (zfs_do_jail_impl(argc, argv, B_FALSE));
	}
	#endif
	Index: vendor-sys/openzfs/dist/cmd/zgenhostid/zgenhostid
	===================================================================
	--- vendor-sys/openzfs/dist/cmd/zgenhostid/zgenhostid (revision 365891)
	+++ vendor-sys/openzfs/dist/cmd/zgenhostid/zgenhostid (nonexistent)
	@@ -1,61 +0,0 @@
	-#!/usr/bin/env bash
	-
	-# Emulate genhostid(1) available on RHEL/CENTOS, for use on distros
	-# which do not provide that utility.
	-#
	-# Usage:
	-# zgenhostid
	-# zgenhostid <value>
	-#
	-# If /etc/hostid already exists and is size > 0, the script exits immediately
	-# and changes nothing. Unlike genhostid, this generates an error message.
	-#
	-# The first form generates a random hostid and stores it in /etc/hostid.
	-# The second form checks that the provided value is between 0x1 and 0xFFFFFFFF
	-# and if so, stores it in /etc/hostid. This form is not supported by
	-# genhostid(1).
	-
	-hostid_file=/etc/hostid
	-
	-function usage {
	- echo "$0 [value]"
	- echo "If $hostid_file is not present, store a hostid in it." >&2
	- echo "The optional value must be an 8-digit hex number between" >&2
	- echo "1 and 2^32-1. If no value is provided, a random one will" >&2
	- echo "be generated. The value must be unique among your systems." >&2
	-}
	-
	-# hostid(1) ignores contents of /etc/hostid if size < 4 bytes. It would
	-# be better if this checked size >= 4 bytes but it the method must be
	-# widely portable.
	-if [ -s $hostid_file ]; then
	- echo "$hostid_file already exists. No change made." >&2
	- exit 1
	-fi
	-
	-if [ -n "$1" ]; then
	- host_id=$1
	-else
	- # $RANDOM goes from 0..32k-1
	- number=$((((RANDOM % 4) * 32768 + RANDOM) * 32768 + RANDOM))
	- host_id=$(printf "%08x" $number)
	-fi
	-
	-if egrep -o '^0{8}$' <<< $host_id >/dev/null 2>&1; then
	- usage
	- exit 2
	-fi
	-
	-if ! egrep -o '^[a-fA-F0-9]{8}$' <<< $host_id >/dev/null 2>&1; then
	- usage
	- exit 3
	-fi
	-
	-a=${host_id:6:2}
	-b=${host_id:4:2}
	-c=${host_id:2:2}
	-d=${host_id:0:2}
	-
	-echo -ne \\x$a\\x$b\\x$c\\x$d > $hostid_file
	-
	-exit 0

	Property changes on: vendor-sys/openzfs/dist/cmd/zgenhostid/zgenhostid
	___________________________________________________________________
	Deleted: svn:executable
	## -1 +0,0 ##
	-*
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/cmd/zgenhostid/.gitignore
	===================================================================
	--- vendor-sys/openzfs/dist/cmd/zgenhostid/.gitignore (nonexistent)
	+++ vendor-sys/openzfs/dist/cmd/zgenhostid/.gitignore (revision 365892)
	@@ -0,0 +1 @@
	+/zgenhostid
	Index: vendor-sys/openzfs/dist/cmd/zgenhostid/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/cmd/zgenhostid/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/cmd/zgenhostid/Makefile.am (revision 365892)
	@@ -1 +1,5 @@
	-dist_bin_SCRIPTS = zgenhostid
	+include $(top_srcdir)/config/Rules.am
	+
	+bin_PROGRAMS = zgenhostid
	+
	+zgenhostid_SOURCES = zgenhostid.c
	Index: vendor-sys/openzfs/dist/cmd/zgenhostid/zgenhostid.c
	===================================================================
	--- vendor-sys/openzfs/dist/cmd/zgenhostid/zgenhostid.c (nonexistent)
	+++ vendor-sys/openzfs/dist/cmd/zgenhostid/zgenhostid.c (revision 365892)
	@@ -0,0 +1,152 @@
	+/*
	+ * CDDL HEADER START
	+ *
	+ * The contents of this file are subject to the terms of the
	+ * Common Development and Distribution License (the "License").
	+ * You may not use this file except in compliance with the License.
	+ *
	+ * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	+ * or http://www.opensolaris.org/os/licensing.
	+ * See the License for the specific language governing permissions
	+ * and limitations under the License.
	+ *
	+ * When distributing Covered Code, include this CDDL HEADER in each
	+ * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	+ * If applicable, add the following below this CDDL HEADER, with the
	+ * fields enclosed by brackets "[]" replaced with your own identifying
	+ * information: Portions Copyright [yyyy] [name of copyright owner]
	+ *
	+ * CDDL HEADER END
	+ */
	+
	+/*
	+ * Copyright (c) 2020, Georgy Yakovlev. All rights reserved.
	+ */
	+
	+#include <errno.h>
	+#include <fcntl.h>
	+#include <getopt.h>
	+#include <inttypes.h>
	+#include <limits.h>
	+#include <stdint.h>
	+#include <stdio.h>
	+#include <stdlib.h>
	+#include <string.h>
	+#include <sys/stat.h>
	+#include <time.h>
	+#include <unistd.h>
	+
	+static void usage(void);
	+
	+static void
	+usage(void)
	+{
	+ (void) fprintf(stderr,
	+ "usage: zgenhostid [-fh] [-o path] [value]\n\n"
	+ " -f\t\t force hostid file write\n"
	+ " -h\t\t print this usage and exit\n"
	+ " -o <filename>\t write hostid to this file\n\n"
	+ "If hostid file is not present, store a hostid in it.\n"
	+ "The optional value must be an 8-digit hex number between"
	+ "1 and 2^32-1.\n"
	+ "If no value is provided, a random one will"
	+ "be generated.\n"
	+ "The value must be unique among your systems.\n");
	+ exit(EXIT_FAILURE);
	+ /* NOTREACHED */
	+}
	+
	+int
	+main(int argc, char **argv)
	+{
	+ /* default file path, can be optionally set by user */
	+ char path[PATH_MAX] = "/etc/hostid";
	+ /* holds converted user input or lrand48() generated value */
	+ unsigned long input_i = 0;
	+
	+ int opt;
	+ int pathlen;
	+ int force_fwrite = 0;
	+ while ((opt = getopt_long(argc, argv, "fo:h?", 0, 0)) != -1) {
	+ switch (opt) {
	+ case 'f':
	+ force_fwrite = 1;
	+ break;
	+ case 'o':
	+ pathlen = snprintf(path, sizeof (path), "%s", optarg);
	+ if (pathlen >= sizeof (path)) {
	+ fprintf(stderr, "%s\n", strerror(EOVERFLOW));
	+ exit(EXIT_FAILURE);
	+ } else if (pathlen < 1) {
	+ fprintf(stderr, "%s\n", strerror(EINVAL));
	+ exit(EXIT_FAILURE);
	+ }
	+ break;
	+ case 'h':
	+ case '?':
	+ usage();
	+ }
	+ }
	+
	+ char *in_s = argv[optind];
	+ if (in_s != NULL) {
	+ /* increment pointer by 2 if string is 0x prefixed */
	+ if (strncasecmp("0x", in_s, 2) == 0) {
	+ in_s += 2;
	+ }
	+
	+ /* need to be exactly 8 characters */
	+ const char *hex = "0123456789abcdefABCDEF";
	+ if (strlen(in_s) != 8 \|\| strspn(in_s, hex) != 8) {
	+ fprintf(stderr, "%s\n", strerror(ERANGE));
	+ usage();
	+ }
	+
	+ input_i = strtoul(in_s, NULL, 16);
	+ if (errno != 0) {
	+ perror("strtoul");
	+ exit(EXIT_FAILURE);
	+ }
	+
	+ if (input_i < 0x1 \|\| input_i > UINT32_MAX) {
	+ fprintf(stderr, "%s\n", strerror(ERANGE));
	+ usage();
	+ }
	+ }
	+
	+ struct stat fstat;
	+ if (force_fwrite == 0 && stat(path, &fstat) == 0 &&
	+ S_ISREG(fstat.st_mode)) {
	+ fprintf(stderr, "%s: %s\n", path, strerror(EEXIST));
	+ exit(EXIT_FAILURE);
	+ }
	+
	+ /*
	+ * generate if not provided by user
	+ * also handle unlikely zero return from lrand48()
	+ */
	+ while (input_i == 0) {
	+ srand48(getpid() ^ time(NULL));
	+ input_i = lrand48();
	+ }
	+
	+ FILE *fp = fopen(path, "wb");
	+ if (!fp) {
	+ perror("fopen");
	+ exit(EXIT_FAILURE);
	+ }
	+
	+ /*
	+ * we need just 4 bytes in native endianess
	+ * not using sethostid() because it may be missing or just a stub
	+ */
	+ uint32_t hostid = input_i;
	+ int written = fwrite(&hostid, 1, 4, fp);
	+ if (written != 4) {
	+ perror("fwrite");
	+ exit(EXIT_FAILURE);
	+ }
	+
	+ fclose(fp);
	+ exit(EXIT_SUCCESS);
	+}

	Property changes on: vendor-sys/openzfs/dist/cmd/zgenhostid/zgenhostid.c
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/cmd/zpool/zpool_main.c
	===================================================================
	--- vendor-sys/openzfs/dist/cmd/zpool/zpool_main.c (revision 365891)
	+++ vendor-sys/openzfs/dist/cmd/zpool/zpool_main.c (revision 365892)
	@@ -1,10329 +1,10337 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2012 by Frederik Wessels. All rights reserved.
	* Copyright (c) 2012 by Cyril Plisko. All rights reserved.
	* Copyright (c) 2013 by Prasad Joshi (sTec). All rights reserved.
	* Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>.
	* Copyright (c) 2017 Datto Inc.
	* Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
	* Copyright (c) 2017, Intel Corporation.
	* Copyright (c) 2019, loli10K <ezomori.nozomu@gmail.com>
	*/

	#include <assert.h>
	#include <ctype.h>
	#include <dirent.h>
	#include <errno.h>
	#include <fcntl.h>
	#include <getopt.h>
	#include <libgen.h>
	#include <libintl.h>
	#include <libuutil.h>
	#include <locale.h>
	#include <pthread.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <strings.h>
	#include <time.h>
	#include <unistd.h>
	#include <pwd.h>
	#include <zone.h>
	#include <sys/wait.h>
	#include <zfs_prop.h>
	#include <sys/fs/zfs.h>
	#include <sys/stat.h>
	#include <sys/systeminfo.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/fm/util.h>
	#include <sys/fm/protocol.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/mount.h>
	#include <sys/sysmacros.h>

	#include <math.h>

	#include <libzfs.h>
	#include <libzutil.h>

	#include "zpool_util.h"
	#include "zfs_comutil.h"
	#include "zfeature_common.h"

	#include "statcommon.h"

	libzfs_handle_t *g_zfs;

	static int zpool_do_create(int, char **);
	static int zpool_do_destroy(int, char **);

	static int zpool_do_add(int, char **);
	static int zpool_do_remove(int, char **);
	static int zpool_do_labelclear(int, char **);

	static int zpool_do_checkpoint(int, char **);

	static int zpool_do_list(int, char **);
	static int zpool_do_iostat(int, char **);
	static int zpool_do_status(int, char **);

	static int zpool_do_online(int, char **);
	static int zpool_do_offline(int, char **);
	static int zpool_do_clear(int, char **);
	static int zpool_do_reopen(int, char **);

	static int zpool_do_reguid(int, char **);

	static int zpool_do_attach(int, char **);
	static int zpool_do_detach(int, char **);
	static int zpool_do_replace(int, char **);
	static int zpool_do_split(int, char **);

	static int zpool_do_initialize(int, char **);
	static int zpool_do_scrub(int, char **);
	static int zpool_do_resilver(int, char **);
	static int zpool_do_trim(int, char **);

	static int zpool_do_import(int, char **);
	static int zpool_do_export(int, char **);

	static int zpool_do_upgrade(int, char **);

	static int zpool_do_history(int, char **);
	static int zpool_do_events(int, char **);

	static int zpool_do_get(int, char **);
	static int zpool_do_set(int, char **);

	static int zpool_do_sync(int, char **);

	static int zpool_do_version(int, char **);

	static int zpool_do_wait(int, char **);

	/*
	* These libumem hooks provide a reasonable set of defaults for the allocator's
	* debugging facilities.
	*/

	#ifdef DEBUG
	const char *
	_umem_debug_init(void)
	{
	return ("default,verbose"); /* $UMEM_DEBUG setting */
	}

	const char *
	_umem_logging_init(void)
	{
	return ("fail,contents"); /* $UMEM_LOGGING setting */
	}
	#endif

	typedef enum {
	HELP_ADD,
	HELP_ATTACH,
	HELP_CLEAR,
	HELP_CREATE,
	HELP_CHECKPOINT,
	HELP_DESTROY,
	HELP_DETACH,
	HELP_EXPORT,
	HELP_HISTORY,
	HELP_IMPORT,
	HELP_IOSTAT,
	HELP_LABELCLEAR,
	HELP_LIST,
	HELP_OFFLINE,
	HELP_ONLINE,
	HELP_REPLACE,
	HELP_REMOVE,
	HELP_INITIALIZE,
	HELP_SCRUB,
	HELP_RESILVER,
	HELP_TRIM,
	HELP_STATUS,
	HELP_UPGRADE,
	HELP_EVENTS,
	HELP_GET,
	HELP_SET,
	HELP_SPLIT,
	HELP_SYNC,
	HELP_REGUID,
	HELP_REOPEN,
	HELP_VERSION,
	HELP_WAIT
	} zpool_help_t;


	/*
	* Flags for stats to display with "zpool iostats"
	*/
	enum iostat_type {
	IOS_DEFAULT = 0,
	IOS_LATENCY = 1,
	IOS_QUEUES = 2,
	IOS_L_HISTO = 3,
	IOS_RQ_HISTO = 4,
	IOS_COUNT, /* always last element */
	};

	/* iostat_type entries as bitmasks */
	#define IOS_DEFAULT_M (1ULL << IOS_DEFAULT)
	#define IOS_LATENCY_M (1ULL << IOS_LATENCY)
	#define IOS_QUEUES_M (1ULL << IOS_QUEUES)
	#define IOS_L_HISTO_M (1ULL << IOS_L_HISTO)
	#define IOS_RQ_HISTO_M (1ULL << IOS_RQ_HISTO)

	/* Mask of all the histo bits */
	#define IOS_ANYHISTO_M (IOS_L_HISTO_M \| IOS_RQ_HISTO_M)

	/*
	* Lookup table for iostat flags to nvlist names. Basically a list
	* of all the nvlists a flag requires. Also specifies the order in
	* which data gets printed in zpool iostat.
	*/
	static const char *vsx_type_to_nvlist[IOS_COUNT][13] = {
	[IOS_L_HISTO] = {
	ZPOOL_CONFIG_VDEV_TOT_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_TOT_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_DISK_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_DISK_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_SYNC_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_SYNC_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_ASYNC_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_ASYNC_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_SCRUB_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_TRIM_LAT_HISTO,
	NULL},
	[IOS_LATENCY] = {
	ZPOOL_CONFIG_VDEV_TOT_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_TOT_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_DISK_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_DISK_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_TRIM_LAT_HISTO,
	NULL},
	[IOS_QUEUES] = {
	ZPOOL_CONFIG_VDEV_SYNC_R_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_SYNC_W_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_ASYNC_R_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_ASYNC_W_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_SCRUB_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_TRIM_ACTIVE_QUEUE,
	NULL},
	[IOS_RQ_HISTO] = {
	ZPOOL_CONFIG_VDEV_SYNC_IND_R_HISTO,
	ZPOOL_CONFIG_VDEV_SYNC_AGG_R_HISTO,
	ZPOOL_CONFIG_VDEV_SYNC_IND_W_HISTO,
	ZPOOL_CONFIG_VDEV_SYNC_AGG_W_HISTO,
	ZPOOL_CONFIG_VDEV_ASYNC_IND_R_HISTO,
	ZPOOL_CONFIG_VDEV_ASYNC_AGG_R_HISTO,
	ZPOOL_CONFIG_VDEV_ASYNC_IND_W_HISTO,
	ZPOOL_CONFIG_VDEV_ASYNC_AGG_W_HISTO,
	ZPOOL_CONFIG_VDEV_IND_SCRUB_HISTO,
	ZPOOL_CONFIG_VDEV_AGG_SCRUB_HISTO,
	ZPOOL_CONFIG_VDEV_IND_TRIM_HISTO,
	ZPOOL_CONFIG_VDEV_AGG_TRIM_HISTO,
	NULL},
	};


	/*
	* Given a cb->cb_flags with a histogram bit set, return the iostat_type.
	* Right now, only one histo bit is ever set at one time, so we can
	* just do a highbit64(a)
	*/
	#define IOS_HISTO_IDX(a) (highbit64(a & IOS_ANYHISTO_M) - 1)

	typedef struct zpool_command {
	const char *name;
	int (func)(int, char *);
	zpool_help_t usage;
	} zpool_command_t;

	/*
	* Master command table. Each ZFS command has a name, associated function, and
	* usage message. The usage messages need to be internationalized, so we have
	* to have a function to return the usage message based on a command index.
	*
	* These commands are organized according to how they are displayed in the usage
	* message. An empty command (one with a NULL name) indicates an empty line in
	* the generic usage message.
	*/
	static zpool_command_t command_table[] = {
	{ "version", zpool_do_version, HELP_VERSION },
	{ NULL },
	{ "create", zpool_do_create, HELP_CREATE },
	{ "destroy", zpool_do_destroy, HELP_DESTROY },
	{ NULL },
	{ "add", zpool_do_add, HELP_ADD },
	{ "remove", zpool_do_remove, HELP_REMOVE },
	{ NULL },
	{ "labelclear", zpool_do_labelclear, HELP_LABELCLEAR },
	{ NULL },
	{ "checkpoint", zpool_do_checkpoint, HELP_CHECKPOINT },
	{ NULL },
	{ "list", zpool_do_list, HELP_LIST },
	{ "iostat", zpool_do_iostat, HELP_IOSTAT },
	{ "status", zpool_do_status, HELP_STATUS },
	{ NULL },
	{ "online", zpool_do_online, HELP_ONLINE },
	{ "offline", zpool_do_offline, HELP_OFFLINE },
	{ "clear", zpool_do_clear, HELP_CLEAR },
	{ "reopen", zpool_do_reopen, HELP_REOPEN },
	{ NULL },
	{ "attach", zpool_do_attach, HELP_ATTACH },
	{ "detach", zpool_do_detach, HELP_DETACH },
	{ "replace", zpool_do_replace, HELP_REPLACE },
	{ "split", zpool_do_split, HELP_SPLIT },
	{ NULL },
	{ "initialize", zpool_do_initialize, HELP_INITIALIZE },
	{ "resilver", zpool_do_resilver, HELP_RESILVER },
	{ "scrub", zpool_do_scrub, HELP_SCRUB },
	{ "trim", zpool_do_trim, HELP_TRIM },
	{ NULL },
	{ "import", zpool_do_import, HELP_IMPORT },
	{ "export", zpool_do_export, HELP_EXPORT },
	{ "upgrade", zpool_do_upgrade, HELP_UPGRADE },
	{ "reguid", zpool_do_reguid, HELP_REGUID },
	{ NULL },
	{ "history", zpool_do_history, HELP_HISTORY },
	{ "events", zpool_do_events, HELP_EVENTS },
	{ NULL },
	{ "get", zpool_do_get, HELP_GET },
	{ "set", zpool_do_set, HELP_SET },
	{ "sync", zpool_do_sync, HELP_SYNC },
	{ NULL },
	{ "wait", zpool_do_wait, HELP_WAIT },
	};

	#define NCOMMAND (ARRAY_SIZE(command_table))

	#define VDEV_ALLOC_CLASS_LOGS "logs"

	static zpool_command_t *current_command;
	static char history_str[HIS_MAX_RECORD_LEN];
	static boolean_t log_history = B_TRUE;
	static uint_t timestamp_fmt = NODATE;

	static const char *
	get_usage(zpool_help_t idx)
	{
	switch (idx) {
	case HELP_ADD:
	return (gettext("\tadd [-fgLnP] [-o property=value] "
	"<pool> <vdev> ...\n"));
	case HELP_ATTACH:
	return (gettext("\tattach [-fsw] [-o property=value] "
	"<pool> <device> <new-device>\n"));
	case HELP_CLEAR:
	return (gettext("\tclear [-nF] <pool> [device]\n"));
	case HELP_CREATE:
	return (gettext("\tcreate [-fnd] [-o property=value] ... \n"
	"\t [-O file-system-property=value] ... \n"
	"\t [-m mountpoint] [-R root] <pool> <vdev> ...\n"));
	case HELP_CHECKPOINT:
	return (gettext("\tcheckpoint [-d [-w]] <pool> ...\n"));
	case HELP_DESTROY:
	return (gettext("\tdestroy [-f] <pool>\n"));
	case HELP_DETACH:
	return (gettext("\tdetach <pool> <device>\n"));
	case HELP_EXPORT:
	return (gettext("\texport [-af] <pool> ...\n"));
	case HELP_HISTORY:
	return (gettext("\thistory [-il] [<pool>] ...\n"));
	case HELP_IMPORT:
	return (gettext("\timport [-d dir] [-D]\n"
	"\timport [-o mntopts] [-o property=value] ... \n"
	"\t [-d dir \| -c cachefile] [-D] [-l] [-f] [-m] [-N] "
	"[-R root] [-F [-n]] -a\n"
	"\timport [-o mntopts] [-o property=value] ... \n"
	"\t [-d dir \| -c cachefile] [-D] [-l] [-f] [-m] [-N] "
	"[-R root] [-F [-n]]\n"
	"\t [--rewind-to-checkpoint] <pool \| id> [newpool]\n"));
	case HELP_IOSTAT:
	return (gettext("\tiostat [[[-c [script1,script2,...]"
	"[-lq]]\|[-rw]] [-T d \| u] [-ghHLpPvy]\n"
	"\t [[pool ...]\|[pool vdev ...]\|[vdev ...]]"
	" [[-n] interval [count]]\n"));
	case HELP_LABELCLEAR:
	return (gettext("\tlabelclear [-f] <vdev>\n"));
	case HELP_LIST:
	return (gettext("\tlist [-gHLpPv] [-o property[,...]] "
	"[-T d\|u] [pool] ... \n"
	"\t [interval [count]]\n"));
	case HELP_OFFLINE:
	return (gettext("\toffline [-f] [-t] <pool> <device> ...\n"));
	case HELP_ONLINE:
	return (gettext("\tonline [-e] <pool> <device> ...\n"));
	case HELP_REPLACE:
	return (gettext("\treplace [-fsw] [-o property=value] "
	"<pool> <device> [new-device]\n"));
	case HELP_REMOVE:
	return (gettext("\tremove [-npsw] <pool> <device> ...\n"));
	case HELP_REOPEN:
	return (gettext("\treopen [-n] <pool>\n"));
	case HELP_INITIALIZE:
	return (gettext("\tinitialize [-c \| -s] [-w] <pool> "
	"[<device> ...]\n"));
	case HELP_SCRUB:
	return (gettext("\tscrub [-s \| -p] [-w] <pool> ...\n"));
	case HELP_RESILVER:
	return (gettext("\tresilver <pool> ...\n"));
	case HELP_TRIM:
	return (gettext("\ttrim [-dw] [-r <rate>] [-c \| -s] <pool> "
	"[<device> ...]\n"));
	case HELP_STATUS:
	return (gettext("\tstatus [-c [script1,script2,...]] "
	"[-igLpPstvxD] [-T d\|u] [pool] ... \n"
	"\t [interval [count]]\n"));
	case HELP_UPGRADE:
	return (gettext("\tupgrade\n"
	"\tupgrade -v\n"
	"\tupgrade [-V version] <-a \| pool ...>\n"));
	case HELP_EVENTS:
	return (gettext("\tevents [-vHf [pool] \| -c]\n"));
	case HELP_GET:
	return (gettext("\tget [-Hp] [-o \"all\" \| field[,...]] "
	"<\"all\" \| property[,...]> <pool> ...\n"));
	case HELP_SET:
	return (gettext("\tset <property=value> <pool> \n"));
	case HELP_SPLIT:
	return (gettext("\tsplit [-gLnPl] [-R altroot] [-o mntopts]\n"
	"\t [-o property=value] <pool> <newpool> "
	"[<device> ...]\n"));
	case HELP_REGUID:
	return (gettext("\treguid <pool>\n"));
	case HELP_SYNC:
	return (gettext("\tsync [pool] ...\n"));
	case HELP_VERSION:
	return (gettext("\tversion\n"));
	case HELP_WAIT:
	return (gettext("\twait [-Hp] [-T d\|u] [-t <activity>[,...]] "
	"<pool> [interval]\n"));
	}

	abort();
	/* NOTREACHED */
	}

	static void
	zpool_collect_leaves(zpool_handle_t zhp, nvlist_t nvroot, nvlist_t *res)
	{
	uint_t children = 0;
	nvlist_t **child;
	uint_t i;

	(void) nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_CHILDREN,
	&child, &children);

	if (children == 0) {
	char *path = zpool_vdev_name(g_zfs, zhp, nvroot,
	VDEV_NAME_PATH);

	if (strcmp(path, VDEV_TYPE_INDIRECT) != 0 &&
	strcmp(path, VDEV_TYPE_HOLE) != 0)
	fnvlist_add_boolean(res, path);

	free(path);
	return;
	}

	for (i = 0; i < children; i++) {
	zpool_collect_leaves(zhp, child[i], res);
	}
	}

	/*
	* Callback routine that will print out a pool property value.
	*/
	static int
	print_prop_cb(int prop, void *cb)
	{
	FILE *fp = cb;

	(void) fprintf(fp, "\t%-19s ", zpool_prop_to_name(prop));

	if (zpool_prop_readonly(prop))
	(void) fprintf(fp, " NO ");
	else
	(void) fprintf(fp, " YES ");

	if (zpool_prop_values(prop) == NULL)
	(void) fprintf(fp, "-\n");
	else
	(void) fprintf(fp, "%s\n", zpool_prop_values(prop));

	return (ZPROP_CONT);
	}

	/*
	* Display usage message. If we're inside a command, display only the usage for
	* that command. Otherwise, iterate over the entire command table and display
	* a complete usage message.
	*/
	static void
	usage(boolean_t requested)
	{
	FILE *fp = requested ? stdout : stderr;

	if (current_command == NULL) {
	int i;

	(void) fprintf(fp, gettext("usage: zpool command args ...\n"));
	(void) fprintf(fp,
	gettext("where 'command' is one of the following:\n\n"));

	for (i = 0; i < NCOMMAND; i++) {
	if (command_table[i].name == NULL)
	(void) fprintf(fp, "\n");
	else
	(void) fprintf(fp, "%s",
	get_usage(command_table[i].usage));
	}
	} else {
	(void) fprintf(fp, gettext("usage:\n"));
	(void) fprintf(fp, "%s", get_usage(current_command->usage));
	}

	if (current_command != NULL &&
	((strcmp(current_command->name, "set") == 0) \|\|
	(strcmp(current_command->name, "get") == 0) \|\|
	(strcmp(current_command->name, "list") == 0))) {

	(void) fprintf(fp,
	gettext("\nthe following properties are supported:\n"));

	(void) fprintf(fp, "\n\t%-19s %s %s\n\n",
	"PROPERTY", "EDIT", "VALUES");

	/* Iterate over all properties */
	(void) zprop_iter(print_prop_cb, fp, B_FALSE, B_TRUE,
	ZFS_TYPE_POOL);

	(void) fprintf(fp, "\t%-19s ", "feature@...");
	(void) fprintf(fp, "YES disabled \| enabled \| active\n");

	(void) fprintf(fp, gettext("\nThe feature@ properties must be "
	"appended with a feature name.\nSee zpool-features(5).\n"));
	}

	/*
	* See comments at end of main().
	*/
	if (getenv("ZFS_ABORT") != NULL) {
	(void) printf("dumping core by request\n");
	abort();
	}

	exit(requested ? 0 : 2);
	}

	/*
	* zpool initialize [-c \| -s] [-w] <pool> [<vdev> ...]
	* Initialize all unused blocks in the specified vdevs, or all vdevs in the pool
	* if none specified.
	*
	* -c Cancel. Ends active initializing.
	* -s Suspend. Initializing can then be restarted with no flags.
	* -w Wait. Blocks until initializing has completed.
	*/
	int
	zpool_do_initialize(int argc, char **argv)
	{
	int c;
	char *poolname;
	zpool_handle_t *zhp;
	nvlist_t *vdevs;
	int err = 0;
	boolean_t wait = B_FALSE;

	struct option long_options[] = {
	{"cancel", no_argument, NULL, 'c'},
	{"suspend", no_argument, NULL, 's'},
	{"wait", no_argument, NULL, 'w'},
	{0, 0, 0, 0}
	};

	pool_initialize_func_t cmd_type = POOL_INITIALIZE_START;
	while ((c = getopt_long(argc, argv, "csw", long_options, NULL)) != -1) {
	switch (c) {
	case 'c':
	if (cmd_type != POOL_INITIALIZE_START &&
	cmd_type != POOL_INITIALIZE_CANCEL) {
	(void) fprintf(stderr, gettext("-c cannot be "
	"combined with other options\n"));
	usage(B_FALSE);
	}
	cmd_type = POOL_INITIALIZE_CANCEL;
	break;
	case 's':
	if (cmd_type != POOL_INITIALIZE_START &&
	cmd_type != POOL_INITIALIZE_SUSPEND) {
	(void) fprintf(stderr, gettext("-s cannot be "
	"combined with other options\n"));
	usage(B_FALSE);
	}
	cmd_type = POOL_INITIALIZE_SUSPEND;
	break;
	case 'w':
	wait = B_TRUE;
	break;
	case '?':
	if (optopt != 0) {
	(void) fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	} else {
	(void) fprintf(stderr,
	gettext("invalid option '%s'\n"),
	argv[optind - 1]);
	}
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	usage(B_FALSE);
	return (-1);
	}

	if (wait && (cmd_type != POOL_INITIALIZE_START)) {
	(void) fprintf(stderr, gettext("-w cannot be used with -c or "
	"-s\n"));
	usage(B_FALSE);
	}

	poolname = argv[0];
	zhp = zpool_open(g_zfs, poolname);
	if (zhp == NULL)
	return (-1);

	vdevs = fnvlist_alloc();
	if (argc == 1) {
	/* no individual leaf vdevs specified, so add them all */
	nvlist_t *config = zpool_get_config(zhp, NULL);
	nvlist_t *nvroot = fnvlist_lookup_nvlist(config,
	ZPOOL_CONFIG_VDEV_TREE);
	zpool_collect_leaves(zhp, nvroot, vdevs);
	} else {
	for (int i = 1; i < argc; i++) {
	fnvlist_add_boolean(vdevs, argv[i]);
	}
	}

	if (wait)
	err = zpool_initialize_wait(zhp, cmd_type, vdevs);
	else
	err = zpool_initialize(zhp, cmd_type, vdevs);

	fnvlist_free(vdevs);
	zpool_close(zhp);

	return (err);
	}

	/*
	* print a pool vdev config for dry runs
	*/
	static void
	print_vdev_tree(zpool_handle_t zhp, const char name, nvlist_t *nv, int indent,
	const char *match, int name_flags)
	{
	nvlist_t **child;
	uint_t c, children;
	char *vname;
	boolean_t printed = B_FALSE;

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0) {
	if (name != NULL)
	(void) printf("\t%*s%s\n", indent, "", name);
	return;
	}

	for (c = 0; c < children; c++) {
	uint64_t is_log = B_FALSE;
	char *class = "";

	(void) nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_LOG,
	&is_log);
	if (is_log)
	class = VDEV_ALLOC_BIAS_LOG;
	(void) nvlist_lookup_string(child[c],
	ZPOOL_CONFIG_ALLOCATION_BIAS, &class);
	if (strcmp(match, class) != 0)
	continue;

	if (!printed && name != NULL) {
	(void) printf("\t%*s%s\n", indent, "", name);
	printed = B_TRUE;
	}
	vname = zpool_vdev_name(g_zfs, zhp, child[c], name_flags);
	print_vdev_tree(zhp, vname, child[c], indent + 2, "",
	name_flags);
	free(vname);
	}
	}

	static boolean_t
	prop_list_contains_feature(nvlist_t *proplist)
	{
	nvpair_t *nvp;
	for (nvp = nvlist_next_nvpair(proplist, NULL); NULL != nvp;
	nvp = nvlist_next_nvpair(proplist, nvp)) {
	if (zpool_prop_feature(nvpair_name(nvp)))
	return (B_TRUE);
	}
	return (B_FALSE);
	}

	/*
	* Add a property pair (name, string-value) into a property nvlist.
	*/
	static int
	add_prop_list(const char propname, char propval, nvlist_t **props,
	boolean_t poolprop)
	{
	zpool_prop_t prop = ZPOOL_PROP_INVAL;
	nvlist_t *proplist;
	const char *normnm;
	char *strval;

	if (*props == NULL &&
	nvlist_alloc(props, NV_UNIQUE_NAME, 0) != 0) {
	(void) fprintf(stderr,
	gettext("internal error: out of memory\n"));
	return (1);
	}

	proplist = *props;

	if (poolprop) {
	const char *vname = zpool_prop_to_name(ZPOOL_PROP_VERSION);

	if ((prop = zpool_name_to_prop(propname)) == ZPOOL_PROP_INVAL &&
	!zpool_prop_feature(propname)) {
	(void) fprintf(stderr, gettext("property '%s' is "
	"not a valid pool property\n"), propname);
	return (2);
	}

	/*
	* feature@ properties and version should not be specified
	* at the same time.
	*/
	if ((prop == ZPOOL_PROP_INVAL && zpool_prop_feature(propname) &&
	nvlist_exists(proplist, vname)) \|\|
	(prop == ZPOOL_PROP_VERSION &&
	prop_list_contains_feature(proplist))) {
	(void) fprintf(stderr, gettext("'feature@' and "
	"'version' properties cannot be specified "
	"together\n"));
	return (2);
	}


	if (zpool_prop_feature(propname))
	normnm = propname;
	else
	normnm = zpool_prop_to_name(prop);
	} else {
	zfs_prop_t fsprop = zfs_name_to_prop(propname);

	if (zfs_prop_valid_for_type(fsprop, ZFS_TYPE_FILESYSTEM,
	B_FALSE)) {
	normnm = zfs_prop_to_name(fsprop);
	} else if (zfs_prop_user(propname) \|\|
	zfs_prop_userquota(propname)) {
	normnm = propname;
	} else {
	(void) fprintf(stderr, gettext("property '%s' is "
	"not a valid filesystem property\n"), propname);
	return (2);
	}
	}

	if (nvlist_lookup_string(proplist, normnm, &strval) == 0 &&
	prop != ZPOOL_PROP_CACHEFILE) {
	(void) fprintf(stderr, gettext("property '%s' "
	"specified multiple times\n"), propname);
	return (2);
	}

	if (nvlist_add_string(proplist, normnm, propval) != 0) {
	(void) fprintf(stderr, gettext("internal "
	"error: out of memory\n"));
	return (1);
	}

	return (0);
	}

	/*
	* Set a default property pair (name, string-value) in a property nvlist
	*/
	static int
	add_prop_list_default(const char propname, char propval, nvlist_t **props,
	boolean_t poolprop)
	{
	char *pval;

	if (nvlist_lookup_string(*props, propname, &pval) == 0)
	return (0);

	return (add_prop_list(propname, propval, props, B_TRUE));
	}

	/*
	* zpool add [-fgLnP] [-o property=value] <pool> <vdev> ...
	*
	* -f Force addition of devices, even if they appear in use
	* -g Display guid for individual vdev name.
	* -L Follow links when resolving vdev path name.
	* -n Do not add the devices, but display the resulting layout if
	* they were to be added.
	* -o Set property=value.
	* -P Display full path for vdev name.
	*
	* Adds the given vdevs to 'pool'. As with create, the bulk of this work is
	* handled by make_root_vdev(), which constructs the nvlist needed to pass to
	* libzfs.
	*/
	int
	zpool_do_add(int argc, char **argv)
	{
	boolean_t force = B_FALSE;
	boolean_t dryrun = B_FALSE;
	int name_flags = 0;
	int c;
	nvlist_t *nvroot;
	char *poolname;
	int ret;
	zpool_handle_t *zhp;
	nvlist_t *config;
	nvlist_t *props = NULL;
	char *propval;

	/* check options */
	while ((c = getopt(argc, argv, "fgLno:P")) != -1) {
	switch (c) {
	case 'f':
	force = B_TRUE;
	break;
	case 'g':
	name_flags \|= VDEV_NAME_GUID;
	break;
	case 'L':
	name_flags \|= VDEV_NAME_FOLLOW_LINKS;
	break;
	case 'n':
	dryrun = B_TRUE;
	break;
	case 'o':
	if ((propval = strchr(optarg, '=')) == NULL) {
	(void) fprintf(stderr, gettext("missing "
	"'=' for -o option\n"));
	usage(B_FALSE);
	}
	*propval = '\0';
	propval++;

	if ((strcmp(optarg, ZPOOL_CONFIG_ASHIFT) != 0) \|\|
	(add_prop_list(optarg, propval, &props, B_TRUE)))
	usage(B_FALSE);
	break;
	case 'P':
	name_flags \|= VDEV_NAME_PATH;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* get pool name and check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	usage(B_FALSE);
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing vdev specification\n"));
	usage(B_FALSE);
	}

	poolname = argv[0];

	argc--;
	argv++;

	if ((zhp = zpool_open(g_zfs, poolname)) == NULL)
	return (1);

	if ((config = zpool_get_config(zhp, NULL)) == NULL) {
	(void) fprintf(stderr, gettext("pool '%s' is unavailable\n"),
	poolname);
	zpool_close(zhp);
	return (1);
	}

	/* unless manually specified use "ashift" pool property (if set) */
	if (!nvlist_exists(props, ZPOOL_CONFIG_ASHIFT)) {
	int intval;
	zprop_source_t src;
	char strval[ZPOOL_MAXPROPLEN];

	intval = zpool_get_prop_int(zhp, ZPOOL_PROP_ASHIFT, &src);
	if (src != ZPROP_SRC_DEFAULT) {
	(void) sprintf(strval, "%" PRId32, intval);
	verify(add_prop_list(ZPOOL_CONFIG_ASHIFT, strval,
	&props, B_TRUE) == 0);
	}
	}

	/* pass off to make_root_vdev for processing */
	nvroot = make_root_vdev(zhp, props, force, !force, B_FALSE, dryrun,
	argc, argv);
	if (nvroot == NULL) {
	zpool_close(zhp);
	return (1);
	}

	if (dryrun) {
	nvlist_t *poolnvroot;
	nvlist_t **l2child;
	uint_t l2children, c;
	char *vname;
	boolean_t hadcache = B_FALSE;

	verify(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
	&poolnvroot) == 0);

	(void) printf(gettext("would update '%s' to the following "
	"configuration:\n"), zpool_get_name(zhp));

	/* print original main pool and new tree */
	print_vdev_tree(zhp, poolname, poolnvroot, 0, "",
	name_flags \| VDEV_NAME_TYPE_ID);
	print_vdev_tree(zhp, NULL, nvroot, 0, "", name_flags);

	/* print other classes: 'dedup', 'special', and 'log' */
	if (zfs_special_devs(poolnvroot, VDEV_ALLOC_BIAS_DEDUP)) {
	print_vdev_tree(zhp, "dedup", poolnvroot, 0,
	VDEV_ALLOC_BIAS_DEDUP, name_flags);
	print_vdev_tree(zhp, NULL, nvroot, 0,
	VDEV_ALLOC_BIAS_DEDUP, name_flags);
	} else if (zfs_special_devs(nvroot, VDEV_ALLOC_BIAS_DEDUP)) {
	print_vdev_tree(zhp, "dedup", nvroot, 0,
	VDEV_ALLOC_BIAS_DEDUP, name_flags);
	}

	if (zfs_special_devs(poolnvroot, VDEV_ALLOC_BIAS_SPECIAL)) {
	print_vdev_tree(zhp, "special", poolnvroot, 0,
	VDEV_ALLOC_BIAS_SPECIAL, name_flags);
	print_vdev_tree(zhp, NULL, nvroot, 0,
	VDEV_ALLOC_BIAS_SPECIAL, name_flags);
	} else if (zfs_special_devs(nvroot, VDEV_ALLOC_BIAS_SPECIAL)) {
	print_vdev_tree(zhp, "special", nvroot, 0,
	VDEV_ALLOC_BIAS_SPECIAL, name_flags);
	}

	if (num_logs(poolnvroot) > 0) {
	print_vdev_tree(zhp, "logs", poolnvroot, 0,
	VDEV_ALLOC_BIAS_LOG, name_flags);
	print_vdev_tree(zhp, NULL, nvroot, 0,
	VDEV_ALLOC_BIAS_LOG, name_flags);
	} else if (num_logs(nvroot) > 0) {
	print_vdev_tree(zhp, "logs", nvroot, 0,
	VDEV_ALLOC_BIAS_LOG, name_flags);
	}

	/* Do the same for the caches */
	if (nvlist_lookup_nvlist_array(poolnvroot, ZPOOL_CONFIG_L2CACHE,
	&l2child, &l2children) == 0 && l2children) {
	hadcache = B_TRUE;
	(void) printf(gettext("\tcache\n"));
	for (c = 0; c < l2children; c++) {
	vname = zpool_vdev_name(g_zfs, NULL,
	l2child[c], name_flags);
	(void) printf("\t %s\n", vname);
	free(vname);
	}
	}
	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_L2CACHE,
	&l2child, &l2children) == 0 && l2children) {
	if (!hadcache)
	(void) printf(gettext("\tcache\n"));
	for (c = 0; c < l2children; c++) {
	vname = zpool_vdev_name(g_zfs, NULL,
	l2child[c], name_flags);
	(void) printf("\t %s\n", vname);
	free(vname);
	}
	}

	ret = 0;
	} else {
	ret = (zpool_add(zhp, nvroot) != 0);
	}

	nvlist_free(props);
	nvlist_free(nvroot);
	zpool_close(zhp);

	return (ret);
	}

	/*
	* zpool remove [-npsw] <pool> <vdev> ...
	*
	* Removes the given vdev from the pool.
	*/
	int
	zpool_do_remove(int argc, char **argv)
	{
	char *poolname;
	int i, ret = 0;
	zpool_handle_t *zhp = NULL;
	boolean_t stop = B_FALSE;
	int c;
	boolean_t noop = B_FALSE;
	boolean_t parsable = B_FALSE;
	boolean_t wait = B_FALSE;

	/* check options */
	while ((c = getopt(argc, argv, "npsw")) != -1) {
	switch (c) {
	case 'n':
	noop = B_TRUE;
	break;
	case 'p':
	parsable = B_TRUE;
	break;
	case 's':
	stop = B_TRUE;
	break;
	case 'w':
	wait = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* get pool name and check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	usage(B_FALSE);
	}

	poolname = argv[0];

	if ((zhp = zpool_open(g_zfs, poolname)) == NULL)
	return (1);

	if (stop && noop) {
	(void) fprintf(stderr, gettext("stop request ignored\n"));
	return (0);
	}

	if (stop) {
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}
	if (zpool_vdev_remove_cancel(zhp) != 0)
	ret = 1;
	if (wait) {
	(void) fprintf(stderr, gettext("invalid option "
	"combination: -w cannot be used with -s\n"));
	usage(B_FALSE);
	}
	} else {
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing device\n"));
	usage(B_FALSE);
	}

	for (i = 1; i < argc; i++) {
	if (noop) {
	uint64_t size;

	if (zpool_vdev_indirect_size(zhp, argv[i],
	&size) != 0) {
	ret = 1;
	break;
	}
	if (parsable) {
	(void) printf("%s %llu\n",
	argv[i], (unsigned long long)size);
	} else {
	char valstr[32];
	zfs_nicenum(size, valstr,
	sizeof (valstr));
	(void) printf("Memory that will be "
	"used after removing %s: %s\n",
	argv[i], valstr);
	}
	} else {
	if (zpool_vdev_remove(zhp, argv[i]) != 0)
	ret = 1;
	}
	}

	if (ret == 0 && wait)
	ret = zpool_wait(zhp, ZPOOL_WAIT_REMOVE);
	}
	zpool_close(zhp);

	return (ret);
	}

	/*
	* zpool labelclear [-f] <vdev>
	*
	* -f Force clearing the label for the vdevs which are members of
	* the exported or foreign pools.
	*
	* Verifies that the vdev is not active and zeros out the label information
	* on the device.
	*/
	int
	zpool_do_labelclear(int argc, char **argv)
	{
	char vdev[MAXPATHLEN];
	char *name = NULL;
	struct stat st;
	int c, fd = -1, ret = 0;
	nvlist_t *config;
	pool_state_t state;
	boolean_t inuse = B_FALSE;
	boolean_t force = B_FALSE;

	/* check options */
	while ((c = getopt(argc, argv, "f")) != -1) {
	switch (c) {
	case 'f':
	force = B_TRUE;
	break;
	default:
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* get vdev name */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing vdev name\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	/*
	* Check if we were given absolute path and use it as is.
	* Otherwise if the provided vdev name doesn't point to a file,
	* try prepending expected disk paths and partition numbers.
	*/
	(void) strlcpy(vdev, argv[0], sizeof (vdev));
	if (vdev[0] != '/' && stat(vdev, &st) != 0) {
	int error;

	error = zfs_resolve_shortname(argv[0], vdev, MAXPATHLEN);
	if (error == 0 && zfs_dev_is_whole_disk(vdev)) {
	if (zfs_append_partition(vdev, MAXPATHLEN) == -1)
	error = ENOENT;
	}

	if (error \|\| (stat(vdev, &st) != 0)) {
	(void) fprintf(stderr, gettext(
	"failed to find device %s, try specifying absolute "
	"path instead\n"), argv[0]);
	return (1);
	}
	}

	if ((fd = open(vdev, O_RDWR)) < 0) {
	(void) fprintf(stderr, gettext("failed to open %s: %s\n"),
	vdev, strerror(errno));
	return (1);
	}

	/*
	* Flush all dirty pages for the block device. This should not be
	* fatal when the device does not support BLKFLSBUF as would be the
	* case for a file vdev.
	*/
	if ((zfs_dev_flush(fd) != 0) && (errno != ENOTTY))
	(void) fprintf(stderr, gettext("failed to invalidate "
	"cache for %s: %s\n"), vdev, strerror(errno));

	if (zpool_read_label(fd, &config, NULL) != 0) {
	(void) fprintf(stderr,
	gettext("failed to read label from %s\n"), vdev);
	ret = 1;
	goto errout;
	}
	nvlist_free(config);

	ret = zpool_in_use(g_zfs, fd, &state, &name, &inuse);
	if (ret != 0) {
	(void) fprintf(stderr,
	gettext("failed to check state for %s\n"), vdev);
	ret = 1;
	goto errout;
	}

	if (!inuse)
	goto wipe_label;

	switch (state) {
	default:
	case POOL_STATE_ACTIVE:
	case POOL_STATE_SPARE:
	case POOL_STATE_L2CACHE:
	(void) fprintf(stderr, gettext(
	"%s is a member (%s) of pool \"%s\"\n"),
	vdev, zpool_pool_state_to_name(state), name);
	ret = 1;
	goto errout;

	case POOL_STATE_EXPORTED:
	if (force)
	break;
	(void) fprintf(stderr, gettext(
	"use '-f' to override the following error:\n"
	"%s is a member of exported pool \"%s\"\n"),
	vdev, name);
	ret = 1;
	goto errout;

	case POOL_STATE_POTENTIALLY_ACTIVE:
	if (force)
	break;
	(void) fprintf(stderr, gettext(
	"use '-f' to override the following error:\n"
	"%s is a member of potentially active pool \"%s\"\n"),
	vdev, name);
	ret = 1;
	goto errout;

	case POOL_STATE_DESTROYED:
	/* inuse should never be set for a destroyed pool */
	assert(0);
	break;
	}

	wipe_label:
	ret = zpool_clear_label(fd);
	if (ret != 0) {
	(void) fprintf(stderr,
	gettext("failed to clear label for %s\n"), vdev);
	}

	errout:
	free(name);
	(void) close(fd);

	return (ret);
	}

	/*
	* zpool create [-fnd] [-o property=value] ...
	* [-O file-system-property=value] ...
	* [-R root] [-m mountpoint] <pool> <dev> ...
	*
	* -f Force creation, even if devices appear in use
	* -n Do not create the pool, but display the resulting layout if it
	* were to be created.
	* -R Create a pool under an alternate root
	* -m Set default mountpoint for the root dataset. By default it's
	* '/<pool>'
	* -o Set property=value.
	* -o Set feature@feature=enabled\|disabled.
	* -d Don't automatically enable all supported pool features
	* (individual features can be enabled with -o).
	* -O Set fsproperty=value in the pool's root file system
	*
	* Creates the named pool according to the given vdev specification. The
	* bulk of the vdev processing is done in make_root_vdev() in zpool_vdev.c.
	* Once we get the nvlist back from make_root_vdev(), we either print out the
	* contents (if '-n' was specified), or pass it to libzfs to do the creation.
	*/
	int
	zpool_do_create(int argc, char **argv)
	{
	boolean_t force = B_FALSE;
	boolean_t dryrun = B_FALSE;
	boolean_t enable_all_pool_feat = B_TRUE;
	int c;
	nvlist_t *nvroot = NULL;
	char *poolname;
	char *tname = NULL;
	int ret = 1;
	char *altroot = NULL;
	char *mountpoint = NULL;
	nvlist_t *fsprops = NULL;
	nvlist_t *props = NULL;
	char *propval;

	/* check options */
	while ((c = getopt(argc, argv, ":fndR:m:o:O:t:")) != -1) {
	switch (c) {
	case 'f':
	force = B_TRUE;
	break;
	case 'n':
	dryrun = B_TRUE;
	break;
	case 'd':
	enable_all_pool_feat = B_FALSE;
	break;
	case 'R':
	altroot = optarg;
	if (add_prop_list(zpool_prop_to_name(
	ZPOOL_PROP_ALTROOT), optarg, &props, B_TRUE))
	goto errout;
	if (add_prop_list_default(zpool_prop_to_name(
	ZPOOL_PROP_CACHEFILE), "none", &props, B_TRUE))
	goto errout;
	break;
	case 'm':
	/* Equivalent to -O mountpoint=optarg */
	mountpoint = optarg;
	break;
	case 'o':
	if ((propval = strchr(optarg, '=')) == NULL) {
	(void) fprintf(stderr, gettext("missing "
	"'=' for -o option\n"));
	goto errout;
	}
	*propval = '\0';
	propval++;

	if (add_prop_list(optarg, propval, &props, B_TRUE))
	goto errout;

	/*
	* If the user is creating a pool that doesn't support
	* feature flags, don't enable any features.
	*/
	if (zpool_name_to_prop(optarg) == ZPOOL_PROP_VERSION) {
	char *end;
	u_longlong_t ver;

	ver = strtoull(propval, &end, 10);
	if (*end == '\0' &&
	ver < SPA_VERSION_FEATURES) {
	enable_all_pool_feat = B_FALSE;
	}
	}
	if (zpool_name_to_prop(optarg) == ZPOOL_PROP_ALTROOT)
	altroot = propval;
	break;
	case 'O':
	if ((propval = strchr(optarg, '=')) == NULL) {
	(void) fprintf(stderr, gettext("missing "
	"'=' for -O option\n"));
	goto errout;
	}
	*propval = '\0';
	propval++;

	/*
	* Mountpoints are checked and then added later.
	* Uniquely among properties, they can be specified
	* more than once, to avoid conflict with -m.
	*/
	if (0 == strcmp(optarg,
	zfs_prop_to_name(ZFS_PROP_MOUNTPOINT))) {
	mountpoint = propval;
	} else if (add_prop_list(optarg, propval, &fsprops,
	B_FALSE)) {
	goto errout;
	}
	break;
	case 't':
	/*
	* Sanity check temporary pool name.
	*/
	if (strchr(optarg, '/') != NULL) {
	(void) fprintf(stderr, gettext("cannot create "
	"'%s': invalid character '/' in temporary "
	"name\n"), optarg);
	(void) fprintf(stderr, gettext("use 'zfs "
	"create' to create a dataset\n"));
	goto errout;
	}

	if (add_prop_list(zpool_prop_to_name(
	ZPOOL_PROP_TNAME), optarg, &props, B_TRUE))
	goto errout;
	if (add_prop_list_default(zpool_prop_to_name(
	ZPOOL_PROP_CACHEFILE), "none", &props, B_TRUE))
	goto errout;
	tname = optarg;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	goto badusage;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	goto badusage;
	}
	}

	argc -= optind;
	argv += optind;

	/* get pool name and check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	goto badusage;
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing vdev specification\n"));
	goto badusage;
	}

	poolname = argv[0];

	/*
	* As a special case, check for use of '/' in the name, and direct the
	* user to use 'zfs create' instead.
	*/
	if (strchr(poolname, '/') != NULL) {
	(void) fprintf(stderr, gettext("cannot create '%s': invalid "
	"character '/' in pool name\n"), poolname);
	(void) fprintf(stderr, gettext("use 'zfs create' to "
	"create a dataset\n"));
	goto errout;
	}

	/* pass off to make_root_vdev for bulk processing */
	nvroot = make_root_vdev(NULL, props, force, !force, B_FALSE, dryrun,
	argc - 1, argv + 1);
	if (nvroot == NULL)
	goto errout;

	/* make_root_vdev() allows 0 toplevel children if there are spares */
	if (!zfs_allocatable_devs(nvroot)) {
	(void) fprintf(stderr, gettext("invalid vdev "
	"specification: at least one toplevel vdev must be "
	"specified\n"));
	goto errout;
	}

	if (altroot != NULL && altroot[0] != '/') {
	(void) fprintf(stderr, gettext("invalid alternate root '%s': "
	"must be an absolute path\n"), altroot);
	goto errout;
	}

	/*
	* Check the validity of the mountpoint and direct the user to use the
	* '-m' mountpoint option if it looks like its in use.
	*/
	if (mountpoint == NULL \|\|
	(strcmp(mountpoint, ZFS_MOUNTPOINT_LEGACY) != 0 &&
	strcmp(mountpoint, ZFS_MOUNTPOINT_NONE) != 0)) {
	char buf[MAXPATHLEN];
	DIR *dirp;

	if (mountpoint && mountpoint[0] != '/') {
	(void) fprintf(stderr, gettext("invalid mountpoint "
	"'%s': must be an absolute path, 'legacy', or "
	"'none'\n"), mountpoint);
	goto errout;
	}

	if (mountpoint == NULL) {
	if (altroot != NULL)
	(void) snprintf(buf, sizeof (buf), "%s/%s",
	altroot, poolname);
	else
	(void) snprintf(buf, sizeof (buf), "/%s",
	poolname);
	} else {
	if (altroot != NULL)
	(void) snprintf(buf, sizeof (buf), "%s%s",
	altroot, mountpoint);
	else
	(void) snprintf(buf, sizeof (buf), "%s",
	mountpoint);
	}

	if ((dirp = opendir(buf)) == NULL && errno != ENOENT) {
	(void) fprintf(stderr, gettext("mountpoint '%s' : "
	"%s\n"), buf, strerror(errno));
	(void) fprintf(stderr, gettext("use '-m' "
	"option to provide a different default\n"));
	goto errout;
	} else if (dirp) {
	int count = 0;

	while (count < 3 && readdir(dirp) != NULL)
	count++;
	(void) closedir(dirp);

	if (count > 2) {
	(void) fprintf(stderr, gettext("mountpoint "
	"'%s' exists and is not empty\n"), buf);
	(void) fprintf(stderr, gettext("use '-m' "
	"option to provide a "
	"different default\n"));
	goto errout;
	}
	}
	}

	/*
	* Now that the mountpoint's validity has been checked, ensure that
	* the property is set appropriately prior to creating the pool.
	*/
	if (mountpoint != NULL) {
	ret = add_prop_list(zfs_prop_to_name(ZFS_PROP_MOUNTPOINT),
	mountpoint, &fsprops, B_FALSE);
	if (ret != 0)
	goto errout;
	}

	ret = 1;
	if (dryrun) {
	/*
	* For a dry run invocation, print out a basic message and run
	* through all the vdevs in the list and print out in an
	* appropriate hierarchy.
	*/
	(void) printf(gettext("would create '%s' with the "
	"following layout:\n\n"), poolname);

	print_vdev_tree(NULL, poolname, nvroot, 0, "", 0);
	print_vdev_tree(NULL, "dedup", nvroot, 0,
	VDEV_ALLOC_BIAS_DEDUP, 0);
	print_vdev_tree(NULL, "special", nvroot, 0,
	VDEV_ALLOC_BIAS_SPECIAL, 0);
	print_vdev_tree(NULL, "logs", nvroot, 0,
	VDEV_ALLOC_BIAS_LOG, 0);

	ret = 0;
	} else {
	/*
	* Hand off to libzfs.
	*/
	spa_feature_t i;
	for (i = 0; i < SPA_FEATURES; i++) {
	char propname[MAXPATHLEN];
	char *propval;
	zfeature_info_t *feat = &spa_feature_table[i];

	(void) snprintf(propname, sizeof (propname),
	"feature@%s", feat->fi_uname);

	/*
	* Only features contained in props will be enabled:
	* remove from the nvlist every ZFS_FEATURE_DISABLED
	* value and add every missing ZFS_FEATURE_ENABLED if
	* enable_all_pool_feat is set.
	*/
	if (!nvlist_lookup_string(props, propname, &propval)) {
	if (strcmp(propval, ZFS_FEATURE_DISABLED) == 0)
	(void) nvlist_remove_all(props,
	propname);
	} else if (enable_all_pool_feat) {
	ret = add_prop_list(propname,
	ZFS_FEATURE_ENABLED, &props, B_TRUE);
	if (ret != 0)
	goto errout;
	}
	}

	ret = 1;
	if (zpool_create(g_zfs, poolname,
	nvroot, props, fsprops) == 0) {
	zfs_handle_t *pool = zfs_open(g_zfs,
	tname ? tname : poolname, ZFS_TYPE_FILESYSTEM);
	if (pool != NULL) {
	if (zfs_mount(pool, NULL, 0) == 0) {
	ret = zfs_shareall(pool);
	zfs_commit_all_shares();
	}
	zfs_close(pool);
	}
	} else if (libzfs_errno(g_zfs) == EZFS_INVALIDNAME) {
	(void) fprintf(stderr, gettext("pool name may have "
	"been omitted\n"));
	}
	}

	errout:
	nvlist_free(nvroot);
	nvlist_free(fsprops);
	nvlist_free(props);
	return (ret);
	badusage:
	nvlist_free(fsprops);
	nvlist_free(props);
	usage(B_FALSE);
	return (2);
	}

	/*
	* zpool destroy <pool>
	*
	* -f Forcefully unmount any datasets
	*
	* Destroy the given pool. Automatically unmounts any datasets in the pool.
	*/
	int
	zpool_do_destroy(int argc, char **argv)
	{
	boolean_t force = B_FALSE;
	int c;
	char *pool;
	zpool_handle_t *zhp;
	int ret;

	/* check options */
	while ((c = getopt(argc, argv, "f")) != -1) {
	switch (c) {
	case 'f':
	force = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* check arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool argument\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	pool = argv[0];

	if ((zhp = zpool_open_canfail(g_zfs, pool)) == NULL) {
	/*
	* As a special case, check for use of '/' in the name, and
	* direct the user to use 'zfs destroy' instead.
	*/
	if (strchr(pool, '/') != NULL)
	(void) fprintf(stderr, gettext("use 'zfs destroy' to "
	"destroy a dataset\n"));
	return (1);
	}

	if (zpool_disable_datasets(zhp, force) != 0) {
	(void) fprintf(stderr, gettext("could not destroy '%s': "
	"could not unmount datasets\n"), zpool_get_name(zhp));
	zpool_close(zhp);
	return (1);
	}

	/* The history must be logged as part of the export */
	log_history = B_FALSE;

	ret = (zpool_destroy(zhp, history_str) != 0);

	zpool_close(zhp);

	return (ret);
	}

	typedef struct export_cbdata {
	boolean_t force;
	boolean_t hardforce;
	} export_cbdata_t;

	/*
	* Export one pool
	*/
	static int
	zpool_export_one(zpool_handle_t zhp, void data)
	{
	export_cbdata_t *cb = data;

	if (zpool_disable_datasets(zhp, cb->force) != 0)
	return (1);

	/* The history must be logged as part of the export */
	log_history = B_FALSE;

	if (cb->hardforce) {
	if (zpool_export_force(zhp, history_str) != 0)
	return (1);
	} else if (zpool_export(zhp, cb->force, history_str) != 0) {
	return (1);
	}

	return (0);
	}

	/*
	* zpool export [-f] <pool> ...
	*
	* -a Export all pools
	* -f Forcefully unmount datasets
	*
	* Export the given pools. By default, the command will attempt to cleanly
	* unmount any active datasets within the pool. If the '-f' flag is specified,
	* then the datasets will be forcefully unmounted.
	*/
	int
	zpool_do_export(int argc, char **argv)
	{
	export_cbdata_t cb;
	boolean_t do_all = B_FALSE;
	boolean_t force = B_FALSE;
	boolean_t hardforce = B_FALSE;
	int c, ret;

	/* check options */
	while ((c = getopt(argc, argv, "afF")) != -1) {
	switch (c) {
	case 'a':
	do_all = B_TRUE;
	break;
	case 'f':
	force = B_TRUE;
	break;
	case 'F':
	hardforce = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	cb.force = force;
	cb.hardforce = hardforce;
	argc -= optind;
	argv += optind;

	if (do_all) {
	if (argc != 0) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	return (for_each_pool(argc, argv, B_TRUE, NULL,
	zpool_export_one, &cb));
	}

	/* check arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool argument\n"));
	usage(B_FALSE);
	}

	ret = for_each_pool(argc, argv, B_TRUE, NULL, zpool_export_one, &cb);

	return (ret);
	}

	/*
	* Given a vdev configuration, determine the maximum width needed for the device
	* name column.
	*/
	static int
	max_width(zpool_handle_t zhp, nvlist_t nv, int depth, int max,
	int name_flags)
	{
	char *name;
	nvlist_t **child;
	uint_t c, children;
	int ret;

	name = zpool_vdev_name(g_zfs, zhp, nv, name_flags);
	if (strlen(name) + depth > max)
	max = strlen(name) + depth;

	free(name);

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_SPARES,
	&child, &children) == 0) {
	for (c = 0; c < children; c++)
	if ((ret = max_width(zhp, child[c], depth + 2,
	max, name_flags)) > max)
	max = ret;
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_L2CACHE,
	&child, &children) == 0) {
	for (c = 0; c < children; c++)
	if ((ret = max_width(zhp, child[c], depth + 2,
	max, name_flags)) > max)
	max = ret;
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) == 0) {
	for (c = 0; c < children; c++)
	if ((ret = max_width(zhp, child[c], depth + 2,
	max, name_flags)) > max)
	max = ret;
	}

	return (max);
	}

	typedef struct spare_cbdata {
	uint64_t cb_guid;
	zpool_handle_t *cb_zhp;
	} spare_cbdata_t;

	static boolean_t
	find_vdev(nvlist_t *nv, uint64_t search)
	{
	uint64_t guid;
	nvlist_t **child;
	uint_t c, children;

	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID, &guid) == 0 &&
	search == guid)
	return (B_TRUE);

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) == 0) {
	for (c = 0; c < children; c++)
	if (find_vdev(child[c], search))
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	static int
	find_spare(zpool_handle_t zhp, void data)
	{
	spare_cbdata_t *cbp = data;
	nvlist_t config, nvroot;

	config = zpool_get_config(zhp, NULL);
	verify(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
	&nvroot) == 0);

	if (find_vdev(nvroot, cbp->cb_guid)) {
	cbp->cb_zhp = zhp;
	return (1);
	}

	zpool_close(zhp);
	return (0);
	}

	typedef struct status_cbdata {
	int cb_count;
	int cb_name_flags;
	int cb_namewidth;
	boolean_t cb_allpools;
	boolean_t cb_verbose;
	boolean_t cb_literal;
	boolean_t cb_explain;
	boolean_t cb_first;
	boolean_t cb_dedup_stats;
	boolean_t cb_print_status;
	boolean_t cb_print_slow_ios;
	boolean_t cb_print_vdev_init;
	boolean_t cb_print_vdev_trim;
	vdev_cmd_data_list_t *vcdl;
	} status_cbdata_t;

	/* Return 1 if string is NULL, empty, or whitespace; return 0 otherwise. */
	static int
	is_blank_str(char *str)
	{
	while (str != NULL && *str != '\0') {
	if (!isblank(*str))
	return (0);
	str++;
	}
	return (1);
	}

	/* Print command output lines for specific vdev in a specific pool */
	static void
	zpool_print_cmd(vdev_cmd_data_list_t vcdl, const char pool, char *path)
	{
	vdev_cmd_data_t *data;
	int i, j;
	char *val;

	for (i = 0; i < vcdl->count; i++) {
	if ((strcmp(vcdl->data[i].path, path) != 0) \|\|
	(strcmp(vcdl->data[i].pool, pool) != 0)) {
	/* Not the vdev we're looking for */
	continue;
	}

	data = &vcdl->data[i];
	/* Print out all the output values for this vdev */
	for (j = 0; j < vcdl->uniq_cols_cnt; j++) {
	val = NULL;
	/* Does this vdev have values for this column? */
	for (int k = 0; k < data->cols_cnt; k++) {
	if (strcmp(data->cols[k],
	vcdl->uniq_cols[j]) == 0) {
	/* yes it does, record the value */
	val = data->lines[k];
	break;
	}
	}
	/*
	* Mark empty values with dashes to make output
	* awk-able.
	*/
	if (is_blank_str(val))
	val = "-";

	printf("%*s", vcdl->uniq_cols_width[j], val);
	if (j < vcdl->uniq_cols_cnt - 1)
	printf(" ");
	}

	/* Print out any values that aren't in a column at the end */
	for (j = data->cols_cnt; j < data->lines_cnt; j++) {
	/* Did we have any columns? If so print a spacer. */
	if (vcdl->uniq_cols_cnt > 0)
	printf(" ");

	val = data->lines[j];
	printf("%s", val ? val : "");
	}
	break;
	}
	}

	/*
	* Print vdev initialization status for leaves
	*/
	static void
	print_status_initialize(vdev_stat_t *vs, boolean_t verbose)
	{
	if (verbose) {
	if ((vs->vs_initialize_state == VDEV_INITIALIZE_ACTIVE \|\|
	vs->vs_initialize_state == VDEV_INITIALIZE_SUSPENDED \|\|
	vs->vs_initialize_state == VDEV_INITIALIZE_COMPLETE) &&
	!vs->vs_scan_removing) {
	char zbuf[1024];
	char tbuf[256];
	struct tm zaction_ts;

	time_t t = vs->vs_initialize_action_time;
	int initialize_pct = 100;
	if (vs->vs_initialize_state !=
	VDEV_INITIALIZE_COMPLETE) {
	initialize_pct = (vs->vs_initialize_bytes_done *
	100 / (vs->vs_initialize_bytes_est + 1));
	}

	(void) localtime_r(&t, &zaction_ts);
	(void) strftime(tbuf, sizeof (tbuf), "%c", &zaction_ts);

	switch (vs->vs_initialize_state) {
	case VDEV_INITIALIZE_SUSPENDED:
	(void) snprintf(zbuf, sizeof (zbuf), ", %s %s",
	gettext("suspended, started at"), tbuf);
	break;
	case VDEV_INITIALIZE_ACTIVE:
	(void) snprintf(zbuf, sizeof (zbuf), ", %s %s",
	gettext("started at"), tbuf);
	break;
	case VDEV_INITIALIZE_COMPLETE:
	(void) snprintf(zbuf, sizeof (zbuf), ", %s %s",
	gettext("completed at"), tbuf);
	break;
	}

	(void) printf(gettext(" (%d%% initialized%s)"),
	initialize_pct, zbuf);
	} else {
	(void) printf(gettext(" (uninitialized)"));
	}
	} else if (vs->vs_initialize_state == VDEV_INITIALIZE_ACTIVE) {
	(void) printf(gettext(" (initializing)"));
	}
	}

	/*
	* Print vdev TRIM status for leaves
	*/
	static void
	print_status_trim(vdev_stat_t *vs, boolean_t verbose)
	{
	if (verbose) {
	if ((vs->vs_trim_state == VDEV_TRIM_ACTIVE \|\|
	vs->vs_trim_state == VDEV_TRIM_SUSPENDED \|\|
	vs->vs_trim_state == VDEV_TRIM_COMPLETE) &&
	!vs->vs_scan_removing) {
	char zbuf[1024];
	char tbuf[256];
	struct tm zaction_ts;

	time_t t = vs->vs_trim_action_time;
	int trim_pct = 100;
	if (vs->vs_trim_state != VDEV_TRIM_COMPLETE) {
	trim_pct = (vs->vs_trim_bytes_done *
	100 / (vs->vs_trim_bytes_est + 1));
	}

	(void) localtime_r(&t, &zaction_ts);
	(void) strftime(tbuf, sizeof (tbuf), "%c", &zaction_ts);

	switch (vs->vs_trim_state) {
	case VDEV_TRIM_SUSPENDED:
	(void) snprintf(zbuf, sizeof (zbuf), ", %s %s",
	gettext("suspended, started at"), tbuf);
	break;
	case VDEV_TRIM_ACTIVE:
	(void) snprintf(zbuf, sizeof (zbuf), ", %s %s",
	gettext("started at"), tbuf);
	break;
	case VDEV_TRIM_COMPLETE:
	(void) snprintf(zbuf, sizeof (zbuf), ", %s %s",
	gettext("completed at"), tbuf);
	break;
	}

	(void) printf(gettext(" (%d%% trimmed%s)"),
	trim_pct, zbuf);
	} else if (vs->vs_trim_notsup) {
	(void) printf(gettext(" (trim unsupported)"));
	} else {
	(void) printf(gettext(" (untrimmed)"));
	}
	} else if (vs->vs_trim_state == VDEV_TRIM_ACTIVE) {
	(void) printf(gettext(" (trimming)"));
	}
	}

	/*
	* Return the color associated with a health string. This includes returning
	* NULL for no color change.
	*/
	static char *
	health_str_to_color(const char *health)
	{
	if (strcmp(health, gettext("FAULTED")) == 0 \|\|
	strcmp(health, gettext("SUSPENDED")) == 0 \|\|
	strcmp(health, gettext("UNAVAIL")) == 0) {
	return (ANSI_RED);
	}

	if (strcmp(health, gettext("OFFLINE")) == 0 \|\|
	strcmp(health, gettext("DEGRADED")) == 0 \|\|
	strcmp(health, gettext("REMOVED")) == 0) {
	return (ANSI_YELLOW);
	}

	return (NULL);
	}

	/*
	* Print out configuration state as requested by status_callback.
	*/
	static void
	print_status_config(zpool_handle_t zhp, status_cbdata_t cb, const char *name,
	nvlist_t nv, int depth, boolean_t isspare, vdev_rebuild_stat_t vrs)
	{
	nvlist_t *child, root;
	uint_t c, i, vsc, children;
	pool_scan_stat_t *ps = NULL;
	vdev_stat_t *vs;
	char rbuf[6], wbuf[6], cbuf[6];
	char *vname;
	uint64_t notpresent;
	spare_cbdata_t spare_cb;
	const char *state;
	char *type;
	char *path = NULL;
	char rcolor = NULL, wcolor = NULL, *ccolor = NULL;

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	children = 0;

	verify(nvlist_lookup_uint64_array(nv, ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t **)&vs, &vsc) == 0);

	verify(nvlist_lookup_string(nv, ZPOOL_CONFIG_TYPE, &type) == 0);

	if (strcmp(type, VDEV_TYPE_INDIRECT) == 0)
	return;

	state = zpool_state_to_name(vs->vs_state, vs->vs_aux);

	if (isspare) {
	/*
	* For hot spares, we use the terms 'INUSE' and 'AVAILABLE' for
	* online drives.
	*/
	if (vs->vs_aux == VDEV_AUX_SPARED)
	state = gettext("INUSE");
	else if (vs->vs_state == VDEV_STATE_HEALTHY)
	state = gettext("AVAIL");
	}

	printf_color(health_str_to_color(state),
	"\t%s%-s %-8s", depth, "", cb->cb_namewidth - depth,
	name, state);

	if (!isspare) {
	if (vs->vs_read_errors)
	rcolor = ANSI_RED;

	if (vs->vs_write_errors)
	wcolor = ANSI_RED;

	if (vs->vs_checksum_errors)
	ccolor = ANSI_RED;

	if (cb->cb_literal) {
	printf(" ");
	printf_color(rcolor, "%5llu",
	(u_longlong_t)vs->vs_read_errors);
	printf(" ");
	printf_color(wcolor, "%5llu",
	(u_longlong_t)vs->vs_write_errors);
	printf(" ");
	printf_color(ccolor, "%5llu",
	(u_longlong_t)vs->vs_checksum_errors);
	} else {
	zfs_nicenum(vs->vs_read_errors, rbuf, sizeof (rbuf));
	zfs_nicenum(vs->vs_write_errors, wbuf, sizeof (wbuf));
	zfs_nicenum(vs->vs_checksum_errors, cbuf,
	sizeof (cbuf));
	printf(" ");
	printf_color(rcolor, "%5s", rbuf);
	printf(" ");
	printf_color(wcolor, "%5s", wbuf);
	printf(" ");
	printf_color(ccolor, "%5s", cbuf);
	}
	if (cb->cb_print_slow_ios) {
	if (children == 0) {
	/* Only leafs vdevs have slow IOs */
	zfs_nicenum(vs->vs_slow_ios, rbuf,
	sizeof (rbuf));
	} else {
	snprintf(rbuf, sizeof (rbuf), "-");
	}

	if (cb->cb_literal)
	printf(" %5llu", (u_longlong_t)vs->vs_slow_ios);
	else
	printf(" %5s", rbuf);
	}
	}

	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_NOT_PRESENT,
	&notpresent) == 0) {
	verify(nvlist_lookup_string(nv, ZPOOL_CONFIG_PATH, &path) == 0);
	(void) printf(" %s %s", gettext("was"), path);
	} else if (vs->vs_aux != 0) {
	(void) printf(" ");
	color_start(ANSI_RED);
	switch (vs->vs_aux) {
	case VDEV_AUX_OPEN_FAILED:
	(void) printf(gettext("cannot open"));
	break;

	case VDEV_AUX_BAD_GUID_SUM:
	(void) printf(gettext("missing device"));
	break;

	case VDEV_AUX_NO_REPLICAS:
	(void) printf(gettext("insufficient replicas"));
	break;

	case VDEV_AUX_VERSION_NEWER:
	(void) printf(gettext("newer version"));
	break;

	case VDEV_AUX_UNSUP_FEAT:
	(void) printf(gettext("unsupported feature(s)"));
	break;

	case VDEV_AUX_ASHIFT_TOO_BIG:
	(void) printf(gettext("unsupported minimum blocksize"));
	break;

	case VDEV_AUX_SPARED:
	verify(nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID,
	&spare_cb.cb_guid) == 0);
	if (zpool_iter(g_zfs, find_spare, &spare_cb) == 1) {
	if (strcmp(zpool_get_name(spare_cb.cb_zhp),
	zpool_get_name(zhp)) == 0)
	(void) printf(gettext("currently in "
	"use"));
	else
	(void) printf(gettext("in use by "
	"pool '%s'"),
	zpool_get_name(spare_cb.cb_zhp));
	zpool_close(spare_cb.cb_zhp);
	} else {
	(void) printf(gettext("currently in use"));
	}
	break;

	case VDEV_AUX_ERR_EXCEEDED:
	(void) printf(gettext("too many errors"));
	break;

	case VDEV_AUX_IO_FAILURE:
	(void) printf(gettext("experienced I/O failures"));
	break;

	case VDEV_AUX_BAD_LOG:
	(void) printf(gettext("bad intent log"));
	break;

	case VDEV_AUX_EXTERNAL:
	(void) printf(gettext("external device fault"));
	break;

	case VDEV_AUX_SPLIT_POOL:
	(void) printf(gettext("split into new pool"));
	break;

	case VDEV_AUX_ACTIVE:
	(void) printf(gettext("currently in use"));
	break;

	case VDEV_AUX_CHILDREN_OFFLINE:
	(void) printf(gettext("all children offline"));
	break;

	default:
	(void) printf(gettext("corrupted data"));
	break;
	}
	color_end();
	}

	/* The root vdev has the scrub/resilver stats */
	root = fnvlist_lookup_nvlist(zpool_get_config(zhp, NULL),
	ZPOOL_CONFIG_VDEV_TREE);
	(void) nvlist_lookup_uint64_array(root, ZPOOL_CONFIG_SCAN_STATS,
	(uint64_t **)&ps, &c);

	if (ps != NULL && ps->pss_state == DSS_SCANNING && children == 0) {
	if (vs->vs_scan_processed != 0) {
	(void) printf(gettext(" (%s)"),
	(ps->pss_func == POOL_SCAN_RESILVER) ?
	"resilvering" : "repairing");
	} else if (vs->vs_resilver_deferred) {
	(void) printf(gettext(" (awaiting resilver)"));
	}
	}

	/* The top-level vdevs have the rebuild stats */
	if (vrs != NULL && vrs->vrs_state == VDEV_REBUILD_ACTIVE &&
	children == 0) {
	if (vs->vs_rebuild_processed != 0) {
	(void) printf(gettext(" (resilvering)"));
	}
	}

	if (cb->vcdl != NULL) {
	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_PATH, &path) == 0) {
	printf(" ");
	zpool_print_cmd(cb->vcdl, zpool_get_name(zhp), path);
	}
	}

	/* Display vdev initialization and trim status for leaves */
	if (children == 0) {
	print_status_initialize(vs, cb->cb_print_vdev_init);
	print_status_trim(vs, cb->cb_print_vdev_trim);
	}

	(void) printf("\n");

	for (c = 0; c < children; c++) {
	uint64_t islog = B_FALSE, ishole = B_FALSE;

	/* Don't print logs or holes here */
	(void) nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_LOG,
	&islog);
	(void) nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_HOLE,
	&ishole);
	if (islog \|\| ishole)
	continue;
	/* Only print normal classes here */
	if (nvlist_exists(child[c], ZPOOL_CONFIG_ALLOCATION_BIAS))
	continue;

	/* Provide vdev_rebuild_stats to children if available */
	if (vrs == NULL) {
	(void) nvlist_lookup_uint64_array(nv,
	ZPOOL_CONFIG_REBUILD_STATS,
	(uint64_t **)&vrs, &i);
	}

	vname = zpool_vdev_name(g_zfs, zhp, child[c],
	cb->cb_name_flags \| VDEV_NAME_TYPE_ID);
	print_status_config(zhp, cb, vname, child[c], depth + 2,
	isspare, vrs);
	free(vname);
	}
	}

	/*
	* Print the configuration of an exported pool. Iterate over all vdevs in the
	* pool, printing out the name and status for each one.
	*/
	static void
	print_import_config(status_cbdata_t cb, const char name, nvlist_t *nv,
	int depth)
	{
	nvlist_t **child;
	uint_t c, children;
	vdev_stat_t *vs;
	char type, vname;

	verify(nvlist_lookup_string(nv, ZPOOL_CONFIG_TYPE, &type) == 0);
	if (strcmp(type, VDEV_TYPE_MISSING) == 0 \|\|
	strcmp(type, VDEV_TYPE_HOLE) == 0)
	return;

	verify(nvlist_lookup_uint64_array(nv, ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t **)&vs, &c) == 0);

	(void) printf("\t%s%-s", depth, "", cb->cb_namewidth - depth, name);
	(void) printf(" %s", zpool_state_to_name(vs->vs_state, vs->vs_aux));

	if (vs->vs_aux != 0) {
	(void) printf(" ");

	switch (vs->vs_aux) {
	case VDEV_AUX_OPEN_FAILED:
	(void) printf(gettext("cannot open"));
	break;

	case VDEV_AUX_BAD_GUID_SUM:
	(void) printf(gettext("missing device"));
	break;

	case VDEV_AUX_NO_REPLICAS:
	(void) printf(gettext("insufficient replicas"));
	break;

	case VDEV_AUX_VERSION_NEWER:
	(void) printf(gettext("newer version"));
	break;

	case VDEV_AUX_UNSUP_FEAT:
	(void) printf(gettext("unsupported feature(s)"));
	break;

	case VDEV_AUX_ERR_EXCEEDED:
	(void) printf(gettext("too many errors"));
	break;

	case VDEV_AUX_ACTIVE:
	(void) printf(gettext("currently in use"));
	break;

	case VDEV_AUX_CHILDREN_OFFLINE:
	(void) printf(gettext("all children offline"));
	break;

	default:
	(void) printf(gettext("corrupted data"));
	break;
	}
	}
	(void) printf("\n");

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	return;

	for (c = 0; c < children; c++) {
	uint64_t is_log = B_FALSE;

	(void) nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_LOG,
	&is_log);
	if (is_log)
	continue;
	if (nvlist_exists(child[c], ZPOOL_CONFIG_ALLOCATION_BIAS))
	continue;

	vname = zpool_vdev_name(g_zfs, NULL, child[c],
	cb->cb_name_flags \| VDEV_NAME_TYPE_ID);
	print_import_config(cb, vname, child[c], depth + 2);
	free(vname);
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_L2CACHE,
	&child, &children) == 0) {
	(void) printf(gettext("\tcache\n"));
	for (c = 0; c < children; c++) {
	vname = zpool_vdev_name(g_zfs, NULL, child[c],
	cb->cb_name_flags);
	(void) printf("\t %s\n", vname);
	free(vname);
	}
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_SPARES,
	&child, &children) == 0) {
	(void) printf(gettext("\tspares\n"));
	for (c = 0; c < children; c++) {
	vname = zpool_vdev_name(g_zfs, NULL, child[c],
	cb->cb_name_flags);
	(void) printf("\t %s\n", vname);
	free(vname);
	}
	}
	}

	/*
	* Print specialized class vdevs.
	*
	* These are recorded as top level vdevs in the main pool child array
	* but with "is_log" set to 1 or an "alloc_bias" string. We use either
	* print_status_config() or print_import_config() to print the top level
	* class vdevs then any of their children (eg mirrored slogs) are printed
	* recursively - which works because only the top level vdev is marked.
	*/
	static void
	print_class_vdevs(zpool_handle_t zhp, status_cbdata_t cb, nvlist_t *nv,
	const char *class)
	{
	uint_t c, children;
	nvlist_t **child;
	boolean_t printed = B_FALSE;

	assert(zhp != NULL \|\| !cb->cb_verbose);

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN, &child,
	&children) != 0)
	return;

	for (c = 0; c < children; c++) {
	uint64_t is_log = B_FALSE;
	char *bias = NULL;
	char *type = NULL;

	(void) nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_LOG,
	&is_log);

	if (is_log) {
	bias = VDEV_ALLOC_CLASS_LOGS;
	} else {
	(void) nvlist_lookup_string(child[c],
	ZPOOL_CONFIG_ALLOCATION_BIAS, &bias);
	(void) nvlist_lookup_string(child[c],
	ZPOOL_CONFIG_TYPE, &type);
	}

	if (bias == NULL \|\| strcmp(bias, class) != 0)
	continue;
	if (!is_log && strcmp(type, VDEV_TYPE_INDIRECT) == 0)
	continue;

	if (!printed) {
	(void) printf("\t%s\t\n", gettext(class));
	printed = B_TRUE;
	}

	char *name = zpool_vdev_name(g_zfs, zhp, child[c],
	cb->cb_name_flags \| VDEV_NAME_TYPE_ID);
	if (cb->cb_print_status)
	print_status_config(zhp, cb, name, child[c], 2,
	B_FALSE, NULL);
	else
	print_import_config(cb, name, child[c], 2);
	free(name);
	}
	}

	/*
	* Display the status for the given pool.
	*/
	static void
	show_import(nvlist_t *config)
	{
	uint64_t pool_state;
	vdev_stat_t *vs;
	char *name;
	uint64_t guid;
	uint64_t hostid = 0;
	char *msgid;
	char *hostname = "unknown";
	nvlist_t nvroot, nvinfo;
	zpool_status_t reason;
	zpool_errata_t errata;
	const char *health;
	uint_t vsc;
	char *comment;
	status_cbdata_t cb = { 0 };

	verify(nvlist_lookup_string(config, ZPOOL_CONFIG_POOL_NAME,
	&name) == 0);
	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID,
	&guid) == 0);
	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_STATE,
	&pool_state) == 0);
	verify(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
	&nvroot) == 0);

	verify(nvlist_lookup_uint64_array(nvroot, ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t **)&vs, &vsc) == 0);
	health = zpool_state_to_name(vs->vs_state, vs->vs_aux);

	reason = zpool_import_status(config, &msgid, &errata);

	(void) printf(gettext(" pool: %s\n"), name);
	(void) printf(gettext(" id: %llu\n"), (u_longlong_t)guid);
	(void) printf(gettext(" state: %s"), health);
	if (pool_state == POOL_STATE_DESTROYED)
	(void) printf(gettext(" (DESTROYED)"));
	(void) printf("\n");

	switch (reason) {
	case ZPOOL_STATUS_MISSING_DEV_R:
	case ZPOOL_STATUS_MISSING_DEV_NR:
	case ZPOOL_STATUS_BAD_GUID_SUM:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices are "
	"missing from the system.\n"));
	break;

	case ZPOOL_STATUS_CORRUPT_LABEL_R:
	case ZPOOL_STATUS_CORRUPT_LABEL_NR:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices contains"
	" corrupted data.\n"));
	break;

	case ZPOOL_STATUS_CORRUPT_DATA:
	(void) printf(
	gettext(" status: The pool data is corrupted.\n"));
	break;

	case ZPOOL_STATUS_OFFLINE_DEV:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices "
	"are offlined.\n"));
	break;

	case ZPOOL_STATUS_CORRUPT_POOL:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool metadata is "
	"corrupted.\n"));
	break;

	case ZPOOL_STATUS_VERSION_OLDER:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool is formatted using "
	"a legacy on-disk version.\n"));
	break;

	case ZPOOL_STATUS_VERSION_NEWER:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool is formatted using "
	"an incompatible version.\n"));
	break;

	case ZPOOL_STATUS_FEAT_DISABLED:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("Some supported features are "
	"not enabled on the pool.\n"));
	break;

	case ZPOOL_STATUS_UNSUP_FEAT_READ:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool uses the following "
	"feature(s) not supported on this system:\n"));
	color_start(ANSI_YELLOW);
	zpool_print_unsup_feat(config);
	color_end();
	break;

	case ZPOOL_STATUS_UNSUP_FEAT_WRITE:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool can only be "
	"accessed in read-only mode on this system. It\n\tcannot be"
	" accessed in read-write mode because it uses the "
	"following\n\tfeature(s) not supported on this system:\n"));
	color_start(ANSI_YELLOW);
	zpool_print_unsup_feat(config);
	color_end();
	break;

	case ZPOOL_STATUS_HOSTID_ACTIVE:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool is currently "
	"imported by another system.\n"));
	break;

	case ZPOOL_STATUS_HOSTID_REQUIRED:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool has the "
	"multihost property on. It cannot\n\tbe safely imported "
	"when the system hostid is not set.\n"));
	break;

	case ZPOOL_STATUS_HOSTID_MISMATCH:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool was last accessed "
	"by another system.\n"));
	break;

	case ZPOOL_STATUS_FAULTED_DEV_R:
	case ZPOOL_STATUS_FAULTED_DEV_NR:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices are "
	"faulted.\n"));
	break;

	case ZPOOL_STATUS_BAD_LOG:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("An intent log record cannot "
	"be read.\n"));
	break;

	case ZPOOL_STATUS_RESILVERING:
	case ZPOOL_STATUS_REBUILDING:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices were "
	"being resilvered.\n"));
	break;

	case ZPOOL_STATUS_ERRATA:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("Errata #%d detected.\n"),
	errata);
	break;

	+ case ZPOOL_STATUS_NON_NATIVE_ASHIFT:
	+ printf_color(ANSI_BOLD, gettext("status: "));
	+ printf_color(ANSI_YELLOW, gettext("One or more devices are "
	+ "configured to use a non-native block size.\n"
	+ "\tExpect reduced performance.\n"));
	+ break;
	+
	default:
	/*
	* No other status can be seen when importing pools.
	*/
	assert(reason == ZPOOL_STATUS_OK);
	}

	/*
	* Print out an action according to the overall state of the pool.
	*/
	if (vs->vs_state == VDEV_STATE_HEALTHY) {
	if (reason == ZPOOL_STATUS_VERSION_OLDER \|\|
	reason == ZPOOL_STATUS_FEAT_DISABLED) {
	(void) printf(gettext(" action: The pool can be "
	"imported using its name or numeric identifier, "
	"though\n\tsome features will not be available "
	"without an explicit 'zpool upgrade'.\n"));
	} else if (reason == ZPOOL_STATUS_HOSTID_MISMATCH) {
	(void) printf(gettext(" action: The pool can be "
	"imported using its name or numeric "
	"identifier and\n\tthe '-f' flag.\n"));
	} else if (reason == ZPOOL_STATUS_ERRATA) {
	switch (errata) {
	case ZPOOL_ERRATA_NONE:
	break;

	case ZPOOL_ERRATA_ZOL_2094_SCRUB:
	(void) printf(gettext(" action: The pool can "
	"be imported using its name or numeric "
	"identifier,\n\thowever there is a compat"
	"ibility issue which should be corrected"
	"\n\tby running 'zpool scrub'\n"));
	break;

	case ZPOOL_ERRATA_ZOL_2094_ASYNC_DESTROY:
	(void) printf(gettext(" action: The pool can"
	"not be imported with this version of ZFS "
	"due to\n\tan active asynchronous destroy. "
	"Revert to an earlier version\n\tand "
	"allow the destroy to complete before "
	"updating.\n"));
	break;

	case ZPOOL_ERRATA_ZOL_6845_ENCRYPTION:
	(void) printf(gettext(" action: Existing "
	"encrypted datasets contain an on-disk "
	"incompatibility, which\n\tneeds to be "
	"corrected. Backup these datasets to new "
	"encrypted datasets\n\tand destroy the "
	"old ones.\n"));
	break;

	case ZPOOL_ERRATA_ZOL_8308_ENCRYPTION:
	(void) printf(gettext(" action: Existing "
	"encrypted snapshots and bookmarks contain "
	"an on-disk\n\tincompatibility. This may "
	"cause on-disk corruption if they are used"
	"\n\twith 'zfs recv'. To correct the "
	"issue, enable the bookmark_v2 feature.\n\t"
	"No additional action is needed if there "
	"are no encrypted snapshots or\n\t"
	"bookmarks. If preserving the encrypted "
	"snapshots and bookmarks is\n\trequired, "
	"use a non-raw send to backup and restore "
	"them. Alternately,\n\tthey may be removed"
	" to resolve the incompatibility.\n"));
	break;
	default:
	/*
	* All errata must contain an action message.
	*/
	assert(0);
	}
	} else {
	(void) printf(gettext(" action: The pool can be "
	"imported using its name or numeric "
	"identifier.\n"));
	}
	} else if (vs->vs_state == VDEV_STATE_DEGRADED) {
	(void) printf(gettext(" action: The pool can be imported "
	"despite missing or damaged devices. The\n\tfault "
	"tolerance of the pool may be compromised if imported.\n"));
	} else {
	switch (reason) {
	case ZPOOL_STATUS_VERSION_NEWER:
	(void) printf(gettext(" action: The pool cannot be "
	"imported. Access the pool on a system running "
	"newer\n\tsoftware, or recreate the pool from "
	"backup.\n"));
	break;
	case ZPOOL_STATUS_UNSUP_FEAT_READ:
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("The pool cannot be "
	"imported. Access the pool on a system that "
	"supports\n\tthe required feature(s), or recreate "
	"the pool from backup.\n"));
	break;
	case ZPOOL_STATUS_UNSUP_FEAT_WRITE:
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("The pool cannot be "
	"imported in read-write mode. Import the pool "
	"with\n"
	"\t\"-o readonly=on\", access the pool on a system "
	"that supports the\n\trequired feature(s), or "
	"recreate the pool from backup.\n"));
	break;
	case ZPOOL_STATUS_MISSING_DEV_R:
	case ZPOOL_STATUS_MISSING_DEV_NR:
	case ZPOOL_STATUS_BAD_GUID_SUM:
	(void) printf(gettext(" action: The pool cannot be "
	"imported. Attach the missing\n\tdevices and try "
	"again.\n"));
	break;
	case ZPOOL_STATUS_HOSTID_ACTIVE:
	VERIFY0(nvlist_lookup_nvlist(config,
	ZPOOL_CONFIG_LOAD_INFO, &nvinfo));

	if (nvlist_exists(nvinfo, ZPOOL_CONFIG_MMP_HOSTNAME))
	hostname = fnvlist_lookup_string(nvinfo,
	ZPOOL_CONFIG_MMP_HOSTNAME);

	if (nvlist_exists(nvinfo, ZPOOL_CONFIG_MMP_HOSTID))
	hostid = fnvlist_lookup_uint64(nvinfo,
	ZPOOL_CONFIG_MMP_HOSTID);

	(void) printf(gettext(" action: The pool must be "
	"exported from %s (hostid=%lx)\n\tbefore it "
	"can be safely imported.\n"), hostname,
	(unsigned long) hostid);
	break;
	case ZPOOL_STATUS_HOSTID_REQUIRED:
	(void) printf(gettext(" action: Set a unique system "
	"hostid with the zgenhostid(8) command.\n"));
	break;
	default:
	(void) printf(gettext(" action: The pool cannot be "
	"imported due to damaged devices or data.\n"));
	}
	}

	/* Print the comment attached to the pool. */
	if (nvlist_lookup_string(config, ZPOOL_CONFIG_COMMENT, &comment) == 0)
	(void) printf(gettext("comment: %s\n"), comment);

	/*
	* If the state is "closed" or "can't open", and the aux state
	* is "corrupt data":
	*/
	if (((vs->vs_state == VDEV_STATE_CLOSED) \|\|
	(vs->vs_state == VDEV_STATE_CANT_OPEN)) &&
	(vs->vs_aux == VDEV_AUX_CORRUPT_DATA)) {
	if (pool_state == POOL_STATE_DESTROYED)
	(void) printf(gettext("\tThe pool was destroyed, "
	"but can be imported using the '-Df' flags.\n"));
	else if (pool_state != POOL_STATE_EXPORTED)
	(void) printf(gettext("\tThe pool may be active on "
	"another system, but can be imported using\n\t"
	"the '-f' flag.\n"));
	}

	if (msgid != NULL) {
	(void) printf(gettext(
	" see: https://openzfs.github.io/openzfs-docs/msg/%s\n"),
	msgid);
	}

	(void) printf(gettext(" config:\n\n"));

	cb.cb_namewidth = max_width(NULL, nvroot, 0, strlen(name),
	VDEV_NAME_TYPE_ID);
	if (cb.cb_namewidth < 10)
	cb.cb_namewidth = 10;

	print_import_config(&cb, name, nvroot, 0);

	print_class_vdevs(NULL, &cb, nvroot, VDEV_ALLOC_BIAS_DEDUP);
	print_class_vdevs(NULL, &cb, nvroot, VDEV_ALLOC_BIAS_SPECIAL);
	print_class_vdevs(NULL, &cb, nvroot, VDEV_ALLOC_CLASS_LOGS);

	if (reason == ZPOOL_STATUS_BAD_GUID_SUM) {
	(void) printf(gettext("\n\tAdditional devices are known to "
	"be part of this pool, though their\n\texact "
	"configuration cannot be determined.\n"));
	}
	}

	static boolean_t
	zfs_force_import_required(nvlist_t *config)
	{
	uint64_t state;
	uint64_t hostid = 0;
	nvlist_t *nvinfo;

	state = fnvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_STATE);
	(void) nvlist_lookup_uint64(config, ZPOOL_CONFIG_HOSTID, &hostid);

	if (state != POOL_STATE_EXPORTED && hostid != get_system_hostid())
	return (B_TRUE);

	nvinfo = fnvlist_lookup_nvlist(config, ZPOOL_CONFIG_LOAD_INFO);
	if (nvlist_exists(nvinfo, ZPOOL_CONFIG_MMP_STATE)) {
	mmp_state_t mmp_state = fnvlist_lookup_uint64(nvinfo,
	ZPOOL_CONFIG_MMP_STATE);

	if (mmp_state != MMP_STATE_INACTIVE)
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	/*
	* Perform the import for the given configuration. This passes the heavy
	* lifting off to zpool_import_props(), and then mounts the datasets contained
	* within the pool.
	*/
	static int
	do_import(nvlist_t config, const char newname, const char *mntopts,
	nvlist_t *props, int flags)
	{
	int ret = 0;
	zpool_handle_t *zhp;
	char *name;
	uint64_t version;

	name = fnvlist_lookup_string(config, ZPOOL_CONFIG_POOL_NAME);
	version = fnvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION);

	if (!SPA_VERSION_IS_SUPPORTED(version)) {
	(void) fprintf(stderr, gettext("cannot import '%s': pool "
	"is formatted using an unsupported ZFS version\n"), name);
	return (1);
	} else if (zfs_force_import_required(config) &&
	!(flags & ZFS_IMPORT_ANY_HOST)) {
	mmp_state_t mmp_state = MMP_STATE_INACTIVE;
	nvlist_t *nvinfo;

	nvinfo = fnvlist_lookup_nvlist(config, ZPOOL_CONFIG_LOAD_INFO);
	if (nvlist_exists(nvinfo, ZPOOL_CONFIG_MMP_STATE))
	mmp_state = fnvlist_lookup_uint64(nvinfo,
	ZPOOL_CONFIG_MMP_STATE);

	if (mmp_state == MMP_STATE_ACTIVE) {
	char *hostname = "<unknown>";
	uint64_t hostid = 0;

	if (nvlist_exists(nvinfo, ZPOOL_CONFIG_MMP_HOSTNAME))
	hostname = fnvlist_lookup_string(nvinfo,
	ZPOOL_CONFIG_MMP_HOSTNAME);

	if (nvlist_exists(nvinfo, ZPOOL_CONFIG_MMP_HOSTID))
	hostid = fnvlist_lookup_uint64(nvinfo,
	ZPOOL_CONFIG_MMP_HOSTID);

	(void) fprintf(stderr, gettext("cannot import '%s': "
	"pool is imported on %s (hostid: "
	"0x%lx)\nExport the pool on the other system, "
	"then run 'zpool import'.\n"),
	name, hostname, (unsigned long) hostid);
	} else if (mmp_state == MMP_STATE_NO_HOSTID) {
	(void) fprintf(stderr, gettext("Cannot import '%s': "
	"pool has the multihost property on and the\n"
	"system's hostid is not set. Set a unique hostid "
	"with the zgenhostid(8) command.\n"), name);
	} else {
	char *hostname = "<unknown>";
	uint64_t timestamp = 0;
	uint64_t hostid = 0;

	if (nvlist_exists(config, ZPOOL_CONFIG_HOSTNAME))
	hostname = fnvlist_lookup_string(config,
	ZPOOL_CONFIG_HOSTNAME);

	if (nvlist_exists(config, ZPOOL_CONFIG_TIMESTAMP))
	timestamp = fnvlist_lookup_uint64(config,
	ZPOOL_CONFIG_TIMESTAMP);

	if (nvlist_exists(config, ZPOOL_CONFIG_HOSTID))
	hostid = fnvlist_lookup_uint64(config,
	ZPOOL_CONFIG_HOSTID);

	(void) fprintf(stderr, gettext("cannot import '%s': "
	"pool was previously in use from another system.\n"
	"Last accessed by %s (hostid=%lx) at %s"
	"The pool can be imported, use 'zpool import -f' "
	"to import the pool.\n"), name, hostname,
	(unsigned long)hostid, ctime((time_t *)&timestamp));
	}

	return (1);
	}

	if (zpool_import_props(g_zfs, config, newname, props, flags) != 0)
	return (1);

	if (newname != NULL)
	name = (char *)newname;

	if ((zhp = zpool_open_canfail(g_zfs, name)) == NULL)
	return (1);

	/*
	* Loading keys is best effort. We don't want to return immediately
	* if it fails but we do want to give the error to the caller.
	*/
	if (flags & ZFS_IMPORT_LOAD_KEYS) {
	ret = zfs_crypto_attempt_load_keys(g_zfs, name);
	if (ret != 0)
	ret = 1;
	}

	if (zpool_get_state(zhp) != POOL_STATE_UNAVAIL &&
	!(flags & ZFS_IMPORT_ONLY) &&
	zpool_enable_datasets(zhp, mntopts, 0) != 0) {
	zpool_close(zhp);
	return (1);
	}

	zpool_close(zhp);
	return (ret);
	}

	typedef struct target_exists_args {
	const char *poolname;
	uint64_t poolguid;
	} target_exists_args_t;

	static int
	name_or_guid_exists(zpool_handle_t zhp, void data)
	{
	target_exists_args_t *args = data;
	nvlist_t *config = zpool_get_config(zhp, NULL);
	int found = 0;

	if (config == NULL)
	return (0);

	if (args->poolname != NULL) {
	char *pool_name;

	verify(nvlist_lookup_string(config, ZPOOL_CONFIG_POOL_NAME,
	&pool_name) == 0);
	if (strcmp(pool_name, args->poolname) == 0)
	found = 1;
	} else {
	uint64_t pool_guid;

	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID,
	&pool_guid) == 0);
	if (pool_guid == args->poolguid)
	found = 1;
	}
	zpool_close(zhp);

	return (found);
	}
	/*
	* zpool checkpoint <pool>
	* checkpoint --discard <pool>
	*
	* -d Discard the checkpoint from a checkpointed
	* --discard pool.
	*
	* -w Wait for discarding a checkpoint to complete.
	* --wait
	*
	* Checkpoints the specified pool, by taking a "snapshot" of its
	* current state. A pool can only have one checkpoint at a time.
	*/
	int
	zpool_do_checkpoint(int argc, char **argv)
	{
	boolean_t discard, wait;
	char *pool;
	zpool_handle_t *zhp;
	int c, err;

	struct option long_options[] = {
	{"discard", no_argument, NULL, 'd'},
	{"wait", no_argument, NULL, 'w'},
	{0, 0, 0, 0}
	};

	discard = B_FALSE;
	wait = B_FALSE;
	while ((c = getopt_long(argc, argv, ":dw", long_options, NULL)) != -1) {
	switch (c) {
	case 'd':
	discard = B_TRUE;
	break;
	case 'w':
	wait = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	if (wait && !discard) {
	(void) fprintf(stderr, gettext("--wait only valid when "
	"--discard also specified\n"));
	usage(B_FALSE);
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool argument\n"));
	usage(B_FALSE);
	}

	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	pool = argv[0];

	if ((zhp = zpool_open(g_zfs, pool)) == NULL) {
	/* As a special case, check for use of '/' in the name */
	if (strchr(pool, '/') != NULL)
	(void) fprintf(stderr, gettext("'zpool checkpoint' "
	"doesn't work on datasets. To save the state "
	"of a dataset from a specific point in time "
	"please use 'zfs snapshot'\n"));
	return (1);
	}

	if (discard) {
	err = (zpool_discard_checkpoint(zhp) != 0);
	if (err == 0 && wait)
	err = zpool_wait(zhp, ZPOOL_WAIT_CKPT_DISCARD);
	} else {
	err = (zpool_checkpoint(zhp) != 0);
	}

	zpool_close(zhp);

	return (err);
	}

	#define CHECKPOINT_OPT 1024

	/*
	* zpool import [-d dir] [-D]
	* import [-o mntopts] [-o prop=value] ... [-R root] [-D] [-l]
	* [-d dir \| -c cachefile] [-f] -a
	* import [-o mntopts] [-o prop=value] ... [-R root] [-D] [-l]
	* [-d dir \| -c cachefile] [-f] [-n] [-F] <pool \| id> [newpool]
	*
	* -c Read pool information from a cachefile instead of searching
	* devices.
	*
	* -d Scan in a specific directory, other than /dev/. More than
	* one directory can be specified using multiple '-d' options.
	*
	* -D Scan for previously destroyed pools or import all or only
	* specified destroyed pools.
	*
	* -R Temporarily import the pool, with all mountpoints relative to
	* the given root. The pool will remain exported when the machine
	* is rebooted.
	*
	* -V Import even in the presence of faulted vdevs. This is an
	* intentionally undocumented option for testing purposes, and
	* treats the pool configuration as complete, leaving any bad
	* vdevs in the FAULTED state. In other words, it does verbatim
	* import.
	*
	* -f Force import, even if it appears that the pool is active.
	*
	* -F Attempt rewind if necessary.
	*
	* -n See if rewind would work, but don't actually rewind.
	*
	* -N Import the pool but don't mount datasets.
	*
	* -T Specify a starting txg to use for import. This option is
	* intentionally undocumented option for testing purposes.
	*
	* -a Import all pools found.
	*
	* -l Load encryption keys while importing.
	*
	* -o Set property=value and/or temporary mount options (without '=').
	*
	* -s Scan using the default search path, the libblkid cache will
	* not be consulted.
	*
	* --rewind-to-checkpoint
	* Import the pool and revert back to the checkpoint.
	*
	* The import command scans for pools to import, and import pools based on pool
	* name and GUID. The pool can also be renamed as part of the import process.
	*/
	int
	zpool_do_import(int argc, char **argv)
	{
	char **searchdirs = NULL;
	char env, envdup = NULL;
	int nsearch = 0;
	int c;
	int err = 0;
	nvlist_t *pools = NULL;
	boolean_t do_all = B_FALSE;
	boolean_t do_destroyed = B_FALSE;
	char *mntopts = NULL;
	nvpair_t *elem;
	nvlist_t *config;
	uint64_t searchguid = 0;
	char *searchname = NULL;
	char *propval;
	nvlist_t *found_config;
	nvlist_t *policy = NULL;
	nvlist_t *props = NULL;
	boolean_t first;
	int flags = ZFS_IMPORT_NORMAL;
	uint32_t rewind_policy = ZPOOL_NO_REWIND;
	boolean_t dryrun = B_FALSE;
	boolean_t do_rewind = B_FALSE;
	boolean_t xtreme_rewind = B_FALSE;
	boolean_t do_scan = B_FALSE;
	boolean_t pool_exists = B_FALSE;
	uint64_t pool_state, txg = -1ULL;
	char *cachefile = NULL;
	importargs_t idata = { 0 };
	char *endptr;

	struct option long_options[] = {
	{"rewind-to-checkpoint", no_argument, NULL, CHECKPOINT_OPT},
	{0, 0, 0, 0}
	};

	/* check options */
	while ((c = getopt_long(argc, argv, ":aCc:d:DEfFlmnNo:R:stT:VX",
	long_options, NULL)) != -1) {
	switch (c) {
	case 'a':
	do_all = B_TRUE;
	break;
	case 'c':
	cachefile = optarg;
	break;
	case 'd':
	if (searchdirs == NULL) {
	searchdirs = safe_malloc(sizeof (char *));
	} else {
	char *tmp = safe_malloc((nsearch + 1)
	sizeof (char *));
	bcopy(searchdirs, tmp, nsearch *
	sizeof (char *));
	free(searchdirs);
	searchdirs = tmp;
	}
	searchdirs[nsearch++] = optarg;
	break;
	case 'D':
	do_destroyed = B_TRUE;
	break;
	case 'f':
	flags \|= ZFS_IMPORT_ANY_HOST;
	break;
	case 'F':
	do_rewind = B_TRUE;
	break;
	case 'l':
	flags \|= ZFS_IMPORT_LOAD_KEYS;
	break;
	case 'm':
	flags \|= ZFS_IMPORT_MISSING_LOG;
	break;
	case 'n':
	dryrun = B_TRUE;
	break;
	case 'N':
	flags \|= ZFS_IMPORT_ONLY;
	break;
	case 'o':
	if ((propval = strchr(optarg, '=')) != NULL) {
	*propval = '\0';
	propval++;
	if (add_prop_list(optarg, propval,
	&props, B_TRUE))
	goto error;
	} else {
	mntopts = optarg;
	}
	break;
	case 'R':
	if (add_prop_list(zpool_prop_to_name(
	ZPOOL_PROP_ALTROOT), optarg, &props, B_TRUE))
	goto error;
	if (add_prop_list_default(zpool_prop_to_name(
	ZPOOL_PROP_CACHEFILE), "none", &props, B_TRUE))
	goto error;
	break;
	case 's':
	do_scan = B_TRUE;
	break;
	case 't':
	flags \|= ZFS_IMPORT_TEMP_NAME;
	if (add_prop_list_default(zpool_prop_to_name(
	ZPOOL_PROP_CACHEFILE), "none", &props, B_TRUE))
	goto error;
	break;

	case 'T':
	errno = 0;
	txg = strtoull(optarg, &endptr, 0);
	if (errno != 0 \|\| *endptr != '\0') {
	(void) fprintf(stderr,
	gettext("invalid txg value\n"));
	usage(B_FALSE);
	}
	rewind_policy = ZPOOL_DO_REWIND \| ZPOOL_EXTREME_REWIND;
	break;
	case 'V':
	flags \|= ZFS_IMPORT_VERBATIM;
	break;
	case 'X':
	xtreme_rewind = B_TRUE;
	break;
	case CHECKPOINT_OPT:
	flags \|= ZFS_IMPORT_CHECKPOINT;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (cachefile && nsearch != 0) {
	(void) fprintf(stderr, gettext("-c is incompatible with -d\n"));
	usage(B_FALSE);
	}

	if ((flags & ZFS_IMPORT_LOAD_KEYS) && (flags & ZFS_IMPORT_ONLY)) {
	(void) fprintf(stderr, gettext("-l is incompatible with -N\n"));
	usage(B_FALSE);
	}

	if ((flags & ZFS_IMPORT_LOAD_KEYS) && !do_all && argc == 0) {
	(void) fprintf(stderr, gettext("-l is only meaningful during "
	"an import\n"));
	usage(B_FALSE);
	}

	if ((dryrun \|\| xtreme_rewind) && !do_rewind) {
	(void) fprintf(stderr,
	gettext("-n or -X only meaningful with -F\n"));
	usage(B_FALSE);
	}
	if (dryrun)
	rewind_policy = ZPOOL_TRY_REWIND;
	else if (do_rewind)
	rewind_policy = ZPOOL_DO_REWIND;
	if (xtreme_rewind)
	rewind_policy \|= ZPOOL_EXTREME_REWIND;

	/* In the future, we can capture further policy and include it here */
	if (nvlist_alloc(&policy, NV_UNIQUE_NAME, 0) != 0 \|\|
	nvlist_add_uint64(policy, ZPOOL_LOAD_REQUEST_TXG, txg) != 0 \|\|
	nvlist_add_uint32(policy, ZPOOL_LOAD_REWIND_POLICY,
	rewind_policy) != 0)
	goto error;

	/* check argument count */
	if (do_all) {
	if (argc != 0) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}
	} else {
	if (argc > 2) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}
	}

	/*
	* Check for the effective uid. We do this explicitly here because
	* otherwise any attempt to discover pools will silently fail.
	*/
	if (argc == 0 && geteuid() != 0) {
	(void) fprintf(stderr, gettext("cannot "
	"discover pools: permission denied\n"));
	if (searchdirs != NULL)
	free(searchdirs);

	nvlist_free(props);
	nvlist_free(policy);
	return (1);
	}

	/*
	* Depending on the arguments given, we do one of the following:
	*
	* <none> Iterate through all pools and display information about
	* each one.
	*
	* -a Iterate through all pools and try to import each one.
	*
	* <id> Find the pool that corresponds to the given GUID/pool
	* name and import that one.
	*
	* -D Above options applies only to destroyed pools.
	*/
	if (argc != 0) {
	char *endptr;

	errno = 0;
	searchguid = strtoull(argv[0], &endptr, 10);
	if (errno != 0 \|\| *endptr != '\0') {
	searchname = argv[0];
	searchguid = 0;
	}
	found_config = NULL;

	/*
	* User specified a name or guid. Ensure it's unique.
	*/
	target_exists_args_t search = {searchname, searchguid};
	pool_exists = zpool_iter(g_zfs, name_or_guid_exists, &search);
	}

	/*
	* Check the environment for the preferred search path.
	*/
	if ((searchdirs == NULL) && (env = getenv("ZPOOL_IMPORT_PATH"))) {
	char *dir;

	envdup = strdup(env);

	dir = strtok(envdup, ":");
	while (dir != NULL) {
	if (searchdirs == NULL) {
	searchdirs = safe_malloc(sizeof (char *));
	} else {
	char *tmp = safe_malloc((nsearch + 1)
	sizeof (char *));
	bcopy(searchdirs, tmp, nsearch *
	sizeof (char *));
	free(searchdirs);
	searchdirs = tmp;
	}
	searchdirs[nsearch++] = dir;
	dir = strtok(NULL, ":");
	}
	}

	idata.path = searchdirs;
	idata.paths = nsearch;
	idata.poolname = searchname;
	idata.guid = searchguid;
	idata.cachefile = cachefile;
	idata.scan = do_scan;
	idata.policy = policy;

	pools = zpool_search_import(g_zfs, &idata, &libzfs_config_ops);

	if (pools != NULL && pool_exists &&
	(argc == 1 \|\| strcmp(argv[0], argv[1]) == 0)) {
	(void) fprintf(stderr, gettext("cannot import '%s': "
	"a pool with that name already exists\n"),
	argv[0]);
	(void) fprintf(stderr, gettext("use the form '%s "
	"<pool \| id> <newpool>' to give it a new name\n"),
	"zpool import");
	err = 1;
	} else if (pools == NULL && pool_exists) {
	(void) fprintf(stderr, gettext("cannot import '%s': "
	"a pool with that name is already created/imported,\n"),
	argv[0]);
	(void) fprintf(stderr, gettext("and no additional pools "
	"with that name were found\n"));
	err = 1;
	} else if (pools == NULL) {
	if (argc != 0) {
	(void) fprintf(stderr, gettext("cannot import '%s': "
	"no such pool available\n"), argv[0]);
	}
	err = 1;
	}

	if (err == 1) {
	if (searchdirs != NULL)
	free(searchdirs);
	if (envdup != NULL)
	free(envdup);
	nvlist_free(policy);
	nvlist_free(pools);
	nvlist_free(props);
	return (1);
	}

	/*
	* At this point we have a list of import candidate configs. Even if
	* we were searching by pool name or guid, we still need to
	* post-process the list to deal with pool state and possible
	* duplicate names.
	*/
	err = 0;
	elem = NULL;
	first = B_TRUE;
	while ((elem = nvlist_next_nvpair(pools, elem)) != NULL) {

	verify(nvpair_value_nvlist(elem, &config) == 0);

	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_STATE,
	&pool_state) == 0);
	if (!do_destroyed && pool_state == POOL_STATE_DESTROYED)
	continue;
	if (do_destroyed && pool_state != POOL_STATE_DESTROYED)
	continue;

	verify(nvlist_add_nvlist(config, ZPOOL_LOAD_POLICY,
	policy) == 0);

	if (argc == 0) {
	if (first)
	first = B_FALSE;
	else if (!do_all)
	(void) printf("\n");

	if (do_all) {
	err \|= do_import(config, NULL, mntopts,
	props, flags);
	} else {
	show_import(config);
	}
	} else if (searchname != NULL) {
	char *name;

	/*
	* We are searching for a pool based on name.
	*/
	verify(nvlist_lookup_string(config,
	ZPOOL_CONFIG_POOL_NAME, &name) == 0);

	if (strcmp(name, searchname) == 0) {
	if (found_config != NULL) {
	(void) fprintf(stderr, gettext(
	"cannot import '%s': more than "
	"one matching pool\n"), searchname);
	(void) fprintf(stderr, gettext(
	"import by numeric ID instead\n"));
	err = B_TRUE;
	}
	found_config = config;
	}
	} else {
	uint64_t guid;

	/*
	* Search for a pool by guid.
	*/
	verify(nvlist_lookup_uint64(config,
	ZPOOL_CONFIG_POOL_GUID, &guid) == 0);

	if (guid == searchguid)
	found_config = config;
	}
	}

	/*
	* If we were searching for a specific pool, verify that we found a
	* pool, and then do the import.
	*/
	if (argc != 0 && err == 0) {
	if (found_config == NULL) {
	(void) fprintf(stderr, gettext("cannot import '%s': "
	"no such pool available\n"), argv[0]);
	err = B_TRUE;
	} else {
	err \|= do_import(found_config, argc == 1 ? NULL :
	argv[1], mntopts, props, flags);
	}
	}

	/*
	* If we were just looking for pools, report an error if none were
	* found.
	*/
	if (argc == 0 && first)
	(void) fprintf(stderr,
	gettext("no pools available to import\n"));

	error:
	nvlist_free(props);
	nvlist_free(pools);
	nvlist_free(policy);
	if (searchdirs != NULL)
	free(searchdirs);
	if (envdup != NULL)
	free(envdup);

	return (err ? 1 : 0);
	}

	/*
	* zpool sync [-f] [pool] ...
	*
	* -f (undocumented) force uberblock (and config including zpool cache file)
	* update.
	*
	* Sync the specified pool(s).
	* Without arguments "zpool sync" will sync all pools.
	* This command initiates TXG sync(s) and will return after the TXG(s) commit.
	*
	*/
	static int
	zpool_do_sync(int argc, char **argv)
	{
	int ret;
	boolean_t force = B_FALSE;

	/* check options */
	while ((ret = getopt(argc, argv, "f")) != -1) {
	switch (ret) {
	case 'f':
	force = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* if argc == 0 we will execute zpool_sync_one on all pools */
	ret = for_each_pool(argc, argv, B_FALSE, NULL, zpool_sync_one, &force);

	return (ret);
	}

	typedef struct iostat_cbdata {
	uint64_t cb_flags;
	int cb_name_flags;
	int cb_namewidth;
	int cb_iteration;
	char *cb_vdev_names; / Only show these vdevs */
	unsigned int cb_vdev_names_count;
	boolean_t cb_verbose;
	boolean_t cb_literal;
	boolean_t cb_scripted;
	zpool_list_t *cb_list;
	vdev_cmd_data_list_t *vcdl;
	} iostat_cbdata_t;

	/* iostat labels */
	typedef struct name_and_columns {
	const char name; / Column name */
	unsigned int columns; /* Center name to this number of columns */
	} name_and_columns_t;

	#define IOSTAT_MAX_LABELS 13 /* Max number of labels on one line */

	static const name_and_columns_t iostat_top_labels[][IOSTAT_MAX_LABELS] =
	{
	[IOS_DEFAULT] = {{"capacity", 2}, {"operations", 2}, {"bandwidth", 2},
	{NULL}},
	[IOS_LATENCY] = {{"total_wait", 2}, {"disk_wait", 2}, {"syncq_wait", 2},
	{"asyncq_wait", 2}, {"scrub", 1}, {"trim", 1}, {NULL}},
	[IOS_QUEUES] = {{"syncq_read", 2}, {"syncq_write", 2},
	{"asyncq_read", 2}, {"asyncq_write", 2}, {"scrubq_read", 2},
	{"trimq_write", 2}, {NULL}},
	[IOS_L_HISTO] = {{"total_wait", 2}, {"disk_wait", 2}, {"syncq_wait", 2},
	{"asyncq_wait", 2}, {NULL}},
	[IOS_RQ_HISTO] = {{"sync_read", 2}, {"sync_write", 2},
	{"async_read", 2}, {"async_write", 2}, {"scrub", 2},
	{"trim", 2}, {NULL}},
	};

	/* Shorthand - if "columns" field not set, default to 1 column */
	static const name_and_columns_t iostat_bottom_labels[][IOSTAT_MAX_LABELS] =
	{
	[IOS_DEFAULT] = {{"alloc"}, {"free"}, {"read"}, {"write"}, {"read"},
	{"write"}, {NULL}},
	[IOS_LATENCY] = {{"read"}, {"write"}, {"read"}, {"write"}, {"read"},
	{"write"}, {"read"}, {"write"}, {"wait"}, {"wait"}, {NULL}},
	[IOS_QUEUES] = {{"pend"}, {"activ"}, {"pend"}, {"activ"}, {"pend"},
	{"activ"}, {"pend"}, {"activ"}, {"pend"}, {"activ"},
	{"pend"}, {"activ"}, {NULL}},
	[IOS_L_HISTO] = {{"read"}, {"write"}, {"read"}, {"write"}, {"read"},
	{"write"}, {"read"}, {"write"}, {"scrub"}, {"trim"}, {NULL}},
	[IOS_RQ_HISTO] = {{"ind"}, {"agg"}, {"ind"}, {"agg"}, {"ind"}, {"agg"},
	{"ind"}, {"agg"}, {"ind"}, {"agg"}, {"ind"}, {"agg"}, {NULL}},
	};

	static const char *histo_to_title[] = {
	[IOS_L_HISTO] = "latency",
	[IOS_RQ_HISTO] = "req_size",
	};

	/*
	* Return the number of labels in a null-terminated name_and_columns_t
	* array.
	*
	*/
	static unsigned int
	label_array_len(const name_and_columns_t *labels)
	{
	int i = 0;

	while (labels[i].name)
	i++;

	return (i);
	}

	/*
	* Return the number of strings in a null-terminated string array.
	* For example:
	*
	* const char foo[] = {"bar", "baz", NULL}
	*
	* returns 2
	*/
	static uint64_t
	str_array_len(const char *array[])
	{
	uint64_t i = 0;
	while (array[i])
	i++;

	return (i);
	}


	/*
	* Return a default column width for default/latency/queue columns. This does
	* not include histograms, which have their columns autosized.
	*/
	static unsigned int
	default_column_width(iostat_cbdata_t *cb, enum iostat_type type)
	{
	unsigned long column_width = 5; /* Normal niceprint */
	static unsigned long widths[] = {
	/*
	* Choose some sane default column sizes for printing the
	* raw numbers.
	*/
	[IOS_DEFAULT] = 15, /* 1PB capacity */
	[IOS_LATENCY] = 10, /* 1B ns = 10sec */
	[IOS_QUEUES] = 6, /* 1M queue entries */
	[IOS_L_HISTO] = 10, /* 1B ns = 10sec */
	[IOS_RQ_HISTO] = 6, /* 1M queue entries */
	};

	if (cb->cb_literal)
	column_width = widths[type];

	return (column_width);
	}

	/*
	* Print the column labels, i.e:
	*
	* capacity operations bandwidth
	* alloc free read write read write ...
	*
	* If force_column_width is set, use it for the column width. If not set, use
	* the default column width.
	*/
	static void
	print_iostat_labels(iostat_cbdata_t *cb, unsigned int force_column_width,
	const name_and_columns_t labels[][IOSTAT_MAX_LABELS])
	{
	int i, idx, s;
	int text_start, rw_column_width, spaces_to_end;
	uint64_t flags = cb->cb_flags;
	uint64_t f;
	unsigned int column_width = force_column_width;

	/* For each bit set in flags */
	for (f = flags; f; f &= ~(1ULL << idx)) {
	idx = lowbit64(f) - 1;
	if (!force_column_width)
	column_width = default_column_width(cb, idx);
	/* Print our top labels centered over "read write" label. */
	for (i = 0; i < label_array_len(labels[idx]); i++) {
	const char *name = labels[idx][i].name;
	/*
	* We treat labels[][].columns == 0 as shorthand
	* for one column. It makes writing out the label
	* tables more concise.
	*/
	unsigned int columns = MAX(1, labels[idx][i].columns);
	unsigned int slen = strlen(name);

	rw_column_width = (column_width * columns) +
	(2 * (columns - 1));

	text_start = (int)((rw_column_width) / columns -
	slen / columns);
	if (text_start < 0)
	text_start = 0;

	printf(" "); /* Two spaces between columns */

	/* Space from beginning of column to label */
	for (s = 0; s < text_start; s++)
	printf(" ");

	printf("%s", name);

	/* Print space after label to end of column */
	spaces_to_end = rw_column_width - text_start - slen;
	if (spaces_to_end < 0)
	spaces_to_end = 0;

	for (s = 0; s < spaces_to_end; s++)
	printf(" ");
	}
	}
	}


	/*
	* print_cmd_columns - Print custom column titles from -c
	*
	* If the user specified the "zpool status\|iostat -c" then print their custom
	* column titles in the header. For example, print_cmd_columns() would print
	* the " col1 col2" part of this:
	*
	* $ zpool iostat -vc 'echo col1=val1; echo col2=val2'
	* ...
	* capacity operations bandwidth
	* pool alloc free read write read write col1 col2
	* ---------- ----- ----- ----- ----- ----- ----- ---- ----
	* mypool 269K 1008M 0 0 107 946
	* mirror 269K 1008M 0 0 107 946
	* sdb - - 0 0 102 473 val1 val2
	* sdc - - 0 0 5 473 val1 val2
	* ---------- ----- ----- ----- ----- ----- ----- ---- ----
	*/
	static void
	print_cmd_columns(vdev_cmd_data_list_t *vcdl, int use_dashes)
	{
	int i, j;
	vdev_cmd_data_t *data = &vcdl->data[0];

	if (vcdl->count == 0 \|\| data == NULL)
	return;

	/*
	* Each vdev cmd should have the same column names unless the user did
	* something weird with their cmd. Just take the column names from the
	* first vdev and assume it works for all of them.
	*/
	for (i = 0; i < vcdl->uniq_cols_cnt; i++) {
	printf(" ");
	if (use_dashes) {
	for (j = 0; j < vcdl->uniq_cols_width[i]; j++)
	printf("-");
	} else {
	printf_color(ANSI_BOLD, "%*s", vcdl->uniq_cols_width[i],
	vcdl->uniq_cols[i]);
	}
	}
	}


	/*
	* Utility function to print out a line of dashes like:
	*
	* -------------------------------- ----- ----- ----- ----- -----
	*
	* ...or a dashed named-row line like:
	*
	* logs - - - - -
	*
	* @cb: iostat data
	*
	* @force_column_width If non-zero, use the value as the column width.
	* Otherwise use the default column widths.
	*
	* @name: Print a dashed named-row line starting
	* with @name. Otherwise, print a regular
	* dashed line.
	*/
	static void
	print_iostat_dashes(iostat_cbdata_t *cb, unsigned int force_column_width,
	const char *name)
	{
	int i;
	unsigned int namewidth;
	uint64_t flags = cb->cb_flags;
	uint64_t f;
	int idx;
	const name_and_columns_t *labels;
	const char *title;


	if (cb->cb_flags & IOS_ANYHISTO_M) {
	title = histo_to_title[IOS_HISTO_IDX(cb->cb_flags)];
	} else if (cb->cb_vdev_names_count) {
	title = "vdev";
	} else {
	title = "pool";
	}

	namewidth = MAX(MAX(strlen(title), cb->cb_namewidth),
	name ? strlen(name) : 0);


	if (name) {
	printf("%-*s", namewidth, name);
	} else {
	for (i = 0; i < namewidth; i++)
	(void) printf("-");
	}

	/* For each bit in flags */
	for (f = flags; f; f &= ~(1ULL << idx)) {
	unsigned int column_width;
	idx = lowbit64(f) - 1;
	if (force_column_width)
	column_width = force_column_width;
	else
	column_width = default_column_width(cb, idx);

	labels = iostat_bottom_labels[idx];
	for (i = 0; i < label_array_len(labels); i++) {
	if (name)
	printf(" %*s-", column_width - 1, " ");
	else
	printf(" %.*s", column_width,
	"--------------------");
	}
	}
	}


	static void
	print_iostat_separator_impl(iostat_cbdata_t *cb,
	unsigned int force_column_width)
	{
	print_iostat_dashes(cb, force_column_width, NULL);
	}

	static void
	print_iostat_separator(iostat_cbdata_t *cb)
	{
	print_iostat_separator_impl(cb, 0);
	}

	static void
	print_iostat_header_impl(iostat_cbdata_t *cb, unsigned int force_column_width,
	const char *histo_vdev_name)
	{
	unsigned int namewidth;
	const char *title;

	if (cb->cb_flags & IOS_ANYHISTO_M) {
	title = histo_to_title[IOS_HISTO_IDX(cb->cb_flags)];
	} else if (cb->cb_vdev_names_count) {
	title = "vdev";
	} else {
	title = "pool";
	}

	namewidth = MAX(MAX(strlen(title), cb->cb_namewidth),
	histo_vdev_name ? strlen(histo_vdev_name) : 0);

	if (histo_vdev_name)
	printf("%-*s", namewidth, histo_vdev_name);
	else
	printf("%*s", namewidth, "");


	print_iostat_labels(cb, force_column_width, iostat_top_labels);
	printf("\n");

	printf("%-*s", namewidth, title);

	print_iostat_labels(cb, force_column_width, iostat_bottom_labels);
	if (cb->vcdl != NULL)
	print_cmd_columns(cb->vcdl, 0);

	printf("\n");

	print_iostat_separator_impl(cb, force_column_width);

	if (cb->vcdl != NULL)
	print_cmd_columns(cb->vcdl, 1);

	printf("\n");
	}

	static void
	print_iostat_header(iostat_cbdata_t *cb)
	{
	print_iostat_header_impl(cb, 0, NULL);
	}


	/*
	* Display a single statistic.
	*/
	static void
	print_one_stat(uint64_t value, enum zfs_nicenum_format format,
	unsigned int column_size, boolean_t scripted)
	{
	char buf[64];

	zfs_nicenum_format(value, buf, sizeof (buf), format);

	if (scripted)
	printf("\t%s", buf);
	else
	printf(" %*s", column_size, buf);
	}

	/*
	* Calculate the default vdev stats
	*
	* Subtract oldvs from newvs, apply a scaling factor, and save the resulting
	* stats into calcvs.
	*/
	static void
	calc_default_iostats(vdev_stat_t oldvs, vdev_stat_t newvs,
	vdev_stat_t *calcvs)
	{
	int i;

	memcpy(calcvs, newvs, sizeof (*calcvs));
	for (i = 0; i < ARRAY_SIZE(calcvs->vs_ops); i++)
	calcvs->vs_ops[i] = (newvs->vs_ops[i] - oldvs->vs_ops[i]);

	for (i = 0; i < ARRAY_SIZE(calcvs->vs_bytes); i++)
	calcvs->vs_bytes[i] = (newvs->vs_bytes[i] - oldvs->vs_bytes[i]);
	}

	/*
	* Internal representation of the extended iostats data.
	*
	* The extended iostat stats are exported in nvlists as either uint64_t arrays
	* or single uint64_t's. We make both look like arrays to make them easier
	* to process. In order to make single uint64_t's look like arrays, we set
	* __data to the stat data, and then set *data = &__data with count = 1. Then,
	* we can just use *data and count.
	*/
	struct stat_array {
	uint64_t *data;
	uint_t count; /* Number of entries in data[] */
	uint64_t __data; /* Only used when data is a single uint64_t */
	};

	static uint64_t
	stat_histo_max(struct stat_array *nva, unsigned int len)
	{
	uint64_t max = 0;
	int i;
	for (i = 0; i < len; i++)
	max = MAX(max, array64_max(nva[i].data, nva[i].count));

	return (max);
	}

	/*
	* Helper function to lookup a uint64_t array or uint64_t value and store its
	* data as a stat_array. If the nvpair is a single uint64_t value, then we make
	* it look like a one element array to make it easier to process.
	*/
	static int
	nvpair64_to_stat_array(nvlist_t nvl, const char name,
	struct stat_array *nva)
	{
	nvpair_t *tmp;
	int ret;

	verify(nvlist_lookup_nvpair(nvl, name, &tmp) == 0);
	switch (nvpair_type(tmp)) {
	case DATA_TYPE_UINT64_ARRAY:
	ret = nvpair_value_uint64_array(tmp, &nva->data, &nva->count);
	break;
	case DATA_TYPE_UINT64:
	ret = nvpair_value_uint64(tmp, &nva->__data);
	nva->data = &nva->__data;
	nva->count = 1;
	break;
	default:
	/* Not a uint64_t */
	ret = EINVAL;
	break;
	}

	return (ret);
	}

	/*
	* Given a list of nvlist names, look up the extended stats in newnv and oldnv,
	* subtract them, and return the results in a newly allocated stat_array.
	* You must free the returned array after you are done with it with
	* free_calc_stats().
	*
	* Additionally, you can set "oldnv" to NULL if you simply want the newnv
	* values.
	*/
	static struct stat_array *
	calc_and_alloc_stats_ex(const char *names, unsigned int len, nvlist_t oldnv,
	nvlist_t *newnv)
	{
	nvlist_t oldnvx = NULL, newnvx;
	struct stat_array oldnva, newnva, *calcnva;
	int i, j;
	unsigned int alloc_size = (sizeof (struct stat_array)) * len;

	/* Extract our extended stats nvlist from the main list */
	verify(nvlist_lookup_nvlist(newnv, ZPOOL_CONFIG_VDEV_STATS_EX,
	&newnvx) == 0);
	if (oldnv) {
	verify(nvlist_lookup_nvlist(oldnv, ZPOOL_CONFIG_VDEV_STATS_EX,
	&oldnvx) == 0);
	}

	newnva = safe_malloc(alloc_size);
	oldnva = safe_malloc(alloc_size);
	calcnva = safe_malloc(alloc_size);

	for (j = 0; j < len; j++) {
	verify(nvpair64_to_stat_array(newnvx, names[j],
	&newnva[j]) == 0);
	calcnva[j].count = newnva[j].count;
	alloc_size = calcnva[j].count * sizeof (calcnva[j].data[0]);
	calcnva[j].data = safe_malloc(alloc_size);
	memcpy(calcnva[j].data, newnva[j].data, alloc_size);

	if (oldnvx) {
	verify(nvpair64_to_stat_array(oldnvx, names[j],
	&oldnva[j]) == 0);
	for (i = 0; i < oldnva[j].count; i++)
	calcnva[j].data[i] -= oldnva[j].data[i];
	}
	}
	free(newnva);
	free(oldnva);
	return (calcnva);
	}

	static void
	free_calc_stats(struct stat_array *nva, unsigned int len)
	{
	int i;
	for (i = 0; i < len; i++)
	free(nva[i].data);

	free(nva);
	}

	static void
	print_iostat_histo(struct stat_array *nva, unsigned int len,
	iostat_cbdata_t *cb, unsigned int column_width, unsigned int namewidth,
	double scale)
	{
	int i, j;
	char buf[6];
	uint64_t val;
	enum zfs_nicenum_format format;
	unsigned int buckets;
	unsigned int start_bucket;

	if (cb->cb_literal)
	format = ZFS_NICENUM_RAW;
	else
	format = ZFS_NICENUM_1024;

	/* All these histos are the same size, so just use nva[0].count */
	buckets = nva[0].count;

	if (cb->cb_flags & IOS_RQ_HISTO_M) {
	/* Start at 512 - req size should never be lower than this */
	start_bucket = 9;
	} else {
	start_bucket = 0;
	}

	for (j = start_bucket; j < buckets; j++) {
	/* Print histogram bucket label */
	if (cb->cb_flags & IOS_L_HISTO_M) {
	/* Ending range of this bucket */
	val = (1UL << (j + 1)) - 1;
	zfs_nicetime(val, buf, sizeof (buf));
	} else {
	/* Request size (starting range of bucket) */
	val = (1UL << j);
	zfs_nicenum(val, buf, sizeof (buf));
	}

	if (cb->cb_scripted)
	printf("%llu", (u_longlong_t)val);
	else
	printf("%-*s", namewidth, buf);

	/* Print the values on the line */
	for (i = 0; i < len; i++) {
	print_one_stat(nva[i].data[j] * scale, format,
	column_width, cb->cb_scripted);
	}
	printf("\n");
	}
	}

	static void
	print_solid_separator(unsigned int length)
	{
	while (length--)
	printf("-");
	printf("\n");
	}

	static void
	print_iostat_histos(iostat_cbdata_t cb, nvlist_t oldnv,
	nvlist_t newnv, double scale, const char name)
	{
	unsigned int column_width;
	unsigned int namewidth;
	unsigned int entire_width;
	enum iostat_type type;
	struct stat_array *nva;
	const char **names;
	unsigned int names_len;

	/* What type of histo are we? */
	type = IOS_HISTO_IDX(cb->cb_flags);

	/* Get NULL-terminated array of nvlist names for our histo */
	names = vsx_type_to_nvlist[type];
	names_len = str_array_len(names); /* num of names */

	nva = calc_and_alloc_stats_ex(names, names_len, oldnv, newnv);

	if (cb->cb_literal) {
	column_width = MAX(5,
	(unsigned int) log10(stat_histo_max(nva, names_len)) + 1);
	} else {
	column_width = 5;
	}

	namewidth = MAX(cb->cb_namewidth,
	strlen(histo_to_title[IOS_HISTO_IDX(cb->cb_flags)]));

	/*
	* Calculate the entire line width of what we're printing. The
	* +2 is for the two spaces between columns:
	*/
	/* read write */
	/* ----- ----- */
	/* \|___\| <---------- column_width */
	/* */
	/* \|__________\| <--- entire_width */
	/* */
	entire_width = namewidth + (column_width + 2) *
	label_array_len(iostat_bottom_labels[type]);

	if (cb->cb_scripted)
	printf("%s\n", name);
	else
	print_iostat_header_impl(cb, column_width, name);

	print_iostat_histo(nva, names_len, cb, column_width,
	namewidth, scale);

	free_calc_stats(nva, names_len);
	if (!cb->cb_scripted)
	print_solid_separator(entire_width);
	}

	/*
	* Calculate the average latency of a power-of-two latency histogram
	*/
	static uint64_t
	single_histo_average(uint64_t *histo, unsigned int buckets)
	{
	int i;
	uint64_t count = 0, total = 0;

	for (i = 0; i < buckets; i++) {
	/*
	* Our buckets are power-of-two latency ranges. Use the
	* midpoint latency of each bucket to calculate the average.
	* For example:
	*
	* Bucket Midpoint
	* 8ns-15ns: 12ns
	* 16ns-31ns: 24ns
	* ...
	*/
	if (histo[i] != 0) {
	total += histo[i] * (((1UL << i) + ((1UL << i)/2)));
	count += histo[i];
	}
	}

	/* Prevent divide by zero */
	return (count == 0 ? 0 : total / count);
	}

	static void
	print_iostat_queues(iostat_cbdata_t cb, nvlist_t oldnv,
	nvlist_t *newnv)
	{
	int i;
	uint64_t val;
	const char *names[] = {
	ZPOOL_CONFIG_VDEV_SYNC_R_PEND_QUEUE,
	ZPOOL_CONFIG_VDEV_SYNC_R_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_SYNC_W_PEND_QUEUE,
	ZPOOL_CONFIG_VDEV_SYNC_W_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_ASYNC_R_PEND_QUEUE,
	ZPOOL_CONFIG_VDEV_ASYNC_R_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_ASYNC_W_PEND_QUEUE,
	ZPOOL_CONFIG_VDEV_ASYNC_W_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_SCRUB_PEND_QUEUE,
	ZPOOL_CONFIG_VDEV_SCRUB_ACTIVE_QUEUE,
	ZPOOL_CONFIG_VDEV_TRIM_PEND_QUEUE,
	ZPOOL_CONFIG_VDEV_TRIM_ACTIVE_QUEUE,
	};

	struct stat_array *nva;

	unsigned int column_width = default_column_width(cb, IOS_QUEUES);
	enum zfs_nicenum_format format;

	nva = calc_and_alloc_stats_ex(names, ARRAY_SIZE(names), NULL, newnv);

	if (cb->cb_literal)
	format = ZFS_NICENUM_RAW;
	else
	format = ZFS_NICENUM_1024;

	for (i = 0; i < ARRAY_SIZE(names); i++) {
	val = nva[i].data[0];
	print_one_stat(val, format, column_width, cb->cb_scripted);
	}

	free_calc_stats(nva, ARRAY_SIZE(names));
	}

	static void
	print_iostat_latency(iostat_cbdata_t cb, nvlist_t oldnv,
	nvlist_t *newnv)
	{
	int i;
	uint64_t val;
	const char *names[] = {
	ZPOOL_CONFIG_VDEV_TOT_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_TOT_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_DISK_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_DISK_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_SYNC_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_SYNC_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_ASYNC_R_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_ASYNC_W_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_SCRUB_LAT_HISTO,
	ZPOOL_CONFIG_VDEV_TRIM_LAT_HISTO,
	};
	struct stat_array *nva;

	unsigned int column_width = default_column_width(cb, IOS_LATENCY);
	enum zfs_nicenum_format format;

	nva = calc_and_alloc_stats_ex(names, ARRAY_SIZE(names), oldnv, newnv);

	if (cb->cb_literal)
	format = ZFS_NICENUM_RAWTIME;
	else
	format = ZFS_NICENUM_TIME;

	/* Print our avg latencies on the line */
	for (i = 0; i < ARRAY_SIZE(names); i++) {
	/* Compute average latency for a latency histo */
	val = single_histo_average(nva[i].data, nva[i].count);
	print_one_stat(val, format, column_width, cb->cb_scripted);
	}
	free_calc_stats(nva, ARRAY_SIZE(names));
	}

	/*
	* Print default statistics (capacity/operations/bandwidth)
	*/
	static void
	print_iostat_default(vdev_stat_t vs, iostat_cbdata_t cb, double scale)
	{
	unsigned int column_width = default_column_width(cb, IOS_DEFAULT);
	enum zfs_nicenum_format format;
	char na; /* char to print for "not applicable" values */

	if (cb->cb_literal) {
	format = ZFS_NICENUM_RAW;
	na = '0';
	} else {
	format = ZFS_NICENUM_1024;
	na = '-';
	}

	/* only toplevel vdevs have capacity stats */
	if (vs->vs_space == 0) {
	if (cb->cb_scripted)
	printf("\t%c\t%c", na, na);
	else
	printf(" %c %c", column_width, na, column_width,
	na);
	} else {
	print_one_stat(vs->vs_alloc, format, column_width,
	cb->cb_scripted);
	print_one_stat(vs->vs_space - vs->vs_alloc, format,
	column_width, cb->cb_scripted);
	}

	print_one_stat((uint64_t)(vs->vs_ops[ZIO_TYPE_READ] * scale),
	format, column_width, cb->cb_scripted);
	print_one_stat((uint64_t)(vs->vs_ops[ZIO_TYPE_WRITE] * scale),
	format, column_width, cb->cb_scripted);
	print_one_stat((uint64_t)(vs->vs_bytes[ZIO_TYPE_READ] * scale),
	format, column_width, cb->cb_scripted);
	print_one_stat((uint64_t)(vs->vs_bytes[ZIO_TYPE_WRITE] * scale),
	format, column_width, cb->cb_scripted);
	}

	static const char *class_name[] = {
	VDEV_ALLOC_BIAS_DEDUP,
	VDEV_ALLOC_BIAS_SPECIAL,
	VDEV_ALLOC_CLASS_LOGS
	};

	/*
	* Print out all the statistics for the given vdev. This can either be the
	* toplevel configuration, or called recursively. If 'name' is NULL, then this
	* is a verbose output, and we don't want to display the toplevel pool stats.
	*
	* Returns the number of stat lines printed.
	*/
	static unsigned int
	print_vdev_stats(zpool_handle_t zhp, const char name, nvlist_t *oldnv,
	nvlist_t newnv, iostat_cbdata_t cb, int depth)
	{
	nvlist_t oldchild, newchild;
	uint_t c, children, oldchildren;
	vdev_stat_t oldvs, newvs, *calcvs;
	vdev_stat_t zerovs = { 0 };
	char *vname;
	int i;
	int ret = 0;
	uint64_t tdelta;
	double scale;

	if (strcmp(name, VDEV_TYPE_INDIRECT) == 0)
	return (ret);

	calcvs = safe_malloc(sizeof (*calcvs));

	if (oldnv != NULL) {
	verify(nvlist_lookup_uint64_array(oldnv,
	ZPOOL_CONFIG_VDEV_STATS, (uint64_t **)&oldvs, &c) == 0);
	} else {
	oldvs = &zerovs;
	}

	/* Do we only want to see a specific vdev? */
	for (i = 0; i < cb->cb_vdev_names_count; i++) {
	/* Yes we do. Is this the vdev? */
	if (strcmp(name, cb->cb_vdev_names[i]) == 0) {
	/*
	* This is our vdev. Since it is the only vdev we
	* will be displaying, make depth = 0 so that it
	* doesn't get indented.
	*/
	depth = 0;
	break;
	}
	}

	if (cb->cb_vdev_names_count && (i == cb->cb_vdev_names_count)) {
	/* Couldn't match the name */
	goto children;
	}


	verify(nvlist_lookup_uint64_array(newnv, ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t **)&newvs, &c) == 0);

	/*
	* Print the vdev name unless it's is a histogram. Histograms
	* display the vdev name in the header itself.
	*/
	if (!(cb->cb_flags & IOS_ANYHISTO_M)) {
	if (cb->cb_scripted) {
	printf("%s", name);
	} else {
	if (strlen(name) + depth > cb->cb_namewidth)
	(void) printf("%*s%s", depth, "", name);
	else
	(void) printf("%s%s%s", depth, "", name,
	(int)(cb->cb_namewidth - strlen(name) -
	depth), "");
	}
	}

	/* Calculate our scaling factor */
	tdelta = newvs->vs_timestamp - oldvs->vs_timestamp;
	if ((oldvs->vs_timestamp == 0) && (cb->cb_flags & IOS_ANYHISTO_M)) {
	/*
	* If we specify printing histograms with no time interval, then
	* print the histogram numbers over the entire lifetime of the
	* vdev.
	*/
	scale = 1;
	} else {
	if (tdelta == 0)
	scale = 1.0;
	else
	scale = (double)NANOSEC / tdelta;
	}

	if (cb->cb_flags & IOS_DEFAULT_M) {
	calc_default_iostats(oldvs, newvs, calcvs);
	print_iostat_default(calcvs, cb, scale);
	}
	if (cb->cb_flags & IOS_LATENCY_M)
	print_iostat_latency(cb, oldnv, newnv);
	if (cb->cb_flags & IOS_QUEUES_M)
	print_iostat_queues(cb, oldnv, newnv);
	if (cb->cb_flags & IOS_ANYHISTO_M) {
	printf("\n");
	print_iostat_histos(cb, oldnv, newnv, scale, name);
	}

	if (cb->vcdl != NULL) {
	char *path;
	if (nvlist_lookup_string(newnv, ZPOOL_CONFIG_PATH,
	&path) == 0) {
	printf(" ");
	zpool_print_cmd(cb->vcdl, zpool_get_name(zhp), path);
	}
	}

	if (!(cb->cb_flags & IOS_ANYHISTO_M))
	printf("\n");

	ret++;

	children:

	free(calcvs);

	if (!cb->cb_verbose)
	return (ret);

	if (nvlist_lookup_nvlist_array(newnv, ZPOOL_CONFIG_CHILDREN,
	&newchild, &children) != 0)
	return (ret);

	if (oldnv) {
	if (nvlist_lookup_nvlist_array(oldnv, ZPOOL_CONFIG_CHILDREN,
	&oldchild, &oldchildren) != 0)
	return (ret);

	children = MIN(oldchildren, children);
	}

	/*
	* print normal top-level devices
	*/
	for (c = 0; c < children; c++) {
	uint64_t ishole = B_FALSE, islog = B_FALSE;

	(void) nvlist_lookup_uint64(newchild[c], ZPOOL_CONFIG_IS_HOLE,
	&ishole);

	(void) nvlist_lookup_uint64(newchild[c], ZPOOL_CONFIG_IS_LOG,
	&islog);

	if (ishole \|\| islog)
	continue;

	if (nvlist_exists(newchild[c], ZPOOL_CONFIG_ALLOCATION_BIAS))
	continue;

	vname = zpool_vdev_name(g_zfs, zhp, newchild[c],
	cb->cb_name_flags);
	ret += print_vdev_stats(zhp, vname, oldnv ? oldchild[c] : NULL,
	newchild[c], cb, depth + 2);
	free(vname);
	}

	/*
	* print all other top-level devices
	*/
	for (uint_t n = 0; n < 3; n++) {
	boolean_t printed = B_FALSE;

	for (c = 0; c < children; c++) {
	uint64_t islog = B_FALSE;
	char *bias = NULL;
	char *type = NULL;

	(void) nvlist_lookup_uint64(newchild[c],
	ZPOOL_CONFIG_IS_LOG, &islog);
	if (islog) {
	bias = VDEV_ALLOC_CLASS_LOGS;
	} else {
	(void) nvlist_lookup_string(newchild[c],
	ZPOOL_CONFIG_ALLOCATION_BIAS, &bias);
	(void) nvlist_lookup_string(newchild[c],
	ZPOOL_CONFIG_TYPE, &type);
	}
	if (bias == NULL \|\| strcmp(bias, class_name[n]) != 0)
	continue;
	if (!islog && strcmp(type, VDEV_TYPE_INDIRECT) == 0)
	continue;

	if (!printed) {
	if ((!(cb->cb_flags & IOS_ANYHISTO_M)) &&
	!cb->cb_scripted && !cb->cb_vdev_names) {
	print_iostat_dashes(cb, 0,
	class_name[n]);
	}
	printf("\n");
	printed = B_TRUE;
	}

	vname = zpool_vdev_name(g_zfs, zhp, newchild[c],
	cb->cb_name_flags);
	ret += print_vdev_stats(zhp, vname, oldnv ?
	oldchild[c] : NULL, newchild[c], cb, depth + 2);
	free(vname);
	}
	}

	/*
	* Include level 2 ARC devices in iostat output
	*/
	if (nvlist_lookup_nvlist_array(newnv, ZPOOL_CONFIG_L2CACHE,
	&newchild, &children) != 0)
	return (ret);

	if (oldnv) {
	if (nvlist_lookup_nvlist_array(oldnv, ZPOOL_CONFIG_L2CACHE,
	&oldchild, &oldchildren) != 0)
	return (ret);

	children = MIN(oldchildren, children);
	}

	if (children > 0) {
	if ((!(cb->cb_flags & IOS_ANYHISTO_M)) && !cb->cb_scripted &&
	!cb->cb_vdev_names) {
	print_iostat_dashes(cb, 0, "cache");
	}
	printf("\n");

	for (c = 0; c < children; c++) {
	vname = zpool_vdev_name(g_zfs, zhp, newchild[c],
	cb->cb_name_flags);
	ret += print_vdev_stats(zhp, vname, oldnv ? oldchild[c]
	: NULL, newchild[c], cb, depth + 2);
	free(vname);
	}
	}

	return (ret);
	}

	static int
	refresh_iostat(zpool_handle_t zhp, void data)
	{
	iostat_cbdata_t *cb = data;
	boolean_t missing;

	/*
	* If the pool has disappeared, remove it from the list and continue.
	*/
	if (zpool_refresh_stats(zhp, &missing) != 0)
	return (-1);

	if (missing)
	pool_list_remove(cb->cb_list, zhp);

	return (0);
	}

	/*
	* Callback to print out the iostats for the given pool.
	*/
	static int
	print_iostat(zpool_handle_t zhp, void data)
	{
	iostat_cbdata_t *cb = data;
	nvlist_t oldconfig, newconfig;
	nvlist_t oldnvroot, newnvroot;
	int ret;

	newconfig = zpool_get_config(zhp, &oldconfig);

	if (cb->cb_iteration == 1)
	oldconfig = NULL;

	verify(nvlist_lookup_nvlist(newconfig, ZPOOL_CONFIG_VDEV_TREE,
	&newnvroot) == 0);

	if (oldconfig == NULL)
	oldnvroot = NULL;
	else
	verify(nvlist_lookup_nvlist(oldconfig, ZPOOL_CONFIG_VDEV_TREE,
	&oldnvroot) == 0);

	ret = print_vdev_stats(zhp, zpool_get_name(zhp), oldnvroot, newnvroot,
	cb, 0);
	if ((ret != 0) && !(cb->cb_flags & IOS_ANYHISTO_M) &&
	!cb->cb_scripted && cb->cb_verbose && !cb->cb_vdev_names_count) {
	print_iostat_separator(cb);
	if (cb->vcdl != NULL) {
	print_cmd_columns(cb->vcdl, 1);
	}
	printf("\n");
	}

	return (ret);
	}

	static int
	get_columns(void)
	{
	struct winsize ws;
	int columns = 80;
	int error;

	if (isatty(STDOUT_FILENO)) {
	error = ioctl(STDOUT_FILENO, TIOCGWINSZ, &ws);
	if (error == 0)
	columns = ws.ws_col;
	} else {
	columns = 999;
	}

	return (columns);
	}

	/*
	* Return the required length of the pool/vdev name column. The minimum
	* allowed width and output formatting flags must be provided.
	*/
	static int
	get_namewidth(zpool_handle_t *zhp, int min_width, int flags, boolean_t verbose)
	{
	nvlist_t config, nvroot;
	int width = min_width;

	if ((config = zpool_get_config(zhp, NULL)) != NULL) {
	verify(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
	&nvroot) == 0);
	unsigned int poolname_len = strlen(zpool_get_name(zhp));
	if (verbose == B_FALSE) {
	width = MAX(poolname_len, min_width);
	} else {
	width = MAX(poolname_len,
	max_width(zhp, nvroot, 0, min_width, flags));
	}
	}

	return (width);
	}

	/*
	* Parse the input string, get the 'interval' and 'count' value if there is one.
	*/
	static void
	get_interval_count(int argcp, char argv, float iv,
	unsigned long *cnt)
	{
	float interval = 0;
	unsigned long count = 0;
	int argc = *argcp;

	/*
	* Determine if the last argument is an integer or a pool name
	*/
	if (argc > 0 && zfs_isnumber(argv[argc - 1])) {
	char *end;

	errno = 0;
	interval = strtof(argv[argc - 1], &end);

	if (*end == '\0' && errno == 0) {
	if (interval == 0) {
	(void) fprintf(stderr, gettext("interval "
	"cannot be zero\n"));
	usage(B_FALSE);
	}
	/*
	* Ignore the last parameter
	*/
	argc--;
	} else {
	/*
	* If this is not a valid number, just plow on. The
	* user will get a more informative error message later
	* on.
	*/
	interval = 0;
	}
	}

	/*
	* If the last argument is also an integer, then we have both a count
	* and an interval.
	*/
	if (argc > 0 && zfs_isnumber(argv[argc - 1])) {
	char *end;

	errno = 0;
	count = interval;
	interval = strtof(argv[argc - 1], &end);

	if (*end == '\0' && errno == 0) {
	if (interval == 0) {
	(void) fprintf(stderr, gettext("interval "
	"cannot be zero\n"));
	usage(B_FALSE);
	}

	/*
	* Ignore the last parameter
	*/
	argc--;
	} else {
	interval = 0;
	}
	}

	*iv = interval;
	*cnt = count;
	*argcp = argc;
	}

	static void
	get_timestamp_arg(char c)
	{
	if (c == 'u')
	timestamp_fmt = UDATE;
	else if (c == 'd')
	timestamp_fmt = DDATE;
	else
	usage(B_FALSE);
	}

	/*
	* Return stat flags that are supported by all pools by both the module and
	* zpool iostat. "*data" should be initialized to all 0xFFs before running.
	* It will get ANDed down until only the flags that are supported on all pools
	* remain.
	*/
	static int
	get_stat_flags_cb(zpool_handle_t zhp, void data)
	{
	uint64_t *mask = data;
	nvlist_t config, nvroot, *nvx;
	uint64_t flags = 0;
	int i, j;

	config = zpool_get_config(zhp, NULL);
	verify(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
	&nvroot) == 0);

	/* Default stats are always supported, but for completeness.. */
	if (nvlist_exists(nvroot, ZPOOL_CONFIG_VDEV_STATS))
	flags \|= IOS_DEFAULT_M;

	/* Get our extended stats nvlist from the main list */
	if (nvlist_lookup_nvlist(nvroot, ZPOOL_CONFIG_VDEV_STATS_EX,
	&nvx) != 0) {
	/*
	* No extended stats; they're probably running an older
	* module. No big deal, we support that too.
	*/
	goto end;
	}

	/* For each extended stat, make sure all its nvpairs are supported */
	for (j = 0; j < ARRAY_SIZE(vsx_type_to_nvlist); j++) {
	if (!vsx_type_to_nvlist[j][0])
	continue;

	/* Start off by assuming the flag is supported, then check */
	flags \|= (1ULL << j);
	for (i = 0; vsx_type_to_nvlist[j][i]; i++) {
	if (!nvlist_exists(nvx, vsx_type_to_nvlist[j][i])) {
	/* flag isn't supported */
	flags = flags & ~(1ULL << j);
	break;
	}
	}
	}
	end:
	mask = mask & flags;
	return (0);
	}

	/*
	* Return a bitmask of stats that are supported on all pools by both the module
	* and zpool iostat.
	*/
	static uint64_t
	get_stat_flags(zpool_list_t *list)
	{
	uint64_t mask = -1;

	/*
	* get_stat_flags_cb() will lop off bits from "mask" until only the
	* flags that are supported on all pools remain.
	*/
	pool_list_iter(list, B_FALSE, get_stat_flags_cb, &mask);
	return (mask);
	}

	/*
	* Return 1 if cb_data->cb_vdev_names[0] is this vdev's name, 0 otherwise.
	*/
	static int
	is_vdev_cb(zpool_handle_t zhp, nvlist_t nv, void *cb_data)
	{
	iostat_cbdata_t *cb = cb_data;
	char *name = NULL;
	int ret = 0;

	name = zpool_vdev_name(g_zfs, zhp, nv, cb->cb_name_flags);

	if (strcmp(name, cb->cb_vdev_names[0]) == 0)
	ret = 1; /* match */
	free(name);

	return (ret);
	}

	/*
	* Returns 1 if cb_data->cb_vdev_names[0] is a vdev name, 0 otherwise.
	*/
	static int
	is_vdev(zpool_handle_t zhp, void cb_data)
	{
	return (for_each_vdev(zhp, is_vdev_cb, cb_data));
	}

	/*
	* Check if vdevs are in a pool
	*
	* Return 1 if all argv[] strings are vdev names in pool "pool_name". Otherwise
	* return 0. If pool_name is NULL, then search all pools.
	*/
	static int
	are_vdevs_in_pool(int argc, char *argv, char pool_name,
	iostat_cbdata_t *cb)
	{
	char **tmp_name;
	int ret = 0;
	int i;
	int pool_count = 0;

	if ((argc == 0) \|\| !*argv)
	return (0);

	if (pool_name)
	pool_count = 1;

	/* Temporarily hijack cb_vdev_names for a second... */
	tmp_name = cb->cb_vdev_names;

	/* Go though our list of prospective vdev names */
	for (i = 0; i < argc; i++) {
	cb->cb_vdev_names = argv + i;

	/* Is this name a vdev in our pools? */
	ret = for_each_pool(pool_count, &pool_name, B_TRUE, NULL,
	is_vdev, cb);
	if (!ret) {
	/* No match */
	break;
	}
	}

	cb->cb_vdev_names = tmp_name;

	return (ret);
	}

	static int
	is_pool_cb(zpool_handle_t zhp, void data)
	{
	char *name = data;
	if (strcmp(name, zpool_get_name(zhp)) == 0)
	return (1);

	return (0);
	}

	/*
	* Do we have a pool named *name? If so, return 1, otherwise 0.
	*/
	static int
	is_pool(char *name)
	{
	return (for_each_pool(0, NULL, B_TRUE, NULL, is_pool_cb, name));
	}

	/* Are all our argv[] strings pool names? If so return 1, 0 otherwise. */
	static int
	are_all_pools(int argc, char **argv)
	{
	if ((argc == 0) \|\| !*argv)
	return (0);

	while (--argc >= 0)
	if (!is_pool(argv[argc]))
	return (0);

	return (1);
	}

	/*
	* Helper function to print out vdev/pool names we can't resolve. Used for an
	* error message.
	*/
	static void
	error_list_unresolved_vdevs(int argc, char *argv, char pool_name,
	iostat_cbdata_t *cb)
	{
	int i;
	char *name;
	char *str;
	for (i = 0; i < argc; i++) {
	name = argv[i];

	if (is_pool(name))
	str = gettext("pool");
	else if (are_vdevs_in_pool(1, &name, pool_name, cb))
	str = gettext("vdev in this pool");
	else if (are_vdevs_in_pool(1, &name, NULL, cb))
	str = gettext("vdev in another pool");
	else
	str = gettext("unknown");

	fprintf(stderr, "\t%s (%s)\n", name, str);
	}
	}

	/*
	* Same as get_interval_count(), but with additional checks to not misinterpret
	* guids as interval/count values. Assumes VDEV_NAME_GUID is set in
	* cb.cb_name_flags.
	*/
	static void
	get_interval_count_filter_guids(int argc, char argv, float interval,
	unsigned long count, iostat_cbdata_t cb)
	{
	char **tmpargv = argv;
	int argc_for_interval = 0;

	/* Is the last arg an interval value? Or a guid? */
	if (argc >= 1 && !are_vdevs_in_pool(1, &argv[argc - 1], NULL, cb)) {
	/*
	* The last arg is not a guid, so it's probably an
	* interval value.
	*/
	argc_for_interval++;

	if (*argc >= 2 &&
	!are_vdevs_in_pool(1, &argv[*argc - 2], NULL, cb)) {
	/*
	* The 2nd to last arg is not a guid, so it's probably
	* an interval value.
	*/
	argc_for_interval++;
	}
	}

	/* Point to our list of possible intervals */
	tmpargv = &argv[*argc - argc_for_interval];

	argc = argc - argc_for_interval;
	get_interval_count(&argc_for_interval, tmpargv,
	interval, count);
	}

	/*
	* Floating point sleep(). Allows you to pass in a floating point value for
	* seconds.
	*/
	static void
	fsleep(float sec)
	{
	struct timespec req;
	req.tv_sec = floor(sec);
	req.tv_nsec = (sec - (float)req.tv_sec) * NANOSEC;
	nanosleep(&req, NULL);
	}

	/*
	* Terminal height, in rows. Returns -1 if stdout is not connected to a TTY or
	* if we were unable to determine its size.
	*/
	static int
	terminal_height(void)
	{
	struct winsize win;

	if (isatty(STDOUT_FILENO) == 0)
	return (-1);

	if (ioctl(STDOUT_FILENO, TIOCGWINSZ, &win) != -1 && win.ws_row > 0)
	return (win.ws_row);

	return (-1);
	}

	/*
	* Run one of the zpool status/iostat -c scripts with the help (-h) option and
	* print the result.
	*
	* name: Short name of the script ('iostat').
	* path: Full path to the script ('/usr/local/etc/zfs/zpool.d/iostat');
	*/
	static void
	print_zpool_script_help(char name, char path)
	{
	char *argv[] = {path, "-h", NULL};
	char **lines = NULL;
	int lines_cnt = 0;
	int rc;

	rc = libzfs_run_process_get_stdout_nopath(path, argv, NULL, &lines,
	&lines_cnt);
	if (rc != 0 \|\| lines == NULL \|\| lines_cnt <= 0) {
	if (lines != NULL)
	libzfs_free_str_array(lines, lines_cnt);
	return;
	}

	for (int i = 0; i < lines_cnt; i++)
	if (!is_blank_str(lines[i]))
	printf(" %-14s %s\n", name, lines[i]);

	libzfs_free_str_array(lines, lines_cnt);
	}

	/*
	* Go though the zpool status/iostat -c scripts in the user's path, run their
	* help option (-h), and print out the results.
	*/
	static void
	print_zpool_dir_scripts(char *dirpath)
	{
	DIR *dir;
	struct dirent *ent;
	char fullpath[MAXPATHLEN];
	struct stat dir_stat;

	if ((dir = opendir(dirpath)) != NULL) {
	/* print all the files and directories within directory */
	while ((ent = readdir(dir)) != NULL) {
	sprintf(fullpath, "%s/%s", dirpath, ent->d_name);

	/* Print the scripts */
	if (stat(fullpath, &dir_stat) == 0)
	if (dir_stat.st_mode & S_IXUSR &&
	S_ISREG(dir_stat.st_mode))
	print_zpool_script_help(ent->d_name,
	fullpath);
	}
	closedir(dir);
	}
	}

	/*
	* Print out help text for all zpool status/iostat -c scripts.
	*/
	static void
	print_zpool_script_list(char *subcommand)
	{
	char dir, sp;

	printf(gettext("Available 'zpool %s -c' commands:\n"), subcommand);

	sp = zpool_get_cmd_search_path();
	if (sp == NULL)
	return;

	dir = strtok(sp, ":");
	while (dir != NULL) {
	print_zpool_dir_scripts(dir);
	dir = strtok(NULL, ":");
	}

	free(sp);
	}

	/*
	* Set the minimum pool/vdev name column width. The width must be at least 10,
	* but may be as large as the column width - 42 so it still fits on one line.
	* NOTE: 42 is the width of the default capacity/operations/bandwidth output
	*/
	static int
	get_namewidth_iostat(zpool_handle_t zhp, void data)
	{
	iostat_cbdata_t *cb = data;
	int width, available_width;

	/*
	* get_namewidth() returns the maximum width of any name in that column
	* for any pool/vdev/device line that will be output.
	*/
	width = get_namewidth(zhp, cb->cb_namewidth, cb->cb_name_flags,
	cb->cb_verbose);

	/*
	* The width we are calculating is the width of the header and also the
	* padding width for names that are less than maximum width. The stats
	* take up 42 characters, so the width available for names is:
	*/
	available_width = get_columns() - 42;

	/*
	* If the maximum width fits on a screen, then great! Make everything
	* line up by justifying all lines to the same width. If that max
	* width is larger than what's available, the name plus stats won't fit
	* on one line, and justifying to that width would cause every line to
	* wrap on the screen. We only want lines with long names to wrap.
	* Limit the padding to what won't wrap.
	*/
	if (width > available_width)
	width = available_width;

	/*
	* And regardless of whatever the screen width is (get_columns can
	* return 0 if the width is not known or less than 42 for a narrow
	* terminal) have the width be a minimum of 10.
	*/
	if (width < 10)
	width = 10;

	/* Save the calculated width */
	cb->cb_namewidth = width;

	return (0);
	}

	/*
	* zpool iostat [[-c [script1,script2,...]] [-lq]\|[-rw]] [-ghHLpPvy] [-n name]
	* [-T d\|u] [[ pool ...]\|[pool vdev ...]\|[vdev ...]]
	* [interval [count]]
	*
	* -c CMD For each vdev, run command CMD
	* -g Display guid for individual vdev name.
	* -L Follow links when resolving vdev path name.
	* -P Display full path for vdev name.
	* -v Display statistics for individual vdevs
	* -h Display help
	* -p Display values in parsable (exact) format.
	* -H Scripted mode. Don't display headers, and separate properties
	* by a single tab.
	* -l Display average latency
	* -q Display queue depths
	* -w Display latency histograms
	* -r Display request size histogram
	* -T Display a timestamp in date(1) or Unix format
	* -n Only print headers once
	*
	* This command can be tricky because we want to be able to deal with pool
	* creation/destruction as well as vdev configuration changes. The bulk of this
	* processing is handled by the pool_list_* routines in zpool_iter.c. We rely
	* on pool_list_update() to detect the addition of new pools. Configuration
	* changes are all handled within libzfs.
	*/
	int
	zpool_do_iostat(int argc, char **argv)
	{
	int c;
	int ret;
	int npools;
	float interval = 0;
	unsigned long count = 0;
	int winheight = 24;
	zpool_list_t *list;
	boolean_t verbose = B_FALSE;
	boolean_t latency = B_FALSE, l_histo = B_FALSE, rq_histo = B_FALSE;
	boolean_t queues = B_FALSE, parsable = B_FALSE, scripted = B_FALSE;
	boolean_t omit_since_boot = B_FALSE;
	boolean_t guid = B_FALSE;
	boolean_t follow_links = B_FALSE;
	boolean_t full_name = B_FALSE;
	boolean_t headers_once = B_FALSE;
	iostat_cbdata_t cb = { 0 };
	char *cmd = NULL;

	/* Used for printing error message */
	const char flag_to_arg[] = {[IOS_LATENCY] = 'l', [IOS_QUEUES] = 'q',
	[IOS_L_HISTO] = 'w', [IOS_RQ_HISTO] = 'r'};

	uint64_t unsupported_flags;

	/* check options */
	while ((c = getopt(argc, argv, "c:gLPT:vyhplqrwnH")) != -1) {
	switch (c) {
	case 'c':
	if (cmd != NULL) {
	fprintf(stderr,
	gettext("Can't set -c flag twice\n"));
	exit(1);
	}

	if (getenv("ZPOOL_SCRIPTS_ENABLED") != NULL &&
	!libzfs_envvar_is_set("ZPOOL_SCRIPTS_ENABLED")) {
	fprintf(stderr, gettext(
	"Can't run -c, disabled by "
	"ZPOOL_SCRIPTS_ENABLED.\n"));
	exit(1);
	}

	if ((getuid() <= 0 \|\| geteuid() <= 0) &&
	!libzfs_envvar_is_set("ZPOOL_SCRIPTS_AS_ROOT")) {
	fprintf(stderr, gettext(
	"Can't run -c with root privileges "
	"unless ZPOOL_SCRIPTS_AS_ROOT is set.\n"));
	exit(1);
	}
	cmd = optarg;
	verbose = B_TRUE;
	break;
	case 'g':
	guid = B_TRUE;
	break;
	case 'L':
	follow_links = B_TRUE;
	break;
	case 'P':
	full_name = B_TRUE;
	break;
	case 'T':
	get_timestamp_arg(*optarg);
	break;
	case 'v':
	verbose = B_TRUE;
	break;
	case 'p':
	parsable = B_TRUE;
	break;
	case 'l':
	latency = B_TRUE;
	break;
	case 'q':
	queues = B_TRUE;
	break;
	case 'H':
	scripted = B_TRUE;
	break;
	case 'w':
	l_histo = B_TRUE;
	break;
	case 'r':
	rq_histo = B_TRUE;
	break;
	case 'y':
	omit_since_boot = B_TRUE;
	break;
	case 'n':
	headers_once = B_TRUE;
	break;
	case 'h':
	usage(B_FALSE);
	break;
	case '?':
	if (optopt == 'c') {
	print_zpool_script_list("iostat");
	exit(0);
	} else {
	fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	}
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	cb.cb_literal = parsable;
	cb.cb_scripted = scripted;

	if (guid)
	cb.cb_name_flags \|= VDEV_NAME_GUID;
	if (follow_links)
	cb.cb_name_flags \|= VDEV_NAME_FOLLOW_LINKS;
	if (full_name)
	cb.cb_name_flags \|= VDEV_NAME_PATH;
	cb.cb_iteration = 0;
	cb.cb_namewidth = 0;
	cb.cb_verbose = verbose;

	/* Get our interval and count values (if any) */
	if (guid) {
	get_interval_count_filter_guids(&argc, argv, &interval,
	&count, &cb);
	} else {
	get_interval_count(&argc, argv, &interval, &count);
	}

	if (argc == 0) {
	/* No args, so just print the defaults. */
	} else if (are_all_pools(argc, argv)) {
	/* All the args are pool names */
	} else if (are_vdevs_in_pool(argc, argv, NULL, &cb)) {
	/* All the args are vdevs */
	cb.cb_vdev_names = argv;
	cb.cb_vdev_names_count = argc;
	argc = 0; /* No pools to process */
	} else if (are_all_pools(1, argv)) {
	/* The first arg is a pool name */
	if (are_vdevs_in_pool(argc - 1, argv + 1, argv[0], &cb)) {
	/* ...and the rest are vdev names */
	cb.cb_vdev_names = argv + 1;
	cb.cb_vdev_names_count = argc - 1;
	argc = 1; /* One pool to process */
	} else {
	fprintf(stderr, gettext("Expected either a list of "));
	fprintf(stderr, gettext("pools, or list of vdevs in"));
	fprintf(stderr, " \"%s\", ", argv[0]);
	fprintf(stderr, gettext("but got:\n"));
	error_list_unresolved_vdevs(argc - 1, argv + 1,
	argv[0], &cb);
	fprintf(stderr, "\n");
	usage(B_FALSE);
	return (1);
	}
	} else {
	/*
	* The args don't make sense. The first arg isn't a pool name,
	* nor are all the args vdevs.
	*/
	fprintf(stderr, gettext("Unable to parse pools/vdevs list.\n"));
	fprintf(stderr, "\n");
	return (1);
	}

	if (cb.cb_vdev_names_count != 0) {
	/*
	* If user specified vdevs, it implies verbose.
	*/
	cb.cb_verbose = B_TRUE;
	}

	/*
	* Construct the list of all interesting pools.
	*/
	ret = 0;
	if ((list = pool_list_get(argc, argv, NULL, &ret)) == NULL)
	return (1);

	if (pool_list_count(list) == 0 && argc != 0) {
	pool_list_free(list);
	return (1);
	}

	if (pool_list_count(list) == 0 && interval == 0) {
	pool_list_free(list);
	(void) fprintf(stderr, gettext("no pools available\n"));
	return (1);
	}

	if ((l_histo \|\| rq_histo) && (cmd != NULL \|\| latency \|\| queues)) {
	pool_list_free(list);
	(void) fprintf(stderr,
	gettext("[-r\|-w] isn't allowed with [-c\|-l\|-q]\n"));
	usage(B_FALSE);
	return (1);
	}

	if (l_histo && rq_histo) {
	pool_list_free(list);
	(void) fprintf(stderr,
	gettext("Only one of [-r\|-w] can be passed at a time\n"));
	usage(B_FALSE);
	return (1);
	}

	/*
	* Enter the main iostat loop.
	*/
	cb.cb_list = list;

	if (l_histo) {
	/*
	* Histograms tables look out of place when you try to display
	* them with the other stats, so make a rule that you can only
	* print histograms by themselves.
	*/
	cb.cb_flags = IOS_L_HISTO_M;
	} else if (rq_histo) {
	cb.cb_flags = IOS_RQ_HISTO_M;
	} else {
	cb.cb_flags = IOS_DEFAULT_M;
	if (latency)
	cb.cb_flags \|= IOS_LATENCY_M;
	if (queues)
	cb.cb_flags \|= IOS_QUEUES_M;
	}

	/*
	* See if the module supports all the stats we want to display.
	*/
	unsupported_flags = cb.cb_flags & ~get_stat_flags(list);
	if (unsupported_flags) {
	uint64_t f;
	int idx;
	fprintf(stderr,
	gettext("The loaded zfs module doesn't support:"));

	/* for each bit set in unsupported_flags */
	for (f = unsupported_flags; f; f &= ~(1ULL << idx)) {
	idx = lowbit64(f) - 1;
	fprintf(stderr, " -%c", flag_to_arg[idx]);
	}

	fprintf(stderr, ". Try running a newer module.\n");
	pool_list_free(list);

	return (1);
	}

	for (;;) {
	if ((npools = pool_list_count(list)) == 0)
	(void) fprintf(stderr, gettext("no pools available\n"));
	else {
	/*
	* If this is the first iteration and -y was supplied
	* we skip any printing.
	*/
	boolean_t skip = (omit_since_boot &&
	cb.cb_iteration == 0);

	/*
	* Refresh all statistics. This is done as an
	* explicit step before calculating the maximum name
	* width, so that any * configuration changes are
	* properly accounted for.
	*/
	(void) pool_list_iter(list, B_FALSE, refresh_iostat,
	&cb);

	/*
	* Iterate over all pools to determine the maximum width
	* for the pool / device name column across all pools.
	*/
	cb.cb_namewidth = 0;
	(void) pool_list_iter(list, B_FALSE,
	get_namewidth_iostat, &cb);

	if (timestamp_fmt != NODATE)
	print_timestamp(timestamp_fmt);

	if (cmd != NULL && cb.cb_verbose &&
	!(cb.cb_flags & IOS_ANYHISTO_M)) {
	cb.vcdl = all_pools_for_each_vdev_run(argc,
	argv, cmd, g_zfs, cb.cb_vdev_names,
	cb.cb_vdev_names_count, cb.cb_name_flags);
	} else {
	cb.vcdl = NULL;
	}


	/*
	* Check terminal size so we can print headers
	* even when terminal window has its height
	* changed.
	*/
	winheight = terminal_height();
	/*
	* Are we connected to TTY? If not, headers_once
	* should be true, to avoid breaking scripts.
	*/
	if (winheight < 0)
	headers_once = B_TRUE;

	/*
	* If it's the first time and we're not skipping it,
	* or either skip or verbose mode, print the header.
	*
	* The histogram code explicitly prints its header on
	* every vdev, so skip this for histograms.
	*/
	if (((++cb.cb_iteration == 1 && !skip) \|\|
	(skip != verbose) \|\|
	(!headers_once &&
	(cb.cb_iteration % winheight) == 0)) &&
	(!(cb.cb_flags & IOS_ANYHISTO_M)) &&
	!cb.cb_scripted)
	print_iostat_header(&cb);

	if (skip) {
	(void) fsleep(interval);
	continue;
	}

	pool_list_iter(list, B_FALSE, print_iostat, &cb);

	/*
	* If there's more than one pool, and we're not in
	* verbose mode (which prints a separator for us),
	* then print a separator.
	*
	* In addition, if we're printing specific vdevs then
	* we also want an ending separator.
	*/
	if (((npools > 1 && !verbose &&
	!(cb.cb_flags & IOS_ANYHISTO_M)) \|\|
	(!(cb.cb_flags & IOS_ANYHISTO_M) &&
	cb.cb_vdev_names_count)) &&
	!cb.cb_scripted) {
	print_iostat_separator(&cb);
	if (cb.vcdl != NULL)
	print_cmd_columns(cb.vcdl, 1);
	printf("\n");
	}

	if (cb.vcdl != NULL)
	free_vdev_cmd_data_list(cb.vcdl);

	}

	/*
	* Flush the output so that redirection to a file isn't buffered
	* indefinitely.
	*/
	(void) fflush(stdout);

	if (interval == 0)
	break;

	if (count != 0 && --count == 0)
	break;

	(void) fsleep(interval);
	}

	pool_list_free(list);

	return (ret);
	}

	typedef struct list_cbdata {
	boolean_t cb_verbose;
	int cb_name_flags;
	int cb_namewidth;
	boolean_t cb_scripted;
	zprop_list_t *cb_proplist;
	boolean_t cb_literal;
	} list_cbdata_t;


	/*
	* Given a list of columns to display, output appropriate headers for each one.
	*/
	static void
	print_header(list_cbdata_t *cb)
	{
	zprop_list_t *pl = cb->cb_proplist;
	char headerbuf[ZPOOL_MAXPROPLEN];
	const char *header;
	boolean_t first = B_TRUE;
	boolean_t right_justify;
	size_t width = 0;

	for (; pl != NULL; pl = pl->pl_next) {
	width = pl->pl_width;
	if (first && cb->cb_verbose) {
	/*
	* Reset the width to accommodate the verbose listing
	* of devices.
	*/
	width = cb->cb_namewidth;
	}

	if (!first)
	(void) printf(" ");
	else
	first = B_FALSE;

	right_justify = B_FALSE;
	if (pl->pl_prop != ZPROP_INVAL) {
	header = zpool_prop_column_name(pl->pl_prop);
	right_justify = zpool_prop_align_right(pl->pl_prop);
	} else {
	int i;

	for (i = 0; pl->pl_user_prop[i] != '\0'; i++)
	headerbuf[i] = toupper(pl->pl_user_prop[i]);
	headerbuf[i] = '\0';
	header = headerbuf;
	}

	if (pl->pl_next == NULL && !right_justify)
	(void) printf("%s", header);
	else if (right_justify)
	(void) printf("%*s", (int)width, header);
	else
	(void) printf("%-*s", (int)width, header);
	}

	(void) printf("\n");
	}

	/*
	* Given a pool and a list of properties, print out all the properties according
	* to the described layout. Used by zpool_do_list().
	*/
	static void
	print_pool(zpool_handle_t zhp, list_cbdata_t cb)
	{
	zprop_list_t *pl = cb->cb_proplist;
	boolean_t first = B_TRUE;
	char property[ZPOOL_MAXPROPLEN];
	char *propstr;
	boolean_t right_justify;
	size_t width;

	for (; pl != NULL; pl = pl->pl_next) {

	width = pl->pl_width;
	if (first && cb->cb_verbose) {
	/*
	* Reset the width to accommodate the verbose listing
	* of devices.
	*/
	width = cb->cb_namewidth;
	}

	if (!first) {
	if (cb->cb_scripted)
	(void) printf("\t");
	else
	(void) printf(" ");
	} else {
	first = B_FALSE;
	}

	right_justify = B_FALSE;
	if (pl->pl_prop != ZPROP_INVAL) {
	if (zpool_get_prop(zhp, pl->pl_prop, property,
	sizeof (property), NULL, cb->cb_literal) != 0)
	propstr = "-";
	else
	propstr = property;

	right_justify = zpool_prop_align_right(pl->pl_prop);
	} else if ((zpool_prop_feature(pl->pl_user_prop) \|\|
	zpool_prop_unsupported(pl->pl_user_prop)) &&
	zpool_prop_get_feature(zhp, pl->pl_user_prop, property,
	sizeof (property)) == 0) {
	propstr = property;
	} else {
	propstr = "-";
	}


	/*
	* If this is being called in scripted mode, or if this is the
	* last column and it is left-justified, don't include a width
	* format specifier.
	*/
	if (cb->cb_scripted \|\| (pl->pl_next == NULL && !right_justify))
	(void) printf("%s", propstr);
	else if (right_justify)
	(void) printf("%*s", (int)width, propstr);
	else
	(void) printf("%-*s", (int)width, propstr);
	}

	(void) printf("\n");
	}

	static void
	print_one_column(zpool_prop_t prop, uint64_t value, const char *str,
	boolean_t scripted, boolean_t valid, enum zfs_nicenum_format format)
	{
	char propval[64];
	boolean_t fixed;
	size_t width = zprop_width(prop, &fixed, ZFS_TYPE_POOL);

	switch (prop) {
	case ZPOOL_PROP_EXPANDSZ:
	case ZPOOL_PROP_CHECKPOINT:
	case ZPOOL_PROP_DEDUPRATIO:
	if (value == 0)
	(void) strlcpy(propval, "-", sizeof (propval));
	else
	zfs_nicenum_format(value, propval, sizeof (propval),
	format);
	break;
	case ZPOOL_PROP_FRAGMENTATION:
	if (value == ZFS_FRAG_INVALID) {
	(void) strlcpy(propval, "-", sizeof (propval));
	} else if (format == ZFS_NICENUM_RAW) {
	(void) snprintf(propval, sizeof (propval), "%llu",
	(unsigned long long)value);
	} else {
	(void) snprintf(propval, sizeof (propval), "%llu%%",
	(unsigned long long)value);
	}
	break;
	case ZPOOL_PROP_CAPACITY:
	/* capacity value is in parts-per-10,000 (aka permyriad) */
	if (format == ZFS_NICENUM_RAW)
	(void) snprintf(propval, sizeof (propval), "%llu",
	(unsigned long long)value / 100);
	else
	(void) snprintf(propval, sizeof (propval),
	value < 1000 ? "%1.2f%%" : value < 10000 ?
	"%2.1f%%" : "%3.0f%%", value / 100.0);
	break;
	case ZPOOL_PROP_HEALTH:
	width = 8;
	snprintf(propval, sizeof (propval), "%-*s", (int)width, str);
	break;
	default:
	zfs_nicenum_format(value, propval, sizeof (propval), format);
	}

	if (!valid)
	(void) strlcpy(propval, "-", sizeof (propval));

	if (scripted)
	(void) printf("\t%s", propval);
	else
	(void) printf(" %*s", (int)width, propval);
	}

	/*
	* print static default line per vdev
	* not compatible with '-o' <proplist> option
	*/
	static void
	print_list_stats(zpool_handle_t zhp, const char name, nvlist_t *nv,
	list_cbdata_t *cb, int depth, boolean_t isspare)
	{
	nvlist_t **child;
	vdev_stat_t *vs;
	uint_t c, children;
	char *vname;
	boolean_t scripted = cb->cb_scripted;
	uint64_t islog = B_FALSE;
	char dashes = "%-s - - - - "
	"- - - - -\n";

	verify(nvlist_lookup_uint64_array(nv, ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t **)&vs, &c) == 0);

	if (name != NULL) {
	boolean_t toplevel = (vs->vs_space != 0);
	uint64_t cap;
	enum zfs_nicenum_format format;
	const char *state;

	if (cb->cb_literal)
	format = ZFS_NICENUM_RAW;
	else
	format = ZFS_NICENUM_1024;

	if (strcmp(name, VDEV_TYPE_INDIRECT) == 0)
	return;

	if (scripted)
	(void) printf("\t%s", name);
	else if (strlen(name) + depth > cb->cb_namewidth)
	(void) printf("%*s%s", depth, "", name);
	else
	(void) printf("%s%s%s", depth, "", name,
	(int)(cb->cb_namewidth - strlen(name) - depth), "");

	/*
	* Print the properties for the individual vdevs. Some
	* properties are only applicable to toplevel vdevs. The
	* 'toplevel' boolean value is passed to the print_one_column()
	* to indicate that the value is valid.
	*/
	print_one_column(ZPOOL_PROP_SIZE, vs->vs_space, NULL, scripted,
	toplevel, format);
	print_one_column(ZPOOL_PROP_ALLOCATED, vs->vs_alloc, NULL,
	scripted, toplevel, format);
	print_one_column(ZPOOL_PROP_FREE, vs->vs_space - vs->vs_alloc,
	NULL, scripted, toplevel, format);
	print_one_column(ZPOOL_PROP_CHECKPOINT,
	vs->vs_checkpoint_space, NULL, scripted, toplevel, format);
	print_one_column(ZPOOL_PROP_EXPANDSZ, vs->vs_esize, NULL,
	scripted, B_TRUE, format);
	print_one_column(ZPOOL_PROP_FRAGMENTATION,
	vs->vs_fragmentation, NULL, scripted,
	(vs->vs_fragmentation != ZFS_FRAG_INVALID && toplevel),
	format);
	cap = (vs->vs_space == 0) ? 0 :
	(vs->vs_alloc * 10000 / vs->vs_space);
	print_one_column(ZPOOL_PROP_CAPACITY, cap, NULL,
	scripted, toplevel, format);
	print_one_column(ZPOOL_PROP_DEDUPRATIO, 0, NULL,
	scripted, toplevel, format);
	state = zpool_state_to_name(vs->vs_state, vs->vs_aux);
	if (isspare) {
	if (vs->vs_aux == VDEV_AUX_SPARED)
	state = "INUSE";
	else if (vs->vs_state == VDEV_STATE_HEALTHY)
	state = "AVAIL";
	}
	print_one_column(ZPOOL_PROP_HEALTH, 0, state, scripted,
	B_TRUE, format);
	(void) printf("\n");
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	return;

	/* list the normal vdevs first */
	for (c = 0; c < children; c++) {
	uint64_t ishole = B_FALSE;

	if (nvlist_lookup_uint64(child[c],
	ZPOOL_CONFIG_IS_HOLE, &ishole) == 0 && ishole)
	continue;

	if (nvlist_lookup_uint64(child[c],
	ZPOOL_CONFIG_IS_LOG, &islog) == 0 && islog)
	continue;

	if (nvlist_exists(child[c], ZPOOL_CONFIG_ALLOCATION_BIAS))
	continue;

	vname = zpool_vdev_name(g_zfs, zhp, child[c],
	cb->cb_name_flags);
	print_list_stats(zhp, vname, child[c], cb, depth + 2, B_FALSE);
	free(vname);
	}

	/* list the classes: 'logs', 'dedup', and 'special' */
	for (uint_t n = 0; n < 3; n++) {
	boolean_t printed = B_FALSE;

	for (c = 0; c < children; c++) {
	char *bias = NULL;
	char *type = NULL;

	if (nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_LOG,
	&islog) == 0 && islog) {
	bias = VDEV_ALLOC_CLASS_LOGS;
	} else {
	(void) nvlist_lookup_string(child[c],
	ZPOOL_CONFIG_ALLOCATION_BIAS, &bias);
	(void) nvlist_lookup_string(child[c],
	ZPOOL_CONFIG_TYPE, &type);
	}
	if (bias == NULL \|\| strcmp(bias, class_name[n]) != 0)
	continue;
	if (!islog && strcmp(type, VDEV_TYPE_INDIRECT) == 0)
	continue;

	if (!printed) {
	/* LINTED E_SEC_PRINTF_VAR_FMT */
	(void) printf(dashes, cb->cb_namewidth,
	class_name[n]);
	printed = B_TRUE;
	}
	vname = zpool_vdev_name(g_zfs, zhp, child[c],
	cb->cb_name_flags);
	print_list_stats(zhp, vname, child[c], cb, depth + 2,
	B_FALSE);
	free(vname);
	}
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_L2CACHE,
	&child, &children) == 0 && children > 0) {
	/* LINTED E_SEC_PRINTF_VAR_FMT */
	(void) printf(dashes, cb->cb_namewidth, "cache");
	for (c = 0; c < children; c++) {
	vname = zpool_vdev_name(g_zfs, zhp, child[c],
	cb->cb_name_flags);
	print_list_stats(zhp, vname, child[c], cb, depth + 2,
	B_FALSE);
	free(vname);
	}
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_SPARES, &child,
	&children) == 0 && children > 0) {
	/* LINTED E_SEC_PRINTF_VAR_FMT */
	(void) printf(dashes, cb->cb_namewidth, "spare");
	for (c = 0; c < children; c++) {
	vname = zpool_vdev_name(g_zfs, zhp, child[c],
	cb->cb_name_flags);
	print_list_stats(zhp, vname, child[c], cb, depth + 2,
	B_TRUE);
	free(vname);
	}
	}
	}

	/*
	* Generic callback function to list a pool.
	*/
	static int
	list_callback(zpool_handle_t zhp, void data)
	{
	list_cbdata_t *cbp = data;

	print_pool(zhp, cbp);

	if (cbp->cb_verbose) {
	nvlist_t config, nvroot;

	config = zpool_get_config(zhp, NULL);
	verify(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
	&nvroot) == 0);
	print_list_stats(zhp, NULL, nvroot, cbp, 0, B_FALSE);
	}

	return (0);
	}

	/*
	* Set the minimum pool/vdev name column width. The width must be at least 9,
	* but may be as large as needed.
	*/
	static int
	get_namewidth_list(zpool_handle_t zhp, void data)
	{
	list_cbdata_t *cb = data;
	int width;

	width = get_namewidth(zhp, cb->cb_namewidth, cb->cb_name_flags,
	cb->cb_verbose);

	if (width < 9)
	width = 9;

	cb->cb_namewidth = width;

	return (0);
	}

	/*
	* zpool list [-gHLpP] [-o prop[,prop]*] [-T d\|u] [pool] ... [interval [count]]
	*
	* -g Display guid for individual vdev name.
	* -H Scripted mode. Don't display headers, and separate properties
	* by a single tab.
	* -L Follow links when resolving vdev path name.
	* -o List of properties to display. Defaults to
	* "name,size,allocated,free,expandsize,fragmentation,capacity,"
	* "dedupratio,health,altroot"
	* -p Display values in parsable (exact) format.
	* -P Display full path for vdev name.
	* -T Display a timestamp in date(1) or Unix format
	*
	* List all pools in the system, whether or not they're healthy. Output space
	* statistics for each one, as well as health status summary.
	*/
	int
	zpool_do_list(int argc, char **argv)
	{
	int c;
	int ret = 0;
	list_cbdata_t cb = { 0 };
	static char default_props[] =
	"name,size,allocated,free,checkpoint,expandsize,fragmentation,"
	"capacity,dedupratio,health,altroot";
	char *props = default_props;
	float interval = 0;
	unsigned long count = 0;
	zpool_list_t *list;
	boolean_t first = B_TRUE;

	/* check options */
	while ((c = getopt(argc, argv, ":gHLo:pPT:v")) != -1) {
	switch (c) {
	case 'g':
	cb.cb_name_flags \|= VDEV_NAME_GUID;
	break;
	case 'H':
	cb.cb_scripted = B_TRUE;
	break;
	case 'L':
	cb.cb_name_flags \|= VDEV_NAME_FOLLOW_LINKS;
	break;
	case 'o':
	props = optarg;
	break;
	case 'P':
	cb.cb_name_flags \|= VDEV_NAME_PATH;
	break;
	case 'p':
	cb.cb_literal = B_TRUE;
	break;
	case 'T':
	get_timestamp_arg(*optarg);
	break;
	case 'v':
	cb.cb_verbose = B_TRUE;
	cb.cb_namewidth = 8; /* 8 until precalc is avail */
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	get_interval_count(&argc, argv, &interval, &count);

	if (zprop_get_list(g_zfs, props, &cb.cb_proplist, ZFS_TYPE_POOL) != 0)
	usage(B_FALSE);

	for (;;) {
	if ((list = pool_list_get(argc, argv, &cb.cb_proplist,
	&ret)) == NULL)
	return (1);

	if (pool_list_count(list) == 0)
	break;

	cb.cb_namewidth = 0;
	(void) pool_list_iter(list, B_FALSE, get_namewidth_list, &cb);

	if (timestamp_fmt != NODATE)
	print_timestamp(timestamp_fmt);

	if (!cb.cb_scripted && (first \|\| cb.cb_verbose)) {
	print_header(&cb);
	first = B_FALSE;
	}
	ret = pool_list_iter(list, B_TRUE, list_callback, &cb);

	if (interval == 0)
	break;

	if (count != 0 && --count == 0)
	break;

	pool_list_free(list);
	(void) fsleep(interval);
	}

	if (argc == 0 && !cb.cb_scripted && pool_list_count(list) == 0) {
	(void) printf(gettext("no pools available\n"));
	ret = 0;
	}

	pool_list_free(list);
	zprop_free_list(cb.cb_proplist);
	return (ret);
	}

	static int
	zpool_do_attach_or_replace(int argc, char **argv, int replacing)
	{
	boolean_t force = B_FALSE;
	boolean_t rebuild = B_FALSE;
	boolean_t wait = B_FALSE;
	int c;
	nvlist_t *nvroot;
	char poolname, old_disk, *new_disk;
	zpool_handle_t *zhp;
	nvlist_t *props = NULL;
	char *propval;
	int ret;

	/* check options */
	while ((c = getopt(argc, argv, "fo:sw")) != -1) {
	switch (c) {
	case 'f':
	force = B_TRUE;
	break;
	case 'o':
	if ((propval = strchr(optarg, '=')) == NULL) {
	(void) fprintf(stderr, gettext("missing "
	"'=' for -o option\n"));
	usage(B_FALSE);
	}
	*propval = '\0';
	propval++;

	if ((strcmp(optarg, ZPOOL_CONFIG_ASHIFT) != 0) \|\|
	(add_prop_list(optarg, propval, &props, B_TRUE)))
	usage(B_FALSE);
	break;
	case 's':
	rebuild = B_TRUE;
	break;
	case 'w':
	wait = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* get pool name and check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	usage(B_FALSE);
	}

	poolname = argv[0];

	if (argc < 2) {
	(void) fprintf(stderr,
	gettext("missing <device> specification\n"));
	usage(B_FALSE);
	}

	old_disk = argv[1];

	if (argc < 3) {
	if (!replacing) {
	(void) fprintf(stderr,
	gettext("missing <new_device> specification\n"));
	usage(B_FALSE);
	}
	new_disk = old_disk;
	argc -= 1;
	argv += 1;
	} else {
	new_disk = argv[2];
	argc -= 2;
	argv += 2;
	}

	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	if ((zhp = zpool_open(g_zfs, poolname)) == NULL) {
	nvlist_free(props);
	return (1);
	}

	if (zpool_get_config(zhp, NULL) == NULL) {
	(void) fprintf(stderr, gettext("pool '%s' is unavailable\n"),
	poolname);
	zpool_close(zhp);
	nvlist_free(props);
	return (1);
	}

	/* unless manually specified use "ashift" pool property (if set) */
	if (!nvlist_exists(props, ZPOOL_CONFIG_ASHIFT)) {
	int intval;
	zprop_source_t src;
	char strval[ZPOOL_MAXPROPLEN];

	intval = zpool_get_prop_int(zhp, ZPOOL_PROP_ASHIFT, &src);
	if (src != ZPROP_SRC_DEFAULT) {
	(void) sprintf(strval, "%" PRId32, intval);
	verify(add_prop_list(ZPOOL_CONFIG_ASHIFT, strval,
	&props, B_TRUE) == 0);
	}
	}

	nvroot = make_root_vdev(zhp, props, force, B_FALSE, replacing, B_FALSE,
	argc, argv);
	if (nvroot == NULL) {
	zpool_close(zhp);
	nvlist_free(props);
	return (1);
	}

	ret = zpool_vdev_attach(zhp, old_disk, new_disk, nvroot, replacing,
	rebuild);

	if (ret == 0 && wait)
	ret = zpool_wait(zhp,
	replacing ? ZPOOL_WAIT_REPLACE : ZPOOL_WAIT_RESILVER);

	nvlist_free(props);
	nvlist_free(nvroot);
	zpool_close(zhp);

	return (ret);
	}

	/*
	* zpool replace [-fsw] [-o property=value] <pool> <device> <new_device>
	*
	* -f Force attach, even if <new_device> appears to be in use.
	* -s Use sequential instead of healing reconstruction for resilver.
	* -o Set property=value.
	* -w Wait for replacing to complete before returning
	*
	* Replace <device> with <new_device>.
	*/
	/* ARGSUSED */
	int
	zpool_do_replace(int argc, char **argv)
	{
	return (zpool_do_attach_or_replace(argc, argv, B_TRUE));
	}

	/*
	* zpool attach [-fsw] [-o property=value] <pool> <device> <new_device>
	*
	* -f Force attach, even if <new_device> appears to be in use.
	* -s Use sequential instead of healing reconstruction for resilver.
	* -o Set property=value.
	* -w Wait for resilvering to complete before returning
	*
	* Attach <new_device> to the mirror containing <device>. If <device> is not
	* part of a mirror, then <device> will be transformed into a mirror of
	* <device> and <new_device>. In either case, <new_device> will begin life
	* with a DTL of [0, now], and will immediately begin to resilver itself.
	*/
	int
	zpool_do_attach(int argc, char **argv)
	{
	return (zpool_do_attach_or_replace(argc, argv, B_FALSE));
	}

	/*
	* zpool detach [-f] <pool> <device>
	*
	* -f Force detach of <device>, even if DTLs argue against it
	* (not supported yet)
	*
	* Detach a device from a mirror. The operation will be refused if <device>
	* is the last device in the mirror, or if the DTLs indicate that this device
	* has the only valid copy of some data.
	*/
	/* ARGSUSED */
	int
	zpool_do_detach(int argc, char **argv)
	{
	int c;
	char poolname, path;
	zpool_handle_t *zhp;
	int ret;

	/* check options */
	while ((c = getopt(argc, argv, "")) != -1) {
	switch (c) {
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* get pool name and check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	usage(B_FALSE);
	}

	if (argc < 2) {
	(void) fprintf(stderr,
	gettext("missing <device> specification\n"));
	usage(B_FALSE);
	}

	poolname = argv[0];
	path = argv[1];

	if ((zhp = zpool_open(g_zfs, poolname)) == NULL)
	return (1);

	ret = zpool_vdev_detach(zhp, path);

	zpool_close(zhp);

	return (ret);
	}

	/*
	* zpool split [-gLnP] [-o prop=val] ...
	* [-o mntopt] ...
	* [-R altroot] <pool> <newpool> [<device> ...]
	*
	* -g Display guid for individual vdev name.
	* -L Follow links when resolving vdev path name.
	* -n Do not split the pool, but display the resulting layout if
	* it were to be split.
	* -o Set property=value, or set mount options.
	* -P Display full path for vdev name.
	* -R Mount the split-off pool under an alternate root.
	* -l Load encryption keys while importing.
	*
	* Splits the named pool and gives it the new pool name. Devices to be split
	* off may be listed, provided that no more than one device is specified
	* per top-level vdev mirror. The newly split pool is left in an exported
	* state unless -R is specified.
	*
	* Restrictions: the top-level of the pool pool must only be made up of
	* mirrors; all devices in the pool must be healthy; no device may be
	* undergoing a resilvering operation.
	*/
	int
	zpool_do_split(int argc, char **argv)
	{
	char srcpool, newpool, *propval;
	char *mntopts = NULL;
	splitflags_t flags;
	int c, ret = 0;
	boolean_t loadkeys = B_FALSE;
	zpool_handle_t *zhp;
	nvlist_t config, props = NULL;

	flags.dryrun = B_FALSE;
	flags.import = B_FALSE;
	flags.name_flags = 0;

	/* check options */
	while ((c = getopt(argc, argv, ":gLR:lno:P")) != -1) {
	switch (c) {
	case 'g':
	flags.name_flags \|= VDEV_NAME_GUID;
	break;
	case 'L':
	flags.name_flags \|= VDEV_NAME_FOLLOW_LINKS;
	break;
	case 'R':
	flags.import = B_TRUE;
	if (add_prop_list(
	zpool_prop_to_name(ZPOOL_PROP_ALTROOT), optarg,
	&props, B_TRUE) != 0) {
	nvlist_free(props);
	usage(B_FALSE);
	}
	break;
	case 'l':
	loadkeys = B_TRUE;
	break;
	case 'n':
	flags.dryrun = B_TRUE;
	break;
	case 'o':
	if ((propval = strchr(optarg, '=')) != NULL) {
	*propval = '\0';
	propval++;
	if (add_prop_list(optarg, propval,
	&props, B_TRUE) != 0) {
	nvlist_free(props);
	usage(B_FALSE);
	}
	} else {
	mntopts = optarg;
	}
	break;
	case 'P':
	flags.name_flags \|= VDEV_NAME_PATH;
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	break;
	}
	}

	if (!flags.import && mntopts != NULL) {
	(void) fprintf(stderr, gettext("setting mntopts is only "
	"valid when importing the pool\n"));
	usage(B_FALSE);
	}

	if (!flags.import && loadkeys) {
	(void) fprintf(stderr, gettext("loading keys is only "
	"valid when importing the pool\n"));
	usage(B_FALSE);
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("Missing pool name\n"));
	usage(B_FALSE);
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("Missing new pool name\n"));
	usage(B_FALSE);
	}

	srcpool = argv[0];
	newpool = argv[1];

	argc -= 2;
	argv += 2;

	if ((zhp = zpool_open(g_zfs, srcpool)) == NULL) {
	nvlist_free(props);
	return (1);
	}

	config = split_mirror_vdev(zhp, newpool, props, flags, argc, argv);
	if (config == NULL) {
	ret = 1;
	} else {
	if (flags.dryrun) {
	(void) printf(gettext("would create '%s' with the "
	"following layout:\n\n"), newpool);
	print_vdev_tree(NULL, newpool, config, 0, "",
	flags.name_flags);
	}
	}

	zpool_close(zhp);

	if (ret != 0 \|\| flags.dryrun \|\| !flags.import) {
	nvlist_free(config);
	nvlist_free(props);
	return (ret);
	}

	/*
	* The split was successful. Now we need to open the new
	* pool and import it.
	*/
	if ((zhp = zpool_open_canfail(g_zfs, newpool)) == NULL) {
	nvlist_free(config);
	nvlist_free(props);
	return (1);
	}

	if (loadkeys) {
	ret = zfs_crypto_attempt_load_keys(g_zfs, newpool);
	if (ret != 0)
	ret = 1;
	}

	if (zpool_get_state(zhp) != POOL_STATE_UNAVAIL &&
	zpool_enable_datasets(zhp, mntopts, 0) != 0) {
	ret = 1;
	(void) fprintf(stderr, gettext("Split was successful, but "
	"the datasets could not all be mounted\n"));
	(void) fprintf(stderr, gettext("Try doing '%s' with a "
	"different altroot\n"), "zpool import");
	}
	zpool_close(zhp);
	nvlist_free(config);
	nvlist_free(props);

	return (ret);
	}



	/*
	* zpool online <pool> <device> ...
	*/
	int
	zpool_do_online(int argc, char **argv)
	{
	int c, i;
	char *poolname;
	zpool_handle_t *zhp;
	int ret = 0;
	vdev_state_t newstate;
	int flags = 0;

	/* check options */
	while ((c = getopt(argc, argv, "e")) != -1) {
	switch (c) {
	case 'e':
	flags \|= ZFS_ONLINE_EXPAND;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* get pool name and check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name\n"));
	usage(B_FALSE);
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing device name\n"));
	usage(B_FALSE);
	}

	poolname = argv[0];

	if ((zhp = zpool_open(g_zfs, poolname)) == NULL)
	return (1);

	for (i = 1; i < argc; i++) {
	if (zpool_vdev_online(zhp, argv[i], flags, &newstate) == 0) {
	if (newstate != VDEV_STATE_HEALTHY) {
	(void) printf(gettext("warning: device '%s' "
	"onlined, but remains in faulted state\n"),
	argv[i]);
	if (newstate == VDEV_STATE_FAULTED)
	(void) printf(gettext("use 'zpool "
	"clear' to restore a faulted "
	"device\n"));
	else
	(void) printf(gettext("use 'zpool "
	"replace' to replace devices "
	"that are no longer present\n"));
	}
	} else {
	ret = 1;
	}
	}

	zpool_close(zhp);

	return (ret);
	}

	/*
	* zpool offline [-ft] <pool> <device> ...
	*
	* -f Force the device into a faulted state.
	*
	* -t Only take the device off-line temporarily. The offline/faulted
	* state will not be persistent across reboots.
	*/
	/* ARGSUSED */
	int
	zpool_do_offline(int argc, char **argv)
	{
	int c, i;
	char *poolname;
	zpool_handle_t *zhp;
	int ret = 0;
	boolean_t istmp = B_FALSE;
	boolean_t fault = B_FALSE;

	/* check options */
	while ((c = getopt(argc, argv, "ft")) != -1) {
	switch (c) {
	case 'f':
	fault = B_TRUE;
	break;
	case 't':
	istmp = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* get pool name and check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name\n"));
	usage(B_FALSE);
	}
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing device name\n"));
	usage(B_FALSE);
	}

	poolname = argv[0];

	if ((zhp = zpool_open(g_zfs, poolname)) == NULL)
	return (1);

	for (i = 1; i < argc; i++) {
	if (fault) {
	uint64_t guid = zpool_vdev_path_to_guid(zhp, argv[i]);
	vdev_aux_t aux;
	if (istmp == B_FALSE) {
	/* Force the fault to persist across imports */
	aux = VDEV_AUX_EXTERNAL_PERSIST;
	} else {
	aux = VDEV_AUX_EXTERNAL;
	}

	if (guid == 0 \|\| zpool_vdev_fault(zhp, guid, aux) != 0)
	ret = 1;
	} else {
	if (zpool_vdev_offline(zhp, argv[i], istmp) != 0)
	ret = 1;
	}
	}

	zpool_close(zhp);

	return (ret);
	}

	/*
	* zpool clear <pool> [device]
	*
	* Clear all errors associated with a pool or a particular device.
	*/
	int
	zpool_do_clear(int argc, char **argv)
	{
	int c;
	int ret = 0;
	boolean_t dryrun = B_FALSE;
	boolean_t do_rewind = B_FALSE;
	boolean_t xtreme_rewind = B_FALSE;
	uint32_t rewind_policy = ZPOOL_NO_REWIND;
	nvlist_t *policy = NULL;
	zpool_handle_t *zhp;
	char pool, device;

	/* check options */
	while ((c = getopt(argc, argv, "FnX")) != -1) {
	switch (c) {
	case 'F':
	do_rewind = B_TRUE;
	break;
	case 'n':
	dryrun = B_TRUE;
	break;
	case 'X':
	xtreme_rewind = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name\n"));
	usage(B_FALSE);
	}

	if (argc > 2) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	if ((dryrun \|\| xtreme_rewind) && !do_rewind) {
	(void) fprintf(stderr,
	gettext("-n or -X only meaningful with -F\n"));
	usage(B_FALSE);
	}
	if (dryrun)
	rewind_policy = ZPOOL_TRY_REWIND;
	else if (do_rewind)
	rewind_policy = ZPOOL_DO_REWIND;
	if (xtreme_rewind)
	rewind_policy \|= ZPOOL_EXTREME_REWIND;

	/* In future, further rewind policy choices can be passed along here */
	if (nvlist_alloc(&policy, NV_UNIQUE_NAME, 0) != 0 \|\|
	nvlist_add_uint32(policy, ZPOOL_LOAD_REWIND_POLICY,
	rewind_policy) != 0) {
	return (1);
	}

	pool = argv[0];
	device = argc == 2 ? argv[1] : NULL;

	if ((zhp = zpool_open_canfail(g_zfs, pool)) == NULL) {
	nvlist_free(policy);
	return (1);
	}

	if (zpool_clear(zhp, device, policy) != 0)
	ret = 1;

	zpool_close(zhp);

	nvlist_free(policy);

	return (ret);
	}

	/*
	* zpool reguid <pool>
	*/
	int
	zpool_do_reguid(int argc, char **argv)
	{
	int c;
	char *poolname;
	zpool_handle_t *zhp;
	int ret = 0;

	/* check options */
	while ((c = getopt(argc, argv, "")) != -1) {
	switch (c) {
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* get pool name and check number of arguments */
	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name\n"));
	usage(B_FALSE);
	}

	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	poolname = argv[0];
	if ((zhp = zpool_open(g_zfs, poolname)) == NULL)
	return (1);

	ret = zpool_reguid(zhp);

	zpool_close(zhp);
	return (ret);
	}


	/*
	* zpool reopen <pool>
	*
	* Reopen the pool so that the kernel can update the sizes of all vdevs.
	*/
	int
	zpool_do_reopen(int argc, char **argv)
	{
	int c;
	int ret = 0;
	boolean_t scrub_restart = B_TRUE;

	/* check options */
	while ((c = getopt(argc, argv, "n")) != -1) {
	switch (c) {
	case 'n':
	scrub_restart = B_FALSE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	/* if argc == 0 we will execute zpool_reopen_one on all pools */
	ret = for_each_pool(argc, argv, B_TRUE, NULL, zpool_reopen_one,
	&scrub_restart);

	return (ret);
	}

	typedef struct scrub_cbdata {
	int cb_type;
	pool_scrub_cmd_t cb_scrub_cmd;
	} scrub_cbdata_t;

	static boolean_t
	zpool_has_checkpoint(zpool_handle_t *zhp)
	{
	nvlist_t config, nvroot;

	config = zpool_get_config(zhp, NULL);

	if (config != NULL) {
	pool_checkpoint_stat_t *pcs = NULL;
	uint_t c;

	nvroot = fnvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE);
	(void) nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_CHECKPOINT_STATS, (uint64_t **)&pcs, &c);

	if (pcs == NULL \|\| pcs->pcs_state == CS_NONE)
	return (B_FALSE);

	assert(pcs->pcs_state == CS_CHECKPOINT_EXISTS \|\|
	pcs->pcs_state == CS_CHECKPOINT_DISCARDING);
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	static int
	scrub_callback(zpool_handle_t zhp, void data)
	{
	scrub_cbdata_t *cb = data;
	int err;

	/*
	* Ignore faulted pools.
	*/
	if (zpool_get_state(zhp) == POOL_STATE_UNAVAIL) {
	(void) fprintf(stderr, gettext("cannot scan '%s': pool is "
	"currently unavailable\n"), zpool_get_name(zhp));
	return (1);
	}

	err = zpool_scan(zhp, cb->cb_type, cb->cb_scrub_cmd);

	if (err == 0 && zpool_has_checkpoint(zhp) &&
	cb->cb_type == POOL_SCAN_SCRUB) {
	(void) printf(gettext("warning: will not scrub state that "
	"belongs to the checkpoint of pool '%s'\n"),
	zpool_get_name(zhp));
	}

	return (err != 0);
	}

	static int
	wait_callback(zpool_handle_t zhp, void data)
	{
	zpool_wait_activity_t *act = data;
	return (zpool_wait(zhp, *act));
	}

	/*
	* zpool scrub [-s \| -p] [-w] <pool> ...
	*
	* -s Stop. Stops any in-progress scrub.
	* -p Pause. Pause in-progress scrub.
	* -w Wait. Blocks until scrub has completed.
	*/
	int
	zpool_do_scrub(int argc, char **argv)
	{
	int c;
	scrub_cbdata_t cb;
	boolean_t wait = B_FALSE;
	int error;

	cb.cb_type = POOL_SCAN_SCRUB;
	cb.cb_scrub_cmd = POOL_SCRUB_NORMAL;

	/* check options */
	while ((c = getopt(argc, argv, "spw")) != -1) {
	switch (c) {
	case 's':
	cb.cb_type = POOL_SCAN_NONE;
	break;
	case 'p':
	cb.cb_scrub_cmd = POOL_SCRUB_PAUSE;
	break;
	case 'w':
	wait = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	if (cb.cb_type == POOL_SCAN_NONE &&
	cb.cb_scrub_cmd == POOL_SCRUB_PAUSE) {
	(void) fprintf(stderr, gettext("invalid option combination: "
	"-s and -p are mutually exclusive\n"));
	usage(B_FALSE);
	}

	if (wait && (cb.cb_type == POOL_SCAN_NONE \|\|
	cb.cb_scrub_cmd == POOL_SCRUB_PAUSE)) {
	(void) fprintf(stderr, gettext("invalid option combination: "
	"-w cannot be used with -p or -s\n"));
	usage(B_FALSE);
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	usage(B_FALSE);
	}

	error = for_each_pool(argc, argv, B_TRUE, NULL, scrub_callback, &cb);

	if (wait && !error) {
	zpool_wait_activity_t act = ZPOOL_WAIT_SCRUB;
	error = for_each_pool(argc, argv, B_TRUE, NULL, wait_callback,
	&act);
	}

	return (error);
	}

	/*
	* zpool resilver <pool> ...
	*
	* Restarts any in-progress resilver
	*/
	int
	zpool_do_resilver(int argc, char **argv)
	{
	int c;
	scrub_cbdata_t cb;

	cb.cb_type = POOL_SCAN_RESILVER;
	cb.cb_scrub_cmd = POOL_SCRUB_NORMAL;

	/* check options */
	while ((c = getopt(argc, argv, "")) != -1) {
	switch (c) {
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	usage(B_FALSE);
	}

	return (for_each_pool(argc, argv, B_TRUE, NULL, scrub_callback, &cb));
	}

	/*
	* zpool trim [-d] [-r <rate>] [-c \| -s] <pool> [<device> ...]
	*
	* -c Cancel. Ends any in-progress trim.
	* -d Secure trim. Requires kernel and device support.
	* -r <rate> Sets the TRIM rate in bytes (per second). Supports
	* adding a multiplier suffix such as 'k' or 'm'.
	* -s Suspend. TRIM can then be restarted with no flags.
	* -w Wait. Blocks until trimming has completed.
	*/
	int
	zpool_do_trim(int argc, char **argv)
	{
	struct option long_options[] = {
	{"cancel", no_argument, NULL, 'c'},
	{"secure", no_argument, NULL, 'd'},
	{"rate", required_argument, NULL, 'r'},
	{"suspend", no_argument, NULL, 's'},
	{"wait", no_argument, NULL, 'w'},
	{0, 0, 0, 0}
	};

	pool_trim_func_t cmd_type = POOL_TRIM_START;
	uint64_t rate = 0;
	boolean_t secure = B_FALSE;
	boolean_t wait = B_FALSE;

	int c;
	while ((c = getopt_long(argc, argv, "cdr:sw", long_options, NULL))
	!= -1) {
	switch (c) {
	case 'c':
	if (cmd_type != POOL_TRIM_START &&
	cmd_type != POOL_TRIM_CANCEL) {
	(void) fprintf(stderr, gettext("-c cannot be "
	"combined with other options\n"));
	usage(B_FALSE);
	}
	cmd_type = POOL_TRIM_CANCEL;
	break;
	case 'd':
	if (cmd_type != POOL_TRIM_START) {
	(void) fprintf(stderr, gettext("-d cannot be "
	"combined with the -c or -s options\n"));
	usage(B_FALSE);
	}
	secure = B_TRUE;
	break;
	case 'r':
	if (cmd_type != POOL_TRIM_START) {
	(void) fprintf(stderr, gettext("-r cannot be "
	"combined with the -c or -s options\n"));
	usage(B_FALSE);
	}
	if (zfs_nicestrtonum(NULL, optarg, &rate) == -1) {
	(void) fprintf(stderr,
	gettext("invalid value for rate\n"));
	usage(B_FALSE);
	}
	break;
	case 's':
	if (cmd_type != POOL_TRIM_START &&
	cmd_type != POOL_TRIM_SUSPEND) {
	(void) fprintf(stderr, gettext("-s cannot be "
	"combined with other options\n"));
	usage(B_FALSE);
	}
	cmd_type = POOL_TRIM_SUSPEND;
	break;
	case 'w':
	wait = B_TRUE;
	break;
	case '?':
	if (optopt != 0) {
	(void) fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	} else {
	(void) fprintf(stderr,
	gettext("invalid option '%s'\n"),
	argv[optind - 1]);
	}
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing pool name argument\n"));
	usage(B_FALSE);
	return (-1);
	}

	if (wait && (cmd_type != POOL_TRIM_START)) {
	(void) fprintf(stderr, gettext("-w cannot be used with -c or "
	"-s\n"));
	usage(B_FALSE);
	}

	char *poolname = argv[0];
	zpool_handle_t *zhp = zpool_open(g_zfs, poolname);
	if (zhp == NULL)
	return (-1);

	trimflags_t trim_flags = {
	.secure = secure,
	.rate = rate,
	.wait = wait,
	};

	nvlist_t *vdevs = fnvlist_alloc();
	if (argc == 1) {
	/* no individual leaf vdevs specified, so add them all */
	nvlist_t *config = zpool_get_config(zhp, NULL);
	nvlist_t *nvroot = fnvlist_lookup_nvlist(config,
	ZPOOL_CONFIG_VDEV_TREE);
	zpool_collect_leaves(zhp, nvroot, vdevs);
	trim_flags.fullpool = B_TRUE;
	} else {
	trim_flags.fullpool = B_FALSE;
	for (int i = 1; i < argc; i++) {
	fnvlist_add_boolean(vdevs, argv[i]);
	}
	}

	int error = zpool_trim(zhp, cmd_type, vdevs, &trim_flags);

	fnvlist_free(vdevs);
	zpool_close(zhp);

	return (error);
	}

	/*
	* Converts a total number of seconds to a human readable string broken
	* down in to days/hours/minutes/seconds.
	*/
	static void
	secs_to_dhms(uint64_t total, char *buf)
	{
	uint64_t days = total / 60 / 60 / 24;
	uint64_t hours = (total / 60 / 60) % 24;
	uint64_t mins = (total / 60) % 60;
	uint64_t secs = (total % 60);

	if (days > 0) {
	(void) sprintf(buf, "%llu days %02llu:%02llu:%02llu",
	(u_longlong_t)days, (u_longlong_t)hours,
	(u_longlong_t)mins, (u_longlong_t)secs);
	} else {
	(void) sprintf(buf, "%02llu:%02llu:%02llu",
	(u_longlong_t)hours, (u_longlong_t)mins,
	(u_longlong_t)secs);
	}
	}

	/*
	* Print out detailed scrub status.
	*/
	static void
	print_scan_scrub_resilver_status(pool_scan_stat_t *ps)
	{
	time_t start, end, pause;
	uint64_t pass_scanned, scanned, pass_issued, issued, total;
	uint64_t elapsed, scan_rate, issue_rate;
	double fraction_done;
	char processed_buf[7], scanned_buf[7], issued_buf[7], total_buf[7];
	char srate_buf[7], irate_buf[7], time_buf[32];

	printf(" ");
	printf_color(ANSI_BOLD, gettext("scan:"));
	printf(" ");

	/* If there's never been a scan, there's not much to say. */
	if (ps == NULL \|\| ps->pss_func == POOL_SCAN_NONE \|\|
	ps->pss_func >= POOL_SCAN_FUNCS) {
	(void) printf(gettext("none requested\n"));
	return;
	}

	start = ps->pss_start_time;
	end = ps->pss_end_time;
	pause = ps->pss_pass_scrub_pause;

	zfs_nicebytes(ps->pss_processed, processed_buf, sizeof (processed_buf));

	assert(ps->pss_func == POOL_SCAN_SCRUB \|\|
	ps->pss_func == POOL_SCAN_RESILVER);

	/* Scan is finished or canceled. */
	if (ps->pss_state == DSS_FINISHED) {
	secs_to_dhms(end - start, time_buf);

	if (ps->pss_func == POOL_SCAN_SCRUB) {
	(void) printf(gettext("scrub repaired %s "
	"in %s with %llu errors on %s"), processed_buf,
	time_buf, (u_longlong_t)ps->pss_errors,
	ctime(&end));
	} else if (ps->pss_func == POOL_SCAN_RESILVER) {
	(void) printf(gettext("resilvered %s "
	"in %s with %llu errors on %s"), processed_buf,
	time_buf, (u_longlong_t)ps->pss_errors,
	ctime(&end));
	}
	return;
	} else if (ps->pss_state == DSS_CANCELED) {
	if (ps->pss_func == POOL_SCAN_SCRUB) {
	(void) printf(gettext("scrub canceled on %s"),
	ctime(&end));
	} else if (ps->pss_func == POOL_SCAN_RESILVER) {
	(void) printf(gettext("resilver canceled on %s"),
	ctime(&end));
	}
	return;
	}

	assert(ps->pss_state == DSS_SCANNING);

	/* Scan is in progress. Resilvers can't be paused. */
	if (ps->pss_func == POOL_SCAN_SCRUB) {
	if (pause == 0) {
	(void) printf(gettext("scrub in progress since %s"),
	ctime(&start));
	} else {
	(void) printf(gettext("scrub paused since %s"),
	ctime(&pause));
	(void) printf(gettext("\tscrub started on %s"),
	ctime(&start));
	}
	} else if (ps->pss_func == POOL_SCAN_RESILVER) {
	(void) printf(gettext("resilver in progress since %s"),
	ctime(&start));
	}

	scanned = ps->pss_examined;
	pass_scanned = ps->pss_pass_exam;
	issued = ps->pss_issued;
	pass_issued = ps->pss_pass_issued;
	total = ps->pss_to_examine;

	/* we are only done with a block once we have issued the IO for it */
	fraction_done = (double)issued / total;

	/* elapsed time for this pass, rounding up to 1 if it's 0 */
	elapsed = time(NULL) - ps->pss_pass_start;
	elapsed -= ps->pss_pass_scrub_spent_paused;
	elapsed = (elapsed != 0) ? elapsed : 1;

	scan_rate = pass_scanned / elapsed;
	issue_rate = pass_issued / elapsed;
	uint64_t total_secs_left = (issue_rate != 0 && total >= issued) ?
	((total - issued) / issue_rate) : UINT64_MAX;
	secs_to_dhms(total_secs_left, time_buf);

	/* format all of the numbers we will be reporting */
	zfs_nicebytes(scanned, scanned_buf, sizeof (scanned_buf));
	zfs_nicebytes(issued, issued_buf, sizeof (issued_buf));
	zfs_nicebytes(total, total_buf, sizeof (total_buf));
	zfs_nicebytes(scan_rate, srate_buf, sizeof (srate_buf));
	zfs_nicebytes(issue_rate, irate_buf, sizeof (irate_buf));

	/* do not print estimated time if we have a paused scrub */
	if (pause == 0) {
	(void) printf(gettext("\t%s scanned at %s/s, "
	"%s issued at %s/s, %s total\n"),
	scanned_buf, srate_buf, issued_buf, irate_buf, total_buf);
	} else {
	(void) printf(gettext("\t%s scanned, %s issued, %s total\n"),
	scanned_buf, issued_buf, total_buf);
	}

	if (ps->pss_func == POOL_SCAN_RESILVER) {
	(void) printf(gettext("\t%s resilvered, %.2f%% done"),
	processed_buf, 100 * fraction_done);
	} else if (ps->pss_func == POOL_SCAN_SCRUB) {
	(void) printf(gettext("\t%s repaired, %.2f%% done"),
	processed_buf, 100 * fraction_done);
	}

	if (pause == 0) {
	if (total_secs_left != UINT64_MAX &&
	issue_rate >= 10 * 1024 * 1024) {
	(void) printf(gettext(", %s to go\n"), time_buf);
	} else {
	(void) printf(gettext(", no estimated "
	"completion time\n"));
	}
	} else {
	(void) printf(gettext("\n"));
	}
	}

	static void
	print_rebuild_status_impl(vdev_rebuild_stat_t vrs, char vdev_name)
	{
	if (vrs == NULL \|\| vrs->vrs_state == VDEV_REBUILD_NONE)
	return;

	printf(" ");
	printf_color(ANSI_BOLD, gettext("scan:"));
	printf(" ");

	uint64_t bytes_scanned = vrs->vrs_bytes_scanned;
	uint64_t bytes_issued = vrs->vrs_bytes_issued;
	uint64_t bytes_rebuilt = vrs->vrs_bytes_rebuilt;
	uint64_t bytes_est = vrs->vrs_bytes_est;
	uint64_t scan_rate = (vrs->vrs_pass_bytes_scanned /
	(vrs->vrs_pass_time_ms + 1)) * 1000;
	uint64_t issue_rate = (vrs->vrs_pass_bytes_issued /
	(vrs->vrs_pass_time_ms + 1)) * 1000;
	double scan_pct = MIN((double)bytes_scanned * 100 /
	(bytes_est + 1), 100);

	/* Format all of the numbers we will be reporting */
	char bytes_scanned_buf[7], bytes_issued_buf[7];
	char bytes_rebuilt_buf[7], bytes_est_buf[7];
	char scan_rate_buf[7], issue_rate_buf[7], time_buf[32];
	zfs_nicebytes(bytes_scanned, bytes_scanned_buf,
	sizeof (bytes_scanned_buf));
	zfs_nicebytes(bytes_issued, bytes_issued_buf,
	sizeof (bytes_issued_buf));
	zfs_nicebytes(bytes_rebuilt, bytes_rebuilt_buf,
	sizeof (bytes_rebuilt_buf));
	zfs_nicebytes(bytes_est, bytes_est_buf, sizeof (bytes_est_buf));
	zfs_nicebytes(scan_rate, scan_rate_buf, sizeof (scan_rate_buf));
	zfs_nicebytes(issue_rate, issue_rate_buf, sizeof (issue_rate_buf));

	time_t start = vrs->vrs_start_time;
	time_t end = vrs->vrs_end_time;

	/* Rebuild is finished or canceled. */
	if (vrs->vrs_state == VDEV_REBUILD_COMPLETE) {
	secs_to_dhms(vrs->vrs_scan_time_ms / 1000, time_buf);
	(void) printf(gettext("resilvered (%s) %s in %s "
	"with %llu errors on %s"), vdev_name, bytes_rebuilt_buf,
	time_buf, (u_longlong_t)vrs->vrs_errors, ctime(&end));
	return;
	} else if (vrs->vrs_state == VDEV_REBUILD_CANCELED) {
	(void) printf(gettext("resilver (%s) canceled on %s"),
	vdev_name, ctime(&end));
	return;
	} else if (vrs->vrs_state == VDEV_REBUILD_ACTIVE) {
	(void) printf(gettext("resilver (%s) in progress since %s"),
	vdev_name, ctime(&start));
	}

	assert(vrs->vrs_state == VDEV_REBUILD_ACTIVE);

	secs_to_dhms(MAX((int64_t)bytes_est - (int64_t)bytes_scanned, 0) /
	MAX(scan_rate, 1), time_buf);

	(void) printf(gettext("\t%s scanned at %s/s, %s issued %s/s, "
	"%s total\n"), bytes_scanned_buf, scan_rate_buf,
	bytes_issued_buf, issue_rate_buf, bytes_est_buf);
	(void) printf(gettext("\t%s resilvered, %.2f%% done"),
	bytes_rebuilt_buf, scan_pct);

	if (vrs->vrs_state == VDEV_REBUILD_ACTIVE) {
	if (scan_rate >= 10 * 1024 * 1024) {
	(void) printf(gettext(", %s to go\n"), time_buf);
	} else {
	(void) printf(gettext(", no estimated "
	"completion time\n"));
	}
	} else {
	(void) printf(gettext("\n"));
	}
	}

	/*
	* Print rebuild status for top-level vdevs.
	*/
	static void
	print_rebuild_status(zpool_handle_t zhp, nvlist_t nvroot)
	{
	nvlist_t **child;
	uint_t children;

	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	children = 0;

	for (uint_t c = 0; c < children; c++) {
	vdev_rebuild_stat_t *vrs;
	uint_t i;

	if (nvlist_lookup_uint64_array(child[c],
	ZPOOL_CONFIG_REBUILD_STATS, (uint64_t **)&vrs, &i) == 0) {
	char *name = zpool_vdev_name(g_zfs, zhp,
	child[c], VDEV_NAME_TYPE_ID);
	print_rebuild_status_impl(vrs, name);
	free(name);
	}
	}
	}

	/*
	* As we don't scrub checkpointed blocks, we want to warn the user that we
	* skipped scanning some blocks if a checkpoint exists or existed at any
	* time during the scan. If a sequential instead of healing reconstruction
	* was performed then the blocks were reconstructed. However, their checksums
	* have not been verified so we still print the warning.
	*/
	static void
	print_checkpoint_scan_warning(pool_scan_stat_t ps, pool_checkpoint_stat_t pcs)
	{
	if (ps == NULL \|\| pcs == NULL)
	return;

	if (pcs->pcs_state == CS_NONE \|\|
	pcs->pcs_state == CS_CHECKPOINT_DISCARDING)
	return;

	assert(pcs->pcs_state == CS_CHECKPOINT_EXISTS);

	if (ps->pss_state == DSS_NONE)
	return;

	if ((ps->pss_state == DSS_FINISHED \|\| ps->pss_state == DSS_CANCELED) &&
	ps->pss_end_time < pcs->pcs_start_time)
	return;

	if (ps->pss_state == DSS_FINISHED \|\| ps->pss_state == DSS_CANCELED) {
	(void) printf(gettext(" scan warning: skipped blocks "
	"that are only referenced by the checkpoint.\n"));
	} else {
	assert(ps->pss_state == DSS_SCANNING);
	(void) printf(gettext(" scan warning: skipping blocks "
	"that are only referenced by the checkpoint.\n"));
	}
	}

	/*
	* Returns B_TRUE if there is an active rebuild in progress. Otherwise,
	* B_FALSE is returned and 'rebuild_end_time' is set to the end time for
	* the last completed (or cancelled) rebuild.
	*/
	static boolean_t
	check_rebuilding(nvlist_t nvroot, uint64_t rebuild_end_time)
	{
	nvlist_t **child;
	uint_t children;
	boolean_t rebuilding = B_FALSE;
	uint64_t end_time = 0;

	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	children = 0;

	for (uint_t c = 0; c < children; c++) {
	vdev_rebuild_stat_t *vrs;
	uint_t i;

	if (nvlist_lookup_uint64_array(child[c],
	ZPOOL_CONFIG_REBUILD_STATS, (uint64_t **)&vrs, &i) == 0) {

	if (vrs->vrs_end_time > end_time)
	end_time = vrs->vrs_end_time;

	if (vrs->vrs_state == VDEV_REBUILD_ACTIVE) {
	rebuilding = B_TRUE;
	end_time = 0;
	break;
	}
	}
	}

	if (rebuild_end_time != NULL)
	*rebuild_end_time = end_time;

	return (rebuilding);
	}

	/*
	* Print the scan status.
	*/
	static void
	print_scan_status(zpool_handle_t zhp, nvlist_t nvroot)
	{
	uint64_t rebuild_end_time = 0, resilver_end_time = 0;
	boolean_t have_resilver = B_FALSE, have_scrub = B_FALSE;
	boolean_t active_resilver = B_FALSE;
	pool_checkpoint_stat_t *pcs = NULL;
	pool_scan_stat_t *ps = NULL;
	uint_t c;

	if (nvlist_lookup_uint64_array(nvroot, ZPOOL_CONFIG_SCAN_STATS,
	(uint64_t **)&ps, &c) == 0) {
	if (ps->pss_func == POOL_SCAN_RESILVER) {
	resilver_end_time = ps->pss_end_time;
	active_resilver = (ps->pss_state == DSS_SCANNING);
	}

	have_resilver = (ps->pss_func == POOL_SCAN_RESILVER);
	have_scrub = (ps->pss_func == POOL_SCAN_SCRUB);
	}

	boolean_t active_rebuild = check_rebuilding(nvroot, &rebuild_end_time);
	boolean_t have_rebuild = (active_rebuild \|\| (rebuild_end_time > 0));

	/* Always print the scrub status when available. */
	if (have_scrub)
	print_scan_scrub_resilver_status(ps);

	/*
	* When there is an active resilver or rebuild print its status.
	* Otherwise print the status of the last resilver or rebuild.
	*/
	if (active_resilver \|\| (!active_rebuild && have_resilver &&
	resilver_end_time && resilver_end_time > rebuild_end_time)) {
	print_scan_scrub_resilver_status(ps);
	} else if (active_rebuild \|\| (!active_resilver && have_rebuild &&
	rebuild_end_time && rebuild_end_time > resilver_end_time)) {
	print_rebuild_status(zhp, nvroot);
	}

	(void) nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_CHECKPOINT_STATS, (uint64_t **)&pcs, &c);
	print_checkpoint_scan_warning(ps, pcs);
	}

	/*
	* Print out detailed removal status.
	*/
	static void
	print_removal_status(zpool_handle_t zhp, pool_removal_stat_t prs)
	{
	char copied_buf[7], examined_buf[7], total_buf[7], rate_buf[7];
	time_t start, end;
	nvlist_t config, nvroot;
	nvlist_t **child;
	uint_t children;
	char *vdev_name;

	if (prs == NULL \|\| prs->prs_state == DSS_NONE)
	return;

	/*
	* Determine name of vdev.
	*/
	config = zpool_get_config(zhp, NULL);
	nvroot = fnvlist_lookup_nvlist(config,
	ZPOOL_CONFIG_VDEV_TREE);
	verify(nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_CHILDREN,
	&child, &children) == 0);
	assert(prs->prs_removing_vdev < children);
	vdev_name = zpool_vdev_name(g_zfs, zhp,
	child[prs->prs_removing_vdev], B_TRUE);

	(void) printf(gettext("remove: "));

	start = prs->prs_start_time;
	end = prs->prs_end_time;
	zfs_nicenum(prs->prs_copied, copied_buf, sizeof (copied_buf));

	/*
	* Removal is finished or canceled.
	*/
	if (prs->prs_state == DSS_FINISHED) {
	uint64_t minutes_taken = (end - start) / 60;

	(void) printf(gettext("Removal of vdev %llu copied %s "
	"in %lluh%um, completed on %s"),
	(longlong_t)prs->prs_removing_vdev,
	copied_buf,
	(u_longlong_t)(minutes_taken / 60),
	(uint_t)(minutes_taken % 60),
	ctime((time_t *)&end));
	} else if (prs->prs_state == DSS_CANCELED) {
	(void) printf(gettext("Removal of %s canceled on %s"),
	vdev_name, ctime(&end));
	} else {
	uint64_t copied, total, elapsed, mins_left, hours_left;
	double fraction_done;
	uint_t rate;

	assert(prs->prs_state == DSS_SCANNING);

	/*
	* Removal is in progress.
	*/
	(void) printf(gettext(
	"Evacuation of %s in progress since %s"),
	vdev_name, ctime(&start));

	copied = prs->prs_copied > 0 ? prs->prs_copied : 1;
	total = prs->prs_to_copy;
	fraction_done = (double)copied / total;

	/* elapsed time for this pass */
	elapsed = time(NULL) - prs->prs_start_time;
	elapsed = elapsed > 0 ? elapsed : 1;
	rate = copied / elapsed;
	rate = rate > 0 ? rate : 1;
	mins_left = ((total - copied) / rate) / 60;
	hours_left = mins_left / 60;

	zfs_nicenum(copied, examined_buf, sizeof (examined_buf));
	zfs_nicenum(total, total_buf, sizeof (total_buf));
	zfs_nicenum(rate, rate_buf, sizeof (rate_buf));

	/*
	* do not print estimated time if hours_left is more than
	* 30 days
	*/
	(void) printf(gettext(" %s copied out of %s at %s/s, "
	"%.2f%% done"),
	examined_buf, total_buf, rate_buf, 100 * fraction_done);
	if (hours_left < (30 * 24)) {
	(void) printf(gettext(", %lluh%um to go\n"),
	(u_longlong_t)hours_left, (uint_t)(mins_left % 60));
	} else {
	(void) printf(gettext(
	", (copy is slow, no estimated time)\n"));
	}
	}
	free(vdev_name);

	if (prs->prs_mapping_memory > 0) {
	char mem_buf[7];
	zfs_nicenum(prs->prs_mapping_memory, mem_buf, sizeof (mem_buf));
	(void) printf(gettext(" %s memory used for "
	"removed device mappings\n"),
	mem_buf);
	}
	}

	static void
	print_checkpoint_status(pool_checkpoint_stat_t *pcs)
	{
	time_t start;
	char space_buf[7];

	if (pcs == NULL \|\| pcs->pcs_state == CS_NONE)
	return;

	(void) printf(gettext("checkpoint: "));

	start = pcs->pcs_start_time;
	zfs_nicenum(pcs->pcs_space, space_buf, sizeof (space_buf));

	if (pcs->pcs_state == CS_CHECKPOINT_EXISTS) {
	char *date = ctime(&start);

	/*
	* ctime() adds a newline at the end of the generated
	* string, thus the weird format specifier and the
	* strlen() call used to chop it off from the output.
	*/
	(void) printf(gettext("created %.*s, consumes %s\n"),
	(int)(strlen(date) - 1), date, space_buf);
	return;
	}

	assert(pcs->pcs_state == CS_CHECKPOINT_DISCARDING);

	(void) printf(gettext("discarding, %s remaining.\n"),
	space_buf);
	}

	static void
	print_error_log(zpool_handle_t *zhp)
	{
	nvlist_t *nverrlist = NULL;
	nvpair_t *elem;
	char *pathname;
	size_t len = MAXPATHLEN * 2;

	if (zpool_get_errlog(zhp, &nverrlist) != 0)
	return;

	(void) printf("errors: Permanent errors have been "
	"detected in the following files:\n\n");

	pathname = safe_malloc(len);
	elem = NULL;
	while ((elem = nvlist_next_nvpair(nverrlist, elem)) != NULL) {
	nvlist_t *nv;
	uint64_t dsobj, obj;

	verify(nvpair_value_nvlist(elem, &nv) == 0);
	verify(nvlist_lookup_uint64(nv, ZPOOL_ERR_DATASET,
	&dsobj) == 0);
	verify(nvlist_lookup_uint64(nv, ZPOOL_ERR_OBJECT,
	&obj) == 0);
	zpool_obj_to_path(zhp, dsobj, obj, pathname, len);
	(void) printf("%7s %s\n", "", pathname);
	}
	free(pathname);
	nvlist_free(nverrlist);
	}

	static void
	print_spares(zpool_handle_t zhp, status_cbdata_t cb, nvlist_t **spares,
	uint_t nspares)
	{
	uint_t i;
	char *name;

	if (nspares == 0)
	return;

	(void) printf(gettext("\tspares\n"));

	for (i = 0; i < nspares; i++) {
	name = zpool_vdev_name(g_zfs, zhp, spares[i],
	cb->cb_name_flags);
	print_status_config(zhp, cb, name, spares[i], 2, B_TRUE, NULL);
	free(name);
	}
	}

	static void
	print_l2cache(zpool_handle_t zhp, status_cbdata_t cb, nvlist_t **l2cache,
	uint_t nl2cache)
	{
	uint_t i;
	char *name;

	if (nl2cache == 0)
	return;

	(void) printf(gettext("\tcache\n"));

	for (i = 0; i < nl2cache; i++) {
	name = zpool_vdev_name(g_zfs, zhp, l2cache[i],
	cb->cb_name_flags);
	print_status_config(zhp, cb, name, l2cache[i], 2,
	B_FALSE, NULL);
	free(name);
	}
	}

	static void
	print_dedup_stats(nvlist_t *config)
	{
	ddt_histogram_t *ddh;
	ddt_stat_t *dds;
	ddt_object_t *ddo;
	uint_t c;
	char dspace[6], mspace[6];

	/*
	* If the pool was faulted then we may not have been able to
	* obtain the config. Otherwise, if we have anything in the dedup
	* table continue processing the stats.
	*/
	if (nvlist_lookup_uint64_array(config, ZPOOL_CONFIG_DDT_OBJ_STATS,
	(uint64_t **)&ddo, &c) != 0)
	return;

	(void) printf("\n");
	(void) printf(gettext(" dedup: "));
	if (ddo->ddo_count == 0) {
	(void) printf(gettext("no DDT entries\n"));
	return;
	}

	zfs_nicebytes(ddo->ddo_dspace, dspace, sizeof (dspace));
	zfs_nicebytes(ddo->ddo_mspace, mspace, sizeof (mspace));
	(void) printf("DDT entries %llu, size %s on disk, %s in core\n",
	(u_longlong_t)ddo->ddo_count,
	dspace,
	mspace);

	verify(nvlist_lookup_uint64_array(config, ZPOOL_CONFIG_DDT_STATS,
	(uint64_t **)&dds, &c) == 0);
	verify(nvlist_lookup_uint64_array(config, ZPOOL_CONFIG_DDT_HISTOGRAM,
	(uint64_t **)&ddh, &c) == 0);
	zpool_dump_ddt(dds, ddh);
	}

	/*
	* Display a summary of pool status. Displays a summary such as:
	*
	* pool: tank
	* status: DEGRADED
	* reason: One or more devices ...
	* see: https://openzfs.github.io/openzfs-docs/msg/ZFS-xxxx-01
	* config:
	* mirror DEGRADED
	* c1t0d0 OK
	* c2t0d0 UNAVAIL
	*
	* When given the '-v' option, we print out the complete config. If the '-e'
	* option is specified, then we print out error rate information as well.
	*/
	static int
	status_callback(zpool_handle_t zhp, void data)
	{
	status_cbdata_t *cbp = data;
	nvlist_t config, nvroot;
	char *msgid;
	zpool_status_t reason;
	zpool_errata_t errata;
	const char *health;
	uint_t c;
	vdev_stat_t *vs;

	config = zpool_get_config(zhp, NULL);
	reason = zpool_get_status(zhp, &msgid, &errata);

	cbp->cb_count++;

	/*
	* If we were given 'zpool status -x', only report those pools with
	* problems.
	*/
	if (cbp->cb_explain &&
	(reason == ZPOOL_STATUS_OK \|\|
	reason == ZPOOL_STATUS_VERSION_OLDER \|\|
	reason == ZPOOL_STATUS_FEAT_DISABLED)) {
	if (!cbp->cb_allpools) {
	(void) printf(gettext("pool '%s' is healthy\n"),
	zpool_get_name(zhp));
	if (cbp->cb_first)
	cbp->cb_first = B_FALSE;
	}
	return (0);
	}

	if (cbp->cb_first)
	cbp->cb_first = B_FALSE;
	else
	(void) printf("\n");

	nvroot = fnvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE);
	verify(nvlist_lookup_uint64_array(nvroot, ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t **)&vs, &c) == 0);

	health = zpool_get_state_str(zhp);

	printf(" ");
	printf_color(ANSI_BOLD, gettext("pool:"));
	printf(" %s\n", zpool_get_name(zhp));
	printf(" ");
	printf_color(ANSI_BOLD, gettext("state: "));

	printf_color(health_str_to_color(health), "%s", health);

	printf("\n");

	switch (reason) {
	case ZPOOL_STATUS_MISSING_DEV_R:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices could "
	"not be opened. Sufficient replicas exist for\n\tthe pool "
	"to continue functioning in a degraded state.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Attach the missing device "
	"and online it using 'zpool online'.\n"));
	break;

	case ZPOOL_STATUS_MISSING_DEV_NR:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices could "
	"not be opened. There are insufficient\n\treplicas for the"
	" pool to continue functioning.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Attach the missing device "
	"and online it using 'zpool online'.\n"));
	break;

	case ZPOOL_STATUS_CORRUPT_LABEL_R:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices could "
	"not be used because the label is missing or\n\tinvalid. "
	"Sufficient replicas exist for the pool to continue\n\t"
	"functioning in a degraded state.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Replace the device using "
	"'zpool replace'.\n"));
	break;

	case ZPOOL_STATUS_CORRUPT_LABEL_NR:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices could "
	"not be used because the label is missing \n\tor invalid. "
	"There are insufficient replicas for the pool to "
	"continue\n\tfunctioning.\n"));
	zpool_explain_recover(zpool_get_handle(zhp),
	zpool_get_name(zhp), reason, config);
	break;

	case ZPOOL_STATUS_FAILING_DEV:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices has "
	"experienced an unrecoverable error. An\n\tattempt was "
	"made to correct the error. Applications are "
	"unaffected.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Determine if the "
	"device needs to be replaced, and clear the errors\n\tusing"
	" 'zpool clear' or replace the device with 'zpool "
	"replace'.\n"));
	break;

	case ZPOOL_STATUS_OFFLINE_DEV:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices has "
	"been taken offline by the administrator.\n\tSufficient "
	"replicas exist for the pool to continue functioning in "
	"a\n\tdegraded state.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Online the device "
	"using 'zpool online' or replace the device with\n\t'zpool "
	"replace'.\n"));
	break;

	case ZPOOL_STATUS_REMOVED_DEV:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices has "
	"been removed by the administrator.\n\tSufficient "
	"replicas exist for the pool to continue functioning in "
	"a\n\tdegraded state.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Online the device "
	"using zpool online' or replace the device with\n\t'zpool "
	"replace'.\n"));
	break;

	case ZPOOL_STATUS_RESILVERING:
	case ZPOOL_STATUS_REBUILDING:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices is "
	"currently being resilvered. The pool will\n\tcontinue "
	"to function, possibly in a degraded state.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Wait for the resilver to "
	"complete.\n"));
	break;

	case ZPOOL_STATUS_REBUILD_SCRUB:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices have "
	"been sequentially resilvered, scrubbing\n\tthe pool "
	"is recommended.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Use 'zpool scrub' to "
	"verify all data checksums.\n"));
	break;

	case ZPOOL_STATUS_CORRUPT_DATA:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices has "
	"experienced an error resulting in data\n\tcorruption. "
	"Applications may be affected.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Restore the file in question"
	" if possible. Otherwise restore the\n\tentire pool from "
	"backup.\n"));
	break;

	case ZPOOL_STATUS_CORRUPT_POOL:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool metadata is "
	"corrupted and the pool cannot be opened.\n"));
	zpool_explain_recover(zpool_get_handle(zhp),
	zpool_get_name(zhp), reason, config);
	break;

	case ZPOOL_STATUS_VERSION_OLDER:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool is formatted using "
	"a legacy on-disk format. The pool can\n\tstill be used, "
	"but some features are unavailable.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Upgrade the pool using "
	"'zpool upgrade'. Once this is done, the\n\tpool will no "
	"longer be accessible on software that does not support\n\t"
	"feature flags.\n"));
	break;

	case ZPOOL_STATUS_VERSION_NEWER:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool has been upgraded "
	"to a newer, incompatible on-disk version.\n\tThe pool "
	"cannot be accessed on this system.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Access the pool from a "
	"system running more recent software, or\n\trestore the "
	"pool from backup.\n"));
	break;

	case ZPOOL_STATUS_FEAT_DISABLED:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("Some supported features are "
	"not enabled on the pool. The pool can\n\tstill be used, "
	"but some features are unavailable.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Enable all features using "
	"'zpool upgrade'. Once this is done,\n\tthe pool may no "
	"longer be accessible by software that does not support\n\t"
	"the features. See zpool-features(5) for details.\n"));
	break;

	case ZPOOL_STATUS_UNSUP_FEAT_READ:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool cannot be accessed "
	"on this system because it uses the\n\tfollowing feature(s)"
	" not supported on this system:\n"));
	zpool_print_unsup_feat(config);
	(void) printf("\n");
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Access the pool from a "
	"system that supports the required feature(s),\n\tor "
	"restore the pool from backup.\n"));
	break;

	case ZPOOL_STATUS_UNSUP_FEAT_WRITE:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool can only be "
	"accessed in read-only mode on this system. It\n\tcannot be"
	" accessed in read-write mode because it uses the "
	"following\n\tfeature(s) not supported on this system:\n"));
	zpool_print_unsup_feat(config);
	(void) printf("\n");
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("The pool cannot be accessed "
	"in read-write mode. Import the pool with\n"
	"\t\"-o readonly=on\", access the pool from a system that "
	"supports the\n\trequired feature(s), or restore the "
	"pool from backup.\n"));
	break;

	case ZPOOL_STATUS_FAULTED_DEV_R:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices are "
	"faulted in response to persistent errors.\n\tSufficient "
	"replicas exist for the pool to continue functioning "
	"in a\n\tdegraded state.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Replace the faulted device, "
	"or use 'zpool clear' to mark the device\n\trepaired.\n"));
	break;

	case ZPOOL_STATUS_FAULTED_DEV_NR:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices are "
	"faulted in response to persistent errors. There are "
	"insufficient replicas for the pool to\n\tcontinue "
	"functioning.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Destroy and re-create the "
	"pool from a backup source. Manually marking the device\n"
	"\trepaired using 'zpool clear' may allow some data "
	"to be recovered.\n"));
	break;

	case ZPOOL_STATUS_IO_FAILURE_MMP:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("The pool is suspended "
	"because multihost writes failed or were delayed;\n\t"
	"another system could import the pool undetected.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Make sure the pool's devices"
	" are connected, then reboot your system and\n\timport the "
	"pool.\n"));
	break;

	case ZPOOL_STATUS_IO_FAILURE_WAIT:
	case ZPOOL_STATUS_IO_FAILURE_CONTINUE:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("One or more devices are "
	"faulted in response to IO failures.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Make sure the affected "
	"devices are connected, then run 'zpool clear'.\n"));
	break;

	case ZPOOL_STATUS_BAD_LOG:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("An intent log record "
	"could not be read.\n"
	"\tWaiting for administrator intervention to fix the "
	"faulted pool.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Either restore the affected "
	"device(s) and run 'zpool online',\n"
	"\tor ignore the intent log records by running "
	"'zpool clear'.\n"));
	break;

	case ZPOOL_STATUS_NON_NATIVE_ASHIFT:
	(void) printf(gettext("status: One or more devices are "
	"configured to use a non-native block size.\n"
	"\tExpect reduced performance.\n"));
	(void) printf(gettext("action: Replace affected devices with "
	"devices that support the\n\tconfigured block size, or "
	"migrate data to a properly configured\n\tpool.\n"));
	break;

	case ZPOOL_STATUS_HOSTID_MISMATCH:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("Mismatch between pool hostid"
	" and system hostid on imported pool.\n\tThis pool was "
	"previously imported into a system with a different "
	"hostid,\n\tand then was verbatim imported into this "
	"system.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("Export this pool on all "
	"systems on which it is imported.\n"
	"\tThen import it to correct the mismatch.\n"));
	break;

	case ZPOOL_STATUS_ERRATA:
	printf_color(ANSI_BOLD, gettext("status: "));
	printf_color(ANSI_YELLOW, gettext("Errata #%d detected.\n"),
	errata);

	switch (errata) {
	case ZPOOL_ERRATA_NONE:
	break;

	case ZPOOL_ERRATA_ZOL_2094_SCRUB:
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("To correct the issue"
	" run 'zpool scrub'.\n"));
	break;

	case ZPOOL_ERRATA_ZOL_6845_ENCRYPTION:
	(void) printf(gettext("\tExisting encrypted datasets "
	"contain an on-disk incompatibility\n\twhich "
	"needs to be corrected.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("To correct the issue"
	" backup existing encrypted datasets to new\n\t"
	"encrypted datasets and destroy the old ones. "
	"'zfs mount -o ro' can\n\tbe used to temporarily "
	"mount existing encrypted datasets readonly.\n"));
	break;

	case ZPOOL_ERRATA_ZOL_8308_ENCRYPTION:
	(void) printf(gettext("\tExisting encrypted snapshots "
	"and bookmarks contain an on-disk\n\tincompat"
	"ibility. This may cause on-disk corruption if "
	"they are used\n\twith 'zfs recv'.\n"));
	printf_color(ANSI_BOLD, gettext("action: "));
	printf_color(ANSI_YELLOW, gettext("To correct the"
	"issue, enable the bookmark_v2 feature. No "
	"additional\n\taction is needed if there are no "
	"encrypted snapshots or bookmarks.\n\tIf preserving"
	"the encrypted snapshots and bookmarks is required,"
	" use\n\ta non-raw send to backup and restore them."
	" Alternately, they may be\n\tremoved to resolve "
	"the incompatibility.\n"));
	break;

	default:
	/*
	* All errata which allow the pool to be imported
	* must contain an action message.
	*/
	assert(0);
	}
	break;

	default:
	/*
	* The remaining errors can't actually be generated, yet.
	*/
	assert(reason == ZPOOL_STATUS_OK);
	}

	if (msgid != NULL) {
	printf(" ");
	printf_color(ANSI_BOLD, gettext("see:"));
	printf(gettext(
	" https://openzfs.github.io/openzfs-docs/msg/%s\n"),
	msgid);
	}

	if (config != NULL) {
	uint64_t nerr;
	nvlist_t spares, l2cache;
	uint_t nspares, nl2cache;
	pool_checkpoint_stat_t *pcs = NULL;
	pool_removal_stat_t *prs = NULL;

	print_scan_status(zhp, nvroot);

	(void) nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_REMOVAL_STATS, (uint64_t **)&prs, &c);
	print_removal_status(zhp, prs);

	(void) nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_CHECKPOINT_STATS, (uint64_t **)&pcs, &c);
	print_checkpoint_status(pcs);

	cbp->cb_namewidth = max_width(zhp, nvroot, 0, 0,
	cbp->cb_name_flags \| VDEV_NAME_TYPE_ID);
	if (cbp->cb_namewidth < 10)
	cbp->cb_namewidth = 10;

	color_start(ANSI_BOLD);
	(void) printf(gettext("config:\n\n"));
	(void) printf(gettext("\t%-*s %-8s %5s %5s %5s"),
	cbp->cb_namewidth, "NAME", "STATE", "READ", "WRITE",
	"CKSUM");
	color_end();

	if (cbp->cb_print_slow_ios) {
	printf_color(ANSI_BOLD, " %5s", gettext("SLOW"));
	}

	if (cbp->vcdl != NULL)
	print_cmd_columns(cbp->vcdl, 0);

	printf("\n");

	print_status_config(zhp, cbp, zpool_get_name(zhp), nvroot, 0,
	B_FALSE, NULL);

	print_class_vdevs(zhp, cbp, nvroot, VDEV_ALLOC_BIAS_DEDUP);
	print_class_vdevs(zhp, cbp, nvroot, VDEV_ALLOC_BIAS_SPECIAL);
	print_class_vdevs(zhp, cbp, nvroot, VDEV_ALLOC_CLASS_LOGS);

	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_L2CACHE,
	&l2cache, &nl2cache) == 0)
	print_l2cache(zhp, cbp, l2cache, nl2cache);

	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_SPARES,
	&spares, &nspares) == 0)
	print_spares(zhp, cbp, spares, nspares);

	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_ERRCOUNT,
	&nerr) == 0) {
	nvlist_t *nverrlist = NULL;

	/*
	* If the approximate error count is small, get a
	* precise count by fetching the entire log and
	* uniquifying the results.
	*/
	if (nerr > 0 && nerr < 100 && !cbp->cb_verbose &&
	zpool_get_errlog(zhp, &nverrlist) == 0) {
	nvpair_t *elem;

	elem = NULL;
	nerr = 0;
	while ((elem = nvlist_next_nvpair(nverrlist,
	elem)) != NULL) {
	nerr++;
	}
	}
	nvlist_free(nverrlist);

	(void) printf("\n");

	if (nerr == 0)
	(void) printf(gettext("errors: No known data "
	"errors\n"));
	else if (!cbp->cb_verbose)
	(void) printf(gettext("errors: %llu data "
	"errors, use '-v' for a list\n"),
	(u_longlong_t)nerr);
	else
	print_error_log(zhp);
	}

	if (cbp->cb_dedup_stats)
	print_dedup_stats(config);
	} else {
	(void) printf(gettext("config: The configuration cannot be "
	"determined.\n"));
	}

	return (0);
	}

	/*
	* zpool status [-c [script1,script2,...]] [-igLpPstvx] [-T d\|u] [pool] ...
	* [interval [count]]
	*
	* -c CMD For each vdev, run command CMD
	* -i Display vdev initialization status.
	* -g Display guid for individual vdev name.
	* -L Follow links when resolving vdev path name.
	* -p Display values in parsable (exact) format.
	* -P Display full path for vdev name.
	* -s Display slow IOs column.
	* -v Display complete error logs
	* -x Display only pools with potential problems
	* -D Display dedup status (undocumented)
	* -t Display vdev TRIM status.
	* -T Display a timestamp in date(1) or Unix format
	*
	* Describes the health status of all pools or some subset.
	*/
	int
	zpool_do_status(int argc, char **argv)
	{
	int c;
	int ret;
	float interval = 0;
	unsigned long count = 0;
	status_cbdata_t cb = { 0 };
	char *cmd = NULL;

	/* check options */
	while ((c = getopt(argc, argv, "c:igLpPsvxDtT:")) != -1) {
	switch (c) {
	case 'c':
	if (cmd != NULL) {
	fprintf(stderr,
	gettext("Can't set -c flag twice\n"));
	exit(1);
	}

	if (getenv("ZPOOL_SCRIPTS_ENABLED") != NULL &&
	!libzfs_envvar_is_set("ZPOOL_SCRIPTS_ENABLED")) {
	fprintf(stderr, gettext(
	"Can't run -c, disabled by "
	"ZPOOL_SCRIPTS_ENABLED.\n"));
	exit(1);
	}

	if ((getuid() <= 0 \|\| geteuid() <= 0) &&
	!libzfs_envvar_is_set("ZPOOL_SCRIPTS_AS_ROOT")) {
	fprintf(stderr, gettext(
	"Can't run -c with root privileges "
	"unless ZPOOL_SCRIPTS_AS_ROOT is set.\n"));
	exit(1);
	}
	cmd = optarg;
	break;
	case 'i':
	cb.cb_print_vdev_init = B_TRUE;
	break;
	case 'g':
	cb.cb_name_flags \|= VDEV_NAME_GUID;
	break;
	case 'L':
	cb.cb_name_flags \|= VDEV_NAME_FOLLOW_LINKS;
	break;
	case 'p':
	cb.cb_literal = B_TRUE;
	break;
	case 'P':
	cb.cb_name_flags \|= VDEV_NAME_PATH;
	break;
	case 's':
	cb.cb_print_slow_ios = B_TRUE;
	break;
	case 'v':
	cb.cb_verbose = B_TRUE;
	break;
	case 'x':
	cb.cb_explain = B_TRUE;
	break;
	case 'D':
	cb.cb_dedup_stats = B_TRUE;
	break;
	case 't':
	cb.cb_print_vdev_trim = B_TRUE;
	break;
	case 'T':
	get_timestamp_arg(*optarg);
	break;
	case '?':
	if (optopt == 'c') {
	print_zpool_script_list("status");
	exit(0);
	} else {
	fprintf(stderr,
	gettext("invalid option '%c'\n"), optopt);
	}
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	get_interval_count(&argc, argv, &interval, &count);

	if (argc == 0)
	cb.cb_allpools = B_TRUE;

	cb.cb_first = B_TRUE;
	cb.cb_print_status = B_TRUE;

	for (;;) {
	if (timestamp_fmt != NODATE)
	print_timestamp(timestamp_fmt);

	if (cmd != NULL)
	cb.vcdl = all_pools_for_each_vdev_run(argc, argv, cmd,
	NULL, NULL, 0, 0);

	ret = for_each_pool(argc, argv, B_TRUE, NULL,
	status_callback, &cb);

	if (cb.vcdl != NULL)
	free_vdev_cmd_data_list(cb.vcdl);

	if (argc == 0 && cb.cb_count == 0)
	(void) fprintf(stderr, gettext("no pools available\n"));
	else if (cb.cb_explain && cb.cb_first && cb.cb_allpools)
	(void) printf(gettext("all pools are healthy\n"));

	if (ret != 0)
	return (ret);

	if (interval == 0)
	break;

	if (count != 0 && --count == 0)
	break;

	(void) fsleep(interval);
	}

	return (0);
	}

	typedef struct upgrade_cbdata {
	int cb_first;
	int cb_argc;
	uint64_t cb_version;
	char **cb_argv;
	} upgrade_cbdata_t;

	static int
	check_unsupp_fs(zfs_handle_t zhp, void unsupp_fs)
	{
	int zfs_version = (int)zfs_prop_get_int(zhp, ZFS_PROP_VERSION);
	int count = (int )unsupp_fs;

	if (zfs_version > ZPL_VERSION) {
	(void) printf(gettext("%s (v%d) is not supported by this "
	"implementation of ZFS.\n"),
	zfs_get_name(zhp), zfs_version);
	(*count)++;
	}

	zfs_iter_filesystems(zhp, check_unsupp_fs, unsupp_fs);

	zfs_close(zhp);

	return (0);
	}

	static int
	upgrade_version(zpool_handle_t *zhp, uint64_t version)
	{
	int ret;
	nvlist_t *config;
	uint64_t oldversion;
	int unsupp_fs = 0;

	config = zpool_get_config(zhp, NULL);
	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION,
	&oldversion) == 0);

	assert(SPA_VERSION_IS_SUPPORTED(oldversion));
	assert(oldversion < version);

	ret = zfs_iter_root(zpool_get_handle(zhp), check_unsupp_fs, &unsupp_fs);
	if (ret != 0)
	return (ret);

	if (unsupp_fs) {
	(void) fprintf(stderr, gettext("Upgrade not performed due "
	"to %d unsupported filesystems (max v%d).\n"),
	unsupp_fs, (int)ZPL_VERSION);
	return (1);
	}

	ret = zpool_upgrade(zhp, version);
	if (ret != 0)
	return (ret);

	if (version >= SPA_VERSION_FEATURES) {
	(void) printf(gettext("Successfully upgraded "
	"'%s' from version %llu to feature flags.\n"),
	zpool_get_name(zhp), (u_longlong_t)oldversion);
	} else {
	(void) printf(gettext("Successfully upgraded "
	"'%s' from version %llu to version %llu.\n"),
	zpool_get_name(zhp), (u_longlong_t)oldversion,
	(u_longlong_t)version);
	}

	return (0);
	}

	static int
	upgrade_enable_all(zpool_handle_t zhp, int countp)
	{
	int i, ret, count;
	boolean_t firstff = B_TRUE;
	nvlist_t *enabled = zpool_get_features(zhp);

	count = 0;
	for (i = 0; i < SPA_FEATURES; i++) {
	const char *fname = spa_feature_table[i].fi_uname;
	const char *fguid = spa_feature_table[i].fi_guid;
	if (!nvlist_exists(enabled, fguid)) {
	char *propname;
	verify(-1 != asprintf(&propname, "feature@%s", fname));
	ret = zpool_set_prop(zhp, propname,
	ZFS_FEATURE_ENABLED);
	if (ret != 0) {
	free(propname);
	return (ret);
	}
	count++;

	if (firstff) {
	(void) printf(gettext("Enabled the "
	"following features on '%s':\n"),
	zpool_get_name(zhp));
	firstff = B_FALSE;
	}
	(void) printf(gettext(" %s\n"), fname);
	free(propname);
	}
	}

	if (countp != NULL)
	*countp = count;
	return (0);
	}

	static int
	upgrade_cb(zpool_handle_t zhp, void arg)
	{
	upgrade_cbdata_t *cbp = arg;
	nvlist_t *config;
	uint64_t version;
	boolean_t printnl = B_FALSE;
	int ret;

	config = zpool_get_config(zhp, NULL);
	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION,
	&version) == 0);

	assert(SPA_VERSION_IS_SUPPORTED(version));

	if (version < cbp->cb_version) {
	cbp->cb_first = B_FALSE;
	ret = upgrade_version(zhp, cbp->cb_version);
	if (ret != 0)
	return (ret);
	printnl = B_TRUE;

	/*
	* If they did "zpool upgrade -a", then we could
	* be doing ioctls to different pools. We need
	* to log this history once to each pool, and bypass
	* the normal history logging that happens in main().
	*/
	(void) zpool_log_history(g_zfs, history_str);
	log_history = B_FALSE;
	}

	if (cbp->cb_version >= SPA_VERSION_FEATURES) {
	int count;
	ret = upgrade_enable_all(zhp, &count);
	if (ret != 0)
	return (ret);

	if (count > 0) {
	cbp->cb_first = B_FALSE;
	printnl = B_TRUE;
	}
	}

	if (printnl) {
	(void) printf(gettext("\n"));
	}

	return (0);
	}

	static int
	upgrade_list_older_cb(zpool_handle_t zhp, void arg)
	{
	upgrade_cbdata_t *cbp = arg;
	nvlist_t *config;
	uint64_t version;

	config = zpool_get_config(zhp, NULL);
	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION,
	&version) == 0);

	assert(SPA_VERSION_IS_SUPPORTED(version));

	if (version < SPA_VERSION_FEATURES) {
	if (cbp->cb_first) {
	(void) printf(gettext("The following pools are "
	"formatted with legacy version numbers and can\n"
	"be upgraded to use feature flags. After "
	"being upgraded, these pools\nwill no "
	"longer be accessible by software that does not "
	"support feature\nflags.\n\n"));
	(void) printf(gettext("VER POOL\n"));
	(void) printf(gettext("--- ------------\n"));
	cbp->cb_first = B_FALSE;
	}

	(void) printf("%2llu %s\n", (u_longlong_t)version,
	zpool_get_name(zhp));
	}

	return (0);
	}

	static int
	upgrade_list_disabled_cb(zpool_handle_t zhp, void arg)
	{
	upgrade_cbdata_t *cbp = arg;
	nvlist_t *config;
	uint64_t version;

	config = zpool_get_config(zhp, NULL);
	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION,
	&version) == 0);

	if (version >= SPA_VERSION_FEATURES) {
	int i;
	boolean_t poolfirst = B_TRUE;
	nvlist_t *enabled = zpool_get_features(zhp);

	for (i = 0; i < SPA_FEATURES; i++) {
	const char *fguid = spa_feature_table[i].fi_guid;
	const char *fname = spa_feature_table[i].fi_uname;
	if (!nvlist_exists(enabled, fguid)) {
	if (cbp->cb_first) {
	(void) printf(gettext("\nSome "
	"supported features are not "
	"enabled on the following pools. "
	"Once a\nfeature is enabled the "
	"pool may become incompatible with "
	"software\nthat does not support "
	"the feature. See "
	"zpool-features(5) for "
	"details.\n\n"));
	(void) printf(gettext("POOL "
	"FEATURE\n"));
	(void) printf(gettext("------"
	"---------\n"));
	cbp->cb_first = B_FALSE;
	}

	if (poolfirst) {
	(void) printf(gettext("%s\n"),
	zpool_get_name(zhp));
	poolfirst = B_FALSE;
	}

	(void) printf(gettext(" %s\n"), fname);
	}
	/*
	* If they did "zpool upgrade -a", then we could
	* be doing ioctls to different pools. We need
	* to log this history once to each pool, and bypass
	* the normal history logging that happens in main().
	*/
	(void) zpool_log_history(g_zfs, history_str);
	log_history = B_FALSE;
	}
	}

	return (0);
	}

	/* ARGSUSED */
	static int
	upgrade_one(zpool_handle_t zhp, void data)
	{
	boolean_t printnl = B_FALSE;
	upgrade_cbdata_t *cbp = data;
	uint64_t cur_version;
	int ret;

	if (strcmp("log", zpool_get_name(zhp)) == 0) {
	(void) fprintf(stderr, gettext("'log' is now a reserved word\n"
	"Pool 'log' must be renamed using export and import"
	" to upgrade.\n"));
	return (1);
	}

	cur_version = zpool_get_prop_int(zhp, ZPOOL_PROP_VERSION, NULL);
	if (cur_version > cbp->cb_version) {
	(void) printf(gettext("Pool '%s' is already formatted "
	"using more current version '%llu'.\n\n"),
	zpool_get_name(zhp), (u_longlong_t)cur_version);
	return (0);
	}

	if (cbp->cb_version != SPA_VERSION && cur_version == cbp->cb_version) {
	(void) printf(gettext("Pool '%s' is already formatted "
	"using version %llu.\n\n"), zpool_get_name(zhp),
	(u_longlong_t)cbp->cb_version);
	return (0);
	}

	if (cur_version != cbp->cb_version) {
	printnl = B_TRUE;
	ret = upgrade_version(zhp, cbp->cb_version);
	if (ret != 0)
	return (ret);
	}

	if (cbp->cb_version >= SPA_VERSION_FEATURES) {
	int count = 0;
	ret = upgrade_enable_all(zhp, &count);
	if (ret != 0)
	return (ret);

	if (count != 0) {
	printnl = B_TRUE;
	} else if (cur_version == SPA_VERSION) {
	(void) printf(gettext("Pool '%s' already has all "
	"supported features enabled.\n"),
	zpool_get_name(zhp));
	}
	}

	if (printnl) {
	(void) printf(gettext("\n"));
	}

	return (0);
	}

	/*
	* zpool upgrade
	* zpool upgrade -v
	* zpool upgrade [-V version] <-a \| pool ...>
	*
	* With no arguments, display downrev'd ZFS pool available for upgrade.
	* Individual pools can be upgraded by specifying the pool, and '-a' will
	* upgrade all pools.
	*/
	int
	zpool_do_upgrade(int argc, char **argv)
	{
	int c;
	upgrade_cbdata_t cb = { 0 };
	int ret = 0;
	boolean_t showversions = B_FALSE;
	boolean_t upgradeall = B_FALSE;
	char *end;


	/* check options */
	while ((c = getopt(argc, argv, ":avV:")) != -1) {
	switch (c) {
	case 'a':
	upgradeall = B_TRUE;
	break;
	case 'v':
	showversions = B_TRUE;
	break;
	case 'V':
	cb.cb_version = strtoll(optarg, &end, 10);
	if (*end != '\0' \|\|
	!SPA_VERSION_IS_SUPPORTED(cb.cb_version)) {
	(void) fprintf(stderr,
	gettext("invalid version '%s'\n"), optarg);
	usage(B_FALSE);
	}
	break;
	case ':':
	(void) fprintf(stderr, gettext("missing argument for "
	"'%c' option\n"), optopt);
	usage(B_FALSE);
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	cb.cb_argc = argc;
	cb.cb_argv = argv;
	argc -= optind;
	argv += optind;

	if (cb.cb_version == 0) {
	cb.cb_version = SPA_VERSION;
	} else if (!upgradeall && argc == 0) {
	(void) fprintf(stderr, gettext("-V option is "
	"incompatible with other arguments\n"));
	usage(B_FALSE);
	}

	if (showversions) {
	if (upgradeall \|\| argc != 0) {
	(void) fprintf(stderr, gettext("-v option is "
	"incompatible with other arguments\n"));
	usage(B_FALSE);
	}
	} else if (upgradeall) {
	if (argc != 0) {
	(void) fprintf(stderr, gettext("-a option should not "
	"be used along with a pool name\n"));
	usage(B_FALSE);
	}
	}

	(void) printf(gettext("This system supports ZFS pool feature "
	"flags.\n\n"));
	if (showversions) {
	int i;

	(void) printf(gettext("The following features are "
	"supported:\n\n"));
	(void) printf(gettext("FEAT DESCRIPTION\n"));
	(void) printf("----------------------------------------------"
	"---------------\n");
	for (i = 0; i < SPA_FEATURES; i++) {
	zfeature_info_t *fi = &spa_feature_table[i];
	const char *ro =
	(fi->fi_flags & ZFEATURE_FLAG_READONLY_COMPAT) ?
	" (read-only compatible)" : "";

	(void) printf("%-37s%s\n", fi->fi_uname, ro);
	(void) printf(" %s\n", fi->fi_desc);
	}
	(void) printf("\n");

	(void) printf(gettext("The following legacy versions are also "
	"supported:\n\n"));
	(void) printf(gettext("VER DESCRIPTION\n"));
	(void) printf("--- -----------------------------------------"
	"---------------\n");
	(void) printf(gettext(" 1 Initial ZFS version\n"));
	(void) printf(gettext(" 2 Ditto blocks "
	"(replicated metadata)\n"));
	(void) printf(gettext(" 3 Hot spares and double parity "
	"RAID-Z\n"));
	(void) printf(gettext(" 4 zpool history\n"));
	(void) printf(gettext(" 5 Compression using the gzip "
	"algorithm\n"));
	(void) printf(gettext(" 6 bootfs pool property\n"));
	(void) printf(gettext(" 7 Separate intent log devices\n"));
	(void) printf(gettext(" 8 Delegated administration\n"));
	(void) printf(gettext(" 9 refquota and refreservation "
	"properties\n"));
	(void) printf(gettext(" 10 Cache devices\n"));
	(void) printf(gettext(" 11 Improved scrub performance\n"));
	(void) printf(gettext(" 12 Snapshot properties\n"));
	(void) printf(gettext(" 13 snapused property\n"));
	(void) printf(gettext(" 14 passthrough-x aclinherit\n"));
	(void) printf(gettext(" 15 user/group space accounting\n"));
	(void) printf(gettext(" 16 stmf property support\n"));
	(void) printf(gettext(" 17 Triple-parity RAID-Z\n"));
	(void) printf(gettext(" 18 Snapshot user holds\n"));
	(void) printf(gettext(" 19 Log device removal\n"));
	(void) printf(gettext(" 20 Compression using zle "
	"(zero-length encoding)\n"));
	(void) printf(gettext(" 21 Deduplication\n"));
	(void) printf(gettext(" 22 Received properties\n"));
	(void) printf(gettext(" 23 Slim ZIL\n"));
	(void) printf(gettext(" 24 System attributes\n"));
	(void) printf(gettext(" 25 Improved scrub stats\n"));
	(void) printf(gettext(" 26 Improved snapshot deletion "
	"performance\n"));
	(void) printf(gettext(" 27 Improved snapshot creation "
	"performance\n"));
	(void) printf(gettext(" 28 Multiple vdev replacements\n"));
	(void) printf(gettext("\nFor more information on a particular "
	"version, including supported releases,\n"));
	(void) printf(gettext("see the ZFS Administration Guide.\n\n"));
	} else if (argc == 0 && upgradeall) {
	cb.cb_first = B_TRUE;
	ret = zpool_iter(g_zfs, upgrade_cb, &cb);
	if (ret == 0 && cb.cb_first) {
	if (cb.cb_version == SPA_VERSION) {
	(void) printf(gettext("All pools are already "
	"formatted using feature flags.\n\n"));
	(void) printf(gettext("Every feature flags "
	"pool already has all supported features "
	"enabled.\n"));
	} else {
	(void) printf(gettext("All pools are already "
	"formatted with version %llu or higher.\n"),
	(u_longlong_t)cb.cb_version);
	}
	}
	} else if (argc == 0) {
	cb.cb_first = B_TRUE;
	ret = zpool_iter(g_zfs, upgrade_list_older_cb, &cb);
	assert(ret == 0);

	if (cb.cb_first) {
	(void) printf(gettext("All pools are formatted "
	"using feature flags.\n\n"));
	} else {
	(void) printf(gettext("\nUse 'zpool upgrade -v' "
	"for a list of available legacy versions.\n"));
	}

	cb.cb_first = B_TRUE;
	ret = zpool_iter(g_zfs, upgrade_list_disabled_cb, &cb);
	assert(ret == 0);

	if (cb.cb_first) {
	(void) printf(gettext("Every feature flags pool has "
	"all supported features enabled.\n"));
	} else {
	(void) printf(gettext("\n"));
	}
	} else {
	ret = for_each_pool(argc, argv, B_FALSE, NULL,
	upgrade_one, &cb);
	}

	return (ret);
	}

	typedef struct hist_cbdata {
	boolean_t first;
	boolean_t longfmt;
	boolean_t internal;
	} hist_cbdata_t;

	static void
	print_history_records(nvlist_t nvhis, hist_cbdata_t cb)
	{
	nvlist_t **records;
	uint_t numrecords;
	int i;

	verify(nvlist_lookup_nvlist_array(nvhis, ZPOOL_HIST_RECORD,
	&records, &numrecords) == 0);
	for (i = 0; i < numrecords; i++) {
	nvlist_t *rec = records[i];
	char tbuf[30] = "";

	if (nvlist_exists(rec, ZPOOL_HIST_TIME)) {
	time_t tsec;
	struct tm t;

	tsec = fnvlist_lookup_uint64(records[i],
	ZPOOL_HIST_TIME);
	(void) localtime_r(&tsec, &t);
	(void) strftime(tbuf, sizeof (tbuf), "%F.%T", &t);
	}

	if (nvlist_exists(rec, ZPOOL_HIST_CMD)) {
	(void) printf("%s %s", tbuf,
	fnvlist_lookup_string(rec, ZPOOL_HIST_CMD));
	} else if (nvlist_exists(rec, ZPOOL_HIST_INT_EVENT)) {
	int ievent =
	fnvlist_lookup_uint64(rec, ZPOOL_HIST_INT_EVENT);
	if (!cb->internal)
	continue;
	if (ievent >= ZFS_NUM_LEGACY_HISTORY_EVENTS) {
	(void) printf("%s unrecognized record:\n",
	tbuf);
	dump_nvlist(rec, 4);
	continue;
	}
	(void) printf("%s [internal %s txg:%lld] %s", tbuf,
	zfs_history_event_names[ievent],
	(longlong_t)fnvlist_lookup_uint64(
	rec, ZPOOL_HIST_TXG),
	fnvlist_lookup_string(rec, ZPOOL_HIST_INT_STR));
	} else if (nvlist_exists(rec, ZPOOL_HIST_INT_NAME)) {
	if (!cb->internal)
	continue;
	(void) printf("%s [txg:%lld] %s", tbuf,
	(longlong_t)fnvlist_lookup_uint64(
	rec, ZPOOL_HIST_TXG),
	fnvlist_lookup_string(rec, ZPOOL_HIST_INT_NAME));
	if (nvlist_exists(rec, ZPOOL_HIST_DSNAME)) {
	(void) printf(" %s (%llu)",
	fnvlist_lookup_string(rec,
	ZPOOL_HIST_DSNAME),
	(u_longlong_t)fnvlist_lookup_uint64(rec,
	ZPOOL_HIST_DSID));
	}
	(void) printf(" %s", fnvlist_lookup_string(rec,
	ZPOOL_HIST_INT_STR));
	} else if (nvlist_exists(rec, ZPOOL_HIST_IOCTL)) {
	if (!cb->internal)
	continue;
	(void) printf("%s ioctl %s\n", tbuf,
	fnvlist_lookup_string(rec, ZPOOL_HIST_IOCTL));
	if (nvlist_exists(rec, ZPOOL_HIST_INPUT_NVL)) {
	(void) printf(" input:\n");
	dump_nvlist(fnvlist_lookup_nvlist(rec,
	ZPOOL_HIST_INPUT_NVL), 8);
	}
	if (nvlist_exists(rec, ZPOOL_HIST_OUTPUT_NVL)) {
	(void) printf(" output:\n");
	dump_nvlist(fnvlist_lookup_nvlist(rec,
	ZPOOL_HIST_OUTPUT_NVL), 8);
	}
	if (nvlist_exists(rec, ZPOOL_HIST_ERRNO)) {
	(void) printf(" errno: %lld\n",
	(longlong_t)fnvlist_lookup_int64(rec,
	ZPOOL_HIST_ERRNO));
	}
	} else {
	if (!cb->internal)
	continue;
	(void) printf("%s unrecognized record:\n", tbuf);
	dump_nvlist(rec, 4);
	}

	if (!cb->longfmt) {
	(void) printf("\n");
	continue;
	}
	(void) printf(" [");
	if (nvlist_exists(rec, ZPOOL_HIST_WHO)) {
	uid_t who = fnvlist_lookup_uint64(rec, ZPOOL_HIST_WHO);
	struct passwd *pwd = getpwuid(who);
	(void) printf("user %d ", (int)who);
	if (pwd != NULL)
	(void) printf("(%s) ", pwd->pw_name);
	}
	if (nvlist_exists(rec, ZPOOL_HIST_HOST)) {
	(void) printf("on %s",
	fnvlist_lookup_string(rec, ZPOOL_HIST_HOST));
	}
	if (nvlist_exists(rec, ZPOOL_HIST_ZONE)) {
	(void) printf(":%s",
	fnvlist_lookup_string(rec, ZPOOL_HIST_ZONE));
	}

	(void) printf("]");
	(void) printf("\n");
	}
	}

	/*
	* Print out the command history for a specific pool.
	*/
	static int
	get_history_one(zpool_handle_t zhp, void data)
	{
	nvlist_t *nvhis;
	int ret;
	hist_cbdata_t cb = (hist_cbdata_t )data;
	uint64_t off = 0;
	boolean_t eof = B_FALSE;

	cb->first = B_FALSE;

	(void) printf(gettext("History for '%s':\n"), zpool_get_name(zhp));

	while (!eof) {
	if ((ret = zpool_get_history(zhp, &nvhis, &off, &eof)) != 0)
	return (ret);

	print_history_records(nvhis, cb);
	nvlist_free(nvhis);
	}
	(void) printf("\n");

	return (ret);
	}

	/*
	* zpool history <pool>
	*
	* Displays the history of commands that modified pools.
	*/
	int
	zpool_do_history(int argc, char **argv)
	{
	hist_cbdata_t cbdata = { 0 };
	int ret;
	int c;

	cbdata.first = B_TRUE;
	/* check options */
	while ((c = getopt(argc, argv, "li")) != -1) {
	switch (c) {
	case 'l':
	cbdata.longfmt = B_TRUE;
	break;
	case 'i':
	cbdata.internal = B_TRUE;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}
	argc -= optind;
	argv += optind;

	ret = for_each_pool(argc, argv, B_FALSE, NULL, get_history_one,
	&cbdata);

	if (argc == 0 && cbdata.first == B_TRUE) {
	(void) fprintf(stderr, gettext("no pools available\n"));
	return (0);
	}

	return (ret);
	}

	typedef struct ev_opts {
	int verbose;
	int scripted;
	int follow;
	int clear;
	char poolname[ZFS_MAX_DATASET_NAME_LEN];
	} ev_opts_t;

	static void
	zpool_do_events_short(nvlist_t nvl, ev_opts_t opts)
	{
	char ctime_str[26], str[32], *ptr;
	int64_t *tv;
	uint_t n;

	verify(nvlist_lookup_int64_array(nvl, FM_EREPORT_TIME, &tv, &n) == 0);
	memset(str, ' ', 32);
	(void) ctime_r((const time_t *)&tv[0], ctime_str);
	(void) memcpy(str, ctime_str+4, 6); /* 'Jun 30' */
	(void) memcpy(str+7, ctime_str+20, 4); /* '1993' */
	(void) memcpy(str+12, ctime_str+11, 8); /* '21:49:08' */
	(void) sprintf(str+20, ".%09lld", (longlong_t)tv[1]); /* '.123456789' */
	if (opts->scripted)
	(void) printf(gettext("%s\t"), str);
	else
	(void) printf(gettext("%s "), str);

	verify(nvlist_lookup_string(nvl, FM_CLASS, &ptr) == 0);
	(void) printf(gettext("%s\n"), ptr);
	}

	static void
	zpool_do_events_nvprint(nvlist_t *nvl, int depth)
	{
	nvpair_t *nvp;

	for (nvp = nvlist_next_nvpair(nvl, NULL);
	nvp != NULL; nvp = nvlist_next_nvpair(nvl, nvp)) {

	data_type_t type = nvpair_type(nvp);
	const char *name = nvpair_name(nvp);

	boolean_t b;
	uint8_t i8;
	uint16_t i16;
	uint32_t i32;
	uint64_t i64;
	char *str;
	nvlist_t *cnv;

	printf(gettext("%*s%s = "), depth, "", name);

	switch (type) {
	case DATA_TYPE_BOOLEAN:
	printf(gettext("%s"), "1");
	break;

	case DATA_TYPE_BOOLEAN_VALUE:
	(void) nvpair_value_boolean_value(nvp, &b);
	printf(gettext("%s"), b ? "1" : "0");
	break;

	case DATA_TYPE_BYTE:
	(void) nvpair_value_byte(nvp, &i8);
	printf(gettext("0x%x"), i8);
	break;

	case DATA_TYPE_INT8:
	(void) nvpair_value_int8(nvp, (void *)&i8);
	printf(gettext("0x%x"), i8);
	break;

	case DATA_TYPE_UINT8:
	(void) nvpair_value_uint8(nvp, &i8);
	printf(gettext("0x%x"), i8);
	break;

	case DATA_TYPE_INT16:
	(void) nvpair_value_int16(nvp, (void *)&i16);
	printf(gettext("0x%x"), i16);
	break;

	case DATA_TYPE_UINT16:
	(void) nvpair_value_uint16(nvp, &i16);
	printf(gettext("0x%x"), i16);
	break;

	case DATA_TYPE_INT32:
	(void) nvpair_value_int32(nvp, (void *)&i32);
	printf(gettext("0x%x"), i32);
	break;

	case DATA_TYPE_UINT32:
	(void) nvpair_value_uint32(nvp, &i32);
	printf(gettext("0x%x"), i32);
	break;

	case DATA_TYPE_INT64:
	(void) nvpair_value_int64(nvp, (void *)&i64);
	printf(gettext("0x%llx"), (u_longlong_t)i64);
	break;

	case DATA_TYPE_UINT64:
	(void) nvpair_value_uint64(nvp, &i64);
	/*
	* translate vdev state values to readable
	* strings to aide zpool events consumers
	*/
	if (strcmp(name,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_STATE) == 0 \|\|
	strcmp(name,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_LASTSTATE) == 0) {
	printf(gettext("\"%s\" (0x%llx)"),
	zpool_state_to_name(i64, VDEV_AUX_NONE),
	(u_longlong_t)i64);
	} else {
	printf(gettext("0x%llx"), (u_longlong_t)i64);
	}
	break;

	case DATA_TYPE_HRTIME:
	(void) nvpair_value_hrtime(nvp, (void *)&i64);
	printf(gettext("0x%llx"), (u_longlong_t)i64);
	break;

	case DATA_TYPE_STRING:
	(void) nvpair_value_string(nvp, &str);
	printf(gettext("\"%s\""), str ? str : "<NULL>");
	break;

	case DATA_TYPE_NVLIST:
	printf(gettext("(embedded nvlist)\n"));
	(void) nvpair_value_nvlist(nvp, &cnv);
	zpool_do_events_nvprint(cnv, depth + 8);
	printf(gettext("%*s(end %s)"), depth, "", name);
	break;

	case DATA_TYPE_NVLIST_ARRAY: {
	nvlist_t **val;
	uint_t i, nelem;

	(void) nvpair_value_nvlist_array(nvp, &val, &nelem);
	printf(gettext("(%d embedded nvlists)\n"), nelem);
	for (i = 0; i < nelem; i++) {
	printf(gettext("%*s%s[%d] = %s\n"),
	depth, "", name, i, "(embedded nvlist)");
	zpool_do_events_nvprint(val[i], depth + 8);
	printf(gettext("%*s(end %s[%i])\n"),
	depth, "", name, i);
	}
	printf(gettext("%*s(end %s)\n"), depth, "", name);
	}
	break;

	case DATA_TYPE_INT8_ARRAY: {
	int8_t *val;
	uint_t i, nelem;

	(void) nvpair_value_int8_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("0x%x "), val[i]);

	break;
	}

	case DATA_TYPE_UINT8_ARRAY: {
	uint8_t *val;
	uint_t i, nelem;

	(void) nvpair_value_uint8_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("0x%x "), val[i]);

	break;
	}

	case DATA_TYPE_INT16_ARRAY: {
	int16_t *val;
	uint_t i, nelem;

	(void) nvpair_value_int16_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("0x%x "), val[i]);

	break;
	}

	case DATA_TYPE_UINT16_ARRAY: {
	uint16_t *val;
	uint_t i, nelem;

	(void) nvpair_value_uint16_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("0x%x "), val[i]);

	break;
	}

	case DATA_TYPE_INT32_ARRAY: {
	int32_t *val;
	uint_t i, nelem;

	(void) nvpair_value_int32_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("0x%x "), val[i]);

	break;
	}

	case DATA_TYPE_UINT32_ARRAY: {
	uint32_t *val;
	uint_t i, nelem;

	(void) nvpair_value_uint32_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("0x%x "), val[i]);

	break;
	}

	case DATA_TYPE_INT64_ARRAY: {
	int64_t *val;
	uint_t i, nelem;

	(void) nvpair_value_int64_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("0x%llx "),
	(u_longlong_t)val[i]);

	break;
	}

	case DATA_TYPE_UINT64_ARRAY: {
	uint64_t *val;
	uint_t i, nelem;

	(void) nvpair_value_uint64_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("0x%llx "),
	(u_longlong_t)val[i]);

	break;
	}

	case DATA_TYPE_STRING_ARRAY: {
	char **str;
	uint_t i, nelem;

	(void) nvpair_value_string_array(nvp, &str, &nelem);
	for (i = 0; i < nelem; i++)
	printf(gettext("\"%s\" "),
	str[i] ? str[i] : "<NULL>");

	break;
	}

	case DATA_TYPE_BOOLEAN_ARRAY:
	case DATA_TYPE_BYTE_ARRAY:
	case DATA_TYPE_DOUBLE:
	case DATA_TYPE_DONTCARE:
	case DATA_TYPE_UNKNOWN:
	printf(gettext("<unknown>"));
	break;
	}

	printf(gettext("\n"));
	}
	}

	static int
	zpool_do_events_next(ev_opts_t *opts)
	{
	nvlist_t *nvl;
	int zevent_fd, ret, dropped;
	char *pool;

	zevent_fd = open(ZFS_DEV, O_RDWR);
	VERIFY(zevent_fd >= 0);

	if (!opts->scripted)
	(void) printf(gettext("%-30s %s\n"), "TIME", "CLASS");

	while (1) {
	ret = zpool_events_next(g_zfs, &nvl, &dropped,
	(opts->follow ? ZEVENT_NONE : ZEVENT_NONBLOCK), zevent_fd);
	if (ret \|\| nvl == NULL)
	break;

	if (dropped > 0)
	(void) printf(gettext("dropped %d events\n"), dropped);

	if (strlen(opts->poolname) > 0 &&
	nvlist_lookup_string(nvl, FM_FMRI_ZFS_POOL, &pool) == 0 &&
	strcmp(opts->poolname, pool) != 0)
	continue;

	zpool_do_events_short(nvl, opts);

	if (opts->verbose) {
	zpool_do_events_nvprint(nvl, 8);
	printf(gettext("\n"));
	}
	(void) fflush(stdout);

	nvlist_free(nvl);
	}

	VERIFY(0 == close(zevent_fd));

	return (ret);
	}

	static int
	zpool_do_events_clear(ev_opts_t *opts)
	{
	int count, ret;

	ret = zpool_events_clear(g_zfs, &count);
	if (!ret)
	(void) printf(gettext("cleared %d events\n"), count);

	return (ret);
	}

	/*
	* zpool events [-vHf [pool] \| -c]
	*
	* Displays events logs by ZFS.
	*/
	int
	zpool_do_events(int argc, char **argv)
	{
	ev_opts_t opts = { 0 };
	int ret;
	int c;

	/* check options */
	while ((c = getopt(argc, argv, "vHfc")) != -1) {
	switch (c) {
	case 'v':
	opts.verbose = 1;
	break;
	case 'H':
	opts.scripted = 1;
	break;
	case 'f':
	opts.follow = 1;
	break;
	case 'c':
	opts.clear = 1;
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}
	argc -= optind;
	argv += optind;

	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	} else if (argc == 1) {
	(void) strlcpy(opts.poolname, argv[0], sizeof (opts.poolname));
	if (!zfs_name_valid(opts.poolname, ZFS_TYPE_POOL)) {
	(void) fprintf(stderr,
	gettext("invalid pool name '%s'\n"), opts.poolname);
	usage(B_FALSE);
	}
	}

	if ((argc == 1 \|\| opts.verbose \|\| opts.scripted \|\| opts.follow) &&
	opts.clear) {
	(void) fprintf(stderr,
	gettext("invalid options combined with -c\n"));
	usage(B_FALSE);
	}

	if (opts.clear)
	ret = zpool_do_events_clear(&opts);
	else
	ret = zpool_do_events_next(&opts);

	return (ret);
	}

	static int
	get_callback(zpool_handle_t zhp, void data)
	{
	zprop_get_cbdata_t cbp = (zprop_get_cbdata_t )data;
	char value[MAXNAMELEN];
	zprop_source_t srctype;
	zprop_list_t *pl;

	for (pl = cbp->cb_proplist; pl != NULL; pl = pl->pl_next) {

	/*
	* Skip the special fake placeholder. This will also skip
	* over the name property when 'all' is specified.
	*/
	if (pl->pl_prop == ZPOOL_PROP_NAME &&
	pl == cbp->cb_proplist)
	continue;

	if (pl->pl_prop == ZPROP_INVAL &&
	(zpool_prop_feature(pl->pl_user_prop) \|\|
	zpool_prop_unsupported(pl->pl_user_prop))) {
	srctype = ZPROP_SRC_LOCAL;

	if (zpool_prop_get_feature(zhp, pl->pl_user_prop,
	value, sizeof (value)) == 0) {
	zprop_print_one_property(zpool_get_name(zhp),
	cbp, pl->pl_user_prop, value, srctype,
	NULL, NULL);
	}
	} else {
	if (zpool_get_prop(zhp, pl->pl_prop, value,
	sizeof (value), &srctype, cbp->cb_literal) != 0)
	continue;

	zprop_print_one_property(zpool_get_name(zhp), cbp,
	zpool_prop_to_name(pl->pl_prop), value, srctype,
	NULL, NULL);
	}
	}
	return (0);
	}

	/*
	* zpool get [-Hp] [-o "all" \| field[,...]] <"all" \| property[,...]> <pool> ...
	*
	* -H Scripted mode. Don't display headers, and separate properties
	* by a single tab.
	* -o List of columns to display. Defaults to
	* "name,property,value,source".
	* -p Display values in parsable (exact) format.
	*
	* Get properties of pools in the system. Output space statistics
	* for each one as well as other attributes.
	*/
	int
	zpool_do_get(int argc, char **argv)
	{
	zprop_get_cbdata_t cb = { 0 };
	zprop_list_t fake_name = { 0 };
	int ret;
	int c, i;
	char *value;

	cb.cb_first = B_TRUE;

	/*
	* Set up default columns and sources.
	*/
	cb.cb_sources = ZPROP_SRC_ALL;
	cb.cb_columns[0] = GET_COL_NAME;
	cb.cb_columns[1] = GET_COL_PROPERTY;
	cb.cb_columns[2] = GET_COL_VALUE;
	cb.cb_columns[3] = GET_COL_SOURCE;
	cb.cb_type = ZFS_TYPE_POOL;

	/* check options */
	while ((c = getopt(argc, argv, ":Hpo:")) != -1) {
	switch (c) {
	case 'p':
	cb.cb_literal = B_TRUE;
	break;
	case 'H':
	cb.cb_scripted = B_TRUE;
	break;
	case 'o':
	bzero(&cb.cb_columns, sizeof (cb.cb_columns));
	i = 0;
	while (*optarg != '\0') {
	static char *col_subopts[] =
	{ "name", "property", "value", "source",
	"all", NULL };

	if (i == ZFS_GET_NCOLS) {
	(void) fprintf(stderr, gettext("too "
	"many fields given to -o "
	"option\n"));
	usage(B_FALSE);
	}

	switch (getsubopt(&optarg, col_subopts,
	&value)) {
	case 0:
	cb.cb_columns[i++] = GET_COL_NAME;
	break;
	case 1:
	cb.cb_columns[i++] = GET_COL_PROPERTY;
	break;
	case 2:
	cb.cb_columns[i++] = GET_COL_VALUE;
	break;
	case 3:
	cb.cb_columns[i++] = GET_COL_SOURCE;
	break;
	case 4:
	if (i > 0) {
	(void) fprintf(stderr,
	gettext("\"all\" conflicts "
	"with specific fields "
	"given to -o option\n"));
	usage(B_FALSE);
	}
	cb.cb_columns[0] = GET_COL_NAME;
	cb.cb_columns[1] = GET_COL_PROPERTY;
	cb.cb_columns[2] = GET_COL_VALUE;
	cb.cb_columns[3] = GET_COL_SOURCE;
	i = ZFS_GET_NCOLS;
	break;
	default:
	(void) fprintf(stderr,
	gettext("invalid column name "
	"'%s'\n"), value);
	usage(B_FALSE);
	}
	}
	break;
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing property "
	"argument\n"));
	usage(B_FALSE);
	}

	if (zprop_get_list(g_zfs, argv[0], &cb.cb_proplist,
	ZFS_TYPE_POOL) != 0)
	usage(B_FALSE);

	argc--;
	argv++;

	if (cb.cb_proplist != NULL) {
	fake_name.pl_prop = ZPOOL_PROP_NAME;
	fake_name.pl_width = strlen(gettext("NAME"));
	fake_name.pl_next = cb.cb_proplist;
	cb.cb_proplist = &fake_name;
	}

	ret = for_each_pool(argc, argv, B_TRUE, &cb.cb_proplist,
	get_callback, &cb);

	if (cb.cb_proplist == &fake_name)
	zprop_free_list(fake_name.pl_next);
	else
	zprop_free_list(cb.cb_proplist);

	return (ret);
	}

	typedef struct set_cbdata {
	char *cb_propname;
	char *cb_value;
	boolean_t cb_any_successful;
	} set_cbdata_t;

	static int
	set_callback(zpool_handle_t zhp, void data)
	{
	int error;
	set_cbdata_t cb = (set_cbdata_t )data;

	error = zpool_set_prop(zhp, cb->cb_propname, cb->cb_value);

	if (!error)
	cb->cb_any_successful = B_TRUE;

	return (error);
	}

	int
	zpool_do_set(int argc, char **argv)
	{
	set_cbdata_t cb = { 0 };
	int error;

	if (argc > 1 && argv[1][0] == '-') {
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	argv[1][1]);
	usage(B_FALSE);
	}

	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing property=value "
	"argument\n"));
	usage(B_FALSE);
	}

	if (argc < 3) {
	(void) fprintf(stderr, gettext("missing pool name\n"));
	usage(B_FALSE);
	}

	if (argc > 3) {
	(void) fprintf(stderr, gettext("too many pool names\n"));
	usage(B_FALSE);
	}

	cb.cb_propname = argv[1];
	cb.cb_value = strchr(cb.cb_propname, '=');
	if (cb.cb_value == NULL) {
	(void) fprintf(stderr, gettext("missing value in "
	"property=value argument\n"));
	usage(B_FALSE);
	}

	*(cb.cb_value) = '\0';
	cb.cb_value++;

	error = for_each_pool(argc - 2, argv + 2, B_TRUE, NULL,
	set_callback, &cb);

	return (error);
	}

	/* Add up the total number of bytes left to initialize/trim across all vdevs */
	static uint64_t
	vdev_activity_remaining(nvlist_t *nv, zpool_wait_activity_t activity)
	{
	uint64_t bytes_remaining;
	nvlist_t **child;
	uint_t c, children;
	vdev_stat_t *vs;

	assert(activity == ZPOOL_WAIT_INITIALIZE \|\|
	activity == ZPOOL_WAIT_TRIM);

	verify(nvlist_lookup_uint64_array(nv, ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t **)&vs, &c) == 0);

	if (activity == ZPOOL_WAIT_INITIALIZE &&
	vs->vs_initialize_state == VDEV_INITIALIZE_ACTIVE)
	bytes_remaining = vs->vs_initialize_bytes_est -
	vs->vs_initialize_bytes_done;
	else if (activity == ZPOOL_WAIT_TRIM &&
	vs->vs_trim_state == VDEV_TRIM_ACTIVE)
	bytes_remaining = vs->vs_trim_bytes_est -
	vs->vs_trim_bytes_done;
	else
	bytes_remaining = 0;

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	children = 0;

	for (c = 0; c < children; c++)
	bytes_remaining += vdev_activity_remaining(child[c], activity);

	return (bytes_remaining);
	}

	/* Add up the total number of bytes left to rebuild across top-level vdevs */
	static uint64_t
	vdev_activity_top_remaining(nvlist_t *nv)
	{
	uint64_t bytes_remaining = 0;
	nvlist_t **child;
	uint_t children;
	int error;

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	children = 0;

	for (uint_t c = 0; c < children; c++) {
	vdev_rebuild_stat_t *vrs;
	uint_t i;

	error = nvlist_lookup_uint64_array(child[c],
	ZPOOL_CONFIG_REBUILD_STATS, (uint64_t **)&vrs, &i);
	if (error == 0) {
	if (vrs->vrs_state == VDEV_REBUILD_ACTIVE) {
	bytes_remaining += (vrs->vrs_bytes_est -
	vrs->vrs_bytes_rebuilt);
	}
	}
	}

	return (bytes_remaining);
	}

	/* Whether any vdevs are 'spare' or 'replacing' vdevs */
	static boolean_t
	vdev_any_spare_replacing(nvlist_t *nv)
	{
	nvlist_t **child;
	uint_t c, children;
	char *vdev_type;

	(void) nvlist_lookup_string(nv, ZPOOL_CONFIG_TYPE, &vdev_type);

	if (strcmp(vdev_type, VDEV_TYPE_REPLACING) == 0 \|\|
	strcmp(vdev_type, VDEV_TYPE_SPARE) == 0) {
	return (B_TRUE);
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	children = 0;

	for (c = 0; c < children; c++) {
	if (vdev_any_spare_replacing(child[c]))
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	typedef struct wait_data {
	char *wd_poolname;
	boolean_t wd_scripted;
	boolean_t wd_exact;
	boolean_t wd_headers_once;
	boolean_t wd_should_exit;
	/* Which activities to wait for */
	boolean_t wd_enabled[ZPOOL_WAIT_NUM_ACTIVITIES];
	float wd_interval;
	pthread_cond_t wd_cv;
	pthread_mutex_t wd_mutex;
	} wait_data_t;

	/*
	* Print to stdout a single line, containing one column for each activity that
	* we are waiting for specifying how many bytes of work are left for that
	* activity.
	*/
	static void
	print_wait_status_row(wait_data_t wd, zpool_handle_t zhp, int row)
	{
	nvlist_t config, nvroot;
	uint_t c;
	int i;
	pool_checkpoint_stat_t *pcs = NULL;
	pool_scan_stat_t *pss = NULL;
	pool_removal_stat_t *prs = NULL;
	char *headers[] = {"DISCARD", "FREE", "INITIALIZE", "REPLACE",
	"REMOVE", "RESILVER", "SCRUB", "TRIM"};
	int col_widths[ZPOOL_WAIT_NUM_ACTIVITIES];

	/* Calculate the width of each column */
	for (i = 0; i < ZPOOL_WAIT_NUM_ACTIVITIES; i++) {
	/*
	* Make sure we have enough space in the col for pretty-printed
	* numbers and for the column header, and then leave a couple
	* spaces between cols for readability.
	*/
	col_widths[i] = MAX(strlen(headers[i]), 6) + 2;
	}

	/* Print header if appropriate */
	int term_height = terminal_height();
	boolean_t reprint_header = (!wd->wd_headers_once && term_height > 0 &&
	row % (term_height-1) == 0);
	if (!wd->wd_scripted && (row == 0 \|\| reprint_header)) {
	for (i = 0; i < ZPOOL_WAIT_NUM_ACTIVITIES; i++) {
	if (wd->wd_enabled[i])
	(void) printf("%*s", col_widths[i], headers[i]);
	}
	(void) printf("\n");
	}

	/* Bytes of work remaining in each activity */
	int64_t bytes_rem[ZPOOL_WAIT_NUM_ACTIVITIES] = {0};

	bytes_rem[ZPOOL_WAIT_FREE] =
	zpool_get_prop_int(zhp, ZPOOL_PROP_FREEING, NULL);

	config = zpool_get_config(zhp, NULL);
	nvroot = fnvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE);

	(void) nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_CHECKPOINT_STATS, (uint64_t **)&pcs, &c);
	if (pcs != NULL && pcs->pcs_state == CS_CHECKPOINT_DISCARDING)
	bytes_rem[ZPOOL_WAIT_CKPT_DISCARD] = pcs->pcs_space;

	(void) nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_REMOVAL_STATS, (uint64_t **)&prs, &c);
	if (prs != NULL && prs->prs_state == DSS_SCANNING)
	bytes_rem[ZPOOL_WAIT_REMOVE] = prs->prs_to_copy -
	prs->prs_copied;

	(void) nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_SCAN_STATS, (uint64_t **)&pss, &c);
	if (pss != NULL && pss->pss_state == DSS_SCANNING &&
	pss->pss_pass_scrub_pause == 0) {
	int64_t rem = pss->pss_to_examine - pss->pss_issued;
	if (pss->pss_func == POOL_SCAN_SCRUB)
	bytes_rem[ZPOOL_WAIT_SCRUB] = rem;
	else
	bytes_rem[ZPOOL_WAIT_RESILVER] = rem;
	} else if (check_rebuilding(nvroot, NULL)) {
	bytes_rem[ZPOOL_WAIT_RESILVER] =
	vdev_activity_top_remaining(nvroot);
	}

	bytes_rem[ZPOOL_WAIT_INITIALIZE] =
	vdev_activity_remaining(nvroot, ZPOOL_WAIT_INITIALIZE);
	bytes_rem[ZPOOL_WAIT_TRIM] =
	vdev_activity_remaining(nvroot, ZPOOL_WAIT_TRIM);

	/*
	* A replace finishes after resilvering finishes, so the amount of work
	* left for a replace is the same as for resilvering.
	*
	* It isn't quite correct to say that if we have any 'spare' or
	* 'replacing' vdevs and a resilver is happening, then a replace is in
	* progress, like we do here. When a hot spare is used, the faulted vdev
	* is not removed after the hot spare is resilvered, so parent 'spare'
	* vdev is not removed either. So we could have a 'spare' vdev, but be
	* resilvering for a different reason. However, we use it as a heuristic
	* because we don't have access to the DTLs, which could tell us whether
	* or not we have really finished resilvering a hot spare.
	*/
	if (vdev_any_spare_replacing(nvroot))
	bytes_rem[ZPOOL_WAIT_REPLACE] = bytes_rem[ZPOOL_WAIT_RESILVER];

	if (timestamp_fmt != NODATE)
	print_timestamp(timestamp_fmt);

	for (i = 0; i < ZPOOL_WAIT_NUM_ACTIVITIES; i++) {
	char buf[64];
	if (!wd->wd_enabled[i])
	continue;

	if (wd->wd_exact)
	(void) snprintf(buf, sizeof (buf), "%" PRIi64,
	bytes_rem[i]);
	else
	zfs_nicenum(bytes_rem[i], buf, sizeof (buf));

	if (wd->wd_scripted)
	(void) printf(i == 0 ? "%s" : "\t%s", buf);
	else
	(void) printf(" %*s", col_widths[i] - 1, buf);
	}
	(void) printf("\n");
	(void) fflush(stdout);
	}

	static void *
	wait_status_thread(void *arg)
	{
	wait_data_t wd = (wait_data_t )arg;
	zpool_handle_t *zhp;

	if ((zhp = zpool_open(g_zfs, wd->wd_poolname)) == NULL)
	return (void *)(1);

	for (int row = 0; ; row++) {
	boolean_t missing;
	struct timespec timeout;
	int ret = 0;
	(void) clock_gettime(CLOCK_REALTIME, &timeout);

	if (zpool_refresh_stats(zhp, &missing) != 0 \|\| missing \|\|
	zpool_props_refresh(zhp) != 0) {
	zpool_close(zhp);
	return (void *)(uintptr_t)(missing ? 0 : 1);
	}

	print_wait_status_row(wd, zhp, row);

	timeout.tv_sec += floor(wd->wd_interval);
	long nanos = timeout.tv_nsec +
	(wd->wd_interval - floor(wd->wd_interval)) * NANOSEC;
	if (nanos >= NANOSEC) {
	timeout.tv_sec++;
	timeout.tv_nsec = nanos - NANOSEC;
	} else {
	timeout.tv_nsec = nanos;
	}
	pthread_mutex_lock(&wd->wd_mutex);
	if (!wd->wd_should_exit)
	ret = pthread_cond_timedwait(&wd->wd_cv, &wd->wd_mutex,
	&timeout);
	pthread_mutex_unlock(&wd->wd_mutex);
	if (ret == 0) {
	break; /* signaled by main thread */
	} else if (ret != ETIMEDOUT) {
	(void) fprintf(stderr, gettext("pthread_cond_timedwait "
	"failed: %s\n"), strerror(ret));
	zpool_close(zhp);
	return (void *)(uintptr_t)(1);
	}
	}

	zpool_close(zhp);
	return (void *)(0);
	}

	int
	zpool_do_wait(int argc, char **argv)
	{
	boolean_t verbose = B_FALSE;
	char c;
	char *value;
	int i;
	unsigned long count;
	pthread_t status_thr;
	int error = 0;
	zpool_handle_t *zhp;

	wait_data_t wd;
	wd.wd_scripted = B_FALSE;
	wd.wd_exact = B_FALSE;
	wd.wd_headers_once = B_FALSE;
	wd.wd_should_exit = B_FALSE;

	pthread_mutex_init(&wd.wd_mutex, NULL);
	pthread_cond_init(&wd.wd_cv, NULL);

	/* By default, wait for all types of activity. */
	for (i = 0; i < ZPOOL_WAIT_NUM_ACTIVITIES; i++)
	wd.wd_enabled[i] = B_TRUE;

	while ((c = getopt(argc, argv, "HpT:t:")) != -1) {
	switch (c) {
	case 'H':
	wd.wd_scripted = B_TRUE;
	break;
	case 'n':
	wd.wd_headers_once = B_TRUE;
	break;
	case 'p':
	wd.wd_exact = B_TRUE;
	break;
	case 'T':
	get_timestamp_arg(*optarg);
	break;
	case 't':
	{
	static char *col_subopts[] = { "discard", "free",
	"initialize", "replace", "remove", "resilver",
	"scrub", "trim", NULL };

	/* Reset activities array */
	bzero(&wd.wd_enabled, sizeof (wd.wd_enabled));
	while (*optarg != '\0') {
	int activity = getsubopt(&optarg, col_subopts,
	&value);

	if (activity < 0) {
	(void) fprintf(stderr,
	gettext("invalid activity '%s'\n"),
	value);
	usage(B_FALSE);
	}

	wd.wd_enabled[activity] = B_TRUE;
	}
	break;
	}
	case '?':
	(void) fprintf(stderr, gettext("invalid option '%c'\n"),
	optopt);
	usage(B_FALSE);
	}
	}

	argc -= optind;
	argv += optind;

	get_interval_count(&argc, argv, &wd.wd_interval, &count);
	if (count != 0) {
	/* This subcmd only accepts an interval, not a count */
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	if (wd.wd_interval != 0)
	verbose = B_TRUE;

	if (argc < 1) {
	(void) fprintf(stderr, gettext("missing 'pool' argument\n"));
	usage(B_FALSE);
	}
	if (argc > 1) {
	(void) fprintf(stderr, gettext("too many arguments\n"));
	usage(B_FALSE);
	}

	wd.wd_poolname = argv[0];

	if ((zhp = zpool_open(g_zfs, wd.wd_poolname)) == NULL)
	return (1);

	if (verbose) {
	/*
	* We use a separate thread for printing status updates because
	* the main thread will call lzc_wait(), which blocks as long
	* as an activity is in progress, which can be a long time.
	*/
	if (pthread_create(&status_thr, NULL, wait_status_thread, &wd)
	!= 0) {
	(void) fprintf(stderr, gettext("failed to create status"
	"thread: %s\n"), strerror(errno));
	zpool_close(zhp);
	return (1);
	}
	}

	/*
	* Loop over all activities that we are supposed to wait for until none
	* of them are in progress. Note that this means we can end up waiting
	* for more activities to complete than just those that were in progress
	* when we began waiting; if an activity we are interested in begins
	* while we are waiting for another activity, we will wait for both to
	* complete before exiting.
	*/
	for (;;) {
	boolean_t missing = B_FALSE;
	boolean_t any_waited = B_FALSE;

	for (i = 0; i < ZPOOL_WAIT_NUM_ACTIVITIES; i++) {
	boolean_t waited;

	if (!wd.wd_enabled[i])
	continue;

	error = zpool_wait_status(zhp, i, &missing, &waited);
	if (error != 0 \|\| missing)
	break;

	any_waited = (any_waited \|\| waited);
	}

	if (error != 0 \|\| missing \|\| !any_waited)
	break;
	}

	zpool_close(zhp);

	if (verbose) {
	uintptr_t status;
	pthread_mutex_lock(&wd.wd_mutex);
	wd.wd_should_exit = B_TRUE;
	pthread_cond_signal(&wd.wd_cv);
	pthread_mutex_unlock(&wd.wd_mutex);
	(void) pthread_join(status_thr, (void *)&status);
	if (status != 0)
	error = status;
	}

	pthread_mutex_destroy(&wd.wd_mutex);
	pthread_cond_destroy(&wd.wd_cv);
	return (error);
	}

	static int
	find_command_idx(char command, int idx)
	{
	int i;

	for (i = 0; i < NCOMMAND; i++) {
	if (command_table[i].name == NULL)
	continue;

	if (strcmp(command, command_table[i].name) == 0) {
	*idx = i;
	return (0);
	}
	}
	return (1);
	}

	/*
	* Display version message
	*/
	static int
	zpool_do_version(int argc, char **argv)
	{
	if (zfs_version_print() == -1)
	return (1);

	return (0);
	}

	int
	main(int argc, char **argv)
	{
	int ret = 0;
	int i = 0;
	char *cmdname;
	char **newargv;

	(void) setlocale(LC_ALL, "");
	+ (void) setlocale(LC_NUMERIC, "C");
	(void) textdomain(TEXT_DOMAIN);
	srand(time(NULL));

	opterr = 0;

	/*
	* Make sure the user has specified some command.
	*/
	if (argc < 2) {
	(void) fprintf(stderr, gettext("missing command\n"));
	usage(B_FALSE);
	}

	cmdname = argv[1];

	/*
	* Special case '-?'
	*/
	if ((strcmp(cmdname, "-?") == 0) \|\| strcmp(cmdname, "--help") == 0)
	usage(B_TRUE);

	/*
	* Special case '-V\|--version'
	*/
	if ((strcmp(cmdname, "-V") == 0) \|\| (strcmp(cmdname, "--version") == 0))
	return (zpool_do_version(argc, argv));

	if ((g_zfs = libzfs_init()) == NULL) {
	(void) fprintf(stderr, "%s\n", libzfs_error_init(errno));
	return (1);
	}

	libzfs_print_on_error(g_zfs, B_TRUE);

	zfs_save_arguments(argc, argv, history_str, sizeof (history_str));

	/*
	* Many commands modify input strings for string parsing reasons.
	* We create a copy to protect the original argv.
	*/
	newargv = malloc((argc + 1) * sizeof (newargv[0]));
	for (i = 0; i < argc; i++)
	newargv[i] = strdup(argv[i]);
	newargv[argc] = NULL;

	/*
	* Run the appropriate command.
	*/
	if (find_command_idx(cmdname, &i) == 0) {
	current_command = &command_table[i];
	ret = command_table[i].func(argc - 1, newargv + 1);
	} else if (strchr(cmdname, '=')) {
	verify(find_command_idx("set", &i) == 0);
	current_command = &command_table[i];
	ret = command_table[i].func(argc, newargv);
	} else if (strcmp(cmdname, "freeze") == 0 && argc == 3) {
	/*
	* 'freeze' is a vile debugging abomination, so we treat
	* it as such.
	*/
	zfs_cmd_t zc = {"\0"};

	(void) strlcpy(zc.zc_name, argv[2], sizeof (zc.zc_name));
	ret = zfs_ioctl(g_zfs, ZFS_IOC_POOL_FREEZE, &zc);
	if (ret != 0) {
	(void) fprintf(stderr,
	gettext("failed to freeze pool: %d\n"), errno);
	ret = 1;
	}

	log_history = 0;
	} else {
	(void) fprintf(stderr, gettext("unrecognized "
	"command '%s'\n"), cmdname);
	usage(B_FALSE);
	ret = 1;
	}

	for (i = 0; i < argc; i++)
	free(newargv[i]);
	free(newargv);

	if (ret == 0 && log_history)
	(void) zpool_log_history(g_zfs, history_str);

	libzfs_fini(g_zfs);

	/*
	* The 'ZFS_ABORT' environment variable causes us to dump core on exit
	* for the purposes of running ::findleaks.
	*/
	if (getenv("ZFS_ABORT") != NULL) {
	(void) printf("dumping core by request\n");
	abort();
	}

	return (ret);
	}
	Index: vendor-sys/openzfs/dist/config/deb.am
	===================================================================
	--- vendor-sys/openzfs/dist/config/deb.am (revision 365891)
	+++ vendor-sys/openzfs/dist/config/deb.am (revision 365892)
	@@ -1,74 +1,74 @@
	PHONY += deb-kmod deb-dkms deb-utils deb deb-local

	deb-local:
	@(if test "${HAVE_DPKGBUILD}" = "no"; then \
	echo -e "\n" \
	"*** Required util ${DPKGBUILD} missing. Please install the\n" \
	"*** package for your distribution which provides ${DPKGBUILD},\n" \
	"*** re-run configure, and try again.\n"; \
	exit 1; \
	fi; \
	if test "${HAVE_ALIEN}" = "no"; then \
	echo -e "\n" \
	"*** Required util ${ALIEN} missing. Please install the\n" \
	"*** package for your distribution which provides ${ALIEN},\n" \
	"*** re-run configure, and try again.\n"; \
	exit 1; \
	fi)

	deb-kmod: deb-local rpm-kmod
	name=${PACKAGE}; \
	version=${VERSION}-${RELEASE}; \
	arch=`$(RPM) -qp $${name}-kmod-$${version}.src.rpm --qf %{arch} \| tail -1`; \
	debarch=`$(DPKG) --print-architecture`; \
	pkg1=kmod-$${name}*$${version}.$${arch}.rpm; \
	fakeroot $(ALIEN) --bump=0 --scripts --to-deb --target=$$debarch $$pkg1 \|\| exit 1; \
	$(RM) $$pkg1


	deb-dkms: deb-local rpm-dkms
	name=${PACKAGE}; \
	version=${VERSION}-${RELEASE}; \
	arch=`$(RPM) -qp $${name}-dkms-$${version}.src.rpm --qf %{arch} \| tail -1`; \
	debarch=`$(DPKG) --print-architecture`; \
	pkg1=$${name}-dkms-$${version}.$${arch}.rpm; \
	fakeroot $(ALIEN) --bump=0 --scripts --to-deb --target=$$debarch $$pkg1 \|\| exit 1; \
	$(RM) $$pkg1

	-deb-utils: deb-local rpm-utils
	+deb-utils: deb-local rpm-utils-initramfs
	name=${PACKAGE}; \
	version=${VERSION}-${RELEASE}; \
	arch=`$(RPM) -qp $${name}-$${version}.src.rpm --qf %{arch} \| tail -1`; \
	debarch=`$(DPKG) --print-architecture`; \
	pkg1=$${name}-$${version}.$${arch}.rpm; \
	pkg2=libnvpair1-$${version}.$${arch}.rpm; \
	pkg3=libuutil1-$${version}.$${arch}.rpm; \
	pkg4=libzfs2-$${version}.$${arch}.rpm; \
	pkg5=libzpool2-$${version}.$${arch}.rpm; \
	pkg6=libzfs2-devel-$${version}.$${arch}.rpm; \
	pkg7=$${name}-test-$${version}.$${arch}.rpm; \
	pkg8=$${name}-dracut-$${version}.noarch.rpm; \
	pkg9=$${name}-initramfs-$${version}.$${arch}.rpm; \
	pkg10=`ls python-pyzfs-$${version} \| tail -1`; \
	## Arguments need to be passed to dh_shlibdeps. Alien provides no mechanism
	## to do this, so we install a shim onto the path which calls the real
	## dh_shlibdeps with the required arguments.
	path_prepend=`mktemp -d /tmp/intercept.XXX`; \
	echo "#$(SHELL)" > $${path_prepend}/dh_shlibdeps; \
	echo "`which dh_shlibdeps` -- \
	-xlibuutil1linux -xlibnvpair1linux -xlibzfs2linux -xlibzpool2linux" \
	>> $${path_prepend}/dh_shlibdeps; \
	## These -x arguments are passed to dpkg-shlibdeps, which exclude the
	## Debianized packages from the auto-generated dependencies of the new debs,
	## which should NOT be mixed with the alien-generated debs created here
	chmod +x $${path_prepend}/dh_shlibdeps; \
	env PATH=$${path_prepend}:$${PATH} \
	fakeroot $(ALIEN) --bump=0 --scripts --to-deb --target=$$debarch \
	$$pkg1 $$pkg2 $$pkg3 $$pkg4 $$pkg5 $$pkg6 $$pkg7 \
	$$pkg8 $$pkg9 $$pkg10 \|\| exit 1; \
	$(RM) $${path_prepend}/dh_shlibdeps; \
	rmdir $${path_prepend}; \
	$(RM) $$pkg1 $$pkg2 $$pkg3 $$pkg4 $$pkg5 $$pkg6 $$pkg7 \
	$$pkg8 $$pkg9 $$pkg10;

	deb: deb-kmod deb-dkms deb-utils
	Index: vendor-sys/openzfs/dist/config/find_system_library.m4
	===================================================================
	--- vendor-sys/openzfs/dist/config/find_system_library.m4 (revision 365891)
	+++ vendor-sys/openzfs/dist/config/find_system_library.m4 (revision 365892)
	@@ -1,93 +1,98 @@
	# find_system_lib.m4 - Macros to search for a system library. -- Autoconf --

	dnl requires pkg.m4 from pkg-config
	dnl requires ax_save_flags.m4 from autoconf-archive
	dnl requires ax_restore_flags.m4 from autoconf-archive

	dnl ZFS_AC_FIND_SYSTEM_LIBRARY(VARIABLE-PREFIX, MODULE, HEADER, HEADER-PREFIXES, LIBRARY, FUNCTIONS, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])

	AC_DEFUN([ZFS_AC_FIND_SYSTEM_LIBRARY], [
	AC_REQUIRE([PKG_PROG_PKG_CONFIG])

	_header_found=
	_library_found=
	+ _pc_found=

	AS_IF([test -n "$2"], [PKG_CHECK_MODULES([$1], [$2], [
	_header_found=1
	_library_found=1
	+ _pc_found=1
	], [:])])

	# set _header_found/_library_found if the user passed in CFLAGS/LIBS
	AS_IF([test "x$[$1][_CFLAGS]" != x], [_header_found=1])
	AS_IF([test "x$[$1][_LIBS]" != x], [_library_found=1])

	AX_SAVE_FLAGS

	orig_CFLAGS="$CFLAGS"

	for _prefixdir in /usr /usr/local
	do
	AS_VAR_PUSHDEF([header_cache], [ac_cv_header_$3])
	AS_IF([test "x$_prefixdir" != "x/usr"], [
	[$1][_CFLAGS]="-I$lt_sysroot$_prefixdir/include"
	AS_IF([test "x$_library_found" = x], [
	[$1][_LIBS]="-L$lt_sysroot$_prefixdir/lib"
	])
	])
	CFLAGS="$orig_CFLAGS $[$1][_CFLAGS]"
	AS_UNSET([header_cache])
	AC_CHECK_HEADER([$3], [
	_header_found=1
	break
	], [AS_IF([test "x$_header_found" = "x1"], [
	# if pkg-config or the user set CFLAGS, fail if the header is unusable
	AC_MSG_FAILURE([header [$3] for library [$5] is not usable])
	])], [AC_INCLUDES_DEFAULT])
	# search for header under HEADER-PREFIXES
	m4_foreach_w([prefix], [$4], [
	[$1][_CFLAGS]=["-I$lt_sysroot$_prefixdir/include/]prefix["]
	CFLAGS="$orig_CFLAGS $[$1][_CFLAGS]"
	AS_UNSET([header_cache])
	AC_CHECK_HEADER([$3], [
	_header_found=1
	break
	], [], [AC_INCLUDES_DEFAULT])
	])
	AS_VAR_POPDEF([header_cache])
	done

	AS_IF([test "x$_header_found" = "x1"], [
	AS_IF([test "x$_library_found" = x], [
	[$1][_LIBS]="$[$1]_LIBS -l[$5]"
	])
	LDFLAGS="$LDFLAGS $[$1][_LIBS]"

	_libcheck=1
	m4_ifval([$6],
	[m4_foreach_w([func], [$6], [AC_CHECK_LIB([$5], func, [:], [_libcheck=])])],
	[AC_CHECK_LIB([$5], [main], [:], [_libcheck=])])

	AS_IF([test "x$_libcheck" = "x1"], [_library_found=1],
	[test "x$_library_found" = "x1"], [
	# if pkg-config or the user set LIBS, fail if the library is unusable
	AC_MSG_FAILURE([library [$5] is not usable])
	])
	], [test "x$_library_found" = "x1"], [
	# if the user set LIBS, fail if we didn't find the header
	AC_MSG_FAILURE([cannot find header [$3] for library [$5]])
	])

	AX_RESTORE_FLAGS

	AS_IF([test "x$_header_found" = "x1" && test "x$_library_found" = "x1"], [
	AC_SUBST([$1]_CFLAGS)
	AC_SUBST([$1]_LIBS)
	+ AS_IF([test "x$_pc_found" = "x1"], [
	+ AC_SUBST([$1]_PC, [$2])
	+ ])
	AC_DEFINE([HAVE_][$1], [1], [Define if you have [$5]])
	$7
	],[dnl ELSE
	AC_SUBST([$1]_CFLAGS, [])
	AC_SUBST([$1]_LIBS, [])
	AC_MSG_WARN([cannot find [$5] via pkg-config or in the standard locations])
	$8
	])
	])
	Index: vendor-sys/openzfs/dist/config/rpm.am
	===================================================================
	--- vendor-sys/openzfs/dist/config/rpm.am (revision 365891)
	+++ vendor-sys/openzfs/dist/config/rpm.am (revision 365892)
	@@ -1,93 +1,105 @@
	###############################################################################
	# Copyright (C) 2007-2013 Lawrence Livermore National Security, LLC.
	# Copyright (C) 2007 The Regents of the University of California.
	# Written by Brian Behlendorf <behlendorf1@llnl.gov>.
	###############################################################################
	# Build targets for RPM packages.
	###############################################################################

	PHONY += srpm srpms srpm-kmod srpm-dkms srpm-utils
	-PHONY += rpm rpms rpm-kmod rpm-dkms rpm-utils
	+PHONY += rpm rpms rpm-kmod rpm-dkms rpm-utils rpm-utils-initramfs
	PHONY += srpm-common rpm-common rpm-local

	srpm-kmod srpm-dkms srpm-utils: dist

	srpm-kmod:
	$(MAKE) $(AM_MAKEFLAGS) pkg="${PACKAGE}-kmod" \
	def='${SRPM_DEFINE_COMMON} ${SRPM_DEFINE_KMOD}' srpm-common

	srpm-dkms:
	$(MAKE) $(AM_MAKEFLAGS) pkg="${PACKAGE}-dkms" \
	def='${SRPM_DEFINE_COMMON} ${SRPM_DEFINE_DKMS}' srpm-common

	srpm-utils:
	$(MAKE) $(AM_MAKEFLAGS) pkg="${PACKAGE}" \
	def='${SRPM_DEFINE_COMMON} ${SRPM_DEFINE_UTIL}' srpm-common

	srpm: srpm-kmod srpm-dkms srpm-utils
	srpms: srpm-kmod srpm-dkms srpm-utils

	rpm-kmod: srpm-kmod
	$(MAKE) $(AM_MAKEFLAGS) pkg="${PACKAGE}-kmod" \
	def='${RPM_DEFINE_COMMON} ${RPM_DEFINE_KMOD}' rpm-common

	rpm-dkms: srpm-dkms
	$(MAKE) $(AM_MAKEFLAGS) pkg="${PACKAGE}-dkms" \
	def='${RPM_DEFINE_COMMON} ${RPM_DEFINE_DKMS}' rpm-common

	+# The rpm-utils and rpm-utils-initramfs targets are identical except for the
	+# zfs-initramfs package: rpm-utils never includes it, rpm-utils-initramfs
	+# includes it if detected at configure time. The zfs-initramfs package does
	+# not work on any known RPM-based distribution and the resulting RPM is only
	+# used to create a Debian package. The rpm-utils-initramfs target is not
	+# intended to be specified by the user directly, it is provided as a
	+# dependency of the deb-utils target.
	+
	rpm-utils: srpm-utils
	$(MAKE) $(AM_MAKEFLAGS) pkg="${PACKAGE}" \
	def='${RPM_DEFINE_COMMON} ${RPM_DEFINE_UTIL}' rpm-common
	+
	+rpm-utils-initramfs: srpm-utils
	+ $(MAKE) $(AM_MAKEFLAGS) pkg="${PACKAGE}" \
	+ def='${RPM_DEFINE_COMMON} ${RPM_DEFINE_UTIL} ${RPM_DEFINE_INITRAMFS}' rpm-common

	rpm: rpm-kmod rpm-dkms rpm-utils
	rpms: rpm-kmod rpm-dkms rpm-utils

	rpm-local:
	@(if test "${HAVE_RPMBUILD}" = "no"; then \
	echo -e "\n" \
	"*** Required util ${RPMBUILD} missing. Please install the\n" \
	"*** package for your distribution which provides ${RPMBUILD},\n" \
	"*** re-run configure, and try again.\n"; \
	exit 1; \
	fi; \
	mkdir -p $(rpmbuild)/TMP && \
	mkdir -p $(rpmbuild)/BUILD && \
	mkdir -p $(rpmbuild)/RPMS && \
	mkdir -p $(rpmbuild)/SRPMS && \
	mkdir -p $(rpmbuild)/SPECS && \
	cp ${RPM_SPEC_DIR}/$(rpmspec) $(rpmbuild)/SPECS && \
	mkdir -p $(rpmbuild)/SOURCES && \
	cp $(top_srcdir)/scripts/kmodtool $(rpmbuild)/SOURCES && \
	cp $(distdir).tar.gz $(rpmbuild)/SOURCES)

	srpm-common:
	@(dist=`$(RPM) --eval %{?dist}`; \
	rpmpkg=$(pkg)-$(VERSION)-$(RELEASE)$$dist*src.rpm; \
	rpmspec=$(pkg).spec; \
	rpmbuild=`mktemp -t -d $(PACKAGE)-build-$$USER-XXXXXXXX`; \
	$(MAKE) $(AM_MAKEFLAGS) \
	rpmbuild="$$rpmbuild" \
	rpmspec="$$rpmspec" \
	rpm-local \|\| exit 1; \
	LANG=C $(RPMBUILD) \
	--define "_tmppath $$rpmbuild/TMP" \
	--define "_topdir $$rpmbuild" \
	$(def) -bs $$rpmbuild/SPECS/$$rpmspec \|\| exit 1; \
	cp $$rpmbuild/SRPMS/$$rpmpkg . \|\| exit 1; \
	rm -R $$rpmbuild)

	rpm-common:
	@(dist=`$(RPM) --eval %{?dist}`; \
	rpmpkg=$(pkg)-$(VERSION)-$(RELEASE)$$dist*src.rpm; \
	rpmspec=$(pkg).spec; \
	rpmbuild=`mktemp -t -d $(PACKAGE)-build-$$USER-XXXXXXXX`; \
	$(MAKE) $(AM_MAKEFLAGS) \
	rpmbuild="$$rpmbuild" \
	rpmspec="$$rpmspec" \
	rpm-local \|\| exit 1; \
	LANG=C ${RPMBUILD} \
	--define "_tmppath $$rpmbuild/TMP" \
	--define "_topdir $$rpmbuild" \
	$(def) --rebuild $$rpmpkg \|\| exit 1; \
	cp $$rpmbuild/RPMS// . \|\| exit 1; \
	rm -R $$rpmbuild)
	Index: vendor-sys/openzfs/dist/config/zfs-build.m4
	===================================================================
	--- vendor-sys/openzfs/dist/config/zfs-build.m4 (revision 365891)
	+++ vendor-sys/openzfs/dist/config/zfs-build.m4 (revision 365892)
	@@ -1,564 +1,563 @@
	AC_DEFUN([ZFS_AC_LICENSE], [
	AC_MSG_CHECKING([zfs author])
	AC_MSG_RESULT([$ZFS_META_AUTHOR])

	AC_MSG_CHECKING([zfs license])
	AC_MSG_RESULT([$ZFS_META_LICENSE])
	])

	AC_DEFUN([ZFS_AC_DEBUG_ENABLE], [
	DEBUG_CFLAGS="-Werror"
	DEBUG_CPPFLAGS="-DDEBUG -UNDEBUG"
	DEBUG_LDFLAGS=""
	DEBUG_ZFS="_with_debug"
	AC_DEFINE(ZFS_DEBUG, 1, [zfs debugging enabled])

	KERNEL_DEBUG_CFLAGS="-Werror"
	KERNEL_DEBUG_CPPFLAGS="-DDEBUG -UNDEBUG"
	])

	AC_DEFUN([ZFS_AC_DEBUG_DISABLE], [
	DEBUG_CFLAGS=""
	DEBUG_CPPFLAGS="-UDEBUG -DNDEBUG"
	DEBUG_LDFLAGS=""
	DEBUG_ZFS="_without_debug"

	KERNEL_DEBUG_CFLAGS=""
	KERNEL_DEBUG_CPPFLAGS="-UDEBUG -DNDEBUG"
	])

	dnl #
	dnl # When debugging is enabled:
	dnl # - Enable all ASSERTs (-DDEBUG)
	dnl # - Promote all compiler warnings to errors (-Werror)
	dnl #
	AC_DEFUN([ZFS_AC_DEBUG], [
	AC_MSG_CHECKING([whether assertion support will be enabled])
	AC_ARG_ENABLE([debug],
	[AS_HELP_STRING([--enable-debug],
	[Enable compiler and code assertions @<:@default=no@:>@])],
	[],
	[enable_debug=no])

	AS_CASE(["x$enable_debug"],
	["xyes"],
	[ZFS_AC_DEBUG_ENABLE],
	["xno"],
	[ZFS_AC_DEBUG_DISABLE],
	[AC_MSG_ERROR([Unknown option $enable_debug])])

	AC_SUBST(DEBUG_CFLAGS)
	AC_SUBST(DEBUG_CPPFLAGS)
	AC_SUBST(DEBUG_LDFLAGS)
	AC_SUBST(DEBUG_ZFS)

	AC_SUBST(KERNEL_DEBUG_CFLAGS)
	AC_SUBST(KERNEL_DEBUG_CPPFLAGS)

	AC_MSG_RESULT([$enable_debug])
	])

	AC_DEFUN([ZFS_AC_DEBUGINFO_ENABLE], [
	DEBUG_CFLAGS="$DEBUG_CFLAGS -g -fno-inline $NO_IPA_SRA"

	KERNEL_DEBUG_CFLAGS="$KERNEL_DEBUG_CFLAGS -fno-inline $NO_IPA_SRA"
	KERNEL_MAKE="$KERNEL_MAKE CONFIG_DEBUG_INFO=y"

	DEBUGINFO_ZFS="_with_debuginfo"
	])

	AC_DEFUN([ZFS_AC_DEBUGINFO_DISABLE], [
	DEBUGINFO_ZFS="_without_debuginfo"
	])

	AC_DEFUN([ZFS_AC_DEBUGINFO], [
	AC_MSG_CHECKING([whether debuginfo support will be forced])
	AC_ARG_ENABLE([debuginfo],
	[AS_HELP_STRING([--enable-debuginfo],
	[Force generation of debuginfo @<:@default=no@:>@])],
	[],
	[enable_debuginfo=no])

	AS_CASE(["x$enable_debuginfo"],
	["xyes"],
	[ZFS_AC_DEBUGINFO_ENABLE],
	["xno"],
	[ZFS_AC_DEBUGINFO_DISABLE],
	[AC_MSG_ERROR([Unknown option $enable_debuginfo])])

	AC_SUBST(DEBUG_CFLAGS)
	AC_SUBST(DEBUGINFO_ZFS)

	AC_SUBST(KERNEL_DEBUG_CFLAGS)
	AC_SUBST(KERNEL_MAKE)

	AC_MSG_RESULT([$enable_debuginfo])
	])

	dnl #
	dnl # Disabled by default, provides basic memory tracking. Track the total
	dnl # number of bytes allocated with kmem_alloc() and freed with kmem_free().
	dnl # Then at module unload time if any bytes were leaked it will be reported
	dnl # on the console.
	dnl #
	AC_DEFUN([ZFS_AC_DEBUG_KMEM], [
	AC_MSG_CHECKING([whether basic kmem accounting is enabled])
	AC_ARG_ENABLE([debug-kmem],
	[AS_HELP_STRING([--enable-debug-kmem],
	[Enable basic kmem accounting @<:@default=no@:>@])],
	[],
	[enable_debug_kmem=no])

	AS_IF([test "x$enable_debug_kmem" = xyes], [
	KERNEL_DEBUG_CPPFLAGS="${KERNEL_DEBUG_CPPFLAGS} -DDEBUG_KMEM"
	DEBUG_KMEM_ZFS="_with_debug_kmem"
	], [
	DEBUG_KMEM_ZFS="_without_debug_kmem"
	])

	AC_SUBST(KERNEL_DEBUG_CPPFLAGS)
	AC_SUBST(DEBUG_KMEM_ZFS)

	AC_MSG_RESULT([$enable_debug_kmem])
	])

	dnl #
	dnl # Disabled by default, provides detailed memory tracking. This feature
	dnl # also requires --enable-debug-kmem to be set. When enabled not only will
	dnl # total bytes be tracked but also the location of every kmem_alloc() and
	dnl # kmem_free(). When the module is unloaded a list of all leaked addresses
	dnl # and where they were allocated will be dumped to the console. Enabling
	dnl # this feature has a significant impact on performance but it makes finding
	dnl # memory leaks straight forward.
	dnl #
	AC_DEFUN([ZFS_AC_DEBUG_KMEM_TRACKING], [
	AC_MSG_CHECKING([whether detailed kmem tracking is enabled])
	AC_ARG_ENABLE([debug-kmem-tracking],
	[AS_HELP_STRING([--enable-debug-kmem-tracking],
	[Enable detailed kmem tracking @<:@default=no@:>@])],
	[],
	[enable_debug_kmem_tracking=no])

	AS_IF([test "x$enable_debug_kmem_tracking" = xyes], [
	KERNEL_DEBUG_CPPFLAGS="${KERNEL_DEBUG_CPPFLAGS} -DDEBUG_KMEM_TRACKING"
	DEBUG_KMEM_TRACKING_ZFS="_with_debug_kmem_tracking"
	], [
	DEBUG_KMEM_TRACKING_ZFS="_without_debug_kmem_tracking"
	])

	AC_SUBST(KERNEL_DEBUG_CPPFLAGS)
	AC_SUBST(DEBUG_KMEM_TRACKING_ZFS)

	AC_MSG_RESULT([$enable_debug_kmem_tracking])
	])

	AC_DEFUN([ZFS_AC_CONFIG_ALWAYS], [
	ZFS_AC_CONFIG_ALWAYS_CC_NO_UNUSED_BUT_SET_VARIABLE
	ZFS_AC_CONFIG_ALWAYS_CC_NO_BOOL_COMPARE
	ZFS_AC_CONFIG_ALWAYS_CC_FRAME_LARGER_THAN
	ZFS_AC_CONFIG_ALWAYS_CC_NO_FORMAT_TRUNCATION
	ZFS_AC_CONFIG_ALWAYS_CC_NO_FORMAT_ZERO_LENGTH
	ZFS_AC_CONFIG_ALWAYS_CC_NO_OMIT_FRAME_POINTER
	ZFS_AC_CONFIG_ALWAYS_CC_NO_IPA_SRA
	ZFS_AC_CONFIG_ALWAYS_CC_ASAN
	ZFS_AC_CONFIG_ALWAYS_TOOLCHAIN_SIMD
	ZFS_AC_CONFIG_ALWAYS_SYSTEM
	ZFS_AC_CONFIG_ALWAYS_ARCH
	ZFS_AC_CONFIG_ALWAYS_PYTHON
	ZFS_AC_CONFIG_ALWAYS_PYZFS
	ZFS_AC_CONFIG_ALWAYS_SED
	])

	AC_DEFUN([ZFS_AC_CONFIG], [

	dnl # Remove the previous build test directory.
	rm -Rf build

	ZFS_CONFIG=all
	AC_ARG_WITH([config],
	AS_HELP_STRING([--with-config=CONFIG],
	[Config file 'kernel\|user\|all\|srpm']),
	[ZFS_CONFIG="$withval"])
	AC_ARG_ENABLE([linux-builtin],
	[AC_HELP_STRING([--enable-linux-builtin],
	[Configure for builtin in-tree kernel modules @<:@default=no@:>@])],
	[],
	[enable_linux_builtin=no])

	AC_MSG_CHECKING([zfs config])
	AC_MSG_RESULT([$ZFS_CONFIG]);
	AC_SUBST(ZFS_CONFIG)

	ZFS_AC_CONFIG_ALWAYS


	AM_COND_IF([BUILD_LINUX], [
	AC_ARG_VAR([TEST_JOBS],
	[simultaneous jobs during configure (defaults to $(nproc))])
	if test "x$ac_cv_env_TEST_JOBS_set" != "xset"; then
	TEST_JOBS=$(nproc)
	fi
	AC_SUBST(TEST_JOBS)
	])

	case "$ZFS_CONFIG" in
	kernel) ZFS_AC_CONFIG_KERNEL ;;
	user) ZFS_AC_CONFIG_USER ;;
	all) ZFS_AC_CONFIG_USER
	ZFS_AC_CONFIG_KERNEL ;;
	srpm) ;;
	*)
	AC_MSG_RESULT([Error!])
	AC_MSG_ERROR([Bad value "$ZFS_CONFIG" for --with-config,
	user kernel\|user\|all\|srpm]) ;;
	esac

	AM_CONDITIONAL([CONFIG_USER],
	[test "$ZFS_CONFIG" = user -o "$ZFS_CONFIG" = all])
	AM_CONDITIONAL([CONFIG_KERNEL],
	[test "$ZFS_CONFIG" = kernel -o "$ZFS_CONFIG" = all] &&
	[test "x$enable_linux_builtin" != xyes ])
	AM_CONDITIONAL([CONFIG_QAT],
	[test "$ZFS_CONFIG" = kernel -o "$ZFS_CONFIG" = all] &&
	[test "x$qatsrc" != x ])
	AM_CONDITIONAL([WANT_DEVNAME2DEVID], [test "x$user_libudev" = xyes ])
	AM_CONDITIONAL([WANT_MMAP_LIBAIO], [test "x$user_libaio" = xyes ])
	AM_CONDITIONAL([PAM_ZFS_ENABLED], [test "x$enable_pam" = xyes])
	])

	dnl #
	dnl # Check for rpm+rpmbuild to build RPM packages. If these tools
	dnl # are missing it is non-fatal but you will not be able to build
	dnl # RPM packages and will be warned if you try too.
	dnl #
	dnl # By default the generic spec file will be used because it requires
	dnl # minimal dependencies. Distribution specific spec files can be
	dnl # placed under the 'rpm/<distribution>' directory and enabled using
	dnl # the --with-spec=<distribution> configure option.
	dnl #
	AC_DEFUN([ZFS_AC_RPM], [
	RPM=rpm
	RPMBUILD=rpmbuild

	AC_MSG_CHECKING([whether $RPM is available])
	AS_IF([tmp=$($RPM --version 2>/dev/null)], [
	RPM_VERSION=$(echo $tmp \| $AWK '/RPM/ { print $[3] }')
	HAVE_RPM=yes
	AC_MSG_RESULT([$HAVE_RPM ($RPM_VERSION)])
	],[
	HAVE_RPM=no
	AC_MSG_RESULT([$HAVE_RPM])
	])

	AC_MSG_CHECKING([whether $RPMBUILD is available])
	AS_IF([tmp=$($RPMBUILD --version 2>/dev/null)], [
	RPMBUILD_VERSION=$(echo $tmp \| $AWK '/RPM/ { print $[3] }')
	HAVE_RPMBUILD=yes
	AC_MSG_RESULT([$HAVE_RPMBUILD ($RPMBUILD_VERSION)])
	],[
	HAVE_RPMBUILD=no
	AC_MSG_RESULT([$HAVE_RPMBUILD])
	])

	RPM_DEFINE_COMMON='--define "$(DEBUG_ZFS) 1"'
	RPM_DEFINE_COMMON=${RPM_DEFINE_COMMON}' --define "$(DEBUGINFO_ZFS) 1"'
	RPM_DEFINE_COMMON=${RPM_DEFINE_COMMON}' --define "$(DEBUG_KMEM_ZFS) 1"'
	RPM_DEFINE_COMMON=${RPM_DEFINE_COMMON}' --define "$(DEBUG_KMEM_TRACKING_ZFS) 1"'
	RPM_DEFINE_COMMON=${RPM_DEFINE_COMMON}' --define "$(ASAN_ZFS) 1"'

	RPM_DEFINE_UTIL=' --define "_initconfdir $(initconfdir)"'

	dnl # Make the next three RPM_DEFINE_UTIL additions conditional, since
	dnl # their values may not be set when running:
	dnl #
	dnl # ./configure --with-config=srpm
	dnl #
	AS_IF([test -n "$dracutdir" ], [
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' --define "_dracutdir $(dracutdir)"'
	])
	AS_IF([test -n "$udevdir" ], [
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' --define "_udevdir $(udevdir)"'
	])
	AS_IF([test -n "$udevruledir" ], [
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' --define "_udevruledir $(udevruledir)"'
	])
	- RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' $(DEFINE_INITRAMFS)'
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' $(DEFINE_SYSTEMD)'
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' $(DEFINE_PYZFS)'
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' $(DEFINE_PAM)'
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' $(DEFINE_PYTHON_VERSION)'
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' $(DEFINE_PYTHON_PKG_VERSION)'

	dnl # Override default lib directory on Debian/Ubuntu systems. The
	dnl # provided /usr/lib/rpm/platform/<arch>/macros files do not
	dnl # specify the correct path for multiarch systems as described
	dnl # by the packaging guidelines.
	dnl #
	dnl # https://wiki.ubuntu.com/MultiarchSpec
	dnl # https://wiki.debian.org/Multiarch/Implementation
	dnl #
	AS_IF([test "$DEFAULT_PACKAGE" = "deb"], [
	MULTIARCH_LIBDIR="lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH)"
	RPM_DEFINE_UTIL=${RPM_DEFINE_UTIL}' --define "_lib $(MULTIARCH_LIBDIR)"'
	AC_SUBST(MULTIARCH_LIBDIR)
	])

	dnl # Make RPM_DEFINE_KMOD additions conditional on CONFIG_KERNEL,
	dnl # since the values will not be set otherwise. The spec files
	dnl # provide defaults for them.
	dnl #
	RPM_DEFINE_KMOD='--define "_wrong_version_format_terminate_build 0"'
	AM_COND_IF([CONFIG_KERNEL], [
	RPM_DEFINE_KMOD=${RPM_DEFINE_KMOD}' --define "kernels $(LINUX_VERSION)"'
	RPM_DEFINE_KMOD=${RPM_DEFINE_KMOD}' --define "ksrc $(LINUX)"'
	RPM_DEFINE_KMOD=${RPM_DEFINE_KMOD}' --define "kobj $(LINUX_OBJ)"'
	])

	RPM_DEFINE_DKMS=''

	SRPM_DEFINE_COMMON='--define "build_src_rpm 1"'
	SRPM_DEFINE_UTIL=
	SRPM_DEFINE_KMOD=
	SRPM_DEFINE_DKMS=

	RPM_SPEC_DIR="rpm/generic"
	AC_ARG_WITH([spec],
	AS_HELP_STRING([--with-spec=SPEC],
	[Spec files 'generic\|redhat']),
	[RPM_SPEC_DIR="rpm/$withval"])

	AC_MSG_CHECKING([whether spec files are available])
	AC_MSG_RESULT([yes ($RPM_SPEC_DIR/*.spec.in)])

	AC_SUBST(HAVE_RPM)
	AC_SUBST(RPM)
	AC_SUBST(RPM_VERSION)

	AC_SUBST(HAVE_RPMBUILD)
	AC_SUBST(RPMBUILD)
	AC_SUBST(RPMBUILD_VERSION)

	AC_SUBST(RPM_SPEC_DIR)
	AC_SUBST(RPM_DEFINE_UTIL)
	AC_SUBST(RPM_DEFINE_KMOD)
	AC_SUBST(RPM_DEFINE_DKMS)
	AC_SUBST(RPM_DEFINE_COMMON)
	AC_SUBST(SRPM_DEFINE_UTIL)
	AC_SUBST(SRPM_DEFINE_KMOD)
	AC_SUBST(SRPM_DEFINE_DKMS)
	AC_SUBST(SRPM_DEFINE_COMMON)
	])

	dnl #
	dnl # Check for dpkg+dpkg-buildpackage to build DEB packages. If these
	dnl # tools are missing it is non-fatal but you will not be able to build
	dnl # DEB packages and will be warned if you try too.
	dnl #
	AC_DEFUN([ZFS_AC_DPKG], [
	DPKG=dpkg
	DPKGBUILD=dpkg-buildpackage

	AC_MSG_CHECKING([whether $DPKG is available])
	AS_IF([tmp=$($DPKG --version 2>/dev/null)], [
	DPKG_VERSION=$(echo $tmp \| $AWK '/Debian/ { print $[7] }')
	HAVE_DPKG=yes
	AC_MSG_RESULT([$HAVE_DPKG ($DPKG_VERSION)])
	],[
	HAVE_DPKG=no
	AC_MSG_RESULT([$HAVE_DPKG])
	])

	AC_MSG_CHECKING([whether $DPKGBUILD is available])
	AS_IF([tmp=$($DPKGBUILD --version 2>/dev/null)], [
	DPKGBUILD_VERSION=$(echo $tmp \| \
	$AWK '/Debian/ { print $[4] }' \| cut -f-4 -d'.')
	HAVE_DPKGBUILD=yes
	AC_MSG_RESULT([$HAVE_DPKGBUILD ($DPKGBUILD_VERSION)])
	],[
	HAVE_DPKGBUILD=no
	AC_MSG_RESULT([$HAVE_DPKGBUILD])
	])

	AC_SUBST(HAVE_DPKG)
	AC_SUBST(DPKG)
	AC_SUBST(DPKG_VERSION)

	AC_SUBST(HAVE_DPKGBUILD)
	AC_SUBST(DPKGBUILD)
	AC_SUBST(DPKGBUILD_VERSION)
	])

	dnl #
	dnl # Until native packaging for various different packing systems
	dnl # can be added the least we can do is attempt to use alien to
	dnl # convert the RPM packages to the needed package type. This is
	dnl # a hack but so far it has worked reasonable well.
	dnl #
	AC_DEFUN([ZFS_AC_ALIEN], [
	ALIEN=alien

	AC_MSG_CHECKING([whether $ALIEN is available])
	AS_IF([tmp=$($ALIEN --version 2>/dev/null)], [
	ALIEN_VERSION=$(echo $tmp \| $AWK '{ print $[3] }')
	HAVE_ALIEN=yes
	AC_MSG_RESULT([$HAVE_ALIEN ($ALIEN_VERSION)])
	],[
	HAVE_ALIEN=no
	AC_MSG_RESULT([$HAVE_ALIEN])
	])

	AC_SUBST(HAVE_ALIEN)
	AC_SUBST(ALIEN)
	AC_SUBST(ALIEN_VERSION)
	])

	dnl #
	dnl # Using the VENDOR tag from config.guess set the default
	dnl # package type for 'make pkg': (rpm \| deb \| tgz)
	dnl #
	AC_DEFUN([ZFS_AC_DEFAULT_PACKAGE], [
	AC_MSG_CHECKING([os distribution])
	AC_ARG_WITH([vendor],
	[AS_HELP_STRING([--with-vendor],
	[Distribution vendor @<:@default=check@:>@])],
	[with_vendor=$withval],
	[with_vendor=check])
	AS_IF([test "x$with_vendor" = "xcheck"],[
	if test -f /etc/toss-release ; then
	VENDOR=toss ;
	elif test -f /etc/fedora-release ; then
	VENDOR=fedora ;
	elif test -f /etc/redhat-release ; then
	VENDOR=redhat ;
	elif test -f /etc/gentoo-release ; then
	VENDOR=gentoo ;
	elif test -f /etc/arch-release ; then
	VENDOR=arch ;
	elif test -f /etc/SuSE-release ; then
	VENDOR=sles ;
	elif test -f /etc/slackware-version ; then
	VENDOR=slackware ;
	elif test -f /etc/lunar.release ; then
	VENDOR=lunar ;
	elif test -f /etc/lsb-release ; then
	VENDOR=ubuntu ;
	elif test -f /etc/debian_version ; then
	VENDOR=debian ;
	elif test -f /etc/alpine-release ; then
	VENDOR=alpine ;
	elif test -f /bin/freebsd-version ; then
	VENDOR=freebsd ;
	else
	VENDOR= ;
	fi],
	[ test "x${with_vendor}" != x],[
	VENDOR="$with_vendor" ],
	[ VENDOR= ; ]
	)
	AC_MSG_RESULT([$VENDOR])
	AC_SUBST(VENDOR)

	AC_MSG_CHECKING([default package type])
	case "$VENDOR" in
	toss) DEFAULT_PACKAGE=rpm ;;
	redhat) DEFAULT_PACKAGE=rpm ;;
	fedora) DEFAULT_PACKAGE=rpm ;;
	gentoo) DEFAULT_PACKAGE=tgz ;;
	alpine) DEFAULT_PACKAGE=tgz ;;
	arch) DEFAULT_PACKAGE=tgz ;;
	sles) DEFAULT_PACKAGE=rpm ;;
	slackware) DEFAULT_PACKAGE=tgz ;;
	lunar) DEFAULT_PACKAGE=tgz ;;
	ubuntu) DEFAULT_PACKAGE=deb ;;
	debian) DEFAULT_PACKAGE=deb ;;
	freebsd) DEFAULT_PACKAGE=pkg ;;
	*) DEFAULT_PACKAGE=rpm ;;
	esac
	AC_MSG_RESULT([$DEFAULT_PACKAGE])
	AC_SUBST(DEFAULT_PACKAGE)

	AC_MSG_CHECKING([default init directory])
	case "$VENDOR" in
	freebsd) initdir=$sysconfdir/rc.d ;;
	*) initdir=$sysconfdir/init.d;;
	esac
	AC_MSG_RESULT([$initdir])
	AC_SUBST(initdir)

	AC_MSG_CHECKING([default init script type and shell])
	case "$VENDOR" in
	toss) DEFAULT_INIT_SCRIPT=redhat ;;
	redhat) DEFAULT_INIT_SCRIPT=redhat ;;
	fedora) DEFAULT_INIT_SCRIPT=fedora ;;
	gentoo) DEFAULT_INIT_SCRIPT=openrc ;;
	alpine) DEFAULT_INIT_SCRIPT=openrc ;;
	arch) DEFAULT_INIT_SCRIPT=lsb ;;
	sles) DEFAULT_INIT_SCRIPT=lsb ;;
	slackware) DEFAULT_INIT_SCRIPT=lsb ;;
	lunar) DEFAULT_INIT_SCRIPT=lunar ;;
	ubuntu) DEFAULT_INIT_SCRIPT=lsb ;;
	debian) DEFAULT_INIT_SCRIPT=lsb ;;
	freebsd) DEFAULT_INIT_SCRIPT=freebsd;;
	*) DEFAULT_INIT_SCRIPT=lsb ;;
	esac

	# On gentoo, it's possible that OpenRC isn't installed. Check if
	# /sbin/openrc-run exists, and if not, fall back to generic defaults.

	DEFAULT_INIT_SHELL="/bin/sh"
	AS_IF([test "$DEFAULT_INIT_SCRIPT" = "openrc"], [
	AS_IF([test -x "/sbin/openrc-run"],
	[DEFAULT_INIT_SHELL="/sbin/openrc-run"],
	[DEFAULT_INIT_SCRIPT=lsb])
	])

	AC_MSG_RESULT([$DEFAULT_INIT_SCRIPT:$DEFAULT_INIT_SHELL])
	AC_SUBST(DEFAULT_INIT_SCRIPT)
	AC_SUBST(DEFAULT_INIT_SHELL)

	AC_MSG_CHECKING([default nfs server init script])
	AS_IF([test "$VENDOR" = "debian"],
	[DEFAULT_INIT_NFS_SERVER="nfs-kernel-server"],
	[DEFAULT_INIT_NFS_SERVER="nfs"]
	)
	AC_MSG_RESULT([$DEFAULT_INIT_NFS_SERVER])
	AC_SUBST(DEFAULT_INIT_NFS_SERVER)

	AC_MSG_CHECKING([default init config directory])
	case "$VENDOR" in
	alpine) initconfdir=/etc/conf.d ;;
	gentoo) initconfdir=/etc/conf.d ;;
	toss) initconfdir=/etc/sysconfig ;;
	redhat) initconfdir=/etc/sysconfig ;;
	fedora) initconfdir=/etc/sysconfig ;;
	sles) initconfdir=/etc/sysconfig ;;
	ubuntu) initconfdir=/etc/default ;;
	debian) initconfdir=/etc/default ;;
	freebsd) initconfdir=$sysconfdir/rc.conf.d;;
	*) initconfdir=/etc/default ;;
	esac
	AC_MSG_RESULT([$initconfdir])
	AC_SUBST(initconfdir)

	AC_MSG_CHECKING([whether initramfs-tools is available])
	if test -d /usr/share/initramfs-tools ; then
	- DEFINE_INITRAMFS='--define "_initramfs 1"'
	+ RPM_DEFINE_INITRAMFS='--define "_initramfs 1"'
	AC_MSG_RESULT([yes])
	else
	- DEFINE_INITRAMFS=''
	+ RPM_DEFINE_INITRAMFS=''
	AC_MSG_RESULT([no])
	fi
	- AC_SUBST(DEFINE_INITRAMFS)
	+ AC_SUBST(RPM_DEFINE_INITRAMFS)
	])

	dnl #
	dnl # Default ZFS package configuration
	dnl #
	AC_DEFUN([ZFS_AC_PACKAGE], [
	ZFS_AC_DEFAULT_PACKAGE
	AS_IF([test x$VENDOR != xfreebsd], [
	ZFS_AC_RPM
	ZFS_AC_DPKG
	ZFS_AC_ALIEN
	])
	])
	Index: vendor-sys/openzfs/dist/configure.ac
	===================================================================
	--- vendor-sys/openzfs/dist/configure.ac (revision 365891)
	+++ vendor-sys/openzfs/dist/configure.ac (revision 365892)
	@@ -1,409 +1,411 @@
	/*
	* This file is part of the ZFS Linux port.
	*
	* Copyright (c) 2009 Lawrence Livermore National Security, LLC.
	* Produced at Lawrence Livermore National Laboratory
	* Written by:
	* Brian Behlendorf <behlendorf1@llnl.gov>,
	* Herb Wartens <wartens2@llnl.gov>,
	* Jim Garlick <garlick@llnl.gov>
	* LLNL-CODE-403049
	*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License, Version 1.0 only
	* (the "License"). You may not use this file except in compliance
	* with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	AC_INIT(m4_esyscmd(grep ^Name: META \| cut -d ':' -f 2 \| tr -d ' \n'),
	m4_esyscmd(grep ^Version: META \| cut -d ':' -f 2 \| tr -d ' \n'))
	AC_LANG(C)
	ZFS_AC_META
	AC_CONFIG_AUX_DIR([config])
	AC_CONFIG_MACRO_DIR([config])
	AC_CANONICAL_SYSTEM
	AM_MAINTAINER_MODE
	m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
	AM_INIT_AUTOMAKE([subdir-objects])
	AC_CONFIG_HEADERS([zfs_config.h], [
	(mv zfs_config.h zfs_config.h.tmp &&
	awk -f ${ac_srcdir}/config/config.awk zfs_config.h.tmp >zfs_config.h &&
	rm zfs_config.h.tmp) \|\| exit 1])

	AC_PROG_INSTALL
	AC_PROG_CC
	AC_PROG_LIBTOOL
	PKG_PROG_PKG_CONFIG
	AM_PROG_AS
	AM_PROG_CC_C_O
	AX_CODE_COVERAGE
	_AM_PROG_TAR(pax)

	ZFS_AC_LICENSE
	ZFS_AC_CONFIG
	ZFS_AC_PACKAGE
	ZFS_AC_DEBUG
	ZFS_AC_DEBUGINFO
	ZFS_AC_DEBUG_KMEM
	ZFS_AC_DEBUG_KMEM_TRACKING

	AC_CONFIG_FILES([
	Makefile
	cmd/Makefile
	cmd/arc_summary/Makefile
	cmd/arcstat/Makefile
	cmd/dbufstat/Makefile
	cmd/fsck_zfs/Makefile
	cmd/mount_zfs/Makefile
	cmd/raidz_test/Makefile
	cmd/vdev_id/Makefile
	cmd/zdb/Makefile
	cmd/zed/Makefile
	cmd/zed/zed.d/Makefile
	cmd/zfs/Makefile
	cmd/zfs_ids_to_path/Makefile
	cmd/zgenhostid/Makefile
	cmd/zhack/Makefile
	cmd/zinject/Makefile
	cmd/zpool/Makefile
	cmd/zstream/Makefile
	cmd/zstreamdump/Makefile
	cmd/ztest/Makefile
	cmd/zvol_id/Makefile
	cmd/zvol_wait/Makefile
	contrib/Makefile
	contrib/bash_completion.d/Makefile
	contrib/bpftrace/Makefile
	contrib/dracut/02zfsexpandknowledge/Makefile
	contrib/dracut/90zfs/Makefile
	contrib/dracut/Makefile
	contrib/initramfs/Makefile
	contrib/initramfs/conf.d/Makefile
	contrib/initramfs/conf-hooks.d/Makefile
	contrib/initramfs/hooks/Makefile
	contrib/initramfs/scripts/Makefile
	contrib/initramfs/scripts/local-top/Makefile
	contrib/pam_zfs_key/Makefile
	contrib/pyzfs/Makefile
	contrib/pyzfs/setup.py
	contrib/zcp/Makefile
	etc/Makefile
	etc/default/Makefile
	etc/init.d/Makefile
	etc/modules-load.d/Makefile
	etc/sudoers.d/Makefile
	etc/systemd/Makefile
	etc/systemd/system-generators/Makefile
	etc/systemd/system/Makefile
	etc/zfs/Makefile
	include/Makefile
	include/os/Makefile
	include/os/freebsd/Makefile
	include/os/freebsd/linux/Makefile
	include/os/freebsd/spl/Makefile
	include/os/freebsd/spl/acl/Makefile
	include/os/freebsd/spl/rpc/Makefile
	include/os/freebsd/spl/sys/Makefile
	include/os/freebsd/zfs/Makefile
	include/os/freebsd/zfs/sys/Makefile
	include/os/linux/Makefile
	include/os/linux/kernel/Makefile
	include/os/linux/kernel/linux/Makefile
	include/os/linux/spl/Makefile
	include/os/linux/spl/rpc/Makefile
	include/os/linux/spl/sys/Makefile
	include/os/linux/zfs/Makefile
	include/os/linux/zfs/sys/Makefile
	include/sys/Makefile
	include/sys/crypto/Makefile
	include/sys/fm/Makefile
	include/sys/fm/fs/Makefile
	include/sys/fs/Makefile
	include/sys/lua/Makefile
	include/sys/sysevent/Makefile
	include/sys/zstd/Makefile
	lib/Makefile
	lib/libavl/Makefile
	lib/libefi/Makefile
	lib/libicp/Makefile
	lib/libnvpair/Makefile
	lib/libshare/Makefile
	lib/libspl/Makefile
	lib/libspl/include/Makefile
	lib/libspl/include/ia32/Makefile
	lib/libspl/include/ia32/sys/Makefile
	lib/libspl/include/os/Makefile
	lib/libspl/include/os/freebsd/Makefile
	lib/libspl/include/os/freebsd/sys/Makefile
	lib/libspl/include/os/linux/Makefile
	lib/libspl/include/os/linux/sys/Makefile
	lib/libspl/include/rpc/Makefile
	lib/libspl/include/sys/Makefile
	lib/libspl/include/sys/dktp/Makefile
	lib/libspl/include/util/Makefile
	lib/libtpool/Makefile
	lib/libunicode/Makefile
	lib/libuutil/Makefile
	lib/libzfs/Makefile
	lib/libzfs/libzfs.pc
	+ lib/libzfsbootenv/Makefile
	+ lib/libzfsbootenv/libzfsbootenv.pc
	lib/libzfs_core/Makefile
	lib/libzfs_core/libzfs_core.pc
	lib/libzpool/Makefile
	lib/libzstd/Makefile
	lib/libzutil/Makefile
	man/Makefile
	man/man1/Makefile
	man/man5/Makefile
	man/man8/Makefile
	module/Kbuild
	module/Makefile
	module/avl/Makefile
	module/icp/Makefile
	module/lua/Makefile
	module/nvpair/Makefile
	module/os/linux/spl/Makefile
	module/os/linux/zfs/Makefile
	module/spl/Makefile
	module/unicode/Makefile
	module/zcommon/Makefile
	module/zfs/Makefile
	module/zstd/Makefile
	rpm/Makefile
	rpm/generic/Makefile
	rpm/generic/zfs-dkms.spec
	rpm/generic/zfs-kmod.spec
	rpm/generic/zfs.spec
	rpm/redhat/Makefile
	rpm/redhat/zfs-dkms.spec
	rpm/redhat/zfs-kmod.spec
	rpm/redhat/zfs.spec
	scripts/Makefile
	tests/Makefile
	tests/runfiles/Makefile
	tests/test-runner/Makefile
	tests/test-runner/bin/Makefile
	tests/test-runner/include/Makefile
	tests/test-runner/man/Makefile
	tests/zfs-tests/Makefile
	tests/zfs-tests/callbacks/Makefile
	tests/zfs-tests/cmd/Makefile
	tests/zfs-tests/cmd/btree_test/Makefile
	tests/zfs-tests/cmd/chg_usr_exec/Makefile
	tests/zfs-tests/cmd/devname2devid/Makefile
	tests/zfs-tests/cmd/dir_rd_update/Makefile
	tests/zfs-tests/cmd/file_check/Makefile
	tests/zfs-tests/cmd/file_trunc/Makefile
	tests/zfs-tests/cmd/file_write/Makefile
	tests/zfs-tests/cmd/get_diff/Makefile
	tests/zfs-tests/cmd/largest_file/Makefile
	tests/zfs-tests/cmd/libzfs_input_check/Makefile
	tests/zfs-tests/cmd/mkbusy/Makefile
	tests/zfs-tests/cmd/mkfile/Makefile
	tests/zfs-tests/cmd/mkfiles/Makefile
	tests/zfs-tests/cmd/mktree/Makefile
	tests/zfs-tests/cmd/mmap_exec/Makefile
	tests/zfs-tests/cmd/mmap_libaio/Makefile
	tests/zfs-tests/cmd/mmapwrite/Makefile
	tests/zfs-tests/cmd/nvlist_to_lua/Makefile
	tests/zfs-tests/cmd/randfree_file/Makefile
	tests/zfs-tests/cmd/randwritecomp/Makefile
	tests/zfs-tests/cmd/readmmap/Makefile
	tests/zfs-tests/cmd/rename_dir/Makefile
	tests/zfs-tests/cmd/rm_lnkcnt_zero_file/Makefile
	tests/zfs-tests/cmd/stride_dd/Makefile
	tests/zfs-tests/cmd/threadsappend/Makefile
	tests/zfs-tests/cmd/user_ns_exec/Makefile
	tests/zfs-tests/cmd/xattrtest/Makefile
	tests/zfs-tests/include/Makefile
	tests/zfs-tests/tests/Makefile
	tests/zfs-tests/tests/functional/Makefile
	tests/zfs-tests/tests/functional/acl/Makefile
	tests/zfs-tests/tests/functional/acl/posix/Makefile
	tests/zfs-tests/tests/functional/alloc_class/Makefile
	tests/zfs-tests/tests/functional/arc/Makefile
	tests/zfs-tests/tests/functional/atime/Makefile
	tests/zfs-tests/tests/functional/bootfs/Makefile
	tests/zfs-tests/tests/functional/btree/Makefile
	tests/zfs-tests/tests/functional/cache/Makefile
	tests/zfs-tests/tests/functional/cachefile/Makefile
	tests/zfs-tests/tests/functional/casenorm/Makefile
	tests/zfs-tests/tests/functional/channel_program/Makefile
	tests/zfs-tests/tests/functional/channel_program/lua_core/Makefile
	tests/zfs-tests/tests/functional/channel_program/synctask_core/Makefile
	tests/zfs-tests/tests/functional/chattr/Makefile
	tests/zfs-tests/tests/functional/checksum/Makefile
	tests/zfs-tests/tests/functional/clean_mirror/Makefile
	tests/zfs-tests/tests/functional/cli_root/Makefile
	tests/zfs-tests/tests/functional/cli_root/zdb/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_bookmark/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_change-key/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_clone/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_copies/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_create/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_destroy/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_diff/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_get/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_ids_to_path/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_inherit/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_jail/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_load-key/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_mount/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_program/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_promote/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_property/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_receive/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_rename/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_reservation/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_rollback/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_send/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_set/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_share/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_snapshot/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_sysfs/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_unload-key/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_unmount/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_unshare/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_upgrade/Makefile
	tests/zfs-tests/tests/functional/cli_root/zfs_wait/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_add/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_attach/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_clear/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_create/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_destroy/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_detach/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_events/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_expand/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_export/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_get/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_history/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_import/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_import/blockfiles/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_initialize/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_labelclear/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_offline/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_online/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_remove/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_reopen/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_replace/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_resilver/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_scrub/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_set/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_split/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_status/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_sync/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_trim/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_upgrade/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_upgrade/blockfiles/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_wait/Makefile
	tests/zfs-tests/tests/functional/cli_root/zpool_wait/scan/Makefile
	tests/zfs-tests/tests/functional/cli_user/Makefile
	tests/zfs-tests/tests/functional/cli_user/misc/Makefile
	tests/zfs-tests/tests/functional/cli_user/zfs_list/Makefile
	tests/zfs-tests/tests/functional/cli_user/zpool_iostat/Makefile
	tests/zfs-tests/tests/functional/cli_user/zpool_list/Makefile
	tests/zfs-tests/tests/functional/cli_user/zpool_status/Makefile
	tests/zfs-tests/tests/functional/compression/Makefile
	tests/zfs-tests/tests/functional/cp_files/Makefile
	tests/zfs-tests/tests/functional/ctime/Makefile
	tests/zfs-tests/tests/functional/deadman/Makefile
	tests/zfs-tests/tests/functional/delegate/Makefile
	tests/zfs-tests/tests/functional/devices/Makefile
	tests/zfs-tests/tests/functional/events/Makefile
	tests/zfs-tests/tests/functional/exec/Makefile
	tests/zfs-tests/tests/functional/fallocate/Makefile
	tests/zfs-tests/tests/functional/fault/Makefile
	tests/zfs-tests/tests/functional/features/Makefile
	tests/zfs-tests/tests/functional/features/async_destroy/Makefile
	tests/zfs-tests/tests/functional/features/large_dnode/Makefile
	tests/zfs-tests/tests/functional/grow/Makefile
	tests/zfs-tests/tests/functional/history/Makefile
	tests/zfs-tests/tests/functional/hkdf/Makefile
	tests/zfs-tests/tests/functional/inheritance/Makefile
	tests/zfs-tests/tests/functional/inuse/Makefile
	tests/zfs-tests/tests/functional/io/Makefile
	tests/zfs-tests/tests/functional/large_files/Makefile
	tests/zfs-tests/tests/functional/largest_pool/Makefile
	tests/zfs-tests/tests/functional/libzfs/Makefile
	tests/zfs-tests/tests/functional/limits/Makefile
	tests/zfs-tests/tests/functional/link_count/Makefile
	tests/zfs-tests/tests/functional/log_spacemap/Makefile
	tests/zfs-tests/tests/functional/migration/Makefile
	tests/zfs-tests/tests/functional/mmap/Makefile
	tests/zfs-tests/tests/functional/mmp/Makefile
	tests/zfs-tests/tests/functional/mount/Makefile
	tests/zfs-tests/tests/functional/mv_files/Makefile
	tests/zfs-tests/tests/functional/nestedfs/Makefile
	tests/zfs-tests/tests/functional/no_space/Makefile
	tests/zfs-tests/tests/functional/nopwrite/Makefile
	tests/zfs-tests/tests/functional/online_offline/Makefile
	tests/zfs-tests/tests/functional/pam/Makefile
	tests/zfs-tests/tests/functional/persist_l2arc/Makefile
	tests/zfs-tests/tests/functional/pool_checkpoint/Makefile
	tests/zfs-tests/tests/functional/pool_names/Makefile
	tests/zfs-tests/tests/functional/poolversion/Makefile
	tests/zfs-tests/tests/functional/privilege/Makefile
	tests/zfs-tests/tests/functional/procfs/Makefile
	tests/zfs-tests/tests/functional/projectquota/Makefile
	tests/zfs-tests/tests/functional/pyzfs/Makefile
	tests/zfs-tests/tests/functional/quota/Makefile
	tests/zfs-tests/tests/functional/raidz/Makefile
	tests/zfs-tests/tests/functional/redacted_send/Makefile
	tests/zfs-tests/tests/functional/redundancy/Makefile
	tests/zfs-tests/tests/functional/refquota/Makefile
	tests/zfs-tests/tests/functional/refreserv/Makefile
	tests/zfs-tests/tests/functional/removal/Makefile
	tests/zfs-tests/tests/functional/rename_dirs/Makefile
	tests/zfs-tests/tests/functional/replacement/Makefile
	tests/zfs-tests/tests/functional/reservation/Makefile
	tests/zfs-tests/tests/functional/rootpool/Makefile
	tests/zfs-tests/tests/functional/rsend/Makefile
	tests/zfs-tests/tests/functional/scrub_mirror/Makefile
	tests/zfs-tests/tests/functional/slog/Makefile
	tests/zfs-tests/tests/functional/snapshot/Makefile
	tests/zfs-tests/tests/functional/snapused/Makefile
	tests/zfs-tests/tests/functional/sparse/Makefile
	tests/zfs-tests/tests/functional/suid/Makefile
	tests/zfs-tests/tests/functional/threadsappend/Makefile
	tests/zfs-tests/tests/functional/tmpfile/Makefile
	tests/zfs-tests/tests/functional/trim/Makefile
	tests/zfs-tests/tests/functional/truncate/Makefile
	tests/zfs-tests/tests/functional/upgrade/Makefile
	tests/zfs-tests/tests/functional/user_namespace/Makefile
	tests/zfs-tests/tests/functional/userquota/Makefile
	tests/zfs-tests/tests/functional/vdev_zaps/Makefile
	tests/zfs-tests/tests/functional/write_dirs/Makefile
	tests/zfs-tests/tests/functional/xattr/Makefile
	tests/zfs-tests/tests/functional/zvol/Makefile
	tests/zfs-tests/tests/functional/zvol/zvol_ENOSPC/Makefile
	tests/zfs-tests/tests/functional/zvol/zvol_cli/Makefile
	tests/zfs-tests/tests/functional/zvol/zvol_misc/Makefile
	tests/zfs-tests/tests/functional/zvol/zvol_swap/Makefile
	tests/zfs-tests/tests/perf/Makefile
	tests/zfs-tests/tests/perf/fio/Makefile
	tests/zfs-tests/tests/perf/regression/Makefile
	tests/zfs-tests/tests/perf/scripts/Makefile
	tests/zfs-tests/tests/stress/Makefile
	udev/Makefile
	udev/rules.d/Makefile
	zfs.release
	])


	AC_OUTPUT
	Index: vendor-sys/openzfs/dist/contrib/dracut/90zfs/module-setup.sh.in
	===================================================================
	--- vendor-sys/openzfs/dist/contrib/dracut/90zfs/module-setup.sh.in (revision 365891)
	+++ vendor-sys/openzfs/dist/contrib/dracut/90zfs/module-setup.sh.in (revision 365892)
	@@ -1,119 +1,116 @@
	#!/usr/bin/env bash

	check() {
	# We depend on udev-rules being loaded
	[ "${1}" = "-d" ] && return 0

	# Verify the zfs tool chain
	- for tool in "@sbindir@/zpool" "@sbindir@/zfs" "@mounthelperdir@/mount.zfs" ; do
	+ for tool in "@bindir@/zgenhostid" "@sbindir@/zpool" "@sbindir@/zfs" "@mounthelperdir@/mount.zfs" ; do
	test -x "$tool" \|\| return 1
	done
	# Verify grep exists
	which grep >/dev/null 2>&1 \|\| return 1

	return 0
	}

	depends() {
	echo udev-rules
	return 0
	}

	installkernel() {
	instmods zfs
	instmods zcommon
	instmods znvpair
	instmods zavl
	instmods zunicode
	instmods zlua
	instmods icp
	instmods spl
	instmods zlib_deflate
	instmods zlib_inflate
	}

	install() {
	inst_rules @udevruledir@/90-zfs.rules
	inst_rules @udevruledir@/69-vdev.rules
	inst_rules @udevruledir@/60-zvol.rules
	dracut_install hostid
	dracut_install grep
	+ dracut_install @bindir@/zgenhostid
	dracut_install @sbindir@/zfs
	dracut_install @sbindir@/zpool
	# Workaround for zfsonlinux/zfs#4749 by ensuring libgcc_s.so(.1) is included
	if [[ -n "$(ldd @sbindir@/zpool \| grep -F 'libgcc_s.so')" ]]; then
	# Dracut will have already tracked and included it
	:;
	elif command -v gcc-config 2>&1 1>/dev/null; then
	# On systems with gcc-config (Gentoo, Funtoo, etc.):
	# Use the current profile to resolve the appropriate path
	dracut_install "/usr/lib/gcc/$(s=$(gcc-config -c); echo ${s%-}/${s##-})/libgcc_s.so.1"
	elif [[ -n "$(ls /usr/lib/libgcc_s.so* 2>/dev/null)" ]]; then
	# Try a simple path first
	dracut_install /usr/lib/libgcc_s.so*
	else
	# Fallback: Guess the path and include all matches
	dracut_install /usr/lib/gcc///libgcc_s.so*
	fi
	dracut_install @mounthelperdir@/mount.zfs
	dracut_install @udevdir@/vdev_id
	dracut_install awk
	dracut_install basename
	dracut_install cut
	dracut_install head
	dracut_install @udevdir@/zvol_id
	inst_hook cmdline 95 "${moddir}/parse-zfs.sh"
	if [ -n "$systemdutildir" ] ; then
	inst_script "${moddir}/zfs-generator.sh" "$systemdutildir"/system-generators/dracut-zfs-generator
	fi
	inst_hook pre-mount 90 "${moddir}/zfs-load-key.sh"
	inst_hook mount 98 "${moddir}/mount-zfs.sh"
	inst_hook cleanup 99 "${moddir}/zfs-needshutdown.sh"
	inst_hook shutdown 20 "${moddir}/export-zfs.sh"

	inst_simple "${moddir}/zfs-lib.sh" "/lib/dracut-zfs-lib.sh"
	if [ -e @sysconfdir@/zfs/zpool.cache ]; then
	inst @sysconfdir@/zfs/zpool.cache
	type mark_hostonly >/dev/null 2>&1 && mark_hostonly @sysconfdir@/zfs/zpool.cache
	fi

	if [ -e @sysconfdir@/zfs/vdev_id.conf ]; then
	inst @sysconfdir@/zfs/vdev_id.conf
	type mark_hostonly >/dev/null 2>&1 && mark_hostonly @sysconfdir@/zfs/vdev_id.conf
	fi

	# Synchronize initramfs and system hostid
	- AA=`hostid \| cut -b 1,2`
	- BB=`hostid \| cut -b 3,4`
	- CC=`hostid \| cut -b 5,6`
	- DD=`hostid \| cut -b 7,8`
	- echo -ne "\\x${DD}\\x${CC}\\x${BB}\\x${AA}" > "${initdir}/etc/hostid"
	+ zgenhostid -o "${initdir}/etc/hostid" "$(hostid)"

	if dracut_module_included "systemd"; then
	mkdir -p "${initdir}/$systemdsystemunitdir/zfs-import.target.wants"
	for _item in scan cache ; do
	dracut_install @systemdunitdir@/zfs-import-$_item.service
	if ! [ -L "${initdir}/$systemdsystemunitdir/zfs-import.target.wants"/zfs-import-$_item.service ]; then
	ln -s ../zfs-import-$_item.service "${initdir}/$systemdsystemunitdir/zfs-import.target.wants"/zfs-import-$_item.service
	type mark_hostonly >/dev/null 2>&1 && mark_hostonly @systemdunitdir@/zfs-import-$_item.service
	fi
	done
	inst "${moddir}"/zfs-env-bootfs.service "${systemdsystemunitdir}"/zfs-env-bootfs.service
	ln -s ../zfs-env-bootfs.service "${initdir}/${systemdsystemunitdir}/zfs-import.target.wants"/zfs-env-bootfs.service
	type mark_hostonly >/dev/null 2>&1 && mark_hostonly @systemdunitdir@/zfs-env-bootfs.service
	dracut_install systemd-ask-password
	dracut_install systemd-tty-ask-password-agent
	mkdir -p "${initdir}/$systemdsystemunitdir/initrd.target.wants"
	dracut_install @systemdunitdir@/zfs-import.target
	if ! [ -L "${initdir}/$systemdsystemunitdir/initrd.target.wants"/zfs-import.target ]; then
	ln -s ../zfs-import.target "${initdir}/$systemdsystemunitdir/initrd.target.wants"/zfs-import.target
	type mark_hostonly >/dev/null 2>&1 && mark_hostonly @systemdunitdir@/zfs-import.target
	fi
	for _service in zfs-snapshot-bootfs.service zfs-rollback-bootfs.service ; do
	inst "${moddir}"/$_service "${systemdsystemunitdir}"/$_service
	if ! [ -L "${initdir}/$systemdsystemunitdir/initrd.target.wants"/$_service ]; then
	ln -s ../$_service "${initdir}/$systemdsystemunitdir/initrd.target.wants"/$_service
	fi
	done
	fi
	}
	Index: vendor-sys/openzfs/dist/contrib/dracut/90zfs/parse-zfs.sh.in
	===================================================================
	--- vendor-sys/openzfs/dist/contrib/dracut/90zfs/parse-zfs.sh.in (revision 365891)
	+++ vendor-sys/openzfs/dist/contrib/dracut/90zfs/parse-zfs.sh.in (revision 365892)
	@@ -1,66 +1,62 @@
	#!/bin/bash

	. /lib/dracut-lib.sh

	# Let the command line override our host id.
	spl_hostid=$(getarg spl_hostid=)
	if [ -n "${spl_hostid}" ] ; then
	info "ZFS: Using hostid from command line: ${spl_hostid}"
	- AA=$(echo "${spl_hostid}" \| cut -b 1,2)
	- BB=$(echo "${spl_hostid}" \| cut -b 3,4)
	- CC=$(echo "${spl_hostid}" \| cut -b 5,6)
	- DD=$(echo "${spl_hostid}" \| cut -b 7,8)
	- echo -ne "\\x${DD}\\x${CC}\\x${BB}\\x${AA}" >/etc/hostid
	+ zgenhostid -f "${spl_hostid}"
	elif [ -f "/etc/hostid" ] ; then
	info "ZFS: Using hostid from /etc/hostid: $(hostid)"
	else
	warn "ZFS: No hostid found on kernel command line or /etc/hostid."
	warn "ZFS: Pools may not import correctly."
	fi

	wait_for_zfs=0
	case "${root}" in
	""\|zfs\|zfs:)
	# We'll take root unset, root=zfs, or root=zfs:
	# No root set, so we want to read the bootfs attribute. We
	# can't do that until udev settles so we'll set dummy values
	# and hope for the best later on.
	root="zfs:AUTO"
	rootok=1
	wait_for_zfs=1

	info "ZFS: Enabling autodetection of bootfs after udev settles."
	;;

	ZFS\=\|zfs:\|zfs:FILESYSTEM\=\|FILESYSTEM\=)
	# root is explicit ZFS root. Parse it now. We can handle
	# a root=... param in any of the following formats:
	# root=ZFS=rpool/ROOT
	# root=zfs:rpool/ROOT
	# root=zfs:FILESYSTEM=rpool/ROOT
	# root=FILESYSTEM=rpool/ROOT
	# root=ZFS=pool+with+space/ROOT+WITH+SPACE (translates to root=ZFS=pool with space/ROOT WITH SPACE)

	# Strip down to just the pool/fs
	root="${root#zfs:}"
	root="${root#FILESYSTEM=}"
	root="zfs:${root#ZFS=}"
	# switch + with spaces because kernel cmdline does not allow us to quote parameters
	root=$(printf '%s\n' "$root" \| sed "s/+/ /g")
	rootok=1
	wait_for_zfs=1

	info "ZFS: Set ${root} as bootfs."
	;;
	esac

	# Make sure Dracut is happy that we have a root and will wait for ZFS
	# modules to settle before mounting.
	if [ ${wait_for_zfs} -eq 1 ]; then
	ln -s /dev/null /dev/root 2>/dev/null
	initqueuedir="${hookdir}/initqueue/finished"
	test -d "${initqueuedir}" \|\| {
	initqueuedir="${hookdir}/initqueue-finished"
	}
	echo '[ -e /dev/zfs ]' > "${initqueuedir}/zfs.sh"
	fi
	Index: vendor-sys/openzfs/dist/include/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/include/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/include/Makefile.am (revision 365892)
	@@ -1,33 +1,34 @@
	SUBDIRS = sys os

	COMMON_H = \
	cityhash.h \
	zfeature_common.h \
	zfs_comutil.h \
	zfs_deleg.h \
	zfs_fletcher.h \
	zfs_namecheck.h \
	zfs_prop.h

	USER_H = \
	libnvpair.h \
	libuutil_common.h \
	libuutil.h \
	libuutil_impl.h \
	libzfs.h \
	+ libzfsbootenv.h \
	libzfs_core.h \
	libzfs_impl.h \
	libzutil.h \
	thread_pool.h

	if CONFIG_USER
	libzfsdir = $(includedir)/libzfs
	libzfs_HEADERS = $(COMMON_H) $(USER_H)
	endif

	if CONFIG_KERNEL
	if BUILD_LINUX
	kerneldir = @prefix@/src/zfs-$(VERSION)/include
	kernel_HEADERS = $(COMMON_H)
	endif
	endif
	Index: vendor-sys/openzfs/dist/include/libzfs.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/libzfs.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/libzfs.h (revision 365892)
	@@ -1,932 +1,932 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright Joyent, Inc.
	* Copyright (c) 2013 Steven Hartland. All rights reserved.
	* Copyright (c) 2016, Intel Corporation.
	* Copyright 2016 Nexenta Systems, Inc.
	* Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
	* Copyright (c) 2019 Datto Inc.
	*/

	#ifndef _LIBZFS_H
	#define _LIBZFS_H

	#include <assert.h>
	#include <libnvpair.h>
	#include <sys/mnttab.h>
	#include <sys/param.h>
	#include <sys/types.h>
	#include <sys/varargs.h>
	#include <sys/fs/zfs.h>
	#include <sys/avl.h>
	#include <ucred.h>
	#include <libzfs_core.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	/*
	* Miscellaneous ZFS constants
	*/
	#define ZFS_MAXPROPLEN MAXPATHLEN
	#define ZPOOL_MAXPROPLEN MAXPATHLEN

	/*
	* libzfs errors
	*/
	typedef enum zfs_error {
	EZFS_SUCCESS = 0, /* no error -- success */
	EZFS_NOMEM = 2000, /* out of memory */
	EZFS_BADPROP, /* invalid property value */
	EZFS_PROPREADONLY, /* cannot set readonly property */
	EZFS_PROPTYPE, /* property does not apply to dataset type */
	EZFS_PROPNONINHERIT, /* property is not inheritable */
	EZFS_PROPSPACE, /* bad quota or reservation */
	EZFS_BADTYPE, /* dataset is not of appropriate type */
	EZFS_BUSY, /* pool or dataset is busy */
	EZFS_EXISTS, /* pool or dataset already exists */
	EZFS_NOENT, /* no such pool or dataset */
	EZFS_BADSTREAM, /* bad backup stream */
	EZFS_DSREADONLY, /* dataset is readonly */
	EZFS_VOLTOOBIG, /* volume is too large for 32-bit system */
	EZFS_INVALIDNAME, /* invalid dataset name */
	EZFS_BADRESTORE, /* unable to restore to destination */
	EZFS_BADBACKUP, /* backup failed */
	EZFS_BADTARGET, /* bad attach/detach/replace target */
	EZFS_NODEVICE, /* no such device in pool */
	EZFS_BADDEV, /* invalid device to add */
	EZFS_NOREPLICAS, /* no valid replicas */
	EZFS_RESILVERING, /* resilvering (healing reconstruction) */
	EZFS_BADVERSION, /* unsupported version */
	EZFS_POOLUNAVAIL, /* pool is currently unavailable */
	EZFS_DEVOVERFLOW, /* too many devices in one vdev */
	EZFS_BADPATH, /* must be an absolute path */
	EZFS_CROSSTARGET, /* rename or clone across pool or dataset */
	EZFS_ZONED, /* used improperly in local zone */
	EZFS_MOUNTFAILED, /* failed to mount dataset */
	EZFS_UMOUNTFAILED, /* failed to unmount dataset */
	EZFS_UNSHARENFSFAILED, /* unshare(1M) failed */
	EZFS_SHARENFSFAILED, /* share(1M) failed */
	EZFS_PERM, /* permission denied */
	EZFS_NOSPC, /* out of space */
	EZFS_FAULT, /* bad address */
	EZFS_IO, /* I/O error */
	EZFS_INTR, /* signal received */
	EZFS_ISSPARE, /* device is a hot spare */
	EZFS_INVALCONFIG, /* invalid vdev configuration */
	EZFS_RECURSIVE, /* recursive dependency */
	EZFS_NOHISTORY, /* no history object */
	EZFS_POOLPROPS, /* couldn't retrieve pool props */
	EZFS_POOL_NOTSUP, /* ops not supported for this type of pool */
	EZFS_POOL_INVALARG, /* invalid argument for this pool operation */
	EZFS_NAMETOOLONG, /* dataset name is too long */
	EZFS_OPENFAILED, /* open of device failed */
	EZFS_NOCAP, /* couldn't get capacity */
	EZFS_LABELFAILED, /* write of label failed */
	EZFS_BADWHO, /* invalid permission who */
	EZFS_BADPERM, /* invalid permission */
	EZFS_BADPERMSET, /* invalid permission set name */
	EZFS_NODELEGATION, /* delegated administration is disabled */
	EZFS_UNSHARESMBFAILED, /* failed to unshare over smb */
	EZFS_SHARESMBFAILED, /* failed to share over smb */
	EZFS_BADCACHE, /* bad cache file */
	EZFS_ISL2CACHE, /* device is for the level 2 ARC */
	EZFS_VDEVNOTSUP, /* unsupported vdev type */
	EZFS_NOTSUP, /* ops not supported on this dataset */
	EZFS_ACTIVE_SPARE, /* pool has active shared spare devices */
	EZFS_UNPLAYED_LOGS, /* log device has unplayed logs */
	EZFS_REFTAG_RELE, /* snapshot release: tag not found */
	EZFS_REFTAG_HOLD, /* snapshot hold: tag already exists */
	EZFS_TAGTOOLONG, /* snapshot hold/rele: tag too long */
	EZFS_PIPEFAILED, /* pipe create failed */
	EZFS_THREADCREATEFAILED, /* thread create failed */
	EZFS_POSTSPLIT_ONLINE, /* onlining a disk after splitting it */
	EZFS_SCRUBBING, /* currently scrubbing */
	EZFS_NO_SCRUB, /* no active scrub */
	EZFS_DIFF, /* general failure of zfs diff */
	EZFS_DIFFDATA, /* bad zfs diff data */
	EZFS_POOLREADONLY, /* pool is in read-only mode */
	EZFS_SCRUB_PAUSED, /* scrub currently paused */
	EZFS_ACTIVE_POOL, /* pool is imported on a different system */
	EZFS_CRYPTOFAILED, /* failed to setup encryption */
	EZFS_NO_PENDING, /* cannot cancel, no operation is pending */
	EZFS_CHECKPOINT_EXISTS, /* checkpoint exists */
	EZFS_DISCARDING_CHECKPOINT, /* currently discarding a checkpoint */
	EZFS_NO_CHECKPOINT, /* pool has no checkpoint */
	EZFS_DEVRM_IN_PROGRESS, /* a device is currently being removed */
	EZFS_VDEV_TOO_BIG, /* a device is too big to be used */
	EZFS_IOC_NOTSUPPORTED, /* operation not supported by zfs module */
	EZFS_TOOMANY, /* argument list too long */
	EZFS_INITIALIZING, /* currently initializing */
	EZFS_NO_INITIALIZE, /* no active initialize */
	EZFS_WRONG_PARENT, /* invalid parent dataset (e.g ZVOL) */
	EZFS_TRIMMING, /* currently trimming */
	EZFS_NO_TRIM, /* no active trim */
	EZFS_TRIM_NOTSUP, /* device does not support trim */
	EZFS_NO_RESILVER_DEFER, /* pool doesn't support resilver_defer */
	EZFS_EXPORT_IN_PROGRESS, /* currently exporting the pool */
	EZFS_REBUILDING, /* resilvering (sequential reconstrution) */
	EZFS_UNKNOWN
	} zfs_error_t;

	/*
	* The following data structures are all part
	* of the zfs_allow_t data structure which is
	* used for printing 'allow' permissions.
	* It is a linked list of zfs_allow_t's which
	* then contain avl tree's for user/group/sets/...
	* and each one of the entries in those trees have
	* avl tree's for the permissions they belong to and
	* whether they are local,descendent or local+descendent
	* permissions. The AVL trees are used primarily for
	* sorting purposes, but also so that we can quickly find
	* a given user and or permission.
	*/
	typedef struct zfs_perm_node {
	avl_node_t z_node;
	char z_pname[MAXPATHLEN];
	} zfs_perm_node_t;

	typedef struct zfs_allow_node {
	avl_node_t z_node;
	char z_key[MAXPATHLEN]; /* name, such as joe */
	avl_tree_t z_localdescend; /* local+descendent perms */
	avl_tree_t z_local; /* local permissions */
	avl_tree_t z_descend; /* descendent permissions */
	} zfs_allow_node_t;

	typedef struct zfs_allow {
	struct zfs_allow *z_next;
	char z_setpoint[MAXPATHLEN];
	avl_tree_t z_sets;
	avl_tree_t z_crperms;
	avl_tree_t z_user;
	avl_tree_t z_group;
	avl_tree_t z_everyone;
	} zfs_allow_t;

	/*
	* Basic handle types
	*/
	typedef struct zfs_handle zfs_handle_t;
	typedef struct zpool_handle zpool_handle_t;
	typedef struct libzfs_handle libzfs_handle_t;

	extern int zpool_wait(zpool_handle_t *, zpool_wait_activity_t);
	extern int zpool_wait_status(zpool_handle_t *, zpool_wait_activity_t,
	boolean_t , boolean_t );

	/*
	* Library initialization
	*/
	extern libzfs_handle_t *libzfs_init(void);
	extern void libzfs_fini(libzfs_handle_t *);

	extern libzfs_handle_t zpool_get_handle(zpool_handle_t );
	extern libzfs_handle_t zfs_get_handle(zfs_handle_t );

	extern void libzfs_print_on_error(libzfs_handle_t *, boolean_t);

	extern void zfs_save_arguments(int argc, char *, char , int);
	extern int zpool_log_history(libzfs_handle_t , const char );

	extern int libzfs_errno(libzfs_handle_t *);
	extern const char *libzfs_error_init(int);
	extern const char libzfs_error_action(libzfs_handle_t );
	extern const char libzfs_error_description(libzfs_handle_t );
	extern int zfs_standard_error(libzfs_handle_t , int, const char );
	extern void libzfs_mnttab_init(libzfs_handle_t *);
	extern void libzfs_mnttab_fini(libzfs_handle_t *);
	extern void libzfs_mnttab_cache(libzfs_handle_t *, boolean_t);
	extern int libzfs_mnttab_find(libzfs_handle_t , const char ,
	struct mnttab *);
	extern void libzfs_mnttab_add(libzfs_handle_t , const char ,
	const char , const char );
	extern void libzfs_mnttab_remove(libzfs_handle_t , const char );

	/*
	* Basic handle functions
	*/
	extern zpool_handle_t zpool_open(libzfs_handle_t , const char *);
	extern zpool_handle_t zpool_open_canfail(libzfs_handle_t , const char *);
	extern void zpool_close(zpool_handle_t *);
	extern const char zpool_get_name(zpool_handle_t );
	extern int zpool_get_state(zpool_handle_t *);
	extern const char *zpool_state_to_name(vdev_state_t, vdev_aux_t);
	extern const char *zpool_pool_state_to_name(pool_state_t);
	extern void zpool_free_handles(libzfs_handle_t *);

	/*
	* Iterate over all active pools in the system.
	*/
	typedef int (zpool_iter_f)(zpool_handle_t , void *);
	extern int zpool_iter(libzfs_handle_t , zpool_iter_f, void );
	extern boolean_t zpool_skip_pool(const char *);

	/*
	* Functions to create and destroy pools
	*/
	extern int zpool_create(libzfs_handle_t , const char , nvlist_t *,
	nvlist_t , nvlist_t );
	extern int zpool_destroy(zpool_handle_t , const char );
	extern int zpool_add(zpool_handle_t , nvlist_t );

	typedef struct splitflags {
	/* do not split, but return the config that would be split off */
	int dryrun : 1;

	/* after splitting, import the pool */
	int import : 1;
	int name_flags;
	} splitflags_t;

	typedef struct trimflags {
	/* requested vdevs are for the entire pool */
	boolean_t fullpool;

	/* request a secure trim, requires support from device */
	boolean_t secure;

	/* after starting trim, block until trim completes */
	boolean_t wait;

	/* trim at the requested rate in bytes/second */
	uint64_t rate;
	} trimflags_t;

	/*
	* Functions to manipulate pool and vdev state
	*/
	extern int zpool_scan(zpool_handle_t *, pool_scan_func_t, pool_scrub_cmd_t);
	extern int zpool_initialize(zpool_handle_t *, pool_initialize_func_t,
	nvlist_t *);
	extern int zpool_initialize_wait(zpool_handle_t *, pool_initialize_func_t,
	nvlist_t *);
	extern int zpool_trim(zpool_handle_t , pool_trim_func_t, nvlist_t ,
	trimflags_t *);

	extern int zpool_clear(zpool_handle_t , const char , nvlist_t *);
	extern int zpool_reguid(zpool_handle_t *);
	extern int zpool_reopen_one(zpool_handle_t , void );

	extern int zpool_sync_one(zpool_handle_t , void );

	extern int zpool_vdev_online(zpool_handle_t , const char , int,
	vdev_state_t *);
	extern int zpool_vdev_offline(zpool_handle_t , const char , boolean_t);
	extern int zpool_vdev_attach(zpool_handle_t , const char ,
	const char , nvlist_t , int, boolean_t);
	extern int zpool_vdev_detach(zpool_handle_t , const char );
	extern int zpool_vdev_remove(zpool_handle_t , const char );
	extern int zpool_vdev_remove_cancel(zpool_handle_t *);
	extern int zpool_vdev_indirect_size(zpool_handle_t , const char , uint64_t *);
	extern int zpool_vdev_split(zpool_handle_t , char , nvlist_t *, nvlist_t ,
	splitflags_t);

	extern int zpool_vdev_fault(zpool_handle_t *, uint64_t, vdev_aux_t);
	extern int zpool_vdev_degrade(zpool_handle_t *, uint64_t, vdev_aux_t);
	extern int zpool_vdev_clear(zpool_handle_t *, uint64_t);

	extern nvlist_t zpool_find_vdev(zpool_handle_t , const char , boolean_t ,
	boolean_t , boolean_t );
	extern nvlist_t zpool_find_vdev_by_physpath(zpool_handle_t , const char *,
	boolean_t , boolean_t , boolean_t *);
	extern int zpool_label_disk(libzfs_handle_t , zpool_handle_t , const char *);
	extern uint64_t zpool_vdev_path_to_guid(zpool_handle_t zhp, const char path);

	const char zpool_get_state_str(zpool_handle_t );

	/*
	* Functions to manage pool properties
	*/
	extern int zpool_set_prop(zpool_handle_t , const char , const char *);
	extern int zpool_get_prop(zpool_handle_t , zpool_prop_t, char ,
	size_t proplen, zprop_source_t *, boolean_t literal);
	extern uint64_t zpool_get_prop_int(zpool_handle_t *, zpool_prop_t,
	zprop_source_t *);
	extern int zpool_props_refresh(zpool_handle_t *);

	extern const char *zpool_prop_to_name(zpool_prop_t);
	extern const char *zpool_prop_values(zpool_prop_t);

	/*
	* Pool health statistics.
	*/
	typedef enum {
	/*
	* The following correspond to faults as defined in the (fault.fs.zfs.*)
	* event namespace. Each is associated with a corresponding message ID.
	* This must be kept in sync with the zfs_msgid_table in
	* lib/libzfs/libzfs_status.c.
	*/
	ZPOOL_STATUS_CORRUPT_CACHE, /* corrupt /kernel/drv/zpool.cache */
	ZPOOL_STATUS_MISSING_DEV_R, /* missing device with replicas */
	ZPOOL_STATUS_MISSING_DEV_NR, /* missing device with no replicas */
	ZPOOL_STATUS_CORRUPT_LABEL_R, /* bad device label with replicas */
	ZPOOL_STATUS_CORRUPT_LABEL_NR, /* bad device label with no replicas */
	ZPOOL_STATUS_BAD_GUID_SUM, /* sum of device guids didn't match */
	ZPOOL_STATUS_CORRUPT_POOL, /* pool metadata is corrupted */
	ZPOOL_STATUS_CORRUPT_DATA, /* data errors in user (meta)data */
	ZPOOL_STATUS_FAILING_DEV, /* device experiencing errors */
	ZPOOL_STATUS_VERSION_NEWER, /* newer on-disk version */
	ZPOOL_STATUS_HOSTID_MISMATCH, /* last accessed by another system */
	ZPOOL_STATUS_HOSTID_ACTIVE, /* currently active on another system */
	ZPOOL_STATUS_HOSTID_REQUIRED, /* multihost=on and hostid=0 */
	ZPOOL_STATUS_IO_FAILURE_WAIT, /* failed I/O, failmode 'wait' */
	ZPOOL_STATUS_IO_FAILURE_CONTINUE, /* failed I/O, failmode 'continue' */
	ZPOOL_STATUS_IO_FAILURE_MMP, /* failed MMP, failmode not 'panic' */
	ZPOOL_STATUS_BAD_LOG, /* cannot read log chain(s) */
	ZPOOL_STATUS_ERRATA, /* informational errata available */

	/*
	* If the pool has unsupported features but can still be opened in
	* read-only mode, its status is ZPOOL_STATUS_UNSUP_FEAT_WRITE. If the
	* pool has unsupported features but cannot be opened at all, its
	* status is ZPOOL_STATUS_UNSUP_FEAT_READ.
	*/
	ZPOOL_STATUS_UNSUP_FEAT_READ, /* unsupported features for read */
	ZPOOL_STATUS_UNSUP_FEAT_WRITE, /* unsupported features for write */

	/*
	* These faults have no corresponding message ID. At the time we are
	* checking the status, the original reason for the FMA fault (I/O or
	* checksum errors) has been lost.
	*/
	ZPOOL_STATUS_FAULTED_DEV_R, /* faulted device with replicas */
	ZPOOL_STATUS_FAULTED_DEV_NR, /* faulted device with no replicas */

	/*
	* The following are not faults per se, but still an error possibly
	* requiring administrative attention. There is no corresponding
	* message ID.
	*/
	ZPOOL_STATUS_VERSION_OLDER, /* older legacy on-disk version */
	ZPOOL_STATUS_FEAT_DISABLED, /* supported features are disabled */
	ZPOOL_STATUS_RESILVERING, /* device being resilvered */
	ZPOOL_STATUS_OFFLINE_DEV, /* device offline */
	ZPOOL_STATUS_REMOVED_DEV, /* removed device */
	ZPOOL_STATUS_REBUILDING, /* device being rebuilt */
	ZPOOL_STATUS_REBUILD_SCRUB, /* recommend scrubbing the pool */
	ZPOOL_STATUS_NON_NATIVE_ASHIFT, /* (e.g. 512e dev with ashift of 9) */

	/*
	* Finally, the following indicates a healthy pool.
	*/
	ZPOOL_STATUS_OK
	} zpool_status_t;

	extern zpool_status_t zpool_get_status(zpool_handle_t , char *,
	zpool_errata_t *);
	extern zpool_status_t zpool_import_status(nvlist_t , char *,
	zpool_errata_t *);

	/*
	* Statistics and configuration functions.
	*/
	extern nvlist_t zpool_get_config(zpool_handle_t , nvlist_t **);
	extern nvlist_t zpool_get_features(zpool_handle_t );
	extern int zpool_refresh_stats(zpool_handle_t , boolean_t );
	extern int zpool_get_errlog(zpool_handle_t , nvlist_t *);

	/*
	* Import and export functions
	*/
	extern int zpool_export(zpool_handle_t , boolean_t, const char );
	extern int zpool_export_force(zpool_handle_t , const char );
	extern int zpool_import(libzfs_handle_t , nvlist_t , const char *,
	char *altroot);
	extern int zpool_import_props(libzfs_handle_t , nvlist_t , const char *,
	nvlist_t *, int);
	extern void zpool_print_unsup_feat(nvlist_t *config);

	/*
	* Miscellaneous pool functions
	*/
	struct zfs_cmd;

	extern const char *zfs_history_event_names[];

	typedef enum {
	VDEV_NAME_PATH = 1 << 0,
	VDEV_NAME_GUID = 1 << 1,
	VDEV_NAME_FOLLOW_LINKS = 1 << 2,
	VDEV_NAME_TYPE_ID = 1 << 3,
	} vdev_name_t;

	extern char zpool_vdev_name(libzfs_handle_t , zpool_handle_t , nvlist_t ,
	int name_flags);
	extern int zpool_upgrade(zpool_handle_t *, uint64_t);
	extern int zpool_get_history(zpool_handle_t , nvlist_t , uint64_t ,
	boolean_t *);
	extern int zpool_events_next(libzfs_handle_t , nvlist_t , int , unsigned,
	int);
	extern int zpool_events_clear(libzfs_handle_t , int );
	extern int zpool_events_seek(libzfs_handle_t *, uint64_t, int);
	extern void zpool_obj_to_path_ds(zpool_handle_t , uint64_t, uint64_t, char ,
	size_t);
	extern void zpool_obj_to_path(zpool_handle_t , uint64_t, uint64_t, char ,
	size_t);
	extern int zfs_ioctl(libzfs_handle_t , int, struct zfs_cmd );
	extern int zpool_get_physpath(zpool_handle_t , char , size_t);
	extern void zpool_explain_recover(libzfs_handle_t , const char , int,
	nvlist_t *);
	extern int zpool_checkpoint(zpool_handle_t *);
	extern int zpool_discard_checkpoint(zpool_handle_t *);

	/*
	* Basic handle manipulations. These functions do not create or destroy the
	* underlying datasets, only the references to them.
	*/
	extern zfs_handle_t zfs_open(libzfs_handle_t , const char *, int);
	extern zfs_handle_t zfs_handle_dup(zfs_handle_t );
	extern void zfs_close(zfs_handle_t *);
	extern zfs_type_t zfs_get_type(const zfs_handle_t *);
	extern const char zfs_get_name(const zfs_handle_t );
	extern zpool_handle_t zfs_get_pool_handle(const zfs_handle_t );
	extern const char zfs_get_pool_name(const zfs_handle_t );

	/*
	* Property management functions. Some functions are shared with the kernel,
	* and are found in sys/fs/zfs.h.
	*/

	/*
	* zfs dataset property management
	*/
	extern const char *zfs_prop_default_string(zfs_prop_t);
	extern uint64_t zfs_prop_default_numeric(zfs_prop_t);
	extern const char *zfs_prop_column_name(zfs_prop_t);
	extern boolean_t zfs_prop_align_right(zfs_prop_t);

	extern nvlist_t zfs_valid_proplist(libzfs_handle_t , zfs_type_t, nvlist_t *,
	uint64_t, zfs_handle_t , zpool_handle_t , boolean_t, const char *);

	extern const char *zfs_prop_to_name(zfs_prop_t);
	extern int zfs_prop_set(zfs_handle_t , const char , const char *);
	extern int zfs_prop_set_list(zfs_handle_t , nvlist_t );
	extern int zfs_prop_get(zfs_handle_t , zfs_prop_t, char , size_t,
	zprop_source_t , char , size_t, boolean_t);
	extern int zfs_prop_get_recvd(zfs_handle_t , const char , char *, size_t,
	boolean_t);
	extern int zfs_prop_get_numeric(zfs_handle_t , zfs_prop_t, uint64_t ,
	zprop_source_t , char , size_t);
	extern int zfs_prop_get_userquota_int(zfs_handle_t zhp, const char propname,
	uint64_t *propvalue);
	extern int zfs_prop_get_userquota(zfs_handle_t zhp, const char propname,
	char *propbuf, int proplen, boolean_t literal);
	extern int zfs_prop_get_written_int(zfs_handle_t zhp, const char propname,
	uint64_t *propvalue);
	extern int zfs_prop_get_written(zfs_handle_t zhp, const char propname,
	char *propbuf, int proplen, boolean_t literal);
	extern int zfs_prop_get_feature(zfs_handle_t zhp, const char propname,
	char *buf, size_t len);
	extern uint64_t getprop_uint64(zfs_handle_t , zfs_prop_t, char *);
	extern uint64_t zfs_prop_get_int(zfs_handle_t *, zfs_prop_t);
	extern int zfs_prop_inherit(zfs_handle_t , const char , boolean_t);
	extern const char *zfs_prop_values(zfs_prop_t);
	extern int zfs_prop_is_string(zfs_prop_t prop);
	extern nvlist_t zfs_get_all_props(zfs_handle_t );
	extern nvlist_t zfs_get_user_props(zfs_handle_t );
	extern nvlist_t zfs_get_recvd_props(zfs_handle_t );
	extern nvlist_t zfs_get_clones_nvl(zfs_handle_t );

	extern int zfs_wait_status(zfs_handle_t *, zfs_wait_activity_t,
	boolean_t , boolean_t );

	/*
	* zfs encryption management
	*/
	extern int zfs_crypto_get_encryption_root(zfs_handle_t , boolean_t , char *);
	extern int zfs_crypto_create(libzfs_handle_t , char , nvlist_t , nvlist_t ,
	boolean_t stdin_available, uint8_t *, uint_t );
	extern int zfs_crypto_clone_check(libzfs_handle_t , zfs_handle_t , char *,
	nvlist_t *);
	extern int zfs_crypto_attempt_load_keys(libzfs_handle_t , char );
	extern int zfs_crypto_load_key(zfs_handle_t , boolean_t, char );
	extern int zfs_crypto_unload_key(zfs_handle_t *);
	extern int zfs_crypto_rewrap(zfs_handle_t , nvlist_t , boolean_t);

	typedef struct zprop_list {
	int pl_prop;
	char *pl_user_prop;
	struct zprop_list *pl_next;
	boolean_t pl_all;
	size_t pl_width;
	size_t pl_recvd_width;
	boolean_t pl_fixed;
	} zprop_list_t;

	extern int zfs_expand_proplist(zfs_handle_t , zprop_list_t *, boolean_t,
	boolean_t);
	extern void zfs_prune_proplist(zfs_handle_t , uint8_t );

	#define ZFS_MOUNTPOINT_NONE "none"
	#define ZFS_MOUNTPOINT_LEGACY "legacy"

	#define ZFS_FEATURE_DISABLED "disabled"
	#define ZFS_FEATURE_ENABLED "enabled"
	#define ZFS_FEATURE_ACTIVE "active"

	#define ZFS_UNSUPPORTED_INACTIVE "inactive"
	#define ZFS_UNSUPPORTED_READONLY "readonly"

	/*
	* zpool property management
	*/
	extern int zpool_expand_proplist(zpool_handle_t , zprop_list_t *);
	extern int zpool_prop_get_feature(zpool_handle_t , const char , char *,
	size_t);
	extern const char *zpool_prop_default_string(zpool_prop_t);
	extern uint64_t zpool_prop_default_numeric(zpool_prop_t);
	extern const char *zpool_prop_column_name(zpool_prop_t);
	extern boolean_t zpool_prop_align_right(zpool_prop_t);

	/*
	* Functions shared by zfs and zpool property management.
	*/
	extern int zprop_iter(zprop_func func, void *cb, boolean_t show_all,
	boolean_t ordered, zfs_type_t type);
	extern int zprop_get_list(libzfs_handle_t , char , zprop_list_t **,
	zfs_type_t);
	extern void zprop_free_list(zprop_list_t *);

	#define ZFS_GET_NCOLS 5

	typedef enum {
	GET_COL_NONE,
	GET_COL_NAME,
	GET_COL_PROPERTY,
	GET_COL_VALUE,
	GET_COL_RECVD,
	GET_COL_SOURCE
	} zfs_get_column_t;

	/*
	* Functions for printing zfs or zpool properties
	*/
	typedef struct zprop_get_cbdata {
	int cb_sources;
	zfs_get_column_t cb_columns[ZFS_GET_NCOLS];
	int cb_colwidths[ZFS_GET_NCOLS + 1];
	boolean_t cb_scripted;
	boolean_t cb_literal;
	boolean_t cb_first;
	zprop_list_t *cb_proplist;
	zfs_type_t cb_type;
	} zprop_get_cbdata_t;

	void zprop_print_one_property(const char , zprop_get_cbdata_t ,
	const char , const char , zprop_source_t, const char *,
	const char *);

	/*
	* Iterator functions.
	*/
	typedef int (zfs_iter_f)(zfs_handle_t , void *);
	extern int zfs_iter_root(libzfs_handle_t , zfs_iter_f, void );
	extern int zfs_iter_children(zfs_handle_t , zfs_iter_f, void );
	extern int zfs_iter_dependents(zfs_handle_t , boolean_t, zfs_iter_f, void );
	extern int zfs_iter_filesystems(zfs_handle_t , zfs_iter_f, void );
	extern int zfs_iter_snapshots(zfs_handle_t , boolean_t, zfs_iter_f, void ,
	uint64_t, uint64_t);
	extern int zfs_iter_snapshots_sorted(zfs_handle_t , zfs_iter_f, void ,
	uint64_t, uint64_t);
	extern int zfs_iter_snapspec(zfs_handle_t , const char , zfs_iter_f, void *);
	extern int zfs_iter_bookmarks(zfs_handle_t , zfs_iter_f, void );
	extern int zfs_iter_mounted(zfs_handle_t , zfs_iter_f, void );

	typedef struct get_all_cb {
	zfs_handle_t **cb_handles;
	size_t cb_alloc;
	size_t cb_used;
	} get_all_cb_t;

	void zfs_foreach_mountpoint(libzfs_handle_t , zfs_handle_t *, size_t,
	zfs_iter_f, void *, boolean_t);
	void libzfs_add_handle(get_all_cb_t , zfs_handle_t );

	/*
	* Functions to create and destroy datasets.
	*/
	extern int zfs_create(libzfs_handle_t , const char , zfs_type_t,
	nvlist_t *);
	extern int zfs_create_ancestors(libzfs_handle_t , const char );
	extern int zfs_destroy(zfs_handle_t *, boolean_t);
	extern int zfs_destroy_snaps(zfs_handle_t , char , boolean_t);
	extern int zfs_destroy_snaps_nvl(libzfs_handle_t , nvlist_t , boolean_t);
	extern int zfs_clone(zfs_handle_t , const char , nvlist_t *);
	extern int zfs_snapshot(libzfs_handle_t , const char , boolean_t, nvlist_t *);
	extern int zfs_snapshot_nvl(libzfs_handle_t hdl, nvlist_t snaps,
	nvlist_t *props);
	extern int zfs_rollback(zfs_handle_t , zfs_handle_t , boolean_t);

	typedef struct renameflags {
	/* recursive rename */
	int recursive : 1;

	/* don't unmount file systems */
	int nounmount : 1;

	/* force unmount file systems */
	int forceunmount : 1;
	} renameflags_t;

	extern int zfs_rename(zfs_handle_t , const char , renameflags_t);

	typedef struct sendflags {
	/* Amount of extra information to print. */
	int verbosity;

	/* recursive send (ie, -R) */
	boolean_t replicate;

	/* for incrementals, do all intermediate snapshots */
	boolean_t doall;

	/* if dataset is a clone, do incremental from its origin */
	boolean_t fromorigin;

	/* field no longer used, maintained for backwards compatibility */
	boolean_t pad;

	/* send properties (ie, -p) */
	boolean_t props;

	/* do not send (no-op, ie. -n) */
	boolean_t dryrun;

	/* parsable verbose output (ie. -P) */
	boolean_t parsable;

	/* show progress (ie. -v) */
	boolean_t progress;

	/* large blocks (>128K) are permitted */
	boolean_t largeblock;

	/* WRITE_EMBEDDED records of type DATA are permitted */
	boolean_t embed_data;

	/* compressed WRITE records are permitted */
	boolean_t compress;

	/* raw encrypted records are permitted */
	boolean_t raw;

	/* only send received properties (ie. -b) */
	boolean_t backup;

	/* include snapshot holds in send stream */
	boolean_t holds;

	/* stream represents a partially received dataset */
	boolean_t saved;
	} sendflags_t;

	typedef boolean_t (snapfilter_cb_t)(zfs_handle_t , void );

	extern int zfs_send(zfs_handle_t , const char , const char *,
	sendflags_t , int, snapfilter_cb_t, void , nvlist_t **);
	extern int zfs_send_one(zfs_handle_t , const char , int, sendflags_t *,
	const char *);
	extern int zfs_send_progress(zfs_handle_t , int, uint64_t , uint64_t *);
	extern int zfs_send_resume(libzfs_handle_t , sendflags_t , int outfd,
	const char *);
	extern int zfs_send_saved(zfs_handle_t , sendflags_t , int, const char *);
	extern nvlist_t zfs_send_resume_token_to_nvlist(libzfs_handle_t hdl,
	const char *token);

	extern int zfs_promote(zfs_handle_t *);
	extern int zfs_hold(zfs_handle_t , const char , const char *,
	boolean_t, int);
	extern int zfs_hold_nvl(zfs_handle_t , int, nvlist_t );
	extern int zfs_release(zfs_handle_t , const char , const char *, boolean_t);
	extern int zfs_get_holds(zfs_handle_t , nvlist_t *);
	extern uint64_t zvol_volsize_to_reservation(zpool_handle_t *, uint64_t,
	nvlist_t *);

	typedef int (zfs_userspace_cb_t)(void arg, const char *domain,
	uid_t rid, uint64_t space);

	extern int zfs_userspace(zfs_handle_t *, zfs_userquota_prop_t,
	zfs_userspace_cb_t, void *);

	extern int zfs_get_fsacl(zfs_handle_t , nvlist_t *);
	extern int zfs_set_fsacl(zfs_handle_t , boolean_t, nvlist_t );

	typedef struct recvflags {
	/* print informational messages (ie, -v was specified) */
	boolean_t verbose;

	/* the destination is a prefix, not the exact fs (ie, -d) */
	boolean_t isprefix;

	/*
	* Only the tail of the sent snapshot path is appended to the
	* destination to determine the received snapshot name (ie, -e).
	*/
	boolean_t istail;

	/* do not actually do the recv, just check if it would work (ie, -n) */
	boolean_t dryrun;

	/* rollback/destroy filesystems as necessary (eg, -F) */
	boolean_t force;

	/* set "canmount=off" on all modified filesystems */
	boolean_t canmountoff;

	/*
	* Mark the file systems as "resumable" and do not destroy them if the
	* receive is interrupted
	*/
	boolean_t resumable;

	/* byteswap flag is used internally; callers need not specify */
	boolean_t byteswap;

	/* do not mount file systems as they are extracted (private) */
	boolean_t nomount;

	/* Was holds flag set in the compound header? */
	boolean_t holds;

	/* skip receive of snapshot holds */
	boolean_t skipholds;

	/* mount the filesystem unless nomount is specified */
	boolean_t domount;

	/* force unmount while recv snapshot (private) */
	boolean_t forceunmount;
	} recvflags_t;

	extern int zfs_receive(libzfs_handle_t , const char , nvlist_t *,
	recvflags_t , int, avl_tree_t );

	typedef enum diff_flags {
	ZFS_DIFF_PARSEABLE = 0x1,
	ZFS_DIFF_TIMESTAMP = 0x2,
	ZFS_DIFF_CLASSIFY = 0x4
	} diff_flags_t;

	extern int zfs_show_diffs(zfs_handle_t , int, const char , const char *,
	int);

	/*
	* Miscellaneous functions.
	*/
	extern const char *zfs_type_to_name(zfs_type_t);
	extern void zfs_refresh_properties(zfs_handle_t *);
	extern int zfs_name_valid(const char *, zfs_type_t);
	extern zfs_handle_t zfs_path_to_zhandle(libzfs_handle_t , const char *,
	zfs_type_t);
	extern int zfs_parent_name(zfs_handle_t , char , size_t);
	extern boolean_t zfs_dataset_exists(libzfs_handle_t , const char ,
	zfs_type_t);
	extern int zfs_spa_version(zfs_handle_t , int );
	extern boolean_t zfs_bookmark_exists(const char *path);

	/*
	* Mount support functions.
	*/
	extern boolean_t is_mounted(libzfs_handle_t , const char special, char **);
	extern boolean_t zfs_is_mounted(zfs_handle_t , char *);
	extern int zfs_mount(zfs_handle_t , const char , int);
	extern int zfs_mount_at(zfs_handle_t , const char , int, const char *);
	extern int zfs_unmount(zfs_handle_t , const char , int);
	extern int zfs_unmountall(zfs_handle_t *, int);

	#if defined(__linux__)
	extern int zfs_parse_mount_options(char mntopts, unsigned long mntflags,
	unsigned long zfsflags, int sloppy, char badopt, char *mtabopt);
	extern void zfs_adjust_mount_options(zfs_handle_t zhp, const char mntpoint,
	char mntopts, char mtabopt);
	#endif

	/*
	* Share support functions.
	*/
	extern boolean_t zfs_is_shared(zfs_handle_t *);
	extern int zfs_share(zfs_handle_t *);
	extern int zfs_unshare(zfs_handle_t *);

	/*
	* Protocol-specific share support functions.
	*/
	extern boolean_t zfs_is_shared_nfs(zfs_handle_t , char *);
	extern boolean_t zfs_is_shared_smb(zfs_handle_t , char *);
	extern int zfs_share_nfs(zfs_handle_t *);
	extern int zfs_share_smb(zfs_handle_t *);
	extern int zfs_shareall(zfs_handle_t *);
	extern int zfs_unshare_nfs(zfs_handle_t , const char );
	extern int zfs_unshare_smb(zfs_handle_t , const char );
	extern int zfs_unshareall_nfs(zfs_handle_t *);
	extern int zfs_unshareall_smb(zfs_handle_t *);
	extern int zfs_unshareall_bypath(zfs_handle_t , const char );
	extern int zfs_unshareall_bytype(zfs_handle_t , const char , const char *);
	extern int zfs_unshareall(zfs_handle_t *);
	extern int zfs_deleg_share_nfs(libzfs_handle_t , char , char , char ,
	void , void , int, zfs_share_op_t);
	extern void zfs_commit_nfs_shares(void);
	extern void zfs_commit_smb_shares(void);
	extern void zfs_commit_all_shares(void);
	extern void zfs_commit_shares(const char *);

	extern int zfs_nicestrtonum(libzfs_handle_t , const char , uint64_t *);

	/*
	* Utility functions to run an external process.
	*/
	#define STDOUT_VERBOSE 0x01
	#define STDERR_VERBOSE 0x02
	#define NO_DEFAULT_PATH 0x04 /* Don't use $PATH to lookup the command */

	int libzfs_run_process(const char , char *, int);
	int libzfs_run_process_get_stdout(const char , char [], char *[],
	char *[], int );
	int libzfs_run_process_get_stdout_nopath(const char , char [], char *[],
	char *[], int );

	void libzfs_free_str_array(char **, int);

	int libzfs_envvar_is_set(char *);

	/*
	* Utility functions for zfs version
	*/
	extern void zfs_version_userland(char *, int);
	extern int zfs_version_kernel(char *, int);
	extern int zfs_version_print(void);

	/*
	* Given a device or file, determine if it is part of a pool.
	*/
	extern int zpool_in_use(libzfs_handle_t , int, pool_state_t , char **,
	boolean_t *);

	/*
	* Label manipulation.
	*/
	extern int zpool_clear_label(int);
	-extern int zpool_set_bootenv(zpool_handle_t , const char );
	-extern int zpool_get_bootenv(zpool_handle_t , char , size_t, off_t);
	+extern int zpool_set_bootenv(zpool_handle_t , const nvlist_t );
	+extern int zpool_get_bootenv(zpool_handle_t , nvlist_t *);

	/*
	* Management interfaces for SMB ACL files
	*/

	int zfs_smb_acl_add(libzfs_handle_t , char , char , char );
	int zfs_smb_acl_remove(libzfs_handle_t , char , char , char );
	int zfs_smb_acl_purge(libzfs_handle_t , char , char *);
	int zfs_smb_acl_rename(libzfs_handle_t , char , char , char , char *);

	/*
	* Enable and disable datasets within a pool by mounting/unmounting and
	* sharing/unsharing them.
	*/
	extern int zpool_enable_datasets(zpool_handle_t , const char , int);
	extern int zpool_disable_datasets(zpool_handle_t *, boolean_t);

	#ifdef __FreeBSD__

	/*
	* Attach/detach the given filesystem to/from the given jail.
	*/
	extern int zfs_jail(zfs_handle_t *zhp, int jailid, int attach);

	/*
	* Set loader options for next boot.
	*/
	extern int zpool_nextboot(libzfs_handle_t , uint64_t, uint64_t, const char );

	#endif /* __FreeBSD__ */

	#ifdef __cplusplus
	}
	#endif

	#endif /* _LIBZFS_H */
	Index: vendor-sys/openzfs/dist/include/libzfs_core.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/libzfs_core.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/libzfs_core.h (revision 365892)
	@@ -1,144 +1,144 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2012, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2017 Datto Inc.
	* Copyright 2017 RackTop Systems.
	* Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
	*/

	#ifndef _LIBZFS_CORE_H
	#define _LIBZFS_CORE_H

	#include <libnvpair.h>
	#include <sys/param.h>
	#include <sys/types.h>
	#include <sys/fs/zfs.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	int libzfs_core_init(void);
	void libzfs_core_fini(void);

	/*
	* NB: this type should be kept binary compatible with dmu_objset_type_t.
	*/
	enum lzc_dataset_type {
	LZC_DATSET_TYPE_ZFS = 2,
	LZC_DATSET_TYPE_ZVOL
	};

	int lzc_snapshot(nvlist_t , nvlist_t , nvlist_t **);
	int lzc_create(const char , enum lzc_dataset_type, nvlist_t , uint8_t *,
	uint_t);
	int lzc_clone(const char , const char , nvlist_t *);
	int lzc_promote(const char , char , int);
	int lzc_destroy_snaps(nvlist_t , boolean_t, nvlist_t *);
	int lzc_bookmark(nvlist_t , nvlist_t *);
	int lzc_get_bookmarks(const char , nvlist_t , nvlist_t **);
	int lzc_get_bookmark_props(const char , nvlist_t *);
	int lzc_destroy_bookmarks(nvlist_t , nvlist_t *);
	int lzc_load_key(const char , boolean_t, uint8_t , uint_t);
	int lzc_unload_key(const char *);
	int lzc_change_key(const char , uint64_t, nvlist_t , uint8_t *, uint_t);
	int lzc_initialize(const char , pool_initialize_func_t, nvlist_t ,
	nvlist_t **);
	int lzc_trim(const char *, pool_trim_func_t, uint64_t, boolean_t,
	nvlist_t , nvlist_t *);
	int lzc_redact(const char , const char , nvlist_t *);

	int lzc_snaprange_space(const char , const char , uint64_t *);

	int lzc_hold(nvlist_t , int, nvlist_t *);
	int lzc_release(nvlist_t , nvlist_t *);
	int lzc_get_holds(const char , nvlist_t *);

	enum lzc_send_flags {
	LZC_SEND_FLAG_EMBED_DATA = 1 << 0,
	LZC_SEND_FLAG_LARGE_BLOCK = 1 << 1,
	LZC_SEND_FLAG_COMPRESS = 1 << 2,
	LZC_SEND_FLAG_RAW = 1 << 3,
	LZC_SEND_FLAG_SAVED = 1 << 4,
	};

	int lzc_send(const char , const char , int, enum lzc_send_flags);
	int lzc_send_resume(const char , const char , int,
	enum lzc_send_flags, uint64_t, uint64_t);
	int lzc_send_space(const char , const char , enum lzc_send_flags, uint64_t *);

	struct dmu_replay_record;

	int lzc_send_redacted(const char , const char , int, enum lzc_send_flags,
	const char *);
	int lzc_send_resume_redacted(const char , const char , int,
	enum lzc_send_flags, uint64_t, uint64_t, const char *);
	int lzc_receive(const char , nvlist_t , const char *, boolean_t, boolean_t,
	int);
	int lzc_receive_resumable(const char , nvlist_t , const char *, boolean_t,
	boolean_t, int);
	int lzc_receive_with_header(const char , nvlist_t , const char *, boolean_t,
	boolean_t, boolean_t, int, const struct dmu_replay_record *);
	int lzc_receive_one(const char , nvlist_t , const char *, boolean_t,
	boolean_t, boolean_t, int, const struct dmu_replay_record *, int,
	uint64_t , uint64_t , uint64_t , nvlist_t *);
	int lzc_receive_with_cmdprops(const char , nvlist_t , nvlist_t *,
	uint8_t , uint_t, const char , boolean_t, boolean_t, boolean_t, int,
	const struct dmu_replay_record , int, uint64_t , uint64_t *,
	uint64_t , nvlist_t *);
	int lzc_send_space(const char , const char , enum lzc_send_flags, uint64_t *);
	int lzc_send_space_resume_redacted(const char , const char ,
	enum lzc_send_flags, uint64_t, uint64_t, uint64_t, const char *,
	int, uint64_t *);
	uint64_t lzc_send_progress(int);

	boolean_t lzc_exists(const char *);

	int lzc_rollback(const char , char , int);
	int lzc_rollback_to(const char , const char );

	int lzc_rename(const char , const char );
	int lzc_destroy(const char *);

	int lzc_channel_program(const char , const char , uint64_t,
	uint64_t, nvlist_t , nvlist_t *);
	int lzc_channel_program_nosync(const char , const char , uint64_t,
	uint64_t, nvlist_t , nvlist_t *);

	int lzc_sync(const char , nvlist_t , nvlist_t **);
	int lzc_reopen(const char *, boolean_t);

	int lzc_pool_checkpoint(const char *);
	int lzc_pool_checkpoint_discard(const char *);

	int lzc_wait(const char , zpool_wait_activity_t, boolean_t );
	int lzc_wait_tag(const char , zpool_wait_activity_t, uint64_t, boolean_t );
	int lzc_wait_fs(const char , zfs_wait_activity_t, boolean_t );

	-int lzc_set_bootenv(const char , const char );
	+int lzc_set_bootenv(const char , const nvlist_t );
	int lzc_get_bootenv(const char , nvlist_t *);
	#ifdef __cplusplus
	}
	#endif

	#endif /* _LIBZFS_CORE_H */
	Index: vendor-sys/openzfs/dist/include/libzfsbootenv.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/libzfsbootenv.h (nonexistent)
	+++ vendor-sys/openzfs/dist/include/libzfsbootenv.h (revision 365892)
	@@ -0,0 +1,41 @@
	+/*
	+ * This file and its contents are supplied under the terms of the
	+ * Common Development and Distribution License ("CDDL"), version 1.0.
	+ * You may only use this file in accordance with the terms of version
	+ * 1.0 of the CDDL.
	+ *
	+ * A full copy of the text of the CDDL should have accompanied this
	+ * source. A copy of the CDDL is also available via the Internet at
	+ * http://www.illumos.org/license/CDDL.
	+ */
	+
	+/*
	+ * Copyright 2020 Toomas Soome <tsoome@me.com>
	+ */
	+
	+#ifndef _LIBZFSBOOTENV_H
	+#define _LIBZFSBOOTENV_H
	+
	+#ifdef __cplusplus
	+extern "C" {
	+#endif
	+
	+typedef enum lzbe_flags {
	+ lzbe_add, /* add data to existing nvlist */
	+ lzbe_replace /* replace current nvlist */
	+} lzbe_flags_t;
	+
	+extern int lzbe_nvlist_get(const char , const char , void **);
	+extern int lzbe_nvlist_set(const char , const char , void *);
	+extern void lzbe_nvlist_free(void *);
	+extern int lzbe_add_pair(void , const char , const char , void , size_t);
	+extern int lzbe_remove_pair(void , const char );
	+extern int lzbe_set_boot_device(const char , lzbe_flags_t, const char );
	+extern int lzbe_get_boot_device(const char , char *);
	+extern int lzbe_bootenv_print(const char , const char , FILE *);
	+
	+#ifdef __cplusplus
	+}
	+#endif
	+
	+#endif /* _LIBZFSBOOTENV_H */

	Property changes on: vendor-sys/openzfs/dist/include/libzfsbootenv.h
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/include/os/freebsd/spl/sys/ccompile.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/freebsd/spl/sys/ccompile.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/os/freebsd/spl/sys/ccompile.h (revision 365892)
	@@ -1,271 +1,274 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License, Version 1.0 only
	* (the "License"). You may not use this file except in compliance
	* with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright 2004 Sun Microsystems, Inc. All rights reserved.
	* Use is subject to license terms.
	*/

	#ifndef _SYS_CCOMPILE_H
	#define _SYS_CCOMPILE_H

	/*
	* This file contains definitions designed to enable different compilers
	* to be used harmoniously on Solaris systems.
	*/

	#ifdef __cplusplus
	extern "C" {
	#endif

	/*
	* Allow for version tests for compiler bugs and features.
	*/
	#if defined(__GNUC__)
	#define __GNUC_VERSION \
	(__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
	#else
	#define __GNUC_VERSION 0
	#endif

	#if defined(__ATTRIBUTE_IMPLEMENTED) \|\| defined(__GNUC__)

	/*
	* analogous to lint's PRINTFLIKEn
	*/
	#define __sun_attr___PRINTFLIKE__(__n) \
	__attribute__((__format__(printf, __n, (__n)+1)))
	#define __sun_attr___VPRINTFLIKE__(__n) \
	__attribute__((__format__(printf, __n, 0)))

	/*
	* Handle the kernel printf routines that can take '%b' too
	*/
	#if __GNUC_VERSION < 30402
	/*
	* XX64 at least this doesn't work correctly yet with 3.4.1 anyway!
	*/
	#define __sun_attr___KPRINTFLIKE__ __sun_attr___PRINTFLIKE__
	#define __sun_attr___KVPRINTFLIKE__ __sun_attr___VPRINTFLIKE__
	#else
	#define __sun_attr___KPRINTFLIKE__(__n) \
	__attribute__((__format__(cmn_err, __n, (__n)+1)))
	#define __sun_attr___KVPRINTFLIKE__(__n) \
	__attribute__((__format__(cmn_err, __n, 0)))
	#endif

	/*
	* This one's pretty obvious -- the function never returns
	*/
	#define __sun_attr___noreturn__ __attribute__((__noreturn__))


	/*
	* This is an appropriate label for functions that do not
	* modify their arguments, e.g. strlen()
	*/
	#define __sun_attr___pure__ __attribute__((__pure__))

	/*
	* This is a stronger form of __pure__. Can be used for functions
	* that do not modify their arguments and don't depend on global
	* memory.
	*/
	#define __sun_attr___const__ __attribute__((__const__))

	/*
	* structure packing like #pragma pack(1)
	*/
	#define __sun_attr___packed__ __attribute__((__packed__))

	#define ___sun_attr_inner(__a) __sun_attr_##__a
	#define __sun_attr__(__a) ___sun_attr_inner __a

	#else /* __ATTRIBUTE_IMPLEMENTED \|\| __GNUC__ */

	#define __sun_attr__(__a)

	#endif /* __ATTRIBUTE_IMPLEMENTED \|\| __GNUC__ */

	/*
	* Shorthand versions for readability
	*/

	#define __PRINTFLIKE(__n) __sun_attr__((__PRINTFLIKE__(__n)))
	#define __VPRINTFLIKE(__n) __sun_attr__((__VPRINTFLIKE__(__n)))
	#define __KPRINTFLIKE(__n) __sun_attr__((__KPRINTFLIKE__(__n)))
	#define __KVPRINTFLIKE(__n) __sun_attr__((__KVPRINTFLIKE__(__n)))
	#ifdef _KERNEL
	#define __NORETURN __sun_attr__((__noreturn__))
	#endif
	#define __CONST __sun_attr__((__const__))
	#define __PURE __sun_attr__((__pure__))

	#if defined(INVARIANTS) && !defined(ZFS_DEBUG)
	#define ZFS_DEBUG
	#undef NDEBUG
	#endif

	#define EXPORT_SYMBOL(x)
	#define MODULE_AUTHOR(s)
	#define MODULE_DESCRIPTION(s)
	#define MODULE_LICENSE(s)
	#define module_param(a, b, c)
	#define module_param_call(a, b, c, d, e)
	#define module_param_named(a, b, c, d)
	#define MODULE_PARM_DESC(a, b)
	#define asm __asm
	#ifdef ZFS_DEBUG
	#undef NDEBUG
	#endif
	#if !defined(ZFS_DEBUG) && !defined(NDEBUG)
	#define NDEBUG
	#endif

	#ifndef EINTEGRITY
	#define EINTEGRITY 97 /* EINTEGRITY is new in 13 */
	#endif

	/*
	* These are bespoke errnos used in ZFS. We map them to their closest FreeBSD
	* equivalents. This gives us more useful error messages from strerror(3).
	*/
	#define ECKSUM EINTEGRITY
	#define EFRAGS ENOSPC

	/* Similar for ENOACTIVE */
	#define ENOTACTIVE ECANCELED

	#define EREMOTEIO EREMOTE
	#define ECHRNG ENXIO
	#define ETIME ETIMEDOUT

	#define O_LARGEFILE 0
	#define O_RSYNC 0
	#define O_DSYNC 0

	#ifndef LOCORE
	#ifndef HAVE_RPC_TYPES
	typedef int bool_t;
	typedef int enum_t;
	#endif
	#endif

	#ifndef __cplusplus
	#define __init
	#define __exit
	#endif

	#ifdef _KERNEL
	#define param_set_charp(a, b) (0)
	#define ATTR_UID AT_UID
	#define ATTR_GID AT_GID
	#define ATTR_MODE AT_MODE
	#define ATTR_XVATTR AT_XVATTR
	#define ATTR_CTIME AT_CTIME
	#define ATTR_MTIME AT_MTIME
	#define ATTR_ATIME AT_ATIME
	#define vmem_free zfs_kmem_free
	#define vmem_zalloc(size, flags) zfs_kmem_alloc(size, flags \| M_ZERO)
	#define vmem_alloc zfs_kmem_alloc
	#define MUTEX_NOLOCKDEP 0
	#define RW_NOLOCKDEP 0

	#else
	#define FALSE 0
	#define TRUE 1
	/*
	* XXX We really need to consolidate on standard
	* error codes in the common code
	*/
	#define ENOSTR ENOTCONN
	#define ENODATA EINVAL


	#define __BSD_VISIBLE 1
	#ifndef IN_BASE
	#define __POSIX_VISIBLE 201808
	#define __XSI_VISIBLE 1000
	#endif
	#define ARRAY_SIZE(a) (sizeof (a) / sizeof (a[0]))
	-#define open64 open
	#define mmap64 mmap
	+/* Note: this file can be used on linux/macOS when bootstrapping tools. */
	+#if defined(__FreeBSD__)
	+#define open64 open
	#define pwrite64 pwrite
	#define ftruncate64 ftruncate
	#define lseek64 lseek
	#define pread64 pread
	#define stat64 stat
	#define lstat64 lstat
	#define statfs64 statfs
	#define readdir64 readdir
	#define dirent64 dirent
	+#endif
	#define P2ALIGN(x, align) ((x) & -(align))
	#define P2CROSS(x, y, align) (((x) ^ (y)) > (align) - 1)
	#define P2ROUNDUP(x, align) ((((x) - 1) \| ((align) - 1)) + 1)
	#define P2PHASE(x, align) ((x) & ((align) - 1))
	#define P2NPHASE(x, align) (-(x) & ((align) - 1))
	#define ISP2(x) (((x) & ((x) - 1)) == 0)
	#define IS_P2ALIGNED(v, a) ((((uintptr_t)(v)) & ((uintptr_t)(a) - 1)) == 0)
	#define P2BOUNDARY(off, len, align) \
	(((off) ^ ((off) + (len) - 1)) > (align) - 1)

	/*
	* Typed version of the P2* macros. These macros should be used to ensure
	* that the result is correctly calculated based on the data type of (x),
	* which is passed in as the last argument, regardless of the data
	* type of the alignment. For example, if (x) is of type uint64_t,
	* and we want to round it up to a page boundary using "PAGESIZE" as
	* the alignment, we can do either
	*
	* P2ROUNDUP(x, (uint64_t)PAGESIZE)
	* or
	* P2ROUNDUP_TYPED(x, PAGESIZE, uint64_t)
	*/
	#define P2ALIGN_TYPED(x, align, type) \
	((type)(x) & -(type)(align))
	#define P2PHASE_TYPED(x, align, type) \
	((type)(x) & ((type)(align) - 1))
	#define P2NPHASE_TYPED(x, align, type) \
	(-(type)(x) & ((type)(align) - 1))
	#define P2ROUNDUP_TYPED(x, align, type) \
	((((type)(x) - 1) \| ((type)(align) - 1)) + 1)
	#define P2END_TYPED(x, align, type) \
	(-(~(type)(x) & -(type)(align)))
	#define P2PHASEUP_TYPED(x, align, phase, type) \
	((type)(phase) - (((type)(phase) - (type)(x)) & -(type)(align)))
	#define P2CROSS_TYPED(x, y, align, type) \
	(((type)(x) ^ (type)(y)) > (type)(align) - 1)
	#define P2SAMEHIGHBIT_TYPED(x, y, type) \
	(((type)(x) ^ (type)(y)) < ((type)(x) & (type)(y)))

	#define DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
	#define RLIM64_INFINITY RLIM_INFINITY
	#ifndef HAVE_ERESTART
	#define ERESTART EAGAIN
	#endif
	#define ABS(a) ((a) < 0 ? -(a) : (a))

	#endif
	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_CCOMPILE_H */
	Index: vendor-sys/openzfs/dist/include/os/freebsd/spl/sys/condvar.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/freebsd/spl/sys/condvar.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/os/freebsd/spl/sys/condvar.h (revision 365892)
	@@ -1,205 +1,211 @@
	/*
	* Copyright (c) 2007 Pawel Jakub Dawidek <pjd@FreeBSD.org>
	* Copyright (c) 2013 iXsystems, Inc.
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	* 1. Redistributions of source code must retain the above copyright
	* notice, this list of conditions and the following disclaimer.
	* 2. Redistributions in binary form must reproduce the above copyright
	* notice, this list of conditions and the following disclaimer in the
	* documentation and/or other materials provided with the distribution.
	*
	* THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	* SUCH DAMAGE.
	*
	* $FreeBSD$
	*/

	#ifndef _OPENSOLARIS_SYS_CONDVAR_H_
	#define _OPENSOLARIS_SYS_CONDVAR_H_

	#include <sys/param.h>
	#include <sys/systm.h>

	#include <sys/spl_condvar.h>
	#include <sys/mutex.h>
	#include <sys/time.h>

	/*
	* cv_timedwait() is similar to cv_wait() except that it additionally expects
	* a timeout value specified in ticks. When woken by cv_signal() or
	* cv_broadcast() it returns 1, otherwise when the timeout is reached -1 is
	* returned.
	*
	* cv_timedwait_sig() behaves the same as cv_timedwait() but blocks
	* interruptibly and can be woken by a signal (EINTR, ERESTART). When
	* this occurs 0 is returned.
	*
	* cv_timedwait_io() and cv_timedwait_sig_io() are variants of cv_timedwait()
	* and cv_timedwait_sig() which should be used when waiting for outstanding
	* IO to complete. They are responsible for updating the iowait accounting
	* when this is supported by the platform.
	*
	* cv_timedwait_hires() and cv_timedwait_sig_hires() are high resolution
	* versions of cv_timedwait() and cv_timedwait_sig(). They expect the timeout
	* to be specified as a hrtime_t allowing for timeouts of less than a tick.
	*
	* N.B. The return values differ slightly from the illumos implementation
	* which returns the time remaining, instead of 1, when woken. They both
	* return -1 on timeout. Consumers which need to know the time remaining
	* are responsible for tracking it themselves.
	*/

	static __inline sbintime_t
	zfs_nstosbt(int64_t _ns)
	{
	sbintime_t sb = 0;

	#ifdef KASSERT
	KASSERT(_ns >= 0, ("Negative values illegal for nstosbt: %jd", _ns));
	#endif
	if (_ns >= SBT_1S) {
	sb = (_ns / 1000000000) * SBT_1S;
	_ns = _ns % 1000000000;
	}
	/* 9223372037 = ceil(2^63 / 1000000000) */
	sb += ((_ns * 9223372037ull) + 0x7fffffff) >> 31;
	return (sb);
	}


	typedef struct cv kcondvar_t;
	#define CALLOUT_FLAG_ABSOLUTE C_ABSOLUTE

	typedef enum {
	CV_DEFAULT,
	CV_DRIVER
	} kcv_type_t;

	#define zfs_cv_init(cv, name, type, arg) do { \
	const char *_name; \
	ASSERT((type) == CV_DEFAULT); \
	for (_name = #cv; *_name != '\0'; _name++) { \
	if (_name >= 'a' && _name <= 'z') \
	break; \
	} \
	if (*_name == '\0') \
	_name = #cv; \
	cv_init((cv), _name); \
	} while (0)
	#define cv_init(cv, name, type, arg) zfs_cv_init(cv, name, type, arg)


	static inline int
	cv_wait_sig(kcondvar_t cvp, kmutex_t mp)
	{

	return (_cv_wait_sig(cvp, &(mp)->lock_object) == 0);
	}

	static inline int
	cv_timedwait(kcondvar_t cvp, kmutex_t mp, clock_t timo)
	{
	int rc;

	timo -= ddi_get_lbolt();
	if (timo <= 0)
	return (-1);
	rc = _cv_timedwait_sbt((cvp), &(mp)->lock_object, \
	tick_sbt * (timo), 0, C_HARDCLOCK);
	if (rc == EWOULDBLOCK)
	return (-1);
	return (1);
	}

	static inline int
	cv_timedwait_sig(kcondvar_t cvp, kmutex_t mp, clock_t timo)
	{
	int rc;

	timo -= ddi_get_lbolt();
	if (timo <= 0)
	return (-1);
	rc = _cv_timedwait_sig_sbt(cvp, &(mp)->lock_object, \
	tick_sbt * (timo), 0, C_HARDCLOCK);
	if (rc == EWOULDBLOCK)
	return (-1);
	if (rc == EINTR \|\| rc == ERESTART)
	return (0);

	return (1);
	}

	-#define cv_timedwait_io cv_timedwait
	-#define cv_timedwait_sig_io cv_timedwait_sig
	+#define cv_timedwait_io cv_timedwait
	+#define cv_timedwait_idle cv_timedwait
	+#define cv_timedwait_sig_io cv_timedwait_sig
	+#define cv_wait_io cv_wait
	+#define cv_wait_io_sig cv_wait_sig
	+#define cv_wait_idle cv_wait
	+#define cv_timedwait_io_hires cv_timedwait_hires
	+#define cv_timedwait_idle_hires cv_timedwait_hires

	static inline int
	cv_timedwait_hires(kcondvar_t cvp, kmutex_t mp, hrtime_t tim, hrtime_t res,
	int flag)
	{
	hrtime_t hrtime;
	int rc;

	ASSERT(tim >= res);

	hrtime = gethrtime();
	if (flag == 0)
	tim += hrtime;

	if (hrtime >= tim)
	return (-1);
	rc = cv_timedwait_sbt(cvp, mp, zfs_nstosbt(tim),
	zfs_nstosbt(res), C_ABSOLUTE);

	if (rc == EWOULDBLOCK)
	return (-1);

	KASSERT(rc == 0, ("unexpected rc value %d", rc));
	return (1);
	}

	static inline int
	cv_timedwait_sig_hires(kcondvar_t cvp, kmutex_t mp, hrtime_t tim,
	hrtime_t res, int flag)
	{
	sbintime_t sbt;
	hrtime_t hrtime;
	int rc;

	ASSERT(tim >= res);

	hrtime = gethrtime();
	if (flag == 0)
	tim += hrtime;

	if (hrtime >= tim)
	return (-1);

	sbt = zfs_nstosbt(tim);
	rc = cv_timedwait_sig_sbt(cvp, mp, sbt, zfs_nstosbt(res), C_ABSOLUTE);

	switch (rc) {
	case EWOULDBLOCK:
	return (-1);
	case EINTR:
	case ERESTART:
	return (0);
	default:
	KASSERT(rc == 0, ("unexpected rc value %d", rc));
	return (1);
	}
	}

	#endif /* _OPENSOLARIS_SYS_CONDVAR_H_ */
	Index: vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/Makefile.am (revision 365892)
	@@ -1,14 +1,15 @@
	KERNEL_H = \
	freebsd_crypto.h \
	sha2.h \
	vdev_os.h \
	+ zfs_bootenv_os.h \
	zfs_context_os.h \
	zfs_ctldir.h \
	zfs_dir.h \
	zfs_ioctl_compat.h \
	zfs_vfsops_os.h \
	zfs_vnops.h \
	zfs_znode_impl.h \
	zpl.h

	noinst_HEADERS = $(KERNEL_H)
	Index: vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_bootenv_os.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_bootenv_os.h (nonexistent)
	+++ vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_bootenv_os.h (revision 365892)
	@@ -0,0 +1,29 @@
	+/*
	+ * This file and its contents are supplied under the terms of the
	+ * Common Development and Distribution License ("CDDL"), version 1.0.
	+ * You may only use this file in accordance with the terms of version
	+ * 1.0 of the CDDL.
	+ *
	+ * A full copy of the text of the CDDL should have accompanied this
	+ * source. A copy of the CDDL is also available via the Internet at
	+ * http://www.illumos.org/license/CDDL.
	+ */
	+
	+/*
	+ * Copyright 2020 Toomas Soome <tsoome@me.com>
	+ */
	+
	+#ifndef _ZFS_BOOTENV_OS_H
	+#define _ZFS_BOOTENV_OS_H
	+
	+#ifdef __cplusplus
	+extern "C" {
	+#endif
	+
	+#define BOOTENV_OS BE_FREEBSD_VENDOR
	+
	+#ifdef __cplusplus
	+}
	+#endif
	+
	+#endif /* _ZFS_BOOTENV_OS_H */

	Property changes on: vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_bootenv_os.h
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_context_os.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_context_os.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_context_os.h (revision 365892)
	@@ -1,91 +1,87 @@
	/*
	* Copyright (c) 2020 iXsystems, Inc.
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	* 1. Redistributions of source code must retain the above copyright
	* notice, this list of conditions and the following disclaimer.
	* 2. Redistributions in binary form must reproduce the above copyright
	* notice, this list of conditions and the following disclaimer in the
	* documentation and/or other materials provided with the distribution.
	*
	* THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	* SUCH DAMAGE.
	*
	* $FreeBSD$
	*/

	#ifndef ZFS_CONTEXT_OS_H_
	#define ZFS_CONTEXT_OS_H_

	#include <sys/condvar.h>
	#include <sys/rwlock.h>
	#include <sys/sig.h>
	#include_next <sys/sdt.h>
	#include <sys/misc.h>
	#include <sys/kdb.h>
	#include <sys/pathname.h>
	#include <sys/conf.h>
	#include <sys/types.h>
	#include <sys/ccompat.h>
	#include <linux/types.h>

	-#define cv_wait_io(cv, mp) cv_wait(cv, mp)
	-#define cv_wait_io_sig(cv, mp) cv_wait_sig(cv, mp)
	-
	#define cond_resched() kern_yield(PRI_USER)

	#define taskq_create_sysdc(a, b, d, e, p, dc, f) \
	(taskq_create(a, b, maxclsyspri, d, e, f))

	#define tsd_create(keyp, destructor) do { \
	*(keyp) = osd_thread_register((destructor)); \
	KASSERT(*(keyp) > 0, ("cannot register OSD")); \
	} while (0)

	#define tsd_destroy(keyp) osd_thread_deregister(*(keyp))
	#define tsd_get(key) osd_thread_get(curthread, (key))
	#define tsd_set(key, value) osd_thread_set(curthread, (key), (value))
	#define fm_panic panic

	#define cond_resched() kern_yield(PRI_USER)
	extern int zfs_debug_level;
	extern struct mtx zfs_debug_mtx;
	#define ZFS_LOG(lvl, ...) do { \
	if (((lvl) & 0xff) <= zfs_debug_level) { \
	mtx_lock(&zfs_debug_mtx); \
	printf("%s:%u[%d]: ", \
	__func__, __LINE__, (lvl)); \
	printf(__VA_ARGS__); \
	printf("\n"); \
	if ((lvl) & 0x100) \
	kdb_backtrace(); \
	mtx_unlock(&zfs_debug_mtx); \
	} \
	} while (0)

	-#define MSEC_TO_TICK(msec) ((msec) / (MILLISEC / hz))
	+#define MSEC_TO_TICK(msec) (howmany((hrtime_t)(msec) * hz, MILLISEC))
	extern int hz;
	extern int tick;
	typedef int fstrans_cookie_t;
	#define spl_fstrans_mark() (0)
	#define spl_fstrans_unmark(x) (x = 0)
	#define signal_pending(x) SIGPENDING(x)
	#define current curthread
	#define thread_join(x)
	-#define cv_wait_io(cv, mp) cv_wait(cv, mp)
	typedef struct opensolaris_utsname utsname_t;
	extern utsname_t *utsname(void);
	extern int spa_import_rootpool(const char *name, bool checkpointrewind);
	#endif
	Index: vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_vfsops_os.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_vfsops_os.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/os/freebsd/zfs/sys/zfs_vfsops_os.h (revision 365892)
	@@ -1,176 +1,239 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011 Pawel Jakub Dawidek <pawel@dawidek.net>.
	* All rights reserved.
	*/

	#ifndef _SYS_FS_ZFS_VFSOPS_H
	#define _SYS_FS_ZFS_VFSOPS_H

	+#if __FreeBSD_version >= 1300109
	+#define TEARDOWN_INACTIVE_RMS
	+#endif
	+
	#include <sys/dataset_kstats.h>
	#include <sys/list.h>
	#include <sys/vfs.h>
	#include <sys/zil.h>
	#include <sys/sa.h>
	#include <sys/rrwlock.h>
	+#ifdef TEARDOWN_INACTIVE_RMS
	+#include <sys/rmlock.h>
	+#endif
	#include <sys/zfs_ioctl.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	+#ifdef TEARDOWN_INACTIVE_RMS
	+typedef struct rmslock zfs_teardown_lock_t;
	+#else
	+#define zfs_teardown_lock_t krwlock_t
	+#endif
	+
	typedef struct zfsvfs zfsvfs_t;
	struct znode;

	struct zfsvfs {
	vfs_t z_vfs; / generic fs struct */
	zfsvfs_t z_parent; / parent fs */
	objset_t z_os; / objset reference */
	uint64_t z_flags; /* super_block flags */
	uint64_t z_root; /* id of root znode */
	uint64_t z_unlinkedobj; /* id of unlinked zapobj */
	uint64_t z_max_blksz; /* maximum block size for files */
	uint64_t z_fuid_obj; /* fuid table object number */
	uint64_t z_fuid_size; /* fuid table size */
	avl_tree_t z_fuid_idx; /* fuid tree keyed by index */
	avl_tree_t z_fuid_domain; /* fuid tree keyed by domain */
	krwlock_t z_fuid_lock; /* fuid lock */
	boolean_t z_fuid_loaded; /* fuid tables are loaded */
	boolean_t z_fuid_dirty; /* need to sync fuid table ? */
	struct zfs_fuid_info z_fuid_replay; / fuid info for replay */
	zilog_t z_log; / intent log pointer */
	uint_t z_acl_mode; /* acl chmod/mode behavior */
	uint_t z_acl_inherit; /* acl inheritance behavior */
	zfs_case_t z_case; /* case-sense */
	boolean_t z_utf8; /* utf8-only */
	int z_norm; /* normalization flags */
	boolean_t z_atime; /* enable atimes mount option */
	boolean_t z_unmounted; /* unmounted */
	rrmlock_t z_teardown_lock;
	- krwlock_t z_teardown_inactive_lock;
	+ zfs_teardown_lock_t z_teardown_inactive_lock;
	list_t z_all_znodes; /* all vnodes in the fs */
	uint64_t z_nr_znodes; /* number of znodes in the fs */
	kmutex_t z_znodes_lock; /* lock for z_all_znodes */
	struct zfsctl_root z_ctldir; / .zfs directory pointer */
	boolean_t z_show_ctldir; /* expose .zfs in the root dir */
	boolean_t z_issnap; /* true if this is a snapshot */
	boolean_t z_vscan; /* virus scan on/off */
	boolean_t z_use_fuids; /* version allows fuids */
	boolean_t z_replay; /* set during ZIL replay */
	boolean_t z_use_sa; /* version allow system attributes */
	boolean_t z_xattr_sa; /* allow xattrs to be stores as SA */
	boolean_t z_use_namecache; /* make use of FreeBSD name cache */
	uint8_t z_xattr; /* xattr type in use */
	uint64_t z_version; /* ZPL version */
	uint64_t z_shares_dir; /* hidden shares dir */
	dataset_kstats_t z_kstat; /* fs kstats */
	kmutex_t z_lock;
	uint64_t z_userquota_obj;
	uint64_t z_groupquota_obj;
	uint64_t z_userobjquota_obj;
	uint64_t z_groupobjquota_obj;
	uint64_t z_projectquota_obj;
	uint64_t z_projectobjquota_obj;
	uint64_t z_replay_eof; /* New end of file - replay only */
	sa_attr_type_t z_attr_table; / SA attr mapping->id */
	#define ZFS_OBJ_MTX_SZ 64
	kmutex_t z_hold_mtx[ZFS_OBJ_MTX_SZ]; /* znode hold locks */
	struct task z_unlinked_drain_task;
	};
	+
	+#ifdef TEARDOWN_INACTIVE_RMS
	+#define ZFS_INIT_TEARDOWN_INACTIVE(zfsvfs) \
	+ rms_init(&(zfsvfs)->z_teardown_inactive_lock, "zfs teardown inactive")
	+
	+#define ZFS_DESTROY_TEARDOWN_INACTIVE(zfsvfs) \
	+ rms_destroy(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_TRYRLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rms_try_rlock(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_RLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rms_rlock(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_RUNLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rms_runlock(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_WLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rms_wlock(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_WUNLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rms_wunlock(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_TEARDOWN_INACTIVE_WLOCKED(zfsvfs) \
	+ rms_wowned(&(zfsvfs)->z_teardown_inactive_lock)
	+#else
	+#define ZFS_INIT_TEARDOWN_INACTIVE(zfsvfs) \
	+ rw_init(&(zfsvfs)->z_teardown_inactive_lock, NULL, RW_DEFAULT, NULL)
	+
	+#define ZFS_DESTROY_TEARDOWN_INACTIVE(zfsvfs) \
	+ rw_destroy(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_TRYRLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rw_tryenter(&(zfsvfs)->z_teardown_inactive_lock, RW_READER)
	+
	+#define ZFS_RLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rw_enter(&(zfsvfs)->z_teardown_inactive_lock, RW_READER)
	+
	+#define ZFS_RUNLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rw_exit(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_WLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rw_enter(&(zfsvfs)->z_teardown_inactive_lock, RW_WRITER)
	+
	+#define ZFS_WUNLOCK_TEARDOWN_INACTIVE(zfsvfs) \
	+ rw_exit(&(zfsvfs)->z_teardown_inactive_lock)
	+
	+#define ZFS_TEARDOWN_INACTIVE_WLOCKED(zfsvfs) \
	+ RW_WRITE_HELD(&(zfsvfs)->z_teardown_inactive_lock)
	+#endif

	#define ZSB_XATTR 0x0001 /* Enable user xattrs */
	/*
	* Normal filesystems (those not under .zfs/snapshot) have a total
	* file ID size limited to 12 bytes (including the length field) due to
	* NFSv2 protocol's limitation of 32 bytes for a filehandle. For historical
	* reasons, this same limit is being imposed by the Solaris NFSv3 implementation
	* (although the NFSv3 protocol actually permits a maximum of 64 bytes). It
	* is not possible to expand beyond 12 bytes without abandoning support
	* of NFSv2.
	*
	* For normal filesystems, we partition up the available space as follows:
	* 2 bytes fid length (required)
	* 6 bytes object number (48 bits)
	* 4 bytes generation number (32 bits)
	*
	* We reserve only 48 bits for the object number, as this is the limit
	* currently defined and imposed by the DMU.
	*/
	typedef struct zfid_short {
	uint16_t zf_len;
	uint8_t zf_object[6]; /* obj[i] = obj >> (8 * i) */
	uint8_t zf_gen[4]; /* gen[i] = gen >> (8 * i) */
	} zfid_short_t;

	/*
	* Filesystems under .zfs/snapshot have a total file ID size of 22[*] bytes
	* (including the length field). This makes files under .zfs/snapshot
	* accessible by NFSv3 and NFSv4, but not NFSv2.
	*
	* For files under .zfs/snapshot, we partition up the available space
	* as follows:
	* 2 bytes fid length (required)
	* 6 bytes object number (48 bits)
	* 4 bytes generation number (32 bits)
	* 6 bytes objset id (48 bits)
	* 4 bytes[**] currently just zero (32 bits)
	*
	* We reserve only 48 bits for the object number and objset id, as these are
	* the limits currently defined and imposed by the DMU.
	*
	* [*] 20 bytes on FreeBSD to fit into the size of struct fid.
	* [**] 2 bytes on FreeBSD for the above reason.
	*/
	typedef struct zfid_long {
	zfid_short_t z_fid;
	uint8_t zf_setid[6]; /* obj[i] = obj >> (8 * i) */
	uint8_t zf_setgen[2]; /* gen[i] = gen >> (8 * i) */
	} zfid_long_t;

	#define SHORT_FID_LEN (sizeof (zfid_short_t) - sizeof (uint16_t))
	#define LONG_FID_LEN (sizeof (zfid_long_t) - sizeof (uint16_t))

	extern uint_t zfs_fsyncer_key;
	extern int zfs_super_owner;

	extern void zfs_init(void);
	extern void zfs_fini(void);

	extern int zfs_suspend_fs(zfsvfs_t *zfsvfs);
	extern int zfs_resume_fs(zfsvfs_t zfsvfs, struct dsl_dataset ds);
	extern int zfs_end_fs(zfsvfs_t zfsvfs, struct dsl_dataset ds);
	extern int zfs_set_version(zfsvfs_t *zfsvfs, uint64_t newvers);
	extern int zfsvfs_create(const char name, boolean_t readonly, zfsvfs_t *zfvp);
	extern int zfsvfs_create_impl(zfsvfs_t *zfvp, zfsvfs_t zfsvfs, objset_t *os);
	extern void zfsvfs_free(zfsvfs_t *zfsvfs);
	extern int zfs_check_global_label(const char dsname, const char hexsl);
	extern boolean_t zfs_is_readonly(zfsvfs_t *zfsvfs);
	extern int zfs_get_temporary_prop(struct dsl_dataset *ds, zfs_prop_t zfs_prop,
	uint64_t val, char setpoint);
	extern int zfs_busy(void);

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_FS_ZFS_VFSOPS_H */
	Index: vendor-sys/openzfs/dist/include/os/linux/kernel/linux/mod_compat.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/linux/kernel/linux/mod_compat.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/os/linux/kernel/linux/mod_compat.h (revision 365892)
	@@ -1,151 +1,153 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (C) 2016 Gvozden Neskovic <neskovic@gmail.com>.
	+ * Copyright (c) 2020 by Delphix. All rights reserved.
	*/

	#ifndef _MOD_COMPAT_H
	#define _MOD_COMPAT_H

	#include <linux/module.h>
	#include <linux/moduleparam.h>

	/* Grsecurity kernel API change */
	#ifdef MODULE_PARAM_CALL_CONST
	typedef const struct kernel_param zfs_kernel_param_t;
	#else
	typedef struct kernel_param zfs_kernel_param_t;
	#endif

	#define ZMOD_RW 0644
	#define ZMOD_RD 0444

	/* BEGIN CSTYLED */
	#define INT int
	#define UINT uint
	#define ULONG ulong
	#define LONG long
	#define STRING charp
	/* END CSTYLED */

	enum scope_prefix_types {
	zfs,
	zfs_arc,
	zfs_condense,
	zfs_dbuf,
	zfs_dbuf_cache,
	zfs_deadman,
	zfs_dedup,
	zfs_l2arc,
	zfs_livelist,
	zfs_livelist_condense,
	zfs_lua,
	zfs_metaslab,
	zfs_mg,
	zfs_multihost,
	zfs_prefetch,
	zfs_reconstruct,
	zfs_recv,
	zfs_send,
	zfs_spa,
	zfs_trim,
	zfs_txg,
	zfs_vdev,
	zfs_vdev_cache,
	+ zfs_vdev_file,
	zfs_vdev_mirror,
	zfs_zevent,
	zfs_zio,
	zfs_zil
	};

	/*
	* Declare a module parameter / sysctl node
	*
	* "scope_prefix" the part of the the sysctl / sysfs tree the node resides under
	* (currently a no-op on Linux)
	* "name_prefix" the part of the variable name that will be excluded from the
	* exported names on platforms with a hierarchical namespace
	* "name" the part of the variable that will be exposed on platforms with a
	* hierarchical namespace, or as name_prefix ## name on Linux
	* "type" the variable type
	* "perm" the permissions (read/write or read only)
	* "desc" a brief description of the option
	*
	* Examples:
	* ZFS_MODULE_PARAM(zfs_vdev_mirror, zfs_vdev_mirror_, rotating_inc, UINT,
	* ZMOD_RW, "Rotating media load increment for non-seeking I/O's");
	* on FreeBSD:
	* vfs.zfs.vdev.mirror.rotating_inc
	* on Linux:
	* zfs_vdev_mirror_rotating_inc
	*
	* ZFS_MODULE_PARAM(zfs, , dmu_prefetch_max, UINT, ZMOD_RW,
	* "Limit one prefetch call to this size");
	* on FreeBSD:
	* vfs.zfs.dmu_prefetch_max
	* on Linux:
	* dmu_prefetch_max
	*/
	/* BEGIN CSTYLED */
	#define ZFS_MODULE_PARAM(scope_prefix, name_prefix, name, type, perm, desc) \
	CTASSERT_GLOBAL((sizeof (scope_prefix) == sizeof (enum scope_prefix_types))); \
	module_param(name_prefix ## name, type, perm); \
	MODULE_PARM_DESC(name_prefix ## name, desc)
	/* END CSTYLED */

	/*
	* Declare a module parameter / sysctl node
	*
	* "scope_prefix" the part of the the sysctl / sysfs tree the node resides under
	* (currently a no-op on Linux)
	* "name_prefix" the part of the variable name that will be excluded from the
	* exported names on platforms with a hierarchical namespace
	* "name" the part of the variable that will be exposed on platforms with a
	* hierarchical namespace, or as name_prefix ## name on Linux
	* "setfunc" setter function
	* "getfunc" getter function
	* "perm" the permissions (read/write or read only)
	* "desc" a brief description of the option
	*
	* Examples:
	* ZFS_MODULE_PARAM_CALL(zfs_spa, spa_, slop_shift, param_set_slop_shift,
	* param_get_int, ZMOD_RW, "Reserved free space in pool");
	* on FreeBSD:
	* vfs.zfs.spa_slop_shift
	* on Linux:
	* spa_slop_shift
	*/
	/* BEGIN CSTYLED */
	#define ZFS_MODULE_PARAM_CALL(scope_prefix, name_prefix, name, setfunc, getfunc, perm, desc) \
	CTASSERT_GLOBAL((sizeof (scope_prefix) == sizeof (enum scope_prefix_types))); \
	module_param_call(name_prefix ## name, setfunc, getfunc, &name_prefix ## name, perm); \
	MODULE_PARM_DESC(name_prefix ## name, desc)
	/* END CSTYLED */

	#define ZFS_MODULE_PARAM_ARGS const char buf, zfs_kernel_param_t kp

	#define ZFS_MODULE_DESCRIPTION(s) MODULE_DESCRIPTION(s)
	#define ZFS_MODULE_AUTHOR(s) MODULE_AUTHOR(s)
	#define ZFS_MODULE_LICENSE(s) MODULE_LICENSE(s)
	#define ZFS_MODULE_VERSION(s) MODULE_VERSION(s)

	#endif /* _MOD_COMPAT_H */
	Index: vendor-sys/openzfs/dist/include/os/linux/spl/sys/condvar.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/linux/spl/sys/condvar.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/os/linux/spl/sys/condvar.h (revision 365892)
	@@ -1,113 +1,120 @@
	/*
	* Copyright (C) 2007-2010 Lawrence Livermore National Security, LLC.
	* Copyright (C) 2007 The Regents of the University of California.
	* Produced at Lawrence Livermore National Laboratory (cf, DISCLAIMER).
	* Written by Brian Behlendorf <behlendorf1@llnl.gov>.
	* UCRL-CODE-235197
	*
	* This file is part of the SPL, Solaris Porting Layer.
	* For details, see <http://zfsonlinux.org/>.
	*
	* The SPL is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License as published by the
	* Free Software Foundation; either version 2 of the License, or (at your
	* option) any later version.
	*
	* The SPL is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* for more details.
	*
	* You should have received a copy of the GNU General Public License along
	* with the SPL. If not, see <http://www.gnu.org/licenses/>.
	*/

	#ifndef _SPL_CONDVAR_H
	#define _SPL_CONDVAR_H

	#include <linux/module.h>
	#include <sys/kmem.h>
	#include <sys/mutex.h>
	#include <sys/callo.h>
	#include <sys/wait.h>
	#include <sys/time.h>

	/*
	* cv_timedwait() is similar to cv_wait() except that it additionally expects
	* a timeout value specified in ticks. When woken by cv_signal() or
	* cv_broadcast() it returns 1, otherwise when the timeout is reached -1 is
	* returned.
	*
	* cv_timedwait_sig() behaves the same as cv_timedwait() but blocks
	* interruptibly and can be woken by a signal (EINTR, ERESTART). When
	* this occurs 0 is returned.
	*
	* cv_timedwait_io() and cv_timedwait_sig_io() are variants of cv_timedwait()
	* and cv_timedwait_sig() which should be used when waiting for outstanding
	* IO to complete. They are responsible for updating the iowait accounting
	* when this is supported by the platform.
	*
	* cv_timedwait_hires() and cv_timedwait_sig_hires() are high resolution
	* versions of cv_timedwait() and cv_timedwait_sig(). They expect the timeout
	* to be specified as a hrtime_t allowing for timeouts of less than a tick.
	*
	* N.B. The return values differ slightly from the illumos implementation
	* which returns the time remaining, instead of 1, when woken. They both
	* return -1 on timeout. Consumers which need to know the time remaining
	* are responsible for tracking it themselves.
	*/


	/*
	* The kcondvar_t struct is protected by mutex taken externally before
	* calling any of the wait/signal funs, and passed into the wait funs.
	*/
	#define CV_MAGIC 0x346545f4
	#define CV_DESTROY 0x346545f5

	typedef struct {
	int cv_magic;
	spl_wait_queue_head_t cv_event;
	spl_wait_queue_head_t cv_destroy;
	atomic_t cv_refs;
	atomic_t cv_waiters;
	kmutex_t *cv_mutex;
	} kcondvar_t;

	typedef enum { CV_DEFAULT = 0, CV_DRIVER } kcv_type_t;

	extern void __cv_init(kcondvar_t , char , kcv_type_t, void *);
	extern void __cv_destroy(kcondvar_t *);
	extern void __cv_wait(kcondvar_t , kmutex_t );
	extern void __cv_wait_io(kcondvar_t , kmutex_t );
	+extern void __cv_wait_idle(kcondvar_t , kmutex_t );
	extern int __cv_wait_io_sig(kcondvar_t , kmutex_t );
	extern int __cv_wait_sig(kcondvar_t , kmutex_t );
	extern int __cv_timedwait(kcondvar_t , kmutex_t , clock_t);
	extern int __cv_timedwait_io(kcondvar_t , kmutex_t , clock_t);
	extern int __cv_timedwait_sig(kcondvar_t , kmutex_t , clock_t);
	+extern int __cv_timedwait_idle(kcondvar_t , kmutex_t , clock_t);
	extern int cv_timedwait_hires(kcondvar_t , kmutex_t , hrtime_t,
	hrtime_t res, int flag);
	extern int cv_timedwait_sig_hires(kcondvar_t , kmutex_t , hrtime_t,
	hrtime_t res, int flag);
	+extern int cv_timedwait_idle_hires(kcondvar_t , kmutex_t , hrtime_t,
	+ hrtime_t res, int flag);
	extern void __cv_signal(kcondvar_t *);
	extern void __cv_broadcast(kcondvar_t *c);

	#define cv_init(cvp, name, type, arg) __cv_init(cvp, name, type, arg)
	#define cv_destroy(cvp) __cv_destroy(cvp)
	#define cv_wait(cvp, mp) __cv_wait(cvp, mp)
	#define cv_wait_io(cvp, mp) __cv_wait_io(cvp, mp)
	+#define cv_wait_idle(cvp, mp) __cv_wait_idle(cvp, mp)
	#define cv_wait_io_sig(cvp, mp) __cv_wait_io_sig(cvp, mp)
	#define cv_wait_sig(cvp, mp) __cv_wait_sig(cvp, mp)
	#define cv_signal(cvp) __cv_signal(cvp)
	#define cv_broadcast(cvp) __cv_broadcast(cvp)

	/*
	* NB: There is no way to reliably distinguish between having been signalled
	* and having timed out on Linux. If the client code needs to reliably
	* distinguish between the two it should use the hires variant.
	*/
	#define cv_timedwait(cvp, mp, t) __cv_timedwait(cvp, mp, t)
	#define cv_timedwait_io(cvp, mp, t) __cv_timedwait_io(cvp, mp, t)
	#define cv_timedwait_sig(cvp, mp, t) __cv_timedwait_sig(cvp, mp, t)
	+#define cv_timedwait_idle(cvp, mp, t) __cv_timedwait_idle(cvp, mp, t)
	+

	#endif /* _SPL_CONDVAR_H */
	Index: vendor-sys/openzfs/dist/include/os/linux/zfs/sys/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/linux/zfs/sys/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/include/os/linux/zfs/sys/Makefile.am (revision 365892)
	@@ -1,30 +1,31 @@
	KERNEL_H = \
	policy.h \
	sha2.h \
	trace_acl.h \
	trace_arc.h \
	trace_common.h \
	trace_zfs.h \
	trace_dbgmsg.h \
	trace_dbuf.h \
	trace_dmu.h \
	trace_dnode.h \
	trace_multilist.h \
	trace_rrwlock.h \
	trace_txg.h \
	trace_vdev.h \
	trace_zil.h \
	trace_zio.h \
	trace_zrlock.h \
	+ zfs_bootenv_os.h \
	zfs_context_os.h \
	zfs_ctldir.h \
	zfs_dir.h \
	zfs_vfsops_os.h \
	zfs_vnops.h \
	zfs_znode_impl.h \
	zpl.h

	if CONFIG_KERNEL
	kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys
	kernel_HEADERS = $(KERNEL_H)
	endif
	Index: vendor-sys/openzfs/dist/include/os/linux/zfs/sys/zfs_bootenv_os.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/os/linux/zfs/sys/zfs_bootenv_os.h (nonexistent)
	+++ vendor-sys/openzfs/dist/include/os/linux/zfs/sys/zfs_bootenv_os.h (revision 365892)
	@@ -0,0 +1,29 @@
	+/*
	+ * This file and its contents are supplied under the terms of the
	+ * Common Development and Distribution License ("CDDL"), version 1.0.
	+ * You may only use this file in accordance with the terms of version
	+ * 1.0 of the CDDL.
	+ *
	+ * A full copy of the text of the CDDL should have accompanied this
	+ * source. A copy of the CDDL is also available via the Internet at
	+ * http://www.illumos.org/license/CDDL.
	+ */
	+
	+/*
	+ * Copyright 2020 Toomas Soome <tsoome@me.com>
	+ */
	+
	+#ifndef _ZFS_BOOTENV_OS_H
	+#define _ZFS_BOOTENV_OS_H
	+
	+#ifdef __cplusplus
	+extern "C" {
	+#endif
	+
	+#define BOOTENV_OS BE_LINUX_VENDOR
	+
	+#ifdef __cplusplus
	+}
	+#endif
	+
	+#endif /* _ZFS_BOOTENV_OS_H */

	Property changes on: vendor-sys/openzfs/dist/include/os/linux/zfs/sys/zfs_bootenv_os.h
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/include/sys/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/Makefile.am (revision 365892)
	@@ -1,148 +1,149 @@
	SUBDIRS = fm fs crypto lua sysevent zstd

	COMMON_H = \
	abd.h \
	abd_impl.h \
	aggsum.h \
	arc.h \
	arc_impl.h \
	avl.h \
	avl_impl.h \
	bitops.h \
	blkptr.h \
	bplist.h \
	bpobj.h \
	bptree.h \
	btree.h \
	bqueue.h \
	dataset_kstats.h \
	dbuf.h \
	ddt.h \
	dmu.h \
	dmu_impl.h \
	dmu_objset.h \
	dmu_recv.h \
	dmu_redact.h \
	dmu_send.h \
	dmu_traverse.h \
	dmu_tx.h \
	dmu_zfetch.h \
	dnode.h \
	dsl_bookmark.h \
	dsl_dataset.h \
	dsl_deadlist.h \
	dsl_deleg.h \
	dsl_destroy.h \
	dsl_dir.h \
	dsl_crypt.h \
	dsl_pool.h \
	dsl_prop.h \
	dsl_scan.h \
	dsl_synctask.h \
	dsl_userhold.h \
	edonr.h \
	efi_partition.h \
	frame.h \
	hkdf.h \
	metaslab.h \
	metaslab_impl.h \
	mmp.h \
	mntent.h \
	mod.h \
	multilist.h \
	note.h \
	nvpair.h \
	nvpair_impl.h \
	objlist.h \
	pathname.h \
	qat.h \
	range_tree.h \
	rrwlock.h \
	sa.h \
	sa_impl.h \
	skein.h \
	spa_boot.h \
	spa_checkpoint.h \
	spa_log_spacemap.h \
	space_map.h \
	space_reftree.h \
	spa.h \
	spa_impl.h \
	spa_checksum.h \
	sysevent.h \
	txg.h \
	txg_impl.h \
	u8_textprep_data.h \
	u8_textprep.h \
	uberblock.h \
	uberblock_impl.h \
	uio_impl.h \
	unique.h \
	uuid.h \
	vdev_disk.h \
	vdev_file.h \
	vdev.h \
	vdev_impl.h \
	vdev_indirect_births.h \
	vdev_indirect_mapping.h \
	vdev_initialize.h \
	vdev_raidz.h \
	vdev_raidz_impl.h \
	vdev_rebuild.h \
	vdev_removal.h \
	vdev_trim.h \
	xvattr.h \
	zap.h \
	zap_impl.h \
	zap_leaf.h \
	zcp.h \
	zcp_global.h \
	zcp_iter.h \
	zcp_prop.h \
	zcp_set.h \
	zfeature.h \
	zfs_acl.h \
	+ zfs_bootenv.h \
	zfs_context.h \
	zfs_debug.h \
	zfs_delay.h \
	zfs_file.h \
	zfs_fuid.h \
	zfs_project.h \
	zfs_quota.h \
	zfs_ratelimit.h \
	zfs_refcount.h \
	zfs_rlock.h \
	zfs_sa.h \
	zfs_stat.h \
	zfs_sysfs.h \
	zfs_vfsops.h \
	zfs_znode.h \
	zil.h \
	zil_impl.h \
	zio_checksum.h \
	zio_compress.h \
	zio_crypt.h \
	zio.h \
	zio_impl.h \
	zio_priority.h \
	zrlock.h \
	zthr.h

	KERNEL_H = \
	zfs_ioctl.h \
	zfs_ioctl_impl.h \
	zfs_onexit.h \
	zvol.h \
	zvol_impl.h

	if CONFIG_USER
	libzfsdir = $(includedir)/libzfs/sys
	libzfs_HEADERS = $(COMMON_H)
	endif

	if CONFIG_KERNEL
	if BUILD_LINUX
	kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys
	kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
	endif
	endif
	Index: vendor-sys/openzfs/dist/include/sys/dsl_synctask.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/dsl_synctask.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/dsl_synctask.h (revision 365892)
	@@ -1,127 +1,127 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2012, 2017 by Delphix. All rights reserved.
	*/

	#ifndef _SYS_DSL_SYNCTASK_H
	#define _SYS_DSL_SYNCTASK_H

	#include <sys/txg.h>
	#include <sys/zfs_context.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	struct dsl_pool;

	typedef int (dsl_checkfunc_t)(void , dmu_tx_t );
	typedef void (dsl_syncfunc_t)(void , dmu_tx_t );
	typedef void (dsl_sigfunc_t)(void , dmu_tx_t );

	typedef enum zfs_space_check {
	/*
	* Normal space check: if there is less than 3.2% free space,
	* the operation will fail. Operations which are logically
	* creating things should use this (e.g. "zfs create", "zfs snapshot").
	* User writes (via the ZPL / ZVOL) also fail at this point.
	*/
	ZFS_SPACE_CHECK_NORMAL,

	/*
	* Space check allows use of half the slop space. If there
	* is less than 1.6% free space, the operation will fail. Most
	* operations should use this (e.g. "zfs set", "zfs rename"),
	* because we want them to succeed even after user writes are failing,
	* so that they can be used as part of the space recovery process.
	*/
	ZFS_SPACE_CHECK_RESERVED,

	/*
	* Space check allows use of three quarters of the slop space.
	* If there is less than 0.8% free space, the operation will
	* fail.
	*/
	ZFS_SPACE_CHECK_EXTRA_RESERVED,

	/*
	* In all cases "zfs destroy" is expected to result in an net
	* reduction of space, except one. When the pool has a
	* checkpoint, space freed by "zfs destroy" will not actually
	* free anything internally. Thus, it starts failing after
	* three quarters of the slop space is exceeded.
	*/
	ZFS_SPACE_CHECK_DESTROY = ZFS_SPACE_CHECK_EXTRA_RESERVED,

	/*
	* A channel program can run a "zfs destroy" as part of its
	* script and therefore has the same space_check policy when
	* being evaluated.
	*/
	ZFS_SPACE_CHECK_ZCP_EVAL = ZFS_SPACE_CHECK_DESTROY,

	/*
	* No space check is performed. This level of space check should
	* be used cautiously as operations that use it can even run when
	* 0.8% capacity is left for use. In this scenario, if there is a
	* checkpoint, async destroys are suspended and any kind of freeing
	* can potentially add space instead of freeing it.
	*
	* See also the comments above spa_slop_shift.
	*/
	ZFS_SPACE_CHECK_NONE,

	ZFS_SPACE_CHECK_DISCARD_CHECKPOINT = ZFS_SPACE_CHECK_NONE,

	} zfs_space_check_t;

	typedef struct dsl_sync_task {
	txg_node_t dst_node;
	struct dsl_pool *dst_pool;
	uint64_t dst_txg;
	int dst_space;
	zfs_space_check_t dst_space_check;
	dsl_checkfunc_t *dst_checkfunc;
	dsl_syncfunc_t *dst_syncfunc;
	void *dst_arg;
	int dst_error;
	boolean_t dst_nowaiter;
	} dsl_sync_task_t;

	void dsl_sync_task_sync(dsl_sync_task_t , dmu_tx_t );
	int dsl_sync_task(const char , dsl_checkfunc_t ,
	dsl_syncfunc_t , void , int, zfs_space_check_t);
	void dsl_sync_task_nowait(struct dsl_pool , dsl_syncfunc_t ,
	- void , int, zfs_space_check_t, dmu_tx_t );
	+ void , dmu_tx_t );
	int dsl_early_sync_task(const char , dsl_checkfunc_t ,
	dsl_syncfunc_t , void , int, zfs_space_check_t);
	void dsl_early_sync_task_nowait(struct dsl_pool , dsl_syncfunc_t ,
	- void , int, zfs_space_check_t, dmu_tx_t );
	+ void , dmu_tx_t );
	int dsl_sync_task_sig(const char , dsl_checkfunc_t , dsl_syncfunc_t *,
	dsl_sigfunc_t , void , int, zfs_space_check_t);

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_DSL_SYNCTASK_H */
	Index: vendor-sys/openzfs/dist/include/sys/fm/fs/zfs.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/fm/fs/zfs.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/fm/fs/zfs.h (revision 365892)
	@@ -1,121 +1,126 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
	* Use is subject to license terms.
	*/

	+/*
	+ * Copyright (c) 2020 by Delphix. All rights reserved.
	+ */
	+
	#ifndef _SYS_FM_FS_ZFS_H
	#define _SYS_FM_FS_ZFS_H

	#ifdef __cplusplus
	extern "C" {
	#endif

	#define ZFS_ERROR_CLASS "fs.zfs"

	#define FM_EREPORT_ZFS_CHECKSUM "checksum"
	#define FM_EREPORT_ZFS_AUTHENTICATION "authentication"
	#define FM_EREPORT_ZFS_IO "io"
	#define FM_EREPORT_ZFS_DATA "data"
	#define FM_EREPORT_ZFS_DELAY "delay"
	#define FM_EREPORT_ZFS_DEADMAN "deadman"
	#define FM_EREPORT_ZFS_POOL "zpool"
	#define FM_EREPORT_ZFS_DEVICE_UNKNOWN "vdev.unknown"
	#define FM_EREPORT_ZFS_DEVICE_OPEN_FAILED "vdev.open_failed"
	#define FM_EREPORT_ZFS_DEVICE_CORRUPT_DATA "vdev.corrupt_data"
	#define FM_EREPORT_ZFS_DEVICE_NO_REPLICAS "vdev.no_replicas"
	#define FM_EREPORT_ZFS_DEVICE_BAD_GUID_SUM "vdev.bad_guid_sum"
	#define FM_EREPORT_ZFS_DEVICE_TOO_SMALL "vdev.too_small"
	#define FM_EREPORT_ZFS_DEVICE_BAD_LABEL "vdev.bad_label"
	#define FM_EREPORT_ZFS_DEVICE_BAD_ASHIFT "vdev.bad_ashift"
	#define FM_EREPORT_ZFS_IO_FAILURE "io_failure"
	#define FM_EREPORT_ZFS_PROBE_FAILURE "probe_failure"
	#define FM_EREPORT_ZFS_LOG_REPLAY "log_replay"
	#define FM_EREPORT_ZFS_CONFIG_CACHE_WRITE "config_cache_write"

	#define FM_EREPORT_PAYLOAD_ZFS_POOL "pool"
	#define FM_EREPORT_PAYLOAD_ZFS_POOL_FAILMODE "pool_failmode"
	#define FM_EREPORT_PAYLOAD_ZFS_POOL_GUID "pool_guid"
	#define FM_EREPORT_PAYLOAD_ZFS_POOL_CONTEXT "pool_context"
	#define FM_EREPORT_PAYLOAD_ZFS_POOL_STATE "pool_state"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_GUID "vdev_guid"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_TYPE "vdev_type"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_PATH "vdev_path"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_PHYSPATH "vdev_physpath"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_ENC_SYSFS_PATH "vdev_enc_sysfs_path"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_DEVID "vdev_devid"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_FRU "vdev_fru"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_STATE "vdev_state"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_LASTSTATE "vdev_laststate"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_ASHIFT "vdev_ashift"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_COMP_TS "vdev_complete_ts"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_DELTA_TS "vdev_delta_ts"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_SPARE_PATHS "vdev_spare_paths"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_SPARE_GUIDS "vdev_spare_guids"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_READ_ERRORS "vdev_read_errors"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_WRITE_ERRORS "vdev_write_errors"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_CKSUM_ERRORS "vdev_cksum_errors"
	#define FM_EREPORT_PAYLOAD_ZFS_VDEV_DELAYS "vdev_delays"
	#define FM_EREPORT_PAYLOAD_ZFS_PARENT_GUID "parent_guid"
	#define FM_EREPORT_PAYLOAD_ZFS_PARENT_TYPE "parent_type"
	#define FM_EREPORT_PAYLOAD_ZFS_PARENT_PATH "parent_path"
	#define FM_EREPORT_PAYLOAD_ZFS_PARENT_DEVID "parent_devid"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_OBJSET "zio_objset"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_OBJECT "zio_object"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_LEVEL "zio_level"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_BLKID "zio_blkid"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_ERR "zio_err"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_OFFSET "zio_offset"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_SIZE "zio_size"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_FLAGS "zio_flags"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_STAGE "zio_stage"
	+#define FM_EREPORT_PAYLOAD_ZFS_ZIO_PRIORITY "zio_priority"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_PIPELINE "zio_pipeline"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_DELAY "zio_delay"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_TIMESTAMP "zio_timestamp"
	#define FM_EREPORT_PAYLOAD_ZFS_ZIO_DELTA "zio_delta"
	#define FM_EREPORT_PAYLOAD_ZFS_PREV_STATE "prev_state"
	#define FM_EREPORT_PAYLOAD_ZFS_CKSUM_EXPECTED "cksum_expected"
	#define FM_EREPORT_PAYLOAD_ZFS_CKSUM_ACTUAL "cksum_actual"
	#define FM_EREPORT_PAYLOAD_ZFS_CKSUM_ALGO "cksum_algorithm"
	#define FM_EREPORT_PAYLOAD_ZFS_CKSUM_BYTESWAP "cksum_byteswap"
	#define FM_EREPORT_PAYLOAD_ZFS_BAD_OFFSET_RANGES "bad_ranges"
	#define FM_EREPORT_PAYLOAD_ZFS_BAD_RANGE_MIN_GAP "bad_ranges_min_gap"
	#define FM_EREPORT_PAYLOAD_ZFS_BAD_RANGE_SETS "bad_range_sets"
	#define FM_EREPORT_PAYLOAD_ZFS_BAD_RANGE_CLEARS "bad_range_clears"
	#define FM_EREPORT_PAYLOAD_ZFS_BAD_SET_BITS "bad_set_bits"
	#define FM_EREPORT_PAYLOAD_ZFS_BAD_CLEARED_BITS "bad_cleared_bits"
	#define FM_EREPORT_PAYLOAD_ZFS_BAD_SET_HISTOGRAM "bad_set_histogram"
	#define FM_EREPORT_PAYLOAD_ZFS_BAD_CLEARED_HISTOGRAM "bad_cleared_histogram"

	#define FM_EREPORT_FAILMODE_WAIT "wait"
	#define FM_EREPORT_FAILMODE_CONTINUE "continue"
	#define FM_EREPORT_FAILMODE_PANIC "panic"

	#define FM_RESOURCE_REMOVED "removed"
	#define FM_RESOURCE_AUTOREPLACE "autoreplace"
	#define FM_RESOURCE_STATECHANGE "statechange"

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_FM_FS_ZFS_H */
	Index: vendor-sys/openzfs/dist/include/sys/fm/util.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/fm/util.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/fm/util.h (revision 365892)
	@@ -1,118 +1,121 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
	*/

	#ifndef _SYS_FM_UTIL_H
	#define _SYS_FM_UTIL_H

	#ifdef __cplusplus
	extern "C" {
	#endif

	#include <sys/nvpair.h>

	/*
	* Shared user/kernel definitions for class length, error channel name,
	* and kernel event publisher string.
	*/
	#define FM_MAX_CLASS 100
	#define FM_ERROR_CHAN "com.sun:fm:error"
	#define FM_PUB "fm"

	/*
	* ereport dump device transport support
	*
	* Ereports are written out to the dump device at a proscribed offset from the
	* end, similar to in-transit log messages. The ereports are represented as a
	* erpt_dump_t header followed by ed_size bytes of packed native nvlist data.
	*
	* NOTE: All of these constants and the header must be defined so they have the
	* same representation for both 32-bit and 64-bit producers and consumers.
	*/
	#define ERPT_MAGIC 0xf00d4eddU
	#define ERPT_MAX_ERRS 16
	#define ERPT_DATA_SZ (6 * 1024)
	#define ERPT_EVCH_MAX 256
	#define ERPT_HIWAT 64

	typedef struct erpt_dump {
	uint32_t ed_magic; /* ERPT_MAGIC or zero to indicate end */
	uint32_t ed_chksum; /* checksum32() of packed nvlist data */
	uint32_t ed_size; /* ereport (nvl) fixed buf size */
	uint32_t ed_pad; /* reserved for future use */
	hrtime_t ed_hrt_nsec; /* hrtime of this ereport */
	hrtime_t ed_hrt_base; /* hrtime sample corresponding to ed_tod_base */
	struct {
	uint64_t sec; /* seconds since gettimeofday() Epoch */
	uint64_t nsec; /* nanoseconds past ed_tod_base.sec */
	} ed_tod_base;
	} erpt_dump_t;

	#ifdef _KERNEL

	#define ZEVENT_SHUTDOWN 0x1

	typedef void zevent_cb_t(nvlist_t , nvlist_t );

	typedef struct zevent_s {
	nvlist_t ev_nvl; / protected by the zevent_lock */
	nvlist_t ev_detector; / " */
	list_t ev_ze_list; /* " */
	list_node_t ev_node; /* " */
	zevent_cb_t ev_cb; / " */
	uint64_t ev_eid;
	} zevent_t;

	typedef struct zfs_zevent {
	zevent_t ze_zevent; / protected by the zevent_lock */
	list_node_t ze_node; /* " */
	uint64_t ze_dropped; /* " */
	} zfs_zevent_t;

	extern void fm_init(void);
	extern void fm_fini(void);
	extern void fm_nvprint(nvlist_t *);
	extern void zfs_zevent_post_cb(nvlist_t nvl, nvlist_t detector);
	extern int zfs_zevent_post(nvlist_t , nvlist_t , zevent_cb_t *);
	extern void zfs_zevent_drain_all(int *);
	extern int zfs_zevent_fd_hold(int, minor_t , zfs_zevent_t *);
	extern void zfs_zevent_fd_rele(int);
	extern int zfs_zevent_next(zfs_zevent_t , nvlist_t , uint64_t , uint64_t *);
	extern int zfs_zevent_wait(zfs_zevent_t *);
	extern int zfs_zevent_seek(zfs_zevent_t *, uint64_t);
	extern void zfs_zevent_init(zfs_zevent_t **);
	extern void zfs_zevent_destroy(zfs_zevent_t *);

	+extern void zfs_zevent_track_duplicate(void);
	+extern void zfs_ereport_init(void);
	+extern void zfs_ereport_fini(void);
	#else

	static inline void fm_init(void) { }
	static inline void fm_fini(void) { }

	#endif /* _KERNEL */

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_FM_UTIL_H */
	Index: vendor-sys/openzfs/dist/include/sys/fs/zfs.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/fs/zfs.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/fs/zfs.h (revision 365892)
	@@ -1,1589 +1,1589 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2013, 2017 Joyent, Inc. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright (c) 2017, Intel Corporation.
	* Copyright (c) 2019 Datto Inc.
	*/

	/* Portions Copyright 2010 Robert Milkowski */

	#ifndef _SYS_FS_ZFS_H
	#define _SYS_FS_ZFS_H

	#include <sys/time.h>
	#include <sys/zio_priority.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	/*
	* Types and constants shared between userland and the kernel.
	*/

	/*
	* Each dataset can be one of the following types. These constants can be
	* combined into masks that can be passed to various functions.
	*/
	typedef enum {
	ZFS_TYPE_FILESYSTEM = (1 << 0),
	ZFS_TYPE_SNAPSHOT = (1 << 1),
	ZFS_TYPE_VOLUME = (1 << 2),
	ZFS_TYPE_POOL = (1 << 3),
	ZFS_TYPE_BOOKMARK = (1 << 4)
	} zfs_type_t;

	/*
	* NB: lzc_dataset_type should be updated whenever a new objset type is added,
	* if it represents a real type of a dataset that can be created from userland.
	*/
	typedef enum dmu_objset_type {
	DMU_OST_NONE,
	DMU_OST_META,
	DMU_OST_ZFS,
	DMU_OST_ZVOL,
	DMU_OST_OTHER, /* For testing only! */
	DMU_OST_ANY, /* Be careful! */
	DMU_OST_NUMTYPES
	} dmu_objset_type_t;

	#define ZFS_TYPE_DATASET \
	(ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME \| ZFS_TYPE_SNAPSHOT)

	/*
	* All of these include the terminating NUL byte.
	*/
	#define ZAP_MAXNAMELEN 256
	#define ZAP_MAXVALUELEN (1024 * 8)
	#define ZAP_OLDMAXVALUELEN 1024
	#define ZFS_MAX_DATASET_NAME_LEN 256

	/*
	* Dataset properties are identified by these constants and must be added to
	* the end of this list to ensure that external consumers are not affected
	* by the change. If you make any changes to this list, be sure to update
	* the property table in module/zcommon/zfs_prop.c.
	*/
	typedef enum {
	ZPROP_CONT = -2,
	ZPROP_INVAL = -1,
	ZFS_PROP_TYPE = 0,
	ZFS_PROP_CREATION,
	ZFS_PROP_USED,
	ZFS_PROP_AVAILABLE,
	ZFS_PROP_REFERENCED,
	ZFS_PROP_COMPRESSRATIO,
	ZFS_PROP_MOUNTED,
	ZFS_PROP_ORIGIN,
	ZFS_PROP_QUOTA,
	ZFS_PROP_RESERVATION,
	ZFS_PROP_VOLSIZE,
	ZFS_PROP_VOLBLOCKSIZE,
	ZFS_PROP_RECORDSIZE,
	ZFS_PROP_MOUNTPOINT,
	ZFS_PROP_SHARENFS,
	ZFS_PROP_CHECKSUM,
	ZFS_PROP_COMPRESSION,
	ZFS_PROP_ATIME,
	ZFS_PROP_DEVICES,
	ZFS_PROP_EXEC,
	ZFS_PROP_SETUID,
	ZFS_PROP_READONLY,
	ZFS_PROP_ZONED,
	ZFS_PROP_SNAPDIR,
	ZFS_PROP_ACLMODE,
	ZFS_PROP_ACLINHERIT,
	ZFS_PROP_CREATETXG,
	ZFS_PROP_NAME, /* not exposed to the user */
	ZFS_PROP_CANMOUNT,
	ZFS_PROP_ISCSIOPTIONS, /* not exposed to the user */
	ZFS_PROP_XATTR,
	ZFS_PROP_NUMCLONES, /* not exposed to the user */
	ZFS_PROP_COPIES,
	ZFS_PROP_VERSION,
	ZFS_PROP_UTF8ONLY,
	ZFS_PROP_NORMALIZE,
	ZFS_PROP_CASE,
	ZFS_PROP_VSCAN,
	ZFS_PROP_NBMAND,
	ZFS_PROP_SHARESMB,
	ZFS_PROP_REFQUOTA,
	ZFS_PROP_REFRESERVATION,
	ZFS_PROP_GUID,
	ZFS_PROP_PRIMARYCACHE,
	ZFS_PROP_SECONDARYCACHE,
	ZFS_PROP_USEDSNAP,
	ZFS_PROP_USEDDS,
	ZFS_PROP_USEDCHILD,
	ZFS_PROP_USEDREFRESERV,
	ZFS_PROP_USERACCOUNTING, /* not exposed to the user */
	ZFS_PROP_STMF_SHAREINFO, /* not exposed to the user */
	ZFS_PROP_DEFER_DESTROY,
	ZFS_PROP_USERREFS,
	ZFS_PROP_LOGBIAS,
	ZFS_PROP_UNIQUE, /* not exposed to the user */
	ZFS_PROP_OBJSETID,
	ZFS_PROP_DEDUP,
	ZFS_PROP_MLSLABEL,
	ZFS_PROP_SYNC,
	ZFS_PROP_DNODESIZE,
	ZFS_PROP_REFRATIO,
	ZFS_PROP_WRITTEN,
	ZFS_PROP_CLONES,
	ZFS_PROP_LOGICALUSED,
	ZFS_PROP_LOGICALREFERENCED,
	ZFS_PROP_INCONSISTENT, /* not exposed to the user */
	ZFS_PROP_VOLMODE,
	ZFS_PROP_FILESYSTEM_LIMIT,
	ZFS_PROP_SNAPSHOT_LIMIT,
	ZFS_PROP_FILESYSTEM_COUNT,
	ZFS_PROP_SNAPSHOT_COUNT,
	ZFS_PROP_SNAPDEV,
	ZFS_PROP_ACLTYPE,
	ZFS_PROP_SELINUX_CONTEXT,
	ZFS_PROP_SELINUX_FSCONTEXT,
	ZFS_PROP_SELINUX_DEFCONTEXT,
	ZFS_PROP_SELINUX_ROOTCONTEXT,
	ZFS_PROP_RELATIME,
	ZFS_PROP_REDUNDANT_METADATA,
	ZFS_PROP_OVERLAY,
	ZFS_PROP_PREV_SNAP,
	ZFS_PROP_RECEIVE_RESUME_TOKEN,
	ZFS_PROP_ENCRYPTION,
	ZFS_PROP_KEYLOCATION,
	ZFS_PROP_KEYFORMAT,
	ZFS_PROP_PBKDF2_SALT,
	ZFS_PROP_PBKDF2_ITERS,
	ZFS_PROP_ENCRYPTION_ROOT,
	ZFS_PROP_KEY_GUID,
	ZFS_PROP_KEYSTATUS,
	ZFS_PROP_REMAPTXG, /* obsolete - no longer used */
	ZFS_PROP_SPECIAL_SMALL_BLOCKS,
	ZFS_PROP_IVSET_GUID, /* not exposed to the user */
	ZFS_PROP_REDACTED,
	ZFS_PROP_REDACT_SNAPS,
	ZFS_NUM_PROPS
	} zfs_prop_t;

	typedef enum {
	ZFS_PROP_USERUSED,
	ZFS_PROP_USERQUOTA,
	ZFS_PROP_GROUPUSED,
	ZFS_PROP_GROUPQUOTA,
	ZFS_PROP_USEROBJUSED,
	ZFS_PROP_USEROBJQUOTA,
	ZFS_PROP_GROUPOBJUSED,
	ZFS_PROP_GROUPOBJQUOTA,
	ZFS_PROP_PROJECTUSED,
	ZFS_PROP_PROJECTQUOTA,
	ZFS_PROP_PROJECTOBJUSED,
	ZFS_PROP_PROJECTOBJQUOTA,
	ZFS_NUM_USERQUOTA_PROPS
	} zfs_userquota_prop_t;

	extern const char *zfs_userquota_prop_prefixes[ZFS_NUM_USERQUOTA_PROPS];

	/*
	* Pool properties are identified by these constants and must be added to the
	* end of this list to ensure that external consumers are not affected
	* by the change. Properties must be registered in zfs_prop_init().
	*/
	typedef enum {
	ZPOOL_PROP_INVAL = -1,
	ZPOOL_PROP_NAME,
	ZPOOL_PROP_SIZE,
	ZPOOL_PROP_CAPACITY,
	ZPOOL_PROP_ALTROOT,
	ZPOOL_PROP_HEALTH,
	ZPOOL_PROP_GUID,
	ZPOOL_PROP_VERSION,
	ZPOOL_PROP_BOOTFS,
	ZPOOL_PROP_DELEGATION,
	ZPOOL_PROP_AUTOREPLACE,
	ZPOOL_PROP_CACHEFILE,
	ZPOOL_PROP_FAILUREMODE,
	ZPOOL_PROP_LISTSNAPS,
	ZPOOL_PROP_AUTOEXPAND,
	ZPOOL_PROP_DEDUPDITTO,
	ZPOOL_PROP_DEDUPRATIO,
	ZPOOL_PROP_FREE,
	ZPOOL_PROP_ALLOCATED,
	ZPOOL_PROP_READONLY,
	ZPOOL_PROP_ASHIFT,
	ZPOOL_PROP_COMMENT,
	ZPOOL_PROP_EXPANDSZ,
	ZPOOL_PROP_FREEING,
	ZPOOL_PROP_FRAGMENTATION,
	ZPOOL_PROP_LEAKED,
	ZPOOL_PROP_MAXBLOCKSIZE,
	ZPOOL_PROP_TNAME,
	ZPOOL_PROP_MAXDNODESIZE,
	ZPOOL_PROP_MULTIHOST,
	ZPOOL_PROP_CHECKPOINT,
	ZPOOL_PROP_LOAD_GUID,
	ZPOOL_PROP_AUTOTRIM,
	ZPOOL_NUM_PROPS
	} zpool_prop_t;

	/* Small enough to not hog a whole line of printout in zpool(1M). */
	#define ZPROP_MAX_COMMENT 32

	#define ZPROP_VALUE "value"
	#define ZPROP_SOURCE "source"

	typedef enum {
	ZPROP_SRC_NONE = 0x1,
	ZPROP_SRC_DEFAULT = 0x2,
	ZPROP_SRC_TEMPORARY = 0x4,
	ZPROP_SRC_LOCAL = 0x8,
	ZPROP_SRC_INHERITED = 0x10,
	ZPROP_SRC_RECEIVED = 0x20
	} zprop_source_t;

	#define ZPROP_SRC_ALL 0x3f

	#define ZPROP_SOURCE_VAL_RECVD "$recvd"
	#define ZPROP_N_MORE_ERRORS "N_MORE_ERRORS"

	/*
	* Dataset flag implemented as a special entry in the props zap object
	* indicating that the dataset has received properties on or after
	* SPA_VERSION_RECVD_PROPS. The first such receive blows away local properties
	* just as it did in earlier versions, and thereafter, local properties are
	* preserved.
	*/
	#define ZPROP_HAS_RECVD "$hasrecvd"

	typedef enum {
	ZPROP_ERR_NOCLEAR = 0x1, /* failure to clear existing props */
	ZPROP_ERR_NORESTORE = 0x2 /* failure to restore props on error */
	} zprop_errflags_t;

	typedef int (zprop_func)(int, void );

	/*
	* Properties to be set on the root file system of a new pool
	* are stuffed into their own nvlist, which is then included in
	* the properties nvlist with the pool properties.
	*/
	#define ZPOOL_ROOTFS_PROPS "root-props-nvl"

	/*
	* Length of 'written@' and 'written#'
	*/
	#define ZFS_WRITTEN_PROP_PREFIX_LEN 8

	/*
	* Dataset property functions shared between libzfs and kernel.
	*/
	const char *zfs_prop_default_string(zfs_prop_t);
	uint64_t zfs_prop_default_numeric(zfs_prop_t);
	boolean_t zfs_prop_readonly(zfs_prop_t);
	boolean_t zfs_prop_visible(zfs_prop_t prop);
	boolean_t zfs_prop_inheritable(zfs_prop_t);
	boolean_t zfs_prop_setonce(zfs_prop_t);
	boolean_t zfs_prop_encryption_key_param(zfs_prop_t);
	boolean_t zfs_prop_valid_keylocation(const char *, boolean_t);
	const char *zfs_prop_to_name(zfs_prop_t);
	zfs_prop_t zfs_name_to_prop(const char *);
	boolean_t zfs_prop_user(const char *);
	boolean_t zfs_prop_userquota(const char *);
	boolean_t zfs_prop_written(const char *);
	int zfs_prop_index_to_string(zfs_prop_t, uint64_t, const char **);
	int zfs_prop_string_to_index(zfs_prop_t, const char , uint64_t );
	uint64_t zfs_prop_random_value(zfs_prop_t, uint64_t seed);
	boolean_t zfs_prop_valid_for_type(int, zfs_type_t, boolean_t);

	/*
	* Pool property functions shared between libzfs and kernel.
	*/
	zpool_prop_t zpool_name_to_prop(const char *);
	const char *zpool_prop_to_name(zpool_prop_t);
	const char *zpool_prop_default_string(zpool_prop_t);
	uint64_t zpool_prop_default_numeric(zpool_prop_t);
	boolean_t zpool_prop_readonly(zpool_prop_t);
	boolean_t zpool_prop_setonce(zpool_prop_t);
	boolean_t zpool_prop_feature(const char *);
	boolean_t zpool_prop_unsupported(const char *);
	int zpool_prop_index_to_string(zpool_prop_t, uint64_t, const char **);
	int zpool_prop_string_to_index(zpool_prop_t, const char , uint64_t );
	uint64_t zpool_prop_random_value(zpool_prop_t, uint64_t seed);

	/*
	* Definitions for the Delegation.
	*/
	typedef enum {
	ZFS_DELEG_WHO_UNKNOWN = 0,
	ZFS_DELEG_USER = 'u',
	ZFS_DELEG_USER_SETS = 'U',
	ZFS_DELEG_GROUP = 'g',
	ZFS_DELEG_GROUP_SETS = 'G',
	ZFS_DELEG_EVERYONE = 'e',
	ZFS_DELEG_EVERYONE_SETS = 'E',
	ZFS_DELEG_CREATE = 'c',
	ZFS_DELEG_CREATE_SETS = 'C',
	ZFS_DELEG_NAMED_SET = 's',
	ZFS_DELEG_NAMED_SET_SETS = 'S'
	} zfs_deleg_who_type_t;

	typedef enum {
	ZFS_DELEG_NONE = 0,
	ZFS_DELEG_PERM_LOCAL = 1,
	ZFS_DELEG_PERM_DESCENDENT = 2,
	ZFS_DELEG_PERM_LOCALDESCENDENT = 3,
	ZFS_DELEG_PERM_CREATE = 4
	} zfs_deleg_inherit_t;

	#define ZFS_DELEG_PERM_UID "uid"
	#define ZFS_DELEG_PERM_GID "gid"
	#define ZFS_DELEG_PERM_GROUPS "groups"

	#define ZFS_MLSLABEL_DEFAULT "none"

	#define ZFS_SMB_ACL_SRC "src"
	#define ZFS_SMB_ACL_TARGET "target"

	typedef enum {
	ZFS_CANMOUNT_OFF = 0,
	ZFS_CANMOUNT_ON = 1,
	ZFS_CANMOUNT_NOAUTO = 2
	} zfs_canmount_type_t;

	typedef enum {
	ZFS_LOGBIAS_LATENCY = 0,
	ZFS_LOGBIAS_THROUGHPUT = 1
	} zfs_logbias_op_t;

	typedef enum zfs_share_op {
	ZFS_SHARE_NFS = 0,
	ZFS_UNSHARE_NFS = 1,
	ZFS_SHARE_SMB = 2,
	ZFS_UNSHARE_SMB = 3
	} zfs_share_op_t;

	typedef enum zfs_smb_acl_op {
	ZFS_SMB_ACL_ADD,
	ZFS_SMB_ACL_REMOVE,
	ZFS_SMB_ACL_RENAME,
	ZFS_SMB_ACL_PURGE
	} zfs_smb_acl_op_t;

	typedef enum zfs_cache_type {
	ZFS_CACHE_NONE = 0,
	ZFS_CACHE_METADATA = 1,
	ZFS_CACHE_ALL = 2
	} zfs_cache_type_t;

	typedef enum {
	ZFS_SYNC_STANDARD = 0,
	ZFS_SYNC_ALWAYS = 1,
	ZFS_SYNC_DISABLED = 2
	} zfs_sync_type_t;

	typedef enum {
	ZFS_XATTR_OFF = 0,
	ZFS_XATTR_DIR = 1,
	ZFS_XATTR_SA = 2
	} zfs_xattr_type_t;

	typedef enum {
	ZFS_DNSIZE_LEGACY = 0,
	ZFS_DNSIZE_AUTO = 1,
	ZFS_DNSIZE_1K = 1024,
	ZFS_DNSIZE_2K = 2048,
	ZFS_DNSIZE_4K = 4096,
	ZFS_DNSIZE_8K = 8192,
	ZFS_DNSIZE_16K = 16384
	} zfs_dnsize_type_t;

	typedef enum {
	ZFS_REDUNDANT_METADATA_ALL,
	ZFS_REDUNDANT_METADATA_MOST
	} zfs_redundant_metadata_type_t;

	typedef enum {
	ZFS_VOLMODE_DEFAULT = 0,
	ZFS_VOLMODE_GEOM = 1,
	ZFS_VOLMODE_DEV = 2,
	ZFS_VOLMODE_NONE = 3
	} zfs_volmode_t;

	typedef enum zfs_keystatus {
	ZFS_KEYSTATUS_NONE = 0,
	ZFS_KEYSTATUS_UNAVAILABLE,
	ZFS_KEYSTATUS_AVAILABLE,
	} zfs_keystatus_t;

	typedef enum zfs_keyformat {
	ZFS_KEYFORMAT_NONE = 0,
	ZFS_KEYFORMAT_RAW,
	ZFS_KEYFORMAT_HEX,
	ZFS_KEYFORMAT_PASSPHRASE,
	ZFS_KEYFORMAT_FORMATS
	} zfs_keyformat_t;

	typedef enum zfs_key_location {
	ZFS_KEYLOCATION_NONE = 0,
	ZFS_KEYLOCATION_PROMPT,
	ZFS_KEYLOCATION_URI,
	ZFS_KEYLOCATION_LOCATIONS
	} zfs_keylocation_t;

	#define DEFAULT_PBKDF2_ITERATIONS 350000
	#define MIN_PBKDF2_ITERATIONS 100000

	/*
	* On-disk version number.
	*/
	#define SPA_VERSION_1 1ULL
	#define SPA_VERSION_2 2ULL
	#define SPA_VERSION_3 3ULL
	#define SPA_VERSION_4 4ULL
	#define SPA_VERSION_5 5ULL
	#define SPA_VERSION_6 6ULL
	#define SPA_VERSION_7 7ULL
	#define SPA_VERSION_8 8ULL
	#define SPA_VERSION_9 9ULL
	#define SPA_VERSION_10 10ULL
	#define SPA_VERSION_11 11ULL
	#define SPA_VERSION_12 12ULL
	#define SPA_VERSION_13 13ULL
	#define SPA_VERSION_14 14ULL
	#define SPA_VERSION_15 15ULL
	#define SPA_VERSION_16 16ULL
	#define SPA_VERSION_17 17ULL
	#define SPA_VERSION_18 18ULL
	#define SPA_VERSION_19 19ULL
	#define SPA_VERSION_20 20ULL
	#define SPA_VERSION_21 21ULL
	#define SPA_VERSION_22 22ULL
	#define SPA_VERSION_23 23ULL
	#define SPA_VERSION_24 24ULL
	#define SPA_VERSION_25 25ULL
	#define SPA_VERSION_26 26ULL
	#define SPA_VERSION_27 27ULL
	#define SPA_VERSION_28 28ULL
	#define SPA_VERSION_5000 5000ULL

	/*
	* The incrementing pool version number has been replaced by pool feature
	* flags. For more details, see zfeature.c.
	*/
	#define SPA_VERSION SPA_VERSION_5000
	#define SPA_VERSION_STRING "5000"

	/*
	* Symbolic names for the changes that caused a SPA_VERSION switch.
	* Used in the code when checking for presence or absence of a feature.
	* Feel free to define multiple symbolic names for each version if there
	* were multiple changes to on-disk structures during that version.
	*
	* NOTE: When checking the current SPA_VERSION in your code, be sure
	* to use spa_version() since it reports the version of the
	* last synced uberblock. Checking the in-flight version can
	* be dangerous in some cases.
	*/
	#define SPA_VERSION_INITIAL SPA_VERSION_1
	#define SPA_VERSION_DITTO_BLOCKS SPA_VERSION_2
	#define SPA_VERSION_SPARES SPA_VERSION_3
	#define SPA_VERSION_RAIDZ2 SPA_VERSION_3
	#define SPA_VERSION_BPOBJ_ACCOUNT SPA_VERSION_3
	#define SPA_VERSION_RAIDZ_DEFLATE SPA_VERSION_3
	#define SPA_VERSION_DNODE_BYTES SPA_VERSION_3
	#define SPA_VERSION_ZPOOL_HISTORY SPA_VERSION_4
	#define SPA_VERSION_GZIP_COMPRESSION SPA_VERSION_5
	#define SPA_VERSION_BOOTFS SPA_VERSION_6
	#define SPA_VERSION_SLOGS SPA_VERSION_7
	#define SPA_VERSION_DELEGATED_PERMS SPA_VERSION_8
	#define SPA_VERSION_FUID SPA_VERSION_9
	#define SPA_VERSION_REFRESERVATION SPA_VERSION_9
	#define SPA_VERSION_REFQUOTA SPA_VERSION_9
	#define SPA_VERSION_UNIQUE_ACCURATE SPA_VERSION_9
	#define SPA_VERSION_L2CACHE SPA_VERSION_10
	#define SPA_VERSION_NEXT_CLONES SPA_VERSION_11
	#define SPA_VERSION_ORIGIN SPA_VERSION_11
	#define SPA_VERSION_DSL_SCRUB SPA_VERSION_11
	#define SPA_VERSION_SNAP_PROPS SPA_VERSION_12
	#define SPA_VERSION_USED_BREAKDOWN SPA_VERSION_13
	#define SPA_VERSION_PASSTHROUGH_X SPA_VERSION_14
	#define SPA_VERSION_USERSPACE SPA_VERSION_15
	#define SPA_VERSION_STMF_PROP SPA_VERSION_16
	#define SPA_VERSION_RAIDZ3 SPA_VERSION_17
	#define SPA_VERSION_USERREFS SPA_VERSION_18
	#define SPA_VERSION_HOLES SPA_VERSION_19
	#define SPA_VERSION_ZLE_COMPRESSION SPA_VERSION_20
	#define SPA_VERSION_DEDUP SPA_VERSION_21
	#define SPA_VERSION_RECVD_PROPS SPA_VERSION_22
	#define SPA_VERSION_SLIM_ZIL SPA_VERSION_23
	#define SPA_VERSION_SA SPA_VERSION_24
	#define SPA_VERSION_SCAN SPA_VERSION_25
	#define SPA_VERSION_DIR_CLONES SPA_VERSION_26
	#define SPA_VERSION_DEADLISTS SPA_VERSION_26
	#define SPA_VERSION_FAST_SNAP SPA_VERSION_27
	#define SPA_VERSION_MULTI_REPLACE SPA_VERSION_28
	#define SPA_VERSION_BEFORE_FEATURES SPA_VERSION_28
	#define SPA_VERSION_FEATURES SPA_VERSION_5000

	#define SPA_VERSION_IS_SUPPORTED(v) \
	(((v) >= SPA_VERSION_INITIAL && (v) <= SPA_VERSION_BEFORE_FEATURES) \|\| \
	((v) >= SPA_VERSION_FEATURES && (v) <= SPA_VERSION))

	/*
	* ZPL version - rev'd whenever an incompatible on-disk format change
	* occurs. This is independent of SPA/DMU/ZAP versioning. You must
	* also update the version_table[] and help message in zfs_prop.c.
	*/
	#define ZPL_VERSION_1 1ULL
	#define ZPL_VERSION_2 2ULL
	#define ZPL_VERSION_3 3ULL
	#define ZPL_VERSION_4 4ULL
	#define ZPL_VERSION_5 5ULL
	#define ZPL_VERSION ZPL_VERSION_5
	#define ZPL_VERSION_STRING "5"

	#define ZPL_VERSION_INITIAL ZPL_VERSION_1
	#define ZPL_VERSION_DIRENT_TYPE ZPL_VERSION_2
	#define ZPL_VERSION_FUID ZPL_VERSION_3
	#define ZPL_VERSION_NORMALIZATION ZPL_VERSION_3
	#define ZPL_VERSION_SYSATTR ZPL_VERSION_3
	#define ZPL_VERSION_USERSPACE ZPL_VERSION_4
	#define ZPL_VERSION_SA ZPL_VERSION_5

	/* Persistent L2ARC version */
	#define L2ARC_PERSISTENT_VERSION_1 1ULL
	#define L2ARC_PERSISTENT_VERSION L2ARC_PERSISTENT_VERSION_1
	#define L2ARC_PERSISTENT_VERSION_STRING "1"

	/* Rewind policy information */
	#define ZPOOL_NO_REWIND 1 /* No policy - default behavior */
	#define ZPOOL_NEVER_REWIND 2 /* Do not search for best txg or rewind */
	#define ZPOOL_TRY_REWIND 4 /* Search for best txg, but do not rewind */
	#define ZPOOL_DO_REWIND 8 /* Rewind to best txg w/in deferred frees */
	#define ZPOOL_EXTREME_REWIND 16 /* Allow extreme measures to find best txg */
	#define ZPOOL_REWIND_MASK 28 /* All the possible rewind bits */
	#define ZPOOL_REWIND_POLICIES 31 /* All the possible policy bits */

	typedef struct zpool_load_policy {
	uint32_t zlp_rewind; /* rewind policy requested */
	uint64_t zlp_maxmeta; /* max acceptable meta-data errors */
	uint64_t zlp_maxdata; /* max acceptable data errors */
	uint64_t zlp_txg; /* specific txg to load */
	} zpool_load_policy_t;

	/*
	* The following are configuration names used in the nvlist describing a pool's
	* configuration. New on-disk names should be prefixed with "<reversed-DNS>:"
	* (e.g. "org.openzfs:") to avoid conflicting names being developed
	* independently.
	*/
	#define ZPOOL_CONFIG_VERSION "version"
	#define ZPOOL_CONFIG_POOL_NAME "name"
	#define ZPOOL_CONFIG_POOL_STATE "state"
	#define ZPOOL_CONFIG_POOL_TXG "txg"
	#define ZPOOL_CONFIG_POOL_GUID "pool_guid"
	#define ZPOOL_CONFIG_CREATE_TXG "create_txg"
	#define ZPOOL_CONFIG_TOP_GUID "top_guid"
	#define ZPOOL_CONFIG_VDEV_TREE "vdev_tree"
	#define ZPOOL_CONFIG_TYPE "type"
	#define ZPOOL_CONFIG_CHILDREN "children"
	#define ZPOOL_CONFIG_ID "id"
	#define ZPOOL_CONFIG_GUID "guid"
	#define ZPOOL_CONFIG_INDIRECT_OBJECT "com.delphix:indirect_object"
	#define ZPOOL_CONFIG_INDIRECT_BIRTHS "com.delphix:indirect_births"
	#define ZPOOL_CONFIG_PREV_INDIRECT_VDEV "com.delphix:prev_indirect_vdev"
	#define ZPOOL_CONFIG_PATH "path"
	#define ZPOOL_CONFIG_DEVID "devid"
	#define ZPOOL_CONFIG_METASLAB_ARRAY "metaslab_array"
	#define ZPOOL_CONFIG_METASLAB_SHIFT "metaslab_shift"
	#define ZPOOL_CONFIG_ASHIFT "ashift"
	#define ZPOOL_CONFIG_ASIZE "asize"
	#define ZPOOL_CONFIG_DTL "DTL"
	#define ZPOOL_CONFIG_SCAN_STATS "scan_stats" /* not stored on disk */
	#define ZPOOL_CONFIG_REMOVAL_STATS "removal_stats" /* not stored on disk */
	#define ZPOOL_CONFIG_CHECKPOINT_STATS "checkpoint_stats" /* not on disk */
	#define ZPOOL_CONFIG_VDEV_STATS "vdev_stats" /* not stored on disk */
	#define ZPOOL_CONFIG_INDIRECT_SIZE "indirect_size" /* not stored on disk */

	/* container nvlist of extended stats */
	#define ZPOOL_CONFIG_VDEV_STATS_EX "vdev_stats_ex"

	/* Active queue read/write stats */
	#define ZPOOL_CONFIG_VDEV_SYNC_R_ACTIVE_QUEUE "vdev_sync_r_active_queue"
	#define ZPOOL_CONFIG_VDEV_SYNC_W_ACTIVE_QUEUE "vdev_sync_w_active_queue"
	#define ZPOOL_CONFIG_VDEV_ASYNC_R_ACTIVE_QUEUE "vdev_async_r_active_queue"
	#define ZPOOL_CONFIG_VDEV_ASYNC_W_ACTIVE_QUEUE "vdev_async_w_active_queue"
	#define ZPOOL_CONFIG_VDEV_SCRUB_ACTIVE_QUEUE "vdev_async_scrub_active_queue"
	#define ZPOOL_CONFIG_VDEV_TRIM_ACTIVE_QUEUE "vdev_async_trim_active_queue"

	/* Queue sizes */
	#define ZPOOL_CONFIG_VDEV_SYNC_R_PEND_QUEUE "vdev_sync_r_pend_queue"
	#define ZPOOL_CONFIG_VDEV_SYNC_W_PEND_QUEUE "vdev_sync_w_pend_queue"
	#define ZPOOL_CONFIG_VDEV_ASYNC_R_PEND_QUEUE "vdev_async_r_pend_queue"
	#define ZPOOL_CONFIG_VDEV_ASYNC_W_PEND_QUEUE "vdev_async_w_pend_queue"
	#define ZPOOL_CONFIG_VDEV_SCRUB_PEND_QUEUE "vdev_async_scrub_pend_queue"
	#define ZPOOL_CONFIG_VDEV_TRIM_PEND_QUEUE "vdev_async_trim_pend_queue"

	/* Latency read/write histogram stats */
	#define ZPOOL_CONFIG_VDEV_TOT_R_LAT_HISTO "vdev_tot_r_lat_histo"
	#define ZPOOL_CONFIG_VDEV_TOT_W_LAT_HISTO "vdev_tot_w_lat_histo"
	#define ZPOOL_CONFIG_VDEV_DISK_R_LAT_HISTO "vdev_disk_r_lat_histo"
	#define ZPOOL_CONFIG_VDEV_DISK_W_LAT_HISTO "vdev_disk_w_lat_histo"
	#define ZPOOL_CONFIG_VDEV_SYNC_R_LAT_HISTO "vdev_sync_r_lat_histo"
	#define ZPOOL_CONFIG_VDEV_SYNC_W_LAT_HISTO "vdev_sync_w_lat_histo"
	#define ZPOOL_CONFIG_VDEV_ASYNC_R_LAT_HISTO "vdev_async_r_lat_histo"
	#define ZPOOL_CONFIG_VDEV_ASYNC_W_LAT_HISTO "vdev_async_w_lat_histo"
	#define ZPOOL_CONFIG_VDEV_SCRUB_LAT_HISTO "vdev_scrub_histo"
	#define ZPOOL_CONFIG_VDEV_TRIM_LAT_HISTO "vdev_trim_histo"

	/* Request size histograms */
	#define ZPOOL_CONFIG_VDEV_SYNC_IND_R_HISTO "vdev_sync_ind_r_histo"
	#define ZPOOL_CONFIG_VDEV_SYNC_IND_W_HISTO "vdev_sync_ind_w_histo"
	#define ZPOOL_CONFIG_VDEV_ASYNC_IND_R_HISTO "vdev_async_ind_r_histo"
	#define ZPOOL_CONFIG_VDEV_ASYNC_IND_W_HISTO "vdev_async_ind_w_histo"
	#define ZPOOL_CONFIG_VDEV_IND_SCRUB_HISTO "vdev_ind_scrub_histo"
	#define ZPOOL_CONFIG_VDEV_IND_TRIM_HISTO "vdev_ind_trim_histo"
	#define ZPOOL_CONFIG_VDEV_SYNC_AGG_R_HISTO "vdev_sync_agg_r_histo"
	#define ZPOOL_CONFIG_VDEV_SYNC_AGG_W_HISTO "vdev_sync_agg_w_histo"
	#define ZPOOL_CONFIG_VDEV_ASYNC_AGG_R_HISTO "vdev_async_agg_r_histo"
	#define ZPOOL_CONFIG_VDEV_ASYNC_AGG_W_HISTO "vdev_async_agg_w_histo"
	#define ZPOOL_CONFIG_VDEV_AGG_SCRUB_HISTO "vdev_agg_scrub_histo"
	#define ZPOOL_CONFIG_VDEV_AGG_TRIM_HISTO "vdev_agg_trim_histo"

	/* Number of slow IOs */
	#define ZPOOL_CONFIG_VDEV_SLOW_IOS "vdev_slow_ios"

	/* vdev enclosure sysfs path */
	#define ZPOOL_CONFIG_VDEV_ENC_SYSFS_PATH "vdev_enc_sysfs_path"

	#define ZPOOL_CONFIG_WHOLE_DISK "whole_disk"
	#define ZPOOL_CONFIG_ERRCOUNT "error_count"
	#define ZPOOL_CONFIG_NOT_PRESENT "not_present"
	#define ZPOOL_CONFIG_SPARES "spares"
	#define ZPOOL_CONFIG_IS_SPARE "is_spare"
	#define ZPOOL_CONFIG_NPARITY "nparity"
	#define ZPOOL_CONFIG_HOSTID "hostid"
	#define ZPOOL_CONFIG_HOSTNAME "hostname"
	#define ZPOOL_CONFIG_LOADED_TIME "initial_load_time"
	#define ZPOOL_CONFIG_UNSPARE "unspare"
	#define ZPOOL_CONFIG_PHYS_PATH "phys_path"
	#define ZPOOL_CONFIG_IS_LOG "is_log"
	#define ZPOOL_CONFIG_L2CACHE "l2cache"
	#define ZPOOL_CONFIG_HOLE_ARRAY "hole_array"
	#define ZPOOL_CONFIG_VDEV_CHILDREN "vdev_children"
	#define ZPOOL_CONFIG_IS_HOLE "is_hole"
	#define ZPOOL_CONFIG_DDT_HISTOGRAM "ddt_histogram"
	#define ZPOOL_CONFIG_DDT_OBJ_STATS "ddt_object_stats"
	#define ZPOOL_CONFIG_DDT_STATS "ddt_stats"
	#define ZPOOL_CONFIG_SPLIT "splitcfg"
	#define ZPOOL_CONFIG_ORIG_GUID "orig_guid"
	#define ZPOOL_CONFIG_SPLIT_GUID "split_guid"
	#define ZPOOL_CONFIG_SPLIT_LIST "guid_list"
	#define ZPOOL_CONFIG_REMOVING "removing"
	#define ZPOOL_CONFIG_RESILVER_TXG "resilver_txg"
	#define ZPOOL_CONFIG_REBUILD_TXG "rebuild_txg"
	#define ZPOOL_CONFIG_COMMENT "comment"
	#define ZPOOL_CONFIG_SUSPENDED "suspended" /* not stored on disk */
	#define ZPOOL_CONFIG_SUSPENDED_REASON "suspended_reason" /* not stored */
	#define ZPOOL_CONFIG_TIMESTAMP "timestamp" /* not stored on disk */
	#define ZPOOL_CONFIG_BOOTFS "bootfs" /* not stored on disk */
	#define ZPOOL_CONFIG_MISSING_DEVICES "missing_vdevs" /* not stored on disk */
	#define ZPOOL_CONFIG_LOAD_INFO "load_info" /* not stored on disk */
	#define ZPOOL_CONFIG_REWIND_INFO "rewind_info" /* not stored on disk */
	#define ZPOOL_CONFIG_UNSUP_FEAT "unsup_feat" /* not stored on disk */
	#define ZPOOL_CONFIG_ENABLED_FEAT "enabled_feat" /* not stored on disk */
	#define ZPOOL_CONFIG_CAN_RDONLY "can_rdonly" /* not stored on disk */
	#define ZPOOL_CONFIG_FEATURES_FOR_READ "features_for_read"
	#define ZPOOL_CONFIG_FEATURE_STATS "feature_stats" /* not stored on disk */
	#define ZPOOL_CONFIG_ERRATA "errata" /* not stored on disk */
	#define ZPOOL_CONFIG_VDEV_TOP_ZAP "com.delphix:vdev_zap_top"
	#define ZPOOL_CONFIG_VDEV_LEAF_ZAP "com.delphix:vdev_zap_leaf"
	#define ZPOOL_CONFIG_HAS_PER_VDEV_ZAPS "com.delphix:has_per_vdev_zaps"
	#define ZPOOL_CONFIG_RESILVER_DEFER "com.datto:resilver_defer"
	#define ZPOOL_CONFIG_CACHEFILE "cachefile" /* not stored on disk */
	#define ZPOOL_CONFIG_MMP_STATE "mmp_state" /* not stored on disk */
	#define ZPOOL_CONFIG_MMP_TXG "mmp_txg" /* not stored on disk */
	#define ZPOOL_CONFIG_MMP_SEQ "mmp_seq" /* not stored on disk */
	#define ZPOOL_CONFIG_MMP_HOSTNAME "mmp_hostname" /* not stored on disk */
	#define ZPOOL_CONFIG_MMP_HOSTID "mmp_hostid" /* not stored on disk */
	#define ZPOOL_CONFIG_ALLOCATION_BIAS "alloc_bias" /* not stored on disk */
	#define ZPOOL_CONFIG_EXPANSION_TIME "expansion_time" /* not stored */
	#define ZPOOL_CONFIG_REBUILD_STATS "org.openzfs:rebuild_stats"

	/*
	* The persistent vdev state is stored as separate values rather than a single
	* 'vdev_state' entry. This is because a device can be in multiple states, such
	* as offline and degraded.
	*/
	#define ZPOOL_CONFIG_OFFLINE "offline"
	#define ZPOOL_CONFIG_FAULTED "faulted"
	#define ZPOOL_CONFIG_DEGRADED "degraded"
	#define ZPOOL_CONFIG_REMOVED "removed"
	#define ZPOOL_CONFIG_FRU "fru"
	#define ZPOOL_CONFIG_AUX_STATE "aux_state"

	/* Pool load policy parameters */
	#define ZPOOL_LOAD_POLICY "load-policy"
	#define ZPOOL_LOAD_REWIND_POLICY "load-rewind-policy"
	#define ZPOOL_LOAD_REQUEST_TXG "load-request-txg"
	#define ZPOOL_LOAD_META_THRESH "load-meta-thresh"
	#define ZPOOL_LOAD_DATA_THRESH "load-data-thresh"

	/* Rewind data discovered */
	#define ZPOOL_CONFIG_LOAD_TIME "rewind_txg_ts"
	#define ZPOOL_CONFIG_LOAD_DATA_ERRORS "verify_data_errors"
	#define ZPOOL_CONFIG_REWIND_TIME "seconds_of_rewind"

	#define VDEV_TYPE_ROOT "root"
	#define VDEV_TYPE_MIRROR "mirror"
	#define VDEV_TYPE_REPLACING "replacing"
	#define VDEV_TYPE_RAIDZ "raidz"
	#define VDEV_TYPE_DISK "disk"
	#define VDEV_TYPE_FILE "file"
	#define VDEV_TYPE_MISSING "missing"
	#define VDEV_TYPE_HOLE "hole"
	#define VDEV_TYPE_SPARE "spare"
	#define VDEV_TYPE_LOG "log"
	#define VDEV_TYPE_L2CACHE "l2cache"
	#define VDEV_TYPE_INDIRECT "indirect"

	/* VDEV_TOP_ZAP_* are used in top-level vdev ZAP objects. */
	#define VDEV_TOP_ZAP_INDIRECT_OBSOLETE_SM \
	"com.delphix:indirect_obsolete_sm"
	#define VDEV_TOP_ZAP_OBSOLETE_COUNTS_ARE_PRECISE \
	"com.delphix:obsolete_counts_are_precise"
	#define VDEV_TOP_ZAP_POOL_CHECKPOINT_SM \
	"com.delphix:pool_checkpoint_sm"
	#define VDEV_TOP_ZAP_MS_UNFLUSHED_PHYS_TXGS \
	"com.delphix:ms_unflushed_phys_txgs"

	#define VDEV_TOP_ZAP_VDEV_REBUILD_PHYS \
	"org.openzfs:vdev_rebuild"

	#define VDEV_TOP_ZAP_ALLOCATION_BIAS \
	"org.zfsonlinux:allocation_bias"

	/* vdev metaslab allocation bias */
	#define VDEV_ALLOC_BIAS_LOG "log"
	#define VDEV_ALLOC_BIAS_SPECIAL "special"
	#define VDEV_ALLOC_BIAS_DEDUP "dedup"

	/* vdev initialize state */
	#define VDEV_LEAF_ZAP_INITIALIZE_LAST_OFFSET \
	"com.delphix:next_offset_to_initialize"
	#define VDEV_LEAF_ZAP_INITIALIZE_STATE \
	"com.delphix:vdev_initialize_state"
	#define VDEV_LEAF_ZAP_INITIALIZE_ACTION_TIME \
	"com.delphix:vdev_initialize_action_time"

	/* vdev TRIM state */
	#define VDEV_LEAF_ZAP_TRIM_LAST_OFFSET \
	"org.zfsonlinux:next_offset_to_trim"
	#define VDEV_LEAF_ZAP_TRIM_STATE \
	"org.zfsonlinux:vdev_trim_state"
	#define VDEV_LEAF_ZAP_TRIM_ACTION_TIME \
	"org.zfsonlinux:vdev_trim_action_time"
	#define VDEV_LEAF_ZAP_TRIM_RATE \
	"org.zfsonlinux:vdev_trim_rate"
	#define VDEV_LEAF_ZAP_TRIM_PARTIAL \
	"org.zfsonlinux:vdev_trim_partial"
	#define VDEV_LEAF_ZAP_TRIM_SECURE \
	"org.zfsonlinux:vdev_trim_secure"

	/*
	* This is needed in userland to report the minimum necessary device size.
	*/
	#define SPA_MINDEVSIZE (64ULL << 20)

	/*
	* Set if the fragmentation has not yet been calculated. This can happen
	* because the space maps have not been upgraded or the histogram feature
	* is not enabled.
	*/
	#define ZFS_FRAG_INVALID UINT64_MAX

	/*
	* The location of the pool configuration repository, shared between kernel and
	* userland.
	*/
	#define ZPOOL_CACHE_BOOT "/boot/zfs/zpool.cache"
	#define ZPOOL_CACHE "/etc/zfs/zpool.cache"
	/*
	* vdev states are ordered from least to most healthy.
	* A vdev that's CANT_OPEN or below is considered unusable.
	*/
	typedef enum vdev_state {
	VDEV_STATE_UNKNOWN = 0, /* Uninitialized vdev */
	VDEV_STATE_CLOSED, /* Not currently open */
	VDEV_STATE_OFFLINE, /* Not allowed to open */
	VDEV_STATE_REMOVED, /* Explicitly removed from system */
	VDEV_STATE_CANT_OPEN, /* Tried to open, but failed */
	VDEV_STATE_FAULTED, /* External request to fault device */
	VDEV_STATE_DEGRADED, /* Replicated vdev with unhealthy kids */
	VDEV_STATE_HEALTHY /* Presumed good */
	} vdev_state_t;

	#define VDEV_STATE_ONLINE VDEV_STATE_HEALTHY

	/*
	* vdev aux states. When a vdev is in the CANT_OPEN state, the aux field
	* of the vdev stats structure uses these constants to distinguish why.
	*/
	typedef enum vdev_aux {
	VDEV_AUX_NONE, /* no error */
	VDEV_AUX_OPEN_FAILED, /* ldi_open_() or vn_open() failed /
	VDEV_AUX_CORRUPT_DATA, /* bad label or disk contents */
	VDEV_AUX_NO_REPLICAS, /* insufficient number of replicas */
	VDEV_AUX_BAD_GUID_SUM, /* vdev guid sum doesn't match */
	VDEV_AUX_TOO_SMALL, /* vdev size is too small */
	VDEV_AUX_BAD_LABEL, /* the label is OK but invalid */
	VDEV_AUX_VERSION_NEWER, /* on-disk version is too new */
	VDEV_AUX_VERSION_OLDER, /* on-disk version is too old */
	VDEV_AUX_UNSUP_FEAT, /* unsupported features */
	VDEV_AUX_SPARED, /* hot spare used in another pool */
	VDEV_AUX_ERR_EXCEEDED, /* too many errors */
	VDEV_AUX_IO_FAILURE, /* experienced I/O failure */
	VDEV_AUX_BAD_LOG, /* cannot read log chain(s) */
	VDEV_AUX_EXTERNAL, /* external diagnosis or forced fault */
	VDEV_AUX_SPLIT_POOL, /* vdev was split off into another pool */
	VDEV_AUX_BAD_ASHIFT, /* vdev ashift is invalid */
	VDEV_AUX_EXTERNAL_PERSIST, /* persistent forced fault */
	VDEV_AUX_ACTIVE, /* vdev active on a different host */
	VDEV_AUX_CHILDREN_OFFLINE, /* all children are offline */
	VDEV_AUX_ASHIFT_TOO_BIG, /* vdev's min block size is too large */
	} vdev_aux_t;

	/*
	* pool state. The following states are written to disk as part of the normal
	* SPA lifecycle: ACTIVE, EXPORTED, DESTROYED, SPARE, L2CACHE. The remaining
	* states are software abstractions used at various levels to communicate
	* pool state.
	*/
	typedef enum pool_state {
	POOL_STATE_ACTIVE = 0, /* In active use */
	POOL_STATE_EXPORTED, /* Explicitly exported */
	POOL_STATE_DESTROYED, /* Explicitly destroyed */
	POOL_STATE_SPARE, /* Reserved for hot spare use */
	POOL_STATE_L2CACHE, /* Level 2 ARC device */
	POOL_STATE_UNINITIALIZED, /* Internal spa_t state */
	POOL_STATE_UNAVAIL, /* Internal libzfs state */
	POOL_STATE_POTENTIALLY_ACTIVE /* Internal libzfs state */
	} pool_state_t;

	/*
	* mmp state. The following states provide additional detail describing
	* why a pool couldn't be safely imported.
	*/
	typedef enum mmp_state {
	MMP_STATE_ACTIVE = 0, /* In active use */
	MMP_STATE_INACTIVE, /* Inactive and safe to import */
	MMP_STATE_NO_HOSTID /* System hostid is not set */
	} mmp_state_t;

	/*
	* Scan Functions.
	*/
	typedef enum pool_scan_func {
	POOL_SCAN_NONE,
	POOL_SCAN_SCRUB,
	POOL_SCAN_RESILVER,
	POOL_SCAN_FUNCS
	} pool_scan_func_t;

	/*
	* Used to control scrub pause and resume.
	*/
	typedef enum pool_scrub_cmd {
	POOL_SCRUB_NORMAL = 0,
	POOL_SCRUB_PAUSE,
	POOL_SCRUB_FLAGS_END
	} pool_scrub_cmd_t;

	typedef enum {
	CS_NONE,
	CS_CHECKPOINT_EXISTS,
	CS_CHECKPOINT_DISCARDING,
	CS_NUM_STATES
	} checkpoint_state_t;

	typedef struct pool_checkpoint_stat {
	uint64_t pcs_state; /* checkpoint_state_t */
	uint64_t pcs_start_time; /* time checkpoint/discard started */
	uint64_t pcs_space; /* checkpointed space */
	} pool_checkpoint_stat_t;

	/*
	* ZIO types. Needed to interpret vdev statistics below.
	*/
	typedef enum zio_type {
	ZIO_TYPE_NULL = 0,
	ZIO_TYPE_READ,
	ZIO_TYPE_WRITE,
	ZIO_TYPE_FREE,
	ZIO_TYPE_CLAIM,
	ZIO_TYPE_IOCTL,
	ZIO_TYPE_TRIM,
	ZIO_TYPES
	} zio_type_t;

	/*
	* Pool statistics. Note: all fields should be 64-bit because this
	* is passed between kernel and userland as an nvlist uint64 array.
	*/
	typedef struct pool_scan_stat {
	/* values stored on disk */
	uint64_t pss_func; /* pool_scan_func_t */
	uint64_t pss_state; /* dsl_scan_state_t */
	uint64_t pss_start_time; /* scan start time */
	uint64_t pss_end_time; /* scan end time */
	uint64_t pss_to_examine; /* total bytes to scan */
	uint64_t pss_examined; /* total bytes located by scanner */
	uint64_t pss_to_process; /* total bytes to process */
	uint64_t pss_processed; /* total processed bytes */
	uint64_t pss_errors; /* scan errors */

	/* values not stored on disk */
	uint64_t pss_pass_exam; /* examined bytes per scan pass */
	uint64_t pss_pass_start; /* start time of a scan pass */
	uint64_t pss_pass_scrub_pause; /* pause time of a scrub pass */
	/* cumulative time scrub spent paused, needed for rate calculation */
	uint64_t pss_pass_scrub_spent_paused;
	uint64_t pss_pass_issued; /* issued bytes per scan pass */
	uint64_t pss_issued; /* total bytes checked by scanner */
	} pool_scan_stat_t;

	typedef struct pool_removal_stat {
	uint64_t prs_state; /* dsl_scan_state_t */
	uint64_t prs_removing_vdev;
	uint64_t prs_start_time;
	uint64_t prs_end_time;
	uint64_t prs_to_copy; /* bytes that need to be copied */
	uint64_t prs_copied; /* bytes copied so far */
	/*
	* bytes of memory used for indirect mappings.
	* This includes all removed vdevs.
	*/
	uint64_t prs_mapping_memory;
	} pool_removal_stat_t;

	typedef enum dsl_scan_state {
	DSS_NONE,
	DSS_SCANNING,
	DSS_FINISHED,
	DSS_CANCELED,
	DSS_NUM_STATES
	} dsl_scan_state_t;

	typedef struct vdev_rebuild_stat {
	uint64_t vrs_state; /* vdev_rebuild_state_t */
	uint64_t vrs_start_time; /* time_t */
	uint64_t vrs_end_time; /* time_t */
	uint64_t vrs_scan_time_ms; /* total run time (millisecs) */
	uint64_t vrs_bytes_scanned; /* allocated bytes scanned */
	uint64_t vrs_bytes_issued; /* read bytes issued */
	uint64_t vrs_bytes_rebuilt; /* rebuilt bytes */
	uint64_t vrs_bytes_est; /* total bytes to scan */
	uint64_t vrs_errors; /* scanning errors */
	uint64_t vrs_pass_time_ms; /* pass run time (millisecs) */
	uint64_t vrs_pass_bytes_scanned; /* bytes scanned since start/resume */
	uint64_t vrs_pass_bytes_issued; /* bytes rebuilt since start/resume */
	} vdev_rebuild_stat_t;

	/*
	* Errata described by https://openzfs.github.io/openzfs-docs/msg/ZFS-8000-ER.
	* The ordering of this enum must be maintained to ensure the errata identifiers
	* map to the correct documentation. New errata may only be appended to the
	* list and must contain corresponding documentation at the above link.
	*/
	typedef enum zpool_errata {
	ZPOOL_ERRATA_NONE,
	ZPOOL_ERRATA_ZOL_2094_SCRUB,
	ZPOOL_ERRATA_ZOL_2094_ASYNC_DESTROY,
	ZPOOL_ERRATA_ZOL_6845_ENCRYPTION,
	ZPOOL_ERRATA_ZOL_8308_ENCRYPTION,
	} zpool_errata_t;

	/*
	* Vdev statistics. Note: all fields should be 64-bit because this
	* is passed between kernel and user land as an nvlist uint64 array.
	*
	* The vs_ops[] and vs_bytes[] arrays must always be an array size of 6 in
	* order to keep subsequent members at their known fixed offsets. When
	* adding a new field it must be added to the end the structure.
	*/
	#define VS_ZIO_TYPES 6

	typedef struct vdev_stat {
	hrtime_t vs_timestamp; /* time since vdev load */
	uint64_t vs_state; /* vdev state */
	uint64_t vs_aux; /* see vdev_aux_t */
	uint64_t vs_alloc; /* space allocated */
	uint64_t vs_space; /* total capacity */
	uint64_t vs_dspace; /* deflated capacity */
	uint64_t vs_rsize; /* replaceable dev size */
	uint64_t vs_esize; /* expandable dev size */
	uint64_t vs_ops[VS_ZIO_TYPES]; /* operation count */
	uint64_t vs_bytes[VS_ZIO_TYPES]; /* bytes read/written */
	uint64_t vs_read_errors; /* read errors */
	uint64_t vs_write_errors; /* write errors */
	uint64_t vs_checksum_errors; /* checksum errors */
	uint64_t vs_initialize_errors; /* initializing errors */
	uint64_t vs_self_healed; /* self-healed bytes */
	uint64_t vs_scan_removing; /* removing? */
	uint64_t vs_scan_processed; /* scan processed bytes */
	uint64_t vs_fragmentation; /* device fragmentation */
	uint64_t vs_initialize_bytes_done; /* bytes initialized */
	uint64_t vs_initialize_bytes_est; /* total bytes to initialize */
	uint64_t vs_initialize_state; /* vdev_initializing_state_t */
	uint64_t vs_initialize_action_time; /* time_t */
	uint64_t vs_checkpoint_space; /* checkpoint-consumed space */
	uint64_t vs_resilver_deferred; /* resilver deferred */
	uint64_t vs_slow_ios; /* slow IOs */
	uint64_t vs_trim_errors; /* trimming errors */
	uint64_t vs_trim_notsup; /* supported by device */
	uint64_t vs_trim_bytes_done; /* bytes trimmed */
	uint64_t vs_trim_bytes_est; /* total bytes to trim */
	uint64_t vs_trim_state; /* vdev_trim_state_t */
	uint64_t vs_trim_action_time; /* time_t */
	uint64_t vs_rebuild_processed; /* bytes rebuilt */
	uint64_t vs_configured_ashift; /* TLV vdev_ashift */
	uint64_t vs_logical_ashift; /* vdev_logical_ashift */
	uint64_t vs_physical_ashift; /* vdev_physical_ashift */
	} vdev_stat_t;

	/* BEGIN CSTYLED */
	#define VDEV_STAT_VALID(field, uint64_t_field_count) \
	((uint64_t_field_count * sizeof (uint64_t)) >= \
	(offsetof(vdev_stat_t, field) + sizeof (((vdev_stat_t *)NULL)->field)))
	/* END CSTYLED */

	/*
	* Extended stats
	*
	* These are stats which aren't included in the original iostat output. For
	* convenience, they are grouped together in vdev_stat_ex, although each stat
	* is individually exported as an nvlist.
	*/
	typedef struct vdev_stat_ex {
	/* Number of ZIOs issued to disk and waiting to finish */
	uint64_t vsx_active_queue[ZIO_PRIORITY_NUM_QUEUEABLE];

	/* Number of ZIOs pending to be issued to disk */
	uint64_t vsx_pend_queue[ZIO_PRIORITY_NUM_QUEUEABLE];

	/*
	* Below are the histograms for various latencies. Buckets are in
	* units of nanoseconds.
	*/

	/*
	* 2^37 nanoseconds = 134s. Timeouts will probably start kicking in
	* before this.
	*/
	#define VDEV_L_HISTO_BUCKETS 37 /* Latency histo buckets */
	#define VDEV_RQ_HISTO_BUCKETS 25 /* Request size histo buckets */

	/* Amount of time in ZIO queue (ns) */
	uint64_t vsx_queue_histo[ZIO_PRIORITY_NUM_QUEUEABLE]
	[VDEV_L_HISTO_BUCKETS];

	/* Total ZIO latency (ns). Includes queuing and disk access time */
	uint64_t vsx_total_histo[ZIO_TYPES][VDEV_L_HISTO_BUCKETS];

	/* Amount of time to read/write the disk (ns) */
	uint64_t vsx_disk_histo[ZIO_TYPES][VDEV_L_HISTO_BUCKETS];

	/* "lookup the bucket for a value" histogram macros */
	#define HISTO(val, buckets) (val != 0 ? MIN(highbit64(val) - 1, \
	buckets - 1) : 0)
	#define L_HISTO(a) HISTO(a, VDEV_L_HISTO_BUCKETS)
	#define RQ_HISTO(a) HISTO(a, VDEV_RQ_HISTO_BUCKETS)

	/* Physical IO histogram */
	uint64_t vsx_ind_histo[ZIO_PRIORITY_NUM_QUEUEABLE]
	[VDEV_RQ_HISTO_BUCKETS];

	/* Delegated (aggregated) physical IO histogram */
	uint64_t vsx_agg_histo[ZIO_PRIORITY_NUM_QUEUEABLE]
	[VDEV_RQ_HISTO_BUCKETS];

	} vdev_stat_ex_t;

	/*
	* Initialize functions.
	*/
	typedef enum pool_initialize_func {
	POOL_INITIALIZE_START,
	POOL_INITIALIZE_CANCEL,
	POOL_INITIALIZE_SUSPEND,
	POOL_INITIALIZE_FUNCS
	} pool_initialize_func_t;

	/*
	* TRIM functions.
	*/
	typedef enum pool_trim_func {
	POOL_TRIM_START,
	POOL_TRIM_CANCEL,
	POOL_TRIM_SUSPEND,
	POOL_TRIM_FUNCS
	} pool_trim_func_t;

	/*
	* DDT statistics. Note: all fields should be 64-bit because this
	* is passed between kernel and userland as an nvlist uint64 array.
	*/
	typedef struct ddt_object {
	uint64_t ddo_count; /* number of elements in ddt */
	uint64_t ddo_dspace; /* size of ddt on disk */
	uint64_t ddo_mspace; /* size of ddt in-core */
	} ddt_object_t;

	typedef struct ddt_stat {
	uint64_t dds_blocks; /* blocks */
	uint64_t dds_lsize; /* logical size */
	uint64_t dds_psize; /* physical size */
	uint64_t dds_dsize; /* deflated allocated size */
	uint64_t dds_ref_blocks; /* referenced blocks */
	uint64_t dds_ref_lsize; /* referenced lsize * refcnt */
	uint64_t dds_ref_psize; /* referenced psize * refcnt */
	uint64_t dds_ref_dsize; /* referenced dsize * refcnt */
	} ddt_stat_t;

	typedef struct ddt_histogram {
	ddt_stat_t ddh_stat[64]; /* power-of-two histogram buckets */
	} ddt_histogram_t;

	#define ZVOL_DRIVER "zvol"
	#define ZFS_DRIVER "zfs"
	#define ZFS_DEV "/dev/zfs"

	#define ZFS_SUPER_MAGIC 0x2fc12fc1

	/* general zvol path */
	#define ZVOL_DIR "/dev/zvol/"

	#define ZVOL_MAJOR 230
	#define ZVOL_MINOR_BITS 4
	#define ZVOL_MINOR_MASK ((1U << ZVOL_MINOR_BITS) - 1)
	#define ZVOL_MINORS (1 << 4)
	#define ZVOL_DEV_NAME "zd"

	#define ZVOL_PROP_NAME "name"
	#define ZVOL_DEFAULT_BLOCKSIZE 8192

	typedef enum {
	VDEV_INITIALIZE_NONE,
	VDEV_INITIALIZE_ACTIVE,
	VDEV_INITIALIZE_CANCELED,
	VDEV_INITIALIZE_SUSPENDED,
	VDEV_INITIALIZE_COMPLETE
	} vdev_initializing_state_t;

	typedef enum {
	VDEV_TRIM_NONE,
	VDEV_TRIM_ACTIVE,
	VDEV_TRIM_CANCELED,
	VDEV_TRIM_SUSPENDED,
	VDEV_TRIM_COMPLETE,
	} vdev_trim_state_t;

	typedef enum {
	VDEV_REBUILD_NONE,
	VDEV_REBUILD_ACTIVE,
	VDEV_REBUILD_CANCELED,
	VDEV_REBUILD_COMPLETE,
	} vdev_rebuild_state_t;

	/*
	* nvlist name constants. Facilitate restricting snapshot iteration range for
	* the "list next snapshot" ioctl
	*/
	#define SNAP_ITER_MIN_TXG "snap_iter_min_txg"
	#define SNAP_ITER_MAX_TXG "snap_iter_max_txg"

	/*
	* /dev/zfs ioctl numbers.
	*
	* These numbers cannot change over time. New ioctl numbers must be appended.
	*/
	typedef enum zfs_ioc {
	/*
	* Core features - 81/128 numbers reserved.
	*/
	#ifdef __FreeBSD__
	ZFS_IOC_FIRST = 0,
	#else
	ZFS_IOC_FIRST = ('Z' << 8),
	#endif
	ZFS_IOC = ZFS_IOC_FIRST,
	ZFS_IOC_POOL_CREATE = ZFS_IOC_FIRST, /* 0x5a00 */
	ZFS_IOC_POOL_DESTROY, /* 0x5a01 */
	ZFS_IOC_POOL_IMPORT, /* 0x5a02 */
	ZFS_IOC_POOL_EXPORT, /* 0x5a03 */
	ZFS_IOC_POOL_CONFIGS, /* 0x5a04 */
	ZFS_IOC_POOL_STATS, /* 0x5a05 */
	ZFS_IOC_POOL_TRYIMPORT, /* 0x5a06 */
	ZFS_IOC_POOL_SCAN, /* 0x5a07 */
	ZFS_IOC_POOL_FREEZE, /* 0x5a08 */
	ZFS_IOC_POOL_UPGRADE, /* 0x5a09 */
	ZFS_IOC_POOL_GET_HISTORY, /* 0x5a0a */
	ZFS_IOC_VDEV_ADD, /* 0x5a0b */
	ZFS_IOC_VDEV_REMOVE, /* 0x5a0c */
	ZFS_IOC_VDEV_SET_STATE, /* 0x5a0d */
	ZFS_IOC_VDEV_ATTACH, /* 0x5a0e */
	ZFS_IOC_VDEV_DETACH, /* 0x5a0f */
	ZFS_IOC_VDEV_SETPATH, /* 0x5a10 */
	ZFS_IOC_VDEV_SETFRU, /* 0x5a11 */
	ZFS_IOC_OBJSET_STATS, /* 0x5a12 */
	ZFS_IOC_OBJSET_ZPLPROPS, /* 0x5a13 */
	ZFS_IOC_DATASET_LIST_NEXT, /* 0x5a14 */
	ZFS_IOC_SNAPSHOT_LIST_NEXT, /* 0x5a15 */
	ZFS_IOC_SET_PROP, /* 0x5a16 */
	ZFS_IOC_CREATE, /* 0x5a17 */
	ZFS_IOC_DESTROY, /* 0x5a18 */
	ZFS_IOC_ROLLBACK, /* 0x5a19 */
	ZFS_IOC_RENAME, /* 0x5a1a */
	ZFS_IOC_RECV, /* 0x5a1b */
	ZFS_IOC_SEND, /* 0x5a1c */
	ZFS_IOC_INJECT_FAULT, /* 0x5a1d */
	ZFS_IOC_CLEAR_FAULT, /* 0x5a1e */
	ZFS_IOC_INJECT_LIST_NEXT, /* 0x5a1f */
	ZFS_IOC_ERROR_LOG, /* 0x5a20 */
	ZFS_IOC_CLEAR, /* 0x5a21 */
	ZFS_IOC_PROMOTE, /* 0x5a22 */
	ZFS_IOC_SNAPSHOT, /* 0x5a23 */
	ZFS_IOC_DSOBJ_TO_DSNAME, /* 0x5a24 */
	ZFS_IOC_OBJ_TO_PATH, /* 0x5a25 */
	ZFS_IOC_POOL_SET_PROPS, /* 0x5a26 */
	ZFS_IOC_POOL_GET_PROPS, /* 0x5a27 */
	ZFS_IOC_SET_FSACL, /* 0x5a28 */
	ZFS_IOC_GET_FSACL, /* 0x5a29 */
	ZFS_IOC_SHARE, /* 0x5a2a */
	ZFS_IOC_INHERIT_PROP, /* 0x5a2b */
	ZFS_IOC_SMB_ACL, /* 0x5a2c */
	ZFS_IOC_USERSPACE_ONE, /* 0x5a2d */
	ZFS_IOC_USERSPACE_MANY, /* 0x5a2e */
	ZFS_IOC_USERSPACE_UPGRADE, /* 0x5a2f */
	ZFS_IOC_HOLD, /* 0x5a30 */
	ZFS_IOC_RELEASE, /* 0x5a31 */
	ZFS_IOC_GET_HOLDS, /* 0x5a32 */
	ZFS_IOC_OBJSET_RECVD_PROPS, /* 0x5a33 */
	ZFS_IOC_VDEV_SPLIT, /* 0x5a34 */
	ZFS_IOC_NEXT_OBJ, /* 0x5a35 */
	ZFS_IOC_DIFF, /* 0x5a36 */
	ZFS_IOC_TMP_SNAPSHOT, /* 0x5a37 */
	ZFS_IOC_OBJ_TO_STATS, /* 0x5a38 */
	ZFS_IOC_SPACE_WRITTEN, /* 0x5a39 */
	ZFS_IOC_SPACE_SNAPS, /* 0x5a3a */
	ZFS_IOC_DESTROY_SNAPS, /* 0x5a3b */
	ZFS_IOC_POOL_REGUID, /* 0x5a3c */
	ZFS_IOC_POOL_REOPEN, /* 0x5a3d */
	ZFS_IOC_SEND_PROGRESS, /* 0x5a3e */
	ZFS_IOC_LOG_HISTORY, /* 0x5a3f */
	ZFS_IOC_SEND_NEW, /* 0x5a40 */
	ZFS_IOC_SEND_SPACE, /* 0x5a41 */
	ZFS_IOC_CLONE, /* 0x5a42 */
	ZFS_IOC_BOOKMARK, /* 0x5a43 */
	ZFS_IOC_GET_BOOKMARKS, /* 0x5a44 */
	ZFS_IOC_DESTROY_BOOKMARKS, /* 0x5a45 */
	ZFS_IOC_RECV_NEW, /* 0x5a46 */
	ZFS_IOC_POOL_SYNC, /* 0x5a47 */
	ZFS_IOC_CHANNEL_PROGRAM, /* 0x5a48 */
	ZFS_IOC_LOAD_KEY, /* 0x5a49 */
	ZFS_IOC_UNLOAD_KEY, /* 0x5a4a */
	ZFS_IOC_CHANGE_KEY, /* 0x5a4b */
	ZFS_IOC_REMAP, /* 0x5a4c */
	ZFS_IOC_POOL_CHECKPOINT, /* 0x5a4d */
	ZFS_IOC_POOL_DISCARD_CHECKPOINT, /* 0x5a4e */
	ZFS_IOC_POOL_INITIALIZE, /* 0x5a4f */
	ZFS_IOC_POOL_TRIM, /* 0x5a50 */
	ZFS_IOC_REDACT, /* 0x5a51 */
	ZFS_IOC_GET_BOOKMARK_PROPS, /* 0x5a52 */
	ZFS_IOC_WAIT, /* 0x5a53 */
	ZFS_IOC_WAIT_FS, /* 0x5a54 */

	/*
	* Per-platform (Optional) - 8/128 numbers reserved.
	*/
	ZFS_IOC_PLATFORM = ZFS_IOC_FIRST + 0x80,
	ZFS_IOC_EVENTS_NEXT, /* 0x81 (Linux) */
	ZFS_IOC_EVENTS_CLEAR, /* 0x82 (Linux) */
	ZFS_IOC_EVENTS_SEEK, /* 0x83 (Linux) */
	ZFS_IOC_NEXTBOOT, /* 0x84 (FreeBSD) */
	ZFS_IOC_JAIL, /* 0x85 (FreeBSD) */
	ZFS_IOC_UNJAIL, /* 0x86 (FreeBSD) */
	- ZFS_IOC_SET_BOOTENV, /* 0x87 (Linux) */
	- ZFS_IOC_GET_BOOTENV, /* 0x88 (Linux) */
	+ ZFS_IOC_SET_BOOTENV, /* 0x87 */
	+ ZFS_IOC_GET_BOOTENV, /* 0x88 */
	ZFS_IOC_LAST
	} zfs_ioc_t;

	/*
	* zvol ioctl to get dataset name
	*/
	#define BLKZNAME _IOR(0x12, 125, char[ZFS_MAX_DATASET_NAME_LEN])

	/*
	* ZFS-specific error codes used for returning descriptive errors
	* to the userland through zfs ioctls.
	*
	* The enum implicitly includes all the error codes from errno.h.
	* New code should use and extend this enum for errors that are
	* not described precisely by generic errno codes.
	*
	* These numbers should not change over time. New entries should be appended.
	*
	* (Keep in sync with contrib/pyzfs/libzfs_core/_constants.py)
	*/
	typedef enum {
	ZFS_ERR_CHECKPOINT_EXISTS = 1024,
	ZFS_ERR_DISCARDING_CHECKPOINT,
	ZFS_ERR_NO_CHECKPOINT,
	ZFS_ERR_DEVRM_IN_PROGRESS,
	ZFS_ERR_VDEV_TOO_BIG,
	ZFS_ERR_IOC_CMD_UNAVAIL,
	ZFS_ERR_IOC_ARG_UNAVAIL,
	ZFS_ERR_IOC_ARG_REQUIRED,
	ZFS_ERR_IOC_ARG_BADTYPE,
	ZFS_ERR_WRONG_PARENT,
	ZFS_ERR_FROM_IVSET_GUID_MISSING,
	ZFS_ERR_FROM_IVSET_GUID_MISMATCH,
	ZFS_ERR_SPILL_BLOCK_FLAG_MISSING,
	ZFS_ERR_UNKNOWN_SEND_STREAM_FEATURE,
	ZFS_ERR_EXPORT_IN_PROGRESS,
	ZFS_ERR_BOOKMARK_SOURCE_NOT_ANCESTOR,
	ZFS_ERR_STREAM_TRUNCATED,
	ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH,
	ZFS_ERR_RESILVER_IN_PROGRESS,
	ZFS_ERR_REBUILD_IN_PROGRESS,
	ZFS_ERR_BADPROP,
	} zfs_errno_t;

	/*
	* Internal SPA load state. Used by FMA diagnosis engine.
	*/
	typedef enum {
	SPA_LOAD_NONE, /* no load in progress */
	SPA_LOAD_OPEN, /* normal open */
	SPA_LOAD_IMPORT, /* import in progress */
	SPA_LOAD_TRYIMPORT, /* tryimport in progress */
	SPA_LOAD_RECOVER, /* recovery requested */
	SPA_LOAD_ERROR, /* load failed */
	SPA_LOAD_CREATE /* creation in progress */
	} spa_load_state_t;

	typedef enum {
	ZPOOL_WAIT_CKPT_DISCARD,
	ZPOOL_WAIT_FREE,
	ZPOOL_WAIT_INITIALIZE,
	ZPOOL_WAIT_REPLACE,
	ZPOOL_WAIT_REMOVE,
	ZPOOL_WAIT_RESILVER,
	ZPOOL_WAIT_SCRUB,
	ZPOOL_WAIT_TRIM,
	ZPOOL_WAIT_NUM_ACTIVITIES
	} zpool_wait_activity_t;

	typedef enum {
	ZFS_WAIT_DELETEQ,
	ZFS_WAIT_NUM_ACTIVITIES
	} zfs_wait_activity_t;

	/*
	* Bookmark name values.
	*/
	#define ZPOOL_ERR_LIST "error list"
	#define ZPOOL_ERR_DATASET "dataset"
	#define ZPOOL_ERR_OBJECT "object"

	#define HIS_MAX_RECORD_LEN (MAXPATHLEN + MAXPATHLEN + 1)

	/*
	* The following are names used in the nvlist describing
	* the pool's history log.
	*/
	#define ZPOOL_HIST_RECORD "history record"
	#define ZPOOL_HIST_TIME "history time"
	#define ZPOOL_HIST_CMD "history command"
	#define ZPOOL_HIST_WHO "history who"
	#define ZPOOL_HIST_ZONE "history zone"
	#define ZPOOL_HIST_HOST "history hostname"
	#define ZPOOL_HIST_TXG "history txg"
	#define ZPOOL_HIST_INT_EVENT "history internal event"
	#define ZPOOL_HIST_INT_STR "history internal str"
	#define ZPOOL_HIST_INT_NAME "internal_name"
	#define ZPOOL_HIST_IOCTL "ioctl"
	#define ZPOOL_HIST_INPUT_NVL "in_nvl"
	#define ZPOOL_HIST_OUTPUT_NVL "out_nvl"
	#define ZPOOL_HIST_DSNAME "dsname"
	#define ZPOOL_HIST_DSID "dsid"
	#define ZPOOL_HIST_ERRNO "errno"

	/*
	* Special nvlist name that will not have its args recorded in the pool's
	* history log.
	*/
	#define ZPOOL_HIDDEN_ARGS "hidden_args"

	/*
	* The following are names used when invoking ZFS_IOC_POOL_INITIALIZE.
	*/
	#define ZPOOL_INITIALIZE_COMMAND "initialize_command"
	#define ZPOOL_INITIALIZE_VDEVS "initialize_vdevs"

	/*
	* The following are names used when invoking ZFS_IOC_POOL_TRIM.
	*/
	#define ZPOOL_TRIM_COMMAND "trim_command"
	#define ZPOOL_TRIM_VDEVS "trim_vdevs"
	#define ZPOOL_TRIM_RATE "trim_rate"
	#define ZPOOL_TRIM_SECURE "trim_secure"

	/*
	* The following are names used when invoking ZFS_IOC_POOL_WAIT.
	*/
	#define ZPOOL_WAIT_ACTIVITY "wait_activity"
	#define ZPOOL_WAIT_TAG "wait_tag"
	#define ZPOOL_WAIT_WAITED "wait_waited"

	/*
	* The following are names used when invoking ZFS_IOC_WAIT_FS.
	*/
	#define ZFS_WAIT_ACTIVITY "wait_activity"
	#define ZFS_WAIT_WAITED "wait_waited"

	/*
	* Flags for ZFS_IOC_VDEV_SET_STATE
	*/
	#define ZFS_ONLINE_CHECKREMOVE 0x1
	#define ZFS_ONLINE_UNSPARE 0x2
	#define ZFS_ONLINE_FORCEFAULT 0x4
	#define ZFS_ONLINE_EXPAND 0x8
	#define ZFS_OFFLINE_TEMPORARY 0x1

	/*
	* Flags for ZFS_IOC_POOL_IMPORT
	*/
	#define ZFS_IMPORT_NORMAL 0x0
	#define ZFS_IMPORT_VERBATIM 0x1
	#define ZFS_IMPORT_ANY_HOST 0x2
	#define ZFS_IMPORT_MISSING_LOG 0x4
	#define ZFS_IMPORT_ONLY 0x8
	#define ZFS_IMPORT_TEMP_NAME 0x10
	#define ZFS_IMPORT_SKIP_MMP 0x20
	#define ZFS_IMPORT_LOAD_KEYS 0x40
	#define ZFS_IMPORT_CHECKPOINT 0x80

	/*
	* Channel program argument/return nvlist keys and defaults.
	*/
	#define ZCP_ARG_PROGRAM "program"
	#define ZCP_ARG_ARGLIST "arg"
	#define ZCP_ARG_SYNC "sync"
	#define ZCP_ARG_INSTRLIMIT "instrlimit"
	#define ZCP_ARG_MEMLIMIT "memlimit"

	#define ZCP_ARG_CLIARGV "argv"

	#define ZCP_RET_ERROR "error"
	#define ZCP_RET_RETURN "return"

	#define ZCP_DEFAULT_INSTRLIMIT (10 * 1000 * 1000)
	#define ZCP_MAX_INSTRLIMIT (10 * ZCP_DEFAULT_INSTRLIMIT)
	#define ZCP_DEFAULT_MEMLIMIT (10 * 1024 * 1024)
	#define ZCP_MAX_MEMLIMIT (10 * ZCP_DEFAULT_MEMLIMIT)

	/*
	* Sysevent payload members. ZFS will generate the following sysevents with the
	* given payloads:
	*
	* ESC_ZFS_RESILVER_START
	* ESC_ZFS_RESILVER_FINISH
	*
	* ZFS_EV_POOL_NAME DATA_TYPE_STRING
	* ZFS_EV_POOL_GUID DATA_TYPE_UINT64
	* ZFS_EV_RESILVER_TYPE DATA_TYPE_STRING
	*
	* ESC_ZFS_POOL_DESTROY
	* ESC_ZFS_POOL_REGUID
	*
	* ZFS_EV_POOL_NAME DATA_TYPE_STRING
	* ZFS_EV_POOL_GUID DATA_TYPE_UINT64
	*
	* ESC_ZFS_VDEV_REMOVE
	* ESC_ZFS_VDEV_CLEAR
	* ESC_ZFS_VDEV_CHECK
	*
	* ZFS_EV_POOL_NAME DATA_TYPE_STRING
	* ZFS_EV_POOL_GUID DATA_TYPE_UINT64
	* ZFS_EV_VDEV_PATH DATA_TYPE_STRING (optional)
	* ZFS_EV_VDEV_GUID DATA_TYPE_UINT64
	*
	* ESC_ZFS_HISTORY_EVENT
	*
	* ZFS_EV_POOL_NAME DATA_TYPE_STRING
	* ZFS_EV_POOL_GUID DATA_TYPE_UINT64
	* ZFS_EV_HIST_TIME DATA_TYPE_UINT64 (optional)
	* ZFS_EV_HIST_CMD DATA_TYPE_STRING (optional)
	* ZFS_EV_HIST_WHO DATA_TYPE_UINT64 (optional)
	* ZFS_EV_HIST_ZONE DATA_TYPE_STRING (optional)
	* ZFS_EV_HIST_HOST DATA_TYPE_STRING (optional)
	* ZFS_EV_HIST_TXG DATA_TYPE_UINT64 (optional)
	* ZFS_EV_HIST_INT_EVENT DATA_TYPE_UINT64 (optional)
	* ZFS_EV_HIST_INT_STR DATA_TYPE_STRING (optional)
	* ZFS_EV_HIST_INT_NAME DATA_TYPE_STRING (optional)
	* ZFS_EV_HIST_IOCTL DATA_TYPE_STRING (optional)
	* ZFS_EV_HIST_DSNAME DATA_TYPE_STRING (optional)
	* ZFS_EV_HIST_DSID DATA_TYPE_UINT64 (optional)
	*
	* The ZFS_EV_HIST_* members will correspond to the ZPOOL_HIST_* members in the
	* history log nvlist. The keynames will be free of any spaces or other
	* characters that could be potentially unexpected to consumers of the
	* sysevents.
	*/
	#define ZFS_EV_POOL_NAME "pool_name"
	#define ZFS_EV_POOL_GUID "pool_guid"
	#define ZFS_EV_VDEV_PATH "vdev_path"
	#define ZFS_EV_VDEV_GUID "vdev_guid"
	#define ZFS_EV_HIST_TIME "history_time"
	#define ZFS_EV_HIST_CMD "history_command"
	#define ZFS_EV_HIST_WHO "history_who"
	#define ZFS_EV_HIST_ZONE "history_zone"
	#define ZFS_EV_HIST_HOST "history_hostname"
	#define ZFS_EV_HIST_TXG "history_txg"
	#define ZFS_EV_HIST_INT_EVENT "history_internal_event"
	#define ZFS_EV_HIST_INT_STR "history_internal_str"
	#define ZFS_EV_HIST_INT_NAME "history_internal_name"
	#define ZFS_EV_HIST_IOCTL "history_ioctl"
	#define ZFS_EV_HIST_DSNAME "history_dsname"
	#define ZFS_EV_HIST_DSID "history_dsid"
	#define ZFS_EV_RESILVER_TYPE "resilver_type"

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_FS_ZFS_H */
	Index: vendor-sys/openzfs/dist/include/sys/spa.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/spa.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/spa.h (revision 365892)
	@@ -1,1224 +1,1224 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	- * Copyright (c) 2011, 2019 by Delphix. All rights reserved.
	+ * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
	* Copyright 2013 Saso Kiselkov. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright 2017 Joyent, Inc.
	* Copyright (c) 2017, 2019, Datto Inc. All rights reserved.
	* Copyright (c) 2017, Intel Corporation.
	* Copyright (c) 2019, Allan Jude
	* Copyright (c) 2019, Klara Inc.
	*/

	#ifndef _SYS_SPA_H
	#define _SYS_SPA_H

	#include <sys/avl.h>
	#include <sys/zfs_context.h>
	#include <sys/kstat.h>
	#include <sys/nvpair.h>
	#include <sys/sysmacros.h>
	#include <sys/types.h>
	#include <sys/fs/zfs.h>
	#include <sys/spa_checksum.h>
	#include <sys/dmu.h>
	#include <sys/space_map.h>
	#include <sys/bitops.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	/*
	* Forward references that lots of things need.
	*/
	typedef struct spa spa_t;
	typedef struct vdev vdev_t;
	typedef struct metaslab metaslab_t;
	typedef struct metaslab_group metaslab_group_t;
	typedef struct metaslab_class metaslab_class_t;
	typedef struct zio zio_t;
	typedef struct zilog zilog_t;
	typedef struct spa_aux_vdev spa_aux_vdev_t;
	typedef struct ddt ddt_t;
	typedef struct ddt_entry ddt_entry_t;
	typedef struct zbookmark_phys zbookmark_phys_t;

	struct bpobj;
	struct bplist;
	struct dsl_pool;
	struct dsl_dataset;
	struct dsl_crypto_params;

	/*
	* We currently support block sizes from 512 bytes to 16MB.
	* The benefits of larger blocks, and thus larger IO, need to be weighed
	* against the cost of COWing a giant block to modify one byte, and the
	* large latency of reading or writing a large block.
	*
	* Note that although blocks up to 16MB are supported, the recordsize
	* property can not be set larger than zfs_max_recordsize (default 1MB).
	* See the comment near zfs_max_recordsize in dsl_dataset.c for details.
	*
	* Note that although the LSIZE field of the blkptr_t can store sizes up
	* to 32MB, the dnode's dn_datablkszsec can only store sizes up to
	* 32MB - 512 bytes. Therefore, we limit SPA_MAXBLOCKSIZE to 16MB.
	*/
	#define SPA_MINBLOCKSHIFT 9
	#define SPA_OLD_MAXBLOCKSHIFT 17
	#define SPA_MAXBLOCKSHIFT 24
	#define SPA_MINBLOCKSIZE (1ULL << SPA_MINBLOCKSHIFT)
	#define SPA_OLD_MAXBLOCKSIZE (1ULL << SPA_OLD_MAXBLOCKSHIFT)
	#define SPA_MAXBLOCKSIZE (1ULL << SPA_MAXBLOCKSHIFT)

	/*
	* Alignment Shift (ashift) is an immutable, internal top-level vdev property
	* which can only be set at vdev creation time. Physical writes are always done
	* according to it, which makes 2^ashift the smallest possible IO on a vdev.
	*
	* We currently allow values ranging from 512 bytes (2^9 = 512) to 64 KiB
	* (2^16 = 65,536).
	*/
	#define ASHIFT_MIN 9
	#define ASHIFT_MAX 16

	/*
	* Size of block to hold the configuration data (a packed nvlist)
	*/
	#define SPA_CONFIG_BLOCKSIZE (1ULL << 14)

	/*
	* The DVA size encodings for LSIZE and PSIZE support blocks up to 32MB.
	* The ASIZE encoding should be at least 64 times larger (6 more bits)
	* to support up to 4-way RAID-Z mirror mode with worst-case gang block
	* overhead, three DVAs per bp, plus one more bit in case we do anything
	* else that expands the ASIZE.
	*/
	#define SPA_LSIZEBITS 16 /* LSIZE up to 32M (2^16 * 512) */
	#define SPA_PSIZEBITS 16 /* PSIZE up to 32M (2^16 * 512) */
	#define SPA_ASIZEBITS 24 /* ASIZE up to 64 times larger */

	#define SPA_COMPRESSBITS 7
	#define SPA_VDEVBITS 24
	#define SPA_COMPRESSMASK ((1U << SPA_COMPRESSBITS) - 1)

	/*
	* All SPA data is represented by 128-bit data virtual addresses (DVAs).
	* The members of the dva_t should be considered opaque outside the SPA.
	*/
	typedef struct dva {
	uint64_t dva_word[2];
	} dva_t;


	/*
	* Some checksums/hashes need a 256-bit initialization salt. This salt is kept
	* secret and is suitable for use in MAC algorithms as the key.
	*/
	typedef struct zio_cksum_salt {
	uint8_t zcs_bytes[32];
	} zio_cksum_salt_t;

	/*
	* Each block is described by its DVAs, time of birth, checksum, etc.
	* The word-by-word, bit-by-bit layout of the blkptr is as follows:
	*
	* 64 56 48 40 32 24 16 8 0
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 0 \| pad \| vdev1 \| GRID \| ASIZE \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 1 \|G\| offset1 \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 2 \| pad \| vdev2 \| GRID \| ASIZE \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 3 \|G\| offset2 \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 4 \| pad \| vdev3 \| GRID \| ASIZE \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 5 \|G\| offset3 \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 6 \|BDX\|lvl\| type \| cksum \|E\| comp\| PSIZE \| LSIZE \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 7 \| padding \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 8 \| padding \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 9 \| physical birth txg \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* a \| logical birth txg \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* b \| fill count \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* c \| checksum[0] \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* d \| checksum[1] \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* e \| checksum[2] \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* f \| checksum[3] \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	*
	* Legend:
	*
	* vdev virtual device ID
	* offset offset into virtual device
	* LSIZE logical size
	* PSIZE physical size (after compression)
	* ASIZE allocated size (including RAID-Z parity and gang block headers)
	* GRID RAID-Z layout information (reserved for future use)
	* cksum checksum function
	* comp compression function
	* G gang block indicator
	* B byteorder (endianness)
	* D dedup
	* X encryption
	* E blkptr_t contains embedded data (see below)
	* lvl level of indirection
	* type DMU object type
	* phys birth txg when dva[0] was written; zero if same as logical birth txg
	* note that typically all the dva's would be written in this
	* txg, but they could be different if they were moved by
	* device removal.
	* log. birth transaction group in which the block was logically born
	* fill count number of non-zero blocks under this bp
	* checksum[4] 256-bit checksum of the data this bp describes
	*/

	/*
	* The blkptr_t's of encrypted blocks also need to store the encryption
	* parameters so that the block can be decrypted. This layout is as follows:
	*
	* 64 56 48 40 32 24 16 8 0
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 0 \| vdev1 \| GRID \| ASIZE \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 1 \|G\| offset1 \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 2 \| vdev2 \| GRID \| ASIZE \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 3 \|G\| offset2 \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 4 \| salt \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 5 \| IV1 \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 6 \|BDX\|lvl\| type \| cksum \|E\| comp\| PSIZE \| LSIZE \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 7 \| padding \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 8 \| padding \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 9 \| physical birth txg \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* a \| logical birth txg \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* b \| IV2 \| fill count \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* c \| checksum[0] \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* d \| checksum[1] \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* e \| MAC[0] \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* f \| MAC[1] \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	*
	* Legend:
	*
	* salt Salt for generating encryption keys
	* IV1 First 64 bits of encryption IV
	* X Block requires encryption handling (set to 1)
	* E blkptr_t contains embedded data (set to 0, see below)
	* fill count number of non-zero blocks under this bp (truncated to 32 bits)
	* IV2 Last 32 bits of encryption IV
	* checksum[2] 128-bit checksum of the data this bp describes
	* MAC[2] 128-bit message authentication code for this data
	*
	* The X bit being set indicates that this block is one of 3 types. If this is
	* a level 0 block with an encrypted object type, the block is encrypted
	* (see BP_IS_ENCRYPTED()). If this is a level 0 block with an unencrypted
	* object type, this block is authenticated with an HMAC (see
	* BP_IS_AUTHENTICATED()). Otherwise (if level > 0), this bp will use the MAC
	* words to store a checksum-of-MACs from the level below (see
	* BP_HAS_INDIRECT_MAC_CKSUM()). For convenience in the code, BP_IS_PROTECTED()
	* refers to both encrypted and authenticated blocks and BP_USES_CRYPT()
	* refers to any of these 3 kinds of blocks.
	*
	* The additional encryption parameters are the salt, IV, and MAC which are
	* explained in greater detail in the block comment at the top of zio_crypt.c.
	* The MAC occupies half of the checksum space since it serves a very similar
	* purpose: to prevent data corruption on disk. The only functional difference
	* is that the checksum is used to detect on-disk corruption whether or not the
	* encryption key is loaded and the MAC provides additional protection against
	* malicious disk tampering. We use the 3rd DVA to store the salt and first
	* 64 bits of the IV. As a result encrypted blocks can only have 2 copies
	* maximum instead of the normal 3. The last 32 bits of the IV are stored in
	* the upper bits of what is usually the fill count. Note that only blocks at
	* level 0 or -2 are ever encrypted, which allows us to guarantee that these
	* 32 bits are not trampled over by other code (see zio_crypt.c for details).
	* The salt and IV are not used for authenticated bps or bps with an indirect
	* MAC checksum, so these blocks can utilize all 3 DVAs and the full 64 bits
	* for the fill count.
	*/

	/*
	* "Embedded" blkptr_t's don't actually point to a block, instead they
	* have a data payload embedded in the blkptr_t itself. See the comment
	* in blkptr.c for more details.
	*
	* The blkptr_t is laid out as follows:
	*
	* 64 56 48 40 32 24 16 8 0
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 0 \| payload \|
	* 1 \| payload \|
	* 2 \| payload \|
	* 3 \| payload \|
	* 4 \| payload \|
	* 5 \| payload \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 6 \|BDX\|lvl\| type \| etype \|E\| comp\| PSIZE\| LSIZE \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* 7 \| payload \|
	* 8 \| payload \|
	* 9 \| payload \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* a \| logical birth txg \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* b \| payload \|
	* c \| payload \|
	* d \| payload \|
	* e \| payload \|
	* f \| payload \|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	*
	* Legend:
	*
	* payload contains the embedded data
	* B (byteorder) byteorder (endianness)
	* D (dedup) padding (set to zero)
	* X encryption (set to zero)
	* E (embedded) set to one
	* lvl indirection level
	* type DMU object type
	* etype how to interpret embedded data (BP_EMBEDDED_TYPE_*)
	* comp compression function of payload
	* PSIZE size of payload after compression, in bytes
	* LSIZE logical size of payload, in bytes
	* note that 25 bits is enough to store the largest
	* "normal" BP's LSIZE (2^16 * 2^9) in bytes
	* log. birth transaction group in which the block was logically born
	*
	* Note that LSIZE and PSIZE are stored in bytes, whereas for non-embedded
	* bp's they are stored in units of SPA_MINBLOCKSHIFT.
	* Generally, the generic BP_GET_*() macros can be used on embedded BP's.
	* The B, D, X, lvl, type, and comp fields are stored the same as with normal
	* BP's so the BP_SET_* macros can be used with them. etype, PSIZE, LSIZE must
	* be set with the BPE_SET_* macros. BP_SET_EMBEDDED() should be called before
	* other macros, as they assert that they are only used on BP's of the correct
	* "embedded-ness". Encrypted blkptr_t's cannot be embedded because they use
	* the payload space for encryption parameters (see the comment above on
	* how encryption parameters are stored).
	*/

	#define BPE_GET_ETYPE(bp) \
	(ASSERT(BP_IS_EMBEDDED(bp)), \
	BF64_GET((bp)->blk_prop, 40, 8))
	#define BPE_SET_ETYPE(bp, t) do { \
	ASSERT(BP_IS_EMBEDDED(bp)); \
	BF64_SET((bp)->blk_prop, 40, 8, t); \
	_NOTE(CONSTCOND) } while (0)

	#define BPE_GET_LSIZE(bp) \
	(ASSERT(BP_IS_EMBEDDED(bp)), \
	BF64_GET_SB((bp)->blk_prop, 0, 25, 0, 1))
	#define BPE_SET_LSIZE(bp, x) do { \
	ASSERT(BP_IS_EMBEDDED(bp)); \
	BF64_SET_SB((bp)->blk_prop, 0, 25, 0, 1, x); \
	_NOTE(CONSTCOND) } while (0)

	#define BPE_GET_PSIZE(bp) \
	(ASSERT(BP_IS_EMBEDDED(bp)), \
	BF64_GET_SB((bp)->blk_prop, 25, 7, 0, 1))
	#define BPE_SET_PSIZE(bp, x) do { \
	ASSERT(BP_IS_EMBEDDED(bp)); \
	BF64_SET_SB((bp)->blk_prop, 25, 7, 0, 1, x); \
	_NOTE(CONSTCOND) } while (0)

	typedef enum bp_embedded_type {
	BP_EMBEDDED_TYPE_DATA,
	BP_EMBEDDED_TYPE_RESERVED, /* Reserved for Delphix byteswap feature. */
	BP_EMBEDDED_TYPE_REDACTED,
	NUM_BP_EMBEDDED_TYPES
	} bp_embedded_type_t;

	#define BPE_NUM_WORDS 14
	#define BPE_PAYLOAD_SIZE (BPE_NUM_WORDS * sizeof (uint64_t))
	#define BPE_IS_PAYLOADWORD(bp, wp) \
	((wp) != &(bp)->blk_prop && (wp) != &(bp)->blk_birth)

	#define SPA_BLKPTRSHIFT 7 /* blkptr_t is 128 bytes */
	#define SPA_DVAS_PER_BP 3 /* Number of DVAs in a bp */
	#define SPA_SYNC_MIN_VDEVS 3 /* min vdevs to update during sync */

	/*
	* A block is a hole when it has either 1) never been written to, or
	* 2) is zero-filled. In both cases, ZFS can return all zeroes for all reads
	* without physically allocating disk space. Holes are represented in the
	* blkptr_t structure by zeroed blk_dva. Correct checking for holes is
	* done through the BP_IS_HOLE macro. For holes, the logical size, level,
	* DMU object type, and birth times are all also stored for holes that
	* were written to at some point (i.e. were punched after having been filled).
	*/
	typedef struct blkptr {
	dva_t blk_dva[SPA_DVAS_PER_BP]; /* Data Virtual Addresses */
	uint64_t blk_prop; /* size, compression, type, etc */
	uint64_t blk_pad[2]; /* Extra space for the future */
	uint64_t blk_phys_birth; /* txg when block was allocated */
	uint64_t blk_birth; /* transaction group at birth */
	uint64_t blk_fill; /* fill count */
	zio_cksum_t blk_cksum; /* 256-bit checksum */
	} blkptr_t;

	/*
	* Macros to get and set fields in a bp or DVA.
	*/
	#define DVA_GET_ASIZE(dva) \
	BF64_GET_SB((dva)->dva_word[0], 0, SPA_ASIZEBITS, SPA_MINBLOCKSHIFT, 0)
	#define DVA_SET_ASIZE(dva, x) \
	BF64_SET_SB((dva)->dva_word[0], 0, SPA_ASIZEBITS, \
	SPA_MINBLOCKSHIFT, 0, x)

	#define DVA_GET_GRID(dva) BF64_GET((dva)->dva_word[0], 24, 8)
	#define DVA_SET_GRID(dva, x) BF64_SET((dva)->dva_word[0], 24, 8, x)

	#define DVA_GET_VDEV(dva) BF64_GET((dva)->dva_word[0], 32, SPA_VDEVBITS)
	#define DVA_SET_VDEV(dva, x) \
	BF64_SET((dva)->dva_word[0], 32, SPA_VDEVBITS, x)

	#define DVA_GET_OFFSET(dva) \
	BF64_GET_SB((dva)->dva_word[1], 0, 63, SPA_MINBLOCKSHIFT, 0)
	#define DVA_SET_OFFSET(dva, x) \
	BF64_SET_SB((dva)->dva_word[1], 0, 63, SPA_MINBLOCKSHIFT, 0, x)

	#define DVA_GET_GANG(dva) BF64_GET((dva)->dva_word[1], 63, 1)
	#define DVA_SET_GANG(dva, x) BF64_SET((dva)->dva_word[1], 63, 1, x)

	#define BP_GET_LSIZE(bp) \
	(BP_IS_EMBEDDED(bp) ? \
	(BPE_GET_ETYPE(bp) == BP_EMBEDDED_TYPE_DATA ? BPE_GET_LSIZE(bp) : 0): \
	BF64_GET_SB((bp)->blk_prop, 0, SPA_LSIZEBITS, SPA_MINBLOCKSHIFT, 1))
	#define BP_SET_LSIZE(bp, x) do { \
	ASSERT(!BP_IS_EMBEDDED(bp)); \
	BF64_SET_SB((bp)->blk_prop, \
	0, SPA_LSIZEBITS, SPA_MINBLOCKSHIFT, 1, x); \
	_NOTE(CONSTCOND) } while (0)

	#define BP_GET_PSIZE(bp) \
	(BP_IS_EMBEDDED(bp) ? 0 : \
	BF64_GET_SB((bp)->blk_prop, 16, SPA_PSIZEBITS, SPA_MINBLOCKSHIFT, 1))
	#define BP_SET_PSIZE(bp, x) do { \
	ASSERT(!BP_IS_EMBEDDED(bp)); \
	BF64_SET_SB((bp)->blk_prop, \
	16, SPA_PSIZEBITS, SPA_MINBLOCKSHIFT, 1, x); \
	_NOTE(CONSTCOND) } while (0)

	#define BP_GET_COMPRESS(bp) \
	BF64_GET((bp)->blk_prop, 32, SPA_COMPRESSBITS)
	#define BP_SET_COMPRESS(bp, x) \
	BF64_SET((bp)->blk_prop, 32, SPA_COMPRESSBITS, x)

	#define BP_IS_EMBEDDED(bp) BF64_GET((bp)->blk_prop, 39, 1)
	#define BP_SET_EMBEDDED(bp, x) BF64_SET((bp)->blk_prop, 39, 1, x)

	#define BP_GET_CHECKSUM(bp) \
	(BP_IS_EMBEDDED(bp) ? ZIO_CHECKSUM_OFF : \
	BF64_GET((bp)->blk_prop, 40, 8))
	#define BP_SET_CHECKSUM(bp, x) do { \
	ASSERT(!BP_IS_EMBEDDED(bp)); \
	BF64_SET((bp)->blk_prop, 40, 8, x); \
	_NOTE(CONSTCOND) } while (0)

	#define BP_GET_TYPE(bp) BF64_GET((bp)->blk_prop, 48, 8)
	#define BP_SET_TYPE(bp, x) BF64_SET((bp)->blk_prop, 48, 8, x)

	#define BP_GET_LEVEL(bp) BF64_GET((bp)->blk_prop, 56, 5)
	#define BP_SET_LEVEL(bp, x) BF64_SET((bp)->blk_prop, 56, 5, x)

	/* encrypted, authenticated, and MAC cksum bps use the same bit */
	#define BP_USES_CRYPT(bp) BF64_GET((bp)->blk_prop, 61, 1)
	#define BP_SET_CRYPT(bp, x) BF64_SET((bp)->blk_prop, 61, 1, x)

	#define BP_IS_ENCRYPTED(bp) \
	(BP_USES_CRYPT(bp) && \
	BP_GET_LEVEL(bp) <= 0 && \
	DMU_OT_IS_ENCRYPTED(BP_GET_TYPE(bp)))

	#define BP_IS_AUTHENTICATED(bp) \
	(BP_USES_CRYPT(bp) && \
	BP_GET_LEVEL(bp) <= 0 && \
	!DMU_OT_IS_ENCRYPTED(BP_GET_TYPE(bp)))

	#define BP_HAS_INDIRECT_MAC_CKSUM(bp) \
	(BP_USES_CRYPT(bp) && BP_GET_LEVEL(bp) > 0)

	#define BP_IS_PROTECTED(bp) \
	(BP_IS_ENCRYPTED(bp) \|\| BP_IS_AUTHENTICATED(bp))

	#define BP_GET_DEDUP(bp) BF64_GET((bp)->blk_prop, 62, 1)
	#define BP_SET_DEDUP(bp, x) BF64_SET((bp)->blk_prop, 62, 1, x)

	#define BP_GET_BYTEORDER(bp) BF64_GET((bp)->blk_prop, 63, 1)
	#define BP_SET_BYTEORDER(bp, x) BF64_SET((bp)->blk_prop, 63, 1, x)

	#define BP_GET_FREE(bp) BF64_GET((bp)->blk_fill, 0, 1)
	#define BP_SET_FREE(bp, x) BF64_SET((bp)->blk_fill, 0, 1, x)

	#define BP_PHYSICAL_BIRTH(bp) \
	(BP_IS_EMBEDDED(bp) ? 0 : \
	(bp)->blk_phys_birth ? (bp)->blk_phys_birth : (bp)->blk_birth)

	#define BP_SET_BIRTH(bp, logical, physical) \
	{ \
	ASSERT(!BP_IS_EMBEDDED(bp)); \
	(bp)->blk_birth = (logical); \
	(bp)->blk_phys_birth = ((logical) == (physical) ? 0 : (physical)); \
	}

	#define BP_GET_FILL(bp) \
	((BP_IS_ENCRYPTED(bp)) ? BF64_GET((bp)->blk_fill, 0, 32) : \
	((BP_IS_EMBEDDED(bp)) ? 1 : (bp)->blk_fill))

	#define BP_SET_FILL(bp, fill) \
	{ \
	if (BP_IS_ENCRYPTED(bp)) \
	BF64_SET((bp)->blk_fill, 0, 32, fill); \
	else \
	(bp)->blk_fill = fill; \
	}

	#define BP_GET_IV2(bp) \
	(ASSERT(BP_IS_ENCRYPTED(bp)), \
	BF64_GET((bp)->blk_fill, 32, 32))
	#define BP_SET_IV2(bp, iv2) \
	{ \
	ASSERT(BP_IS_ENCRYPTED(bp)); \
	BF64_SET((bp)->blk_fill, 32, 32, iv2); \
	}

	#define BP_IS_METADATA(bp) \
	(BP_GET_LEVEL(bp) > 0 \|\| DMU_OT_IS_METADATA(BP_GET_TYPE(bp)))

	#define BP_GET_ASIZE(bp) \
	(BP_IS_EMBEDDED(bp) ? 0 : \
	DVA_GET_ASIZE(&(bp)->blk_dva[0]) + \
	DVA_GET_ASIZE(&(bp)->blk_dva[1]) + \
	(DVA_GET_ASIZE(&(bp)->blk_dva[2]) * !BP_IS_ENCRYPTED(bp)))

	#define BP_GET_UCSIZE(bp) \
	(BP_IS_METADATA(bp) ? BP_GET_PSIZE(bp) : BP_GET_LSIZE(bp))

	#define BP_GET_NDVAS(bp) \
	(BP_IS_EMBEDDED(bp) ? 0 : \
	!!DVA_GET_ASIZE(&(bp)->blk_dva[0]) + \
	!!DVA_GET_ASIZE(&(bp)->blk_dva[1]) + \
	(!!DVA_GET_ASIZE(&(bp)->blk_dva[2]) * !BP_IS_ENCRYPTED(bp)))

	#define BP_COUNT_GANG(bp) \
	(BP_IS_EMBEDDED(bp) ? 0 : \
	(DVA_GET_GANG(&(bp)->blk_dva[0]) + \
	DVA_GET_GANG(&(bp)->blk_dva[1]) + \
	(DVA_GET_GANG(&(bp)->blk_dva[2]) * !BP_IS_ENCRYPTED(bp))))

	#define DVA_EQUAL(dva1, dva2) \
	((dva1)->dva_word[1] == (dva2)->dva_word[1] && \
	(dva1)->dva_word[0] == (dva2)->dva_word[0])

	#define BP_EQUAL(bp1, bp2) \
	(BP_PHYSICAL_BIRTH(bp1) == BP_PHYSICAL_BIRTH(bp2) && \
	(bp1)->blk_birth == (bp2)->blk_birth && \
	DVA_EQUAL(&(bp1)->blk_dva[0], &(bp2)->blk_dva[0]) && \
	DVA_EQUAL(&(bp1)->blk_dva[1], &(bp2)->blk_dva[1]) && \
	DVA_EQUAL(&(bp1)->blk_dva[2], &(bp2)->blk_dva[2]))


	#define DVA_IS_VALID(dva) (DVA_GET_ASIZE(dva) != 0)

	#define BP_IDENTITY(bp) (ASSERT(!BP_IS_EMBEDDED(bp)), &(bp)->blk_dva[0])
	#define BP_IS_GANG(bp) \
	(BP_IS_EMBEDDED(bp) ? B_FALSE : DVA_GET_GANG(BP_IDENTITY(bp)))
	#define DVA_IS_EMPTY(dva) ((dva)->dva_word[0] == 0ULL && \
	(dva)->dva_word[1] == 0ULL)
	#define BP_IS_HOLE(bp) \
	(!BP_IS_EMBEDDED(bp) && DVA_IS_EMPTY(BP_IDENTITY(bp)))

	#define BP_SET_REDACTED(bp) \
	{ \
	BP_SET_EMBEDDED(bp, B_TRUE); \
	BPE_SET_ETYPE(bp, BP_EMBEDDED_TYPE_REDACTED); \
	}
	#define BP_IS_REDACTED(bp) \
	(BP_IS_EMBEDDED(bp) && BPE_GET_ETYPE(bp) == BP_EMBEDDED_TYPE_REDACTED)

	/* BP_IS_RAIDZ(bp) assumes no block compression */
	#define BP_IS_RAIDZ(bp) (DVA_GET_ASIZE(&(bp)->blk_dva[0]) > \
	BP_GET_PSIZE(bp))

	#define BP_ZERO(bp) \
	{ \
	(bp)->blk_dva[0].dva_word[0] = 0; \
	(bp)->blk_dva[0].dva_word[1] = 0; \
	(bp)->blk_dva[1].dva_word[0] = 0; \
	(bp)->blk_dva[1].dva_word[1] = 0; \
	(bp)->blk_dva[2].dva_word[0] = 0; \
	(bp)->blk_dva[2].dva_word[1] = 0; \
	(bp)->blk_prop = 0; \
	(bp)->blk_pad[0] = 0; \
	(bp)->blk_pad[1] = 0; \
	(bp)->blk_phys_birth = 0; \
	(bp)->blk_birth = 0; \
	(bp)->blk_fill = 0; \
	ZIO_SET_CHECKSUM(&(bp)->blk_cksum, 0, 0, 0, 0); \
	}

	#ifdef _ZFS_BIG_ENDIAN
	#define ZFS_HOST_BYTEORDER (0ULL)
	#else
	#define ZFS_HOST_BYTEORDER (1ULL)
	#endif

	#define BP_SHOULD_BYTESWAP(bp) (BP_GET_BYTEORDER(bp) != ZFS_HOST_BYTEORDER)

	#define BP_SPRINTF_LEN 400

	/*
	* This macro allows code sharing between zfs, libzpool, and mdb.
	* 'func' is either snprintf() or mdb_snprintf().
	* 'ws' (whitespace) can be ' ' for single-line format, '\n' for multi-line.
	*/

	#define SNPRINTF_BLKPTR(func, ws, buf, size, bp, type, checksum, compress) \
	{ \
	static const char *copyname[] = \
	{ "zero", "single", "double", "triple" }; \
	int len = 0; \
	int copies = 0; \
	const char *crypt_type; \
	if (bp != NULL) { \
	if (BP_IS_ENCRYPTED(bp)) { \
	crypt_type = "encrypted"; \
	/* LINTED E_SUSPICIOUS_COMPARISON */ \
	} else if (BP_IS_AUTHENTICATED(bp)) { \
	crypt_type = "authenticated"; \
	} else if (BP_HAS_INDIRECT_MAC_CKSUM(bp)) { \
	crypt_type = "indirect-MAC"; \
	} else { \
	crypt_type = "unencrypted"; \
	} \
	} \
	if (bp == NULL) { \
	len += func(buf + len, size - len, "<NULL>"); \
	} else if (BP_IS_HOLE(bp)) { \
	len += func(buf + len, size - len, \
	"HOLE [L%llu %s] " \
	"size=%llxL birth=%lluL", \
	(u_longlong_t)BP_GET_LEVEL(bp), \
	type, \
	(u_longlong_t)BP_GET_LSIZE(bp), \
	(u_longlong_t)bp->blk_birth); \
	} else if (BP_IS_EMBEDDED(bp)) { \
	len = func(buf + len, size - len, \
	"EMBEDDED [L%llu %s] et=%u %s " \
	"size=%llxL/%llxP birth=%lluL", \
	(u_longlong_t)BP_GET_LEVEL(bp), \
	type, \
	(int)BPE_GET_ETYPE(bp), \
	compress, \
	(u_longlong_t)BPE_GET_LSIZE(bp), \
	(u_longlong_t)BPE_GET_PSIZE(bp), \
	(u_longlong_t)bp->blk_birth); \
	} else if (BP_IS_REDACTED(bp)) { \
	len += func(buf + len, size - len, \
	"REDACTED [L%llu %s] size=%llxL birth=%lluL", \
	(u_longlong_t)BP_GET_LEVEL(bp), \
	type, \
	(u_longlong_t)BP_GET_LSIZE(bp), \
	(u_longlong_t)bp->blk_birth); \
	} else { \
	for (int d = 0; d < BP_GET_NDVAS(bp); d++) { \
	const dva_t *dva = &bp->blk_dva[d]; \
	if (DVA_IS_VALID(dva)) \
	copies++; \
	len += func(buf + len, size - len, \
	"DVA[%d]=<%llu:%llx:%llx>%c", d, \
	(u_longlong_t)DVA_GET_VDEV(dva), \
	(u_longlong_t)DVA_GET_OFFSET(dva), \
	(u_longlong_t)DVA_GET_ASIZE(dva), \
	ws); \
	} \
	if (BP_IS_ENCRYPTED(bp)) { \
	len += func(buf + len, size - len, \
	"salt=%llx iv=%llx:%llx%c", \
	(u_longlong_t)bp->blk_dva[2].dva_word[0], \
	(u_longlong_t)bp->blk_dva[2].dva_word[1], \
	(u_longlong_t)BP_GET_IV2(bp), \
	ws); \
	} \
	if (BP_IS_GANG(bp) && \
	DVA_GET_ASIZE(&bp->blk_dva[2]) <= \
	DVA_GET_ASIZE(&bp->blk_dva[1]) / 2) \
	copies--; \
	len += func(buf + len, size - len, \
	"[L%llu %s] %s %s %s %s %s %s %s%c" \
	"size=%llxL/%llxP birth=%lluL/%lluP fill=%llu%c" \
	"cksum=%llx:%llx:%llx:%llx", \
	(u_longlong_t)BP_GET_LEVEL(bp), \
	type, \
	checksum, \
	compress, \
	crypt_type, \
	BP_GET_BYTEORDER(bp) == 0 ? "BE" : "LE", \
	BP_IS_GANG(bp) ? "gang" : "contiguous", \
	BP_GET_DEDUP(bp) ? "dedup" : "unique", \
	copyname[copies], \
	ws, \
	(u_longlong_t)BP_GET_LSIZE(bp), \
	(u_longlong_t)BP_GET_PSIZE(bp), \
	(u_longlong_t)bp->blk_birth, \
	(u_longlong_t)BP_PHYSICAL_BIRTH(bp), \
	(u_longlong_t)BP_GET_FILL(bp), \
	ws, \
	(u_longlong_t)bp->blk_cksum.zc_word[0], \
	(u_longlong_t)bp->blk_cksum.zc_word[1], \
	(u_longlong_t)bp->blk_cksum.zc_word[2], \
	(u_longlong_t)bp->blk_cksum.zc_word[3]); \
	} \
	ASSERT(len < size); \
	}

	#define BP_GET_BUFC_TYPE(bp) \
	(BP_IS_METADATA(bp) ? ARC_BUFC_METADATA : ARC_BUFC_DATA)

	typedef enum spa_import_type {
	SPA_IMPORT_EXISTING,
	SPA_IMPORT_ASSEMBLE
	} spa_import_type_t;

	typedef enum spa_mode {
	SPA_MODE_UNINIT = 0,
	SPA_MODE_READ = 1,
	SPA_MODE_WRITE = 2,
	} spa_mode_t;

	/*
	* Send TRIM commands in-line during normal pool operation while deleting.
	* OFF: no
	* ON: yes
	* NB: IN_FREEBSD_BASE is defined within the FreeBSD sources.
	*/
	typedef enum {
	SPA_AUTOTRIM_OFF = 0, /* default */
	SPA_AUTOTRIM_ON,
	#ifdef IN_FREEBSD_BASE
	SPA_AUTOTRIM_DEFAULT = SPA_AUTOTRIM_ON,
	#else
	SPA_AUTOTRIM_DEFAULT = SPA_AUTOTRIM_OFF,
	#endif
	} spa_autotrim_t;

	/*
	* Reason TRIM command was issued, used internally for accounting purposes.
	*/
	typedef enum trim_type {
	TRIM_TYPE_MANUAL = 0,
	TRIM_TYPE_AUTO = 1,
	TRIM_TYPE_SIMPLE = 2
	} trim_type_t;

	/* state manipulation functions */
	extern int spa_open(const char pool, spa_t , void tag);
	extern int spa_open_rewind(const char pool, spa_t , void tag,
	nvlist_t policy, nvlist_t *config);
	extern int spa_get_stats(const char pool, nvlist_t config, char altroot,
	size_t buflen);
	extern int spa_create(const char pool, nvlist_t nvroot, nvlist_t *props,
	nvlist_t zplprops, struct dsl_crypto_params dcp);
	extern int spa_import(char pool, nvlist_t config, nvlist_t *props,
	uint64_t flags);
	extern nvlist_t spa_tryimport(nvlist_t tryconfig);
	extern int spa_destroy(char *pool);
	extern int spa_checkpoint(const char *pool);
	extern int spa_checkpoint_discard(const char *pool);
	extern int spa_export(char pool, nvlist_t *oldconfig, boolean_t force,
	boolean_t hardforce);
	extern int spa_reset(char *pool);
	extern void spa_async_request(spa_t *spa, int flag);
	extern void spa_async_unrequest(spa_t *spa, int flag);
	extern void spa_async_suspend(spa_t *spa);
	extern void spa_async_resume(spa_t *spa);
	extern int spa_async_tasks(spa_t *spa);
	extern spa_t spa_inject_addref(char pool);
	extern void spa_inject_delref(spa_t *spa);
	extern void spa_scan_stat_init(spa_t *spa);
	extern int spa_scan_get_stats(spa_t spa, pool_scan_stat_t ps);
	extern int bpobj_enqueue_alloc_cb(void arg, const blkptr_t bp, dmu_tx_t *tx);
	extern int bpobj_enqueue_free_cb(void arg, const blkptr_t bp, dmu_tx_t *tx);

	#define SPA_ASYNC_CONFIG_UPDATE 0x01
	#define SPA_ASYNC_REMOVE 0x02
	#define SPA_ASYNC_PROBE 0x04
	#define SPA_ASYNC_RESILVER_DONE 0x08
	#define SPA_ASYNC_RESILVER 0x10
	#define SPA_ASYNC_AUTOEXPAND 0x20
	#define SPA_ASYNC_REMOVE_DONE 0x40
	#define SPA_ASYNC_REMOVE_STOP 0x80
	#define SPA_ASYNC_INITIALIZE_RESTART 0x100
	#define SPA_ASYNC_TRIM_RESTART 0x200
	#define SPA_ASYNC_AUTOTRIM_RESTART 0x400
	#define SPA_ASYNC_L2CACHE_REBUILD 0x800
	#define SPA_ASYNC_L2CACHE_TRIM 0x1000
	#define SPA_ASYNC_REBUILD_DONE 0x2000

	/* device manipulation */
	extern int spa_vdev_add(spa_t spa, nvlist_t nvroot);
	extern int spa_vdev_attach(spa_t spa, uint64_t guid, nvlist_t nvroot,
	int replacing, int rebuild);
	extern int spa_vdev_detach(spa_t *spa, uint64_t guid, uint64_t pguid,
	int replace_done);
	extern int spa_vdev_remove(spa_t *spa, uint64_t guid, boolean_t unspare);
	extern boolean_t spa_vdev_remove_active(spa_t *spa);
	extern int spa_vdev_initialize(spa_t spa, nvlist_t nv, uint64_t cmd_type,
	nvlist_t *vdev_errlist);
	extern int spa_vdev_trim(spa_t spa, nvlist_t nv, uint64_t cmd_type,
	uint64_t rate, boolean_t partial, boolean_t secure, nvlist_t *vdev_errlist);
	extern int spa_vdev_setpath(spa_t spa, uint64_t guid, const char newpath);
	extern int spa_vdev_setfru(spa_t spa, uint64_t guid, const char newfru);
	extern int spa_vdev_split_mirror(spa_t spa, char newname, nvlist_t *config,
	nvlist_t *props, boolean_t exp);

	/* spare state (which is global across all pools) */
	extern void spa_spare_add(vdev_t *vd);
	extern void spa_spare_remove(vdev_t *vd);
	extern boolean_t spa_spare_exists(uint64_t guid, uint64_t pool, int refcnt);
	extern void spa_spare_activate(vdev_t *vd);

	/* L2ARC state (which is global across all pools) */
	extern void spa_l2cache_add(vdev_t *vd);
	extern void spa_l2cache_remove(vdev_t *vd);
	extern boolean_t spa_l2cache_exists(uint64_t guid, uint64_t *pool);
	extern void spa_l2cache_activate(vdev_t *vd);
	extern void spa_l2cache_drop(spa_t *spa);

	/* scanning */
	extern int spa_scan(spa_t *spa, pool_scan_func_t func);
	extern int spa_scan_stop(spa_t *spa);
	extern int spa_scrub_pause_resume(spa_t *spa, pool_scrub_cmd_t flag);

	/* spa syncing */
	extern void spa_sync(spa_t spa, uint64_t txg); / only for DMU use */
	extern void spa_sync_allpools(void);

	extern int zfs_sync_pass_deferred_free;

	/* spa namespace global mutex */
	extern kmutex_t spa_namespace_lock;

	/*
	* SPA configuration functions in spa_config.c
	*/

	#define SPA_CONFIG_UPDATE_POOL 0
	#define SPA_CONFIG_UPDATE_VDEVS 1

	extern void spa_write_cachefile(spa_t *, boolean_t, boolean_t);
	extern void spa_config_load(void);
	extern nvlist_t spa_all_configs(uint64_t );
	extern void spa_config_set(spa_t spa, nvlist_t config);
	extern nvlist_t spa_config_generate(spa_t spa, vdev_t *vd, uint64_t txg,
	int getstats);
	extern void spa_config_update(spa_t *spa, int what);
	extern int spa_config_parse(spa_t spa, vdev_t vdp, nvlist_t nv,
	vdev_t *parent, uint_t id, int atype);


	/*
	* Miscellaneous SPA routines in spa_misc.c
	*/

	/* Namespace manipulation */
	extern spa_t spa_lookup(const char name);
	extern spa_t spa_add(const char name, nvlist_t config, const char altroot);
	extern void spa_remove(spa_t *spa);
	extern spa_t spa_next(spa_t prev);

	/* Refcount functions */
	extern void spa_open_ref(spa_t spa, void tag);
	extern void spa_close(spa_t spa, void tag);
	extern void spa_async_close(spa_t spa, void tag);
	extern boolean_t spa_refcount_zero(spa_t *spa);

	#define SCL_NONE 0x00
	#define SCL_CONFIG 0x01
	#define SCL_STATE 0x02
	#define SCL_L2ARC 0x04 /* hack until L2ARC 2.0 */
	#define SCL_ALLOC 0x08
	#define SCL_ZIO 0x10
	#define SCL_FREE 0x20
	#define SCL_VDEV 0x40
	#define SCL_LOCKS 7
	#define SCL_ALL ((1 << SCL_LOCKS) - 1)
	#define SCL_STATE_ALL (SCL_STATE \| SCL_L2ARC \| SCL_ZIO)

	/* Historical pool statistics */
	typedef struct spa_history_kstat {
	kmutex_t lock;
	uint64_t count;
	uint64_t size;
	kstat_t *kstat;
	void *priv;
	list_t list;
	} spa_history_kstat_t;

	typedef struct spa_history_list {
	uint64_t size;
	procfs_list_t procfs_list;
	} spa_history_list_t;

	typedef struct spa_stats {
	spa_history_list_t read_history;
	spa_history_list_t txg_history;
	spa_history_kstat_t tx_assign_histogram;
	spa_history_kstat_t io_history;
	spa_history_list_t mmp_history;
	spa_history_kstat_t state; /* pool state */
	spa_history_kstat_t iostats;
	} spa_stats_t;

	typedef enum txg_state {
	TXG_STATE_BIRTH = 0,
	TXG_STATE_OPEN = 1,
	TXG_STATE_QUIESCED = 2,
	TXG_STATE_WAIT_FOR_SYNC = 3,
	TXG_STATE_SYNCED = 4,
	TXG_STATE_COMMITTED = 5,
	} txg_state_t;

	typedef struct txg_stat {
	vdev_stat_t vs1;
	vdev_stat_t vs2;
	uint64_t txg;
	uint64_t ndirty;
	} txg_stat_t;

	/* Assorted pool IO kstats */
	typedef struct spa_iostats {
	kstat_named_t trim_extents_written;
	kstat_named_t trim_bytes_written;
	kstat_named_t trim_extents_skipped;
	kstat_named_t trim_bytes_skipped;
	kstat_named_t trim_extents_failed;
	kstat_named_t trim_bytes_failed;
	kstat_named_t autotrim_extents_written;
	kstat_named_t autotrim_bytes_written;
	kstat_named_t autotrim_extents_skipped;
	kstat_named_t autotrim_bytes_skipped;
	kstat_named_t autotrim_extents_failed;
	kstat_named_t autotrim_bytes_failed;
	kstat_named_t simple_trim_extents_written;
	kstat_named_t simple_trim_bytes_written;
	kstat_named_t simple_trim_extents_skipped;
	kstat_named_t simple_trim_bytes_skipped;
	kstat_named_t simple_trim_extents_failed;
	kstat_named_t simple_trim_bytes_failed;
	} spa_iostats_t;

	extern void spa_stats_init(spa_t *spa);
	extern void spa_stats_destroy(spa_t *spa);
	extern void spa_read_history_add(spa_t spa, const zbookmark_phys_t zb,
	uint32_t aflags);
	extern void spa_txg_history_add(spa_t *spa, uint64_t txg, hrtime_t birth_time);
	extern int spa_txg_history_set(spa_t *spa, uint64_t txg,
	txg_state_t completed_state, hrtime_t completed_time);
	extern txg_stat_t spa_txg_history_init_io(spa_t , uint64_t,
	struct dsl_pool *);
	extern void spa_txg_history_fini_io(spa_t , txg_stat_t );
	extern void spa_tx_assign_add_nsecs(spa_t *spa, uint64_t nsecs);
	extern int spa_mmp_history_set_skip(spa_t *spa, uint64_t mmp_kstat_id);
	extern int spa_mmp_history_set(spa_t *spa, uint64_t mmp_kstat_id, int io_error,
	hrtime_t duration);
	extern void spa_mmp_history_add(spa_t *spa, uint64_t txg, uint64_t timestamp,
	uint64_t mmp_delay, vdev_t *vd, int label, uint64_t mmp_kstat_id,
	int error);
	extern void spa_iostats_trim_add(spa_t *spa, trim_type_t type,
	uint64_t extents_written, uint64_t bytes_written,
	uint64_t extents_skipped, uint64_t bytes_skipped,
	uint64_t extents_failed, uint64_t bytes_failed);
	extern void spa_import_progress_add(spa_t *spa);
	extern void spa_import_progress_remove(uint64_t spa_guid);
	extern int spa_import_progress_set_mmp_check(uint64_t pool_guid,
	uint64_t mmp_sec_remaining);
	extern int spa_import_progress_set_max_txg(uint64_t pool_guid,
	uint64_t max_txg);
	extern int spa_import_progress_set_state(uint64_t pool_guid,
	spa_load_state_t spa_load_state);

	/* Pool configuration locks */
	extern int spa_config_tryenter(spa_t spa, int locks, void tag, krw_t rw);
	extern void spa_config_enter(spa_t spa, int locks, const void tag, krw_t rw);
	extern void spa_config_exit(spa_t spa, int locks, const void tag);
	extern int spa_config_held(spa_t *spa, int locks, krw_t rw);

	/* Pool vdev add/remove lock */
	extern uint64_t spa_vdev_enter(spa_t *spa);
	extern uint64_t spa_vdev_detach_enter(spa_t *spa, uint64_t guid);
	extern uint64_t spa_vdev_config_enter(spa_t *spa);
	extern void spa_vdev_config_exit(spa_t spa, vdev_t vd, uint64_t txg,
	int error, char *tag);
	extern int spa_vdev_exit(spa_t spa, vdev_t vd, uint64_t txg, int error);

	/* Pool vdev state change lock */
	extern void spa_vdev_state_enter(spa_t *spa, int oplock);
	extern int spa_vdev_state_exit(spa_t spa, vdev_t vd, int error);

	/* Log state */
	typedef enum spa_log_state {
	SPA_LOG_UNKNOWN = 0, /* unknown log state */
	SPA_LOG_MISSING, /* missing log(s) */
	SPA_LOG_CLEAR, /* clear the log(s) */
	SPA_LOG_GOOD, /* log(s) are good */
	} spa_log_state_t;

	extern spa_log_state_t spa_get_log_state(spa_t *spa);
	extern void spa_set_log_state(spa_t *spa, spa_log_state_t state);
	extern int spa_reset_logs(spa_t *spa);

	/* Log claim callback */
	extern void spa_claim_notify(zio_t *zio);
	extern void spa_deadman(void *);

	/* Accessor functions */
	extern boolean_t spa_shutting_down(spa_t *spa);
	extern struct dsl_pool spa_get_dsl(spa_t spa);
	extern boolean_t spa_is_initializing(spa_t *spa);
	extern boolean_t spa_indirect_vdevs_loaded(spa_t *spa);
	extern blkptr_t spa_get_rootblkptr(spa_t spa);
	extern void spa_set_rootblkptr(spa_t spa, const blkptr_t bp);
	extern void spa_altroot(spa_t , char , size_t);
	extern int spa_sync_pass(spa_t *spa);
	extern char spa_name(spa_t spa);
	extern uint64_t spa_guid(spa_t *spa);
	extern uint64_t spa_load_guid(spa_t *spa);
	extern uint64_t spa_last_synced_txg(spa_t *spa);
	extern uint64_t spa_first_txg(spa_t *spa);
	extern uint64_t spa_syncing_txg(spa_t *spa);
	extern uint64_t spa_final_dirty_txg(spa_t *spa);
	extern uint64_t spa_version(spa_t *spa);
	extern pool_state_t spa_state(spa_t *spa);
	extern spa_load_state_t spa_load_state(spa_t *spa);
	extern uint64_t spa_freeze_txg(spa_t *spa);
	extern uint64_t spa_get_worst_case_asize(spa_t *spa, uint64_t lsize);
	extern uint64_t spa_get_dspace(spa_t *spa);
	extern uint64_t spa_get_checkpoint_space(spa_t *spa);
	extern uint64_t spa_get_slop_space(spa_t *spa);
	extern void spa_update_dspace(spa_t *spa);
	extern uint64_t spa_version(spa_t *spa);
	extern boolean_t spa_deflate(spa_t *spa);
	extern metaslab_class_t spa_normal_class(spa_t spa);
	extern metaslab_class_t spa_log_class(spa_t spa);
	extern metaslab_class_t spa_special_class(spa_t spa);
	extern metaslab_class_t spa_dedup_class(spa_t spa);
	extern metaslab_class_t spa_preferred_class(spa_t spa, uint64_t size,
	dmu_object_type_t objtype, uint_t level, uint_t special_smallblk);

	extern void spa_evicting_os_register(spa_t , objset_t os);
	extern void spa_evicting_os_deregister(spa_t , objset_t os);
	extern void spa_evicting_os_wait(spa_t *spa);
	extern int spa_max_replication(spa_t *spa);
	extern int spa_prev_software_version(spa_t *spa);
	extern uint64_t spa_get_failmode(spa_t *spa);
	extern uint64_t spa_get_deadman_failmode(spa_t *spa);
	extern void spa_set_deadman_failmode(spa_t spa, const char failmode);
	extern boolean_t spa_suspended(spa_t *spa);
	extern uint64_t spa_bootfs(spa_t *spa);
	extern uint64_t spa_delegation(spa_t *spa);
	extern objset_t spa_meta_objset(spa_t spa);
	extern space_map_t spa_syncing_log_sm(spa_t spa);
	extern uint64_t spa_deadman_synctime(spa_t *spa);
	extern uint64_t spa_deadman_ziotime(spa_t *spa);
	extern uint64_t spa_dirty_data(spa_t *spa);
	extern spa_autotrim_t spa_get_autotrim(spa_t *spa);

	/* Miscellaneous support routines */
	extern void spa_load_failed(spa_t spa, const char fmt, ...);
	extern void spa_load_note(spa_t spa, const char fmt, ...);
	extern void spa_activate_mos_feature(spa_t spa, const char feature,
	dmu_tx_t *tx);
	extern void spa_deactivate_mos_feature(spa_t spa, const char feature);
	extern spa_t *spa_by_guid(uint64_t pool_guid, uint64_t device_guid);
	extern boolean_t spa_guid_exists(uint64_t pool_guid, uint64_t device_guid);
	extern char spa_strdup(const char );
	extern void spa_strfree(char *);
	extern uint64_t spa_get_random(uint64_t range);
	extern uint64_t spa_generate_guid(spa_t *spa);
	extern void snprintf_blkptr(char buf, size_t buflen, const blkptr_t bp);
	extern void spa_freeze(spa_t *spa);
	extern int spa_change_guid(spa_t *spa);
	extern void spa_upgrade(spa_t *spa, uint64_t version);
	extern void spa_evict_all(void);
	extern vdev_t spa_lookup_by_guid(spa_t spa, uint64_t guid,
	boolean_t l2cache);
	extern boolean_t spa_has_spare(spa_t *, uint64_t guid);
	extern uint64_t dva_get_dsize_sync(spa_t spa, const dva_t dva);
	extern uint64_t bp_get_dsize_sync(spa_t spa, const blkptr_t bp);
	extern uint64_t bp_get_dsize(spa_t spa, const blkptr_t bp);
	extern boolean_t spa_has_slogs(spa_t *spa);
	extern boolean_t spa_is_root(spa_t *spa);
	extern boolean_t spa_writeable(spa_t *spa);
	extern boolean_t spa_has_pending_synctask(spa_t *spa);
	extern int spa_maxblocksize(spa_t *spa);
	extern int spa_maxdnodesize(spa_t *spa);
	extern boolean_t spa_has_checkpoint(spa_t *spa);
	extern boolean_t spa_importing_readonly_checkpoint(spa_t *spa);
	extern boolean_t spa_suspend_async_destroy(spa_t *spa);
	extern uint64_t spa_min_claim_txg(spa_t *spa);
	extern boolean_t zfs_dva_valid(spa_t spa, const dva_t dva,
	const blkptr_t *bp);
	typedef void (*spa_remap_cb_t)(uint64_t vdev, uint64_t offset, uint64_t size,
	void *arg);
	extern boolean_t spa_remap_blkptr(spa_t spa, blkptr_t bp,
	spa_remap_cb_t callback, void *arg);
	extern uint64_t spa_get_last_removal_txg(spa_t *spa);
	extern boolean_t spa_trust_config(spa_t *spa);
	extern uint64_t spa_missing_tvds_allowed(spa_t *spa);
	extern void spa_set_missing_tvds(spa_t *spa, uint64_t missing);
	extern boolean_t spa_top_vdevs_spacemap_addressable(spa_t *spa);
	extern uint64_t spa_total_metaslabs(spa_t *spa);
	extern boolean_t spa_multihost(spa_t *spa);
	extern uint32_t spa_get_hostid(spa_t *spa);
	extern void spa_activate_allocation_classes(spa_t , dmu_tx_t );
	extern boolean_t spa_livelist_delete_check(spa_t *spa);

	extern spa_mode_t spa_mode(spa_t *spa);
	extern uint64_t zfs_strtonum(const char str, char *nptr);

	extern char *spa_his_ievent_table[];

	extern void spa_history_create_obj(spa_t spa, dmu_tx_t tx);
	extern int spa_history_get(spa_t spa, uint64_t offset, uint64_t *len_read,
	char *his_buf);
	extern int spa_history_log(spa_t spa, const char his_buf);
	extern int spa_history_log_nvl(spa_t spa, nvlist_t nvl);
	extern void spa_history_log_version(spa_t spa, const char operation,
	dmu_tx_t *tx);
	extern void spa_history_log_internal(spa_t spa, const char operation,
	dmu_tx_t tx, const char fmt, ...) __printflike(4, 5);
	extern void spa_history_log_internal_ds(struct dsl_dataset ds, const char op,
	dmu_tx_t tx, const char fmt, ...) __printflike(4, 5);
	extern void spa_history_log_internal_dd(dsl_dir_t dd, const char operation,
	dmu_tx_t tx, const char fmt, ...) __printflike(4, 5);

	extern const char spa_state_to_name(spa_t spa);

	/* error handling */
	struct zbookmark_phys;
	extern void spa_log_error(spa_t spa, const zbookmark_phys_t zb);
	extern int zfs_ereport_post(const char clazz, spa_t spa, vdev_t *vd,
	- const zbookmark_phys_t zb, zio_t zio, uint64_t stateoroffset,
	- uint64_t length);
	+ const zbookmark_phys_t zb, zio_t zio, uint64_t state);
	extern boolean_t zfs_ereport_is_valid(const char clazz, spa_t spa, vdev_t *vd,
	zio_t *zio);
	+extern void zfs_ereport_taskq_fini(void);
	extern nvlist_t zfs_event_create(spa_t spa, vdev_t vd, const char type,
	const char name, nvlist_t aux);
	extern void zfs_post_remove(spa_t spa, vdev_t vd);
	extern void zfs_post_state_change(spa_t spa, vdev_t vd, uint64_t laststate);
	extern void zfs_post_autoreplace(spa_t spa, vdev_t vd);
	extern uint64_t spa_get_errlog_size(spa_t *spa);
	extern int spa_get_errlog(spa_t spa, void uaddr, size_t *count);
	extern void spa_errlog_rotate(spa_t *spa);
	extern void spa_errlog_drain(spa_t *spa);
	extern void spa_errlog_sync(spa_t *spa, uint64_t txg);
	extern void spa_get_errlists(spa_t spa, avl_tree_t last, avl_tree_t *scrub);

	/* vdev cache */
	extern void vdev_cache_stat_init(void);
	extern void vdev_cache_stat_fini(void);

	/* vdev mirror */
	extern void vdev_mirror_stat_init(void);
	extern void vdev_mirror_stat_fini(void);

	/* Initialization and termination */
	extern void spa_init(spa_mode_t mode);
	extern void spa_fini(void);
	extern void spa_boot_init(void);

	/* properties */
	extern int spa_prop_set(spa_t spa, nvlist_t nvp);
	extern int spa_prop_get(spa_t spa, nvlist_t *nvp);
	extern void spa_prop_clear_bootfs(spa_t spa, uint64_t obj, dmu_tx_t tx);
	extern void spa_configfile_set(spa_t , nvlist_t , boolean_t);

	/* asynchronous event notification */
	extern void spa_event_notify(spa_t spa, vdev_t vdev, nvlist_t *hist_nvl,
	const char *name);

	/* waiting for pool activities to complete */
	extern int spa_wait(const char *pool, zpool_wait_activity_t activity,
	boolean_t *waited);
	extern int spa_wait_tag(const char *name, zpool_wait_activity_t activity,
	uint64_t tag, boolean_t *waited);
	extern void spa_notify_waiters(spa_t *spa);
	extern void spa_wake_waiters(spa_t *spa);

	/* module param call functions */
	int param_set_deadman_ziotime(ZFS_MODULE_PARAM_ARGS);
	int param_set_deadman_synctime(ZFS_MODULE_PARAM_ARGS);
	int param_set_slop_shift(ZFS_MODULE_PARAM_ARGS);
	int param_set_deadman_failmode(ZFS_MODULE_PARAM_ARGS);

	#ifdef ZFS_DEBUG
	#define dprintf_bp(bp, fmt, ...) do { \
	if (zfs_flags & ZFS_DEBUG_DPRINTF) { \
	char *__blkbuf = kmem_alloc(BP_SPRINTF_LEN, KM_SLEEP); \
	snprintf_blkptr(__blkbuf, BP_SPRINTF_LEN, (bp)); \
	dprintf(fmt " %s\n", __VA_ARGS__, __blkbuf); \
	kmem_free(__blkbuf, BP_SPRINTF_LEN); \
	} \
	_NOTE(CONSTCOND) } while (0)
	#else
	#define dprintf_bp(bp, fmt, ...)
	#endif

	extern spa_mode_t spa_mode_global;
	extern int zfs_deadman_enabled;
	extern unsigned long zfs_deadman_synctime_ms;
	extern unsigned long zfs_deadman_ziotime_ms;
	extern unsigned long zfs_deadman_checktime_ms;

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_SPA_H */
	Index: vendor-sys/openzfs/dist/include/sys/vdev.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/vdev.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/vdev.h (revision 365892)
	@@ -1,201 +1,200 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2017, Intel Corporation.
	* Copyright (c) 2019, Datto Inc. All rights reserved.
	*/

	#ifndef _SYS_VDEV_H
	#define _SYS_VDEV_H

	#include <sys/spa.h>
	#include <sys/zio.h>
	#include <sys/dmu.h>
	#include <sys/space_map.h>
	#include <sys/fs/zfs.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	typedef enum vdev_dtl_type {
	DTL_MISSING, /* 0% replication: no copies of the data */
	DTL_PARTIAL, /* less than 100% replication: some copies missing */
	DTL_SCRUB, /* unable to fully repair during scrub/resilver */
	DTL_OUTAGE, /* temporarily missing (used to attempt detach) */
	DTL_TYPES
	} vdev_dtl_type_t;

	extern int zfs_nocacheflush;

	extern void vdev_dbgmsg(vdev_t vd, const char fmt, ...);
	extern void vdev_dbgmsg_print_tree(vdev_t *, int);
	extern int vdev_open(vdev_t *);
	extern void vdev_open_children(vdev_t *);
	extern int vdev_validate(vdev_t *);
	extern int vdev_copy_path_strict(vdev_t , vdev_t );
	extern void vdev_copy_path_relaxed(vdev_t , vdev_t );
	extern void vdev_close(vdev_t *);
	extern int vdev_create(vdev_t *, uint64_t txg, boolean_t isreplace);
	extern void vdev_reopen(vdev_t *);
	extern int vdev_validate_aux(vdev_t *vd);
	extern zio_t vdev_probe(vdev_t vd, zio_t *pio);
	extern boolean_t vdev_is_concrete(vdev_t *vd);
	extern boolean_t vdev_is_bootable(vdev_t *vd);
	extern vdev_t vdev_lookup_top(spa_t spa, uint64_t vdev);
	extern vdev_t vdev_lookup_by_guid(vdev_t vd, uint64_t guid);
	extern int vdev_count_leaves(spa_t *spa);
	extern void vdev_dtl_dirty(vdev_t *vd, vdev_dtl_type_t d,
	uint64_t txg, uint64_t size);
	extern boolean_t vdev_dtl_contains(vdev_t *vd, vdev_dtl_type_t d,
	uint64_t txg, uint64_t size);
	extern boolean_t vdev_dtl_empty(vdev_t *vd, vdev_dtl_type_t d);
	extern boolean_t vdev_dtl_need_resilver(vdev_t *vd, uint64_t off, size_t size);
	extern void vdev_dtl_reassess(vdev_t *vd, uint64_t txg, uint64_t scrub_txg,
	boolean_t scrub_done, boolean_t rebuild_done);
	extern boolean_t vdev_dtl_required(vdev_t *vd);
	extern boolean_t vdev_resilver_needed(vdev_t *vd,
	uint64_t minp, uint64_t maxp);
	extern void vdev_destroy_unlink_zap(vdev_t *vd, uint64_t zapobj,
	dmu_tx_t *tx);
	extern uint64_t vdev_create_link_zap(vdev_t vd, dmu_tx_t tx);
	extern void vdev_construct_zaps(vdev_t vd, dmu_tx_t tx);
	extern void vdev_destroy_spacemaps(vdev_t vd, dmu_tx_t tx);
	extern void vdev_indirect_mark_obsolete(vdev_t *vd, uint64_t offset,
	uint64_t size);
	extern void spa_vdev_indirect_mark_obsolete(spa_t *spa, uint64_t vdev,
	uint64_t offset, uint64_t size, dmu_tx_t *tx);
	extern boolean_t vdev_replace_in_progress(vdev_t *vdev);

	extern void vdev_hold(vdev_t *);
	extern void vdev_rele(vdev_t *);

	extern int vdev_metaslab_init(vdev_t *vd, uint64_t txg);
	extern void vdev_metaslab_fini(vdev_t *vd);
	extern void vdev_metaslab_set_size(vdev_t *);
	-extern void vdev_ashift_optimize(vdev_t *);
	extern void vdev_expand(vdev_t *vd, uint64_t txg);
	extern void vdev_split(vdev_t *vd);
	extern void vdev_deadman(vdev_t vd, char tag);
	extern void vdev_xlate(vdev_t vd, const range_seg64_t logical_rs,
	range_seg64_t *physical_rs);

	extern void vdev_get_stats_ex(vdev_t vd, vdev_stat_t vs, vdev_stat_ex_t *vsx);
	extern void vdev_get_stats(vdev_t vd, vdev_stat_t vs);
	extern void vdev_clear_stats(vdev_t *vd);
	extern void vdev_stat_update(zio_t *zio, uint64_t psize);
	extern void vdev_scan_stat_init(vdev_t *vd);
	extern void vdev_propagate_state(vdev_t *vd);
	extern void vdev_set_state(vdev_t *vd, boolean_t isopen, vdev_state_t state,
	vdev_aux_t aux);
	extern boolean_t vdev_children_are_offline(vdev_t *vd);

	extern void vdev_space_update(vdev_t *vd,
	int64_t alloc_delta, int64_t defer_delta, int64_t space_delta);

	extern int64_t vdev_deflated_space(vdev_t *vd, int64_t space);

	extern uint64_t vdev_psize_to_asize(vdev_t *vd, uint64_t psize);

	extern int vdev_fault(spa_t *spa, uint64_t guid, vdev_aux_t aux);
	extern int vdev_degrade(spa_t *spa, uint64_t guid, vdev_aux_t aux);
	extern int vdev_online(spa_t *spa, uint64_t guid, uint64_t flags,
	vdev_state_t *);
	extern int vdev_offline(spa_t *spa, uint64_t guid, uint64_t flags);
	extern void vdev_clear(spa_t spa, vdev_t vd);

	extern boolean_t vdev_is_dead(vdev_t *vd);
	extern boolean_t vdev_readable(vdev_t *vd);
	extern boolean_t vdev_writeable(vdev_t *vd);
	extern boolean_t vdev_allocatable(vdev_t *vd);
	extern boolean_t vdev_accessible(vdev_t vd, zio_t zio);
	extern boolean_t vdev_is_spacemap_addressable(vdev_t *vd);

	extern void vdev_cache_init(vdev_t *vd);
	extern void vdev_cache_fini(vdev_t *vd);
	extern boolean_t vdev_cache_read(zio_t *zio);
	extern void vdev_cache_write(zio_t *zio);
	extern void vdev_cache_purge(vdev_t *vd);

	extern void vdev_queue_init(vdev_t *vd);
	extern void vdev_queue_fini(vdev_t *vd);
	extern zio_t vdev_queue_io(zio_t zio);
	extern void vdev_queue_io_done(zio_t *zio);
	extern void vdev_queue_change_io_priority(zio_t *zio, zio_priority_t priority);

	extern int vdev_queue_length(vdev_t *vd);
	extern uint64_t vdev_queue_last_offset(vdev_t *vd);

	extern void vdev_config_dirty(vdev_t *vd);
	extern void vdev_config_clean(vdev_t *vd);
	extern int vdev_config_sync(vdev_t **svd, int svdcount, uint64_t txg);

	extern void vdev_state_dirty(vdev_t *vd);
	extern void vdev_state_clean(vdev_t *vd);

	extern void vdev_defer_resilver(vdev_t *vd);
	extern boolean_t vdev_clear_resilver_deferred(vdev_t vd, dmu_tx_t tx);

	typedef enum vdev_config_flag {
	VDEV_CONFIG_SPARE = 1 << 0,
	VDEV_CONFIG_L2CACHE = 1 << 1,
	VDEV_CONFIG_REMOVING = 1 << 2,
	VDEV_CONFIG_MOS = 1 << 3,
	VDEV_CONFIG_MISSING = 1 << 4
	} vdev_config_flag_t;

	extern void vdev_top_config_generate(spa_t spa, nvlist_t config);
	extern nvlist_t vdev_config_generate(spa_t spa, vdev_t *vd,
	boolean_t getstats, vdev_config_flag_t flags);

	/*
	* Label routines
	*/
	struct uberblock;
	extern uint64_t vdev_label_offset(uint64_t psize, int l, uint64_t offset);
	extern int vdev_label_number(uint64_t psise, uint64_t offset);
	extern nvlist_t vdev_label_read_config(vdev_t vd, uint64_t txg);
	extern void vdev_uberblock_load(vdev_t , struct uberblock , nvlist_t **);
	extern void vdev_config_generate_stats(vdev_t vd, nvlist_t nv);
	extern void vdev_label_write(zio_t zio, vdev_t vd, int l, abd_t *buf, uint64_t
	offset, uint64_t size, zio_done_func_t done, void priv, int flags);
	extern int vdev_label_read_bootenv(vdev_t , nvlist_t );
	-extern int vdev_label_write_bootenv(vdev_t , char );
	+extern int vdev_label_write_bootenv(vdev_t , nvlist_t );

	typedef enum {
	VDEV_LABEL_CREATE, /* create/add a new device */
	VDEV_LABEL_REPLACE, /* replace an existing device */
	VDEV_LABEL_SPARE, /* add a new hot spare */
	VDEV_LABEL_REMOVE, /* remove an existing device */
	VDEV_LABEL_L2CACHE, /* add an L2ARC cache device */
	VDEV_LABEL_SPLIT /* generating new label for split-off dev */
	} vdev_labeltype_t;

	extern int vdev_label_init(vdev_t *vd, uint64_t txg, vdev_labeltype_t reason);

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_VDEV_H */
	Index: vendor-sys/openzfs/dist/include/sys/vdev_impl.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/vdev_impl.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/vdev_impl.h (revision 365892)
	@@ -1,620 +1,629 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2017, Intel Corporation.
	*/

	#ifndef _SYS_VDEV_IMPL_H
	#define _SYS_VDEV_IMPL_H

	#include <sys/avl.h>
	#include <sys/bpobj.h>
	#include <sys/dmu.h>
	#include <sys/metaslab.h>
	#include <sys/nvpair.h>
	#include <sys/space_map.h>
	#include <sys/vdev.h>
	#include <sys/dkio.h>
	#include <sys/uberblock_impl.h>
	#include <sys/vdev_indirect_mapping.h>
	#include <sys/vdev_indirect_births.h>
	#include <sys/vdev_rebuild.h>
	#include <sys/vdev_removal.h>
	#include <sys/zfs_ratelimit.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	/*
	* Virtual device descriptors.
	*
	* All storage pool operations go through the virtual device framework,
	* which provides data replication and I/O scheduling.
	*/

	/*
	* Forward declarations that lots of things need.
	*/
	typedef struct vdev_queue vdev_queue_t;
	typedef struct vdev_cache vdev_cache_t;
	typedef struct vdev_cache_entry vdev_cache_entry_t;
	struct abd;

	extern int zfs_vdev_queue_depth_pct;
	extern int zfs_vdev_def_queue_depth;
	extern uint32_t zfs_vdev_async_write_max_active;

	/*
	* Virtual device operations
	*/
	typedef int vdev_open_func_t(vdev_t vd, uint64_t size, uint64_t *max_size,
	uint64_t ashift, uint64_t pshift);
	typedef void vdev_close_func_t(vdev_t *vd);
	typedef uint64_t vdev_asize_func_t(vdev_t *vd, uint64_t psize);
	typedef void vdev_io_start_func_t(zio_t *zio);
	typedef void vdev_io_done_func_t(zio_t *zio);
	typedef void vdev_state_change_func_t(vdev_t *vd, int, int);
	typedef boolean_t vdev_need_resilver_func_t(vdev_t *vd, uint64_t, size_t);
	typedef void vdev_hold_func_t(vdev_t *vd);
	typedef void vdev_rele_func_t(vdev_t *vd);

	typedef void vdev_remap_cb_t(uint64_t inner_offset, vdev_t *vd,
	uint64_t offset, uint64_t size, void *arg);
	typedef void vdev_remap_func_t(vdev_t *vd, uint64_t offset, uint64_t size,
	vdev_remap_cb_t callback, void *arg);
	/*
	* Given a target vdev, translates the logical range "in" to the physical
	* range "res"
	*/
	typedef void vdev_xlation_func_t(vdev_t cvd, const range_seg64_t in,
	range_seg64_t *res);

	typedef const struct vdev_ops {
	vdev_open_func_t *vdev_op_open;
	vdev_close_func_t *vdev_op_close;
	vdev_asize_func_t *vdev_op_asize;
	vdev_io_start_func_t *vdev_op_io_start;
	vdev_io_done_func_t *vdev_op_io_done;
	vdev_state_change_func_t *vdev_op_state_change;
	vdev_need_resilver_func_t *vdev_op_need_resilver;
	vdev_hold_func_t *vdev_op_hold;
	vdev_rele_func_t *vdev_op_rele;
	vdev_remap_func_t *vdev_op_remap;
	/*
	* For translating ranges from non-leaf vdevs (e.g. raidz) to leaves.
	* Used when initializing vdevs. Isn't used by leaf ops.
	*/
	vdev_xlation_func_t *vdev_op_xlate;
	char vdev_op_type[16];
	boolean_t vdev_op_leaf;
	} vdev_ops_t;

	/*
	* Virtual device properties
	*/
	struct vdev_cache_entry {
	struct abd *ve_abd;
	uint64_t ve_offset;
	clock_t ve_lastused;
	avl_node_t ve_offset_node;
	avl_node_t ve_lastused_node;
	uint32_t ve_hits;
	uint16_t ve_missed_update;
	zio_t *ve_fill_io;
	};

	struct vdev_cache {
	avl_tree_t vc_offset_tree;
	avl_tree_t vc_lastused_tree;
	kmutex_t vc_lock;
	};

	typedef struct vdev_queue_class {
	uint32_t vqc_active;

	/*
	* Sorted by offset or timestamp, depending on if the queue is
	* LBA-ordered vs FIFO.
	*/
	avl_tree_t vqc_queued_tree;
	} vdev_queue_class_t;

	struct vdev_queue {
	vdev_t *vq_vdev;
	vdev_queue_class_t vq_class[ZIO_PRIORITY_NUM_QUEUEABLE];
	avl_tree_t vq_active_tree;
	avl_tree_t vq_read_offset_tree;
	avl_tree_t vq_write_offset_tree;
	avl_tree_t vq_trim_offset_tree;
	uint64_t vq_last_offset;
	hrtime_t vq_io_complete_ts; /* time last i/o completed */
	hrtime_t vq_io_delta_ts;
	zio_t vq_io_search; /* used as local for stack reduction */
	kmutex_t vq_lock;
	};

	typedef enum vdev_alloc_bias {
	VDEV_BIAS_NONE,
	VDEV_BIAS_LOG, /* dedicated to ZIL data (SLOG) */
	VDEV_BIAS_SPECIAL, /* dedicated to ddt, metadata, and small blks */
	VDEV_BIAS_DEDUP /* dedicated to dedup metadata */
	} vdev_alloc_bias_t;


	/*
	* On-disk indirect vdev state.
	*
	* An indirect vdev is described exclusively in the MOS config of a pool.
	* The config for an indirect vdev includes several fields, which are
	* accessed in memory by a vdev_indirect_config_t.
	*/
	typedef struct vdev_indirect_config {
	/*
	* Object (in MOS) which contains the indirect mapping. This object
	* contains an array of vdev_indirect_mapping_entry_phys_t ordered by
	* vimep_src. The bonus buffer for this object is a
	* vdev_indirect_mapping_phys_t. This object is allocated when a vdev
	* removal is initiated.
	*
	* Note that this object can be empty if none of the data on the vdev
	* has been copied yet.
	*/
	uint64_t vic_mapping_object;

	/*
	* Object (in MOS) which contains the birth times for the mapping
	* entries. This object contains an array of
	* vdev_indirect_birth_entry_phys_t sorted by vibe_offset. The bonus
	* buffer for this object is a vdev_indirect_birth_phys_t. This object
	* is allocated when a vdev removal is initiated.
	*
	* Note that this object can be empty if none of the vdev has yet been
	* copied.
	*/
	uint64_t vic_births_object;

	/*
	* This is the vdev ID which was removed previous to this vdev, or
	* UINT64_MAX if there are no previously removed vdevs.
	*/
	uint64_t vic_prev_indirect_vdev;
	} vdev_indirect_config_t;

	/*
	* Virtual device descriptor
	*/
	struct vdev {
	/*
	* Common to all vdev types.
	*/
	uint64_t vdev_id; /* child number in vdev parent */
	uint64_t vdev_guid; /* unique ID for this vdev */
	uint64_t vdev_guid_sum; /* self guid + all child guids */
	uint64_t vdev_orig_guid; /* orig. guid prior to remove */
	uint64_t vdev_asize; /* allocatable device capacity */
	uint64_t vdev_min_asize; /* min acceptable asize */
	uint64_t vdev_max_asize; /* max acceptable asize */
	uint64_t vdev_ashift; /* block alignment shift */

	/*
	* Logical block alignment shift
	*
	* The smallest sized/aligned I/O supported by the device.
	*/
	uint64_t vdev_logical_ashift;
	/*
	* Physical block alignment shift
	*
	* The device supports logical I/Os with vdev_logical_ashift
	* size/alignment, but optimum performance will be achieved by
	* aligning/sizing requests to vdev_physical_ashift. Smaller
	* requests may be inflated or incur device level read-modify-write
	* operations.
	*
	* May be 0 to indicate no preference (i.e. use vdev_logical_ashift).
	*/
	uint64_t vdev_physical_ashift;
	uint64_t vdev_state; /* see VDEV_STATE_* #defines */
	uint64_t vdev_prevstate; /* used when reopening a vdev */
	vdev_ops_t vdev_ops; / vdev operations */
	spa_t vdev_spa; / spa for this vdev */
	void vdev_tsd; / type-specific data */
	vdev_t vdev_top; / top-level vdev */
	vdev_t vdev_parent; / parent vdev */
	vdev_t *vdev_child; / array of children */
	uint64_t vdev_children; /* number of children */
	vdev_stat_t vdev_stat; /* virtual device statistics */
	vdev_stat_ex_t vdev_stat_ex; /* extended statistics */
	boolean_t vdev_expanding; /* expand the vdev? */
	boolean_t vdev_reopening; /* reopen in progress? */
	boolean_t vdev_nonrot; /* true if solid state */
	int vdev_open_error; /* error on last open */
	kthread_t vdev_open_thread; / thread opening children */
	uint64_t vdev_crtxg; /* txg when top-level was added */

	/*
	* Top-level vdev state.
	*/
	uint64_t vdev_ms_array; /* metaslab array object */
	uint64_t vdev_ms_shift; /* metaslab size shift */
	uint64_t vdev_ms_count; /* number of metaslabs */
	metaslab_group_t vdev_mg; / metaslab group */
	metaslab_t *vdev_ms; / metaslab array */
	uint64_t vdev_pending_fastwrite; /* allocated fastwrites */
	txg_list_t vdev_ms_list; /* per-txg dirty metaslab lists */
	txg_list_t vdev_dtl_list; /* per-txg dirty DTL lists */
	txg_node_t vdev_txg_node; /* per-txg dirty vdev linkage */
	boolean_t vdev_remove_wanted; /* async remove wanted? */
	boolean_t vdev_probe_wanted; /* async probe wanted? */
	list_node_t vdev_config_dirty_node; /* config dirty list */
	list_node_t vdev_state_dirty_node; /* state dirty list */
	uint64_t vdev_deflate_ratio; /* deflation ratio (x512) */
	uint64_t vdev_islog; /* is an intent log device */
	uint64_t vdev_removing; /* device is being removed? */
	boolean_t vdev_ishole; /* is a hole in the namespace */
	uint64_t vdev_top_zap;
	vdev_alloc_bias_t vdev_alloc_bias; /* metaslab allocation bias */

	/* pool checkpoint related */
	space_map_t vdev_checkpoint_sm; / contains reserved blocks */

	/* Initialize related */
	boolean_t vdev_initialize_exit_wanted;
	vdev_initializing_state_t vdev_initialize_state;
	list_node_t vdev_initialize_node;
	kthread_t *vdev_initialize_thread;
	/* Protects vdev_initialize_thread and vdev_initialize_state. */
	kmutex_t vdev_initialize_lock;
	kcondvar_t vdev_initialize_cv;
	uint64_t vdev_initialize_offset[TXG_SIZE];
	uint64_t vdev_initialize_last_offset;
	range_tree_t vdev_initialize_tree; / valid while initializing */
	uint64_t vdev_initialize_bytes_est;
	uint64_t vdev_initialize_bytes_done;
	uint64_t vdev_initialize_action_time; /* start and end time */

	/* TRIM related */
	boolean_t vdev_trim_exit_wanted;
	boolean_t vdev_autotrim_exit_wanted;
	vdev_trim_state_t vdev_trim_state;
	list_node_t vdev_trim_node;
	kmutex_t vdev_autotrim_lock;
	kcondvar_t vdev_autotrim_cv;
	kthread_t *vdev_autotrim_thread;
	/* Protects vdev_trim_thread and vdev_trim_state. */
	kmutex_t vdev_trim_lock;
	kcondvar_t vdev_trim_cv;
	kthread_t *vdev_trim_thread;
	uint64_t vdev_trim_offset[TXG_SIZE];
	uint64_t vdev_trim_last_offset;
	uint64_t vdev_trim_bytes_est;
	uint64_t vdev_trim_bytes_done;
	uint64_t vdev_trim_rate; /* requested rate (bytes/sec) */
	uint64_t vdev_trim_partial; /* requested partial TRIM */
	uint64_t vdev_trim_secure; /* requested secure TRIM */
	uint64_t vdev_trim_action_time; /* start and end time */

	/* Rebuild related */
	boolean_t vdev_rebuilding;
	boolean_t vdev_rebuild_exit_wanted;
	boolean_t vdev_rebuild_cancel_wanted;
	boolean_t vdev_rebuild_reset_wanted;
	kmutex_t vdev_rebuild_lock;
	kcondvar_t vdev_rebuild_cv;
	kthread_t *vdev_rebuild_thread;
	vdev_rebuild_t vdev_rebuild_config;

	/* For limiting outstanding I/Os (initialize, TRIM, rebuild) */
	kmutex_t vdev_initialize_io_lock;
	kcondvar_t vdev_initialize_io_cv;
	uint64_t vdev_initialize_inflight;
	kmutex_t vdev_trim_io_lock;
	kcondvar_t vdev_trim_io_cv;
	uint64_t vdev_trim_inflight[3];
	kmutex_t vdev_rebuild_io_lock;
	kcondvar_t vdev_rebuild_io_cv;
	uint64_t vdev_rebuild_inflight;

	/*
	* Values stored in the config for an indirect or removing vdev.
	*/
	vdev_indirect_config_t vdev_indirect_config;

	/*
	* The vdev_indirect_rwlock protects the vdev_indirect_mapping
	* pointer from changing on indirect vdevs (when it is condensed).
	* Note that removing (not yet indirect) vdevs have different
	* access patterns (the mapping is not accessed from open context,
	* e.g. from zio_read) and locking strategy (e.g. svr_lock).
	*/
	krwlock_t vdev_indirect_rwlock;
	vdev_indirect_mapping_t *vdev_indirect_mapping;
	vdev_indirect_births_t *vdev_indirect_births;

	/*
	* In memory data structures used to manage the obsolete sm, for
	* indirect or removing vdevs.
	*
	* The vdev_obsolete_segments is the in-core record of the segments
	* that are no longer referenced anywhere in the pool (due to
	* being freed or remapped and not referenced by any snapshots).
	* During a sync, segments are added to vdev_obsolete_segments
	* via vdev_indirect_mark_obsolete(); at the end of each sync
	* pass, this is appended to vdev_obsolete_sm via
	* vdev_indirect_sync_obsolete(). The vdev_obsolete_lock
	* protects against concurrent modifications of vdev_obsolete_segments
	* from multiple zio threads.
	*/
	kmutex_t vdev_obsolete_lock;
	range_tree_t *vdev_obsolete_segments;
	space_map_t *vdev_obsolete_sm;

	/*
	* Protects the vdev_scan_io_queue field itself as well as the
	* structure's contents (when present).
	*/
	kmutex_t vdev_scan_io_queue_lock;
	struct dsl_scan_io_queue *vdev_scan_io_queue;

	/*
	* Leaf vdev state.
	*/
	range_tree_t vdev_dtl[DTL_TYPES]; / dirty time logs */
	space_map_t vdev_dtl_sm; / dirty time log space map */
	txg_node_t vdev_dtl_node; /* per-txg dirty DTL linkage */
	uint64_t vdev_dtl_object; /* DTL object */
	uint64_t vdev_psize; /* physical device capacity */
	uint64_t vdev_wholedisk; /* true if this is a whole disk */
	uint64_t vdev_offline; /* persistent offline state */
	uint64_t vdev_faulted; /* persistent faulted state */
	uint64_t vdev_degraded; /* persistent degraded state */
	uint64_t vdev_removed; /* persistent removed state */
	uint64_t vdev_resilver_txg; /* persistent resilvering state */
	uint64_t vdev_rebuild_txg; /* persistent rebuilding state */
	uint64_t vdev_nparity; /* number of parity devices for raidz */
	char vdev_path; / vdev path (if any) */
	char vdev_devid; / vdev devid (if any) */
	char vdev_physpath; / vdev device path (if any) */
	char vdev_enc_sysfs_path; / enclosure sysfs path */
	char vdev_fru; / physical FRU location */
	uint64_t vdev_not_present; /* not present during import */
	uint64_t vdev_unspare; /* unspare when resilvering done */
	boolean_t vdev_nowritecache; /* true if flushwritecache failed */
	boolean_t vdev_has_trim; /* TRIM is supported */
	boolean_t vdev_has_securetrim; /* secure TRIM is supported */
	boolean_t vdev_checkremove; /* temporary online test */
	boolean_t vdev_forcefault; /* force online fault */
	boolean_t vdev_splitting; /* split or repair in progress */
	boolean_t vdev_delayed_close; /* delayed device close? */
	boolean_t vdev_tmpoffline; /* device taken offline temporarily? */
	boolean_t vdev_detached; /* device detached? */
	boolean_t vdev_cant_read; /* vdev is failing all reads */
	boolean_t vdev_cant_write; /* vdev is failing all writes */
	boolean_t vdev_isspare; /* was a hot spare */
	boolean_t vdev_isl2cache; /* was a l2cache device */
	boolean_t vdev_copy_uberblocks; /* post expand copy uberblocks */
	boolean_t vdev_resilver_deferred; /* resilver deferred */
	vdev_queue_t vdev_queue; /* I/O deadline schedule queue */
	vdev_cache_t vdev_cache; /* physical block cache */
	spa_aux_vdev_t vdev_aux; / for l2cache and spares vdevs */
	zio_t vdev_probe_zio; / root of current probe */
	vdev_aux_t vdev_label_aux; /* on-disk aux state */
	uint64_t vdev_leaf_zap;
	hrtime_t vdev_mmp_pending; /* 0 if write finished */
	uint64_t vdev_mmp_kstat_id; /* to find kstat entry */
	uint64_t vdev_expansion_time; /* vdev's last expansion time */
	list_node_t vdev_leaf_node; /* leaf vdev list */

	/*
	* For DTrace to work in userland (libzpool) context, these fields must
	* remain at the end of the structure. DTrace will use the kernel's
	* CTF definition for 'struct vdev', and since the size of a kmutex_t is
	* larger in userland, the offsets for the rest of the fields would be
	* incorrect.
	*/
	kmutex_t vdev_dtl_lock; /* vdev_dtl_{map,resilver} */
	kmutex_t vdev_stat_lock; /* vdev_stat */
	kmutex_t vdev_probe_lock; /* protects vdev_probe_zio */

	/*
	* We rate limit ZIO delay and ZIO checksum events, since they
	* can flood ZED with tons of events when a drive is acting up.
	*/
	zfs_ratelimit_t vdev_delay_rl;
	zfs_ratelimit_t vdev_checksum_rl;
	};

	#define VDEV_RAIDZ_MAXPARITY 3

	#define VDEV_PAD_SIZE (8 << 10)
	/* 2 padding areas (vl_pad1 and vl_be) to skip */
	#define VDEV_SKIP_SIZE VDEV_PAD_SIZE * 2
	#define VDEV_PHYS_SIZE (112 << 10)
	#define VDEV_UBERBLOCK_RING (128 << 10)

	/*
	* MMP blocks occupy the last MMP_BLOCKS_PER_LABEL slots in the uberblock
	* ring when MMP is enabled.
	*/
	#define MMP_BLOCKS_PER_LABEL 1

	/* The largest uberblock we support is 8k. */
	#define MAX_UBERBLOCK_SHIFT (13)
	#define VDEV_UBERBLOCK_SHIFT(vd) \
	MIN(MAX((vd)->vdev_top->vdev_ashift, UBERBLOCK_SHIFT), \
	MAX_UBERBLOCK_SHIFT)
	#define VDEV_UBERBLOCK_COUNT(vd) \
	(VDEV_UBERBLOCK_RING >> VDEV_UBERBLOCK_SHIFT(vd))
	#define VDEV_UBERBLOCK_OFFSET(vd, n) \
	offsetof(vdev_label_t, vl_uberblock[(n) << VDEV_UBERBLOCK_SHIFT(vd)])
	#define VDEV_UBERBLOCK_SIZE(vd) (1ULL << VDEV_UBERBLOCK_SHIFT(vd))

	typedef struct vdev_phys {
	char vp_nvlist[VDEV_PHYS_SIZE - sizeof (zio_eck_t)];
	zio_eck_t vp_zbt;
	} vdev_phys_t;

	typedef enum vbe_vers {
	- /* The bootenv file is stored as ascii text in the envblock */
	+ /*
	+ * The bootenv file is stored as ascii text in the envblock.
	+ * It is used by the GRUB bootloader used on Linux to store the
	+ * contents of the grubenv file. The file is stored as raw ASCII,
	+ * and is protected by an embedded checksum. By default, GRUB will
	+ * check if the boot filesystem supports storing the environment data
	+ * in a special location, and if so, will invoke filesystem specific
	+ * logic to retrieve it. This can be overriden by a variable, should
	+ * the user so desire.
	+ */
	VB_RAW = 0,

	/*
	* The bootenv file is converted to an nvlist and then packed into the
	* envblock.
	*/
	VB_NVLIST = 1
	} vbe_vers_t;

	typedef struct vdev_boot_envblock {
	uint64_t vbe_version;
	char vbe_bootenv[VDEV_PAD_SIZE - sizeof (uint64_t) -
	sizeof (zio_eck_t)];
	zio_eck_t vbe_zbt;
	} vdev_boot_envblock_t;

	CTASSERT_GLOBAL(sizeof (vdev_boot_envblock_t) == VDEV_PAD_SIZE);

	typedef struct vdev_label {
	char vl_pad1[VDEV_PAD_SIZE]; /* 8K */
	vdev_boot_envblock_t vl_be; /* 8K */
	vdev_phys_t vl_vdev_phys; /* 112K */
	char vl_uberblock[VDEV_UBERBLOCK_RING]; /* 128K */
	} vdev_label_t; /* 256K total */

	/*
	* vdev_dirty() flags
	*/
	#define VDD_METASLAB 0x01
	#define VDD_DTL 0x02

	/* Offset of embedded boot loader region on each label */
	#define VDEV_BOOT_OFFSET (2 * sizeof (vdev_label_t))
	/*
	* Size of embedded boot loader region on each label.
	* The total size of the first two labels plus the boot area is 4MB.
	*/
	#define VDEV_BOOT_SIZE (7ULL << 19) /* 3.5M */

	/*
	* Size of label regions at the start and end of each leaf device.
	*/
	#define VDEV_LABEL_START_SIZE (2 * sizeof (vdev_label_t) + VDEV_BOOT_SIZE)
	#define VDEV_LABEL_END_SIZE (2 * sizeof (vdev_label_t))
	#define VDEV_LABELS 4
	#define VDEV_BEST_LABEL VDEV_LABELS

	#define VDEV_ALLOC_LOAD 0
	#define VDEV_ALLOC_ADD 1
	#define VDEV_ALLOC_SPARE 2
	#define VDEV_ALLOC_L2CACHE 3
	#define VDEV_ALLOC_ROOTPOOL 4
	#define VDEV_ALLOC_SPLIT 5
	#define VDEV_ALLOC_ATTACH 6

	/*
	* Allocate or free a vdev
	*/
	extern vdev_t vdev_alloc_common(spa_t spa, uint_t id, uint64_t guid,
	vdev_ops_t *ops);
	extern int vdev_alloc(spa_t spa, vdev_t vdp, nvlist_t config,
	vdev_t *parent, uint_t id, int alloctype);
	extern void vdev_free(vdev_t *vd);

	/*
	* Add or remove children and parents
	*/
	extern void vdev_add_child(vdev_t pvd, vdev_t cvd);
	extern void vdev_remove_child(vdev_t pvd, vdev_t cvd);
	extern void vdev_compact_children(vdev_t *pvd);
	extern vdev_t vdev_add_parent(vdev_t cvd, vdev_ops_t *ops);
	extern void vdev_remove_parent(vdev_t *cvd);

	/*
	* vdev sync load and sync
	*/
	extern boolean_t vdev_log_state_valid(vdev_t *vd);
	extern int vdev_load(vdev_t *vd);
	extern int vdev_dtl_load(vdev_t *vd);
	extern void vdev_sync(vdev_t *vd, uint64_t txg);
	extern void vdev_sync_done(vdev_t *vd, uint64_t txg);
	extern void vdev_dirty(vdev_t vd, int flags, void arg, uint64_t txg);
	extern void vdev_dirty_leaves(vdev_t *vd, int flags, uint64_t txg);

	/*
	* Available vdev types.
	*/
	extern vdev_ops_t vdev_root_ops;
	extern vdev_ops_t vdev_mirror_ops;
	extern vdev_ops_t vdev_replacing_ops;
	extern vdev_ops_t vdev_raidz_ops;
	extern vdev_ops_t vdev_disk_ops;
	extern vdev_ops_t vdev_file_ops;
	extern vdev_ops_t vdev_missing_ops;
	extern vdev_ops_t vdev_hole_ops;
	extern vdev_ops_t vdev_spare_ops;
	extern vdev_ops_t vdev_indirect_ops;

	/*
	* Common size functions
	*/
	extern void vdev_default_xlate(vdev_t vd, const range_seg64_t in,
	range_seg64_t *out);
	extern uint64_t vdev_default_asize(vdev_t *vd, uint64_t psize);
	extern uint64_t vdev_get_min_asize(vdev_t *vd);
	extern void vdev_set_min_asize(vdev_t *vd);

	/*
	* Global variables
	*/
	extern int zfs_vdev_standard_sm_blksz;
	/* zdb uses this tunable, so it must be declared here to make lint happy. */
	extern int zfs_vdev_cache_size;

	/*
	* Functions from vdev_indirect.c
	*/
	extern void vdev_indirect_sync_obsolete(vdev_t vd, dmu_tx_t tx);
	extern boolean_t vdev_indirect_should_condense(vdev_t *vd);
	extern void spa_condense_indirect_start_sync(vdev_t vd, dmu_tx_t tx);
	extern int vdev_obsolete_sm_object(vdev_t vd, uint64_t sm_obj);
	extern int vdev_obsolete_counts_are_precise(vdev_t vd, boolean_t are_precise);

	/*
	* Other miscellaneous functions
	*/
	int vdev_checkpoint_sm_object(vdev_t vd, uint64_t sm_obj);

	/*
	* Vdev ashift optimization tunables
	*/
	extern uint64_t zfs_vdev_min_auto_ashift;
	extern uint64_t zfs_vdev_max_auto_ashift;
	int param_set_min_auto_ashift(ZFS_MODULE_PARAM_ARGS);
	int param_set_max_auto_ashift(ZFS_MODULE_PARAM_ARGS);

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_VDEV_IMPL_H */
	Index: vendor-sys/openzfs/dist/include/sys/zfs_bootenv.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/zfs_bootenv.h (nonexistent)
	+++ vendor-sys/openzfs/dist/include/sys/zfs_bootenv.h (revision 365892)
	@@ -0,0 +1,53 @@
	+/*
	+ * This file and its contents are supplied under the terms of the
	+ * Common Development and Distribution License ("CDDL"), version 1.0.
	+ * You may only use this file in accordance with the terms of version
	+ * 1.0 of the CDDL.
	+ *
	+ * A full copy of the text of the CDDL should have accompanied this
	+ * source. A copy of the CDDL is also available via the Internet at
	+ * http://www.illumos.org/license/CDDL.
	+ */
	+
	+/*
	+ * Copyright 2020 Toomas Soome <tsoome@me.com>
	+ */
	+
	+#ifndef _ZFS_BOOTENV_H
	+#define _ZFS_BOOTENV_H
	+
	+/*
	+ * Define macros for label bootenv nvlist pair keys.
	+ */
	+
	+#ifdef __cplusplus
	+extern "C" {
	+#endif
	+
	+#define BOOTENV_VERSION "version"
	+
	+#define BE_ILLUMOS_VENDOR "illumos"
	+#define BE_FREEBSD_VENDOR "freebsd"
	+#define BE_GRUB_VENDOR "grub"
	+#define BE_LINUX_VENDOR "linux"
	+
	+#include <sys/zfs_bootenv_os.h>
	+
	+#define GRUB_ENVMAP BE_GRUB_VENDOR ":" "envmap"
	+
	+#define FREEBSD_BOOTONCE BE_FREEBSD_VENDOR ":" "bootonce"
	+#define FREEBSD_BOOTONCE_USED BE_FREEBSD_VENDOR ":" "bootonce-used"
	+#define FREEBSD_NVSTORE BE_FREEBSD_VENDOR ":" "nvstore"
	+#define ILLUMOS_BOOTONCE BE_ILLUMOS_VENDOR ":" "bootonce"
	+#define ILLUMOS_BOOTONCE_USED BE_ILLUMOS_VENDOR ":" "bootonce-used"
	+#define ILLUMOS_NVSTORE BE_ILLUMOS_VENDOR ":" "nvstore"
	+
	+#define OS_BOOTONCE BOOTENV_OS ":" "bootonce"
	+#define OS_BOOTONCE_USED BOOTENV_OS ":" "bootonce-used"
	+#define OS_NVSTORE BOOTENV_OS ":" "nvstore"
	+
	+#ifdef __cplusplus
	+}
	+#endif
	+
	+#endif /* _ZFS_BOOTENV_H */

	Property changes on: vendor-sys/openzfs/dist/include/sys/zfs_bootenv.h
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/include/sys/zfs_context.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/zfs_context.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/zfs_context.h (revision 365892)
	@@ -1,763 +1,767 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2012, 2018 by Delphix. All rights reserved.
	* Copyright (c) 2012, Joyent, Inc. All rights reserved.
	*/

	#ifndef _SYS_ZFS_CONTEXT_H
	#define _SYS_ZFS_CONTEXT_H

	#ifdef __cplusplus
	extern "C" {
	#endif

	#ifdef __KERNEL__
	#include <sys/note.h>
	#include <sys/types.h>
	#include <sys/atomic.h>
	#include <sys/sysmacros.h>
	#include <sys/vmsystm.h>
	#include <sys/condvar.h>
	#include <sys/cmn_err.h>
	#include <sys/kmem.h>
	#include <sys/kmem_cache.h>
	#include <sys/vmem.h>
	#include <sys/taskq.h>
	#include <sys/param.h>
	#include <sys/disp.h>
	#include <sys/debug.h>
	#include <sys/random.h>
	#include <sys/strings.h>
	#include <sys/byteorder.h>
	#include <sys/list.h>
	#include <sys/time.h>
	#include <sys/zone.h>
	#include <sys/kstat.h>
	#include <sys/zfs_debug.h>
	#include <sys/sysevent.h>
	#include <sys/sysevent/eventdefs.h>
	#include <sys/zfs_delay.h>
	#include <sys/sunddi.h>
	#include <sys/ctype.h>
	#include <sys/disp.h>
	#include <sys/trace.h>
	#include <sys/procfs_list.h>
	#include <sys/mod.h>
	#include <sys/zfs_context_os.h>
	#else /* _KERNEL */

	#define _SYS_MUTEX_H
	#define _SYS_RWLOCK_H
	#define _SYS_CONDVAR_H
	#define _SYS_VNODE_H
	#define _SYS_VFS_H
	#define _SYS_SUNDDI_H
	#define _SYS_CALLB_H

	#include <stdio.h>
	#include <stdlib.h>
	#include <stddef.h>
	#include <stdarg.h>
	#include <fcntl.h>
	#include <unistd.h>
	#include <errno.h>
	#include <string.h>
	#include <strings.h>
	#include <pthread.h>
	#include <setjmp.h>
	#include <assert.h>
	#include <umem.h>
	#include <limits.h>
	#include <atomic.h>
	#include <dirent.h>
	#include <time.h>
	#include <ctype.h>
	#include <signal.h>
	#include <sys/mman.h>
	#include <sys/note.h>
	#include <sys/types.h>
	#include <sys/cred.h>
	#include <sys/sysmacros.h>
	#include <sys/resource.h>
	#include <sys/byteorder.h>
	#include <sys/list.h>
	#include <sys/mod.h>
	#include <sys/uio.h>
	#include <sys/zfs_debug.h>
	#include <sys/kstat.h>
	#include <sys/u8_textprep.h>
	#include <sys/sysevent.h>
	#include <sys/sysevent/eventdefs.h>
	#include <sys/sunddi.h>
	#include <sys/debug.h>
	#include <sys/utsname.h>
	#include <sys/trace_zfs.h>

	#include <sys/zfs_context_os.h>

	/*
	* Stack
	*/

	#define noinline __attribute__((noinline))
	#define likely(x) __builtin_expect((x), 1)
	#define unlikely(x) __builtin_expect((x), 0)

	/*
	* Debugging
	*/

	/*
	* Note that we are not using the debugging levels.
	*/

	#define CE_CONT 0 /* continuation */
	#define CE_NOTE 1 /* notice */
	#define CE_WARN 2 /* warning */
	#define CE_PANIC 3 /* panic */
	#define CE_IGNORE 4 /* print nothing */

	/*
	* ZFS debugging
	*/

	extern void dprintf_setup(int argc, char *argv);

	extern void cmn_err(int, const char *, ...);
	extern void vcmn_err(int, const char *, va_list);
	extern void panic(const char *, ...) __NORETURN;
	extern void vpanic(const char *, va_list) __NORETURN;

	#define fm_panic panic

	extern int aok;

	/*
	* DTrace SDT probes have different signatures in userland than they do in
	* the kernel. If they're being used in kernel code, re-define them out of
	* existence for their counterparts in libzpool.
	*
	* Here's an example of how to use the set-error probes in userland:
	* zfs$target:::set-error /arg0 == EBUSY/ {stack();}
	*
	* Here's an example of how to use DTRACE_PROBE probes in userland:
	* If there is a probe declared as follows:
	* DTRACE_PROBE2(zfs__probe_name, uint64_t, blkid, dnode_t *, dn);
	* Then you can use it as follows:
	* zfs$target:::probe2 /copyinstr(arg0) == "zfs__probe_name"/
	* {printf("%u %p\n", arg1, arg2);}
	*/

	#ifdef DTRACE_PROBE
	#undef DTRACE_PROBE
	#endif /* DTRACE_PROBE */
	#define DTRACE_PROBE(a)

	#ifdef DTRACE_PROBE1
	#undef DTRACE_PROBE1
	#endif /* DTRACE_PROBE1 */
	#define DTRACE_PROBE1(a, b, c)

	#ifdef DTRACE_PROBE2
	#undef DTRACE_PROBE2
	#endif /* DTRACE_PROBE2 */
	#define DTRACE_PROBE2(a, b, c, d, e)

	#ifdef DTRACE_PROBE3
	#undef DTRACE_PROBE3
	#endif /* DTRACE_PROBE3 */
	#define DTRACE_PROBE3(a, b, c, d, e, f, g)

	#ifdef DTRACE_PROBE4
	#undef DTRACE_PROBE4
	#endif /* DTRACE_PROBE4 */
	#define DTRACE_PROBE4(a, b, c, d, e, f, g, h, i)

	/*
	* Tunables.
	*/
	typedef struct zfs_kernel_param {
	const char name; / unused stub */
	} zfs_kernel_param_t;

	#define ZFS_MODULE_PARAM(scope_prefix, name_prefix, name, type, perm, desc)
	#define ZFS_MODULE_PARAM_ARGS void
	#define ZFS_MODULE_PARAM_CALL(scope_prefix, name_prefix, name, setfunc, \
	getfunc, perm, desc)

	/*
	* Threads.
	*/
	typedef pthread_t kthread_t;

	#define TS_RUN 0x00000002
	#define TS_JOINABLE 0x00000004

	#define curthread ((void *)(uintptr_t)pthread_self())
	#define kpreempt(x) yield()
	#define getcomm() "unknown"

	#define thread_create_named(name, stk, stksize, func, arg, len, \
	pp, state, pri) \
	zk_thread_create(func, arg, stksize, state)
	#define thread_create(stk, stksize, func, arg, len, pp, state, pri) \
	zk_thread_create(func, arg, stksize, state)
	#define thread_exit() pthread_exit(NULL)
	#define thread_join(t) pthread_join((pthread_t)(t), NULL)

	#define newproc(f, a, cid, pri, ctp, pid) (ENOSYS)

	/* in libzpool, p0 exists only to have its address taken */
	typedef struct proc {
	uintptr_t this_is_never_used_dont_dereference_it;
	} proc_t;

	extern struct proc p0;
	#define curproc (&p0)

	#define PS_NONE -1

	extern kthread_t zk_thread_create(void (func)(void ), void arg,
	size_t stksize, int state);

	#define issig(why) (FALSE)
	#define ISSIG(thr, why) (FALSE)

	#define kpreempt_disable() ((void)0)
	#define kpreempt_enable() ((void)0)
	#define cond_resched() sched_yield()

	/*
	* Mutexes
	*/
	typedef struct kmutex {
	pthread_mutex_t m_lock;
	pthread_t m_owner;
	} kmutex_t;

	#define MUTEX_DEFAULT 0
	#define MUTEX_NOLOCKDEP MUTEX_DEFAULT
	#define MUTEX_HELD(mp) pthread_equal((mp)->m_owner, pthread_self())
	#define MUTEX_NOT_HELD(mp) !MUTEX_HELD(mp)

	extern void mutex_init(kmutex_t mp, char name, int type, void *cookie);
	extern void mutex_destroy(kmutex_t *mp);
	extern void mutex_enter(kmutex_t *mp);
	extern void mutex_exit(kmutex_t *mp);
	extern int mutex_tryenter(kmutex_t *mp);

	#define NESTED_SINGLE 1
	#define mutex_enter_nested(mp, class) mutex_enter(mp)
	/*
	* RW locks
	*/
	typedef struct krwlock {
	pthread_rwlock_t rw_lock;
	pthread_t rw_owner;
	uint_t rw_readers;
	} krwlock_t;

	typedef int krw_t;

	#define RW_READER 0
	#define RW_WRITER 1
	#define RW_DEFAULT RW_READER
	#define RW_NOLOCKDEP RW_READER

	#define RW_READ_HELD(rw) ((rw)->rw_readers > 0)
	#define RW_WRITE_HELD(rw) pthread_equal((rw)->rw_owner, pthread_self())
	#define RW_LOCK_HELD(rw) (RW_READ_HELD(rw) \|\| RW_WRITE_HELD(rw))

	extern void rw_init(krwlock_t rwlp, char name, int type, void *arg);
	extern void rw_destroy(krwlock_t *rwlp);
	extern void rw_enter(krwlock_t *rwlp, krw_t rw);
	extern int rw_tryenter(krwlock_t *rwlp, krw_t rw);
	extern int rw_tryupgrade(krwlock_t *rwlp);
	extern void rw_exit(krwlock_t *rwlp);
	#define rw_downgrade(rwlp) do { } while (0)

	/*
	* Credentials
	*/
	extern uid_t crgetuid(cred_t *cr);
	extern uid_t crgetruid(cred_t *cr);
	extern gid_t crgetgid(cred_t *cr);
	extern int crgetngroups(cred_t *cr);
	extern gid_t crgetgroups(cred_t cr);

	/*
	* Condition variables
	*/
	typedef pthread_cond_t kcondvar_t;

	#define CV_DEFAULT 0
	#define CALLOUT_FLAG_ABSOLUTE 0x2

	extern void cv_init(kcondvar_t cv, char name, int type, void *arg);
	extern void cv_destroy(kcondvar_t *cv);
	extern void cv_wait(kcondvar_t cv, kmutex_t mp);
	extern int cv_wait_sig(kcondvar_t cv, kmutex_t mp);
	extern int cv_timedwait(kcondvar_t cv, kmutex_t mp, clock_t abstime);
	extern int cv_timedwait_hires(kcondvar_t cvp, kmutex_t mp, hrtime_t tim,
	hrtime_t res, int flag);
	extern void cv_signal(kcondvar_t *cv);
	extern void cv_broadcast(kcondvar_t *cv);

	#define cv_timedwait_io(cv, mp, at) cv_timedwait(cv, mp, at)
	+#define cv_timedwait_idle(cv, mp, at) cv_timedwait(cv, mp, at)
	#define cv_timedwait_sig(cv, mp, at) cv_timedwait(cv, mp, at)
	#define cv_wait_io(cv, mp) cv_wait(cv, mp)
	+#define cv_wait_idle(cv, mp) cv_wait(cv, mp)
	#define cv_wait_io_sig(cv, mp) cv_wait_sig(cv, mp)
	#define cv_timedwait_sig_hires(cv, mp, t, r, f) \
	cv_timedwait_hires(cv, mp, t, r, f)
	+#define cv_timedwait_idle_hires(cv, mp, t, r, f) \
	+ cv_timedwait_hires(cv, mp, t, r, f)

	/*
	* Thread-specific data
	*/
	#define tsd_get(k) pthread_getspecific(k)
	#define tsd_set(k, v) pthread_setspecific(k, v)
	#define tsd_create(kp, d) pthread_key_create((pthread_key_t *)kp, d)
	#define tsd_destroy(kp) /* nothing */
	#ifdef __FreeBSD__
	typedef off_t loff_t;
	#endif

	/*
	* kstat creation, installation and deletion
	*/
	extern kstat_t kstat_create(const char , int,
	const char , const char , uchar_t, ulong_t, uchar_t);
	extern void kstat_install(kstat_t *);
	extern void kstat_delete(kstat_t *);
	extern void kstat_waitq_enter(kstat_io_t *);
	extern void kstat_waitq_exit(kstat_io_t *);
	extern void kstat_runq_enter(kstat_io_t *);
	extern void kstat_runq_exit(kstat_io_t *);
	extern void kstat_waitq_to_runq(kstat_io_t *);
	extern void kstat_runq_back_to_waitq(kstat_io_t *);
	extern void kstat_set_raw_ops(kstat_t *ksp,
	int (headers)(char buf, size_t size),
	int (data)(char buf, size_t size, void *data),
	void (addr)(kstat_t *ksp, loff_t index));

	/*
	* procfs list manipulation
	*/

	typedef struct procfs_list {
	void *pl_private;
	kmutex_t pl_lock;
	list_t pl_list;
	uint64_t pl_next_id;
	size_t pl_node_offset;
	} procfs_list_t;

	#ifndef __cplusplus
	struct seq_file { };
	void seq_printf(struct seq_file m, const char fmt, ...);

	typedef struct procfs_list_node {
	list_node_t pln_link;
	uint64_t pln_id;
	} procfs_list_node_t;

	void procfs_list_install(const char *module,
	const char *name,
	mode_t mode,
	procfs_list_t *procfs_list,
	int (show)(struct seq_file f, void *p),
	int (show_header)(struct seq_file f),
	int (clear)(procfs_list_t procfs_list),
	size_t procfs_list_node_off);
	void procfs_list_uninstall(procfs_list_t *procfs_list);
	void procfs_list_destroy(procfs_list_t *procfs_list);
	void procfs_list_add(procfs_list_t procfs_list, void p);
	#endif

	/*
	* Kernel memory
	*/
	#define KM_SLEEP UMEM_NOFAIL
	#define KM_PUSHPAGE KM_SLEEP
	#define KM_NOSLEEP UMEM_DEFAULT
	#define KM_NORMALPRI 0 /* not needed with UMEM_DEFAULT */
	#define KMC_NODEBUG UMC_NODEBUG
	#define KMC_KVMEM 0x0
	#define kmem_alloc(_s, _f) umem_alloc(_s, _f)
	#define kmem_zalloc(_s, _f) umem_zalloc(_s, _f)
	#define kmem_free(_b, _s) umem_free(_b, _s)
	#define vmem_alloc(_s, _f) kmem_alloc(_s, _f)
	#define vmem_zalloc(_s, _f) kmem_zalloc(_s, _f)
	#define vmem_free(_b, _s) kmem_free(_b, _s)
	#define kmem_cache_create(_a, _b, _c, _d, _e, _f, _g, _h, _i) \
	umem_cache_create(_a, _b, _c, _d, _e, _f, _g, _h, _i)
	#define kmem_cache_destroy(_c) umem_cache_destroy(_c)
	#define kmem_cache_alloc(_c, _f) umem_cache_alloc(_c, _f)
	#define kmem_cache_free(_c, _b) umem_cache_free(_c, _b)
	#define kmem_debugging() 0
	#define kmem_cache_reap_now(_c) umem_cache_reap_now(_c);
	#define kmem_cache_set_move(_c, _cb) /* nothing */
	#define POINTER_INVALIDATE(_pp) /* nothing */
	#define POINTER_IS_VALID(_p) 0

	typedef umem_cache_t kmem_cache_t;

	typedef enum kmem_cbrc {
	KMEM_CBRC_YES,
	KMEM_CBRC_NO,
	KMEM_CBRC_LATER,
	KMEM_CBRC_DONT_NEED,
	KMEM_CBRC_DONT_KNOW
	} kmem_cbrc_t;

	/*
	* Task queues
	*/

	#define TASKQ_NAMELEN 31

	typedef uintptr_t taskqid_t;
	typedef void (task_func_t)(void *);

	typedef struct taskq_ent {
	struct taskq_ent *tqent_next;
	struct taskq_ent *tqent_prev;
	task_func_t *tqent_func;
	void *tqent_arg;
	uintptr_t tqent_flags;
	} taskq_ent_t;

	typedef struct taskq {
	char tq_name[TASKQ_NAMELEN + 1];
	kmutex_t tq_lock;
	krwlock_t tq_threadlock;
	kcondvar_t tq_dispatch_cv;
	kcondvar_t tq_wait_cv;
	kthread_t **tq_threadlist;
	int tq_flags;
	int tq_active;
	int tq_nthreads;
	int tq_nalloc;
	int tq_minalloc;
	int tq_maxalloc;
	kcondvar_t tq_maxalloc_cv;
	int tq_maxalloc_wait;
	taskq_ent_t *tq_freelist;
	taskq_ent_t tq_task;
	} taskq_t;

	#define TQENT_FLAG_PREALLOC 0x1 /* taskq_dispatch_ent used */

	#define TASKQ_PREPOPULATE 0x0001
	#define TASKQ_CPR_SAFE 0x0002 /* Use CPR safe protocol */
	#define TASKQ_DYNAMIC 0x0004 /* Use dynamic thread scheduling */
	#define TASKQ_THREADS_CPU_PCT 0x0008 /* Scale # threads by # cpus */
	#define TASKQ_DC_BATCH 0x0010 /* Mark threads as batch */

	#define TQ_SLEEP KM_SLEEP /* Can block for memory */
	#define TQ_NOSLEEP KM_NOSLEEP /* cannot block for memory; may fail */
	#define TQ_NOQUEUE 0x02 /* Do not enqueue if can't dispatch */
	#define TQ_FRONT 0x08 /* Queue in front */

	#define TASKQID_INVALID ((taskqid_t)0)

	extern taskq_t *system_taskq;
	extern taskq_t *system_delay_taskq;

	extern taskq_t taskq_create(const char , int, pri_t, int, int, uint_t);
	#define taskq_create_proc(a, b, c, d, e, p, f) \
	(taskq_create(a, b, c, d, e, f))
	#define taskq_create_sysdc(a, b, d, e, p, dc, f) \
	(taskq_create(a, b, maxclsyspri, d, e, f))
	extern taskqid_t taskq_dispatch(taskq_t , task_func_t, void , uint_t);
	extern taskqid_t taskq_dispatch_delay(taskq_t , task_func_t, void , uint_t,
	clock_t);
	extern void taskq_dispatch_ent(taskq_t , task_func_t, void , uint_t,
	taskq_ent_t *);
	extern int taskq_empty_ent(taskq_ent_t *);
	extern void taskq_init_ent(taskq_ent_t *);
	extern void taskq_destroy(taskq_t *);
	extern void taskq_wait(taskq_t *);
	extern void taskq_wait_id(taskq_t *, taskqid_t);
	extern void taskq_wait_outstanding(taskq_t *, taskqid_t);
	extern int taskq_member(taskq_t , kthread_t );
	extern taskq_t *taskq_of_curthread(void);
	extern int taskq_cancel_id(taskq_t *, taskqid_t);
	extern void system_taskq_init(void);
	extern void system_taskq_fini(void);

	#define XVA_MAPSIZE 3
	#define XVA_MAGIC 0x78766174

	extern char *vn_dumpdir;
	#define AV_SCANSTAMP_SZ 32 /* length of anti-virus scanstamp */

	typedef struct xoptattr {
	inode_timespec_t xoa_createtime; /* Create time of file */
	uint8_t xoa_archive;
	uint8_t xoa_system;
	uint8_t xoa_readonly;
	uint8_t xoa_hidden;
	uint8_t xoa_nounlink;
	uint8_t xoa_immutable;
	uint8_t xoa_appendonly;
	uint8_t xoa_nodump;
	uint8_t xoa_settable;
	uint8_t xoa_opaque;
	uint8_t xoa_av_quarantined;
	uint8_t xoa_av_modified;
	uint8_t xoa_av_scanstamp[AV_SCANSTAMP_SZ];
	uint8_t xoa_reparse;
	uint8_t xoa_offline;
	uint8_t xoa_sparse;
	} xoptattr_t;

	typedef struct vattr {
	uint_t va_mask; /* bit-mask of attributes */
	u_offset_t va_size; /* file size in bytes */
	} vattr_t;


	typedef struct xvattr {
	vattr_t xva_vattr; /* Embedded vattr structure */
	uint32_t xva_magic; /* Magic Number */
	uint32_t xva_mapsize; /* Size of attr bitmap (32-bit words) */
	uint32_t xva_rtnattrmapp; / Ptr to xva_rtnattrmap[] */
	uint32_t xva_reqattrmap[XVA_MAPSIZE]; /* Requested attrs */
	uint32_t xva_rtnattrmap[XVA_MAPSIZE]; /* Returned attrs */
	xoptattr_t xva_xoptattrs; /* Optional attributes */
	} xvattr_t;

	typedef struct vsecattr {
	uint_t vsa_mask; /* See below */
	int vsa_aclcnt; /* ACL entry count */
	void vsa_aclentp; / pointer to ACL entries */
	int vsa_dfaclcnt; /* default ACL entry count */
	void vsa_dfaclentp; / pointer to default ACL entries */
	size_t vsa_aclentsz; /* ACE size in bytes of vsa_aclentp */
	} vsecattr_t;

	#define AT_MODE 0x00002
	#define AT_UID 0x00004
	#define AT_GID 0x00008
	#define AT_FSID 0x00010
	#define AT_NODEID 0x00020
	#define AT_NLINK 0x00040
	#define AT_SIZE 0x00080
	#define AT_ATIME 0x00100
	#define AT_MTIME 0x00200
	#define AT_CTIME 0x00400
	#define AT_RDEV 0x00800
	#define AT_BLKSIZE 0x01000
	#define AT_NBLOCKS 0x02000
	#define AT_SEQ 0x08000
	#define AT_XVATTR 0x10000

	#define CRCREAT 0

	#define F_FREESP 11
	#define FIGNORECASE 0x80000 /* request case-insensitive lookups */

	/*
	* Random stuff
	*/
	#define ddi_get_lbolt() (gethrtime() >> 23)
	#define ddi_get_lbolt64() (gethrtime() >> 23)
	#define hz 119 /* frequency when using gethrtime() >> 23 for lbolt */

	#define ddi_time_before(a, b) (a < b)
	#define ddi_time_after(a, b) ddi_time_before(b, a)
	#define ddi_time_before_eq(a, b) (!ddi_time_after(a, b))
	#define ddi_time_after_eq(a, b) ddi_time_before_eq(b, a)

	#define ddi_time_before64(a, b) (a < b)
	#define ddi_time_after64(a, b) ddi_time_before64(b, a)
	#define ddi_time_before_eq64(a, b) (!ddi_time_after64(a, b))
	#define ddi_time_after_eq64(a, b) ddi_time_before_eq64(b, a)

	extern void delay(clock_t ticks);

	#define SEC_TO_TICK(sec) ((sec) * hz)
	-#define MSEC_TO_TICK(msec) ((msec) / (MILLISEC / hz))
	-#define USEC_TO_TICK(usec) ((usec) / (MICROSEC / hz))
	-#define NSEC_TO_TICK(usec) ((usec) / (NANOSEC / hz))
	+#define MSEC_TO_TICK(msec) (howmany((hrtime_t)(msec) * hz, MILLISEC))
	+#define USEC_TO_TICK(usec) (howmany((hrtime_t)(usec) * hz, MICROSEC))
	+#define NSEC_TO_TICK(nsec) (howmany((hrtime_t)(nsec) * hz, NANOSEC))

	#define max_ncpus 64
	#define boot_ncpus (sysconf(_SC_NPROCESSORS_ONLN))

	/*
	* Process priorities as defined by setpriority(2) and getpriority(2).
	*/
	#define minclsyspri 19
	#define maxclsyspri -20
	#define defclsyspri 0

	#define CPU_SEQID ((uintptr_t)pthread_self() & (max_ncpus - 1))

	#define kcred NULL
	#define CRED() NULL

	#define ptob(x) ((x) * PAGESIZE)

	#define NN_DIVISOR_1000 (1U << 0)
	#define NN_NUMBUF_SZ (6)

	extern uint64_t physmem;
	extern char *random_path;
	extern char *urandom_path;

	extern int highbit64(uint64_t i);
	extern int lowbit64(uint64_t i);
	extern int random_get_bytes(uint8_t *ptr, size_t len);
	extern int random_get_pseudo_bytes(uint8_t *ptr, size_t len);

	extern void kernel_init(int mode);
	extern void kernel_fini(void);
	extern void random_init(void);
	extern void random_fini(void);

	struct spa;
	extern void show_pool_stats(struct spa *);
	extern int set_global_var(char *arg);

	typedef struct callb_cpr {
	kmutex_t *cc_lockp;
	} callb_cpr_t;

	#define CALLB_CPR_INIT(cp, lockp, func, name) { \
	(cp)->cc_lockp = lockp; \
	}

	#define CALLB_CPR_SAFE_BEGIN(cp) { \
	ASSERT(MUTEX_HELD((cp)->cc_lockp)); \
	}

	#define CALLB_CPR_SAFE_END(cp, lockp) { \
	ASSERT(MUTEX_HELD((cp)->cc_lockp)); \
	}

	#define CALLB_CPR_EXIT(cp) { \
	ASSERT(MUTEX_HELD((cp)->cc_lockp)); \
	mutex_exit((cp)->cc_lockp); \
	}

	#define zone_dataset_visible(x, y) (1)
	#define INGLOBALZONE(z) (1)
	extern uint32_t zone_get_hostid(void *zonep);

	extern char kmem_vasprintf(const char fmt, va_list adx);
	extern char kmem_asprintf(const char fmt, ...);
	#define kmem_strfree(str) kmem_free((str), strlen(str) + 1)
	#define kmem_strdup(s) strdup(s)

	/*
	* Hostname information
	*/
	extern char hw_serial[]; /* for userland-emulated hostid access */
	extern int ddi_strtoul(const char str, char *nptr, int base,
	unsigned long *result);

	extern int ddi_strtoull(const char str, char *nptr, int base,
	u_longlong_t *result);

	typedef struct utsname utsname_t;
	extern utsname_t *utsname(void);

	/* ZFS Boot Related stuff. */

	struct _buf {
	intptr_t _fd;
	};

	struct bootstat {
	uint64_t st_size;
	};

	typedef struct ace_object {
	uid_t a_who;
	uint32_t a_access_mask;
	uint16_t a_flags;
	uint16_t a_type;
	uint8_t a_obj_type[16];
	uint8_t a_inherit_obj_type[16];
	} ace_object_t;


	#define ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE 0x05
	#define ACE_ACCESS_DENIED_OBJECT_ACE_TYPE 0x06
	#define ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE 0x07
	#define ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE 0x08

	extern int zfs_secpolicy_snapshot_perms(const char name, cred_t cr);
	extern int zfs_secpolicy_rename_perms(const char from, const char to,
	cred_t *cr);
	extern int zfs_secpolicy_destroy_perms(const char name, cred_t cr);
	extern int secpolicy_zfs(const cred_t *cr);
	extern int secpolicy_zfs_proc(const cred_t cr, proc_t proc);
	extern zoneid_t getzoneid(void);

	/* SID stuff */
	typedef struct ksiddomain {
	uint_t kd_ref;
	uint_t kd_len;
	char *kd_name;
	} ksiddomain_t;

	ksiddomain_t ksid_lookupdomain(const char );
	void ksiddomain_rele(ksiddomain_t *);

	#define DDI_SLEEP KM_SLEEP
	#define ddi_log_sysevent(_a, _b, _c, _d, _e, _f, _g) \
	sysevent_post_event(_c, _d, _b, "libzpool", _e, _f)

	#define zfs_sleep_until(wakeup) \
	do { \
	hrtime_t delta = wakeup - gethrtime(); \
	struct timespec ts; \
	ts.tv_sec = delta / NANOSEC; \
	ts.tv_nsec = delta % NANOSEC; \
	(void) nanosleep(&ts, NULL); \
	} while (0)

	typedef int fstrans_cookie_t;

	extern fstrans_cookie_t spl_fstrans_mark(void);
	extern void spl_fstrans_unmark(fstrans_cookie_t);
	extern int __spl_pf_fstrans_check(void);
	extern int kmem_cache_reap_active(void);

	#define ____cacheline_aligned

	/*
	* Kernel modules
	*/
	#define __init
	#define __exit

	#endif /* _KERNEL */

	#ifdef __cplusplus
	};
	#endif

	#endif /* _SYS_ZFS_CONTEXT_H */
	Index: vendor-sys/openzfs/dist/include/sys/zfs_ioctl.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/zfs_ioctl.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/zfs_ioctl.h (revision 365892)
	@@ -1,581 +1,581 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2012, 2020 by Delphix. All rights reserved.
	* Copyright 2016 RackTop Systems.
	* Copyright (c) 2017, Intel Corporation.
	*/

	#ifndef _SYS_ZFS_IOCTL_H
	#define _SYS_ZFS_IOCTL_H

	#include <sys/cred.h>
	#include <sys/dmu.h>
	#include <sys/zio.h>
	#include <sys/dsl_deleg.h>
	#include <sys/spa.h>
	#include <sys/zfs_stat.h>

	#ifdef _KERNEL
	#include <sys/nvpair.h>
	#endif /* _KERNEL */

	#ifdef __cplusplus
	extern "C" {
	#endif

	/*
	* The structures in this file are passed between userland and the
	* kernel. Userland may be running a 32-bit process, while the kernel
	* is 64-bit. Therefore, these structures need to compile the same in
	* 32-bit and 64-bit. This means not using type "long", and adding
	* explicit padding so that the 32-bit structure will not be packed more
	* tightly than the 64-bit structure (which requires 64-bit alignment).
	*/

	/*
	* Property values for snapdir
	*/
	#define ZFS_SNAPDIR_HIDDEN 0
	#define ZFS_SNAPDIR_VISIBLE 1

	/*
	* Property values for snapdev
	*/
	#define ZFS_SNAPDEV_HIDDEN 0
	#define ZFS_SNAPDEV_VISIBLE 1
	/*
	* Property values for acltype
	*/
	#define ZFS_ACLTYPE_OFF 0
	-#define ZFS_ACLTYPE_POSIXACL 1
	+#define ZFS_ACLTYPE_POSIX 1

	/*
	* Field manipulation macros for the drr_versioninfo field of the
	* send stream header.
	*/

	/*
	* Header types for zfs send streams.
	*/
	typedef enum drr_headertype {
	DMU_SUBSTREAM = 0x1,
	DMU_COMPOUNDSTREAM = 0x2
	} drr_headertype_t;

	#define DMU_GET_STREAM_HDRTYPE(vi) BF64_GET((vi), 0, 2)
	#define DMU_SET_STREAM_HDRTYPE(vi, x) BF64_SET((vi), 0, 2, x)

	#define DMU_GET_FEATUREFLAGS(vi) BF64_GET((vi), 2, 30)
	#define DMU_SET_FEATUREFLAGS(vi, x) BF64_SET((vi), 2, 30, x)

	/*
	* Feature flags for zfs send streams (flags in drr_versioninfo)
	*/

	#define DMU_BACKUP_FEATURE_DEDUP (1 << 0)
	#define DMU_BACKUP_FEATURE_DEDUPPROPS (1 << 1)
	#define DMU_BACKUP_FEATURE_SA_SPILL (1 << 2)
	/* flags #3 - #15 are reserved for incompatible closed-source implementations */
	#define DMU_BACKUP_FEATURE_EMBED_DATA (1 << 16)
	#define DMU_BACKUP_FEATURE_LZ4 (1 << 17)
	/* flag #18 is reserved for a Delphix feature */
	#define DMU_BACKUP_FEATURE_LARGE_BLOCKS (1 << 19)
	#define DMU_BACKUP_FEATURE_RESUMING (1 << 20)
	#define DMU_BACKUP_FEATURE_REDACTED (1 << 21)
	#define DMU_BACKUP_FEATURE_COMPRESSED (1 << 22)
	#define DMU_BACKUP_FEATURE_LARGE_DNODE (1 << 23)
	#define DMU_BACKUP_FEATURE_RAW (1 << 24)
	#define DMU_BACKUP_FEATURE_ZSTD (1 << 25)
	#define DMU_BACKUP_FEATURE_HOLDS (1 << 26)
	/*
	* The SWITCH_TO_LARGE_BLOCKS feature indicates that we can receive
	* incremental LARGE_BLOCKS streams (those with WRITE records of >128KB) even
	* if the previous send did not use LARGE_BLOCKS, and thus its large blocks
	* were split into multiple 128KB WRITE records. (See
	* flush_write_batch_impl() and receive_object()). Older software that does
	* not support this flag may encounter a bug when switching to large blocks,
	* which causes files to incorrectly be zeroed.
	*
	* This flag is currently not set on any send streams. In the future, we
	* intend for incremental send streams of snapshots that have large blocks to
	* use LARGE_BLOCKS by default, and these streams will also have the
	* SWITCH_TO_LARGE_BLOCKS feature set. This ensures that streams from the
	* default use of "zfs send" won't encounter the bug mentioned above.
	*/
	#define DMU_BACKUP_FEATURE_SWITCH_TO_LARGE_BLOCKS (1 << 27)

	/*
	* Mask of all supported backup features
	*/
	#define DMU_BACKUP_FEATURE_MASK (DMU_BACKUP_FEATURE_SA_SPILL \| \
	DMU_BACKUP_FEATURE_EMBED_DATA \| DMU_BACKUP_FEATURE_LZ4 \| \
	DMU_BACKUP_FEATURE_RESUMING \| DMU_BACKUP_FEATURE_LARGE_BLOCKS \| \
	DMU_BACKUP_FEATURE_COMPRESSED \| DMU_BACKUP_FEATURE_LARGE_DNODE \| \
	DMU_BACKUP_FEATURE_RAW \| DMU_BACKUP_FEATURE_HOLDS \| \
	DMU_BACKUP_FEATURE_REDACTED \| DMU_BACKUP_FEATURE_SWITCH_TO_LARGE_BLOCKS \| \
	DMU_BACKUP_FEATURE_ZSTD)

	/* Are all features in the given flag word currently supported? */
	#define DMU_STREAM_SUPPORTED(x) (!((x) & ~DMU_BACKUP_FEATURE_MASK))

	typedef enum dmu_send_resume_token_version {
	ZFS_SEND_RESUME_TOKEN_VERSION = 1
	} dmu_send_resume_token_version_t;

	/*
	* The drr_versioninfo field of the dmu_replay_record has the
	* following layout:
	*
	* 64 56 48 40 32 24 16 8 0
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	* \| reserved \| feature-flags \|C\|S\|
	* +-------+-------+-------+-------+-------+-------+-------+-------+
	*
	* The low order two bits indicate the header type: SUBSTREAM (0x1)
	* or COMPOUNDSTREAM (0x2). Using two bits for this is historical:
	* this field used to be a version number, where the two version types
	* were 1 and 2. Using two bits for this allows earlier versions of
	* the code to be able to recognize send streams that don't use any
	* of the features indicated by feature flags.
	*/

	#define DMU_BACKUP_MAGIC 0x2F5bacbacULL

	/*
	* Send stream flags. Bits 24-31 are reserved for vendor-specific
	* implementations and should not be used.
	*/
	#define DRR_FLAG_CLONE (1<<0)
	#define DRR_FLAG_CI_DATA (1<<1)
	/*
	* This send stream, if it is a full send, includes the FREE and FREEOBJECT
	* records that are created by the sending process. This means that the send
	* stream can be received as a clone, even though it is not an incremental.
	* This is not implemented as a feature flag, because the receiving side does
	* not need to have implemented it to receive this stream; it is fully backwards
	* compatible. We need a flag, though, because full send streams without it
	* cannot necessarily be received as a clone correctly.
	*/
	#define DRR_FLAG_FREERECORDS (1<<2)
	/*
	* When DRR_FLAG_SPILL_BLOCK is set it indicates the DRR_OBJECT_SPILL
	* and DRR_SPILL_UNMODIFIED flags are meaningful in the send stream.
	*
	* When DRR_FLAG_SPILL_BLOCK is set, DRR_OBJECT records will have
	* DRR_OBJECT_SPILL set if and only if they should have a spill block
	* (either an existing one, or a new one in the send stream). When clear
	* the object does not have a spill block and any existing spill block
	* should be freed.
	*
	* Similarly, when DRR_FLAG_SPILL_BLOCK is set, DRR_SPILL records will
	* have DRR_SPILL_UNMODIFIED set if and only if they were included for
	* backward compatibility purposes, and can be safely ignored by new versions
	* of zfs receive. Previous versions of ZFS which do not understand the
	* DRR_FLAG_SPILL_BLOCK will process this record and recreate any missing
	* spill blocks.
	*/
	#define DRR_FLAG_SPILL_BLOCK (1<<3)

	/*
	* flags in the drr_flags field in the DRR_WRITE, DRR_SPILL, DRR_OBJECT,
	* DRR_WRITE_BYREF, and DRR_OBJECT_RANGE blocks
	*/
	#define DRR_CHECKSUM_DEDUP (1<<0) /* not used for SPILL records */
	#define DRR_RAW_BYTESWAP (1<<1)
	#define DRR_OBJECT_SPILL (1<<2) /* OBJECT record has a spill block */
	#define DRR_SPILL_UNMODIFIED (1<<2) /* SPILL record for unmodified block */

	#define DRR_IS_DEDUP_CAPABLE(flags) ((flags) & DRR_CHECKSUM_DEDUP)
	#define DRR_IS_RAW_BYTESWAPPED(flags) ((flags) & DRR_RAW_BYTESWAP)
	#define DRR_OBJECT_HAS_SPILL(flags) ((flags) & DRR_OBJECT_SPILL)
	#define DRR_SPILL_IS_UNMODIFIED(flags) ((flags) & DRR_SPILL_UNMODIFIED)

	/* deal with compressed drr_write replay records */
	#define DRR_WRITE_COMPRESSED(drrw) ((drrw)->drr_compressiontype != 0)
	#define DRR_WRITE_PAYLOAD_SIZE(drrw) \
	(DRR_WRITE_COMPRESSED(drrw) ? (drrw)->drr_compressed_size : \
	(drrw)->drr_logical_size)
	#define DRR_SPILL_PAYLOAD_SIZE(drrs) \
	((drrs)->drr_compressed_size ? \
	(drrs)->drr_compressed_size : (drrs)->drr_length)
	#define DRR_OBJECT_PAYLOAD_SIZE(drro) \
	((drro)->drr_raw_bonuslen != 0 ? \
	(drro)->drr_raw_bonuslen : P2ROUNDUP((drro)->drr_bonuslen, 8))

	/*
	* zfs ioctl command structure
	*/

	/* Header is used in C++ so can't forward declare untagged struct */
	struct drr_begin {
	uint64_t drr_magic;
	uint64_t drr_versioninfo; /* was drr_version */
	uint64_t drr_creation_time;
	dmu_objset_type_t drr_type;
	uint32_t drr_flags;
	uint64_t drr_toguid;
	uint64_t drr_fromguid;
	char drr_toname[MAXNAMELEN];
	};

	typedef struct dmu_replay_record {
	enum {
	DRR_BEGIN, DRR_OBJECT, DRR_FREEOBJECTS,
	DRR_WRITE, DRR_FREE, DRR_END, DRR_WRITE_BYREF,
	DRR_SPILL, DRR_WRITE_EMBEDDED, DRR_OBJECT_RANGE, DRR_REDACT,
	DRR_NUMTYPES
	} drr_type;
	uint32_t drr_payloadlen;
	union {
	struct drr_begin drr_begin;
	struct drr_end {
	zio_cksum_t drr_checksum;
	uint64_t drr_toguid;
	} drr_end;
	struct drr_object {
	uint64_t drr_object;
	dmu_object_type_t drr_type;
	dmu_object_type_t drr_bonustype;
	uint32_t drr_blksz;
	uint32_t drr_bonuslen;
	uint8_t drr_checksumtype;
	uint8_t drr_compress;
	uint8_t drr_dn_slots;
	uint8_t drr_flags;
	uint32_t drr_raw_bonuslen;
	uint64_t drr_toguid;
	/* only (possibly) nonzero for raw streams */
	uint8_t drr_indblkshift;
	uint8_t drr_nlevels;
	uint8_t drr_nblkptr;
	uint8_t drr_pad[5];
	uint64_t drr_maxblkid;
	/* bonus content follows */
	} drr_object;
	struct drr_freeobjects {
	uint64_t drr_firstobj;
	uint64_t drr_numobjs;
	uint64_t drr_toguid;
	} drr_freeobjects;
	struct drr_write {
	uint64_t drr_object;
	dmu_object_type_t drr_type;
	uint32_t drr_pad;
	uint64_t drr_offset;
	uint64_t drr_logical_size;
	uint64_t drr_toguid;
	uint8_t drr_checksumtype;
	uint8_t drr_flags;
	uint8_t drr_compressiontype;
	uint8_t drr_pad2[5];
	/* deduplication key */
	ddt_key_t drr_key;
	/* only nonzero if drr_compressiontype is not 0 */
	uint64_t drr_compressed_size;
	/* only nonzero for raw streams */
	uint8_t drr_salt[ZIO_DATA_SALT_LEN];
	uint8_t drr_iv[ZIO_DATA_IV_LEN];
	uint8_t drr_mac[ZIO_DATA_MAC_LEN];
	/* content follows */
	} drr_write;
	struct drr_free {
	uint64_t drr_object;
	uint64_t drr_offset;
	uint64_t drr_length;
	uint64_t drr_toguid;
	} drr_free;
	struct drr_write_byref {
	/* where to put the data */
	uint64_t drr_object;
	uint64_t drr_offset;
	uint64_t drr_length;
	uint64_t drr_toguid;
	/* where to find the prior copy of the data */
	uint64_t drr_refguid;
	uint64_t drr_refobject;
	uint64_t drr_refoffset;
	/* properties of the data */
	uint8_t drr_checksumtype;
	uint8_t drr_flags;
	uint8_t drr_pad2[6];
	ddt_key_t drr_key; /* deduplication key */
	} drr_write_byref;
	struct drr_spill {
	uint64_t drr_object;
	uint64_t drr_length;
	uint64_t drr_toguid;
	uint8_t drr_flags;
	uint8_t drr_compressiontype;
	uint8_t drr_pad[6];
	/* only nonzero for raw streams */
	uint64_t drr_compressed_size;
	uint8_t drr_salt[ZIO_DATA_SALT_LEN];
	uint8_t drr_iv[ZIO_DATA_IV_LEN];
	uint8_t drr_mac[ZIO_DATA_MAC_LEN];
	dmu_object_type_t drr_type;
	/* spill data follows */
	} drr_spill;
	struct drr_write_embedded {
	uint64_t drr_object;
	uint64_t drr_offset;
	/* logical length, should equal blocksize */
	uint64_t drr_length;
	uint64_t drr_toguid;
	uint8_t drr_compression;
	uint8_t drr_etype;
	uint8_t drr_pad[6];
	uint32_t drr_lsize; /* uncompressed size of payload */
	uint32_t drr_psize; /* compr. (real) size of payload */
	/* (possibly compressed) content follows */
	} drr_write_embedded;
	struct drr_object_range {
	uint64_t drr_firstobj;
	uint64_t drr_numslots;
	uint64_t drr_toguid;
	uint8_t drr_salt[ZIO_DATA_SALT_LEN];
	uint8_t drr_iv[ZIO_DATA_IV_LEN];
	uint8_t drr_mac[ZIO_DATA_MAC_LEN];
	uint8_t drr_flags;
	uint8_t drr_pad[3];
	} drr_object_range;
	struct drr_redact {
	uint64_t drr_object;
	uint64_t drr_offset;
	uint64_t drr_length;
	uint64_t drr_toguid;
	} drr_redact;

	/*
	* Note: drr_checksum is overlaid with all record types
	* except DRR_BEGIN. Therefore its (non-pad) members
	* must not overlap with members from the other structs.
	* We accomplish this by putting its members at the very
	* end of the struct.
	*/
	struct drr_checksum {
	uint64_t drr_pad[34];
	/*
	* fletcher-4 checksum of everything preceding the
	* checksum.
	*/
	zio_cksum_t drr_checksum;
	} drr_checksum;
	} drr_u;
	} dmu_replay_record_t;

	/* diff record range types */
	typedef enum diff_type {
	DDR_NONE = 0x1,
	DDR_INUSE = 0x2,
	DDR_FREE = 0x4
	} diff_type_t;

	/*
	* The diff reports back ranges of free or in-use objects.
	*/
	typedef struct dmu_diff_record {
	uint64_t ddr_type;
	uint64_t ddr_first;
	uint64_t ddr_last;
	} dmu_diff_record_t;

	typedef struct zinject_record {
	uint64_t zi_objset;
	uint64_t zi_object;
	uint64_t zi_start;
	uint64_t zi_end;
	uint64_t zi_guid;
	uint32_t zi_level;
	uint32_t zi_error;
	uint64_t zi_type;
	uint32_t zi_freq;
	uint32_t zi_failfast;
	char zi_func[MAXNAMELEN];
	uint32_t zi_iotype;
	int32_t zi_duration;
	uint64_t zi_timer;
	uint64_t zi_nlanes;
	uint32_t zi_cmd;
	uint32_t zi_dvas;
	} zinject_record_t;

	#define ZINJECT_NULL 0x1
	#define ZINJECT_FLUSH_ARC 0x2
	#define ZINJECT_UNLOAD_SPA 0x4
	#define ZINJECT_CALC_RANGE 0x8

	#define ZEVENT_NONE 0x0
	#define ZEVENT_NONBLOCK 0x1
	#define ZEVENT_SIZE 1024

	#define ZEVENT_SEEK_START 0
	#define ZEVENT_SEEK_END UINT64_MAX

	/* scaled frequency ranges */
	#define ZI_PERCENTAGE_MIN 4294UL
	#define ZI_PERCENTAGE_MAX UINT32_MAX

	#define ZI_NO_DVA (-1)

	typedef enum zinject_type {
	ZINJECT_UNINITIALIZED,
	ZINJECT_DATA_FAULT,
	ZINJECT_DEVICE_FAULT,
	ZINJECT_LABEL_FAULT,
	ZINJECT_IGNORED_WRITES,
	ZINJECT_PANIC,
	ZINJECT_DELAY_IO,
	ZINJECT_DECRYPT_FAULT,
	} zinject_type_t;

	typedef struct zfs_share {
	uint64_t z_exportdata;
	uint64_t z_sharedata;
	uint64_t z_sharetype; /* 0 = share, 1 = unshare */
	uint64_t z_sharemax; /* max length of share string */
	} zfs_share_t;

	/*
	* ZFS file systems may behave the usual, POSIX-compliant way, where
	* name lookups are case-sensitive. They may also be set up so that
	* all the name lookups are case-insensitive, or so that only some
	* lookups, the ones that set an FIGNORECASE flag, are case-insensitive.
	*/
	typedef enum zfs_case {
	ZFS_CASE_SENSITIVE,
	ZFS_CASE_INSENSITIVE,
	ZFS_CASE_MIXED
	} zfs_case_t;

	/*
	* Note: this struct must have the same layout in 32-bit and 64-bit, so
	* that 32-bit processes (like /sbin/zfs) can pass it to the 64-bit
	* kernel. Therefore, we add padding to it so that no "hidden" padding
	* is automatically added on 64-bit (but not on 32-bit).
	*/
	typedef struct zfs_cmd {
	char zc_name[MAXPATHLEN]; /* name of pool or dataset */
	uint64_t zc_nvlist_src; /* really (char ) /
	uint64_t zc_nvlist_src_size;
	uint64_t zc_nvlist_dst; /* really (char ) /
	uint64_t zc_nvlist_dst_size;
	boolean_t zc_nvlist_dst_filled; /* put an nvlist in dst? */
	int zc_pad2;

	/*
	* The following members are for legacy ioctls which haven't been
	* converted to the new method.
	*/
	uint64_t zc_history; /* really (char ) /
	char zc_value[MAXPATHLEN * 2];
	char zc_string[MAXNAMELEN];
	uint64_t zc_guid;
	uint64_t zc_nvlist_conf; /* really (char ) /
	uint64_t zc_nvlist_conf_size;
	uint64_t zc_cookie;
	uint64_t zc_objset_type;
	uint64_t zc_perm_action;
	uint64_t zc_history_len;
	uint64_t zc_history_offset;
	uint64_t zc_obj;
	uint64_t zc_iflags; /* internal to zfs(7fs) */
	zfs_share_t zc_share;
	dmu_objset_stats_t zc_objset_stats;
	struct drr_begin zc_begin_record;
	zinject_record_t zc_inject_record;
	uint32_t zc_defer_destroy;
	uint32_t zc_flags;
	uint64_t zc_action_handle;
	int zc_cleanup_fd;
	uint8_t zc_simple;
	uint8_t zc_pad[3]; /* alignment */
	uint64_t zc_sendobj;
	uint64_t zc_fromobj;
	uint64_t zc_createtxg;
	zfs_stat_t zc_stat;
	uint64_t zc_zoneid;
	} zfs_cmd_t;

	typedef struct zfs_useracct {
	char zu_domain[256];
	uid_t zu_rid;
	uint32_t zu_pad;
	uint64_t zu_space;
	} zfs_useracct_t;

	#define ZFSDEV_MAX_MINOR (1 << 16)
	#define ZFS_MIN_MINOR (ZFSDEV_MAX_MINOR + 1)

	#define ZPOOL_EXPORT_AFTER_SPLIT 0x1

	#ifdef _KERNEL
	struct objset;
	struct zfsvfs;

	typedef struct zfs_creat {
	nvlist_t *zct_zplprops;
	nvlist_t *zct_props;
	} zfs_creat_t;

	extern int zfs_secpolicy_snapshot_perms(const char , cred_t );
	extern int zfs_secpolicy_rename_perms(const char , const char , cred_t *);
	extern int zfs_secpolicy_destroy_perms(const char , cred_t );
	extern void zfs_unmount_snap(const char *);
	extern void zfs_destroy_unmount_origin(const char *);
	extern int getzfsvfs_impl(struct objset , struct zfsvfs *);
	extern int getzfsvfs(const char , struct zfsvfs *);

	enum zfsdev_state_type {
	ZST_ONEXIT,
	ZST_ZEVENT,
	ZST_ALL,
	};

	/*
	* The zfsdev_state_t structure is managed as a singly-linked list
	* from which items are never deleted. This allows for lock-free
	* reading of the list so long as assignments to the zs_next and
	* reads from zs_minor are performed atomically. Empty items are
	* indicated by storing -1 into zs_minor.
	*/
	typedef struct zfsdev_state {
	struct zfsdev_state zs_next; / next zfsdev_state_t link */
	minor_t zs_minor; /* made up minor number */
	void zs_onexit; / onexit data */
	void zs_zevent; / zevent data */
	} zfsdev_state_t;

	extern void *zfsdev_get_state(minor_t minor, enum zfsdev_state_type which);
	extern int zfsdev_getminor(int fd, minor_t *minorp);
	extern minor_t zfsdev_minor_alloc(void);

	extern uint_t zfs_fsyncer_key;
	extern uint_t zfs_allow_log_key;

	#endif /* _KERNEL */

	#ifdef __cplusplus
	}
	#endif

	#endif /* _SYS_ZFS_IOCTL_H */
	Index: vendor-sys/openzfs/dist/include/sys/zio.h
	===================================================================
	--- vendor-sys/openzfs/dist/include/sys/zio.h (revision 365891)
	+++ vendor-sys/openzfs/dist/include/sys/zio.h (revision 365892)
	@@ -1,710 +1,710 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
	- * Copyright (c) 2012, 2018 by Delphix. All rights reserved.
	+ * Copyright (c) 2012, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
	* Copyright (c) 2013, Joyent, Inc. All rights reserved.
	* Copyright 2016 Toomas Soome <tsoome@me.com>
	* Copyright (c) 2019, Allan Jude
	* Copyright (c) 2019, Klara Inc.
	* Copyright (c) 2019-2020, Michael Niewöhner
	*/

	#ifndef _ZIO_H
	#define _ZIO_H

	#include <sys/zio_priority.h>
	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/txg.h>
	#include <sys/avl.h>
	#include <sys/fs/zfs.h>
	#include <sys/zio_impl.h>

	#ifdef __cplusplus
	extern "C" {
	#endif

	/*
	* Embedded checksum
	*/
	#define ZEC_MAGIC 0x210da7ab10c7a11ULL

	typedef struct zio_eck {
	uint64_t zec_magic; /* for validation, endianness */
	zio_cksum_t zec_cksum; /* 256-bit checksum */
	} zio_eck_t;

	/*
	* Gang block headers are self-checksumming and contain an array
	* of block pointers.
	*/
	#define SPA_GANGBLOCKSIZE SPA_MINBLOCKSIZE
	#define SPA_GBH_NBLKPTRS ((SPA_GANGBLOCKSIZE - \
	sizeof (zio_eck_t)) / sizeof (blkptr_t))
	#define SPA_GBH_FILLER ((SPA_GANGBLOCKSIZE - \
	sizeof (zio_eck_t) - \
	(SPA_GBH_NBLKPTRS * sizeof (blkptr_t))) /\
	sizeof (uint64_t))

	typedef struct zio_gbh {
	blkptr_t zg_blkptr[SPA_GBH_NBLKPTRS];
	uint64_t zg_filler[SPA_GBH_FILLER];
	zio_eck_t zg_tail;
	} zio_gbh_phys_t;

	enum zio_checksum {
	ZIO_CHECKSUM_INHERIT = 0,
	ZIO_CHECKSUM_ON,
	ZIO_CHECKSUM_OFF,
	ZIO_CHECKSUM_LABEL,
	ZIO_CHECKSUM_GANG_HEADER,
	ZIO_CHECKSUM_ZILOG,
	ZIO_CHECKSUM_FLETCHER_2,
	ZIO_CHECKSUM_FLETCHER_4,
	ZIO_CHECKSUM_SHA256,
	ZIO_CHECKSUM_ZILOG2,
	ZIO_CHECKSUM_NOPARITY,
	ZIO_CHECKSUM_SHA512,
	ZIO_CHECKSUM_SKEIN,
	#if !defined(__FreeBSD__)
	ZIO_CHECKSUM_EDONR,
	#endif
	ZIO_CHECKSUM_FUNCTIONS
	};

	/*
	* The number of "legacy" compression functions which can be set on individual
	* objects.
	*/
	#define ZIO_CHECKSUM_LEGACY_FUNCTIONS ZIO_CHECKSUM_ZILOG2

	#define ZIO_CHECKSUM_ON_VALUE ZIO_CHECKSUM_FLETCHER_4
	#define ZIO_CHECKSUM_DEFAULT ZIO_CHECKSUM_ON

	#define ZIO_CHECKSUM_MASK 0xffULL
	#define ZIO_CHECKSUM_VERIFY (1 << 8)

	#define ZIO_DEDUPCHECKSUM ZIO_CHECKSUM_SHA256

	/* supported encryption algorithms */
	enum zio_encrypt {
	ZIO_CRYPT_INHERIT = 0,
	ZIO_CRYPT_ON,
	ZIO_CRYPT_OFF,
	ZIO_CRYPT_AES_128_CCM,
	ZIO_CRYPT_AES_192_CCM,
	ZIO_CRYPT_AES_256_CCM,
	ZIO_CRYPT_AES_128_GCM,
	ZIO_CRYPT_AES_192_GCM,
	ZIO_CRYPT_AES_256_GCM,
	ZIO_CRYPT_FUNCTIONS
	};

	#define ZIO_CRYPT_ON_VALUE ZIO_CRYPT_AES_256_GCM
	#define ZIO_CRYPT_DEFAULT ZIO_CRYPT_OFF

	/* macros defining encryption lengths */
	#define ZIO_OBJSET_MAC_LEN 32
	#define ZIO_DATA_IV_LEN 12
	#define ZIO_DATA_SALT_LEN 8
	#define ZIO_DATA_MAC_LEN 16

	/*
	* The number of "legacy" compression functions which can be set on individual
	* objects.
	*/
	#define ZIO_COMPRESS_LEGACY_FUNCTIONS ZIO_COMPRESS_LZ4

	/*
	* The meaning of "compress = on" selected by the compression features enabled
	* on a given pool.
	*/
	#define ZIO_COMPRESS_LEGACY_ON_VALUE ZIO_COMPRESS_LZJB
	#define ZIO_COMPRESS_LZ4_ON_VALUE ZIO_COMPRESS_LZ4

	#define ZIO_COMPRESS_DEFAULT ZIO_COMPRESS_OFF

	#define BOOTFS_COMPRESS_VALID(compress) \
	((compress) == ZIO_COMPRESS_LZJB \|\| \
	(compress) == ZIO_COMPRESS_LZ4 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_1 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_2 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_3 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_4 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_5 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_6 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_7 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_8 \|\| \
	(compress) == ZIO_COMPRESS_GZIP_9 \|\| \
	(compress) == ZIO_COMPRESS_ZLE \|\| \
	(compress) == ZIO_COMPRESS_ZSTD \|\| \
	(compress) == ZIO_COMPRESS_ON \|\| \
	(compress) == ZIO_COMPRESS_OFF)


	#define ZIO_COMPRESS_ALGO(x) (x & SPA_COMPRESSMASK)
	#define ZIO_COMPRESS_LEVEL(x) ((x & ~SPA_COMPRESSMASK) >> SPA_COMPRESSBITS)
	#define ZIO_COMPRESS_RAW(type, level) (type \| ((level) << SPA_COMPRESSBITS))

	#define ZIO_COMPLEVEL_ZSTD(level) \
	ZIO_COMPRESS_RAW(ZIO_COMPRESS_ZSTD, level)

	#define ZIO_FAILURE_MODE_WAIT 0
	#define ZIO_FAILURE_MODE_CONTINUE 1
	#define ZIO_FAILURE_MODE_PANIC 2

	typedef enum zio_suspend_reason {
	ZIO_SUSPEND_NONE = 0,
	ZIO_SUSPEND_IOERR,
	ZIO_SUSPEND_MMP,
	} zio_suspend_reason_t;

	enum zio_flag {
	/*
	* Flags inherited by gang, ddt, and vdev children,
	* and that must be equal for two zios to aggregate
	*/
	ZIO_FLAG_DONT_AGGREGATE = 1 << 0,
	ZIO_FLAG_IO_REPAIR = 1 << 1,
	ZIO_FLAG_SELF_HEAL = 1 << 2,
	ZIO_FLAG_RESILVER = 1 << 3,
	ZIO_FLAG_SCRUB = 1 << 4,
	ZIO_FLAG_SCAN_THREAD = 1 << 5,
	ZIO_FLAG_PHYSICAL = 1 << 6,

	#define ZIO_FLAG_AGG_INHERIT (ZIO_FLAG_CANFAIL - 1)

	/*
	* Flags inherited by ddt, gang, and vdev children.
	*/
	ZIO_FLAG_CANFAIL = 1 << 7, /* must be first for INHERIT */
	ZIO_FLAG_SPECULATIVE = 1 << 8,
	ZIO_FLAG_CONFIG_WRITER = 1 << 9,
	ZIO_FLAG_DONT_RETRY = 1 << 10,
	ZIO_FLAG_DONT_CACHE = 1 << 11,
	ZIO_FLAG_NODATA = 1 << 12,
	ZIO_FLAG_INDUCE_DAMAGE = 1 << 13,
	ZIO_FLAG_IO_ALLOCATING = 1 << 14,

	#define ZIO_FLAG_DDT_INHERIT (ZIO_FLAG_IO_RETRY - 1)
	#define ZIO_FLAG_GANG_INHERIT (ZIO_FLAG_IO_RETRY - 1)

	/*
	* Flags inherited by vdev children.
	*/
	ZIO_FLAG_IO_RETRY = 1 << 15, /* must be first for INHERIT */
	ZIO_FLAG_PROBE = 1 << 16,
	ZIO_FLAG_TRYHARD = 1 << 17,
	ZIO_FLAG_OPTIONAL = 1 << 18,

	#define ZIO_FLAG_VDEV_INHERIT (ZIO_FLAG_DONT_QUEUE - 1)

	/*
	* Flags not inherited by any children.
	*/
	ZIO_FLAG_DONT_QUEUE = 1 << 19, /* must be first for INHERIT */
	ZIO_FLAG_DONT_PROPAGATE = 1 << 20,
	ZIO_FLAG_IO_BYPASS = 1 << 21,
	ZIO_FLAG_IO_REWRITE = 1 << 22,
	ZIO_FLAG_RAW_COMPRESS = 1 << 23,
	ZIO_FLAG_RAW_ENCRYPT = 1 << 24,
	ZIO_FLAG_GANG_CHILD = 1 << 25,
	ZIO_FLAG_DDT_CHILD = 1 << 26,
	ZIO_FLAG_GODFATHER = 1 << 27,
	ZIO_FLAG_NOPWRITE = 1 << 28,
	ZIO_FLAG_REEXECUTED = 1 << 29,
	ZIO_FLAG_DELEGATED = 1 << 30,
	ZIO_FLAG_FASTWRITE = 1 << 31,
	};

	#define ZIO_FLAG_MUSTSUCCEED 0
	#define ZIO_FLAG_RAW (ZIO_FLAG_RAW_COMPRESS \| ZIO_FLAG_RAW_ENCRYPT)

	#define ZIO_DDT_CHILD_FLAGS(zio) \
	(((zio)->io_flags & ZIO_FLAG_DDT_INHERIT) \| \
	ZIO_FLAG_DDT_CHILD \| ZIO_FLAG_CANFAIL)

	#define ZIO_GANG_CHILD_FLAGS(zio) \
	(((zio)->io_flags & ZIO_FLAG_GANG_INHERIT) \| \
	ZIO_FLAG_GANG_CHILD \| ZIO_FLAG_CANFAIL)

	#define ZIO_VDEV_CHILD_FLAGS(zio) \
	(((zio)->io_flags & ZIO_FLAG_VDEV_INHERIT) \| \
	ZIO_FLAG_DONT_PROPAGATE \| ZIO_FLAG_CANFAIL)

	#define ZIO_CHILD_BIT(x) (1 << (x))
	#define ZIO_CHILD_BIT_IS_SET(val, x) ((val) & (1 << (x)))

	enum zio_child {
	ZIO_CHILD_VDEV = 0,
	ZIO_CHILD_GANG,
	ZIO_CHILD_DDT,
	ZIO_CHILD_LOGICAL,
	ZIO_CHILD_TYPES
	};

	#define ZIO_CHILD_VDEV_BIT ZIO_CHILD_BIT(ZIO_CHILD_VDEV)
	#define ZIO_CHILD_GANG_BIT ZIO_CHILD_BIT(ZIO_CHILD_GANG)
	#define ZIO_CHILD_DDT_BIT ZIO_CHILD_BIT(ZIO_CHILD_DDT)
	#define ZIO_CHILD_LOGICAL_BIT ZIO_CHILD_BIT(ZIO_CHILD_LOGICAL)
	#define ZIO_CHILD_ALL_BITS \
	(ZIO_CHILD_VDEV_BIT \| ZIO_CHILD_GANG_BIT \| \
	ZIO_CHILD_DDT_BIT \| ZIO_CHILD_LOGICAL_BIT)

	enum zio_wait_type {
	ZIO_WAIT_READY = 0,
	ZIO_WAIT_DONE,
	ZIO_WAIT_TYPES
	};

	typedef void zio_done_func_t(zio_t *zio);

	extern int zio_exclude_metadata;
	extern int zio_dva_throttle_enabled;
	extern const char *zio_type_name[ZIO_TYPES];

	/*
	* A bookmark is a four-tuple <objset, object, level, blkid> that uniquely
	* identifies any block in the pool. By convention, the meta-objset (MOS)
	* is objset 0, and the meta-dnode is object 0. This covers all blocks
	* except root blocks and ZIL blocks, which are defined as follows:
	*
	* Root blocks (objset_phys_t) are object 0, level -1: <objset, 0, -1, 0>.
	* ZIL blocks are bookmarked <objset, 0, -2, blkid == ZIL sequence number>.
	* dmu_sync()ed ZIL data blocks are bookmarked <objset, object, -2, blkid>.
	* dnode visit bookmarks are <objset, object id of dnode, -3, 0>.
	*
	* Note: this structure is called a bookmark because its original purpose
	* was to remember where to resume a pool-wide traverse.
	*
	* Note: this structure is passed between userland and the kernel, and is
	* stored on disk (by virtue of being incorporated into other on-disk
	* structures, e.g. dsl_scan_phys_t).
	*/
	struct zbookmark_phys {
	uint64_t zb_objset;
	uint64_t zb_object;
	int64_t zb_level;
	uint64_t zb_blkid;
	};

	#define SET_BOOKMARK(zb, objset, object, level, blkid) \
	{ \
	(zb)->zb_objset = objset; \
	(zb)->zb_object = object; \
	(zb)->zb_level = level; \
	(zb)->zb_blkid = blkid; \
	}

	#define ZB_DESTROYED_OBJSET (-1ULL)

	#define ZB_ROOT_OBJECT (0ULL)
	#define ZB_ROOT_LEVEL (-1LL)
	#define ZB_ROOT_BLKID (0ULL)

	#define ZB_ZIL_OBJECT (0ULL)
	#define ZB_ZIL_LEVEL (-2LL)

	#define ZB_DNODE_LEVEL (-3LL)
	#define ZB_DNODE_BLKID (0ULL)

	#define ZB_IS_ZERO(zb) \
	((zb)->zb_objset == 0 && (zb)->zb_object == 0 && \
	(zb)->zb_level == 0 && (zb)->zb_blkid == 0)
	#define ZB_IS_ROOT(zb) \
	((zb)->zb_object == ZB_ROOT_OBJECT && \
	(zb)->zb_level == ZB_ROOT_LEVEL && \
	(zb)->zb_blkid == ZB_ROOT_BLKID)

	typedef struct zio_prop {
	enum zio_checksum zp_checksum;
	enum zio_compress zp_compress;
	uint8_t zp_complevel;
	dmu_object_type_t zp_type;
	uint8_t zp_level;
	uint8_t zp_copies;
	boolean_t zp_dedup;
	boolean_t zp_dedup_verify;
	boolean_t zp_nopwrite;
	boolean_t zp_encrypt;
	boolean_t zp_byteorder;
	uint8_t zp_salt[ZIO_DATA_SALT_LEN];
	uint8_t zp_iv[ZIO_DATA_IV_LEN];
	uint8_t zp_mac[ZIO_DATA_MAC_LEN];
	uint32_t zp_zpl_smallblk;
	} zio_prop_t;

	typedef struct zio_cksum_report zio_cksum_report_t;

	typedef void zio_cksum_finish_f(zio_cksum_report_t *rep,
	const abd_t *good_data);
	typedef void zio_cksum_free_f(void *cbdata, size_t size);

	struct zio_bad_cksum; /* defined in zio_checksum.h */
	struct dnode_phys;
	struct abd;

	struct zio_cksum_report {
	struct zio_cksum_report *zcr_next;
	nvlist_t *zcr_ereport;
	nvlist_t *zcr_detector;
	void *zcr_cbdata;
	size_t zcr_cbinfo; /* passed to zcr_free() */
	uint64_t zcr_align;
	uint64_t zcr_length;
	zio_cksum_finish_f *zcr_finish;
	zio_cksum_free_f *zcr_free;

	/* internal use only */
	struct zio_bad_cksum zcr_ckinfo; / information from failure */
	};

	typedef void zio_vsd_cksum_report_f(zio_t zio, zio_cksum_report_t zcr,
	void *arg);

	zio_vsd_cksum_report_f zio_vsd_default_cksum_report;

	typedef struct zio_vsd_ops {
	zio_done_func_t *vsd_free;
	zio_vsd_cksum_report_f *vsd_cksum_report;
	} zio_vsd_ops_t;

	typedef struct zio_gang_node {
	zio_gbh_phys_t *gn_gbh;
	struct zio_gang_node *gn_child[SPA_GBH_NBLKPTRS];
	} zio_gang_node_t;

	typedef zio_t zio_gang_issue_func_t(zio_t zio, blkptr_t *bp,
	zio_gang_node_t gn, struct abd data, uint64_t offset);

	typedef void zio_transform_func_t(zio_t zio, struct abd data, uint64_t size);

	typedef struct zio_transform {
	struct abd *zt_orig_abd;
	uint64_t zt_orig_size;
	uint64_t zt_bufsize;
	zio_transform_func_t *zt_transform;
	struct zio_transform *zt_next;
	} zio_transform_t;

	typedef zio_t zio_pipe_stage_t(zio_t zio);

	/*
	* The io_reexecute flags are distinct from io_flags because the child must
	* be able to propagate them to the parent. The normal io_flags are local
	* to the zio, not protected by any lock, and not modifiable by children;
	* the reexecute flags are protected by io_lock, modifiable by children,
	* and always propagated -- even when ZIO_FLAG_DONT_PROPAGATE is set.
	*/
	#define ZIO_REEXECUTE_NOW 0x01
	#define ZIO_REEXECUTE_SUSPEND 0x02

	/*
	* The io_trim flags are used to specify the type of TRIM to perform. They
	* only apply to ZIO_TYPE_TRIM zios are distinct from io_flags.
	*/
	enum trim_flag {
	ZIO_TRIM_SECURE = 1 << 0,
	};

	typedef struct zio_alloc_list {
	list_t zal_list;
	uint64_t zal_size;
	} zio_alloc_list_t;

	typedef struct zio_link {
	zio_t *zl_parent;
	zio_t *zl_child;
	list_node_t zl_parent_node;
	list_node_t zl_child_node;
	} zio_link_t;

	struct zio {
	/* Core information about this I/O */
	zbookmark_phys_t io_bookmark;
	zio_prop_t io_prop;
	zio_type_t io_type;
	enum zio_child io_child_type;
	enum trim_flag io_trim_flags;
	int io_cmd;
	zio_priority_t io_priority;
	uint8_t io_reexecute;
	uint8_t io_state[ZIO_WAIT_TYPES];
	uint64_t io_txg;
	spa_t *io_spa;
	blkptr_t *io_bp;
	blkptr_t *io_bp_override;
	blkptr_t io_bp_copy;
	list_t io_parent_list;
	list_t io_child_list;
	zio_t *io_logical;
	zio_transform_t *io_transform_stack;

	/* Callback info */
	zio_done_func_t *io_ready;
	zio_done_func_t *io_children_ready;
	zio_done_func_t *io_physdone;
	zio_done_func_t *io_done;
	void *io_private;
	int64_t io_prev_space_delta; /* DMU private */
	blkptr_t io_bp_orig;
	/* io_lsize != io_orig_size iff this is a raw write */
	uint64_t io_lsize;

	/* Data represented by this I/O */
	struct abd *io_abd;
	struct abd *io_orig_abd;
	uint64_t io_size;
	uint64_t io_orig_size;

	/* Stuff for the vdev stack */
	vdev_t *io_vd;
	void *io_vsd;
	const zio_vsd_ops_t *io_vsd_ops;
	metaslab_class_t io_metaslab_class; / dva throttle class */

	uint64_t io_offset;
	hrtime_t io_timestamp; /* submitted at */
	hrtime_t io_queued_timestamp;
	hrtime_t io_target_timestamp;
	hrtime_t io_delta; /* vdev queue service delta */
	hrtime_t io_delay; /* Device access time (disk or */
	/* file). */
	avl_node_t io_queue_node;
	avl_node_t io_offset_node;
	avl_node_t io_alloc_node;
	zio_alloc_list_t io_alloc_list;

	/* Internal pipeline state */
	enum zio_flag io_flags;
	enum zio_stage io_stage;
	enum zio_stage io_pipeline;
	enum zio_flag io_orig_flags;
	enum zio_stage io_orig_stage;
	enum zio_stage io_orig_pipeline;
	enum zio_stage io_pipeline_trace;
	int io_error;
	int io_child_error[ZIO_CHILD_TYPES];
	uint64_t io_children[ZIO_CHILD_TYPES][ZIO_WAIT_TYPES];
	uint64_t io_child_count;
	uint64_t io_phys_children;
	uint64_t io_parent_count;
	uint64_t *io_stall;
	zio_t *io_gang_leader;
	zio_gang_node_t *io_gang_tree;
	void *io_executor;
	void *io_waiter;
	void *io_bio;
	kmutex_t io_lock;
	kcondvar_t io_cv;
	int io_allocator;

	/* FMA state */
	zio_cksum_report_t *io_cksum_report;
	uint64_t io_ena;

	/* Taskq dispatching state */
	taskq_ent_t io_tqent;
	};

	enum blk_verify_flag {
	BLK_VERIFY_ONLY,
	BLK_VERIFY_LOG,
	BLK_VERIFY_HALT
	};

	extern int zio_bookmark_compare(const void , const void );

	extern zio_t zio_null(zio_t pio, spa_t spa, vdev_t vd,
	zio_done_func_t done, void priv, enum zio_flag flags);

	extern zio_t zio_root(spa_t spa,
	zio_done_func_t done, void priv, enum zio_flag flags);

	extern zio_t zio_read(zio_t pio, spa_t spa, const blkptr_t bp,
	struct abd data, uint64_t lsize, zio_done_func_t done, void *priv,
	zio_priority_t priority, enum zio_flag flags, const zbookmark_phys_t *zb);

	extern zio_t zio_write(zio_t pio, spa_t spa, uint64_t txg, blkptr_t bp,
	struct abd data, uint64_t size, uint64_t psize, const zio_prop_t zp,
	zio_done_func_t ready, zio_done_func_t children_ready,
	zio_done_func_t physdone, zio_done_func_t done,
	void *priv, zio_priority_t priority, enum zio_flag flags,
	const zbookmark_phys_t *zb);

	extern zio_t zio_rewrite(zio_t pio, spa_t spa, uint64_t txg, blkptr_t bp,
	struct abd data, uint64_t size, zio_done_func_t done, void *priv,
	zio_priority_t priority, enum zio_flag flags, zbookmark_phys_t *zb);

	extern void zio_write_override(zio_t zio, blkptr_t bp, int copies,
	boolean_t nopwrite);

	extern void zio_free(spa_t spa, uint64_t txg, const blkptr_t bp);

	extern zio_t zio_claim(zio_t pio, spa_t *spa, uint64_t txg,
	const blkptr_t *bp,
	zio_done_func_t done, void priv, enum zio_flag flags);

	extern zio_t zio_ioctl(zio_t pio, spa_t spa, vdev_t vd, int cmd,
	zio_done_func_t done, void priv, enum zio_flag flags);

	extern zio_t zio_trim(zio_t pio, vdev_t *vd, uint64_t offset, uint64_t size,
	zio_done_func_t done, void priv, zio_priority_t priority,
	enum zio_flag flags, enum trim_flag trim_flags);

	extern zio_t zio_read_phys(zio_t pio, vdev_t *vd, uint64_t offset,
	uint64_t size, struct abd *data, int checksum,
	zio_done_func_t done, void priv, zio_priority_t priority,
	enum zio_flag flags, boolean_t labels);

	extern zio_t zio_write_phys(zio_t pio, vdev_t *vd, uint64_t offset,
	uint64_t size, struct abd *data, int checksum,
	zio_done_func_t done, void priv, zio_priority_t priority,
	enum zio_flag flags, boolean_t labels);

	extern zio_t zio_free_sync(zio_t pio, spa_t *spa, uint64_t txg,
	const blkptr_t *bp, enum zio_flag flags);

	extern int zio_alloc_zil(spa_t spa, objset_t os, uint64_t txg,
	blkptr_t new_bp, uint64_t size, boolean_t slog);
	extern void zio_flush(zio_t zio, vdev_t vd);
	extern void zio_shrink(zio_t *zio, uint64_t size);

	extern int zio_wait(zio_t *zio);
	extern void zio_nowait(zio_t *zio);
	extern void zio_execute(zio_t *zio);
	extern void zio_interrupt(zio_t *zio);
	extern void zio_delay_init(zio_t *zio);
	extern void zio_delay_interrupt(zio_t *zio);
	extern void zio_deadman(zio_t zio, char tag);

	extern zio_t zio_walk_parents(zio_t cio, zio_link_t **);
	extern zio_t zio_walk_children(zio_t pio, zio_link_t **);
	extern zio_t zio_unique_parent(zio_t cio);
	extern void zio_add_child(zio_t pio, zio_t cio);

	extern void *zio_buf_alloc(size_t size);
	extern void zio_buf_free(void *buf, size_t size);
	extern void *zio_data_buf_alloc(size_t size);
	extern void zio_data_buf_free(void *buf, size_t size);

	extern void zio_push_transform(zio_t zio, struct abd abd, uint64_t size,
	uint64_t bufsize, zio_transform_func_t *transform);
	extern void zio_pop_transforms(zio_t *zio);

	extern void zio_resubmit_stage_async(void *);

	extern zio_t zio_vdev_child_io(zio_t zio, blkptr_t bp, vdev_t vd,
	uint64_t offset, struct abd *data, uint64_t size, int type,
	zio_priority_t priority, enum zio_flag flags,
	zio_done_func_t done, void priv);

	extern zio_t zio_vdev_delegated_io(vdev_t vd, uint64_t offset,
	struct abd *data, uint64_t size, zio_type_t type, zio_priority_t priority,
	enum zio_flag flags, zio_done_func_t done, void priv);

	extern void zio_vdev_io_bypass(zio_t *zio);
	extern void zio_vdev_io_reissue(zio_t *zio);
	extern void zio_vdev_io_redone(zio_t *zio);

	extern void zio_change_priority(zio_t *pio, zio_priority_t priority);

	extern void zio_checksum_verified(zio_t *zio);
	extern int zio_worst_error(int e1, int e2);

	extern enum zio_checksum zio_checksum_select(enum zio_checksum child,
	enum zio_checksum parent);
	extern enum zio_checksum zio_checksum_dedup_select(spa_t *spa,
	enum zio_checksum child, enum zio_checksum parent);
	extern enum zio_compress zio_compress_select(spa_t *spa,
	enum zio_compress child, enum zio_compress parent);
	extern uint8_t zio_complevel_select(spa_t *spa, enum zio_compress compress,
	uint8_t child, uint8_t parent);

	extern void zio_suspend(spa_t spa, zio_t zio, zio_suspend_reason_t);
	extern int zio_resume(spa_t *spa);
	extern void zio_resume_wait(spa_t *spa);

	extern boolean_t zfs_blkptr_verify(spa_t spa, const blkptr_t bp,
	boolean_t config_held, enum blk_verify_flag blk_verify);

	/*
	* Initial setup and teardown.
	*/
	extern void zio_init(void);
	extern void zio_fini(void);

	/*
	* Fault injection
	*/
	struct zinject_record;
	extern uint32_t zio_injection_enabled;
	extern int zio_inject_fault(char name, int flags, int id,
	struct zinject_record *record);
	extern int zio_inject_list_next(int id, char name, size_t buflen,
	struct zinject_record *record);
	extern int zio_clear_fault(int id);
	extern void zio_handle_panic_injection(spa_t spa, char tag, uint64_t type);
	extern int zio_handle_decrypt_injection(spa_t spa, const zbookmark_phys_t zb,
	uint64_t type, int error);
	extern int zio_handle_fault_injection(zio_t *zio, int error);
	extern int zio_handle_device_injection(vdev_t vd, zio_t zio, int error);
	extern int zio_handle_device_injections(vdev_t vd, zio_t zio, int err1,
	int err2);
	extern int zio_handle_label_injection(zio_t *zio, int error);
	extern void zio_handle_ignored_writes(zio_t *zio);
	extern hrtime_t zio_handle_io_delay(zio_t *zio);

	/*
	* Checksum ereport functions
	*/
	-extern void zfs_ereport_start_checksum(spa_t spa, vdev_t vd,
	+extern int zfs_ereport_start_checksum(spa_t spa, vdev_t vd,
	const zbookmark_phys_t zb, struct zio zio, uint64_t offset,
	uint64_t length, void arg, struct zio_bad_cksum info);
	extern void zfs_ereport_finish_checksum(zio_cksum_report_t *report,
	const abd_t good_data, const abd_t bad_data, boolean_t drop_if_identical);

	extern void zfs_ereport_free_checksum(zio_cksum_report_t *report);

	/* If we have the good data in hand, this function can be used */
	extern int zfs_ereport_post_checksum(spa_t spa, vdev_t vd,
	const zbookmark_phys_t zb, struct zio zio, uint64_t offset,
	uint64_t length, const abd_t good_data, const abd_t bad_data,
	struct zio_bad_cksum *info);

	/* Called from spa_sync(), but primarily an injection handler */
	extern void spa_handle_ignored_writes(spa_t *spa);

	/* zbookmark_phys functions */
	boolean_t zbookmark_subtree_completed(const struct dnode_phys *dnp,
	const zbookmark_phys_t subtree_root, const zbookmark_phys_t last_block);
	int zbookmark_compare(uint16_t dbss1, uint8_t ibs1, uint16_t dbss2,
	uint8_t ibs2, const zbookmark_phys_t zb1, const zbookmark_phys_t zb2);

	#ifdef __cplusplus
	}
	#endif

	#endif /* _ZIO_H */
	Index: vendor-sys/openzfs/dist/lib/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/lib/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/Makefile.am (revision 365892)
	@@ -1,14 +1,18 @@
	# NB: GNU Automake Manual, Chapter 8.3.5: Libtool Convenience Libraries
	# These nine libraries are intermediary build components.
	SUBDIRS = libavl libicp libshare libspl libtpool libzstd

	if BUILD_LINUX
	SUBDIRS += libefi
	endif

	+# libnvpair is installed as part of the final build product
	+# libzutil depends on it, so it must be compiled before libzutil
	+SUBDIRS += libnvpair
	+
	# libzutil depends on libefi if present
	SUBDIRS += libzutil libunicode

	# These five libraries, which are installed as the final build product,
	# incorporate the eight convenience libraries given above.
	-SUBDIRS += libuutil libnvpair libzfs_core libzfs libzpool
	+SUBDIRS += libuutil libzfs_core libzfs libzpool libzfsbootenv
	Index: vendor-sys/openzfs/dist/lib/libefi/rdwr_efi.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libefi/rdwr_efi.c (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libefi/rdwr_efi.c (revision 365892)
	@@ -1,1655 +1,1754 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright 2012 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2018 by Delphix. All rights reserved.
	*/

	#include <stdio.h>
	#include <stdlib.h>
	#include <errno.h>
	#include <string.h>
	#include <strings.h>
	#include <unistd.h>
	#include <uuid/uuid.h>
	#include <zlib.h>
	#include <libintl.h>
	#include <sys/types.h>
	#include <sys/dkio.h>
	#include <sys/vtoc.h>
	#include <sys/mhd.h>
	#include <sys/param.h>
	#include <sys/dktp/fdisk.h>
	#include <sys/efi_partition.h>
	#include <sys/byteorder.h>
	#include <sys/vdev_disk.h>
	#include <linux/fs.h>
	+#include <linux/blkpg.h>

	static struct uuid_to_ptag {
	struct uuid uuid;
	} conversion_array[] = {
	{ EFI_UNUSED },
	{ EFI_BOOT },
	{ EFI_ROOT },
	{ EFI_SWAP },
	{ EFI_USR },
	{ EFI_BACKUP },
	{ EFI_UNUSED }, /* STAND is never used */
	{ EFI_VAR },
	{ EFI_HOME },
	{ EFI_ALTSCTR },
	{ EFI_UNUSED }, /* CACHE (cachefs) is never used */
	{ EFI_RESERVED },
	{ EFI_SYSTEM },
	{ EFI_LEGACY_MBR },
	{ EFI_SYMC_PUB },
	{ EFI_SYMC_CDS },
	{ EFI_MSFT_RESV },
	{ EFI_DELL_BASIC },
	{ EFI_DELL_RAID },
	{ EFI_DELL_SWAP },
	{ EFI_DELL_LVM },
	{ EFI_DELL_RESV },
	{ EFI_AAPL_HFS },
	{ EFI_AAPL_UFS },
	{ EFI_FREEBSD_BOOT },
	{ EFI_FREEBSD_SWAP },
	{ EFI_FREEBSD_UFS },
	{ EFI_FREEBSD_VINUM },
	{ EFI_FREEBSD_ZFS },
	{ EFI_BIOS_BOOT },
	{ EFI_INTC_RS },
	{ EFI_SNE_BOOT },
	{ EFI_LENOVO_BOOT },
	{ EFI_MSFT_LDMM },
	{ EFI_MSFT_LDMD },
	{ EFI_MSFT_RE },
	{ EFI_IBM_GPFS },
	{ EFI_MSFT_STORAGESPACES },
	{ EFI_HPQ_DATA },
	{ EFI_HPQ_SVC },
	{ EFI_RHT_DATA },
	{ EFI_RHT_HOME },
	{ EFI_RHT_SRV },
	{ EFI_RHT_DMCRYPT },
	{ EFI_RHT_LUKS },
	{ EFI_FREEBSD_DISKLABEL },
	{ EFI_AAPL_RAID },
	{ EFI_AAPL_RAIDOFFLINE },
	{ EFI_AAPL_BOOT },
	{ EFI_AAPL_LABEL },
	{ EFI_AAPL_TVRECOVERY },
	{ EFI_AAPL_CORESTORAGE },
	{ EFI_NETBSD_SWAP },
	{ EFI_NETBSD_FFS },
	{ EFI_NETBSD_LFS },
	{ EFI_NETBSD_RAID },
	{ EFI_NETBSD_CAT },
	{ EFI_NETBSD_CRYPT },
	{ EFI_GOOG_KERN },
	{ EFI_GOOG_ROOT },
	{ EFI_GOOG_RESV },
	{ EFI_HAIKU_BFS },
	{ EFI_MIDNIGHTBSD_BOOT },
	{ EFI_MIDNIGHTBSD_DATA },
	{ EFI_MIDNIGHTBSD_SWAP },
	{ EFI_MIDNIGHTBSD_UFS },
	{ EFI_MIDNIGHTBSD_VINUM },
	{ EFI_MIDNIGHTBSD_ZFS },
	{ EFI_CEPH_JOURNAL },
	{ EFI_CEPH_DMCRYPTJOURNAL },
	{ EFI_CEPH_OSD },
	{ EFI_CEPH_DMCRYPTOSD },
	{ EFI_CEPH_CREATE },
	{ EFI_CEPH_DMCRYPTCREATE },
	{ EFI_OPENBSD_DISKLABEL },
	{ EFI_BBRY_QNX },
	{ EFI_BELL_PLAN9 },
	{ EFI_VMW_KCORE },
	{ EFI_VMW_VMFS },
	{ EFI_VMW_RESV },
	{ EFI_RHT_ROOTX86 },
	{ EFI_RHT_ROOTAMD64 },
	{ EFI_RHT_ROOTARM },
	{ EFI_RHT_ROOTARM64 },
	{ EFI_ACRONIS_SECUREZONE },
	{ EFI_ONIE_BOOT },
	{ EFI_ONIE_CONFIG },
	{ EFI_IBM_PPRPBOOT },
	{ EFI_FREEDESKTOP_BOOT }
	};

	/*
	* Default vtoc information for non-SVr4 partitions
	*/
	struct dk_map2 default_vtoc_map[NDKMAP] = {
	{ V_ROOT, 0 }, /* a - 0 */
	{ V_SWAP, V_UNMNT }, /* b - 1 */
	{ V_BACKUP, V_UNMNT }, /* c - 2 */
	{ V_UNASSIGNED, 0 }, /* d - 3 */
	{ V_UNASSIGNED, 0 }, /* e - 4 */
	{ V_UNASSIGNED, 0 }, /* f - 5 */
	{ V_USR, 0 }, /* g - 6 */
	{ V_UNASSIGNED, 0 }, /* h - 7 */

	#if defined(_SUNOS_VTOC_16)

	#if defined(i386) \|\| defined(__amd64) \|\| defined(__arm) \|\| \
	defined(__powerpc) \|\| defined(__sparc) \|\| defined(__s390__) \|\| \
	defined(__mips__) \|\| defined(__rv64g__)
	{ V_BOOT, V_UNMNT }, /* i - 8 */
	{ V_ALTSCTR, 0 }, /* j - 9 */

	#else
	#error No VTOC format defined.
	#endif /* defined(i386) */

	{ V_UNASSIGNED, 0 }, /* k - 10 */
	{ V_UNASSIGNED, 0 }, /* l - 11 */
	{ V_UNASSIGNED, 0 }, /* m - 12 */
	{ V_UNASSIGNED, 0 }, /* n - 13 */
	{ V_UNASSIGNED, 0 }, /* o - 14 */
	{ V_UNASSIGNED, 0 }, /* p - 15 */
	#endif /* defined(_SUNOS_VTOC_16) */
	};

	int efi_debug = 0;

	static int efi_read(int, struct dk_gpt *);

	/*
	* Return a 32-bit CRC of the contents of the buffer. Pre-and-post
	* one's conditioning will be handled by crc32() internally.
	*/
	static uint32_t
	efi_crc32(const unsigned char *buf, unsigned int size)
	{
	uint32_t crc = crc32(0, Z_NULL, 0);

	crc = crc32(crc, buf, size);

	return (crc);
	}

	static int
	read_disk_info(int fd, diskaddr_t capacity, uint_t lbsize)
	{
	int sector_size;
	unsigned long long capacity_size;

	if (ioctl(fd, BLKSSZGET, &sector_size) < 0)
	return (-1);

	if (ioctl(fd, BLKGETSIZE64, &capacity_size) < 0)
	return (-1);

	*lbsize = (uint_t)sector_size;
	*capacity = (diskaddr_t)(capacity_size / sector_size);

	return (0);
	}

	+/*
	+ * Return back the device name associated with the file descriptor. The
	+ * caller is responsible for freeing the memory associated with the
	+ * returned string.
	+ */
	+static char *
	+efi_get_devname(int fd)
	+{
	+ char *path;
	+ char *dev_name;
	+
	+ path = calloc(1, PATH_MAX);
	+ if (path == NULL)
	+ return (NULL);
	+
	+ /*
	+ * The libefi API only provides the open fd and not the file path.
	+ * To handle this realpath(3) is used to resolve the block device
	+ * name from /proc/self/fd/<fd>.
	+ */
	+ (void) sprintf(path, "/proc/self/fd/%d", fd);
	+ dev_name = realpath(path, NULL);
	+ free(path);
	+ return (dev_name);
	+}
	+
	static int
	efi_get_info(int fd, struct dk_cinfo *dki_info)
	{
	- char *path;
	char *dev_path;
	int rval = 0;

	memset(dki_info, 0, sizeof (*dki_info));

	- path = calloc(1, PATH_MAX);
	- if (path == NULL)
	- goto error;
	-
	/*
	* The simplest way to get the partition number under linux is
	* to parse it out of the /dev/<disk><partition> block device name.
	* The kernel creates this using the partition number when it
	* populates /dev/ so it may be trusted. The tricky bit here is
	* that the naming convention is based on the block device type.
	* So we need to take this in to account when parsing out the
	- * partition information. Another issue is that the libefi API
	- * API only provides the open fd and not the file path. To handle
	- * this realpath(3) is used to resolve the block device name from
	- * /proc/self/fd/<fd>. Aside from the partition number we collect
	+ * partition information. Aside from the partition number we collect
	* some additional device info.
	*/
	- (void) sprintf(path, "/proc/self/fd/%d", fd);
	- dev_path = realpath(path, NULL);
	- free(path);
	-
	+ dev_path = efi_get_devname(fd);
	if (dev_path == NULL)
	goto error;

	if ((strncmp(dev_path, "/dev/sd", 7) == 0)) {
	strcpy(dki_info->dki_cname, "sd");
	dki_info->dki_ctype = DKC_SCSI_CCS;
	rval = sscanf(dev_path, "/dev/%[a-zA-Z]%hu",
	dki_info->dki_dname,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/hd", 7) == 0)) {
	strcpy(dki_info->dki_cname, "hd");
	dki_info->dki_ctype = DKC_DIRECT;
	rval = sscanf(dev_path, "/dev/%[a-zA-Z]%hu",
	dki_info->dki_dname,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/md", 7) == 0)) {
	strcpy(dki_info->dki_cname, "pseudo");
	dki_info->dki_ctype = DKC_MD;
	strcpy(dki_info->dki_dname, "md");
	rval = sscanf(dev_path, "/dev/md%[0-9]p%hu",
	dki_info->dki_dname + 2,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/vd", 7) == 0)) {
	strcpy(dki_info->dki_cname, "vd");
	dki_info->dki_ctype = DKC_MD;
	rval = sscanf(dev_path, "/dev/%[a-zA-Z]%hu",
	dki_info->dki_dname,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/xvd", 8) == 0)) {
	strcpy(dki_info->dki_cname, "xvd");
	dki_info->dki_ctype = DKC_MD;
	rval = sscanf(dev_path, "/dev/%[a-zA-Z]%hu",
	dki_info->dki_dname,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/zd", 7) == 0)) {
	strcpy(dki_info->dki_cname, "zd");
	dki_info->dki_ctype = DKC_MD;
	strcpy(dki_info->dki_dname, "zd");
	rval = sscanf(dev_path, "/dev/zd%[0-9]p%hu",
	dki_info->dki_dname + 2,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/dm-", 8) == 0)) {
	strcpy(dki_info->dki_cname, "pseudo");
	dki_info->dki_ctype = DKC_VBD;
	strcpy(dki_info->dki_dname, "dm-");
	rval = sscanf(dev_path, "/dev/dm-%[0-9]p%hu",
	dki_info->dki_dname + 3,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/ram", 8) == 0)) {
	strcpy(dki_info->dki_cname, "pseudo");
	dki_info->dki_ctype = DKC_PCMCIA_MEM;
	strcpy(dki_info->dki_dname, "ram");
	rval = sscanf(dev_path, "/dev/ram%[0-9]p%hu",
	dki_info->dki_dname + 3,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/loop", 9) == 0)) {
	strcpy(dki_info->dki_cname, "pseudo");
	dki_info->dki_ctype = DKC_VBD;
	strcpy(dki_info->dki_dname, "loop");
	rval = sscanf(dev_path, "/dev/loop%[0-9]p%hu",
	dki_info->dki_dname + 4,
	&dki_info->dki_partition);
	} else if ((strncmp(dev_path, "/dev/nvme", 9) == 0)) {
	strcpy(dki_info->dki_cname, "nvme");
	dki_info->dki_ctype = DKC_SCSI_CCS;
	strcpy(dki_info->dki_dname, "nvme");
	(void) sscanf(dev_path, "/dev/nvme%[0-9]",
	dki_info->dki_dname + 4);
	size_t controller_length = strlen(
	dki_info->dki_dname);
	strcpy(dki_info->dki_dname + controller_length,
	"n");
	rval = sscanf(dev_path,
	"/dev/nvme%*[0-9]n%[0-9]p%hu",
	dki_info->dki_dname + controller_length + 1,
	&dki_info->dki_partition);
	} else {
	strcpy(dki_info->dki_dname, "unknown");
	strcpy(dki_info->dki_cname, "unknown");
	dki_info->dki_ctype = DKC_UNKNOWN;
	}

	switch (rval) {
	case 0:
	errno = EINVAL;
	goto error;
	case 1:
	dki_info->dki_partition = 0;
	}

	free(dev_path);

	return (0);
	error:
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCINFO errno 0x%x\n", errno);

	switch (errno) {
	case EIO:
	return (VT_EIO);
	case EINVAL:
	return (VT_EINVAL);
	default:
	return (VT_ERROR);
	}
	}

	/*
	* the number of blocks the EFI label takes up (round up to nearest
	* block)
	*/
	#define NBLOCKS(p, l) (1 + ((((p) * (int)sizeof (efi_gpe_t)) + \
	((l) - 1)) / (l)))
	/* number of partitions -- limited by what we can malloc */
	#define MAX_PARTS ((4294967295UL - sizeof (struct dk_gpt)) / \
	sizeof (struct dk_part))

	int
	efi_alloc_and_init(int fd, uint32_t nparts, struct dk_gpt **vtoc)
	{
	diskaddr_t capacity = 0;
	uint_t lbsize = 0;
	uint_t nblocks;
	size_t length;
	struct dk_gpt *vptr;
	struct uuid uuid;
	struct dk_cinfo dki_info;

	if (read_disk_info(fd, &capacity, &lbsize) != 0)
	return (-1);

	if (efi_get_info(fd, &dki_info) != 0)
	return (-1);

	if (dki_info.dki_partition != 0)
	return (-1);

	if ((dki_info.dki_ctype == DKC_PCMCIA_MEM) \|\|
	(dki_info.dki_ctype == DKC_VBD) \|\|
	(dki_info.dki_ctype == DKC_UNKNOWN))
	return (-1);

	nblocks = NBLOCKS(nparts, lbsize);
	if ((nblocks * lbsize) < EFI_MIN_ARRAY_SIZE + lbsize) {
	/* 16K plus one block for the GPT */
	nblocks = EFI_MIN_ARRAY_SIZE / lbsize + 1;
	}

	if (nparts > MAX_PARTS) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"the maximum number of partitions supported is %lu\n",
	MAX_PARTS);
	}
	return (-1);
	}

	length = sizeof (struct dk_gpt) +
	sizeof (struct dk_part) * (nparts - 1);

	vptr = calloc(1, length);
	if (vptr == NULL)
	return (-1);

	*vtoc = vptr;

	vptr->efi_version = EFI_VERSION_CURRENT;
	vptr->efi_lbasize = lbsize;
	vptr->efi_nparts = nparts;
	/*
	* add one block here for the PMBR; on disks with a 512 byte
	* block size and 128 or fewer partitions, efi_first_u_lba
	* should work out to "34"
	*/
	vptr->efi_first_u_lba = nblocks + 1;
	vptr->efi_last_lba = capacity - 1;
	vptr->efi_altern_lba = capacity -1;
	vptr->efi_last_u_lba = vptr->efi_last_lba - nblocks;

	(void) uuid_generate((uchar_t *)&uuid);
	UUID_LE_CONVERT(vptr->efi_disk_uguid, uuid);
	return (0);
	}

	/*
	* Read EFI - return partition number upon success.
	*/
	int
	efi_alloc_and_read(int fd, struct dk_gpt **vtoc)
	{
	int rval;
	uint32_t nparts;
	int length;
	struct dk_gpt *vptr;

	/* figure out the number of entries that would fit into 16K */
	nparts = EFI_MIN_ARRAY_SIZE / sizeof (efi_gpe_t);
	length = (int) sizeof (struct dk_gpt) +
	(int) sizeof (struct dk_part) * (nparts - 1);
	vptr = calloc(1, length);

	if (vptr == NULL)
	return (VT_ERROR);

	vptr->efi_nparts = nparts;
	rval = efi_read(fd, vptr);

	if ((rval == VT_EINVAL) && vptr->efi_nparts > nparts) {
	void *tmp;
	length = (int) sizeof (struct dk_gpt) +
	(int) sizeof (struct dk_part) * (vptr->efi_nparts - 1);
	nparts = vptr->efi_nparts;
	if ((tmp = realloc(vptr, length)) == NULL) {
	free(vptr);
	*vtoc = NULL;
	return (VT_ERROR);
	} else {
	vptr = tmp;
	rval = efi_read(fd, vptr);
	}
	}

	if (rval < 0) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"read of EFI table failed, rval=%d\n", rval);
	}
	free(vptr);
	*vtoc = NULL;
	} else {
	*vtoc = vptr;
	}

	return (rval);
	}

	static int
	efi_ioctl(int fd, int cmd, dk_efi_t *dk_ioc)
	{
	void *data = dk_ioc->dki_data;
	int error;
	diskaddr_t capacity;
	uint_t lbsize;

	/*
	* When the IO is not being performed in kernel as an ioctl we need
	* to know the sector size so we can seek to the proper byte offset.
	*/
	if (read_disk_info(fd, &capacity, &lbsize) == -1) {
	if (efi_debug)
	fprintf(stderr, "unable to read disk info: %d", errno);

	errno = EIO;
	return (-1);
	}

	switch (cmd) {
	case DKIOCGETEFI:
	if (lbsize == 0) {
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCGETEFI assuming "
	"LBA %d bytes\n", DEV_BSIZE);

	lbsize = DEV_BSIZE;
	}

	error = lseek(fd, dk_ioc->dki_lba * lbsize, SEEK_SET);
	if (error == -1) {
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCGETEFI lseek "
	"error: %d\n", errno);
	return (error);
	}

	error = read(fd, data, dk_ioc->dki_length);
	if (error == -1) {
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCGETEFI read "
	"error: %d\n", errno);
	return (error);
	}

	if (error != dk_ioc->dki_length) {
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCGETEFI short "
	"read of %d bytes\n", error);
	errno = EIO;
	return (-1);
	}
	error = 0;
	break;

	case DKIOCSETEFI:
	if (lbsize == 0) {
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCSETEFI unknown "
	"LBA size\n");
	errno = EIO;
	return (-1);
	}

	error = lseek(fd, dk_ioc->dki_lba * lbsize, SEEK_SET);
	if (error == -1) {
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCSETEFI lseek "
	"error: %d\n", errno);
	return (error);
	}

	error = write(fd, data, dk_ioc->dki_length);
	if (error == -1) {
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCSETEFI write "
	"error: %d\n", errno);
	return (error);
	}

	if (error != dk_ioc->dki_length) {
	if (efi_debug)
	(void) fprintf(stderr, "DKIOCSETEFI short "
	"write of %d bytes\n", error);
	errno = EIO;
	return (-1);
	}

	/* Sync the new EFI table to disk */
	error = fsync(fd);
	if (error == -1)
	return (error);

	/* Ensure any local disk cache is also flushed */
	if (ioctl(fd, BLKFLSBUF, 0) == -1)
	return (error);

	error = 0;
	break;

	default:
	if (efi_debug)
	(void) fprintf(stderr, "unsupported ioctl()\n");

	errno = EIO;
	return (-1);
	}

	return (error);
	}

	int
	efi_rescan(int fd)
	{
	int retry = 10;
	int error;

	/* Notify the kernel a devices partition table has been updated */
	while ((error = ioctl(fd, BLKRRPART)) != 0) {
	if ((--retry == 0) \|\| (errno != EBUSY)) {
	(void) fprintf(stderr, "the kernel failed to rescan "
	"the partition table: %d\n", errno);
	return (-1);
	}
	usleep(50000);
	}

	return (0);
	}

	static int
	check_label(int fd, dk_efi_t *dk_ioc)
	{
	efi_gpt_t *efi;
	uint_t crc;

	if (efi_ioctl(fd, DKIOCGETEFI, dk_ioc) == -1) {
	switch (errno) {
	case EIO:
	return (VT_EIO);
	default:
	return (VT_ERROR);
	}
	}
	efi = dk_ioc->dki_data;
	if (efi->efi_gpt_Signature != LE_64(EFI_SIGNATURE)) {
	if (efi_debug)
	(void) fprintf(stderr,
	"Bad EFI signature: 0x%llx != 0x%llx\n",
	(long long)efi->efi_gpt_Signature,
	(long long)LE_64(EFI_SIGNATURE));
	return (VT_EINVAL);
	}

	/*
	* check CRC of the header; the size of the header should
	* never be larger than one block
	*/
	crc = efi->efi_gpt_HeaderCRC32;
	efi->efi_gpt_HeaderCRC32 = 0;
	len_t headerSize = (len_t)LE_32(efi->efi_gpt_HeaderSize);

	if (headerSize < EFI_MIN_LABEL_SIZE \|\| headerSize > EFI_LABEL_SIZE) {
	if (efi_debug)
	(void) fprintf(stderr,
	"Invalid EFI HeaderSize %llu. Assuming %d.\n",
	headerSize, EFI_MIN_LABEL_SIZE);
	}

	if ((headerSize > dk_ioc->dki_length) \|\|
	crc != LE_32(efi_crc32((unsigned char *)efi, headerSize))) {
	if (efi_debug)
	(void) fprintf(stderr,
	"Bad EFI CRC: 0x%x != 0x%x\n",
	crc, LE_32(efi_crc32((unsigned char *)efi,
	headerSize)));
	return (VT_EINVAL);
	}

	return (0);
	}

	static int
	efi_read(int fd, struct dk_gpt *vtoc)
	{
	int i, j;
	int label_len;
	int rval = 0;
	int md_flag = 0;
	int vdc_flag = 0;
	diskaddr_t capacity = 0;
	uint_t lbsize = 0;
	struct dk_minfo disk_info;
	dk_efi_t dk_ioc;
	efi_gpt_t *efi;
	efi_gpe_t *efi_parts;
	struct dk_cinfo dki_info;
	uint32_t user_length;
	boolean_t legacy_label = B_FALSE;

	/*
	* get the partition number for this file descriptor.
	*/
	if ((rval = efi_get_info(fd, &dki_info)) != 0)
	return (rval);

	if ((strncmp(dki_info.dki_cname, "pseudo", 7) == 0) &&
	(strncmp(dki_info.dki_dname, "md", 3) == 0)) {
	md_flag++;
	} else if ((strncmp(dki_info.dki_cname, "vdc", 4) == 0) &&
	(strncmp(dki_info.dki_dname, "vdc", 4) == 0)) {
	/*
	* The controller and drive name "vdc" (virtual disk client)
	* indicates a LDoms virtual disk.
	*/
	vdc_flag++;
	}

	/* get the LBA size */
	if (read_disk_info(fd, &capacity, &lbsize) == -1) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"unable to read disk info: %d",
	errno);
	}
	return (VT_EINVAL);
	}

	disk_info.dki_lbsize = lbsize;
	disk_info.dki_capacity = capacity;

	if (disk_info.dki_lbsize == 0) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"efi_read: assuming LBA 512 bytes\n");
	}
	disk_info.dki_lbsize = DEV_BSIZE;
	}
	/*
	* Read the EFI GPT to figure out how many partitions we need
	* to deal with.
	*/
	dk_ioc.dki_lba = 1;
	if (NBLOCKS(vtoc->efi_nparts, disk_info.dki_lbsize) < 34) {
	label_len = EFI_MIN_ARRAY_SIZE + disk_info.dki_lbsize;
	} else {
	label_len = vtoc->efi_nparts * (int) sizeof (efi_gpe_t) +
	disk_info.dki_lbsize;
	if (label_len % disk_info.dki_lbsize) {
	/* pad to physical sector size */
	label_len += disk_info.dki_lbsize;
	label_len &= ~(disk_info.dki_lbsize - 1);
	}
	}

	if (posix_memalign((void **)&dk_ioc.dki_data,
	disk_info.dki_lbsize, label_len))
	return (VT_ERROR);

	memset(dk_ioc.dki_data, 0, label_len);
	dk_ioc.dki_length = disk_info.dki_lbsize;
	user_length = vtoc->efi_nparts;
	efi = dk_ioc.dki_data;
	if (md_flag) {
	dk_ioc.dki_length = label_len;
	if (efi_ioctl(fd, DKIOCGETEFI, &dk_ioc) == -1) {
	switch (errno) {
	case EIO:
	return (VT_EIO);
	default:
	return (VT_ERROR);
	}
	}
	} else if ((rval = check_label(fd, &dk_ioc)) == VT_EINVAL) {
	/*
	* No valid label here; try the alternate. Note that here
	* we just read GPT header and save it into dk_ioc.data,
	* Later, we will read GUID partition entry array if we
	* can get valid GPT header.
	*/

	/*
	* This is a workaround for legacy systems. In the past, the
	* last sector of SCSI disk was invisible on x86 platform. At
	* that time, backup label was saved on the next to the last
	* sector. It is possible for users to move a disk from previous
	* solaris system to present system. Here, we attempt to search
	* legacy backup EFI label first.
	*/
	dk_ioc.dki_lba = disk_info.dki_capacity - 2;
	dk_ioc.dki_length = disk_info.dki_lbsize;
	rval = check_label(fd, &dk_ioc);
	if (rval == VT_EINVAL) {
	/*
	* we didn't find legacy backup EFI label, try to
	* search backup EFI label in the last block.
	*/
	dk_ioc.dki_lba = disk_info.dki_capacity - 1;
	dk_ioc.dki_length = disk_info.dki_lbsize;
	rval = check_label(fd, &dk_ioc);
	if (rval == 0) {
	legacy_label = B_TRUE;
	if (efi_debug)
	(void) fprintf(stderr,
	"efi_read: primary label corrupt; "
	"using EFI backup label located on"
	" the last block\n");
	}
	} else {
	if ((efi_debug) && (rval == 0))
	(void) fprintf(stderr, "efi_read: primary label"
	" corrupt; using legacy EFI backup label "
	" located on the next to last block\n");
	}

	if (rval == 0) {
	dk_ioc.dki_lba = LE_64(efi->efi_gpt_PartitionEntryLBA);
	vtoc->efi_flags \|= EFI_GPT_PRIMARY_CORRUPT;
	vtoc->efi_nparts =
	LE_32(efi->efi_gpt_NumberOfPartitionEntries);
	/*
	* Partition tables are between backup GPT header
	* table and ParitionEntryLBA (the starting LBA of
	* the GUID partition entries array). Now that we
	* already got valid GPT header and saved it in
	* dk_ioc.dki_data, we try to get GUID partition
	* entry array here.
	*/
	/* LINTED */
	dk_ioc.dki_data = (efi_gpt_t )((char )dk_ioc.dki_data
	+ disk_info.dki_lbsize);
	if (legacy_label)
	dk_ioc.dki_length = disk_info.dki_capacity - 1 -
	dk_ioc.dki_lba;
	else
	dk_ioc.dki_length = disk_info.dki_capacity - 2 -
	dk_ioc.dki_lba;
	dk_ioc.dki_length *= disk_info.dki_lbsize;
	if (dk_ioc.dki_length >
	((len_t)label_len - sizeof (*dk_ioc.dki_data))) {
	rval = VT_EINVAL;
	} else {
	/*
	* read GUID partition entry array
	*/
	rval = efi_ioctl(fd, DKIOCGETEFI, &dk_ioc);
	}
	}

	} else if (rval == 0) {

	dk_ioc.dki_lba = LE_64(efi->efi_gpt_PartitionEntryLBA);
	/* LINTED */
	dk_ioc.dki_data = (efi_gpt_t )((char )dk_ioc.dki_data
	+ disk_info.dki_lbsize);
	dk_ioc.dki_length = label_len - disk_info.dki_lbsize;
	rval = efi_ioctl(fd, DKIOCGETEFI, &dk_ioc);

	} else if (vdc_flag && rval == VT_ERROR && errno == EINVAL) {
	/*
	* When the device is a LDoms virtual disk, the DKIOCGETEFI
	* ioctl can fail with EINVAL if the virtual disk backend
	* is a ZFS volume serviced by a domain running an old version
	* of Solaris. This is because the DKIOCGETEFI ioctl was
	* initially incorrectly implemented for a ZFS volume and it
	* expected the GPT and GPE to be retrieved with a single ioctl.
	* So we try to read the GPT and the GPE using that old style
	* ioctl.
	*/
	dk_ioc.dki_lba = 1;
	dk_ioc.dki_length = label_len;
	rval = check_label(fd, &dk_ioc);
	}

	if (rval < 0) {
	free(efi);
	return (rval);
	}

	/* LINTED -- always longlong aligned */
	efi_parts = (efi_gpe_t )(((char )efi) + disk_info.dki_lbsize);

	/*
	* Assemble this into a "dk_gpt" struct for easier
	* digestibility by applications.
	*/
	vtoc->efi_version = LE_32(efi->efi_gpt_Revision);
	vtoc->efi_nparts = LE_32(efi->efi_gpt_NumberOfPartitionEntries);
	vtoc->efi_part_size = LE_32(efi->efi_gpt_SizeOfPartitionEntry);
	vtoc->efi_lbasize = disk_info.dki_lbsize;
	vtoc->efi_last_lba = disk_info.dki_capacity - 1;
	vtoc->efi_first_u_lba = LE_64(efi->efi_gpt_FirstUsableLBA);
	vtoc->efi_last_u_lba = LE_64(efi->efi_gpt_LastUsableLBA);
	vtoc->efi_altern_lba = LE_64(efi->efi_gpt_AlternateLBA);
	UUID_LE_CONVERT(vtoc->efi_disk_uguid, efi->efi_gpt_DiskGUID);

	/*
	* If the array the user passed in is too small, set the length
	* to what it needs to be and return
	*/
	if (user_length < vtoc->efi_nparts) {
	return (VT_EINVAL);
	}

	for (i = 0; i < vtoc->efi_nparts; i++) {

	UUID_LE_CONVERT(vtoc->efi_parts[i].p_guid,
	efi_parts[i].efi_gpe_PartitionTypeGUID);

	for (j = 0;
	j < sizeof (conversion_array)
	/ sizeof (struct uuid_to_ptag); j++) {

	if (bcmp(&vtoc->efi_parts[i].p_guid,
	&conversion_array[j].uuid,
	sizeof (struct uuid)) == 0) {
	vtoc->efi_parts[i].p_tag = j;
	break;
	}
	}
	if (vtoc->efi_parts[i].p_tag == V_UNASSIGNED)
	continue;
	vtoc->efi_parts[i].p_flag =
	LE_16(efi_parts[i].efi_gpe_Attributes.PartitionAttrs);
	vtoc->efi_parts[i].p_start =
	LE_64(efi_parts[i].efi_gpe_StartingLBA);
	vtoc->efi_parts[i].p_size =
	LE_64(efi_parts[i].efi_gpe_EndingLBA) -
	vtoc->efi_parts[i].p_start + 1;
	for (j = 0; j < EFI_PART_NAME_LEN; j++) {
	vtoc->efi_parts[i].p_name[j] =
	(uchar_t)LE_16(
	efi_parts[i].efi_gpe_PartitionName[j]);
	}

	UUID_LE_CONVERT(vtoc->efi_parts[i].p_uguid,
	efi_parts[i].efi_gpe_UniquePartitionGUID);
	}
	free(efi);

	return (dki_info.dki_partition);
	}

	/* writes a "protective" MBR */
	static int
	write_pmbr(int fd, struct dk_gpt *vtoc)
	{
	dk_efi_t dk_ioc;
	struct mboot mb;
	uchar_t *cp;
	diskaddr_t size_in_lba;
	uchar_t *buf;
	int len;

	len = (vtoc->efi_lbasize == 0) ? sizeof (mb) : vtoc->efi_lbasize;
	if (posix_memalign((void **)&buf, len, len))
	return (VT_ERROR);

	/*
	* Preserve any boot code and disk signature if the first block is
	* already an MBR.
	*/
	memset(buf, 0, len);
	dk_ioc.dki_lba = 0;
	dk_ioc.dki_length = len;
	/* LINTED -- always longlong aligned */
	dk_ioc.dki_data = (efi_gpt_t *)buf;
	if (efi_ioctl(fd, DKIOCGETEFI, &dk_ioc) == -1) {
	(void) memcpy(&mb, buf, sizeof (mb));
	bzero(&mb, sizeof (mb));
	mb.signature = LE_16(MBB_MAGIC);
	} else {
	(void) memcpy(&mb, buf, sizeof (mb));
	if (mb.signature != LE_16(MBB_MAGIC)) {
	bzero(&mb, sizeof (mb));
	mb.signature = LE_16(MBB_MAGIC);
	}
	}

	bzero(&mb.parts, sizeof (mb.parts));
	cp = (uchar_t *)&mb.parts[0];
	/* bootable or not */
	*cp++ = 0;
	/* beginning CHS; 0xffffff if not representable */
	*cp++ = 0xff;
	*cp++ = 0xff;
	*cp++ = 0xff;
	/* OS type */
	*cp++ = EFI_PMBR;
	/* ending CHS; 0xffffff if not representable */
	*cp++ = 0xff;
	*cp++ = 0xff;
	*cp++ = 0xff;
	/* starting LBA: 1 (little endian format) by EFI definition */
	*cp++ = 0x01;
	*cp++ = 0x00;
	*cp++ = 0x00;
	*cp++ = 0x00;
	/* ending LBA: last block on the disk (little endian format) */
	size_in_lba = vtoc->efi_last_lba;
	if (size_in_lba < 0xffffffff) {
	*cp++ = (size_in_lba & 0x000000ff);
	*cp++ = (size_in_lba & 0x0000ff00) >> 8;
	*cp++ = (size_in_lba & 0x00ff0000) >> 16;
	*cp++ = (size_in_lba & 0xff000000) >> 24;
	} else {
	*cp++ = 0xff;
	*cp++ = 0xff;
	*cp++ = 0xff;
	*cp++ = 0xff;
	}

	(void) memcpy(buf, &mb, sizeof (mb));
	/* LINTED -- always longlong aligned */
	dk_ioc.dki_data = (efi_gpt_t *)buf;
	dk_ioc.dki_lba = 0;
	dk_ioc.dki_length = len;
	if (efi_ioctl(fd, DKIOCSETEFI, &dk_ioc) == -1) {
	free(buf);
	switch (errno) {
	case EIO:
	return (VT_EIO);
	case EINVAL:
	return (VT_EINVAL);
	default:
	return (VT_ERROR);
	}
	}
	free(buf);
	return (0);
	}

	/* make sure the user specified something reasonable */
	static int
	check_input(struct dk_gpt *vtoc)
	{
	int resv_part = -1;
	int i, j;
	diskaddr_t istart, jstart, isize, jsize, endsect;

	/*
	* Sanity-check the input (make sure no partitions overlap)
	*/
	for (i = 0; i < vtoc->efi_nparts; i++) {
	/* It can't be unassigned and have an actual size */
	if ((vtoc->efi_parts[i].p_tag == V_UNASSIGNED) &&
	(vtoc->efi_parts[i].p_size != 0)) {
	if (efi_debug) {
	(void) fprintf(stderr, "partition %d is "
	"\"unassigned\" but has a size of %llu",
	i, vtoc->efi_parts[i].p_size);
	}
	return (VT_EINVAL);
	}
	if (vtoc->efi_parts[i].p_tag == V_UNASSIGNED) {
	if (uuid_is_null((uchar_t *)&vtoc->efi_parts[i].p_guid))
	continue;
	/* we have encountered an unknown uuid */
	vtoc->efi_parts[i].p_tag = 0xff;
	}
	if (vtoc->efi_parts[i].p_tag == V_RESERVED) {
	if (resv_part != -1) {
	if (efi_debug) {
	(void) fprintf(stderr, "found "
	"duplicate reserved partition "
	"at %d\n", i);
	}
	return (VT_EINVAL);
	}
	resv_part = i;
	}
	if ((vtoc->efi_parts[i].p_start < vtoc->efi_first_u_lba) \|\|
	(vtoc->efi_parts[i].p_start > vtoc->efi_last_u_lba)) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"Partition %d starts at %llu. ",
	i,
	vtoc->efi_parts[i].p_start);
	(void) fprintf(stderr,
	"It must be between %llu and %llu.\n",
	vtoc->efi_first_u_lba,
	vtoc->efi_last_u_lba);
	}
	return (VT_EINVAL);
	}
	if ((vtoc->efi_parts[i].p_start +
	vtoc->efi_parts[i].p_size <
	vtoc->efi_first_u_lba) \|\|
	(vtoc->efi_parts[i].p_start +
	vtoc->efi_parts[i].p_size >
	vtoc->efi_last_u_lba + 1)) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"Partition %d ends at %llu. ",
	i,
	vtoc->efi_parts[i].p_start +
	vtoc->efi_parts[i].p_size);
	(void) fprintf(stderr,
	"It must be between %llu and %llu.\n",
	vtoc->efi_first_u_lba,
	vtoc->efi_last_u_lba);
	}
	return (VT_EINVAL);
	}

	for (j = 0; j < vtoc->efi_nparts; j++) {
	isize = vtoc->efi_parts[i].p_size;
	jsize = vtoc->efi_parts[j].p_size;
	istart = vtoc->efi_parts[i].p_start;
	jstart = vtoc->efi_parts[j].p_start;
	if ((i != j) && (isize != 0) && (jsize != 0)) {
	endsect = jstart + jsize -1;
	if ((jstart <= istart) &&
	(istart <= endsect)) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"Partition %d overlaps "
	"partition %d.", i, j);
	}
	return (VT_EINVAL);
	}
	}
	}
	}
	/* just a warning for now */
	if ((resv_part == -1) && efi_debug) {
	(void) fprintf(stderr,
	"no reserved partition found\n");
	}
	return (0);
	}

	+static int
	+call_blkpg_ioctl(int fd, int command, diskaddr_t start,
	+ diskaddr_t size, uint_t pno)
	+{
	+ struct blkpg_ioctl_arg ioctl_arg;
	+ struct blkpg_partition linux_part;
	+ memset(&linux_part, 0, sizeof (linux_part));
	+
	+ char *path = efi_get_devname(fd);
	+ if (path == NULL) {
	+ (void) fprintf(stderr, "failed to retrieve device name\n");
	+ return (VT_EINVAL);
	+ }
	+
	+ linux_part.start = start;
	+ linux_part.length = size;
	+ linux_part.pno = pno;
	+ snprintf(linux_part.devname, BLKPG_DEVNAMELTH - 1, "%s%u", path, pno);
	+ linux_part.devname[BLKPG_DEVNAMELTH - 1] = '\0';
	+ free(path);
	+
	+ ioctl_arg.op = command;
	+ ioctl_arg.flags = 0;
	+ ioctl_arg.datalen = sizeof (struct blkpg_partition);
	+ ioctl_arg.data = &linux_part;
	+
	+ return (ioctl(fd, BLKPG, &ioctl_arg));
	+}
	+
	/*
	* add all the unallocated space to the current label
	*/
	int
	efi_use_whole_disk(int fd)
	{
	- struct dk_gpt *efi_label = NULL;
	- int rval;
	- int i;
	- uint_t resv_index = 0, data_index = 0;
	- diskaddr_t resv_start = 0, data_start = 0;
	- diskaddr_t data_size, limit, difference;
	- boolean_t sync_needed = B_FALSE;
	- uint_t nblocks;
	+ struct dk_gpt *efi_label = NULL;
	+ int rval;
	+ int i;
	+ uint_t resv_index = 0, data_index = 0;
	+ diskaddr_t resv_start = 0, data_start = 0;
	+ diskaddr_t data_size, limit, difference;
	+ boolean_t sync_needed = B_FALSE;
	+ uint_t nblocks;

	rval = efi_alloc_and_read(fd, &efi_label);
	if (rval < 0) {
	if (efi_label != NULL)
	efi_free(efi_label);
	return (rval);
	}

	/*
	* Find the last physically non-zero partition.
	* This should be the reserved partition.
	*/
	for (i = 0; i < efi_label->efi_nparts; i ++) {
	if (resv_start < efi_label->efi_parts[i].p_start) {
	resv_start = efi_label->efi_parts[i].p_start;
	resv_index = i;
	}
	}

	/*
	* Find the last physically non-zero partition before that.
	* This is the data partition.
	*/
	for (i = 0; i < resv_index; i ++) {
	if (data_start < efi_label->efi_parts[i].p_start) {
	data_start = efi_label->efi_parts[i].p_start;
	data_index = i;
	}
	}
	data_size = efi_label->efi_parts[data_index].p_size;

	/*
	* See the "efi_alloc_and_init" function for more information
	* about where this "nblocks" value comes from.
	*/
	nblocks = efi_label->efi_first_u_lba - 1;

	/*
	* Determine if the EFI label is out of sync. We check that:
	*
	* 1. the data partition ends at the limit we set, and
	* 2. the reserved partition starts at the limit we set.
	*
	* If either of these conditions is not met, then we need to
	* resync the EFI label.
	*
	* The limit is the last usable LBA, determined by the last LBA
	* and the first usable LBA fields on the EFI label of the disk
	* (see the lines directly above). Additionally, we factor in
	* EFI_MIN_RESV_SIZE (per its use in "zpool_label_disk") and
	* P2ALIGN it to ensure the partition boundaries are aligned
	* (for performance reasons). The alignment should match the
	* alignment used by the "zpool_label_disk" function.
	*/
	limit = P2ALIGN(efi_label->efi_last_lba - nblocks - EFI_MIN_RESV_SIZE,
	PARTITION_END_ALIGNMENT);
	if (data_start + data_size != limit \|\| resv_start != limit)
	sync_needed = B_TRUE;

	if (efi_debug && sync_needed)
	(void) fprintf(stderr, "efi_use_whole_disk: sync needed\n");

	/*
	* If alter_lba is 1, we are using the backup label.
	* Since we can locate the backup label by disk capacity,
	* there must be no unallocated space.
	*/
	if ((efi_label->efi_altern_lba == 1) \|\| (efi_label->efi_altern_lba
	>= efi_label->efi_last_lba && !sync_needed)) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"efi_use_whole_disk: requested space not found\n");
	}
	efi_free(efi_label);
	return (VT_ENOSPC);
	}

	/*
	* Verify that we've found the reserved partition by checking
	* that it looks the way it did when we created it in zpool_label_disk.
	* If we've found the incorrect partition, then we know that this
	* device was reformatted and no longer is solely used by ZFS.
	*/
	if ((efi_label->efi_parts[resv_index].p_size != EFI_MIN_RESV_SIZE) \|\|
	(efi_label->efi_parts[resv_index].p_tag != V_RESERVED) \|\|
	(resv_index != 8)) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"efi_use_whole_disk: wholedisk not available\n");
	}
	efi_free(efi_label);
	return (VT_ENOSPC);
	}

	if (data_start + data_size != resv_start) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"efi_use_whole_disk: "
	"data_start (%lli) + "
	"data_size (%lli) != "
	"resv_start (%lli)\n",
	data_start, data_size, resv_start);
	}

	return (VT_EINVAL);
	}

	if (limit < resv_start) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"efi_use_whole_disk: "
	"limit (%lli) < resv_start (%lli)\n",
	limit, resv_start);
	}

	return (VT_EINVAL);
	}

	difference = limit - resv_start;

	if (efi_debug)
	(void) fprintf(stderr,
	"efi_use_whole_disk: difference is %lli\n", difference);

	/*
	* Move the reserved partition. There is currently no data in
	* here except fabricated devids (which get generated via
	* efi_write()). So there is no need to copy data.
	*/
	efi_label->efi_parts[data_index].p_size += difference;
	efi_label->efi_parts[resv_index].p_start += difference;
	efi_label->efi_last_u_lba = efi_label->efi_last_lba - nblocks;

	- rval = efi_write(fd, efi_label);
	- if (rval < 0) {
	- if (efi_debug) {
	- (void) fprintf(stderr,
	- "efi_use_whole_disk:fail to write label, rval=%d\n",
	- rval);
	+ /*
	+ * Rescanning the partition table in the kernel can result
	+ * in the device links to be removed (see comment in vdev_disk_open).
	+ * If BLKPG_RESIZE_PARTITION is available, then we can resize
	+ * the partition table online and avoid having to remove the device
	+ * links used by the pool. This provides a very deterministic
	+ * approach to resizing devices and does not require any
	+ * loops waiting for devices to reappear.
	+ */
	+#ifdef BLKPG_RESIZE_PARTITION
	+ /*
	+ * Delete the reserved partition since we're about to expand
	+ * the data partition and it would overlap with the reserved
	+ * partition.
	+ * NOTE: The starting index for the ioctl is 1 while for the
	+ * EFI partitions it's 0. For that reason we have to add one
	+ * whenever we make an ioctl call.
	+ */
	+ rval = call_blkpg_ioctl(fd, BLKPG_DEL_PARTITION, 0, 0, resv_index + 1);
	+ if (rval != 0)
	+ goto out;
	+
	+ /*
	+ * Expand the data partition
	+ */
	+ rval = call_blkpg_ioctl(fd, BLKPG_RESIZE_PARTITION,
	+ efi_label->efi_parts[data_index].p_start * efi_label->efi_lbasize,
	+ efi_label->efi_parts[data_index].p_size * efi_label->efi_lbasize,
	+ data_index + 1);
	+ if (rval != 0) {
	+ (void) fprintf(stderr, "Unable to resize data "
	+ "partition: %d\n", rval);
	+ /*
	+ * Since we failed to resize, we need to reset the start
	+ * of the reserve partition and re-create it.
	+ */
	+ efi_label->efi_parts[resv_index].p_start -= difference;
	+ }
	+
	+ /*
	+ * Re-add the reserved partition. If we've expanded the data partition
	+ * then we'll move the reserve partition to the end of the data
	+ * partition. Otherwise, we'll recreate the partition in its original
	+ * location. Note that we do this as best-effort and ignore any
	+ * errors that may arise here. This will ensure that we finish writing
	+ * the EFI label.
	+ */
	+ (void) call_blkpg_ioctl(fd, BLKPG_ADD_PARTITION,
	+ efi_label->efi_parts[resv_index].p_start * efi_label->efi_lbasize,
	+ efi_label->efi_parts[resv_index].p_size * efi_label->efi_lbasize,
	+ resv_index + 1);
	+#endif
	+
	+ /*
	+ * We're now ready to write the EFI label.
	+ */
	+ if (rval == 0) {
	+ rval = efi_write(fd, efi_label);
	+ if (rval < 0 && efi_debug) {
	+ (void) fprintf(stderr, "efi_use_whole_disk:fail "
	+ "to write label, rval=%d\n", rval);
	}
	- efi_free(efi_label);
	- return (rval);
	}

	+out:
	efi_free(efi_label);
	- return (0);
	+ return (rval);
	}

	/*
	* write EFI label and backup label
	*/
	int
	efi_write(int fd, struct dk_gpt *vtoc)
	{
	dk_efi_t dk_ioc;
	efi_gpt_t *efi;
	efi_gpe_t *efi_parts;
	int i, j;
	struct dk_cinfo dki_info;
	int rval;
	int md_flag = 0;
	int nblocks;
	diskaddr_t lba_backup_gpt_hdr;

	if ((rval = efi_get_info(fd, &dki_info)) != 0)
	return (rval);

	/* check if we are dealing with a metadevice */
	if ((strncmp(dki_info.dki_cname, "pseudo", 7) == 0) &&
	(strncmp(dki_info.dki_dname, "md", 3) == 0)) {
	md_flag = 1;
	}

	if (check_input(vtoc)) {
	/*
	* not valid; if it's a metadevice just pass it down
	* because SVM will do its own checking
	*/
	if (md_flag == 0) {
	return (VT_EINVAL);
	}
	}

	dk_ioc.dki_lba = 1;
	if (NBLOCKS(vtoc->efi_nparts, vtoc->efi_lbasize) < 34) {
	dk_ioc.dki_length = EFI_MIN_ARRAY_SIZE + vtoc->efi_lbasize;
	} else {
	dk_ioc.dki_length = NBLOCKS(vtoc->efi_nparts,
	vtoc->efi_lbasize) *
	vtoc->efi_lbasize;
	}

	/*
	* the number of blocks occupied by GUID partition entry array
	*/
	nblocks = dk_ioc.dki_length / vtoc->efi_lbasize - 1;

	/*
	* Backup GPT header is located on the block after GUID
	* partition entry array. Here, we calculate the address
	* for backup GPT header.
	*/
	lba_backup_gpt_hdr = vtoc->efi_last_u_lba + 1 + nblocks;
	if (posix_memalign((void **)&dk_ioc.dki_data,
	vtoc->efi_lbasize, dk_ioc.dki_length))
	return (VT_ERROR);

	memset(dk_ioc.dki_data, 0, dk_ioc.dki_length);
	efi = dk_ioc.dki_data;

	/* stuff user's input into EFI struct */
	efi->efi_gpt_Signature = LE_64(EFI_SIGNATURE);
	efi->efi_gpt_Revision = LE_32(vtoc->efi_version); /* 0x02000100 */
	efi->efi_gpt_HeaderSize = LE_32(sizeof (struct efi_gpt) - LEN_EFI_PAD);
	efi->efi_gpt_Reserved1 = 0;
	efi->efi_gpt_MyLBA = LE_64(1ULL);
	efi->efi_gpt_AlternateLBA = LE_64(lba_backup_gpt_hdr);
	efi->efi_gpt_FirstUsableLBA = LE_64(vtoc->efi_first_u_lba);
	efi->efi_gpt_LastUsableLBA = LE_64(vtoc->efi_last_u_lba);
	efi->efi_gpt_PartitionEntryLBA = LE_64(2ULL);
	efi->efi_gpt_NumberOfPartitionEntries = LE_32(vtoc->efi_nparts);
	efi->efi_gpt_SizeOfPartitionEntry = LE_32(sizeof (struct efi_gpe));
	UUID_LE_CONVERT(efi->efi_gpt_DiskGUID, vtoc->efi_disk_uguid);

	/* LINTED -- always longlong aligned */
	efi_parts = (efi_gpe_t )((char )dk_ioc.dki_data + vtoc->efi_lbasize);

	for (i = 0; i < vtoc->efi_nparts; i++) {
	for (j = 0;
	j < sizeof (conversion_array) /
	sizeof (struct uuid_to_ptag); j++) {

	if (vtoc->efi_parts[i].p_tag == j) {
	UUID_LE_CONVERT(
	efi_parts[i].efi_gpe_PartitionTypeGUID,
	conversion_array[j].uuid);
	break;
	}
	}

	if (j == sizeof (conversion_array) /
	sizeof (struct uuid_to_ptag)) {
	/*
	* If we didn't have a matching uuid match, bail here.
	* Don't write a label with unknown uuid.
	*/
	if (efi_debug) {
	(void) fprintf(stderr,
	"Unknown uuid for p_tag %d\n",
	vtoc->efi_parts[i].p_tag);
	}
	return (VT_EINVAL);
	}

	/* Zero's should be written for empty partitions */
	if (vtoc->efi_parts[i].p_tag == V_UNASSIGNED)
	continue;

	efi_parts[i].efi_gpe_StartingLBA =
	LE_64(vtoc->efi_parts[i].p_start);
	efi_parts[i].efi_gpe_EndingLBA =
	LE_64(vtoc->efi_parts[i].p_start +
	vtoc->efi_parts[i].p_size - 1);
	efi_parts[i].efi_gpe_Attributes.PartitionAttrs =
	LE_16(vtoc->efi_parts[i].p_flag);
	for (j = 0; j < EFI_PART_NAME_LEN; j++) {
	efi_parts[i].efi_gpe_PartitionName[j] =
	LE_16((ushort_t)vtoc->efi_parts[i].p_name[j]);
	}
	if ((vtoc->efi_parts[i].p_tag != V_UNASSIGNED) &&
	uuid_is_null((uchar_t *)&vtoc->efi_parts[i].p_uguid)) {
	(void) uuid_generate((uchar_t *)
	&vtoc->efi_parts[i].p_uguid);
	}
	bcopy(&vtoc->efi_parts[i].p_uguid,
	&efi_parts[i].efi_gpe_UniquePartitionGUID,
	sizeof (uuid_t));
	}
	efi->efi_gpt_PartitionEntryArrayCRC32 =
	LE_32(efi_crc32((unsigned char *)efi_parts,
	vtoc->efi_nparts * (int)sizeof (struct efi_gpe)));
	efi->efi_gpt_HeaderCRC32 =
	LE_32(efi_crc32((unsigned char *)efi,
	LE_32(efi->efi_gpt_HeaderSize)));

	if (efi_ioctl(fd, DKIOCSETEFI, &dk_ioc) == -1) {
	free(dk_ioc.dki_data);
	switch (errno) {
	case EIO:
	return (VT_EIO);
	case EINVAL:
	return (VT_EINVAL);
	default:
	return (VT_ERROR);
	}
	}
	/* if it's a metadevice we're done */
	if (md_flag) {
	free(dk_ioc.dki_data);
	return (0);
	}

	/* write backup partition array */
	dk_ioc.dki_lba = vtoc->efi_last_u_lba + 1;
	dk_ioc.dki_length -= vtoc->efi_lbasize;
	/* LINTED */
	dk_ioc.dki_data = (efi_gpt_t )((char )dk_ioc.dki_data +
	vtoc->efi_lbasize);

	if (efi_ioctl(fd, DKIOCSETEFI, &dk_ioc) == -1) {
	/*
	* we wrote the primary label okay, so don't fail
	*/
	if (efi_debug) {
	(void) fprintf(stderr,
	"write of backup partitions to block %llu "
	"failed, errno %d\n",
	vtoc->efi_last_u_lba + 1,
	errno);
	}
	}
	/*
	* now swap MyLBA and AlternateLBA fields and write backup
	* partition table header
	*/
	dk_ioc.dki_lba = lba_backup_gpt_hdr;
	dk_ioc.dki_length = vtoc->efi_lbasize;
	/* LINTED */
	dk_ioc.dki_data = (efi_gpt_t )((char )dk_ioc.dki_data -
	vtoc->efi_lbasize);
	efi->efi_gpt_AlternateLBA = LE_64(1ULL);
	efi->efi_gpt_MyLBA = LE_64(lba_backup_gpt_hdr);
	efi->efi_gpt_PartitionEntryLBA = LE_64(vtoc->efi_last_u_lba + 1);
	efi->efi_gpt_HeaderCRC32 = 0;
	efi->efi_gpt_HeaderCRC32 =
	LE_32(efi_crc32((unsigned char *)dk_ioc.dki_data,
	LE_32(efi->efi_gpt_HeaderSize)));

	if (efi_ioctl(fd, DKIOCSETEFI, &dk_ioc) == -1) {
	if (efi_debug) {
	(void) fprintf(stderr,
	"write of backup header to block %llu failed, "
	"errno %d\n",
	lba_backup_gpt_hdr,
	errno);
	}
	}
	/* write the PMBR */
	(void) write_pmbr(fd, vtoc);
	free(dk_ioc.dki_data);

	return (0);
	}

	void
	efi_free(struct dk_gpt *ptr)
	{
	free(ptr);
	}

	/*
	* Input: File descriptor
	* Output: 1 if disk has an EFI label, or > 2TB with no VTOC or legacy MBR.
	* Otherwise 0.
	*/
	int
	efi_type(int fd)
	{
	#if 0
	struct vtoc vtoc;
	struct extvtoc extvtoc;

	if (ioctl(fd, DKIOCGEXTVTOC, &extvtoc) == -1) {
	if (errno == ENOTSUP)
	return (1);
	else if (errno == ENOTTY) {
	if (ioctl(fd, DKIOCGVTOC, &vtoc) == -1)
	if (errno == ENOTSUP)
	return (1);
	}
	}
	return (0);
	#else
	return (ENOSYS);
	#endif
	}

	void
	efi_err_check(struct dk_gpt *vtoc)
	{
	int resv_part = -1;
	int i, j;
	diskaddr_t istart, jstart, isize, jsize, endsect;
	int overlap = 0;

	/*
	* make sure no partitions overlap
	*/
	for (i = 0; i < vtoc->efi_nparts; i++) {
	/* It can't be unassigned and have an actual size */
	if ((vtoc->efi_parts[i].p_tag == V_UNASSIGNED) &&
	(vtoc->efi_parts[i].p_size != 0)) {
	(void) fprintf(stderr,
	"partition %d is \"unassigned\" but has a size "
	"of %llu\n", i, vtoc->efi_parts[i].p_size);
	}
	if (vtoc->efi_parts[i].p_tag == V_UNASSIGNED) {
	continue;
	}
	if (vtoc->efi_parts[i].p_tag == V_RESERVED) {
	if (resv_part != -1) {
	(void) fprintf(stderr,
	"found duplicate reserved partition at "
	"%d\n", i);
	}
	resv_part = i;
	if (vtoc->efi_parts[i].p_size != EFI_MIN_RESV_SIZE)
	(void) fprintf(stderr,
	"Warning: reserved partition size must "
	"be %d sectors\n", EFI_MIN_RESV_SIZE);
	}
	if ((vtoc->efi_parts[i].p_start < vtoc->efi_first_u_lba) \|\|
	(vtoc->efi_parts[i].p_start > vtoc->efi_last_u_lba)) {
	(void) fprintf(stderr,
	"Partition %d starts at %llu\n",
	i,
	vtoc->efi_parts[i].p_start);
	(void) fprintf(stderr,
	"It must be between %llu and %llu.\n",
	vtoc->efi_first_u_lba,
	vtoc->efi_last_u_lba);
	}
	if ((vtoc->efi_parts[i].p_start +
	vtoc->efi_parts[i].p_size <
	vtoc->efi_first_u_lba) \|\|
	(vtoc->efi_parts[i].p_start +
	vtoc->efi_parts[i].p_size >
	vtoc->efi_last_u_lba + 1)) {
	(void) fprintf(stderr,
	"Partition %d ends at %llu\n",
	i,
	vtoc->efi_parts[i].p_start +
	vtoc->efi_parts[i].p_size);
	(void) fprintf(stderr,
	"It must be between %llu and %llu.\n",
	vtoc->efi_first_u_lba,
	vtoc->efi_last_u_lba);
	}

	for (j = 0; j < vtoc->efi_nparts; j++) {
	isize = vtoc->efi_parts[i].p_size;
	jsize = vtoc->efi_parts[j].p_size;
	istart = vtoc->efi_parts[i].p_start;
	jstart = vtoc->efi_parts[j].p_start;
	if ((i != j) && (isize != 0) && (jsize != 0)) {
	endsect = jstart + jsize -1;
	if ((jstart <= istart) &&
	(istart <= endsect)) {
	if (!overlap) {
	(void) fprintf(stderr,
	"label error: EFI Labels do not "
	"support overlapping partitions\n");
	}
	(void) fprintf(stderr,
	"Partition %d overlaps partition "
	"%d.\n", i, j);
	overlap = 1;
	}
	}
	}
	}
	/* make sure there is a reserved partition */
	if (resv_part == -1) {
	(void) fprintf(stderr,
	"no reserved partition found\n");
	}
	}

	/*
	* We need to get information necessary to construct a new efi
	* label type
	*/
	int
	efi_auto_sense(int fd, struct dk_gpt **vtoc)
	{

	int i;

	/*
	* Now build the default partition table
	*/
	if (efi_alloc_and_init(fd, EFI_NUMPAR, vtoc) != 0) {
	if (efi_debug) {
	(void) fprintf(stderr, "efi_alloc_and_init failed.\n");
	}
	return (-1);
	}

	for (i = 0; i < MIN((*vtoc)->efi_nparts, V_NUMPAR); i++) {
	(*vtoc)->efi_parts[i].p_tag = default_vtoc_map[i].p_tag;
	(*vtoc)->efi_parts[i].p_flag = default_vtoc_map[i].p_flag;
	(*vtoc)->efi_parts[i].p_start = 0;
	(*vtoc)->efi_parts[i].p_size = 0;
	}
	/*
	* Make constants first
	* and variable partitions later
	*/

	/* root partition - s0 128 MB */
	(*vtoc)->efi_parts[0].p_start = 34;
	(*vtoc)->efi_parts[0].p_size = 262144;

	/* partition - s1 128 MB */
	(*vtoc)->efi_parts[1].p_start = 262178;
	(*vtoc)->efi_parts[1].p_size = 262144;

	/* partition -s2 is NOT the Backup disk */
	(*vtoc)->efi_parts[2].p_tag = V_UNASSIGNED;

	/* partition -s6 /usr partition - HOG */
	(*vtoc)->efi_parts[6].p_start = 524322;
	(vtoc)->efi_parts[6].p_size = (vtoc)->efi_last_u_lba - 524322
	- (1024 * 16);

	/* efi reserved partition - s9 16K */
	(vtoc)->efi_parts[8].p_start = (vtoc)->efi_last_u_lba - (1024 * 16);
	(vtoc)->efi_parts[8].p_size = (1024 16);
	(*vtoc)->efi_parts[8].p_tag = V_RESERVED;
	return (0);
	}
	Index: vendor-sys/openzfs/dist/lib/libshare/os/linux/nfs.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libshare/os/linux/nfs.c (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libshare/os/linux/nfs.c (revision 365892)
	@@ -1,712 +1,713 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011 Gunnar Beutner
	* Copyright (c) 2012 Cyril Plisko. All rights reserved.
	* Copyright (c) 2019, 2020 by Delphix. All rights reserved.
	*/

	#include <dirent.h>
	#include <stdio.h>
	#include <string.h>
	#include <strings.h>
	#include <errno.h>
	+#include <fcntl.h>
	#include <sys/file.h>
	#include <sys/stat.h>
	#include <sys/types.h>
	#include <sys/wait.h>
	#include <unistd.h>
	#include <libzfs.h>
	#include <libshare.h>
	#include "libshare_impl.h"
	#include "nfs.h"

	#define FILE_HEADER "# !!! DO NOT EDIT THIS FILE MANUALLY !!!\n\n"
	#define ZFS_EXPORTS_DIR "/etc/exports.d"
	#define ZFS_EXPORTS_FILE ZFS_EXPORTS_DIR"/zfs.exports"
	#define ZFS_EXPORTS_LOCK ZFS_EXPORTS_FILE".lock"

	static sa_fstype_t *nfs_fstype;

	typedef int (nfs_shareopt_callback_t)(const char opt, const char *value,
	void *cookie);

	typedef int (nfs_host_callback_t)(const char sharepath, const char *filename,
	const char host, const char security, const char access, void cookie);

	static int nfs_lock_fd = -1;

	/*
	* The nfs_exports_[lock\|unlock] is used to guard against conconcurrent
	* updates to the exports file. Each protocol is responsible for
	* providing the necessary locking to ensure consistency.
	*/
	static int
	nfs_exports_lock(void)
	{
	nfs_lock_fd = open(ZFS_EXPORTS_LOCK,
	O_RDWR \| O_CREAT, 0600);
	if (nfs_lock_fd == -1) {
	fprintf(stderr, "failed to lock %s: %s\n",
	ZFS_EXPORTS_LOCK, strerror(errno));
	return (errno);
	}
	if (flock(nfs_lock_fd, LOCK_EX) != 0) {
	fprintf(stderr, "failed to lock %s: %s\n",
	ZFS_EXPORTS_LOCK, strerror(errno));
	return (errno);
	}
	return (0);
	}

	static void
	nfs_exports_unlock(void)
	{
	verify(nfs_lock_fd > 0);

	if (flock(nfs_lock_fd, LOCK_UN) != 0) {
	fprintf(stderr, "failed to unlock %s: %s\n",
	ZFS_EXPORTS_LOCK, strerror(errno));
	}
	close(nfs_lock_fd);
	nfs_lock_fd = -1;
	}

	/*
	* Invokes the specified callback function for each Solaris share option
	* listed in the specified string.
	*/
	static int
	foreach_nfs_shareopt(const char *shareopts,
	nfs_shareopt_callback_t callback, void *cookie)
	{
	char shareopts_dup, opt, cur, value;
	int was_nul, error;

	if (shareopts == NULL)
	return (SA_OK);

	if (strcmp(shareopts, "on") == 0)
	shareopts = "rw,crossmnt";

	shareopts_dup = strdup(shareopts);


	if (shareopts_dup == NULL)
	return (SA_NO_MEMORY);

	opt = shareopts_dup;
	was_nul = 0;

	while (1) {
	cur = opt;

	while (cur != ',' && cur != '\0')
	cur++;

	if (*cur == '\0')
	was_nul = 1;

	*cur = '\0';

	if (cur > opt) {
	value = strchr(opt, '=');

	if (value != NULL) {
	*value = '\0';
	value++;
	}

	error = callback(opt, value, cookie);

	if (error != SA_OK) {
	free(shareopts_dup);
	return (error);
	}
	}

	opt = cur + 1;

	if (was_nul)
	break;
	}

	free(shareopts_dup);

	return (SA_OK);
	}

	typedef struct nfs_host_cookie_s {
	nfs_host_callback_t callback;
	const char *sharepath;
	void *cookie;
	const char *filename;
	const char *security;
	} nfs_host_cookie_t;

	/*
	* Helper function for foreach_nfs_host. This function checks whether the
	* current share option is a host specification and invokes a callback
	* function with information about the host.
	*/
	static int
	foreach_nfs_host_cb(const char opt, const char value, void *pcookie)
	{
	int error;
	const char *access;
	char host_dup, host, *next;
	nfs_host_cookie_t udata = (nfs_host_cookie_t )pcookie;

	#ifdef DEBUG
	fprintf(stderr, "foreach_nfs_host_cb: key=%s, value=%s\n", opt, value);
	#endif

	if (strcmp(opt, "sec") == 0)
	udata->security = value;

	if (strcmp(opt, "rw") == 0 \|\| strcmp(opt, "ro") == 0) {
	if (value == NULL)
	value = "*";

	access = opt;

	host_dup = strdup(value);

	if (host_dup == NULL)
	return (SA_NO_MEMORY);

	host = host_dup;

	do {
	next = strchr(host, ':');
	if (next != NULL) {
	*next = '\0';
	next++;
	}

	error = udata->callback(udata->filename,
	udata->sharepath, host, udata->security,
	access, udata->cookie);

	if (error != SA_OK) {
	free(host_dup);

	return (error);
	}

	host = next;
	} while (host != NULL);

	free(host_dup);
	}

	return (SA_OK);
	}

	/*
	* Invokes a callback function for all NFS hosts that are set for a share.
	*/
	static int
	foreach_nfs_host(sa_share_impl_t impl_share, char *filename,
	nfs_host_callback_t callback, void *cookie)
	{
	nfs_host_cookie_t udata;
	char *shareopts;

	udata.callback = callback;
	udata.sharepath = impl_share->sa_mountpoint;
	udata.cookie = cookie;
	udata.filename = filename;
	udata.security = "sys";

	shareopts = FSINFO(impl_share, nfs_fstype)->shareopts;

	return (foreach_nfs_shareopt(shareopts, foreach_nfs_host_cb,
	&udata));
	}

	/*
	* Converts a Solaris NFS host specification to its Linux equivalent.
	*/
	static int
	get_linux_hostspec(const char solaris_hostspec, char *plinux_hostspec)
	{
	/*
	* For now we just support CIDR masks (e.g. @192.168.0.0/16) and host
	* wildcards (e.g. *.example.org).
	*/
	if (solaris_hostspec[0] == '@') {
	/*
	* Solaris host specifier, e.g. @192.168.0.0/16; we just need
	* to skip the @ in this case
	*/
	*plinux_hostspec = strdup(solaris_hostspec + 1);
	} else {
	*plinux_hostspec = strdup(solaris_hostspec);
	}

	if (*plinux_hostspec == NULL) {
	return (SA_NO_MEMORY);
	}

	return (SA_OK);
	}

	/*
	* Adds a Linux share option to an array of NFS options.
	*/
	static int
	add_linux_shareopt(char *plinux_opts, const char key, const char *value)
	{
	size_t len = 0;
	char *new_linux_opts;

	if (*plinux_opts != NULL)
	len = strlen(*plinux_opts);

	new_linux_opts = realloc(*plinux_opts, len + 1 + strlen(key) +
	(value ? 1 + strlen(value) : 0) + 1);

	if (new_linux_opts == NULL)
	return (SA_NO_MEMORY);

	new_linux_opts[len] = '\0';

	if (len > 0)
	strcat(new_linux_opts, ",");

	strcat(new_linux_opts, key);

	if (value != NULL) {
	strcat(new_linux_opts, "=");
	strcat(new_linux_opts, value);
	}

	*plinux_opts = new_linux_opts;

	return (SA_OK);
	}

	/*
	* Validates and converts a single Solaris share option to its Linux
	* equivalent.
	*/
	static int
	get_linux_shareopts_cb(const char key, const char value, void *cookie)
	{
	char plinux_opts = (char )cookie;

	/* host-specific options, these are taken care of elsewhere */
	if (strcmp(key, "ro") == 0 \|\| strcmp(key, "rw") == 0 \|\|
	strcmp(key, "sec") == 0)
	return (SA_OK);

	if (strcmp(key, "anon") == 0)
	key = "anonuid";

	if (strcmp(key, "root_mapping") == 0) {
	(void) add_linux_shareopt(plinux_opts, "root_squash", NULL);
	key = "anonuid";
	}

	if (strcmp(key, "nosub") == 0)
	key = "subtree_check";

	if (strcmp(key, "insecure") != 0 && strcmp(key, "secure") != 0 &&
	strcmp(key, "async") != 0 && strcmp(key, "sync") != 0 &&
	strcmp(key, "no_wdelay") != 0 && strcmp(key, "wdelay") != 0 &&
	strcmp(key, "nohide") != 0 && strcmp(key, "hide") != 0 &&
	strcmp(key, "crossmnt") != 0 &&
	strcmp(key, "no_subtree_check") != 0 &&
	strcmp(key, "subtree_check") != 0 &&
	strcmp(key, "insecure_locks") != 0 &&
	strcmp(key, "secure_locks") != 0 &&
	strcmp(key, "no_auth_nlm") != 0 && strcmp(key, "auth_nlm") != 0 &&
	strcmp(key, "no_acl") != 0 && strcmp(key, "mountpoint") != 0 &&
	strcmp(key, "mp") != 0 && strcmp(key, "fsuid") != 0 &&
	strcmp(key, "refer") != 0 && strcmp(key, "replicas") != 0 &&
	strcmp(key, "root_squash") != 0 &&
	strcmp(key, "no_root_squash") != 0 &&
	strcmp(key, "all_squash") != 0 &&
	strcmp(key, "no_all_squash") != 0 && strcmp(key, "fsid") != 0 &&
	strcmp(key, "anonuid") != 0 && strcmp(key, "anongid") != 0) {
	return (SA_SYNTAX_ERR);
	}

	(void) add_linux_shareopt(plinux_opts, key, value);

	return (SA_OK);
	}

	/*
	* Takes a string containing Solaris share options (e.g. "sync,no_acl") and
	* converts them to a NULL-terminated array of Linux NFS options.
	*/
	static int
	get_linux_shareopts(const char shareopts, char *plinux_opts)
	{
	int error;

	assert(plinux_opts != NULL);

	*plinux_opts = NULL;

	/* no_subtree_check - Default as of nfs-utils v1.1.0 */
	(void) add_linux_shareopt(plinux_opts, "no_subtree_check", NULL);

	/* mountpoint - Restrict exports to ZFS mountpoints */
	(void) add_linux_shareopt(plinux_opts, "mountpoint", NULL);

	error = foreach_nfs_shareopt(shareopts, get_linux_shareopts_cb,
	plinux_opts);

	if (error != SA_OK) {
	free(*plinux_opts);
	*plinux_opts = NULL;
	}

	return (error);
	}

	static char *
	nfs_init_tmpfile(void)
	{
	char *tmpfile = NULL;

	if (asprintf(&tmpfile, "%s%s", ZFS_EXPORTS_FILE, ".XXXXXXXX") == -1) {
	fprintf(stderr, "Unable to allocate temporary file\n");
	return (NULL);
	}

	int fd = mkstemp(tmpfile);
	if (fd == -1) {
	fprintf(stderr, "Unable to create temporary file: %s",
	strerror(errno));
	free(tmpfile);
	return (NULL);
	}
	close(fd);
	return (tmpfile);
	}

	static int
	nfs_fini_tmpfile(char *tmpfile)
	{
	if (rename(tmpfile, ZFS_EXPORTS_FILE) == -1) {
	fprintf(stderr, "Unable to rename %s: %s\n", tmpfile,
	strerror(errno));
	unlink(tmpfile);
	free(tmpfile);
	return (SA_SYSTEM_ERR);
	}
	free(tmpfile);
	return (SA_OK);
	}

	/*
	* This function populates an entry into /etc/exports.d/zfs.exports.
	* This file is consumed by the linux nfs server so that zfs shares are
	* automatically exported upon boot or whenever the nfs server restarts.
	*/
	static int
	nfs_add_entry(const char filename, const char sharepath,
	const char host, const char security, const char *access_opts,
	void *pcookie)
	{
	int error;
	char *linuxhost;
	const char linux_opts = (const char )pcookie;

	error = get_linux_hostspec(host, &linuxhost);
	if (error != SA_OK)
	return (error);

	if (linux_opts == NULL)
	linux_opts = "";

	FILE *fp = fopen(filename, "a+");
	if (fp == NULL) {
	fprintf(stderr, "failed to open %s file: %s", filename,
	strerror(errno));
	free(linuxhost);
	return (SA_SYSTEM_ERR);
	}

	if (fprintf(fp, "%s %s(sec=%s,%s,%s)\n", sharepath, linuxhost,
	security, access_opts, linux_opts) < 0) {
	fprintf(stderr, "failed to write to %s\n", filename);
	free(linuxhost);
	fclose(fp);
	return (SA_SYSTEM_ERR);
	}

	free(linuxhost);
	if (fclose(fp) != 0) {
	fprintf(stderr, "Unable to close file %s: %s\n",
	filename, strerror(errno));
	return (SA_SYSTEM_ERR);
	}
	return (SA_OK);
	}

	/*
	* This function copies all entries from the exports file to "filename",
	* omitting any entries for the specified mountpoint.
	*/
	static int
	nfs_copy_entries(char filename, const char mountpoint)
	{
	char *buf = NULL;
	size_t buflen = 0;
	int error = SA_OK;

	/*
	* If the file doesn't exist then there is nothing more
	* we need to do.
	*/
	FILE *oldfp = fopen(ZFS_EXPORTS_FILE, "r");
	if (oldfp == NULL)
	return (SA_OK);

	FILE *newfp = fopen(filename, "w+");
	fputs(FILE_HEADER, newfp);
	while ((getline(&buf, &buflen, oldfp)) != -1) {
	char *space = NULL;

	if (buf[0] == '\n' \|\| buf[0] == '#')
	continue;

	if ((space = strchr(buf, ' ')) != NULL) {
	int mountpoint_len = strlen(mountpoint);

	if (space - buf == mountpoint_len &&
	strncmp(mountpoint, buf, mountpoint_len) == 0) {
	continue;
	}
	}
	fputs(buf, newfp);
	}

	if (oldfp != NULL && ferror(oldfp) != 0) {
	error = ferror(oldfp);
	}
	if (error == 0 && ferror(newfp) != 0) {
	error = ferror(newfp);
	}

	free(buf);
	if (fclose(newfp) != 0) {
	fprintf(stderr, "Unable to close file %s: %s\n",
	filename, strerror(errno));
	error = error != 0 ? error : SA_SYSTEM_ERR;
	}
	fclose(oldfp);

	return (error);
	}

	/*
	* Enables NFS sharing for the specified share.
	*/
	static int
	nfs_enable_share(sa_share_impl_t impl_share)
	{
	char shareopts, linux_opts;
	char *filename = NULL;
	int error;

	if ((filename = nfs_init_tmpfile()) == NULL)
	return (SA_SYSTEM_ERR);

	error = nfs_exports_lock();
	if (error != 0) {
	unlink(filename);
	free(filename);
	return (error);
	}

	error = nfs_copy_entries(filename, impl_share->sa_mountpoint);
	if (error != SA_OK) {
	unlink(filename);
	free(filename);
	nfs_exports_unlock();
	return (error);
	}

	shareopts = FSINFO(impl_share, nfs_fstype)->shareopts;
	error = get_linux_shareopts(shareopts, &linux_opts);
	if (error != SA_OK) {
	unlink(filename);
	free(filename);
	nfs_exports_unlock();
	return (error);
	}

	error = foreach_nfs_host(impl_share, filename, nfs_add_entry,
	linux_opts);
	free(linux_opts);
	if (error == 0) {
	error = nfs_fini_tmpfile(filename);
	} else {
	unlink(filename);
	free(filename);
	}
	nfs_exports_unlock();
	return (error);
	}

	/*
	* Disables NFS sharing for the specified share.
	*/
	static int
	nfs_disable_share(sa_share_impl_t impl_share)
	{
	int error;
	char *filename = NULL;

	if ((filename = nfs_init_tmpfile()) == NULL)
	return (SA_SYSTEM_ERR);

	error = nfs_exports_lock();
	if (error != 0) {
	unlink(filename);
	free(filename);
	return (error);
	}

	error = nfs_copy_entries(filename, impl_share->sa_mountpoint);
	if (error != SA_OK) {
	unlink(filename);
	free(filename);
	nfs_exports_unlock();
	return (error);
	}
	error = nfs_fini_tmpfile(filename);
	nfs_exports_unlock();
	return (error);
	}

	static boolean_t
	nfs_is_shared(sa_share_impl_t impl_share)
	{
	size_t buflen = 0;
	char *buf = NULL;

	FILE *fp = fopen(ZFS_EXPORTS_FILE, "r");
	if (fp == NULL) {
	return (B_FALSE);
	}
	while ((getline(&buf, &buflen, fp)) != -1) {
	char *space = NULL;

	if ((space = strchr(buf, ' ')) != NULL) {
	int mountpoint_len = strlen(impl_share->sa_mountpoint);

	if (space - buf == mountpoint_len &&
	strncmp(impl_share->sa_mountpoint, buf,
	mountpoint_len) == 0) {
	fclose(fp);
	free(buf);
	return (B_TRUE);
	}
	}
	}
	free(buf);
	fclose(fp);
	return (B_FALSE);
	}

	/*
	* Checks whether the specified NFS share options are syntactically correct.
	*/
	static int
	nfs_validate_shareopts(const char *shareopts)
	{
	char *linux_opts;
	int error;

	error = get_linux_shareopts(shareopts, &linux_opts);

	if (error != SA_OK)
	return (error);

	free(linux_opts);
	return (SA_OK);
	}

	static int
	nfs_update_shareopts(sa_share_impl_t impl_share, const char *shareopts)
	{
	FSINFO(impl_share, nfs_fstype)->shareopts = (char *)shareopts;
	return (SA_OK);
	}

	/*
	* Clears a share's NFS options. Used by libshare to
	* clean up shares that are about to be free()'d.
	*/
	static void
	nfs_clear_shareopts(sa_share_impl_t impl_share)
	{
	FSINFO(impl_share, nfs_fstype)->shareopts = NULL;
	}

	static int
	nfs_commit_shares(void)
	{
	char *argv[] = {
	"/usr/sbin/exportfs",
	"-ra",
	NULL
	};

	return (libzfs_run_process(argv[0], argv, 0));
	}

	static const sa_share_ops_t nfs_shareops = {
	.enable_share = nfs_enable_share,
	.disable_share = nfs_disable_share,
	.is_shared = nfs_is_shared,

	.validate_shareopts = nfs_validate_shareopts,
	.update_shareopts = nfs_update_shareopts,
	.clear_shareopts = nfs_clear_shareopts,
	.commit_shares = nfs_commit_shares,
	};

	/*
	* Initializes the NFS functionality of libshare.
	*/
	void
	libshare_nfs_init(void)
	{
	struct stat sb;

	nfs_fstype = register_fstype("nfs", &nfs_shareops);

	if (stat(ZFS_EXPORTS_DIR, &sb) < 0 &&
	mkdir(ZFS_EXPORTS_DIR, 0755) < 0) {
	fprintf(stderr, "failed to create %s: %s\n",
	ZFS_EXPORTS_DIR, strerror(errno));
	}
	}
	Index: vendor-sys/openzfs/dist/lib/libspl/include/os/freebsd/sys/stat.h
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libspl/include/os/freebsd/sys/stat.h (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libspl/include/os/freebsd/sys/stat.h (revision 365892)
	@@ -1,71 +1,74 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License, Version 1.0 only
	* (the "License"). You may not use this file except in compliance
	* with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
	*/

	#ifndef _LIBSPL_SYS_STAT_H
	#define _LIBSPL_SYS_STAT_H

	#include_next <sys/stat.h>

	+/* Note: this file can be used on linux/macOS when bootstrapping tools. */
	+#if defined(__FreeBSD__)
	#include <sys/mount.h> /* for BLKGETSIZE64 */

	#define stat64 stat

	#define MAXOFFSET_T OFF_MAX

	#ifndef _KERNEL
	#include <sys/disk.h>

	static __inline int
	fstat64(int fd, struct stat *sb)
	{
	int ret;

	ret = fstat(fd, sb);
	if (ret == 0) {
	if (S_ISCHR(sb->st_mode))
	(void) ioctl(fd, DIOCGMEDIASIZE, &sb->st_size);
	}
	return (ret);
	}
	#endif

	/*
	* Emulate Solaris' behavior of returning the block device size in fstat64().
	*/
	static inline int
	fstat64_blk(int fd, struct stat64 *st)
	{
	if (fstat64(fd, st) == -1)
	return (-1);

	/* In Linux we need to use an ioctl to get the size of a block device */
	if (S_ISBLK(st->st_mode)) {
	if (ioctl(fd, BLKGETSIZE64, &st->st_size) != 0)
	return (-1);
	}

	return (0);
	}
	+#endif /* defined(__FreeBSD__) */
	#endif /* _LIBSPL_SYS_STAT_H */
	Index: vendor-sys/openzfs/dist/lib/libzfs/libzfs.pc.in
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfs/libzfs.pc.in (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzfs/libzfs.pc.in (revision 365892)
	@@ -1,14 +1,14 @@
	prefix=@prefix@
	exec_prefix=@exec_prefix@
	libdir=@libdir@
	includedir=@includedir@

	Name: libzfs
	Description: LibZFS library
	Version: @VERSION@
	-URL: https://zfsonlinux.org
	+URL: https://github.com/openzfs/zfs
	Requires: libzfs_core
	-Requires.private: libcrypto zlib
	+Requires.private: @LIBCRYPTO_PC@ @ZLIB_PC@
	Cflags: -I${includedir}/libzfs -I${includedir}/libspl
	Libs: -L${libdir} -lzfs -lnvpair
	Libs.private: -luutil -lm -pthread
	Index: vendor-sys/openzfs/dist/lib/libzfs/libzfs_dataset.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfs/libzfs_dataset.c (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzfs/libzfs_dataset.c (revision 365892)
	@@ -1,5506 +1,5507 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright 2019 Joyent, Inc.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2012 DEY Storage Systems, Inc. All rights reserved.
	* Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
	* Copyright (c) 2013 Martin Matuska. All rights reserved.
	* Copyright (c) 2013 Steven Hartland. All rights reserved.
	* Copyright 2017 Nexenta Systems, Inc.
	* Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
	* Copyright 2017-2018 RackTop Systems.
	* Copyright (c) 2019 Datto Inc.
	* Copyright (c) 2019, loli10K <ezomori.nozomu@gmail.com>
	*/

	#include <ctype.h>
	#include <errno.h>
	#include <libintl.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <strings.h>
	#include <unistd.h>
	#include <stddef.h>
	#include <zone.h>
	#include <fcntl.h>
	#include <sys/mntent.h>
	#include <sys/mount.h>
	#include <pwd.h>
	#include <grp.h>
	#include <stddef.h>
	#include <ucred.h>
	#ifdef HAVE_IDMAP
	#include <idmap.h>
	#include <aclutils.h>
	#include <directory.h>
	#endif /* HAVE_IDMAP */

	#include <sys/dnode.h>
	#include <sys/spa.h>
	#include <sys/zap.h>
	#include <sys/dsl_crypt.h>
	#include <libzfs.h>
	#include <libzutil.h>

	#include "zfs_namecheck.h"
	#include "zfs_prop.h"
	#include "libzfs_impl.h"
	#include "libzfs.h"
	#include "zfs_deleg.h"

	static int userquota_propname_decode(const char *propname, boolean_t zoned,
	zfs_userquota_prop_t typep, char domain, int domainlen, uint64_t *ridp);

	/*
	* Given a single type (not a mask of types), return the type in a human
	* readable form.
	*/
	const char *
	zfs_type_to_name(zfs_type_t type)
	{
	switch (type) {
	case ZFS_TYPE_FILESYSTEM:
	return (dgettext(TEXT_DOMAIN, "filesystem"));
	case ZFS_TYPE_SNAPSHOT:
	return (dgettext(TEXT_DOMAIN, "snapshot"));
	case ZFS_TYPE_VOLUME:
	return (dgettext(TEXT_DOMAIN, "volume"));
	case ZFS_TYPE_POOL:
	return (dgettext(TEXT_DOMAIN, "pool"));
	case ZFS_TYPE_BOOKMARK:
	return (dgettext(TEXT_DOMAIN, "bookmark"));
	default:
	assert(!"unhandled zfs_type_t");
	}

	return (NULL);
	}

	/*
	* Validate a ZFS path. This is used even before trying to open the dataset, to
	* provide a more meaningful error message. We call zfs_error_aux() to
	* explain exactly why the name was not valid.
	*/
	int
	zfs_validate_name(libzfs_handle_t hdl, const char path, int type,
	boolean_t modifying)
	{
	namecheck_err_t why;
	char what;

	if (!(type & ZFS_TYPE_SNAPSHOT) && strchr(path, '@') != NULL) {
	if (hdl != NULL)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"snapshot delimiter '@' is not expected here"));
	return (0);
	}

	if (type == ZFS_TYPE_SNAPSHOT && strchr(path, '@') == NULL) {
	if (hdl != NULL)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"missing '@' delimiter in snapshot name"));
	return (0);
	}

	if (!(type & ZFS_TYPE_BOOKMARK) && strchr(path, '#') != NULL) {
	if (hdl != NULL)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"bookmark delimiter '#' is not expected here"));
	return (0);
	}

	if (type == ZFS_TYPE_BOOKMARK && strchr(path, '#') == NULL) {
	if (hdl != NULL)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"missing '#' delimiter in bookmark name"));
	return (0);
	}

	if (modifying && strchr(path, '%') != NULL) {
	if (hdl != NULL)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid character %c in name"), '%');
	return (0);
	}

	if (entity_namecheck(path, &why, &what) != 0) {
	if (hdl != NULL) {
	switch (why) {
	case NAME_ERR_TOOLONG:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"name is too long"));
	break;

	case NAME_ERR_LEADING_SLASH:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"leading slash in name"));
	break;

	case NAME_ERR_EMPTY_COMPONENT:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"empty component or misplaced '@'"
	" or '#' delimiter in name"));
	break;

	case NAME_ERR_TRAILING_SLASH:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"trailing slash in name"));
	break;

	case NAME_ERR_INVALCHAR:
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "invalid character "
	"'%c' in name"), what);
	break;

	case NAME_ERR_MULTIPLE_DELIMITERS:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"multiple '@' and/or '#' delimiters in "
	"name"));
	break;

	case NAME_ERR_NOLETTER:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool doesn't begin with a letter"));
	break;

	case NAME_ERR_RESERVED:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"name is reserved"));
	break;

	case NAME_ERR_DISKLIKE:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"reserved disk name"));
	break;

	case NAME_ERR_SELF_REF:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"self reference, '.' is found in name"));
	break;

	case NAME_ERR_PARENT_REF:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"parent reference, '..' is found in name"));
	break;

	default:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"(%d) not defined"), why);
	break;
	}
	}

	return (0);
	}

	return (-1);
	}

	int
	zfs_name_valid(const char *name, zfs_type_t type)
	{
	if (type == ZFS_TYPE_POOL)
	return (zpool_name_valid(NULL, B_FALSE, name));
	return (zfs_validate_name(NULL, name, type, B_FALSE));
	}

	/*
	* This function takes the raw DSL properties, and filters out the user-defined
	* properties into a separate nvlist.
	*/
	static nvlist_t *
	process_user_props(zfs_handle_t zhp, nvlist_t props)
	{
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	nvpair_t *elem;
	nvlist_t *propval;
	nvlist_t *nvl;

	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0) {
	(void) no_memory(hdl);
	return (NULL);
	}

	elem = NULL;
	while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
	if (!zfs_prop_user(nvpair_name(elem)))
	continue;

	verify(nvpair_value_nvlist(elem, &propval) == 0);
	if (nvlist_add_nvlist(nvl, nvpair_name(elem), propval) != 0) {
	nvlist_free(nvl);
	(void) no_memory(hdl);
	return (NULL);
	}
	}

	return (nvl);
	}

	static zpool_handle_t *
	zpool_add_handle(zfs_handle_t zhp, const char pool_name)
	{
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	zpool_handle_t *zph;

	if ((zph = zpool_open_canfail(hdl, pool_name)) != NULL) {
	if (hdl->libzfs_pool_handles != NULL)
	zph->zpool_next = hdl->libzfs_pool_handles;
	hdl->libzfs_pool_handles = zph;
	}
	return (zph);
	}

	static zpool_handle_t *
	zpool_find_handle(zfs_handle_t zhp, const char pool_name, int len)
	{
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	zpool_handle_t *zph = hdl->libzfs_pool_handles;

	while ((zph != NULL) &&
	(strncmp(pool_name, zpool_get_name(zph), len) != 0))
	zph = zph->zpool_next;
	return (zph);
	}

	/*
	* Returns a handle to the pool that contains the provided dataset.
	* If a handle to that pool already exists then that handle is returned.
	* Otherwise, a new handle is created and added to the list of handles.
	*/
	static zpool_handle_t *
	zpool_handle(zfs_handle_t *zhp)
	{
	char *pool_name;
	int len;
	zpool_handle_t *zph;

	len = strcspn(zhp->zfs_name, "/@#") + 1;
	pool_name = zfs_alloc(zhp->zfs_hdl, len);
	(void) strlcpy(pool_name, zhp->zfs_name, len);

	zph = zpool_find_handle(zhp, pool_name, len);
	if (zph == NULL)
	zph = zpool_add_handle(zhp, pool_name);

	free(pool_name);
	return (zph);
	}

	void
	zpool_free_handles(libzfs_handle_t *hdl)
	{
	zpool_handle_t next, zph = hdl->libzfs_pool_handles;

	while (zph != NULL) {
	next = zph->zpool_next;
	zpool_close(zph);
	zph = next;
	}
	hdl->libzfs_pool_handles = NULL;
	}

	/*
	* Utility function to gather stats (objset and zpl) for the given object.
	*/
	static int
	get_stats_ioctl(zfs_handle_t zhp, zfs_cmd_t zc)
	{
	libzfs_handle_t *hdl = zhp->zfs_hdl;

	(void) strlcpy(zc->zc_name, zhp->zfs_name, sizeof (zc->zc_name));

	while (zfs_ioctl(hdl, ZFS_IOC_OBJSET_STATS, zc) != 0) {
	if (errno == ENOMEM) {
	if (zcmd_expand_dst_nvlist(hdl, zc) != 0) {
	return (-1);
	}
	} else {
	return (-1);
	}
	}
	return (0);
	}

	/*
	* Utility function to get the received properties of the given object.
	*/
	static int
	get_recvd_props_ioctl(zfs_handle_t *zhp)
	{
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	nvlist_t *recvdprops;
	zfs_cmd_t zc = {"\0"};
	int err;

	if (zcmd_alloc_dst_nvlist(hdl, &zc, 0) != 0)
	return (-1);

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));

	while (zfs_ioctl(hdl, ZFS_IOC_OBJSET_RECVD_PROPS, &zc) != 0) {
	if (errno == ENOMEM) {
	if (zcmd_expand_dst_nvlist(hdl, &zc) != 0) {
	return (-1);
	}
	} else {
	zcmd_free_nvlists(&zc);
	return (-1);
	}
	}

	err = zcmd_read_dst_nvlist(zhp->zfs_hdl, &zc, &recvdprops);
	zcmd_free_nvlists(&zc);
	if (err != 0)
	return (-1);

	nvlist_free(zhp->zfs_recvd_props);
	zhp->zfs_recvd_props = recvdprops;

	return (0);
	}

	static int
	put_stats_zhdl(zfs_handle_t zhp, zfs_cmd_t zc)
	{
	nvlist_t allprops, userprops;

	zhp->zfs_dmustats = zc->zc_objset_stats; /* structure assignment */

	if (zcmd_read_dst_nvlist(zhp->zfs_hdl, zc, &allprops) != 0) {
	return (-1);
	}

	/*
	* XXX Why do we store the user props separately, in addition to
	* storing them in zfs_props?
	*/
	if ((userprops = process_user_props(zhp, allprops)) == NULL) {
	nvlist_free(allprops);
	return (-1);
	}

	nvlist_free(zhp->zfs_props);
	nvlist_free(zhp->zfs_user_props);

	zhp->zfs_props = allprops;
	zhp->zfs_user_props = userprops;

	return (0);
	}

	static int
	get_stats(zfs_handle_t *zhp)
	{
	int rc = 0;
	zfs_cmd_t zc = {"\0"};

	if (zcmd_alloc_dst_nvlist(zhp->zfs_hdl, &zc, 0) != 0)
	return (-1);
	if (get_stats_ioctl(zhp, &zc) != 0)
	rc = -1;
	else if (put_stats_zhdl(zhp, &zc) != 0)
	rc = -1;
	zcmd_free_nvlists(&zc);
	return (rc);
	}

	/*
	* Refresh the properties currently stored in the handle.
	*/
	void
	zfs_refresh_properties(zfs_handle_t *zhp)
	{
	(void) get_stats(zhp);
	}

	/*
	* Makes a handle from the given dataset name. Used by zfs_open() and
	* zfs_iter_* to create child handles on the fly.
	*/
	static int
	make_dataset_handle_common(zfs_handle_t zhp, zfs_cmd_t zc)
	{
	if (put_stats_zhdl(zhp, zc) != 0)
	return (-1);

	/*
	* We've managed to open the dataset and gather statistics. Determine
	* the high-level type.
	*/
	if (zhp->zfs_dmustats.dds_type == DMU_OST_ZVOL)
	zhp->zfs_head_type = ZFS_TYPE_VOLUME;
	else if (zhp->zfs_dmustats.dds_type == DMU_OST_ZFS)
	zhp->zfs_head_type = ZFS_TYPE_FILESYSTEM;
	else if (zhp->zfs_dmustats.dds_type == DMU_OST_OTHER)
	return (-1);
	else
	abort();

	if (zhp->zfs_dmustats.dds_is_snapshot)
	zhp->zfs_type = ZFS_TYPE_SNAPSHOT;
	else if (zhp->zfs_dmustats.dds_type == DMU_OST_ZVOL)
	zhp->zfs_type = ZFS_TYPE_VOLUME;
	else if (zhp->zfs_dmustats.dds_type == DMU_OST_ZFS)
	zhp->zfs_type = ZFS_TYPE_FILESYSTEM;
	else
	abort(); /* we should never see any other types */

	if ((zhp->zpool_hdl = zpool_handle(zhp)) == NULL)
	return (-1);

	return (0);
	}

	zfs_handle_t *
	make_dataset_handle(libzfs_handle_t hdl, const char path)
	{
	zfs_cmd_t zc = {"\0"};

	zfs_handle_t *zhp = calloc(1, sizeof (zfs_handle_t));

	if (zhp == NULL)
	return (NULL);

	zhp->zfs_hdl = hdl;
	(void) strlcpy(zhp->zfs_name, path, sizeof (zhp->zfs_name));
	if (zcmd_alloc_dst_nvlist(hdl, &zc, 0) != 0) {
	free(zhp);
	return (NULL);
	}
	if (get_stats_ioctl(zhp, &zc) == -1) {
	zcmd_free_nvlists(&zc);
	free(zhp);
	return (NULL);
	}
	if (make_dataset_handle_common(zhp, &zc) == -1) {
	free(zhp);
	zhp = NULL;
	}
	zcmd_free_nvlists(&zc);
	return (zhp);
	}

	zfs_handle_t *
	make_dataset_handle_zc(libzfs_handle_t hdl, zfs_cmd_t zc)
	{
	zfs_handle_t *zhp = calloc(1, sizeof (zfs_handle_t));

	if (zhp == NULL)
	return (NULL);

	zhp->zfs_hdl = hdl;
	(void) strlcpy(zhp->zfs_name, zc->zc_name, sizeof (zhp->zfs_name));
	if (make_dataset_handle_common(zhp, zc) == -1) {
	free(zhp);
	return (NULL);
	}
	return (zhp);
	}

	zfs_handle_t *
	make_dataset_simple_handle_zc(zfs_handle_t pzhp, zfs_cmd_t zc)
	{
	zfs_handle_t *zhp = calloc(1, sizeof (zfs_handle_t));

	if (zhp == NULL)
	return (NULL);

	zhp->zfs_hdl = pzhp->zfs_hdl;
	(void) strlcpy(zhp->zfs_name, zc->zc_name, sizeof (zhp->zfs_name));
	zhp->zfs_head_type = pzhp->zfs_type;
	zhp->zfs_type = ZFS_TYPE_SNAPSHOT;
	zhp->zpool_hdl = zpool_handle(zhp);

	return (zhp);
	}

	zfs_handle_t *
	zfs_handle_dup(zfs_handle_t *zhp_orig)
	{
	zfs_handle_t *zhp = calloc(1, sizeof (zfs_handle_t));

	if (zhp == NULL)
	return (NULL);

	zhp->zfs_hdl = zhp_orig->zfs_hdl;
	zhp->zpool_hdl = zhp_orig->zpool_hdl;
	(void) strlcpy(zhp->zfs_name, zhp_orig->zfs_name,
	sizeof (zhp->zfs_name));
	zhp->zfs_type = zhp_orig->zfs_type;
	zhp->zfs_head_type = zhp_orig->zfs_head_type;
	zhp->zfs_dmustats = zhp_orig->zfs_dmustats;
	if (zhp_orig->zfs_props != NULL) {
	if (nvlist_dup(zhp_orig->zfs_props, &zhp->zfs_props, 0) != 0) {
	(void) no_memory(zhp->zfs_hdl);
	zfs_close(zhp);
	return (NULL);
	}
	}
	if (zhp_orig->zfs_user_props != NULL) {
	if (nvlist_dup(zhp_orig->zfs_user_props,
	&zhp->zfs_user_props, 0) != 0) {
	(void) no_memory(zhp->zfs_hdl);
	zfs_close(zhp);
	return (NULL);
	}
	}
	if (zhp_orig->zfs_recvd_props != NULL) {
	if (nvlist_dup(zhp_orig->zfs_recvd_props,
	&zhp->zfs_recvd_props, 0)) {
	(void) no_memory(zhp->zfs_hdl);
	zfs_close(zhp);
	return (NULL);
	}
	}
	zhp->zfs_mntcheck = zhp_orig->zfs_mntcheck;
	if (zhp_orig->zfs_mntopts != NULL) {
	zhp->zfs_mntopts = zfs_strdup(zhp_orig->zfs_hdl,
	zhp_orig->zfs_mntopts);
	}
	zhp->zfs_props_table = zhp_orig->zfs_props_table;
	return (zhp);
	}

	boolean_t
	zfs_bookmark_exists(const char *path)
	{
	nvlist_t *bmarks;
	nvlist_t *props;
	char fsname[ZFS_MAX_DATASET_NAME_LEN];
	char *bmark_name;
	char *pound;
	int err;
	boolean_t rv;

	(void) strlcpy(fsname, path, sizeof (fsname));
	pound = strchr(fsname, '#');
	if (pound == NULL)
	return (B_FALSE);

	*pound = '\0';
	bmark_name = pound + 1;
	props = fnvlist_alloc();
	err = lzc_get_bookmarks(fsname, props, &bmarks);
	nvlist_free(props);
	if (err != 0) {
	nvlist_free(bmarks);
	return (B_FALSE);
	}

	rv = nvlist_exists(bmarks, bmark_name);
	nvlist_free(bmarks);
	return (rv);
	}

	zfs_handle_t *
	make_bookmark_handle(zfs_handle_t parent, const char path,
	nvlist_t *bmark_props)
	{
	zfs_handle_t *zhp = calloc(1, sizeof (zfs_handle_t));

	if (zhp == NULL)
	return (NULL);

	/* Fill in the name. */
	zhp->zfs_hdl = parent->zfs_hdl;
	(void) strlcpy(zhp->zfs_name, path, sizeof (zhp->zfs_name));

	/* Set the property lists. */
	if (nvlist_dup(bmark_props, &zhp->zfs_props, 0) != 0) {
	free(zhp);
	return (NULL);
	}

	/* Set the types. */
	zhp->zfs_head_type = parent->zfs_head_type;
	zhp->zfs_type = ZFS_TYPE_BOOKMARK;

	if ((zhp->zpool_hdl = zpool_handle(zhp)) == NULL) {
	nvlist_free(zhp->zfs_props);
	free(zhp);
	return (NULL);
	}

	return (zhp);
	}

	struct zfs_open_bookmarks_cb_data {
	const char *path;
	zfs_handle_t *zhp;
	};

	static int
	zfs_open_bookmarks_cb(zfs_handle_t zhp, void data)
	{
	struct zfs_open_bookmarks_cb_data *dp = data;

	/*
	* Is it the one we are looking for?
	*/
	if (strcmp(dp->path, zfs_get_name(zhp)) == 0) {
	/*
	* We found it. Save it and let the caller know we are done.
	*/
	dp->zhp = zhp;
	return (EEXIST);
	}

	/*
	* Not found. Close the handle and ask for another one.
	*/
	zfs_close(zhp);
	return (0);
	}

	/*
	* Opens the given snapshot, bookmark, filesystem, or volume. The 'types'
	* argument is a mask of acceptable types. The function will print an
	* appropriate error message and return NULL if it can't be opened.
	*/
	zfs_handle_t *
	zfs_open(libzfs_handle_t hdl, const char path, int types)
	{
	zfs_handle_t *zhp;
	char errbuf[1024];
	char *bookp;

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot open '%s'"), path);

	/*
	* Validate the name before we even try to open it.
	*/
	if (!zfs_validate_name(hdl, path, types, B_FALSE)) {
	(void) zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
	return (NULL);
	}

	/*
	* Bookmarks needs to be handled separately.
	*/
	bookp = strchr(path, '#');
	if (bookp == NULL) {
	/*
	* Try to get stats for the dataset, which will tell us if it
	* exists.
	*/
	errno = 0;
	if ((zhp = make_dataset_handle(hdl, path)) == NULL) {
	(void) zfs_standard_error(hdl, errno, errbuf);
	return (NULL);
	}
	} else {
	char dsname[ZFS_MAX_DATASET_NAME_LEN];
	zfs_handle_t *pzhp;
	struct zfs_open_bookmarks_cb_data cb_data = {path, NULL};

	/*
	* We need to cut out '#' and everything after '#'
	* to get the parent dataset name only.
	*/
	assert(bookp - path < sizeof (dsname));
	(void) strncpy(dsname, path, bookp - path);
	dsname[bookp - path] = '\0';

	/*
	* Create handle for the parent dataset.
	*/
	errno = 0;
	if ((pzhp = make_dataset_handle(hdl, dsname)) == NULL) {
	(void) zfs_standard_error(hdl, errno, errbuf);
	return (NULL);
	}

	/*
	* Iterate bookmarks to find the right one.
	*/
	errno = 0;
	if ((zfs_iter_bookmarks(pzhp, zfs_open_bookmarks_cb,
	&cb_data) == 0) && (cb_data.zhp == NULL)) {
	(void) zfs_error(hdl, EZFS_NOENT, errbuf);
	zfs_close(pzhp);
	return (NULL);
	}
	if (cb_data.zhp == NULL) {
	(void) zfs_standard_error(hdl, errno, errbuf);
	zfs_close(pzhp);
	return (NULL);
	}
	zhp = cb_data.zhp;

	/*
	* Cleanup.
	*/
	zfs_close(pzhp);
	}

	if (!(types & zhp->zfs_type)) {
	(void) zfs_error(hdl, EZFS_BADTYPE, errbuf);
	zfs_close(zhp);
	return (NULL);
	}

	return (zhp);
	}

	/*
	* Release a ZFS handle. Nothing to do but free the associated memory.
	*/
	void
	zfs_close(zfs_handle_t *zhp)
	{
	if (zhp->zfs_mntopts)
	free(zhp->zfs_mntopts);
	nvlist_free(zhp->zfs_props);
	nvlist_free(zhp->zfs_user_props);
	nvlist_free(zhp->zfs_recvd_props);
	free(zhp);
	}

	typedef struct mnttab_node {
	struct mnttab mtn_mt;
	avl_node_t mtn_node;
	} mnttab_node_t;

	static int
	libzfs_mnttab_cache_compare(const void arg1, const void arg2)
	{
	const mnttab_node_t mtn1 = (const mnttab_node_t )arg1;
	const mnttab_node_t mtn2 = (const mnttab_node_t )arg2;
	int rv;

	rv = strcmp(mtn1->mtn_mt.mnt_special, mtn2->mtn_mt.mnt_special);

	return (TREE_ISIGN(rv));
	}

	void
	libzfs_mnttab_init(libzfs_handle_t *hdl)
	{
	pthread_mutex_init(&hdl->libzfs_mnttab_cache_lock, NULL);
	assert(avl_numnodes(&hdl->libzfs_mnttab_cache) == 0);
	avl_create(&hdl->libzfs_mnttab_cache, libzfs_mnttab_cache_compare,
	sizeof (mnttab_node_t), offsetof(mnttab_node_t, mtn_node));
	}

	static int
	libzfs_mnttab_update(libzfs_handle_t *hdl)
	{
	struct mnttab entry;

	/* Reopen MNTTAB to prevent reading stale data from open file */
	if (freopen(MNTTAB, "r", hdl->libzfs_mnttab) == NULL)
	return (ENOENT);

	while (getmntent(hdl->libzfs_mnttab, &entry) == 0) {
	mnttab_node_t *mtn;
	avl_index_t where;

	if (strcmp(entry.mnt_fstype, MNTTYPE_ZFS) != 0)
	continue;

	mtn = zfs_alloc(hdl, sizeof (mnttab_node_t));
	mtn->mtn_mt.mnt_special = zfs_strdup(hdl, entry.mnt_special);
	mtn->mtn_mt.mnt_mountp = zfs_strdup(hdl, entry.mnt_mountp);
	mtn->mtn_mt.mnt_fstype = zfs_strdup(hdl, entry.mnt_fstype);
	mtn->mtn_mt.mnt_mntopts = zfs_strdup(hdl, entry.mnt_mntopts);

	/* Exclude duplicate mounts */
	if (avl_find(&hdl->libzfs_mnttab_cache, mtn, &where) != NULL) {
	free(mtn->mtn_mt.mnt_special);
	free(mtn->mtn_mt.mnt_mountp);
	free(mtn->mtn_mt.mnt_fstype);
	free(mtn->mtn_mt.mnt_mntopts);
	free(mtn);
	continue;
	}

	avl_add(&hdl->libzfs_mnttab_cache, mtn);
	}

	return (0);
	}

	void
	libzfs_mnttab_fini(libzfs_handle_t *hdl)
	{
	void *cookie = NULL;
	mnttab_node_t *mtn;

	while ((mtn = avl_destroy_nodes(&hdl->libzfs_mnttab_cache, &cookie))
	!= NULL) {
	free(mtn->mtn_mt.mnt_special);
	free(mtn->mtn_mt.mnt_mountp);
	free(mtn->mtn_mt.mnt_fstype);
	free(mtn->mtn_mt.mnt_mntopts);
	free(mtn);
	}
	avl_destroy(&hdl->libzfs_mnttab_cache);
	(void) pthread_mutex_destroy(&hdl->libzfs_mnttab_cache_lock);
	}

	void
	libzfs_mnttab_cache(libzfs_handle_t *hdl, boolean_t enable)
	{
	hdl->libzfs_mnttab_enable = enable;
	}

	int
	libzfs_mnttab_find(libzfs_handle_t hdl, const char fsname,
	struct mnttab *entry)
	{
	mnttab_node_t find;
	mnttab_node_t *mtn;
	int ret = ENOENT;

	if (!hdl->libzfs_mnttab_enable) {
	struct mnttab srch = { 0 };

	if (avl_numnodes(&hdl->libzfs_mnttab_cache))
	libzfs_mnttab_fini(hdl);

	/* Reopen MNTTAB to prevent reading stale data from open file */
	if (freopen(MNTTAB, "r", hdl->libzfs_mnttab) == NULL)
	return (ENOENT);

	srch.mnt_special = (char *)fsname;
	srch.mnt_fstype = MNTTYPE_ZFS;
	if (getmntany(hdl->libzfs_mnttab, entry, &srch) == 0)
	return (0);
	else
	return (ENOENT);
	}

	pthread_mutex_lock(&hdl->libzfs_mnttab_cache_lock);
	if (avl_numnodes(&hdl->libzfs_mnttab_cache) == 0) {
	int error;

	if ((error = libzfs_mnttab_update(hdl)) != 0) {
	pthread_mutex_unlock(&hdl->libzfs_mnttab_cache_lock);
	return (error);
	}
	}

	find.mtn_mt.mnt_special = (char *)fsname;
	mtn = avl_find(&hdl->libzfs_mnttab_cache, &find, NULL);
	if (mtn) {
	*entry = mtn->mtn_mt;
	ret = 0;
	}
	pthread_mutex_unlock(&hdl->libzfs_mnttab_cache_lock);
	return (ret);
	}

	void
	libzfs_mnttab_add(libzfs_handle_t hdl, const char special,
	const char mountp, const char mntopts)
	{
	mnttab_node_t *mtn;

	pthread_mutex_lock(&hdl->libzfs_mnttab_cache_lock);
	if (avl_numnodes(&hdl->libzfs_mnttab_cache) != 0) {
	mtn = zfs_alloc(hdl, sizeof (mnttab_node_t));
	mtn->mtn_mt.mnt_special = zfs_strdup(hdl, special);
	mtn->mtn_mt.mnt_mountp = zfs_strdup(hdl, mountp);
	mtn->mtn_mt.mnt_fstype = zfs_strdup(hdl, MNTTYPE_ZFS);
	mtn->mtn_mt.mnt_mntopts = zfs_strdup(hdl, mntopts);
	/*
	* Another thread may have already added this entry
	* via libzfs_mnttab_update. If so we should skip it.
	*/
	if (avl_find(&hdl->libzfs_mnttab_cache, mtn, NULL) != NULL) {
	free(mtn->mtn_mt.mnt_special);
	free(mtn->mtn_mt.mnt_mountp);
	free(mtn->mtn_mt.mnt_fstype);
	free(mtn->mtn_mt.mnt_mntopts);
	free(mtn);
	} else {
	avl_add(&hdl->libzfs_mnttab_cache, mtn);
	}
	}
	pthread_mutex_unlock(&hdl->libzfs_mnttab_cache_lock);
	}

	void
	libzfs_mnttab_remove(libzfs_handle_t hdl, const char fsname)
	{
	mnttab_node_t find;
	mnttab_node_t *ret;

	pthread_mutex_lock(&hdl->libzfs_mnttab_cache_lock);
	find.mtn_mt.mnt_special = (char *)fsname;
	if ((ret = avl_find(&hdl->libzfs_mnttab_cache, (void *)&find, NULL))
	!= NULL) {
	avl_remove(&hdl->libzfs_mnttab_cache, ret);
	free(ret->mtn_mt.mnt_special);
	free(ret->mtn_mt.mnt_mountp);
	free(ret->mtn_mt.mnt_fstype);
	free(ret->mtn_mt.mnt_mntopts);
	free(ret);
	}
	pthread_mutex_unlock(&hdl->libzfs_mnttab_cache_lock);
	}

	int
	zfs_spa_version(zfs_handle_t zhp, int spa_version)
	{
	zpool_handle_t *zpool_handle = zhp->zpool_hdl;

	if (zpool_handle == NULL)
	return (-1);

	*spa_version = zpool_get_prop_int(zpool_handle,
	ZPOOL_PROP_VERSION, NULL);
	return (0);
	}

	/*
	* The choice of reservation property depends on the SPA version.
	*/
	static int
	zfs_which_resv_prop(zfs_handle_t zhp, zfs_prop_t resv_prop)
	{
	int spa_version;

	if (zfs_spa_version(zhp, &spa_version) < 0)
	return (-1);

	if (spa_version >= SPA_VERSION_REFRESERVATION)
	*resv_prop = ZFS_PROP_REFRESERVATION;
	else
	*resv_prop = ZFS_PROP_RESERVATION;

	return (0);
	}

	/*
	* Given an nvlist of properties to set, validates that they are correct, and
	* parses any numeric properties (index, boolean, etc) if they are specified as
	* strings.
	*/
	nvlist_t *
	zfs_valid_proplist(libzfs_handle_t hdl, zfs_type_t type, nvlist_t nvl,
	uint64_t zoned, zfs_handle_t zhp, zpool_handle_t zpool_hdl,
	boolean_t key_params_ok, const char *errbuf)
	{
	nvpair_t *elem;
	uint64_t intval;
	char *strval;
	zfs_prop_t prop;
	nvlist_t *ret;
	int chosen_normal = -1;
	int chosen_utf = -1;

	if (nvlist_alloc(&ret, NV_UNIQUE_NAME, 0) != 0) {
	(void) no_memory(hdl);
	return (NULL);
	}

	/*
	* Make sure this property is valid and applies to this type.
	*/

	elem = NULL;
	while ((elem = nvlist_next_nvpair(nvl, elem)) != NULL) {
	const char *propname = nvpair_name(elem);

	prop = zfs_name_to_prop(propname);
	if (prop == ZPROP_INVAL && zfs_prop_user(propname)) {
	/*
	* This is a user property: make sure it's a
	* string, and that it's less than ZAP_MAXNAMELEN.
	*/
	if (nvpair_type(elem) != DATA_TYPE_STRING) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be a string"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (strlen(nvpair_name(elem)) >= ZAP_MAXNAMELEN) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property name '%s' is too long"),
	propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	(void) nvpair_value_string(elem, &strval);
	if (nvlist_add_string(ret, propname, strval) != 0) {
	(void) no_memory(hdl);
	goto error;
	}
	continue;
	}

	/*
	* Currently, only user properties can be modified on
	* snapshots.
	*/
	if (type == ZFS_TYPE_SNAPSHOT) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"this property can not be modified for snapshots"));
	(void) zfs_error(hdl, EZFS_PROPTYPE, errbuf);
	goto error;
	}

	if (prop == ZPROP_INVAL && zfs_prop_userquota(propname)) {
	zfs_userquota_prop_t uqtype;
	char *newpropname = NULL;
	char domain[128];
	uint64_t rid;
	uint64_t valary[3];
	int rc;

	if (userquota_propname_decode(propname, zoned,
	&uqtype, domain, sizeof (domain), &rid) != 0) {
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN,
	"'%s' has an invalid user/group name"),
	propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (uqtype != ZFS_PROP_USERQUOTA &&
	uqtype != ZFS_PROP_GROUPQUOTA &&
	uqtype != ZFS_PROP_USEROBJQUOTA &&
	uqtype != ZFS_PROP_GROUPOBJQUOTA &&
	uqtype != ZFS_PROP_PROJECTQUOTA &&
	uqtype != ZFS_PROP_PROJECTOBJQUOTA) {
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "'%s' is readonly"),
	propname);
	(void) zfs_error(hdl, EZFS_PROPREADONLY,
	errbuf);
	goto error;
	}

	if (nvpair_type(elem) == DATA_TYPE_STRING) {
	(void) nvpair_value_string(elem, &strval);
	if (strcmp(strval, "none") == 0) {
	intval = 0;
	} else if (zfs_nicestrtonum(hdl,
	strval, &intval) != 0) {
	(void) zfs_error(hdl,
	EZFS_BADPROP, errbuf);
	goto error;
	}
	} else if (nvpair_type(elem) ==
	DATA_TYPE_UINT64) {
	(void) nvpair_value_uint64(elem, &intval);
	if (intval == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"use 'none' to disable "
	"{user\|group\|project}quota"));
	goto error;
	}
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be a number"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	/*
	* Encode the prop name as
	* userquota@<hex-rid>-domain, to make it easy
	* for the kernel to decode.
	*/
	rc = asprintf(&newpropname, "%s%llx-%s",
	zfs_userquota_prop_prefixes[uqtype],
	(longlong_t)rid, domain);
	if (rc == -1 \|\| newpropname == NULL) {
	(void) no_memory(hdl);
	goto error;
	}

	valary[0] = uqtype;
	valary[1] = rid;
	valary[2] = intval;
	if (nvlist_add_uint64_array(ret, newpropname,
	valary, 3) != 0) {
	free(newpropname);
	(void) no_memory(hdl);
	goto error;
	}
	free(newpropname);
	continue;
	} else if (prop == ZPROP_INVAL && zfs_prop_written(propname)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' is readonly"),
	propname);
	(void) zfs_error(hdl, EZFS_PROPREADONLY, errbuf);
	goto error;
	}

	if (prop == ZPROP_INVAL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid property '%s'"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (!zfs_prop_valid_for_type(prop, type, B_FALSE)) {
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "'%s' does not "
	"apply to datasets of this type"), propname);
	(void) zfs_error(hdl, EZFS_PROPTYPE, errbuf);
	goto error;
	}

	if (zfs_prop_readonly(prop) &&
	!(zfs_prop_setonce(prop) && zhp == NULL) &&
	!(zfs_prop_encryption_key_param(prop) && key_params_ok)) {
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "'%s' is readonly"),
	propname);
	(void) zfs_error(hdl, EZFS_PROPREADONLY, errbuf);
	goto error;
	}

	if (zprop_parse_value(hdl, elem, prop, type, ret,
	&strval, &intval, errbuf) != 0)
	goto error;

	/*
	* Perform some additional checks for specific properties.
	*/
	switch (prop) {
	case ZFS_PROP_VERSION:
	{
	int version;

	if (zhp == NULL)
	break;
	version = zfs_prop_get_int(zhp, ZFS_PROP_VERSION);
	if (intval < version) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"Can not downgrade; already at version %u"),
	version);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	break;
	}

	case ZFS_PROP_VOLBLOCKSIZE:
	case ZFS_PROP_RECORDSIZE:
	{
	int maxbs = SPA_MAXBLOCKSIZE;
	char buf[64];

	if (zpool_hdl != NULL) {
	maxbs = zpool_get_prop_int(zpool_hdl,
	ZPOOL_PROP_MAXBLOCKSIZE, NULL);
	}
	/*
	* The value must be a power of two between
	* SPA_MINBLOCKSIZE and maxbs.
	*/
	if (intval < SPA_MINBLOCKSIZE \|\|
	intval > maxbs \|\| !ISP2(intval)) {
	zfs_nicebytes(maxbs, buf, sizeof (buf));
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be power of 2 from 512B "
	"to %s"), propname, buf);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	break;
	}

	case ZFS_PROP_SPECIAL_SMALL_BLOCKS:
	{
	int maxbs = SPA_OLD_MAXBLOCKSIZE;
	char buf[64];

	if (zpool_hdl != NULL) {
	char state[64] = "";

	maxbs = zpool_get_prop_int(zpool_hdl,
	ZPOOL_PROP_MAXBLOCKSIZE, NULL);

	/*
	* Issue a warning but do not fail so that
	* tests for settable properties succeed.
	*/
	if (zpool_prop_get_feature(zpool_hdl,
	"feature@allocation_classes", state,
	sizeof (state)) != 0 \|\|
	strcmp(state, ZFS_FEATURE_ACTIVE) != 0) {
	(void) fprintf(stderr, gettext(
	"%s: property requires a special "
	"device in the pool\n"), propname);
	}
	}
	if (intval != 0 &&
	(intval < SPA_MINBLOCKSIZE \|\|
	intval > maxbs \|\| !ISP2(intval))) {
	zfs_nicebytes(maxbs, buf, sizeof (buf));
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid '%s=%d' property: must be zero or "
	"a power of 2 from 512B to %s"), propname,
	intval, buf);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	break;
	}

	case ZFS_PROP_MLSLABEL:
	{
	#ifdef HAVE_MLSLABEL
	/*
	* Verify the mlslabel string and convert to
	* internal hex label string.
	*/

	m_label_t *new_sl;
	char hex = NULL; / internal label string */

	/* Default value is already OK. */
	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
	break;

	/* Verify the label can be converted to binary form */
	if (((new_sl = m_label_alloc(MAC_LABEL)) == NULL) \|\|
	(str_to_label(strval, &new_sl, MAC_LABEL,
	L_NO_CORRECTION, NULL) == -1)) {
	goto badlabel;
	}

	/* Now translate to hex internal label string */
	if (label_to_str(new_sl, &hex, M_INTERNAL,
	DEF_NAMES) != 0) {
	if (hex)
	free(hex);
	goto badlabel;
	}
	m_label_free(new_sl);

	/* If string is already in internal form, we're done. */
	if (strcmp(strval, hex) == 0) {
	free(hex);
	break;
	}

	/* Replace the label string with the internal form. */
	(void) nvlist_remove(ret, zfs_prop_to_name(prop),
	DATA_TYPE_STRING);
	verify(nvlist_add_string(ret, zfs_prop_to_name(prop),
	hex) == 0);
	free(hex);

	break;

	badlabel:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid mlslabel '%s'"), strval);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	m_label_free(new_sl); /* OK if null */
	goto error;
	#else
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"mlslabels are unsupported"));
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	#endif /* HAVE_MLSLABEL */
	}

	case ZFS_PROP_MOUNTPOINT:
	{
	namecheck_err_t why;

	if (strcmp(strval, ZFS_MOUNTPOINT_NONE) == 0 \|\|
	strcmp(strval, ZFS_MOUNTPOINT_LEGACY) == 0)
	break;

	if (mountpoint_namecheck(strval, &why)) {
	switch (why) {
	case NAME_ERR_LEADING_SLASH:
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN,
	"'%s' must be an absolute path, "
	"'none', or 'legacy'"), propname);
	break;
	case NAME_ERR_TOOLONG:
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN,
	"component of '%s' is too long"),
	propname);
	break;

	default:
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN,
	"(%d) not defined"),
	why);
	break;
	}
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	}

	/FALLTHRU/

	case ZFS_PROP_SHARESMB:
	case ZFS_PROP_SHARENFS:
	/*
	* For the mountpoint and sharenfs or sharesmb
	* properties, check if it can be set in a
	* global/non-global zone based on
	* the zoned property value:
	*
	* global zone non-global zone
	* --------------------------------------------------
	* zoned=on mountpoint (no) mountpoint (yes)
	* sharenfs (no) sharenfs (no)
	* sharesmb (no) sharesmb (no)
	*
	* zoned=off mountpoint (yes) N/A
	* sharenfs (yes)
	* sharesmb (yes)
	*/
	if (zoned) {
	if (getzoneid() == GLOBAL_ZONEID) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' cannot be set on "
	"dataset in a non-global zone"),
	propname);
	(void) zfs_error(hdl, EZFS_ZONED,
	errbuf);
	goto error;
	} else if (prop == ZFS_PROP_SHARENFS \|\|
	prop == ZFS_PROP_SHARESMB) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' cannot be set in "
	"a non-global zone"), propname);
	(void) zfs_error(hdl, EZFS_ZONED,
	errbuf);
	goto error;
	}
	} else if (getzoneid() != GLOBAL_ZONEID) {
	/*
	* If zoned property is 'off', this must be in
	* a global zone. If not, something is wrong.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' cannot be set while dataset "
	"'zoned' property is set"), propname);
	(void) zfs_error(hdl, EZFS_ZONED, errbuf);
	goto error;
	}

	/*
	* At this point, it is legitimate to set the
	* property. Now we want to make sure that the
	* property value is valid if it is sharenfs.
	*/
	if ((prop == ZFS_PROP_SHARENFS \|\|
	prop == ZFS_PROP_SHARESMB) &&
	strcmp(strval, "on") != 0 &&
	strcmp(strval, "off") != 0) {
	zfs_share_proto_t proto;

	if (prop == ZFS_PROP_SHARESMB)
	proto = PROTO_SMB;
	else
	proto = PROTO_NFS;

	if (zfs_parse_options(strval, proto) != SA_OK) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' cannot be set to invalid "
	"options"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP,
	errbuf);
	goto error;
	}
	}

	break;

	case ZFS_PROP_KEYLOCATION:
	if (!zfs_prop_valid_keylocation(strval, B_FALSE)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid keylocation"));
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (zhp != NULL) {
	uint64_t crypt =
	zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);

	if (crypt == ZIO_CRYPT_OFF &&
	strcmp(strval, "none") != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"keylocation must be 'none' "
	"for unencrypted datasets"));
	(void) zfs_error(hdl, EZFS_BADPROP,
	errbuf);
	goto error;
	} else if (crypt != ZIO_CRYPT_OFF &&
	strcmp(strval, "none") == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"keylocation must not be 'none' "
	"for encrypted datasets"));
	(void) zfs_error(hdl, EZFS_BADPROP,
	errbuf);
	goto error;
	}
	}
	break;

	case ZFS_PROP_PBKDF2_ITERS:
	if (intval < MIN_PBKDF2_ITERATIONS) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"minimum pbkdf2 iterations is %u"),
	MIN_PBKDF2_ITERATIONS);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	break;

	case ZFS_PROP_UTF8ONLY:
	chosen_utf = (int)intval;
	break;

	case ZFS_PROP_NORMALIZE:
	chosen_normal = (int)intval;
	break;

	default:
	break;
	}

	/*
	* For changes to existing volumes, we have some additional
	* checks to enforce.
	*/
	if (type == ZFS_TYPE_VOLUME && zhp != NULL) {
	uint64_t blocksize = zfs_prop_get_int(zhp,
	ZFS_PROP_VOLBLOCKSIZE);
	char buf[64];

	switch (prop) {
	case ZFS_PROP_VOLSIZE:
	if (intval % blocksize != 0) {
	zfs_nicebytes(blocksize, buf,
	sizeof (buf));
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be a multiple of "
	"volume block size (%s)"),
	propname, buf);
	(void) zfs_error(hdl, EZFS_BADPROP,
	errbuf);
	goto error;
	}

	if (intval == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' cannot be zero"),
	propname);
	(void) zfs_error(hdl, EZFS_BADPROP,
	errbuf);
	goto error;
	}
	break;

	default:
	break;
	}
	}

	/* check encryption properties */
	if (zhp != NULL) {
	int64_t crypt = zfs_prop_get_int(zhp,
	ZFS_PROP_ENCRYPTION);

	switch (prop) {
	case ZFS_PROP_COPIES:
	if (crypt != ZIO_CRYPT_OFF && intval > 2) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"encrypted datasets cannot have "
	"3 copies"));
	(void) zfs_error(hdl, EZFS_BADPROP,
	errbuf);
	goto error;
	}
	break;
	default:
	break;
	}
	}
	}

	/*
	* If normalization was chosen, but no UTF8 choice was made,
	* enforce rejection of non-UTF8 names.
	*
	* If normalization was chosen, but rejecting non-UTF8 names
	* was explicitly not chosen, it is an error.
	*/
	if (chosen_normal > 0 && chosen_utf < 0) {
	if (nvlist_add_uint64(ret,
	zfs_prop_to_name(ZFS_PROP_UTF8ONLY), 1) != 0) {
	(void) no_memory(hdl);
	goto error;
	}
	} else if (chosen_normal > 0 && chosen_utf == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be set 'on' if normalization chosen"),
	zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	return (ret);

	error:
	nvlist_free(ret);
	return (NULL);
	}

	static int
	zfs_add_synthetic_resv(zfs_handle_t zhp, nvlist_t nvl)
	{
	uint64_t old_volsize;
	uint64_t new_volsize;
	uint64_t old_reservation;
	uint64_t new_reservation;
	zfs_prop_t resv_prop;
	nvlist_t *props;
	zpool_handle_t *zph = zpool_handle(zhp);

	/*
	* If this is an existing volume, and someone is setting the volsize,
	* make sure that it matches the reservation, or add it if necessary.
	*/
	old_volsize = zfs_prop_get_int(zhp, ZFS_PROP_VOLSIZE);
	if (zfs_which_resv_prop(zhp, &resv_prop) < 0)
	return (-1);
	old_reservation = zfs_prop_get_int(zhp, resv_prop);

	props = fnvlist_alloc();
	fnvlist_add_uint64(props, zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
	zfs_prop_get_int(zhp, ZFS_PROP_VOLBLOCKSIZE));

	if ((zvol_volsize_to_reservation(zph, old_volsize, props) !=
	old_reservation) \|\| nvlist_exists(nvl,
	zfs_prop_to_name(resv_prop))) {
	fnvlist_free(props);
	return (0);
	}
	if (nvlist_lookup_uint64(nvl, zfs_prop_to_name(ZFS_PROP_VOLSIZE),
	&new_volsize) != 0) {
	fnvlist_free(props);
	return (-1);
	}
	new_reservation = zvol_volsize_to_reservation(zph, new_volsize, props);
	fnvlist_free(props);

	if (nvlist_add_uint64(nvl, zfs_prop_to_name(resv_prop),
	new_reservation) != 0) {
	(void) no_memory(zhp->zfs_hdl);
	return (-1);
	}
	return (1);
	}

	/*
	* Helper for 'zfs {set\|clone} refreservation=auto'. Must be called after
	* zfs_valid_proplist(), as it is what sets the UINT64_MAX sentinel value.
	* Return codes must match zfs_add_synthetic_resv().
	*/
	static int
	zfs_fix_auto_resv(zfs_handle_t zhp, nvlist_t nvl)
	{
	uint64_t volsize;
	uint64_t resvsize;
	zfs_prop_t prop;
	nvlist_t *props;

	if (!ZFS_IS_VOLUME(zhp)) {
	return (0);
	}

	if (zfs_which_resv_prop(zhp, &prop) != 0) {
	return (-1);
	}

	if (prop != ZFS_PROP_REFRESERVATION) {
	return (0);
	}

	if (nvlist_lookup_uint64(nvl, zfs_prop_to_name(prop), &resvsize) != 0) {
	/* No value being set, so it can't be "auto" */
	return (0);
	}
	if (resvsize != UINT64_MAX) {
	/* Being set to a value other than "auto" */
	return (0);
	}

	props = fnvlist_alloc();

	fnvlist_add_uint64(props, zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
	zfs_prop_get_int(zhp, ZFS_PROP_VOLBLOCKSIZE));

	if (nvlist_lookup_uint64(nvl, zfs_prop_to_name(ZFS_PROP_VOLSIZE),
	&volsize) != 0) {
	volsize = zfs_prop_get_int(zhp, ZFS_PROP_VOLSIZE);
	}

	resvsize = zvol_volsize_to_reservation(zpool_handle(zhp), volsize,
	props);
	fnvlist_free(props);

	(void) nvlist_remove_all(nvl, zfs_prop_to_name(prop));
	if (nvlist_add_uint64(nvl, zfs_prop_to_name(prop), resvsize) != 0) {
	(void) no_memory(zhp->zfs_hdl);
	return (-1);
	}
	return (1);
	}

	static boolean_t
	zfs_is_namespace_prop(zfs_prop_t prop)
	{
	switch (prop) {

	case ZFS_PROP_ATIME:
	case ZFS_PROP_RELATIME:
	case ZFS_PROP_DEVICES:
	case ZFS_PROP_EXEC:
	case ZFS_PROP_SETUID:
	case ZFS_PROP_READONLY:
	case ZFS_PROP_XATTR:
	case ZFS_PROP_NBMAND:
	return (B_TRUE);

	default:
	return (B_FALSE);
	}
	}

	/*
	* Given a property name and value, set the property for the given dataset.
	*/
	int
	zfs_prop_set(zfs_handle_t zhp, const char propname, const char *propval)
	{
	int ret = -1;
	char errbuf[1024];
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	nvlist_t *nvl = NULL;

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot set property for '%s'"),
	zhp->zfs_name);

	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0 \|\|
	nvlist_add_string(nvl, propname, propval) != 0) {
	(void) no_memory(hdl);
	goto error;
	}

	ret = zfs_prop_set_list(zhp, nvl);

	error:
	nvlist_free(nvl);
	return (ret);
	}



	/*
	* Given an nvlist of property names and values, set the properties for the
	* given dataset.
	*/
	int
	zfs_prop_set_list(zfs_handle_t zhp, nvlist_t props)
	{
	zfs_cmd_t zc = {"\0"};
	int ret = -1;
	prop_changelist_t **cls = NULL;
	int cl_idx;
	char errbuf[1024];
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	nvlist_t *nvl;
	int nvl_len = 0;
	int added_resv = 0;
	zfs_prop_t prop = 0;
	nvpair_t *elem;

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot set property for '%s'"),
	zhp->zfs_name);

	if ((nvl = zfs_valid_proplist(hdl, zhp->zfs_type, props,
	zfs_prop_get_int(zhp, ZFS_PROP_ZONED), zhp, zhp->zpool_hdl,
	B_FALSE, errbuf)) == NULL)
	goto error;

	/*
	* We have to check for any extra properties which need to be added
	* before computing the length of the nvlist.
	*/
	for (elem = nvlist_next_nvpair(nvl, NULL);
	elem != NULL;
	elem = nvlist_next_nvpair(nvl, elem)) {
	if (zfs_name_to_prop(nvpair_name(elem)) == ZFS_PROP_VOLSIZE &&
	(added_resv = zfs_add_synthetic_resv(zhp, nvl)) == -1) {
	goto error;
	}
	}

	if (added_resv != 1 &&
	(added_resv = zfs_fix_auto_resv(zhp, nvl)) == -1) {
	goto error;
	}

	/*
	* Check how many properties we're setting and allocate an array to
	* store changelist pointers for postfix().
	*/
	for (elem = nvlist_next_nvpair(nvl, NULL);
	elem != NULL;
	elem = nvlist_next_nvpair(nvl, elem))
	nvl_len++;
	if ((cls = calloc(nvl_len, sizeof (prop_changelist_t *))) == NULL)
	goto error;

	cl_idx = 0;
	for (elem = nvlist_next_nvpair(nvl, NULL);
	elem != NULL;
	elem = nvlist_next_nvpair(nvl, elem)) {

	prop = zfs_name_to_prop(nvpair_name(elem));

	assert(cl_idx < nvl_len);
	/*
	* We don't want to unmount & remount the dataset when changing
	* its canmount property to 'on' or 'noauto'. We only use
	* the changelist logic to unmount when setting canmount=off.
	*/
	if (prop != ZFS_PROP_CANMOUNT \|\|
	(fnvpair_value_uint64(elem) == ZFS_CANMOUNT_OFF &&
	zfs_is_mounted(zhp, NULL))) {
	cls[cl_idx] = changelist_gather(zhp, prop, 0, 0);
	if (cls[cl_idx] == NULL)
	goto error;
	}

	if (prop == ZFS_PROP_MOUNTPOINT &&
	changelist_haszonedchild(cls[cl_idx])) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"child dataset with inherited mountpoint is used "
	"in a non-global zone"));
	ret = zfs_error(hdl, EZFS_ZONED, errbuf);
	goto error;
	}

	if (cls[cl_idx] != NULL &&
	(ret = changelist_prefix(cls[cl_idx])) != 0)
	goto error;

	cl_idx++;
	}
	assert(cl_idx == nvl_len);

	/*
	* Execute the corresponding ioctl() to set this list of properties.
	*/
	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));

	if ((ret = zcmd_write_src_nvlist(hdl, &zc, nvl)) != 0 \|\|
	(ret = zcmd_alloc_dst_nvlist(hdl, &zc, 0)) != 0)
	goto error;

	ret = zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);

	if (ret != 0) {
	if (zc.zc_nvlist_dst_filled == B_FALSE) {
	(void) zfs_standard_error(hdl, errno, errbuf);
	goto error;
	}

	/* Get the list of unset properties back and report them. */
	nvlist_t *errorprops = NULL;
	if (zcmd_read_dst_nvlist(hdl, &zc, &errorprops) != 0)
	goto error;
	for (nvpair_t *elem = nvlist_next_nvpair(errorprops, NULL);
	elem != NULL;
	elem = nvlist_next_nvpair(errorprops, elem)) {
	prop = zfs_name_to_prop(nvpair_name(elem));
	zfs_setprop_error(hdl, prop, errno, errbuf);
	}
	nvlist_free(errorprops);

	if (added_resv && errno == ENOSPC) {
	/* clean up the volsize property we tried to set */
	uint64_t old_volsize = zfs_prop_get_int(zhp,
	ZFS_PROP_VOLSIZE);
	nvlist_free(nvl);
	nvl = NULL;
	zcmd_free_nvlists(&zc);

	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0)
	goto error;
	if (nvlist_add_uint64(nvl,
	zfs_prop_to_name(ZFS_PROP_VOLSIZE),
	old_volsize) != 0)
	goto error;
	if (zcmd_write_src_nvlist(hdl, &zc, nvl) != 0)
	goto error;
	(void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
	}
	} else {
	for (cl_idx = 0; cl_idx < nvl_len; cl_idx++) {
	if (cls[cl_idx] != NULL) {
	int clp_err = changelist_postfix(cls[cl_idx]);
	if (clp_err != 0)
	ret = clp_err;
	}
	}

	if (ret == 0) {
	/*
	* Refresh the statistics so the new property
	* value is reflected.
	*/
	(void) get_stats(zhp);

	/*
	* Remount the filesystem to propagate the change
	* if one of the options handled by the generic
	* Linux namespace layer has been modified.
	*/
	if (zfs_is_namespace_prop(prop) &&
	zfs_is_mounted(zhp, NULL))
	ret = zfs_mount(zhp, MNTOPT_REMOUNT, 0);
	}
	}

	error:
	nvlist_free(nvl);
	zcmd_free_nvlists(&zc);
	if (cls != NULL) {
	for (cl_idx = 0; cl_idx < nvl_len; cl_idx++) {
	if (cls[cl_idx] != NULL)
	changelist_free(cls[cl_idx]);
	}
	free(cls);
	}
	return (ret);
	}

	/*
	* Given a property, inherit the value from the parent dataset, or if received
	* is TRUE, revert to the received value, if any.
	*/
	int
	zfs_prop_inherit(zfs_handle_t zhp, const char propname, boolean_t received)
	{
	zfs_cmd_t zc = {"\0"};
	int ret;
	prop_changelist_t *cl;
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	char errbuf[1024];
	zfs_prop_t prop;

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot inherit %s for '%s'"), propname, zhp->zfs_name);

	zc.zc_cookie = received;
	if ((prop = zfs_name_to_prop(propname)) == ZPROP_INVAL) {
	/*
	* For user properties, the amount of work we have to do is very
	* small, so just do it here.
	*/
	if (!zfs_prop_user(propname)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid property"));
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
	(void) strlcpy(zc.zc_value, propname, sizeof (zc.zc_value));

	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_INHERIT_PROP, &zc) != 0)
	return (zfs_standard_error(hdl, errno, errbuf));

	return (0);
	}

	/*
	* Verify that this property is inheritable.
	*/
	if (zfs_prop_readonly(prop))
	return (zfs_error(hdl, EZFS_PROPREADONLY, errbuf));

	if (!zfs_prop_inheritable(prop) && !received)
	return (zfs_error(hdl, EZFS_PROPNONINHERIT, errbuf));

	/*
	* Check to see if the value applies to this type
	*/
	if (!zfs_prop_valid_for_type(prop, zhp->zfs_type, B_FALSE))
	return (zfs_error(hdl, EZFS_PROPTYPE, errbuf));

	/*
	* Normalize the name, to get rid of shorthand abbreviations.
	*/
	propname = zfs_prop_to_name(prop);
	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
	(void) strlcpy(zc.zc_value, propname, sizeof (zc.zc_value));

	if (prop == ZFS_PROP_MOUNTPOINT && getzoneid() == GLOBAL_ZONEID &&
	zfs_prop_get_int(zhp, ZFS_PROP_ZONED)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset is used in a non-global zone"));
	return (zfs_error(hdl, EZFS_ZONED, errbuf));
	}

	/*
	* Determine datasets which will be affected by this change, if any.
	*/
	if ((cl = changelist_gather(zhp, prop, 0, 0)) == NULL)
	return (-1);

	if (prop == ZFS_PROP_MOUNTPOINT && changelist_haszonedchild(cl)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"child dataset with inherited mountpoint is used "
	"in a non-global zone"));
	ret = zfs_error(hdl, EZFS_ZONED, errbuf);
	goto error;
	}

	if ((ret = changelist_prefix(cl)) != 0)
	goto error;

	if ((ret = zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_INHERIT_PROP, &zc)) != 0) {
	return (zfs_standard_error(hdl, errno, errbuf));
	} else {

	if ((ret = changelist_postfix(cl)) != 0)
	goto error;

	/*
	* Refresh the statistics so the new property is reflected.
	*/
	(void) get_stats(zhp);

	/*
	* Remount the filesystem to propagate the change
	* if one of the options handled by the generic
	* Linux namespace layer has been modified.
	*/
	if (zfs_is_namespace_prop(prop) &&
	zfs_is_mounted(zhp, NULL))
	ret = zfs_mount(zhp, MNTOPT_REMOUNT, 0);
	}

	error:
	changelist_free(cl);
	return (ret);
	}

	/*
	* True DSL properties are stored in an nvlist. The following two functions
	* extract them appropriately.
	*/
	uint64_t
	getprop_uint64(zfs_handle_t zhp, zfs_prop_t prop, char *source)
	{
	nvlist_t *nv;
	uint64_t value;

	*source = NULL;
	if (nvlist_lookup_nvlist(zhp->zfs_props,
	zfs_prop_to_name(prop), &nv) == 0) {
	verify(nvlist_lookup_uint64(nv, ZPROP_VALUE, &value) == 0);
	(void) nvlist_lookup_string(nv, ZPROP_SOURCE, source);
	} else {
	verify(!zhp->zfs_props_table \|\|
	zhp->zfs_props_table[prop] == B_TRUE);
	value = zfs_prop_default_numeric(prop);
	*source = "";
	}

	return (value);
	}

	static const char *
	getprop_string(zfs_handle_t zhp, zfs_prop_t prop, char *source)
	{
	nvlist_t *nv;
	const char *value;

	*source = NULL;
	if (nvlist_lookup_nvlist(zhp->zfs_props,
	zfs_prop_to_name(prop), &nv) == 0) {
	value = fnvlist_lookup_string(nv, ZPROP_VALUE);
	(void) nvlist_lookup_string(nv, ZPROP_SOURCE, source);
	} else {
	verify(!zhp->zfs_props_table \|\|
	zhp->zfs_props_table[prop] == B_TRUE);
	value = zfs_prop_default_string(prop);
	*source = "";
	}

	return (value);
	}

	static boolean_t
	zfs_is_recvd_props_mode(zfs_handle_t *zhp)
	{
	return (zhp->zfs_props == zhp->zfs_recvd_props);
	}

	static void
	zfs_set_recvd_props_mode(zfs_handle_t zhp, uint64_t cookie)
	{
	*cookie = (uint64_t)(uintptr_t)zhp->zfs_props;
	zhp->zfs_props = zhp->zfs_recvd_props;
	}

	static void
	zfs_unset_recvd_props_mode(zfs_handle_t zhp, uint64_t cookie)
	{
	zhp->zfs_props = (nvlist_t )(uintptr_t)cookie;
	*cookie = 0;
	}

	/*
	* Internal function for getting a numeric property. Both zfs_prop_get() and
	* zfs_prop_get_int() are built using this interface.
	*
	* Certain properties can be overridden using 'mount -o'. In this case, scan
	* the contents of the /proc/self/mounts entry, searching for the
	* appropriate options. If they differ from the on-disk values, report the
	* current values and mark the source "temporary".
	*/
	static int
	get_numeric_property(zfs_handle_t zhp, zfs_prop_t prop, zprop_source_t src,
	char *source, uint64_t val)
	{
	zfs_cmd_t zc = {"\0"};
	nvlist_t *zplprops = NULL;
	struct mnttab mnt;
	char *mntopt_on = NULL;
	char *mntopt_off = NULL;
	boolean_t received = zfs_is_recvd_props_mode(zhp);

	*source = NULL;

	/*
	* If the property is being fetched for a snapshot, check whether
	* the property is valid for the snapshot's head dataset type.
	*/
	if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT &&
	!zfs_prop_valid_for_type(prop, zhp->zfs_head_type, B_TRUE)) {
	*val = zfs_prop_default_numeric(prop);
	return (-1);
	}

	switch (prop) {
	case ZFS_PROP_ATIME:
	mntopt_on = MNTOPT_ATIME;
	mntopt_off = MNTOPT_NOATIME;
	break;

	case ZFS_PROP_RELATIME:
	mntopt_on = MNTOPT_RELATIME;
	mntopt_off = MNTOPT_NORELATIME;
	break;

	case ZFS_PROP_DEVICES:
	mntopt_on = MNTOPT_DEVICES;
	mntopt_off = MNTOPT_NODEVICES;
	break;

	case ZFS_PROP_EXEC:
	mntopt_on = MNTOPT_EXEC;
	mntopt_off = MNTOPT_NOEXEC;
	break;

	case ZFS_PROP_READONLY:
	mntopt_on = MNTOPT_RO;
	mntopt_off = MNTOPT_RW;
	break;

	case ZFS_PROP_SETUID:
	mntopt_on = MNTOPT_SETUID;
	mntopt_off = MNTOPT_NOSETUID;
	break;

	case ZFS_PROP_XATTR:
	mntopt_on = MNTOPT_XATTR;
	mntopt_off = MNTOPT_NOXATTR;
	break;

	case ZFS_PROP_NBMAND:
	mntopt_on = MNTOPT_NBMAND;
	mntopt_off = MNTOPT_NONBMAND;
	break;

	default:
	break;
	}

	/*
	* Because looking up the mount options is potentially expensive
	* (iterating over all of /proc/self/mounts), we defer its
	* calculation until we're looking up a property which requires
	* its presence.
	*/
	if (!zhp->zfs_mntcheck &&
	(mntopt_on != NULL \|\| prop == ZFS_PROP_MOUNTED)) {
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	struct mnttab entry;

	if (libzfs_mnttab_find(hdl, zhp->zfs_name, &entry) == 0) {
	zhp->zfs_mntopts = zfs_strdup(hdl,
	entry.mnt_mntopts);
	if (zhp->zfs_mntopts == NULL)
	return (-1);
	}

	zhp->zfs_mntcheck = B_TRUE;
	}

	if (zhp->zfs_mntopts == NULL)
	mnt.mnt_mntopts = "";
	else
	mnt.mnt_mntopts = zhp->zfs_mntopts;

	switch (prop) {
	case ZFS_PROP_ATIME:
	case ZFS_PROP_RELATIME:
	case ZFS_PROP_DEVICES:
	case ZFS_PROP_EXEC:
	case ZFS_PROP_READONLY:
	case ZFS_PROP_SETUID:
	#ifndef __FreeBSD__
	case ZFS_PROP_XATTR:
	#endif
	case ZFS_PROP_NBMAND:
	*val = getprop_uint64(zhp, prop, source);

	if (received)
	break;

	if (hasmntopt(&mnt, mntopt_on) && !*val) {
	*val = B_TRUE;
	if (src)
	*src = ZPROP_SRC_TEMPORARY;
	} else if (hasmntopt(&mnt, mntopt_off) && *val) {
	*val = B_FALSE;
	if (src)
	*src = ZPROP_SRC_TEMPORARY;
	}
	break;

	case ZFS_PROP_CANMOUNT:
	case ZFS_PROP_VOLSIZE:
	case ZFS_PROP_QUOTA:
	case ZFS_PROP_REFQUOTA:
	case ZFS_PROP_RESERVATION:
	case ZFS_PROP_REFRESERVATION:
	case ZFS_PROP_FILESYSTEM_LIMIT:
	case ZFS_PROP_SNAPSHOT_LIMIT:
	case ZFS_PROP_FILESYSTEM_COUNT:
	case ZFS_PROP_SNAPSHOT_COUNT:
	*val = getprop_uint64(zhp, prop, source);

	if (*source == NULL) {
	/* not default, must be local */
	*source = zhp->zfs_name;
	}
	break;

	case ZFS_PROP_MOUNTED:
	*val = (zhp->zfs_mntopts != NULL);
	break;

	case ZFS_PROP_NUMCLONES:
	*val = zhp->zfs_dmustats.dds_num_clones;
	break;

	case ZFS_PROP_VERSION:
	case ZFS_PROP_NORMALIZE:
	case ZFS_PROP_UTF8ONLY:
	case ZFS_PROP_CASE:
	if (zcmd_alloc_dst_nvlist(zhp->zfs_hdl, &zc, 0) != 0)
	return (-1);
	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_ZPLPROPS, &zc)) {
	zcmd_free_nvlists(&zc);
	if (prop == ZFS_PROP_VERSION &&
	zhp->zfs_type == ZFS_TYPE_VOLUME)
	*val = zfs_prop_default_numeric(prop);
	return (-1);
	}
	if (zcmd_read_dst_nvlist(zhp->zfs_hdl, &zc, &zplprops) != 0 \|\|
	nvlist_lookup_uint64(zplprops, zfs_prop_to_name(prop),
	val) != 0) {
	zcmd_free_nvlists(&zc);
	return (-1);
	}
	nvlist_free(zplprops);
	zcmd_free_nvlists(&zc);
	break;

	case ZFS_PROP_INCONSISTENT:
	*val = zhp->zfs_dmustats.dds_inconsistent;
	break;

	case ZFS_PROP_REDACTED:
	*val = zhp->zfs_dmustats.dds_redacted;
	break;

	default:
	switch (zfs_prop_get_type(prop)) {
	case PROP_TYPE_NUMBER:
	case PROP_TYPE_INDEX:
	*val = getprop_uint64(zhp, prop, source);
	/*
	* If we tried to use a default value for a
	* readonly property, it means that it was not
	* present. Note this only applies to "truly"
	* readonly properties, not set-once properties
	* like volblocksize.
	*/
	if (zfs_prop_readonly(prop) &&
	!zfs_prop_setonce(prop) &&
	source != NULL && (source)[0] == '\0') {
	*source = NULL;
	return (-1);
	}
	break;

	case PROP_TYPE_STRING:
	default:
	zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
	"cannot get non-numeric property"));
	return (zfs_error(zhp->zfs_hdl, EZFS_BADPROP,
	dgettext(TEXT_DOMAIN, "internal error")));
	}
	}

	return (0);
	}

	/*
	* Calculate the source type, given the raw source string.
	*/
	static void
	get_source(zfs_handle_t zhp, zprop_source_t srctype, char *source,
	char *statbuf, size_t statlen)
	{
	if (statbuf == NULL \|\|
	srctype == NULL \|\| *srctype == ZPROP_SRC_TEMPORARY) {
	return;
	}

	if (source == NULL) {
	*srctype = ZPROP_SRC_NONE;
	} else if (source[0] == '\0') {
	*srctype = ZPROP_SRC_DEFAULT;
	} else if (strstr(source, ZPROP_SOURCE_VAL_RECVD) != NULL) {
	*srctype = ZPROP_SRC_RECEIVED;
	} else {
	if (strcmp(source, zhp->zfs_name) == 0) {
	*srctype = ZPROP_SRC_LOCAL;
	} else {
	(void) strlcpy(statbuf, source, statlen);
	*srctype = ZPROP_SRC_INHERITED;
	}
	}

	}

	int
	zfs_prop_get_recvd(zfs_handle_t zhp, const char propname, char *propbuf,
	size_t proplen, boolean_t literal)
	{
	zfs_prop_t prop;
	int err = 0;

	if (zhp->zfs_recvd_props == NULL)
	if (get_recvd_props_ioctl(zhp) != 0)
	return (-1);

	prop = zfs_name_to_prop(propname);

	if (prop != ZPROP_INVAL) {
	uint64_t cookie;
	if (!nvlist_exists(zhp->zfs_recvd_props, propname))
	return (-1);
	zfs_set_recvd_props_mode(zhp, &cookie);
	err = zfs_prop_get(zhp, prop, propbuf, proplen,
	NULL, NULL, 0, literal);
	zfs_unset_recvd_props_mode(zhp, &cookie);
	} else {
	nvlist_t *propval;
	char *recvdval;
	if (nvlist_lookup_nvlist(zhp->zfs_recvd_props,
	propname, &propval) != 0)
	return (-1);
	verify(nvlist_lookup_string(propval, ZPROP_VALUE,
	&recvdval) == 0);
	(void) strlcpy(propbuf, recvdval, proplen);
	}

	return (err == 0 ? 0 : -1);
	}

	static int
	get_clones_string(zfs_handle_t zhp, char propbuf, size_t proplen)
	{
	nvlist_t *value;
	nvpair_t *pair;

	value = zfs_get_clones_nvl(zhp);
	if (value == NULL)
	return (-1);

	propbuf[0] = '\0';
	for (pair = nvlist_next_nvpair(value, NULL); pair != NULL;
	pair = nvlist_next_nvpair(value, pair)) {
	if (propbuf[0] != '\0')
	(void) strlcat(propbuf, ",", proplen);
	(void) strlcat(propbuf, nvpair_name(pair), proplen);
	}

	return (0);
	}

	struct get_clones_arg {
	uint64_t numclones;
	nvlist_t *value;
	const char *origin;
	char buf[ZFS_MAX_DATASET_NAME_LEN];
	};

	static int
	get_clones_cb(zfs_handle_t zhp, void arg)
	{
	struct get_clones_arg *gca = arg;

	if (gca->numclones == 0) {
	zfs_close(zhp);
	return (0);
	}

	if (zfs_prop_get(zhp, ZFS_PROP_ORIGIN, gca->buf, sizeof (gca->buf),
	NULL, NULL, 0, B_TRUE) != 0)
	goto out;
	if (strcmp(gca->buf, gca->origin) == 0) {
	fnvlist_add_boolean(gca->value, zfs_get_name(zhp));
	gca->numclones--;
	}

	out:
	(void) zfs_iter_children(zhp, get_clones_cb, gca);
	zfs_close(zhp);
	return (0);
	}

	nvlist_t *
	zfs_get_clones_nvl(zfs_handle_t *zhp)
	{
	nvlist_t nv, value;

	if (nvlist_lookup_nvlist(zhp->zfs_props,
	zfs_prop_to_name(ZFS_PROP_CLONES), &nv) != 0) {
	struct get_clones_arg gca;

	/*
	* if this is a snapshot, then the kernel wasn't able
	* to get the clones. Do it by slowly iterating.
	*/
	if (zhp->zfs_type != ZFS_TYPE_SNAPSHOT)
	return (NULL);
	if (nvlist_alloc(&nv, NV_UNIQUE_NAME, 0) != 0)
	return (NULL);
	if (nvlist_alloc(&value, NV_UNIQUE_NAME, 0) != 0) {
	nvlist_free(nv);
	return (NULL);
	}

	gca.numclones = zfs_prop_get_int(zhp, ZFS_PROP_NUMCLONES);
	gca.value = value;
	gca.origin = zhp->zfs_name;

	if (gca.numclones != 0) {
	zfs_handle_t *root;
	char pool[ZFS_MAX_DATASET_NAME_LEN];
	char *cp = pool;

	/* get the pool name */
	(void) strlcpy(pool, zhp->zfs_name, sizeof (pool));
	(void) strsep(&cp, "/@");
	root = zfs_open(zhp->zfs_hdl, pool,
	ZFS_TYPE_FILESYSTEM);
	if (root == NULL) {
	nvlist_free(nv);
	nvlist_free(value);
	return (NULL);
	}

	(void) get_clones_cb(root, &gca);
	}

	if (gca.numclones != 0 \|\|
	nvlist_add_nvlist(nv, ZPROP_VALUE, value) != 0 \|\|
	nvlist_add_nvlist(zhp->zfs_props,
	zfs_prop_to_name(ZFS_PROP_CLONES), nv) != 0) {
	nvlist_free(nv);
	nvlist_free(value);
	return (NULL);
	}
	nvlist_free(nv);
	nvlist_free(value);
	verify(0 == nvlist_lookup_nvlist(zhp->zfs_props,
	zfs_prop_to_name(ZFS_PROP_CLONES), &nv));
	}

	verify(nvlist_lookup_nvlist(nv, ZPROP_VALUE, &value) == 0);

	return (value);
	}

	static int
	get_rsnaps_string(zfs_handle_t zhp, char propbuf, size_t proplen)
	{
	nvlist_t *value;
	uint64_t *snaps;
	uint_t nsnaps;

	if (nvlist_lookup_nvlist(zhp->zfs_props,
	zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &value) != 0)
	return (-1);
	if (nvlist_lookup_uint64_array(value, ZPROP_VALUE, &snaps,
	&nsnaps) != 0)
	return (-1);
	if (nsnaps == 0) {
	/* There's no redaction snapshots; pass a special value back */
	(void) snprintf(propbuf, proplen, "none");
	return (0);
	}
	propbuf[0] = '\0';
	for (int i = 0; i < nsnaps; i++) {
	char buf[128];
	if (propbuf[0] != '\0')
	(void) strlcat(propbuf, ",", proplen);
	(void) snprintf(buf, sizeof (buf), "%llu",
	(u_longlong_t)snaps[i]);
	(void) strlcat(propbuf, buf, proplen);
	}

	return (0);
	}

	/*
	* Accepts a property and value and checks that the value
	* matches the one found by the channel program. If they are
	* not equal, print both of them.
	*/
	static void
	zcp_check(zfs_handle_t *zhp, zfs_prop_t prop, uint64_t intval,
	const char *strval)
	{
	if (!zhp->zfs_hdl->libzfs_prop_debug)
	return;
	int error;
	char *poolname = zhp->zpool_hdl->zpool_name;
	const char *prop_name = zfs_prop_to_name(prop);
	const char *program =
	"args = ...\n"
	"ds = args['dataset']\n"
	"prop = args['property']\n"
	"value, setpoint = zfs.get_prop(ds, prop)\n"
	"return {value=value, setpoint=setpoint}\n";
	nvlist_t *outnvl;
	nvlist_t *retnvl;
	nvlist_t *argnvl = fnvlist_alloc();

	fnvlist_add_string(argnvl, "dataset", zhp->zfs_name);
	fnvlist_add_string(argnvl, "property", zfs_prop_to_name(prop));

	error = lzc_channel_program_nosync(poolname, program,
	10 * 1000 * 1000, 10 * 1024 * 1024, argnvl, &outnvl);

	if (error == 0) {
	retnvl = fnvlist_lookup_nvlist(outnvl, "return");
	if (zfs_prop_get_type(prop) == PROP_TYPE_NUMBER) {
	int64_t ans;
	error = nvlist_lookup_int64(retnvl, "value", &ans);
	if (error != 0) {
	(void) fprintf(stderr, "%s: zcp check error: "
	"%u\n", prop_name, error);
	return;
	}
	if (ans != intval) {
	(void) fprintf(stderr, "%s: zfs found %llu, "
	"but zcp found %llu\n", prop_name,
	(u_longlong_t)intval, (u_longlong_t)ans);
	}
	} else {
	char *str_ans;
	error = nvlist_lookup_string(retnvl, "value", &str_ans);
	if (error != 0) {
	(void) fprintf(stderr, "%s: zcp check error: "
	"%u\n", prop_name, error);
	return;
	}
	if (strcmp(strval, str_ans) != 0) {
	(void) fprintf(stderr,
	"%s: zfs found '%s', but zcp found '%s'\n",
	prop_name, strval, str_ans);
	}
	}
	} else {
	(void) fprintf(stderr, "%s: zcp check failed, channel program "
	"error: %u\n", prop_name, error);
	}
	nvlist_free(argnvl);
	nvlist_free(outnvl);
	}

	/*
	* Retrieve a property from the given object. If 'literal' is specified, then
	* numbers are left as exact values. Otherwise, numbers are converted to a
	* human-readable form.
	*
	* Returns 0 on success, or -1 on error.
	*/
	int
	zfs_prop_get(zfs_handle_t zhp, zfs_prop_t prop, char propbuf, size_t proplen,
	zprop_source_t src, char statbuf, size_t statlen, boolean_t literal)
	{
	char *source = NULL;
	uint64_t val;
	const char *str;
	const char *strval;
	boolean_t received = zfs_is_recvd_props_mode(zhp);

	/*
	* Check to see if this property applies to our object
	*/
	if (!zfs_prop_valid_for_type(prop, zhp->zfs_type, B_FALSE))
	return (-1);

	if (received && zfs_prop_readonly(prop))
	return (-1);

	if (src)
	*src = ZPROP_SRC_NONE;

	switch (prop) {
	case ZFS_PROP_CREATION:
	/*
	* 'creation' is a time_t stored in the statistics. We convert
	* this into a string unless 'literal' is specified.
	*/
	{
	val = getprop_uint64(zhp, prop, &source);
	time_t time = (time_t)val;
	struct tm t;

	if (literal \|\|
	localtime_r(&time, &t) == NULL \|\|
	strftime(propbuf, proplen, "%a %b %e %k:%M %Y",
	&t) == 0)
	(void) snprintf(propbuf, proplen, "%llu",
	(u_longlong_t)val);
	}
	zcp_check(zhp, prop, val, NULL);
	break;

	case ZFS_PROP_MOUNTPOINT:
	/*
	* Getting the precise mountpoint can be tricky.
	*
	* - for 'none' or 'legacy', return those values.
	* - for inherited mountpoints, we want to take everything
	* after our ancestor and append it to the inherited value.
	*
	* If the pool has an alternate root, we want to prepend that
	* root to any values we return.
	*/

	str = getprop_string(zhp, prop, &source);

	if (str[0] == '/') {
	char buf[MAXPATHLEN];
	char *root = buf;
	const char *relpath;

	/*
	* If we inherit the mountpoint, even from a dataset
	* with a received value, the source will be the path of
	* the dataset we inherit from. If source is
	* ZPROP_SOURCE_VAL_RECVD, the received value is not
	* inherited.
	*/
	if (strcmp(source, ZPROP_SOURCE_VAL_RECVD) == 0) {
	relpath = "";
	} else {
	relpath = zhp->zfs_name + strlen(source);
	if (relpath[0] == '/')
	relpath++;
	}

	if ((zpool_get_prop(zhp->zpool_hdl,
	ZPOOL_PROP_ALTROOT, buf, MAXPATHLEN, NULL,
	B_FALSE)) \|\| (strcmp(root, "-") == 0))
	root[0] = '\0';
	/*
	* Special case an alternate root of '/'. This will
	* avoid having multiple leading slashes in the
	* mountpoint path.
	*/
	if (strcmp(root, "/") == 0)
	root++;

	/*
	* If the mountpoint is '/' then skip over this
	* if we are obtaining either an alternate root or
	* an inherited mountpoint.
	*/
	if (str[1] == '\0' && (root[0] != '\0' \|\|
	relpath[0] != '\0'))
	str++;

	if (relpath[0] == '\0')
	(void) snprintf(propbuf, proplen, "%s%s",
	root, str);
	else
	(void) snprintf(propbuf, proplen, "%s%s%s%s",
	root, str, relpath[0] == '@' ? "" : "/",
	relpath);
	} else {
	/* 'legacy' or 'none' */
	(void) strlcpy(propbuf, str, proplen);
	}
	zcp_check(zhp, prop, 0, propbuf);
	break;

	case ZFS_PROP_ORIGIN:
	str = getprop_string(zhp, prop, &source);
	if (str == NULL)
	return (-1);
	(void) strlcpy(propbuf, str, proplen);
	zcp_check(zhp, prop, 0, str);
	break;

	case ZFS_PROP_REDACT_SNAPS:
	if (get_rsnaps_string(zhp, propbuf, proplen) != 0)
	return (-1);
	break;

	case ZFS_PROP_CLONES:
	if (get_clones_string(zhp, propbuf, proplen) != 0)
	return (-1);
	break;

	case ZFS_PROP_QUOTA:
	case ZFS_PROP_REFQUOTA:
	case ZFS_PROP_RESERVATION:
	case ZFS_PROP_REFRESERVATION:

	if (get_numeric_property(zhp, prop, src, &source, &val) != 0)
	return (-1);
	/*
	* If quota or reservation is 0, we translate this into 'none'
	* (unless literal is set), and indicate that it's the default
	* value. Otherwise, we print the number nicely and indicate
	* that its set locally.
	*/
	if (val == 0) {
	if (literal)
	(void) strlcpy(propbuf, "0", proplen);
	else
	(void) strlcpy(propbuf, "none", proplen);
	} else {
	if (literal)
	(void) snprintf(propbuf, proplen, "%llu",
	(u_longlong_t)val);
	else
	zfs_nicebytes(val, propbuf, proplen);
	}
	zcp_check(zhp, prop, val, NULL);
	break;

	case ZFS_PROP_FILESYSTEM_LIMIT:
	case ZFS_PROP_SNAPSHOT_LIMIT:
	case ZFS_PROP_FILESYSTEM_COUNT:
	case ZFS_PROP_SNAPSHOT_COUNT:

	if (get_numeric_property(zhp, prop, src, &source, &val) != 0)
	return (-1);

	/*
	* If limit is UINT64_MAX, we translate this into 'none' (unless
	* literal is set), and indicate that it's the default value.
	* Otherwise, we print the number nicely and indicate that it's
	* set locally.
	*/
	if (literal) {
	(void) snprintf(propbuf, proplen, "%llu",
	(u_longlong_t)val);
	} else if (val == UINT64_MAX) {
	(void) strlcpy(propbuf, "none", proplen);
	} else {
	zfs_nicenum(val, propbuf, proplen);
	}

	zcp_check(zhp, prop, val, NULL);
	break;

	case ZFS_PROP_REFRATIO:
	case ZFS_PROP_COMPRESSRATIO:
	if (get_numeric_property(zhp, prop, src, &source, &val) != 0)
	return (-1);
	if (literal)
	(void) snprintf(propbuf, proplen, "%llu.%02llu",
	(u_longlong_t)(val / 100),
	(u_longlong_t)(val % 100));
	else
	(void) snprintf(propbuf, proplen, "%llu.%02llux",
	(u_longlong_t)(val / 100),
	(u_longlong_t)(val % 100));
	zcp_check(zhp, prop, val, NULL);
	break;

	case ZFS_PROP_TYPE:
	switch (zhp->zfs_type) {
	case ZFS_TYPE_FILESYSTEM:
	str = "filesystem";
	break;
	case ZFS_TYPE_VOLUME:
	str = "volume";
	break;
	case ZFS_TYPE_SNAPSHOT:
	str = "snapshot";
	break;
	case ZFS_TYPE_BOOKMARK:
	str = "bookmark";
	break;
	default:
	abort();
	}
	(void) snprintf(propbuf, proplen, "%s", str);
	zcp_check(zhp, prop, 0, propbuf);
	break;

	case ZFS_PROP_MOUNTED:
	/*
	* The 'mounted' property is a pseudo-property that described
	* whether the filesystem is currently mounted. Even though
	* it's a boolean value, the typical values of "on" and "off"
	* don't make sense, so we translate to "yes" and "no".
	*/
	if (get_numeric_property(zhp, ZFS_PROP_MOUNTED,
	src, &source, &val) != 0)
	return (-1);
	if (val)
	(void) strlcpy(propbuf, "yes", proplen);
	else
	(void) strlcpy(propbuf, "no", proplen);
	break;

	case ZFS_PROP_NAME:
	/*
	* The 'name' property is a pseudo-property derived from the
	* dataset name. It is presented as a real property to simplify
	* consumers.
	*/
	(void) strlcpy(propbuf, zhp->zfs_name, proplen);
	zcp_check(zhp, prop, 0, propbuf);
	break;

	case ZFS_PROP_MLSLABEL:
	{
	#ifdef HAVE_MLSLABEL
	m_label_t *new_sl = NULL;
	char ascii = NULL; / human readable label */

	(void) strlcpy(propbuf,
	getprop_string(zhp, prop, &source), proplen);

	if (literal \|\| (strcasecmp(propbuf,
	ZFS_MLSLABEL_DEFAULT) == 0))
	break;

	/*
	* Try to translate the internal hex string to
	* human-readable output. If there are any
	* problems just use the hex string.
	*/

	if (str_to_label(propbuf, &new_sl, MAC_LABEL,
	L_NO_CORRECTION, NULL) == -1) {
	m_label_free(new_sl);
	break;
	}

	if (label_to_str(new_sl, &ascii, M_LABEL,
	DEF_NAMES) != 0) {
	if (ascii)
	free(ascii);
	m_label_free(new_sl);
	break;
	}
	m_label_free(new_sl);

	(void) strlcpy(propbuf, ascii, proplen);
	free(ascii);
	#else
	(void) strlcpy(propbuf,
	getprop_string(zhp, prop, &source), proplen);
	#endif /* HAVE_MLSLABEL */
	}
	break;

	case ZFS_PROP_GUID:
	case ZFS_PROP_CREATETXG:
	case ZFS_PROP_OBJSETID:
	+ case ZFS_PROP_PBKDF2_ITERS:
	/*
	* These properties are stored as numbers, but they are
	- * identifiers.
	+ * identifiers or counters.
	* We don't want them to be pretty printed, because pretty
	- * printing mangles the ID into a truncated and useless value.
	+ * printing truncates their values making them useless.
	*/
	if (get_numeric_property(zhp, prop, src, &source, &val) != 0)
	return (-1);
	(void) snprintf(propbuf, proplen, "%llu", (u_longlong_t)val);
	zcp_check(zhp, prop, val, NULL);
	break;

	case ZFS_PROP_REFERENCED:
	case ZFS_PROP_AVAILABLE:
	case ZFS_PROP_USED:
	case ZFS_PROP_USEDSNAP:
	case ZFS_PROP_USEDDS:
	case ZFS_PROP_USEDREFRESERV:
	case ZFS_PROP_USEDCHILD:
	if (get_numeric_property(zhp, prop, src, &source, &val) != 0)
	return (-1);
	if (literal) {
	(void) snprintf(propbuf, proplen, "%llu",
	(u_longlong_t)val);
	} else {
	zfs_nicebytes(val, propbuf, proplen);
	}
	zcp_check(zhp, prop, val, NULL);
	break;

	default:
	switch (zfs_prop_get_type(prop)) {
	case PROP_TYPE_NUMBER:
	if (get_numeric_property(zhp, prop, src,
	&source, &val) != 0) {
	return (-1);
	}

	if (literal) {
	(void) snprintf(propbuf, proplen, "%llu",
	(u_longlong_t)val);
	} else {
	zfs_nicenum(val, propbuf, proplen);
	}
	zcp_check(zhp, prop, val, NULL);
	break;

	case PROP_TYPE_STRING:
	str = getprop_string(zhp, prop, &source);
	if (str == NULL)
	return (-1);

	(void) strlcpy(propbuf, str, proplen);
	zcp_check(zhp, prop, 0, str);
	break;

	case PROP_TYPE_INDEX:
	if (get_numeric_property(zhp, prop, src,
	&source, &val) != 0)
	return (-1);
	if (zfs_prop_index_to_string(prop, val, &strval) != 0)
	return (-1);

	(void) strlcpy(propbuf, strval, proplen);
	zcp_check(zhp, prop, 0, strval);
	break;

	default:
	abort();
	}
	}

	get_source(zhp, src, source, statbuf, statlen);

	return (0);
	}

	/*
	* Utility function to get the given numeric property. Does no validation that
	* the given property is the appropriate type; should only be used with
	* hard-coded property types.
	*/
	uint64_t
	zfs_prop_get_int(zfs_handle_t *zhp, zfs_prop_t prop)
	{
	char *source;
	uint64_t val = 0;

	(void) get_numeric_property(zhp, prop, NULL, &source, &val);

	return (val);
	}

	static int
	zfs_prop_set_int(zfs_handle_t *zhp, zfs_prop_t prop, uint64_t val)
	{
	char buf[64];

	(void) snprintf(buf, sizeof (buf), "%llu", (longlong_t)val);
	return (zfs_prop_set(zhp, zfs_prop_to_name(prop), buf));
	}

	/*
	* Similar to zfs_prop_get(), but returns the value as an integer.
	*/
	int
	zfs_prop_get_numeric(zfs_handle_t zhp, zfs_prop_t prop, uint64_t value,
	zprop_source_t src, char statbuf, size_t statlen)
	{
	char *source;

	/*
	* Check to see if this property applies to our object
	*/
	if (!zfs_prop_valid_for_type(prop, zhp->zfs_type, B_FALSE)) {
	return (zfs_error_fmt(zhp->zfs_hdl, EZFS_PROPTYPE,
	dgettext(TEXT_DOMAIN, "cannot get property '%s'"),
	zfs_prop_to_name(prop)));
	}

	if (src)
	*src = ZPROP_SRC_NONE;

	if (get_numeric_property(zhp, prop, src, &source, value) != 0)
	return (-1);

	get_source(zhp, src, source, statbuf, statlen);

	return (0);
	}

	#ifdef HAVE_IDMAP
	static int
	idmap_id_to_numeric_domain_rid(uid_t id, boolean_t isuser,
	char *domainp, idmap_rid_t ridp)
	{
	idmap_get_handle_t *get_hdl = NULL;
	idmap_stat status;
	int err = EINVAL;

	if (idmap_get_create(&get_hdl) != IDMAP_SUCCESS)
	goto out;

	if (isuser) {
	err = idmap_get_sidbyuid(get_hdl, id,
	IDMAP_REQ_FLG_USE_CACHE, domainp, ridp, &status);
	} else {
	err = idmap_get_sidbygid(get_hdl, id,
	IDMAP_REQ_FLG_USE_CACHE, domainp, ridp, &status);
	}
	if (err == IDMAP_SUCCESS &&
	idmap_get_mappings(get_hdl) == IDMAP_SUCCESS &&
	status == IDMAP_SUCCESS)
	err = 0;
	else
	err = EINVAL;
	out:
	if (get_hdl)
	idmap_get_destroy(get_hdl);
	return (err);
	}
	#endif /* HAVE_IDMAP */

	/*
	* convert the propname into parameters needed by kernel
	* Eg: userquota@ahrens -> ZFS_PROP_USERQUOTA, "", 126829
	* Eg: userused@matt@domain -> ZFS_PROP_USERUSED, "S-1-123-456", 789
	* Eg: groupquota@staff -> ZFS_PROP_GROUPQUOTA, "", 1234
	* Eg: groupused@staff -> ZFS_PROP_GROUPUSED, "", 1234
	* Eg: projectquota@123 -> ZFS_PROP_PROJECTQUOTA, "", 123
	* Eg: projectused@789 -> ZFS_PROP_PROJECTUSED, "", 789
	*/
	static int
	userquota_propname_decode(const char *propname, boolean_t zoned,
	zfs_userquota_prop_t typep, char domain, int domainlen, uint64_t *ridp)
	{
	zfs_userquota_prop_t type;
	char *cp;
	boolean_t isuser;
	boolean_t isgroup;
	boolean_t isproject;
	struct passwd *pw;
	struct group *gr;

	domain[0] = '\0';

	/* Figure out the property type ({user\|group\|project}{quota\|space}) */
	for (type = 0; type < ZFS_NUM_USERQUOTA_PROPS; type++) {
	if (strncmp(propname, zfs_userquota_prop_prefixes[type],
	strlen(zfs_userquota_prop_prefixes[type])) == 0)
	break;
	}
	if (type == ZFS_NUM_USERQUOTA_PROPS)
	return (EINVAL);
	*typep = type;

	isuser = (type == ZFS_PROP_USERQUOTA \|\| type == ZFS_PROP_USERUSED \|\|
	type == ZFS_PROP_USEROBJQUOTA \|\|
	type == ZFS_PROP_USEROBJUSED);
	isgroup = (type == ZFS_PROP_GROUPQUOTA \|\| type == ZFS_PROP_GROUPUSED \|\|
	type == ZFS_PROP_GROUPOBJQUOTA \|\|
	type == ZFS_PROP_GROUPOBJUSED);
	isproject = (type == ZFS_PROP_PROJECTQUOTA \|\|
	type == ZFS_PROP_PROJECTUSED \|\| type == ZFS_PROP_PROJECTOBJQUOTA \|\|
	type == ZFS_PROP_PROJECTOBJUSED);

	cp = strchr(propname, '@') + 1;

	if (isuser && (pw = getpwnam(cp)) != NULL) {
	if (zoned && getzoneid() == GLOBAL_ZONEID)
	return (ENOENT);
	*ridp = pw->pw_uid;
	} else if (isgroup && (gr = getgrnam(cp)) != NULL) {
	if (zoned && getzoneid() == GLOBAL_ZONEID)
	return (ENOENT);
	*ridp = gr->gr_gid;
	} else if (!isproject && strchr(cp, '@')) {
	#ifdef HAVE_IDMAP
	/*
	* It's a SID name (eg "user@domain") that needs to be
	* turned into S-1-domainID-RID.
	*/
	directory_error_t e;
	char *numericsid = NULL;
	char *end;

	if (zoned && getzoneid() == GLOBAL_ZONEID)
	return (ENOENT);
	if (isuser) {
	e = directory_sid_from_user_name(NULL,
	cp, &numericsid);
	} else {
	e = directory_sid_from_group_name(NULL,
	cp, &numericsid);
	}
	if (e != NULL) {
	directory_error_free(e);
	return (ENOENT);
	}
	if (numericsid == NULL)
	return (ENOENT);
	cp = numericsid;
	(void) strlcpy(domain, cp, domainlen);
	cp = strrchr(domain, '-');
	*cp = '\0';
	cp++;

	errno = 0;
	*ridp = strtoull(cp, &end, 10);
	free(numericsid);

	if (errno != 0 \|\| *end != '\0')
	return (EINVAL);
	#else
	return (ENOSYS);
	#endif /* HAVE_IDMAP */
	} else {
	/* It's a user/group/project ID (eg "12345"). */
	uid_t id;
	char *end;
	id = strtoul(cp, &end, 10);
	if (*end != '\0')
	return (EINVAL);
	if (id > MAXUID && !isproject) {
	#ifdef HAVE_IDMAP
	/* It's an ephemeral ID. */
	idmap_rid_t rid;
	char *mapdomain;

	if (idmap_id_to_numeric_domain_rid(id, isuser,
	&mapdomain, &rid) != 0)
	return (ENOENT);
	(void) strlcpy(domain, mapdomain, domainlen);
	*ridp = rid;
	#else
	return (ENOSYS);
	#endif /* HAVE_IDMAP */
	} else {
	*ridp = id;
	}
	}

	return (0);
	}

	static int
	zfs_prop_get_userquota_common(zfs_handle_t zhp, const char propname,
	uint64_t propvalue, zfs_userquota_prop_t typep)
	{
	int err;
	zfs_cmd_t zc = {"\0"};

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));

	err = userquota_propname_decode(propname,
	zfs_prop_get_int(zhp, ZFS_PROP_ZONED),
	typep, zc.zc_value, sizeof (zc.zc_value), &zc.zc_guid);
	zc.zc_objset_type = *typep;
	if (err)
	return (err);

	err = zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_USERSPACE_ONE, &zc);
	if (err)
	return (err);

	*propvalue = zc.zc_cookie;
	return (0);
	}

	int
	zfs_prop_get_userquota_int(zfs_handle_t zhp, const char propname,
	uint64_t *propvalue)
	{
	zfs_userquota_prop_t type;

	return (zfs_prop_get_userquota_common(zhp, propname, propvalue,
	&type));
	}

	int
	zfs_prop_get_userquota(zfs_handle_t zhp, const char propname,
	char *propbuf, int proplen, boolean_t literal)
	{
	int err;
	uint64_t propvalue;
	zfs_userquota_prop_t type;

	err = zfs_prop_get_userquota_common(zhp, propname, &propvalue,
	&type);

	if (err)
	return (err);

	if (literal) {
	(void) snprintf(propbuf, proplen, "%llu",
	(u_longlong_t)propvalue);
	} else if (propvalue == 0 &&
	(type == ZFS_PROP_USERQUOTA \|\| type == ZFS_PROP_GROUPQUOTA \|\|
	type == ZFS_PROP_USEROBJQUOTA \|\| type == ZFS_PROP_GROUPOBJQUOTA \|\|
	type == ZFS_PROP_PROJECTQUOTA \|\|
	type == ZFS_PROP_PROJECTOBJQUOTA)) {
	(void) strlcpy(propbuf, "none", proplen);
	} else if (type == ZFS_PROP_USERQUOTA \|\| type == ZFS_PROP_GROUPQUOTA \|\|
	type == ZFS_PROP_USERUSED \|\| type == ZFS_PROP_GROUPUSED \|\|
	type == ZFS_PROP_PROJECTUSED \|\| type == ZFS_PROP_PROJECTQUOTA) {
	zfs_nicebytes(propvalue, propbuf, proplen);
	} else {
	zfs_nicenum(propvalue, propbuf, proplen);
	}
	return (0);
	}

	/*
	* propname must start with "written@" or "written#".
	*/
	int
	zfs_prop_get_written_int(zfs_handle_t zhp, const char propname,
	uint64_t *propvalue)
	{
	int err;
	zfs_cmd_t zc = {"\0"};
	const char *snapname;

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));

	assert(zfs_prop_written(propname));
	snapname = propname + strlen("written@");
	if (strchr(snapname, '@') != NULL \|\| strchr(snapname, '#') != NULL) {
	/* full snapshot or bookmark name specified */
	(void) strlcpy(zc.zc_value, snapname, sizeof (zc.zc_value));
	} else {
	/* snapname is the short name, append it to zhp's fsname */
	char *cp;

	(void) strlcpy(zc.zc_value, zhp->zfs_name,
	sizeof (zc.zc_value));
	cp = strchr(zc.zc_value, '@');
	if (cp != NULL)
	*cp = '\0';
	(void) strlcat(zc.zc_value, snapname - 1, sizeof (zc.zc_value));
	}

	err = zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SPACE_WRITTEN, &zc);
	if (err)
	return (err);

	*propvalue = zc.zc_cookie;
	return (0);
	}

	int
	zfs_prop_get_written(zfs_handle_t zhp, const char propname,
	char *propbuf, int proplen, boolean_t literal)
	{
	int err;
	uint64_t propvalue;

	err = zfs_prop_get_written_int(zhp, propname, &propvalue);

	if (err)
	return (err);

	if (literal) {
	(void) snprintf(propbuf, proplen, "%llu",
	(u_longlong_t)propvalue);
	} else {
	zfs_nicebytes(propvalue, propbuf, proplen);
	}

	return (0);
	}

	/*
	* Returns the name of the given zfs handle.
	*/
	const char *
	zfs_get_name(const zfs_handle_t *zhp)
	{
	return (zhp->zfs_name);
	}

	/*
	* Returns the name of the parent pool for the given zfs handle.
	*/
	const char *
	zfs_get_pool_name(const zfs_handle_t *zhp)
	{
	return (zhp->zpool_hdl->zpool_name);
	}

	/*
	* Returns the type of the given zfs handle.
	*/
	zfs_type_t
	zfs_get_type(const zfs_handle_t *zhp)
	{
	return (zhp->zfs_type);
	}

	/*
	* Is one dataset name a child dataset of another?
	*
	* Needs to handle these cases:
	* Dataset 1 "a/foo" "a/foo" "a/foo" "a/foo"
	* Dataset 2 "a/fo" "a/foobar" "a/bar/baz" "a/foo/bar"
	* Descendant? No. No. No. Yes.
	*/
	static boolean_t
	is_descendant(const char ds1, const char ds2)
	{
	size_t d1len = strlen(ds1);

	/* ds2 can't be a descendant if it's smaller */
	if (strlen(ds2) < d1len)
	return (B_FALSE);

	/* otherwise, compare strings and verify that there's a '/' char */
	return (ds2[d1len] == '/' && (strncmp(ds1, ds2, d1len) == 0));
	}

	/*
	* Given a complete name, return just the portion that refers to the parent.
	* Will return -1 if there is no parent (path is just the name of the
	* pool).
	*/
	static int
	parent_name(const char path, char buf, size_t buflen)
	{
	char *slashp;

	(void) strlcpy(buf, path, buflen);

	if ((slashp = strrchr(buf, '/')) == NULL)
	return (-1);
	*slashp = '\0';

	return (0);
	}

	int
	zfs_parent_name(zfs_handle_t zhp, char buf, size_t buflen)
	{
	return (parent_name(zfs_get_name(zhp), buf, buflen));
	}

	/*
	* If accept_ancestor is false, then check to make sure that the given path has
	* a parent, and that it exists. If accept_ancestor is true, then find the
	* closest existing ancestor for the given path. In prefixlen return the
	* length of already existing prefix of the given path. We also fetch the
	* 'zoned' property, which is used to validate property settings when creating
	* new datasets.
	*/
	static int
	check_parents(libzfs_handle_t hdl, const char path, uint64_t *zoned,
	boolean_t accept_ancestor, int *prefixlen)
	{
	zfs_cmd_t zc = {"\0"};
	char parent[ZFS_MAX_DATASET_NAME_LEN];
	char *slash;
	zfs_handle_t *zhp;
	char errbuf[1024];
	uint64_t is_zoned;

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot create '%s'"), path);

	/* get parent, and check to see if this is just a pool */
	if (parent_name(path, parent, sizeof (parent)) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"missing dataset name"));
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
	}

	/* check to see if the pool exists */
	if ((slash = strchr(parent, '/')) == NULL)
	slash = parent + strlen(parent);
	(void) strncpy(zc.zc_name, parent, slash - parent);
	zc.zc_name[slash - parent] = '\0';
	if (zfs_ioctl(hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0 &&
	errno == ENOENT) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"no such pool '%s'"), zc.zc_name);
	return (zfs_error(hdl, EZFS_NOENT, errbuf));
	}

	/* check to see if the parent dataset exists */
	while ((zhp = make_dataset_handle(hdl, parent)) == NULL) {
	if (errno == ENOENT && accept_ancestor) {
	/*
	* Go deeper to find an ancestor, give up on top level.
	*/
	if (parent_name(parent, parent, sizeof (parent)) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"no such pool '%s'"), zc.zc_name);
	return (zfs_error(hdl, EZFS_NOENT, errbuf));
	}
	} else if (errno == ENOENT) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"parent does not exist"));
	return (zfs_error(hdl, EZFS_NOENT, errbuf));
	} else
	return (zfs_standard_error(hdl, errno, errbuf));
	}

	is_zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);
	if (zoned != NULL)
	*zoned = is_zoned;

	/* we are in a non-global zone, but parent is in the global zone */
	if (getzoneid() != GLOBAL_ZONEID && !is_zoned) {
	(void) zfs_standard_error(hdl, EPERM, errbuf);
	zfs_close(zhp);
	return (-1);
	}

	/* make sure parent is a filesystem */
	if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"parent is not a filesystem"));
	(void) zfs_error(hdl, EZFS_BADTYPE, errbuf);
	zfs_close(zhp);
	return (-1);
	}

	zfs_close(zhp);
	if (prefixlen != NULL)
	*prefixlen = strlen(parent);
	return (0);
	}

	/*
	* Finds whether the dataset of the given type(s) exists.
	*/
	boolean_t
	zfs_dataset_exists(libzfs_handle_t hdl, const char path, zfs_type_t types)
	{
	zfs_handle_t *zhp;

	if (!zfs_validate_name(hdl, path, types, B_FALSE))
	return (B_FALSE);

	/*
	* Try to get stats for the dataset, which will tell us if it exists.
	*/
	if ((zhp = make_dataset_handle(hdl, path)) != NULL) {
	int ds_type = zhp->zfs_type;

	zfs_close(zhp);
	if (types & ds_type)
	return (B_TRUE);
	}
	return (B_FALSE);
	}

	/*
	* Given a path to 'target', create all the ancestors between
	* the prefixlen portion of the path, and the target itself.
	* Fail if the initial prefixlen-ancestor does not already exist.
	*/
	int
	create_parents(libzfs_handle_t hdl, char target, int prefixlen)
	{
	zfs_handle_t *h;
	char *cp;
	const char *opname;

	/* make sure prefix exists */
	cp = target + prefixlen;
	if (*cp != '/') {
	assert(strchr(cp, '/') == NULL);
	h = zfs_open(hdl, target, ZFS_TYPE_FILESYSTEM);
	} else {
	*cp = '\0';
	h = zfs_open(hdl, target, ZFS_TYPE_FILESYSTEM);
	*cp = '/';
	}
	if (h == NULL)
	return (-1);
	zfs_close(h);

	/*
	* Attempt to create, mount, and share any ancestor filesystems,
	* up to the prefixlen-long one.
	*/
	for (cp = target + prefixlen + 1;
	(cp = strchr(cp, '/')) != NULL; *cp = '/', cp++) {

	*cp = '\0';

	h = make_dataset_handle(hdl, target);
	if (h) {
	/* it already exists, nothing to do here */
	zfs_close(h);
	continue;
	}

	if (zfs_create(hdl, target, ZFS_TYPE_FILESYSTEM,
	NULL) != 0) {
	opname = dgettext(TEXT_DOMAIN, "create");
	goto ancestorerr;
	}

	h = zfs_open(hdl, target, ZFS_TYPE_FILESYSTEM);
	if (h == NULL) {
	opname = dgettext(TEXT_DOMAIN, "open");
	goto ancestorerr;
	}

	if (zfs_mount(h, NULL, 0) != 0) {
	opname = dgettext(TEXT_DOMAIN, "mount");
	goto ancestorerr;
	}

	if (zfs_share(h) != 0) {
	opname = dgettext(TEXT_DOMAIN, "share");
	goto ancestorerr;
	}

	zfs_close(h);
	}
	zfs_commit_all_shares();

	return (0);

	ancestorerr:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"failed to %s ancestor '%s'"), opname, target);
	return (-1);
	}

	/*
	* Creates non-existing ancestors of the given path.
	*/
	int
	zfs_create_ancestors(libzfs_handle_t hdl, const char path)
	{
	int prefix;
	char *path_copy;
	char errbuf[1024];
	int rc = 0;

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot create '%s'"), path);

	/*
	* Check that we are not passing the nesting limit
	* before we start creating any ancestors.
	*/
	if (dataset_nestcheck(path) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"maximum name nesting depth exceeded"));
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
	}

	if (check_parents(hdl, path, NULL, B_TRUE, &prefix) != 0)
	return (-1);

	if ((path_copy = strdup(path)) != NULL) {
	rc = create_parents(hdl, path_copy, prefix);
	free(path_copy);
	}
	if (path_copy == NULL \|\| rc != 0)
	return (-1);

	return (0);
	}

	/*
	* Create a new filesystem or volume.
	*/
	int
	zfs_create(libzfs_handle_t hdl, const char path, zfs_type_t type,
	nvlist_t *props)
	{
	int ret;
	uint64_t size = 0;
	uint64_t blocksize = zfs_prop_default_numeric(ZFS_PROP_VOLBLOCKSIZE);
	uint64_t zoned;
	enum lzc_dataset_type ost;
	zpool_handle_t *zpool_handle;
	uint8_t *wkeydata = NULL;
	uint_t wkeylen = 0;
	char errbuf[1024];
	char parent[ZFS_MAX_DATASET_NAME_LEN];

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot create '%s'"), path);

	/* validate the path, taking care to note the extended error message */
	if (!zfs_validate_name(hdl, path, type, B_TRUE))
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));

	if (dataset_nestcheck(path) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"maximum name nesting depth exceeded"));
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
	}

	/* validate parents exist */
	if (check_parents(hdl, path, &zoned, B_FALSE, NULL) != 0)
	return (-1);

	/*
	* The failure modes when creating a dataset of a different type over
	* one that already exists is a little strange. In particular, if you
	* try to create a dataset on top of an existing dataset, the ioctl()
	* will return ENOENT, not EEXIST. To prevent this from happening, we
	* first try to see if the dataset exists.
	*/
	if (zfs_dataset_exists(hdl, path, ZFS_TYPE_DATASET)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset already exists"));
	return (zfs_error(hdl, EZFS_EXISTS, errbuf));
	}

	if (type == ZFS_TYPE_VOLUME)
	ost = LZC_DATSET_TYPE_ZVOL;
	else
	ost = LZC_DATSET_TYPE_ZFS;

	/* open zpool handle for prop validation */
	char pool_path[ZFS_MAX_DATASET_NAME_LEN];
	(void) strlcpy(pool_path, path, sizeof (pool_path));

	/* truncate pool_path at first slash */
	char *p = strchr(pool_path, '/');
	if (p != NULL)
	*p = '\0';

	if ((zpool_handle = zpool_open(hdl, pool_path)) == NULL)
	return (-1);

	if (props && (props = zfs_valid_proplist(hdl, type, props,
	zoned, NULL, zpool_handle, B_TRUE, errbuf)) == 0) {
	zpool_close(zpool_handle);
	return (-1);
	}
	zpool_close(zpool_handle);

	if (type == ZFS_TYPE_VOLUME) {
	/*
	* If we are creating a volume, the size and block size must
	* satisfy a few restraints. First, the blocksize must be a
	* valid block size between SPA_{MIN,MAX}BLOCKSIZE. Second, the
	* volsize must be a multiple of the block size, and cannot be
	* zero.
	*/
	if (props == NULL \|\| nvlist_lookup_uint64(props,
	zfs_prop_to_name(ZFS_PROP_VOLSIZE), &size) != 0) {
	nvlist_free(props);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"missing volume size"));
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}

	if ((ret = nvlist_lookup_uint64(props,
	zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
	&blocksize)) != 0) {
	if (ret == ENOENT) {
	blocksize = zfs_prop_default_numeric(
	ZFS_PROP_VOLBLOCKSIZE);
	} else {
	nvlist_free(props);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"missing volume block size"));
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}
	}

	if (size == 0) {
	nvlist_free(props);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"volume size cannot be zero"));
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}

	if (size % blocksize != 0) {
	nvlist_free(props);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"volume size must be a multiple of volume block "
	"size"));
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}
	}

	(void) parent_name(path, parent, sizeof (parent));
	if (zfs_crypto_create(hdl, parent, props, NULL, B_TRUE,
	&wkeydata, &wkeylen) != 0) {
	nvlist_free(props);
	return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
	}

	/* create the dataset */
	ret = lzc_create(path, ost, props, wkeydata, wkeylen);
	nvlist_free(props);
	if (wkeydata != NULL)
	free(wkeydata);

	/* check for failure */
	if (ret != 0) {
	switch (errno) {
	case ENOENT:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"no such parent '%s'"), parent);
	return (zfs_error(hdl, EZFS_NOENT, errbuf));

	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded to set this "
	"property or value"));
	return (zfs_error(hdl, EZFS_BADVERSION, errbuf));

	case EACCES:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"encryption root's key is not loaded "
	"or provided"));
	return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));

	case ERANGE:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid property value(s) specified"));
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	#ifdef _ILP32
	case EOVERFLOW:
	/*
	* This platform can't address a volume this big.
	*/
	if (type == ZFS_TYPE_VOLUME)
	return (zfs_error(hdl, EZFS_VOLTOOBIG,
	errbuf));
	#endif
	/* FALLTHROUGH */
	default:
	return (zfs_standard_error(hdl, errno, errbuf));
	}
	}

	return (0);
	}

	/*
	* Destroys the given dataset. The caller must make sure that the filesystem
	* isn't mounted, and that there are no active dependents. If the file system
	* does not exist this function does nothing.
	*/
	int
	zfs_destroy(zfs_handle_t *zhp, boolean_t defer)
	{
	int error;

	if (zhp->zfs_type != ZFS_TYPE_SNAPSHOT && defer)
	return (EINVAL);

	if (zhp->zfs_type == ZFS_TYPE_BOOKMARK) {
	nvlist_t *nv = fnvlist_alloc();
	fnvlist_add_boolean(nv, zhp->zfs_name);
	error = lzc_destroy_bookmarks(nv, NULL);
	fnvlist_free(nv);
	if (error != 0) {
	return (zfs_standard_error_fmt(zhp->zfs_hdl, error,
	dgettext(TEXT_DOMAIN, "cannot destroy '%s'"),
	zhp->zfs_name));
	}
	return (0);
	}

	if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT) {
	nvlist_t *nv = fnvlist_alloc();
	fnvlist_add_boolean(nv, zhp->zfs_name);
	error = lzc_destroy_snaps(nv, defer, NULL);
	fnvlist_free(nv);
	} else {
	error = lzc_destroy(zhp->zfs_name);
	}

	if (error != 0 && error != ENOENT) {
	return (zfs_standard_error_fmt(zhp->zfs_hdl, errno,
	dgettext(TEXT_DOMAIN, "cannot destroy '%s'"),
	zhp->zfs_name));
	}

	remove_mountpoint(zhp);

	return (0);
	}

	struct destroydata {
	nvlist_t *nvl;
	const char *snapname;
	};

	static int
	zfs_check_snap_cb(zfs_handle_t zhp, void arg)
	{
	struct destroydata *dd = arg;
	char name[ZFS_MAX_DATASET_NAME_LEN];
	int rv = 0;

	if (snprintf(name, sizeof (name), "%s@%s", zhp->zfs_name,
	dd->snapname) >= sizeof (name))
	return (EINVAL);

	if (lzc_exists(name))
	verify(nvlist_add_boolean(dd->nvl, name) == 0);

	rv = zfs_iter_filesystems(zhp, zfs_check_snap_cb, dd);
	zfs_close(zhp);
	return (rv);
	}

	/*
	* Destroys all snapshots with the given name in zhp & descendants.
	*/
	int
	zfs_destroy_snaps(zfs_handle_t zhp, char snapname, boolean_t defer)
	{
	int ret;
	struct destroydata dd = { 0 };

	dd.snapname = snapname;
	verify(nvlist_alloc(&dd.nvl, NV_UNIQUE_NAME, 0) == 0);
	(void) zfs_check_snap_cb(zfs_handle_dup(zhp), &dd);

	if (nvlist_empty(dd.nvl)) {
	ret = zfs_standard_error_fmt(zhp->zfs_hdl, ENOENT,
	dgettext(TEXT_DOMAIN, "cannot destroy '%s@%s'"),
	zhp->zfs_name, snapname);
	} else {
	ret = zfs_destroy_snaps_nvl(zhp->zfs_hdl, dd.nvl, defer);
	}
	nvlist_free(dd.nvl);
	return (ret);
	}

	/*
	* Destroys all the snapshots named in the nvlist.
	*/
	int
	zfs_destroy_snaps_nvl(libzfs_handle_t hdl, nvlist_t snaps, boolean_t defer)
	{
	int ret;
	nvlist_t *errlist = NULL;
	nvpair_t *pair;

	ret = lzc_destroy_snaps(snaps, defer, &errlist);

	if (ret == 0) {
	nvlist_free(errlist);
	return (0);
	}

	if (nvlist_empty(errlist)) {
	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot destroy snapshots"));

	ret = zfs_standard_error(hdl, ret, errbuf);
	}
	for (pair = nvlist_next_nvpair(errlist, NULL);
	pair != NULL; pair = nvlist_next_nvpair(errlist, pair)) {
	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot destroy snapshot %s"),
	nvpair_name(pair));

	switch (fnvpair_value_int32(pair)) {
	case EEXIST:
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "snapshot is cloned"));
	ret = zfs_error(hdl, EZFS_EXISTS, errbuf);
	break;
	default:
	ret = zfs_standard_error(hdl, errno, errbuf);
	break;
	}
	}

	nvlist_free(errlist);
	return (ret);
	}

	/*
	* Clones the given dataset. The target must be of the same type as the source.
	*/
	int
	zfs_clone(zfs_handle_t zhp, const char target, nvlist_t *props)
	{
	char parent[ZFS_MAX_DATASET_NAME_LEN];
	int ret;
	char errbuf[1024];
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	uint64_t zoned;

	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot create '%s'"), target);

	/* validate the target/clone name */
	if (!zfs_validate_name(hdl, target, ZFS_TYPE_FILESYSTEM, B_TRUE))
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));

	/* validate parents exist */
	if (check_parents(hdl, target, &zoned, B_FALSE, NULL) != 0)
	return (-1);

	(void) parent_name(target, parent, sizeof (parent));

	/* do the clone */

	if (props) {
	zfs_type_t type;

	if (ZFS_IS_VOLUME(zhp)) {
	type = ZFS_TYPE_VOLUME;
	} else {
	type = ZFS_TYPE_FILESYSTEM;
	}
	if ((props = zfs_valid_proplist(hdl, type, props, zoned,
	zhp, zhp->zpool_hdl, B_TRUE, errbuf)) == NULL)
	return (-1);
	if (zfs_fix_auto_resv(zhp, props) == -1) {
	nvlist_free(props);
	return (-1);
	}
	}

	if (zfs_crypto_clone_check(hdl, zhp, parent, props) != 0) {
	nvlist_free(props);
	return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
	}

	ret = lzc_clone(target, zhp->zfs_name, props);
	nvlist_free(props);

	if (ret != 0) {
	switch (errno) {

	case ENOENT:
	/*
	* The parent doesn't exist. We should have caught this
	* above, but there may a race condition that has since
	* destroyed the parent.
	*
	* At this point, we don't know whether it's the source
	* that doesn't exist anymore, or whether the target
	* dataset doesn't exist.
	*/
	zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
	"no such parent '%s'"), parent);
	return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));

	case EXDEV:
	zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
	"source and target pools differ"));
	return (zfs_error(zhp->zfs_hdl, EZFS_CROSSTARGET,
	errbuf));

	default:
	return (zfs_standard_error(zhp->zfs_hdl, errno,
	errbuf));
	}
	}

	return (ret);
	}

	/*
	* Promotes the given clone fs to be the clone parent.
	*/
	int
	zfs_promote(zfs_handle_t *zhp)
	{
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	char snapname[ZFS_MAX_DATASET_NAME_LEN];
	int ret;
	char errbuf[1024];

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot promote '%s'"), zhp->zfs_name);

	if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"snapshots can not be promoted"));
	return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
	}

	if (zhp->zfs_dmustats.dds_origin[0] == '\0') {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"not a cloned filesystem"));
	return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
	}

	if (!zfs_validate_name(hdl, zhp->zfs_name, zhp->zfs_type, B_TRUE))
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));

	ret = lzc_promote(zhp->zfs_name, snapname, sizeof (snapname));

	if (ret != 0) {
	switch (ret) {
	case EACCES:
	/*
	* Promoting encrypted dataset outside its
	* encryption root.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot promote dataset outside its "
	"encryption root"));
	return (zfs_error(hdl, EZFS_EXISTS, errbuf));

	case EEXIST:
	/* There is a conflicting snapshot name. */
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"conflicting snapshot '%s' from parent '%s'"),
	snapname, zhp->zfs_dmustats.dds_origin);
	return (zfs_error(hdl, EZFS_EXISTS, errbuf));

	default:
	return (zfs_standard_error(hdl, ret, errbuf));
	}
	}
	return (ret);
	}

	typedef struct snapdata {
	nvlist_t *sd_nvl;
	const char *sd_snapname;
	} snapdata_t;

	static int
	zfs_snapshot_cb(zfs_handle_t zhp, void arg)
	{
	snapdata_t *sd = arg;
	char name[ZFS_MAX_DATASET_NAME_LEN];
	int rv = 0;

	if (zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT) == 0) {
	if (snprintf(name, sizeof (name), "%s@%s", zfs_get_name(zhp),
	sd->sd_snapname) >= sizeof (name))
	return (EINVAL);

	fnvlist_add_boolean(sd->sd_nvl, name);

	rv = zfs_iter_filesystems(zhp, zfs_snapshot_cb, sd);
	}
	zfs_close(zhp);

	return (rv);
	}

	/*
	* Creates snapshots. The keys in the snaps nvlist are the snapshots to be
	* created.
	*/
	int
	zfs_snapshot_nvl(libzfs_handle_t hdl, nvlist_t snaps, nvlist_t *props)
	{
	int ret;
	char errbuf[1024];
	nvpair_t *elem;
	nvlist_t *errors;
	zpool_handle_t *zpool_hdl;
	char pool[ZFS_MAX_DATASET_NAME_LEN];

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot create snapshots "));

	elem = NULL;
	while ((elem = nvlist_next_nvpair(snaps, elem)) != NULL) {
	const char *snapname = nvpair_name(elem);

	/* validate the target name */
	if (!zfs_validate_name(hdl, snapname, ZFS_TYPE_SNAPSHOT,
	B_TRUE)) {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot create snapshot '%s'"), snapname);
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
	}
	}

	/*
	* get pool handle for prop validation. assumes all snaps are in the
	* same pool, as does lzc_snapshot (below).
	*/
	elem = nvlist_next_nvpair(snaps, NULL);
	(void) strlcpy(pool, nvpair_name(elem), sizeof (pool));
	pool[strcspn(pool, "/@")] = '\0';
	zpool_hdl = zpool_open(hdl, pool);
	if (zpool_hdl == NULL)
	return (-1);

	if (props != NULL &&
	(props = zfs_valid_proplist(hdl, ZFS_TYPE_SNAPSHOT,
	props, B_FALSE, NULL, zpool_hdl, B_FALSE, errbuf)) == NULL) {
	zpool_close(zpool_hdl);
	return (-1);
	}
	zpool_close(zpool_hdl);

	ret = lzc_snapshot(snaps, props, &errors);

	if (ret != 0) {
	boolean_t printed = B_FALSE;
	for (elem = nvlist_next_nvpair(errors, NULL);
	elem != NULL;
	elem = nvlist_next_nvpair(errors, elem)) {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot create snapshot '%s'"), nvpair_name(elem));
	(void) zfs_standard_error(hdl,
	fnvpair_value_int32(elem), errbuf);
	printed = B_TRUE;
	}
	if (!printed) {
	switch (ret) {
	case EXDEV:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"multiple snapshots of same "
	"fs not allowed"));
	(void) zfs_error(hdl, EZFS_EXISTS, errbuf);

	break;
	default:
	(void) zfs_standard_error(hdl, ret, errbuf);
	}
	}
	}

	nvlist_free(props);
	nvlist_free(errors);
	return (ret);
	}

	int
	zfs_snapshot(libzfs_handle_t hdl, const char path, boolean_t recursive,
	nvlist_t *props)
	{
	int ret;
	snapdata_t sd = { 0 };
	char fsname[ZFS_MAX_DATASET_NAME_LEN];
	char *cp;
	zfs_handle_t *zhp;
	char errbuf[1024];

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot snapshot %s"), path);

	if (!zfs_validate_name(hdl, path, ZFS_TYPE_SNAPSHOT, B_TRUE))
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));

	(void) strlcpy(fsname, path, sizeof (fsname));
	cp = strchr(fsname, '@');
	*cp = '\0';
	sd.sd_snapname = cp + 1;

	if ((zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM \|
	ZFS_TYPE_VOLUME)) == NULL) {
	return (-1);
	}

	verify(nvlist_alloc(&sd.sd_nvl, NV_UNIQUE_NAME, 0) == 0);
	if (recursive) {
	(void) zfs_snapshot_cb(zfs_handle_dup(zhp), &sd);
	} else {
	fnvlist_add_boolean(sd.sd_nvl, path);
	}

	ret = zfs_snapshot_nvl(hdl, sd.sd_nvl, props);
	nvlist_free(sd.sd_nvl);
	zfs_close(zhp);
	return (ret);
	}

	/*
	* Destroy any more recent snapshots. We invoke this callback on any dependents
	* of the snapshot first. If the 'cb_dependent' member is non-zero, then this
	* is a dependent and we should just destroy it without checking the transaction
	* group.
	*/
	typedef struct rollback_data {
	const char cb_target; / the snapshot */
	uint64_t cb_create; /* creation time reference */
	boolean_t cb_error;
	boolean_t cb_force;
	} rollback_data_t;

	static int
	rollback_destroy_dependent(zfs_handle_t zhp, void data)
	{
	rollback_data_t *cbp = data;
	prop_changelist_t *clp;

	/* We must destroy this clone; first unmount it */
	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
	cbp->cb_force ? MS_FORCE: 0);
	if (clp == NULL \|\| changelist_prefix(clp) != 0) {
	cbp->cb_error = B_TRUE;
	zfs_close(zhp);
	return (0);
	}
	if (zfs_destroy(zhp, B_FALSE) != 0)
	cbp->cb_error = B_TRUE;
	else
	changelist_remove(clp, zhp->zfs_name);
	(void) changelist_postfix(clp);
	changelist_free(clp);

	zfs_close(zhp);
	return (0);
	}

	static int
	rollback_destroy(zfs_handle_t zhp, void data)
	{
	rollback_data_t *cbp = data;

	if (zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG) > cbp->cb_create) {
	cbp->cb_error \|= zfs_iter_dependents(zhp, B_FALSE,
	rollback_destroy_dependent, cbp);

	cbp->cb_error \|= zfs_destroy(zhp, B_FALSE);
	}

	zfs_close(zhp);
	return (0);
	}

	/*
	* Given a dataset, rollback to a specific snapshot, discarding any
	* data changes since then and making it the active dataset.
	*
	* Any snapshots and bookmarks more recent than the target are
	* destroyed, along with their dependents (i.e. clones).
	*/
	int
	zfs_rollback(zfs_handle_t zhp, zfs_handle_t snap, boolean_t force)
	{
	rollback_data_t cb = { 0 };
	int err;
	boolean_t restore_resv = 0;
	uint64_t old_volsize = 0, new_volsize;
	zfs_prop_t resv_prop = { 0 };
	uint64_t min_txg = 0;

	assert(zhp->zfs_type == ZFS_TYPE_FILESYSTEM \|\|
	zhp->zfs_type == ZFS_TYPE_VOLUME);

	/*
	* Destroy all recent snapshots and their dependents.
	*/
	cb.cb_force = force;
	cb.cb_target = snap->zfs_name;
	cb.cb_create = zfs_prop_get_int(snap, ZFS_PROP_CREATETXG);

	if (cb.cb_create > 0)
	min_txg = cb.cb_create;

	(void) zfs_iter_snapshots(zhp, B_FALSE, rollback_destroy, &cb,
	min_txg, 0);

	(void) zfs_iter_bookmarks(zhp, rollback_destroy, &cb);

	if (cb.cb_error)
	return (-1);

	/*
	* Now that we have verified that the snapshot is the latest,
	* rollback to the given snapshot.
	*/

	if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
	if (zfs_which_resv_prop(zhp, &resv_prop) < 0)
	return (-1);
	old_volsize = zfs_prop_get_int(zhp, ZFS_PROP_VOLSIZE);
	restore_resv =
	(old_volsize == zfs_prop_get_int(zhp, resv_prop));
	}

	/*
	* Pass both the filesystem and the wanted snapshot names,
	* we would get an error back if the snapshot is destroyed or
	* a new snapshot is created before this request is processed.
	*/
	err = lzc_rollback_to(zhp->zfs_name, snap->zfs_name);
	if (err != 0) {
	char errbuf[1024];

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot rollback '%s'"),
	zhp->zfs_name);
	switch (err) {
	case EEXIST:
	zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
	"there is a snapshot or bookmark more recent "
	"than '%s'"), snap->zfs_name);
	(void) zfs_error(zhp->zfs_hdl, EZFS_EXISTS, errbuf);
	break;
	case ESRCH:
	zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
	"'%s' is not found among snapshots of '%s'"),
	snap->zfs_name, zhp->zfs_name);
	(void) zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf);
	break;
	case EINVAL:
	(void) zfs_error(zhp->zfs_hdl, EZFS_BADTYPE, errbuf);
	break;
	default:
	(void) zfs_standard_error(zhp->zfs_hdl, err, errbuf);
	}
	return (err);
	}

	/*
	* For volumes, if the pre-rollback volsize matched the pre-
	* rollback reservation and the volsize has changed then set
	* the reservation property to the post-rollback volsize.
	* Make a new handle since the rollback closed the dataset.
	*/
	if ((zhp->zfs_type == ZFS_TYPE_VOLUME) &&
	(zhp = make_dataset_handle(zhp->zfs_hdl, zhp->zfs_name))) {
	if (restore_resv) {
	new_volsize = zfs_prop_get_int(zhp, ZFS_PROP_VOLSIZE);
	if (old_volsize != new_volsize)
	err = zfs_prop_set_int(zhp, resv_prop,
	new_volsize);
	}
	zfs_close(zhp);
	}
	return (err);
	}

	/*
	* Renames the given dataset.
	*/
	int
	zfs_rename(zfs_handle_t zhp, const char target, renameflags_t flags)
	{
	int ret = 0;
	zfs_cmd_t zc = {"\0"};
	char *delim;
	prop_changelist_t *cl = NULL;
	char parent[ZFS_MAX_DATASET_NAME_LEN];
	char property[ZFS_MAXPROPLEN];
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	char errbuf[1024];

	/* if we have the same exact name, just return success */
	if (strcmp(zhp->zfs_name, target) == 0)
	return (0);

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot rename to '%s'"), target);

	/* make sure source name is valid */
	if (!zfs_validate_name(hdl, zhp->zfs_name, zhp->zfs_type, B_TRUE))
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));

	/*
	* Make sure the target name is valid
	*/
	if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT) {
	if ((strchr(target, '@') == NULL) \|\|
	*target == '@') {
	/*
	* Snapshot target name is abbreviated,
	* reconstruct full dataset name
	*/
	(void) strlcpy(parent, zhp->zfs_name,
	sizeof (parent));
	delim = strchr(parent, '@');
	if (strchr(target, '@') == NULL)
	*(++delim) = '\0';
	else
	*delim = '\0';
	(void) strlcat(parent, target, sizeof (parent));
	target = parent;
	} else {
	/*
	* Make sure we're renaming within the same dataset.
	*/
	delim = strchr(target, '@');
	if (strncmp(zhp->zfs_name, target, delim - target)
	!= 0 \|\| zhp->zfs_name[delim - target] != '@') {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"snapshots must be part of same "
	"dataset"));
	return (zfs_error(hdl, EZFS_CROSSTARGET,
	errbuf));
	}
	}

	if (!zfs_validate_name(hdl, target, zhp->zfs_type, B_TRUE))
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
	} else {
	if (flags.recursive) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"recursive rename must be a snapshot"));
	return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
	}

	if (!zfs_validate_name(hdl, target, zhp->zfs_type, B_TRUE))
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));

	/* validate parents */
	if (check_parents(hdl, target, NULL, B_FALSE, NULL) != 0)
	return (-1);

	/* make sure we're in the same pool */
	verify((delim = strchr(target, '/')) != NULL);
	if (strncmp(zhp->zfs_name, target, delim - target) != 0 \|\|
	zhp->zfs_name[delim - target] != '/') {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"datasets must be within same pool"));
	return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
	}

	/* new name cannot be a child of the current dataset name */
	if (is_descendant(zhp->zfs_name, target)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"New dataset name cannot be a descendant of "
	"current dataset name"));
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
	}
	}

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot rename '%s'"), zhp->zfs_name);

	if (getzoneid() == GLOBAL_ZONEID &&
	zfs_prop_get_int(zhp, ZFS_PROP_ZONED)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset is used in a non-global zone"));
	return (zfs_error(hdl, EZFS_ZONED, errbuf));
	}

	/*
	* Avoid unmounting file systems with mountpoint property set to
	* 'legacy' or 'none' even if -u option is not given.
	*/
	if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
	!flags.recursive && !flags.nounmount &&
	zfs_prop_get(zhp, ZFS_PROP_MOUNTPOINT, property,
	sizeof (property), NULL, NULL, 0, B_FALSE) == 0 &&
	(strcmp(property, "legacy") == 0 \|\|
	strcmp(property, "none") == 0)) {
	flags.nounmount = B_TRUE;
	}
	if (flags.recursive) {
	char *parentname = zfs_strdup(zhp->zfs_hdl, zhp->zfs_name);
	if (parentname == NULL) {
	ret = -1;
	goto error;
	}
	delim = strchr(parentname, '@');
	*delim = '\0';
	zfs_handle_t *zhrp = zfs_open(zhp->zfs_hdl, parentname,
	ZFS_TYPE_DATASET);
	free(parentname);
	if (zhrp == NULL) {
	ret = -1;
	goto error;
	}
	zfs_close(zhrp);
	} else if (zhp->zfs_type != ZFS_TYPE_SNAPSHOT) {
	if ((cl = changelist_gather(zhp, ZFS_PROP_NAME,
	flags.nounmount ? CL_GATHER_DONT_UNMOUNT :
	CL_GATHER_ITER_MOUNTED,
	flags.forceunmount ? MS_FORCE : 0)) == NULL)
	return (-1);

	if (changelist_haszonedchild(cl)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"child dataset with inherited mountpoint is used "
	"in a non-global zone"));
	(void) zfs_error(hdl, EZFS_ZONED, errbuf);
	ret = -1;
	goto error;
	}

	if ((ret = changelist_prefix(cl)) != 0)
	goto error;
	}

	if (ZFS_IS_VOLUME(zhp))
	zc.zc_objset_type = DMU_OST_ZVOL;
	else
	zc.zc_objset_type = DMU_OST_ZFS;

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
	(void) strlcpy(zc.zc_value, target, sizeof (zc.zc_value));

	zc.zc_cookie = !!flags.recursive;
	zc.zc_cookie \|= (!!flags.nounmount) << 1;

	if ((ret = zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_RENAME, &zc)) != 0) {
	/*
	* if it was recursive, the one that actually failed will
	* be in zc.zc_name
	*/
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot rename '%s'"), zc.zc_name);

	if (flags.recursive && errno == EEXIST) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"a child dataset already has a snapshot "
	"with the new name"));
	(void) zfs_error(hdl, EZFS_EXISTS, errbuf);
	} else if (errno == EACCES) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot move encrypted child outside of "
	"its encryption root"));
	(void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
	} else {
	(void) zfs_standard_error(zhp->zfs_hdl, errno, errbuf);
	}

	/*
	* On failure, we still want to remount any filesystems that
	* were previously mounted, so we don't alter the system state.
	*/
	if (cl != NULL)
	(void) changelist_postfix(cl);
	} else {
	if (cl != NULL) {
	changelist_rename(cl, zfs_get_name(zhp), target);
	ret = changelist_postfix(cl);
	}
	}

	error:
	if (cl != NULL) {
	changelist_free(cl);
	}
	return (ret);
	}

	nvlist_t *
	zfs_get_all_props(zfs_handle_t *zhp)
	{
	return (zhp->zfs_props);
	}

	nvlist_t *
	zfs_get_recvd_props(zfs_handle_t *zhp)
	{
	if (zhp->zfs_recvd_props == NULL)
	if (get_recvd_props_ioctl(zhp) != 0)
	return (NULL);
	return (zhp->zfs_recvd_props);
	}

	nvlist_t *
	zfs_get_user_props(zfs_handle_t *zhp)
	{
	return (zhp->zfs_user_props);
	}

	/*
	* This function is used by 'zfs list' to determine the exact set of columns to
	* display, and their maximum widths. This does two main things:
	*
	* - If this is a list of all properties, then expand the list to include
	* all native properties, and set a flag so that for each dataset we look
	* for new unique user properties and add them to the list.
	*
	* - For non fixed-width properties, keep track of the maximum width seen
	* so that we can size the column appropriately. If the user has
	* requested received property values, we also need to compute the width
	* of the RECEIVED column.
	*/
	int
	zfs_expand_proplist(zfs_handle_t zhp, zprop_list_t *plp, boolean_t received,
	boolean_t literal)
	{
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	zprop_list_t *entry;
	zprop_list_t last, start;
	nvlist_t userprops, propval;
	nvpair_t *elem;
	char *strval;
	char buf[ZFS_MAXPROPLEN];

	if (zprop_expand_list(hdl, plp, ZFS_TYPE_DATASET) != 0)
	return (-1);

	userprops = zfs_get_user_props(zhp);

	entry = *plp;
	if (entry->pl_all && nvlist_next_nvpair(userprops, NULL) != NULL) {
	/*
	* Go through and add any user properties as necessary. We
	* start by incrementing our list pointer to the first
	* non-native property.
	*/
	start = plp;
	while (*start != NULL) {
	if ((*start)->pl_prop == ZPROP_INVAL)
	break;
	start = &(*start)->pl_next;
	}

	elem = NULL;
	while ((elem = nvlist_next_nvpair(userprops, elem)) != NULL) {
	/*
	* See if we've already found this property in our list.
	*/
	for (last = start; *last != NULL;
	last = &(*last)->pl_next) {
	if (strcmp((*last)->pl_user_prop,
	nvpair_name(elem)) == 0)
	break;
	}

	if (*last == NULL) {
	if ((entry = zfs_alloc(hdl,
	sizeof (zprop_list_t))) == NULL \|\|
	((entry->pl_user_prop = zfs_strdup(hdl,
	nvpair_name(elem)))) == NULL) {
	free(entry);
	return (-1);
	}

	entry->pl_prop = ZPROP_INVAL;
	entry->pl_width = strlen(nvpair_name(elem));
	entry->pl_all = B_TRUE;
	*last = entry;
	}
	}
	}

	/*
	* Now go through and check the width of any non-fixed columns
	*/
	for (entry = *plp; entry != NULL; entry = entry->pl_next) {
	if (entry->pl_fixed && !literal)
	continue;

	if (entry->pl_prop != ZPROP_INVAL) {
	if (zfs_prop_get(zhp, entry->pl_prop,
	buf, sizeof (buf), NULL, NULL, 0, literal) == 0) {
	if (strlen(buf) > entry->pl_width)
	entry->pl_width = strlen(buf);
	}
	if (received && zfs_prop_get_recvd(zhp,
	zfs_prop_to_name(entry->pl_prop),
	buf, sizeof (buf), literal) == 0)
	if (strlen(buf) > entry->pl_recvd_width)
	entry->pl_recvd_width = strlen(buf);
	} else {
	if (nvlist_lookup_nvlist(userprops, entry->pl_user_prop,
	&propval) == 0) {
	verify(nvlist_lookup_string(propval,
	ZPROP_VALUE, &strval) == 0);
	if (strlen(strval) > entry->pl_width)
	entry->pl_width = strlen(strval);
	}
	if (received && zfs_prop_get_recvd(zhp,
	entry->pl_user_prop,
	buf, sizeof (buf), literal) == 0)
	if (strlen(buf) > entry->pl_recvd_width)
	entry->pl_recvd_width = strlen(buf);
	}
	}

	return (0);
	}

	void
	zfs_prune_proplist(zfs_handle_t zhp, uint8_t props)
	{
	nvpair_t *curr;
	nvpair_t *next;

	/*
	* Keep a reference to the props-table against which we prune the
	* properties.
	*/
	zhp->zfs_props_table = props;

	curr = nvlist_next_nvpair(zhp->zfs_props, NULL);

	while (curr) {
	zfs_prop_t zfs_prop = zfs_name_to_prop(nvpair_name(curr));
	next = nvlist_next_nvpair(zhp->zfs_props, curr);

	/*
	* User properties will result in ZPROP_INVAL, and since we
	* only know how to prune standard ZFS properties, we always
	* leave these in the list. This can also happen if we
	* encounter an unknown DSL property (when running older
	* software, for example).
	*/
	if (zfs_prop != ZPROP_INVAL && props[zfs_prop] == B_FALSE)
	(void) nvlist_remove(zhp->zfs_props,
	nvpair_name(curr), nvpair_type(curr));
	curr = next;
	}
	}

	static int
	zfs_smb_acl_mgmt(libzfs_handle_t hdl, char dataset, char *path,
	zfs_smb_acl_op_t cmd, char resource1, char resource2)
	{
	zfs_cmd_t zc = {"\0"};
	nvlist_t *nvlist = NULL;
	int error;

	(void) strlcpy(zc.zc_name, dataset, sizeof (zc.zc_name));
	(void) strlcpy(zc.zc_value, path, sizeof (zc.zc_value));
	zc.zc_cookie = (uint64_t)cmd;

	if (cmd == ZFS_SMB_ACL_RENAME) {
	if (nvlist_alloc(&nvlist, NV_UNIQUE_NAME, 0) != 0) {
	(void) no_memory(hdl);
	return (0);
	}
	}

	switch (cmd) {
	case ZFS_SMB_ACL_ADD:
	case ZFS_SMB_ACL_REMOVE:
	(void) strlcpy(zc.zc_string, resource1, sizeof (zc.zc_string));
	break;
	case ZFS_SMB_ACL_RENAME:
	if (nvlist_add_string(nvlist, ZFS_SMB_ACL_SRC,
	resource1) != 0) {
	(void) no_memory(hdl);
	return (-1);
	}
	if (nvlist_add_string(nvlist, ZFS_SMB_ACL_TARGET,
	resource2) != 0) {
	(void) no_memory(hdl);
	return (-1);
	}
	if (zcmd_write_src_nvlist(hdl, &zc, nvlist) != 0) {
	nvlist_free(nvlist);
	return (-1);
	}
	break;
	case ZFS_SMB_ACL_PURGE:
	break;
	default:
	return (-1);
	}
	error = ioctl(hdl->libzfs_fd, ZFS_IOC_SMB_ACL, &zc);
	nvlist_free(nvlist);
	return (error);
	}

	int
	zfs_smb_acl_add(libzfs_handle_t hdl, char dataset,
	char path, char resource)
	{
	return (zfs_smb_acl_mgmt(hdl, dataset, path, ZFS_SMB_ACL_ADD,
	resource, NULL));
	}

	int
	zfs_smb_acl_remove(libzfs_handle_t hdl, char dataset,
	char path, char resource)
	{
	return (zfs_smb_acl_mgmt(hdl, dataset, path, ZFS_SMB_ACL_REMOVE,
	resource, NULL));
	}

	int
	zfs_smb_acl_purge(libzfs_handle_t hdl, char dataset, char *path)
	{
	return (zfs_smb_acl_mgmt(hdl, dataset, path, ZFS_SMB_ACL_PURGE,
	NULL, NULL));
	}

	int
	zfs_smb_acl_rename(libzfs_handle_t hdl, char dataset, char *path,
	char oldname, char newname)
	{
	return (zfs_smb_acl_mgmt(hdl, dataset, path, ZFS_SMB_ACL_RENAME,
	oldname, newname));
	}

	int
	zfs_userspace(zfs_handle_t *zhp, zfs_userquota_prop_t type,
	zfs_userspace_cb_t func, void *arg)
	{
	zfs_cmd_t zc = {"\0"};
	zfs_useracct_t buf[100];
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	int ret;

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));

	zc.zc_objset_type = type;
	zc.zc_nvlist_dst = (uintptr_t)buf;

	for (;;) {
	zfs_useracct_t *zua = buf;

	zc.zc_nvlist_dst_size = sizeof (buf);
	if (zfs_ioctl(hdl, ZFS_IOC_USERSPACE_MANY, &zc) != 0) {
	char errbuf[1024];

	if ((errno == ENOTSUP &&
	(type == ZFS_PROP_USEROBJUSED \|\|
	type == ZFS_PROP_GROUPOBJUSED \|\|
	type == ZFS_PROP_USEROBJQUOTA \|\|
	type == ZFS_PROP_GROUPOBJQUOTA \|\|
	type == ZFS_PROP_PROJECTOBJUSED \|\|
	type == ZFS_PROP_PROJECTOBJQUOTA \|\|
	type == ZFS_PROP_PROJECTUSED \|\|
	type == ZFS_PROP_PROJECTQUOTA)))
	break;

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot get used/quota for %s"), zc.zc_name);
	return (zfs_standard_error_fmt(hdl, errno, errbuf));
	}
	if (zc.zc_nvlist_dst_size == 0)
	break;

	while (zc.zc_nvlist_dst_size > 0) {
	if ((ret = func(arg, zua->zu_domain, zua->zu_rid,
	zua->zu_space)) != 0)
	return (ret);
	zua++;
	zc.zc_nvlist_dst_size -= sizeof (zfs_useracct_t);
	}
	}

	return (0);
	}

	struct holdarg {
	nvlist_t *nvl;
	const char *snapname;
	const char *tag;
	boolean_t recursive;
	int error;
	};

	static int
	zfs_hold_one(zfs_handle_t zhp, void arg)
	{
	struct holdarg *ha = arg;
	char name[ZFS_MAX_DATASET_NAME_LEN];
	int rv = 0;

	if (snprintf(name, sizeof (name), "%s@%s", zhp->zfs_name,
	ha->snapname) >= sizeof (name))
	return (EINVAL);

	if (lzc_exists(name))
	fnvlist_add_string(ha->nvl, name, ha->tag);

	if (ha->recursive)
	rv = zfs_iter_filesystems(zhp, zfs_hold_one, ha);
	zfs_close(zhp);
	return (rv);
	}

	int
	zfs_hold(zfs_handle_t zhp, const char snapname, const char *tag,
	boolean_t recursive, int cleanup_fd)
	{
	int ret;
	struct holdarg ha;

	ha.nvl = fnvlist_alloc();
	ha.snapname = snapname;
	ha.tag = tag;
	ha.recursive = recursive;
	(void) zfs_hold_one(zfs_handle_dup(zhp), &ha);

	if (nvlist_empty(ha.nvl)) {
	char errbuf[1024];

	fnvlist_free(ha.nvl);
	ret = ENOENT;
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot hold snapshot '%s@%s'"),
	zhp->zfs_name, snapname);
	(void) zfs_standard_error(zhp->zfs_hdl, ret, errbuf);
	return (ret);
	}

	ret = zfs_hold_nvl(zhp, cleanup_fd, ha.nvl);
	fnvlist_free(ha.nvl);

	return (ret);
	}

	int
	zfs_hold_nvl(zfs_handle_t zhp, int cleanup_fd, nvlist_t holds)
	{
	int ret;
	nvlist_t *errors;
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	char errbuf[1024];
	nvpair_t *elem;

	errors = NULL;
	ret = lzc_hold(holds, cleanup_fd, &errors);

	if (ret == 0) {
	/* There may be errors even in the success case. */
	fnvlist_free(errors);
	return (0);
	}

	if (nvlist_empty(errors)) {
	/* no hold-specific errors */
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot hold"));
	switch (ret) {
	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded"));
	(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
	break;
	case EINVAL:
	(void) zfs_error(hdl, EZFS_BADTYPE, errbuf);
	break;
	default:
	(void) zfs_standard_error(hdl, ret, errbuf);
	}
	}

	for (elem = nvlist_next_nvpair(errors, NULL);
	elem != NULL;
	elem = nvlist_next_nvpair(errors, elem)) {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot hold snapshot '%s'"), nvpair_name(elem));
	switch (fnvpair_value_int32(elem)) {
	case E2BIG:
	/*
	* Temporary tags wind up having the ds object id
	* prepended. So even if we passed the length check
	* above, it's still possible for the tag to wind
	* up being slightly too long.
	*/
	(void) zfs_error(hdl, EZFS_TAGTOOLONG, errbuf);
	break;
	case EINVAL:
	(void) zfs_error(hdl, EZFS_BADTYPE, errbuf);
	break;
	case EEXIST:
	(void) zfs_error(hdl, EZFS_REFTAG_HOLD, errbuf);
	break;
	default:
	(void) zfs_standard_error(hdl,
	fnvpair_value_int32(elem), errbuf);
	}
	}

	fnvlist_free(errors);
	return (ret);
	}

	static int
	zfs_release_one(zfs_handle_t zhp, void arg)
	{
	struct holdarg *ha = arg;
	char name[ZFS_MAX_DATASET_NAME_LEN];
	int rv = 0;
	nvlist_t *existing_holds;

	if (snprintf(name, sizeof (name), "%s@%s", zhp->zfs_name,
	ha->snapname) >= sizeof (name)) {
	ha->error = EINVAL;
	rv = EINVAL;
	}

	if (lzc_get_holds(name, &existing_holds) != 0) {
	ha->error = ENOENT;
	} else if (!nvlist_exists(existing_holds, ha->tag)) {
	ha->error = ESRCH;
	} else {
	nvlist_t *torelease = fnvlist_alloc();
	fnvlist_add_boolean(torelease, ha->tag);
	fnvlist_add_nvlist(ha->nvl, name, torelease);
	fnvlist_free(torelease);
	}

	if (ha->recursive)
	rv = zfs_iter_filesystems(zhp, zfs_release_one, ha);
	zfs_close(zhp);
	return (rv);
	}

	int
	zfs_release(zfs_handle_t zhp, const char snapname, const char *tag,
	boolean_t recursive)
	{
	int ret;
	struct holdarg ha;
	nvlist_t *errors = NULL;
	nvpair_t *elem;
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	char errbuf[1024];

	ha.nvl = fnvlist_alloc();
	ha.snapname = snapname;
	ha.tag = tag;
	ha.recursive = recursive;
	ha.error = 0;
	(void) zfs_release_one(zfs_handle_dup(zhp), &ha);

	if (nvlist_empty(ha.nvl)) {
	fnvlist_free(ha.nvl);
	ret = ha.error;
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot release hold from snapshot '%s@%s'"),
	zhp->zfs_name, snapname);
	if (ret == ESRCH) {
	(void) zfs_error(hdl, EZFS_REFTAG_RELE, errbuf);
	} else {
	(void) zfs_standard_error(hdl, ret, errbuf);
	}
	return (ret);
	}

	ret = lzc_release(ha.nvl, &errors);
	fnvlist_free(ha.nvl);

	if (ret == 0) {
	/* There may be errors even in the success case. */
	fnvlist_free(errors);
	return (0);
	}

	if (nvlist_empty(errors)) {
	/* no hold-specific errors */
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot release"));
	switch (errno) {
	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded"));
	(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
	break;
	default:
	(void) zfs_standard_error_fmt(hdl, errno, errbuf);
	}
	}

	for (elem = nvlist_next_nvpair(errors, NULL);
	elem != NULL;
	elem = nvlist_next_nvpair(errors, elem)) {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot release hold from snapshot '%s'"),
	nvpair_name(elem));
	switch (fnvpair_value_int32(elem)) {
	case ESRCH:
	(void) zfs_error(hdl, EZFS_REFTAG_RELE, errbuf);
	break;
	case EINVAL:
	(void) zfs_error(hdl, EZFS_BADTYPE, errbuf);
	break;
	default:
	(void) zfs_standard_error_fmt(hdl,
	fnvpair_value_int32(elem), errbuf);
	}
	}

	fnvlist_free(errors);
	return (ret);
	}

	int
	zfs_get_fsacl(zfs_handle_t zhp, nvlist_t *nvl)
	{
	zfs_cmd_t zc = {"\0"};
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	int nvsz = 2048;
	void *nvbuf;
	int err = 0;
	char errbuf[1024];

	assert(zhp->zfs_type == ZFS_TYPE_VOLUME \|\|
	zhp->zfs_type == ZFS_TYPE_FILESYSTEM);

	tryagain:

	nvbuf = malloc(nvsz);
	if (nvbuf == NULL) {
	err = (zfs_error(hdl, EZFS_NOMEM, strerror(errno)));
	goto out;
	}

	zc.zc_nvlist_dst_size = nvsz;
	zc.zc_nvlist_dst = (uintptr_t)nvbuf;

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));

	if (zfs_ioctl(hdl, ZFS_IOC_GET_FSACL, &zc) != 0) {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot get permissions on '%s'"),
	zc.zc_name);
	switch (errno) {
	case ENOMEM:
	free(nvbuf);
	nvsz = zc.zc_nvlist_dst_size;
	goto tryagain;

	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded"));
	err = zfs_error(hdl, EZFS_BADVERSION, errbuf);
	break;
	case EINVAL:
	err = zfs_error(hdl, EZFS_BADTYPE, errbuf);
	break;
	case ENOENT:
	err = zfs_error(hdl, EZFS_NOENT, errbuf);
	break;
	default:
	err = zfs_standard_error_fmt(hdl, errno, errbuf);
	break;
	}
	} else {
	/* success */
	int rc = nvlist_unpack(nvbuf, zc.zc_nvlist_dst_size, nvl, 0);
	if (rc) {
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(
	TEXT_DOMAIN, "cannot get permissions on '%s'"),
	zc.zc_name);
	err = zfs_standard_error_fmt(hdl, rc, errbuf);
	}
	}

	free(nvbuf);
	out:
	return (err);
	}

	int
	zfs_set_fsacl(zfs_handle_t zhp, boolean_t un, nvlist_t nvl)
	{
	zfs_cmd_t zc = {"\0"};
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	char *nvbuf;
	char errbuf[1024];
	size_t nvsz;
	int err;

	assert(zhp->zfs_type == ZFS_TYPE_VOLUME \|\|
	zhp->zfs_type == ZFS_TYPE_FILESYSTEM);

	err = nvlist_size(nvl, &nvsz, NV_ENCODE_NATIVE);
	assert(err == 0);

	nvbuf = malloc(nvsz);

	err = nvlist_pack(nvl, &nvbuf, &nvsz, NV_ENCODE_NATIVE, 0);
	assert(err == 0);

	zc.zc_nvlist_src_size = nvsz;
	zc.zc_nvlist_src = (uintptr_t)nvbuf;
	zc.zc_perm_action = un;

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));

	if (zfs_ioctl(hdl, ZFS_IOC_SET_FSACL, &zc) != 0) {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot set permissions on '%s'"),
	zc.zc_name);
	switch (errno) {
	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded"));
	err = zfs_error(hdl, EZFS_BADVERSION, errbuf);
	break;
	case EINVAL:
	err = zfs_error(hdl, EZFS_BADTYPE, errbuf);
	break;
	case ENOENT:
	err = zfs_error(hdl, EZFS_NOENT, errbuf);
	break;
	default:
	err = zfs_standard_error_fmt(hdl, errno, errbuf);
	break;
	}
	}

	free(nvbuf);

	return (err);
	}

	int
	zfs_get_holds(zfs_handle_t zhp, nvlist_t *nvl)
	{
	int err;
	char errbuf[1024];

	err = lzc_get_holds(zhp->zfs_name, nvl);

	if (err != 0) {
	libzfs_handle_t *hdl = zhp->zfs_hdl;

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot get holds for '%s'"),
	zhp->zfs_name);
	switch (err) {
	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded"));
	err = zfs_error(hdl, EZFS_BADVERSION, errbuf);
	break;
	case EINVAL:
	err = zfs_error(hdl, EZFS_BADTYPE, errbuf);
	break;
	case ENOENT:
	err = zfs_error(hdl, EZFS_NOENT, errbuf);
	break;
	default:
	err = zfs_standard_error_fmt(hdl, errno, errbuf);
	break;
	}
	}

	return (err);
	}

	/*
	* The theory of raidz space accounting
	*
	* The "referenced" property of RAIDZ vdevs is scaled such that a 128KB block
	* will "reference" 128KB, even though it allocates more than that, to store the
	* parity information (and perhaps skip sectors). This concept of the
	* "referenced" (and other DMU space accounting) being lower than the allocated
	* space by a constant factor is called "raidz deflation."
	*
	* As mentioned above, the constant factor for raidz deflation assumes a 128KB
	* block size. However, zvols typically have a much smaller block size (default
	* 8KB). These smaller blocks may require proportionally much more parity
	* information (and perhaps skip sectors). In this case, the change to the
	* "referenced" property may be much more than the logical block size.
	*
	* Suppose a raidz vdev has 5 disks with ashift=12. A 128k block may be written
	* as follows.
	*
	* +-------+-------+-------+-------+-------+
	* \| disk1 \| disk2 \| disk3 \| disk4 \| disk5 \|
	* +-------+-------+-------+-------+-------+
	* \| P0 \| D0 \| D8 \| D16 \| D24 \|
	* \| P1 \| D1 \| D9 \| D17 \| D25 \|
	* \| P2 \| D2 \| D10 \| D18 \| D26 \|
	* \| P3 \| D3 \| D11 \| D19 \| D27 \|
	* \| P4 \| D4 \| D12 \| D20 \| D28 \|
	* \| P5 \| D5 \| D13 \| D21 \| D29 \|
	* \| P6 \| D6 \| D14 \| D22 \| D30 \|
	* \| P7 \| D7 \| D15 \| D23 \| D31 \|
	* +-------+-------+-------+-------+-------+
	*
	* Above, notice that 160k was allocated: 8 x 4k parity sectors + 32 x 4k data
	* sectors. The dataset's referenced will increase by 128k and the pool's
	* allocated and free properties will be adjusted by 160k.
	*
	* A 4k block written to the same raidz vdev will require two 4k sectors. The
	* blank cells represent unallocated space.
	*
	* +-------+-------+-------+-------+-------+
	* \| disk1 \| disk2 \| disk3 \| disk4 \| disk5 \|
	* +-------+-------+-------+-------+-------+
	* \| P0 \| D0 \| \| \| \|
	* +-------+-------+-------+-------+-------+
	*
	* Above, notice that the 4k block required one sector for parity and another
	* for data. vdev_raidz_asize() will return 8k and as such the pool's allocated
	* and free properties will be adjusted by 8k. The dataset will not be charged
	* 8k. Rather, it will be charged a value that is scaled according to the
	* overhead of the 128k block on the same vdev. This 8k allocation will be
	* charged 8k * 128k / 160k. 128k is from SPA_OLD_MAXBLOCKSIZE and 160k is as
	* calculated in the 128k block example above.
	*
	* Every raidz allocation is sized to be a multiple of nparity+1 sectors. That
	* is, every raidz1 allocation will be a multiple of 2 sectors, raidz2
	* allocations are a multiple of 3 sectors, and raidz3 allocations are a
	* multiple of of 4 sectors. When a block does not fill the required number of
	* sectors, skip blocks (sectors) are used.
	*
	* An 8k block being written to a raidz vdev may be written as follows:
	*
	* +-------+-------+-------+-------+-------+
	* \| disk1 \| disk2 \| disk3 \| disk4 \| disk5 \|
	* +-------+-------+-------+-------+-------+
	* \| P0 \| D0 \| D1 \| S0 \| \|
	* +-------+-------+-------+-------+-------+
	*
	* In order to maintain the nparity+1 allocation size, a skip block (S0) was
	* added. For this 8k block, the pool's allocated and free properties are
	* adjusted by 16k and the dataset's referenced is increased by 16k * 128k /
	* 160k. Again, 128k is from SPA_OLD_MAXBLOCKSIZE and 160k is as calculated in
	* the 128k block example above.
	*
	* Compression may lead to a variety of block sizes being written for the same
	* volume or file. There is no clear way to reserve just the amount of space
	* that will be required, so the worst case (no compression) is assumed.
	* Note that metadata blocks will typically be compressed, so the reservation
	* size returned by zvol_volsize_to_reservation() will generally be slightly
	* larger than the maximum that the volume can reference.
	*/

	/*
	* Derived from function of same name in module/zfs/vdev_raidz.c. Returns the
	* amount of space (in bytes) that will be allocated for the specified block
	* size. Note that the "referenced" space accounted will be less than this, but
	* not necessarily equal to "blksize", due to RAIDZ deflation.
	*/
	static uint64_t
	vdev_raidz_asize(uint64_t ndisks, uint64_t nparity, uint64_t ashift,
	uint64_t blksize)
	{
	uint64_t asize, ndata;

	ASSERT3U(ndisks, >, nparity);
	ndata = ndisks - nparity;
	asize = ((blksize - 1) >> ashift) + 1;
	asize += nparity * ((asize + ndata - 1) / ndata);
	asize = roundup(asize, nparity + 1) << ashift;

	return (asize);
	}

	/*
	* Determine how much space will be allocated if it lands on the most space-
	* inefficient top-level vdev. Returns the size in bytes required to store one
	* copy of the volume data. See theory comment above.
	*/
	static uint64_t
	volsize_from_vdevs(zpool_handle_t *zhp, uint64_t nblocks, uint64_t blksize)
	{
	nvlist_t config, tree, **vdevs;
	uint_t nvdevs, v;
	uint64_t ret = 0;

	config = zpool_get_config(zhp, NULL);
	if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE, &tree) != 0 \|\|
	nvlist_lookup_nvlist_array(tree, ZPOOL_CONFIG_CHILDREN,
	&vdevs, &nvdevs) != 0) {
	return (nblocks * blksize);
	}

	for (v = 0; v < nvdevs; v++) {
	char *type;
	uint64_t nparity, ashift, asize, tsize;
	nvlist_t **disks;
	uint_t ndisks;
	uint64_t volsize;

	if (nvlist_lookup_string(vdevs[v], ZPOOL_CONFIG_TYPE,
	&type) != 0 \|\| strcmp(type, VDEV_TYPE_RAIDZ) != 0 \|\|
	nvlist_lookup_uint64(vdevs[v], ZPOOL_CONFIG_NPARITY,
	&nparity) != 0 \|\|
	nvlist_lookup_uint64(vdevs[v], ZPOOL_CONFIG_ASHIFT,
	&ashift) != 0 \|\|
	nvlist_lookup_nvlist_array(vdevs[v], ZPOOL_CONFIG_CHILDREN,
	&disks, &ndisks) != 0) {
	continue;
	}

	/* allocation size for the "typical" 128k block */
	tsize = vdev_raidz_asize(ndisks, nparity, ashift,
	SPA_OLD_MAXBLOCKSIZE);
	/* allocation size for the blksize block */
	asize = vdev_raidz_asize(ndisks, nparity, ashift, blksize);

	/*
	* Scale this size down as a ratio of 128k / tsize. See theory
	* statement above.
	*/
	volsize = nblocks * asize * SPA_OLD_MAXBLOCKSIZE / tsize;
	if (volsize > ret) {
	ret = volsize;
	}
	}

	if (ret == 0) {
	ret = nblocks * blksize;
	}

	return (ret);
	}

	/*
	* Convert the zvol's volume size to an appropriate reservation. See theory
	* comment above.
	*
	* Note: If this routine is updated, it is necessary to update the ZFS test
	* suite's shell version in reservation.shlib.
	*/
	uint64_t
	zvol_volsize_to_reservation(zpool_handle_t *zph, uint64_t volsize,
	nvlist_t *props)
	{
	uint64_t numdb;
	uint64_t nblocks, volblocksize;
	int ncopies;
	char *strval;

	if (nvlist_lookup_string(props,
	zfs_prop_to_name(ZFS_PROP_COPIES), &strval) == 0)
	ncopies = atoi(strval);
	else
	ncopies = 1;
	if (nvlist_lookup_uint64(props,
	zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
	&volblocksize) != 0)
	volblocksize = ZVOL_DEFAULT_BLOCKSIZE;

	nblocks = volsize / volblocksize;
	/*
	* Metadata defaults to using 128k blocks, not volblocksize blocks. For
	* this reason, only the data blocks are scaled based on vdev config.
	*/
	volsize = volsize_from_vdevs(zph, nblocks, volblocksize);

	/* start with metadnode L0-L6 */
	numdb = 7;
	/* calculate number of indirects */
	while (nblocks > 1) {
	nblocks += DNODES_PER_LEVEL - 1;
	nblocks /= DNODES_PER_LEVEL;
	numdb += nblocks;
	}
	numdb *= MIN(SPA_DVAS_PER_BP, ncopies + 1);
	volsize *= ncopies;
	/*
	* this is exactly DN_MAX_INDBLKSHIFT when metadata isn't
	* compressed, but in practice they compress down to about
	* 1100 bytes
	*/
	numdb *= 1ULL << DN_MAX_INDBLKSHIFT;
	volsize += numdb;
	return (volsize);
	}

	/*
	* Wait for the given activity and return the status of the wait (whether or not
	* any waiting was done) in the 'waited' parameter. Non-existent fses are
	* reported via the 'missing' parameter, rather than by printing an error
	* message. This is convenient when this function is called in a loop over a
	* long period of time (as it is, for example, by zfs's wait cmd). In that
	* scenario, a fs being exported or destroyed should be considered a normal
	* event, so we don't want to print an error when we find that the fs doesn't
	* exist.
	*/
	int
	zfs_wait_status(zfs_handle_t *zhp, zfs_wait_activity_t activity,
	boolean_t missing, boolean_t waited)
	{
	int error = lzc_wait_fs(zhp->zfs_name, activity, waited);
	*missing = (error == ENOENT);
	if (*missing)
	return (0);

	if (error != 0) {
	(void) zfs_standard_error_fmt(zhp->zfs_hdl, error,
	dgettext(TEXT_DOMAIN, "error waiting in fs '%s'"),
	zhp->zfs_name);
	}

	return (error);
	}
	Index: vendor-sys/openzfs/dist/lib/libzfs/libzfs_pool.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfs/libzfs_pool.c (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzfs/libzfs_pool.c (revision 365892)
	@@ -1,4531 +1,4527 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright 2015 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
	* Copyright (c) 2018 Datto Inc.
	* Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
	* Copyright (c) 2017, Intel Corporation.
	* Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>
	*/

	#include <errno.h>
	#include <libintl.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <strings.h>
	#include <unistd.h>
	#include <libgen.h>
	#include <zone.h>
	#include <sys/stat.h>
	#include <sys/efi_partition.h>
	#include <sys/systeminfo.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/vdev_disk.h>
	#include <dlfcn.h>
	#include <libzutil.h>

	#include "zfs_namecheck.h"
	#include "zfs_prop.h"
	#include "libzfs_impl.h"
	#include "zfs_comutil.h"
	#include "zfeature_common.h"

	static boolean_t zpool_vdev_is_interior(const char *name);

	typedef struct prop_flags {
	int create:1; /* Validate property on creation */
	int import:1; /* Validate property on import */
	} prop_flags_t;

	/*
	* ====================================================================
	* zpool property functions
	* ====================================================================
	*/

	static int
	zpool_get_all_props(zpool_handle_t *zhp)
	{
	zfs_cmd_t zc = {"\0"};
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));

	if (zcmd_alloc_dst_nvlist(hdl, &zc, 0) != 0)
	return (-1);

	while (zfs_ioctl(hdl, ZFS_IOC_POOL_GET_PROPS, &zc) != 0) {
	if (errno == ENOMEM) {
	if (zcmd_expand_dst_nvlist(hdl, &zc) != 0) {
	zcmd_free_nvlists(&zc);
	return (-1);
	}
	} else {
	zcmd_free_nvlists(&zc);
	return (-1);
	}
	}

	if (zcmd_read_dst_nvlist(hdl, &zc, &zhp->zpool_props) != 0) {
	zcmd_free_nvlists(&zc);
	return (-1);
	}

	zcmd_free_nvlists(&zc);

	return (0);
	}

	int
	zpool_props_refresh(zpool_handle_t *zhp)
	{
	nvlist_t *old_props;

	old_props = zhp->zpool_props;

	if (zpool_get_all_props(zhp) != 0)
	return (-1);

	nvlist_free(old_props);
	return (0);
	}

	static const char *
	zpool_get_prop_string(zpool_handle_t *zhp, zpool_prop_t prop,
	zprop_source_t *src)
	{
	nvlist_t nv, nvl;
	uint64_t ival;
	char *value;
	zprop_source_t source;

	nvl = zhp->zpool_props;
	if (nvlist_lookup_nvlist(nvl, zpool_prop_to_name(prop), &nv) == 0) {
	verify(nvlist_lookup_uint64(nv, ZPROP_SOURCE, &ival) == 0);
	source = ival;
	verify(nvlist_lookup_string(nv, ZPROP_VALUE, &value) == 0);
	} else {
	source = ZPROP_SRC_DEFAULT;
	if ((value = (char *)zpool_prop_default_string(prop)) == NULL)
	value = "-";
	}

	if (src)
	*src = source;

	return (value);
	}

	uint64_t
	zpool_get_prop_int(zpool_handle_t zhp, zpool_prop_t prop, zprop_source_t src)
	{
	nvlist_t nv, nvl;
	uint64_t value;
	zprop_source_t source;

	if (zhp->zpool_props == NULL && zpool_get_all_props(zhp)) {
	/*
	* zpool_get_all_props() has most likely failed because
	* the pool is faulted, but if all we need is the top level
	* vdev's guid then get it from the zhp config nvlist.
	*/
	if ((prop == ZPOOL_PROP_GUID) &&
	(nvlist_lookup_nvlist(zhp->zpool_config,
	ZPOOL_CONFIG_VDEV_TREE, &nv) == 0) &&
	(nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID, &value)
	== 0)) {
	return (value);
	}
	return (zpool_prop_default_numeric(prop));
	}

	nvl = zhp->zpool_props;
	if (nvlist_lookup_nvlist(nvl, zpool_prop_to_name(prop), &nv) == 0) {
	verify(nvlist_lookup_uint64(nv, ZPROP_SOURCE, &value) == 0);
	source = value;
	verify(nvlist_lookup_uint64(nv, ZPROP_VALUE, &value) == 0);
	} else {
	source = ZPROP_SRC_DEFAULT;
	value = zpool_prop_default_numeric(prop);
	}

	if (src)
	*src = source;

	return (value);
	}

	/*
	* Map VDEV STATE to printed strings.
	*/
	const char *
	zpool_state_to_name(vdev_state_t state, vdev_aux_t aux)
	{
	switch (state) {
	case VDEV_STATE_CLOSED:
	case VDEV_STATE_OFFLINE:
	return (gettext("OFFLINE"));
	case VDEV_STATE_REMOVED:
	return (gettext("REMOVED"));
	case VDEV_STATE_CANT_OPEN:
	if (aux == VDEV_AUX_CORRUPT_DATA \|\| aux == VDEV_AUX_BAD_LOG)
	return (gettext("FAULTED"));
	else if (aux == VDEV_AUX_SPLIT_POOL)
	return (gettext("SPLIT"));
	else
	return (gettext("UNAVAIL"));
	case VDEV_STATE_FAULTED:
	return (gettext("FAULTED"));
	case VDEV_STATE_DEGRADED:
	return (gettext("DEGRADED"));
	case VDEV_STATE_HEALTHY:
	return (gettext("ONLINE"));

	default:
	break;
	}

	return (gettext("UNKNOWN"));
	}

	/*
	* Map POOL STATE to printed strings.
	*/
	const char *
	zpool_pool_state_to_name(pool_state_t state)
	{
	switch (state) {
	default:
	break;
	case POOL_STATE_ACTIVE:
	return (gettext("ACTIVE"));
	case POOL_STATE_EXPORTED:
	return (gettext("EXPORTED"));
	case POOL_STATE_DESTROYED:
	return (gettext("DESTROYED"));
	case POOL_STATE_SPARE:
	return (gettext("SPARE"));
	case POOL_STATE_L2CACHE:
	return (gettext("L2CACHE"));
	case POOL_STATE_UNINITIALIZED:
	return (gettext("UNINITIALIZED"));
	case POOL_STATE_UNAVAIL:
	return (gettext("UNAVAIL"));
	case POOL_STATE_POTENTIALLY_ACTIVE:
	return (gettext("POTENTIALLY_ACTIVE"));
	}

	return (gettext("UNKNOWN"));
	}

	/*
	* Given a pool handle, return the pool health string ("ONLINE", "DEGRADED",
	* "SUSPENDED", etc).
	*/
	const char *
	zpool_get_state_str(zpool_handle_t *zhp)
	{
	zpool_errata_t errata;
	zpool_status_t status;
	nvlist_t *nvroot;
	vdev_stat_t *vs;
	uint_t vsc;
	const char *str;

	status = zpool_get_status(zhp, NULL, &errata);

	if (zpool_get_state(zhp) == POOL_STATE_UNAVAIL) {
	str = gettext("FAULTED");
	} else if (status == ZPOOL_STATUS_IO_FAILURE_WAIT \|\|
	status == ZPOOL_STATUS_IO_FAILURE_MMP) {
	str = gettext("SUSPENDED");
	} else {
	verify(nvlist_lookup_nvlist(zpool_get_config(zhp, NULL),
	ZPOOL_CONFIG_VDEV_TREE, &nvroot) == 0);
	verify(nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_VDEV_STATS, (uint64_t **)&vs, &vsc)
	== 0);
	str = zpool_state_to_name(vs->vs_state, vs->vs_aux);
	}
	return (str);
	}

	/*
	* Get a zpool property value for 'prop' and return the value in
	* a pre-allocated buffer.
	*/
	int
	zpool_get_prop(zpool_handle_t zhp, zpool_prop_t prop, char buf,
	size_t len, zprop_source_t *srctype, boolean_t literal)
	{
	uint64_t intval;
	const char *strval;
	zprop_source_t src = ZPROP_SRC_NONE;

	if (zpool_get_state(zhp) == POOL_STATE_UNAVAIL) {
	switch (prop) {
	case ZPOOL_PROP_NAME:
	(void) strlcpy(buf, zpool_get_name(zhp), len);
	break;

	case ZPOOL_PROP_HEALTH:
	(void) strlcpy(buf, zpool_get_state_str(zhp), len);
	break;

	case ZPOOL_PROP_GUID:
	intval = zpool_get_prop_int(zhp, prop, &src);
	(void) snprintf(buf, len, "%llu", (u_longlong_t)intval);
	break;

	case ZPOOL_PROP_ALTROOT:
	case ZPOOL_PROP_CACHEFILE:
	case ZPOOL_PROP_COMMENT:
	if (zhp->zpool_props != NULL \|\|
	zpool_get_all_props(zhp) == 0) {
	(void) strlcpy(buf,
	zpool_get_prop_string(zhp, prop, &src),
	len);
	break;
	}
	/* FALLTHROUGH */
	default:
	(void) strlcpy(buf, "-", len);
	break;
	}

	if (srctype != NULL)
	*srctype = src;
	return (0);
	}

	if (zhp->zpool_props == NULL && zpool_get_all_props(zhp) &&
	prop != ZPOOL_PROP_NAME)
	return (-1);

	switch (zpool_prop_get_type(prop)) {
	case PROP_TYPE_STRING:
	(void) strlcpy(buf, zpool_get_prop_string(zhp, prop, &src),
	len);
	break;

	case PROP_TYPE_NUMBER:
	intval = zpool_get_prop_int(zhp, prop, &src);

	switch (prop) {
	case ZPOOL_PROP_SIZE:
	case ZPOOL_PROP_ALLOCATED:
	case ZPOOL_PROP_FREE:
	case ZPOOL_PROP_FREEING:
	case ZPOOL_PROP_LEAKED:
	case ZPOOL_PROP_ASHIFT:
	if (literal)
	(void) snprintf(buf, len, "%llu",
	(u_longlong_t)intval);
	else
	(void) zfs_nicenum(intval, buf, len);
	break;

	case ZPOOL_PROP_EXPANDSZ:
	case ZPOOL_PROP_CHECKPOINT:
	if (intval == 0) {
	(void) strlcpy(buf, "-", len);
	} else if (literal) {
	(void) snprintf(buf, len, "%llu",
	(u_longlong_t)intval);
	} else {
	(void) zfs_nicebytes(intval, buf, len);
	}
	break;

	case ZPOOL_PROP_CAPACITY:
	if (literal) {
	(void) snprintf(buf, len, "%llu",
	(u_longlong_t)intval);
	} else {
	(void) snprintf(buf, len, "%llu%%",
	(u_longlong_t)intval);
	}
	break;

	case ZPOOL_PROP_FRAGMENTATION:
	if (intval == UINT64_MAX) {
	(void) strlcpy(buf, "-", len);
	} else if (literal) {
	(void) snprintf(buf, len, "%llu",
	(u_longlong_t)intval);
	} else {
	(void) snprintf(buf, len, "%llu%%",
	(u_longlong_t)intval);
	}
	break;

	case ZPOOL_PROP_DEDUPRATIO:
	if (literal)
	(void) snprintf(buf, len, "%llu.%02llu",
	(u_longlong_t)(intval / 100),
	(u_longlong_t)(intval % 100));
	else
	(void) snprintf(buf, len, "%llu.%02llux",
	(u_longlong_t)(intval / 100),
	(u_longlong_t)(intval % 100));
	break;

	case ZPOOL_PROP_HEALTH:
	(void) strlcpy(buf, zpool_get_state_str(zhp), len);
	break;
	case ZPOOL_PROP_VERSION:
	if (intval >= SPA_VERSION_FEATURES) {
	(void) snprintf(buf, len, "-");
	break;
	}
	/* FALLTHROUGH */
	default:
	(void) snprintf(buf, len, "%llu", (u_longlong_t)intval);
	}
	break;

	case PROP_TYPE_INDEX:
	intval = zpool_get_prop_int(zhp, prop, &src);
	if (zpool_prop_index_to_string(prop, intval, &strval)
	!= 0)
	return (-1);
	(void) strlcpy(buf, strval, len);
	break;

	default:
	abort();
	}

	if (srctype)
	*srctype = src;

	return (0);
	}

	/*
	* Check if the bootfs name has the same pool name as it is set to.
	* Assuming bootfs is a valid dataset name.
	*/
	static boolean_t
	bootfs_name_valid(const char pool, const char bootfs)
	{
	int len = strlen(pool);
	if (bootfs[0] == '\0')
	return (B_TRUE);

	if (!zfs_name_valid(bootfs, ZFS_TYPE_FILESYSTEM\|ZFS_TYPE_SNAPSHOT))
	return (B_FALSE);

	if (strncmp(pool, bootfs, len) == 0 &&
	(bootfs[len] == '/' \|\| bootfs[len] == '\0'))
	return (B_TRUE);

	return (B_FALSE);
	}

	/*
	* Given an nvlist of zpool properties to be set, validate that they are
	* correct, and parse any numeric properties (index, boolean, etc) if they are
	* specified as strings.
	*/
	static nvlist_t *
	zpool_valid_proplist(libzfs_handle_t hdl, const char poolname,
	nvlist_t props, uint64_t version, prop_flags_t flags, char errbuf)
	{
	nvpair_t *elem;
	nvlist_t *retprops;
	zpool_prop_t prop;
	char *strval;
	uint64_t intval;
	char slash, check;
	struct stat64 statbuf;
	zpool_handle_t *zhp;

	if (nvlist_alloc(&retprops, NV_UNIQUE_NAME, 0) != 0) {
	(void) no_memory(hdl);
	return (NULL);
	}

	elem = NULL;
	while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
	const char *propname = nvpair_name(elem);

	prop = zpool_name_to_prop(propname);
	if (prop == ZPOOL_PROP_INVAL && zpool_prop_feature(propname)) {
	int err;
	char *fname = strchr(propname, '@') + 1;

	err = zfeature_lookup_name(fname, NULL);
	if (err != 0) {
	ASSERT3U(err, ==, ENOENT);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid feature '%s'"), fname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (nvpair_type(elem) != DATA_TYPE_STRING) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be a string"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	(void) nvpair_value_string(elem, &strval);
	if (strcmp(strval, ZFS_FEATURE_ENABLED) != 0 &&
	strcmp(strval, ZFS_FEATURE_DISABLED) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' can only be set to "
	"'enabled' or 'disabled'"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (!flags.create &&
	strcmp(strval, ZFS_FEATURE_DISABLED) == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' can only be set to "
	"'disabled' at creation time"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (nvlist_add_uint64(retprops, propname, 0) != 0) {
	(void) no_memory(hdl);
	goto error;
	}
	continue;
	}

	/*
	* Make sure this property is valid and applies to this type.
	*/
	if (prop == ZPOOL_PROP_INVAL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid property '%s'"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (zpool_prop_readonly(prop)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "'%s' "
	"is readonly"), propname);
	(void) zfs_error(hdl, EZFS_PROPREADONLY, errbuf);
	goto error;
	}

	if (!flags.create && zpool_prop_setonce(prop)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' can only be set at "
	"creation time"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (zprop_parse_value(hdl, elem, prop, ZFS_TYPE_POOL, retprops,
	&strval, &intval, errbuf) != 0)
	goto error;

	/*
	* Perform additional checking for specific properties.
	*/
	switch (prop) {
	case ZPOOL_PROP_VERSION:
	if (intval < version \|\|
	!SPA_VERSION_IS_SUPPORTED(intval)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' number %d is invalid."),
	propname, intval);
	(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
	goto error;
	}
	break;

	case ZPOOL_PROP_ASHIFT:
	if (intval != 0 &&
	(intval < ASHIFT_MIN \|\| intval > ASHIFT_MAX)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' number %d is invalid, only "
	"values between %" PRId32 " and "
	"%" PRId32 " are allowed."),
	propname, intval, ASHIFT_MIN, ASHIFT_MAX);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	break;

	case ZPOOL_PROP_BOOTFS:
	if (flags.create \|\| flags.import) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' cannot be set at creation "
	"or import time"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (version < SPA_VERSION_BOOTFS) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded to support "
	"'%s' property"), propname);
	(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
	goto error;
	}

	/*
	* bootfs property value has to be a dataset name and
	* the dataset has to be in the same pool as it sets to.
	*/
	if (!bootfs_name_valid(poolname, strval)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "'%s' "
	"is an invalid name"), strval);
	(void) zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
	goto error;
	}

	if ((zhp = zpool_open_canfail(hdl, poolname)) == NULL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"could not open pool '%s'"), poolname);
	(void) zfs_error(hdl, EZFS_OPENFAILED, errbuf);
	goto error;
	}
	zpool_close(zhp);
	break;

	case ZPOOL_PROP_ALTROOT:
	if (!flags.create && !flags.import) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' can only be set during pool "
	"creation or import"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	if (strval[0] != '/') {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"bad alternate root '%s'"), strval);
	(void) zfs_error(hdl, EZFS_BADPATH, errbuf);
	goto error;
	}
	break;

	case ZPOOL_PROP_CACHEFILE:
	if (strval[0] == '\0')
	break;

	if (strcmp(strval, "none") == 0)
	break;

	if (strval[0] != '/') {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' must be empty, an "
	"absolute path, or 'none'"), propname);
	(void) zfs_error(hdl, EZFS_BADPATH, errbuf);
	goto error;
	}

	slash = strrchr(strval, '/');

	if (slash[1] == '\0' \|\| strcmp(slash, "/.") == 0 \|\|
	strcmp(slash, "/..") == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' is not a valid file"), strval);
	(void) zfs_error(hdl, EZFS_BADPATH, errbuf);
	goto error;
	}

	*slash = '\0';

	if (strval[0] != '\0' &&
	(stat64(strval, &statbuf) != 0 \|\|
	!S_ISDIR(statbuf.st_mode))) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' is not a valid directory"),
	strval);
	(void) zfs_error(hdl, EZFS_BADPATH, errbuf);
	goto error;
	}

	*slash = '/';
	break;

	case ZPOOL_PROP_COMMENT:
	for (check = strval; *check != '\0'; check++) {
	if (!isprint(*check)) {
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN,
	"comment may only have printable "
	"characters"));
	(void) zfs_error(hdl, EZFS_BADPROP,
	errbuf);
	goto error;
	}
	}
	if (strlen(strval) > ZPROP_MAX_COMMENT) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"comment must not exceed %d characters"),
	ZPROP_MAX_COMMENT);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	break;
	case ZPOOL_PROP_READONLY:
	if (!flags.import) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' can only be set at "
	"import time"), propname);
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	break;
	case ZPOOL_PROP_MULTIHOST:
	if (get_system_hostid() == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"requires a non-zero system hostid"));
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	break;
	case ZPOOL_PROP_DEDUPDITTO:
	printf("Note: property '%s' no longer has "
	"any effect\n", propname);
	break;

	default:
	break;
	}
	}

	return (retprops);
	error:
	nvlist_free(retprops);
	return (NULL);
	}

	/*
	* Set zpool property : propname=propval.
	*/
	int
	zpool_set_prop(zpool_handle_t zhp, const char propname, const char *propval)
	{
	zfs_cmd_t zc = {"\0"};
	int ret = -1;
	char errbuf[1024];
	nvlist_t *nvl = NULL;
	nvlist_t *realprops;
	uint64_t version;
	prop_flags_t flags = { 0 };

	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot set property for '%s'"),
	zhp->zpool_name);

	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, 0) != 0)
	return (no_memory(zhp->zpool_hdl));

	if (nvlist_add_string(nvl, propname, propval) != 0) {
	nvlist_free(nvl);
	return (no_memory(zhp->zpool_hdl));
	}

	version = zpool_get_prop_int(zhp, ZPOOL_PROP_VERSION, NULL);
	if ((realprops = zpool_valid_proplist(zhp->zpool_hdl,
	zhp->zpool_name, nvl, version, flags, errbuf)) == NULL) {
	nvlist_free(nvl);
	return (-1);
	}

	nvlist_free(nvl);
	nvl = realprops;

	/*
	* Execute the corresponding ioctl() to set this property.
	*/
	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));

	if (zcmd_write_src_nvlist(zhp->zpool_hdl, &zc, nvl) != 0) {
	nvlist_free(nvl);
	return (-1);
	}

	ret = zfs_ioctl(zhp->zpool_hdl, ZFS_IOC_POOL_SET_PROPS, &zc);

	zcmd_free_nvlists(&zc);
	nvlist_free(nvl);

	if (ret)
	(void) zpool_standard_error(zhp->zpool_hdl, errno, errbuf);
	else
	(void) zpool_props_refresh(zhp);

	return (ret);
	}

	int
	zpool_expand_proplist(zpool_handle_t zhp, zprop_list_t *plp)
	{
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	zprop_list_t *entry;
	char buf[ZFS_MAXPROPLEN];
	nvlist_t *features = NULL;
	nvpair_t *nvp;
	zprop_list_t **last;
	boolean_t firstexpand = (NULL == *plp);
	int i;

	if (zprop_expand_list(hdl, plp, ZFS_TYPE_POOL) != 0)
	return (-1);

	last = plp;
	while (*last != NULL)
	last = &(*last)->pl_next;

	if ((*plp)->pl_all)
	features = zpool_get_features(zhp);

	if ((*plp)->pl_all && firstexpand) {
	for (i = 0; i < SPA_FEATURES; i++) {
	zprop_list_t *entry = zfs_alloc(hdl,
	sizeof (zprop_list_t));
	entry->pl_prop = ZPROP_INVAL;
	entry->pl_user_prop = zfs_asprintf(hdl, "feature@%s",
	spa_feature_table[i].fi_uname);
	entry->pl_width = strlen(entry->pl_user_prop);
	entry->pl_all = B_TRUE;

	*last = entry;
	last = &entry->pl_next;
	}
	}

	/* add any unsupported features */
	for (nvp = nvlist_next_nvpair(features, NULL);
	nvp != NULL; nvp = nvlist_next_nvpair(features, nvp)) {
	char *propname;
	boolean_t found;
	zprop_list_t *entry;

	if (zfeature_is_supported(nvpair_name(nvp)))
	continue;

	propname = zfs_asprintf(hdl, "unsupported@%s",
	nvpair_name(nvp));

	/*
	* Before adding the property to the list make sure that no
	* other pool already added the same property.
	*/
	found = B_FALSE;
	entry = *plp;
	while (entry != NULL) {
	if (entry->pl_user_prop != NULL &&
	strcmp(propname, entry->pl_user_prop) == 0) {
	found = B_TRUE;
	break;
	}
	entry = entry->pl_next;
	}
	if (found) {
	free(propname);
	continue;
	}

	entry = zfs_alloc(hdl, sizeof (zprop_list_t));
	entry->pl_prop = ZPROP_INVAL;
	entry->pl_user_prop = propname;
	entry->pl_width = strlen(entry->pl_user_prop);
	entry->pl_all = B_TRUE;

	*last = entry;
	last = &entry->pl_next;
	}

	for (entry = *plp; entry != NULL; entry = entry->pl_next) {

	if (entry->pl_fixed)
	continue;

	if (entry->pl_prop != ZPROP_INVAL &&
	zpool_get_prop(zhp, entry->pl_prop, buf, sizeof (buf),
	NULL, B_FALSE) == 0) {
	if (strlen(buf) > entry->pl_width)
	entry->pl_width = strlen(buf);
	}
	}

	return (0);
	}

	/*
	* Get the state for the given feature on the given ZFS pool.
	*/
	int
	zpool_prop_get_feature(zpool_handle_t zhp, const char propname, char *buf,
	size_t len)
	{
	uint64_t refcount;
	boolean_t found = B_FALSE;
	nvlist_t *features = zpool_get_features(zhp);
	boolean_t supported;
	const char *feature = strchr(propname, '@') + 1;

	supported = zpool_prop_feature(propname);
	ASSERT(supported \|\| zpool_prop_unsupported(propname));

	/*
	* Convert from feature name to feature guid. This conversion is
	* unnecessary for unsupported@... properties because they already
	* use guids.
	*/
	if (supported) {
	int ret;
	spa_feature_t fid;

	ret = zfeature_lookup_name(feature, &fid);
	if (ret != 0) {
	(void) strlcpy(buf, "-", len);
	return (ENOTSUP);
	}
	feature = spa_feature_table[fid].fi_guid;
	}

	if (nvlist_lookup_uint64(features, feature, &refcount) == 0)
	found = B_TRUE;

	if (supported) {
	if (!found) {
	(void) strlcpy(buf, ZFS_FEATURE_DISABLED, len);
	} else {
	if (refcount == 0)
	(void) strlcpy(buf, ZFS_FEATURE_ENABLED, len);
	else
	(void) strlcpy(buf, ZFS_FEATURE_ACTIVE, len);
	}
	} else {
	if (found) {
	if (refcount == 0) {
	(void) strcpy(buf, ZFS_UNSUPPORTED_INACTIVE);
	} else {
	(void) strcpy(buf, ZFS_UNSUPPORTED_READONLY);
	}
	} else {
	(void) strlcpy(buf, "-", len);
	return (ENOTSUP);
	}
	}

	return (0);
	}

	/*
	* Validate the given pool name, optionally putting an extended error message in
	* 'buf'.
	*/
	boolean_t
	zpool_name_valid(libzfs_handle_t hdl, boolean_t isopen, const char pool)
	{
	namecheck_err_t why;
	char what;
	int ret;

	ret = pool_namecheck(pool, &why, &what);

	/*
	* The rules for reserved pool names were extended at a later point.
	* But we need to support users with existing pools that may now be
	* invalid. So we only check for this expanded set of names during a
	* create (or import), and only in userland.
	*/
	if (ret == 0 && !isopen &&
	(strncmp(pool, "mirror", 6) == 0 \|\|
	strncmp(pool, "raidz", 5) == 0 \|\|
	strncmp(pool, "spare", 5) == 0 \|\|
	strcmp(pool, "log") == 0)) {
	if (hdl != NULL)
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "name is reserved"));
	return (B_FALSE);
	}


	if (ret != 0) {
	if (hdl != NULL) {
	switch (why) {
	case NAME_ERR_TOOLONG:
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "name is too long"));
	break;

	case NAME_ERR_INVALCHAR:
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "invalid character "
	"'%c' in pool name"), what);
	break;

	case NAME_ERR_NOLETTER:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"name must begin with a letter"));
	break;

	case NAME_ERR_RESERVED:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"name is reserved"));
	break;

	case NAME_ERR_DISKLIKE:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool name is reserved"));
	break;

	case NAME_ERR_LEADING_SLASH:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"leading slash in name"));
	break;

	case NAME_ERR_EMPTY_COMPONENT:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"empty component in name"));
	break;

	case NAME_ERR_TRAILING_SLASH:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"trailing slash in name"));
	break;

	case NAME_ERR_MULTIPLE_DELIMITERS:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"multiple '@' and/or '#' delimiters in "
	"name"));
	break;

	case NAME_ERR_NO_AT:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"permission set is missing '@'"));
	break;

	default:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"(%d) not defined"), why);
	break;
	}
	}
	return (B_FALSE);
	}

	return (B_TRUE);
	}

	/*
	* Open a handle to the given pool, even if the pool is currently in the FAULTED
	* state.
	*/
	zpool_handle_t *
	zpool_open_canfail(libzfs_handle_t hdl, const char pool)
	{
	zpool_handle_t *zhp;
	boolean_t missing;

	/*
	* Make sure the pool name is valid.
	*/
	if (!zpool_name_valid(hdl, B_TRUE, pool)) {
	(void) zfs_error_fmt(hdl, EZFS_INVALIDNAME,
	dgettext(TEXT_DOMAIN, "cannot open '%s'"),
	pool);
	return (NULL);
	}

	if ((zhp = zfs_alloc(hdl, sizeof (zpool_handle_t))) == NULL)
	return (NULL);

	zhp->zpool_hdl = hdl;
	(void) strlcpy(zhp->zpool_name, pool, sizeof (zhp->zpool_name));

	if (zpool_refresh_stats(zhp, &missing) != 0) {
	zpool_close(zhp);
	return (NULL);
	}

	if (missing) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "no such pool"));
	(void) zfs_error_fmt(hdl, EZFS_NOENT,
	dgettext(TEXT_DOMAIN, "cannot open '%s'"), pool);
	zpool_close(zhp);
	return (NULL);
	}

	return (zhp);
	}

	/*
	* Like the above, but silent on error. Used when iterating over pools (because
	* the configuration cache may be out of date).
	*/
	int
	zpool_open_silent(libzfs_handle_t hdl, const char pool, zpool_handle_t **ret)
	{
	zpool_handle_t *zhp;
	boolean_t missing;

	if ((zhp = zfs_alloc(hdl, sizeof (zpool_handle_t))) == NULL)
	return (-1);

	zhp->zpool_hdl = hdl;
	(void) strlcpy(zhp->zpool_name, pool, sizeof (zhp->zpool_name));

	if (zpool_refresh_stats(zhp, &missing) != 0) {
	zpool_close(zhp);
	return (-1);
	}

	if (missing) {
	zpool_close(zhp);
	*ret = NULL;
	return (0);
	}

	*ret = zhp;
	return (0);
	}

	/*
	* Similar to zpool_open_canfail(), but refuses to open pools in the faulted
	* state.
	*/
	zpool_handle_t *
	zpool_open(libzfs_handle_t hdl, const char pool)
	{
	zpool_handle_t *zhp;

	if ((zhp = zpool_open_canfail(hdl, pool)) == NULL)
	return (NULL);

	if (zhp->zpool_state == POOL_STATE_UNAVAIL) {
	(void) zfs_error_fmt(hdl, EZFS_POOLUNAVAIL,
	dgettext(TEXT_DOMAIN, "cannot open '%s'"), zhp->zpool_name);
	zpool_close(zhp);
	return (NULL);
	}

	return (zhp);
	}

	/*
	* Close the handle. Simply frees the memory associated with the handle.
	*/
	void
	zpool_close(zpool_handle_t *zhp)
	{
	nvlist_free(zhp->zpool_config);
	nvlist_free(zhp->zpool_old_config);
	nvlist_free(zhp->zpool_props);
	free(zhp);
	}

	/*
	* Return the name of the pool.
	*/
	const char *
	zpool_get_name(zpool_handle_t *zhp)
	{
	return (zhp->zpool_name);
	}


	/*
	* Return the state of the pool (ACTIVE or UNAVAILABLE)
	*/
	int
	zpool_get_state(zpool_handle_t *zhp)
	{
	return (zhp->zpool_state);
	}

	/*
	* Check if vdev list contains a special vdev
	*/
	static boolean_t
	zpool_has_special_vdev(nvlist_t *nvroot)
	{
	nvlist_t **child;
	uint_t children;

	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_CHILDREN, &child,
	&children) == 0) {
	for (uint_t c = 0; c < children; c++) {
	char *bias;

	if (nvlist_lookup_string(child[c],
	ZPOOL_CONFIG_ALLOCATION_BIAS, &bias) == 0 &&
	strcmp(bias, VDEV_ALLOC_BIAS_SPECIAL) == 0) {
	return (B_TRUE);
	}
	}
	}
	return (B_FALSE);
	}

	/*
	* Create the named pool, using the provided vdev list. It is assumed
	* that the consumer has already validated the contents of the nvlist, so we
	* don't have to worry about error semantics.
	*/
	int
	zpool_create(libzfs_handle_t hdl, const char pool, nvlist_t *nvroot,
	nvlist_t props, nvlist_t fsprops)
	{
	zfs_cmd_t zc = {"\0"};
	nvlist_t *zc_fsprops = NULL;
	nvlist_t *zc_props = NULL;
	nvlist_t *hidden_args = NULL;
	uint8_t *wkeydata = NULL;
	uint_t wkeylen = 0;
	char msg[1024];
	int ret = -1;

	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot create '%s'"), pool);

	if (!zpool_name_valid(hdl, B_FALSE, pool))
	return (zfs_error(hdl, EZFS_INVALIDNAME, msg));

	if (zcmd_write_conf_nvlist(hdl, &zc, nvroot) != 0)
	return (-1);

	if (props) {
	prop_flags_t flags = { .create = B_TRUE, .import = B_FALSE };

	if ((zc_props = zpool_valid_proplist(hdl, pool, props,
	SPA_VERSION_1, flags, msg)) == NULL) {
	goto create_failed;
	}
	}

	if (fsprops) {
	uint64_t zoned;
	char *zonestr;

	zoned = ((nvlist_lookup_string(fsprops,
	zfs_prop_to_name(ZFS_PROP_ZONED), &zonestr) == 0) &&
	strcmp(zonestr, "on") == 0);

	if ((zc_fsprops = zfs_valid_proplist(hdl, ZFS_TYPE_FILESYSTEM,
	fsprops, zoned, NULL, NULL, B_TRUE, msg)) == NULL) {
	goto create_failed;
	}

	if (nvlist_exists(zc_fsprops,
	zfs_prop_to_name(ZFS_PROP_SPECIAL_SMALL_BLOCKS)) &&
	!zpool_has_special_vdev(nvroot)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"%s property requires a special vdev"),
	zfs_prop_to_name(ZFS_PROP_SPECIAL_SMALL_BLOCKS));
	(void) zfs_error(hdl, EZFS_BADPROP, msg);
	goto create_failed;
	}

	if (!zc_props &&
	(nvlist_alloc(&zc_props, NV_UNIQUE_NAME, 0) != 0)) {
	goto create_failed;
	}
	if (zfs_crypto_create(hdl, NULL, zc_fsprops, props, B_TRUE,
	&wkeydata, &wkeylen) != 0) {
	zfs_error(hdl, EZFS_CRYPTOFAILED, msg);
	goto create_failed;
	}
	if (nvlist_add_nvlist(zc_props,
	ZPOOL_ROOTFS_PROPS, zc_fsprops) != 0) {
	goto create_failed;
	}
	if (wkeydata != NULL) {
	if (nvlist_alloc(&hidden_args, NV_UNIQUE_NAME, 0) != 0)
	goto create_failed;

	if (nvlist_add_uint8_array(hidden_args, "wkeydata",
	wkeydata, wkeylen) != 0)
	goto create_failed;

	if (nvlist_add_nvlist(zc_props, ZPOOL_HIDDEN_ARGS,
	hidden_args) != 0)
	goto create_failed;
	}
	}

	if (zc_props && zcmd_write_src_nvlist(hdl, &zc, zc_props) != 0)
	goto create_failed;

	(void) strlcpy(zc.zc_name, pool, sizeof (zc.zc_name));

	if ((ret = zfs_ioctl(hdl, ZFS_IOC_POOL_CREATE, &zc)) != 0) {

	zcmd_free_nvlists(&zc);
	nvlist_free(zc_props);
	nvlist_free(zc_fsprops);
	nvlist_free(hidden_args);
	if (wkeydata != NULL)
	free(wkeydata);

	switch (errno) {
	case EBUSY:
	/*
	* This can happen if the user has specified the same
	* device multiple times. We can't reliably detect this
	* until we try to add it and see we already have a
	* label. This can also happen under if the device is
	* part of an active md or lvm device.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"one or more vdevs refer to the same device, or "
	"one of\nthe devices is part of an active md or "
	"lvm device"));
	return (zfs_error(hdl, EZFS_BADDEV, msg));

	case ERANGE:
	/*
	* This happens if the record size is smaller or larger
	* than the allowed size range, or not a power of 2.
	*
	* NOTE: although zfs_valid_proplist is called earlier,
	* this case may have slipped through since the
	* pool does not exist yet and it is therefore
	* impossible to read properties e.g. max blocksize
	* from the pool.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"record size invalid"));
	return (zfs_error(hdl, EZFS_BADPROP, msg));

	case EOVERFLOW:
	/*
	* This occurs when one of the devices is below
	* SPA_MINDEVSIZE. Unfortunately, we can't detect which
	* device was the problem device since there's no
	* reliable way to determine device size from userland.
	*/
	{
	char buf[64];

	zfs_nicebytes(SPA_MINDEVSIZE, buf,
	sizeof (buf));

	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"one or more devices is less than the "
	"minimum size (%s)"), buf);
	}
	return (zfs_error(hdl, EZFS_BADDEV, msg));

	case ENOSPC:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"one or more devices is out of space"));
	return (zfs_error(hdl, EZFS_BADDEV, msg));

	default:
	return (zpool_standard_error(hdl, errno, msg));
	}
	}

	create_failed:
	zcmd_free_nvlists(&zc);
	nvlist_free(zc_props);
	nvlist_free(zc_fsprops);
	nvlist_free(hidden_args);
	if (wkeydata != NULL)
	free(wkeydata);
	return (ret);
	}

	/*
	* Destroy the given pool. It is up to the caller to ensure that there are no
	* datasets left in the pool.
	*/
	int
	zpool_destroy(zpool_handle_t zhp, const char log_str)
	{
	zfs_cmd_t zc = {"\0"};
	zfs_handle_t *zfp = NULL;
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	char msg[1024];

	if (zhp->zpool_state == POOL_STATE_ACTIVE &&
	(zfp = zfs_open(hdl, zhp->zpool_name, ZFS_TYPE_FILESYSTEM)) == NULL)
	return (-1);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	zc.zc_history = (uint64_t)(uintptr_t)log_str;

	if (zfs_ioctl(hdl, ZFS_IOC_POOL_DESTROY, &zc) != 0) {
	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot destroy '%s'"), zhp->zpool_name);

	if (errno == EROFS) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"one or more devices is read only"));
	(void) zfs_error(hdl, EZFS_BADDEV, msg);
	} else {
	(void) zpool_standard_error(hdl, errno, msg);
	}

	if (zfp)
	zfs_close(zfp);
	return (-1);
	}

	if (zfp) {
	remove_mountpoint(zfp);
	zfs_close(zfp);
	}

	return (0);
	}

	/*
	* Create a checkpoint in the given pool.
	*/
	int
	zpool_checkpoint(zpool_handle_t *zhp)
	{
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	char msg[1024];
	int error;

	error = lzc_pool_checkpoint(zhp->zpool_name);
	if (error != 0) {
	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot checkpoint '%s'"), zhp->zpool_name);
	(void) zpool_standard_error(hdl, error, msg);
	return (-1);
	}

	return (0);
	}

	/*
	* Discard the checkpoint from the given pool.
	*/
	int
	zpool_discard_checkpoint(zpool_handle_t *zhp)
	{
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	char msg[1024];
	int error;

	error = lzc_pool_checkpoint_discard(zhp->zpool_name);
	if (error != 0) {
	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot discard checkpoint in '%s'"), zhp->zpool_name);
	(void) zpool_standard_error(hdl, error, msg);
	return (-1);
	}

	return (0);
	}

	/*
	* Add the given vdevs to the pool. The caller must have already performed the
	* necessary verification to ensure that the vdev specification is well-formed.
	*/
	int
	zpool_add(zpool_handle_t zhp, nvlist_t nvroot)
	{
	zfs_cmd_t zc = {"\0"};
	int ret;
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	char msg[1024];
	nvlist_t spares, l2cache;
	uint_t nspares, nl2cache;

	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot add to '%s'"), zhp->zpool_name);

	if (zpool_get_prop_int(zhp, ZPOOL_PROP_VERSION, NULL) <
	SPA_VERSION_SPARES &&
	nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_SPARES,
	&spares, &nspares) == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "pool must be "
	"upgraded to add hot spares"));
	return (zfs_error(hdl, EZFS_BADVERSION, msg));
	}

	if (zpool_get_prop_int(zhp, ZPOOL_PROP_VERSION, NULL) <
	SPA_VERSION_L2CACHE &&
	nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_L2CACHE,
	&l2cache, &nl2cache) == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "pool must be "
	"upgraded to add cache devices"));
	return (zfs_error(hdl, EZFS_BADVERSION, msg));
	}

	if (zcmd_write_conf_nvlist(hdl, &zc, nvroot) != 0)
	return (-1);
	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_ADD, &zc) != 0) {
	switch (errno) {
	case EBUSY:
	/*
	* This can happen if the user has specified the same
	* device multiple times. We can't reliably detect this
	* until we try to add it and see we already have a
	* label.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"one or more vdevs refer to the same device"));
	(void) zfs_error(hdl, EZFS_BADDEV, msg);
	break;

	case EINVAL:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid config; a pool with removing/removed "
	"vdevs does not support adding raidz vdevs"));
	(void) zfs_error(hdl, EZFS_BADDEV, msg);
	break;

	case EOVERFLOW:
	/*
	* This occurs when one of the devices is below
	* SPA_MINDEVSIZE. Unfortunately, we can't detect which
	* device was the problem device since there's no
	* reliable way to determine device size from userland.
	*/
	{
	char buf[64];

	zfs_nicebytes(SPA_MINDEVSIZE, buf,
	sizeof (buf));

	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"device is less than the minimum "
	"size (%s)"), buf);
	}
	(void) zfs_error(hdl, EZFS_BADDEV, msg);
	break;

	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded to add these vdevs"));
	(void) zfs_error(hdl, EZFS_BADVERSION, msg);
	break;

	default:
	(void) zpool_standard_error(hdl, errno, msg);
	}

	ret = -1;
	} else {
	ret = 0;
	}

	zcmd_free_nvlists(&zc);

	return (ret);
	}

	/*
	* Exports the pool from the system. The caller must ensure that there are no
	* mounted datasets in the pool.
	*/
	static int
	zpool_export_common(zpool_handle_t *zhp, boolean_t force, boolean_t hardforce,
	const char *log_str)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];

	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot export '%s'"), zhp->zpool_name);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	zc.zc_cookie = force;
	zc.zc_guid = hardforce;
	zc.zc_history = (uint64_t)(uintptr_t)log_str;

	if (zfs_ioctl(zhp->zpool_hdl, ZFS_IOC_POOL_EXPORT, &zc) != 0) {
	switch (errno) {
	case EXDEV:
	zfs_error_aux(zhp->zpool_hdl, dgettext(TEXT_DOMAIN,
	"use '-f' to override the following errors:\n"
	"'%s' has an active shared spare which could be"
	" used by other pools once '%s' is exported."),
	zhp->zpool_name, zhp->zpool_name);
	return (zfs_error(zhp->zpool_hdl, EZFS_ACTIVE_SPARE,
	msg));
	default:
	return (zpool_standard_error_fmt(zhp->zpool_hdl, errno,
	msg));
	}
	}

	return (0);
	}

	int
	zpool_export(zpool_handle_t zhp, boolean_t force, const char log_str)
	{
	return (zpool_export_common(zhp, force, B_FALSE, log_str));
	}

	int
	zpool_export_force(zpool_handle_t zhp, const char log_str)
	{
	return (zpool_export_common(zhp, B_TRUE, B_TRUE, log_str));
	}

	static void
	zpool_rewind_exclaim(libzfs_handle_t hdl, const char name, boolean_t dryrun,
	nvlist_t *config)
	{
	nvlist_t *nv = NULL;
	uint64_t rewindto;
	int64_t loss = -1;
	struct tm t;
	char timestr[128];

	if (!hdl->libzfs_printerr \|\| config == NULL)
	return;

	if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_LOAD_INFO, &nv) != 0 \|\|
	nvlist_lookup_nvlist(nv, ZPOOL_CONFIG_REWIND_INFO, &nv) != 0) {
	return;
	}

	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_LOAD_TIME, &rewindto) != 0)
	return;
	(void) nvlist_lookup_int64(nv, ZPOOL_CONFIG_REWIND_TIME, &loss);

	if (localtime_r((time_t *)&rewindto, &t) != NULL &&
	strftime(timestr, 128, "%c", &t) != 0) {
	if (dryrun) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"Would be able to return %s "
	"to its state as of %s.\n"),
	name, timestr);
	} else {
	(void) printf(dgettext(TEXT_DOMAIN,
	"Pool %s returned to its state as of %s.\n"),
	name, timestr);
	}
	if (loss > 120) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"%s approximately %lld "),
	dryrun ? "Would discard" : "Discarded",
	((longlong_t)loss + 30) / 60);
	(void) printf(dgettext(TEXT_DOMAIN,
	"minutes of transactions.\n"));
	} else if (loss > 0) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"%s approximately %lld "),
	dryrun ? "Would discard" : "Discarded",
	(longlong_t)loss);
	(void) printf(dgettext(TEXT_DOMAIN,
	"seconds of transactions.\n"));
	}
	}
	}

	void
	zpool_explain_recover(libzfs_handle_t hdl, const char name, int reason,
	nvlist_t *config)
	{
	nvlist_t *nv = NULL;
	int64_t loss = -1;
	uint64_t edata = UINT64_MAX;
	uint64_t rewindto;
	struct tm t;
	char timestr[128];

	if (!hdl->libzfs_printerr)
	return;

	if (reason >= 0)
	(void) printf(dgettext(TEXT_DOMAIN, "action: "));
	else
	(void) printf(dgettext(TEXT_DOMAIN, "\t"));

	/* All attempted rewinds failed if ZPOOL_CONFIG_LOAD_TIME missing */
	if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_LOAD_INFO, &nv) != 0 \|\|
	nvlist_lookup_nvlist(nv, ZPOOL_CONFIG_REWIND_INFO, &nv) != 0 \|\|
	nvlist_lookup_uint64(nv, ZPOOL_CONFIG_LOAD_TIME, &rewindto) != 0)
	goto no_info;

	(void) nvlist_lookup_int64(nv, ZPOOL_CONFIG_REWIND_TIME, &loss);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_LOAD_DATA_ERRORS,
	&edata);

	(void) printf(dgettext(TEXT_DOMAIN,
	"Recovery is possible, but will result in some data loss.\n"));

	if (localtime_r((time_t *)&rewindto, &t) != NULL &&
	strftime(timestr, 128, "%c", &t) != 0) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"\tReturning the pool to its state as of %s\n"
	"\tshould correct the problem. "),
	timestr);
	} else {
	(void) printf(dgettext(TEXT_DOMAIN,
	"\tReverting the pool to an earlier state "
	"should correct the problem.\n\t"));
	}

	if (loss > 120) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"Approximately %lld minutes of data\n"
	"\tmust be discarded, irreversibly. "),
	((longlong_t)loss + 30) / 60);
	} else if (loss > 0) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"Approximately %lld seconds of data\n"
	"\tmust be discarded, irreversibly. "),
	(longlong_t)loss);
	}
	if (edata != 0 && edata != UINT64_MAX) {
	if (edata == 1) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"After rewind, at least\n"
	"\tone persistent user-data error will remain. "));
	} else {
	(void) printf(dgettext(TEXT_DOMAIN,
	"After rewind, several\n"
	"\tpersistent user-data errors will remain. "));
	}
	}
	(void) printf(dgettext(TEXT_DOMAIN,
	"Recovery can be attempted\n\tby executing 'zpool %s -F %s'. "),
	reason >= 0 ? "clear" : "import", name);

	(void) printf(dgettext(TEXT_DOMAIN,
	"A scrub of the pool\n"
	"\tis strongly recommended after recovery.\n"));
	return;

	no_info:
	(void) printf(dgettext(TEXT_DOMAIN,
	"Destroy and re-create the pool from\n\ta backup source.\n"));
	}

	/*
	* zpool_import() is a contracted interface. Should be kept the same
	* if possible.
	*
	* Applications should use zpool_import_props() to import a pool with
	* new properties value to be set.
	*/
	int
	zpool_import(libzfs_handle_t hdl, nvlist_t config, const char *newname,
	char *altroot)
	{
	nvlist_t *props = NULL;
	int ret;

	if (altroot != NULL) {
	if (nvlist_alloc(&props, NV_UNIQUE_NAME, 0) != 0) {
	return (zfs_error_fmt(hdl, EZFS_NOMEM,
	dgettext(TEXT_DOMAIN, "cannot import '%s'"),
	newname));
	}

	if (nvlist_add_string(props,
	zpool_prop_to_name(ZPOOL_PROP_ALTROOT), altroot) != 0 \|\|
	nvlist_add_string(props,
	zpool_prop_to_name(ZPOOL_PROP_CACHEFILE), "none") != 0) {
	nvlist_free(props);
	return (zfs_error_fmt(hdl, EZFS_NOMEM,
	dgettext(TEXT_DOMAIN, "cannot import '%s'"),
	newname));
	}
	}

	ret = zpool_import_props(hdl, config, newname, props,
	ZFS_IMPORT_NORMAL);
	nvlist_free(props);
	return (ret);
	}

	static void
	print_vdev_tree(libzfs_handle_t hdl, const char name, nvlist_t *nv,
	int indent)
	{
	nvlist_t **child;
	uint_t c, children;
	char *vname;
	uint64_t is_log = 0;

	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_IS_LOG,
	&is_log);

	if (name != NULL)
	(void) printf("\t%*s%s%s\n", indent, "", name,
	is_log ? " [log]" : "");

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	return;

	for (c = 0; c < children; c++) {
	vname = zpool_vdev_name(hdl, NULL, child[c], VDEV_NAME_TYPE_ID);
	print_vdev_tree(hdl, vname, child[c], indent + 2);
	free(vname);
	}
	}

	void
	zpool_print_unsup_feat(nvlist_t *config)
	{
	nvlist_t nvinfo, unsup_feat;
	nvpair_t *nvp;

	verify(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_LOAD_INFO, &nvinfo) ==
	0);
	verify(nvlist_lookup_nvlist(nvinfo, ZPOOL_CONFIG_UNSUP_FEAT,
	&unsup_feat) == 0);

	for (nvp = nvlist_next_nvpair(unsup_feat, NULL); nvp != NULL;
	nvp = nvlist_next_nvpair(unsup_feat, nvp)) {
	char *desc;

	verify(nvpair_type(nvp) == DATA_TYPE_STRING);
	verify(nvpair_value_string(nvp, &desc) == 0);

	if (strlen(desc) > 0)
	(void) printf("\t%s (%s)\n", nvpair_name(nvp), desc);
	else
	(void) printf("\t%s\n", nvpair_name(nvp));
	}
	}

	/*
	* Import the given pool using the known configuration and a list of
	* properties to be set. The configuration should have come from
	* zpool_find_import(). The 'newname' parameters control whether the pool
	* is imported with a different name.
	*/
	int
	zpool_import_props(libzfs_handle_t hdl, nvlist_t config, const char *newname,
	nvlist_t *props, int flags)
	{
	zfs_cmd_t zc = {"\0"};
	zpool_load_policy_t policy;
	nvlist_t *nv = NULL;
	nvlist_t *nvinfo = NULL;
	nvlist_t *missing = NULL;
	char *thename;
	char *origname;
	int ret;
	int error = 0;
	char errbuf[1024];

	verify(nvlist_lookup_string(config, ZPOOL_CONFIG_POOL_NAME,
	&origname) == 0);

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot import pool '%s'"), origname);

	if (newname != NULL) {
	if (!zpool_name_valid(hdl, B_FALSE, newname))
	return (zfs_error_fmt(hdl, EZFS_INVALIDNAME,
	dgettext(TEXT_DOMAIN, "cannot import '%s'"),
	newname));
	thename = (char *)newname;
	} else {
	thename = origname;
	}

	if (props != NULL) {
	uint64_t version;
	prop_flags_t flags = { .create = B_FALSE, .import = B_TRUE };

	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION,
	&version) == 0);

	if ((props = zpool_valid_proplist(hdl, origname,
	props, version, flags, errbuf)) == NULL)
	return (-1);
	if (zcmd_write_src_nvlist(hdl, &zc, props) != 0) {
	nvlist_free(props);
	return (-1);
	}
	nvlist_free(props);
	}

	(void) strlcpy(zc.zc_name, thename, sizeof (zc.zc_name));

	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID,
	&zc.zc_guid) == 0);

	if (zcmd_write_conf_nvlist(hdl, &zc, config) != 0) {
	zcmd_free_nvlists(&zc);
	return (-1);
	}
	if (zcmd_alloc_dst_nvlist(hdl, &zc, zc.zc_nvlist_conf_size * 2) != 0) {
	zcmd_free_nvlists(&zc);
	return (-1);
	}

	zc.zc_cookie = flags;
	while ((ret = zfs_ioctl(hdl, ZFS_IOC_POOL_IMPORT, &zc)) != 0 &&
	errno == ENOMEM) {
	if (zcmd_expand_dst_nvlist(hdl, &zc) != 0) {
	zcmd_free_nvlists(&zc);
	return (-1);
	}
	}
	if (ret != 0)
	error = errno;

	(void) zcmd_read_dst_nvlist(hdl, &zc, &nv);

	zcmd_free_nvlists(&zc);

	zpool_get_load_policy(config, &policy);

	if (error) {
	char desc[1024];
	char aux[256];

	/*
	* Dry-run failed, but we print out what success
	* looks like if we found a best txg
	*/
	if (policy.zlp_rewind & ZPOOL_TRY_REWIND) {
	zpool_rewind_exclaim(hdl, newname ? origname : thename,
	B_TRUE, nv);
	nvlist_free(nv);
	return (-1);
	}

	if (newname == NULL)
	(void) snprintf(desc, sizeof (desc),
	dgettext(TEXT_DOMAIN, "cannot import '%s'"),
	thename);
	else
	(void) snprintf(desc, sizeof (desc),
	dgettext(TEXT_DOMAIN, "cannot import '%s' as '%s'"),
	origname, thename);

	switch (error) {
	case ENOTSUP:
	if (nv != NULL && nvlist_lookup_nvlist(nv,
	ZPOOL_CONFIG_LOAD_INFO, &nvinfo) == 0 &&
	nvlist_exists(nvinfo, ZPOOL_CONFIG_UNSUP_FEAT)) {
	(void) printf(dgettext(TEXT_DOMAIN, "This "
	"pool uses the following feature(s) not "
	"supported by this system:\n"));
	zpool_print_unsup_feat(nv);
	if (nvlist_exists(nvinfo,
	ZPOOL_CONFIG_CAN_RDONLY)) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"All unsupported features are only "
	"required for writing to the pool."
	"\nThe pool can be imported using "
	"'-o readonly=on'.\n"));
	}
	}
	/*
	* Unsupported version.
	*/
	(void) zfs_error(hdl, EZFS_BADVERSION, desc);
	break;

	case EREMOTEIO:
	if (nv != NULL && nvlist_lookup_nvlist(nv,
	ZPOOL_CONFIG_LOAD_INFO, &nvinfo) == 0) {
	char *hostname = "<unknown>";
	uint64_t hostid = 0;
	mmp_state_t mmp_state;

	mmp_state = fnvlist_lookup_uint64(nvinfo,
	ZPOOL_CONFIG_MMP_STATE);

	if (nvlist_exists(nvinfo,
	ZPOOL_CONFIG_MMP_HOSTNAME))
	hostname = fnvlist_lookup_string(nvinfo,
	ZPOOL_CONFIG_MMP_HOSTNAME);

	if (nvlist_exists(nvinfo,
	ZPOOL_CONFIG_MMP_HOSTID))
	hostid = fnvlist_lookup_uint64(nvinfo,
	ZPOOL_CONFIG_MMP_HOSTID);

	if (mmp_state == MMP_STATE_ACTIVE) {
	(void) snprintf(aux, sizeof (aux),
	dgettext(TEXT_DOMAIN, "pool is imp"
	"orted on host '%s' (hostid=%lx).\n"
	"Export the pool on the other "
	"system, then run 'zpool import'."),
	hostname, (unsigned long) hostid);
	} else if (mmp_state == MMP_STATE_NO_HOSTID) {
	(void) snprintf(aux, sizeof (aux),
	dgettext(TEXT_DOMAIN, "pool has "
	"the multihost property on and "
	"the\nsystem's hostid is not set. "
	"Set a unique system hostid with "
	"the zgenhostid(8) command.\n"));
	}

	(void) zfs_error_aux(hdl, aux);
	}
	(void) zfs_error(hdl, EZFS_ACTIVE_POOL, desc);
	break;

	case EINVAL:
	(void) zfs_error(hdl, EZFS_INVALCONFIG, desc);
	break;

	case EROFS:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"one or more devices is read only"));
	(void) zfs_error(hdl, EZFS_BADDEV, desc);
	break;

	case ENXIO:
	if (nv && nvlist_lookup_nvlist(nv,
	ZPOOL_CONFIG_LOAD_INFO, &nvinfo) == 0 &&
	nvlist_lookup_nvlist(nvinfo,
	ZPOOL_CONFIG_MISSING_DEVICES, &missing) == 0) {
	(void) printf(dgettext(TEXT_DOMAIN,
	"The devices below are missing or "
	"corrupted, use '-m' to import the pool "
	"anyway:\n"));
	print_vdev_tree(hdl, NULL, missing, 2);
	(void) printf("\n");
	}
	(void) zpool_standard_error(hdl, error, desc);
	break;

	case EEXIST:
	(void) zpool_standard_error(hdl, error, desc);
	break;

	case EBUSY:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"one or more devices are already in use\n"));
	(void) zfs_error(hdl, EZFS_BADDEV, desc);
	break;
	case ENAMETOOLONG:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"new name of at least one dataset is longer than "
	"the maximum allowable length"));
	(void) zfs_error(hdl, EZFS_NAMETOOLONG, desc);
	break;
	default:
	(void) zpool_standard_error(hdl, error, desc);
	zpool_explain_recover(hdl,
	newname ? origname : thename, -error, nv);
	break;
	}

	nvlist_free(nv);
	ret = -1;
	} else {
	zpool_handle_t *zhp;

	/*
	* This should never fail, but play it safe anyway.
	*/
	if (zpool_open_silent(hdl, thename, &zhp) != 0)
	ret = -1;
	else if (zhp != NULL)
	zpool_close(zhp);
	if (policy.zlp_rewind &
	(ZPOOL_DO_REWIND \| ZPOOL_TRY_REWIND)) {
	zpool_rewind_exclaim(hdl, newname ? origname : thename,
	((policy.zlp_rewind & ZPOOL_TRY_REWIND) != 0), nv);
	}
	nvlist_free(nv);
	return (0);
	}

	return (ret);
	}

	/*
	* Translate vdev names to guids. If a vdev_path is determined to be
	* unsuitable then a vd_errlist is allocated and the vdev path and errno
	* are added to it.
	*/
	static int
	zpool_translate_vdev_guids(zpool_handle_t zhp, nvlist_t vds,
	nvlist_t vdev_guids, nvlist_t guids_to_paths, nvlist_t **vd_errlist)
	{
	nvlist_t *errlist = NULL;
	int error = 0;

	for (nvpair_t *elem = nvlist_next_nvpair(vds, NULL); elem != NULL;
	elem = nvlist_next_nvpair(vds, elem)) {
	boolean_t spare, cache;

	char *vd_path = nvpair_name(elem);
	nvlist_t *tgt = zpool_find_vdev(zhp, vd_path, &spare, &cache,
	NULL);

	if ((tgt == NULL) \|\| cache \|\| spare) {
	if (errlist == NULL) {
	errlist = fnvlist_alloc();
	error = EINVAL;
	}

	uint64_t err = (tgt == NULL) ? EZFS_NODEVICE :
	(spare ? EZFS_ISSPARE : EZFS_ISL2CACHE);
	fnvlist_add_int64(errlist, vd_path, err);
	continue;
	}

	uint64_t guid = fnvlist_lookup_uint64(tgt, ZPOOL_CONFIG_GUID);
	fnvlist_add_uint64(vdev_guids, vd_path, guid);

	char msg[MAXNAMELEN];
	(void) snprintf(msg, sizeof (msg), "%llu", (u_longlong_t)guid);
	fnvlist_add_string(guids_to_paths, msg, vd_path);
	}

	if (error != 0) {
	verify(errlist != NULL);
	if (vd_errlist != NULL)
	*vd_errlist = errlist;
	else
	fnvlist_free(errlist);
	}

	return (error);
	}

	static int
	xlate_init_err(int err)
	{
	switch (err) {
	case ENODEV:
	return (EZFS_NODEVICE);
	case EINVAL:
	case EROFS:
	return (EZFS_BADDEV);
	case EBUSY:
	return (EZFS_INITIALIZING);
	case ESRCH:
	return (EZFS_NO_INITIALIZE);
	}
	return (err);
	}

	/*
	* Begin, suspend, or cancel the initialization (initializing of all free
	* blocks) for the given vdevs in the given pool.
	*/
	static int
	zpool_initialize_impl(zpool_handle_t *zhp, pool_initialize_func_t cmd_type,
	nvlist_t *vds, boolean_t wait)
	{
	int err;

	nvlist_t *vdev_guids = fnvlist_alloc();
	nvlist_t *guids_to_paths = fnvlist_alloc();
	nvlist_t *vd_errlist = NULL;
	nvlist_t *errlist;
	nvpair_t *elem;

	err = zpool_translate_vdev_guids(zhp, vds, vdev_guids,
	guids_to_paths, &vd_errlist);

	if (err != 0) {
	verify(vd_errlist != NULL);
	goto list_errors;
	}

	err = lzc_initialize(zhp->zpool_name, cmd_type,
	vdev_guids, &errlist);

	if (err != 0) {
	if (errlist != NULL) {
	vd_errlist = fnvlist_lookup_nvlist(errlist,
	ZPOOL_INITIALIZE_VDEVS);
	goto list_errors;
	}
	(void) zpool_standard_error(zhp->zpool_hdl, err,
	dgettext(TEXT_DOMAIN, "operation failed"));
	goto out;
	}

	if (wait) {
	for (elem = nvlist_next_nvpair(vdev_guids, NULL); elem != NULL;
	elem = nvlist_next_nvpair(vdev_guids, elem)) {

	uint64_t guid = fnvpair_value_uint64(elem);

	err = lzc_wait_tag(zhp->zpool_name,
	ZPOOL_WAIT_INITIALIZE, guid, NULL);
	if (err != 0) {
	(void) zpool_standard_error_fmt(zhp->zpool_hdl,
	err, dgettext(TEXT_DOMAIN, "error "
	"waiting for '%s' to initialize"),
	nvpair_name(elem));

	goto out;
	}
	}
	}
	goto out;

	list_errors:
	for (elem = nvlist_next_nvpair(vd_errlist, NULL); elem != NULL;
	elem = nvlist_next_nvpair(vd_errlist, elem)) {
	int64_t vd_error = xlate_init_err(fnvpair_value_int64(elem));
	char *path;

	if (nvlist_lookup_string(guids_to_paths, nvpair_name(elem),
	&path) != 0)
	path = nvpair_name(elem);

	(void) zfs_error_fmt(zhp->zpool_hdl, vd_error,
	"cannot initialize '%s'", path);
	}

	out:
	fnvlist_free(vdev_guids);
	fnvlist_free(guids_to_paths);

	if (vd_errlist != NULL)
	fnvlist_free(vd_errlist);

	return (err == 0 ? 0 : -1);
	}

	int
	zpool_initialize(zpool_handle_t *zhp, pool_initialize_func_t cmd_type,
	nvlist_t *vds)
	{
	return (zpool_initialize_impl(zhp, cmd_type, vds, B_FALSE));
	}

	int
	zpool_initialize_wait(zpool_handle_t *zhp, pool_initialize_func_t cmd_type,
	nvlist_t *vds)
	{
	return (zpool_initialize_impl(zhp, cmd_type, vds, B_TRUE));
	}

	static int
	xlate_trim_err(int err)
	{
	switch (err) {
	case ENODEV:
	return (EZFS_NODEVICE);
	case EINVAL:
	case EROFS:
	return (EZFS_BADDEV);
	case EBUSY:
	return (EZFS_TRIMMING);
	case ESRCH:
	return (EZFS_NO_TRIM);
	case EOPNOTSUPP:
	return (EZFS_TRIM_NOTSUP);
	}
	return (err);
	}

	static int
	zpool_trim_wait(zpool_handle_t zhp, nvlist_t vdev_guids)
	{
	int err;
	nvpair_t *elem;

	for (elem = nvlist_next_nvpair(vdev_guids, NULL); elem != NULL;
	elem = nvlist_next_nvpair(vdev_guids, elem)) {

	uint64_t guid = fnvpair_value_uint64(elem);

	err = lzc_wait_tag(zhp->zpool_name,
	ZPOOL_WAIT_TRIM, guid, NULL);
	if (err != 0) {
	(void) zpool_standard_error_fmt(zhp->zpool_hdl,
	err, dgettext(TEXT_DOMAIN, "error "
	"waiting to trim '%s'"), nvpair_name(elem));

	return (err);
	}
	}
	return (0);
	}

	/*
	* Check errlist and report any errors, omitting ones which should be
	* suppressed. Returns B_TRUE if any errors were reported.
	*/
	static boolean_t
	check_trim_errs(zpool_handle_t zhp, trimflags_t trim_flags,
	nvlist_t guids_to_paths, nvlist_t vds, nvlist_t *errlist)
	{
	nvpair_t *elem;
	boolean_t reported_errs = B_FALSE;
	int num_vds = 0;
	int num_suppressed_errs = 0;

	for (elem = nvlist_next_nvpair(vds, NULL);
	elem != NULL; elem = nvlist_next_nvpair(vds, elem)) {
	num_vds++;
	}

	for (elem = nvlist_next_nvpair(errlist, NULL);
	elem != NULL; elem = nvlist_next_nvpair(errlist, elem)) {
	int64_t vd_error = xlate_trim_err(fnvpair_value_int64(elem));
	char *path;

	/*
	* If only the pool was specified, and it was not a secure
	* trim then suppress warnings for individual vdevs which
	* do not support trimming.
	*/
	if (vd_error == EZFS_TRIM_NOTSUP &&
	trim_flags->fullpool &&
	!trim_flags->secure) {
	num_suppressed_errs++;
	continue;
	}

	reported_errs = B_TRUE;
	if (nvlist_lookup_string(guids_to_paths, nvpair_name(elem),
	&path) != 0)
	path = nvpair_name(elem);

	(void) zfs_error_fmt(zhp->zpool_hdl, vd_error,
	"cannot trim '%s'", path);
	}

	if (num_suppressed_errs == num_vds) {
	(void) zfs_error_aux(zhp->zpool_hdl, dgettext(TEXT_DOMAIN,
	"no devices in pool support trim operations"));
	(void) (zfs_error(zhp->zpool_hdl, EZFS_TRIM_NOTSUP,
	dgettext(TEXT_DOMAIN, "cannot trim")));
	reported_errs = B_TRUE;
	}

	return (reported_errs);
	}

	/*
	* Begin, suspend, or cancel the TRIM (discarding of all free blocks) for
	* the given vdevs in the given pool.
	*/
	int
	zpool_trim(zpool_handle_t zhp, pool_trim_func_t cmd_type, nvlist_t vds,
	trimflags_t *trim_flags)
	{
	int err;
	int retval = 0;

	nvlist_t *vdev_guids = fnvlist_alloc();
	nvlist_t *guids_to_paths = fnvlist_alloc();
	nvlist_t *errlist = NULL;

	err = zpool_translate_vdev_guids(zhp, vds, vdev_guids,
	guids_to_paths, &errlist);
	if (err != 0) {
	check_trim_errs(zhp, trim_flags, guids_to_paths, vds, errlist);
	retval = -1;
	goto out;
	}

	err = lzc_trim(zhp->zpool_name, cmd_type, trim_flags->rate,
	trim_flags->secure, vdev_guids, &errlist);
	if (err != 0) {
	nvlist_t *vd_errlist;
	if (errlist != NULL && nvlist_lookup_nvlist(errlist,
	ZPOOL_TRIM_VDEVS, &vd_errlist) == 0) {
	if (check_trim_errs(zhp, trim_flags, guids_to_paths,
	vds, vd_errlist)) {
	retval = -1;
	goto out;
	}
	} else {
	char msg[1024];

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "operation failed"));
	zpool_standard_error(zhp->zpool_hdl, err, msg);
	retval = -1;
	goto out;
	}
	}


	if (trim_flags->wait)
	retval = zpool_trim_wait(zhp, vdev_guids);

	out:
	if (errlist != NULL)
	fnvlist_free(errlist);
	fnvlist_free(vdev_guids);
	fnvlist_free(guids_to_paths);
	return (retval);
	}

	/*
	* Scan the pool.
	*/
	int
	zpool_scan(zpool_handle_t *zhp, pool_scan_func_t func, pool_scrub_cmd_t cmd)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	int err;
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	zc.zc_cookie = func;
	zc.zc_flags = cmd;

	if (zfs_ioctl(hdl, ZFS_IOC_POOL_SCAN, &zc) == 0)
	return (0);

	err = errno;

	/* ECANCELED on a scrub means we resumed a paused scrub */
	if (err == ECANCELED && func == POOL_SCAN_SCRUB &&
	cmd == POOL_SCRUB_NORMAL)
	return (0);

	if (err == ENOENT && func != POOL_SCAN_NONE && cmd == POOL_SCRUB_NORMAL)
	return (0);

	if (func == POOL_SCAN_SCRUB) {
	if (cmd == POOL_SCRUB_PAUSE) {
	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot pause scrubbing %s"), zc.zc_name);
	} else {
	assert(cmd == POOL_SCRUB_NORMAL);
	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot scrub %s"), zc.zc_name);
	}
	} else if (func == POOL_SCAN_RESILVER) {
	assert(cmd == POOL_SCRUB_NORMAL);
	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot restart resilver on %s"), zc.zc_name);
	} else if (func == POOL_SCAN_NONE) {
	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot cancel scrubbing %s"),
	zc.zc_name);
	} else {
	assert(!"unexpected result");
	}

	if (err == EBUSY) {
	nvlist_t *nvroot;
	pool_scan_stat_t *ps = NULL;
	uint_t psc;

	verify(nvlist_lookup_nvlist(zhp->zpool_config,
	ZPOOL_CONFIG_VDEV_TREE, &nvroot) == 0);
	(void) nvlist_lookup_uint64_array(nvroot,
	ZPOOL_CONFIG_SCAN_STATS, (uint64_t **)&ps, &psc);
	if (ps && ps->pss_func == POOL_SCAN_SCRUB &&
	ps->pss_state == DSS_SCANNING) {
	if (cmd == POOL_SCRUB_PAUSE)
	return (zfs_error(hdl, EZFS_SCRUB_PAUSED, msg));
	else
	return (zfs_error(hdl, EZFS_SCRUBBING, msg));
	} else {
	return (zfs_error(hdl, EZFS_RESILVERING, msg));
	}
	} else if (err == ENOENT) {
	return (zfs_error(hdl, EZFS_NO_SCRUB, msg));
	} else if (err == ENOTSUP && func == POOL_SCAN_RESILVER) {
	return (zfs_error(hdl, EZFS_NO_RESILVER_DEFER, msg));
	} else {
	return (zpool_standard_error(hdl, err, msg));
	}
	}

	/*
	* Find a vdev that matches the search criteria specified. We use the
	* the nvpair name to determine how we should look for the device.
	* 'avail_spare' is set to TRUE if the provided guid refers to an AVAIL
	* spare; but FALSE if its an INUSE spare.
	*/
	static nvlist_t *
	vdev_to_nvlist_iter(nvlist_t nv, nvlist_t search, boolean_t *avail_spare,
	boolean_t l2cache, boolean_t log)
	{
	uint_t c, children;
	nvlist_t **child;
	nvlist_t *ret;
	uint64_t is_log;
	char *srchkey;
	nvpair_t *pair = nvlist_next_nvpair(search, NULL);

	/* Nothing to look for */
	if (search == NULL \|\| pair == NULL)
	return (NULL);

	/* Obtain the key we will use to search */
	srchkey = nvpair_name(pair);

	switch (nvpair_type(pair)) {
	case DATA_TYPE_UINT64:
	if (strcmp(srchkey, ZPOOL_CONFIG_GUID) == 0) {
	uint64_t srchval, theguid;

	verify(nvpair_value_uint64(pair, &srchval) == 0);
	verify(nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID,
	&theguid) == 0);
	if (theguid == srchval)
	return (nv);
	}
	break;

	case DATA_TYPE_STRING: {
	char srchval, val;

	verify(nvpair_value_string(pair, &srchval) == 0);
	if (nvlist_lookup_string(nv, srchkey, &val) != 0)
	break;

	/*
	* Search for the requested value. Special cases:
	*
	* - ZPOOL_CONFIG_PATH for whole disk entries. These end in
	* "-part1", or "p1". The suffix is hidden from the user,
	* but included in the string, so this matches around it.
	* - ZPOOL_CONFIG_PATH for short names zfs_strcmp_shortname()
	* is used to check all possible expanded paths.
	* - looking for a top-level vdev name (i.e. ZPOOL_CONFIG_TYPE).
	*
	* Otherwise, all other searches are simple string compares.
	*/
	if (strcmp(srchkey, ZPOOL_CONFIG_PATH) == 0) {
	uint64_t wholedisk = 0;

	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_WHOLE_DISK,
	&wholedisk);
	if (zfs_strcmp_pathname(srchval, val, wholedisk) == 0)
	return (nv);

	} else if (strcmp(srchkey, ZPOOL_CONFIG_TYPE) == 0 && val) {
	char type, idx, end, p;
	uint64_t id, vdev_id;

	/*
	* Determine our vdev type, keeping in mind
	* that the srchval is composed of a type and
	* vdev id pair (i.e. mirror-4).
	*/
	if ((type = strdup(srchval)) == NULL)
	return (NULL);

	if ((p = strrchr(type, '-')) == NULL) {
	free(type);
	break;
	}
	idx = p + 1;
	*p = '\0';

	/*
	* If the types don't match then keep looking.
	*/
	if (strncmp(val, type, strlen(val)) != 0) {
	free(type);
	break;
	}

	verify(zpool_vdev_is_interior(type));
	verify(nvlist_lookup_uint64(nv, ZPOOL_CONFIG_ID,
	&id) == 0);

	errno = 0;
	vdev_id = strtoull(idx, &end, 10);

	free(type);
	if (errno != 0)
	return (NULL);

	/*
	* Now verify that we have the correct vdev id.
	*/
	if (vdev_id == id)
	return (nv);
	}

	/*
	* Common case
	*/
	if (strcmp(srchval, val) == 0)
	return (nv);
	break;
	}

	default:
	break;
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0)
	return (NULL);

	for (c = 0; c < children; c++) {
	if ((ret = vdev_to_nvlist_iter(child[c], search,
	avail_spare, l2cache, NULL)) != NULL) {
	/*
	* The 'is_log' value is only set for the toplevel
	* vdev, not the leaf vdevs. So we always lookup the
	* log device from the root of the vdev tree (where
	* 'log' is non-NULL).
	*/
	if (log != NULL &&
	nvlist_lookup_uint64(child[c],
	ZPOOL_CONFIG_IS_LOG, &is_log) == 0 &&
	is_log) {
	*log = B_TRUE;
	}
	return (ret);
	}
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_SPARES,
	&child, &children) == 0) {
	for (c = 0; c < children; c++) {
	if ((ret = vdev_to_nvlist_iter(child[c], search,
	avail_spare, l2cache, NULL)) != NULL) {
	*avail_spare = B_TRUE;
	return (ret);
	}
	}
	}

	if (nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_L2CACHE,
	&child, &children) == 0) {
	for (c = 0; c < children; c++) {
	if ((ret = vdev_to_nvlist_iter(child[c], search,
	avail_spare, l2cache, NULL)) != NULL) {
	*l2cache = B_TRUE;
	return (ret);
	}
	}
	}

	return (NULL);
	}

	/*
	* Given a physical path or guid, find the associated vdev.
	*/
	nvlist_t *
	zpool_find_vdev_by_physpath(zpool_handle_t zhp, const char ppath,
	boolean_t avail_spare, boolean_t l2cache, boolean_t *log)
	{
	nvlist_t search, nvroot, *ret;
	uint64_t guid;
	char *end;

	verify(nvlist_alloc(&search, NV_UNIQUE_NAME, KM_SLEEP) == 0);

	guid = strtoull(ppath, &end, 0);
	if (guid != 0 && *end == '\0') {
	verify(nvlist_add_uint64(search, ZPOOL_CONFIG_GUID, guid) == 0);
	} else {
	verify(nvlist_add_string(search, ZPOOL_CONFIG_PHYS_PATH,
	ppath) == 0);
	}

	verify(nvlist_lookup_nvlist(zhp->zpool_config, ZPOOL_CONFIG_VDEV_TREE,
	&nvroot) == 0);

	*avail_spare = B_FALSE;
	*l2cache = B_FALSE;
	if (log != NULL)
	*log = B_FALSE;
	ret = vdev_to_nvlist_iter(nvroot, search, avail_spare, l2cache, log);
	nvlist_free(search);

	return (ret);
	}

	/*
	* Determine if we have an "interior" top-level vdev (i.e mirror/raidz).
	*/
	static boolean_t
	zpool_vdev_is_interior(const char *name)
	{
	if (strncmp(name, VDEV_TYPE_RAIDZ, strlen(VDEV_TYPE_RAIDZ)) == 0 \|\|
	strncmp(name, VDEV_TYPE_SPARE, strlen(VDEV_TYPE_SPARE)) == 0 \|\|
	strncmp(name,
	VDEV_TYPE_REPLACING, strlen(VDEV_TYPE_REPLACING)) == 0 \|\|
	strncmp(name, VDEV_TYPE_MIRROR, strlen(VDEV_TYPE_MIRROR)) == 0)
	return (B_TRUE);
	return (B_FALSE);
	}

	nvlist_t *
	zpool_find_vdev(zpool_handle_t zhp, const char path, boolean_t *avail_spare,
	boolean_t l2cache, boolean_t log)
	{
	char *end;
	nvlist_t nvroot, search, *ret;
	uint64_t guid;

	verify(nvlist_alloc(&search, NV_UNIQUE_NAME, KM_SLEEP) == 0);

	guid = strtoull(path, &end, 0);
	if (guid != 0 && *end == '\0') {
	verify(nvlist_add_uint64(search, ZPOOL_CONFIG_GUID, guid) == 0);
	} else if (zpool_vdev_is_interior(path)) {
	verify(nvlist_add_string(search, ZPOOL_CONFIG_TYPE, path) == 0);
	} else {
	verify(nvlist_add_string(search, ZPOOL_CONFIG_PATH, path) == 0);
	}

	verify(nvlist_lookup_nvlist(zhp->zpool_config, ZPOOL_CONFIG_VDEV_TREE,
	&nvroot) == 0);

	*avail_spare = B_FALSE;
	*l2cache = B_FALSE;
	if (log != NULL)
	*log = B_FALSE;
	ret = vdev_to_nvlist_iter(nvroot, search, avail_spare, l2cache, log);
	nvlist_free(search);

	return (ret);
	}

	static int
	vdev_is_online(nvlist_t *nv)
	{
	uint64_t ival;

	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_OFFLINE, &ival) == 0 \|\|
	nvlist_lookup_uint64(nv, ZPOOL_CONFIG_FAULTED, &ival) == 0 \|\|
	nvlist_lookup_uint64(nv, ZPOOL_CONFIG_REMOVED, &ival) == 0)
	return (0);

	return (1);
	}

	/*
	* Helper function for zpool_get_physpaths().
	*/
	static int
	vdev_get_one_physpath(nvlist_t config, char physpath, size_t physpath_size,
	size_t *bytes_written)
	{
	size_t bytes_left, pos, rsz;
	char *tmppath;
	const char *format;

	if (nvlist_lookup_string(config, ZPOOL_CONFIG_PHYS_PATH,
	&tmppath) != 0)
	return (EZFS_NODEVICE);

	pos = *bytes_written;
	bytes_left = physpath_size - pos;
	format = (pos == 0) ? "%s" : " %s";

	rsz = snprintf(physpath + pos, bytes_left, format, tmppath);
	*bytes_written += rsz;

	if (rsz >= bytes_left) {
	/* if physpath was not copied properly, clear it */
	if (bytes_left != 0) {
	physpath[pos] = 0;
	}
	return (EZFS_NOSPC);
	}
	return (0);
	}

	static int
	vdev_get_physpaths(nvlist_t nv, char physpath, size_t phypath_size,
	size_t *rsz, boolean_t is_spare)
	{
	char *type;
	int ret;

	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_TYPE, &type) != 0)
	return (EZFS_INVALCONFIG);

	if (strcmp(type, VDEV_TYPE_DISK) == 0) {
	/*
	* An active spare device has ZPOOL_CONFIG_IS_SPARE set.
	* For a spare vdev, we only want to boot from the active
	* spare device.
	*/
	if (is_spare) {
	uint64_t spare = 0;
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_IS_SPARE,
	&spare);
	if (!spare)
	return (EZFS_INVALCONFIG);
	}

	if (vdev_is_online(nv)) {
	if ((ret = vdev_get_one_physpath(nv, physpath,
	phypath_size, rsz)) != 0)
	return (ret);
	}
	} else if (strcmp(type, VDEV_TYPE_MIRROR) == 0 \|\|
	strcmp(type, VDEV_TYPE_RAIDZ) == 0 \|\|
	strcmp(type, VDEV_TYPE_REPLACING) == 0 \|\|
	(is_spare = (strcmp(type, VDEV_TYPE_SPARE) == 0))) {
	nvlist_t **child;
	uint_t count;
	int i, ret;

	if (nvlist_lookup_nvlist_array(nv,
	ZPOOL_CONFIG_CHILDREN, &child, &count) != 0)
	return (EZFS_INVALCONFIG);

	for (i = 0; i < count; i++) {
	ret = vdev_get_physpaths(child[i], physpath,
	phypath_size, rsz, is_spare);
	if (ret == EZFS_NOSPC)
	return (ret);
	}
	}

	return (EZFS_POOL_INVALARG);
	}

	/*
	* Get phys_path for a root pool config.
	* Return 0 on success; non-zero on failure.
	*/
	static int
	zpool_get_config_physpath(nvlist_t config, char physpath, size_t phypath_size)
	{
	size_t rsz;
	nvlist_t *vdev_root;
	nvlist_t **child;
	uint_t count;
	char *type;

	rsz = 0;

	if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
	&vdev_root) != 0)
	return (EZFS_INVALCONFIG);

	if (nvlist_lookup_string(vdev_root, ZPOOL_CONFIG_TYPE, &type) != 0 \|\|
	nvlist_lookup_nvlist_array(vdev_root, ZPOOL_CONFIG_CHILDREN,
	&child, &count) != 0)
	return (EZFS_INVALCONFIG);

	/*
	* root pool can only have a single top-level vdev.
	*/
	if (strcmp(type, VDEV_TYPE_ROOT) != 0 \|\| count != 1)
	return (EZFS_POOL_INVALARG);

	(void) vdev_get_physpaths(child[0], physpath, phypath_size, &rsz,
	B_FALSE);

	/* No online devices */
	if (rsz == 0)
	return (EZFS_NODEVICE);

	return (0);
	}

	/*
	* Get phys_path for a root pool
	* Return 0 on success; non-zero on failure.
	*/
	int
	zpool_get_physpath(zpool_handle_t zhp, char physpath, size_t phypath_size)
	{
	return (zpool_get_config_physpath(zhp->zpool_config, physpath,
	phypath_size));
	}

	/*
	* Convert a vdev path to a GUID. Returns GUID or 0 on error.
	*
	* If is_spare, is_l2cache, or is_log is non-NULL, then store within it
	* if the VDEV is a spare, l2cache, or log device. If they're NULL then
	* ignore them.
	*/
	static uint64_t
	zpool_vdev_path_to_guid_impl(zpool_handle_t zhp, const char path,
	boolean_t is_spare, boolean_t is_l2cache, boolean_t *is_log)
	{
	uint64_t guid;
	boolean_t spare = B_FALSE, l2cache = B_FALSE, log = B_FALSE;
	nvlist_t *tgt;

	if ((tgt = zpool_find_vdev(zhp, path, &spare, &l2cache,
	&log)) == NULL)
	return (0);

	verify(nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_GUID, &guid) == 0);
	if (is_spare != NULL)
	*is_spare = spare;
	if (is_l2cache != NULL)
	*is_l2cache = l2cache;
	if (is_log != NULL)
	*is_log = log;

	return (guid);
	}

	/* Convert a vdev path to a GUID. Returns GUID or 0 on error. */
	uint64_t
	zpool_vdev_path_to_guid(zpool_handle_t zhp, const char path)
	{
	return (zpool_vdev_path_to_guid_impl(zhp, path, NULL, NULL, NULL));
	}

	/*
	* Bring the specified vdev online. The 'flags' parameter is a set of the
	* ZFS_ONLINE_* flags.
	*/
	int
	zpool_vdev_online(zpool_handle_t zhp, const char path, int flags,
	vdev_state_t *newstate)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	char *pathname;
	nvlist_t *tgt;
	boolean_t avail_spare, l2cache, islog;
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	int error;

	if (flags & ZFS_ONLINE_EXPAND) {
	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot expand %s"), path);
	} else {
	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot online %s"), path);
	}

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	if ((tgt = zpool_find_vdev(zhp, path, &avail_spare, &l2cache,
	&islog)) == NULL)
	return (zfs_error(hdl, EZFS_NODEVICE, msg));

	verify(nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_GUID, &zc.zc_guid) == 0);

	if (avail_spare)
	return (zfs_error(hdl, EZFS_ISSPARE, msg));

	if ((flags & ZFS_ONLINE_EXPAND \|\|
	zpool_get_prop_int(zhp, ZPOOL_PROP_AUTOEXPAND, NULL)) &&
	nvlist_lookup_string(tgt, ZPOOL_CONFIG_PATH, &pathname) == 0) {
	uint64_t wholedisk = 0;

	(void) nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_WHOLE_DISK,
	&wholedisk);

	/*
	* XXX - L2ARC 1.0 devices can't support expansion.
	*/
	if (l2cache) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot expand cache devices"));
	return (zfs_error(hdl, EZFS_VDEVNOTSUP, msg));
	}

	if (wholedisk) {
	const char *fullpath = path;
	char buf[MAXPATHLEN];

	if (path[0] != '/') {
	error = zfs_resolve_shortname(path, buf,
	sizeof (buf));
	if (error != 0)
	return (zfs_error(hdl, EZFS_NODEVICE,
	msg));

	fullpath = buf;
	}

	error = zpool_relabel_disk(hdl, fullpath, msg);
	if (error != 0)
	return (error);
	}
	}

	zc.zc_cookie = VDEV_STATE_ONLINE;
	zc.zc_obj = flags;

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_SET_STATE, &zc) != 0) {
	if (errno == EINVAL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "was split "
	"from this pool into a new one. Use '%s' "
	"instead"), "zpool detach");
	return (zfs_error(hdl, EZFS_POSTSPLIT_ONLINE, msg));
	}
	return (zpool_standard_error(hdl, errno, msg));
	}

	*newstate = zc.zc_cookie;
	return (0);
	}

	/*
	* Take the specified vdev offline
	*/
	int
	zpool_vdev_offline(zpool_handle_t zhp, const char path, boolean_t istmp)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	nvlist_t *tgt;
	boolean_t avail_spare, l2cache;
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot offline %s"), path);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	if ((tgt = zpool_find_vdev(zhp, path, &avail_spare, &l2cache,
	NULL)) == NULL)
	return (zfs_error(hdl, EZFS_NODEVICE, msg));

	verify(nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_GUID, &zc.zc_guid) == 0);

	if (avail_spare)
	return (zfs_error(hdl, EZFS_ISSPARE, msg));

	zc.zc_cookie = VDEV_STATE_OFFLINE;
	zc.zc_obj = istmp ? ZFS_OFFLINE_TEMPORARY : 0;

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_SET_STATE, &zc) == 0)
	return (0);

	switch (errno) {
	case EBUSY:

	/*
	* There are no other replicas of this device.
	*/
	return (zfs_error(hdl, EZFS_NOREPLICAS, msg));

	case EEXIST:
	/*
	* The log device has unplayed logs
	*/
	return (zfs_error(hdl, EZFS_UNPLAYED_LOGS, msg));

	default:
	return (zpool_standard_error(hdl, errno, msg));
	}
	}

	/*
	* Mark the given vdev faulted.
	*/
	int
	zpool_vdev_fault(zpool_handle_t *zhp, uint64_t guid, vdev_aux_t aux)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot fault %llu"), (u_longlong_t)guid);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	zc.zc_guid = guid;
	zc.zc_cookie = VDEV_STATE_FAULTED;
	zc.zc_obj = aux;

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_SET_STATE, &zc) == 0)
	return (0);

	switch (errno) {
	case EBUSY:

	/*
	* There are no other replicas of this device.
	*/
	return (zfs_error(hdl, EZFS_NOREPLICAS, msg));

	default:
	return (zpool_standard_error(hdl, errno, msg));
	}

	}

	/*
	* Mark the given vdev degraded.
	*/
	int
	zpool_vdev_degrade(zpool_handle_t *zhp, uint64_t guid, vdev_aux_t aux)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot degrade %llu"), (u_longlong_t)guid);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	zc.zc_guid = guid;
	zc.zc_cookie = VDEV_STATE_DEGRADED;
	zc.zc_obj = aux;

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_SET_STATE, &zc) == 0)
	return (0);

	return (zpool_standard_error(hdl, errno, msg));
	}

	/*
	* Returns TRUE if the given nvlist is a vdev that was originally swapped in as
	* a hot spare.
	*/
	static boolean_t
	is_replacing_spare(nvlist_t search, nvlist_t tgt, int which)
	{
	nvlist_t **child;
	uint_t c, children;
	char *type;

	if (nvlist_lookup_nvlist_array(search, ZPOOL_CONFIG_CHILDREN, &child,
	&children) == 0) {
	verify(nvlist_lookup_string(search, ZPOOL_CONFIG_TYPE,
	&type) == 0);

	if (strcmp(type, VDEV_TYPE_SPARE) == 0 &&
	children == 2 && child[which] == tgt)
	return (B_TRUE);

	for (c = 0; c < children; c++)
	if (is_replacing_spare(child[c], tgt, which))
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	/*
	* Attach new_disk (fully described by nvroot) to old_disk.
	* If 'replacing' is specified, the new disk will replace the old one.
	*/
	int
	zpool_vdev_attach(zpool_handle_t zhp, const char old_disk,
	const char new_disk, nvlist_t nvroot, int replacing, boolean_t rebuild)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	int ret;
	nvlist_t *tgt;
	boolean_t avail_spare, l2cache, islog;
	uint64_t val;
	char *newname;
	nvlist_t **child;
	uint_t children;
	nvlist_t *config_root;
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	if (replacing)
	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot replace %s with %s"), old_disk, new_disk);
	else
	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot attach %s to %s"), new_disk, old_disk);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	if ((tgt = zpool_find_vdev(zhp, old_disk, &avail_spare, &l2cache,
	&islog)) == NULL)
	return (zfs_error(hdl, EZFS_NODEVICE, msg));

	if (avail_spare)
	return (zfs_error(hdl, EZFS_ISSPARE, msg));

	if (l2cache)
	return (zfs_error(hdl, EZFS_ISL2CACHE, msg));

	verify(nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_GUID, &zc.zc_guid) == 0);
	zc.zc_cookie = replacing;
	zc.zc_simple = rebuild;

	if (rebuild &&
	zfeature_lookup_guid("org.openzfs:device_rebuild", NULL) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"the loaded zfs module doesn't support device rebuilds"));
	return (zfs_error(hdl, EZFS_POOL_NOTSUP, msg));
	}

	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_CHILDREN,
	&child, &children) != 0 \|\| children != 1) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"new device must be a single disk"));
	return (zfs_error(hdl, EZFS_INVALCONFIG, msg));
	}

	verify(nvlist_lookup_nvlist(zpool_get_config(zhp, NULL),
	ZPOOL_CONFIG_VDEV_TREE, &config_root) == 0);

	if ((newname = zpool_vdev_name(NULL, NULL, child[0], 0)) == NULL)
	return (-1);

	/*
	* If the target is a hot spare that has been swapped in, we can only
	* replace it with another hot spare.
	*/
	if (replacing &&
	nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_IS_SPARE, &val) == 0 &&
	(zpool_find_vdev(zhp, newname, &avail_spare, &l2cache,
	NULL) == NULL \|\| !avail_spare) &&
	is_replacing_spare(config_root, tgt, 1)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"can only be replaced by another hot spare"));
	free(newname);
	return (zfs_error(hdl, EZFS_BADTARGET, msg));
	}

	free(newname);

	if (zcmd_write_conf_nvlist(hdl, &zc, nvroot) != 0)
	return (-1);

	ret = zfs_ioctl(hdl, ZFS_IOC_VDEV_ATTACH, &zc);

	zcmd_free_nvlists(&zc);

	if (ret == 0)
	return (0);

	switch (errno) {
	case ENOTSUP:
	/*
	* Can't attach to or replace this type of vdev.
	*/
	if (replacing) {
	uint64_t version = zpool_get_prop_int(zhp,
	ZPOOL_PROP_VERSION, NULL);

	if (islog) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot replace a log with a spare"));
	} else if (rebuild) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"only mirror vdevs support sequential "
	"reconstruction"));
	} else if (version >= SPA_VERSION_MULTI_REPLACE) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"already in replacing/spare config; wait "
	"for completion or use 'zpool detach'"));
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot replace a replacing device"));
	}
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"can only attach to mirrors and top-level "
	"disks"));
	}
	(void) zfs_error(hdl, EZFS_BADTARGET, msg);
	break;

	case EINVAL:
	/*
	* The new device must be a single disk.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"new device must be a single disk"));
	(void) zfs_error(hdl, EZFS_INVALCONFIG, msg);
	break;

	case EBUSY:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "%s is busy, "
	"or device removal is in progress"),
	new_disk);
	(void) zfs_error(hdl, EZFS_BADDEV, msg);
	break;

	case EOVERFLOW:
	/*
	* The new device is too small.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"device is too small"));
	(void) zfs_error(hdl, EZFS_BADDEV, msg);
	break;

	case EDOM:
	/*
	* The new device has a different optimal sector size.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"new device has a different optimal sector size; use the "
	"option '-o ashift=N' to override the optimal size"));
	(void) zfs_error(hdl, EZFS_BADDEV, msg);
	break;

	case ENAMETOOLONG:
	/*
	* The resulting top-level vdev spec won't fit in the label.
	*/
	(void) zfs_error(hdl, EZFS_DEVOVERFLOW, msg);
	break;

	default:
	(void) zpool_standard_error(hdl, errno, msg);
	}

	return (-1);
	}

	/*
	* Detach the specified device.
	*/
	int
	zpool_vdev_detach(zpool_handle_t zhp, const char path)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	nvlist_t *tgt;
	boolean_t avail_spare, l2cache;
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot detach %s"), path);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	if ((tgt = zpool_find_vdev(zhp, path, &avail_spare, &l2cache,
	NULL)) == NULL)
	return (zfs_error(hdl, EZFS_NODEVICE, msg));

	if (avail_spare)
	return (zfs_error(hdl, EZFS_ISSPARE, msg));

	if (l2cache)
	return (zfs_error(hdl, EZFS_ISL2CACHE, msg));

	verify(nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_GUID, &zc.zc_guid) == 0);

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_DETACH, &zc) == 0)
	return (0);

	switch (errno) {

	case ENOTSUP:
	/*
	* Can't detach from this type of vdev.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "only "
	"applicable to mirror and replacing vdevs"));
	(void) zfs_error(hdl, EZFS_BADTARGET, msg);
	break;

	case EBUSY:
	/*
	* There are no other replicas of this device.
	*/
	(void) zfs_error(hdl, EZFS_NOREPLICAS, msg);
	break;

	default:
	(void) zpool_standard_error(hdl, errno, msg);
	}

	return (-1);
	}

	/*
	* Find a mirror vdev in the source nvlist.
	*
	* The mchild array contains a list of disks in one of the top-level mirrors
	* of the source pool. The schild array contains a list of disks that the
	* user specified on the command line. We loop over the mchild array to
	* see if any entry in the schild array matches.
	*
	* If a disk in the mchild array is found in the schild array, we return
	* the index of that entry. Otherwise we return -1.
	*/
	static int
	find_vdev_entry(zpool_handle_t zhp, nvlist_t *mchild, uint_t mchildren,
	nvlist_t **schild, uint_t schildren)
	{
	uint_t mc;

	for (mc = 0; mc < mchildren; mc++) {
	uint_t sc;
	char *mpath = zpool_vdev_name(zhp->zpool_hdl, zhp,
	mchild[mc], 0);

	for (sc = 0; sc < schildren; sc++) {
	char *spath = zpool_vdev_name(zhp->zpool_hdl, zhp,
	schild[sc], 0);
	boolean_t result = (strcmp(mpath, spath) == 0);

	free(spath);
	if (result) {
	free(mpath);
	return (mc);
	}
	}

	free(mpath);
	}

	return (-1);
	}

	/*
	* Split a mirror pool. If newroot points to null, then a new nvlist
	* is generated and it is the responsibility of the caller to free it.
	*/
	int
	zpool_vdev_split(zpool_handle_t zhp, char newname, nvlist_t **newroot,
	nvlist_t *props, splitflags_t flags)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	nvlist_t tree, config, child, newchild, *newconfig = NULL;
	nvlist_t *varray = NULL, zc_props = NULL;
	uint_t c, children, newchildren, lastlog = 0, vcount, found = 0;
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	uint64_t vers, readonly = B_FALSE;
	boolean_t freelist = B_FALSE, memory_err = B_TRUE;
	int retval = 0;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "Unable to split %s"), zhp->zpool_name);

	if (!zpool_name_valid(hdl, B_FALSE, newname))
	return (zfs_error(hdl, EZFS_INVALIDNAME, msg));

	if ((config = zpool_get_config(zhp, NULL)) == NULL) {
	(void) fprintf(stderr, gettext("Internal error: unable to "
	"retrieve pool configuration\n"));
	return (-1);
	}

	verify(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE, &tree)
	== 0);
	verify(nvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION, &vers) == 0);

	if (props) {
	prop_flags_t flags = { .create = B_FALSE, .import = B_TRUE };
	if ((zc_props = zpool_valid_proplist(hdl, zhp->zpool_name,
	props, vers, flags, msg)) == NULL)
	return (-1);
	(void) nvlist_lookup_uint64(zc_props,
	zpool_prop_to_name(ZPOOL_PROP_READONLY), &readonly);
	if (readonly) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property %s can only be set at import time"),
	zpool_prop_to_name(ZPOOL_PROP_READONLY));
	return (-1);
	}
	}

	if (nvlist_lookup_nvlist_array(tree, ZPOOL_CONFIG_CHILDREN, &child,
	&children) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"Source pool is missing vdev tree"));
	nvlist_free(zc_props);
	return (-1);
	}

	varray = zfs_alloc(hdl, children * sizeof (nvlist_t *));
	vcount = 0;

	if (*newroot == NULL \|\|
	nvlist_lookup_nvlist_array(*newroot, ZPOOL_CONFIG_CHILDREN,
	&newchild, &newchildren) != 0)
	newchildren = 0;

	for (c = 0; c < children; c++) {
	uint64_t is_log = B_FALSE, is_hole = B_FALSE;
	char *type;
	nvlist_t *mchild, vdev;
	uint_t mchildren;
	int entry;

	/*
	* Unlike cache & spares, slogs are stored in the
	* ZPOOL_CONFIG_CHILDREN array. We filter them out here.
	*/
	(void) nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_LOG,
	&is_log);
	(void) nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_HOLE,
	&is_hole);
	if (is_log \|\| is_hole) {
	/*
	* Create a hole vdev and put it in the config.
	*/
	if (nvlist_alloc(&vdev, NV_UNIQUE_NAME, 0) != 0)
	goto out;
	if (nvlist_add_string(vdev, ZPOOL_CONFIG_TYPE,
	VDEV_TYPE_HOLE) != 0)
	goto out;
	if (nvlist_add_uint64(vdev, ZPOOL_CONFIG_IS_HOLE,
	1) != 0)
	goto out;
	if (lastlog == 0)
	lastlog = vcount;
	varray[vcount++] = vdev;
	continue;
	}
	lastlog = 0;
	verify(nvlist_lookup_string(child[c], ZPOOL_CONFIG_TYPE, &type)
	== 0);

	if (strcmp(type, VDEV_TYPE_INDIRECT) == 0) {
	vdev = child[c];
	if (nvlist_dup(vdev, &varray[vcount++], 0) != 0)
	goto out;
	continue;
	} else if (strcmp(type, VDEV_TYPE_MIRROR) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"Source pool must be composed only of mirrors\n"));
	retval = zfs_error(hdl, EZFS_INVALCONFIG, msg);
	goto out;
	}

	verify(nvlist_lookup_nvlist_array(child[c],
	ZPOOL_CONFIG_CHILDREN, &mchild, &mchildren) == 0);

	/* find or add an entry for this top-level vdev */
	if (newchildren > 0 &&
	(entry = find_vdev_entry(zhp, mchild, mchildren,
	newchild, newchildren)) >= 0) {
	/* We found a disk that the user specified. */
	vdev = mchild[entry];
	++found;
	} else {
	/* User didn't specify a disk for this vdev. */
	vdev = mchild[mchildren - 1];
	}

	if (nvlist_dup(vdev, &varray[vcount++], 0) != 0)
	goto out;
	}

	/* did we find every disk the user specified? */
	if (found != newchildren) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "Device list must "
	"include at most one disk from each mirror"));
	retval = zfs_error(hdl, EZFS_INVALCONFIG, msg);
	goto out;
	}

	/* Prepare the nvlist for populating. */
	if (*newroot == NULL) {
	if (nvlist_alloc(newroot, NV_UNIQUE_NAME, 0) != 0)
	goto out;
	freelist = B_TRUE;
	if (nvlist_add_string(*newroot, ZPOOL_CONFIG_TYPE,
	VDEV_TYPE_ROOT) != 0)
	goto out;
	} else {
	verify(nvlist_remove_all(*newroot, ZPOOL_CONFIG_CHILDREN) == 0);
	}

	/* Add all the children we found */
	if (nvlist_add_nvlist_array(*newroot, ZPOOL_CONFIG_CHILDREN, varray,
	lastlog == 0 ? vcount : lastlog) != 0)
	goto out;

	/*
	* If we're just doing a dry run, exit now with success.
	*/
	if (flags.dryrun) {
	memory_err = B_FALSE;
	freelist = B_FALSE;
	goto out;
	}

	/* now build up the config list & call the ioctl */
	if (nvlist_alloc(&newconfig, NV_UNIQUE_NAME, 0) != 0)
	goto out;

	if (nvlist_add_nvlist(newconfig,
	ZPOOL_CONFIG_VDEV_TREE, *newroot) != 0 \|\|
	nvlist_add_string(newconfig,
	ZPOOL_CONFIG_POOL_NAME, newname) != 0 \|\|
	nvlist_add_uint64(newconfig, ZPOOL_CONFIG_VERSION, vers) != 0)
	goto out;

	/*
	* The new pool is automatically part of the namespace unless we
	* explicitly export it.
	*/
	if (!flags.import)
	zc.zc_cookie = ZPOOL_EXPORT_AFTER_SPLIT;
	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	(void) strlcpy(zc.zc_string, newname, sizeof (zc.zc_string));
	if (zcmd_write_conf_nvlist(hdl, &zc, newconfig) != 0)
	goto out;
	if (zc_props != NULL && zcmd_write_src_nvlist(hdl, &zc, zc_props) != 0)
	goto out;

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_SPLIT, &zc) != 0) {
	retval = zpool_standard_error(hdl, errno, msg);
	goto out;
	}

	freelist = B_FALSE;
	memory_err = B_FALSE;

	out:
	if (varray != NULL) {
	int v;

	for (v = 0; v < vcount; v++)
	nvlist_free(varray[v]);
	free(varray);
	}
	zcmd_free_nvlists(&zc);
	nvlist_free(zc_props);
	nvlist_free(newconfig);
	if (freelist) {
	nvlist_free(*newroot);
	*newroot = NULL;
	}

	if (retval != 0)
	return (retval);

	if (memory_err)
	return (no_memory(hdl));

	return (0);
	}

	/*
	* Remove the given device.
	*/
	int
	zpool_vdev_remove(zpool_handle_t zhp, const char path)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	nvlist_t *tgt;
	boolean_t avail_spare, l2cache, islog;
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	uint64_t version;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot remove %s"), path);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	if ((tgt = zpool_find_vdev(zhp, path, &avail_spare, &l2cache,
	&islog)) == NULL)
	return (zfs_error(hdl, EZFS_NODEVICE, msg));

	version = zpool_get_prop_int(zhp, ZPOOL_PROP_VERSION, NULL);
	if (islog && version < SPA_VERSION_HOLES) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded to support log removal"));
	return (zfs_error(hdl, EZFS_BADVERSION, msg));
	}

	zc.zc_guid = fnvlist_lookup_uint64(tgt, ZPOOL_CONFIG_GUID);

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_REMOVE, &zc) == 0)
	return (0);

	switch (errno) {

	case EINVAL:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid config; all top-level vdevs must "
	"have the same sector size and not be raidz."));
	(void) zfs_error(hdl, EZFS_INVALCONFIG, msg);
	break;

	case EBUSY:
	if (islog) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"Mount encrypted datasets to replay logs."));
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"Pool busy; removal may already be in progress"));
	}
	(void) zfs_error(hdl, EZFS_BUSY, msg);
	break;

	case EACCES:
	if (islog) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"Mount encrypted datasets to replay logs."));
	(void) zfs_error(hdl, EZFS_BUSY, msg);
	} else {
	(void) zpool_standard_error(hdl, errno, msg);
	}
	break;

	default:
	(void) zpool_standard_error(hdl, errno, msg);
	}
	return (-1);
	}

	int
	zpool_vdev_remove_cancel(zpool_handle_t *zhp)
	{
	zfs_cmd_t zc;
	char msg[1024];
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot cancel removal"));

	bzero(&zc, sizeof (zc));
	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	zc.zc_cookie = 1;

	if (zfs_ioctl(hdl, ZFS_IOC_VDEV_REMOVE, &zc) == 0)
	return (0);

	return (zpool_standard_error(hdl, errno, msg));
	}

	int
	zpool_vdev_indirect_size(zpool_handle_t zhp, const char path,
	uint64_t *sizep)
	{
	char msg[1024];
	nvlist_t *tgt;
	boolean_t avail_spare, l2cache, islog;
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot determine indirect size of %s"),
	path);

	if ((tgt = zpool_find_vdev(zhp, path, &avail_spare, &l2cache,
	&islog)) == NULL)
	return (zfs_error(hdl, EZFS_NODEVICE, msg));

	if (avail_spare \|\| l2cache \|\| islog) {
	*sizep = 0;
	return (0);
	}

	if (nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_INDIRECT_SIZE, sizep) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"indirect size not available"));
	return (zfs_error(hdl, EINVAL, msg));
	}
	return (0);
	}

	/*
	* Clear the errors for the pool, or the particular device if specified.
	*/
	int
	zpool_clear(zpool_handle_t zhp, const char path, nvlist_t *rewindnvl)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	nvlist_t *tgt;
	zpool_load_policy_t policy;
	boolean_t avail_spare, l2cache;
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	nvlist_t *nvi = NULL;
	int error;

	if (path)
	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot clear errors for %s"),
	path);
	else
	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot clear errors for %s"),
	zhp->zpool_name);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	if (path) {
	if ((tgt = zpool_find_vdev(zhp, path, &avail_spare,
	&l2cache, NULL)) == NULL)
	return (zfs_error(hdl, EZFS_NODEVICE, msg));

	/*
	* Don't allow error clearing for hot spares. Do allow
	* error clearing for l2cache devices.
	*/
	if (avail_spare)
	return (zfs_error(hdl, EZFS_ISSPARE, msg));

	verify(nvlist_lookup_uint64(tgt, ZPOOL_CONFIG_GUID,
	&zc.zc_guid) == 0);
	}

	zpool_get_load_policy(rewindnvl, &policy);
	zc.zc_cookie = policy.zlp_rewind;

	if (zcmd_alloc_dst_nvlist(hdl, &zc, zhp->zpool_config_size * 2) != 0)
	return (-1);

	if (zcmd_write_src_nvlist(hdl, &zc, rewindnvl) != 0)
	return (-1);

	while ((error = zfs_ioctl(hdl, ZFS_IOC_CLEAR, &zc)) != 0 &&
	errno == ENOMEM) {
	if (zcmd_expand_dst_nvlist(hdl, &zc) != 0) {
	zcmd_free_nvlists(&zc);
	return (-1);
	}
	}

	if (!error \|\| ((policy.zlp_rewind & ZPOOL_TRY_REWIND) &&
	errno != EPERM && errno != EACCES)) {
	if (policy.zlp_rewind &
	(ZPOOL_DO_REWIND \| ZPOOL_TRY_REWIND)) {
	(void) zcmd_read_dst_nvlist(hdl, &zc, &nvi);
	zpool_rewind_exclaim(hdl, zc.zc_name,
	((policy.zlp_rewind & ZPOOL_TRY_REWIND) != 0),
	nvi);
	nvlist_free(nvi);
	}
	zcmd_free_nvlists(&zc);
	return (0);
	}

	zcmd_free_nvlists(&zc);
	return (zpool_standard_error(hdl, errno, msg));
	}

	/*
	* Similar to zpool_clear(), but takes a GUID (used by fmd).
	*/
	int
	zpool_vdev_clear(zpool_handle_t *zhp, uint64_t guid)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot clear errors for %llx"),
	(u_longlong_t)guid);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	zc.zc_guid = guid;
	zc.zc_cookie = ZPOOL_NO_REWIND;

	if (zfs_ioctl(hdl, ZFS_IOC_CLEAR, &zc) == 0)
	return (0);

	return (zpool_standard_error(hdl, errno, msg));
	}

	/*
	* Change the GUID for a pool.
	*/
	int
	zpool_reguid(zpool_handle_t *zhp)
	{
	char msg[1024];
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	zfs_cmd_t zc = {"\0"};

	(void) snprintf(msg, sizeof (msg),
	dgettext(TEXT_DOMAIN, "cannot reguid '%s'"), zhp->zpool_name);

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	if (zfs_ioctl(hdl, ZFS_IOC_POOL_REGUID, &zc) == 0)
	return (0);

	return (zpool_standard_error(hdl, errno, msg));
	}

	/*
	* Reopen the pool.
	*/
	int
	zpool_reopen_one(zpool_handle_t zhp, void data)
	{
	libzfs_handle_t *hdl = zpool_get_handle(zhp);
	const char *pool_name = zpool_get_name(zhp);
	boolean_t *scrub_restart = data;
	int error;

	error = lzc_reopen(pool_name, *scrub_restart);
	if (error) {
	return (zpool_standard_error_fmt(hdl, error,
	dgettext(TEXT_DOMAIN, "cannot reopen '%s'"), pool_name));
	}

	return (0);
	}

	/* call into libzfs_core to execute the sync IOCTL per pool */
	int
	zpool_sync_one(zpool_handle_t zhp, void data)
	{
	int ret;
	libzfs_handle_t *hdl = zpool_get_handle(zhp);
	const char *pool_name = zpool_get_name(zhp);
	boolean_t *force = data;
	nvlist_t *innvl = fnvlist_alloc();

	fnvlist_add_boolean_value(innvl, "force", *force);
	if ((ret = lzc_sync(pool_name, innvl, NULL)) != 0) {
	nvlist_free(innvl);
	return (zpool_standard_error_fmt(hdl, ret,
	dgettext(TEXT_DOMAIN, "sync '%s' failed"), pool_name));
	}
	nvlist_free(innvl);

	return (0);
	}

	#define PATH_BUF_LEN 64

	/*
	* Given a vdev, return the name to display in iostat. If the vdev has a path,
	* we use that, stripping off any leading "/dev/dsk/"; if not, we use the type.
	* We also check if this is a whole disk, in which case we strip off the
	* trailing 's0' slice name.
	*
	* This routine is also responsible for identifying when disks have been
	* reconfigured in a new location. The kernel will have opened the device by
	* devid, but the path will still refer to the old location. To catch this, we
	* first do a path -> devid translation (which is fast for the common case). If
	* the devid matches, we're done. If not, we do a reverse devid -> path
	* translation and issue the appropriate ioctl() to update the path of the vdev.
	* If 'zhp' is NULL, then this is an exported pool, and we don't need to do any
	* of these checks.
	*/
	char *
	zpool_vdev_name(libzfs_handle_t hdl, zpool_handle_t zhp, nvlist_t *nv,
	int name_flags)
	{
	char path, type, *env;
	uint64_t value;
	char buf[PATH_BUF_LEN];
	char tmpbuf[PATH_BUF_LEN];

	/*
	* vdev_name will be "root"/"root-0" for the root vdev, but it is the
	* zpool name that will be displayed to the user.
	*/
	verify(nvlist_lookup_string(nv, ZPOOL_CONFIG_TYPE, &type) == 0);
	if (zhp != NULL && strcmp(type, "root") == 0)
	return (zfs_strdup(hdl, zpool_get_name(zhp)));

	env = getenv("ZPOOL_VDEV_NAME_PATH");
	if (env && (strtoul(env, NULL, 0) > 0 \|\|
	!strncasecmp(env, "YES", 3) \|\| !strncasecmp(env, "ON", 2)))
	name_flags \|= VDEV_NAME_PATH;

	env = getenv("ZPOOL_VDEV_NAME_GUID");
	if (env && (strtoul(env, NULL, 0) > 0 \|\|
	!strncasecmp(env, "YES", 3) \|\| !strncasecmp(env, "ON", 2)))
	name_flags \|= VDEV_NAME_GUID;

	env = getenv("ZPOOL_VDEV_NAME_FOLLOW_LINKS");
	if (env && (strtoul(env, NULL, 0) > 0 \|\|
	!strncasecmp(env, "YES", 3) \|\| !strncasecmp(env, "ON", 2)))
	name_flags \|= VDEV_NAME_FOLLOW_LINKS;

	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_NOT_PRESENT, &value) == 0 \|\|
	name_flags & VDEV_NAME_GUID) {
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID, &value);
	(void) snprintf(buf, sizeof (buf), "%llu", (u_longlong_t)value);
	path = buf;
	} else if (nvlist_lookup_string(nv, ZPOOL_CONFIG_PATH, &path) == 0) {
	if (name_flags & VDEV_NAME_FOLLOW_LINKS) {
	char *rp = realpath(path, NULL);
	if (rp) {
	strlcpy(buf, rp, sizeof (buf));
	path = buf;
	free(rp);
	}
	}

	/*
	* For a block device only use the name.
	*/
	if ((strcmp(type, VDEV_TYPE_DISK) == 0) &&
	!(name_flags & VDEV_NAME_PATH)) {
	path = zfs_strip_path(path);
	}

	/*
	* Remove the partition from the path it this is a whole disk.
	*/
	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_WHOLE_DISK, &value)
	== 0 && value && !(name_flags & VDEV_NAME_PATH)) {
	return (zfs_strip_partition(path));
	}
	} else {
	path = type;

	/*
	* If it's a raidz device, we need to stick in the parity level.
	*/
	if (strcmp(path, VDEV_TYPE_RAIDZ) == 0) {
	verify(nvlist_lookup_uint64(nv, ZPOOL_CONFIG_NPARITY,
	&value) == 0);
	(void) snprintf(buf, sizeof (buf), "%s%llu", path,
	(u_longlong_t)value);
	path = buf;
	}

	/*
	* We identify each top-level vdev by using a <type-id>
	* naming convention.
	*/
	if (name_flags & VDEV_NAME_TYPE_ID) {
	uint64_t id;
	verify(nvlist_lookup_uint64(nv, ZPOOL_CONFIG_ID,
	&id) == 0);
	(void) snprintf(tmpbuf, sizeof (tmpbuf), "%s-%llu",
	path, (u_longlong_t)id);
	path = tmpbuf;
	}
	}

	return (zfs_strdup(hdl, path));
	}

	static int
	zbookmark_mem_compare(const void a, const void b)
	{
	return (memcmp(a, b, sizeof (zbookmark_phys_t)));
	}

	/*
	* Retrieve the persistent error log, uniquify the members, and return to the
	* caller.
	*/
	int
	zpool_get_errlog(zpool_handle_t zhp, nvlist_t *nverrlistp)
	{
	zfs_cmd_t zc = {"\0"};
	libzfs_handle_t *hdl = zhp->zpool_hdl;
	uint64_t count;
	zbookmark_phys_t *zb = NULL;
	int i;

	/*
	* Retrieve the raw error list from the kernel. If the number of errors
	* has increased, allocate more space and continue until we get the
	* entire list.
	*/
	verify(nvlist_lookup_uint64(zhp->zpool_config, ZPOOL_CONFIG_ERRCOUNT,
	&count) == 0);
	if (count == 0)
	return (0);
	zc.zc_nvlist_dst = (uintptr_t)zfs_alloc(zhp->zpool_hdl,
	count * sizeof (zbookmark_phys_t));
	zc.zc_nvlist_dst_size = count;
	(void) strcpy(zc.zc_name, zhp->zpool_name);
	for (;;) {
	if (zfs_ioctl(zhp->zpool_hdl, ZFS_IOC_ERROR_LOG,
	&zc) != 0) {
	free((void *)(uintptr_t)zc.zc_nvlist_dst);
	if (errno == ENOMEM) {
	void *dst;

	count = zc.zc_nvlist_dst_size;
	dst = zfs_alloc(zhp->zpool_hdl, count *
	sizeof (zbookmark_phys_t));
	zc.zc_nvlist_dst = (uintptr_t)dst;
	} else {
	return (zpool_standard_error_fmt(hdl, errno,
	dgettext(TEXT_DOMAIN, "errors: List of "
	"errors unavailable")));
	}
	} else {
	break;
	}
	}

	/*
	* Sort the resulting bookmarks. This is a little confusing due to the
	* implementation of ZFS_IOC_ERROR_LOG. The bookmarks are copied last
	* to first, and 'zc_nvlist_dst_size' indicates the number of bookmarks
	* _not_ copied as part of the process. So we point the start of our
	* array appropriate and decrement the total number of elements.
	*/
	zb = ((zbookmark_phys_t *)(uintptr_t)zc.zc_nvlist_dst) +
	zc.zc_nvlist_dst_size;
	count -= zc.zc_nvlist_dst_size;

	qsort(zb, count, sizeof (zbookmark_phys_t), zbookmark_mem_compare);

	verify(nvlist_alloc(nverrlistp, 0, KM_SLEEP) == 0);

	/*
	* Fill in the nverrlistp with nvlist's of dataset and object numbers.
	*/
	for (i = 0; i < count; i++) {
	nvlist_t *nv;

	/* ignoring zb_blkid and zb_level for now */
	if (i > 0 && zb[i-1].zb_objset == zb[i].zb_objset &&
	zb[i-1].zb_object == zb[i].zb_object)
	continue;

	if (nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) != 0)
	goto nomem;
	if (nvlist_add_uint64(nv, ZPOOL_ERR_DATASET,
	zb[i].zb_objset) != 0) {
	nvlist_free(nv);
	goto nomem;
	}
	if (nvlist_add_uint64(nv, ZPOOL_ERR_OBJECT,
	zb[i].zb_object) != 0) {
	nvlist_free(nv);
	goto nomem;
	}
	if (nvlist_add_nvlist(*nverrlistp, "ejk", nv) != 0) {
	nvlist_free(nv);
	goto nomem;
	}
	nvlist_free(nv);
	}

	free((void *)(uintptr_t)zc.zc_nvlist_dst);
	return (0);

	nomem:
	free((void *)(uintptr_t)zc.zc_nvlist_dst);
	return (no_memory(zhp->zpool_hdl));
	}

	/*
	* Upgrade a ZFS pool to the latest on-disk version.
	*/
	int
	zpool_upgrade(zpool_handle_t *zhp, uint64_t new_version)
	{
	zfs_cmd_t zc = {"\0"};
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) strcpy(zc.zc_name, zhp->zpool_name);
	zc.zc_cookie = new_version;

	if (zfs_ioctl(hdl, ZFS_IOC_POOL_UPGRADE, &zc) != 0)
	return (zpool_standard_error_fmt(hdl, errno,
	dgettext(TEXT_DOMAIN, "cannot upgrade '%s'"),
	zhp->zpool_name));
	return (0);
	}

	void
	zfs_save_arguments(int argc, char *argv, char string, int len)
	{
	int i;

	(void) strlcpy(string, basename(argv[0]), len);
	for (i = 1; i < argc; i++) {
	(void) strlcat(string, " ", len);
	(void) strlcat(string, argv[i], len);
	}
	}

	int
	zpool_log_history(libzfs_handle_t hdl, const char message)
	{
	zfs_cmd_t zc = {"\0"};
	nvlist_t *args;
	int err;

	args = fnvlist_alloc();
	fnvlist_add_string(args, "message", message);
	err = zcmd_write_src_nvlist(hdl, &zc, args);
	if (err == 0)
	err = zfs_ioctl(hdl, ZFS_IOC_LOG_HISTORY, &zc);
	nvlist_free(args);
	zcmd_free_nvlists(&zc);
	return (err);
	}

	/*
	* Perform ioctl to get some command history of a pool.
	*
	* 'buf' is the buffer to fill up to 'len' bytes. 'off' is the
	* logical offset of the history buffer to start reading from.
	*
	* Upon return, 'off' is the next logical offset to read from and
	* 'len' is the actual amount of bytes read into 'buf'.
	*/
	static int
	get_history(zpool_handle_t zhp, char buf, uint64_t off, uint64_t len)
	{
	zfs_cmd_t zc = {"\0"};
	libzfs_handle_t *hdl = zhp->zpool_hdl;

	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));

	zc.zc_history = (uint64_t)(uintptr_t)buf;
	zc.zc_history_len = *len;
	zc.zc_history_offset = *off;

	if (zfs_ioctl(hdl, ZFS_IOC_POOL_GET_HISTORY, &zc) != 0) {
	switch (errno) {
	case EPERM:
	return (zfs_error_fmt(hdl, EZFS_PERM,
	dgettext(TEXT_DOMAIN,
	"cannot show history for pool '%s'"),
	zhp->zpool_name));
	case ENOENT:
	return (zfs_error_fmt(hdl, EZFS_NOHISTORY,
	dgettext(TEXT_DOMAIN, "cannot get history for pool "
	"'%s'"), zhp->zpool_name));
	case ENOTSUP:
	return (zfs_error_fmt(hdl, EZFS_BADVERSION,
	dgettext(TEXT_DOMAIN, "cannot get history for pool "
	"'%s', pool must be upgraded"), zhp->zpool_name));
	default:
	return (zpool_standard_error_fmt(hdl, errno,
	dgettext(TEXT_DOMAIN,
	"cannot get history for '%s'"), zhp->zpool_name));
	}
	}

	*len = zc.zc_history_len;
	*off = zc.zc_history_offset;

	return (0);
	}

	/*
	* Retrieve the command history of a pool.
	*/
	int
	zpool_get_history(zpool_handle_t zhp, nvlist_t nvhisp, uint64_t off,
	boolean_t *eof)
	{
	char *buf;
	int buflen = 128 * 1024;
	nvlist_t **records = NULL;
	uint_t numrecords = 0;
	int err, i;
	uint64_t start = *off;

	buf = malloc(buflen);
	if (buf == NULL)
	return (ENOMEM);
	/* process about 1MB a time */
	while (off - start < 1024 1024) {
	uint64_t bytes_read = buflen;
	uint64_t leftover;

	if ((err = get_history(zhp, buf, off, &bytes_read)) != 0)
	break;

	/* if nothing else was read in, we're at EOF, just return */
	if (!bytes_read) {
	*eof = B_TRUE;
	break;
	}

	if ((err = zpool_history_unpack(buf, bytes_read,
	&leftover, &records, &numrecords)) != 0)
	break;
	*off -= leftover;
	if (leftover == bytes_read) {
	/*
	* no progress made, because buffer is not big enough
	* to hold this record; resize and retry.
	*/
	buflen *= 2;
	free(buf);
	buf = malloc(buflen);
	if (buf == NULL)
	return (ENOMEM);
	}
	}

	free(buf);

	if (!err) {
	verify(nvlist_alloc(nvhisp, NV_UNIQUE_NAME, 0) == 0);
	verify(nvlist_add_nvlist_array(*nvhisp, ZPOOL_HIST_RECORD,
	records, numrecords) == 0);
	}
	for (i = 0; i < numrecords; i++)
	nvlist_free(records[i]);
	free(records);

	return (err);
	}

	/*
	* Retrieve the next event given the passed 'zevent_fd' file descriptor.
	* If there is a new event available 'nvp' will contain a newly allocated
	* nvlist and 'dropped' will be set to the number of missed events since
	* the last call to this function. When 'nvp' is set to NULL it indicates
	* no new events are available. In either case the function returns 0 and
	* it is up to the caller to free 'nvp'. In the case of a fatal error the
	* function will return a non-zero value. When the function is called in
	* blocking mode (the default, unless the ZEVENT_NONBLOCK flag is passed),
	* it will not return until a new event is available.
	*/
	int
	zpool_events_next(libzfs_handle_t hdl, nvlist_t *nvp,
	int *dropped, unsigned flags, int zevent_fd)
	{
	zfs_cmd_t zc = {"\0"};
	int error = 0;

	*nvp = NULL;
	*dropped = 0;
	zc.zc_cleanup_fd = zevent_fd;

	if (flags & ZEVENT_NONBLOCK)
	zc.zc_guid = ZEVENT_NONBLOCK;

	if (zcmd_alloc_dst_nvlist(hdl, &zc, ZEVENT_SIZE) != 0)
	return (-1);

	retry:
	if (zfs_ioctl(hdl, ZFS_IOC_EVENTS_NEXT, &zc) != 0) {
	switch (errno) {
	case ESHUTDOWN:
	error = zfs_error_fmt(hdl, EZFS_POOLUNAVAIL,
	dgettext(TEXT_DOMAIN, "zfs shutdown"));
	goto out;
	case ENOENT:
	/* Blocking error case should not occur */
	if (!(flags & ZEVENT_NONBLOCK))
	error = zpool_standard_error_fmt(hdl, errno,
	dgettext(TEXT_DOMAIN, "cannot get event"));

	goto out;
	case ENOMEM:
	if (zcmd_expand_dst_nvlist(hdl, &zc) != 0) {
	error = zfs_error_fmt(hdl, EZFS_NOMEM,
	dgettext(TEXT_DOMAIN, "cannot get event"));
	goto out;
	} else {
	goto retry;
	}
	default:
	error = zpool_standard_error_fmt(hdl, errno,
	dgettext(TEXT_DOMAIN, "cannot get event"));
	goto out;
	}
	}

	error = zcmd_read_dst_nvlist(hdl, &zc, nvp);
	if (error != 0)
	goto out;

	*dropped = (int)zc.zc_cookie;
	out:
	zcmd_free_nvlists(&zc);

	return (error);
	}

	/*
	* Clear all events.
	*/
	int
	zpool_events_clear(libzfs_handle_t hdl, int count)
	{
	zfs_cmd_t zc = {"\0"};
	char msg[1024];

	(void) snprintf(msg, sizeof (msg), dgettext(TEXT_DOMAIN,
	"cannot clear events"));

	if (zfs_ioctl(hdl, ZFS_IOC_EVENTS_CLEAR, &zc) != 0)
	return (zpool_standard_error_fmt(hdl, errno, msg));

	if (count != NULL)
	count = (int)zc.zc_cookie; / # of events cleared */

	return (0);
	}

	/*
	* Seek to a specific EID, ZEVENT_SEEK_START, or ZEVENT_SEEK_END for
	* the passed zevent_fd file handle. On success zero is returned,
	* otherwise -1 is returned and hdl->libzfs_error is set to the errno.
	*/
	int
	zpool_events_seek(libzfs_handle_t *hdl, uint64_t eid, int zevent_fd)
	{
	zfs_cmd_t zc = {"\0"};
	int error = 0;

	zc.zc_guid = eid;
	zc.zc_cleanup_fd = zevent_fd;

	if (zfs_ioctl(hdl, ZFS_IOC_EVENTS_SEEK, &zc) != 0) {
	switch (errno) {
	case ENOENT:
	error = zfs_error_fmt(hdl, EZFS_NOENT,
	dgettext(TEXT_DOMAIN, "cannot get event"));
	break;

	case ENOMEM:
	error = zfs_error_fmt(hdl, EZFS_NOMEM,
	dgettext(TEXT_DOMAIN, "cannot get event"));
	break;

	default:
	error = zpool_standard_error_fmt(hdl, errno,
	dgettext(TEXT_DOMAIN, "cannot get event"));
	break;
	}
	}

	return (error);
	}

	static void
	zpool_obj_to_path_impl(zpool_handle_t *zhp, uint64_t dsobj, uint64_t obj,
	char *pathname, size_t len, boolean_t always_unmounted)
	{
	zfs_cmd_t zc = {"\0"};
	boolean_t mounted = B_FALSE;
	char *mntpnt = NULL;
	char dsname[ZFS_MAX_DATASET_NAME_LEN];

	if (dsobj == 0) {
	/* special case for the MOS */
	(void) snprintf(pathname, len, "<metadata>:<0x%llx>",
	(longlong_t)obj);
	return;
	}

	/* get the dataset's name */
	(void) strlcpy(zc.zc_name, zhp->zpool_name, sizeof (zc.zc_name));
	zc.zc_obj = dsobj;
	if (zfs_ioctl(zhp->zpool_hdl,
	ZFS_IOC_DSOBJ_TO_DSNAME, &zc) != 0) {
	/* just write out a path of two object numbers */
	(void) snprintf(pathname, len, "<0x%llx>:<0x%llx>",
	(longlong_t)dsobj, (longlong_t)obj);
	return;
	}
	(void) strlcpy(dsname, zc.zc_value, sizeof (dsname));

	/* find out if the dataset is mounted */
	mounted = !always_unmounted && is_mounted(zhp->zpool_hdl, dsname,
	&mntpnt);

	/* get the corrupted object's path */
	(void) strlcpy(zc.zc_name, dsname, sizeof (zc.zc_name));
	zc.zc_obj = obj;
	if (zfs_ioctl(zhp->zpool_hdl, ZFS_IOC_OBJ_TO_PATH,
	&zc) == 0) {
	if (mounted) {
	(void) snprintf(pathname, len, "%s%s", mntpnt,
	zc.zc_value);
	} else {
	(void) snprintf(pathname, len, "%s:%s",
	dsname, zc.zc_value);
	}
	} else {
	(void) snprintf(pathname, len, "%s:<0x%llx>", dsname,
	(longlong_t)obj);
	}
	free(mntpnt);
	}

	void
	zpool_obj_to_path(zpool_handle_t *zhp, uint64_t dsobj, uint64_t obj,
	char *pathname, size_t len)
	{
	zpool_obj_to_path_impl(zhp, dsobj, obj, pathname, len, B_FALSE);
	}

	void
	zpool_obj_to_path_ds(zpool_handle_t *zhp, uint64_t dsobj, uint64_t obj,
	char *pathname, size_t len)
	{
	zpool_obj_to_path_impl(zhp, dsobj, obj, pathname, len, B_TRUE);
	}
	/*
	* Wait while the specified activity is in progress in the pool.
	*/
	int
	zpool_wait(zpool_handle_t *zhp, zpool_wait_activity_t activity)
	{
	boolean_t missing;

	int error = zpool_wait_status(zhp, activity, &missing, NULL);

	if (missing) {
	(void) zpool_standard_error_fmt(zhp->zpool_hdl, ENOENT,
	dgettext(TEXT_DOMAIN, "error waiting in pool '%s'"),
	zhp->zpool_name);
	return (ENOENT);
	} else {
	return (error);
	}
	}

	/*
	* Wait for the given activity and return the status of the wait (whether or not
	* any waiting was done) in the 'waited' parameter. Non-existent pools are
	* reported via the 'missing' parameter, rather than by printing an error
	* message. This is convenient when this function is called in a loop over a
	* long period of time (as it is, for example, by zpool's wait cmd). In that
	* scenario, a pool being exported or destroyed should be considered a normal
	* event, so we don't want to print an error when we find that the pool doesn't
	* exist.
	*/
	int
	zpool_wait_status(zpool_handle_t *zhp, zpool_wait_activity_t activity,
	boolean_t missing, boolean_t waited)
	{
	int error = lzc_wait(zhp->zpool_name, activity, waited);
	*missing = (error == ENOENT);
	if (*missing)
	return (0);

	if (error != 0) {
	(void) zpool_standard_error_fmt(zhp->zpool_hdl, error,
	dgettext(TEXT_DOMAIN, "error waiting in pool '%s'"),
	zhp->zpool_name);
	}

	return (error);
	}

	int
	-zpool_set_bootenv(zpool_handle_t zhp, const char envmap)
	+zpool_set_bootenv(zpool_handle_t zhp, const nvlist_t envmap)
	{
	int error = lzc_set_bootenv(zhp->zpool_name, envmap);
	if (error != 0) {
	(void) zpool_standard_error_fmt(zhp->zpool_hdl, error,
	dgettext(TEXT_DOMAIN,
	"error setting bootenv in pool '%s'"), zhp->zpool_name);
	}

	return (error);
	}

	int
	-zpool_get_bootenv(zpool_handle_t zhp, char outbuf, size_t size, off_t offset)
	+zpool_get_bootenv(zpool_handle_t zhp, nvlist_t *nvlp)
	{
	- nvlist_t *nvl = NULL;
	- int error = lzc_get_bootenv(zhp->zpool_name, &nvl);
	+ nvlist_t *nvl;
	+ int error;
	+
	+ nvl = NULL;
	+ error = lzc_get_bootenv(zhp->zpool_name, &nvl);
	if (error != 0) {
	(void) zpool_standard_error_fmt(zhp->zpool_hdl, error,
	dgettext(TEXT_DOMAIN,
	"error getting bootenv in pool '%s'"), zhp->zpool_name);
	- return (-1);
	+ } else {
	+ *nvlp = nvl;
	}
	- char *envmap = fnvlist_lookup_string(nvl, "envmap");
	- if (offset >= strlen(envmap)) {
	- fnvlist_free(nvl);
	- return (0);
	- }

	- strncpy(outbuf, envmap + offset, size);
	- int bytes = MIN(strlen(envmap + offset), size);
	- fnvlist_free(nvl);
	- return (bytes);
	+ return (error);
	}
	Index: vendor-sys/openzfs/dist/lib/libzfs/libzfs_sendrecv.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfs/libzfs_sendrecv.c (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzfs/libzfs_sendrecv.c (revision 365892)
	@@ -1,5202 +1,5203 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2012, Joyent, Inc. All rights reserved.
	* Copyright (c) 2012 Pawel Jakub Dawidek <pawel@dawidek.net>.
	* All rights reserved
	* Copyright (c) 2013 Steven Hartland. All rights reserved.
	* Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
	* Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
	* Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
	* Copyright (c) 2019 Datto Inc.
	*/

	#include <assert.h>
	#include <ctype.h>
	#include <errno.h>
	#include <libintl.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <strings.h>
	#include <unistd.h>
	#include <stddef.h>
	#include <fcntl.h>
	#include <sys/mount.h>
	#include <sys/mntent.h>
	#include <sys/mnttab.h>
	#include <sys/avl.h>
	#include <sys/debug.h>
	#include <sys/stat.h>
	#include <stddef.h>
	#include <pthread.h>
	#include <umem.h>
	#include <time.h>

	#include <libzfs.h>
	#include <libzfs_core.h>
	#include <libzutil.h>

	#include "zfs_namecheck.h"
	#include "zfs_prop.h"
	#include "zfs_fletcher.h"
	#include "libzfs_impl.h"
	#include <cityhash.h>
	#include <zlib.h>
	#include <sys/zio_checksum.h>
	#include <sys/dsl_crypt.h>
	#include <sys/ddt.h>
	#include <sys/socket.h>
	#include <sys/sha2.h>

	static int zfs_receive_impl(libzfs_handle_t , const char , const char *,
	recvflags_t , int, const char , nvlist_t , avl_tree_t , char **,
	const char , nvlist_t );
	static int guid_to_name_redact_snaps(libzfs_handle_t hdl, const char parent,
	uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
	uint64_t num_redact_snaps, char *name);
	static int guid_to_name(libzfs_handle_t , const char ,
	uint64_t, boolean_t, char *);

	typedef struct progress_arg {
	zfs_handle_t *pa_zhp;
	int pa_fd;
	boolean_t pa_parsable;
	boolean_t pa_estimate;
	int pa_verbosity;
	} progress_arg_t;

	static int
	dump_record(dmu_replay_record_t drr, void payload, int payload_len,
	zio_cksum_t *zc, int outfd)
	{
	ASSERT3U(offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum),
	==, sizeof (dmu_replay_record_t) - sizeof (zio_cksum_t));
	fletcher_4_incremental_native(drr,
	offsetof(dmu_replay_record_t, drr_u.drr_checksum.drr_checksum), zc);
	if (drr->drr_type != DRR_BEGIN) {
	ASSERT(ZIO_CHECKSUM_IS_ZERO(&drr->drr_u.
	drr_checksum.drr_checksum));
	drr->drr_u.drr_checksum.drr_checksum = *zc;
	}
	fletcher_4_incremental_native(&drr->drr_u.drr_checksum.drr_checksum,
	sizeof (zio_cksum_t), zc);
	if (write(outfd, drr, sizeof (*drr)) == -1)
	return (errno);
	if (payload_len != 0) {
	fletcher_4_incremental_native(payload, payload_len, zc);
	if (write(outfd, payload, payload_len) == -1)
	return (errno);
	}
	return (0);
	}

	/*
	* Routines for dealing with the AVL tree of fs-nvlists
	*/
	typedef struct fsavl_node {
	avl_node_t fn_node;
	nvlist_t *fn_nvfs;
	char *fn_snapname;
	uint64_t fn_guid;
	} fsavl_node_t;

	static int
	fsavl_compare(const void arg1, const void arg2)
	{
	const fsavl_node_t fn1 = (const fsavl_node_t )arg1;
	const fsavl_node_t fn2 = (const fsavl_node_t )arg2;

	return (TREE_CMP(fn1->fn_guid, fn2->fn_guid));
	}

	/*
	* Given the GUID of a snapshot, find its containing filesystem and
	* (optionally) name.
	*/
	static nvlist_t *
	fsavl_find(avl_tree_t avl, uint64_t snapguid, char *snapname)
	{
	fsavl_node_t fn_find;
	fsavl_node_t *fn;

	fn_find.fn_guid = snapguid;

	fn = avl_find(avl, &fn_find, NULL);
	if (fn) {
	if (snapname)
	*snapname = fn->fn_snapname;
	return (fn->fn_nvfs);
	}
	return (NULL);
	}

	static void
	fsavl_destroy(avl_tree_t *avl)
	{
	fsavl_node_t *fn;
	void *cookie;

	if (avl == NULL)
	return;

	cookie = NULL;
	while ((fn = avl_destroy_nodes(avl, &cookie)) != NULL)
	free(fn);
	avl_destroy(avl);
	free(avl);
	}

	/*
	* Given an nvlist, produce an avl tree of snapshots, ordered by guid
	*/
	static avl_tree_t *
	fsavl_create(nvlist_t *fss)
	{
	avl_tree_t *fsavl;
	nvpair_t *fselem = NULL;

	if ((fsavl = malloc(sizeof (avl_tree_t))) == NULL)
	return (NULL);

	avl_create(fsavl, fsavl_compare, sizeof (fsavl_node_t),
	offsetof(fsavl_node_t, fn_node));

	while ((fselem = nvlist_next_nvpair(fss, fselem)) != NULL) {
	nvlist_t nvfs, snaps;
	nvpair_t *snapelem = NULL;

	VERIFY(0 == nvpair_value_nvlist(fselem, &nvfs));
	VERIFY(0 == nvlist_lookup_nvlist(nvfs, "snaps", &snaps));

	while ((snapelem =
	nvlist_next_nvpair(snaps, snapelem)) != NULL) {
	fsavl_node_t *fn;
	uint64_t guid;

	VERIFY(0 == nvpair_value_uint64(snapelem, &guid));
	if ((fn = malloc(sizeof (fsavl_node_t))) == NULL) {
	fsavl_destroy(fsavl);
	return (NULL);
	}
	fn->fn_nvfs = nvfs;
	fn->fn_snapname = nvpair_name(snapelem);
	fn->fn_guid = guid;

	/*
	* Note: if there are multiple snaps with the
	* same GUID, we ignore all but one.
	*/
	if (avl_find(fsavl, fn, NULL) == NULL)
	avl_add(fsavl, fn);
	else
	free(fn);
	}
	}

	return (fsavl);
	}

	/*
	* Routines for dealing with the giant nvlist of fs-nvlists, etc.
	*/
	typedef struct send_data {
	/*
	* assigned inside every recursive call,
	* restored from *_save on return:
	*
	* guid of fromsnap snapshot in parent dataset
	* txg of fromsnap snapshot in current dataset
	* txg of tosnap snapshot in current dataset
	*/

	uint64_t parent_fromsnap_guid;
	uint64_t fromsnap_txg;
	uint64_t tosnap_txg;

	/* the nvlists get accumulated during depth-first traversal */
	nvlist_t *parent_snaps;
	nvlist_t *fss;
	nvlist_t *snapprops;
	nvlist_t snapholds; / user holds */

	/* send-receive configuration, does not change during traversal */
	const char *fsname;
	const char *fromsnap;
	const char *tosnap;
	boolean_t recursive;
	boolean_t raw;
	boolean_t doall;
	boolean_t replicate;
	boolean_t verbose;
	boolean_t backup;
	boolean_t seenfrom;
	boolean_t seento;
	boolean_t holds; /* were holds requested with send -h */
	boolean_t props;

	/*
	* The header nvlist is of the following format:
	* {
	* "tosnap" -> string
	* "fromsnap" -> string (if incremental)
	* "fss" -> {
	* id -> {
	*
	* "name" -> string (full name; for debugging)
	* "parentfromsnap" -> number (guid of fromsnap in parent)
	*
	* "props" -> { name -> value (only if set here) }
	* "snaps" -> { name (lastname) -> number (guid) }
	* "snapprops" -> { name (lastname) -> { name -> value } }
	* "snapholds" -> { name (lastname) -> { holdname -> crtime } }
	*
	* "origin" -> number (guid) (if clone)
	* "is_encroot" -> boolean
	* "sent" -> boolean (not on-disk)
	* }
	* }
	* }
	*
	*/
	} send_data_t;

	static void
	send_iterate_prop(zfs_handle_t zhp, boolean_t received_only, nvlist_t nv);

	static int
	send_iterate_snap(zfs_handle_t zhp, void arg)
	{
	send_data_t *sd = arg;
	uint64_t guid = zhp->zfs_dmustats.dds_guid;
	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
	char *snapname;
	nvlist_t *nv;
	boolean_t isfromsnap, istosnap, istosnapwithnofrom;

	snapname = strrchr(zhp->zfs_name, '@')+1;
	isfromsnap = (sd->fromsnap != NULL &&
	strcmp(sd->fromsnap, snapname) == 0);
	istosnap = (sd->tosnap != NULL && (strcmp(sd->tosnap, snapname) == 0));
	istosnapwithnofrom = (istosnap && sd->fromsnap == NULL);

	if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
	if (sd->verbose) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"skipping snapshot %s because it was created "
	"after the destination snapshot (%s)\n"),
	zhp->zfs_name, sd->tosnap);
	}
	zfs_close(zhp);
	return (0);
	}

	VERIFY(0 == nvlist_add_uint64(sd->parent_snaps, snapname, guid));
	/*
	* NB: if there is no fromsnap here (it's a newly created fs in
	* an incremental replication), we will substitute the tosnap.
	*/
	if (isfromsnap \|\| (sd->parent_fromsnap_guid == 0 && istosnap)) {
	sd->parent_fromsnap_guid = guid;
	}

	if (!sd->recursive) {
	if (!sd->seenfrom && isfromsnap) {
	sd->seenfrom = B_TRUE;
	zfs_close(zhp);
	return (0);
	}

	if ((sd->seento \|\| !sd->seenfrom) && !istosnapwithnofrom) {
	zfs_close(zhp);
	return (0);
	}

	if (istosnap)
	sd->seento = B_TRUE;
	}

	VERIFY(0 == nvlist_alloc(&nv, NV_UNIQUE_NAME, 0));
	send_iterate_prop(zhp, sd->backup, nv);
	VERIFY(0 == nvlist_add_nvlist(sd->snapprops, snapname, nv));
	nvlist_free(nv);
	if (sd->holds) {
	nvlist_t *holds = fnvlist_alloc();
	int err = lzc_get_holds(zhp->zfs_name, &holds);
	if (err == 0) {
	VERIFY(0 == nvlist_add_nvlist(sd->snapholds,
	snapname, holds));
	}
	fnvlist_free(holds);
	}

	zfs_close(zhp);
	return (0);
	}

	static void
	send_iterate_prop(zfs_handle_t zhp, boolean_t received_only, nvlist_t nv)
	{
	nvlist_t *props = NULL;
	nvpair_t *elem = NULL;

	if (received_only)
	props = zfs_get_recvd_props(zhp);
	else
	props = zhp->zfs_props;

	while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
	char *propname = nvpair_name(elem);
	zfs_prop_t prop = zfs_name_to_prop(propname);
	nvlist_t *propnv;

	if (!zfs_prop_user(propname)) {
	/*
	* Realistically, this should never happen. However,
	* we want the ability to add DSL properties without
	* needing to make incompatible version changes. We
	* need to ignore unknown properties to allow older
	* software to still send datasets containing these
	* properties, with the unknown properties elided.
	*/
	if (prop == ZPROP_INVAL)
	continue;

	if (zfs_prop_readonly(prop))
	continue;
	}

	verify(nvpair_value_nvlist(elem, &propnv) == 0);
	if (prop == ZFS_PROP_QUOTA \|\| prop == ZFS_PROP_RESERVATION \|\|
	prop == ZFS_PROP_REFQUOTA \|\|
	prop == ZFS_PROP_REFRESERVATION) {
	char *source;
	uint64_t value;
	verify(nvlist_lookup_uint64(propnv,
	ZPROP_VALUE, &value) == 0);
	if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT)
	continue;
	/*
	* May have no source before SPA_VERSION_RECVD_PROPS,
	* but is still modifiable.
	*/
	if (nvlist_lookup_string(propnv,
	ZPROP_SOURCE, &source) == 0) {
	if ((strcmp(source, zhp->zfs_name) != 0) &&
	(strcmp(source,
	ZPROP_SOURCE_VAL_RECVD) != 0))
	continue;
	}
	} else {
	char *source;
	if (nvlist_lookup_string(propnv,
	ZPROP_SOURCE, &source) != 0)
	continue;
	if ((strcmp(source, zhp->zfs_name) != 0) &&
	(strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0))
	continue;
	}

	if (zfs_prop_user(propname) \|\|
	zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
	char *value;
	verify(nvlist_lookup_string(propnv,
	ZPROP_VALUE, &value) == 0);
	VERIFY(0 == nvlist_add_string(nv, propname, value));
	} else {
	uint64_t value;
	verify(nvlist_lookup_uint64(propnv,
	ZPROP_VALUE, &value) == 0);
	VERIFY(0 == nvlist_add_uint64(nv, propname, value));
	}
	}
	}

	/*
	* returns snapshot creation txg
	* and returns 0 if the snapshot does not exist
	*/
	static uint64_t
	get_snap_txg(libzfs_handle_t hdl, const char fs, const char *snap)
	{
	char name[ZFS_MAX_DATASET_NAME_LEN];
	uint64_t txg = 0;

	if (fs == NULL \|\| fs[0] == '\0' \|\| snap == NULL \|\| snap[0] == '\0')
	return (txg);

	(void) snprintf(name, sizeof (name), "%s@%s", fs, snap);
	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_SNAPSHOT)) {
	zfs_handle_t *zhp = zfs_open(hdl, name, ZFS_TYPE_SNAPSHOT);
	if (zhp != NULL) {
	txg = zfs_prop_get_int(zhp, ZFS_PROP_CREATETXG);
	zfs_close(zhp);
	}
	}

	return (txg);
	}

	/*
	* recursively generate nvlists describing datasets. See comment
	* for the data structure send_data_t above for description of contents
	* of the nvlist.
	*/
	static int
	send_iterate_fs(zfs_handle_t zhp, void arg)
	{
	send_data_t *sd = arg;
	nvlist_t nvfs = NULL, nv = NULL;
	int rv = 0;
	uint64_t min_txg = 0, max_txg = 0;
	uint64_t parent_fromsnap_guid_save = sd->parent_fromsnap_guid;
	uint64_t fromsnap_txg_save = sd->fromsnap_txg;
	uint64_t tosnap_txg_save = sd->tosnap_txg;
	uint64_t txg = zhp->zfs_dmustats.dds_creation_txg;
	uint64_t guid = zhp->zfs_dmustats.dds_guid;
	uint64_t fromsnap_txg, tosnap_txg;
	char guidstring[64];

	fromsnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->fromsnap);
	if (fromsnap_txg != 0)
	sd->fromsnap_txg = fromsnap_txg;

	tosnap_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name, sd->tosnap);
	if (tosnap_txg != 0)
	sd->tosnap_txg = tosnap_txg;

	/*
	* on the send side, if the current dataset does not have tosnap,
	* perform two additional checks:
	*
	* - skip sending the current dataset if it was created later than
	* the parent tosnap
	* - return error if the current dataset was created earlier than
	* the parent tosnap
	*/
	if (sd->tosnap != NULL && tosnap_txg == 0) {
	if (sd->tosnap_txg != 0 && txg > sd->tosnap_txg) {
	if (sd->verbose) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"skipping dataset %s: snapshot %s does "
	"not exist\n"), zhp->zfs_name, sd->tosnap);
	}
	} else {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"cannot send %s@%s%s: snapshot %s@%s does not "
	"exist\n"), sd->fsname, sd->tosnap, sd->recursive ?
	dgettext(TEXT_DOMAIN, " recursively") : "",
	zhp->zfs_name, sd->tosnap);
	rv = EZFS_NOENT;
	}
	goto out;
	}

	nvfs = fnvlist_alloc();
	fnvlist_add_string(nvfs, "name", zhp->zfs_name);
	fnvlist_add_uint64(nvfs, "parentfromsnap",
	sd->parent_fromsnap_guid);

	if (zhp->zfs_dmustats.dds_origin[0]) {
	zfs_handle_t *origin = zfs_open(zhp->zfs_hdl,
	zhp->zfs_dmustats.dds_origin, ZFS_TYPE_SNAPSHOT);
	if (origin == NULL) {
	rv = -1;
	goto out;
	}
	fnvlist_add_uint64(nvfs, "origin",
	origin->zfs_dmustats.dds_guid);

	zfs_close(origin);
	}

	/* iterate over props */
	if (sd->props \|\| sd->backup \|\| sd->recursive) {
	nv = fnvlist_alloc();
	send_iterate_prop(zhp, sd->backup, nv);
	}
	if (zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) != ZIO_CRYPT_OFF) {
	boolean_t encroot;

	/* determine if this dataset is an encryption root */
	if (zfs_crypto_get_encryption_root(zhp, &encroot, NULL) != 0) {
	rv = -1;
	goto out;
	}

	if (encroot)
	fnvlist_add_boolean(nvfs, "is_encroot");

	/*
	* Encrypted datasets can only be sent with properties if
	* the raw flag is specified because the receive side doesn't
	* currently have a mechanism for recursively asking the user
	* for new encryption parameters.
	*/
	if (!sd->raw) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"cannot send %s@%s: encrypted dataset %s may not "
	"be sent with properties without the raw flag\n"),
	sd->fsname, sd->tosnap, zhp->zfs_name);
	rv = -1;
	goto out;
	}

	}

	if (nv != NULL)
	fnvlist_add_nvlist(nvfs, "props", nv);

	/* iterate over snaps, and set sd->parent_fromsnap_guid */
	sd->parent_fromsnap_guid = 0;
	sd->parent_snaps = fnvlist_alloc();
	sd->snapprops = fnvlist_alloc();
	if (sd->holds)
	VERIFY(0 == nvlist_alloc(&sd->snapholds, NV_UNIQUE_NAME, 0));


	/*
	* If this is a "doall" send, a replicate send or we're just trying
	* to gather a list of previous snapshots, iterate through all the
	* snaps in the txg range. Otherwise just look at the one we're
	* interested in.
	*/
	if (sd->doall \|\| sd->replicate \|\| sd->tosnap == NULL) {
	if (!sd->replicate && fromsnap_txg != 0)
	min_txg = fromsnap_txg;
	if (!sd->replicate && tosnap_txg != 0)
	max_txg = tosnap_txg;
	(void) zfs_iter_snapshots_sorted(zhp, send_iterate_snap, sd,
	min_txg, max_txg);
	} else {
	char snapname[MAXPATHLEN] = { 0 };
	zfs_handle_t *snap;

	(void) snprintf(snapname, sizeof (snapname), "%s@%s",
	zhp->zfs_name, sd->tosnap);
	if (sd->fromsnap != NULL)
	sd->seenfrom = B_TRUE;
	snap = zfs_open(zhp->zfs_hdl, snapname,
	ZFS_TYPE_SNAPSHOT);
	if (snap != NULL)
	(void) send_iterate_snap(snap, sd);
	}

	fnvlist_add_nvlist(nvfs, "snaps", sd->parent_snaps);
	fnvlist_add_nvlist(nvfs, "snapprops", sd->snapprops);
	if (sd->holds)
	fnvlist_add_nvlist(nvfs, "snapholds", sd->snapholds);
	fnvlist_free(sd->parent_snaps);
	fnvlist_free(sd->snapprops);
	fnvlist_free(sd->snapholds);

	/* Do not allow the size of the properties list to exceed the limit */
	if ((fnvlist_size(nvfs) + fnvlist_size(sd->fss)) >
	zhp->zfs_hdl->libzfs_max_nvlist) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"warning: cannot send %s@%s: the size of the list of "
	"snapshots and properties is too large to be received "
	"successfully.\n"
	"Select a smaller number of snapshots to send.\n"),
	zhp->zfs_name, sd->tosnap);
	rv = EZFS_NOSPC;
	goto out;
	}
	/* add this fs to nvlist */
	(void) snprintf(guidstring, sizeof (guidstring),
	"0x%llx", (longlong_t)guid);
	fnvlist_add_nvlist(sd->fss, guidstring, nvfs);

	/* iterate over children */
	if (sd->recursive)
	rv = zfs_iter_filesystems(zhp, send_iterate_fs, sd);

	out:
	sd->parent_fromsnap_guid = parent_fromsnap_guid_save;
	sd->fromsnap_txg = fromsnap_txg_save;
	sd->tosnap_txg = tosnap_txg_save;
	fnvlist_free(nv);
	fnvlist_free(nvfs);

	zfs_close(zhp);
	return (rv);
	}

	static int
	gather_nvlist(libzfs_handle_t hdl, const char fsname, const char *fromsnap,
	const char *tosnap, boolean_t recursive, boolean_t raw, boolean_t doall,
	boolean_t replicate, boolean_t verbose, boolean_t backup, boolean_t holds,
	boolean_t props, nvlist_t nvlp, avl_tree_t avlp)
	{
	zfs_handle_t *zhp;
	send_data_t sd = { 0 };
	int error;

	zhp = zfs_open(hdl, fsname, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL)
	return (EZFS_BADTYPE);

	VERIFY(0 == nvlist_alloc(&sd.fss, NV_UNIQUE_NAME, 0));
	sd.fsname = fsname;
	sd.fromsnap = fromsnap;
	sd.tosnap = tosnap;
	sd.recursive = recursive;
	sd.raw = raw;
	sd.doall = doall;
	sd.replicate = replicate;
	sd.verbose = verbose;
	sd.backup = backup;
	sd.holds = holds;
	sd.props = props;

	if ((error = send_iterate_fs(zhp, &sd)) != 0) {
	nvlist_free(sd.fss);
	if (avlp != NULL)
	*avlp = NULL;
	*nvlp = NULL;
	return (error);
	}

	if (avlp != NULL && (*avlp = fsavl_create(sd.fss)) == NULL) {
	nvlist_free(sd.fss);
	*nvlp = NULL;
	return (EZFS_NOMEM);
	}

	*nvlp = sd.fss;
	return (0);
	}

	/*
	* Routines specific to "zfs send"
	*/
	typedef struct send_dump_data {
	/* these are all just the short snapname (the part after the @) */
	const char *fromsnap;
	const char *tosnap;
	char prevsnap[ZFS_MAX_DATASET_NAME_LEN];
	uint64_t prevsnap_obj;
	boolean_t seenfrom, seento, replicate, doall, fromorigin;
	boolean_t dryrun, parsable, progress, embed_data, std_out;
	boolean_t large_block, compress, raw, holds;
	int outfd;
	boolean_t err;
	nvlist_t *fss;
	nvlist_t *snapholds;
	avl_tree_t *fsavl;
	snapfilter_cb_t *filter_cb;
	void *filter_cb_arg;
	nvlist_t *debugnv;
	char holdtag[ZFS_MAX_DATASET_NAME_LEN];
	int cleanup_fd;
	int verbosity;
	uint64_t size;
	} send_dump_data_t;

	static int
	zfs_send_space(zfs_handle_t zhp, const char snapname, const char *from,
	enum lzc_send_flags flags, uint64_t *spacep)
	{
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	int error;

	assert(snapname != NULL);
	error = lzc_send_space(snapname, from, flags, spacep);

	if (error != 0) {
	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"warning: cannot estimate space for '%s'"), snapname);

	switch (error) {
	case EXDEV:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"not an earlier snapshot from the same fs"));
	return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));

	case ENOENT:
	if (zfs_dataset_exists(hdl, snapname,
	ZFS_TYPE_SNAPSHOT)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incremental source (%s) does not exist"),
	snapname);
	}
	return (zfs_error(hdl, EZFS_NOENT, errbuf));

	case EDQUOT:
	case EFBIG:
	case EIO:
	case ENOLINK:
	case ENOSPC:
	case ENOSTR:
	case ENXIO:
	case EPIPE:
	case ERANGE:
	case EFAULT:
	case EROFS:
	case EINVAL:
	zfs_error_aux(hdl, strerror(error));
	return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));

	default:
	return (zfs_standard_error(hdl, error, errbuf));
	}
	}

	return (0);
	}

	/*
	* Dumps a backup of the given snapshot (incremental from fromsnap if it's not
	* NULL) to the file descriptor specified by outfd.
	*/
	static int
	dump_ioctl(zfs_handle_t zhp, const char fromsnap, uint64_t fromsnap_obj,
	boolean_t fromorigin, int outfd, enum lzc_send_flags flags,
	nvlist_t *debugnv)
	{
	zfs_cmd_t zc = {"\0"};
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	nvlist_t *thisdbg;

	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);
	assert(fromsnap_obj == 0 \|\| !fromorigin);

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
	zc.zc_cookie = outfd;
	zc.zc_obj = fromorigin;
	zc.zc_sendobj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
	zc.zc_fromobj = fromsnap_obj;
	zc.zc_flags = flags;

	VERIFY(0 == nvlist_alloc(&thisdbg, NV_UNIQUE_NAME, 0));
	if (fromsnap && fromsnap[0] != '\0') {
	VERIFY(0 == nvlist_add_string(thisdbg,
	"fromsnap", fromsnap));
	}

	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND, &zc) != 0) {
	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"warning: cannot send '%s'"), zhp->zfs_name);

	VERIFY(0 == nvlist_add_uint64(thisdbg, "error", errno));
	if (debugnv) {
	VERIFY(0 == nvlist_add_nvlist(debugnv,
	zhp->zfs_name, thisdbg));
	}
	nvlist_free(thisdbg);

	switch (errno) {
	case EXDEV:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"not an earlier snapshot from the same fs"));
	return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));

	case EACCES:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"source key must be loaded"));
	return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));

	case ENOENT:
	if (zfs_dataset_exists(hdl, zc.zc_name,
	ZFS_TYPE_SNAPSHOT)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incremental source (@%s) does not exist"),
	zc.zc_value);
	}
	return (zfs_error(hdl, EZFS_NOENT, errbuf));

	case EDQUOT:
	case EFBIG:
	case EIO:
	case ENOLINK:
	case ENOSPC:
	case ENOSTR:
	case ENXIO:
	case EPIPE:
	case ERANGE:
	case EFAULT:
	case EROFS:
	zfs_error_aux(hdl, strerror(errno));
	return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));

	default:
	return (zfs_standard_error(hdl, errno, errbuf));
	}
	}

	if (debugnv)
	VERIFY(0 == nvlist_add_nvlist(debugnv, zhp->zfs_name, thisdbg));
	nvlist_free(thisdbg);

	return (0);
	}

	static void
	gather_holds(zfs_handle_t zhp, send_dump_data_t sdd)
	{
	assert(zhp->zfs_type == ZFS_TYPE_SNAPSHOT);

	/*
	* zfs_send() only sets snapholds for sends that need them,
	* e.g. replication and doall.
	*/
	if (sdd->snapholds == NULL)
	return;

	fnvlist_add_string(sdd->snapholds, zhp->zfs_name, sdd->holdtag);
	}

	int
	zfs_send_progress(zfs_handle_t zhp, int fd, uint64_t bytes_written,
	uint64_t *blocks_visited)
	{
	zfs_cmd_t zc = {"\0"};

	(void) strlcpy(zc.zc_name, zhp->zfs_name, sizeof (zc.zc_name));
	zc.zc_cookie = fd;
	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_SEND_PROGRESS, &zc) != 0)
	return (errno);
	if (bytes_written != NULL)
	*bytes_written = zc.zc_cookie;
	if (blocks_visited != NULL)
	*blocks_visited = zc.zc_objset_type;
	return (0);
	}

	static void *
	send_progress_thread(void *arg)
	{
	progress_arg_t *pa = arg;
	zfs_handle_t *zhp = pa->pa_zhp;
	uint64_t bytes;
	uint64_t blocks;
	char buf[16];
	time_t t;
	struct tm *tm;
	boolean_t firstloop = B_TRUE;

	/*
	* Print the progress from ZFS_IOC_SEND_PROGRESS every second.
	*/
	for (;;) {
	int err;
	(void) sleep(1);
	if ((err = zfs_send_progress(zhp, pa->pa_fd, &bytes,
	&blocks)) != 0) {
	if (err == EINTR \|\| err == ENOENT)
	return ((void *)0);
	return ((void *)(uintptr_t)err);
	}

	if (firstloop && !pa->pa_parsable) {
	(void) fprintf(stderr,
	"TIME %s %sSNAPSHOT %s\n",
	pa->pa_estimate ? "BYTES" : " SENT",
	pa->pa_verbosity >= 2 ? " BLOCKS " : "",
	zhp->zfs_name);
	firstloop = B_FALSE;
	}

	(void) time(&t);
	tm = localtime(&t);

	if (pa->pa_verbosity >= 2 && pa->pa_parsable) {
	(void) fprintf(stderr,
	"%02d:%02d:%02d\t%llu\t%llu\t%s\n",
	tm->tm_hour, tm->tm_min, tm->tm_sec,
	(u_longlong_t)bytes, (u_longlong_t)blocks,
	zhp->zfs_name);
	} else if (pa->pa_verbosity >= 2) {
	zfs_nicenum(bytes, buf, sizeof (buf));
	(void) fprintf(stderr,
	"%02d:%02d:%02d %5s %8llu %s\n",
	tm->tm_hour, tm->tm_min, tm->tm_sec,
	buf, (u_longlong_t)blocks, zhp->zfs_name);
	} else if (pa->pa_parsable) {
	(void) fprintf(stderr, "%02d:%02d:%02d\t%llu\t%s\n",
	tm->tm_hour, tm->tm_min, tm->tm_sec,
	(u_longlong_t)bytes, zhp->zfs_name);
	} else {
	zfs_nicebytes(bytes, buf, sizeof (buf));
	(void) fprintf(stderr, "%02d:%02d:%02d %5s %s\n",
	tm->tm_hour, tm->tm_min, tm->tm_sec,
	buf, zhp->zfs_name);
	}
	}
	}

	static void
	send_print_verbose(FILE fout, const char tosnap, const char *fromsnap,
	uint64_t size, boolean_t parsable)
	{
	if (parsable) {
	if (fromsnap != NULL) {
	(void) fprintf(fout, "incremental\t%s\t%s",
	fromsnap, tosnap);
	} else {
	(void) fprintf(fout, "full\t%s",
	tosnap);
	}
	} else {
	if (fromsnap != NULL) {
	if (strchr(fromsnap, '@') == NULL &&
	strchr(fromsnap, '#') == NULL) {
	(void) fprintf(fout, dgettext(TEXT_DOMAIN,
	"send from @%s to %s"),
	fromsnap, tosnap);
	} else {
	(void) fprintf(fout, dgettext(TEXT_DOMAIN,
	"send from %s to %s"),
	fromsnap, tosnap);
	}
	} else {
	(void) fprintf(fout, dgettext(TEXT_DOMAIN,
	"full send of %s"),
	tosnap);
	}
	}

	if (parsable) {
	(void) fprintf(fout, "\t%llu",
	(longlong_t)size);
	} else if (size != 0) {
	char buf[16];
	zfs_nicebytes(size, buf, sizeof (buf));
	(void) fprintf(fout, dgettext(TEXT_DOMAIN,
	" estimated size is %s"), buf);
	}
	(void) fprintf(fout, "\n");
	}

	static int
	dump_snapshot(zfs_handle_t zhp, void arg)
	{
	send_dump_data_t *sdd = arg;
	progress_arg_t pa = { 0 };
	pthread_t tid;
	char *thissnap;
	enum lzc_send_flags flags = 0;
	int err;
	boolean_t isfromsnap, istosnap, fromorigin;
	boolean_t exclude = B_FALSE;
	FILE *fout = sdd->std_out ? stdout : stderr;

	err = 0;
	thissnap = strchr(zhp->zfs_name, '@') + 1;
	isfromsnap = (sdd->fromsnap != NULL &&
	strcmp(sdd->fromsnap, thissnap) == 0);

	if (!sdd->seenfrom && isfromsnap) {
	gather_holds(zhp, sdd);
	sdd->seenfrom = B_TRUE;
	(void) strlcpy(sdd->prevsnap, thissnap,
	sizeof (sdd->prevsnap));
	sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
	zfs_close(zhp);
	return (0);
	}

	if (sdd->seento \|\| !sdd->seenfrom) {
	zfs_close(zhp);
	return (0);
	}

	istosnap = (strcmp(sdd->tosnap, thissnap) == 0);
	if (istosnap)
	sdd->seento = B_TRUE;

	if (sdd->large_block)
	flags \|= LZC_SEND_FLAG_LARGE_BLOCK;
	if (sdd->embed_data)
	flags \|= LZC_SEND_FLAG_EMBED_DATA;
	if (sdd->compress)
	flags \|= LZC_SEND_FLAG_COMPRESS;
	if (sdd->raw)
	flags \|= LZC_SEND_FLAG_RAW;

	if (!sdd->doall && !isfromsnap && !istosnap) {
	if (sdd->replicate) {
	char *snapname;
	nvlist_t *snapprops;
	/*
	* Filter out all intermediate snapshots except origin
	* snapshots needed to replicate clones.
	*/
	nvlist_t *nvfs = fsavl_find(sdd->fsavl,
	zhp->zfs_dmustats.dds_guid, &snapname);

	VERIFY(0 == nvlist_lookup_nvlist(nvfs,
	"snapprops", &snapprops));
	VERIFY(0 == nvlist_lookup_nvlist(snapprops,
	thissnap, &snapprops));
	exclude = !nvlist_exists(snapprops, "is_clone_origin");
	} else {
	exclude = B_TRUE;
	}
	}

	/*
	* If a filter function exists, call it to determine whether
	* this snapshot will be sent.
	*/
	if (exclude \|\| (sdd->filter_cb != NULL &&
	sdd->filter_cb(zhp, sdd->filter_cb_arg) == B_FALSE)) {
	/*
	* This snapshot is filtered out. Don't send it, and don't
	* set prevsnap_obj, so it will be as if this snapshot didn't
	* exist, and the next accepted snapshot will be sent as
	* an incremental from the last accepted one, or as the
	* first (and full) snapshot in the case of a replication,
	* non-incremental send.
	*/
	zfs_close(zhp);
	return (0);
	}

	gather_holds(zhp, sdd);
	fromorigin = sdd->prevsnap[0] == '\0' &&
	(sdd->fromorigin \|\| sdd->replicate);

	if (sdd->verbosity != 0) {
	uint64_t size = 0;
	char fromds[ZFS_MAX_DATASET_NAME_LEN];

	if (sdd->prevsnap[0] != '\0') {
	(void) strlcpy(fromds, zhp->zfs_name, sizeof (fromds));
	*(strchr(fromds, '@') + 1) = '\0';
	(void) strlcat(fromds, sdd->prevsnap, sizeof (fromds));
	}
	if (zfs_send_space(zhp, zhp->zfs_name,
	sdd->prevsnap[0] ? fromds : NULL, flags, &size) != 0) {
	size = 0; /* cannot estimate send space */
	} else {
	send_print_verbose(fout, zhp->zfs_name,
	sdd->prevsnap[0] ? sdd->prevsnap : NULL,
	size, sdd->parsable);
	}
	sdd->size += size;
	}

	if (!sdd->dryrun) {
	/*
	* If progress reporting is requested, spawn a new thread to
	* poll ZFS_IOC_SEND_PROGRESS at a regular interval.
	*/
	if (sdd->progress) {
	pa.pa_zhp = zhp;
	pa.pa_fd = sdd->outfd;
	pa.pa_parsable = sdd->parsable;
	pa.pa_estimate = B_FALSE;
	pa.pa_verbosity = sdd->verbosity;

	if ((err = pthread_create(&tid, NULL,
	send_progress_thread, &pa)) != 0) {
	zfs_close(zhp);
	return (err);
	}
	}

	err = dump_ioctl(zhp, sdd->prevsnap, sdd->prevsnap_obj,
	fromorigin, sdd->outfd, flags, sdd->debugnv);

	if (sdd->progress) {
	void *status = NULL;
	(void) pthread_cancel(tid);
	(void) pthread_join(tid, &status);
	int error = (int)(uintptr_t)status;
	if (error != 0 && status != PTHREAD_CANCELED) {
	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"progress thread exited nonzero"));
	return (zfs_standard_error(zhp->zfs_hdl, error,
	errbuf));
	}
	}
	}

	(void) strcpy(sdd->prevsnap, thissnap);
	sdd->prevsnap_obj = zfs_prop_get_int(zhp, ZFS_PROP_OBJSETID);
	zfs_close(zhp);
	return (err);
	}

	static int
	dump_filesystem(zfs_handle_t zhp, void arg)
	{
	int rv = 0;
	send_dump_data_t *sdd = arg;
	boolean_t missingfrom = B_FALSE;
	zfs_cmd_t zc = {"\0"};
	uint64_t min_txg = 0, max_txg = 0;

	(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
	zhp->zfs_name, sdd->tosnap);
	if (zfs_ioctl(zhp->zfs_hdl, ZFS_IOC_OBJSET_STATS, &zc) != 0) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"WARNING: could not send %s@%s: does not exist\n"),
	zhp->zfs_name, sdd->tosnap);
	sdd->err = B_TRUE;
	return (0);
	}

	if (sdd->replicate && sdd->fromsnap) {
	/*
	* If this fs does not have fromsnap, and we're doing
	* recursive, we need to send a full stream from the
	* beginning (or an incremental from the origin if this
	* is a clone). If we're doing non-recursive, then let
	* them get the error.
	*/
	(void) snprintf(zc.zc_name, sizeof (zc.zc_name), "%s@%s",
	zhp->zfs_name, sdd->fromsnap);
	if (zfs_ioctl(zhp->zfs_hdl,
	ZFS_IOC_OBJSET_STATS, &zc) != 0) {
	missingfrom = B_TRUE;
	}
	}

	sdd->seenfrom = sdd->seento = sdd->prevsnap[0] = 0;
	sdd->prevsnap_obj = 0;
	if (sdd->fromsnap == NULL \|\| missingfrom)
	sdd->seenfrom = B_TRUE;



	/*
	* Iterate through all snapshots and process the ones we will be
	* sending. If we only have a "from" and "to" snapshot to deal
	* with, we can avoid iterating through all the other snapshots.
	*/
	if (sdd->doall \|\| sdd->replicate \|\| sdd->tosnap == NULL) {
	if (!sdd->replicate && sdd->fromsnap != NULL)
	min_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
	sdd->fromsnap);
	if (!sdd->replicate && sdd->tosnap != NULL)
	max_txg = get_snap_txg(zhp->zfs_hdl, zhp->zfs_name,
	sdd->tosnap);
	rv = zfs_iter_snapshots_sorted(zhp, dump_snapshot, arg,
	min_txg, max_txg);
	} else {
	char snapname[MAXPATHLEN] = { 0 };
	zfs_handle_t *snap;

	if (!sdd->seenfrom) {
	(void) snprintf(snapname, sizeof (snapname),
	"%s@%s", zhp->zfs_name, sdd->fromsnap);
	snap = zfs_open(zhp->zfs_hdl, snapname,
	ZFS_TYPE_SNAPSHOT);
	if (snap != NULL)
	rv = dump_snapshot(snap, sdd);
	else
	rv = -1;
	}

	if (rv == 0) {
	(void) snprintf(snapname, sizeof (snapname),
	"%s@%s", zhp->zfs_name, sdd->tosnap);
	snap = zfs_open(zhp->zfs_hdl, snapname,
	ZFS_TYPE_SNAPSHOT);
	if (snap != NULL)
	rv = dump_snapshot(snap, sdd);
	else
	rv = -1;
	}
	}

	if (!sdd->seenfrom) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"WARNING: could not send %s@%s:\n"
	"incremental source (%s@%s) does not exist\n"),
	zhp->zfs_name, sdd->tosnap,
	zhp->zfs_name, sdd->fromsnap);
	sdd->err = B_TRUE;
	} else if (!sdd->seento) {
	if (sdd->fromsnap) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"WARNING: could not send %s@%s:\n"
	"incremental source (%s@%s) "
	"is not earlier than it\n"),
	zhp->zfs_name, sdd->tosnap,
	zhp->zfs_name, sdd->fromsnap);
	} else {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"WARNING: "
	"could not send %s@%s: does not exist\n"),
	zhp->zfs_name, sdd->tosnap);
	}
	sdd->err = B_TRUE;
	}

	return (rv);
	}

	static int
	dump_filesystems(zfs_handle_t rzhp, void arg)
	{
	send_dump_data_t *sdd = arg;
	nvpair_t *fspair;
	boolean_t needagain, progress;

	if (!sdd->replicate)
	return (dump_filesystem(rzhp, sdd));

	/* Mark the clone origin snapshots. */
	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
	fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
	nvlist_t *nvfs;
	uint64_t origin_guid = 0;

	VERIFY(0 == nvpair_value_nvlist(fspair, &nvfs));
	(void) nvlist_lookup_uint64(nvfs, "origin", &origin_guid);
	if (origin_guid != 0) {
	char *snapname;
	nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
	origin_guid, &snapname);
	if (origin_nv != NULL) {
	nvlist_t *snapprops;
	VERIFY(0 == nvlist_lookup_nvlist(origin_nv,
	"snapprops", &snapprops));
	VERIFY(0 == nvlist_lookup_nvlist(snapprops,
	snapname, &snapprops));
	VERIFY(0 == nvlist_add_boolean(
	snapprops, "is_clone_origin"));
	}
	}
	}
	again:
	needagain = progress = B_FALSE;
	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
	fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
	nvlist_t fslist, parent_nv;
	char *fsname;
	zfs_handle_t *zhp;
	int err;
	uint64_t origin_guid = 0;
	uint64_t parent_guid = 0;

	VERIFY(nvpair_value_nvlist(fspair, &fslist) == 0);
	if (nvlist_lookup_boolean(fslist, "sent") == 0)
	continue;

	VERIFY(nvlist_lookup_string(fslist, "name", &fsname) == 0);
	(void) nvlist_lookup_uint64(fslist, "origin", &origin_guid);
	(void) nvlist_lookup_uint64(fslist, "parentfromsnap",
	&parent_guid);

	if (parent_guid != 0) {
	parent_nv = fsavl_find(sdd->fsavl, parent_guid, NULL);
	if (!nvlist_exists(parent_nv, "sent")) {
	/* parent has not been sent; skip this one */
	needagain = B_TRUE;
	continue;
	}
	}

	if (origin_guid != 0) {
	nvlist_t *origin_nv = fsavl_find(sdd->fsavl,
	origin_guid, NULL);
	if (origin_nv != NULL &&
	!nvlist_exists(origin_nv, "sent")) {
	/*
	* origin has not been sent yet;
	* skip this clone.
	*/
	needagain = B_TRUE;
	continue;
	}
	}

	zhp = zfs_open(rzhp->zfs_hdl, fsname, ZFS_TYPE_DATASET);
	if (zhp == NULL)
	return (-1);
	err = dump_filesystem(zhp, sdd);
	VERIFY(nvlist_add_boolean(fslist, "sent") == 0);
	progress = B_TRUE;
	zfs_close(zhp);
	if (err)
	return (err);
	}
	if (needagain) {
	assert(progress);
	goto again;
	}

	/* clean out the sent flags in case we reuse this fss */
	for (fspair = nvlist_next_nvpair(sdd->fss, NULL); fspair;
	fspair = nvlist_next_nvpair(sdd->fss, fspair)) {
	nvlist_t *fslist;

	VERIFY(nvpair_value_nvlist(fspair, &fslist) == 0);
	(void) nvlist_remove_all(fslist, "sent");
	}

	return (0);
	}

	nvlist_t *
	zfs_send_resume_token_to_nvlist(libzfs_handle_t hdl, const char token)
	{
	unsigned int version;
	int nread, i;
	unsigned long long checksum, packed_len;

	/*
	* Decode token header, which is:
	* <token version>-<checksum of payload>-<uncompressed payload length>
	* Note that the only supported token version is 1.
	*/
	nread = sscanf(token, "%u-%llx-%llx-",
	&version, &checksum, &packed_len);
	if (nread != 3) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"resume token is corrupt (invalid format)"));
	return (NULL);
	}

	if (version != ZFS_SEND_RESUME_TOKEN_VERSION) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"resume token is corrupt (invalid version %u)"),
	version);
	return (NULL);
	}

	/* convert hexadecimal representation to binary */
	token = strrchr(token, '-') + 1;
	int len = strlen(token) / 2;
	unsigned char *compressed = zfs_alloc(hdl, len);
	for (i = 0; i < len; i++) {
	nread = sscanf(token + i * 2, "%2hhx", compressed + i);
	if (nread != 1) {
	free(compressed);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"resume token is corrupt "
	"(payload is not hex-encoded)"));
	return (NULL);
	}
	}

	/* verify checksum */
	zio_cksum_t cksum;
	fletcher_4_native_varsize(compressed, len, &cksum);
	if (cksum.zc_word[0] != checksum) {
	free(compressed);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"resume token is corrupt (incorrect checksum)"));
	return (NULL);
	}

	/* uncompress */
	void *packed = zfs_alloc(hdl, packed_len);
	uLongf packed_len_long = packed_len;
	if (uncompress(packed, &packed_len_long, compressed, len) != Z_OK \|\|
	packed_len_long != packed_len) {
	free(packed);
	free(compressed);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"resume token is corrupt (decompression failed)"));
	return (NULL);
	}

	/* unpack nvlist */
	nvlist_t *nv;
	int error = nvlist_unpack(packed, packed_len, &nv, KM_SLEEP);
	free(packed);
	free(compressed);
	if (error != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"resume token is corrupt (nvlist_unpack failed)"));
	return (NULL);
	}
	return (nv);
	}
	static enum lzc_send_flags
	lzc_flags_from_sendflags(const sendflags_t *flags)
	{
	enum lzc_send_flags lzc_flags = 0;
	if (flags->largeblock)
	lzc_flags \|= LZC_SEND_FLAG_LARGE_BLOCK;
	if (flags->embed_data)
	lzc_flags \|= LZC_SEND_FLAG_EMBED_DATA;
	if (flags->compress)
	lzc_flags \|= LZC_SEND_FLAG_COMPRESS;
	if (flags->raw)
	lzc_flags \|= LZC_SEND_FLAG_RAW;
	if (flags->saved)
	lzc_flags \|= LZC_SEND_FLAG_SAVED;
	return (lzc_flags);
	}

	static int
	estimate_size(zfs_handle_t zhp, const char from, int fd, sendflags_t *flags,
	uint64_t resumeobj, uint64_t resumeoff, uint64_t bytes,
	const char redactbook, char errbuf)
	{
	uint64_t size;
	FILE *fout = flags->dryrun ? stdout : stderr;
	progress_arg_t pa = { 0 };
	int err = 0;
	pthread_t ptid;

	if (flags->progress) {
	pa.pa_zhp = zhp;
	pa.pa_fd = fd;
	pa.pa_parsable = flags->parsable;
	pa.pa_estimate = B_TRUE;
	pa.pa_verbosity = flags->verbosity;

	err = pthread_create(&ptid, NULL,
	send_progress_thread, &pa);
	if (err != 0) {
	zfs_error_aux(zhp->zfs_hdl, strerror(errno));
	return (zfs_error(zhp->zfs_hdl,
	EZFS_THREADCREATEFAILED, errbuf));
	}
	}

	err = lzc_send_space_resume_redacted(zhp->zfs_name, from,
	lzc_flags_from_sendflags(flags), resumeobj, resumeoff, bytes,
	redactbook, fd, &size);

	if (flags->progress) {
	void *status = NULL;
	(void) pthread_cancel(ptid);
	(void) pthread_join(ptid, &status);
	int error = (int)(uintptr_t)status;
	if (error != 0 && status != PTHREAD_CANCELED) {
	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "progress thread exited "
	"nonzero"));
	return (zfs_standard_error(zhp->zfs_hdl, error,
	errbuf));
	}
	}

	if (err != 0) {
	zfs_error_aux(zhp->zfs_hdl, strerror(err));
	return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
	errbuf));
	}
	send_print_verbose(fout, zhp->zfs_name, from, size,
	flags->parsable);

	if (flags->parsable) {
	(void) fprintf(fout, "size\t%llu\n", (longlong_t)size);
	} else {
	char buf[16];
	zfs_nicenum(size, buf, sizeof (buf));
	(void) fprintf(fout, dgettext(TEXT_DOMAIN,
	"total estimated size is %s\n"), buf);
	}
	return (0);
	}

	static boolean_t
	redact_snaps_contains(const uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
	{
	for (int i = 0; i < num_snaps; i++) {
	if (snaps[i] == guid)
	return (B_TRUE);
	}
	return (B_FALSE);
	}

	static boolean_t
	redact_snaps_equal(const uint64_t *snaps1, uint64_t num_snaps1,
	const uint64_t *snaps2, uint64_t num_snaps2)
	{
	if (num_snaps1 != num_snaps2)
	return (B_FALSE);
	for (int i = 0; i < num_snaps1; i++) {
	if (!redact_snaps_contains(snaps2, num_snaps2, snaps1[i]))
	return (B_FALSE);
	}
	return (B_TRUE);
	}

	/*
	* Check that the list of redaction snapshots in the bookmark matches the send
	* we're resuming, and return whether or not it's complete.
	*
	* Note that the caller needs to free the contents of *bookname with free() if
	* this function returns successfully.
	*/
	static int
	find_redact_book(libzfs_handle_t hdl, const char path,
	const uint64_t *redact_snap_guids, int num_redact_snaps,
	char **bookname)
	{
	char errbuf[1024];
	int error = 0;
	nvlist_t *props = fnvlist_alloc();
	nvlist_t *bmarks;

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot resume send"));

	fnvlist_add_boolean(props, "redact_complete");
	fnvlist_add_boolean(props, zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
	error = lzc_get_bookmarks(path, props, &bmarks);
	nvlist_free(props);
	if (error != 0) {
	if (error == ESRCH) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"nonexistent redaction bookmark provided"));
	} else if (error == ENOENT) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset to be sent no longer exists"));
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"unknown error: %s"), strerror(error));
	}
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}
	nvpair_t *pair;
	for (pair = nvlist_next_nvpair(bmarks, NULL); pair;
	pair = nvlist_next_nvpair(bmarks, pair)) {

	nvlist_t *bmark = fnvpair_value_nvlist(pair);
	nvlist_t *vallist = fnvlist_lookup_nvlist(bmark,
	zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
	uint_t len = 0;
	uint64_t *bmarksnaps = fnvlist_lookup_uint64_array(vallist,
	ZPROP_VALUE, &len);
	if (redact_snaps_equal(redact_snap_guids,
	num_redact_snaps, bmarksnaps, len)) {
	break;
	}
	}
	if (pair == NULL) {
	fnvlist_free(bmarks);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"no appropriate redaction bookmark exists"));
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}
	char *name = nvpair_name(pair);
	nvlist_t *bmark = fnvpair_value_nvlist(pair);
	nvlist_t *vallist = fnvlist_lookup_nvlist(bmark, "redact_complete");
	boolean_t complete = fnvlist_lookup_boolean_value(vallist,
	ZPROP_VALUE);
	if (!complete) {
	fnvlist_free(bmarks);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incomplete redaction bookmark provided"));
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}
	*bookname = strndup(name, ZFS_MAX_DATASET_NAME_LEN);
	ASSERT3P(*bookname, !=, NULL);
	fnvlist_free(bmarks);
	return (0);
	}

	static int
	zfs_send_resume_impl(libzfs_handle_t hdl, sendflags_t flags, int outfd,
	nvlist_t *resume_nvl)
	{
	char errbuf[1024];
	char *toname;
	char *fromname = NULL;
	uint64_t resumeobj, resumeoff, toguid, fromguid, bytes;
	zfs_handle_t *zhp;
	int error = 0;
	char name[ZFS_MAX_DATASET_NAME_LEN];
	enum lzc_send_flags lzc_flags = 0;
	FILE *fout = (flags->verbosity > 0 && flags->dryrun) ? stdout : stderr;
	uint64_t *redact_snap_guids = NULL;
	int num_redact_snaps = 0;
	char *redact_book = NULL;

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot resume send"));

	if (flags->verbosity != 0) {
	(void) fprintf(fout, dgettext(TEXT_DOMAIN,
	"resume token contents:\n"));
	nvlist_print(fout, resume_nvl);
	}

	if (nvlist_lookup_string(resume_nvl, "toname", &toname) != 0 \|\|
	nvlist_lookup_uint64(resume_nvl, "object", &resumeobj) != 0 \|\|
	nvlist_lookup_uint64(resume_nvl, "offset", &resumeoff) != 0 \|\|
	nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 \|\|
	nvlist_lookup_uint64(resume_nvl, "toguid", &toguid) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"resume token is corrupt"));
	return (zfs_error(hdl, EZFS_FAULT, errbuf));
	}
	fromguid = 0;
	(void) nvlist_lookup_uint64(resume_nvl, "fromguid", &fromguid);

	if (flags->largeblock \|\| nvlist_exists(resume_nvl, "largeblockok"))
	lzc_flags \|= LZC_SEND_FLAG_LARGE_BLOCK;
	if (flags->embed_data \|\| nvlist_exists(resume_nvl, "embedok"))
	lzc_flags \|= LZC_SEND_FLAG_EMBED_DATA;
	if (flags->compress \|\| nvlist_exists(resume_nvl, "compressok"))
	lzc_flags \|= LZC_SEND_FLAG_COMPRESS;
	if (flags->raw \|\| nvlist_exists(resume_nvl, "rawok"))
	lzc_flags \|= LZC_SEND_FLAG_RAW;
	if (flags->saved \|\| nvlist_exists(resume_nvl, "savedok"))
	lzc_flags \|= LZC_SEND_FLAG_SAVED;

	if (flags->saved) {
	(void) strcpy(name, toname);
	} else {
	error = guid_to_name(hdl, toname, toguid, B_FALSE, name);
	if (error != 0) {
	if (zfs_dataset_exists(hdl, toname, ZFS_TYPE_DATASET)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' is no longer the same snapshot "
	"used in the initial send"), toname);
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' used in the initial send no "
	"longer exists"), toname);
	}
	return (zfs_error(hdl, EZFS_BADPATH, errbuf));
	}
	}

	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
	if (zhp == NULL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"unable to access '%s'"), name);
	return (zfs_error(hdl, EZFS_BADPATH, errbuf));
	}

	if (nvlist_lookup_uint64_array(resume_nvl, "book_redact_snaps",
	&redact_snap_guids, (uint_t *)&num_redact_snaps) != 0) {
	num_redact_snaps = -1;
	}

	if (fromguid != 0) {
	if (guid_to_name_redact_snaps(hdl, toname, fromguid, B_TRUE,
	redact_snap_guids, num_redact_snaps, name) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incremental source %#llx no longer exists"),
	(longlong_t)fromguid);
	return (zfs_error(hdl, EZFS_BADPATH, errbuf));
	}
	fromname = name;
	}

	redact_snap_guids = NULL;

	if (nvlist_lookup_uint64_array(resume_nvl,
	zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS), &redact_snap_guids,
	(uint_t *)&num_redact_snaps) == 0) {
	char path[ZFS_MAX_DATASET_NAME_LEN];

	(void) strlcpy(path, toname, sizeof (path));
	char *at = strchr(path, '@');
	ASSERT3P(at, !=, NULL);

	*at = '\0';

	if ((error = find_redact_book(hdl, path, redact_snap_guids,
	num_redact_snaps, &redact_book)) != 0) {
	return (error);
	}
	}

	if (flags->verbosity != 0) {
	/*
	* Some of these may have come from the resume token, set them
	* here for size estimate purposes.
	*/
	sendflags_t tmpflags = *flags;
	if (lzc_flags & LZC_SEND_FLAG_LARGE_BLOCK)
	tmpflags.largeblock = B_TRUE;
	if (lzc_flags & LZC_SEND_FLAG_COMPRESS)
	tmpflags.compress = B_TRUE;
	if (lzc_flags & LZC_SEND_FLAG_EMBED_DATA)
	tmpflags.embed_data = B_TRUE;
	error = estimate_size(zhp, fromname, outfd, &tmpflags,
	resumeobj, resumeoff, bytes, redact_book, errbuf);
	}

	if (!flags->dryrun) {
	progress_arg_t pa = { 0 };
	pthread_t tid;
	/*
	* If progress reporting is requested, spawn a new thread to
	* poll ZFS_IOC_SEND_PROGRESS at a regular interval.
	*/
	if (flags->progress) {
	pa.pa_zhp = zhp;
	pa.pa_fd = outfd;
	pa.pa_parsable = flags->parsable;
	pa.pa_estimate = B_FALSE;
	pa.pa_verbosity = flags->verbosity;

	error = pthread_create(&tid, NULL,
	send_progress_thread, &pa);
	if (error != 0) {
	if (redact_book != NULL)
	free(redact_book);
	zfs_close(zhp);
	return (error);
	}
	}

	error = lzc_send_resume_redacted(zhp->zfs_name, fromname, outfd,
	lzc_flags, resumeobj, resumeoff, redact_book);
	if (redact_book != NULL)
	free(redact_book);

	if (flags->progress) {
	void *status = NULL;
	(void) pthread_cancel(tid);
	(void) pthread_join(tid, &status);
	int error = (int)(uintptr_t)status;
	if (error != 0 && status != PTHREAD_CANCELED) {
	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"progress thread exited nonzero"));
	return (zfs_standard_error(hdl, error, errbuf));
	}
	}

	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"warning: cannot send '%s'"), zhp->zfs_name);

	zfs_close(zhp);

	switch (error) {
	case 0:
	return (0);
	case EACCES:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"source key must be loaded"));
	return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));
	case ESRCH:
	if (lzc_exists(zhp->zfs_name)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incremental source could not be found"));
	}
	return (zfs_error(hdl, EZFS_NOENT, errbuf));

	case EXDEV:
	case ENOENT:
	case EDQUOT:
	case EFBIG:
	case EIO:
	case ENOLINK:
	case ENOSPC:
	case ENOSTR:
	case ENXIO:
	case EPIPE:
	case ERANGE:
	case EFAULT:
	case EROFS:
	zfs_error_aux(hdl, strerror(errno));
	return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));

	default:
	return (zfs_standard_error(hdl, errno, errbuf));
	}
	} else {
	if (redact_book != NULL)
	free(redact_book);
	}

	zfs_close(zhp);

	return (error);
	}

	int
	zfs_send_resume(libzfs_handle_t hdl, sendflags_t flags, int outfd,
	const char *resume_token)
	{
	int ret;
	char errbuf[1024];
	nvlist_t *resume_nvl;

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot resume send"));

	resume_nvl = zfs_send_resume_token_to_nvlist(hdl, resume_token);
	if (resume_nvl == NULL) {
	/*
	* zfs_error_aux has already been set by
	* zfs_send_resume_token_to_nvlist()
	*/
	return (zfs_error(hdl, EZFS_FAULT, errbuf));
	}

	ret = zfs_send_resume_impl(hdl, flags, outfd, resume_nvl);
	nvlist_free(resume_nvl);

	return (ret);
	}

	int
	zfs_send_saved(zfs_handle_t zhp, sendflags_t flags, int outfd,
	const char *resume_token)
	{
	int ret;
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	nvlist_t saved_nvl = NULL, resume_nvl = NULL;
	uint64_t saved_guid = 0, resume_guid = 0;
	uint64_t obj = 0, off = 0, bytes = 0;
	char token_buf[ZFS_MAXPROPLEN];
	char errbuf[1024];

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"saved send failed"));

	ret = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
	token_buf, sizeof (token_buf), NULL, NULL, 0, B_TRUE);
	if (ret != 0)
	goto out;

	saved_nvl = zfs_send_resume_token_to_nvlist(hdl, token_buf);
	if (saved_nvl == NULL) {
	/*
	* zfs_error_aux has already been set by
	* zfs_send_resume_token_to_nvlist()
	*/
	ret = zfs_error(hdl, EZFS_FAULT, errbuf);
	goto out;
	}

	/*
	* If a resume token is provided we use the object and offset
	* from that instead of the default, which starts from the
	* beginning.
	*/
	if (resume_token != NULL) {
	resume_nvl = zfs_send_resume_token_to_nvlist(hdl,
	resume_token);
	if (resume_nvl == NULL) {
	ret = zfs_error(hdl, EZFS_FAULT, errbuf);
	goto out;
	}

	if (nvlist_lookup_uint64(resume_nvl, "object", &obj) != 0 \|\|
	nvlist_lookup_uint64(resume_nvl, "offset", &off) != 0 \|\|
	nvlist_lookup_uint64(resume_nvl, "bytes", &bytes) != 0 \|\|
	nvlist_lookup_uint64(resume_nvl, "toguid",
	&resume_guid) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"provided resume token is corrupt"));
	ret = zfs_error(hdl, EZFS_FAULT, errbuf);
	goto out;
	}

	if (nvlist_lookup_uint64(saved_nvl, "toguid",
	&saved_guid)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset's resume token is corrupt"));
	ret = zfs_error(hdl, EZFS_FAULT, errbuf);
	goto out;
	}

	if (resume_guid != saved_guid) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"provided resume token does not match dataset"));
	ret = zfs_error(hdl, EZFS_BADBACKUP, errbuf);
	goto out;
	}
	}

	(void) nvlist_remove_all(saved_nvl, "object");
	fnvlist_add_uint64(saved_nvl, "object", obj);

	(void) nvlist_remove_all(saved_nvl, "offset");
	fnvlist_add_uint64(saved_nvl, "offset", off);

	(void) nvlist_remove_all(saved_nvl, "bytes");
	fnvlist_add_uint64(saved_nvl, "bytes", bytes);

	(void) nvlist_remove_all(saved_nvl, "toname");
	fnvlist_add_string(saved_nvl, "toname", zhp->zfs_name);

	ret = zfs_send_resume_impl(hdl, flags, outfd, saved_nvl);

	out:
	nvlist_free(saved_nvl);
	nvlist_free(resume_nvl);
	return (ret);
	}

	/*
	* This function informs the target system that the recursive send is complete.
	* The record is also expected in the case of a send -p.
	*/
	static int
	send_conclusion_record(int fd, zio_cksum_t *zc)
	{
	dmu_replay_record_t drr = { 0 };
	drr.drr_type = DRR_END;
	if (zc != NULL)
	drr.drr_u.drr_end.drr_checksum = *zc;
	if (write(fd, &drr, sizeof (drr)) == -1) {
	return (errno);
	}
	return (0);
	}

	/*
	* This function is responsible for sending the records that contain the
	* necessary information for the target system's libzfs to be able to set the
	* properties of the filesystem being received, or to be able to prepare for
	* a recursive receive.
	*
	* The "zhp" argument is the handle of the snapshot we are sending
	* (the "tosnap"). The "from" argument is the short snapshot name (the part
	* after the @) of the incremental source.
	*/
	static int
	send_prelim_records(zfs_handle_t zhp, const char from, int fd,
	boolean_t gather_props, boolean_t recursive, boolean_t verbose,
	boolean_t dryrun, boolean_t raw, boolean_t replicate, boolean_t backup,
	boolean_t holds, boolean_t props, boolean_t doall,
	nvlist_t fssp, avl_tree_t fsavlp)
	{
	int err = 0;
	char *packbuf = NULL;
	size_t buflen = 0;
	zio_cksum_t zc = { {0} };
	int featureflags = 0;
	/* name of filesystem/volume that contains snapshot we are sending */
	char tofs[ZFS_MAX_DATASET_NAME_LEN];
	/* short name of snap we are sending */
	char *tosnap = "";

	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"warning: cannot send '%s'"), zhp->zfs_name);
	if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM && zfs_prop_get_int(zhp,
	ZFS_PROP_VERSION) >= ZPL_VERSION_SA) {
	featureflags \|= DMU_BACKUP_FEATURE_SA_SPILL;
	}

	if (holds)
	featureflags \|= DMU_BACKUP_FEATURE_HOLDS;

	(void) strlcpy(tofs, zhp->zfs_name, ZFS_MAX_DATASET_NAME_LEN);
	char *at = strchr(tofs, '@');
	if (at != NULL) {
	*at = '\0';
	tosnap = at + 1;
	}

	if (gather_props) {
	nvlist_t *hdrnv = fnvlist_alloc();
	nvlist_t *fss = NULL;

	if (from != NULL)
	fnvlist_add_string(hdrnv, "fromsnap", from);
	fnvlist_add_string(hdrnv, "tosnap", tosnap);
	if (!recursive)
	fnvlist_add_boolean(hdrnv, "not_recursive");

	if (raw) {
	VERIFY0(nvlist_add_boolean(hdrnv, "raw"));
	}

	if ((err = gather_nvlist(zhp->zfs_hdl, tofs,
	from, tosnap, recursive, raw, doall, replicate, verbose,
	backup, holds, props, &fss, fsavlp)) != 0) {
	return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
	errbuf));
	}
	/*
	* Do not allow the size of the properties list to exceed
	* the limit
	*/
	if ((fnvlist_size(fss) + fnvlist_size(hdrnv)) >
	zhp->zfs_hdl->libzfs_max_nvlist) {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "warning: cannot send '%s': "
	"the size of the list of snapshots and properties "
	"is too large to be received successfully.\n"
	"Select a smaller number of snapshots to send.\n"),
	zhp->zfs_name);
	return (zfs_error(zhp->zfs_hdl, EZFS_NOSPC,
	errbuf));
	}
	fnvlist_add_nvlist(hdrnv, "fss", fss);
	VERIFY0(nvlist_pack(hdrnv, &packbuf, &buflen, NV_ENCODE_XDR,
	0));
	if (fssp != NULL) {
	*fssp = fss;
	} else {
	nvlist_free(fss);
	}
	nvlist_free(hdrnv);
	}

	if (!dryrun) {
	dmu_replay_record_t drr = { 0 };
	/* write first begin record */
	drr.drr_type = DRR_BEGIN;
	drr.drr_u.drr_begin.drr_magic = DMU_BACKUP_MAGIC;
	DMU_SET_STREAM_HDRTYPE(drr.drr_u.drr_begin.
	drr_versioninfo, DMU_COMPOUNDSTREAM);
	DMU_SET_FEATUREFLAGS(drr.drr_u.drr_begin.
	drr_versioninfo, featureflags);
	if (snprintf(drr.drr_u.drr_begin.drr_toname,
	sizeof (drr.drr_u.drr_begin.drr_toname), "%s@%s", tofs,
	tosnap) >= sizeof (drr.drr_u.drr_begin.drr_toname)) {
	return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
	errbuf));
	}
	drr.drr_payloadlen = buflen;

	err = dump_record(&drr, packbuf, buflen, &zc, fd);
	free(packbuf);
	if (err != 0) {
	zfs_error_aux(zhp->zfs_hdl, strerror(err));
	return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
	errbuf));
	}
	err = send_conclusion_record(fd, &zc);
	if (err != 0) {
	zfs_error_aux(zhp->zfs_hdl, strerror(err));
	return (zfs_error(zhp->zfs_hdl, EZFS_BADBACKUP,
	errbuf));
	}
	}
	return (0);
	}

	/*
	* Generate a send stream. The "zhp" argument is the filesystem/volume
	* that contains the snapshot to send. The "fromsnap" argument is the
	* short name (the part after the '@') of the snapshot that is the
	* incremental source to send from (if non-NULL). The "tosnap" argument
	* is the short name of the snapshot to send.
	*
	* The content of the send stream is the snapshot identified by
	* 'tosnap'. Incremental streams are requested in two ways:
	* - from the snapshot identified by "fromsnap" (if non-null) or
	* - from the origin of the dataset identified by zhp, which must
	* be a clone. In this case, "fromsnap" is null and "fromorigin"
	* is TRUE.
	*
	* The send stream is recursive (i.e. dumps a hierarchy of snapshots) and
	* uses a special header (with a hdrtype field of DMU_COMPOUNDSTREAM)
	* if "replicate" is set. If "doall" is set, dump all the intermediate
	* snapshots. The DMU_COMPOUNDSTREAM header is used in the "doall"
	* case too. If "props" is set, send properties.
	*/
	int
	zfs_send(zfs_handle_t zhp, const char fromsnap, const char *tosnap,
	sendflags_t *flags, int outfd, snapfilter_cb_t filter_func,
	void cb_arg, nvlist_t *debugnvp)
	{
	char errbuf[1024];
	send_dump_data_t sdd = { 0 };
	int err = 0;
	nvlist_t *fss = NULL;
	avl_tree_t *fsavl = NULL;
	static uint64_t holdseq;
	int spa_version;
	pthread_t tid = 0;
	int pipefd[2];
	int featureflags = 0;
	FILE *fout;

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot send '%s'"), zhp->zfs_name);

	if (fromsnap && fromsnap[0] == '\0') {
	zfs_error_aux(zhp->zfs_hdl, dgettext(TEXT_DOMAIN,
	"zero-length incremental source"));
	return (zfs_error(zhp->zfs_hdl, EZFS_NOENT, errbuf));
	}

	if (zhp->zfs_type == ZFS_TYPE_FILESYSTEM) {
	uint64_t version;
	version = zfs_prop_get_int(zhp, ZFS_PROP_VERSION);
	if (version >= ZPL_VERSION_SA) {
	featureflags \|= DMU_BACKUP_FEATURE_SA_SPILL;
	}
	}

	if (flags->holds)
	featureflags \|= DMU_BACKUP_FEATURE_HOLDS;

	if (flags->replicate \|\| flags->doall \|\| flags->props \|\|
	flags->holds \|\| flags->backup) {
	char full_tosnap_name[ZFS_MAX_DATASET_NAME_LEN];
	if (snprintf(full_tosnap_name, sizeof (full_tosnap_name),
	"%s@%s", zhp->zfs_name, tosnap) >=
	sizeof (full_tosnap_name)) {
	err = EINVAL;
	goto stderr_out;
	}
	zfs_handle_t *tosnap = zfs_open(zhp->zfs_hdl,
	full_tosnap_name, ZFS_TYPE_SNAPSHOT);
	if (tosnap == NULL) {
	err = -1;
	goto err_out;
	}
	err = send_prelim_records(tosnap, fromsnap, outfd,
	flags->replicate \|\| flags->props \|\| flags->holds,
	flags->replicate, flags->verbosity > 0, flags->dryrun,
	flags->raw, flags->replicate, flags->backup, flags->holds,
	flags->props, flags->doall, &fss, &fsavl);
	zfs_close(tosnap);
	if (err != 0)
	goto err_out;
	}

	/* dump each stream */
	sdd.fromsnap = fromsnap;
	sdd.tosnap = tosnap;
	if (tid != 0)
	sdd.outfd = pipefd[0];
	else
	sdd.outfd = outfd;
	sdd.replicate = flags->replicate;
	sdd.doall = flags->doall;
	sdd.fromorigin = flags->fromorigin;
	sdd.fss = fss;
	sdd.fsavl = fsavl;
	sdd.verbosity = flags->verbosity;
	sdd.parsable = flags->parsable;
	sdd.progress = flags->progress;
	sdd.dryrun = flags->dryrun;
	sdd.large_block = flags->largeblock;
	sdd.embed_data = flags->embed_data;
	sdd.compress = flags->compress;
	sdd.raw = flags->raw;
	sdd.holds = flags->holds;
	sdd.filter_cb = filter_func;
	sdd.filter_cb_arg = cb_arg;
	if (debugnvp)
	sdd.debugnv = *debugnvp;
	if (sdd.verbosity != 0 && sdd.dryrun)
	sdd.std_out = B_TRUE;
	fout = sdd.std_out ? stdout : stderr;

	/*
	* Some flags require that we place user holds on the datasets that are
	* being sent so they don't get destroyed during the send. We can skip
	* this step if the pool is imported read-only since the datasets cannot
	* be destroyed.
	*/
	if (!flags->dryrun && !zpool_get_prop_int(zfs_get_pool_handle(zhp),
	ZPOOL_PROP_READONLY, NULL) &&
	zfs_spa_version(zhp, &spa_version) == 0 &&
	spa_version >= SPA_VERSION_USERREFS &&
	(flags->doall \|\| flags->replicate)) {
	++holdseq;
	(void) snprintf(sdd.holdtag, sizeof (sdd.holdtag),
	".send-%d-%llu", getpid(), (u_longlong_t)holdseq);
	sdd.cleanup_fd = open(ZFS_DEV, O_RDWR);
	if (sdd.cleanup_fd < 0) {
	err = errno;
	goto stderr_out;
	}
	sdd.snapholds = fnvlist_alloc();
	} else {
	sdd.cleanup_fd = -1;
	sdd.snapholds = NULL;
	}

	if (flags->verbosity != 0 \|\| sdd.snapholds != NULL) {
	/*
	* Do a verbose no-op dry run to get all the verbose output
	* or to gather snapshot hold's before generating any data,
	* then do a non-verbose real run to generate the streams.
	*/
	sdd.dryrun = B_TRUE;
	err = dump_filesystems(zhp, &sdd);

	if (err != 0)
	goto stderr_out;

	if (flags->verbosity != 0) {
	if (flags->parsable) {
	(void) fprintf(fout, "size\t%llu\n",
	(longlong_t)sdd.size);
	} else {
	char buf[16];
	zfs_nicebytes(sdd.size, buf, sizeof (buf));
	(void) fprintf(fout, dgettext(TEXT_DOMAIN,
	"total estimated size is %s\n"), buf);
	}
	}

	/* Ensure no snaps found is treated as an error. */
	if (!sdd.seento) {
	err = ENOENT;
	goto err_out;
	}

	/* Skip the second run if dryrun was requested. */
	if (flags->dryrun)
	goto err_out;

	if (sdd.snapholds != NULL) {
	err = zfs_hold_nvl(zhp, sdd.cleanup_fd, sdd.snapholds);
	if (err != 0)
	goto stderr_out;

	fnvlist_free(sdd.snapholds);
	sdd.snapholds = NULL;
	}

	sdd.dryrun = B_FALSE;
	sdd.verbosity = 0;
	}

	err = dump_filesystems(zhp, &sdd);
	fsavl_destroy(fsavl);
	nvlist_free(fss);

	/* Ensure no snaps found is treated as an error. */
	if (err == 0 && !sdd.seento)
	err = ENOENT;

	if (tid != 0) {
	if (err != 0)
	(void) pthread_cancel(tid);
	(void) close(pipefd[0]);
	(void) pthread_join(tid, NULL);
	}

	if (sdd.cleanup_fd != -1) {
	VERIFY(0 == close(sdd.cleanup_fd));
	sdd.cleanup_fd = -1;
	}

	if (!flags->dryrun && (flags->replicate \|\| flags->doall \|\|
	flags->props \|\| flags->backup \|\| flags->holds)) {
	/*
	* write final end record. NB: want to do this even if
	* there was some error, because it might not be totally
	* failed.
	*/
	err = send_conclusion_record(outfd, NULL);
	if (err != 0)
	return (zfs_standard_error(zhp->zfs_hdl, err, errbuf));
	}

	return (err \|\| sdd.err);

	stderr_out:
	err = zfs_standard_error(zhp->zfs_hdl, err, errbuf);
	err_out:
	fsavl_destroy(fsavl);
	nvlist_free(fss);
	fnvlist_free(sdd.snapholds);

	if (sdd.cleanup_fd != -1)
	VERIFY(0 == close(sdd.cleanup_fd));
	if (tid != 0) {
	(void) pthread_cancel(tid);
	(void) close(pipefd[0]);
	(void) pthread_join(tid, NULL);
	}
	return (err);
	}

	static zfs_handle_t *
	name_to_dir_handle(libzfs_handle_t hdl, const char snapname)
	{
	char dirname[ZFS_MAX_DATASET_NAME_LEN];
	(void) strlcpy(dirname, snapname, ZFS_MAX_DATASET_NAME_LEN);
	char *c = strchr(dirname, '@');
	if (c != NULL)
	*c = '\0';
	return (zfs_open(hdl, dirname, ZFS_TYPE_DATASET));
	}

	/*
	* Returns B_TRUE if earlier is an earlier snapshot in later's timeline; either
	* an earlier snapshot in the same filesystem, or a snapshot before later's
	* origin, or it's origin's origin, etc.
	*/
	static boolean_t
	snapshot_is_before(zfs_handle_t earlier, zfs_handle_t later)
	{
	boolean_t ret;
	uint64_t later_txg =
	(later->zfs_type == ZFS_TYPE_FILESYSTEM \|\|
	later->zfs_type == ZFS_TYPE_VOLUME ?
	UINT64_MAX : zfs_prop_get_int(later, ZFS_PROP_CREATETXG));
	uint64_t earlier_txg = zfs_prop_get_int(earlier, ZFS_PROP_CREATETXG);

	if (earlier_txg >= later_txg)
	return (B_FALSE);

	zfs_handle_t *earlier_dir = name_to_dir_handle(earlier->zfs_hdl,
	earlier->zfs_name);
	zfs_handle_t *later_dir = name_to_dir_handle(later->zfs_hdl,
	later->zfs_name);

	if (strcmp(earlier_dir->zfs_name, later_dir->zfs_name) == 0) {
	zfs_close(earlier_dir);
	zfs_close(later_dir);
	return (B_TRUE);
	}

	char clonename[ZFS_MAX_DATASET_NAME_LEN];
	if (zfs_prop_get(later_dir, ZFS_PROP_ORIGIN, clonename,
	ZFS_MAX_DATASET_NAME_LEN, NULL, NULL, 0, B_TRUE) != 0) {
	zfs_close(earlier_dir);
	zfs_close(later_dir);
	return (B_FALSE);
	}

	zfs_handle_t *origin = zfs_open(earlier->zfs_hdl, clonename,
	ZFS_TYPE_DATASET);
	uint64_t origin_txg = zfs_prop_get_int(origin, ZFS_PROP_CREATETXG);

	/*
	* If "earlier" is exactly the origin, then
	* snapshot_is_before(earlier, origin) will return false (because
	* they're the same).
	*/
	if (origin_txg == earlier_txg &&
	strcmp(origin->zfs_name, earlier->zfs_name) == 0) {
	zfs_close(earlier_dir);
	zfs_close(later_dir);
	zfs_close(origin);
	return (B_TRUE);
	}
	zfs_close(earlier_dir);
	zfs_close(later_dir);

	ret = snapshot_is_before(earlier, origin);
	zfs_close(origin);
	return (ret);
	}

	/*
	* The "zhp" argument is the handle of the dataset to send (typically a
	* snapshot). The "from" argument is the full name of the snapshot or
	* bookmark that is the incremental source.
	*/
	int
	zfs_send_one(zfs_handle_t zhp, const char from, int fd, sendflags_t *flags,
	const char *redactbook)
	{
	int err;
	libzfs_handle_t *hdl = zhp->zfs_hdl;
	char *name = zhp->zfs_name;
	int orig_fd = fd;
	pthread_t ptid;
	progress_arg_t pa = { 0 };

	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"warning: cannot send '%s'"), name);

	if (from != NULL && strchr(from, '@')) {
	zfs_handle_t *from_zhp = zfs_open(hdl, from,
	ZFS_TYPE_DATASET);
	if (from_zhp == NULL)
	return (-1);
	if (!snapshot_is_before(from_zhp, zhp)) {
	zfs_close(from_zhp);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"not an earlier snapshot from the same fs"));
	return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));
	}
	zfs_close(from_zhp);
	}

	if (redactbook != NULL) {
	char bookname[ZFS_MAX_DATASET_NAME_LEN];
	nvlist_t *redact_snaps;
	zfs_handle_t *book_zhp;
	char at, pound;
	int dsnamelen;

	pound = strchr(redactbook, '#');
	if (pound != NULL)
	redactbook = pound + 1;
	at = strchr(name, '@');
	if (at == NULL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot do a redacted send to a filesystem"));
	return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
	}
	dsnamelen = at - name;
	if (snprintf(bookname, sizeof (bookname), "%.*s#%s",
	dsnamelen, name, redactbook)
	>= sizeof (bookname)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid bookmark name"));
	return (zfs_error(hdl, EZFS_INVALIDNAME, errbuf));
	}
	book_zhp = zfs_open(hdl, bookname, ZFS_TYPE_BOOKMARK);
	if (book_zhp == NULL)
	return (-1);
	if (nvlist_lookup_nvlist(book_zhp->zfs_props,
	zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS),
	&redact_snaps) != 0 \|\| redact_snaps == NULL) {
	zfs_close(book_zhp);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"not a redaction bookmark"));
	return (zfs_error(hdl, EZFS_BADTYPE, errbuf));
	}
	zfs_close(book_zhp);
	}

	/*
	* Send fs properties
	*/
	if (flags->props \|\| flags->holds \|\| flags->backup) {
	/*
	* Note: the header generated by send_prelim_records()
	* assumes that the incremental source is in the same
	* filesystem/volume as the target (which is a requirement
	* when doing "zfs send -R"). But that isn't always the
	* case here (e.g. send from snap in origin, or send from
	* bookmark). We pass from=NULL, which will omit this
	* information from the prelim records; it isn't used
	* when receiving this type of stream.
	*/
	err = send_prelim_records(zhp, NULL, fd, B_TRUE, B_FALSE,
	flags->verbosity > 0, flags->dryrun, flags->raw,
	flags->replicate, flags->backup, flags->holds,
	flags->props, flags->doall, NULL, NULL);
	if (err != 0)
	return (err);
	}

	/*
	* Perform size estimate if verbose was specified.
	*/
	if (flags->verbosity != 0) {
	err = estimate_size(zhp, from, fd, flags, 0, 0, 0, redactbook,
	errbuf);
	if (err != 0)
	return (err);
	}

	if (flags->dryrun)
	return (0);

	/*
	* If progress reporting is requested, spawn a new thread to poll
	* ZFS_IOC_SEND_PROGRESS at a regular interval.
	*/
	if (flags->progress) {
	pa.pa_zhp = zhp;
	pa.pa_fd = fd;
	pa.pa_parsable = flags->parsable;
	pa.pa_estimate = B_FALSE;
	pa.pa_verbosity = flags->verbosity;

	err = pthread_create(&ptid, NULL,
	send_progress_thread, &pa);
	if (err != 0) {
	zfs_error_aux(zhp->zfs_hdl, strerror(errno));
	return (zfs_error(zhp->zfs_hdl,
	EZFS_THREADCREATEFAILED, errbuf));
	}
	}

	err = lzc_send_redacted(name, from, fd,
	lzc_flags_from_sendflags(flags), redactbook);

	if (flags->progress) {
	void *status = NULL;
	if (err != 0)
	(void) pthread_cancel(ptid);
	(void) pthread_join(ptid, &status);
	int error = (int)(uintptr_t)status;
	if (error != 0 && status != PTHREAD_CANCELED) {
	char errbuf[1024];
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "progress thread exited "
	"nonzero"));
	return (zfs_standard_error(hdl, error, errbuf));
	}
	}

	if (flags->props \|\| flags->holds \|\| flags->backup) {
	/* Write the final end record. */
	err = send_conclusion_record(orig_fd, NULL);
	if (err != 0)
	return (zfs_standard_error(hdl, err, errbuf));
	}
	if (err != 0) {
	switch (errno) {
	case EXDEV:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"not an earlier snapshot from the same fs"));
	return (zfs_error(hdl, EZFS_CROSSTARGET, errbuf));

	case ENOENT:
	case ESRCH:
	if (lzc_exists(name)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incremental source (%s) does not exist"),
	from);
	}
	return (zfs_error(hdl, EZFS_NOENT, errbuf));

	case EACCES:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset key must be loaded"));
	return (zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf));

	case EBUSY:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"target is busy; if a filesystem, "
	"it must not be mounted"));
	return (zfs_error(hdl, EZFS_BUSY, errbuf));

	case EDQUOT:
	case EFAULT:
	case EFBIG:
	case EINVAL:
	case EIO:
	case ENOLINK:
	case ENOSPC:
	case ENOSTR:
	case ENXIO:
	case EPIPE:
	case ERANGE:
	case EROFS:
	zfs_error_aux(hdl, strerror(errno));
	return (zfs_error(hdl, EZFS_BADBACKUP, errbuf));

	default:
	return (zfs_standard_error(hdl, errno, errbuf));
	}
	}
	return (err != 0);
	}

	/*
	* Routines specific to "zfs recv"
	*/

	static int
	recv_read(libzfs_handle_t hdl, int fd, void buf, int ilen,
	boolean_t byteswap, zio_cksum_t *zc)
	{
	char *cp = buf;
	int rv;
	int len = ilen;

	do {
	rv = read(fd, cp, len);
	cp += rv;
	len -= rv;
	} while (rv > 0);

	if (rv < 0 \|\| len != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"failed to read from stream"));
	return (zfs_error(hdl, EZFS_BADSTREAM, dgettext(TEXT_DOMAIN,
	"cannot receive")));
	}

	if (zc) {
	if (byteswap)
	fletcher_4_incremental_byteswap(buf, ilen, zc);
	else
	fletcher_4_incremental_native(buf, ilen, zc);
	}
	return (0);
	}

	static int
	recv_read_nvlist(libzfs_handle_t hdl, int fd, int len, nvlist_t *nvp,
	boolean_t byteswap, zio_cksum_t *zc)
	{
	char *buf;
	int err;

	buf = zfs_alloc(hdl, len);
	if (buf == NULL)
	return (ENOMEM);

	if (len > hdl->libzfs_max_nvlist) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "nvlist too large"));
	+ free(buf);
	return (ENOMEM);
	}

	err = recv_read(hdl, fd, buf, len, byteswap, zc);
	if (err != 0) {
	free(buf);
	return (err);
	}

	err = nvlist_unpack(buf, len, nvp, 0);
	free(buf);
	if (err != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
	"stream (malformed nvlist)"));
	return (EINVAL);
	}
	return (0);
	}

	/*
	* Returns the grand origin (origin of origin of origin...) of a given handle.
	* If this dataset is not a clone, it simply returns a copy of the original
	* handle.
	*/
	static zfs_handle_t *
	recv_open_grand_origin(zfs_handle_t *zhp)
	{
	char origin[ZFS_MAX_DATASET_NAME_LEN];
	zprop_source_t src;
	zfs_handle_t *ozhp = zfs_handle_dup(zhp);

	while (ozhp != NULL) {
	if (zfs_prop_get(ozhp, ZFS_PROP_ORIGIN, origin,
	sizeof (origin), &src, NULL, 0, B_FALSE) != 0)
	break;

	(void) zfs_close(ozhp);
	ozhp = zfs_open(zhp->zfs_hdl, origin, ZFS_TYPE_FILESYSTEM);
	}

	return (ozhp);
	}

	static int
	recv_rename_impl(zfs_handle_t zhp, const char name, const char *newname)
	{
	int err;
	zfs_handle_t *ozhp = NULL;

	/*
	* Attempt to rename the dataset. If it fails with EACCES we have
	* attempted to rename the dataset outside of its encryption root.
	* Force the dataset to become an encryption root and try again.
	*/
	err = lzc_rename(name, newname);
	if (err == EACCES) {
	ozhp = recv_open_grand_origin(zhp);
	if (ozhp == NULL) {
	err = ENOENT;
	goto out;
	}

	err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
	NULL, NULL, 0);
	if (err != 0)
	goto out;

	err = lzc_rename(name, newname);
	}

	out:
	if (ozhp != NULL)
	zfs_close(ozhp);
	return (err);
	}

	static int
	recv_rename(libzfs_handle_t hdl, const char name, const char *tryname,
	int baselen, char newname, recvflags_t flags)
	{
	static int seq;
	int err;
	prop_changelist_t *clp = NULL;
	zfs_handle_t *zhp = NULL;

	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
	if (zhp == NULL) {
	err = -1;
	goto out;
	}
	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
	flags->force ? MS_FORCE : 0);
	if (clp == NULL) {
	err = -1;
	goto out;
	}
	err = changelist_prefix(clp);
	if (err)
	goto out;

	if (tryname) {
	(void) strcpy(newname, tryname);
	if (flags->verbose) {
	(void) printf("attempting rename %s to %s\n",
	name, newname);
	}
	err = recv_rename_impl(zhp, name, newname);
	if (err == 0)
	changelist_rename(clp, name, tryname);
	} else {
	err = ENOENT;
	}

	if (err != 0 && strncmp(name + baselen, "recv-", 5) != 0) {
	seq++;

	(void) snprintf(newname, ZFS_MAX_DATASET_NAME_LEN,
	"%.*srecv-%u-%u", baselen, name, getpid(), seq);

	if (flags->verbose) {
	(void) printf("failed - trying rename %s to %s\n",
	name, newname);
	}
	err = recv_rename_impl(zhp, name, newname);
	if (err == 0)
	changelist_rename(clp, name, newname);
	if (err && flags->verbose) {
	(void) printf("failed (%u) - "
	"will try again on next pass\n", errno);
	}
	err = EAGAIN;
	} else if (flags->verbose) {
	if (err == 0)
	(void) printf("success\n");
	else
	(void) printf("failed (%u)\n", errno);
	}

	(void) changelist_postfix(clp);

	out:
	if (clp != NULL)
	changelist_free(clp);
	if (zhp != NULL)
	zfs_close(zhp);

	return (err);
	}

	static int
	recv_promote(libzfs_handle_t hdl, const char fsname,
	const char origin_fsname, recvflags_t flags)
	{
	int err;
	zfs_cmd_t zc = {"\0"};
	zfs_handle_t zhp = NULL, ozhp = NULL;

	if (flags->verbose)
	(void) printf("promoting %s\n", fsname);

	(void) strlcpy(zc.zc_value, origin_fsname, sizeof (zc.zc_value));
	(void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));

	/*
	* Attempt to promote the dataset. If it fails with EACCES the
	* promotion would cause this dataset to leave its encryption root.
	* Force the origin to become an encryption root and try again.
	*/
	err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
	if (err == EACCES) {
	zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
	if (zhp == NULL) {
	err = -1;
	goto out;
	}

	ozhp = recv_open_grand_origin(zhp);
	if (ozhp == NULL) {
	err = -1;
	goto out;
	}

	err = lzc_change_key(ozhp->zfs_name, DCP_CMD_FORCE_NEW_KEY,
	NULL, NULL, 0);
	if (err != 0)
	goto out;

	err = zfs_ioctl(hdl, ZFS_IOC_PROMOTE, &zc);
	}

	out:
	if (zhp != NULL)
	zfs_close(zhp);
	if (ozhp != NULL)
	zfs_close(ozhp);

	return (err);
	}

	static int
	recv_destroy(libzfs_handle_t hdl, const char name, int baselen,
	char newname, recvflags_t flags)
	{
	int err = 0;
	prop_changelist_t *clp;
	zfs_handle_t *zhp;
	boolean_t defer = B_FALSE;
	int spa_version;

	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
	if (zhp == NULL)
	return (-1);
	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
	flags->force ? MS_FORCE : 0);
	if (zfs_get_type(zhp) == ZFS_TYPE_SNAPSHOT &&
	zfs_spa_version(zhp, &spa_version) == 0 &&
	spa_version >= SPA_VERSION_USERREFS)
	defer = B_TRUE;
	zfs_close(zhp);
	if (clp == NULL)
	return (-1);
	err = changelist_prefix(clp);
	if (err)
	return (err);

	if (flags->verbose)
	(void) printf("attempting destroy %s\n", name);
	if (zhp->zfs_type == ZFS_TYPE_SNAPSHOT) {
	nvlist_t *nv = fnvlist_alloc();
	fnvlist_add_boolean(nv, name);
	err = lzc_destroy_snaps(nv, defer, NULL);
	fnvlist_free(nv);
	} else {
	err = lzc_destroy(name);
	}
	if (err == 0) {
	if (flags->verbose)
	(void) printf("success\n");
	changelist_remove(clp, name);
	}

	(void) changelist_postfix(clp);
	changelist_free(clp);

	/*
	* Deferred destroy might destroy the snapshot or only mark it to be
	* destroyed later, and it returns success in either case.
	*/
	if (err != 0 \|\| (defer && zfs_dataset_exists(hdl, name,
	ZFS_TYPE_SNAPSHOT))) {
	err = recv_rename(hdl, name, NULL, baselen, newname, flags);
	}

	return (err);
	}

	typedef struct guid_to_name_data {
	uint64_t guid;
	boolean_t bookmark_ok;
	char *name;
	char *skip;
	uint64_t *redact_snap_guids;
	uint64_t num_redact_snaps;
	} guid_to_name_data_t;

	static boolean_t
	redact_snaps_match(zfs_handle_t zhp, guid_to_name_data_t gtnd)
	{
	uint64_t *bmark_snaps;
	uint_t bmark_num_snaps;
	nvlist_t *nvl;
	if (zhp->zfs_type != ZFS_TYPE_BOOKMARK)
	return (B_FALSE);

	nvl = fnvlist_lookup_nvlist(zhp->zfs_props,
	zfs_prop_to_name(ZFS_PROP_REDACT_SNAPS));
	bmark_snaps = fnvlist_lookup_uint64_array(nvl, ZPROP_VALUE,
	&bmark_num_snaps);
	if (bmark_num_snaps != gtnd->num_redact_snaps)
	return (B_FALSE);
	int i = 0;
	for (; i < bmark_num_snaps; i++) {
	int j = 0;
	for (; j < bmark_num_snaps; j++) {
	if (bmark_snaps[i] == gtnd->redact_snap_guids[j])
	break;
	}
	if (j == bmark_num_snaps)
	break;
	}
	return (i == bmark_num_snaps);
	}

	static int
	guid_to_name_cb(zfs_handle_t zhp, void arg)
	{
	guid_to_name_data_t *gtnd = arg;
	const char *slash;
	int err;

	if (gtnd->skip != NULL &&
	(slash = strrchr(zhp->zfs_name, '/')) != NULL &&
	strcmp(slash + 1, gtnd->skip) == 0) {
	zfs_close(zhp);
	return (0);
	}

	if (zfs_prop_get_int(zhp, ZFS_PROP_GUID) == gtnd->guid &&
	(gtnd->num_redact_snaps == -1 \|\| redact_snaps_match(zhp, gtnd))) {
	(void) strcpy(gtnd->name, zhp->zfs_name);
	zfs_close(zhp);
	return (EEXIST);
	}

	err = zfs_iter_children(zhp, guid_to_name_cb, gtnd);
	if (err != EEXIST && gtnd->bookmark_ok)
	err = zfs_iter_bookmarks(zhp, guid_to_name_cb, gtnd);
	zfs_close(zhp);
	return (err);
	}

	/*
	* Attempt to find the local dataset associated with this guid. In the case of
	* multiple matches, we attempt to find the "best" match by searching
	* progressively larger portions of the hierarchy. This allows one to send a
	* tree of datasets individually and guarantee that we will find the source
	* guid within that hierarchy, even if there are multiple matches elsewhere.
	*
	* If num_redact_snaps is not -1, we attempt to find a redaction bookmark with
	* the specified number of redaction snapshots. If num_redact_snaps isn't 0 or
	* -1, then redact_snap_guids will be an array of the guids of the snapshots the
	* redaction bookmark was created with. If num_redact_snaps is -1, then we will
	* attempt to find a snapshot or bookmark (if bookmark_ok is passed) with the
	* given guid. Note that a redaction bookmark can be returned if
	* num_redact_snaps == -1.
	*/
	static int
	guid_to_name_redact_snaps(libzfs_handle_t hdl, const char parent,
	uint64_t guid, boolean_t bookmark_ok, uint64_t *redact_snap_guids,
	uint64_t num_redact_snaps, char *name)
	{
	char pname[ZFS_MAX_DATASET_NAME_LEN];
	guid_to_name_data_t gtnd;

	gtnd.guid = guid;
	gtnd.bookmark_ok = bookmark_ok;
	gtnd.name = name;
	gtnd.skip = NULL;
	gtnd.redact_snap_guids = redact_snap_guids;
	gtnd.num_redact_snaps = num_redact_snaps;

	/*
	* Search progressively larger portions of the hierarchy, starting
	* with the filesystem specified by 'parent'. This will
	* select the "most local" version of the origin snapshot in the case
	* that there are multiple matching snapshots in the system.
	*/
	(void) strlcpy(pname, parent, sizeof (pname));
	char *cp = strrchr(pname, '@');
	if (cp == NULL)
	cp = strchr(pname, '\0');
	for (; cp != NULL; cp = strrchr(pname, '/')) {
	/* Chop off the last component and open the parent */
	*cp = '\0';
	zfs_handle_t *zhp = make_dataset_handle(hdl, pname);

	if (zhp == NULL)
	continue;
	int err = guid_to_name_cb(zfs_handle_dup(zhp), &gtnd);
	if (err != EEXIST)
	err = zfs_iter_children(zhp, guid_to_name_cb, &gtnd);
	if (err != EEXIST && bookmark_ok)
	err = zfs_iter_bookmarks(zhp, guid_to_name_cb, &gtnd);
	zfs_close(zhp);
	if (err == EEXIST)
	return (0);

	/*
	* Remember the last portion of the dataset so we skip it next
	* time through (as we've already searched that portion of the
	* hierarchy).
	*/
	gtnd.skip = strrchr(pname, '/') + 1;
	}

	return (ENOENT);
	}

	static int
	guid_to_name(libzfs_handle_t hdl, const char parent, uint64_t guid,
	boolean_t bookmark_ok, char *name)
	{
	return (guid_to_name_redact_snaps(hdl, parent, guid, bookmark_ok, NULL,
	-1, name));
	}

	/*
	* Return +1 if guid1 is before guid2, 0 if they are the same, and -1 if
	* guid1 is after guid2.
	*/
	static int
	created_before(libzfs_handle_t hdl, avl_tree_t avl,
	uint64_t guid1, uint64_t guid2)
	{
	nvlist_t *nvfs;
	char fsname = NULL, snapname = NULL;
	char buf[ZFS_MAX_DATASET_NAME_LEN];
	int rv;
	zfs_handle_t guid1hdl, guid2hdl;
	uint64_t create1, create2;

	if (guid2 == 0)
	return (0);
	if (guid1 == 0)
	return (1);

	nvfs = fsavl_find(avl, guid1, &snapname);
	VERIFY(0 == nvlist_lookup_string(nvfs, "name", &fsname));
	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
	guid1hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
	if (guid1hdl == NULL)
	return (-1);

	nvfs = fsavl_find(avl, guid2, &snapname);
	VERIFY(0 == nvlist_lookup_string(nvfs, "name", &fsname));
	(void) snprintf(buf, sizeof (buf), "%s@%s", fsname, snapname);
	guid2hdl = zfs_open(hdl, buf, ZFS_TYPE_SNAPSHOT);
	if (guid2hdl == NULL) {
	zfs_close(guid1hdl);
	return (-1);
	}

	create1 = zfs_prop_get_int(guid1hdl, ZFS_PROP_CREATETXG);
	create2 = zfs_prop_get_int(guid2hdl, ZFS_PROP_CREATETXG);

	if (create1 < create2)
	rv = -1;
	else if (create1 > create2)
	rv = +1;
	else
	rv = 0;

	zfs_close(guid1hdl);
	zfs_close(guid2hdl);

	return (rv);
	}

	/*
	* This function reestablishes the hierarchy of encryption roots after a
	* recursive incremental receive has completed. This must be done after the
	* second call to recv_incremental_replication() has renamed and promoted all
	* sent datasets to their final locations in the dataset hierarchy.
	*/
	static int
	recv_fix_encryption_hierarchy(libzfs_handle_t hdl, const char top_zfs,
	nvlist_t stream_nv, avl_tree_t stream_avl)
	{
	int err;
	nvpair_t *fselem = NULL;
	nvlist_t *stream_fss;

	VERIFY(0 == nvlist_lookup_nvlist(stream_nv, "fss", &stream_fss));

	while ((fselem = nvlist_next_nvpair(stream_fss, fselem)) != NULL) {
	zfs_handle_t *zhp = NULL;
	uint64_t crypt;
	nvlist_t snaps, props, *stream_nvfs = NULL;
	nvpair_t *snapel = NULL;
	boolean_t is_encroot, is_clone, stream_encroot;
	char *cp;
	char *stream_keylocation = NULL;
	char keylocation[MAXNAMELEN];
	char fsname[ZFS_MAX_DATASET_NAME_LEN];

	keylocation[0] = '\0';
	VERIFY(0 == nvpair_value_nvlist(fselem, &stream_nvfs));
	VERIFY(0 == nvlist_lookup_nvlist(stream_nvfs, "snaps", &snaps));
	VERIFY(0 == nvlist_lookup_nvlist(stream_nvfs, "props", &props));
	stream_encroot = nvlist_exists(stream_nvfs, "is_encroot");

	/* find a snapshot from the stream that exists locally */
	err = ENOENT;
	while ((snapel = nvlist_next_nvpair(snaps, snapel)) != NULL) {
	uint64_t guid;

	VERIFY(0 == nvpair_value_uint64(snapel, &guid));
	err = guid_to_name(hdl, top_zfs, guid, B_FALSE,
	fsname);
	if (err == 0)
	break;
	}

	if (err != 0)
	continue;

	cp = strchr(fsname, '@');
	if (cp != NULL)
	*cp = '\0';

	zhp = zfs_open(hdl, fsname, ZFS_TYPE_DATASET);
	if (zhp == NULL) {
	err = ENOENT;
	goto error;
	}

	crypt = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION);
	is_clone = zhp->zfs_dmustats.dds_origin[0] != '\0';
	(void) zfs_crypto_get_encryption_root(zhp, &is_encroot, NULL);

	/* we don't need to do anything for unencrypted datasets */
	if (crypt == ZIO_CRYPT_OFF) {
	zfs_close(zhp);
	continue;
	}

	/*
	* If the dataset is flagged as an encryption root, was not
	* received as a clone and is not currently an encryption root,
	* force it to become one. Fixup the keylocation if necessary.
	*/
	if (stream_encroot) {
	if (!is_clone && !is_encroot) {
	err = lzc_change_key(fsname,
	DCP_CMD_FORCE_NEW_KEY, NULL, NULL, 0);
	if (err != 0) {
	zfs_close(zhp);
	goto error;
	}
	}

	VERIFY(0 == nvlist_lookup_string(props,
	zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
	&stream_keylocation));

	/*
	* Refresh the properties in case the call to
	* lzc_change_key() changed the value.
	*/
	zfs_refresh_properties(zhp);
	err = zfs_prop_get(zhp, ZFS_PROP_KEYLOCATION,
	keylocation, sizeof (keylocation), NULL, NULL,
	0, B_TRUE);
	if (err != 0) {
	zfs_close(zhp);
	goto error;
	}

	if (strcmp(keylocation, stream_keylocation) != 0) {
	err = zfs_prop_set(zhp,
	zfs_prop_to_name(ZFS_PROP_KEYLOCATION),
	stream_keylocation);
	if (err != 0) {
	zfs_close(zhp);
	goto error;
	}
	}
	}

	/*
	* If the dataset is not flagged as an encryption root and is
	* currently an encryption root, force it to inherit from its
	* parent. The root of a raw send should never be
	* force-inherited.
	*/
	if (!stream_encroot && is_encroot &&
	strcmp(top_zfs, fsname) != 0) {
	err = lzc_change_key(fsname, DCP_CMD_FORCE_INHERIT,
	NULL, NULL, 0);
	if (err != 0) {
	zfs_close(zhp);
	goto error;
	}
	}

	zfs_close(zhp);
	}

	return (0);

	error:
	return (err);
	}

	static int
	recv_incremental_replication(libzfs_handle_t hdl, const char tofs,
	recvflags_t flags, nvlist_t stream_nv, avl_tree_t *stream_avl,
	nvlist_t *renamed)
	{
	nvlist_t local_nv, deleted = NULL;
	avl_tree_t *local_avl;
	nvpair_t fselem, nextfselem;
	char *fromsnap;
	char newname[ZFS_MAX_DATASET_NAME_LEN];
	char guidname[32];
	int error;
	boolean_t needagain, progress, recursive;
	char s1, s2;

	VERIFY(0 == nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap));

	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
	ENOENT);

	if (flags->dryrun)
	return (0);

	again:
	needagain = progress = B_FALSE;

	VERIFY(0 == nvlist_alloc(&deleted, NV_UNIQUE_NAME, 0));

	if ((error = gather_nvlist(hdl, tofs, fromsnap, NULL,
	recursive, B_TRUE, B_FALSE, recursive, B_FALSE, B_FALSE,
	B_FALSE, B_TRUE, &local_nv, &local_avl)) != 0)
	return (error);

	/*
	* Process deletes and renames
	*/
	for (fselem = nvlist_next_nvpair(local_nv, NULL);
	fselem; fselem = nextfselem) {
	nvlist_t nvfs, snaps;
	nvlist_t *stream_nvfs = NULL;
	nvpair_t snapelem, nextsnapelem;
	uint64_t fromguid = 0;
	uint64_t originguid = 0;
	uint64_t stream_originguid = 0;
	uint64_t parent_fromsnap_guid, stream_parent_fromsnap_guid;
	char fsname, stream_fsname;

	nextfselem = nvlist_next_nvpair(local_nv, fselem);

	VERIFY(0 == nvpair_value_nvlist(fselem, &nvfs));
	VERIFY(0 == nvlist_lookup_nvlist(nvfs, "snaps", &snaps));
	VERIFY(0 == nvlist_lookup_string(nvfs, "name", &fsname));
	VERIFY(0 == nvlist_lookup_uint64(nvfs, "parentfromsnap",
	&parent_fromsnap_guid));
	(void) nvlist_lookup_uint64(nvfs, "origin", &originguid);

	/*
	* First find the stream's fs, so we can check for
	* a different origin (due to "zfs promote")
	*/
	for (snapelem = nvlist_next_nvpair(snaps, NULL);
	snapelem; snapelem = nvlist_next_nvpair(snaps, snapelem)) {
	uint64_t thisguid;

	VERIFY(0 == nvpair_value_uint64(snapelem, &thisguid));
	stream_nvfs = fsavl_find(stream_avl, thisguid, NULL);

	if (stream_nvfs != NULL)
	break;
	}

	/* check for promote */
	(void) nvlist_lookup_uint64(stream_nvfs, "origin",
	&stream_originguid);
	if (stream_nvfs && originguid != stream_originguid) {
	switch (created_before(hdl, local_avl,
	stream_originguid, originguid)) {
	case 1: {
	/* promote it! */
	nvlist_t *origin_nvfs;
	char *origin_fsname;

	origin_nvfs = fsavl_find(local_avl, originguid,
	NULL);
	VERIFY(0 == nvlist_lookup_string(origin_nvfs,
	"name", &origin_fsname));
	error = recv_promote(hdl, fsname, origin_fsname,
	flags);
	if (error == 0)
	progress = B_TRUE;
	break;
	}
	default:
	break;
	case -1:
	fsavl_destroy(local_avl);
	nvlist_free(local_nv);
	return (-1);
	}
	/*
	* We had/have the wrong origin, therefore our
	* list of snapshots is wrong. Need to handle
	* them on the next pass.
	*/
	needagain = B_TRUE;
	continue;
	}

	for (snapelem = nvlist_next_nvpair(snaps, NULL);
	snapelem; snapelem = nextsnapelem) {
	uint64_t thisguid;
	char *stream_snapname;
	nvlist_t found, props;

	nextsnapelem = nvlist_next_nvpair(snaps, snapelem);

	VERIFY(0 == nvpair_value_uint64(snapelem, &thisguid));
	found = fsavl_find(stream_avl, thisguid,
	&stream_snapname);

	/* check for delete */
	if (found == NULL) {
	char name[ZFS_MAX_DATASET_NAME_LEN];

	if (!flags->force)
	continue;

	(void) snprintf(name, sizeof (name), "%s@%s",
	fsname, nvpair_name(snapelem));

	error = recv_destroy(hdl, name,
	strlen(fsname)+1, newname, flags);
	if (error)
	needagain = B_TRUE;
	else
	progress = B_TRUE;
	sprintf(guidname, "%llu",
	(u_longlong_t)thisguid);
	nvlist_add_boolean(deleted, guidname);
	continue;
	}

	stream_nvfs = found;

	if (0 == nvlist_lookup_nvlist(stream_nvfs, "snapprops",
	&props) && 0 == nvlist_lookup_nvlist(props,
	stream_snapname, &props)) {
	zfs_cmd_t zc = {"\0"};

	zc.zc_cookie = B_TRUE; /* received */
	(void) snprintf(zc.zc_name, sizeof (zc.zc_name),
	"%s@%s", fsname, nvpair_name(snapelem));
	if (zcmd_write_src_nvlist(hdl, &zc,
	props) == 0) {
	(void) zfs_ioctl(hdl,
	ZFS_IOC_SET_PROP, &zc);
	zcmd_free_nvlists(&zc);
	}
	}

	/* check for different snapname */
	if (strcmp(nvpair_name(snapelem),
	stream_snapname) != 0) {
	char name[ZFS_MAX_DATASET_NAME_LEN];
	char tryname[ZFS_MAX_DATASET_NAME_LEN];

	(void) snprintf(name, sizeof (name), "%s@%s",
	fsname, nvpair_name(snapelem));
	(void) snprintf(tryname, sizeof (name), "%s@%s",
	fsname, stream_snapname);

	error = recv_rename(hdl, name, tryname,
	strlen(fsname)+1, newname, flags);
	if (error)
	needagain = B_TRUE;
	else
	progress = B_TRUE;
	}

	if (strcmp(stream_snapname, fromsnap) == 0)
	fromguid = thisguid;
	}

	/* check for delete */
	if (stream_nvfs == NULL) {
	if (!flags->force)
	continue;

	error = recv_destroy(hdl, fsname, strlen(tofs)+1,
	newname, flags);
	if (error)
	needagain = B_TRUE;
	else
	progress = B_TRUE;
	sprintf(guidname, "%llu",
	(u_longlong_t)parent_fromsnap_guid);
	nvlist_add_boolean(deleted, guidname);
	continue;
	}

	if (fromguid == 0) {
	if (flags->verbose) {
	(void) printf("local fs %s does not have "
	"fromsnap (%s in stream); must have "
	"been deleted locally; ignoring\n",
	fsname, fromsnap);
	}
	continue;
	}

	VERIFY(0 == nvlist_lookup_string(stream_nvfs,
	"name", &stream_fsname));
	VERIFY(0 == nvlist_lookup_uint64(stream_nvfs,
	"parentfromsnap", &stream_parent_fromsnap_guid));

	s1 = strrchr(fsname, '/');
	s2 = strrchr(stream_fsname, '/');

	/*
	* Check if we're going to rename based on parent guid change
	* and the current parent guid was also deleted. If it was then
	* rename will fail and is likely unneeded, so avoid this and
	* force an early retry to determine the new
	* parent_fromsnap_guid.
	*/
	if (stream_parent_fromsnap_guid != 0 &&
	parent_fromsnap_guid != 0 &&
	stream_parent_fromsnap_guid != parent_fromsnap_guid) {
	sprintf(guidname, "%llu",
	(u_longlong_t)parent_fromsnap_guid);
	if (nvlist_exists(deleted, guidname)) {
	progress = B_TRUE;
	needagain = B_TRUE;
	goto doagain;
	}
	}

	/*
	* Check for rename. If the exact receive path is specified, it
	* does not count as a rename, but we still need to check the
	* datasets beneath it.
	*/
	if ((stream_parent_fromsnap_guid != 0 &&
	parent_fromsnap_guid != 0 &&
	stream_parent_fromsnap_guid != parent_fromsnap_guid) \|\|
	((flags->isprefix \|\| strcmp(tofs, fsname) != 0) &&
	(s1 != NULL) && (s2 != NULL) && strcmp(s1, s2) != 0)) {
	nvlist_t *parent;
	char tryname[ZFS_MAX_DATASET_NAME_LEN];

	parent = fsavl_find(local_avl,
	stream_parent_fromsnap_guid, NULL);
	/*
	* NB: parent might not be found if we used the
	* tosnap for stream_parent_fromsnap_guid,
	* because the parent is a newly-created fs;
	* we'll be able to rename it after we recv the
	* new fs.
	*/
	if (parent != NULL) {
	char *pname;

	VERIFY(0 == nvlist_lookup_string(parent, "name",
	&pname));
	(void) snprintf(tryname, sizeof (tryname),
	"%s%s", pname, strrchr(stream_fsname, '/'));
	} else {
	tryname[0] = '\0';
	if (flags->verbose) {
	(void) printf("local fs %s new parent "
	"not found\n", fsname);
	}
	}

	newname[0] = '\0';

	error = recv_rename(hdl, fsname, tryname,
	strlen(tofs)+1, newname, flags);

	if (renamed != NULL && newname[0] != '\0') {
	VERIFY(0 == nvlist_add_boolean(renamed,
	newname));
	}

	if (error)
	needagain = B_TRUE;
	else
	progress = B_TRUE;
	}
	}

	doagain:
	fsavl_destroy(local_avl);
	nvlist_free(local_nv);
	nvlist_free(deleted);

	if (needagain && progress) {
	/* do another pass to fix up temporary names */
	if (flags->verbose)
	(void) printf("another pass:\n");
	goto again;
	}

	return (needagain \|\| error != 0);
	}

	static int
	zfs_receive_package(libzfs_handle_t hdl, int fd, const char destname,
	recvflags_t flags, dmu_replay_record_t drr, zio_cksum_t *zc,
	char *top_zfs, nvlist_t cmdprops)
	{
	nvlist_t *stream_nv = NULL;
	avl_tree_t *stream_avl = NULL;
	char *fromsnap = NULL;
	char *sendsnap = NULL;
	char *cp;
	char tofs[ZFS_MAX_DATASET_NAME_LEN];
	char sendfs[ZFS_MAX_DATASET_NAME_LEN];
	char errbuf[1024];
	dmu_replay_record_t drre;
	int error;
	boolean_t anyerr = B_FALSE;
	boolean_t softerr = B_FALSE;
	boolean_t recursive, raw;

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot receive"));

	assert(drr->drr_type == DRR_BEGIN);
	assert(drr->drr_u.drr_begin.drr_magic == DMU_BACKUP_MAGIC);
	assert(DMU_GET_STREAM_HDRTYPE(drr->drr_u.drr_begin.drr_versioninfo) ==
	DMU_COMPOUNDSTREAM);

	/*
	* Read in the nvlist from the stream.
	*/
	if (drr->drr_payloadlen != 0) {
	error = recv_read_nvlist(hdl, fd, drr->drr_payloadlen,
	&stream_nv, flags->byteswap, zc);
	if (error) {
	error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	goto out;
	}
	}

	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
	ENOENT);
	raw = (nvlist_lookup_boolean(stream_nv, "raw") == 0);

	if (recursive && strchr(destname, '@')) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot specify snapshot name for multi-snapshot stream"));
	error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	goto out;
	}

	/*
	* Read in the end record and verify checksum.
	*/
	if (0 != (error = recv_read(hdl, fd, &drre, sizeof (drre),
	flags->byteswap, NULL)))
	goto out;
	if (flags->byteswap) {
	drre.drr_type = BSWAP_32(drre.drr_type);
	drre.drr_u.drr_end.drr_checksum.zc_word[0] =
	BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[0]);
	drre.drr_u.drr_end.drr_checksum.zc_word[1] =
	BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[1]);
	drre.drr_u.drr_end.drr_checksum.zc_word[2] =
	BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[2]);
	drre.drr_u.drr_end.drr_checksum.zc_word[3] =
	BSWAP_64(drre.drr_u.drr_end.drr_checksum.zc_word[3]);
	}
	if (drre.drr_type != DRR_END) {
	error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	goto out;
	}
	if (!ZIO_CHECKSUM_EQUAL(drre.drr_u.drr_end.drr_checksum, *zc)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incorrect header checksum"));
	error = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	goto out;
	}

	(void) nvlist_lookup_string(stream_nv, "fromsnap", &fromsnap);

	if (drr->drr_payloadlen != 0) {
	nvlist_t *stream_fss;

	VERIFY(0 == nvlist_lookup_nvlist(stream_nv, "fss",
	&stream_fss));
	if ((stream_avl = fsavl_create(stream_fss)) == NULL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"couldn't allocate avl tree"));
	error = zfs_error(hdl, EZFS_NOMEM, errbuf);
	goto out;
	}

	if (fromsnap != NULL && recursive) {
	nvlist_t *renamed = NULL;
	nvpair_t *pair = NULL;

	(void) strlcpy(tofs, destname, sizeof (tofs));
	if (flags->isprefix) {
	struct drr_begin *drrb = &drr->drr_u.drr_begin;
	int i;

	if (flags->istail) {
	cp = strrchr(drrb->drr_toname, '/');
	if (cp == NULL) {
	(void) strlcat(tofs, "/",
	sizeof (tofs));
	i = 0;
	} else {
	i = (cp - drrb->drr_toname);
	}
	} else {
	i = strcspn(drrb->drr_toname, "/@");
	}
	/* zfs_receive_one() will create_parents() */
	(void) strlcat(tofs, &drrb->drr_toname[i],
	sizeof (tofs));
	*strchr(tofs, '@') = '\0';
	}

	if (!flags->dryrun && !flags->nomount) {
	VERIFY(0 == nvlist_alloc(&renamed,
	NV_UNIQUE_NAME, 0));
	}

	softerr = recv_incremental_replication(hdl, tofs, flags,
	stream_nv, stream_avl, renamed);

	/* Unmount renamed filesystems before receiving. */
	while ((pair = nvlist_next_nvpair(renamed,
	pair)) != NULL) {
	zfs_handle_t *zhp;
	prop_changelist_t *clp = NULL;

	zhp = zfs_open(hdl, nvpair_name(pair),
	ZFS_TYPE_FILESYSTEM);
	if (zhp != NULL) {
	clp = changelist_gather(zhp,
	ZFS_PROP_MOUNTPOINT, 0,
	flags->forceunmount ? MS_FORCE : 0);
	zfs_close(zhp);
	if (clp != NULL) {
	softerr \|=
	changelist_prefix(clp);
	changelist_free(clp);
	}
	}
	}

	nvlist_free(renamed);
	}
	}

	/*
	* Get the fs specified by the first path in the stream (the top level
	* specified by 'zfs send') and pass it to each invocation of
	* zfs_receive_one().
	*/
	(void) strlcpy(sendfs, drr->drr_u.drr_begin.drr_toname,
	sizeof (sendfs));
	if ((cp = strchr(sendfs, '@')) != NULL) {
	*cp = '\0';
	/*
	* Find the "sendsnap", the final snapshot in a replication
	* stream. zfs_receive_one() handles certain errors
	* differently, depending on if the contained stream is the
	* last one or not.
	*/
	sendsnap = (cp + 1);
	}

	/* Finally, receive each contained stream */
	do {
	/*
	* we should figure out if it has a recoverable
	* error, in which case do a recv_skip() and drive on.
	* Note, if we fail due to already having this guid,
	* zfs_receive_one() will take care of it (ie,
	* recv_skip() and return 0).
	*/
	error = zfs_receive_impl(hdl, destname, NULL, flags, fd,
	sendfs, stream_nv, stream_avl, top_zfs, sendsnap, cmdprops);
	if (error == ENODATA) {
	error = 0;
	break;
	}
	anyerr \|= error;
	} while (error == 0);

	if (drr->drr_payloadlen != 0 && recursive && fromsnap != NULL) {
	/*
	* Now that we have the fs's they sent us, try the
	* renames again.
	*/
	softerr = recv_incremental_replication(hdl, tofs, flags,
	stream_nv, stream_avl, NULL);
	}

	if (raw && softerr == 0 && *top_zfs != NULL) {
	softerr = recv_fix_encryption_hierarchy(hdl, *top_zfs,
	stream_nv, stream_avl);
	}

	out:
	fsavl_destroy(stream_avl);
	nvlist_free(stream_nv);
	if (softerr)
	error = -2;
	if (anyerr)
	error = -1;
	return (error);
	}

	static void
	trunc_prop_errs(int truncated)
	{
	ASSERT(truncated != 0);

	if (truncated == 1)
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"1 more property could not be set\n"));
	else
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN,
	"%d more properties could not be set\n"), truncated);
	}

	static int
	recv_skip(libzfs_handle_t *hdl, int fd, boolean_t byteswap)
	{
	dmu_replay_record_t *drr;
	void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);
	uint64_t payload_size;
	char errbuf[1024];

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot receive"));

	/* XXX would be great to use lseek if possible... */
	drr = buf;

	while (recv_read(hdl, fd, drr, sizeof (dmu_replay_record_t),
	byteswap, NULL) == 0) {
	if (byteswap)
	drr->drr_type = BSWAP_32(drr->drr_type);

	switch (drr->drr_type) {
	case DRR_BEGIN:
	if (drr->drr_payloadlen != 0) {
	(void) recv_read(hdl, fd, buf,
	drr->drr_payloadlen, B_FALSE, NULL);
	}
	break;

	case DRR_END:
	free(buf);
	return (0);

	case DRR_OBJECT:
	if (byteswap) {
	drr->drr_u.drr_object.drr_bonuslen =
	BSWAP_32(drr->drr_u.drr_object.
	drr_bonuslen);
	drr->drr_u.drr_object.drr_raw_bonuslen =
	BSWAP_32(drr->drr_u.drr_object.
	drr_raw_bonuslen);
	}

	payload_size =
	DRR_OBJECT_PAYLOAD_SIZE(&drr->drr_u.drr_object);
	(void) recv_read(hdl, fd, buf, payload_size,
	B_FALSE, NULL);
	break;

	case DRR_WRITE:
	if (byteswap) {
	drr->drr_u.drr_write.drr_logical_size =
	BSWAP_64(
	drr->drr_u.drr_write.drr_logical_size);
	drr->drr_u.drr_write.drr_compressed_size =
	BSWAP_64(
	drr->drr_u.drr_write.drr_compressed_size);
	}
	payload_size =
	DRR_WRITE_PAYLOAD_SIZE(&drr->drr_u.drr_write);
	assert(payload_size <= SPA_MAXBLOCKSIZE);
	(void) recv_read(hdl, fd, buf,
	payload_size, B_FALSE, NULL);
	break;
	case DRR_SPILL:
	if (byteswap) {
	drr->drr_u.drr_spill.drr_length =
	BSWAP_64(drr->drr_u.drr_spill.drr_length);
	drr->drr_u.drr_spill.drr_compressed_size =
	BSWAP_64(drr->drr_u.drr_spill.
	drr_compressed_size);
	}

	payload_size =
	DRR_SPILL_PAYLOAD_SIZE(&drr->drr_u.drr_spill);
	(void) recv_read(hdl, fd, buf, payload_size,
	B_FALSE, NULL);
	break;
	case DRR_WRITE_EMBEDDED:
	if (byteswap) {
	drr->drr_u.drr_write_embedded.drr_psize =
	BSWAP_32(drr->drr_u.drr_write_embedded.
	drr_psize);
	}
	(void) recv_read(hdl, fd, buf,
	P2ROUNDUP(drr->drr_u.drr_write_embedded.drr_psize,
	8), B_FALSE, NULL);
	break;
	case DRR_OBJECT_RANGE:
	case DRR_WRITE_BYREF:
	case DRR_FREEOBJECTS:
	case DRR_FREE:
	break;

	default:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid record type"));
	free(buf);
	return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
	}
	}

	free(buf);
	return (-1);
	}

	static void
	recv_ecksum_set_aux(libzfs_handle_t hdl, const char target_snap,
	boolean_t resumable, boolean_t checksum)
	{
	char target_fs[ZFS_MAX_DATASET_NAME_LEN];

	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, (checksum ?
	"checksum mismatch" : "incomplete stream")));

	if (!resumable)
	return;
	(void) strlcpy(target_fs, target_snap, sizeof (target_fs));
	*strchr(target_fs, '@') = '\0';
	zfs_handle_t *zhp = zfs_open(hdl, target_fs,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL)
	return;

	char token_buf[ZFS_MAXPROPLEN];
	int error = zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN,
	token_buf, sizeof (token_buf),
	NULL, NULL, 0, B_TRUE);
	if (error == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"checksum mismatch or incomplete stream.\n"
	"Partially received snapshot is saved.\n"
	"A resuming stream can be generated on the sending "
	"system by running:\n"
	" zfs send -t %s"),
	token_buf);
	}
	zfs_close(zhp);
	}

	/*
	* Prepare a new nvlist of properties that are to override (-o) or be excluded
	* (-x) from the received dataset
	* recvprops: received properties from the send stream
	* cmdprops: raw input properties from command line
	* origprops: properties, both locally-set and received, currently set on the
	* target dataset if it exists, NULL otherwise.
	* oxprops: valid output override (-o) and excluded (-x) properties
	*/
	static int
	zfs_setup_cmdline_props(libzfs_handle_t *hdl, zfs_type_t type,
	char *fsname, boolean_t zoned, boolean_t recursive, boolean_t newfs,
	boolean_t raw, boolean_t toplevel, nvlist_t recvprops, nvlist_t cmdprops,
	nvlist_t origprops, nvlist_t oxprops, uint8_t *wkeydata_out,
	uint_t wkeylen_out, const char errbuf)
	{
	nvpair_t *nvp;
	nvlist_t oprops, voprops;
	zfs_handle_t *zhp = NULL;
	zpool_handle_t *zpool_hdl = NULL;
	char *cp;
	int ret = 0;
	char namebuf[ZFS_MAX_DATASET_NAME_LEN];

	if (nvlist_empty(cmdprops))
	return (0); /* No properties to override or exclude */

	*oxprops = fnvlist_alloc();
	oprops = fnvlist_alloc();

	strlcpy(namebuf, fsname, ZFS_MAX_DATASET_NAME_LEN);

	/*
	* Get our dataset handle. The target dataset may not exist yet.
	*/
	if (zfs_dataset_exists(hdl, namebuf, ZFS_TYPE_DATASET)) {
	zhp = zfs_open(hdl, namebuf, ZFS_TYPE_DATASET);
	if (zhp == NULL) {
	ret = -1;
	goto error;
	}
	}

	/* open the zpool handle */
	cp = strchr(namebuf, '/');
	if (cp != NULL)
	*cp = '\0';
	zpool_hdl = zpool_open(hdl, namebuf);
	if (zpool_hdl == NULL) {
	ret = -1;
	goto error;
	}

	/* restore namebuf to match fsname for later use */
	if (cp != NULL)
	*cp = '/';

	/*
	* first iteration: process excluded (-x) properties now and gather
	* added (-o) properties to be later processed by zfs_valid_proplist()
	*/
	nvp = NULL;
	while ((nvp = nvlist_next_nvpair(cmdprops, nvp)) != NULL) {
	const char *name = nvpair_name(nvp);
	zfs_prop_t prop = zfs_name_to_prop(name);

	/* "origin" is processed separately, don't handle it here */
	if (prop == ZFS_PROP_ORIGIN)
	continue;

	/*
	* we're trying to override or exclude a property that does not
	* make sense for this type of dataset, but we don't want to
	* fail if the receive is recursive: this comes in handy when
	* the send stream contains, for instance, a child ZVOL and
	* we're trying to receive it with "-o atime=on"
	*/
	if (!zfs_prop_valid_for_type(prop, type, B_FALSE) &&
	!zfs_prop_user(name)) {
	if (recursive)
	continue;
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' does not apply to datasets of this "
	"type"), name);
	ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	/* raw streams can't override encryption properties */
	if ((zfs_prop_encryption_key_param(prop) \|\|
	prop == ZFS_PROP_ENCRYPTION) && raw) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"encryption property '%s' cannot "
	"be set or excluded for raw streams."), name);
	ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	/* incremental streams can only exclude encryption properties */
	if ((zfs_prop_encryption_key_param(prop) \|\|
	prop == ZFS_PROP_ENCRYPTION) && !newfs &&
	nvpair_type(nvp) != DATA_TYPE_BOOLEAN) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"encryption property '%s' cannot "
	"be set for incremental streams."), name);
	ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	switch (nvpair_type(nvp)) {
	case DATA_TYPE_BOOLEAN: /* -x property */
	/*
	* DATA_TYPE_BOOLEAN is the way we're asked to "exclude"
	* a property: this is done by forcing an explicit
	* inherit on the destination so the effective value is
	* not the one we received from the send stream.
	* We do this only if the property is not already
	* locally-set, in which case its value will take
	* priority over the received anyway.
	*/
	if (nvlist_exists(origprops, name)) {
	nvlist_t *attrs;
	char *source = NULL;

	attrs = fnvlist_lookup_nvlist(origprops, name);
	if (nvlist_lookup_string(attrs,
	ZPROP_SOURCE, &source) == 0 &&
	strcmp(source, ZPROP_SOURCE_VAL_RECVD) != 0)
	continue;
	}
	/*
	* We can't force an explicit inherit on non-inheritable
	* properties: if we're asked to exclude this kind of
	* values we remove them from "recvprops" input nvlist.
	*/
	if (!zfs_prop_inheritable(prop) &&
	!zfs_prop_user(name) && /* can be inherited too */
	nvlist_exists(recvprops, name))
	fnvlist_remove(recvprops, name);
	else
	fnvlist_add_nvpair(*oxprops, nvp);
	break;
	case DATA_TYPE_STRING: /* -o property=value */
	fnvlist_add_nvpair(oprops, nvp);
	break;
	default:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property '%s' must be a string or boolean"), name);
	ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}
	}

	if (toplevel) {
	/* convert override strings properties to native */
	if ((voprops = zfs_valid_proplist(hdl, ZFS_TYPE_DATASET,
	oprops, zoned, zhp, zpool_hdl, B_FALSE, errbuf)) == NULL) {
	ret = zfs_error(hdl, EZFS_BADPROP, errbuf);
	goto error;
	}

	/*
	* zfs_crypto_create() requires the parent name. Get it
	* by truncating the fsname copy stored in namebuf.
	*/
	cp = strrchr(namebuf, '/');
	if (cp != NULL)
	*cp = '\0';

	if (!raw && zfs_crypto_create(hdl, namebuf, voprops, NULL,
	B_FALSE, wkeydata_out, wkeylen_out) != 0) {
	fnvlist_free(voprops);
	ret = zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
	goto error;
	}

	/* second pass: process "-o" properties */
	fnvlist_merge(*oxprops, voprops);
	fnvlist_free(voprops);
	} else {
	/* override props on child dataset are inherited */
	nvp = NULL;
	while ((nvp = nvlist_next_nvpair(oprops, nvp)) != NULL) {
	const char *name = nvpair_name(nvp);
	fnvlist_add_boolean(*oxprops, name);
	}
	}

	error:
	if (zhp != NULL)
	zfs_close(zhp);
	if (zpool_hdl != NULL)
	zpool_close(zpool_hdl);
	fnvlist_free(oprops);
	return (ret);
	}

	/*
	* Restores a backup of tosnap from the file descriptor specified by infd.
	*/
	static int
	zfs_receive_one(libzfs_handle_t hdl, int infd, const char tosnap,
	const char originsnap, recvflags_t flags, dmu_replay_record_t *drr,
	dmu_replay_record_t drr_noswap, const char sendfs, nvlist_t *stream_nv,
	avl_tree_t stream_avl, char *top_zfs,
	const char finalsnap, nvlist_t cmdprops)
	{
	time_t begin_time;
	int ioctl_err, ioctl_errno, err;
	char *cp;
	struct drr_begin *drrb = &drr->drr_u.drr_begin;
	char errbuf[1024];
	const char *chopprefix;
	boolean_t newfs = B_FALSE;
	boolean_t stream_wantsnewfs;
	boolean_t newprops = B_FALSE;
	uint64_t read_bytes = 0;
	uint64_t errflags = 0;
	uint64_t parent_snapguid = 0;
	prop_changelist_t *clp = NULL;
	nvlist_t *snapprops_nvlist = NULL;
	nvlist_t *snapholds_nvlist = NULL;
	zprop_errflags_t prop_errflags;
	nvlist_t *prop_errors = NULL;
	boolean_t recursive;
	char *snapname = NULL;
	char destsnap[MAXPATHLEN * 2];
	char origin[MAXNAMELEN];
	char name[MAXPATHLEN];
	char tmp_keylocation[MAXNAMELEN];
	nvlist_t rcvprops = NULL; / props received from the send stream */
	nvlist_t oxprops = NULL; / override (-o) and exclude (-x) props */
	nvlist_t origprops = NULL; / original props (if destination exists) */
	zfs_type_t type;
	boolean_t toplevel = B_FALSE;
	boolean_t zoned = B_FALSE;
	boolean_t hastoken = B_FALSE;
	boolean_t redacted;
	uint8_t *wkeydata = NULL;
	uint_t wkeylen = 0;

	begin_time = time(NULL);
	bzero(origin, MAXNAMELEN);
	bzero(tmp_keylocation, MAXNAMELEN);

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot receive"));

	recursive = (nvlist_lookup_boolean(stream_nv, "not_recursive") ==
	ENOENT);

	/* Did the user request holds be skipped via zfs recv -k? */
	boolean_t holds = flags->holds && !flags->skipholds;

	if (stream_avl != NULL) {
	char *keylocation = NULL;
	nvlist_t *lookup = NULL;
	nvlist_t *fs = fsavl_find(stream_avl, drrb->drr_toguid,
	&snapname);

	(void) nvlist_lookup_uint64(fs, "parentfromsnap",
	&parent_snapguid);
	err = nvlist_lookup_nvlist(fs, "props", &rcvprops);
	if (err) {
	VERIFY(0 == nvlist_alloc(&rcvprops, NV_UNIQUE_NAME, 0));
	newprops = B_TRUE;
	}

	/*
	* The keylocation property may only be set on encryption roots,
	* but this dataset might not become an encryption root until
	* recv_fix_encryption_hierarchy() is called. That function
	* will fixup the keylocation anyway, so we temporarily unset
	* the keylocation for now to avoid any errors from the receive
	* ioctl.
	*/
	err = nvlist_lookup_string(rcvprops,
	zfs_prop_to_name(ZFS_PROP_KEYLOCATION), &keylocation);
	if (err == 0) {
	strcpy(tmp_keylocation, keylocation);
	(void) nvlist_remove_all(rcvprops,
	zfs_prop_to_name(ZFS_PROP_KEYLOCATION));
	}

	if (flags->canmountoff) {
	VERIFY(0 == nvlist_add_uint64(rcvprops,
	zfs_prop_to_name(ZFS_PROP_CANMOUNT), 0));
	} else if (newprops) { /* nothing in rcvprops, eliminate it */
	nvlist_free(rcvprops);
	rcvprops = NULL;
	newprops = B_FALSE;
	}
	if (0 == nvlist_lookup_nvlist(fs, "snapprops", &lookup)) {
	VERIFY(0 == nvlist_lookup_nvlist(lookup,
	snapname, &snapprops_nvlist));
	}
	if (holds) {
	if (0 == nvlist_lookup_nvlist(fs, "snapholds",
	&lookup)) {
	VERIFY(0 == nvlist_lookup_nvlist(lookup,
	snapname, &snapholds_nvlist));
	}
	}
	}

	cp = NULL;

	/*
	* Determine how much of the snapshot name stored in the stream
	* we are going to tack on to the name they specified on the
	* command line, and how much we are going to chop off.
	*
	* If they specified a snapshot, chop the entire name stored in
	* the stream.
	*/
	if (flags->istail) {
	/*
	* A filesystem was specified with -e. We want to tack on only
	* the tail of the sent snapshot path.
	*/
	if (strchr(tosnap, '@')) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
	"argument - snapshot not allowed with -e"));
	err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
	goto out;
	}

	chopprefix = strrchr(sendfs, '/');

	if (chopprefix == NULL) {
	/*
	* The tail is the poolname, so we need to
	* prepend a path separator.
	*/
	int len = strlen(drrb->drr_toname);
	cp = malloc(len + 2);
	cp[0] = '/';
	(void) strcpy(&cp[1], drrb->drr_toname);
	chopprefix = cp;
	} else {
	chopprefix = drrb->drr_toname + (chopprefix - sendfs);
	}
	} else if (flags->isprefix) {
	/*
	* A filesystem was specified with -d. We want to tack on
	* everything but the first element of the sent snapshot path
	* (all but the pool name).
	*/
	if (strchr(tosnap, '@')) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
	"argument - snapshot not allowed with -d"));
	err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
	goto out;
	}

	chopprefix = strchr(drrb->drr_toname, '/');
	if (chopprefix == NULL)
	chopprefix = strchr(drrb->drr_toname, '@');
	} else if (strchr(tosnap, '@') == NULL) {
	/*
	* If a filesystem was specified without -d or -e, we want to
	* tack on everything after the fs specified by 'zfs send'.
	*/
	chopprefix = drrb->drr_toname + strlen(sendfs);
	} else {
	/* A snapshot was specified as an exact path (no -d or -e). */
	if (recursive) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot specify snapshot name for multi-snapshot "
	"stream"));
	err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	goto out;
	}
	chopprefix = drrb->drr_toname + strlen(drrb->drr_toname);
	}

	ASSERT(strstr(drrb->drr_toname, sendfs) == drrb->drr_toname);
	ASSERT(chopprefix > drrb->drr_toname \|\| strchr(sendfs, '/') == NULL);
	ASSERT(chopprefix <= drrb->drr_toname + strlen(drrb->drr_toname) \|\|
	strchr(sendfs, '/') == NULL);
	ASSERT(chopprefix[0] == '/' \|\| chopprefix[0] == '@' \|\|
	chopprefix[0] == '\0');

	/*
	* Determine name of destination snapshot.
	*/
	(void) strlcpy(destsnap, tosnap, sizeof (destsnap));
	(void) strlcat(destsnap, chopprefix, sizeof (destsnap));
	free(cp);
	if (!zfs_name_valid(destsnap, ZFS_TYPE_SNAPSHOT)) {
	err = zfs_error(hdl, EZFS_INVALIDNAME, errbuf);
	goto out;
	}

	/*
	* Determine the name of the origin snapshot.
	*/
	if (originsnap) {
	(void) strlcpy(origin, originsnap, sizeof (origin));
	if (flags->verbose)
	(void) printf("using provided clone origin %s\n",
	origin);
	} else if (drrb->drr_flags & DRR_FLAG_CLONE) {
	if (guid_to_name(hdl, destsnap,
	drrb->drr_fromguid, B_FALSE, origin) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"local origin for clone %s does not exist"),
	destsnap);
	err = zfs_error(hdl, EZFS_NOENT, errbuf);
	goto out;
	}
	if (flags->verbose)
	(void) printf("found clone origin %s\n", origin);
	}

	if ((DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
	DMU_BACKUP_FEATURE_DEDUP)) {
	(void) fprintf(stderr,
	gettext("ERROR: \"zfs receive\" no longer supports "
	"deduplicated send streams. Use\n"
	"the \"zstream redup\" command to convert this stream "
	"to a regular,\n"
	"non-deduplicated stream.\n"));
	err = zfs_error(hdl, EZFS_NOTSUP, errbuf);
	goto out;
	}

	boolean_t resuming = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
	DMU_BACKUP_FEATURE_RESUMING;
	boolean_t raw = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
	DMU_BACKUP_FEATURE_RAW;
	boolean_t embedded = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
	DMU_BACKUP_FEATURE_EMBED_DATA;
	stream_wantsnewfs = (drrb->drr_fromguid == 0 \|\|
	(drrb->drr_flags & DRR_FLAG_CLONE) \|\| originsnap) && !resuming;

	if (stream_wantsnewfs) {
	/*
	* if the parent fs does not exist, look for it based on
	* the parent snap GUID
	*/
	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot receive new filesystem stream"));

	(void) strcpy(name, destsnap);
	cp = strrchr(name, '/');
	if (cp)
	*cp = '\0';
	if (cp &&
	!zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
	char suffix[ZFS_MAX_DATASET_NAME_LEN];
	(void) strcpy(suffix, strrchr(destsnap, '/'));
	if (guid_to_name(hdl, name, parent_snapguid,
	B_FALSE, destsnap) == 0) {
	*strchr(destsnap, '@') = '\0';
	(void) strcat(destsnap, suffix);
	}
	}
	} else {
	/*
	* If the fs does not exist, look for it based on the
	* fromsnap GUID.
	*/
	if (resuming) {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot receive resume stream"));
	} else {
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN,
	"cannot receive incremental stream"));
	}

	(void) strcpy(name, destsnap);
	*strchr(name, '@') = '\0';

	/*
	* If the exact receive path was specified and this is the
	* topmost path in the stream, then if the fs does not exist we
	* should look no further.
	*/
	if ((flags->isprefix \|\| (*(chopprefix = drrb->drr_toname +
	strlen(sendfs)) != '\0' && *chopprefix != '@')) &&
	!zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
	char snap[ZFS_MAX_DATASET_NAME_LEN];
	(void) strcpy(snap, strchr(destsnap, '@'));
	if (guid_to_name(hdl, name, drrb->drr_fromguid,
	B_FALSE, destsnap) == 0) {
	*strchr(destsnap, '@') = '\0';
	(void) strcat(destsnap, snap);
	}
	}
	}

	(void) strcpy(name, destsnap);
	*strchr(name, '@') = '\0';

	redacted = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo) &
	DMU_BACKUP_FEATURE_REDACTED;

	if (zfs_dataset_exists(hdl, name, ZFS_TYPE_DATASET)) {
	zfs_cmd_t zc = {"\0"};
	zfs_handle_t *zhp;
	boolean_t encrypted;

	(void) strcpy(zc.zc_name, name);

	/*
	* Destination fs exists. It must be one of these cases:
	* - an incremental send stream
	* - the stream specifies a new fs (full stream or clone)
	* and they want us to blow away the existing fs (and
	* have therefore specified -F and removed any snapshots)
	* - we are resuming a failed receive.
	*/
	if (stream_wantsnewfs) {
	boolean_t is_volume = drrb->drr_type == DMU_OST_ZVOL;
	if (!flags->force) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination '%s' exists\n"
	"must specify -F to overwrite it"), name);
	err = zfs_error(hdl, EZFS_EXISTS, errbuf);
	goto out;
	}
	if (zfs_ioctl(hdl, ZFS_IOC_SNAPSHOT_LIST_NEXT,
	&zc) == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination has snapshots (eg. %s)\n"
	"must destroy them to overwrite it"),
	zc.zc_name);
	err = zfs_error(hdl, EZFS_EXISTS, errbuf);
	goto out;
	}
	if (is_volume && strrchr(name, '/') == NULL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination %s is the root dataset\n"
	"cannot overwrite with a ZVOL"),
	name);
	err = zfs_error(hdl, EZFS_EXISTS, errbuf);
	goto out;
	}
	if (is_volume &&
	zfs_ioctl(hdl, ZFS_IOC_DATASET_LIST_NEXT,
	&zc) == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination has children (eg. %s)\n"
	"cannot overwrite with a ZVOL"),
	zc.zc_name);
	err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
	goto out;
	}
	}

	if ((zhp = zfs_open(hdl, name,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME)) == NULL) {
	err = -1;
	goto out;
	}

	if (stream_wantsnewfs &&
	zhp->zfs_dmustats.dds_origin[0]) {
	zfs_close(zhp);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination '%s' is a clone\n"
	"must destroy it to overwrite it"), name);
	err = zfs_error(hdl, EZFS_EXISTS, errbuf);
	goto out;
	}

	/*
	* Raw sends can not be performed as an incremental on top
	* of existing unencrypted datasets. zfs recv -F can't be
	* used to blow away an existing encrypted filesystem. This
	* is because it would require the dsl dir to point to the
	* new key (or lack of a key) and the old key at the same
	* time. The -F flag may still be used for deleting
	* intermediate snapshots that would otherwise prevent the
	* receive from working.
	*/
	encrypted = zfs_prop_get_int(zhp, ZFS_PROP_ENCRYPTION) !=
	ZIO_CRYPT_OFF;
	if (!stream_wantsnewfs && !encrypted && raw) {
	zfs_close(zhp);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"cannot perform raw receive on top of "
	"existing unencrypted dataset"));
	err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
	goto out;
	}

	if (stream_wantsnewfs && flags->force &&
	((raw && !encrypted) \|\| encrypted)) {
	zfs_close(zhp);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"zfs receive -F cannot be used to destroy an "
	"encrypted filesystem or overwrite an "
	"unencrypted one with an encrypted one"));
	err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
	goto out;
	}

	if (!flags->dryrun && zhp->zfs_type == ZFS_TYPE_FILESYSTEM &&
	stream_wantsnewfs) {
	/* We can't do online recv in this case */
	clp = changelist_gather(zhp, ZFS_PROP_NAME, 0,
	flags->forceunmount ? MS_FORCE : 0);
	if (clp == NULL) {
	zfs_close(zhp);
	err = -1;
	goto out;
	}
	if (changelist_prefix(clp) != 0) {
	changelist_free(clp);
	zfs_close(zhp);
	err = -1;
	goto out;
	}
	}

	/*
	* If we are resuming a newfs, set newfs here so that we will
	* mount it if the recv succeeds this time. We can tell
	* that it was a newfs on the first recv because the fs
	* itself will be inconsistent (if the fs existed when we
	* did the first recv, we would have received it into
	* .../%recv).
	*/
	if (resuming && zfs_prop_get_int(zhp, ZFS_PROP_INCONSISTENT))
	newfs = B_TRUE;

	/* we want to know if we're zoned when validating -o\|-x props */
	zoned = zfs_prop_get_int(zhp, ZFS_PROP_ZONED);

	/* may need this info later, get it now we have zhp around */
	if (zfs_prop_get(zhp, ZFS_PROP_RECEIVE_RESUME_TOKEN, NULL, 0,
	NULL, NULL, 0, B_TRUE) == 0)
	hastoken = B_TRUE;

	/* gather existing properties on destination */
	origprops = fnvlist_alloc();
	fnvlist_merge(origprops, zhp->zfs_props);
	fnvlist_merge(origprops, zhp->zfs_user_props);

	zfs_close(zhp);
	} else {
	zfs_handle_t *zhp;

	/*
	* Destination filesystem does not exist. Therefore we better
	* be creating a new filesystem (either from a full backup, or
	* a clone). It would therefore be invalid if the user
	* specified only the pool name (i.e. if the destination name
	* contained no slash character).
	*/
	cp = strrchr(name, '/');

	if (!stream_wantsnewfs \|\| cp == NULL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination '%s' does not exist"), name);
	err = zfs_error(hdl, EZFS_NOENT, errbuf);
	goto out;
	}

	/*
	* Trim off the final dataset component so we perform the
	* recvbackup ioctl to the filesystems's parent.
	*/
	*cp = '\0';

	if (flags->isprefix && !flags->istail && !flags->dryrun &&
	create_parents(hdl, destsnap, strlen(tosnap)) != 0) {
	err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
	goto out;
	}

	/* validate parent */
	zhp = zfs_open(hdl, name, ZFS_TYPE_DATASET);
	if (zhp == NULL) {
	err = zfs_error(hdl, EZFS_BADRESTORE, errbuf);
	goto out;
	}
	if (zfs_get_type(zhp) != ZFS_TYPE_FILESYSTEM) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"parent '%s' is not a filesystem"), name);
	err = zfs_error(hdl, EZFS_WRONG_PARENT, errbuf);
	zfs_close(zhp);
	goto out;
	}

	zfs_close(zhp);

	newfs = B_TRUE;
	*cp = '/';
	}

	if (flags->verbose) {
	(void) printf("%s %s stream of %s into %s\n",
	flags->dryrun ? "would receive" : "receiving",
	drrb->drr_fromguid ? "incremental" : "full",
	drrb->drr_toname, destsnap);
	(void) fflush(stdout);
	}

	if (flags->dryrun) {
	void *buf = zfs_alloc(hdl, SPA_MAXBLOCKSIZE);

	/*
	* We have read the DRR_BEGIN record, but we have
	* not yet read the payload. For non-dryrun sends
	* this will be done by the kernel, so we must
	* emulate that here, before attempting to read
	* more records.
	*/
	err = recv_read(hdl, infd, buf, drr->drr_payloadlen,
	flags->byteswap, NULL);
	free(buf);
	if (err != 0)
	goto out;

	err = recv_skip(hdl, infd, flags->byteswap);
	goto out;
	}

	/*
	* If this is the top-level dataset, record it so we can use it
	* for recursive operations later.
	*/
	if (top_zfs != NULL &&
	(top_zfs == NULL \|\| strcmp(top_zfs, name) == 0)) {
	toplevel = B_TRUE;
	if (*top_zfs == NULL)
	*top_zfs = zfs_strdup(hdl, name);
	}

	if (drrb->drr_type == DMU_OST_ZVOL) {
	type = ZFS_TYPE_VOLUME;
	} else if (drrb->drr_type == DMU_OST_ZFS) {
	type = ZFS_TYPE_FILESYSTEM;
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid record type: 0x%d"), drrb->drr_type);
	err = zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	goto out;
	}
	if ((err = zfs_setup_cmdline_props(hdl, type, name, zoned, recursive,
	stream_wantsnewfs, raw, toplevel, rcvprops, cmdprops, origprops,
	&oxprops, &wkeydata, &wkeylen, errbuf)) != 0)
	goto out;

	/*
	* When sending with properties (zfs send -p), the encryption property
	* is not included because it is a SETONCE property and therefore
	* treated as read only. However, we are always able to determine its
	* value because raw sends will include it in the DRR_BDEGIN payload
	* and non-raw sends with properties are not allowed for encrypted
	* datasets. Therefore, if this is a non-raw properties stream, we can
	* infer that the value should be ZIO_CRYPT_OFF and manually add that
	* to the received properties.
	*/
	if (stream_wantsnewfs && !raw && rcvprops != NULL &&
	!nvlist_exists(cmdprops, zfs_prop_to_name(ZFS_PROP_ENCRYPTION))) {
	if (oxprops == NULL)
	oxprops = fnvlist_alloc();
	fnvlist_add_uint64(oxprops,
	zfs_prop_to_name(ZFS_PROP_ENCRYPTION), ZIO_CRYPT_OFF);
	}

	err = ioctl_err = lzc_receive_with_cmdprops(destsnap, rcvprops,
	oxprops, wkeydata, wkeylen, origin, flags->force, flags->resumable,
	raw, infd, drr_noswap, -1, &read_bytes, &errflags,
	NULL, &prop_errors);
	ioctl_errno = ioctl_err;
	prop_errflags = errflags;

	if (err == 0) {
	nvpair_t *prop_err = NULL;

	while ((prop_err = nvlist_next_nvpair(prop_errors,
	prop_err)) != NULL) {
	char tbuf[1024];
	zfs_prop_t prop;
	int intval;

	prop = zfs_name_to_prop(nvpair_name(prop_err));
	(void) nvpair_value_int32(prop_err, &intval);
	if (strcmp(nvpair_name(prop_err),
	ZPROP_N_MORE_ERRORS) == 0) {
	trunc_prop_errs(intval);
	break;
	} else if (snapname == NULL \|\| finalsnap == NULL \|\|
	strcmp(finalsnap, snapname) == 0 \|\|
	strcmp(nvpair_name(prop_err),
	zfs_prop_to_name(ZFS_PROP_REFQUOTA)) != 0) {
	/*
	* Skip the special case of, for example,
	* "refquota", errors on intermediate
	* snapshots leading up to a final one.
	* That's why we have all of the checks above.
	*
	* See zfs_ioctl.c's extract_delay_props() for
	* a list of props which can fail on
	* intermediate snapshots, but shouldn't
	* affect the overall receive.
	*/
	(void) snprintf(tbuf, sizeof (tbuf),
	dgettext(TEXT_DOMAIN,
	"cannot receive %s property on %s"),
	nvpair_name(prop_err), name);
	zfs_setprop_error(hdl, prop, intval, tbuf);
	}
	}
	}

	if (err == 0 && snapprops_nvlist) {
	zfs_cmd_t zc = {"\0"};

	(void) strcpy(zc.zc_name, destsnap);
	zc.zc_cookie = B_TRUE; /* received */
	if (zcmd_write_src_nvlist(hdl, &zc, snapprops_nvlist) == 0) {
	(void) zfs_ioctl(hdl, ZFS_IOC_SET_PROP, &zc);
	zcmd_free_nvlists(&zc);
	}
	}
	if (err == 0 && snapholds_nvlist) {
	nvpair_t *pair;
	nvlist_t holds, errors = NULL;
	int cleanup_fd = -1;

	VERIFY(0 == nvlist_alloc(&holds, 0, KM_SLEEP));
	for (pair = nvlist_next_nvpair(snapholds_nvlist, NULL);
	pair != NULL;
	pair = nvlist_next_nvpair(snapholds_nvlist, pair)) {
	VERIFY(0 == nvlist_add_string(holds, destsnap,
	nvpair_name(pair)));
	}
	(void) lzc_hold(holds, cleanup_fd, &errors);
	nvlist_free(snapholds_nvlist);
	nvlist_free(holds);
	}

	if (err && (ioctl_errno == ENOENT \|\| ioctl_errno == EEXIST)) {
	/*
	* It may be that this snapshot already exists,
	* in which case we want to consume & ignore it
	* rather than failing.
	*/
	avl_tree_t *local_avl;
	nvlist_t local_nv, fs;
	cp = strchr(destsnap, '@');

	/*
	* XXX Do this faster by just iterating over snaps in
	* this fs. Also if zc_value does not exist, we will
	* get a strange "does not exist" error message.
	*/
	*cp = '\0';
	if (gather_nvlist(hdl, destsnap, NULL, NULL, B_FALSE, B_TRUE,
	B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_FALSE, B_TRUE,
	&local_nv, &local_avl) == 0) {
	*cp = '@';
	fs = fsavl_find(local_avl, drrb->drr_toguid, NULL);
	fsavl_destroy(local_avl);
	nvlist_free(local_nv);

	if (fs != NULL) {
	if (flags->verbose) {
	(void) printf("snap %s already exists; "
	"ignoring\n", destsnap);
	}
	err = ioctl_err = recv_skip(hdl, infd,
	flags->byteswap);
	}
	}
	*cp = '@';
	}

	if (ioctl_err != 0) {
	switch (ioctl_errno) {
	case ENODEV:
	cp = strchr(destsnap, '@');
	*cp = '\0';
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"most recent snapshot of %s does not\n"
	"match incremental source"), destsnap);
	(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
	*cp = '@';
	break;
	case ETXTBSY:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination %s has been modified\n"
	"since most recent snapshot"), name);
	(void) zfs_error(hdl, EZFS_BADRESTORE, errbuf);
	break;
	case EACCES:
	if (raw && stream_wantsnewfs) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"failed to create encryption key"));
	} else if (raw && !stream_wantsnewfs) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"encryption key does not match "
	"existing key"));
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"inherited key must be loaded"));
	}
	(void) zfs_error(hdl, EZFS_CRYPTOFAILED, errbuf);
	break;
	case EEXIST:
	cp = strchr(destsnap, '@');
	if (newfs) {
	/* it's the containing fs that exists */
	*cp = '\0';
	}
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination already exists"));
	(void) zfs_error_fmt(hdl, EZFS_EXISTS,
	dgettext(TEXT_DOMAIN, "cannot restore to %s"),
	destsnap);
	*cp = '@';
	break;
	case EINVAL:
	if (flags->resumable) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"kernel modules must be upgraded to "
	"receive this stream."));
	} else if (embedded && !raw) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incompatible embedded data stream "
	"feature with encrypted receive."));
	}
	(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	break;
	case ECKSUM:
	case ZFS_ERR_STREAM_TRUNCATED:
	recv_ecksum_set_aux(hdl, destsnap, flags->resumable,
	ioctl_err == ECKSUM);
	(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	break;
	case ZFS_ERR_STREAM_LARGE_BLOCK_MISMATCH:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"incremental send stream requires -L "
	"(--large-block), to match previous receive."));
	(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	break;
	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool must be upgraded to receive this stream."));
	(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
	break;
	case EDQUOT:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination %s space quota exceeded."), name);
	(void) zfs_error(hdl, EZFS_NOSPC, errbuf);
	break;
	case ZFS_ERR_FROM_IVSET_GUID_MISSING:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"IV set guid missing. See errata %u at "
	"https://openzfs.github.io/openzfs-docs/msg/"
	"ZFS-8000-ER."),
	ZPOOL_ERRATA_ZOL_8308_ENCRYPTION);
	(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	break;
	case ZFS_ERR_FROM_IVSET_GUID_MISMATCH:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"IV set guid mismatch. See the 'zfs receive' "
	"man page section\n discussing the limitations "
	"of raw encrypted send streams."));
	(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	break;
	case ZFS_ERR_SPILL_BLOCK_FLAG_MISSING:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"Spill block flag missing for raw send.\n"
	"The zfs software on the sending system must "
	"be updated."));
	(void) zfs_error(hdl, EZFS_BADSTREAM, errbuf);
	break;
	case EBUSY:
	if (hastoken) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"destination %s contains "
	"partially-complete state from "
	"\"zfs receive -s\"."), name);
	(void) zfs_error(hdl, EZFS_BUSY, errbuf);
	break;
	}
	/* fallthru */
	default:
	(void) zfs_standard_error(hdl, ioctl_errno, errbuf);
	}
	}

	/*
	* Mount the target filesystem (if created). Also mount any
	* children of the target filesystem if we did a replication
	* receive (indicated by stream_avl being non-NULL).
	*/
	if (clp) {
	if (!flags->nomount)
	err \|= changelist_postfix(clp);
	changelist_free(clp);
	}

	if ((newfs \|\| stream_avl) && type == ZFS_TYPE_FILESYSTEM && !redacted)
	flags->domount = B_TRUE;

	if (prop_errflags & ZPROP_ERR_NOCLEAR) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
	"failed to clear unreceived properties on %s"), name);
	(void) fprintf(stderr, "\n");
	}
	if (prop_errflags & ZPROP_ERR_NORESTORE) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "Warning: "
	"failed to restore original properties on %s"), name);
	(void) fprintf(stderr, "\n");
	}

	if (err \|\| ioctl_err) {
	err = -1;
	goto out;
	}

	if (flags->verbose) {
	char buf1[64];
	char buf2[64];
	uint64_t bytes = read_bytes;
	time_t delta = time(NULL) - begin_time;
	if (delta == 0)
	delta = 1;
	zfs_nicebytes(bytes, buf1, sizeof (buf1));
	zfs_nicebytes(bytes/delta, buf2, sizeof (buf1));

	(void) printf("received %s stream in %lld seconds (%s/sec)\n",
	buf1, (longlong_t)delta, buf2);
	}

	err = 0;
	out:
	if (prop_errors != NULL)
	nvlist_free(prop_errors);

	if (tmp_keylocation[0] != '\0') {
	VERIFY(0 == nvlist_add_string(rcvprops,
	zfs_prop_to_name(ZFS_PROP_KEYLOCATION), tmp_keylocation));
	}

	if (newprops)
	nvlist_free(rcvprops);

	nvlist_free(oxprops);
	nvlist_free(origprops);

	return (err);
	}

	/*
	* Check properties we were asked to override (both -o\|-x)
	*/
	static boolean_t
	zfs_receive_checkprops(libzfs_handle_t hdl, nvlist_t props,
	const char *errbuf)
	{
	nvpair_t *nvp;
	zfs_prop_t prop;
	const char *name;

	nvp = NULL;
	while ((nvp = nvlist_next_nvpair(props, nvp)) != NULL) {
	name = nvpair_name(nvp);
	prop = zfs_name_to_prop(name);

	if (prop == ZPROP_INVAL) {
	if (!zfs_prop_user(name)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid property '%s'"), name);
	return (B_FALSE);
	}
	continue;
	}
	/*
	* "origin" is readonly but is used to receive datasets as
	* clones so we don't raise an error here
	*/
	if (prop == ZFS_PROP_ORIGIN)
	continue;

	/* encryption params have their own verification later */
	if (prop == ZFS_PROP_ENCRYPTION \|\|
	zfs_prop_encryption_key_param(prop))
	continue;

	/*
	* cannot override readonly, set-once and other specific
	* settable properties
	*/
	if (zfs_prop_readonly(prop) \|\| prop == ZFS_PROP_VERSION \|\|
	prop == ZFS_PROP_VOLSIZE) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid property '%s'"), name);
	return (B_FALSE);
	}
	}

	return (B_TRUE);
	}

	static int
	zfs_receive_impl(libzfs_handle_t hdl, const char tosnap,
	const char originsnap, recvflags_t flags, int infd, const char *sendfs,
	nvlist_t stream_nv, avl_tree_t stream_avl, char **top_zfs,
	const char finalsnap, nvlist_t cmdprops)
	{
	int err;
	dmu_replay_record_t drr, drr_noswap;
	struct drr_begin *drrb = &drr.drr_u.drr_begin;
	char errbuf[1024];
	zio_cksum_t zcksum = { { 0 } };
	uint64_t featureflags;
	int hdrtype;

	(void) snprintf(errbuf, sizeof (errbuf), dgettext(TEXT_DOMAIN,
	"cannot receive"));

	/* check cmdline props, raise an error if they cannot be received */
	if (!zfs_receive_checkprops(hdl, cmdprops, errbuf)) {
	return (zfs_error(hdl, EZFS_BADPROP, errbuf));
	}

	if (flags->isprefix &&
	!zfs_dataset_exists(hdl, tosnap, ZFS_TYPE_DATASET)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified fs "
	"(%s) does not exist"), tosnap);
	return (zfs_error(hdl, EZFS_NOENT, errbuf));
	}
	if (originsnap &&
	!zfs_dataset_exists(hdl, originsnap, ZFS_TYPE_DATASET)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "specified origin fs "
	"(%s) does not exist"), originsnap);
	return (zfs_error(hdl, EZFS_NOENT, errbuf));
	}

	/* read in the BEGIN record */
	if (0 != (err = recv_read(hdl, infd, &drr, sizeof (drr), B_FALSE,
	&zcksum)))
	return (err);

	if (drr.drr_type == DRR_END \|\| drr.drr_type == BSWAP_32(DRR_END)) {
	/* It's the double end record at the end of a package */
	return (ENODATA);
	}

	/* the kernel needs the non-byteswapped begin record */
	drr_noswap = drr;

	flags->byteswap = B_FALSE;
	if (drrb->drr_magic == BSWAP_64(DMU_BACKUP_MAGIC)) {
	/*
	* We computed the checksum in the wrong byteorder in
	* recv_read() above; do it again correctly.
	*/
	bzero(&zcksum, sizeof (zio_cksum_t));
	fletcher_4_incremental_byteswap(&drr, sizeof (drr), &zcksum);
	flags->byteswap = B_TRUE;

	drr.drr_type = BSWAP_32(drr.drr_type);
	drr.drr_payloadlen = BSWAP_32(drr.drr_payloadlen);
	drrb->drr_magic = BSWAP_64(drrb->drr_magic);
	drrb->drr_versioninfo = BSWAP_64(drrb->drr_versioninfo);
	drrb->drr_creation_time = BSWAP_64(drrb->drr_creation_time);
	drrb->drr_type = BSWAP_32(drrb->drr_type);
	drrb->drr_flags = BSWAP_32(drrb->drr_flags);
	drrb->drr_toguid = BSWAP_64(drrb->drr_toguid);
	drrb->drr_fromguid = BSWAP_64(drrb->drr_fromguid);
	}

	if (drrb->drr_magic != DMU_BACKUP_MAGIC \|\| drr.drr_type != DRR_BEGIN) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
	"stream (bad magic number)"));
	return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
	}

	featureflags = DMU_GET_FEATUREFLAGS(drrb->drr_versioninfo);
	hdrtype = DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo);

	if (!DMU_STREAM_SUPPORTED(featureflags) \|\|
	(hdrtype != DMU_SUBSTREAM && hdrtype != DMU_COMPOUNDSTREAM)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"stream has unsupported feature, feature flags = %lx"),
	featureflags);
	return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
	}

	/* Holds feature is set once in the compound stream header. */
	if (featureflags & DMU_BACKUP_FEATURE_HOLDS)
	flags->holds = B_TRUE;

	if (strchr(drrb->drr_toname, '@') == NULL) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "invalid "
	"stream (bad snapshot name)"));
	return (zfs_error(hdl, EZFS_BADSTREAM, errbuf));
	}

	if (DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) == DMU_SUBSTREAM) {
	char nonpackage_sendfs[ZFS_MAX_DATASET_NAME_LEN];
	if (sendfs == NULL) {
	/*
	* We were not called from zfs_receive_package(). Get
	* the fs specified by 'zfs send'.
	*/
	char *cp;
	(void) strlcpy(nonpackage_sendfs,
	drr.drr_u.drr_begin.drr_toname,
	sizeof (nonpackage_sendfs));
	if ((cp = strchr(nonpackage_sendfs, '@')) != NULL)
	*cp = '\0';
	sendfs = nonpackage_sendfs;
	VERIFY(finalsnap == NULL);
	}
	return (zfs_receive_one(hdl, infd, tosnap, originsnap, flags,
	&drr, &drr_noswap, sendfs, stream_nv, stream_avl, top_zfs,
	finalsnap, cmdprops));
	} else {
	assert(DMU_GET_STREAM_HDRTYPE(drrb->drr_versioninfo) ==
	DMU_COMPOUNDSTREAM);
	return (zfs_receive_package(hdl, infd, tosnap, flags, &drr,
	&zcksum, top_zfs, cmdprops));
	}
	}

	/*
	* Restores a backup of tosnap from the file descriptor specified by infd.
	* Return 0 on total success, -2 if some things couldn't be
	* destroyed/renamed/promoted, -1 if some things couldn't be received.
	* (-1 will override -2, if -1 and the resumable flag was specified the
	* transfer can be resumed if the sending side supports it).
	*/
	int
	zfs_receive(libzfs_handle_t hdl, const char tosnap, nvlist_t *props,
	recvflags_t flags, int infd, avl_tree_t stream_avl)
	{
	char *top_zfs = NULL;
	int err;
	struct stat sb;
	char *originsnap = NULL;

	/*
	* The only way fstat can fail is if we do not have a valid file
	* descriptor.
	*/
	if (fstat(infd, &sb) == -1) {
	perror("fstat");
	return (-2);
	}

	/*
	* It is not uncommon for gigabytes to be processed in zfs receive.
	* Speculatively increase the buffer size if supported by the platform.
	*/
	if (S_ISFIFO(sb.st_mode))
	libzfs_set_pipe_max(infd);

	if (props) {
	err = nvlist_lookup_string(props, "origin", &originsnap);
	if (err && err != ENOENT)
	return (err);
	}

	err = zfs_receive_impl(hdl, tosnap, originsnap, flags, infd, NULL, NULL,
	stream_avl, &top_zfs, NULL, props);

	if (err == 0 && !flags->nomount && flags->domount && top_zfs) {
	zfs_handle_t *zhp = NULL;
	prop_changelist_t *clp = NULL;

	zhp = zfs_open(hdl, top_zfs,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME);
	if (zhp == NULL) {
	err = -1;
	goto out;
	} else {
	if (zhp->zfs_type == ZFS_TYPE_VOLUME) {
	zfs_close(zhp);
	goto out;
	}

	clp = changelist_gather(zhp, ZFS_PROP_MOUNTPOINT,
	CL_GATHER_MOUNT_ALWAYS,
	flags->forceunmount ? MS_FORCE : 0);
	zfs_close(zhp);
	if (clp == NULL) {
	err = -1;
	goto out;
	}

	/* mount and share received datasets */
	err = changelist_postfix(clp);
	changelist_free(clp);
	if (err != 0)
	err = -1;
	}
	}

	out:
	if (top_zfs)
	free(top_zfs);

	return (err);
	}
	Index: vendor-sys/openzfs/dist/lib/libzfs/libzfs_util.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfs/libzfs_util.c (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzfs/libzfs_util.c (revision 365892)
	@@ -1,2102 +1,2105 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright 2020 Joyent, Inc. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
	* Copyright (c) 2017 Datto Inc.
	* Copyright (c) 2020 The FreeBSD Foundation
	*
	* Portions of this software were developed by Allan Jude
	* under sponsorship from the FreeBSD Foundation.
	*/

	/*
	* Internal utility routines for the ZFS library.
	*/

	#include <errno.h>
	#include <fcntl.h>
	#include <libintl.h>
	#include <stdarg.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <strings.h>
	#include <unistd.h>
	#include <math.h>
	#include <sys/stat.h>
	#include <sys/mnttab.h>
	#include <sys/mntent.h>
	#include <sys/types.h>
	#include <sys/wait.h>

	#include <libzfs.h>
	#include <libzfs_core.h>

	#include "libzfs_impl.h"
	#include "zfs_prop.h"
	#include "zfeature_common.h"
	#include <zfs_fletcher.h>
	#include <libzutil.h>

	/*
	* We only care about the scheme in order to match the scheme
	* with the handler. Each handler should validate the full URI
	* as necessary.
	*/
	#define URI_REGEX "^\$[A-Za-z][A-Za-z0-9+.\\-]*\$:"

	int
	libzfs_errno(libzfs_handle_t *hdl)
	{
	return (hdl->libzfs_error);
	}

	const char *
	libzfs_error_action(libzfs_handle_t *hdl)
	{
	return (hdl->libzfs_action);
	}

	const char *
	libzfs_error_description(libzfs_handle_t *hdl)
	{
	if (hdl->libzfs_desc[0] != '\0')
	return (hdl->libzfs_desc);

	switch (hdl->libzfs_error) {
	case EZFS_NOMEM:
	return (dgettext(TEXT_DOMAIN, "out of memory"));
	case EZFS_BADPROP:
	return (dgettext(TEXT_DOMAIN, "invalid property value"));
	case EZFS_PROPREADONLY:
	return (dgettext(TEXT_DOMAIN, "read-only property"));
	case EZFS_PROPTYPE:
	return (dgettext(TEXT_DOMAIN, "property doesn't apply to "
	"datasets of this type"));
	case EZFS_PROPNONINHERIT:
	return (dgettext(TEXT_DOMAIN, "property cannot be inherited"));
	case EZFS_PROPSPACE:
	return (dgettext(TEXT_DOMAIN, "invalid quota or reservation"));
	case EZFS_BADTYPE:
	return (dgettext(TEXT_DOMAIN, "operation not applicable to "
	"datasets of this type"));
	case EZFS_BUSY:
	return (dgettext(TEXT_DOMAIN, "pool or dataset is busy"));
	case EZFS_EXISTS:
	return (dgettext(TEXT_DOMAIN, "pool or dataset exists"));
	case EZFS_NOENT:
	return (dgettext(TEXT_DOMAIN, "no such pool or dataset"));
	case EZFS_BADSTREAM:
	return (dgettext(TEXT_DOMAIN, "invalid backup stream"));
	case EZFS_DSREADONLY:
	return (dgettext(TEXT_DOMAIN, "dataset is read-only"));
	case EZFS_VOLTOOBIG:
	return (dgettext(TEXT_DOMAIN, "volume size exceeds limit for "
	"this system"));
	case EZFS_INVALIDNAME:
	return (dgettext(TEXT_DOMAIN, "invalid name"));
	case EZFS_BADRESTORE:
	return (dgettext(TEXT_DOMAIN, "unable to restore to "
	"destination"));
	case EZFS_BADBACKUP:
	return (dgettext(TEXT_DOMAIN, "backup failed"));
	case EZFS_BADTARGET:
	return (dgettext(TEXT_DOMAIN, "invalid target vdev"));
	case EZFS_NODEVICE:
	return (dgettext(TEXT_DOMAIN, "no such device in pool"));
	case EZFS_BADDEV:
	return (dgettext(TEXT_DOMAIN, "invalid device"));
	case EZFS_NOREPLICAS:
	return (dgettext(TEXT_DOMAIN, "no valid replicas"));
	case EZFS_RESILVERING:
	return (dgettext(TEXT_DOMAIN, "currently resilvering"));
	case EZFS_BADVERSION:
	return (dgettext(TEXT_DOMAIN, "unsupported version or "
	"feature"));
	case EZFS_POOLUNAVAIL:
	return (dgettext(TEXT_DOMAIN, "pool is unavailable"));
	case EZFS_DEVOVERFLOW:
	return (dgettext(TEXT_DOMAIN, "too many devices in one vdev"));
	case EZFS_BADPATH:
	return (dgettext(TEXT_DOMAIN, "must be an absolute path"));
	case EZFS_CROSSTARGET:
	return (dgettext(TEXT_DOMAIN, "operation crosses datasets or "
	"pools"));
	case EZFS_ZONED:
	return (dgettext(TEXT_DOMAIN, "dataset in use by local zone"));
	case EZFS_MOUNTFAILED:
	return (dgettext(TEXT_DOMAIN, "mount failed"));
	case EZFS_UMOUNTFAILED:
	return (dgettext(TEXT_DOMAIN, "umount failed"));
	case EZFS_UNSHARENFSFAILED:
	return (dgettext(TEXT_DOMAIN, "unshare(1M) failed"));
	case EZFS_SHARENFSFAILED:
	return (dgettext(TEXT_DOMAIN, "share(1M) failed"));
	case EZFS_UNSHARESMBFAILED:
	return (dgettext(TEXT_DOMAIN, "smb remove share failed"));
	case EZFS_SHARESMBFAILED:
	return (dgettext(TEXT_DOMAIN, "smb add share failed"));
	case EZFS_PERM:
	return (dgettext(TEXT_DOMAIN, "permission denied"));
	case EZFS_NOSPC:
	return (dgettext(TEXT_DOMAIN, "out of space"));
	case EZFS_FAULT:
	return (dgettext(TEXT_DOMAIN, "bad address"));
	case EZFS_IO:
	return (dgettext(TEXT_DOMAIN, "I/O error"));
	case EZFS_INTR:
	return (dgettext(TEXT_DOMAIN, "signal received"));
	case EZFS_ISSPARE:
	return (dgettext(TEXT_DOMAIN, "device is reserved as a hot "
	"spare"));
	case EZFS_INVALCONFIG:
	return (dgettext(TEXT_DOMAIN, "invalid vdev configuration"));
	case EZFS_RECURSIVE:
	return (dgettext(TEXT_DOMAIN, "recursive dataset dependency"));
	case EZFS_NOHISTORY:
	return (dgettext(TEXT_DOMAIN, "no history available"));
	case EZFS_POOLPROPS:
	return (dgettext(TEXT_DOMAIN, "failed to retrieve "
	"pool properties"));
	case EZFS_POOL_NOTSUP:
	return (dgettext(TEXT_DOMAIN, "operation not supported "
	"on this type of pool"));
	case EZFS_POOL_INVALARG:
	return (dgettext(TEXT_DOMAIN, "invalid argument for "
	"this pool operation"));
	case EZFS_NAMETOOLONG:
	return (dgettext(TEXT_DOMAIN, "dataset name is too long"));
	case EZFS_OPENFAILED:
	return (dgettext(TEXT_DOMAIN, "open failed"));
	case EZFS_NOCAP:
	return (dgettext(TEXT_DOMAIN,
	"disk capacity information could not be retrieved"));
	case EZFS_LABELFAILED:
	return (dgettext(TEXT_DOMAIN, "write of label failed"));
	case EZFS_BADWHO:
	return (dgettext(TEXT_DOMAIN, "invalid user/group"));
	case EZFS_BADPERM:
	return (dgettext(TEXT_DOMAIN, "invalid permission"));
	case EZFS_BADPERMSET:
	return (dgettext(TEXT_DOMAIN, "invalid permission set name"));
	case EZFS_NODELEGATION:
	return (dgettext(TEXT_DOMAIN, "delegated administration is "
	"disabled on pool"));
	case EZFS_BADCACHE:
	return (dgettext(TEXT_DOMAIN, "invalid or missing cache file"));
	case EZFS_ISL2CACHE:
	return (dgettext(TEXT_DOMAIN, "device is in use as a cache"));
	case EZFS_VDEVNOTSUP:
	return (dgettext(TEXT_DOMAIN, "vdev specification is not "
	"supported"));
	case EZFS_NOTSUP:
	return (dgettext(TEXT_DOMAIN, "operation not supported "
	"on this dataset"));
	case EZFS_IOC_NOTSUPPORTED:
	return (dgettext(TEXT_DOMAIN, "operation not supported by "
	"zfs kernel module"));
	case EZFS_ACTIVE_SPARE:
	return (dgettext(TEXT_DOMAIN, "pool has active shared spare "
	"device"));
	case EZFS_UNPLAYED_LOGS:
	return (dgettext(TEXT_DOMAIN, "log device has unplayed intent "
	"logs"));
	case EZFS_REFTAG_RELE:
	return (dgettext(TEXT_DOMAIN, "no such tag on this dataset"));
	case EZFS_REFTAG_HOLD:
	return (dgettext(TEXT_DOMAIN, "tag already exists on this "
	"dataset"));
	case EZFS_TAGTOOLONG:
	return (dgettext(TEXT_DOMAIN, "tag too long"));
	case EZFS_PIPEFAILED:
	return (dgettext(TEXT_DOMAIN, "pipe create failed"));
	case EZFS_THREADCREATEFAILED:
	return (dgettext(TEXT_DOMAIN, "thread create failed"));
	case EZFS_POSTSPLIT_ONLINE:
	return (dgettext(TEXT_DOMAIN, "disk was split from this pool "
	"into a new one"));
	case EZFS_SCRUB_PAUSED:
	return (dgettext(TEXT_DOMAIN, "scrub is paused; "
	"use 'zpool scrub' to resume"));
	case EZFS_SCRUBBING:
	return (dgettext(TEXT_DOMAIN, "currently scrubbing; "
	"use 'zpool scrub -s' to cancel current scrub"));
	case EZFS_NO_SCRUB:
	return (dgettext(TEXT_DOMAIN, "there is no active scrub"));
	case EZFS_DIFF:
	return (dgettext(TEXT_DOMAIN, "unable to generate diffs"));
	case EZFS_DIFFDATA:
	return (dgettext(TEXT_DOMAIN, "invalid diff data"));
	case EZFS_POOLREADONLY:
	return (dgettext(TEXT_DOMAIN, "pool is read-only"));
	case EZFS_NO_PENDING:
	return (dgettext(TEXT_DOMAIN, "operation is not "
	"in progress"));
	case EZFS_CHECKPOINT_EXISTS:
	return (dgettext(TEXT_DOMAIN, "checkpoint exists"));
	case EZFS_DISCARDING_CHECKPOINT:
	return (dgettext(TEXT_DOMAIN, "currently discarding "
	"checkpoint"));
	case EZFS_NO_CHECKPOINT:
	return (dgettext(TEXT_DOMAIN, "checkpoint does not exist"));
	case EZFS_DEVRM_IN_PROGRESS:
	return (dgettext(TEXT_DOMAIN, "device removal in progress"));
	case EZFS_VDEV_TOO_BIG:
	return (dgettext(TEXT_DOMAIN, "device exceeds supported size"));
	case EZFS_ACTIVE_POOL:
	return (dgettext(TEXT_DOMAIN, "pool is imported on a "
	"different host"));
	case EZFS_CRYPTOFAILED:
	return (dgettext(TEXT_DOMAIN, "encryption failure"));
	case EZFS_TOOMANY:
	return (dgettext(TEXT_DOMAIN, "argument list too long"));
	case EZFS_INITIALIZING:
	return (dgettext(TEXT_DOMAIN, "currently initializing"));
	case EZFS_NO_INITIALIZE:
	return (dgettext(TEXT_DOMAIN, "there is no active "
	"initialization"));
	case EZFS_WRONG_PARENT:
	return (dgettext(TEXT_DOMAIN, "invalid parent dataset"));
	case EZFS_TRIMMING:
	return (dgettext(TEXT_DOMAIN, "currently trimming"));
	case EZFS_NO_TRIM:
	return (dgettext(TEXT_DOMAIN, "there is no active trim"));
	case EZFS_TRIM_NOTSUP:
	return (dgettext(TEXT_DOMAIN, "trim operations are not "
	"supported by this device"));
	case EZFS_NO_RESILVER_DEFER:
	return (dgettext(TEXT_DOMAIN, "this action requires the "
	"resilver_defer feature"));
	case EZFS_EXPORT_IN_PROGRESS:
	return (dgettext(TEXT_DOMAIN, "pool export in progress"));
	case EZFS_REBUILDING:
	return (dgettext(TEXT_DOMAIN, "currently sequentially "
	"resilvering"));
	case EZFS_UNKNOWN:
	return (dgettext(TEXT_DOMAIN, "unknown error"));
	default:
	assert(hdl->libzfs_error == 0);
	return (dgettext(TEXT_DOMAIN, "no error"));
	}
	}

	/PRINTFLIKE2/
	void
	zfs_error_aux(libzfs_handle_t hdl, const char fmt, ...)
	{
	va_list ap;

	va_start(ap, fmt);

	(void) vsnprintf(hdl->libzfs_desc, sizeof (hdl->libzfs_desc),
	fmt, ap);
	hdl->libzfs_desc_active = 1;

	va_end(ap);
	}

	static void
	zfs_verror(libzfs_handle_t hdl, int error, const char fmt, va_list ap)
	{
	(void) vsnprintf(hdl->libzfs_action, sizeof (hdl->libzfs_action),
	fmt, ap);
	hdl->libzfs_error = error;

	if (hdl->libzfs_desc_active)
	hdl->libzfs_desc_active = 0;
	else
	hdl->libzfs_desc[0] = '\0';

	if (hdl->libzfs_printerr) {
	if (error == EZFS_UNKNOWN) {
	(void) fprintf(stderr, dgettext(TEXT_DOMAIN, "internal "
	"error: %s: %s\n"), hdl->libzfs_action,
	libzfs_error_description(hdl));
	abort();
	}

	(void) fprintf(stderr, "%s: %s\n", hdl->libzfs_action,
	libzfs_error_description(hdl));
	if (error == EZFS_NOMEM)
	exit(1);
	}
	}

	int
	zfs_error(libzfs_handle_t hdl, int error, const char msg)
	{
	return (zfs_error_fmt(hdl, error, "%s", msg));
	}

	/PRINTFLIKE3/
	int
	zfs_error_fmt(libzfs_handle_t hdl, int error, const char fmt, ...)
	{
	va_list ap;

	va_start(ap, fmt);

	zfs_verror(hdl, error, fmt, ap);

	va_end(ap);

	return (-1);
	}

	static int
	zfs_common_error(libzfs_handle_t hdl, int error, const char fmt,
	va_list ap)
	{
	switch (error) {
	case EPERM:
	case EACCES:
	zfs_verror(hdl, EZFS_PERM, fmt, ap);
	return (-1);

	case ECANCELED:
	zfs_verror(hdl, EZFS_NODELEGATION, fmt, ap);
	return (-1);

	case EIO:
	zfs_verror(hdl, EZFS_IO, fmt, ap);
	return (-1);

	case EFAULT:
	zfs_verror(hdl, EZFS_FAULT, fmt, ap);
	return (-1);

	case EINTR:
	zfs_verror(hdl, EZFS_INTR, fmt, ap);
	return (-1);
	}

	return (0);
	}

	int
	zfs_standard_error(libzfs_handle_t hdl, int error, const char msg)
	{
	return (zfs_standard_error_fmt(hdl, error, "%s", msg));
	}

	/PRINTFLIKE3/
	int
	zfs_standard_error_fmt(libzfs_handle_t hdl, int error, const char fmt, ...)
	{
	va_list ap;

	va_start(ap, fmt);

	if (zfs_common_error(hdl, error, fmt, ap) != 0) {
	va_end(ap);
	return (-1);
	}

	switch (error) {
	case ENXIO:
	case ENODEV:
	case EPIPE:
	zfs_verror(hdl, EZFS_IO, fmt, ap);
	break;

	case ENOENT:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset does not exist"));
	zfs_verror(hdl, EZFS_NOENT, fmt, ap);
	break;

	case ENOSPC:
	case EDQUOT:
	zfs_verror(hdl, EZFS_NOSPC, fmt, ap);
	break;

	case EEXIST:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset already exists"));
	zfs_verror(hdl, EZFS_EXISTS, fmt, ap);
	break;

	case EBUSY:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"dataset is busy"));
	zfs_verror(hdl, EZFS_BUSY, fmt, ap);
	break;
	case EROFS:
	zfs_verror(hdl, EZFS_POOLREADONLY, fmt, ap);
	break;
	case ENAMETOOLONG:
	zfs_verror(hdl, EZFS_NAMETOOLONG, fmt, ap);
	break;
	case ENOTSUP:
	zfs_verror(hdl, EZFS_BADVERSION, fmt, ap);
	break;
	case EAGAIN:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool I/O is currently suspended"));
	zfs_verror(hdl, EZFS_POOLUNAVAIL, fmt, ap);
	break;
	case EREMOTEIO:
	zfs_verror(hdl, EZFS_ACTIVE_POOL, fmt, ap);
	break;
	case ZFS_ERR_UNKNOWN_SEND_STREAM_FEATURE:
	case ZFS_ERR_IOC_CMD_UNAVAIL:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "the loaded zfs "
	"module does not support this operation. A reboot may "
	"be required to enable this operation."));
	zfs_verror(hdl, EZFS_IOC_NOTSUPPORTED, fmt, ap);
	break;
	case ZFS_ERR_IOC_ARG_UNAVAIL:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "the loaded zfs "
	"module does not support an option for this operation. "
	"A reboot may be required to enable this option."));
	zfs_verror(hdl, EZFS_IOC_NOTSUPPORTED, fmt, ap);
	break;
	case ZFS_ERR_IOC_ARG_REQUIRED:
	case ZFS_ERR_IOC_ARG_BADTYPE:
	zfs_verror(hdl, EZFS_IOC_NOTSUPPORTED, fmt, ap);
	break;
	case ZFS_ERR_WRONG_PARENT:
	zfs_verror(hdl, EZFS_WRONG_PARENT, fmt, ap);
	break;
	case ZFS_ERR_BADPROP:
	zfs_verror(hdl, EZFS_BADPROP, fmt, ap);
	break;
	default:
	zfs_error_aux(hdl, strerror(error));
	zfs_verror(hdl, EZFS_UNKNOWN, fmt, ap);
	break;
	}

	va_end(ap);
	return (-1);
	}

	void
	zfs_setprop_error(libzfs_handle_t *hdl, zfs_prop_t prop, int err,
	char *errbuf)
	{
	switch (err) {

	case ENOSPC:
	/*
	* For quotas and reservations, ENOSPC indicates
	* something different; setting a quota or reservation
	* doesn't use any disk space.
	*/
	switch (prop) {
	case ZFS_PROP_QUOTA:
	case ZFS_PROP_REFQUOTA:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"size is less than current used or "
	"reserved space"));
	(void) zfs_error(hdl, EZFS_PROPSPACE, errbuf);
	break;

	case ZFS_PROP_RESERVATION:
	case ZFS_PROP_REFRESERVATION:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"size is greater than available space"));
	(void) zfs_error(hdl, EZFS_PROPSPACE, errbuf);
	break;

	default:
	(void) zfs_standard_error(hdl, err, errbuf);
	break;
	}
	break;

	case EBUSY:
	(void) zfs_standard_error(hdl, EBUSY, errbuf);
	break;

	case EROFS:
	(void) zfs_error(hdl, EZFS_DSREADONLY, errbuf);
	break;

	case E2BIG:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property value too long"));
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	break;

	case ENOTSUP:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool and or dataset must be upgraded to set this "
	"property or value"));
	(void) zfs_error(hdl, EZFS_BADVERSION, errbuf);
	break;

	case ERANGE:
	if (prop == ZFS_PROP_COMPRESSION \|\|
	prop == ZFS_PROP_DNODESIZE \|\|
	prop == ZFS_PROP_RECORDSIZE) {
	(void) zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property setting is not allowed on "
	"bootable datasets"));
	(void) zfs_error(hdl, EZFS_NOTSUP, errbuf);
	} else if (prop == ZFS_PROP_CHECKSUM \|\|
	prop == ZFS_PROP_DEDUP) {
	(void) zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"property setting is not allowed on "
	"root pools"));
	(void) zfs_error(hdl, EZFS_NOTSUP, errbuf);
	} else {
	(void) zfs_standard_error(hdl, err, errbuf);
	}
	break;

	case EINVAL:
	if (prop == ZPROP_INVAL) {
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	} else {
	(void) zfs_standard_error(hdl, err, errbuf);
	}
	break;

	case ZFS_ERR_BADPROP:
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	break;

	case EACCES:
	if (prop == ZFS_PROP_KEYLOCATION) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"keylocation may only be set on encryption roots"));
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	} else {
	(void) zfs_standard_error(hdl, err, errbuf);
	}
	break;

	case EOVERFLOW:
	/*
	* This platform can't address a volume this big.
	*/
	#ifdef _ILP32
	if (prop == ZFS_PROP_VOLSIZE) {
	(void) zfs_error(hdl, EZFS_VOLTOOBIG, errbuf);
	break;
	}
	#endif
	/* FALLTHROUGH */
	default:
	(void) zfs_standard_error(hdl, err, errbuf);
	}
	}

	int
	zpool_standard_error(libzfs_handle_t hdl, int error, const char msg)
	{
	return (zpool_standard_error_fmt(hdl, error, "%s", msg));
	}

	/PRINTFLIKE3/
	int
	zpool_standard_error_fmt(libzfs_handle_t hdl, int error, const char fmt, ...)
	{
	va_list ap;

	va_start(ap, fmt);

	if (zfs_common_error(hdl, error, fmt, ap) != 0) {
	va_end(ap);
	return (-1);
	}

	switch (error) {
	case ENODEV:
	zfs_verror(hdl, EZFS_NODEVICE, fmt, ap);
	break;

	case ENOENT:
	zfs_error_aux(hdl,
	dgettext(TEXT_DOMAIN, "no such pool or dataset"));
	zfs_verror(hdl, EZFS_NOENT, fmt, ap);
	break;

	case EEXIST:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool already exists"));
	zfs_verror(hdl, EZFS_EXISTS, fmt, ap);
	break;

	case EBUSY:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "pool is busy"));
	zfs_verror(hdl, EZFS_BUSY, fmt, ap);
	break;

	/* There is no pending operation to cancel */
	case ENOTACTIVE:
	zfs_verror(hdl, EZFS_NO_PENDING, fmt, ap);
	break;

	case ENXIO:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"one or more devices is currently unavailable"));
	zfs_verror(hdl, EZFS_BADDEV, fmt, ap);
	break;

	case ENAMETOOLONG:
	zfs_verror(hdl, EZFS_DEVOVERFLOW, fmt, ap);
	break;

	case ENOTSUP:
	zfs_verror(hdl, EZFS_POOL_NOTSUP, fmt, ap);
	break;

	case EINVAL:
	zfs_verror(hdl, EZFS_POOL_INVALARG, fmt, ap);
	break;

	case ENOSPC:
	case EDQUOT:
	zfs_verror(hdl, EZFS_NOSPC, fmt, ap);
	return (-1);

	case EAGAIN:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"pool I/O is currently suspended"));
	zfs_verror(hdl, EZFS_POOLUNAVAIL, fmt, ap);
	break;

	case EROFS:
	zfs_verror(hdl, EZFS_POOLREADONLY, fmt, ap);
	break;
	case EDOM:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"block size out of range or does not match"));
	zfs_verror(hdl, EZFS_BADPROP, fmt, ap);
	break;
	case EREMOTEIO:
	zfs_verror(hdl, EZFS_ACTIVE_POOL, fmt, ap);
	break;
	case ZFS_ERR_CHECKPOINT_EXISTS:
	zfs_verror(hdl, EZFS_CHECKPOINT_EXISTS, fmt, ap);
	break;
	case ZFS_ERR_DISCARDING_CHECKPOINT:
	zfs_verror(hdl, EZFS_DISCARDING_CHECKPOINT, fmt, ap);
	break;
	case ZFS_ERR_NO_CHECKPOINT:
	zfs_verror(hdl, EZFS_NO_CHECKPOINT, fmt, ap);
	break;
	case ZFS_ERR_DEVRM_IN_PROGRESS:
	zfs_verror(hdl, EZFS_DEVRM_IN_PROGRESS, fmt, ap);
	break;
	case ZFS_ERR_VDEV_TOO_BIG:
	zfs_verror(hdl, EZFS_VDEV_TOO_BIG, fmt, ap);
	break;
	case ZFS_ERR_EXPORT_IN_PROGRESS:
	zfs_verror(hdl, EZFS_EXPORT_IN_PROGRESS, fmt, ap);
	break;
	case ZFS_ERR_RESILVER_IN_PROGRESS:
	zfs_verror(hdl, EZFS_RESILVERING, fmt, ap);
	break;
	case ZFS_ERR_REBUILD_IN_PROGRESS:
	zfs_verror(hdl, EZFS_REBUILDING, fmt, ap);
	break;
	case ZFS_ERR_BADPROP:
	zfs_verror(hdl, EZFS_BADPROP, fmt, ap);
	break;
	case ZFS_ERR_IOC_CMD_UNAVAIL:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "the loaded zfs "
	"module does not support this operation. A reboot may "
	"be required to enable this operation."));
	zfs_verror(hdl, EZFS_IOC_NOTSUPPORTED, fmt, ap);
	break;
	case ZFS_ERR_IOC_ARG_UNAVAIL:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "the loaded zfs "
	"module does not support an option for this operation. "
	"A reboot may be required to enable this option."));
	zfs_verror(hdl, EZFS_IOC_NOTSUPPORTED, fmt, ap);
	break;
	case ZFS_ERR_IOC_ARG_REQUIRED:
	case ZFS_ERR_IOC_ARG_BADTYPE:
	zfs_verror(hdl, EZFS_IOC_NOTSUPPORTED, fmt, ap);
	break;
	default:
	zfs_error_aux(hdl, strerror(error));
	zfs_verror(hdl, EZFS_UNKNOWN, fmt, ap);
	}

	va_end(ap);
	return (-1);
	}

	/*
	* Display an out of memory error message and abort the current program.
	*/
	int
	no_memory(libzfs_handle_t *hdl)
	{
	return (zfs_error(hdl, EZFS_NOMEM, "internal error"));
	}

	/*
	* A safe form of malloc() which will die if the allocation fails.
	*/
	void *
	zfs_alloc(libzfs_handle_t *hdl, size_t size)
	{
	void *data;

	if ((data = calloc(1, size)) == NULL)
	(void) no_memory(hdl);

	return (data);
	}

	/*
	* A safe form of asprintf() which will die if the allocation fails.
	*/
	/PRINTFLIKE2/
	char *
	zfs_asprintf(libzfs_handle_t hdl, const char fmt, ...)
	{
	va_list ap;
	char *ret;
	int err;

	va_start(ap, fmt);

	err = vasprintf(&ret, fmt, ap);

	va_end(ap);

	if (err < 0)
	(void) no_memory(hdl);

	return (ret);
	}

	/*
	* A safe form of realloc(), which also zeroes newly allocated space.
	*/
	void *
	zfs_realloc(libzfs_handle_t hdl, void ptr, size_t oldsize, size_t newsize)
	{
	void *ret;

	if ((ret = realloc(ptr, newsize)) == NULL) {
	(void) no_memory(hdl);
	return (NULL);
	}

	bzero((char *)ret + oldsize, (newsize - oldsize));
	return (ret);
	}

	/*
	* A safe form of strdup() which will die if the allocation fails.
	*/
	char *
	zfs_strdup(libzfs_handle_t hdl, const char str)
	{
	char *ret;

	if ((ret = strdup(str)) == NULL)
	(void) no_memory(hdl);

	return (ret);
	}

	void
	libzfs_print_on_error(libzfs_handle_t *hdl, boolean_t printerr)
	{
	hdl->libzfs_printerr = printerr;
	}

	/*
	* Read lines from an open file descriptor and store them in an array of
	* strings until EOF. lines[] will be allocated and populated with all the
	* lines read. All newlines are replaced with NULL terminators for
	* convenience. lines[] must be freed after use with libzfs_free_str_array().
	*
	* Returns the number of lines read.
	*/
	static int
	libzfs_read_stdout_from_fd(int fd, char **lines[])
	{

	FILE *fp;
	int lines_cnt = 0;
	size_t len = 0;
	char *line = NULL;
	char tmp_lines = NULL, tmp;
	char *nl = NULL;
	int rc;

	fp = fdopen(fd, "r");
	if (fp == NULL)
	return (0);
	while (1) {
	rc = getline(&line, &len, fp);
	if (rc == -1)
	break;

	tmp = realloc(tmp_lines, sizeof (tmp_lines) (lines_cnt + 1));
	if (tmp == NULL) {
	/* Return the lines we were able to process */
	break;
	}
	tmp_lines = tmp;

	/* Terminate newlines */
	if ((nl = strchr(line, '\n')) != NULL)
	*nl = '\0';
	tmp_lines[lines_cnt] = line;
	lines_cnt++;
	line = NULL;
	}
	fclose(fp);
	*lines = tmp_lines;
	return (lines_cnt);
	}

	static int
	libzfs_run_process_impl(const char path, char argv[], char *env[], int flags,
	char *lines[], int lines_cnt)
	{
	pid_t pid;
	int error, devnull_fd;
	int link[2];

	/*
	* Setup a pipe between our child and parent process if we're
	* reading stdout.
	*/
	if ((lines != NULL) && pipe(link) == -1)
	return (-EPIPE);

	pid = vfork();
	if (pid == 0) {
	/* Child process */
	devnull_fd = open("/dev/null", O_WRONLY);

	if (devnull_fd < 0)
	_exit(-1);

	if (!(flags & STDOUT_VERBOSE) && (lines == NULL))
	(void) dup2(devnull_fd, STDOUT_FILENO);
	else if (lines != NULL) {
	/* Save the output to lines[] */
	dup2(link[1], STDOUT_FILENO);
	close(link[0]);
	close(link[1]);
	}

	if (!(flags & STDERR_VERBOSE))
	(void) dup2(devnull_fd, STDERR_FILENO);

	close(devnull_fd);

	if (flags & NO_DEFAULT_PATH) {
	if (env == NULL)
	execv(path, argv);
	else
	execve(path, argv, env);
	} else {
	if (env == NULL)
	execvp(path, argv);
	else
	execvpe(path, argv, env);
	}

	_exit(-1);
	} else if (pid > 0) {
	/* Parent process */
	int status;

	while ((error = waitpid(pid, &status, 0)) == -1 &&
	errno == EINTR) { }
	if (error < 0 \|\| !WIFEXITED(status))
	return (-1);

	if (lines != NULL) {
	close(link[1]);
	*lines_cnt = libzfs_read_stdout_from_fd(link[0], lines);
	}
	return (WEXITSTATUS(status));
	}

	return (-1);
	}

	int
	libzfs_run_process(const char path, char argv[], int flags)
	{
	return (libzfs_run_process_impl(path, argv, NULL, flags, NULL, NULL));
	}

	/*
	* Run a command and store its stdout lines in an array of strings (lines[]).
	* lines[] is allocated and populated for you, and the number of lines is set in
	* lines_cnt. lines[] must be freed after use with libzfs_free_str_array().
	* All newlines (\n) in lines[] are terminated for convenience.
	*/
	int
	libzfs_run_process_get_stdout(const char path, char argv[], char *env[],
	char *lines[], int lines_cnt)
	{
	return (libzfs_run_process_impl(path, argv, env, 0, lines, lines_cnt));
	}

	/*
	* Same as libzfs_run_process_get_stdout(), but run without $PATH set. This
	* means that *path needs to be the full path to the executable.
	*/
	int
	libzfs_run_process_get_stdout_nopath(const char path, char argv[],
	char env[], char lines[], int lines_cnt)
	{
	return (libzfs_run_process_impl(path, argv, env, NO_DEFAULT_PATH,
	lines, lines_cnt));
	}

	/*
	* Free an array of strings. Free both the strings contained in the array and
	* the array itself.
	*/
	void
	libzfs_free_str_array(char **strs, int count)
	{
	while (--count >= 0)
	free(strs[count]);

	free(strs);
	}

	/*
	* Returns 1 if environment variable is set to "YES", "yes", "ON", "on", or
	* a non-zero number.
	*
	* Returns 0 otherwise.
	*/
	int
	libzfs_envvar_is_set(char *envvar)
	{
	char *env = getenv(envvar);
	if (env && (strtoul(env, NULL, 0) > 0 \|\|
	(!strncasecmp(env, "YES", 3) && strnlen(env, 4) == 3) \|\|
	(!strncasecmp(env, "ON", 2) && strnlen(env, 3) == 2)))
	return (1);

	return (0);
	}

	libzfs_handle_t *
	libzfs_init(void)
	{
	libzfs_handle_t *hdl;
	int error;
	char *env;

	error = libzfs_load_module();
	if (error) {
	errno = error;
	return (NULL);
	}

	if ((hdl = calloc(1, sizeof (libzfs_handle_t))) == NULL) {
	return (NULL);
	}

	if (regcomp(&hdl->libzfs_urire, URI_REGEX, 0) != 0) {
	free(hdl);
	return (NULL);
	}

	if ((hdl->libzfs_fd = open(ZFS_DEV, O_RDWR\|O_EXCL)) < 0) {
	free(hdl);
	return (NULL);
	}

	#ifdef HAVE_SETMNTENT
	if ((hdl->libzfs_mnttab = setmntent(MNTTAB, "r")) == NULL) {
	#else
	if ((hdl->libzfs_mnttab = fopen(MNTTAB, "r")) == NULL) {
	#endif
	(void) close(hdl->libzfs_fd);
	free(hdl);
	return (NULL);
	}

	if (libzfs_core_init() != 0) {
	(void) close(hdl->libzfs_fd);
	(void) fclose(hdl->libzfs_mnttab);
	free(hdl);
	return (NULL);
	}

	zfs_prop_init();
	zpool_prop_init();
	zpool_feature_init();
	libzfs_mnttab_init(hdl);
	fletcher_4_init();

	if (getenv("ZFS_PROP_DEBUG") != NULL) {
	hdl->libzfs_prop_debug = B_TRUE;
	}
	if ((env = getenv("ZFS_SENDRECV_MAX_NVLIST")) != NULL) {
	if ((error = zfs_nicestrtonum(hdl, env,
	&hdl->libzfs_max_nvlist))) {
	errno = error;
	+ (void) close(hdl->libzfs_fd);
	+ (void) fclose(hdl->libzfs_mnttab);
	+ free(hdl);
	return (NULL);
	}
	} else {
	hdl->libzfs_max_nvlist = (SPA_MAXBLOCKSIZE * 4);
	}

	/*
	* For testing, remove some settable properties and features
	*/
	if (libzfs_envvar_is_set("ZFS_SYSFS_PROP_SUPPORT_TEST")) {
	zprop_desc_t *proptbl;

	proptbl = zpool_prop_get_table();
	proptbl[ZPOOL_PROP_COMMENT].pd_zfs_mod_supported = B_FALSE;

	proptbl = zfs_prop_get_table();
	proptbl[ZFS_PROP_DNODESIZE].pd_zfs_mod_supported = B_FALSE;

	zfeature_info_t *ftbl = spa_feature_table;
	ftbl[SPA_FEATURE_LARGE_BLOCKS].fi_zfs_mod_supported = B_FALSE;
	}

	return (hdl);
	}

	void
	libzfs_fini(libzfs_handle_t *hdl)
	{
	(void) close(hdl->libzfs_fd);
	if (hdl->libzfs_mnttab)
	#ifdef HAVE_SETMNTENT
	(void) endmntent(hdl->libzfs_mnttab);
	#else
	(void) fclose(hdl->libzfs_mnttab);
	#endif
	zpool_free_handles(hdl);
	namespace_clear(hdl);
	libzfs_mnttab_fini(hdl);
	libzfs_core_fini();
	regfree(&hdl->libzfs_urire);
	fletcher_4_fini();
	free(hdl);
	}

	libzfs_handle_t *
	zpool_get_handle(zpool_handle_t *zhp)
	{
	return (zhp->zpool_hdl);
	}

	libzfs_handle_t *
	zfs_get_handle(zfs_handle_t *zhp)
	{
	return (zhp->zfs_hdl);
	}

	zpool_handle_t *
	zfs_get_pool_handle(const zfs_handle_t *zhp)
	{
	return (zhp->zpool_hdl);
	}

	/*
	* Given a name, determine whether or not it's a valid path
	* (starts with '/' or "./"). If so, walk the mnttab trying
	* to match the device number. If not, treat the path as an
	* fs/vol/snap/bkmark name.
	*/
	zfs_handle_t *
	zfs_path_to_zhandle(libzfs_handle_t hdl, const char path, zfs_type_t argtype)
	{
	struct stat64 statbuf;
	struct extmnttab entry;

	if (path[0] != '/' && strncmp(path, "./", strlen("./")) != 0) {
	/*
	* It's not a valid path, assume it's a name of type 'argtype'.
	*/
	return (zfs_open(hdl, path, argtype));
	}

	/* Reopen MNTTAB to prevent reading stale data from open file */
	if (freopen(MNTTAB, "r", hdl->libzfs_mnttab) == NULL)
	return (NULL);

	if (getextmntent(path, &entry, &statbuf) != 0)
	return (NULL);

	if (strcmp(entry.mnt_fstype, MNTTYPE_ZFS) != 0) {
	(void) fprintf(stderr, gettext("'%s': not a ZFS filesystem\n"),
	path);
	return (NULL);
	}

	return (zfs_open(hdl, entry.mnt_special, ZFS_TYPE_FILESYSTEM));
	}

	/*
	* Initialize the zc_nvlist_dst member to prepare for receiving an nvlist from
	* an ioctl().
	*/
	int
	zcmd_alloc_dst_nvlist(libzfs_handle_t hdl, zfs_cmd_t zc, size_t len)
	{
	if (len == 0)
	len = 256 * 1024;
	zc->zc_nvlist_dst_size = len;
	zc->zc_nvlist_dst =
	(uint64_t)(uintptr_t)zfs_alloc(hdl, zc->zc_nvlist_dst_size);
	if (zc->zc_nvlist_dst == 0)
	return (-1);

	return (0);
	}

	/*
	* Called when an ioctl() which returns an nvlist fails with ENOMEM. This will
	* expand the nvlist to the size specified in 'zc_nvlist_dst_size', which was
	* filled in by the kernel to indicate the actual required size.
	*/
	int
	zcmd_expand_dst_nvlist(libzfs_handle_t hdl, zfs_cmd_t zc)
	{
	free((void *)(uintptr_t)zc->zc_nvlist_dst);
	zc->zc_nvlist_dst =
	(uint64_t)(uintptr_t)zfs_alloc(hdl, zc->zc_nvlist_dst_size);
	if (zc->zc_nvlist_dst == 0)
	return (-1);

	return (0);
	}

	/*
	* Called to free the src and dst nvlists stored in the command structure.
	*/
	void
	zcmd_free_nvlists(zfs_cmd_t *zc)
	{
	free((void *)(uintptr_t)zc->zc_nvlist_conf);
	free((void *)(uintptr_t)zc->zc_nvlist_src);
	free((void *)(uintptr_t)zc->zc_nvlist_dst);
	zc->zc_nvlist_conf = 0;
	zc->zc_nvlist_src = 0;
	zc->zc_nvlist_dst = 0;
	}

	static int
	zcmd_write_nvlist_com(libzfs_handle_t hdl, uint64_t outnv, uint64_t *outlen,
	nvlist_t *nvl)
	{
	char *packed;
	size_t len;

	verify(nvlist_size(nvl, &len, NV_ENCODE_NATIVE) == 0);

	if ((packed = zfs_alloc(hdl, len)) == NULL)
	return (-1);

	verify(nvlist_pack(nvl, &packed, &len, NV_ENCODE_NATIVE, 0) == 0);

	*outnv = (uint64_t)(uintptr_t)packed;
	*outlen = len;

	return (0);
	}

	int
	zcmd_write_conf_nvlist(libzfs_handle_t hdl, zfs_cmd_t zc, nvlist_t *nvl)
	{
	return (zcmd_write_nvlist_com(hdl, &zc->zc_nvlist_conf,
	&zc->zc_nvlist_conf_size, nvl));
	}

	int
	zcmd_write_src_nvlist(libzfs_handle_t hdl, zfs_cmd_t zc, nvlist_t *nvl)
	{
	return (zcmd_write_nvlist_com(hdl, &zc->zc_nvlist_src,
	&zc->zc_nvlist_src_size, nvl));
	}

	/*
	* Unpacks an nvlist from the ZFS ioctl command structure.
	*/
	int
	zcmd_read_dst_nvlist(libzfs_handle_t hdl, zfs_cmd_t zc, nvlist_t **nvlp)
	{
	if (nvlist_unpack((void *)(uintptr_t)zc->zc_nvlist_dst,
	zc->zc_nvlist_dst_size, nvlp, 0) != 0)
	return (no_memory(hdl));

	return (0);
	}

	/*
	* ================================================================
	* API shared by zfs and zpool property management
	* ================================================================
	*/

	static void
	zprop_print_headers(zprop_get_cbdata_t *cbp, zfs_type_t type)
	{
	zprop_list_t *pl = cbp->cb_proplist;
	int i;
	char *title;
	size_t len;

	cbp->cb_first = B_FALSE;
	if (cbp->cb_scripted)
	return;

	/*
	* Start with the length of the column headers.
	*/
	cbp->cb_colwidths[GET_COL_NAME] = strlen(dgettext(TEXT_DOMAIN, "NAME"));
	cbp->cb_colwidths[GET_COL_PROPERTY] = strlen(dgettext(TEXT_DOMAIN,
	"PROPERTY"));
	cbp->cb_colwidths[GET_COL_VALUE] = strlen(dgettext(TEXT_DOMAIN,
	"VALUE"));
	cbp->cb_colwidths[GET_COL_RECVD] = strlen(dgettext(TEXT_DOMAIN,
	"RECEIVED"));
	cbp->cb_colwidths[GET_COL_SOURCE] = strlen(dgettext(TEXT_DOMAIN,
	"SOURCE"));

	/* first property is always NAME */
	assert(cbp->cb_proplist->pl_prop ==
	((type == ZFS_TYPE_POOL) ? ZPOOL_PROP_NAME : ZFS_PROP_NAME));

	/*
	* Go through and calculate the widths for each column. For the
	* 'source' column, we kludge it up by taking the worst-case scenario of
	* inheriting from the longest name. This is acceptable because in the
	* majority of cases 'SOURCE' is the last column displayed, and we don't
	* use the width anyway. Note that the 'VALUE' column can be oversized,
	* if the name of the property is much longer than any values we find.
	*/
	for (pl = cbp->cb_proplist; pl != NULL; pl = pl->pl_next) {
	/*
	* 'PROPERTY' column
	*/
	if (pl->pl_prop != ZPROP_INVAL) {
	const char *propname = (type == ZFS_TYPE_POOL) ?
	zpool_prop_to_name(pl->pl_prop) :
	zfs_prop_to_name(pl->pl_prop);

	len = strlen(propname);
	if (len > cbp->cb_colwidths[GET_COL_PROPERTY])
	cbp->cb_colwidths[GET_COL_PROPERTY] = len;
	} else {
	len = strlen(pl->pl_user_prop);
	if (len > cbp->cb_colwidths[GET_COL_PROPERTY])
	cbp->cb_colwidths[GET_COL_PROPERTY] = len;
	}

	/*
	* 'VALUE' column. The first property is always the 'name'
	* property that was tacked on either by /sbin/zfs's
	* zfs_do_get() or when calling zprop_expand_list(), so we
	* ignore its width. If the user specified the name property
	* to display, then it will be later in the list in any case.
	*/
	if (pl != cbp->cb_proplist &&
	pl->pl_width > cbp->cb_colwidths[GET_COL_VALUE])
	cbp->cb_colwidths[GET_COL_VALUE] = pl->pl_width;

	/* 'RECEIVED' column. */
	if (pl != cbp->cb_proplist &&
	pl->pl_recvd_width > cbp->cb_colwidths[GET_COL_RECVD])
	cbp->cb_colwidths[GET_COL_RECVD] = pl->pl_recvd_width;

	/*
	* 'NAME' and 'SOURCE' columns
	*/
	if (pl->pl_prop == (type == ZFS_TYPE_POOL ? ZPOOL_PROP_NAME :
	ZFS_PROP_NAME) &&
	pl->pl_width > cbp->cb_colwidths[GET_COL_NAME]) {
	cbp->cb_colwidths[GET_COL_NAME] = pl->pl_width;
	cbp->cb_colwidths[GET_COL_SOURCE] = pl->pl_width +
	strlen(dgettext(TEXT_DOMAIN, "inherited from"));
	}
	}

	/*
	* Now go through and print the headers.
	*/
	for (i = 0; i < ZFS_GET_NCOLS; i++) {
	switch (cbp->cb_columns[i]) {
	case GET_COL_NAME:
	title = dgettext(TEXT_DOMAIN, "NAME");
	break;
	case GET_COL_PROPERTY:
	title = dgettext(TEXT_DOMAIN, "PROPERTY");
	break;
	case GET_COL_VALUE:
	title = dgettext(TEXT_DOMAIN, "VALUE");
	break;
	case GET_COL_RECVD:
	title = dgettext(TEXT_DOMAIN, "RECEIVED");
	break;
	case GET_COL_SOURCE:
	title = dgettext(TEXT_DOMAIN, "SOURCE");
	break;
	default:
	title = NULL;
	}

	if (title != NULL) {
	if (i == (ZFS_GET_NCOLS - 1) \|\|
	cbp->cb_columns[i + 1] == GET_COL_NONE)
	(void) printf("%s", title);
	else
	(void) printf("%-*s ",
	cbp->cb_colwidths[cbp->cb_columns[i]],
	title);
	}
	}
	(void) printf("\n");
	}

	/*
	* Display a single line of output, according to the settings in the callback
	* structure.
	*/
	void
	zprop_print_one_property(const char name, zprop_get_cbdata_t cbp,
	const char propname, const char value, zprop_source_t sourcetype,
	const char source, const char recvd_value)
	{
	int i;
	const char *str = NULL;
	char buf[128];

	/*
	* Ignore those source types that the user has chosen to ignore.
	*/
	if ((sourcetype & cbp->cb_sources) == 0)
	return;

	if (cbp->cb_first)
	zprop_print_headers(cbp, cbp->cb_type);

	for (i = 0; i < ZFS_GET_NCOLS; i++) {
	switch (cbp->cb_columns[i]) {
	case GET_COL_NAME:
	str = name;
	break;

	case GET_COL_PROPERTY:
	str = propname;
	break;

	case GET_COL_VALUE:
	str = value;
	break;

	case GET_COL_SOURCE:
	switch (sourcetype) {
	case ZPROP_SRC_NONE:
	str = "-";
	break;

	case ZPROP_SRC_DEFAULT:
	str = "default";
	break;

	case ZPROP_SRC_LOCAL:
	str = "local";
	break;

	case ZPROP_SRC_TEMPORARY:
	str = "temporary";
	break;

	case ZPROP_SRC_INHERITED:
	(void) snprintf(buf, sizeof (buf),
	"inherited from %s", source);
	str = buf;
	break;
	case ZPROP_SRC_RECEIVED:
	str = "received";
	break;

	default:
	str = NULL;
	assert(!"unhandled zprop_source_t");
	}
	break;

	case GET_COL_RECVD:
	str = (recvd_value == NULL ? "-" : recvd_value);
	break;

	default:
	continue;
	}

	if (i == (ZFS_GET_NCOLS - 1) \|\|
	cbp->cb_columns[i + 1] == GET_COL_NONE)
	(void) printf("%s", str);
	else if (cbp->cb_scripted)
	(void) printf("%s\t", str);
	else
	(void) printf("%-*s ",
	cbp->cb_colwidths[cbp->cb_columns[i]],
	str);
	}

	(void) printf("\n");
	}

	/*
	* Given a numeric suffix, convert the value into a number of bits that the
	* resulting value must be shifted.
	*/
	static int
	str2shift(libzfs_handle_t hdl, const char buf)
	{
	const char *ends = "BKMGTPEZ";
	int i;

	if (buf[0] == '\0')
	return (0);
	for (i = 0; i < strlen(ends); i++) {
	if (toupper(buf[0]) == ends[i])
	break;
	}
	if (i == strlen(ends)) {
	if (hdl)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid numeric suffix '%s'"), buf);
	return (-1);
	}

	/*
	* Allow 'G' = 'GB' = 'GiB', case-insensitively.
	* However, 'BB' and 'BiB' are disallowed.
	*/
	if (buf[1] == '\0' \|\|
	(toupper(buf[0]) != 'B' &&
	((toupper(buf[1]) == 'B' && buf[2] == '\0') \|\|
	(toupper(buf[1]) == 'I' && toupper(buf[2]) == 'B' &&
	buf[3] == '\0'))))
	return (10 * i);

	if (hdl)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid numeric suffix '%s'"), buf);
	return (-1);
	}

	/*
	* Convert a string of the form '100G' into a real number. Used when setting
	* properties or creating a volume. 'buf' is used to place an extended error
	* message for the caller to use.
	*/
	int
	zfs_nicestrtonum(libzfs_handle_t hdl, const char value, uint64_t *num)
	{
	char *end;
	int shift;

	*num = 0;

	/* Check to see if this looks like a number. */
	if ((value[0] < '0' \|\| value[0] > '9') && value[0] != '.') {
	if (hdl)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"bad numeric value '%s'"), value);
	return (-1);
	}

	/* Rely on strtoull() to process the numeric portion. */
	errno = 0;
	*num = strtoull(value, &end, 10);

	/*
	* Check for ERANGE, which indicates that the value is too large to fit
	* in a 64-bit value.
	*/
	if (errno == ERANGE) {
	if (hdl)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"numeric value is too large"));
	return (-1);
	}

	/*
	* If we have a decimal value, then do the computation with floating
	* point arithmetic. Otherwise, use standard arithmetic.
	*/
	if (*end == '.') {
	double fval = strtod(value, &end);

	if ((shift = str2shift(hdl, end)) == -1)
	return (-1);

	fval *= pow(2, shift);

	/*
	* UINT64_MAX is not exactly representable as a double.
	* The closest representation is UINT64_MAX + 1, so we
	* use a >= comparison instead of > for the bounds check.
	*/
	if (fval >= (double)UINT64_MAX) {
	if (hdl)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"numeric value is too large"));
	return (-1);
	}

	*num = (uint64_t)fval;
	} else {
	if ((shift = str2shift(hdl, end)) == -1)
	return (-1);

	/* Check for overflow */
	if (shift >= 64 \|\| (num << shift) >> shift != num) {
	if (hdl)
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"numeric value is too large"));
	return (-1);
	}

	*num <<= shift;
	}

	return (0);
	}

	/*
	* Given a propname=value nvpair to set, parse any numeric properties
	* (index, boolean, etc) if they are specified as strings and add the
	* resulting nvpair to the returned nvlist.
	*
	* At the DSL layer, all properties are either 64-bit numbers or strings.
	* We want the user to be able to ignore this fact and specify properties
	* as native values (numbers, for example) or as strings (to simplify
	* command line utilities). This also handles converting index types
	* (compression, checksum, etc) from strings to their on-disk index.
	*/
	int
	zprop_parse_value(libzfs_handle_t hdl, nvpair_t elem, int prop,
	zfs_type_t type, nvlist_t ret, char svalp, uint64_t ivalp,
	const char *errbuf)
	{
	data_type_t datatype = nvpair_type(elem);
	zprop_type_t proptype;
	const char *propname;
	char *value;
	boolean_t isnone = B_FALSE;
	boolean_t isauto = B_FALSE;
	int err = 0;

	if (type == ZFS_TYPE_POOL) {
	proptype = zpool_prop_get_type(prop);
	propname = zpool_prop_to_name(prop);
	} else {
	proptype = zfs_prop_get_type(prop);
	propname = zfs_prop_to_name(prop);
	}

	/*
	* Convert any properties to the internal DSL value types.
	*/
	*svalp = NULL;
	*ivalp = 0;

	switch (proptype) {
	case PROP_TYPE_STRING:
	if (datatype != DATA_TYPE_STRING) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be a string"), nvpair_name(elem));
	goto error;
	}
	err = nvpair_value_string(elem, svalp);
	if (err != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' is invalid"), nvpair_name(elem));
	goto error;
	}
	if (strlen(*svalp) >= ZFS_MAXPROPLEN) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' is too long"), nvpair_name(elem));
	goto error;
	}
	break;

	case PROP_TYPE_NUMBER:
	if (datatype == DATA_TYPE_STRING) {
	(void) nvpair_value_string(elem, &value);
	if (strcmp(value, "none") == 0) {
	isnone = B_TRUE;
	} else if (strcmp(value, "auto") == 0) {
	isauto = B_TRUE;
	} else if (zfs_nicestrtonum(hdl, value, ivalp) != 0) {
	goto error;
	}
	} else if (datatype == DATA_TYPE_UINT64) {
	(void) nvpair_value_uint64(elem, ivalp);
	} else {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be a number"), nvpair_name(elem));
	goto error;
	}

	/*
	* Quota special: force 'none' and don't allow 0.
	*/
	if ((type & ZFS_TYPE_DATASET) && *ivalp == 0 && !isnone &&
	(prop == ZFS_PROP_QUOTA \|\| prop == ZFS_PROP_REFQUOTA)) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"use 'none' to disable quota/refquota"));
	goto error;
	}

	/*
	* Special handling for "*_limit=none". In this case it's not
	* 0 but UINT64_MAX.
	*/
	if ((type & ZFS_TYPE_DATASET) && isnone &&
	(prop == ZFS_PROP_FILESYSTEM_LIMIT \|\|
	prop == ZFS_PROP_SNAPSHOT_LIMIT)) {
	*ivalp = UINT64_MAX;
	}

	/*
	* Special handling for setting 'refreservation' to 'auto'. Use
	* UINT64_MAX to tell the caller to use zfs_fix_auto_resv().
	* 'auto' is only allowed on volumes.
	*/
	if (isauto) {
	switch (prop) {
	case ZFS_PROP_REFRESERVATION:
	if ((type & ZFS_TYPE_VOLUME) == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s=auto' only allowed on "
	"volumes"), nvpair_name(elem));
	goto error;
	}
	*ivalp = UINT64_MAX;
	break;
	default:
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'auto' is invalid value for '%s'"),
	nvpair_name(elem));
	goto error;
	}
	}

	break;

	case PROP_TYPE_INDEX:
	if (datatype != DATA_TYPE_STRING) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be a string"), nvpair_name(elem));
	goto error;
	}

	(void) nvpair_value_string(elem, &value);

	if (zprop_string_to_index(prop, value, ivalp, type) != 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"'%s' must be one of '%s'"), propname,
	zprop_values(prop, type));
	goto error;
	}
	break;

	default:
	abort();
	}

	/*
	* Add the result to our return set of properties.
	*/
	if (*svalp != NULL) {
	if (nvlist_add_string(ret, propname, *svalp) != 0) {
	(void) no_memory(hdl);
	return (-1);
	}
	} else {
	if (nvlist_add_uint64(ret, propname, *ivalp) != 0) {
	(void) no_memory(hdl);
	return (-1);
	}
	}

	return (0);
	error:
	(void) zfs_error(hdl, EZFS_BADPROP, errbuf);
	return (-1);
	}

	static int
	addlist(libzfs_handle_t hdl, char propname, zprop_list_t **listp,
	zfs_type_t type)
	{
	int prop;
	zprop_list_t *entry;

	prop = zprop_name_to_prop(propname, type);

	if (prop != ZPROP_INVAL && !zprop_valid_for_type(prop, type, B_FALSE))
	prop = ZPROP_INVAL;

	/*
	* When no property table entry can be found, return failure if
	* this is a pool property or if this isn't a user-defined
	* dataset property,
	*/
	if (prop == ZPROP_INVAL && ((type == ZFS_TYPE_POOL &&
	!zpool_prop_feature(propname) &&
	!zpool_prop_unsupported(propname)) \|\|
	(type == ZFS_TYPE_DATASET && !zfs_prop_user(propname) &&
	!zfs_prop_userquota(propname) && !zfs_prop_written(propname)))) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"invalid property '%s'"), propname);
	return (zfs_error(hdl, EZFS_BADPROP,
	dgettext(TEXT_DOMAIN, "bad property list")));
	}

	if ((entry = zfs_alloc(hdl, sizeof (zprop_list_t))) == NULL)
	return (-1);

	entry->pl_prop = prop;
	if (prop == ZPROP_INVAL) {
	if ((entry->pl_user_prop = zfs_strdup(hdl, propname)) ==
	NULL) {
	free(entry);
	return (-1);
	}
	entry->pl_width = strlen(propname);
	} else {
	entry->pl_width = zprop_width(prop, &entry->pl_fixed,
	type);
	}

	*listp = entry;

	return (0);
	}

	/*
	* Given a comma-separated list of properties, construct a property list
	* containing both user-defined and native properties. This function will
	* return a NULL list if 'all' is specified, which can later be expanded
	* by zprop_expand_list().
	*/
	int
	zprop_get_list(libzfs_handle_t hdl, char props, zprop_list_t **listp,
	zfs_type_t type)
	{
	*listp = NULL;

	/*
	* If 'all' is specified, return a NULL list.
	*/
	if (strcmp(props, "all") == 0)
	return (0);

	/*
	* If no props were specified, return an error.
	*/
	if (props[0] == '\0') {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"no properties specified"));
	return (zfs_error(hdl, EZFS_BADPROP, dgettext(TEXT_DOMAIN,
	"bad property list")));
	}

	/*
	* It would be nice to use getsubopt() here, but the inclusion of column
	* aliases makes this more effort than it's worth.
	*/
	while (*props != '\0') {
	size_t len;
	char *p;
	char c;

	if ((p = strchr(props, ',')) == NULL) {
	len = strlen(props);
	p = props + len;
	} else {
	len = p - props;
	}

	/*
	* Check for empty options.
	*/
	if (len == 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN,
	"empty property name"));
	return (zfs_error(hdl, EZFS_BADPROP,
	dgettext(TEXT_DOMAIN, "bad property list")));
	}

	/*
	* Check all regular property names.
	*/
	c = props[len];
	props[len] = '\0';

	if (strcmp(props, "space") == 0) {
	static char *spaceprops[] = {
	"name", "avail", "used", "usedbysnapshots",
	"usedbydataset", "usedbyrefreservation",
	"usedbychildren", NULL
	};
	int i;

	for (i = 0; spaceprops[i]; i++) {
	if (addlist(hdl, spaceprops[i], listp, type))
	return (-1);
	listp = &(*listp)->pl_next;
	}
	} else {
	if (addlist(hdl, props, listp, type))
	return (-1);
	listp = &(*listp)->pl_next;
	}

	props = p;
	if (c == ',')
	props++;
	}

	return (0);
	}

	void
	zprop_free_list(zprop_list_t *pl)
	{
	zprop_list_t *next;

	while (pl != NULL) {
	next = pl->pl_next;
	free(pl->pl_user_prop);
	free(pl);
	pl = next;
	}
	}

	typedef struct expand_data {
	zprop_list_t **last;
	libzfs_handle_t *hdl;
	zfs_type_t type;
	} expand_data_t;

	static int
	zprop_expand_list_cb(int prop, void *cb)
	{
	zprop_list_t *entry;
	expand_data_t *edp = cb;

	if ((entry = zfs_alloc(edp->hdl, sizeof (zprop_list_t))) == NULL)
	return (ZPROP_INVAL);

	entry->pl_prop = prop;
	entry->pl_width = zprop_width(prop, &entry->pl_fixed, edp->type);
	entry->pl_all = B_TRUE;

	*(edp->last) = entry;
	edp->last = &entry->pl_next;

	return (ZPROP_CONT);
	}

	int
	zprop_expand_list(libzfs_handle_t hdl, zprop_list_t *plp, zfs_type_t type)
	{
	zprop_list_t *entry;
	zprop_list_t **last;
	expand_data_t exp;

	if (*plp == NULL) {
	/*
	* If this is the very first time we've been called for an 'all'
	* specification, expand the list to include all native
	* properties.
	*/
	last = plp;

	exp.last = last;
	exp.hdl = hdl;
	exp.type = type;

	if (zprop_iter_common(zprop_expand_list_cb, &exp, B_FALSE,
	B_FALSE, type) == ZPROP_INVAL)
	return (-1);

	/*
	* Add 'name' to the beginning of the list, which is handled
	* specially.
	*/
	if ((entry = zfs_alloc(hdl, sizeof (zprop_list_t))) == NULL)
	return (-1);

	entry->pl_prop = (type == ZFS_TYPE_POOL) ? ZPOOL_PROP_NAME :
	ZFS_PROP_NAME;
	entry->pl_width = zprop_width(entry->pl_prop,
	&entry->pl_fixed, type);
	entry->pl_all = B_TRUE;
	entry->pl_next = *plp;
	*plp = entry;
	}
	return (0);
	}

	int
	zprop_iter(zprop_func func, void *cb, boolean_t show_all, boolean_t ordered,
	zfs_type_t type)
	{
	return (zprop_iter_common(func, cb, show_all, ordered, type));
	}

	/*
	* Fill given version buffer with zfs userland version
	*/
	void
	zfs_version_userland(char *version, int len)
	{
	(void) strlcpy(version, ZFS_META_ALIAS, len);
	}

	/*
	* Prints both zfs userland and kernel versions
	* Returns 0 on success, and -1 on error (with errno set)
	*/
	int
	zfs_version_print(void)
	{
	char zver_userland[128];
	char zver_kernel[128];

	zfs_version_userland(zver_userland, sizeof (zver_userland));

	(void) printf("%s\n", zver_userland);

	if (zfs_version_kernel(zver_kernel, sizeof (zver_kernel)) == -1) {
	fprintf(stderr, "zfs_version_kernel() failed: %s\n",
	strerror(errno));
	return (-1);
	}

	(void) printf("zfs-kmod-%s\n", zver_kernel);

	return (0);
	}

	/*
	* Return 1 if the user requested ANSI color output, and our terminal supports
	* it. Return 0 for no color.
	*/
	static int
	use_color(void)
	{
	static int use_color = -1;
	char *term;

	/*
	* Optimization:
	*
	* For each zpool invocation, we do a single check to see if we should
	* be using color or not, and cache that value for the lifetime of the
	* the zpool command. That makes it cheap to call use_color() when
	* we're printing with color. We assume that the settings are not going
	* to change during the invocation of a zpool command (the user isn't
	* going to change the ZFS_COLOR value while zpool is running, for
	* example).
	*/
	if (use_color != -1) {
	/*
	* We've already figured out if we should be using color or
	* not. Return the cached value.
	*/
	return (use_color);
	}

	term = getenv("TERM");
	/*
	* The user sets the ZFS_COLOR env var set to enable zpool ANSI color
	* output. However if NO_COLOR is set (https://no-color.org/) then
	* don't use it. Also, don't use color if terminal doesn't support
	* it.
	*/
	if (libzfs_envvar_is_set("ZFS_COLOR") &&
	!libzfs_envvar_is_set("NO_COLOR") &&
	isatty(STDOUT_FILENO) && term && strcmp("dumb", term) != 0 &&
	strcmp("unknown", term) != 0) {
	/* Color supported */
	use_color = 1;
	} else {
	use_color = 0;
	}

	return (use_color);
	}

	/*
	* color_start() and color_end() are used for when you want to colorize a block
	* of text. For example:
	*
	* color_start(ANSI_RED_FG)
	* printf("hello");
	* printf("world");
	* color_end();
	*/
	void
	color_start(char *color)
	{
	if (use_color())
	printf("%s", color);
	}

	void
	color_end(void)
	{
	if (use_color())
	printf(ANSI_RESET);
	}

	/* printf() with a color. If color is NULL, then do a normal printf. */
	int
	printf_color(char color, char format, ...)
	{
	va_list aptr;
	int rc;

	if (color)
	color_start(color);

	va_start(aptr, format);
	rc = vprintf(format, aptr);
	va_end(aptr);

	if (color)
	color_end();

	return (rc);
	}
	Index: vendor-sys/openzfs/dist/lib/libzfs/os/linux/libzfs_pool_os.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfs/os/linux/libzfs_pool_os.c (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzfs/os/linux/libzfs_pool_os.c (revision 365892)
	@@ -1,345 +1,342 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright 2015 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2018 by Delphix. All rights reserved.
	* Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
	* Copyright (c) 2018 Datto Inc.
	* Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
	* Copyright (c) 2017, Intel Corporation.
	* Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>
	*/

	#include <errno.h>
	#include <libintl.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <strings.h>
	#include <unistd.h>
	#include <libgen.h>
	#include <zone.h>
	#include <sys/stat.h>
	#include <sys/efi_partition.h>
	#include <sys/systeminfo.h>
	#include <sys/vtoc.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/vdev_disk.h>
	#include <dlfcn.h>
	#include <libzutil.h>

	#include "zfs_namecheck.h"
	#include "zfs_prop.h"
	#include "libzfs_impl.h"
	#include "zfs_comutil.h"
	#include "zfeature_common.h"

	/*
	* If the device has being dynamically expanded then we need to relabel
	* the disk to use the new unallocated space.
	*/
	int
	zpool_relabel_disk(libzfs_handle_t hdl, const char path, const char *msg)
	{
	int fd, error;

	if ((fd = open(path, O_RDWR\|O_DIRECT)) < 0) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "cannot "
	"relabel '%s': unable to open device: %d"), path, errno);
	return (zfs_error(hdl, EZFS_OPENFAILED, msg));
	}

	/*
	* It's possible that we might encounter an error if the device
	* does not have any unallocated space left. If so, we simply
	* ignore that error and continue on.
	- *
	- * Also, we don't call efi_rescan() - that would just return EBUSY.
	- * The module will do it for us in vdev_disk_open().
	*/
	error = efi_use_whole_disk(fd);

	/* Flush the buffers to disk and invalidate the page cache. */
	(void) fsync(fd);
	(void) ioctl(fd, BLKFLSBUF);

	(void) close(fd);
	if (error && error != VT_ENOSPC) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "cannot "
	"relabel '%s': unable to read disk capacity"), path);
	return (zfs_error(hdl, EZFS_NOCAP, msg));
	}
	return (0);
	}

	/*
	* Read the EFI label from the config, if a label does not exist then
	* pass back the error to the caller. If the caller has passed a non-NULL
	* diskaddr argument then we set it to the starting address of the EFI
	* partition.
	*/
	static int
	read_efi_label(nvlist_t config, diskaddr_t sb)
	{
	char *path;
	int fd;
	char diskname[MAXPATHLEN];
	int err = -1;

	if (nvlist_lookup_string(config, ZPOOL_CONFIG_PATH, &path) != 0)
	return (err);

	(void) snprintf(diskname, sizeof (diskname), "%s%s", DISK_ROOT,
	strrchr(path, '/'));
	if ((fd = open(diskname, O_RDONLY\|O_DIRECT)) >= 0) {
	struct dk_gpt *vtoc;

	if ((err = efi_alloc_and_read(fd, &vtoc)) >= 0) {
	if (sb != NULL)
	*sb = vtoc->efi_parts[0].p_start;
	efi_free(vtoc);
	}
	(void) close(fd);
	}
	return (err);
	}

	/*
	* determine where a partition starts on a disk in the current
	* configuration
	*/
	static diskaddr_t
	find_start_block(nvlist_t *config)
	{
	nvlist_t **child;
	uint_t c, children;
	diskaddr_t sb = MAXOFFSET_T;
	uint64_t wholedisk;

	if (nvlist_lookup_nvlist_array(config,
	ZPOOL_CONFIG_CHILDREN, &child, &children) != 0) {
	if (nvlist_lookup_uint64(config,
	ZPOOL_CONFIG_WHOLE_DISK,
	&wholedisk) != 0 \|\| !wholedisk) {
	return (MAXOFFSET_T);
	}
	if (read_efi_label(config, &sb) < 0)
	sb = MAXOFFSET_T;
	return (sb);
	}

	for (c = 0; c < children; c++) {
	sb = find_start_block(child[c]);
	if (sb != MAXOFFSET_T) {
	return (sb);
	}
	}
	return (MAXOFFSET_T);
	}

	static int
	zpool_label_disk_check(char *path)
	{
	struct dk_gpt *vtoc;
	int fd, err;

	if ((fd = open(path, O_RDONLY\|O_DIRECT)) < 0)
	return (errno);

	if ((err = efi_alloc_and_read(fd, &vtoc)) != 0) {
	(void) close(fd);
	return (err);
	}

	if (vtoc->efi_flags & EFI_GPT_PRIMARY_CORRUPT) {
	efi_free(vtoc);
	(void) close(fd);
	return (EIDRM);
	}

	efi_free(vtoc);
	(void) close(fd);
	return (0);
	}

	/*
	* Generate a unique partition name for the ZFS member. Partitions must
	* have unique names to ensure udev will be able to create symlinks under
	* /dev/disk/by-partlabel/ for all pool members. The partition names are
	* of the form <pool>-<unique-id>.
	*/
	static void
	zpool_label_name(char *label_name, int label_size)
	{
	uint64_t id = 0;
	int fd;

	fd = open("/dev/urandom", O_RDONLY);
	if (fd >= 0) {
	if (read(fd, &id, sizeof (id)) != sizeof (id))
	id = 0;

	close(fd);
	}

	if (id == 0)
	id = (((uint64_t)rand()) << 32) \| (uint64_t)rand();

	snprintf(label_name, label_size, "zfs-%016llx", (u_longlong_t)id);
	}

	/*
	* Label an individual disk. The name provided is the short name,
	* stripped of any leading /dev path.
	*/
	int
	zpool_label_disk(libzfs_handle_t hdl, zpool_handle_t zhp, const char *name)
	{
	char path[MAXPATHLEN];
	struct dk_gpt *vtoc;
	int rval, fd;
	size_t resv = EFI_MIN_RESV_SIZE;
	uint64_t slice_size;
	diskaddr_t start_block;
	char errbuf[1024];

	/* prepare an error message just in case */
	(void) snprintf(errbuf, sizeof (errbuf),
	dgettext(TEXT_DOMAIN, "cannot label '%s'"), name);

	if (zhp) {
	nvlist_t *nvroot;

	verify(nvlist_lookup_nvlist(zhp->zpool_config,
	ZPOOL_CONFIG_VDEV_TREE, &nvroot) == 0);

	if (zhp->zpool_start_block == 0)
	start_block = find_start_block(nvroot);
	else
	start_block = zhp->zpool_start_block;
	zhp->zpool_start_block = start_block;
	} else {
	/* new pool */
	start_block = NEW_START_BLOCK;
	}

	(void) snprintf(path, sizeof (path), "%s/%s", DISK_ROOT, name);

	if ((fd = open(path, O_RDWR\|O_DIRECT\|O_EXCL)) < 0) {
	/*
	* This shouldn't happen. We've long since verified that this
	* is a valid device.
	*/
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "cannot "
	"label '%s': unable to open device: %d"), path, errno);
	return (zfs_error(hdl, EZFS_OPENFAILED, errbuf));
	}

	if (efi_alloc_and_init(fd, EFI_NUMPAR, &vtoc) != 0) {
	/*
	* The only way this can fail is if we run out of memory, or we
	* were unable to read the disk's capacity
	*/
	if (errno == ENOMEM)
	(void) no_memory(hdl);

	(void) close(fd);
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "cannot "
	"label '%s': unable to read disk capacity"), path);

	return (zfs_error(hdl, EZFS_NOCAP, errbuf));
	}

	slice_size = vtoc->efi_last_u_lba + 1;
	slice_size -= EFI_MIN_RESV_SIZE;
	if (start_block == MAXOFFSET_T)
	start_block = NEW_START_BLOCK;
	slice_size -= start_block;
	slice_size = P2ALIGN(slice_size, PARTITION_END_ALIGNMENT);

	vtoc->efi_parts[0].p_start = start_block;
	vtoc->efi_parts[0].p_size = slice_size;

	/*
	* Why we use V_USR: V_BACKUP confuses users, and is considered
	* disposable by some EFI utilities (since EFI doesn't have a backup
	* slice). V_UNASSIGNED is supposed to be used only for zero size
	* partitions, and efi_write() will fail if we use it. V_ROOT, V_BOOT,
	* etc. were all pretty specific. V_USR is as close to reality as we
	* can get, in the absence of V_OTHER.
	*/
	vtoc->efi_parts[0].p_tag = V_USR;
	zpool_label_name(vtoc->efi_parts[0].p_name, EFI_PART_NAME_LEN);

	vtoc->efi_parts[8].p_start = slice_size + start_block;
	vtoc->efi_parts[8].p_size = resv;
	vtoc->efi_parts[8].p_tag = V_RESERVED;

	rval = efi_write(fd, vtoc);

	/* Flush the buffers to disk and invalidate the page cache. */
	(void) fsync(fd);
	(void) ioctl(fd, BLKFLSBUF);

	if (rval == 0)
	rval = efi_rescan(fd);

	/*
	* Some block drivers (like pcata) may not support EFI GPT labels.
	* Print out a helpful error message directing the user to manually
	* label the disk and give a specific slice.
	*/
	if (rval != 0) {
	(void) close(fd);
	efi_free(vtoc);

	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "try using "
	"parted(8) and then provide a specific slice: %d"), rval);
	return (zfs_error(hdl, EZFS_LABELFAILED, errbuf));
	}

	(void) close(fd);
	efi_free(vtoc);

	(void) snprintf(path, sizeof (path), "%s/%s", DISK_ROOT, name);
	(void) zfs_append_partition(path, MAXPATHLEN);

	/* Wait to udev to signal use the device has settled. */
	rval = zpool_label_disk_wait(path, DISK_LABEL_WAIT);
	if (rval) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "failed to "
	"detect device partitions on '%s': %d"), path, rval);
	return (zfs_error(hdl, EZFS_LABELFAILED, errbuf));
	}

	/* We can't be to paranoid. Read the label back and verify it. */
	(void) snprintf(path, sizeof (path), "%s/%s", DISK_ROOT, name);
	rval = zpool_label_disk_check(path);
	if (rval) {
	zfs_error_aux(hdl, dgettext(TEXT_DOMAIN, "freshly written "
	"EFI label on '%s' is damaged. Ensure\nthis device "
	"is not in use, and is functioning properly: %d"),
	path, rval);
	return (zfs_error(hdl, EZFS_LABELFAILED, errbuf));
	}
	return (0);
	}
	Index: vendor-sys/openzfs/dist/lib/libzfs_core/libzfs_core.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfs_core/libzfs_core.c (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzfs_core/libzfs_core.c (revision 365892)
	@@ -1,1644 +1,1640 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2012, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2013 Steven Hartland. All rights reserved.
	* Copyright (c) 2017 Datto Inc.
	* Copyright 2017 RackTop Systems.
	* Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
	* Copyright (c) 2019, 2020 by Christian Schwarz. All rights reserved.
	*/

	/*
	* LibZFS_Core (lzc) is intended to replace most functionality in libzfs.
	* It has the following characteristics:
	*
	* - Thread Safe. libzfs_core is accessible concurrently from multiple
	* threads. This is accomplished primarily by avoiding global data
	* (e.g. caching). Since it's thread-safe, there is no reason for a
	* process to have multiple libzfs "instances". Therefore, we store
	* our few pieces of data (e.g. the file descriptor) in global
	* variables. The fd is reference-counted so that the libzfs_core
	* library can be "initialized" multiple times (e.g. by different
	* consumers within the same process).
	*
	* - Committed Interface. The libzfs_core interface will be committed,
	* therefore consumers can compile against it and be confident that
	* their code will continue to work on future releases of this code.
	* Currently, the interface is Evolving (not Committed), but we intend
	* to commit to it once it is more complete and we determine that it
	* meets the needs of all consumers.
	*
	* - Programmatic Error Handling. libzfs_core communicates errors with
	* defined error numbers, and doesn't print anything to stdout/stderr.
	*
	* - Thin Layer. libzfs_core is a thin layer, marshaling arguments
	* to/from the kernel ioctls. There is generally a 1:1 correspondence
	* between libzfs_core functions and ioctls to ZFS_DEV.
	*
	* - Clear Atomicity. Because libzfs_core functions are generally 1:1
	* with kernel ioctls, and kernel ioctls are general atomic, each
	* libzfs_core function is atomic. For example, creating multiple
	* snapshots with a single call to lzc_snapshot() is atomic -- it
	* can't fail with only some of the requested snapshots created, even
	* in the event of power loss or system crash.
	*
	* - Continued libzfs Support. Some higher-level operations (e.g.
	* support for "zfs send -R") are too complicated to fit the scope of
	* libzfs_core. This functionality will continue to live in libzfs.
	* Where appropriate, libzfs will use the underlying atomic operations
	* of libzfs_core. For example, libzfs may implement "zfs send -R \|
	* zfs receive" by using individual "send one snapshot", rename,
	* destroy, and "receive one snapshot" operations in libzfs_core.
	* /sbin/zfs and /sbin/zpool will link with both libzfs and
	* libzfs_core. Other consumers should aim to use only libzfs_core,
	* since that will be the supported, stable interface going forwards.
	*/

	#include <libzfs_core.h>
	#include <ctype.h>
	#include <unistd.h>
	#include <stdlib.h>
	#include <string.h>
	#ifdef ZFS_DEBUG
	#include <stdio.h>
	#endif
	#include <errno.h>
	#include <fcntl.h>
	#include <pthread.h>
	#include <libzutil.h>
	#include <sys/nvpair.h>
	#include <sys/param.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <sys/zfs_ioctl.h>

	static int g_fd = -1;
	static pthread_mutex_t g_lock = PTHREAD_MUTEX_INITIALIZER;
	static int g_refcount;

	#ifdef ZFS_DEBUG
	static zfs_ioc_t fail_ioc_cmd = ZFS_IOC_LAST;
	static zfs_errno_t fail_ioc_err;

	static void
	libzfs_core_debug_ioc(void)
	{
	/*
	* To test running newer user space binaries with kernel's
	* that don't yet support an ioctl or a new ioctl arg we
	* provide an override to intentionally fail an ioctl.
	*
	* USAGE:
	* The override variable, ZFS_IOC_TEST, is of the form "cmd:err"
	*
	* For example, to fail a ZFS_IOC_POOL_CHECKPOINT with a
	* ZFS_ERR_IOC_CMD_UNAVAIL, the string would be "0x5a4d:1029"
	*
	* $ sudo sh -c "ZFS_IOC_TEST=0x5a4d:1029 zpool checkpoint tank"
	* cannot checkpoint 'tank': the loaded zfs module does not support
	* this operation. A reboot may be required to enable this operation.
	*/
	if (fail_ioc_cmd == ZFS_IOC_LAST) {
	char *ioc_test = getenv("ZFS_IOC_TEST");
	unsigned int ioc_num = 0, ioc_err = 0;

	if (ioc_test != NULL &&
	sscanf(ioc_test, "%i:%i", &ioc_num, &ioc_err) == 2 &&
	ioc_num < ZFS_IOC_LAST) {
	fail_ioc_cmd = ioc_num;
	fail_ioc_err = ioc_err;
	}
	}
	}
	#endif

	int
	libzfs_core_init(void)
	{
	(void) pthread_mutex_lock(&g_lock);
	if (g_refcount == 0) {
	g_fd = open(ZFS_DEV, O_RDWR);
	if (g_fd < 0) {
	(void) pthread_mutex_unlock(&g_lock);
	return (errno);
	}
	}
	g_refcount++;

	#ifdef ZFS_DEBUG
	libzfs_core_debug_ioc();
	#endif
	(void) pthread_mutex_unlock(&g_lock);
	return (0);
	}

	void
	libzfs_core_fini(void)
	{
	(void) pthread_mutex_lock(&g_lock);
	ASSERT3S(g_refcount, >, 0);

	if (g_refcount > 0)
	g_refcount--;

	if (g_refcount == 0 && g_fd != -1) {
	(void) close(g_fd);
	g_fd = -1;
	}
	(void) pthread_mutex_unlock(&g_lock);
	}

	static int
	lzc_ioctl(zfs_ioc_t ioc, const char *name,
	nvlist_t source, nvlist_t *resultp)
	{
	zfs_cmd_t zc = {"\0"};
	int error = 0;
	char *packed = NULL;
	size_t size = 0;

	ASSERT3S(g_refcount, >, 0);
	VERIFY3S(g_fd, !=, -1);

	#ifdef ZFS_DEBUG
	if (ioc == fail_ioc_cmd)
	return (fail_ioc_err);
	#endif

	if (name != NULL)
	(void) strlcpy(zc.zc_name, name, sizeof (zc.zc_name));

	if (source != NULL) {
	packed = fnvlist_pack(source, &size);
	zc.zc_nvlist_src = (uint64_t)(uintptr_t)packed;
	zc.zc_nvlist_src_size = size;
	}

	if (resultp != NULL) {
	*resultp = NULL;
	if (ioc == ZFS_IOC_CHANNEL_PROGRAM) {
	zc.zc_nvlist_dst_size = fnvlist_lookup_uint64(source,
	ZCP_ARG_MEMLIMIT);
	} else {
	zc.zc_nvlist_dst_size = MAX(size * 2, 128 * 1024);
	}
	zc.zc_nvlist_dst = (uint64_t)(uintptr_t)
	malloc(zc.zc_nvlist_dst_size);
	if (zc.zc_nvlist_dst == (uint64_t)0) {
	error = ENOMEM;
	goto out;
	}
	}

	while (zfs_ioctl_fd(g_fd, ioc, &zc) != 0) {
	/*
	* If ioctl exited with ENOMEM, we retry the ioctl after
	* increasing the size of the destination nvlist.
	*
	* Channel programs that exit with ENOMEM ran over the
	* lua memory sandbox; they should not be retried.
	*/
	if (errno == ENOMEM && resultp != NULL &&
	ioc != ZFS_IOC_CHANNEL_PROGRAM) {
	free((void *)(uintptr_t)zc.zc_nvlist_dst);
	zc.zc_nvlist_dst_size *= 2;
	zc.zc_nvlist_dst = (uint64_t)(uintptr_t)
	malloc(zc.zc_nvlist_dst_size);
	if (zc.zc_nvlist_dst == (uint64_t)0) {
	error = ENOMEM;
	goto out;
	}
	} else {
	error = errno;
	break;
	}
	}
	if (zc.zc_nvlist_dst_filled) {
	resultp = fnvlist_unpack((void )(uintptr_t)zc.zc_nvlist_dst,
	zc.zc_nvlist_dst_size);
	}

	out:
	if (packed != NULL)
	fnvlist_pack_free(packed, size);
	free((void *)(uintptr_t)zc.zc_nvlist_dst);
	return (error);
	}

	int
	lzc_create(const char fsname, enum lzc_dataset_type type, nvlist_t props,
	uint8_t *wkeydata, uint_t wkeylen)
	{
	int error;
	nvlist_t *hidden_args = NULL;
	nvlist_t *args = fnvlist_alloc();

	fnvlist_add_int32(args, "type", (dmu_objset_type_t)type);
	if (props != NULL)
	fnvlist_add_nvlist(args, "props", props);

	if (wkeydata != NULL) {
	hidden_args = fnvlist_alloc();
	fnvlist_add_uint8_array(hidden_args, "wkeydata", wkeydata,
	wkeylen);
	fnvlist_add_nvlist(args, ZPOOL_HIDDEN_ARGS, hidden_args);
	}

	error = lzc_ioctl(ZFS_IOC_CREATE, fsname, args, NULL);
	nvlist_free(hidden_args);
	nvlist_free(args);
	return (error);
	}

	int
	lzc_clone(const char fsname, const char origin, nvlist_t *props)
	{
	int error;
	nvlist_t *hidden_args = NULL;
	nvlist_t *args = fnvlist_alloc();

	fnvlist_add_string(args, "origin", origin);
	if (props != NULL)
	fnvlist_add_nvlist(args, "props", props);
	error = lzc_ioctl(ZFS_IOC_CLONE, fsname, args, NULL);
	nvlist_free(hidden_args);
	nvlist_free(args);
	return (error);
	}

	int
	lzc_promote(const char fsname, char snapnamebuf, int snapnamelen)
	{
	/*
	* The promote ioctl is still legacy, so we need to construct our
	* own zfs_cmd_t rather than using lzc_ioctl().
	*/
	zfs_cmd_t zc = {"\0"};

	ASSERT3S(g_refcount, >, 0);
	VERIFY3S(g_fd, !=, -1);

	(void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
	if (zfs_ioctl_fd(g_fd, ZFS_IOC_PROMOTE, &zc) != 0) {
	int error = errno;
	if (error == EEXIST && snapnamebuf != NULL)
	(void) strlcpy(snapnamebuf, zc.zc_string, snapnamelen);
	return (error);
	}
	return (0);
	}

	int
	lzc_rename(const char source, const char target)
	{
	zfs_cmd_t zc = {"\0"};
	int error;

	ASSERT3S(g_refcount, >, 0);
	VERIFY3S(g_fd, !=, -1);
	(void) strlcpy(zc.zc_name, source, sizeof (zc.zc_name));
	(void) strlcpy(zc.zc_value, target, sizeof (zc.zc_value));
	error = zfs_ioctl_fd(g_fd, ZFS_IOC_RENAME, &zc);
	if (error != 0)
	error = errno;
	return (error);
	}
	int
	lzc_destroy(const char *fsname)
	{
	int error;
	nvlist_t *args = fnvlist_alloc();
	error = lzc_ioctl(ZFS_IOC_DESTROY, fsname, args, NULL);
	nvlist_free(args);
	return (error);
	}

	/*
	* Creates snapshots.
	*
	* The keys in the snaps nvlist are the snapshots to be created.
	* They must all be in the same pool.
	*
	* The props nvlist is properties to set. Currently only user properties
	* are supported. { user:prop_name -> string value }
	*
	* The returned results nvlist will have an entry for each snapshot that failed.
	* The value will be the (int32) error code.
	*
	* The return value will be 0 if all snapshots were created, otherwise it will
	* be the errno of a (unspecified) snapshot that failed.
	*/
	int
	lzc_snapshot(nvlist_t snaps, nvlist_t props, nvlist_t **errlist)
	{
	nvpair_t *elem;
	nvlist_t *args;
	int error;
	char pool[ZFS_MAX_DATASET_NAME_LEN];

	*errlist = NULL;

	/* determine the pool name */
	elem = nvlist_next_nvpair(snaps, NULL);
	if (elem == NULL)
	return (0);
	(void) strlcpy(pool, nvpair_name(elem), sizeof (pool));
	pool[strcspn(pool, "/@")] = '\0';

	args = fnvlist_alloc();
	fnvlist_add_nvlist(args, "snaps", snaps);
	if (props != NULL)
	fnvlist_add_nvlist(args, "props", props);

	error = lzc_ioctl(ZFS_IOC_SNAPSHOT, pool, args, errlist);
	nvlist_free(args);

	return (error);
	}

	/*
	* Destroys snapshots.
	*
	* The keys in the snaps nvlist are the snapshots to be destroyed.
	* They must all be in the same pool.
	*
	* Snapshots that do not exist will be silently ignored.
	*
	* If 'defer' is not set, and a snapshot has user holds or clones, the
	* destroy operation will fail and none of the snapshots will be
	* destroyed.
	*
	* If 'defer' is set, and a snapshot has user holds or clones, it will be
	* marked for deferred destruction, and will be destroyed when the last hold
	* or clone is removed/destroyed.
	*
	* The return value will be 0 if all snapshots were destroyed (or marked for
	* later destruction if 'defer' is set) or didn't exist to begin with.
	*
	* Otherwise the return value will be the errno of a (unspecified) snapshot
	* that failed, no snapshots will be destroyed, and the errlist will have an
	* entry for each snapshot that failed. The value in the errlist will be
	* the (int32) error code.
	*/
	int
	lzc_destroy_snaps(nvlist_t snaps, boolean_t defer, nvlist_t *errlist)
	{
	nvpair_t *elem;
	nvlist_t *args;
	int error;
	char pool[ZFS_MAX_DATASET_NAME_LEN];

	/* determine the pool name */
	elem = nvlist_next_nvpair(snaps, NULL);
	if (elem == NULL)
	return (0);
	(void) strlcpy(pool, nvpair_name(elem), sizeof (pool));
	pool[strcspn(pool, "/@")] = '\0';

	args = fnvlist_alloc();
	fnvlist_add_nvlist(args, "snaps", snaps);
	if (defer)
	fnvlist_add_boolean(args, "defer");

	error = lzc_ioctl(ZFS_IOC_DESTROY_SNAPS, pool, args, errlist);
	nvlist_free(args);

	return (error);
	}

	int
	lzc_snaprange_space(const char firstsnap, const char lastsnap,
	uint64_t *usedp)
	{
	nvlist_t *args;
	nvlist_t *result;
	int err;
	char fs[ZFS_MAX_DATASET_NAME_LEN];
	char *atp;

	/* determine the fs name */
	(void) strlcpy(fs, firstsnap, sizeof (fs));
	atp = strchr(fs, '@');
	if (atp == NULL)
	return (EINVAL);
	*atp = '\0';

	args = fnvlist_alloc();
	fnvlist_add_string(args, "firstsnap", firstsnap);

	err = lzc_ioctl(ZFS_IOC_SPACE_SNAPS, lastsnap, args, &result);
	nvlist_free(args);
	if (err == 0)
	*usedp = fnvlist_lookup_uint64(result, "used");
	fnvlist_free(result);

	return (err);
	}

	boolean_t
	lzc_exists(const char *dataset)
	{
	/*
	* The objset_stats ioctl is still legacy, so we need to construct our
	* own zfs_cmd_t rather than using lzc_ioctl().
	*/
	zfs_cmd_t zc = {"\0"};

	ASSERT3S(g_refcount, >, 0);
	VERIFY3S(g_fd, !=, -1);

	(void) strlcpy(zc.zc_name, dataset, sizeof (zc.zc_name));
	return (zfs_ioctl_fd(g_fd, ZFS_IOC_OBJSET_STATS, &zc) == 0);
	}

	/*
	* outnvl is unused.
	* It was added to preserve the function signature in case it is
	* needed in the future.
	*/
	/ARGSUSED/
	int
	lzc_sync(const char pool_name, nvlist_t innvl, nvlist_t **outnvl)
	{
	return (lzc_ioctl(ZFS_IOC_POOL_SYNC, pool_name, innvl, NULL));
	}

	/*
	* Create "user holds" on snapshots. If there is a hold on a snapshot,
	* the snapshot can not be destroyed. (However, it can be marked for deletion
	* by lzc_destroy_snaps(defer=B_TRUE).)
	*
	* The keys in the nvlist are snapshot names.
	* The snapshots must all be in the same pool.
	* The value is the name of the hold (string type).
	*
	* If cleanup_fd is not -1, it must be the result of open(ZFS_DEV, O_EXCL).
	* In this case, when the cleanup_fd is closed (including on process
	* termination), the holds will be released. If the system is shut down
	* uncleanly, the holds will be released when the pool is next opened
	* or imported.
	*
	* Holds for snapshots which don't exist will be skipped and have an entry
	* added to errlist, but will not cause an overall failure.
	*
	* The return value will be 0 if all holds, for snapshots that existed,
	* were successfully created.
	*
	* Otherwise the return value will be the errno of a (unspecified) hold that
	* failed and no holds will be created.
	*
	* In all cases the errlist will have an entry for each hold that failed
	* (name = snapshot), with its value being the error code (int32).
	*/
	int
	lzc_hold(nvlist_t holds, int cleanup_fd, nvlist_t *errlist)
	{
	char pool[ZFS_MAX_DATASET_NAME_LEN];
	nvlist_t *args;
	nvpair_t *elem;
	int error;

	/* determine the pool name */
	elem = nvlist_next_nvpair(holds, NULL);
	if (elem == NULL)
	return (0);
	(void) strlcpy(pool, nvpair_name(elem), sizeof (pool));
	pool[strcspn(pool, "/@")] = '\0';

	args = fnvlist_alloc();
	fnvlist_add_nvlist(args, "holds", holds);
	if (cleanup_fd != -1)
	fnvlist_add_int32(args, "cleanup_fd", cleanup_fd);

	error = lzc_ioctl(ZFS_IOC_HOLD, pool, args, errlist);
	nvlist_free(args);
	return (error);
	}

	/*
	* Release "user holds" on snapshots. If the snapshot has been marked for
	* deferred destroy (by lzc_destroy_snaps(defer=B_TRUE)), it does not have
	* any clones, and all the user holds are removed, then the snapshot will be
	* destroyed.
	*
	* The keys in the nvlist are snapshot names.
	* The snapshots must all be in the same pool.
	* The value is an nvlist whose keys are the holds to remove.
	*
	* Holds which failed to release because they didn't exist will have an entry
	* added to errlist, but will not cause an overall failure.
	*
	* The return value will be 0 if the nvl holds was empty or all holds that
	* existed, were successfully removed.
	*
	* Otherwise the return value will be the errno of a (unspecified) hold that
	* failed to release and no holds will be released.
	*
	* In all cases the errlist will have an entry for each hold that failed to
	* to release.
	*/
	int
	lzc_release(nvlist_t holds, nvlist_t *errlist)
	{
	char pool[ZFS_MAX_DATASET_NAME_LEN];
	nvpair_t *elem;

	/* determine the pool name */
	elem = nvlist_next_nvpair(holds, NULL);
	if (elem == NULL)
	return (0);
	(void) strlcpy(pool, nvpair_name(elem), sizeof (pool));
	pool[strcspn(pool, "/@")] = '\0';

	return (lzc_ioctl(ZFS_IOC_RELEASE, pool, holds, errlist));
	}

	/*
	* Retrieve list of user holds on the specified snapshot.
	*
	* On success, *holdsp will be set to an nvlist which the caller must free.
	* The keys are the names of the holds, and the value is the creation time
	* of the hold (uint64) in seconds since the epoch.
	*/
	int
	lzc_get_holds(const char snapname, nvlist_t *holdsp)
	{
	return (lzc_ioctl(ZFS_IOC_GET_HOLDS, snapname, NULL, holdsp));
	}

	/*
	* Generate a zfs send stream for the specified snapshot and write it to
	* the specified file descriptor.
	*
	* "snapname" is the full name of the snapshot to send (e.g. "pool/fs@snap")
	*
	* If "from" is NULL, a full (non-incremental) stream will be sent.
	* If "from" is non-NULL, it must be the full name of a snapshot or
	* bookmark to send an incremental from (e.g. "pool/fs@earlier_snap" or
	* "pool/fs#earlier_bmark"). If non-NULL, the specified snapshot or
	* bookmark must represent an earlier point in the history of "snapname").
	* It can be an earlier snapshot in the same filesystem or zvol as "snapname",
	* or it can be the origin of "snapname"'s filesystem, or an earlier
	* snapshot in the origin, etc.
	*
	* "fd" is the file descriptor to write the send stream to.
	*
	* If "flags" contains LZC_SEND_FLAG_LARGE_BLOCK, the stream is permitted
	* to contain DRR_WRITE records with drr_length > 128K, and DRR_OBJECT
	* records with drr_blksz > 128K.
	*
	* If "flags" contains LZC_SEND_FLAG_EMBED_DATA, the stream is permitted
	* to contain DRR_WRITE_EMBEDDED records with drr_etype==BP_EMBEDDED_TYPE_DATA,
	* which the receiving system must support (as indicated by support
	* for the "embedded_data" feature).
	*
	* If "flags" contains LZC_SEND_FLAG_COMPRESS, the stream is generated by using
	* compressed WRITE records for blocks which are compressed on disk and in
	* memory. If the lz4_compress feature is active on the sending system, then
	* the receiving system must have that feature enabled as well.
	*
	* If "flags" contains LZC_SEND_FLAG_RAW, the stream is generated, for encrypted
	* datasets, by sending data exactly as it exists on disk. This allows backups
	* to be taken even if encryption keys are not currently loaded.
	*/
	int
	lzc_send(const char snapname, const char from, int fd,
	enum lzc_send_flags flags)
	{
	return (lzc_send_resume_redacted(snapname, from, fd, flags, 0, 0,
	NULL));
	}

	int
	lzc_send_redacted(const char snapname, const char from, int fd,
	enum lzc_send_flags flags, const char *redactbook)
	{
	return (lzc_send_resume_redacted(snapname, from, fd, flags, 0, 0,
	redactbook));
	}

	int
	lzc_send_resume(const char snapname, const char from, int fd,
	enum lzc_send_flags flags, uint64_t resumeobj, uint64_t resumeoff)
	{
	return (lzc_send_resume_redacted(snapname, from, fd, flags, resumeobj,
	resumeoff, NULL));
	}

	/*
	* snapname: The name of the "tosnap", or the snapshot whose contents we are
	* sending.
	* from: The name of the "fromsnap", or the incremental source.
	* fd: File descriptor to write the stream to.
	* flags: flags that determine features to be used by the stream.
	* resumeobj: Object to resume from, for resuming send
	* resumeoff: Offset to resume from, for resuming send.
	* redactnv: nvlist of string -> boolean(ignored) containing the names of all
	* the snapshots that we should redact with respect to.
	* redactbook: Name of the redaction bookmark to create.
	*/
	int
	lzc_send_resume_redacted(const char snapname, const char from, int fd,
	enum lzc_send_flags flags, uint64_t resumeobj, uint64_t resumeoff,
	const char *redactbook)
	{
	nvlist_t *args;
	int err;

	args = fnvlist_alloc();
	fnvlist_add_int32(args, "fd", fd);
	if (from != NULL)
	fnvlist_add_string(args, "fromsnap", from);
	if (flags & LZC_SEND_FLAG_LARGE_BLOCK)
	fnvlist_add_boolean(args, "largeblockok");
	if (flags & LZC_SEND_FLAG_EMBED_DATA)
	fnvlist_add_boolean(args, "embedok");
	if (flags & LZC_SEND_FLAG_COMPRESS)
	fnvlist_add_boolean(args, "compressok");
	if (flags & LZC_SEND_FLAG_RAW)
	fnvlist_add_boolean(args, "rawok");
	if (flags & LZC_SEND_FLAG_SAVED)
	fnvlist_add_boolean(args, "savedok");
	if (resumeobj != 0 \|\| resumeoff != 0) {
	fnvlist_add_uint64(args, "resume_object", resumeobj);
	fnvlist_add_uint64(args, "resume_offset", resumeoff);
	}
	if (redactbook != NULL)
	fnvlist_add_string(args, "redactbook", redactbook);

	err = lzc_ioctl(ZFS_IOC_SEND_NEW, snapname, args, NULL);
	nvlist_free(args);
	return (err);
	}

	/*
	* "from" can be NULL, a snapshot, or a bookmark.
	*
	* If from is NULL, a full (non-incremental) stream will be estimated. This
	* is calculated very efficiently.
	*
	* If from is a snapshot, lzc_send_space uses the deadlists attached to
	* each snapshot to efficiently estimate the stream size.
	*
	* If from is a bookmark, the indirect blocks in the destination snapshot
	* are traversed, looking for blocks with a birth time since the creation TXG of
	* the snapshot this bookmark was created from. This will result in
	* significantly more I/O and be less efficient than a send space estimation on
	* an equivalent snapshot. This process is also used if redact_snaps is
	* non-null.
	*/
	int
	lzc_send_space_resume_redacted(const char snapname, const char from,
	enum lzc_send_flags flags, uint64_t resumeobj, uint64_t resumeoff,
	uint64_t resume_bytes, const char redactbook, int fd, uint64_t spacep)
	{
	nvlist_t *args;
	nvlist_t *result;
	int err;

	args = fnvlist_alloc();
	if (from != NULL)
	fnvlist_add_string(args, "from", from);
	if (flags & LZC_SEND_FLAG_LARGE_BLOCK)
	fnvlist_add_boolean(args, "largeblockok");
	if (flags & LZC_SEND_FLAG_EMBED_DATA)
	fnvlist_add_boolean(args, "embedok");
	if (flags & LZC_SEND_FLAG_COMPRESS)
	fnvlist_add_boolean(args, "compressok");
	if (flags & LZC_SEND_FLAG_RAW)
	fnvlist_add_boolean(args, "rawok");
	if (resumeobj != 0 \|\| resumeoff != 0) {
	fnvlist_add_uint64(args, "resume_object", resumeobj);
	fnvlist_add_uint64(args, "resume_offset", resumeoff);
	fnvlist_add_uint64(args, "bytes", resume_bytes);
	}
	if (redactbook != NULL)
	fnvlist_add_string(args, "redactbook", redactbook);
	if (fd != -1)
	fnvlist_add_int32(args, "fd", fd);

	err = lzc_ioctl(ZFS_IOC_SEND_SPACE, snapname, args, &result);
	nvlist_free(args);
	if (err == 0)
	*spacep = fnvlist_lookup_uint64(result, "space");
	nvlist_free(result);
	return (err);
	}

	int
	lzc_send_space(const char snapname, const char from,
	enum lzc_send_flags flags, uint64_t *spacep)
	{
	return (lzc_send_space_resume_redacted(snapname, from, flags, 0, 0, 0,
	NULL, -1, spacep));
	}

	static int
	recv_read(int fd, void *buf, int ilen)
	{
	char *cp = buf;
	int rv;
	int len = ilen;

	do {
	rv = read(fd, cp, len);
	cp += rv;
	len -= rv;
	} while (rv > 0);

	if (rv < 0 \|\| len != 0)
	return (EIO);

	return (0);
	}

	/*
	* Linux adds ZFS_IOC_RECV_NEW for resumable and raw streams and preserves the
	* legacy ZFS_IOC_RECV user/kernel interface. The new interface supports all
	* stream options but is currently only used for resumable streams. This way
	* updated user space utilities will interoperate with older kernel modules.
	*
	* Non-Linux OpenZFS platforms have opted to modify the legacy interface.
	*/
	static int
	recv_impl(const char snapname, nvlist_t recvdprops, nvlist_t *localprops,
	uint8_t wkeydata, uint_t wkeylen, const char origin, boolean_t force,
	boolean_t resumable, boolean_t raw, int input_fd,
	const dmu_replay_record_t begin_record, uint64_t read_bytes,
	uint64_t errflags, nvlist_t *errors)
	{
	dmu_replay_record_t drr;
	char fsname[MAXPATHLEN];
	char *atp;
	int error;
	boolean_t payload = B_FALSE;

	ASSERT3S(g_refcount, >, 0);
	VERIFY3S(g_fd, !=, -1);

	/* Set 'fsname' to the name of containing filesystem */
	(void) strlcpy(fsname, snapname, sizeof (fsname));
	atp = strchr(fsname, '@');
	if (atp == NULL)
	return (EINVAL);
	*atp = '\0';

	/* If the fs does not exist, try its parent. */
	if (!lzc_exists(fsname)) {
	char *slashp = strrchr(fsname, '/');
	if (slashp == NULL)
	return (ENOENT);
	*slashp = '\0';
	}

	/*
	* The begin_record is normally a non-byteswapped BEGIN record.
	* For resumable streams it may be set to any non-byteswapped
	* dmu_replay_record_t.
	*/
	if (begin_record == NULL) {
	error = recv_read(input_fd, &drr, sizeof (drr));
	if (error != 0)
	return (error);
	} else {
	drr = *begin_record;
	payload = (begin_record->drr_payloadlen != 0);
	}

	/*
	* All receives with a payload should use the new interface.
	*/
	if (resumable \|\| raw \|\| wkeydata != NULL \|\| payload) {
	nvlist_t *outnvl = NULL;
	nvlist_t *innvl = fnvlist_alloc();

	fnvlist_add_string(innvl, "snapname", snapname);

	if (recvdprops != NULL)
	fnvlist_add_nvlist(innvl, "props", recvdprops);

	if (localprops != NULL)
	fnvlist_add_nvlist(innvl, "localprops", localprops);

	if (wkeydata != NULL) {
	/*
	* wkeydata must be placed in the special
	* ZPOOL_HIDDEN_ARGS nvlist so that it
	* will not be printed to the zpool history.
	*/
	nvlist_t *hidden_args = fnvlist_alloc();
	fnvlist_add_uint8_array(hidden_args, "wkeydata",
	wkeydata, wkeylen);
	fnvlist_add_nvlist(innvl, ZPOOL_HIDDEN_ARGS,
	hidden_args);
	nvlist_free(hidden_args);
	}

	if (origin != NULL && strlen(origin))
	fnvlist_add_string(innvl, "origin", origin);

	fnvlist_add_byte_array(innvl, "begin_record",
	(uchar_t *)&drr, sizeof (drr));

	fnvlist_add_int32(innvl, "input_fd", input_fd);

	if (force)
	fnvlist_add_boolean(innvl, "force");

	if (resumable)
	fnvlist_add_boolean(innvl, "resumable");


	error = lzc_ioctl(ZFS_IOC_RECV_NEW, fsname, innvl, &outnvl);

	if (error == 0 && read_bytes != NULL)
	error = nvlist_lookup_uint64(outnvl, "read_bytes",
	read_bytes);

	if (error == 0 && errflags != NULL)
	error = nvlist_lookup_uint64(outnvl, "error_flags",
	errflags);

	if (error == 0 && errors != NULL) {
	nvlist_t *nvl;
	error = nvlist_lookup_nvlist(outnvl, "errors", &nvl);
	if (error == 0)
	*errors = fnvlist_dup(nvl);
	}

	fnvlist_free(innvl);
	fnvlist_free(outnvl);
	} else {
	zfs_cmd_t zc = {"\0"};
	char *packed = NULL;
	size_t size;

	ASSERT3S(g_refcount, >, 0);

	(void) strlcpy(zc.zc_name, fsname, sizeof (zc.zc_name));
	(void) strlcpy(zc.zc_value, snapname, sizeof (zc.zc_value));

	if (recvdprops != NULL) {
	packed = fnvlist_pack(recvdprops, &size);
	zc.zc_nvlist_src = (uint64_t)(uintptr_t)packed;
	zc.zc_nvlist_src_size = size;
	}

	if (localprops != NULL) {
	packed = fnvlist_pack(localprops, &size);
	zc.zc_nvlist_conf = (uint64_t)(uintptr_t)packed;
	zc.zc_nvlist_conf_size = size;
	}

	if (origin != NULL)
	(void) strlcpy(zc.zc_string, origin,
	sizeof (zc.zc_string));

	ASSERT3S(drr.drr_type, ==, DRR_BEGIN);
	zc.zc_begin_record = drr.drr_u.drr_begin;
	zc.zc_guid = force;
	zc.zc_cookie = input_fd;
	zc.zc_cleanup_fd = -1;
	zc.zc_action_handle = 0;

	zc.zc_nvlist_dst_size = 128 * 1024;
	zc.zc_nvlist_dst = (uint64_t)(uintptr_t)
	malloc(zc.zc_nvlist_dst_size);

	error = zfs_ioctl_fd(g_fd, ZFS_IOC_RECV, &zc);
	if (error != 0) {
	error = errno;
	} else {
	if (read_bytes != NULL)
	*read_bytes = zc.zc_cookie;

	if (errflags != NULL)
	*errflags = zc.zc_obj;

	if (errors != NULL)
	VERIFY0(nvlist_unpack(
	(void *)(uintptr_t)zc.zc_nvlist_dst,
	zc.zc_nvlist_dst_size, errors, KM_SLEEP));
	}

	if (packed != NULL)
	fnvlist_pack_free(packed, size);
	free((void *)(uintptr_t)zc.zc_nvlist_dst);
	}

	return (error);
	}

	/*
	* The simplest receive case: receive from the specified fd, creating the
	* specified snapshot. Apply the specified properties as "received" properties
	* (which can be overridden by locally-set properties). If the stream is a
	* clone, its origin snapshot must be specified by 'origin'. The 'force'
	* flag will cause the target filesystem to be rolled back or destroyed if
	* necessary to receive.
	*
	* Return 0 on success or an errno on failure.
	*
	* Note: this interface does not work on dedup'd streams
	* (those with DMU_BACKUP_FEATURE_DEDUP).
	*/
	int
	lzc_receive(const char snapname, nvlist_t props, const char *origin,
	boolean_t force, boolean_t raw, int fd)
	{
	return (recv_impl(snapname, props, NULL, NULL, 0, origin, force,
	B_FALSE, raw, fd, NULL, NULL, NULL, NULL));
	}

	/*
	* Like lzc_receive, but if the receive fails due to premature stream
	* termination, the intermediate state will be preserved on disk. In this
	* case, ECKSUM will be returned. The receive may subsequently be resumed
	* with a resuming send stream generated by lzc_send_resume().
	*/
	int
	lzc_receive_resumable(const char snapname, nvlist_t props, const char *origin,
	boolean_t force, boolean_t raw, int fd)
	{
	return (recv_impl(snapname, props, NULL, NULL, 0, origin, force,
	B_TRUE, raw, fd, NULL, NULL, NULL, NULL));
	}

	/*
	* Like lzc_receive, but allows the caller to read the begin record and then to
	* pass it in. That could be useful if the caller wants to derive, for example,
	* the snapname or the origin parameters based on the information contained in
	* the begin record.
	* The begin record must be in its original form as read from the stream,
	* in other words, it should not be byteswapped.
	*
	* The 'resumable' parameter allows to obtain the same behavior as with
	* lzc_receive_resumable.
	*/
	int
	lzc_receive_with_header(const char snapname, nvlist_t props,
	const char *origin, boolean_t force, boolean_t resumable, boolean_t raw,
	int fd, const dmu_replay_record_t *begin_record)
	{
	if (begin_record == NULL)
	return (EINVAL);

	return (recv_impl(snapname, props, NULL, NULL, 0, origin, force,
	resumable, raw, fd, begin_record, NULL, NULL, NULL));
	}

	/*
	* Like lzc_receive, but allows the caller to pass all supported arguments
	* and retrieve all values returned. The only additional input parameter
	* is 'cleanup_fd' which is used to set a cleanup-on-exit file descriptor.
	*
	* The following parameters all provide return values. Several may be set
	* in the failure case and will contain additional information.
	*
	* The 'read_bytes' value will be set to the total number of bytes read.
	*
	* The 'errflags' value will contain zprop_errflags_t flags which are
	* used to describe any failures.
	*
	* The 'action_handle' and 'cleanup_fd' are no longer used, and are ignored.
	*
	* The 'errors' nvlist contains an entry for each unapplied received
	* property. Callers are responsible for freeing this nvlist.
	*/
	int lzc_receive_one(const char snapname, nvlist_t props,
	const char *origin, boolean_t force, boolean_t resumable, boolean_t raw,
	int input_fd, const dmu_replay_record_t *begin_record, int cleanup_fd,
	uint64_t read_bytes, uint64_t errflags, uint64_t *action_handle,
	nvlist_t **errors)
	{
	return (recv_impl(snapname, props, NULL, NULL, 0, origin, force,
	resumable, raw, input_fd, begin_record,
	read_bytes, errflags, errors));
	}

	/*
	* Like lzc_receive_one, but allows the caller to pass an additional 'cmdprops'
	* argument.
	*
	* The 'cmdprops' nvlist contains both override ('zfs receive -o') and
	* exclude ('zfs receive -x') properties. Callers are responsible for freeing
	* this nvlist
	*/
	int lzc_receive_with_cmdprops(const char snapname, nvlist_t props,
	nvlist_t cmdprops, uint8_t wkeydata, uint_t wkeylen, const char *origin,
	boolean_t force, boolean_t resumable, boolean_t raw, int input_fd,
	const dmu_replay_record_t *begin_record, int cleanup_fd,
	uint64_t read_bytes, uint64_t errflags, uint64_t *action_handle,
	nvlist_t **errors)
	{
	return (recv_impl(snapname, props, cmdprops, wkeydata, wkeylen, origin,
	force, resumable, raw, input_fd, begin_record,
	read_bytes, errflags, errors));
	}

	/*
	* Roll back this filesystem or volume to its most recent snapshot.
	* If snapnamebuf is not NULL, it will be filled in with the name
	* of the most recent snapshot.
	* Note that the latest snapshot may change if a new one is concurrently
	* created or the current one is destroyed. lzc_rollback_to can be used
	* to roll back to a specific latest snapshot.
	*
	* Return 0 on success or an errno on failure.
	*/
	int
	lzc_rollback(const char fsname, char snapnamebuf, int snapnamelen)
	{
	nvlist_t *args;
	nvlist_t *result;
	int err;

	args = fnvlist_alloc();
	err = lzc_ioctl(ZFS_IOC_ROLLBACK, fsname, args, &result);
	nvlist_free(args);
	if (err == 0 && snapnamebuf != NULL) {
	const char *snapname = fnvlist_lookup_string(result, "target");
	(void) strlcpy(snapnamebuf, snapname, snapnamelen);
	}
	nvlist_free(result);

	return (err);
	}

	/*
	* Roll back this filesystem or volume to the specified snapshot,
	* if possible.
	*
	* Return 0 on success or an errno on failure.
	*/
	int
	lzc_rollback_to(const char fsname, const char snapname)
	{
	nvlist_t *args;
	nvlist_t *result;
	int err;

	args = fnvlist_alloc();
	fnvlist_add_string(args, "target", snapname);
	err = lzc_ioctl(ZFS_IOC_ROLLBACK, fsname, args, &result);
	nvlist_free(args);
	nvlist_free(result);
	return (err);
	}

	/*
	* Creates new bookmarks from existing snapshot or bookmark.
	*
	* The bookmarks nvlist maps from the full name of the new bookmark to
	* the full name of the source snapshot or bookmark.
	* All the bookmarks and snapshots must be in the same pool.
	* The new bookmarks names must be unique.
	* => see function dsl_bookmark_create_nvl_validate
	*
	* The returned results nvlist will have an entry for each bookmark that failed.
	* The value will be the (int32) error code.
	*
	* The return value will be 0 if all bookmarks were created, otherwise it will
	* be the errno of a (undetermined) bookmarks that failed.
	*/
	int
	lzc_bookmark(nvlist_t bookmarks, nvlist_t *errlist)
	{
	nvpair_t *elem;
	int error;
	char pool[ZFS_MAX_DATASET_NAME_LEN];

	/* determine pool name from first bookmark */
	elem = nvlist_next_nvpair(bookmarks, NULL);
	if (elem == NULL)
	return (0);
	(void) strlcpy(pool, nvpair_name(elem), sizeof (pool));
	pool[strcspn(pool, "/#")] = '\0';

	error = lzc_ioctl(ZFS_IOC_BOOKMARK, pool, bookmarks, errlist);

	return (error);
	}

	/*
	* Retrieve bookmarks.
	*
	* Retrieve the list of bookmarks for the given file system. The props
	* parameter is an nvlist of property names (with no values) that will be
	* returned for each bookmark.
	*
	* The following are valid properties on bookmarks, most of which are numbers
	* (represented as uint64 in the nvlist), except redact_snaps, which is a
	* uint64 array, and redact_complete, which is a boolean
	*
	* "guid" - globally unique identifier of the snapshot it refers to
	* "createtxg" - txg when the snapshot it refers to was created
	* "creation" - timestamp when the snapshot it refers to was created
	* "ivsetguid" - IVset guid for identifying encrypted snapshots
	* "redact_snaps" - list of guids of the redaction snapshots for the specified
	* bookmark. If the bookmark is not a redaction bookmark, the nvlist will
	* not contain an entry for this value. If it is redacted with respect to
	* no snapshots, it will contain value -> NULL uint64 array
	* "redact_complete" - boolean value; true if the redaction bookmark is
	* complete, false otherwise.
	*
	* The format of the returned nvlist as follows:
	* <short name of bookmark> -> {
	* <name of property> -> {
	* "value" -> uint64
	* }
	* ...
	* "redact_snaps" -> {
	* "value" -> uint64 array
	* }
	* "redact_complete" -> {
	* "value" -> boolean value
	* }
	* }
	*/
	int
	lzc_get_bookmarks(const char fsname, nvlist_t props, nvlist_t **bmarks)
	{
	return (lzc_ioctl(ZFS_IOC_GET_BOOKMARKS, fsname, props, bmarks));
	}

	/*
	* Get bookmark properties.
	*
	* Given a bookmark's full name, retrieve all properties for the bookmark.
	*
	* The format of the returned property list is as follows:
	* {
	* <name of property> -> {
	* "value" -> uint64
	* }
	* ...
	* "redact_snaps" -> {
	* "value" -> uint64 array
	* }
	*/
	int
	lzc_get_bookmark_props(const char bookmark, nvlist_t *props)
	{
	int error;

	nvlist_t *innvl = fnvlist_alloc();
	error = lzc_ioctl(ZFS_IOC_GET_BOOKMARK_PROPS, bookmark, innvl, props);
	fnvlist_free(innvl);

	return (error);
	}

	/*
	* Destroys bookmarks.
	*
	* The keys in the bmarks nvlist are the bookmarks to be destroyed.
	* They must all be in the same pool. Bookmarks are specified as
	* <fs>#<bmark>.
	*
	* Bookmarks that do not exist will be silently ignored.
	*
	* The return value will be 0 if all bookmarks that existed were destroyed.
	*
	* Otherwise the return value will be the errno of a (undetermined) bookmark
	* that failed, no bookmarks will be destroyed, and the errlist will have an
	* entry for each bookmarks that failed. The value in the errlist will be
	* the (int32) error code.
	*/
	int
	lzc_destroy_bookmarks(nvlist_t bmarks, nvlist_t *errlist)
	{
	nvpair_t *elem;
	int error;
	char pool[ZFS_MAX_DATASET_NAME_LEN];

	/* determine the pool name */
	elem = nvlist_next_nvpair(bmarks, NULL);
	if (elem == NULL)
	return (0);
	(void) strlcpy(pool, nvpair_name(elem), sizeof (pool));
	pool[strcspn(pool, "/#")] = '\0';

	error = lzc_ioctl(ZFS_IOC_DESTROY_BOOKMARKS, pool, bmarks, errlist);

	return (error);
	}

	static int
	lzc_channel_program_impl(const char pool, const char program, boolean_t sync,
	uint64_t instrlimit, uint64_t memlimit, nvlist_t argnvl, nvlist_t *outnvl)
	{
	int error;
	nvlist_t *args;

	args = fnvlist_alloc();
	fnvlist_add_string(args, ZCP_ARG_PROGRAM, program);
	fnvlist_add_nvlist(args, ZCP_ARG_ARGLIST, argnvl);
	fnvlist_add_boolean_value(args, ZCP_ARG_SYNC, sync);
	fnvlist_add_uint64(args, ZCP_ARG_INSTRLIMIT, instrlimit);
	fnvlist_add_uint64(args, ZCP_ARG_MEMLIMIT, memlimit);
	error = lzc_ioctl(ZFS_IOC_CHANNEL_PROGRAM, pool, args, outnvl);
	fnvlist_free(args);

	return (error);
	}

	/*
	* Executes a channel program.
	*
	* If this function returns 0 the channel program was successfully loaded and
	* ran without failing. Note that individual commands the channel program ran
	* may have failed and the channel program is responsible for reporting such
	* errors through outnvl if they are important.
	*
	* This method may also return:
	*
	* EINVAL The program contains syntax errors, or an invalid memory or time
	* limit was given. No part of the channel program was executed.
	* If caused by syntax errors, 'outnvl' contains information about the
	* errors.
	*
	* ECHRNG The program was executed, but encountered a runtime error, such as
	* calling a function with incorrect arguments, invoking the error()
	* function directly, failing an assert() command, etc. Some portion
	* of the channel program may have executed and committed changes.
	* Information about the failure can be found in 'outnvl'.
	*
	* ENOMEM The program fully executed, but the output buffer was not large
	* enough to store the returned value. No output is returned through
	* 'outnvl'.
	*
	* ENOSPC The program was terminated because it exceeded its memory usage
	* limit. Some portion of the channel program may have executed and
	* committed changes to disk. No output is returned through 'outnvl'.
	*
	* ETIME The program was terminated because it exceeded its Lua instruction
	* limit. Some portion of the channel program may have executed and
	* committed changes to disk. No output is returned through 'outnvl'.
	*/
	int
	lzc_channel_program(const char pool, const char program, uint64_t instrlimit,
	uint64_t memlimit, nvlist_t argnvl, nvlist_t *outnvl)
	{
	return (lzc_channel_program_impl(pool, program, B_TRUE, instrlimit,
	memlimit, argnvl, outnvl));
	}

	/*
	* Creates a checkpoint for the specified pool.
	*
	* If this function returns 0 the pool was successfully checkpointed.
	*
	* This method may also return:
	*
	* ZFS_ERR_CHECKPOINT_EXISTS
	* The pool already has a checkpoint. A pools can only have one
	* checkpoint at most, at any given time.
	*
	* ZFS_ERR_DISCARDING_CHECKPOINT
	* ZFS is in the middle of discarding a checkpoint for this pool.
	* The pool can be checkpointed again once the discard is done.
	*
	* ZFS_DEVRM_IN_PROGRESS
	* A vdev is currently being removed. The pool cannot be
	* checkpointed until the device removal is done.
	*
	* ZFS_VDEV_TOO_BIG
	* One or more top-level vdevs exceed the maximum vdev size
	* supported for this feature.
	*/
	int
	lzc_pool_checkpoint(const char *pool)
	{
	int error;

	nvlist_t *result = NULL;
	nvlist_t *args = fnvlist_alloc();

	error = lzc_ioctl(ZFS_IOC_POOL_CHECKPOINT, pool, args, &result);

	fnvlist_free(args);
	fnvlist_free(result);

	return (error);
	}

	/*
	* Discard the checkpoint from the specified pool.
	*
	* If this function returns 0 the checkpoint was successfully discarded.
	*
	* This method may also return:
	*
	* ZFS_ERR_NO_CHECKPOINT
	* The pool does not have a checkpoint.
	*
	* ZFS_ERR_DISCARDING_CHECKPOINT
	* ZFS is already in the middle of discarding the checkpoint.
	*/
	int
	lzc_pool_checkpoint_discard(const char *pool)
	{
	int error;

	nvlist_t *result = NULL;
	nvlist_t *args = fnvlist_alloc();

	error = lzc_ioctl(ZFS_IOC_POOL_DISCARD_CHECKPOINT, pool, args, &result);

	fnvlist_free(args);
	fnvlist_free(result);

	return (error);
	}

	/*
	* Executes a read-only channel program.
	*
	* A read-only channel program works programmatically the same way as a
	* normal channel program executed with lzc_channel_program(). The only
	* difference is it runs exclusively in open-context and therefore can
	* return faster. The downside to that, is that the program cannot change
	* on-disk state by calling functions from the zfs.sync submodule.
	*
	* The return values of this function (and their meaning) are exactly the
	* same as the ones described in lzc_channel_program().
	*/
	int
	lzc_channel_program_nosync(const char pool, const char program,
	uint64_t timeout, uint64_t memlimit, nvlist_t argnvl, nvlist_t *outnvl)
	{
	return (lzc_channel_program_impl(pool, program, B_FALSE, timeout,
	memlimit, argnvl, outnvl));
	}

	/*
	* Performs key management functions
	*
	* crypto_cmd should be a value from dcp_cmd_t. If the command specifies to
	* load or change a wrapping key, the key should be specified in the
	* hidden_args nvlist so that it is not logged.
	*/
	int
	lzc_load_key(const char fsname, boolean_t noop, uint8_t wkeydata,
	uint_t wkeylen)
	{
	int error;
	nvlist_t *ioc_args;
	nvlist_t *hidden_args;

	if (wkeydata == NULL)
	return (EINVAL);

	ioc_args = fnvlist_alloc();
	hidden_args = fnvlist_alloc();
	fnvlist_add_uint8_array(hidden_args, "wkeydata", wkeydata, wkeylen);
	fnvlist_add_nvlist(ioc_args, ZPOOL_HIDDEN_ARGS, hidden_args);
	if (noop)
	fnvlist_add_boolean(ioc_args, "noop");
	error = lzc_ioctl(ZFS_IOC_LOAD_KEY, fsname, ioc_args, NULL);
	nvlist_free(hidden_args);
	nvlist_free(ioc_args);

	return (error);
	}

	int
	lzc_unload_key(const char *fsname)
	{
	return (lzc_ioctl(ZFS_IOC_UNLOAD_KEY, fsname, NULL, NULL));
	}

	int
	lzc_change_key(const char fsname, uint64_t crypt_cmd, nvlist_t props,
	uint8_t *wkeydata, uint_t wkeylen)
	{
	int error;
	nvlist_t *ioc_args = fnvlist_alloc();
	nvlist_t *hidden_args = NULL;

	fnvlist_add_uint64(ioc_args, "crypt_cmd", crypt_cmd);

	if (wkeydata != NULL) {
	hidden_args = fnvlist_alloc();
	fnvlist_add_uint8_array(hidden_args, "wkeydata", wkeydata,
	wkeylen);
	fnvlist_add_nvlist(ioc_args, ZPOOL_HIDDEN_ARGS, hidden_args);
	}

	if (props != NULL)
	fnvlist_add_nvlist(ioc_args, "props", props);

	error = lzc_ioctl(ZFS_IOC_CHANGE_KEY, fsname, ioc_args, NULL);
	nvlist_free(hidden_args);
	nvlist_free(ioc_args);

	return (error);
	}

	int
	lzc_reopen(const char *pool_name, boolean_t scrub_restart)
	{
	nvlist_t *args = fnvlist_alloc();
	int error;

	fnvlist_add_boolean_value(args, "scrub_restart", scrub_restart);

	error = lzc_ioctl(ZFS_IOC_POOL_REOPEN, pool_name, args, NULL);
	nvlist_free(args);
	return (error);
	}

	/*
	* Changes initializing state.
	*
	* vdevs should be a list of (<key>, guid) where guid is a uint64 vdev GUID.
	* The key is ignored.
	*
	* If there are errors related to vdev arguments, per-vdev errors are returned
	* in an nvlist with the key "vdevs". Each error is a (guid, errno) pair where
	* guid is stringified with PRIu64, and errno is one of the following as
	* an int64_t:
	* - ENODEV if the device was not found
	* - EINVAL if the devices is not a leaf or is not concrete (e.g. missing)
	* - EROFS if the device is not writeable
	* - EBUSY start requested but the device is already being either
	* initialized or trimmed
	* - ESRCH cancel/suspend requested but device is not being initialized
	*
	* If the errlist is empty, then return value will be:
	* - EINVAL if one or more arguments was invalid
	* - Other spa_open failures
	* - 0 if the operation succeeded
	*/
	int
	lzc_initialize(const char *poolname, pool_initialize_func_t cmd_type,
	nvlist_t vdevs, nvlist_t *errlist)
	{
	int error;

	nvlist_t *args = fnvlist_alloc();
	fnvlist_add_uint64(args, ZPOOL_INITIALIZE_COMMAND, (uint64_t)cmd_type);
	fnvlist_add_nvlist(args, ZPOOL_INITIALIZE_VDEVS, vdevs);

	error = lzc_ioctl(ZFS_IOC_POOL_INITIALIZE, poolname, args, errlist);

	fnvlist_free(args);

	return (error);
	}

	/*
	* Changes TRIM state.
	*
	* vdevs should be a list of (<key>, guid) where guid is a uint64 vdev GUID.
	* The key is ignored.
	*
	* If there are errors related to vdev arguments, per-vdev errors are returned
	* in an nvlist with the key "vdevs". Each error is a (guid, errno) pair where
	* guid is stringified with PRIu64, and errno is one of the following as
	* an int64_t:
	* - ENODEV if the device was not found
	* - EINVAL if the devices is not a leaf or is not concrete (e.g. missing)
	* - EROFS if the device is not writeable
	* - EBUSY start requested but the device is already being either trimmed
	* or initialized
	* - ESRCH cancel/suspend requested but device is not being initialized
	* - EOPNOTSUPP if the device does not support TRIM (or secure TRIM)
	*
	* If the errlist is empty, then return value will be:
	* - EINVAL if one or more arguments was invalid
	* - Other spa_open failures
	* - 0 if the operation succeeded
	*/
	int
	lzc_trim(const char *poolname, pool_trim_func_t cmd_type, uint64_t rate,
	boolean_t secure, nvlist_t vdevs, nvlist_t *errlist)
	{
	int error;

	nvlist_t *args = fnvlist_alloc();
	fnvlist_add_uint64(args, ZPOOL_TRIM_COMMAND, (uint64_t)cmd_type);
	fnvlist_add_nvlist(args, ZPOOL_TRIM_VDEVS, vdevs);
	fnvlist_add_uint64(args, ZPOOL_TRIM_RATE, rate);
	fnvlist_add_boolean_value(args, ZPOOL_TRIM_SECURE, secure);

	error = lzc_ioctl(ZFS_IOC_POOL_TRIM, poolname, args, errlist);

	fnvlist_free(args);

	return (error);
	}

	/*
	* Create a redaction bookmark named bookname by redacting snapshot with respect
	* to all the snapshots in snapnv.
	*/
	int
	lzc_redact(const char snapshot, const char bookname, nvlist_t *snapnv)
	{
	nvlist_t *args = fnvlist_alloc();
	fnvlist_add_string(args, "bookname", bookname);
	fnvlist_add_nvlist(args, "snapnv", snapnv);
	int error = lzc_ioctl(ZFS_IOC_REDACT, snapshot, args, NULL);
	fnvlist_free(args);
	return (error);
	}

	static int
	wait_common(const char *pool, zpool_wait_activity_t activity, boolean_t use_tag,
	uint64_t tag, boolean_t *waited)
	{
	nvlist_t *args = fnvlist_alloc();
	nvlist_t *result = NULL;

	fnvlist_add_int32(args, ZPOOL_WAIT_ACTIVITY, activity);
	if (use_tag)
	fnvlist_add_uint64(args, ZPOOL_WAIT_TAG, tag);

	int error = lzc_ioctl(ZFS_IOC_WAIT, pool, args, &result);

	if (error == 0 && waited != NULL)
	*waited = fnvlist_lookup_boolean_value(result,
	ZPOOL_WAIT_WAITED);

	fnvlist_free(args);
	fnvlist_free(result);

	return (error);
	}

	int
	lzc_wait(const char pool, zpool_wait_activity_t activity, boolean_t waited)
	{
	return (wait_common(pool, activity, B_FALSE, 0, waited));
	}

	int
	lzc_wait_tag(const char *pool, zpool_wait_activity_t activity, uint64_t tag,
	boolean_t *waited)
	{
	return (wait_common(pool, activity, B_TRUE, tag, waited));
	}

	int
	lzc_wait_fs(const char fs, zfs_wait_activity_t activity, boolean_t waited)
	{
	nvlist_t *args = fnvlist_alloc();
	nvlist_t *result = NULL;

	fnvlist_add_int32(args, ZFS_WAIT_ACTIVITY, activity);

	int error = lzc_ioctl(ZFS_IOC_WAIT_FS, fs, args, &result);

	if (error == 0 && waited != NULL)
	*waited = fnvlist_lookup_boolean_value(result,
	ZFS_WAIT_WAITED);

	fnvlist_free(args);
	fnvlist_free(result);

	return (error);
	}

	/*
	* Set the bootenv contents for the given pool.
	*/
	int
	-lzc_set_bootenv(const char pool, const char env)
	+lzc_set_bootenv(const char pool, const nvlist_t env)
	{
	- nvlist_t *args = fnvlist_alloc();
	- fnvlist_add_string(args, "envmap", env);
	- int error = lzc_ioctl(ZFS_IOC_SET_BOOTENV, pool, args, NULL);
	- fnvlist_free(args);
	- return (error);
	+ return (lzc_ioctl(ZFS_IOC_SET_BOOTENV, pool, (nvlist_t *)env, NULL));
	}

	/*
	* Get the contents of the bootenv of the given pool.
	*/
	int
	lzc_get_bootenv(const char pool, nvlist_t *outnvl)
	{
	return (lzc_ioctl(ZFS_IOC_GET_BOOTENV, pool, NULL, outnvl));
	}
	Index: vendor-sys/openzfs/dist/lib/libzfs_core/libzfs_core.pc.in
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfs_core/libzfs_core.pc.in (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzfs_core/libzfs_core.pc.in (revision 365892)
	@@ -1,13 +1,13 @@
	prefix=@prefix@
	exec_prefix=@exec_prefix@
	libdir=@libdir@
	includedir=@includedir@

	Name: libzfs_core
	Description: LibZFS core library
	Version: @VERSION@
	-URL: https://zfsonlinux.org
	-Requires.private: blkid uuid libtirpc zlib
	+URL: https://github.com/openzfs/zfs
	+Requires.private: @LIBBLKID_PC@ @LIBUUID_PC@ @LIBTIRPC_PC@ @ZLIB_PC@
	Cflags: -I${includedir}/libzfs -I${includedir}/libspl
	Libs: -L${libdir} -lzfs_core -lnvpair
	Libs.private: @LIBCLOCK_GETTIME@ @LIBUDEV_LIBS@ -lm -pthread
	Index: vendor-sys/openzfs/dist/lib/libzfsbootenv/.gitignore
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfsbootenv/.gitignore (nonexistent)
	+++ vendor-sys/openzfs/dist/lib/libzfsbootenv/.gitignore (revision 365892)
	@@ -0,0 +1 @@
	+/libzfsbootenv.pc
	Index: vendor-sys/openzfs/dist/lib/libzfsbootenv/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfsbootenv/Makefile.am (nonexistent)
	+++ vendor-sys/openzfs/dist/lib/libzfsbootenv/Makefile.am (revision 365892)
	@@ -0,0 +1,32 @@
	+include $(top_srcdir)/config/Rules.am
	+
	+pkgconfig_DATA = libzfsbootenv.pc
	+
	+lib_LTLIBRARIES = libzfsbootenv.la
	+
	+if BUILD_FREEBSD
	+DEFAULT_INCLUDES += -I$(top_srcdir)/include/os/freebsd/zfs
	+endif
	+if BUILD_LINUX
	+DEFAULT_INCLUDES += -I$(top_srcdir)/include/os/linux/zfs
	+endif
	+
	+USER_C = \
	+ lzbe_device.c \
	+ lzbe_pair.c \
	+ lzbe_util.c
	+
	+dist_libzfsbootenv_la_SOURCES = \
	+ $(USER_C)
	+
	+libzfsbootenv_la_LIBADD = \
	+ $(abs_top_builddir)/lib/libzfs/libzfs.la \
	+ $(abs_top_builddir)/lib/libnvpair/libnvpair.la
	+
	+libzfsbootenv_la_LDFLAGS =
	+
	+if !ASAN_ENABLED
	+libzfsbootenv_la_LDFLAGS += -Wl,-z,defs
	+endif
	+
	+libzfsbootenv_la_LDFLAGS += -version-info 1:0:0

	Property changes on: vendor-sys/openzfs/dist/lib/libzfsbootenv/Makefile.am
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/lib/libzfsbootenv/libzfsbootenv.pc.in
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfsbootenv/libzfsbootenv.pc.in (nonexistent)
	+++ vendor-sys/openzfs/dist/lib/libzfsbootenv/libzfsbootenv.pc.in (revision 365892)
	@@ -0,0 +1,12 @@
	+prefix=@prefix@
	+exec_prefix=@exec_prefix@
	+libdir=@libdir@
	+includedir=@includedir@
	+
	+Name: libzfsbootenv
	+Description: LibZFSBootENV library
	+Version: @VERSION@
	+URL: https://zfsonlinux.org
	+Requires: libzfs libnvpair
	+Cflags: -I${includedir}
	+Libs: -L${libdir} -lzfsbootenv

	Property changes on: vendor-sys/openzfs/dist/lib/libzfsbootenv/libzfsbootenv.pc.in
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_device.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_device.c (nonexistent)
	+++ vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_device.c (revision 365892)
	@@ -0,0 +1,164 @@
	+/*
	+ * This file and its contents are supplied under the terms of the
	+ * Common Development and Distribution License ("CDDL"), version 1.0.
	+ * You may only use this file in accordance with the terms of version
	+ * 1.0 of the CDDL.
	+ *
	+ * A full copy of the text of the CDDL should have accompanied this
	+ * source. A copy of the CDDL is also available via the Internet at
	+ * http://www.illumos.org/license/CDDL.
	+ */
	+/*
	+ * Copyright 2020 Toomas Soome <tsoome@me.com>
	+ */
	+
	+#include <sys/types.h>
	+#include <string.h>
	+#include <libzfs.h>
	+#include <libzfsbootenv.h>
	+#include <sys/zfs_bootenv.h>
	+#include <sys/vdev_impl.h>
	+
	+/*
	+ * Store device name to zpool label bootenv area.
	+ * This call will set bootenv version to VB_NVLIST, if bootenv currently
	+ * does contain other version, then old data will be replaced.
	+ */
	+int
	+lzbe_set_boot_device(const char pool, lzbe_flags_t flag, const char device)
	+{
	+ libzfs_handle_t *hdl;
	+ zpool_handle_t *zphdl;
	+ nvlist_t *nv;
	+ char *descriptor;
	+ uint64_t version;
	+ int rv = -1;
	+
	+ if (pool == NULL \|\| *pool == '\0')
	+ return (rv);
	+
	+ if ((hdl = libzfs_init()) == NULL)
	+ return (rv);
	+
	+ zphdl = zpool_open(hdl, pool);
	+ if (zphdl == NULL) {
	+ libzfs_fini(hdl);
	+ return (rv);
	+ }
	+
	+ switch (flag) {
	+ case lzbe_add:
	+ rv = zpool_get_bootenv(zphdl, &nv);
	+ if (rv == 0) {
	+ /*
	+ * We got the nvlist, check for version.
	+ * if version is missing or is not VB_NVLIST,
	+ * create new list.
	+ */
	+ rv = nvlist_lookup_uint64(nv, BOOTENV_VERSION,
	+ &version);
	+ if (rv == 0 && version == VB_NVLIST)
	+ break;
	+
	+ /* Drop this nvlist */
	+ fnvlist_free(nv);
	+ }
	+ /* FALLTHROUGH */
	+ case lzbe_replace:
	+ nv = fnvlist_alloc();
	+ break;
	+ default:
	+ return (rv);
	+ }
	+
	+ /* version is mandatory */
	+ fnvlist_add_uint64(nv, BOOTENV_VERSION, VB_NVLIST);
	+
	+ /*
	+ * If device name is empty, remove boot device configuration.
	+ */
	+ if ((device == NULL \|\| *device == '\0')) {
	+ if (nvlist_exists(nv, OS_BOOTONCE))
	+ fnvlist_remove(nv, OS_BOOTONCE);
	+ } else {
	+ /*
	+ * Use device name directly if it does start with
	+ * prefix "zfs:". Otherwise, add prefix and sufix.
	+ */
	+ if (strncmp(device, "zfs:", 4) == 0) {
	+ fnvlist_add_string(nv, OS_BOOTONCE, device);
	+ } else {
	+ descriptor = NULL;
	+ if (asprintf(&descriptor, "zfs:%s:", device) > 0)
	+ fnvlist_add_string(nv, OS_BOOTONCE, descriptor);
	+ else
	+ rv = ENOMEM;
	+ free(descriptor);
	+ }
	+ }
	+
	+ rv = zpool_set_bootenv(zphdl, nv);
	+ if (rv != 0)
	+ fprintf(stderr, "%s\n", libzfs_error_description(hdl));
	+
	+ fnvlist_free(nv);
	+ zpool_close(zphdl);
	+ libzfs_fini(hdl);
	+ return (rv);
	+}
	+
	+/*
	+ * Return boot device name from bootenv, if set.
	+ */
	+int
	+lzbe_get_boot_device(const char pool, char *device)
	+{
	+ libzfs_handle_t *hdl;
	+ zpool_handle_t *zphdl;
	+ nvlist_t *nv;
	+ char *val;
	+ int rv = -1;
	+
	+ if (pool == NULL \|\| *pool == '\0' \|\| device == NULL)
	+ return (rv);
	+
	+ if ((hdl = libzfs_init()) == NULL)
	+ return (rv);
	+
	+ zphdl = zpool_open(hdl, pool);
	+ if (zphdl == NULL) {
	+ libzfs_fini(hdl);
	+ return (rv);
	+ }
	+
	+ rv = zpool_get_bootenv(zphdl, &nv);
	+ if (rv == 0) {
	+ rv = nvlist_lookup_string(nv, OS_BOOTONCE, &val);
	+ if (rv == 0) {
	+ /*
	+ * zfs device descriptor is in form of "zfs:dataset:",
	+ * we only do need dataset name.
	+ */
	+ if (strncmp(val, "zfs:", 4) == 0) {
	+ val += 4;
	+ val = strdup(val);
	+ if (val != NULL) {
	+ size_t len = strlen(val);
	+
	+ if (val[len - 1] == ':')
	+ val[len - 1] = '\0';
	+ *device = val;
	+ } else {
	+ rv = ENOMEM;
	+ }
	+ } else {
	+ rv = EINVAL;
	+ }
	+ }
	+ nvlist_free(nv);
	+ }
	+
	+ zpool_close(zphdl);
	+ libzfs_fini(hdl);
	+ return (rv);
	+}

	Property changes on: vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_device.c
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_pair.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_pair.c (nonexistent)
	+++ vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_pair.c (revision 365892)
	@@ -0,0 +1,347 @@
	+/*
	+ * This file and its contents are supplied under the terms of the
	+ * Common Development and Distribution License ("CDDL"), version 1.0.
	+ * You may only use this file in accordance with the terms of version
	+ * 1.0 of the CDDL.
	+ *
	+ * A full copy of the text of the CDDL should have accompanied this
	+ * source. A copy of the CDDL is also available via the Internet at
	+ * http://www.illumos.org/license/CDDL.
	+ */
	+/*
	+ * Copyright 2020 Toomas Soome <tsoome@me.com>
	+ */
	+
	+#include <sys/types.h>
	+#include <string.h>
	+#include <libzfs.h>
	+#include <libzfsbootenv.h>
	+#include <sys/zfs_bootenv.h>
	+#include <sys/vdev_impl.h>
	+
	+/*
	+ * Get or create nvlist. If key is not NULL, get nvlist from bootenv,
	+ * otherwise return bootenv.
	+ */
	+int
	+lzbe_nvlist_get(const char pool, const char key, void **ptr)
	+{
	+ libzfs_handle_t *hdl;
	+ zpool_handle_t *zphdl;
	+ nvlist_t *nv;
	+ int rv = -1;
	+
	+ if (pool == NULL \|\| *pool == '\0')
	+ return (rv);
	+
	+ if ((hdl = libzfs_init()) == NULL) {
	+ return (rv);
	+ }
	+
	+ zphdl = zpool_open(hdl, pool);
	+ if (zphdl == NULL) {
	+ libzfs_fini(hdl);
	+ return (rv);
	+ }
	+
	+ rv = zpool_get_bootenv(zphdl, &nv);
	+ if (rv == 0) {
	+ nvlist_t nvl, dup;
	+
	+ if (key != NULL) {
	+ rv = nvlist_lookup_nvlist(nv, key, &nvl);
	+ if (rv == 0) {
	+ rv = nvlist_dup(nvl, &dup, 0);
	+ nvlist_free(nv);
	+ if (rv == 0)
	+ nv = dup;
	+ else
	+ nv = NULL;
	+ } else {
	+ nvlist_free(nv);
	+ rv = nvlist_alloc(&nv, NV_UNIQUE_NAME, 0);
	+ }
	+ }
	+ *ptr = nv;
	+ }
	+
	+ zpool_close(zphdl);
	+ libzfs_fini(hdl);
	+ return (rv);
	+}
	+
	+int
	+lzbe_nvlist_set(const char pool, const char key, void *ptr)
	+{
	+ libzfs_handle_t *hdl;
	+ zpool_handle_t *zphdl;
	+ nvlist_t *nv;
	+ uint64_t version;
	+ int rv = -1;
	+
	+ if (pool == NULL \|\| *pool == '\0')
	+ return (rv);
	+
	+ if ((hdl = libzfs_init()) == NULL) {
	+ return (rv);
	+ }
	+
	+ zphdl = zpool_open(hdl, pool);
	+ if (zphdl == NULL) {
	+ libzfs_fini(hdl);
	+ return (rv);
	+ }
	+
	+ if (key != NULL) {
	+ rv = zpool_get_bootenv(zphdl, &nv);
	+ if (rv == 0) {
	+ /*
	+ * We got the nvlist, check for version.
	+ * if version is missing or is not VB_NVLIST,
	+ * create new list.
	+ */
	+ rv = nvlist_lookup_uint64(nv, BOOTENV_VERSION,
	+ &version);
	+ if (rv != 0 \|\| version != VB_NVLIST) {
	+ /* Drop this nvlist */
	+ fnvlist_free(nv);
	+ /* Create and prepare new nvlist */
	+ nv = fnvlist_alloc();
	+ fnvlist_add_uint64(nv, BOOTENV_VERSION,
	+ VB_NVLIST);
	+ }
	+ rv = nvlist_add_nvlist(nv, key, ptr);
	+ if (rv == 0)
	+ rv = zpool_set_bootenv(zphdl, nv);
	+ nvlist_free(nv);
	+ }
	+ } else {
	+ rv = zpool_set_bootenv(zphdl, ptr);
	+ }
	+
	+ zpool_close(zphdl);
	+ libzfs_fini(hdl);
	+ return (rv);
	+}
	+
	+/*
	+ * free nvlist we got via lzbe_nvlist_get()
	+ */
	+void
	+lzbe_nvlist_free(void *ptr)
	+{
	+ nvlist_free(ptr);
	+}
	+
	+static const char *typenames[] = {
	+ "DATA_TYPE_UNKNOWN",
	+ "DATA_TYPE_BOOLEAN",
	+ "DATA_TYPE_BYTE",
	+ "DATA_TYPE_INT16",
	+ "DATA_TYPE_UINT16",
	+ "DATA_TYPE_INT32",
	+ "DATA_TYPE_UINT32",
	+ "DATA_TYPE_INT64",
	+ "DATA_TYPE_UINT64",
	+ "DATA_TYPE_STRING",
	+ "DATA_TYPE_BYTE_ARRAY",
	+ "DATA_TYPE_INT16_ARRAY",
	+ "DATA_TYPE_UINT16_ARRAY",
	+ "DATA_TYPE_INT32_ARRAY",
	+ "DATA_TYPE_UINT32_ARRAY",
	+ "DATA_TYPE_INT64_ARRAY",
	+ "DATA_TYPE_UINT64_ARRAY",
	+ "DATA_TYPE_STRING_ARRAY",
	+ "DATA_TYPE_HRTIME",
	+ "DATA_TYPE_NVLIST",
	+ "DATA_TYPE_NVLIST_ARRAY",
	+ "DATA_TYPE_BOOLEAN_VALUE",
	+ "DATA_TYPE_INT8",
	+ "DATA_TYPE_UINT8",
	+ "DATA_TYPE_BOOLEAN_ARRAY",
	+ "DATA_TYPE_INT8_ARRAY",
	+ "DATA_TYPE_UINT8_ARRAY"
	+};
	+
	+static int
	+nvpair_type_from_name(const char *name)
	+{
	+ unsigned i;
	+
	+ for (i = 0; i < ARRAY_SIZE(typenames); i++) {
	+ if (strcmp(name, typenames[i]) == 0)
	+ return (i);
	+ }
	+ return (0);
	+}
	+
	+/*
	+ * Add pair defined by key, type and value into nvlist.
	+ */
	+int
	+lzbe_add_pair(void ptr, const char key, const char type, void value,
	+ size_t size)
	+{
	+ nvlist_t *nv = ptr;
	+ data_type_t dt;
	+ int rv = 0;
	+
	+ if (ptr == NULL \|\| key == NULL \|\| value == NULL)
	+ return (rv);
	+
	+ if (type == NULL)
	+ type = "DATA_TYPE_STRING";
	+ dt = nvpair_type_from_name(type);
	+ if (dt == DATA_TYPE_UNKNOWN)
	+ return (EINVAL);
	+
	+ switch (dt) {
	+ case DATA_TYPE_BYTE:
	+ if (size != sizeof (uint8_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_byte(nv, key, (uint8_t )value);
	+ break;
	+
	+ case DATA_TYPE_INT16:
	+ if (size != sizeof (int16_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_int16(nv, key, (int16_t )value);
	+ break;
	+
	+ case DATA_TYPE_UINT16:
	+ if (size != sizeof (uint16_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_uint16(nv, key, (uint16_t )value);
	+ break;
	+
	+ case DATA_TYPE_INT32:
	+ if (size != sizeof (int32_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_int32(nv, key, (int32_t )value);
	+ break;
	+
	+ case DATA_TYPE_UINT32:
	+ if (size != sizeof (uint32_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_uint32(nv, key, (uint32_t )value);
	+ break;
	+
	+ case DATA_TYPE_INT64:
	+ if (size != sizeof (int64_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_int64(nv, key, (int64_t )value);
	+ break;
	+
	+ case DATA_TYPE_UINT64:
	+ if (size != sizeof (uint64_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_uint64(nv, key, (uint64_t )value);
	+ break;
	+
	+ case DATA_TYPE_STRING:
	+ rv = nvlist_add_string(nv, key, value);
	+ break;
	+
	+ case DATA_TYPE_BYTE_ARRAY:
	+ rv = nvlist_add_byte_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_INT16_ARRAY:
	+ rv = nvlist_add_int16_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_UINT16_ARRAY:
	+ rv = nvlist_add_uint16_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_INT32_ARRAY:
	+ rv = nvlist_add_int32_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_UINT32_ARRAY:
	+ rv = nvlist_add_uint32_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_INT64_ARRAY:
	+ rv = nvlist_add_int64_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_UINT64_ARRAY:
	+ rv = nvlist_add_uint64_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_STRING_ARRAY:
	+ rv = nvlist_add_string_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_NVLIST:
	+ rv = nvlist_add_nvlist(nv, key, (nvlist_t *)value);
	+ break;
	+
	+ case DATA_TYPE_NVLIST_ARRAY:
	+ rv = nvlist_add_nvlist_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_BOOLEAN_VALUE:
	+ if (size != sizeof (boolean_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_boolean_value(nv, key, (boolean_t )value);
	+ break;
	+
	+ case DATA_TYPE_INT8:
	+ if (size != sizeof (int8_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_int8(nv, key, (int8_t )value);
	+ break;
	+
	+ case DATA_TYPE_UINT8:
	+ if (size != sizeof (uint8_t)) {
	+ rv = EINVAL;
	+ break;
	+ }
	+ rv = nvlist_add_uint8(nv, key, (uint8_t )value);
	+ break;
	+
	+ case DATA_TYPE_BOOLEAN_ARRAY:
	+ rv = nvlist_add_boolean_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_INT8_ARRAY:
	+ rv = nvlist_add_int8_array(nv, key, value, size);
	+ break;
	+
	+ case DATA_TYPE_UINT8_ARRAY:
	+ rv = nvlist_add_uint8_array(nv, key, value, size);
	+ break;
	+
	+ default:
	+ return (ENOTSUP);
	+ }
	+
	+ return (rv);
	+}
	+
	+int
	+lzbe_remove_pair(void ptr, const char key)
	+{
	+
	+ return (nvlist_remove_all(ptr, key));
	+}

	Property changes on: vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_pair.c
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_util.c
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_util.c (nonexistent)
	+++ vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_util.c (revision 365892)
	@@ -0,0 +1,39 @@
	+/*
	+ * This file and its contents are supplied under the terms of the
	+ * Common Development and Distribution License ("CDDL"), version 1.0.
	+ * You may only use this file in accordance with the terms of version
	+ * 1.0 of the CDDL.
	+ *
	+ * A full copy of the text of the CDDL should have accompanied this
	+ * source. A copy of the CDDL is also available via the Internet at
	+ * http://www.illumos.org/license/CDDL.
	+ */
	+/*
	+ * Copyright 2020 Toomas Soome <tsoome@me.com>
	+ */
	+
	+#include <sys/types.h>
	+#include <string.h>
	+#include <libzfs.h>
	+#include <libzfsbootenv.h>
	+
	+/*
	+ * Output bootenv information.
	+ */
	+int
	+lzbe_bootenv_print(const char pool, const char nvlist, FILE *of)
	+{
	+ nvlist_t *nv;
	+ int rv = -1;
	+
	+ if (pool == NULL \|\| *pool == '\0' \|\| of == NULL)
	+ return (rv);
	+
	+ rv = lzbe_nvlist_get(pool, nvlist, (void **)&nv);
	+ if (rv == 0) {
	+ nvlist_print(of, nv);
	+ nvlist_free(nv);
	+ }
	+
	+ return (rv);
	+}

	Property changes on: vendor-sys/openzfs/dist/lib/libzfsbootenv/lzbe_util.c
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/lib/libzpool/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzpool/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzpool/Makefile.am (revision 365892)
	@@ -1,230 +1,237 @@
	include $(top_srcdir)/config/Rules.am

	VPATH = \
	$(top_srcdir)/module/zfs \
	$(top_srcdir)/module/zcommon \
	$(top_srcdir)/module/lua \
	$(top_srcdir)/module/os/linux/zfs \
	$(top_srcdir)/lib/libzpool

	+if BUILD_FREEBSD
	+DEFAULT_INCLUDES += -I$(top_srcdir)/include/os/freebsd/zfs
	+endif
	+if BUILD_LINUX
	+DEFAULT_INCLUDES += -I$(top_srcdir)/include/os/linux/zfs
	+endif
	+
	# Unconditionally enable debugging for libzpool
	AM_CPPFLAGS += -DDEBUG -UNDEBUG -DZFS_DEBUG

	# Suppress unused but set variable warnings often due to ASSERTs
	AM_CFLAGS += $(NO_UNUSED_BUT_SET_VARIABLE)

	# Includes kernel code generate warnings for large stack frames
	AM_CFLAGS += $(FRAME_LARGER_THAN)

	AM_CFLAGS += $(ZLIB_CFLAGS)

	AM_CFLAGS += -DLIB_ZPOOL_BUILD

	lib_LTLIBRARIES = libzpool.la

	USER_C = \
	kernel.c \
	taskq.c \
	util.c

	KERNEL_C = \
	zfeature_common.c \
	zfs_comutil.c \
	zfs_deleg.c \
	zfs_fletcher.c \
	zfs_fletcher_aarch64_neon.c \
	zfs_fletcher_avx512.c \
	zfs_fletcher_intel.c \
	zfs_fletcher_sse.c \
	zfs_fletcher_superscalar.c \
	zfs_fletcher_superscalar4.c \
	zfs_namecheck.c \
	zfs_prop.c \
	zfs_uio.c \
	zpool_prop.c \
	zprop_common.c \
	abd.c \
	abd_os.c \
	aggsum.c \
	arc.c \
	arc_os.c \
	blkptr.c \
	bplist.c \
	bpobj.c \
	bptree.c \
	btree.c \
	bqueue.c \
	cityhash.c \
	dbuf.c \
	dbuf_stats.c \
	ddt.c \
	ddt_zap.c \
	dmu.c \
	dmu_diff.c \
	dmu_object.c \
	dmu_objset.c \
	dmu_recv.c \
	dmu_redact.c \
	dmu_send.c \
	dmu_traverse.c \
	dmu_tx.c \
	dmu_zfetch.c \
	dnode.c \
	dnode_sync.c \
	dsl_bookmark.c \
	dsl_dataset.c \
	dsl_deadlist.c \
	dsl_deleg.c \
	dsl_dir.c \
	dsl_crypt.c \
	dsl_pool.c \
	dsl_prop.c \
	dsl_scan.c \
	dsl_synctask.c \
	dsl_destroy.c \
	dsl_userhold.c \
	edonr_zfs.c \
	hkdf.c \
	fm.c \
	gzip.c \
	lzjb.c \
	lz4.c \
	metaslab.c \
	mmp.c \
	multilist.c \
	objlist.c \
	pathname.c \
	range_tree.c \
	refcount.c \
	rrwlock.c \
	sa.c \
	sha256.c \
	skein_zfs.c \
	spa.c \
	spa_boot.c \
	spa_checkpoint.c \
	spa_config.c \
	spa_errlog.c \
	spa_history.c \
	spa_log_spacemap.c \
	spa_misc.c \
	spa_stats.c \
	space_map.c \
	space_reftree.c \
	txg.c \
	trace.c \
	uberblock.c \
	unique.c \
	vdev.c \
	vdev_cache.c \
	vdev_file.c \
	vdev_indirect_births.c \
	vdev_indirect.c \
	vdev_indirect_mapping.c \
	vdev_initialize.c \
	vdev_label.c \
	vdev_mirror.c \
	vdev_missing.c \
	vdev_queue.c \
	vdev_raidz.c \
	vdev_raidz_math_aarch64_neon.c \
	vdev_raidz_math_aarch64_neonx2.c \
	vdev_raidz_math_avx2.c \
	vdev_raidz_math_avx512bw.c \
	vdev_raidz_math_avx512f.c \
	vdev_raidz_math.c \
	vdev_raidz_math_scalar.c \
	vdev_raidz_math_sse2.c \
	vdev_raidz_math_ssse3.c \
	vdev_raidz_math_powerpc_altivec.c \
	vdev_rebuild.c \
	vdev_removal.c \
	vdev_root.c \
	vdev_trim.c \
	zap.c \
	zap_leaf.c \
	zap_micro.c \
	zcp.c \
	zcp_get.c \
	zcp_global.c \
	zcp_iter.c \
	zcp_set.c \
	zcp_synctask.c \
	zfeature.c \
	zfs_byteswap.c \
	zfs_debug.c \
	zfs_fm.c \
	zfs_fuid.c \
	zfs_sa.c \
	zfs_znode.c \
	zfs_ratelimit.c \
	zfs_rlock.c \
	zil.c \
	zio.c \
	zio_checksum.c \
	zio_compress.c \
	zio_crypt.c \
	zio_inject.c \
	zle.c \
	zrlock.c \
	zthr.c

	LUA_C = \
	lapi.c \
	lauxlib.c \
	lbaselib.c \
	lcode.c \
	lcompat.c \
	lcorolib.c \
	lctype.c \
	ldebug.c \
	ldo.c \
	lfunc.c \
	lgc.c \
	llex.c \
	lmem.c \
	lobject.c \
	lopcodes.c \
	lparser.c \
	lstate.c \
	lstring.c \
	lstrlib.c \
	ltable.c \
	ltablib.c \
	ltm.c \
	lvm.c \
	lzio.c

	dist_libzpool_la_SOURCES = \
	$(USER_C)

	nodist_libzpool_la_SOURCES = \
	$(KERNEL_C) \
	$(LUA_C)

	libzpool_la_LIBADD = \
	$(abs_top_builddir)/lib/libicp/libicp.la \
	$(abs_top_builddir)/lib/libunicode/libunicode.la \
	$(abs_top_builddir)/lib/libzfs_core/libzfs_core.la \
	$(abs_top_builddir)/lib/libnvpair/libnvpair.la \
	$(abs_top_builddir)/lib/libzstd/libzstd.la

	libzpool_la_LIBADD += $(LIBCLOCK_GETTIME) $(ZLIB_LIBS) -ldl

	libzpool_la_LDFLAGS = -pthread

	if !ASAN_ENABLED
	libzpool_la_LDFLAGS += -Wl,-z,defs
	endif

	if BUILD_FREEBSD
	libzpool_la_LIBADD += -lgeom
	libzpool_la_LDFLAGS += -version-info 4:0:0
	else
	libzpool_la_LDFLAGS += -version-info 2:0:0
	endif

	if TARGET_CPU_POWERPC
	vdev_raidz_math_powerpc_altivec.$(OBJEXT): CFLAGS += -maltivec
	vdev_raidz_math_powerpc_altivec.l$(OBJEXT): CFLAGS += -maltivec
	endif
	Index: vendor-sys/openzfs/dist/lib/libzutil/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/lib/libzutil/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/lib/libzutil/Makefile.am (revision 365892)
	@@ -1,50 +1,51 @@
	include $(top_srcdir)/config/Rules.am

	# Suppress unused but set variable warnings often due to ASSERTs
	AM_CFLAGS += $(NO_UNUSED_BUT_SET_VARIABLE)
	AM_CFLAGS += $(LIBBLKID_CFLAGS) $(LIBUDEV_CFLAGS)

	DEFAULT_INCLUDES += -I$(srcdir)

	noinst_LTLIBRARIES = libzutil.la

	USER_C = \
	zutil_device_path.c \
	zutil_import.c \
	zutil_import.h \
	zutil_nicenum.c \
	zutil_pool.c

	if BUILD_LINUX
	USER_C += \
	os/linux/zutil_device_path_os.c \
	os/linux/zutil_import_os.c \
	os/linux/zutil_compat.c
	endif

	if BUILD_FREEBSD
	DEFAULT_INCLUDES += -I$(top_srcdir)/include/os/freebsd/zfs

	USER_C += \
	os/freebsd/zutil_device_path_os.c \
	os/freebsd/zutil_import_os.c \
	os/freebsd/zutil_compat.c

	VPATH += $(top_srcdir)/module/os/freebsd/zfs

	nodist_libzutil_la_SOURCES = zfs_ioctl_compat.c
	endif

	libzutil_la_SOURCES = $(USER_C)

	libzutil_la_LIBADD = \
	$(abs_top_builddir)/lib/libavl/libavl.la \
	$(abs_top_builddir)/lib/libtpool/libtpool.la \
	+ $(abs_top_builddir)/lib/libnvpair/libnvpair.la \
	$(abs_top_builddir)/lib/libspl/libspl.la

	if BUILD_LINUX
	libzutil_la_LIBADD += \
	$(abs_top_builddir)/lib/libefi/libefi.la
	endif

	libzutil_la_LIBADD += -lm $(LIBBLKID_LIBS) $(LIBUDEV_LIBS)
	Index: vendor-sys/openzfs/dist/man/man5/zfs-module-parameters.5
	===================================================================
	--- vendor-sys/openzfs/dist/man/man5/zfs-module-parameters.5 (revision 365891)
	+++ vendor-sys/openzfs/dist/man/man5/zfs-module-parameters.5 (revision 365892)
	@@ -1,4098 +1,4157 @@
	'\" te
	.\" Copyright (c) 2013 by Turbo Fredriksson <turbo@bayour.com>. All rights reserved.
	-.\" Copyright (c) 2019 by Delphix. All rights reserved.
	+.\" Copyright (c) 2019, 2020 by Delphix. All rights reserved.
	.\" Copyright (c) 2019 Datto Inc.
	.\" The contents of this file are subject to the terms of the Common Development
	.\" and Distribution License (the "License"). You may not use this file except
	.\" in compliance with the License. You can obtain a copy of the license at
	.\" usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
	.\"
	.\" See the License for the specific language governing permissions and
	.\" limitations under the License. When distributing Covered Code, include this
	.\" CDDL HEADER in each file and include the License file at
	.\" usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this
	.\" CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your
	.\" own identifying information:
	.\" Portions Copyright [yyyy] [name of copyright owner]
	.TH ZFS-MODULE-PARAMETERS 5 "Aug 24, 2020" OpenZFS
	.SH NAME
	zfs\-module\-parameters \- ZFS module parameters
	.SH DESCRIPTION
	.sp
	.LP
	Description of the different parameters to the ZFS module.

	.SS "Module parameters"
	.sp
	.LP

	.sp
	.ne 2
	.na
	\fBdbuf_cache_max_bytes\fR (ulong)
	.ad
	.RS 12n
	Maximum size in bytes of the dbuf cache. The target size is determined by the
	MIN versus \fB1/2^dbuf_cache_shift\fR (1/32) of the target ARC size. The
	behavior of the dbuf cache and its associated settings can be observed via the
	\fB/proc/spl/kstat/zfs/dbufstats\fR kstat.
	.sp
	Default value: \fBULONG_MAX\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBdbuf_metadata_cache_max_bytes\fR (ulong)
	.ad
	.RS 12n
	Maximum size in bytes of the metadata dbuf cache. The target size is
	determined by the MIN versus \fB1/2^dbuf_metadata_cache_shift\fR (1/64) of the
	target ARC size. The behavior of the metadata dbuf cache and its associated
	settings can be observed via the \fB/proc/spl/kstat/zfs/dbufstats\fR kstat.
	.sp
	Default value: \fBULONG_MAX\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBdbuf_cache_hiwater_pct\fR (uint)
	.ad
	.RS 12n
	The percentage over \fBdbuf_cache_max_bytes\fR when dbufs must be evicted
	directly.
	.sp
	Default value: \fB10\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBdbuf_cache_lowater_pct\fR (uint)
	.ad
	.RS 12n
	The percentage below \fBdbuf_cache_max_bytes\fR when the evict thread stops
	evicting dbufs.
	.sp
	Default value: \fB10\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBdbuf_cache_shift\fR (int)
	.ad
	.RS 12n
	Set the size of the dbuf cache, \fBdbuf_cache_max_bytes\fR, to a log2 fraction
	of the target ARC size.
	.sp
	Default value: \fB5\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBdbuf_metadata_cache_shift\fR (int)
	.ad
	.RS 12n
	Set the size of the dbuf metadata cache, \fBdbuf_metadata_cache_max_bytes\fR,
	to a log2 fraction of the target ARC size.
	.sp
	Default value: \fB6\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBdmu_object_alloc_chunk_shift\fR (int)
	.ad
	.RS 12n
	dnode slots allocated in a single operation as a power of 2. The default value
	minimizes lock contention for the bulk operation performed.
	.sp
	Default value: \fB7\fR (128).
	.RE

	.sp
	.ne 2
	.na
	\fBdmu_prefetch_max\fR (int)
	.ad
	.RS 12n
	Limit the amount we can prefetch with one call to this amount (in bytes).
	This helps to limit the amount of memory that can be used by prefetching.
	.sp
	Default value: \fB134,217,728\fR (128MB).
	.RE

	.sp
	.ne 2
	.na
	\fBignore_hole_birth\fR (int)
	.ad
	.RS 12n
	This is an alias for \fBsend_holes_without_birth_time\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_feed_again\fR (int)
	.ad
	.RS 12n
	Turbo L2ARC warm-up. When the L2ARC is cold the fill interval will be set as
	fast as possible.
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR to disable.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_feed_min_ms\fR (ulong)
	.ad
	.RS 12n
	Min feed interval in milliseconds. Requires \fBl2arc_feed_again=1\fR and only
	applicable in related situations.
	.sp
	Default value: \fB200\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_feed_secs\fR (ulong)
	.ad
	.RS 12n
	Seconds between L2ARC writing
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_headroom\fR (ulong)
	.ad
	.RS 12n
	How far through the ARC lists to search for L2ARC cacheable content, expressed
	as a multiplier of \fBl2arc_write_max\fR.
	ARC persistence across reboots can be achieved with persistent L2ARC by setting
	this parameter to \fB0\fR allowing the full length of ARC lists to be searched
	for cacheable content.
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_headroom_boost\fR (ulong)
	.ad
	.RS 12n
	Scales \fBl2arc_headroom\fR by this percentage when L2ARC contents are being
	successfully compressed before writing. A value of \fB100\fR disables this
	feature.
	.sp
	Default value: \fB200\fR%.
	.RE

	.sp
	.ne 2
	.na
	+\fBl2arc_mfuonly\fR (int)
	+.ad
	+.RS 12n
	+Controls whether only MFU metadata and data are cached from ARC into L2ARC.
	+This may be desired to avoid wasting space on L2ARC when reading/writing large
	+amounts of data that are not expected to be accessed more than once. The
	+default is \fB0\fR, meaning both MRU and MFU data and metadata are cached.
	+When turning off (\fB0\fR) this feature some MRU buffers will still be present
	+in ARC and eventually cached on L2ARC.
	+.sp
	+Use \fB0\fR for no (default) and \fB1\fR for yes.
	+.RE
	+
	+.sp
	+.ne 2
	+.na
	\fBl2arc_meta_percent\fR (int)
	.ad
	.RS 12n
	Percent of ARC size allowed for L2ARC-only headers.
	Since L2ARC buffers are not evicted on memory pressure, too large amount of
	headers on system with irrationaly large L2ARC can render it slow or unusable.
	This parameter limits L2ARC writes and rebuild to achieve it.
	.sp
	Default value: \fB33\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_trim_ahead\fR (ulong)
	.ad
	.RS 12n
	Trims ahead of the current write size (\fBl2arc_write_max\fR) on L2ARC devices
	by this percentage of write size if we have filled the device. If set to
	\fB100\fR we TRIM twice the space required to accommodate upcoming writes. A
	minimum of 64MB will be trimmed. It also enables TRIM of the whole L2ARC device
	upon creation or addition to an existing pool or if the header of the device is
	invalid upon importing a pool or onlining a cache device. A value of \fB0\fR
	disables TRIM on L2ARC altogether and is the default as it can put significant
	stress on the underlying storage devices. This will vary depending of how well
	the specific device handles these commands.
	.sp
	Default value: \fB0\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_noprefetch\fR (int)
	.ad
	.RS 12n
	Do not write buffers to L2ARC if they were prefetched but not used by
	applications.
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR to disable.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_norw\fR (int)
	.ad
	.RS 12n
	No reads during writes.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_write_boost\fR (ulong)
	.ad
	.RS 12n
	Cold L2ARC devices will have \fBl2arc_write_max\fR increased by this amount
	while they remain cold.
	.sp
	Default value: \fB8,388,608\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_write_max\fR (ulong)
	.ad
	.RS 12n
	Max write bytes per interval.
	.sp
	Default value: \fB8,388,608\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_rebuild_enabled\fR (int)
	.ad
	.RS 12n
	Rebuild the L2ARC when importing a pool (persistent L2ARC). This can be
	disabled if there are problems importing a pool or attaching an L2ARC device
	(e.g. the L2ARC device is slow in reading stored log metadata, or the metadata
	has become somehow fragmented/unusable).
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR for no.
	.RE

	.sp
	.ne 2
	.na
	\fBl2arc_rebuild_blocks_min_l2size\fR (ulong)
	.ad
	.RS 12n
	Min size (in bytes) of an L2ARC device required in order to write log blocks
	in it. The log blocks are used upon importing the pool to rebuild
	the L2ARC (persistent L2ARC). Rationale: for L2ARC devices less than 1GB, the
	amount of data l2arc_evict() evicts is significant compared to the amount of
	restored L2ARC data. In this case do not write log blocks in L2ARC in order not
	to waste space.
	.sp
	Default value: \fB1,073,741,824\fR (1GB).
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_aliquot\fR (ulong)
	.ad
	.RS 12n
	Metaslab granularity, in bytes. This is roughly similar to what would be
	referred to as the "stripe size" in traditional RAID arrays. In normal
	operation, ZFS will try to write this amount of data to a top-level vdev
	before moving on to the next one.
	.sp
	Default value: \fB524,288\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_bias_enabled\fR (int)
	.ad
	.RS 12n
	Enable metaslab group biasing based on its vdev's over- or under-utilization
	relative to the pool.
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR for no.
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_force_ganging\fR (ulong)
	.ad
	.RS 12n
	Make some blocks above a certain size be gang blocks. This option is used
	by the test suite to facilitate testing.
	.sp
	Default value: \fB16,777,217\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_keep_log_spacemaps_at_export\fR (int)
	.ad
	.RS 12n
	Prevent log spacemaps from being destroyed during pool exports and destroys.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_metaslab_segment_weight_enabled\fR (int)
	.ad
	.RS 12n
	Enable/disable segment-based metaslab selection.
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR for no.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_metaslab_switch_threshold\fR (int)
	.ad
	.RS 12n
	When using segment-based metaslab selection, continue allocating
	from the active metaslab until \fBzfs_metaslab_switch_threshold\fR
	worth of buckets have been exhausted.
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_debug_load\fR (int)
	.ad
	.RS 12n
	Load all metaslabs during pool import.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_debug_unload\fR (int)
	.ad
	.RS 12n
	Prevent metaslabs from being unloaded.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_fragmentation_factor_enabled\fR (int)
	.ad
	.RS 12n
	Enable use of the fragmentation metric in computing metaslab weights.
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR for no.
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_df_max_search\fR (int)
	.ad
	.RS 12n
	Maximum distance to search forward from the last offset. Without this limit,
	fragmented pools can see >100,000 iterations and metaslab_block_picker()
	becomes the performance limiting factor on high-performance storage.

	With the default setting of 16MB, we typically see less than 500 iterations,
	even with very fragmented, ashift=9 pools. The maximum number of iterations
	possible is: \fBmetaslab_df_max_search / (2 * (1<<ashift))\fR.
	With the default setting of 16MB this is 16*1024 (with ashift=9) or 2048
	(with ashift=12).
	.sp
	Default value: \fB16,777,216\fR (16MB)
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_df_use_largest_segment\fR (int)
	.ad
	.RS 12n
	If we are not searching forward (due to metaslab_df_max_search,
	metaslab_df_free_pct, or metaslab_df_alloc_threshold), this tunable controls
	what segment is used. If it is set, we will use the largest free segment.
	If it is not set, we will use a segment of exactly the requested size (or
	larger).
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_metaslab_max_size_cache_sec\fR (ulong)
	.ad
	.RS 12n
	When we unload a metaslab, we cache the size of the largest free chunk. We use
	that cached size to determine whether or not to load a metaslab for a given
	allocation. As more frees accumulate in that metaslab while it's unloaded, the
	cached max size becomes less and less accurate. After a number of seconds
	controlled by this tunable, we stop considering the cached max size and start
	considering only the histogram instead.
	.sp
	Default value: \fB3600 seconds\fR (one hour)
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_metaslab_mem_limit\fR (int)
	.ad
	.RS 12n
	When we are loading a new metaslab, we check the amount of memory being used
	to store metaslab range trees. If it is over a threshold, we attempt to unload
	the least recently used metaslab to prevent the system from clogging all of
	its memory with range trees. This tunable sets the percentage of total system
	memory that is the threshold.
	.sp
	Default value: \fB25 percent\fR
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_default_ms_count\fR (int)
	.ad
	.RS 12n
	When a vdev is added target this number of metaslabs per top-level vdev.
	.sp
	Default value: \fB200\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_default_ms_shift\fR (int)
	.ad
	.RS 12n
	Default limit for metaslab size.
	.sp
	Default value: \fB29\fR [meaning (1 << 29) = 512MB].
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_max_auto_ashift\fR (ulong)
	.ad
	.RS 12n
	Maximum ashift used when optimizing for logical -> physical sector size on new
	top-level vdevs.
	.sp
	Default value: \fBASHIFT_MAX\fR (16).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_min_auto_ashift\fR (ulong)
	.ad
	.RS 12n
	Minimum ashift used when creating new top-level vdevs.
	.sp
	Default value: \fBASHIFT_MIN\fR (9).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_min_ms_count\fR (int)
	.ad
	.RS 12n
	Minimum number of metaslabs to create in a top-level vdev.
	.sp
	Default value: \fB16\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBvdev_validate_skip\fR (int)
	.ad
	.RS 12n
	Skip label validation steps during pool import. Changing is not recommended
	unless you know what you are doing and are recovering a damaged label.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_ms_count_limit\fR (int)
	.ad
	.RS 12n
	Practical upper limit of total metaslabs per top-level vdev.
	.sp
	Default value: \fB131,072\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_preload_enabled\fR (int)
	.ad
	.RS 12n
	Enable metaslab group preloading.
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR for no.
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_lba_weighting_enabled\fR (int)
	.ad
	.RS 12n
	Give more weight to metaslabs with lower LBAs, assuming they have
	greater bandwidth as is typically the case on a modern constant
	angular velocity disk drive.
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR for no.
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_unload_delay\fR (int)
	.ad
	.RS 12n
	After a metaslab is used, we keep it loaded for this many txgs, to attempt to
	reduce unnecessary reloading. Note that both this many txgs and
	\fBmetaslab_unload_delay_ms\fR milliseconds must pass before unloading will
	occur.
	.sp
	Default value: \fB32\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBmetaslab_unload_delay_ms\fR (int)
	.ad
	.RS 12n
	After a metaslab is used, we keep it loaded for this many milliseconds, to
	attempt to reduce unnecessary reloading. Note that both this many
	milliseconds and \fBmetaslab_unload_delay\fR txgs must pass before unloading
	will occur.
	.sp
	Default value: \fB600000\fR (ten minutes).
	.RE

	.sp
	.ne 2
	.na
	\fBsend_holes_without_birth_time\fR (int)
	.ad
	.RS 12n
	When set, the hole_birth optimization will not be used, and all holes will
	always be sent on zfs send. This is useful if you suspect your datasets are
	affected by a bug in hole_birth.
	.sp
	Use \fB1\fR for on (default) and \fB0\fR for off.
	.RE

	.sp
	.ne 2
	.na
	\fBspa_config_path\fR (charp)
	.ad
	.RS 12n
	SPA config file
	.sp
	Default value: \fB/etc/zfs/zpool.cache\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBspa_asize_inflation\fR (int)
	.ad
	.RS 12n
	Multiplication factor used to estimate actual disk consumption from the
	size of data being written. The default value is a worst case estimate,
	but lower values may be valid for a given pool depending on its
	configuration. Pool administrators who understand the factors involved
	may wish to specify a more realistic inflation factor, particularly if
	they operate close to quota or capacity limits.
	.sp
	Default value: \fB24\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBspa_load_print_vdev_tree\fR (int)
	.ad
	.RS 12n
	Whether to print the vdev tree in the debugging message buffer during pool import.
	Use 0 to disable and 1 to enable.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBspa_load_verify_data\fR (int)
	.ad
	.RS 12n
	Whether to traverse data blocks during an "extreme rewind" (\fB-X\fR)
	import. Use 0 to disable and 1 to enable.

	An extreme rewind import normally performs a full traversal of all
	blocks in the pool for verification. If this parameter is set to 0,
	the traversal skips non-metadata blocks. It can be toggled once the
	import has started to stop or start the traversal of non-metadata blocks.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBspa_load_verify_metadata\fR (int)
	.ad
	.RS 12n
	Whether to traverse blocks during an "extreme rewind" (\fB-X\fR)
	pool import. Use 0 to disable and 1 to enable.

	An extreme rewind import normally performs a full traversal of all
	blocks in the pool for verification. If this parameter is set to 0,
	the traversal is not performed. It can be toggled once the import has
	started to stop or start the traversal.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBspa_load_verify_shift\fR (int)
	.ad
	.RS 12n
	Sets the maximum number of bytes to consume during pool import to the log2
	fraction of the target ARC size.
	.sp
	Default value: \fB4\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBspa_slop_shift\fR (int)
	.ad
	.RS 12n
	Normally, we don't allow the last 3.2% (1/(2^spa_slop_shift)) of space
	in the pool to be consumed. This ensures that we don't run the pool
	completely out of space, due to unaccounted changes (e.g. to the MOS).
	It also limits the worst-case time to allocate space. If we have
	less than this amount of free space, most ZPL operations (e.g. write,
	create) will return ENOSPC.
	.sp
	Default value: \fB5\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBvdev_removal_max_span\fR (int)
	.ad
	.RS 12n
	During top-level vdev removal, chunks of data are copied from the vdev
	which may include free space in order to trade bandwidth for IOPS.
	This parameter determines the maximum span of free space (in bytes)
	which will be included as "unnecessary" data in a chunk of copied data.

	The default value here was chosen to align with
	\fBzfs_vdev_read_gap_limit\fR, which is a similar concept when doing
	regular reads (but there's no reason it has to be the same).
	.sp
	Default value: \fB32,768\fR.
	.RE

	.sp
	.ne 2
	.na
	+\fBvdev_file_logical_ashift\fR (ulong)
	+.ad
	+.RS 12n
	+Logical ashift for file-based devices.
	+.sp
	+Default value: \fB9\fR.
	+.RE
	+
	+.sp
	+.ne 2
	+.na
	+\fBvdev_file_physical_ashift\fR (ulong)
	+.ad
	+.RS 12n
	+Physical ashift for file-based devices.
	+.sp
	+Default value: \fB9\fR.
	+.RE
	+
	+.sp
	+.ne 2
	+.na
	\fBzap_iterate_prefetch\fR (int)
	.ad
	.RS 12n
	If this is set, when we start iterating over a ZAP object, zfs will prefetch
	the entire object (all leaf blocks). However, this is limited by
	\fBdmu_prefetch_max\fR.
	.sp
	Use \fB1\fR for on (default) and \fB0\fR for off.
	.RE

	.sp
	.ne 2
	.na
	\fBzfetch_array_rd_sz\fR (ulong)
	.ad
	.RS 12n
	If prefetching is enabled, disable prefetching for reads larger than this size.
	.sp
	Default value: \fB1,048,576\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfetch_max_distance\fR (uint)
	.ad
	.RS 12n
	Max bytes to prefetch per stream (default 8MB).
	.sp
	Default value: \fB8,388,608\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfetch_max_streams\fR (uint)
	.ad
	.RS 12n
	Max number of streams per zfetch (prefetch streams per file).
	.sp
	Default value: \fB8\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfetch_min_sec_reap\fR (uint)
	.ad
	.RS 12n
	Min time before an active prefetch stream can be reclaimed
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_abd_scatter_enabled\fR (int)
	.ad
	.RS 12n
	Enables ARC from using scatter/gather lists and forces all allocations to be
	linear in kernel memory. Disabling can improve performance in some code paths
	at the expense of fragmented kernel memory.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_abd_scatter_max_order\fR (iunt)
	.ad
	.RS 12n
	Maximum number of consecutive memory pages allocated in a single block for
	scatter/gather lists. Default value is specified by the kernel itself.
	.sp
	Default value: \fB10\fR at the time of this writing.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_abd_scatter_min_size\fR (uint)
	.ad
	.RS 12n
	This is the minimum allocation size that will use scatter (page-based)
	ABD's. Smaller allocations will use linear ABD's.
	.sp
	Default value: \fB1536\fR (512B and 1KB allocations will be linear).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_dnode_limit\fR (ulong)
	.ad
	.RS 12n
	When the number of bytes consumed by dnodes in the ARC exceeds this number of
	bytes, try to unpin some of it in response to demand for non-metadata. This
	value acts as a ceiling to the amount of dnode metadata, and defaults to 0 which
	indicates that a percent which is based on \fBzfs_arc_dnode_limit_percent\fR of
	the ARC meta buffers that may be used for dnodes.

	See also \fBzfs_arc_meta_prune\fR which serves a similar purpose but is used
	when the amount of metadata in the ARC exceeds \fBzfs_arc_meta_limit\fR rather
	than in response to overall demand for non-metadata.

	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_dnode_limit_percent\fR (ulong)
	.ad
	.RS 12n
	Percentage that can be consumed by dnodes of ARC meta buffers.
	.sp
	See also \fBzfs_arc_dnode_limit\fR which serves a similar purpose but has a
	higher priority if set to nonzero value.
	.sp
	Default value: \fB10\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_dnode_reduce_percent\fR (ulong)
	.ad
	.RS 12n
	Percentage of ARC dnodes to try to scan in response to demand for non-metadata
	when the number of bytes consumed by dnodes exceeds \fBzfs_arc_dnode_limit\fR.

	.sp
	Default value: \fB10\fR% of the number of dnodes in the ARC.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_average_blocksize\fR (int)
	.ad
	.RS 12n
	The ARC's buffer hash table is sized based on the assumption of an average
	block size of \fBzfs_arc_average_blocksize\fR (default 8K). This works out
	to roughly 1MB of hash table per 1GB of physical memory with 8-byte pointers.
	For configurations with a known larger average block size this value can be
	increased to reduce the memory footprint.

	.sp
	Default value: \fB8192\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_eviction_pct\fR (int)
	.ad
	.RS 12n
	When \fBarc_is_overflowing()\fR, \fBarc_get_data_impl()\fR waits for this
	percent of the requested amount of data to be evicted. For example, by
	default for every 2KB that's evicted, 1KB of it may be "reused" by a new
	allocation. Since this is above 100%, it ensures that progress is made
	towards getting \fBarc_size\fR under \fBarc_c\fR. Since this is finite, it
	ensures that allocations can still happen, even during the potentially long
	time that \fBarc_size\fR is more than \fBarc_c\fR.
	.sp
	Default value: \fB200\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_evict_batch_limit\fR (int)
	.ad
	.RS 12n
	Number ARC headers to evict per sub-list before proceeding to another sub-list.
	This batch-style operation prevents entire sub-lists from being evicted at once
	but comes at a cost of additional unlocking and locking.
	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_grow_retry\fR (int)
	.ad
	.RS 12n
	If set to a non zero value, it will replace the arc_grow_retry value with this value.
	The arc_grow_retry value (default 5) is the number of seconds the ARC will wait before
	trying to resume growth after a memory pressure event.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_lotsfree_percent\fR (int)
	.ad
	.RS 12n
	Throttle I/O when free system memory drops below this percentage of total
	system memory. Setting this value to 0 will disable the throttle.
	.sp
	Default value: \fB10\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_max\fR (ulong)
	.ad
	.RS 12n
	Max size of ARC in bytes. If set to 0 then the max size of ARC is determined
	by the amount of system memory installed. For Linux, 1/2 of system memory will
	be used as the limit. For FreeBSD, the larger of all system memory - 1GB or
	5/8 of system memory will be used as the limit. This value must be at least
	67108864 (64 megabytes).
	.sp
	This value can be changed dynamically with some caveats. It cannot be set back
	to 0 while running and reducing it below the current ARC size will not cause
	the ARC to shrink without memory pressure to induce shrinking.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_meta_adjust_restarts\fR (ulong)
	.ad
	.RS 12n
	The number of restart passes to make while scanning the ARC attempting
	the free buffers in order to stay below the \fBzfs_arc_meta_limit\fR.
	This value should not need to be tuned but is available to facilitate
	performance analysis.
	.sp
	Default value: \fB4096\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_meta_limit\fR (ulong)
	.ad
	.RS 12n
	The maximum allowed size in bytes that meta data buffers are allowed to
	consume in the ARC. When this limit is reached meta data buffers will
	be reclaimed even if the overall arc_c_max has not been reached. This
	value defaults to 0 which indicates that a percent which is based on
	\fBzfs_arc_meta_limit_percent\fR of the ARC may be used for meta data.
	.sp
	This value my be changed dynamically except that it cannot be set back to 0
	for a specific percent of the ARC; it must be set to an explicit value.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_meta_limit_percent\fR (ulong)
	.ad
	.RS 12n
	Percentage of ARC buffers that can be used for meta data.

	See also \fBzfs_arc_meta_limit\fR which serves a similar purpose but has a
	higher priority if set to nonzero value.

	.sp
	Default value: \fB75\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_meta_min\fR (ulong)
	.ad
	.RS 12n
	The minimum allowed size in bytes that meta data buffers may consume in
	the ARC. This value defaults to 0 which disables a floor on the amount
	of the ARC devoted meta data.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_meta_prune\fR (int)
	.ad
	.RS 12n
	The number of dentries and inodes to be scanned looking for entries
	which can be dropped. This may be required when the ARC reaches the
	\fBzfs_arc_meta_limit\fR because dentries and inodes can pin buffers
	in the ARC. Increasing this value will cause to dentry and inode caches
	to be pruned more aggressively. Setting this value to 0 will disable
	pruning the inode and dentry caches.
	.sp
	Default value: \fB10,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_meta_strategy\fR (int)
	.ad
	.RS 12n
	Define the strategy for ARC meta data buffer eviction (meta reclaim strategy).
	A value of 0 (META_ONLY) will evict only the ARC meta data buffers.
	A value of 1 (BALANCED) indicates that additional data buffers may be evicted if
	that is required to in order to evict the required number of meta data buffers.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_min\fR (ulong)
	.ad
	.RS 12n
	Min size of ARC in bytes. If set to 0 then arc_c_min will default to
	consuming the larger of 32M or 1/32 of total system memory.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_min_prefetch_ms\fR (int)
	.ad
	.RS 12n
	Minimum time prefetched blocks are locked in the ARC, specified in ms.
	A value of \fB0\fR will default to 1000 ms.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_min_prescient_prefetch_ms\fR (int)
	.ad
	.RS 12n
	Minimum time "prescient prefetched" blocks are locked in the ARC, specified
	in ms. These blocks are meant to be prefetched fairly aggressively ahead of
	the code that may use them. A value of \fB0\fR will default to 6000 ms.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_max_missing_tvds\fR (int)
	.ad
	.RS 12n
	Number of missing top-level vdevs which will be allowed during
	pool import (only in read-only mode).
	.sp
	Default value: \fB0\fR
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_max_nvlist_src_size\fR (ulong)
	.ad
	.RS 12n
	Maximum size in bytes allowed to be passed as zc_nvlist_src_size for ioctls on
	/dev/zfs. This prevents a user from causing the kernel to allocate an excessive
	amount of memory. When the limit is exceeded, the ioctl fails with EINVAL and a
	description of the error is sent to the zfs-dbgmsg log. This parameter should
	not need to be touched under normal circumstances. On FreeBSD, the default is
	based on the system limit on user wired memory. On Linux, the default is
	\fBKMALLOC_MAX_SIZE\fR .
	.sp
	Default value: \fB0\fR (kernel decides)
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_multilist_num_sublists\fR (int)
	.ad
	.RS 12n
	To allow more fine-grained locking, each ARC state contains a series
	of lists for both data and meta data objects. Locking is performed at
	the level of these "sub-lists". This parameters controls the number of
	sub-lists per ARC state, and also applies to other uses of the
	multilist data structure.
	.sp
	Default value: \fB4\fR or the number of online CPUs, whichever is greater
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_overflow_shift\fR (int)
	.ad
	.RS 12n
	The ARC size is considered to be overflowing if it exceeds the current
	ARC target size (arc_c) by a threshold determined by this parameter.
	The threshold is calculated as a fraction of arc_c using the formula
	"arc_c >> \fBzfs_arc_overflow_shift\fR".

	The default value of 8 causes the ARC to be considered to be overflowing
	if it exceeds the target size by 1/256th (0.3%) of the target size.

	When the ARC is overflowing, new buffer allocations are stalled until
	the reclaim thread catches up and the overflow condition no longer exists.
	.sp
	Default value: \fB8\fR.
	.RE

	.sp
	.ne 2
	.na

	\fBzfs_arc_p_min_shift\fR (int)
	.ad
	.RS 12n
	If set to a non zero value, this will update arc_p_min_shift (default 4)
	with the new value.
	arc_p_min_shift is used to shift of arc_c for calculating both min and max
	max arc_p
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_p_dampener_disable\fR (int)
	.ad
	.RS 12n
	Disable arc_p adapt dampener
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR to disable.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_shrink_shift\fR (int)
	.ad
	.RS 12n
	If set to a non zero value, this will update arc_shrink_shift (default 7)
	with the new value.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_pc_percent\fR (uint)
	.ad
	.RS 12n
	Percent of pagecache to reclaim arc to

	This tunable allows ZFS arc to play more nicely with the kernel's LRU
	pagecache. It can guarantee that the ARC size won't collapse under scanning
	pressure on the pagecache, yet still allows arc to be reclaimed down to
	zfs_arc_min if necessary. This value is specified as percent of pagecache
	size (as measured by NR_FILE_PAGES) where that percent may exceed 100. This
	only operates during memory pressure/reclaim.
	.sp
	Default value: \fB0\fR% (disabled).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_shrinker_limit\fR (int)
	.ad
	.RS 12n
	This is a limit on how many pages the ARC shrinker makes available for
	eviction in response to one page allocation attempt. Note that in
	practice, the kernel's shrinker can ask us to evict up to about 4x this
	for one allocation attempt.
	.sp
	The default limit of 10,000 (in practice, 160MB per allocation attempt with
	4K pages) limits the amount of time spent attempting to reclaim ARC memory to
	less than 100ms per allocation attempt, even with a small average compressed
	block size of ~8KB.
	.sp
	The parameter can be set to 0 (zero) to disable the limit.
	.sp
	This parameter only applies on Linux.
	.sp
	Default value: \fB10,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_arc_sys_free\fR (ulong)
	.ad
	.RS 12n
	The target number of bytes the ARC should leave as free memory on the system.
	Defaults to the larger of 1/64 of physical memory or 512K. Setting this
	option to a non-zero value will override the default.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_autoimport_disable\fR (int)
	.ad
	.RS 12n
	Disable pool import at module load by ignoring the cache file (typically \fB/etc/zfs/zpool.cache\fR).
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR for no.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_checksum_events_per_second\fR (uint)
	.ad
	.RS 12n
	Rate limit checksum events to this many per second. Note that this should
	not be set below the zed thresholds (currently 10 checksums over 10 sec)
	or else zed may not trigger any action.
	.sp
	Default value: 20
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_commit_timeout_pct\fR (int)
	.ad
	.RS 12n
	This controls the amount of time that a ZIL block (lwb) will remain "open"
	when it isn't "full", and it has a thread waiting for it to be committed to
	stable storage. The timeout is scaled based on a percentage of the last lwb
	latency to avoid significantly impacting the latency of each individual
	transaction record (itx).
	.sp
	Default value: \fB5\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_condense_indirect_commit_entry_delay_ms\fR (int)
	.ad
	.RS 12n
	Vdev indirection layer (used for device removal) sleeps for this many
	milliseconds during mapping generation. Intended for use with the test suite
	to throttle vdev removal speed.
	.sp
	Default value: \fB0\fR (no throttle).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_condense_indirect_vdevs_enable\fR (int)
	.ad
	.RS 12n
	Enable condensing indirect vdev mappings. When set to a non-zero value,
	attempt to condense indirect vdev mappings if the mapping uses more than
	\fBzfs_condense_min_mapping_bytes\fR bytes of memory and if the obsolete
	space map object uses more than \fBzfs_condense_max_obsolete_bytes\fR
	bytes on-disk. The condensing process is an attempt to save memory by
	removing obsolete mappings.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_condense_max_obsolete_bytes\fR (ulong)
	.ad
	.RS 12n
	Only attempt to condense indirect vdev mappings if the on-disk size
	of the obsolete space map object is greater than this number of bytes
	(see \fBfBzfs_condense_indirect_vdevs_enable\fR).
	.sp
	Default value: \fB1,073,741,824\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_condense_min_mapping_bytes\fR (ulong)
	.ad
	.RS 12n
	Minimum size vdev mapping to attempt to condense (see
	\fBzfs_condense_indirect_vdevs_enable\fR).
	.sp
	Default value: \fB131,072\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dbgmsg_enable\fR (int)
	.ad
	.RS 12n
	Internally ZFS keeps a small log to facilitate debugging. By default the log
	is disabled, to enable it set this option to 1. The contents of the log can
	be accessed by reading the /proc/spl/kstat/zfs/dbgmsg file. Writing 0 to
	this proc file clears the log.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dbgmsg_maxsize\fR (int)
	.ad
	.RS 12n
	The maximum size in bytes of the internal ZFS debug log.
	.sp
	Default value: \fB4M\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dbuf_state_index\fR (int)
	.ad
	.RS 12n
	This feature is currently unused. It is normally used for controlling what
	reporting is available under /proc/spl/kstat/zfs.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_deadman_enabled\fR (int)
	.ad
	.RS 12n
	When a pool sync operation takes longer than \fBzfs_deadman_synctime_ms\fR
	milliseconds, or when an individual I/O takes longer than
	\fBzfs_deadman_ziotime_ms\fR milliseconds, then the operation is considered to
	be "hung". If \fBzfs_deadman_enabled\fR is set then the deadman behavior is
	invoked as described by the \fBzfs_deadman_failmode\fR module option.
	By default the deadman is enabled and configured to \fBwait\fR which results
	in "hung" I/Os only being logged. The deadman is automatically disabled
	when a pool gets suspended.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_deadman_failmode\fR (charp)
	.ad
	.RS 12n
	Controls the failure behavior when the deadman detects a "hung" I/O. Valid
	values are \fBwait\fR, \fBcontinue\fR, and \fBpanic\fR.
	.sp
	\fBwait\fR - Wait for a "hung" I/O to complete. For each "hung" I/O a
	"deadman" event will be posted describing that I/O.
	.sp
	\fBcontinue\fR - Attempt to recover from a "hung" I/O by re-dispatching it
	to the I/O pipeline if possible.
	.sp
	\fBpanic\fR - Panic the system. This can be used to facilitate an automatic
	fail-over to a properly configured fail-over partner.
	.sp
	Default value: \fBwait\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_deadman_checktime_ms\fR (int)
	.ad
	.RS 12n
	Check time in milliseconds. This defines the frequency at which we check
	for hung I/O and potentially invoke the \fBzfs_deadman_failmode\fR behavior.
	.sp
	Default value: \fB60,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_deadman_synctime_ms\fR (ulong)
	.ad
	.RS 12n
	Interval in milliseconds after which the deadman is triggered and also
	the interval after which a pool sync operation is considered to be "hung".
	Once this limit is exceeded the deadman will be invoked every
	\fBzfs_deadman_checktime_ms\fR milliseconds until the pool sync completes.
	.sp
	Default value: \fB600,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_deadman_ziotime_ms\fR (ulong)
	.ad
	.RS 12n
	Interval in milliseconds after which the deadman is triggered and an
	individual I/O operation is considered to be "hung". As long as the I/O
	remains "hung" the deadman will be invoked every \fBzfs_deadman_checktime_ms\fR
	milliseconds until the I/O completes.
	.sp
	Default value: \fB300,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dedup_prefetch\fR (int)
	.ad
	.RS 12n
	Enable prefetching dedup-ed blks
	.sp
	Use \fB1\fR for yes and \fB0\fR to disable (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_delay_min_dirty_percent\fR (int)
	.ad
	.RS 12n
	Start to delay each transaction once there is this amount of dirty data,
	expressed as a percentage of \fBzfs_dirty_data_max\fR.
	This value should be >= zfs_vdev_async_write_active_max_dirty_percent.
	See the section "ZFS TRANSACTION DELAY".
	.sp
	Default value: \fB60\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_delay_scale\fR (int)
	.ad
	.RS 12n
	This controls how quickly the transaction delay approaches infinity.
	Larger values cause longer delays for a given amount of dirty data.
	.sp
	For the smoothest delay, this value should be about 1 billion divided
	by the maximum number of operations per second. This will smoothly
	handle between 10x and 1/10th this number.
	.sp
	See the section "ZFS TRANSACTION DELAY".
	.sp
	Note: \fBzfs_delay_scale\fR * \fBzfs_dirty_data_max\fR must be < 2^64.
	.sp
	Default value: \fB500,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_disable_ivset_guid_check\fR (int)
	.ad
	.RS 12n
	Disables requirement for IVset guids to be present and match when doing a raw
	receive of encrypted datasets. Intended for users whose pools were created with
	ZFS on Linux pre-release versions and now have compatibility issues.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_key_max_salt_uses\fR (ulong)
	.ad
	.RS 12n
	Maximum number of uses of a single salt value before generating a new one for
	encrypted datasets. The default value is also the maximum that will be
	accepted.
	.sp
	Default value: \fB400,000,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_object_mutex_size\fR (uint)
	.ad
	.RS 12n
	Size of the znode hashtable used for holds.

	Due to the need to hold locks on objects that may not exist yet, kernel mutexes
	are not created per-object and instead a hashtable is used where collisions
	will result in objects waiting when there is not actually contention on the
	same object.
	.sp
	Default value: \fB64\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_slow_io_events_per_second\fR (int)
	.ad
	.RS 12n
	Rate limit delay zevents (which report slow I/Os) to this many per second.
	.sp
	Default value: 20
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_unflushed_max_mem_amt\fR (ulong)
	.ad
	.RS 12n
	Upper-bound limit for unflushed metadata changes to be held by the
	log spacemap in memory (in bytes).
	.sp
	Default value: \fB1,073,741,824\fR (1GB).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_unflushed_max_mem_ppm\fR (ulong)
	.ad
	.RS 12n
	Percentage of the overall system memory that ZFS allows to be used
	for unflushed metadata changes by the log spacemap.
	(value is calculated over 1000000 for finer granularity).
	.sp
	Default value: \fB1000\fR (which is divided by 1000000, resulting in
	the limit to be \fB0.1\fR% of memory)
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_unflushed_log_block_max\fR (ulong)
	.ad
	.RS 12n
	Describes the maximum number of log spacemap blocks allowed for each pool.
	The default value of 262144 means that the space in all the log spacemaps
	can add up to no more than 262144 blocks (which means 32GB of logical
	space before compression and ditto blocks, assuming that blocksize is
	128k).
	.sp
	This tunable is important because it involves a trade-off between import
	time after an unclean export and the frequency of flushing metaslabs.
	The higher this number is, the more log blocks we allow when the pool is
	active which means that we flush metaslabs less often and thus decrease
	the number of I/Os for spacemap updates per TXG.
	At the same time though, that means that in the event of an unclean export,
	there will be more log spacemap blocks for us to read, inducing overhead
	in the import time of the pool.
	The lower the number, the amount of flushing increases destroying log
	blocks quicker as they become obsolete faster, which leaves less blocks
	to be read during import time after a crash.
	.sp
	Each log spacemap block existing during pool import leads to approximately
	one extra logical I/O issued.
	This is the reason why this tunable is exposed in terms of blocks rather
	than space used.
	.sp
	Default value: \fB262144\fR (256K).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_unflushed_log_block_min\fR (ulong)
	.ad
	.RS 12n
	If the number of metaslabs is small and our incoming rate is high, we
	could get into a situation that we are flushing all our metaslabs every
	TXG.
	Thus we always allow at least this many log blocks.
	.sp
	Default value: \fB1000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_unflushed_log_block_pct\fR (ulong)
	.ad
	.RS 12n
	Tunable used to determine the number of blocks that can be used for
	the spacemap log, expressed as a percentage of the total number of
	metaslabs in the pool.
	.sp
	Default value: \fB400\fR (read as \fB400\fR% - meaning that the number
	of log spacemap blocks are capped at 4 times the number of
	metaslabs in the pool).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_unlink_suspend_progress\fR (uint)
	.ad
	.RS 12n
	When enabled, files will not be asynchronously removed from the list of pending
	unlinks and the space they consume will be leaked. Once this option has been
	disabled and the dataset is remounted, the pending unlinks will be processed
	and the freed space returned to the pool.
	This option is used by the test suite to facilitate testing.
	.sp
	Uses \fB0\fR (default) to allow progress and \fB1\fR to pause progress.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_delete_blocks\fR (ulong)
	.ad
	.RS 12n
	This is the used to define a large file for the purposes of delete. Files
	containing more than \fBzfs_delete_blocks\fR will be deleted asynchronously
	while smaller files are deleted synchronously. Decreasing this value will
	reduce the time spent in an unlink(2) system call at the expense of a longer
	delay before the freed space is available.
	.sp
	Default value: \fB20,480\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dirty_data_max\fR (int)
	.ad
	.RS 12n
	Determines the dirty space limit in bytes. Once this limit is exceeded, new
	writes are halted until space frees up. This parameter takes precedence
	over \fBzfs_dirty_data_max_percent\fR.
	See the section "ZFS TRANSACTION DELAY".
	.sp
	Default value: \fB10\fR% of physical RAM, capped at \fBzfs_dirty_data_max_max\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dirty_data_max_max\fR (int)
	.ad
	.RS 12n
	Maximum allowable value of \fBzfs_dirty_data_max\fR, expressed in bytes.
	This limit is only enforced at module load time, and will be ignored if
	\fBzfs_dirty_data_max\fR is later changed. This parameter takes
	precedence over \fBzfs_dirty_data_max_max_percent\fR. See the section
	"ZFS TRANSACTION DELAY".
	.sp
	Default value: \fB25\fR% of physical RAM.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dirty_data_max_max_percent\fR (int)
	.ad
	.RS 12n
	Maximum allowable value of \fBzfs_dirty_data_max\fR, expressed as a
	percentage of physical RAM. This limit is only enforced at module load
	time, and will be ignored if \fBzfs_dirty_data_max\fR is later changed.
	The parameter \fBzfs_dirty_data_max_max\fR takes precedence over this
	one. See the section "ZFS TRANSACTION DELAY".
	.sp
	Default value: \fB25\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dirty_data_max_percent\fR (int)
	.ad
	.RS 12n
	Determines the dirty space limit, expressed as a percentage of all
	memory. Once this limit is exceeded, new writes are halted until space frees
	up. The parameter \fBzfs_dirty_data_max\fR takes precedence over this
	one. See the section "ZFS TRANSACTION DELAY".
	.sp
	Default value: \fB10\fR%, subject to \fBzfs_dirty_data_max_max\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dirty_data_sync_percent\fR (int)
	.ad
	.RS 12n
	Start syncing out a transaction group if there's at least this much dirty data
	as a percentage of \fBzfs_dirty_data_max\fR. This should be less than
	\fBzfs_vdev_async_write_active_min_dirty_percent\fR.
	.sp
	Default value: \fB20\fR% of \fBzfs_dirty_data_max\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_fallocate_reserve_percent\fR (uint)
	.ad
	.RS 12n
	Since ZFS is a copy-on-write filesystem with snapshots, blocks cannot be
	preallocated for a file in order to guarantee that later writes will not
	run out of space. Instead, fallocate() space preallocation only checks
	that sufficient space is currently available in the pool or the user's
	project quota allocation, and then creates a sparse file of the requested
	size. The requested space is multiplied by \fBzfs_fallocate_reserve_percent\fR
	to allow additional space for indirect blocks and other internal metadata.
	Setting this value to 0 disables support for fallocate(2) and returns
	EOPNOTSUPP for fallocate() space preallocation again.
	.sp
	Default value: \fB110\fR%
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_fletcher_4_impl\fR (string)
	.ad
	.RS 12n
	Select a fletcher 4 implementation.
	.sp
	Supported selectors are: \fBfastest\fR, \fBscalar\fR, \fBsse2\fR, \fBssse3\fR,
	\fBavx2\fR, \fBavx512f\fR, \fBavx512bw\fR, and \fBaarch64_neon\fR.
	All of the selectors except \fBfastest\fR and \fBscalar\fR require instruction
	set extensions to be available and will only appear if ZFS detects that they are
	present at runtime. If multiple implementations of fletcher 4 are available,
	the \fBfastest\fR will be chosen using a micro benchmark. Selecting \fBscalar\fR
	results in the original, CPU based calculation, being used. Selecting any option
	other than \fBfastest\fR and \fBscalar\fR results in vector instructions from
	the respective CPU instruction set being used.
	.sp
	Default value: \fBfastest\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_free_bpobj_enabled\fR (int)
	.ad
	.RS 12n
	Enable/disable the processing of the free_bpobj object.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_async_block_max_blocks\fR (ulong)
	.ad
	.RS 12n
	Maximum number of blocks freed in a single txg.
	.sp
	Default value: \fBULONG_MAX\fR (unlimited).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_max_async_dedup_frees\fR (ulong)
	.ad
	.RS 12n
	Maximum number of dedup blocks freed in a single txg.
	.sp
	Default value: \fB100,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_override_estimate_recordsize\fR (ulong)
	.ad
	.RS 12n
	Record size calculation override for zfs send estimates.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_async_read_max_active\fR (int)
	.ad
	.RS 12n
	Maximum asynchronous read I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB3\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_async_read_min_active\fR (int)
	.ad
	.RS 12n
	Minimum asynchronous read I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_async_write_active_max_dirty_percent\fR (int)
	.ad
	.RS 12n
	When the pool has more than
	\fBzfs_vdev_async_write_active_max_dirty_percent\fR dirty data, use
	\fBzfs_vdev_async_write_max_active\fR to limit active async writes. If
	the dirty data is between min and max, the active I/O limit is linearly
	interpolated. See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB60\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_async_write_active_min_dirty_percent\fR (int)
	.ad
	.RS 12n
	When the pool has less than
	\fBzfs_vdev_async_write_active_min_dirty_percent\fR dirty data, use
	\fBzfs_vdev_async_write_min_active\fR to limit active async writes. If
	the dirty data is between min and max, the active I/O limit is linearly
	interpolated. See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB30\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_async_write_max_active\fR (int)
	.ad
	.RS 12n
	Maximum asynchronous write I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_async_write_min_active\fR (int)
	.ad
	.RS 12n
	Minimum asynchronous write I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Lower values are associated with better latency on rotational media but poorer
	resilver performance. The default value of 2 was chosen as a compromise. A
	value of 3 has been shown to improve resilver performance further at a cost of
	further increasing latency.
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_initializing_max_active\fR (int)
	.ad
	.RS 12n
	Maximum initializing I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_initializing_min_active\fR (int)
	.ad
	.RS 12n
	Minimum initializing I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_max_active\fR (int)
	.ad
	.RS 12n
	The maximum number of I/Os active to each device. Ideally, this will be >=
	the sum of each queue's max_active. It must be at least the sum of each
	queue's min_active. See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_rebuild_max_active\fR (int)
	.ad
	.RS 12n
	Maximum sequential resilver I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB3\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_rebuild_min_active\fR (int)
	.ad
	.RS 12n
	Minimum sequential resilver I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_removal_max_active\fR (int)
	.ad
	.RS 12n
	Maximum removal I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_removal_min_active\fR (int)
	.ad
	.RS 12n
	Minimum removal I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_scrub_max_active\fR (int)
	.ad
	.RS 12n
	Maximum scrub I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_scrub_min_active\fR (int)
	.ad
	.RS 12n
	Minimum scrub I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_sync_read_max_active\fR (int)
	.ad
	.RS 12n
	Maximum synchronous read I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_sync_read_min_active\fR (int)
	.ad
	.RS 12n
	Minimum synchronous read I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_sync_write_max_active\fR (int)
	.ad
	.RS 12n
	Maximum synchronous write I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_sync_write_min_active\fR (int)
	.ad
	.RS 12n
	Minimum synchronous write I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_trim_max_active\fR (int)
	.ad
	.RS 12n
	Maximum trim/discard I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_trim_min_active\fR (int)
	.ad
	.RS 12n
	Minimum trim/discard I/Os active to each device.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_queue_depth_pct\fR (int)
	.ad
	.RS 12n
	Maximum number of queued allocations per top-level vdev expressed as
	a percentage of \fBzfs_vdev_async_write_max_active\fR which allows the
	system to detect devices that are more capable of handling allocations
	and to allocate more blocks to those devices. It allows for dynamic
	allocation distribution when devices are imbalanced as fuller devices
	will tend to be slower than empty devices.

	See also \fBzio_dva_throttle_enabled\fR.
	.sp
	Default value: \fB1000\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_expire_snapshot\fR (int)
	.ad
	.RS 12n
	Seconds to expire .zfs/snapshot
	.sp
	Default value: \fB300\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_admin_snapshot\fR (int)
	.ad
	.RS 12n
	Allow the creation, removal, or renaming of entries in the .zfs/snapshot
	directory to cause the creation, destruction, or renaming of snapshots.
	When enabled this functionality works both locally and over NFS exports
	which have the 'no_root_squash' option set. This functionality is disabled
	by default.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_flags\fR (int)
	.ad
	.RS 12n
	Set additional debugging flags. The following flags may be bitwise-or'd
	together.
	.sp
	.TS
	box;
	rB lB
	lB lB
	r l.
	Value Symbolic Name
	Description
	_
	1 ZFS_DEBUG_DPRINTF
	Enable dprintf entries in the debug log.
	_
	2 ZFS_DEBUG_DBUF_VERIFY *
	Enable extra dbuf verifications.
	_
	4 ZFS_DEBUG_DNODE_VERIFY *
	Enable extra dnode verifications.
	_
	8 ZFS_DEBUG_SNAPNAMES
	Enable snapshot name verification.
	_
	16 ZFS_DEBUG_MODIFY
	Check for illegally modified ARC buffers.
	_
	64 ZFS_DEBUG_ZIO_FREE
	Enable verification of block frees.
	_
	128 ZFS_DEBUG_HISTOGRAM_VERIFY
	Enable extra spacemap histogram verifications.
	_
	256 ZFS_DEBUG_METASLAB_VERIFY
	Verify space accounting on disk matches in-core range_trees.
	_
	512 ZFS_DEBUG_SET_ERROR
	Enable SET_ERROR and dprintf entries in the debug log.
	_
	1024 ZFS_DEBUG_INDIRECT_REMAP
	Verify split blocks created by device removal.
	_
	2048 ZFS_DEBUG_TRIM
	Verify TRIM ranges are always within the allocatable range tree.
	_
	4096 ZFS_DEBUG_LOG_SPACEMAP
	Verify that the log summary is consistent with the spacemap log
	and enable zfs_dbgmsgs for metaslab loading and flushing.
	.TE
	.sp
	* Requires debug build.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_free_leak_on_eio\fR (int)
	.ad
	.RS 12n
	If destroy encounters an EIO while reading metadata (e.g. indirect
	blocks), space referenced by the missing metadata can not be freed.
	Normally this causes the background destroy to become "stalled", as
	it is unable to make forward progress. While in this stalled state,
	all remaining space to free from the error-encountering filesystem is
	"temporarily leaked". Set this flag to cause it to ignore the EIO,
	permanently leak the space from indirect blocks that can not be read,
	and continue to free everything else that it can.

	The default, "stalling" behavior is useful if the storage partially
	fails (i.e. some but not all i/os fail), and then later recovers. In
	this case, we will be able to continue pool operations while it is
	partially failed, and when it recovers, we can continue to free the
	space, with no leaks. However, note that this case is actually
	fairly rare.

	Typically pools either (a) fail completely (but perhaps temporarily,
	e.g. a top-level vdev going offline), or (b) have localized,
	permanent errors (e.g. disk returns the wrong data due to bit flip or
	firmware bug). In case (a), this setting does not matter because the
	pool will be suspended and the sync thread will not be able to make
	forward progress regardless. In case (b), because the error is
	permanent, the best we can do is leak the minimum amount of space,
	which is what setting this flag will do. Therefore, it is reasonable
	for this flag to normally be set, but we chose the more conservative
	approach of not setting it, so that there is no possibility of
	leaking space in the "partial temporary" failure case.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_free_min_time_ms\fR (int)
	.ad
	.RS 12n
	During a \fBzfs destroy\fR operation using \fBfeature@async_destroy\fR a minimum
	of this much time will be spent working on freeing blocks per txg.
	.sp
	Default value: \fB1,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_obsolete_min_time_ms\fR (int)
	.ad
	.RS 12n
	Similar to \fBzfs_free_min_time_ms\fR but for cleanup of old indirection records
	for removed vdevs.
	.sp
	Default value: \fB500\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_immediate_write_sz\fR (long)
	.ad
	.RS 12n
	Largest data block to write to zil. Larger blocks will be treated as if the
	dataset being written to had the property setting \fBlogbias=throughput\fR.
	.sp
	Default value: \fB32,768\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_initialize_value\fR (ulong)
	.ad
	.RS 12n
	Pattern written to vdev free space by \fBzpool initialize\fR.
	.sp
	Default value: \fB16,045,690,984,833,335,022\fR (0xdeadbeefdeadbeee).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_initialize_chunk_size\fR (ulong)
	.ad
	.RS 12n
	Size of writes used by \fBzpool initialize\fR.
	This option is used by the test suite to facilitate testing.
	.sp
	Default value: \fB1,048,576\fR
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_livelist_max_entries\fR (ulong)
	.ad
	.RS 12n
	The threshold size (in block pointers) at which we create a new sub-livelist.
	Larger sublists are more costly from a memory perspective but the fewer
	sublists there are, the lower the cost of insertion.
	.sp
	Default value: \fB500,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_livelist_min_percent_shared\fR (int)
	.ad
	.RS 12n
	If the amount of shared space between a snapshot and its clone drops below
	this threshold, the clone turns off the livelist and reverts to the old deletion
	method. This is in place because once a clone has been overwritten enough
	livelists no long give us a benefit.
	.sp
	Default value: \fB75\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_livelist_condense_new_alloc\fR (int)
	.ad
	.RS 12n
	Incremented each time an extra ALLOC blkptr is added to a livelist entry while
	it is being condensed.
	This option is used by the test suite to track race conditions.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_livelist_condense_sync_cancel\fR (int)
	.ad
	.RS 12n
	Incremented each time livelist condensing is canceled while in
	spa_livelist_condense_sync.
	This option is used by the test suite to track race conditions.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_livelist_condense_sync_pause\fR (int)
	.ad
	.RS 12n
	When set, the livelist condense process pauses indefinitely before
	executing the synctask - spa_livelist_condense_sync.
	This option is used by the test suite to trigger race conditions.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_livelist_condense_zthr_cancel\fR (int)
	.ad
	.RS 12n
	Incremented each time livelist condensing is canceled while in
	spa_livelist_condense_cb.
	This option is used by the test suite to track race conditions.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_livelist_condense_zthr_pause\fR (int)
	.ad
	.RS 12n
	When set, the livelist condense process pauses indefinitely before
	executing the open context condensing work in spa_livelist_condense_cb.
	This option is used by the test suite to trigger race conditions.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_lua_max_instrlimit\fR (ulong)
	.ad
	.RS 12n
	The maximum execution time limit that can be set for a ZFS channel program,
	specified as a number of Lua instructions.
	.sp
	Default value: \fB100,000,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_lua_max_memlimit\fR (ulong)
	.ad
	.RS 12n
	The maximum memory limit that can be set for a ZFS channel program, specified
	in bytes.
	.sp
	Default value: \fB104,857,600\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_max_dataset_nesting\fR (int)
	.ad
	.RS 12n
	The maximum depth of nested datasets. This value can be tuned temporarily to
	fix existing datasets that exceed the predefined limit.
	.sp
	Default value: \fB50\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_max_log_walking\fR (ulong)
	.ad
	.RS 12n
	The number of past TXGs that the flushing algorithm of the log spacemap
	feature uses to estimate incoming log blocks.
	.sp
	Default value: \fB5\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_max_logsm_summary_length\fR (ulong)
	.ad
	.RS 12n
	Maximum number of rows allowed in the summary of the spacemap log.
	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_max_recordsize\fR (int)
	.ad
	.RS 12n
	We currently support block sizes from 512 bytes to 16MB. The benefits of
	larger blocks, and thus larger I/O, need to be weighed against the cost of
	COWing a giant block to modify one byte. Additionally, very large blocks
	can have an impact on i/o latency, and also potentially on the memory
	allocator. Therefore, we do not allow the recordsize to be set larger than
	zfs_max_recordsize (default 1MB). Larger blocks can be created by changing
	this tunable, and pools with larger blocks can always be imported and used,
	regardless of this setting.
	.sp
	Default value: \fB1,048,576\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_allow_redacted_dataset_mount\fR (int)
	.ad
	.RS 12n
	Allow datasets received with redacted send/receive to be mounted. Normally
	disabled because these datasets may be missing key data.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_min_metaslabs_to_flush\fR (ulong)
	.ad
	.RS 12n
	Minimum number of metaslabs to flush per dirty TXG
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_metaslab_fragmentation_threshold\fR (int)
	.ad
	.RS 12n
	Allow metaslabs to keep their active state as long as their fragmentation
	percentage is less than or equal to this value. An active metaslab that
	exceeds this threshold will no longer keep its active status allowing
	better metaslabs to be selected.
	.sp
	Default value: \fB70\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_mg_fragmentation_threshold\fR (int)
	.ad
	.RS 12n
	Metaslab groups are considered eligible for allocations if their
	fragmentation metric (measured as a percentage) is less than or equal to
	this value. If a metaslab group exceeds this threshold then it will be
	skipped unless all metaslab groups within the metaslab class have also
	crossed this threshold.
	.sp
	Default value: \fB95\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_mg_noalloc_threshold\fR (int)
	.ad
	.RS 12n
	Defines a threshold at which metaslab groups should be eligible for
	allocations. The value is expressed as a percentage of free space
	beyond which a metaslab group is always eligible for allocations.
	If a metaslab group's free space is less than or equal to the
	threshold, the allocator will avoid allocating to that group
	unless all groups in the pool have reached the threshold. Once all
	groups have reached the threshold, all groups are allowed to accept
	allocations. The default value of 0 disables the feature and causes
	all metaslab groups to be eligible for allocations.

	This parameter allows one to deal with pools having heavily imbalanced
	vdevs such as would be the case when a new vdev has been added.
	Setting the threshold to a non-zero percentage will stop allocations
	from being made to vdevs that aren't filled to the specified percentage
	and allow lesser filled vdevs to acquire more allocations than they
	otherwise would under the old \fBzfs_mg_alloc_failures\fR facility.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_ddt_data_is_special\fR (int)
	.ad
	.RS 12n
	If enabled, ZFS will place DDT data into the special allocation class.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_user_indirect_is_special\fR (int)
	.ad
	.RS 12n
	If enabled, ZFS will place user data (both file and zvol) indirect blocks
	into the special allocation class.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_multihost_history\fR (int)
	.ad
	.RS 12n
	Historical statistics for the last N multihost updates will be available in
	\fB/proc/spl/kstat/zfs/<pool>/multihost\fR
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_multihost_interval\fR (ulong)
	.ad
	.RS 12n
	Used to control the frequency of multihost writes which are performed when the
	\fBmultihost\fR pool property is on. This is one factor used to determine the
	length of the activity check during import.
	.sp
	The multihost write period is \fBzfs_multihost_interval / leaf-vdevs\fR
	milliseconds. On average a multihost write will be issued for each leaf vdev
	every \fBzfs_multihost_interval\fR milliseconds. In practice, the observed
	period can vary with the I/O load and this observed value is the delay which is
	stored in the uberblock.
	.sp
	Default value: \fB1000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_multihost_import_intervals\fR (uint)
	.ad
	.RS 12n
	Used to control the duration of the activity test on import. Smaller values of
	\fBzfs_multihost_import_intervals\fR will reduce the import time but increase
	the risk of failing to detect an active pool. The total activity check time is
	never allowed to drop below one second.
	.sp
	On import the activity check waits a minimum amount of time determined by
	\fBzfs_multihost_interval * zfs_multihost_import_intervals\fR, or the same
	product computed on the host which last had the pool imported (whichever is
	greater). The activity check time may be further extended if the value of mmp
	delay found in the best uberblock indicates actual multihost updates happened
	at longer intervals than \fBzfs_multihost_interval\fR. A minimum value of
	\fB100ms\fR is enforced.
	.sp
	A value of 0 is ignored and treated as if it was set to 1.
	.sp
	Default value: \fB20\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_multihost_fail_intervals\fR (uint)
	.ad
	.RS 12n
	Controls the behavior of the pool when multihost write failures or delays are
	detected.
	.sp
	When \fBzfs_multihost_fail_intervals = 0\fR, multihost write failures or delays
	are ignored. The failures will still be reported to the ZED which depending on
	its configuration may take action such as suspending the pool or offlining a
	device.

	.sp
	When \fBzfs_multihost_fail_intervals > 0\fR, the pool will be suspended if
	\fBzfs_multihost_fail_intervals * zfs_multihost_interval\fR milliseconds pass
	without a successful mmp write. This guarantees the activity test will see
	mmp writes if the pool is imported. A value of 1 is ignored and treated as
	if it was set to 2. This is necessary to prevent the pool from being suspended
	due to normal, small I/O latency variations.

	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_no_scrub_io\fR (int)
	.ad
	.RS 12n
	Set for no scrub I/O. This results in scrubs not actually scrubbing data and
	simply doing a metadata crawl of the pool instead.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_no_scrub_prefetch\fR (int)
	.ad
	.RS 12n
	Set to disable block prefetching for scrubs.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_nocacheflush\fR (int)
	.ad
	.RS 12n
	Disable cache flush operations on disks when writing. Setting this will
	cause pool corruption on power loss if a volatile out-of-order write cache
	is enabled.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_nopwrite_enabled\fR (int)
	.ad
	.RS 12n
	Enable NOP writes
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR to disable.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_dmu_offset_next_sync\fR (int)
	.ad
	.RS 12n
	Enable forcing txg sync to find holes. When enabled forces ZFS to act
	like prior versions when SEEK_HOLE or SEEK_DATA flags are used, which
	when a dnode is dirty causes txg's to be synced so that this data can be
	found.
	.sp
	Use \fB1\fR for yes and \fB0\fR to disable (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_pd_bytes_max\fR (int)
	.ad
	.RS 12n
	The number of bytes which should be prefetched during a pool traversal
	(eg: \fBzfs send\fR or other data crawling operations)
	.sp
	Default value: \fB52,428,800\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_per_txg_dirty_frees_percent \fR (ulong)
	.ad
	.RS 12n
	Tunable to control percentage of dirtied indirect blocks from frees allowed
	into one TXG. After this threshold is crossed, additional frees will wait until
	the next TXG.
	A value of zero will disable this throttle.
	.sp
	Default value: \fB5\fR, set to \fB0\fR to disable.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_prefetch_disable\fR (int)
	.ad
	.RS 12n
	This tunable disables predictive prefetch. Note that it leaves "prescient"
	prefetch (e.g. prefetch for zfs send) intact. Unlike predictive prefetch,
	prescient prefetch never issues i/os that end up not being needed, so it
	can't hurt performance.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_qat_checksum_disable\fR (int)
	.ad
	.RS 12n
	This tunable disables qat hardware acceleration for sha256 checksums. It
	may be set after the zfs modules have been loaded to initialize the qat
	hardware as long as support is compiled in and the qat driver is present.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_qat_compress_disable\fR (int)
	.ad
	.RS 12n
	This tunable disables qat hardware acceleration for gzip compression. It
	may be set after the zfs modules have been loaded to initialize the qat
	hardware as long as support is compiled in and the qat driver is present.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_qat_encrypt_disable\fR (int)
	.ad
	.RS 12n
	This tunable disables qat hardware acceleration for AES-GCM encryption. It
	may be set after the zfs modules have been loaded to initialize the qat
	hardware as long as support is compiled in and the qat driver is present.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_read_chunk_size\fR (long)
	.ad
	.RS 12n
	Bytes to read per chunk
	.sp
	Default value: \fB1,048,576\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_read_history\fR (int)
	.ad
	.RS 12n
	Historical statistics for the last N reads will be available in
	\fB/proc/spl/kstat/zfs/<pool>/reads\fR
	.sp
	Default value: \fB0\fR (no data is kept).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_read_history_hits\fR (int)
	.ad
	.RS 12n
	Include cache hits in read history
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_rebuild_max_segment\fR (ulong)
	.ad
	.RS 12n
	Maximum read segment size to issue when sequentially resilvering a
	top-level vdev.
	.sp
	Default value: \fB1,048,576\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_reconstruct_indirect_combinations_max\fR (int)
	.ad
	.RS 12na
	If an indirect split block contains more than this many possible unique
	combinations when being reconstructed, consider it too computationally
	expensive to check them all. Instead, try at most
	\fBzfs_reconstruct_indirect_combinations_max\fR randomly-selected
	combinations each time the block is accessed. This allows all segment
	copies to participate fairly in the reconstruction when all combinations
	cannot be checked and prevents repeated use of one bad copy.
	.sp
	Default value: \fB4096\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_recover\fR (int)
	.ad
	.RS 12n
	Set to attempt to recover from fatal errors. This should only be used as a
	last resort, as it typically results in leaked space, or worse.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_removal_ignore_errors\fR (int)
	.ad
	.RS 12n
	.sp
	Ignore hard IO errors during device removal. When set, if a device encounters
	a hard IO error during the removal process the removal will not be cancelled.
	This can result in a normally recoverable block becoming permanently damaged
	and is not recommended. This should only be used as a last resort when the
	pool cannot be returned to a healthy state prior to removing the device.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_removal_suspend_progress\fR (int)
	.ad
	.RS 12n
	.sp
	This is used by the test suite so that it can ensure that certain actions
	happen while in the middle of a removal.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_remove_max_segment\fR (int)
	.ad
	.RS 12n
	.sp
	The largest contiguous segment that we will attempt to allocate when removing
	a device. This can be no larger than 16MB. If there is a performance
	problem with attempting to allocate large blocks, consider decreasing this.
	.sp
	Default value: \fB16,777,216\fR (16MB).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_resilver_disable_defer\fR (int)
	.ad
	.RS 12n
	Disables the \fBresilver_defer\fR feature, causing an operation that would
	start a resilver to restart one in progress immediately.
	.sp
	Default value: \fB0\fR (feature enabled).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_resilver_min_time_ms\fR (int)
	.ad
	.RS 12n
	Resilvers are processed by the sync thread. While resilvering it will spend
	at least this much time working on a resilver between txg flushes.
	.sp
	Default value: \fB3,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_ignore_errors\fR (int)
	.ad
	.RS 12n
	If set to a nonzero value, remove the DTL (dirty time list) upon
	completion of a pool scan (scrub) even if there were unrepairable
	errors. It is intended to be used during pool repair or recovery to
	stop resilvering when the pool is next imported.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scrub_min_time_ms\fR (int)
	.ad
	.RS 12n
	Scrubs are processed by the sync thread. While scrubbing it will spend
	at least this much time working on a scrub between txg flushes.
	.sp
	Default value: \fB1,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_checkpoint_intval\fR (int)
	.ad
	.RS 12n
	To preserve progress across reboots the sequential scan algorithm periodically
	needs to stop metadata scanning and issue all the verifications I/Os to disk.
	The frequency of this flushing is determined by the
	\fBzfs_scan_checkpoint_intval\fR tunable.
	.sp
	Default value: \fB7200\fR seconds (every 2 hours).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_fill_weight\fR (int)
	.ad
	.RS 12n
	This tunable affects how scrub and resilver I/O segments are ordered. A higher
	number indicates that we care more about how filled in a segment is, while a
	lower number indicates we care more about the size of the extent without
	considering the gaps within a segment. This value is only tunable upon module
	insertion. Changing the value afterwards will have no affect on scrub or
	resilver performance.
	.sp
	Default value: \fB3\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_issue_strategy\fR (int)
	.ad
	.RS 12n
	Determines the order that data will be verified while scrubbing or resilvering.
	If set to \fB1\fR, data will be verified as sequentially as possible, given the
	amount of memory reserved for scrubbing (see \fBzfs_scan_mem_lim_fact\fR). This
	may improve scrub performance if the pool's data is very fragmented. If set to
	\fB2\fR, the largest mostly-contiguous chunk of found data will be verified
	first. By deferring scrubbing of small segments, we may later find adjacent data
	to coalesce and increase the segment size. If set to \fB0\fR, zfs will use
	strategy \fB1\fR during normal verification and strategy \fB2\fR while taking a
	checkpoint.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_legacy\fR (int)
	.ad
	.RS 12n
	A value of 0 indicates that scrubs and resilvers will gather metadata in
	memory before issuing sequential I/O. A value of 1 indicates that the legacy
	algorithm will be used where I/O is initiated as soon as it is discovered.
	Changing this value to 0 will not affect scrubs or resilvers that are already
	in progress.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_max_ext_gap\fR (int)
	.ad
	.RS 12n
	Indicates the largest gap in bytes between scrub / resilver I/Os that will still
	be considered sequential for sorting purposes. Changing this value will not
	affect scrubs or resilvers that are already in progress.
	.sp
	Default value: \fB2097152 (2 MB)\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_mem_lim_fact\fR (int)
	.ad
	.RS 12n
	Maximum fraction of RAM used for I/O sorting by sequential scan algorithm.
	This tunable determines the hard limit for I/O sorting memory usage.
	When the hard limit is reached we stop scanning metadata and start issuing
	data verification I/O. This is done until we get below the soft limit.
	.sp
	Default value: \fB20\fR which is 5% of RAM (1/20).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_mem_lim_soft_fact\fR (int)
	.ad
	.RS 12n
	The fraction of the hard limit used to determined the soft limit for I/O sorting
	by the sequential scan algorithm. When we cross this limit from below no action
	is taken. When we cross this limit from above it is because we are issuing
	verification I/O. In this case (unless the metadata scan is done) we stop
	issuing verification I/O and start scanning metadata again until we get to the
	hard limit.
	.sp
	Default value: \fB20\fR which is 5% of the hard limit (1/20).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_strict_mem_lim\fR (int)
	.ad
	.RS 12n
	Enforces tight memory limits on pool scans when a sequential scan is in
	progress. When disabled the memory limit may be exceeded by fast disks.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_scan_suspend_progress\fR (int)
	.ad
	.RS 12n
	Freezes a scrub/resilver in progress without actually pausing it. Intended for
	testing/debugging.
	.sp
	Default value: \fB0\fR.
	.RE


	.sp
	.ne 2
	.na
	\fBzfs_scan_vdev_limit\fR (int)
	.ad
	.RS 12n
	Maximum amount of data that can be concurrently issued at once for scrubs and
	resilvers per leaf device, given in bytes.
	.sp
	Default value: \fB41943040\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_send_corrupt_data\fR (int)
	.ad
	.RS 12n
	Allow sending of corrupt data (ignore read/checksum errors when sending data)
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_send_unmodified_spill_blocks\fR (int)
	.ad
	.RS 12n
	Include unmodified spill blocks in the send stream. Under certain circumstances
	previous versions of ZFS could incorrectly remove the spill block from an
	existing object. Including unmodified copies of the spill blocks creates a
	backwards compatible stream which will recreate a spill block if it was
	incorrectly removed.
	.sp
	Use \fB1\fR for yes (default) and \fB0\fR for no.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_send_no_prefetch_queue_ff\fR (int)
	.ad
	.RS 12n
	The fill fraction of the \fBzfs send\fR internal queues. The fill fraction
	controls the timing with which internal threads are woken up.
	.sp
	Default value: \fB20\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_send_no_prefetch_queue_length\fR (int)
	.ad
	.RS 12n
	The maximum number of bytes allowed in \fBzfs send\fR's internal queues.
	.sp
	Default value: \fB1,048,576\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_send_queue_ff\fR (int)
	.ad
	.RS 12n
	The fill fraction of the \fBzfs send\fR prefetch queue. The fill fraction
	controls the timing with which internal threads are woken up.
	.sp
	Default value: \fB20\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_send_queue_length\fR (int)
	.ad
	.RS 12n
	The maximum number of bytes allowed that will be prefetched by \fBzfs send\fR.
	This value must be at least twice the maximum block size in use.
	.sp
	Default value: \fB16,777,216\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_recv_queue_ff\fR (int)
	.ad
	.RS 12n
	The fill fraction of the \fBzfs receive\fR queue. The fill fraction
	controls the timing with which internal threads are woken up.
	.sp
	Default value: \fB20\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_recv_queue_length\fR (int)
	.ad
	.RS 12n
	The maximum number of bytes allowed in the \fBzfs receive\fR queue. This value
	must be at least twice the maximum block size in use.
	.sp
	Default value: \fB16,777,216\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_recv_write_batch_size\fR (int)
	.ad
	.RS 12n
	The maximum amount of data (in bytes) that \fBzfs receive\fR will write in
	one DMU transaction. This is the uncompressed size, even when receiving a
	compressed send stream. This setting will not reduce the write size below
	a single block. Capped at a maximum of 32MB
	.sp
	Default value: \fB1MB\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_override_estimate_recordsize\fR (ulong)
	.ad
	.RS 12n
	Setting this variable overrides the default logic for estimating block
	sizes when doing a zfs send. The default heuristic is that the average
	block size will be the current recordsize. Override this value if most data
	in your dataset is not of that size and you require accurate zfs send size
	estimates.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_sync_pass_deferred_free\fR (int)
	.ad
	.RS 12n
	Flushing of data to disk is done in passes. Defer frees starting in this pass
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_spa_discard_memory_limit\fR (int)
	.ad
	.RS 12n
	Maximum memory used for prefetching a checkpoint's space map on each
	vdev while discarding the checkpoint.
	.sp
	Default value: \fB16,777,216\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_special_class_metadata_reserve_pct\fR (int)
	.ad
	.RS 12n
	Only allow small data blocks to be allocated on the special and dedup vdev
	types when the available free space percentage on these vdevs exceeds this
	value. This ensures reserved space is available for pool meta data as the
	special vdevs approach capacity.
	.sp
	Default value: \fB25\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_sync_pass_dont_compress\fR (int)
	.ad
	.RS 12n
	Starting in this sync pass, we disable compression (including of metadata).
	With the default setting, in practice, we don't have this many sync passes,
	so this has no effect.
	.sp
	The original intent was that disabling compression would help the sync passes
	to converge. However, in practice disabling compression increases the average
	number of sync passes, because when we turn compression off, a lot of block's
	size will change and thus we have to re-allocate (not overwrite) them. It
	also increases the number of 128KB allocations (e.g. for indirect blocks and
	spacemaps) because these will not be compressed. The 128K allocations are
	especially detrimental to performance on highly fragmented systems, which may
	have very few free segments of this size, and may need to load new metaslabs
	to satisfy 128K allocations.
	.sp
	Default value: \fB8\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_sync_pass_rewrite\fR (int)
	.ad
	.RS 12n
	Rewrite new block pointers starting in this pass
	.sp
	Default value: \fB2\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_sync_taskq_batch_pct\fR (int)
	.ad
	.RS 12n
	This controls the number of threads used by the dp_sync_taskq. The default
	value of 75% will create a maximum of one thread per cpu.
	.sp
	Default value: \fB75\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_trim_extent_bytes_max\fR (uint)
	.ad
	.RS 12n
	Maximum size of TRIM command. Ranges larger than this will be split in to
	chunks no larger than \fBzfs_trim_extent_bytes_max\fR bytes before being
	issued to the device.
	.sp
	Default value: \fB134,217,728\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_trim_extent_bytes_min\fR (uint)
	.ad
	.RS 12n
	Minimum size of TRIM commands. TRIM ranges smaller than this will be skipped
	unless they're part of a larger range which was broken in to chunks. This is
	done because it's common for these small TRIMs to negatively impact overall
	performance. This value can be set to 0 to TRIM all unallocated space.
	.sp
	Default value: \fB32,768\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_trim_metaslab_skip\fR (uint)
	.ad
	.RS 12n
	Skip uninitialized metaslabs during the TRIM process. This option is useful
	for pools constructed from large thinly-provisioned devices where TRIM
	operations are slow. As a pool ages an increasing fraction of the pools
	metaslabs will be initialized progressively degrading the usefulness of
	this option. This setting is stored when starting a manual TRIM and will
	persist for the duration of the requested TRIM.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_trim_queue_limit\fR (uint)
	.ad
	.RS 12n
	Maximum number of queued TRIMs outstanding per leaf vdev. The number of
	concurrent TRIM commands issued to the device is controlled by the
	\fBzfs_vdev_trim_min_active\fR and \fBzfs_vdev_trim_max_active\fR module
	options.
	.sp
	Default value: \fB10\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_trim_txg_batch\fR (uint)
	.ad
	.RS 12n
	The number of transaction groups worth of frees which should be aggregated
	before TRIM operations are issued to the device. This setting represents a
	trade-off between issuing larger, more efficient TRIM operations and the
	delay before the recently trimmed space is available for use by the device.
	.sp
	Increasing this value will allow frees to be aggregated for a longer time.
	This will result is larger TRIM operations and potentially increased memory
	usage. Decreasing this value will have the opposite effect. The default
	value of 32 was determined to be a reasonable compromise.
	.sp
	Default value: \fB32\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_txg_history\fR (int)
	.ad
	.RS 12n
	Historical statistics for the last N txgs will be available in
	\fB/proc/spl/kstat/zfs/<pool>/txgs\fR
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_txg_timeout\fR (int)
	.ad
	.RS 12n
	Flush dirty data to disk at least every N seconds (maximum txg duration)
	.sp
	Default value: \fB5\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_aggregate_trim\fR (int)
	.ad
	.RS 12n
	Allow TRIM I/Os to be aggregated. This is normally not helpful because
	the extents to be trimmed will have been already been aggregated by the
	metaslab. This option is provided for debugging and performance analysis.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_aggregation_limit\fR (int)
	.ad
	.RS 12n
	Max vdev I/O aggregation size
	.sp
	Default value: \fB1,048,576\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_aggregation_limit_non_rotating\fR (int)
	.ad
	.RS 12n
	Max vdev I/O aggregation size for non-rotating media
	.sp
	Default value: \fB131,072\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_cache_bshift\fR (int)
	.ad
	.RS 12n
	Shift size to inflate reads too
	.sp
	Default value: \fB16\fR (effectively 65536).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_cache_max\fR (int)
	.ad
	.RS 12n
	Inflate reads smaller than this value to meet the \fBzfs_vdev_cache_bshift\fR
	size (default 64k).
	.sp
	Default value: \fB16384\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_cache_size\fR (int)
	.ad
	.RS 12n
	Total size of the per-disk cache in bytes.
	.sp
	Currently this feature is disabled as it has been found to not be helpful
	for performance and in some cases harmful.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_mirror_rotating_inc\fR (int)
	.ad
	.RS 12n
	A number by which the balancing algorithm increments the load calculation for
	the purpose of selecting the least busy mirror member when an I/O immediately
	follows its predecessor on rotational vdevs for the purpose of making decisions
	based on load.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_mirror_rotating_seek_inc\fR (int)
	.ad
	.RS 12n
	A number by which the balancing algorithm increments the load calculation for
	the purpose of selecting the least busy mirror member when an I/O lacks
	locality as defined by the zfs_vdev_mirror_rotating_seek_offset. I/Os within
	this that are not immediately following the previous I/O are incremented by
	half.
	.sp
	Default value: \fB5\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_mirror_rotating_seek_offset\fR (int)
	.ad
	.RS 12n
	The maximum distance for the last queued I/O in which the balancing algorithm
	considers an I/O to have locality.
	See the section "ZFS I/O SCHEDULER".
	.sp
	Default value: \fB1048576\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_mirror_non_rotating_inc\fR (int)
	.ad
	.RS 12n
	A number by which the balancing algorithm increments the load calculation for
	the purpose of selecting the least busy mirror member on non-rotational vdevs
	when I/Os do not immediately follow one another.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_mirror_non_rotating_seek_inc\fR (int)
	.ad
	.RS 12n
	A number by which the balancing algorithm increments the load calculation for
	the purpose of selecting the least busy mirror member when an I/O lacks
	locality as defined by the zfs_vdev_mirror_rotating_seek_offset. I/Os within
	this that are not immediately following the previous I/O are incremented by
	half.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_read_gap_limit\fR (int)
	.ad
	.RS 12n
	Aggregate read I/O operations if the gap on-disk between them is within this
	threshold.
	.sp
	Default value: \fB32,768\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_write_gap_limit\fR (int)
	.ad
	.RS 12n
	Aggregate write I/O over gap
	.sp
	Default value: \fB4,096\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_raidz_impl\fR (string)
	.ad
	.RS 12n
	Parameter for selecting raidz parity implementation to use.

	Options marked (always) below may be selected on module load as they are
	supported on all systems.
	The remaining options may only be set after the module is loaded, as they
	are available only if the implementations are compiled in and supported
	on the running system.

	Once the module is loaded, the content of
	/sys/module/zfs/parameters/zfs_vdev_raidz_impl will show available options
	with the currently selected one enclosed in [].
	Possible options are:
	fastest - (always) implementation selected using built-in benchmark
	original - (always) original raidz implementation
	scalar - (always) scalar raidz implementation
	sse2 - implementation using SSE2 instruction set (64bit x86 only)
	ssse3 - implementation using SSSE3 instruction set (64bit x86 only)
	avx2 - implementation using AVX2 instruction set (64bit x86 only)
	avx512f - implementation using AVX512F instruction set (64bit x86 only)
	avx512bw - implementation using AVX512F & AVX512BW instruction sets (64bit x86 only)
	aarch64_neon - implementation using NEON (Aarch64/64 bit ARMv8 only)
	aarch64_neonx2 - implementation using NEON with more unrolling (Aarch64/64 bit ARMv8 only)
	powerpc_altivec - implementation using Altivec (PowerPC only)
	.sp
	Default value: \fBfastest\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_vdev_scheduler\fR (charp)
	.ad
	.RS 12n
	\fBDEPRECATED\fR: This option exists for compatibility with older user
	configurations. It does nothing except print a warning to the kernel log if
	set.
	.sp
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_zevent_cols\fR (int)
	.ad
	.RS 12n
	When zevents are logged to the console use this as the word wrap width.
	.sp
	Default value: \fB80\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_zevent_console\fR (int)
	.ad
	.RS 12n
	Log events to the console
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_zevent_len_max\fR (int)
	.ad
	.RS 12n
	Max event queue length. A value of 0 will result in a calculated value which
	increases with the number of CPUs in the system (minimum 64 events). Events
	in the queue can be viewed with the \fBzpool events\fR command.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	+.na
	+\fBzfs_zevent_retain_max\fR (int)
	+.ad
	+.RS 12n
	+Maximum recent zevent records to retain for duplicate checking. Setting
	+this value to zero disables duplicate detection.
	+.sp
	+Default value: \fB2000\fR.
	+.RE
	+
	+.sp
	+.ne 2
	+.na
	+\fBzfs_zevent_retain_expire_secs\fR (int)
	+.ad
	+.RS 12n
	+Lifespan for a recent ereport that was retained for duplicate checking.
	+.sp
	+Default value: \fB900\fR.
	+.RE
	+
	.na
	\fBzfs_zil_clean_taskq_maxalloc\fR (int)
	.ad
	.RS 12n
	The maximum number of taskq entries that are allowed to be cached. When this
	limit is exceeded transaction records (itxs) will be cleaned synchronously.
	.sp
	Default value: \fB1048576\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_zil_clean_taskq_minalloc\fR (int)
	.ad
	.RS 12n
	The number of taskq entries that are pre-populated when the taskq is first
	created and are immediately available for use.
	.sp
	Default value: \fB1024\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzfs_zil_clean_taskq_nthr_pct\fR (int)
	.ad
	.RS 12n
	This controls the number of threads used by the dp_zil_clean_taskq. The default
	value of 100% will create a maximum of one thread per cpu.
	.sp
	Default value: \fB100\fR%.
	.RE

	.sp
	.ne 2
	.na
	\fBzil_maxblocksize\fR (int)
	.ad
	.RS 12n
	This sets the maximum block size used by the ZIL. On very fragmented pools,
	lowering this (typically to 36KB) can improve performance.
	.sp
	Default value: \fB131072\fR (128KB).
	.RE

	.sp
	.ne 2
	.na
	\fBzil_nocacheflush\fR (int)
	.ad
	.RS 12n
	Disable the cache flush commands that are normally sent to the disk(s) by
	the ZIL after an LWB write has completed. Setting this will cause ZIL
	corruption on power loss if a volatile out-of-order write cache is enabled.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzil_replay_disable\fR (int)
	.ad
	.RS 12n
	Disable intent logging replay. Can be disabled for recovery from corrupted
	ZIL
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzil_slog_bulk\fR (ulong)
	.ad
	.RS 12n
	Limit SLOG write size per commit executed with synchronous priority.
	Any writes above that will be executed with lower (asynchronous) priority
	to limit potential SLOG device abuse by single active ZIL writer.
	.sp
	Default value: \fB786,432\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzio_deadman_log_all\fR (int)
	.ad
	.RS 12n
	If non-zero, the zio deadman will produce debugging messages (see
	\fBzfs_dbgmsg_enable\fR) for all zios, rather than only for leaf
	zios possessing a vdev. This is meant to be used by developers to gain
	diagnostic information for hang conditions which don't involve a mutex
	or other locking primitive; typically conditions in which a thread in
	the zio pipeline is looping indefinitely.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzio_decompress_fail_fraction\fR (int)
	.ad
	.RS 12n
	If non-zero, this value represents the denominator of the probability that zfs
	should induce a decompression failure. For instance, for a 5% decompression
	failure rate, this value should be set to 20.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzio_slow_io_ms\fR (int)
	.ad
	.RS 12n
	When an I/O operation takes more than \fBzio_slow_io_ms\fR milliseconds to
	complete is marked as a slow I/O. Each slow I/O causes a delay zevent. Slow
	I/O counters can be seen with "zpool status -s".

	.sp
	Default value: \fB30,000\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzio_dva_throttle_enabled\fR (int)
	.ad
	.RS 12n
	Throttle block allocations in the I/O pipeline. This allows for
	dynamic allocation distribution when devices are imbalanced.
	When enabled, the maximum number of pending allocations per top-level vdev
	is limited by \fBzfs_vdev_queue_depth_pct\fR.
	.sp
	Default value: \fB1\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzio_requeue_io_start_cut_in_line\fR (int)
	.ad
	.RS 12n
	Prioritize requeued I/O
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzio_taskq_batch_pct\fR (uint)
	.ad
	.RS 12n
	Percentage of online CPUs (or CPU cores, etc) which will run a worker thread
	for I/O. These workers are responsible for I/O work such as compression and
	checksum calculations. Fractional number of CPUs will be rounded down.
	.sp
	The default value of 75 was chosen to avoid using all CPUs which can result in
	latency issues and inconsistent application performance, especially when high
	compression is enabled.
	.sp
	Default value: \fB75\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzvol_inhibit_dev\fR (uint)
	.ad
	.RS 12n
	Do not create zvol device nodes. This may slightly improve startup time on
	systems with a very large number of zvols.
	.sp
	Use \fB1\fR for yes and \fB0\fR for no (default).
	.RE

	.sp
	.ne 2
	.na
	\fBzvol_major\fR (uint)
	.ad
	.RS 12n
	Major number for zvol block devices
	.sp
	Default value: \fB230\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzvol_max_discard_blocks\fR (ulong)
	.ad
	.RS 12n
	Discard (aka TRIM) operations done on zvols will be done in batches of this
	many blocks, where block size is determined by the \fBvolblocksize\fR property
	of a zvol.
	.sp
	Default value: \fB16,384\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzvol_prefetch_bytes\fR (uint)
	.ad
	.RS 12n
	When adding a zvol to the system prefetch \fBzvol_prefetch_bytes\fR
	from the start and end of the volume. Prefetching these regions
	of the volume is desirable because they are likely to be accessed
	immediately by \fBblkid(8)\fR or by the kernel scanning for a partition
	table.
	.sp
	Default value: \fB131,072\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzvol_request_sync\fR (uint)
	.ad
	.RS 12n
	When processing I/O requests for a zvol submit them synchronously. This
	effectively limits the queue depth to 1 for each I/O submitter. When set
	to 0 requests are handled asynchronously by a thread pool. The number of
	requests which can be handled concurrently is controller by \fBzvol_threads\fR.
	.sp
	Default value: \fB0\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzvol_threads\fR (uint)
	.ad
	.RS 12n
	Max number of threads which can handle zvol I/O requests concurrently.
	.sp
	Default value: \fB32\fR.
	.RE

	.sp
	.ne 2
	.na
	\fBzvol_volmode\fR (uint)
	.ad
	.RS 12n
	Defines zvol block devices behaviour when \fBvolmode\fR is set to \fBdefault\fR.
	Valid values are \fB1\fR (full), \fB2\fR (dev) and \fB3\fR (none).
	.sp
	Default value: \fB1\fR.
	.RE

	.SH ZFS I/O SCHEDULER
	ZFS issues I/O operations to leaf vdevs to satisfy and complete I/Os.
	The I/O scheduler determines when and in what order those operations are
	issued. The I/O scheduler divides operations into five I/O classes
	prioritized in the following order: sync read, sync write, async read,
	async write, and scrub/resilver. Each queue defines the minimum and
	maximum number of concurrent operations that may be issued to the
	device. In addition, the device has an aggregate maximum,
	\fBzfs_vdev_max_active\fR. Note that the sum of the per-queue minimums
	must not exceed the aggregate maximum. If the sum of the per-queue
	maximums exceeds the aggregate maximum, then the number of active I/Os
	may reach \fBzfs_vdev_max_active\fR, in which case no further I/Os will
	be issued regardless of whether all per-queue minimums have been met.
	.sp
	For many physical devices, throughput increases with the number of
	concurrent operations, but latency typically suffers. Further, physical
	devices typically have a limit at which more concurrent operations have no
	effect on throughput or can actually cause it to decrease.
	.sp
	The scheduler selects the next operation to issue by first looking for an
	I/O class whose minimum has not been satisfied. Once all are satisfied and
	the aggregate maximum has not been hit, the scheduler looks for classes
	whose maximum has not been satisfied. Iteration through the I/O classes is
	done in the order specified above. No further operations are issued if the
	aggregate maximum number of concurrent operations has been hit or if there
	are no operations queued for an I/O class that has not hit its maximum.
	Every time an I/O is queued or an operation completes, the I/O scheduler
	looks for new operations to issue.
	.sp
	In general, smaller max_active's will lead to lower latency of synchronous
	operations. Larger max_active's may lead to higher overall throughput,
	depending on underlying storage.
	.sp
	The ratio of the queues' max_actives determines the balance of performance
	between reads, writes, and scrubs. E.g., increasing
	\fBzfs_vdev_scrub_max_active\fR will cause the scrub or resilver to complete
	more quickly, but reads and writes to have higher latency and lower throughput.
	.sp
	All I/O classes have a fixed maximum number of outstanding operations
	except for the async write class. Asynchronous writes represent the data
	that is committed to stable storage during the syncing stage for
	transaction groups. Transaction groups enter the syncing state
	periodically so the number of queued async writes will quickly burst up
	and then bleed down to zero. Rather than servicing them as quickly as
	possible, the I/O scheduler changes the maximum number of active async
	write I/Os according to the amount of dirty data in the pool. Since
	both throughput and latency typically increase with the number of
	concurrent operations issued to physical devices, reducing the
	burstiness in the number of concurrent operations also stabilizes the
	response time of operations from other -- and in particular synchronous
	-- queues. In broad strokes, the I/O scheduler will issue more
	concurrent operations from the async write queue as there's more dirty
	data in the pool.
	.sp
	Async Writes
	.sp
	The number of concurrent operations issued for the async write I/O class
	follows a piece-wise linear function defined by a few adjustable points.
	.nf

	\| o---------\| <-- zfs_vdev_async_write_max_active
	^ \| /^ \|
	\| \| / \| \|
	active \| / \| \|
	I/O \| / \| \|
	count \| / \| \|
	\| / \| \|
	\|-------o \| \| <-- zfs_vdev_async_write_min_active
	0\|_______^______\|_________\|
	0% \| \| 100% of zfs_dirty_data_max
	\| \|
	\| `-- zfs_vdev_async_write_active_max_dirty_percent
	`--------- zfs_vdev_async_write_active_min_dirty_percent

	.fi
	Until the amount of dirty data exceeds a minimum percentage of the dirty
	data allowed in the pool, the I/O scheduler will limit the number of
	concurrent operations to the minimum. As that threshold is crossed, the
	number of concurrent operations issued increases linearly to the maximum at
	the specified maximum percentage of the dirty data allowed in the pool.
	.sp
	Ideally, the amount of dirty data on a busy pool will stay in the sloped
	part of the function between \fBzfs_vdev_async_write_active_min_dirty_percent\fR
	and \fBzfs_vdev_async_write_active_max_dirty_percent\fR. If it exceeds the
	maximum percentage, this indicates that the rate of incoming data is
	greater than the rate that the backend storage can handle. In this case, we
	must further throttle incoming writes, as described in the next section.

	.SH ZFS TRANSACTION DELAY
	We delay transactions when we've determined that the backend storage
	isn't able to accommodate the rate of incoming writes.
	.sp
	If there is already a transaction waiting, we delay relative to when
	that transaction will finish waiting. This way the calculated delay time
	is independent of the number of threads concurrently executing
	transactions.
	.sp
	If we are the only waiter, wait relative to when the transaction
	started, rather than the current time. This credits the transaction for
	"time already served", e.g. reading indirect blocks.
	.sp
	The minimum time for a transaction to take is calculated as:
	.nf
	min_time = zfs_delay_scale * (dirty - min) / (max - dirty)
	min_time is then capped at 100 milliseconds.
	.fi
	.sp
	The delay has two degrees of freedom that can be adjusted via tunables. The
	percentage of dirty data at which we start to delay is defined by
	\fBzfs_delay_min_dirty_percent\fR. This should typically be at or above
	\fBzfs_vdev_async_write_active_max_dirty_percent\fR so that we only start to
	delay after writing at full speed has failed to keep up with the incoming write
	rate. The scale of the curve is defined by \fBzfs_delay_scale\fR. Roughly speaking,
	this variable determines the amount of delay at the midpoint of the curve.
	.sp
	.nf
	delay
	10ms +-------------------------------------------------------------*+
	\| *\|
	9ms + *+
	\| *\|
	8ms + *+
	\| * \|
	7ms + * +
	\| * \|
	6ms + * +
	\| * \|
	5ms + * +
	\| * \|
	4ms + * +
	\| * \|
	3ms + * +
	\| * \|
	2ms + (midpoint) * +
	\| \| ** \|
	1ms + v *** +
	\| zfs_delay_scale ----------> ******** \|
	0 +-------------------------------------*********----------------+
	0% <- zfs_dirty_data_max -> 100%
	.fi
	.sp
	Note that since the delay is added to the outstanding time remaining on the
	most recent transaction, the delay is effectively the inverse of IOPS.
	Here the midpoint of 500us translates to 2000 IOPS. The shape of the curve
	was chosen such that small changes in the amount of accumulated dirty data
	in the first 3/4 of the curve yield relatively small differences in the
	amount of delay.
	.sp
	The effects can be easier to understand when the amount of delay is
	represented on a log scale:
	.sp
	.nf
	delay
	100ms +-------------------------------------------------------------++
	+ +
	\| \|
	+ *+
	10ms + *+
	+ ** +
	\| (midpoint) ** \|
	+ \| ** +
	1ms + v **** +
	+ zfs_delay_scale ----------> ***** +
	\| **** \|
	+ **** +
	100us + ** +
	+ * +
	\| * \|
	+ * +
	10us + * +
	+ +
	\| \|
	+ +
	+--------------------------------------------------------------+
	0% <- zfs_dirty_data_max -> 100%
	.fi
	.sp
	Note here that only as the amount of dirty data approaches its limit does
	the delay start to increase rapidly. The goal of a properly tuned system
	should be to keep the amount of dirty data out of that range by first
	ensuring that the appropriate limits are set for the I/O scheduler to reach
	optimal throughput on the backend storage, and then by changing the value
	of \fBzfs_delay_scale\fR to increase the steepness of the curve.
	Index: vendor-sys/openzfs/dist/man/man8/zfs-rename.8
	===================================================================
	--- vendor-sys/openzfs/dist/man/man8/zfs-rename.8 (revision 365891)
	+++ vendor-sys/openzfs/dist/man/man8/zfs-rename.8 (revision 365892)
	@@ -1,119 +1,122 @@
	.\"
	.\" CDDL HEADER START
	.\"
	.\" The contents of this file are subject to the terms of the
	.\" Common Development and Distribution License (the "License").
	.\" You may not use this file except in compliance with the License.
	.\"
	.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	.\" or http://www.opensolaris.org/os/licensing.
	.\" See the License for the specific language governing permissions
	.\" and limitations under the License.
	.\"
	.\" When distributing Covered Code, include this CDDL HEADER in each
	.\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	.\" If applicable, add the following below this CDDL HEADER, with the
	.\" fields enclosed by brackets "[]" replaced with your own identifying
	.\" information: Portions Copyright [yyyy] [name of copyright owner]
	.\"
	.\" CDDL HEADER END
	.\"
	.\"
	.\" Copyright (c) 2009 Sun Microsystems, Inc. All Rights Reserved.
	.\" Copyright 2011 Joshua M. Clulow <josh@sysmgr.org>
	.\" Copyright (c) 2011, 2019 by Delphix. All rights reserved.
	.\" Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
	.\" Copyright (c) 2014, Joyent, Inc. All rights reserved.
	.\" Copyright (c) 2014 by Adam Stevko. All rights reserved.
	.\" Copyright (c) 2014 Integros [integros.com]
	.\" Copyright 2019 Richard Laager. All rights reserved.
	.\" Copyright 2018 Nexenta Systems, Inc.
	.\" Copyright 2019 Joyent, Inc.
	.\"
	-.Dd June 30, 2019
	+.Dd September 1, 2020
	.Dt ZFS-RENAME 8
	.Os
	.Sh NAME
	.Nm zfs Ns Pf - Cm rename
	.Nd Renames the given dataset (filesystem or snapshot).
	.Sh SYNOPSIS
	.Nm
	.Cm rename
	.Op Fl f
	.Ar filesystem Ns \| Ns Ar volume Ns \| Ns Ar snapshot
	.Ar filesystem Ns \| Ns Ar volume Ns \| Ns Ar snapshot
	.Nm
	.Cm rename
	.Fl p
	.Op Fl f
	.Ar filesystem Ns \| Ns Ar volume
	.Ar filesystem Ns \| Ns Ar volume
	.Nm
	.Cm rename
	.Fl u
	.Op Fl f
	-.Ar filesystem
	-.Ar filesystem
	+.Ar filesystem Ar filesystem
	+.Nm
	+.Cm rename
	+.Fl r
	+.Ar snapshot Ar snapshot
	.Sh DESCRIPTION
	.Bl -tag -width ""
	.It Xo
	.Nm
	.Cm rename
	.Op Fl f
	.Ar filesystem Ns \| Ns Ar volume Ns \| Ns Ar snapshot
	.Ar filesystem Ns \| Ns Ar volume Ns \| Ns Ar snapshot
	.Xc
	.It Xo
	.Nm
	.Cm rename
	.Fl p
	.Op Fl f
	.Ar filesystem Ns \| Ns Ar volume
	.Ar filesystem Ns \| Ns Ar volume
	.Xc
	.It Xo
	.Nm
	.Cm rename
	.Fl u
	.Op Fl f
	.Ar filesystem
	.Ar filesystem
	.Xc
	Renames the given dataset.
	The new target can be located anywhere in the ZFS hierarchy, with the exception
	of snapshots.
	Snapshots can only be renamed within the parent file system or volume.
	When renaming a snapshot, the parent file system of the snapshot does not need
	to be specified as part of the second argument.
	Renamed file systems can inherit new mount points, in which case they are
	unmounted and remounted at the new mount point.
	.Bl -tag -width "-a"
	.It Fl f
	Force unmount any file systems that need to be unmounted in the process.
	This flag has no effect if used together with the
	.Fl u
	flag.
	.It Fl p
	Creates all the nonexistent parent datasets.
	Datasets created in this manner are automatically mounted according to the
	.Sy mountpoint
	property inherited from their parent.
	.It Fl u
	Do not remount file systems during rename.
	If a file system's
	.Sy mountpoint
	property is set to
	.Sy legacy
	or
	.Sy none ,
	the file system is not unmounted even if this option is not given.
	.El
	.It Xo
	.Nm
	.Cm rename
	.Fl r
	.Ar snapshot Ar snapshot
	.Xc
	Recursively rename the snapshots of all descendent datasets.
	Snapshots are the only dataset that can be renamed recursively.
	.El
	Index: vendor-sys/openzfs/dist/man/man8/zfsprops.8
	===================================================================
	--- vendor-sys/openzfs/dist/man/man8/zfsprops.8 (revision 365891)
	+++ vendor-sys/openzfs/dist/man/man8/zfsprops.8 (revision 365892)
	@@ -1,1988 +1,1992 @@
	.\"
	.\" CDDL HEADER START
	.\"
	.\" The contents of this file are subject to the terms of the
	.\" Common Development and Distribution License (the "License").
	.\" You may not use this file except in compliance with the License.
	.\"
	.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	.\" or http://www.opensolaris.org/os/licensing.
	.\" See the License for the specific language governing permissions
	.\" and limitations under the License.
	.\"
	.\" When distributing Covered Code, include this CDDL HEADER in each
	.\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	.\" If applicable, add the following below this CDDL HEADER, with the
	.\" fields enclosed by brackets "[]" replaced with your own identifying
	.\" information: Portions Copyright [yyyy] [name of copyright owner]
	.\"
	.\" CDDL HEADER END
	.\"
	.\"
	.\" Copyright (c) 2009 Sun Microsystems, Inc. All Rights Reserved.
	.\" Copyright 2011 Joshua M. Clulow <josh@sysmgr.org>
	.\" Copyright (c) 2011, 2019 by Delphix. All rights reserved.
	.\" Copyright (c) 2011, Pawel Jakub Dawidek <pjd@FreeBSD.org>
	.\" Copyright (c) 2012, Glen Barber <gjb@FreeBSD.org>
	.\" Copyright (c) 2012, Bryan Drewery <bdrewery@FreeBSD.org>
	.\" Copyright (c) 2013, Steven Hartland <smh@FreeBSD.org>
	.\" Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
	.\" Copyright (c) 2014, Joyent, Inc. All rights reserved.
	.\" Copyright (c) 2014 by Adam Stevko. All rights reserved.
	.\" Copyright (c) 2014 Integros [integros.com]
	.\" Copyright (c) 2016 Nexenta Systems, Inc. All Rights Reserved.
	.\" Copyright (c) 2014, Xin LI <delphij@FreeBSD.org>
	.\" Copyright (c) 2014-2015, The FreeBSD Foundation, All Rights Reserved.
	.\" Copyright 2019 Richard Laager. All rights reserved.
	.\" Copyright 2018 Nexenta Systems, Inc.
	.\" Copyright 2019 Joyent, Inc.
	.\" Copyright (c) 2019, Kjeld Schouten-Lebbing
	.\"
	-.Dd January 30, 2020
	+.Dd September 1, 2020
	.Dt ZFSPROPS 8
	.Os
	.Sh NAME
	.Nm zfsprops
	.Nd Native properties and user-defined of ZFS datasets.
	.Sh DESCRIPTION
	Properties are divided into two types, native properties and user-defined
	.Po or
	.Qq user
	.Pc
	properties.
	Native properties either export internal statistics or control ZFS behavior.
	In addition, native properties are either editable or read-only.
	User properties have no effect on ZFS behavior, but you can use them to annotate
	datasets in a way that is meaningful in your environment.
	For more information about user properties, see the
	.Sx User Properties
	section, below.
	.Ss Native Properties
	Every dataset has a set of properties that export statistics about the dataset
	as well as control various behaviors.
	Properties are inherited from the parent unless overridden by the child.
	Some properties apply only to certain types of datasets
	.Pq file systems, volumes, or snapshots .
	.Pp
	The values of numeric properties can be specified using human-readable suffixes
	.Po for example,
	.Sy k ,
	.Sy KB ,
	.Sy M ,
	.Sy Gb ,
	and so forth, up to
	.Sy Z
	for zettabyte
	.Pc .
	The following are all valid
	.Pq and equal
	specifications:
	.Li 1536M, 1.5g, 1.50GB .
	.Pp
	The values of non-numeric properties are case sensitive and must be lowercase,
	except for
	.Sy mountpoint ,
	.Sy sharenfs ,
	and
	.Sy sharesmb .
	.Pp
	The following native properties consist of read-only statistics about the
	dataset.
	These properties can be neither set, nor inherited.
	Native properties apply to all dataset types unless otherwise noted.
	.Bl -tag -width "usedbyrefreservation"
	.It Sy available
	The amount of space available to the dataset and all its children, assuming that
	there is no other activity in the pool.
	Because space is shared within a pool, availability can be limited by any number
	of factors, including physical pool size, quotas, reservations, or other
	datasets within the pool.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy avail .
	.It Sy compressratio
	For non-snapshots, the compression ratio achieved for the
	.Sy used
	space of this dataset, expressed as a multiplier.
	The
	.Sy used
	property includes descendant datasets, and, for clones, does not include the
	space shared with the origin snapshot.
	For snapshots, the
	.Sy compressratio
	is the same as the
	.Sy refcompressratio
	property.
	Compression can be turned on by running:
	.Nm zfs Cm set Sy compression Ns = Ns Sy on Ar dataset .
	The default value is
	.Sy off .
	.It Sy createtxg
	The transaction group (txg) in which the dataset was created. Bookmarks have
	the same
	.Sy createtxg
	as the snapshot they are initially tied to. This property is suitable for
	ordering a list of snapshots, e.g. for incremental send and receive.
	.It Sy creation
	The time this dataset was created.
	.It Sy clones
	For snapshots, this property is a comma-separated list of filesystems or volumes
	which are clones of this snapshot.
	The clones'
	.Sy origin
	property is this snapshot.
	If the
	.Sy clones
	property is not empty, then this snapshot can not be destroyed
	.Po even with the
	.Fl r
	or
	.Fl f
	options
	.Pc .
	The roles of origin and clone can be swapped by promoting the clone with the
	.Nm zfs Cm promote
	command.
	.It Sy defer_destroy
	This property is
	.Sy on
	if the snapshot has been marked for deferred destroy by using the
	.Nm zfs Cm destroy Fl d
	command.
	Otherwise, the property is
	.Sy off .
	.It Sy encryptionroot
	For encrypted datasets, indicates where the dataset is currently inheriting its
	encryption key from. Loading or unloading a key for the
	.Sy encryptionroot
	will implicitly load / unload the key for any inheriting datasets (see
	.Nm zfs Cm load-key
	and
	.Nm zfs Cm unload-key
	for details).
	Clones will always share an
	encryption key with their origin. See the
	.Em Encryption
	section of
	.Xr zfs-load-key 8
	for details.
	.It Sy filesystem_count
	The total number of filesystems and volumes that exist under this location in
	the dataset tree.
	This value is only available when a
	.Sy filesystem_limit
	has been set somewhere in the tree under which the dataset resides.
	.It Sy keystatus
	Indicates if an encryption key is currently loaded into ZFS. The possible
	values are
	.Sy none ,
	.Sy available ,
	and
	.Sy unavailable .
	See
	.Nm zfs Cm load-key
	and
	.Nm zfs Cm unload-key .
	.It Sy guid
	The 64 bit GUID of this dataset or bookmark which does not change over its
	entire lifetime. When a snapshot is sent to another pool, the received
	snapshot has the same GUID. Thus, the
	.Sy guid
	is suitable to identify a snapshot across pools.
	.It Sy logicalreferenced
	The amount of space that is
	.Qq logically
	accessible by this dataset.
	See the
	.Sy referenced
	property.
	The logical space ignores the effect of the
	.Sy compression
	and
	.Sy copies
	properties, giving a quantity closer to the amount of data that applications
	see.
	However, it does include space consumed by metadata.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy lrefer .
	.It Sy logicalused
	The amount of space that is
	.Qq logically
	consumed by this dataset and all its descendents.
	See the
	.Sy used
	property.
	The logical space ignores the effect of the
	.Sy compression
	and
	.Sy copies
	properties, giving a quantity closer to the amount of data that applications
	see.
	However, it does include space consumed by metadata.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy lused .
	.It Sy mounted
	For file systems, indicates whether the file system is currently mounted.
	This property can be either
	.Sy yes
	or
	.Sy no .
	.It Sy objsetid
	A unique identifier for this dataset within the pool. Unlike the dataset's
	.Sy guid
	, the
	.Sy objsetid
	of a dataset is not transferred to other pools when the snapshot is copied
	with a send/receive operation.
	The
	.Sy objsetid
	can be reused (for a new dataset) after the dataset is deleted.
	.It Sy origin
	For cloned file systems or volumes, the snapshot from which the clone was
	created.
	See also the
	.Sy clones
	property.
	.It Sy receive_resume_token
	For filesystems or volumes which have saved partially-completed state from
	.Sy zfs receive -s ,
	this opaque token can be provided to
	.Sy zfs send -t
	to resume and complete the
	.Sy zfs receive .
	.It Sy redact_snaps
	For bookmarks, this is the list of snapshot guids the bookmark contains a redaction
	list for.
	For snapshots, this is the list of snapshot guids the snapshot is redacted with
	respect to.
	.It Sy referenced
	The amount of data that is accessible by this dataset, which may or may not be
	shared with other datasets in the pool.
	When a snapshot or clone is created, it initially references the same amount of
	space as the file system or snapshot it was created from, since its contents are
	identical.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy refer .
	.It Sy refcompressratio
	The compression ratio achieved for the
	.Sy referenced
	space of this dataset, expressed as a multiplier.
	See also the
	.Sy compressratio
	property.
	.It Sy snapshot_count
	The total number of snapshots that exist under this location in the dataset
	tree.
	This value is only available when a
	.Sy snapshot_limit
	has been set somewhere in the tree under which the dataset resides.
	.It Sy type
	The type of dataset:
	.Sy filesystem ,
	.Sy volume ,
	.Sy snapshot ,
	or
	.Sy bookmark .
	.It Sy used
	The amount of space consumed by this dataset and all its descendents.
	This is the value that is checked against this dataset's quota and reservation.
	The space used does not include this dataset's reservation, but does take into
	account the reservations of any descendent datasets.
	The amount of space that a dataset consumes from its parent, as well as the
	amount of space that is freed if this dataset is recursively destroyed, is the
	greater of its space used and its reservation.
	.Pp
	The used space of a snapshot
	.Po see the
	.Em Snapshots
	section of
	.Xr zfsconcepts 8
	.Pc
	is space that is referenced exclusively by this snapshot.
	If this snapshot is destroyed, the amount of
	.Sy used
	space will be freed.
	Space that is shared by multiple snapshots isn't accounted for in this metric.
	When a snapshot is destroyed, space that was previously shared with this
	snapshot can become unique to snapshots adjacent to it, thus changing the used
	space of those snapshots.
	The used space of the latest snapshot can also be affected by changes in the
	file system.
	Note that the
	.Sy used
	space of a snapshot is a subset of the
	.Sy written
	space of the snapshot.
	.Pp
	The amount of space used, available, or referenced does not take into account
	pending changes.
	Pending changes are generally accounted for within a few seconds.
	Committing a change to a disk using
	.Xr fsync 2
	or
	.Dv O_SYNC
	does not necessarily guarantee that the space usage information is updated
	immediately.
	.It Sy usedby*
	The
	.Sy usedby*
	properties decompose the
	.Sy used
	properties into the various reasons that space is used.
	Specifically,
	.Sy used No =
	.Sy usedbychildren No +
	.Sy usedbydataset No +
	.Sy usedbyrefreservation No +
	.Sy usedbysnapshots .
	These properties are only available for datasets created on
	.Nm zpool
	.Qo version 13 Qc
	pools.
	.It Sy usedbychildren
	The amount of space used by children of this dataset, which would be freed if
	all the dataset's children were destroyed.
	.It Sy usedbydataset
	The amount of space used by this dataset itself, which would be freed if the
	dataset were destroyed
	.Po after first removing any
	.Sy refreservation
	and destroying any necessary snapshots or descendents
	.Pc .
	.It Sy usedbyrefreservation
	The amount of space used by a
	.Sy refreservation
	set on this dataset, which would be freed if the
	.Sy refreservation
	was removed.
	.It Sy usedbysnapshots
	The amount of space consumed by snapshots of this dataset.
	In particular, it is the amount of space that would be freed if all of this
	dataset's snapshots were destroyed.
	Note that this is not simply the sum of the snapshots'
	.Sy used
	properties because space can be shared by multiple snapshots.
	.It Sy userused Ns @ Ns Em user
	The amount of space consumed by the specified user in this dataset.
	Space is charged to the owner of each file, as displayed by
	.Nm ls Fl l .
	The amount of space charged is displayed by
	.Nm du
	and
	.Nm ls Fl s .
	See the
	.Nm zfs Cm userspace
	subcommand for more information.
	.Pp
	Unprivileged users can access only their own space usage.
	The root user, or a user who has been granted the
	.Sy userused
	privilege with
	.Nm zfs Cm allow ,
	can access everyone's usage.
	.Pp
	The
	.Sy userused Ns @ Ns Em ...
	properties are not displayed by
	.Nm zfs Cm get Sy all .
	The user's name must be appended after the @ symbol, using one of the following
	forms:
	.Bl -bullet -width ""
	.It
	.Em POSIX name
	.Po for example,
	.Sy joe
	.Pc
	.It
	.Em POSIX numeric ID
	.Po for example,
	.Sy 789
	.Pc
	.It
	.Em SID name
	.Po for example,
	.Sy joe.smith@mydomain
	.Pc
	.It
	.Em SID numeric ID
	.Po for example,
	.Sy S-1-123-456-789
	.Pc
	.El
	.Pp
	Files created on Linux always have POSIX owners.
	.It Sy userobjused Ns @ Ns Em user
	The
	.Sy userobjused
	property is similar to
	.Sy userused
	but instead it counts the number of objects consumed by a user. This property
	counts all objects allocated on behalf of the user, it may differ from the
	results of system tools such as
	.Nm df Fl i .
	.Pp
	When the property
	.Sy xattr=on
	is set on a file system additional objects will be created per-file to store
	extended attributes. These additional objects are reflected in the
	.Sy userobjused
	value and are counted against the user's
	.Sy userobjquota .
	When a file system is configured to use
	.Sy xattr=sa
	no additional internal objects are normally required.
	.It Sy userrefs
	This property is set to the number of user holds on this snapshot.
	User holds are set by using the
	.Nm zfs Cm hold
	command.
	.It Sy groupused Ns @ Ns Em group
	The amount of space consumed by the specified group in this dataset.
	Space is charged to the group of each file, as displayed by
	.Nm ls Fl l .
	See the
	.Sy userused Ns @ Ns Em user
	property for more information.
	.Pp
	Unprivileged users can only access their own groups' space usage.
	The root user, or a user who has been granted the
	.Sy groupused
	privilege with
	.Nm zfs Cm allow ,
	can access all groups' usage.
	.It Sy groupobjused Ns @ Ns Em group
	The number of objects consumed by the specified group in this dataset.
	Multiple objects may be charged to the group for each file when extended
	attributes are in use. See the
	.Sy userobjused Ns @ Ns Em user
	property for more information.
	.Pp
	Unprivileged users can only access their own groups' space usage.
	The root user, or a user who has been granted the
	.Sy groupobjused
	privilege with
	.Nm zfs Cm allow ,
	can access all groups' usage.
	.It Sy projectused Ns @ Ns Em project
	The amount of space consumed by the specified project in this dataset. Project
	is identified via the project identifier (ID) that is object-based numeral
	attribute. An object can inherit the project ID from its parent object (if the
	parent has the flag of inherit project ID that can be set and changed via
	.Nm chattr Fl /+P
	or
	.Nm zfs project Fl s )
	when being created. The privileged user can set and change object's project
	ID via
	.Nm chattr Fl p
	or
	.Nm zfs project Fl s
	anytime. Space is charged to the project of each file, as displayed by
	.Nm lsattr Fl p
	or
	.Nm zfs project .
	See the
	.Sy userused Ns @ Ns Em user
	property for more information.
	.Pp
	The root user, or a user who has been granted the
	.Sy projectused
	privilege with
	.Nm zfs allow ,
	can access all projects' usage.
	.It Sy projectobjused Ns @ Ns Em project
	The
	.Sy projectobjused
	is similar to
	.Sy projectused
	but instead it counts the number of objects consumed by project. When the
	property
	.Sy xattr=on
	is set on a fileset, ZFS will create additional objects per-file to store
	extended attributes. These additional objects are reflected in the
	.Sy projectobjused
	value and are counted against the project's
	.Sy projectobjquota .
	When a filesystem is configured to use
	.Sy xattr=sa
	no additional internal objects are required. See the
	.Sy userobjused Ns @ Ns Em user
	property for more information.
	.Pp
	The root user, or a user who has been granted the
	.Sy projectobjused
	privilege with
	.Nm zfs allow ,
	can access all projects' objects usage.
	.It Sy volblocksize
	For volumes, specifies the block size of the volume.
	The
	.Sy blocksize
	cannot be changed once the volume has been written, so it should be set at
	volume creation time.
	The default
	.Sy blocksize
	for volumes is 8 Kbytes.
	Any power of 2 from 512 bytes to 128 Kbytes is valid.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy volblock .
	.It Sy written
	The amount of space
	.Sy referenced
	by this dataset, that was written since the previous snapshot
	.Pq i.e. that is not referenced by the previous snapshot .
	.It Sy written Ns @ Ns Em snapshot
	The amount of
	.Sy referenced
	space written to this dataset since the specified snapshot.
	This is the space that is referenced by this dataset but was not referenced by
	the specified snapshot.
	.Pp
	The
	.Em snapshot
	may be specified as a short snapshot name
	.Po just the part after the
	.Sy @
	.Pc ,
	in which case it will be interpreted as a snapshot in the same filesystem as
	this dataset.
	The
	.Em snapshot
	may be a full snapshot name
	.Po Em filesystem Ns @ Ns Em snapshot Pc ,
	which for clones may be a snapshot in the origin's filesystem
	.Pq or the origin of the origin's filesystem, etc.
	.El
	.Pp
	The following native properties can be used to change the behavior of a ZFS
	dataset.
	.Bl -tag -width ""
	.It Xo
	.Sy aclinherit Ns = Ns Sy discard Ns \| Ns Sy noallow Ns \| Ns
	.Sy restricted Ns \| Ns Sy passthrough Ns \| Ns Sy passthrough-x
	.Xc
	Controls how ACEs are inherited when files and directories are created.
	.Bl -tag -width "passthrough-x"
	.It Sy discard
	does not inherit any ACEs.
	.It Sy noallow
	only inherits inheritable ACEs that specify
	.Qq deny
	permissions.
	.It Sy restricted
	default, removes the
	.Sy write_acl
	and
	.Sy write_owner
	permissions when the ACE is inherited.
	.It Sy passthrough
	inherits all inheritable ACEs without any modifications.
	.It Sy passthrough-x
	same meaning as
	.Sy passthrough ,
	except that the
	.Sy owner@ ,
	.Sy group@ ,
	and
	.Sy everyone@
	ACEs inherit the execute permission only if the file creation mode also requests
	the execute bit.
	.El
	.Pp
	When the property value is set to
	.Sy passthrough ,
	files are created with a mode determined by the inheritable ACEs.
	If no inheritable ACEs exist that affect the mode, then the mode is set in
	accordance to the requested mode from the application.
	.Pp
	The
	.Sy aclinherit
	property does not apply to POSIX ACLs.
	.It Xo
	.Sy aclmode Ns = Ns Sy discard Ns \| Ns Sy groupmask Ns \| Ns
	.Sy passthrough Ns \| Ns Sy restricted Ns
	.Xc
	Controls how an ACL is modified during chmod(2) and how inherited ACEs
	are modified by the file creation mode.
	.Bl -tag -width "passthrough"
	.It Sy discard
	default, deletes all
	.Sy ACEs
	except for those representing
	the mode of the file or directory requested by
	.Xr chmod 2 .
	.It Sy groupmask
	reduces permissions granted in all
	.Sy ALLOW
	entries found in the
	.Sy ACL
	such that they are no greater than the group permissions specified by
	.Xr chmod 2 .
	.It Sy passthrough
	indicates that no changes are made to the
	.Tn ACL
	other than creating or updating the necessary
	.Tn ACL
	entries to represent the new mode of the file or directory.
	.It Sy restricted
	will cause the
	.Xr chmod 2
	operation to return an error when used on any file or directory which has
	a non-trivial
	.Tn ACL
	whose entries can not be represented by a mode.
	.Xr chmod 2
	is required to change the set user ID, set group ID, or sticky bits on a file
	or directory, as they do not have equivalent
	.Tn ACL
	entries.
	In order to use
	.Xr chmod 2
	on a file or directory with a non-trivial
	.Tn ACL
	when
	.Sy aclmode
	is set to
	.Sy restricted ,
	you must first remove all
	.Tn ACL
	entries which do not represent the current mode.
	.El
	-.It Sy acltype Ns = Ns Sy off Ns \| Ns Sy noacl Ns \| Ns Sy posixacl
	+.It Sy acltype Ns = Ns Sy off Ns \| Ns Sy posix
	Controls whether ACLs are enabled and if so what type of ACL to use.
	This property is not visible on FreeBSD yet.
	.Bl -tag -width "posixacl"
	.It Sy off
	default, when a file system has the
	.Sy acltype
	property set to off then ACLs are disabled.
	.It Sy noacl
	an alias for
	.Sy off
	-.It Sy posixacl
	+.It Sy posix
	indicates POSIX ACLs should be used. POSIX ACLs are specific to Linux and are
	not functional on other platforms. POSIX ACLs are stored as an extended
	attribute and therefore will not overwrite any existing NFSv4 ACLs which
	may be set.
	+.It Sy posixacl
	+an alias for
	+.Sy posix
	.El
	.Pp
	To obtain the best performance when setting
	-.Sy posixacl
	+.Sy posix
	users are strongly encouraged to set the
	.Sy xattr=sa
	property. This will result in the POSIX ACL being stored more efficiently on
	disk. But as a consequence, all new extended attributes will only be
	accessible from OpenZFS implementations which support the
	.Sy xattr=sa
	property. See the
	.Sy xattr
	property for more details.
	.It Sy atime Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether the access time for files is updated when they are read.
	Turning this property off avoids producing write traffic when reading files and
	can result in significant performance gains, though it might confuse mailers
	and other similar utilities. The values
	.Sy on
	and
	.Sy off
	are equivalent to the
	.Sy atime
	and
	.Sy noatime
	mount options. The default value is
	.Sy on .
	See also
	.Sy relatime
	below.
	.It Sy canmount Ns = Ns Sy on Ns \| Ns Sy off Ns \| Ns Sy noauto
	If this property is set to
	.Sy off ,
	the file system cannot be mounted, and is ignored by
	.Nm zfs Cm mount Fl a .
	Setting this property to
	.Sy off
	is similar to setting the
	.Sy mountpoint
	property to
	.Sy none ,
	except that the dataset still has a normal
	.Sy mountpoint
	property, which can be inherited.
	Setting this property to
	.Sy off
	allows datasets to be used solely as a mechanism to inherit properties.
	One example of setting
	.Sy canmount Ns = Ns Sy off
	is to have two datasets with the same
	.Sy mountpoint ,
	so that the children of both datasets appear in the same directory, but might
	have different inherited characteristics.
	.Pp
	When set to
	.Sy noauto ,
	a dataset can only be mounted and unmounted explicitly.
	The dataset is not mounted automatically when the dataset is created or
	imported, nor is it mounted by the
	.Nm zfs Cm mount Fl a
	command or unmounted by the
	.Nm zfs Cm unmount Fl a
	command.
	.Pp
	This property is not inherited.
	.It Xo
	.Sy checksum Ns = Ns Sy on Ns \| Ns Sy off Ns \| Ns Sy fletcher2 Ns \| Ns
	.Sy fletcher4 Ns \| Ns Sy sha256 Ns \| Ns Sy noparity Ns \| Ns
	.Sy sha512 Ns \| Ns Sy skein Ns \| Ns Sy edonr
	.Xc
	Controls the checksum used to verify data integrity.
	The default value is
	.Sy on ,
	which automatically selects an appropriate algorithm
	.Po currently,
	.Sy fletcher4 ,
	but this may change in future releases
	.Pc .
	The value
	.Sy off
	disables integrity checking on user data.
	The value
	.Sy noparity
	not only disables integrity but also disables maintaining parity for user data.
	This setting is used internally by a dump device residing on a RAID-Z pool and
	should not be used by any other dataset.
	Disabling checksums is
	.Sy NOT
	a recommended practice.
	.Pp
	The
	.Sy sha512 ,
	.Sy skein ,
	and
	.Sy edonr
	checksum algorithms require enabling the appropriate features on the pool.
	FreeBSD does not support the
	.Sy edonr
	algorithm.
	.Pp
	Please see
	.Xr zpool-features 5
	for more information on these algorithms.
	.Pp
	Changing this property affects only newly-written data.
	.It Xo
	.Sy compression Ns = Ns Sy on Ns \| Ns Sy off Ns \| Ns Sy gzip Ns \| Ns
	.Sy gzip- Ns Em N Ns \| Ns Sy lz4 Ns \| Ns Sy lzjb Ns \| Ns Sy zle Ns \| Ns Sy zstd Ns \| Ns
	.Sy zstd- Ns Em N Ns \| Ns Sy zstd-fast Ns \| Ns Sy zstd-fast- Ns Em N
	.Xc
	Controls the compression algorithm used for this dataset.
	.Pp
	Setting compression to
	.Sy on
	indicates that the current default compression algorithm should be used.
	The default balances compression and decompression speed, with compression ratio
	and is expected to work well on a wide variety of workloads.
	Unlike all other settings for this property,
	.Sy on
	does not select a fixed compression type.
	As new compression algorithms are added to ZFS and enabled on a pool, the
	default compression algorithm may change.
	The current default compression algorithm is either
	.Sy lzjb
	or, if the
	.Sy lz4_compress
	feature is enabled,
	.Sy lz4 .
	.Pp
	The
	.Sy lz4
	compression algorithm is a high-performance replacement for the
	.Sy lzjb
	algorithm.
	It features significantly faster compression and decompression, as well as a
	moderately higher compression ratio than
	.Sy lzjb ,
	but can only be used on pools with the
	.Sy lz4_compress
	feature set to
	.Sy enabled .
	See
	.Xr zpool-features 5
	for details on ZFS feature flags and the
	.Sy lz4_compress
	feature.
	.Pp
	The
	.Sy lzjb
	compression algorithm is optimized for performance while providing decent data
	compression.
	.Pp
	The
	.Sy gzip
	compression algorithm uses the same compression as the
	.Xr gzip 1
	command.
	You can specify the
	.Sy gzip
	level by using the value
	.Sy gzip- Ns Em N ,
	where
	.Em N
	is an integer from 1
	.Pq fastest
	to 9
	.Pq best compression ratio .
	Currently,
	.Sy gzip
	is equivalent to
	.Sy gzip-6
	.Po which is also the default for
	.Xr gzip 1
	.Pc .
	.Pp
	The
	.Sy zstd
	compression algorithm provides both high compression ratios and good
	performance. You can specify the
	.Sy zstd
	level by using the value
	.Sy zstd- Ns Em N ,
	where
	.Em N
	is an integer from 1
	.Pq fastest
	to 19
	.Pq best compression ratio .
	.Sy zstd
	is equivalent to
	.Sy zstd-3 .
	.Pp
	Faster speeds at the cost of the compression ratio can be requested by
	setting a negative
	.Sy zstd
	level. This is done using
	.Sy zstd-fast- Ns Em N ,
	where
	.Em N
	is an integer in [1-9,10,20,30,...,100,500,1000] which maps to a negative
	.Sy zstd
	level. The lower the level the faster the compression - 1000 provides
	the fastest compression and lowest compression ratio.
	.Sy zstd-fast
	is equivalent to
	.Sy zstd-fast-1 .
	.Pp
	The
	.Sy zle
	compression algorithm compresses runs of zeros.
	.Pp
	This property can also be referred to by its shortened column name
	.Sy compress .
	Changing this property affects only newly-written data.
	.Pp
	When any setting except
	.Sy off
	is selected, compression will explicitly check for blocks consisting of only
	zeroes (the NUL byte). When a zero-filled block is detected, it is stored as
	a hole and not compressed using the indicated compression algorithm.
	.Pp
	Any block being compressed must be no larger than 7/8 of its original size
	after compression, otherwise the compression will not be considered worthwhile
	and the block saved uncompressed. Note that when the logical block is less than
	8 times the disk sector size this effectively reduces the necessary compression
	ratio; for example 8k blocks on disks with 4k disk sectors must compress to 1/2
	or less of their original size.
	.It Xo
	.Sy context Ns = Ns Sy none Ns \| Ns
	.Em SELinux_User:SElinux_Role:Selinux_Type:Sensitivity_Level
	.Xc
	This flag sets the SELinux context for all files in the file system under
	a mount point for that file system. See
	.Xr selinux 8
	for more information.
	.It Xo
	.Sy fscontext Ns = Ns Sy none Ns \| Ns
	.Em SELinux_User:SElinux_Role:Selinux_Type:Sensitivity_Level
	.Xc
	This flag sets the SELinux context for the file system file system being
	mounted. See
	.Xr selinux 8
	for more information.
	.It Xo
	.Sy defcontext Ns = Ns Sy none Ns \| Ns
	.Em SELinux_User:SElinux_Role:Selinux_Type:Sensitivity_Level
	.Xc
	This flag sets the SELinux default context for unlabeled files. See
	.Xr selinux 8
	for more information.
	.It Xo
	.Sy rootcontext Ns = Ns Sy none Ns \| Ns
	.Em SELinux_User:SElinux_Role:Selinux_Type:Sensitivity_Level
	.Xc
	This flag sets the SELinux context for the root inode of the file system. See
	.Xr selinux 8
	for more information.
	.It Sy copies Ns = Ns Sy 1 Ns \| Ns Sy 2 Ns \| Ns Sy 3
	Controls the number of copies of data stored for this dataset.
	These copies are in addition to any redundancy provided by the pool, for
	example, mirroring or RAID-Z.
	The copies are stored on different disks, if possible.
	The space used by multiple copies is charged to the associated file and dataset,
	changing the
	.Sy used
	property and counting against quotas and reservations.
	.Pp
	Changing this property only affects newly-written data.
	Therefore, set this property at file system creation time by using the
	.Fl o Sy copies Ns = Ns Ar N
	option.
	.Pp
	Remember that ZFS will not import a pool with a missing top-level vdev. Do
	.Sy NOT
	create, for example a two-disk striped pool and set
	.Sy copies=2
	on some datasets thinking you have setup redundancy for them. When a disk
	fails you will not be able to import the pool and will have lost all of your
	data.
	.Pp
	Encrypted datasets may not have
	.Sy copies Ns = Ns Em 3
	since the implementation stores some encryption metadata where the third copy
	would normally be.
	.It Sy devices Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether device nodes can be opened on this file system.
	The default value is
	.Sy on .
	The values
	.Sy on
	and
	.Sy off
	are equivalent to the
	.Sy dev
	and
	.Sy nodev
	mount options.
	.It Xo
	.Sy dedup Ns = Ns Sy off Ns \| Ns Sy on Ns \| Ns Sy verify Ns \| Ns
	.Sy sha256[,verify] Ns \| Ns Sy sha512[,verify] Ns \| Ns Sy skein[,verify] Ns \| Ns
	.Sy edonr,verify
	.Xc
	Configures deduplication for a dataset. The default value is
	.Sy off .
	The default deduplication checksum is
	.Sy sha256
	(this may change in the future). When
	.Sy dedup
	is enabled, the checksum defined here overrides the
	.Sy checksum
	property. Setting the value to
	.Sy verify
	has the same effect as the setting
	.Sy sha256,verify.
	.Pp
	If set to
	.Sy verify ,
	ZFS will do a byte-to-byte comparison in case of two blocks having the same
	signature to make sure the block contents are identical. Specifying
	.Sy verify
	is mandatory for the
	.Sy edonr
	algorithm.
	.Pp
	Unless necessary, deduplication should NOT be enabled on a system. See the
	.Em Deduplication
	section of
	.Xr zfsconcepts 8 .
	.It Xo
	.Sy dnodesize Ns = Ns Sy legacy Ns \| Ns Sy auto Ns \| Ns Sy 1k Ns \| Ns
	.Sy 2k Ns \| Ns Sy 4k Ns \| Ns Sy 8k Ns \| Ns Sy 16k
	.Xc
	Specifies a compatibility mode or literal value for the size of dnodes in the
	file system. The default value is
	.Sy legacy .
	Setting this property to a value other than
	.Sy legacy
	requires the large_dnode pool feature to be enabled.
	.Pp
	Consider setting
	.Sy dnodesize
	to
	.Sy auto
	if the dataset uses the
	.Sy xattr=sa
	property setting and the workload makes heavy use of extended attributes. This
	may be applicable to SELinux-enabled systems, Lustre servers, and Samba
	servers, for example. Literal values are supported for cases where the optimal
	size is known in advance and for performance testing.
	.Pp
	Leave
	.Sy dnodesize
	set to
	.Sy legacy
	if you need to receive a send stream of this dataset on a pool that doesn't
	enable the large_dnode feature, or if you need to import this pool on a system
	that doesn't support the large_dnode feature.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy dnsize .
	.It Xo
	.Sy encryption Ns = Ns Sy off Ns \| Ns Sy on Ns \| Ns Sy aes-128-ccm Ns \| Ns
	.Sy aes-192-ccm Ns \| Ns Sy aes-256-ccm Ns \| Ns Sy aes-128-gcm Ns \| Ns
	.Sy aes-192-gcm Ns \| Ns Sy aes-256-gcm
	.Xc
	Controls the encryption cipher suite (block cipher, key length, and mode) used
	for this dataset. Requires the
	.Sy encryption
	feature to be enabled on the pool.
	Requires a
	.Sy keyformat
	to be set at dataset creation time.
	.Pp
	Selecting
	.Sy encryption Ns = Ns Sy on
	when creating a dataset indicates that the default encryption suite will be
	selected, which is currently
	.Sy aes-256-gcm .
	In order to provide consistent data protection, encryption must be specified at
	dataset creation time and it cannot be changed afterwards.
	.Pp
	For more details and caveats about encryption see the
	-.Sy Encryption
	-section.
	+.Em Encryption
	+section of
	+.Xr zfs-load-key 8 .
	.It Sy keyformat Ns = Ns Sy raw Ns \| Ns Sy hex Ns \| Ns Sy passphrase
	Controls what format the user's encryption key will be provided as. This
	property is only set when the dataset is encrypted.
	.Pp
	Raw keys and hex keys must be 32 bytes long (regardless of the chosen
	encryption suite) and must be randomly generated. A raw key can be generated
	with the following command:
	.Bd -literal
	# dd if=/dev/urandom of=/path/to/output/key bs=32 count=1
	.Ed
	.Pp
	Passphrases must be between 8 and 512 bytes long and will be processed through
	PBKDF2 before being used (see the
	.Sy pbkdf2iters
	property). Even though the
	encryption suite cannot be changed after dataset creation, the keyformat can be
	with
	.Nm zfs Cm change-key .
	.It Xo
	.Sy keylocation Ns = Ns Sy prompt Ns \| Ns Sy file:// Ns Em </absolute/file/path>
	.Xc
	Controls where the user's encryption key will be loaded from by default for
	commands such as
	.Nm zfs Cm load-key
	and
	.Nm zfs Cm mount Cm -l .
	This property is only set for encrypted datasets which are encryption roots. If
	unspecified, the default is
	.Sy prompt.
	.Pp
	Even though the encryption suite cannot be changed after dataset creation, the
	keylocation can be with either
	.Nm zfs Cm set
	or
	.Nm zfs Cm change-key .
	If
	.Sy prompt
	is selected ZFS will ask for the key at the command prompt when it is required
	to access the encrypted data (see
	.Nm zfs Cm load-key
	for details). This setting will also allow the key to be passed in via STDIN,
	but users should be careful not to place keys which should be kept secret on
	the command line. If a file URI is selected, the key will be loaded from the
	specified absolute file path.
	.It Sy pbkdf2iters Ns = Ns Ar iterations
	Controls the number of PBKDF2 iterations that a
	.Sy passphrase
	encryption key should be run through when processing it into an encryption key.
	This property is only defined when encryption is enabled and a keyformat of
	.Sy passphrase
	is selected. The goal of PBKDF2 is to significantly increase the
	computational difficulty needed to brute force a user's passphrase. This is
	accomplished by forcing the attacker to run each passphrase through a
	computationally expensive hashing function many times before they arrive at the
	resulting key. A user who actually knows the passphrase will only have to pay
	this cost once. As CPUs become better at processing, this number should be
	raised to ensure that a brute force attack is still not possible. The current
	default is
	.Sy 350000
	and the minimum is
	.Sy 100000 .
	This property may be changed with
	.Nm zfs Cm change-key .
	.It Sy exec Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether processes can be executed from within this file system.
	The default value is
	.Sy on .
	The values
	.Sy on
	and
	.Sy off
	are equivalent to the
	.Sy exec
	and
	.Sy noexec
	mount options.
	.It Sy filesystem_limit Ns = Ns Em count Ns \| Ns Sy none
	Limits the number of filesystems and volumes that can exist under this point in
	the dataset tree.
	The limit is not enforced if the user is allowed to change the limit.
	Setting a
	.Sy filesystem_limit
	to
	.Sy on
	a descendent of a filesystem that already has a
	.Sy filesystem_limit
	does not override the ancestor's
	.Sy filesystem_limit ,
	but rather imposes an additional limit.
	This feature must be enabled to be used
	.Po see
	.Xr zpool-features 5
	.Pc .
	.It Sy special_small_blocks Ns = Ns Em size
	This value represents the threshold block size for including small file
	blocks into the special allocation class. Blocks smaller than or equal to this
	value will be assigned to the special allocation class while greater blocks
	will be assigned to the regular class. Valid values are zero or a power of two
	from 512B up to 1M. The default size is 0 which means no small file blocks
	will be allocated in the special class.
	.Pp
	Before setting this property, a special class vdev must be added to the
	pool. See
	.Xr zpool 8
	for more details on the special allocation class.
	.It Sy mountpoint Ns = Ns Pa path Ns \| Ns Sy none Ns \| Ns Sy legacy
	Controls the mount point used for this file system.
	See the
	.Em Mount Points
	section of
	.Xr zfsconcepts 8
	for more information on how this property is used.
	.Pp
	When the
	.Sy mountpoint
	property is changed for a file system, the file system and any children that
	inherit the mount point are unmounted.
	If the new value is
	.Sy legacy ,
	then they remain unmounted.
	Otherwise, they are automatically remounted in the new location if the property
	was previously
	.Sy legacy
	or
	.Sy none ,
	or if they were mounted before the property was changed.
	In addition, any shared file systems are unshared and shared in the new
	location.
	.It Sy nbmand Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether the file system should be mounted with
	.Sy nbmand
	.Pq Non Blocking mandatory locks .
	This is used for SMB clients.
	Changes to this property only take effect when the file system is umounted and
	remounted.
	See
	.Xr mount 8
	for more information on
	.Sy nbmand
	mounts. This property is not used on Linux.
	.It Sy overlay Ns = Ns Sy on Ns \| Ns Sy off
	Allow mounting on a busy directory or a directory which already contains
	files or directories.
	This is the default mount behavior for Linux and FreeBSD file systems.
	On these platforms the property is
	.Sy on
	by default.
	Set to
	.Sy off
	to disable overlay mounts for consistency with OpenZFS on other platforms.
	.It Sy primarycache Ns = Ns Sy all Ns \| Ns Sy none Ns \| Ns Sy metadata
	Controls what is cached in the primary cache
	.Pq ARC .
	If this property is set to
	.Sy all ,
	then both user data and metadata is cached.
	If this property is set to
	.Sy none ,
	then neither user data nor metadata is cached.
	If this property is set to
	.Sy metadata ,
	then only metadata is cached.
	The default value is
	.Sy all .
	.It Sy quota Ns = Ns Em size Ns \| Ns Sy none
	Limits the amount of space a dataset and its descendents can consume.
	This property enforces a hard limit on the amount of space used.
	This includes all space consumed by descendents, including file systems and
	snapshots.
	Setting a quota on a descendent of a dataset that already has a quota does not
	override the ancestor's quota, but rather imposes an additional limit.
	.Pp
	Quotas cannot be set on volumes, as the
	.Sy volsize
	property acts as an implicit quota.
	.It Sy snapshot_limit Ns = Ns Em count Ns \| Ns Sy none
	Limits the number of snapshots that can be created on a dataset and its
	descendents.
	Setting a
	.Sy snapshot_limit
	on a descendent of a dataset that already has a
	.Sy snapshot_limit
	does not override the ancestor's
	.Sy snapshot_limit ,
	but rather imposes an additional limit.
	The limit is not enforced if the user is allowed to change the limit.
	For example, this means that recursive snapshots taken from the global zone are
	counted against each delegated dataset within a zone.
	This feature must be enabled to be used
	.Po see
	.Xr zpool-features 5
	.Pc .
	.It Sy userquota@ Ns Em user Ns = Ns Em size Ns \| Ns Sy none
	Limits the amount of space consumed by the specified user.
	User space consumption is identified by the
	.Sy userspace@ Ns Em user
	property.
	.Pp
	Enforcement of user quotas may be delayed by several seconds.
	This delay means that a user might exceed their quota before the system notices
	that they are over quota and begins to refuse additional writes with the
	.Er EDQUOT
	error message.
	See the
	.Nm zfs Cm userspace
	subcommand for more information.
	.Pp
	Unprivileged users can only access their own groups' space usage.
	The root user, or a user who has been granted the
	.Sy userquota
	privilege with
	.Nm zfs Cm allow ,
	can get and set everyone's quota.
	.Pp
	This property is not available on volumes, on file systems before version 4, or
	on pools before version 15.
	The
	.Sy userquota@ Ns Em ...
	properties are not displayed by
	.Nm zfs Cm get Sy all .
	The user's name must be appended after the
	.Sy @
	symbol, using one of the following forms:
	.Bl -bullet
	.It
	.Em POSIX name
	.Po for example,
	.Sy joe
	.Pc
	.It
	.Em POSIX numeric ID
	.Po for example,
	.Sy 789
	.Pc
	.It
	.Em SID name
	.Po for example,
	.Sy joe.smith@mydomain
	.Pc
	.It
	.Em SID numeric ID
	.Po for example,
	.Sy S-1-123-456-789
	.Pc
	.El
	.Pp
	Files created on Linux always have POSIX owners.
	.It Sy userobjquota@ Ns Em user Ns = Ns Em size Ns \| Ns Sy none
	The
	.Sy userobjquota
	is similar to
	.Sy userquota
	but it limits the number of objects a user can create. Please refer to
	.Sy userobjused
	for more information about how objects are counted.
	.It Sy groupquota@ Ns Em group Ns = Ns Em size Ns \| Ns Sy none
	Limits the amount of space consumed by the specified group.
	Group space consumption is identified by the
	.Sy groupused@ Ns Em group
	property.
	.Pp
	Unprivileged users can access only their own groups' space usage.
	The root user, or a user who has been granted the
	.Sy groupquota
	privilege with
	.Nm zfs Cm allow ,
	can get and set all groups' quotas.
	.It Sy groupobjquota@ Ns Em group Ns = Ns Em size Ns \| Ns Sy none
	The
	.Sy groupobjquota
	is similar to
	.Sy groupquota
	but it limits number of objects a group can consume. Please refer to
	.Sy userobjused
	for more information about how objects are counted.
	.It Sy projectquota@ Ns Em project Ns = Ns Em size Ns \| Ns Sy none
	Limits the amount of space consumed by the specified project. Project
	space consumption is identified by the
	.Sy projectused@ Ns Em project
	property. Please refer to
	.Sy projectused
	for more information about how project is identified and set/changed.
	.Pp
	The root user, or a user who has been granted the
	.Sy projectquota
	privilege with
	.Nm zfs allow ,
	can access all projects' quota.
	.It Sy projectobjquota@ Ns Em project Ns = Ns Em size Ns \| Ns Sy none
	The
	.Sy projectobjquota
	is similar to
	.Sy projectquota
	but it limits number of objects a project can consume. Please refer to
	.Sy userobjused
	for more information about how objects are counted.
	.It Sy readonly Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether this dataset can be modified.
	The default value is
	.Sy off .
	The values
	.Sy on
	and
	.Sy off
	are equivalent to the
	.Sy ro
	and
	.Sy rw
	mount options.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy rdonly .
	.It Sy recordsize Ns = Ns Em size
	Specifies a suggested block size for files in the file system.
	This property is designed solely for use with database workloads that access
	files in fixed-size records.
	ZFS automatically tunes block sizes according to internal algorithms optimized
	for typical access patterns.
	.Pp
	For databases that create very large files but access them in small random
	chunks, these algorithms may be suboptimal.
	Specifying a
	.Sy recordsize
	greater than or equal to the record size of the database can result in
	significant performance gains.
	Use of this property for general purpose file systems is strongly discouraged,
	and may adversely affect performance.
	.Pp
	The size specified must be a power of two greater than or equal to 512 and less
	than or equal to 128 Kbytes.
	If the
	.Sy large_blocks
	feature is enabled on the pool, the size may be up to 1 Mbyte.
	See
	.Xr zpool-features 5
	for details on ZFS feature flags.
	.Pp
	Changing the file system's
	.Sy recordsize
	affects only files created afterward; existing files are unaffected.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy recsize .
	.It Sy redundant_metadata Ns = Ns Sy all Ns \| Ns Sy most
	Controls what types of metadata are stored redundantly.
	ZFS stores an extra copy of metadata, so that if a single block is corrupted,
	the amount of user data lost is limited.
	This extra copy is in addition to any redundancy provided at the pool level
	.Pq e.g. by mirroring or RAID-Z ,
	and is in addition to an extra copy specified by the
	.Sy copies
	property
	.Pq up to a total of 3 copies .
	For example if the pool is mirrored,
	.Sy copies Ns = Ns 2 ,
	and
	.Sy redundant_metadata Ns = Ns Sy most ,
	then ZFS stores 6 copies of most metadata, and 4 copies of data and some
	metadata.
	.Pp
	When set to
	.Sy all ,
	ZFS stores an extra copy of all metadata.
	If a single on-disk block is corrupt, at worst a single block of user data
	.Po which is
	.Sy recordsize
	bytes long
	.Pc
	can be lost.
	.Pp
	When set to
	.Sy most ,
	ZFS stores an extra copy of most types of metadata.
	This can improve performance of random writes, because less metadata must be
	written.
	In practice, at worst about 100 blocks
	.Po of
	.Sy recordsize
	bytes each
	.Pc
	of user data can be lost if a single on-disk block is corrupt.
	The exact behavior of which metadata blocks are stored redundantly may change in
	future releases.
	.Pp
	The default value is
	.Sy all .
	.It Sy refquota Ns = Ns Em size Ns \| Ns Sy none
	Limits the amount of space a dataset can consume.
	This property enforces a hard limit on the amount of space used.
	This hard limit does not include space used by descendents, including file
	systems and snapshots.
	.It Sy refreservation Ns = Ns Em size Ns \| Ns Sy none Ns \| Ns Sy auto
	The minimum amount of space guaranteed to a dataset, not including its
	descendents.
	When the amount of space used is below this value, the dataset is treated as if
	it were taking up the amount of space specified by
	.Sy refreservation .
	The
	.Sy refreservation
	reservation is accounted for in the parent datasets' space used, and counts
	against the parent datasets' quotas and reservations.
	.Pp
	If
	.Sy refreservation
	is set, a snapshot is only allowed if there is enough free pool space outside of
	this reservation to accommodate the current number of
	.Qq referenced
	bytes in the dataset.
	.Pp
	If
	.Sy refreservation
	is set to
	.Sy auto ,
	a volume is thick provisioned
	.Po or
	.Qq not sparse
	.Pc .
	.Sy refreservation Ns = Ns Sy auto
	is only supported on volumes.
	See
	.Sy volsize
	in the
	.Sx Native Properties
	section for more information about sparse volumes.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy refreserv .
	.It Sy relatime Ns = Ns Sy on Ns \| Ns Sy off
	Controls the manner in which the access time is updated when
	.Sy atime=on
	is set. Turning this property on causes the access time to be updated relative
	to the modify or change time. Access time is only updated if the previous
	access time was earlier than the current modify or change time or if the
	existing access time hasn't been updated within the past 24 hours. The default
	value is
	.Sy off .
	The values
	.Sy on
	and
	.Sy off
	are equivalent to the
	.Sy relatime
	and
	.Sy norelatime
	mount options.
	.It Sy reservation Ns = Ns Em size Ns \| Ns Sy none
	The minimum amount of space guaranteed to a dataset and its descendants.
	When the amount of space used is below this value, the dataset is treated as if
	it were taking up the amount of space specified by its reservation.
	Reservations are accounted for in the parent datasets' space used, and count
	against the parent datasets' quotas and reservations.
	.Pp
	This property can also be referred to by its shortened column name,
	.Sy reserv .
	.It Sy secondarycache Ns = Ns Sy all Ns \| Ns Sy none Ns \| Ns Sy metadata
	Controls what is cached in the secondary cache
	.Pq L2ARC .
	If this property is set to
	.Sy all ,
	then both user data and metadata is cached.
	If this property is set to
	.Sy none ,
	then neither user data nor metadata is cached.
	If this property is set to
	.Sy metadata ,
	then only metadata is cached.
	The default value is
	.Sy all .
	.It Sy setuid Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether the setuid bit is respected for the file system.
	The default value is
	.Sy on .
	The values
	.Sy on
	and
	.Sy off
	are equivalent to the
	.Sy suid
	and
	.Sy nosuid
	mount options.
	.It Sy sharesmb Ns = Ns Sy on Ns \| Ns Sy off Ns \| Ns Em opts
	Controls whether the file system is shared by using
	.Sy Samba USERSHARES
	and what options are to be used. Otherwise, the file system is automatically
	shared and unshared with the
	.Nm zfs Cm share
	and
	.Nm zfs Cm unshare
	commands. If the property is set to on, the
	.Xr net 8
	command is invoked to create a
	.Sy USERSHARE .
	.Pp
	Because SMB shares requires a resource name, a unique resource name is
	constructed from the dataset name. The constructed name is a copy of the
	dataset name except that the characters in the dataset name, which would be
	invalid in the resource name, are replaced with underscore (_) characters.
	Linux does not currently support additional options which might be available
	on Solaris.
	.Pp
	If the
	.Sy sharesmb
	property is set to
	.Sy off ,
	the file systems are unshared.
	.Pp
	The share is created with the ACL (Access Control List) "Everyone:F" ("F"
	stands for "full permissions", ie. read and write permissions) and no guest
	access (which means Samba must be able to authenticate a real user, system
	passwd/shadow, LDAP or smbpasswd based) by default. This means that any
	additional access control (disallow specific user specific access etc) must
	be done on the underlying file system.
	.It Sy sharenfs Ns = Ns Sy on Ns \| Ns Sy off Ns \| Ns Em opts
	Controls whether the file system is shared via NFS, and what options are to be
	used.
	A file system with a
	.Sy sharenfs
	property of
	.Sy off
	is managed with the
	.Xr exportfs 8
	command and entries in the
	.Em /etc/exports
	file.
	Otherwise, the file system is automatically shared and unshared with the
	.Nm zfs Cm share
	and
	.Nm zfs Cm unshare
	commands.
	If the property is set to
	.Sy on ,
	the dataset is shared using the default options:
	.Pp
	.Em sec=sys,rw,crossmnt,no_subtree_check
	.Pp
	See
	.Xr exports 5
	for the meaning of the default options. Otherwise, the
	.Xr exportfs 8
	command is invoked with options equivalent to the contents of this property.
	.Pp
	When the
	.Sy sharenfs
	property is changed for a dataset, the dataset and any children inheriting the
	property are re-shared with the new options, only if the property was previously
	.Sy off ,
	or if they were shared before the property was changed.
	If the new property is
	.Sy off ,
	the file systems are unshared.
	.It Sy logbias Ns = Ns Sy latency Ns \| Ns Sy throughput
	Provide a hint to ZFS about handling of synchronous requests in this dataset.
	If
	.Sy logbias
	is set to
	.Sy latency
	.Pq the default ,
	ZFS will use pool log devices
	.Pq if configured
	to handle the requests at low latency.
	If
	.Sy logbias
	is set to
	.Sy throughput ,
	ZFS will not use configured pool log devices.
	ZFS will instead optimize synchronous operations for global pool throughput and
	efficient use of resources.
	.It Sy snapdev Ns = Ns Sy hidden Ns \| Ns Sy visible
	Controls whether the volume snapshot devices under
	.Em /dev/zvol/<pool>
	are hidden or visible. The default value is
	.Sy hidden .
	.It Sy snapdir Ns = Ns Sy hidden Ns \| Ns Sy visible
	Controls whether the
	.Pa .zfs
	directory is hidden or visible in the root of the file system as discussed in
	the
	.Em Snapshots
	section of
	.Xr zfsconcepts 8 .
	The default value is
	.Sy hidden .
	.It Sy sync Ns = Ns Sy standard Ns \| Ns Sy always Ns \| Ns Sy disabled
	Controls the behavior of synchronous requests
	.Pq e.g. fsync, O_DSYNC .
	.Sy standard
	is the
	.Tn POSIX
	specified behavior of ensuring all synchronous requests are written to stable
	storage and all devices are flushed to ensure data is not cached by device
	controllers
	.Pq this is the default .
	.Sy always
	causes every file system transaction to be written and flushed before its
	system call returns.
	This has a large performance penalty.
	.Sy disabled
	disables synchronous requests.
	File system transactions are only committed to stable storage periodically.
	This option will give the highest performance.
	However, it is very dangerous as ZFS would be ignoring the synchronous
	transaction demands of applications such as databases or NFS.
	Administrators should only use this option when the risks are understood.
	.It Sy version Ns = Ns Em N Ns \| Ns Sy current
	The on-disk version of this file system, which is independent of the pool
	version.
	This property can only be set to later supported versions.
	See the
	.Nm zfs Cm upgrade
	command.
	.It Sy volsize Ns = Ns Em size
	For volumes, specifies the logical size of the volume.
	By default, creating a volume establishes a reservation of equal size.
	For storage pools with a version number of 9 or higher, a
	.Sy refreservation
	is set instead.
	Any changes to
	.Sy volsize
	are reflected in an equivalent change to the reservation
	.Po or
	.Sy refreservation
	.Pc .
	The
	.Sy volsize
	can only be set to a multiple of
	.Sy volblocksize ,
	and cannot be zero.
	.Pp
	The reservation is kept equal to the volume's logical size to prevent unexpected
	behavior for consumers.
	Without the reservation, the volume could run out of space, resulting in
	undefined behavior or data corruption, depending on how the volume is used.
	These effects can also occur when the volume size is changed while it is in use
	.Pq particularly when shrinking the size .
	Extreme care should be used when adjusting the volume size.
	.Pp
	Though not recommended, a
	.Qq sparse volume
	.Po also known as
	.Qq thin provisioned
	.Pc
	can be created by specifying the
	.Fl s
	option to the
	.Nm zfs Cm create Fl V
	command, or by changing the value of the
	.Sy refreservation
	property
	.Po or
	.Sy reservation
	property on pool version 8 or earlier
	.Pc
	after the volume has been created.
	A
	.Qq sparse volume
	is a volume where the value of
	.Sy refreservation
	is less than the size of the volume plus the space required to store its
	metadata.
	Consequently, writes to a sparse volume can fail with
	.Er ENOSPC
	when the pool is low on space.
	For a sparse volume, changes to
	.Sy volsize
	are not reflected in the
	.Sy refreservation.
	A volume that is not sparse is said to be
	.Qq thick provisioned .
	A sparse volume can become thick provisioned by setting
	.Sy refreservation
	to
	.Sy auto .
	.It Sy volmode Ns = Ns Cm default \| full \| geom \| dev \| none
	This property specifies how volumes should be exposed to the OS.
	Setting it to
	.Sy full
	exposes volumes as fully fledged block devices, providing maximal
	functionality. The value
	.Sy geom
	is just an alias for
	.Sy full
	and is kept for compatibility.
	Setting it to
	.Sy dev
	hides its partitions.
	Volumes with property set to
	.Sy none
	are not exposed outside ZFS, but can be snapshotted, cloned, replicated, etc,
	that can be suitable for backup purposes.
	Value
	.Sy default
	means that volumes exposition is controlled by system-wide tunable
	.Va zvol_volmode ,
	where
	.Sy full ,
	.Sy dev
	and
	.Sy none
	are encoded as 1, 2 and 3 respectively.
	The default values is
	.Sy full .
	.It Sy vscan Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether regular files should be scanned for viruses when a file is
	opened and closed.
	In addition to enabling this property, the virus scan service must also be
	enabled for virus scanning to occur.
	The default value is
	.Sy off .
	This property is not used on Linux.
	.It Sy xattr Ns = Ns Sy on Ns \| Ns Sy off Ns \| Ns Sy sa
	Controls whether extended attributes are enabled for this file system. Two
	styles of extended attributes are supported either directory based or system
	attribute based.
	.Pp
	The default value of
	.Sy on
	enables directory based extended attributes. This style of extended attribute
	imposes no practical limit on either the size or number of attributes which
	can be set on a file. Although under Linux the
	.Xr getxattr 2
	and
	.Xr setxattr 2
	system calls limit the maximum size to 64K. This is the most compatible
	style of extended attribute and is supported by all OpenZFS implementations.
	.Pp
	System attribute based xattrs can be enabled by setting the value to
	.Sy sa .
	The key advantage of this type of xattr is improved performance. Storing
	extended attributes as system attributes significantly decreases the amount of
	disk IO required. Up to 64K of data may be stored per-file in the space
	reserved for system attributes. If there is not enough space available for
	an extended attribute then it will be automatically written as a directory
	based xattr. System attribute based extended attributes are not accessible
	on platforms which do not support the
	.Sy xattr=sa
	feature.
	.Pp
	The use of system attribute based xattrs is strongly encouraged for users of
	SELinux or POSIX ACLs. Both of these features heavily rely of extended
	attributes and benefit significantly from the reduced access time.
	.Pp
	The values
	.Sy on
	and
	.Sy off
	are equivalent to the
	.Sy xattr
	and
	.Sy noxattr
	mount options.
	.It Sy jailed Ns = Ns Cm off \| on
	Controls whether the dataset is managed from a jail. See the
	.Qq Sx Jails
	section in
	.Xr zfs 8
	for more information. Jails are a FreeBSD feature and are not relevant on
	other platforms. The default value is
	.Cm off .
	.It Sy zoned Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether the dataset is managed from a non-global zone. Zones are a
	Solaris feature and are not relevant on other platforms. The default value is
	.Sy off .
	.El
	.Pp
	The following three properties cannot be changed after the file system is
	created, and therefore, should be set when the file system is created.
	If the properties are not set with the
	.Nm zfs Cm create
	or
	.Nm zpool Cm create
	commands, these properties are inherited from the parent dataset.
	If the parent dataset lacks these properties due to having been created prior to
	these features being supported, the new file system will have the default values
	for these properties.
	.Bl -tag -width ""
	.It Xo
	.Sy casesensitivity Ns = Ns Sy sensitive Ns \| Ns
	.Sy insensitive Ns \| Ns Sy mixed
	.Xc
	Indicates whether the file name matching algorithm used by the file system
	should be case-sensitive, case-insensitive, or allow a combination of both
	styles of matching.
	The default value for the
	.Sy casesensitivity
	property is
	.Sy sensitive .
	Traditionally,
	.Ux
	and
	.Tn POSIX
	file systems have case-sensitive file names.
	.Pp
	The
	.Sy mixed
	value for the
	.Sy casesensitivity
	property indicates that the file system can support requests for both
	case-sensitive and case-insensitive matching behavior.
	Currently, case-insensitive matching behavior on a file system that supports
	mixed behavior is limited to the SMB server product.
	For more information about the
	.Sy mixed
	value behavior, see the "ZFS Administration Guide".
	.It Xo
	.Sy normalization Ns = Ns Sy none Ns \| Ns Sy formC Ns \| Ns
	.Sy formD Ns \| Ns Sy formKC Ns \| Ns Sy formKD
	.Xc
	Indicates whether the file system should perform a
	.Sy unicode
	normalization of file names whenever two file names are compared, and which
	normalization algorithm should be used.
	File names are always stored unmodified, names are normalized as part of any
	comparison process.
	If this property is set to a legal value other than
	.Sy none ,
	and the
	.Sy utf8only
	property was left unspecified, the
	.Sy utf8only
	property is automatically set to
	.Sy on .
	The default value of the
	.Sy normalization
	property is
	.Sy none .
	This property cannot be changed after the file system is created.
	.It Sy utf8only Ns = Ns Sy on Ns \| Ns Sy off
	Indicates whether the file system should reject file names that include
	characters that are not present in the
	.Sy UTF-8
	character code set.
	If this property is explicitly set to
	.Sy off ,
	the normalization property must either not be explicitly set or be set to
	.Sy none .
	The default value for the
	.Sy utf8only
	property is
	.Sy off .
	This property cannot be changed after the file system is created.
	.El
	.Pp
	The
	.Sy casesensitivity ,
	.Sy normalization ,
	and
	.Sy utf8only
	properties are also new permissions that can be assigned to non-privileged users
	by using the ZFS delegated administration feature.
	.Ss "Temporary Mount Point Properties"
	When a file system is mounted, either through
	.Xr mount 8
	for legacy mounts or the
	.Nm zfs Cm mount
	command for normal file systems, its mount options are set according to its
	properties.
	The correlation between properties and mount options is as follows:
	.Bd -literal
	PROPERTY MOUNT OPTION
	atime atime/noatime
	canmount auto/noauto
	devices dev/nodev
	exec exec/noexec
	readonly ro/rw
	relatime relatime/norelatime
	setuid suid/nosuid
	xattr xattr/noxattr
	.Ed
	.Pp
	In addition, these options can be set on a per-mount basis using the
	.Fl o
	option, without affecting the property that is stored on disk.
	The values specified on the command line override the values stored in the
	dataset.
	The
	.Sy nosuid
	option is an alias for
	.Sy nodevices Ns \&, Ns Sy nosetuid .
	These properties are reported as
	.Qq temporary
	by the
	.Nm zfs Cm get
	command.
	If the properties are changed while the dataset is mounted, the new setting
	overrides any temporary settings.
	.Ss "User Properties"
	In addition to the standard native properties, ZFS supports arbitrary user
	properties.
	User properties have no effect on ZFS behavior, but applications or
	administrators can use them to annotate datasets
	.Pq file systems, volumes, and snapshots .
	.Pp
	User property names must contain a colon
	.Pq Qq Sy \&:
	character to distinguish them from native properties.
	They may contain lowercase letters, numbers, and the following punctuation
	characters: colon
	.Pq Qq Sy \&: ,
	dash
	.Pq Qq Sy - ,
	period
	.Pq Qq Sy \&. ,
	and underscore
	.Pq Qq Sy _ .
	The expected convention is that the property name is divided into two portions
	such as
	.Em module Ns \&: Ns Em property ,
	but this namespace is not enforced by ZFS.
	User property names can be at most 256 characters, and cannot begin with a dash
	.Pq Qq Sy - .
	.Pp
	When making programmatic use of user properties, it is strongly suggested to use
	a reversed
	.Sy DNS
	domain name for the
	.Em module
	component of property names to reduce the chance that two
	independently-developed packages use the same property name for different
	purposes.
	.Pp
	The values of user properties are arbitrary strings, are always inherited, and
	are never validated.
	All of the commands that operate on properties
	.Po Nm zfs Cm list ,
	.Nm zfs Cm get ,
	.Nm zfs Cm set ,
	and so forth
	.Pc
	can be used to manipulate both native properties and user properties.
	Use the
	.Nm zfs Cm inherit
	command to clear a user property.
	If the property is not defined in any parent dataset, it is removed entirely.
	Property values are limited to 8192 bytes.
	Index: vendor-sys/openzfs/dist/man/man8/zgenhostid.8
	===================================================================
	--- vendor-sys/openzfs/dist/man/man8/zgenhostid.8 (revision 365891)
	+++ vendor-sys/openzfs/dist/man/man8/zgenhostid.8 (revision 365892)
	@@ -1,71 +1,102 @@
	.\"
	.\" CDDL HEADER START
	.\"
	.\" The contents of this file are subject to the terms of the
	.\" Common Development and Distribution License (the "License").
	.\" You may not use this file except in compliance with the License.
	.\"
	.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	.\" or http://www.opensolaris.org/os/licensing.
	.\" See the License for the specific language governing permissions
	.\" and limitations under the License.
	.\"
	.\" When distributing Covered Code, include this CDDL HEADER in each
	.\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	.\" If applicable, add the following below this CDDL HEADER, with the
	.\" fields enclosed by brackets "[]" replaced with your own identifying
	.\" information: Portions Copyright [yyyy] [name of copyright owner]
	.\"
	.\" CDDL HEADER END
	.\"
	.\"
	.\" Copyright (c) 2017 by Lawrence Livermore National Security, LLC.
	.\"
	-.Dd September 16, 2017
	+.Dd September 13, 2020
	.Dt ZGENHOSTID 8 SMM
	.Os
	.Sh NAME
	.Nm zgenhostid
	.Nd generate and store a hostid in
	.Em /etc/hostid
	.Sh SYNOPSIS
	.Nm
	+.Op Fl f
	+.Op Fl o Ar filename
	.Op Ar hostid
	.Sh DESCRIPTION
	-If
	-.Em /etc/hostid
	-does not exist, create it and store a hostid in it. If the user provides
	+Creates
	+.Pa /etc/hostid
	+file and stores hostid in it.
	+If the user provides
	.Op Ar hostid
	-on the command line, store that value. Otherwise, randomly generate a
	-value to store.
	-.Pp
	-This emulates the
	-.Xr genhostid 1
	-utility and is provided for use on systems which do not include the utility.
	-.Sh OPTIONS
	-.Op Ar hostid
	+on the command line, validates and stores that value.
	+Otherwise, randomly generates a value to store.
	+.Bl -tag -width "hostid"
	+.It Fl h
	+Display a summary of the command-line options.
	+.It Fl f
	+Force file overwrite.
	+.It Fl o Ar filename
	+Write to
	+.Pa filename
	+instead of default
	+.Pa /etc/hostd
	+.It Ar hostid
	Specifies the value to be placed in
	-.Em /etc/hostid .
	-It must be a number with a value between 1 and 2^32-1. This value
	+.Pa /etc/hostid .
	+It must be a number with a value between 1 and 2^32-1.
	+This value
	.Sy must
	-be unique among your systems. It must be expressed in hexadecimal and be
	-exactly 8 digits long.
	+be unique among your systems.
	+It
	+.Sy must
	+be expressed in hexadecimal and be exactly
	+.Em 8
	+digits long, optionally prefixed by
	+.Em 0x .
	+.El
	+.Sh FILES
	+.Pa /etc/hostid
	.Sh EXAMPLES
	-.Bl -tag -width Ds
	+.Bl -tag -width Bd
	.It Generate a random hostid and store it
	.Bd -literal
	# zgenhostid
	.Ed
	-.It Record the libc-generated hostid in Em /etc/hostid
	+.It Record the libc-generated hostid in Pa /etc/hostid
	.Bd -literal
	-# zgenhostid $(hostid)
	+# zgenhostid "$(hostid)"
	.Ed
	-.It Record a custom hostid (0xdeadbeef) in Em etc/hostid
	+.It Record a custom hostid (0xdeadbeef) in Pa /etc/hostid
	.Bd -literal
	# zgenhostid deadbeef
	.Ed
	+.It Record a custom hostid (0x01234567) in Pa /tmp/hostid
	+and ovewrite the file if it exists
	+.Bd -literal
	+# zgenhostid -f -o /tmp/hostid 0x01234567
	+.Ed
	.El
	.Sh SEE ALSO
	.Xr genhostid 1 ,
	.Xr hostid 1 ,
	+.Xr sethostid 3 ,
	.Xr spl-module-parameters 5
	+.Sh HISTORY
	+.Nm
	+emulates the
	+.Xr genhostid 1
	+utility and is provided for use on systems which
	+do not include the utility or do not provide
	+.Xr sethostid 3
	+call.
	Index: vendor-sys/openzfs/dist/man/man8/zpoolprops.8
	===================================================================
	--- vendor-sys/openzfs/dist/man/man8/zpoolprops.8 (revision 365891)
	+++ vendor-sys/openzfs/dist/man/man8/zpoolprops.8 (revision 365892)
	@@ -1,368 +1,368 @@
	.\"
	.\" CDDL HEADER START
	.\"
	.\" The contents of this file are subject to the terms of the
	.\" Common Development and Distribution License (the "License").
	.\" You may not use this file except in compliance with the License.
	.\"
	.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	.\" or http://www.opensolaris.org/os/licensing.
	.\" See the License for the specific language governing permissions
	.\" and limitations under the License.
	.\"
	.\" When distributing Covered Code, include this CDDL HEADER in each
	.\" file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	.\" If applicable, add the following below this CDDL HEADER, with the
	.\" fields enclosed by brackets "[]" replaced with your own identifying
	.\" information: Portions Copyright [yyyy] [name of copyright owner]
	.\"
	.\" CDDL HEADER END
	.\"
	.\"
	.\" Copyright (c) 2007, Sun Microsystems, Inc. All Rights Reserved.
	.\" Copyright (c) 2012, 2018 by Delphix. All rights reserved.
	.\" Copyright (c) 2012 Cyril Plisko. All Rights Reserved.
	.\" Copyright (c) 2017 Datto Inc.
	.\" Copyright (c) 2018 George Melikov. All Rights Reserved.
	.\" Copyright 2017 Nexenta Systems, Inc.
	.\" Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
	.\"
	.Dd August 9, 2019
	.Dt ZPOOLPROPS 8
	.Os
	.Sh NAME
	.Nm zpoolprops
	.Nd available properties for ZFS storage pools
	.Sh DESCRIPTION
	Each pool has several properties associated with it.
	Some properties are read-only statistics while others are configurable and
	change the behavior of the pool.
	.Pp
	The following are read-only properties:
	.Bl -tag -width Ds
	.It Cm allocated
	Amount of storage used within the pool.
	See
	.Sy fragmentation
	and
	.Sy free
	for more information.
	.It Sy capacity
	Percentage of pool space used.
	This property can also be referred to by its shortened column name,
	.Sy cap .
	.It Sy expandsize
	Amount of uninitialized space within the pool or device that can be used to
	increase the total capacity of the pool.
	Uninitialized space consists of any space on an EFI labeled vdev which has not
	been brought online
	.Po e.g, using
	.Nm zpool Cm online Fl e
	.Pc .
	This space occurs when a LUN is dynamically expanded.
	.It Sy fragmentation
	The amount of fragmentation in the pool. As the amount of space
	.Sy allocated
	increases, it becomes more difficult to locate
	.Sy free
	space. This may result in lower write performance compared to pools with more
	unfragmented free space.
	.It Sy free
	The amount of free space available in the pool.
	By contrast, the
	.Xr zfs 8
	.Sy available
	property describes how much new data can be written to ZFS filesystems/volumes.
	The zpool
	.Sy free
	property is not generally useful for this purpose, and can be substantially more than the zfs
	.Sy available
	-space. This discrepancy is due to several factors, including raidz party; zfs
	+space. This discrepancy is due to several factors, including raidz parity; zfs
	reservation, quota, refreservation, and refquota properties; and space set aside by
	.Sy spa_slop_shift
	(see
	.Xr zfs-module-parameters 5
	for more information).
	.It Sy freeing
	After a file system or snapshot is destroyed, the space it was using is
	returned to the pool asynchronously.
	.Sy freeing
	is the amount of space remaining to be reclaimed.
	Over time
	.Sy freeing
	will decrease while
	.Sy free
	increases.
	.It Sy health
	The current health of the pool.
	Health can be one of
	.Sy ONLINE , DEGRADED , FAULTED , OFFLINE, REMOVED , UNAVAIL .
	.It Sy guid
	A unique identifier for the pool.
	.It Sy load_guid
	A unique identifier for the pool.
	Unlike the
	.Sy guid
	property, this identifier is generated every time we load the pool (e.g. does
	not persist across imports/exports) and never changes while the pool is loaded
	(even if a
	.Sy reguid
	operation takes place).
	.It Sy size
	Total size of the storage pool.
	.It Sy unsupported@ Ns Em feature_guid
	Information about unsupported features that are enabled on the pool.
	See
	.Xr zpool-features 5
	for details.
	.El
	.Pp
	The space usage properties report actual physical space available to the
	storage pool.
	The physical space can be different from the total amount of space that any
	contained datasets can actually use.
	The amount of space used in a raidz configuration depends on the characteristics
	of the data being written.
	In addition, ZFS reserves some space for internal accounting that the
	.Xr zfs 8
	command takes into account, but the
	.Nm
	command does not.
	For non-full pools of a reasonable size, these effects should be invisible.
	For small pools, or pools that are close to being completely full, these
	discrepancies may become more noticeable.
	.Pp
	The following property can be set at creation time and import time:
	.Bl -tag -width Ds
	.It Sy altroot
	Alternate root directory.
	If set, this directory is prepended to any mount points within the pool.
	This can be used when examining an unknown pool where the mount points cannot be
	trusted, or in an alternate boot environment, where the typical paths are not
	valid.
	.Sy altroot
	is not a persistent property.
	It is valid only while the system is up.
	Setting
	.Sy altroot
	defaults to using
	.Sy cachefile Ns = Ns Sy none ,
	though this may be overridden using an explicit setting.
	.El
	.Pp
	The following property can be set only at import time:
	.Bl -tag -width Ds
	.It Sy readonly Ns = Ns Sy on Ns \| Ns Sy off
	If set to
	.Sy on ,
	the pool will be imported in read-only mode.
	This property can also be referred to by its shortened column name,
	.Sy rdonly .
	.El
	.Pp
	The following properties can be set at creation time and import time, and later
	changed with the
	.Nm zpool Cm set
	command:
	.Bl -tag -width Ds
	.It Sy ashift Ns = Ns Sy ashift
	Pool sector size exponent, to the power of
	.Sy 2
	(internally referred to as
	.Sy ashift
	). Values from 9 to 16, inclusive, are valid; also, the
	value 0 (the default) means to auto-detect using the kernel's block
	layer and a ZFS internal exception list. I/O operations will be aligned
	to the specified size boundaries. Additionally, the minimum (disk)
	write size will be set to the specified size, so this represents a
	space vs. performance trade-off. For optimal performance, the pool
	sector size should be greater than or equal to the sector size of the
	underlying disks. The typical case for setting this property is when
	performance is important and the underlying disks use 4KiB sectors but
	report 512B sectors to the OS (for compatibility reasons); in that
	case, set
	.Sy ashift=12
	(which is 1<<12 = 4096). When set, this property is
	used as the default hint value in subsequent vdev operations (add,
	attach and replace). Changing this value will not modify any existing
	vdev, not even on disk replacement; however it can be used, for
	instance, to replace a dying 512B sectors disk with a newer 4KiB
	sectors device: this will probably result in bad performance but at the
	same time could prevent loss of data.
	.It Sy autoexpand Ns = Ns Sy on Ns \| Ns Sy off
	Controls automatic pool expansion when the underlying LUN is grown.
	If set to
	.Sy on ,
	the pool will be resized according to the size of the expanded device.
	If the device is part of a mirror or raidz then all devices within that
	mirror/raidz group must be expanded before the new space is made available to
	the pool.
	The default behavior is
	.Sy off .
	This property can also be referred to by its shortened column name,
	.Sy expand .
	.It Sy autoreplace Ns = Ns Sy on Ns \| Ns Sy off
	Controls automatic device replacement.
	If set to
	.Sy off ,
	device replacement must be initiated by the administrator by using the
	.Nm zpool Cm replace
	command.
	If set to
	.Sy on ,
	any new device, found in the same physical location as a device that previously
	belonged to the pool, is automatically formatted and replaced.
	The default behavior is
	.Sy off .
	This property can also be referred to by its shortened column name,
	.Sy replace .
	Autoreplace can also be used with virtual disks (like device
	mapper) provided that you use the /dev/disk/by-vdev paths setup by
	vdev_id.conf. See the
	.Xr vdev_id 8
	man page for more details.
	Autoreplace and autoonline require the ZFS Event Daemon be configured and
	running. See the
	.Xr zed 8
	man page for more details.
	.It Sy autotrim Ns = Ns Sy on Ns \| Ns Sy off
	When set to
	.Sy on
	space which has been recently freed, and is no longer allocated by the pool,
	will be periodically trimmed. This allows block device vdevs which support
	BLKDISCARD, such as SSDs, or file vdevs on which the underlying file system
	supports hole-punching, to reclaim unused blocks. The default setting for
	this property is
	.Sy off .
	.Pp
	Automatic TRIM does not immediately reclaim blocks after a free. Instead,
	it will optimistically delay allowing smaller ranges to be aggregated in to
	a few larger ones. These can then be issued more efficiently to the storage.
	TRIM on L2ARC devices is enabled by setting
	.Sy l2arc_trim_ahead > 0 .
	.Pp
	Be aware that automatic trimming of recently freed data blocks can put
	significant stress on the underlying storage devices. This will vary
	depending of how well the specific device handles these commands. For
	lower end devices it is often possible to achieve most of the benefits
	of automatic trimming by running an on-demand (manual) TRIM periodically
	using the
	.Nm zpool Cm trim
	command.
	.It Sy bootfs Ns = Ns Sy (unset) Ns \| Ns Ar pool Ns / Ns Ar dataset
	Identifies the default bootable dataset for the root pool. This property is
	expected to be set mainly by the installation and upgrade programs.
	Not all Linux distribution boot processes use the bootfs property.
	.It Sy cachefile Ns = Ns Ar path Ns \| Ns Sy none
	Controls the location of where the pool configuration is cached.
	Discovering all pools on system startup requires a cached copy of the
	configuration data that is stored on the root file system.
	All pools in this cache are automatically imported when the system boots.
	Some environments, such as install and clustering, need to cache this
	information in a different location so that pools are not automatically
	imported.
	Setting this property caches the pool configuration in a different location that
	can later be imported with
	.Nm zpool Cm import Fl c .
	Setting it to the value
	.Sy none
	creates a temporary pool that is never cached, and the
	.Qq
	.Pq empty string
	uses the default location.
	.Pp
	Multiple pools can share the same cache file.
	Because the kernel destroys and recreates this file when pools are added and
	removed, care should be taken when attempting to access this file.
	When the last pool using a
	.Sy cachefile
	is exported or destroyed, the file will be empty.
	.It Sy comment Ns = Ns Ar text
	A text string consisting of printable ASCII characters that will be stored
	such that it is available even if the pool becomes faulted.
	An administrator can provide additional information about a pool using this
	property.
	.It Sy dedupditto Ns = Ns Ar number
	This property is deprecated and no longer has any effect.
	.It Sy delegation Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether a non-privileged user is granted access based on the dataset
	permissions defined on the dataset.
	See
	.Xr zfs 8
	for more information on ZFS delegated administration.
	.It Sy failmode Ns = Ns Sy wait Ns \| Ns Sy continue Ns \| Ns Sy panic
	Controls the system behavior in the event of catastrophic pool failure.
	This condition is typically a result of a loss of connectivity to the underlying
	storage device(s) or a failure of all devices within the pool.
	The behavior of such an event is determined as follows:
	.Bl -tag -width "continue"
	.It Sy wait
	Blocks all I/O access until the device connectivity is recovered and the errors
	are cleared.
	This is the default behavior.
	.It Sy continue
	Returns
	.Er EIO
	to any new write I/O requests but allows reads to any of the remaining healthy
	devices.
	Any write requests that have yet to be committed to disk would be blocked.
	.It Sy panic
	Prints out a message to the console and generates a system crash dump.
	.El
	.It Sy feature@ Ns Ar feature_name Ns = Ns Sy enabled
	The value of this property is the current state of
	.Ar feature_name .
	The only valid value when setting this property is
	.Sy enabled
	which moves
	.Ar feature_name
	to the enabled state.
	See
	.Xr zpool-features 5
	for details on feature states.
	.It Sy listsnapshots Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether information about snapshots associated with this pool is
	output when
	.Nm zfs Cm list
	is run without the
	.Fl t
	option.
	The default value is
	.Sy off .
	This property can also be referred to by its shortened name,
	.Sy listsnaps .
	.It Sy multihost Ns = Ns Sy on Ns \| Ns Sy off
	Controls whether a pool activity check should be performed during
	.Nm zpool Cm import .
	When a pool is determined to be active it cannot be imported, even with the
	.Fl f
	option. This property is intended to be used in failover configurations
	where multiple hosts have access to a pool on shared storage.
	.Pp
	Multihost provides protection on import only. It does not protect against an
	individual device being used in multiple pools, regardless of the type of vdev.
	See the discussion under
	.Sy zpool create.
	.Pp
	When this property is on, periodic writes to storage occur to show the pool is
	in use. See
	.Sy zfs_multihost_interval
	in the
	.Xr zfs-module-parameters 5
	man page. In order to enable this property each host must set a unique hostid.
	See
	.Xr genhostid 1
	.Xr zgenhostid 8
	.Xr spl-module-parameters 5
	for additional details. The default value is
	.Sy off .
	.It Sy version Ns = Ns Ar version
	The current on-disk version of the pool.
	This can be increased, but never decreased.
	The preferred method of updating pools is with the
	.Nm zpool Cm upgrade
	command, though this property can be used when a specific version is needed for
	backwards compatibility.
	Once feature flags are enabled on a pool this property will no longer have a
	value.
	.El
	Index: vendor-sys/openzfs/dist/module/os/freebsd/zfs/kmod_core.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/freebsd/zfs/kmod_core.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/freebsd/zfs/kmod_core.c (revision 365892)
	@@ -1,381 +1,380 @@
	/*
	* Copyright (c) 2020 iXsystems, Inc.
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	* 1. Redistributions of source code must retain the above copyright
	* notice, this list of conditions and the following disclaimer.
	* 2. Redistributions in binary form must reproduce the above copyright
	* notice, this list of conditions and the following disclaimer in the
	* documentation and/or other materials provided with the distribution.
	*
	* THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	* SUCH DAMAGE.
	*
	*/

	#include <sys/cdefs.h>
	__FBSDID("$FreeBSD$");

	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/systm.h>
	#include <sys/conf.h>
	#include <sys/eventhandler.h>
	#include <sys/kernel.h>
	#include <sys/lock.h>
	#include <sys/malloc.h>
	#include <sys/mutex.h>
	#include <sys/proc.h>
	#include <sys/errno.h>
	#include <sys/uio.h>
	#include <sys/buf.h>
	#include <sys/file.h>
	#include <sys/kmem.h>
	#include <sys/conf.h>
	#include <sys/eventhandler.h>
	#include <sys/cmn_err.h>
	#include <sys/stat.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/zfs_vfsops.h>
	#include <sys/zfs_znode.h>
	#include <sys/zap.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev.h>
	#include <sys/dmu.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_prop.h>
	#include <sys/dsl_deleg.h>
	#include <sys/dmu_objset.h>
	#include <sys/dmu_impl.h>
	#include <sys/dmu_tx.h>
	#include <sys/fm/util.h>
	#include <sys/sunddi.h>
	#include <sys/policy.h>
	#include <sys/zone.h>
	#include <sys/nvpair.h>
	#include <sys/mount.h>
	#include <sys/taskqueue.h>
	#include <sys/sdt.h>
	#include <sys/fs/zfs.h>
	#include <sys/zfs_ctldir.h>
	#include <sys/zfs_dir.h>
	#include <sys/zfs_onexit.h>
	#include <sys/zvol.h>
	#include <sys/dsl_scan.h>
	#include <sys/dmu_objset.h>
	#include <sys/dmu_send.h>
	#include <sys/dsl_destroy.h>
	#include <sys/dsl_bookmark.h>
	#include <sys/dsl_userhold.h>
	#include <sys/zfeature.h>
	#include <sys/zcp.h>
	#include <sys/zio_checksum.h>
	#include <sys/vdev_removal.h>
	#include <sys/dsl_crypt.h>

	#include <sys/zfs_ioctl_compat.h>
	#include <sys/zfs_ioctl_impl.h>

	#include "zfs_namecheck.h"
	#include "zfs_prop.h"
	#include "zfs_deleg.h"
	#include "zfs_comutil.h"

	SYSCTL_DECL(_vfs_zfs);
	SYSCTL_DECL(_vfs_zfs_vdev);


	static int zfs_version_ioctl = ZFS_IOCVER_OZFS;
	SYSCTL_DECL(_vfs_zfs_version);
	SYSCTL_INT(_vfs_zfs_version, OID_AUTO, ioctl, CTLFLAG_RD, &zfs_version_ioctl,
	0, "ZFS_IOCTL_VERSION");

	static struct cdev *zfsdev;

	static struct root_hold_token *zfs_root_token;

	extern uint_t rrw_tsd_key;
	extern uint_t zfs_allow_log_key;
	extern uint_t zfs_geom_probe_vdev_key;

	static int zfs__init(void);
	static int zfs__fini(void);
	static void zfs_shutdown(void *, int);

	static eventhandler_tag zfs_shutdown_event_tag;
	extern zfsdev_state_t *zfsdev_state_list;

	#define ZFS_MIN_KSTACK_PAGES 4


	static int
	zfsdev_ioctl(struct cdev *dev, ulong_t zcmd, caddr_t arg, int flag,
	struct thread *td)
	{
	uint_t len;
	int vecnum;
	zfs_iocparm_t *zp;
	zfs_cmd_t *zc;
	zfs_cmd_legacy_t *zcl;
	int rc, error;
	void *uaddr;

	len = IOCPARM_LEN(zcmd);
	vecnum = zcmd & 0xff;
	zp = (void *)arg;
	uaddr = (void *)zp->zfs_cmd;
	error = 0;
	zcl = NULL;

	if (len != sizeof (zfs_iocparm_t)) {
	printf("len %d vecnum: %d sizeof (zfs_cmd_t) %ju\n",
	len, vecnum, (uintmax_t)sizeof (zfs_cmd_t));
	return (EINVAL);
	}

	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
	/*
	* Remap ioctl code for legacy user binaries
	*/
	if (zp->zfs_ioctl_version == ZFS_IOCVER_LEGACY) {
	vecnum = zfs_ioctl_legacy_to_ozfs(vecnum);
	if (vecnum < 0) {
	kmem_free(zc, sizeof (zfs_cmd_t));
	return (ENOTSUP);
	}
	zcl = kmem_zalloc(sizeof (zfs_cmd_legacy_t), KM_SLEEP);
	if (copyin(uaddr, zcl, sizeof (zfs_cmd_legacy_t))) {
	error = SET_ERROR(EFAULT);
	goto out;
	}
	zfs_cmd_legacy_to_ozfs(zcl, zc);
	} else if (copyin(uaddr, zc, sizeof (zfs_cmd_t))) {
	error = SET_ERROR(EFAULT);
	goto out;
	}
	error = zfsdev_ioctl_common(vecnum, zc, 0);
	if (zcl) {
	zfs_cmd_ozfs_to_legacy(zc, zcl);
	rc = copyout(zcl, uaddr, sizeof (*zcl));
	} else {
	rc = copyout(zc, uaddr, sizeof (*zc));
	}
	if (error == 0 && rc != 0)
	error = SET_ERROR(EFAULT);
	out:
	if (zcl)
	kmem_free(zcl, sizeof (zfs_cmd_legacy_t));
	kmem_free(zc, sizeof (zfs_cmd_t));
	return (error);
	}

	static void
	zfsdev_close(void *data)
	{
	zfsdev_state_t zs, zsp = data;

	mutex_enter(&zfsdev_state_lock);
	for (zs = zfsdev_state_list; zs != NULL; zs = zs->zs_next) {
	if (zs == zsp)
	break;
	}
	if (zs == NULL \|\| zs->zs_minor <= 0) {
	mutex_exit(&zfsdev_state_lock);
	return;
	}
	zs->zs_minor = -1;
	zfs_onexit_destroy(zs->zs_onexit);
	zfs_zevent_destroy(zs->zs_zevent);
	mutex_exit(&zfsdev_state_lock);
	zs->zs_onexit = NULL;
	zs->zs_zevent = NULL;
	}

	static int
	zfs_ctldev_init(struct cdev *devp)
	{
	boolean_t newzs = B_FALSE;
	minor_t minor;
	zfsdev_state_t zs, zsprev = NULL;

	ASSERT(MUTEX_HELD(&zfsdev_state_lock));

	minor = zfsdev_minor_alloc();
	if (minor == 0)
	return (SET_ERROR(ENXIO));

	for (zs = zfsdev_state_list; zs != NULL; zs = zs->zs_next) {
	if (zs->zs_minor == -1)
	break;
	zsprev = zs;
	}

	if (!zs) {
	zs = kmem_zalloc(sizeof (zfsdev_state_t), KM_SLEEP);
	newzs = B_TRUE;
	}

	devfs_set_cdevpriv(zs, zfsdev_close);

	zfs_onexit_init((zfs_onexit_t **)&zs->zs_onexit);
	zfs_zevent_init((zfs_zevent_t **)&zs->zs_zevent);

	if (newzs) {
	zs->zs_minor = minor;
	wmb();
	zsprev->zs_next = zs;
	} else {
	wmb();
	zs->zs_minor = minor;
	}
	return (0);
	}

	static int
	zfsdev_open(struct cdev devp, int flag, int mode, struct thread td)
	{
	int error;

	mutex_enter(&zfsdev_state_lock);
	error = zfs_ctldev_init(devp);
	mutex_exit(&zfsdev_state_lock);

	return (error);
	}

	static struct cdevsw zfs_cdevsw = {
	.d_version = D_VERSION,
	.d_open = zfsdev_open,
	.d_ioctl = zfsdev_ioctl,
	.d_name = ZFS_DRIVER
	};

	int
	zfsdev_attach(void)
	{
	zfsdev = make_dev(&zfs_cdevsw, 0x0, UID_ROOT, GID_OPERATOR, 0666,
	ZFS_DRIVER);
	return (0);
	}

	void
	zfsdev_detach(void)
	{
	if (zfsdev != NULL)
	destroy_dev(zfsdev);
	}

	int
	zfs__init(void)
	{
	int error;

	#if KSTACK_PAGES < ZFS_MIN_KSTACK_PAGES
	printf("ZFS NOTICE: KSTACK_PAGES is %d which could result in stack "
	"overflow panic!\nPlease consider adding "
	"'options KSTACK_PAGES=%d' to your kernel config\n", KSTACK_PAGES,
	ZFS_MIN_KSTACK_PAGES);
	#endif
	zfs_root_token = root_mount_hold("ZFS");
	if ((error = zfs_kmod_init()) != 0) {
	printf("ZFS: Failed to Load ZFS Filesystem"
	", rc = %d\n", error);
	root_mount_rel(zfs_root_token);
	return (error);
	}


	tsd_create(&zfs_geom_probe_vdev_key, NULL);

	printf("ZFS storage pool version: features support ("
	SPA_VERSION_STRING ")\n");
	root_mount_rel(zfs_root_token);
	ddi_sysevent_init();
	return (0);
	}

	int
	zfs__fini(void)
	{
	if (zfs_busy() \|\| zvol_busy() \|\|
	zio_injection_enabled) {
	return (EBUSY);
	}
	zfs_kmod_fini();
	tsd_destroy(&zfs_geom_probe_vdev_key);
	return (0);
	}

	static void
	zfs_shutdown(void *arg __unused, int howto __unused)
	{

	/*
	* ZFS fini routines can not properly work in a panic-ed system.
	*/
	if (panicstr == NULL)
	zfs__fini();
	}


	static int
	zfs_modevent(module_t mod, int type, void *unused __unused)
	{
	int err;

	switch (type) {
	case MOD_LOAD:
	err = zfs__init();
	if (err == 0)
	zfs_shutdown_event_tag = EVENTHANDLER_REGISTER(
	shutdown_post_sync, zfs_shutdown, NULL,
	SHUTDOWN_PRI_FIRST);
	return (err);
	case MOD_UNLOAD:
	err = zfs__fini();
	if (err == 0 && zfs_shutdown_event_tag != NULL)
	EVENTHANDLER_DEREGISTER(shutdown_post_sync,
	zfs_shutdown_event_tag);
	return (err);
	case MOD_SHUTDOWN:
	return (0);
	default:
	break;
	}
	return (EOPNOTSUPP);
	}

	static moduledata_t zfs_mod = {
	"zfsctrl",
	zfs_modevent,
	0
	};

	#ifdef _KERNEL
	EVENTHANDLER_DEFINE(mountroot, spa_boot_init, NULL, 0);
	#endif

	DECLARE_MODULE(zfsctrl, zfs_mod, SI_SUB_CLOCKS, SI_ORDER_ANY);
	MODULE_VERSION(zfsctrl, 1);
	#if __FreeBSD_version > 1300092
	MODULE_DEPEND(zfsctrl, xdr, 1, 1, 1);
	#else
	MODULE_DEPEND(zfsctrl, krpc, 1, 1, 1);
	#endif
	MODULE_DEPEND(zfsctrl, acl_nfs4, 1, 1, 1);
	MODULE_DEPEND(zfsctrl, crypto, 1, 1, 1);
	-MODULE_DEPEND(zfsctrl, cryptodev, 1, 1, 1);
	Index: vendor-sys/openzfs/dist/module/os/freebsd/zfs/sysctl_os.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/freebsd/zfs/sysctl_os.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/freebsd/zfs/sysctl_os.c (revision 365892)
	@@ -1,693 +1,694 @@
	/*
	* Copyright (c) 2020 iXsystems, Inc.
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	* 1. Redistributions of source code must retain the above copyright
	* notice, this list of conditions and the following disclaimer.
	* 2. Redistributions in binary form must reproduce the above copyright
	* notice, this list of conditions and the following disclaimer in the
	* documentation and/or other materials provided with the distribution.
	*
	* THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	* SUCH DAMAGE.
	*
	*/

	#include <sys/cdefs.h>
	__FBSDID("$FreeBSD$");

	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/systm.h>
	#include <sys/conf.h>
	#include <sys/kernel.h>
	#include <sys/lock.h>
	#include <sys/malloc.h>
	#include <sys/mutex.h>
	#include <sys/proc.h>
	#include <sys/errno.h>
	#include <sys/uio.h>
	#include <sys/buf.h>
	#include <sys/file.h>
	#include <sys/kmem.h>
	#include <sys/conf.h>
	#include <sys/cmn_err.h>
	#include <sys/stat.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/zfs_vfsops.h>
	#include <sys/zfs_znode.h>
	#include <sys/zap.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev.h>
	#include <sys/vdev_impl.h>
	#include <sys/dmu.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_prop.h>
	#include <sys/dsl_deleg.h>
	#include <sys/dmu_objset.h>
	#include <sys/dmu_impl.h>
	#include <sys/dmu_tx.h>
	#include <sys/sunddi.h>
	#include <sys/policy.h>
	#include <sys/zone.h>
	#include <sys/nvpair.h>
	#include <sys/mount.h>
	#include <sys/taskqueue.h>
	#include <sys/sdt.h>
	#include <sys/fs/zfs.h>
	#include <sys/zfs_ctldir.h>
	#include <sys/zfs_dir.h>
	#include <sys/zfs_onexit.h>
	#include <sys/zvol.h>
	#include <sys/dsl_scan.h>
	#include <sys/dmu_objset.h>
	#include <sys/dmu_send.h>
	#include <sys/dsl_destroy.h>
	#include <sys/dsl_bookmark.h>
	#include <sys/dsl_userhold.h>
	#include <sys/zfeature.h>
	#include <sys/zcp.h>
	#include <sys/zio_checksum.h>
	#include <sys/vdev_removal.h>
	#include <sys/dsl_crypt.h>

	#include <sys/zfs_ioctl_compat.h>
	#include <sys/zfs_context.h>

	#include <sys/arc_impl.h>
	#include <sys/dsl_pool.h>


	/* BEGIN CSTYLED */
	SYSCTL_DECL(_vfs_zfs);
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, arc, CTLFLAG_RW, 0, "ZFS adaptive replacement cache");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, condense, CTLFLAG_RW, 0, "ZFS condense");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, dbuf, CTLFLAG_RW, 0, "ZFS disk buf cache");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, dbuf_cache, CTLFLAG_RW, 0, "ZFS disk buf cache");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, deadman, CTLFLAG_RW, 0, "ZFS deadman");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, dedup, CTLFLAG_RW, 0, "ZFS dedup");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, l2arc, CTLFLAG_RW, 0, "ZFS l2arc");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, livelist, CTLFLAG_RW, 0, "ZFS livelist");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, lua, CTLFLAG_RW, 0, "ZFS lua");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, metaslab, CTLFLAG_RW, 0, "ZFS metaslab");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, mg, CTLFLAG_RW, 0, "ZFS metaslab group");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, multihost, CTLFLAG_RW, 0, "ZFS multihost protection");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, prefetch, CTLFLAG_RW, 0, "ZFS prefetch");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, reconstruct, CTLFLAG_RW, 0, "ZFS reconstruct");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, recv, CTLFLAG_RW, 0, "ZFS receive");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, send, CTLFLAG_RW, 0, "ZFS send");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, spa, CTLFLAG_RW, 0, "ZFS space allocation");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, trim, CTLFLAG_RW, 0, "ZFS TRIM");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, txg, CTLFLAG_RW, 0, "ZFS transaction group");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, vdev, CTLFLAG_RW, 0, "ZFS VDEV");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, zevent, CTLFLAG_RW, 0, "ZFS event");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, zil, CTLFLAG_RW, 0, "ZFS ZIL");
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, zio, CTLFLAG_RW, 0, "ZFS ZIO");

	SYSCTL_NODE(_vfs_zfs_livelist, OID_AUTO, condense, CTLFLAG_RW, 0,
	"ZFS livelist condense");
	SYSCTL_NODE(_vfs_zfs_vdev, OID_AUTO, cache, CTLFLAG_RW, 0, "ZFS VDEV Cache");
	+SYSCTL_NODE(_vfs_zfs_vdev, OID_AUTO, file, CTLFLAG_RW, 0, "ZFS VDEV file");
	SYSCTL_NODE(_vfs_zfs_vdev, OID_AUTO, mirror, CTLFLAG_RD, 0,
	"ZFS VDEV mirror");

	SYSCTL_DECL(_vfs_zfs_version);
	SYSCTL_CONST_STRING(_vfs_zfs_version, OID_AUTO, module, CTLFLAG_RD,
	(ZFS_META_VERSION "-" ZFS_META_RELEASE), "OpenZFS module version");

	extern arc_state_t ARC_anon;
	extern arc_state_t ARC_mru;
	extern arc_state_t ARC_mru_ghost;
	extern arc_state_t ARC_mfu;
	extern arc_state_t ARC_mfu_ghost;
	extern arc_state_t ARC_l2c_only;

	/*
	* minimum lifespan of a prefetch block in clock ticks
	* (initialized in arc_init())
	*/

	/* arc.c */

	/* legacy compat */
	extern uint64_t l2arc_write_max; /* def max write size */
	extern uint64_t l2arc_write_boost; /* extra warmup write */
	extern uint64_t l2arc_headroom; /* # of dev writes */
	extern uint64_t l2arc_headroom_boost;
	extern uint64_t l2arc_feed_secs; /* interval seconds */
	extern uint64_t l2arc_feed_min_ms; /* min interval msecs */
	extern int l2arc_noprefetch; /* don't cache prefetch bufs */
	extern int l2arc_feed_again; /* turbo warmup */
	extern int l2arc_norw; /* no reads during writes */

	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, l2arc_write_max, CTLFLAG_RW,
	&l2arc_write_max, 0, "max write size (LEGACY)");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, l2arc_write_boost, CTLFLAG_RW,
	&l2arc_write_boost, 0, "extra write during warmup (LEGACY)");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, l2arc_headroom, CTLFLAG_RW,
	&l2arc_headroom, 0, "number of dev writes (LEGACY)");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, l2arc_feed_secs, CTLFLAG_RW,
	&l2arc_feed_secs, 0, "interval seconds (LEGACY)");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, l2arc_feed_min_ms, CTLFLAG_RW,
	&l2arc_feed_min_ms, 0, "min interval milliseconds (LEGACY)");

	SYSCTL_INT(_vfs_zfs, OID_AUTO, l2arc_noprefetch, CTLFLAG_RW,
	&l2arc_noprefetch, 0, "don't cache prefetch bufs (LEGACY)");
	SYSCTL_INT(_vfs_zfs, OID_AUTO, l2arc_feed_again, CTLFLAG_RW,
	&l2arc_feed_again, 0, "turbo warmup (LEGACY)");
	SYSCTL_INT(_vfs_zfs, OID_AUTO, l2arc_norw, CTLFLAG_RW,
	&l2arc_norw, 0, "no reads during writes (LEGACY)");
	#if 0
	extern int zfs_compressed_arc_enabled;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, compressed_arc_enabled, CTLFLAG_RW,
	&zfs_compressed_arc_enabled, 1, "compressed arc buffers (LEGACY)");
	#endif

	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, anon_size, CTLFLAG_RD,
	&ARC_anon.arcs_size.rc_count, 0, "size of anonymous state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, anon_metadata_esize, CTLFLAG_RD,
	&ARC_anon.arcs_esize[ARC_BUFC_METADATA].rc_count, 0,
	"size of anonymous state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, anon_data_esize, CTLFLAG_RD,
	&ARC_anon.arcs_esize[ARC_BUFC_DATA].rc_count, 0,
	"size of anonymous state");

	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mru_size, CTLFLAG_RD,
	&ARC_mru.arcs_size.rc_count, 0, "size of mru state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mru_metadata_esize, CTLFLAG_RD,
	&ARC_mru.arcs_esize[ARC_BUFC_METADATA].rc_count, 0,
	"size of metadata in mru state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mru_data_esize, CTLFLAG_RD,
	&ARC_mru.arcs_esize[ARC_BUFC_DATA].rc_count, 0,
	"size of data in mru state");

	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mru_ghost_size, CTLFLAG_RD,
	&ARC_mru_ghost.arcs_size.rc_count, 0, "size of mru ghost state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mru_ghost_metadata_esize, CTLFLAG_RD,
	&ARC_mru_ghost.arcs_esize[ARC_BUFC_METADATA].rc_count, 0,
	"size of metadata in mru ghost state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mru_ghost_data_esize, CTLFLAG_RD,
	&ARC_mru_ghost.arcs_esize[ARC_BUFC_DATA].rc_count, 0,
	"size of data in mru ghost state");

	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mfu_size, CTLFLAG_RD,
	&ARC_mfu.arcs_size.rc_count, 0, "size of mfu state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mfu_metadata_esize, CTLFLAG_RD,
	&ARC_mfu.arcs_esize[ARC_BUFC_METADATA].rc_count, 0,
	"size of metadata in mfu state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mfu_data_esize, CTLFLAG_RD,
	&ARC_mfu.arcs_esize[ARC_BUFC_DATA].rc_count, 0,
	"size of data in mfu state");

	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mfu_ghost_size, CTLFLAG_RD,
	&ARC_mfu_ghost.arcs_size.rc_count, 0, "size of mfu ghost state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mfu_ghost_metadata_esize, CTLFLAG_RD,
	&ARC_mfu_ghost.arcs_esize[ARC_BUFC_METADATA].rc_count, 0,
	"size of metadata in mfu ghost state");
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, mfu_ghost_data_esize, CTLFLAG_RD,
	&ARC_mfu_ghost.arcs_esize[ARC_BUFC_DATA].rc_count, 0,
	"size of data in mfu ghost state");

	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, l2c_only_size, CTLFLAG_RD,
	&ARC_l2c_only.arcs_size.rc_count, 0, "size of mru state");

	static int
	sysctl_vfs_zfs_arc_no_grow_shift(SYSCTL_HANDLER_ARGS)
	{
	uint32_t val;
	int err;

	val = arc_no_grow_shift;
	err = sysctl_handle_32(oidp, &val, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (err);

	if (val >= arc_shrink_shift)
	return (EINVAL);

	arc_no_grow_shift = val;
	return (0);
	}

	SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_no_grow_shift, CTLTYPE_U32 \| CTLFLAG_RWTUN,
	0, sizeof (uint32_t), sysctl_vfs_zfs_arc_no_grow_shift, "U",
	"log2(fraction of ARC which must be free to allow growing)");

	int
	param_set_arc_long(SYSCTL_HANDLER_ARGS)
	{
	int err;

	err = sysctl_handle_long(oidp, arg1, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (err);

	arc_tuning_update(B_TRUE);

	return (0);
	}

	int
	param_set_arc_int(SYSCTL_HANDLER_ARGS)
	{
	int err;

	err = sysctl_handle_int(oidp, arg1, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (err);

	arc_tuning_update(B_TRUE);

	return (0);
	}

	SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_min, CTLTYPE_ULONG \| CTLFLAG_RWTUN,
	&zfs_arc_min, sizeof (zfs_arc_min), param_set_arc_long, "LU",
	"min arc size (LEGACY)");
	SYSCTL_PROC(_vfs_zfs, OID_AUTO, arc_max, CTLTYPE_ULONG \| CTLFLAG_RWTUN,
	&zfs_arc_max, sizeof (zfs_arc_max), param_set_arc_long, "LU",
	"max arc size (LEGACY)");

	/* dbuf.c */


	/* dmu.c */

	/* dmu_zfetch.c */
	SYSCTL_NODE(_vfs_zfs, OID_AUTO, zfetch, CTLFLAG_RW, 0, "ZFS ZFETCH (LEGACY)");

	/* max bytes to prefetch per stream (default 8MB) */
	extern uint32_t zfetch_max_distance;
	SYSCTL_UINT(_vfs_zfs_zfetch, OID_AUTO, max_distance, CTLFLAG_RWTUN,
	&zfetch_max_distance, 0, "Max bytes to prefetch per stream (LEGACY)");

	/* max bytes to prefetch indirects for per stream (default 64MB) */
	extern uint32_t zfetch_max_idistance;
	SYSCTL_UINT(_vfs_zfs_prefetch, OID_AUTO, max_idistance, CTLFLAG_RWTUN,
	&zfetch_max_idistance, 0, "Max bytes to prefetch indirects for per stream");

	/* dsl_pool.c */

	/* dnode.c */
	extern int zfs_default_bs;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, default_bs, CTLFLAG_RWTUN,
	&zfs_default_bs, 0, "Default dnode block shift");

	extern int zfs_default_ibs;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, default_ibs, CTLFLAG_RWTUN,
	&zfs_default_ibs, 0, "Default dnode indirect block shift");


	/* dsl_scan.c */

	/* metaslab.c */

	/*
	* In pools where the log space map feature is not enabled we touch
	* multiple metaslabs (and their respective space maps) with each
	* transaction group. Thus, we benefit from having a small space map
	* block size since it allows us to issue more I/O operations scattered
	* around the disk. So a sane default for the space map block size
	* is 8~16K.
	*/
	extern int zfs_metaslab_sm_blksz_no_log;
	SYSCTL_INT(_vfs_zfs_metaslab, OID_AUTO, sm_blksz_no_log, CTLFLAG_RDTUN,
	&zfs_metaslab_sm_blksz_no_log, 0,
	"Block size for space map in pools with log space map disabled. "
	"Power of 2 and greater than 4096.");

	/*
	* When the log space map feature is enabled, we accumulate a lot of
	* changes per metaslab that are flushed once in a while so we benefit
	* from a bigger block size like 128K for the metaslab space maps.
	*/
	extern int zfs_metaslab_sm_blksz_with_log;
	SYSCTL_INT(_vfs_zfs_metaslab, OID_AUTO, sm_blksz_with_log, CTLFLAG_RDTUN,
	&zfs_metaslab_sm_blksz_with_log, 0,
	"Block size for space map in pools with log space map enabled. "
	"Power of 2 and greater than 4096.");

	/*
	* The in-core space map representation is more compact than its on-disk form.
	* The zfs_condense_pct determines how much more compact the in-core
	* space map representation must be before we compact it on-disk.
	* Values should be greater than or equal to 100.
	*/
	extern int zfs_condense_pct;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, condense_pct, CTLFLAG_RWTUN,
	&zfs_condense_pct, 0,
	"Condense on-disk spacemap when it is more than this many percents"
	" of in-memory counterpart");

	extern int zfs_remove_max_segment;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, remove_max_segment, CTLFLAG_RWTUN,
	&zfs_remove_max_segment, 0, "Largest contiguous segment ZFS will attempt to"
	" allocate when removing a device");

	extern int zfs_removal_suspend_progress;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, removal_suspend_progress, CTLFLAG_RWTUN,
	&zfs_removal_suspend_progress, 0, "Ensures certain actions can happen while"
	" in the middle of a removal");


	/*
	* Minimum size which forces the dynamic allocator to change
	* it's allocation strategy. Once the space map cannot satisfy
	* an allocation of this size then it switches to using more
	* aggressive strategy (i.e search by size rather than offset).
	*/
	extern uint64_t metaslab_df_alloc_threshold;
	SYSCTL_QUAD(_vfs_zfs_metaslab, OID_AUTO, df_alloc_threshold, CTLFLAG_RWTUN,
	&metaslab_df_alloc_threshold, 0,
	"Minimum size which forces the dynamic allocator to change it's allocation strategy");

	/*
	* The minimum free space, in percent, which must be available
	* in a space map to continue allocations in a first-fit fashion.
	* Once the space map's free space drops below this level we dynamically
	* switch to using best-fit allocations.
	*/
	extern int metaslab_df_free_pct;
	SYSCTL_INT(_vfs_zfs_metaslab, OID_AUTO, df_free_pct, CTLFLAG_RWTUN,
	&metaslab_df_free_pct, 0,
	"The minimum free space, in percent, which must be available in a "
	"space map to continue allocations in a first-fit fashion");

	/*
	* Percentage of all cpus that can be used by the metaslab taskq.
	*/
	extern int metaslab_load_pct;
	SYSCTL_INT(_vfs_zfs_metaslab, OID_AUTO, load_pct, CTLFLAG_RWTUN,
	&metaslab_load_pct, 0,
	"Percentage of cpus that can be used by the metaslab taskq");

	/*
	* Max number of metaslabs per group to preload.
	*/
	extern int metaslab_preload_limit;
	SYSCTL_INT(_vfs_zfs_metaslab, OID_AUTO, preload_limit, CTLFLAG_RWTUN,
	&metaslab_preload_limit, 0,
	"Max number of metaslabs per group to preload");

	/* refcount.c */
	extern int reference_tracking_enable;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, reference_tracking_enable, CTLFLAG_RDTUN,
	&reference_tracking_enable, 0,
	"Track reference holders to refcount_t objects, used mostly by ZFS");

	/* spa.c */
	extern int zfs_ccw_retry_interval;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, ccw_retry_interval, CTLFLAG_RWTUN,
	&zfs_ccw_retry_interval, 0,
	"Configuration cache file write, retry after failure, interval (seconds)");

	extern uint64_t zfs_max_missing_tvds_cachefile;
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, max_missing_tvds_cachefile, CTLFLAG_RWTUN,
	&zfs_max_missing_tvds_cachefile, 0,
	"allow importing pools with missing top-level vdevs in cache file");

	extern uint64_t zfs_max_missing_tvds_scan;
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, max_missing_tvds_scan, CTLFLAG_RWTUN,
	&zfs_max_missing_tvds_scan, 0,
	"allow importing pools with missing top-level vdevs during scan");

	/* spa_misc.c */
	extern int zfs_flags;
	static int
	sysctl_vfs_zfs_debug_flags(SYSCTL_HANDLER_ARGS)
	{
	int err, val;

	val = zfs_flags;
	err = sysctl_handle_int(oidp, &val, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (err);

	/*
	* ZFS_DEBUG_MODIFY must be enabled prior to boot so all
	* arc buffers in the system have the necessary additional
	* checksum data. However, it is safe to disable at any
	* time.
	*/
	if (!(zfs_flags & ZFS_DEBUG_MODIFY))
	val &= ~ZFS_DEBUG_MODIFY;
	zfs_flags = val;

	return (0);
	}

	SYSCTL_PROC(_vfs_zfs, OID_AUTO, debugflags,
	CTLTYPE_UINT \| CTLFLAG_MPSAFE \| CTLFLAG_RWTUN, NULL, 0,
	sysctl_vfs_zfs_debug_flags, "IU", "Debug flags for ZFS testing.");

	int
	param_set_deadman_synctime(SYSCTL_HANDLER_ARGS)
	{
	unsigned long val;
	int err;

	val = zfs_deadman_synctime_ms;
	err = sysctl_handle_long(oidp, &val, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (err);
	zfs_deadman_synctime_ms = val;

	spa_set_deadman_synctime(MSEC2NSEC(zfs_deadman_synctime_ms));

	return (0);
	}

	int
	param_set_deadman_ziotime(SYSCTL_HANDLER_ARGS)
	{
	unsigned long val;
	int err;

	val = zfs_deadman_ziotime_ms;
	err = sysctl_handle_long(oidp, &val, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (err);
	zfs_deadman_ziotime_ms = val;

	spa_set_deadman_ziotime(MSEC2NSEC(zfs_deadman_synctime_ms));

	return (0);
	}

	int
	param_set_deadman_failmode(SYSCTL_HANDLER_ARGS)
	{
	char buf[16];
	int rc;

	if (req->newptr == NULL)
	strlcpy(buf, zfs_deadman_failmode, sizeof (buf));

	rc = sysctl_handle_string(oidp, buf, sizeof (buf), req);
	if (rc \|\| req->newptr == NULL)
	return (rc);
	if (strcmp(buf, zfs_deadman_failmode) == 0)
	return (0);
	if (!strcmp(buf, "wait"))
	zfs_deadman_failmode = "wait";
	if (!strcmp(buf, "continue"))
	zfs_deadman_failmode = "continue";
	if (!strcmp(buf, "panic"))
	zfs_deadman_failmode = "panic";

	return (-param_set_deadman_failmode_common(buf));
	}


	/* spacemap.c */
	extern int space_map_ibs;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, space_map_ibs, CTLFLAG_RWTUN,
	&space_map_ibs, 0, "Space map indirect block shift");


	/* vdev.c */
	int
	param_set_min_auto_ashift(SYSCTL_HANDLER_ARGS)
	{
	uint64_t val;
	int err;

	val = zfs_vdev_min_auto_ashift;
	err = sysctl_handle_64(oidp, &val, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (SET_ERROR(err));

	if (val < ASHIFT_MIN \|\| val > zfs_vdev_max_auto_ashift)
	return (SET_ERROR(EINVAL));

	zfs_vdev_min_auto_ashift = val;

	return (0);
	}

	int
	param_set_max_auto_ashift(SYSCTL_HANDLER_ARGS)
	{
	uint64_t val;
	int err;

	val = zfs_vdev_max_auto_ashift;
	err = sysctl_handle_64(oidp, &val, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (SET_ERROR(err));

	if (val > ASHIFT_MAX \|\| val < zfs_vdev_min_auto_ashift)
	return (SET_ERROR(EINVAL));

	zfs_vdev_max_auto_ashift = val;

	return (0);
	}

	SYSCTL_PROC(_vfs_zfs, OID_AUTO, min_auto_ashift, CTLTYPE_U64 \| CTLFLAG_RWTUN,
	&zfs_vdev_min_auto_ashift, sizeof (zfs_vdev_min_auto_ashift),
	param_set_min_auto_ashift, "QU",
	"Min ashift used when creating new top-level vdev. (LEGACY)");
	SYSCTL_PROC(_vfs_zfs, OID_AUTO, max_auto_ashift, CTLTYPE_U64 \| CTLFLAG_RWTUN,
	&zfs_vdev_max_auto_ashift, sizeof (zfs_vdev_max_auto_ashift),
	param_set_max_auto_ashift, "QU",
	"Max ashift used when optimizing for logical -> physical sector size on "
	"new top-level vdevs. (LEGACY)");

	/*
	* Since the DTL space map of a vdev is not expected to have a lot of
	* entries, we default its block size to 4K.
	*/
	extern int zfs_vdev_dtl_sm_blksz;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, dtl_sm_blksz, CTLFLAG_RDTUN,
	&zfs_vdev_dtl_sm_blksz, 0,
	"Block size for DTL space map. Power of 2 and greater than 4096.");

	/*
	* vdev-wide space maps that have lots of entries written to them at
	* the end of each transaction can benefit from a higher I/O bandwidth
	* (e.g. vdev_obsolete_sm), thus we default their block size to 128K.
	*/
	extern int zfs_vdev_standard_sm_blksz;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, standard_sm_blksz, CTLFLAG_RDTUN,
	&zfs_vdev_standard_sm_blksz, 0,
	"Block size for standard space map. Power of 2 and greater than 4096.");

	extern int vdev_validate_skip;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, validate_skip, CTLFLAG_RDTUN,
	&vdev_validate_skip, 0,
	"Enable to bypass vdev_validate().");


	/* vdev_cache.c */

	/* vdev_mirror.c */
	/*
	* The load configuration settings below are tuned by default for
	* the case where all devices are of the same rotational type.
	*
	* If there is a mixture of rotating and non-rotating media, setting
	* non_rotating_seek_inc to 0 may well provide better results as it
	* will direct more reads to the non-rotating vdevs which are more
	* likely to have a higher performance.
	*/


	/* vdev_queue.c */
	#define ZFS_VDEV_QUEUE_KNOB_MIN(name) \
	extern uint32_t zfs_vdev_ ## name ## _min_active; \
	SYSCTL_UINT(_vfs_zfs_vdev, OID_AUTO, name ## _min_active, CTLFLAG_RWTUN,\
	&zfs_vdev_ ## name ## _min_active, 0, \
	"Initial number of I/O requests of type " #name \
	" active for each device");

	#define ZFS_VDEV_QUEUE_KNOB_MAX(name) \
	extern uint32_t zfs_vdev_ ## name ## _max_active; \
	SYSCTL_UINT(_vfs_zfs_vdev, OID_AUTO, name ## _max_active, CTLFLAG_RWTUN, \
	&zfs_vdev_ ## name ## _max_active, 0, \
	"Maximum number of I/O requests of type " #name \
	" active for each device");


	#undef ZFS_VDEV_QUEUE_KNOB

	extern uint32_t zfs_vdev_max_active;
	SYSCTL_UINT(_vfs_zfs, OID_AUTO, top_maxinflight, CTLFLAG_RWTUN,
	&zfs_vdev_max_active, 0,
	"The maximum number of I/Os of all types active for each device. (LEGACY)");

	extern int zfs_vdev_def_queue_depth;
	SYSCTL_INT(_vfs_zfs_vdev, OID_AUTO, def_queue_depth, CTLFLAG_RWTUN,
	&zfs_vdev_def_queue_depth, 0,
	"Default queue depth for each allocator");

	/*extern uint64_t zfs_multihost_history;
	SYSCTL_UQUAD(_vfs_zfs, OID_AUTO, multihost_history, CTLFLAG_RWTUN,
	&zfs_multihost_history, 0,
	"Historical staticists for the last N multihost updates");*/

	#ifdef notyet
	SYSCTL_INT(_vfs_zfs_vdev, OID_AUTO, trim_on_init, CTLFLAG_RW,
	&vdev_trim_on_init, 0, "Enable/disable full vdev trim on initialisation");
	#endif


	/* zio.c */
	#if defined(__LP64__)
	int zio_use_uma = 1;
	#else
	int zio_use_uma = 0;
	#endif

	SYSCTL_INT(_vfs_zfs_zio, OID_AUTO, use_uma, CTLFLAG_RDTUN, &zio_use_uma, 0,
	"Use uma(9) for ZIO allocations");
	SYSCTL_INT(_vfs_zfs_zio, OID_AUTO, exclude_metadata, CTLFLAG_RDTUN, &zio_exclude_metadata, 0,
	"Exclude metadata buffers from dumps as well");

	int
	param_set_slop_shift(SYSCTL_HANDLER_ARGS)
	{
	int val;
	int err;

	val = (int )arg1;

	err = sysctl_handle_int(oidp, &val, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (err);

	if (val < 1 \|\| val > 31)
	return (EINVAL);

	(int )arg1 = val;

	return (0);
	}

	int
	param_set_multihost_interval(SYSCTL_HANDLER_ARGS)
	{
	int err;

	err = sysctl_handle_long(oidp, arg1, 0, req);
	if (err != 0 \|\| req->newptr == NULL)
	return (err);

	if (spa_mode_global != SPA_MODE_UNINIT)
	mmp_signal_all_threads();

	return (0);
	}
	Index: vendor-sys/openzfs/dist/module/os/freebsd/zfs/vdev_file.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/freebsd/zfs/vdev_file.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/freebsd/zfs/vdev_file.c (revision 365892)
	@@ -1,328 +1,336 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	- * Copyright (c) 2011, 2016 by Delphix. All rights reserved.
	+ * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/file.h>
	#include <sys/vdev_file.h>
	#include <sys/vdev_impl.h>
	#include <sys/zio.h>
	#include <sys/fs/zfs.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/abd.h>
	#include <sys/stat.h>

	/*
	* Virtual device vector for files.
	*/

	static taskq_t *vdev_file_taskq;

	+unsigned long vdev_file_logical_ashift = SPA_MINBLOCKSHIFT;
	+unsigned long vdev_file_physical_ashift = SPA_MINBLOCKSHIFT;
	+
	void
	vdev_file_init(void)
	{
	vdev_file_taskq = taskq_create("z_vdev_file", MAX(max_ncpus, 16),
	minclsyspri, max_ncpus, INT_MAX, 0);
	}

	void
	vdev_file_fini(void)
	{
	taskq_destroy(vdev_file_taskq);
	}

	static void
	vdev_file_hold(vdev_t *vd)
	{
	ASSERT(vd->vdev_path != NULL);
	}

	static void
	vdev_file_rele(vdev_t *vd)
	{
	ASSERT(vd->vdev_path != NULL);
	}

	static mode_t
	vdev_file_open_mode(spa_mode_t spa_mode)
	{
	mode_t mode = 0;

	if ((spa_mode & SPA_MODE_READ) && (spa_mode & SPA_MODE_WRITE)) {
	mode = O_RDWR;
	} else if (spa_mode & SPA_MODE_READ) {
	mode = O_RDONLY;
	} else if (spa_mode & SPA_MODE_WRITE) {
	mode = O_WRONLY;
	}

	return (mode \| O_LARGEFILE);
	}

	static int
	vdev_file_open(vdev_t vd, uint64_t psize, uint64_t *max_psize,
	uint64_t logical_ashift, uint64_t physical_ashift)
	{
	vdev_file_t *vf;
	zfs_file_t *fp;
	zfs_file_attr_t zfa;
	int error;

	/*
	* Rotational optimizations only make sense on block devices.
	*/
	vd->vdev_nonrot = B_TRUE;

	/*
	* Allow TRIM on file based vdevs. This may not always be supported,
	* since it depends on your kernel version and underlying filesystem
	* type but it is always safe to attempt.
	*/
	vd->vdev_has_trim = B_TRUE;

	/*
	* Disable secure TRIM on file based vdevs. There is no way to
	* request this behavior from the underlying filesystem.
	*/
	vd->vdev_has_securetrim = B_FALSE;

	/*
	* We must have a pathname, and it must be absolute.
	*/
	if (vd->vdev_path == NULL \|\| vd->vdev_path[0] != '/') {
	vd->vdev_stat.vs_aux = VDEV_AUX_BAD_LABEL;
	return (SET_ERROR(EINVAL));
	}

	/*
	* Reopen the device if it's not currently open. Otherwise,
	* just update the physical size of the device.
	*/
	if (vd->vdev_tsd != NULL) {
	ASSERT(vd->vdev_reopening);
	vf = vd->vdev_tsd;
	goto skip_open;
	}

	vf = vd->vdev_tsd = kmem_zalloc(sizeof (vdev_file_t), KM_SLEEP);

	/*
	* We always open the files from the root of the global zone, even if
	* we're in a local zone. If the user has gotten to this point, the
	* administrator has already decided that the pool should be available
	* to local zone users, so the underlying devices should be as well.
	*/
	ASSERT(vd->vdev_path != NULL && vd->vdev_path[0] == '/');

	error = zfs_file_open(vd->vdev_path,
	vdev_file_open_mode(spa_mode(vd->vdev_spa)), 0, &fp);
	if (error) {
	vd->vdev_stat.vs_aux = VDEV_AUX_OPEN_FAILED;
	return (error);
	}

	vf->vf_file = fp;

	#ifdef _KERNEL
	/*
	* Make sure it's a regular file.
	*/
	if (zfs_file_getattr(fp, &zfa)) {
	return (SET_ERROR(ENODEV));
	}
	if (!S_ISREG(zfa.zfa_mode)) {
	vd->vdev_stat.vs_aux = VDEV_AUX_OPEN_FAILED;
	return (SET_ERROR(ENODEV));
	}
	#endif

	skip_open:

	error = zfs_file_getattr(vf->vf_file, &zfa);
	if (error) {
	vd->vdev_stat.vs_aux = VDEV_AUX_OPEN_FAILED;
	return (error);
	}

	max_psize = psize = zfa.zfa_size;
	- *logical_ashift = SPA_MINBLOCKSHIFT;
	- *physical_ashift = SPA_MINBLOCKSHIFT;
	+ *logical_ashift = vdev_file_logical_ashift;
	+ *physical_ashift = vdev_file_physical_ashift;

	return (0);
	}

	static void
	vdev_file_close(vdev_t *vd)
	{
	vdev_file_t *vf = vd->vdev_tsd;

	if (vd->vdev_reopening \|\| vf == NULL)
	return;

	if (vf->vf_file != NULL) {
	zfs_file_close(vf->vf_file);
	}

	vd->vdev_delayed_close = B_FALSE;
	kmem_free(vf, sizeof (vdev_file_t));
	vd->vdev_tsd = NULL;
	}

	/*
	* Implements the interrupt side for file vdev types. This routine will be
	* called when the I/O completes allowing us to transfer the I/O to the
	* interrupt taskqs. For consistency, the code structure mimics disk vdev
	* types.
	*/
	static void
	vdev_file_io_intr(zio_t *zio)
	{
	zio_delay_interrupt(zio);
	}

	static void
	vdev_file_io_strategy(void *arg)
	{
	zio_t *zio = arg;
	vdev_t *vd = zio->io_vd;
	vdev_file_t *vf;
	void *buf;
	ssize_t resid;
	loff_t off;
	ssize_t size;
	int err;

	off = zio->io_offset;
	size = zio->io_size;
	resid = 0;

	vf = vd->vdev_tsd;

	ASSERT(zio->io_type == ZIO_TYPE_READ \|\| zio->io_type == ZIO_TYPE_WRITE);
	if (zio->io_type == ZIO_TYPE_READ) {
	buf = abd_borrow_buf(zio->io_abd, zio->io_size);
	err = zfs_file_pread(vf->vf_file, buf, size, off, &resid);
	abd_return_buf_copy(zio->io_abd, buf, size);
	} else {
	buf = abd_borrow_buf_copy(zio->io_abd, zio->io_size);
	err = zfs_file_pwrite(vf->vf_file, buf, size, off, &resid);
	abd_return_buf(zio->io_abd, buf, size);
	}
	if (resid != 0 && zio->io_error == 0)
	zio->io_error = ENOSPC;

	vdev_file_io_intr(zio);
	}

	static void
	vdev_file_io_start(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;
	vdev_file_t *vf = vd->vdev_tsd;

	if (zio->io_type == ZIO_TYPE_IOCTL) {
	/* XXPOLICY */
	if (!vdev_readable(vd)) {
	zio->io_error = SET_ERROR(ENXIO);
	zio_interrupt(zio);
	return;
	}

	switch (zio->io_cmd) {
	case DKIOCFLUSHWRITECACHE:
	zio->io_error = zfs_file_fsync(vf->vf_file,
	O_SYNC\|O_DSYNC);
	break;
	default:
	zio->io_error = SET_ERROR(ENOTSUP);
	}

	zio_execute(zio);
	return;
	} else if (zio->io_type == ZIO_TYPE_TRIM) {
	#ifdef notyet
	int mode = 0;

	ASSERT3U(zio->io_size, !=, 0);

	/* XXX FreeBSD has no fallocate routine in file ops */
	zio->io_error = zfs_file_fallocate(vf->vf_file,
	mode, zio->io_offset, zio->io_size);
	#endif
	zio->io_error = SET_ERROR(ENOTSUP);
	zio_execute(zio);
	return;
	}
	ASSERT(zio->io_type == ZIO_TYPE_READ \|\| zio->io_type == ZIO_TYPE_WRITE);
	zio->io_target_timestamp = zio_handle_io_delay(zio);

	VERIFY3U(taskq_dispatch(vdev_file_taskq, vdev_file_io_strategy, zio,
	TQ_SLEEP), !=, 0);
	}

	/* ARGSUSED */
	static void
	vdev_file_io_done(zio_t *zio)
	{
	}

	vdev_ops_t vdev_file_ops = {
	vdev_file_open,
	vdev_file_close,
	vdev_default_asize,
	vdev_file_io_start,
	vdev_file_io_done,
	NULL,
	NULL,
	vdev_file_hold,
	vdev_file_rele,
	NULL,
	vdev_default_xlate,
	VDEV_TYPE_FILE, /* name of this vdev type */
	B_TRUE /* leaf vdev */
	};

	/*
	* From userland we access disks just like files.
	*/
	#ifndef _KERNEL

	vdev_ops_t vdev_disk_ops = {
	vdev_file_open,
	vdev_file_close,
	vdev_default_asize,
	vdev_file_io_start,
	vdev_file_io_done,
	NULL,
	NULL,
	vdev_file_hold,
	vdev_file_rele,
	NULL,
	vdev_default_xlate,
	VDEV_TYPE_DISK, /* name of this vdev type */
	B_TRUE /* leaf vdev */
	};

	#endif
	+
	+ZFS_MODULE_PARAM(zfs_vdev_file, vdev_file_, logical_ashift, ULONG, ZMOD_RW,
	+ "Logical ashift for file-based devices");
	+ZFS_MODULE_PARAM(zfs_vdev_file, vdev_file_, physical_ashift, ULONG, ZMOD_RW,
	+ "Physical ashift for file-based devices");
	Index: vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_file_os.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_file_os.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_file_os.c (revision 365892)
	@@ -1,309 +1,306 @@
	/*
	* Copyright (c) 2020 iXsystems, Inc.
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without
	* modification, are permitted provided that the following conditions
	* are met:
	* 1. Redistributions of source code must retain the above copyright
	* notice, this list of conditions and the following disclaimer.
	* 2. Redistributions in binary form must reproduce the above copyright
	* notice, this list of conditions and the following disclaimer in the
	* documentation and/or other materials provided with the distribution.
	*
	* THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
	* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
	* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
	* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
	* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
	* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
	* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
	* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
	* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
	* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
	* SUCH DAMAGE.
	*
	*/

	#include <sys/cdefs.h>
	__FBSDID("$FreeBSD$");

	#include <sys/dmu.h>
	#include <sys/dmu_impl.h>
	#include <sys/dmu_recv.h>
	#include <sys/dmu_tx.h>
	#include <sys/dbuf.h>
	#include <sys/dnode.h>
	#include <sys/zfs_context.h>
	#include <sys/dmu_objset.h>
	#include <sys/dmu_traverse.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_pool.h>
	#include <sys/dsl_synctask.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/zap.h>
	#include <sys/zio_checksum.h>
	#include <sys/zfs_znode.h>
	#include <sys/zfs_file.h>
	#include <sys/buf.h>
	#include <sys/stat.h>

	int
	zfs_file_open(const char path, int flags, int mode, zfs_file_t *fpp)
	{
	struct thread *td;
	int rc, fd;

	td = curthread;
	pwd_ensure_dirs();
	/* 12.x doesn't take a const char * */
	rc = kern_openat(td, AT_FDCWD, __DECONST(char *, path),
	UIO_SYSSPACE, flags, mode);
	if (rc)
	return (SET_ERROR(rc));
	fd = td->td_retval[0];
	td->td_retval[0] = 0;
	if (fget(curthread, fd, &cap_no_rights, fpp))
	kern_close(td, fd);
	return (0);
	}

	void
	zfs_file_close(zfs_file_t *fp)
	{
	fo_close(fp, curthread);
	}

	static int
	zfs_file_write_impl(zfs_file_t fp, const void buf, size_t count, loff_t *offp,
	ssize_t *resid)
	{
	ssize_t rc;
	struct uio auio;
	struct thread *td;
	struct iovec aiov;

	td = curthread;
	aiov.iov_base = (void *)(uintptr_t)buf;
	aiov.iov_len = count;
	auio.uio_iov = &aiov;
	auio.uio_iovcnt = 1;
	auio.uio_segflg = UIO_SYSSPACE;
	auio.uio_resid = count;
	auio.uio_rw = UIO_WRITE;
	auio.uio_td = td;
	auio.uio_offset = *offp;

	if ((fp->f_flag & FWRITE) == 0)
	return (SET_ERROR(EBADF));

	if (fp->f_type == DTYPE_VNODE)
	bwillwrite();

	rc = fo_write(fp, &auio, td->td_ucred, FOF_OFFSET, td);
	if (rc)
	return (SET_ERROR(rc));
	if (resid)
	*resid = auio.uio_resid;
	else if (auio.uio_resid)
	return (SET_ERROR(EIO));
	*offp += count - auio.uio_resid;
	return (rc);
	}

	int
	zfs_file_write(zfs_file_t fp, const void buf, size_t count, ssize_t *resid)
	{
	loff_t off = fp->f_offset;
	ssize_t rc;

	rc = zfs_file_write_impl(fp, buf, count, &off, resid);
	if (rc == 0)
	fp->f_offset = off;

	return (SET_ERROR(rc));
	}

	int
	zfs_file_pwrite(zfs_file_t fp, const void buf, size_t count, loff_t off,
	ssize_t *resid)
	{
	return (zfs_file_write_impl(fp, buf, count, &off, resid));
	}

	static int
	zfs_file_read_impl(zfs_file_t fp, void buf, size_t count, loff_t *offp,
	ssize_t *resid)
	{
	ssize_t rc;
	struct uio auio;
	struct thread *td;
	struct iovec aiov;

	td = curthread;
	aiov.iov_base = (void *)(uintptr_t)buf;
	aiov.iov_len = count;
	auio.uio_iov = &aiov;
	auio.uio_iovcnt = 1;
	auio.uio_segflg = UIO_SYSSPACE;
	auio.uio_resid = count;
	auio.uio_rw = UIO_READ;
	auio.uio_td = td;
	auio.uio_offset = *offp;

	if ((fp->f_flag & FREAD) == 0)
	return (SET_ERROR(EBADF));

	rc = fo_read(fp, &auio, td->td_ucred, FOF_OFFSET, td);
	if (rc)
	return (SET_ERROR(rc));
	*resid = auio.uio_resid;
	*offp += count - auio.uio_resid;
	return (SET_ERROR(0));
	}

	int
	zfs_file_read(zfs_file_t fp, void buf, size_t count, ssize_t *resid)
	{
	loff_t off = fp->f_offset;
	ssize_t rc;

	rc = zfs_file_read_impl(fp, buf, count, &off, resid);
	if (rc == 0)
	fp->f_offset = off;
	return (rc);
	}

	int
	zfs_file_pread(zfs_file_t fp, void buf, size_t count, loff_t off,
	ssize_t *resid)
	{
	return (zfs_file_read_impl(fp, buf, count, &off, resid));
	}

	int
	zfs_file_seek(zfs_file_t fp, loff_t offp, int whence)
	{
	int rc;
	struct thread *td;

	td = curthread;
	if ((fp->f_ops->fo_flags & DFLAG_SEEKABLE) == 0)
	return (SET_ERROR(ESPIPE));
	rc = fo_seek(fp, *offp, whence, td);
	if (rc == 0)
	*offp = td->td_uretoff.tdu_off;
	return (SET_ERROR(rc));
	}

	int
	zfs_file_getattr(zfs_file_t fp, zfs_file_attr_t zfattr)
	{
	struct thread *td;
	struct stat sb;
	int rc;

	td = curthread;

	rc = fo_stat(fp, &sb, td->td_ucred, td);
	if (rc)
	return (SET_ERROR(rc));
	zfattr->zfa_size = sb.st_size;
	zfattr->zfa_mode = sb.st_mode;

	return (0);
	}

	static __inline int
	zfs_vop_fsync(vnode_t *vp)
	{
	struct mount *mp;
	int error;

	if ((error = vn_start_write(vp, &mp, V_WAIT \| PCATCH)) != 0)
	goto drop;
	vn_lock(vp, LK_EXCLUSIVE \| LK_RETRY);
	error = VOP_FSYNC(vp, MNT_WAIT, curthread);
	VOP_UNLOCK1(vp);
	vn_finished_write(mp);
	drop:
	return (SET_ERROR(error));
	}

	int
	zfs_file_fsync(zfs_file_t *fp, int flags)
	{
	- struct vnode *v;
	-
	if (fp->f_type != DTYPE_VNODE)
	return (EINVAL);

	- v = fp->f_data;
	- return (zfs_vop_fsync(v));
	+ return (zfs_vop_fsync(fp->f_vnode));
	}

	int
	zfs_file_get(int fd, zfs_file_t **fpp)
	{
	struct file *fp;

	if (fget(curthread, fd, &cap_no_rights, &fp))
	return (SET_ERROR(EBADF));

	*fpp = fp;
	return (0);
	}

	void
	zfs_file_put(int fd)
	{
	struct file *fp;

	/* No CAP_ rights required, as we're only releasing. */
	if (fget(curthread, fd, &cap_no_rights, &fp) == 0) {
	fdrop(fp, curthread);
	fdrop(fp, curthread);
	}
	}

	loff_t
	zfs_file_off(zfs_file_t *fp)
	{
	return (fp->f_offset);
	}

	void *
	zfs_file_private(zfs_file_t *fp)
	{
	file_t *tmpfp;
	void *data;
	int error;

	tmpfp = curthread->td_fpop;
	curthread->td_fpop = fp;
	error = devfs_get_cdevpriv(&data);
	curthread->td_fpop = tmpfp;
	if (error != 0)
	return (NULL);
	return (data);
	}

	int
	zfs_file_unlink(const char *fnamep)
	{
	enum uio_seg seg = UIO_SYSSPACE;
	int rc;

	#if __FreeBSD_version >= 1300018
	rc = kern_funlinkat(curthread, AT_FDCWD, fnamep, FD_NONE, seg, 0, 0);
	#else
	#ifdef AT_BENEATH
	rc = kern_unlinkat(curthread, AT_FDCWD, fnamep, seg, 0, 0);
	#else
	rc = kern_unlinkat(curthread, AT_FDCWD, __DECONST(char *, fnamep),
	seg, 0);
	#endif
	#endif
	return (SET_ERROR(rc));
	}
	Index: vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_vfsops.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_vfsops.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_vfsops.c (revision 365892)
	@@ -1,2289 +1,2289 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011 Pawel Jakub Dawidek <pawel@dawidek.net>.
	* All rights reserved.
	* Copyright (c) 2012, 2015 by Delphix. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright 2016 Nexenta Systems, Inc. All rights reserved.
	*/

	/* Portions Copyright 2010 Robert Milkowski */

	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/systm.h>
	#include <sys/kernel.h>
	#include <sys/sysmacros.h>
	#include <sys/kmem.h>
	#include <sys/acl.h>
	#include <sys/vnode.h>
	#include <sys/vfs.h>
	#include <sys/mntent.h>
	#include <sys/mount.h>
	#include <sys/cmn_err.h>
	#include <sys/zfs_znode.h>
	#include <sys/zfs_dir.h>
	#include <sys/zil.h>
	#include <sys/fs/zfs.h>
	#include <sys/dmu.h>
	#include <sys/dsl_prop.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_deleg.h>
	#include <sys/spa.h>
	#include <sys/zap.h>
	#include <sys/sa.h>
	#include <sys/sa_impl.h>
	#include <sys/policy.h>
	#include <sys/atomic.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/zfs_ctldir.h>
	#include <sys/zfs_fuid.h>
	#include <sys/sunddi.h>
	#include <sys/dmu_objset.h>
	#include <sys/dsl_dir.h>
	#include <sys/spa_boot.h>
	#include <sys/jail.h>
	#include <ufs/ufs/quota.h>
	#include <sys/zfs_quota.h>

	#include "zfs_comutil.h"

	#ifndef MNTK_VMSETSIZE_BUG
	#define MNTK_VMSETSIZE_BUG 0
	#endif
	#ifndef MNTK_NOMSYNC
	#define MNTK_NOMSYNC 8
	#endif

	/* BEGIN CSTYLED */
	struct mtx zfs_debug_mtx;
	MTX_SYSINIT(zfs_debug_mtx, &zfs_debug_mtx, "zfs_debug", MTX_DEF);

	SYSCTL_NODE(_vfs, OID_AUTO, zfs, CTLFLAG_RW, 0, "ZFS file system");

	int zfs_super_owner;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, super_owner, CTLFLAG_RW, &zfs_super_owner, 0,
	"File system owner can perform privileged operation on his file systems");

	int zfs_debug_level;
	SYSCTL_INT(_vfs_zfs, OID_AUTO, debug, CTLFLAG_RWTUN, &zfs_debug_level, 0,
	"Debug level");

	SYSCTL_NODE(_vfs_zfs, OID_AUTO, version, CTLFLAG_RD, 0, "ZFS versions");
	static int zfs_version_acl = ZFS_ACL_VERSION;
	SYSCTL_INT(_vfs_zfs_version, OID_AUTO, acl, CTLFLAG_RD, &zfs_version_acl, 0,
	"ZFS_ACL_VERSION");
	static int zfs_version_spa = SPA_VERSION;
	SYSCTL_INT(_vfs_zfs_version, OID_AUTO, spa, CTLFLAG_RD, &zfs_version_spa, 0,
	"SPA_VERSION");
	static int zfs_version_zpl = ZPL_VERSION;
	SYSCTL_INT(_vfs_zfs_version, OID_AUTO, zpl, CTLFLAG_RD, &zfs_version_zpl, 0,
	"ZPL_VERSION");
	/* END CSTYLED */

	static int zfs_quotactl(vfs_t vfsp, int cmds, uid_t id, void arg);
	static int zfs_mount(vfs_t *vfsp);
	static int zfs_umount(vfs_t *vfsp, int fflag);
	static int zfs_root(vfs_t vfsp, int flags, vnode_t *vpp);
	static int zfs_statfs(vfs_t vfsp, struct statfs statp);
	static int zfs_vget(vfs_t vfsp, ino_t ino, int flags, vnode_t *vpp);
	static int zfs_sync(vfs_t *vfsp, int waitfor);
	#if __FreeBSD_version >= 1300098
	static int zfs_checkexp(vfs_t vfsp, struct sockaddr nam, uint64_t *extflagsp,
	struct ucred *credanonp, int numsecflavors, int *secflavors);
	#else
	static int zfs_checkexp(vfs_t vfsp, struct sockaddr nam, int *extflagsp,
	struct ucred *credanonp, int numsecflavors, int **secflavors);
	#endif
	static int zfs_fhtovp(vfs_t vfsp, fid_t fidp, int flags, vnode_t **vpp);
	static void zfs_freevfs(vfs_t *vfsp);

	struct vfsops zfs_vfsops = {
	.vfs_mount = zfs_mount,
	.vfs_unmount = zfs_umount,
	#if __FreeBSD_version >= 1300049
	.vfs_root = vfs_cache_root,
	.vfs_cachedroot = zfs_root,
	#else
	.vfs_root = zfs_root,
	#endif
	.vfs_statfs = zfs_statfs,
	.vfs_vget = zfs_vget,
	.vfs_sync = zfs_sync,
	.vfs_checkexp = zfs_checkexp,
	.vfs_fhtovp = zfs_fhtovp,
	.vfs_quotactl = zfs_quotactl,
	};

	VFS_SET(zfs_vfsops, zfs, VFCF_JAIL \| VFCF_DELEGADMIN);

	/*
	* We need to keep a count of active fs's.
	* This is necessary to prevent our module
	* from being unloaded after a umount -f
	*/
	static uint32_t zfs_active_fs_count = 0;

	int
	zfs_get_temporary_prop(dsl_dataset_t ds, zfs_prop_t zfs_prop, uint64_t val,
	char *setpoint)
	{
	int error;
	zfsvfs_t *zfvp;
	vfs_t *vfsp;
	objset_t *os;
	uint64_t tmp = *val;

	error = dmu_objset_from_ds(ds, &os);
	if (error != 0)
	return (error);

	error = getzfsvfs_impl(os, &zfvp);
	if (error != 0)
	return (error);
	if (zfvp == NULL)
	return (ENOENT);
	vfsp = zfvp->z_vfs;
	switch (zfs_prop) {
	case ZFS_PROP_ATIME:
	if (vfs_optionisset(vfsp, MNTOPT_NOATIME, NULL))
	tmp = 0;
	if (vfs_optionisset(vfsp, MNTOPT_ATIME, NULL))
	tmp = 1;
	break;
	case ZFS_PROP_DEVICES:
	if (vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL))
	tmp = 0;
	if (vfs_optionisset(vfsp, MNTOPT_DEVICES, NULL))
	tmp = 1;
	break;
	case ZFS_PROP_EXEC:
	if (vfs_optionisset(vfsp, MNTOPT_NOEXEC, NULL))
	tmp = 0;
	if (vfs_optionisset(vfsp, MNTOPT_EXEC, NULL))
	tmp = 1;
	break;
	case ZFS_PROP_SETUID:
	if (vfs_optionisset(vfsp, MNTOPT_NOSETUID, NULL))
	tmp = 0;
	if (vfs_optionisset(vfsp, MNTOPT_SETUID, NULL))
	tmp = 1;
	break;
	case ZFS_PROP_READONLY:
	if (vfs_optionisset(vfsp, MNTOPT_RW, NULL))
	tmp = 0;
	if (vfs_optionisset(vfsp, MNTOPT_RO, NULL))
	tmp = 1;
	break;
	case ZFS_PROP_XATTR:
	if (zfvp->z_flags & ZSB_XATTR)
	tmp = zfvp->z_xattr;
	break;
	case ZFS_PROP_NBMAND:
	if (vfs_optionisset(vfsp, MNTOPT_NONBMAND, NULL))
	tmp = 0;
	if (vfs_optionisset(vfsp, MNTOPT_NBMAND, NULL))
	tmp = 1;
	break;
	default:
	vfs_unbusy(vfsp);
	return (ENOENT);
	}

	vfs_unbusy(vfsp);
	if (tmp != *val) {
	(void) strcpy(setpoint, "temporary");
	*val = tmp;
	}
	return (0);
	}

	static int
	zfs_getquota(zfsvfs_t zfsvfs, uid_t id, int isgroup, struct dqblk64 dqp)
	{
	int error = 0;
	char buf[32];
	uint64_t usedobj, quotaobj;
	uint64_t quota, used = 0;
	timespec_t now;

	usedobj = isgroup ? DMU_GROUPUSED_OBJECT : DMU_USERUSED_OBJECT;
	quotaobj = isgroup ? zfsvfs->z_groupquota_obj : zfsvfs->z_userquota_obj;

	if (quotaobj == 0 \|\| zfsvfs->z_replay) {
	error = ENOENT;
	goto done;
	}
	(void) sprintf(buf, "%llx", (longlong_t)id);
	if ((error = zap_lookup(zfsvfs->z_os, quotaobj,
	buf, sizeof (quota), 1, &quota)) != 0) {
	dprintf("%s(%d): quotaobj lookup failed\n",
	__FUNCTION__, __LINE__);
	goto done;
	}
	/*
	* quota(8) uses bsoftlimit as "quoota", and hardlimit as "limit".
	* So we set them to be the same.
	*/
	dqp->dqb_bsoftlimit = dqp->dqb_bhardlimit = btodb(quota);
	error = zap_lookup(zfsvfs->z_os, usedobj, buf, sizeof (used), 1, &used);
	if (error && error != ENOENT) {
	dprintf("%s(%d): usedobj failed; %d\n",
	__FUNCTION__, __LINE__, error);
	goto done;
	}
	dqp->dqb_curblocks = btodb(used);
	dqp->dqb_ihardlimit = dqp->dqb_isoftlimit = 0;
	vfs_timestamp(&now);
	/*
	* Setting this to 0 causes FreeBSD quota(8) to print
	* the number of days since the epoch, which isn't
	* particularly useful.
	*/
	dqp->dqb_btime = dqp->dqb_itime = now.tv_sec;
	done:
	return (error);
	}

	static int
	zfs_quotactl(vfs_t vfsp, int cmds, uid_t id, void arg)
	{
	zfsvfs_t *zfsvfs = vfsp->vfs_data;
	struct thread *td;
	int cmd, type, error = 0;
	int bitsize;
	zfs_userquota_prop_t quota_type;
	struct dqblk64 dqblk = { 0 };

	td = curthread;
	cmd = cmds >> SUBCMDSHIFT;
	type = cmds & SUBCMDMASK;

	ZFS_ENTER(zfsvfs);
	if (id == -1) {
	switch (type) {
	case USRQUOTA:
	id = td->td_ucred->cr_ruid;
	break;
	case GRPQUOTA:
	id = td->td_ucred->cr_rgid;
	break;
	default:
	error = EINVAL;
	if (cmd == Q_QUOTAON \|\| cmd == Q_QUOTAOFF)
	vfs_unbusy(vfsp);
	goto done;
	}
	}
	/*
	* Map BSD type to:
	* ZFS_PROP_USERUSED,
	* ZFS_PROP_USERQUOTA,
	* ZFS_PROP_GROUPUSED,
	* ZFS_PROP_GROUPQUOTA
	*/
	switch (cmd) {
	case Q_SETQUOTA:
	case Q_SETQUOTA32:
	if (type == USRQUOTA)
	quota_type = ZFS_PROP_USERQUOTA;
	else if (type == GRPQUOTA)
	quota_type = ZFS_PROP_GROUPQUOTA;
	else
	error = EINVAL;
	break;
	case Q_GETQUOTA:
	case Q_GETQUOTA32:
	if (type == USRQUOTA)
	quota_type = ZFS_PROP_USERUSED;
	else if (type == GRPQUOTA)
	quota_type = ZFS_PROP_GROUPUSED;
	else
	error = EINVAL;
	break;
	}

	/*
	* Depending on the cmd, we may need to get
	* the ruid and domain (see fuidstr_to_sid?),
	* the fuid (how?), or other information.
	* Create fuid using zfs_fuid_create(zfsvfs, id,
	* ZFS_OWNER or ZFS_GROUP, cr, &fuidp)?
	* I think I can use just the id?
	*
	* Look at zfs_id_overquota() to look up a quota.
	* zap_lookup(something, quotaobj, fuidstring,
	* sizeof (long long), 1, &quota)
	*
	* See zfs_set_userquota() to set a quota.
	*/
	if ((uint32_t)type >= MAXQUOTAS) {
	error = EINVAL;
	goto done;
	}

	switch (cmd) {
	case Q_GETQUOTASIZE:
	bitsize = 64;
	error = copyout(&bitsize, arg, sizeof (int));
	break;
	case Q_QUOTAON:
	// As far as I can tell, you can't turn quotas on or off on zfs
	error = 0;
	vfs_unbusy(vfsp);
	break;
	case Q_QUOTAOFF:
	error = ENOTSUP;
	vfs_unbusy(vfsp);
	break;
	case Q_SETQUOTA:
	error = copyin(arg, &dqblk, sizeof (dqblk));
	if (error == 0)
	error = zfs_set_userquota(zfsvfs, quota_type,
	"", id, dbtob(dqblk.dqb_bhardlimit));
	break;
	case Q_GETQUOTA:
	error = zfs_getquota(zfsvfs, id, type == GRPQUOTA, &dqblk);
	if (error == 0)
	error = copyout(&dqblk, arg, sizeof (dqblk));
	break;
	default:
	error = EINVAL;
	break;
	}
	done:
	ZFS_EXIT(zfsvfs);
	return (error);
	}


	boolean_t
	zfs_is_readonly(zfsvfs_t *zfsvfs)
	{
	return (!!(zfsvfs->z_vfs->vfs_flag & VFS_RDONLY));
	}

	/ARGSUSED/
	static int
	zfs_sync(vfs_t *vfsp, int waitfor)
	{

	/*
	* Data integrity is job one. We don't want a compromised kernel
	* writing to the storage pool, so we never sync during panic.
	*/
	if (panicstr)
	return (0);

	/*
	* Ignore the system syncher. ZFS already commits async data
	* at zfs_txg_timeout intervals.
	*/
	if (waitfor == MNT_LAZY)
	return (0);

	if (vfsp != NULL) {
	/*
	* Sync a specific filesystem.
	*/
	zfsvfs_t *zfsvfs = vfsp->vfs_data;
	dsl_pool_t *dp;
	int error;

	error = vfs_stdsync(vfsp, waitfor);
	if (error != 0)
	return (error);

	ZFS_ENTER(zfsvfs);
	dp = dmu_objset_pool(zfsvfs->z_os);

	/*
	* If the system is shutting down, then skip any
	* filesystems which may exist on a suspended pool.
	*/
	if (rebooting && spa_suspended(dp->dp_spa)) {
	ZFS_EXIT(zfsvfs);
	return (0);
	}

	if (zfsvfs->z_log != NULL)
	zil_commit(zfsvfs->z_log, 0);

	ZFS_EXIT(zfsvfs);
	} else {
	/*
	* Sync all ZFS filesystems. This is what happens when you
	* run sync(1M). Unlike other filesystems, ZFS honors the
	* request by waiting for all pools to commit all dirty data.
	*/
	spa_sync_allpools();
	}

	return (0);
	}

	static void
	atime_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	if (newval == TRUE) {
	zfsvfs->z_atime = TRUE;
	zfsvfs->z_vfs->vfs_flag &= ~MNT_NOATIME;
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_NOATIME);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_ATIME, NULL, 0);
	} else {
	zfsvfs->z_atime = FALSE;
	zfsvfs->z_vfs->vfs_flag \|= MNT_NOATIME;
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_ATIME);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_NOATIME, NULL, 0);
	}
	}

	static void
	xattr_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	if (newval == ZFS_XATTR_OFF) {
	zfsvfs->z_flags &= ~ZSB_XATTR;
	} else {
	zfsvfs->z_flags \|= ZSB_XATTR;

	if (newval == ZFS_XATTR_SA)
	zfsvfs->z_xattr_sa = B_TRUE;
	else
	zfsvfs->z_xattr_sa = B_FALSE;
	}
	}

	static void
	blksz_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;
	ASSERT3U(newval, <=, spa_maxblocksize(dmu_objset_spa(zfsvfs->z_os)));
	ASSERT3U(newval, >=, SPA_MINBLOCKSIZE);
	ASSERT(ISP2(newval));

	zfsvfs->z_max_blksz = newval;
	zfsvfs->z_vfs->mnt_stat.f_iosize = newval;
	}

	static void
	readonly_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	if (newval) {
	/* XXX locking on vfs_flag? */
	zfsvfs->z_vfs->vfs_flag \|= VFS_RDONLY;
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_RW);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_RO, NULL, 0);
	} else {
	/* XXX locking on vfs_flag? */
	zfsvfs->z_vfs->vfs_flag &= ~VFS_RDONLY;
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_RO);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_RW, NULL, 0);
	}
	}

	static void
	setuid_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	if (newval == FALSE) {
	zfsvfs->z_vfs->vfs_flag \|= VFS_NOSETUID;
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_SETUID);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_NOSETUID, NULL, 0);
	} else {
	zfsvfs->z_vfs->vfs_flag &= ~VFS_NOSETUID;
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_NOSETUID);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_SETUID, NULL, 0);
	}
	}

	static void
	exec_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	if (newval == FALSE) {
	zfsvfs->z_vfs->vfs_flag \|= VFS_NOEXEC;
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_EXEC);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_NOEXEC, NULL, 0);
	} else {
	zfsvfs->z_vfs->vfs_flag &= ~VFS_NOEXEC;
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_NOEXEC);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_EXEC, NULL, 0);
	}
	}

	/*
	* The nbmand mount option can be changed at mount time.
	* We can't allow it to be toggled on live file systems or incorrect
	* behavior may be seen from cifs clients
	*
	* This property isn't registered via dsl_prop_register(), but this callback
	* will be called when a file system is first mounted
	*/
	static void
	nbmand_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;
	if (newval == FALSE) {
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_NBMAND);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_NONBMAND, NULL, 0);
	} else {
	vfs_clearmntopt(zfsvfs->z_vfs, MNTOPT_NONBMAND);
	vfs_setmntopt(zfsvfs->z_vfs, MNTOPT_NBMAND, NULL, 0);
	}
	}

	static void
	snapdir_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	zfsvfs->z_show_ctldir = newval;
	}

	static void
	vscan_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	zfsvfs->z_vscan = newval;
	}

	static void
	acl_mode_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	zfsvfs->z_acl_mode = newval;
	}

	static void
	acl_inherit_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	zfsvfs->z_acl_inherit = newval;
	}

	static int
	zfs_register_callbacks(vfs_t *vfsp)
	{
	struct dsl_dataset *ds = NULL;
	objset_t *os = NULL;
	zfsvfs_t *zfsvfs = NULL;
	uint64_t nbmand;
	boolean_t readonly = B_FALSE;
	boolean_t do_readonly = B_FALSE;
	boolean_t setuid = B_FALSE;
	boolean_t do_setuid = B_FALSE;
	boolean_t exec = B_FALSE;
	boolean_t do_exec = B_FALSE;
	boolean_t xattr = B_FALSE;
	boolean_t atime = B_FALSE;
	boolean_t do_atime = B_FALSE;
	boolean_t do_xattr = B_FALSE;
	int error = 0;

	ASSERT(vfsp);
	zfsvfs = vfsp->vfs_data;
	ASSERT(zfsvfs);
	os = zfsvfs->z_os;

	/*
	* This function can be called for a snapshot when we update snapshot's
	* mount point, which isn't really supported.
	*/
	if (dmu_objset_is_snapshot(os))
	return (EOPNOTSUPP);

	/*
	* The act of registering our callbacks will destroy any mount
	* options we may have. In order to enable temporary overrides
	* of mount options, we stash away the current values and
	* restore them after we register the callbacks.
	*/
	if (vfs_optionisset(vfsp, MNTOPT_RO, NULL) \|\|
	!spa_writeable(dmu_objset_spa(os))) {
	readonly = B_TRUE;
	do_readonly = B_TRUE;
	} else if (vfs_optionisset(vfsp, MNTOPT_RW, NULL)) {
	readonly = B_FALSE;
	do_readonly = B_TRUE;
	}
	if (vfs_optionisset(vfsp, MNTOPT_NOSETUID, NULL)) {
	setuid = B_FALSE;
	do_setuid = B_TRUE;
	} else if (vfs_optionisset(vfsp, MNTOPT_SETUID, NULL)) {
	setuid = B_TRUE;
	do_setuid = B_TRUE;
	}
	if (vfs_optionisset(vfsp, MNTOPT_NOEXEC, NULL)) {
	exec = B_FALSE;
	do_exec = B_TRUE;
	} else if (vfs_optionisset(vfsp, MNTOPT_EXEC, NULL)) {
	exec = B_TRUE;
	do_exec = B_TRUE;
	}
	if (vfs_optionisset(vfsp, MNTOPT_NOXATTR, NULL)) {
	zfsvfs->z_xattr = xattr = ZFS_XATTR_OFF;
	do_xattr = B_TRUE;
	} else if (vfs_optionisset(vfsp, MNTOPT_XATTR, NULL)) {
	zfsvfs->z_xattr = xattr = ZFS_XATTR_DIR;
	do_xattr = B_TRUE;
	} else if (vfs_optionisset(vfsp, MNTOPT_DIRXATTR, NULL)) {
	zfsvfs->z_xattr = xattr = ZFS_XATTR_DIR;
	do_xattr = B_TRUE;
	} else if (vfs_optionisset(vfsp, MNTOPT_SAXATTR, NULL)) {
	zfsvfs->z_xattr = xattr = ZFS_XATTR_SA;
	do_xattr = B_TRUE;
	}
	if (vfs_optionisset(vfsp, MNTOPT_NOATIME, NULL)) {
	atime = B_FALSE;
	do_atime = B_TRUE;
	} else if (vfs_optionisset(vfsp, MNTOPT_ATIME, NULL)) {
	atime = B_TRUE;
	do_atime = B_TRUE;
	}

	/*
	* We need to enter pool configuration here, so that we can use
	* dsl_prop_get_int_ds() to handle the special nbmand property below.
	* dsl_prop_get_integer() can not be used, because it has to acquire
	* spa_namespace_lock and we can not do that because we already hold
	* z_teardown_lock. The problem is that spa_write_cachefile() is called
	* with spa_namespace_lock held and the function calls ZFS vnode
	* operations to write the cache file and thus z_teardown_lock is
	* acquired after spa_namespace_lock.
	*/
	ds = dmu_objset_ds(os);
	dsl_pool_config_enter(dmu_objset_pool(os), FTAG);

	/*
	* nbmand is a special property. It can only be changed at
	* mount time.
	*
	* This is weird, but it is documented to only be changeable
	* at mount time.
	*/
	if (vfs_optionisset(vfsp, MNTOPT_NONBMAND, NULL)) {
	nbmand = B_FALSE;
	} else if (vfs_optionisset(vfsp, MNTOPT_NBMAND, NULL)) {
	nbmand = B_TRUE;
	} else if ((error = dsl_prop_get_int_ds(ds, "nbmand", &nbmand) != 0)) {
	dsl_pool_config_exit(dmu_objset_pool(os), FTAG);
	return (error);
	}

	/*
	* Register property callbacks.
	*
	* It would probably be fine to just check for i/o error from
	* the first prop_register(), but I guess I like to go
	* overboard...
	*/
	error = dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_ATIME), atime_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_XATTR), xattr_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_RECORDSIZE), blksz_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_READONLY), readonly_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_SETUID), setuid_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_EXEC), exec_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_SNAPDIR), snapdir_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_ACLMODE), acl_mode_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_ACLINHERIT), acl_inherit_changed_cb,
	zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_VSCAN), vscan_changed_cb, zfsvfs);
	dsl_pool_config_exit(dmu_objset_pool(os), FTAG);
	if (error)
	goto unregister;

	/*
	* Invoke our callbacks to restore temporary mount options.
	*/
	if (do_readonly)
	readonly_changed_cb(zfsvfs, readonly);
	if (do_setuid)
	setuid_changed_cb(zfsvfs, setuid);
	if (do_exec)
	exec_changed_cb(zfsvfs, exec);
	if (do_xattr)
	xattr_changed_cb(zfsvfs, xattr);
	if (do_atime)
	atime_changed_cb(zfsvfs, atime);

	nbmand_changed_cb(zfsvfs, nbmand);

	return (0);

	unregister:
	dsl_prop_unregister_all(ds, zfsvfs);
	return (error);
	}

	/*
	* Associate this zfsvfs with the given objset, which must be owned.
	* This will cache a bunch of on-disk state from the objset in the
	* zfsvfs.
	*/
	static int
	zfsvfs_init(zfsvfs_t zfsvfs, objset_t os)
	{
	int error;
	uint64_t val;

	zfsvfs->z_max_blksz = SPA_OLD_MAXBLOCKSIZE;
	zfsvfs->z_show_ctldir = ZFS_SNAPDIR_VISIBLE;
	zfsvfs->z_os = os;

	error = zfs_get_zplprop(os, ZFS_PROP_VERSION, &zfsvfs->z_version);
	if (error != 0)
	return (error);
	if (zfsvfs->z_version >
	zfs_zpl_version_map(spa_version(dmu_objset_spa(os)))) {
	(void) printf("Can't mount a version %lld file system "
	"on a version %lld pool\n. Pool must be upgraded to mount "
	"this file system.", (u_longlong_t)zfsvfs->z_version,
	(u_longlong_t)spa_version(dmu_objset_spa(os)));
	return (SET_ERROR(ENOTSUP));
	}
	error = zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &val);
	if (error != 0)
	return (error);
	zfsvfs->z_norm = (int)val;

	error = zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &val);
	if (error != 0)
	return (error);
	zfsvfs->z_utf8 = (val != 0);

	error = zfs_get_zplprop(os, ZFS_PROP_CASE, &val);
	if (error != 0)
	return (error);
	zfsvfs->z_case = (uint_t)val;

	/*
	* Fold case on file systems that are always or sometimes case
	* insensitive.
	*/
	if (zfsvfs->z_case == ZFS_CASE_INSENSITIVE \|\|
	zfsvfs->z_case == ZFS_CASE_MIXED)
	zfsvfs->z_norm \|= U8_TEXTPREP_TOUPPER;

	zfsvfs->z_use_fuids = USE_FUIDS(zfsvfs->z_version, zfsvfs->z_os);
	zfsvfs->z_use_sa = USE_SA(zfsvfs->z_version, zfsvfs->z_os);

	uint64_t sa_obj = 0;
	if (zfsvfs->z_use_sa) {
	/* should either have both of these objects or none */
	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_SA_ATTRS, 8, 1,
	&sa_obj);
	if (error != 0)
	return (error);
	}

	error = sa_setup(os, sa_obj, zfs_attr_table, ZPL_END,
	&zfsvfs->z_attr_table);
	if (error != 0)
	return (error);

	if (zfsvfs->z_version >= ZPL_VERSION_SA)
	sa_register_update_callback(os, zfs_sa_upgrade);

	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_ROOT_OBJ, 8, 1,
	&zfsvfs->z_root);
	if (error != 0)
	return (error);
	ASSERT(zfsvfs->z_root != 0);

	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_UNLINKED_SET, 8, 1,
	&zfsvfs->z_unlinkedobj);
	if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA],
	8, 1, &zfsvfs->z_userquota_obj);
	if (error == ENOENT)
	zfsvfs->z_userquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA],
	8, 1, &zfsvfs->z_groupquota_obj);
	if (error == ENOENT)
	zfsvfs->z_groupquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_PROJECTQUOTA],
	8, 1, &zfsvfs->z_projectquota_obj);
	if (error == ENOENT)
	zfsvfs->z_projectquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_USEROBJQUOTA],
	8, 1, &zfsvfs->z_userobjquota_obj);
	if (error == ENOENT)
	zfsvfs->z_userobjquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_GROUPOBJQUOTA],
	8, 1, &zfsvfs->z_groupobjquota_obj);
	if (error == ENOENT)
	zfsvfs->z_groupobjquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_PROJECTOBJQUOTA],
	8, 1, &zfsvfs->z_projectobjquota_obj);
	if (error == ENOENT)
	zfsvfs->z_projectobjquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_FUID_TABLES, 8, 1,
	&zfsvfs->z_fuid_obj);
	if (error == ENOENT)
	zfsvfs->z_fuid_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_SHARES_DIR, 8, 1,
	&zfsvfs->z_shares_dir);
	if (error == ENOENT)
	zfsvfs->z_shares_dir = 0;
	else if (error != 0)
	return (error);

	/*
	* Only use the name cache if we are looking for a
	* name on a file system that does not require normalization
	* or case folding. We can also look there if we happen to be
	* on a non-normalizing, mixed sensitivity file system IF we
	* are looking for the exact name (which is always the case on
	* FreeBSD).
	*/
	zfsvfs->z_use_namecache = !zfsvfs->z_norm \|\|
	((zfsvfs->z_case == ZFS_CASE_MIXED) &&
	!(zfsvfs->z_norm & ~U8_TEXTPREP_TOUPPER));

	return (0);
	}

	taskq_t *zfsvfs_taskq;

	static void
	zfsvfs_task_unlinked_drain(void *context, int pending __unused)
	{

	zfs_unlinked_drain((zfsvfs_t *)context);
	}

	int
	zfsvfs_create(const char osname, boolean_t readonly, zfsvfs_t *zfvp)
	{
	objset_t *os;
	zfsvfs_t *zfsvfs;
	int error;
	boolean_t ro = (readonly \|\| (strchr(osname, '@') != NULL));

	/*
	* XXX: Fix struct statfs so this isn't necessary!
	*
	* The 'osname' is used as the filesystem's special node, which means
	* it must fit in statfs.f_mntfromname, or else it can't be
	* enumerated, so libzfs_mnttab_find() returns NULL, which causes
	* 'zfs unmount' to think it's not mounted when it is.
	*/
	if (strlen(osname) >= MNAMELEN)
	return (SET_ERROR(ENAMETOOLONG));

	zfsvfs = kmem_zalloc(sizeof (zfsvfs_t), KM_SLEEP);

	error = dmu_objset_own(osname, DMU_OST_ZFS, ro, B_TRUE, zfsvfs,
	&os);
	if (error != 0) {
	kmem_free(zfsvfs, sizeof (zfsvfs_t));
	return (error);
	}

	error = zfsvfs_create_impl(zfvp, zfsvfs, os);

	return (error);
	}


	int
	zfsvfs_create_impl(zfsvfs_t *zfvp, zfsvfs_t zfsvfs, objset_t *os)
	{
	int error;

	zfsvfs->z_vfs = NULL;
	zfsvfs->z_parent = zfsvfs;

	mutex_init(&zfsvfs->z_znodes_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&zfsvfs->z_lock, NULL, MUTEX_DEFAULT, NULL);
	list_create(&zfsvfs->z_all_znodes, sizeof (znode_t),
	offsetof(znode_t, z_link_node));
	TASK_INIT(&zfsvfs->z_unlinked_drain_task, 0,
	zfsvfs_task_unlinked_drain, zfsvfs);
	#ifdef DIAGNOSTIC
	rrm_init(&zfsvfs->z_teardown_lock, B_TRUE);
	#else
	rrm_init(&zfsvfs->z_teardown_lock, B_FALSE);
	#endif
	- rw_init(&zfsvfs->z_teardown_inactive_lock, NULL, RW_DEFAULT, NULL);
	+ ZFS_INIT_TEARDOWN_INACTIVE(zfsvfs);
	rw_init(&zfsvfs->z_fuid_lock, NULL, RW_DEFAULT, NULL);
	for (int i = 0; i != ZFS_OBJ_MTX_SZ; i++)
	mutex_init(&zfsvfs->z_hold_mtx[i], NULL, MUTEX_DEFAULT, NULL);

	error = zfsvfs_init(zfsvfs, os);
	if (error != 0) {
	dmu_objset_disown(os, B_TRUE, zfsvfs);
	*zfvp = NULL;
	kmem_free(zfsvfs, sizeof (zfsvfs_t));
	return (error);
	}

	*zfvp = zfsvfs;
	return (0);
	}

	static int
	zfsvfs_setup(zfsvfs_t *zfsvfs, boolean_t mounting)
	{
	int error;

	/*
	* Check for a bad on-disk format version now since we
	* lied about owning the dataset readonly before.
	*/
	if (!(zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) &&
	dmu_objset_incompatible_encryption_version(zfsvfs->z_os))
	return (SET_ERROR(EROFS));

	error = zfs_register_callbacks(zfsvfs->z_vfs);
	if (error)
	return (error);

	zfsvfs->z_log = zil_open(zfsvfs->z_os, zfs_get_data);

	/*
	* If we are not mounting (ie: online recv), then we don't
	* have to worry about replaying the log as we blocked all
	* operations out since we closed the ZIL.
	*/
	if (mounting) {
	boolean_t readonly;

	ASSERT3P(zfsvfs->z_kstat.dk_kstats, ==, NULL);
	dataset_kstats_create(&zfsvfs->z_kstat, zfsvfs->z_os);

	/*
	* During replay we remove the read only flag to
	* allow replays to succeed.
	*/
	readonly = zfsvfs->z_vfs->vfs_flag & VFS_RDONLY;
	if (readonly != 0) {
	zfsvfs->z_vfs->vfs_flag &= ~VFS_RDONLY;
	} else {
	dsl_dir_t *dd;
	zap_stats_t zs;

	if (zap_get_stats(zfsvfs->z_os, zfsvfs->z_unlinkedobj,
	&zs) == 0) {
	dataset_kstats_update_nunlinks_kstat(
	&zfsvfs->z_kstat, zs.zs_num_entries);
	dprintf_ds(zfsvfs->z_os->os_dsl_dataset,
	"num_entries in unlinked set: %llu",
	zs.zs_num_entries);
	}

	zfs_unlinked_drain(zfsvfs);
	dd = zfsvfs->z_os->os_dsl_dataset->ds_dir;
	dd->dd_activity_cancelled = B_FALSE;
	}

	/*
	* Parse and replay the intent log.
	*
	* Because of ziltest, this must be done after
	* zfs_unlinked_drain(). (Further note: ziltest
	* doesn't use readonly mounts, where
	* zfs_unlinked_drain() isn't called.) This is because
	* ziltest causes spa_sync() to think it's committed,
	* but actually it is not, so the intent log contains
	* many txg's worth of changes.
	*
	* In particular, if object N is in the unlinked set in
	* the last txg to actually sync, then it could be
	* actually freed in a later txg and then reallocated
	* in a yet later txg. This would write a "create
	* object N" record to the intent log. Normally, this
	* would be fine because the spa_sync() would have
	* written out the fact that object N is free, before
	* we could write the "create object N" intent log
	* record.
	*
	* But when we are in ziltest mode, we advance the "open
	* txg" without actually spa_sync()-ing the changes to
	* disk. So we would see that object N is still
	* allocated and in the unlinked set, and there is an
	* intent log record saying to allocate it.
	*/
	if (spa_writeable(dmu_objset_spa(zfsvfs->z_os))) {
	if (zil_replay_disable) {
	zil_destroy(zfsvfs->z_log, B_FALSE);
	} else {
	boolean_t use_nc = zfsvfs->z_use_namecache;
	zfsvfs->z_use_namecache = B_FALSE;
	zfsvfs->z_replay = B_TRUE;
	zil_replay(zfsvfs->z_os, zfsvfs,
	zfs_replay_vector);
	zfsvfs->z_replay = B_FALSE;
	zfsvfs->z_use_namecache = use_nc;
	}
	}

	/* restore readonly bit */
	if (readonly != 0)
	zfsvfs->z_vfs->vfs_flag \|= VFS_RDONLY;
	}

	/*
	* Set the objset user_ptr to track its zfsvfs.
	*/
	mutex_enter(&zfsvfs->z_os->os_user_ptr_lock);
	dmu_objset_set_user(zfsvfs->z_os, zfsvfs);
	mutex_exit(&zfsvfs->z_os->os_user_ptr_lock);

	return (0);
	}

	extern krwlock_t zfsvfs_lock; /* in zfs_znode.c */

	void
	zfsvfs_free(zfsvfs_t *zfsvfs)
	{
	int i;

	/*
	* This is a barrier to prevent the filesystem from going away in
	* zfs_znode_move() until we can safely ensure that the filesystem is
	* not unmounted. We consider the filesystem valid before the barrier
	* and invalid after the barrier.
	*/
	rw_enter(&zfsvfs_lock, RW_READER);
	rw_exit(&zfsvfs_lock);

	zfs_fuid_destroy(zfsvfs);

	mutex_destroy(&zfsvfs->z_znodes_lock);
	mutex_destroy(&zfsvfs->z_lock);
	ASSERT(zfsvfs->z_nr_znodes == 0);
	list_destroy(&zfsvfs->z_all_znodes);
	rrm_destroy(&zfsvfs->z_teardown_lock);
	- rw_destroy(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_DESTROY_TEARDOWN_INACTIVE(zfsvfs);
	rw_destroy(&zfsvfs->z_fuid_lock);
	for (i = 0; i != ZFS_OBJ_MTX_SZ; i++)
	mutex_destroy(&zfsvfs->z_hold_mtx[i]);
	dataset_kstats_destroy(&zfsvfs->z_kstat);
	kmem_free(zfsvfs, sizeof (zfsvfs_t));
	}

	static void
	zfs_set_fuid_feature(zfsvfs_t *zfsvfs)
	{
	zfsvfs->z_use_fuids = USE_FUIDS(zfsvfs->z_version, zfsvfs->z_os);
	if (zfsvfs->z_vfs) {
	if (zfsvfs->z_use_fuids) {
	vfs_set_feature(zfsvfs->z_vfs, VFSFT_XVATTR);
	vfs_set_feature(zfsvfs->z_vfs, VFSFT_SYSATTR_VIEWS);
	vfs_set_feature(zfsvfs->z_vfs, VFSFT_ACEMASKONACCESS);
	vfs_set_feature(zfsvfs->z_vfs, VFSFT_ACLONCREATE);
	vfs_set_feature(zfsvfs->z_vfs, VFSFT_ACCESS_FILTER);
	vfs_set_feature(zfsvfs->z_vfs, VFSFT_REPARSE);
	} else {
	vfs_clear_feature(zfsvfs->z_vfs, VFSFT_XVATTR);
	vfs_clear_feature(zfsvfs->z_vfs, VFSFT_SYSATTR_VIEWS);
	vfs_clear_feature(zfsvfs->z_vfs, VFSFT_ACEMASKONACCESS);
	vfs_clear_feature(zfsvfs->z_vfs, VFSFT_ACLONCREATE);
	vfs_clear_feature(zfsvfs->z_vfs, VFSFT_ACCESS_FILTER);
	vfs_clear_feature(zfsvfs->z_vfs, VFSFT_REPARSE);
	}
	}
	zfsvfs->z_use_sa = USE_SA(zfsvfs->z_version, zfsvfs->z_os);
	}

	static int
	zfs_domount(vfs_t vfsp, char osname)
	{
	uint64_t recordsize, fsid_guid;
	int error = 0;
	zfsvfs_t *zfsvfs;

	ASSERT(vfsp);
	ASSERT(osname);

	error = zfsvfs_create(osname, vfsp->mnt_flag & MNT_RDONLY, &zfsvfs);
	if (error)
	return (error);
	zfsvfs->z_vfs = vfsp;

	if ((error = dsl_prop_get_integer(osname,
	"recordsize", &recordsize, NULL)))
	goto out;
	zfsvfs->z_vfs->vfs_bsize = SPA_MINBLOCKSIZE;
	zfsvfs->z_vfs->mnt_stat.f_iosize = recordsize;

	vfsp->vfs_data = zfsvfs;
	vfsp->mnt_flag \|= MNT_LOCAL;
	vfsp->mnt_kern_flag \|= MNTK_LOOKUP_SHARED;
	vfsp->mnt_kern_flag \|= MNTK_SHARED_WRITES;
	vfsp->mnt_kern_flag \|= MNTK_EXTENDED_SHARED;
	/*
	* This can cause a loss of coherence between ARC and page cache
	* on ZoF - unclear if the problem is in FreeBSD or ZoF
	*/
	vfsp->mnt_kern_flag \|= MNTK_NO_IOPF; /* vn_io_fault can be used */
	vfsp->mnt_kern_flag \|= MNTK_NOMSYNC;
	vfsp->mnt_kern_flag \|= MNTK_VMSETSIZE_BUG;

	#if defined(_KERNEL) && !defined(KMEM_DEBUG)
	vfsp->mnt_kern_flag \|= MNTK_FPLOOKUP;
	#endif
	/*
	* The fsid is 64 bits, composed of an 8-bit fs type, which
	* separates our fsid from any other filesystem types, and a
	* 56-bit objset unique ID. The objset unique ID is unique to
	* all objsets open on this system, provided by unique_create().
	* The 8-bit fs type must be put in the low bits of fsid[1]
	* because that's where other Solaris filesystems put it.
	*/
	fsid_guid = dmu_objset_fsid_guid(zfsvfs->z_os);
	ASSERT((fsid_guid & ~((1ULL<<56)-1)) == 0);
	vfsp->vfs_fsid.val[0] = fsid_guid;
	vfsp->vfs_fsid.val[1] = ((fsid_guid>>32) << 8) \|
	(vfsp->mnt_vfc->vfc_typenum & 0xFF);

	/*
	* Set features for file system.
	*/
	zfs_set_fuid_feature(zfsvfs);
	if (zfsvfs->z_case == ZFS_CASE_INSENSITIVE) {
	vfs_set_feature(vfsp, VFSFT_DIRENTFLAGS);
	vfs_set_feature(vfsp, VFSFT_CASEINSENSITIVE);
	vfs_set_feature(vfsp, VFSFT_NOCASESENSITIVE);
	} else if (zfsvfs->z_case == ZFS_CASE_MIXED) {
	vfs_set_feature(vfsp, VFSFT_DIRENTFLAGS);
	vfs_set_feature(vfsp, VFSFT_CASEINSENSITIVE);
	}
	vfs_set_feature(vfsp, VFSFT_ZEROCOPY_SUPPORTED);

	if (dmu_objset_is_snapshot(zfsvfs->z_os)) {
	uint64_t pval;

	atime_changed_cb(zfsvfs, B_FALSE);
	readonly_changed_cb(zfsvfs, B_TRUE);
	if ((error = dsl_prop_get_integer(osname,
	"xattr", &pval, NULL)))
	goto out;
	xattr_changed_cb(zfsvfs, pval);
	zfsvfs->z_issnap = B_TRUE;
	zfsvfs->z_os->os_sync = ZFS_SYNC_DISABLED;

	mutex_enter(&zfsvfs->z_os->os_user_ptr_lock);
	dmu_objset_set_user(zfsvfs->z_os, zfsvfs);
	mutex_exit(&zfsvfs->z_os->os_user_ptr_lock);
	} else {
	if ((error = zfsvfs_setup(zfsvfs, B_TRUE)))
	goto out;
	}

	vfs_mountedfrom(vfsp, osname);

	if (!zfsvfs->z_issnap)
	zfsctl_create(zfsvfs);
	out:
	if (error) {
	dmu_objset_disown(zfsvfs->z_os, B_TRUE, zfsvfs);
	zfsvfs_free(zfsvfs);
	} else {
	atomic_inc_32(&zfs_active_fs_count);
	}

	return (error);
	}

	static void
	zfs_unregister_callbacks(zfsvfs_t *zfsvfs)
	{
	objset_t *os = zfsvfs->z_os;

	if (!dmu_objset_is_snapshot(os))
	dsl_prop_unregister_all(dmu_objset_ds(os), zfsvfs);
	}

	static int
	getpoolname(const char osname, char poolname)
	{
	char *p;

	p = strchr(osname, '/');
	if (p == NULL) {
	if (strlen(osname) >= MAXNAMELEN)
	return (ENAMETOOLONG);
	(void) strcpy(poolname, osname);
	} else {
	if (p - osname >= MAXNAMELEN)
	return (ENAMETOOLONG);
	(void) strncpy(poolname, osname, p - osname);
	poolname[p - osname] = '\0';
	}
	return (0);
	}

	/ARGSUSED/
	static int
	zfs_mount(vfs_t *vfsp)
	{
	kthread_t *td = curthread;
	vnode_t *mvp = vfsp->mnt_vnodecovered;
	cred_t *cr = td->td_ucred;
	char *osname;
	int error = 0;
	int canwrite;

	if (vfs_getopt(vfsp->mnt_optnew, "from", (void **)&osname, NULL))
	return (SET_ERROR(EINVAL));

	/*
	* If full-owner-access is enabled and delegated administration is
	* turned on, we must set nosuid.
	*/
	if (zfs_super_owner &&
	dsl_deleg_access(osname, ZFS_DELEG_PERM_MOUNT, cr) != ECANCELED) {
	secpolicy_fs_mount_clearopts(cr, vfsp);
	}

	/*
	* Check for mount privilege?
	*
	* If we don't have privilege then see if
	* we have local permission to allow it
	*/
	error = secpolicy_fs_mount(cr, mvp, vfsp);
	if (error) {
	if (dsl_deleg_access(osname, ZFS_DELEG_PERM_MOUNT, cr) != 0)
	goto out;

	if (!(vfsp->vfs_flag & MS_REMOUNT)) {
	vattr_t vattr;

	/*
	* Make sure user is the owner of the mount point
	* or has sufficient privileges.
	*/

	vattr.va_mask = AT_UID;

	vn_lock(mvp, LK_SHARED \| LK_RETRY);
	if (VOP_GETATTR(mvp, &vattr, cr)) {
	VOP_UNLOCK1(mvp);
	goto out;
	}

	if (secpolicy_vnode_owner(mvp, cr, vattr.va_uid) != 0 &&
	VOP_ACCESS(mvp, VWRITE, cr, td) != 0) {
	VOP_UNLOCK1(mvp);
	goto out;
	}
	VOP_UNLOCK1(mvp);
	}

	secpolicy_fs_mount_clearopts(cr, vfsp);
	}

	/*
	* Refuse to mount a filesystem if we are in a local zone and the
	* dataset is not visible.
	*/
	if (!INGLOBALZONE(curproc) &&
	(!zone_dataset_visible(osname, &canwrite) \|\| !canwrite)) {
	error = SET_ERROR(EPERM);
	goto out;
	}

	vfsp->vfs_flag \|= MNT_NFS4ACLS;

	/*
	* When doing a remount, we simply refresh our temporary properties
	* according to those options set in the current VFS options.
	*/
	if (vfsp->vfs_flag & MS_REMOUNT) {
	zfsvfs_t *zfsvfs = vfsp->vfs_data;

	/*
	* Refresh mount options with z_teardown_lock blocking I/O while
	* the filesystem is in an inconsistent state.
	* The lock also serializes this code with filesystem
	* manipulations between entry to zfs_suspend_fs() and return
	* from zfs_resume_fs().
	*/
	rrm_enter(&zfsvfs->z_teardown_lock, RW_WRITER, FTAG);
	zfs_unregister_callbacks(zfsvfs);
	error = zfs_register_callbacks(vfsp);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);
	goto out;
	}

	/* Initial root mount: try hard to import the requested root pool. */
	if ((vfsp->vfs_flag & MNT_ROOTFS) != 0 &&
	(vfsp->vfs_flag & MNT_UPDATE) == 0) {
	char pname[MAXNAMELEN];

	error = getpoolname(osname, pname);
	if (error == 0)
	error = spa_import_rootpool(pname, false);
	if (error)
	goto out;
	}
	DROP_GIANT();
	error = zfs_domount(vfsp, osname);
	PICKUP_GIANT();

	out:
	return (error);
	}

	static int
	zfs_statfs(vfs_t vfsp, struct statfs statp)
	{
	zfsvfs_t *zfsvfs = vfsp->vfs_data;
	uint64_t refdbytes, availbytes, usedobjs, availobjs;

	statp->f_version = STATFS_VERSION;

	ZFS_ENTER(zfsvfs);

	dmu_objset_space(zfsvfs->z_os,
	&refdbytes, &availbytes, &usedobjs, &availobjs);

	/*
	* The underlying storage pool actually uses multiple block sizes.
	* We report the fragsize as the smallest block size we support,
	* and we report our blocksize as the filesystem's maximum blocksize.
	*/
	statp->f_bsize = SPA_MINBLOCKSIZE;
	statp->f_iosize = zfsvfs->z_vfs->mnt_stat.f_iosize;

	/*
	* The following report "total" blocks of various kinds in the
	* file system, but reported in terms of f_frsize - the
	* "fragment" size.
	*/

	statp->f_blocks = (refdbytes + availbytes) >> SPA_MINBLOCKSHIFT;
	statp->f_bfree = availbytes / statp->f_bsize;
	statp->f_bavail = statp->f_bfree; /* no root reservation */

	/*
	* statvfs() should really be called statufs(), because it assumes
	* static metadata. ZFS doesn't preallocate files, so the best
	* we can do is report the max that could possibly fit in f_files,
	* and that minus the number actually used in f_ffree.
	* For f_ffree, report the smaller of the number of object available
	* and the number of blocks (each object will take at least a block).
	*/
	statp->f_ffree = MIN(availobjs, statp->f_bfree);
	statp->f_files = statp->f_ffree + usedobjs;

	/*
	* We're a zfs filesystem.
	*/
	strlcpy(statp->f_fstypename, "zfs",
	sizeof (statp->f_fstypename));

	strlcpy(statp->f_mntfromname, vfsp->mnt_stat.f_mntfromname,
	sizeof (statp->f_mntfromname));
	strlcpy(statp->f_mntonname, vfsp->mnt_stat.f_mntonname,
	sizeof (statp->f_mntonname));

	statp->f_namemax = MAXNAMELEN - 1;

	ZFS_EXIT(zfsvfs);
	return (0);
	}

	static int
	zfs_root(vfs_t vfsp, int flags, vnode_t *vpp)
	{
	zfsvfs_t *zfsvfs = vfsp->vfs_data;
	znode_t *rootzp;
	int error;

	ZFS_ENTER(zfsvfs);

	error = zfs_zget(zfsvfs, zfsvfs->z_root, &rootzp);
	if (error == 0)
	*vpp = ZTOV(rootzp);

	ZFS_EXIT(zfsvfs);

	if (error == 0) {
	error = vn_lock(*vpp, flags);
	if (error != 0) {
	VN_RELE(*vpp);
	*vpp = NULL;
	}
	}
	return (error);
	}

	/*
	* Teardown the zfsvfs::z_os.
	*
	* Note, if 'unmounting' is FALSE, we return with the 'z_teardown_lock'
	* and 'z_teardown_inactive_lock' held.
	*/
	static int
	zfsvfs_teardown(zfsvfs_t *zfsvfs, boolean_t unmounting)
	{
	znode_t *zp;
	dsl_dir_t *dd;

	/*
	* If someone has not already unmounted this file system,
	* drain the zrele_taskq to ensure all active references to the
	* zfsvfs_t have been handled only then can it be safely destroyed.
	*/
	if (zfsvfs->z_os) {
	/*
	* If we're unmounting we have to wait for the list to
	* drain completely.
	*
	* If we're not unmounting there's no guarantee the list
	* will drain completely, but zreles run from the taskq
	* may add the parents of dir-based xattrs to the taskq
	* so we want to wait for these.
	*
	* We can safely read z_nr_znodes without locking because the
	* VFS has already blocked operations which add to the
	* z_all_znodes list and thus increment z_nr_znodes.
	*/
	int round = 0;
	while (zfsvfs->z_nr_znodes > 0) {
	taskq_wait_outstanding(dsl_pool_zrele_taskq(
	dmu_objset_pool(zfsvfs->z_os)), 0);
	if (++round > 1 && !unmounting)
	break;
	}
	}
	rrm_enter(&zfsvfs->z_teardown_lock, RW_WRITER, FTAG);

	if (!unmounting) {
	/*
	* We purge the parent filesystem's vfsp as the parent
	* filesystem and all of its snapshots have their vnode's
	* v_vfsp set to the parent's filesystem's vfsp. Note,
	* 'z_parent' is self referential for non-snapshots.
	*/
	#ifdef FREEBSD_NAMECACHE
	cache_purgevfs(zfsvfs->z_parent->z_vfs, true);
	#endif
	}

	/*
	* Close the zil. NB: Can't close the zil while zfs_inactive
	* threads are blocked as zil_close can call zfs_inactive.
	*/
	if (zfsvfs->z_log) {
	zil_close(zfsvfs->z_log);
	zfsvfs->z_log = NULL;
	}

	- rw_enter(&zfsvfs->z_teardown_inactive_lock, RW_WRITER);
	+ ZFS_WLOCK_TEARDOWN_INACTIVE(zfsvfs);

	/*
	* If we are not unmounting (ie: online recv) and someone already
	* unmounted this file system while we were doing the switcheroo,
	* or a reopen of z_os failed then just bail out now.
	*/
	if (!unmounting && (zfsvfs->z_unmounted \|\| zfsvfs->z_os == NULL)) {
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_WUNLOCK_TEARDOWN_INACTIVE(zfsvfs);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);
	return (SET_ERROR(EIO));
	}

	/*
	* At this point there are no vops active, and any new vops will
	* fail with EIO since we have z_teardown_lock for writer (only
	* relevant for forced unmount).
	*
	* Release all holds on dbufs.
	*/
	mutex_enter(&zfsvfs->z_znodes_lock);
	for (zp = list_head(&zfsvfs->z_all_znodes); zp != NULL;
	zp = list_next(&zfsvfs->z_all_znodes, zp))
	if (zp->z_sa_hdl) {
	ASSERT(ZTOV(zp)->v_count >= 0);
	zfs_znode_dmu_fini(zp);
	}
	mutex_exit(&zfsvfs->z_znodes_lock);

	/*
	* If we are unmounting, set the unmounted flag and let new vops
	* unblock. zfs_inactive will have the unmounted behavior, and all
	* other vops will fail with EIO.
	*/
	if (unmounting) {
	zfsvfs->z_unmounted = B_TRUE;
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_WUNLOCK_TEARDOWN_INACTIVE(zfsvfs);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);
	}

	/*
	* z_os will be NULL if there was an error in attempting to reopen
	* zfsvfs, so just return as the properties had already been
	* unregistered and cached data had been evicted before.
	*/
	if (zfsvfs->z_os == NULL)
	return (0);

	/*
	* Unregister properties.
	*/
	zfs_unregister_callbacks(zfsvfs);

	/*
	* Evict cached data
	*/
	if (!zfs_is_readonly(zfsvfs))
	txg_wait_synced(dmu_objset_pool(zfsvfs->z_os), 0);
	dmu_objset_evict_dbufs(zfsvfs->z_os);
	dd = zfsvfs->z_os->os_dsl_dataset->ds_dir;
	dsl_dir_cancel_waiters(dd);

	return (0);
	}

	/ARGSUSED/
	static int
	zfs_umount(vfs_t *vfsp, int fflag)
	{
	kthread_t *td = curthread;
	zfsvfs_t *zfsvfs = vfsp->vfs_data;
	objset_t *os;
	cred_t *cr = td->td_ucred;
	int ret;

	ret = secpolicy_fs_unmount(cr, vfsp);
	if (ret) {
	if (dsl_deleg_access((char *)vfsp->vfs_resource,
	ZFS_DELEG_PERM_MOUNT, cr))
	return (ret);
	}

	/*
	* Unmount any snapshots mounted under .zfs before unmounting the
	* dataset itself.
	*/
	if (zfsvfs->z_ctldir != NULL) {
	if ((ret = zfsctl_umount_snapshots(vfsp, fflag, cr)) != 0)
	return (ret);
	}

	if (fflag & MS_FORCE) {
	/*
	* Mark file system as unmounted before calling
	* vflush(FORCECLOSE). This way we ensure no future vnops
	* will be called and risk operating on DOOMED vnodes.
	*/
	rrm_enter(&zfsvfs->z_teardown_lock, RW_WRITER, FTAG);
	zfsvfs->z_unmounted = B_TRUE;
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);
	}

	/*
	* Flush all the files.
	*/
	ret = vflush(vfsp, 0, (fflag & MS_FORCE) ? FORCECLOSE : 0, td);
	if (ret != 0)
	return (ret);
	while (taskqueue_cancel(zfsvfs_taskq->tq_queue,
	&zfsvfs->z_unlinked_drain_task, NULL) != 0)
	taskqueue_drain(zfsvfs_taskq->tq_queue,
	&zfsvfs->z_unlinked_drain_task);

	VERIFY(zfsvfs_teardown(zfsvfs, B_TRUE) == 0);
	os = zfsvfs->z_os;

	/*
	* z_os will be NULL if there was an error in
	* attempting to reopen zfsvfs.
	*/
	if (os != NULL) {
	/*
	* Unset the objset user_ptr.
	*/
	mutex_enter(&os->os_user_ptr_lock);
	dmu_objset_set_user(os, NULL);
	mutex_exit(&os->os_user_ptr_lock);

	/*
	* Finally release the objset
	*/
	dmu_objset_disown(os, B_TRUE, zfsvfs);
	}

	/*
	* We can now safely destroy the '.zfs' directory node.
	*/
	if (zfsvfs->z_ctldir != NULL)
	zfsctl_destroy(zfsvfs);
	zfs_freevfs(vfsp);

	return (0);
	}

	static int
	zfs_vget(vfs_t vfsp, ino_t ino, int flags, vnode_t *vpp)
	{
	zfsvfs_t *zfsvfs = vfsp->vfs_data;
	znode_t *zp;
	int err;

	/*
	* zfs_zget() can't operate on virtual entries like .zfs/ or
	* .zfs/snapshot/ directories, that's why we return EOPNOTSUPP.
	* This will make NFS to switch to LOOKUP instead of using VGET.
	*/
	if (ino == ZFSCTL_INO_ROOT \|\| ino == ZFSCTL_INO_SNAPDIR \|\|
	(zfsvfs->z_shares_dir != 0 && ino == zfsvfs->z_shares_dir))
	return (EOPNOTSUPP);

	ZFS_ENTER(zfsvfs);
	err = zfs_zget(zfsvfs, ino, &zp);
	if (err == 0 && zp->z_unlinked) {
	vrele(ZTOV(zp));
	err = EINVAL;
	}
	if (err == 0)
	*vpp = ZTOV(zp);
	ZFS_EXIT(zfsvfs);
	if (err == 0) {
	err = vn_lock(*vpp, flags);
	if (err != 0)
	vrele(*vpp);
	}
	if (err != 0)
	*vpp = NULL;
	return (err);
	}

	static int
	#if __FreeBSD_version >= 1300098
	zfs_checkexp(vfs_t vfsp, struct sockaddr nam, uint64_t *extflagsp,
	struct ucred *credanonp, int numsecflavors, int *secflavors)
	#else
	zfs_checkexp(vfs_t vfsp, struct sockaddr nam, int *extflagsp,
	struct ucred *credanonp, int numsecflavors, int **secflavors)
	#endif
	{
	zfsvfs_t *zfsvfs = vfsp->vfs_data;

	/*
	* If this is regular file system vfsp is the same as
	* zfsvfs->z_parent->z_vfs, but if it is snapshot,
	* zfsvfs->z_parent->z_vfs represents parent file system
	* which we have to use here, because only this file system
	* has mnt_export configured.
	*/
	return (vfs_stdcheckexp(zfsvfs->z_parent->z_vfs, nam, extflagsp,
	credanonp, numsecflavors, secflavors));
	}

	CTASSERT(SHORT_FID_LEN <= sizeof (struct fid));
	CTASSERT(LONG_FID_LEN <= sizeof (struct fid));

	static int
	zfs_fhtovp(vfs_t vfsp, fid_t fidp, int flags, vnode_t **vpp)
	{
	struct componentname cn;
	zfsvfs_t *zfsvfs = vfsp->vfs_data;
	znode_t *zp;
	vnode_t *dvp;
	uint64_t object = 0;
	uint64_t fid_gen = 0;
	uint64_t gen_mask;
	uint64_t zp_gen;
	int i, err;

	*vpp = NULL;

	ZFS_ENTER(zfsvfs);

	/*
	* On FreeBSD we can get snapshot's mount point or its parent file
	* system mount point depending if snapshot is already mounted or not.
	*/
	if (zfsvfs->z_parent == zfsvfs && fidp->fid_len == LONG_FID_LEN) {
	zfid_long_t zlfid = (zfid_long_t )fidp;
	uint64_t objsetid = 0;
	uint64_t setgen = 0;

	for (i = 0; i < sizeof (zlfid->zf_setid); i++)
	objsetid \|= ((uint64_t)zlfid->zf_setid[i]) << (8 * i);

	for (i = 0; i < sizeof (zlfid->zf_setgen); i++)
	setgen \|= ((uint64_t)zlfid->zf_setgen[i]) << (8 * i);

	ZFS_EXIT(zfsvfs);

	err = zfsctl_lookup_objset(vfsp, objsetid, &zfsvfs);
	if (err)
	return (SET_ERROR(EINVAL));
	ZFS_ENTER(zfsvfs);
	}

	if (fidp->fid_len == SHORT_FID_LEN \|\| fidp->fid_len == LONG_FID_LEN) {
	zfid_short_t zfid = (zfid_short_t )fidp;

	for (i = 0; i < sizeof (zfid->zf_object); i++)
	object \|= ((uint64_t)zfid->zf_object[i]) << (8 * i);

	for (i = 0; i < sizeof (zfid->zf_gen); i++)
	fid_gen \|= ((uint64_t)zfid->zf_gen[i]) << (8 * i);
	} else {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	/*
	* A zero fid_gen means we are in .zfs or the .zfs/snapshot
	* directory tree. If the object == zfsvfs->z_shares_dir, then
	* we are in the .zfs/shares directory tree.
	*/
	if ((fid_gen == 0 &&
	(object == ZFSCTL_INO_ROOT \|\| object == ZFSCTL_INO_SNAPDIR)) \|\|
	(zfsvfs->z_shares_dir != 0 && object == zfsvfs->z_shares_dir)) {
	ZFS_EXIT(zfsvfs);
	VERIFY0(zfsctl_root(zfsvfs, LK_SHARED, &dvp));
	if (object == ZFSCTL_INO_SNAPDIR) {
	cn.cn_nameptr = "snapshot";
	cn.cn_namelen = strlen(cn.cn_nameptr);
	cn.cn_nameiop = LOOKUP;
	cn.cn_flags = ISLASTCN \| LOCKLEAF;
	cn.cn_lkflags = flags;
	VERIFY0(VOP_LOOKUP(dvp, vpp, &cn));
	vput(dvp);
	} else if (object == zfsvfs->z_shares_dir) {
	/*
	* XXX This branch must not be taken,
	* if it is, then the lookup below will
	* explode.
	*/
	cn.cn_nameptr = "shares";
	cn.cn_namelen = strlen(cn.cn_nameptr);
	cn.cn_nameiop = LOOKUP;
	cn.cn_flags = ISLASTCN;
	cn.cn_lkflags = flags;
	VERIFY0(VOP_LOOKUP(dvp, vpp, &cn));
	vput(dvp);
	} else {
	*vpp = dvp;
	}
	return (err);
	}

	gen_mask = -1ULL >> (64 - 8 * i);

	dprintf("getting %llu [%u mask %llx]\n", object, fid_gen, gen_mask);
	if ((err = zfs_zget(zfsvfs, object, &zp))) {
	ZFS_EXIT(zfsvfs);
	return (err);
	}
	(void) sa_lookup(zp->z_sa_hdl, SA_ZPL_GEN(zfsvfs), &zp_gen,
	sizeof (uint64_t));
	zp_gen = zp_gen & gen_mask;
	if (zp_gen == 0)
	zp_gen = 1;
	if (zp->z_unlinked \|\| zp_gen != fid_gen) {
	dprintf("znode gen (%u) != fid gen (%u)\n", zp_gen, fid_gen);
	vrele(ZTOV(zp));
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	*vpp = ZTOV(zp);
	ZFS_EXIT(zfsvfs);
	err = vn_lock(*vpp, flags);
	if (err == 0)
	vnode_create_vobject(*vpp, zp->z_size, curthread);
	else
	*vpp = NULL;
	return (err);
	}

	/*
	* Block out VOPs and close zfsvfs_t::z_os
	*
	* Note, if successful, then we return with the 'z_teardown_lock' and
	* 'z_teardown_inactive_lock' write held. We leave ownership of the underlying
	* dataset and objset intact so that they can be atomically handed off during
	* a subsequent rollback or recv operation and the resume thereafter.
	*/
	int
	zfs_suspend_fs(zfsvfs_t *zfsvfs)
	{
	int error;

	if ((error = zfsvfs_teardown(zfsvfs, B_FALSE)) != 0)
	return (error);

	return (0);
	}

	/*
	* Rebuild SA and release VOPs. Note that ownership of the underlying dataset
	* is an invariant across any of the operations that can be performed while the
	* filesystem was suspended. Whether it succeeded or failed, the preconditions
	* are the same: the relevant objset and associated dataset are owned by
	* zfsvfs, held, and long held on entry.
	*/
	int
	zfs_resume_fs(zfsvfs_t zfsvfs, dsl_dataset_t ds)
	{
	int err;
	znode_t *zp;

	ASSERT(RRM_WRITE_HELD(&zfsvfs->z_teardown_lock));
	- ASSERT(RW_WRITE_HELD(&zfsvfs->z_teardown_inactive_lock));
	+ ASSERT(ZFS_TEARDOWN_INACTIVE_WLOCKED(zfsvfs));

	/*
	* We already own this, so just update the objset_t, as the one we
	* had before may have been evicted.
	*/
	objset_t *os;
	VERIFY3P(ds->ds_owner, ==, zfsvfs);
	VERIFY(dsl_dataset_long_held(ds));
	dsl_pool_t *dp = spa_get_dsl(dsl_dataset_get_spa(ds));
	dsl_pool_config_enter(dp, FTAG);
	VERIFY0(dmu_objset_from_ds(ds, &os));
	dsl_pool_config_exit(dp, FTAG);

	err = zfsvfs_init(zfsvfs, os);
	if (err != 0)
	goto bail;

	ds->ds_dir->dd_activity_cancelled = B_FALSE;
	VERIFY(zfsvfs_setup(zfsvfs, B_FALSE) == 0);

	zfs_set_fuid_feature(zfsvfs);

	/*
	* Attempt to re-establish all the active znodes with
	* their dbufs. If a zfs_rezget() fails, then we'll let
	* any potential callers discover that via ZFS_ENTER_VERIFY_VP
	* when they try to use their znode.
	*/
	mutex_enter(&zfsvfs->z_znodes_lock);
	for (zp = list_head(&zfsvfs->z_all_znodes); zp;
	zp = list_next(&zfsvfs->z_all_znodes, zp)) {
	(void) zfs_rezget(zp);
	}
	mutex_exit(&zfsvfs->z_znodes_lock);

	bail:
	/* release the VOPs */
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_WUNLOCK_TEARDOWN_INACTIVE(zfsvfs);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);

	if (err) {
	/*
	* Since we couldn't setup the sa framework, try to force
	* unmount this file system.
	*/
	if (vn_vfswlock(zfsvfs->z_vfs->vfs_vnodecovered) == 0) {
	vfs_ref(zfsvfs->z_vfs);
	(void) dounmount(zfsvfs->z_vfs, MS_FORCE, curthread);
	}
	}
	return (err);
	}

	static void
	zfs_freevfs(vfs_t *vfsp)
	{
	zfsvfs_t *zfsvfs = vfsp->vfs_data;

	zfsvfs_free(zfsvfs);

	atomic_dec_32(&zfs_active_fs_count);
	}

	#ifdef __i386__
	static int desiredvnodes_backup;
	#include <sys/vmmeter.h>


	#include <vm/vm_page.h>
	#include <vm/vm_object.h>
	#include <vm/vm_kern.h>
	#include <vm/vm_map.h>
	#endif

	static void
	zfs_vnodes_adjust(void)
	{
	#ifdef __i386__
	int newdesiredvnodes;

	desiredvnodes_backup = desiredvnodes;

	/*
	* We calculate newdesiredvnodes the same way it is done in
	* vntblinit(). If it is equal to desiredvnodes, it means that
	* it wasn't tuned by the administrator and we can tune it down.
	*/
	newdesiredvnodes = min(maxproc + vm_cnt.v_page_count / 4, 2 *
	vm_kmem_size / (5 * (sizeof (struct vm_object) +
	sizeof (struct vnode))));
	if (newdesiredvnodes == desiredvnodes)
	desiredvnodes = (3 * newdesiredvnodes) / 4;
	#endif
	}

	static void
	zfs_vnodes_adjust_back(void)
	{

	#ifdef __i386__
	desiredvnodes = desiredvnodes_backup;
	#endif
	}

	void
	zfs_init(void)
	{

	printf("ZFS filesystem version: " ZPL_VERSION_STRING "\n");

	/*
	* Initialize .zfs directory structures
	*/
	zfsctl_init();

	/*
	* Initialize znode cache, vnode ops, etc...
	*/
	zfs_znode_init();

	/*
	* Reduce number of vnodes. Originally number of vnodes is calculated
	* with UFS inode in mind. We reduce it here, because it's too big for
	* ZFS/i386.
	*/
	zfs_vnodes_adjust();

	dmu_objset_register_type(DMU_OST_ZFS, zpl_get_file_info);

	zfsvfs_taskq = taskq_create("zfsvfs", 1, minclsyspri, 0, 0, 0);
	}

	void
	zfs_fini(void)
	{
	taskq_destroy(zfsvfs_taskq);
	zfsctl_fini();
	zfs_znode_fini();
	zfs_vnodes_adjust_back();
	}

	int
	zfs_busy(void)
	{
	return (zfs_active_fs_count != 0);
	}

	/*
	* Release VOPs and unmount a suspended filesystem.
	*/
	int
	zfs_end_fs(zfsvfs_t zfsvfs, dsl_dataset_t ds)
	{
	ASSERT(RRM_WRITE_HELD(&zfsvfs->z_teardown_lock));
	- ASSERT(RW_WRITE_HELD(&zfsvfs->z_teardown_inactive_lock));
	+ ASSERT(ZFS_TEARDOWN_INACTIVE_WLOCKED(zfsvfs));

	/*
	* We already own this, so just hold and rele it to update the
	* objset_t, as the one we had before may have been evicted.
	*/
	objset_t *os;
	VERIFY3P(ds->ds_owner, ==, zfsvfs);
	VERIFY(dsl_dataset_long_held(ds));
	dsl_pool_t *dp = spa_get_dsl(dsl_dataset_get_spa(ds));
	dsl_pool_config_enter(dp, FTAG);
	VERIFY0(dmu_objset_from_ds(ds, &os));
	dsl_pool_config_exit(dp, FTAG);
	zfsvfs->z_os = os;

	/* release the VOPs */
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_WUNLOCK_TEARDOWN_INACTIVE(zfsvfs);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);

	/*
	* Try to force unmount this file system.
	*/
	(void) zfs_umount(zfsvfs->z_vfs, 0);
	zfsvfs->z_unmounted = B_TRUE;
	return (0);
	}

	int
	zfs_set_version(zfsvfs_t *zfsvfs, uint64_t newvers)
	{
	int error;
	objset_t *os = zfsvfs->z_os;
	dmu_tx_t *tx;

	if (newvers < ZPL_VERSION_INITIAL \|\| newvers > ZPL_VERSION)
	return (SET_ERROR(EINVAL));

	if (newvers < zfsvfs->z_version)
	return (SET_ERROR(EINVAL));

	if (zfs_spa_version_map(newvers) >
	spa_version(dmu_objset_spa(zfsvfs->z_os)))
	return (SET_ERROR(ENOTSUP));

	tx = dmu_tx_create(os);
	dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, B_FALSE, ZPL_VERSION_STR);
	if (newvers >= ZPL_VERSION_SA && !zfsvfs->z_use_sa) {
	dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, B_TRUE,
	ZFS_SA_ATTRS);
	dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
	}
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	return (error);
	}

	error = zap_update(os, MASTER_NODE_OBJ, ZPL_VERSION_STR,
	8, 1, &newvers, tx);

	if (error) {
	dmu_tx_commit(tx);
	return (error);
	}

	if (newvers >= ZPL_VERSION_SA && !zfsvfs->z_use_sa) {
	uint64_t sa_obj;

	ASSERT3U(spa_version(dmu_objset_spa(zfsvfs->z_os)), >=,
	SPA_VERSION_SA);
	sa_obj = zap_create(os, DMU_OT_SA_MASTER_NODE,
	DMU_OT_NONE, 0, tx);

	error = zap_add(os, MASTER_NODE_OBJ,
	ZFS_SA_ATTRS, 8, 1, &sa_obj, tx);
	ASSERT0(error);

	VERIFY(0 == sa_set_sa_object(os, sa_obj));
	sa_register_update_callback(os, zfs_sa_upgrade);
	}

	spa_history_log_internal_ds(dmu_objset_ds(os), "upgrade", tx,
	"from %ju to %ju", (uintmax_t)zfsvfs->z_version,
	(uintmax_t)newvers);
	dmu_tx_commit(tx);

	zfsvfs->z_version = newvers;
	os->os_version = newvers;

	zfs_set_fuid_feature(zfsvfs);

	return (0);
	}

	/*
	* Read a property stored within the master node.
	*/
	int
	zfs_get_zplprop(objset_t os, zfs_prop_t prop, uint64_t value)
	{
	uint64_t *cached_copy = NULL;

	/*
	* Figure out where in the objset_t the cached copy would live, if it
	* is available for the requested property.
	*/
	if (os != NULL) {
	switch (prop) {
	case ZFS_PROP_VERSION:
	cached_copy = &os->os_version;
	break;
	case ZFS_PROP_NORMALIZE:
	cached_copy = &os->os_normalization;
	break;
	case ZFS_PROP_UTF8ONLY:
	cached_copy = &os->os_utf8only;
	break;
	case ZFS_PROP_CASE:
	cached_copy = &os->os_casesensitivity;
	break;
	default:
	break;
	}
	}
	if (cached_copy != NULL && *cached_copy != OBJSET_PROP_UNINITIALIZED) {
	value = cached_copy;
	return (0);
	}

	/*
	* If the property wasn't cached, look up the file system's value for
	* the property. For the version property, we look up a slightly
	* different string.
	*/
	const char *pname;
	int error = ENOENT;
	if (prop == ZFS_PROP_VERSION) {
	pname = ZPL_VERSION_STR;
	} else {
	pname = zfs_prop_to_name(prop);
	}

	if (os != NULL) {
	ASSERT3U(os->os_phys->os_type, ==, DMU_OST_ZFS);
	error = zap_lookup(os, MASTER_NODE_OBJ, pname, 8, 1, value);
	}

	if (error == ENOENT) {
	/* No value set, use the default value */
	switch (prop) {
	case ZFS_PROP_VERSION:
	*value = ZPL_VERSION;
	break;
	case ZFS_PROP_NORMALIZE:
	case ZFS_PROP_UTF8ONLY:
	*value = 0;
	break;
	case ZFS_PROP_CASE:
	*value = ZFS_CASE_SENSITIVE;
	break;
	default:
	return (error);
	}
	error = 0;
	}

	/*
	* If one of the methods for getting the property value above worked,
	* copy it into the objset_t's cache.
	*/
	if (error == 0 && cached_copy != NULL) {
	cached_copy = value;
	}

	return (error);
	}

	/*
	* Return true if the corresponding vfs's unmounted flag is set.
	* Otherwise return false.
	* If this function returns true we know VFS unmount has been initiated.
	*/
	boolean_t
	zfs_get_vfs_flag_unmounted(objset_t *os)
	{
	zfsvfs_t *zfvp;
	boolean_t unmounted = B_FALSE;

	ASSERT(dmu_objset_type(os) == DMU_OST_ZFS);

	mutex_enter(&os->os_user_ptr_lock);
	zfvp = dmu_objset_get_user(os);
	if (zfvp != NULL && zfvp->z_vfs != NULL &&
	(zfvp->z_vfs->mnt_kern_flag & MNTK_UNMOUNT))
	unmounted = B_TRUE;
	mutex_exit(&os->os_user_ptr_lock);

	return (unmounted);
	}

	#ifdef _KERNEL
	void
	zfsvfs_update_fromname(const char oldname, const char newname)
	{
	char tmpbuf[MAXPATHLEN];
	struct mount *mp;
	char *fromname;
	size_t oldlen;

	oldlen = strlen(oldname);

	mtx_lock(&mountlist_mtx);
	TAILQ_FOREACH(mp, &mountlist, mnt_list) {
	fromname = mp->mnt_stat.f_mntfromname;
	if (strcmp(fromname, oldname) == 0) {
	(void) strlcpy(fromname, newname,
	sizeof (mp->mnt_stat.f_mntfromname));
	continue;
	}
	if (strncmp(fromname, oldname, oldlen) == 0 &&
	(fromname[oldlen] == '/' \|\| fromname[oldlen] == '@')) {
	(void) snprintf(tmpbuf, sizeof (tmpbuf), "%s%s",
	newname, fromname + oldlen);
	(void) strlcpy(fromname, tmpbuf,
	sizeof (mp->mnt_stat.f_mntfromname));
	continue;
	}
	}
	mtx_unlock(&mountlist_mtx);
	}
	#endif
	Index: vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_vnops.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_vnops.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_vnops.c (revision 365892)
	@@ -1,6629 +1,6629 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2012, 2015 by Delphix. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright 2017 Nexenta Systems, Inc.
	*/

	/* Portions Copyright 2007 Jeremy Teo */
	/* Portions Copyright 2010 Robert Milkowski */

	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/time.h>
	#include <sys/systm.h>
	#include <sys/sysmacros.h>
	#include <sys/resource.h>
	#include <sys/vfs.h>
	#include <sys/endian.h>
	#include <sys/vm.h>
	#include <sys/vnode.h>
	#if __FreeBSD_version >= 1300102
	#include <sys/smr.h>
	#endif
	#include <sys/dirent.h>
	#include <sys/file.h>
	#include <sys/stat.h>
	#include <sys/kmem.h>
	#include <sys/taskq.h>
	#include <sys/uio.h>
	#include <sys/atomic.h>
	#include <sys/namei.h>
	#include <sys/mman.h>
	#include <sys/cmn_err.h>
	#include <sys/kdb.h>
	#include <sys/sysproto.h>
	#include <sys/errno.h>
	#include <sys/unistd.h>
	#include <sys/zfs_dir.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/fs/zfs.h>
	#include <sys/dmu.h>
	#include <sys/dmu_objset.h>
	#include <sys/spa.h>
	#include <sys/txg.h>
	#include <sys/dbuf.h>
	#include <sys/zap.h>
	#include <sys/sa.h>
	#include <sys/policy.h>
	#include <sys/sunddi.h>
	#include <sys/filio.h>
	#include <sys/sid.h>
	#include <sys/zfs_ctldir.h>
	#include <sys/zfs_fuid.h>
	#include <sys/zfs_quota.h>
	#include <sys/zfs_sa.h>
	#include <sys/zfs_rlock.h>
	#include <sys/extdirent.h>
	#include <sys/bio.h>
	#include <sys/buf.h>
	#include <sys/sched.h>
	#include <sys/acl.h>
	#include <sys/vmmeter.h>
	#include <vm/vm_param.h>
	#include <sys/zil.h>
	#include <sys/zfs_vnops.h>

	#include <vm/vm_object.h>

	#include <sys/extattr.h>
	#include <sys/priv.h>

	#ifndef VN_OPEN_INVFS
	#define VN_OPEN_INVFS 0x0
	#endif

	VFS_SMR_DECLARE;

	#if __FreeBSD_version >= 1300047
	#define vm_page_wire_lock(pp)
	#define vm_page_wire_unlock(pp)
	#else
	#define vm_page_wire_lock(pp) vm_page_lock(pp)
	#define vm_page_wire_unlock(pp) vm_page_unlock(pp)
	#endif

	static int
	zfs_u8_validate(const char u8str, size_t n, char list, int flag, int errnum)
	{

	return (u8_validate(__DECONST(char *, u8str), n, list, flag, errnum));
	}
	#define u8_validate zfs_u8_validate

	#ifdef DEBUG_VFS_LOCKS
	#define VNCHECKREF(vp) \
	VNASSERT((vp)->v_holdcnt > 0 && (vp)->v_usecount > 0, vp, \
	("%s: wrong ref counts", __func__));
	#else
	#define VNCHECKREF(vp)
	#endif

	/*
	* Programming rules.
	*
	* Each vnode op performs some logical unit of work. To do this, the ZPL must
	* properly lock its in-core state, create a DMU transaction, do the work,
	* record this work in the intent log (ZIL), commit the DMU transaction,
	* and wait for the intent log to commit if it is a synchronous operation.
	* Moreover, the vnode ops must work in both normal and log replay context.
	* The ordering of events is important to avoid deadlocks and references
	* to freed memory. The example below illustrates the following Big Rules:
	*
	* (1) A check must be made in each zfs thread for a mounted file system.
	* This is done avoiding races using ZFS_ENTER(zfsvfs).
	* A ZFS_EXIT(zfsvfs) is needed before all returns. Any znodes
	* must be checked with ZFS_VERIFY_ZP(zp). Both of these macros
	* can return EIO from the calling function.
	*
	* (2) VN_RELE() should always be the last thing except for zil_commit()
	* (if necessary) and ZFS_EXIT(). This is for 3 reasons:
	* First, if it's the last reference, the vnode/znode
	* can be freed, so the zp may point to freed memory. Second, the last
	* reference will call zfs_zinactive(), which may induce a lot of work --
	* pushing cached pages (which acquires range locks) and syncing out
	* cached atime changes. Third, zfs_zinactive() may require a new tx,
	* which could deadlock the system if you were already holding one.
	* If you must call VN_RELE() within a tx then use VN_RELE_ASYNC().
	*
	* (3) All range locks must be grabbed before calling dmu_tx_assign(),
	* as they can span dmu_tx_assign() calls.
	*
	* (4) If ZPL locks are held, pass TXG_NOWAIT as the second argument to
	* dmu_tx_assign(). This is critical because we don't want to block
	* while holding locks.
	*
	* If no ZPL locks are held (aside from ZFS_ENTER()), use TXG_WAIT. This
	* reduces lock contention and CPU usage when we must wait (note that if
	* throughput is constrained by the storage, nearly every transaction
	* must wait).
	*
	* Note, in particular, that if a lock is sometimes acquired before
	* the tx assigns, and sometimes after (e.g. z_lock), then failing
	* to use a non-blocking assign can deadlock the system. The scenario:
	*
	* Thread A has grabbed a lock before calling dmu_tx_assign().
	* Thread B is in an already-assigned tx, and blocks for this lock.
	* Thread A calls dmu_tx_assign(TXG_WAIT) and blocks in txg_wait_open()
	* forever, because the previous txg can't quiesce until B's tx commits.
	*
	* If dmu_tx_assign() returns ERESTART and zfsvfs->z_assign is TXG_NOWAIT,
	* then drop all locks, call dmu_tx_wait(), and try again. On subsequent
	* calls to dmu_tx_assign(), pass TXG_NOTHROTTLE in addition to TXG_NOWAIT,
	* to indicate that this operation has already called dmu_tx_wait().
	* This will ensure that we don't retry forever, waiting a short bit
	* each time.
	*
	* (5) If the operation succeeded, generate the intent log entry for it
	* before dropping locks. This ensures that the ordering of events
	* in the intent log matches the order in which they actually occurred.
	* During ZIL replay the zfs_log_* functions will update the sequence
	* number to indicate the zil transaction has replayed.
	*
	* (6) At the end of each vnode op, the DMU tx must always commit,
	* regardless of whether there were any errors.
	*
	* (7) After dropping all locks, invoke zil_commit(zilog, foid)
	* to ensure that synchronous semantics are provided when necessary.
	*
	* In general, this is how things should be ordered in each vnode op:
	*
	* ZFS_ENTER(zfsvfs); // exit if unmounted
	* top:
	* zfs_dirent_lookup(&dl, ...) // lock directory entry (may VN_HOLD())
	* rw_enter(...); // grab any other locks you need
	* tx = dmu_tx_create(...); // get DMU tx
	* dmu_tx_hold_*(); // hold each object you might modify
	* error = dmu_tx_assign(tx, (waited ? TXG_NOTHROTTLE : 0) \| TXG_NOWAIT);
	* if (error) {
	* rw_exit(...); // drop locks
	* zfs_dirent_unlock(dl); // unlock directory entry
	* VN_RELE(...); // release held vnodes
	* if (error == ERESTART) {
	* waited = B_TRUE;
	* dmu_tx_wait(tx);
	* dmu_tx_abort(tx);
	* goto top;
	* }
	* dmu_tx_abort(tx); // abort DMU tx
	* ZFS_EXIT(zfsvfs); // finished in zfs
	* return (error); // really out of space
	* }
	* error = do_real_work(); // do whatever this VOP does
	* if (error == 0)
	* zfs_log_*(...); // on success, make ZIL entry
	* dmu_tx_commit(tx); // commit DMU tx -- error or not
	* rw_exit(...); // drop locks
	* zfs_dirent_unlock(dl); // unlock directory entry
	* VN_RELE(...); // release held vnodes
	* zil_commit(zilog, foid); // synchronous when necessary
	* ZFS_EXIT(zfsvfs); // finished in zfs
	* return (error); // done, report error
	*/

	/* ARGSUSED */
	static int
	zfs_open(vnode_t *vpp, int flag, cred_t cr)
	{
	znode_t zp = VTOZ(vpp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	if ((flag & FWRITE) && (zp->z_pflags & ZFS_APPENDONLY) &&
	((flag & FAPPEND) == 0)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EPERM));
	}

	if (!zfs_has_ctldir(zp) && zp->z_zfsvfs->z_vscan &&
	ZTOV(zp)->v_type == VREG &&
	!(zp->z_pflags & ZFS_AV_QUARANTINED) && zp->z_size > 0) {
	if (fs_vscan(*vpp, cr, 0) != 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EACCES));
	}
	}

	/* Keep a count of the synchronous opens in the znode */
	if (flag & (FSYNC \| FDSYNC))
	atomic_inc_32(&zp->z_sync_cnt);

	ZFS_EXIT(zfsvfs);
	return (0);
	}

	/* ARGSUSED */
	static int
	zfs_close(vnode_t vp, int flag, int count, offset_t offset, cred_t cr)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	/* Decrement the synchronous opens in the znode */
	if ((flag & (FSYNC \| FDSYNC)) && (count == 1))
	atomic_dec_32(&zp->z_sync_cnt);

	if (!zfs_has_ctldir(zp) && zp->z_zfsvfs->z_vscan &&
	ZTOV(zp)->v_type == VREG &&
	!(zp->z_pflags & ZFS_AV_QUARANTINED) && zp->z_size > 0)
	VERIFY(fs_vscan(vp, cr, 1) == 0);

	ZFS_EXIT(zfsvfs);
	return (0);
	}

	/*
	* Lseek support for finding holes (cmd == _FIO_SEEK_HOLE) and
	* data (cmd == _FIO_SEEK_DATA). "off" is an in/out parameter.
	*/
	static int
	zfs_holey(vnode_t vp, ulong_t cmd, offset_t off)
	{
	znode_t *zp = VTOZ(vp);
	uint64_t noff = (uint64_t)off; / new offset */
	uint64_t file_sz;
	int error;
	boolean_t hole;

	file_sz = zp->z_size;
	if (noff >= file_sz) {
	return (SET_ERROR(ENXIO));
	}

	if (cmd == _FIO_SEEK_HOLE)
	hole = B_TRUE;
	else
	hole = B_FALSE;

	error = dmu_offset_next(zp->z_zfsvfs->z_os, zp->z_id, hole, &noff);

	if (error == ESRCH)
	return (SET_ERROR(ENXIO));

	/* file was dirty, so fall back to using generic logic */
	if (error == EBUSY) {
	if (hole)
	*off = file_sz;

	return (0);
	}

	/*
	* We could find a hole that begins after the logical end-of-file,
	* because dmu_offset_next() only works on whole blocks. If the
	* EOF falls mid-block, then indicate that the "virtual hole"
	* at the end of the file begins at the logical EOF, rather than
	* at the end of the last block.
	*/
	if (noff > file_sz) {
	ASSERT(hole);
	noff = file_sz;
	}

	if (noff < *off)
	return (error);
	*off = noff;
	return (error);
	}

	/* ARGSUSED */
	static int
	zfs_ioctl(vnode_t vp, ulong_t com, intptr_t data, int flag, cred_t cred,
	int *rvalp)
	{
	offset_t off;
	int error;
	zfsvfs_t *zfsvfs;
	znode_t *zp;

	switch (com) {
	case _FIOFFS:
	{
	return (0);

	/*
	* The following two ioctls are used by bfu. Faking out,
	* necessary to avoid bfu errors.
	*/
	}
	case _FIOGDIO:
	case _FIOSDIO:
	{
	return (0);
	}

	case _FIO_SEEK_DATA:
	case _FIO_SEEK_HOLE:
	{
	off = (offset_t )data;
	zp = VTOZ(vp);
	zfsvfs = zp->z_zfsvfs;
	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	/* offset parameter is in/out */
	error = zfs_holey(vp, com, &off);
	ZFS_EXIT(zfsvfs);
	if (error)
	return (error);
	(offset_t )data = off;
	return (0);
	}
	}
	return (SET_ERROR(ENOTTY));
	}

	static vm_page_t
	page_busy(vnode_t *vp, int64_t start, int64_t off, int64_t nbytes)
	{
	vm_object_t obj;
	vm_page_t pp;
	int64_t end;

	/*
	* At present vm_page_clear_dirty extends the cleared range to DEV_BSIZE
	* aligned boundaries, if the range is not aligned. As a result a
	* DEV_BSIZE subrange with partially dirty data may get marked as clean.
	* It may happen that all DEV_BSIZE subranges are marked clean and thus
	* the whole page would be considered clean despite have some
	* dirty data.
	* For this reason we should shrink the range to DEV_BSIZE aligned
	* boundaries before calling vm_page_clear_dirty.
	*/
	end = rounddown2(off + nbytes, DEV_BSIZE);
	off = roundup2(off, DEV_BSIZE);
	nbytes = end - off;

	obj = vp->v_object;
	zfs_vmobject_assert_wlocked_12(obj);
	#if __FreeBSD_version < 1300050
	for (;;) {
	if ((pp = vm_page_lookup(obj, OFF_TO_IDX(start))) != NULL &&
	pp->valid) {
	if (vm_page_xbusied(pp)) {
	/*
	* Reference the page before unlocking and
	* sleeping so that the page daemon is less
	* likely to reclaim it.
	*/
	vm_page_reference(pp);
	vm_page_lock(pp);
	zfs_vmobject_wunlock(obj);
	vm_page_busy_sleep(pp, "zfsmwb", true);
	zfs_vmobject_wlock(obj);
	continue;
	}
	vm_page_sbusy(pp);
	} else if (pp != NULL) {
	ASSERT(!pp->valid);
	pp = NULL;
	}
	if (pp != NULL) {
	ASSERT3U(pp->valid, ==, VM_PAGE_BITS_ALL);
	vm_object_pip_add(obj, 1);
	pmap_remove_write(pp);
	if (nbytes != 0)
	vm_page_clear_dirty(pp, off, nbytes);
	}
	break;
	}
	#else
	vm_page_grab_valid_unlocked(&pp, obj, OFF_TO_IDX(start),
	VM_ALLOC_NOCREAT \| VM_ALLOC_SBUSY \| VM_ALLOC_NORMAL \|
	VM_ALLOC_IGN_SBUSY);
	if (pp != NULL) {
	ASSERT3U(pp->valid, ==, VM_PAGE_BITS_ALL);
	vm_object_pip_add(obj, 1);
	pmap_remove_write(pp);
	if (nbytes != 0)
	vm_page_clear_dirty(pp, off, nbytes);
	}
	#endif
	return (pp);
	}

	static void
	page_unbusy(vm_page_t pp)
	{

	vm_page_sunbusy(pp);
	#if __FreeBSD_version >= 1300041
	vm_object_pip_wakeup(pp->object);
	#else
	vm_object_pip_subtract(pp->object, 1);
	#endif
	}

	#if __FreeBSD_version > 1300051
	static vm_page_t
	page_hold(vnode_t *vp, int64_t start)
	{
	vm_object_t obj;
	vm_page_t m;

	obj = vp->v_object;
	vm_page_grab_valid_unlocked(&m, obj, OFF_TO_IDX(start),
	VM_ALLOC_NOCREAT \| VM_ALLOC_WIRED \| VM_ALLOC_IGN_SBUSY \|
	VM_ALLOC_NOBUSY);
	return (m);
	}
	#else
	static vm_page_t
	page_hold(vnode_t *vp, int64_t start)
	{
	vm_object_t obj;
	vm_page_t pp;

	obj = vp->v_object;
	zfs_vmobject_assert_wlocked(obj);

	for (;;) {
	if ((pp = vm_page_lookup(obj, OFF_TO_IDX(start))) != NULL &&
	pp->valid) {
	if (vm_page_xbusied(pp)) {
	/*
	* Reference the page before unlocking and
	* sleeping so that the page daemon is less
	* likely to reclaim it.
	*/
	vm_page_reference(pp);
	vm_page_lock(pp);
	zfs_vmobject_wunlock(obj);
	vm_page_busy_sleep(pp, "zfsmwb", true);
	zfs_vmobject_wlock(obj);
	continue;
	}

	ASSERT3U(pp->valid, ==, VM_PAGE_BITS_ALL);
	vm_page_wire_lock(pp);
	vm_page_hold(pp);
	vm_page_wire_unlock(pp);

	} else
	pp = NULL;
	break;
	}
	return (pp);
	}
	#endif

	static void
	page_unhold(vm_page_t pp)
	{

	vm_page_wire_lock(pp);
	#if __FreeBSD_version >= 1300035
	vm_page_unwire(pp, PQ_ACTIVE);
	#else
	vm_page_unhold(pp);
	#endif
	vm_page_wire_unlock(pp);
	}

	/*
	* When a file is memory mapped, we must keep the IO data synchronized
	* between the DMU cache and the memory mapped pages. What this means:
	*
	* On Write: If we find a memory mapped page, we write to both
	* the page and the dmu buffer.
	*/
	static void
	update_pages(vnode_t vp, int64_t start, int len, objset_t os, uint64_t oid,
	int segflg, dmu_tx_t *tx)
	{
	vm_object_t obj;
	struct sf_buf *sf;
	caddr_t va;
	int off;

	ASSERT(segflg != UIO_NOCOPY);
	ASSERT(vp->v_mount != NULL);
	obj = vp->v_object;
	ASSERT(obj != NULL);

	off = start & PAGEOFFSET;
	zfs_vmobject_wlock_12(obj);
	#if __FreeBSD_version >= 1300041
	vm_object_pip_add(obj, 1);
	#endif
	for (start &= PAGEMASK; len > 0; start += PAGESIZE) {
	vm_page_t pp;
	int nbytes = imin(PAGESIZE - off, len);

	if ((pp = page_busy(vp, start, off, nbytes)) != NULL) {
	zfs_vmobject_wunlock_12(obj);

	va = zfs_map_page(pp, &sf);
	(void) dmu_read(os, oid, start+off, nbytes,
	va+off, DMU_READ_PREFETCH);
	zfs_unmap_page(sf);

	zfs_vmobject_wlock_12(obj);
	page_unbusy(pp);
	}
	len -= nbytes;
	off = 0;
	}
	#if __FreeBSD_version >= 1300041
	vm_object_pip_wakeup(obj);
	#else
	vm_object_pip_wakeupn(obj, 0);
	#endif
	zfs_vmobject_wunlock_12(obj);
	}

	/*
	* Read with UIO_NOCOPY flag means that sendfile(2) requests
	* ZFS to populate a range of page cache pages with data.
	*
	* NOTE: this function could be optimized to pre-allocate
	* all pages in advance, drain exclusive busy on all of them,
	* map them into contiguous KVA region and populate them
	* in one single dmu_read() call.
	*/
	static int
	mappedread_sf(vnode_t vp, int nbytes, uio_t uio)
	{
	znode_t *zp = VTOZ(vp);
	objset_t *os = zp->z_zfsvfs->z_os;
	struct sf_buf *sf;
	vm_object_t obj;
	vm_page_t pp;
	int64_t start;
	caddr_t va;
	int len = nbytes;
	int error = 0;

	ASSERT(uio->uio_segflg == UIO_NOCOPY);
	ASSERT(vp->v_mount != NULL);
	obj = vp->v_object;
	ASSERT(obj != NULL);
	ASSERT((uio->uio_loffset & PAGEOFFSET) == 0);

	zfs_vmobject_wlock_12(obj);
	for (start = uio->uio_loffset; len > 0; start += PAGESIZE) {
	int bytes = MIN(PAGESIZE, len);

	pp = vm_page_grab_unlocked(obj, OFF_TO_IDX(start),
	VM_ALLOC_SBUSY \| VM_ALLOC_NORMAL \| VM_ALLOC_IGN_SBUSY);
	if (vm_page_none_valid(pp)) {
	zfs_vmobject_wunlock_12(obj);
	va = zfs_map_page(pp, &sf);
	error = dmu_read(os, zp->z_id, start, bytes, va,
	DMU_READ_PREFETCH);
	if (bytes != PAGESIZE && error == 0)
	bzero(va + bytes, PAGESIZE - bytes);
	zfs_unmap_page(sf);
	zfs_vmobject_wlock_12(obj);
	#if __FreeBSD_version >= 1300081
	if (error == 0) {
	vm_page_valid(pp);
	vm_page_activate(pp);
	vm_page_do_sunbusy(pp);
	} else {
	zfs_vmobject_wlock(obj);
	if (!vm_page_wired(pp) && pp->valid == 0 &&
	vm_page_busy_tryupgrade(pp))
	vm_page_free(pp);
	else
	vm_page_sunbusy(pp);
	zfs_vmobject_wunlock(obj);
	}
	#else
	vm_page_do_sunbusy(pp);
	vm_page_lock(pp);
	if (error) {
	if (pp->wire_count == 0 && pp->valid == 0 &&
	!vm_page_busied(pp))
	vm_page_free(pp);
	} else {
	pp->valid = VM_PAGE_BITS_ALL;
	vm_page_activate(pp);
	}
	vm_page_unlock(pp);
	#endif
	} else {
	ASSERT3U(pp->valid, ==, VM_PAGE_BITS_ALL);
	vm_page_do_sunbusy(pp);
	}
	if (error)
	break;
	uio->uio_resid -= bytes;
	uio->uio_offset += bytes;
	len -= bytes;
	}
	zfs_vmobject_wunlock_12(obj);
	return (error);
	}

	/*
	* When a file is memory mapped, we must keep the IO data synchronized
	* between the DMU cache and the memory mapped pages. What this means:
	*
	* On Read: We "read" preferentially from memory mapped pages,
	* else we default from the dmu buffer.
	*
	* NOTE: We will always "break up" the IO into PAGESIZE uiomoves when
	* the file is memory mapped.
	*/
	static int
	mappedread(vnode_t vp, int nbytes, uio_t uio)
	{
	znode_t *zp = VTOZ(vp);
	vm_object_t obj;
	int64_t start;
	int len = nbytes;
	int off;
	int error = 0;

	ASSERT(vp->v_mount != NULL);
	obj = vp->v_object;
	ASSERT(obj != NULL);

	start = uio->uio_loffset;
	off = start & PAGEOFFSET;
	zfs_vmobject_wlock_12(obj);
	for (start &= PAGEMASK; len > 0; start += PAGESIZE) {
	vm_page_t pp;
	uint64_t bytes = MIN(PAGESIZE - off, len);

	if ((pp = page_hold(vp, start))) {
	struct sf_buf *sf;
	caddr_t va;

	zfs_vmobject_wunlock_12(obj);
	va = zfs_map_page(pp, &sf);
	error = vn_io_fault_uiomove(va + off, bytes, uio);
	zfs_unmap_page(sf);
	zfs_vmobject_wlock_12(obj);
	page_unhold(pp);
	} else {
	zfs_vmobject_wunlock_12(obj);
	error = dmu_read_uio_dbuf(sa_get_db(zp->z_sa_hdl),
	uio, bytes);
	zfs_vmobject_wlock_12(obj);
	}
	len -= bytes;
	off = 0;
	if (error)
	break;
	}
	zfs_vmobject_wunlock_12(obj);
	return (error);
	}

	offset_t zfs_read_chunk_size = 1024 * 1024; /* Tunable */

	/*
	* Read bytes from specified file into supplied buffer.
	*
	* IN: vp - vnode of file to be read from.
	* uio - structure supplying read location, range info,
	* and return buffer.
	* ioflag - SYNC flags; used to provide FRSYNC semantics.
	* cr - credentials of caller.
	* ct - caller context
	*
	* OUT: uio - updated offset and range, buffer filled.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Side Effects:
	* vp - atime updated if byte count > 0
	*/
	/* ARGSUSED */
	static int
	zfs_read(vnode_t vp, uio_t uio, int ioflag, cred_t *cr)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	ssize_t n, nbytes, start_resid;
	int error = 0;
	int64_t nread;
	zfs_locked_range_t *lr;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	/* We don't copy out anything useful for directories. */
	if (vp->v_type == VDIR) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EISDIR));
	}

	if (zp->z_pflags & ZFS_AV_QUARANTINED) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EACCES));
	}

	/*
	* Validate file offset
	*/
	if (uio->uio_loffset < (offset_t)0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	/*
	* Fasttrack empty reads
	*/
	if (uio->uio_resid == 0) {
	ZFS_EXIT(zfsvfs);
	return (0);
	}

	/*
	* If we're in FRSYNC mode, sync out this znode before reading it.
	*/
	if (zfsvfs->z_log &&
	(ioflag & FRSYNC \|\| zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS))
	zil_commit(zfsvfs->z_log, zp->z_id);

	/*
	* Lock the range against changes.
	*/
	lr = zfs_rangelock_enter(&zp->z_rangelock, uio->uio_loffset,
	uio->uio_resid, RL_READER);

	/*
	* If we are reading past end-of-file we can skip
	* to the end; but we might still need to set atime.
	*/
	if (uio->uio_loffset >= zp->z_size) {
	error = 0;
	goto out;
	}

	ASSERT(uio->uio_loffset < zp->z_size);
	n = MIN(uio->uio_resid, zp->z_size - uio->uio_loffset);
	start_resid = n;

	while (n > 0) {
	nbytes = MIN(n, zfs_read_chunk_size -
	P2PHASE(uio->uio_loffset, zfs_read_chunk_size));

	if (uio->uio_segflg == UIO_NOCOPY)
	error = mappedread_sf(vp, nbytes, uio);
	else if (vn_has_cached_data(vp)) {
	error = mappedread(vp, nbytes, uio);
	} else {
	error = dmu_read_uio_dbuf(sa_get_db(zp->z_sa_hdl),
	uio, nbytes);
	}
	if (error) {
	/* convert checksum errors into IO errors */
	if (error == ECKSUM)
	error = SET_ERROR(EIO);
	break;
	}

	n -= nbytes;
	}

	nread = start_resid - n;
	dataset_kstats_update_read_kstats(&zfsvfs->z_kstat, nread);

	out:
	zfs_rangelock_exit(lr);

	ZFS_ACCESSTIME_STAMP(zfsvfs, zp);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Write the bytes to a file.
	*
	* IN: vp - vnode of file to be written to.
	* uio - structure supplying write location, range info,
	* and data buffer.
	* ioflag - FAPPEND, FSYNC, and/or FDSYNC. FAPPEND is
	* set if in append mode.
	* cr - credentials of caller.
	* ct - caller context (NFS/CIFS fem monitor only)
	*
	* OUT: uio - updated offset and range.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* vp - ctime\|mtime updated if byte count > 0
	*/

	/* ARGSUSED */
	static int
	zfs_write(vnode_t vp, uio_t uio, int ioflag, cred_t *cr)
	{
	znode_t *zp = VTOZ(vp);
	rlim64_t limit = MAXOFFSET_T;
	ssize_t start_resid = uio->uio_resid;
	ssize_t tx_bytes;
	uint64_t end_size;
	dmu_buf_impl_t *db;
	dmu_tx_t *tx;
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	zilog_t *zilog;
	offset_t woff;
	ssize_t n, nbytes;
	zfs_locked_range_t *lr;
	int max_blksz = zfsvfs->z_max_blksz;
	int error = 0;
	arc_buf_t *abuf;
	iovec_t *aiov = NULL;
	xuio_t *xuio = NULL;
	int i_iov = 0;
	int iovcnt __unused = uio->uio_iovcnt;
	iovec_t *iovp = uio->uio_iov;
	int write_eof;
	int count = 0;
	sa_bulk_attr_t bulk[4];
	uint64_t mtime[2], ctime[2];
	uint64_t uid, gid, projid;
	int64_t nwritten;

	/*
	* Fasttrack empty write
	*/
	n = start_resid;
	if (n == 0)
	return (0);

	if (limit == RLIM64_INFINITY \|\| limit > MAXOFFSET_T)
	limit = MAXOFFSET_T;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MTIME(zfsvfs), NULL, &mtime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, &ctime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_SIZE(zfsvfs), NULL,
	&zp->z_size, 8);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL,
	&zp->z_pflags, 8);

	/*
	* Callers might not be able to detect properly that we are read-only,
	* so check it explicitly here.
	*/
	if (zfs_is_readonly(zfsvfs)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EROFS));
	}

	/*
	* If immutable or not appending then return EPERM.
	* Intentionally allow ZFS_READONLY through here.
	* See zfs_zaccess_common()
	*/
	if ((zp->z_pflags & ZFS_IMMUTABLE) \|\|
	((zp->z_pflags & ZFS_APPENDONLY) && !(ioflag & FAPPEND) &&
	(uio->uio_loffset < zp->z_size))) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EPERM));
	}

	zilog = zfsvfs->z_log;

	/*
	* Validate file offset
	*/
	woff = ioflag & FAPPEND ? zp->z_size : uio->uio_loffset;
	if (woff < 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	/*
	* If in append mode, set the io offset pointer to eof.
	*/
	if (ioflag & FAPPEND) {
	/*
	* Obtain an appending range lock to guarantee file append
	* semantics. We reset the write offset once we have the lock.
	*/
	lr = zfs_rangelock_enter(&zp->z_rangelock, 0, n, RL_APPEND);
	woff = lr->lr_offset;
	if (lr->lr_length == UINT64_MAX) {
	/*
	* We overlocked the file because this write will cause
	* the file block size to increase.
	* Note that zp_size cannot change with this lock held.
	*/
	woff = zp->z_size;
	}
	uio->uio_loffset = woff;
	} else {
	/*
	* Note that if the file block size will change as a result of
	* this write, then this range lock will lock the entire file
	* so that we can re-write the block safely.
	*/
	lr = zfs_rangelock_enter(&zp->z_rangelock, woff, n, RL_WRITER);
	}

	if (vn_rlimit_fsize(vp, uio, uio->uio_td)) {
	zfs_rangelock_exit(lr);
	ZFS_EXIT(zfsvfs);
	return (EFBIG);
	}

	if (woff >= limit) {
	zfs_rangelock_exit(lr);
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EFBIG));
	}

	if ((woff + n) > limit \|\| woff > (limit - n))
	n = limit - woff;

	/* Will this write extend the file length? */
	write_eof = (woff + n > zp->z_size);

	end_size = MAX(zp->z_size, woff + n);

	uid = zp->z_uid;
	gid = zp->z_gid;
	projid = zp->z_projid;

	/*
	* Write the file in reasonable size chunks. Each chunk is written
	* in a separate transaction; this keeps the intent log records small
	* and allows us to do more fine-grained space accounting.
	*/
	while (n > 0) {
	woff = uio->uio_loffset;

	if (zfs_id_overblockquota(zfsvfs, DMU_USERUSED_OBJECT, uid) \|\|
	zfs_id_overblockquota(zfsvfs, DMU_GROUPUSED_OBJECT, gid) \|\|
	(projid != ZFS_DEFAULT_PROJID &&
	zfs_id_overblockquota(zfsvfs, DMU_PROJECTUSED_OBJECT,
	projid))) {
	error = SET_ERROR(EDQUOT);
	break;
	}

	abuf = NULL;
	if (xuio) {
	ASSERT(i_iov < iovcnt);
	aiov = &iovp[i_iov];
	abuf = dmu_xuio_arcbuf(xuio, i_iov);
	dmu_xuio_clear(xuio, i_iov);
	DTRACE_PROBE3(zfs_cp_write, int, i_iov,
	iovec_t , aiov, arc_buf_t , abuf);
	ASSERT((aiov->iov_base == abuf->b_data) \|\|
	((char )aiov->iov_base - (char )abuf->b_data +
	aiov->iov_len == arc_buf_size(abuf)));
	i_iov++;
	} else if (n >= max_blksz &&
	woff >= zp->z_size &&
	P2PHASE(woff, max_blksz) == 0 &&
	zp->z_blksz == max_blksz) {
	/*
	* This write covers a full block. "Borrow" a buffer
	* from the dmu so that we can fill it before we enter
	* a transaction. This avoids the possibility of
	* holding up the transaction if the data copy hangs
	* up on a pagefault (e.g., from an NFS server mapping).
	*/
	size_t cbytes;

	abuf = dmu_request_arcbuf(sa_get_db(zp->z_sa_hdl),
	max_blksz);
	ASSERT(abuf != NULL);
	ASSERT(arc_buf_size(abuf) == max_blksz);
	if ((error = uiocopy(abuf->b_data, max_blksz,
	UIO_WRITE, uio, &cbytes))) {
	dmu_return_arcbuf(abuf);
	break;
	}
	ASSERT(cbytes == max_blksz);
	}

	/*
	* Start a transaction.
	*/
	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	db = (dmu_buf_impl_t *)sa_get_db(zp->z_sa_hdl);
	DB_DNODE_ENTER(db);
	dmu_tx_hold_write_by_dnode(tx, DB_DNODE(db), woff,
	MIN(n, max_blksz));
	DB_DNODE_EXIT(db);
	zfs_sa_upgrade_txholds(tx, zp);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	if (abuf != NULL)
	dmu_return_arcbuf(abuf);
	break;
	}

	/*
	* If zfs_range_lock() over-locked we grow the blocksize
	* and then reduce the lock range. This will only happen
	* on the first iteration since zfs_range_reduce() will
	* shrink down r_len to the appropriate size.
	*/
	if (lr->lr_length == UINT64_MAX) {
	uint64_t new_blksz;

	if (zp->z_blksz > max_blksz) {
	/*
	* File's blocksize is already larger than the
	* "recordsize" property. Only let it grow to
	* the next power of 2.
	*/
	ASSERT(!ISP2(zp->z_blksz));
	new_blksz = MIN(end_size,
	1 << highbit64(zp->z_blksz));
	} else {
	new_blksz = MIN(end_size, max_blksz);
	}
	zfs_grow_blocksize(zp, new_blksz, tx);
	zfs_rangelock_reduce(lr, woff, n);
	}

	/*
	* XXX - should we really limit each write to z_max_blksz?
	* Perhaps we should use SPA_MAXBLOCKSIZE chunks?
	*/
	nbytes = MIN(n, max_blksz - P2PHASE(woff, max_blksz));

	if (woff + nbytes > zp->z_size)
	vnode_pager_setsize(vp, woff + nbytes);

	if (abuf == NULL) {
	tx_bytes = uio->uio_resid;
	error = dmu_write_uio_dbuf(sa_get_db(zp->z_sa_hdl),
	uio, nbytes, tx);
	tx_bytes -= uio->uio_resid;
	} else {
	tx_bytes = nbytes;
	ASSERT(xuio == NULL \|\| tx_bytes == aiov->iov_len);
	/*
	* If this is not a full block write, but we are
	* extending the file past EOF and this data starts
	* block-aligned, use assign_arcbuf(). Otherwise,
	* write via dmu_write().
	*/
	if (tx_bytes < max_blksz && (!write_eof \|\|
	aiov->iov_base != abuf->b_data)) {
	ASSERT(xuio);
	dmu_write(zfsvfs->z_os, zp->z_id, woff,
	aiov->iov_len, aiov->iov_base, tx);
	dmu_return_arcbuf(abuf);
	xuio_stat_wbuf_copied();
	} else {
	ASSERT(xuio \|\| tx_bytes == max_blksz);
	dmu_assign_arcbuf(sa_get_db(zp->z_sa_hdl), woff,
	abuf, tx);
	}
	ASSERT(tx_bytes <= uio->uio_resid);
	uioskip(uio, tx_bytes);
	}
	if (tx_bytes && vn_has_cached_data(vp)) {
	update_pages(vp, woff, tx_bytes, zfsvfs->z_os,
	zp->z_id, uio->uio_segflg, tx);
	}

	/*
	* If we made no progress, we're done. If we made even
	* partial progress, update the znode and ZIL accordingly.
	*/
	if (tx_bytes == 0) {
	(void) sa_update(zp->z_sa_hdl, SA_ZPL_SIZE(zfsvfs),
	(void *)&zp->z_size, sizeof (uint64_t), tx);
	dmu_tx_commit(tx);
	ASSERT(error != 0);
	break;
	}

	/*
	* Clear Set-UID/Set-GID bits on successful write if not
	* privileged and at least one of the execute bits is set.
	*
	* It would be nice to to this after all writes have
	* been done, but that would still expose the ISUID/ISGID
	* to another app after the partial write is committed.
	*
	* Note: we don't call zfs_fuid_map_id() here because
	* user 0 is not an ephemeral uid.
	*/
	mutex_enter(&zp->z_acl_lock);
	if ((zp->z_mode & (S_IXUSR \| (S_IXUSR >> 3) \|
	(S_IXUSR >> 6))) != 0 &&
	(zp->z_mode & (S_ISUID \| S_ISGID)) != 0 &&
	secpolicy_vnode_setid_retain(vp, cr,
	(zp->z_mode & S_ISUID) != 0 && zp->z_uid == 0) != 0) {
	uint64_t newmode;
	zp->z_mode &= ~(S_ISUID \| S_ISGID);
	newmode = zp->z_mode;
	(void) sa_update(zp->z_sa_hdl, SA_ZPL_MODE(zfsvfs),
	(void *)&newmode, sizeof (uint64_t), tx);
	}
	mutex_exit(&zp->z_acl_lock);

	zfs_tstamp_update_setup(zp, CONTENT_MODIFIED, mtime, ctime);

	/*
	* Update the file size (zp_size) if it has changed;
	* account for possible concurrent updates.
	*/
	while ((end_size = zp->z_size) < uio->uio_loffset) {
	(void) atomic_cas_64(&zp->z_size, end_size,
	uio->uio_loffset);
	ASSERT(error == 0 \|\| error == EFAULT);
	}
	/*
	* If we are replaying and eof is non zero then force
	* the file size to the specified eof. Note, there's no
	* concurrency during replay.
	*/
	if (zfsvfs->z_replay && zfsvfs->z_replay_eof != 0)
	zp->z_size = zfsvfs->z_replay_eof;

	if (error == 0)
	error = sa_bulk_update(zp->z_sa_hdl, bulk, count, tx);
	else
	(void) sa_bulk_update(zp->z_sa_hdl, bulk, count, tx);

	zfs_log_write(zilog, tx, TX_WRITE, zp, woff, tx_bytes,
	ioflag, NULL, NULL);
	dmu_tx_commit(tx);

	if (error != 0)
	break;
	ASSERT(tx_bytes == nbytes);
	n -= nbytes;

	}

	zfs_rangelock_exit(lr);

	/*
	* If we're in replay mode, or we made no progress, return error.
	* Otherwise, it's at least a partial write, so it's successful.
	*/
	if (zfsvfs->z_replay \|\| uio->uio_resid == start_resid) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* EFAULT means that at least one page of the source buffer was not
	* available. VFS will re-try remaining I/O upon this error.
	*/
	if (error == EFAULT) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	if (ioflag & (FSYNC \| FDSYNC) \|\|
	zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, zp->z_id);

	nwritten = start_resid - uio->uio_resid;
	dataset_kstats_update_write_kstats(&zfsvfs->z_kstat, nwritten);

	ZFS_EXIT(zfsvfs);
	return (0);
	}

	int
	zfs_write_simple(znode_t zp, const void data, size_t len,
	loff_t pos, size_t *presid)
	{
	int error = 0;
	ssize_t resid;

	error = vn_rdwr(UIO_WRITE, ZTOV(zp), __DECONST(void *, data), len, pos,
	UIO_SYSSPACE, IO_SYNC, kcred, NOCRED, &resid, curthread);

	if (error) {
	return (SET_ERROR(error));
	} else if (presid == NULL) {
	if (resid != 0) {
	error = SET_ERROR(EIO);
	}
	} else {
	*presid = resid;
	}
	return (error);
	}

	static void
	zfs_get_done(zgd_t *zgd, int error)
	{
	znode_t *zp = zgd->zgd_private;
	objset_t *os = zp->z_zfsvfs->z_os;

	if (zgd->zgd_db)
	dmu_buf_rele(zgd->zgd_db, zgd);

	zfs_rangelock_exit(zgd->zgd_lr);

	/*
	* Release the vnode asynchronously as we currently have the
	* txg stopped from syncing.
	*/
	VN_RELE_ASYNC(ZTOV(zp), dsl_pool_zrele_taskq(dmu_objset_pool(os)));

	kmem_free(zgd, sizeof (zgd_t));
	}

	#ifdef ZFS_DEBUG
	static int zil_fault_io = 0;
	#endif

	/*
	* Get data to generate a TX_WRITE intent log record.
	*/
	int
	zfs_get_data(void arg, lr_write_t lr, char buf, struct lwb lwb, zio_t *zio)
	{
	zfsvfs_t *zfsvfs = arg;
	objset_t *os = zfsvfs->z_os;
	znode_t *zp;
	uint64_t object = lr->lr_foid;
	uint64_t offset = lr->lr_offset;
	uint64_t size = lr->lr_length;
	dmu_buf_t *db;
	zgd_t *zgd;
	int error = 0;

	ASSERT3P(lwb, !=, NULL);
	ASSERT3P(zio, !=, NULL);
	ASSERT3U(size, !=, 0);

	/*
	* Nothing to do if the file has been removed
	*/
	if (zfs_zget(zfsvfs, object, &zp) != 0)
	return (SET_ERROR(ENOENT));
	if (zp->z_unlinked) {
	/*
	* Release the vnode asynchronously as we currently have the
	* txg stopped from syncing.
	*/
	VN_RELE_ASYNC(ZTOV(zp),
	dsl_pool_zrele_taskq(dmu_objset_pool(os)));
	return (SET_ERROR(ENOENT));
	}

	zgd = (zgd_t *)kmem_zalloc(sizeof (zgd_t), KM_SLEEP);
	zgd->zgd_lwb = lwb;
	zgd->zgd_private = zp;

	/*
	* Write records come in two flavors: immediate and indirect.
	* For small writes it's cheaper to store the data with the
	* log record (immediate); for large writes it's cheaper to
	* sync the data and get a pointer to it (indirect) so that
	* we don't have to write the data twice.
	*/
	if (buf != NULL) { /* immediate write */
	zgd->zgd_lr = zfs_rangelock_enter(&zp->z_rangelock, offset,
	size, RL_READER);
	/* test for truncation needs to be done while range locked */
	if (offset >= zp->z_size) {
	error = SET_ERROR(ENOENT);
	} else {
	error = dmu_read(os, object, offset, size, buf,
	DMU_READ_NO_PREFETCH);
	}
	ASSERT(error == 0 \|\| error == ENOENT);
	} else { /* indirect write */
	/*
	* Have to lock the whole block to ensure when it's
	* written out and its checksum is being calculated
	* that no one can change the data. We need to re-check
	* blocksize after we get the lock in case it's changed!
	*/
	for (;;) {
	uint64_t blkoff;
	size = zp->z_blksz;
	blkoff = ISP2(size) ? P2PHASE(offset, size) : offset;
	offset -= blkoff;
	zgd->zgd_lr = zfs_rangelock_enter(&zp->z_rangelock,
	offset, size, RL_READER);
	if (zp->z_blksz == size)
	break;
	offset += blkoff;
	zfs_rangelock_exit(zgd->zgd_lr);
	}
	/* test for truncation needs to be done while range locked */
	if (lr->lr_offset >= zp->z_size)
	error = SET_ERROR(ENOENT);
	#ifdef ZFS_DEBUG
	if (zil_fault_io) {
	error = SET_ERROR(EIO);
	zil_fault_io = 0;
	}
	#endif
	if (error == 0)
	error = dmu_buf_hold(os, object, offset, zgd, &db,
	DMU_READ_NO_PREFETCH);

	if (error == 0) {
	blkptr_t *bp = &lr->lr_blkptr;

	zgd->zgd_db = db;
	zgd->zgd_bp = bp;

	ASSERT(db->db_offset == offset);
	ASSERT(db->db_size == size);

	error = dmu_sync(zio, lr->lr_common.lrc_txg,
	zfs_get_done, zgd);
	ASSERT(error \|\| lr->lr_length <= size);

	/*
	* On success, we need to wait for the write I/O
	* initiated by dmu_sync() to complete before we can
	* release this dbuf. We will finish everything up
	* in the zfs_get_done() callback.
	*/
	if (error == 0)
	return (0);

	if (error == EALREADY) {
	lr->lr_common.lrc_txtype = TX_WRITE2;
	/*
	* TX_WRITE2 relies on the data previously
	* written by the TX_WRITE that caused
	* EALREADY. We zero out the BP because
	* it is the old, currently-on-disk BP,
	* so there's no need to zio_flush() its
	* vdevs (flushing would needlesly hurt
	* performance, and doesn't work on
	* indirect vdevs).
	*/
	zgd->zgd_bp = NULL;
	BP_ZERO(bp);
	error = 0;
	}
	}
	}

	zfs_get_done(zgd, error);

	return (error);
	}

	/ARGSUSED/
	static int
	zfs_access(vnode_t vp, int mode, int flag, cred_t cr,
	caller_context_t *ct)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	int error;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	if (flag & V_ACE_MASK)
	error = zfs_zaccess(zp, mode, flag, B_FALSE, cr);
	else
	error = zfs_zaccess_rwx(zp, mode, flag, cr);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	static int
	zfs_dd_callback(struct mount mp, void arg, int lkflags, struct vnode **vpp)
	{
	int error;

	*vpp = arg;
	error = vn_lock(*vpp, lkflags);
	if (error != 0)
	vrele(*vpp);
	return (error);
	}

	static int
	zfs_lookup_lock(vnode_t dvp, vnode_t vp, const char *name, int lkflags)
	{
	znode_t *zdp = VTOZ(dvp);
	zfsvfs_t *zfsvfs __unused = zdp->z_zfsvfs;
	int error;
	int ltype;

	if (zfsvfs->z_replay == B_FALSE)
	ASSERT_VOP_LOCKED(dvp, __func__);
	#ifdef DIAGNOSTIC
	if ((zdp->z_pflags & ZFS_XATTR) == 0)
	VERIFY(!RRM_LOCK_HELD(&zfsvfs->z_teardown_lock));
	#endif

	if (name[0] == 0 \|\| (name[0] == '.' && name[1] == 0)) {
	ASSERT3P(dvp, ==, vp);
	vref(dvp);
	ltype = lkflags & LK_TYPE_MASK;
	if (ltype != VOP_ISLOCKED(dvp)) {
	if (ltype == LK_EXCLUSIVE)
	vn_lock(dvp, LK_UPGRADE \| LK_RETRY);
	else /* if (ltype == LK_SHARED) */
	vn_lock(dvp, LK_DOWNGRADE \| LK_RETRY);

	/*
	* Relock for the "." case could leave us with
	* reclaimed vnode.
	*/
	if (VN_IS_DOOMED(dvp)) {
	vrele(dvp);
	return (SET_ERROR(ENOENT));
	}
	}
	return (0);
	} else if (name[0] == '.' && name[1] == '.' && name[2] == 0) {
	/*
	* Note that in this case, dvp is the child vnode, and we
	* are looking up the parent vnode - exactly reverse from
	* normal operation. Unlocking dvp requires some rather
	* tricky unlock/relock dance to prevent mp from being freed;
	* use vn_vget_ino_gen() which takes care of all that.
	*
	* XXX Note that there is a time window when both vnodes are
	* unlocked. It is possible, although highly unlikely, that
	* during that window the parent-child relationship between
	* the vnodes may change, for example, get reversed.
	* In that case we would have a wrong lock order for the vnodes.
	* All other filesystems seem to ignore this problem, so we
	* do the same here.
	* A potential solution could be implemented as follows:
	* - using LK_NOWAIT when locking the second vnode and retrying
	* if necessary
	* - checking that the parent-child relationship still holds
	* after locking both vnodes and retrying if it doesn't
	*/
	error = vn_vget_ino_gen(dvp, zfs_dd_callback, vp, lkflags, &vp);
	return (error);
	} else {
	error = vn_lock(vp, lkflags);
	if (error != 0)
	vrele(vp);
	return (error);
	}
	}

	/*
	* Lookup an entry in a directory, or an extended attribute directory.
	* If it exists, return a held vnode reference for it.
	*
	* IN: dvp - vnode of directory to search.
	* nm - name of entry to lookup.
	* pnp - full pathname to lookup [UNUSED].
	* flags - LOOKUP_XATTR set if looking for an attribute.
	* rdir - root directory vnode [UNUSED].
	* cr - credentials of caller.
	* ct - caller context
	*
	* OUT: vpp - vnode of located entry, NULL if not found.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* NA
	*/
	/* ARGSUSED */
	static int
	zfs_lookup(vnode_t dvp, char nm, vnode_t *vpp, struct componentname cnp,
	int nameiop, cred_t cr, kthread_t td, int flags, boolean_t cached)
	{
	znode_t *zdp = VTOZ(dvp);
	znode_t *zp;
	zfsvfs_t *zfsvfs = zdp->z_zfsvfs;
	int error = 0;

	/*
	* Fast path lookup, however we must skip DNLC lookup
	* for case folding or normalizing lookups because the
	* DNLC code only stores the passed in name. This means
	* creating 'a' and removing 'A' on a case insensitive
	* file system would work, but DNLC still thinks 'a'
	* exists and won't let you create it again on the next
	* pass through fast path.
	*/
	if (!(flags & LOOKUP_XATTR)) {
	if (dvp->v_type != VDIR) {
	return (SET_ERROR(ENOTDIR));
	} else if (zdp->z_sa_hdl == NULL) {
	return (SET_ERROR(EIO));
	}
	}

	DTRACE_PROBE2(zfs__fastpath__lookup__miss, vnode_t , dvp, char , nm);

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zdp);

	*vpp = NULL;

	if (flags & LOOKUP_XATTR) {
	/*
	* If the xattr property is off, refuse the lookup request.
	*/
	if (!(zfsvfs->z_flags & ZSB_XATTR)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EOPNOTSUPP));
	}

	/*
	* We don't allow recursive attributes..
	* Maybe someday we will.
	*/
	if (zdp->z_pflags & ZFS_XATTR) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	if ((error = zfs_get_xattrdir(VTOZ(dvp), &zp, cr, flags))) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	*vpp = ZTOV(zp);

	/*
	* Do we have permission to get into attribute directory?
	*/
	error = zfs_zaccess(zp, ACE_EXECUTE, 0, B_FALSE, cr);
	if (error) {
	vrele(ZTOV(zp));
	}

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Check accessibility of directory if we're not coming in via
	* VOP_CACHEDLOOKUP.
	*/
	if (!cached) {
	#ifdef NOEXECCHECK
	if ((cnp->cn_flags & NOEXECCHECK) != 0) {
	cnp->cn_flags &= ~NOEXECCHECK;
	} else
	#endif
	if ((error = zfs_zaccess(zdp, ACE_EXECUTE, 0, B_FALSE, cr))) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	}

	if (zfsvfs->z_utf8 && u8_validate(nm, strlen(nm),
	NULL, U8_VALIDATE_ENTIRE, &error) < 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EILSEQ));
	}


	/*
	* First handle the special cases.
	*/
	if ((cnp->cn_flags & ISDOTDOT) != 0) {
	/*
	* If we are a snapshot mounted under .zfs, return
	* the vp for the snapshot directory.
	*/
	if (zdp->z_id == zfsvfs->z_root && zfsvfs->z_parent != zfsvfs) {
	struct componentname cn;
	vnode_t *zfsctl_vp;
	int ltype;

	ZFS_EXIT(zfsvfs);
	ltype = VOP_ISLOCKED(dvp);
	VOP_UNLOCK1(dvp);
	error = zfsctl_root(zfsvfs->z_parent, LK_SHARED,
	&zfsctl_vp);
	if (error == 0) {
	cn.cn_nameptr = "snapshot";
	cn.cn_namelen = strlen(cn.cn_nameptr);
	cn.cn_nameiop = cnp->cn_nameiop;
	cn.cn_flags = cnp->cn_flags & ~ISDOTDOT;
	cn.cn_lkflags = cnp->cn_lkflags;
	error = VOP_LOOKUP(zfsctl_vp, vpp, &cn);
	vput(zfsctl_vp);
	}
	vn_lock(dvp, ltype \| LK_RETRY);
	return (error);
	}
	}
	if (zfs_has_ctldir(zdp) && strcmp(nm, ZFS_CTLDIR_NAME) == 0) {
	ZFS_EXIT(zfsvfs);
	if ((cnp->cn_flags & ISLASTCN) != 0 && nameiop != LOOKUP)
	return (SET_ERROR(ENOTSUP));
	error = zfsctl_root(zfsvfs, cnp->cn_lkflags, vpp);
	return (error);
	}

	/*
	* The loop is retry the lookup if the parent-child relationship
	* changes during the dot-dot locking complexities.
	*/
	for (;;) {
	uint64_t parent;

	error = zfs_dirlook(zdp, nm, &zp);
	if (error == 0)
	*vpp = ZTOV(zp);

	ZFS_EXIT(zfsvfs);
	if (error != 0)
	break;

	error = zfs_lookup_lock(dvp, *vpp, nm, cnp->cn_lkflags);
	if (error != 0) {
	/*
	* If we've got a locking error, then the vnode
	* got reclaimed because of a force unmount.
	* We never enter doomed vnodes into the name cache.
	*/
	*vpp = NULL;
	return (error);
	}

	if ((cnp->cn_flags & ISDOTDOT) == 0)
	break;

	ZFS_ENTER(zfsvfs);
	if (zdp->z_sa_hdl == NULL) {
	error = SET_ERROR(EIO);
	} else {
	error = sa_lookup(zdp->z_sa_hdl, SA_ZPL_PARENT(zfsvfs),
	&parent, sizeof (parent));
	}
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	vput(ZTOV(zp));
	break;
	}
	if (zp->z_id == parent) {
	ZFS_EXIT(zfsvfs);
	break;
	}
	vput(ZTOV(zp));
	}

	if (error != 0)
	*vpp = NULL;

	/* Translate errors and add SAVENAME when needed. */
	if (cnp->cn_flags & ISLASTCN) {
	switch (nameiop) {
	case CREATE:
	case RENAME:
	if (error == ENOENT) {
	error = EJUSTRETURN;
	cnp->cn_flags \|= SAVENAME;
	break;
	}
	/* FALLTHROUGH */
	case DELETE:
	if (error == 0)
	cnp->cn_flags \|= SAVENAME;
	break;
	}
	}

	/* Insert name into cache (as non-existent) if appropriate. */
	if (zfsvfs->z_use_namecache && !zfsvfs->z_replay &&
	error == ENOENT && (cnp->cn_flags & MAKEENTRY) != 0)
	cache_enter(dvp, NULL, cnp);

	/* Insert name into cache if appropriate. */
	if (zfsvfs->z_use_namecache && !zfsvfs->z_replay &&
	error == 0 && (cnp->cn_flags & MAKEENTRY)) {
	if (!(cnp->cn_flags & ISLASTCN) \|\|
	(nameiop != DELETE && nameiop != RENAME)) {
	cache_enter(dvp, *vpp, cnp);
	}
	}

	return (error);
	}

	/*
	* Attempt to create a new entry in a directory. If the entry
	* already exists, truncate the file if permissible, else return
	* an error. Return the vp of the created or trunc'd file.
	*
	* IN: dvp - vnode of directory to put new file entry in.
	* name - name of new file entry.
	* vap - attributes of new file.
	* excl - flag indicating exclusive or non-exclusive mode.
	* mode - mode to open file with.
	* cr - credentials of caller.
	* flag - large file flag [UNUSED].
	* ct - caller context
	* vsecp - ACL to be set
	*
	* OUT: vpp - vnode of created or trunc'd entry.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* dvp - ctime\|mtime updated if new entry created
	* vp - ctime\|mtime always, atime if new
	*/

	/* ARGSUSED */
	int
	zfs_create(znode_t dzp, char name, vattr_t *vap, int excl, int mode,
	znode_t *zpp, cred_t cr, int flag, vsecattr_t *vsecp)
	{
	znode_t *zp;
	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
	zilog_t *zilog;
	objset_t *os;
	dmu_tx_t *tx;
	int error;
	ksid_t *ksid;
	uid_t uid;
	gid_t gid = crgetgid(cr);
	uint64_t projid = ZFS_DEFAULT_PROJID;
	zfs_acl_ids_t acl_ids;
	boolean_t fuid_dirtied;
	uint64_t txtype;
	#ifdef DEBUG_VFS_LOCKS
	vnode_t *dvp = ZTOV(dzp);
	#endif

	/*
	* If we have an ephemeral id, ACL, or XVATTR then
	* make sure file system is at proper version
	*/

	ksid = crgetsid(cr, KSID_OWNER);
	if (ksid)
	uid = ksid_getid(ksid);
	else
	uid = crgetuid(cr);

	if (zfsvfs->z_use_fuids == B_FALSE &&
	(vsecp \|\| (vap->va_mask & AT_XVATTR) \|\|
	IS_EPHEMERAL(uid) \|\| IS_EPHEMERAL(gid)))
	return (SET_ERROR(EINVAL));

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(dzp);
	os = zfsvfs->z_os;
	zilog = zfsvfs->z_log;

	if (zfsvfs->z_utf8 && u8_validate(name, strlen(name),
	NULL, U8_VALIDATE_ENTIRE, &error) < 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EILSEQ));
	}

	if (vap->va_mask & AT_XVATTR) {
	if ((error = secpolicy_xvattr(ZTOV(dzp), (xvattr_t *)vap,
	crgetuid(cr), cr, vap->va_type)) != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	}

	*zpp = NULL;

	if ((vap->va_mode & S_ISVTX) && secpolicy_vnode_stky_modify(cr))
	vap->va_mode &= ~S_ISVTX;

	error = zfs_dirent_lookup(dzp, name, &zp, ZNEW);
	if (error) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	ASSERT3P(zp, ==, NULL);

	/*
	* Create a new file object and update the directory
	* to reference it.
	*/
	if ((error = zfs_zaccess(dzp, ACE_ADD_FILE, 0, B_FALSE, cr))) {
	goto out;
	}

	/*
	* We only support the creation of regular files in
	* extended attribute directories.
	*/

	if ((dzp->z_pflags & ZFS_XATTR) &&
	(vap->va_type != VREG)) {
	error = SET_ERROR(EINVAL);
	goto out;
	}

	if ((error = zfs_acl_ids_create(dzp, 0, vap,
	cr, vsecp, &acl_ids)) != 0)
	goto out;

	if (S_ISREG(vap->va_mode) \|\| S_ISDIR(vap->va_mode))
	projid = zfs_inherit_projid(dzp);
	if (zfs_acl_ids_overquota(zfsvfs, &acl_ids, projid)) {
	zfs_acl_ids_free(&acl_ids);
	error = SET_ERROR(EDQUOT);
	goto out;
	}

	getnewvnode_reserve_();

	tx = dmu_tx_create(os);

	dmu_tx_hold_sa_create(tx, acl_ids.z_aclp->z_acl_bytes +
	ZFS_SA_BASE_ATTR_SIZE);

	fuid_dirtied = zfsvfs->z_fuid_dirty;
	if (fuid_dirtied)
	zfs_fuid_txhold(zfsvfs, tx);
	dmu_tx_hold_zap(tx, dzp->z_id, TRUE, name);
	dmu_tx_hold_sa(tx, dzp->z_sa_hdl, B_FALSE);
	if (!zfsvfs->z_use_sa &&
	acl_ids.z_aclp->z_acl_bytes > ZFS_ACE_SPACE) {
	dmu_tx_hold_write(tx, DMU_NEW_OBJECT,
	0, acl_ids.z_aclp->z_acl_bytes);
	}
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	zfs_acl_ids_free(&acl_ids);
	dmu_tx_abort(tx);
	getnewvnode_drop_reserve();
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	zfs_mknode(dzp, vap, tx, cr, 0, &zp, &acl_ids);
	if (fuid_dirtied)
	zfs_fuid_sync(zfsvfs, tx);

	(void) zfs_link_create(dzp, name, zp, tx, ZNEW);
	txtype = zfs_log_create_txtype(Z_FILE, vsecp, vap);
	zfs_log_create(zilog, tx, txtype, dzp, zp, name,
	vsecp, acl_ids.z_fuidp, vap);
	zfs_acl_ids_free(&acl_ids);
	dmu_tx_commit(tx);

	getnewvnode_drop_reserve();

	out:
	VNCHECKREF(dvp);
	if (error == 0) {
	*zpp = zp;
	}

	if (zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Remove an entry from a directory.
	*
	* IN: dvp - vnode of directory to remove entry from.
	* name - name of entry to remove.
	* cr - credentials of caller.
	* ct - caller context
	* flags - case flags
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* dvp - ctime\|mtime
	* vp - ctime (if nlink > 0)
	*/

	/ARGSUSED/
	static int
	zfs_remove_(vnode_t dvp, vnode_t vp, char name, cred_t cr)
	{
	znode_t *dzp = VTOZ(dvp);
	znode_t *zp;
	znode_t *xzp;
	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
	zilog_t *zilog;
	uint64_t xattr_obj;
	uint64_t obj = 0;
	dmu_tx_t *tx;
	boolean_t unlinked;
	uint64_t txtype;
	int error;


	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(dzp);
	zp = VTOZ(vp);
	ZFS_VERIFY_ZP(zp);
	zilog = zfsvfs->z_log;

	xattr_obj = 0;
	xzp = NULL;

	if ((error = zfs_zaccess_delete(dzp, zp, cr))) {
	goto out;
	}

	/*
	* Need to use rmdir for removing directories.
	*/
	if (vp->v_type == VDIR) {
	error = SET_ERROR(EPERM);
	goto out;
	}

	vnevent_remove(vp, dvp, name, ct);

	obj = zp->z_id;

	/* are there any extended attributes? */
	error = sa_lookup(zp->z_sa_hdl, SA_ZPL_XATTR(zfsvfs),
	&xattr_obj, sizeof (xattr_obj));
	if (error == 0 && xattr_obj) {
	error = zfs_zget(zfsvfs, xattr_obj, &xzp);
	ASSERT0(error);
	}

	/*
	* We may delete the znode now, or we may put it in the unlinked set;
	* it depends on whether we're the last link, and on whether there are
	* other holds on the vnode. So we dmu_tx_hold() the right things to
	* allow for either case.
	*/
	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_zap(tx, dzp->z_id, FALSE, name);
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	zfs_sa_upgrade_txholds(tx, zp);
	zfs_sa_upgrade_txholds(tx, dzp);

	if (xzp) {
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE);
	dmu_tx_hold_sa(tx, xzp->z_sa_hdl, B_FALSE);
	}

	/* charge as an update -- would be nice not to charge at all */
	dmu_tx_hold_zap(tx, zfsvfs->z_unlinkedobj, FALSE, NULL);

	/*
	* Mark this transaction as typically resulting in a net free of space
	*/
	dmu_tx_mark_netfree(tx);

	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Remove the directory entry.
	*/
	error = zfs_link_destroy(dzp, name, zp, tx, ZEXISTS, &unlinked);

	if (error) {
	dmu_tx_commit(tx);
	goto out;
	}

	if (unlinked) {
	zfs_unlinked_add(zp, tx);
	vp->v_vflag \|= VV_NOSYNC;
	}
	/* XXX check changes to linux vnops */
	txtype = TX_REMOVE;
	zfs_log_remove(zilog, tx, txtype, dzp, name, obj, unlinked);

	dmu_tx_commit(tx);
	out:

	if (xzp)
	vrele(ZTOV(xzp));

	if (zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);


	ZFS_EXIT(zfsvfs);
	return (error);
	}


	static int
	zfs_lookup_internal(znode_t dzp, char name, vnode_t **vpp,
	struct componentname *cnp, int nameiop)
	{
	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
	int error;

	cnp->cn_nameptr = name;
	cnp->cn_namelen = strlen(name);
	cnp->cn_nameiop = nameiop;
	cnp->cn_flags = ISLASTCN \| SAVENAME;
	cnp->cn_lkflags = LK_EXCLUSIVE \| LK_RETRY;
	cnp->cn_cred = kcred;
	cnp->cn_thread = curthread;

	if (zfsvfs->z_use_namecache && !zfsvfs->z_replay) {
	struct vop_lookup_args a;

	a.a_gen.a_desc = &vop_lookup_desc;
	a.a_dvp = ZTOV(dzp);
	a.a_vpp = vpp;
	a.a_cnp = cnp;
	error = vfs_cache_lookup(&a);
	} else {
	error = zfs_lookup(ZTOV(dzp), name, vpp, cnp, nameiop, kcred,
	curthread, 0, B_FALSE);
	}
	#ifdef ZFS_DEBUG
	if (error) {
	printf("got error %d on name %s on op %d\n", error, name,
	nameiop);
	kdb_backtrace();
	}
	#endif
	return (error);
	}

	int
	zfs_remove(znode_t dzp, char name, cred_t *cr, int flags)
	{
	vnode_t *vp;
	int error;
	struct componentname cn;

	if ((error = zfs_lookup_internal(dzp, name, &vp, &cn, DELETE)))
	return (error);

	error = zfs_remove_(ZTOV(dzp), vp, name, cr);
	vput(vp);
	return (error);
	}
	/*
	* Create a new directory and insert it into dvp using the name
	* provided. Return a pointer to the inserted directory.
	*
	* IN: dvp - vnode of directory to add subdir to.
	* dirname - name of new directory.
	* vap - attributes of new directory.
	* cr - credentials of caller.
	* ct - caller context
	* flags - case flags
	* vsecp - ACL to be set
	*
	* OUT: vpp - vnode of created directory.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* dvp - ctime\|mtime updated
	* vp - ctime\|mtime\|atime updated
	*/
	/ARGSUSED/
	int
	zfs_mkdir(znode_t dzp, char dirname, vattr_t vap, znode_t zpp, cred_t cr,
	int flags, vsecattr_t *vsecp)
	{
	znode_t *zp;
	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
	zilog_t *zilog;
	uint64_t txtype;
	dmu_tx_t *tx;
	int error;
	ksid_t *ksid;
	uid_t uid;
	gid_t gid = crgetgid(cr);
	zfs_acl_ids_t acl_ids;
	boolean_t fuid_dirtied;

	ASSERT(vap->va_type == VDIR);

	/*
	* If we have an ephemeral id, ACL, or XVATTR then
	* make sure file system is at proper version
	*/

	ksid = crgetsid(cr, KSID_OWNER);
	if (ksid)
	uid = ksid_getid(ksid);
	else
	uid = crgetuid(cr);
	if (zfsvfs->z_use_fuids == B_FALSE &&
	((vap->va_mask & AT_XVATTR) \|\|
	IS_EPHEMERAL(uid) \|\| IS_EPHEMERAL(gid)))
	return (SET_ERROR(EINVAL));

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(dzp);
	zilog = zfsvfs->z_log;

	if (dzp->z_pflags & ZFS_XATTR) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	if (zfsvfs->z_utf8 && u8_validate(dirname,
	strlen(dirname), NULL, U8_VALIDATE_ENTIRE, &error) < 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EILSEQ));
	}

	if (vap->va_mask & AT_XVATTR) {
	if ((error = secpolicy_xvattr(ZTOV(dzp), (xvattr_t *)vap,
	crgetuid(cr), cr, vap->va_type)) != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	}

	if ((error = zfs_acl_ids_create(dzp, 0, vap, cr,
	NULL, &acl_ids)) != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* First make sure the new directory doesn't exist.
	*
	* Existence is checked first to make sure we don't return
	* EACCES instead of EEXIST which can cause some applications
	* to fail.
	*/
	*zpp = NULL;

	if ((error = zfs_dirent_lookup(dzp, dirname, &zp, ZNEW))) {
	zfs_acl_ids_free(&acl_ids);
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	ASSERT3P(zp, ==, NULL);

	if ((error = zfs_zaccess(dzp, ACE_ADD_SUBDIRECTORY, 0, B_FALSE, cr))) {
	zfs_acl_ids_free(&acl_ids);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	if (zfs_acl_ids_overquota(zfsvfs, &acl_ids, zfs_inherit_projid(dzp))) {
	zfs_acl_ids_free(&acl_ids);
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EDQUOT));
	}

	/*
	* Add a new entry to the directory.
	*/
	getnewvnode_reserve_();
	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_zap(tx, dzp->z_id, TRUE, dirname);
	dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
	fuid_dirtied = zfsvfs->z_fuid_dirty;
	if (fuid_dirtied)
	zfs_fuid_txhold(zfsvfs, tx);
	if (!zfsvfs->z_use_sa && acl_ids.z_aclp->z_acl_bytes > ZFS_ACE_SPACE) {
	dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
	acl_ids.z_aclp->z_acl_bytes);
	}

	dmu_tx_hold_sa_create(tx, acl_ids.z_aclp->z_acl_bytes +
	ZFS_SA_BASE_ATTR_SIZE);

	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	zfs_acl_ids_free(&acl_ids);
	dmu_tx_abort(tx);
	getnewvnode_drop_reserve();
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Create new node.
	*/
	zfs_mknode(dzp, vap, tx, cr, 0, &zp, &acl_ids);

	if (fuid_dirtied)
	zfs_fuid_sync(zfsvfs, tx);

	/*
	* Now put new name in parent dir.
	*/
	(void) zfs_link_create(dzp, dirname, zp, tx, ZNEW);

	*zpp = zp;

	txtype = zfs_log_create_txtype(Z_DIR, NULL, vap);
	zfs_log_create(zilog, tx, txtype, dzp, zp, dirname, NULL,
	acl_ids.z_fuidp, vap);

	zfs_acl_ids_free(&acl_ids);

	dmu_tx_commit(tx);

	getnewvnode_drop_reserve();

	if (zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);

	ZFS_EXIT(zfsvfs);
	return (0);
	}

	/*
	* Remove a directory subdir entry. If the current working
	* directory is the same as the subdir to be removed, the
	* remove will fail.
	*
	* IN: dvp - vnode of directory to remove from.
	* name - name of directory to be removed.
	* cwd - vnode of current working directory.
	* cr - credentials of caller.
	* ct - caller context
	* flags - case flags
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* dvp - ctime\|mtime updated
	*/
	/ARGSUSED/
	static int
	zfs_rmdir_(vnode_t dvp, vnode_t vp, char name, cred_t cr)
	{
	znode_t *dzp = VTOZ(dvp);
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
	zilog_t *zilog;
	dmu_tx_t *tx;
	int error;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(dzp);
	ZFS_VERIFY_ZP(zp);
	zilog = zfsvfs->z_log;


	if ((error = zfs_zaccess_delete(dzp, zp, cr))) {
	goto out;
	}

	if (vp->v_type != VDIR) {
	error = SET_ERROR(ENOTDIR);
	goto out;
	}

	vnevent_rmdir(vp, dvp, name, ct);

	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_zap(tx, dzp->z_id, FALSE, name);
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	dmu_tx_hold_zap(tx, zfsvfs->z_unlinkedobj, FALSE, NULL);
	zfs_sa_upgrade_txholds(tx, zp);
	zfs_sa_upgrade_txholds(tx, dzp);
	dmu_tx_mark_netfree(tx);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	cache_purge(dvp);

	error = zfs_link_destroy(dzp, name, zp, tx, ZEXISTS, NULL);

	if (error == 0) {
	uint64_t txtype = TX_RMDIR;
	zfs_log_remove(zilog, tx, txtype, dzp, name,
	ZFS_NO_OBJECT, B_FALSE);
	}

	dmu_tx_commit(tx);

	cache_purge(vp);
	out:
	if (zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	int
	zfs_rmdir(znode_t dzp, char name, znode_t cwd, cred_t cr, int flags)
	{
	struct componentname cn;
	vnode_t *vp;
	int error;

	if ((error = zfs_lookup_internal(dzp, name, &vp, &cn, DELETE)))
	return (error);

	error = zfs_rmdir_(ZTOV(dzp), vp, name, cr);
	vput(vp);
	return (error);
	}

	/*
	* Read as many directory entries as will fit into the provided
	* buffer from the given directory cursor position (specified in
	* the uio structure).
	*
	* IN: vp - vnode of directory to read.
	* uio - structure supplying read location, range info,
	* and return buffer.
	* cr - credentials of caller.
	* ct - caller context
	* flags - case flags
	*
	* OUT: uio - updated offset and range, buffer filled.
	* eofp - set to true if end-of-file detected.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* vp - atime updated
	*
	* Note that the low 4 bits of the cookie returned by zap is always zero.
	* This allows us to use the low range for "special" directory entries:
	* We use 0 for '.', and 1 for '..'. If this is the root of the filesystem,
	* we use the offset 2 for the '.zfs' directory.
	*/
	/* ARGSUSED */
	static int
	zfs_readdir(vnode_t vp, uio_t uio, cred_t cr, int eofp,
	int ncookies, ulong_t *cookies)
	{
	znode_t *zp = VTOZ(vp);
	iovec_t *iovp;
	edirent_t *eodp;
	dirent64_t *odp;
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	objset_t *os;
	caddr_t outbuf;
	size_t bufsize;
	zap_cursor_t zc;
	zap_attribute_t zap;
	uint_t bytes_wanted;
	uint64_t offset; /* must be unsigned; checks for < 1 */
	uint64_t parent;
	int local_eof;
	int outcount;
	int error;
	uint8_t prefetch;
	boolean_t check_sysattrs;
	uint8_t type;
	int ncooks;
	ulong_t *cooks = NULL;
	int flags = 0;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_PARENT(zfsvfs),
	&parent, sizeof (parent))) != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* If we are not given an eof variable,
	* use a local one.
	*/
	if (eofp == NULL)
	eofp = &local_eof;

	/*
	* Check for valid iov_len.
	*/
	if (uio->uio_iov->iov_len <= 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	/*
	* Quit if directory has been removed (posix)
	*/
	if ((*eofp = zp->z_unlinked) != 0) {
	ZFS_EXIT(zfsvfs);
	return (0);
	}

	error = 0;
	os = zfsvfs->z_os;
	offset = uio->uio_loffset;
	prefetch = zp->z_zn_prefetch;

	/*
	* Initialize the iterator cursor.
	*/
	if (offset <= 3) {
	/*
	* Start iteration from the beginning of the directory.
	*/
	zap_cursor_init(&zc, os, zp->z_id);
	} else {
	/*
	* The offset is a serialized cursor.
	*/
	zap_cursor_init_serialized(&zc, os, zp->z_id, offset);
	}

	/*
	* Get space to change directory entries into fs independent format.
	*/
	iovp = uio->uio_iov;
	bytes_wanted = iovp->iov_len;
	if (uio->uio_segflg != UIO_SYSSPACE \|\| uio->uio_iovcnt != 1) {
	bufsize = bytes_wanted;
	outbuf = kmem_alloc(bufsize, KM_SLEEP);
	odp = (struct dirent64 *)outbuf;
	} else {
	bufsize = bytes_wanted;
	outbuf = NULL;
	odp = (struct dirent64 *)iovp->iov_base;
	}
	eodp = (struct edirent *)odp;

	if (ncookies != NULL) {
	/*
	* Minimum entry size is dirent size and 1 byte for a file name.
	*/
	ncooks = uio->uio_resid / (sizeof (struct dirent) -
	sizeof (((struct dirent *)NULL)->d_name) + 1);
	cooks = malloc(ncooks * sizeof (ulong_t), M_TEMP, M_WAITOK);
	*cookies = cooks;
	*ncookies = ncooks;
	}
	/*
	* If this VFS supports the system attribute view interface; and
	* we're looking at an extended attribute directory; and we care
	* about normalization conflicts on this vfs; then we must check
	* for normalization conflicts with the sysattr name space.
	*/
	#ifdef TODO
	check_sysattrs = vfs_has_feature(vp->v_vfsp, VFSFT_SYSATTR_VIEWS) &&
	(vp->v_flag & V_XATTRDIR) && zfsvfs->z_norm &&
	(flags & V_RDDIR_ENTFLAGS);
	#else
	check_sysattrs = 0;
	#endif

	/*
	* Transform to file-system independent format
	*/
	outcount = 0;
	while (outcount < bytes_wanted) {
	ino64_t objnum;
	ushort_t reclen;
	off64_t *next = NULL;

	/*
	* Special case `.', `..', and `.zfs'.
	*/
	if (offset == 0) {
	(void) strcpy(zap.za_name, ".");
	zap.za_normalization_conflict = 0;
	objnum = zp->z_id;
	type = DT_DIR;
	} else if (offset == 1) {
	(void) strcpy(zap.za_name, "..");
	zap.za_normalization_conflict = 0;
	objnum = parent;
	type = DT_DIR;
	} else if (offset == 2 && zfs_show_ctldir(zp)) {
	(void) strcpy(zap.za_name, ZFS_CTLDIR_NAME);
	zap.za_normalization_conflict = 0;
	objnum = ZFSCTL_INO_ROOT;
	type = DT_DIR;
	} else {
	/*
	* Grab next entry.
	*/
	if ((error = zap_cursor_retrieve(&zc, &zap))) {
	if ((*eofp = (error == ENOENT)) != 0)
	break;
	else
	goto update;
	}

	if (zap.za_integer_length != 8 \|\|
	zap.za_num_integers != 1) {
	cmn_err(CE_WARN, "zap_readdir: bad directory "
	"entry, obj = %lld, offset = %lld\n",
	(u_longlong_t)zp->z_id,
	(u_longlong_t)offset);
	error = SET_ERROR(ENXIO);
	goto update;
	}

	objnum = ZFS_DIRENT_OBJ(zap.za_first_integer);
	/*
	* MacOS X can extract the object type here such as:
	* uint8_t type = ZFS_DIRENT_TYPE(zap.za_first_integer);
	*/
	type = ZFS_DIRENT_TYPE(zap.za_first_integer);

	if (check_sysattrs && !zap.za_normalization_conflict) {
	#ifdef TODO
	zap.za_normalization_conflict =
	xattr_sysattr_casechk(zap.za_name);
	#else
	panic("%s:%u: TODO", __func__, __LINE__);
	#endif
	}
	}

	if (flags & V_RDDIR_ACCFILTER) {
	/*
	* If we have no access at all, don't include
	* this entry in the returned information
	*/
	znode_t *ezp;
	if (zfs_zget(zp->z_zfsvfs, objnum, &ezp) != 0)
	goto skip_entry;
	if (!zfs_has_access(ezp, cr)) {
	vrele(ZTOV(ezp));
	goto skip_entry;
	}
	vrele(ZTOV(ezp));
	}

	if (flags & V_RDDIR_ENTFLAGS)
	reclen = EDIRENT_RECLEN(strlen(zap.za_name));
	else
	reclen = DIRENT64_RECLEN(strlen(zap.za_name));

	/*
	* Will this entry fit in the buffer?
	*/
	if (outcount + reclen > bufsize) {
	/*
	* Did we manage to fit anything in the buffer?
	*/
	if (!outcount) {
	error = SET_ERROR(EINVAL);
	goto update;
	}
	break;
	}
	if (flags & V_RDDIR_ENTFLAGS) {
	/*
	* Add extended flag entry:
	*/
	eodp->ed_ino = objnum;
	eodp->ed_reclen = reclen;
	/* NOTE: ed_off is the offset for the next entry */
	next = &(eodp->ed_off);
	eodp->ed_eflags = zap.za_normalization_conflict ?
	ED_CASE_CONFLICT : 0;
	(void) strncpy(eodp->ed_name, zap.za_name,
	EDIRENT_NAMELEN(reclen));
	eodp = (edirent_t *)((intptr_t)eodp + reclen);
	} else {
	/*
	* Add normal entry:
	*/
	odp->d_ino = objnum;
	odp->d_reclen = reclen;
	odp->d_namlen = strlen(zap.za_name);
	/* NOTE: d_off is the offset for the next entry. */
	next = &odp->d_off;
	strlcpy(odp->d_name, zap.za_name, odp->d_namlen + 1);
	odp->d_type = type;
	dirent_terminate(odp);
	odp = (dirent64_t *)((intptr_t)odp + reclen);
	}
	outcount += reclen;

	ASSERT(outcount <= bufsize);

	/* Prefetch znode */
	if (prefetch)
	dmu_prefetch(os, objnum, 0, 0, 0,
	ZIO_PRIORITY_SYNC_READ);

	skip_entry:
	/*
	* Move to the next entry, fill in the previous offset.
	*/
	if (offset > 2 \|\| (offset == 2 && !zfs_show_ctldir(zp))) {
	zap_cursor_advance(&zc);
	offset = zap_cursor_serialize(&zc);
	} else {
	offset += 1;
	}

	/* Fill the offset right after advancing the cursor. */
	if (next != NULL)
	*next = offset;
	if (cooks != NULL) {
	*cooks++ = offset;
	ncooks--;
	KASSERT(ncooks >= 0, ("ncookies=%d", ncooks));
	}
	}
	zp->z_zn_prefetch = B_FALSE; /* a lookup will re-enable pre-fetching */

	/* Subtract unused cookies */
	if (ncookies != NULL)
	*ncookies -= ncooks;

	if (uio->uio_segflg == UIO_SYSSPACE && uio->uio_iovcnt == 1) {
	iovp->iov_base += outcount;
	iovp->iov_len -= outcount;
	uio->uio_resid -= outcount;
	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ, uio))) {
	/*
	* Reset the pointer.
	*/
	offset = uio->uio_loffset;
	}

	update:
	zap_cursor_fini(&zc);
	if (uio->uio_segflg != UIO_SYSSPACE \|\| uio->uio_iovcnt != 1)
	kmem_free(outbuf, bufsize);

	if (error == ENOENT)
	error = 0;

	ZFS_ACCESSTIME_STAMP(zfsvfs, zp);

	uio->uio_loffset = offset;
	ZFS_EXIT(zfsvfs);
	if (error != 0 && cookies != NULL) {
	free(*cookies, M_TEMP);
	*cookies = NULL;
	*ncookies = 0;
	}
	return (error);
	}

	ulong_t zfs_fsync_sync_cnt = 4;

	static int
	zfs_fsync(vnode_t vp, int syncflag, cred_t cr, caller_context_t *ct)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;

	(void) tsd_set(zfs_fsyncer_key, (void *)zfs_fsync_sync_cnt);

	if (zfsvfs->z_os->os_sync != ZFS_SYNC_DISABLED) {
	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);
	zil_commit(zfsvfs->z_log, zp->z_id);
	ZFS_EXIT(zfsvfs);
	}
	tsd_set(zfs_fsyncer_key, NULL);
	return (0);
	}


	/*
	* Get the requested file attributes and place them in the provided
	* vattr structure.
	*
	* IN: vp - vnode of file.
	* vap - va_mask identifies requested attributes.
	* If AT_XVATTR set, then optional attrs are requested
	* flags - ATTR_NOACLCHECK (CIFS server context)
	* cr - credentials of caller.
	*
	* OUT: vap - attribute values.
	*
	* RETURN: 0 (always succeeds).
	*/
	/* ARGSUSED */
	static int
	zfs_getattr(vnode_t vp, vattr_t vap, int flags, cred_t *cr)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	int error = 0;
	uint32_t blksize;
	u_longlong_t nblocks;
	uint64_t mtime[2], ctime[2], crtime[2], rdev;
	xvattr_t xvap = (xvattr_t )vap; /* vap may be an xvattr_t * */
	xoptattr_t *xoap = NULL;
	boolean_t skipaclchk = (flags & ATTR_NOACLCHECK) ? B_TRUE : B_FALSE;
	sa_bulk_attr_t bulk[4];
	int count = 0;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	zfs_fuid_map_ids(zp, cr, &vap->va_uid, &vap->va_gid);

	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MTIME(zfsvfs), NULL, &mtime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, &ctime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CRTIME(zfsvfs), NULL, &crtime, 16);
	if (vp->v_type == VBLK \|\| vp->v_type == VCHR)
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_RDEV(zfsvfs), NULL,
	&rdev, 8);

	if ((error = sa_bulk_lookup(zp->z_sa_hdl, bulk, count)) != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* If ACL is trivial don't bother looking for ACE_READ_ATTRIBUTES.
	* Also, if we are the owner don't bother, since owner should
	* always be allowed to read basic attributes of file.
	*/
	if (!(zp->z_pflags & ZFS_ACL_TRIVIAL) &&
	(vap->va_uid != crgetuid(cr))) {
	if ((error = zfs_zaccess(zp, ACE_READ_ATTRIBUTES, 0,
	skipaclchk, cr))) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	}

	/*
	* Return all attributes. It's cheaper to provide the answer
	* than to determine whether we were asked the question.
	*/

	vap->va_type = IFTOVT(zp->z_mode);
	vap->va_mode = zp->z_mode & ~S_IFMT;
	vn_fsid(vp, vap);
	vap->va_nodeid = zp->z_id;
	vap->va_nlink = zp->z_links;
	if ((vp->v_flag & VROOT) && zfs_show_ctldir(zp) &&
	zp->z_links < ZFS_LINK_MAX)
	vap->va_nlink++;
	vap->va_size = zp->z_size;
	if (vp->v_type == VBLK \|\| vp->v_type == VCHR)
	vap->va_rdev = zfs_cmpldev(rdev);
	vap->va_seq = zp->z_seq;
	vap->va_flags = 0; /* FreeBSD: Reset chflags(2) flags. */
	vap->va_filerev = zp->z_seq;

	/*
	* Add in any requested optional attributes and the create time.
	* Also set the corresponding bits in the returned attribute bitmap.
	*/
	if ((xoap = xva_getxoptattr(xvap)) != NULL && zfsvfs->z_use_fuids) {
	if (XVA_ISSET_REQ(xvap, XAT_ARCHIVE)) {
	xoap->xoa_archive =
	((zp->z_pflags & ZFS_ARCHIVE) != 0);
	XVA_SET_RTN(xvap, XAT_ARCHIVE);
	}

	if (XVA_ISSET_REQ(xvap, XAT_READONLY)) {
	xoap->xoa_readonly =
	((zp->z_pflags & ZFS_READONLY) != 0);
	XVA_SET_RTN(xvap, XAT_READONLY);
	}

	if (XVA_ISSET_REQ(xvap, XAT_SYSTEM)) {
	xoap->xoa_system =
	((zp->z_pflags & ZFS_SYSTEM) != 0);
	XVA_SET_RTN(xvap, XAT_SYSTEM);
	}

	if (XVA_ISSET_REQ(xvap, XAT_HIDDEN)) {
	xoap->xoa_hidden =
	((zp->z_pflags & ZFS_HIDDEN) != 0);
	XVA_SET_RTN(xvap, XAT_HIDDEN);
	}

	if (XVA_ISSET_REQ(xvap, XAT_NOUNLINK)) {
	xoap->xoa_nounlink =
	((zp->z_pflags & ZFS_NOUNLINK) != 0);
	XVA_SET_RTN(xvap, XAT_NOUNLINK);
	}

	if (XVA_ISSET_REQ(xvap, XAT_IMMUTABLE)) {
	xoap->xoa_immutable =
	((zp->z_pflags & ZFS_IMMUTABLE) != 0);
	XVA_SET_RTN(xvap, XAT_IMMUTABLE);
	}

	if (XVA_ISSET_REQ(xvap, XAT_APPENDONLY)) {
	xoap->xoa_appendonly =
	((zp->z_pflags & ZFS_APPENDONLY) != 0);
	XVA_SET_RTN(xvap, XAT_APPENDONLY);
	}

	if (XVA_ISSET_REQ(xvap, XAT_NODUMP)) {
	xoap->xoa_nodump =
	((zp->z_pflags & ZFS_NODUMP) != 0);
	XVA_SET_RTN(xvap, XAT_NODUMP);
	}

	if (XVA_ISSET_REQ(xvap, XAT_OPAQUE)) {
	xoap->xoa_opaque =
	((zp->z_pflags & ZFS_OPAQUE) != 0);
	XVA_SET_RTN(xvap, XAT_OPAQUE);
	}

	if (XVA_ISSET_REQ(xvap, XAT_AV_QUARANTINED)) {
	xoap->xoa_av_quarantined =
	((zp->z_pflags & ZFS_AV_QUARANTINED) != 0);
	XVA_SET_RTN(xvap, XAT_AV_QUARANTINED);
	}

	if (XVA_ISSET_REQ(xvap, XAT_AV_MODIFIED)) {
	xoap->xoa_av_modified =
	((zp->z_pflags & ZFS_AV_MODIFIED) != 0);
	XVA_SET_RTN(xvap, XAT_AV_MODIFIED);
	}

	if (XVA_ISSET_REQ(xvap, XAT_AV_SCANSTAMP) &&
	vp->v_type == VREG) {
	zfs_sa_get_scanstamp(zp, xvap);
	}

	if (XVA_ISSET_REQ(xvap, XAT_REPARSE)) {
	xoap->xoa_reparse = ((zp->z_pflags & ZFS_REPARSE) != 0);
	XVA_SET_RTN(xvap, XAT_REPARSE);
	}
	if (XVA_ISSET_REQ(xvap, XAT_GEN)) {
	xoap->xoa_generation = zp->z_gen;
	XVA_SET_RTN(xvap, XAT_GEN);
	}

	if (XVA_ISSET_REQ(xvap, XAT_OFFLINE)) {
	xoap->xoa_offline =
	((zp->z_pflags & ZFS_OFFLINE) != 0);
	XVA_SET_RTN(xvap, XAT_OFFLINE);
	}

	if (XVA_ISSET_REQ(xvap, XAT_SPARSE)) {
	xoap->xoa_sparse =
	((zp->z_pflags & ZFS_SPARSE) != 0);
	XVA_SET_RTN(xvap, XAT_SPARSE);
	}

	if (XVA_ISSET_REQ(xvap, XAT_PROJINHERIT)) {
	xoap->xoa_projinherit =
	((zp->z_pflags & ZFS_PROJINHERIT) != 0);
	XVA_SET_RTN(xvap, XAT_PROJINHERIT);
	}

	if (XVA_ISSET_REQ(xvap, XAT_PROJID)) {
	xoap->xoa_projid = zp->z_projid;
	XVA_SET_RTN(xvap, XAT_PROJID);
	}
	}

	ZFS_TIME_DECODE(&vap->va_atime, zp->z_atime);
	ZFS_TIME_DECODE(&vap->va_mtime, mtime);
	ZFS_TIME_DECODE(&vap->va_ctime, ctime);
	ZFS_TIME_DECODE(&vap->va_birthtime, crtime);


	sa_object_size(zp->z_sa_hdl, &blksize, &nblocks);
	vap->va_blksize = blksize;
	vap->va_bytes = nblocks << 9; /* nblocks * 512 */

	if (zp->z_blksz == 0) {
	/*
	* Block size hasn't been set; suggest maximal I/O transfers.
	*/
	vap->va_blksize = zfsvfs->z_max_blksz;
	}

	ZFS_EXIT(zfsvfs);
	return (0);
	}

	/*
	* Set the file attributes to the values contained in the
	* vattr structure.
	*
	* IN: zp - znode of file to be modified.
	* vap - new attribute values.
	* If AT_XVATTR set, then optional attrs are being set
	* flags - ATTR_UTIME set if non-default time values provided.
	* - ATTR_NOACLCHECK (CIFS context only).
	* cr - credentials of caller.
	* ct - caller context
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* vp - ctime updated, mtime updated if size changed.
	*/
	/* ARGSUSED */
	int
	zfs_setattr(znode_t zp, vattr_t vap, int flags, cred_t *cr)
	{
	vnode_t *vp = ZTOV(zp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	objset_t *os = zfsvfs->z_os;
	zilog_t *zilog;
	dmu_tx_t *tx;
	vattr_t oldva;
	xvattr_t tmpxvattr;
	uint_t mask = vap->va_mask;
	uint_t saved_mask = 0;
	uint64_t saved_mode;
	int trim_mask = 0;
	uint64_t new_mode;
	uint64_t new_uid, new_gid;
	uint64_t xattr_obj;
	uint64_t mtime[2], ctime[2];
	uint64_t projid = ZFS_INVALID_PROJID;
	znode_t *attrzp;
	int need_policy = FALSE;
	int err, err2;
	zfs_fuid_info_t *fuidp = NULL;
	xvattr_t xvap = (xvattr_t )vap; /* vap may be an xvattr_t * */
	xoptattr_t *xoap;
	zfs_acl_t *aclp;
	boolean_t skipaclchk = (flags & ATTR_NOACLCHECK) ? B_TRUE : B_FALSE;
	boolean_t fuid_dirtied = B_FALSE;
	sa_bulk_attr_t bulk[7], xattr_bulk[7];
	int count = 0, xattr_count = 0;

	if (mask == 0)
	return (0);

	if (mask & AT_NOSET)
	return (SET_ERROR(EINVAL));

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	zilog = zfsvfs->z_log;

	/*
	* Make sure that if we have ephemeral uid/gid or xvattr specified
	* that file system is at proper version level
	*/

	if (zfsvfs->z_use_fuids == B_FALSE &&
	(((mask & AT_UID) && IS_EPHEMERAL(vap->va_uid)) \|\|
	((mask & AT_GID) && IS_EPHEMERAL(vap->va_gid)) \|\|
	(mask & AT_XVATTR))) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	if (mask & AT_SIZE && vp->v_type == VDIR) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EISDIR));
	}

	if (mask & AT_SIZE && vp->v_type != VREG && vp->v_type != VFIFO) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	/*
	* If this is an xvattr_t, then get a pointer to the structure of
	* optional attributes. If this is NULL, then we have a vattr_t.
	*/
	xoap = xva_getxoptattr(xvap);

	xva_init(&tmpxvattr);

	/*
	* Immutable files can only alter immutable bit and atime
	*/
	if ((zp->z_pflags & ZFS_IMMUTABLE) &&
	((mask & (AT_SIZE\|AT_UID\|AT_GID\|AT_MTIME\|AT_MODE)) \|\|
	((mask & AT_XVATTR) && XVA_ISSET_REQ(xvap, XAT_CREATETIME)))) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EPERM));
	}

	/*
	* Note: ZFS_READONLY is handled in zfs_zaccess_common.
	*/

	/*
	* Verify timestamps doesn't overflow 32 bits.
	* ZFS can handle large timestamps, but 32bit syscalls can't
	* handle times greater than 2039. This check should be removed
	* once large timestamps are fully supported.
	*/
	if (mask & (AT_ATIME \| AT_MTIME)) {
	if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) \|\|
	((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EOVERFLOW));
	}
	}
	if (xoap != NULL && (mask & AT_XVATTR)) {
	if (XVA_ISSET_REQ(xvap, XAT_CREATETIME) &&
	TIMESPEC_OVERFLOW(&vap->va_birthtime)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EOVERFLOW));
	}

	if (XVA_ISSET_REQ(xvap, XAT_PROJID)) {
	if (!dmu_objset_projectquota_enabled(os) \|\|
	(!S_ISREG(zp->z_mode) && !S_ISDIR(zp->z_mode))) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EOPNOTSUPP));
	}

	projid = xoap->xoa_projid;
	if (unlikely(projid == ZFS_INVALID_PROJID)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	if (projid == zp->z_projid && zp->z_pflags & ZFS_PROJID)
	projid = ZFS_INVALID_PROJID;
	else
	need_policy = TRUE;
	}

	if (XVA_ISSET_REQ(xvap, XAT_PROJINHERIT) &&
	(xoap->xoa_projinherit !=
	((zp->z_pflags & ZFS_PROJINHERIT) != 0)) &&
	(!dmu_objset_projectquota_enabled(os) \|\|
	(!S_ISREG(zp->z_mode) && !S_ISDIR(zp->z_mode)))) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EOPNOTSUPP));
	}
	}

	attrzp = NULL;
	aclp = NULL;

	if (zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EROFS));
	}

	/*
	* First validate permissions
	*/

	if (mask & AT_SIZE) {
	/*
	* XXX - Note, we are not providing any open
	* mode flags here (like FNDELAY), so we may
	* block if there are locks present... this
	* should be addressed in openat().
	*/
	/* XXX - would it be OK to generate a log record here? */
	err = zfs_freesp(zp, vap->va_size, 0, 0, FALSE);
	if (err) {
	ZFS_EXIT(zfsvfs);
	return (err);
	}
	}

	if (mask & (AT_ATIME\|AT_MTIME) \|\|
	((mask & AT_XVATTR) && (XVA_ISSET_REQ(xvap, XAT_HIDDEN) \|\|
	XVA_ISSET_REQ(xvap, XAT_READONLY) \|\|
	XVA_ISSET_REQ(xvap, XAT_ARCHIVE) \|\|
	XVA_ISSET_REQ(xvap, XAT_OFFLINE) \|\|
	XVA_ISSET_REQ(xvap, XAT_SPARSE) \|\|
	XVA_ISSET_REQ(xvap, XAT_CREATETIME) \|\|
	XVA_ISSET_REQ(xvap, XAT_SYSTEM)))) {
	need_policy = zfs_zaccess(zp, ACE_WRITE_ATTRIBUTES, 0,
	skipaclchk, cr);
	}

	if (mask & (AT_UID\|AT_GID)) {
	int idmask = (mask & (AT_UID\|AT_GID));
	int take_owner;
	int take_group;

	/*
	* NOTE: even if a new mode is being set,
	* we may clear S_ISUID/S_ISGID bits.
	*/

	if (!(mask & AT_MODE))
	vap->va_mode = zp->z_mode;

	/*
	* Take ownership or chgrp to group we are a member of
	*/

	take_owner = (mask & AT_UID) && (vap->va_uid == crgetuid(cr));
	take_group = (mask & AT_GID) &&
	zfs_groupmember(zfsvfs, vap->va_gid, cr);

	/*
	* If both AT_UID and AT_GID are set then take_owner and
	* take_group must both be set in order to allow taking
	* ownership.
	*
	* Otherwise, send the check through secpolicy_vnode_setattr()
	*
	*/

	if (((idmask == (AT_UID\|AT_GID)) && take_owner && take_group) \|\|
	((idmask == AT_UID) && take_owner) \|\|
	((idmask == AT_GID) && take_group)) {
	if (zfs_zaccess(zp, ACE_WRITE_OWNER, 0,
	skipaclchk, cr) == 0) {
	/*
	* Remove setuid/setgid for non-privileged users
	*/
	secpolicy_setid_clear(vap, vp, cr);
	trim_mask = (mask & (AT_UID\|AT_GID));
	} else {
	need_policy = TRUE;
	}
	} else {
	need_policy = TRUE;
	}
	}

	oldva.va_mode = zp->z_mode;
	zfs_fuid_map_ids(zp, cr, &oldva.va_uid, &oldva.va_gid);
	if (mask & AT_XVATTR) {
	/*
	* Update xvattr mask to include only those attributes
	* that are actually changing.
	*
	* the bits will be restored prior to actually setting
	* the attributes so the caller thinks they were set.
	*/
	if (XVA_ISSET_REQ(xvap, XAT_APPENDONLY)) {
	if (xoap->xoa_appendonly !=
	((zp->z_pflags & ZFS_APPENDONLY) != 0)) {
	need_policy = TRUE;
	} else {
	XVA_CLR_REQ(xvap, XAT_APPENDONLY);
	XVA_SET_REQ(&tmpxvattr, XAT_APPENDONLY);
	}
	}

	if (XVA_ISSET_REQ(xvap, XAT_PROJINHERIT)) {
	if (xoap->xoa_projinherit !=
	((zp->z_pflags & ZFS_PROJINHERIT) != 0)) {
	need_policy = TRUE;
	} else {
	XVA_CLR_REQ(xvap, XAT_PROJINHERIT);
	XVA_SET_REQ(&tmpxvattr, XAT_PROJINHERIT);
	}
	}

	if (XVA_ISSET_REQ(xvap, XAT_NOUNLINK)) {
	if (xoap->xoa_nounlink !=
	((zp->z_pflags & ZFS_NOUNLINK) != 0)) {
	need_policy = TRUE;
	} else {
	XVA_CLR_REQ(xvap, XAT_NOUNLINK);
	XVA_SET_REQ(&tmpxvattr, XAT_NOUNLINK);
	}
	}

	if (XVA_ISSET_REQ(xvap, XAT_IMMUTABLE)) {
	if (xoap->xoa_immutable !=
	((zp->z_pflags & ZFS_IMMUTABLE) != 0)) {
	need_policy = TRUE;
	} else {
	XVA_CLR_REQ(xvap, XAT_IMMUTABLE);
	XVA_SET_REQ(&tmpxvattr, XAT_IMMUTABLE);
	}
	}

	if (XVA_ISSET_REQ(xvap, XAT_NODUMP)) {
	if (xoap->xoa_nodump !=
	((zp->z_pflags & ZFS_NODUMP) != 0)) {
	need_policy = TRUE;
	} else {
	XVA_CLR_REQ(xvap, XAT_NODUMP);
	XVA_SET_REQ(&tmpxvattr, XAT_NODUMP);
	}
	}

	if (XVA_ISSET_REQ(xvap, XAT_AV_MODIFIED)) {
	if (xoap->xoa_av_modified !=
	((zp->z_pflags & ZFS_AV_MODIFIED) != 0)) {
	need_policy = TRUE;
	} else {
	XVA_CLR_REQ(xvap, XAT_AV_MODIFIED);
	XVA_SET_REQ(&tmpxvattr, XAT_AV_MODIFIED);
	}
	}

	if (XVA_ISSET_REQ(xvap, XAT_AV_QUARANTINED)) {
	if ((vp->v_type != VREG &&
	xoap->xoa_av_quarantined) \|\|
	xoap->xoa_av_quarantined !=
	((zp->z_pflags & ZFS_AV_QUARANTINED) != 0)) {
	need_policy = TRUE;
	} else {
	XVA_CLR_REQ(xvap, XAT_AV_QUARANTINED);
	XVA_SET_REQ(&tmpxvattr, XAT_AV_QUARANTINED);
	}
	}

	if (XVA_ISSET_REQ(xvap, XAT_REPARSE)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EPERM));
	}

	if (need_policy == FALSE &&
	(XVA_ISSET_REQ(xvap, XAT_AV_SCANSTAMP) \|\|
	XVA_ISSET_REQ(xvap, XAT_OPAQUE))) {
	need_policy = TRUE;
	}
	}

	if (mask & AT_MODE) {
	if (zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr) == 0) {
	err = secpolicy_setid_setsticky_clear(vp, vap,
	&oldva, cr);
	if (err) {
	ZFS_EXIT(zfsvfs);
	return (err);
	}
	trim_mask \|= AT_MODE;
	} else {
	need_policy = TRUE;
	}
	}

	if (need_policy) {
	/*
	* If trim_mask is set then take ownership
	* has been granted or write_acl is present and user
	* has the ability to modify mode. In that case remove
	* UID\|GID and or MODE from mask so that
	* secpolicy_vnode_setattr() doesn't revoke it.
	*/

	if (trim_mask) {
	saved_mask = vap->va_mask;
	vap->va_mask &= ~trim_mask;
	if (trim_mask & AT_MODE) {
	/*
	* Save the mode, as secpolicy_vnode_setattr()
	* will overwrite it with ova.va_mode.
	*/
	saved_mode = vap->va_mode;
	}
	}
	err = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
	(int ()(void , int, cred_t *))zfs_zaccess_unix, zp);
	if (err) {
	ZFS_EXIT(zfsvfs);
	return (err);
	}

	if (trim_mask) {
	vap->va_mask \|= saved_mask;
	if (trim_mask & AT_MODE) {
	/*
	* Recover the mode after
	* secpolicy_vnode_setattr().
	*/
	vap->va_mode = saved_mode;
	}
	}
	}

	/*
	* secpolicy_vnode_setattr, or take ownership may have
	* changed va_mask
	*/
	mask = vap->va_mask;

	if ((mask & (AT_UID \| AT_GID)) \|\| projid != ZFS_INVALID_PROJID) {
	err = sa_lookup(zp->z_sa_hdl, SA_ZPL_XATTR(zfsvfs),
	&xattr_obj, sizeof (xattr_obj));

	if (err == 0 && xattr_obj) {
	err = zfs_zget(zp->z_zfsvfs, xattr_obj, &attrzp);
	if (err == 0) {
	err = vn_lock(ZTOV(attrzp), LK_EXCLUSIVE);
	if (err != 0)
	vrele(ZTOV(attrzp));
	}
	if (err)
	goto out2;
	}
	if (mask & AT_UID) {
	new_uid = zfs_fuid_create(zfsvfs,
	(uint64_t)vap->va_uid, cr, ZFS_OWNER, &fuidp);
	if (new_uid != zp->z_uid &&
	zfs_id_overquota(zfsvfs, DMU_USERUSED_OBJECT,
	new_uid)) {
	if (attrzp)
	vput(ZTOV(attrzp));
	err = SET_ERROR(EDQUOT);
	goto out2;
	}
	}

	if (mask & AT_GID) {
	new_gid = zfs_fuid_create(zfsvfs, (uint64_t)vap->va_gid,
	cr, ZFS_GROUP, &fuidp);
	if (new_gid != zp->z_gid &&
	zfs_id_overquota(zfsvfs, DMU_GROUPUSED_OBJECT,
	new_gid)) {
	if (attrzp)
	vput(ZTOV(attrzp));
	err = SET_ERROR(EDQUOT);
	goto out2;
	}
	}

	if (projid != ZFS_INVALID_PROJID &&
	zfs_id_overquota(zfsvfs, DMU_PROJECTUSED_OBJECT, projid)) {
	if (attrzp)
	vput(ZTOV(attrzp));
	err = SET_ERROR(EDQUOT);
	goto out2;
	}
	}
	tx = dmu_tx_create(os);

	if (mask & AT_MODE) {
	uint64_t pmode = zp->z_mode;
	uint64_t acl_obj;
	new_mode = (pmode & S_IFMT) \| (vap->va_mode & ~S_IFMT);

	if (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED &&
	!(zp->z_pflags & ZFS_ACL_TRIVIAL)) {
	err = SET_ERROR(EPERM);
	goto out;
	}

	if ((err = zfs_acl_chmod_setattr(zp, &aclp, new_mode)))
	goto out;

	if (!zp->z_is_sa && ((acl_obj = zfs_external_acl(zp)) != 0)) {
	/*
	* Are we upgrading ACL from old V0 format
	* to V1 format?
	*/
	if (zfsvfs->z_version >= ZPL_VERSION_FUID &&
	zfs_znode_acl_version(zp) ==
	ZFS_ACL_VERSION_INITIAL) {
	dmu_tx_hold_free(tx, acl_obj, 0,
	DMU_OBJECT_END);
	dmu_tx_hold_write(tx, DMU_NEW_OBJECT,
	0, aclp->z_acl_bytes);
	} else {
	dmu_tx_hold_write(tx, acl_obj, 0,
	aclp->z_acl_bytes);
	}
	} else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) {
	dmu_tx_hold_write(tx, DMU_NEW_OBJECT,
	0, aclp->z_acl_bytes);
	}
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE);
	} else {
	if (((mask & AT_XVATTR) &&
	XVA_ISSET_REQ(xvap, XAT_AV_SCANSTAMP)) \|\|
	(projid != ZFS_INVALID_PROJID &&
	!(zp->z_pflags & ZFS_PROJID)))
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE);
	else
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	}

	if (attrzp) {
	dmu_tx_hold_sa(tx, attrzp->z_sa_hdl, B_FALSE);
	}

	fuid_dirtied = zfsvfs->z_fuid_dirty;
	if (fuid_dirtied)
	zfs_fuid_txhold(zfsvfs, tx);

	zfs_sa_upgrade_txholds(tx, zp);

	err = dmu_tx_assign(tx, TXG_WAIT);
	if (err)
	goto out;

	count = 0;
	/*
	* Set each attribute requested.
	* We group settings according to the locks they need to acquire.
	*
	* Note: you cannot set ctime directly, although it will be
	* updated as a side-effect of calling this function.
	*/

	if (projid != ZFS_INVALID_PROJID && !(zp->z_pflags & ZFS_PROJID)) {
	/*
	* For the existed object that is upgraded from old system,
	* its on-disk layout has no slot for the project ID attribute.
	* But quota accounting logic needs to access related slots by
	* offset directly. So we need to adjust old objects' layout
	* to make the project ID to some unified and fixed offset.
	*/
	if (attrzp)
	err = sa_add_projid(attrzp->z_sa_hdl, tx, projid);
	if (err == 0)
	err = sa_add_projid(zp->z_sa_hdl, tx, projid);

	if (unlikely(err == EEXIST))
	err = 0;
	else if (err != 0)
	goto out;
	else
	projid = ZFS_INVALID_PROJID;
	}

	if (mask & (AT_UID\|AT_GID\|AT_MODE))
	mutex_enter(&zp->z_acl_lock);

	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL,
	&zp->z_pflags, sizeof (zp->z_pflags));

	if (attrzp) {
	if (mask & (AT_UID\|AT_GID\|AT_MODE))
	mutex_enter(&attrzp->z_acl_lock);
	SA_ADD_BULK_ATTR(xattr_bulk, xattr_count,
	SA_ZPL_FLAGS(zfsvfs), NULL, &attrzp->z_pflags,
	sizeof (attrzp->z_pflags));
	if (projid != ZFS_INVALID_PROJID) {
	attrzp->z_projid = projid;
	SA_ADD_BULK_ATTR(xattr_bulk, xattr_count,
	SA_ZPL_PROJID(zfsvfs), NULL, &attrzp->z_projid,
	sizeof (attrzp->z_projid));
	}
	}

	if (mask & (AT_UID\|AT_GID)) {

	if (mask & AT_UID) {
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_UID(zfsvfs), NULL,
	&new_uid, sizeof (new_uid));
	zp->z_uid = new_uid;
	if (attrzp) {
	SA_ADD_BULK_ATTR(xattr_bulk, xattr_count,
	SA_ZPL_UID(zfsvfs), NULL, &new_uid,
	sizeof (new_uid));
	attrzp->z_uid = new_uid;
	}
	}

	if (mask & AT_GID) {
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_GID(zfsvfs),
	NULL, &new_gid, sizeof (new_gid));
	zp->z_gid = new_gid;
	if (attrzp) {
	SA_ADD_BULK_ATTR(xattr_bulk, xattr_count,
	SA_ZPL_GID(zfsvfs), NULL, &new_gid,
	sizeof (new_gid));
	attrzp->z_gid = new_gid;
	}
	}
	if (!(mask & AT_MODE)) {
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs),
	NULL, &new_mode, sizeof (new_mode));
	new_mode = zp->z_mode;
	}
	err = zfs_acl_chown_setattr(zp);
	ASSERT(err == 0);
	if (attrzp) {
	err = zfs_acl_chown_setattr(attrzp);
	ASSERT(err == 0);
	}
	}

	if (mask & AT_MODE) {
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL,
	&new_mode, sizeof (new_mode));
	zp->z_mode = new_mode;
	ASSERT3U((uintptr_t)aclp, !=, 0);
	err = zfs_aclset_common(zp, aclp, cr, tx);
	ASSERT0(err);
	if (zp->z_acl_cached)
	zfs_acl_free(zp->z_acl_cached);
	zp->z_acl_cached = aclp;
	aclp = NULL;
	}


	if (mask & AT_ATIME) {
	ZFS_TIME_ENCODE(&vap->va_atime, zp->z_atime);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ATIME(zfsvfs), NULL,
	&zp->z_atime, sizeof (zp->z_atime));
	}

	if (mask & AT_MTIME) {
	ZFS_TIME_ENCODE(&vap->va_mtime, mtime);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MTIME(zfsvfs), NULL,
	mtime, sizeof (mtime));
	}

	if (projid != ZFS_INVALID_PROJID) {
	zp->z_projid = projid;
	SA_ADD_BULK_ATTR(bulk, count,
	SA_ZPL_PROJID(zfsvfs), NULL, &zp->z_projid,
	sizeof (zp->z_projid));
	}

	/* XXX - shouldn't this be done before the ATIME/MTIME checks? */
	if (mask & AT_SIZE && !(mask & AT_MTIME)) {
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MTIME(zfsvfs),
	NULL, mtime, sizeof (mtime));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL,
	&ctime, sizeof (ctime));
	zfs_tstamp_update_setup(zp, CONTENT_MODIFIED, mtime, ctime);
	} else if (mask != 0) {
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL,
	&ctime, sizeof (ctime));
	zfs_tstamp_update_setup(zp, STATE_CHANGED, mtime, ctime);
	if (attrzp) {
	SA_ADD_BULK_ATTR(xattr_bulk, xattr_count,
	SA_ZPL_CTIME(zfsvfs), NULL,
	&ctime, sizeof (ctime));
	zfs_tstamp_update_setup(attrzp, STATE_CHANGED,
	mtime, ctime);
	}
	}

	/*
	* Do this after setting timestamps to prevent timestamp
	* update from toggling bit
	*/

	if (xoap && (mask & AT_XVATTR)) {

	if (XVA_ISSET_REQ(xvap, XAT_CREATETIME))
	xoap->xoa_createtime = vap->va_birthtime;
	/*
	* restore trimmed off masks
	* so that return masks can be set for caller.
	*/

	if (XVA_ISSET_REQ(&tmpxvattr, XAT_APPENDONLY)) {
	XVA_SET_REQ(xvap, XAT_APPENDONLY);
	}
	if (XVA_ISSET_REQ(&tmpxvattr, XAT_NOUNLINK)) {
	XVA_SET_REQ(xvap, XAT_NOUNLINK);
	}
	if (XVA_ISSET_REQ(&tmpxvattr, XAT_IMMUTABLE)) {
	XVA_SET_REQ(xvap, XAT_IMMUTABLE);
	}
	if (XVA_ISSET_REQ(&tmpxvattr, XAT_NODUMP)) {
	XVA_SET_REQ(xvap, XAT_NODUMP);
	}
	if (XVA_ISSET_REQ(&tmpxvattr, XAT_AV_MODIFIED)) {
	XVA_SET_REQ(xvap, XAT_AV_MODIFIED);
	}
	if (XVA_ISSET_REQ(&tmpxvattr, XAT_AV_QUARANTINED)) {
	XVA_SET_REQ(xvap, XAT_AV_QUARANTINED);
	}
	if (XVA_ISSET_REQ(&tmpxvattr, XAT_PROJINHERIT)) {
	XVA_SET_REQ(xvap, XAT_PROJINHERIT);
	}

	if (XVA_ISSET_REQ(xvap, XAT_AV_SCANSTAMP))
	ASSERT(vp->v_type == VREG);

	zfs_xvattr_set(zp, xvap, tx);
	}

	if (fuid_dirtied)
	zfs_fuid_sync(zfsvfs, tx);

	if (mask != 0)
	zfs_log_setattr(zilog, tx, TX_SETATTR, zp, vap, mask, fuidp);

	if (mask & (AT_UID\|AT_GID\|AT_MODE))
	mutex_exit(&zp->z_acl_lock);

	if (attrzp) {
	if (mask & (AT_UID\|AT_GID\|AT_MODE))
	mutex_exit(&attrzp->z_acl_lock);
	}
	out:
	if (err == 0 && attrzp) {
	err2 = sa_bulk_update(attrzp->z_sa_hdl, xattr_bulk,
	xattr_count, tx);
	ASSERT(err2 == 0);
	}

	if (attrzp)
	vput(ZTOV(attrzp));

	if (aclp)
	zfs_acl_free(aclp);

	if (fuidp) {
	zfs_fuid_info_free(fuidp);
	fuidp = NULL;
	}

	if (err) {
	dmu_tx_abort(tx);
	} else {
	err2 = sa_bulk_update(zp->z_sa_hdl, bulk, count, tx);
	dmu_tx_commit(tx);
	}

	out2:
	if (os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);

	ZFS_EXIT(zfsvfs);
	return (err);
	}

	/*
	* We acquire all but fdvp locks using non-blocking acquisitions. If we
	* fail to acquire any lock in the path we will drop all held locks,
	* acquire the new lock in a blocking fashion, and then release it and
	* restart the rename. This acquire/release step ensures that we do not
	* spin on a lock waiting for release. On error release all vnode locks
	* and decrement references the way tmpfs_rename() would do.
	*/
	static int
	zfs_rename_relock(struct vnode sdvp, struct vnode *svpp,
	struct vnode tdvp, struct vnode *tvpp,
	const struct componentname scnp, const struct componentname tcnp)
	{
	zfsvfs_t *zfsvfs;
	struct vnode nvp, svp, *tvp;
	znode_t sdzp, tdzp, szp, tzp;
	const char *snm = scnp->cn_nameptr;
	const char *tnm = tcnp->cn_nameptr;
	int error;

	VOP_UNLOCK1(tdvp);
	if (tvpp != NULL && tvpp != tdvp)
	VOP_UNLOCK1(*tvpp);

	relock:
	error = vn_lock(sdvp, LK_EXCLUSIVE);
	if (error)
	goto out;
	sdzp = VTOZ(sdvp);

	error = vn_lock(tdvp, LK_EXCLUSIVE \| LK_NOWAIT);
	if (error != 0) {
	VOP_UNLOCK1(sdvp);
	if (error != EBUSY)
	goto out;
	error = vn_lock(tdvp, LK_EXCLUSIVE);
	if (error)
	goto out;
	VOP_UNLOCK1(tdvp);
	goto relock;
	}
	tdzp = VTOZ(tdvp);

	/*
	* Before using sdzp and tdzp we must ensure that they are live.
	* As a porting legacy from illumos we have two things to worry
	* about. One is typical for FreeBSD and it is that the vnode is
	* not reclaimed (doomed). The other is that the znode is live.
	* The current code can invalidate the znode without acquiring the
	* corresponding vnode lock if the object represented by the znode
	* and vnode is no longer valid after a rollback or receive operation.
	* z_teardown_lock hidden behind ZFS_ENTER and ZFS_EXIT is the lock
	* that protects the znodes from the invalidation.
	*/
	zfsvfs = sdzp->z_zfsvfs;
	ASSERT3P(zfsvfs, ==, tdzp->z_zfsvfs);
	ZFS_ENTER(zfsvfs);

	/*
	* We can not use ZFS_VERIFY_ZP() here because it could directly return
	* bypassing the cleanup code in the case of an error.
	*/
	if (tdzp->z_sa_hdl == NULL \|\| sdzp->z_sa_hdl == NULL) {
	ZFS_EXIT(zfsvfs);
	VOP_UNLOCK1(sdvp);
	VOP_UNLOCK1(tdvp);
	error = SET_ERROR(EIO);
	goto out;
	}

	/*
	* Re-resolve svp to be certain it still exists and fetch the
	* correct vnode.
	*/
	error = zfs_dirent_lookup(sdzp, snm, &szp, ZEXISTS);
	if (error != 0) {
	/* Source entry invalid or not there. */
	ZFS_EXIT(zfsvfs);
	VOP_UNLOCK1(sdvp);
	VOP_UNLOCK1(tdvp);
	if ((scnp->cn_flags & ISDOTDOT) != 0 \|\|
	(scnp->cn_namelen == 1 && scnp->cn_nameptr[0] == '.'))
	error = SET_ERROR(EINVAL);
	goto out;
	}
	svp = ZTOV(szp);

	/*
	* Re-resolve tvp, if it disappeared we just carry on.
	*/
	error = zfs_dirent_lookup(tdzp, tnm, &tzp, 0);
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	VOP_UNLOCK1(sdvp);
	VOP_UNLOCK1(tdvp);
	vrele(svp);
	if ((tcnp->cn_flags & ISDOTDOT) != 0)
	error = SET_ERROR(EINVAL);
	goto out;
	}
	if (tzp != NULL)
	tvp = ZTOV(tzp);
	else
	tvp = NULL;

	/*
	* At present the vnode locks must be acquired before z_teardown_lock,
	* although it would be more logical to use the opposite order.
	*/
	ZFS_EXIT(zfsvfs);

	/*
	* Now try acquire locks on svp and tvp.
	*/
	nvp = svp;
	error = vn_lock(nvp, LK_EXCLUSIVE \| LK_NOWAIT);
	if (error != 0) {
	VOP_UNLOCK1(sdvp);
	VOP_UNLOCK1(tdvp);
	if (tvp != NULL)
	vrele(tvp);
	if (error != EBUSY) {
	vrele(nvp);
	goto out;
	}
	error = vn_lock(nvp, LK_EXCLUSIVE);
	if (error != 0) {
	vrele(nvp);
	goto out;
	}
	VOP_UNLOCK1(nvp);
	/*
	* Concurrent rename race.
	* XXX ?
	*/
	if (nvp == tdvp) {
	vrele(nvp);
	error = SET_ERROR(EINVAL);
	goto out;
	}
	vrele(*svpp);
	*svpp = nvp;
	goto relock;
	}
	vrele(*svpp);
	*svpp = nvp;

	if (*tvpp != NULL)
	vrele(*tvpp);
	*tvpp = NULL;
	if (tvp != NULL) {
	nvp = tvp;
	error = vn_lock(nvp, LK_EXCLUSIVE \| LK_NOWAIT);
	if (error != 0) {
	VOP_UNLOCK1(sdvp);
	VOP_UNLOCK1(tdvp);
	VOP_UNLOCK1(*svpp);
	if (error != EBUSY) {
	vrele(nvp);
	goto out;
	}
	error = vn_lock(nvp, LK_EXCLUSIVE);
	if (error != 0) {
	vrele(nvp);
	goto out;
	}
	vput(nvp);
	goto relock;
	}
	*tvpp = nvp;
	}

	return (0);

	out:
	return (error);
	}

	/*
	* Note that we must use VRELE_ASYNC in this function as it walks
	* up the directory tree and vrele may need to acquire an exclusive
	* lock if a last reference to a vnode is dropped.
	*/
	static int
	zfs_rename_check(znode_t szp, znode_t sdzp, znode_t *tdzp)
	{
	zfsvfs_t *zfsvfs;
	znode_t zp, zp1;
	uint64_t parent;
	int error;

	zfsvfs = tdzp->z_zfsvfs;
	if (tdzp == szp)
	return (SET_ERROR(EINVAL));
	if (tdzp == sdzp)
	return (0);
	if (tdzp->z_id == zfsvfs->z_root)
	return (0);
	zp = tdzp;
	for (;;) {
	ASSERT(!zp->z_unlinked);
	if ((error = sa_lookup(zp->z_sa_hdl,
	SA_ZPL_PARENT(zfsvfs), &parent, sizeof (parent))) != 0)
	break;

	if (parent == szp->z_id) {
	error = SET_ERROR(EINVAL);
	break;
	}
	if (parent == zfsvfs->z_root)
	break;
	if (parent == sdzp->z_id)
	break;

	error = zfs_zget(zfsvfs, parent, &zp1);
	if (error != 0)
	break;

	if (zp != tdzp)
	VN_RELE_ASYNC(ZTOV(zp),
	dsl_pool_zrele_taskq(
	dmu_objset_pool(zfsvfs->z_os)));
	zp = zp1;
	}

	if (error == ENOTDIR)
	panic("checkpath: .. not a directory\n");
	if (zp != tdzp)
	VN_RELE_ASYNC(ZTOV(zp),
	dsl_pool_zrele_taskq(dmu_objset_pool(zfsvfs->z_os)));
	return (error);
	}

	/*
	* Move an entry from the provided source directory to the target
	* directory. Change the entry name as indicated.
	*
	* IN: sdvp - Source directory containing the "old entry".
	* snm - Old entry name.
	* tdvp - Target directory to contain the "new entry".
	* tnm - New entry name.
	* cr - credentials of caller.
	* ct - caller context
	* flags - case flags
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* sdvp,tdvp - ctime\|mtime updated
	*/
	/ARGSUSED/
	static int
	zfs_rename_(vnode_t sdvp, vnode_t svpp, struct componentname scnp,
	vnode_t tdvp, vnode_t tvpp, struct componentname tcnp,
	cred_t *cr, int log)
	{
	zfsvfs_t *zfsvfs;
	znode_t sdzp, tdzp, szp, tzp;
	zilog_t *zilog = NULL;
	dmu_tx_t *tx;
	char *snm = scnp->cn_nameptr;
	char *tnm = tcnp->cn_nameptr;
	int error = 0;
	bool want_seqc_end __maybe_unused = false;

	/* Reject renames across filesystems. */
	if ((*svpp)->v_mount != tdvp->v_mount \|\|
	((tvpp) != NULL && (svpp)->v_mount != (*tvpp)->v_mount)) {
	error = SET_ERROR(EXDEV);
	goto out;
	}

	if (zfsctl_is_node(tdvp)) {
	error = SET_ERROR(EXDEV);
	goto out;
	}

	/*
	* Lock all four vnodes to ensure safety and semantics of renaming.
	*/
	error = zfs_rename_relock(sdvp, svpp, tdvp, tvpp, scnp, tcnp);
	if (error != 0) {
	/* no vnodes are locked in the case of error here */
	return (error);
	}

	tdzp = VTOZ(tdvp);
	sdzp = VTOZ(sdvp);
	zfsvfs = tdzp->z_zfsvfs;
	zilog = zfsvfs->z_log;

	/*
	* After we re-enter ZFS_ENTER() we will have to revalidate all
	* znodes involved.
	*/
	ZFS_ENTER(zfsvfs);

	if (zfsvfs->z_utf8 && u8_validate(tnm,
	strlen(tnm), NULL, U8_VALIDATE_ENTIRE, &error) < 0) {
	error = SET_ERROR(EILSEQ);
	goto unlockout;
	}

	/* If source and target are the same file, there is nothing to do. */
	if ((svpp) == (tvpp)) {
	error = 0;
	goto unlockout;
	}

	if (((svpp)->v_type == VDIR && (svpp)->v_mountedhere != NULL) \|\|
	((tvpp) != NULL && (tvpp)->v_type == VDIR &&
	(*tvpp)->v_mountedhere != NULL)) {
	error = SET_ERROR(EXDEV);
	goto unlockout;
	}

	/*
	* We can not use ZFS_VERIFY_ZP() here because it could directly return
	* bypassing the cleanup code in the case of an error.
	*/
	if (tdzp->z_sa_hdl == NULL \|\| sdzp->z_sa_hdl == NULL) {
	error = SET_ERROR(EIO);
	goto unlockout;
	}

	szp = VTOZ(*svpp);
	tzp = tvpp == NULL ? NULL : VTOZ(tvpp);
	if (szp->z_sa_hdl == NULL \|\| (tzp != NULL && tzp->z_sa_hdl == NULL)) {
	error = SET_ERROR(EIO);
	goto unlockout;
	}

	/*
	* This is to prevent the creation of links into attribute space
	* by renaming a linked file into/outof an attribute directory.
	* See the comment in zfs_link() for why this is considered bad.
	*/
	if ((tdzp->z_pflags & ZFS_XATTR) != (sdzp->z_pflags & ZFS_XATTR)) {
	error = SET_ERROR(EINVAL);
	goto unlockout;
	}

	/*
	* If we are using project inheritance, means if the directory has
	* ZFS_PROJINHERIT set, then its descendant directories will inherit
	* not only the project ID, but also the ZFS_PROJINHERIT flag. Under
	* such case, we only allow renames into our tree when the project
	* IDs are the same.
	*/
	if (tdzp->z_pflags & ZFS_PROJINHERIT &&
	tdzp->z_projid != szp->z_projid) {
	error = SET_ERROR(EXDEV);
	goto unlockout;
	}

	/*
	* Must have write access at the source to remove the old entry
	* and write access at the target to create the new entry.
	* Note that if target and source are the same, this can be
	* done in a single check.
	*/
	if ((error = zfs_zaccess_rename(sdzp, szp, tdzp, tzp, cr)))
	goto unlockout;

	if ((*svpp)->v_type == VDIR) {
	/*
	* Avoid ".", "..", and aliases of "." for obvious reasons.
	*/
	if ((scnp->cn_namelen == 1 && scnp->cn_nameptr[0] == '.') \|\|
	sdzp == szp \|\|
	(scnp->cn_flags \| tcnp->cn_flags) & ISDOTDOT) {
	error = EINVAL;
	goto unlockout;
	}

	/*
	* Check to make sure rename is valid.
	* Can't do a move like this: /usr/a/b to /usr/a/b/c/d
	*/
	if ((error = zfs_rename_check(szp, sdzp, tdzp)))
	goto unlockout;
	}

	/*
	* Does target exist?
	*/
	if (tzp) {
	/*
	* Source and target must be the same type.
	*/
	if ((*svpp)->v_type == VDIR) {
	if ((*tvpp)->v_type != VDIR) {
	error = SET_ERROR(ENOTDIR);
	goto unlockout;
	} else {
	cache_purge(tdvp);
	if (sdvp != tdvp)
	cache_purge(sdvp);
	}
	} else {
	if ((*tvpp)->v_type == VDIR) {
	error = SET_ERROR(EISDIR);
	goto unlockout;
	}
	}
	}

	vn_seqc_write_begin(*svpp);
	vn_seqc_write_begin(sdvp);
	if (*tvpp != NULL)
	vn_seqc_write_begin(*tvpp);
	if (tdvp != *tvpp)
	vn_seqc_write_begin(tdvp);
	#if __FreeBSD_version >= 1300102
	want_seqc_end = true;
	#endif
	vnevent_rename_src(*svpp, sdvp, scnp->cn_nameptr, ct);
	if (tzp)
	vnevent_rename_dest(*tvpp, tdvp, tnm, ct);

	/*
	* notify the target directory if it is not the same
	* as source directory.
	*/
	if (tdvp != sdvp) {
	vnevent_rename_dest_dir(tdvp, ct);
	}

	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_sa(tx, szp->z_sa_hdl, B_FALSE);
	dmu_tx_hold_sa(tx, sdzp->z_sa_hdl, B_FALSE);
	dmu_tx_hold_zap(tx, sdzp->z_id, FALSE, snm);
	dmu_tx_hold_zap(tx, tdzp->z_id, TRUE, tnm);
	if (sdzp != tdzp) {
	dmu_tx_hold_sa(tx, tdzp->z_sa_hdl, B_FALSE);
	zfs_sa_upgrade_txholds(tx, tdzp);
	}
	if (tzp) {
	dmu_tx_hold_sa(tx, tzp->z_sa_hdl, B_FALSE);
	zfs_sa_upgrade_txholds(tx, tzp);
	}

	zfs_sa_upgrade_txholds(tx, szp);
	dmu_tx_hold_zap(tx, zfsvfs->z_unlinkedobj, FALSE, NULL);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	goto unlockout;
	}


	if (tzp) /* Attempt to remove the existing target */
	error = zfs_link_destroy(tdzp, tnm, tzp, tx, 0, NULL);

	if (error == 0) {
	error = zfs_link_create(tdzp, tnm, szp, tx, ZRENAMING);
	if (error == 0) {
	szp->z_pflags \|= ZFS_AV_MODIFIED;

	error = sa_update(szp->z_sa_hdl, SA_ZPL_FLAGS(zfsvfs),
	(void *)&szp->z_pflags, sizeof (uint64_t), tx);
	ASSERT0(error);

	error = zfs_link_destroy(sdzp, snm, szp, tx, ZRENAMING,
	NULL);
	if (error == 0) {
	zfs_log_rename(zilog, tx, TX_RENAME, sdzp,
	snm, tdzp, tnm, szp);

	/*
	* Update path information for the target vnode
	*/
	vn_renamepath(tdvp, *svpp, tnm, strlen(tnm));
	} else {
	/*
	* At this point, we have successfully created
	* the target name, but have failed to remove
	* the source name. Since the create was done
	* with the ZRENAMING flag, there are
	* complications; for one, the link count is
	* wrong. The easiest way to deal with this
	* is to remove the newly created target, and
	* return the original error. This must
	* succeed; fortunately, it is very unlikely to
	* fail, since we just created it.
	*/
	VERIFY3U(zfs_link_destroy(tdzp, tnm, szp, tx,
	ZRENAMING, NULL), ==, 0);
	}
	}
	if (error == 0) {
	cache_purge(*svpp);
	if (*tvpp != NULL)
	cache_purge(*tvpp);
	cache_purge_negative(tdvp);
	}
	}

	dmu_tx_commit(tx);

	unlockout: /* all 4 vnodes are locked, ZFS_ENTER called */
	ZFS_EXIT(zfsvfs);
	if (want_seqc_end) {
	vn_seqc_write_end(*svpp);
	vn_seqc_write_end(sdvp);
	if (*tvpp != NULL)
	vn_seqc_write_end(*tvpp);
	if (tdvp != *tvpp)
	vn_seqc_write_end(tdvp);
	want_seqc_end = false;
	}
	VOP_UNLOCK1(*svpp);
	VOP_UNLOCK1(sdvp);

	out: /* original two vnodes are locked */
	MPASS(!want_seqc_end);
	if (error == 0 && zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);

	if (*tvpp != NULL)
	VOP_UNLOCK1(*tvpp);
	if (tdvp != *tvpp)
	VOP_UNLOCK1(tdvp);
	return (error);
	}

	int
	zfs_rename(znode_t sdzp, char sname, znode_t tdzp, char tname,
	cred_t *cr, int flags)
	{
	struct componentname scn, tcn;
	vnode_t sdvp, tdvp;
	vnode_t svp, tvp;
	int error;
	svp = tvp = NULL;

	sdvp = ZTOV(sdzp);
	tdvp = ZTOV(tdzp);
	error = zfs_lookup_internal(sdzp, sname, &svp, &scn, DELETE);
	if (sdzp->z_zfsvfs->z_replay == B_FALSE)
	VOP_UNLOCK1(sdvp);
	if (error != 0)
	goto fail;
	VOP_UNLOCK1(svp);

	vn_lock(tdvp, LK_EXCLUSIVE \| LK_RETRY);
	error = zfs_lookup_internal(tdzp, tname, &tvp, &tcn, RENAME);
	if (error == EJUSTRETURN)
	tvp = NULL;
	else if (error != 0) {
	VOP_UNLOCK1(tdvp);
	goto fail;
	}

	error = zfs_rename_(sdvp, &svp, &scn, tdvp, &tvp, &tcn, cr, 0);
	fail:
	if (svp != NULL)
	vrele(svp);
	if (tvp != NULL)
	vrele(tvp);

	return (error);
	}

	/*
	* Insert the indicated symbolic reference entry into the directory.
	*
	* IN: dvp - Directory to contain new symbolic link.
	* link - Name for new symlink entry.
	* vap - Attributes of new entry.
	* cr - credentials of caller.
	* ct - caller context
	* flags - case flags
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* dvp - ctime\|mtime updated
	*/
	/ARGSUSED/
	int
	zfs_symlink(znode_t dzp, const char name, vattr_t *vap,
	const char link, znode_t zpp, cred_t cr, int flags)
	{
	znode_t *zp;
	dmu_tx_t *tx;
	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
	zilog_t *zilog;
	uint64_t len = strlen(link);
	int error;
	zfs_acl_ids_t acl_ids;
	boolean_t fuid_dirtied;
	uint64_t txtype = TX_SYMLINK;

	ASSERT(vap->va_type == VLNK);

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(dzp);
	zilog = zfsvfs->z_log;

	if (zfsvfs->z_utf8 && u8_validate(name, strlen(name),
	NULL, U8_VALIDATE_ENTIRE, &error) < 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EILSEQ));
	}

	if (len > MAXPATHLEN) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(ENAMETOOLONG));
	}

	if ((error = zfs_acl_ids_create(dzp, 0,
	vap, cr, NULL, &acl_ids)) != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Attempt to lock directory; fail if entry already exists.
	*/
	error = zfs_dirent_lookup(dzp, name, &zp, ZNEW);
	if (error) {
	zfs_acl_ids_free(&acl_ids);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	if ((error = zfs_zaccess(dzp, ACE_ADD_FILE, 0, B_FALSE, cr))) {
	zfs_acl_ids_free(&acl_ids);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	if (zfs_acl_ids_overquota(zfsvfs, &acl_ids,
	0 /* projid */)) {
	zfs_acl_ids_free(&acl_ids);
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EDQUOT));
	}

	getnewvnode_reserve_();
	tx = dmu_tx_create(zfsvfs->z_os);
	fuid_dirtied = zfsvfs->z_fuid_dirty;
	dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, MAX(1, len));
	dmu_tx_hold_zap(tx, dzp->z_id, TRUE, name);
	dmu_tx_hold_sa_create(tx, acl_ids.z_aclp->z_acl_bytes +
	ZFS_SA_BASE_ATTR_SIZE + len);
	dmu_tx_hold_sa(tx, dzp->z_sa_hdl, B_FALSE);
	if (!zfsvfs->z_use_sa && acl_ids.z_aclp->z_acl_bytes > ZFS_ACE_SPACE) {
	dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
	acl_ids.z_aclp->z_acl_bytes);
	}
	if (fuid_dirtied)
	zfs_fuid_txhold(zfsvfs, tx);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	zfs_acl_ids_free(&acl_ids);
	dmu_tx_abort(tx);
	getnewvnode_drop_reserve();
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Create a new object for the symlink.
	* for version 4 ZPL datsets the symlink will be an SA attribute
	*/
	zfs_mknode(dzp, vap, tx, cr, 0, &zp, &acl_ids);

	if (fuid_dirtied)
	zfs_fuid_sync(zfsvfs, tx);

	if (zp->z_is_sa)
	error = sa_update(zp->z_sa_hdl, SA_ZPL_SYMLINK(zfsvfs),
	__DECONST(void *, link), len, tx);
	else
	zfs_sa_symlink(zp, __DECONST(char *, link), len, tx);

	zp->z_size = len;
	(void) sa_update(zp->z_sa_hdl, SA_ZPL_SIZE(zfsvfs),
	&zp->z_size, sizeof (zp->z_size), tx);
	/*
	* Insert the new object into the directory.
	*/
	(void) zfs_link_create(dzp, name, zp, tx, ZNEW);

	zfs_log_symlink(zilog, tx, txtype, dzp, zp,
	__DECONST(char , name), __DECONST(char , link));
	*zpp = zp;

	zfs_acl_ids_free(&acl_ids);

	dmu_tx_commit(tx);

	getnewvnode_drop_reserve();

	if (zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Return, in the buffer contained in the provided uio structure,
	* the symbolic path referred to by vp.
	*
	* IN: vp - vnode of symbolic link.
	* uio - structure to contain the link path.
	* cr - credentials of caller.
	* ct - caller context
	*
	* OUT: uio - structure containing the link path.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* vp - atime updated
	*/
	/* ARGSUSED */
	static int
	zfs_readlink(vnode_t vp, uio_t uio, cred_t cr, caller_context_t ct)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	int error;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	if (zp->z_is_sa)
	error = sa_lookup_uio(zp->z_sa_hdl,
	SA_ZPL_SYMLINK(zfsvfs), uio);
	else
	error = zfs_sa_readlink(zp, uio);

	ZFS_ACCESSTIME_STAMP(zfsvfs, zp);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Insert a new entry into directory tdvp referencing svp.
	*
	* IN: tdvp - Directory to contain new entry.
	* svp - vnode of new entry.
	* name - name of new entry.
	* cr - credentials of caller.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* tdvp - ctime\|mtime updated
	* svp - ctime updated
	*/
	/* ARGSUSED */
	int
	zfs_link(znode_t tdzp, znode_t szp, char name, cred_t cr,
	int flags)
	{
	znode_t *tzp;
	zfsvfs_t *zfsvfs = tdzp->z_zfsvfs;
	zilog_t *zilog;
	dmu_tx_t *tx;
	int error;
	uint64_t parent;
	uid_t owner;

	ASSERT(ZTOV(tdzp)->v_type == VDIR);

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(tdzp);
	zilog = zfsvfs->z_log;

	/*
	* POSIX dictates that we return EPERM here.
	* Better choices include ENOTSUP or EISDIR.
	*/
	if (ZTOV(szp)->v_type == VDIR) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EPERM));
	}

	ZFS_VERIFY_ZP(szp);

	/*
	* If we are using project inheritance, means if the directory has
	* ZFS_PROJINHERIT set, then its descendant directories will inherit
	* not only the project ID, but also the ZFS_PROJINHERIT flag. Under
	* such case, we only allow hard link creation in our tree when the
	* project IDs are the same.
	*/
	if (tdzp->z_pflags & ZFS_PROJINHERIT &&
	tdzp->z_projid != szp->z_projid) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EXDEV));
	}

	if (szp->z_pflags & (ZFS_APPENDONLY \|
	ZFS_IMMUTABLE \| ZFS_READONLY)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EPERM));
	}

	/* Prevent links to .zfs/shares files */

	if ((error = sa_lookup(szp->z_sa_hdl, SA_ZPL_PARENT(zfsvfs),
	&parent, sizeof (uint64_t))) != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	if (parent == zfsvfs->z_shares_dir) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EPERM));
	}

	if (zfsvfs->z_utf8 && u8_validate(name,
	strlen(name), NULL, U8_VALIDATE_ENTIRE, &error) < 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EILSEQ));
	}

	/*
	* We do not support links between attributes and non-attributes
	* because of the potential security risk of creating links
	* into "normal" file space in order to circumvent restrictions
	* imposed in attribute space.
	*/
	if ((szp->z_pflags & ZFS_XATTR) != (tdzp->z_pflags & ZFS_XATTR)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}


	owner = zfs_fuid_map_id(zfsvfs, szp->z_uid, cr, ZFS_OWNER);
	if (owner != crgetuid(cr) && secpolicy_basic_link(ZTOV(szp), cr) != 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EPERM));
	}

	if ((error = zfs_zaccess(tdzp, ACE_ADD_FILE, 0, B_FALSE, cr))) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Attempt to lock directory; fail if entry already exists.
	*/
	error = zfs_dirent_lookup(tdzp, name, &tzp, ZNEW);
	if (error) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_sa(tx, szp->z_sa_hdl, B_FALSE);
	dmu_tx_hold_zap(tx, tdzp->z_id, TRUE, name);
	zfs_sa_upgrade_txholds(tx, szp);
	zfs_sa_upgrade_txholds(tx, tdzp);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	error = zfs_link_create(tdzp, name, szp, tx, 0);

	if (error == 0) {
	uint64_t txtype = TX_LINK;
	zfs_log_link(zilog, tx, txtype, tdzp, szp, name);
	}

	dmu_tx_commit(tx);

	if (error == 0) {
	vnevent_link(ZTOV(szp), ct);
	}

	if (zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Free or allocate space in a file. Currently, this function only
	* supports the `F_FREESP' command. However, this command is somewhat
	* misnamed, as its functionality includes the ability to allocate as
	* well as free space.
	*
	* IN: ip - inode of file to free data in.
	* cmd - action to take (only F_FREESP supported).
	* bfp - section of file to free/alloc.
	* flag - current file open mode flags.
	* offset - current file offset.
	* cr - credentials of caller.
	*
	* RETURN: 0 on success, error code on failure.
	*
	* Timestamps:
	* ip - ctime\|mtime updated
	*/
	/* ARGSUSED */
	int
	zfs_space(znode_t zp, int cmd, flock64_t bfp, int flag,
	offset_t offset, cred_t *cr)
	{
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	uint64_t off, len;
	int error;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	if (cmd != F_FREESP) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	/*
	* Callers might not be able to detect properly that we are read-only,
	* so check it explicitly here.
	*/
	if (zfs_is_readonly(zfsvfs)) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EROFS));
	}

	if (bfp->l_len < 0) {
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(EINVAL));
	}

	/*
	* Permissions aren't checked on Solaris because on this OS
	* zfs_space() can only be called with an opened file handle.
	* On Linux we can get here through truncate_range() which
	* operates directly on inodes, so we need to check access rights.
	*/
	if ((error = zfs_zaccess(zp, ACE_WRITE_DATA, 0, B_FALSE, cr))) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	off = bfp->l_start;
	len = bfp->l_len; /* 0 means from off to end of file */

	error = zfs_freesp(zp, off, len, flag, TRUE);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/ARGSUSED/
	static void
	zfs_inactive(vnode_t vp, cred_t cr, caller_context_t *ct)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	int error;

	- rw_enter(&zfsvfs->z_teardown_inactive_lock, RW_READER);
	+ ZFS_RLOCK_TEARDOWN_INACTIVE(zfsvfs);
	if (zp->z_sa_hdl == NULL) {
	/*
	* The fs has been unmounted, or we did a
	* suspend/resume and this file no longer exists.
	*/
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_RUNLOCK_TEARDOWN_INACTIVE(zfsvfs);
	vrecycle(vp);
	return;
	}

	if (zp->z_unlinked) {
	/*
	* Fast path to recycle a vnode of a removed file.
	*/
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_RUNLOCK_TEARDOWN_INACTIVE(zfsvfs);
	vrecycle(vp);
	return;
	}

	if (zp->z_atime_dirty && zp->z_unlinked == 0) {
	dmu_tx_t *tx = dmu_tx_create(zfsvfs->z_os);

	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	zfs_sa_upgrade_txholds(tx, zp);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	} else {
	(void) sa_update(zp->z_sa_hdl, SA_ZPL_ATIME(zfsvfs),
	(void *)&zp->z_atime, sizeof (zp->z_atime), tx);
	zp->z_atime_dirty = 0;
	dmu_tx_commit(tx);
	}
	}
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_RUNLOCK_TEARDOWN_INACTIVE(zfsvfs);
	}


	CTASSERT(sizeof (struct zfid_short) <= sizeof (struct fid));
	CTASSERT(sizeof (struct zfid_long) <= sizeof (struct fid));

	/ARGSUSED/
	static int
	zfs_fid(vnode_t vp, fid_t fidp, caller_context_t *ct)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	uint32_t gen;
	uint64_t gen64;
	uint64_t object = zp->z_id;
	zfid_short_t *zfid;
	int size, i, error;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_GEN(zfsvfs),
	&gen64, sizeof (uint64_t))) != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	gen = (uint32_t)gen64;

	size = (zfsvfs->z_parent != zfsvfs) ? LONG_FID_LEN : SHORT_FID_LEN;
	fidp->fid_len = size;

	zfid = (zfid_short_t *)fidp;

	zfid->zf_len = size;

	for (i = 0; i < sizeof (zfid->zf_object); i++)
	zfid->zf_object[i] = (uint8_t)(object >> (8 * i));

	/* Must have a non-zero generation number to distinguish from .zfs */
	if (gen == 0)
	gen = 1;
	for (i = 0; i < sizeof (zfid->zf_gen); i++)
	zfid->zf_gen[i] = (uint8_t)(gen >> (8 * i));

	if (size == LONG_FID_LEN) {
	uint64_t objsetid = dmu_objset_id(zfsvfs->z_os);
	zfid_long_t *zlfid;

	zlfid = (zfid_long_t *)fidp;

	for (i = 0; i < sizeof (zlfid->zf_setid); i++)
	zlfid->zf_setid[i] = (uint8_t)(objsetid >> (8 * i));

	/* XXX - this should be the generation number for the objset */
	for (i = 0; i < sizeof (zlfid->zf_setgen); i++)
	zlfid->zf_setgen[i] = 0;
	}

	ZFS_EXIT(zfsvfs);
	return (0);
	}

	static int
	zfs_pathconf(vnode_t vp, int cmd, ulong_t valp, cred_t *cr,
	caller_context_t *ct)
	{

	switch (cmd) {
	case _PC_LINK_MAX:
	*valp = MIN(LONG_MAX, ZFS_LINK_MAX);
	return (0);

	case _PC_FILESIZEBITS:
	*valp = 64;
	return (0);
	case _PC_MIN_HOLE_SIZE:
	*valp = (int)SPA_MINBLOCKSIZE;
	return (0);
	case _PC_ACL_EXTENDED:
	*valp = 0;
	return (0);

	case _PC_ACL_NFS4:
	*valp = 1;
	return (0);

	case _PC_ACL_PATH_MAX:
	*valp = ACL_MAX_ENTRIES;
	return (0);

	default:
	return (EOPNOTSUPP);
	}
	}

	/ARGSUSED/
	static int
	zfs_getsecattr(vnode_t vp, vsecattr_t vsecp, int flag, cred_t *cr,
	caller_context_t *ct)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	int error;
	boolean_t skipaclchk = (flag & ATTR_NOACLCHECK) ? B_TRUE : B_FALSE;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);
	error = zfs_getacl(zp, vsecp, skipaclchk, cr);
	ZFS_EXIT(zfsvfs);

	return (error);
	}

	/ARGSUSED/
	int
	zfs_setsecattr(znode_t zp, vsecattr_t vsecp, int flag, cred_t *cr)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	int error;
	boolean_t skipaclchk = (flag & ATTR_NOACLCHECK) ? B_TRUE : B_FALSE;
	zilog_t *zilog = zfsvfs->z_log;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	error = zfs_setacl(zp, vsecp, skipaclchk, cr);

	if (zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zilog, 0);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	static int
	zfs_getpages(struct vnode vp, vm_page_t ma, int count, int *rbehind,
	int *rahead)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	objset_t *os = zp->z_zfsvfs->z_os;
	zfs_locked_range_t *lr;
	vm_object_t object;
	off_t start, end, obj_size;
	uint_t blksz;
	int pgsin_b, pgsin_a;
	int error;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	start = IDX_TO_OFF(ma[0]->pindex);
	end = IDX_TO_OFF(ma[count - 1]->pindex + 1);

	/*
	* Lock a range covering all required and optional pages.
	* Note that we need to handle the case of the block size growing.
	*/
	for (;;) {
	blksz = zp->z_blksz;
	lr = zfs_rangelock_tryenter(&zp->z_rangelock,
	rounddown(start, blksz),
	roundup(end, blksz) - rounddown(start, blksz), RL_READER);
	if (lr == NULL) {
	if (rahead != NULL) {
	*rahead = 0;
	rahead = NULL;
	}
	if (rbehind != NULL) {
	*rbehind = 0;
	rbehind = NULL;
	}
	break;
	}
	if (blksz == zp->z_blksz)
	break;
	zfs_rangelock_exit(lr);
	}

	object = ma[0]->object;
	zfs_vmobject_wlock(object);
	obj_size = object->un_pager.vnp.vnp_size;
	zfs_vmobject_wunlock(object);
	if (IDX_TO_OFF(ma[count - 1]->pindex) >= obj_size) {
	zfs_rangelock_exit(lr);
	ZFS_EXIT(zfsvfs);
	return (zfs_vm_pagerret_bad);
	}

	pgsin_b = 0;
	if (rbehind != NULL) {
	pgsin_b = OFF_TO_IDX(start - rounddown(start, blksz));
	pgsin_b = MIN(*rbehind, pgsin_b);
	}

	pgsin_a = 0;
	if (rahead != NULL) {
	pgsin_a = OFF_TO_IDX(roundup(end, blksz) - end);
	if (end + IDX_TO_OFF(pgsin_a) >= obj_size)
	pgsin_a = OFF_TO_IDX(round_page(obj_size) - end);
	pgsin_a = MIN(*rahead, pgsin_a);
	}

	/*
	* NB: we need to pass the exact byte size of the data that we expect
	* to read after accounting for the file size. This is required because
	* ZFS will panic if we request DMU to read beyond the end of the last
	* allocated block.
	*/
	error = dmu_read_pages(os, zp->z_id, ma, count, &pgsin_b, &pgsin_a,
	MIN(end, obj_size) - (end - PAGE_SIZE));

	zfs_rangelock_exit(lr);
	ZFS_ACCESSTIME_STAMP(zfsvfs, zp);
	ZFS_EXIT(zfsvfs);

	if (error != 0)
	return (zfs_vm_pagerret_error);

	VM_CNT_INC(v_vnodein);
	VM_CNT_ADD(v_vnodepgsin, count + pgsin_b + pgsin_a);
	if (rbehind != NULL)
	*rbehind = pgsin_b;
	if (rahead != NULL)
	*rahead = pgsin_a;
	return (zfs_vm_pagerret_ok);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_getpages_args {
	struct vnode *a_vp;
	vm_page_t *a_m;
	int a_count;
	int *a_rbehind;
	int *a_rahead;
	};
	#endif

	static int
	zfs_freebsd_getpages(struct vop_getpages_args *ap)
	{

	return (zfs_getpages(ap->a_vp, ap->a_m, ap->a_count, ap->a_rbehind,
	ap->a_rahead));
	}

	static int
	zfs_putpages(struct vnode vp, vm_page_t ma, size_t len, int flags,
	int *rtvals)
	{
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	zfs_locked_range_t *lr;
	dmu_tx_t *tx;
	struct sf_buf *sf;
	vm_object_t object;
	vm_page_t m;
	caddr_t va;
	size_t tocopy;
	size_t lo_len;
	vm_ooffset_t lo_off;
	vm_ooffset_t off;
	uint_t blksz;
	int ncount;
	int pcount;
	int err;
	int i;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	object = vp->v_object;
	pcount = btoc(len);
	ncount = pcount;

	KASSERT(ma[0]->object == object, ("mismatching object"));
	KASSERT(len > 0 && (len & PAGE_MASK) == 0, ("unexpected length"));

	for (i = 0; i < pcount; i++)
	rtvals[i] = zfs_vm_pagerret_error;

	off = IDX_TO_OFF(ma[0]->pindex);
	blksz = zp->z_blksz;
	lo_off = rounddown(off, blksz);
	lo_len = roundup(len + (off - lo_off), blksz);
	lr = zfs_rangelock_enter(&zp->z_rangelock, lo_off, lo_len, RL_WRITER);

	zfs_vmobject_wlock(object);
	if (len + off > object->un_pager.vnp.vnp_size) {
	if (object->un_pager.vnp.vnp_size > off) {
	int pgoff;

	len = object->un_pager.vnp.vnp_size - off;
	ncount = btoc(len);
	if ((pgoff = (int)len & PAGE_MASK) != 0) {
	/*
	* If the object is locked and the following
	* conditions hold, then the page's dirty
	* field cannot be concurrently changed by a
	* pmap operation.
	*/
	m = ma[ncount - 1];
	vm_page_assert_sbusied(m);
	KASSERT(!pmap_page_is_write_mapped(m),
	("zfs_putpages: page %p is not read-only",
	m));
	vm_page_clear_dirty(m, pgoff, PAGE_SIZE -
	pgoff);
	}
	} else {
	len = 0;
	ncount = 0;
	}
	if (ncount < pcount) {
	for (i = ncount; i < pcount; i++) {
	rtvals[i] = zfs_vm_pagerret_bad;
	}
	}
	}
	zfs_vmobject_wunlock(object);

	if (ncount == 0)
	goto out;

	if (zfs_id_overblockquota(zfsvfs, DMU_USERUSED_OBJECT, zp->z_uid) \|\|
	zfs_id_overblockquota(zfsvfs, DMU_GROUPUSED_OBJECT, zp->z_gid) \|\|
	(zp->z_projid != ZFS_DEFAULT_PROJID &&
	zfs_id_overblockquota(zfsvfs, DMU_PROJECTUSED_OBJECT,
	zp->z_projid))) {
	goto out;
	}

	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_write(tx, zp->z_id, off, len);

	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	zfs_sa_upgrade_txholds(tx, zp);
	err = dmu_tx_assign(tx, TXG_WAIT);
	if (err != 0) {
	dmu_tx_abort(tx);
	goto out;
	}

	if (zp->z_blksz < PAGE_SIZE) {
	for (i = 0; len > 0; off += tocopy, len -= tocopy, i++) {
	tocopy = len > PAGE_SIZE ? PAGE_SIZE : len;
	va = zfs_map_page(ma[i], &sf);
	dmu_write(zfsvfs->z_os, zp->z_id, off, tocopy, va, tx);
	zfs_unmap_page(sf);
	}
	} else {
	err = dmu_write_pages(zfsvfs->z_os, zp->z_id, off, len, ma, tx);
	}

	if (err == 0) {
	uint64_t mtime[2], ctime[2];
	sa_bulk_attr_t bulk[3];
	int count = 0;

	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MTIME(zfsvfs), NULL,
	&mtime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL,
	&ctime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL,
	&zp->z_pflags, 8);
	zfs_tstamp_update_setup(zp, CONTENT_MODIFIED, mtime, ctime);
	err = sa_bulk_update(zp->z_sa_hdl, bulk, count, tx);
	ASSERT0(err);
	/*
	* XXX we should be passing a callback to undirty
	* but that would make the locking messier
	*/
	zfs_log_write(zfsvfs->z_log, tx, TX_WRITE, zp, off,
	len, 0, NULL, NULL);

	zfs_vmobject_wlock(object);
	for (i = 0; i < ncount; i++) {
	rtvals[i] = zfs_vm_pagerret_ok;
	vm_page_undirty(ma[i]);
	}
	zfs_vmobject_wunlock(object);
	VM_CNT_INC(v_vnodeout);
	VM_CNT_ADD(v_vnodepgsout, ncount);
	}
	dmu_tx_commit(tx);

	out:
	zfs_rangelock_exit(lr);
	if ((flags & (zfs_vm_pagerput_sync \| zfs_vm_pagerput_inval)) != 0 \|\|
	zfsvfs->z_os->os_sync == ZFS_SYNC_ALWAYS)
	zil_commit(zfsvfs->z_log, zp->z_id);
	ZFS_EXIT(zfsvfs);
	return (rtvals[0]);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_putpages_args {
	struct vnode *a_vp;
	vm_page_t *a_m;
	int a_count;
	int a_sync;
	int *a_rtvals;
	};
	#endif

	static int
	zfs_freebsd_putpages(struct vop_putpages_args *ap)
	{

	return (zfs_putpages(ap->a_vp, ap->a_m, ap->a_count, ap->a_sync,
	ap->a_rtvals));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_bmap_args {
	struct vnode *a_vp;
	daddr_t a_bn;
	struct bufobj **a_bop;
	daddr_t *a_bnp;
	int *a_runp;
	int *a_runb;
	};
	#endif

	static int
	zfs_freebsd_bmap(struct vop_bmap_args *ap)
	{

	if (ap->a_bop != NULL)
	*ap->a_bop = &ap->a_vp->v_bufobj;
	if (ap->a_bnp != NULL)
	*ap->a_bnp = ap->a_bn;
	if (ap->a_runp != NULL)
	*ap->a_runp = 0;
	if (ap->a_runb != NULL)
	*ap->a_runb = 0;

	return (0);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_open_args {
	struct vnode *a_vp;
	int a_mode;
	struct ucred *a_cred;
	struct thread *a_td;
	};
	#endif

	static int
	zfs_freebsd_open(struct vop_open_args *ap)
	{
	vnode_t *vp = ap->a_vp;
	znode_t *zp = VTOZ(vp);
	int error;

	error = zfs_open(&vp, ap->a_mode, ap->a_cred);
	if (error == 0)
	vnode_create_vobject(vp, zp->z_size, ap->a_td);
	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_close_args {
	struct vnode *a_vp;
	int a_fflag;
	struct ucred *a_cred;
	struct thread *a_td;
	};
	#endif

	static int
	zfs_freebsd_close(struct vop_close_args *ap)
	{

	return (zfs_close(ap->a_vp, ap->a_fflag, 1, 0, ap->a_cred));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_ioctl_args {
	struct vnode *a_vp;
	ulong_t a_command;
	caddr_t a_data;
	int a_fflag;
	struct ucred *cred;
	struct thread *td;
	};
	#endif

	static int
	zfs_freebsd_ioctl(struct vop_ioctl_args *ap)
	{

	return (zfs_ioctl(ap->a_vp, ap->a_command, (intptr_t)ap->a_data,
	ap->a_fflag, ap->a_cred, NULL));
	}

	static int
	ioflags(int ioflags)
	{
	int flags = 0;

	if (ioflags & IO_APPEND)
	flags \|= FAPPEND;
	if (ioflags & IO_NDELAY)
	flags \|= FNONBLOCK;
	if (ioflags & IO_SYNC)
	flags \|= (FSYNC \| FDSYNC \| FRSYNC);

	return (flags);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_read_args {
	struct vnode *a_vp;
	struct uio *a_uio;
	int a_ioflag;
	struct ucred *a_cred;
	};
	#endif

	static int
	zfs_freebsd_read(struct vop_read_args *ap)
	{

	return (zfs_read(ap->a_vp, ap->a_uio, ioflags(ap->a_ioflag),
	ap->a_cred));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_write_args {
	struct vnode *a_vp;
	struct uio *a_uio;
	int a_ioflag;
	struct ucred *a_cred;
	};
	#endif

	static int
	zfs_freebsd_write(struct vop_write_args *ap)
	{

	return (zfs_write(ap->a_vp, ap->a_uio, ioflags(ap->a_ioflag),
	ap->a_cred));
	}

	#if __FreeBSD_version >= 1300102
	/*
	* VOP_FPLOOKUP_VEXEC routines are subject to special circumstances, see
	* the comment above cache_fplookup for details.
	*/
	static int
	zfs_freebsd_fplookup_vexec(struct vop_fplookup_vexec_args *v)
	{
	vnode_t *vp;
	znode_t *zp;
	uint64_t pflags;

	vp = v->a_vp;
	zp = VTOZ_SMR(vp);
	if (__predict_false(zp == NULL))
	return (EAGAIN);
	pflags = atomic_load_64(&zp->z_pflags);
	if (pflags & ZFS_AV_QUARANTINED)
	return (EAGAIN);
	if (pflags & ZFS_XATTR)
	return (EAGAIN);
	if ((pflags & ZFS_NO_EXECS_DENIED) == 0)
	return (EAGAIN);
	return (0);
	}
	#endif

	#ifndef _SYS_SYSPROTO_H_
	struct vop_access_args {
	struct vnode *a_vp;
	accmode_t a_accmode;
	struct ucred *a_cred;
	struct thread *a_td;
	};
	#endif

	static int
	zfs_freebsd_access(struct vop_access_args *ap)
	{
	vnode_t *vp = ap->a_vp;
	znode_t *zp = VTOZ(vp);
	accmode_t accmode;
	int error = 0;


	if (ap->a_accmode == VEXEC) {
	if (zfs_fastaccesschk_execute(zp, ap->a_cred) == 0)
	return (0);
	}

	/*
	* ZFS itself only knowns about VREAD, VWRITE, VEXEC and VAPPEND,
	*/
	accmode = ap->a_accmode & (VREAD\|VWRITE\|VEXEC\|VAPPEND);
	if (accmode != 0)
	error = zfs_access(ap->a_vp, accmode, 0, ap->a_cred, NULL);

	/*
	* VADMIN has to be handled by vaccess().
	*/
	if (error == 0) {
	accmode = ap->a_accmode & ~(VREAD\|VWRITE\|VEXEC\|VAPPEND);
	if (accmode != 0) {
	#if __FreeBSD_version >= 1300105
	error = vaccess(vp->v_type, zp->z_mode, zp->z_uid,
	zp->z_gid, accmode, ap->a_cred);
	#else
	error = vaccess(vp->v_type, zp->z_mode, zp->z_uid,
	zp->z_gid, accmode, ap->a_cred, NULL);
	#endif
	}
	}

	/*
	* For VEXEC, ensure that at least one execute bit is set for
	* non-directories.
	*/
	if (error == 0 && (ap->a_accmode & VEXEC) != 0 && vp->v_type != VDIR &&
	(zp->z_mode & (S_IXUSR \| S_IXGRP \| S_IXOTH)) == 0) {
	error = EACCES;
	}

	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_lookup_args {
	struct vnode *a_dvp;
	struct vnode **a_vpp;
	struct componentname *a_cnp;
	};
	#endif

	static int
	zfs_freebsd_lookup(struct vop_lookup_args *ap, boolean_t cached)
	{
	struct componentname *cnp = ap->a_cnp;
	char nm[NAME_MAX + 1];

	ASSERT(cnp->cn_namelen < sizeof (nm));
	strlcpy(nm, cnp->cn_nameptr, MIN(cnp->cn_namelen + 1, sizeof (nm)));

	return (zfs_lookup(ap->a_dvp, nm, ap->a_vpp, cnp, cnp->cn_nameiop,
	cnp->cn_cred, cnp->cn_thread, 0, cached));
	}

	static int
	zfs_freebsd_cachedlookup(struct vop_cachedlookup_args *ap)
	{

	return (zfs_freebsd_lookup((struct vop_lookup_args *)ap, B_TRUE));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_lookup_args {
	struct vnode *a_dvp;
	struct vnode **a_vpp;
	struct componentname *a_cnp;
	};
	#endif

	static int
	zfs_cache_lookup(struct vop_lookup_args *ap)
	{
	zfsvfs_t *zfsvfs;

	zfsvfs = ap->a_dvp->v_mount->mnt_data;
	if (zfsvfs->z_use_namecache)
	return (vfs_cache_lookup(ap));
	else
	return (zfs_freebsd_lookup(ap, B_FALSE));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_create_args {
	struct vnode *a_dvp;
	struct vnode **a_vpp;
	struct componentname *a_cnp;
	struct vattr *a_vap;
	};
	#endif

	static int
	zfs_freebsd_create(struct vop_create_args *ap)
	{
	zfsvfs_t *zfsvfs;
	struct componentname *cnp = ap->a_cnp;
	vattr_t *vap = ap->a_vap;
	znode_t *zp = NULL;
	int rc, mode;

	ASSERT(cnp->cn_flags & SAVENAME);

	vattr_init_mask(vap);
	mode = vap->va_mode & ALLPERMS;
	zfsvfs = ap->a_dvp->v_mount->mnt_data;
	*ap->a_vpp = NULL;

	rc = zfs_create(VTOZ(ap->a_dvp), cnp->cn_nameptr, vap, !EXCL, mode,
	&zp, cnp->cn_cred, 0 /* flag /, NULL / vsecattr */);
	if (rc == 0)
	*ap->a_vpp = ZTOV(zp);
	if (zfsvfs->z_use_namecache &&
	rc == 0 && (cnp->cn_flags & MAKEENTRY) != 0)
	cache_enter(ap->a_dvp, *ap->a_vpp, cnp);

	return (rc);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_remove_args {
	struct vnode *a_dvp;
	struct vnode *a_vp;
	struct componentname *a_cnp;
	};
	#endif

	static int
	zfs_freebsd_remove(struct vop_remove_args *ap)
	{

	ASSERT(ap->a_cnp->cn_flags & SAVENAME);

	return (zfs_remove_(ap->a_dvp, ap->a_vp, ap->a_cnp->cn_nameptr,
	ap->a_cnp->cn_cred));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_mkdir_args {
	struct vnode *a_dvp;
	struct vnode **a_vpp;
	struct componentname *a_cnp;
	struct vattr *a_vap;
	};
	#endif

	static int
	zfs_freebsd_mkdir(struct vop_mkdir_args *ap)
	{
	vattr_t *vap = ap->a_vap;
	znode_t *zp = NULL;
	int rc;

	ASSERT(ap->a_cnp->cn_flags & SAVENAME);

	vattr_init_mask(vap);
	*ap->a_vpp = NULL;

	rc = zfs_mkdir(VTOZ(ap->a_dvp), ap->a_cnp->cn_nameptr, vap, &zp,
	ap->a_cnp->cn_cred, 0, NULL);

	if (rc == 0)
	*ap->a_vpp = ZTOV(zp);
	return (rc);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_rmdir_args {
	struct vnode *a_dvp;
	struct vnode *a_vp;
	struct componentname *a_cnp;
	};
	#endif

	static int
	zfs_freebsd_rmdir(struct vop_rmdir_args *ap)
	{
	struct componentname *cnp = ap->a_cnp;

	ASSERT(cnp->cn_flags & SAVENAME);

	return (zfs_rmdir_(ap->a_dvp, ap->a_vp, cnp->cn_nameptr, cnp->cn_cred));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_readdir_args {
	struct vnode *a_vp;
	struct uio *a_uio;
	struct ucred *a_cred;
	int *a_eofflag;
	int *a_ncookies;
	ulong_t **a_cookies;
	};
	#endif

	static int
	zfs_freebsd_readdir(struct vop_readdir_args *ap)
	{

	return (zfs_readdir(ap->a_vp, ap->a_uio, ap->a_cred, ap->a_eofflag,
	ap->a_ncookies, ap->a_cookies));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_fsync_args {
	struct vnode *a_vp;
	int a_waitfor;
	struct thread *a_td;
	};
	#endif

	static int
	zfs_freebsd_fsync(struct vop_fsync_args *ap)
	{

	vop_stdfsync(ap);
	return (zfs_fsync(ap->a_vp, 0, ap->a_td->td_ucred, NULL));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_getattr_args {
	struct vnode *a_vp;
	struct vattr *a_vap;
	struct ucred *a_cred;
	};
	#endif

	static int
	zfs_freebsd_getattr(struct vop_getattr_args *ap)
	{
	vattr_t *vap = ap->a_vap;
	xvattr_t xvap;
	ulong_t fflags = 0;
	int error;

	xva_init(&xvap);
	xvap.xva_vattr = *vap;
	xvap.xva_vattr.va_mask \|= AT_XVATTR;

	/* Convert chflags into ZFS-type flags. */
	/* XXX: what about SF_SETTABLE?. */
	XVA_SET_REQ(&xvap, XAT_IMMUTABLE);
	XVA_SET_REQ(&xvap, XAT_APPENDONLY);
	XVA_SET_REQ(&xvap, XAT_NOUNLINK);
	XVA_SET_REQ(&xvap, XAT_NODUMP);
	XVA_SET_REQ(&xvap, XAT_READONLY);
	XVA_SET_REQ(&xvap, XAT_ARCHIVE);
	XVA_SET_REQ(&xvap, XAT_SYSTEM);
	XVA_SET_REQ(&xvap, XAT_HIDDEN);
	XVA_SET_REQ(&xvap, XAT_REPARSE);
	XVA_SET_REQ(&xvap, XAT_OFFLINE);
	XVA_SET_REQ(&xvap, XAT_SPARSE);

	error = zfs_getattr(ap->a_vp, (vattr_t *)&xvap, 0, ap->a_cred);
	if (error != 0)
	return (error);

	/* Convert ZFS xattr into chflags. */
	#define FLAG_CHECK(fflag, xflag, xfield) do { \
	if (XVA_ISSET_RTN(&xvap, (xflag)) && (xfield) != 0) \
	fflags \|= (fflag); \
	} while (0)
	FLAG_CHECK(SF_IMMUTABLE, XAT_IMMUTABLE,
	xvap.xva_xoptattrs.xoa_immutable);
	FLAG_CHECK(SF_APPEND, XAT_APPENDONLY,
	xvap.xva_xoptattrs.xoa_appendonly);
	FLAG_CHECK(SF_NOUNLINK, XAT_NOUNLINK,
	xvap.xva_xoptattrs.xoa_nounlink);
	FLAG_CHECK(UF_ARCHIVE, XAT_ARCHIVE,
	xvap.xva_xoptattrs.xoa_archive);
	FLAG_CHECK(UF_NODUMP, XAT_NODUMP,
	xvap.xva_xoptattrs.xoa_nodump);
	FLAG_CHECK(UF_READONLY, XAT_READONLY,
	xvap.xva_xoptattrs.xoa_readonly);
	FLAG_CHECK(UF_SYSTEM, XAT_SYSTEM,
	xvap.xva_xoptattrs.xoa_system);
	FLAG_CHECK(UF_HIDDEN, XAT_HIDDEN,
	xvap.xva_xoptattrs.xoa_hidden);
	FLAG_CHECK(UF_REPARSE, XAT_REPARSE,
	xvap.xva_xoptattrs.xoa_reparse);
	FLAG_CHECK(UF_OFFLINE, XAT_OFFLINE,
	xvap.xva_xoptattrs.xoa_offline);
	FLAG_CHECK(UF_SPARSE, XAT_SPARSE,
	xvap.xva_xoptattrs.xoa_sparse);

	#undef FLAG_CHECK
	*vap = xvap.xva_vattr;
	vap->va_flags = fflags;
	return (0);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_setattr_args {
	struct vnode *a_vp;
	struct vattr *a_vap;
	struct ucred *a_cred;
	};
	#endif

	static int
	zfs_freebsd_setattr(struct vop_setattr_args *ap)
	{
	vnode_t *vp = ap->a_vp;
	vattr_t *vap = ap->a_vap;
	cred_t *cred = ap->a_cred;
	xvattr_t xvap;
	ulong_t fflags;
	uint64_t zflags;

	vattr_init_mask(vap);
	vap->va_mask &= ~AT_NOSET;

	xva_init(&xvap);
	xvap.xva_vattr = *vap;

	zflags = VTOZ(vp)->z_pflags;

	if (vap->va_flags != VNOVAL) {
	zfsvfs_t *zfsvfs = VTOZ(vp)->z_zfsvfs;
	int error;

	if (zfsvfs->z_use_fuids == B_FALSE)
	return (EOPNOTSUPP);

	fflags = vap->va_flags;
	/*
	* XXX KDM
	* We need to figure out whether it makes sense to allow
	* UF_REPARSE through, since we don't really have other
	* facilities to handle reparse points and zfs_setattr()
	* doesn't currently allow setting that attribute anyway.
	*/
	if ((fflags & ~(SF_IMMUTABLE\|SF_APPEND\|SF_NOUNLINK\|UF_ARCHIVE\|
	UF_NODUMP\|UF_SYSTEM\|UF_HIDDEN\|UF_READONLY\|UF_REPARSE\|
	UF_OFFLINE\|UF_SPARSE)) != 0)
	return (EOPNOTSUPP);
	/*
	* Unprivileged processes are not permitted to unset system
	* flags, or modify flags if any system flags are set.
	* Privileged non-jail processes may not modify system flags
	* if securelevel > 0 and any existing system flags are set.
	* Privileged jail processes behave like privileged non-jail
	* processes if the PR_ALLOW_CHFLAGS permission bit is set;
	* otherwise, they behave like unprivileged processes.
	*/
	if (secpolicy_fs_owner(vp->v_mount, cred) == 0 \|\|
	spl_priv_check_cred(cred, PRIV_VFS_SYSFLAGS) == 0) {
	if (zflags &
	(ZFS_IMMUTABLE \| ZFS_APPENDONLY \| ZFS_NOUNLINK)) {
	error = securelevel_gt(cred, 0);
	if (error != 0)
	return (error);
	}
	} else {
	/*
	* Callers may only modify the file flags on
	* objects they have VADMIN rights for.
	*/
	if ((error = VOP_ACCESS(vp, VADMIN, cred,
	curthread)) != 0)
	return (error);
	if (zflags &
	(ZFS_IMMUTABLE \| ZFS_APPENDONLY \|
	ZFS_NOUNLINK)) {
	return (EPERM);
	}
	if (fflags &
	(SF_IMMUTABLE \| SF_APPEND \| SF_NOUNLINK)) {
	return (EPERM);
	}
	}

	#define FLAG_CHANGE(fflag, zflag, xflag, xfield) do { \
	if (((fflags & (fflag)) && !(zflags & (zflag))) \|\| \
	((zflags & (zflag)) && !(fflags & (fflag)))) { \
	XVA_SET_REQ(&xvap, (xflag)); \
	(xfield) = ((fflags & (fflag)) != 0); \
	} \
	} while (0)
	/* Convert chflags into ZFS-type flags. */
	/* XXX: what about SF_SETTABLE?. */
	FLAG_CHANGE(SF_IMMUTABLE, ZFS_IMMUTABLE, XAT_IMMUTABLE,
	xvap.xva_xoptattrs.xoa_immutable);
	FLAG_CHANGE(SF_APPEND, ZFS_APPENDONLY, XAT_APPENDONLY,
	xvap.xva_xoptattrs.xoa_appendonly);
	FLAG_CHANGE(SF_NOUNLINK, ZFS_NOUNLINK, XAT_NOUNLINK,
	xvap.xva_xoptattrs.xoa_nounlink);
	FLAG_CHANGE(UF_ARCHIVE, ZFS_ARCHIVE, XAT_ARCHIVE,
	xvap.xva_xoptattrs.xoa_archive);
	FLAG_CHANGE(UF_NODUMP, ZFS_NODUMP, XAT_NODUMP,
	xvap.xva_xoptattrs.xoa_nodump);
	FLAG_CHANGE(UF_READONLY, ZFS_READONLY, XAT_READONLY,
	xvap.xva_xoptattrs.xoa_readonly);
	FLAG_CHANGE(UF_SYSTEM, ZFS_SYSTEM, XAT_SYSTEM,
	xvap.xva_xoptattrs.xoa_system);
	FLAG_CHANGE(UF_HIDDEN, ZFS_HIDDEN, XAT_HIDDEN,
	xvap.xva_xoptattrs.xoa_hidden);
	FLAG_CHANGE(UF_REPARSE, ZFS_REPARSE, XAT_REPARSE,
	xvap.xva_xoptattrs.xoa_reparse);
	FLAG_CHANGE(UF_OFFLINE, ZFS_OFFLINE, XAT_OFFLINE,
	xvap.xva_xoptattrs.xoa_offline);
	FLAG_CHANGE(UF_SPARSE, ZFS_SPARSE, XAT_SPARSE,
	xvap.xva_xoptattrs.xoa_sparse);
	#undef FLAG_CHANGE
	}
	if (vap->va_birthtime.tv_sec != VNOVAL) {
	xvap.xva_vattr.va_mask \|= AT_XVATTR;
	XVA_SET_REQ(&xvap, XAT_CREATETIME);
	}
	return (zfs_setattr(VTOZ(vp), (vattr_t *)&xvap, 0, cred));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_rename_args {
	struct vnode *a_fdvp;
	struct vnode *a_fvp;
	struct componentname *a_fcnp;
	struct vnode *a_tdvp;
	struct vnode *a_tvp;
	struct componentname *a_tcnp;
	};
	#endif

	static int
	zfs_freebsd_rename(struct vop_rename_args *ap)
	{
	vnode_t *fdvp = ap->a_fdvp;
	vnode_t *fvp = ap->a_fvp;
	vnode_t *tdvp = ap->a_tdvp;
	vnode_t *tvp = ap->a_tvp;
	int error;

	ASSERT(ap->a_fcnp->cn_flags & (SAVENAME\|SAVESTART));
	ASSERT(ap->a_tcnp->cn_flags & (SAVENAME\|SAVESTART));

	error = zfs_rename_(fdvp, &fvp, ap->a_fcnp, tdvp, &tvp,
	ap->a_tcnp, ap->a_fcnp->cn_cred, 1);

	vrele(fdvp);
	vrele(fvp);
	vrele(tdvp);
	if (tvp != NULL)
	vrele(tvp);

	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_symlink_args {
	struct vnode *a_dvp;
	struct vnode **a_vpp;
	struct componentname *a_cnp;
	struct vattr *a_vap;
	char *a_target;
	};
	#endif

	static int
	zfs_freebsd_symlink(struct vop_symlink_args *ap)
	{
	struct componentname *cnp = ap->a_cnp;
	vattr_t *vap = ap->a_vap;
	znode_t *zp = NULL;
	int rc;

	ASSERT(cnp->cn_flags & SAVENAME);

	vap->va_type = VLNK; /* FreeBSD: Syscall only sets va_mode. */
	vattr_init_mask(vap);
	*ap->a_vpp = NULL;

	rc = zfs_symlink(VTOZ(ap->a_dvp), cnp->cn_nameptr, vap,
	ap->a_target, &zp, cnp->cn_cred, 0 /* flags */);
	if (rc == 0)
	*ap->a_vpp = ZTOV(zp);
	return (rc);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_readlink_args {
	struct vnode *a_vp;
	struct uio *a_uio;
	struct ucred *a_cred;
	};
	#endif

	static int
	zfs_freebsd_readlink(struct vop_readlink_args *ap)
	{

	return (zfs_readlink(ap->a_vp, ap->a_uio, ap->a_cred, NULL));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_link_args {
	struct vnode *a_tdvp;
	struct vnode *a_vp;
	struct componentname *a_cnp;
	};
	#endif

	static int
	zfs_freebsd_link(struct vop_link_args *ap)
	{
	struct componentname *cnp = ap->a_cnp;
	vnode_t *vp = ap->a_vp;
	vnode_t *tdvp = ap->a_tdvp;

	if (tdvp->v_mount != vp->v_mount)
	return (EXDEV);

	ASSERT(cnp->cn_flags & SAVENAME);

	return (zfs_link(VTOZ(tdvp), VTOZ(vp),
	cnp->cn_nameptr, cnp->cn_cred, 0));
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_inactive_args {
	struct vnode *a_vp;
	struct thread *a_td;
	};
	#endif

	static int
	zfs_freebsd_inactive(struct vop_inactive_args *ap)
	{
	vnode_t *vp = ap->a_vp;

	zfs_inactive(vp, ap->a_td->td_ucred, NULL);
	return (0);
	}

	#if __FreeBSD_version >= 1300042
	#ifndef _SYS_SYSPROTO_H_
	struct vop_need_inactive_args {
	struct vnode *a_vp;
	struct thread *a_td;
	};
	#endif

	static int
	zfs_freebsd_need_inactive(struct vop_need_inactive_args *ap)
	{
	vnode_t *vp = ap->a_vp;
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	int need;

	if (vn_need_pageq_flush(vp))
	return (1);

	- if (!rw_tryenter(&zfsvfs->z_teardown_inactive_lock, RW_READER))
	+ if (!ZFS_TRYRLOCK_TEARDOWN_INACTIVE(zfsvfs))
	return (1);
	need = (zp->z_sa_hdl == NULL \|\| zp->z_unlinked \|\| zp->z_atime_dirty);
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_RUNLOCK_TEARDOWN_INACTIVE(zfsvfs);

	return (need);
	}
	#endif

	#ifndef _SYS_SYSPROTO_H_
	struct vop_reclaim_args {
	struct vnode *a_vp;
	struct thread *a_td;
	};
	#endif

	static int
	zfs_freebsd_reclaim(struct vop_reclaim_args *ap)
	{
	vnode_t *vp = ap->a_vp;
	znode_t *zp = VTOZ(vp);
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;

	ASSERT(zp != NULL);

	#if __FreeBSD_version < 1300042
	/* Destroy the vm object and flush associated pages. */
	vnode_destroy_vobject(vp);
	#endif
	/*
	* z_teardown_inactive_lock protects from a race with
	* zfs_znode_dmu_fini in zfsvfs_teardown during
	* force unmount.
	*/
	- rw_enter(&zfsvfs->z_teardown_inactive_lock, RW_READER);
	+ ZFS_RLOCK_TEARDOWN_INACTIVE(zfsvfs);
	if (zp->z_sa_hdl == NULL)
	zfs_znode_free(zp);
	else
	zfs_zinactive(zp);
	- rw_exit(&zfsvfs->z_teardown_inactive_lock);
	+ ZFS_RUNLOCK_TEARDOWN_INACTIVE(zfsvfs);

	vp->v_data = NULL;
	return (0);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_fid_args {
	struct vnode *a_vp;
	struct fid *a_fid;
	};
	#endif

	static int
	zfs_freebsd_fid(struct vop_fid_args *ap)
	{

	return (zfs_fid(ap->a_vp, (void *)ap->a_fid, NULL));
	}


	#ifndef _SYS_SYSPROTO_H_
	struct vop_pathconf_args {
	struct vnode *a_vp;
	int a_name;
	register_t *a_retval;
	} *ap;
	#endif

	static int
	zfs_freebsd_pathconf(struct vop_pathconf_args *ap)
	{
	ulong_t val;
	int error;

	error = zfs_pathconf(ap->a_vp, ap->a_name, &val,
	curthread->td_ucred, NULL);
	if (error == 0) {
	*ap->a_retval = val;
	return (error);
	}
	if (error != EOPNOTSUPP)
	return (error);

	switch (ap->a_name) {
	case _PC_NAME_MAX:
	*ap->a_retval = NAME_MAX;
	return (0);
	case _PC_PIPE_BUF:
	if (ap->a_vp->v_type == VDIR \|\| ap->a_vp->v_type == VFIFO) {
	*ap->a_retval = PIPE_BUF;
	return (0);
	}
	return (EINVAL);
	default:
	return (vop_stdpathconf(ap));
	}
	}

	/*
	* FreeBSD's extended attributes namespace defines file name prefix for ZFS'
	* extended attribute name:
	*
	* NAMESPACE PREFIX
	* system freebsd:system:
	* user (none, can be used to access ZFS fsattr(5) attributes
	* created on Solaris)
	*/
	static int
	zfs_create_attrname(int attrnamespace, const char name, char attrname,
	size_t size)
	{
	const char namespace, prefix, *suffix;

	/* We don't allow '/' character in attribute name. */
	if (strchr(name, '/') != NULL)
	return (EINVAL);
	/* We don't allow attribute names that start with "freebsd:" string. */
	if (strncmp(name, "freebsd:", 8) == 0)
	return (EINVAL);

	bzero(attrname, size);

	switch (attrnamespace) {
	case EXTATTR_NAMESPACE_USER:
	#if 0
	prefix = "freebsd:";
	namespace = EXTATTR_NAMESPACE_USER_STRING;
	suffix = ":";
	#else
	/*
	* This is the default namespace by which we can access all
	* attributes created on Solaris.
	*/
	prefix = namespace = suffix = "";
	#endif
	break;
	case EXTATTR_NAMESPACE_SYSTEM:
	prefix = "freebsd:";
	namespace = EXTATTR_NAMESPACE_SYSTEM_STRING;
	suffix = ":";
	break;
	case EXTATTR_NAMESPACE_EMPTY:
	default:
	return (EINVAL);
	}
	if (snprintf(attrname, size, "%s%s%s%s", prefix, namespace, suffix,
	name) >= size) {
	return (ENAMETOOLONG);
	}
	return (0);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_getextattr {
	IN struct vnode *a_vp;
	IN int a_attrnamespace;
	IN const char *a_name;
	INOUT struct uio *a_uio;
	OUT size_t *a_size;
	IN struct ucred *a_cred;
	IN struct thread *a_td;
	};
	#endif

	/*
	* Vnode operating to retrieve a named extended attribute.
	*/
	static int
	zfs_getextattr(struct vop_getextattr_args *ap)
	{
	zfsvfs_t *zfsvfs = VTOZ(ap->a_vp)->z_zfsvfs;
	struct thread *td = ap->a_td;
	struct nameidata nd;
	char attrname[255];
	struct vattr va;
	vnode_t xvp = NULL, vp;
	int error, flags;

	/*
	* If the xattr property is off, refuse the request.
	*/
	if (!(zfsvfs->z_flags & ZSB_XATTR)) {
	return (SET_ERROR(EOPNOTSUPP));
	}

	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
	ap->a_cred, ap->a_td, VREAD);
	if (error != 0)
	return (error);

	error = zfs_create_attrname(ap->a_attrnamespace, ap->a_name, attrname,
	sizeof (attrname));
	if (error != 0)
	return (error);

	ZFS_ENTER(zfsvfs);

	error = zfs_lookup(ap->a_vp, NULL, &xvp, NULL, 0, ap->a_cred, td,
	LOOKUP_XATTR, B_FALSE);
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	flags = FREAD;
	NDINIT_ATVP(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, attrname,
	xvp, td);
	error = vn_open_cred(&nd, &flags, 0, VN_OPEN_INVFS, ap->a_cred, NULL);
	vp = nd.ni_vp;
	NDFREE(&nd, NDF_ONLY_PNBUF);
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	if (error == ENOENT)
	error = ENOATTR;
	return (error);
	}

	if (ap->a_size != NULL) {
	error = VOP_GETATTR(vp, &va, ap->a_cred);
	if (error == 0)
	*ap->a_size = (size_t)va.va_size;
	} else if (ap->a_uio != NULL)
	error = VOP_READ(vp, ap->a_uio, IO_UNIT, ap->a_cred);

	VOP_UNLOCK1(vp);
	vn_close(vp, flags, ap->a_cred, td);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_deleteextattr {
	IN struct vnode *a_vp;
	IN int a_attrnamespace;
	IN const char *a_name;
	IN struct ucred *a_cred;
	IN struct thread *a_td;
	};
	#endif

	/*
	* Vnode operation to remove a named attribute.
	*/
	static int
	zfs_deleteextattr(struct vop_deleteextattr_args *ap)
	{
	zfsvfs_t *zfsvfs = VTOZ(ap->a_vp)->z_zfsvfs;
	struct thread *td = ap->a_td;
	struct nameidata nd;
	char attrname[255];
	vnode_t xvp = NULL, vp;
	int error;

	/*
	* If the xattr property is off, refuse the request.
	*/
	if (!(zfsvfs->z_flags & ZSB_XATTR)) {
	return (SET_ERROR(EOPNOTSUPP));
	}

	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
	ap->a_cred, ap->a_td, VWRITE);
	if (error != 0)
	return (error);

	error = zfs_create_attrname(ap->a_attrnamespace, ap->a_name, attrname,
	sizeof (attrname));
	if (error != 0)
	return (error);

	ZFS_ENTER(zfsvfs);

	error = zfs_lookup(ap->a_vp, NULL, &xvp, NULL, 0, ap->a_cred, td,
	LOOKUP_XATTR, B_FALSE);
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	NDINIT_ATVP(&nd, DELETE, NOFOLLOW \| LOCKPARENT \| LOCKLEAF,
	UIO_SYSSPACE, attrname, xvp, td);
	error = namei(&nd);
	vp = nd.ni_vp;
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	NDFREE(&nd, NDF_ONLY_PNBUF);
	if (error == ENOENT)
	error = ENOATTR;
	return (error);
	}

	error = VOP_REMOVE(nd.ni_dvp, vp, &nd.ni_cnd);
	NDFREE(&nd, NDF_ONLY_PNBUF);

	vput(nd.ni_dvp);
	if (vp == nd.ni_dvp)
	vrele(vp);
	else
	vput(vp);
	ZFS_EXIT(zfsvfs);

	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_setextattr {
	IN struct vnode *a_vp;
	IN int a_attrnamespace;
	IN const char *a_name;
	INOUT struct uio *a_uio;
	IN struct ucred *a_cred;
	IN struct thread *a_td;
	};
	#endif

	/*
	* Vnode operation to set a named attribute.
	*/
	static int
	zfs_setextattr(struct vop_setextattr_args *ap)
	{
	zfsvfs_t *zfsvfs = VTOZ(ap->a_vp)->z_zfsvfs;
	struct thread *td = ap->a_td;
	struct nameidata nd;
	char attrname[255];
	struct vattr va;
	vnode_t xvp = NULL, vp;
	int error, flags;

	/*
	* If the xattr property is off, refuse the request.
	*/
	if (!(zfsvfs->z_flags & ZSB_XATTR)) {
	return (SET_ERROR(EOPNOTSUPP));
	}

	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
	ap->a_cred, ap->a_td, VWRITE);
	if (error != 0)
	return (error);
	error = zfs_create_attrname(ap->a_attrnamespace, ap->a_name, attrname,
	sizeof (attrname));
	if (error != 0)
	return (error);

	ZFS_ENTER(zfsvfs);

	error = zfs_lookup(ap->a_vp, NULL, &xvp, NULL, 0, ap->a_cred, td,
	LOOKUP_XATTR \| CREATE_XATTR_DIR, B_FALSE);
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	flags = FFLAGS(O_WRONLY \| O_CREAT);
	NDINIT_ATVP(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, attrname,
	xvp, td);
	error = vn_open_cred(&nd, &flags, 0600, VN_OPEN_INVFS, ap->a_cred,
	NULL);
	vp = nd.ni_vp;
	NDFREE(&nd, NDF_ONLY_PNBUF);
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	VATTR_NULL(&va);
	va.va_size = 0;
	error = VOP_SETATTR(vp, &va, ap->a_cred);
	if (error == 0)
	VOP_WRITE(vp, ap->a_uio, IO_UNIT, ap->a_cred);

	VOP_UNLOCK1(vp);
	vn_close(vp, flags, ap->a_cred, td);
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_listextattr {
	IN struct vnode *a_vp;
	IN int a_attrnamespace;
	INOUT struct uio *a_uio;
	OUT size_t *a_size;
	IN struct ucred *a_cred;
	IN struct thread *a_td;
	};
	#endif

	/*
	* Vnode operation to retrieve extended attributes on a vnode.
	*/
	static int
	zfs_listextattr(struct vop_listextattr_args *ap)
	{
	zfsvfs_t *zfsvfs = VTOZ(ap->a_vp)->z_zfsvfs;
	struct thread *td = ap->a_td;
	struct nameidata nd;
	char attrprefix[16];
	uint8_t dirbuf[sizeof (struct dirent)];
	struct dirent *dp;
	struct iovec aiov;
	struct uio auio, *uio = ap->a_uio;
	size_t *sizep = ap->a_size;
	size_t plen;
	vnode_t xvp = NULL, vp;
	int done, error, eof, pos;

	/*
	* If the xattr property is off, refuse the request.
	*/
	if (!(zfsvfs->z_flags & ZSB_XATTR)) {
	return (SET_ERROR(EOPNOTSUPP));
	}

	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
	ap->a_cred, ap->a_td, VREAD);
	if (error != 0)
	return (error);

	error = zfs_create_attrname(ap->a_attrnamespace, "", attrprefix,
	sizeof (attrprefix));
	if (error != 0)
	return (error);
	plen = strlen(attrprefix);

	ZFS_ENTER(zfsvfs);

	if (sizep != NULL)
	*sizep = 0;

	error = zfs_lookup(ap->a_vp, NULL, &xvp, NULL, 0, ap->a_cred, td,
	LOOKUP_XATTR, B_FALSE);
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	/*
	* ENOATTR means that the EA directory does not yet exist,
	* i.e. there are no extended attributes there.
	*/
	if (error == ENOATTR)
	error = 0;
	return (error);
	}

	NDINIT_ATVP(&nd, LOOKUP, NOFOLLOW \| LOCKLEAF \| LOCKSHARED,
	UIO_SYSSPACE, ".", xvp, td);
	error = namei(&nd);
	vp = nd.ni_vp;
	NDFREE(&nd, NDF_ONLY_PNBUF);
	if (error != 0) {
	ZFS_EXIT(zfsvfs);
	return (error);
	}

	auio.uio_iov = &aiov;
	auio.uio_iovcnt = 1;
	auio.uio_segflg = UIO_SYSSPACE;
	auio.uio_td = td;
	auio.uio_rw = UIO_READ;
	auio.uio_offset = 0;

	do {
	uint8_t nlen;

	aiov.iov_base = (void *)dirbuf;
	aiov.iov_len = sizeof (dirbuf);
	auio.uio_resid = sizeof (dirbuf);
	error = VOP_READDIR(vp, &auio, ap->a_cred, &eof, NULL, NULL);
	done = sizeof (dirbuf) - auio.uio_resid;
	if (error != 0)
	break;
	for (pos = 0; pos < done; ) {
	dp = (struct dirent *)(dirbuf + pos);
	pos += dp->d_reclen;
	/*
	* XXX: Temporarily we also accept DT_UNKNOWN, as this
	* is what we get when attribute was created on Solaris.
	*/
	if (dp->d_type != DT_REG && dp->d_type != DT_UNKNOWN)
	continue;
	if (plen == 0 &&
	strncmp(dp->d_name, "freebsd:", 8) == 0)
	continue;
	else if (strncmp(dp->d_name, attrprefix, plen) != 0)
	continue;
	nlen = dp->d_namlen - plen;
	if (sizep != NULL)
	*sizep += 1 + nlen;
	else if (uio != NULL) {
	/*
	* Format of extattr name entry is one byte for
	* length and the rest for name.
	*/
	error = uiomove(&nlen, 1, uio->uio_rw, uio);
	if (error == 0) {
	error = uiomove(dp->d_name + plen, nlen,
	uio->uio_rw, uio);
	}
	if (error != 0)
	break;
	}
	}
	} while (!eof && error == 0);

	vput(vp);
	ZFS_EXIT(zfsvfs);

	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_getacl_args {
	struct vnode *vp;
	acl_type_t type;
	struct acl *aclp;
	struct ucred *cred;
	struct thread *td;
	};
	#endif

	static int
	zfs_freebsd_getacl(struct vop_getacl_args *ap)
	{
	int error;
	vsecattr_t vsecattr;

	if (ap->a_type != ACL_TYPE_NFS4)
	return (EINVAL);

	vsecattr.vsa_mask = VSA_ACE \| VSA_ACECNT;
	if ((error = zfs_getsecattr(ap->a_vp, &vsecattr, 0, ap->a_cred, NULL)))
	return (error);

	error = acl_from_aces(ap->a_aclp, vsecattr.vsa_aclentp,
	vsecattr.vsa_aclcnt);
	if (vsecattr.vsa_aclentp != NULL)
	kmem_free(vsecattr.vsa_aclentp, vsecattr.vsa_aclentsz);

	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_setacl_args {
	struct vnode *vp;
	acl_type_t type;
	struct acl *aclp;
	struct ucred *cred;
	struct thread *td;
	};
	#endif

	static int
	zfs_freebsd_setacl(struct vop_setacl_args *ap)
	{
	int error;
	vsecattr_t vsecattr;
	int aclbsize; /* size of acl list in bytes */
	aclent_t *aaclp;

	if (ap->a_type != ACL_TYPE_NFS4)
	return (EINVAL);

	if (ap->a_aclp == NULL)
	return (EINVAL);

	if (ap->a_aclp->acl_cnt < 1 \|\| ap->a_aclp->acl_cnt > MAX_ACL_ENTRIES)
	return (EINVAL);

	/*
	* With NFSv4 ACLs, chmod(2) may need to add additional entries,
	* splitting every entry into two and appending "canonical six"
	* entries at the end. Don't allow for setting an ACL that would
	* cause chmod(2) to run out of ACL entries.
	*/
	if (ap->a_aclp->acl_cnt * 2 + 6 > ACL_MAX_ENTRIES)
	return (ENOSPC);

	error = acl_nfs4_check(ap->a_aclp, ap->a_vp->v_type == VDIR);
	if (error != 0)
	return (error);

	vsecattr.vsa_mask = VSA_ACE;
	aclbsize = ap->a_aclp->acl_cnt * sizeof (ace_t);
	vsecattr.vsa_aclentp = kmem_alloc(aclbsize, KM_SLEEP);
	aaclp = vsecattr.vsa_aclentp;
	vsecattr.vsa_aclentsz = aclbsize;

	aces_from_acl(vsecattr.vsa_aclentp, &vsecattr.vsa_aclcnt, ap->a_aclp);
	error = zfs_setsecattr(VTOZ(ap->a_vp), &vsecattr, 0, ap->a_cred);
	kmem_free(aaclp, aclbsize);

	return (error);
	}

	#ifndef _SYS_SYSPROTO_H_
	struct vop_aclcheck_args {
	struct vnode *vp;
	acl_type_t type;
	struct acl *aclp;
	struct ucred *cred;
	struct thread *td;
	};
	#endif

	static int
	zfs_freebsd_aclcheck(struct vop_aclcheck_args *ap)
	{

	return (EOPNOTSUPP);
	}

	static int
	zfs_vptocnp(struct vop_vptocnp_args *ap)
	{
	vnode_t *covered_vp;
	vnode_t *vp = ap->a_vp;
	zfsvfs_t *zfsvfs = vp->v_vfsp->vfs_data;
	znode_t *zp = VTOZ(vp);
	int ltype;
	int error;

	ZFS_ENTER(zfsvfs);
	ZFS_VERIFY_ZP(zp);

	/*
	* If we are a snapshot mounted under .zfs, run the operation
	* on the covered vnode.
	*/
	if (zp->z_id != zfsvfs->z_root \|\| zfsvfs->z_parent == zfsvfs) {
	char name[MAXNAMLEN + 1];
	znode_t *dzp;
	size_t len;

	error = zfs_znode_parent_and_name(zp, &dzp, name);
	if (error == 0) {
	len = strlen(name);
	if (*ap->a_buflen < len)
	error = SET_ERROR(ENOMEM);
	}
	if (error == 0) {
	*ap->a_buflen -= len;
	bcopy(name, ap->a_buf + *ap->a_buflen, len);
	*ap->a_vpp = ZTOV(dzp);
	}
	ZFS_EXIT(zfsvfs);
	return (error);
	}
	ZFS_EXIT(zfsvfs);

	covered_vp = vp->v_mount->mnt_vnodecovered;
	#if __FreeBSD_version >= 1300045
	enum vgetstate vs = vget_prep(covered_vp);
	#else
	vhold(covered_vp);
	#endif
	ltype = VOP_ISLOCKED(vp);
	VOP_UNLOCK1(vp);
	#if __FreeBSD_version >= 1300045
	error = vget_finish(covered_vp, LK_SHARED, vs);
	#else
	error = vget(covered_vp, LK_SHARED \| LK_VNHELD, curthread);
	#endif
	if (error == 0) {
	error = VOP_VPTOCNP(covered_vp, ap->a_vpp, ap->a_cred,
	ap->a_buf, ap->a_buflen);
	vput(covered_vp);
	}
	vn_lock(vp, ltype \| LK_RETRY);
	if (VN_IS_DOOMED(vp))
	error = SET_ERROR(ENOENT);
	return (error);
	}

	#ifdef DIAGNOSTIC
	#ifndef _SYS_SYSPROTO_H_
	struct vop_lock1_args {
	struct vnode *a_vp;
	int a_flags;
	char *file;
	int line;
	};
	#endif

	static int
	zfs_lock(struct vop_lock1_args *ap)
	{
	vnode_t *vp;
	znode_t *zp;
	int err;

	#if __FreeBSD_version >= 1300064
	err = vop_lock(ap);
	#else
	err = vop_stdlock(ap);
	#endif
	if (err == 0 && (ap->a_flags & LK_NOWAIT) == 0) {
	vp = ap->a_vp;
	zp = vp->v_data;
	if (vp->v_mount != NULL && !VN_IS_DOOMED(vp) &&
	zp != NULL && (zp->z_pflags & ZFS_XATTR) == 0)
	VERIFY(!RRM_LOCK_HELD(&zp->z_zfsvfs->z_teardown_lock));
	}
	return (err);
	}
	#endif

	struct vop_vector zfs_vnodeops;
	struct vop_vector zfs_fifoops;
	struct vop_vector zfs_shareops;

	struct vop_vector zfs_vnodeops = {
	.vop_default = &default_vnodeops,
	.vop_inactive = zfs_freebsd_inactive,
	#if __FreeBSD_version >= 1300042
	.vop_need_inactive = zfs_freebsd_need_inactive,
	#endif
	.vop_reclaim = zfs_freebsd_reclaim,
	#if __FreeBSD_version >= 1300102
	.vop_fplookup_vexec = zfs_freebsd_fplookup_vexec,
	#endif
	.vop_access = zfs_freebsd_access,
	.vop_allocate = VOP_EINVAL,
	.vop_lookup = zfs_cache_lookup,
	.vop_cachedlookup = zfs_freebsd_cachedlookup,
	.vop_getattr = zfs_freebsd_getattr,
	.vop_setattr = zfs_freebsd_setattr,
	.vop_create = zfs_freebsd_create,
	.vop_mknod = (vop_mknod_t *)zfs_freebsd_create,
	.vop_mkdir = zfs_freebsd_mkdir,
	.vop_readdir = zfs_freebsd_readdir,
	.vop_fsync = zfs_freebsd_fsync,
	.vop_open = zfs_freebsd_open,
	.vop_close = zfs_freebsd_close,
	.vop_rmdir = zfs_freebsd_rmdir,
	.vop_ioctl = zfs_freebsd_ioctl,
	.vop_link = zfs_freebsd_link,
	.vop_symlink = zfs_freebsd_symlink,
	.vop_readlink = zfs_freebsd_readlink,
	.vop_read = zfs_freebsd_read,
	.vop_write = zfs_freebsd_write,
	.vop_remove = zfs_freebsd_remove,
	.vop_rename = zfs_freebsd_rename,
	.vop_pathconf = zfs_freebsd_pathconf,
	.vop_bmap = zfs_freebsd_bmap,
	.vop_fid = zfs_freebsd_fid,
	.vop_getextattr = zfs_getextattr,
	.vop_deleteextattr = zfs_deleteextattr,
	.vop_setextattr = zfs_setextattr,
	.vop_listextattr = zfs_listextattr,
	.vop_getacl = zfs_freebsd_getacl,
	.vop_setacl = zfs_freebsd_setacl,
	.vop_aclcheck = zfs_freebsd_aclcheck,
	.vop_getpages = zfs_freebsd_getpages,
	.vop_putpages = zfs_freebsd_putpages,
	.vop_vptocnp = zfs_vptocnp,
	#if __FreeBSD_version >= 1300064
	#ifdef DIAGNOSTIC
	.vop_lock1 = zfs_lock,
	#else
	.vop_lock1 = vop_lock,
	#endif
	.vop_unlock = vop_unlock,
	.vop_islocked = vop_islocked,
	#else
	#ifdef DIAGNOSTIC
	.vop_lock1 = zfs_lock,
	#endif
	#endif
	};
	VFS_VOP_VECTOR_REGISTER(zfs_vnodeops);

	struct vop_vector zfs_fifoops = {
	.vop_default = &fifo_specops,
	.vop_fsync = zfs_freebsd_fsync,
	#if __FreeBSD_version >= 1300102
	.vop_fplookup_vexec = zfs_freebsd_fplookup_vexec,
	#endif
	.vop_access = zfs_freebsd_access,
	.vop_getattr = zfs_freebsd_getattr,
	.vop_inactive = zfs_freebsd_inactive,
	.vop_read = VOP_PANIC,
	.vop_reclaim = zfs_freebsd_reclaim,
	.vop_setattr = zfs_freebsd_setattr,
	.vop_write = VOP_PANIC,
	.vop_pathconf = zfs_freebsd_pathconf,
	.vop_fid = zfs_freebsd_fid,
	.vop_getacl = zfs_freebsd_getacl,
	.vop_setacl = zfs_freebsd_setacl,
	.vop_aclcheck = zfs_freebsd_aclcheck,
	};
	VFS_VOP_VECTOR_REGISTER(zfs_fifoops);

	/*
	* special share hidden files vnode operations template
	*/
	struct vop_vector zfs_shareops = {
	.vop_default = &default_vnodeops,
	.vop_access = zfs_freebsd_access,
	.vop_inactive = zfs_freebsd_inactive,
	.vop_reclaim = zfs_freebsd_reclaim,
	.vop_fid = zfs_freebsd_fid,
	.vop_pathconf = zfs_freebsd_pathconf,
	};
	VFS_VOP_VECTOR_REGISTER(zfs_shareops);
	Index: vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_znode.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_znode.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/freebsd/zfs/zfs_znode.c (revision 365892)
	@@ -1,2067 +1,2067 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2012, 2014 by Delphix. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	*/

	/* Portions Copyright 2007 Jeremy Teo */
	/* Portions Copyright 2011 Martin Matuska <mm@FreeBSD.org> */

	#ifdef _KERNEL
	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/time.h>
	#include <sys/systm.h>
	#include <sys/sysmacros.h>
	#include <sys/resource.h>
	#include <sys/mntent.h>
	#include <sys/u8_textprep.h>
	#include <sys/dsl_dataset.h>
	#include <sys/vfs.h>
	#include <sys/vnode.h>
	#include <sys/file.h>
	#include <sys/kmem.h>
	#include <sys/errno.h>
	#include <sys/unistd.h>
	#include <sys/atomic.h>
	#include <sys/zfs_dir.h>
	#include <sys/zfs_acl.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/zfs_rlock.h>
	#include <sys/zfs_fuid.h>
	#include <sys/dnode.h>
	#include <sys/fs/zfs.h>
	#endif /* _KERNEL */

	#include <sys/dmu.h>
	#include <sys/dmu_objset.h>
	#include <sys/dmu_tx.h>
	#include <sys/zfs_refcount.h>
	#include <sys/stat.h>
	#include <sys/zap.h>
	#include <sys/zfs_znode.h>
	#include <sys/sa.h>
	#include <sys/zfs_sa.h>
	#include <sys/zfs_stat.h>

	#include "zfs_prop.h"
	#include "zfs_comutil.h"

	/* Used by fstat(1). */
	SYSCTL_INT(_debug_sizeof, OID_AUTO, znode, CTLFLAG_RD,
	SYSCTL_NULL_INT_PTR, sizeof (znode_t), "sizeof(znode_t)");

	/*
	* Define ZNODE_STATS to turn on statistic gathering. By default, it is only
	* turned on when DEBUG is also defined.
	*/
	#ifdef ZFS_DEBUG
	#define ZNODE_STATS
	#endif /* DEBUG */

	#ifdef ZNODE_STATS
	#define ZNODE_STAT_ADD(stat) ((stat)++)
	#else
	#define ZNODE_STAT_ADD(stat) /* nothing */
	#endif /* ZNODE_STATS */

	/*
	* Functions needed for userland (ie: libzpool) are not put under
	* #ifdef_KERNEL; the rest of the functions have dependencies
	* (such as VFS logic) that will not compile easily in userland.
	*/
	#ifdef _KERNEL
	/*
	* Needed to close a small window in zfs_znode_move() that allows the zfsvfs to
	* be freed before it can be safely accessed.
	*/
	krwlock_t zfsvfs_lock;

	#if defined(_KERNEL) && !defined(KMEM_DEBUG) && \
	__FreeBSD_version >= 1300102
	#define _ZFS_USE_SMR
	static uma_zone_t znode_uma_zone;
	#else
	static kmem_cache_t *znode_cache = NULL;
	#endif

	extern struct vop_vector zfs_vnodeops;
	extern struct vop_vector zfs_fifoops;
	extern struct vop_vector zfs_shareops;


	/*
	* This callback is invoked when acquiring a RL_WRITER or RL_APPEND lock on
	* z_rangelock. It will modify the offset and length of the lock to reflect
	* znode-specific information, and convert RL_APPEND to RL_WRITER. This is
	* called with the rangelock_t's rl_lock held, which avoids races.
	*/
	static void
	zfs_rangelock_cb(zfs_locked_range_t new, void arg)
	{
	znode_t *zp = arg;

	/*
	* If in append mode, convert to writer and lock starting at the
	* current end of file.
	*/
	if (new->lr_type == RL_APPEND) {
	new->lr_offset = zp->z_size;
	new->lr_type = RL_WRITER;
	}

	/*
	* If we need to grow the block size then lock the whole file range.
	*/
	uint64_t end_size = MAX(zp->z_size, new->lr_offset + new->lr_length);
	if (end_size > zp->z_blksz && (!ISP2(zp->z_blksz) \|\|
	zp->z_blksz < ZTOZSB(zp)->z_max_blksz)) {
	new->lr_offset = 0;
	new->lr_length = UINT64_MAX;
	}
	}

	static int
	zfs_znode_cache_constructor(void buf, void arg, int kmflags)
	{
	znode_t *zp = buf;

	POINTER_INVALIDATE(&zp->z_zfsvfs);

	list_link_init(&zp->z_link_node);

	mutex_init(&zp->z_acl_lock, NULL, MUTEX_DEFAULT, NULL);

	zfs_rangelock_init(&zp->z_rangelock, zfs_rangelock_cb, zp);

	zp->z_acl_cached = NULL;
	zp->z_vnode = NULL;
	zp->z_moved = 0;
	return (0);
	}

	/ARGSUSED/
	static void
	zfs_znode_cache_destructor(void buf, void arg)
	{
	znode_t *zp = buf;

	ASSERT(!POINTER_IS_VALID(zp->z_zfsvfs));
	ASSERT3P(zp->z_vnode, ==, NULL);
	ASSERT(!list_link_active(&zp->z_link_node));
	mutex_destroy(&zp->z_acl_lock);
	zfs_rangelock_fini(&zp->z_rangelock);

	ASSERT(zp->z_acl_cached == NULL);
	}


	#ifdef _ZFS_USE_SMR
	VFS_SMR_DECLARE;

	static int
	zfs_znode_cache_constructor_smr(void mem, int size __unused, void private,
	int flags)
	{

	return (zfs_znode_cache_constructor(mem, private, flags));
	}

	static void
	zfs_znode_cache_destructor_smr(void mem, int size __unused, void private)
	{

	zfs_znode_cache_destructor(mem, private);
	}

	void
	zfs_znode_init(void)
	{
	/*
	* Initialize zcache
	*/
	rw_init(&zfsvfs_lock, NULL, RW_DEFAULT, NULL);
	ASSERT(znode_uma_zone == NULL);
	znode_uma_zone = uma_zcreate("zfs_znode_cache",
	sizeof (znode_t), zfs_znode_cache_constructor_smr,
	zfs_znode_cache_destructor_smr, NULL, NULL, 0, 0);
	VFS_SMR_ZONE_SET(znode_uma_zone);
	}

	static znode_t *
	zfs_znode_alloc_kmem(int flags)
	{

	return (uma_zalloc_smr(znode_uma_zone, flags));
	}

	static void
	zfs_znode_free_kmem(znode_t *zp)
	{

	uma_zfree_smr(znode_uma_zone, zp);
	}
	#else
	void
	zfs_znode_init(void)
	{
	/*
	* Initialize zcache
	*/
	rw_init(&zfsvfs_lock, NULL, RW_DEFAULT, NULL);
	ASSERT(znode_cache == NULL);
	znode_cache = kmem_cache_create("zfs_znode_cache",
	sizeof (znode_t), 0, zfs_znode_cache_constructor,
	zfs_znode_cache_destructor, NULL, NULL, NULL, 0);
	}

	static znode_t *
	zfs_znode_alloc_kmem(int flags)
	{

	return (kmem_cache_alloc(znode_cache, flags));
	}

	static void
	zfs_znode_free_kmem(znode_t *zp)
	{

	kmem_cache_free(znode_cache, zp);
	}
	#endif

	void
	zfs_znode_fini(void)
	{
	/*
	* Cleanup zcache
	*/
	#ifdef _ZFS_USE_SMR
	if (znode_uma_zone) {
	uma_zdestroy(znode_uma_zone);
	znode_uma_zone = NULL;
	}
	#else
	if (znode_cache) {
	kmem_cache_destroy(znode_cache);
	znode_cache = NULL;
	}
	#endif
	rw_destroy(&zfsvfs_lock);
	}


	static int
	zfs_create_share_dir(zfsvfs_t zfsvfs, dmu_tx_t tx)
	{
	zfs_acl_ids_t acl_ids;
	vattr_t vattr;
	znode_t *sharezp;
	znode_t *zp;
	int error;

	vattr.va_mask = AT_MODE\|AT_UID\|AT_GID;
	vattr.va_type = VDIR;
	vattr.va_mode = S_IFDIR\|0555;
	vattr.va_uid = crgetuid(kcred);
	vattr.va_gid = crgetgid(kcred);

	sharezp = zfs_znode_alloc_kmem(KM_SLEEP);
	ASSERT(!POINTER_IS_VALID(sharezp->z_zfsvfs));
	sharezp->z_moved = 0;
	sharezp->z_unlinked = 0;
	sharezp->z_atime_dirty = 0;
	sharezp->z_zfsvfs = zfsvfs;
	sharezp->z_is_sa = zfsvfs->z_use_sa;

	VERIFY(0 == zfs_acl_ids_create(sharezp, IS_ROOT_NODE, &vattr,
	kcred, NULL, &acl_ids));
	zfs_mknode(sharezp, &vattr, tx, kcred, IS_ROOT_NODE, &zp, &acl_ids);
	ASSERT3P(zp, ==, sharezp);
	POINTER_INVALIDATE(&sharezp->z_zfsvfs);
	error = zap_add(zfsvfs->z_os, MASTER_NODE_OBJ,
	ZFS_SHARES_DIR, 8, 1, &sharezp->z_id, tx);
	zfsvfs->z_shares_dir = sharezp->z_id;

	zfs_acl_ids_free(&acl_ids);
	sa_handle_destroy(sharezp->z_sa_hdl);
	zfs_znode_free_kmem(sharezp);

	return (error);
	}

	/*
	* define a couple of values we need available
	* for both 64 and 32 bit environments.
	*/
	#ifndef NBITSMINOR64
	#define NBITSMINOR64 32
	#endif
	#ifndef MAXMAJ64
	#define MAXMAJ64 0xffffffffUL
	#endif
	#ifndef MAXMIN64
	#define MAXMIN64 0xffffffffUL
	#endif

	/*
	* Create special expldev for ZFS private use.
	* Can't use standard expldev since it doesn't do
	* what we want. The standard expldev() takes a
	* dev32_t in LP64 and expands it to a long dev_t.
	* We need an interface that takes a dev32_t in ILP32
	* and expands it to a long dev_t.
	*/
	static uint64_t
	zfs_expldev(dev_t dev)
	{
	return (((uint64_t)major(dev) << NBITSMINOR64) \| minor(dev));
	}
	/*
	* Special cmpldev for ZFS private use.
	* Can't use standard cmpldev since it takes
	* a long dev_t and compresses it to dev32_t in
	* LP64. We need to do a compaction of a long dev_t
	* to a dev32_t in ILP32.
	*/
	dev_t
	zfs_cmpldev(uint64_t dev)
	{
	return (makedev((dev >> NBITSMINOR64), (dev & MAXMIN64)));
	}

	static void
	zfs_znode_sa_init(zfsvfs_t zfsvfs, znode_t zp,
	dmu_buf_t db, dmu_object_type_t obj_type, sa_handle_t sa_hdl)
	{
	ASSERT(!POINTER_IS_VALID(zp->z_zfsvfs) \|\| (zfsvfs == zp->z_zfsvfs));
	ASSERT(MUTEX_HELD(ZFS_OBJ_MUTEX(zfsvfs, zp->z_id)));

	ASSERT(zp->z_sa_hdl == NULL);
	ASSERT(zp->z_acl_cached == NULL);
	if (sa_hdl == NULL) {
	VERIFY(0 == sa_handle_get_from_db(zfsvfs->z_os, db, zp,
	SA_HDL_SHARED, &zp->z_sa_hdl));
	} else {
	zp->z_sa_hdl = sa_hdl;
	sa_set_userp(sa_hdl, zp);
	}

	zp->z_is_sa = (obj_type == DMU_OT_SA) ? B_TRUE : B_FALSE;

	/*
	* Slap on VROOT if we are the root znode unless we are the root
	* node of a snapshot mounted under .zfs.
	*/
	if (zp->z_id == zfsvfs->z_root && zfsvfs->z_parent == zfsvfs)
	ZTOV(zp)->v_flag \|= VROOT;

	vn_exists(ZTOV(zp));
	}

	void
	zfs_znode_dmu_fini(znode_t *zp)
	{
	ASSERT(MUTEX_HELD(ZFS_OBJ_MUTEX(zp->z_zfsvfs, zp->z_id)) \|\|
	zp->z_unlinked \|\|
	- RW_WRITE_HELD(&zp->z_zfsvfs->z_teardown_inactive_lock));
	+ ZFS_TEARDOWN_INACTIVE_WLOCKED(zp->z_zfsvfs));

	sa_handle_destroy(zp->z_sa_hdl);
	zp->z_sa_hdl = NULL;
	}

	static void
	zfs_vnode_forget(vnode_t *vp)
	{

	/* copied from insmntque_stddtr */
	vp->v_data = NULL;
	vp->v_op = &dead_vnodeops;
	vgone(vp);
	vput(vp);
	}

	/*
	* Construct a new znode/vnode and initialize.
	*
	* This does not do a call to dmu_set_user() that is
	* up to the caller to do, in case you don't want to
	* return the znode
	*/
	static znode_t *
	zfs_znode_alloc(zfsvfs_t zfsvfs, dmu_buf_t db, int blksz,
	dmu_object_type_t obj_type, sa_handle_t *hdl)
	{
	znode_t *zp;
	vnode_t *vp;
	uint64_t mode;
	uint64_t parent;
	#ifdef notyet
	uint64_t mtime[2], ctime[2];
	#endif
	uint64_t projid = ZFS_DEFAULT_PROJID;
	sa_bulk_attr_t bulk[9];
	int count = 0;
	int error;

	zp = zfs_znode_alloc_kmem(KM_SLEEP);

	#ifndef _ZFS_USE_SMR
	KASSERT((zfsvfs->z_parent->z_vfs->mnt_kern_flag & MNTK_FPLOOKUP) == 0,
	("%s: fast path lookup enabled without smr", __func__));
	#endif

	#if __FreeBSD_version >= 1300076
	KASSERT(curthread->td_vp_reserved != NULL,
	("zfs_znode_alloc: getnewvnode without any vnodes reserved"));
	#else
	KASSERT(curthread->td_vp_reserv > 0,
	("zfs_znode_alloc: getnewvnode without any vnodes reserved"));
	#endif
	error = getnewvnode("zfs", zfsvfs->z_parent->z_vfs, &zfs_vnodeops, &vp);
	if (error != 0) {
	zfs_znode_free_kmem(zp);
	return (NULL);
	}
	zp->z_vnode = vp;
	vp->v_data = zp;

	ASSERT(!POINTER_IS_VALID(zp->z_zfsvfs));
	zp->z_moved = 0;

	/*
	* Defer setting z_zfsvfs until the znode is ready to be a candidate for
	* the zfs_znode_move() callback.
	*/
	zp->z_sa_hdl = NULL;
	zp->z_unlinked = 0;
	zp->z_atime_dirty = 0;
	zp->z_mapcnt = 0;
	zp->z_id = db->db_object;
	zp->z_blksz = blksz;
	zp->z_seq = 0x7A4653;
	zp->z_sync_cnt = 0;

	vp = ZTOV(zp);

	zfs_znode_sa_init(zfsvfs, zp, db, obj_type, hdl);

	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, &mode, 8);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_GEN(zfsvfs), NULL, &zp->z_gen, 8);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_SIZE(zfsvfs), NULL,
	&zp->z_size, 8);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_LINKS(zfsvfs), NULL,
	&zp->z_links, 8);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL,
	&zp->z_pflags, 8);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_PARENT(zfsvfs), NULL, &parent, 8);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ATIME(zfsvfs), NULL,
	&zp->z_atime, 16);
	#ifdef notyet
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MTIME(zfsvfs), NULL,
	&mtime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL,
	&ctime, 16);
	#endif
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_UID(zfsvfs), NULL,
	&zp->z_uid, 8);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_GID(zfsvfs), NULL,
	&zp->z_gid, 8);

	if (sa_bulk_lookup(zp->z_sa_hdl, bulk, count) != 0 \|\| zp->z_gen == 0 \|\|
	(dmu_objset_projectquota_enabled(zfsvfs->z_os) &&
	(zp->z_pflags & ZFS_PROJID) &&
	sa_lookup(zp->z_sa_hdl, SA_ZPL_PROJID(zfsvfs), &projid, 8) != 0)) {
	if (hdl == NULL)
	sa_handle_destroy(zp->z_sa_hdl);
	zfs_vnode_forget(vp);
	zp->z_vnode = NULL;
	zfs_znode_free_kmem(zp);
	return (NULL);
	}

	zp->z_projid = projid;
	zp->z_mode = mode;

	/* Cache the xattr parent id */
	if (zp->z_pflags & ZFS_XATTR)
	zp->z_xattr_parent = parent;

	vp->v_type = IFTOVT((mode_t)mode);

	switch (vp->v_type) {
	case VDIR:
	zp->z_zn_prefetch = B_TRUE; /* z_prefetch default is enabled */
	break;
	case VFIFO:
	vp->v_op = &zfs_fifoops;
	break;
	case VREG:
	if (parent == zfsvfs->z_shares_dir) {
	ASSERT(zp->z_uid == 0 && zp->z_gid == 0);
	vp->v_op = &zfs_shareops;
	}
	break;
	default:
	break;
	}

	mutex_enter(&zfsvfs->z_znodes_lock);
	list_insert_tail(&zfsvfs->z_all_znodes, zp);
	zfsvfs->z_nr_znodes++;
	membar_producer();
	/*
	* Everything else must be valid before assigning z_zfsvfs makes the
	* znode eligible for zfs_znode_move().
	*/
	zp->z_zfsvfs = zfsvfs;
	mutex_exit(&zfsvfs->z_znodes_lock);

	/*
	* Acquire vnode lock before making it available to the world.
	*/
	vn_lock(vp, LK_EXCLUSIVE \| LK_RETRY);
	VN_LOCK_AREC(vp);
	if (vp->v_type != VFIFO)
	VN_LOCK_ASHARE(vp);

	return (zp);
	}

	static uint64_t empty_xattr;
	static uint64_t pad[4];
	static zfs_acl_phys_t acl_phys;
	/*
	* Create a new DMU object to hold a zfs znode.
	*
	* IN: dzp - parent directory for new znode
	* vap - file attributes for new znode
	* tx - dmu transaction id for zap operations
	* cr - credentials of caller
	* flag - flags:
	* IS_ROOT_NODE - new object will be root
	* IS_XATTR - new object is an attribute
	* bonuslen - length of bonus buffer
	* setaclp - File/Dir initial ACL
	* fuidp - Tracks fuid allocation.
	*
	* OUT: zpp - allocated znode
	*
	*/
	void
	zfs_mknode(znode_t dzp, vattr_t vap, dmu_tx_t tx, cred_t cr,
	uint_t flag, znode_t *zpp, zfs_acl_ids_t acl_ids)
	{
	uint64_t crtime[2], atime[2], mtime[2], ctime[2];
	uint64_t mode, size, links, parent, pflags;
	uint64_t dzp_pflags = 0;
	uint64_t rdev = 0;
	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
	dmu_buf_t *db;
	timestruc_t now;
	uint64_t gen, obj;
	int err;
	int bonuslen;
	int dnodesize;
	sa_handle_t *sa_hdl;
	dmu_object_type_t obj_type;
	sa_bulk_attr_t *sa_attrs;
	int cnt = 0;
	zfs_acl_locator_cb_t locate = { 0 };

	ASSERT(vap && ((vap->va_mask & AT_MODE) == AT_MODE));

	if (zfsvfs->z_replay) {
	obj = vap->va_nodeid;
	now = vap->va_ctime; /* see zfs_replay_create() */
	gen = vap->va_nblocks; /* ditto */
	dnodesize = vap->va_fsid; /* ditto */
	} else {
	obj = 0;
	vfs_timestamp(&now);
	gen = dmu_tx_get_txg(tx);
	dnodesize = dmu_objset_dnodesize(zfsvfs->z_os);
	}

	if (dnodesize == 0)
	dnodesize = DNODE_MIN_SIZE;

	obj_type = zfsvfs->z_use_sa ? DMU_OT_SA : DMU_OT_ZNODE;
	bonuslen = (obj_type == DMU_OT_SA) ?
	DN_BONUS_SIZE(dnodesize) : ZFS_OLD_ZNODE_PHYS_SIZE;

	/*
	* Create a new DMU object.
	*/
	/*
	* There's currently no mechanism for pre-reading the blocks that will
	* be needed to allocate a new object, so we accept the small chance
	* that there will be an i/o error and we will fail one of the
	* assertions below.
	*/
	if (vap->va_type == VDIR) {
	if (zfsvfs->z_replay) {
	VERIFY0(zap_create_claim_norm_dnsize(zfsvfs->z_os, obj,
	zfsvfs->z_norm, DMU_OT_DIRECTORY_CONTENTS,
	obj_type, bonuslen, dnodesize, tx));
	} else {
	obj = zap_create_norm_dnsize(zfsvfs->z_os,
	zfsvfs->z_norm, DMU_OT_DIRECTORY_CONTENTS,
	obj_type, bonuslen, dnodesize, tx);
	}
	} else {
	if (zfsvfs->z_replay) {
	VERIFY0(dmu_object_claim_dnsize(zfsvfs->z_os, obj,
	DMU_OT_PLAIN_FILE_CONTENTS, 0,
	obj_type, bonuslen, dnodesize, tx));
	} else {
	obj = dmu_object_alloc_dnsize(zfsvfs->z_os,
	DMU_OT_PLAIN_FILE_CONTENTS, 0,
	obj_type, bonuslen, dnodesize, tx);
	}
	}

	ZFS_OBJ_HOLD_ENTER(zfsvfs, obj);
	VERIFY(0 == sa_buf_hold(zfsvfs->z_os, obj, NULL, &db));

	/*
	* If this is the root, fix up the half-initialized parent pointer
	* to reference the just-allocated physical data area.
	*/
	if (flag & IS_ROOT_NODE) {
	dzp->z_id = obj;
	} else {
	dzp_pflags = dzp->z_pflags;
	}

	/*
	* If parent is an xattr, so am I.
	*/
	if (dzp_pflags & ZFS_XATTR) {
	flag \|= IS_XATTR;
	}

	if (zfsvfs->z_use_fuids)
	pflags = ZFS_ARCHIVE \| ZFS_AV_MODIFIED;
	else
	pflags = 0;

	if (vap->va_type == VDIR) {
	size = 2; /* contents ("." and "..") */
	links = (flag & (IS_ROOT_NODE \| IS_XATTR)) ? 2 : 1;
	} else {
	size = links = 0;
	}

	if (vap->va_type == VBLK \|\| vap->va_type == VCHR) {
	rdev = zfs_expldev(vap->va_rdev);
	}

	parent = dzp->z_id;
	mode = acl_ids->z_mode;
	if (flag & IS_XATTR)
	pflags \|= ZFS_XATTR;

	/*
	* No execs denied will be determined when zfs_mode_compute() is called.
	*/
	pflags \|= acl_ids->z_aclp->z_hints &
	(ZFS_ACL_TRIVIAL\|ZFS_INHERIT_ACE\|ZFS_ACL_AUTO_INHERIT\|
	ZFS_ACL_DEFAULTED\|ZFS_ACL_PROTECTED);

	ZFS_TIME_ENCODE(&now, crtime);
	ZFS_TIME_ENCODE(&now, ctime);

	if (vap->va_mask & AT_ATIME) {
	ZFS_TIME_ENCODE(&vap->va_atime, atime);
	} else {
	ZFS_TIME_ENCODE(&now, atime);
	}

	if (vap->va_mask & AT_MTIME) {
	ZFS_TIME_ENCODE(&vap->va_mtime, mtime);
	} else {
	ZFS_TIME_ENCODE(&now, mtime);
	}

	/* Now add in all of the "SA" attributes */
	VERIFY(0 == sa_handle_get_from_db(zfsvfs->z_os, db, NULL, SA_HDL_SHARED,
	&sa_hdl));

	/*
	* Setup the array of attributes to be replaced/set on the new file
	*
	* order for DMU_OT_ZNODE is critical since it needs to be constructed
	* in the old znode_phys_t format. Don't change this ordering
	*/
	sa_attrs = kmem_alloc(sizeof (sa_bulk_attr_t) * ZPL_END, KM_SLEEP);

	if (obj_type == DMU_OT_ZNODE) {
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_ATIME(zfsvfs),
	NULL, &atime, 16);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_MTIME(zfsvfs),
	NULL, &mtime, 16);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_CTIME(zfsvfs),
	NULL, &ctime, 16);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_CRTIME(zfsvfs),
	NULL, &crtime, 16);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_GEN(zfsvfs),
	NULL, &gen, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_MODE(zfsvfs),
	NULL, &mode, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_SIZE(zfsvfs),
	NULL, &size, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_PARENT(zfsvfs),
	NULL, &parent, 8);
	} else {
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_MODE(zfsvfs),
	NULL, &mode, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_SIZE(zfsvfs),
	NULL, &size, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_GEN(zfsvfs),
	NULL, &gen, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_UID(zfsvfs),
	NULL, &acl_ids->z_fuid, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_GID(zfsvfs),
	NULL, &acl_ids->z_fgid, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_PARENT(zfsvfs),
	NULL, &parent, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_FLAGS(zfsvfs),
	NULL, &pflags, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_ATIME(zfsvfs),
	NULL, &atime, 16);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_MTIME(zfsvfs),
	NULL, &mtime, 16);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_CTIME(zfsvfs),
	NULL, &ctime, 16);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_CRTIME(zfsvfs),
	NULL, &crtime, 16);
	}

	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_LINKS(zfsvfs), NULL, &links, 8);

	if (obj_type == DMU_OT_ZNODE) {
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_XATTR(zfsvfs), NULL,
	&empty_xattr, 8);
	}
	if (obj_type == DMU_OT_ZNODE \|\|
	(vap->va_type == VBLK \|\| vap->va_type == VCHR)) {
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_RDEV(zfsvfs),
	NULL, &rdev, 8);

	}
	if (obj_type == DMU_OT_ZNODE) {
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_FLAGS(zfsvfs),
	NULL, &pflags, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_UID(zfsvfs), NULL,
	&acl_ids->z_fuid, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_GID(zfsvfs), NULL,
	&acl_ids->z_fgid, 8);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_PAD(zfsvfs), NULL, pad,
	sizeof (uint64_t) * 4);
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_ZNODE_ACL(zfsvfs), NULL,
	&acl_phys, sizeof (zfs_acl_phys_t));
	} else if (acl_ids->z_aclp->z_version >= ZFS_ACL_VERSION_FUID) {
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_DACL_COUNT(zfsvfs), NULL,
	&acl_ids->z_aclp->z_acl_count, 8);
	locate.cb_aclp = acl_ids->z_aclp;
	SA_ADD_BULK_ATTR(sa_attrs, cnt, SA_ZPL_DACL_ACES(zfsvfs),
	zfs_acl_data_locator, &locate,
	acl_ids->z_aclp->z_acl_bytes);
	mode = zfs_mode_compute(mode, acl_ids->z_aclp, &pflags,
	acl_ids->z_fuid, acl_ids->z_fgid);
	}

	VERIFY(sa_replace_all_by_template(sa_hdl, sa_attrs, cnt, tx) == 0);

	if (!(flag & IS_ROOT_NODE)) {
	*zpp = zfs_znode_alloc(zfsvfs, db, 0, obj_type, sa_hdl);
	ASSERT(*zpp != NULL);
	} else {
	/*
	* If we are creating the root node, the "parent" we
	* passed in is the znode for the root.
	*/
	*zpp = dzp;

	(*zpp)->z_sa_hdl = sa_hdl;
	}

	(*zpp)->z_pflags = pflags;
	(*zpp)->z_mode = mode;
	(*zpp)->z_dnodesize = dnodesize;

	if (vap->va_mask & AT_XVATTR)
	zfs_xvattr_set(zpp, (xvattr_t )vap, tx);

	if (obj_type == DMU_OT_ZNODE \|\|
	acl_ids->z_aclp->z_version < ZFS_ACL_VERSION_FUID) {
	VERIFY0(zfs_aclset_common(*zpp, acl_ids->z_aclp, cr, tx));
	}
	if (!(flag & IS_ROOT_NODE)) {
	vnode_t *vp;

	vp = ZTOV(*zpp);
	vp->v_vflag \|= VV_FORCEINSMQ;
	err = insmntque(vp, zfsvfs->z_vfs);
	vp->v_vflag &= ~VV_FORCEINSMQ;
	KASSERT(err == 0, ("insmntque() failed: error %d", err));
	}
	kmem_free(sa_attrs, sizeof (sa_bulk_attr_t) * ZPL_END);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj);
	}

	/*
	* Update in-core attributes. It is assumed the caller will be doing an
	* sa_bulk_update to push the changes out.
	*/
	void
	zfs_xvattr_set(znode_t zp, xvattr_t xvap, dmu_tx_t *tx)
	{
	xoptattr_t *xoap;

	xoap = xva_getxoptattr(xvap);
	ASSERT(xoap);

	ASSERT_VOP_IN_SEQC(ZTOV(zp));

	if (XVA_ISSET_REQ(xvap, XAT_CREATETIME)) {
	uint64_t times[2];
	ZFS_TIME_ENCODE(&xoap->xoa_createtime, times);
	(void) sa_update(zp->z_sa_hdl, SA_ZPL_CRTIME(zp->z_zfsvfs),
	&times, sizeof (times), tx);
	XVA_SET_RTN(xvap, XAT_CREATETIME);
	}
	if (XVA_ISSET_REQ(xvap, XAT_READONLY)) {
	ZFS_ATTR_SET(zp, ZFS_READONLY, xoap->xoa_readonly,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_READONLY);
	}
	if (XVA_ISSET_REQ(xvap, XAT_HIDDEN)) {
	ZFS_ATTR_SET(zp, ZFS_HIDDEN, xoap->xoa_hidden,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_HIDDEN);
	}
	if (XVA_ISSET_REQ(xvap, XAT_SYSTEM)) {
	ZFS_ATTR_SET(zp, ZFS_SYSTEM, xoap->xoa_system,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_SYSTEM);
	}
	if (XVA_ISSET_REQ(xvap, XAT_ARCHIVE)) {
	ZFS_ATTR_SET(zp, ZFS_ARCHIVE, xoap->xoa_archive,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_ARCHIVE);
	}
	if (XVA_ISSET_REQ(xvap, XAT_IMMUTABLE)) {
	ZFS_ATTR_SET(zp, ZFS_IMMUTABLE, xoap->xoa_immutable,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_IMMUTABLE);
	}
	if (XVA_ISSET_REQ(xvap, XAT_NOUNLINK)) {
	ZFS_ATTR_SET(zp, ZFS_NOUNLINK, xoap->xoa_nounlink,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_NOUNLINK);
	}
	if (XVA_ISSET_REQ(xvap, XAT_APPENDONLY)) {
	ZFS_ATTR_SET(zp, ZFS_APPENDONLY, xoap->xoa_appendonly,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_APPENDONLY);
	}
	if (XVA_ISSET_REQ(xvap, XAT_NODUMP)) {
	ZFS_ATTR_SET(zp, ZFS_NODUMP, xoap->xoa_nodump,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_NODUMP);
	}
	if (XVA_ISSET_REQ(xvap, XAT_OPAQUE)) {
	ZFS_ATTR_SET(zp, ZFS_OPAQUE, xoap->xoa_opaque,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_OPAQUE);
	}
	if (XVA_ISSET_REQ(xvap, XAT_AV_QUARANTINED)) {
	ZFS_ATTR_SET(zp, ZFS_AV_QUARANTINED,
	xoap->xoa_av_quarantined, zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_AV_QUARANTINED);
	}
	if (XVA_ISSET_REQ(xvap, XAT_AV_MODIFIED)) {
	ZFS_ATTR_SET(zp, ZFS_AV_MODIFIED, xoap->xoa_av_modified,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_AV_MODIFIED);
	}
	if (XVA_ISSET_REQ(xvap, XAT_AV_SCANSTAMP)) {
	zfs_sa_set_scanstamp(zp, xvap, tx);
	XVA_SET_RTN(xvap, XAT_AV_SCANSTAMP);
	}
	if (XVA_ISSET_REQ(xvap, XAT_REPARSE)) {
	ZFS_ATTR_SET(zp, ZFS_REPARSE, xoap->xoa_reparse,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_REPARSE);
	}
	if (XVA_ISSET_REQ(xvap, XAT_OFFLINE)) {
	ZFS_ATTR_SET(zp, ZFS_OFFLINE, xoap->xoa_offline,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_OFFLINE);
	}
	if (XVA_ISSET_REQ(xvap, XAT_SPARSE)) {
	ZFS_ATTR_SET(zp, ZFS_SPARSE, xoap->xoa_sparse,
	zp->z_pflags, tx);
	XVA_SET_RTN(xvap, XAT_SPARSE);
	}
	}

	int
	zfs_zget(zfsvfs_t zfsvfs, uint64_t obj_num, znode_t *zpp)
	{
	dmu_object_info_t doi;
	dmu_buf_t *db;
	znode_t *zp;
	vnode_t *vp;
	sa_handle_t *hdl;
	struct thread *td;
	int locked;
	int err;

	td = curthread;
	getnewvnode_reserve_();
	again:
	*zpp = NULL;
	ZFS_OBJ_HOLD_ENTER(zfsvfs, obj_num);

	err = sa_buf_hold(zfsvfs->z_os, obj_num, NULL, &db);
	if (err) {
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	getnewvnode_drop_reserve();
	return (err);
	}

	dmu_object_info_from_db(db, &doi);
	if (doi.doi_bonus_type != DMU_OT_SA &&
	(doi.doi_bonus_type != DMU_OT_ZNODE \|\|
	(doi.doi_bonus_type == DMU_OT_ZNODE &&
	doi.doi_bonus_size < sizeof (znode_phys_t)))) {
	sa_buf_rele(db, NULL);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	getnewvnode_drop_reserve();
	return (SET_ERROR(EINVAL));
	}

	hdl = dmu_buf_get_user(db);
	if (hdl != NULL) {
	zp = sa_get_userdata(hdl);

	/*
	* Since "SA" does immediate eviction we
	* should never find a sa handle that doesn't
	* know about the znode.
	*/
	ASSERT3P(zp, !=, NULL);
	ASSERT3U(zp->z_id, ==, obj_num);
	if (zp->z_unlinked) {
	err = SET_ERROR(ENOENT);
	} else {
	vp = ZTOV(zp);
	/*
	* Don't let the vnode disappear after
	* ZFS_OBJ_HOLD_EXIT.
	*/
	VN_HOLD(vp);
	*zpp = zp;
	err = 0;
	}

	sa_buf_rele(db, NULL);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);

	if (err) {
	getnewvnode_drop_reserve();
	return (err);
	}

	locked = VOP_ISLOCKED(vp);
	VI_LOCK(vp);
	if (VN_IS_DOOMED(vp) && locked != LK_EXCLUSIVE) {
	/*
	* The vnode is doomed and this thread doesn't
	* hold the exclusive lock on it, so the vnode
	* must be being reclaimed by another thread.
	* Otherwise the doomed vnode is being reclaimed
	* by this thread and zfs_zget is called from
	* ZIL internals.
	*/
	VI_UNLOCK(vp);

	/*
	* XXX vrele() locks the vnode when the last reference
	* is dropped. Although in this case the vnode is
	* doomed / dead and so no inactivation is required,
	* the vnode lock is still acquired. That could result
	* in a LOR with z_teardown_lock if another thread holds
	* the vnode's lock and tries to take z_teardown_lock.
	* But that is only possible if the other thread peforms
	* a ZFS vnode operation on the vnode. That either
	* should not happen if the vnode is dead or the thread
	* should also have a reference to the vnode and thus
	* our reference is not last.
	*/
	VN_RELE(vp);
	goto again;
	}
	VI_UNLOCK(vp);
	getnewvnode_drop_reserve();
	return (err);
	}

	/*
	* Not found create new znode/vnode
	* but only if file exists.
	*
	* There is a small window where zfs_vget() could
	* find this object while a file create is still in
	* progress. This is checked for in zfs_znode_alloc()
	*
	* if zfs_znode_alloc() fails it will drop the hold on the
	* bonus buffer.
	*/
	zp = zfs_znode_alloc(zfsvfs, db, doi.doi_data_block_size,
	doi.doi_bonus_type, NULL);
	if (zp == NULL) {
	err = SET_ERROR(ENOENT);
	} else {
	*zpp = zp;
	}
	if (err == 0) {
	vnode_t *vp = ZTOV(zp);

	err = insmntque(vp, zfsvfs->z_vfs);
	if (err == 0) {
	vp->v_hash = obj_num;
	VOP_UNLOCK1(vp);
	} else {
	zp->z_vnode = NULL;
	zfs_znode_dmu_fini(zp);
	zfs_znode_free(zp);
	*zpp = NULL;
	}
	}
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	getnewvnode_drop_reserve();
	return (err);
	}

	int
	zfs_rezget(znode_t *zp)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	dmu_object_info_t doi;
	dmu_buf_t *db;
	vnode_t *vp;
	uint64_t obj_num = zp->z_id;
	uint64_t mode, size;
	sa_bulk_attr_t bulk[8];
	int err;
	int count = 0;
	uint64_t gen;

	/*
	* Remove cached pages before reloading the znode, so that they are not
	* lingering after we run into any error. Ideally, we should vgone()
	* the vnode in case of error, but currently we cannot do that
	* because of the LOR between the vnode lock and z_teardown_lock.
	* So, instead, we have to "doom" the znode in the illumos style.
	*/
	vp = ZTOV(zp);
	vn_pages_remove(vp, 0, 0);

	ZFS_OBJ_HOLD_ENTER(zfsvfs, obj_num);

	mutex_enter(&zp->z_acl_lock);
	if (zp->z_acl_cached) {
	zfs_acl_free(zp->z_acl_cached);
	zp->z_acl_cached = NULL;
	}

	mutex_exit(&zp->z_acl_lock);
	ASSERT(zp->z_sa_hdl == NULL);
	err = sa_buf_hold(zfsvfs->z_os, obj_num, NULL, &db);
	if (err) {
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	return (err);
	}

	dmu_object_info_from_db(db, &doi);
	if (doi.doi_bonus_type != DMU_OT_SA &&
	(doi.doi_bonus_type != DMU_OT_ZNODE \|\|
	(doi.doi_bonus_type == DMU_OT_ZNODE &&
	doi.doi_bonus_size < sizeof (znode_phys_t)))) {
	sa_buf_rele(db, NULL);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	return (SET_ERROR(EINVAL));
	}

	zfs_znode_sa_init(zfsvfs, zp, db, doi.doi_bonus_type, NULL);
	size = zp->z_size;

	/* reload cached values */
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_GEN(zfsvfs), NULL,
	&gen, sizeof (gen));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_SIZE(zfsvfs), NULL,
	&zp->z_size, sizeof (zp->z_size));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_LINKS(zfsvfs), NULL,
	&zp->z_links, sizeof (zp->z_links));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL,
	&zp->z_pflags, sizeof (zp->z_pflags));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ATIME(zfsvfs), NULL,
	&zp->z_atime, sizeof (zp->z_atime));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_UID(zfsvfs), NULL,
	&zp->z_uid, sizeof (zp->z_uid));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_GID(zfsvfs), NULL,
	&zp->z_gid, sizeof (zp->z_gid));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL,
	&mode, sizeof (mode));

	if (sa_bulk_lookup(zp->z_sa_hdl, bulk, count)) {
	zfs_znode_dmu_fini(zp);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	return (SET_ERROR(EIO));
	}

	zp->z_mode = mode;

	if (gen != zp->z_gen) {
	zfs_znode_dmu_fini(zp);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	return (SET_ERROR(EIO));
	}

	/*
	* It is highly improbable but still quite possible that two
	* objects in different datasets are created with the same
	* object numbers and in transaction groups with the same
	* numbers. znodes corresponding to those objects would
	* have the same z_id and z_gen, but their other attributes
	* may be different.
	* zfs recv -F may replace one of such objects with the other.
	* As a result file properties recorded in the replaced
	* object's vnode may no longer match the received object's
	* properties. At present the only cached property is the
	* files type recorded in v_type.
	* So, handle this case by leaving the old vnode and znode
	* disassociated from the actual object. A new vnode and a
	* znode will be created if the object is accessed
	* (e.g. via a look-up). The old vnode and znode will be
	* recycled when the last vnode reference is dropped.
	*/
	if (vp->v_type != IFTOVT((mode_t)zp->z_mode)) {
	zfs_znode_dmu_fini(zp);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	return (SET_ERROR(EIO));
	}

	/*
	* If the file has zero links, then it has been unlinked on the send
	* side and it must be in the received unlinked set.
	* We call zfs_znode_dmu_fini() now to prevent any accesses to the
	* stale data and to prevent automatically removal of the file in
	* zfs_zinactive(). The file will be removed either when it is removed
	* on the send side and the next incremental stream is received or
	* when the unlinked set gets processed.
	*/
	zp->z_unlinked = (zp->z_links == 0);
	if (zp->z_unlinked) {
	zfs_znode_dmu_fini(zp);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);
	return (0);
	}

	zp->z_blksz = doi.doi_data_block_size;
	if (zp->z_size != size)
	vnode_pager_setsize(vp, zp->z_size);

	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj_num);

	return (0);
	}

	void
	zfs_znode_delete(znode_t zp, dmu_tx_t tx)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	objset_t *os = zfsvfs->z_os;
	uint64_t obj = zp->z_id;
	uint64_t acl_obj = zfs_external_acl(zp);

	ZFS_OBJ_HOLD_ENTER(zfsvfs, obj);
	if (acl_obj) {
	VERIFY(!zp->z_is_sa);
	VERIFY(0 == dmu_object_free(os, acl_obj, tx));
	}
	VERIFY(0 == dmu_object_free(os, obj, tx));
	zfs_znode_dmu_fini(zp);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, obj);
	zfs_znode_free(zp);
	}

	void
	zfs_zinactive(znode_t *zp)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	uint64_t z_id = zp->z_id;

	ASSERT(zp->z_sa_hdl);

	/*
	* Don't allow a zfs_zget() while were trying to release this znode
	*/
	ZFS_OBJ_HOLD_ENTER(zfsvfs, z_id);

	/*
	* If this was the last reference to a file with no links, remove
	* the file from the file system unless the file system is mounted
	* read-only. That can happen, for example, if the file system was
	* originally read-write, the file was opened, then unlinked and
	* the file system was made read-only before the file was finally
	* closed. The file will remain in the unlinked set.
	*/
	if (zp->z_unlinked) {
	ASSERT(!zfsvfs->z_issnap);
	if ((zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) == 0) {
	ZFS_OBJ_HOLD_EXIT(zfsvfs, z_id);
	zfs_rmnode(zp);
	return;
	}
	}

	zfs_znode_dmu_fini(zp);
	ZFS_OBJ_HOLD_EXIT(zfsvfs, z_id);
	zfs_znode_free(zp);
	}

	void
	zfs_znode_free(znode_t *zp)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;

	ASSERT(zp->z_sa_hdl == NULL);
	zp->z_vnode = NULL;
	mutex_enter(&zfsvfs->z_znodes_lock);
	POINTER_INVALIDATE(&zp->z_zfsvfs);
	list_remove(&zfsvfs->z_all_znodes, zp);
	zfsvfs->z_nr_znodes--;
	mutex_exit(&zfsvfs->z_znodes_lock);

	if (zp->z_acl_cached) {
	zfs_acl_free(zp->z_acl_cached);
	zp->z_acl_cached = NULL;
	}

	zfs_znode_free_kmem(zp);
	}

	void
	zfs_tstamp_update_setup_ext(znode_t *zp, uint_t flag, uint64_t mtime[2],
	uint64_t ctime[2], boolean_t have_tx)
	{
	timestruc_t now;

	vfs_timestamp(&now);

	if (have_tx) { /* will sa_bulk_update happen really soon? */
	zp->z_atime_dirty = 0;
	zp->z_seq++;
	} else {
	zp->z_atime_dirty = 1;
	}

	if (flag & AT_ATIME) {
	ZFS_TIME_ENCODE(&now, zp->z_atime);
	}

	if (flag & AT_MTIME) {
	ZFS_TIME_ENCODE(&now, mtime);
	if (zp->z_zfsvfs->z_use_fuids) {
	zp->z_pflags \|= (ZFS_ARCHIVE \|
	ZFS_AV_MODIFIED);
	}
	}

	if (flag & AT_CTIME) {
	ZFS_TIME_ENCODE(&now, ctime);
	if (zp->z_zfsvfs->z_use_fuids)
	zp->z_pflags \|= ZFS_ARCHIVE;
	}
	}


	void
	zfs_tstamp_update_setup(znode_t *zp, uint_t flag, uint64_t mtime[2],
	uint64_t ctime[2])
	{
	zfs_tstamp_update_setup_ext(zp, flag, mtime, ctime, B_TRUE);
	}
	/*
	* Grow the block size for a file.
	*
	* IN: zp - znode of file to free data in.
	* size - requested block size
	* tx - open transaction.
	*
	* NOTE: this function assumes that the znode is write locked.
	*/
	void
	zfs_grow_blocksize(znode_t zp, uint64_t size, dmu_tx_t tx)
	{
	int error;
	u_longlong_t dummy;

	if (size <= zp->z_blksz)
	return;
	/*
	* If the file size is already greater than the current blocksize,
	* we will not grow. If there is more than one block in a file,
	* the blocksize cannot change.
	*/
	if (zp->z_blksz && zp->z_size > zp->z_blksz)
	return;

	error = dmu_object_set_blocksize(zp->z_zfsvfs->z_os, zp->z_id,
	size, 0, tx);

	if (error == ENOTSUP)
	return;
	ASSERT0(error);

	/* What blocksize did we actually get? */
	dmu_object_size_from_db(sa_get_db(zp->z_sa_hdl), &zp->z_blksz, &dummy);
	}

	/*
	* Increase the file length
	*
	* IN: zp - znode of file to free data in.
	* end - new end-of-file
	*
	* RETURN: 0 on success, error code on failure
	*/
	static int
	zfs_extend(znode_t *zp, uint64_t end)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	dmu_tx_t *tx;
	zfs_locked_range_t *lr;
	uint64_t newblksz;
	int error;

	/*
	* We will change zp_size, lock the whole file.
	*/
	lr = zfs_rangelock_enter(&zp->z_rangelock, 0, UINT64_MAX, RL_WRITER);

	/*
	* Nothing to do if file already at desired length.
	*/
	if (end <= zp->z_size) {
	zfs_rangelock_exit(lr);
	return (0);
	}
	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	zfs_sa_upgrade_txholds(tx, zp);
	if (end > zp->z_blksz &&
	(!ISP2(zp->z_blksz) \|\| zp->z_blksz < zfsvfs->z_max_blksz)) {
	/*
	* We are growing the file past the current block size.
	*/
	if (zp->z_blksz > zp->z_zfsvfs->z_max_blksz) {
	/*
	* File's blocksize is already larger than the
	* "recordsize" property. Only let it grow to
	* the next power of 2.
	*/
	ASSERT(!ISP2(zp->z_blksz));
	newblksz = MIN(end, 1 << highbit64(zp->z_blksz));
	} else {
	newblksz = MIN(end, zp->z_zfsvfs->z_max_blksz);
	}
	dmu_tx_hold_write(tx, zp->z_id, 0, newblksz);
	} else {
	newblksz = 0;
	}

	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	zfs_rangelock_exit(lr);
	return (error);
	}

	if (newblksz)
	zfs_grow_blocksize(zp, newblksz, tx);

	zp->z_size = end;

	VERIFY(0 == sa_update(zp->z_sa_hdl, SA_ZPL_SIZE(zp->z_zfsvfs),
	&zp->z_size, sizeof (zp->z_size), tx));

	vnode_pager_setsize(ZTOV(zp), end);

	zfs_rangelock_exit(lr);

	dmu_tx_commit(tx);

	return (0);
	}

	/*
	* Free space in a file.
	*
	* IN: zp - znode of file to free data in.
	* off - start of section to free.
	* len - length of section to free.
	*
	* RETURN: 0 on success, error code on failure
	*/
	static int
	zfs_free_range(znode_t *zp, uint64_t off, uint64_t len)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	zfs_locked_range_t *lr;
	int error;

	/*
	* Lock the range being freed.
	*/
	lr = zfs_rangelock_enter(&zp->z_rangelock, off, len, RL_WRITER);

	/*
	* Nothing to do if file already at desired length.
	*/
	if (off >= zp->z_size) {
	zfs_rangelock_exit(lr);
	return (0);
	}

	if (off + len > zp->z_size)
	len = zp->z_size - off;

	error = dmu_free_long_range(zfsvfs->z_os, zp->z_id, off, len);

	if (error == 0) {
	/*
	* In FreeBSD we cannot free block in the middle of a file,
	* but only at the end of a file, so this code path should
	* never happen.
	*/
	vnode_pager_setsize(ZTOV(zp), off);
	}

	zfs_rangelock_exit(lr);

	return (error);
	}

	/*
	* Truncate a file
	*
	* IN: zp - znode of file to free data in.
	* end - new end-of-file.
	*
	* RETURN: 0 on success, error code on failure
	*/
	static int
	zfs_trunc(znode_t *zp, uint64_t end)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	vnode_t *vp = ZTOV(zp);
	dmu_tx_t *tx;
	zfs_locked_range_t *lr;
	int error;
	sa_bulk_attr_t bulk[2];
	int count = 0;

	/*
	* We will change zp_size, lock the whole file.
	*/
	lr = zfs_rangelock_enter(&zp->z_rangelock, 0, UINT64_MAX, RL_WRITER);

	/*
	* Nothing to do if file already at desired length.
	*/
	if (end >= zp->z_size) {
	zfs_rangelock_exit(lr);
	return (0);
	}

	error = dmu_free_long_range(zfsvfs->z_os, zp->z_id, end,
	DMU_OBJECT_END);
	if (error) {
	zfs_rangelock_exit(lr);
	return (error);
	}
	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	zfs_sa_upgrade_txholds(tx, zp);
	dmu_tx_mark_netfree(tx);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	zfs_rangelock_exit(lr);
	return (error);
	}

	zp->z_size = end;
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_SIZE(zfsvfs),
	NULL, &zp->z_size, sizeof (zp->z_size));

	if (end == 0) {
	zp->z_pflags &= ~ZFS_SPARSE;
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs),
	NULL, &zp->z_pflags, 8);
	}
	VERIFY(sa_bulk_update(zp->z_sa_hdl, bulk, count, tx) == 0);

	dmu_tx_commit(tx);

	/*
	* Clear any mapped pages in the truncated region. This has to
	* happen outside of the transaction to avoid the possibility of
	* a deadlock with someone trying to push a page that we are
	* about to invalidate.
	*/
	vnode_pager_setsize(vp, end);

	zfs_rangelock_exit(lr);

	return (0);
	}

	/*
	* Free space in a file
	*
	* IN: zp - znode of file to free data in.
	* off - start of range
	* len - end of range (0 => EOF)
	* flag - current file open mode flags.
	* log - TRUE if this action should be logged
	*
	* RETURN: 0 on success, error code on failure
	*/
	int
	zfs_freesp(znode_t *zp, uint64_t off, uint64_t len, int flag, boolean_t log)
	{
	dmu_tx_t *tx;
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	zilog_t *zilog = zfsvfs->z_log;
	uint64_t mode;
	uint64_t mtime[2], ctime[2];
	sa_bulk_attr_t bulk[3];
	int count = 0;
	int error;

	if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_MODE(zfsvfs), &mode,
	sizeof (mode))) != 0)
	return (error);

	if (off > zp->z_size) {
	error = zfs_extend(zp, off+len);
	if (error == 0 && log)
	goto log;
	else
	return (error);
	}

	if (len == 0) {
	error = zfs_trunc(zp, off);
	} else {
	if ((error = zfs_free_range(zp, off, len)) == 0 &&
	off + len > zp->z_size)
	error = zfs_extend(zp, off+len);
	}
	if (error \|\| !log)
	return (error);
	log:
	tx = dmu_tx_create(zfsvfs->z_os);
	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_FALSE);
	zfs_sa_upgrade_txholds(tx, zp);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	return (error);
	}

	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MTIME(zfsvfs), NULL, mtime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, ctime, 16);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs),
	NULL, &zp->z_pflags, 8);
	zfs_tstamp_update_setup(zp, CONTENT_MODIFIED, mtime, ctime);
	error = sa_bulk_update(zp->z_sa_hdl, bulk, count, tx);
	ASSERT(error == 0);

	zfs_log_truncate(zilog, tx, TX_TRUNCATE, zp, off, len);

	dmu_tx_commit(tx);
	return (0);
	}

	void
	zfs_create_fs(objset_t os, cred_t cr, nvlist_t zplprops, dmu_tx_t tx)
	{
	uint64_t moid, obj, sa_obj, version;
	uint64_t sense = ZFS_CASE_SENSITIVE;
	uint64_t norm = 0;
	nvpair_t *elem;
	int error;
	int i;
	znode_t *rootzp = NULL;
	zfsvfs_t *zfsvfs;
	vattr_t vattr;
	znode_t *zp;
	zfs_acl_ids_t acl_ids;

	/*
	* First attempt to create master node.
	*/
	/*
	* In an empty objset, there are no blocks to read and thus
	* there can be no i/o errors (which we assert below).
	*/
	moid = MASTER_NODE_OBJ;
	error = zap_create_claim(os, moid, DMU_OT_MASTER_NODE,
	DMU_OT_NONE, 0, tx);
	ASSERT(error == 0);

	/*
	* Set starting attributes.
	*/
	version = zfs_zpl_version_map(spa_version(dmu_objset_spa(os)));
	elem = NULL;
	while ((elem = nvlist_next_nvpair(zplprops, elem)) != NULL) {
	/* For the moment we expect all zpl props to be uint64_ts */
	uint64_t val;
	char *name;

	ASSERT(nvpair_type(elem) == DATA_TYPE_UINT64);
	VERIFY(nvpair_value_uint64(elem, &val) == 0);
	name = nvpair_name(elem);
	if (strcmp(name, zfs_prop_to_name(ZFS_PROP_VERSION)) == 0) {
	if (val < version)
	version = val;
	} else {
	error = zap_update(os, moid, name, 8, 1, &val, tx);
	}
	ASSERT(error == 0);
	if (strcmp(name, zfs_prop_to_name(ZFS_PROP_NORMALIZE)) == 0)
	norm = val;
	else if (strcmp(name, zfs_prop_to_name(ZFS_PROP_CASE)) == 0)
	sense = val;
	}
	ASSERT(version != 0);
	error = zap_update(os, moid, ZPL_VERSION_STR, 8, 1, &version, tx);

	/*
	* Create zap object used for SA attribute registration
	*/

	if (version >= ZPL_VERSION_SA) {
	sa_obj = zap_create(os, DMU_OT_SA_MASTER_NODE,
	DMU_OT_NONE, 0, tx);
	error = zap_add(os, moid, ZFS_SA_ATTRS, 8, 1, &sa_obj, tx);
	ASSERT(error == 0);
	} else {
	sa_obj = 0;
	}
	/*
	* Create a delete queue.
	*/
	obj = zap_create(os, DMU_OT_UNLINKED_SET, DMU_OT_NONE, 0, tx);

	error = zap_add(os, moid, ZFS_UNLINKED_SET, 8, 1, &obj, tx);
	ASSERT(error == 0);

	/*
	* Create root znode. Create minimal znode/vnode/zfsvfs
	* to allow zfs_mknode to work.
	*/
	VATTR_NULL(&vattr);
	vattr.va_mask = AT_MODE\|AT_UID\|AT_GID;
	vattr.va_type = VDIR;
	vattr.va_mode = S_IFDIR\|0755;
	vattr.va_uid = crgetuid(cr);
	vattr.va_gid = crgetgid(cr);

	zfsvfs = kmem_zalloc(sizeof (zfsvfs_t), KM_SLEEP);

	rootzp = zfs_znode_alloc_kmem(KM_SLEEP);
	ASSERT(!POINTER_IS_VALID(rootzp->z_zfsvfs));
	rootzp->z_moved = 0;
	rootzp->z_unlinked = 0;
	rootzp->z_atime_dirty = 0;
	rootzp->z_is_sa = USE_SA(version, os);

	zfsvfs->z_os = os;
	zfsvfs->z_parent = zfsvfs;
	zfsvfs->z_version = version;
	zfsvfs->z_use_fuids = USE_FUIDS(version, os);
	zfsvfs->z_use_sa = USE_SA(version, os);
	zfsvfs->z_norm = norm;

	error = sa_setup(os, sa_obj, zfs_attr_table, ZPL_END,
	&zfsvfs->z_attr_table);

	ASSERT(error == 0);

	/*
	* Fold case on file systems that are always or sometimes case
	* insensitive.
	*/
	if (sense == ZFS_CASE_INSENSITIVE \|\| sense == ZFS_CASE_MIXED)
	zfsvfs->z_norm \|= U8_TEXTPREP_TOUPPER;

	mutex_init(&zfsvfs->z_znodes_lock, NULL, MUTEX_DEFAULT, NULL);
	list_create(&zfsvfs->z_all_znodes, sizeof (znode_t),
	offsetof(znode_t, z_link_node));

	for (i = 0; i != ZFS_OBJ_MTX_SZ; i++)
	mutex_init(&zfsvfs->z_hold_mtx[i], NULL, MUTEX_DEFAULT, NULL);

	rootzp->z_zfsvfs = zfsvfs;
	VERIFY(0 == zfs_acl_ids_create(rootzp, IS_ROOT_NODE, &vattr,
	cr, NULL, &acl_ids));
	zfs_mknode(rootzp, &vattr, tx, cr, IS_ROOT_NODE, &zp, &acl_ids);
	ASSERT3P(zp, ==, rootzp);
	error = zap_add(os, moid, ZFS_ROOT_OBJ, 8, 1, &rootzp->z_id, tx);
	ASSERT(error == 0);
	zfs_acl_ids_free(&acl_ids);
	POINTER_INVALIDATE(&rootzp->z_zfsvfs);

	sa_handle_destroy(rootzp->z_sa_hdl);
	zfs_znode_free_kmem(rootzp);

	/*
	* Create shares directory
	*/

	error = zfs_create_share_dir(zfsvfs, tx);

	ASSERT(error == 0);

	for (i = 0; i != ZFS_OBJ_MTX_SZ; i++)
	mutex_destroy(&zfsvfs->z_hold_mtx[i]);
	kmem_free(zfsvfs, sizeof (zfsvfs_t));
	}
	#endif /* _KERNEL */

	static int
	zfs_sa_setup(objset_t osp, sa_attr_type_t *sa_table)
	{
	uint64_t sa_obj = 0;
	int error;

	error = zap_lookup(osp, MASTER_NODE_OBJ, ZFS_SA_ATTRS, 8, 1, &sa_obj);
	if (error != 0 && error != ENOENT)
	return (error);

	error = sa_setup(osp, sa_obj, zfs_attr_table, ZPL_END, sa_table);
	return (error);
	}

	static int
	zfs_grab_sa_handle(objset_t osp, uint64_t obj, sa_handle_t *hdlp,
	dmu_buf_t *db, void tag)
	{
	dmu_object_info_t doi;
	int error;

	if ((error = sa_buf_hold(osp, obj, tag, db)) != 0)
	return (error);

	dmu_object_info_from_db(*db, &doi);
	if ((doi.doi_bonus_type != DMU_OT_SA &&
	doi.doi_bonus_type != DMU_OT_ZNODE) \|\|
	(doi.doi_bonus_type == DMU_OT_ZNODE &&
	doi.doi_bonus_size < sizeof (znode_phys_t))) {
	sa_buf_rele(*db, tag);
	return (SET_ERROR(ENOTSUP));
	}

	error = sa_handle_get(osp, obj, NULL, SA_HDL_PRIVATE, hdlp);
	if (error != 0) {
	sa_buf_rele(*db, tag);
	return (error);
	}

	return (0);
	}

	static void
	zfs_release_sa_handle(sa_handle_t hdl, dmu_buf_t db, void *tag)
	{
	sa_handle_destroy(hdl);
	sa_buf_rele(db, tag);
	}

	/*
	* Given an object number, return its parent object number and whether
	* or not the object is an extended attribute directory.
	*/
	static int
	zfs_obj_to_pobj(objset_t osp, sa_handle_t hdl, sa_attr_type_t *sa_table,
	uint64_t pobjp, int is_xattrdir)
	{
	uint64_t parent;
	uint64_t pflags;
	uint64_t mode;
	uint64_t parent_mode;
	sa_bulk_attr_t bulk[3];
	sa_handle_t *sa_hdl;
	dmu_buf_t *sa_db;
	int count = 0;
	int error;

	SA_ADD_BULK_ATTR(bulk, count, sa_table[ZPL_PARENT], NULL,
	&parent, sizeof (parent));
	SA_ADD_BULK_ATTR(bulk, count, sa_table[ZPL_FLAGS], NULL,
	&pflags, sizeof (pflags));
	SA_ADD_BULK_ATTR(bulk, count, sa_table[ZPL_MODE], NULL,
	&mode, sizeof (mode));

	if ((error = sa_bulk_lookup(hdl, bulk, count)) != 0)
	return (error);

	/*
	* When a link is removed its parent pointer is not changed and will
	* be invalid. There are two cases where a link is removed but the
	* file stays around, when it goes to the delete queue and when there
	* are additional links.
	*/
	error = zfs_grab_sa_handle(osp, parent, &sa_hdl, &sa_db, FTAG);
	if (error != 0)
	return (error);

	error = sa_lookup(sa_hdl, ZPL_MODE, &parent_mode, sizeof (parent_mode));
	zfs_release_sa_handle(sa_hdl, sa_db, FTAG);
	if (error != 0)
	return (error);

	*is_xattrdir = ((pflags & ZFS_XATTR) != 0) && S_ISDIR(mode);

	/*
	* Extended attributes can be applied to files, directories, etc.
	* Otherwise the parent must be a directory.
	*/
	if (!*is_xattrdir && !S_ISDIR(parent_mode))
	return (SET_ERROR(EINVAL));

	*pobjp = parent;

	return (0);
	}

	/*
	* Given an object number, return some zpl level statistics
	*/
	static int
	zfs_obj_to_stats_impl(sa_handle_t hdl, sa_attr_type_t sa_table,
	zfs_stat_t *sb)
	{
	sa_bulk_attr_t bulk[4];
	int count = 0;

	SA_ADD_BULK_ATTR(bulk, count, sa_table[ZPL_MODE], NULL,
	&sb->zs_mode, sizeof (sb->zs_mode));
	SA_ADD_BULK_ATTR(bulk, count, sa_table[ZPL_GEN], NULL,
	&sb->zs_gen, sizeof (sb->zs_gen));
	SA_ADD_BULK_ATTR(bulk, count, sa_table[ZPL_LINKS], NULL,
	&sb->zs_links, sizeof (sb->zs_links));
	SA_ADD_BULK_ATTR(bulk, count, sa_table[ZPL_CTIME], NULL,
	&sb->zs_ctime, sizeof (sb->zs_ctime));

	return (sa_bulk_lookup(hdl, bulk, count));
	}

	static int
	zfs_obj_to_path_impl(objset_t osp, uint64_t obj, sa_handle_t hdl,
	sa_attr_type_t sa_table, char buf, int len)
	{
	sa_handle_t *sa_hdl;
	sa_handle_t *prevhdl = NULL;
	dmu_buf_t *prevdb = NULL;
	dmu_buf_t *sa_db = NULL;
	char *path = buf + len - 1;
	int error;

	*path = '\0';
	sa_hdl = hdl;

	uint64_t deleteq_obj;
	VERIFY0(zap_lookup(osp, MASTER_NODE_OBJ,
	ZFS_UNLINKED_SET, sizeof (uint64_t), 1, &deleteq_obj));
	error = zap_lookup_int(osp, deleteq_obj, obj);
	if (error == 0) {
	return (ESTALE);
	} else if (error != ENOENT) {
	return (error);
	}
	error = 0;

	for (;;) {
	uint64_t pobj;
	char component[MAXNAMELEN + 2];
	size_t complen;
	int is_xattrdir;

	if (prevdb)
	zfs_release_sa_handle(prevhdl, prevdb, FTAG);

	if ((error = zfs_obj_to_pobj(osp, sa_hdl, sa_table, &pobj,
	&is_xattrdir)) != 0)
	break;

	if (pobj == obj) {
	if (path[0] != '/')
	*--path = '/';
	break;
	}

	component[0] = '/';
	if (is_xattrdir) {
	(void) sprintf(component + 1, "<xattrdir>");
	} else {
	error = zap_value_search(osp, pobj, obj,
	ZFS_DIRENT_OBJ(-1ULL), component + 1);
	if (error != 0)
	break;
	}

	complen = strlen(component);
	path -= complen;
	ASSERT(path >= buf);
	bcopy(component, path, complen);
	obj = pobj;

	if (sa_hdl != hdl) {
	prevhdl = sa_hdl;
	prevdb = sa_db;
	}
	error = zfs_grab_sa_handle(osp, obj, &sa_hdl, &sa_db, FTAG);
	if (error != 0) {
	sa_hdl = prevhdl;
	sa_db = prevdb;
	break;
	}
	}

	if (sa_hdl != NULL && sa_hdl != hdl) {
	ASSERT(sa_db != NULL);
	zfs_release_sa_handle(sa_hdl, sa_db, FTAG);
	}

	if (error == 0)
	(void) memmove(buf, path, buf + len - path);

	return (error);
	}

	int
	zfs_obj_to_path(objset_t osp, uint64_t obj, char buf, int len)
	{
	sa_attr_type_t *sa_table;
	sa_handle_t *hdl;
	dmu_buf_t *db;
	int error;

	error = zfs_sa_setup(osp, &sa_table);
	if (error != 0)
	return (error);

	error = zfs_grab_sa_handle(osp, obj, &hdl, &db, FTAG);
	if (error != 0)
	return (error);

	error = zfs_obj_to_path_impl(osp, obj, hdl, sa_table, buf, len);

	zfs_release_sa_handle(hdl, db, FTAG);
	return (error);
	}

	int
	zfs_obj_to_stats(objset_t osp, uint64_t obj, zfs_stat_t sb,
	char *buf, int len)
	{
	char *path = buf + len - 1;
	sa_attr_type_t *sa_table;
	sa_handle_t *hdl;
	dmu_buf_t *db;
	int error;

	*path = '\0';

	error = zfs_sa_setup(osp, &sa_table);
	if (error != 0)
	return (error);

	error = zfs_grab_sa_handle(osp, obj, &hdl, &db, FTAG);
	if (error != 0)
	return (error);

	error = zfs_obj_to_stats_impl(hdl, sa_table, sb);
	if (error != 0) {
	zfs_release_sa_handle(hdl, db, FTAG);
	return (error);
	}

	error = zfs_obj_to_path_impl(osp, obj, hdl, sa_table, buf, len);

	zfs_release_sa_handle(hdl, db, FTAG);
	return (error);
	}

	#ifdef _KERNEL
	int
	zfs_znode_parent_and_name(znode_t zp, znode_t dzpp, char buf)
	{
	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
	uint64_t parent;
	int is_xattrdir;
	int err;

	/* Extended attributes should not be visible as regular files. */
	if ((zp->z_pflags & ZFS_XATTR) != 0)
	return (SET_ERROR(EINVAL));

	err = zfs_obj_to_pobj(zfsvfs->z_os, zp->z_sa_hdl, zfsvfs->z_attr_table,
	&parent, &is_xattrdir);
	if (err != 0)
	return (err);
	ASSERT0(is_xattrdir);

	/* No name as this is a root object. */
	if (parent == zp->z_id)
	return (SET_ERROR(EINVAL));

	err = zap_value_search(zfsvfs->z_os, parent, zp->z_id,
	ZFS_DIRENT_OBJ(-1ULL), buf);
	if (err != 0)
	return (err);
	err = zfs_zget(zfsvfs, parent, dzpp);
	return (err);
	}
	#endif /* _KERNEL */
	Index: vendor-sys/openzfs/dist/module/os/linux/spl/spl-condvar.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/linux/spl/spl-condvar.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/linux/spl/spl-condvar.c (revision 365892)
	@@ -1,466 +1,510 @@
	/*
	* Copyright (C) 2007-2010 Lawrence Livermore National Security, LLC.
	* Copyright (C) 2007 The Regents of the University of California.
	* Produced at Lawrence Livermore National Laboratory (cf, DISCLAIMER).
	* Written by Brian Behlendorf <behlendorf1@llnl.gov>.
	* UCRL-CODE-235197
	*
	* This file is part of the SPL, Solaris Porting Layer.
	* For details, see <http://zfsonlinux.org/>.
	*
	* The SPL is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License as published by the
	* Free Software Foundation; either version 2 of the License, or (at your
	* option) any later version.
	*
	* The SPL is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* for more details.
	*
	* You should have received a copy of the GNU General Public License along
	* with the SPL. If not, see <http://www.gnu.org/licenses/>.
	*
	* Solaris Porting Layer (SPL) Credential Implementation.
	*/

	#include <sys/condvar.h>
	#include <sys/time.h>
	#include <sys/sysmacros.h>
	#include <linux/hrtimer.h>
	#include <linux/compiler_compat.h>
	#include <linux/mod_compat.h>

	#include <linux/sched.h>

	#ifdef HAVE_SCHED_SIGNAL_HEADER
	#include <linux/sched/signal.h>
	#endif

	#define MAX_HRTIMEOUT_SLACK_US 1000
	unsigned int spl_schedule_hrtimeout_slack_us = 0;

	static int
	param_set_hrtimeout_slack(const char buf, zfs_kernel_param_t kp)
	{
	unsigned long val;
	int error;

	error = kstrtoul(buf, 0, &val);
	if (error)
	return (error);

	if (val > MAX_HRTIMEOUT_SLACK_US)
	return (-EINVAL);

	error = param_set_uint(buf, kp);
	if (error < 0)
	return (error);

	return (0);
	}

	module_param_call(spl_schedule_hrtimeout_slack_us, param_set_hrtimeout_slack,
	param_get_uint, &spl_schedule_hrtimeout_slack_us, 0644);
	MODULE_PARM_DESC(spl_schedule_hrtimeout_slack_us,
	"schedule_hrtimeout_range() delta/slack value in us, default(0)");

	void
	__cv_init(kcondvar_t cvp, char name, kcv_type_t type, void *arg)
	{
	ASSERT(cvp);
	ASSERT(name == NULL);
	ASSERT(type == CV_DEFAULT);
	ASSERT(arg == NULL);

	cvp->cv_magic = CV_MAGIC;
	init_waitqueue_head(&cvp->cv_event);
	init_waitqueue_head(&cvp->cv_destroy);
	atomic_set(&cvp->cv_waiters, 0);
	atomic_set(&cvp->cv_refs, 1);
	cvp->cv_mutex = NULL;
	}
	EXPORT_SYMBOL(__cv_init);

	static int
	cv_destroy_wakeup(kcondvar_t *cvp)
	{
	if (!atomic_read(&cvp->cv_waiters) && !atomic_read(&cvp->cv_refs)) {
	ASSERT(cvp->cv_mutex == NULL);
	ASSERT(!waitqueue_active(&cvp->cv_event));
	return (1);
	}

	return (0);
	}

	void
	__cv_destroy(kcondvar_t *cvp)
	{
	ASSERT(cvp);
	ASSERT(cvp->cv_magic == CV_MAGIC);

	cvp->cv_magic = CV_DESTROY;
	atomic_dec(&cvp->cv_refs);

	/* Block until all waiters are woken and references dropped. */
	while (cv_destroy_wakeup(cvp) == 0)
	wait_event_timeout(cvp->cv_destroy, cv_destroy_wakeup(cvp), 1);

	ASSERT3P(cvp->cv_mutex, ==, NULL);
	ASSERT3S(atomic_read(&cvp->cv_refs), ==, 0);
	ASSERT3S(atomic_read(&cvp->cv_waiters), ==, 0);
	ASSERT3S(waitqueue_active(&cvp->cv_event), ==, 0);
	}
	EXPORT_SYMBOL(__cv_destroy);

	static void
	cv_wait_common(kcondvar_t cvp, kmutex_t mp, int state, int io)
	{
	DEFINE_WAIT(wait);
	kmutex_t *m;

	ASSERT(cvp);
	ASSERT(mp);
	ASSERT(cvp->cv_magic == CV_MAGIC);
	ASSERT(mutex_owned(mp));
	atomic_inc(&cvp->cv_refs);

	m = READ_ONCE(cvp->cv_mutex);
	if (!m)
	m = xchg(&cvp->cv_mutex, mp);
	/* Ensure the same mutex is used by all callers */
	ASSERT(m == NULL \|\| m == mp);

	prepare_to_wait_exclusive(&cvp->cv_event, &wait, state);
	atomic_inc(&cvp->cv_waiters);

	/*
	* Mutex should be dropped after prepare_to_wait() this
	* ensures we're linked in to the waiters list and avoids the
	* race where 'cvp->cv_waiters > 0' but the list is empty.
	*/
	mutex_exit(mp);
	if (io)
	io_schedule();
	else
	schedule();

	/* No more waiters a different mutex could be used */
	if (atomic_dec_and_test(&cvp->cv_waiters)) {
	/*
	* This is set without any lock, so it's racy. But this is
	* just for debug anyway, so make it best-effort
	*/
	cvp->cv_mutex = NULL;
	wake_up(&cvp->cv_destroy);
	}

	finish_wait(&cvp->cv_event, &wait);
	atomic_dec(&cvp->cv_refs);

	/*
	* Hold mutex after we release the cvp, otherwise we could dead lock
	* with a thread holding the mutex and call cv_destroy.
	*/
	mutex_enter(mp);
	}

	void
	__cv_wait(kcondvar_t cvp, kmutex_t mp)
	{
	cv_wait_common(cvp, mp, TASK_UNINTERRUPTIBLE, 0);
	}
	EXPORT_SYMBOL(__cv_wait);

	void
	__cv_wait_io(kcondvar_t cvp, kmutex_t mp)
	{
	cv_wait_common(cvp, mp, TASK_UNINTERRUPTIBLE, 1);
	}
	EXPORT_SYMBOL(__cv_wait_io);

	int
	__cv_wait_io_sig(kcondvar_t cvp, kmutex_t mp)
	{
	cv_wait_common(cvp, mp, TASK_INTERRUPTIBLE, 1);

	return (signal_pending(current) ? 0 : 1);
	}
	EXPORT_SYMBOL(__cv_wait_io_sig);

	int
	__cv_wait_sig(kcondvar_t cvp, kmutex_t mp)
	{
	cv_wait_common(cvp, mp, TASK_INTERRUPTIBLE, 0);

	return (signal_pending(current) ? 0 : 1);
	}
	EXPORT_SYMBOL(__cv_wait_sig);

	+void
	+__cv_wait_idle(kcondvar_t cvp, kmutex_t mp)
	+{
	+ sigset_t blocked, saved;
	+
	+ sigfillset(&blocked);
	+ (void) sigprocmask(SIG_BLOCK, &blocked, &saved);
	+ cv_wait_common(cvp, mp, TASK_INTERRUPTIBLE, 0);
	+ (void) sigprocmask(SIG_SETMASK, &saved, NULL);
	+}
	+EXPORT_SYMBOL(__cv_wait_idle);
	+
	#if defined(HAVE_IO_SCHEDULE_TIMEOUT)
	#define spl_io_schedule_timeout(t) io_schedule_timeout(t)
	#else

	struct spl_task_timer {
	struct timer_list timer;
	struct task_struct *task;
	};

	static void
	__cv_wakeup(spl_timer_list_t t)
	{
	struct timer_list tmr = (struct timer_list )t;
	struct spl_task_timer *task_timer = from_timer(task_timer, tmr, timer);

	wake_up_process(task_timer->task);
	}

	static long
	spl_io_schedule_timeout(long time_left)
	{
	long expire_time = jiffies + time_left;
	struct spl_task_timer task_timer;
	struct timer_list *timer = &task_timer.timer;

	task_timer.task = current;

	timer_setup(timer, __cv_wakeup, 0);

	timer->expires = expire_time;
	add_timer(timer);

	io_schedule();

	del_timer_sync(timer);

	time_left = expire_time - jiffies;

	return (time_left < 0 ? 0 : time_left);
	}
	#endif

	/*
	* 'expire_time' argument is an absolute wall clock time in jiffies.
	* Return value is time left (expire_time - now) or -1 if timeout occurred.
	*/
	static clock_t
	__cv_timedwait_common(kcondvar_t cvp, kmutex_t mp, clock_t expire_time,
	int state, int io)
	{
	DEFINE_WAIT(wait);
	kmutex_t *m;
	clock_t time_left;

	ASSERT(cvp);
	ASSERT(mp);
	ASSERT(cvp->cv_magic == CV_MAGIC);
	ASSERT(mutex_owned(mp));

	/* XXX - Does not handle jiffie wrap properly */
	time_left = expire_time - jiffies;
	if (time_left <= 0)
	return (-1);

	atomic_inc(&cvp->cv_refs);
	m = READ_ONCE(cvp->cv_mutex);
	if (!m)
	m = xchg(&cvp->cv_mutex, mp);
	/* Ensure the same mutex is used by all callers */
	ASSERT(m == NULL \|\| m == mp);

	prepare_to_wait_exclusive(&cvp->cv_event, &wait, state);
	atomic_inc(&cvp->cv_waiters);

	/*
	* Mutex should be dropped after prepare_to_wait() this
	* ensures we're linked in to the waiters list and avoids the
	* race where 'cvp->cv_waiters > 0' but the list is empty.
	*/
	mutex_exit(mp);
	if (io)
	time_left = spl_io_schedule_timeout(time_left);
	else
	time_left = schedule_timeout(time_left);

	/* No more waiters a different mutex could be used */
	if (atomic_dec_and_test(&cvp->cv_waiters)) {
	/*
	* This is set without any lock, so it's racy. But this is
	* just for debug anyway, so make it best-effort
	*/
	cvp->cv_mutex = NULL;
	wake_up(&cvp->cv_destroy);
	}

	finish_wait(&cvp->cv_event, &wait);
	atomic_dec(&cvp->cv_refs);

	/*
	* Hold mutex after we release the cvp, otherwise we could dead lock
	* with a thread holding the mutex and call cv_destroy.
	*/
	mutex_enter(mp);
	return (time_left > 0 ? 1 : -1);
	}

	int
	__cv_timedwait(kcondvar_t cvp, kmutex_t mp, clock_t exp_time)
	{
	return (__cv_timedwait_common(cvp, mp, exp_time,
	TASK_UNINTERRUPTIBLE, 0));
	}
	EXPORT_SYMBOL(__cv_timedwait);

	int
	__cv_timedwait_io(kcondvar_t cvp, kmutex_t mp, clock_t exp_time)
	{
	return (__cv_timedwait_common(cvp, mp, exp_time,
	TASK_UNINTERRUPTIBLE, 1));
	}
	EXPORT_SYMBOL(__cv_timedwait_io);

	int
	__cv_timedwait_sig(kcondvar_t cvp, kmutex_t mp, clock_t exp_time)
	{
	int rc;

	rc = __cv_timedwait_common(cvp, mp, exp_time, TASK_INTERRUPTIBLE, 0);
	return (signal_pending(current) ? 0 : rc);
	}
	EXPORT_SYMBOL(__cv_timedwait_sig);

	+int
	+__cv_timedwait_idle(kcondvar_t cvp, kmutex_t mp, clock_t exp_time)
	+{
	+ sigset_t blocked, saved;
	+ int rc;
	+
	+ sigfillset(&blocked);
	+ (void) sigprocmask(SIG_BLOCK, &blocked, &saved);
	+ rc = __cv_timedwait_common(cvp, mp, exp_time,
	+ TASK_INTERRUPTIBLE, 0);
	+ (void) sigprocmask(SIG_SETMASK, &saved, NULL);
	+
	+ return (rc);
	+}
	+EXPORT_SYMBOL(__cv_timedwait_idle);
	/*
	* 'expire_time' argument is an absolute clock time in nanoseconds.
	* Return value is time left (expire_time - now) or -1 if timeout occurred.
	*/
	static clock_t
	__cv_timedwait_hires(kcondvar_t cvp, kmutex_t mp, hrtime_t expire_time,
	hrtime_t res, int state)
	{
	DEFINE_WAIT(wait);
	kmutex_t *m;
	hrtime_t time_left;
	ktime_t ktime_left;
	u64 slack = 0;
	int rc;

	ASSERT(cvp);
	ASSERT(mp);
	ASSERT(cvp->cv_magic == CV_MAGIC);
	ASSERT(mutex_owned(mp));

	time_left = expire_time - gethrtime();
	if (time_left <= 0)
	return (-1);

	atomic_inc(&cvp->cv_refs);
	m = READ_ONCE(cvp->cv_mutex);
	if (!m)
	m = xchg(&cvp->cv_mutex, mp);
	/* Ensure the same mutex is used by all callers */
	ASSERT(m == NULL \|\| m == mp);

	prepare_to_wait_exclusive(&cvp->cv_event, &wait, state);
	atomic_inc(&cvp->cv_waiters);

	/*
	* Mutex should be dropped after prepare_to_wait() this
	* ensures we're linked in to the waiters list and avoids the
	* race where 'cvp->cv_waiters > 0' but the list is empty.
	*/
	mutex_exit(mp);

	ktime_left = ktime_set(0, time_left);
	slack = MIN(MAX(res, spl_schedule_hrtimeout_slack_us * NSEC_PER_USEC),
	MAX_HRTIMEOUT_SLACK_US * NSEC_PER_USEC);
	rc = schedule_hrtimeout_range(&ktime_left, slack, HRTIMER_MODE_REL);

	/* No more waiters a different mutex could be used */
	if (atomic_dec_and_test(&cvp->cv_waiters)) {
	/*
	* This is set without any lock, so it's racy. But this is
	* just for debug anyway, so make it best-effort
	*/
	cvp->cv_mutex = NULL;
	wake_up(&cvp->cv_destroy);
	}

	finish_wait(&cvp->cv_event, &wait);
	atomic_dec(&cvp->cv_refs);

	mutex_enter(mp);
	return (rc == -EINTR ? 1 : -1);
	}

	/*
	* Compatibility wrapper for the cv_timedwait_hires() Illumos interface.
	*/
	static int
	cv_timedwait_hires_common(kcondvar_t cvp, kmutex_t mp, hrtime_t tim,
	hrtime_t res, int flag, int state)
	{
	if (!(flag & CALLOUT_FLAG_ABSOLUTE))
	tim += gethrtime();

	return (__cv_timedwait_hires(cvp, mp, tim, res, state));
	}

	int
	cv_timedwait_hires(kcondvar_t cvp, kmutex_t mp, hrtime_t tim, hrtime_t res,
	int flag)
	{
	return (cv_timedwait_hires_common(cvp, mp, tim, res, flag,
	TASK_UNINTERRUPTIBLE));
	}
	EXPORT_SYMBOL(cv_timedwait_hires);

	int
	cv_timedwait_sig_hires(kcondvar_t cvp, kmutex_t mp, hrtime_t tim,
	hrtime_t res, int flag)
	{
	int rc;

	rc = cv_timedwait_hires_common(cvp, mp, tim, res, flag,
	TASK_INTERRUPTIBLE);
	return (signal_pending(current) ? 0 : rc);
	}
	EXPORT_SYMBOL(cv_timedwait_sig_hires);
	+
	+int
	+cv_timedwait_idle_hires(kcondvar_t cvp, kmutex_t mp, hrtime_t tim,
	+ hrtime_t res, int flag)
	+{
	+ sigset_t blocked, saved;
	+ int rc;
	+
	+ sigfillset(&blocked);
	+ (void) sigprocmask(SIG_BLOCK, &blocked, &saved);
	+ rc = cv_timedwait_hires_common(cvp, mp, tim, res, flag,
	+ TASK_INTERRUPTIBLE);
	+ (void) sigprocmask(SIG_SETMASK, &saved, NULL);
	+
	+ return (rc);
	+}
	+EXPORT_SYMBOL(cv_timedwait_idle_hires);

	void
	__cv_signal(kcondvar_t *cvp)
	{
	ASSERT(cvp);
	ASSERT(cvp->cv_magic == CV_MAGIC);
	atomic_inc(&cvp->cv_refs);

	/*
	* All waiters are added with WQ_FLAG_EXCLUSIVE so only one
	* waiter will be set runnable with each call to wake_up().
	* Additionally wake_up() holds a spin_lock associated with
	* the wait queue to ensure we don't race waking up processes.
	*/
	if (atomic_read(&cvp->cv_waiters) > 0)
	wake_up(&cvp->cv_event);

	atomic_dec(&cvp->cv_refs);
	}
	EXPORT_SYMBOL(__cv_signal);

	void
	__cv_broadcast(kcondvar_t *cvp)
	{
	ASSERT(cvp);
	ASSERT(cvp->cv_magic == CV_MAGIC);
	atomic_inc(&cvp->cv_refs);

	/*
	* Wake_up_all() will wake up all waiters even those which
	* have the WQ_FLAG_EXCLUSIVE flag set.
	*/
	if (atomic_read(&cvp->cv_waiters) > 0)
	wake_up_all(&cvp->cv_event);

	atomic_dec(&cvp->cv_refs);
	}
	EXPORT_SYMBOL(__cv_broadcast);
	Index: vendor-sys/openzfs/dist/module/os/linux/zfs/vdev_disk.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/linux/zfs/vdev_disk.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/linux/zfs/vdev_disk.c (revision 365892)
	@@ -1,873 +1,891 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (C) 2008-2010 Lawrence Livermore National Security, LLC.
	* Produced at Lawrence Livermore National Laboratory (cf, DISCLAIMER).
	* Rewritten for Linux by Brian Behlendorf <behlendorf1@llnl.gov>.
	* LLNL-CODE-403049.
	* Copyright (c) 2012, 2019 by Delphix. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev_disk.h>
	#include <sys/vdev_impl.h>
	#include <sys/vdev_trim.h>
	#include <sys/abd.h>
	#include <sys/fs/zfs.h>
	#include <sys/zio.h>
	+#include <linux/blkpg.h>
	#include <linux/msdos_fs.h>
	#include <linux/vfs_compat.h>

	typedef struct vdev_disk {
	struct block_device *vd_bdev;
	krwlock_t vd_lock;
	} vdev_disk_t;

	/*
	* Unique identifier for the exclusive vdev holder.
	*/
	static void *zfs_vdev_holder = VDEV_HOLDER;

	/*
	* Wait up to zfs_vdev_open_timeout_ms milliseconds before determining the
	* device is missing. The missing path may be transient since the links
	* can be briefly removed and recreated in response to udev events.
	*/
	static unsigned zfs_vdev_open_timeout_ms = 1000;

	/*
	* Size of the "reserved" partition, in blocks.
	*/
	#define EFI_MIN_RESV_SIZE (16 * 1024)

	/*
	* Virtual device vector for disks.
	*/
	typedef struct dio_request {
	zio_t dr_zio; / Parent ZIO */
	atomic_t dr_ref; /* References */
	int dr_error; /* Bio error */
	int dr_bio_count; /* Count of bio's */
	struct bio dr_bio[0]; / Attached bio's */
	} dio_request_t;

	static fmode_t
	vdev_bdev_mode(spa_mode_t spa_mode)
	{
	fmode_t mode = 0;

	if (spa_mode & SPA_MODE_READ)
	mode \|= FMODE_READ;

	if (spa_mode & SPA_MODE_WRITE)
	mode \|= FMODE_WRITE;

	return (mode);
	}

	/*
	* Returns the usable capacity (in bytes) for the partition or disk.
	*/
	static uint64_t
	bdev_capacity(struct block_device *bdev)
	{
	return (i_size_read(bdev->bd_inode));
	}

	/*
	* Returns the maximum expansion capacity of the block device (in bytes).
	*
	* It is possible to expand a vdev when it has been created as a wholedisk
	* and the containing block device has increased in capacity. Or when the
	* partition containing the pool has been manually increased in size.
	*
	* This function is only responsible for calculating the potential expansion
	* size so it can be reported by 'zpool list'. The efi_use_whole_disk() is
	* responsible for verifying the expected partition layout in the wholedisk
	* case, and updating the partition table if appropriate. Once the partition
	* size has been increased the additional capacity will be visible using
	* bdev_capacity().
	*
	* The returned maximum expansion capacity is always expected to be larger, or
	* at the very least equal, to its usable capacity to prevent overestimating
	* the pool expandsize.
	*/
	static uint64_t
	bdev_max_capacity(struct block_device *bdev, uint64_t wholedisk)
	{
	uint64_t psize;
	int64_t available;

	if (wholedisk && bdev->bd_part != NULL && bdev != bdev->bd_contains) {
	/*
	* When reporting maximum expansion capacity for a wholedisk
	* deduct any capacity which is expected to be lost due to
	* alignment restrictions. Over reporting this value isn't
	* harmful and would only result in slightly less capacity
	* than expected post expansion.
	* The estimated available space may be slightly smaller than
	* bdev_capacity() for devices where the number of sectors is
	* not a multiple of the alignment size and the partition layout
	* is keeping less than PARTITION_END_ALIGNMENT bytes after the
	* "reserved" EFI partition: in such cases return the device
	* usable capacity.
	*/
	available = i_size_read(bdev->bd_contains->bd_inode) -
	((EFI_MIN_RESV_SIZE + NEW_START_BLOCK +
	PARTITION_END_ALIGNMENT) << SECTOR_BITS);
	psize = MAX(available, bdev_capacity(bdev));
	} else {
	psize = bdev_capacity(bdev);
	}

	return (psize);
	}

	static void
	vdev_disk_error(zio_t *zio)
	{
	/*
	* This function can be called in interrupt context, for instance while
	* handling IRQs coming from a misbehaving disk device; use printk()
	* which is safe from any context.
	*/
	printk(KERN_WARNING "zio pool=%s vdev=%s error=%d type=%d "
	"offset=%llu size=%llu flags=%x\n", spa_name(zio->io_spa),
	zio->io_vd->vdev_path, zio->io_error, zio->io_type,
	(u_longlong_t)zio->io_offset, (u_longlong_t)zio->io_size,
	zio->io_flags);
	}

	static int
	vdev_disk_open(vdev_t v, uint64_t psize, uint64_t *max_psize,
	uint64_t logical_ashift, uint64_t physical_ashift)
	{
	struct block_device *bdev;
	fmode_t mode = vdev_bdev_mode(spa_mode(v->vdev_spa));
	hrtime_t timeout = MSEC2NSEC(zfs_vdev_open_timeout_ms);
	vdev_disk_t *vd;

	/* Must have a pathname and it must be absolute. */
	if (v->vdev_path == NULL \|\| v->vdev_path[0] != '/') {
	v->vdev_stat.vs_aux = VDEV_AUX_BAD_LABEL;
	vdev_dbgmsg(v, "invalid vdev_path");
	return (SET_ERROR(EINVAL));
	}

	/*
	* Reopen the device if it is currently open. When expanding a
	- * partition force re-scanning the partition table while closed
	+ * partition force re-scanning the partition table if userland
	+ * did not take care of this already. We need to do this while closed
	* in order to get an accurate updated block device size. Then
	* since udev may need to recreate the device links increase the
	* open retry timeout before reporting the device as unavailable.
	*/
	vd = v->vdev_tsd;
	if (vd) {
	char disk_name[BDEVNAME_SIZE + 6] = "/dev/";
	boolean_t reread_part = B_FALSE;

	rw_enter(&vd->vd_lock, RW_WRITER);
	bdev = vd->vd_bdev;
	vd->vd_bdev = NULL;

	if (bdev) {
	if (v->vdev_expanding && bdev != bdev->bd_contains) {
	bdevname(bdev->bd_contains, disk_name + 5);
	- reread_part = B_TRUE;
	+ /*
	+ * If userland has BLKPG_RESIZE_PARTITION,
	+ * then it should have updated the partition
	+ * table already. We can detect this by
	+ * comparing our current physical size
	+ * with that of the device. If they are
	+ * the same, then we must not have
	+ * BLKPG_RESIZE_PARTITION or it failed to
	+ * update the partition table online. We
	+ * fallback to rescanning the partition
	+ * table from the kernel below. However,
	+ * if the capacity already reflects the
	+ * updated partition, then we skip
	+ * rescanning the partition table here.
	+ */
	+ if (v->vdev_psize == bdev_capacity(bdev))
	+ reread_part = B_TRUE;
	}

	blkdev_put(bdev, mode \| FMODE_EXCL);
	}

	if (reread_part) {
	bdev = blkdev_get_by_path(disk_name, mode \| FMODE_EXCL,
	zfs_vdev_holder);
	if (!IS_ERR(bdev)) {
	int error = vdev_bdev_reread_part(bdev);
	blkdev_put(bdev, mode \| FMODE_EXCL);
	if (error == 0) {
	timeout = MSEC2NSEC(
	zfs_vdev_open_timeout_ms * 2);
	}
	}
	}
	} else {
	vd = kmem_zalloc(sizeof (vdev_disk_t), KM_SLEEP);

	rw_init(&vd->vd_lock, NULL, RW_DEFAULT, NULL);
	rw_enter(&vd->vd_lock, RW_WRITER);
	}

	/*
	* Devices are always opened by the path provided at configuration
	* time. This means that if the provided path is a udev by-id path
	* then drives may be re-cabled without an issue. If the provided
	* path is a udev by-path path, then the physical location information
	* will be preserved. This can be critical for more complicated
	* configurations where drives are located in specific physical
	* locations to maximize the systems tolerance to component failure.
	*
	* Alternatively, you can provide your own udev rule to flexibly map
	* the drives as you see fit. It is not advised that you use the
	* /dev/[hd]d devices which may be reordered due to probing order.
	* Devices in the wrong locations will be detected by the higher
	* level vdev validation.
	*
	* The specified paths may be briefly removed and recreated in
	* response to udev events. This should be exceptionally unlikely
	* because the zpool command makes every effort to verify these paths
	* have already settled prior to reaching this point. Therefore,
	* a ENOENT failure at this point is highly likely to be transient
	* and it is reasonable to sleep and retry before giving up. In
	* practice delays have been observed to be on the order of 100ms.
	*/
	hrtime_t start = gethrtime();
	bdev = ERR_PTR(-ENXIO);
	while (IS_ERR(bdev) && ((gethrtime() - start) < timeout)) {
	bdev = blkdev_get_by_path(v->vdev_path, mode \| FMODE_EXCL,
	zfs_vdev_holder);
	if (unlikely(PTR_ERR(bdev) == -ENOENT)) {
	schedule_timeout(MSEC_TO_TICK(10));
	} else if (IS_ERR(bdev)) {
	break;
	}
	}

	if (IS_ERR(bdev)) {
	int error = -PTR_ERR(bdev);
	vdev_dbgmsg(v, "open error=%d timeout=%llu/%llu", error,
	(u_longlong_t)(gethrtime() - start),
	(u_longlong_t)timeout);
	vd->vd_bdev = NULL;
	v->vdev_tsd = vd;
	rw_exit(&vd->vd_lock);
	return (SET_ERROR(error));
	} else {
	vd->vd_bdev = bdev;
	v->vdev_tsd = vd;
	rw_exit(&vd->vd_lock);
	}

	struct request_queue *q = bdev_get_queue(vd->vd_bdev);

	/* Determine the physical block size */
	int physical_block_size = bdev_physical_block_size(vd->vd_bdev);

	/* Determine the logical block size */
	int logical_block_size = bdev_logical_block_size(vd->vd_bdev);

	/* Clear the nowritecache bit, causes vdev_reopen() to try again. */
	v->vdev_nowritecache = B_FALSE;

	/* Set when device reports it supports TRIM. */
	v->vdev_has_trim = !!blk_queue_discard(q);

	/* Set when device reports it supports secure TRIM. */
	v->vdev_has_securetrim = !!blk_queue_discard_secure(q);

	/* Inform the ZIO pipeline that we are non-rotational */
	v->vdev_nonrot = blk_queue_nonrot(q);

	/* Physical volume size in bytes for the partition */
	*psize = bdev_capacity(vd->vd_bdev);

	/* Physical volume size in bytes including possible expansion space */
	*max_psize = bdev_max_capacity(vd->vd_bdev, v->vdev_wholedisk);

	/* Based on the minimum sector size set the block size */
	*physical_ashift = highbit64(MAX(physical_block_size,
	SPA_MINBLOCKSIZE)) - 1;

	*logical_ashift = highbit64(MAX(logical_block_size,
	SPA_MINBLOCKSIZE)) - 1;

	return (0);
	}

	static void
	vdev_disk_close(vdev_t *v)
	{
	vdev_disk_t *vd = v->vdev_tsd;

	if (v->vdev_reopening \|\| vd == NULL)
	return;

	if (vd->vd_bdev != NULL) {
	blkdev_put(vd->vd_bdev,
	vdev_bdev_mode(spa_mode(v->vdev_spa)) \| FMODE_EXCL);
	}

	rw_destroy(&vd->vd_lock);
	kmem_free(vd, sizeof (vdev_disk_t));
	v->vdev_tsd = NULL;
	}

	static dio_request_t *
	vdev_disk_dio_alloc(int bio_count)
	{
	dio_request_t *dr;
	int i;

	dr = kmem_zalloc(sizeof (dio_request_t) +
	sizeof (struct bio ) bio_count, KM_SLEEP);
	if (dr) {
	atomic_set(&dr->dr_ref, 0);
	dr->dr_bio_count = bio_count;
	dr->dr_error = 0;

	for (i = 0; i < dr->dr_bio_count; i++)
	dr->dr_bio[i] = NULL;
	}

	return (dr);
	}

	static void
	vdev_disk_dio_free(dio_request_t *dr)
	{
	int i;

	for (i = 0; i < dr->dr_bio_count; i++)
	if (dr->dr_bio[i])
	bio_put(dr->dr_bio[i]);

	kmem_free(dr, sizeof (dio_request_t) +
	sizeof (struct bio ) dr->dr_bio_count);
	}

	static void
	vdev_disk_dio_get(dio_request_t *dr)
	{
	atomic_inc(&dr->dr_ref);
	}

	static int
	vdev_disk_dio_put(dio_request_t *dr)
	{
	int rc = atomic_dec_return(&dr->dr_ref);

	/*
	* Free the dio_request when the last reference is dropped and
	* ensure zio_interpret is called only once with the correct zio
	*/
	if (rc == 0) {
	zio_t *zio = dr->dr_zio;
	int error = dr->dr_error;

	vdev_disk_dio_free(dr);

	if (zio) {
	zio->io_error = error;
	ASSERT3S(zio->io_error, >=, 0);
	if (zio->io_error)
	vdev_disk_error(zio);

	zio_delay_interrupt(zio);
	}
	}

	return (rc);
	}

	BIO_END_IO_PROTO(vdev_disk_physio_completion, bio, error)
	{
	dio_request_t *dr = bio->bi_private;
	int rc;

	if (dr->dr_error == 0) {
	#ifdef HAVE_1ARG_BIO_END_IO_T
	dr->dr_error = BIO_END_IO_ERROR(bio);
	#else
	if (error)
	dr->dr_error = -(error);
	else if (!test_bit(BIO_UPTODATE, &bio->bi_flags))
	dr->dr_error = EIO;
	#endif
	}

	/* Drop reference acquired by __vdev_disk_physio */
	rc = vdev_disk_dio_put(dr);
	}

	static inline void
	vdev_submit_bio_impl(struct bio *bio)
	{
	#ifdef HAVE_1ARG_SUBMIT_BIO
	submit_bio(bio);
	#else
	submit_bio(0, bio);
	#endif
	}

	#ifdef HAVE_BIO_SET_DEV
	#if defined(CONFIG_BLK_CGROUP) && defined(HAVE_BIO_SET_DEV_GPL_ONLY)
	/*
	* The Linux 5.5 kernel updated percpu_ref_tryget() which is inlined by
	* blkg_tryget() to use rcu_read_lock() instead of rcu_read_lock_sched().
	* As a side effect the function was converted to GPL-only. Define our
	* own version when needed which uses rcu_read_lock_sched().
	*/
	#if defined(HAVE_BLKG_TRYGET_GPL_ONLY)
	static inline bool
	vdev_blkg_tryget(struct blkcg_gq *blkg)
	{
	struct percpu_ref *ref = &blkg->refcnt;
	unsigned long __percpu *count;
	bool rc;

	rcu_read_lock_sched();

	if (__ref_is_percpu(ref, &count)) {
	this_cpu_inc(*count);
	rc = true;
	} else {
	rc = atomic_long_inc_not_zero(&ref->count);
	}

	rcu_read_unlock_sched();

	return (rc);
	}
	#elif defined(HAVE_BLKG_TRYGET)
	#define vdev_blkg_tryget(bg) blkg_tryget(bg)
	#endif
	/*
	* The Linux 5.0 kernel updated the bio_set_dev() macro so it calls the
	* GPL-only bio_associate_blkg() symbol thus inadvertently converting
	* the entire macro. Provide a minimal version which always assigns the
	* request queue's root_blkg to the bio.
	*/
	static inline void
	vdev_bio_associate_blkg(struct bio *bio)
	{
	struct request_queue *q = bio->bi_disk->queue;

	ASSERT3P(q, !=, NULL);
	ASSERT3P(bio->bi_blkg, ==, NULL);

	if (q->root_blkg && vdev_blkg_tryget(q->root_blkg))
	bio->bi_blkg = q->root_blkg;
	}
	#define bio_associate_blkg vdev_bio_associate_blkg
	#endif
	#else
	/*
	* Provide a bio_set_dev() helper macro for pre-Linux 4.14 kernels.
	*/
	static inline void
	bio_set_dev(struct bio bio, struct block_device bdev)
	{
	bio->bi_bdev = bdev;
	}
	#endif /* HAVE_BIO_SET_DEV */

	static inline void
	vdev_submit_bio(struct bio *bio)
	{
	struct bio_list *bio_list = current->bio_list;
	current->bio_list = NULL;
	vdev_submit_bio_impl(bio);
	current->bio_list = bio_list;
	}

	static int
	__vdev_disk_physio(struct block_device bdev, zio_t zio,
	size_t io_size, uint64_t io_offset, int rw, int flags)
	{
	dio_request_t *dr;
	uint64_t abd_offset;
	uint64_t bio_offset;
	int bio_size, bio_count = 16;
	int i = 0, error = 0;
	struct blk_plug plug;

	/*
	* Accessing outside the block device is never allowed.
	*/
	if (io_offset + io_size > bdev->bd_inode->i_size) {
	vdev_dbgmsg(zio->io_vd,
	"Illegal access %llu size %llu, device size %llu",
	io_offset, io_size, i_size_read(bdev->bd_inode));
	return (SET_ERROR(EIO));
	}

	retry:
	dr = vdev_disk_dio_alloc(bio_count);
	if (dr == NULL)
	return (SET_ERROR(ENOMEM));

	if (zio && !(zio->io_flags & (ZIO_FLAG_IO_RETRY \| ZIO_FLAG_TRYHARD)))
	bio_set_flags_failfast(bdev, &flags);

	dr->dr_zio = zio;

	/*
	* When the IO size exceeds the maximum bio size for the request
	* queue we are forced to break the IO in multiple bio's and wait
	* for them all to complete. Ideally, all pool users will set
	* their volume block size to match the maximum request size and
	* the common case will be one bio per vdev IO request.
	*/

	abd_offset = 0;
	bio_offset = io_offset;
	bio_size = io_size;
	for (i = 0; i <= dr->dr_bio_count; i++) {

	/* Finished constructing bio's for given buffer */
	if (bio_size <= 0)
	break;

	/*
	* By default only 'bio_count' bio's per dio are allowed.
	* However, if we find ourselves in a situation where more
	* are needed we allocate a larger dio and warn the user.
	*/
	if (dr->dr_bio_count == i) {
	vdev_disk_dio_free(dr);
	bio_count *= 2;
	goto retry;
	}

	/* bio_alloc() with __GFP_WAIT never returns NULL */
	dr->dr_bio[i] = bio_alloc(GFP_NOIO,
	MIN(abd_nr_pages_off(zio->io_abd, bio_size, abd_offset),
	BIO_MAX_PAGES));
	if (unlikely(dr->dr_bio[i] == NULL)) {
	vdev_disk_dio_free(dr);
	return (SET_ERROR(ENOMEM));
	}

	/* Matching put called by vdev_disk_physio_completion */
	vdev_disk_dio_get(dr);

	bio_set_dev(dr->dr_bio[i], bdev);
	BIO_BI_SECTOR(dr->dr_bio[i]) = bio_offset >> 9;
	dr->dr_bio[i]->bi_end_io = vdev_disk_physio_completion;
	dr->dr_bio[i]->bi_private = dr;
	bio_set_op_attrs(dr->dr_bio[i], rw, flags);

	/* Remaining size is returned to become the new size */
	bio_size = abd_bio_map_off(dr->dr_bio[i], zio->io_abd,
	bio_size, abd_offset);

	/* Advance in buffer and construct another bio if needed */
	abd_offset += BIO_BI_SIZE(dr->dr_bio[i]);
	bio_offset += BIO_BI_SIZE(dr->dr_bio[i]);
	}

	/* Extra reference to protect dio_request during vdev_submit_bio */
	vdev_disk_dio_get(dr);

	if (dr->dr_bio_count > 1)
	blk_start_plug(&plug);

	/* Submit all bio's associated with this dio */
	for (i = 0; i < dr->dr_bio_count; i++)
	if (dr->dr_bio[i])
	vdev_submit_bio(dr->dr_bio[i]);

	if (dr->dr_bio_count > 1)
	blk_finish_plug(&plug);

	(void) vdev_disk_dio_put(dr);

	return (error);
	}

	BIO_END_IO_PROTO(vdev_disk_io_flush_completion, bio, error)
	{
	zio_t *zio = bio->bi_private;
	#ifdef HAVE_1ARG_BIO_END_IO_T
	zio->io_error = BIO_END_IO_ERROR(bio);
	#else
	zio->io_error = -error;
	#endif

	if (zio->io_error && (zio->io_error == EOPNOTSUPP))
	zio->io_vd->vdev_nowritecache = B_TRUE;

	bio_put(bio);
	ASSERT3S(zio->io_error, >=, 0);
	if (zio->io_error)
	vdev_disk_error(zio);
	zio_interrupt(zio);
	}

	static int
	vdev_disk_io_flush(struct block_device bdev, zio_t zio)
	{
	struct request_queue *q;
	struct bio *bio;

	q = bdev_get_queue(bdev);
	if (!q)
	return (SET_ERROR(ENXIO));

	bio = bio_alloc(GFP_NOIO, 0);
	/* bio_alloc() with __GFP_WAIT never returns NULL */
	if (unlikely(bio == NULL))
	return (SET_ERROR(ENOMEM));

	bio->bi_end_io = vdev_disk_io_flush_completion;
	bio->bi_private = zio;
	bio_set_dev(bio, bdev);
	bio_set_flush(bio);
	vdev_submit_bio(bio);
	invalidate_bdev(bdev);

	return (0);
	}

	static void
	vdev_disk_io_start(zio_t *zio)
	{
	vdev_t *v = zio->io_vd;
	vdev_disk_t *vd = v->vdev_tsd;
	unsigned long trim_flags = 0;
	int rw, error;

	/*
	* If the vdev is closed, it's likely in the REMOVED or FAULTED state.
	* Nothing to be done here but return failure.
	*/
	if (vd == NULL) {
	zio->io_error = ENXIO;
	zio_interrupt(zio);
	return;
	}

	rw_enter(&vd->vd_lock, RW_READER);

	/*
	* If the vdev is closed, it's likely due to a failed reopen and is
	* in the UNAVAIL state. Nothing to be done here but return failure.
	*/
	if (vd->vd_bdev == NULL) {
	rw_exit(&vd->vd_lock);
	zio->io_error = ENXIO;
	zio_interrupt(zio);
	return;
	}

	switch (zio->io_type) {
	case ZIO_TYPE_IOCTL:

	if (!vdev_readable(v)) {
	rw_exit(&vd->vd_lock);
	zio->io_error = SET_ERROR(ENXIO);
	zio_interrupt(zio);
	return;
	}

	switch (zio->io_cmd) {
	case DKIOCFLUSHWRITECACHE:

	if (zfs_nocacheflush)
	break;

	if (v->vdev_nowritecache) {
	zio->io_error = SET_ERROR(ENOTSUP);
	break;
	}

	error = vdev_disk_io_flush(vd->vd_bdev, zio);
	if (error == 0) {
	rw_exit(&vd->vd_lock);
	return;
	}

	zio->io_error = error;

	break;

	default:
	zio->io_error = SET_ERROR(ENOTSUP);
	}

	rw_exit(&vd->vd_lock);
	zio_execute(zio);
	return;
	case ZIO_TYPE_WRITE:
	rw = WRITE;
	break;

	case ZIO_TYPE_READ:
	rw = READ;
	break;

	case ZIO_TYPE_TRIM:
	#if defined(BLKDEV_DISCARD_SECURE)
	if (zio->io_trim_flags & ZIO_TRIM_SECURE)
	trim_flags \|= BLKDEV_DISCARD_SECURE;
	#endif
	zio->io_error = -blkdev_issue_discard(vd->vd_bdev,
	zio->io_offset >> 9, zio->io_size >> 9, GFP_NOFS,
	trim_flags);

	rw_exit(&vd->vd_lock);
	zio_interrupt(zio);
	return;

	default:
	rw_exit(&vd->vd_lock);
	zio->io_error = SET_ERROR(ENOTSUP);
	zio_interrupt(zio);
	return;
	}

	zio->io_target_timestamp = zio_handle_io_delay(zio);
	error = __vdev_disk_physio(vd->vd_bdev, zio,
	zio->io_size, zio->io_offset, rw, 0);
	rw_exit(&vd->vd_lock);

	if (error) {
	zio->io_error = error;
	zio_interrupt(zio);
	return;
	}
	}

	static void
	vdev_disk_io_done(zio_t *zio)
	{
	/*
	* If the device returned EIO, we revalidate the media. If it is
	* determined the media has changed this triggers the asynchronous
	* removal of the device from the configuration.
	*/
	if (zio->io_error == EIO) {
	vdev_t *v = zio->io_vd;
	vdev_disk_t *vd = v->vdev_tsd;

	if (check_disk_change(vd->vd_bdev)) {
	invalidate_bdev(vd->vd_bdev);
	v->vdev_remove_wanted = B_TRUE;
	spa_async_request(zio->io_spa, SPA_ASYNC_REMOVE);
	}
	}
	}

	static void
	vdev_disk_hold(vdev_t *vd)
	{
	ASSERT(spa_config_held(vd->vdev_spa, SCL_STATE, RW_WRITER));

	/* We must have a pathname, and it must be absolute. */
	if (vd->vdev_path == NULL \|\| vd->vdev_path[0] != '/')
	return;

	/*
	* Only prefetch path and devid info if the device has
	* never been opened.
	*/
	if (vd->vdev_tsd != NULL)
	return;

	}

	static void
	vdev_disk_rele(vdev_t *vd)
	{
	ASSERT(spa_config_held(vd->vdev_spa, SCL_STATE, RW_WRITER));

	/* XXX: Implement me as a vnode rele for the device */
	}

	vdev_ops_t vdev_disk_ops = {
	.vdev_op_open = vdev_disk_open,
	.vdev_op_close = vdev_disk_close,
	.vdev_op_asize = vdev_default_asize,
	.vdev_op_io_start = vdev_disk_io_start,
	.vdev_op_io_done = vdev_disk_io_done,
	.vdev_op_state_change = NULL,
	.vdev_op_need_resilver = NULL,
	.vdev_op_hold = vdev_disk_hold,
	.vdev_op_rele = vdev_disk_rele,
	.vdev_op_remap = NULL,
	.vdev_op_xlate = vdev_default_xlate,
	.vdev_op_type = VDEV_TYPE_DISK, /* name of this vdev type */
	.vdev_op_leaf = B_TRUE /* leaf vdev */
	};

	/*
	* The zfs_vdev_scheduler module option has been deprecated. Setting this
	* value no longer has any effect. It has not yet been entirely removed
	* to allow the module to be loaded if this option is specified in the
	* /etc/modprobe.d/zfs.conf file. The following warning will be logged.
	*/
	static int
	param_set_vdev_scheduler(const char val, zfs_kernel_param_t kp)
	{
	int error = param_set_charp(val, kp);
	if (error == 0) {
	printk(KERN_INFO "The 'zfs_vdev_scheduler' module option "
	"is not supported.\n");
	}

	return (error);
	}

	char *zfs_vdev_scheduler = "unused";
	module_param_call(zfs_vdev_scheduler, param_set_vdev_scheduler,
	param_get_charp, &zfs_vdev_scheduler, 0644);
	MODULE_PARM_DESC(zfs_vdev_scheduler, "I/O scheduler");

	int
	param_set_min_auto_ashift(const char buf, zfs_kernel_param_t kp)
	{
	uint64_t val;
	int error;

	error = kstrtoull(buf, 0, &val);
	if (error < 0)
	return (SET_ERROR(error));

	if (val < ASHIFT_MIN \|\| val > zfs_vdev_max_auto_ashift)
	return (SET_ERROR(-EINVAL));

	error = param_set_ulong(buf, kp);
	if (error < 0)
	return (SET_ERROR(error));

	return (0);
	}

	int
	param_set_max_auto_ashift(const char buf, zfs_kernel_param_t kp)
	{
	uint64_t val;
	int error;

	error = kstrtoull(buf, 0, &val);
	if (error < 0)
	return (SET_ERROR(error));

	if (val > ASHIFT_MAX \|\| val < zfs_vdev_min_auto_ashift)
	return (SET_ERROR(-EINVAL));

	error = param_set_ulong(buf, kp);
	if (error < 0)
	return (SET_ERROR(error));

	return (0);
	}
	Index: vendor-sys/openzfs/dist/module/os/linux/zfs/vdev_file.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/linux/zfs/vdev_file.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/linux/zfs/vdev_file.c (revision 365892)
	@@ -1,348 +1,364 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	- * Copyright (c) 2011, 2016 by Delphix. All rights reserved.
	+ * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev_file.h>
	#include <sys/vdev_impl.h>
	#include <sys/vdev_trim.h>
	#include <sys/zio.h>
	#include <sys/fs/zfs.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/abd.h>
	#include <sys/fcntl.h>
	#include <sys/vnode.h>
	#include <sys/zfs_file.h>
	#ifdef _KERNEL
	#include <linux/falloc.h>
	#endif
	/*
	* Virtual device vector for files.
	*/

	static taskq_t *vdev_file_taskq;

	+/*
	+ * By default, the logical/physical ashift for file vdevs is set to
	+ * SPA_MINBLOCKSHIFT (9). This allows all file vdevs to use 512B (1 << 9)
	+ * blocksizes. Users may opt to change one or both of these for testing
	+ * or performance reasons. Care should be taken as these values will
	+ * impact the vdev_ashift setting which can only be set at vdev creation
	+ * time.
	+ */
	+unsigned long vdev_file_logical_ashift = SPA_MINBLOCKSHIFT;
	+unsigned long vdev_file_physical_ashift = SPA_MINBLOCKSHIFT;
	+
	static void
	vdev_file_hold(vdev_t *vd)
	{
	ASSERT(vd->vdev_path != NULL);
	}

	static void
	vdev_file_rele(vdev_t *vd)
	{
	ASSERT(vd->vdev_path != NULL);
	}

	static mode_t
	vdev_file_open_mode(spa_mode_t spa_mode)
	{
	mode_t mode = 0;

	if ((spa_mode & SPA_MODE_READ) && (spa_mode & SPA_MODE_WRITE)) {
	mode = O_RDWR;
	} else if (spa_mode & SPA_MODE_READ) {
	mode = O_RDONLY;
	} else if (spa_mode & SPA_MODE_WRITE) {
	mode = O_WRONLY;
	}

	return (mode \| O_LARGEFILE);
	}

	static int
	vdev_file_open(vdev_t vd, uint64_t psize, uint64_t *max_psize,
	uint64_t logical_ashift, uint64_t physical_ashift)
	{
	vdev_file_t *vf;
	zfs_file_t *fp;
	zfs_file_attr_t zfa;
	int error;

	/*
	* Rotational optimizations only make sense on block devices.
	*/
	vd->vdev_nonrot = B_TRUE;

	/*
	* Allow TRIM on file based vdevs. This may not always be supported,
	* since it depends on your kernel version and underlying filesystem
	* type but it is always safe to attempt.
	*/
	vd->vdev_has_trim = B_TRUE;

	/*
	* Disable secure TRIM on file based vdevs. There is no way to
	* request this behavior from the underlying filesystem.
	*/
	vd->vdev_has_securetrim = B_FALSE;

	/*
	* We must have a pathname, and it must be absolute.
	*/
	if (vd->vdev_path == NULL \|\| vd->vdev_path[0] != '/') {
	vd->vdev_stat.vs_aux = VDEV_AUX_BAD_LABEL;
	return (SET_ERROR(EINVAL));
	}

	/*
	* Reopen the device if it's not currently open. Otherwise,
	* just update the physical size of the device.
	*/
	if (vd->vdev_tsd != NULL) {
	ASSERT(vd->vdev_reopening);
	vf = vd->vdev_tsd;
	goto skip_open;
	}

	vf = vd->vdev_tsd = kmem_zalloc(sizeof (vdev_file_t), KM_SLEEP);

	/*
	* We always open the files from the root of the global zone, even if
	* we're in a local zone. If the user has gotten to this point, the
	* administrator has already decided that the pool should be available
	* to local zone users, so the underlying devices should be as well.
	*/
	ASSERT(vd->vdev_path != NULL && vd->vdev_path[0] == '/');

	error = zfs_file_open(vd->vdev_path,
	vdev_file_open_mode(spa_mode(vd->vdev_spa)), 0, &fp);
	if (error) {
	vd->vdev_stat.vs_aux = VDEV_AUX_OPEN_FAILED;
	return (error);
	}

	vf->vf_file = fp;

	#ifdef _KERNEL
	/*
	* Make sure it's a regular file.
	*/
	if (zfs_file_getattr(fp, &zfa)) {
	return (SET_ERROR(ENODEV));
	}
	if (!S_ISREG(zfa.zfa_mode)) {
	vd->vdev_stat.vs_aux = VDEV_AUX_OPEN_FAILED;
	return (SET_ERROR(ENODEV));
	}
	#endif

	skip_open:

	error = zfs_file_getattr(vf->vf_file, &zfa);
	if (error) {
	vd->vdev_stat.vs_aux = VDEV_AUX_OPEN_FAILED;
	return (error);
	}

	max_psize = psize = zfa.zfa_size;
	- *logical_ashift = SPA_MINBLOCKSHIFT;
	- *physical_ashift = SPA_MINBLOCKSHIFT;
	+ *logical_ashift = vdev_file_logical_ashift;
	+ *physical_ashift = vdev_file_physical_ashift;

	return (0);
	}

	static void
	vdev_file_close(vdev_t *vd)
	{
	vdev_file_t *vf = vd->vdev_tsd;

	if (vd->vdev_reopening \|\| vf == NULL)
	return;

	if (vf->vf_file != NULL) {
	(void) zfs_file_close(vf->vf_file);
	}

	vd->vdev_delayed_close = B_FALSE;
	kmem_free(vf, sizeof (vdev_file_t));
	vd->vdev_tsd = NULL;
	}

	static void
	vdev_file_io_strategy(void *arg)
	{
	zio_t zio = (zio_t )arg;
	vdev_t *vd = zio->io_vd;
	vdev_file_t *vf = vd->vdev_tsd;
	ssize_t resid;
	void *buf;
	loff_t off;
	ssize_t size;
	int err;

	off = zio->io_offset;
	size = zio->io_size;
	resid = 0;

	if (zio->io_type == ZIO_TYPE_READ) {
	buf = abd_borrow_buf(zio->io_abd, zio->io_size);
	err = zfs_file_pread(vf->vf_file, buf, size, off, &resid);
	abd_return_buf_copy(zio->io_abd, buf, size);
	} else {
	buf = abd_borrow_buf_copy(zio->io_abd, zio->io_size);
	err = zfs_file_pwrite(vf->vf_file, buf, size, off, &resid);
	abd_return_buf(zio->io_abd, buf, size);
	}
	zio->io_error = err;
	if (resid != 0 && zio->io_error == 0)
	zio->io_error = SET_ERROR(ENOSPC);

	zio_delay_interrupt(zio);
	}

	static void
	vdev_file_io_fsync(void *arg)
	{
	zio_t zio = (zio_t )arg;
	vdev_file_t *vf = zio->io_vd->vdev_tsd;

	zio->io_error = zfs_file_fsync(vf->vf_file, O_SYNC \| O_DSYNC);

	zio_interrupt(zio);
	}

	static void
	vdev_file_io_start(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;
	vdev_file_t *vf = vd->vdev_tsd;

	if (zio->io_type == ZIO_TYPE_IOCTL) {
	/* XXPOLICY */
	if (!vdev_readable(vd)) {
	zio->io_error = SET_ERROR(ENXIO);
	zio_interrupt(zio);
	return;
	}

	switch (zio->io_cmd) {
	case DKIOCFLUSHWRITECACHE:

	if (zfs_nocacheflush)
	break;

	/*
	* We cannot safely call vfs_fsync() when PF_FSTRANS
	* is set in the current context. Filesystems like
	* XFS include sanity checks to verify it is not
	* already set, see xfs_vm_writepage(). Therefore
	* the sync must be dispatched to a different context.
	*/
	if (__spl_pf_fstrans_check()) {
	VERIFY3U(taskq_dispatch(vdev_file_taskq,
	vdev_file_io_fsync, zio, TQ_SLEEP), !=,
	TASKQID_INVALID);
	return;
	}

	zio->io_error = zfs_file_fsync(vf->vf_file,
	O_SYNC \| O_DSYNC);
	break;
	default:
	zio->io_error = SET_ERROR(ENOTSUP);
	}

	zio_execute(zio);
	return;
	} else if (zio->io_type == ZIO_TYPE_TRIM) {
	int mode = 0;

	ASSERT3U(zio->io_size, !=, 0);
	#ifdef __linux__
	mode = FALLOC_FL_PUNCH_HOLE \| FALLOC_FL_KEEP_SIZE;
	#endif
	zio->io_error = zfs_file_fallocate(vf->vf_file,
	mode, zio->io_offset, zio->io_size);
	zio_execute(zio);
	return;
	}

	zio->io_target_timestamp = zio_handle_io_delay(zio);

	VERIFY3U(taskq_dispatch(vdev_file_taskq, vdev_file_io_strategy, zio,
	TQ_SLEEP), !=, TASKQID_INVALID);
	}

	/* ARGSUSED */
	static void
	vdev_file_io_done(zio_t *zio)
	{
	}

	vdev_ops_t vdev_file_ops = {
	.vdev_op_open = vdev_file_open,
	.vdev_op_close = vdev_file_close,
	.vdev_op_asize = vdev_default_asize,
	.vdev_op_io_start = vdev_file_io_start,
	.vdev_op_io_done = vdev_file_io_done,
	.vdev_op_state_change = NULL,
	.vdev_op_need_resilver = NULL,
	.vdev_op_hold = vdev_file_hold,
	.vdev_op_rele = vdev_file_rele,
	.vdev_op_remap = NULL,
	.vdev_op_xlate = vdev_default_xlate,
	.vdev_op_type = VDEV_TYPE_FILE, /* name of this vdev type */
	.vdev_op_leaf = B_TRUE /* leaf vdev */
	};

	void
	vdev_file_init(void)
	{
	vdev_file_taskq = taskq_create("z_vdev_file", MAX(boot_ncpus, 16),
	minclsyspri, boot_ncpus, INT_MAX, TASKQ_DYNAMIC);

	VERIFY(vdev_file_taskq);
	}

	void
	vdev_file_fini(void)
	{
	taskq_destroy(vdev_file_taskq);
	}

	/*
	* From userland we access disks just like files.
	*/
	#ifndef _KERNEL

	vdev_ops_t vdev_disk_ops = {
	.vdev_op_open = vdev_file_open,
	.vdev_op_close = vdev_file_close,
	.vdev_op_asize = vdev_default_asize,
	.vdev_op_io_start = vdev_file_io_start,
	.vdev_op_io_done = vdev_file_io_done,
	.vdev_op_state_change = NULL,
	.vdev_op_need_resilver = NULL,
	.vdev_op_hold = vdev_file_hold,
	.vdev_op_rele = vdev_file_rele,
	.vdev_op_remap = NULL,
	.vdev_op_xlate = vdev_default_xlate,
	.vdev_op_type = VDEV_TYPE_DISK, /* name of this vdev type */
	.vdev_op_leaf = B_TRUE /* leaf vdev */
	};

	#endif
	+
	+ZFS_MODULE_PARAM(zfs_vdev_file, vdev_file_, logical_ashift, ULONG, ZMOD_RW,
	+ "Logical ashift for file-based devices");
	+ZFS_MODULE_PARAM(zfs_vdev_file, vdev_file_, physical_ashift, ULONG, ZMOD_RW,
	+ "Physical ashift for file-based devices");
	Index: vendor-sys/openzfs/dist/module/os/linux/zfs/zfs_acl.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/linux/zfs/zfs_acl.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/linux/zfs/zfs_acl.c (revision 365892)
	@@ -1,2932 +1,2932 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2013 by Delphix. All rights reserved.
	* Copyright 2014 Nexenta Systems, Inc. All rights reserved.
	*/


	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/time.h>
	#include <sys/sysmacros.h>
	#include <sys/vfs.h>
	#include <sys/vnode.h>
	#include <sys/sid.h>
	#include <sys/file.h>
	#include <sys/stat.h>
	#include <sys/kmem.h>
	#include <sys/cmn_err.h>
	#include <sys/errno.h>
	#include <sys/fs/zfs.h>
	#include <sys/policy.h>
	#include <sys/zfs_znode.h>
	#include <sys/zfs_fuid.h>
	#include <sys/zfs_acl.h>
	#include <sys/zfs_dir.h>
	#include <sys/zfs_quota.h>
	#include <sys/zfs_vfsops.h>
	#include <sys/dmu.h>
	#include <sys/dnode.h>
	#include <sys/zap.h>
	#include <sys/sa.h>
	#include <sys/trace_acl.h>
	#include <sys/zpl.h>

	#define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE
	#define DENY ACE_ACCESS_DENIED_ACE_TYPE
	#define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE
	#define MIN_ACE_TYPE ALLOW

	#define OWNING_GROUP (ACE_GROUP\|ACE_IDENTIFIER_GROUP)
	#define EVERYONE_ALLOW_MASK (ACE_READ_ACL\|ACE_READ_ATTRIBUTES \| \
	ACE_READ_NAMED_ATTRS\|ACE_SYNCHRONIZE)
	#define EVERYONE_DENY_MASK (ACE_WRITE_ACL\|ACE_WRITE_OWNER \| \
	ACE_WRITE_ATTRIBUTES\|ACE_WRITE_NAMED_ATTRS)
	#define OWNER_ALLOW_MASK (ACE_WRITE_ACL \| ACE_WRITE_OWNER \| \
	ACE_WRITE_ATTRIBUTES\|ACE_WRITE_NAMED_ATTRS)

	#define ZFS_CHECKED_MASKS (ACE_READ_ACL\|ACE_READ_ATTRIBUTES\|ACE_READ_DATA\| \
	ACE_READ_NAMED_ATTRS\|ACE_WRITE_DATA\|ACE_WRITE_ATTRIBUTES\| \
	ACE_WRITE_NAMED_ATTRS\|ACE_APPEND_DATA\|ACE_EXECUTE\|ACE_WRITE_OWNER\| \
	ACE_WRITE_ACL\|ACE_DELETE\|ACE_DELETE_CHILD\|ACE_SYNCHRONIZE)

	#define WRITE_MASK_DATA (ACE_WRITE_DATA\|ACE_APPEND_DATA\|ACE_WRITE_NAMED_ATTRS)
	#define WRITE_MASK_ATTRS (ACE_WRITE_ACL\|ACE_WRITE_OWNER\|ACE_WRITE_ATTRIBUTES\| \
	ACE_DELETE\|ACE_DELETE_CHILD)
	#define WRITE_MASK (WRITE_MASK_DATA\|WRITE_MASK_ATTRS)

	#define OGE_CLEAR (ACE_READ_DATA\|ACE_LIST_DIRECTORY\|ACE_WRITE_DATA\| \
	ACE_ADD_FILE\|ACE_APPEND_DATA\|ACE_ADD_SUBDIRECTORY\|ACE_EXECUTE)

	#define OKAY_MASK_BITS (ACE_READ_DATA\|ACE_LIST_DIRECTORY\|ACE_WRITE_DATA\| \
	ACE_ADD_FILE\|ACE_APPEND_DATA\|ACE_ADD_SUBDIRECTORY\|ACE_EXECUTE)

	#define ALL_INHERIT (ACE_FILE_INHERIT_ACE\|ACE_DIRECTORY_INHERIT_ACE \| \
	ACE_NO_PROPAGATE_INHERIT_ACE\|ACE_INHERIT_ONLY_ACE\|ACE_INHERITED_ACE)

	#define RESTRICTED_CLEAR (ACE_WRITE_ACL\|ACE_WRITE_OWNER)

	#define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT\|ZFS_ACL_DEFAULTED\|\
	ZFS_ACL_PROTECTED)

	#define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS\|ZFS_ACL_TRIVIAL\|ZFS_INHERIT_ACE\|\
	ZFS_ACL_OBJ_ACE)

	#define ALL_MODE_EXECS (S_IXUSR \| S_IXGRP \| S_IXOTH)

	#define IDMAP_WK_CREATOR_OWNER_UID 2147483648U

	static uint16_t
	zfs_ace_v0_get_type(void *acep)
	{
	return (((zfs_oldace_t *)acep)->z_type);
	}

	static uint16_t
	zfs_ace_v0_get_flags(void *acep)
	{
	return (((zfs_oldace_t *)acep)->z_flags);
	}

	static uint32_t
	zfs_ace_v0_get_mask(void *acep)
	{
	return (((zfs_oldace_t *)acep)->z_access_mask);
	}

	static uint64_t
	zfs_ace_v0_get_who(void *acep)
	{
	return (((zfs_oldace_t *)acep)->z_fuid);
	}

	static void
	zfs_ace_v0_set_type(void *acep, uint16_t type)
	{
	((zfs_oldace_t *)acep)->z_type = type;
	}

	static void
	zfs_ace_v0_set_flags(void *acep, uint16_t flags)
	{
	((zfs_oldace_t *)acep)->z_flags = flags;
	}

	static void
	zfs_ace_v0_set_mask(void *acep, uint32_t mask)
	{
	((zfs_oldace_t *)acep)->z_access_mask = mask;
	}

	static void
	zfs_ace_v0_set_who(void *acep, uint64_t who)
	{
	((zfs_oldace_t *)acep)->z_fuid = who;
	}

	/ARGSUSED/
	static size_t
	zfs_ace_v0_size(void *acep)
	{
	return (sizeof (zfs_oldace_t));
	}

	static size_t
	zfs_ace_v0_abstract_size(void)
	{
	return (sizeof (zfs_oldace_t));
	}

	static int
	zfs_ace_v0_mask_off(void)
	{
	return (offsetof(zfs_oldace_t, z_access_mask));
	}

	/ARGSUSED/
	static int
	zfs_ace_v0_data(void acep, void *datap)
	{
	*datap = NULL;
	return (0);
	}

	static acl_ops_t zfs_acl_v0_ops = {
	.ace_mask_get = zfs_ace_v0_get_mask,
	.ace_mask_set = zfs_ace_v0_set_mask,
	.ace_flags_get = zfs_ace_v0_get_flags,
	.ace_flags_set = zfs_ace_v0_set_flags,
	.ace_type_get = zfs_ace_v0_get_type,
	.ace_type_set = zfs_ace_v0_set_type,
	.ace_who_get = zfs_ace_v0_get_who,
	.ace_who_set = zfs_ace_v0_set_who,
	.ace_size = zfs_ace_v0_size,
	.ace_abstract_size = zfs_ace_v0_abstract_size,
	.ace_mask_off = zfs_ace_v0_mask_off,
	.ace_data = zfs_ace_v0_data
	};

	static uint16_t
	zfs_ace_fuid_get_type(void *acep)
	{
	return (((zfs_ace_hdr_t *)acep)->z_type);
	}

	static uint16_t
	zfs_ace_fuid_get_flags(void *acep)
	{
	return (((zfs_ace_hdr_t *)acep)->z_flags);
	}

	static uint32_t
	zfs_ace_fuid_get_mask(void *acep)
	{
	return (((zfs_ace_hdr_t *)acep)->z_access_mask);
	}

	static uint64_t
	zfs_ace_fuid_get_who(void *args)
	{
	uint16_t entry_type;
	zfs_ace_t *acep = args;

	entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;

	if (entry_type == ACE_OWNER \|\| entry_type == OWNING_GROUP \|\|
	entry_type == ACE_EVERYONE)
	return (-1);
	return (((zfs_ace_t *)acep)->z_fuid);
	}

	static void
	zfs_ace_fuid_set_type(void *acep, uint16_t type)
	{
	((zfs_ace_hdr_t *)acep)->z_type = type;
	}

	static void
	zfs_ace_fuid_set_flags(void *acep, uint16_t flags)
	{
	((zfs_ace_hdr_t *)acep)->z_flags = flags;
	}

	static void
	zfs_ace_fuid_set_mask(void *acep, uint32_t mask)
	{
	((zfs_ace_hdr_t *)acep)->z_access_mask = mask;
	}

	static void
	zfs_ace_fuid_set_who(void *arg, uint64_t who)
	{
	zfs_ace_t *acep = arg;

	uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;

	if (entry_type == ACE_OWNER \|\| entry_type == OWNING_GROUP \|\|
	entry_type == ACE_EVERYONE)
	return;
	acep->z_fuid = who;
	}

	static size_t
	zfs_ace_fuid_size(void *acep)
	{
	zfs_ace_hdr_t *zacep = acep;
	uint16_t entry_type;

	switch (zacep->z_type) {
	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
	return (sizeof (zfs_object_ace_t));
	case ALLOW:
	case DENY:
	entry_type =
	(((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS);
	if (entry_type == ACE_OWNER \|\|
	entry_type == OWNING_GROUP \|\|
	entry_type == ACE_EVERYONE)
	return (sizeof (zfs_ace_hdr_t));
	/FALLTHROUGH/
	default:
	return (sizeof (zfs_ace_t));
	}
	}

	static size_t
	zfs_ace_fuid_abstract_size(void)
	{
	return (sizeof (zfs_ace_hdr_t));
	}

	static int
	zfs_ace_fuid_mask_off(void)
	{
	return (offsetof(zfs_ace_hdr_t, z_access_mask));
	}

	static int
	zfs_ace_fuid_data(void acep, void *datap)
	{
	zfs_ace_t *zacep = acep;
	zfs_object_ace_t *zobjp;

	switch (zacep->z_hdr.z_type) {
	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
	zobjp = acep;
	*datap = (caddr_t)zobjp + sizeof (zfs_ace_t);
	return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t));
	default:
	*datap = NULL;
	return (0);
	}
	}

	static acl_ops_t zfs_acl_fuid_ops = {
	.ace_mask_get = zfs_ace_fuid_get_mask,
	.ace_mask_set = zfs_ace_fuid_set_mask,
	.ace_flags_get = zfs_ace_fuid_get_flags,
	.ace_flags_set = zfs_ace_fuid_set_flags,
	.ace_type_get = zfs_ace_fuid_get_type,
	.ace_type_set = zfs_ace_fuid_set_type,
	.ace_who_get = zfs_ace_fuid_get_who,
	.ace_who_set = zfs_ace_fuid_set_who,
	.ace_size = zfs_ace_fuid_size,
	.ace_abstract_size = zfs_ace_fuid_abstract_size,
	.ace_mask_off = zfs_ace_fuid_mask_off,
	.ace_data = zfs_ace_fuid_data
	};

	/*
	* The following three functions are provided for compatibility with
	* older ZPL version in order to determine if the file use to have
	* an external ACL and what version of ACL previously existed on the
	* file. Would really be nice to not need this, sigh.
	*/
	uint64_t
	zfs_external_acl(znode_t *zp)
	{
	zfs_acl_phys_t acl_phys;
	int error;

	if (zp->z_is_sa)
	return (0);

	/*
	* Need to deal with a potential
	* race where zfs_sa_upgrade could cause
	* z_isa_sa to change.
	*
	* If the lookup fails then the state of z_is_sa should have
	* changed.
	*/

	if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(ZTOZSB(zp)),
	&acl_phys, sizeof (acl_phys))) == 0)
	return (acl_phys.z_acl_extern_obj);
	else {
	/*
	* after upgrade the SA_ZPL_ZNODE_ACL should have been
	* removed
	*/
	VERIFY(zp->z_is_sa && error == ENOENT);
	return (0);
	}
	}

	/*
	* Determine size of ACL in bytes
	*
	* This is more complicated than it should be since we have to deal
	* with old external ACLs.
	*/
	static int
	zfs_acl_znode_info(znode_t zp, int aclsize, int *aclcount,
	zfs_acl_phys_t *aclphys)
	{
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	uint64_t acl_count;
	int size;
	int error;

	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
	if (zp->z_is_sa) {
	if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs),
	&size)) != 0)
	return (error);
	*aclsize = size;
	if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs),
	&acl_count, sizeof (acl_count))) != 0)
	return (error);
	*aclcount = acl_count;
	} else {
	if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs),
	aclphys, sizeof (*aclphys))) != 0)
	return (error);

	if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) {
	*aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size);
	*aclcount = aclphys->z_acl_size;
	} else {
	*aclsize = aclphys->z_acl_size;
	*aclcount = aclphys->z_acl_count;
	}
	}
	return (0);
	}

	int
	zfs_znode_acl_version(znode_t *zp)
	{
	zfs_acl_phys_t acl_phys;

	if (zp->z_is_sa)
	return (ZFS_ACL_VERSION_FUID);
	else {
	int error;

	/*
	* Need to deal with a potential
	* race where zfs_sa_upgrade could cause
	* z_isa_sa to change.
	*
	* If the lookup fails then the state of z_is_sa should have
	* changed.
	*/
	if ((error = sa_lookup(zp->z_sa_hdl,
	SA_ZPL_ZNODE_ACL(ZTOZSB(zp)),
	&acl_phys, sizeof (acl_phys))) == 0)
	return (acl_phys.z_acl_version);
	else {
	/*
	* After upgrade SA_ZPL_ZNODE_ACL should have
	* been removed.
	*/
	VERIFY(zp->z_is_sa && error == ENOENT);
	return (ZFS_ACL_VERSION_FUID);
	}
	}
	}

	static int
	zfs_acl_version(int version)
	{
	if (version < ZPL_VERSION_FUID)
	return (ZFS_ACL_VERSION_INITIAL);
	else
	return (ZFS_ACL_VERSION_FUID);
	}

	static int
	zfs_acl_version_zp(znode_t *zp)
	{
	return (zfs_acl_version(ZTOZSB(zp)->z_version));
	}

	zfs_acl_t *
	zfs_acl_alloc(int vers)
	{
	zfs_acl_t *aclp;

	aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP);
	list_create(&aclp->z_acl, sizeof (zfs_acl_node_t),
	offsetof(zfs_acl_node_t, z_next));
	aclp->z_version = vers;
	if (vers == ZFS_ACL_VERSION_FUID)
	aclp->z_ops = &zfs_acl_fuid_ops;
	else
	aclp->z_ops = &zfs_acl_v0_ops;
	return (aclp);
	}

	zfs_acl_node_t *
	zfs_acl_node_alloc(size_t bytes)
	{
	zfs_acl_node_t *aclnode;

	aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP);
	if (bytes) {
	aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP);
	aclnode->z_allocdata = aclnode->z_acldata;
	aclnode->z_allocsize = bytes;
	aclnode->z_size = bytes;
	}

	return (aclnode);
	}

	static void
	zfs_acl_node_free(zfs_acl_node_t *aclnode)
	{
	if (aclnode->z_allocsize)
	kmem_free(aclnode->z_allocdata, aclnode->z_allocsize);
	kmem_free(aclnode, sizeof (zfs_acl_node_t));
	}

	static void
	zfs_acl_release_nodes(zfs_acl_t *aclp)
	{
	zfs_acl_node_t *aclnode;

	while ((aclnode = list_head(&aclp->z_acl))) {
	list_remove(&aclp->z_acl, aclnode);
	zfs_acl_node_free(aclnode);
	}
	aclp->z_acl_count = 0;
	aclp->z_acl_bytes = 0;
	}

	void
	zfs_acl_free(zfs_acl_t *aclp)
	{
	zfs_acl_release_nodes(aclp);
	list_destroy(&aclp->z_acl);
	kmem_free(aclp, sizeof (zfs_acl_t));
	}

	static boolean_t
	zfs_acl_valid_ace_type(uint_t type, uint_t flags)
	{
	uint16_t entry_type;

	switch (type) {
	case ALLOW:
	case DENY:
	case ACE_SYSTEM_AUDIT_ACE_TYPE:
	case ACE_SYSTEM_ALARM_ACE_TYPE:
	entry_type = flags & ACE_TYPE_FLAGS;
	return (entry_type == ACE_OWNER \|\|
	entry_type == OWNING_GROUP \|\|
	entry_type == ACE_EVERYONE \|\| entry_type == 0 \|\|
	entry_type == ACE_IDENTIFIER_GROUP);
	default:
	if (type >= MIN_ACE_TYPE && type <= MAX_ACE_TYPE)
	return (B_TRUE);
	}
	return (B_FALSE);
	}

	static boolean_t
	zfs_ace_valid(umode_t obj_mode, zfs_acl_t *aclp, uint16_t type, uint16_t iflags)
	{
	/*
	* first check type of entry
	*/

	if (!zfs_acl_valid_ace_type(type, iflags))
	return (B_FALSE);

	switch (type) {
	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
	if (aclp->z_version < ZFS_ACL_VERSION_FUID)
	return (B_FALSE);
	aclp->z_hints \|= ZFS_ACL_OBJ_ACE;
	}

	/*
	* next check inheritance level flags
	*/

	if (S_ISDIR(obj_mode) &&
	(iflags & (ACE_FILE_INHERIT_ACE\|ACE_DIRECTORY_INHERIT_ACE)))
	aclp->z_hints \|= ZFS_INHERIT_ACE;

	if (iflags & (ACE_INHERIT_ONLY_ACE\|ACE_NO_PROPAGATE_INHERIT_ACE)) {
	if ((iflags & (ACE_FILE_INHERIT_ACE\|
	ACE_DIRECTORY_INHERIT_ACE)) == 0) {
	return (B_FALSE);
	}
	}

	return (B_TRUE);
	}

	static void *
	zfs_acl_next_ace(zfs_acl_t aclp, void start, uint64_t *who,
	uint32_t access_mask, uint16_t iflags, uint16_t *type)
	{
	zfs_acl_node_t *aclnode;

	ASSERT(aclp);

	if (start == NULL) {
	aclnode = list_head(&aclp->z_acl);
	if (aclnode == NULL)
	return (NULL);

	aclp->z_next_ace = aclnode->z_acldata;
	aclp->z_curr_node = aclnode;
	aclnode->z_ace_idx = 0;
	}

	aclnode = aclp->z_curr_node;

	if (aclnode == NULL)
	return (NULL);

	if (aclnode->z_ace_idx >= aclnode->z_ace_count) {
	aclnode = list_next(&aclp->z_acl, aclnode);
	if (aclnode == NULL)
	return (NULL);
	else {
	aclp->z_curr_node = aclnode;
	aclnode->z_ace_idx = 0;
	aclp->z_next_ace = aclnode->z_acldata;
	}
	}

	if (aclnode->z_ace_idx < aclnode->z_ace_count) {
	void *acep = aclp->z_next_ace;
	size_t ace_size;

	/*
	* Make sure we don't overstep our bounds
	*/
	ace_size = aclp->z_ops->ace_size(acep);

	if (((caddr_t)acep + ace_size) >
	((caddr_t)aclnode->z_acldata + aclnode->z_size)) {
	return (NULL);
	}

	*iflags = aclp->z_ops->ace_flags_get(acep);
	*type = aclp->z_ops->ace_type_get(acep);
	*access_mask = aclp->z_ops->ace_mask_get(acep);
	*who = aclp->z_ops->ace_who_get(acep);
	aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size;
	aclnode->z_ace_idx++;

	return ((void *)acep);
	}
	return (NULL);
	}

	/ARGSUSED/
	static uint64_t
	zfs_ace_walk(void *datap, uint64_t cookie, int aclcnt,
	uint16_t flags, uint16_t type, uint32_t *mask)
	{
	zfs_acl_t *aclp = datap;
	zfs_ace_hdr_t acep = (zfs_ace_hdr_t )(uintptr_t)cookie;
	uint64_t who;

	acep = zfs_acl_next_ace(aclp, acep, &who, mask,
	flags, type);
	return ((uint64_t)(uintptr_t)acep);
	}

	/*
	* Copy ACE to internal ZFS format.
	* While processing the ACL each ACE will be validated for correctness.
	* ACE FUIDs will be created later.
	*/
	static int
	zfs_copy_ace_2_fuid(zfsvfs_t zfsvfs, umode_t obj_mode, zfs_acl_t aclp,
	void datap, zfs_ace_t z_acl, uint64_t aclcnt, size_t *size,
	zfs_fuid_info_t *fuidp, cred_t cr)
	{
	int i;
	uint16_t entry_type;
	zfs_ace_t *aceptr = z_acl;
	ace_t *acep = datap;
	zfs_object_ace_t *zobjacep;
	ace_object_t *aceobjp;

	for (i = 0; i != aclcnt; i++) {
	aceptr->z_hdr.z_access_mask = acep->a_access_mask;
	aceptr->z_hdr.z_flags = acep->a_flags;
	aceptr->z_hdr.z_type = acep->a_type;
	entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS;
	if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP &&
	entry_type != ACE_EVERYONE) {
	aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who,
	cr, (entry_type == 0) ?
	ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp);
	}

	/*
	* Make sure ACE is valid
	*/
	if (zfs_ace_valid(obj_mode, aclp, aceptr->z_hdr.z_type,
	aceptr->z_hdr.z_flags) != B_TRUE)
	return (SET_ERROR(EINVAL));

	switch (acep->a_type) {
	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
	zobjacep = (zfs_object_ace_t *)aceptr;
	aceobjp = (ace_object_t *)acep;

	bcopy(aceobjp->a_obj_type, zobjacep->z_object_type,
	sizeof (aceobjp->a_obj_type));
	bcopy(aceobjp->a_inherit_obj_type,
	zobjacep->z_inherit_type,
	sizeof (aceobjp->a_inherit_obj_type));
	acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t));
	break;
	default:
	acep = (ace_t *)((caddr_t)acep + sizeof (ace_t));
	}

	aceptr = (zfs_ace_t *)((caddr_t)aceptr +
	aclp->z_ops->ace_size(aceptr));
	}

	*size = (caddr_t)aceptr - (caddr_t)z_acl;

	return (0);
	}

	/*
	* Copy ZFS ACEs to fixed size ace_t layout
	*/
	static void
	zfs_copy_fuid_2_ace(zfsvfs_t zfsvfs, zfs_acl_t aclp, cred_t *cr,
	void *datap, int filter)
	{
	uint64_t who;
	uint32_t access_mask;
	uint16_t iflags, type;
	zfs_ace_hdr_t *zacep = NULL;
	ace_t *acep = datap;
	ace_object_t *objacep;
	zfs_object_ace_t *zobjacep;
	size_t ace_size;
	uint16_t entry_type;

	while ((zacep = zfs_acl_next_ace(aclp, zacep,
	&who, &access_mask, &iflags, &type))) {

	switch (type) {
	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
	if (filter) {
	continue;
	}
	zobjacep = (zfs_object_ace_t *)zacep;
	objacep = (ace_object_t *)acep;
	bcopy(zobjacep->z_object_type,
	objacep->a_obj_type,
	sizeof (zobjacep->z_object_type));
	bcopy(zobjacep->z_inherit_type,
	objacep->a_inherit_obj_type,
	sizeof (zobjacep->z_inherit_type));
	ace_size = sizeof (ace_object_t);
	break;
	default:
	ace_size = sizeof (ace_t);
	break;
	}

	entry_type = (iflags & ACE_TYPE_FLAGS);
	if ((entry_type != ACE_OWNER &&
	entry_type != OWNING_GROUP &&
	entry_type != ACE_EVERYONE)) {
	acep->a_who = zfs_fuid_map_id(zfsvfs, who,
	cr, (entry_type & ACE_IDENTIFIER_GROUP) ?
	ZFS_ACE_GROUP : ZFS_ACE_USER);
	} else {
	acep->a_who = (uid_t)(int64_t)who;
	}
	acep->a_access_mask = access_mask;
	acep->a_flags = iflags;
	acep->a_type = type;
	acep = (ace_t *)((caddr_t)acep + ace_size);
	}
	}

	static int
	zfs_copy_ace_2_oldace(umode_t obj_mode, zfs_acl_t aclp, ace_t acep,
	zfs_oldace_t z_acl, int aclcnt, size_t size)
	{
	int i;
	zfs_oldace_t *aceptr = z_acl;

	for (i = 0; i != aclcnt; i++, aceptr++) {
	aceptr->z_access_mask = acep[i].a_access_mask;
	aceptr->z_type = acep[i].a_type;
	aceptr->z_flags = acep[i].a_flags;
	aceptr->z_fuid = acep[i].a_who;
	/*
	* Make sure ACE is valid
	*/
	if (zfs_ace_valid(obj_mode, aclp, aceptr->z_type,
	aceptr->z_flags) != B_TRUE)
	return (SET_ERROR(EINVAL));
	}
	*size = (caddr_t)aceptr - (caddr_t)z_acl;
	return (0);
	}

	/*
	* convert old ACL format to new
	*/
	void
	zfs_acl_xform(znode_t zp, zfs_acl_t aclp, cred_t *cr)
	{
	zfs_oldace_t *oldaclp;
	int i;
	uint16_t type, iflags;
	uint32_t access_mask;
	uint64_t who;
	void *cookie = NULL;
	zfs_acl_node_t *newaclnode;

	ASSERT(aclp->z_version == ZFS_ACL_VERSION_INITIAL);
	/*
	* First create the ACE in a contiguous piece of memory
	* for zfs_copy_ace_2_fuid().
	*
	* We only convert an ACL once, so this won't happen
	* every time.
	*/
	oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count,
	KM_SLEEP);
	i = 0;
	while ((cookie = zfs_acl_next_ace(aclp, cookie, &who,
	&access_mask, &iflags, &type))) {
	oldaclp[i].z_flags = iflags;
	oldaclp[i].z_type = type;
	oldaclp[i].z_fuid = who;
	oldaclp[i++].z_access_mask = access_mask;
	}

	newaclnode = zfs_acl_node_alloc(aclp->z_acl_count *
	sizeof (zfs_object_ace_t));
	aclp->z_ops = &zfs_acl_fuid_ops;
	VERIFY(zfs_copy_ace_2_fuid(ZTOZSB(zp), ZTOI(zp)->i_mode,
	aclp, oldaclp, newaclnode->z_acldata, aclp->z_acl_count,
	&newaclnode->z_size, NULL, cr) == 0);
	newaclnode->z_ace_count = aclp->z_acl_count;
	aclp->z_version = ZFS_ACL_VERSION;
	kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t));

	/*
	* Release all previous ACL nodes
	*/

	zfs_acl_release_nodes(aclp);

	list_insert_head(&aclp->z_acl, newaclnode);

	aclp->z_acl_bytes = newaclnode->z_size;
	aclp->z_acl_count = newaclnode->z_ace_count;

	}

	/*
	* Convert unix access mask to v4 access mask
	*/
	static uint32_t
	zfs_unix_to_v4(uint32_t access_mask)
	{
	uint32_t new_mask = 0;

	if (access_mask & S_IXOTH)
	new_mask \|= ACE_EXECUTE;
	if (access_mask & S_IWOTH)
	new_mask \|= ACE_WRITE_DATA;
	if (access_mask & S_IROTH)
	new_mask \|= ACE_READ_DATA;
	return (new_mask);
	}

	static void
	zfs_set_ace(zfs_acl_t aclp, void acep, uint32_t access_mask,
	uint16_t access_type, uint64_t fuid, uint16_t entry_type)
	{
	uint16_t type = entry_type & ACE_TYPE_FLAGS;

	aclp->z_ops->ace_mask_set(acep, access_mask);
	aclp->z_ops->ace_type_set(acep, access_type);
	aclp->z_ops->ace_flags_set(acep, entry_type);
	if ((type != ACE_OWNER && type != OWNING_GROUP &&
	type != ACE_EVERYONE))
	aclp->z_ops->ace_who_set(acep, fuid);
	}

	/*
	* Determine mode of file based on ACL.
	*/
	uint64_t
	zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp,
	uint64_t *pflags, uint64_t fuid, uint64_t fgid)
	{
	int entry_type;
	mode_t mode;
	mode_t seen = 0;
	zfs_ace_hdr_t *acep = NULL;
	uint64_t who;
	uint16_t iflags, type;
	uint32_t access_mask;
	boolean_t an_exec_denied = B_FALSE;

	mode = (fmode & (S_IFMT \| S_ISUID \| S_ISGID \| S_ISVTX));

	while ((acep = zfs_acl_next_ace(aclp, acep, &who,
	&access_mask, &iflags, &type))) {

	if (!zfs_acl_valid_ace_type(type, iflags))
	continue;

	entry_type = (iflags & ACE_TYPE_FLAGS);

	/*
	* Skip over any inherit_only ACEs
	*/
	if (iflags & ACE_INHERIT_ONLY_ACE)
	continue;

	if (entry_type == ACE_OWNER \|\| (entry_type == 0 &&
	who == fuid)) {
	if ((access_mask & ACE_READ_DATA) &&
	(!(seen & S_IRUSR))) {
	seen \|= S_IRUSR;
	if (type == ALLOW) {
	mode \|= S_IRUSR;
	}
	}
	if ((access_mask & ACE_WRITE_DATA) &&
	(!(seen & S_IWUSR))) {
	seen \|= S_IWUSR;
	if (type == ALLOW) {
	mode \|= S_IWUSR;
	}
	}
	if ((access_mask & ACE_EXECUTE) &&
	(!(seen & S_IXUSR))) {
	seen \|= S_IXUSR;
	if (type == ALLOW) {
	mode \|= S_IXUSR;
	}
	}
	} else if (entry_type == OWNING_GROUP \|\|
	(entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) {
	if ((access_mask & ACE_READ_DATA) &&
	(!(seen & S_IRGRP))) {
	seen \|= S_IRGRP;
	if (type == ALLOW) {
	mode \|= S_IRGRP;
	}
	}
	if ((access_mask & ACE_WRITE_DATA) &&
	(!(seen & S_IWGRP))) {
	seen \|= S_IWGRP;
	if (type == ALLOW) {
	mode \|= S_IWGRP;
	}
	}
	if ((access_mask & ACE_EXECUTE) &&
	(!(seen & S_IXGRP))) {
	seen \|= S_IXGRP;
	if (type == ALLOW) {
	mode \|= S_IXGRP;
	}
	}
	} else if (entry_type == ACE_EVERYONE) {
	if ((access_mask & ACE_READ_DATA)) {
	if (!(seen & S_IRUSR)) {
	seen \|= S_IRUSR;
	if (type == ALLOW) {
	mode \|= S_IRUSR;
	}
	}
	if (!(seen & S_IRGRP)) {
	seen \|= S_IRGRP;
	if (type == ALLOW) {
	mode \|= S_IRGRP;
	}
	}
	if (!(seen & S_IROTH)) {
	seen \|= S_IROTH;
	if (type == ALLOW) {
	mode \|= S_IROTH;
	}
	}
	}
	if ((access_mask & ACE_WRITE_DATA)) {
	if (!(seen & S_IWUSR)) {
	seen \|= S_IWUSR;
	if (type == ALLOW) {
	mode \|= S_IWUSR;
	}
	}
	if (!(seen & S_IWGRP)) {
	seen \|= S_IWGRP;
	if (type == ALLOW) {
	mode \|= S_IWGRP;
	}
	}
	if (!(seen & S_IWOTH)) {
	seen \|= S_IWOTH;
	if (type == ALLOW) {
	mode \|= S_IWOTH;
	}
	}
	}
	if ((access_mask & ACE_EXECUTE)) {
	if (!(seen & S_IXUSR)) {
	seen \|= S_IXUSR;
	if (type == ALLOW) {
	mode \|= S_IXUSR;
	}
	}
	if (!(seen & S_IXGRP)) {
	seen \|= S_IXGRP;
	if (type == ALLOW) {
	mode \|= S_IXGRP;
	}
	}
	if (!(seen & S_IXOTH)) {
	seen \|= S_IXOTH;
	if (type == ALLOW) {
	mode \|= S_IXOTH;
	}
	}
	}
	} else {
	/*
	* Only care if this IDENTIFIER_GROUP or
	* USER ACE denies execute access to someone,
	* mode is not affected
	*/
	if ((access_mask & ACE_EXECUTE) && type == DENY)
	an_exec_denied = B_TRUE;
	}
	}

	/*
	* Failure to allow is effectively a deny, so execute permission
	* is denied if it was never mentioned or if we explicitly
	* weren't allowed it.
	*/
	if (!an_exec_denied &&
	((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS \|\|
	(mode & ALL_MODE_EXECS) != ALL_MODE_EXECS))
	an_exec_denied = B_TRUE;

	if (an_exec_denied)
	*pflags &= ~ZFS_NO_EXECS_DENIED;
	else
	*pflags \|= ZFS_NO_EXECS_DENIED;

	return (mode);
	}

	/*
	* Read an external acl object. If the intent is to modify, always
	* create a new acl and leave any cached acl in place.
	*/
	int
	zfs_acl_node_read(struct znode zp, boolean_t have_lock, zfs_acl_t *aclpp,
	boolean_t will_modify)
	{
	zfs_acl_t *aclp;
	int aclsize = 0;
	int acl_count = 0;
	zfs_acl_node_t *aclnode;
	zfs_acl_phys_t znode_acl;
	int version;
	int error;
	boolean_t drop_lock = B_FALSE;

	ASSERT(MUTEX_HELD(&zp->z_acl_lock));

	if (zp->z_acl_cached && !will_modify) {
	*aclpp = zp->z_acl_cached;
	return (0);
	}

	/*
	* close race where znode could be upgrade while trying to
	* read the znode attributes.
	*
	* But this could only happen if the file isn't already an SA
	* znode
	*/
	if (!zp->z_is_sa && !have_lock) {
	mutex_enter(&zp->z_lock);
	drop_lock = B_TRUE;
	}
	version = zfs_znode_acl_version(zp);

	if ((error = zfs_acl_znode_info(zp, &aclsize,
	&acl_count, &znode_acl)) != 0) {
	goto done;
	}

	aclp = zfs_acl_alloc(version);

	aclp->z_acl_count = acl_count;
	aclp->z_acl_bytes = aclsize;

	aclnode = zfs_acl_node_alloc(aclsize);
	aclnode->z_ace_count = aclp->z_acl_count;
	aclnode->z_size = aclsize;

	if (!zp->z_is_sa) {
	if (znode_acl.z_acl_extern_obj) {
	error = dmu_read(ZTOZSB(zp)->z_os,
	znode_acl.z_acl_extern_obj, 0, aclnode->z_size,
	aclnode->z_acldata, DMU_READ_PREFETCH);
	} else {
	bcopy(znode_acl.z_ace_data, aclnode->z_acldata,
	aclnode->z_size);
	}
	} else {
	error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(ZTOZSB(zp)),
	aclnode->z_acldata, aclnode->z_size);
	}

	if (error != 0) {
	zfs_acl_free(aclp);
	zfs_acl_node_free(aclnode);
	/* convert checksum errors into IO errors */
	if (error == ECKSUM)
	error = SET_ERROR(EIO);
	goto done;
	}

	list_insert_head(&aclp->z_acl, aclnode);

	*aclpp = aclp;
	if (!will_modify)
	zp->z_acl_cached = aclp;
	done:
	if (drop_lock)
	mutex_exit(&zp->z_lock);
	return (error);
	}

	/ARGSUSED/
	void
	zfs_acl_data_locator(void *dataptr, uint32_t length, uint32_t buflen,
	boolean_t start, void *userdata)
	{
	zfs_acl_locator_cb_t cb = (zfs_acl_locator_cb_t )userdata;

	if (start) {
	cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl);
	} else {
	cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl,
	cb->cb_acl_node);
	}
	*dataptr = cb->cb_acl_node->z_acldata;
	*length = cb->cb_acl_node->z_size;
	}

	int
	zfs_acl_chown_setattr(znode_t *zp)
	{
	int error;
	zfs_acl_t *aclp;

	- if (ZTOZSB(zp)->z_acl_type == ZFS_ACLTYPE_POSIXACL)
	+ if (ZTOZSB(zp)->z_acl_type == ZFS_ACLTYPE_POSIX)
	return (0);

	ASSERT(MUTEX_HELD(&zp->z_lock));
	ASSERT(MUTEX_HELD(&zp->z_acl_lock));

	error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE);
	if (error == 0 && aclp->z_acl_count > 0)
	zp->z_mode = ZTOI(zp)->i_mode =
	zfs_mode_compute(zp->z_mode, aclp,
	&zp->z_pflags, KUID_TO_SUID(ZTOI(zp)->i_uid),
	KGID_TO_SGID(ZTOI(zp)->i_gid));

	/*
	* Some ZFS implementations (ZEVO) create neither a ZNODE_ACL
	* nor a DACL_ACES SA in which case ENOENT is returned from
	* zfs_acl_node_read() when the SA can't be located.
	* Allow chown/chgrp to succeed in these cases rather than
	* returning an error that makes no sense in the context of
	* the caller.
	*/
	if (error == ENOENT)
	return (0);

	return (error);
	}

	typedef struct trivial_acl {
	uint32_t allow0; /* allow mask for bits only in owner */
	uint32_t deny1; /* deny mask for bits not in owner */
	uint32_t deny2; /* deny mask for bits not in group */
	uint32_t owner; /* allow mask matching mode */
	uint32_t group; /* allow mask matching mode */
	uint32_t everyone; /* allow mask matching mode */
	} trivial_acl_t;

	static void
	acl_trivial_access_masks(mode_t mode, boolean_t isdir, trivial_acl_t *masks)
	{
	uint32_t read_mask = ACE_READ_DATA;
	uint32_t write_mask = ACE_WRITE_DATA\|ACE_APPEND_DATA;
	uint32_t execute_mask = ACE_EXECUTE;

	if (isdir)
	write_mask \|= ACE_DELETE_CHILD;

	masks->deny1 = 0;

	if (!(mode & S_IRUSR) && (mode & (S_IRGRP\|S_IROTH)))
	masks->deny1 \|= read_mask;
	if (!(mode & S_IWUSR) && (mode & (S_IWGRP\|S_IWOTH)))
	masks->deny1 \|= write_mask;
	if (!(mode & S_IXUSR) && (mode & (S_IXGRP\|S_IXOTH)))
	masks->deny1 \|= execute_mask;

	masks->deny2 = 0;
	if (!(mode & S_IRGRP) && (mode & S_IROTH))
	masks->deny2 \|= read_mask;
	if (!(mode & S_IWGRP) && (mode & S_IWOTH))
	masks->deny2 \|= write_mask;
	if (!(mode & S_IXGRP) && (mode & S_IXOTH))
	masks->deny2 \|= execute_mask;

	masks->allow0 = 0;
	if ((mode & S_IRUSR) && (!(mode & S_IRGRP) && (mode & S_IROTH)))
	masks->allow0 \|= read_mask;
	if ((mode & S_IWUSR) && (!(mode & S_IWGRP) && (mode & S_IWOTH)))
	masks->allow0 \|= write_mask;
	if ((mode & S_IXUSR) && (!(mode & S_IXGRP) && (mode & S_IXOTH)))
	masks->allow0 \|= execute_mask;

	masks->owner = ACE_WRITE_ATTRIBUTES\|ACE_WRITE_OWNER\|ACE_WRITE_ACL\|
	ACE_WRITE_NAMED_ATTRS\|ACE_READ_ACL\|ACE_READ_ATTRIBUTES\|
	ACE_READ_NAMED_ATTRS\|ACE_SYNCHRONIZE;
	if (mode & S_IRUSR)
	masks->owner \|= read_mask;
	if (mode & S_IWUSR)
	masks->owner \|= write_mask;
	if (mode & S_IXUSR)
	masks->owner \|= execute_mask;

	masks->group = ACE_READ_ACL\|ACE_READ_ATTRIBUTES\|ACE_READ_NAMED_ATTRS\|
	ACE_SYNCHRONIZE;
	if (mode & S_IRGRP)
	masks->group \|= read_mask;
	if (mode & S_IWGRP)
	masks->group \|= write_mask;
	if (mode & S_IXGRP)
	masks->group \|= execute_mask;

	masks->everyone = ACE_READ_ACL\|ACE_READ_ATTRIBUTES\|ACE_READ_NAMED_ATTRS\|
	ACE_SYNCHRONIZE;
	if (mode & S_IROTH)
	masks->everyone \|= read_mask;
	if (mode & S_IWOTH)
	masks->everyone \|= write_mask;
	if (mode & S_IXOTH)
	masks->everyone \|= execute_mask;
	}

	/*
	* ace_trivial:
	* determine whether an ace_t acl is trivial
	*
	* Trivialness implies that the acl is composed of only
	* owner, group, everyone entries. ACL can't
	* have read_acl denied, and write_owner/write_acl/write_attributes
	* can only be owner@ entry.
	*/
	static int
	ace_trivial_common(void *acep, int aclcnt,
	uint64_t (walk)(void , uint64_t, int aclcnt,
	uint16_t , uint16_t , uint32_t *))
	{
	uint16_t flags;
	uint32_t mask;
	uint16_t type;
	uint64_t cookie = 0;

	while ((cookie = walk(acep, cookie, aclcnt, &flags, &type, &mask))) {
	switch (flags & ACE_TYPE_FLAGS) {
	case ACE_OWNER:
	case ACE_GROUP\|ACE_IDENTIFIER_GROUP:
	case ACE_EVERYONE:
	break;
	default:
	return (1);
	}

	if (flags & (ACE_FILE_INHERIT_ACE\|
	ACE_DIRECTORY_INHERIT_ACE\|ACE_NO_PROPAGATE_INHERIT_ACE\|
	ACE_INHERIT_ONLY_ACE))
	return (1);

	/*
	* Special check for some special bits
	*
	* Don't allow anybody to deny reading basic
	* attributes or a files ACL.
	*/
	if ((mask & (ACE_READ_ACL\|ACE_READ_ATTRIBUTES)) &&
	(type == ACE_ACCESS_DENIED_ACE_TYPE))
	return (1);

	/*
	* Delete permission is never set by default
	*/
	if (mask & ACE_DELETE)
	return (1);

	/*
	* Child delete permission should be accompanied by write
	*/
	if ((mask & ACE_DELETE_CHILD) && !(mask & ACE_WRITE_DATA))
	return (1);

	/*
	* only allow owner@ to have
	* write_acl/write_owner/write_attributes/write_xattr/
	*/
	if (type == ACE_ACCESS_ALLOWED_ACE_TYPE &&
	(!(flags & ACE_OWNER) && (mask &
	(ACE_WRITE_OWNER\|ACE_WRITE_ACL\| ACE_WRITE_ATTRIBUTES\|
	ACE_WRITE_NAMED_ATTRS))))
	return (1);

	}

	return (0);
	}

	/*
	* common code for setting ACLs.
	*
	* This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl.
	* zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's
	* already checked the acl and knows whether to inherit.
	*/
	int
	zfs_aclset_common(znode_t zp, zfs_acl_t aclp, cred_t cr, dmu_tx_t tx)
	{
	int error;
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	dmu_object_type_t otype;
	zfs_acl_locator_cb_t locate = { 0 };
	uint64_t mode;
	sa_bulk_attr_t bulk[5];
	uint64_t ctime[2];
	int count = 0;
	zfs_acl_phys_t acl_phys;

	mode = zp->z_mode;

	mode = zfs_mode_compute(mode, aclp, &zp->z_pflags,
	KUID_TO_SUID(ZTOI(zp)->i_uid), KGID_TO_SGID(ZTOI(zp)->i_gid));

	zp->z_mode = ZTOI(zp)->i_mode = mode;
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL,
	&mode, sizeof (mode));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL,
	&zp->z_pflags, sizeof (zp->z_pflags));
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL,
	&ctime, sizeof (ctime));

	if (zp->z_acl_cached) {
	zfs_acl_free(zp->z_acl_cached);
	zp->z_acl_cached = NULL;
	}

	/*
	* Upgrade needed?
	*/
	if (!zfsvfs->z_use_fuids) {
	otype = DMU_OT_OLDACL;
	} else {
	if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) &&
	(zfsvfs->z_version >= ZPL_VERSION_FUID))
	zfs_acl_xform(zp, aclp, cr);
	ASSERT(aclp->z_version >= ZFS_ACL_VERSION_FUID);
	otype = DMU_OT_ACL;
	}

	/*
	* Arrgh, we have to handle old on disk format
	* as well as newer (preferred) SA format.
	*/

	if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */
	locate.cb_aclp = aclp;
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs),
	zfs_acl_data_locator, &locate, aclp->z_acl_bytes);
	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs),
	NULL, &aclp->z_acl_count, sizeof (uint64_t));
	} else { /* Painful legacy way */
	zfs_acl_node_t *aclnode;
	uint64_t off = 0;
	uint64_t aoid;

	if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs),
	&acl_phys, sizeof (acl_phys))) != 0)
	return (error);

	aoid = acl_phys.z_acl_extern_obj;

	if (aclp->z_acl_bytes > ZFS_ACE_SPACE) {
	/*
	* If ACL was previously external and we are now
	* converting to new ACL format then release old
	* ACL object and create a new one.
	*/
	if (aoid &&
	aclp->z_version != acl_phys.z_acl_version) {
	error = dmu_object_free(zfsvfs->z_os, aoid, tx);
	if (error)
	return (error);
	aoid = 0;
	}
	if (aoid == 0) {
	aoid = dmu_object_alloc(zfsvfs->z_os,
	otype, aclp->z_acl_bytes,
	otype == DMU_OT_ACL ?
	DMU_OT_SYSACL : DMU_OT_NONE,
	otype == DMU_OT_ACL ?
	DN_OLD_MAX_BONUSLEN : 0, tx);
	} else {
	(void) dmu_object_set_blocksize(zfsvfs->z_os,
	aoid, aclp->z_acl_bytes, 0, tx);
	}
	acl_phys.z_acl_extern_obj = aoid;
	for (aclnode = list_head(&aclp->z_acl); aclnode;
	aclnode = list_next(&aclp->z_acl, aclnode)) {
	if (aclnode->z_ace_count == 0)
	continue;
	dmu_write(zfsvfs->z_os, aoid, off,
	aclnode->z_size, aclnode->z_acldata, tx);
	off += aclnode->z_size;
	}
	} else {
	void *start = acl_phys.z_ace_data;
	/*
	* Migrating back embedded?
	*/
	if (acl_phys.z_acl_extern_obj) {
	error = dmu_object_free(zfsvfs->z_os,
	acl_phys.z_acl_extern_obj, tx);
	if (error)
	return (error);
	acl_phys.z_acl_extern_obj = 0;
	}

	for (aclnode = list_head(&aclp->z_acl); aclnode;
	aclnode = list_next(&aclp->z_acl, aclnode)) {
	if (aclnode->z_ace_count == 0)
	continue;
	bcopy(aclnode->z_acldata, start,
	aclnode->z_size);
	start = (caddr_t)start + aclnode->z_size;
	}
	}
	/*
	* If Old version then swap count/bytes to match old
	* layout of znode_acl_phys_t.
	*/
	if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) {
	acl_phys.z_acl_size = aclp->z_acl_count;
	acl_phys.z_acl_count = aclp->z_acl_bytes;
	} else {
	acl_phys.z_acl_size = aclp->z_acl_bytes;
	acl_phys.z_acl_count = aclp->z_acl_count;
	}
	acl_phys.z_acl_version = aclp->z_version;

	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL,
	&acl_phys, sizeof (acl_phys));
	}

	/*
	* Replace ACL wide bits, but first clear them.
	*/
	zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS;

	zp->z_pflags \|= aclp->z_hints;

	if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0)
	zp->z_pflags \|= ZFS_ACL_TRIVIAL;

	zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime);
	return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx));
	}

	static void
	zfs_acl_chmod(boolean_t isdir, uint64_t mode, boolean_t split, boolean_t trim,
	zfs_acl_t *aclp)
	{
	void *acep = NULL;
	uint64_t who;
	int new_count, new_bytes;
	int ace_size;
	int entry_type;
	uint16_t iflags, type;
	uint32_t access_mask;
	zfs_acl_node_t *newnode;
	size_t abstract_size = aclp->z_ops->ace_abstract_size();
	void *zacep;
	trivial_acl_t masks;

	new_count = new_bytes = 0;

	acl_trivial_access_masks((mode_t)mode, isdir, &masks);

	newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes);

	zacep = newnode->z_acldata;
	if (masks.allow0) {
	zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER);
	zacep = (void *)((uintptr_t)zacep + abstract_size);
	new_count++;
	new_bytes += abstract_size;
	}
	if (masks.deny1) {
	zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER);
	zacep = (void *)((uintptr_t)zacep + abstract_size);
	new_count++;
	new_bytes += abstract_size;
	}
	if (masks.deny2) {
	zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP);
	zacep = (void *)((uintptr_t)zacep + abstract_size);
	new_count++;
	new_bytes += abstract_size;
	}

	while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask,
	&iflags, &type))) {
	entry_type = (iflags & ACE_TYPE_FLAGS);
	/*
	* ACEs used to represent the file mode may be divided
	* into an equivalent pair of inherit-only and regular
	* ACEs, if they are inheritable.
	* Skip regular ACEs, which are replaced by the new mode.
	*/
	if (split && (entry_type == ACE_OWNER \|\|
	entry_type == OWNING_GROUP \|\|
	entry_type == ACE_EVERYONE)) {
	if (!isdir \|\| !(iflags &
	(ACE_FILE_INHERIT_ACE\|ACE_DIRECTORY_INHERIT_ACE)))
	continue;
	/*
	* We preserve owner@, group@, or @everyone
	* permissions, if they are inheritable, by
	* copying them to inherit_only ACEs. This
	* prevents inheritable permissions from being
	* altered along with the file mode.
	*/
	iflags \|= ACE_INHERIT_ONLY_ACE;
	}

	/*
	* If this ACL has any inheritable ACEs, mark that in
	* the hints (which are later masked into the pflags)
	* so create knows to do inheritance.
	*/
	if (isdir && (iflags &
	(ACE_FILE_INHERIT_ACE\|ACE_DIRECTORY_INHERIT_ACE)))
	aclp->z_hints \|= ZFS_INHERIT_ACE;

	if ((type != ALLOW && type != DENY) \|\|
	(iflags & ACE_INHERIT_ONLY_ACE)) {
	switch (type) {
	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
	aclp->z_hints \|= ZFS_ACL_OBJ_ACE;
	break;
	}
	} else {
	/*
	* Limit permissions to be no greater than
	* group permissions.
	* The "aclinherit" and "aclmode" properties
	* affect policy for create and chmod(2),
	* respectively.
	*/
	if ((type == ALLOW) && trim)
	access_mask &= masks.group;
	}
	zfs_set_ace(aclp, zacep, access_mask, type, who, iflags);
	ace_size = aclp->z_ops->ace_size(acep);
	zacep = (void *)((uintptr_t)zacep + ace_size);
	new_count++;
	new_bytes += ace_size;
	}
	zfs_set_ace(aclp, zacep, masks.owner, ALLOW, -1, ACE_OWNER);
	zacep = (void *)((uintptr_t)zacep + abstract_size);
	zfs_set_ace(aclp, zacep, masks.group, ALLOW, -1, OWNING_GROUP);
	zacep = (void *)((uintptr_t)zacep + abstract_size);
	zfs_set_ace(aclp, zacep, masks.everyone, ALLOW, -1, ACE_EVERYONE);

	new_count += 3;
	new_bytes += abstract_size * 3;
	zfs_acl_release_nodes(aclp);
	aclp->z_acl_count = new_count;
	aclp->z_acl_bytes = new_bytes;
	newnode->z_ace_count = new_count;
	newnode->z_size = new_bytes;
	list_insert_tail(&aclp->z_acl, newnode);
	}

	int
	zfs_acl_chmod_setattr(znode_t zp, zfs_acl_t *aclp, uint64_t mode)
	{
	int error = 0;

	mutex_enter(&zp->z_acl_lock);
	mutex_enter(&zp->z_lock);
	if (ZTOZSB(zp)->z_acl_mode == ZFS_ACL_DISCARD)
	*aclp = zfs_acl_alloc(zfs_acl_version_zp(zp));
	else
	error = zfs_acl_node_read(zp, B_TRUE, aclp, B_TRUE);

	if (error == 0) {
	(*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS;
	zfs_acl_chmod(S_ISDIR(ZTOI(zp)->i_mode), mode, B_TRUE,
	(ZTOZSB(zp)->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp);
	}
	mutex_exit(&zp->z_lock);
	mutex_exit(&zp->z_acl_lock);

	return (error);
	}

	/*
	* Should ACE be inherited?
	*/
	static int
	zfs_ace_can_use(umode_t obj_mode, uint16_t acep_flags)
	{
	int iflags = (acep_flags & 0xf);

	if (S_ISDIR(obj_mode) && (iflags & ACE_DIRECTORY_INHERIT_ACE))
	return (1);
	else if (iflags & ACE_FILE_INHERIT_ACE)
	return (!(S_ISDIR(obj_mode) &&
	(iflags & ACE_NO_PROPAGATE_INHERIT_ACE)));
	return (0);
	}

	/*
	* inherit inheritable ACEs from parent
	*/
	static zfs_acl_t *
	zfs_acl_inherit(zfsvfs_t zfsvfs, umode_t va_mode, zfs_acl_t paclp,
	uint64_t mode, boolean_t *need_chmod)
	{
	void *pacep = NULL;
	void *acep;
	zfs_acl_node_t *aclnode;
	zfs_acl_t *aclp = NULL;
	uint64_t who;
	uint32_t access_mask;
	uint16_t iflags, newflags, type;
	size_t ace_size;
	void data1, data2;
	size_t data1sz, data2sz;
	uint_t aclinherit;
	boolean_t isdir = S_ISDIR(va_mode);
	boolean_t isreg = S_ISREG(va_mode);

	*need_chmod = B_TRUE;

	aclp = zfs_acl_alloc(paclp->z_version);
	aclinherit = zfsvfs->z_acl_inherit;
	if (aclinherit == ZFS_ACL_DISCARD \|\| S_ISLNK(va_mode))
	return (aclp);

	while ((pacep = zfs_acl_next_ace(paclp, pacep, &who,
	&access_mask, &iflags, &type))) {

	/*
	* don't inherit bogus ACEs
	*/
	if (!zfs_acl_valid_ace_type(type, iflags))
	continue;

	/*
	* Check if ACE is inheritable by this vnode
	*/
	if ((aclinherit == ZFS_ACL_NOALLOW && type == ALLOW) \|\|
	!zfs_ace_can_use(va_mode, iflags))
	continue;

	/*
	* If owner@, group@, or everyone@ inheritable
	* then zfs_acl_chmod() isn't needed.
	*/
	if ((aclinherit == ZFS_ACL_PASSTHROUGH \|\|
	aclinherit == ZFS_ACL_PASSTHROUGH_X) &&
	((iflags & (ACE_OWNER\|ACE_EVERYONE)) \|\|
	((iflags & OWNING_GROUP) == OWNING_GROUP)) &&
	(isreg \|\| (isdir && (iflags & ACE_DIRECTORY_INHERIT_ACE))))
	*need_chmod = B_FALSE;

	/*
	* Strip inherited execute permission from file if
	* not in mode
	*/
	if (aclinherit == ZFS_ACL_PASSTHROUGH_X && type == ALLOW &&
	!isdir && ((mode & (S_IXUSR\|S_IXGRP\|S_IXOTH)) == 0)) {
	access_mask &= ~ACE_EXECUTE;
	}

	/*
	* Strip write_acl and write_owner from permissions
	* when inheriting an ACE
	*/
	if (aclinherit == ZFS_ACL_RESTRICTED && type == ALLOW) {
	access_mask &= ~RESTRICTED_CLEAR;
	}

	ace_size = aclp->z_ops->ace_size(pacep);
	aclnode = zfs_acl_node_alloc(ace_size);
	list_insert_tail(&aclp->z_acl, aclnode);
	acep = aclnode->z_acldata;

	zfs_set_ace(aclp, acep, access_mask, type,
	who, iflags\|ACE_INHERITED_ACE);

	/*
	* Copy special opaque data if any
	*/
	if ((data1sz = paclp->z_ops->ace_data(pacep, &data1)) != 0) {
	VERIFY((data2sz = aclp->z_ops->ace_data(acep,
	&data2)) == data1sz);
	bcopy(data1, data2, data2sz);
	}

	aclp->z_acl_count++;
	aclnode->z_ace_count++;
	aclp->z_acl_bytes += aclnode->z_size;
	newflags = aclp->z_ops->ace_flags_get(acep);

	/*
	* If ACE is not to be inherited further, or if the vnode is
	* not a directory, remove all inheritance flags
	*/
	if (!isdir \|\| (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) {
	newflags &= ~ALL_INHERIT;
	aclp->z_ops->ace_flags_set(acep,
	newflags\|ACE_INHERITED_ACE);
	continue;
	}

	/*
	* This directory has an inheritable ACE
	*/
	aclp->z_hints \|= ZFS_INHERIT_ACE;

	/*
	* If only FILE_INHERIT is set then turn on
	* inherit_only
	*/
	if ((iflags & (ACE_FILE_INHERIT_ACE \|
	ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) {
	newflags \|= ACE_INHERIT_ONLY_ACE;
	aclp->z_ops->ace_flags_set(acep,
	newflags\|ACE_INHERITED_ACE);
	} else {
	newflags &= ~ACE_INHERIT_ONLY_ACE;
	aclp->z_ops->ace_flags_set(acep,
	newflags\|ACE_INHERITED_ACE);
	}
	}
	if (zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED &&
	aclp->z_acl_count != 0) {
	*need_chmod = B_FALSE;
	}

	return (aclp);
	}

	/*
	* Create file system object initial permissions
	* including inheritable ACEs.
	* Also, create FUIDs for owner and group.
	*/
	int
	zfs_acl_ids_create(znode_t dzp, int flag, vattr_t vap, cred_t *cr,
	vsecattr_t vsecp, zfs_acl_ids_t acl_ids)
	{
	int error;
	zfsvfs_t *zfsvfs = ZTOZSB(dzp);
	zfs_acl_t *paclp;
	gid_t gid = vap->va_gid;
	boolean_t need_chmod = B_TRUE;
	boolean_t trim = B_FALSE;
	boolean_t inherited = B_FALSE;

	bzero(acl_ids, sizeof (zfs_acl_ids_t));
	acl_ids->z_mode = vap->va_mode;

	if (vsecp)
	if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_mode, vsecp,
	cr, &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0)
	return (error);

	acl_ids->z_fuid = vap->va_uid;
	acl_ids->z_fgid = vap->va_gid;
	#ifdef HAVE_KSID
	/*
	* Determine uid and gid.
	*/
	if ((flag & IS_ROOT_NODE) \|\| zfsvfs->z_replay \|\|
	((flag & IS_XATTR) && (S_ISDIR(vap->va_mode)))) {
	acl_ids->z_fuid = zfs_fuid_create(zfsvfs, (uint64_t)vap->va_uid,
	cr, ZFS_OWNER, &acl_ids->z_fuidp);
	acl_ids->z_fgid = zfs_fuid_create(zfsvfs, (uint64_t)vap->va_gid,
	cr, ZFS_GROUP, &acl_ids->z_fuidp);
	gid = vap->va_gid;
	} else {
	acl_ids->z_fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER,
	cr, &acl_ids->z_fuidp);
	acl_ids->z_fgid = 0;
	if (vap->va_mask & AT_GID) {
	acl_ids->z_fgid = zfs_fuid_create(zfsvfs,
	(uint64_t)vap->va_gid,
	cr, ZFS_GROUP, &acl_ids->z_fuidp);
	gid = vap->va_gid;
	if (acl_ids->z_fgid != KGID_TO_SGID(ZTOI(dzp)->i_gid) &&
	!groupmember(vap->va_gid, cr) &&
	secpolicy_vnode_create_gid(cr) != 0)
	acl_ids->z_fgid = 0;
	}
	if (acl_ids->z_fgid == 0) {
	if (dzp->z_mode & S_ISGID) {
	char *domain;
	uint32_t rid;

	acl_ids->z_fgid = KGID_TO_SGID(
	ZTOI(dzp)->i_gid);
	gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid,
	cr, ZFS_GROUP);

	if (zfsvfs->z_use_fuids &&
	IS_EPHEMERAL(acl_ids->z_fgid)) {
	domain = zfs_fuid_idx_domain(
	&zfsvfs->z_fuid_idx,
	FUID_INDEX(acl_ids->z_fgid));
	rid = FUID_RID(acl_ids->z_fgid);
	zfs_fuid_node_add(&acl_ids->z_fuidp,
	domain, rid,
	FUID_INDEX(acl_ids->z_fgid),
	acl_ids->z_fgid, ZFS_GROUP);
	}
	} else {
	acl_ids->z_fgid = zfs_fuid_create_cred(zfsvfs,
	ZFS_GROUP, cr, &acl_ids->z_fuidp);
	gid = crgetgid(cr);
	}
	}
	}
	#endif /* HAVE_KSID */

	/*
	* If we're creating a directory, and the parent directory has the
	* set-GID bit set, set in on the new directory.
	* Otherwise, if the user is neither privileged nor a member of the
	* file's new group, clear the file's set-GID bit.
	*/

	if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) &&
	(S_ISDIR(vap->va_mode))) {
	acl_ids->z_mode \|= S_ISGID;
	} else {
	if ((acl_ids->z_mode & S_ISGID) &&
	secpolicy_vnode_setids_setgids(cr, gid) != 0)
	acl_ids->z_mode &= ~S_ISGID;
	}

	if (acl_ids->z_aclp == NULL) {
	mutex_enter(&dzp->z_acl_lock);
	mutex_enter(&dzp->z_lock);
	if (!(flag & IS_ROOT_NODE) &&
	(dzp->z_pflags & ZFS_INHERIT_ACE) &&
	!(dzp->z_pflags & ZFS_XATTR)) {
	VERIFY(0 == zfs_acl_node_read(dzp, B_TRUE,
	&paclp, B_FALSE));
	acl_ids->z_aclp = zfs_acl_inherit(zfsvfs,
	vap->va_mode, paclp, acl_ids->z_mode, &need_chmod);
	inherited = B_TRUE;
	} else {
	acl_ids->z_aclp =
	zfs_acl_alloc(zfs_acl_version_zp(dzp));
	acl_ids->z_aclp->z_hints \|= ZFS_ACL_TRIVIAL;
	}
	mutex_exit(&dzp->z_lock);
	mutex_exit(&dzp->z_acl_lock);

	if (need_chmod) {
	if (S_ISDIR(vap->va_mode))
	acl_ids->z_aclp->z_hints \|=
	ZFS_ACL_AUTO_INHERIT;

	if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK &&
	zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH &&
	zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH_X)
	trim = B_TRUE;
	zfs_acl_chmod(vap->va_mode, acl_ids->z_mode, B_FALSE,
	trim, acl_ids->z_aclp);
	}
	}

	if (inherited \|\| vsecp) {
	acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode,
	acl_ids->z_aclp, &acl_ids->z_aclp->z_hints,
	acl_ids->z_fuid, acl_ids->z_fgid);
	if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0)
	acl_ids->z_aclp->z_hints \|= ZFS_ACL_TRIVIAL;
	}

	return (0);
	}

	/*
	* Free ACL and fuid_infop, but not the acl_ids structure
	*/
	void
	zfs_acl_ids_free(zfs_acl_ids_t *acl_ids)
	{
	if (acl_ids->z_aclp)
	zfs_acl_free(acl_ids->z_aclp);
	if (acl_ids->z_fuidp)
	zfs_fuid_info_free(acl_ids->z_fuidp);
	acl_ids->z_aclp = NULL;
	acl_ids->z_fuidp = NULL;
	}

	boolean_t
	zfs_acl_ids_overquota(zfsvfs_t zv, zfs_acl_ids_t acl_ids, uint64_t projid)
	{
	return (zfs_id_overquota(zv, DMU_USERUSED_OBJECT, acl_ids->z_fuid) \|\|
	zfs_id_overquota(zv, DMU_GROUPUSED_OBJECT, acl_ids->z_fgid) \|\|
	(projid != ZFS_DEFAULT_PROJID && projid != ZFS_INVALID_PROJID &&
	zfs_id_overquota(zv, DMU_PROJECTUSED_OBJECT, projid)));
	}

	/*
	* Retrieve a file's ACL
	*/
	int
	zfs_getacl(znode_t zp, vsecattr_t vsecp, boolean_t skipaclchk, cred_t *cr)
	{
	zfs_acl_t *aclp;
	ulong_t mask;
	int error;
	int count = 0;
	int largeace = 0;

	mask = vsecp->vsa_mask & (VSA_ACE \| VSA_ACECNT \|
	VSA_ACE_ACLFLAGS \| VSA_ACE_ALLTYPES);

	if (mask == 0)
	return (SET_ERROR(ENOSYS));

	if ((error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr)))
	return (error);

	mutex_enter(&zp->z_acl_lock);

	error = zfs_acl_node_read(zp, B_FALSE, &aclp, B_FALSE);
	if (error != 0) {
	mutex_exit(&zp->z_acl_lock);
	return (error);
	}

	/*
	* Scan ACL to determine number of ACEs
	*/
	if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) {
	void *zacep = NULL;
	uint64_t who;
	uint32_t access_mask;
	uint16_t type, iflags;

	while ((zacep = zfs_acl_next_ace(aclp, zacep,
	&who, &access_mask, &iflags, &type))) {
	switch (type) {
	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
	largeace++;
	continue;
	default:
	count++;
	}
	}
	vsecp->vsa_aclcnt = count;
	} else
	count = (int)aclp->z_acl_count;

	if (mask & VSA_ACECNT) {
	vsecp->vsa_aclcnt = count;
	}

	if (mask & VSA_ACE) {
	size_t aclsz;

	aclsz = count * sizeof (ace_t) +
	sizeof (ace_object_t) * largeace;

	vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP);
	vsecp->vsa_aclentsz = aclsz;

	if (aclp->z_version == ZFS_ACL_VERSION_FUID)
	zfs_copy_fuid_2_ace(ZTOZSB(zp), aclp, cr,
	vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES));
	else {
	zfs_acl_node_t *aclnode;
	void *start = vsecp->vsa_aclentp;

	for (aclnode = list_head(&aclp->z_acl); aclnode;
	aclnode = list_next(&aclp->z_acl, aclnode)) {
	bcopy(aclnode->z_acldata, start,
	aclnode->z_size);
	start = (caddr_t)start + aclnode->z_size;
	}
	ASSERT((caddr_t)start - (caddr_t)vsecp->vsa_aclentp ==
	aclp->z_acl_bytes);
	}
	}
	if (mask & VSA_ACE_ACLFLAGS) {
	vsecp->vsa_aclflags = 0;
	if (zp->z_pflags & ZFS_ACL_DEFAULTED)
	vsecp->vsa_aclflags \|= ACL_DEFAULTED;
	if (zp->z_pflags & ZFS_ACL_PROTECTED)
	vsecp->vsa_aclflags \|= ACL_PROTECTED;
	if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT)
	vsecp->vsa_aclflags \|= ACL_AUTO_INHERIT;
	}

	mutex_exit(&zp->z_acl_lock);

	return (0);
	}

	int
	zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, umode_t obj_mode,
	vsecattr_t vsecp, cred_t cr, zfs_fuid_info_t fuidp, zfs_acl_t zaclp)
	{
	zfs_acl_t *aclp;
	zfs_acl_node_t *aclnode;
	int aclcnt = vsecp->vsa_aclcnt;
	int error;

	if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES \|\| vsecp->vsa_aclcnt <= 0)
	return (SET_ERROR(EINVAL));

	aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version));

	aclp->z_hints = 0;
	aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t));
	if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) {
	if ((error = zfs_copy_ace_2_oldace(obj_mode, aclp,
	(ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata,
	aclcnt, &aclnode->z_size)) != 0) {
	zfs_acl_free(aclp);
	zfs_acl_node_free(aclnode);
	return (error);
	}
	} else {
	if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_mode, aclp,
	vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt,
	&aclnode->z_size, fuidp, cr)) != 0) {
	zfs_acl_free(aclp);
	zfs_acl_node_free(aclnode);
	return (error);
	}
	}
	aclp->z_acl_bytes = aclnode->z_size;
	aclnode->z_ace_count = aclcnt;
	aclp->z_acl_count = aclcnt;
	list_insert_head(&aclp->z_acl, aclnode);

	/*
	* If flags are being set then add them to z_hints
	*/
	if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) {
	if (vsecp->vsa_aclflags & ACL_PROTECTED)
	aclp->z_hints \|= ZFS_ACL_PROTECTED;
	if (vsecp->vsa_aclflags & ACL_DEFAULTED)
	aclp->z_hints \|= ZFS_ACL_DEFAULTED;
	if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT)
	aclp->z_hints \|= ZFS_ACL_AUTO_INHERIT;
	}

	*zaclp = aclp;

	return (0);
	}

	/*
	* Set a file's ACL
	*/
	int
	zfs_setacl(znode_t zp, vsecattr_t vsecp, boolean_t skipaclchk, cred_t *cr)
	{
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	zilog_t *zilog = zfsvfs->z_log;
	ulong_t mask = vsecp->vsa_mask & (VSA_ACE \| VSA_ACECNT);
	dmu_tx_t *tx;
	int error;
	zfs_acl_t *aclp;
	zfs_fuid_info_t *fuidp = NULL;
	boolean_t fuid_dirtied;
	uint64_t acl_obj;

	if (mask == 0)
	return (SET_ERROR(ENOSYS));

	if (zp->z_pflags & ZFS_IMMUTABLE)
	return (SET_ERROR(EPERM));

	if ((error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr)))
	return (error);

	error = zfs_vsec_2_aclp(zfsvfs, ZTOI(zp)->i_mode, vsecp, cr, &fuidp,
	&aclp);
	if (error)
	return (error);

	/*
	* If ACL wide flags aren't being set then preserve any
	* existing flags.
	*/
	if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) {
	aclp->z_hints \|=
	(zp->z_pflags & V4_ACL_WIDE_FLAGS);
	}
	top:
	mutex_enter(&zp->z_acl_lock);
	mutex_enter(&zp->z_lock);

	tx = dmu_tx_create(zfsvfs->z_os);

	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE);

	fuid_dirtied = zfsvfs->z_fuid_dirty;
	if (fuid_dirtied)
	zfs_fuid_txhold(zfsvfs, tx);

	/*
	* If old version and ACL won't fit in bonus and we aren't
	* upgrading then take out necessary DMU holds
	*/

	if ((acl_obj = zfs_external_acl(zp)) != 0) {
	if (zfsvfs->z_version >= ZPL_VERSION_FUID &&
	zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) {
	dmu_tx_hold_free(tx, acl_obj, 0,
	DMU_OBJECT_END);
	dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
	aclp->z_acl_bytes);
	} else {
	dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes);
	}
	} else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) {
	dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes);
	}

	zfs_sa_upgrade_txholds(tx, zp);
	error = dmu_tx_assign(tx, TXG_NOWAIT);
	if (error) {
	mutex_exit(&zp->z_acl_lock);
	mutex_exit(&zp->z_lock);

	if (error == ERESTART) {
	dmu_tx_wait(tx);
	dmu_tx_abort(tx);
	goto top;
	}
	dmu_tx_abort(tx);
	zfs_acl_free(aclp);
	return (error);
	}

	error = zfs_aclset_common(zp, aclp, cr, tx);
	ASSERT(error == 0);
	ASSERT(zp->z_acl_cached == NULL);
	zp->z_acl_cached = aclp;

	if (fuid_dirtied)
	zfs_fuid_sync(zfsvfs, tx);

	zfs_log_acl(zilog, tx, zp, vsecp, fuidp);

	if (fuidp)
	zfs_fuid_info_free(fuidp);
	dmu_tx_commit(tx);

	mutex_exit(&zp->z_lock);
	mutex_exit(&zp->z_acl_lock);

	return (error);
	}

	/*
	* Check accesses of interest (AoI) against attributes of the dataset
	* such as read-only. Returns zero if no AoI conflict with dataset
	* attributes, otherwise an appropriate errno is returned.
	*/
	static int
	zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode)
	{
	if ((v4_mode & WRITE_MASK) && (zfs_is_readonly(ZTOZSB(zp))) &&
	(!Z_ISDEV(ZTOI(zp)->i_mode) \|\|
	(Z_ISDEV(ZTOI(zp)->i_mode) && (v4_mode & WRITE_MASK_ATTRS)))) {
	return (SET_ERROR(EROFS));
	}

	/*
	* Only check for READONLY on non-directories.
	*/
	if ((v4_mode & WRITE_MASK_DATA) &&
	((!S_ISDIR(ZTOI(zp)->i_mode) &&
	(zp->z_pflags & (ZFS_READONLY \| ZFS_IMMUTABLE))) \|\|
	(S_ISDIR(ZTOI(zp)->i_mode) &&
	(zp->z_pflags & ZFS_IMMUTABLE)))) {
	return (SET_ERROR(EPERM));
	}

	if ((v4_mode & (ACE_DELETE \| ACE_DELETE_CHILD)) &&
	(zp->z_pflags & ZFS_NOUNLINK)) {
	return (SET_ERROR(EPERM));
	}

	if (((v4_mode & (ACE_READ_DATA\|ACE_EXECUTE)) &&
	(zp->z_pflags & ZFS_AV_QUARANTINED))) {
	return (SET_ERROR(EACCES));
	}

	return (0);
	}

	/*
	* The primary usage of this function is to loop through all of the
	* ACEs in the znode, determining what accesses of interest (AoI) to
	* the caller are allowed or denied. The AoI are expressed as bits in
	* the working_mode parameter. As each ACE is processed, bits covered
	* by that ACE are removed from the working_mode. This removal
	* facilitates two things. The first is that when the working mode is
	* empty (= 0), we know we've looked at all the AoI. The second is
	* that the ACE interpretation rules don't allow a later ACE to undo
	* something granted or denied by an earlier ACE. Removing the
	* discovered access or denial enforces this rule. At the end of
	* processing the ACEs, all AoI that were found to be denied are
	* placed into the working_mode, giving the caller a mask of denied
	* accesses. Returns:
	* 0 if all AoI granted
	* EACCES if the denied mask is non-zero
	* other error if abnormal failure (e.g., IO error)
	*
	* A secondary usage of the function is to determine if any of the
	* AoI are granted. If an ACE grants any access in
	* the working_mode, we immediately short circuit out of the function.
	* This mode is chosen by setting anyaccess to B_TRUE. The
	* working_mode is not a denied access mask upon exit if the function
	* is used in this manner.
	*/
	static int
	zfs_zaccess_aces_check(znode_t zp, uint32_t working_mode,
	boolean_t anyaccess, cred_t *cr)
	{
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	zfs_acl_t *aclp;
	int error;
	uid_t uid = crgetuid(cr);
	uint64_t who;
	uint16_t type, iflags;
	uint16_t entry_type;
	uint32_t access_mask;
	uint32_t deny_mask = 0;
	zfs_ace_hdr_t *acep = NULL;
	boolean_t checkit;
	uid_t gowner;
	uid_t fowner;

	zfs_fuid_map_ids(zp, cr, &fowner, &gowner);

	mutex_enter(&zp->z_acl_lock);

	error = zfs_acl_node_read(zp, B_FALSE, &aclp, B_FALSE);
	if (error != 0) {
	mutex_exit(&zp->z_acl_lock);
	return (error);
	}

	ASSERT(zp->z_acl_cached);

	while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask,
	&iflags, &type))) {
	uint32_t mask_matched;

	if (!zfs_acl_valid_ace_type(type, iflags))
	continue;

	if (S_ISDIR(ZTOI(zp)->i_mode) &&
	(iflags & ACE_INHERIT_ONLY_ACE))
	continue;

	/* Skip ACE if it does not affect any AoI */
	mask_matched = (access_mask & *working_mode);
	if (!mask_matched)
	continue;

	entry_type = (iflags & ACE_TYPE_FLAGS);

	checkit = B_FALSE;

	switch (entry_type) {
	case ACE_OWNER:
	if (uid == fowner)
	checkit = B_TRUE;
	break;
	case OWNING_GROUP:
	who = gowner;
	/FALLTHROUGH/
	case ACE_IDENTIFIER_GROUP:
	checkit = zfs_groupmember(zfsvfs, who, cr);
	break;
	case ACE_EVERYONE:
	checkit = B_TRUE;
	break;

	/* USER Entry */
	default:
	if (entry_type == 0) {
	uid_t newid;

	newid = zfs_fuid_map_id(zfsvfs, who, cr,
	ZFS_ACE_USER);
	if (newid != IDMAP_WK_CREATOR_OWNER_UID &&
	uid == newid)
	checkit = B_TRUE;
	break;
	} else {
	mutex_exit(&zp->z_acl_lock);
	return (SET_ERROR(EIO));
	}
	}

	if (checkit) {
	if (type == DENY) {
	DTRACE_PROBE3(zfs__ace__denies,
	znode_t *, zp,
	zfs_ace_hdr_t *, acep,
	uint32_t, mask_matched);
	deny_mask \|= mask_matched;
	} else {
	DTRACE_PROBE3(zfs__ace__allows,
	znode_t *, zp,
	zfs_ace_hdr_t *, acep,
	uint32_t, mask_matched);
	if (anyaccess) {
	mutex_exit(&zp->z_acl_lock);
	return (0);
	}
	}
	*working_mode &= ~mask_matched;
	}

	/* Are we done? */
	if (*working_mode == 0)
	break;
	}

	mutex_exit(&zp->z_acl_lock);

	/* Put the found 'denies' back on the working mode */
	if (deny_mask) {
	*working_mode \|= deny_mask;
	return (SET_ERROR(EACCES));
	} else if (*working_mode) {
	return (-1);
	}

	return (0);
	}

	/*
	* Return true if any access whatsoever granted, we don't actually
	* care what access is granted.
	*/
	boolean_t
	zfs_has_access(znode_t zp, cred_t cr)
	{
	uint32_t have = ACE_ALL_PERMS;

	if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) {
	uid_t owner;

	owner = zfs_fuid_map_id(ZTOZSB(zp),
	KUID_TO_SUID(ZTOI(zp)->i_uid), cr, ZFS_OWNER);
	return (secpolicy_vnode_any_access(cr, ZTOI(zp), owner) == 0);
	}
	return (B_TRUE);
	}

	static int
	zfs_zaccess_common(znode_t zp, uint32_t v4_mode, uint32_t working_mode,
	boolean_t check_privs, boolean_t skipaclchk, cred_t cr)
	{
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	int err;

	*working_mode = v4_mode;
	*check_privs = B_TRUE;

	/*
	* Short circuit empty requests
	*/
	if (v4_mode == 0 \|\| zfsvfs->z_replay) {
	*working_mode = 0;
	return (0);
	}

	if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) {
	*check_privs = B_FALSE;
	return (err);
	}

	/*
	* The caller requested that the ACL check be skipped. This
	* would only happen if the caller checked VOP_ACCESS() with a
	* 32 bit ACE mask and already had the appropriate permissions.
	*/
	if (skipaclchk) {
	*working_mode = 0;
	return (0);
	}

	return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr));
	}

	static int
	zfs_zaccess_append(znode_t zp, uint32_t working_mode, boolean_t *check_privs,
	cred_t *cr)
	{
	if (*working_mode != ACE_WRITE_DATA)
	return (SET_ERROR(EACCES));

	return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode,
	check_privs, B_FALSE, cr));
	}

	int
	zfs_fastaccesschk_execute(znode_t zdp, cred_t cr)
	{
	boolean_t owner = B_FALSE;
	boolean_t groupmbr = B_FALSE;
	boolean_t is_attr;
	uid_t uid = crgetuid(cr);
	int error;

	if (zdp->z_pflags & ZFS_AV_QUARANTINED)
	return (SET_ERROR(EACCES));

	is_attr = ((zdp->z_pflags & ZFS_XATTR) &&
	(S_ISDIR(ZTOI(zdp)->i_mode)));
	if (is_attr)
	goto slow;


	mutex_enter(&zdp->z_acl_lock);

	if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) {
	mutex_exit(&zdp->z_acl_lock);
	return (0);
	}

	if (KUID_TO_SUID(ZTOI(zdp)->i_uid) != 0 \|\|
	KGID_TO_SGID(ZTOI(zdp)->i_gid) != 0) {
	mutex_exit(&zdp->z_acl_lock);
	goto slow;
	}

	if (uid == KUID_TO_SUID(ZTOI(zdp)->i_uid)) {
	owner = B_TRUE;
	if (zdp->z_mode & S_IXUSR) {
	mutex_exit(&zdp->z_acl_lock);
	return (0);
	} else {
	mutex_exit(&zdp->z_acl_lock);
	goto slow;
	}
	}
	if (groupmember(KGID_TO_SGID(ZTOI(zdp)->i_gid), cr)) {
	groupmbr = B_TRUE;
	if (zdp->z_mode & S_IXGRP) {
	mutex_exit(&zdp->z_acl_lock);
	return (0);
	} else {
	mutex_exit(&zdp->z_acl_lock);
	goto slow;
	}
	}
	if (!owner && !groupmbr) {
	if (zdp->z_mode & S_IXOTH) {
	mutex_exit(&zdp->z_acl_lock);
	return (0);
	}
	}

	mutex_exit(&zdp->z_acl_lock);

	slow:
	DTRACE_PROBE(zfs__fastpath__execute__access__miss);
	ZFS_ENTER(ZTOZSB(zdp));
	error = zfs_zaccess(zdp, ACE_EXECUTE, 0, B_FALSE, cr);
	ZFS_EXIT(ZTOZSB(zdp));
	return (error);
	}

	/*
	* Determine whether Access should be granted/denied.
	*
	* The least priv subsystem is always consulted as a basic privilege
	* can define any form of access.
	*/
	int
	zfs_zaccess(znode_t zp, int mode, int flags, boolean_t skipaclchk, cred_t cr)
	{
	uint32_t working_mode;
	int error;
	int is_attr;
	boolean_t check_privs;
	znode_t *xzp;
	znode_t *check_zp = zp;
	mode_t needed_bits;
	uid_t owner;

	is_attr = ((zp->z_pflags & ZFS_XATTR) && S_ISDIR(ZTOI(zp)->i_mode));

	/*
	* If attribute then validate against base file
	*/
	if (is_attr) {
	if ((error = zfs_zget(ZTOZSB(zp),
	zp->z_xattr_parent, &xzp)) != 0) {
	return (error);
	}

	check_zp = xzp;

	/*
	* fixup mode to map to xattr perms
	*/

	if (mode & (ACE_WRITE_DATA\|ACE_APPEND_DATA)) {
	mode &= ~(ACE_WRITE_DATA\|ACE_APPEND_DATA);
	mode \|= ACE_WRITE_NAMED_ATTRS;
	}

	if (mode & (ACE_READ_DATA\|ACE_EXECUTE)) {
	mode &= ~(ACE_READ_DATA\|ACE_EXECUTE);
	mode \|= ACE_READ_NAMED_ATTRS;
	}
	}

	owner = zfs_fuid_map_id(ZTOZSB(zp), KUID_TO_SUID(ZTOI(zp)->i_uid),
	cr, ZFS_OWNER);
	/*
	* Map the bits required to the standard inode flags
	* S_IRUSR\|S_IWUSR\|S_IXUSR in the needed_bits. Map the bits
	* mapped by working_mode (currently missing) in missing_bits.
	* Call secpolicy_vnode_access2() with (needed_bits & ~checkmode),
	* needed_bits.
	*/
	needed_bits = 0;

	working_mode = mode;
	if ((working_mode & (ACE_READ_ACL\|ACE_READ_ATTRIBUTES)) &&
	owner == crgetuid(cr))
	working_mode &= ~(ACE_READ_ACL\|ACE_READ_ATTRIBUTES);

	if (working_mode & (ACE_READ_DATA\|ACE_READ_NAMED_ATTRS\|
	ACE_READ_ACL\|ACE_READ_ATTRIBUTES\|ACE_SYNCHRONIZE))
	needed_bits \|= S_IRUSR;
	if (working_mode & (ACE_WRITE_DATA\|ACE_WRITE_NAMED_ATTRS\|
	ACE_APPEND_DATA\|ACE_WRITE_ATTRIBUTES\|ACE_SYNCHRONIZE))
	needed_bits \|= S_IWUSR;
	if (working_mode & ACE_EXECUTE)
	needed_bits \|= S_IXUSR;

	if ((error = zfs_zaccess_common(check_zp, mode, &working_mode,
	&check_privs, skipaclchk, cr)) == 0) {
	if (is_attr)
	zrele(xzp);
	return (secpolicy_vnode_access2(cr, ZTOI(zp), owner,
	needed_bits, needed_bits));
	}

	if (error && !check_privs) {
	if (is_attr)
	zrele(xzp);
	return (error);
	}

	if (error && (flags & V_APPEND)) {
	error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr);
	}

	if (error && check_privs) {
	mode_t checkmode = 0;

	/*
	* First check for implicit owner permission on
	* read_acl/read_attributes
	*/

	error = 0;
	ASSERT(working_mode != 0);

	if ((working_mode & (ACE_READ_ACL\|ACE_READ_ATTRIBUTES) &&
	owner == crgetuid(cr)))
	working_mode &= ~(ACE_READ_ACL\|ACE_READ_ATTRIBUTES);

	if (working_mode & (ACE_READ_DATA\|ACE_READ_NAMED_ATTRS\|
	ACE_READ_ACL\|ACE_READ_ATTRIBUTES\|ACE_SYNCHRONIZE))
	checkmode \|= S_IRUSR;
	if (working_mode & (ACE_WRITE_DATA\|ACE_WRITE_NAMED_ATTRS\|
	ACE_APPEND_DATA\|ACE_WRITE_ATTRIBUTES\|ACE_SYNCHRONIZE))
	checkmode \|= S_IWUSR;
	if (working_mode & ACE_EXECUTE)
	checkmode \|= S_IXUSR;

	error = secpolicy_vnode_access2(cr, ZTOI(check_zp), owner,
	needed_bits & ~checkmode, needed_bits);

	if (error == 0 && (working_mode & ACE_WRITE_OWNER))
	error = secpolicy_vnode_chown(cr, owner);
	if (error == 0 && (working_mode & ACE_WRITE_ACL))
	error = secpolicy_vnode_setdac(cr, owner);

	if (error == 0 && (working_mode &
	(ACE_DELETE\|ACE_DELETE_CHILD)))
	error = secpolicy_vnode_remove(cr);

	if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) {
	error = secpolicy_vnode_chown(cr, owner);
	}
	if (error == 0) {
	/*
	* See if any bits other than those already checked
	* for are still present. If so then return EACCES
	*/
	if (working_mode & ~(ZFS_CHECKED_MASKS)) {
	error = SET_ERROR(EACCES);
	}
	}
	} else if (error == 0) {
	error = secpolicy_vnode_access2(cr, ZTOI(zp), owner,
	needed_bits, needed_bits);
	}

	if (is_attr)
	zrele(xzp);

	return (error);
	}

	/*
	* Translate traditional unix S_IRUSR/S_IWUSR/S_IXUSR mode into
	* native ACL format and call zfs_zaccess()
	*/
	int
	zfs_zaccess_rwx(znode_t zp, mode_t mode, int flags, cred_t cr)
	{
	return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr));
	}

	/*
	* Access function for secpolicy_vnode_setattr
	*/
	int
	zfs_zaccess_unix(znode_t zp, mode_t mode, cred_t cr)
	{
	int v4_mode = zfs_unix_to_v4(mode >> 6);

	return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr));
	}

	/* See zfs_zaccess_delete() */
	int zfs_write_implies_delete_child = 1;

	/*
	* Determine whether delete access should be granted.
	*
	* The following chart outlines how we handle delete permissions which is
	* how recent versions of windows (Windows 2008) handles it. The efficiency
	* comes from not having to check the parent ACL where the object itself grants
	* delete:
	*
	* -------------------------------------------------------
	* \| Parent Dir \| Target Object Permissions \|
	* \| permissions \| \|
	* -------------------------------------------------------
	* \| \| ACL Allows \| ACL Denies\| Delete \|
	* \| \| Delete \| Delete \| unspecified\|
	* -------------------------------------------------------
	* \| ACL Allows \| Permit \| Deny * \| Permit \|
	* \| DELETE_CHILD \| \| \| \|
	* -------------------------------------------------------
	* \| ACL Denies \| Permit \| Deny \| Deny \|
	* \| DELETE_CHILD \| \| \| \|
	* -------------------------------------------------------
	* \| ACL specifies \| \| \| \|
	* \| only allow \| Permit \| Deny * \| Permit \|
	* \| write and \| \| \| \|
	* \| execute \| \| \| \|
	* -------------------------------------------------------
	* \| ACL denies \| \| \| \|
	* \| write and \| Permit \| Deny \| Deny \|
	* \| execute \| \| \| \|
	* -------------------------------------------------------
	* ^
	* \|
	* Re. execute permission on the directory: if that's missing,
	* the vnode lookup of the target will fail before we get here.
	*
	* Re [*] in the table above: NFSv4 would normally Permit delete for
	* these two cells of the matrix.
	* See acl.h for notes on which ACE_... flags should be checked for which
	* operations. Specifically, the NFSv4 committee recommendation is in
	* conflict with the Windows interpretation of DENY ACEs, where DENY ACEs
	* should take precedence ahead of ALLOW ACEs.
	*
	* This implementation always consults the target object's ACL first.
	* If a DENY ACE is present on the target object that specifies ACE_DELETE,
	* delete access is denied. If an ALLOW ACE with ACE_DELETE is present on
	* the target object, access is allowed. If and only if no entries with
	* ACE_DELETE are present in the object's ACL, check the container's ACL
	* for entries with ACE_DELETE_CHILD.
	*
	* A summary of the logic implemented from the table above is as follows:
	*
	* First check for DENY ACEs that apply.
	* If either target or container has a deny, EACCES.
	*
	* Delete access can then be summarized as follows:
	* 1: The object to be deleted grants ACE_DELETE, or
	* 2: The containing directory grants ACE_DELETE_CHILD.
	* In a Windows system, that would be the end of the story.
	* In this system, (2) has some complications...
	* 2a: "sticky" bit on a directory adds restrictions, and
	* 2b: existing ACEs from previous versions of ZFS may
	* not carry ACE_DELETE_CHILD where they should, so we
	* also allow delete when ACE_WRITE_DATA is granted.
	*
	* Note: 2b is technically a work-around for a prior bug,
	* which hopefully can go away some day. For those who
	* no longer need the work around, and for testing, this
	* work-around is made conditional via the tunable:
	* zfs_write_implies_delete_child
	*/
	int
	zfs_zaccess_delete(znode_t dzp, znode_t zp, cred_t *cr)
	{
	uint32_t wanted_dirperms;
	uint32_t dzp_working_mode = 0;
	uint32_t zp_working_mode = 0;
	int dzp_error, zp_error;
	boolean_t dzpcheck_privs;
	boolean_t zpcheck_privs;

	if (zp->z_pflags & (ZFS_IMMUTABLE \| ZFS_NOUNLINK))
	return (SET_ERROR(EPERM));

	/*
	* Case 1:
	* If target object grants ACE_DELETE then we are done. This is
	* indicated by a return value of 0. For this case we don't worry
	* about the sticky bit because sticky only applies to the parent
	* directory and this is the child access result.
	*
	* If we encounter a DENY ACE here, we're also done (EACCES).
	* Note that if we hit a DENY ACE here (on the target) it should
	* take precedence over a DENY ACE on the container, so that when
	* we have more complete auditing support we will be able to
	* report an access failure against the specific target.
	* (This is part of why we're checking the target first.)
	*/
	zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode,
	&zpcheck_privs, B_FALSE, cr);
	if (zp_error == EACCES) {
	/* We hit a DENY ACE. */
	if (!zpcheck_privs)
	return (SET_ERROR(zp_error));
	return (secpolicy_vnode_remove(cr));

	}
	if (zp_error == 0)
	return (0);

	/*
	* Case 2:
	* If the containing directory grants ACE_DELETE_CHILD,
	* or we're in backward compatibility mode and the
	* containing directory has ACE_WRITE_DATA, allow.
	* Case 2b is handled with wanted_dirperms.
	*/
	wanted_dirperms = ACE_DELETE_CHILD;
	if (zfs_write_implies_delete_child)
	wanted_dirperms \|= ACE_WRITE_DATA;
	dzp_error = zfs_zaccess_common(dzp, wanted_dirperms,
	&dzp_working_mode, &dzpcheck_privs, B_FALSE, cr);
	if (dzp_error == EACCES) {
	/* We hit a DENY ACE. */
	if (!dzpcheck_privs)
	return (SET_ERROR(dzp_error));
	return (secpolicy_vnode_remove(cr));
	}

	/*
	* Cases 2a, 2b (continued)
	*
	* Note: dzp_working_mode now contains any permissions
	* that were NOT granted. Therefore, if any of the
	* wanted_dirperms WERE granted, we will have:
	* dzp_working_mode != wanted_dirperms
	* We're really asking if ANY of those permissions
	* were granted, and if so, grant delete access.
	*/
	if (dzp_working_mode != wanted_dirperms)
	dzp_error = 0;

	/*
	* dzp_error is 0 if the container granted us permissions to "modify".
	* If we do not have permission via one or more ACEs, our current
	* privileges may still permit us to modify the container.
	*
	* dzpcheck_privs is false when i.e. the FS is read-only.
	* Otherwise, do privilege checks for the container.
	*/
	if (dzp_error != 0 && dzpcheck_privs) {
	uid_t owner;

	/*
	* The secpolicy call needs the requested access and
	* the current access mode of the container, but it
	* only knows about Unix-style modes (VEXEC, VWRITE),
	* so this must condense the fine-grained ACE bits into
	* Unix modes.
	*
	* The VEXEC flag is easy, because we know that has
	* always been checked before we get here (during the
	* lookup of the target vnode). The container has not
	* granted us permissions to "modify", so we do not set
	* the VWRITE flag in the current access mode.
	*/
	owner = zfs_fuid_map_id(ZTOZSB(dzp),
	KUID_TO_SUID(ZTOI(dzp)->i_uid), cr, ZFS_OWNER);
	dzp_error = secpolicy_vnode_access2(cr, ZTOI(dzp),
	owner, S_IXUSR, S_IWUSR\|S_IXUSR);
	}
	if (dzp_error != 0) {
	/*
	* Note: We may have dzp_error = -1 here (from
	* zfs_zacess_common). Don't return that.
	*/
	return (SET_ERROR(EACCES));
	}


	/*
	* At this point, we know that the directory permissions allow
	* us to modify, but we still need to check for the additional
	* restrictions that apply when the "sticky bit" is set.
	*
	* Yes, zfs_sticky_remove_access() also checks this bit, but
	* checking it here and skipping the call below is nice when
	* you're watching all of this with dtrace.
	*/
	if ((dzp->z_mode & S_ISVTX) == 0)
	return (0);

	/*
	* zfs_sticky_remove_access will succeed if:
	* 1. The sticky bit is absent.
	* 2. We pass the sticky bit restrictions.
	* 3. We have privileges that always allow file removal.
	*/
	return (zfs_sticky_remove_access(dzp, zp, cr));
	}

	int
	zfs_zaccess_rename(znode_t sdzp, znode_t szp, znode_t *tdzp,
	znode_t tzp, cred_t cr)
	{
	int add_perm;
	int error;

	if (szp->z_pflags & ZFS_AV_QUARANTINED)
	return (SET_ERROR(EACCES));

	add_perm = S_ISDIR(ZTOI(szp)->i_mode) ?
	ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE;

	/*
	* Rename permissions are combination of delete permission +
	* add file/subdir permission.
	*/

	/*
	* first make sure we do the delete portion.
	*
	* If that succeeds then check for add_file/add_subdir permissions
	*/

	if ((error = zfs_zaccess_delete(sdzp, szp, cr)))
	return (error);

	/*
	* If we have a tzp, see if we can delete it?
	*/
	if (tzp) {
	if ((error = zfs_zaccess_delete(tdzp, tzp, cr)))
	return (error);
	}

	/*
	* Now check for add permissions
	*/
	error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr);

	return (error);
	}
	Index: vendor-sys/openzfs/dist/module/os/linux/zfs/zfs_vfsops.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/linux/zfs/zfs_vfsops.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/linux/zfs/zfs_vfsops.c (revision 365892)
	@@ -1,2175 +1,2175 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2012, 2018 by Delphix. All rights reserved.
	*/

	/* Portions Copyright 2010 Robert Milkowski */

	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/sysmacros.h>
	#include <sys/kmem.h>
	#include <sys/pathname.h>
	#include <sys/vnode.h>
	#include <sys/vfs.h>
	#include <sys/mntent.h>
	#include <sys/cmn_err.h>
	#include <sys/zfs_znode.h>
	#include <sys/zfs_vnops.h>
	#include <sys/zfs_dir.h>
	#include <sys/zil.h>
	#include <sys/fs/zfs.h>
	#include <sys/dmu.h>
	#include <sys/dsl_prop.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_deleg.h>
	#include <sys/spa.h>
	#include <sys/zap.h>
	#include <sys/sa.h>
	#include <sys/sa_impl.h>
	#include <sys/policy.h>
	#include <sys/atomic.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/zfs_ctldir.h>
	#include <sys/zfs_fuid.h>
	#include <sys/zfs_quota.h>
	#include <sys/sunddi.h>
	#include <sys/dmu_objset.h>
	#include <sys/dsl_dir.h>
	#include <sys/spa_boot.h>
	#include <sys/objlist.h>
	#include <sys/zpl.h>
	#include <linux/vfs_compat.h>
	#include "zfs_comutil.h"

	enum {
	TOKEN_RO,
	TOKEN_RW,
	TOKEN_SETUID,
	TOKEN_NOSETUID,
	TOKEN_EXEC,
	TOKEN_NOEXEC,
	TOKEN_DEVICES,
	TOKEN_NODEVICES,
	TOKEN_DIRXATTR,
	TOKEN_SAXATTR,
	TOKEN_XATTR,
	TOKEN_NOXATTR,
	TOKEN_ATIME,
	TOKEN_NOATIME,
	TOKEN_RELATIME,
	TOKEN_NORELATIME,
	TOKEN_NBMAND,
	TOKEN_NONBMAND,
	TOKEN_MNTPOINT,
	TOKEN_LAST,
	};

	static const match_table_t zpl_tokens = {
	{ TOKEN_RO, MNTOPT_RO },
	{ TOKEN_RW, MNTOPT_RW },
	{ TOKEN_SETUID, MNTOPT_SETUID },
	{ TOKEN_NOSETUID, MNTOPT_NOSETUID },
	{ TOKEN_EXEC, MNTOPT_EXEC },
	{ TOKEN_NOEXEC, MNTOPT_NOEXEC },
	{ TOKEN_DEVICES, MNTOPT_DEVICES },
	{ TOKEN_NODEVICES, MNTOPT_NODEVICES },
	{ TOKEN_DIRXATTR, MNTOPT_DIRXATTR },
	{ TOKEN_SAXATTR, MNTOPT_SAXATTR },
	{ TOKEN_XATTR, MNTOPT_XATTR },
	{ TOKEN_NOXATTR, MNTOPT_NOXATTR },
	{ TOKEN_ATIME, MNTOPT_ATIME },
	{ TOKEN_NOATIME, MNTOPT_NOATIME },
	{ TOKEN_RELATIME, MNTOPT_RELATIME },
	{ TOKEN_NORELATIME, MNTOPT_NORELATIME },
	{ TOKEN_NBMAND, MNTOPT_NBMAND },
	{ TOKEN_NONBMAND, MNTOPT_NONBMAND },
	{ TOKEN_MNTPOINT, MNTOPT_MNTPOINT "=%s" },
	{ TOKEN_LAST, NULL },
	};

	static void
	zfsvfs_vfs_free(vfs_t *vfsp)
	{
	if (vfsp != NULL) {
	if (vfsp->vfs_mntpoint != NULL)
	kmem_strfree(vfsp->vfs_mntpoint);

	kmem_free(vfsp, sizeof (vfs_t));
	}
	}

	static int
	zfsvfs_parse_option(char option, int token, substring_t args, vfs_t *vfsp)
	{
	switch (token) {
	case TOKEN_RO:
	vfsp->vfs_readonly = B_TRUE;
	vfsp->vfs_do_readonly = B_TRUE;
	break;
	case TOKEN_RW:
	vfsp->vfs_readonly = B_FALSE;
	vfsp->vfs_do_readonly = B_TRUE;
	break;
	case TOKEN_SETUID:
	vfsp->vfs_setuid = B_TRUE;
	vfsp->vfs_do_setuid = B_TRUE;
	break;
	case TOKEN_NOSETUID:
	vfsp->vfs_setuid = B_FALSE;
	vfsp->vfs_do_setuid = B_TRUE;
	break;
	case TOKEN_EXEC:
	vfsp->vfs_exec = B_TRUE;
	vfsp->vfs_do_exec = B_TRUE;
	break;
	case TOKEN_NOEXEC:
	vfsp->vfs_exec = B_FALSE;
	vfsp->vfs_do_exec = B_TRUE;
	break;
	case TOKEN_DEVICES:
	vfsp->vfs_devices = B_TRUE;
	vfsp->vfs_do_devices = B_TRUE;
	break;
	case TOKEN_NODEVICES:
	vfsp->vfs_devices = B_FALSE;
	vfsp->vfs_do_devices = B_TRUE;
	break;
	case TOKEN_DIRXATTR:
	vfsp->vfs_xattr = ZFS_XATTR_DIR;
	vfsp->vfs_do_xattr = B_TRUE;
	break;
	case TOKEN_SAXATTR:
	vfsp->vfs_xattr = ZFS_XATTR_SA;
	vfsp->vfs_do_xattr = B_TRUE;
	break;
	case TOKEN_XATTR:
	vfsp->vfs_xattr = ZFS_XATTR_DIR;
	vfsp->vfs_do_xattr = B_TRUE;
	break;
	case TOKEN_NOXATTR:
	vfsp->vfs_xattr = ZFS_XATTR_OFF;
	vfsp->vfs_do_xattr = B_TRUE;
	break;
	case TOKEN_ATIME:
	vfsp->vfs_atime = B_TRUE;
	vfsp->vfs_do_atime = B_TRUE;
	break;
	case TOKEN_NOATIME:
	vfsp->vfs_atime = B_FALSE;
	vfsp->vfs_do_atime = B_TRUE;
	break;
	case TOKEN_RELATIME:
	vfsp->vfs_relatime = B_TRUE;
	vfsp->vfs_do_relatime = B_TRUE;
	break;
	case TOKEN_NORELATIME:
	vfsp->vfs_relatime = B_FALSE;
	vfsp->vfs_do_relatime = B_TRUE;
	break;
	case TOKEN_NBMAND:
	vfsp->vfs_nbmand = B_TRUE;
	vfsp->vfs_do_nbmand = B_TRUE;
	break;
	case TOKEN_NONBMAND:
	vfsp->vfs_nbmand = B_FALSE;
	vfsp->vfs_do_nbmand = B_TRUE;
	break;
	case TOKEN_MNTPOINT:
	vfsp->vfs_mntpoint = match_strdup(&args[0]);
	if (vfsp->vfs_mntpoint == NULL)
	return (SET_ERROR(ENOMEM));

	break;
	default:
	break;
	}

	return (0);
	}

	/*
	* Parse the raw mntopts and return a vfs_t describing the options.
	*/
	static int
	zfsvfs_parse_options(char mntopts, vfs_t *vfsp)
	{
	vfs_t *tmp_vfsp;
	int error;

	tmp_vfsp = kmem_zalloc(sizeof (vfs_t), KM_SLEEP);

	if (mntopts != NULL) {
	substring_t args[MAX_OPT_ARGS];
	char tmp_mntopts, p, *t;
	int token;

	tmp_mntopts = t = kmem_strdup(mntopts);
	if (tmp_mntopts == NULL)
	return (SET_ERROR(ENOMEM));

	while ((p = strsep(&t, ",")) != NULL) {
	if (!*p)
	continue;

	args[0].to = args[0].from = NULL;
	token = match_token(p, zpl_tokens, args);
	error = zfsvfs_parse_option(p, token, args, tmp_vfsp);
	if (error) {
	kmem_strfree(tmp_mntopts);
	zfsvfs_vfs_free(tmp_vfsp);
	return (error);
	}
	}

	kmem_strfree(tmp_mntopts);
	}

	*vfsp = tmp_vfsp;

	return (0);
	}

	boolean_t
	zfs_is_readonly(zfsvfs_t *zfsvfs)
	{
	return (!!(zfsvfs->z_sb->s_flags & SB_RDONLY));
	}

	/ARGSUSED/
	int
	zfs_sync(struct super_block sb, int wait, cred_t cr)
	{
	zfsvfs_t *zfsvfs = sb->s_fs_info;

	/*
	* Semantically, the only requirement is that the sync be initiated.
	* The DMU syncs out txgs frequently, so there's nothing to do.
	*/
	if (!wait)
	return (0);

	if (zfsvfs != NULL) {
	/*
	* Sync a specific filesystem.
	*/
	dsl_pool_t *dp;

	ZFS_ENTER(zfsvfs);
	dp = dmu_objset_pool(zfsvfs->z_os);

	/*
	* If the system is shutting down, then skip any
	* filesystems which may exist on a suspended pool.
	*/
	if (spa_suspended(dp->dp_spa)) {
	ZFS_EXIT(zfsvfs);
	return (0);
	}

	if (zfsvfs->z_log != NULL)
	zil_commit(zfsvfs->z_log, 0);

	ZFS_EXIT(zfsvfs);
	} else {
	/*
	* Sync all ZFS filesystems. This is what happens when you
	* run sync(1M). Unlike other filesystems, ZFS honors the
	* request by waiting for all pools to commit all dirty data.
	*/
	spa_sync_allpools();
	}

	return (0);
	}

	static void
	atime_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;
	struct super_block *sb = zfsvfs->z_sb;

	if (sb == NULL)
	return;
	/*
	* Update SB_NOATIME bit in VFS super block. Since atime update is
	* determined by atime_needs_update(), atime_needs_update() needs to
	* return false if atime is turned off, and not unconditionally return
	* false if atime is turned on.
	*/
	if (newval)
	sb->s_flags &= ~SB_NOATIME;
	else
	sb->s_flags \|= SB_NOATIME;
	}

	static void
	relatime_changed_cb(void *arg, uint64_t newval)
	{
	((zfsvfs_t *)arg)->z_relatime = newval;
	}

	static void
	xattr_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	if (newval == ZFS_XATTR_OFF) {
	zfsvfs->z_flags &= ~ZSB_XATTR;
	} else {
	zfsvfs->z_flags \|= ZSB_XATTR;

	if (newval == ZFS_XATTR_SA)
	zfsvfs->z_xattr_sa = B_TRUE;
	else
	zfsvfs->z_xattr_sa = B_FALSE;
	}
	}

	static void
	acltype_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	switch (newval) {
	case ZFS_ACLTYPE_OFF:
	zfsvfs->z_acl_type = ZFS_ACLTYPE_OFF;
	zfsvfs->z_sb->s_flags &= ~SB_POSIXACL;
	break;
	- case ZFS_ACLTYPE_POSIXACL:
	+ case ZFS_ACLTYPE_POSIX:
	#ifdef CONFIG_FS_POSIX_ACL
	- zfsvfs->z_acl_type = ZFS_ACLTYPE_POSIXACL;
	+ zfsvfs->z_acl_type = ZFS_ACLTYPE_POSIX;
	zfsvfs->z_sb->s_flags \|= SB_POSIXACL;
	#else
	zfsvfs->z_acl_type = ZFS_ACLTYPE_OFF;
	zfsvfs->z_sb->s_flags &= ~SB_POSIXACL;
	#endif /* CONFIG_FS_POSIX_ACL */
	break;
	default:
	break;
	}
	}

	static void
	blksz_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;
	ASSERT3U(newval, <=, spa_maxblocksize(dmu_objset_spa(zfsvfs->z_os)));
	ASSERT3U(newval, >=, SPA_MINBLOCKSIZE);
	ASSERT(ISP2(newval));

	zfsvfs->z_max_blksz = newval;
	}

	static void
	readonly_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;
	struct super_block *sb = zfsvfs->z_sb;

	if (sb == NULL)
	return;

	if (newval)
	sb->s_flags \|= SB_RDONLY;
	else
	sb->s_flags &= ~SB_RDONLY;
	}

	static void
	devices_changed_cb(void *arg, uint64_t newval)
	{
	}

	static void
	setuid_changed_cb(void *arg, uint64_t newval)
	{
	}

	static void
	exec_changed_cb(void *arg, uint64_t newval)
	{
	}

	static void
	nbmand_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;
	struct super_block *sb = zfsvfs->z_sb;

	if (sb == NULL)
	return;

	if (newval == TRUE)
	sb->s_flags \|= SB_MANDLOCK;
	else
	sb->s_flags &= ~SB_MANDLOCK;
	}

	static void
	snapdir_changed_cb(void *arg, uint64_t newval)
	{
	((zfsvfs_t *)arg)->z_show_ctldir = newval;
	}

	static void
	vscan_changed_cb(void *arg, uint64_t newval)
	{
	((zfsvfs_t *)arg)->z_vscan = newval;
	}

	static void
	acl_mode_changed_cb(void *arg, uint64_t newval)
	{
	zfsvfs_t *zfsvfs = arg;

	zfsvfs->z_acl_mode = newval;
	}

	static void
	acl_inherit_changed_cb(void *arg, uint64_t newval)
	{
	((zfsvfs_t *)arg)->z_acl_inherit = newval;
	}

	static int
	zfs_register_callbacks(vfs_t *vfsp)
	{
	struct dsl_dataset *ds = NULL;
	objset_t *os = NULL;
	zfsvfs_t *zfsvfs = NULL;
	int error = 0;

	ASSERT(vfsp);
	zfsvfs = vfsp->vfs_data;
	ASSERT(zfsvfs);
	os = zfsvfs->z_os;

	/*
	* The act of registering our callbacks will destroy any mount
	* options we may have. In order to enable temporary overrides
	* of mount options, we stash away the current values and
	* restore them after we register the callbacks.
	*/
	if (zfs_is_readonly(zfsvfs) \|\| !spa_writeable(dmu_objset_spa(os))) {
	vfsp->vfs_do_readonly = B_TRUE;
	vfsp->vfs_readonly = B_TRUE;
	}

	/*
	* Register property callbacks.
	*
	* It would probably be fine to just check for i/o error from
	* the first prop_register(), but I guess I like to go
	* overboard...
	*/
	ds = dmu_objset_ds(os);
	dsl_pool_config_enter(dmu_objset_pool(os), FTAG);
	error = dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_ATIME), atime_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_RELATIME), relatime_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_XATTR), xattr_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_RECORDSIZE), blksz_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_READONLY), readonly_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_DEVICES), devices_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_SETUID), setuid_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_EXEC), exec_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_SNAPDIR), snapdir_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_ACLTYPE), acltype_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_ACLMODE), acl_mode_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_ACLINHERIT), acl_inherit_changed_cb,
	zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_VSCAN), vscan_changed_cb, zfsvfs);
	error = error ? error : dsl_prop_register(ds,
	zfs_prop_to_name(ZFS_PROP_NBMAND), nbmand_changed_cb, zfsvfs);
	dsl_pool_config_exit(dmu_objset_pool(os), FTAG);
	if (error)
	goto unregister;

	/*
	* Invoke our callbacks to restore temporary mount options.
	*/
	if (vfsp->vfs_do_readonly)
	readonly_changed_cb(zfsvfs, vfsp->vfs_readonly);
	if (vfsp->vfs_do_setuid)
	setuid_changed_cb(zfsvfs, vfsp->vfs_setuid);
	if (vfsp->vfs_do_exec)
	exec_changed_cb(zfsvfs, vfsp->vfs_exec);
	if (vfsp->vfs_do_devices)
	devices_changed_cb(zfsvfs, vfsp->vfs_devices);
	if (vfsp->vfs_do_xattr)
	xattr_changed_cb(zfsvfs, vfsp->vfs_xattr);
	if (vfsp->vfs_do_atime)
	atime_changed_cb(zfsvfs, vfsp->vfs_atime);
	if (vfsp->vfs_do_relatime)
	relatime_changed_cb(zfsvfs, vfsp->vfs_relatime);
	if (vfsp->vfs_do_nbmand)
	nbmand_changed_cb(zfsvfs, vfsp->vfs_nbmand);

	return (0);

	unregister:
	dsl_prop_unregister_all(ds, zfsvfs);
	return (error);
	}

	/*
	* Takes a dataset, a property, a value and that value's setpoint as
	* found in the ZAP. Checks if the property has been changed in the vfs.
	* If so, val and setpoint will be overwritten with updated content.
	* Otherwise, they are left unchanged.
	*/
	int
	zfs_get_temporary_prop(dsl_dataset_t ds, zfs_prop_t zfs_prop, uint64_t val,
	char *setpoint)
	{
	int error;
	zfsvfs_t *zfvp;
	vfs_t *vfsp;
	objset_t *os;
	uint64_t tmp = *val;

	error = dmu_objset_from_ds(ds, &os);
	if (error != 0)
	return (error);

	if (dmu_objset_type(os) != DMU_OST_ZFS)
	return (EINVAL);

	mutex_enter(&os->os_user_ptr_lock);
	zfvp = dmu_objset_get_user(os);
	mutex_exit(&os->os_user_ptr_lock);
	if (zfvp == NULL)
	return (ESRCH);

	vfsp = zfvp->z_vfs;

	switch (zfs_prop) {
	case ZFS_PROP_ATIME:
	if (vfsp->vfs_do_atime)
	tmp = vfsp->vfs_atime;
	break;
	case ZFS_PROP_RELATIME:
	if (vfsp->vfs_do_relatime)
	tmp = vfsp->vfs_relatime;
	break;
	case ZFS_PROP_DEVICES:
	if (vfsp->vfs_do_devices)
	tmp = vfsp->vfs_devices;
	break;
	case ZFS_PROP_EXEC:
	if (vfsp->vfs_do_exec)
	tmp = vfsp->vfs_exec;
	break;
	case ZFS_PROP_SETUID:
	if (vfsp->vfs_do_setuid)
	tmp = vfsp->vfs_setuid;
	break;
	case ZFS_PROP_READONLY:
	if (vfsp->vfs_do_readonly)
	tmp = vfsp->vfs_readonly;
	break;
	case ZFS_PROP_XATTR:
	if (vfsp->vfs_do_xattr)
	tmp = vfsp->vfs_xattr;
	break;
	case ZFS_PROP_NBMAND:
	if (vfsp->vfs_do_nbmand)
	tmp = vfsp->vfs_nbmand;
	break;
	default:
	return (ENOENT);
	}

	if (tmp != *val) {
	(void) strcpy(setpoint, "temporary");
	*val = tmp;
	}
	return (0);
	}

	/*
	* Associate this zfsvfs with the given objset, which must be owned.
	* This will cache a bunch of on-disk state from the objset in the
	* zfsvfs.
	*/
	static int
	zfsvfs_init(zfsvfs_t zfsvfs, objset_t os)
	{
	int error;
	uint64_t val;

	zfsvfs->z_max_blksz = SPA_OLD_MAXBLOCKSIZE;
	zfsvfs->z_show_ctldir = ZFS_SNAPDIR_VISIBLE;
	zfsvfs->z_os = os;

	error = zfs_get_zplprop(os, ZFS_PROP_VERSION, &zfsvfs->z_version);
	if (error != 0)
	return (error);
	if (zfsvfs->z_version >
	zfs_zpl_version_map(spa_version(dmu_objset_spa(os)))) {
	(void) printk("Can't mount a version %lld file system "
	"on a version %lld pool\n. Pool must be upgraded to mount "
	"this file system.\n", (u_longlong_t)zfsvfs->z_version,
	(u_longlong_t)spa_version(dmu_objset_spa(os)));
	return (SET_ERROR(ENOTSUP));
	}
	error = zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &val);
	if (error != 0)
	return (error);
	zfsvfs->z_norm = (int)val;

	error = zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &val);
	if (error != 0)
	return (error);
	zfsvfs->z_utf8 = (val != 0);

	error = zfs_get_zplprop(os, ZFS_PROP_CASE, &val);
	if (error != 0)
	return (error);
	zfsvfs->z_case = (uint_t)val;

	if ((error = zfs_get_zplprop(os, ZFS_PROP_ACLTYPE, &val)) != 0)
	return (error);
	zfsvfs->z_acl_type = (uint_t)val;

	/*
	* Fold case on file systems that are always or sometimes case
	* insensitive.
	*/
	if (zfsvfs->z_case == ZFS_CASE_INSENSITIVE \|\|
	zfsvfs->z_case == ZFS_CASE_MIXED)
	zfsvfs->z_norm \|= U8_TEXTPREP_TOUPPER;

	zfsvfs->z_use_fuids = USE_FUIDS(zfsvfs->z_version, zfsvfs->z_os);
	zfsvfs->z_use_sa = USE_SA(zfsvfs->z_version, zfsvfs->z_os);

	uint64_t sa_obj = 0;
	if (zfsvfs->z_use_sa) {
	/* should either have both of these objects or none */
	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_SA_ATTRS, 8, 1,
	&sa_obj);
	if (error != 0)
	return (error);

	error = zfs_get_zplprop(os, ZFS_PROP_XATTR, &val);
	if ((error == 0) && (val == ZFS_XATTR_SA))
	zfsvfs->z_xattr_sa = B_TRUE;
	}

	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_ROOT_OBJ, 8, 1,
	&zfsvfs->z_root);
	if (error != 0)
	return (error);
	ASSERT(zfsvfs->z_root != 0);

	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_UNLINKED_SET, 8, 1,
	&zfsvfs->z_unlinkedobj);
	if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA],
	8, 1, &zfsvfs->z_userquota_obj);
	if (error == ENOENT)
	zfsvfs->z_userquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA],
	8, 1, &zfsvfs->z_groupquota_obj);
	if (error == ENOENT)
	zfsvfs->z_groupquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_PROJECTQUOTA],
	8, 1, &zfsvfs->z_projectquota_obj);
	if (error == ENOENT)
	zfsvfs->z_projectquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_USEROBJQUOTA],
	8, 1, &zfsvfs->z_userobjquota_obj);
	if (error == ENOENT)
	zfsvfs->z_userobjquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_GROUPOBJQUOTA],
	8, 1, &zfsvfs->z_groupobjquota_obj);
	if (error == ENOENT)
	zfsvfs->z_groupobjquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ,
	zfs_userquota_prop_prefixes[ZFS_PROP_PROJECTOBJQUOTA],
	8, 1, &zfsvfs->z_projectobjquota_obj);
	if (error == ENOENT)
	zfsvfs->z_projectobjquota_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_FUID_TABLES, 8, 1,
	&zfsvfs->z_fuid_obj);
	if (error == ENOENT)
	zfsvfs->z_fuid_obj = 0;
	else if (error != 0)
	return (error);

	error = zap_lookup(os, MASTER_NODE_OBJ, ZFS_SHARES_DIR, 8, 1,
	&zfsvfs->z_shares_dir);
	if (error == ENOENT)
	zfsvfs->z_shares_dir = 0;
	else if (error != 0)
	return (error);

	error = sa_setup(os, sa_obj, zfs_attr_table, ZPL_END,
	&zfsvfs->z_attr_table);
	if (error != 0)
	return (error);

	if (zfsvfs->z_version >= ZPL_VERSION_SA)
	sa_register_update_callback(os, zfs_sa_upgrade);

	return (0);
	}

	int
	zfsvfs_create(const char osname, boolean_t readonly, zfsvfs_t *zfvp)
	{
	objset_t *os;
	zfsvfs_t *zfsvfs;
	int error;
	boolean_t ro = (readonly \|\| (strchr(osname, '@') != NULL));

	zfsvfs = kmem_zalloc(sizeof (zfsvfs_t), KM_SLEEP);

	error = dmu_objset_own(osname, DMU_OST_ZFS, ro, B_TRUE, zfsvfs, &os);
	if (error != 0) {
	kmem_free(zfsvfs, sizeof (zfsvfs_t));
	return (error);
	}

	error = zfsvfs_create_impl(zfvp, zfsvfs, os);
	if (error != 0) {
	dmu_objset_disown(os, B_TRUE, zfsvfs);
	}
	return (error);
	}


	/*
	* Note: zfsvfs is assumed to be malloc'd, and will be freed by this function
	* on a failure. Do not pass in a statically allocated zfsvfs.
	*/
	int
	zfsvfs_create_impl(zfsvfs_t *zfvp, zfsvfs_t zfsvfs, objset_t *os)
	{
	int error;

	zfsvfs->z_vfs = NULL;
	zfsvfs->z_sb = NULL;
	zfsvfs->z_parent = zfsvfs;

	mutex_init(&zfsvfs->z_znodes_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&zfsvfs->z_lock, NULL, MUTEX_DEFAULT, NULL);
	list_create(&zfsvfs->z_all_znodes, sizeof (znode_t),
	offsetof(znode_t, z_link_node));
	rrm_init(&zfsvfs->z_teardown_lock, B_FALSE);
	rw_init(&zfsvfs->z_teardown_inactive_lock, NULL, RW_DEFAULT, NULL);
	rw_init(&zfsvfs->z_fuid_lock, NULL, RW_DEFAULT, NULL);

	int size = MIN(1 << (highbit64(zfs_object_mutex_size) - 1),
	ZFS_OBJ_MTX_MAX);
	zfsvfs->z_hold_size = size;
	zfsvfs->z_hold_trees = vmem_zalloc(sizeof (avl_tree_t) * size,
	KM_SLEEP);
	zfsvfs->z_hold_locks = vmem_zalloc(sizeof (kmutex_t) * size, KM_SLEEP);
	for (int i = 0; i != size; i++) {
	avl_create(&zfsvfs->z_hold_trees[i], zfs_znode_hold_compare,
	sizeof (znode_hold_t), offsetof(znode_hold_t, zh_node));
	mutex_init(&zfsvfs->z_hold_locks[i], NULL, MUTEX_DEFAULT, NULL);
	}

	error = zfsvfs_init(zfsvfs, os);
	if (error != 0) {
	*zfvp = NULL;
	zfsvfs_free(zfsvfs);
	return (error);
	}

	zfsvfs->z_drain_task = TASKQID_INVALID;
	zfsvfs->z_draining = B_FALSE;
	zfsvfs->z_drain_cancel = B_TRUE;

	*zfvp = zfsvfs;
	return (0);
	}

	static int
	zfsvfs_setup(zfsvfs_t *zfsvfs, boolean_t mounting)
	{
	int error;
	boolean_t readonly = zfs_is_readonly(zfsvfs);

	error = zfs_register_callbacks(zfsvfs->z_vfs);
	if (error)
	return (error);

	zfsvfs->z_log = zil_open(zfsvfs->z_os, zfs_get_data);

	/*
	* If we are not mounting (ie: online recv), then we don't
	* have to worry about replaying the log as we blocked all
	* operations out since we closed the ZIL.
	*/
	if (mounting) {
	ASSERT3P(zfsvfs->z_kstat.dk_kstats, ==, NULL);
	dataset_kstats_create(&zfsvfs->z_kstat, zfsvfs->z_os);

	/*
	* During replay we remove the read only flag to
	* allow replays to succeed.
	*/
	if (readonly != 0) {
	readonly_changed_cb(zfsvfs, B_FALSE);
	} else {
	zap_stats_t zs;
	if (zap_get_stats(zfsvfs->z_os, zfsvfs->z_unlinkedobj,
	&zs) == 0) {
	dataset_kstats_update_nunlinks_kstat(
	&zfsvfs->z_kstat, zs.zs_num_entries);
	dprintf_ds(zfsvfs->z_os->os_dsl_dataset,
	"num_entries in unlinked set: %llu",
	zs.zs_num_entries);
	}
	zfs_unlinked_drain(zfsvfs);
	dsl_dir_t *dd = zfsvfs->z_os->os_dsl_dataset->ds_dir;
	dd->dd_activity_cancelled = B_FALSE;
	}

	/*
	* Parse and replay the intent log.
	*
	* Because of ziltest, this must be done after
	* zfs_unlinked_drain(). (Further note: ziltest
	* doesn't use readonly mounts, where
	* zfs_unlinked_drain() isn't called.) This is because
	* ziltest causes spa_sync() to think it's committed,
	* but actually it is not, so the intent log contains
	* many txg's worth of changes.
	*
	* In particular, if object N is in the unlinked set in
	* the last txg to actually sync, then it could be
	* actually freed in a later txg and then reallocated
	* in a yet later txg. This would write a "create
	* object N" record to the intent log. Normally, this
	* would be fine because the spa_sync() would have
	* written out the fact that object N is free, before
	* we could write the "create object N" intent log
	* record.
	*
	* But when we are in ziltest mode, we advance the "open
	* txg" without actually spa_sync()-ing the changes to
	* disk. So we would see that object N is still
	* allocated and in the unlinked set, and there is an
	* intent log record saying to allocate it.
	*/
	if (spa_writeable(dmu_objset_spa(zfsvfs->z_os))) {
	if (zil_replay_disable) {
	zil_destroy(zfsvfs->z_log, B_FALSE);
	} else {
	zfsvfs->z_replay = B_TRUE;
	zil_replay(zfsvfs->z_os, zfsvfs,
	zfs_replay_vector);
	zfsvfs->z_replay = B_FALSE;
	}
	}

	/* restore readonly bit */
	if (readonly != 0)
	readonly_changed_cb(zfsvfs, B_TRUE);
	}

	/*
	* Set the objset user_ptr to track its zfsvfs.
	*/
	mutex_enter(&zfsvfs->z_os->os_user_ptr_lock);
	dmu_objset_set_user(zfsvfs->z_os, zfsvfs);
	mutex_exit(&zfsvfs->z_os->os_user_ptr_lock);

	return (0);
	}

	void
	zfsvfs_free(zfsvfs_t *zfsvfs)
	{
	int i, size = zfsvfs->z_hold_size;

	zfs_fuid_destroy(zfsvfs);

	mutex_destroy(&zfsvfs->z_znodes_lock);
	mutex_destroy(&zfsvfs->z_lock);
	list_destroy(&zfsvfs->z_all_znodes);
	rrm_destroy(&zfsvfs->z_teardown_lock);
	rw_destroy(&zfsvfs->z_teardown_inactive_lock);
	rw_destroy(&zfsvfs->z_fuid_lock);
	for (i = 0; i != size; i++) {
	avl_destroy(&zfsvfs->z_hold_trees[i]);
	mutex_destroy(&zfsvfs->z_hold_locks[i]);
	}
	vmem_free(zfsvfs->z_hold_trees, sizeof (avl_tree_t) * size);
	vmem_free(zfsvfs->z_hold_locks, sizeof (kmutex_t) * size);
	zfsvfs_vfs_free(zfsvfs->z_vfs);
	dataset_kstats_destroy(&zfsvfs->z_kstat);
	kmem_free(zfsvfs, sizeof (zfsvfs_t));
	}

	static void
	zfs_set_fuid_feature(zfsvfs_t *zfsvfs)
	{
	zfsvfs->z_use_fuids = USE_FUIDS(zfsvfs->z_version, zfsvfs->z_os);
	zfsvfs->z_use_sa = USE_SA(zfsvfs->z_version, zfsvfs->z_os);
	}

	static void
	zfs_unregister_callbacks(zfsvfs_t *zfsvfs)
	{
	objset_t *os = zfsvfs->z_os;

	if (!dmu_objset_is_snapshot(os))
	dsl_prop_unregister_all(dmu_objset_ds(os), zfsvfs);
	}

	#ifdef HAVE_MLSLABEL
	/*
	* Check that the hex label string is appropriate for the dataset being
	* mounted into the global_zone proper.
	*
	* Return an error if the hex label string is not default or
	* admin_low/admin_high. For admin_low labels, the corresponding
	* dataset must be readonly.
	*/
	int
	zfs_check_global_label(const char dsname, const char hexsl)
	{
	if (strcasecmp(hexsl, ZFS_MLSLABEL_DEFAULT) == 0)
	return (0);
	if (strcasecmp(hexsl, ADMIN_HIGH) == 0)
	return (0);
	if (strcasecmp(hexsl, ADMIN_LOW) == 0) {
	/* must be readonly */
	uint64_t rdonly;

	if (dsl_prop_get_integer(dsname,
	zfs_prop_to_name(ZFS_PROP_READONLY), &rdonly, NULL))
	return (SET_ERROR(EACCES));
	return (rdonly ? 0 : SET_ERROR(EACCES));
	}
	return (SET_ERROR(EACCES));
	}
	#endif /* HAVE_MLSLABEL */

	static int
	zfs_statfs_project(zfsvfs_t zfsvfs, znode_t zp, struct kstatfs *statp,
	uint32_t bshift)
	{
	char buf[20 + DMU_OBJACCT_PREFIX_LEN];
	uint64_t offset = DMU_OBJACCT_PREFIX_LEN;
	uint64_t quota;
	uint64_t used;
	int err;

	strlcpy(buf, DMU_OBJACCT_PREFIX, DMU_OBJACCT_PREFIX_LEN + 1);
	err = zfs_id_to_fuidstr(zfsvfs, NULL, zp->z_projid, buf + offset,
	sizeof (buf) - offset, B_FALSE);
	if (err)
	return (err);

	if (zfsvfs->z_projectquota_obj == 0)
	goto objs;

	err = zap_lookup(zfsvfs->z_os, zfsvfs->z_projectquota_obj,
	buf + offset, 8, 1, &quota);
	if (err == ENOENT)
	goto objs;
	else if (err)
	return (err);

	err = zap_lookup(zfsvfs->z_os, DMU_PROJECTUSED_OBJECT,
	buf + offset, 8, 1, &used);
	if (unlikely(err == ENOENT)) {
	uint32_t blksize;
	u_longlong_t nblocks;

	/*
	* Quota accounting is async, so it is possible race case.
	* There is at least one object with the given project ID.
	*/
	sa_object_size(zp->z_sa_hdl, &blksize, &nblocks);
	if (unlikely(zp->z_blksz == 0))
	blksize = zfsvfs->z_max_blksz;

	used = blksize * nblocks;
	} else if (err) {
	return (err);
	}

	statp->f_blocks = quota >> bshift;
	statp->f_bfree = (quota > used) ? ((quota - used) >> bshift) : 0;
	statp->f_bavail = statp->f_bfree;

	objs:
	if (zfsvfs->z_projectobjquota_obj == 0)
	return (0);

	err = zap_lookup(zfsvfs->z_os, zfsvfs->z_projectobjquota_obj,
	buf + offset, 8, 1, &quota);
	if (err == ENOENT)
	return (0);
	else if (err)
	return (err);

	err = zap_lookup(zfsvfs->z_os, DMU_PROJECTUSED_OBJECT,
	buf, 8, 1, &used);
	if (unlikely(err == ENOENT)) {
	/*
	* Quota accounting is async, so it is possible race case.
	* There is at least one object with the given project ID.
	*/
	used = 1;
	} else if (err) {
	return (err);
	}

	statp->f_files = quota;
	statp->f_ffree = (quota > used) ? (quota - used) : 0;

	return (0);
	}

	int
	zfs_statvfs(struct inode ip, struct kstatfs statp)
	{
	zfsvfs_t *zfsvfs = ITOZSB(ip);
	uint64_t refdbytes, availbytes, usedobjs, availobjs;
	int err = 0;

	ZFS_ENTER(zfsvfs);

	dmu_objset_space(zfsvfs->z_os,
	&refdbytes, &availbytes, &usedobjs, &availobjs);

	uint64_t fsid = dmu_objset_fsid_guid(zfsvfs->z_os);
	/*
	* The underlying storage pool actually uses multiple block
	* size. Under Solaris frsize (fragment size) is reported as
	* the smallest block size we support, and bsize (block size)
	* as the filesystem's maximum block size. Unfortunately,
	* under Linux the fragment size and block size are often used
	* interchangeably. Thus we are forced to report both of them
	* as the filesystem's maximum block size.
	*/
	statp->f_frsize = zfsvfs->z_max_blksz;
	statp->f_bsize = zfsvfs->z_max_blksz;
	uint32_t bshift = fls(statp->f_bsize) - 1;

	/*
	* The following report "total" blocks of various kinds in
	* the file system, but reported in terms of f_bsize - the
	* "preferred" size.
	*/

	/* Round up so we never have a filesystem using 0 blocks. */
	refdbytes = P2ROUNDUP(refdbytes, statp->f_bsize);
	statp->f_blocks = (refdbytes + availbytes) >> bshift;
	statp->f_bfree = availbytes >> bshift;
	statp->f_bavail = statp->f_bfree; /* no root reservation */

	/*
	* statvfs() should really be called statufs(), because it assumes
	* static metadata. ZFS doesn't preallocate files, so the best
	* we can do is report the max that could possibly fit in f_files,
	* and that minus the number actually used in f_ffree.
	* For f_ffree, report the smaller of the number of objects available
	* and the number of blocks (each object will take at least a block).
	*/
	statp->f_ffree = MIN(availobjs, availbytes >> DNODE_SHIFT);
	statp->f_files = statp->f_ffree + usedobjs;
	statp->f_fsid.val[0] = (uint32_t)fsid;
	statp->f_fsid.val[1] = (uint32_t)(fsid >> 32);
	statp->f_type = ZFS_SUPER_MAGIC;
	statp->f_namelen = MAXNAMELEN - 1;

	/*
	* We have all of 40 characters to stuff a string here.
	* Is there anything useful we could/should provide?
	*/
	bzero(statp->f_spare, sizeof (statp->f_spare));

	if (dmu_objset_projectquota_enabled(zfsvfs->z_os) &&
	dmu_objset_projectquota_present(zfsvfs->z_os)) {
	znode_t *zp = ITOZ(ip);

	if (zp->z_pflags & ZFS_PROJINHERIT && zp->z_projid &&
	zpl_is_valid_projid(zp->z_projid))
	err = zfs_statfs_project(zfsvfs, zp, statp, bshift);
	}

	ZFS_EXIT(zfsvfs);
	return (err);
	}

	static int
	zfs_root(zfsvfs_t zfsvfs, struct inode *ipp)
	{
	znode_t *rootzp;
	int error;

	ZFS_ENTER(zfsvfs);

	error = zfs_zget(zfsvfs, zfsvfs->z_root, &rootzp);
	if (error == 0)
	*ipp = ZTOI(rootzp);

	ZFS_EXIT(zfsvfs);
	return (error);
	}

	/*
	* Linux kernels older than 3.1 do not support a per-filesystem shrinker.
	* To accommodate this we must improvise and manually walk the list of znodes
	* attempting to prune dentries in order to be able to drop the inodes.
	*
	* To avoid scanning the same znodes multiple times they are always rotated
	* to the end of the z_all_znodes list. New znodes are inserted at the
	* end of the list so we're always scanning the oldest znodes first.
	*/
	static int
	zfs_prune_aliases(zfsvfs_t *zfsvfs, unsigned long nr_to_scan)
	{
	znode_t *zp_array, zp;
	int max_array = MIN(nr_to_scan, PAGE_SIZE * 8 / sizeof (znode_t *));
	int objects = 0;
	int i = 0, j = 0;

	zp_array = kmem_zalloc(max_array * sizeof (znode_t *), KM_SLEEP);

	mutex_enter(&zfsvfs->z_znodes_lock);
	while ((zp = list_head(&zfsvfs->z_all_znodes)) != NULL) {

	if ((i++ > nr_to_scan) \|\| (j >= max_array))
	break;

	ASSERT(list_link_active(&zp->z_link_node));
	list_remove(&zfsvfs->z_all_znodes, zp);
	list_insert_tail(&zfsvfs->z_all_znodes, zp);

	/* Skip active znodes and .zfs entries */
	if (MUTEX_HELD(&zp->z_lock) \|\| zp->z_is_ctldir)
	continue;

	if (igrab(ZTOI(zp)) == NULL)
	continue;

	zp_array[j] = zp;
	j++;
	}
	mutex_exit(&zfsvfs->z_znodes_lock);

	for (i = 0; i < j; i++) {
	zp = zp_array[i];

	ASSERT3P(zp, !=, NULL);
	d_prune_aliases(ZTOI(zp));

	if (atomic_read(&ZTOI(zp)->i_count) == 1)
	objects++;

	zrele(zp);
	}

	kmem_free(zp_array, max_array * sizeof (znode_t *));

	return (objects);
	}

	/*
	* The ARC has requested that the filesystem drop entries from the dentry
	* and inode caches. This can occur when the ARC needs to free meta data
	* blocks but can't because they are all pinned by entries in these caches.
	*/
	int
	zfs_prune(struct super_block sb, unsigned long nr_to_scan, int objects)
	{
	zfsvfs_t *zfsvfs = sb->s_fs_info;
	int error = 0;
	struct shrinker *shrinker = &sb->s_shrink;
	struct shrink_control sc = {
	.nr_to_scan = nr_to_scan,
	.gfp_mask = GFP_KERNEL,
	};

	ZFS_ENTER(zfsvfs);

	#if defined(HAVE_SPLIT_SHRINKER_CALLBACK) && \
	defined(SHRINK_CONTROL_HAS_NID) && \
	defined(SHRINKER_NUMA_AWARE)
	if (sb->s_shrink.flags & SHRINKER_NUMA_AWARE) {
	*objects = 0;
	for_each_online_node(sc.nid) {
	objects += (shrinker->scan_objects)(shrinker, &sc);
	}
	} else {
	objects = (shrinker->scan_objects)(shrinker, &sc);
	}

	#elif defined(HAVE_SPLIT_SHRINKER_CALLBACK)
	objects = (shrinker->scan_objects)(shrinker, &sc);
	#elif defined(HAVE_SINGLE_SHRINKER_CALLBACK)
	objects = (shrinker->shrink)(shrinker, &sc);
	#elif defined(HAVE_D_PRUNE_ALIASES)
	#define D_PRUNE_ALIASES_IS_DEFAULT
	*objects = zfs_prune_aliases(zfsvfs, nr_to_scan);
	#else
	#error "No available dentry and inode cache pruning mechanism."
	#endif

	#if defined(HAVE_D_PRUNE_ALIASES) && !defined(D_PRUNE_ALIASES_IS_DEFAULT)
	#undef D_PRUNE_ALIASES_IS_DEFAULT
	/*
	* Fall back to zfs_prune_aliases if the kernel's per-superblock
	* shrinker couldn't free anything, possibly due to the inodes being
	* allocated in a different memcg.
	*/
	if (*objects == 0)
	*objects = zfs_prune_aliases(zfsvfs, nr_to_scan);
	#endif

	ZFS_EXIT(zfsvfs);

	dprintf_ds(zfsvfs->z_os->os_dsl_dataset,
	"pruning, nr_to_scan=%lu objects=%d error=%d\n",
	nr_to_scan, *objects, error);

	return (error);
	}

	/*
	* Teardown the zfsvfs_t.
	*
	* Note, if 'unmounting' is FALSE, we return with the 'z_teardown_lock'
	* and 'z_teardown_inactive_lock' held.
	*/
	static int
	zfsvfs_teardown(zfsvfs_t *zfsvfs, boolean_t unmounting)
	{
	znode_t *zp;

	zfs_unlinked_drain_stop_wait(zfsvfs);

	/*
	* If someone has not already unmounted this file system,
	* drain the zrele_taskq to ensure all active references to the
	* zfsvfs_t have been handled only then can it be safely destroyed.
	*/
	if (zfsvfs->z_os) {
	/*
	* If we're unmounting we have to wait for the list to
	* drain completely.
	*
	* If we're not unmounting there's no guarantee the list
	* will drain completely, but iputs run from the taskq
	* may add the parents of dir-based xattrs to the taskq
	* so we want to wait for these.
	*
	* We can safely read z_nr_znodes without locking because the
	* VFS has already blocked operations which add to the
	* z_all_znodes list and thus increment z_nr_znodes.
	*/
	int round = 0;
	while (zfsvfs->z_nr_znodes > 0) {
	taskq_wait_outstanding(dsl_pool_zrele_taskq(
	dmu_objset_pool(zfsvfs->z_os)), 0);
	if (++round > 1 && !unmounting)
	break;
	}
	}

	rrm_enter(&zfsvfs->z_teardown_lock, RW_WRITER, FTAG);

	if (!unmounting) {
	/*
	* We purge the parent filesystem's super block as the
	* parent filesystem and all of its snapshots have their
	* inode's super block set to the parent's filesystem's
	* super block. Note, 'z_parent' is self referential
	* for non-snapshots.
	*/
	shrink_dcache_sb(zfsvfs->z_parent->z_sb);
	}

	/*
	* Close the zil. NB: Can't close the zil while zfs_inactive
	* threads are blocked as zil_close can call zfs_inactive.
	*/
	if (zfsvfs->z_log) {
	zil_close(zfsvfs->z_log);
	zfsvfs->z_log = NULL;
	}

	rw_enter(&zfsvfs->z_teardown_inactive_lock, RW_WRITER);

	/*
	* If we are not unmounting (ie: online recv) and someone already
	* unmounted this file system while we were doing the switcheroo,
	* or a reopen of z_os failed then just bail out now.
	*/
	if (!unmounting && (zfsvfs->z_unmounted \|\| zfsvfs->z_os == NULL)) {
	rw_exit(&zfsvfs->z_teardown_inactive_lock);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);
	return (SET_ERROR(EIO));
	}

	/*
	* At this point there are no VFS ops active, and any new VFS ops
	* will fail with EIO since we have z_teardown_lock for writer (only
	* relevant for forced unmount).
	*
	* Release all holds on dbufs. We also grab an extra reference to all
	* the remaining inodes so that the kernel does not attempt to free
	* any inodes of a suspended fs. This can cause deadlocks since the
	* zfs_resume_fs() process may involve starting threads, which might
	* attempt to free unreferenced inodes to free up memory for the new
	* thread.
	*/
	if (!unmounting) {
	mutex_enter(&zfsvfs->z_znodes_lock);
	for (zp = list_head(&zfsvfs->z_all_znodes); zp != NULL;
	zp = list_next(&zfsvfs->z_all_znodes, zp)) {
	if (zp->z_sa_hdl)
	zfs_znode_dmu_fini(zp);
	if (igrab(ZTOI(zp)) != NULL)
	zp->z_suspended = B_TRUE;

	}
	mutex_exit(&zfsvfs->z_znodes_lock);
	}

	/*
	* If we are unmounting, set the unmounted flag and let new VFS ops
	* unblock. zfs_inactive will have the unmounted behavior, and all
	* other VFS ops will fail with EIO.
	*/
	if (unmounting) {
	zfsvfs->z_unmounted = B_TRUE;
	rw_exit(&zfsvfs->z_teardown_inactive_lock);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);
	}

	/*
	* z_os will be NULL if there was an error in attempting to reopen
	* zfsvfs, so just return as the properties had already been
	*
	* unregistered and cached data had been evicted before.
	*/
	if (zfsvfs->z_os == NULL)
	return (0);

	/*
	* Unregister properties.
	*/
	zfs_unregister_callbacks(zfsvfs);

	/*
	* Evict cached data. We must write out any dirty data before
	* disowning the dataset.
	*/
	objset_t *os = zfsvfs->z_os;
	boolean_t os_dirty = B_FALSE;
	for (int t = 0; t < TXG_SIZE; t++) {
	if (dmu_objset_is_dirty(os, t)) {
	os_dirty = B_TRUE;
	break;
	}
	}
	if (!zfs_is_readonly(zfsvfs) && os_dirty) {
	txg_wait_synced(dmu_objset_pool(zfsvfs->z_os), 0);
	}
	dmu_objset_evict_dbufs(zfsvfs->z_os);
	dsl_dir_t *dd = os->os_dsl_dataset->ds_dir;
	dsl_dir_cancel_waiters(dd);

	return (0);
	}

	#if defined(HAVE_SUPER_SETUP_BDI_NAME)
	atomic_long_t zfs_bdi_seq = ATOMIC_LONG_INIT(0);
	#endif

	int
	zfs_domount(struct super_block sb, zfs_mnt_t zm, int silent)
	{
	const char *osname = zm->mnt_osname;
	struct inode *root_inode;
	uint64_t recordsize;
	int error = 0;
	zfsvfs_t *zfsvfs = NULL;
	vfs_t *vfs = NULL;

	ASSERT(zm);
	ASSERT(osname);

	error = zfsvfs_parse_options(zm->mnt_data, &vfs);
	if (error)
	return (error);

	error = zfsvfs_create(osname, vfs->vfs_readonly, &zfsvfs);
	if (error) {
	zfsvfs_vfs_free(vfs);
	goto out;
	}

	if ((error = dsl_prop_get_integer(osname, "recordsize",
	&recordsize, NULL))) {
	zfsvfs_vfs_free(vfs);
	goto out;
	}

	vfs->vfs_data = zfsvfs;
	zfsvfs->z_vfs = vfs;
	zfsvfs->z_sb = sb;
	sb->s_fs_info = zfsvfs;
	sb->s_magic = ZFS_SUPER_MAGIC;
	sb->s_maxbytes = MAX_LFS_FILESIZE;
	sb->s_time_gran = 1;
	sb->s_blocksize = recordsize;
	sb->s_blocksize_bits = ilog2(recordsize);

	error = -zpl_bdi_setup(sb, "zfs");
	if (error)
	goto out;

	sb->s_bdi->ra_pages = 0;

	/* Set callback operations for the file system. */
	sb->s_op = &zpl_super_operations;
	sb->s_xattr = zpl_xattr_handlers;
	sb->s_export_op = &zpl_export_operations;
	sb->s_d_op = &zpl_dentry_operations;

	/* Set features for file system. */
	zfs_set_fuid_feature(zfsvfs);

	if (dmu_objset_is_snapshot(zfsvfs->z_os)) {
	uint64_t pval;

	atime_changed_cb(zfsvfs, B_FALSE);
	readonly_changed_cb(zfsvfs, B_TRUE);
	if ((error = dsl_prop_get_integer(osname,
	"xattr", &pval, NULL)))
	goto out;
	xattr_changed_cb(zfsvfs, pval);
	if ((error = dsl_prop_get_integer(osname,
	"acltype", &pval, NULL)))
	goto out;
	acltype_changed_cb(zfsvfs, pval);
	zfsvfs->z_issnap = B_TRUE;
	zfsvfs->z_os->os_sync = ZFS_SYNC_DISABLED;
	zfsvfs->z_snap_defer_time = jiffies;

	mutex_enter(&zfsvfs->z_os->os_user_ptr_lock);
	dmu_objset_set_user(zfsvfs->z_os, zfsvfs);
	mutex_exit(&zfsvfs->z_os->os_user_ptr_lock);
	} else {
	if ((error = zfsvfs_setup(zfsvfs, B_TRUE)))
	goto out;
	}

	/* Allocate a root inode for the filesystem. */
	error = zfs_root(zfsvfs, &root_inode);
	if (error) {
	(void) zfs_umount(sb);
	goto out;
	}

	/* Allocate a root dentry for the filesystem */
	sb->s_root = d_make_root(root_inode);
	if (sb->s_root == NULL) {
	(void) zfs_umount(sb);
	error = SET_ERROR(ENOMEM);
	goto out;
	}

	if (!zfsvfs->z_issnap)
	zfsctl_create(zfsvfs);

	zfsvfs->z_arc_prune = arc_add_prune_callback(zpl_prune_sb, sb);
	out:
	if (error) {
	if (zfsvfs != NULL) {
	dmu_objset_disown(zfsvfs->z_os, B_TRUE, zfsvfs);
	zfsvfs_free(zfsvfs);
	}
	/*
	* make sure we don't have dangling sb->s_fs_info which
	* zfs_preumount will use.
	*/
	sb->s_fs_info = NULL;
	}

	return (error);
	}

	/*
	* Called when an unmount is requested and certain sanity checks have
	* already passed. At this point no dentries or inodes have been reclaimed
	* from their respective caches. We drop the extra reference on the .zfs
	* control directory to allow everything to be reclaimed. All snapshots
	* must already have been unmounted to reach this point.
	*/
	void
	zfs_preumount(struct super_block *sb)
	{
	zfsvfs_t *zfsvfs = sb->s_fs_info;

	/* zfsvfs is NULL when zfs_domount fails during mount */
	if (zfsvfs) {
	zfs_unlinked_drain_stop_wait(zfsvfs);
	zfsctl_destroy(sb->s_fs_info);
	/*
	* Wait for zrele_async before entering evict_inodes in
	* generic_shutdown_super. The reason we must finish before
	* evict_inodes is when lazytime is on, or when zfs_purgedir
	* calls zfs_zget, zrele would bump i_count from 0 to 1. This
	* would race with the i_count check in evict_inodes. This means
	* it could destroy the inode while we are still using it.
	*
	* We wait for two passes. xattr directories in the first pass
	* may add xattr entries in zfs_purgedir, so in the second pass
	* we wait for them. We don't use taskq_wait here because it is
	* a pool wide taskq. Other mounted filesystems can constantly
	* do zrele_async and there's no guarantee when taskq will be
	* empty.
	*/
	taskq_wait_outstanding(dsl_pool_zrele_taskq(
	dmu_objset_pool(zfsvfs->z_os)), 0);
	taskq_wait_outstanding(dsl_pool_zrele_taskq(
	dmu_objset_pool(zfsvfs->z_os)), 0);
	}
	}

	/*
	* Called once all other unmount released tear down has occurred.
	* It is our responsibility to release any remaining infrastructure.
	*/
	/ARGSUSED/
	int
	zfs_umount(struct super_block *sb)
	{
	zfsvfs_t *zfsvfs = sb->s_fs_info;
	objset_t *os;

	if (zfsvfs->z_arc_prune != NULL)
	arc_remove_prune_callback(zfsvfs->z_arc_prune);
	VERIFY(zfsvfs_teardown(zfsvfs, B_TRUE) == 0);
	os = zfsvfs->z_os;
	zpl_bdi_destroy(sb);

	/*
	* z_os will be NULL if there was an error in
	* attempting to reopen zfsvfs.
	*/
	if (os != NULL) {
	/*
	* Unset the objset user_ptr.
	*/
	mutex_enter(&os->os_user_ptr_lock);
	dmu_objset_set_user(os, NULL);
	mutex_exit(&os->os_user_ptr_lock);

	/*
	* Finally release the objset
	*/
	dmu_objset_disown(os, B_TRUE, zfsvfs);
	}

	zfsvfs_free(zfsvfs);
	return (0);
	}

	int
	zfs_remount(struct super_block sb, int flags, zfs_mnt_t *zm)
	{
	zfsvfs_t *zfsvfs = sb->s_fs_info;
	vfs_t *vfsp;
	boolean_t issnap = dmu_objset_is_snapshot(zfsvfs->z_os);
	int error;

	if ((issnap \|\| !spa_writeable(dmu_objset_spa(zfsvfs->z_os))) &&
	!(*flags & SB_RDONLY)) {
	*flags \|= SB_RDONLY;
	return (EROFS);
	}

	error = zfsvfs_parse_options(zm->mnt_data, &vfsp);
	if (error)
	return (error);

	if (!zfs_is_readonly(zfsvfs) && (*flags & SB_RDONLY))
	txg_wait_synced(dmu_objset_pool(zfsvfs->z_os), 0);

	zfs_unregister_callbacks(zfsvfs);
	zfsvfs_vfs_free(zfsvfs->z_vfs);

	vfsp->vfs_data = zfsvfs;
	zfsvfs->z_vfs = vfsp;
	if (!issnap)
	(void) zfs_register_callbacks(vfsp);

	return (error);
	}

	int
	zfs_vget(struct super_block sb, struct inode ipp, fid_t fidp)
	{
	zfsvfs_t *zfsvfs = sb->s_fs_info;
	znode_t *zp;
	uint64_t object = 0;
	uint64_t fid_gen = 0;
	uint64_t gen_mask;
	uint64_t zp_gen;
	int i, err;

	*ipp = NULL;

	if (fidp->fid_len == SHORT_FID_LEN \|\| fidp->fid_len == LONG_FID_LEN) {
	zfid_short_t zfid = (zfid_short_t )fidp;

	for (i = 0; i < sizeof (zfid->zf_object); i++)
	object \|= ((uint64_t)zfid->zf_object[i]) << (8 * i);

	for (i = 0; i < sizeof (zfid->zf_gen); i++)
	fid_gen \|= ((uint64_t)zfid->zf_gen[i]) << (8 * i);
	} else {
	return (SET_ERROR(EINVAL));
	}

	/* LONG_FID_LEN means snapdirs */
	if (fidp->fid_len == LONG_FID_LEN) {
	zfid_long_t zlfid = (zfid_long_t )fidp;
	uint64_t objsetid = 0;
	uint64_t setgen = 0;

	for (i = 0; i < sizeof (zlfid->zf_setid); i++)
	objsetid \|= ((uint64_t)zlfid->zf_setid[i]) << (8 * i);

	for (i = 0; i < sizeof (zlfid->zf_setgen); i++)
	setgen \|= ((uint64_t)zlfid->zf_setgen[i]) << (8 * i);

	if (objsetid != ZFSCTL_INO_SNAPDIRS - object) {
	dprintf("snapdir fid: objsetid (%llu) != "
	"ZFSCTL_INO_SNAPDIRS (%llu) - object (%llu)\n",
	objsetid, ZFSCTL_INO_SNAPDIRS, object);

	return (SET_ERROR(EINVAL));
	}

	if (fid_gen > 1 \|\| setgen != 0) {
	dprintf("snapdir fid: fid_gen (%llu) and setgen "
	"(%llu)\n", fid_gen, setgen);
	return (SET_ERROR(EINVAL));
	}

	return (zfsctl_snapdir_vget(sb, objsetid, fid_gen, ipp));
	}

	ZFS_ENTER(zfsvfs);
	/* A zero fid_gen means we are in the .zfs control directories */
	if (fid_gen == 0 &&
	(object == ZFSCTL_INO_ROOT \|\| object == ZFSCTL_INO_SNAPDIR)) {
	*ipp = zfsvfs->z_ctldir;
	ASSERT(*ipp != NULL);
	if (object == ZFSCTL_INO_SNAPDIR) {
	VERIFY(zfsctl_root_lookup(*ipp, "snapshot", ipp,
	0, kcred, NULL, NULL) == 0);
	} else {
	igrab(*ipp);
	}
	ZFS_EXIT(zfsvfs);
	return (0);
	}

	gen_mask = -1ULL >> (64 - 8 * i);

	dprintf("getting %llu [%llu mask %llx]\n", object, fid_gen, gen_mask);
	if ((err = zfs_zget(zfsvfs, object, &zp))) {
	ZFS_EXIT(zfsvfs);
	return (err);
	}

	/* Don't export xattr stuff */
	if (zp->z_pflags & ZFS_XATTR) {
	zrele(zp);
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(ENOENT));
	}

	(void) sa_lookup(zp->z_sa_hdl, SA_ZPL_GEN(zfsvfs), &zp_gen,
	sizeof (uint64_t));
	zp_gen = zp_gen & gen_mask;
	if (zp_gen == 0)
	zp_gen = 1;
	if ((fid_gen == 0) && (zfsvfs->z_root == object))
	fid_gen = zp_gen;
	if (zp->z_unlinked \|\| zp_gen != fid_gen) {
	dprintf("znode gen (%llu) != fid gen (%llu)\n", zp_gen,
	fid_gen);
	zrele(zp);
	ZFS_EXIT(zfsvfs);
	return (SET_ERROR(ENOENT));
	}

	*ipp = ZTOI(zp);
	if (*ipp)
	zfs_inode_update(ITOZ(*ipp));

	ZFS_EXIT(zfsvfs);
	return (0);
	}

	/*
	* Block out VFS ops and close zfsvfs_t
	*
	* Note, if successful, then we return with the 'z_teardown_lock' and
	* 'z_teardown_inactive_lock' write held. We leave ownership of the underlying
	* dataset and objset intact so that they can be atomically handed off during
	* a subsequent rollback or recv operation and the resume thereafter.
	*/
	int
	zfs_suspend_fs(zfsvfs_t *zfsvfs)
	{
	int error;

	if ((error = zfsvfs_teardown(zfsvfs, B_FALSE)) != 0)
	return (error);

	return (0);
	}

	/*
	* Rebuild SA and release VOPs. Note that ownership of the underlying dataset
	* is an invariant across any of the operations that can be performed while the
	* filesystem was suspended. Whether it succeeded or failed, the preconditions
	* are the same: the relevant objset and associated dataset are owned by
	* zfsvfs, held, and long held on entry.
	*/
	int
	zfs_resume_fs(zfsvfs_t zfsvfs, dsl_dataset_t ds)
	{
	int err, err2;
	znode_t *zp;

	ASSERT(RRM_WRITE_HELD(&zfsvfs->z_teardown_lock));
	ASSERT(RW_WRITE_HELD(&zfsvfs->z_teardown_inactive_lock));

	/*
	* We already own this, so just update the objset_t, as the one we
	* had before may have been evicted.
	*/
	objset_t *os;
	VERIFY3P(ds->ds_owner, ==, zfsvfs);
	VERIFY(dsl_dataset_long_held(ds));
	dsl_pool_t *dp = spa_get_dsl(dsl_dataset_get_spa(ds));
	dsl_pool_config_enter(dp, FTAG);
	VERIFY0(dmu_objset_from_ds(ds, &os));
	dsl_pool_config_exit(dp, FTAG);

	err = zfsvfs_init(zfsvfs, os);
	if (err != 0)
	goto bail;

	ds->ds_dir->dd_activity_cancelled = B_FALSE;
	VERIFY(zfsvfs_setup(zfsvfs, B_FALSE) == 0);

	zfs_set_fuid_feature(zfsvfs);
	zfsvfs->z_rollback_time = jiffies;

	/*
	* Attempt to re-establish all the active inodes with their
	* dbufs. If a zfs_rezget() fails, then we unhash the inode
	* and mark it stale. This prevents a collision if a new
	* inode/object is created which must use the same inode
	* number. The stale inode will be be released when the
	* VFS prunes the dentry holding the remaining references
	* on the stale inode.
	*/
	mutex_enter(&zfsvfs->z_znodes_lock);
	for (zp = list_head(&zfsvfs->z_all_znodes); zp;
	zp = list_next(&zfsvfs->z_all_znodes, zp)) {
	err2 = zfs_rezget(zp);
	if (err2) {
	remove_inode_hash(ZTOI(zp));
	zp->z_is_stale = B_TRUE;
	}

	/* see comment in zfs_suspend_fs() */
	if (zp->z_suspended) {
	zfs_zrele_async(zp);
	zp->z_suspended = B_FALSE;
	}
	}
	mutex_exit(&zfsvfs->z_znodes_lock);

	if (!zfs_is_readonly(zfsvfs) && !zfsvfs->z_unmounted) {
	/*
	* zfs_suspend_fs() could have interrupted freeing
	* of dnodes. We need to restart this freeing so
	* that we don't "leak" the space.
	*/
	zfs_unlinked_drain(zfsvfs);
	}

	/*
	* Most of the time zfs_suspend_fs is used for changing the contents
	* of the underlying dataset. ZFS rollback and receive operations
	* might create files for which negative dentries are present in
	* the cache. Since walking the dcache would require a lot of GPL-only
	* code duplication, it's much easier on these rather rare occasions
	* just to flush the whole dcache for the given dataset/filesystem.
	*/
	shrink_dcache_sb(zfsvfs->z_sb);

	bail:
	if (err != 0)
	zfsvfs->z_unmounted = B_TRUE;

	/* release the VFS ops */
	rw_exit(&zfsvfs->z_teardown_inactive_lock);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);

	if (err != 0) {
	/*
	* Since we couldn't setup the sa framework, try to force
	* unmount this file system.
	*/
	if (zfsvfs->z_os)
	(void) zfs_umount(zfsvfs->z_sb);
	}
	return (err);
	}

	/*
	* Release VOPs and unmount a suspended filesystem.
	*/
	int
	zfs_end_fs(zfsvfs_t zfsvfs, dsl_dataset_t ds)
	{
	ASSERT(RRM_WRITE_HELD(&zfsvfs->z_teardown_lock));
	ASSERT(RW_WRITE_HELD(&zfsvfs->z_teardown_inactive_lock));

	/*
	* We already own this, so just hold and rele it to update the
	* objset_t, as the one we had before may have been evicted.
	*/
	objset_t *os;
	VERIFY3P(ds->ds_owner, ==, zfsvfs);
	VERIFY(dsl_dataset_long_held(ds));
	dsl_pool_t *dp = spa_get_dsl(dsl_dataset_get_spa(ds));
	dsl_pool_config_enter(dp, FTAG);
	VERIFY0(dmu_objset_from_ds(ds, &os));
	dsl_pool_config_exit(dp, FTAG);
	zfsvfs->z_os = os;

	/* release the VOPs */
	rw_exit(&zfsvfs->z_teardown_inactive_lock);
	rrm_exit(&zfsvfs->z_teardown_lock, FTAG);

	/*
	* Try to force unmount this file system.
	*/
	(void) zfs_umount(zfsvfs->z_sb);
	zfsvfs->z_unmounted = B_TRUE;
	return (0);
	}

	/*
	* Automounted snapshots rely on periodic revalidation
	* to defer snapshots from being automatically unmounted.
	*/

	inline void
	zfs_exit_fs(zfsvfs_t *zfsvfs)
	{
	if (!zfsvfs->z_issnap)
	return;

	if (time_after(jiffies, zfsvfs->z_snap_defer_time +
	MAX(zfs_expire_snapshot * HZ / 2, HZ))) {
	zfsvfs->z_snap_defer_time = jiffies;
	zfsctl_snapshot_unmount_delay(zfsvfs->z_os->os_spa,
	dmu_objset_id(zfsvfs->z_os),
	zfs_expire_snapshot);
	}
	}

	int
	zfs_set_version(zfsvfs_t *zfsvfs, uint64_t newvers)
	{
	int error;
	objset_t *os = zfsvfs->z_os;
	dmu_tx_t *tx;

	if (newvers < ZPL_VERSION_INITIAL \|\| newvers > ZPL_VERSION)
	return (SET_ERROR(EINVAL));

	if (newvers < zfsvfs->z_version)
	return (SET_ERROR(EINVAL));

	if (zfs_spa_version_map(newvers) >
	spa_version(dmu_objset_spa(zfsvfs->z_os)))
	return (SET_ERROR(ENOTSUP));

	tx = dmu_tx_create(os);
	dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, B_FALSE, ZPL_VERSION_STR);
	if (newvers >= ZPL_VERSION_SA && !zfsvfs->z_use_sa) {
	dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, B_TRUE,
	ZFS_SA_ATTRS);
	dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
	}
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error) {
	dmu_tx_abort(tx);
	return (error);
	}

	error = zap_update(os, MASTER_NODE_OBJ, ZPL_VERSION_STR,
	8, 1, &newvers, tx);

	if (error) {
	dmu_tx_commit(tx);
	return (error);
	}

	if (newvers >= ZPL_VERSION_SA && !zfsvfs->z_use_sa) {
	uint64_t sa_obj;

	ASSERT3U(spa_version(dmu_objset_spa(zfsvfs->z_os)), >=,
	SPA_VERSION_SA);
	sa_obj = zap_create(os, DMU_OT_SA_MASTER_NODE,
	DMU_OT_NONE, 0, tx);

	error = zap_add(os, MASTER_NODE_OBJ,
	ZFS_SA_ATTRS, 8, 1, &sa_obj, tx);
	ASSERT0(error);

	VERIFY(0 == sa_set_sa_object(os, sa_obj));
	sa_register_update_callback(os, zfs_sa_upgrade);
	}

	spa_history_log_internal_ds(dmu_objset_ds(os), "upgrade", tx,
	"from %llu to %llu", zfsvfs->z_version, newvers);

	dmu_tx_commit(tx);

	zfsvfs->z_version = newvers;
	os->os_version = newvers;

	zfs_set_fuid_feature(zfsvfs);

	return (0);
	}

	/*
	* Read a property stored within the master node.
	*/
	int
	zfs_get_zplprop(objset_t os, zfs_prop_t prop, uint64_t value)
	{
	uint64_t *cached_copy = NULL;

	/*
	* Figure out where in the objset_t the cached copy would live, if it
	* is available for the requested property.
	*/
	if (os != NULL) {
	switch (prop) {
	case ZFS_PROP_VERSION:
	cached_copy = &os->os_version;
	break;
	case ZFS_PROP_NORMALIZE:
	cached_copy = &os->os_normalization;
	break;
	case ZFS_PROP_UTF8ONLY:
	cached_copy = &os->os_utf8only;
	break;
	case ZFS_PROP_CASE:
	cached_copy = &os->os_casesensitivity;
	break;
	default:
	break;
	}
	}
	if (cached_copy != NULL && *cached_copy != OBJSET_PROP_UNINITIALIZED) {
	value = cached_copy;
	return (0);
	}

	/*
	* If the property wasn't cached, look up the file system's value for
	* the property. For the version property, we look up a slightly
	* different string.
	*/
	const char *pname;
	int error = ENOENT;
	if (prop == ZFS_PROP_VERSION)
	pname = ZPL_VERSION_STR;
	else
	pname = zfs_prop_to_name(prop);

	if (os != NULL) {
	ASSERT3U(os->os_phys->os_type, ==, DMU_OST_ZFS);
	error = zap_lookup(os, MASTER_NODE_OBJ, pname, 8, 1, value);
	}

	if (error == ENOENT) {
	/* No value set, use the default value */
	switch (prop) {
	case ZFS_PROP_VERSION:
	*value = ZPL_VERSION;
	break;
	case ZFS_PROP_NORMALIZE:
	case ZFS_PROP_UTF8ONLY:
	*value = 0;
	break;
	case ZFS_PROP_CASE:
	*value = ZFS_CASE_SENSITIVE;
	break;
	case ZFS_PROP_ACLTYPE:
	*value = ZFS_ACLTYPE_OFF;
	break;
	default:
	return (error);
	}
	error = 0;
	}

	/*
	* If one of the methods for getting the property value above worked,
	* copy it into the objset_t's cache.
	*/
	if (error == 0 && cached_copy != NULL) {
	cached_copy = value;
	}

	return (error);
	}

	/*
	* Return true if the corresponding vfs's unmounted flag is set.
	* Otherwise return false.
	* If this function returns true we know VFS unmount has been initiated.
	*/
	boolean_t
	zfs_get_vfs_flag_unmounted(objset_t *os)
	{
	zfsvfs_t *zfvp;
	boolean_t unmounted = B_FALSE;

	ASSERT(dmu_objset_type(os) == DMU_OST_ZFS);

	mutex_enter(&os->os_user_ptr_lock);
	zfvp = dmu_objset_get_user(os);
	if (zfvp != NULL && zfvp->z_unmounted)
	unmounted = B_TRUE;
	mutex_exit(&os->os_user_ptr_lock);

	return (unmounted);
	}

	/ARGSUSED/
	void
	zfsvfs_update_fromname(const char oldname, const char newname)
	{
	/*
	* We don't need to do anything here, the devname is always current by
	* virtue of zfsvfs->z_sb->s_op->show_devname.
	*/
	}

	void
	zfs_init(void)
	{
	zfsctl_init();
	zfs_znode_init();
	dmu_objset_register_type(DMU_OST_ZFS, zpl_get_file_info);
	register_filesystem(&zpl_fs_type);
	}

	void
	zfs_fini(void)
	{
	/*
	* we don't use outstanding because zpl_posix_acl_free might add more.
	*/
	taskq_wait(system_delay_taskq);
	taskq_wait(system_taskq);
	unregister_filesystem(&zpl_fs_type);
	zfs_znode_fini();
	zfsctl_fini();
	}

	#if defined(_KERNEL)
	EXPORT_SYMBOL(zfs_suspend_fs);
	EXPORT_SYMBOL(zfs_resume_fs);
	EXPORT_SYMBOL(zfs_set_version);
	EXPORT_SYMBOL(zfsvfs_create);
	EXPORT_SYMBOL(zfsvfs_free);
	EXPORT_SYMBOL(zfs_is_readonly);
	EXPORT_SYMBOL(zfs_domount);
	EXPORT_SYMBOL(zfs_preumount);
	EXPORT_SYMBOL(zfs_umount);
	EXPORT_SYMBOL(zfs_remount);
	EXPORT_SYMBOL(zfs_statvfs);
	EXPORT_SYMBOL(zfs_vget);
	EXPORT_SYMBOL(zfs_prune);
	#endif
	Index: vendor-sys/openzfs/dist/module/os/linux/zfs/zpl_super.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/linux/zfs/zpl_super.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/linux/zfs/zpl_super.c (revision 365892)
	@@ -1,346 +1,352 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2011, Lawrence Livermore National Security, LLC.
	*/


	#include <sys/zfs_znode.h>
	#include <sys/zfs_vfsops.h>
	#include <sys/zfs_vnops.h>
	#include <sys/zfs_ctldir.h>
	#include <sys/zpl.h>


	static struct inode *
	zpl_inode_alloc(struct super_block *sb)
	{
	struct inode *ip;

	VERIFY3S(zfs_inode_alloc(sb, &ip), ==, 0);
	inode_set_iversion(ip, 1);

	return (ip);
	}

	static void
	zpl_inode_destroy(struct inode *ip)
	{
	ASSERT(atomic_read(&ip->i_count) == 0);
	zfs_inode_destroy(ip);
	}

	/*
	* Called from __mark_inode_dirty() to reflect that something in the
	* inode has changed. We use it to ensure the znode system attributes
	* are always strictly update to date with respect to the inode.
	*/
	#ifdef HAVE_DIRTY_INODE_WITH_FLAGS
	static void
	zpl_dirty_inode(struct inode *ip, int flags)
	{
	fstrans_cookie_t cookie;

	cookie = spl_fstrans_mark();
	zfs_dirty_inode(ip, flags);
	spl_fstrans_unmark(cookie);
	}
	#else
	static void
	zpl_dirty_inode(struct inode *ip)
	{
	fstrans_cookie_t cookie;

	cookie = spl_fstrans_mark();
	zfs_dirty_inode(ip, 0);
	spl_fstrans_unmark(cookie);
	}
	#endif /* HAVE_DIRTY_INODE_WITH_FLAGS */

	/*
	* When ->drop_inode() is called its return value indicates if the
	* inode should be evicted from the inode cache. If the inode is
	* unhashed and has no links the default policy is to evict it
	* immediately.
	*
	* The ->evict_inode() callback must minimally truncate the inode pages,
	* and call clear_inode(). For 2.6.35 and later kernels this will
	* simply update the inode state, with the sync occurring before the
	* truncate in evict(). For earlier kernels clear_inode() maps to
	* end_writeback() which is responsible for completing all outstanding
	* write back. In either case, once this is done it is safe to cleanup
	* any remaining inode specific data via zfs_inactive().
	* remaining filesystem specific data.
	*/
	static void
	zpl_evict_inode(struct inode *ip)
	{
	fstrans_cookie_t cookie;

	cookie = spl_fstrans_mark();
	truncate_setsize(ip, 0);
	clear_inode(ip);
	zfs_inactive(ip);
	spl_fstrans_unmark(cookie);
	}

	static void
	zpl_put_super(struct super_block *sb)
	{
	fstrans_cookie_t cookie;
	int error;

	cookie = spl_fstrans_mark();
	error = -zfs_umount(sb);
	spl_fstrans_unmark(cookie);
	ASSERT3S(error, <=, 0);
	}

	static int
	zpl_sync_fs(struct super_block *sb, int wait)
	{
	fstrans_cookie_t cookie;
	cred_t *cr = CRED();
	int error;

	crhold(cr);
	cookie = spl_fstrans_mark();
	error = -zfs_sync(sb, wait, cr);
	spl_fstrans_unmark(cookie);
	crfree(cr);
	ASSERT3S(error, <=, 0);

	return (error);
	}

	static int
	zpl_statfs(struct dentry dentry, struct kstatfs statp)
	{
	fstrans_cookie_t cookie;
	int error;

	cookie = spl_fstrans_mark();
	error = -zfs_statvfs(dentry->d_inode, statp);
	spl_fstrans_unmark(cookie);
	ASSERT3S(error, <=, 0);

	/*
	* If required by a 32-bit system call, dynamically scale the
	* block size up to 16MiB and decrease the block counts. This
	* allows for a maximum size of 64EiB to be reported. The file
	* counts must be artificially capped at 2^32-1.
	*/
	if (unlikely(zpl_is_32bit_api())) {
	while (statp->f_blocks > UINT32_MAX &&
	statp->f_bsize < SPA_MAXBLOCKSIZE) {
	statp->f_frsize <<= 1;
	statp->f_bsize <<= 1;

	statp->f_blocks >>= 1;
	statp->f_bfree >>= 1;
	statp->f_bavail >>= 1;
	}

	uint64_t usedobjs = statp->f_files - statp->f_ffree;
	statp->f_ffree = MIN(statp->f_ffree, UINT32_MAX - usedobjs);
	statp->f_files = statp->f_ffree + usedobjs;
	}

	return (error);
	}

	static int
	zpl_remount_fs(struct super_block sb, int flags, char *data)
	{
	zfs_mnt_t zm = { .mnt_osname = NULL, .mnt_data = data };
	fstrans_cookie_t cookie;
	int error;

	cookie = spl_fstrans_mark();
	error = -zfs_remount(sb, flags, &zm);
	spl_fstrans_unmark(cookie);
	ASSERT3S(error, <=, 0);

	return (error);
	}

	static int
	__zpl_show_devname(struct seq_file seq, zfsvfs_t zfsvfs)
	{
	char *fsname;

	+ ZFS_ENTER(zfsvfs);
	fsname = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP);
	dmu_objset_name(zfsvfs->z_os, fsname);
	seq_puts(seq, fsname);
	kmem_free(fsname, ZFS_MAX_DATASET_NAME_LEN);
	+ ZFS_EXIT(zfsvfs);

	return (0);
	}

	static int
	zpl_show_devname(struct seq_file seq, struct dentry root)
	{
	return (__zpl_show_devname(seq, root->d_sb->s_fs_info));
	}

	static int
	__zpl_show_options(struct seq_file seq, zfsvfs_t zfsvfs)
	{
	seq_printf(seq, ",%s",
	zfsvfs->z_flags & ZSB_XATTR ? "xattr" : "noxattr");

	#ifdef CONFIG_FS_POSIX_ACL
	switch (zfsvfs->z_acl_type) {
	- case ZFS_ACLTYPE_POSIXACL:
	+ case ZFS_ACLTYPE_POSIX:
	seq_puts(seq, ",posixacl");
	break;
	default:
	seq_puts(seq, ",noacl");
	break;
	}
	#endif /* CONFIG_FS_POSIX_ACL */

	return (0);
	}

	static int
	zpl_show_options(struct seq_file seq, struct dentry root)
	{
	return (__zpl_show_options(seq, root->d_sb->s_fs_info));
	}

	static int
	zpl_fill_super(struct super_block sb, void data, int silent)
	{
	zfs_mnt_t zm = (zfs_mnt_t )data;
	fstrans_cookie_t cookie;
	int error;

	cookie = spl_fstrans_mark();
	error = -zfs_domount(sb, zm, silent);
	spl_fstrans_unmark(cookie);
	ASSERT3S(error, <=, 0);

	return (error);
	}

	static int
	zpl_test_super(struct super_block s, void data)
	{
	zfsvfs_t *zfsvfs = s->s_fs_info;
	objset_t *os = data;

	if (zfsvfs == NULL)
	return (0);

	return (os == zfsvfs->z_os);
	}

	static struct super_block *
	zpl_mount_impl(struct file_system_type fs_type, int flags, zfs_mnt_t zm)
	{
	struct super_block *s;
	objset_t *os;
	int err;

	err = dmu_objset_hold(zm->mnt_osname, FTAG, &os);
	if (err)
	return (ERR_PTR(-err));

	/*
	* The dsl pool lock must be released prior to calling sget().
	* It is possible sget() may block on the lock in grab_super()
	* while deactivate_super() holds that same lock and waits for
	* a txg sync. If the dsl_pool lock is held over sget()
	* this can prevent the pool sync and cause a deadlock.
	*/
	+ dsl_dataset_long_hold(dmu_objset_ds(os), FTAG);
	dsl_pool_rele(dmu_objset_pool(os), FTAG);
	+
	s = sget(fs_type, zpl_test_super, set_anon_super, flags, os);
	+
	+ dsl_dataset_long_rele(dmu_objset_ds(os), FTAG);
	dsl_dataset_rele(dmu_objset_ds(os), FTAG);

	if (IS_ERR(s))
	return (ERR_CAST(s));

	if (s->s_root == NULL) {
	err = zpl_fill_super(s, zm, flags & SB_SILENT ? 1 : 0);
	if (err) {
	deactivate_locked_super(s);
	return (ERR_PTR(err));
	}
	s->s_flags \|= SB_ACTIVE;
	} else if ((flags ^ s->s_flags) & SB_RDONLY) {
	deactivate_locked_super(s);
	return (ERR_PTR(-EBUSY));
	}

	return (s);
	}

	static struct dentry *
	zpl_mount(struct file_system_type *fs_type, int flags,
	const char osname, void data)
	{
	zfs_mnt_t zm = { .mnt_osname = osname, .mnt_data = data };

	struct super_block *sb = zpl_mount_impl(fs_type, flags, &zm);
	if (IS_ERR(sb))
	return (ERR_CAST(sb));

	return (dget(sb->s_root));
	}

	static void
	zpl_kill_sb(struct super_block *sb)
	{
	zfs_preumount(sb);
	kill_anon_super(sb);
	}

	void
	zpl_prune_sb(int64_t nr_to_scan, void *arg)
	{
	struct super_block sb = (struct super_block )arg;
	int objects = 0;

	(void) -zfs_prune(sb, nr_to_scan, &objects);
	}

	const struct super_operations zpl_super_operations = {
	.alloc_inode = zpl_inode_alloc,
	.destroy_inode = zpl_inode_destroy,
	.dirty_inode = zpl_dirty_inode,
	.write_inode = NULL,
	.evict_inode = zpl_evict_inode,
	.put_super = zpl_put_super,
	.sync_fs = zpl_sync_fs,
	.statfs = zpl_statfs,
	.remount_fs = zpl_remount_fs,
	.show_devname = zpl_show_devname,
	.show_options = zpl_show_options,
	.show_stats = NULL,
	};

	struct file_system_type zpl_fs_type = {
	.owner = THIS_MODULE,
	.name = ZFS_DRIVER,
	.mount = zpl_mount,
	.kill_sb = zpl_kill_sb,
	};
	Index: vendor-sys/openzfs/dist/module/os/linux/zfs/zpl_xattr.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/os/linux/zfs/zpl_xattr.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/os/linux/zfs/zpl_xattr.c (revision 365892)
	@@ -1,1480 +1,1480 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2011, Lawrence Livermore National Security, LLC.
	*
	* Extended attributes (xattr) on Solaris are implemented as files
	* which exist in a hidden xattr directory. These extended attributes
	* can be accessed using the attropen() system call which opens
	* the extended attribute. It can then be manipulated just like
	* a standard file descriptor. This has a couple advantages such
	* as practically no size limit on the file, and the extended
	* attributes permissions may differ from those of the parent file.
	* This interface is really quite clever, but it's also completely
	* different than what is supported on Linux. It also comes with a
	* steep performance penalty when accessing small xattrs because they
	* are not stored with the parent file.
	*
	* Under Linux extended attributes are manipulated by the system
	* calls getxattr(2), setxattr(2), and listxattr(2). They consider
	* extended attributes to be name/value pairs where the name is a
	* NULL terminated string. The name must also include one of the
	* following namespace prefixes:
	*
	* user - No restrictions and is available to user applications.
	* trusted - Restricted to kernel and root (CAP_SYS_ADMIN) use.
	* system - Used for access control lists (system.nfs4_acl, etc).
	* security - Used by SELinux to store a files security context.
	*
	* The value under Linux to limited to 65536 bytes of binary data.
	* In practice, individual xattrs tend to be much smaller than this
	* and are typically less than 100 bytes. A good example of this
	* are the security.selinux xattrs which are less than 100 bytes and
	* exist for every file when xattr labeling is enabled.
	*
	* The Linux xattr implementation has been written to take advantage of
	* this typical usage. When the dataset property 'xattr=sa' is set,
	* then xattrs will be preferentially stored as System Attributes (SA).
	* This allows tiny xattrs (~100 bytes) to be stored with the dnode and
	* up to 64k of xattrs to be stored in the spill block. If additional
	* xattr space is required, which is unlikely under Linux, they will
	* be stored using the traditional directory approach.
	*
	* This optimization results in roughly a 3x performance improvement
	* when accessing xattrs because it avoids the need to perform a seek
	* for every xattr value. When multiple xattrs are stored per-file
	* the performance improvements are even greater because all of the
	* xattrs stored in the spill block will be cached.
	*
	* However, by default SA based xattrs are disabled in the Linux port
	* to maximize compatibility with other implementations. If you do
	* enable SA based xattrs then they will not be visible on platforms
	* which do not support this feature.
	*
	* NOTE: One additional consequence of the xattr directory implementation
	* is that when an extended attribute is manipulated an inode is created.
	* This inode will exist in the Linux inode cache but there will be no
	* associated entry in the dentry cache which references it. This is
	* safe but it may result in some confusion. Enabling SA based xattrs
	* largely avoids the issue except in the overflow case.
	*/

	#include <sys/zfs_znode.h>
	#include <sys/zfs_vfsops.h>
	#include <sys/zfs_vnops.h>
	#include <sys/zap.h>
	#include <sys/vfs.h>
	#include <sys/zpl.h>

	typedef struct xattr_filldir {
	size_t size;
	size_t offset;
	char *buf;
	struct dentry *dentry;
	} xattr_filldir_t;

	static const struct xattr_handler zpl_xattr_handler(const char );

	static int
	zpl_xattr_permission(xattr_filldir_t xf, const char name, int name_len)
	{
	static const struct xattr_handler *handler;
	struct dentry *d = xf->dentry;

	handler = zpl_xattr_handler(name);
	if (!handler)
	return (0);

	if (handler->list) {
	#if defined(HAVE_XATTR_LIST_SIMPLE)
	if (!handler->list(d))
	return (0);
	#elif defined(HAVE_XATTR_LIST_DENTRY)
	if (!handler->list(d, NULL, 0, name, name_len, 0))
	return (0);
	#elif defined(HAVE_XATTR_LIST_HANDLER)
	if (!handler->list(handler, d, NULL, 0, name, name_len))
	return (0);
	#endif
	}

	return (1);
	}

	/*
	* Determine is a given xattr name should be visible and if so copy it
	* in to the provided buffer (xf->buf).
	*/
	static int
	zpl_xattr_filldir(xattr_filldir_t xf, const char name, int name_len)
	{
	/* Check permissions using the per-namespace list xattr handler. */
	if (!zpl_xattr_permission(xf, name, name_len))
	return (0);

	/* When xf->buf is NULL only calculate the required size. */
	if (xf->buf) {
	if (xf->offset + name_len + 1 > xf->size)
	return (-ERANGE);

	memcpy(xf->buf + xf->offset, name, name_len);
	xf->buf[xf->offset + name_len] = '\0';
	}

	xf->offset += (name_len + 1);

	return (0);
	}

	/*
	* Read as many directory entry names as will fit in to the provided buffer,
	* or when no buffer is provided calculate the required buffer size.
	*/
	static int
	zpl_xattr_readdir(struct inode dxip, xattr_filldir_t xf)
	{
	zap_cursor_t zc;
	zap_attribute_t zap;
	int error;

	zap_cursor_init(&zc, ITOZSB(dxip)->z_os, ITOZ(dxip)->z_id);

	while ((error = -zap_cursor_retrieve(&zc, &zap)) == 0) {

	if (zap.za_integer_length != 8 \|\| zap.za_num_integers != 1) {
	error = -ENXIO;
	break;
	}

	error = zpl_xattr_filldir(xf, zap.za_name, strlen(zap.za_name));
	if (error)
	break;

	zap_cursor_advance(&zc);
	}

	zap_cursor_fini(&zc);

	if (error == -ENOENT)
	error = 0;

	return (error);
	}

	static ssize_t
	zpl_xattr_list_dir(xattr_filldir_t xf, cred_t cr)
	{
	struct inode *ip = xf->dentry->d_inode;
	struct inode *dxip = NULL;
	znode_t *dxzp;
	int error;

	/* Lookup the xattr directory */
	error = -zfs_lookup(ITOZ(ip), NULL, &dxzp, LOOKUP_XATTR,
	cr, NULL, NULL);
	if (error) {
	if (error == -ENOENT)
	error = 0;

	return (error);
	}

	dxip = ZTOI(dxzp);
	error = zpl_xattr_readdir(dxip, xf);
	iput(dxip);

	return (error);
	}

	static ssize_t
	zpl_xattr_list_sa(xattr_filldir_t *xf)
	{
	znode_t *zp = ITOZ(xf->dentry->d_inode);
	nvpair_t *nvp = NULL;
	int error = 0;

	mutex_enter(&zp->z_lock);
	if (zp->z_xattr_cached == NULL)
	error = -zfs_sa_get_xattr(zp);
	mutex_exit(&zp->z_lock);

	if (error)
	return (error);

	ASSERT(zp->z_xattr_cached);

	while ((nvp = nvlist_next_nvpair(zp->z_xattr_cached, nvp)) != NULL) {
	ASSERT3U(nvpair_type(nvp), ==, DATA_TYPE_BYTE_ARRAY);

	error = zpl_xattr_filldir(xf, nvpair_name(nvp),
	strlen(nvpair_name(nvp)));
	if (error)
	return (error);
	}

	return (0);
	}

	ssize_t
	zpl_xattr_list(struct dentry dentry, char buffer, size_t buffer_size)
	{
	znode_t *zp = ITOZ(dentry->d_inode);
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	xattr_filldir_t xf = { buffer_size, 0, buffer, dentry };
	cred_t *cr = CRED();
	fstrans_cookie_t cookie;
	int error = 0;

	crhold(cr);
	cookie = spl_fstrans_mark();
	ZPL_ENTER(zfsvfs);
	ZPL_VERIFY_ZP(zp);
	rw_enter(&zp->z_xattr_lock, RW_READER);

	if (zfsvfs->z_use_sa && zp->z_is_sa) {
	error = zpl_xattr_list_sa(&xf);
	if (error)
	goto out;
	}

	error = zpl_xattr_list_dir(&xf, cr);
	if (error)
	goto out;

	error = xf.offset;
	out:

	rw_exit(&zp->z_xattr_lock);
	ZPL_EXIT(zfsvfs);
	spl_fstrans_unmark(cookie);
	crfree(cr);

	return (error);
	}

	static int
	zpl_xattr_get_dir(struct inode ip, const char name, void *value,
	size_t size, cred_t *cr)
	{
	struct inode *xip = NULL;
	znode_t *dxzp = NULL;
	znode_t *xzp = NULL;
	loff_t pos = 0;
	int error;

	/* Lookup the xattr directory */
	error = -zfs_lookup(ITOZ(ip), NULL, &dxzp, LOOKUP_XATTR,
	cr, NULL, NULL);
	if (error)
	goto out;

	/* Lookup a specific xattr name in the directory */
	error = -zfs_lookup(dxzp, (char *)name, &xzp, 0, cr, NULL, NULL);
	if (error)
	goto out;

	xip = ZTOI(xzp);
	if (!size) {
	error = i_size_read(xip);
	goto out;
	}

	if (size < i_size_read(xip)) {
	error = -ERANGE;
	goto out;
	}

	error = zpl_read_common(xip, value, size, &pos, UIO_SYSSPACE, 0, cr);
	out:
	if (xzp)
	zrele(xzp);

	if (dxzp)
	zrele(dxzp);

	return (error);
	}

	static int
	zpl_xattr_get_sa(struct inode ip, const char name, void *value, size_t size)
	{
	znode_t *zp = ITOZ(ip);
	uchar_t *nv_value;
	uint_t nv_size;
	int error = 0;

	ASSERT(RW_LOCK_HELD(&zp->z_xattr_lock));

	mutex_enter(&zp->z_lock);
	if (zp->z_xattr_cached == NULL)
	error = -zfs_sa_get_xattr(zp);
	mutex_exit(&zp->z_lock);

	if (error)
	return (error);

	ASSERT(zp->z_xattr_cached);
	error = -nvlist_lookup_byte_array(zp->z_xattr_cached, name,
	&nv_value, &nv_size);
	if (error)
	return (error);

	if (size == 0 \|\| value == NULL)
	return (nv_size);

	if (size < nv_size)
	return (-ERANGE);

	memcpy(value, nv_value, nv_size);

	return (nv_size);
	}

	static int
	__zpl_xattr_get(struct inode ip, const char name, void *value, size_t size,
	cred_t *cr)
	{
	znode_t *zp = ITOZ(ip);
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	int error;

	ASSERT(RW_LOCK_HELD(&zp->z_xattr_lock));

	if (zfsvfs->z_use_sa && zp->z_is_sa) {
	error = zpl_xattr_get_sa(ip, name, value, size);
	if (error != -ENOENT)
	goto out;
	}

	error = zpl_xattr_get_dir(ip, name, value, size, cr);
	out:
	if (error == -ENOENT)
	error = -ENODATA;

	return (error);
	}

	#define XATTR_NOENT 0x0
	#define XATTR_IN_SA 0x1
	#define XATTR_IN_DIR 0x2
	/* check where the xattr resides */
	static int
	__zpl_xattr_where(struct inode ip, const char name, int where, cred_t cr)
	{
	znode_t *zp = ITOZ(ip);
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	int error;

	ASSERT(where);
	ASSERT(RW_LOCK_HELD(&zp->z_xattr_lock));

	*where = XATTR_NOENT;
	if (zfsvfs->z_use_sa && zp->z_is_sa) {
	error = zpl_xattr_get_sa(ip, name, NULL, 0);
	if (error >= 0)
	*where \|= XATTR_IN_SA;
	else if (error != -ENOENT)
	return (error);
	}

	error = zpl_xattr_get_dir(ip, name, NULL, 0, cr);
	if (error >= 0)
	*where \|= XATTR_IN_DIR;
	else if (error != -ENOENT)
	return (error);

	if (*where == (XATTR_IN_SA\|XATTR_IN_DIR))
	cmn_err(CE_WARN, "ZFS: inode %p has xattr \"%s\""
	" in both SA and dir", ip, name);
	if (*where == XATTR_NOENT)
	error = -ENODATA;
	else
	error = 0;
	return (error);
	}

	static int
	zpl_xattr_get(struct inode ip, const char name, void *value, size_t size)
	{
	znode_t *zp = ITOZ(ip);
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	cred_t *cr = CRED();
	fstrans_cookie_t cookie;
	int error;

	crhold(cr);
	cookie = spl_fstrans_mark();
	ZPL_ENTER(zfsvfs);
	ZPL_VERIFY_ZP(zp);
	rw_enter(&zp->z_xattr_lock, RW_READER);
	error = __zpl_xattr_get(ip, name, value, size, cr);
	rw_exit(&zp->z_xattr_lock);
	ZPL_EXIT(zfsvfs);
	spl_fstrans_unmark(cookie);
	crfree(cr);

	return (error);
	}

	static int
	zpl_xattr_set_dir(struct inode ip, const char name, const void *value,
	size_t size, int flags, cred_t *cr)
	{
	znode_t *dxzp = NULL;
	znode_t *xzp = NULL;
	vattr_t *vap = NULL;
	ssize_t wrote;
	int lookup_flags, error;
	const int xattr_mode = S_IFREG \| 0644;
	loff_t pos = 0;

	/*
	* Lookup the xattr directory. When we're adding an entry pass
	* CREATE_XATTR_DIR to ensure the xattr directory is created.
	* When removing an entry this flag is not passed to avoid
	* unnecessarily creating a new xattr directory.
	*/
	lookup_flags = LOOKUP_XATTR;
	if (value != NULL)
	lookup_flags \|= CREATE_XATTR_DIR;

	error = -zfs_lookup(ITOZ(ip), NULL, &dxzp, lookup_flags,
	cr, NULL, NULL);
	if (error)
	goto out;

	/* Lookup a specific xattr name in the directory */
	error = -zfs_lookup(dxzp, (char *)name, &xzp, 0, cr, NULL, NULL);
	if (error && (error != -ENOENT))
	goto out;

	error = 0;

	/* Remove a specific name xattr when value is set to NULL. */
	if (value == NULL) {
	if (xzp)
	error = -zfs_remove(dxzp, (char *)name, cr, 0);

	goto out;
	}

	/* Lookup failed create a new xattr. */
	if (xzp == NULL) {
	vap = kmem_zalloc(sizeof (vattr_t), KM_SLEEP);
	vap->va_mode = xattr_mode;
	vap->va_mask = ATTR_MODE;
	vap->va_uid = crgetfsuid(cr);
	vap->va_gid = crgetfsgid(cr);

	error = -zfs_create(dxzp, (char *)name, vap, 0, 0644, &xzp,
	cr, 0, NULL);
	if (error)
	goto out;
	}

	ASSERT(xzp != NULL);

	error = -zfs_freesp(xzp, 0, 0, xattr_mode, TRUE);
	if (error)
	goto out;

	wrote = zpl_write_common(ZTOI(xzp), value, size, &pos,
	UIO_SYSSPACE, 0, cr);
	if (wrote < 0)
	error = wrote;

	out:

	if (error == 0) {
	ip->i_ctime = current_time(ip);
	zfs_mark_inode_dirty(ip);
	}

	if (vap)
	kmem_free(vap, sizeof (vattr_t));

	if (xzp)
	zrele(xzp);

	if (dxzp)
	zrele(dxzp);

	if (error == -ENOENT)
	error = -ENODATA;

	ASSERT3S(error, <=, 0);

	return (error);
	}

	static int
	zpl_xattr_set_sa(struct inode ip, const char name, const void *value,
	size_t size, int flags, cred_t *cr)
	{
	znode_t *zp = ITOZ(ip);
	nvlist_t *nvl;
	size_t sa_size;
	int error = 0;

	mutex_enter(&zp->z_lock);
	if (zp->z_xattr_cached == NULL)
	error = -zfs_sa_get_xattr(zp);
	mutex_exit(&zp->z_lock);

	if (error)
	return (error);

	ASSERT(zp->z_xattr_cached);
	nvl = zp->z_xattr_cached;

	if (value == NULL) {
	error = -nvlist_remove(nvl, name, DATA_TYPE_BYTE_ARRAY);
	if (error == -ENOENT)
	error = zpl_xattr_set_dir(ip, name, NULL, 0, flags, cr);
	} else {
	/* Limited to 32k to keep nvpair memory allocations small */
	if (size > DXATTR_MAX_ENTRY_SIZE)
	return (-EFBIG);

	/* Prevent the DXATTR SA from consuming the entire SA region */
	error = -nvlist_size(nvl, &sa_size, NV_ENCODE_XDR);
	if (error)
	return (error);

	if (sa_size > DXATTR_MAX_SA_SIZE)
	return (-EFBIG);

	error = -nvlist_add_byte_array(nvl, name,
	(uchar_t *)value, size);
	}

	/*
	* Update the SA for additions, modifications, and removals. On
	* error drop the inconsistent cached version of the nvlist, it
	* will be reconstructed from the ARC when next accessed.
	*/
	if (error == 0)
	error = -zfs_sa_set_xattr(zp);

	if (error) {
	nvlist_free(nvl);
	zp->z_xattr_cached = NULL;
	}

	ASSERT3S(error, <=, 0);

	return (error);
	}

	static int
	zpl_xattr_set(struct inode ip, const char name, const void *value,
	size_t size, int flags)
	{
	znode_t *zp = ITOZ(ip);
	zfsvfs_t *zfsvfs = ZTOZSB(zp);
	cred_t *cr = CRED();
	fstrans_cookie_t cookie;
	int where;
	int error;

	crhold(cr);
	cookie = spl_fstrans_mark();
	ZPL_ENTER(zfsvfs);
	ZPL_VERIFY_ZP(zp);
	rw_enter(&ITOZ(ip)->z_xattr_lock, RW_WRITER);

	/*
	* Before setting the xattr check to see if it already exists.
	* This is done to ensure the following optional flags are honored.
	*
	* XATTR_CREATE: fail if xattr already exists
	* XATTR_REPLACE: fail if xattr does not exist
	*
	* We also want to know if it resides in sa or dir, so we can make
	* sure we don't end up with duplicate in both places.
	*/
	error = __zpl_xattr_where(ip, name, &where, cr);
	if (error < 0) {
	if (error != -ENODATA)
	goto out;
	if (flags & XATTR_REPLACE)
	goto out;

	/* The xattr to be removed already doesn't exist */
	error = 0;
	if (value == NULL)
	goto out;
	} else {
	error = -EEXIST;
	if (flags & XATTR_CREATE)
	goto out;
	}

	/* Preferentially store the xattr as a SA for better performance */
	if (zfsvfs->z_use_sa && zp->z_is_sa &&
	(zfsvfs->z_xattr_sa \|\| (value == NULL && where & XATTR_IN_SA))) {
	error = zpl_xattr_set_sa(ip, name, value, size, flags, cr);
	if (error == 0) {
	/*
	* Successfully put into SA, we need to clear the one
	* in dir.
	*/
	if (where & XATTR_IN_DIR)
	zpl_xattr_set_dir(ip, name, NULL, 0, 0, cr);
	goto out;
	}
	}

	error = zpl_xattr_set_dir(ip, name, value, size, flags, cr);
	/*
	* Successfully put into dir, we need to clear the one in SA.
	*/
	if (error == 0 && (where & XATTR_IN_SA))
	zpl_xattr_set_sa(ip, name, NULL, 0, 0, cr);
	out:
	rw_exit(&ITOZ(ip)->z_xattr_lock);
	ZPL_EXIT(zfsvfs);
	spl_fstrans_unmark(cookie);
	crfree(cr);
	ASSERT3S(error, <=, 0);

	return (error);
	}

	/*
	* Extended user attributes
	*
	* "Extended user attributes may be assigned to files and directories for
	* storing arbitrary additional information such as the mime type,
	* character set or encoding of a file. The access permissions for user
	* attributes are defined by the file permission bits: read permission
	* is required to retrieve the attribute value, and writer permission is
	* required to change it.
	*
	* The file permission bits of regular files and directories are
	* interpreted differently from the file permission bits of special
	* files and symbolic links. For regular files and directories the file
	* permission bits define access to the file's contents, while for
	* device special files they define access to the device described by
	* the special file. The file permissions of symbolic links are not
	* used in access checks. These differences would allow users to
	* consume filesystem resources in a way not controllable by disk quotas
	* for group or world writable special files and directories.
	*
	* For this reason, extended user attributes are allowed only for
	* regular files and directories, and access to extended user attributes
	* is restricted to the owner and to users with appropriate capabilities
	* for directories with the sticky bit set (see the chmod(1) manual page
	* for an explanation of the sticky bit)." - xattr(7)
	*
	* ZFS allows extended user attributes to be disabled administratively
	* by setting the 'xattr=off' property on the dataset.
	*/
	static int
	__zpl_xattr_user_list(struct inode ip, char list, size_t list_size,
	const char *name, size_t name_len)
	{
	return (ITOZSB(ip)->z_flags & ZSB_XATTR);
	}
	ZPL_XATTR_LIST_WRAPPER(zpl_xattr_user_list);

	static int
	__zpl_xattr_user_get(struct inode ip, const char name,
	void *value, size_t size)
	{
	char *xattr_name;
	int error;
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") == 0)
	return (-EINVAL);
	#endif
	if (!(ITOZSB(ip)->z_flags & ZSB_XATTR))
	return (-EOPNOTSUPP);

	xattr_name = kmem_asprintf("%s%s", XATTR_USER_PREFIX, name);
	error = zpl_xattr_get(ip, xattr_name, value, size);
	kmem_strfree(xattr_name);

	return (error);
	}
	ZPL_XATTR_GET_WRAPPER(zpl_xattr_user_get);

	static int
	__zpl_xattr_user_set(struct inode ip, const char name,
	const void *value, size_t size, int flags)
	{
	char *xattr_name;
	int error;
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") == 0)
	return (-EINVAL);
	#endif
	if (!(ITOZSB(ip)->z_flags & ZSB_XATTR))
	return (-EOPNOTSUPP);

	xattr_name = kmem_asprintf("%s%s", XATTR_USER_PREFIX, name);
	error = zpl_xattr_set(ip, xattr_name, value, size, flags);
	kmem_strfree(xattr_name);

	return (error);
	}
	ZPL_XATTR_SET_WRAPPER(zpl_xattr_user_set);

	xattr_handler_t zpl_xattr_user_handler =
	{
	.prefix = XATTR_USER_PREFIX,
	.list = zpl_xattr_user_list,
	.get = zpl_xattr_user_get,
	.set = zpl_xattr_user_set,
	};

	/*
	* Trusted extended attributes
	*
	* "Trusted extended attributes are visible and accessible only to
	* processes that have the CAP_SYS_ADMIN capability. Attributes in this
	* class are used to implement mechanisms in user space (i.e., outside
	* the kernel) which keep information in extended attributes to which
	* ordinary processes should not have access." - xattr(7)
	*/
	static int
	__zpl_xattr_trusted_list(struct inode ip, char list, size_t list_size,
	const char *name, size_t name_len)
	{
	return (capable(CAP_SYS_ADMIN));
	}
	ZPL_XATTR_LIST_WRAPPER(zpl_xattr_trusted_list);

	static int
	__zpl_xattr_trusted_get(struct inode ip, const char name,
	void *value, size_t size)
	{
	char *xattr_name;
	int error;

	if (!capable(CAP_SYS_ADMIN))
	return (-EACCES);
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") == 0)
	return (-EINVAL);
	#endif
	xattr_name = kmem_asprintf("%s%s", XATTR_TRUSTED_PREFIX, name);
	error = zpl_xattr_get(ip, xattr_name, value, size);
	kmem_strfree(xattr_name);

	return (error);
	}
	ZPL_XATTR_GET_WRAPPER(zpl_xattr_trusted_get);

	static int
	__zpl_xattr_trusted_set(struct inode ip, const char name,
	const void *value, size_t size, int flags)
	{
	char *xattr_name;
	int error;

	if (!capable(CAP_SYS_ADMIN))
	return (-EACCES);
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") == 0)
	return (-EINVAL);
	#endif
	xattr_name = kmem_asprintf("%s%s", XATTR_TRUSTED_PREFIX, name);
	error = zpl_xattr_set(ip, xattr_name, value, size, flags);
	kmem_strfree(xattr_name);

	return (error);
	}
	ZPL_XATTR_SET_WRAPPER(zpl_xattr_trusted_set);

	xattr_handler_t zpl_xattr_trusted_handler =
	{
	.prefix = XATTR_TRUSTED_PREFIX,
	.list = zpl_xattr_trusted_list,
	.get = zpl_xattr_trusted_get,
	.set = zpl_xattr_trusted_set,
	};

	/*
	* Extended security attributes
	*
	* "The security attribute namespace is used by kernel security modules,
	* such as Security Enhanced Linux, and also to implement file
	* capabilities (see capabilities(7)). Read and write access
	* permissions to security attributes depend on the policy implemented
	* for each security attribute by the security module. When no security
	* module is loaded, all processes have read access to extended security
	* attributes, and write access is limited to processes that have the
	* CAP_SYS_ADMIN capability." - xattr(7)
	*/
	static int
	__zpl_xattr_security_list(struct inode ip, char list, size_t list_size,
	const char *name, size_t name_len)
	{
	return (1);
	}
	ZPL_XATTR_LIST_WRAPPER(zpl_xattr_security_list);

	static int
	__zpl_xattr_security_get(struct inode ip, const char name,
	void *value, size_t size)
	{
	char *xattr_name;
	int error;
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") == 0)
	return (-EINVAL);
	#endif
	xattr_name = kmem_asprintf("%s%s", XATTR_SECURITY_PREFIX, name);
	error = zpl_xattr_get(ip, xattr_name, value, size);
	kmem_strfree(xattr_name);

	return (error);
	}
	ZPL_XATTR_GET_WRAPPER(zpl_xattr_security_get);

	static int
	__zpl_xattr_security_set(struct inode ip, const char name,
	const void *value, size_t size, int flags)
	{
	char *xattr_name;
	int error;
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") == 0)
	return (-EINVAL);
	#endif
	xattr_name = kmem_asprintf("%s%s", XATTR_SECURITY_PREFIX, name);
	error = zpl_xattr_set(ip, xattr_name, value, size, flags);
	kmem_strfree(xattr_name);

	return (error);
	}
	ZPL_XATTR_SET_WRAPPER(zpl_xattr_security_set);

	static int
	zpl_xattr_security_init_impl(struct inode ip, const struct xattr xattrs,
	void *fs_info)
	{
	const struct xattr *xattr;
	int error = 0;

	for (xattr = xattrs; xattr->name != NULL; xattr++) {
	error = __zpl_xattr_security_set(ip,
	xattr->name, xattr->value, xattr->value_len, 0);

	if (error < 0)
	break;
	}

	return (error);
	}

	int
	zpl_xattr_security_init(struct inode ip, struct inode dip,
	const struct qstr *qstr)
	{
	return security_inode_init_security(ip, dip, qstr,
	&zpl_xattr_security_init_impl, NULL);
	}

	/*
	* Security xattr namespace handlers.
	*/
	xattr_handler_t zpl_xattr_security_handler = {
	.prefix = XATTR_SECURITY_PREFIX,
	.list = zpl_xattr_security_list,
	.get = zpl_xattr_security_get,
	.set = zpl_xattr_security_set,
	};

	/*
	* Extended system attributes
	*
	* "Extended system attributes are used by the kernel to store system
	* objects such as Access Control Lists. Read and write access permissions
	* to system attributes depend on the policy implemented for each system
	* attribute implemented by filesystems in the kernel." - xattr(7)
	*/
	#ifdef CONFIG_FS_POSIX_ACL
	#ifndef HAVE_SET_ACL
	static
	#endif
	int
	zpl_set_acl(struct inode ip, struct posix_acl acl, int type)
	{
	char name, value = NULL;
	int error = 0;
	size_t size = 0;

	if (S_ISLNK(ip->i_mode))
	return (-EOPNOTSUPP);

	switch (type) {
	case ACL_TYPE_ACCESS:
	name = XATTR_NAME_POSIX_ACL_ACCESS;
	if (acl) {
	umode_t mode = ip->i_mode;
	error = posix_acl_equiv_mode(acl, &mode);
	if (error < 0) {
	return (error);
	} else {
	/*
	* The mode bits will have been set by
	* ->zfs_setattr()->zfs_acl_chmod_setattr()
	* using the ZFS ACL conversion. If they
	* differ from the Posix ACL conversion dirty
	* the inode to write the Posix mode bits.
	*/
	if (ip->i_mode != mode) {
	ip->i_mode = mode;
	ip->i_ctime = current_time(ip);
	zfs_mark_inode_dirty(ip);
	}

	if (error == 0)
	acl = NULL;
	}
	}
	break;

	case ACL_TYPE_DEFAULT:
	name = XATTR_NAME_POSIX_ACL_DEFAULT;
	if (!S_ISDIR(ip->i_mode))
	return (acl ? -EACCES : 0);
	break;

	default:
	return (-EINVAL);
	}

	if (acl) {
	size = posix_acl_xattr_size(acl->a_count);
	value = kmem_alloc(size, KM_SLEEP);

	error = zpl_acl_to_xattr(acl, value, size);
	if (error < 0) {
	kmem_free(value, size);
	return (error);
	}
	}

	error = zpl_xattr_set(ip, name, value, size, 0);
	if (value)
	kmem_free(value, size);

	if (!error) {
	if (acl)
	zpl_set_cached_acl(ip, type, acl);
	else
	zpl_forget_cached_acl(ip, type);
	}

	return (error);
	}

	struct posix_acl *
	zpl_get_acl(struct inode *ip, int type)
	{
	struct posix_acl *acl;
	void *value = NULL;
	char *name;
	int size;

	/*
	* As of Linux 3.14, the kernel get_acl will check this for us.
	* Also as of Linux 4.7, comparing against ACL_NOT_CACHED is wrong
	* as the kernel get_acl will set it to temporary sentinel value.
	*/
	#ifndef HAVE_KERNEL_GET_ACL_HANDLE_CACHE
	acl = get_cached_acl(ip, type);
	if (acl != ACL_NOT_CACHED)
	return (acl);
	#endif

	switch (type) {
	case ACL_TYPE_ACCESS:
	name = XATTR_NAME_POSIX_ACL_ACCESS;
	break;
	case ACL_TYPE_DEFAULT:
	name = XATTR_NAME_POSIX_ACL_DEFAULT;
	break;
	default:
	return (ERR_PTR(-EINVAL));
	}

	size = zpl_xattr_get(ip, name, NULL, 0);
	if (size > 0) {
	value = kmem_alloc(size, KM_SLEEP);
	size = zpl_xattr_get(ip, name, value, size);
	}

	if (size > 0) {
	acl = zpl_acl_from_xattr(value, size);
	} else if (size == -ENODATA \|\| size == -ENOSYS) {
	acl = NULL;
	} else {
	acl = ERR_PTR(-EIO);
	}

	if (size > 0)
	kmem_free(value, size);

	/* As of Linux 4.7, the kernel get_acl will set this for us */
	#ifndef HAVE_KERNEL_GET_ACL_HANDLE_CACHE
	if (!IS_ERR(acl))
	zpl_set_cached_acl(ip, type, acl);
	#endif

	return (acl);
	}

	int
	zpl_init_acl(struct inode ip, struct inode dir)
	{
	struct posix_acl *acl = NULL;
	int error = 0;

	- if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIXACL)
	+ if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIX)
	return (0);

	if (!S_ISLNK(ip->i_mode)) {
	acl = zpl_get_acl(dir, ACL_TYPE_DEFAULT);
	if (IS_ERR(acl))
	return (PTR_ERR(acl));
	if (!acl) {
	ip->i_mode &= ~current_umask();
	ip->i_ctime = current_time(ip);
	zfs_mark_inode_dirty(ip);
	return (0);
	}
	}

	if (acl) {
	umode_t mode;

	if (S_ISDIR(ip->i_mode)) {
	error = zpl_set_acl(ip, acl, ACL_TYPE_DEFAULT);
	if (error)
	goto out;
	}

	mode = ip->i_mode;
	error = __posix_acl_create(&acl, GFP_KERNEL, &mode);
	if (error >= 0) {
	ip->i_mode = mode;
	zfs_mark_inode_dirty(ip);
	if (error > 0)
	error = zpl_set_acl(ip, acl, ACL_TYPE_ACCESS);
	}
	}
	out:
	zpl_posix_acl_release(acl);

	return (error);
	}

	int
	zpl_chmod_acl(struct inode *ip)
	{
	struct posix_acl *acl;
	int error;

	- if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIXACL)
	+ if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIX)
	return (0);

	if (S_ISLNK(ip->i_mode))
	return (-EOPNOTSUPP);

	acl = zpl_get_acl(ip, ACL_TYPE_ACCESS);
	if (IS_ERR(acl) \|\| !acl)
	return (PTR_ERR(acl));

	error = __posix_acl_chmod(&acl, GFP_KERNEL, ip->i_mode);
	if (!error)
	error = zpl_set_acl(ip, acl, ACL_TYPE_ACCESS);

	zpl_posix_acl_release(acl);

	return (error);
	}

	static int
	__zpl_xattr_acl_list_access(struct inode ip, char list, size_t list_size,
	const char *name, size_t name_len)
	{
	char *xattr_name = XATTR_NAME_POSIX_ACL_ACCESS;
	size_t xattr_size = sizeof (XATTR_NAME_POSIX_ACL_ACCESS);

	- if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIXACL)
	+ if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIX)
	return (0);

	if (list && xattr_size <= list_size)
	memcpy(list, xattr_name, xattr_size);

	return (xattr_size);
	}
	ZPL_XATTR_LIST_WRAPPER(zpl_xattr_acl_list_access);

	static int
	__zpl_xattr_acl_list_default(struct inode ip, char list, size_t list_size,
	const char *name, size_t name_len)
	{
	char *xattr_name = XATTR_NAME_POSIX_ACL_DEFAULT;
	size_t xattr_size = sizeof (XATTR_NAME_POSIX_ACL_DEFAULT);

	- if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIXACL)
	+ if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIX)
	return (0);

	if (list && xattr_size <= list_size)
	memcpy(list, xattr_name, xattr_size);

	return (xattr_size);
	}
	ZPL_XATTR_LIST_WRAPPER(zpl_xattr_acl_list_default);

	static int
	__zpl_xattr_acl_get_access(struct inode ip, const char name,
	void *buffer, size_t size)
	{
	struct posix_acl *acl;
	int type = ACL_TYPE_ACCESS;
	int error;
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") != 0)
	return (-EINVAL);
	#endif
	- if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIXACL)
	+ if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIX)
	return (-EOPNOTSUPP);

	acl = zpl_get_acl(ip, type);
	if (IS_ERR(acl))
	return (PTR_ERR(acl));
	if (acl == NULL)
	return (-ENODATA);

	error = zpl_acl_to_xattr(acl, buffer, size);
	zpl_posix_acl_release(acl);

	return (error);
	}
	ZPL_XATTR_GET_WRAPPER(zpl_xattr_acl_get_access);

	static int
	__zpl_xattr_acl_get_default(struct inode ip, const char name,
	void *buffer, size_t size)
	{
	struct posix_acl *acl;
	int type = ACL_TYPE_DEFAULT;
	int error;
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") != 0)
	return (-EINVAL);
	#endif
	- if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIXACL)
	+ if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIX)
	return (-EOPNOTSUPP);

	acl = zpl_get_acl(ip, type);
	if (IS_ERR(acl))
	return (PTR_ERR(acl));
	if (acl == NULL)
	return (-ENODATA);

	error = zpl_acl_to_xattr(acl, buffer, size);
	zpl_posix_acl_release(acl);

	return (error);
	}
	ZPL_XATTR_GET_WRAPPER(zpl_xattr_acl_get_default);

	static int
	__zpl_xattr_acl_set_access(struct inode ip, const char name,
	const void *value, size_t size, int flags)
	{
	struct posix_acl *acl;
	int type = ACL_TYPE_ACCESS;
	int error = 0;
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") != 0)
	return (-EINVAL);
	#endif
	- if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIXACL)
	+ if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIX)
	return (-EOPNOTSUPP);

	if (!inode_owner_or_capable(ip))
	return (-EPERM);

	if (value) {
	acl = zpl_acl_from_xattr(value, size);
	if (IS_ERR(acl))
	return (PTR_ERR(acl));
	else if (acl) {
	error = zpl_posix_acl_valid(ip, acl);
	if (error) {
	zpl_posix_acl_release(acl);
	return (error);
	}
	}
	} else {
	acl = NULL;
	}

	error = zpl_set_acl(ip, acl, type);
	zpl_posix_acl_release(acl);

	return (error);
	}
	ZPL_XATTR_SET_WRAPPER(zpl_xattr_acl_set_access);

	static int
	__zpl_xattr_acl_set_default(struct inode ip, const char name,
	const void *value, size_t size, int flags)
	{
	struct posix_acl *acl;
	int type = ACL_TYPE_DEFAULT;
	int error = 0;
	/* xattr_resolve_name will do this for us if this is defined */
	#ifndef HAVE_XATTR_HANDLER_NAME
	if (strcmp(name, "") != 0)
	return (-EINVAL);
	#endif
	- if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIXACL)
	+ if (ITOZSB(ip)->z_acl_type != ZFS_ACLTYPE_POSIX)
	return (-EOPNOTSUPP);

	if (!inode_owner_or_capable(ip))
	return (-EPERM);

	if (value) {
	acl = zpl_acl_from_xattr(value, size);
	if (IS_ERR(acl))
	return (PTR_ERR(acl));
	else if (acl) {
	error = zpl_posix_acl_valid(ip, acl);
	if (error) {
	zpl_posix_acl_release(acl);
	return (error);
	}
	}
	} else {
	acl = NULL;
	}

	error = zpl_set_acl(ip, acl, type);
	zpl_posix_acl_release(acl);

	return (error);
	}
	ZPL_XATTR_SET_WRAPPER(zpl_xattr_acl_set_default);

	/*
	* ACL access xattr namespace handlers.
	*
	* Use .name instead of .prefix when available. xattr_resolve_name will match
	* whole name and reject anything that has .name only as prefix.
	*/
	xattr_handler_t zpl_xattr_acl_access_handler =
	{
	#ifdef HAVE_XATTR_HANDLER_NAME
	.name = XATTR_NAME_POSIX_ACL_ACCESS,
	#else
	.prefix = XATTR_NAME_POSIX_ACL_ACCESS,
	#endif
	.list = zpl_xattr_acl_list_access,
	.get = zpl_xattr_acl_get_access,
	.set = zpl_xattr_acl_set_access,
	#if defined(HAVE_XATTR_LIST_SIMPLE) \|\| \
	defined(HAVE_XATTR_LIST_DENTRY) \|\| \
	defined(HAVE_XATTR_LIST_HANDLER)
	.flags = ACL_TYPE_ACCESS,
	#endif
	};

	/*
	* ACL default xattr namespace handlers.
	*
	* Use .name instead of .prefix when available. xattr_resolve_name will match
	* whole name and reject anything that has .name only as prefix.
	*/
	xattr_handler_t zpl_xattr_acl_default_handler =
	{
	#ifdef HAVE_XATTR_HANDLER_NAME
	.name = XATTR_NAME_POSIX_ACL_DEFAULT,
	#else
	.prefix = XATTR_NAME_POSIX_ACL_DEFAULT,
	#endif
	.list = zpl_xattr_acl_list_default,
	.get = zpl_xattr_acl_get_default,
	.set = zpl_xattr_acl_set_default,
	#if defined(HAVE_XATTR_LIST_SIMPLE) \|\| \
	defined(HAVE_XATTR_LIST_DENTRY) \|\| \
	defined(HAVE_XATTR_LIST_HANDLER)
	.flags = ACL_TYPE_DEFAULT,
	#endif
	};

	#endif /* CONFIG_FS_POSIX_ACL */

	xattr_handler_t *zpl_xattr_handlers[] = {
	&zpl_xattr_security_handler,
	&zpl_xattr_trusted_handler,
	&zpl_xattr_user_handler,
	#ifdef CONFIG_FS_POSIX_ACL
	&zpl_xattr_acl_access_handler,
	&zpl_xattr_acl_default_handler,
	#endif /* CONFIG_FS_POSIX_ACL */
	NULL
	};

	static const struct xattr_handler *
	zpl_xattr_handler(const char *name)
	{
	if (strncmp(name, XATTR_USER_PREFIX,
	XATTR_USER_PREFIX_LEN) == 0)
	return (&zpl_xattr_user_handler);

	if (strncmp(name, XATTR_TRUSTED_PREFIX,
	XATTR_TRUSTED_PREFIX_LEN) == 0)
	return (&zpl_xattr_trusted_handler);

	if (strncmp(name, XATTR_SECURITY_PREFIX,
	XATTR_SECURITY_PREFIX_LEN) == 0)
	return (&zpl_xattr_security_handler);

	#ifdef CONFIG_FS_POSIX_ACL
	if (strncmp(name, XATTR_NAME_POSIX_ACL_ACCESS,
	sizeof (XATTR_NAME_POSIX_ACL_ACCESS)) == 0)
	return (&zpl_xattr_acl_access_handler);

	if (strncmp(name, XATTR_NAME_POSIX_ACL_DEFAULT,
	sizeof (XATTR_NAME_POSIX_ACL_DEFAULT)) == 0)
	return (&zpl_xattr_acl_default_handler);
	#endif /* CONFIG_FS_POSIX_ACL */

	return (NULL);
	}

	#if !defined(HAVE_POSIX_ACL_RELEASE) \|\| defined(HAVE_POSIX_ACL_RELEASE_GPL_ONLY)
	struct acl_rel_struct {
	struct acl_rel_struct *next;
	struct posix_acl *acl;
	clock_t time;
	};

	#define ACL_REL_GRACE (60*HZ)
	#define ACL_REL_WINDOW (1*HZ)
	#define ACL_REL_SCHED (ACL_REL_GRACE+ACL_REL_WINDOW)

	/*
	* Lockless multi-producer single-consumer fifo list.
	* Nodes are added to tail and removed from head. Tail pointer is our
	* synchronization point. It always points to the next pointer of the last
	* node, or head if list is empty.
	*/
	static struct acl_rel_struct *acl_rel_head = NULL;
	static struct acl_rel_struct **acl_rel_tail = &acl_rel_head;

	static void
	zpl_posix_acl_free(void *arg)
	{
	struct acl_rel_struct *freelist = NULL;
	struct acl_rel_struct *a;
	clock_t new_time;
	boolean_t refire = B_FALSE;

	ASSERT3P(acl_rel_head, !=, NULL);
	while (acl_rel_head) {
	a = acl_rel_head;
	if (ddi_get_lbolt() - a->time >= ACL_REL_GRACE) {
	/*
	* If a is the last node we need to reset tail, but we
	* need to use cmpxchg to make sure it is still the
	* last node.
	*/
	if (acl_rel_tail == &a->next) {
	acl_rel_head = NULL;
	if (cmpxchg(&acl_rel_tail, &a->next,
	&acl_rel_head) == &a->next) {
	ASSERT3P(a->next, ==, NULL);
	a->next = freelist;
	freelist = a;
	break;
	}
	}
	/*
	* a is not last node, make sure next pointer is set
	* by the adder and advance the head.
	*/
	while (READ_ONCE(a->next) == NULL)
	cpu_relax();
	acl_rel_head = a->next;
	a->next = freelist;
	freelist = a;
	} else {
	/*
	* a is still in grace period. We are responsible to
	* reschedule the free task, since adder will only do
	* so if list is empty.
	*/
	new_time = a->time + ACL_REL_SCHED;
	refire = B_TRUE;
	break;
	}
	}

	if (refire)
	taskq_dispatch_delay(system_delay_taskq, zpl_posix_acl_free,
	NULL, TQ_SLEEP, new_time);

	while (freelist) {
	a = freelist;
	freelist = a->next;
	kfree(a->acl);
	kmem_free(a, sizeof (struct acl_rel_struct));
	}
	}

	void
	zpl_posix_acl_release_impl(struct posix_acl *acl)
	{
	struct acl_rel_struct a, *prev;

	a = kmem_alloc(sizeof (struct acl_rel_struct), KM_SLEEP);
	a->next = NULL;
	a->acl = acl;
	a->time = ddi_get_lbolt();
	/* atomically points tail to us and get the previous tail */
	prev = xchg(&acl_rel_tail, &a->next);
	ASSERT3P(*prev, ==, NULL);
	*prev = a;
	/* if it was empty before, schedule the free task */
	if (prev == &acl_rel_head)
	taskq_dispatch_delay(system_delay_taskq, zpl_posix_acl_free,
	NULL, TQ_SLEEP, ddi_get_lbolt() + ACL_REL_SCHED);
	}
	#endif
	Index: vendor-sys/openzfs/dist/module/zcommon/zfs_prop.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zcommon/zfs_prop.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zcommon/zfs_prop.c (revision 365892)
	@@ -1,1052 +1,1053 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2018 by Delphix. All rights reserved.
	* Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
	* Copyright 2016, Joyent, Inc.
	* Copyright (c) 2019, Klara Inc.
	* Copyright (c) 2019, Allan Jude
	*/

	/* Portions Copyright 2010 Robert Milkowski */

	#include <sys/zio.h>
	#include <sys/spa.h>
	#include <sys/u8_textprep.h>
	#include <sys/zfs_acl.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/zfs_znode.h>
	#include <sys/dsl_crypt.h>

	#include "zfs_prop.h"
	#include "zfs_deleg.h"
	#include "zfs_fletcher.h"

	#if !defined(_KERNEL)
	#include <stdlib.h>
	#include <string.h>
	#include <ctype.h>
	#endif

	static zprop_desc_t zfs_prop_table[ZFS_NUM_PROPS];

	/* Note this is indexed by zfs_userquota_prop_t, keep the order the same */
	const char *zfs_userquota_prop_prefixes[] = {
	"userused@",
	"userquota@",
	"groupused@",
	"groupquota@",
	"userobjused@",
	"userobjquota@",
	"groupobjused@",
	"groupobjquota@",
	"projectused@",
	"projectquota@",
	"projectobjused@",
	"projectobjquota@"
	};

	zprop_desc_t *
	zfs_prop_get_table(void)
	{
	return (zfs_prop_table);
	}

	void
	zfs_prop_init(void)
	{
	static zprop_index_t checksum_table[] = {
	{ "on", ZIO_CHECKSUM_ON },
	{ "off", ZIO_CHECKSUM_OFF },
	{ "fletcher2", ZIO_CHECKSUM_FLETCHER_2 },
	{ "fletcher4", ZIO_CHECKSUM_FLETCHER_4 },
	{ "sha256", ZIO_CHECKSUM_SHA256 },
	{ "noparity", ZIO_CHECKSUM_NOPARITY },
	{ "sha512", ZIO_CHECKSUM_SHA512 },
	{ "skein", ZIO_CHECKSUM_SKEIN },
	#if !defined(__FreeBSD__)

	{ "edonr", ZIO_CHECKSUM_EDONR },
	#endif
	{ NULL }
	};

	static zprop_index_t dedup_table[] = {
	{ "on", ZIO_CHECKSUM_ON },
	{ "off", ZIO_CHECKSUM_OFF },
	{ "verify", ZIO_CHECKSUM_ON \| ZIO_CHECKSUM_VERIFY },
	{ "sha256", ZIO_CHECKSUM_SHA256 },
	{ "sha256,verify",
	ZIO_CHECKSUM_SHA256 \| ZIO_CHECKSUM_VERIFY },
	{ "sha512", ZIO_CHECKSUM_SHA512 },
	{ "sha512,verify",
	ZIO_CHECKSUM_SHA512 \| ZIO_CHECKSUM_VERIFY },
	{ "skein", ZIO_CHECKSUM_SKEIN },
	{ "skein,verify",
	ZIO_CHECKSUM_SKEIN \| ZIO_CHECKSUM_VERIFY },
	#if !defined(__FreeBSD__)

	{ "edonr,verify",
	ZIO_CHECKSUM_EDONR \| ZIO_CHECKSUM_VERIFY },
	#endif
	{ NULL }
	};

	static zprop_index_t compress_table[] = {
	{ "on", ZIO_COMPRESS_ON },
	{ "off", ZIO_COMPRESS_OFF },
	{ "lzjb", ZIO_COMPRESS_LZJB },
	{ "gzip", ZIO_COMPRESS_GZIP_6 }, /* gzip default */
	{ "gzip-1", ZIO_COMPRESS_GZIP_1 },
	{ "gzip-2", ZIO_COMPRESS_GZIP_2 },
	{ "gzip-3", ZIO_COMPRESS_GZIP_3 },
	{ "gzip-4", ZIO_COMPRESS_GZIP_4 },
	{ "gzip-5", ZIO_COMPRESS_GZIP_5 },
	{ "gzip-6", ZIO_COMPRESS_GZIP_6 },
	{ "gzip-7", ZIO_COMPRESS_GZIP_7 },
	{ "gzip-8", ZIO_COMPRESS_GZIP_8 },
	{ "gzip-9", ZIO_COMPRESS_GZIP_9 },
	{ "zle", ZIO_COMPRESS_ZLE },
	{ "lz4", ZIO_COMPRESS_LZ4 },
	{ "zstd", ZIO_COMPRESS_ZSTD },
	{ "zstd-fast",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_DEFAULT) },

	/*
	* ZSTD 1-19 are synthetic. We store the compression level in a
	* separate hidden property to avoid wasting a large amount of
	* space in the ZIO_COMPRESS enum.
	*
	* The compression level is also stored within the header of the
	* compressed block since we may need it for later recompression
	* to avoid checksum errors (L2ARC).
	*
	* Note that the level here is defined as bit shifted mask on
	* top of the method.
	*/
	{ "zstd-1", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_1) },
	{ "zstd-2", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_2) },
	{ "zstd-3", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_3) },
	{ "zstd-4", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_4) },
	{ "zstd-5", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_5) },
	{ "zstd-6", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_6) },
	{ "zstd-7", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_7) },
	{ "zstd-8", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_8) },
	{ "zstd-9", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_9) },
	{ "zstd-10", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_10) },
	{ "zstd-11", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_11) },
	{ "zstd-12", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_12) },
	{ "zstd-13", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_13) },
	{ "zstd-14", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_14) },
	{ "zstd-15", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_15) },
	{ "zstd-16", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_16) },
	{ "zstd-17", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_17) },
	{ "zstd-18", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_18) },
	{ "zstd-19", ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_19) },

	/*
	* The ZSTD-Fast levels are also synthetic.
	*/
	{ "zstd-fast-1",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_1) },
	{ "zstd-fast-2",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_2) },
	{ "zstd-fast-3",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_3) },
	{ "zstd-fast-4",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_4) },
	{ "zstd-fast-5",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_5) },
	{ "zstd-fast-6",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_6) },
	{ "zstd-fast-7",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_7) },
	{ "zstd-fast-8",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_8) },
	{ "zstd-fast-9",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_9) },
	{ "zstd-fast-10",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_10) },
	{ "zstd-fast-20",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_20) },
	{ "zstd-fast-30",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_30) },
	{ "zstd-fast-40",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_40) },
	{ "zstd-fast-50",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_50) },
	{ "zstd-fast-60",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_60) },
	{ "zstd-fast-70",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_70) },
	{ "zstd-fast-80",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_80) },
	{ "zstd-fast-90",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_90) },
	{ "zstd-fast-100",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_100) },
	{ "zstd-fast-500",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_500) },
	{ "zstd-fast-1000",
	ZIO_COMPLEVEL_ZSTD(ZIO_ZSTD_LEVEL_FAST_1000) },
	{ NULL }
	};

	static zprop_index_t crypto_table[] = {
	{ "on", ZIO_CRYPT_ON },
	{ "off", ZIO_CRYPT_OFF },
	{ "aes-128-ccm", ZIO_CRYPT_AES_128_CCM },
	{ "aes-192-ccm", ZIO_CRYPT_AES_192_CCM },
	{ "aes-256-ccm", ZIO_CRYPT_AES_256_CCM },
	{ "aes-128-gcm", ZIO_CRYPT_AES_128_GCM },
	{ "aes-192-gcm", ZIO_CRYPT_AES_192_GCM },
	{ "aes-256-gcm", ZIO_CRYPT_AES_256_GCM },
	{ NULL }
	};

	static zprop_index_t keyformat_table[] = {
	{ "none", ZFS_KEYFORMAT_NONE },
	{ "raw", ZFS_KEYFORMAT_RAW },
	{ "hex", ZFS_KEYFORMAT_HEX },
	{ "passphrase", ZFS_KEYFORMAT_PASSPHRASE },
	{ NULL }
	};

	static zprop_index_t snapdir_table[] = {
	{ "hidden", ZFS_SNAPDIR_HIDDEN },
	{ "visible", ZFS_SNAPDIR_VISIBLE },
	{ NULL }
	};

	static zprop_index_t snapdev_table[] = {
	{ "hidden", ZFS_SNAPDEV_HIDDEN },
	{ "visible", ZFS_SNAPDEV_VISIBLE },
	{ NULL }
	};

	static zprop_index_t acl_mode_table[] = {
	{ "discard", ZFS_ACL_DISCARD },
	{ "groupmask", ZFS_ACL_GROUPMASK },
	{ "passthrough", ZFS_ACL_PASSTHROUGH },
	{ "restricted", ZFS_ACL_RESTRICTED },
	{ NULL }
	};

	static zprop_index_t acltype_table[] = {
	{ "off", ZFS_ACLTYPE_OFF },
	- { "disabled", ZFS_ACLTYPE_OFF },
	- { "noacl", ZFS_ACLTYPE_OFF },
	- { "posixacl", ZFS_ACLTYPE_POSIXACL },
	+ { "posix", ZFS_ACLTYPE_POSIX },
	+ { "disabled", ZFS_ACLTYPE_OFF }, /* bkwrd compatibility */
	+ { "noacl", ZFS_ACLTYPE_OFF }, /* bkwrd compatibility */
	+ { "posixacl", ZFS_ACLTYPE_POSIX }, /* bkwrd compatibility */
	{ NULL }
	};

	static zprop_index_t acl_inherit_table[] = {
	{ "discard", ZFS_ACL_DISCARD },
	{ "noallow", ZFS_ACL_NOALLOW },
	{ "restricted", ZFS_ACL_RESTRICTED },
	{ "passthrough", ZFS_ACL_PASSTHROUGH },
	{ "secure", ZFS_ACL_RESTRICTED }, /* bkwrd compatibility */
	{ "passthrough-x", ZFS_ACL_PASSTHROUGH_X },
	{ NULL }
	};

	static zprop_index_t case_table[] = {
	{ "sensitive", ZFS_CASE_SENSITIVE },
	{ "insensitive", ZFS_CASE_INSENSITIVE },
	{ "mixed", ZFS_CASE_MIXED },
	{ NULL }
	};

	static zprop_index_t copies_table[] = {
	{ "1", 1 },
	{ "2", 2 },
	{ "3", 3 },
	{ NULL }
	};

	/*
	* Use the unique flags we have to send to u8_strcmp() and/or
	* u8_textprep() to represent the various normalization property
	* values.
	*/
	static zprop_index_t normalize_table[] = {
	{ "none", 0 },
	{ "formD", U8_TEXTPREP_NFD },
	{ "formKC", U8_TEXTPREP_NFKC },
	{ "formC", U8_TEXTPREP_NFC },
	{ "formKD", U8_TEXTPREP_NFKD },
	{ NULL }
	};

	static zprop_index_t version_table[] = {
	{ "1", 1 },
	{ "2", 2 },
	{ "3", 3 },
	{ "4", 4 },
	{ "5", 5 },
	{ "current", ZPL_VERSION },
	{ NULL }
	};

	static zprop_index_t boolean_table[] = {
	{ "off", 0 },
	{ "on", 1 },
	{ NULL }
	};

	static zprop_index_t keystatus_table[] = {
	{ "none", ZFS_KEYSTATUS_NONE},
	{ "unavailable", ZFS_KEYSTATUS_UNAVAILABLE},
	{ "available", ZFS_KEYSTATUS_AVAILABLE},
	{ NULL }
	};

	static zprop_index_t logbias_table[] = {
	{ "latency", ZFS_LOGBIAS_LATENCY },
	{ "throughput", ZFS_LOGBIAS_THROUGHPUT },
	{ NULL }
	};

	static zprop_index_t canmount_table[] = {
	{ "off", ZFS_CANMOUNT_OFF },
	{ "on", ZFS_CANMOUNT_ON },
	{ "noauto", ZFS_CANMOUNT_NOAUTO },
	{ NULL }
	};

	static zprop_index_t cache_table[] = {
	{ "none", ZFS_CACHE_NONE },
	{ "metadata", ZFS_CACHE_METADATA },
	{ "all", ZFS_CACHE_ALL },
	{ NULL }
	};

	static zprop_index_t sync_table[] = {
	{ "standard", ZFS_SYNC_STANDARD },
	{ "always", ZFS_SYNC_ALWAYS },
	{ "disabled", ZFS_SYNC_DISABLED },
	{ NULL }
	};

	static zprop_index_t xattr_table[] = {
	{ "off", ZFS_XATTR_OFF },
	{ "on", ZFS_XATTR_DIR },
	{ "sa", ZFS_XATTR_SA },
	{ "dir", ZFS_XATTR_DIR },
	{ NULL }
	};

	static zprop_index_t dnsize_table[] = {
	{ "legacy", ZFS_DNSIZE_LEGACY },
	{ "auto", ZFS_DNSIZE_AUTO },
	{ "1k", ZFS_DNSIZE_1K },
	{ "2k", ZFS_DNSIZE_2K },
	{ "4k", ZFS_DNSIZE_4K },
	{ "8k", ZFS_DNSIZE_8K },
	{ "16k", ZFS_DNSIZE_16K },
	{ NULL }
	};

	static zprop_index_t redundant_metadata_table[] = {
	{ "all", ZFS_REDUNDANT_METADATA_ALL },
	{ "most", ZFS_REDUNDANT_METADATA_MOST },
	{ NULL }
	};

	static zprop_index_t volmode_table[] = {
	{ "default", ZFS_VOLMODE_DEFAULT },
	{ "full", ZFS_VOLMODE_GEOM },
	{ "geom", ZFS_VOLMODE_GEOM },
	{ "dev", ZFS_VOLMODE_DEV },
	{ "none", ZFS_VOLMODE_NONE },
	{ NULL }
	};

	/* inherit index properties */
	zprop_register_index(ZFS_PROP_REDUNDANT_METADATA, "redundant_metadata",
	ZFS_REDUNDANT_METADATA_ALL,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"all \| most", "REDUND_MD",
	redundant_metadata_table);
	zprop_register_index(ZFS_PROP_SYNC, "sync", ZFS_SYNC_STANDARD,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"standard \| always \| disabled", "SYNC",
	sync_table);
	zprop_register_index(ZFS_PROP_CHECKSUM, "checksum",
	ZIO_CHECKSUM_DEFAULT, PROP_INHERIT, ZFS_TYPE_FILESYSTEM \|
	ZFS_TYPE_VOLUME,
	#if !defined(__FreeBSD__)
	"on \| off \| fletcher2 \| fletcher4 \| sha256 \| sha512 \| skein"
	" \| edonr",
	#else
	"on \| off \| fletcher2 \| fletcher4 \| sha256 \| sha512 \| skein",
	#endif
	"CHECKSUM", checksum_table);
	zprop_register_index(ZFS_PROP_DEDUP, "dedup", ZIO_CHECKSUM_OFF,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"on \| off \| verify \| sha256[,verify] \| sha512[,verify] \| "
	#if !defined(__FreeBSD__)
	"skein[,verify] \| edonr,verify",
	#else
	"skein[,verify]",
	#endif
	"DEDUP", dedup_table);
	zprop_register_index(ZFS_PROP_COMPRESSION, "compression",
	ZIO_COMPRESS_DEFAULT, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"on \| off \| lzjb \| gzip \| gzip-[1-9] \| zle \| lz4 \| "
	"zstd \| zstd-[1-19] \| "
	"zstd-fast-[1-10,20,30,40,50,60,70,80,90,100,500,1000]",
	"COMPRESS", compress_table);
	zprop_register_index(ZFS_PROP_SNAPDIR, "snapdir", ZFS_SNAPDIR_HIDDEN,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
	"hidden \| visible", "SNAPDIR", snapdir_table);
	zprop_register_index(ZFS_PROP_SNAPDEV, "snapdev", ZFS_SNAPDEV_HIDDEN,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"hidden \| visible", "SNAPDEV", snapdev_table);
	zprop_register_index(ZFS_PROP_ACLMODE, "aclmode", ZFS_ACL_DISCARD,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
	"discard \| groupmask \| passthrough \| restricted", "ACLMODE",
	acl_mode_table);
	#ifndef __FreeBSD__
	zprop_register_index(ZFS_PROP_ACLTYPE, "acltype", ZFS_ACLTYPE_OFF,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT,
	- "noacl \| posixacl", "ACLTYPE", acltype_table);
	+ "off \| posix", "ACLTYPE", acltype_table);
	#endif
	zprop_register_index(ZFS_PROP_ACLINHERIT, "aclinherit",
	ZFS_ACL_RESTRICTED, PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
	"discard \| noallow \| restricted \| passthrough \| passthrough-x",
	"ACLINHERIT", acl_inherit_table);
	zprop_register_index(ZFS_PROP_COPIES, "copies", 1, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"1 \| 2 \| 3", "COPIES", copies_table);
	zprop_register_index(ZFS_PROP_PRIMARYCACHE, "primarycache",
	ZFS_CACHE_ALL, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT \| ZFS_TYPE_VOLUME,
	"all \| none \| metadata", "PRIMARYCACHE", cache_table);
	zprop_register_index(ZFS_PROP_SECONDARYCACHE, "secondarycache",
	ZFS_CACHE_ALL, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT \| ZFS_TYPE_VOLUME,
	"all \| none \| metadata", "SECONDARYCACHE", cache_table);
	zprop_register_index(ZFS_PROP_LOGBIAS, "logbias", ZFS_LOGBIAS_LATENCY,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"latency \| throughput", "LOGBIAS", logbias_table);
	zprop_register_index(ZFS_PROP_XATTR, "xattr", ZFS_XATTR_DIR,
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT,
	"on \| off \| dir \| sa", "XATTR", xattr_table);
	zprop_register_index(ZFS_PROP_DNODESIZE, "dnodesize",
	ZFS_DNSIZE_LEGACY, PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
	"legacy \| auto \| 1k \| 2k \| 4k \| 8k \| 16k", "DNSIZE", dnsize_table);
	zprop_register_index(ZFS_PROP_VOLMODE, "volmode",
	ZFS_VOLMODE_DEFAULT, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"default \| full \| geom \| dev \| none", "VOLMODE", volmode_table);

	/* inherit index (boolean) properties */
	zprop_register_index(ZFS_PROP_ATIME, "atime", 1, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM, "on \| off", "ATIME", boolean_table);
	zprop_register_index(ZFS_PROP_RELATIME, "relatime", 0, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM, "on \| off", "RELATIME", boolean_table);
	zprop_register_index(ZFS_PROP_DEVICES, "devices", 1, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT, "on \| off", "DEVICES",
	boolean_table);
	zprop_register_index(ZFS_PROP_EXEC, "exec", 1, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT, "on \| off", "EXEC",
	boolean_table);
	zprop_register_index(ZFS_PROP_SETUID, "setuid", 1, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT, "on \| off", "SETUID",
	boolean_table);
	zprop_register_index(ZFS_PROP_READONLY, "readonly", 0, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "on \| off", "RDONLY",
	boolean_table);
	#ifdef __FreeBSD__
	zprop_register_index(ZFS_PROP_ZONED, "jailed", 0, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM, "on \| off", "JAILED", boolean_table);
	#else
	zprop_register_index(ZFS_PROP_ZONED, "zoned", 0, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM, "on \| off", "ZONED", boolean_table);
	#endif
	zprop_register_index(ZFS_PROP_VSCAN, "vscan", 0, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM, "on \| off", "VSCAN", boolean_table);
	zprop_register_index(ZFS_PROP_NBMAND, "nbmand", 0, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT, "on \| off", "NBMAND",
	boolean_table);
	zprop_register_index(ZFS_PROP_OVERLAY, "overlay", 1, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM, "on \| off", "OVERLAY", boolean_table);

	/* default index properties */
	zprop_register_index(ZFS_PROP_VERSION, "version", 0, PROP_DEFAULT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT,
	"1 \| 2 \| 3 \| 4 \| 5 \| current", "VERSION", version_table);
	zprop_register_index(ZFS_PROP_CANMOUNT, "canmount", ZFS_CANMOUNT_ON,
	PROP_DEFAULT, ZFS_TYPE_FILESYSTEM, "on \| off \| noauto",
	"CANMOUNT", canmount_table);

	/* readonly index properties */
	zprop_register_index(ZFS_PROP_MOUNTED, "mounted", 0, PROP_READONLY,
	ZFS_TYPE_FILESYSTEM, "yes \| no", "MOUNTED", boolean_table);
	zprop_register_index(ZFS_PROP_DEFER_DESTROY, "defer_destroy", 0,
	PROP_READONLY, ZFS_TYPE_SNAPSHOT, "yes \| no", "DEFER_DESTROY",
	boolean_table);
	zprop_register_index(ZFS_PROP_KEYSTATUS, "keystatus",
	ZFS_KEYSTATUS_NONE, PROP_READONLY, ZFS_TYPE_DATASET,
	"none \| unavailable \| available",
	"KEYSTATUS", keystatus_table);

	/* set once index properties */
	zprop_register_index(ZFS_PROP_NORMALIZE, "normalization", 0,
	PROP_ONETIME, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT,
	"none \| formC \| formD \| formKC \| formKD", "NORMALIZATION",
	normalize_table);
	zprop_register_index(ZFS_PROP_CASE, "casesensitivity",
	ZFS_CASE_SENSITIVE, PROP_ONETIME, ZFS_TYPE_FILESYSTEM \|
	ZFS_TYPE_SNAPSHOT,
	"sensitive \| insensitive \| mixed", "CASE", case_table);
	zprop_register_index(ZFS_PROP_KEYFORMAT, "keyformat",
	ZFS_KEYFORMAT_NONE, PROP_ONETIME_DEFAULT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"none \| raw \| hex \| passphrase", "KEYFORMAT", keyformat_table);
	zprop_register_index(ZFS_PROP_ENCRYPTION, "encryption",
	ZIO_CRYPT_DEFAULT, PROP_ONETIME, ZFS_TYPE_DATASET,
	"on \| off \| aes-128-ccm \| aes-192-ccm \| aes-256-ccm \| "
	"aes-128-gcm \| aes-192-gcm \| aes-256-gcm", "ENCRYPTION",
	crypto_table);

	/* set once index (boolean) properties */
	zprop_register_index(ZFS_PROP_UTF8ONLY, "utf8only", 0, PROP_ONETIME,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT,
	"on \| off", "UTF8ONLY", boolean_table);

	/* string properties */
	zprop_register_string(ZFS_PROP_ORIGIN, "origin", NULL, PROP_READONLY,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "<snapshot>", "ORIGIN");
	zprop_register_string(ZFS_PROP_CLONES, "clones", NULL, PROP_READONLY,
	ZFS_TYPE_SNAPSHOT, "<dataset>[,...]", "CLONES");
	zprop_register_string(ZFS_PROP_MOUNTPOINT, "mountpoint", "/",
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM, "<path> \| legacy \| none",
	"MOUNTPOINT");
	zprop_register_string(ZFS_PROP_SHARENFS, "sharenfs", "off",
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM, "on \| off \| share(1M) options",
	"SHARENFS");
	zprop_register_string(ZFS_PROP_TYPE, "type", NULL, PROP_READONLY,
	ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK,
	"filesystem \| volume \| snapshot \| bookmark", "TYPE");
	zprop_register_string(ZFS_PROP_SHARESMB, "sharesmb", "off",
	PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
	"on \| off \| sharemgr(1M) options", "SHARESMB");
	zprop_register_string(ZFS_PROP_MLSLABEL, "mlslabel",
	ZFS_MLSLABEL_DEFAULT, PROP_INHERIT, ZFS_TYPE_DATASET,
	"<sensitivity label>", "MLSLABEL");
	zprop_register_string(ZFS_PROP_SELINUX_CONTEXT, "context",
	"none", PROP_DEFAULT, ZFS_TYPE_DATASET, "<selinux context>",
	"CONTEXT");
	zprop_register_string(ZFS_PROP_SELINUX_FSCONTEXT, "fscontext",
	"none", PROP_DEFAULT, ZFS_TYPE_DATASET, "<selinux fscontext>",
	"FSCONTEXT");
	zprop_register_string(ZFS_PROP_SELINUX_DEFCONTEXT, "defcontext",
	"none", PROP_DEFAULT, ZFS_TYPE_DATASET, "<selinux defcontext>",
	"DEFCONTEXT");
	zprop_register_string(ZFS_PROP_SELINUX_ROOTCONTEXT, "rootcontext",
	"none", PROP_DEFAULT, ZFS_TYPE_DATASET, "<selinux rootcontext>",
	"ROOTCONTEXT");
	zprop_register_string(ZFS_PROP_RECEIVE_RESUME_TOKEN,
	"receive_resume_token",
	NULL, PROP_READONLY, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"<string token>", "RESUMETOK");
	zprop_register_string(ZFS_PROP_ENCRYPTION_ROOT, "encryptionroot", NULL,
	PROP_READONLY, ZFS_TYPE_DATASET, "<filesystem \| volume>",
	"ENCROOT");
	zprop_register_string(ZFS_PROP_KEYLOCATION, "keylocation",
	"none", PROP_DEFAULT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"prompt \| <file URI>", "KEYLOCATION");
	zprop_register_string(ZFS_PROP_REDACT_SNAPS,
	"redact_snaps", NULL, PROP_READONLY,
	ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK, "<snapshot>[,...]",
	"RSNAPS");

	/* readonly number properties */
	zprop_register_number(ZFS_PROP_USED, "used", 0, PROP_READONLY,
	ZFS_TYPE_DATASET, "<size>", "USED");
	zprop_register_number(ZFS_PROP_AVAILABLE, "available", 0, PROP_READONLY,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "<size>", "AVAIL");
	zprop_register_number(ZFS_PROP_REFERENCED, "referenced", 0,
	PROP_READONLY, ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK, "<size>",
	"REFER");
	zprop_register_number(ZFS_PROP_COMPRESSRATIO, "compressratio", 0,
	PROP_READONLY, ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK,
	"<1.00x or higher if compressed>", "RATIO");
	zprop_register_number(ZFS_PROP_REFRATIO, "refcompressratio", 0,
	PROP_READONLY, ZFS_TYPE_DATASET,
	"<1.00x or higher if compressed>", "REFRATIO");
	zprop_register_number(ZFS_PROP_VOLBLOCKSIZE, "volblocksize",
	ZVOL_DEFAULT_BLOCKSIZE, PROP_ONETIME,
	ZFS_TYPE_VOLUME, "512 to 128k, power of 2", "VOLBLOCK");
	zprop_register_number(ZFS_PROP_USEDSNAP, "usedbysnapshots", 0,
	PROP_READONLY, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "<size>",
	"USEDSNAP");
	zprop_register_number(ZFS_PROP_USEDDS, "usedbydataset", 0,
	PROP_READONLY, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "<size>",
	"USEDDS");
	zprop_register_number(ZFS_PROP_USEDCHILD, "usedbychildren", 0,
	PROP_READONLY, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "<size>",
	"USEDCHILD");
	zprop_register_number(ZFS_PROP_USEDREFRESERV, "usedbyrefreservation", 0,
	PROP_READONLY,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "<size>", "USEDREFRESERV");
	zprop_register_number(ZFS_PROP_USERREFS, "userrefs", 0, PROP_READONLY,
	ZFS_TYPE_SNAPSHOT, "<count>", "USERREFS");
	zprop_register_number(ZFS_PROP_WRITTEN, "written", 0, PROP_READONLY,
	ZFS_TYPE_DATASET, "<size>", "WRITTEN");
	zprop_register_number(ZFS_PROP_LOGICALUSED, "logicalused", 0,
	PROP_READONLY, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "<size>",
	"LUSED");
	zprop_register_number(ZFS_PROP_LOGICALREFERENCED, "logicalreferenced",
	0, PROP_READONLY, ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK, "<size>",
	"LREFER");
	zprop_register_number(ZFS_PROP_FILESYSTEM_COUNT, "filesystem_count",
	UINT64_MAX, PROP_READONLY, ZFS_TYPE_FILESYSTEM,
	"<count>", "FSCOUNT");
	zprop_register_number(ZFS_PROP_SNAPSHOT_COUNT, "snapshot_count",
	UINT64_MAX, PROP_READONLY, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"<count>", "SSCOUNT");
	zprop_register_number(ZFS_PROP_GUID, "guid", 0, PROP_READONLY,
	ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK, "<uint64>", "GUID");
	zprop_register_number(ZFS_PROP_CREATETXG, "createtxg", 0, PROP_READONLY,
	ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK, "<uint64>", "CREATETXG");
	zprop_register_number(ZFS_PROP_PBKDF2_ITERS, "pbkdf2iters",
	0, PROP_ONETIME_DEFAULT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"<iters>", "PBKDF2ITERS");
	zprop_register_number(ZFS_PROP_OBJSETID, "objsetid", 0,
	PROP_READONLY, ZFS_TYPE_DATASET, "<uint64>", "OBJSETID");

	/* default number properties */
	zprop_register_number(ZFS_PROP_QUOTA, "quota", 0, PROP_DEFAULT,
	ZFS_TYPE_FILESYSTEM, "<size> \| none", "QUOTA");
	zprop_register_number(ZFS_PROP_RESERVATION, "reservation", 0,
	PROP_DEFAULT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"<size> \| none", "RESERV");
	zprop_register_number(ZFS_PROP_VOLSIZE, "volsize", 0, PROP_DEFAULT,
	ZFS_TYPE_SNAPSHOT \| ZFS_TYPE_VOLUME, "<size>", "VOLSIZE");
	zprop_register_number(ZFS_PROP_REFQUOTA, "refquota", 0, PROP_DEFAULT,
	ZFS_TYPE_FILESYSTEM, "<size> \| none", "REFQUOTA");
	zprop_register_number(ZFS_PROP_REFRESERVATION, "refreservation", 0,
	PROP_DEFAULT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"<size> \| none", "REFRESERV");
	zprop_register_number(ZFS_PROP_FILESYSTEM_LIMIT, "filesystem_limit",
	UINT64_MAX, PROP_DEFAULT, ZFS_TYPE_FILESYSTEM,
	"<count> \| none", "FSLIMIT");
	zprop_register_number(ZFS_PROP_SNAPSHOT_LIMIT, "snapshot_limit",
	UINT64_MAX, PROP_DEFAULT, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME,
	"<count> \| none", "SSLIMIT");

	/* inherit number properties */
	zprop_register_number(ZFS_PROP_RECORDSIZE, "recordsize",
	SPA_OLD_MAXBLOCKSIZE, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM, "512 to 1M, power of 2", "RECSIZE");
	zprop_register_number(ZFS_PROP_SPECIAL_SMALL_BLOCKS,
	"special_small_blocks", 0, PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
	"zero or 512 to 1M, power of 2", "SPECIAL_SMALL_BLOCKS");

	/* hidden properties */
	zprop_register_hidden(ZFS_PROP_NUMCLONES, "numclones", PROP_TYPE_NUMBER,
	PROP_READONLY, ZFS_TYPE_SNAPSHOT, "NUMCLONES");
	zprop_register_hidden(ZFS_PROP_NAME, "name", PROP_TYPE_STRING,
	PROP_READONLY, ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK, "NAME");
	zprop_register_hidden(ZFS_PROP_ISCSIOPTIONS, "iscsioptions",
	PROP_TYPE_STRING, PROP_INHERIT, ZFS_TYPE_VOLUME, "ISCSIOPTIONS");
	zprop_register_hidden(ZFS_PROP_STMF_SHAREINFO, "stmf_sbd_lu",
	PROP_TYPE_STRING, PROP_INHERIT, ZFS_TYPE_VOLUME,
	"STMF_SBD_LU");
	zprop_register_hidden(ZFS_PROP_USERACCOUNTING, "useraccounting",
	PROP_TYPE_NUMBER, PROP_READONLY, ZFS_TYPE_DATASET,
	"USERACCOUNTING");
	zprop_register_hidden(ZFS_PROP_UNIQUE, "unique", PROP_TYPE_NUMBER,
	PROP_READONLY, ZFS_TYPE_DATASET, "UNIQUE");
	zprop_register_hidden(ZFS_PROP_INCONSISTENT, "inconsistent",
	PROP_TYPE_NUMBER, PROP_READONLY, ZFS_TYPE_DATASET, "INCONSISTENT");
	zprop_register_hidden(ZFS_PROP_IVSET_GUID, "ivsetguid",
	PROP_TYPE_NUMBER, PROP_READONLY,
	ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK, "IVSETGUID");
	zprop_register_hidden(ZFS_PROP_PREV_SNAP, "prevsnap", PROP_TYPE_STRING,
	PROP_READONLY, ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "PREVSNAP");
	zprop_register_hidden(ZFS_PROP_PBKDF2_SALT, "pbkdf2salt",
	PROP_TYPE_NUMBER, PROP_ONETIME_DEFAULT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_VOLUME, "PBKDF2SALT");
	zprop_register_hidden(ZFS_PROP_KEY_GUID, "keyguid", PROP_TYPE_NUMBER,
	PROP_READONLY, ZFS_TYPE_DATASET, "KEYGUID");
	zprop_register_hidden(ZFS_PROP_REDACTED, "redacted", PROP_TYPE_NUMBER,
	PROP_READONLY, ZFS_TYPE_DATASET, "REDACTED");

	/*
	* Properties that are obsolete and not used. These are retained so
	* that we don't have to change the values of the zfs_prop_t enum, or
	* have NULL pointers in the zfs_prop_table[].
	*/
	#ifdef __FreeBSD__
	zprop_register_impl(ZFS_PROP_ACLTYPE, "acltype", PROP_TYPE_INDEX,
	ZFS_ACLTYPE_OFF, NULL, PROP_INHERIT,
	ZFS_TYPE_FILESYSTEM \| ZFS_TYPE_SNAPSHOT,
	- "noacl \| posixacl", "ACLTYPE", B_FALSE, B_FALSE, acltype_table);
	+ "off \| posix", "ACLTYPE", B_FALSE, B_FALSE, acltype_table);
	#endif
	zprop_register_hidden(ZFS_PROP_REMAPTXG, "remaptxg", PROP_TYPE_NUMBER,
	PROP_READONLY, ZFS_TYPE_DATASET, "REMAPTXG");

	/* oddball properties */
	zprop_register_impl(ZFS_PROP_CREATION, "creation", PROP_TYPE_NUMBER, 0,
	NULL, PROP_READONLY, ZFS_TYPE_DATASET \| ZFS_TYPE_BOOKMARK,
	"<date>", "CREATION", B_FALSE, B_TRUE, NULL);
	}

	boolean_t
	zfs_prop_delegatable(zfs_prop_t prop)
	{
	zprop_desc_t *pd = &zfs_prop_table[prop];

	/* The mlslabel property is never delegatable. */
	if (prop == ZFS_PROP_MLSLABEL)
	return (B_FALSE);

	return (pd->pd_attr != PROP_READONLY);
	}

	/*
	* Given a zfs dataset property name, returns the corresponding property ID.
	*/
	zfs_prop_t
	zfs_name_to_prop(const char *propname)
	{
	return (zprop_name_to_prop(propname, ZFS_TYPE_DATASET));
	}

	/*
	* For user property names, we allow all lowercase alphanumeric characters, plus
	* a few useful punctuation characters.
	*/
	static int
	valid_char(char c)
	{
	return ((c >= 'a' && c <= 'z') \|\|
	(c >= '0' && c <= '9') \|\|
	c == '-' \|\| c == '_' \|\| c == '.' \|\| c == ':');
	}

	/*
	* Returns true if this is a valid user-defined property (one with a ':').
	*/
	boolean_t
	zfs_prop_user(const char *name)
	{
	int i;
	char c;
	boolean_t foundsep = B_FALSE;

	for (i = 0; i < strlen(name); i++) {
	c = name[i];
	if (!valid_char(c))
	return (B_FALSE);
	if (c == ':')
	foundsep = B_TRUE;
	}

	if (!foundsep)
	return (B_FALSE);

	return (B_TRUE);
	}

	/*
	* Returns true if this is a valid userspace-type property (one with a '@').
	* Note that after the @, any character is valid (eg, another @, for SID
	* user@domain).
	*/
	boolean_t
	zfs_prop_userquota(const char *name)
	{
	zfs_userquota_prop_t prop;

	for (prop = 0; prop < ZFS_NUM_USERQUOTA_PROPS; prop++) {
	if (strncmp(name, zfs_userquota_prop_prefixes[prop],
	strlen(zfs_userquota_prop_prefixes[prop])) == 0) {
	return (B_TRUE);
	}
	}

	return (B_FALSE);
	}

	/*
	* Returns true if this is a valid written@ property.
	* Note that after the @, any character is valid (eg, another @, for
	* written@pool/fs@origin).
	*/
	boolean_t
	zfs_prop_written(const char *name)
	{
	static const char *prop_prefix = "written@";
	static const char *book_prefix = "written#";
	return (strncmp(name, prop_prefix, strlen(prop_prefix)) == 0 \|\|
	strncmp(name, book_prefix, strlen(book_prefix)) == 0);
	}

	/*
	* Tables of index types, plus functions to convert between the user view
	* (strings) and internal representation (uint64_t).
	*/
	int
	zfs_prop_string_to_index(zfs_prop_t prop, const char string, uint64_t index)
	{
	return (zprop_string_to_index(prop, string, index, ZFS_TYPE_DATASET));
	}

	int
	zfs_prop_index_to_string(zfs_prop_t prop, uint64_t index, const char **string)
	{
	return (zprop_index_to_string(prop, index, string, ZFS_TYPE_DATASET));
	}

	uint64_t
	zfs_prop_random_value(zfs_prop_t prop, uint64_t seed)
	{
	return (zprop_random_value(prop, seed, ZFS_TYPE_DATASET));
	}

	/*
	* Returns TRUE if the property applies to any of the given dataset types.
	*/
	boolean_t
	zfs_prop_valid_for_type(int prop, zfs_type_t types, boolean_t headcheck)
	{
	return (zprop_valid_for_type(prop, types, headcheck));
	}

	zprop_type_t
	zfs_prop_get_type(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_proptype);
	}

	/*
	* Returns TRUE if the property is readonly.
	*/
	boolean_t
	zfs_prop_readonly(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_attr == PROP_READONLY \|\|
	zfs_prop_table[prop].pd_attr == PROP_ONETIME \|\|
	zfs_prop_table[prop].pd_attr == PROP_ONETIME_DEFAULT);
	}

	/*
	* Returns TRUE if the property is visible (not hidden).
	*/
	boolean_t
	zfs_prop_visible(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_visible &&
	zfs_prop_table[prop].pd_zfs_mod_supported);
	}

	/*
	* Returns TRUE if the property is only allowed to be set once.
	*/
	boolean_t
	zfs_prop_setonce(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_attr == PROP_ONETIME \|\|
	zfs_prop_table[prop].pd_attr == PROP_ONETIME_DEFAULT);
	}

	const char *
	zfs_prop_default_string(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_strdefault);
	}

	uint64_t
	zfs_prop_default_numeric(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_numdefault);
	}

	/*
	* Given a dataset property ID, returns the corresponding name.
	* Assuming the zfs dataset property ID is valid.
	*/
	const char *
	zfs_prop_to_name(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_name);
	}

	/*
	* Returns TRUE if the property is inheritable.
	*/
	boolean_t
	zfs_prop_inheritable(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_attr == PROP_INHERIT \|\|
	zfs_prop_table[prop].pd_attr == PROP_ONETIME);
	}

	/*
	* Returns TRUE if property is one of the encryption properties that requires
	* a loaded encryption key to modify.
	*/
	boolean_t
	zfs_prop_encryption_key_param(zfs_prop_t prop)
	{
	/*
	* keylocation does not count as an encryption property. It can be
	* changed at will without needing the master keys.
	*/
	return (prop == ZFS_PROP_PBKDF2_SALT \|\| prop == ZFS_PROP_PBKDF2_ITERS \|\|
	prop == ZFS_PROP_KEYFORMAT);
	}

	/*
	* Helper function used by both kernelspace and userspace to check the
	* keylocation property. If encrypted is set, the keylocation must be valid
	* for an encrypted dataset.
	*/
	boolean_t
	zfs_prop_valid_keylocation(const char *str, boolean_t encrypted)
	{
	if (strcmp("none", str) == 0)
	return (!encrypted);
	else if (strcmp("prompt", str) == 0)
	return (B_TRUE);
	else if (strlen(str) > 8 && strncmp("file:///", str, 8) == 0)
	return (B_TRUE);

	return (B_FALSE);
	}


	#ifndef _KERNEL
	#include <libzfs.h>

	/*
	* Returns a string describing the set of acceptable values for the given
	* zfs property, or NULL if it cannot be set.
	*/
	const char *
	zfs_prop_values(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_values);
	}

	/*
	* Returns TRUE if this property is a string type. Note that index types
	* (compression, checksum) are treated as strings in userland, even though they
	* are stored numerically on disk.
	*/
	int
	zfs_prop_is_string(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_proptype == PROP_TYPE_STRING \|\|
	zfs_prop_table[prop].pd_proptype == PROP_TYPE_INDEX);
	}

	/*
	* Returns the column header for the given property. Used only in
	* 'zfs list -o', but centralized here with the other property information.
	*/
	const char *
	zfs_prop_column_name(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_colname);
	}

	/*
	* Returns whether the given property should be displayed right-justified for
	* 'zfs list'.
	*/
	boolean_t
	zfs_prop_align_right(zfs_prop_t prop)
	{
	return (zfs_prop_table[prop].pd_rightalign);
	}

	#endif

	#if defined(_KERNEL)

	#include <sys/simd.h>

	#if defined(HAVE_KERNEL_FPU_INTERNAL)
	union fpregs_state **zfs_kfpu_fpregs;
	EXPORT_SYMBOL(zfs_kfpu_fpregs);
	#endif /* HAVE_KERNEL_FPU_INTERNAL */

	static int __init
	zcommon_init(void)
	{
	int error = kfpu_init();
	if (error)
	return (error);

	fletcher_4_init();

	return (0);
	}

	static void __exit
	zcommon_fini(void)
	{
	fletcher_4_fini();
	kfpu_fini();
	}

	module_init(zcommon_init);
	module_exit(zcommon_fini);

	#endif

	ZFS_MODULE_DESCRIPTION("Generic ZFS support");
	ZFS_MODULE_AUTHOR(ZFS_META_AUTHOR);
	ZFS_MODULE_LICENSE(ZFS_META_LICENSE);
	ZFS_MODULE_VERSION(ZFS_META_VERSION "-" ZFS_META_RELEASE);

	/* zfs dataset property functions */
	EXPORT_SYMBOL(zfs_userquota_prop_prefixes);
	EXPORT_SYMBOL(zfs_prop_init);
	EXPORT_SYMBOL(zfs_prop_get_type);
	EXPORT_SYMBOL(zfs_prop_get_table);
	EXPORT_SYMBOL(zfs_prop_delegatable);
	EXPORT_SYMBOL(zfs_prop_visible);

	/* Dataset property functions shared between libzfs and kernel. */
	EXPORT_SYMBOL(zfs_prop_default_string);
	EXPORT_SYMBOL(zfs_prop_default_numeric);
	EXPORT_SYMBOL(zfs_prop_readonly);
	EXPORT_SYMBOL(zfs_prop_inheritable);
	EXPORT_SYMBOL(zfs_prop_encryption_key_param);
	EXPORT_SYMBOL(zfs_prop_valid_keylocation);
	EXPORT_SYMBOL(zfs_prop_setonce);
	EXPORT_SYMBOL(zfs_prop_to_name);
	EXPORT_SYMBOL(zfs_name_to_prop);
	EXPORT_SYMBOL(zfs_prop_user);
	EXPORT_SYMBOL(zfs_prop_userquota);
	EXPORT_SYMBOL(zfs_prop_index_to_string);
	EXPORT_SYMBOL(zfs_prop_string_to_index);
	EXPORT_SYMBOL(zfs_prop_valid_for_type);
	EXPORT_SYMBOL(zfs_prop_written);
	Index: vendor-sys/openzfs/dist/module/zfs/arc.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/arc.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/arc.c (revision 365892)
	@@ -1,10583 +1,10599 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2018, Joyent, Inc.
	- * Copyright (c) 2011, 2019, Delphix. All rights reserved.
	+ * Copyright (c) 2011, 2020, Delphix. All rights reserved.
	* Copyright (c) 2014, Saso Kiselkov. All rights reserved.
	* Copyright (c) 2017, Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2019, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
	* Copyright (c) 2020, George Amanakis. All rights reserved.
	* Copyright (c) 2019, Klara Inc.
	* Copyright (c) 2019, Allan Jude
	* Copyright (c) 2020, The FreeBSD Foundation [1]
	*
	* [1] Portions of this software were developed by Allan Jude
	* under sponsorship from the FreeBSD Foundation.
	*/

	/*
	* DVA-based Adjustable Replacement Cache
	*
	* While much of the theory of operation used here is
	* based on the self-tuning, low overhead replacement cache
	* presented by Megiddo and Modha at FAST 2003, there are some
	* significant differences:
	*
	* 1. The Megiddo and Modha model assumes any page is evictable.
	* Pages in its cache cannot be "locked" into memory. This makes
	* the eviction algorithm simple: evict the last page in the list.
	* This also make the performance characteristics easy to reason
	* about. Our cache is not so simple. At any given moment, some
	* subset of the blocks in the cache are un-evictable because we
	* have handed out a reference to them. Blocks are only evictable
	* when there are no external references active. This makes
	* eviction far more problematic: we choose to evict the evictable
	* blocks that are the "lowest" in the list.
	*
	* There are times when it is not possible to evict the requested
	* space. In these circumstances we are unable to adjust the cache
	* size. To prevent the cache growing unbounded at these times we
	* implement a "cache throttle" that slows the flow of new data
	* into the cache until we can make space available.
	*
	* 2. The Megiddo and Modha model assumes a fixed cache size.
	* Pages are evicted when the cache is full and there is a cache
	* miss. Our model has a variable sized cache. It grows with
	* high use, but also tries to react to memory pressure from the
	* operating system: decreasing its size when system memory is
	* tight.
	*
	* 3. The Megiddo and Modha model assumes a fixed page size. All
	* elements of the cache are therefore exactly the same size. So
	* when adjusting the cache size following a cache miss, its simply
	* a matter of choosing a single page to evict. In our model, we
	* have variable sized cache blocks (ranging from 512 bytes to
	* 128K bytes). We therefore choose a set of blocks to evict to make
	* space for a cache miss that approximates as closely as possible
	* the space used by the new block.
	*
	* See also: "ARC: A Self-Tuning, Low Overhead Replacement Cache"
	* by N. Megiddo & D. Modha, FAST 2003
	*/

	/*
	* The locking model:
	*
	* A new reference to a cache buffer can be obtained in two
	* ways: 1) via a hash table lookup using the DVA as a key,
	* or 2) via one of the ARC lists. The arc_read() interface
	* uses method 1, while the internal ARC algorithms for
	* adjusting the cache use method 2. We therefore provide two
	* types of locks: 1) the hash table lock array, and 2) the
	* ARC list locks.
	*
	* Buffers do not have their own mutexes, rather they rely on the
	* hash table mutexes for the bulk of their protection (i.e. most
	* fields in the arc_buf_hdr_t are protected by these mutexes).
	*
	* buf_hash_find() returns the appropriate mutex (held) when it
	* locates the requested buffer in the hash table. It returns
	* NULL for the mutex if the buffer was not in the table.
	*
	* buf_hash_remove() expects the appropriate hash mutex to be
	* already held before it is invoked.
	*
	* Each ARC state also has a mutex which is used to protect the
	* buffer list associated with the state. When attempting to
	* obtain a hash table lock while holding an ARC list lock you
	* must use: mutex_tryenter() to avoid deadlock. Also note that
	* the active state mutex must be held before the ghost state mutex.
	*
	* It as also possible to register a callback which is run when the
	* arc_meta_limit is reached and no buffers can be safely evicted. In
	* this case the arc user should drop a reference on some arc buffers so
	* they can be reclaimed and the arc_meta_limit honored. For example,
	* when using the ZPL each dentry holds a references on a znode. These
	* dentries must be pruned before the arc buffer holding the znode can
	* be safely evicted.
	*
	* Note that the majority of the performance stats are manipulated
	* with atomic operations.
	*
	* The L2ARC uses the l2ad_mtx on each vdev for the following:
	*
	* - L2ARC buflist creation
	* - L2ARC buflist eviction
	* - L2ARC write completion, which walks L2ARC buflists
	* - ARC header destruction, as it removes from L2ARC buflists
	* - ARC header release, as it removes from L2ARC buflists
	*/

	/*
	* ARC operation:
	*
	* Every block that is in the ARC is tracked by an arc_buf_hdr_t structure.
	* This structure can point either to a block that is still in the cache or to
	* one that is only accessible in an L2 ARC device, or it can provide
	* information about a block that was recently evicted. If a block is
	* only accessible in the L2ARC, then the arc_buf_hdr_t only has enough
	* information to retrieve it from the L2ARC device. This information is
	* stored in the l2arc_buf_hdr_t sub-structure of the arc_buf_hdr_t. A block
	* that is in this state cannot access the data directly.
	*
	* Blocks that are actively being referenced or have not been evicted
	* are cached in the L1ARC. The L1ARC (l1arc_buf_hdr_t) is a structure within
	* the arc_buf_hdr_t that will point to the data block in memory. A block can
	* only be read by a consumer if it has an l1arc_buf_hdr_t. The L1ARC
	* caches data in two ways -- in a list of ARC buffers (arc_buf_t) and
	* also in the arc_buf_hdr_t's private physical data block pointer (b_pabd).
	*
	* The L1ARC's data pointer may or may not be uncompressed. The ARC has the
	* ability to store the physical data (b_pabd) associated with the DVA of the
	* arc_buf_hdr_t. Since the b_pabd is a copy of the on-disk physical block,
	* it will match its on-disk compression characteristics. This behavior can be
	* disabled by setting 'zfs_compressed_arc_enabled' to B_FALSE. When the
	* compressed ARC functionality is disabled, the b_pabd will point to an
	* uncompressed version of the on-disk data.
	*
	* Data in the L1ARC is not accessed by consumers of the ARC directly. Each
	* arc_buf_hdr_t can have multiple ARC buffers (arc_buf_t) which reference it.
	* Each ARC buffer (arc_buf_t) is being actively accessed by a specific ARC
	* consumer. The ARC will provide references to this data and will keep it
	* cached until it is no longer in use. The ARC caches only the L1ARC's physical
	* data block and will evict any arc_buf_t that is no longer referenced. The
	* amount of memory consumed by the arc_buf_ts' data buffers can be seen via the
	* "overhead_size" kstat.
	*
	* Depending on the consumer, an arc_buf_t can be requested in uncompressed or
	* compressed form. The typical case is that consumers will want uncompressed
	* data, and when that happens a new data buffer is allocated where the data is
	* decompressed for them to use. Currently the only consumer who wants
	* compressed arc_buf_t's is "zfs send", when it streams data exactly as it
	* exists on disk. When this happens, the arc_buf_t's data buffer is shared
	* with the arc_buf_hdr_t.
	*
	* Here is a diagram showing an arc_buf_hdr_t referenced by two arc_buf_t's. The
	* first one is owned by a compressed send consumer (and therefore references
	* the same compressed data buffer as the arc_buf_hdr_t) and the second could be
	* used by any other consumer (and has its own uncompressed copy of the data
	* buffer).
	*
	* arc_buf_hdr_t
	* +-----------+
	* \| fields \|
	* \| common to \|
	* \| L1- and \|
	* \| L2ARC \|
	* +-----------+
	* \| l2arc_buf_hdr_t
	* \| \|
	* +-----------+
	* \| l1arc_buf_hdr_t
	* \| \| arc_buf_t
	* \| b_buf +------------>+-----------+ arc_buf_t
	* \| b_pabd +-+ \|b_next +---->+-----------+
	* +-----------+ \| \|-----------\| \|b_next +-->NULL
	* \| \|b_comp = T \| +-----------+
	* \| \|b_data +-+ \|b_comp = F \|
	* \| +-----------+ \| \|b_data +-+
	* +->+------+ \| +-----------+ \|
	* compressed \| \| \| \|
	* data \| \|<--------------+ \| uncompressed
	* +------+ compressed, \| data
	* shared +-->+------+
	* data \| \|
	* \| \|
	* +------+
	*
	* When a consumer reads a block, the ARC must first look to see if the
	* arc_buf_hdr_t is cached. If the hdr is cached then the ARC allocates a new
	* arc_buf_t and either copies uncompressed data into a new data buffer from an
	* existing uncompressed arc_buf_t, decompresses the hdr's b_pabd buffer into a
	* new data buffer, or shares the hdr's b_pabd buffer, depending on whether the
	* hdr is compressed and the desired compression characteristics of the
	* arc_buf_t consumer. If the arc_buf_t ends up sharing data with the
	* arc_buf_hdr_t and both of them are uncompressed then the arc_buf_t must be
	* the last buffer in the hdr's b_buf list, however a shared compressed buf can
	* be anywhere in the hdr's list.
	*
	* The diagram below shows an example of an uncompressed ARC hdr that is
	* sharing its data with an arc_buf_t (note that the shared uncompressed buf is
	* the last element in the buf list):
	*
	* arc_buf_hdr_t
	* +-----------+
	* \| \|
	* \| \|
	* \| \|
	* +-----------+
	* l2arc_buf_hdr_t\| \|
	* \| \|
	* +-----------+
	* l1arc_buf_hdr_t\| \|
	* \| \| arc_buf_t (shared)
	* \| b_buf +------------>+---------+ arc_buf_t
	* \| \| \|b_next +---->+---------+
	* \| b_pabd +-+ \|---------\| \|b_next +-->NULL
	* +-----------+ \| \| \| +---------+
	* \| \|b_data +-+ \| \|
	* \| +---------+ \| \|b_data +-+
	* +->+------+ \| +---------+ \|
	* \| \| \| \|
	* uncompressed \| \| \| \|
	* data +------+ \| \|
	* ^ +->+------+ \|
	* \| uncompressed \| \| \|
	* \| data \| \| \|
	* \| +------+ \|
	* +---------------------------------+
	*
	* Writing to the ARC requires that the ARC first discard the hdr's b_pabd
	* since the physical block is about to be rewritten. The new data contents
	* will be contained in the arc_buf_t. As the I/O pipeline performs the write,
	* it may compress the data before writing it to disk. The ARC will be called
	* with the transformed data and will bcopy the transformed on-disk block into
	* a newly allocated b_pabd. Writes are always done into buffers which have
	* either been loaned (and hence are new and don't have other readers) or
	* buffers which have been released (and hence have their own hdr, if there
	* were originally other readers of the buf's original hdr). This ensures that
	* the ARC only needs to update a single buf and its hdr after a write occurs.
	*
	* When the L2ARC is in use, it will also take advantage of the b_pabd. The
	* L2ARC will always write the contents of b_pabd to the L2ARC. This means
	* that when compressed ARC is enabled that the L2ARC blocks are identical
	* to the on-disk block in the main data pool. This provides a significant
	* advantage since the ARC can leverage the bp's checksum when reading from the
	* L2ARC to determine if the contents are valid. However, if the compressed
	* ARC is disabled, then the L2ARC's block must be transformed to look
	* like the physical block in the main data pool before comparing the
	* checksum and determining its validity.
	*
	* The L1ARC has a slightly different system for storing encrypted data.
	* Raw (encrypted + possibly compressed) data has a few subtle differences from
	* data that is just compressed. The biggest difference is that it is not
	* possible to decrypt encrypted data (or vice-versa) if the keys aren't loaded.
	* The other difference is that encryption cannot be treated as a suggestion.
	* If a caller would prefer compressed data, but they actually wind up with
	* uncompressed data the worst thing that could happen is there might be a
	* performance hit. If the caller requests encrypted data, however, we must be
	* sure they actually get it or else secret information could be leaked. Raw
	* data is stored in hdr->b_crypt_hdr.b_rabd. An encrypted header, therefore,
	* may have both an encrypted version and a decrypted version of its data at
	* once. When a caller needs a raw arc_buf_t, it is allocated and the data is
	* copied out of this header. To avoid complications with b_pabd, raw buffers
	* cannot be shared.
	*/

	#include <sys/spa.h>
	#include <sys/zio.h>
	#include <sys/spa_impl.h>
	#include <sys/zio_compress.h>
	#include <sys/zio_checksum.h>
	#include <sys/zfs_context.h>
	#include <sys/arc.h>
	#include <sys/zfs_refcount.h>
	#include <sys/vdev.h>
	#include <sys/vdev_impl.h>
	#include <sys/dsl_pool.h>
	#include <sys/zio_checksum.h>
	#include <sys/multilist.h>
	#include <sys/abd.h>
	#include <sys/zil.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/callb.h>
	#include <sys/kstat.h>
	#include <sys/zthr.h>
	#include <zfs_fletcher.h>
	#include <sys/arc_impl.h>
	#include <sys/trace_zfs.h>
	#include <sys/aggsum.h>
	#include <cityhash.h>
	#include <sys/vdev_trim.h>

	#ifndef _KERNEL
	/* set with ZFS_DEBUG=watch, to enable watchpoints on frozen buffers */
	boolean_t arc_watch = B_FALSE;
	#endif

	/*
	* This thread's job is to keep enough free memory in the system, by
	* calling arc_kmem_reap_soon() plus arc_reduce_target_size(), which improves
	* arc_available_memory().
	*/
	static zthr_t *arc_reap_zthr;

	/*
	* This thread's job is to keep arc_size under arc_c, by calling
	* arc_evict(), which improves arc_is_overflowing().
	*/
	static zthr_t *arc_evict_zthr;

	static kmutex_t arc_evict_lock;
	static boolean_t arc_evict_needed = B_FALSE;

	/*
	* Count of bytes evicted since boot.
	*/
	static uint64_t arc_evict_count;

	/*
	* List of arc_evict_waiter_t's, representing threads waiting for the
	* arc_evict_count to reach specific values.
	*/
	static list_t arc_evict_waiters;

	/*
	* When arc_is_overflowing(), arc_get_data_impl() waits for this percent of
	* the requested amount of data to be evicted. For example, by default for
	* every 2KB that's evicted, 1KB of it may be "reused" by a new allocation.
	* Since this is above 100%, it ensures that progress is made towards getting
	* arc_size under arc_c. Since this is finite, it ensures that allocations
	* can still happen, even during the potentially long time that arc_size is
	* more than arc_c.
	*/
	int zfs_arc_eviction_pct = 200;

	/*
	* The number of headers to evict in arc_evict_state_impl() before
	* dropping the sublist lock and evicting from another sublist. A lower
	* value means we're more likely to evict the "correct" header (i.e. the
	* oldest header in the arc state), but comes with higher overhead
	* (i.e. more invocations of arc_evict_state_impl()).
	*/
	int zfs_arc_evict_batch_limit = 10;

	/* number of seconds before growing cache again */
	int arc_grow_retry = 5;

	/*
	* Minimum time between calls to arc_kmem_reap_soon().
	*/
	int arc_kmem_cache_reap_retry_ms = 1000;

	/* shift of arc_c for calculating overflow limit in arc_get_data_impl */
	int zfs_arc_overflow_shift = 8;

	/* shift of arc_c for calculating both min and max arc_p */
	int arc_p_min_shift = 4;

	/* log2(fraction of arc to reclaim) */
	int arc_shrink_shift = 7;

	/* percent of pagecache to reclaim arc to */
	#ifdef _KERNEL
	uint_t zfs_arc_pc_percent = 0;
	#endif

	/*
	* log2(fraction of ARC which must be free to allow growing).
	* I.e. If there is less than arc_c >> arc_no_grow_shift free memory,
	* when reading a new block into the ARC, we will evict an equal-sized block
	* from the ARC.
	*
	* This must be less than arc_shrink_shift, so that when we shrink the ARC,
	* we will still not allow it to grow.
	*/
	int arc_no_grow_shift = 5;


	/*
	* minimum lifespan of a prefetch block in clock ticks
	* (initialized in arc_init())
	*/
	static int arc_min_prefetch_ms;
	static int arc_min_prescient_prefetch_ms;

	/*
	* If this percent of memory is free, don't throttle.
	*/
	int arc_lotsfree_percent = 10;

	/*
	* The arc has filled available memory and has now warmed up.
	*/
	boolean_t arc_warm;

	/*
	* These tunables are for performance analysis.
	*/
	unsigned long zfs_arc_max = 0;
	unsigned long zfs_arc_min = 0;
	unsigned long zfs_arc_meta_limit = 0;
	unsigned long zfs_arc_meta_min = 0;
	unsigned long zfs_arc_dnode_limit = 0;
	unsigned long zfs_arc_dnode_reduce_percent = 10;
	int zfs_arc_grow_retry = 0;
	int zfs_arc_shrink_shift = 0;
	int zfs_arc_p_min_shift = 0;
	int zfs_arc_average_blocksize = 8 * 1024; /* 8KB */

	/*
	* ARC dirty data constraints for arc_tempreserve_space() throttle.
	*/
	unsigned long zfs_arc_dirty_limit_percent = 50; /* total dirty data limit */
	unsigned long zfs_arc_anon_limit_percent = 25; /* anon block dirty limit */
	unsigned long zfs_arc_pool_dirty_percent = 20; /* each pool's anon allowance */

	/*
	* Enable or disable compressed arc buffers.
	*/
	int zfs_compressed_arc_enabled = B_TRUE;

	/*
	* ARC will evict meta buffers that exceed arc_meta_limit. This
	* tunable make arc_meta_limit adjustable for different workloads.
	*/
	unsigned long zfs_arc_meta_limit_percent = 75;

	/*
	* Percentage that can be consumed by dnodes of ARC meta buffers.
	*/
	unsigned long zfs_arc_dnode_limit_percent = 10;

	/*
	* These tunables are Linux specific
	*/
	unsigned long zfs_arc_sys_free = 0;
	int zfs_arc_min_prefetch_ms = 0;
	int zfs_arc_min_prescient_prefetch_ms = 0;
	int zfs_arc_p_dampener_disable = 1;
	int zfs_arc_meta_prune = 10000;
	int zfs_arc_meta_strategy = ARC_STRATEGY_META_BALANCED;
	int zfs_arc_meta_adjust_restarts = 4096;
	int zfs_arc_lotsfree_percent = 10;

	/* The 6 states: */
	arc_state_t ARC_anon;
	arc_state_t ARC_mru;
	arc_state_t ARC_mru_ghost;
	arc_state_t ARC_mfu;
	arc_state_t ARC_mfu_ghost;
	arc_state_t ARC_l2c_only;

	arc_stats_t arc_stats = {
	{ "hits", KSTAT_DATA_UINT64 },
	{ "misses", KSTAT_DATA_UINT64 },
	{ "demand_data_hits", KSTAT_DATA_UINT64 },
	{ "demand_data_misses", KSTAT_DATA_UINT64 },
	{ "demand_metadata_hits", KSTAT_DATA_UINT64 },
	{ "demand_metadata_misses", KSTAT_DATA_UINT64 },
	{ "prefetch_data_hits", KSTAT_DATA_UINT64 },
	{ "prefetch_data_misses", KSTAT_DATA_UINT64 },
	{ "prefetch_metadata_hits", KSTAT_DATA_UINT64 },
	{ "prefetch_metadata_misses", KSTAT_DATA_UINT64 },
	{ "mru_hits", KSTAT_DATA_UINT64 },
	{ "mru_ghost_hits", KSTAT_DATA_UINT64 },
	{ "mfu_hits", KSTAT_DATA_UINT64 },
	{ "mfu_ghost_hits", KSTAT_DATA_UINT64 },
	{ "deleted", KSTAT_DATA_UINT64 },
	{ "mutex_miss", KSTAT_DATA_UINT64 },
	{ "access_skip", KSTAT_DATA_UINT64 },
	{ "evict_skip", KSTAT_DATA_UINT64 },
	{ "evict_not_enough", KSTAT_DATA_UINT64 },
	{ "evict_l2_cached", KSTAT_DATA_UINT64 },
	{ "evict_l2_eligible", KSTAT_DATA_UINT64 },
	{ "evict_l2_ineligible", KSTAT_DATA_UINT64 },
	{ "evict_l2_skip", KSTAT_DATA_UINT64 },
	{ "hash_elements", KSTAT_DATA_UINT64 },
	{ "hash_elements_max", KSTAT_DATA_UINT64 },
	{ "hash_collisions", KSTAT_DATA_UINT64 },
	{ "hash_chains", KSTAT_DATA_UINT64 },
	{ "hash_chain_max", KSTAT_DATA_UINT64 },
	{ "p", KSTAT_DATA_UINT64 },
	{ "c", KSTAT_DATA_UINT64 },
	{ "c_min", KSTAT_DATA_UINT64 },
	{ "c_max", KSTAT_DATA_UINT64 },
	{ "size", KSTAT_DATA_UINT64 },
	{ "compressed_size", KSTAT_DATA_UINT64 },
	{ "uncompressed_size", KSTAT_DATA_UINT64 },
	{ "overhead_size", KSTAT_DATA_UINT64 },
	{ "hdr_size", KSTAT_DATA_UINT64 },
	{ "data_size", KSTAT_DATA_UINT64 },
	{ "metadata_size", KSTAT_DATA_UINT64 },
	{ "dbuf_size", KSTAT_DATA_UINT64 },
	{ "dnode_size", KSTAT_DATA_UINT64 },
	{ "bonus_size", KSTAT_DATA_UINT64 },
	#if defined(COMPAT_FREEBSD11)
	{ "other_size", KSTAT_DATA_UINT64 },
	#endif
	{ "anon_size", KSTAT_DATA_UINT64 },
	{ "anon_evictable_data", KSTAT_DATA_UINT64 },
	{ "anon_evictable_metadata", KSTAT_DATA_UINT64 },
	{ "mru_size", KSTAT_DATA_UINT64 },
	{ "mru_evictable_data", KSTAT_DATA_UINT64 },
	{ "mru_evictable_metadata", KSTAT_DATA_UINT64 },
	{ "mru_ghost_size", KSTAT_DATA_UINT64 },
	{ "mru_ghost_evictable_data", KSTAT_DATA_UINT64 },
	{ "mru_ghost_evictable_metadata", KSTAT_DATA_UINT64 },
	{ "mfu_size", KSTAT_DATA_UINT64 },
	{ "mfu_evictable_data", KSTAT_DATA_UINT64 },
	{ "mfu_evictable_metadata", KSTAT_DATA_UINT64 },
	{ "mfu_ghost_size", KSTAT_DATA_UINT64 },
	{ "mfu_ghost_evictable_data", KSTAT_DATA_UINT64 },
	{ "mfu_ghost_evictable_metadata", KSTAT_DATA_UINT64 },
	{ "l2_hits", KSTAT_DATA_UINT64 },
	{ "l2_misses", KSTAT_DATA_UINT64 },
	{ "l2_feeds", KSTAT_DATA_UINT64 },
	{ "l2_rw_clash", KSTAT_DATA_UINT64 },
	{ "l2_read_bytes", KSTAT_DATA_UINT64 },
	{ "l2_write_bytes", KSTAT_DATA_UINT64 },
	{ "l2_writes_sent", KSTAT_DATA_UINT64 },
	{ "l2_writes_done", KSTAT_DATA_UINT64 },
	{ "l2_writes_error", KSTAT_DATA_UINT64 },
	{ "l2_writes_lock_retry", KSTAT_DATA_UINT64 },
	{ "l2_evict_lock_retry", KSTAT_DATA_UINT64 },
	{ "l2_evict_reading", KSTAT_DATA_UINT64 },
	{ "l2_evict_l1cached", KSTAT_DATA_UINT64 },
	{ "l2_free_on_write", KSTAT_DATA_UINT64 },
	{ "l2_abort_lowmem", KSTAT_DATA_UINT64 },
	{ "l2_cksum_bad", KSTAT_DATA_UINT64 },
	{ "l2_io_error", KSTAT_DATA_UINT64 },
	{ "l2_size", KSTAT_DATA_UINT64 },
	{ "l2_asize", KSTAT_DATA_UINT64 },
	{ "l2_hdr_size", KSTAT_DATA_UINT64 },
	{ "l2_log_blk_writes", KSTAT_DATA_UINT64 },
	{ "l2_log_blk_avg_asize", KSTAT_DATA_UINT64 },
	{ "l2_log_blk_asize", KSTAT_DATA_UINT64 },
	{ "l2_log_blk_count", KSTAT_DATA_UINT64 },
	{ "l2_data_to_meta_ratio", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_success", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_unsupported", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_io_errors", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_dh_errors", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_cksum_lb_errors", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_lowmem", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_size", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_asize", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_bufs", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_bufs_precached", KSTAT_DATA_UINT64 },
	{ "l2_rebuild_log_blks", KSTAT_DATA_UINT64 },
	{ "memory_throttle_count", KSTAT_DATA_UINT64 },
	{ "memory_direct_count", KSTAT_DATA_UINT64 },
	{ "memory_indirect_count", KSTAT_DATA_UINT64 },
	{ "memory_all_bytes", KSTAT_DATA_UINT64 },
	{ "memory_free_bytes", KSTAT_DATA_UINT64 },
	{ "memory_available_bytes", KSTAT_DATA_INT64 },
	{ "arc_no_grow", KSTAT_DATA_UINT64 },
	{ "arc_tempreserve", KSTAT_DATA_UINT64 },
	{ "arc_loaned_bytes", KSTAT_DATA_UINT64 },
	{ "arc_prune", KSTAT_DATA_UINT64 },
	{ "arc_meta_used", KSTAT_DATA_UINT64 },
	{ "arc_meta_limit", KSTAT_DATA_UINT64 },
	{ "arc_dnode_limit", KSTAT_DATA_UINT64 },
	{ "arc_meta_max", KSTAT_DATA_UINT64 },
	{ "arc_meta_min", KSTAT_DATA_UINT64 },
	{ "async_upgrade_sync", KSTAT_DATA_UINT64 },
	{ "demand_hit_predictive_prefetch", KSTAT_DATA_UINT64 },
	{ "demand_hit_prescient_prefetch", KSTAT_DATA_UINT64 },
	{ "arc_need_free", KSTAT_DATA_UINT64 },
	{ "arc_sys_free", KSTAT_DATA_UINT64 },
	{ "arc_raw_size", KSTAT_DATA_UINT64 },
	{ "cached_only_in_progress", KSTAT_DATA_UINT64 },
	{ "abd_chunk_waste_size", KSTAT_DATA_UINT64 },
	};

	#define ARCSTAT_MAX(stat, val) { \
	uint64_t m; \
	while ((val) > (m = arc_stats.stat.value.ui64) && \
	(m != atomic_cas_64(&arc_stats.stat.value.ui64, m, (val)))) \
	continue; \
	}

	#define ARCSTAT_MAXSTAT(stat) \
	ARCSTAT_MAX(stat##_max, arc_stats.stat.value.ui64)

	/*
	* We define a macro to allow ARC hits/misses to be easily broken down by
	* two separate conditions, giving a total of four different subtypes for
	* each of hits and misses (so eight statistics total).
	*/
	#define ARCSTAT_CONDSTAT(cond1, stat1, notstat1, cond2, stat2, notstat2, stat) \
	if (cond1) { \
	if (cond2) { \
	ARCSTAT_BUMP(arcstat_##stat1##_##stat2##_##stat); \
	} else { \
	ARCSTAT_BUMP(arcstat_##stat1##_##notstat2##_##stat); \
	} \
	} else { \
	if (cond2) { \
	ARCSTAT_BUMP(arcstat_##notstat1##_##stat2##_##stat); \
	} else { \
	ARCSTAT_BUMP(arcstat_##notstat1##_##notstat2##_##stat);\
	} \
	}

	/*
	* This macro allows us to use kstats as floating averages. Each time we
	* update this kstat, we first factor it and the update value by
	* ARCSTAT_AVG_FACTOR to shrink the new value's contribution to the overall
	* average. This macro assumes that integer loads and stores are atomic, but
	* is not safe for multiple writers updating the kstat in parallel (only the
	* last writer's update will remain).
	*/
	#define ARCSTAT_F_AVG_FACTOR 3
	#define ARCSTAT_F_AVG(stat, value) \
	do { \
	uint64_t x = ARCSTAT(stat); \
	x = x - x / ARCSTAT_F_AVG_FACTOR + \
	(value) / ARCSTAT_F_AVG_FACTOR; \
	ARCSTAT(stat) = x; \
	_NOTE(CONSTCOND) \
	} while (0)

	kstat_t *arc_ksp;
	static arc_state_t *arc_anon;
	static arc_state_t *arc_mru_ghost;
	static arc_state_t *arc_mfu_ghost;
	static arc_state_t *arc_l2c_only;

	arc_state_t *arc_mru;
	arc_state_t *arc_mfu;

	/*
	* There are several ARC variables that are critical to export as kstats --
	* but we don't want to have to grovel around in the kstat whenever we wish to
	* manipulate them. For these variables, we therefore define them to be in
	* terms of the statistic variable. This assures that we are not introducing
	* the possibility of inconsistency by having shadow copies of the variables,
	* while still allowing the code to be readable.
	*/
	#define arc_tempreserve ARCSTAT(arcstat_tempreserve)
	#define arc_loaned_bytes ARCSTAT(arcstat_loaned_bytes)
	#define arc_meta_limit ARCSTAT(arcstat_meta_limit) /* max size for metadata */
	/* max size for dnodes */
	#define arc_dnode_size_limit ARCSTAT(arcstat_dnode_limit)
	#define arc_meta_min ARCSTAT(arcstat_meta_min) /* min size for metadata */
	#define arc_meta_max ARCSTAT(arcstat_meta_max) /* max size of metadata */
	#define arc_need_free ARCSTAT(arcstat_need_free) /* waiting to be evicted */

	/* size of all b_rabd's in entire arc */
	#define arc_raw_size ARCSTAT(arcstat_raw_size)
	/* compressed size of entire arc */
	#define arc_compressed_size ARCSTAT(arcstat_compressed_size)
	/* uncompressed size of entire arc */
	#define arc_uncompressed_size ARCSTAT(arcstat_uncompressed_size)
	/* number of bytes in the arc from arc_buf_t's */
	#define arc_overhead_size ARCSTAT(arcstat_overhead_size)

	/*
	* There are also some ARC variables that we want to export, but that are
	* updated so often that having the canonical representation be the statistic
	* variable causes a performance bottleneck. We want to use aggsum_t's for these
	* instead, but still be able to export the kstat in the same way as before.
	* The solution is to always use the aggsum version, except in the kstat update
	* callback.
	*/
	aggsum_t arc_size;
	aggsum_t arc_meta_used;
	aggsum_t astat_data_size;
	aggsum_t astat_metadata_size;
	aggsum_t astat_dbuf_size;
	aggsum_t astat_dnode_size;
	aggsum_t astat_bonus_size;
	aggsum_t astat_hdr_size;
	aggsum_t astat_l2_hdr_size;
	aggsum_t astat_abd_chunk_waste_size;

	hrtime_t arc_growtime;
	list_t arc_prune_list;
	kmutex_t arc_prune_mtx;
	taskq_t *arc_prune_taskq;

	#define GHOST_STATE(state) \
	((state) == arc_mru_ghost \|\| (state) == arc_mfu_ghost \|\| \
	(state) == arc_l2c_only)

	#define HDR_IN_HASH_TABLE(hdr) ((hdr)->b_flags & ARC_FLAG_IN_HASH_TABLE)
	#define HDR_IO_IN_PROGRESS(hdr) ((hdr)->b_flags & ARC_FLAG_IO_IN_PROGRESS)
	#define HDR_IO_ERROR(hdr) ((hdr)->b_flags & ARC_FLAG_IO_ERROR)
	#define HDR_PREFETCH(hdr) ((hdr)->b_flags & ARC_FLAG_PREFETCH)
	#define HDR_PRESCIENT_PREFETCH(hdr) \
	((hdr)->b_flags & ARC_FLAG_PRESCIENT_PREFETCH)
	#define HDR_COMPRESSION_ENABLED(hdr) \
	((hdr)->b_flags & ARC_FLAG_COMPRESSED_ARC)

	#define HDR_L2CACHE(hdr) ((hdr)->b_flags & ARC_FLAG_L2CACHE)
	#define HDR_L2_READING(hdr) \
	(((hdr)->b_flags & ARC_FLAG_IO_IN_PROGRESS) && \
	((hdr)->b_flags & ARC_FLAG_HAS_L2HDR))
	#define HDR_L2_WRITING(hdr) ((hdr)->b_flags & ARC_FLAG_L2_WRITING)
	#define HDR_L2_EVICTED(hdr) ((hdr)->b_flags & ARC_FLAG_L2_EVICTED)
	#define HDR_L2_WRITE_HEAD(hdr) ((hdr)->b_flags & ARC_FLAG_L2_WRITE_HEAD)
	#define HDR_PROTECTED(hdr) ((hdr)->b_flags & ARC_FLAG_PROTECTED)
	#define HDR_NOAUTH(hdr) ((hdr)->b_flags & ARC_FLAG_NOAUTH)
	#define HDR_SHARED_DATA(hdr) ((hdr)->b_flags & ARC_FLAG_SHARED_DATA)

	#define HDR_ISTYPE_METADATA(hdr) \
	((hdr)->b_flags & ARC_FLAG_BUFC_METADATA)
	#define HDR_ISTYPE_DATA(hdr) (!HDR_ISTYPE_METADATA(hdr))

	#define HDR_HAS_L1HDR(hdr) ((hdr)->b_flags & ARC_FLAG_HAS_L1HDR)
	#define HDR_HAS_L2HDR(hdr) ((hdr)->b_flags & ARC_FLAG_HAS_L2HDR)
	#define HDR_HAS_RABD(hdr) \
	(HDR_HAS_L1HDR(hdr) && HDR_PROTECTED(hdr) && \
	(hdr)->b_crypt_hdr.b_rabd != NULL)
	#define HDR_ENCRYPTED(hdr) \
	(HDR_PROTECTED(hdr) && DMU_OT_IS_ENCRYPTED((hdr)->b_crypt_hdr.b_ot))
	#define HDR_AUTHENTICATED(hdr) \
	(HDR_PROTECTED(hdr) && !DMU_OT_IS_ENCRYPTED((hdr)->b_crypt_hdr.b_ot))

	/* For storing compression mode in b_flags */
	#define HDR_COMPRESS_OFFSET (highbit64(ARC_FLAG_COMPRESS_0) - 1)

	#define HDR_GET_COMPRESS(hdr) ((enum zio_compress)BF32_GET((hdr)->b_flags, \
	HDR_COMPRESS_OFFSET, SPA_COMPRESSBITS))
	#define HDR_SET_COMPRESS(hdr, cmp) BF32_SET((hdr)->b_flags, \
	HDR_COMPRESS_OFFSET, SPA_COMPRESSBITS, (cmp));

	#define ARC_BUF_LAST(buf) ((buf)->b_next == NULL)
	#define ARC_BUF_SHARED(buf) ((buf)->b_flags & ARC_BUF_FLAG_SHARED)
	#define ARC_BUF_COMPRESSED(buf) ((buf)->b_flags & ARC_BUF_FLAG_COMPRESSED)
	#define ARC_BUF_ENCRYPTED(buf) ((buf)->b_flags & ARC_BUF_FLAG_ENCRYPTED)

	/*
	* Other sizes
	*/

	#define HDR_FULL_CRYPT_SIZE ((int64_t)sizeof (arc_buf_hdr_t))
	#define HDR_FULL_SIZE ((int64_t)offsetof(arc_buf_hdr_t, b_crypt_hdr))
	#define HDR_L2ONLY_SIZE ((int64_t)offsetof(arc_buf_hdr_t, b_l1hdr))

	/*
	* Hash table routines
	*/

	#define HT_LOCK_ALIGN 64
	#define HT_LOCK_PAD (P2NPHASE(sizeof (kmutex_t), (HT_LOCK_ALIGN)))

	struct ht_lock {
	kmutex_t ht_lock;
	#ifdef _KERNEL
	unsigned char pad[HT_LOCK_PAD];
	#endif
	};

	#define BUF_LOCKS 8192
	typedef struct buf_hash_table {
	uint64_t ht_mask;
	arc_buf_hdr_t **ht_table;
	struct ht_lock ht_locks[BUF_LOCKS];
	} buf_hash_table_t;

	static buf_hash_table_t buf_hash_table;

	#define BUF_HASH_INDEX(spa, dva, birth) \
	(buf_hash(spa, dva, birth) & buf_hash_table.ht_mask)
	#define BUF_HASH_LOCK_NTRY(idx) (buf_hash_table.ht_locks[idx & (BUF_LOCKS-1)])
	#define BUF_HASH_LOCK(idx) (&(BUF_HASH_LOCK_NTRY(idx).ht_lock))
	#define HDR_LOCK(hdr) \
	(BUF_HASH_LOCK(BUF_HASH_INDEX(hdr->b_spa, &hdr->b_dva, hdr->b_birth)))

	uint64_t zfs_crc64_table[256];

	/*
	* Level 2 ARC
	*/

	#define L2ARC_WRITE_SIZE (8 * 1024 * 1024) /* initial write max */
	#define L2ARC_HEADROOM 2 /* num of writes */

	/*
	* If we discover during ARC scan any buffers to be compressed, we boost
	* our headroom for the next scanning cycle by this percentage multiple.
	*/
	#define L2ARC_HEADROOM_BOOST 200
	#define L2ARC_FEED_SECS 1 /* caching interval secs */
	#define L2ARC_FEED_MIN_MS 200 /* min caching interval ms */

	/*
	* We can feed L2ARC from two states of ARC buffers, mru and mfu,
	* and each of the state has two types: data and metadata.
	*/
	#define L2ARC_FEED_TYPES 4

	#define l2arc_writes_sent ARCSTAT(arcstat_l2_writes_sent)
	#define l2arc_writes_done ARCSTAT(arcstat_l2_writes_done)

	/* L2ARC Performance Tunables */
	unsigned long l2arc_write_max = L2ARC_WRITE_SIZE; /* def max write size */
	unsigned long l2arc_write_boost = L2ARC_WRITE_SIZE; /* extra warmup write */
	unsigned long l2arc_headroom = L2ARC_HEADROOM; /* # of dev writes */
	unsigned long l2arc_headroom_boost = L2ARC_HEADROOM_BOOST;
	unsigned long l2arc_feed_secs = L2ARC_FEED_SECS; /* interval seconds */
	unsigned long l2arc_feed_min_ms = L2ARC_FEED_MIN_MS; /* min interval msecs */
	int l2arc_noprefetch = B_TRUE; /* don't cache prefetch bufs */
	int l2arc_feed_again = B_TRUE; /* turbo warmup */
	int l2arc_norw = B_FALSE; /* no reads during writes */
	int l2arc_meta_percent = 33; /* limit on headers size */

	/*
	* L2ARC Internals
	*/
	static list_t L2ARC_dev_list; /* device list */
	static list_t l2arc_dev_list; / device list pointer */
	static kmutex_t l2arc_dev_mtx; /* device list mutex */
	static l2arc_dev_t l2arc_dev_last; / last device used */
	static list_t L2ARC_free_on_write; /* free after write buf list */
	static list_t l2arc_free_on_write; / free after write list ptr */
	static kmutex_t l2arc_free_on_write_mtx; /* mutex for list */
	static uint64_t l2arc_ndev; /* number of devices */

	typedef struct l2arc_read_callback {
	arc_buf_hdr_t l2rcb_hdr; / read header */
	blkptr_t l2rcb_bp; /* original blkptr */
	zbookmark_phys_t l2rcb_zb; /* original bookmark */
	int l2rcb_flags; /* original flags */
	abd_t l2rcb_abd; / temporary buffer */
	} l2arc_read_callback_t;

	typedef struct l2arc_data_free {
	/* protected by l2arc_free_on_write_mtx */
	abd_t *l2df_abd;
	size_t l2df_size;
	arc_buf_contents_t l2df_type;
	list_node_t l2df_list_node;
	} l2arc_data_free_t;

	typedef enum arc_fill_flags {
	ARC_FILL_LOCKED = 1 << 0, /* hdr lock is held */
	ARC_FILL_COMPRESSED = 1 << 1, /* fill with compressed data */
	ARC_FILL_ENCRYPTED = 1 << 2, /* fill with encrypted data */
	ARC_FILL_NOAUTH = 1 << 3, /* don't attempt to authenticate */
	ARC_FILL_IN_PLACE = 1 << 4 /* fill in place (special case) */
	} arc_fill_flags_t;

	static kmutex_t l2arc_feed_thr_lock;
	static kcondvar_t l2arc_feed_thr_cv;
	static uint8_t l2arc_thread_exit;

	static kmutex_t l2arc_rebuild_thr_lock;
	static kcondvar_t l2arc_rebuild_thr_cv;

	enum arc_hdr_alloc_flags {
	ARC_HDR_ALLOC_RDATA = 0x1,
	ARC_HDR_DO_ADAPT = 0x2,
	};


	static abd_t arc_get_data_abd(arc_buf_hdr_t , uint64_t, void *, boolean_t);
	static void arc_get_data_buf(arc_buf_hdr_t , uint64_t, void *);
	static void arc_get_data_impl(arc_buf_hdr_t , uint64_t, void , boolean_t);
	static void arc_free_data_abd(arc_buf_hdr_t , abd_t , uint64_t, void *);
	static void arc_free_data_buf(arc_buf_hdr_t , void , uint64_t, void *);
	static void arc_free_data_impl(arc_buf_hdr_t hdr, uint64_t size, void tag);
	static void arc_hdr_free_abd(arc_buf_hdr_t *, boolean_t);
	static void arc_hdr_alloc_abd(arc_buf_hdr_t *, int);
	static void arc_access(arc_buf_hdr_t , kmutex_t );
	static void arc_buf_watch(arc_buf_t *);

	static arc_buf_contents_t arc_buf_type(arc_buf_hdr_t *);
	static uint32_t arc_bufc_to_flags(arc_buf_contents_t);
	static inline void arc_hdr_set_flags(arc_buf_hdr_t *hdr, arc_flags_t flags);
	static inline void arc_hdr_clear_flags(arc_buf_hdr_t *hdr, arc_flags_t flags);

	static boolean_t l2arc_write_eligible(uint64_t, arc_buf_hdr_t *);
	static void l2arc_read_done(zio_t *);
	static void l2arc_do_free_on_write(void);

	/*
	+ * l2arc_mfuonly : A ZFS module parameter that controls whether only MFU
	+ * metadata and data are cached from ARC into L2ARC.
	+ */
	+int l2arc_mfuonly = 0;
	+
	+/*
	* L2ARC TRIM
	* l2arc_trim_ahead : A ZFS module parameter that controls how much ahead of
	* the current write size (l2arc_write_max) we should TRIM if we
	* have filled the device. It is defined as a percentage of the
	* write size. If set to 100 we trim twice the space required to
	* accommodate upcoming writes. A minimum of 64MB will be trimmed.
	* It also enables TRIM of the whole L2ARC device upon creation or
	* addition to an existing pool or if the header of the device is
	* invalid upon importing a pool or onlining a cache device. The
	* default is 0, which disables TRIM on L2ARC altogether as it can
	* put significant stress on the underlying storage devices. This
	* will vary depending of how well the specific device handles
	* these commands.
	*/
	unsigned long l2arc_trim_ahead = 0;

	/*
	* Performance tuning of L2ARC persistence:
	*
	* l2arc_rebuild_enabled : A ZFS module parameter that controls whether adding
	* an L2ARC device (either at pool import or later) will attempt
	* to rebuild L2ARC buffer contents.
	* l2arc_rebuild_blocks_min_l2size : A ZFS module parameter that controls
	* whether log blocks are written to the L2ARC device. If the L2ARC
	* device is less than 1GB, the amount of data l2arc_evict()
	* evicts is significant compared to the amount of restored L2ARC
	* data. In this case do not write log blocks in L2ARC in order
	* not to waste space.
	*/
	int l2arc_rebuild_enabled = B_TRUE;
	unsigned long l2arc_rebuild_blocks_min_l2size = 1024 * 1024 * 1024;

	/* L2ARC persistence rebuild control routines. */
	void l2arc_rebuild_vdev(vdev_t *vd, boolean_t reopen);
	static void l2arc_dev_rebuild_thread(void *arg);
	static int l2arc_rebuild(l2arc_dev_t *dev);

	/* L2ARC persistence read I/O routines. */
	static int l2arc_dev_hdr_read(l2arc_dev_t *dev);
	static int l2arc_log_blk_read(l2arc_dev_t *dev,
	const l2arc_log_blkptr_t this_lp, const l2arc_log_blkptr_t next_lp,
	l2arc_log_blk_phys_t this_lb, l2arc_log_blk_phys_t next_lb,
	zio_t this_io, zio_t *next_io);
	static zio_t l2arc_log_blk_fetch(vdev_t vd,
	const l2arc_log_blkptr_t lp, l2arc_log_blk_phys_t lb);
	static void l2arc_log_blk_fetch_abort(zio_t *zio);

	/* L2ARC persistence block restoration routines. */
	static void l2arc_log_blk_restore(l2arc_dev_t *dev,
	const l2arc_log_blk_phys_t *lb, uint64_t lb_asize, uint64_t lb_daddr);
	static void l2arc_hdr_restore(const l2arc_log_ent_phys_t *le,
	l2arc_dev_t *dev);

	/* L2ARC persistence write I/O routines. */
	static void l2arc_log_blk_commit(l2arc_dev_t dev, zio_t pio,
	l2arc_write_callback_t *cb);

	/* L2ARC persistence auxiliary routines. */
	boolean_t l2arc_log_blkptr_valid(l2arc_dev_t *dev,
	const l2arc_log_blkptr_t *lbp);
	static boolean_t l2arc_log_blk_insert(l2arc_dev_t *dev,
	const arc_buf_hdr_t *ab);
	boolean_t l2arc_range_check_overlap(uint64_t bottom,
	uint64_t top, uint64_t check);
	static void l2arc_blk_fetch_done(zio_t *zio);
	static inline uint64_t
	l2arc_log_blk_overhead(uint64_t write_sz, l2arc_dev_t *dev);

	/*
	* We use Cityhash for this. It's fast, and has good hash properties without
	* requiring any large static buffers.
	*/
	static uint64_t
	buf_hash(uint64_t spa, const dva_t *dva, uint64_t birth)
	{
	return (cityhash4(spa, dva->dva_word[0], dva->dva_word[1], birth));
	}

	#define HDR_EMPTY(hdr) \
	((hdr)->b_dva.dva_word[0] == 0 && \
	(hdr)->b_dva.dva_word[1] == 0)

	#define HDR_EMPTY_OR_LOCKED(hdr) \
	(HDR_EMPTY(hdr) \|\| MUTEX_HELD(HDR_LOCK(hdr)))

	#define HDR_EQUAL(spa, dva, birth, hdr) \
	((hdr)->b_dva.dva_word[0] == (dva)->dva_word[0]) && \
	((hdr)->b_dva.dva_word[1] == (dva)->dva_word[1]) && \
	((hdr)->b_birth == birth) && ((hdr)->b_spa == spa)

	static void
	buf_discard_identity(arc_buf_hdr_t *hdr)
	{
	hdr->b_dva.dva_word[0] = 0;
	hdr->b_dva.dva_word[1] = 0;
	hdr->b_birth = 0;
	}

	static arc_buf_hdr_t *
	buf_hash_find(uint64_t spa, const blkptr_t bp, kmutex_t *lockp)
	{
	const dva_t *dva = BP_IDENTITY(bp);
	uint64_t birth = BP_PHYSICAL_BIRTH(bp);
	uint64_t idx = BUF_HASH_INDEX(spa, dva, birth);
	kmutex_t *hash_lock = BUF_HASH_LOCK(idx);
	arc_buf_hdr_t *hdr;

	mutex_enter(hash_lock);
	for (hdr = buf_hash_table.ht_table[idx]; hdr != NULL;
	hdr = hdr->b_hash_next) {
	if (HDR_EQUAL(spa, dva, birth, hdr)) {
	*lockp = hash_lock;
	return (hdr);
	}
	}
	mutex_exit(hash_lock);
	*lockp = NULL;
	return (NULL);
	}

	/*
	* Insert an entry into the hash table. If there is already an element
	* equal to elem in the hash table, then the already existing element
	* will be returned and the new element will not be inserted.
	* Otherwise returns NULL.
	* If lockp == NULL, the caller is assumed to already hold the hash lock.
	*/
	static arc_buf_hdr_t *
	buf_hash_insert(arc_buf_hdr_t hdr, kmutex_t *lockp)
	{
	uint64_t idx = BUF_HASH_INDEX(hdr->b_spa, &hdr->b_dva, hdr->b_birth);
	kmutex_t *hash_lock = BUF_HASH_LOCK(idx);
	arc_buf_hdr_t *fhdr;
	uint32_t i;

	ASSERT(!DVA_IS_EMPTY(&hdr->b_dva));
	ASSERT(hdr->b_birth != 0);
	ASSERT(!HDR_IN_HASH_TABLE(hdr));

	if (lockp != NULL) {
	*lockp = hash_lock;
	mutex_enter(hash_lock);
	} else {
	ASSERT(MUTEX_HELD(hash_lock));
	}

	for (fhdr = buf_hash_table.ht_table[idx], i = 0; fhdr != NULL;
	fhdr = fhdr->b_hash_next, i++) {
	if (HDR_EQUAL(hdr->b_spa, &hdr->b_dva, hdr->b_birth, fhdr))
	return (fhdr);
	}

	hdr->b_hash_next = buf_hash_table.ht_table[idx];
	buf_hash_table.ht_table[idx] = hdr;
	arc_hdr_set_flags(hdr, ARC_FLAG_IN_HASH_TABLE);

	/* collect some hash table performance data */
	if (i > 0) {
	ARCSTAT_BUMP(arcstat_hash_collisions);
	if (i == 1)
	ARCSTAT_BUMP(arcstat_hash_chains);

	ARCSTAT_MAX(arcstat_hash_chain_max, i);
	}

	ARCSTAT_BUMP(arcstat_hash_elements);
	ARCSTAT_MAXSTAT(arcstat_hash_elements);

	return (NULL);
	}

	static void
	buf_hash_remove(arc_buf_hdr_t *hdr)
	{
	arc_buf_hdr_t fhdr, *hdrp;
	uint64_t idx = BUF_HASH_INDEX(hdr->b_spa, &hdr->b_dva, hdr->b_birth);

	ASSERT(MUTEX_HELD(BUF_HASH_LOCK(idx)));
	ASSERT(HDR_IN_HASH_TABLE(hdr));

	hdrp = &buf_hash_table.ht_table[idx];
	while ((fhdr = *hdrp) != hdr) {
	ASSERT3P(fhdr, !=, NULL);
	hdrp = &fhdr->b_hash_next;
	}
	*hdrp = hdr->b_hash_next;
	hdr->b_hash_next = NULL;
	arc_hdr_clear_flags(hdr, ARC_FLAG_IN_HASH_TABLE);

	/* collect some hash table performance data */
	ARCSTAT_BUMPDOWN(arcstat_hash_elements);

	if (buf_hash_table.ht_table[idx] &&
	buf_hash_table.ht_table[idx]->b_hash_next == NULL)
	ARCSTAT_BUMPDOWN(arcstat_hash_chains);
	}

	/*
	* Global data structures and functions for the buf kmem cache.
	*/

	static kmem_cache_t *hdr_full_cache;
	static kmem_cache_t *hdr_full_crypt_cache;
	static kmem_cache_t *hdr_l2only_cache;
	static kmem_cache_t *buf_cache;

	static void
	buf_fini(void)
	{
	int i;

	#if defined(_KERNEL)
	/*
	* Large allocations which do not require contiguous pages
	* should be using vmem_free() in the linux kernel\
	*/
	vmem_free(buf_hash_table.ht_table,
	(buf_hash_table.ht_mask + 1) * sizeof (void *));
	#else
	kmem_free(buf_hash_table.ht_table,
	(buf_hash_table.ht_mask + 1) * sizeof (void *));
	#endif
	for (i = 0; i < BUF_LOCKS; i++)
	mutex_destroy(&buf_hash_table.ht_locks[i].ht_lock);
	kmem_cache_destroy(hdr_full_cache);
	kmem_cache_destroy(hdr_full_crypt_cache);
	kmem_cache_destroy(hdr_l2only_cache);
	kmem_cache_destroy(buf_cache);
	}

	/*
	* Constructor callback - called when the cache is empty
	* and a new buf is requested.
	*/
	/* ARGSUSED */
	static int
	hdr_full_cons(void vbuf, void unused, int kmflag)
	{
	arc_buf_hdr_t *hdr = vbuf;

	bzero(hdr, HDR_FULL_SIZE);
	hdr->b_l1hdr.b_byteswap = DMU_BSWAP_NUMFUNCS;
	cv_init(&hdr->b_l1hdr.b_cv, NULL, CV_DEFAULT, NULL);
	zfs_refcount_create(&hdr->b_l1hdr.b_refcnt);
	mutex_init(&hdr->b_l1hdr.b_freeze_lock, NULL, MUTEX_DEFAULT, NULL);
	list_link_init(&hdr->b_l1hdr.b_arc_node);
	list_link_init(&hdr->b_l2hdr.b_l2node);
	multilist_link_init(&hdr->b_l1hdr.b_arc_node);
	arc_space_consume(HDR_FULL_SIZE, ARC_SPACE_HDRS);

	return (0);
	}

	/* ARGSUSED */
	static int
	hdr_full_crypt_cons(void vbuf, void unused, int kmflag)
	{
	arc_buf_hdr_t *hdr = vbuf;

	hdr_full_cons(vbuf, unused, kmflag);
	bzero(&hdr->b_crypt_hdr, sizeof (hdr->b_crypt_hdr));
	arc_space_consume(sizeof (hdr->b_crypt_hdr), ARC_SPACE_HDRS);

	return (0);
	}

	/* ARGSUSED */
	static int
	hdr_l2only_cons(void vbuf, void unused, int kmflag)
	{
	arc_buf_hdr_t *hdr = vbuf;

	bzero(hdr, HDR_L2ONLY_SIZE);
	arc_space_consume(HDR_L2ONLY_SIZE, ARC_SPACE_L2HDRS);

	return (0);
	}

	/* ARGSUSED */
	static int
	buf_cons(void vbuf, void unused, int kmflag)
	{
	arc_buf_t *buf = vbuf;

	bzero(buf, sizeof (arc_buf_t));
	mutex_init(&buf->b_evict_lock, NULL, MUTEX_DEFAULT, NULL);
	arc_space_consume(sizeof (arc_buf_t), ARC_SPACE_HDRS);

	return (0);
	}

	/*
	* Destructor callback - called when a cached buf is
	* no longer required.
	*/
	/* ARGSUSED */
	static void
	hdr_full_dest(void vbuf, void unused)
	{
	arc_buf_hdr_t *hdr = vbuf;

	ASSERT(HDR_EMPTY(hdr));
	cv_destroy(&hdr->b_l1hdr.b_cv);
	zfs_refcount_destroy(&hdr->b_l1hdr.b_refcnt);
	mutex_destroy(&hdr->b_l1hdr.b_freeze_lock);
	ASSERT(!multilist_link_active(&hdr->b_l1hdr.b_arc_node));
	arc_space_return(HDR_FULL_SIZE, ARC_SPACE_HDRS);
	}

	/* ARGSUSED */
	static void
	hdr_full_crypt_dest(void vbuf, void unused)
	{
	arc_buf_hdr_t *hdr = vbuf;

	hdr_full_dest(vbuf, unused);
	arc_space_return(sizeof (hdr->b_crypt_hdr), ARC_SPACE_HDRS);
	}

	/* ARGSUSED */
	static void
	hdr_l2only_dest(void vbuf, void unused)
	{
	arc_buf_hdr_t *hdr __maybe_unused = vbuf;

	ASSERT(HDR_EMPTY(hdr));
	arc_space_return(HDR_L2ONLY_SIZE, ARC_SPACE_L2HDRS);
	}

	/* ARGSUSED */
	static void
	buf_dest(void vbuf, void unused)
	{
	arc_buf_t *buf = vbuf;

	mutex_destroy(&buf->b_evict_lock);
	arc_space_return(sizeof (arc_buf_t), ARC_SPACE_HDRS);
	}

	static void
	buf_init(void)
	{
	uint64_t *ct = NULL;
	uint64_t hsize = 1ULL << 12;
	int i, j;

	/*
	* The hash table is big enough to fill all of physical memory
	* with an average block size of zfs_arc_average_blocksize (default 8K).
	* By default, the table will take up
	* totalmem * sizeof(void*) / 8K (1MB per GB with 8-byte pointers).
	*/
	while (hsize * zfs_arc_average_blocksize < arc_all_memory())
	hsize <<= 1;
	retry:
	buf_hash_table.ht_mask = hsize - 1;
	#if defined(_KERNEL)
	/*
	* Large allocations which do not require contiguous pages
	* should be using vmem_alloc() in the linux kernel
	*/
	buf_hash_table.ht_table =
	vmem_zalloc(hsize * sizeof (void*), KM_SLEEP);
	#else
	buf_hash_table.ht_table =
	kmem_zalloc(hsize * sizeof (void*), KM_NOSLEEP);
	#endif
	if (buf_hash_table.ht_table == NULL) {
	ASSERT(hsize > (1ULL << 8));
	hsize >>= 1;
	goto retry;
	}

	hdr_full_cache = kmem_cache_create("arc_buf_hdr_t_full", HDR_FULL_SIZE,
	0, hdr_full_cons, hdr_full_dest, NULL, NULL, NULL, 0);
	hdr_full_crypt_cache = kmem_cache_create("arc_buf_hdr_t_full_crypt",
	HDR_FULL_CRYPT_SIZE, 0, hdr_full_crypt_cons, hdr_full_crypt_dest,
	NULL, NULL, NULL, 0);
	hdr_l2only_cache = kmem_cache_create("arc_buf_hdr_t_l2only",
	HDR_L2ONLY_SIZE, 0, hdr_l2only_cons, hdr_l2only_dest, NULL,
	NULL, NULL, 0);
	buf_cache = kmem_cache_create("arc_buf_t", sizeof (arc_buf_t),
	0, buf_cons, buf_dest, NULL, NULL, NULL, 0);

	for (i = 0; i < 256; i++)
	for (ct = zfs_crc64_table + i, *ct = i, j = 8; j > 0; j--)
	ct = (ct >> 1) ^ (-(*ct & 1) & ZFS_CRC64_POLY);

	for (i = 0; i < BUF_LOCKS; i++) {
	mutex_init(&buf_hash_table.ht_locks[i].ht_lock,
	NULL, MUTEX_DEFAULT, NULL);
	}
	}

	#define ARC_MINTIME (hz>>4) /* 62 ms */

	/*
	* This is the size that the buf occupies in memory. If the buf is compressed,
	* it will correspond to the compressed size. You should use this method of
	* getting the buf size unless you explicitly need the logical size.
	*/
	uint64_t
	arc_buf_size(arc_buf_t *buf)
	{
	return (ARC_BUF_COMPRESSED(buf) ?
	HDR_GET_PSIZE(buf->b_hdr) : HDR_GET_LSIZE(buf->b_hdr));
	}

	uint64_t
	arc_buf_lsize(arc_buf_t *buf)
	{
	return (HDR_GET_LSIZE(buf->b_hdr));
	}

	/*
	* This function will return B_TRUE if the buffer is encrypted in memory.
	* This buffer can be decrypted by calling arc_untransform().
	*/
	boolean_t
	arc_is_encrypted(arc_buf_t *buf)
	{
	return (ARC_BUF_ENCRYPTED(buf) != 0);
	}

	/*
	* Returns B_TRUE if the buffer represents data that has not had its MAC
	* verified yet.
	*/
	boolean_t
	arc_is_unauthenticated(arc_buf_t *buf)
	{
	return (HDR_NOAUTH(buf->b_hdr) != 0);
	}

	void
	arc_get_raw_params(arc_buf_t buf, boolean_t byteorder, uint8_t *salt,
	uint8_t iv, uint8_t mac)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	ASSERT(HDR_PROTECTED(hdr));

	bcopy(hdr->b_crypt_hdr.b_salt, salt, ZIO_DATA_SALT_LEN);
	bcopy(hdr->b_crypt_hdr.b_iv, iv, ZIO_DATA_IV_LEN);
	bcopy(hdr->b_crypt_hdr.b_mac, mac, ZIO_DATA_MAC_LEN);
	*byteorder = (hdr->b_l1hdr.b_byteswap == DMU_BSWAP_NUMFUNCS) ?
	ZFS_HOST_BYTEORDER : !ZFS_HOST_BYTEORDER;
	}

	/*
	* Indicates how this buffer is compressed in memory. If it is not compressed
	* the value will be ZIO_COMPRESS_OFF. It can be made normally readable with
	* arc_untransform() as long as it is also unencrypted.
	*/
	enum zio_compress
	arc_get_compression(arc_buf_t *buf)
	{
	return (ARC_BUF_COMPRESSED(buf) ?
	HDR_GET_COMPRESS(buf->b_hdr) : ZIO_COMPRESS_OFF);
	}

	/*
	* Return the compression algorithm used to store this data in the ARC. If ARC
	* compression is enabled or this is an encrypted block, this will be the same
	* as what's used to store it on-disk. Otherwise, this will be ZIO_COMPRESS_OFF.
	*/
	static inline enum zio_compress
	arc_hdr_get_compress(arc_buf_hdr_t *hdr)
	{
	return (HDR_COMPRESSION_ENABLED(hdr) ?
	HDR_GET_COMPRESS(hdr) : ZIO_COMPRESS_OFF);
	}

	uint8_t
	arc_get_complevel(arc_buf_t *buf)
	{
	return (buf->b_hdr->b_complevel);
	}

	static inline boolean_t
	arc_buf_is_shared(arc_buf_t *buf)
	{
	boolean_t shared = (buf->b_data != NULL &&
	buf->b_hdr->b_l1hdr.b_pabd != NULL &&
	abd_is_linear(buf->b_hdr->b_l1hdr.b_pabd) &&
	buf->b_data == abd_to_buf(buf->b_hdr->b_l1hdr.b_pabd));
	IMPLY(shared, HDR_SHARED_DATA(buf->b_hdr));
	IMPLY(shared, ARC_BUF_SHARED(buf));
	IMPLY(shared, ARC_BUF_COMPRESSED(buf) \|\| ARC_BUF_LAST(buf));

	/*
	* It would be nice to assert arc_can_share() too, but the "hdr isn't
	* already being shared" requirement prevents us from doing that.
	*/

	return (shared);
	}

	/*
	* Free the checksum associated with this header. If there is no checksum, this
	* is a no-op.
	*/
	static inline void
	arc_cksum_free(arc_buf_hdr_t *hdr)
	{
	ASSERT(HDR_HAS_L1HDR(hdr));

	mutex_enter(&hdr->b_l1hdr.b_freeze_lock);
	if (hdr->b_l1hdr.b_freeze_cksum != NULL) {
	kmem_free(hdr->b_l1hdr.b_freeze_cksum, sizeof (zio_cksum_t));
	hdr->b_l1hdr.b_freeze_cksum = NULL;
	}
	mutex_exit(&hdr->b_l1hdr.b_freeze_lock);
	}

	/*
	* Return true iff at least one of the bufs on hdr is not compressed.
	* Encrypted buffers count as compressed.
	*/
	static boolean_t
	arc_hdr_has_uncompressed_buf(arc_buf_hdr_t *hdr)
	{
	ASSERT(hdr->b_l1hdr.b_state == arc_anon \|\| HDR_EMPTY_OR_LOCKED(hdr));

	for (arc_buf_t *b = hdr->b_l1hdr.b_buf; b != NULL; b = b->b_next) {
	if (!ARC_BUF_COMPRESSED(b)) {
	return (B_TRUE);
	}
	}
	return (B_FALSE);
	}


	/*
	* If we've turned on the ZFS_DEBUG_MODIFY flag, verify that the buf's data
	* matches the checksum that is stored in the hdr. If there is no checksum,
	* or if the buf is compressed, this is a no-op.
	*/
	static void
	arc_cksum_verify(arc_buf_t *buf)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;
	zio_cksum_t zc;

	if (!(zfs_flags & ZFS_DEBUG_MODIFY))
	return;

	if (ARC_BUF_COMPRESSED(buf))
	return;

	ASSERT(HDR_HAS_L1HDR(hdr));

	mutex_enter(&hdr->b_l1hdr.b_freeze_lock);

	if (hdr->b_l1hdr.b_freeze_cksum == NULL \|\| HDR_IO_ERROR(hdr)) {
	mutex_exit(&hdr->b_l1hdr.b_freeze_lock);
	return;
	}

	fletcher_2_native(buf->b_data, arc_buf_size(buf), NULL, &zc);
	if (!ZIO_CHECKSUM_EQUAL(*hdr->b_l1hdr.b_freeze_cksum, zc))
	panic("buffer modified while frozen!");
	mutex_exit(&hdr->b_l1hdr.b_freeze_lock);
	}

	/*
	* This function makes the assumption that data stored in the L2ARC
	* will be transformed exactly as it is in the main pool. Because of
	* this we can verify the checksum against the reading process's bp.
	*/
	static boolean_t
	arc_cksum_is_equal(arc_buf_hdr_t hdr, zio_t zio)
	{
	ASSERT(!BP_IS_EMBEDDED(zio->io_bp));
	VERIFY3U(BP_GET_PSIZE(zio->io_bp), ==, HDR_GET_PSIZE(hdr));

	/*
	* Block pointers always store the checksum for the logical data.
	* If the block pointer has the gang bit set, then the checksum
	* it represents is for the reconstituted data and not for an
	* individual gang member. The zio pipeline, however, must be able to
	* determine the checksum of each of the gang constituents so it
	* treats the checksum comparison differently than what we need
	* for l2arc blocks. This prevents us from using the
	* zio_checksum_error() interface directly. Instead we must call the
	* zio_checksum_error_impl() so that we can ensure the checksum is
	* generated using the correct checksum algorithm and accounts for the
	* logical I/O size and not just a gang fragment.
	*/
	return (zio_checksum_error_impl(zio->io_spa, zio->io_bp,
	BP_GET_CHECKSUM(zio->io_bp), zio->io_abd, zio->io_size,
	zio->io_offset, NULL) == 0);
	}

	/*
	* Given a buf full of data, if ZFS_DEBUG_MODIFY is enabled this computes a
	* checksum and attaches it to the buf's hdr so that we can ensure that the buf
	* isn't modified later on. If buf is compressed or there is already a checksum
	* on the hdr, this is a no-op (we only checksum uncompressed bufs).
	*/
	static void
	arc_cksum_compute(arc_buf_t *buf)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	if (!(zfs_flags & ZFS_DEBUG_MODIFY))
	return;

	ASSERT(HDR_HAS_L1HDR(hdr));

	mutex_enter(&buf->b_hdr->b_l1hdr.b_freeze_lock);
	if (hdr->b_l1hdr.b_freeze_cksum != NULL \|\| ARC_BUF_COMPRESSED(buf)) {
	mutex_exit(&hdr->b_l1hdr.b_freeze_lock);
	return;
	}

	ASSERT(!ARC_BUF_ENCRYPTED(buf));
	ASSERT(!ARC_BUF_COMPRESSED(buf));
	hdr->b_l1hdr.b_freeze_cksum = kmem_alloc(sizeof (zio_cksum_t),
	KM_SLEEP);
	fletcher_2_native(buf->b_data, arc_buf_size(buf), NULL,
	hdr->b_l1hdr.b_freeze_cksum);
	mutex_exit(&hdr->b_l1hdr.b_freeze_lock);
	arc_buf_watch(buf);
	}

	#ifndef _KERNEL
	void
	arc_buf_sigsegv(int sig, siginfo_t si, void unused)
	{
	panic("Got SIGSEGV at address: 0x%lx\n", (long)si->si_addr);
	}
	#endif

	/* ARGSUSED */
	static void
	arc_buf_unwatch(arc_buf_t *buf)
	{
	#ifndef _KERNEL
	if (arc_watch) {
	ASSERT0(mprotect(buf->b_data, arc_buf_size(buf),
	PROT_READ \| PROT_WRITE));
	}
	#endif
	}

	/* ARGSUSED */
	static void
	arc_buf_watch(arc_buf_t *buf)
	{
	#ifndef _KERNEL
	if (arc_watch)
	ASSERT0(mprotect(buf->b_data, arc_buf_size(buf),
	PROT_READ));
	#endif
	}

	static arc_buf_contents_t
	arc_buf_type(arc_buf_hdr_t *hdr)
	{
	arc_buf_contents_t type;
	if (HDR_ISTYPE_METADATA(hdr)) {
	type = ARC_BUFC_METADATA;
	} else {
	type = ARC_BUFC_DATA;
	}
	VERIFY3U(hdr->b_type, ==, type);
	return (type);
	}

	boolean_t
	arc_is_metadata(arc_buf_t *buf)
	{
	return (HDR_ISTYPE_METADATA(buf->b_hdr) != 0);
	}

	static uint32_t
	arc_bufc_to_flags(arc_buf_contents_t type)
	{
	switch (type) {
	case ARC_BUFC_DATA:
	/* metadata field is 0 if buffer contains normal data */
	return (0);
	case ARC_BUFC_METADATA:
	return (ARC_FLAG_BUFC_METADATA);
	default:
	break;
	}
	panic("undefined ARC buffer type!");
	return ((uint32_t)-1);
	}

	void
	arc_buf_thaw(arc_buf_t *buf)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	ASSERT3P(hdr->b_l1hdr.b_state, ==, arc_anon);
	ASSERT(!HDR_IO_IN_PROGRESS(hdr));

	arc_cksum_verify(buf);

	/*
	* Compressed buffers do not manipulate the b_freeze_cksum.
	*/
	if (ARC_BUF_COMPRESSED(buf))
	return;

	ASSERT(HDR_HAS_L1HDR(hdr));
	arc_cksum_free(hdr);
	arc_buf_unwatch(buf);
	}

	void
	arc_buf_freeze(arc_buf_t *buf)
	{
	if (!(zfs_flags & ZFS_DEBUG_MODIFY))
	return;

	if (ARC_BUF_COMPRESSED(buf))
	return;

	ASSERT(HDR_HAS_L1HDR(buf->b_hdr));
	arc_cksum_compute(buf);
	}

	/*
	* The arc_buf_hdr_t's b_flags should never be modified directly. Instead,
	* the following functions should be used to ensure that the flags are
	* updated in a thread-safe way. When manipulating the flags either
	* the hash_lock must be held or the hdr must be undiscoverable. This
	* ensures that we're not racing with any other threads when updating
	* the flags.
	*/
	static inline void
	arc_hdr_set_flags(arc_buf_hdr_t *hdr, arc_flags_t flags)
	{
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));
	hdr->b_flags \|= flags;
	}

	static inline void
	arc_hdr_clear_flags(arc_buf_hdr_t *hdr, arc_flags_t flags)
	{
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));
	hdr->b_flags &= ~flags;
	}

	/*
	* Setting the compression bits in the arc_buf_hdr_t's b_flags is
	* done in a special way since we have to clear and set bits
	* at the same time. Consumers that wish to set the compression bits
	* must use this function to ensure that the flags are updated in
	* thread-safe manner.
	*/
	static void
	arc_hdr_set_compress(arc_buf_hdr_t *hdr, enum zio_compress cmp)
	{
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));

	/*
	* Holes and embedded blocks will always have a psize = 0 so
	* we ignore the compression of the blkptr and set the
	* want to uncompress them. Mark them as uncompressed.
	*/
	if (!zfs_compressed_arc_enabled \|\| HDR_GET_PSIZE(hdr) == 0) {
	arc_hdr_clear_flags(hdr, ARC_FLAG_COMPRESSED_ARC);
	ASSERT(!HDR_COMPRESSION_ENABLED(hdr));
	} else {
	arc_hdr_set_flags(hdr, ARC_FLAG_COMPRESSED_ARC);
	ASSERT(HDR_COMPRESSION_ENABLED(hdr));
	}

	HDR_SET_COMPRESS(hdr, cmp);
	ASSERT3U(HDR_GET_COMPRESS(hdr), ==, cmp);
	}

	/*
	* Looks for another buf on the same hdr which has the data decompressed, copies
	* from it, and returns true. If no such buf exists, returns false.
	*/
	static boolean_t
	arc_buf_try_copy_decompressed_data(arc_buf_t *buf)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;
	boolean_t copied = B_FALSE;

	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT3P(buf->b_data, !=, NULL);
	ASSERT(!ARC_BUF_COMPRESSED(buf));

	for (arc_buf_t *from = hdr->b_l1hdr.b_buf; from != NULL;
	from = from->b_next) {
	/* can't use our own data buffer */
	if (from == buf) {
	continue;
	}

	if (!ARC_BUF_COMPRESSED(from)) {
	bcopy(from->b_data, buf->b_data, arc_buf_size(buf));
	copied = B_TRUE;
	break;
	}
	}

	/*
	* There were no decompressed bufs, so there should not be a
	* checksum on the hdr either.
	*/
	if (zfs_flags & ZFS_DEBUG_MODIFY)
	EQUIV(!copied, hdr->b_l1hdr.b_freeze_cksum == NULL);

	return (copied);
	}

	/*
	* Allocates an ARC buf header that's in an evicted & L2-cached state.
	* This is used during l2arc reconstruction to make empty ARC buffers
	* which circumvent the regular disk->arc->l2arc path and instead come
	* into being in the reverse order, i.e. l2arc->arc.
	*/
	static arc_buf_hdr_t *
	arc_buf_alloc_l2only(size_t size, arc_buf_contents_t type, l2arc_dev_t *dev,
	dva_t dva, uint64_t daddr, int32_t psize, uint64_t birth,
	enum zio_compress compress, uint8_t complevel, boolean_t protected,
	boolean_t prefetch)
	{
	arc_buf_hdr_t *hdr;

	ASSERT(size != 0);
	hdr = kmem_cache_alloc(hdr_l2only_cache, KM_SLEEP);
	hdr->b_birth = birth;
	hdr->b_type = type;
	hdr->b_flags = 0;
	arc_hdr_set_flags(hdr, arc_bufc_to_flags(type) \| ARC_FLAG_HAS_L2HDR);
	HDR_SET_LSIZE(hdr, size);
	HDR_SET_PSIZE(hdr, psize);
	arc_hdr_set_compress(hdr, compress);
	hdr->b_complevel = complevel;
	if (protected)
	arc_hdr_set_flags(hdr, ARC_FLAG_PROTECTED);
	if (prefetch)
	arc_hdr_set_flags(hdr, ARC_FLAG_PREFETCH);
	hdr->b_spa = spa_load_guid(dev->l2ad_vdev->vdev_spa);

	hdr->b_dva = dva;

	hdr->b_l2hdr.b_dev = dev;
	hdr->b_l2hdr.b_daddr = daddr;

	return (hdr);
	}

	/*
	* Return the size of the block, b_pabd, that is stored in the arc_buf_hdr_t.
	*/
	static uint64_t
	arc_hdr_size(arc_buf_hdr_t *hdr)
	{
	uint64_t size;

	if (arc_hdr_get_compress(hdr) != ZIO_COMPRESS_OFF &&
	HDR_GET_PSIZE(hdr) > 0) {
	size = HDR_GET_PSIZE(hdr);
	} else {
	ASSERT3U(HDR_GET_LSIZE(hdr), !=, 0);
	size = HDR_GET_LSIZE(hdr);
	}
	return (size);
	}

	static int
	arc_hdr_authenticate(arc_buf_hdr_t hdr, spa_t spa, uint64_t dsobj)
	{
	int ret;
	uint64_t csize;
	uint64_t lsize = HDR_GET_LSIZE(hdr);
	uint64_t psize = HDR_GET_PSIZE(hdr);
	void *tmpbuf = NULL;
	abd_t *abd = hdr->b_l1hdr.b_pabd;

	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));
	ASSERT(HDR_AUTHENTICATED(hdr));
	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);

	/*
	* The MAC is calculated on the compressed data that is stored on disk.
	* However, if compressed arc is disabled we will only have the
	* decompressed data available to us now. Compress it into a temporary
	* abd so we can verify the MAC. The performance overhead of this will
	* be relatively low, since most objects in an encrypted objset will
	* be encrypted (instead of authenticated) anyway.
	*/
	if (HDR_GET_COMPRESS(hdr) != ZIO_COMPRESS_OFF &&
	!HDR_COMPRESSION_ENABLED(hdr)) {
	tmpbuf = zio_buf_alloc(lsize);
	abd = abd_get_from_buf(tmpbuf, lsize);
	abd_take_ownership_of_buf(abd, B_TRUE);
	csize = zio_compress_data(HDR_GET_COMPRESS(hdr),
	hdr->b_l1hdr.b_pabd, tmpbuf, lsize, hdr->b_complevel);
	ASSERT3U(csize, <=, psize);
	abd_zero_off(abd, csize, psize - csize);
	}

	/*
	* Authentication is best effort. We authenticate whenever the key is
	* available. If we succeed we clear ARC_FLAG_NOAUTH.
	*/
	if (hdr->b_crypt_hdr.b_ot == DMU_OT_OBJSET) {
	ASSERT3U(HDR_GET_COMPRESS(hdr), ==, ZIO_COMPRESS_OFF);
	ASSERT3U(lsize, ==, psize);
	ret = spa_do_crypt_objset_mac_abd(B_FALSE, spa, dsobj, abd,
	psize, hdr->b_l1hdr.b_byteswap != DMU_BSWAP_NUMFUNCS);
	} else {
	ret = spa_do_crypt_mac_abd(B_FALSE, spa, dsobj, abd, psize,
	hdr->b_crypt_hdr.b_mac);
	}

	if (ret == 0)
	arc_hdr_clear_flags(hdr, ARC_FLAG_NOAUTH);
	else if (ret != ENOENT)
	goto error;

	if (tmpbuf != NULL)
	abd_free(abd);

	return (0);

	error:
	if (tmpbuf != NULL)
	abd_free(abd);

	return (ret);
	}

	/*
	* This function will take a header that only has raw encrypted data in
	* b_crypt_hdr.b_rabd and decrypt it into a new buffer which is stored in
	* b_l1hdr.b_pabd. If designated in the header flags, this function will
	* also decompress the data.
	*/
	static int
	arc_hdr_decrypt(arc_buf_hdr_t hdr, spa_t spa, const zbookmark_phys_t *zb)
	{
	int ret;
	abd_t *cabd = NULL;
	void *tmp = NULL;
	boolean_t no_crypt = B_FALSE;
	boolean_t bswap = (hdr->b_l1hdr.b_byteswap != DMU_BSWAP_NUMFUNCS);

	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));
	ASSERT(HDR_ENCRYPTED(hdr));

	arc_hdr_alloc_abd(hdr, ARC_HDR_DO_ADAPT);

	ret = spa_do_crypt_abd(B_FALSE, spa, zb, hdr->b_crypt_hdr.b_ot,
	B_FALSE, bswap, hdr->b_crypt_hdr.b_salt, hdr->b_crypt_hdr.b_iv,
	hdr->b_crypt_hdr.b_mac, HDR_GET_PSIZE(hdr), hdr->b_l1hdr.b_pabd,
	hdr->b_crypt_hdr.b_rabd, &no_crypt);
	if (ret != 0)
	goto error;

	if (no_crypt) {
	abd_copy(hdr->b_l1hdr.b_pabd, hdr->b_crypt_hdr.b_rabd,
	HDR_GET_PSIZE(hdr));
	}

	/*
	* If this header has disabled arc compression but the b_pabd is
	* compressed after decrypting it, we need to decompress the newly
	* decrypted data.
	*/
	if (HDR_GET_COMPRESS(hdr) != ZIO_COMPRESS_OFF &&
	!HDR_COMPRESSION_ENABLED(hdr)) {
	/*
	* We want to make sure that we are correctly honoring the
	* zfs_abd_scatter_enabled setting, so we allocate an abd here
	* and then loan a buffer from it, rather than allocating a
	* linear buffer and wrapping it in an abd later.
	*/
	cabd = arc_get_data_abd(hdr, arc_hdr_size(hdr), hdr, B_TRUE);
	tmp = abd_borrow_buf(cabd, arc_hdr_size(hdr));

	ret = zio_decompress_data(HDR_GET_COMPRESS(hdr),
	hdr->b_l1hdr.b_pabd, tmp, HDR_GET_PSIZE(hdr),
	HDR_GET_LSIZE(hdr), &hdr->b_complevel);
	if (ret != 0) {
	abd_return_buf(cabd, tmp, arc_hdr_size(hdr));
	goto error;
	}

	abd_return_buf_copy(cabd, tmp, arc_hdr_size(hdr));
	arc_free_data_abd(hdr, hdr->b_l1hdr.b_pabd,
	arc_hdr_size(hdr), hdr);
	hdr->b_l1hdr.b_pabd = cabd;
	}

	return (0);

	error:
	arc_hdr_free_abd(hdr, B_FALSE);
	if (cabd != NULL)
	arc_free_data_buf(hdr, cabd, arc_hdr_size(hdr), hdr);

	return (ret);
	}

	/*
	* This function is called during arc_buf_fill() to prepare the header's
	* abd plaintext pointer for use. This involves authenticated protected
	* data and decrypting encrypted data into the plaintext abd.
	*/
	static int
	arc_fill_hdr_crypt(arc_buf_hdr_t hdr, kmutex_t hash_lock, spa_t *spa,
	const zbookmark_phys_t *zb, boolean_t noauth)
	{
	int ret;

	ASSERT(HDR_PROTECTED(hdr));

	if (hash_lock != NULL)
	mutex_enter(hash_lock);

	if (HDR_NOAUTH(hdr) && !noauth) {
	/*
	* The caller requested authenticated data but our data has
	* not been authenticated yet. Verify the MAC now if we can.
	*/
	ret = arc_hdr_authenticate(hdr, spa, zb->zb_objset);
	if (ret != 0)
	goto error;
	} else if (HDR_HAS_RABD(hdr) && hdr->b_l1hdr.b_pabd == NULL) {
	/*
	* If we only have the encrypted version of the data, but the
	* unencrypted version was requested we take this opportunity
	* to store the decrypted version in the header for future use.
	*/
	ret = arc_hdr_decrypt(hdr, spa, zb);
	if (ret != 0)
	goto error;
	}

	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);

	if (hash_lock != NULL)
	mutex_exit(hash_lock);

	return (0);

	error:
	if (hash_lock != NULL)
	mutex_exit(hash_lock);

	return (ret);
	}

	/*
	* This function is used by the dbuf code to decrypt bonus buffers in place.
	* The dbuf code itself doesn't have any locking for decrypting a shared dnode
	* block, so we use the hash lock here to protect against concurrent calls to
	* arc_buf_fill().
	*/
	static void
	arc_buf_untransform_in_place(arc_buf_t buf, kmutex_t hash_lock)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	ASSERT(HDR_ENCRYPTED(hdr));
	ASSERT3U(hdr->b_crypt_hdr.b_ot, ==, DMU_OT_DNODE);
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));
	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);

	zio_crypt_copy_dnode_bonus(hdr->b_l1hdr.b_pabd, buf->b_data,
	arc_buf_size(buf));
	buf->b_flags &= ~ARC_BUF_FLAG_ENCRYPTED;
	buf->b_flags &= ~ARC_BUF_FLAG_COMPRESSED;
	hdr->b_crypt_hdr.b_ebufcnt -= 1;
	}

	/*
	* Given a buf that has a data buffer attached to it, this function will
	* efficiently fill the buf with data of the specified compression setting from
	* the hdr and update the hdr's b_freeze_cksum if necessary. If the buf and hdr
	* are already sharing a data buf, no copy is performed.
	*
	* If the buf is marked as compressed but uncompressed data was requested, this
	* will allocate a new data buffer for the buf, remove that flag, and fill the
	* buf with uncompressed data. You can't request a compressed buf on a hdr with
	* uncompressed data, and (since we haven't added support for it yet) if you
	* want compressed data your buf must already be marked as compressed and have
	* the correct-sized data buffer.
	*/
	static int
	arc_buf_fill(arc_buf_t buf, spa_t spa, const zbookmark_phys_t *zb,
	arc_fill_flags_t flags)
	{
	int error = 0;
	arc_buf_hdr_t *hdr = buf->b_hdr;
	boolean_t hdr_compressed =
	(arc_hdr_get_compress(hdr) != ZIO_COMPRESS_OFF);
	boolean_t compressed = (flags & ARC_FILL_COMPRESSED) != 0;
	boolean_t encrypted = (flags & ARC_FILL_ENCRYPTED) != 0;
	dmu_object_byteswap_t bswap = hdr->b_l1hdr.b_byteswap;
	kmutex_t *hash_lock = (flags & ARC_FILL_LOCKED) ? NULL : HDR_LOCK(hdr);

	ASSERT3P(buf->b_data, !=, NULL);
	IMPLY(compressed, hdr_compressed \|\| ARC_BUF_ENCRYPTED(buf));
	IMPLY(compressed, ARC_BUF_COMPRESSED(buf));
	IMPLY(encrypted, HDR_ENCRYPTED(hdr));
	IMPLY(encrypted, ARC_BUF_ENCRYPTED(buf));
	IMPLY(encrypted, ARC_BUF_COMPRESSED(buf));
	IMPLY(encrypted, !ARC_BUF_SHARED(buf));

	/*
	* If the caller wanted encrypted data we just need to copy it from
	* b_rabd and potentially byteswap it. We won't be able to do any
	* further transforms on it.
	*/
	if (encrypted) {
	ASSERT(HDR_HAS_RABD(hdr));
	abd_copy_to_buf(buf->b_data, hdr->b_crypt_hdr.b_rabd,
	HDR_GET_PSIZE(hdr));
	goto byteswap;
	}

	/*
	* Adjust encrypted and authenticated headers to accommodate
	* the request if needed. Dnode blocks (ARC_FILL_IN_PLACE) are
	* allowed to fail decryption due to keys not being loaded
	* without being marked as an IO error.
	*/
	if (HDR_PROTECTED(hdr)) {
	error = arc_fill_hdr_crypt(hdr, hash_lock, spa,
	zb, !!(flags & ARC_FILL_NOAUTH));
	if (error == EACCES && (flags & ARC_FILL_IN_PLACE) != 0) {
	return (error);
	} else if (error != 0) {
	if (hash_lock != NULL)
	mutex_enter(hash_lock);
	arc_hdr_set_flags(hdr, ARC_FLAG_IO_ERROR);
	if (hash_lock != NULL)
	mutex_exit(hash_lock);
	return (error);
	}
	}

	/*
	* There is a special case here for dnode blocks which are
	* decrypting their bonus buffers. These blocks may request to
	* be decrypted in-place. This is necessary because there may
	* be many dnodes pointing into this buffer and there is
	* currently no method to synchronize replacing the backing
	* b_data buffer and updating all of the pointers. Here we use
	* the hash lock to ensure there are no races. If the need
	* arises for other types to be decrypted in-place, they must
	* add handling here as well.
	*/
	if ((flags & ARC_FILL_IN_PLACE) != 0) {
	ASSERT(!hdr_compressed);
	ASSERT(!compressed);
	ASSERT(!encrypted);

	if (HDR_ENCRYPTED(hdr) && ARC_BUF_ENCRYPTED(buf)) {
	ASSERT3U(hdr->b_crypt_hdr.b_ot, ==, DMU_OT_DNODE);

	if (hash_lock != NULL)
	mutex_enter(hash_lock);
	arc_buf_untransform_in_place(buf, hash_lock);
	if (hash_lock != NULL)
	mutex_exit(hash_lock);

	/* Compute the hdr's checksum if necessary */
	arc_cksum_compute(buf);
	}

	return (0);
	}

	if (hdr_compressed == compressed) {
	if (!arc_buf_is_shared(buf)) {
	abd_copy_to_buf(buf->b_data, hdr->b_l1hdr.b_pabd,
	arc_buf_size(buf));
	}
	} else {
	ASSERT(hdr_compressed);
	ASSERT(!compressed);
	ASSERT3U(HDR_GET_LSIZE(hdr), !=, HDR_GET_PSIZE(hdr));

	/*
	* If the buf is sharing its data with the hdr, unlink it and
	* allocate a new data buffer for the buf.
	*/
	if (arc_buf_is_shared(buf)) {
	ASSERT(ARC_BUF_COMPRESSED(buf));

	/* We need to give the buf its own b_data */
	buf->b_flags &= ~ARC_BUF_FLAG_SHARED;
	buf->b_data =
	arc_get_data_buf(hdr, HDR_GET_LSIZE(hdr), buf);
	arc_hdr_clear_flags(hdr, ARC_FLAG_SHARED_DATA);

	/* Previously overhead was 0; just add new overhead */
	ARCSTAT_INCR(arcstat_overhead_size, HDR_GET_LSIZE(hdr));
	} else if (ARC_BUF_COMPRESSED(buf)) {
	/* We need to reallocate the buf's b_data */
	arc_free_data_buf(hdr, buf->b_data, HDR_GET_PSIZE(hdr),
	buf);
	buf->b_data =
	arc_get_data_buf(hdr, HDR_GET_LSIZE(hdr), buf);

	/* We increased the size of b_data; update overhead */
	ARCSTAT_INCR(arcstat_overhead_size,
	HDR_GET_LSIZE(hdr) - HDR_GET_PSIZE(hdr));
	}

	/*
	* Regardless of the buf's previous compression settings, it
	* should not be compressed at the end of this function.
	*/
	buf->b_flags &= ~ARC_BUF_FLAG_COMPRESSED;

	/*
	* Try copying the data from another buf which already has a
	* decompressed version. If that's not possible, it's time to
	* bite the bullet and decompress the data from the hdr.
	*/
	if (arc_buf_try_copy_decompressed_data(buf)) {
	/* Skip byteswapping and checksumming (already done) */
	return (0);
	} else {
	error = zio_decompress_data(HDR_GET_COMPRESS(hdr),
	hdr->b_l1hdr.b_pabd, buf->b_data,
	HDR_GET_PSIZE(hdr), HDR_GET_LSIZE(hdr),
	&hdr->b_complevel);

	/*
	* Absent hardware errors or software bugs, this should
	* be impossible, but log it anyway so we can debug it.
	*/
	if (error != 0) {
	zfs_dbgmsg(
	"hdr %px, compress %d, psize %d, lsize %d",
	hdr, arc_hdr_get_compress(hdr),
	HDR_GET_PSIZE(hdr), HDR_GET_LSIZE(hdr));
	if (hash_lock != NULL)
	mutex_enter(hash_lock);
	arc_hdr_set_flags(hdr, ARC_FLAG_IO_ERROR);
	if (hash_lock != NULL)
	mutex_exit(hash_lock);
	return (SET_ERROR(EIO));
	}
	}
	}

	byteswap:
	/* Byteswap the buf's data if necessary */
	if (bswap != DMU_BSWAP_NUMFUNCS) {
	ASSERT(!HDR_SHARED_DATA(hdr));
	ASSERT3U(bswap, <, DMU_BSWAP_NUMFUNCS);
	dmu_ot_byteswap[bswap].ob_func(buf->b_data, HDR_GET_LSIZE(hdr));
	}

	/* Compute the hdr's checksum if necessary */
	arc_cksum_compute(buf);

	return (0);
	}

	/*
	* If this function is being called to decrypt an encrypted buffer or verify an
	* authenticated one, the key must be loaded and a mapping must be made
	* available in the keystore via spa_keystore_create_mapping() or one of its
	* callers.
	*/
	int
	arc_untransform(arc_buf_t buf, spa_t spa, const zbookmark_phys_t *zb,
	boolean_t in_place)
	{
	int ret;
	arc_fill_flags_t flags = 0;

	if (in_place)
	flags \|= ARC_FILL_IN_PLACE;

	ret = arc_buf_fill(buf, spa, zb, flags);
	if (ret == ECKSUM) {
	/*
	* Convert authentication and decryption errors to EIO
	* (and generate an ereport) before leaving the ARC.
	*/
	ret = SET_ERROR(EIO);
	spa_log_error(spa, zb);
	(void) zfs_ereport_post(FM_EREPORT_ZFS_AUTHENTICATION,
	- spa, NULL, zb, NULL, 0, 0);
	+ spa, NULL, zb, NULL, 0);
	}

	return (ret);
	}

	/*
	* Increment the amount of evictable space in the arc_state_t's refcount.
	* We account for the space used by the hdr and the arc buf individually
	* so that we can add and remove them from the refcount individually.
	*/
	static void
	arc_evictable_space_increment(arc_buf_hdr_t hdr, arc_state_t state)
	{
	arc_buf_contents_t type = arc_buf_type(hdr);

	ASSERT(HDR_HAS_L1HDR(hdr));

	if (GHOST_STATE(state)) {
	ASSERT0(hdr->b_l1hdr.b_bufcnt);
	ASSERT3P(hdr->b_l1hdr.b_buf, ==, NULL);
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!HDR_HAS_RABD(hdr));
	(void) zfs_refcount_add_many(&state->arcs_esize[type],
	HDR_GET_LSIZE(hdr), hdr);
	return;
	}

	ASSERT(!GHOST_STATE(state));
	if (hdr->b_l1hdr.b_pabd != NULL) {
	(void) zfs_refcount_add_many(&state->arcs_esize[type],
	arc_hdr_size(hdr), hdr);
	}
	if (HDR_HAS_RABD(hdr)) {
	(void) zfs_refcount_add_many(&state->arcs_esize[type],
	HDR_GET_PSIZE(hdr), hdr);
	}

	for (arc_buf_t *buf = hdr->b_l1hdr.b_buf; buf != NULL;
	buf = buf->b_next) {
	if (arc_buf_is_shared(buf))
	continue;
	(void) zfs_refcount_add_many(&state->arcs_esize[type],
	arc_buf_size(buf), buf);
	}
	}

	/*
	* Decrement the amount of evictable space in the arc_state_t's refcount.
	* We account for the space used by the hdr and the arc buf individually
	* so that we can add and remove them from the refcount individually.
	*/
	static void
	arc_evictable_space_decrement(arc_buf_hdr_t hdr, arc_state_t state)
	{
	arc_buf_contents_t type = arc_buf_type(hdr);

	ASSERT(HDR_HAS_L1HDR(hdr));

	if (GHOST_STATE(state)) {
	ASSERT0(hdr->b_l1hdr.b_bufcnt);
	ASSERT3P(hdr->b_l1hdr.b_buf, ==, NULL);
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!HDR_HAS_RABD(hdr));
	(void) zfs_refcount_remove_many(&state->arcs_esize[type],
	HDR_GET_LSIZE(hdr), hdr);
	return;
	}

	ASSERT(!GHOST_STATE(state));
	if (hdr->b_l1hdr.b_pabd != NULL) {
	(void) zfs_refcount_remove_many(&state->arcs_esize[type],
	arc_hdr_size(hdr), hdr);
	}
	if (HDR_HAS_RABD(hdr)) {
	(void) zfs_refcount_remove_many(&state->arcs_esize[type],
	HDR_GET_PSIZE(hdr), hdr);
	}

	for (arc_buf_t *buf = hdr->b_l1hdr.b_buf; buf != NULL;
	buf = buf->b_next) {
	if (arc_buf_is_shared(buf))
	continue;
	(void) zfs_refcount_remove_many(&state->arcs_esize[type],
	arc_buf_size(buf), buf);
	}
	}

	/*
	* Add a reference to this hdr indicating that someone is actively
	* referencing that memory. When the refcount transitions from 0 to 1,
	* we remove it from the respective arc_state_t list to indicate that
	* it is not evictable.
	*/
	static void
	add_reference(arc_buf_hdr_t hdr, void tag)
	{
	arc_state_t *state;

	ASSERT(HDR_HAS_L1HDR(hdr));
	if (!HDR_EMPTY(hdr) && !MUTEX_HELD(HDR_LOCK(hdr))) {
	ASSERT(hdr->b_l1hdr.b_state == arc_anon);
	ASSERT(zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt));
	ASSERT3P(hdr->b_l1hdr.b_buf, ==, NULL);
	}

	state = hdr->b_l1hdr.b_state;

	if ((zfs_refcount_add(&hdr->b_l1hdr.b_refcnt, tag) == 1) &&
	(state != arc_anon)) {
	/* We don't use the L2-only state list. */
	if (state != arc_l2c_only) {
	multilist_remove(state->arcs_list[arc_buf_type(hdr)],
	hdr);
	arc_evictable_space_decrement(hdr, state);
	}
	/* remove the prefetch flag if we get a reference */
	arc_hdr_clear_flags(hdr, ARC_FLAG_PREFETCH);
	}
	}

	/*
	* Remove a reference from this hdr. When the reference transitions from
	* 1 to 0 and we're not anonymous, then we add this hdr to the arc_state_t's
	* list making it eligible for eviction.
	*/
	static int
	remove_reference(arc_buf_hdr_t hdr, kmutex_t hash_lock, void *tag)
	{
	int cnt;
	arc_state_t *state = hdr->b_l1hdr.b_state;

	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT(state == arc_anon \|\| MUTEX_HELD(hash_lock));
	ASSERT(!GHOST_STATE(state));

	/*
	* arc_l2c_only counts as a ghost state so we don't need to explicitly
	* check to prevent usage of the arc_l2c_only list.
	*/
	if (((cnt = zfs_refcount_remove(&hdr->b_l1hdr.b_refcnt, tag)) == 0) &&
	(state != arc_anon)) {
	multilist_insert(state->arcs_list[arc_buf_type(hdr)], hdr);
	ASSERT3U(hdr->b_l1hdr.b_bufcnt, >, 0);
	arc_evictable_space_increment(hdr, state);
	}
	return (cnt);
	}

	/*
	* Returns detailed information about a specific arc buffer. When the
	* state_index argument is set the function will calculate the arc header
	* list position for its arc state. Since this requires a linear traversal
	* callers are strongly encourage not to do this. However, it can be helpful
	* for targeted analysis so the functionality is provided.
	*/
	void
	arc_buf_info(arc_buf_t ab, arc_buf_info_t abi, int state_index)
	{
	arc_buf_hdr_t *hdr = ab->b_hdr;
	l1arc_buf_hdr_t *l1hdr = NULL;
	l2arc_buf_hdr_t *l2hdr = NULL;
	arc_state_t *state = NULL;

	memset(abi, 0, sizeof (arc_buf_info_t));

	if (hdr == NULL)
	return;

	abi->abi_flags = hdr->b_flags;

	if (HDR_HAS_L1HDR(hdr)) {
	l1hdr = &hdr->b_l1hdr;
	state = l1hdr->b_state;
	}
	if (HDR_HAS_L2HDR(hdr))
	l2hdr = &hdr->b_l2hdr;

	if (l1hdr) {
	abi->abi_bufcnt = l1hdr->b_bufcnt;
	abi->abi_access = l1hdr->b_arc_access;
	abi->abi_mru_hits = l1hdr->b_mru_hits;
	abi->abi_mru_ghost_hits = l1hdr->b_mru_ghost_hits;
	abi->abi_mfu_hits = l1hdr->b_mfu_hits;
	abi->abi_mfu_ghost_hits = l1hdr->b_mfu_ghost_hits;
	abi->abi_holds = zfs_refcount_count(&l1hdr->b_refcnt);
	}

	if (l2hdr) {
	abi->abi_l2arc_dattr = l2hdr->b_daddr;
	abi->abi_l2arc_hits = l2hdr->b_hits;
	}

	abi->abi_state_type = state ? state->arcs_state : ARC_STATE_ANON;
	abi->abi_state_contents = arc_buf_type(hdr);
	abi->abi_size = arc_hdr_size(hdr);
	}

	/*
	* Move the supplied buffer to the indicated state. The hash lock
	* for the buffer must be held by the caller.
	*/
	static void
	arc_change_state(arc_state_t new_state, arc_buf_hdr_t hdr,
	kmutex_t *hash_lock)
	{
	arc_state_t *old_state;
	int64_t refcnt;
	uint32_t bufcnt;
	boolean_t update_old, update_new;
	arc_buf_contents_t buftype = arc_buf_type(hdr);

	/*
	* We almost always have an L1 hdr here, since we call arc_hdr_realloc()
	* in arc_read() when bringing a buffer out of the L2ARC. However, the
	* L1 hdr doesn't always exist when we change state to arc_anon before
	* destroying a header, in which case reallocating to add the L1 hdr is
	* pointless.
	*/
	if (HDR_HAS_L1HDR(hdr)) {
	old_state = hdr->b_l1hdr.b_state;
	refcnt = zfs_refcount_count(&hdr->b_l1hdr.b_refcnt);
	bufcnt = hdr->b_l1hdr.b_bufcnt;
	update_old = (bufcnt > 0 \|\| hdr->b_l1hdr.b_pabd != NULL \|\|
	HDR_HAS_RABD(hdr));
	} else {
	old_state = arc_l2c_only;
	refcnt = 0;
	bufcnt = 0;
	update_old = B_FALSE;
	}
	update_new = update_old;

	ASSERT(MUTEX_HELD(hash_lock));
	ASSERT3P(new_state, !=, old_state);
	ASSERT(!GHOST_STATE(new_state) \|\| bufcnt == 0);
	ASSERT(old_state != arc_anon \|\| bufcnt <= 1);

	/*
	* If this buffer is evictable, transfer it from the
	* old state list to the new state list.
	*/
	if (refcnt == 0) {
	if (old_state != arc_anon && old_state != arc_l2c_only) {
	ASSERT(HDR_HAS_L1HDR(hdr));
	multilist_remove(old_state->arcs_list[buftype], hdr);

	if (GHOST_STATE(old_state)) {
	ASSERT0(bufcnt);
	ASSERT3P(hdr->b_l1hdr.b_buf, ==, NULL);
	update_old = B_TRUE;
	}
	arc_evictable_space_decrement(hdr, old_state);
	}
	if (new_state != arc_anon && new_state != arc_l2c_only) {
	/*
	* An L1 header always exists here, since if we're
	* moving to some L1-cached state (i.e. not l2c_only or
	* anonymous), we realloc the header to add an L1hdr
	* beforehand.
	*/
	ASSERT(HDR_HAS_L1HDR(hdr));
	multilist_insert(new_state->arcs_list[buftype], hdr);

	if (GHOST_STATE(new_state)) {
	ASSERT0(bufcnt);
	ASSERT3P(hdr->b_l1hdr.b_buf, ==, NULL);
	update_new = B_TRUE;
	}
	arc_evictable_space_increment(hdr, new_state);
	}
	}

	ASSERT(!HDR_EMPTY(hdr));
	if (new_state == arc_anon && HDR_IN_HASH_TABLE(hdr))
	buf_hash_remove(hdr);

	/* adjust state sizes (ignore arc_l2c_only) */

	if (update_new && new_state != arc_l2c_only) {
	ASSERT(HDR_HAS_L1HDR(hdr));
	if (GHOST_STATE(new_state)) {
	ASSERT0(bufcnt);

	/*
	* When moving a header to a ghost state, we first
	* remove all arc buffers. Thus, we'll have a
	* bufcnt of zero, and no arc buffer to use for
	* the reference. As a result, we use the arc
	* header pointer for the reference.
	*/
	(void) zfs_refcount_add_many(&new_state->arcs_size,
	HDR_GET_LSIZE(hdr), hdr);
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!HDR_HAS_RABD(hdr));
	} else {
	uint32_t buffers = 0;

	/*
	* Each individual buffer holds a unique reference,
	* thus we must remove each of these references one
	* at a time.
	*/
	for (arc_buf_t *buf = hdr->b_l1hdr.b_buf; buf != NULL;
	buf = buf->b_next) {
	ASSERT3U(bufcnt, !=, 0);
	buffers++;

	/*
	* When the arc_buf_t is sharing the data
	* block with the hdr, the owner of the
	* reference belongs to the hdr. Only
	* add to the refcount if the arc_buf_t is
	* not shared.
	*/
	if (arc_buf_is_shared(buf))
	continue;

	(void) zfs_refcount_add_many(
	&new_state->arcs_size,
	arc_buf_size(buf), buf);
	}
	ASSERT3U(bufcnt, ==, buffers);

	if (hdr->b_l1hdr.b_pabd != NULL) {
	(void) zfs_refcount_add_many(
	&new_state->arcs_size,
	arc_hdr_size(hdr), hdr);
	}

	if (HDR_HAS_RABD(hdr)) {
	(void) zfs_refcount_add_many(
	&new_state->arcs_size,
	HDR_GET_PSIZE(hdr), hdr);
	}
	}
	}

	if (update_old && old_state != arc_l2c_only) {
	ASSERT(HDR_HAS_L1HDR(hdr));
	if (GHOST_STATE(old_state)) {
	ASSERT0(bufcnt);
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!HDR_HAS_RABD(hdr));

	/*
	* When moving a header off of a ghost state,
	* the header will not contain any arc buffers.
	* We use the arc header pointer for the reference
	* which is exactly what we did when we put the
	* header on the ghost state.
	*/

	(void) zfs_refcount_remove_many(&old_state->arcs_size,
	HDR_GET_LSIZE(hdr), hdr);
	} else {
	uint32_t buffers = 0;

	/*
	* Each individual buffer holds a unique reference,
	* thus we must remove each of these references one
	* at a time.
	*/
	for (arc_buf_t *buf = hdr->b_l1hdr.b_buf; buf != NULL;
	buf = buf->b_next) {
	ASSERT3U(bufcnt, !=, 0);
	buffers++;

	/*
	* When the arc_buf_t is sharing the data
	* block with the hdr, the owner of the
	* reference belongs to the hdr. Only
	* add to the refcount if the arc_buf_t is
	* not shared.
	*/
	if (arc_buf_is_shared(buf))
	continue;

	(void) zfs_refcount_remove_many(
	&old_state->arcs_size, arc_buf_size(buf),
	buf);
	}
	ASSERT3U(bufcnt, ==, buffers);
	ASSERT(hdr->b_l1hdr.b_pabd != NULL \|\|
	HDR_HAS_RABD(hdr));

	if (hdr->b_l1hdr.b_pabd != NULL) {
	(void) zfs_refcount_remove_many(
	&old_state->arcs_size, arc_hdr_size(hdr),
	hdr);
	}

	if (HDR_HAS_RABD(hdr)) {
	(void) zfs_refcount_remove_many(
	&old_state->arcs_size, HDR_GET_PSIZE(hdr),
	hdr);
	}
	}
	}

	if (HDR_HAS_L1HDR(hdr))
	hdr->b_l1hdr.b_state = new_state;

	/*
	* L2 headers should never be on the L2 state list since they don't
	* have L1 headers allocated.
	*/
	ASSERT(multilist_is_empty(arc_l2c_only->arcs_list[ARC_BUFC_DATA]) &&
	multilist_is_empty(arc_l2c_only->arcs_list[ARC_BUFC_METADATA]));
	}

	void
	arc_space_consume(uint64_t space, arc_space_type_t type)
	{
	ASSERT(type >= 0 && type < ARC_SPACE_NUMTYPES);

	switch (type) {
	default:
	break;
	case ARC_SPACE_DATA:
	aggsum_add(&astat_data_size, space);
	break;
	case ARC_SPACE_META:
	aggsum_add(&astat_metadata_size, space);
	break;
	case ARC_SPACE_BONUS:
	aggsum_add(&astat_bonus_size, space);
	break;
	case ARC_SPACE_DNODE:
	aggsum_add(&astat_dnode_size, space);
	break;
	case ARC_SPACE_DBUF:
	aggsum_add(&astat_dbuf_size, space);
	break;
	case ARC_SPACE_HDRS:
	aggsum_add(&astat_hdr_size, space);
	break;
	case ARC_SPACE_L2HDRS:
	aggsum_add(&astat_l2_hdr_size, space);
	break;
	case ARC_SPACE_ABD_CHUNK_WASTE:
	/*
	* Note: this includes space wasted by all scatter ABD's, not
	* just those allocated by the ARC. But the vast majority of
	* scatter ABD's come from the ARC, because other users are
	* very short-lived.
	*/
	aggsum_add(&astat_abd_chunk_waste_size, space);
	break;
	}

	if (type != ARC_SPACE_DATA && type != ARC_SPACE_ABD_CHUNK_WASTE)
	aggsum_add(&arc_meta_used, space);

	aggsum_add(&arc_size, space);
	}

	void
	arc_space_return(uint64_t space, arc_space_type_t type)
	{
	ASSERT(type >= 0 && type < ARC_SPACE_NUMTYPES);

	switch (type) {
	default:
	break;
	case ARC_SPACE_DATA:
	aggsum_add(&astat_data_size, -space);
	break;
	case ARC_SPACE_META:
	aggsum_add(&astat_metadata_size, -space);
	break;
	case ARC_SPACE_BONUS:
	aggsum_add(&astat_bonus_size, -space);
	break;
	case ARC_SPACE_DNODE:
	aggsum_add(&astat_dnode_size, -space);
	break;
	case ARC_SPACE_DBUF:
	aggsum_add(&astat_dbuf_size, -space);
	break;
	case ARC_SPACE_HDRS:
	aggsum_add(&astat_hdr_size, -space);
	break;
	case ARC_SPACE_L2HDRS:
	aggsum_add(&astat_l2_hdr_size, -space);
	break;
	case ARC_SPACE_ABD_CHUNK_WASTE:
	aggsum_add(&astat_abd_chunk_waste_size, -space);
	break;
	}

	if (type != ARC_SPACE_DATA && type != ARC_SPACE_ABD_CHUNK_WASTE) {
	ASSERT(aggsum_compare(&arc_meta_used, space) >= 0);
	/*
	* We use the upper bound here rather than the precise value
	* because the arc_meta_max value doesn't need to be
	* precise. It's only consumed by humans via arcstats.
	*/
	if (arc_meta_max < aggsum_upper_bound(&arc_meta_used))
	arc_meta_max = aggsum_upper_bound(&arc_meta_used);
	aggsum_add(&arc_meta_used, -space);
	}

	ASSERT(aggsum_compare(&arc_size, space) >= 0);
	aggsum_add(&arc_size, -space);
	}

	/*
	* Given a hdr and a buf, returns whether that buf can share its b_data buffer
	* with the hdr's b_pabd.
	*/
	static boolean_t
	arc_can_share(arc_buf_hdr_t hdr, arc_buf_t buf)
	{
	/*
	* The criteria for sharing a hdr's data are:
	* 1. the buffer is not encrypted
	* 2. the hdr's compression matches the buf's compression
	* 3. the hdr doesn't need to be byteswapped
	* 4. the hdr isn't already being shared
	* 5. the buf is either compressed or it is the last buf in the hdr list
	*
	* Criterion #5 maintains the invariant that shared uncompressed
	* bufs must be the final buf in the hdr's b_buf list. Reading this, you
	* might ask, "if a compressed buf is allocated first, won't that be the
	* last thing in the list?", but in that case it's impossible to create
	* a shared uncompressed buf anyway (because the hdr must be compressed
	* to have the compressed buf). You might also think that #3 is
	* sufficient to make this guarantee, however it's possible
	* (specifically in the rare L2ARC write race mentioned in
	* arc_buf_alloc_impl()) there will be an existing uncompressed buf that
	* is shareable, but wasn't at the time of its allocation. Rather than
	* allow a new shared uncompressed buf to be created and then shuffle
	* the list around to make it the last element, this simply disallows
	* sharing if the new buf isn't the first to be added.
	*/
	ASSERT3P(buf->b_hdr, ==, hdr);
	boolean_t hdr_compressed =
	arc_hdr_get_compress(hdr) != ZIO_COMPRESS_OFF;
	boolean_t buf_compressed = ARC_BUF_COMPRESSED(buf) != 0;
	return (!ARC_BUF_ENCRYPTED(buf) &&
	buf_compressed == hdr_compressed &&
	hdr->b_l1hdr.b_byteswap == DMU_BSWAP_NUMFUNCS &&
	!HDR_SHARED_DATA(hdr) &&
	(ARC_BUF_LAST(buf) \|\| ARC_BUF_COMPRESSED(buf)));
	}

	/*
	* Allocate a buf for this hdr. If you care about the data that's in the hdr,
	* or if you want a compressed buffer, pass those flags in. Returns 0 if the
	* copy was made successfully, or an error code otherwise.
	*/
	static int
	arc_buf_alloc_impl(arc_buf_hdr_t hdr, spa_t spa, const zbookmark_phys_t *zb,
	void *tag, boolean_t encrypted, boolean_t compressed, boolean_t noauth,
	boolean_t fill, arc_buf_t **ret)
	{
	arc_buf_t *buf;
	arc_fill_flags_t flags = ARC_FILL_LOCKED;

	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT3U(HDR_GET_LSIZE(hdr), >, 0);
	VERIFY(hdr->b_type == ARC_BUFC_DATA \|\|
	hdr->b_type == ARC_BUFC_METADATA);
	ASSERT3P(ret, !=, NULL);
	ASSERT3P(*ret, ==, NULL);
	IMPLY(encrypted, compressed);

	hdr->b_l1hdr.b_mru_hits = 0;
	hdr->b_l1hdr.b_mru_ghost_hits = 0;
	hdr->b_l1hdr.b_mfu_hits = 0;
	hdr->b_l1hdr.b_mfu_ghost_hits = 0;
	hdr->b_l1hdr.b_l2_hits = 0;

	buf = *ret = kmem_cache_alloc(buf_cache, KM_PUSHPAGE);
	buf->b_hdr = hdr;
	buf->b_data = NULL;
	buf->b_next = hdr->b_l1hdr.b_buf;
	buf->b_flags = 0;

	add_reference(hdr, tag);

	/*
	* We're about to change the hdr's b_flags. We must either
	* hold the hash_lock or be undiscoverable.
	*/
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));

	/*
	* Only honor requests for compressed bufs if the hdr is actually
	* compressed. This must be overridden if the buffer is encrypted since
	* encrypted buffers cannot be decompressed.
	*/
	if (encrypted) {
	buf->b_flags \|= ARC_BUF_FLAG_COMPRESSED;
	buf->b_flags \|= ARC_BUF_FLAG_ENCRYPTED;
	flags \|= ARC_FILL_COMPRESSED \| ARC_FILL_ENCRYPTED;
	} else if (compressed &&
	arc_hdr_get_compress(hdr) != ZIO_COMPRESS_OFF) {
	buf->b_flags \|= ARC_BUF_FLAG_COMPRESSED;
	flags \|= ARC_FILL_COMPRESSED;
	}

	if (noauth) {
	ASSERT0(encrypted);
	flags \|= ARC_FILL_NOAUTH;
	}

	/*
	* If the hdr's data can be shared then we share the data buffer and
	* set the appropriate bit in the hdr's b_flags to indicate the hdr is
	* sharing it's b_pabd with the arc_buf_t. Otherwise, we allocate a new
	* buffer to store the buf's data.
	*
	* There are two additional restrictions here because we're sharing
	* hdr -> buf instead of the usual buf -> hdr. First, the hdr can't be
	* actively involved in an L2ARC write, because if this buf is used by
	* an arc_write() then the hdr's data buffer will be released when the
	* write completes, even though the L2ARC write might still be using it.
	* Second, the hdr's ABD must be linear so that the buf's user doesn't
	* need to be ABD-aware. It must be allocated via
	* zio_[data_]buf_alloc(), not as a page, because we need to be able
	* to abd_release_ownership_of_buf(), which isn't allowed on "linear
	* page" buffers because the ABD code needs to handle freeing them
	* specially.
	*/
	boolean_t can_share = arc_can_share(hdr, buf) &&
	!HDR_L2_WRITING(hdr) &&
	hdr->b_l1hdr.b_pabd != NULL &&
	abd_is_linear(hdr->b_l1hdr.b_pabd) &&
	!abd_is_linear_page(hdr->b_l1hdr.b_pabd);

	/* Set up b_data and sharing */
	if (can_share) {
	buf->b_data = abd_to_buf(hdr->b_l1hdr.b_pabd);
	buf->b_flags \|= ARC_BUF_FLAG_SHARED;
	arc_hdr_set_flags(hdr, ARC_FLAG_SHARED_DATA);
	} else {
	buf->b_data =
	arc_get_data_buf(hdr, arc_buf_size(buf), buf);
	ARCSTAT_INCR(arcstat_overhead_size, arc_buf_size(buf));
	}
	VERIFY3P(buf->b_data, !=, NULL);

	hdr->b_l1hdr.b_buf = buf;
	hdr->b_l1hdr.b_bufcnt += 1;
	if (encrypted)
	hdr->b_crypt_hdr.b_ebufcnt += 1;

	/*
	* If the user wants the data from the hdr, we need to either copy or
	* decompress the data.
	*/
	if (fill) {
	ASSERT3P(zb, !=, NULL);
	return (arc_buf_fill(buf, spa, zb, flags));
	}

	return (0);
	}

	static char *arc_onloan_tag = "onloan";

	static inline void
	arc_loaned_bytes_update(int64_t delta)
	{
	atomic_add_64(&arc_loaned_bytes, delta);

	/* assert that it did not wrap around */
	ASSERT3S(atomic_add_64_nv(&arc_loaned_bytes, 0), >=, 0);
	}

	/*
	* Loan out an anonymous arc buffer. Loaned buffers are not counted as in
	* flight data by arc_tempreserve_space() until they are "returned". Loaned
	* buffers must be returned to the arc before they can be used by the DMU or
	* freed.
	*/
	arc_buf_t *
	arc_loan_buf(spa_t *spa, boolean_t is_metadata, int size)
	{
	arc_buf_t *buf = arc_alloc_buf(spa, arc_onloan_tag,
	is_metadata ? ARC_BUFC_METADATA : ARC_BUFC_DATA, size);

	arc_loaned_bytes_update(arc_buf_size(buf));

	return (buf);
	}

	arc_buf_t *
	arc_loan_compressed_buf(spa_t *spa, uint64_t psize, uint64_t lsize,
	enum zio_compress compression_type, uint8_t complevel)
	{
	arc_buf_t *buf = arc_alloc_compressed_buf(spa, arc_onloan_tag,
	psize, lsize, compression_type, complevel);

	arc_loaned_bytes_update(arc_buf_size(buf));

	return (buf);
	}

	arc_buf_t *
	arc_loan_raw_buf(spa_t *spa, uint64_t dsobj, boolean_t byteorder,
	const uint8_t salt, const uint8_t iv, const uint8_t *mac,
	dmu_object_type_t ot, uint64_t psize, uint64_t lsize,
	enum zio_compress compression_type, uint8_t complevel)
	{
	arc_buf_t *buf = arc_alloc_raw_buf(spa, arc_onloan_tag, dsobj,
	byteorder, salt, iv, mac, ot, psize, lsize, compression_type,
	complevel);

	atomic_add_64(&arc_loaned_bytes, psize);
	return (buf);
	}


	/*
	* Return a loaned arc buffer to the arc.
	*/
	void
	arc_return_buf(arc_buf_t buf, void tag)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	ASSERT3P(buf->b_data, !=, NULL);
	ASSERT(HDR_HAS_L1HDR(hdr));
	(void) zfs_refcount_add(&hdr->b_l1hdr.b_refcnt, tag);
	(void) zfs_refcount_remove(&hdr->b_l1hdr.b_refcnt, arc_onloan_tag);

	arc_loaned_bytes_update(-arc_buf_size(buf));
	}

	/* Detach an arc_buf from a dbuf (tag) */
	void
	arc_loan_inuse_buf(arc_buf_t buf, void tag)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	ASSERT3P(buf->b_data, !=, NULL);
	ASSERT(HDR_HAS_L1HDR(hdr));
	(void) zfs_refcount_add(&hdr->b_l1hdr.b_refcnt, arc_onloan_tag);
	(void) zfs_refcount_remove(&hdr->b_l1hdr.b_refcnt, tag);

	arc_loaned_bytes_update(arc_buf_size(buf));
	}

	static void
	l2arc_free_abd_on_write(abd_t *abd, size_t size, arc_buf_contents_t type)
	{
	l2arc_data_free_t df = kmem_alloc(sizeof (df), KM_SLEEP);

	df->l2df_abd = abd;
	df->l2df_size = size;
	df->l2df_type = type;
	mutex_enter(&l2arc_free_on_write_mtx);
	list_insert_head(l2arc_free_on_write, df);
	mutex_exit(&l2arc_free_on_write_mtx);
	}

	static void
	arc_hdr_free_on_write(arc_buf_hdr_t *hdr, boolean_t free_rdata)
	{
	arc_state_t *state = hdr->b_l1hdr.b_state;
	arc_buf_contents_t type = arc_buf_type(hdr);
	uint64_t size = (free_rdata) ? HDR_GET_PSIZE(hdr) : arc_hdr_size(hdr);

	/* protected by hash lock, if in the hash table */
	if (multilist_link_active(&hdr->b_l1hdr.b_arc_node)) {
	ASSERT(zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt));
	ASSERT(state != arc_anon && state != arc_l2c_only);

	(void) zfs_refcount_remove_many(&state->arcs_esize[type],
	size, hdr);
	}
	(void) zfs_refcount_remove_many(&state->arcs_size, size, hdr);
	if (type == ARC_BUFC_METADATA) {
	arc_space_return(size, ARC_SPACE_META);
	} else {
	ASSERT(type == ARC_BUFC_DATA);
	arc_space_return(size, ARC_SPACE_DATA);
	}

	if (free_rdata) {
	l2arc_free_abd_on_write(hdr->b_crypt_hdr.b_rabd, size, type);
	} else {
	l2arc_free_abd_on_write(hdr->b_l1hdr.b_pabd, size, type);
	}
	}

	/*
	* Share the arc_buf_t's data with the hdr. Whenever we are sharing the
	* data buffer, we transfer the refcount ownership to the hdr and update
	* the appropriate kstats.
	*/
	static void
	arc_share_buf(arc_buf_hdr_t hdr, arc_buf_t buf)
	{
	ASSERT(arc_can_share(hdr, buf));
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!ARC_BUF_ENCRYPTED(buf));
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));

	/*
	* Start sharing the data buffer. We transfer the
	* refcount ownership to the hdr since it always owns
	* the refcount whenever an arc_buf_t is shared.
	*/
	zfs_refcount_transfer_ownership_many(&hdr->b_l1hdr.b_state->arcs_size,
	arc_hdr_size(hdr), buf, hdr);
	hdr->b_l1hdr.b_pabd = abd_get_from_buf(buf->b_data, arc_buf_size(buf));
	abd_take_ownership_of_buf(hdr->b_l1hdr.b_pabd,
	HDR_ISTYPE_METADATA(hdr));
	arc_hdr_set_flags(hdr, ARC_FLAG_SHARED_DATA);
	buf->b_flags \|= ARC_BUF_FLAG_SHARED;

	/*
	* Since we've transferred ownership to the hdr we need
	* to increment its compressed and uncompressed kstats and
	* decrement the overhead size.
	*/
	ARCSTAT_INCR(arcstat_compressed_size, arc_hdr_size(hdr));
	ARCSTAT_INCR(arcstat_uncompressed_size, HDR_GET_LSIZE(hdr));
	ARCSTAT_INCR(arcstat_overhead_size, -arc_buf_size(buf));
	}

	static void
	arc_unshare_buf(arc_buf_hdr_t hdr, arc_buf_t buf)
	{
	ASSERT(arc_buf_is_shared(buf));
	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));

	/*
	* We are no longer sharing this buffer so we need
	* to transfer its ownership to the rightful owner.
	*/
	zfs_refcount_transfer_ownership_many(&hdr->b_l1hdr.b_state->arcs_size,
	arc_hdr_size(hdr), hdr, buf);
	arc_hdr_clear_flags(hdr, ARC_FLAG_SHARED_DATA);
	abd_release_ownership_of_buf(hdr->b_l1hdr.b_pabd);
	abd_put(hdr->b_l1hdr.b_pabd);
	hdr->b_l1hdr.b_pabd = NULL;
	buf->b_flags &= ~ARC_BUF_FLAG_SHARED;

	/*
	* Since the buffer is no longer shared between
	* the arc buf and the hdr, count it as overhead.
	*/
	ARCSTAT_INCR(arcstat_compressed_size, -arc_hdr_size(hdr));
	ARCSTAT_INCR(arcstat_uncompressed_size, -HDR_GET_LSIZE(hdr));
	ARCSTAT_INCR(arcstat_overhead_size, arc_buf_size(buf));
	}

	/*
	* Remove an arc_buf_t from the hdr's buf list and return the last
	* arc_buf_t on the list. If no buffers remain on the list then return
	* NULL.
	*/
	static arc_buf_t *
	arc_buf_remove(arc_buf_hdr_t hdr, arc_buf_t buf)
	{
	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));

	arc_buf_t **bufp = &hdr->b_l1hdr.b_buf;
	arc_buf_t *lastbuf = NULL;

	/*
	* Remove the buf from the hdr list and locate the last
	* remaining buffer on the list.
	*/
	while (*bufp != NULL) {
	if (*bufp == buf)
	*bufp = buf->b_next;

	/*
	* If we've removed a buffer in the middle of
	* the list then update the lastbuf and update
	* bufp.
	*/
	if (*bufp != NULL) {
	lastbuf = *bufp;
	bufp = &(*bufp)->b_next;
	}
	}
	buf->b_next = NULL;
	ASSERT3P(lastbuf, !=, buf);
	IMPLY(hdr->b_l1hdr.b_bufcnt > 0, lastbuf != NULL);
	IMPLY(hdr->b_l1hdr.b_bufcnt > 0, hdr->b_l1hdr.b_buf != NULL);
	IMPLY(lastbuf != NULL, ARC_BUF_LAST(lastbuf));

	return (lastbuf);
	}

	/*
	* Free up buf->b_data and pull the arc_buf_t off of the arc_buf_hdr_t's
	* list and free it.
	*/
	static void
	arc_buf_destroy_impl(arc_buf_t *buf)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	/*
	* Free up the data associated with the buf but only if we're not
	* sharing this with the hdr. If we are sharing it with the hdr, the
	* hdr is responsible for doing the free.
	*/
	if (buf->b_data != NULL) {
	/*
	* We're about to change the hdr's b_flags. We must either
	* hold the hash_lock or be undiscoverable.
	*/
	ASSERT(HDR_EMPTY_OR_LOCKED(hdr));

	arc_cksum_verify(buf);
	arc_buf_unwatch(buf);

	if (arc_buf_is_shared(buf)) {
	arc_hdr_clear_flags(hdr, ARC_FLAG_SHARED_DATA);
	} else {
	uint64_t size = arc_buf_size(buf);
	arc_free_data_buf(hdr, buf->b_data, size, buf);
	ARCSTAT_INCR(arcstat_overhead_size, -size);
	}
	buf->b_data = NULL;

	ASSERT(hdr->b_l1hdr.b_bufcnt > 0);
	hdr->b_l1hdr.b_bufcnt -= 1;

	if (ARC_BUF_ENCRYPTED(buf)) {
	hdr->b_crypt_hdr.b_ebufcnt -= 1;

	/*
	* If we have no more encrypted buffers and we've
	* already gotten a copy of the decrypted data we can
	* free b_rabd to save some space.
	*/
	if (hdr->b_crypt_hdr.b_ebufcnt == 0 &&
	HDR_HAS_RABD(hdr) && hdr->b_l1hdr.b_pabd != NULL &&
	!HDR_IO_IN_PROGRESS(hdr)) {
	arc_hdr_free_abd(hdr, B_TRUE);
	}
	}
	}

	arc_buf_t *lastbuf = arc_buf_remove(hdr, buf);

	if (ARC_BUF_SHARED(buf) && !ARC_BUF_COMPRESSED(buf)) {
	/*
	* If the current arc_buf_t is sharing its data buffer with the
	* hdr, then reassign the hdr's b_pabd to share it with the new
	* buffer at the end of the list. The shared buffer is always
	* the last one on the hdr's buffer list.
	*
	* There is an equivalent case for compressed bufs, but since
	* they aren't guaranteed to be the last buf in the list and
	* that is an exceedingly rare case, we just allow that space be
	* wasted temporarily. We must also be careful not to share
	* encrypted buffers, since they cannot be shared.
	*/
	if (lastbuf != NULL && !ARC_BUF_ENCRYPTED(lastbuf)) {
	/* Only one buf can be shared at once */
	VERIFY(!arc_buf_is_shared(lastbuf));
	/* hdr is uncompressed so can't have compressed buf */
	VERIFY(!ARC_BUF_COMPRESSED(lastbuf));

	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);
	arc_hdr_free_abd(hdr, B_FALSE);

	/*
	* We must setup a new shared block between the
	* last buffer and the hdr. The data would have
	* been allocated by the arc buf so we need to transfer
	* ownership to the hdr since it's now being shared.
	*/
	arc_share_buf(hdr, lastbuf);
	}
	} else if (HDR_SHARED_DATA(hdr)) {
	/*
	* Uncompressed shared buffers are always at the end
	* of the list. Compressed buffers don't have the
	* same requirements. This makes it hard to
	* simply assert that the lastbuf is shared so
	* we rely on the hdr's compression flags to determine
	* if we have a compressed, shared buffer.
	*/
	ASSERT3P(lastbuf, !=, NULL);
	ASSERT(arc_buf_is_shared(lastbuf) \|\|
	arc_hdr_get_compress(hdr) != ZIO_COMPRESS_OFF);
	}

	/*
	* Free the checksum if we're removing the last uncompressed buf from
	* this hdr.
	*/
	if (!arc_hdr_has_uncompressed_buf(hdr)) {
	arc_cksum_free(hdr);
	}

	/* clean up the buf */
	buf->b_hdr = NULL;
	kmem_cache_free(buf_cache, buf);
	}

	static void
	arc_hdr_alloc_abd(arc_buf_hdr_t *hdr, int alloc_flags)
	{
	uint64_t size;
	boolean_t alloc_rdata = ((alloc_flags & ARC_HDR_ALLOC_RDATA) != 0);
	boolean_t do_adapt = ((alloc_flags & ARC_HDR_DO_ADAPT) != 0);

	ASSERT3U(HDR_GET_LSIZE(hdr), >, 0);
	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT(!HDR_SHARED_DATA(hdr) \|\| alloc_rdata);
	IMPLY(alloc_rdata, HDR_PROTECTED(hdr));

	if (alloc_rdata) {
	size = HDR_GET_PSIZE(hdr);
	ASSERT3P(hdr->b_crypt_hdr.b_rabd, ==, NULL);
	hdr->b_crypt_hdr.b_rabd = arc_get_data_abd(hdr, size, hdr,
	do_adapt);
	ASSERT3P(hdr->b_crypt_hdr.b_rabd, !=, NULL);
	ARCSTAT_INCR(arcstat_raw_size, size);
	} else {
	size = arc_hdr_size(hdr);
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	hdr->b_l1hdr.b_pabd = arc_get_data_abd(hdr, size, hdr,
	do_adapt);
	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);
	}

	ARCSTAT_INCR(arcstat_compressed_size, size);
	ARCSTAT_INCR(arcstat_uncompressed_size, HDR_GET_LSIZE(hdr));
	}

	static void
	arc_hdr_free_abd(arc_buf_hdr_t *hdr, boolean_t free_rdata)
	{
	uint64_t size = (free_rdata) ? HDR_GET_PSIZE(hdr) : arc_hdr_size(hdr);

	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT(hdr->b_l1hdr.b_pabd != NULL \|\| HDR_HAS_RABD(hdr));
	IMPLY(free_rdata, HDR_HAS_RABD(hdr));

	/*
	* If the hdr is currently being written to the l2arc then
	* we defer freeing the data by adding it to the l2arc_free_on_write
	* list. The l2arc will free the data once it's finished
	* writing it to the l2arc device.
	*/
	if (HDR_L2_WRITING(hdr)) {
	arc_hdr_free_on_write(hdr, free_rdata);
	ARCSTAT_BUMP(arcstat_l2_free_on_write);
	} else if (free_rdata) {
	arc_free_data_abd(hdr, hdr->b_crypt_hdr.b_rabd, size, hdr);
	} else {
	arc_free_data_abd(hdr, hdr->b_l1hdr.b_pabd, size, hdr);
	}

	if (free_rdata) {
	hdr->b_crypt_hdr.b_rabd = NULL;
	ARCSTAT_INCR(arcstat_raw_size, -size);
	} else {
	hdr->b_l1hdr.b_pabd = NULL;
	}

	if (hdr->b_l1hdr.b_pabd == NULL && !HDR_HAS_RABD(hdr))
	hdr->b_l1hdr.b_byteswap = DMU_BSWAP_NUMFUNCS;

	ARCSTAT_INCR(arcstat_compressed_size, -size);
	ARCSTAT_INCR(arcstat_uncompressed_size, -HDR_GET_LSIZE(hdr));
	}

	static arc_buf_hdr_t *
	arc_hdr_alloc(uint64_t spa, int32_t psize, int32_t lsize,
	boolean_t protected, enum zio_compress compression_type, uint8_t complevel,
	arc_buf_contents_t type, boolean_t alloc_rdata)
	{
	arc_buf_hdr_t *hdr;
	int flags = ARC_HDR_DO_ADAPT;

	VERIFY(type == ARC_BUFC_DATA \|\| type == ARC_BUFC_METADATA);
	if (protected) {
	hdr = kmem_cache_alloc(hdr_full_crypt_cache, KM_PUSHPAGE);
	} else {
	hdr = kmem_cache_alloc(hdr_full_cache, KM_PUSHPAGE);
	}
	flags \|= alloc_rdata ? ARC_HDR_ALLOC_RDATA : 0;

	ASSERT(HDR_EMPTY(hdr));
	ASSERT3P(hdr->b_l1hdr.b_freeze_cksum, ==, NULL);
	HDR_SET_PSIZE(hdr, psize);
	HDR_SET_LSIZE(hdr, lsize);
	hdr->b_spa = spa;
	hdr->b_type = type;
	hdr->b_flags = 0;
	arc_hdr_set_flags(hdr, arc_bufc_to_flags(type) \| ARC_FLAG_HAS_L1HDR);
	arc_hdr_set_compress(hdr, compression_type);
	hdr->b_complevel = complevel;
	if (protected)
	arc_hdr_set_flags(hdr, ARC_FLAG_PROTECTED);

	hdr->b_l1hdr.b_state = arc_anon;
	hdr->b_l1hdr.b_arc_access = 0;
	hdr->b_l1hdr.b_bufcnt = 0;
	hdr->b_l1hdr.b_buf = NULL;

	/*
	* Allocate the hdr's buffer. This will contain either
	* the compressed or uncompressed data depending on the block
	* it references and compressed arc enablement.
	*/
	arc_hdr_alloc_abd(hdr, flags);
	ASSERT(zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt));

	return (hdr);
	}

	/*
	* Transition between the two allocation states for the arc_buf_hdr struct.
	* The arc_buf_hdr struct can be allocated with (hdr_full_cache) or without
	* (hdr_l2only_cache) the fields necessary for the L1 cache - the smaller
	* version is used when a cache buffer is only in the L2ARC in order to reduce
	* memory usage.
	*/
	static arc_buf_hdr_t *
	arc_hdr_realloc(arc_buf_hdr_t hdr, kmem_cache_t old, kmem_cache_t *new)
	{
	ASSERT(HDR_HAS_L2HDR(hdr));

	arc_buf_hdr_t *nhdr;
	l2arc_dev_t *dev = hdr->b_l2hdr.b_dev;

	ASSERT((old == hdr_full_cache && new == hdr_l2only_cache) \|\|
	(old == hdr_l2only_cache && new == hdr_full_cache));

	/*
	* if the caller wanted a new full header and the header is to be
	* encrypted we will actually allocate the header from the full crypt
	* cache instead. The same applies to freeing from the old cache.
	*/
	if (HDR_PROTECTED(hdr) && new == hdr_full_cache)
	new = hdr_full_crypt_cache;
	if (HDR_PROTECTED(hdr) && old == hdr_full_cache)
	old = hdr_full_crypt_cache;

	nhdr = kmem_cache_alloc(new, KM_PUSHPAGE);

	ASSERT(MUTEX_HELD(HDR_LOCK(hdr)));
	buf_hash_remove(hdr);

	bcopy(hdr, nhdr, HDR_L2ONLY_SIZE);

	if (new == hdr_full_cache \|\| new == hdr_full_crypt_cache) {
	arc_hdr_set_flags(nhdr, ARC_FLAG_HAS_L1HDR);
	/*
	* arc_access and arc_change_state need to be aware that a
	* header has just come out of L2ARC, so we set its state to
	* l2c_only even though it's about to change.
	*/
	nhdr->b_l1hdr.b_state = arc_l2c_only;

	/* Verify previous threads set to NULL before freeing */
	ASSERT3P(nhdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!HDR_HAS_RABD(hdr));
	} else {
	ASSERT3P(hdr->b_l1hdr.b_buf, ==, NULL);
	ASSERT0(hdr->b_l1hdr.b_bufcnt);
	ASSERT3P(hdr->b_l1hdr.b_freeze_cksum, ==, NULL);

	/*
	* If we've reached here, We must have been called from
	* arc_evict_hdr(), as such we should have already been
	* removed from any ghost list we were previously on
	* (which protects us from racing with arc_evict_state),
	* thus no locking is needed during this check.
	*/
	ASSERT(!multilist_link_active(&hdr->b_l1hdr.b_arc_node));

	/*
	* A buffer must not be moved into the arc_l2c_only
	* state if it's not finished being written out to the
	* l2arc device. Otherwise, the b_l1hdr.b_pabd field
	* might try to be accessed, even though it was removed.
	*/
	VERIFY(!HDR_L2_WRITING(hdr));
	VERIFY3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!HDR_HAS_RABD(hdr));

	arc_hdr_clear_flags(nhdr, ARC_FLAG_HAS_L1HDR);
	}
	/*
	* The header has been reallocated so we need to re-insert it into any
	* lists it was on.
	*/
	(void) buf_hash_insert(nhdr, NULL);

	ASSERT(list_link_active(&hdr->b_l2hdr.b_l2node));

	mutex_enter(&dev->l2ad_mtx);

	/*
	* We must place the realloc'ed header back into the list at
	* the same spot. Otherwise, if it's placed earlier in the list,
	* l2arc_write_buffers() could find it during the function's
	* write phase, and try to write it out to the l2arc.
	*/
	list_insert_after(&dev->l2ad_buflist, hdr, nhdr);
	list_remove(&dev->l2ad_buflist, hdr);

	mutex_exit(&dev->l2ad_mtx);

	/*
	* Since we're using the pointer address as the tag when
	* incrementing and decrementing the l2ad_alloc refcount, we
	* must remove the old pointer (that we're about to destroy) and
	* add the new pointer to the refcount. Otherwise we'd remove
	* the wrong pointer address when calling arc_hdr_destroy() later.
	*/

	(void) zfs_refcount_remove_many(&dev->l2ad_alloc,
	arc_hdr_size(hdr), hdr);
	(void) zfs_refcount_add_many(&dev->l2ad_alloc,
	arc_hdr_size(nhdr), nhdr);

	buf_discard_identity(hdr);
	kmem_cache_free(old, hdr);

	return (nhdr);
	}

	/*
	* This function allows an L1 header to be reallocated as a crypt
	* header and vice versa. If we are going to a crypt header, the
	* new fields will be zeroed out.
	*/
	static arc_buf_hdr_t *
	arc_hdr_realloc_crypt(arc_buf_hdr_t *hdr, boolean_t need_crypt)
	{
	arc_buf_hdr_t *nhdr;
	arc_buf_t *buf;
	kmem_cache_t ncache, ocache;
	unsigned nsize, osize;

	/*
	* This function requires that hdr is in the arc_anon state.
	* Therefore it won't have any L2ARC data for us to worry
	* about copying.
	*/
	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT(!HDR_HAS_L2HDR(hdr));
	ASSERT3U(!!HDR_PROTECTED(hdr), !=, need_crypt);
	ASSERT3P(hdr->b_l1hdr.b_state, ==, arc_anon);
	ASSERT(!multilist_link_active(&hdr->b_l1hdr.b_arc_node));
	ASSERT(!list_link_active(&hdr->b_l2hdr.b_l2node));
	ASSERT3P(hdr->b_hash_next, ==, NULL);

	if (need_crypt) {
	ncache = hdr_full_crypt_cache;
	nsize = sizeof (hdr->b_crypt_hdr);
	ocache = hdr_full_cache;
	osize = HDR_FULL_SIZE;
	} else {
	ncache = hdr_full_cache;
	nsize = HDR_FULL_SIZE;
	ocache = hdr_full_crypt_cache;
	osize = sizeof (hdr->b_crypt_hdr);
	}

	nhdr = kmem_cache_alloc(ncache, KM_PUSHPAGE);

	/*
	* Copy all members that aren't locks or condvars to the new header.
	* No lists are pointing to us (as we asserted above), so we don't
	* need to worry about the list nodes.
	*/
	nhdr->b_dva = hdr->b_dva;
	nhdr->b_birth = hdr->b_birth;
	nhdr->b_type = hdr->b_type;
	nhdr->b_flags = hdr->b_flags;
	nhdr->b_psize = hdr->b_psize;
	nhdr->b_lsize = hdr->b_lsize;
	nhdr->b_spa = hdr->b_spa;
	nhdr->b_l1hdr.b_freeze_cksum = hdr->b_l1hdr.b_freeze_cksum;
	nhdr->b_l1hdr.b_bufcnt = hdr->b_l1hdr.b_bufcnt;
	nhdr->b_l1hdr.b_byteswap = hdr->b_l1hdr.b_byteswap;
	nhdr->b_l1hdr.b_state = hdr->b_l1hdr.b_state;
	nhdr->b_l1hdr.b_arc_access = hdr->b_l1hdr.b_arc_access;
	nhdr->b_l1hdr.b_mru_hits = hdr->b_l1hdr.b_mru_hits;
	nhdr->b_l1hdr.b_mru_ghost_hits = hdr->b_l1hdr.b_mru_ghost_hits;
	nhdr->b_l1hdr.b_mfu_hits = hdr->b_l1hdr.b_mfu_hits;
	nhdr->b_l1hdr.b_mfu_ghost_hits = hdr->b_l1hdr.b_mfu_ghost_hits;
	nhdr->b_l1hdr.b_l2_hits = hdr->b_l1hdr.b_l2_hits;
	nhdr->b_l1hdr.b_acb = hdr->b_l1hdr.b_acb;
	nhdr->b_l1hdr.b_pabd = hdr->b_l1hdr.b_pabd;

	/*
	* This zfs_refcount_add() exists only to ensure that the individual
	* arc buffers always point to a header that is referenced, avoiding
	* a small race condition that could trigger ASSERTs.
	*/
	(void) zfs_refcount_add(&nhdr->b_l1hdr.b_refcnt, FTAG);
	nhdr->b_l1hdr.b_buf = hdr->b_l1hdr.b_buf;
	for (buf = nhdr->b_l1hdr.b_buf; buf != NULL; buf = buf->b_next) {
	mutex_enter(&buf->b_evict_lock);
	buf->b_hdr = nhdr;
	mutex_exit(&buf->b_evict_lock);
	}

	zfs_refcount_transfer(&nhdr->b_l1hdr.b_refcnt, &hdr->b_l1hdr.b_refcnt);
	(void) zfs_refcount_remove(&nhdr->b_l1hdr.b_refcnt, FTAG);
	ASSERT0(zfs_refcount_count(&hdr->b_l1hdr.b_refcnt));

	if (need_crypt) {
	arc_hdr_set_flags(nhdr, ARC_FLAG_PROTECTED);
	} else {
	arc_hdr_clear_flags(nhdr, ARC_FLAG_PROTECTED);
	}

	/* unset all members of the original hdr */
	bzero(&hdr->b_dva, sizeof (dva_t));
	hdr->b_birth = 0;
	hdr->b_type = ARC_BUFC_INVALID;
	hdr->b_flags = 0;
	hdr->b_psize = 0;
	hdr->b_lsize = 0;
	hdr->b_spa = 0;
	hdr->b_l1hdr.b_freeze_cksum = NULL;
	hdr->b_l1hdr.b_buf = NULL;
	hdr->b_l1hdr.b_bufcnt = 0;
	hdr->b_l1hdr.b_byteswap = 0;
	hdr->b_l1hdr.b_state = NULL;
	hdr->b_l1hdr.b_arc_access = 0;
	hdr->b_l1hdr.b_mru_hits = 0;
	hdr->b_l1hdr.b_mru_ghost_hits = 0;
	hdr->b_l1hdr.b_mfu_hits = 0;
	hdr->b_l1hdr.b_mfu_ghost_hits = 0;
	hdr->b_l1hdr.b_l2_hits = 0;
	hdr->b_l1hdr.b_acb = NULL;
	hdr->b_l1hdr.b_pabd = NULL;

	if (ocache == hdr_full_crypt_cache) {
	ASSERT(!HDR_HAS_RABD(hdr));
	hdr->b_crypt_hdr.b_ot = DMU_OT_NONE;
	hdr->b_crypt_hdr.b_ebufcnt = 0;
	hdr->b_crypt_hdr.b_dsobj = 0;
	bzero(hdr->b_crypt_hdr.b_salt, ZIO_DATA_SALT_LEN);
	bzero(hdr->b_crypt_hdr.b_iv, ZIO_DATA_IV_LEN);
	bzero(hdr->b_crypt_hdr.b_mac, ZIO_DATA_MAC_LEN);
	}

	buf_discard_identity(hdr);
	kmem_cache_free(ocache, hdr);

	return (nhdr);
	}

	/*
	* This function is used by the send / receive code to convert a newly
	* allocated arc_buf_t to one that is suitable for a raw encrypted write. It
	* is also used to allow the root objset block to be updated without altering
	* its embedded MACs. Both block types will always be uncompressed so we do not
	* have to worry about compression type or psize.
	*/
	void
	arc_convert_to_raw(arc_buf_t *buf, uint64_t dsobj, boolean_t byteorder,
	dmu_object_type_t ot, const uint8_t salt, const uint8_t iv,
	const uint8_t *mac)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	ASSERT(ot == DMU_OT_DNODE \|\| ot == DMU_OT_OBJSET);
	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT3P(hdr->b_l1hdr.b_state, ==, arc_anon);

	buf->b_flags \|= (ARC_BUF_FLAG_COMPRESSED \| ARC_BUF_FLAG_ENCRYPTED);
	if (!HDR_PROTECTED(hdr))
	hdr = arc_hdr_realloc_crypt(hdr, B_TRUE);
	hdr->b_crypt_hdr.b_dsobj = dsobj;
	hdr->b_crypt_hdr.b_ot = ot;
	hdr->b_l1hdr.b_byteswap = (byteorder == ZFS_HOST_BYTEORDER) ?
	DMU_BSWAP_NUMFUNCS : DMU_OT_BYTESWAP(ot);
	if (!arc_hdr_has_uncompressed_buf(hdr))
	arc_cksum_free(hdr);

	if (salt != NULL)
	bcopy(salt, hdr->b_crypt_hdr.b_salt, ZIO_DATA_SALT_LEN);
	if (iv != NULL)
	bcopy(iv, hdr->b_crypt_hdr.b_iv, ZIO_DATA_IV_LEN);
	if (mac != NULL)
	bcopy(mac, hdr->b_crypt_hdr.b_mac, ZIO_DATA_MAC_LEN);
	}

	/*
	* Allocate a new arc_buf_hdr_t and arc_buf_t and return the buf to the caller.
	* The buf is returned thawed since we expect the consumer to modify it.
	*/
	arc_buf_t *
	arc_alloc_buf(spa_t spa, void tag, arc_buf_contents_t type, int32_t size)
	{
	arc_buf_hdr_t *hdr = arc_hdr_alloc(spa_load_guid(spa), size, size,
	B_FALSE, ZIO_COMPRESS_OFF, 0, type, B_FALSE);

	arc_buf_t *buf = NULL;
	VERIFY0(arc_buf_alloc_impl(hdr, spa, NULL, tag, B_FALSE, B_FALSE,
	B_FALSE, B_FALSE, &buf));
	arc_buf_thaw(buf);

	return (buf);
	}

	/*
	* Allocate a compressed buf in the same manner as arc_alloc_buf. Don't use this
	* for bufs containing metadata.
	*/
	arc_buf_t *
	arc_alloc_compressed_buf(spa_t spa, void tag, uint64_t psize, uint64_t lsize,
	enum zio_compress compression_type, uint8_t complevel)
	{
	ASSERT3U(lsize, >, 0);
	ASSERT3U(lsize, >=, psize);
	ASSERT3U(compression_type, >, ZIO_COMPRESS_OFF);
	ASSERT3U(compression_type, <, ZIO_COMPRESS_FUNCTIONS);

	arc_buf_hdr_t *hdr = arc_hdr_alloc(spa_load_guid(spa), psize, lsize,
	B_FALSE, compression_type, complevel, ARC_BUFC_DATA, B_FALSE);

	arc_buf_t *buf = NULL;
	VERIFY0(arc_buf_alloc_impl(hdr, spa, NULL, tag, B_FALSE,
	B_TRUE, B_FALSE, B_FALSE, &buf));
	arc_buf_thaw(buf);
	ASSERT3P(hdr->b_l1hdr.b_freeze_cksum, ==, NULL);

	if (!arc_buf_is_shared(buf)) {
	/*
	* To ensure that the hdr has the correct data in it if we call
	* arc_untransform() on this buf before it's been written to
	* disk, it's easiest if we just set up sharing between the
	* buf and the hdr.
	*/
	arc_hdr_free_abd(hdr, B_FALSE);
	arc_share_buf(hdr, buf);
	}

	return (buf);
	}

	arc_buf_t *
	arc_alloc_raw_buf(spa_t spa, void tag, uint64_t dsobj, boolean_t byteorder,
	const uint8_t salt, const uint8_t iv, const uint8_t *mac,
	dmu_object_type_t ot, uint64_t psize, uint64_t lsize,
	enum zio_compress compression_type, uint8_t complevel)
	{
	arc_buf_hdr_t *hdr;
	arc_buf_t *buf;
	arc_buf_contents_t type = DMU_OT_IS_METADATA(ot) ?
	ARC_BUFC_METADATA : ARC_BUFC_DATA;

	ASSERT3U(lsize, >, 0);
	ASSERT3U(lsize, >=, psize);
	ASSERT3U(compression_type, >=, ZIO_COMPRESS_OFF);
	ASSERT3U(compression_type, <, ZIO_COMPRESS_FUNCTIONS);

	hdr = arc_hdr_alloc(spa_load_guid(spa), psize, lsize, B_TRUE,
	compression_type, complevel, type, B_TRUE);

	hdr->b_crypt_hdr.b_dsobj = dsobj;
	hdr->b_crypt_hdr.b_ot = ot;
	hdr->b_l1hdr.b_byteswap = (byteorder == ZFS_HOST_BYTEORDER) ?
	DMU_BSWAP_NUMFUNCS : DMU_OT_BYTESWAP(ot);
	bcopy(salt, hdr->b_crypt_hdr.b_salt, ZIO_DATA_SALT_LEN);
	bcopy(iv, hdr->b_crypt_hdr.b_iv, ZIO_DATA_IV_LEN);
	bcopy(mac, hdr->b_crypt_hdr.b_mac, ZIO_DATA_MAC_LEN);

	/*
	* This buffer will be considered encrypted even if the ot is not an
	* encrypted type. It will become authenticated instead in
	* arc_write_ready().
	*/
	buf = NULL;
	VERIFY0(arc_buf_alloc_impl(hdr, spa, NULL, tag, B_TRUE, B_TRUE,
	B_FALSE, B_FALSE, &buf));
	arc_buf_thaw(buf);
	ASSERT3P(hdr->b_l1hdr.b_freeze_cksum, ==, NULL);

	return (buf);
	}

	static void
	arc_hdr_l2hdr_destroy(arc_buf_hdr_t *hdr)
	{
	l2arc_buf_hdr_t *l2hdr = &hdr->b_l2hdr;
	l2arc_dev_t *dev = l2hdr->b_dev;
	uint64_t psize = HDR_GET_PSIZE(hdr);
	uint64_t asize = vdev_psize_to_asize(dev->l2ad_vdev, psize);

	ASSERT(MUTEX_HELD(&dev->l2ad_mtx));
	ASSERT(HDR_HAS_L2HDR(hdr));

	list_remove(&dev->l2ad_buflist, hdr);

	ARCSTAT_INCR(arcstat_l2_psize, -psize);
	ARCSTAT_INCR(arcstat_l2_lsize, -HDR_GET_LSIZE(hdr));

	vdev_space_update(dev->l2ad_vdev, -asize, 0, 0);

	(void) zfs_refcount_remove_many(&dev->l2ad_alloc, arc_hdr_size(hdr),
	hdr);
	arc_hdr_clear_flags(hdr, ARC_FLAG_HAS_L2HDR);
	}

	static void
	arc_hdr_destroy(arc_buf_hdr_t *hdr)
	{
	if (HDR_HAS_L1HDR(hdr)) {
	ASSERT(hdr->b_l1hdr.b_buf == NULL \|\|
	hdr->b_l1hdr.b_bufcnt > 0);
	ASSERT(zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt));
	ASSERT3P(hdr->b_l1hdr.b_state, ==, arc_anon);
	}
	ASSERT(!HDR_IO_IN_PROGRESS(hdr));
	ASSERT(!HDR_IN_HASH_TABLE(hdr));

	if (HDR_HAS_L2HDR(hdr)) {
	l2arc_dev_t *dev = hdr->b_l2hdr.b_dev;
	boolean_t buflist_held = MUTEX_HELD(&dev->l2ad_mtx);

	if (!buflist_held)
	mutex_enter(&dev->l2ad_mtx);

	/*
	* Even though we checked this conditional above, we
	* need to check this again now that we have the
	* l2ad_mtx. This is because we could be racing with
	* another thread calling l2arc_evict() which might have
	* destroyed this header's L2 portion as we were waiting
	* to acquire the l2ad_mtx. If that happens, we don't
	* want to re-destroy the header's L2 portion.
	*/
	if (HDR_HAS_L2HDR(hdr))
	arc_hdr_l2hdr_destroy(hdr);

	if (!buflist_held)
	mutex_exit(&dev->l2ad_mtx);
	}

	/*
	* The header's identify can only be safely discarded once it is no
	* longer discoverable. This requires removing it from the hash table
	* and the l2arc header list. After this point the hash lock can not
	* be used to protect the header.
	*/
	if (!HDR_EMPTY(hdr))
	buf_discard_identity(hdr);

	if (HDR_HAS_L1HDR(hdr)) {
	arc_cksum_free(hdr);

	while (hdr->b_l1hdr.b_buf != NULL)
	arc_buf_destroy_impl(hdr->b_l1hdr.b_buf);

	if (hdr->b_l1hdr.b_pabd != NULL)
	arc_hdr_free_abd(hdr, B_FALSE);

	if (HDR_HAS_RABD(hdr))
	arc_hdr_free_abd(hdr, B_TRUE);
	}

	ASSERT3P(hdr->b_hash_next, ==, NULL);
	if (HDR_HAS_L1HDR(hdr)) {
	ASSERT(!multilist_link_active(&hdr->b_l1hdr.b_arc_node));
	ASSERT3P(hdr->b_l1hdr.b_acb, ==, NULL);

	if (!HDR_PROTECTED(hdr)) {
	kmem_cache_free(hdr_full_cache, hdr);
	} else {
	kmem_cache_free(hdr_full_crypt_cache, hdr);
	}
	} else {
	kmem_cache_free(hdr_l2only_cache, hdr);
	}
	}

	void
	arc_buf_destroy(arc_buf_t buf, void tag)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	if (hdr->b_l1hdr.b_state == arc_anon) {
	ASSERT3U(hdr->b_l1hdr.b_bufcnt, ==, 1);
	ASSERT(!HDR_IO_IN_PROGRESS(hdr));
	VERIFY0(remove_reference(hdr, NULL, tag));
	arc_hdr_destroy(hdr);
	return;
	}

	kmutex_t *hash_lock = HDR_LOCK(hdr);
	mutex_enter(hash_lock);

	ASSERT3P(hdr, ==, buf->b_hdr);
	ASSERT(hdr->b_l1hdr.b_bufcnt > 0);
	ASSERT3P(hash_lock, ==, HDR_LOCK(hdr));
	ASSERT3P(hdr->b_l1hdr.b_state, !=, arc_anon);
	ASSERT3P(buf->b_data, !=, NULL);

	(void) remove_reference(hdr, hash_lock, tag);
	arc_buf_destroy_impl(buf);
	mutex_exit(hash_lock);
	}

	/*
	* Evict the arc_buf_hdr that is provided as a parameter. The resultant
	* state of the header is dependent on its state prior to entering this
	* function. The following transitions are possible:
	*
	* - arc_mru -> arc_mru_ghost
	* - arc_mfu -> arc_mfu_ghost
	* - arc_mru_ghost -> arc_l2c_only
	* - arc_mru_ghost -> deleted
	* - arc_mfu_ghost -> arc_l2c_only
	* - arc_mfu_ghost -> deleted
	*/
	static int64_t
	arc_evict_hdr(arc_buf_hdr_t hdr, kmutex_t hash_lock)
	{
	arc_state_t evicted_state, state;
	int64_t bytes_evicted = 0;
	int min_lifetime = HDR_PRESCIENT_PREFETCH(hdr) ?
	arc_min_prescient_prefetch_ms : arc_min_prefetch_ms;

	ASSERT(MUTEX_HELD(hash_lock));
	ASSERT(HDR_HAS_L1HDR(hdr));

	state = hdr->b_l1hdr.b_state;
	if (GHOST_STATE(state)) {
	ASSERT(!HDR_IO_IN_PROGRESS(hdr));
	ASSERT3P(hdr->b_l1hdr.b_buf, ==, NULL);

	/*
	* l2arc_write_buffers() relies on a header's L1 portion
	* (i.e. its b_pabd field) during it's write phase.
	* Thus, we cannot push a header onto the arc_l2c_only
	* state (removing its L1 piece) until the header is
	* done being written to the l2arc.
	*/
	if (HDR_HAS_L2HDR(hdr) && HDR_L2_WRITING(hdr)) {
	ARCSTAT_BUMP(arcstat_evict_l2_skip);
	return (bytes_evicted);
	}

	ARCSTAT_BUMP(arcstat_deleted);
	bytes_evicted += HDR_GET_LSIZE(hdr);

	DTRACE_PROBE1(arc__delete, arc_buf_hdr_t *, hdr);

	if (HDR_HAS_L2HDR(hdr)) {
	ASSERT(hdr->b_l1hdr.b_pabd == NULL);
	ASSERT(!HDR_HAS_RABD(hdr));
	/*
	* This buffer is cached on the 2nd Level ARC;
	* don't destroy the header.
	*/
	arc_change_state(arc_l2c_only, hdr, hash_lock);
	/*
	* dropping from L1+L2 cached to L2-only,
	* realloc to remove the L1 header.
	*/
	hdr = arc_hdr_realloc(hdr, hdr_full_cache,
	hdr_l2only_cache);
	} else {
	arc_change_state(arc_anon, hdr, hash_lock);
	arc_hdr_destroy(hdr);
	}
	return (bytes_evicted);
	}

	ASSERT(state == arc_mru \|\| state == arc_mfu);
	evicted_state = (state == arc_mru) ? arc_mru_ghost : arc_mfu_ghost;

	/* prefetch buffers have a minimum lifespan */
	if (HDR_IO_IN_PROGRESS(hdr) \|\|
	((hdr->b_flags & (ARC_FLAG_PREFETCH \| ARC_FLAG_INDIRECT)) &&
	ddi_get_lbolt() - hdr->b_l1hdr.b_arc_access <
	MSEC_TO_TICK(min_lifetime))) {
	ARCSTAT_BUMP(arcstat_evict_skip);
	return (bytes_evicted);
	}

	ASSERT0(zfs_refcount_count(&hdr->b_l1hdr.b_refcnt));
	while (hdr->b_l1hdr.b_buf) {
	arc_buf_t *buf = hdr->b_l1hdr.b_buf;
	if (!mutex_tryenter(&buf->b_evict_lock)) {
	ARCSTAT_BUMP(arcstat_mutex_miss);
	break;
	}
	if (buf->b_data != NULL)
	bytes_evicted += HDR_GET_LSIZE(hdr);
	mutex_exit(&buf->b_evict_lock);
	arc_buf_destroy_impl(buf);
	}

	if (HDR_HAS_L2HDR(hdr)) {
	ARCSTAT_INCR(arcstat_evict_l2_cached, HDR_GET_LSIZE(hdr));
	} else {
	if (l2arc_write_eligible(hdr->b_spa, hdr)) {
	ARCSTAT_INCR(arcstat_evict_l2_eligible,
	HDR_GET_LSIZE(hdr));
	} else {
	ARCSTAT_INCR(arcstat_evict_l2_ineligible,
	HDR_GET_LSIZE(hdr));
	}
	}

	if (hdr->b_l1hdr.b_bufcnt == 0) {
	arc_cksum_free(hdr);

	bytes_evicted += arc_hdr_size(hdr);

	/*
	* If this hdr is being evicted and has a compressed
	* buffer then we discard it here before we change states.
	* This ensures that the accounting is updated correctly
	* in arc_free_data_impl().
	*/
	if (hdr->b_l1hdr.b_pabd != NULL)
	arc_hdr_free_abd(hdr, B_FALSE);

	if (HDR_HAS_RABD(hdr))
	arc_hdr_free_abd(hdr, B_TRUE);

	arc_change_state(evicted_state, hdr, hash_lock);
	ASSERT(HDR_IN_HASH_TABLE(hdr));
	arc_hdr_set_flags(hdr, ARC_FLAG_IN_HASH_TABLE);
	DTRACE_PROBE1(arc__evict, arc_buf_hdr_t *, hdr);
	}

	return (bytes_evicted);
	}

	static void
	arc_set_need_free(void)
	{
	ASSERT(MUTEX_HELD(&arc_evict_lock));
	int64_t remaining = arc_free_memory() - arc_sys_free / 2;
	arc_evict_waiter_t *aw = list_tail(&arc_evict_waiters);
	if (aw == NULL) {
	arc_need_free = MAX(-remaining, 0);
	} else {
	arc_need_free =
	MAX(-remaining, (int64_t)(aw->aew_count - arc_evict_count));
	}
	}

	static uint64_t
	arc_evict_state_impl(multilist_t ml, int idx, arc_buf_hdr_t marker,
	uint64_t spa, int64_t bytes)
	{
	multilist_sublist_t *mls;
	uint64_t bytes_evicted = 0;
	arc_buf_hdr_t *hdr;
	kmutex_t *hash_lock;
	int evict_count = 0;

	ASSERT3P(marker, !=, NULL);
	IMPLY(bytes < 0, bytes == ARC_EVICT_ALL);

	mls = multilist_sublist_lock(ml, idx);

	for (hdr = multilist_sublist_prev(mls, marker); hdr != NULL;
	hdr = multilist_sublist_prev(mls, marker)) {
	if ((bytes != ARC_EVICT_ALL && bytes_evicted >= bytes) \|\|
	(evict_count >= zfs_arc_evict_batch_limit))
	break;

	/*
	* To keep our iteration location, move the marker
	* forward. Since we're not holding hdr's hash lock, we
	* must be very careful and not remove 'hdr' from the
	* sublist. Otherwise, other consumers might mistake the
	* 'hdr' as not being on a sublist when they call the
	* multilist_link_active() function (they all rely on
	* the hash lock protecting concurrent insertions and
	* removals). multilist_sublist_move_forward() was
	* specifically implemented to ensure this is the case
	* (only 'marker' will be removed and re-inserted).
	*/
	multilist_sublist_move_forward(mls, marker);

	/*
	* The only case where the b_spa field should ever be
	* zero, is the marker headers inserted by
	* arc_evict_state(). It's possible for multiple threads
	* to be calling arc_evict_state() concurrently (e.g.
	* dsl_pool_close() and zio_inject_fault()), so we must
	* skip any markers we see from these other threads.
	*/
	if (hdr->b_spa == 0)
	continue;

	/* we're only interested in evicting buffers of a certain spa */
	if (spa != 0 && hdr->b_spa != spa) {
	ARCSTAT_BUMP(arcstat_evict_skip);
	continue;
	}

	hash_lock = HDR_LOCK(hdr);

	/*
	* We aren't calling this function from any code path
	* that would already be holding a hash lock, so we're
	* asserting on this assumption to be defensive in case
	* this ever changes. Without this check, it would be
	* possible to incorrectly increment arcstat_mutex_miss
	* below (e.g. if the code changed such that we called
	* this function with a hash lock held).
	*/
	ASSERT(!MUTEX_HELD(hash_lock));

	if (mutex_tryenter(hash_lock)) {
	uint64_t evicted = arc_evict_hdr(hdr, hash_lock);
	mutex_exit(hash_lock);

	bytes_evicted += evicted;

	/*
	* If evicted is zero, arc_evict_hdr() must have
	* decided to skip this header, don't increment
	* evict_count in this case.
	*/
	if (evicted != 0)
	evict_count++;

	} else {
	ARCSTAT_BUMP(arcstat_mutex_miss);
	}
	}

	multilist_sublist_unlock(mls);

	/*
	* Increment the count of evicted bytes, and wake up any threads that
	* are waiting for the count to reach this value. Since the list is
	* ordered by ascending aew_count, we pop off the beginning of the
	* list until we reach the end, or a waiter that's past the current
	* "count". Doing this outside the loop reduces the number of times
	* we need to acquire the global arc_evict_lock.
	*
	* Only wake when there's sufficient free memory in the system
	* (specifically, arc_sys_free/2, which by default is a bit more than
	* 1/64th of RAM). See the comments in arc_wait_for_eviction().
	*/
	mutex_enter(&arc_evict_lock);
	arc_evict_count += bytes_evicted;

	if ((int64_t)(arc_free_memory() - arc_sys_free / 2) > 0) {
	arc_evict_waiter_t *aw;
	while ((aw = list_head(&arc_evict_waiters)) != NULL &&
	aw->aew_count <= arc_evict_count) {
	list_remove(&arc_evict_waiters, aw);
	cv_broadcast(&aw->aew_cv);
	}
	}
	arc_set_need_free();
	mutex_exit(&arc_evict_lock);

	/*
	* If the ARC size is reduced from arc_c_max to arc_c_min (especially
	* if the average cached block is small), eviction can be on-CPU for
	* many seconds. To ensure that other threads that may be bound to
	* this CPU are able to make progress, make a voluntary preemption
	* call here.
	*/
	cond_resched();

	return (bytes_evicted);
	}

	/*
	* Evict buffers from the given arc state, until we've removed the
	* specified number of bytes. Move the removed buffers to the
	* appropriate evict state.
	*
	* This function makes a "best effort". It skips over any buffers
	* it can't get a hash_lock on, and so, may not catch all candidates.
	* It may also return without evicting as much space as requested.
	*
	* If bytes is specified using the special value ARC_EVICT_ALL, this
	* will evict all available (i.e. unlocked and evictable) buffers from
	* the given arc state; which is used by arc_flush().
	*/
	static uint64_t
	arc_evict_state(arc_state_t *state, uint64_t spa, int64_t bytes,
	arc_buf_contents_t type)
	{
	uint64_t total_evicted = 0;
	multilist_t *ml = state->arcs_list[type];
	int num_sublists;
	arc_buf_hdr_t **markers;

	IMPLY(bytes < 0, bytes == ARC_EVICT_ALL);

	num_sublists = multilist_get_num_sublists(ml);

	/*
	* If we've tried to evict from each sublist, made some
	* progress, but still have not hit the target number of bytes
	* to evict, we want to keep trying. The markers allow us to
	* pick up where we left off for each individual sublist, rather
	* than starting from the tail each time.
	*/
	markers = kmem_zalloc(sizeof (markers) num_sublists, KM_SLEEP);
	for (int i = 0; i < num_sublists; i++) {
	multilist_sublist_t *mls;

	markers[i] = kmem_cache_alloc(hdr_full_cache, KM_SLEEP);

	/*
	* A b_spa of 0 is used to indicate that this header is
	* a marker. This fact is used in arc_evict_type() and
	* arc_evict_state_impl().
	*/
	markers[i]->b_spa = 0;

	mls = multilist_sublist_lock(ml, i);
	multilist_sublist_insert_tail(mls, markers[i]);
	multilist_sublist_unlock(mls);
	}

	/*
	* While we haven't hit our target number of bytes to evict, or
	* we're evicting all available buffers.
	*/
	while (total_evicted < bytes \|\| bytes == ARC_EVICT_ALL) {
	int sublist_idx = multilist_get_random_index(ml);
	uint64_t scan_evicted = 0;

	/*
	* Try to reduce pinned dnodes with a floor of arc_dnode_limit.
	* Request that 10% of the LRUs be scanned by the superblock
	* shrinker.
	*/
	if (type == ARC_BUFC_DATA && aggsum_compare(&astat_dnode_size,
	arc_dnode_size_limit) > 0) {
	arc_prune_async((aggsum_upper_bound(&astat_dnode_size) -
	arc_dnode_size_limit) / sizeof (dnode_t) /
	zfs_arc_dnode_reduce_percent);
	}

	/*
	* Start eviction using a randomly selected sublist,
	* this is to try and evenly balance eviction across all
	* sublists. Always starting at the same sublist
	* (e.g. index 0) would cause evictions to favor certain
	* sublists over others.
	*/
	for (int i = 0; i < num_sublists; i++) {
	uint64_t bytes_remaining;
	uint64_t bytes_evicted;

	if (bytes == ARC_EVICT_ALL)
	bytes_remaining = ARC_EVICT_ALL;
	else if (total_evicted < bytes)
	bytes_remaining = bytes - total_evicted;
	else
	break;

	bytes_evicted = arc_evict_state_impl(ml, sublist_idx,
	markers[sublist_idx], spa, bytes_remaining);

	scan_evicted += bytes_evicted;
	total_evicted += bytes_evicted;

	/* we've reached the end, wrap to the beginning */
	if (++sublist_idx >= num_sublists)
	sublist_idx = 0;
	}

	/*
	* If we didn't evict anything during this scan, we have
	* no reason to believe we'll evict more during another
	* scan, so break the loop.
	*/
	if (scan_evicted == 0) {
	/* This isn't possible, let's make that obvious */
	ASSERT3S(bytes, !=, 0);

	/*
	* When bytes is ARC_EVICT_ALL, the only way to
	* break the loop is when scan_evicted is zero.
	* In that case, we actually have evicted enough,
	* so we don't want to increment the kstat.
	*/
	if (bytes != ARC_EVICT_ALL) {
	ASSERT3S(total_evicted, <, bytes);
	ARCSTAT_BUMP(arcstat_evict_not_enough);
	}

	break;
	}
	}

	for (int i = 0; i < num_sublists; i++) {
	multilist_sublist_t *mls = multilist_sublist_lock(ml, i);
	multilist_sublist_remove(mls, markers[i]);
	multilist_sublist_unlock(mls);

	kmem_cache_free(hdr_full_cache, markers[i]);
	}
	kmem_free(markers, sizeof (markers) num_sublists);

	return (total_evicted);
	}

	/*
	* Flush all "evictable" data of the given type from the arc state
	* specified. This will not evict any "active" buffers (i.e. referenced).
	*
	* When 'retry' is set to B_FALSE, the function will make a single pass
	* over the state and evict any buffers that it can. Since it doesn't
	* continually retry the eviction, it might end up leaving some buffers
	* in the ARC due to lock misses.
	*
	* When 'retry' is set to B_TRUE, the function will continually retry the
	* eviction until all evictable buffers have been removed from the
	* state. As a result, if concurrent insertions into the state are
	* allowed (e.g. if the ARC isn't shutting down), this function might
	* wind up in an infinite loop, continually trying to evict buffers.
	*/
	static uint64_t
	arc_flush_state(arc_state_t *state, uint64_t spa, arc_buf_contents_t type,
	boolean_t retry)
	{
	uint64_t evicted = 0;

	while (zfs_refcount_count(&state->arcs_esize[type]) != 0) {
	evicted += arc_evict_state(state, spa, ARC_EVICT_ALL, type);

	if (!retry)
	break;
	}

	return (evicted);
	}

	/*
	* Evict the specified number of bytes from the state specified,
	* restricting eviction to the spa and type given. This function
	* prevents us from trying to evict more from a state's list than
	* is "evictable", and to skip evicting altogether when passed a
	* negative value for "bytes". In contrast, arc_evict_state() will
	* evict everything it can, when passed a negative value for "bytes".
	*/
	static uint64_t
	arc_evict_impl(arc_state_t *state, uint64_t spa, int64_t bytes,
	arc_buf_contents_t type)
	{
	int64_t delta;

	if (bytes > 0 && zfs_refcount_count(&state->arcs_esize[type]) > 0) {
	delta = MIN(zfs_refcount_count(&state->arcs_esize[type]),
	bytes);
	return (arc_evict_state(state, spa, delta, type));
	}

	return (0);
	}

	/*
	* The goal of this function is to evict enough meta data buffers from the
	* ARC in order to enforce the arc_meta_limit. Achieving this is slightly
	* more complicated than it appears because it is common for data buffers
	* to have holds on meta data buffers. In addition, dnode meta data buffers
	* will be held by the dnodes in the block preventing them from being freed.
	* This means we can't simply traverse the ARC and expect to always find
	* enough unheld meta data buffer to release.
	*
	* Therefore, this function has been updated to make alternating passes
	* over the ARC releasing data buffers and then newly unheld meta data
	* buffers. This ensures forward progress is maintained and meta_used
	* will decrease. Normally this is sufficient, but if required the ARC
	* will call the registered prune callbacks causing dentry and inodes to
	* be dropped from the VFS cache. This will make dnode meta data buffers
	* available for reclaim.
	*/
	static uint64_t
	arc_evict_meta_balanced(uint64_t meta_used)
	{
	int64_t delta, prune = 0, adjustmnt;
	uint64_t total_evicted = 0;
	arc_buf_contents_t type = ARC_BUFC_DATA;
	int restarts = MAX(zfs_arc_meta_adjust_restarts, 0);

	restart:
	/*
	* This slightly differs than the way we evict from the mru in
	* arc_evict because we don't have a "target" value (i.e. no
	* "meta" arc_p). As a result, I think we can completely
	* cannibalize the metadata in the MRU before we evict the
	* metadata from the MFU. I think we probably need to implement a
	* "metadata arc_p" value to do this properly.
	*/
	adjustmnt = meta_used - arc_meta_limit;

	if (adjustmnt > 0 &&
	zfs_refcount_count(&arc_mru->arcs_esize[type]) > 0) {
	delta = MIN(zfs_refcount_count(&arc_mru->arcs_esize[type]),
	adjustmnt);
	total_evicted += arc_evict_impl(arc_mru, 0, delta, type);
	adjustmnt -= delta;
	}

	/*
	* We can't afford to recalculate adjustmnt here. If we do,
	* new metadata buffers can sneak into the MRU or ANON lists,
	* thus penalize the MFU metadata. Although the fudge factor is
	* small, it has been empirically shown to be significant for
	* certain workloads (e.g. creating many empty directories). As
	* such, we use the original calculation for adjustmnt, and
	* simply decrement the amount of data evicted from the MRU.
	*/

	if (adjustmnt > 0 &&
	zfs_refcount_count(&arc_mfu->arcs_esize[type]) > 0) {
	delta = MIN(zfs_refcount_count(&arc_mfu->arcs_esize[type]),
	adjustmnt);
	total_evicted += arc_evict_impl(arc_mfu, 0, delta, type);
	}

	adjustmnt = meta_used - arc_meta_limit;

	if (adjustmnt > 0 &&
	zfs_refcount_count(&arc_mru_ghost->arcs_esize[type]) > 0) {
	delta = MIN(adjustmnt,
	zfs_refcount_count(&arc_mru_ghost->arcs_esize[type]));
	total_evicted += arc_evict_impl(arc_mru_ghost, 0, delta, type);
	adjustmnt -= delta;
	}

	if (adjustmnt > 0 &&
	zfs_refcount_count(&arc_mfu_ghost->arcs_esize[type]) > 0) {
	delta = MIN(adjustmnt,
	zfs_refcount_count(&arc_mfu_ghost->arcs_esize[type]));
	total_evicted += arc_evict_impl(arc_mfu_ghost, 0, delta, type);
	}

	/*
	* If after attempting to make the requested adjustment to the ARC
	* the meta limit is still being exceeded then request that the
	* higher layers drop some cached objects which have holds on ARC
	* meta buffers. Requests to the upper layers will be made with
	* increasingly large scan sizes until the ARC is below the limit.
	*/
	if (meta_used > arc_meta_limit) {
	if (type == ARC_BUFC_DATA) {
	type = ARC_BUFC_METADATA;
	} else {
	type = ARC_BUFC_DATA;

	if (zfs_arc_meta_prune) {
	prune += zfs_arc_meta_prune;
	arc_prune_async(prune);
	}
	}

	if (restarts > 0) {
	restarts--;
	goto restart;
	}
	}
	return (total_evicted);
	}

	/*
	* Evict metadata buffers from the cache, such that arc_meta_used is
	* capped by the arc_meta_limit tunable.
	*/
	static uint64_t
	arc_evict_meta_only(uint64_t meta_used)
	{
	uint64_t total_evicted = 0;
	int64_t target;

	/*
	* If we're over the meta limit, we want to evict enough
	* metadata to get back under the meta limit. We don't want to
	* evict so much that we drop the MRU below arc_p, though. If
	* we're over the meta limit more than we're over arc_p, we
	* evict some from the MRU here, and some from the MFU below.
	*/
	target = MIN((int64_t)(meta_used - arc_meta_limit),
	(int64_t)(zfs_refcount_count(&arc_anon->arcs_size) +
	zfs_refcount_count(&arc_mru->arcs_size) - arc_p));

	total_evicted += arc_evict_impl(arc_mru, 0, target, ARC_BUFC_METADATA);

	/*
	* Similar to the above, we want to evict enough bytes to get us
	* below the meta limit, but not so much as to drop us below the
	* space allotted to the MFU (which is defined as arc_c - arc_p).
	*/
	target = MIN((int64_t)(meta_used - arc_meta_limit),
	(int64_t)(zfs_refcount_count(&arc_mfu->arcs_size) -
	(arc_c - arc_p)));

	total_evicted += arc_evict_impl(arc_mfu, 0, target, ARC_BUFC_METADATA);

	return (total_evicted);
	}

	static uint64_t
	arc_evict_meta(uint64_t meta_used)
	{
	if (zfs_arc_meta_strategy == ARC_STRATEGY_META_ONLY)
	return (arc_evict_meta_only(meta_used));
	else
	return (arc_evict_meta_balanced(meta_used));
	}

	/*
	* Return the type of the oldest buffer in the given arc state
	*
	* This function will select a random sublist of type ARC_BUFC_DATA and
	* a random sublist of type ARC_BUFC_METADATA. The tail of each sublist
	* is compared, and the type which contains the "older" buffer will be
	* returned.
	*/
	static arc_buf_contents_t
	arc_evict_type(arc_state_t *state)
	{
	multilist_t *data_ml = state->arcs_list[ARC_BUFC_DATA];
	multilist_t *meta_ml = state->arcs_list[ARC_BUFC_METADATA];
	int data_idx = multilist_get_random_index(data_ml);
	int meta_idx = multilist_get_random_index(meta_ml);
	multilist_sublist_t *data_mls;
	multilist_sublist_t *meta_mls;
	arc_buf_contents_t type;
	arc_buf_hdr_t *data_hdr;
	arc_buf_hdr_t *meta_hdr;

	/*
	* We keep the sublist lock until we're finished, to prevent
	* the headers from being destroyed via arc_evict_state().
	*/
	data_mls = multilist_sublist_lock(data_ml, data_idx);
	meta_mls = multilist_sublist_lock(meta_ml, meta_idx);

	/*
	* These two loops are to ensure we skip any markers that
	* might be at the tail of the lists due to arc_evict_state().
	*/

	for (data_hdr = multilist_sublist_tail(data_mls); data_hdr != NULL;
	data_hdr = multilist_sublist_prev(data_mls, data_hdr)) {
	if (data_hdr->b_spa != 0)
	break;
	}

	for (meta_hdr = multilist_sublist_tail(meta_mls); meta_hdr != NULL;
	meta_hdr = multilist_sublist_prev(meta_mls, meta_hdr)) {
	if (meta_hdr->b_spa != 0)
	break;
	}

	if (data_hdr == NULL && meta_hdr == NULL) {
	type = ARC_BUFC_DATA;
	} else if (data_hdr == NULL) {
	ASSERT3P(meta_hdr, !=, NULL);
	type = ARC_BUFC_METADATA;
	} else if (meta_hdr == NULL) {
	ASSERT3P(data_hdr, !=, NULL);
	type = ARC_BUFC_DATA;
	} else {
	ASSERT3P(data_hdr, !=, NULL);
	ASSERT3P(meta_hdr, !=, NULL);

	/* The headers can't be on the sublist without an L1 header */
	ASSERT(HDR_HAS_L1HDR(data_hdr));
	ASSERT(HDR_HAS_L1HDR(meta_hdr));

	if (data_hdr->b_l1hdr.b_arc_access <
	meta_hdr->b_l1hdr.b_arc_access) {
	type = ARC_BUFC_DATA;
	} else {
	type = ARC_BUFC_METADATA;
	}
	}

	multilist_sublist_unlock(meta_mls);
	multilist_sublist_unlock(data_mls);

	return (type);
	}

	/*
	* Evict buffers from the cache, such that arc_size is capped by arc_c.
	*/
	static uint64_t
	arc_evict(void)
	{
	uint64_t total_evicted = 0;
	uint64_t bytes;
	int64_t target;
	uint64_t asize = aggsum_value(&arc_size);
	uint64_t ameta = aggsum_value(&arc_meta_used);

	/*
	* If we're over arc_meta_limit, we want to correct that before
	* potentially evicting data buffers below.
	*/
	total_evicted += arc_evict_meta(ameta);

	/*
	* Adjust MRU size
	*
	* If we're over the target cache size, we want to evict enough
	* from the list to get back to our target size. We don't want
	* to evict too much from the MRU, such that it drops below
	* arc_p. So, if we're over our target cache size more than
	* the MRU is over arc_p, we'll evict enough to get back to
	* arc_p here, and then evict more from the MFU below.
	*/
	target = MIN((int64_t)(asize - arc_c),
	(int64_t)(zfs_refcount_count(&arc_anon->arcs_size) +
	zfs_refcount_count(&arc_mru->arcs_size) + ameta - arc_p));

	/*
	* If we're below arc_meta_min, always prefer to evict data.
	* Otherwise, try to satisfy the requested number of bytes to
	* evict from the type which contains older buffers; in an
	* effort to keep newer buffers in the cache regardless of their
	* type. If we cannot satisfy the number of bytes from this
	* type, spill over into the next type.
	*/
	if (arc_evict_type(arc_mru) == ARC_BUFC_METADATA &&
	ameta > arc_meta_min) {
	bytes = arc_evict_impl(arc_mru, 0, target, ARC_BUFC_METADATA);
	total_evicted += bytes;

	/*
	* If we couldn't evict our target number of bytes from
	* metadata, we try to get the rest from data.
	*/
	target -= bytes;

	total_evicted +=
	arc_evict_impl(arc_mru, 0, target, ARC_BUFC_DATA);
	} else {
	bytes = arc_evict_impl(arc_mru, 0, target, ARC_BUFC_DATA);
	total_evicted += bytes;

	/*
	* If we couldn't evict our target number of bytes from
	* data, we try to get the rest from metadata.
	*/
	target -= bytes;

	total_evicted +=
	arc_evict_impl(arc_mru, 0, target, ARC_BUFC_METADATA);
	}

	/*
	* Re-sum ARC stats after the first round of evictions.
	*/
	asize = aggsum_value(&arc_size);
	ameta = aggsum_value(&arc_meta_used);


	/*
	* Adjust MFU size
	*
	* Now that we've tried to evict enough from the MRU to get its
	* size back to arc_p, if we're still above the target cache
	* size, we evict the rest from the MFU.
	*/
	target = asize - arc_c;

	if (arc_evict_type(arc_mfu) == ARC_BUFC_METADATA &&
	ameta > arc_meta_min) {
	bytes = arc_evict_impl(arc_mfu, 0, target, ARC_BUFC_METADATA);
	total_evicted += bytes;

	/*
	* If we couldn't evict our target number of bytes from
	* metadata, we try to get the rest from data.
	*/
	target -= bytes;

	total_evicted +=
	arc_evict_impl(arc_mfu, 0, target, ARC_BUFC_DATA);
	} else {
	bytes = arc_evict_impl(arc_mfu, 0, target, ARC_BUFC_DATA);
	total_evicted += bytes;

	/*
	* If we couldn't evict our target number of bytes from
	* data, we try to get the rest from data.
	*/
	target -= bytes;

	total_evicted +=
	arc_evict_impl(arc_mfu, 0, target, ARC_BUFC_METADATA);
	}

	/*
	* Adjust ghost lists
	*
	* In addition to the above, the ARC also defines target values
	* for the ghost lists. The sum of the mru list and mru ghost
	* list should never exceed the target size of the cache, and
	* the sum of the mru list, mfu list, mru ghost list, and mfu
	* ghost list should never exceed twice the target size of the
	* cache. The following logic enforces these limits on the ghost
	* caches, and evicts from them as needed.
	*/
	target = zfs_refcount_count(&arc_mru->arcs_size) +
	zfs_refcount_count(&arc_mru_ghost->arcs_size) - arc_c;

	bytes = arc_evict_impl(arc_mru_ghost, 0, target, ARC_BUFC_DATA);
	total_evicted += bytes;

	target -= bytes;

	total_evicted +=
	arc_evict_impl(arc_mru_ghost, 0, target, ARC_BUFC_METADATA);

	/*
	* We assume the sum of the mru list and mfu list is less than
	* or equal to arc_c (we enforced this above), which means we
	* can use the simpler of the two equations below:
	*
	* mru + mfu + mru ghost + mfu ghost <= 2 * arc_c
	* mru ghost + mfu ghost <= arc_c
	*/
	target = zfs_refcount_count(&arc_mru_ghost->arcs_size) +
	zfs_refcount_count(&arc_mfu_ghost->arcs_size) - arc_c;

	bytes = arc_evict_impl(arc_mfu_ghost, 0, target, ARC_BUFC_DATA);
	total_evicted += bytes;

	target -= bytes;

	total_evicted +=
	arc_evict_impl(arc_mfu_ghost, 0, target, ARC_BUFC_METADATA);

	return (total_evicted);
	}

	void
	arc_flush(spa_t *spa, boolean_t retry)
	{
	uint64_t guid = 0;

	/*
	* If retry is B_TRUE, a spa must not be specified since we have
	* no good way to determine if all of a spa's buffers have been
	* evicted from an arc state.
	*/
	ASSERT(!retry \|\| spa == 0);

	if (spa != NULL)
	guid = spa_load_guid(spa);

	(void) arc_flush_state(arc_mru, guid, ARC_BUFC_DATA, retry);
	(void) arc_flush_state(arc_mru, guid, ARC_BUFC_METADATA, retry);

	(void) arc_flush_state(arc_mfu, guid, ARC_BUFC_DATA, retry);
	(void) arc_flush_state(arc_mfu, guid, ARC_BUFC_METADATA, retry);

	(void) arc_flush_state(arc_mru_ghost, guid, ARC_BUFC_DATA, retry);
	(void) arc_flush_state(arc_mru_ghost, guid, ARC_BUFC_METADATA, retry);

	(void) arc_flush_state(arc_mfu_ghost, guid, ARC_BUFC_DATA, retry);
	(void) arc_flush_state(arc_mfu_ghost, guid, ARC_BUFC_METADATA, retry);
	}

	void
	arc_reduce_target_size(int64_t to_free)
	{
	uint64_t asize = aggsum_value(&arc_size);

	/*
	* All callers want the ARC to actually evict (at least) this much
	* memory. Therefore we reduce from the lower of the current size and
	* the target size. This way, even if arc_c is much higher than
	* arc_size (as can be the case after many calls to arc_freed(), we will
	* immediately have arc_c < arc_size and therefore the arc_evict_zthr
	* will evict.
	*/
	uint64_t c = MIN(arc_c, asize);

	if (c > to_free && c - to_free > arc_c_min) {
	arc_c = c - to_free;
	atomic_add_64(&arc_p, -(arc_p >> arc_shrink_shift));
	if (arc_p > arc_c)
	arc_p = (arc_c >> 1);
	ASSERT(arc_c >= arc_c_min);
	ASSERT((int64_t)arc_p >= 0);
	} else {
	arc_c = arc_c_min;
	}

	if (asize > arc_c) {
	/* See comment in arc_evict_cb_check() on why lock+flag */
	mutex_enter(&arc_evict_lock);
	arc_evict_needed = B_TRUE;
	mutex_exit(&arc_evict_lock);
	zthr_wakeup(arc_evict_zthr);
	}
	}

	/*
	* Determine if the system is under memory pressure and is asking
	* to reclaim memory. A return value of B_TRUE indicates that the system
	* is under memory pressure and that the arc should adjust accordingly.
	*/
	boolean_t
	arc_reclaim_needed(void)
	{
	return (arc_available_memory() < 0);
	}

	void
	arc_kmem_reap_soon(void)
	{
	size_t i;
	kmem_cache_t *prev_cache = NULL;
	kmem_cache_t *prev_data_cache = NULL;
	extern kmem_cache_t *zio_buf_cache[];
	extern kmem_cache_t *zio_data_buf_cache[];

	#ifdef _KERNEL
	if ((aggsum_compare(&arc_meta_used, arc_meta_limit) >= 0) &&
	zfs_arc_meta_prune) {
	/*
	* We are exceeding our meta-data cache limit.
	* Prune some entries to release holds on meta-data.
	*/
	arc_prune_async(zfs_arc_meta_prune);
	}
	#if defined(_ILP32)
	/*
	* Reclaim unused memory from all kmem caches.
	*/
	kmem_reap();
	#endif
	#endif

	for (i = 0; i < SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT; i++) {
	#if defined(_ILP32)
	/* reach upper limit of cache size on 32-bit */
	if (zio_buf_cache[i] == NULL)
	break;
	#endif
	if (zio_buf_cache[i] != prev_cache) {
	prev_cache = zio_buf_cache[i];
	kmem_cache_reap_now(zio_buf_cache[i]);
	}
	if (zio_data_buf_cache[i] != prev_data_cache) {
	prev_data_cache = zio_data_buf_cache[i];
	kmem_cache_reap_now(zio_data_buf_cache[i]);
	}
	}
	kmem_cache_reap_now(buf_cache);
	kmem_cache_reap_now(hdr_full_cache);
	kmem_cache_reap_now(hdr_l2only_cache);
	kmem_cache_reap_now(zfs_btree_leaf_cache);
	abd_cache_reap_now();
	}

	/* ARGSUSED */
	static boolean_t
	arc_evict_cb_check(void arg, zthr_t zthr)
	{
	/*
	* This is necessary so that any changes which may have been made to
	* many of the zfs_arc_* module parameters will be propagated to
	* their actual internal variable counterparts. Without this,
	* changing those module params at runtime would have no effect.
	*/
	arc_tuning_update(B_FALSE);

	/*
	* This is necessary in order to keep the kstat information
	* up to date for tools that display kstat data such as the
	* mdb ::arc dcmd and the Linux crash utility. These tools
	* typically do not call kstat's update function, but simply
	* dump out stats from the most recent update. Without
	* this call, these commands may show stale stats for the
	* anon, mru, mru_ghost, mfu, and mfu_ghost lists. Even
	* with this change, the data might be up to 1 second
	* out of date(the arc_evict_zthr has a maximum sleep
	* time of 1 second); but that should suffice. The
	* arc_state_t structures can be queried directly if more
	* accurate information is needed.
	*/
	if (arc_ksp != NULL)
	arc_ksp->ks_update(arc_ksp, KSTAT_READ);

	/*
	* We have to rely on arc_wait_for_eviction() to tell us when to
	* evict, rather than checking if we are overflowing here, so that we
	* are sure to not leave arc_wait_for_eviction() waiting on aew_cv.
	* If we have become "not overflowing" since arc_wait_for_eviction()
	* checked, we need to wake it up. We could broadcast the CV here,
	* but arc_wait_for_eviction() may have not yet gone to sleep. We
	* would need to use a mutex to ensure that this function doesn't
	* broadcast until arc_wait_for_eviction() has gone to sleep (e.g.
	* the arc_evict_lock). However, the lock ordering of such a lock
	* would necessarily be incorrect with respect to the zthr_lock,
	* which is held before this function is called, and is held by
	* arc_wait_for_eviction() when it calls zthr_wakeup().
	*/
	return (arc_evict_needed);
	}

	/*
	* Keep arc_size under arc_c by running arc_evict which evicts data
	* from the ARC.
	*/
	/* ARGSUSED */
	static void
	arc_evict_cb(void arg, zthr_t zthr)
	{
	uint64_t evicted = 0;
	fstrans_cookie_t cookie = spl_fstrans_mark();

	/* Evict from cache */
	evicted = arc_evict();

	/*
	* If evicted is zero, we couldn't evict anything
	* via arc_evict(). This could be due to hash lock
	* collisions, but more likely due to the majority of
	* arc buffers being unevictable. Therefore, even if
	* arc_size is above arc_c, another pass is unlikely to
	* be helpful and could potentially cause us to enter an
	* infinite loop. Additionally, zthr_iscancelled() is
	* checked here so that if the arc is shutting down, the
	* broadcast will wake any remaining arc evict waiters.
	*/
	mutex_enter(&arc_evict_lock);
	arc_evict_needed = !zthr_iscancelled(arc_evict_zthr) &&
	evicted > 0 && aggsum_compare(&arc_size, arc_c) > 0;
	if (!arc_evict_needed) {
	/*
	* We're either no longer overflowing, or we
	* can't evict anything more, so we should wake
	* arc_get_data_impl() sooner.
	*/
	arc_evict_waiter_t *aw;
	while ((aw = list_remove_head(&arc_evict_waiters)) != NULL) {
	cv_broadcast(&aw->aew_cv);
	}
	arc_set_need_free();
	}
	mutex_exit(&arc_evict_lock);
	spl_fstrans_unmark(cookie);
	}

	/* ARGSUSED */
	static boolean_t
	arc_reap_cb_check(void arg, zthr_t zthr)
	{
	int64_t free_memory = arc_available_memory();

	/*
	* If a kmem reap is already active, don't schedule more. We must
	* check for this because kmem_cache_reap_soon() won't actually
	* block on the cache being reaped (this is to prevent callers from
	* becoming implicitly blocked by a system-wide kmem reap -- which,
	* on a system with many, many full magazines, can take minutes).
	*/
	if (!kmem_cache_reap_active() && free_memory < 0) {

	arc_no_grow = B_TRUE;
	arc_warm = B_TRUE;
	/*
	* Wait at least zfs_grow_retry (default 5) seconds
	* before considering growing.
	*/
	arc_growtime = gethrtime() + SEC2NSEC(arc_grow_retry);
	return (B_TRUE);
	} else if (free_memory < arc_c >> arc_no_grow_shift) {
	arc_no_grow = B_TRUE;
	} else if (gethrtime() >= arc_growtime) {
	arc_no_grow = B_FALSE;
	}

	return (B_FALSE);
	}

	/*
	* Keep enough free memory in the system by reaping the ARC's kmem
	* caches. To cause more slabs to be reapable, we may reduce the
	* target size of the cache (arc_c), causing the arc_evict_cb()
	* to free more buffers.
	*/
	/* ARGSUSED */
	static void
	arc_reap_cb(void arg, zthr_t zthr)
	{
	int64_t free_memory;
	fstrans_cookie_t cookie = spl_fstrans_mark();

	/*
	* Kick off asynchronous kmem_reap()'s of all our caches.
	*/
	arc_kmem_reap_soon();

	/*
	* Wait at least arc_kmem_cache_reap_retry_ms between
	* arc_kmem_reap_soon() calls. Without this check it is possible to
	* end up in a situation where we spend lots of time reaping
	* caches, while we're near arc_c_min. Waiting here also gives the
	* subsequent free memory check a chance of finding that the
	* asynchronous reap has already freed enough memory, and we don't
	* need to call arc_reduce_target_size().
	*/
	delay((hz * arc_kmem_cache_reap_retry_ms + 999) / 1000);

	/*
	* Reduce the target size as needed to maintain the amount of free
	* memory in the system at a fraction of the arc_size (1/128th by
	* default). If oversubscribed (free_memory < 0) then reduce the
	* target arc_size by the deficit amount plus the fractional
	* amount. If free memory is positive but less then the fractional
	* amount, reduce by what is needed to hit the fractional amount.
	*/
	free_memory = arc_available_memory();

	int64_t to_free =
	(arc_c >> arc_shrink_shift) - free_memory;
	if (to_free > 0) {
	arc_reduce_target_size(to_free);
	}
	spl_fstrans_unmark(cookie);
	}

	#ifdef _KERNEL
	/*
	* Determine the amount of memory eligible for eviction contained in the
	* ARC. All clean data reported by the ghost lists can always be safely
	* evicted. Due to arc_c_min, the same does not hold for all clean data
	* contained by the regular mru and mfu lists.
	*
	* In the case of the regular mru and mfu lists, we need to report as
	* much clean data as possible, such that evicting that same reported
	* data will not bring arc_size below arc_c_min. Thus, in certain
	* circumstances, the total amount of clean data in the mru and mfu
	* lists might not actually be evictable.
	*
	* The following two distinct cases are accounted for:
	*
	* 1. The sum of the amount of dirty data contained by both the mru and
	* mfu lists, plus the ARC's other accounting (e.g. the anon list),
	* is greater than or equal to arc_c_min.
	* (i.e. amount of dirty data >= arc_c_min)
	*
	* This is the easy case; all clean data contained by the mru and mfu
	* lists is evictable. Evicting all clean data can only drop arc_size
	* to the amount of dirty data, which is greater than arc_c_min.
	*
	* 2. The sum of the amount of dirty data contained by both the mru and
	* mfu lists, plus the ARC's other accounting (e.g. the anon list),
	* is less than arc_c_min.
	* (i.e. arc_c_min > amount of dirty data)
	*
	* 2.1. arc_size is greater than or equal arc_c_min.
	* (i.e. arc_size >= arc_c_min > amount of dirty data)
	*
	* In this case, not all clean data from the regular mru and mfu
	* lists is actually evictable; we must leave enough clean data
	* to keep arc_size above arc_c_min. Thus, the maximum amount of
	* evictable data from the two lists combined, is exactly the
	* difference between arc_size and arc_c_min.
	*
	* 2.2. arc_size is less than arc_c_min
	* (i.e. arc_c_min > arc_size > amount of dirty data)
	*
	* In this case, none of the data contained in the mru and mfu
	* lists is evictable, even if it's clean. Since arc_size is
	* already below arc_c_min, evicting any more would only
	* increase this negative difference.
	*/

	#endif /* _KERNEL */

	/*
	* Adapt arc info given the number of bytes we are trying to add and
	* the state that we are coming from. This function is only called
	* when we are adding new content to the cache.
	*/
	static void
	arc_adapt(int bytes, arc_state_t *state)
	{
	int mult;
	uint64_t arc_p_min = (arc_c >> arc_p_min_shift);
	int64_t mrug_size = zfs_refcount_count(&arc_mru_ghost->arcs_size);
	int64_t mfug_size = zfs_refcount_count(&arc_mfu_ghost->arcs_size);

	ASSERT(bytes > 0);
	/*
	* Adapt the target size of the MRU list:
	* - if we just hit in the MRU ghost list, then increase
	* the target size of the MRU list.
	* - if we just hit in the MFU ghost list, then increase
	* the target size of the MFU list by decreasing the
	* target size of the MRU list.
	*/
	if (state == arc_mru_ghost) {
	mult = (mrug_size >= mfug_size) ? 1 : (mfug_size / mrug_size);
	if (!zfs_arc_p_dampener_disable)
	mult = MIN(mult, 10); /* avoid wild arc_p adjustment */

	arc_p = MIN(arc_c - arc_p_min, arc_p + bytes * mult);
	} else if (state == arc_mfu_ghost) {
	uint64_t delta;

	mult = (mfug_size >= mrug_size) ? 1 : (mrug_size / mfug_size);
	if (!zfs_arc_p_dampener_disable)
	mult = MIN(mult, 10);

	delta = MIN(bytes * mult, arc_p);
	arc_p = MAX(arc_p_min, arc_p - delta);
	}
	ASSERT((int64_t)arc_p >= 0);

	/*
	* Wake reap thread if we do not have any available memory
	*/
	if (arc_reclaim_needed()) {
	zthr_wakeup(arc_reap_zthr);
	return;
	}

	if (arc_no_grow)
	return;

	if (arc_c >= arc_c_max)
	return;

	/*
	* If we're within (2 * maxblocksize) bytes of the target
	* cache size, increment the target cache size
	*/
	ASSERT3U(arc_c, >=, 2ULL << SPA_MAXBLOCKSHIFT);
	if (aggsum_upper_bound(&arc_size) >=
	arc_c - (2ULL << SPA_MAXBLOCKSHIFT)) {
	atomic_add_64(&arc_c, (int64_t)bytes);
	if (arc_c > arc_c_max)
	arc_c = arc_c_max;
	else if (state == arc_anon)
	atomic_add_64(&arc_p, (int64_t)bytes);
	if (arc_p > arc_c)
	arc_p = arc_c;
	}
	ASSERT((int64_t)arc_p >= 0);
	}

	/*
	* Check if arc_size has grown past our upper threshold, determined by
	* zfs_arc_overflow_shift.
	*/
	boolean_t
	arc_is_overflowing(void)
	{
	/* Always allow at least one block of overflow */
	int64_t overflow = MAX(SPA_MAXBLOCKSIZE,
	arc_c >> zfs_arc_overflow_shift);

	/*
	* We just compare the lower bound here for performance reasons. Our
	* primary goals are to make sure that the arc never grows without
	* bound, and that it can reach its maximum size. This check
	* accomplishes both goals. The maximum amount we could run over by is
	* 2 * aggsum_borrow_multiplier * NUM_CPUS * the average size of a block
	* in the ARC. In practice, that's in the tens of MB, which is low
	* enough to be safe.
	*/
	return (aggsum_lower_bound(&arc_size) >= (int64_t)arc_c + overflow);
	}

	static abd_t *
	arc_get_data_abd(arc_buf_hdr_t hdr, uint64_t size, void tag,
	boolean_t do_adapt)
	{
	arc_buf_contents_t type = arc_buf_type(hdr);

	arc_get_data_impl(hdr, size, tag, do_adapt);
	if (type == ARC_BUFC_METADATA) {
	return (abd_alloc(size, B_TRUE));
	} else {
	ASSERT(type == ARC_BUFC_DATA);
	return (abd_alloc(size, B_FALSE));
	}
	}

	static void *
	arc_get_data_buf(arc_buf_hdr_t hdr, uint64_t size, void tag)
	{
	arc_buf_contents_t type = arc_buf_type(hdr);

	arc_get_data_impl(hdr, size, tag, B_TRUE);
	if (type == ARC_BUFC_METADATA) {
	return (zio_buf_alloc(size));
	} else {
	ASSERT(type == ARC_BUFC_DATA);
	return (zio_data_buf_alloc(size));
	}
	}

	/*
	* Wait for the specified amount of data (in bytes) to be evicted from the
	* ARC, and for there to be sufficient free memory in the system. Waiting for
	* eviction ensures that the memory used by the ARC decreases. Waiting for
	* free memory ensures that the system won't run out of free pages, regardless
	* of ARC behavior and settings. See arc_lowmem_init().
	*/
	void
	arc_wait_for_eviction(uint64_t amount)
	{
	mutex_enter(&arc_evict_lock);
	if (arc_is_overflowing()) {
	arc_evict_needed = B_TRUE;
	zthr_wakeup(arc_evict_zthr);

	if (amount != 0) {
	arc_evict_waiter_t aw;
	list_link_init(&aw.aew_node);
	cv_init(&aw.aew_cv, NULL, CV_DEFAULT, NULL);

	arc_evict_waiter_t *last =
	list_tail(&arc_evict_waiters);
	if (last != NULL) {
	ASSERT3U(last->aew_count, >, arc_evict_count);
	aw.aew_count = last->aew_count + amount;
	} else {
	aw.aew_count = arc_evict_count + amount;
	}

	list_insert_tail(&arc_evict_waiters, &aw);

	arc_set_need_free();

	DTRACE_PROBE3(arc__wait__for__eviction,
	uint64_t, amount,
	uint64_t, arc_evict_count,
	uint64_t, aw.aew_count);

	/*
	* We will be woken up either when arc_evict_count
	* reaches aew_count, or when the ARC is no longer
	* overflowing and eviction completes.
	*/
	cv_wait(&aw.aew_cv, &arc_evict_lock);

	/*
	* In case of "false" wakeup, we will still be on the
	* list.
	*/
	if (list_link_active(&aw.aew_node))
	list_remove(&arc_evict_waiters, &aw);

	cv_destroy(&aw.aew_cv);
	}
	}
	mutex_exit(&arc_evict_lock);
	}

	/*
	* Allocate a block and return it to the caller. If we are hitting the
	* hard limit for the cache size, we must sleep, waiting for the eviction
	* thread to catch up. If we're past the target size but below the hard
	* limit, we'll only signal the reclaim thread and continue on.
	*/
	static void
	arc_get_data_impl(arc_buf_hdr_t hdr, uint64_t size, void tag,
	boolean_t do_adapt)
	{
	arc_state_t *state = hdr->b_l1hdr.b_state;
	arc_buf_contents_t type = arc_buf_type(hdr);

	if (do_adapt)
	arc_adapt(size, state);

	/*
	* If arc_size is currently overflowing, we must be adding data
	* faster than we are evicting. To ensure we don't compound the
	* problem by adding more data and forcing arc_size to grow even
	* further past it's target size, we wait for the eviction thread to
	* make some progress. We also wait for there to be sufficient free
	* memory in the system, as measured by arc_free_memory().
	*
	* Specifically, we wait for zfs_arc_eviction_pct percent of the
	* requested size to be evicted. This should be more than 100%, to
	* ensure that that progress is also made towards getting arc_size
	* under arc_c. See the comment above zfs_arc_eviction_pct.
	*
	* We do the overflowing check without holding the arc_evict_lock to
	* reduce lock contention in this hot path. Note that
	* arc_wait_for_eviction() will acquire the lock and check again to
	* ensure we are truly overflowing before blocking.
	*/
	if (arc_is_overflowing()) {
	arc_wait_for_eviction(size *
	zfs_arc_eviction_pct / 100);
	}

	VERIFY3U(hdr->b_type, ==, type);
	if (type == ARC_BUFC_METADATA) {
	arc_space_consume(size, ARC_SPACE_META);
	} else {
	arc_space_consume(size, ARC_SPACE_DATA);
	}

	/*
	* Update the state size. Note that ghost states have a
	* "ghost size" and so don't need to be updated.
	*/
	if (!GHOST_STATE(state)) {

	(void) zfs_refcount_add_many(&state->arcs_size, size, tag);

	/*
	* If this is reached via arc_read, the link is
	* protected by the hash lock. If reached via
	* arc_buf_alloc, the header should not be accessed by
	* any other thread. And, if reached via arc_read_done,
	* the hash lock will protect it if it's found in the
	* hash table; otherwise no other thread should be
	* trying to [add\|remove]_reference it.
	*/
	if (multilist_link_active(&hdr->b_l1hdr.b_arc_node)) {
	ASSERT(zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt));
	(void) zfs_refcount_add_many(&state->arcs_esize[type],
	size, tag);
	}

	/*
	* If we are growing the cache, and we are adding anonymous
	* data, and we have outgrown arc_p, update arc_p
	*/
	if (aggsum_upper_bound(&arc_size) < arc_c &&
	hdr->b_l1hdr.b_state == arc_anon &&
	(zfs_refcount_count(&arc_anon->arcs_size) +
	zfs_refcount_count(&arc_mru->arcs_size) > arc_p))
	arc_p = MIN(arc_c, arc_p + size);
	}
	}

	static void
	arc_free_data_abd(arc_buf_hdr_t hdr, abd_t abd, uint64_t size, void *tag)
	{
	arc_free_data_impl(hdr, size, tag);
	abd_free(abd);
	}

	static void
	arc_free_data_buf(arc_buf_hdr_t hdr, void buf, uint64_t size, void *tag)
	{
	arc_buf_contents_t type = arc_buf_type(hdr);

	arc_free_data_impl(hdr, size, tag);
	if (type == ARC_BUFC_METADATA) {
	zio_buf_free(buf, size);
	} else {
	ASSERT(type == ARC_BUFC_DATA);
	zio_data_buf_free(buf, size);
	}
	}

	/*
	* Free the arc data buffer.
	*/
	static void
	arc_free_data_impl(arc_buf_hdr_t hdr, uint64_t size, void tag)
	{
	arc_state_t *state = hdr->b_l1hdr.b_state;
	arc_buf_contents_t type = arc_buf_type(hdr);

	/* protected by hash lock, if in the hash table */
	if (multilist_link_active(&hdr->b_l1hdr.b_arc_node)) {
	ASSERT(zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt));
	ASSERT(state != arc_anon && state != arc_l2c_only);

	(void) zfs_refcount_remove_many(&state->arcs_esize[type],
	size, tag);
	}
	(void) zfs_refcount_remove_many(&state->arcs_size, size, tag);

	VERIFY3U(hdr->b_type, ==, type);
	if (type == ARC_BUFC_METADATA) {
	arc_space_return(size, ARC_SPACE_META);
	} else {
	ASSERT(type == ARC_BUFC_DATA);
	arc_space_return(size, ARC_SPACE_DATA);
	}
	}

	/*
	* This routine is called whenever a buffer is accessed.
	* NOTE: the hash lock is dropped in this function.
	*/
	static void
	arc_access(arc_buf_hdr_t hdr, kmutex_t hash_lock)
	{
	clock_t now;

	ASSERT(MUTEX_HELD(hash_lock));
	ASSERT(HDR_HAS_L1HDR(hdr));

	if (hdr->b_l1hdr.b_state == arc_anon) {
	/*
	* This buffer is not in the cache, and does not
	* appear in our "ghost" list. Add the new buffer
	* to the MRU state.
	*/

	ASSERT0(hdr->b_l1hdr.b_arc_access);
	hdr->b_l1hdr.b_arc_access = ddi_get_lbolt();
	DTRACE_PROBE1(new_state__mru, arc_buf_hdr_t *, hdr);
	arc_change_state(arc_mru, hdr, hash_lock);

	} else if (hdr->b_l1hdr.b_state == arc_mru) {
	now = ddi_get_lbolt();

	/*
	* If this buffer is here because of a prefetch, then either:
	* - clear the flag if this is a "referencing" read
	* (any subsequent access will bump this into the MFU state).
	* or
	* - move the buffer to the head of the list if this is
	* another prefetch (to make it less likely to be evicted).
	*/
	if (HDR_PREFETCH(hdr) \|\| HDR_PRESCIENT_PREFETCH(hdr)) {
	if (zfs_refcount_count(&hdr->b_l1hdr.b_refcnt) == 0) {
	/* link protected by hash lock */
	ASSERT(multilist_link_active(
	&hdr->b_l1hdr.b_arc_node));
	} else {
	arc_hdr_clear_flags(hdr,
	ARC_FLAG_PREFETCH \|
	ARC_FLAG_PRESCIENT_PREFETCH);
	atomic_inc_32(&hdr->b_l1hdr.b_mru_hits);
	ARCSTAT_BUMP(arcstat_mru_hits);
	}
	hdr->b_l1hdr.b_arc_access = now;
	return;
	}

	/*
	* This buffer has been "accessed" only once so far,
	* but it is still in the cache. Move it to the MFU
	* state.
	*/
	if (ddi_time_after(now, hdr->b_l1hdr.b_arc_access +
	ARC_MINTIME)) {
	/*
	* More than 125ms have passed since we
	* instantiated this buffer. Move it to the
	* most frequently used state.
	*/
	hdr->b_l1hdr.b_arc_access = now;
	DTRACE_PROBE1(new_state__mfu, arc_buf_hdr_t *, hdr);
	arc_change_state(arc_mfu, hdr, hash_lock);
	}
	atomic_inc_32(&hdr->b_l1hdr.b_mru_hits);
	ARCSTAT_BUMP(arcstat_mru_hits);
	} else if (hdr->b_l1hdr.b_state == arc_mru_ghost) {
	arc_state_t *new_state;
	/*
	* This buffer has been "accessed" recently, but
	* was evicted from the cache. Move it to the
	* MFU state.
	*/

	if (HDR_PREFETCH(hdr) \|\| HDR_PRESCIENT_PREFETCH(hdr)) {
	new_state = arc_mru;
	if (zfs_refcount_count(&hdr->b_l1hdr.b_refcnt) > 0) {
	arc_hdr_clear_flags(hdr,
	ARC_FLAG_PREFETCH \|
	ARC_FLAG_PRESCIENT_PREFETCH);
	}
	DTRACE_PROBE1(new_state__mru, arc_buf_hdr_t *, hdr);
	} else {
	new_state = arc_mfu;
	DTRACE_PROBE1(new_state__mfu, arc_buf_hdr_t *, hdr);
	}

	hdr->b_l1hdr.b_arc_access = ddi_get_lbolt();
	arc_change_state(new_state, hdr, hash_lock);

	atomic_inc_32(&hdr->b_l1hdr.b_mru_ghost_hits);
	ARCSTAT_BUMP(arcstat_mru_ghost_hits);
	} else if (hdr->b_l1hdr.b_state == arc_mfu) {
	/*
	* This buffer has been accessed more than once and is
	* still in the cache. Keep it in the MFU state.
	*
	* NOTE: an add_reference() that occurred when we did
	* the arc_read() will have kicked this off the list.
	* If it was a prefetch, we will explicitly move it to
	* the head of the list now.
	*/

	atomic_inc_32(&hdr->b_l1hdr.b_mfu_hits);
	ARCSTAT_BUMP(arcstat_mfu_hits);
	hdr->b_l1hdr.b_arc_access = ddi_get_lbolt();
	} else if (hdr->b_l1hdr.b_state == arc_mfu_ghost) {
	arc_state_t *new_state = arc_mfu;
	/*
	* This buffer has been accessed more than once but has
	* been evicted from the cache. Move it back to the
	* MFU state.
	*/

	if (HDR_PREFETCH(hdr) \|\| HDR_PRESCIENT_PREFETCH(hdr)) {
	/*
	* This is a prefetch access...
	* move this block back to the MRU state.
	*/
	new_state = arc_mru;
	}

	hdr->b_l1hdr.b_arc_access = ddi_get_lbolt();
	DTRACE_PROBE1(new_state__mfu, arc_buf_hdr_t *, hdr);
	arc_change_state(new_state, hdr, hash_lock);

	atomic_inc_32(&hdr->b_l1hdr.b_mfu_ghost_hits);
	ARCSTAT_BUMP(arcstat_mfu_ghost_hits);
	} else if (hdr->b_l1hdr.b_state == arc_l2c_only) {
	/*
	* This buffer is on the 2nd Level ARC.
	*/

	hdr->b_l1hdr.b_arc_access = ddi_get_lbolt();
	DTRACE_PROBE1(new_state__mfu, arc_buf_hdr_t *, hdr);
	arc_change_state(arc_mfu, hdr, hash_lock);
	} else {
	cmn_err(CE_PANIC, "invalid arc state 0x%p",
	hdr->b_l1hdr.b_state);
	}
	}

	/*
	* This routine is called by dbuf_hold() to update the arc_access() state
	* which otherwise would be skipped for entries in the dbuf cache.
	*/
	void
	arc_buf_access(arc_buf_t *buf)
	{
	mutex_enter(&buf->b_evict_lock);
	arc_buf_hdr_t *hdr = buf->b_hdr;

	/*
	* Avoid taking the hash_lock when possible as an optimization.
	* The header must be checked again under the hash_lock in order
	* to handle the case where it is concurrently being released.
	*/
	if (hdr->b_l1hdr.b_state == arc_anon \|\| HDR_EMPTY(hdr)) {
	mutex_exit(&buf->b_evict_lock);
	return;
	}

	kmutex_t *hash_lock = HDR_LOCK(hdr);
	mutex_enter(hash_lock);

	if (hdr->b_l1hdr.b_state == arc_anon \|\| HDR_EMPTY(hdr)) {
	mutex_exit(hash_lock);
	mutex_exit(&buf->b_evict_lock);
	ARCSTAT_BUMP(arcstat_access_skip);
	return;
	}

	mutex_exit(&buf->b_evict_lock);

	ASSERT(hdr->b_l1hdr.b_state == arc_mru \|\|
	hdr->b_l1hdr.b_state == arc_mfu);

	DTRACE_PROBE1(arc__hit, arc_buf_hdr_t *, hdr);
	arc_access(hdr, hash_lock);
	mutex_exit(hash_lock);

	ARCSTAT_BUMP(arcstat_hits);
	ARCSTAT_CONDSTAT(!HDR_PREFETCH(hdr) && !HDR_PRESCIENT_PREFETCH(hdr),
	demand, prefetch, !HDR_ISTYPE_METADATA(hdr), data, metadata, hits);
	}

	/* a generic arc_read_done_func_t which you can use */
	/* ARGSUSED */
	void
	arc_bcopy_func(zio_t zio, const zbookmark_phys_t zb, const blkptr_t *bp,
	arc_buf_t buf, void arg)
	{
	if (buf == NULL)
	return;

	bcopy(buf->b_data, arg, arc_buf_size(buf));
	arc_buf_destroy(buf, arg);
	}

	/* a generic arc_read_done_func_t */
	/* ARGSUSED */
	void
	arc_getbuf_func(zio_t zio, const zbookmark_phys_t zb, const blkptr_t *bp,
	arc_buf_t buf, void arg)
	{
	arc_buf_t **bufp = arg;

	if (buf == NULL) {
	ASSERT(zio == NULL \|\| zio->io_error != 0);
	*bufp = NULL;
	} else {
	ASSERT(zio == NULL \|\| zio->io_error == 0);
	*bufp = buf;
	ASSERT(buf->b_data != NULL);
	}
	}

	static void
	arc_hdr_verify(arc_buf_hdr_t hdr, blkptr_t bp)
	{
	if (BP_IS_HOLE(bp) \|\| BP_IS_EMBEDDED(bp)) {
	ASSERT3U(HDR_GET_PSIZE(hdr), ==, 0);
	ASSERT3U(arc_hdr_get_compress(hdr), ==, ZIO_COMPRESS_OFF);
	} else {
	if (HDR_COMPRESSION_ENABLED(hdr)) {
	ASSERT3U(arc_hdr_get_compress(hdr), ==,
	BP_GET_COMPRESS(bp));
	}
	ASSERT3U(HDR_GET_LSIZE(hdr), ==, BP_GET_LSIZE(bp));
	ASSERT3U(HDR_GET_PSIZE(hdr), ==, BP_GET_PSIZE(bp));
	ASSERT3U(!!HDR_PROTECTED(hdr), ==, BP_IS_PROTECTED(bp));
	}
	}

	static void
	arc_read_done(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;
	arc_buf_hdr_t *hdr = zio->io_private;
	kmutex_t *hash_lock = NULL;
	arc_callback_t *callback_list;
	arc_callback_t *acb;
	boolean_t freeable = B_FALSE;

	/*
	* The hdr was inserted into hash-table and removed from lists
	* prior to starting I/O. We should find this header, since
	* it's in the hash table, and it should be legit since it's
	* not possible to evict it during the I/O. The only possible
	* reason for it not to be found is if we were freed during the
	* read.
	*/
	if (HDR_IN_HASH_TABLE(hdr)) {
	arc_buf_hdr_t *found;

	ASSERT3U(hdr->b_birth, ==, BP_PHYSICAL_BIRTH(zio->io_bp));
	ASSERT3U(hdr->b_dva.dva_word[0], ==,
	BP_IDENTITY(zio->io_bp)->dva_word[0]);
	ASSERT3U(hdr->b_dva.dva_word[1], ==,
	BP_IDENTITY(zio->io_bp)->dva_word[1]);

	found = buf_hash_find(hdr->b_spa, zio->io_bp, &hash_lock);

	ASSERT((found == hdr &&
	DVA_EQUAL(&hdr->b_dva, BP_IDENTITY(zio->io_bp))) \|\|
	(found == hdr && HDR_L2_READING(hdr)));
	ASSERT3P(hash_lock, !=, NULL);
	}

	if (BP_IS_PROTECTED(bp)) {
	hdr->b_crypt_hdr.b_ot = BP_GET_TYPE(bp);
	hdr->b_crypt_hdr.b_dsobj = zio->io_bookmark.zb_objset;
	zio_crypt_decode_params_bp(bp, hdr->b_crypt_hdr.b_salt,
	hdr->b_crypt_hdr.b_iv);

	if (BP_GET_TYPE(bp) == DMU_OT_INTENT_LOG) {
	void *tmpbuf;

	tmpbuf = abd_borrow_buf_copy(zio->io_abd,
	sizeof (zil_chain_t));
	zio_crypt_decode_mac_zil(tmpbuf,
	hdr->b_crypt_hdr.b_mac);
	abd_return_buf(zio->io_abd, tmpbuf,
	sizeof (zil_chain_t));
	} else {
	zio_crypt_decode_mac_bp(bp, hdr->b_crypt_hdr.b_mac);
	}
	}

	if (zio->io_error == 0) {
	/* byteswap if necessary */
	if (BP_SHOULD_BYTESWAP(zio->io_bp)) {
	if (BP_GET_LEVEL(zio->io_bp) > 0) {
	hdr->b_l1hdr.b_byteswap = DMU_BSWAP_UINT64;
	} else {
	hdr->b_l1hdr.b_byteswap =
	DMU_OT_BYTESWAP(BP_GET_TYPE(zio->io_bp));
	}
	} else {
	hdr->b_l1hdr.b_byteswap = DMU_BSWAP_NUMFUNCS;
	}
	if (!HDR_L2_READING(hdr)) {
	hdr->b_complevel = zio->io_prop.zp_complevel;
	}
	}

	arc_hdr_clear_flags(hdr, ARC_FLAG_L2_EVICTED);
	if (l2arc_noprefetch && HDR_PREFETCH(hdr))
	arc_hdr_clear_flags(hdr, ARC_FLAG_L2CACHE);

	callback_list = hdr->b_l1hdr.b_acb;
	ASSERT3P(callback_list, !=, NULL);

	if (hash_lock && zio->io_error == 0 &&
	hdr->b_l1hdr.b_state == arc_anon) {
	/*
	* Only call arc_access on anonymous buffers. This is because
	* if we've issued an I/O for an evicted buffer, we've already
	* called arc_access (to prevent any simultaneous readers from
	* getting confused).
	*/
	arc_access(hdr, hash_lock);
	}

	/*
	* If a read request has a callback (i.e. acb_done is not NULL), then we
	* make a buf containing the data according to the parameters which were
	* passed in. The implementation of arc_buf_alloc_impl() ensures that we
	* aren't needlessly decompressing the data multiple times.
	*/
	int callback_cnt = 0;
	for (acb = callback_list; acb != NULL; acb = acb->acb_next) {
	if (!acb->acb_done)
	continue;

	callback_cnt++;

	if (zio->io_error != 0)
	continue;

	int error = arc_buf_alloc_impl(hdr, zio->io_spa,
	&acb->acb_zb, acb->acb_private, acb->acb_encrypted,
	acb->acb_compressed, acb->acb_noauth, B_TRUE,
	&acb->acb_buf);

	/*
	* Assert non-speculative zios didn't fail because an
	* encryption key wasn't loaded
	*/
	ASSERT((zio->io_flags & ZIO_FLAG_SPECULATIVE) \|\|
	error != EACCES);

	/*
	* If we failed to decrypt, report an error now (as the zio
	* layer would have done if it had done the transforms).
	*/
	if (error == ECKSUM) {
	ASSERT(BP_IS_PROTECTED(bp));
	error = SET_ERROR(EIO);
	if ((zio->io_flags & ZIO_FLAG_SPECULATIVE) == 0) {
	spa_log_error(zio->io_spa, &acb->acb_zb);
	(void) zfs_ereport_post(
	FM_EREPORT_ZFS_AUTHENTICATION,
	- zio->io_spa, NULL, &acb->acb_zb, zio, 0, 0);
	+ zio->io_spa, NULL, &acb->acb_zb, zio, 0);
	}
	}

	if (error != 0) {
	/*
	* Decompression or decryption failed. Set
	* io_error so that when we call acb_done
	* (below), we will indicate that the read
	* failed. Note that in the unusual case
	* where one callback is compressed and another
	* uncompressed, we will mark all of them
	* as failed, even though the uncompressed
	* one can't actually fail. In this case,
	* the hdr will not be anonymous, because
	* if there are multiple callbacks, it's
	* because multiple threads found the same
	* arc buf in the hash table.
	*/
	zio->io_error = error;
	}
	}

	/*
	* If there are multiple callbacks, we must have the hash lock,
	* because the only way for multiple threads to find this hdr is
	* in the hash table. This ensures that if there are multiple
	* callbacks, the hdr is not anonymous. If it were anonymous,
	* we couldn't use arc_buf_destroy() in the error case below.
	*/
	ASSERT(callback_cnt < 2 \|\| hash_lock != NULL);

	hdr->b_l1hdr.b_acb = NULL;
	arc_hdr_clear_flags(hdr, ARC_FLAG_IO_IN_PROGRESS);
	if (callback_cnt == 0)
	ASSERT(hdr->b_l1hdr.b_pabd != NULL \|\| HDR_HAS_RABD(hdr));

	ASSERT(zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt) \|\|
	callback_list != NULL);

	if (zio->io_error == 0) {
	arc_hdr_verify(hdr, zio->io_bp);
	} else {
	arc_hdr_set_flags(hdr, ARC_FLAG_IO_ERROR);
	if (hdr->b_l1hdr.b_state != arc_anon)
	arc_change_state(arc_anon, hdr, hash_lock);
	if (HDR_IN_HASH_TABLE(hdr))
	buf_hash_remove(hdr);
	freeable = zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt);
	}

	/*
	* Broadcast before we drop the hash_lock to avoid the possibility
	* that the hdr (and hence the cv) might be freed before we get to
	* the cv_broadcast().
	*/
	cv_broadcast(&hdr->b_l1hdr.b_cv);

	if (hash_lock != NULL) {
	mutex_exit(hash_lock);
	} else {
	/*
	* This block was freed while we waited for the read to
	* complete. It has been removed from the hash table and
	* moved to the anonymous state (so that it won't show up
	* in the cache).
	*/
	ASSERT3P(hdr->b_l1hdr.b_state, ==, arc_anon);
	freeable = zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt);
	}

	/* execute each callback and free its structure */
	while ((acb = callback_list) != NULL) {
	if (acb->acb_done != NULL) {
	if (zio->io_error != 0 && acb->acb_buf != NULL) {
	/*
	* If arc_buf_alloc_impl() fails during
	* decompression, the buf will still be
	* allocated, and needs to be freed here.
	*/
	arc_buf_destroy(acb->acb_buf,
	acb->acb_private);
	acb->acb_buf = NULL;
	}
	acb->acb_done(zio, &zio->io_bookmark, zio->io_bp,
	acb->acb_buf, acb->acb_private);
	}

	if (acb->acb_zio_dummy != NULL) {
	acb->acb_zio_dummy->io_error = zio->io_error;
	zio_nowait(acb->acb_zio_dummy);
	}

	callback_list = acb->acb_next;
	kmem_free(acb, sizeof (arc_callback_t));
	}

	if (freeable)
	arc_hdr_destroy(hdr);
	}

	/*
	* "Read" the block at the specified DVA (in bp) via the
	* cache. If the block is found in the cache, invoke the provided
	* callback immediately and return. Note that the `zio' parameter
	* in the callback will be NULL in this case, since no IO was
	* required. If the block is not in the cache pass the read request
	* on to the spa with a substitute callback function, so that the
	* requested block will be added to the cache.
	*
	* If a read request arrives for a block that has a read in-progress,
	* either wait for the in-progress read to complete (and return the
	* results); or, if this is a read with a "done" func, add a record
	* to the read to invoke the "done" func when the read completes,
	* and return; or just return.
	*
	* arc_read_done() will invoke all the requested "done" functions
	* for readers of this block.
	*/
	int
	arc_read(zio_t pio, spa_t spa, const blkptr_t *bp,
	arc_read_done_func_t done, void private, zio_priority_t priority,
	int zio_flags, arc_flags_t arc_flags, const zbookmark_phys_t zb)
	{
	arc_buf_hdr_t *hdr = NULL;
	kmutex_t *hash_lock = NULL;
	zio_t *rzio;
	uint64_t guid = spa_load_guid(spa);
	boolean_t compressed_read = (zio_flags & ZIO_FLAG_RAW_COMPRESS) != 0;
	boolean_t encrypted_read = BP_IS_ENCRYPTED(bp) &&
	(zio_flags & ZIO_FLAG_RAW_ENCRYPT) != 0;
	boolean_t noauth_read = BP_IS_AUTHENTICATED(bp) &&
	(zio_flags & ZIO_FLAG_RAW_ENCRYPT) != 0;
	boolean_t embedded_bp = !!BP_IS_EMBEDDED(bp);
	int rc = 0;

	ASSERT(!embedded_bp \|\|
	BPE_GET_ETYPE(bp) == BP_EMBEDDED_TYPE_DATA);
	ASSERT(!BP_IS_HOLE(bp));
	ASSERT(!BP_IS_REDACTED(bp));

	/*
	* Normally SPL_FSTRANS will already be set since kernel threads which
	* expect to call the DMU interfaces will set it when created. System
	* calls are similarly handled by setting/cleaning the bit in the
	* registered callback (module/os/.../zfs/zpl_*).
	*
	* External consumers such as Lustre which call the exported DMU
	* interfaces may not have set SPL_FSTRANS. To avoid a deadlock
	* on the hash_lock always set and clear the bit.
	*/
	fstrans_cookie_t cookie = spl_fstrans_mark();
	top:
	if (!embedded_bp) {
	/*
	* Embedded BP's have no DVA and require no I/O to "read".
	* Create an anonymous arc buf to back it.
	*/
	hdr = buf_hash_find(guid, bp, &hash_lock);
	}

	/*
	* Determine if we have an L1 cache hit or a cache miss. For simplicity
	* we maintain encrypted data separately from compressed / uncompressed
	* data. If the user is requesting raw encrypted data and we don't have
	* that in the header we will read from disk to guarantee that we can
	* get it even if the encryption keys aren't loaded.
	*/
	if (hdr != NULL && HDR_HAS_L1HDR(hdr) && (HDR_HAS_RABD(hdr) \|\|
	(hdr->b_l1hdr.b_pabd != NULL && !encrypted_read))) {
	arc_buf_t *buf = NULL;
	*arc_flags \|= ARC_FLAG_CACHED;

	if (HDR_IO_IN_PROGRESS(hdr)) {
	zio_t *head_zio = hdr->b_l1hdr.b_acb->acb_zio_head;

	if (*arc_flags & ARC_FLAG_CACHED_ONLY) {
	mutex_exit(hash_lock);
	ARCSTAT_BUMP(arcstat_cached_only_in_progress);
	rc = SET_ERROR(ENOENT);
	goto out;
	}

	ASSERT3P(head_zio, !=, NULL);
	if ((hdr->b_flags & ARC_FLAG_PRIO_ASYNC_READ) &&
	priority == ZIO_PRIORITY_SYNC_READ) {
	/*
	* This is a sync read that needs to wait for
	* an in-flight async read. Request that the
	* zio have its priority upgraded.
	*/
	zio_change_priority(head_zio, priority);
	DTRACE_PROBE1(arc__async__upgrade__sync,
	arc_buf_hdr_t *, hdr);
	ARCSTAT_BUMP(arcstat_async_upgrade_sync);
	}
	if (hdr->b_flags & ARC_FLAG_PREDICTIVE_PREFETCH) {
	arc_hdr_clear_flags(hdr,
	ARC_FLAG_PREDICTIVE_PREFETCH);
	}

	if (*arc_flags & ARC_FLAG_WAIT) {
	cv_wait(&hdr->b_l1hdr.b_cv, hash_lock);
	mutex_exit(hash_lock);
	goto top;
	}
	ASSERT(*arc_flags & ARC_FLAG_NOWAIT);

	if (done) {
	arc_callback_t *acb = NULL;

	acb = kmem_zalloc(sizeof (arc_callback_t),
	KM_SLEEP);
	acb->acb_done = done;
	acb->acb_private = private;
	acb->acb_compressed = compressed_read;
	acb->acb_encrypted = encrypted_read;
	acb->acb_noauth = noauth_read;
	acb->acb_zb = *zb;
	if (pio != NULL)
	acb->acb_zio_dummy = zio_null(pio,
	spa, NULL, NULL, NULL, zio_flags);

	ASSERT3P(acb->acb_done, !=, NULL);
	acb->acb_zio_head = head_zio;
	acb->acb_next = hdr->b_l1hdr.b_acb;
	hdr->b_l1hdr.b_acb = acb;
	mutex_exit(hash_lock);
	goto out;
	}
	mutex_exit(hash_lock);
	goto out;
	}

	ASSERT(hdr->b_l1hdr.b_state == arc_mru \|\|
	hdr->b_l1hdr.b_state == arc_mfu);

	if (done) {
	if (hdr->b_flags & ARC_FLAG_PREDICTIVE_PREFETCH) {
	/*
	* This is a demand read which does not have to
	* wait for i/o because we did a predictive
	* prefetch i/o for it, which has completed.
	*/
	DTRACE_PROBE1(
	arc__demand__hit__predictive__prefetch,
	arc_buf_hdr_t *, hdr);
	ARCSTAT_BUMP(
	arcstat_demand_hit_predictive_prefetch);
	arc_hdr_clear_flags(hdr,
	ARC_FLAG_PREDICTIVE_PREFETCH);
	}

	if (hdr->b_flags & ARC_FLAG_PRESCIENT_PREFETCH) {
	ARCSTAT_BUMP(
	arcstat_demand_hit_prescient_prefetch);
	arc_hdr_clear_flags(hdr,
	ARC_FLAG_PRESCIENT_PREFETCH);
	}

	ASSERT(!embedded_bp \|\| !BP_IS_HOLE(bp));

	/* Get a buf with the desired data in it. */
	rc = arc_buf_alloc_impl(hdr, spa, zb, private,
	encrypted_read, compressed_read, noauth_read,
	B_TRUE, &buf);
	if (rc == ECKSUM) {
	/*
	* Convert authentication and decryption errors
	* to EIO (and generate an ereport if needed)
	* before leaving the ARC.
	*/
	rc = SET_ERROR(EIO);
	if ((zio_flags & ZIO_FLAG_SPECULATIVE) == 0) {
	spa_log_error(spa, zb);
	(void) zfs_ereport_post(
	FM_EREPORT_ZFS_AUTHENTICATION,
	- spa, NULL, zb, NULL, 0, 0);
	+ spa, NULL, zb, NULL, 0);
	}
	}
	if (rc != 0) {
	(void) remove_reference(hdr, hash_lock,
	private);
	arc_buf_destroy_impl(buf);
	buf = NULL;
	}

	/* assert any errors weren't due to unloaded keys */
	ASSERT((zio_flags & ZIO_FLAG_SPECULATIVE) \|\|
	rc != EACCES);
	} else if (*arc_flags & ARC_FLAG_PREFETCH &&
	zfs_refcount_count(&hdr->b_l1hdr.b_refcnt) == 0) {
	arc_hdr_set_flags(hdr, ARC_FLAG_PREFETCH);
	}
	DTRACE_PROBE1(arc__hit, arc_buf_hdr_t *, hdr);
	arc_access(hdr, hash_lock);
	if (*arc_flags & ARC_FLAG_PRESCIENT_PREFETCH)
	arc_hdr_set_flags(hdr, ARC_FLAG_PRESCIENT_PREFETCH);
	if (*arc_flags & ARC_FLAG_L2CACHE)
	arc_hdr_set_flags(hdr, ARC_FLAG_L2CACHE);
	mutex_exit(hash_lock);
	ARCSTAT_BUMP(arcstat_hits);
	ARCSTAT_CONDSTAT(!HDR_PREFETCH(hdr),
	demand, prefetch, !HDR_ISTYPE_METADATA(hdr),
	data, metadata, hits);

	if (done)
	done(NULL, zb, bp, buf, private);
	} else {
	uint64_t lsize = BP_GET_LSIZE(bp);
	uint64_t psize = BP_GET_PSIZE(bp);
	arc_callback_t *acb;
	vdev_t *vd = NULL;
	uint64_t addr = 0;
	boolean_t devw = B_FALSE;
	uint64_t size;
	abd_t *hdr_abd;
	int alloc_flags = encrypted_read ? ARC_HDR_ALLOC_RDATA : 0;

	if (*arc_flags & ARC_FLAG_CACHED_ONLY) {
	rc = SET_ERROR(ENOENT);
	if (hash_lock != NULL)
	mutex_exit(hash_lock);
	goto out;
	}

	/*
	* Gracefully handle a damaged logical block size as a
	* checksum error.
	*/
	if (lsize > spa_maxblocksize(spa)) {
	rc = SET_ERROR(ECKSUM);
	if (hash_lock != NULL)
	mutex_exit(hash_lock);
	goto out;
	}

	if (hdr == NULL) {
	/*
	* This block is not in the cache or it has
	* embedded data.
	*/
	arc_buf_hdr_t *exists = NULL;
	arc_buf_contents_t type = BP_GET_BUFC_TYPE(bp);
	hdr = arc_hdr_alloc(spa_load_guid(spa), psize, lsize,
	BP_IS_PROTECTED(bp), BP_GET_COMPRESS(bp), 0, type,
	encrypted_read);

	if (!embedded_bp) {
	hdr->b_dva = *BP_IDENTITY(bp);
	hdr->b_birth = BP_PHYSICAL_BIRTH(bp);
	exists = buf_hash_insert(hdr, &hash_lock);
	}
	if (exists != NULL) {
	/* somebody beat us to the hash insert */
	mutex_exit(hash_lock);
	buf_discard_identity(hdr);
	arc_hdr_destroy(hdr);
	goto top; /* restart the IO request */
	}
	} else {
	/*
	* This block is in the ghost cache or encrypted data
	* was requested and we didn't have it. If it was
	* L2-only (and thus didn't have an L1 hdr),
	* we realloc the header to add an L1 hdr.
	*/
	if (!HDR_HAS_L1HDR(hdr)) {
	hdr = arc_hdr_realloc(hdr, hdr_l2only_cache,
	hdr_full_cache);
	}

	if (GHOST_STATE(hdr->b_l1hdr.b_state)) {
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!HDR_HAS_RABD(hdr));
	ASSERT(!HDR_IO_IN_PROGRESS(hdr));
	ASSERT0(zfs_refcount_count(
	&hdr->b_l1hdr.b_refcnt));
	ASSERT3P(hdr->b_l1hdr.b_buf, ==, NULL);
	ASSERT3P(hdr->b_l1hdr.b_freeze_cksum, ==, NULL);
	} else if (HDR_IO_IN_PROGRESS(hdr)) {
	/*
	* If this header already had an IO in progress
	* and we are performing another IO to fetch
	* encrypted data we must wait until the first
	* IO completes so as not to confuse
	* arc_read_done(). This should be very rare
	* and so the performance impact shouldn't
	* matter.
	*/
	cv_wait(&hdr->b_l1hdr.b_cv, hash_lock);
	mutex_exit(hash_lock);
	goto top;
	}

	/*
	* This is a delicate dance that we play here.
	* This hdr might be in the ghost list so we access
	* it to move it out of the ghost list before we
	* initiate the read. If it's a prefetch then
	* it won't have a callback so we'll remove the
	* reference that arc_buf_alloc_impl() created. We
	* do this after we've called arc_access() to
	* avoid hitting an assert in remove_reference().
	*/
	arc_adapt(arc_hdr_size(hdr), hdr->b_l1hdr.b_state);
	arc_access(hdr, hash_lock);
	arc_hdr_alloc_abd(hdr, alloc_flags);
	}

	if (encrypted_read) {
	ASSERT(HDR_HAS_RABD(hdr));
	size = HDR_GET_PSIZE(hdr);
	hdr_abd = hdr->b_crypt_hdr.b_rabd;
	zio_flags \|= ZIO_FLAG_RAW;
	} else {
	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);
	size = arc_hdr_size(hdr);
	hdr_abd = hdr->b_l1hdr.b_pabd;

	if (arc_hdr_get_compress(hdr) != ZIO_COMPRESS_OFF) {
	zio_flags \|= ZIO_FLAG_RAW_COMPRESS;
	}

	/*
	* For authenticated bp's, we do not ask the ZIO layer
	* to authenticate them since this will cause the entire
	* IO to fail if the key isn't loaded. Instead, we
	* defer authentication until arc_buf_fill(), which will
	* verify the data when the key is available.
	*/
	if (BP_IS_AUTHENTICATED(bp))
	zio_flags \|= ZIO_FLAG_RAW_ENCRYPT;
	}

	if (*arc_flags & ARC_FLAG_PREFETCH &&
	zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt))
	arc_hdr_set_flags(hdr, ARC_FLAG_PREFETCH);
	if (*arc_flags & ARC_FLAG_PRESCIENT_PREFETCH)
	arc_hdr_set_flags(hdr, ARC_FLAG_PRESCIENT_PREFETCH);
	if (*arc_flags & ARC_FLAG_L2CACHE)
	arc_hdr_set_flags(hdr, ARC_FLAG_L2CACHE);
	if (BP_IS_AUTHENTICATED(bp))
	arc_hdr_set_flags(hdr, ARC_FLAG_NOAUTH);
	if (BP_GET_LEVEL(bp) > 0)
	arc_hdr_set_flags(hdr, ARC_FLAG_INDIRECT);
	if (*arc_flags & ARC_FLAG_PREDICTIVE_PREFETCH)
	arc_hdr_set_flags(hdr, ARC_FLAG_PREDICTIVE_PREFETCH);
	ASSERT(!GHOST_STATE(hdr->b_l1hdr.b_state));

	acb = kmem_zalloc(sizeof (arc_callback_t), KM_SLEEP);
	acb->acb_done = done;
	acb->acb_private = private;
	acb->acb_compressed = compressed_read;
	acb->acb_encrypted = encrypted_read;
	acb->acb_noauth = noauth_read;
	acb->acb_zb = *zb;

	ASSERT3P(hdr->b_l1hdr.b_acb, ==, NULL);
	hdr->b_l1hdr.b_acb = acb;
	arc_hdr_set_flags(hdr, ARC_FLAG_IO_IN_PROGRESS);

	if (HDR_HAS_L2HDR(hdr) &&
	(vd = hdr->b_l2hdr.b_dev->l2ad_vdev) != NULL) {
	devw = hdr->b_l2hdr.b_dev->l2ad_writing;
	addr = hdr->b_l2hdr.b_daddr;
	/*
	* Lock out L2ARC device removal.
	*/
	if (vdev_is_dead(vd) \|\|
	!spa_config_tryenter(spa, SCL_L2ARC, vd, RW_READER))
	vd = NULL;
	}

	/*
	* We count both async reads and scrub IOs as asynchronous so
	* that both can be upgraded in the event of a cache hit while
	* the read IO is still in-flight.
	*/
	if (priority == ZIO_PRIORITY_ASYNC_READ \|\|
	priority == ZIO_PRIORITY_SCRUB)
	arc_hdr_set_flags(hdr, ARC_FLAG_PRIO_ASYNC_READ);
	else
	arc_hdr_clear_flags(hdr, ARC_FLAG_PRIO_ASYNC_READ);

	/*
	* At this point, we have a level 1 cache miss or a blkptr
	* with embedded data. Try again in L2ARC if possible.
	*/
	ASSERT3U(HDR_GET_LSIZE(hdr), ==, lsize);

	/*
	* Skip ARC stat bump for block pointers with embedded
	* data. The data are read from the blkptr itself via
	* decode_embedded_bp_compressed().
	*/
	if (!embedded_bp) {
	DTRACE_PROBE4(arc__miss, arc_buf_hdr_t *, hdr,
	blkptr_t *, bp, uint64_t, lsize,
	zbookmark_phys_t *, zb);
	ARCSTAT_BUMP(arcstat_misses);
	ARCSTAT_CONDSTAT(!HDR_PREFETCH(hdr),
	demand, prefetch, !HDR_ISTYPE_METADATA(hdr), data,
	metadata, misses);
	}

	if (vd != NULL && l2arc_ndev != 0 && !(l2arc_norw && devw)) {
	/*
	* Read from the L2ARC if the following are true:
	* 1. The L2ARC vdev was previously cached.
	* 2. This buffer still has L2ARC metadata.
	* 3. This buffer isn't currently writing to the L2ARC.
	* 4. The L2ARC entry wasn't evicted, which may
	* also have invalidated the vdev.
	* 5. This isn't prefetch and l2arc_noprefetch is set.
	*/
	if (HDR_HAS_L2HDR(hdr) &&
	!HDR_L2_WRITING(hdr) && !HDR_L2_EVICTED(hdr) &&
	!(l2arc_noprefetch && HDR_PREFETCH(hdr))) {
	l2arc_read_callback_t *cb;
	abd_t *abd;
	uint64_t asize;

	DTRACE_PROBE1(l2arc__hit, arc_buf_hdr_t *, hdr);
	ARCSTAT_BUMP(arcstat_l2_hits);
	atomic_inc_32(&hdr->b_l2hdr.b_hits);

	cb = kmem_zalloc(sizeof (l2arc_read_callback_t),
	KM_SLEEP);
	cb->l2rcb_hdr = hdr;
	cb->l2rcb_bp = *bp;
	cb->l2rcb_zb = *zb;
	cb->l2rcb_flags = zio_flags;

	/*
	* When Compressed ARC is disabled, but the
	* L2ARC block is compressed, arc_hdr_size()
	* will have returned LSIZE rather than PSIZE.
	*/
	if (HDR_GET_COMPRESS(hdr) != ZIO_COMPRESS_OFF &&
	!HDR_COMPRESSION_ENABLED(hdr) &&
	HDR_GET_PSIZE(hdr) != 0) {
	size = HDR_GET_PSIZE(hdr);
	}

	asize = vdev_psize_to_asize(vd, size);
	if (asize != size) {
	abd = abd_alloc_for_io(asize,
	HDR_ISTYPE_METADATA(hdr));
	cb->l2rcb_abd = abd;
	} else {
	abd = hdr_abd;
	}

	ASSERT(addr >= VDEV_LABEL_START_SIZE &&
	addr + asize <= vd->vdev_psize -
	VDEV_LABEL_END_SIZE);

	/*
	* l2arc read. The SCL_L2ARC lock will be
	* released by l2arc_read_done().
	* Issue a null zio if the underlying buffer
	* was squashed to zero size by compression.
	*/
	ASSERT3U(arc_hdr_get_compress(hdr), !=,
	ZIO_COMPRESS_EMPTY);
	rzio = zio_read_phys(pio, vd, addr,
	asize, abd,
	ZIO_CHECKSUM_OFF,
	l2arc_read_done, cb, priority,
	zio_flags \| ZIO_FLAG_DONT_CACHE \|
	ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_DONT_PROPAGATE \|
	ZIO_FLAG_DONT_RETRY, B_FALSE);
	acb->acb_zio_head = rzio;

	if (hash_lock != NULL)
	mutex_exit(hash_lock);

	DTRACE_PROBE2(l2arc__read, vdev_t *, vd,
	zio_t *, rzio);
	ARCSTAT_INCR(arcstat_l2_read_bytes,
	HDR_GET_PSIZE(hdr));

	if (*arc_flags & ARC_FLAG_NOWAIT) {
	zio_nowait(rzio);
	goto out;
	}

	ASSERT(*arc_flags & ARC_FLAG_WAIT);
	if (zio_wait(rzio) == 0)
	goto out;

	/* l2arc read error; goto zio_read() */
	if (hash_lock != NULL)
	mutex_enter(hash_lock);
	} else {
	DTRACE_PROBE1(l2arc__miss,
	arc_buf_hdr_t *, hdr);
	ARCSTAT_BUMP(arcstat_l2_misses);
	if (HDR_L2_WRITING(hdr))
	ARCSTAT_BUMP(arcstat_l2_rw_clash);
	spa_config_exit(spa, SCL_L2ARC, vd);
	}
	} else {
	if (vd != NULL)
	spa_config_exit(spa, SCL_L2ARC, vd);
	/*
	* Skip ARC stat bump for block pointers with
	* embedded data. The data are read from the blkptr
	* itself via decode_embedded_bp_compressed().
	*/
	if (l2arc_ndev != 0 && !embedded_bp) {
	DTRACE_PROBE1(l2arc__miss,
	arc_buf_hdr_t *, hdr);
	ARCSTAT_BUMP(arcstat_l2_misses);
	}
	}

	rzio = zio_read(pio, spa, bp, hdr_abd, size,
	arc_read_done, hdr, priority, zio_flags, zb);
	acb->acb_zio_head = rzio;

	if (hash_lock != NULL)
	mutex_exit(hash_lock);

	if (*arc_flags & ARC_FLAG_WAIT) {
	rc = zio_wait(rzio);
	goto out;
	}

	ASSERT(*arc_flags & ARC_FLAG_NOWAIT);
	zio_nowait(rzio);
	}

	out:
	/* embedded bps don't actually go to disk */
	if (!embedded_bp)
	spa_read_history_add(spa, zb, *arc_flags);
	spl_fstrans_unmark(cookie);
	return (rc);
	}

	arc_prune_t *
	arc_add_prune_callback(arc_prune_func_t func, void private)
	{
	arc_prune_t *p;

	p = kmem_alloc(sizeof (*p), KM_SLEEP);
	p->p_pfunc = func;
	p->p_private = private;
	list_link_init(&p->p_node);
	zfs_refcount_create(&p->p_refcnt);

	mutex_enter(&arc_prune_mtx);
	zfs_refcount_add(&p->p_refcnt, &arc_prune_list);
	list_insert_head(&arc_prune_list, p);
	mutex_exit(&arc_prune_mtx);

	return (p);
	}

	void
	arc_remove_prune_callback(arc_prune_t *p)
	{
	boolean_t wait = B_FALSE;
	mutex_enter(&arc_prune_mtx);
	list_remove(&arc_prune_list, p);
	if (zfs_refcount_remove(&p->p_refcnt, &arc_prune_list) > 0)
	wait = B_TRUE;
	mutex_exit(&arc_prune_mtx);

	/* wait for arc_prune_task to finish */
	if (wait)
	taskq_wait_outstanding(arc_prune_taskq, 0);
	ASSERT0(zfs_refcount_count(&p->p_refcnt));
	zfs_refcount_destroy(&p->p_refcnt);
	kmem_free(p, sizeof (*p));
	}

	/*
	* Notify the arc that a block was freed, and thus will never be used again.
	*/
	void
	arc_freed(spa_t spa, const blkptr_t bp)
	{
	arc_buf_hdr_t *hdr;
	kmutex_t *hash_lock;
	uint64_t guid = spa_load_guid(spa);

	ASSERT(!BP_IS_EMBEDDED(bp));

	hdr = buf_hash_find(guid, bp, &hash_lock);
	if (hdr == NULL)
	return;

	/*
	* We might be trying to free a block that is still doing I/O
	* (i.e. prefetch) or has a reference (i.e. a dedup-ed,
	* dmu_sync-ed block). If this block is being prefetched, then it
	* would still have the ARC_FLAG_IO_IN_PROGRESS flag set on the hdr
	* until the I/O completes. A block may also have a reference if it is
	* part of a dedup-ed, dmu_synced write. The dmu_sync() function would
	* have written the new block to its final resting place on disk but
	* without the dedup flag set. This would have left the hdr in the MRU
	* state and discoverable. When the txg finally syncs it detects that
	* the block was overridden in open context and issues an override I/O.
	* Since this is a dedup block, the override I/O will determine if the
	* block is already in the DDT. If so, then it will replace the io_bp
	* with the bp from the DDT and allow the I/O to finish. When the I/O
	* reaches the done callback, dbuf_write_override_done, it will
	* check to see if the io_bp and io_bp_override are identical.
	* If they are not, then it indicates that the bp was replaced with
	* the bp in the DDT and the override bp is freed. This allows
	* us to arrive here with a reference on a block that is being
	* freed. So if we have an I/O in progress, or a reference to
	* this hdr, then we don't destroy the hdr.
	*/
	if (!HDR_HAS_L1HDR(hdr) \|\| (!HDR_IO_IN_PROGRESS(hdr) &&
	zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt))) {
	arc_change_state(arc_anon, hdr, hash_lock);
	arc_hdr_destroy(hdr);
	mutex_exit(hash_lock);
	} else {
	mutex_exit(hash_lock);
	}

	}

	/*
	* Release this buffer from the cache, making it an anonymous buffer. This
	* must be done after a read and prior to modifying the buffer contents.
	* If the buffer has more than one reference, we must make
	* a new hdr for the buffer.
	*/
	void
	arc_release(arc_buf_t buf, void tag)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;

	/*
	* It would be nice to assert that if its DMU metadata (level >
	* 0 \|\| it's the dnode file), then it must be syncing context.
	* But we don't know that information at this level.
	*/

	mutex_enter(&buf->b_evict_lock);

	ASSERT(HDR_HAS_L1HDR(hdr));

	/*
	* We don't grab the hash lock prior to this check, because if
	* the buffer's header is in the arc_anon state, it won't be
	* linked into the hash table.
	*/
	if (hdr->b_l1hdr.b_state == arc_anon) {
	mutex_exit(&buf->b_evict_lock);
	ASSERT(!HDR_IO_IN_PROGRESS(hdr));
	ASSERT(!HDR_IN_HASH_TABLE(hdr));
	ASSERT(!HDR_HAS_L2HDR(hdr));
	ASSERT(HDR_EMPTY(hdr));

	ASSERT3U(hdr->b_l1hdr.b_bufcnt, ==, 1);
	ASSERT3S(zfs_refcount_count(&hdr->b_l1hdr.b_refcnt), ==, 1);
	ASSERT(!list_link_active(&hdr->b_l1hdr.b_arc_node));

	hdr->b_l1hdr.b_arc_access = 0;

	/*
	* If the buf is being overridden then it may already
	* have a hdr that is not empty.
	*/
	buf_discard_identity(hdr);
	arc_buf_thaw(buf);

	return;
	}

	kmutex_t *hash_lock = HDR_LOCK(hdr);
	mutex_enter(hash_lock);

	/*
	* This assignment is only valid as long as the hash_lock is
	* held, we must be careful not to reference state or the
	* b_state field after dropping the lock.
	*/
	arc_state_t *state = hdr->b_l1hdr.b_state;
	ASSERT3P(hash_lock, ==, HDR_LOCK(hdr));
	ASSERT3P(state, !=, arc_anon);

	/* this buffer is not on any list */
	ASSERT3S(zfs_refcount_count(&hdr->b_l1hdr.b_refcnt), >, 0);

	if (HDR_HAS_L2HDR(hdr)) {
	mutex_enter(&hdr->b_l2hdr.b_dev->l2ad_mtx);

	/*
	* We have to recheck this conditional again now that
	* we're holding the l2ad_mtx to prevent a race with
	* another thread which might be concurrently calling
	* l2arc_evict(). In that case, l2arc_evict() might have
	* destroyed the header's L2 portion as we were waiting
	* to acquire the l2ad_mtx.
	*/
	if (HDR_HAS_L2HDR(hdr))
	arc_hdr_l2hdr_destroy(hdr);

	mutex_exit(&hdr->b_l2hdr.b_dev->l2ad_mtx);
	}

	/*
	* Do we have more than one buf?
	*/
	if (hdr->b_l1hdr.b_bufcnt > 1) {
	arc_buf_hdr_t *nhdr;
	uint64_t spa = hdr->b_spa;
	uint64_t psize = HDR_GET_PSIZE(hdr);
	uint64_t lsize = HDR_GET_LSIZE(hdr);
	boolean_t protected = HDR_PROTECTED(hdr);
	enum zio_compress compress = arc_hdr_get_compress(hdr);
	arc_buf_contents_t type = arc_buf_type(hdr);
	VERIFY3U(hdr->b_type, ==, type);

	ASSERT(hdr->b_l1hdr.b_buf != buf \|\| buf->b_next != NULL);
	(void) remove_reference(hdr, hash_lock, tag);

	if (arc_buf_is_shared(buf) && !ARC_BUF_COMPRESSED(buf)) {
	ASSERT3P(hdr->b_l1hdr.b_buf, !=, buf);
	ASSERT(ARC_BUF_LAST(buf));
	}

	/*
	* Pull the data off of this hdr and attach it to
	* a new anonymous hdr. Also find the last buffer
	* in the hdr's buffer list.
	*/
	arc_buf_t *lastbuf = arc_buf_remove(hdr, buf);
	ASSERT3P(lastbuf, !=, NULL);

	/*
	* If the current arc_buf_t and the hdr are sharing their data
	* buffer, then we must stop sharing that block.
	*/
	if (arc_buf_is_shared(buf)) {
	ASSERT3P(hdr->b_l1hdr.b_buf, !=, buf);
	VERIFY(!arc_buf_is_shared(lastbuf));

	/*
	* First, sever the block sharing relationship between
	* buf and the arc_buf_hdr_t.
	*/
	arc_unshare_buf(hdr, buf);

	/*
	* Now we need to recreate the hdr's b_pabd. Since we
	* have lastbuf handy, we try to share with it, but if
	* we can't then we allocate a new b_pabd and copy the
	* data from buf into it.
	*/
	if (arc_can_share(hdr, lastbuf)) {
	arc_share_buf(hdr, lastbuf);
	} else {
	arc_hdr_alloc_abd(hdr, ARC_HDR_DO_ADAPT);
	abd_copy_from_buf(hdr->b_l1hdr.b_pabd,
	buf->b_data, psize);
	}
	VERIFY3P(lastbuf->b_data, !=, NULL);
	} else if (HDR_SHARED_DATA(hdr)) {
	/*
	* Uncompressed shared buffers are always at the end
	* of the list. Compressed buffers don't have the
	* same requirements. This makes it hard to
	* simply assert that the lastbuf is shared so
	* we rely on the hdr's compression flags to determine
	* if we have a compressed, shared buffer.
	*/
	ASSERT(arc_buf_is_shared(lastbuf) \|\|
	arc_hdr_get_compress(hdr) != ZIO_COMPRESS_OFF);
	ASSERT(!ARC_BUF_SHARED(buf));
	}

	ASSERT(hdr->b_l1hdr.b_pabd != NULL \|\| HDR_HAS_RABD(hdr));
	ASSERT3P(state, !=, arc_l2c_only);

	(void) zfs_refcount_remove_many(&state->arcs_size,
	arc_buf_size(buf), buf);

	if (zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt)) {
	ASSERT3P(state, !=, arc_l2c_only);
	(void) zfs_refcount_remove_many(
	&state->arcs_esize[type],
	arc_buf_size(buf), buf);
	}

	hdr->b_l1hdr.b_bufcnt -= 1;
	if (ARC_BUF_ENCRYPTED(buf))
	hdr->b_crypt_hdr.b_ebufcnt -= 1;

	arc_cksum_verify(buf);
	arc_buf_unwatch(buf);

	/* if this is the last uncompressed buf free the checksum */
	if (!arc_hdr_has_uncompressed_buf(hdr))
	arc_cksum_free(hdr);

	mutex_exit(hash_lock);

	/*
	* Allocate a new hdr. The new hdr will contain a b_pabd
	* buffer which will be freed in arc_write().
	*/
	nhdr = arc_hdr_alloc(spa, psize, lsize, protected,
	compress, hdr->b_complevel, type, HDR_HAS_RABD(hdr));
	ASSERT3P(nhdr->b_l1hdr.b_buf, ==, NULL);
	ASSERT0(nhdr->b_l1hdr.b_bufcnt);
	ASSERT0(zfs_refcount_count(&nhdr->b_l1hdr.b_refcnt));
	VERIFY3U(nhdr->b_type, ==, type);
	ASSERT(!HDR_SHARED_DATA(nhdr));

	nhdr->b_l1hdr.b_buf = buf;
	nhdr->b_l1hdr.b_bufcnt = 1;
	if (ARC_BUF_ENCRYPTED(buf))
	nhdr->b_crypt_hdr.b_ebufcnt = 1;
	nhdr->b_l1hdr.b_mru_hits = 0;
	nhdr->b_l1hdr.b_mru_ghost_hits = 0;
	nhdr->b_l1hdr.b_mfu_hits = 0;
	nhdr->b_l1hdr.b_mfu_ghost_hits = 0;
	nhdr->b_l1hdr.b_l2_hits = 0;
	(void) zfs_refcount_add(&nhdr->b_l1hdr.b_refcnt, tag);
	buf->b_hdr = nhdr;

	mutex_exit(&buf->b_evict_lock);
	(void) zfs_refcount_add_many(&arc_anon->arcs_size,
	arc_buf_size(buf), buf);
	} else {
	mutex_exit(&buf->b_evict_lock);
	ASSERT(zfs_refcount_count(&hdr->b_l1hdr.b_refcnt) == 1);
	/* protected by hash lock, or hdr is on arc_anon */
	ASSERT(!multilist_link_active(&hdr->b_l1hdr.b_arc_node));
	ASSERT(!HDR_IO_IN_PROGRESS(hdr));
	hdr->b_l1hdr.b_mru_hits = 0;
	hdr->b_l1hdr.b_mru_ghost_hits = 0;
	hdr->b_l1hdr.b_mfu_hits = 0;
	hdr->b_l1hdr.b_mfu_ghost_hits = 0;
	hdr->b_l1hdr.b_l2_hits = 0;
	arc_change_state(arc_anon, hdr, hash_lock);
	hdr->b_l1hdr.b_arc_access = 0;

	mutex_exit(hash_lock);
	buf_discard_identity(hdr);
	arc_buf_thaw(buf);
	}
	}

	int
	arc_released(arc_buf_t *buf)
	{
	int released;

	mutex_enter(&buf->b_evict_lock);
	released = (buf->b_data != NULL &&
	buf->b_hdr->b_l1hdr.b_state == arc_anon);
	mutex_exit(&buf->b_evict_lock);
	return (released);
	}

	#ifdef ZFS_DEBUG
	int
	arc_referenced(arc_buf_t *buf)
	{
	int referenced;

	mutex_enter(&buf->b_evict_lock);
	referenced = (zfs_refcount_count(&buf->b_hdr->b_l1hdr.b_refcnt));
	mutex_exit(&buf->b_evict_lock);
	return (referenced);
	}
	#endif

	static void
	arc_write_ready(zio_t *zio)
	{
	arc_write_callback_t *callback = zio->io_private;
	arc_buf_t *buf = callback->awcb_buf;
	arc_buf_hdr_t *hdr = buf->b_hdr;
	blkptr_t *bp = zio->io_bp;
	uint64_t psize = BP_IS_HOLE(bp) ? 0 : BP_GET_PSIZE(bp);
	fstrans_cookie_t cookie = spl_fstrans_mark();

	ASSERT(HDR_HAS_L1HDR(hdr));
	ASSERT(!zfs_refcount_is_zero(&buf->b_hdr->b_l1hdr.b_refcnt));
	ASSERT(hdr->b_l1hdr.b_bufcnt > 0);

	/*
	* If we're reexecuting this zio because the pool suspended, then
	* cleanup any state that was previously set the first time the
	* callback was invoked.
	*/
	if (zio->io_flags & ZIO_FLAG_REEXECUTED) {
	arc_cksum_free(hdr);
	arc_buf_unwatch(buf);
	if (hdr->b_l1hdr.b_pabd != NULL) {
	if (arc_buf_is_shared(buf)) {
	arc_unshare_buf(hdr, buf);
	} else {
	arc_hdr_free_abd(hdr, B_FALSE);
	}
	}

	if (HDR_HAS_RABD(hdr))
	arc_hdr_free_abd(hdr, B_TRUE);
	}
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);
	ASSERT(!HDR_HAS_RABD(hdr));
	ASSERT(!HDR_SHARED_DATA(hdr));
	ASSERT(!arc_buf_is_shared(buf));

	callback->awcb_ready(zio, buf, callback->awcb_private);

	if (HDR_IO_IN_PROGRESS(hdr))
	ASSERT(zio->io_flags & ZIO_FLAG_REEXECUTED);

	arc_hdr_set_flags(hdr, ARC_FLAG_IO_IN_PROGRESS);

	if (BP_IS_PROTECTED(bp) != !!HDR_PROTECTED(hdr))
	hdr = arc_hdr_realloc_crypt(hdr, BP_IS_PROTECTED(bp));

	if (BP_IS_PROTECTED(bp)) {
	/* ZIL blocks are written through zio_rewrite */
	ASSERT3U(BP_GET_TYPE(bp), !=, DMU_OT_INTENT_LOG);
	ASSERT(HDR_PROTECTED(hdr));

	if (BP_SHOULD_BYTESWAP(bp)) {
	if (BP_GET_LEVEL(bp) > 0) {
	hdr->b_l1hdr.b_byteswap = DMU_BSWAP_UINT64;
	} else {
	hdr->b_l1hdr.b_byteswap =
	DMU_OT_BYTESWAP(BP_GET_TYPE(bp));
	}
	} else {
	hdr->b_l1hdr.b_byteswap = DMU_BSWAP_NUMFUNCS;
	}

	hdr->b_crypt_hdr.b_ot = BP_GET_TYPE(bp);
	hdr->b_crypt_hdr.b_dsobj = zio->io_bookmark.zb_objset;
	zio_crypt_decode_params_bp(bp, hdr->b_crypt_hdr.b_salt,
	hdr->b_crypt_hdr.b_iv);
	zio_crypt_decode_mac_bp(bp, hdr->b_crypt_hdr.b_mac);
	}

	/*
	* If this block was written for raw encryption but the zio layer
	* ended up only authenticating it, adjust the buffer flags now.
	*/
	if (BP_IS_AUTHENTICATED(bp) && ARC_BUF_ENCRYPTED(buf)) {
	arc_hdr_set_flags(hdr, ARC_FLAG_NOAUTH);
	buf->b_flags &= ~ARC_BUF_FLAG_ENCRYPTED;
	if (BP_GET_COMPRESS(bp) == ZIO_COMPRESS_OFF)
	buf->b_flags &= ~ARC_BUF_FLAG_COMPRESSED;
	} else if (BP_IS_HOLE(bp) && ARC_BUF_ENCRYPTED(buf)) {
	buf->b_flags &= ~ARC_BUF_FLAG_ENCRYPTED;
	buf->b_flags &= ~ARC_BUF_FLAG_COMPRESSED;
	}

	/* this must be done after the buffer flags are adjusted */
	arc_cksum_compute(buf);

	enum zio_compress compress;
	if (BP_IS_HOLE(bp) \|\| BP_IS_EMBEDDED(bp)) {
	compress = ZIO_COMPRESS_OFF;
	} else {
	ASSERT3U(HDR_GET_LSIZE(hdr), ==, BP_GET_LSIZE(bp));
	compress = BP_GET_COMPRESS(bp);
	}
	HDR_SET_PSIZE(hdr, psize);
	arc_hdr_set_compress(hdr, compress);
	hdr->b_complevel = zio->io_prop.zp_complevel;

	if (zio->io_error != 0 \|\| psize == 0)
	goto out;

	/*
	* Fill the hdr with data. If the buffer is encrypted we have no choice
	* but to copy the data into b_radb. If the hdr is compressed, the data
	* we want is available from the zio, otherwise we can take it from
	* the buf.
	*
	* We might be able to share the buf's data with the hdr here. However,
	* doing so would cause the ARC to be full of linear ABDs if we write a
	* lot of shareable data. As a compromise, we check whether scattered
	* ABDs are allowed, and assume that if they are then the user wants
	* the ARC to be primarily filled with them regardless of the data being
	* written. Therefore, if they're allowed then we allocate one and copy
	* the data into it; otherwise, we share the data directly if we can.
	*/
	if (ARC_BUF_ENCRYPTED(buf)) {
	ASSERT3U(psize, >, 0);
	ASSERT(ARC_BUF_COMPRESSED(buf));
	arc_hdr_alloc_abd(hdr, ARC_HDR_DO_ADAPT\|ARC_HDR_ALLOC_RDATA);
	abd_copy(hdr->b_crypt_hdr.b_rabd, zio->io_abd, psize);
	} else if (zfs_abd_scatter_enabled \|\| !arc_can_share(hdr, buf)) {
	/*
	* Ideally, we would always copy the io_abd into b_pabd, but the
	* user may have disabled compressed ARC, thus we must check the
	* hdr's compression setting rather than the io_bp's.
	*/
	if (BP_IS_ENCRYPTED(bp)) {
	ASSERT3U(psize, >, 0);
	arc_hdr_alloc_abd(hdr,
	ARC_HDR_DO_ADAPT\|ARC_HDR_ALLOC_RDATA);
	abd_copy(hdr->b_crypt_hdr.b_rabd, zio->io_abd, psize);
	} else if (arc_hdr_get_compress(hdr) != ZIO_COMPRESS_OFF &&
	!ARC_BUF_COMPRESSED(buf)) {
	ASSERT3U(psize, >, 0);
	arc_hdr_alloc_abd(hdr, ARC_HDR_DO_ADAPT);
	abd_copy(hdr->b_l1hdr.b_pabd, zio->io_abd, psize);
	} else {
	ASSERT3U(zio->io_orig_size, ==, arc_hdr_size(hdr));
	arc_hdr_alloc_abd(hdr, ARC_HDR_DO_ADAPT);
	abd_copy_from_buf(hdr->b_l1hdr.b_pabd, buf->b_data,
	arc_buf_size(buf));
	}
	} else {
	ASSERT3P(buf->b_data, ==, abd_to_buf(zio->io_orig_abd));
	ASSERT3U(zio->io_orig_size, ==, arc_buf_size(buf));
	ASSERT3U(hdr->b_l1hdr.b_bufcnt, ==, 1);

	arc_share_buf(hdr, buf);
	}

	out:
	arc_hdr_verify(hdr, bp);
	spl_fstrans_unmark(cookie);
	}

	static void
	arc_write_children_ready(zio_t *zio)
	{
	arc_write_callback_t *callback = zio->io_private;
	arc_buf_t *buf = callback->awcb_buf;

	callback->awcb_children_ready(zio, buf, callback->awcb_private);
	}

	/*
	* The SPA calls this callback for each physical write that happens on behalf
	* of a logical write. See the comment in dbuf_write_physdone() for details.
	*/
	static void
	arc_write_physdone(zio_t *zio)
	{
	arc_write_callback_t *cb = zio->io_private;
	if (cb->awcb_physdone != NULL)
	cb->awcb_physdone(zio, cb->awcb_buf, cb->awcb_private);
	}

	static void
	arc_write_done(zio_t *zio)
	{
	arc_write_callback_t *callback = zio->io_private;
	arc_buf_t *buf = callback->awcb_buf;
	arc_buf_hdr_t *hdr = buf->b_hdr;

	ASSERT3P(hdr->b_l1hdr.b_acb, ==, NULL);

	if (zio->io_error == 0) {
	arc_hdr_verify(hdr, zio->io_bp);

	if (BP_IS_HOLE(zio->io_bp) \|\| BP_IS_EMBEDDED(zio->io_bp)) {
	buf_discard_identity(hdr);
	} else {
	hdr->b_dva = *BP_IDENTITY(zio->io_bp);
	hdr->b_birth = BP_PHYSICAL_BIRTH(zio->io_bp);
	}
	} else {
	ASSERT(HDR_EMPTY(hdr));
	}

	/*
	* If the block to be written was all-zero or compressed enough to be
	* embedded in the BP, no write was performed so there will be no
	* dva/birth/checksum. The buffer must therefore remain anonymous
	* (and uncached).
	*/
	if (!HDR_EMPTY(hdr)) {
	arc_buf_hdr_t *exists;
	kmutex_t *hash_lock;

	ASSERT3U(zio->io_error, ==, 0);

	arc_cksum_verify(buf);

	exists = buf_hash_insert(hdr, &hash_lock);
	if (exists != NULL) {
	/*
	* This can only happen if we overwrite for
	* sync-to-convergence, because we remove
	* buffers from the hash table when we arc_free().
	*/
	if (zio->io_flags & ZIO_FLAG_IO_REWRITE) {
	if (!BP_EQUAL(&zio->io_bp_orig, zio->io_bp))
	panic("bad overwrite, hdr=%p exists=%p",
	(void )hdr, (void )exists);
	ASSERT(zfs_refcount_is_zero(
	&exists->b_l1hdr.b_refcnt));
	arc_change_state(arc_anon, exists, hash_lock);
	arc_hdr_destroy(exists);
	mutex_exit(hash_lock);
	exists = buf_hash_insert(hdr, &hash_lock);
	ASSERT3P(exists, ==, NULL);
	} else if (zio->io_flags & ZIO_FLAG_NOPWRITE) {
	/* nopwrite */
	ASSERT(zio->io_prop.zp_nopwrite);
	if (!BP_EQUAL(&zio->io_bp_orig, zio->io_bp))
	panic("bad nopwrite, hdr=%p exists=%p",
	(void )hdr, (void )exists);
	} else {
	/* Dedup */
	ASSERT(hdr->b_l1hdr.b_bufcnt == 1);
	ASSERT(hdr->b_l1hdr.b_state == arc_anon);
	ASSERT(BP_GET_DEDUP(zio->io_bp));
	ASSERT(BP_GET_LEVEL(zio->io_bp) == 0);
	}
	}
	arc_hdr_clear_flags(hdr, ARC_FLAG_IO_IN_PROGRESS);
	/* if it's not anon, we are doing a scrub */
	if (exists == NULL && hdr->b_l1hdr.b_state == arc_anon)
	arc_access(hdr, hash_lock);
	mutex_exit(hash_lock);
	} else {
	arc_hdr_clear_flags(hdr, ARC_FLAG_IO_IN_PROGRESS);
	}

	ASSERT(!zfs_refcount_is_zero(&hdr->b_l1hdr.b_refcnt));
	callback->awcb_done(zio, buf, callback->awcb_private);

	abd_put(zio->io_abd);
	kmem_free(callback, sizeof (arc_write_callback_t));
	}

	zio_t *
	arc_write(zio_t pio, spa_t spa, uint64_t txg,
	blkptr_t bp, arc_buf_t buf, boolean_t l2arc,
	const zio_prop_t zp, arc_write_done_func_t ready,
	arc_write_done_func_t children_ready, arc_write_done_func_t physdone,
	arc_write_done_func_t done, void private, zio_priority_t priority,
	int zio_flags, const zbookmark_phys_t *zb)
	{
	arc_buf_hdr_t *hdr = buf->b_hdr;
	arc_write_callback_t *callback;
	zio_t *zio;
	zio_prop_t localprop = *zp;

	ASSERT3P(ready, !=, NULL);
	ASSERT3P(done, !=, NULL);
	ASSERT(!HDR_IO_ERROR(hdr));
	ASSERT(!HDR_IO_IN_PROGRESS(hdr));
	ASSERT3P(hdr->b_l1hdr.b_acb, ==, NULL);
	ASSERT3U(hdr->b_l1hdr.b_bufcnt, >, 0);
	if (l2arc)
	arc_hdr_set_flags(hdr, ARC_FLAG_L2CACHE);

	if (ARC_BUF_ENCRYPTED(buf)) {
	ASSERT(ARC_BUF_COMPRESSED(buf));
	localprop.zp_encrypt = B_TRUE;
	localprop.zp_compress = HDR_GET_COMPRESS(hdr);
	localprop.zp_complevel = hdr->b_complevel;
	localprop.zp_byteorder =
	(hdr->b_l1hdr.b_byteswap == DMU_BSWAP_NUMFUNCS) ?
	ZFS_HOST_BYTEORDER : !ZFS_HOST_BYTEORDER;
	bcopy(hdr->b_crypt_hdr.b_salt, localprop.zp_salt,
	ZIO_DATA_SALT_LEN);
	bcopy(hdr->b_crypt_hdr.b_iv, localprop.zp_iv,
	ZIO_DATA_IV_LEN);
	bcopy(hdr->b_crypt_hdr.b_mac, localprop.zp_mac,
	ZIO_DATA_MAC_LEN);
	if (DMU_OT_IS_ENCRYPTED(localprop.zp_type)) {
	localprop.zp_nopwrite = B_FALSE;
	localprop.zp_copies =
	MIN(localprop.zp_copies, SPA_DVAS_PER_BP - 1);
	}
	zio_flags \|= ZIO_FLAG_RAW;
	} else if (ARC_BUF_COMPRESSED(buf)) {
	ASSERT3U(HDR_GET_LSIZE(hdr), !=, arc_buf_size(buf));
	localprop.zp_compress = HDR_GET_COMPRESS(hdr);
	localprop.zp_complevel = hdr->b_complevel;
	zio_flags \|= ZIO_FLAG_RAW_COMPRESS;
	}
	callback = kmem_zalloc(sizeof (arc_write_callback_t), KM_SLEEP);
	callback->awcb_ready = ready;
	callback->awcb_children_ready = children_ready;
	callback->awcb_physdone = physdone;
	callback->awcb_done = done;
	callback->awcb_private = private;
	callback->awcb_buf = buf;

	/*
	* The hdr's b_pabd is now stale, free it now. A new data block
	* will be allocated when the zio pipeline calls arc_write_ready().
	*/
	if (hdr->b_l1hdr.b_pabd != NULL) {
	/*
	* If the buf is currently sharing the data block with
	* the hdr then we need to break that relationship here.
	* The hdr will remain with a NULL data pointer and the
	* buf will take sole ownership of the block.
	*/
	if (arc_buf_is_shared(buf)) {
	arc_unshare_buf(hdr, buf);
	} else {
	arc_hdr_free_abd(hdr, B_FALSE);
	}
	VERIFY3P(buf->b_data, !=, NULL);
	}

	if (HDR_HAS_RABD(hdr))
	arc_hdr_free_abd(hdr, B_TRUE);

	if (!(zio_flags & ZIO_FLAG_RAW))
	arc_hdr_set_compress(hdr, ZIO_COMPRESS_OFF);

	ASSERT(!arc_buf_is_shared(buf));
	ASSERT3P(hdr->b_l1hdr.b_pabd, ==, NULL);

	zio = zio_write(pio, spa, txg, bp,
	abd_get_from_buf(buf->b_data, HDR_GET_LSIZE(hdr)),
	HDR_GET_LSIZE(hdr), arc_buf_size(buf), &localprop, arc_write_ready,
	(children_ready != NULL) ? arc_write_children_ready : NULL,
	arc_write_physdone, arc_write_done, callback,
	priority, zio_flags, zb);

	return (zio);
	}

	void
	arc_tempreserve_clear(uint64_t reserve)
	{
	atomic_add_64(&arc_tempreserve, -reserve);
	ASSERT((int64_t)arc_tempreserve >= 0);
	}

	int
	arc_tempreserve_space(spa_t *spa, uint64_t reserve, uint64_t txg)
	{
	int error;
	uint64_t anon_size;

	if (!arc_no_grow &&
	reserve > arc_c/4 &&
	reserve * 4 > (2ULL << SPA_MAXBLOCKSHIFT))
	arc_c = MIN(arc_c_max, reserve * 4);

	/*
	* Throttle when the calculated memory footprint for the TXG
	* exceeds the target ARC size.
	*/
	if (reserve > arc_c) {
	DMU_TX_STAT_BUMP(dmu_tx_memory_reserve);
	return (SET_ERROR(ERESTART));
	}

	/*
	* Don't count loaned bufs as in flight dirty data to prevent long
	* network delays from blocking transactions that are ready to be
	* assigned to a txg.
	*/

	/* assert that it has not wrapped around */
	ASSERT3S(atomic_add_64_nv(&arc_loaned_bytes, 0), >=, 0);

	anon_size = MAX((int64_t)(zfs_refcount_count(&arc_anon->arcs_size) -
	arc_loaned_bytes), 0);

	/*
	* Writes will, almost always, require additional memory allocations
	* in order to compress/encrypt/etc the data. We therefore need to
	* make sure that there is sufficient available memory for this.
	*/
	error = arc_memory_throttle(spa, reserve, txg);
	if (error != 0)
	return (error);

	/*
	* Throttle writes when the amount of dirty data in the cache
	* gets too large. We try to keep the cache less than half full
	* of dirty blocks so that our sync times don't grow too large.
	*
	* In the case of one pool being built on another pool, we want
	* to make sure we don't end up throttling the lower (backing)
	* pool when the upper pool is the majority contributor to dirty
	* data. To insure we make forward progress during throttling, we
	* also check the current pool's net dirty data and only throttle
	* if it exceeds zfs_arc_pool_dirty_percent of the anonymous dirty
	* data in the cache.
	*
	* Note: if two requests come in concurrently, we might let them
	* both succeed, when one of them should fail. Not a huge deal.
	*/
	uint64_t total_dirty = reserve + arc_tempreserve + anon_size;
	uint64_t spa_dirty_anon = spa_dirty_data(spa);

	if (total_dirty > arc_c * zfs_arc_dirty_limit_percent / 100 &&
	anon_size > arc_c * zfs_arc_anon_limit_percent / 100 &&
	spa_dirty_anon > anon_size * zfs_arc_pool_dirty_percent / 100) {
	#ifdef ZFS_DEBUG
	uint64_t meta_esize = zfs_refcount_count(
	&arc_anon->arcs_esize[ARC_BUFC_METADATA]);
	uint64_t data_esize =
	zfs_refcount_count(&arc_anon->arcs_esize[ARC_BUFC_DATA]);
	dprintf("failing, arc_tempreserve=%lluK anon_meta=%lluK "
	"anon_data=%lluK tempreserve=%lluK arc_c=%lluK\n",
	arc_tempreserve >> 10, meta_esize >> 10,
	data_esize >> 10, reserve >> 10, arc_c >> 10);
	#endif
	DMU_TX_STAT_BUMP(dmu_tx_dirty_throttle);
	return (SET_ERROR(ERESTART));
	}
	atomic_add_64(&arc_tempreserve, reserve);
	return (0);
	}

	static void
	arc_kstat_update_state(arc_state_t state, kstat_named_t size,
	kstat_named_t evict_data, kstat_named_t evict_metadata)
	{
	size->value.ui64 = zfs_refcount_count(&state->arcs_size);
	evict_data->value.ui64 =
	zfs_refcount_count(&state->arcs_esize[ARC_BUFC_DATA]);
	evict_metadata->value.ui64 =
	zfs_refcount_count(&state->arcs_esize[ARC_BUFC_METADATA]);
	}

	static int
	arc_kstat_update(kstat_t *ksp, int rw)
	{
	arc_stats_t *as = ksp->ks_data;

	if (rw == KSTAT_WRITE) {
	return (SET_ERROR(EACCES));
	} else {
	arc_kstat_update_state(arc_anon,
	&as->arcstat_anon_size,
	&as->arcstat_anon_evictable_data,
	&as->arcstat_anon_evictable_metadata);
	arc_kstat_update_state(arc_mru,
	&as->arcstat_mru_size,
	&as->arcstat_mru_evictable_data,
	&as->arcstat_mru_evictable_metadata);
	arc_kstat_update_state(arc_mru_ghost,
	&as->arcstat_mru_ghost_size,
	&as->arcstat_mru_ghost_evictable_data,
	&as->arcstat_mru_ghost_evictable_metadata);
	arc_kstat_update_state(arc_mfu,
	&as->arcstat_mfu_size,
	&as->arcstat_mfu_evictable_data,
	&as->arcstat_mfu_evictable_metadata);
	arc_kstat_update_state(arc_mfu_ghost,
	&as->arcstat_mfu_ghost_size,
	&as->arcstat_mfu_ghost_evictable_data,
	&as->arcstat_mfu_ghost_evictable_metadata);

	ARCSTAT(arcstat_size) = aggsum_value(&arc_size);
	ARCSTAT(arcstat_meta_used) = aggsum_value(&arc_meta_used);
	ARCSTAT(arcstat_data_size) = aggsum_value(&astat_data_size);
	ARCSTAT(arcstat_metadata_size) =
	aggsum_value(&astat_metadata_size);
	ARCSTAT(arcstat_hdr_size) = aggsum_value(&astat_hdr_size);
	ARCSTAT(arcstat_l2_hdr_size) = aggsum_value(&astat_l2_hdr_size);
	ARCSTAT(arcstat_dbuf_size) = aggsum_value(&astat_dbuf_size);
	#if defined(COMPAT_FREEBSD11)
	ARCSTAT(arcstat_other_size) = aggsum_value(&astat_bonus_size) +
	aggsum_value(&astat_dnode_size) +
	aggsum_value(&astat_dbuf_size);
	#endif
	ARCSTAT(arcstat_dnode_size) = aggsum_value(&astat_dnode_size);
	ARCSTAT(arcstat_bonus_size) = aggsum_value(&astat_bonus_size);
	ARCSTAT(arcstat_abd_chunk_waste_size) =
	aggsum_value(&astat_abd_chunk_waste_size);

	as->arcstat_memory_all_bytes.value.ui64 =
	arc_all_memory();
	as->arcstat_memory_free_bytes.value.ui64 =
	arc_free_memory();
	as->arcstat_memory_available_bytes.value.i64 =
	arc_available_memory();
	}

	return (0);
	}

	/*
	* This function must return indices evenly distributed between all
	* sublists of the multilist. This is needed due to how the ARC eviction
	* code is laid out; arc_evict_state() assumes ARC buffers are evenly
	* distributed between all sublists and uses this assumption when
	* deciding which sublist to evict from and how much to evict from it.
	*/
	static unsigned int
	arc_state_multilist_index_func(multilist_t ml, void obj)
	{
	arc_buf_hdr_t *hdr = obj;

	/*
	* We rely on b_dva to generate evenly distributed index
	* numbers using buf_hash below. So, as an added precaution,
	* let's make sure we never add empty buffers to the arc lists.
	*/
	ASSERT(!HDR_EMPTY(hdr));

	/*
	* The assumption here, is the hash value for a given
	* arc_buf_hdr_t will remain constant throughout its lifetime
	* (i.e. its b_spa, b_dva, and b_birth fields don't change).
	* Thus, we don't need to store the header's sublist index
	* on insertion, as this index can be recalculated on removal.
	*
	* Also, the low order bits of the hash value are thought to be
	* distributed evenly. Otherwise, in the case that the multilist
	* has a power of two number of sublists, each sublists' usage
	* would not be evenly distributed.
	*/
	return (buf_hash(hdr->b_spa, &hdr->b_dva, hdr->b_birth) %
	multilist_get_num_sublists(ml));
	}

	#define WARN_IF_TUNING_IGNORED(tuning, value, do_warn) do { \
	if ((do_warn) && (tuning) && ((tuning) != (value))) { \
	cmn_err(CE_WARN, \
	"ignoring tunable %s (using %llu instead)", \
	(#tuning), (value)); \
	} \
	} while (0)

	/*
	* Called during module initialization and periodically thereafter to
	* apply reasonable changes to the exposed performance tunings. Can also be
	* called explicitly by param_set_arc_*() functions when ARC tunables are
	* updated manually. Non-zero zfs_* values which differ from the currently set
	* values will be applied.
	*/
	void
	arc_tuning_update(boolean_t verbose)
	{
	uint64_t allmem = arc_all_memory();
	unsigned long limit;

	/* Valid range: 32M - <arc_c_max> */
	if ((zfs_arc_min) && (zfs_arc_min != arc_c_min) &&
	(zfs_arc_min >= 2ULL << SPA_MAXBLOCKSHIFT) &&
	(zfs_arc_min <= arc_c_max)) {
	arc_c_min = zfs_arc_min;
	arc_c = MAX(arc_c, arc_c_min);
	}
	WARN_IF_TUNING_IGNORED(zfs_arc_min, arc_c_min, verbose);

	/* Valid range: 64M - <all physical memory> */
	if ((zfs_arc_max) && (zfs_arc_max != arc_c_max) &&
	(zfs_arc_max >= 64 << 20) && (zfs_arc_max < allmem) &&
	(zfs_arc_max > arc_c_min)) {
	arc_c_max = zfs_arc_max;
	arc_c = MIN(arc_c, arc_c_max);
	arc_p = (arc_c >> 1);
	if (arc_meta_limit > arc_c_max)
	arc_meta_limit = arc_c_max;
	if (arc_dnode_size_limit > arc_meta_limit)
	arc_dnode_size_limit = arc_meta_limit;
	}
	WARN_IF_TUNING_IGNORED(zfs_arc_max, arc_c_max, verbose);

	/* Valid range: 16M - <arc_c_max> */
	if ((zfs_arc_meta_min) && (zfs_arc_meta_min != arc_meta_min) &&
	(zfs_arc_meta_min >= 1ULL << SPA_MAXBLOCKSHIFT) &&
	(zfs_arc_meta_min <= arc_c_max)) {
	arc_meta_min = zfs_arc_meta_min;
	if (arc_meta_limit < arc_meta_min)
	arc_meta_limit = arc_meta_min;
	if (arc_dnode_size_limit < arc_meta_min)
	arc_dnode_size_limit = arc_meta_min;
	}
	WARN_IF_TUNING_IGNORED(zfs_arc_meta_min, arc_meta_min, verbose);

	/* Valid range: <arc_meta_min> - <arc_c_max> */
	limit = zfs_arc_meta_limit ? zfs_arc_meta_limit :
	MIN(zfs_arc_meta_limit_percent, 100) * arc_c_max / 100;
	if ((limit != arc_meta_limit) &&
	(limit >= arc_meta_min) &&
	(limit <= arc_c_max))
	arc_meta_limit = limit;
	WARN_IF_TUNING_IGNORED(zfs_arc_meta_limit, arc_meta_limit, verbose);

	/* Valid range: <arc_meta_min> - <arc_meta_limit> */
	limit = zfs_arc_dnode_limit ? zfs_arc_dnode_limit :
	MIN(zfs_arc_dnode_limit_percent, 100) * arc_meta_limit / 100;
	if ((limit != arc_dnode_size_limit) &&
	(limit >= arc_meta_min) &&
	(limit <= arc_meta_limit))
	arc_dnode_size_limit = limit;
	WARN_IF_TUNING_IGNORED(zfs_arc_dnode_limit, arc_dnode_size_limit,
	verbose);

	/* Valid range: 1 - N */
	if (zfs_arc_grow_retry)
	arc_grow_retry = zfs_arc_grow_retry;

	/* Valid range: 1 - N */
	if (zfs_arc_shrink_shift) {
	arc_shrink_shift = zfs_arc_shrink_shift;
	arc_no_grow_shift = MIN(arc_no_grow_shift, arc_shrink_shift -1);
	}

	/* Valid range: 1 - N */
	if (zfs_arc_p_min_shift)
	arc_p_min_shift = zfs_arc_p_min_shift;

	/* Valid range: 1 - N ms */
	if (zfs_arc_min_prefetch_ms)
	arc_min_prefetch_ms = zfs_arc_min_prefetch_ms;

	/* Valid range: 1 - N ms */
	if (zfs_arc_min_prescient_prefetch_ms) {
	arc_min_prescient_prefetch_ms =
	zfs_arc_min_prescient_prefetch_ms;
	}

	/* Valid range: 0 - 100 */
	if ((zfs_arc_lotsfree_percent >= 0) &&
	(zfs_arc_lotsfree_percent <= 100))
	arc_lotsfree_percent = zfs_arc_lotsfree_percent;
	WARN_IF_TUNING_IGNORED(zfs_arc_lotsfree_percent, arc_lotsfree_percent,
	verbose);

	/* Valid range: 0 - <all physical memory> */
	if ((zfs_arc_sys_free) && (zfs_arc_sys_free != arc_sys_free))
	arc_sys_free = MIN(MAX(zfs_arc_sys_free, 0), allmem);
	WARN_IF_TUNING_IGNORED(zfs_arc_sys_free, arc_sys_free, verbose);
	}

	static void
	arc_state_init(void)
	{
	arc_anon = &ARC_anon;
	arc_mru = &ARC_mru;
	arc_mru_ghost = &ARC_mru_ghost;
	arc_mfu = &ARC_mfu;
	arc_mfu_ghost = &ARC_mfu_ghost;
	arc_l2c_only = &ARC_l2c_only;

	arc_mru->arcs_list[ARC_BUFC_METADATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_mru->arcs_list[ARC_BUFC_DATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_mru_ghost->arcs_list[ARC_BUFC_METADATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_mru_ghost->arcs_list[ARC_BUFC_DATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_mfu->arcs_list[ARC_BUFC_METADATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_mfu->arcs_list[ARC_BUFC_DATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_mfu_ghost->arcs_list[ARC_BUFC_METADATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_mfu_ghost->arcs_list[ARC_BUFC_DATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_l2c_only->arcs_list[ARC_BUFC_METADATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);
	arc_l2c_only->arcs_list[ARC_BUFC_DATA] =
	multilist_create(sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l1hdr.b_arc_node),
	arc_state_multilist_index_func);

	zfs_refcount_create(&arc_anon->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_create(&arc_anon->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_create(&arc_mru->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_create(&arc_mru->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_create(&arc_mru_ghost->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_create(&arc_mru_ghost->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_create(&arc_mfu->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_create(&arc_mfu->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_create(&arc_mfu_ghost->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_create(&arc_mfu_ghost->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_create(&arc_l2c_only->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_create(&arc_l2c_only->arcs_esize[ARC_BUFC_DATA]);

	zfs_refcount_create(&arc_anon->arcs_size);
	zfs_refcount_create(&arc_mru->arcs_size);
	zfs_refcount_create(&arc_mru_ghost->arcs_size);
	zfs_refcount_create(&arc_mfu->arcs_size);
	zfs_refcount_create(&arc_mfu_ghost->arcs_size);
	zfs_refcount_create(&arc_l2c_only->arcs_size);

	aggsum_init(&arc_meta_used, 0);
	aggsum_init(&arc_size, 0);
	aggsum_init(&astat_data_size, 0);
	aggsum_init(&astat_metadata_size, 0);
	aggsum_init(&astat_hdr_size, 0);
	aggsum_init(&astat_l2_hdr_size, 0);
	aggsum_init(&astat_bonus_size, 0);
	aggsum_init(&astat_dnode_size, 0);
	aggsum_init(&astat_dbuf_size, 0);
	aggsum_init(&astat_abd_chunk_waste_size, 0);

	arc_anon->arcs_state = ARC_STATE_ANON;
	arc_mru->arcs_state = ARC_STATE_MRU;
	arc_mru_ghost->arcs_state = ARC_STATE_MRU_GHOST;
	arc_mfu->arcs_state = ARC_STATE_MFU;
	arc_mfu_ghost->arcs_state = ARC_STATE_MFU_GHOST;
	arc_l2c_only->arcs_state = ARC_STATE_L2C_ONLY;
	}

	static void
	arc_state_fini(void)
	{
	zfs_refcount_destroy(&arc_anon->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_destroy(&arc_anon->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_destroy(&arc_mru->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_destroy(&arc_mru->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_destroy(&arc_mru_ghost->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_destroy(&arc_mru_ghost->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_destroy(&arc_mfu->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_destroy(&arc_mfu->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_destroy(&arc_mfu_ghost->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_destroy(&arc_mfu_ghost->arcs_esize[ARC_BUFC_DATA]);
	zfs_refcount_destroy(&arc_l2c_only->arcs_esize[ARC_BUFC_METADATA]);
	zfs_refcount_destroy(&arc_l2c_only->arcs_esize[ARC_BUFC_DATA]);

	zfs_refcount_destroy(&arc_anon->arcs_size);
	zfs_refcount_destroy(&arc_mru->arcs_size);
	zfs_refcount_destroy(&arc_mru_ghost->arcs_size);
	zfs_refcount_destroy(&arc_mfu->arcs_size);
	zfs_refcount_destroy(&arc_mfu_ghost->arcs_size);
	zfs_refcount_destroy(&arc_l2c_only->arcs_size);

	multilist_destroy(arc_mru->arcs_list[ARC_BUFC_METADATA]);
	multilist_destroy(arc_mru_ghost->arcs_list[ARC_BUFC_METADATA]);
	multilist_destroy(arc_mfu->arcs_list[ARC_BUFC_METADATA]);
	multilist_destroy(arc_mfu_ghost->arcs_list[ARC_BUFC_METADATA]);
	multilist_destroy(arc_mru->arcs_list[ARC_BUFC_DATA]);
	multilist_destroy(arc_mru_ghost->arcs_list[ARC_BUFC_DATA]);
	multilist_destroy(arc_mfu->arcs_list[ARC_BUFC_DATA]);
	multilist_destroy(arc_mfu_ghost->arcs_list[ARC_BUFC_DATA]);
	multilist_destroy(arc_l2c_only->arcs_list[ARC_BUFC_METADATA]);
	multilist_destroy(arc_l2c_only->arcs_list[ARC_BUFC_DATA]);

	aggsum_fini(&arc_meta_used);
	aggsum_fini(&arc_size);
	aggsum_fini(&astat_data_size);
	aggsum_fini(&astat_metadata_size);
	aggsum_fini(&astat_hdr_size);
	aggsum_fini(&astat_l2_hdr_size);
	aggsum_fini(&astat_bonus_size);
	aggsum_fini(&astat_dnode_size);
	aggsum_fini(&astat_dbuf_size);
	aggsum_fini(&astat_abd_chunk_waste_size);
	}

	uint64_t
	arc_target_bytes(void)
	{
	return (arc_c);
	}

	void
	arc_init(void)
	{
	uint64_t percent, allmem = arc_all_memory();
	mutex_init(&arc_evict_lock, NULL, MUTEX_DEFAULT, NULL);
	list_create(&arc_evict_waiters, sizeof (arc_evict_waiter_t),
	offsetof(arc_evict_waiter_t, aew_node));

	arc_min_prefetch_ms = 1000;
	arc_min_prescient_prefetch_ms = 6000;

	#if defined(_KERNEL)
	arc_lowmem_init();
	#endif

	/* Set min cache to 1/32 of all memory, or 32MB, whichever is more. */
	arc_c_min = MAX(allmem / 32, 2ULL << SPA_MAXBLOCKSHIFT);

	/* How to set default max varies by platform. */
	arc_c_max = arc_default_max(arc_c_min, allmem);

	#ifndef _KERNEL
	/*
	* In userland, there's only the memory pressure that we artificially
	* create (see arc_available_memory()). Don't let arc_c get too
	* small, because it can cause transactions to be larger than
	* arc_c, causing arc_tempreserve_space() to fail.
	*/
	arc_c_min = MAX(arc_c_max / 2, 2ULL << SPA_MAXBLOCKSHIFT);
	#endif

	arc_c = arc_c_min;
	arc_p = (arc_c >> 1);

	/* Set min to 1/2 of arc_c_min */
	arc_meta_min = 1ULL << SPA_MAXBLOCKSHIFT;
	/* Initialize maximum observed usage to zero */
	arc_meta_max = 0;
	/*
	* Set arc_meta_limit to a percent of arc_c_max with a floor of
	* arc_meta_min, and a ceiling of arc_c_max.
	*/
	percent = MIN(zfs_arc_meta_limit_percent, 100);
	arc_meta_limit = MAX(arc_meta_min, (percent * arc_c_max) / 100);
	percent = MIN(zfs_arc_dnode_limit_percent, 100);
	arc_dnode_size_limit = (percent * arc_meta_limit) / 100;

	/* Apply user specified tunings */
	arc_tuning_update(B_TRUE);

	/* if kmem_flags are set, lets try to use less memory */
	if (kmem_debugging())
	arc_c = arc_c / 2;
	if (arc_c < arc_c_min)
	arc_c = arc_c_min;

	arc_state_init();

	buf_init();

	list_create(&arc_prune_list, sizeof (arc_prune_t),
	offsetof(arc_prune_t, p_node));
	mutex_init(&arc_prune_mtx, NULL, MUTEX_DEFAULT, NULL);

	arc_prune_taskq = taskq_create("arc_prune", boot_ncpus, defclsyspri,
	boot_ncpus, INT_MAX, TASKQ_PREPOPULATE \| TASKQ_DYNAMIC);

	arc_ksp = kstat_create("zfs", 0, "arcstats", "misc", KSTAT_TYPE_NAMED,
	sizeof (arc_stats) / sizeof (kstat_named_t), KSTAT_FLAG_VIRTUAL);

	if (arc_ksp != NULL) {
	arc_ksp->ks_data = &arc_stats;
	arc_ksp->ks_update = arc_kstat_update;
	kstat_install(arc_ksp);
	}

	arc_evict_zthr = zthr_create_timer("arc_evict",
	arc_evict_cb_check, arc_evict_cb, NULL, SEC2NSEC(1));
	arc_reap_zthr = zthr_create_timer("arc_reap",
	arc_reap_cb_check, arc_reap_cb, NULL, SEC2NSEC(1));

	arc_warm = B_FALSE;

	/*
	* Calculate maximum amount of dirty data per pool.
	*
	* If it has been set by a module parameter, take that.
	* Otherwise, use a percentage of physical memory defined by
	* zfs_dirty_data_max_percent (default 10%) with a cap at
	* zfs_dirty_data_max_max (default 4G or 25% of physical memory).
	*/
	#ifdef __LP64__
	if (zfs_dirty_data_max_max == 0)
	zfs_dirty_data_max_max = MIN(4ULL * 1024 * 1024 * 1024,
	allmem * zfs_dirty_data_max_max_percent / 100);
	#else
	if (zfs_dirty_data_max_max == 0)
	zfs_dirty_data_max_max = MIN(1ULL * 1024 * 1024 * 1024,
	allmem * zfs_dirty_data_max_max_percent / 100);
	#endif

	if (zfs_dirty_data_max == 0) {
	zfs_dirty_data_max = allmem *
	zfs_dirty_data_max_percent / 100;
	zfs_dirty_data_max = MIN(zfs_dirty_data_max,
	zfs_dirty_data_max_max);
	}
	}

	void
	arc_fini(void)
	{
	arc_prune_t *p;

	#ifdef _KERNEL
	arc_lowmem_fini();
	#endif /* _KERNEL */

	/* Use B_TRUE to ensure all buffers are evicted */
	arc_flush(NULL, B_TRUE);

	if (arc_ksp != NULL) {
	kstat_delete(arc_ksp);
	arc_ksp = NULL;
	}

	taskq_wait(arc_prune_taskq);
	taskq_destroy(arc_prune_taskq);

	mutex_enter(&arc_prune_mtx);
	while ((p = list_head(&arc_prune_list)) != NULL) {
	list_remove(&arc_prune_list, p);
	zfs_refcount_remove(&p->p_refcnt, &arc_prune_list);
	zfs_refcount_destroy(&p->p_refcnt);
	kmem_free(p, sizeof (*p));
	}
	mutex_exit(&arc_prune_mtx);

	list_destroy(&arc_prune_list);
	mutex_destroy(&arc_prune_mtx);

	(void) zthr_cancel(arc_evict_zthr);
	(void) zthr_cancel(arc_reap_zthr);

	mutex_destroy(&arc_evict_lock);
	list_destroy(&arc_evict_waiters);

	/*
	* Free any buffers that were tagged for destruction. This needs
	* to occur before arc_state_fini() runs and destroys the aggsum
	* values which are updated when freeing scatter ABDs.
	*/
	l2arc_do_free_on_write();

	/*
	* buf_fini() must proceed arc_state_fini() because buf_fin() may
	* trigger the release of kmem magazines, which can callback to
	* arc_space_return() which accesses aggsums freed in act_state_fini().
	*/
	buf_fini();
	arc_state_fini();

	/*
	* We destroy the zthrs after all the ARC state has been
	* torn down to avoid the case of them receiving any
	* wakeup() signals after they are destroyed.
	*/
	zthr_destroy(arc_evict_zthr);
	zthr_destroy(arc_reap_zthr);

	ASSERT0(arc_loaned_bytes);
	}

	/*
	* Level 2 ARC
	*
	* The level 2 ARC (L2ARC) is a cache layer in-between main memory and disk.
	* It uses dedicated storage devices to hold cached data, which are populated
	* using large infrequent writes. The main role of this cache is to boost
	* the performance of random read workloads. The intended L2ARC devices
	* include short-stroked disks, solid state disks, and other media with
	* substantially faster read latency than disk.
	*
	* +-----------------------+
	* \| ARC \|
	* +-----------------------+
	* \| ^ ^
	* \| \| \|
	* l2arc_feed_thread() arc_read()
	* \| \| \|
	* \| l2arc read \|
	* V \| \|
	* +---------------+ \|
	* \| L2ARC \| \|
	* +---------------+ \|
	* \| ^ \|
	* l2arc_write() \| \|
	* \| \| \|
	* V \| \|
	* +-------+ +-------+
	* \| vdev \| \| vdev \|
	* \| cache \| \| cache \|
	* +-------+ +-------+
	* +=========+ .-----.
	* : L2ARC : \|-_____-\|
	* : devices : \| Disks \|
	* +=========+ `-_____-'
	*
	* Read requests are satisfied from the following sources, in order:
	*
	* 1) ARC
	* 2) vdev cache of L2ARC devices
	* 3) L2ARC devices
	* 4) vdev cache of disks
	* 5) disks
	*
	* Some L2ARC device types exhibit extremely slow write performance.
	* To accommodate for this there are some significant differences between
	* the L2ARC and traditional cache design:
	*
	* 1. There is no eviction path from the ARC to the L2ARC. Evictions from
	* the ARC behave as usual, freeing buffers and placing headers on ghost
	* lists. The ARC does not send buffers to the L2ARC during eviction as
	* this would add inflated write latencies for all ARC memory pressure.
	*
	* 2. The L2ARC attempts to cache data from the ARC before it is evicted.
	* It does this by periodically scanning buffers from the eviction-end of
	* the MFU and MRU ARC lists, copying them to the L2ARC devices if they are
	* not already there. It scans until a headroom of buffers is satisfied,
	* which itself is a buffer for ARC eviction. If a compressible buffer is
	* found during scanning and selected for writing to an L2ARC device, we
	* temporarily boost scanning headroom during the next scan cycle to make
	* sure we adapt to compression effects (which might significantly reduce
	* the data volume we write to L2ARC). The thread that does this is
	* l2arc_feed_thread(), illustrated below; example sizes are included to
	* provide a better sense of ratio than this diagram:
	*
	* head --> tail
	* +---------------------+----------+
	* ARC_mfu \|:::::#:::::::::::::::\|o#o###o###\|-->. # already on L2ARC
	* +---------------------+----------+ \| o L2ARC eligible
	* ARC_mru \|:#:::::::::::::::::::\|#o#ooo####\|-->\| : ARC buffer
	* +---------------------+----------+ \|
	* 15.9 Gbytes ^ 32 Mbytes \|
	* headroom \|
	* l2arc_feed_thread()
	* \|
	* l2arc write hand <--[oooo]--'
	* \| 8 Mbyte
	* \| write max
	* V
	* +==============================+
	* L2ARC dev \|####\|#\|###\|###\| \|####\| ... \|
	* +==============================+
	* 32 Gbytes
	*
	* 3. If an ARC buffer is copied to the L2ARC but then hit instead of
	* evicted, then the L2ARC has cached a buffer much sooner than it probably
	* needed to, potentially wasting L2ARC device bandwidth and storage. It is
	* safe to say that this is an uncommon case, since buffers at the end of
	* the ARC lists have moved there due to inactivity.
	*
	* 4. If the ARC evicts faster than the L2ARC can maintain a headroom,
	* then the L2ARC simply misses copying some buffers. This serves as a
	* pressure valve to prevent heavy read workloads from both stalling the ARC
	* with waits and clogging the L2ARC with writes. This also helps prevent
	* the potential for the L2ARC to churn if it attempts to cache content too
	* quickly, such as during backups of the entire pool.
	*
	* 5. After system boot and before the ARC has filled main memory, there are
	* no evictions from the ARC and so the tails of the ARC_mfu and ARC_mru
	* lists can remain mostly static. Instead of searching from tail of these
	* lists as pictured, the l2arc_feed_thread() will search from the list heads
	* for eligible buffers, greatly increasing its chance of finding them.
	*
	* The L2ARC device write speed is also boosted during this time so that
	* the L2ARC warms up faster. Since there have been no ARC evictions yet,
	* there are no L2ARC reads, and no fear of degrading read performance
	* through increased writes.
	*
	* 6. Writes to the L2ARC devices are grouped and sent in-sequence, so that
	* the vdev queue can aggregate them into larger and fewer writes. Each
	* device is written to in a rotor fashion, sweeping writes through
	* available space then repeating.
	*
	* 7. The L2ARC does not store dirty content. It never needs to flush
	* write buffers back to disk based storage.
	*
	* 8. If an ARC buffer is written (and dirtied) which also exists in the
	* L2ARC, the now stale L2ARC buffer is immediately dropped.
	*
	* The performance of the L2ARC can be tweaked by a number of tunables, which
	* may be necessary for different workloads:
	*
	* l2arc_write_max max write bytes per interval
	* l2arc_write_boost extra write bytes during device warmup
	* l2arc_noprefetch skip caching prefetched buffers
	* l2arc_headroom number of max device writes to precache
	* l2arc_headroom_boost when we find compressed buffers during ARC
	* scanning, we multiply headroom by this
	* percentage factor for the next scan cycle,
	* since more compressed buffers are likely to
	* be present
	* l2arc_feed_secs seconds between L2ARC writing
	*
	* Tunables may be removed or added as future performance improvements are
	* integrated, and also may become zpool properties.
	*
	* There are three key functions that control how the L2ARC warms up:
	*
	* l2arc_write_eligible() check if a buffer is eligible to cache
	* l2arc_write_size() calculate how much to write
	* l2arc_write_interval() calculate sleep delay between writes
	*
	* These three functions determine what to write, how much, and how quickly
	* to send writes.
	*
	* L2ARC persistence:
	*
	* When writing buffers to L2ARC, we periodically add some metadata to
	* make sure we can pick them up after reboot, thus dramatically reducing
	* the impact that any downtime has on the performance of storage systems
	* with large caches.
	*
	* The implementation works fairly simply by integrating the following two
	* modifications:
	*
	* *) When writing to the L2ARC, we occasionally write a "l2arc log block",
	* which is an additional piece of metadata which describes what's been
	* written. This allows us to rebuild the arc_buf_hdr_t structures of the
	* main ARC buffers. There are 2 linked-lists of log blocks headed by
	* dh_start_lbps[2]. We alternate which chain we append to, so they are
	* time-wise and offset-wise interleaved, but that is an optimization rather
	* than for correctness. The log block also includes a pointer to the
	* previous block in its chain.
	*
	* *) We reserve SPA_MINBLOCKSIZE of space at the start of each L2ARC device
	* for our header bookkeeping purposes. This contains a device header,
	* which contains our top-level reference structures. We update it each
	* time we write a new log block, so that we're able to locate it in the
	* L2ARC device. If this write results in an inconsistent device header
	* (e.g. due to power failure), we detect this by verifying the header's
	* checksum and simply fail to reconstruct the L2ARC after reboot.
	*
	* Implementation diagram:
	*
	* +=== L2ARC device (not to scale) ======================================+
	* \| ___two newest log block pointers__.__________ \|
	* \| / \dh_start_lbps[1] \|
	* \| / \ \dh_start_lbps[0]\|
	* \|.___/__. V V \|
	* \|\|L2 dev\|....\|lb \|bufs \|lb \|bufs \|lb \|bufs \|lb \|bufs \|lb \|---(empty)---\|
	* \|\| hdr\| ^ /^ /^ / / \|
	* \|+------+ ...--\-------/ \-----/--\------/ / \|
	* \| \--------------/ \--------------/ \|
	* +======================================================================+
	*
	* As can be seen on the diagram, rather than using a simple linked list,
	* we use a pair of linked lists with alternating elements. This is a
	* performance enhancement due to the fact that we only find out the
	* address of the next log block access once the current block has been
	* completely read in. Obviously, this hurts performance, because we'd be
	* keeping the device's I/O queue at only a 1 operation deep, thus
	* incurring a large amount of I/O round-trip latency. Having two lists
	* allows us to fetch two log blocks ahead of where we are currently
	* rebuilding L2ARC buffers.
	*
	* On-device data structures:
	*
	* L2ARC device header: l2arc_dev_hdr_phys_t
	* L2ARC log block: l2arc_log_blk_phys_t
	*
	* L2ARC reconstruction:
	*
	* When writing data, we simply write in the standard rotary fashion,
	* evicting buffers as we go and simply writing new data over them (writing
	* a new log block every now and then). This obviously means that once we
	* loop around the end of the device, we will start cutting into an already
	* committed log block (and its referenced data buffers), like so:
	*
	* current write head__ __old tail
	* \ /
	* V V
	* <--\|bufs \|lb \|bufs \|lb \| \|bufs \|lb \|bufs \|lb \|-->
	* ^ ^^^^^^^^^___________________________________
	* \| \
	* <<nextwrite>> may overwrite this blk and/or its bufs --'
	*
	* When importing the pool, we detect this situation and use it to stop
	* our scanning process (see l2arc_rebuild).
	*
	* There is one significant caveat to consider when rebuilding ARC contents
	* from an L2ARC device: what about invalidated buffers? Given the above
	* construction, we cannot update blocks which we've already written to amend
	* them to remove buffers which were invalidated. Thus, during reconstruction,
	* we might be populating the cache with buffers for data that's not on the
	* main pool anymore, or may have been overwritten!
	*
	* As it turns out, this isn't a problem. Every arc_read request includes
	* both the DVA and, crucially, the birth TXG of the BP the caller is
	* looking for. So even if the cache were populated by completely rotten
	* blocks for data that had been long deleted and/or overwritten, we'll
	* never actually return bad data from the cache, since the DVA with the
	* birth TXG uniquely identify a block in space and time - once created,
	* a block is immutable on disk. The worst thing we have done is wasted
	* some time and memory at l2arc rebuild to reconstruct outdated ARC
	* entries that will get dropped from the l2arc as it is being updated
	* with new blocks.
	*
	* L2ARC buffers that have been evicted by l2arc_evict() ahead of the write
	* hand are not restored. This is done by saving the offset (in bytes)
	* l2arc_evict() has evicted to in the L2ARC device header and taking it
	* into account when restoring buffers.
	*/

	static boolean_t
	l2arc_write_eligible(uint64_t spa_guid, arc_buf_hdr_t *hdr)
	{
	/*
	* A buffer is not eligible for the L2ARC if it:
	* 1. belongs to a different spa.
	* 2. is already cached on the L2ARC.
	* 3. has an I/O in progress (it may be an incomplete read).
	* 4. is flagged not eligible (zfs property).
	*/
	if (hdr->b_spa != spa_guid \|\| HDR_HAS_L2HDR(hdr) \|\|
	HDR_IO_IN_PROGRESS(hdr) \|\| !HDR_L2CACHE(hdr))
	return (B_FALSE);

	return (B_TRUE);
	}

	static uint64_t
	l2arc_write_size(l2arc_dev_t *dev)
	{
	uint64_t size, dev_size, tsize;

	/*
	* Make sure our globals have meaningful values in case the user
	* altered them.
	*/
	size = l2arc_write_max;
	if (size == 0) {
	cmn_err(CE_NOTE, "Bad value for l2arc_write_max, value must "
	"be greater than zero, resetting it to the default (%d)",
	L2ARC_WRITE_SIZE);
	size = l2arc_write_max = L2ARC_WRITE_SIZE;
	}

	if (arc_warm == B_FALSE)
	size += l2arc_write_boost;

	/*
	* Make sure the write size does not exceed the size of the cache
	* device. This is important in l2arc_evict(), otherwise infinite
	* iteration can occur.
	*/
	dev_size = dev->l2ad_end - dev->l2ad_start;
	tsize = size + l2arc_log_blk_overhead(size, dev);
	if (dev->l2ad_vdev->vdev_has_trim && l2arc_trim_ahead > 0)
	tsize += MAX(64 * 1024 * 1024,
	(tsize * l2arc_trim_ahead) / 100);

	if (tsize >= dev_size) {
	cmn_err(CE_NOTE, "l2arc_write_max or l2arc_write_boost "
	"plus the overhead of log blocks (persistent L2ARC, "
	"%llu bytes) exceeds the size of the cache device "
	"(guid %llu), resetting them to the default (%d)",
	l2arc_log_blk_overhead(size, dev),
	dev->l2ad_vdev->vdev_guid, L2ARC_WRITE_SIZE);
	size = l2arc_write_max = l2arc_write_boost = L2ARC_WRITE_SIZE;

	if (arc_warm == B_FALSE)
	size += l2arc_write_boost;
	}

	return (size);

	}

	static clock_t
	l2arc_write_interval(clock_t began, uint64_t wanted, uint64_t wrote)
	{
	clock_t interval, next, now;

	/*
	* If the ARC lists are busy, increase our write rate; if the
	* lists are stale, idle back. This is achieved by checking
	* how much we previously wrote - if it was more than half of
	* what we wanted, schedule the next write much sooner.
	*/
	if (l2arc_feed_again && wrote > (wanted / 2))
	interval = (hz * l2arc_feed_min_ms) / 1000;
	else
	interval = hz * l2arc_feed_secs;

	now = ddi_get_lbolt();
	next = MAX(now, MIN(now + interval, began + interval));

	return (next);
	}

	/*
	* Cycle through L2ARC devices. This is how L2ARC load balances.
	* If a device is returned, this also returns holding the spa config lock.
	*/
	static l2arc_dev_t *
	l2arc_dev_get_next(void)
	{
	l2arc_dev_t first, next = NULL;

	/*
	* Lock out the removal of spas (spa_namespace_lock), then removal
	* of cache devices (l2arc_dev_mtx). Once a device has been selected,
	* both locks will be dropped and a spa config lock held instead.
	*/
	mutex_enter(&spa_namespace_lock);
	mutex_enter(&l2arc_dev_mtx);

	/* if there are no vdevs, there is nothing to do */
	if (l2arc_ndev == 0)
	goto out;

	first = NULL;
	next = l2arc_dev_last;
	do {
	/* loop around the list looking for a non-faulted vdev */
	if (next == NULL) {
	next = list_head(l2arc_dev_list);
	} else {
	next = list_next(l2arc_dev_list, next);
	if (next == NULL)
	next = list_head(l2arc_dev_list);
	}

	/* if we have come back to the start, bail out */
	if (first == NULL)
	first = next;
	else if (next == first)
	break;

	} while (vdev_is_dead(next->l2ad_vdev) \|\| next->l2ad_rebuild \|\|
	next->l2ad_trim_all);

	/* if we were unable to find any usable vdevs, return NULL */
	if (vdev_is_dead(next->l2ad_vdev) \|\| next->l2ad_rebuild \|\|
	next->l2ad_trim_all)
	next = NULL;

	l2arc_dev_last = next;

	out:
	mutex_exit(&l2arc_dev_mtx);

	/*
	* Grab the config lock to prevent the 'next' device from being
	* removed while we are writing to it.
	*/
	if (next != NULL)
	spa_config_enter(next->l2ad_spa, SCL_L2ARC, next, RW_READER);
	mutex_exit(&spa_namespace_lock);

	return (next);
	}

	/*
	* Free buffers that were tagged for destruction.
	*/
	static void
	l2arc_do_free_on_write(void)
	{
	list_t *buflist;
	l2arc_data_free_t df, df_prev;

	mutex_enter(&l2arc_free_on_write_mtx);
	buflist = l2arc_free_on_write;

	for (df = list_tail(buflist); df; df = df_prev) {
	df_prev = list_prev(buflist, df);
	ASSERT3P(df->l2df_abd, !=, NULL);
	abd_free(df->l2df_abd);
	list_remove(buflist, df);
	kmem_free(df, sizeof (l2arc_data_free_t));
	}

	mutex_exit(&l2arc_free_on_write_mtx);
	}

	/*
	* A write to a cache device has completed. Update all headers to allow
	* reads from these buffers to begin.
	*/
	static void
	l2arc_write_done(zio_t *zio)
	{
	l2arc_write_callback_t *cb;
	l2arc_lb_abd_buf_t *abd_buf;
	l2arc_lb_ptr_buf_t *lb_ptr_buf;
	l2arc_dev_t *dev;
	l2arc_dev_hdr_phys_t *l2dhdr;
	list_t *buflist;
	arc_buf_hdr_t head, hdr, *hdr_prev;
	kmutex_t *hash_lock;
	int64_t bytes_dropped = 0;

	cb = zio->io_private;
	ASSERT3P(cb, !=, NULL);
	dev = cb->l2wcb_dev;
	l2dhdr = dev->l2ad_dev_hdr;
	ASSERT3P(dev, !=, NULL);
	head = cb->l2wcb_head;
	ASSERT3P(head, !=, NULL);
	buflist = &dev->l2ad_buflist;
	ASSERT3P(buflist, !=, NULL);
	DTRACE_PROBE2(l2arc__iodone, zio_t *, zio,
	l2arc_write_callback_t *, cb);

	if (zio->io_error != 0)
	ARCSTAT_BUMP(arcstat_l2_writes_error);

	/*
	* All writes completed, or an error was hit.
	*/
	top:
	mutex_enter(&dev->l2ad_mtx);
	for (hdr = list_prev(buflist, head); hdr; hdr = hdr_prev) {
	hdr_prev = list_prev(buflist, hdr);

	hash_lock = HDR_LOCK(hdr);

	/*
	* We cannot use mutex_enter or else we can deadlock
	* with l2arc_write_buffers (due to swapping the order
	* the hash lock and l2ad_mtx are taken).
	*/
	if (!mutex_tryenter(hash_lock)) {
	/*
	* Missed the hash lock. We must retry so we
	* don't leave the ARC_FLAG_L2_WRITING bit set.
	*/
	ARCSTAT_BUMP(arcstat_l2_writes_lock_retry);

	/*
	* We don't want to rescan the headers we've
	* already marked as having been written out, so
	* we reinsert the head node so we can pick up
	* where we left off.
	*/
	list_remove(buflist, head);
	list_insert_after(buflist, hdr, head);

	mutex_exit(&dev->l2ad_mtx);

	/*
	* We wait for the hash lock to become available
	* to try and prevent busy waiting, and increase
	* the chance we'll be able to acquire the lock
	* the next time around.
	*/
	mutex_enter(hash_lock);
	mutex_exit(hash_lock);
	goto top;
	}

	/*
	* We could not have been moved into the arc_l2c_only
	* state while in-flight due to our ARC_FLAG_L2_WRITING
	* bit being set. Let's just ensure that's being enforced.
	*/
	ASSERT(HDR_HAS_L1HDR(hdr));

	/*
	* Skipped - drop L2ARC entry and mark the header as no
	* longer L2 eligibile.
	*/
	if (zio->io_error != 0) {
	/*
	* Error - drop L2ARC entry.
	*/
	list_remove(buflist, hdr);
	arc_hdr_clear_flags(hdr, ARC_FLAG_HAS_L2HDR);

	uint64_t psize = HDR_GET_PSIZE(hdr);
	ARCSTAT_INCR(arcstat_l2_psize, -psize);
	ARCSTAT_INCR(arcstat_l2_lsize, -HDR_GET_LSIZE(hdr));

	bytes_dropped +=
	vdev_psize_to_asize(dev->l2ad_vdev, psize);
	(void) zfs_refcount_remove_many(&dev->l2ad_alloc,
	arc_hdr_size(hdr), hdr);
	}

	/*
	* Allow ARC to begin reads and ghost list evictions to
	* this L2ARC entry.
	*/
	arc_hdr_clear_flags(hdr, ARC_FLAG_L2_WRITING);

	mutex_exit(hash_lock);
	}

	/*
	* Free the allocated abd buffers for writing the log blocks.
	* If the zio failed reclaim the allocated space and remove the
	* pointers to these log blocks from the log block pointer list
	* of the L2ARC device.
	*/
	while ((abd_buf = list_remove_tail(&cb->l2wcb_abd_list)) != NULL) {
	abd_free(abd_buf->abd);
	zio_buf_free(abd_buf, sizeof (*abd_buf));
	if (zio->io_error != 0) {
	lb_ptr_buf = list_remove_head(&dev->l2ad_lbptr_list);
	/*
	* L2BLK_GET_PSIZE returns aligned size for log
	* blocks.
	*/
	uint64_t asize =
	L2BLK_GET_PSIZE((lb_ptr_buf->lb_ptr)->lbp_prop);
	bytes_dropped += asize;
	ARCSTAT_INCR(arcstat_l2_log_blk_asize, -asize);
	ARCSTAT_BUMPDOWN(arcstat_l2_log_blk_count);
	zfs_refcount_remove_many(&dev->l2ad_lb_asize, asize,
	lb_ptr_buf);
	zfs_refcount_remove(&dev->l2ad_lb_count, lb_ptr_buf);
	kmem_free(lb_ptr_buf->lb_ptr,
	sizeof (l2arc_log_blkptr_t));
	kmem_free(lb_ptr_buf, sizeof (l2arc_lb_ptr_buf_t));
	}
	}
	list_destroy(&cb->l2wcb_abd_list);

	if (zio->io_error != 0) {
	/*
	* Restore the lbps array in the header to its previous state.
	* If the list of log block pointers is empty, zero out the
	* log block pointers in the device header.
	*/
	lb_ptr_buf = list_head(&dev->l2ad_lbptr_list);
	for (int i = 0; i < 2; i++) {
	if (lb_ptr_buf == NULL) {
	/*
	* If the list is empty zero out the device
	* header. Otherwise zero out the second log
	* block pointer in the header.
	*/
	if (i == 0) {
	bzero(l2dhdr, dev->l2ad_dev_hdr_asize);
	} else {
	bzero(&l2dhdr->dh_start_lbps[i],
	sizeof (l2arc_log_blkptr_t));
	}
	break;
	}
	bcopy(lb_ptr_buf->lb_ptr, &l2dhdr->dh_start_lbps[i],
	sizeof (l2arc_log_blkptr_t));
	lb_ptr_buf = list_next(&dev->l2ad_lbptr_list,
	lb_ptr_buf);
	}
	}

	atomic_inc_64(&l2arc_writes_done);
	list_remove(buflist, head);
	ASSERT(!HDR_HAS_L1HDR(head));
	kmem_cache_free(hdr_l2only_cache, head);
	mutex_exit(&dev->l2ad_mtx);

	ASSERT(dev->l2ad_vdev != NULL);
	vdev_space_update(dev->l2ad_vdev, -bytes_dropped, 0, 0);

	l2arc_do_free_on_write();

	kmem_free(cb, sizeof (l2arc_write_callback_t));
	}

	static int
	l2arc_untransform(zio_t zio, l2arc_read_callback_t cb)
	{
	int ret;
	spa_t *spa = zio->io_spa;
	arc_buf_hdr_t *hdr = cb->l2rcb_hdr;
	blkptr_t *bp = zio->io_bp;
	uint8_t salt[ZIO_DATA_SALT_LEN];
	uint8_t iv[ZIO_DATA_IV_LEN];
	uint8_t mac[ZIO_DATA_MAC_LEN];
	boolean_t no_crypt = B_FALSE;

	/*
	* ZIL data is never be written to the L2ARC, so we don't need
	* special handling for its unique MAC storage.
	*/
	ASSERT3U(BP_GET_TYPE(bp), !=, DMU_OT_INTENT_LOG);
	ASSERT(MUTEX_HELD(HDR_LOCK(hdr)));
	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);

	/*
	* If the data was encrypted, decrypt it now. Note that
	* we must check the bp here and not the hdr, since the
	* hdr does not have its encryption parameters updated
	* until arc_read_done().
	*/
	if (BP_IS_ENCRYPTED(bp)) {
	abd_t *eabd = arc_get_data_abd(hdr, arc_hdr_size(hdr), hdr,
	B_TRUE);

	zio_crypt_decode_params_bp(bp, salt, iv);
	zio_crypt_decode_mac_bp(bp, mac);

	ret = spa_do_crypt_abd(B_FALSE, spa, &cb->l2rcb_zb,
	BP_GET_TYPE(bp), BP_GET_DEDUP(bp), BP_SHOULD_BYTESWAP(bp),
	salt, iv, mac, HDR_GET_PSIZE(hdr), eabd,
	hdr->b_l1hdr.b_pabd, &no_crypt);
	if (ret != 0) {
	arc_free_data_abd(hdr, eabd, arc_hdr_size(hdr), hdr);
	goto error;
	}

	/*
	* If we actually performed decryption, replace b_pabd
	* with the decrypted data. Otherwise we can just throw
	* our decryption buffer away.
	*/
	if (!no_crypt) {
	arc_free_data_abd(hdr, hdr->b_l1hdr.b_pabd,
	arc_hdr_size(hdr), hdr);
	hdr->b_l1hdr.b_pabd = eabd;
	zio->io_abd = eabd;
	} else {
	arc_free_data_abd(hdr, eabd, arc_hdr_size(hdr), hdr);
	}
	}

	/*
	* If the L2ARC block was compressed, but ARC compression
	* is disabled we decompress the data into a new buffer and
	* replace the existing data.
	*/
	if (HDR_GET_COMPRESS(hdr) != ZIO_COMPRESS_OFF &&
	!HDR_COMPRESSION_ENABLED(hdr)) {
	abd_t *cabd = arc_get_data_abd(hdr, arc_hdr_size(hdr), hdr,
	B_TRUE);
	void *tmp = abd_borrow_buf(cabd, arc_hdr_size(hdr));

	ret = zio_decompress_data(HDR_GET_COMPRESS(hdr),
	hdr->b_l1hdr.b_pabd, tmp, HDR_GET_PSIZE(hdr),
	HDR_GET_LSIZE(hdr), &hdr->b_complevel);
	if (ret != 0) {
	abd_return_buf_copy(cabd, tmp, arc_hdr_size(hdr));
	arc_free_data_abd(hdr, cabd, arc_hdr_size(hdr), hdr);
	goto error;
	}

	abd_return_buf_copy(cabd, tmp, arc_hdr_size(hdr));
	arc_free_data_abd(hdr, hdr->b_l1hdr.b_pabd,
	arc_hdr_size(hdr), hdr);
	hdr->b_l1hdr.b_pabd = cabd;
	zio->io_abd = cabd;
	zio->io_size = HDR_GET_LSIZE(hdr);
	}

	return (0);

	error:
	return (ret);
	}


	/*
	* A read to a cache device completed. Validate buffer contents before
	* handing over to the regular ARC routines.
	*/
	static void
	l2arc_read_done(zio_t *zio)
	{
	int tfm_error = 0;
	l2arc_read_callback_t *cb = zio->io_private;
	arc_buf_hdr_t *hdr;
	kmutex_t *hash_lock;
	boolean_t valid_cksum;
	boolean_t using_rdata = (BP_IS_ENCRYPTED(&cb->l2rcb_bp) &&
	(cb->l2rcb_flags & ZIO_FLAG_RAW_ENCRYPT));

	ASSERT3P(zio->io_vd, !=, NULL);
	ASSERT(zio->io_flags & ZIO_FLAG_DONT_PROPAGATE);

	spa_config_exit(zio->io_spa, SCL_L2ARC, zio->io_vd);

	ASSERT3P(cb, !=, NULL);
	hdr = cb->l2rcb_hdr;
	ASSERT3P(hdr, !=, NULL);

	hash_lock = HDR_LOCK(hdr);
	mutex_enter(hash_lock);
	ASSERT3P(hash_lock, ==, HDR_LOCK(hdr));

	/*
	* If the data was read into a temporary buffer,
	* move it and free the buffer.
	*/
	if (cb->l2rcb_abd != NULL) {
	ASSERT3U(arc_hdr_size(hdr), <, zio->io_size);
	if (zio->io_error == 0) {
	if (using_rdata) {
	abd_copy(hdr->b_crypt_hdr.b_rabd,
	cb->l2rcb_abd, arc_hdr_size(hdr));
	} else {
	abd_copy(hdr->b_l1hdr.b_pabd,
	cb->l2rcb_abd, arc_hdr_size(hdr));
	}
	}

	/*
	* The following must be done regardless of whether
	* there was an error:
	* - free the temporary buffer
	* - point zio to the real ARC buffer
	* - set zio size accordingly
	* These are required because zio is either re-used for
	* an I/O of the block in the case of the error
	* or the zio is passed to arc_read_done() and it
	* needs real data.
	*/
	abd_free(cb->l2rcb_abd);
	zio->io_size = zio->io_orig_size = arc_hdr_size(hdr);

	if (using_rdata) {
	ASSERT(HDR_HAS_RABD(hdr));
	zio->io_abd = zio->io_orig_abd =
	hdr->b_crypt_hdr.b_rabd;
	} else {
	ASSERT3P(hdr->b_l1hdr.b_pabd, !=, NULL);
	zio->io_abd = zio->io_orig_abd = hdr->b_l1hdr.b_pabd;
	}
	}

	ASSERT3P(zio->io_abd, !=, NULL);

	/*
	* Check this survived the L2ARC journey.
	*/
	ASSERT(zio->io_abd == hdr->b_l1hdr.b_pabd \|\|
	(HDR_HAS_RABD(hdr) && zio->io_abd == hdr->b_crypt_hdr.b_rabd));
	zio->io_bp_copy = cb->l2rcb_bp; /* XXX fix in L2ARC 2.0 */
	zio->io_bp = &zio->io_bp_copy; /* XXX fix in L2ARC 2.0 */
	zio->io_prop.zp_complevel = hdr->b_complevel;

	valid_cksum = arc_cksum_is_equal(hdr, zio);

	/*
	* b_rabd will always match the data as it exists on disk if it is
	* being used. Therefore if we are reading into b_rabd we do not
	* attempt to untransform the data.
	*/
	if (valid_cksum && !using_rdata)
	tfm_error = l2arc_untransform(zio, cb);

	if (valid_cksum && tfm_error == 0 && zio->io_error == 0 &&
	!HDR_L2_EVICTED(hdr)) {
	mutex_exit(hash_lock);
	zio->io_private = hdr;
	arc_read_done(zio);
	} else {
	/*
	* Buffer didn't survive caching. Increment stats and
	* reissue to the original storage device.
	*/
	if (zio->io_error != 0) {
	ARCSTAT_BUMP(arcstat_l2_io_error);
	} else {
	zio->io_error = SET_ERROR(EIO);
	}
	if (!valid_cksum \|\| tfm_error != 0)
	ARCSTAT_BUMP(arcstat_l2_cksum_bad);

	/*
	* If there's no waiter, issue an async i/o to the primary
	* storage now. If there is a waiter, the caller must
	* issue the i/o in a context where it's OK to block.
	*/
	if (zio->io_waiter == NULL) {
	zio_t *pio = zio_unique_parent(zio);
	void *abd = (using_rdata) ?
	hdr->b_crypt_hdr.b_rabd : hdr->b_l1hdr.b_pabd;

	ASSERT(!pio \|\| pio->io_child_type == ZIO_CHILD_LOGICAL);

	zio = zio_read(pio, zio->io_spa, zio->io_bp,
	abd, zio->io_size, arc_read_done,
	hdr, zio->io_priority, cb->l2rcb_flags,
	&cb->l2rcb_zb);

	/*
	* Original ZIO will be freed, so we need to update
	* ARC header with the new ZIO pointer to be used
	* by zio_change_priority() in arc_read().
	*/
	for (struct arc_callback *acb = hdr->b_l1hdr.b_acb;
	acb != NULL; acb = acb->acb_next)
	acb->acb_zio_head = zio;

	mutex_exit(hash_lock);
	zio_nowait(zio);
	} else {
	mutex_exit(hash_lock);
	}
	}

	kmem_free(cb, sizeof (l2arc_read_callback_t));
	}

	/*
	* This is the list priority from which the L2ARC will search for pages to
	* cache. This is used within loops (0..3) to cycle through lists in the
	* desired order. This order can have a significant effect on cache
	* performance.
	*
	* Currently the metadata lists are hit first, MFU then MRU, followed by
	* the data lists. This function returns a locked list, and also returns
	* the lock pointer.
	*/
	static multilist_sublist_t *
	l2arc_sublist_lock(int list_num)
	{
	multilist_t *ml = NULL;
	unsigned int idx;

	ASSERT(list_num >= 0 && list_num < L2ARC_FEED_TYPES);

	switch (list_num) {
	case 0:
	ml = arc_mfu->arcs_list[ARC_BUFC_METADATA];
	break;
	case 1:
	ml = arc_mru->arcs_list[ARC_BUFC_METADATA];
	break;
	case 2:
	ml = arc_mfu->arcs_list[ARC_BUFC_DATA];
	break;
	case 3:
	ml = arc_mru->arcs_list[ARC_BUFC_DATA];
	break;
	default:
	return (NULL);
	}

	/*
	* Return a randomly-selected sublist. This is acceptable
	* because the caller feeds only a little bit of data for each
	* call (8MB). Subsequent calls will result in different
	* sublists being selected.
	*/
	idx = multilist_get_random_index(ml);
	return (multilist_sublist_lock(ml, idx));
	}

	/*
	* Calculates the maximum overhead of L2ARC metadata log blocks for a given
	* L2ARC write size. l2arc_evict and l2arc_write_size need to include this
	* overhead in processing to make sure there is enough headroom available
	* when writing buffers.
	*/
	static inline uint64_t
	l2arc_log_blk_overhead(uint64_t write_sz, l2arc_dev_t *dev)
	{
	if (dev->l2ad_log_entries == 0) {
	return (0);
	} else {
	uint64_t log_entries = write_sz >> SPA_MINBLOCKSHIFT;

	uint64_t log_blocks = (log_entries +
	dev->l2ad_log_entries - 1) /
	dev->l2ad_log_entries;

	return (vdev_psize_to_asize(dev->l2ad_vdev,
	sizeof (l2arc_log_blk_phys_t)) * log_blocks);
	}
	}

	/*
	* Evict buffers from the device write hand to the distance specified in
	* bytes. This distance may span populated buffers, it may span nothing.
	* This is clearing a region on the L2ARC device ready for writing.
	* If the 'all' boolean is set, every buffer is evicted.
	*/
	static void
	l2arc_evict(l2arc_dev_t *dev, uint64_t distance, boolean_t all)
	{
	list_t *buflist;
	arc_buf_hdr_t hdr, hdr_prev;
	kmutex_t *hash_lock;
	uint64_t taddr;
	l2arc_lb_ptr_buf_t lb_ptr_buf, lb_ptr_buf_prev;
	vdev_t *vd = dev->l2ad_vdev;
	boolean_t rerun;

	buflist = &dev->l2ad_buflist;

	/*
	* We need to add in the worst case scenario of log block overhead.
	*/
	distance += l2arc_log_blk_overhead(distance, dev);
	if (vd->vdev_has_trim && l2arc_trim_ahead > 0) {
	/*
	* Trim ahead of the write size 64MB or (l2arc_trim_ahead/100)
	* times the write size, whichever is greater.
	*/
	distance += MAX(64 * 1024 * 1024,
	(distance * l2arc_trim_ahead) / 100);
	}

	top:
	rerun = B_FALSE;
	if (dev->l2ad_hand >= (dev->l2ad_end - distance)) {
	/*
	* When there is no space to accommodate upcoming writes,
	* evict to the end. Then bump the write and evict hands
	* to the start and iterate. This iteration does not
	* happen indefinitely as we make sure in
	* l2arc_write_size() that when the write hand is reset,
	* the write size does not exceed the end of the device.
	*/
	rerun = B_TRUE;
	taddr = dev->l2ad_end;
	} else {
	taddr = dev->l2ad_hand + distance;
	}
	DTRACE_PROBE4(l2arc__evict, l2arc_dev_t , dev, list_t , buflist,
	uint64_t, taddr, boolean_t, all);

	if (!all) {
	/*
	* This check has to be placed after deciding whether to
	* iterate (rerun).
	*/
	if (dev->l2ad_first) {
	/*
	* This is the first sweep through the device. There is
	* nothing to evict. We have already trimmmed the
	* whole device.
	*/
	goto out;
	} else {
	/*
	* Trim the space to be evicted.
	*/
	if (vd->vdev_has_trim && dev->l2ad_evict < taddr &&
	l2arc_trim_ahead > 0) {
	/*
	* We have to drop the spa_config lock because
	* vdev_trim_range() will acquire it.
	* l2ad_evict already accounts for the label
	* size. To prevent vdev_trim_ranges() from
	* adding it again, we subtract it from
	* l2ad_evict.
	*/
	spa_config_exit(dev->l2ad_spa, SCL_L2ARC, dev);
	vdev_trim_simple(vd,
	dev->l2ad_evict - VDEV_LABEL_START_SIZE,
	taddr - dev->l2ad_evict);
	spa_config_enter(dev->l2ad_spa, SCL_L2ARC, dev,
	RW_READER);
	}

	/*
	* When rebuilding L2ARC we retrieve the evict hand
	* from the header of the device. Of note, l2arc_evict()
	* does not actually delete buffers from the cache
	* device, but trimming may do so depending on the
	* hardware implementation. Thus keeping track of the
	* evict hand is useful.
	*/
	dev->l2ad_evict = MAX(dev->l2ad_evict, taddr);
	}
	}

	retry:
	mutex_enter(&dev->l2ad_mtx);
	/*
	* We have to account for evicted log blocks. Run vdev_space_update()
	* on log blocks whose offset (in bytes) is before the evicted offset
	* (in bytes) by searching in the list of pointers to log blocks
	* present in the L2ARC device.
	*/
	for (lb_ptr_buf = list_tail(&dev->l2ad_lbptr_list); lb_ptr_buf;
	lb_ptr_buf = lb_ptr_buf_prev) {

	lb_ptr_buf_prev = list_prev(&dev->l2ad_lbptr_list, lb_ptr_buf);

	/* L2BLK_GET_PSIZE returns aligned size for log blocks */
	uint64_t asize = L2BLK_GET_PSIZE(
	(lb_ptr_buf->lb_ptr)->lbp_prop);

	/*
	* We don't worry about log blocks left behind (ie
	* lbp_payload_start < l2ad_hand) because l2arc_write_buffers()
	* will never write more than l2arc_evict() evicts.
	*/
	if (!all && l2arc_log_blkptr_valid(dev, lb_ptr_buf->lb_ptr)) {
	break;
	} else {
	vdev_space_update(vd, -asize, 0, 0);
	ARCSTAT_INCR(arcstat_l2_log_blk_asize, -asize);
	ARCSTAT_BUMPDOWN(arcstat_l2_log_blk_count);
	zfs_refcount_remove_many(&dev->l2ad_lb_asize, asize,
	lb_ptr_buf);
	zfs_refcount_remove(&dev->l2ad_lb_count, lb_ptr_buf);
	list_remove(&dev->l2ad_lbptr_list, lb_ptr_buf);
	kmem_free(lb_ptr_buf->lb_ptr,
	sizeof (l2arc_log_blkptr_t));
	kmem_free(lb_ptr_buf, sizeof (l2arc_lb_ptr_buf_t));
	}
	}

	for (hdr = list_tail(buflist); hdr; hdr = hdr_prev) {
	hdr_prev = list_prev(buflist, hdr);

	ASSERT(!HDR_EMPTY(hdr));
	hash_lock = HDR_LOCK(hdr);

	/*
	* We cannot use mutex_enter or else we can deadlock
	* with l2arc_write_buffers (due to swapping the order
	* the hash lock and l2ad_mtx are taken).
	*/
	if (!mutex_tryenter(hash_lock)) {
	/*
	* Missed the hash lock. Retry.
	*/
	ARCSTAT_BUMP(arcstat_l2_evict_lock_retry);
	mutex_exit(&dev->l2ad_mtx);
	mutex_enter(hash_lock);
	mutex_exit(hash_lock);
	goto retry;
	}

	/*
	* A header can't be on this list if it doesn't have L2 header.
	*/
	ASSERT(HDR_HAS_L2HDR(hdr));

	/* Ensure this header has finished being written. */
	ASSERT(!HDR_L2_WRITING(hdr));
	ASSERT(!HDR_L2_WRITE_HEAD(hdr));

	if (!all && (hdr->b_l2hdr.b_daddr >= dev->l2ad_evict \|\|
	hdr->b_l2hdr.b_daddr < dev->l2ad_hand)) {
	/*
	* We've evicted to the target address,
	* or the end of the device.
	*/
	mutex_exit(hash_lock);
	break;
	}

	if (!HDR_HAS_L1HDR(hdr)) {
	ASSERT(!HDR_L2_READING(hdr));
	/*
	* This doesn't exist in the ARC. Destroy.
	* arc_hdr_destroy() will call list_remove()
	* and decrement arcstat_l2_lsize.
	*/
	arc_change_state(arc_anon, hdr, hash_lock);
	arc_hdr_destroy(hdr);
	} else {
	ASSERT(hdr->b_l1hdr.b_state != arc_l2c_only);
	ARCSTAT_BUMP(arcstat_l2_evict_l1cached);
	/*
	* Invalidate issued or about to be issued
	* reads, since we may be about to write
	* over this location.
	*/
	if (HDR_L2_READING(hdr)) {
	ARCSTAT_BUMP(arcstat_l2_evict_reading);
	arc_hdr_set_flags(hdr, ARC_FLAG_L2_EVICTED);
	}

	arc_hdr_l2hdr_destroy(hdr);
	}
	mutex_exit(hash_lock);
	}
	mutex_exit(&dev->l2ad_mtx);

	out:
	/*
	* We need to check if we evict all buffers, otherwise we may iterate
	* unnecessarily.
	*/
	if (!all && rerun) {
	/*
	* Bump device hand to the device start if it is approaching the
	* end. l2arc_evict() has already evicted ahead for this case.
	*/
	dev->l2ad_hand = dev->l2ad_start;
	dev->l2ad_evict = dev->l2ad_start;
	dev->l2ad_first = B_FALSE;
	goto top;
	}

	ASSERT3U(dev->l2ad_hand + distance, <, dev->l2ad_end);
	if (!dev->l2ad_first)
	ASSERT3U(dev->l2ad_hand, <, dev->l2ad_evict);
	}

	/*
	* Handle any abd transforms that might be required for writing to the L2ARC.
	* If successful, this function will always return an abd with the data
	* transformed as it is on disk in a new abd of asize bytes.
	*/
	static int
	l2arc_apply_transforms(spa_t spa, arc_buf_hdr_t hdr, uint64_t asize,
	abd_t **abd_out)
	{
	int ret;
	void *tmp = NULL;
	abd_t cabd = NULL, eabd = NULL, *to_write = hdr->b_l1hdr.b_pabd;
	enum zio_compress compress = HDR_GET_COMPRESS(hdr);
	uint64_t psize = HDR_GET_PSIZE(hdr);
	uint64_t size = arc_hdr_size(hdr);
	boolean_t ismd = HDR_ISTYPE_METADATA(hdr);
	boolean_t bswap = (hdr->b_l1hdr.b_byteswap != DMU_BSWAP_NUMFUNCS);
	dsl_crypto_key_t *dck = NULL;
	uint8_t mac[ZIO_DATA_MAC_LEN] = { 0 };
	boolean_t no_crypt = B_FALSE;

	ASSERT((HDR_GET_COMPRESS(hdr) != ZIO_COMPRESS_OFF &&
	!HDR_COMPRESSION_ENABLED(hdr)) \|\|
	HDR_ENCRYPTED(hdr) \|\| HDR_SHARED_DATA(hdr) \|\| psize != asize);
	ASSERT3U(psize, <=, asize);

	/*
	* If this data simply needs its own buffer, we simply allocate it
	* and copy the data. This may be done to eliminate a dependency on a
	* shared buffer or to reallocate the buffer to match asize.
	*/
	if (HDR_HAS_RABD(hdr) && asize != psize) {
	ASSERT3U(asize, >=, psize);
	to_write = abd_alloc_for_io(asize, ismd);
	abd_copy(to_write, hdr->b_crypt_hdr.b_rabd, psize);
	if (psize != asize)
	abd_zero_off(to_write, psize, asize - psize);
	goto out;
	}

	if ((compress == ZIO_COMPRESS_OFF \|\| HDR_COMPRESSION_ENABLED(hdr)) &&
	!HDR_ENCRYPTED(hdr)) {
	ASSERT3U(size, ==, psize);
	to_write = abd_alloc_for_io(asize, ismd);
	abd_copy(to_write, hdr->b_l1hdr.b_pabd, size);
	if (size != asize)
	abd_zero_off(to_write, size, asize - size);
	goto out;
	}

	if (compress != ZIO_COMPRESS_OFF && !HDR_COMPRESSION_ENABLED(hdr)) {
	cabd = abd_alloc_for_io(asize, ismd);
	tmp = abd_borrow_buf(cabd, asize);

	psize = zio_compress_data(compress, to_write, tmp, size,
	hdr->b_complevel);

	if (psize >= size) {
	abd_return_buf(cabd, tmp, asize);
	HDR_SET_COMPRESS(hdr, ZIO_COMPRESS_OFF);
	to_write = cabd;
	abd_copy(to_write, hdr->b_l1hdr.b_pabd, size);
	if (size != asize)
	abd_zero_off(to_write, size, asize - size);
	goto encrypt;
	}
	ASSERT3U(psize, <=, HDR_GET_PSIZE(hdr));
	if (psize < asize)
	bzero((char *)tmp + psize, asize - psize);
	psize = HDR_GET_PSIZE(hdr);
	abd_return_buf_copy(cabd, tmp, asize);
	to_write = cabd;
	}

	encrypt:
	if (HDR_ENCRYPTED(hdr)) {
	eabd = abd_alloc_for_io(asize, ismd);

	/*
	* If the dataset was disowned before the buffer
	* made it to this point, the key to re-encrypt
	* it won't be available. In this case we simply
	* won't write the buffer to the L2ARC.
	*/
	ret = spa_keystore_lookup_key(spa, hdr->b_crypt_hdr.b_dsobj,
	FTAG, &dck);
	if (ret != 0)
	goto error;

	ret = zio_do_crypt_abd(B_TRUE, &dck->dck_key,
	hdr->b_crypt_hdr.b_ot, bswap, hdr->b_crypt_hdr.b_salt,
	hdr->b_crypt_hdr.b_iv, mac, psize, to_write, eabd,
	&no_crypt);
	if (ret != 0)
	goto error;

	if (no_crypt)
	abd_copy(eabd, to_write, psize);

	if (psize != asize)
	abd_zero_off(eabd, psize, asize - psize);

	/* assert that the MAC we got here matches the one we saved */
	ASSERT0(bcmp(mac, hdr->b_crypt_hdr.b_mac, ZIO_DATA_MAC_LEN));
	spa_keystore_dsl_key_rele(spa, dck, FTAG);

	if (to_write == cabd)
	abd_free(cabd);

	to_write = eabd;
	}

	out:
	ASSERT3P(to_write, !=, hdr->b_l1hdr.b_pabd);
	*abd_out = to_write;
	return (0);

	error:
	if (dck != NULL)
	spa_keystore_dsl_key_rele(spa, dck, FTAG);
	if (cabd != NULL)
	abd_free(cabd);
	if (eabd != NULL)
	abd_free(eabd);

	*abd_out = NULL;
	return (ret);
	}

	static void
	l2arc_blk_fetch_done(zio_t *zio)
	{
	l2arc_read_callback_t *cb;

	cb = zio->io_private;
	if (cb->l2rcb_abd != NULL)
	abd_put(cb->l2rcb_abd);
	kmem_free(cb, sizeof (l2arc_read_callback_t));
	}

	/*
	* Find and write ARC buffers to the L2ARC device.
	*
	* An ARC_FLAG_L2_WRITING flag is set so that the L2ARC buffers are not valid
	* for reading until they have completed writing.
	* The headroom_boost is an in-out parameter used to maintain headroom boost
	* state between calls to this function.
	*
	* Returns the number of bytes actually written (which may be smaller than
	* the delta by which the device hand has changed due to alignment and the
	* writing of log blocks).
	*/
	static uint64_t
	l2arc_write_buffers(spa_t spa, l2arc_dev_t dev, uint64_t target_sz)
	{
	arc_buf_hdr_t hdr, hdr_prev, *head;
	uint64_t write_asize, write_psize, write_lsize, headroom;
	boolean_t full;
	l2arc_write_callback_t *cb = NULL;
	zio_t pio, wzio;
	uint64_t guid = spa_load_guid(spa);

	ASSERT3P(dev->l2ad_vdev, !=, NULL);

	pio = NULL;
	write_lsize = write_asize = write_psize = 0;
	full = B_FALSE;
	head = kmem_cache_alloc(hdr_l2only_cache, KM_PUSHPAGE);
	arc_hdr_set_flags(head, ARC_FLAG_L2_WRITE_HEAD \| ARC_FLAG_HAS_L2HDR);

	/*
	* Copy buffers for L2ARC writing.
	*/
	for (int try = 0; try < L2ARC_FEED_TYPES; try++) {
	+ /*
	+ * If try == 1 or 3, we cache MRU metadata and data
	+ * respectively.
	+ */
	+ if (l2arc_mfuonly) {
	+ if (try == 1 \|\| try == 3)
	+ continue;
	+ }
	+
	multilist_sublist_t *mls = l2arc_sublist_lock(try);
	uint64_t passed_sz = 0;

	VERIFY3P(mls, !=, NULL);

	/*
	* L2ARC fast warmup.
	*
	* Until the ARC is warm and starts to evict, read from the
	* head of the ARC lists rather than the tail.
	*/
	if (arc_warm == B_FALSE)
	hdr = multilist_sublist_head(mls);
	else
	hdr = multilist_sublist_tail(mls);

	headroom = target_sz * l2arc_headroom;
	if (zfs_compressed_arc_enabled)
	headroom = (headroom * l2arc_headroom_boost) / 100;

	for (; hdr; hdr = hdr_prev) {
	kmutex_t *hash_lock;
	abd_t *to_write = NULL;

	if (arc_warm == B_FALSE)
	hdr_prev = multilist_sublist_next(mls, hdr);
	else
	hdr_prev = multilist_sublist_prev(mls, hdr);

	hash_lock = HDR_LOCK(hdr);
	if (!mutex_tryenter(hash_lock)) {
	/*
	* Skip this buffer rather than waiting.
	*/
	continue;
	}

	passed_sz += HDR_GET_LSIZE(hdr);
	if (l2arc_headroom != 0 && passed_sz > headroom) {
	/*
	* Searched too far.
	*/
	mutex_exit(hash_lock);
	break;
	}

	if (!l2arc_write_eligible(guid, hdr)) {
	mutex_exit(hash_lock);
	continue;
	}

	/*
	* We rely on the L1 portion of the header below, so
	* it's invalid for this header to have been evicted out
	* of the ghost cache, prior to being written out. The
	* ARC_FLAG_L2_WRITING bit ensures this won't happen.
	*/
	ASSERT(HDR_HAS_L1HDR(hdr));

	ASSERT3U(HDR_GET_PSIZE(hdr), >, 0);
	ASSERT3U(arc_hdr_size(hdr), >, 0);
	ASSERT(hdr->b_l1hdr.b_pabd != NULL \|\|
	HDR_HAS_RABD(hdr));
	uint64_t psize = HDR_GET_PSIZE(hdr);
	uint64_t asize = vdev_psize_to_asize(dev->l2ad_vdev,
	psize);

	if ((write_asize + asize) > target_sz) {
	full = B_TRUE;
	mutex_exit(hash_lock);
	break;
	}

	/*
	* We rely on the L1 portion of the header below, so
	* it's invalid for this header to have been evicted out
	* of the ghost cache, prior to being written out. The
	* ARC_FLAG_L2_WRITING bit ensures this won't happen.
	*/
	arc_hdr_set_flags(hdr, ARC_FLAG_L2_WRITING);
	ASSERT(HDR_HAS_L1HDR(hdr));

	ASSERT3U(HDR_GET_PSIZE(hdr), >, 0);
	ASSERT(hdr->b_l1hdr.b_pabd != NULL \|\|
	HDR_HAS_RABD(hdr));
	ASSERT3U(arc_hdr_size(hdr), >, 0);

	/*
	* If this header has b_rabd, we can use this since it
	* must always match the data exactly as it exists on
	* disk. Otherwise, the L2ARC can normally use the
	* hdr's data, but if we're sharing data between the
	* hdr and one of its bufs, L2ARC needs its own copy of
	* the data so that the ZIO below can't race with the
	* buf consumer. To ensure that this copy will be
	* available for the lifetime of the ZIO and be cleaned
	* up afterwards, we add it to the l2arc_free_on_write
	* queue. If we need to apply any transforms to the
	* data (compression, encryption) we will also need the
	* extra buffer.
	*/
	if (HDR_HAS_RABD(hdr) && psize == asize) {
	to_write = hdr->b_crypt_hdr.b_rabd;
	} else if ((HDR_COMPRESSION_ENABLED(hdr) \|\|
	HDR_GET_COMPRESS(hdr) == ZIO_COMPRESS_OFF) &&
	!HDR_ENCRYPTED(hdr) && !HDR_SHARED_DATA(hdr) &&
	psize == asize) {
	to_write = hdr->b_l1hdr.b_pabd;
	} else {
	int ret;
	arc_buf_contents_t type = arc_buf_type(hdr);

	ret = l2arc_apply_transforms(spa, hdr, asize,
	&to_write);
	if (ret != 0) {
	arc_hdr_clear_flags(hdr,
	ARC_FLAG_L2_WRITING);
	mutex_exit(hash_lock);
	continue;
	}

	l2arc_free_abd_on_write(to_write, asize, type);
	}

	if (pio == NULL) {
	/*
	* Insert a dummy header on the buflist so
	* l2arc_write_done() can find where the
	* write buffers begin without searching.
	*/
	mutex_enter(&dev->l2ad_mtx);
	list_insert_head(&dev->l2ad_buflist, head);
	mutex_exit(&dev->l2ad_mtx);

	cb = kmem_alloc(
	sizeof (l2arc_write_callback_t), KM_SLEEP);
	cb->l2wcb_dev = dev;
	cb->l2wcb_head = head;
	/*
	* Create a list to save allocated abd buffers
	* for l2arc_log_blk_commit().
	*/
	list_create(&cb->l2wcb_abd_list,
	sizeof (l2arc_lb_abd_buf_t),
	offsetof(l2arc_lb_abd_buf_t, node));
	pio = zio_root(spa, l2arc_write_done, cb,
	ZIO_FLAG_CANFAIL);
	}

	hdr->b_l2hdr.b_dev = dev;
	hdr->b_l2hdr.b_hits = 0;

	hdr->b_l2hdr.b_daddr = dev->l2ad_hand;
	arc_hdr_set_flags(hdr, ARC_FLAG_HAS_L2HDR);

	mutex_enter(&dev->l2ad_mtx);
	list_insert_head(&dev->l2ad_buflist, hdr);
	mutex_exit(&dev->l2ad_mtx);

	(void) zfs_refcount_add_many(&dev->l2ad_alloc,
	arc_hdr_size(hdr), hdr);

	wzio = zio_write_phys(pio, dev->l2ad_vdev,
	hdr->b_l2hdr.b_daddr, asize, to_write,
	ZIO_CHECKSUM_OFF, NULL, hdr,
	ZIO_PRIORITY_ASYNC_WRITE,
	ZIO_FLAG_CANFAIL, B_FALSE);

	write_lsize += HDR_GET_LSIZE(hdr);
	DTRACE_PROBE2(l2arc__write, vdev_t *, dev->l2ad_vdev,
	zio_t *, wzio);

	write_psize += psize;
	write_asize += asize;
	dev->l2ad_hand += asize;
	vdev_space_update(dev->l2ad_vdev, asize, 0, 0);

	mutex_exit(hash_lock);

	/*
	* Append buf info to current log and commit if full.
	* arcstat_l2_{size,asize} kstats are updated
	* internally.
	*/
	if (l2arc_log_blk_insert(dev, hdr))
	l2arc_log_blk_commit(dev, pio, cb);

	zio_nowait(wzio);
	}

	multilist_sublist_unlock(mls);

	if (full == B_TRUE)
	break;
	}

	/* No buffers selected for writing? */
	if (pio == NULL) {
	ASSERT0(write_lsize);
	ASSERT(!HDR_HAS_L1HDR(head));
	kmem_cache_free(hdr_l2only_cache, head);

	/*
	* Although we did not write any buffers l2ad_evict may
	* have advanced.
	*/
	l2arc_dev_hdr_update(dev);

	return (0);
	}

	if (!dev->l2ad_first)
	ASSERT3U(dev->l2ad_hand, <=, dev->l2ad_evict);

	ASSERT3U(write_asize, <=, target_sz);
	ARCSTAT_BUMP(arcstat_l2_writes_sent);
	ARCSTAT_INCR(arcstat_l2_write_bytes, write_psize);
	ARCSTAT_INCR(arcstat_l2_lsize, write_lsize);
	ARCSTAT_INCR(arcstat_l2_psize, write_psize);

	dev->l2ad_writing = B_TRUE;
	(void) zio_wait(pio);
	dev->l2ad_writing = B_FALSE;

	/*
	* Update the device header after the zio completes as
	* l2arc_write_done() may have updated the memory holding the log block
	* pointers in the device header.
	*/
	l2arc_dev_hdr_update(dev);

	return (write_asize);
	}

	static boolean_t
	l2arc_hdr_limit_reached(void)
	{
	int64_t s = aggsum_upper_bound(&astat_l2_hdr_size);

	return (arc_reclaim_needed() \|\| (s > arc_meta_limit * 3 / 4) \|\|
	(s > (arc_warm ? arc_c : arc_c_max) * l2arc_meta_percent / 100));
	}

	/*
	* This thread feeds the L2ARC at regular intervals. This is the beating
	* heart of the L2ARC.
	*/
	/* ARGSUSED */
	static void
	l2arc_feed_thread(void *unused)
	{
	callb_cpr_t cpr;
	l2arc_dev_t *dev;
	spa_t *spa;
	uint64_t size, wrote;
	clock_t begin, next = ddi_get_lbolt();
	fstrans_cookie_t cookie;

	CALLB_CPR_INIT(&cpr, &l2arc_feed_thr_lock, callb_generic_cpr, FTAG);

	mutex_enter(&l2arc_feed_thr_lock);

	cookie = spl_fstrans_mark();
	while (l2arc_thread_exit == 0) {
	CALLB_CPR_SAFE_BEGIN(&cpr);
	- (void) cv_timedwait_sig(&l2arc_feed_thr_cv,
	+ (void) cv_timedwait_idle(&l2arc_feed_thr_cv,
	&l2arc_feed_thr_lock, next);
	CALLB_CPR_SAFE_END(&cpr, &l2arc_feed_thr_lock);
	next = ddi_get_lbolt() + hz;

	/*
	* Quick check for L2ARC devices.
	*/
	mutex_enter(&l2arc_dev_mtx);
	if (l2arc_ndev == 0) {
	mutex_exit(&l2arc_dev_mtx);
	continue;
	}
	mutex_exit(&l2arc_dev_mtx);
	begin = ddi_get_lbolt();

	/*
	* This selects the next l2arc device to write to, and in
	* doing so the next spa to feed from: dev->l2ad_spa. This
	* will return NULL if there are now no l2arc devices or if
	* they are all faulted.
	*
	* If a device is returned, its spa's config lock is also
	* held to prevent device removal. l2arc_dev_get_next()
	* will grab and release l2arc_dev_mtx.
	*/
	if ((dev = l2arc_dev_get_next()) == NULL)
	continue;

	spa = dev->l2ad_spa;
	ASSERT3P(spa, !=, NULL);

	/*
	* If the pool is read-only then force the feed thread to
	* sleep a little longer.
	*/
	if (!spa_writeable(spa)) {
	next = ddi_get_lbolt() + 5 * l2arc_feed_secs * hz;
	spa_config_exit(spa, SCL_L2ARC, dev);
	continue;
	}

	/*
	* Avoid contributing to memory pressure.
	*/
	if (l2arc_hdr_limit_reached()) {
	ARCSTAT_BUMP(arcstat_l2_abort_lowmem);
	spa_config_exit(spa, SCL_L2ARC, dev);
	continue;
	}

	ARCSTAT_BUMP(arcstat_l2_feeds);

	size = l2arc_write_size(dev);

	/*
	* Evict L2ARC buffers that will be overwritten.
	*/
	l2arc_evict(dev, size, B_FALSE);

	/*
	* Write ARC buffers.
	*/
	wrote = l2arc_write_buffers(spa, dev, size);

	/*
	* Calculate interval between writes.
	*/
	next = l2arc_write_interval(begin, size, wrote);
	spa_config_exit(spa, SCL_L2ARC, dev);
	}
	spl_fstrans_unmark(cookie);

	l2arc_thread_exit = 0;
	cv_broadcast(&l2arc_feed_thr_cv);
	CALLB_CPR_EXIT(&cpr); /* drops l2arc_feed_thr_lock */
	thread_exit();
	}

	boolean_t
	l2arc_vdev_present(vdev_t *vd)
	{
	return (l2arc_vdev_get(vd) != NULL);
	}

	/*
	* Returns the l2arc_dev_t associated with a particular vdev_t or NULL if
	* the vdev_t isn't an L2ARC device.
	*/
	l2arc_dev_t *
	l2arc_vdev_get(vdev_t *vd)
	{
	l2arc_dev_t *dev;

	mutex_enter(&l2arc_dev_mtx);
	for (dev = list_head(l2arc_dev_list); dev != NULL;
	dev = list_next(l2arc_dev_list, dev)) {
	if (dev->l2ad_vdev == vd)
	break;
	}
	mutex_exit(&l2arc_dev_mtx);

	return (dev);
	}

	/*
	* Add a vdev for use by the L2ARC. By this point the spa has already
	* validated the vdev and opened it.
	*/
	void
	l2arc_add_vdev(spa_t spa, vdev_t vd)
	{
	l2arc_dev_t *adddev;
	uint64_t l2dhdr_asize;

	ASSERT(!l2arc_vdev_present(vd));

	- vdev_ashift_optimize(vd);
	-
	/*
	* Create a new l2arc device entry.
	*/
	adddev = vmem_zalloc(sizeof (l2arc_dev_t), KM_SLEEP);
	adddev->l2ad_spa = spa;
	adddev->l2ad_vdev = vd;
	/* leave extra size for an l2arc device header */
	l2dhdr_asize = adddev->l2ad_dev_hdr_asize =
	MAX(sizeof (*adddev->l2ad_dev_hdr), 1 << vd->vdev_ashift);
	adddev->l2ad_start = VDEV_LABEL_START_SIZE + l2dhdr_asize;
	adddev->l2ad_end = VDEV_LABEL_START_SIZE + vdev_get_min_asize(vd);
	ASSERT3U(adddev->l2ad_start, <, adddev->l2ad_end);
	adddev->l2ad_hand = adddev->l2ad_start;
	adddev->l2ad_evict = adddev->l2ad_start;
	adddev->l2ad_first = B_TRUE;
	adddev->l2ad_writing = B_FALSE;
	adddev->l2ad_trim_all = B_FALSE;
	list_link_init(&adddev->l2ad_node);
	adddev->l2ad_dev_hdr = kmem_zalloc(l2dhdr_asize, KM_SLEEP);

	mutex_init(&adddev->l2ad_mtx, NULL, MUTEX_DEFAULT, NULL);
	/*
	* This is a list of all ARC buffers that are still valid on the
	* device.
	*/
	list_create(&adddev->l2ad_buflist, sizeof (arc_buf_hdr_t),
	offsetof(arc_buf_hdr_t, b_l2hdr.b_l2node));

	/*
	* This is a list of pointers to log blocks that are still present
	* on the device.
	*/
	list_create(&adddev->l2ad_lbptr_list, sizeof (l2arc_lb_ptr_buf_t),
	offsetof(l2arc_lb_ptr_buf_t, node));

	vdev_space_update(vd, 0, 0, adddev->l2ad_end - adddev->l2ad_hand);
	zfs_refcount_create(&adddev->l2ad_alloc);
	zfs_refcount_create(&adddev->l2ad_lb_asize);
	zfs_refcount_create(&adddev->l2ad_lb_count);

	/*
	* Add device to global list
	*/
	mutex_enter(&l2arc_dev_mtx);
	list_insert_head(l2arc_dev_list, adddev);
	atomic_inc_64(&l2arc_ndev);
	mutex_exit(&l2arc_dev_mtx);

	/*
	* Decide if vdev is eligible for L2ARC rebuild
	*/
	l2arc_rebuild_vdev(adddev->l2ad_vdev, B_FALSE);
	}

	void
	l2arc_rebuild_vdev(vdev_t *vd, boolean_t reopen)
	{
	l2arc_dev_t *dev = NULL;
	l2arc_dev_hdr_phys_t *l2dhdr;
	uint64_t l2dhdr_asize;
	spa_t *spa;
	int err;
	boolean_t l2dhdr_valid = B_TRUE;

	dev = l2arc_vdev_get(vd);
	ASSERT3P(dev, !=, NULL);
	spa = dev->l2ad_spa;
	l2dhdr = dev->l2ad_dev_hdr;
	l2dhdr_asize = dev->l2ad_dev_hdr_asize;

	/*
	* The L2ARC has to hold at least the payload of one log block for
	* them to be restored (persistent L2ARC). The payload of a log block
	* depends on the amount of its log entries. We always write log blocks
	* with 1022 entries. How many of them are committed or restored depends
	* on the size of the L2ARC device. Thus the maximum payload of
	* one log block is 1022 * SPA_MAXBLOCKSIZE = 16GB. If the L2ARC device
	* is less than that, we reduce the amount of committed and restored
	* log entries per block so as to enable persistence.
	*/
	if (dev->l2ad_end < l2arc_rebuild_blocks_min_l2size) {
	dev->l2ad_log_entries = 0;
	} else {
	dev->l2ad_log_entries = MIN((dev->l2ad_end -
	dev->l2ad_start) >> SPA_MAXBLOCKSHIFT,
	L2ARC_LOG_BLK_MAX_ENTRIES);
	}

	/*
	* Read the device header, if an error is returned do not rebuild L2ARC.
	*/
	if ((err = l2arc_dev_hdr_read(dev)) != 0)
	l2dhdr_valid = B_FALSE;

	if (l2dhdr_valid && dev->l2ad_log_entries > 0) {
	/*
	* If we are onlining a cache device (vdev_reopen) that was
	* still present (l2arc_vdev_present()) and rebuild is enabled,
	* we should evict all ARC buffers and pointers to log blocks
	* and reclaim their space before restoring its contents to
	* L2ARC.
	*/
	if (reopen) {
	if (!l2arc_rebuild_enabled) {
	return;
	} else {
	l2arc_evict(dev, 0, B_TRUE);
	/* start a new log block */
	dev->l2ad_log_ent_idx = 0;
	dev->l2ad_log_blk_payload_asize = 0;
	dev->l2ad_log_blk_payload_start = 0;
	}
	}
	/*
	* Just mark the device as pending for a rebuild. We won't
	* be starting a rebuild in line here as it would block pool
	* import. Instead spa_load_impl will hand that off to an
	* async task which will call l2arc_spa_rebuild_start.
	*/
	dev->l2ad_rebuild = B_TRUE;
	} else if (spa_writeable(spa)) {
	/*
	* In this case TRIM the whole device if l2arc_trim_ahead > 0,
	* otherwise create a new header. We zero out the memory holding
	* the header to reset dh_start_lbps. If we TRIM the whole
	* device the new header will be written by
	* vdev_trim_l2arc_thread() at the end of the TRIM to update the
	* trim_state in the header too. When reading the header, if
	* trim_state is not VDEV_TRIM_COMPLETE and l2arc_trim_ahead > 0
	* we opt to TRIM the whole device again.
	*/
	if (l2arc_trim_ahead > 0) {
	dev->l2ad_trim_all = B_TRUE;
	} else {
	bzero(l2dhdr, l2dhdr_asize);
	l2arc_dev_hdr_update(dev);
	}
	}
	}

	/*
	* Remove a vdev from the L2ARC.
	*/
	void
	l2arc_remove_vdev(vdev_t *vd)
	{
	l2arc_dev_t *remdev = NULL;

	/*
	* Find the device by vdev
	*/
	remdev = l2arc_vdev_get(vd);
	ASSERT3P(remdev, !=, NULL);

	/*
	* Cancel any ongoing or scheduled rebuild.
	*/
	mutex_enter(&l2arc_rebuild_thr_lock);
	if (remdev->l2ad_rebuild_began == B_TRUE) {
	remdev->l2ad_rebuild_cancel = B_TRUE;
	while (remdev->l2ad_rebuild == B_TRUE)
	cv_wait(&l2arc_rebuild_thr_cv, &l2arc_rebuild_thr_lock);
	}
	mutex_exit(&l2arc_rebuild_thr_lock);

	/*
	* Remove device from global list
	*/
	mutex_enter(&l2arc_dev_mtx);
	list_remove(l2arc_dev_list, remdev);
	l2arc_dev_last = NULL; /* may have been invalidated */
	atomic_dec_64(&l2arc_ndev);
	mutex_exit(&l2arc_dev_mtx);

	/*
	* Clear all buflists and ARC references. L2ARC device flush.
	*/
	l2arc_evict(remdev, 0, B_TRUE);
	list_destroy(&remdev->l2ad_buflist);
	ASSERT(list_is_empty(&remdev->l2ad_lbptr_list));
	list_destroy(&remdev->l2ad_lbptr_list);
	mutex_destroy(&remdev->l2ad_mtx);
	zfs_refcount_destroy(&remdev->l2ad_alloc);
	zfs_refcount_destroy(&remdev->l2ad_lb_asize);
	zfs_refcount_destroy(&remdev->l2ad_lb_count);
	kmem_free(remdev->l2ad_dev_hdr, remdev->l2ad_dev_hdr_asize);
	vmem_free(remdev, sizeof (l2arc_dev_t));
	}

	void
	l2arc_init(void)
	{
	l2arc_thread_exit = 0;
	l2arc_ndev = 0;
	l2arc_writes_sent = 0;
	l2arc_writes_done = 0;

	mutex_init(&l2arc_feed_thr_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&l2arc_feed_thr_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&l2arc_rebuild_thr_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&l2arc_rebuild_thr_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&l2arc_dev_mtx, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&l2arc_free_on_write_mtx, NULL, MUTEX_DEFAULT, NULL);

	l2arc_dev_list = &L2ARC_dev_list;
	l2arc_free_on_write = &L2ARC_free_on_write;
	list_create(l2arc_dev_list, sizeof (l2arc_dev_t),
	offsetof(l2arc_dev_t, l2ad_node));
	list_create(l2arc_free_on_write, sizeof (l2arc_data_free_t),
	offsetof(l2arc_data_free_t, l2df_list_node));
	}

	void
	l2arc_fini(void)
	{
	mutex_destroy(&l2arc_feed_thr_lock);
	cv_destroy(&l2arc_feed_thr_cv);
	mutex_destroy(&l2arc_rebuild_thr_lock);
	cv_destroy(&l2arc_rebuild_thr_cv);
	mutex_destroy(&l2arc_dev_mtx);
	mutex_destroy(&l2arc_free_on_write_mtx);

	list_destroy(l2arc_dev_list);
	list_destroy(l2arc_free_on_write);
	}

	void
	l2arc_start(void)
	{
	if (!(spa_mode_global & SPA_MODE_WRITE))
	return;

	(void) thread_create(NULL, 0, l2arc_feed_thread, NULL, 0, &p0,
	TS_RUN, defclsyspri);
	}

	void
	l2arc_stop(void)
	{
	if (!(spa_mode_global & SPA_MODE_WRITE))
	return;

	mutex_enter(&l2arc_feed_thr_lock);
	cv_signal(&l2arc_feed_thr_cv); /* kick thread out of startup */
	l2arc_thread_exit = 1;
	while (l2arc_thread_exit != 0)
	cv_wait(&l2arc_feed_thr_cv, &l2arc_feed_thr_lock);
	mutex_exit(&l2arc_feed_thr_lock);
	}

	/*
	* Punches out rebuild threads for the L2ARC devices in a spa. This should
	* be called after pool import from the spa async thread, since starting
	* these threads directly from spa_import() will make them part of the
	* "zpool import" context and delay process exit (and thus pool import).
	*/
	void
	l2arc_spa_rebuild_start(spa_t *spa)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	/*
	* Locate the spa's l2arc devices and kick off rebuild threads.
	*/
	for (int i = 0; i < spa->spa_l2cache.sav_count; i++) {
	l2arc_dev_t *dev =
	l2arc_vdev_get(spa->spa_l2cache.sav_vdevs[i]);
	if (dev == NULL) {
	/* Don't attempt a rebuild if the vdev is UNAVAIL */
	continue;
	}
	mutex_enter(&l2arc_rebuild_thr_lock);
	if (dev->l2ad_rebuild && !dev->l2ad_rebuild_cancel) {
	dev->l2ad_rebuild_began = B_TRUE;
	(void) thread_create(NULL, 0, l2arc_dev_rebuild_thread,
	dev, 0, &p0, TS_RUN, minclsyspri);
	}
	mutex_exit(&l2arc_rebuild_thr_lock);
	}
	}

	/*
	* Main entry point for L2ARC rebuilding.
	*/
	static void
	l2arc_dev_rebuild_thread(void *arg)
	{
	l2arc_dev_t *dev = arg;

	VERIFY(!dev->l2ad_rebuild_cancel);
	VERIFY(dev->l2ad_rebuild);
	(void) l2arc_rebuild(dev);
	mutex_enter(&l2arc_rebuild_thr_lock);
	dev->l2ad_rebuild_began = B_FALSE;
	dev->l2ad_rebuild = B_FALSE;
	mutex_exit(&l2arc_rebuild_thr_lock);

	thread_exit();
	}

	/*
	* This function implements the actual L2ARC metadata rebuild. It:
	* starts reading the log block chain and restores each block's contents
	* to memory (reconstructing arc_buf_hdr_t's).
	*
	* Operation stops under any of the following conditions:
	*
	* 1) We reach the end of the log block chain.
	* 2) We encounter any error condition (cksum errors, io errors)
	*/
	static int
	l2arc_rebuild(l2arc_dev_t *dev)
	{
	vdev_t *vd = dev->l2ad_vdev;
	spa_t *spa = vd->vdev_spa;
	int err = 0;
	l2arc_dev_hdr_phys_t *l2dhdr = dev->l2ad_dev_hdr;
	l2arc_log_blk_phys_t this_lb, next_lb;
	zio_t this_io = NULL, next_io = NULL;
	l2arc_log_blkptr_t lbps[2];
	l2arc_lb_ptr_buf_t *lb_ptr_buf;
	boolean_t lock_held;

	this_lb = vmem_zalloc(sizeof (*this_lb), KM_SLEEP);
	next_lb = vmem_zalloc(sizeof (*next_lb), KM_SLEEP);

	/*
	* We prevent device removal while issuing reads to the device,
	* then during the rebuilding phases we drop this lock again so
	* that a spa_unload or device remove can be initiated - this is
	* safe, because the spa will signal us to stop before removing
	* our device and wait for us to stop.
	*/
	spa_config_enter(spa, SCL_L2ARC, vd, RW_READER);
	lock_held = B_TRUE;

	/*
	* Retrieve the persistent L2ARC device state.
	* L2BLK_GET_PSIZE returns aligned size for log blocks.
	*/
	dev->l2ad_evict = MAX(l2dhdr->dh_evict, dev->l2ad_start);
	dev->l2ad_hand = MAX(l2dhdr->dh_start_lbps[0].lbp_daddr +
	L2BLK_GET_PSIZE((&l2dhdr->dh_start_lbps[0])->lbp_prop),
	dev->l2ad_start);
	dev->l2ad_first = !!(l2dhdr->dh_flags & L2ARC_DEV_HDR_EVICT_FIRST);

	vd->vdev_trim_action_time = l2dhdr->dh_trim_action_time;
	vd->vdev_trim_state = l2dhdr->dh_trim_state;

	/*
	* In case the zfs module parameter l2arc_rebuild_enabled is false
	* we do not start the rebuild process.
	*/
	if (!l2arc_rebuild_enabled)
	goto out;

	/* Prepare the rebuild process */
	bcopy(l2dhdr->dh_start_lbps, lbps, sizeof (lbps));

	/* Start the rebuild process */
	for (;;) {
	if (!l2arc_log_blkptr_valid(dev, &lbps[0]))
	break;

	if ((err = l2arc_log_blk_read(dev, &lbps[0], &lbps[1],
	this_lb, next_lb, this_io, &next_io)) != 0)
	goto out;

	/*
	* Our memory pressure valve. If the system is running low
	* on memory, rather than swamping memory with new ARC buf
	* hdrs, we opt not to rebuild the L2ARC. At this point,
	* however, we have already set up our L2ARC dev to chain in
	* new metadata log blocks, so the user may choose to offline/
	* online the L2ARC dev at a later time (or re-import the pool)
	* to reconstruct it (when there's less memory pressure).
	*/
	if (l2arc_hdr_limit_reached()) {
	ARCSTAT_BUMP(arcstat_l2_rebuild_abort_lowmem);
	cmn_err(CE_NOTE, "System running low on memory, "
	"aborting L2ARC rebuild.");
	err = SET_ERROR(ENOMEM);
	goto out;
	}

	spa_config_exit(spa, SCL_L2ARC, vd);
	lock_held = B_FALSE;

	/*
	* Now that we know that the next_lb checks out alright, we
	* can start reconstruction from this log block.
	* L2BLK_GET_PSIZE returns aligned size for log blocks.
	*/
	uint64_t asize = L2BLK_GET_PSIZE((&lbps[0])->lbp_prop);
	l2arc_log_blk_restore(dev, this_lb, asize, lbps[0].lbp_daddr);

	/*
	* log block restored, include its pointer in the list of
	* pointers to log blocks present in the L2ARC device.
	*/
	lb_ptr_buf = kmem_zalloc(sizeof (l2arc_lb_ptr_buf_t), KM_SLEEP);
	lb_ptr_buf->lb_ptr = kmem_zalloc(sizeof (l2arc_log_blkptr_t),
	KM_SLEEP);
	bcopy(&lbps[0], lb_ptr_buf->lb_ptr,
	sizeof (l2arc_log_blkptr_t));
	mutex_enter(&dev->l2ad_mtx);
	list_insert_tail(&dev->l2ad_lbptr_list, lb_ptr_buf);
	ARCSTAT_INCR(arcstat_l2_log_blk_asize, asize);
	ARCSTAT_BUMP(arcstat_l2_log_blk_count);
	zfs_refcount_add_many(&dev->l2ad_lb_asize, asize, lb_ptr_buf);
	zfs_refcount_add(&dev->l2ad_lb_count, lb_ptr_buf);
	mutex_exit(&dev->l2ad_mtx);
	vdev_space_update(vd, asize, 0, 0);

	/*
	* Protection against loops of log blocks:
	*
	* l2ad_hand l2ad_evict
	* V V
	* l2ad_start \|=======================================\| l2ad_end
	* -----\|\|\|----\|\|\|---\|\|\|----\|\|\|
	* (3) (2) (1) (0)
	* ---\|\|\|---\|\|\|----\|\|\|---\|\|\|
	* (7) (6) (5) (4)
	*
	* In this situation the pointer of log block (4) passes
	* l2arc_log_blkptr_valid() but the log block should not be
	* restored as it is overwritten by the payload of log block
	* (0). Only log blocks (0)-(3) should be restored. We check
	* whether l2ad_evict lies in between the payload starting
	* offset of the next log block (lbps[1].lbp_payload_start)
	* and the payload starting offset of the present log block
	* (lbps[0].lbp_payload_start). If true and this isn't the
	* first pass, we are looping from the beginning and we should
	* stop.
	*/
	if (l2arc_range_check_overlap(lbps[1].lbp_payload_start,
	lbps[0].lbp_payload_start, dev->l2ad_evict) &&
	!dev->l2ad_first)
	goto out;

	for (;;) {
	mutex_enter(&l2arc_rebuild_thr_lock);
	if (dev->l2ad_rebuild_cancel) {
	dev->l2ad_rebuild = B_FALSE;
	cv_signal(&l2arc_rebuild_thr_cv);
	mutex_exit(&l2arc_rebuild_thr_lock);
	err = SET_ERROR(ECANCELED);
	goto out;
	}
	mutex_exit(&l2arc_rebuild_thr_lock);
	if (spa_config_tryenter(spa, SCL_L2ARC, vd,
	RW_READER)) {
	lock_held = B_TRUE;
	break;
	}
	/*
	* L2ARC config lock held by somebody in writer,
	* possibly due to them trying to remove us. They'll
	* likely to want us to shut down, so after a little
	* delay, we check l2ad_rebuild_cancel and retry
	* the lock again.
	*/
	delay(1);
	}

	/*
	* Continue with the next log block.
	*/
	lbps[0] = lbps[1];
	lbps[1] = this_lb->lb_prev_lbp;
	PTR_SWAP(this_lb, next_lb);
	this_io = next_io;
	next_io = NULL;
	}

	if (this_io != NULL)
	l2arc_log_blk_fetch_abort(this_io);
	out:
	if (next_io != NULL)
	l2arc_log_blk_fetch_abort(next_io);
	vmem_free(this_lb, sizeof (*this_lb));
	vmem_free(next_lb, sizeof (*next_lb));

	if (!l2arc_rebuild_enabled) {
	spa_history_log_internal(spa, "L2ARC rebuild", NULL,
	"disabled");
	} else if (err == 0 && zfs_refcount_count(&dev->l2ad_lb_count) > 0) {
	ARCSTAT_BUMP(arcstat_l2_rebuild_success);
	spa_history_log_internal(spa, "L2ARC rebuild", NULL,
	"successful, restored %llu blocks",
	(u_longlong_t)zfs_refcount_count(&dev->l2ad_lb_count));
	} else if (err == 0 && zfs_refcount_count(&dev->l2ad_lb_count) == 0) {
	/*
	* No error but also nothing restored, meaning the lbps array
	* in the device header points to invalid/non-present log
	* blocks. Reset the header.
	*/
	spa_history_log_internal(spa, "L2ARC rebuild", NULL,
	"no valid log blocks");
	bzero(l2dhdr, dev->l2ad_dev_hdr_asize);
	l2arc_dev_hdr_update(dev);
	} else if (err == ECANCELED) {
	/*
	* In case the rebuild was canceled do not log to spa history
	* log as the pool may be in the process of being removed.
	*/
	zfs_dbgmsg("L2ARC rebuild aborted, restored %llu blocks",
	zfs_refcount_count(&dev->l2ad_lb_count));
	} else if (err != 0) {
	spa_history_log_internal(spa, "L2ARC rebuild", NULL,
	"aborted, restored %llu blocks",
	(u_longlong_t)zfs_refcount_count(&dev->l2ad_lb_count));
	}

	if (lock_held)
	spa_config_exit(spa, SCL_L2ARC, vd);

	return (err);
	}

	/*
	* Attempts to read the device header on the provided L2ARC device and writes
	* it to `hdr'. On success, this function returns 0, otherwise the appropriate
	* error code is returned.
	*/
	static int
	l2arc_dev_hdr_read(l2arc_dev_t *dev)
	{
	int err;
	uint64_t guid;
	l2arc_dev_hdr_phys_t *l2dhdr = dev->l2ad_dev_hdr;
	const uint64_t l2dhdr_asize = dev->l2ad_dev_hdr_asize;
	abd_t *abd;

	guid = spa_guid(dev->l2ad_vdev->vdev_spa);

	abd = abd_get_from_buf(l2dhdr, l2dhdr_asize);

	err = zio_wait(zio_read_phys(NULL, dev->l2ad_vdev,
	VDEV_LABEL_START_SIZE, l2dhdr_asize, abd,
	ZIO_CHECKSUM_LABEL, NULL, NULL, ZIO_PRIORITY_ASYNC_READ,
	ZIO_FLAG_DONT_CACHE \| ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_DONT_PROPAGATE \| ZIO_FLAG_DONT_RETRY \|
	ZIO_FLAG_SPECULATIVE, B_FALSE));

	abd_put(abd);

	if (err != 0) {
	ARCSTAT_BUMP(arcstat_l2_rebuild_abort_dh_errors);
	zfs_dbgmsg("L2ARC IO error (%d) while reading device header, "
	"vdev guid: %llu", err, dev->l2ad_vdev->vdev_guid);
	return (err);
	}

	if (l2dhdr->dh_magic == BSWAP_64(L2ARC_DEV_HDR_MAGIC))
	byteswap_uint64_array(l2dhdr, sizeof (*l2dhdr));

	if (l2dhdr->dh_magic != L2ARC_DEV_HDR_MAGIC \|\|
	l2dhdr->dh_spa_guid != guid \|\|
	l2dhdr->dh_vdev_guid != dev->l2ad_vdev->vdev_guid \|\|
	l2dhdr->dh_version != L2ARC_PERSISTENT_VERSION \|\|
	l2dhdr->dh_log_entries != dev->l2ad_log_entries \|\|
	l2dhdr->dh_end != dev->l2ad_end \|\|
	!l2arc_range_check_overlap(dev->l2ad_start, dev->l2ad_end,
	l2dhdr->dh_evict) \|\|
	(l2dhdr->dh_trim_state != VDEV_TRIM_COMPLETE &&
	l2arc_trim_ahead > 0)) {
	/*
	* Attempt to rebuild a device containing no actual dev hdr
	* or containing a header from some other pool or from another
	* version of persistent L2ARC.
	*/
	ARCSTAT_BUMP(arcstat_l2_rebuild_abort_unsupported);
	return (SET_ERROR(ENOTSUP));
	}

	return (0);
	}

	/*
	* Reads L2ARC log blocks from storage and validates their contents.
	*
	* This function implements a simple fetcher to make sure that while
	* we're processing one buffer the L2ARC is already fetching the next
	* one in the chain.
	*
	* The arguments this_lp and next_lp point to the current and next log block
	* address in the block chain. Similarly, this_lb and next_lb hold the
	* l2arc_log_blk_phys_t's of the current and next L2ARC blk.
	*
	* The `this_io' and `next_io' arguments are used for block fetching.
	* When issuing the first blk IO during rebuild, you should pass NULL for
	* `this_io'. This function will then issue a sync IO to read the block and
	* also issue an async IO to fetch the next block in the block chain. The
	* fetched IO is returned in `next_io'. On subsequent calls to this
	* function, pass the value returned in `next_io' from the previous call
	* as `this_io' and a fresh `next_io' pointer to hold the next fetch IO.
	* Prior to the call, you should initialize your `next_io' pointer to be
	* NULL. If no fetch IO was issued, the pointer is left set at NULL.
	*
	* On success, this function returns 0, otherwise it returns an appropriate
	* error code. On error the fetching IO is aborted and cleared before
	* returning from this function. Therefore, if we return `success', the
	* caller can assume that we have taken care of cleanup of fetch IOs.
	*/
	static int
	l2arc_log_blk_read(l2arc_dev_t *dev,
	const l2arc_log_blkptr_t this_lbp, const l2arc_log_blkptr_t next_lbp,
	l2arc_log_blk_phys_t this_lb, l2arc_log_blk_phys_t next_lb,
	zio_t this_io, zio_t *next_io)
	{
	int err = 0;
	zio_cksum_t cksum;
	abd_t *abd = NULL;
	uint64_t asize;

	ASSERT(this_lbp != NULL && next_lbp != NULL);
	ASSERT(this_lb != NULL && next_lb != NULL);
	ASSERT(next_io != NULL && *next_io == NULL);
	ASSERT(l2arc_log_blkptr_valid(dev, this_lbp));

	/*
	* Check to see if we have issued the IO for this log block in a
	* previous run. If not, this is the first call, so issue it now.
	*/
	if (this_io == NULL) {
	this_io = l2arc_log_blk_fetch(dev->l2ad_vdev, this_lbp,
	this_lb);
	}

	/*
	* Peek to see if we can start issuing the next IO immediately.
	*/
	if (l2arc_log_blkptr_valid(dev, next_lbp)) {
	/*
	* Start issuing IO for the next log block early - this
	* should help keep the L2ARC device busy while we
	* decompress and restore this log block.
	*/
	*next_io = l2arc_log_blk_fetch(dev->l2ad_vdev, next_lbp,
	next_lb);
	}

	/* Wait for the IO to read this log block to complete */
	if ((err = zio_wait(this_io)) != 0) {
	ARCSTAT_BUMP(arcstat_l2_rebuild_abort_io_errors);
	zfs_dbgmsg("L2ARC IO error (%d) while reading log block, "
	"offset: %llu, vdev guid: %llu", err, this_lbp->lbp_daddr,
	dev->l2ad_vdev->vdev_guid);
	goto cleanup;
	}

	/*
	* Make sure the buffer checks out.
	* L2BLK_GET_PSIZE returns aligned size for log blocks.
	*/
	asize = L2BLK_GET_PSIZE((this_lbp)->lbp_prop);
	fletcher_4_native(this_lb, asize, NULL, &cksum);
	if (!ZIO_CHECKSUM_EQUAL(cksum, this_lbp->lbp_cksum)) {
	ARCSTAT_BUMP(arcstat_l2_rebuild_abort_cksum_lb_errors);
	zfs_dbgmsg("L2ARC log block cksum failed, offset: %llu, "
	"vdev guid: %llu, l2ad_hand: %llu, l2ad_evict: %llu",
	this_lbp->lbp_daddr, dev->l2ad_vdev->vdev_guid,
	dev->l2ad_hand, dev->l2ad_evict);
	err = SET_ERROR(ECKSUM);
	goto cleanup;
	}

	/* Now we can take our time decoding this buffer */
	switch (L2BLK_GET_COMPRESS((this_lbp)->lbp_prop)) {
	case ZIO_COMPRESS_OFF:
	break;
	case ZIO_COMPRESS_LZ4:
	abd = abd_alloc_for_io(asize, B_TRUE);
	abd_copy_from_buf_off(abd, this_lb, 0, asize);
	if ((err = zio_decompress_data(
	L2BLK_GET_COMPRESS((this_lbp)->lbp_prop),
	abd, this_lb, asize, sizeof (*this_lb), NULL)) != 0) {
	err = SET_ERROR(EINVAL);
	goto cleanup;
	}
	break;
	default:
	err = SET_ERROR(EINVAL);
	goto cleanup;
	}
	if (this_lb->lb_magic == BSWAP_64(L2ARC_LOG_BLK_MAGIC))
	byteswap_uint64_array(this_lb, sizeof (*this_lb));
	if (this_lb->lb_magic != L2ARC_LOG_BLK_MAGIC) {
	err = SET_ERROR(EINVAL);
	goto cleanup;
	}
	cleanup:
	/* Abort an in-flight fetch I/O in case of error */
	if (err != 0 && *next_io != NULL) {
	l2arc_log_blk_fetch_abort(*next_io);
	*next_io = NULL;
	}
	if (abd != NULL)
	abd_free(abd);
	return (err);
	}

	/*
	* Restores the payload of a log block to ARC. This creates empty ARC hdr
	* entries which only contain an l2arc hdr, essentially restoring the
	* buffers to their L2ARC evicted state. This function also updates space
	* usage on the L2ARC vdev to make sure it tracks restored buffers.
	*/
	static void
	l2arc_log_blk_restore(l2arc_dev_t dev, const l2arc_log_blk_phys_t lb,
	uint64_t lb_asize, uint64_t lb_daddr)
	{
	uint64_t size = 0, asize = 0;
	uint64_t log_entries = dev->l2ad_log_entries;

	/*
	* Usually arc_adapt() is called only for data, not headers, but
	* since we may allocate significant amount of memory here, let ARC
	* grow its arc_c.
	*/
	arc_adapt(log_entries * HDR_L2ONLY_SIZE, arc_l2c_only);

	for (int i = log_entries - 1; i >= 0; i--) {
	/*
	* Restore goes in the reverse temporal direction to preserve
	* correct temporal ordering of buffers in the l2ad_buflist.
	* l2arc_hdr_restore also does a list_insert_tail instead of
	* list_insert_head on the l2ad_buflist:
	*
	* LIST l2ad_buflist LIST
	* HEAD <------ (time) ------ TAIL
	* direction +-----+-----+-----+-----+-----+ direction
	* of l2arc <== \| buf \| buf \| buf \| buf \| buf \| ===> of rebuild
	* fill +-----+-----+-----+-----+-----+
	* ^ ^
	* \| \|
	* \| \|
	* l2arc_feed_thread l2arc_rebuild
	* will place new bufs here restores bufs here
	*
	* During l2arc_rebuild() the device is not used by
	* l2arc_feed_thread() as dev->l2ad_rebuild is set to true.
	*/
	size += L2BLK_GET_LSIZE((&lb->lb_entries[i])->le_prop);
	asize += vdev_psize_to_asize(dev->l2ad_vdev,
	L2BLK_GET_PSIZE((&lb->lb_entries[i])->le_prop));
	l2arc_hdr_restore(&lb->lb_entries[i], dev);
	}

	/*
	* Record rebuild stats:
	* size Logical size of restored buffers in the L2ARC
	* asize Aligned size of restored buffers in the L2ARC
	*/
	ARCSTAT_INCR(arcstat_l2_rebuild_size, size);
	ARCSTAT_INCR(arcstat_l2_rebuild_asize, asize);
	ARCSTAT_INCR(arcstat_l2_rebuild_bufs, log_entries);
	ARCSTAT_F_AVG(arcstat_l2_log_blk_avg_asize, lb_asize);
	ARCSTAT_F_AVG(arcstat_l2_data_to_meta_ratio, asize / lb_asize);
	ARCSTAT_BUMP(arcstat_l2_rebuild_log_blks);
	}

	/*
	* Restores a single ARC buf hdr from a log entry. The ARC buffer is put
	* into a state indicating that it has been evicted to L2ARC.
	*/
	static void
	l2arc_hdr_restore(const l2arc_log_ent_phys_t le, l2arc_dev_t dev)
	{
	arc_buf_hdr_t hdr, exists;
	kmutex_t *hash_lock;
	arc_buf_contents_t type = L2BLK_GET_TYPE((le)->le_prop);
	uint64_t asize;

	/*
	* Do all the allocation before grabbing any locks, this lets us
	* sleep if memory is full and we don't have to deal with failed
	* allocations.
	*/
	hdr = arc_buf_alloc_l2only(L2BLK_GET_LSIZE((le)->le_prop), type,
	dev, le->le_dva, le->le_daddr,
	L2BLK_GET_PSIZE((le)->le_prop), le->le_birth,
	L2BLK_GET_COMPRESS((le)->le_prop), le->le_complevel,
	L2BLK_GET_PROTECTED((le)->le_prop),
	L2BLK_GET_PREFETCH((le)->le_prop));
	asize = vdev_psize_to_asize(dev->l2ad_vdev,
	L2BLK_GET_PSIZE((le)->le_prop));

	/*
	* vdev_space_update() has to be called before arc_hdr_destroy() to
	* avoid underflow since the latter also calls the former.
	*/
	vdev_space_update(dev->l2ad_vdev, asize, 0, 0);

	ARCSTAT_INCR(arcstat_l2_lsize, HDR_GET_LSIZE(hdr));
	ARCSTAT_INCR(arcstat_l2_psize, HDR_GET_PSIZE(hdr));

	mutex_enter(&dev->l2ad_mtx);
	list_insert_tail(&dev->l2ad_buflist, hdr);
	(void) zfs_refcount_add_many(&dev->l2ad_alloc, arc_hdr_size(hdr), hdr);
	mutex_exit(&dev->l2ad_mtx);

	exists = buf_hash_insert(hdr, &hash_lock);
	if (exists) {
	/* Buffer was already cached, no need to restore it. */
	arc_hdr_destroy(hdr);
	/*
	* If the buffer is already cached, check whether it has
	* L2ARC metadata. If not, enter them and update the flag.
	* This is important is case of onlining a cache device, since
	* we previously evicted all L2ARC metadata from ARC.
	*/
	if (!HDR_HAS_L2HDR(exists)) {
	arc_hdr_set_flags(exists, ARC_FLAG_HAS_L2HDR);
	exists->b_l2hdr.b_dev = dev;
	exists->b_l2hdr.b_daddr = le->le_daddr;
	mutex_enter(&dev->l2ad_mtx);
	list_insert_tail(&dev->l2ad_buflist, exists);
	(void) zfs_refcount_add_many(&dev->l2ad_alloc,
	arc_hdr_size(exists), exists);
	mutex_exit(&dev->l2ad_mtx);
	vdev_space_update(dev->l2ad_vdev, asize, 0, 0);
	ARCSTAT_INCR(arcstat_l2_lsize, HDR_GET_LSIZE(exists));
	ARCSTAT_INCR(arcstat_l2_psize, HDR_GET_PSIZE(exists));
	}
	ARCSTAT_BUMP(arcstat_l2_rebuild_bufs_precached);
	}

	mutex_exit(hash_lock);
	}

	/*
	* Starts an asynchronous read IO to read a log block. This is used in log
	* block reconstruction to start reading the next block before we are done
	* decoding and reconstructing the current block, to keep the l2arc device
	* nice and hot with read IO to process.
	* The returned zio will contain a newly allocated memory buffers for the IO
	* data which should then be freed by the caller once the zio is no longer
	* needed (i.e. due to it having completed). If you wish to abort this
	* zio, you should do so using l2arc_log_blk_fetch_abort, which takes
	* care of disposing of the allocated buffers correctly.
	*/
	static zio_t *
	l2arc_log_blk_fetch(vdev_t vd, const l2arc_log_blkptr_t lbp,
	l2arc_log_blk_phys_t *lb)
	{
	uint32_t asize;
	zio_t *pio;
	l2arc_read_callback_t *cb;

	/* L2BLK_GET_PSIZE returns aligned size for log blocks */
	asize = L2BLK_GET_PSIZE((lbp)->lbp_prop);
	ASSERT(asize <= sizeof (l2arc_log_blk_phys_t));

	cb = kmem_zalloc(sizeof (l2arc_read_callback_t), KM_SLEEP);
	cb->l2rcb_abd = abd_get_from_buf(lb, asize);
	pio = zio_root(vd->vdev_spa, l2arc_blk_fetch_done, cb,
	ZIO_FLAG_DONT_CACHE \| ZIO_FLAG_CANFAIL \| ZIO_FLAG_DONT_PROPAGATE \|
	ZIO_FLAG_DONT_RETRY);
	(void) zio_nowait(zio_read_phys(pio, vd, lbp->lbp_daddr, asize,
	cb->l2rcb_abd, ZIO_CHECKSUM_OFF, NULL, NULL,
	ZIO_PRIORITY_ASYNC_READ, ZIO_FLAG_DONT_CACHE \| ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_DONT_PROPAGATE \| ZIO_FLAG_DONT_RETRY, B_FALSE));

	return (pio);
	}

	/*
	* Aborts a zio returned from l2arc_log_blk_fetch and frees the data
	* buffers allocated for it.
	*/
	static void
	l2arc_log_blk_fetch_abort(zio_t *zio)
	{
	(void) zio_wait(zio);
	}

	/*
	* Creates a zio to update the device header on an l2arc device.
	*/
	void
	l2arc_dev_hdr_update(l2arc_dev_t *dev)
	{
	l2arc_dev_hdr_phys_t *l2dhdr = dev->l2ad_dev_hdr;
	const uint64_t l2dhdr_asize = dev->l2ad_dev_hdr_asize;
	abd_t *abd;
	int err;

	VERIFY(spa_config_held(dev->l2ad_spa, SCL_STATE_ALL, RW_READER));

	l2dhdr->dh_magic = L2ARC_DEV_HDR_MAGIC;
	l2dhdr->dh_version = L2ARC_PERSISTENT_VERSION;
	l2dhdr->dh_spa_guid = spa_guid(dev->l2ad_vdev->vdev_spa);
	l2dhdr->dh_vdev_guid = dev->l2ad_vdev->vdev_guid;
	l2dhdr->dh_log_entries = dev->l2ad_log_entries;
	l2dhdr->dh_evict = dev->l2ad_evict;
	l2dhdr->dh_start = dev->l2ad_start;
	l2dhdr->dh_end = dev->l2ad_end;
	l2dhdr->dh_lb_asize = zfs_refcount_count(&dev->l2ad_lb_asize);
	l2dhdr->dh_lb_count = zfs_refcount_count(&dev->l2ad_lb_count);
	l2dhdr->dh_flags = 0;
	l2dhdr->dh_trim_action_time = dev->l2ad_vdev->vdev_trim_action_time;
	l2dhdr->dh_trim_state = dev->l2ad_vdev->vdev_trim_state;
	if (dev->l2ad_first)
	l2dhdr->dh_flags \|= L2ARC_DEV_HDR_EVICT_FIRST;

	abd = abd_get_from_buf(l2dhdr, l2dhdr_asize);

	err = zio_wait(zio_write_phys(NULL, dev->l2ad_vdev,
	VDEV_LABEL_START_SIZE, l2dhdr_asize, abd, ZIO_CHECKSUM_LABEL, NULL,
	NULL, ZIO_PRIORITY_ASYNC_WRITE, ZIO_FLAG_CANFAIL, B_FALSE));

	abd_put(abd);

	if (err != 0) {
	zfs_dbgmsg("L2ARC IO error (%d) while writing device header, "
	"vdev guid: %llu", err, dev->l2ad_vdev->vdev_guid);
	}
	}

	/*
	* Commits a log block to the L2ARC device. This routine is invoked from
	* l2arc_write_buffers when the log block fills up.
	* This function allocates some memory to temporarily hold the serialized
	* buffer to be written. This is then released in l2arc_write_done.
	*/
	static void
	l2arc_log_blk_commit(l2arc_dev_t dev, zio_t pio, l2arc_write_callback_t *cb)
	{
	l2arc_log_blk_phys_t *lb = &dev->l2ad_log_blk;
	l2arc_dev_hdr_phys_t *l2dhdr = dev->l2ad_dev_hdr;
	uint64_t psize, asize;
	zio_t *wzio;
	l2arc_lb_abd_buf_t *abd_buf;
	uint8_t *tmpbuf;
	l2arc_lb_ptr_buf_t *lb_ptr_buf;

	VERIFY3S(dev->l2ad_log_ent_idx, ==, dev->l2ad_log_entries);

	tmpbuf = zio_buf_alloc(sizeof (*lb));
	abd_buf = zio_buf_alloc(sizeof (*abd_buf));
	abd_buf->abd = abd_get_from_buf(lb, sizeof (*lb));
	lb_ptr_buf = kmem_zalloc(sizeof (l2arc_lb_ptr_buf_t), KM_SLEEP);
	lb_ptr_buf->lb_ptr = kmem_zalloc(sizeof (l2arc_log_blkptr_t), KM_SLEEP);

	/* link the buffer into the block chain */
	lb->lb_prev_lbp = l2dhdr->dh_start_lbps[1];
	lb->lb_magic = L2ARC_LOG_BLK_MAGIC;

	/*
	* l2arc_log_blk_commit() may be called multiple times during a single
	* l2arc_write_buffers() call. Save the allocated abd buffers in a list
	* so we can free them in l2arc_write_done() later on.
	*/
	list_insert_tail(&cb->l2wcb_abd_list, abd_buf);

	/* try to compress the buffer */
	psize = zio_compress_data(ZIO_COMPRESS_LZ4,
	abd_buf->abd, tmpbuf, sizeof (*lb), 0);

	/* a log block is never entirely zero */
	ASSERT(psize != 0);
	asize = vdev_psize_to_asize(dev->l2ad_vdev, psize);
	ASSERT(asize <= sizeof (*lb));

	/*
	* Update the start log block pointer in the device header to point
	* to the log block we're about to write.
	*/
	l2dhdr->dh_start_lbps[1] = l2dhdr->dh_start_lbps[0];
	l2dhdr->dh_start_lbps[0].lbp_daddr = dev->l2ad_hand;
	l2dhdr->dh_start_lbps[0].lbp_payload_asize =
	dev->l2ad_log_blk_payload_asize;
	l2dhdr->dh_start_lbps[0].lbp_payload_start =
	dev->l2ad_log_blk_payload_start;
	_NOTE(CONSTCOND)
	L2BLK_SET_LSIZE(
	(&l2dhdr->dh_start_lbps[0])->lbp_prop, sizeof (*lb));
	L2BLK_SET_PSIZE(
	(&l2dhdr->dh_start_lbps[0])->lbp_prop, asize);
	L2BLK_SET_CHECKSUM(
	(&l2dhdr->dh_start_lbps[0])->lbp_prop,
	ZIO_CHECKSUM_FLETCHER_4);
	if (asize < sizeof (*lb)) {
	/* compression succeeded */
	bzero(tmpbuf + psize, asize - psize);
	L2BLK_SET_COMPRESS(
	(&l2dhdr->dh_start_lbps[0])->lbp_prop,
	ZIO_COMPRESS_LZ4);
	} else {
	/* compression failed */
	bcopy(lb, tmpbuf, sizeof (*lb));
	L2BLK_SET_COMPRESS(
	(&l2dhdr->dh_start_lbps[0])->lbp_prop,
	ZIO_COMPRESS_OFF);
	}

	/* checksum what we're about to write */
	fletcher_4_native(tmpbuf, asize, NULL,
	&l2dhdr->dh_start_lbps[0].lbp_cksum);

	abd_put(abd_buf->abd);

	/* perform the write itself */
	abd_buf->abd = abd_get_from_buf(tmpbuf, sizeof (*lb));
	abd_take_ownership_of_buf(abd_buf->abd, B_TRUE);
	wzio = zio_write_phys(pio, dev->l2ad_vdev, dev->l2ad_hand,
	asize, abd_buf->abd, ZIO_CHECKSUM_OFF, NULL, NULL,
	ZIO_PRIORITY_ASYNC_WRITE, ZIO_FLAG_CANFAIL, B_FALSE);
	DTRACE_PROBE2(l2arc__write, vdev_t , dev->l2ad_vdev, zio_t , wzio);
	(void) zio_nowait(wzio);

	dev->l2ad_hand += asize;
	/*
	* Include the committed log block's pointer in the list of pointers
	* to log blocks present in the L2ARC device.
	*/
	bcopy(&l2dhdr->dh_start_lbps[0], lb_ptr_buf->lb_ptr,
	sizeof (l2arc_log_blkptr_t));
	mutex_enter(&dev->l2ad_mtx);
	list_insert_head(&dev->l2ad_lbptr_list, lb_ptr_buf);
	ARCSTAT_INCR(arcstat_l2_log_blk_asize, asize);
	ARCSTAT_BUMP(arcstat_l2_log_blk_count);
	zfs_refcount_add_many(&dev->l2ad_lb_asize, asize, lb_ptr_buf);
	zfs_refcount_add(&dev->l2ad_lb_count, lb_ptr_buf);
	mutex_exit(&dev->l2ad_mtx);
	vdev_space_update(dev->l2ad_vdev, asize, 0, 0);

	/* bump the kstats */
	ARCSTAT_INCR(arcstat_l2_write_bytes, asize);
	ARCSTAT_BUMP(arcstat_l2_log_blk_writes);
	ARCSTAT_F_AVG(arcstat_l2_log_blk_avg_asize, asize);
	ARCSTAT_F_AVG(arcstat_l2_data_to_meta_ratio,
	dev->l2ad_log_blk_payload_asize / asize);

	/* start a new log block */
	dev->l2ad_log_ent_idx = 0;
	dev->l2ad_log_blk_payload_asize = 0;
	dev->l2ad_log_blk_payload_start = 0;
	}

	/*
	* Validates an L2ARC log block address to make sure that it can be read
	* from the provided L2ARC device.
	*/
	boolean_t
	l2arc_log_blkptr_valid(l2arc_dev_t dev, const l2arc_log_blkptr_t lbp)
	{
	/* L2BLK_GET_PSIZE returns aligned size for log blocks */
	uint64_t asize = L2BLK_GET_PSIZE((lbp)->lbp_prop);
	uint64_t end = lbp->lbp_daddr + asize - 1;
	uint64_t start = lbp->lbp_payload_start;
	boolean_t evicted = B_FALSE;

	/*
	* A log block is valid if all of the following conditions are true:
	* - it fits entirely (including its payload) between l2ad_start and
	* l2ad_end
	* - it has a valid size
	* - neither the log block itself nor part of its payload was evicted
	* by l2arc_evict():
	*
	* l2ad_hand l2ad_evict
	* \| \| lbp_daddr
	* \| start \| \| end
	* \| \| \| \| \|
	* V V V V V
	* l2ad_start ============================================ l2ad_end
	* --------------------------\|\|\|\|
	* ^ ^
	* \| log block
	* payload
	*/

	evicted =
	l2arc_range_check_overlap(start, end, dev->l2ad_hand) \|\|
	l2arc_range_check_overlap(start, end, dev->l2ad_evict) \|\|
	l2arc_range_check_overlap(dev->l2ad_hand, dev->l2ad_evict, start) \|\|
	l2arc_range_check_overlap(dev->l2ad_hand, dev->l2ad_evict, end);

	return (start >= dev->l2ad_start && end <= dev->l2ad_end &&
	asize > 0 && asize <= sizeof (l2arc_log_blk_phys_t) &&
	(!evicted \|\| dev->l2ad_first));
	}

	/*
	* Inserts ARC buffer header `hdr' into the current L2ARC log block on
	* the device. The buffer being inserted must be present in L2ARC.
	* Returns B_TRUE if the L2ARC log block is full and needs to be committed
	* to L2ARC, or B_FALSE if it still has room for more ARC buffers.
	*/
	static boolean_t
	l2arc_log_blk_insert(l2arc_dev_t dev, const arc_buf_hdr_t hdr)
	{
	l2arc_log_blk_phys_t *lb = &dev->l2ad_log_blk;
	l2arc_log_ent_phys_t *le;

	if (dev->l2ad_log_entries == 0)
	return (B_FALSE);

	int index = dev->l2ad_log_ent_idx++;

	ASSERT3S(index, <, dev->l2ad_log_entries);
	ASSERT(HDR_HAS_L2HDR(hdr));

	le = &lb->lb_entries[index];
	bzero(le, sizeof (*le));
	le->le_dva = hdr->b_dva;
	le->le_birth = hdr->b_birth;
	le->le_daddr = hdr->b_l2hdr.b_daddr;
	if (index == 0)
	dev->l2ad_log_blk_payload_start = le->le_daddr;
	L2BLK_SET_LSIZE((le)->le_prop, HDR_GET_LSIZE(hdr));
	L2BLK_SET_PSIZE((le)->le_prop, HDR_GET_PSIZE(hdr));
	L2BLK_SET_COMPRESS((le)->le_prop, HDR_GET_COMPRESS(hdr));
	le->le_complevel = hdr->b_complevel;
	L2BLK_SET_TYPE((le)->le_prop, hdr->b_type);
	L2BLK_SET_PROTECTED((le)->le_prop, !!(HDR_PROTECTED(hdr)));
	L2BLK_SET_PREFETCH((le)->le_prop, !!(HDR_PREFETCH(hdr)));

	dev->l2ad_log_blk_payload_asize += vdev_psize_to_asize(dev->l2ad_vdev,
	HDR_GET_PSIZE(hdr));

	return (dev->l2ad_log_ent_idx == dev->l2ad_log_entries);
	}

	/*
	* Checks whether a given L2ARC device address sits in a time-sequential
	* range. The trick here is that the L2ARC is a rotary buffer, so we can't
	* just do a range comparison, we need to handle the situation in which the
	* range wraps around the end of the L2ARC device. Arguments:
	* bottom -- Lower end of the range to check (written to earlier).
	* top -- Upper end of the range to check (written to later).
	* check -- The address for which we want to determine if it sits in
	* between the top and bottom.
	*
	* The 3-way conditional below represents the following cases:
	*
	* bottom < top : Sequentially ordered case:
	* <check>--------+-------------------+
	* \| (overlap here?) \|
	* L2ARC dev V V
	* \|---------------<bottom>============<top>--------------\|
	*
	* bottom > top: Looped-around case:
	* <check>--------+------------------+
	* \| (overlap here?) \|
	* L2ARC dev V V
	* \|===============<top>---------------<bottom>===========\|
	* ^ ^
	* \| (or here?) \|
	* +---------------+---------<check>
	*
	* top == bottom : Just a single address comparison.
	*/
	boolean_t
	l2arc_range_check_overlap(uint64_t bottom, uint64_t top, uint64_t check)
	{
	if (bottom < top)
	return (bottom <= check && check <= top);
	else if (bottom > top)
	return (check <= top \|\| bottom <= check);
	else
	return (check == top);
	}

	EXPORT_SYMBOL(arc_buf_size);
	EXPORT_SYMBOL(arc_write);
	EXPORT_SYMBOL(arc_read);
	EXPORT_SYMBOL(arc_buf_info);
	EXPORT_SYMBOL(arc_getbuf_func);
	EXPORT_SYMBOL(arc_add_prune_callback);
	EXPORT_SYMBOL(arc_remove_prune_callback);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, min, param_set_arc_long,
	param_get_long, ZMOD_RW, "Min arc size");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, max, param_set_arc_long,
	param_get_long, ZMOD_RW, "Max arc size");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, meta_limit, param_set_arc_long,
	param_get_long, ZMOD_RW, "Metadata limit for arc size");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, meta_limit_percent,
	param_set_arc_long, param_get_long, ZMOD_RW,
	"Percent of arc size for arc meta limit");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, meta_min, param_set_arc_long,
	param_get_long, ZMOD_RW, "Min arc metadata");

	ZFS_MODULE_PARAM(zfs_arc, zfs_arc_, meta_prune, INT, ZMOD_RW,
	"Meta objects to scan for prune");

	ZFS_MODULE_PARAM(zfs_arc, zfs_arc_, meta_adjust_restarts, INT, ZMOD_RW,
	"Limit number of restarts in arc_evict_meta");

	ZFS_MODULE_PARAM(zfs_arc, zfs_arc_, meta_strategy, INT, ZMOD_RW,
	"Meta reclaim strategy");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, grow_retry, param_set_arc_int,
	param_get_int, ZMOD_RW, "Seconds before growing arc size");

	ZFS_MODULE_PARAM(zfs_arc, zfs_arc_, p_dampener_disable, INT, ZMOD_RW,
	"Disable arc_p adapt dampener");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, shrink_shift, param_set_arc_int,
	param_get_int, ZMOD_RW, "log2(fraction of arc to reclaim)");

	ZFS_MODULE_PARAM(zfs_arc, zfs_arc_, pc_percent, UINT, ZMOD_RW,
	"Percent of pagecache to reclaim arc to");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, p_min_shift, param_set_arc_int,
	param_get_int, ZMOD_RW, "arc_c shift to calc min/max arc_p");

	ZFS_MODULE_PARAM(zfs_arc, zfs_arc_, average_blocksize, INT, ZMOD_RD,
	"Target average block size");

	ZFS_MODULE_PARAM(zfs, zfs_, compressed_arc_enabled, INT, ZMOD_RW,
	"Disable compressed arc buffers");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, min_prefetch_ms, param_set_arc_int,
	param_get_int, ZMOD_RW, "Min life of prefetch block in ms");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, min_prescient_prefetch_ms,
	param_set_arc_int, param_get_int, ZMOD_RW,
	"Min life of prescient prefetched block in ms");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, write_max, ULONG, ZMOD_RW,
	"Max write bytes per interval");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, write_boost, ULONG, ZMOD_RW,
	"Extra write bytes during device warmup");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, headroom, ULONG, ZMOD_RW,
	"Number of max device writes to precache");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, headroom_boost, ULONG, ZMOD_RW,
	"Compressed l2arc_headroom multiplier");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, trim_ahead, ULONG, ZMOD_RW,
	"TRIM ahead L2ARC write size multiplier");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, feed_secs, ULONG, ZMOD_RW,
	"Seconds between L2ARC writing");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, feed_min_ms, ULONG, ZMOD_RW,
	"Min feed interval in milliseconds");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, noprefetch, INT, ZMOD_RW,
	"Skip caching prefetched buffers");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, feed_again, INT, ZMOD_RW,
	"Turbo L2ARC warmup");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, norw, INT, ZMOD_RW,
	"No reads during writes");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, meta_percent, INT, ZMOD_RW,
	"Percent of ARC size allowed for L2ARC-only headers");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, rebuild_enabled, INT, ZMOD_RW,
	"Rebuild the L2ARC when importing a pool");

	ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, rebuild_blocks_min_l2size, ULONG, ZMOD_RW,
	"Min size in bytes to write rebuild log blocks in L2ARC");
	+
	+ZFS_MODULE_PARAM(zfs_l2arc, l2arc_, mfuonly, INT, ZMOD_RW,
	+ "Cache only MFU data from ARC into L2ARC");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, lotsfree_percent, param_set_arc_int,
	param_get_int, ZMOD_RW, "System free memory I/O throttle in bytes");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, sys_free, param_set_arc_long,
	param_get_long, ZMOD_RW, "System free memory target size in bytes");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, dnode_limit, param_set_arc_long,
	param_get_long, ZMOD_RW, "Minimum bytes of dnodes in arc");

	ZFS_MODULE_PARAM_CALL(zfs_arc, zfs_arc_, dnode_limit_percent,
	param_set_arc_long, param_get_long, ZMOD_RW,
	"Percent of ARC meta buffers for dnodes");

	ZFS_MODULE_PARAM(zfs_arc, zfs_arc_, dnode_reduce_percent, ULONG, ZMOD_RW,
	"Percentage of excess dnodes to try to unpin");

	ZFS_MODULE_PARAM(zfs_arc, zfs_arc_, eviction_pct, INT, ZMOD_RW,
	"When full, ARC allocation waits for eviction of this % of alloc size");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/dbuf.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/dbuf.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/dbuf.c (revision 365892)
	@@ -1,4741 +1,4741 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2012, 2019 by Delphix. All rights reserved.
	* Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
	* Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
	* Copyright (c) 2019, Klara Inc.
	* Copyright (c) 2019, Allan Jude
	*/

	#include <sys/zfs_context.h>
	#include <sys/arc.h>
	#include <sys/dmu.h>
	#include <sys/dmu_send.h>
	#include <sys/dmu_impl.h>
	#include <sys/dbuf.h>
	#include <sys/dmu_objset.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_dir.h>
	#include <sys/dmu_tx.h>
	#include <sys/spa.h>
	#include <sys/zio.h>
	#include <sys/dmu_zfetch.h>
	#include <sys/sa.h>
	#include <sys/sa_impl.h>
	#include <sys/zfeature.h>
	#include <sys/blkptr.h>
	#include <sys/range_tree.h>
	#include <sys/trace_zfs.h>
	#include <sys/callb.h>
	#include <sys/abd.h>
	#include <sys/vdev.h>
	#include <cityhash.h>
	#include <sys/spa_impl.h>

	kstat_t *dbuf_ksp;

	typedef struct dbuf_stats {
	/*
	* Various statistics about the size of the dbuf cache.
	*/
	kstat_named_t cache_count;
	kstat_named_t cache_size_bytes;
	kstat_named_t cache_size_bytes_max;
	/*
	* Statistics regarding the bounds on the dbuf cache size.
	*/
	kstat_named_t cache_target_bytes;
	kstat_named_t cache_lowater_bytes;
	kstat_named_t cache_hiwater_bytes;
	/*
	* Total number of dbuf cache evictions that have occurred.
	*/
	kstat_named_t cache_total_evicts;
	/*
	* The distribution of dbuf levels in the dbuf cache and
	* the total size of all dbufs at each level.
	*/
	kstat_named_t cache_levels[DN_MAX_LEVELS];
	kstat_named_t cache_levels_bytes[DN_MAX_LEVELS];
	/*
	* Statistics about the dbuf hash table.
	*/
	kstat_named_t hash_hits;
	kstat_named_t hash_misses;
	kstat_named_t hash_collisions;
	kstat_named_t hash_elements;
	kstat_named_t hash_elements_max;
	/*
	* Number of sublists containing more than one dbuf in the dbuf
	* hash table. Keep track of the longest hash chain.
	*/
	kstat_named_t hash_chains;
	kstat_named_t hash_chain_max;
	/*
	* Number of times a dbuf_create() discovers that a dbuf was
	* already created and in the dbuf hash table.
	*/
	kstat_named_t hash_insert_race;
	/*
	* Statistics about the size of the metadata dbuf cache.
	*/
	kstat_named_t metadata_cache_count;
	kstat_named_t metadata_cache_size_bytes;
	kstat_named_t metadata_cache_size_bytes_max;
	/*
	* For diagnostic purposes, this is incremented whenever we can't add
	* something to the metadata cache because it's full, and instead put
	* the data in the regular dbuf cache.
	*/
	kstat_named_t metadata_cache_overflow;
	} dbuf_stats_t;

	dbuf_stats_t dbuf_stats = {
	{ "cache_count", KSTAT_DATA_UINT64 },
	{ "cache_size_bytes", KSTAT_DATA_UINT64 },
	{ "cache_size_bytes_max", KSTAT_DATA_UINT64 },
	{ "cache_target_bytes", KSTAT_DATA_UINT64 },
	{ "cache_lowater_bytes", KSTAT_DATA_UINT64 },
	{ "cache_hiwater_bytes", KSTAT_DATA_UINT64 },
	{ "cache_total_evicts", KSTAT_DATA_UINT64 },
	{ { "cache_levels_N", KSTAT_DATA_UINT64 } },
	{ { "cache_levels_bytes_N", KSTAT_DATA_UINT64 } },
	{ "hash_hits", KSTAT_DATA_UINT64 },
	{ "hash_misses", KSTAT_DATA_UINT64 },
	{ "hash_collisions", KSTAT_DATA_UINT64 },
	{ "hash_elements", KSTAT_DATA_UINT64 },
	{ "hash_elements_max", KSTAT_DATA_UINT64 },
	{ "hash_chains", KSTAT_DATA_UINT64 },
	{ "hash_chain_max", KSTAT_DATA_UINT64 },
	{ "hash_insert_race", KSTAT_DATA_UINT64 },
	{ "metadata_cache_count", KSTAT_DATA_UINT64 },
	{ "metadata_cache_size_bytes", KSTAT_DATA_UINT64 },
	{ "metadata_cache_size_bytes_max", KSTAT_DATA_UINT64 },
	{ "metadata_cache_overflow", KSTAT_DATA_UINT64 }
	};

	#define DBUF_STAT_INCR(stat, val) \
	atomic_add_64(&dbuf_stats.stat.value.ui64, (val));
	#define DBUF_STAT_DECR(stat, val) \
	DBUF_STAT_INCR(stat, -(val));
	#define DBUF_STAT_BUMP(stat) \
	DBUF_STAT_INCR(stat, 1);
	#define DBUF_STAT_BUMPDOWN(stat) \
	DBUF_STAT_INCR(stat, -1);
	#define DBUF_STAT_MAX(stat, v) { \
	uint64_t _m; \
	while ((v) > (_m = dbuf_stats.stat.value.ui64) && \
	(_m != atomic_cas_64(&dbuf_stats.stat.value.ui64, _m, (v))))\
	continue; \
	}

	static boolean_t dbuf_undirty(dmu_buf_impl_t db, dmu_tx_t tx);
	static void dbuf_write(dbuf_dirty_record_t dr, arc_buf_t data, dmu_tx_t *tx);
	static void dbuf_sync_leaf_verify_bonus_dnode(dbuf_dirty_record_t *dr);
	static int dbuf_read_verify_dnode_crypt(dmu_buf_impl_t *db, uint32_t flags);

	extern inline void dmu_buf_init_user(dmu_buf_user_t *dbu,
	dmu_buf_evict_func_t *evict_func_sync,
	dmu_buf_evict_func_t *evict_func_async,
	dmu_buf_t **clear_on_evict_dbufp);

	/*
	* Global data structures and functions for the dbuf cache.
	*/
	static kmem_cache_t *dbuf_kmem_cache;
	static taskq_t *dbu_evict_taskq;

	static kthread_t *dbuf_cache_evict_thread;
	static kmutex_t dbuf_evict_lock;
	static kcondvar_t dbuf_evict_cv;
	static boolean_t dbuf_evict_thread_exit;

	/*
	* There are two dbuf caches; each dbuf can only be in one of them at a time.
	*
	* 1. Cache of metadata dbufs, to help make read-heavy administrative commands
	* from /sbin/zfs run faster. The "metadata cache" specifically stores dbufs
	* that represent the metadata that describes filesystems/snapshots/
	* bookmarks/properties/etc. We only evict from this cache when we export a
	* pool, to short-circuit as much I/O as possible for all administrative
	* commands that need the metadata. There is no eviction policy for this
	* cache, because we try to only include types in it which would occupy a
	* very small amount of space per object but create a large impact on the
	* performance of these commands. Instead, after it reaches a maximum size
	* (which should only happen on very small memory systems with a very large
	* number of filesystem objects), we stop taking new dbufs into the
	* metadata cache, instead putting them in the normal dbuf cache.
	*
	* 2. LRU cache of dbufs. The dbuf cache maintains a list of dbufs that
	* are not currently held but have been recently released. These dbufs
	* are not eligible for arc eviction until they are aged out of the cache.
	* Dbufs that are aged out of the cache will be immediately destroyed and
	* become eligible for arc eviction.
	*
	* Dbufs are added to these caches once the last hold is released. If a dbuf is
	* later accessed and still exists in the dbuf cache, then it will be removed
	* from the cache and later re-added to the head of the cache.
	*
	* If a given dbuf meets the requirements for the metadata cache, it will go
	* there, otherwise it will be considered for the generic LRU dbuf cache. The
	* caches and the refcounts tracking their sizes are stored in an array indexed
	* by those caches' matching enum values (from dbuf_cached_state_t).
	*/
	typedef struct dbuf_cache {
	multilist_t *cache;
	zfs_refcount_t size;
	} dbuf_cache_t;
	dbuf_cache_t dbuf_caches[DB_CACHE_MAX];

	/* Size limits for the caches */
	unsigned long dbuf_cache_max_bytes = ULONG_MAX;
	unsigned long dbuf_metadata_cache_max_bytes = ULONG_MAX;

	/* Set the default sizes of the caches to log2 fraction of arc size */
	int dbuf_cache_shift = 5;
	int dbuf_metadata_cache_shift = 6;

	static unsigned long dbuf_cache_target_bytes(void);
	static unsigned long dbuf_metadata_cache_target_bytes(void);

	/*
	* The LRU dbuf cache uses a three-stage eviction policy:
	* - A low water marker designates when the dbuf eviction thread
	* should stop evicting from the dbuf cache.
	* - When we reach the maximum size (aka mid water mark), we
	* signal the eviction thread to run.
	* - The high water mark indicates when the eviction thread
	* is unable to keep up with the incoming load and eviction must
	* happen in the context of the calling thread.
	*
	* The dbuf cache:
	* (max size)
	* low water mid water hi water
	* +----------------------------------------+----------+----------+
	* \| \| \| \|
	* \| \| \| \|
	* \| \| \| \|
	* \| \| \| \|
	* +----------------------------------------+----------+----------+
	* stop signal evict
	* evicting eviction directly
	* thread
	*
	* The high and low water marks indicate the operating range for the eviction
	* thread. The low water mark is, by default, 90% of the total size of the
	* cache and the high water mark is at 110% (both of these percentages can be
	* changed by setting dbuf_cache_lowater_pct and dbuf_cache_hiwater_pct,
	* respectively). The eviction thread will try to ensure that the cache remains
	* within this range by waking up every second and checking if the cache is
	* above the low water mark. The thread can also be woken up by callers adding
	* elements into the cache if the cache is larger than the mid water (i.e max
	* cache size). Once the eviction thread is woken up and eviction is required,
	* it will continue evicting buffers until it's able to reduce the cache size
	* to the low water mark. If the cache size continues to grow and hits the high
	* water mark, then callers adding elements to the cache will begin to evict
	* directly from the cache until the cache is no longer above the high water
	* mark.
	*/

	/*
	* The percentage above and below the maximum cache size.
	*/
	uint_t dbuf_cache_hiwater_pct = 10;
	uint_t dbuf_cache_lowater_pct = 10;

	/* ARGSUSED */
	static int
	dbuf_cons(void vdb, void unused, int kmflag)
	{
	dmu_buf_impl_t *db = vdb;
	bzero(db, sizeof (dmu_buf_impl_t));

	mutex_init(&db->db_mtx, NULL, MUTEX_DEFAULT, NULL);
	rw_init(&db->db_rwlock, NULL, RW_DEFAULT, NULL);
	cv_init(&db->db_changed, NULL, CV_DEFAULT, NULL);
	multilist_link_init(&db->db_cache_link);
	zfs_refcount_create(&db->db_holds);

	return (0);
	}

	/* ARGSUSED */
	static void
	dbuf_dest(void vdb, void unused)
	{
	dmu_buf_impl_t *db = vdb;
	mutex_destroy(&db->db_mtx);
	rw_destroy(&db->db_rwlock);
	cv_destroy(&db->db_changed);
	ASSERT(!multilist_link_active(&db->db_cache_link));
	zfs_refcount_destroy(&db->db_holds);
	}

	/*
	* dbuf hash table routines
	*/
	static dbuf_hash_table_t dbuf_hash_table;

	static uint64_t dbuf_hash_count;

	/*
	* We use Cityhash for this. It's fast, and has good hash properties without
	* requiring any large static buffers.
	*/
	static uint64_t
	dbuf_hash(void *os, uint64_t obj, uint8_t lvl, uint64_t blkid)
	{
	return (cityhash4((uintptr_t)os, obj, (uint64_t)lvl, blkid));
	}

	#define DTRACE_SET_STATE(db, why) \
	DTRACE_PROBE2(dbuf__state_change, dmu_buf_impl_t *, db, \
	const char *, why)

	#define DBUF_EQUAL(dbuf, os, obj, level, blkid) \
	((dbuf)->db.db_object == (obj) && \
	(dbuf)->db_objset == (os) && \
	(dbuf)->db_level == (level) && \
	(dbuf)->db_blkid == (blkid))

	dmu_buf_impl_t *
	dbuf_find(objset_t *os, uint64_t obj, uint8_t level, uint64_t blkid)
	{
	dbuf_hash_table_t *h = &dbuf_hash_table;
	uint64_t hv;
	uint64_t idx;
	dmu_buf_impl_t *db;

	hv = dbuf_hash(os, obj, level, blkid);
	idx = hv & h->hash_table_mask;

	mutex_enter(DBUF_HASH_MUTEX(h, idx));
	for (db = h->hash_table[idx]; db != NULL; db = db->db_hash_next) {
	if (DBUF_EQUAL(db, os, obj, level, blkid)) {
	mutex_enter(&db->db_mtx);
	if (db->db_state != DB_EVICTING) {
	mutex_exit(DBUF_HASH_MUTEX(h, idx));
	return (db);
	}
	mutex_exit(&db->db_mtx);
	}
	}
	mutex_exit(DBUF_HASH_MUTEX(h, idx));
	return (NULL);
	}

	static dmu_buf_impl_t *
	dbuf_find_bonus(objset_t *os, uint64_t object)
	{
	dnode_t *dn;
	dmu_buf_impl_t *db = NULL;

	if (dnode_hold(os, object, FTAG, &dn) == 0) {
	rw_enter(&dn->dn_struct_rwlock, RW_READER);
	if (dn->dn_bonus != NULL) {
	db = dn->dn_bonus;
	mutex_enter(&db->db_mtx);
	}
	rw_exit(&dn->dn_struct_rwlock);
	dnode_rele(dn, FTAG);
	}
	return (db);
	}

	/*
	* Insert an entry into the hash table. If there is already an element
	* equal to elem in the hash table, then the already existing element
	* will be returned and the new element will not be inserted.
	* Otherwise returns NULL.
	*/
	static dmu_buf_impl_t *
	dbuf_hash_insert(dmu_buf_impl_t *db)
	{
	dbuf_hash_table_t *h = &dbuf_hash_table;
	objset_t *os = db->db_objset;
	uint64_t obj = db->db.db_object;
	int level = db->db_level;
	uint64_t blkid, hv, idx;
	dmu_buf_impl_t *dbf;
	uint32_t i;

	blkid = db->db_blkid;
	hv = dbuf_hash(os, obj, level, blkid);
	idx = hv & h->hash_table_mask;

	mutex_enter(DBUF_HASH_MUTEX(h, idx));
	for (dbf = h->hash_table[idx], i = 0; dbf != NULL;
	dbf = dbf->db_hash_next, i++) {
	if (DBUF_EQUAL(dbf, os, obj, level, blkid)) {
	mutex_enter(&dbf->db_mtx);
	if (dbf->db_state != DB_EVICTING) {
	mutex_exit(DBUF_HASH_MUTEX(h, idx));
	return (dbf);
	}
	mutex_exit(&dbf->db_mtx);
	}
	}

	if (i > 0) {
	DBUF_STAT_BUMP(hash_collisions);
	if (i == 1)
	DBUF_STAT_BUMP(hash_chains);

	DBUF_STAT_MAX(hash_chain_max, i);
	}

	mutex_enter(&db->db_mtx);
	db->db_hash_next = h->hash_table[idx];
	h->hash_table[idx] = db;
	mutex_exit(DBUF_HASH_MUTEX(h, idx));
	atomic_inc_64(&dbuf_hash_count);
	DBUF_STAT_MAX(hash_elements_max, dbuf_hash_count);

	return (NULL);
	}

	/*
	* This returns whether this dbuf should be stored in the metadata cache, which
	* is based on whether it's from one of the dnode types that store data related
	* to traversing dataset hierarchies.
	*/
	static boolean_t
	dbuf_include_in_metadata_cache(dmu_buf_impl_t *db)
	{
	DB_DNODE_ENTER(db);
	dmu_object_type_t type = DB_DNODE(db)->dn_type;
	DB_DNODE_EXIT(db);

	/* Check if this dbuf is one of the types we care about */
	if (DMU_OT_IS_METADATA_CACHED(type)) {
	/* If we hit this, then we set something up wrong in dmu_ot */
	ASSERT(DMU_OT_IS_METADATA(type));

	/*
	* Sanity check for small-memory systems: don't allocate too
	* much memory for this purpose.
	*/
	if (zfs_refcount_count(
	&dbuf_caches[DB_DBUF_METADATA_CACHE].size) >
	dbuf_metadata_cache_target_bytes()) {
	DBUF_STAT_BUMP(metadata_cache_overflow);
	return (B_FALSE);
	}

	return (B_TRUE);
	}

	return (B_FALSE);
	}

	/*
	* Remove an entry from the hash table. It must be in the EVICTING state.
	*/
	static void
	dbuf_hash_remove(dmu_buf_impl_t *db)
	{
	dbuf_hash_table_t *h = &dbuf_hash_table;
	uint64_t hv, idx;
	dmu_buf_impl_t dbf, *dbp;

	hv = dbuf_hash(db->db_objset, db->db.db_object,
	db->db_level, db->db_blkid);
	idx = hv & h->hash_table_mask;

	/*
	* We mustn't hold db_mtx to maintain lock ordering:
	* DBUF_HASH_MUTEX > db_mtx.
	*/
	ASSERT(zfs_refcount_is_zero(&db->db_holds));
	ASSERT(db->db_state == DB_EVICTING);
	ASSERT(!MUTEX_HELD(&db->db_mtx));

	mutex_enter(DBUF_HASH_MUTEX(h, idx));
	dbp = &h->hash_table[idx];
	while ((dbf = *dbp) != db) {
	dbp = &dbf->db_hash_next;
	ASSERT(dbf != NULL);
	}
	*dbp = db->db_hash_next;
	db->db_hash_next = NULL;
	if (h->hash_table[idx] &&
	h->hash_table[idx]->db_hash_next == NULL)
	DBUF_STAT_BUMPDOWN(hash_chains);
	mutex_exit(DBUF_HASH_MUTEX(h, idx));
	atomic_dec_64(&dbuf_hash_count);
	}

	typedef enum {
	DBVU_EVICTING,
	DBVU_NOT_EVICTING
	} dbvu_verify_type_t;

	static void
	dbuf_verify_user(dmu_buf_impl_t *db, dbvu_verify_type_t verify_type)
	{
	#ifdef ZFS_DEBUG
	int64_t holds;

	if (db->db_user == NULL)
	return;

	/* Only data blocks support the attachment of user data. */
	ASSERT(db->db_level == 0);

	/* Clients must resolve a dbuf before attaching user data. */
	ASSERT(db->db.db_data != NULL);
	ASSERT3U(db->db_state, ==, DB_CACHED);

	holds = zfs_refcount_count(&db->db_holds);
	if (verify_type == DBVU_EVICTING) {
	/*
	* Immediate eviction occurs when holds == dirtycnt.
	* For normal eviction buffers, holds is zero on
	* eviction, except when dbuf_fix_old_data() calls
	* dbuf_clear_data(). However, the hold count can grow
	* during eviction even though db_mtx is held (see
	* dmu_bonus_hold() for an example), so we can only
	* test the generic invariant that holds >= dirtycnt.
	*/
	ASSERT3U(holds, >=, db->db_dirtycnt);
	} else {
	if (db->db_user_immediate_evict == TRUE)
	ASSERT3U(holds, >=, db->db_dirtycnt);
	else
	ASSERT3U(holds, >, 0);
	}
	#endif
	}

	static void
	dbuf_evict_user(dmu_buf_impl_t *db)
	{
	dmu_buf_user_t *dbu = db->db_user;

	ASSERT(MUTEX_HELD(&db->db_mtx));

	if (dbu == NULL)
	return;

	dbuf_verify_user(db, DBVU_EVICTING);
	db->db_user = NULL;

	#ifdef ZFS_DEBUG
	if (dbu->dbu_clear_on_evict_dbufp != NULL)
	*dbu->dbu_clear_on_evict_dbufp = NULL;
	#endif

	/*
	* There are two eviction callbacks - one that we call synchronously
	* and one that we invoke via a taskq. The async one is useful for
	* avoiding lock order reversals and limiting stack depth.
	*
	* Note that if we have a sync callback but no async callback,
	* it's likely that the sync callback will free the structure
	* containing the dbu. In that case we need to take care to not
	* dereference dbu after calling the sync evict func.
	*/
	boolean_t has_async = (dbu->dbu_evict_func_async != NULL);

	if (dbu->dbu_evict_func_sync != NULL)
	dbu->dbu_evict_func_sync(dbu);

	if (has_async) {
	taskq_dispatch_ent(dbu_evict_taskq, dbu->dbu_evict_func_async,
	dbu, 0, &dbu->dbu_tqent);
	}
	}

	boolean_t
	dbuf_is_metadata(dmu_buf_impl_t *db)
	{
	/*
	* Consider indirect blocks and spill blocks to be meta data.
	*/
	if (db->db_level > 0 \|\| db->db_blkid == DMU_SPILL_BLKID) {
	return (B_TRUE);
	} else {
	boolean_t is_metadata;

	DB_DNODE_ENTER(db);
	is_metadata = DMU_OT_IS_METADATA(DB_DNODE(db)->dn_type);
	DB_DNODE_EXIT(db);

	return (is_metadata);
	}
	}


	/*
	* This function must return indices evenly distributed between all
	* sublists of the multilist. This is needed due to how the dbuf eviction
	* code is laid out; dbuf_evict_thread() assumes dbufs are evenly
	* distributed between all sublists and uses this assumption when
	* deciding which sublist to evict from and how much to evict from it.
	*/
	static unsigned int
	dbuf_cache_multilist_index_func(multilist_t ml, void obj)
	{
	dmu_buf_impl_t *db = obj;

	/*
	* The assumption here, is the hash value for a given
	* dmu_buf_impl_t will remain constant throughout it's lifetime
	* (i.e. it's objset, object, level and blkid fields don't change).
	* Thus, we don't need to store the dbuf's sublist index
	* on insertion, as this index can be recalculated on removal.
	*
	* Also, the low order bits of the hash value are thought to be
	* distributed evenly. Otherwise, in the case that the multilist
	* has a power of two number of sublists, each sublists' usage
	* would not be evenly distributed.
	*/
	return (dbuf_hash(db->db_objset, db->db.db_object,
	db->db_level, db->db_blkid) %
	multilist_get_num_sublists(ml));
	}

	/*
	* The target size of the dbuf cache can grow with the ARC target,
	* unless limited by the tunable dbuf_cache_max_bytes.
	*/
	static inline unsigned long
	dbuf_cache_target_bytes(void)
	{
	return (MIN(dbuf_cache_max_bytes,
	arc_target_bytes() >> dbuf_cache_shift));
	}

	/*
	* The target size of the dbuf metadata cache can grow with the ARC target,
	* unless limited by the tunable dbuf_metadata_cache_max_bytes.
	*/
	static inline unsigned long
	dbuf_metadata_cache_target_bytes(void)
	{
	return (MIN(dbuf_metadata_cache_max_bytes,
	arc_target_bytes() >> dbuf_metadata_cache_shift));
	}

	static inline uint64_t
	dbuf_cache_hiwater_bytes(void)
	{
	uint64_t dbuf_cache_target = dbuf_cache_target_bytes();
	return (dbuf_cache_target +
	(dbuf_cache_target * dbuf_cache_hiwater_pct) / 100);
	}

	static inline uint64_t
	dbuf_cache_lowater_bytes(void)
	{
	uint64_t dbuf_cache_target = dbuf_cache_target_bytes();
	return (dbuf_cache_target -
	(dbuf_cache_target * dbuf_cache_lowater_pct) / 100);
	}

	static inline boolean_t
	dbuf_cache_above_lowater(void)
	{
	return (zfs_refcount_count(&dbuf_caches[DB_DBUF_CACHE].size) >
	dbuf_cache_lowater_bytes());
	}

	/*
	* Evict the oldest eligible dbuf from the dbuf cache.
	*/
	static void
	dbuf_evict_one(void)
	{
	int idx = multilist_get_random_index(dbuf_caches[DB_DBUF_CACHE].cache);
	multilist_sublist_t *mls = multilist_sublist_lock(
	dbuf_caches[DB_DBUF_CACHE].cache, idx);

	ASSERT(!MUTEX_HELD(&dbuf_evict_lock));

	dmu_buf_impl_t *db = multilist_sublist_tail(mls);
	while (db != NULL && mutex_tryenter(&db->db_mtx) == 0) {
	db = multilist_sublist_prev(mls, db);
	}

	DTRACE_PROBE2(dbuf__evict__one, dmu_buf_impl_t *, db,
	multilist_sublist_t *, mls);

	if (db != NULL) {
	multilist_sublist_remove(mls, db);
	multilist_sublist_unlock(mls);
	(void) zfs_refcount_remove_many(
	&dbuf_caches[DB_DBUF_CACHE].size, db->db.db_size, db);
	DBUF_STAT_BUMPDOWN(cache_levels[db->db_level]);
	DBUF_STAT_BUMPDOWN(cache_count);
	DBUF_STAT_DECR(cache_levels_bytes[db->db_level],
	db->db.db_size);
	ASSERT3U(db->db_caching_status, ==, DB_DBUF_CACHE);
	db->db_caching_status = DB_NO_CACHE;
	dbuf_destroy(db);
	DBUF_STAT_BUMP(cache_total_evicts);
	} else {
	multilist_sublist_unlock(mls);
	}
	}

	/*
	* The dbuf evict thread is responsible for aging out dbufs from the
	* cache. Once the cache has reached it's maximum size, dbufs are removed
	* and destroyed. The eviction thread will continue running until the size
	* of the dbuf cache is at or below the maximum size. Once the dbuf is aged
	* out of the cache it is destroyed and becomes eligible for arc eviction.
	*/
	/* ARGSUSED */
	static void
	dbuf_evict_thread(void *unused)
	{
	callb_cpr_t cpr;

	CALLB_CPR_INIT(&cpr, &dbuf_evict_lock, callb_generic_cpr, FTAG);

	mutex_enter(&dbuf_evict_lock);
	while (!dbuf_evict_thread_exit) {
	while (!dbuf_cache_above_lowater() && !dbuf_evict_thread_exit) {
	CALLB_CPR_SAFE_BEGIN(&cpr);
	- (void) cv_timedwait_sig_hires(&dbuf_evict_cv,
	+ (void) cv_timedwait_idle_hires(&dbuf_evict_cv,
	&dbuf_evict_lock, SEC2NSEC(1), MSEC2NSEC(1), 0);
	CALLB_CPR_SAFE_END(&cpr, &dbuf_evict_lock);
	}
	mutex_exit(&dbuf_evict_lock);

	/*
	* Keep evicting as long as we're above the low water mark
	* for the cache. We do this without holding the locks to
	* minimize lock contention.
	*/
	while (dbuf_cache_above_lowater() && !dbuf_evict_thread_exit) {
	dbuf_evict_one();
	}

	mutex_enter(&dbuf_evict_lock);
	}

	dbuf_evict_thread_exit = B_FALSE;
	cv_broadcast(&dbuf_evict_cv);
	CALLB_CPR_EXIT(&cpr); /* drops dbuf_evict_lock */
	thread_exit();
	}

	/*
	* Wake up the dbuf eviction thread if the dbuf cache is at its max size.
	* If the dbuf cache is at its high water mark, then evict a dbuf from the
	* dbuf cache using the callers context.
	*/
	static void
	dbuf_evict_notify(uint64_t size)
	{
	/*
	* We check if we should evict without holding the dbuf_evict_lock,
	* because it's OK to occasionally make the wrong decision here,
	* and grabbing the lock results in massive lock contention.
	*/
	if (size > dbuf_cache_target_bytes()) {
	if (size > dbuf_cache_hiwater_bytes())
	dbuf_evict_one();
	cv_signal(&dbuf_evict_cv);
	}
	}

	static int
	dbuf_kstat_update(kstat_t *ksp, int rw)
	{
	dbuf_stats_t *ds = ksp->ks_data;

	if (rw == KSTAT_WRITE) {
	return (SET_ERROR(EACCES));
	} else {
	ds->metadata_cache_size_bytes.value.ui64 = zfs_refcount_count(
	&dbuf_caches[DB_DBUF_METADATA_CACHE].size);
	ds->cache_size_bytes.value.ui64 =
	zfs_refcount_count(&dbuf_caches[DB_DBUF_CACHE].size);
	ds->cache_target_bytes.value.ui64 = dbuf_cache_target_bytes();
	ds->cache_hiwater_bytes.value.ui64 = dbuf_cache_hiwater_bytes();
	ds->cache_lowater_bytes.value.ui64 = dbuf_cache_lowater_bytes();
	ds->hash_elements.value.ui64 = dbuf_hash_count;
	}

	return (0);
	}

	void
	dbuf_init(void)
	{
	uint64_t hsize = 1ULL << 16;
	dbuf_hash_table_t *h = &dbuf_hash_table;
	int i;

	/*
	* The hash table is big enough to fill all of physical memory
	* with an average block size of zfs_arc_average_blocksize (default 8K).
	* By default, the table will take up
	* totalmem * sizeof(void*) / 8K (1MB per GB with 8-byte pointers).
	*/
	while (hsize * zfs_arc_average_blocksize < physmem * PAGESIZE)
	hsize <<= 1;

	retry:
	h->hash_table_mask = hsize - 1;
	#if defined(_KERNEL)
	/*
	* Large allocations which do not require contiguous pages
	* should be using vmem_alloc() in the linux kernel
	*/
	h->hash_table = vmem_zalloc(hsize * sizeof (void *), KM_SLEEP);
	#else
	h->hash_table = kmem_zalloc(hsize * sizeof (void *), KM_NOSLEEP);
	#endif
	if (h->hash_table == NULL) {
	/* XXX - we should really return an error instead of assert */
	ASSERT(hsize > (1ULL << 10));
	hsize >>= 1;
	goto retry;
	}

	dbuf_kmem_cache = kmem_cache_create("dmu_buf_impl_t",
	sizeof (dmu_buf_impl_t),
	0, dbuf_cons, dbuf_dest, NULL, NULL, NULL, 0);

	for (i = 0; i < DBUF_MUTEXES; i++)
	mutex_init(&h->hash_mutexes[i], NULL, MUTEX_DEFAULT, NULL);

	dbuf_stats_init(h);

	/*
	* All entries are queued via taskq_dispatch_ent(), so min/maxalloc
	* configuration is not required.
	*/
	dbu_evict_taskq = taskq_create("dbu_evict", 1, defclsyspri, 0, 0, 0);

	for (dbuf_cached_state_t dcs = 0; dcs < DB_CACHE_MAX; dcs++) {
	dbuf_caches[dcs].cache =
	multilist_create(sizeof (dmu_buf_impl_t),
	offsetof(dmu_buf_impl_t, db_cache_link),
	dbuf_cache_multilist_index_func);
	zfs_refcount_create(&dbuf_caches[dcs].size);
	}

	dbuf_evict_thread_exit = B_FALSE;
	mutex_init(&dbuf_evict_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&dbuf_evict_cv, NULL, CV_DEFAULT, NULL);
	dbuf_cache_evict_thread = thread_create(NULL, 0, dbuf_evict_thread,
	NULL, 0, &p0, TS_RUN, minclsyspri);

	dbuf_ksp = kstat_create("zfs", 0, "dbufstats", "misc",
	KSTAT_TYPE_NAMED, sizeof (dbuf_stats) / sizeof (kstat_named_t),
	KSTAT_FLAG_VIRTUAL);
	if (dbuf_ksp != NULL) {
	for (i = 0; i < DN_MAX_LEVELS; i++) {
	snprintf(dbuf_stats.cache_levels[i].name,
	KSTAT_STRLEN, "cache_level_%d", i);
	dbuf_stats.cache_levels[i].data_type =
	KSTAT_DATA_UINT64;
	snprintf(dbuf_stats.cache_levels_bytes[i].name,
	KSTAT_STRLEN, "cache_level_%d_bytes", i);
	dbuf_stats.cache_levels_bytes[i].data_type =
	KSTAT_DATA_UINT64;
	}
	dbuf_ksp->ks_data = &dbuf_stats;
	dbuf_ksp->ks_update = dbuf_kstat_update;
	kstat_install(dbuf_ksp);
	}
	}

	void
	dbuf_fini(void)
	{
	dbuf_hash_table_t *h = &dbuf_hash_table;
	int i;

	dbuf_stats_destroy();

	for (i = 0; i < DBUF_MUTEXES; i++)
	mutex_destroy(&h->hash_mutexes[i]);
	#if defined(_KERNEL)
	/*
	* Large allocations which do not require contiguous pages
	* should be using vmem_free() in the linux kernel
	*/
	vmem_free(h->hash_table, (h->hash_table_mask + 1) * sizeof (void *));
	#else
	kmem_free(h->hash_table, (h->hash_table_mask + 1) * sizeof (void *));
	#endif
	kmem_cache_destroy(dbuf_kmem_cache);
	taskq_destroy(dbu_evict_taskq);

	mutex_enter(&dbuf_evict_lock);
	dbuf_evict_thread_exit = B_TRUE;
	while (dbuf_evict_thread_exit) {
	cv_signal(&dbuf_evict_cv);
	cv_wait(&dbuf_evict_cv, &dbuf_evict_lock);
	}
	mutex_exit(&dbuf_evict_lock);

	mutex_destroy(&dbuf_evict_lock);
	cv_destroy(&dbuf_evict_cv);

	for (dbuf_cached_state_t dcs = 0; dcs < DB_CACHE_MAX; dcs++) {
	zfs_refcount_destroy(&dbuf_caches[dcs].size);
	multilist_destroy(dbuf_caches[dcs].cache);
	}

	if (dbuf_ksp != NULL) {
	kstat_delete(dbuf_ksp);
	dbuf_ksp = NULL;
	}
	}

	/*
	* Other stuff.
	*/

	#ifdef ZFS_DEBUG
	static void
	dbuf_verify(dmu_buf_impl_t *db)
	{
	dnode_t *dn;
	dbuf_dirty_record_t *dr;
	uint32_t txg_prev;

	ASSERT(MUTEX_HELD(&db->db_mtx));

	if (!(zfs_flags & ZFS_DEBUG_DBUF_VERIFY))
	return;

	ASSERT(db->db_objset != NULL);
	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	if (dn == NULL) {
	ASSERT(db->db_parent == NULL);
	ASSERT(db->db_blkptr == NULL);
	} else {
	ASSERT3U(db->db.db_object, ==, dn->dn_object);
	ASSERT3P(db->db_objset, ==, dn->dn_objset);
	ASSERT3U(db->db_level, <, dn->dn_nlevels);
	ASSERT(db->db_blkid == DMU_BONUS_BLKID \|\|
	db->db_blkid == DMU_SPILL_BLKID \|\|
	!avl_is_empty(&dn->dn_dbufs));
	}
	if (db->db_blkid == DMU_BONUS_BLKID) {
	ASSERT(dn != NULL);
	ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
	ASSERT3U(db->db.db_offset, ==, DMU_BONUS_BLKID);
	} else if (db->db_blkid == DMU_SPILL_BLKID) {
	ASSERT(dn != NULL);
	ASSERT0(db->db.db_offset);
	} else {
	ASSERT3U(db->db.db_offset, ==, db->db_blkid * db->db.db_size);
	}

	if ((dr = list_head(&db->db_dirty_records)) != NULL) {
	ASSERT(dr->dr_dbuf == db);
	txg_prev = dr->dr_txg;
	for (dr = list_next(&db->db_dirty_records, dr); dr != NULL;
	dr = list_next(&db->db_dirty_records, dr)) {
	ASSERT(dr->dr_dbuf == db);
	ASSERT(txg_prev > dr->dr_txg);
	txg_prev = dr->dr_txg;
	}
	}

	/*
	* We can't assert that db_size matches dn_datablksz because it
	* can be momentarily different when another thread is doing
	* dnode_set_blksz().
	*/
	if (db->db_level == 0 && db->db.db_object == DMU_META_DNODE_OBJECT) {
	dr = db->db_data_pending;
	/*
	* It should only be modified in syncing context, so
	* make sure we only have one copy of the data.
	*/
	ASSERT(dr == NULL \|\| dr->dt.dl.dr_data == db->db_buf);
	}

	/* verify db->db_blkptr */
	if (db->db_blkptr) {
	if (db->db_parent == dn->dn_dbuf) {
	/* db is pointed to by the dnode */
	/* ASSERT3U(db->db_blkid, <, dn->dn_nblkptr); */
	if (DMU_OBJECT_IS_SPECIAL(db->db.db_object))
	ASSERT(db->db_parent == NULL);
	else
	ASSERT(db->db_parent != NULL);
	if (db->db_blkid != DMU_SPILL_BLKID)
	ASSERT3P(db->db_blkptr, ==,
	&dn->dn_phys->dn_blkptr[db->db_blkid]);
	} else {
	/* db is pointed to by an indirect block */
	int epb __maybe_unused = db->db_parent->db.db_size >>
	SPA_BLKPTRSHIFT;
	ASSERT3U(db->db_parent->db_level, ==, db->db_level+1);
	ASSERT3U(db->db_parent->db.db_object, ==,
	db->db.db_object);
	/*
	* dnode_grow_indblksz() can make this fail if we don't
	* have the parent's rwlock. XXX indblksz no longer
	* grows. safe to do this now?
	*/
	if (RW_LOCK_HELD(&db->db_parent->db_rwlock)) {
	ASSERT3P(db->db_blkptr, ==,
	((blkptr_t *)db->db_parent->db.db_data +
	db->db_blkid % epb));
	}
	}
	}
	if ((db->db_blkptr == NULL \|\| BP_IS_HOLE(db->db_blkptr)) &&
	(db->db_buf == NULL \|\| db->db_buf->b_data) &&
	db->db.db_data && db->db_blkid != DMU_BONUS_BLKID &&
	db->db_state != DB_FILL && !dn->dn_free_txg) {
	/*
	* If the blkptr isn't set but they have nonzero data,
	* it had better be dirty, otherwise we'll lose that
	* data when we evict this buffer.
	*
	* There is an exception to this rule for indirect blocks; in
	* this case, if the indirect block is a hole, we fill in a few
	* fields on each of the child blocks (importantly, birth time)
	* to prevent hole birth times from being lost when you
	* partially fill in a hole.
	*/
	if (db->db_dirtycnt == 0) {
	if (db->db_level == 0) {
	uint64_t *buf = db->db.db_data;
	int i;

	for (i = 0; i < db->db.db_size >> 3; i++) {
	ASSERT(buf[i] == 0);
	}
	} else {
	blkptr_t *bps = db->db.db_data;
	ASSERT3U(1 << DB_DNODE(db)->dn_indblkshift, ==,
	db->db.db_size);
	/*
	* We want to verify that all the blkptrs in the
	* indirect block are holes, but we may have
	* automatically set up a few fields for them.
	* We iterate through each blkptr and verify
	* they only have those fields set.
	*/
	for (int i = 0;
	i < db->db.db_size / sizeof (blkptr_t);
	i++) {
	blkptr_t *bp = &bps[i];
	ASSERT(ZIO_CHECKSUM_IS_ZERO(
	&bp->blk_cksum));
	ASSERT(
	DVA_IS_EMPTY(&bp->blk_dva[0]) &&
	DVA_IS_EMPTY(&bp->blk_dva[1]) &&
	DVA_IS_EMPTY(&bp->blk_dva[2]));
	ASSERT0(bp->blk_fill);
	ASSERT0(bp->blk_pad[0]);
	ASSERT0(bp->blk_pad[1]);
	ASSERT(!BP_IS_EMBEDDED(bp));
	ASSERT(BP_IS_HOLE(bp));
	ASSERT0(bp->blk_phys_birth);
	}
	}
	}
	}
	DB_DNODE_EXIT(db);
	}
	#endif

	static void
	dbuf_clear_data(dmu_buf_impl_t *db)
	{
	ASSERT(MUTEX_HELD(&db->db_mtx));
	dbuf_evict_user(db);
	ASSERT3P(db->db_buf, ==, NULL);
	db->db.db_data = NULL;
	if (db->db_state != DB_NOFILL) {
	db->db_state = DB_UNCACHED;
	DTRACE_SET_STATE(db, "clear data");
	}
	}

	static void
	dbuf_set_data(dmu_buf_impl_t db, arc_buf_t buf)
	{
	ASSERT(MUTEX_HELD(&db->db_mtx));
	ASSERT(buf != NULL);

	db->db_buf = buf;
	ASSERT(buf->b_data != NULL);
	db->db.db_data = buf->b_data;
	}

	static arc_buf_t *
	dbuf_alloc_arcbuf_from_arcbuf(dmu_buf_impl_t db, arc_buf_t data)
	{
	objset_t *os = db->db_objset;
	spa_t *spa = os->os_spa;
	arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
	enum zio_compress compress_type;
	uint8_t complevel;
	int psize, lsize;

	psize = arc_buf_size(data);
	lsize = arc_buf_lsize(data);
	compress_type = arc_get_compression(data);
	complevel = arc_get_complevel(data);

	if (arc_is_encrypted(data)) {
	boolean_t byteorder;
	uint8_t salt[ZIO_DATA_SALT_LEN];
	uint8_t iv[ZIO_DATA_IV_LEN];
	uint8_t mac[ZIO_DATA_MAC_LEN];
	dnode_t *dn = DB_DNODE(db);

	arc_get_raw_params(data, &byteorder, salt, iv, mac);
	data = arc_alloc_raw_buf(spa, db, dmu_objset_id(os),
	byteorder, salt, iv, mac, dn->dn_type, psize, lsize,
	compress_type, complevel);
	} else if (compress_type != ZIO_COMPRESS_OFF) {
	ASSERT3U(type, ==, ARC_BUFC_DATA);
	data = arc_alloc_compressed_buf(spa, db,
	psize, lsize, compress_type, complevel);
	} else {
	data = arc_alloc_buf(spa, db, type, psize);
	}
	return (data);
	}

	static arc_buf_t *
	dbuf_alloc_arcbuf(dmu_buf_impl_t *db)
	{
	spa_t *spa = db->db_objset->os_spa;

	return (arc_alloc_buf(spa, db, DBUF_GET_BUFC_TYPE(db), db->db.db_size));
	}

	/*
	* Loan out an arc_buf for read. Return the loaned arc_buf.
	*/
	arc_buf_t *
	dbuf_loan_arcbuf(dmu_buf_impl_t *db)
	{
	arc_buf_t *abuf;

	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
	mutex_enter(&db->db_mtx);
	if (arc_released(db->db_buf) \|\| zfs_refcount_count(&db->db_holds) > 1) {
	int blksz = db->db.db_size;
	spa_t *spa = db->db_objset->os_spa;

	mutex_exit(&db->db_mtx);
	abuf = arc_loan_buf(spa, B_FALSE, blksz);
	bcopy(db->db.db_data, abuf->b_data, blksz);
	} else {
	abuf = db->db_buf;
	arc_loan_inuse_buf(abuf, db);
	db->db_buf = NULL;
	dbuf_clear_data(db);
	mutex_exit(&db->db_mtx);
	}
	return (abuf);
	}

	/*
	* Calculate which level n block references the data at the level 0 offset
	* provided.
	*/
	uint64_t
	dbuf_whichblock(const dnode_t *dn, const int64_t level, const uint64_t offset)
	{
	if (dn->dn_datablkshift != 0 && dn->dn_indblkshift != 0) {
	/*
	* The level n blkid is equal to the level 0 blkid divided by
	* the number of level 0s in a level n block.
	*
	* The level 0 blkid is offset >> datablkshift =
	* offset / 2^datablkshift.
	*
	* The number of level 0s in a level n is the number of block
	* pointers in an indirect block, raised to the power of level.
	* This is 2^(indblkshift - SPA_BLKPTRSHIFT)^level =
	* 2^(level*(indblkshift - SPA_BLKPTRSHIFT)).
	*
	* Thus, the level n blkid is: offset /
	* ((2^datablkshift)(2^(level(indblkshift-SPA_BLKPTRSHIFT))))
	* = offset / 2^(datablkshift + level *
	* (indblkshift - SPA_BLKPTRSHIFT))
	* = offset >> (datablkshift + level *
	* (indblkshift - SPA_BLKPTRSHIFT))
	*/

	const unsigned exp = dn->dn_datablkshift +
	level * (dn->dn_indblkshift - SPA_BLKPTRSHIFT);

	if (exp >= 8 * sizeof (offset)) {
	/* This only happens on the highest indirection level */
	ASSERT3U(level, ==, dn->dn_nlevels - 1);
	return (0);
	}

	ASSERT3U(exp, <, 8 * sizeof (offset));

	return (offset >> exp);
	} else {
	ASSERT3U(offset, <, dn->dn_datablksz);
	return (0);
	}
	}

	/*
	* This function is used to lock the parent of the provided dbuf. This should be
	* used when modifying or reading db_blkptr.
	*/
	db_lock_type_t
	dmu_buf_lock_parent(dmu_buf_impl_t db, krw_t rw, void tag)
	{
	enum db_lock_type ret = DLT_NONE;
	if (db->db_parent != NULL) {
	rw_enter(&db->db_parent->db_rwlock, rw);
	ret = DLT_PARENT;
	} else if (dmu_objset_ds(db->db_objset) != NULL) {
	rrw_enter(&dmu_objset_ds(db->db_objset)->ds_bp_rwlock, rw,
	tag);
	ret = DLT_OBJSET;
	}
	/*
	* We only return a DLT_NONE lock when it's the top-most indirect block
	* of the meta-dnode of the MOS.
	*/
	return (ret);
	}

	/*
	* We need to pass the lock type in because it's possible that the block will
	* move from being the topmost indirect block in a dnode (and thus, have no
	* parent) to not the top-most via an indirection increase. This would cause a
	* panic if we didn't pass the lock type in.
	*/
	void
	dmu_buf_unlock_parent(dmu_buf_impl_t db, db_lock_type_t type, void tag)
	{
	if (type == DLT_PARENT)
	rw_exit(&db->db_parent->db_rwlock);
	else if (type == DLT_OBJSET)
	rrw_exit(&dmu_objset_ds(db->db_objset)->ds_bp_rwlock, tag);
	}

	static void
	dbuf_read_done(zio_t zio, const zbookmark_phys_t zb, const blkptr_t *bp,
	arc_buf_t buf, void vdb)
	{
	dmu_buf_impl_t *db = vdb;

	mutex_enter(&db->db_mtx);
	ASSERT3U(db->db_state, ==, DB_READ);
	/*
	* All reads are synchronous, so we must have a hold on the dbuf
	*/
	ASSERT(zfs_refcount_count(&db->db_holds) > 0);
	ASSERT(db->db_buf == NULL);
	ASSERT(db->db.db_data == NULL);
	if (buf == NULL) {
	/* i/o error */
	ASSERT(zio == NULL \|\| zio->io_error != 0);
	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
	ASSERT3P(db->db_buf, ==, NULL);
	db->db_state = DB_UNCACHED;
	DTRACE_SET_STATE(db, "i/o error");
	} else if (db->db_level == 0 && db->db_freed_in_flight) {
	/* freed in flight */
	ASSERT(zio == NULL \|\| zio->io_error == 0);
	arc_release(buf, db);
	bzero(buf->b_data, db->db.db_size);
	arc_buf_freeze(buf);
	db->db_freed_in_flight = FALSE;
	dbuf_set_data(db, buf);
	db->db_state = DB_CACHED;
	DTRACE_SET_STATE(db, "freed in flight");
	} else {
	/* success */
	ASSERT(zio == NULL \|\| zio->io_error == 0);
	dbuf_set_data(db, buf);
	db->db_state = DB_CACHED;
	DTRACE_SET_STATE(db, "successful read");
	}
	cv_broadcast(&db->db_changed);
	dbuf_rele_and_unlock(db, NULL, B_FALSE);
	}

	/*
	* Shortcut for performing reads on bonus dbufs. Returns
	* an error if we fail to verify the dnode associated with
	* a decrypted block. Otherwise success.
	*/
	static int
	dbuf_read_bonus(dmu_buf_impl_t db, dnode_t dn, uint32_t flags)
	{
	int bonuslen, max_bonuslen, err;

	err = dbuf_read_verify_dnode_crypt(db, flags);
	if (err)
	return (err);

	bonuslen = MIN(dn->dn_bonuslen, dn->dn_phys->dn_bonuslen);
	max_bonuslen = DN_SLOTS_TO_BONUSLEN(dn->dn_num_slots);
	ASSERT(MUTEX_HELD(&db->db_mtx));
	ASSERT(DB_DNODE_HELD(db));
	ASSERT3U(bonuslen, <=, db->db.db_size);
	db->db.db_data = kmem_alloc(max_bonuslen, KM_SLEEP);
	arc_space_consume(max_bonuslen, ARC_SPACE_BONUS);
	if (bonuslen < max_bonuslen)
	bzero(db->db.db_data, max_bonuslen);
	if (bonuslen)
	bcopy(DN_BONUS(dn->dn_phys), db->db.db_data, bonuslen);
	db->db_state = DB_CACHED;
	DTRACE_SET_STATE(db, "bonus buffer filled");
	return (0);
	}

	static void
	dbuf_handle_indirect_hole(dmu_buf_impl_t db, dnode_t dn)
	{
	blkptr_t *bps = db->db.db_data;
	uint32_t indbs = 1ULL << dn->dn_indblkshift;
	int n_bps = indbs >> SPA_BLKPTRSHIFT;

	for (int i = 0; i < n_bps; i++) {
	blkptr_t *bp = &bps[i];

	ASSERT3U(BP_GET_LSIZE(db->db_blkptr), ==, indbs);
	BP_SET_LSIZE(bp, BP_GET_LEVEL(db->db_blkptr) == 1 ?
	dn->dn_datablksz : BP_GET_LSIZE(db->db_blkptr));
	BP_SET_TYPE(bp, BP_GET_TYPE(db->db_blkptr));
	BP_SET_LEVEL(bp, BP_GET_LEVEL(db->db_blkptr) - 1);
	BP_SET_BIRTH(bp, db->db_blkptr->blk_birth, 0);
	}
	}

	/*
	* Handle reads on dbufs that are holes, if necessary. This function
	* requires that the dbuf's mutex is held. Returns success (0) if action
	* was taken, ENOENT if no action was taken.
	*/
	static int
	dbuf_read_hole(dmu_buf_impl_t db, dnode_t dn, uint32_t flags)
	{
	ASSERT(MUTEX_HELD(&db->db_mtx));

	int is_hole = db->db_blkptr == NULL \|\| BP_IS_HOLE(db->db_blkptr);
	/*
	* For level 0 blocks only, if the above check fails:
	* Recheck BP_IS_HOLE() after dnode_block_freed() in case dnode_sync()
	* processes the delete record and clears the bp while we are waiting
	* for the dn_mtx (resulting in a "no" from block_freed).
	*/
	if (!is_hole && db->db_level == 0) {
	is_hole = dnode_block_freed(dn, db->db_blkid) \|\|
	BP_IS_HOLE(db->db_blkptr);
	}

	if (is_hole) {
	dbuf_set_data(db, dbuf_alloc_arcbuf(db));
	bzero(db->db.db_data, db->db.db_size);

	if (db->db_blkptr != NULL && db->db_level > 0 &&
	BP_IS_HOLE(db->db_blkptr) &&
	db->db_blkptr->blk_birth != 0) {
	dbuf_handle_indirect_hole(db, dn);
	}
	db->db_state = DB_CACHED;
	DTRACE_SET_STATE(db, "hole read satisfied");
	return (0);
	}
	return (ENOENT);
	}

	/*
	* This function ensures that, when doing a decrypting read of a block,
	* we make sure we have decrypted the dnode associated with it. We must do
	* this so that we ensure we are fully authenticating the checksum-of-MACs
	* tree from the root of the objset down to this block. Indirect blocks are
	* always verified against their secure checksum-of-MACs assuming that the
	* dnode containing them is correct. Now that we are doing a decrypting read,
	* we can be sure that the key is loaded and verify that assumption. This is
	* especially important considering that we always read encrypted dnode
	* blocks as raw data (without verifying their MACs) to start, and
	* decrypt / authenticate them when we need to read an encrypted bonus buffer.
	*/
	static int
	dbuf_read_verify_dnode_crypt(dmu_buf_impl_t *db, uint32_t flags)
	{
	int err = 0;
	objset_t *os = db->db_objset;
	arc_buf_t *dnode_abuf;
	dnode_t *dn;
	zbookmark_phys_t zb;

	ASSERT(MUTEX_HELD(&db->db_mtx));

	if (!os->os_encrypted \|\| os->os_raw_receive \|\|
	(flags & DB_RF_NO_DECRYPT) != 0)
	return (0);

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	dnode_abuf = (dn->dn_dbuf != NULL) ? dn->dn_dbuf->db_buf : NULL;

	if (dnode_abuf == NULL \|\| !arc_is_encrypted(dnode_abuf)) {
	DB_DNODE_EXIT(db);
	return (0);
	}

	SET_BOOKMARK(&zb, dmu_objset_id(os),
	DMU_META_DNODE_OBJECT, 0, dn->dn_dbuf->db_blkid);
	err = arc_untransform(dnode_abuf, os->os_spa, &zb, B_TRUE);

	/*
	* An error code of EACCES tells us that the key is still not
	* available. This is ok if we are only reading authenticated
	* (and therefore non-encrypted) blocks.
	*/
	if (err == EACCES && ((db->db_blkid != DMU_BONUS_BLKID &&
	!DMU_OT_IS_ENCRYPTED(dn->dn_type)) \|\|
	(db->db_blkid == DMU_BONUS_BLKID &&
	!DMU_OT_IS_ENCRYPTED(dn->dn_bonustype))))
	err = 0;

	DB_DNODE_EXIT(db);

	return (err);
	}

	/*
	* Drops db_mtx and the parent lock specified by dblt and tag before
	* returning.
	*/
	static int
	dbuf_read_impl(dmu_buf_impl_t db, zio_t zio, uint32_t flags,
	db_lock_type_t dblt, void *tag)
	{
	dnode_t *dn;
	zbookmark_phys_t zb;
	uint32_t aflags = ARC_FLAG_NOWAIT;
	int err, zio_flags;
	boolean_t bonus_read;

	err = zio_flags = 0;
	bonus_read = B_FALSE;
	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	ASSERT(!zfs_refcount_is_zero(&db->db_holds));
	ASSERT(MUTEX_HELD(&db->db_mtx));
	ASSERT(db->db_state == DB_UNCACHED);
	ASSERT(db->db_buf == NULL);
	ASSERT(db->db_parent == NULL \|\|
	RW_LOCK_HELD(&db->db_parent->db_rwlock));

	if (db->db_blkid == DMU_BONUS_BLKID) {
	err = dbuf_read_bonus(db, dn, flags);
	goto early_unlock;
	}

	err = dbuf_read_hole(db, dn, flags);
	if (err == 0)
	goto early_unlock;

	/*
	* Any attempt to read a redacted block should result in an error. This
	* will never happen under normal conditions, but can be useful for
	* debugging purposes.
	*/
	if (BP_IS_REDACTED(db->db_blkptr)) {
	ASSERT(dsl_dataset_feature_is_active(
	db->db_objset->os_dsl_dataset,
	SPA_FEATURE_REDACTED_DATASETS));
	err = SET_ERROR(EIO);
	goto early_unlock;
	}

	SET_BOOKMARK(&zb, dmu_objset_id(db->db_objset),
	db->db.db_object, db->db_level, db->db_blkid);

	/*
	* All bps of an encrypted os should have the encryption bit set.
	* If this is not true it indicates tampering and we report an error.
	*/
	if (db->db_objset->os_encrypted && !BP_USES_CRYPT(db->db_blkptr)) {
	spa_log_error(db->db_objset->os_spa, &zb);
	zfs_panic_recover("unencrypted block in encrypted "
	"object set %llu", dmu_objset_id(db->db_objset));
	err = SET_ERROR(EIO);
	goto early_unlock;
	}

	err = dbuf_read_verify_dnode_crypt(db, flags);
	if (err != 0)
	goto early_unlock;

	DB_DNODE_EXIT(db);

	db->db_state = DB_READ;
	DTRACE_SET_STATE(db, "read issued");
	mutex_exit(&db->db_mtx);

	if (DBUF_IS_L2CACHEABLE(db))
	aflags \|= ARC_FLAG_L2CACHE;

	dbuf_add_ref(db, NULL);

	zio_flags = (flags & DB_RF_CANFAIL) ?
	ZIO_FLAG_CANFAIL : ZIO_FLAG_MUSTSUCCEED;

	if ((flags & DB_RF_NO_DECRYPT) && BP_IS_PROTECTED(db->db_blkptr))
	zio_flags \|= ZIO_FLAG_RAW;
	/*
	* The zio layer will copy the provided blkptr later, but we need to
	* do this now so that we can release the parent's rwlock. We have to
	* do that now so that if dbuf_read_done is called synchronously (on
	* an l1 cache hit) we don't acquire the db_mtx while holding the
	* parent's rwlock, which would be a lock ordering violation.
	*/
	blkptr_t bp = *db->db_blkptr;
	dmu_buf_unlock_parent(db, dblt, tag);
	(void) arc_read(zio, db->db_objset->os_spa, &bp,
	dbuf_read_done, db, ZIO_PRIORITY_SYNC_READ, zio_flags,
	&aflags, &zb);
	return (err);
	early_unlock:
	DB_DNODE_EXIT(db);
	mutex_exit(&db->db_mtx);
	dmu_buf_unlock_parent(db, dblt, tag);
	return (err);
	}

	/*
	* This is our just-in-time copy function. It makes a copy of buffers that
	* have been modified in a previous transaction group before we access them in
	* the current active group.
	*
	* This function is used in three places: when we are dirtying a buffer for the
	* first time in a txg, when we are freeing a range in a dnode that includes
	* this buffer, and when we are accessing a buffer which was received compressed
	* and later referenced in a WRITE_BYREF record.
	*
	* Note that when we are called from dbuf_free_range() we do not put a hold on
	* the buffer, we just traverse the active dbuf list for the dnode.
	*/
	static void
	dbuf_fix_old_data(dmu_buf_impl_t *db, uint64_t txg)
	{
	dbuf_dirty_record_t *dr = list_head(&db->db_dirty_records);

	ASSERT(MUTEX_HELD(&db->db_mtx));
	ASSERT(db->db.db_data != NULL);
	ASSERT(db->db_level == 0);
	ASSERT(db->db.db_object != DMU_META_DNODE_OBJECT);

	if (dr == NULL \|\|
	(dr->dt.dl.dr_data !=
	((db->db_blkid == DMU_BONUS_BLKID) ? db->db.db_data : db->db_buf)))
	return;

	/*
	* If the last dirty record for this dbuf has not yet synced
	* and its referencing the dbuf data, either:
	* reset the reference to point to a new copy,
	* or (if there a no active holders)
	* just null out the current db_data pointer.
	*/
	ASSERT3U(dr->dr_txg, >=, txg - 2);
	if (db->db_blkid == DMU_BONUS_BLKID) {
	dnode_t *dn = DB_DNODE(db);
	int bonuslen = DN_SLOTS_TO_BONUSLEN(dn->dn_num_slots);
	dr->dt.dl.dr_data = kmem_alloc(bonuslen, KM_SLEEP);
	arc_space_consume(bonuslen, ARC_SPACE_BONUS);
	bcopy(db->db.db_data, dr->dt.dl.dr_data, bonuslen);
	} else if (zfs_refcount_count(&db->db_holds) > db->db_dirtycnt) {
	arc_buf_t *buf = dbuf_alloc_arcbuf_from_arcbuf(db, db->db_buf);
	dr->dt.dl.dr_data = buf;
	bcopy(db->db.db_data, buf->b_data, arc_buf_size(buf));
	} else {
	db->db_buf = NULL;
	dbuf_clear_data(db);
	}
	}

	int
	dbuf_read(dmu_buf_impl_t db, zio_t zio, uint32_t flags)
	{
	int err = 0;
	boolean_t prefetch;
	dnode_t *dn;

	/*
	* We don't have to hold the mutex to check db_state because it
	* can't be freed while we have a hold on the buffer.
	*/
	ASSERT(!zfs_refcount_is_zero(&db->db_holds));

	if (db->db_state == DB_NOFILL)
	return (SET_ERROR(EIO));

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);

	prefetch = db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
	(flags & DB_RF_NOPREFETCH) == 0 && dn != NULL &&
	DBUF_IS_CACHEABLE(db);

	mutex_enter(&db->db_mtx);
	if (db->db_state == DB_CACHED) {
	spa_t *spa = dn->dn_objset->os_spa;

	/*
	* Ensure that this block's dnode has been decrypted if
	* the caller has requested decrypted data.
	*/
	err = dbuf_read_verify_dnode_crypt(db, flags);

	/*
	* If the arc buf is compressed or encrypted and the caller
	* requested uncompressed data, we need to untransform it
	* before returning. We also call arc_untransform() on any
	* unauthenticated blocks, which will verify their MAC if
	* the key is now available.
	*/
	if (err == 0 && db->db_buf != NULL &&
	(flags & DB_RF_NO_DECRYPT) == 0 &&
	(arc_is_encrypted(db->db_buf) \|\|
	arc_is_unauthenticated(db->db_buf) \|\|
	arc_get_compression(db->db_buf) != ZIO_COMPRESS_OFF)) {
	zbookmark_phys_t zb;

	SET_BOOKMARK(&zb, dmu_objset_id(db->db_objset),
	db->db.db_object, db->db_level, db->db_blkid);
	dbuf_fix_old_data(db, spa_syncing_txg(spa));
	err = arc_untransform(db->db_buf, spa, &zb, B_FALSE);
	dbuf_set_data(db, db->db_buf);
	}
	mutex_exit(&db->db_mtx);
	if (err == 0 && prefetch) {
	dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1, B_TRUE,
	flags & DB_RF_HAVESTRUCT);
	}
	DB_DNODE_EXIT(db);
	DBUF_STAT_BUMP(hash_hits);
	} else if (db->db_state == DB_UNCACHED) {
	spa_t *spa = dn->dn_objset->os_spa;
	boolean_t need_wait = B_FALSE;

	db_lock_type_t dblt = dmu_buf_lock_parent(db, RW_READER, FTAG);

	if (zio == NULL &&
	db->db_blkptr != NULL && !BP_IS_HOLE(db->db_blkptr)) {
	zio = zio_root(spa, NULL, NULL, ZIO_FLAG_CANFAIL);
	need_wait = B_TRUE;
	}
	err = dbuf_read_impl(db, zio, flags, dblt, FTAG);
	/*
	* dbuf_read_impl has dropped db_mtx and our parent's rwlock
	* for us
	*/
	if (!err && prefetch) {
	dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1, B_TRUE,
	flags & DB_RF_HAVESTRUCT);
	}

	DB_DNODE_EXIT(db);
	DBUF_STAT_BUMP(hash_misses);

	/*
	* If we created a zio_root we must execute it to avoid
	* leaking it, even if it isn't attached to any work due
	* to an error in dbuf_read_impl().
	*/
	if (need_wait) {
	if (err == 0)
	err = zio_wait(zio);
	else
	VERIFY0(zio_wait(zio));
	}
	} else {
	/*
	* Another reader came in while the dbuf was in flight
	* between UNCACHED and CACHED. Either a writer will finish
	* writing the buffer (sending the dbuf to CACHED) or the
	* first reader's request will reach the read_done callback
	* and send the dbuf to CACHED. Otherwise, a failure
	* occurred and the dbuf went to UNCACHED.
	*/
	mutex_exit(&db->db_mtx);
	if (prefetch) {
	dmu_zfetch(&dn->dn_zfetch, db->db_blkid, 1, B_TRUE,
	flags & DB_RF_HAVESTRUCT);
	}
	DB_DNODE_EXIT(db);
	DBUF_STAT_BUMP(hash_misses);

	/* Skip the wait per the caller's request. */
	if ((flags & DB_RF_NEVERWAIT) == 0) {
	mutex_enter(&db->db_mtx);
	while (db->db_state == DB_READ \|\|
	db->db_state == DB_FILL) {
	ASSERT(db->db_state == DB_READ \|\|
	(flags & DB_RF_HAVESTRUCT) == 0);
	DTRACE_PROBE2(blocked__read, dmu_buf_impl_t *,
	db, zio_t *, zio);
	cv_wait(&db->db_changed, &db->db_mtx);
	}
	if (db->db_state == DB_UNCACHED)
	err = SET_ERROR(EIO);
	mutex_exit(&db->db_mtx);
	}
	}

	return (err);
	}

	static void
	dbuf_noread(dmu_buf_impl_t *db)
	{
	ASSERT(!zfs_refcount_is_zero(&db->db_holds));
	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
	mutex_enter(&db->db_mtx);
	while (db->db_state == DB_READ \|\| db->db_state == DB_FILL)
	cv_wait(&db->db_changed, &db->db_mtx);
	if (db->db_state == DB_UNCACHED) {
	ASSERT(db->db_buf == NULL);
	ASSERT(db->db.db_data == NULL);
	dbuf_set_data(db, dbuf_alloc_arcbuf(db));
	db->db_state = DB_FILL;
	DTRACE_SET_STATE(db, "assigning filled buffer");
	} else if (db->db_state == DB_NOFILL) {
	dbuf_clear_data(db);
	} else {
	ASSERT3U(db->db_state, ==, DB_CACHED);
	}
	mutex_exit(&db->db_mtx);
	}

	void
	dbuf_unoverride(dbuf_dirty_record_t *dr)
	{
	dmu_buf_impl_t *db = dr->dr_dbuf;
	blkptr_t *bp = &dr->dt.dl.dr_overridden_by;
	uint64_t txg = dr->dr_txg;

	ASSERT(MUTEX_HELD(&db->db_mtx));
	/*
	* This assert is valid because dmu_sync() expects to be called by
	* a zilog's get_data while holding a range lock. This call only
	* comes from dbuf_dirty() callers who must also hold a range lock.
	*/
	ASSERT(dr->dt.dl.dr_override_state != DR_IN_DMU_SYNC);
	ASSERT(db->db_level == 0);

	if (db->db_blkid == DMU_BONUS_BLKID \|\|
	dr->dt.dl.dr_override_state == DR_NOT_OVERRIDDEN)
	return;

	ASSERT(db->db_data_pending != dr);

	/* free this block */
	if (!BP_IS_HOLE(bp) && !dr->dt.dl.dr_nopwrite)
	zio_free(db->db_objset->os_spa, txg, bp);

	dr->dt.dl.dr_override_state = DR_NOT_OVERRIDDEN;
	dr->dt.dl.dr_nopwrite = B_FALSE;
	dr->dt.dl.dr_has_raw_params = B_FALSE;

	/*
	* Release the already-written buffer, so we leave it in
	* a consistent dirty state. Note that all callers are
	* modifying the buffer, so they will immediately do
	* another (redundant) arc_release(). Therefore, leave
	* the buf thawed to save the effort of freezing &
	* immediately re-thawing it.
	*/
	arc_release(dr->dt.dl.dr_data, db);
	}

	/*
	* Evict (if its unreferenced) or clear (if its referenced) any level-0
	* data blocks in the free range, so that any future readers will find
	* empty blocks.
	*/
	void
	dbuf_free_range(dnode_t *dn, uint64_t start_blkid, uint64_t end_blkid,
	dmu_tx_t *tx)
	{
	dmu_buf_impl_t *db_search;
	dmu_buf_impl_t db, db_next;
	uint64_t txg = tx->tx_txg;
	avl_index_t where;
	dbuf_dirty_record_t *dr;

	if (end_blkid > dn->dn_maxblkid &&
	!(start_blkid == DMU_SPILL_BLKID \|\| end_blkid == DMU_SPILL_BLKID))
	end_blkid = dn->dn_maxblkid;
	dprintf_dnode(dn, "start=%llu end=%llu\n", start_blkid, end_blkid);

	db_search = kmem_alloc(sizeof (dmu_buf_impl_t), KM_SLEEP);
	db_search->db_level = 0;
	db_search->db_blkid = start_blkid;
	db_search->db_state = DB_SEARCH;

	mutex_enter(&dn->dn_dbufs_mtx);
	db = avl_find(&dn->dn_dbufs, db_search, &where);
	ASSERT3P(db, ==, NULL);

	db = avl_nearest(&dn->dn_dbufs, where, AVL_AFTER);

	for (; db != NULL; db = db_next) {
	db_next = AVL_NEXT(&dn->dn_dbufs, db);
	ASSERT(db->db_blkid != DMU_BONUS_BLKID);

	if (db->db_level != 0 \|\| db->db_blkid > end_blkid) {
	break;
	}
	ASSERT3U(db->db_blkid, >=, start_blkid);

	/* found a level 0 buffer in the range */
	mutex_enter(&db->db_mtx);
	if (dbuf_undirty(db, tx)) {
	/* mutex has been dropped and dbuf destroyed */
	continue;
	}

	if (db->db_state == DB_UNCACHED \|\|
	db->db_state == DB_NOFILL \|\|
	db->db_state == DB_EVICTING) {
	ASSERT(db->db.db_data == NULL);
	mutex_exit(&db->db_mtx);
	continue;
	}
	if (db->db_state == DB_READ \|\| db->db_state == DB_FILL) {
	/* will be handled in dbuf_read_done or dbuf_rele */
	db->db_freed_in_flight = TRUE;
	mutex_exit(&db->db_mtx);
	continue;
	}
	if (zfs_refcount_count(&db->db_holds) == 0) {
	ASSERT(db->db_buf);
	dbuf_destroy(db);
	continue;
	}
	/* The dbuf is referenced */

	dr = list_head(&db->db_dirty_records);
	if (dr != NULL) {
	if (dr->dr_txg == txg) {
	/*
	* This buffer is "in-use", re-adjust the file
	* size to reflect that this buffer may
	* contain new data when we sync.
	*/
	if (db->db_blkid != DMU_SPILL_BLKID &&
	db->db_blkid > dn->dn_maxblkid)
	dn->dn_maxblkid = db->db_blkid;
	dbuf_unoverride(dr);
	} else {
	/*
	* This dbuf is not dirty in the open context.
	* Either uncache it (if its not referenced in
	* the open context) or reset its contents to
	* empty.
	*/
	dbuf_fix_old_data(db, txg);
	}
	}
	/* clear the contents if its cached */
	if (db->db_state == DB_CACHED) {
	ASSERT(db->db.db_data != NULL);
	arc_release(db->db_buf, db);
	rw_enter(&db->db_rwlock, RW_WRITER);
	bzero(db->db.db_data, db->db.db_size);
	rw_exit(&db->db_rwlock);
	arc_buf_freeze(db->db_buf);
	}

	mutex_exit(&db->db_mtx);
	}

	kmem_free(db_search, sizeof (dmu_buf_impl_t));
	mutex_exit(&dn->dn_dbufs_mtx);
	}

	void
	dbuf_new_size(dmu_buf_impl_t db, int size, dmu_tx_t tx)
	{
	arc_buf_t buf, old_buf;
	dbuf_dirty_record_t *dr;
	int osize = db->db.db_size;
	arc_buf_contents_t type = DBUF_GET_BUFC_TYPE(db);
	dnode_t *dn;

	ASSERT(db->db_blkid != DMU_BONUS_BLKID);

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);

	/*
	* XXX we should be doing a dbuf_read, checking the return
	* value and returning that up to our callers
	*/
	dmu_buf_will_dirty(&db->db, tx);

	/* create the data buffer for the new block */
	buf = arc_alloc_buf(dn->dn_objset->os_spa, db, type, size);

	/* copy old block data to the new block */
	old_buf = db->db_buf;
	bcopy(old_buf->b_data, buf->b_data, MIN(osize, size));
	/* zero the remainder */
	if (size > osize)
	bzero((uint8_t *)buf->b_data + osize, size - osize);

	mutex_enter(&db->db_mtx);
	dbuf_set_data(db, buf);
	arc_buf_destroy(old_buf, db);
	db->db.db_size = size;

	dr = list_head(&db->db_dirty_records);
	/* dirty record added by dmu_buf_will_dirty() */
	VERIFY(dr != NULL);
	if (db->db_level == 0)
	dr->dt.dl.dr_data = buf;
	ASSERT3U(dr->dr_txg, ==, tx->tx_txg);
	ASSERT3U(dr->dr_accounted, ==, osize);
	dr->dr_accounted = size;
	mutex_exit(&db->db_mtx);

	dmu_objset_willuse_space(dn->dn_objset, size - osize, tx);
	DB_DNODE_EXIT(db);
	}

	void
	dbuf_release_bp(dmu_buf_impl_t *db)
	{
	objset_t *os __maybe_unused = db->db_objset;

	ASSERT(dsl_pool_sync_context(dmu_objset_pool(os)));
	ASSERT(arc_released(os->os_phys_buf) \|\|
	list_link_active(&os->os_dsl_dataset->ds_synced_link));
	ASSERT(db->db_parent == NULL \|\| arc_released(db->db_parent->db_buf));

	(void) arc_release(db->db_buf, db);
	}

	/*
	* We already have a dirty record for this TXG, and we are being
	* dirtied again.
	*/
	static void
	dbuf_redirty(dbuf_dirty_record_t *dr)
	{
	dmu_buf_impl_t *db = dr->dr_dbuf;

	ASSERT(MUTEX_HELD(&db->db_mtx));

	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID) {
	/*
	* If this buffer has already been written out,
	* we now need to reset its state.
	*/
	dbuf_unoverride(dr);
	if (db->db.db_object != DMU_META_DNODE_OBJECT &&
	db->db_state != DB_NOFILL) {
	/* Already released on initial dirty, so just thaw. */
	ASSERT(arc_released(db->db_buf));
	arc_buf_thaw(db->db_buf);
	}
	}
	}

	dbuf_dirty_record_t *
	dbuf_dirty(dmu_buf_impl_t db, dmu_tx_t tx)
	{
	dnode_t *dn;
	objset_t *os;
	dbuf_dirty_record_t dr, dr_next, *dr_head;
	int txgoff = tx->tx_txg & TXG_MASK;
	boolean_t drop_struct_rwlock = B_FALSE;

	ASSERT(tx->tx_txg != 0);
	ASSERT(!zfs_refcount_is_zero(&db->db_holds));
	DMU_TX_DIRTY_BUF(tx, db);

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	/*
	* Shouldn't dirty a regular buffer in syncing context. Private
	* objects may be dirtied in syncing context, but only if they
	* were already pre-dirtied in open context.
	*/
	#ifdef ZFS_DEBUG
	if (dn->dn_objset->os_dsl_dataset != NULL) {
	rrw_enter(&dn->dn_objset->os_dsl_dataset->ds_bp_rwlock,
	RW_READER, FTAG);
	}
	ASSERT(!dmu_tx_is_syncing(tx) \|\|
	BP_IS_HOLE(dn->dn_objset->os_rootbp) \|\|
	DMU_OBJECT_IS_SPECIAL(dn->dn_object) \|\|
	dn->dn_objset->os_dsl_dataset == NULL);
	if (dn->dn_objset->os_dsl_dataset != NULL)
	rrw_exit(&dn->dn_objset->os_dsl_dataset->ds_bp_rwlock, FTAG);
	#endif
	/*
	* We make this assert for private objects as well, but after we
	* check if we're already dirty. They are allowed to re-dirty
	* in syncing context.
	*/
	ASSERT(dn->dn_object == DMU_META_DNODE_OBJECT \|\|
	dn->dn_dirtyctx == DN_UNDIRTIED \|\| dn->dn_dirtyctx ==
	(dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN));

	mutex_enter(&db->db_mtx);
	/*
	* XXX make this true for indirects too? The problem is that
	* transactions created with dmu_tx_create_assigned() from
	* syncing context don't bother holding ahead.
	*/
	ASSERT(db->db_level != 0 \|\|
	db->db_state == DB_CACHED \|\| db->db_state == DB_FILL \|\|
	db->db_state == DB_NOFILL);

	mutex_enter(&dn->dn_mtx);
	dnode_set_dirtyctx(dn, tx, db);
	if (tx->tx_txg > dn->dn_dirty_txg)
	dn->dn_dirty_txg = tx->tx_txg;
	mutex_exit(&dn->dn_mtx);

	if (db->db_blkid == DMU_SPILL_BLKID)
	dn->dn_have_spill = B_TRUE;

	/*
	* If this buffer is already dirty, we're done.
	*/
	dr_head = list_head(&db->db_dirty_records);
	ASSERT(dr_head == NULL \|\| dr_head->dr_txg <= tx->tx_txg \|\|
	db->db.db_object == DMU_META_DNODE_OBJECT);
	dr_next = dbuf_find_dirty_lte(db, tx->tx_txg);
	if (dr_next && dr_next->dr_txg == tx->tx_txg) {
	DB_DNODE_EXIT(db);

	dbuf_redirty(dr_next);
	mutex_exit(&db->db_mtx);
	return (dr_next);
	}

	/*
	* Only valid if not already dirty.
	*/
	ASSERT(dn->dn_object == 0 \|\|
	dn->dn_dirtyctx == DN_UNDIRTIED \|\| dn->dn_dirtyctx ==
	(dmu_tx_is_syncing(tx) ? DN_DIRTY_SYNC : DN_DIRTY_OPEN));

	ASSERT3U(dn->dn_nlevels, >, db->db_level);

	/*
	* We should only be dirtying in syncing context if it's the
	* mos or we're initializing the os or it's a special object.
	* However, we are allowed to dirty in syncing context provided
	* we already dirtied it in open context. Hence we must make
	* this assertion only if we're not already dirty.
	*/
	os = dn->dn_objset;
	VERIFY3U(tx->tx_txg, <=, spa_final_dirty_txg(os->os_spa));
	#ifdef ZFS_DEBUG
	if (dn->dn_objset->os_dsl_dataset != NULL)
	rrw_enter(&os->os_dsl_dataset->ds_bp_rwlock, RW_READER, FTAG);
	ASSERT(!dmu_tx_is_syncing(tx) \|\| DMU_OBJECT_IS_SPECIAL(dn->dn_object) \|\|
	os->os_dsl_dataset == NULL \|\| BP_IS_HOLE(os->os_rootbp));
	if (dn->dn_objset->os_dsl_dataset != NULL)
	rrw_exit(&os->os_dsl_dataset->ds_bp_rwlock, FTAG);
	#endif
	ASSERT(db->db.db_size != 0);

	dprintf_dbuf(db, "size=%llx\n", (u_longlong_t)db->db.db_size);

	if (db->db_blkid != DMU_BONUS_BLKID) {
	dmu_objset_willuse_space(os, db->db.db_size, tx);
	}

	/*
	* If this buffer is dirty in an old transaction group we need
	* to make a copy of it so that the changes we make in this
	* transaction group won't leak out when we sync the older txg.
	*/
	dr = kmem_zalloc(sizeof (dbuf_dirty_record_t), KM_SLEEP);
	list_link_init(&dr->dr_dirty_node);
	list_link_init(&dr->dr_dbuf_node);
	if (db->db_level == 0) {
	void *data_old = db->db_buf;

	if (db->db_state != DB_NOFILL) {
	if (db->db_blkid == DMU_BONUS_BLKID) {
	dbuf_fix_old_data(db, tx->tx_txg);
	data_old = db->db.db_data;
	} else if (db->db.db_object != DMU_META_DNODE_OBJECT) {
	/*
	* Release the data buffer from the cache so
	* that we can modify it without impacting
	* possible other users of this cached data
	* block. Note that indirect blocks and
	* private objects are not released until the
	* syncing state (since they are only modified
	* then).
	*/
	arc_release(db->db_buf, db);
	dbuf_fix_old_data(db, tx->tx_txg);
	data_old = db->db_buf;
	}
	ASSERT(data_old != NULL);
	}
	dr->dt.dl.dr_data = data_old;
	} else {
	mutex_init(&dr->dt.di.dr_mtx, NULL, MUTEX_NOLOCKDEP, NULL);
	list_create(&dr->dt.di.dr_children,
	sizeof (dbuf_dirty_record_t),
	offsetof(dbuf_dirty_record_t, dr_dirty_node));
	}
	if (db->db_blkid != DMU_BONUS_BLKID)
	dr->dr_accounted = db->db.db_size;
	dr->dr_dbuf = db;
	dr->dr_txg = tx->tx_txg;
	list_insert_before(&db->db_dirty_records, dr_next, dr);

	/*
	* We could have been freed_in_flight between the dbuf_noread
	* and dbuf_dirty. We win, as though the dbuf_noread() had
	* happened after the free.
	*/
	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
	db->db_blkid != DMU_SPILL_BLKID) {
	mutex_enter(&dn->dn_mtx);
	if (dn->dn_free_ranges[txgoff] != NULL) {
	range_tree_clear(dn->dn_free_ranges[txgoff],
	db->db_blkid, 1);
	}
	mutex_exit(&dn->dn_mtx);
	db->db_freed_in_flight = FALSE;
	}

	/*
	* This buffer is now part of this txg
	*/
	dbuf_add_ref(db, (void *)(uintptr_t)tx->tx_txg);
	db->db_dirtycnt += 1;
	ASSERT3U(db->db_dirtycnt, <=, 3);

	mutex_exit(&db->db_mtx);

	if (db->db_blkid == DMU_BONUS_BLKID \|\|
	db->db_blkid == DMU_SPILL_BLKID) {
	mutex_enter(&dn->dn_mtx);
	ASSERT(!list_link_active(&dr->dr_dirty_node));
	list_insert_tail(&dn->dn_dirty_records[txgoff], dr);
	mutex_exit(&dn->dn_mtx);
	dnode_setdirty(dn, tx);
	DB_DNODE_EXIT(db);
	return (dr);
	}

	if (!RW_WRITE_HELD(&dn->dn_struct_rwlock)) {
	rw_enter(&dn->dn_struct_rwlock, RW_READER);
	drop_struct_rwlock = B_TRUE;
	}

	/*
	* If we are overwriting a dedup BP, then unless it is snapshotted,
	* when we get to syncing context we will need to decrement its
	* refcount in the DDT. Prefetch the relevant DDT block so that
	* syncing context won't have to wait for the i/o.
	*/
	if (db->db_blkptr != NULL) {
	db_lock_type_t dblt = dmu_buf_lock_parent(db, RW_READER, FTAG);
	ddt_prefetch(os->os_spa, db->db_blkptr);
	dmu_buf_unlock_parent(db, dblt, FTAG);
	}

	/*
	* We need to hold the dn_struct_rwlock to make this assertion,
	* because it protects dn_phys / dn_next_nlevels from changing.
	*/
	ASSERT((dn->dn_phys->dn_nlevels == 0 && db->db_level == 0) \|\|
	dn->dn_phys->dn_nlevels > db->db_level \|\|
	dn->dn_next_nlevels[txgoff] > db->db_level \|\|
	dn->dn_next_nlevels[(tx->tx_txg-1) & TXG_MASK] > db->db_level \|\|
	dn->dn_next_nlevels[(tx->tx_txg-2) & TXG_MASK] > db->db_level);


	if (db->db_level == 0) {
	ASSERT(!db->db_objset->os_raw_receive \|\|
	dn->dn_maxblkid >= db->db_blkid);
	dnode_new_blkid(dn, db->db_blkid, tx,
	drop_struct_rwlock, B_FALSE);
	ASSERT(dn->dn_maxblkid >= db->db_blkid);
	}

	if (db->db_level+1 < dn->dn_nlevels) {
	dmu_buf_impl_t *parent = db->db_parent;
	dbuf_dirty_record_t *di;
	int parent_held = FALSE;

	if (db->db_parent == NULL \|\| db->db_parent == dn->dn_dbuf) {
	int epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
	parent = dbuf_hold_level(dn, db->db_level + 1,
	db->db_blkid >> epbs, FTAG);
	ASSERT(parent != NULL);
	parent_held = TRUE;
	}
	if (drop_struct_rwlock)
	rw_exit(&dn->dn_struct_rwlock);
	ASSERT3U(db->db_level + 1, ==, parent->db_level);
	di = dbuf_dirty(parent, tx);
	if (parent_held)
	dbuf_rele(parent, FTAG);

	mutex_enter(&db->db_mtx);
	/*
	* Since we've dropped the mutex, it's possible that
	* dbuf_undirty() might have changed this out from under us.
	*/
	if (list_head(&db->db_dirty_records) == dr \|\|
	dn->dn_object == DMU_META_DNODE_OBJECT) {
	mutex_enter(&di->dt.di.dr_mtx);
	ASSERT3U(di->dr_txg, ==, tx->tx_txg);
	ASSERT(!list_link_active(&dr->dr_dirty_node));
	list_insert_tail(&di->dt.di.dr_children, dr);
	mutex_exit(&di->dt.di.dr_mtx);
	dr->dr_parent = di;
	}
	mutex_exit(&db->db_mtx);
	} else {
	ASSERT(db->db_level + 1 == dn->dn_nlevels);
	ASSERT(db->db_blkid < dn->dn_nblkptr);
	ASSERT(db->db_parent == NULL \|\| db->db_parent == dn->dn_dbuf);
	mutex_enter(&dn->dn_mtx);
	ASSERT(!list_link_active(&dr->dr_dirty_node));
	list_insert_tail(&dn->dn_dirty_records[txgoff], dr);
	mutex_exit(&dn->dn_mtx);
	if (drop_struct_rwlock)
	rw_exit(&dn->dn_struct_rwlock);
	}

	dnode_setdirty(dn, tx);
	DB_DNODE_EXIT(db);
	return (dr);
	}

	static void
	dbuf_undirty_bonus(dbuf_dirty_record_t *dr)
	{
	dmu_buf_impl_t *db = dr->dr_dbuf;

	if (dr->dt.dl.dr_data != db->db.db_data) {
	struct dnode *dn = DB_DNODE(db);
	int max_bonuslen = DN_SLOTS_TO_BONUSLEN(dn->dn_num_slots);

	kmem_free(dr->dt.dl.dr_data, max_bonuslen);
	arc_space_return(max_bonuslen, ARC_SPACE_BONUS);
	}
	db->db_data_pending = NULL;
	ASSERT(list_next(&db->db_dirty_records, dr) == NULL);
	list_remove(&db->db_dirty_records, dr);
	if (dr->dr_dbuf->db_level != 0) {
	mutex_destroy(&dr->dt.di.dr_mtx);
	list_destroy(&dr->dt.di.dr_children);
	}
	kmem_free(dr, sizeof (dbuf_dirty_record_t));
	ASSERT3U(db->db_dirtycnt, >, 0);
	db->db_dirtycnt -= 1;
	}

	/*
	* Undirty a buffer in the transaction group referenced by the given
	* transaction. Return whether this evicted the dbuf.
	*/
	static boolean_t
	dbuf_undirty(dmu_buf_impl_t db, dmu_tx_t tx)
	{
	dnode_t *dn;
	uint64_t txg = tx->tx_txg;
	dbuf_dirty_record_t *dr;

	ASSERT(txg != 0);

	/*
	* Due to our use of dn_nlevels below, this can only be called
	* in open context, unless we are operating on the MOS.
	* From syncing context, dn_nlevels may be different from the
	* dn_nlevels used when dbuf was dirtied.
	*/
	ASSERT(db->db_objset ==
	dmu_objset_pool(db->db_objset)->dp_meta_objset \|\|
	txg != spa_syncing_txg(dmu_objset_spa(db->db_objset)));
	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
	ASSERT0(db->db_level);
	ASSERT(MUTEX_HELD(&db->db_mtx));

	/*
	* If this buffer is not dirty, we're done.
	*/
	dr = dbuf_find_dirty_eq(db, txg);
	if (dr == NULL)
	return (B_FALSE);
	ASSERT(dr->dr_dbuf == db);

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);

	dprintf_dbuf(db, "size=%llx\n", (u_longlong_t)db->db.db_size);

	ASSERT(db->db.db_size != 0);

	dsl_pool_undirty_space(dmu_objset_pool(dn->dn_objset),
	dr->dr_accounted, txg);

	list_remove(&db->db_dirty_records, dr);

	/*
	* Note that there are three places in dbuf_dirty()
	* where this dirty record may be put on a list.
	* Make sure to do a list_remove corresponding to
	* every one of those list_insert calls.
	*/
	if (dr->dr_parent) {
	mutex_enter(&dr->dr_parent->dt.di.dr_mtx);
	list_remove(&dr->dr_parent->dt.di.dr_children, dr);
	mutex_exit(&dr->dr_parent->dt.di.dr_mtx);
	} else if (db->db_blkid == DMU_SPILL_BLKID \|\|
	db->db_level + 1 == dn->dn_nlevels) {
	ASSERT(db->db_blkptr == NULL \|\| db->db_parent == dn->dn_dbuf);
	mutex_enter(&dn->dn_mtx);
	list_remove(&dn->dn_dirty_records[txg & TXG_MASK], dr);
	mutex_exit(&dn->dn_mtx);
	}
	DB_DNODE_EXIT(db);

	if (db->db_state != DB_NOFILL) {
	dbuf_unoverride(dr);

	ASSERT(db->db_buf != NULL);
	ASSERT(dr->dt.dl.dr_data != NULL);
	if (dr->dt.dl.dr_data != db->db_buf)
	arc_buf_destroy(dr->dt.dl.dr_data, db);
	}

	kmem_free(dr, sizeof (dbuf_dirty_record_t));

	ASSERT(db->db_dirtycnt > 0);
	db->db_dirtycnt -= 1;

	if (zfs_refcount_remove(&db->db_holds, (void *)(uintptr_t)txg) == 0) {
	ASSERT(db->db_state == DB_NOFILL \|\| arc_released(db->db_buf));
	dbuf_destroy(db);
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	static void
	dmu_buf_will_dirty_impl(dmu_buf_t db_fake, int flags, dmu_tx_t tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;

	ASSERT(tx->tx_txg != 0);
	ASSERT(!zfs_refcount_is_zero(&db->db_holds));

	/*
	* Quick check for dirtiness. For already dirty blocks, this
	* reduces runtime of this function by >90%, and overall performance
	* by 50% for some workloads (e.g. file deletion with indirect blocks
	* cached).
	*/
	mutex_enter(&db->db_mtx);

	if (db->db_state == DB_CACHED) {
	dbuf_dirty_record_t *dr = dbuf_find_dirty_eq(db, tx->tx_txg);
	/*
	* It's possible that it is already dirty but not cached,
	* because there are some calls to dbuf_dirty() that don't
	* go through dmu_buf_will_dirty().
	*/
	if (dr != NULL) {
	/* This dbuf is already dirty and cached. */
	dbuf_redirty(dr);
	mutex_exit(&db->db_mtx);
	return;
	}
	}
	mutex_exit(&db->db_mtx);

	DB_DNODE_ENTER(db);
	if (RW_WRITE_HELD(&DB_DNODE(db)->dn_struct_rwlock))
	flags \|= DB_RF_HAVESTRUCT;
	DB_DNODE_EXIT(db);
	(void) dbuf_read(db, NULL, flags);
	(void) dbuf_dirty(db, tx);
	}

	void
	dmu_buf_will_dirty(dmu_buf_t db_fake, dmu_tx_t tx)
	{
	dmu_buf_will_dirty_impl(db_fake,
	DB_RF_MUST_SUCCEED \| DB_RF_NOPREFETCH, tx);
	}

	boolean_t
	dmu_buf_is_dirty(dmu_buf_t db_fake, dmu_tx_t tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;
	dbuf_dirty_record_t *dr;

	mutex_enter(&db->db_mtx);
	dr = dbuf_find_dirty_eq(db, tx->tx_txg);
	mutex_exit(&db->db_mtx);
	return (dr != NULL);
	}

	void
	dmu_buf_will_not_fill(dmu_buf_t db_fake, dmu_tx_t tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;

	db->db_state = DB_NOFILL;
	DTRACE_SET_STATE(db, "allocating NOFILL buffer");
	dmu_buf_will_fill(db_fake, tx);
	}

	void
	dmu_buf_will_fill(dmu_buf_t db_fake, dmu_tx_t tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;

	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
	ASSERT(tx->tx_txg != 0);
	ASSERT(db->db_level == 0);
	ASSERT(!zfs_refcount_is_zero(&db->db_holds));

	ASSERT(db->db.db_object != DMU_META_DNODE_OBJECT \|\|
	dmu_tx_private_ok(tx));

	dbuf_noread(db);
	(void) dbuf_dirty(db, tx);
	}

	/*
	* This function is effectively the same as dmu_buf_will_dirty(), but
	* indicates the caller expects raw encrypted data in the db, and provides
	* the crypt params (byteorder, salt, iv, mac) which should be stored in the
	* blkptr_t when this dbuf is written. This is only used for blocks of
	* dnodes, during raw receive.
	*/
	void
	dmu_buf_set_crypt_params(dmu_buf_t *db_fake, boolean_t byteorder,
	const uint8_t salt, const uint8_t iv, const uint8_t mac, dmu_tx_t tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;
	dbuf_dirty_record_t *dr;

	/*
	* dr_has_raw_params is only processed for blocks of dnodes
	* (see dbuf_sync_dnode_leaf_crypt()).
	*/
	ASSERT3U(db->db.db_object, ==, DMU_META_DNODE_OBJECT);
	ASSERT3U(db->db_level, ==, 0);
	ASSERT(db->db_objset->os_raw_receive);

	dmu_buf_will_dirty_impl(db_fake,
	DB_RF_MUST_SUCCEED \| DB_RF_NOPREFETCH \| DB_RF_NO_DECRYPT, tx);

	dr = dbuf_find_dirty_eq(db, tx->tx_txg);

	ASSERT3P(dr, !=, NULL);

	dr->dt.dl.dr_has_raw_params = B_TRUE;
	dr->dt.dl.dr_byteorder = byteorder;
	bcopy(salt, dr->dt.dl.dr_salt, ZIO_DATA_SALT_LEN);
	bcopy(iv, dr->dt.dl.dr_iv, ZIO_DATA_IV_LEN);
	bcopy(mac, dr->dt.dl.dr_mac, ZIO_DATA_MAC_LEN);
	}

	static void
	dbuf_override_impl(dmu_buf_impl_t db, const blkptr_t bp, dmu_tx_t *tx)
	{
	struct dirty_leaf *dl;
	dbuf_dirty_record_t *dr;

	dr = list_head(&db->db_dirty_records);
	ASSERT3U(dr->dr_txg, ==, tx->tx_txg);
	dl = &dr->dt.dl;
	dl->dr_overridden_by = *bp;
	dl->dr_override_state = DR_OVERRIDDEN;
	dl->dr_overridden_by.blk_birth = dr->dr_txg;
	}

	/* ARGSUSED */
	void
	dmu_buf_fill_done(dmu_buf_t dbuf, dmu_tx_t tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )dbuf;
	dbuf_states_t old_state;
	mutex_enter(&db->db_mtx);
	DBUF_VERIFY(db);

	old_state = db->db_state;
	db->db_state = DB_CACHED;
	if (old_state == DB_FILL) {
	if (db->db_level == 0 && db->db_freed_in_flight) {
	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
	/* we were freed while filling */
	/* XXX dbuf_undirty? */
	bzero(db->db.db_data, db->db.db_size);
	db->db_freed_in_flight = FALSE;
	DTRACE_SET_STATE(db,
	"fill done handling freed in flight");
	} else {
	DTRACE_SET_STATE(db, "fill done");
	}
	cv_broadcast(&db->db_changed);
	}
	mutex_exit(&db->db_mtx);
	}

	void
	dmu_buf_write_embedded(dmu_buf_t dbuf, void data,
	bp_embedded_type_t etype, enum zio_compress comp,
	int uncompressed_size, int compressed_size, int byteorder,
	dmu_tx_t *tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )dbuf;
	struct dirty_leaf *dl;
	dmu_object_type_t type;
	dbuf_dirty_record_t *dr;

	if (etype == BP_EMBEDDED_TYPE_DATA) {
	ASSERT(spa_feature_is_active(dmu_objset_spa(db->db_objset),
	SPA_FEATURE_EMBEDDED_DATA));
	}

	DB_DNODE_ENTER(db);
	type = DB_DNODE(db)->dn_type;
	DB_DNODE_EXIT(db);

	ASSERT0(db->db_level);
	ASSERT(db->db_blkid != DMU_BONUS_BLKID);

	dmu_buf_will_not_fill(dbuf, tx);

	dr = list_head(&db->db_dirty_records);
	ASSERT3U(dr->dr_txg, ==, tx->tx_txg);
	dl = &dr->dt.dl;
	encode_embedded_bp_compressed(&dl->dr_overridden_by,
	data, comp, uncompressed_size, compressed_size);
	BPE_SET_ETYPE(&dl->dr_overridden_by, etype);
	BP_SET_TYPE(&dl->dr_overridden_by, type);
	BP_SET_LEVEL(&dl->dr_overridden_by, 0);
	BP_SET_BYTEORDER(&dl->dr_overridden_by, byteorder);

	dl->dr_override_state = DR_OVERRIDDEN;
	dl->dr_overridden_by.blk_birth = dr->dr_txg;
	}

	void
	dmu_buf_redact(dmu_buf_t dbuf, dmu_tx_t tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )dbuf;
	dmu_object_type_t type;
	ASSERT(dsl_dataset_feature_is_active(db->db_objset->os_dsl_dataset,
	SPA_FEATURE_REDACTED_DATASETS));

	DB_DNODE_ENTER(db);
	type = DB_DNODE(db)->dn_type;
	DB_DNODE_EXIT(db);

	ASSERT0(db->db_level);
	dmu_buf_will_not_fill(dbuf, tx);

	blkptr_t bp = { { { {0} } } };
	BP_SET_TYPE(&bp, type);
	BP_SET_LEVEL(&bp, 0);
	BP_SET_BIRTH(&bp, tx->tx_txg, 0);
	BP_SET_REDACTED(&bp);
	BPE_SET_LSIZE(&bp, dbuf->db_size);

	dbuf_override_impl(db, &bp, tx);
	}

	/*
	* Directly assign a provided arc buf to a given dbuf if it's not referenced
	* by anybody except our caller. Otherwise copy arcbuf's contents to dbuf.
	*/
	void
	dbuf_assign_arcbuf(dmu_buf_impl_t db, arc_buf_t buf, dmu_tx_t *tx)
	{
	ASSERT(!zfs_refcount_is_zero(&db->db_holds));
	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
	ASSERT(db->db_level == 0);
	ASSERT3U(dbuf_is_metadata(db), ==, arc_is_metadata(buf));
	ASSERT(buf != NULL);
	ASSERT3U(arc_buf_lsize(buf), ==, db->db.db_size);
	ASSERT(tx->tx_txg != 0);

	arc_return_buf(buf, db);
	ASSERT(arc_released(buf));

	mutex_enter(&db->db_mtx);

	while (db->db_state == DB_READ \|\| db->db_state == DB_FILL)
	cv_wait(&db->db_changed, &db->db_mtx);

	ASSERT(db->db_state == DB_CACHED \|\| db->db_state == DB_UNCACHED);

	if (db->db_state == DB_CACHED &&
	zfs_refcount_count(&db->db_holds) - 1 > db->db_dirtycnt) {
	/*
	* In practice, we will never have a case where we have an
	* encrypted arc buffer while additional holds exist on the
	* dbuf. We don't handle this here so we simply assert that
	* fact instead.
	*/
	ASSERT(!arc_is_encrypted(buf));
	mutex_exit(&db->db_mtx);
	(void) dbuf_dirty(db, tx);
	bcopy(buf->b_data, db->db.db_data, db->db.db_size);
	arc_buf_destroy(buf, db);
	xuio_stat_wbuf_copied();
	return;
	}

	xuio_stat_wbuf_nocopy();
	if (db->db_state == DB_CACHED) {
	dbuf_dirty_record_t *dr = list_head(&db->db_dirty_records);

	ASSERT(db->db_buf != NULL);
	if (dr != NULL && dr->dr_txg == tx->tx_txg) {
	ASSERT(dr->dt.dl.dr_data == db->db_buf);

	if (!arc_released(db->db_buf)) {
	ASSERT(dr->dt.dl.dr_override_state ==
	DR_OVERRIDDEN);
	arc_release(db->db_buf, db);
	}
	dr->dt.dl.dr_data = buf;
	arc_buf_destroy(db->db_buf, db);
	} else if (dr == NULL \|\| dr->dt.dl.dr_data != db->db_buf) {
	arc_release(db->db_buf, db);
	arc_buf_destroy(db->db_buf, db);
	}
	db->db_buf = NULL;
	}
	ASSERT(db->db_buf == NULL);
	dbuf_set_data(db, buf);
	db->db_state = DB_FILL;
	DTRACE_SET_STATE(db, "filling assigned arcbuf");
	mutex_exit(&db->db_mtx);
	(void) dbuf_dirty(db, tx);
	dmu_buf_fill_done(&db->db, tx);
	}

	void
	dbuf_destroy(dmu_buf_impl_t *db)
	{
	dnode_t *dn;
	dmu_buf_impl_t *parent = db->db_parent;
	dmu_buf_impl_t *dndb;

	ASSERT(MUTEX_HELD(&db->db_mtx));
	ASSERT(zfs_refcount_is_zero(&db->db_holds));

	if (db->db_buf != NULL) {
	arc_buf_destroy(db->db_buf, db);
	db->db_buf = NULL;
	}

	if (db->db_blkid == DMU_BONUS_BLKID) {
	int slots = DB_DNODE(db)->dn_num_slots;
	int bonuslen = DN_SLOTS_TO_BONUSLEN(slots);
	if (db->db.db_data != NULL) {
	kmem_free(db->db.db_data, bonuslen);
	arc_space_return(bonuslen, ARC_SPACE_BONUS);
	db->db_state = DB_UNCACHED;
	DTRACE_SET_STATE(db, "buffer cleared");
	}
	}

	dbuf_clear_data(db);

	if (multilist_link_active(&db->db_cache_link)) {
	ASSERT(db->db_caching_status == DB_DBUF_CACHE \|\|
	db->db_caching_status == DB_DBUF_METADATA_CACHE);

	multilist_remove(dbuf_caches[db->db_caching_status].cache, db);
	(void) zfs_refcount_remove_many(
	&dbuf_caches[db->db_caching_status].size,
	db->db.db_size, db);

	if (db->db_caching_status == DB_DBUF_METADATA_CACHE) {
	DBUF_STAT_BUMPDOWN(metadata_cache_count);
	} else {
	DBUF_STAT_BUMPDOWN(cache_levels[db->db_level]);
	DBUF_STAT_BUMPDOWN(cache_count);
	DBUF_STAT_DECR(cache_levels_bytes[db->db_level],
	db->db.db_size);
	}
	db->db_caching_status = DB_NO_CACHE;
	}

	ASSERT(db->db_state == DB_UNCACHED \|\| db->db_state == DB_NOFILL);
	ASSERT(db->db_data_pending == NULL);
	ASSERT(list_is_empty(&db->db_dirty_records));

	db->db_state = DB_EVICTING;
	DTRACE_SET_STATE(db, "buffer eviction started");
	db->db_blkptr = NULL;

	/*
	* Now that db_state is DB_EVICTING, nobody else can find this via
	* the hash table. We can now drop db_mtx, which allows us to
	* acquire the dn_dbufs_mtx.
	*/
	mutex_exit(&db->db_mtx);

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	dndb = dn->dn_dbuf;
	if (db->db_blkid != DMU_BONUS_BLKID) {
	boolean_t needlock = !MUTEX_HELD(&dn->dn_dbufs_mtx);
	if (needlock)
	mutex_enter_nested(&dn->dn_dbufs_mtx,
	NESTED_SINGLE);
	avl_remove(&dn->dn_dbufs, db);
	membar_producer();
	DB_DNODE_EXIT(db);
	if (needlock)
	mutex_exit(&dn->dn_dbufs_mtx);
	/*
	* Decrementing the dbuf count means that the hold corresponding
	* to the removed dbuf is no longer discounted in dnode_move(),
	* so the dnode cannot be moved until after we release the hold.
	* The membar_producer() ensures visibility of the decremented
	* value in dnode_move(), since DB_DNODE_EXIT doesn't actually
	* release any lock.
	*/
	mutex_enter(&dn->dn_mtx);
	dnode_rele_and_unlock(dn, db, B_TRUE);
	db->db_dnode_handle = NULL;

	dbuf_hash_remove(db);
	} else {
	DB_DNODE_EXIT(db);
	}

	ASSERT(zfs_refcount_is_zero(&db->db_holds));

	db->db_parent = NULL;

	ASSERT(db->db_buf == NULL);
	ASSERT(db->db.db_data == NULL);
	ASSERT(db->db_hash_next == NULL);
	ASSERT(db->db_blkptr == NULL);
	ASSERT(db->db_data_pending == NULL);
	ASSERT3U(db->db_caching_status, ==, DB_NO_CACHE);
	ASSERT(!multilist_link_active(&db->db_cache_link));

	kmem_cache_free(dbuf_kmem_cache, db);
	arc_space_return(sizeof (dmu_buf_impl_t), ARC_SPACE_DBUF);

	/*
	* If this dbuf is referenced from an indirect dbuf,
	* decrement the ref count on the indirect dbuf.
	*/
	if (parent && parent != dndb) {
	mutex_enter(&parent->db_mtx);
	dbuf_rele_and_unlock(parent, db, B_TRUE);
	}
	}

	/*
	* Note: While bpp will always be updated if the function returns success,
	* parentp will not be updated if the dnode does not have dn_dbuf filled in;
	* this happens when the dnode is the meta-dnode, or {user\|group\|project}used
	* object.
	*/
	__attribute__((always_inline))
	static inline int
	dbuf_findbp(dnode_t *dn, int level, uint64_t blkid, int fail_sparse,
	dmu_buf_impl_t parentp, blkptr_t bpp)
	{
	*parentp = NULL;
	*bpp = NULL;

	ASSERT(blkid != DMU_BONUS_BLKID);

	if (blkid == DMU_SPILL_BLKID) {
	mutex_enter(&dn->dn_mtx);
	if (dn->dn_have_spill &&
	(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR))
	*bpp = DN_SPILL_BLKPTR(dn->dn_phys);
	else
	*bpp = NULL;
	dbuf_add_ref(dn->dn_dbuf, NULL);
	*parentp = dn->dn_dbuf;
	mutex_exit(&dn->dn_mtx);
	return (0);
	}

	int nlevels =
	(dn->dn_phys->dn_nlevels == 0) ? 1 : dn->dn_phys->dn_nlevels;
	int epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;

	ASSERT3U(level * epbs, <, 64);
	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
	/*
	* This assertion shouldn't trip as long as the max indirect block size
	* is less than 1M. The reason for this is that up to that point,
	* the number of levels required to address an entire object with blocks
	* of size SPA_MINBLOCKSIZE satisfies nlevels * epbs + 1 <= 64. In
	* other words, if N * epbs + 1 > 64, then if (N-1) * epbs + 1 > 55
	* (i.e. we can address the entire object), objects will all use at most
	* N-1 levels and the assertion won't overflow. However, once epbs is
	* 13, 4 * 13 + 1 = 53, but 5 * 13 + 1 = 66. Then, 4 levels will not be
	* enough to address an entire object, so objects will have 5 levels,
	* but then this assertion will overflow.
	*
	* All this is to say that if we ever increase DN_MAX_INDBLKSHIFT, we
	* need to redo this logic to handle overflows.
	*/
	ASSERT(level >= nlevels \|\|
	((nlevels - level - 1) * epbs) +
	highbit64(dn->dn_phys->dn_nblkptr) <= 64);
	if (level >= nlevels \|\|
	blkid >= ((uint64_t)dn->dn_phys->dn_nblkptr <<
	((nlevels - level - 1) * epbs)) \|\|
	(fail_sparse &&
	blkid > (dn->dn_phys->dn_maxblkid >> (level * epbs)))) {
	/* the buffer has no parent yet */
	return (SET_ERROR(ENOENT));
	} else if (level < nlevels-1) {
	/* this block is referenced from an indirect block */
	int err;

	err = dbuf_hold_impl(dn, level + 1,
	blkid >> epbs, fail_sparse, FALSE, NULL, parentp);

	if (err)
	return (err);
	err = dbuf_read(*parentp, NULL,
	(DB_RF_HAVESTRUCT \| DB_RF_NOPREFETCH \| DB_RF_CANFAIL));
	if (err) {
	dbuf_rele(*parentp, NULL);
	*parentp = NULL;
	return (err);
	}
	rw_enter(&(*parentp)->db_rwlock, RW_READER);
	bpp = ((blkptr_t )(*parentp)->db.db_data) +
	(blkid & ((1ULL << epbs) - 1));
	if (blkid > (dn->dn_phys->dn_maxblkid >> (level * epbs)))
	ASSERT(BP_IS_HOLE(*bpp));
	rw_exit(&(*parentp)->db_rwlock);
	return (0);
	} else {
	/* the block is referenced from the dnode */
	ASSERT3U(level, ==, nlevels-1);
	ASSERT(dn->dn_phys->dn_nblkptr == 0 \|\|
	blkid < dn->dn_phys->dn_nblkptr);
	if (dn->dn_dbuf) {
	dbuf_add_ref(dn->dn_dbuf, NULL);
	*parentp = dn->dn_dbuf;
	}
	*bpp = &dn->dn_phys->dn_blkptr[blkid];
	return (0);
	}
	}

	static dmu_buf_impl_t *
	dbuf_create(dnode_t *dn, uint8_t level, uint64_t blkid,
	dmu_buf_impl_t parent, blkptr_t blkptr)
	{
	objset_t *os = dn->dn_objset;
	dmu_buf_impl_t db, odb;

	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
	ASSERT(dn->dn_type != DMU_OT_NONE);

	db = kmem_cache_alloc(dbuf_kmem_cache, KM_SLEEP);

	list_create(&db->db_dirty_records, sizeof (dbuf_dirty_record_t),
	offsetof(dbuf_dirty_record_t, dr_dbuf_node));

	db->db_objset = os;
	db->db.db_object = dn->dn_object;
	db->db_level = level;
	db->db_blkid = blkid;
	db->db_dirtycnt = 0;
	db->db_dnode_handle = dn->dn_handle;
	db->db_parent = parent;
	db->db_blkptr = blkptr;

	db->db_user = NULL;
	db->db_user_immediate_evict = FALSE;
	db->db_freed_in_flight = FALSE;
	db->db_pending_evict = FALSE;

	if (blkid == DMU_BONUS_BLKID) {
	ASSERT3P(parent, ==, dn->dn_dbuf);
	db->db.db_size = DN_SLOTS_TO_BONUSLEN(dn->dn_num_slots) -
	(dn->dn_nblkptr-1) * sizeof (blkptr_t);
	ASSERT3U(db->db.db_size, >=, dn->dn_bonuslen);
	db->db.db_offset = DMU_BONUS_BLKID;
	db->db_state = DB_UNCACHED;
	DTRACE_SET_STATE(db, "bonus buffer created");
	db->db_caching_status = DB_NO_CACHE;
	/* the bonus dbuf is not placed in the hash table */
	arc_space_consume(sizeof (dmu_buf_impl_t), ARC_SPACE_DBUF);
	return (db);
	} else if (blkid == DMU_SPILL_BLKID) {
	db->db.db_size = (blkptr != NULL) ?
	BP_GET_LSIZE(blkptr) : SPA_MINBLOCKSIZE;
	db->db.db_offset = 0;
	} else {
	int blocksize =
	db->db_level ? 1 << dn->dn_indblkshift : dn->dn_datablksz;
	db->db.db_size = blocksize;
	db->db.db_offset = db->db_blkid * blocksize;
	}

	/*
	* Hold the dn_dbufs_mtx while we get the new dbuf
	* in the hash table and added to the dbufs list.
	* This prevents a possible deadlock with someone
	* trying to look up this dbuf before it's added to the
	* dn_dbufs list.
	*/
	mutex_enter(&dn->dn_dbufs_mtx);
	db->db_state = DB_EVICTING; /* not worth logging this state change */
	if ((odb = dbuf_hash_insert(db)) != NULL) {
	/* someone else inserted it first */
	kmem_cache_free(dbuf_kmem_cache, db);
	mutex_exit(&dn->dn_dbufs_mtx);
	DBUF_STAT_BUMP(hash_insert_race);
	return (odb);
	}
	avl_add(&dn->dn_dbufs, db);

	db->db_state = DB_UNCACHED;
	DTRACE_SET_STATE(db, "regular buffer created");
	db->db_caching_status = DB_NO_CACHE;
	mutex_exit(&dn->dn_dbufs_mtx);
	arc_space_consume(sizeof (dmu_buf_impl_t), ARC_SPACE_DBUF);

	if (parent && parent != dn->dn_dbuf)
	dbuf_add_ref(parent, db);

	ASSERT(dn->dn_object == DMU_META_DNODE_OBJECT \|\|
	zfs_refcount_count(&dn->dn_holds) > 0);
	(void) zfs_refcount_add(&dn->dn_holds, db);

	dprintf_dbuf(db, "db=%p\n", db);

	return (db);
	}

	/*
	* This function returns a block pointer and information about the object,
	* given a dnode and a block. This is a publicly accessible version of
	* dbuf_findbp that only returns some information, rather than the
	* dbuf. Note that the dnode passed in must be held, and the dn_struct_rwlock
	* should be locked as (at least) a reader.
	*/
	int
	dbuf_dnode_findbp(dnode_t *dn, uint64_t level, uint64_t blkid,
	blkptr_t bp, uint16_t datablkszsec, uint8_t *indblkshift)
	{
	dmu_buf_impl_t *dbp = NULL;
	blkptr_t *bp2;
	int err = 0;
	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));

	err = dbuf_findbp(dn, level, blkid, B_FALSE, &dbp, &bp2);
	if (err == 0) {
	bp = bp2;
	if (dbp != NULL)
	dbuf_rele(dbp, NULL);
	if (datablkszsec != NULL)
	*datablkszsec = dn->dn_phys->dn_datablkszsec;
	if (indblkshift != NULL)
	*indblkshift = dn->dn_phys->dn_indblkshift;
	}

	return (err);
	}

	typedef struct dbuf_prefetch_arg {
	spa_t dpa_spa; / The spa to issue the prefetch in. */
	zbookmark_phys_t dpa_zb; /* The target block to prefetch. */
	int dpa_epbs; /* Entries (blkptr_t's) Per Block Shift. */
	int dpa_curlevel; /* The current level that we're reading */
	dnode_t dpa_dnode; / The dnode associated with the prefetch */
	zio_priority_t dpa_prio; /* The priority I/Os should be issued at. */
	zio_t dpa_zio; / The parent zio_t for all prefetches. */
	arc_flags_t dpa_aflags; /* Flags to pass to the final prefetch. */
	} dbuf_prefetch_arg_t;

	/*
	* Actually issue the prefetch read for the block given.
	*/
	static void
	dbuf_issue_final_prefetch(dbuf_prefetch_arg_t dpa, blkptr_t bp)
	{
	ASSERT(!BP_IS_REDACTED(bp) \|\|
	dsl_dataset_feature_is_active(
	dpa->dpa_dnode->dn_objset->os_dsl_dataset,
	SPA_FEATURE_REDACTED_DATASETS));

	if (BP_IS_HOLE(bp) \|\| BP_IS_EMBEDDED(bp) \|\| BP_IS_REDACTED(bp))
	return;

	int zio_flags = ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE;
	arc_flags_t aflags =
	dpa->dpa_aflags \| ARC_FLAG_NOWAIT \| ARC_FLAG_PREFETCH;

	/* dnodes are always read as raw and then converted later */
	if (BP_GET_TYPE(bp) == DMU_OT_DNODE && BP_IS_PROTECTED(bp) &&
	dpa->dpa_curlevel == 0)
	zio_flags \|= ZIO_FLAG_RAW;

	ASSERT3U(dpa->dpa_curlevel, ==, BP_GET_LEVEL(bp));
	ASSERT3U(dpa->dpa_curlevel, ==, dpa->dpa_zb.zb_level);
	ASSERT(dpa->dpa_zio != NULL);
	(void) arc_read(dpa->dpa_zio, dpa->dpa_spa, bp, NULL, NULL,
	dpa->dpa_prio, zio_flags, &aflags, &dpa->dpa_zb);
	}

	/*
	* Called when an indirect block above our prefetch target is read in. This
	* will either read in the next indirect block down the tree or issue the actual
	* prefetch if the next block down is our target.
	*/
	static void
	dbuf_prefetch_indirect_done(zio_t zio, const zbookmark_phys_t zb,
	const blkptr_t iobp, arc_buf_t abuf, void *private)
	{
	dbuf_prefetch_arg_t *dpa = private;

	ASSERT3S(dpa->dpa_zb.zb_level, <, dpa->dpa_curlevel);
	ASSERT3S(dpa->dpa_curlevel, >, 0);

	if (abuf == NULL) {
	ASSERT(zio == NULL \|\| zio->io_error != 0);
	kmem_free(dpa, sizeof (*dpa));
	return;
	}
	ASSERT(zio == NULL \|\| zio->io_error == 0);

	/*
	* The dpa_dnode is only valid if we are called with a NULL
	* zio. This indicates that the arc_read() returned without
	* first calling zio_read() to issue a physical read. Once
	* a physical read is made the dpa_dnode must be invalidated
	* as the locks guarding it may have been dropped. If the
	* dpa_dnode is still valid, then we want to add it to the dbuf
	* cache. To do so, we must hold the dbuf associated with the block
	* we just prefetched, read its contents so that we associate it
	* with an arc_buf_t, and then release it.
	*/
	if (zio != NULL) {
	ASSERT3S(BP_GET_LEVEL(zio->io_bp), ==, dpa->dpa_curlevel);
	if (zio->io_flags & ZIO_FLAG_RAW_COMPRESS) {
	ASSERT3U(BP_GET_PSIZE(zio->io_bp), ==, zio->io_size);
	} else {
	ASSERT3U(BP_GET_LSIZE(zio->io_bp), ==, zio->io_size);
	}
	ASSERT3P(zio->io_spa, ==, dpa->dpa_spa);

	dpa->dpa_dnode = NULL;
	} else if (dpa->dpa_dnode != NULL) {
	uint64_t curblkid = dpa->dpa_zb.zb_blkid >>
	(dpa->dpa_epbs * (dpa->dpa_curlevel -
	dpa->dpa_zb.zb_level));
	dmu_buf_impl_t *db = dbuf_hold_level(dpa->dpa_dnode,
	dpa->dpa_curlevel, curblkid, FTAG);
	if (db == NULL) {
	kmem_free(dpa, sizeof (*dpa));
	arc_buf_destroy(abuf, private);
	return;
	}

	(void) dbuf_read(db, NULL,
	DB_RF_MUST_SUCCEED \| DB_RF_NOPREFETCH \| DB_RF_HAVESTRUCT);
	dbuf_rele(db, FTAG);
	}

	dpa->dpa_curlevel--;
	uint64_t nextblkid = dpa->dpa_zb.zb_blkid >>
	(dpa->dpa_epbs * (dpa->dpa_curlevel - dpa->dpa_zb.zb_level));
	blkptr_t bp = ((blkptr_t )abuf->b_data) +
	P2PHASE(nextblkid, 1ULL << dpa->dpa_epbs);

	ASSERT(!BP_IS_REDACTED(bp) \|\|
	dsl_dataset_feature_is_active(
	dpa->dpa_dnode->dn_objset->os_dsl_dataset,
	SPA_FEATURE_REDACTED_DATASETS));
	if (BP_IS_HOLE(bp) \|\| BP_IS_REDACTED(bp)) {
	kmem_free(dpa, sizeof (*dpa));
	} else if (dpa->dpa_curlevel == dpa->dpa_zb.zb_level) {
	ASSERT3U(nextblkid, ==, dpa->dpa_zb.zb_blkid);
	dbuf_issue_final_prefetch(dpa, bp);
	kmem_free(dpa, sizeof (*dpa));
	} else {
	arc_flags_t iter_aflags = ARC_FLAG_NOWAIT;
	zbookmark_phys_t zb;

	/* flag if L2ARC eligible, l2arc_noprefetch then decides */
	if (dpa->dpa_aflags & ARC_FLAG_L2CACHE)
	iter_aflags \|= ARC_FLAG_L2CACHE;

	ASSERT3U(dpa->dpa_curlevel, ==, BP_GET_LEVEL(bp));

	SET_BOOKMARK(&zb, dpa->dpa_zb.zb_objset,
	dpa->dpa_zb.zb_object, dpa->dpa_curlevel, nextblkid);

	(void) arc_read(dpa->dpa_zio, dpa->dpa_spa,
	bp, dbuf_prefetch_indirect_done, dpa, dpa->dpa_prio,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE,
	&iter_aflags, &zb);
	}

	arc_buf_destroy(abuf, private);
	}

	/*
	* Issue prefetch reads for the given block on the given level. If the indirect
	* blocks above that block are not in memory, we will read them in
	* asynchronously. As a result, this call never blocks waiting for a read to
	* complete. Note that the prefetch might fail if the dataset is encrypted and
	* the encryption key is unmapped before the IO completes.
	*/
	void
	dbuf_prefetch(dnode_t *dn, int64_t level, uint64_t blkid, zio_priority_t prio,
	arc_flags_t aflags)
	{
	blkptr_t bp;
	int epbs, nlevels, curlevel;
	uint64_t curblkid;

	ASSERT(blkid != DMU_BONUS_BLKID);
	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));

	if (blkid > dn->dn_maxblkid)
	return;

	if (level == 0 && dnode_block_freed(dn, blkid))
	return;

	/*
	* This dnode hasn't been written to disk yet, so there's nothing to
	* prefetch.
	*/
	nlevels = dn->dn_phys->dn_nlevels;
	if (level >= nlevels \|\| dn->dn_phys->dn_nblkptr == 0)
	return;

	epbs = dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
	if (dn->dn_phys->dn_maxblkid < blkid << (epbs * level))
	return;

	dmu_buf_impl_t *db = dbuf_find(dn->dn_objset, dn->dn_object,
	level, blkid);
	if (db != NULL) {
	mutex_exit(&db->db_mtx);
	/*
	* This dbuf already exists. It is either CACHED, or
	* (we assume) about to be read or filled.
	*/
	return;
	}

	/*
	* Find the closest ancestor (indirect block) of the target block
	* that is present in the cache. In this indirect block, we will
	* find the bp that is at curlevel, curblkid.
	*/
	curlevel = level;
	curblkid = blkid;
	while (curlevel < nlevels - 1) {
	int parent_level = curlevel + 1;
	uint64_t parent_blkid = curblkid >> epbs;
	dmu_buf_impl_t *db;

	if (dbuf_hold_impl(dn, parent_level, parent_blkid,
	FALSE, TRUE, FTAG, &db) == 0) {
	blkptr_t *bpp = db->db_buf->b_data;
	bp = bpp[P2PHASE(curblkid, 1 << epbs)];
	dbuf_rele(db, FTAG);
	break;
	}

	curlevel = parent_level;
	curblkid = parent_blkid;
	}

	if (curlevel == nlevels - 1) {
	/* No cached indirect blocks found. */
	ASSERT3U(curblkid, <, dn->dn_phys->dn_nblkptr);
	bp = dn->dn_phys->dn_blkptr[curblkid];
	}
	ASSERT(!BP_IS_REDACTED(&bp) \|\|
	dsl_dataset_feature_is_active(dn->dn_objset->os_dsl_dataset,
	SPA_FEATURE_REDACTED_DATASETS));
	if (BP_IS_HOLE(&bp) \|\| BP_IS_REDACTED(&bp))
	return;

	ASSERT3U(curlevel, ==, BP_GET_LEVEL(&bp));

	zio_t *pio = zio_root(dmu_objset_spa(dn->dn_objset), NULL, NULL,
	ZIO_FLAG_CANFAIL);

	dbuf_prefetch_arg_t dpa = kmem_zalloc(sizeof (dpa), KM_SLEEP);
	dsl_dataset_t *ds = dn->dn_objset->os_dsl_dataset;
	SET_BOOKMARK(&dpa->dpa_zb, ds != NULL ? ds->ds_object : DMU_META_OBJSET,
	dn->dn_object, level, blkid);
	dpa->dpa_curlevel = curlevel;
	dpa->dpa_prio = prio;
	dpa->dpa_aflags = aflags;
	dpa->dpa_spa = dn->dn_objset->os_spa;
	dpa->dpa_dnode = dn;
	dpa->dpa_epbs = epbs;
	dpa->dpa_zio = pio;

	/* flag if L2ARC eligible, l2arc_noprefetch then decides */
	if (DNODE_LEVEL_IS_L2CACHEABLE(dn, level))
	dpa->dpa_aflags \|= ARC_FLAG_L2CACHE;

	/*
	* If we have the indirect just above us, no need to do the asynchronous
	* prefetch chain; we'll just run the last step ourselves. If we're at
	* a higher level, though, we want to issue the prefetches for all the
	* indirect blocks asynchronously, so we can go on with whatever we were
	* doing.
	*/
	if (curlevel == level) {
	ASSERT3U(curblkid, ==, blkid);
	dbuf_issue_final_prefetch(dpa, &bp);
	kmem_free(dpa, sizeof (*dpa));
	} else {
	arc_flags_t iter_aflags = ARC_FLAG_NOWAIT;
	zbookmark_phys_t zb;

	/* flag if L2ARC eligible, l2arc_noprefetch then decides */
	if (DNODE_LEVEL_IS_L2CACHEABLE(dn, level))
	iter_aflags \|= ARC_FLAG_L2CACHE;

	SET_BOOKMARK(&zb, ds != NULL ? ds->ds_object : DMU_META_OBJSET,
	dn->dn_object, curlevel, curblkid);
	(void) arc_read(dpa->dpa_zio, dpa->dpa_spa,
	&bp, dbuf_prefetch_indirect_done, dpa, prio,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE,
	&iter_aflags, &zb);
	}
	/*
	* We use pio here instead of dpa_zio since it's possible that
	* dpa may have already been freed.
	*/
	zio_nowait(pio);
	}

	/*
	* Helper function for dbuf_hold_impl() to copy a buffer. Handles
	* the case of encrypted, compressed and uncompressed buffers by
	* allocating the new buffer, respectively, with arc_alloc_raw_buf(),
	* arc_alloc_compressed_buf() or arc_alloc_buf().*
	*
	* NOTE: Declared noinline to avoid stack bloat in dbuf_hold_impl().
	*/
	noinline static void
	dbuf_hold_copy(dnode_t dn, dmu_buf_impl_t db)
	{
	dbuf_dirty_record_t *dr = db->db_data_pending;
	arc_buf_t newdata, data = dr->dt.dl.dr_data;

	newdata = dbuf_alloc_arcbuf_from_arcbuf(db, data);
	dbuf_set_data(db, newdata);
	rw_enter(&db->db_rwlock, RW_WRITER);
	bcopy(data->b_data, db->db.db_data, arc_buf_size(data));
	rw_exit(&db->db_rwlock);
	}

	/*
	* Returns with db_holds incremented, and db_mtx not held.
	* Note: dn_struct_rwlock must be held.
	*/
	int
	dbuf_hold_impl(dnode_t *dn, uint8_t level, uint64_t blkid,
	boolean_t fail_sparse, boolean_t fail_uncached,
	void tag, dmu_buf_impl_t *dbp)
	{
	dmu_buf_impl_t db, parent = NULL;

	/* If the pool has been created, verify the tx_sync_lock is not held */
	spa_t *spa = dn->dn_objset->os_spa;
	dsl_pool_t *dp = spa->spa_dsl_pool;
	if (dp != NULL) {
	ASSERT(!MUTEX_HELD(&dp->dp_tx.tx_sync_lock));
	}

	ASSERT(blkid != DMU_BONUS_BLKID);
	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));
	ASSERT3U(dn->dn_nlevels, >, level);

	*dbp = NULL;

	/* dbuf_find() returns with db_mtx held */
	db = dbuf_find(dn->dn_objset, dn->dn_object, level, blkid);

	if (db == NULL) {
	blkptr_t *bp = NULL;
	int err;

	if (fail_uncached)
	return (SET_ERROR(ENOENT));

	ASSERT3P(parent, ==, NULL);
	err = dbuf_findbp(dn, level, blkid, fail_sparse, &parent, &bp);
	if (fail_sparse) {
	if (err == 0 && bp && BP_IS_HOLE(bp))
	err = SET_ERROR(ENOENT);
	if (err) {
	if (parent)
	dbuf_rele(parent, NULL);
	return (err);
	}
	}
	if (err && err != ENOENT)
	return (err);
	db = dbuf_create(dn, level, blkid, parent, bp);
	}

	if (fail_uncached && db->db_state != DB_CACHED) {
	mutex_exit(&db->db_mtx);
	return (SET_ERROR(ENOENT));
	}

	if (db->db_buf != NULL) {
	arc_buf_access(db->db_buf);
	ASSERT3P(db->db.db_data, ==, db->db_buf->b_data);
	}

	ASSERT(db->db_buf == NULL \|\| arc_referenced(db->db_buf));

	/*
	* If this buffer is currently syncing out, and we are
	* still referencing it from db_data, we need to make a copy
	* of it in case we decide we want to dirty it again in this txg.
	*/
	if (db->db_level == 0 && db->db_blkid != DMU_BONUS_BLKID &&
	dn->dn_object != DMU_META_DNODE_OBJECT &&
	db->db_state == DB_CACHED && db->db_data_pending) {
	dbuf_dirty_record_t *dr = db->db_data_pending;
	if (dr->dt.dl.dr_data == db->db_buf)
	dbuf_hold_copy(dn, db);
	}

	if (multilist_link_active(&db->db_cache_link)) {
	ASSERT(zfs_refcount_is_zero(&db->db_holds));
	ASSERT(db->db_caching_status == DB_DBUF_CACHE \|\|
	db->db_caching_status == DB_DBUF_METADATA_CACHE);

	multilist_remove(dbuf_caches[db->db_caching_status].cache, db);
	(void) zfs_refcount_remove_many(
	&dbuf_caches[db->db_caching_status].size,
	db->db.db_size, db);

	if (db->db_caching_status == DB_DBUF_METADATA_CACHE) {
	DBUF_STAT_BUMPDOWN(metadata_cache_count);
	} else {
	DBUF_STAT_BUMPDOWN(cache_levels[db->db_level]);
	DBUF_STAT_BUMPDOWN(cache_count);
	DBUF_STAT_DECR(cache_levels_bytes[db->db_level],
	db->db.db_size);
	}
	db->db_caching_status = DB_NO_CACHE;
	}
	(void) zfs_refcount_add(&db->db_holds, tag);
	DBUF_VERIFY(db);
	mutex_exit(&db->db_mtx);

	/* NOTE: we can't rele the parent until after we drop the db_mtx */
	if (parent)
	dbuf_rele(parent, NULL);

	ASSERT3P(DB_DNODE(db), ==, dn);
	ASSERT3U(db->db_blkid, ==, blkid);
	ASSERT3U(db->db_level, ==, level);
	*dbp = db;

	return (0);
	}

	dmu_buf_impl_t *
	dbuf_hold(dnode_t dn, uint64_t blkid, void tag)
	{
	return (dbuf_hold_level(dn, 0, blkid, tag));
	}

	dmu_buf_impl_t *
	dbuf_hold_level(dnode_t dn, int level, uint64_t blkid, void tag)
	{
	dmu_buf_impl_t *db;
	int err = dbuf_hold_impl(dn, level, blkid, FALSE, FALSE, tag, &db);
	return (err ? NULL : db);
	}

	void
	dbuf_create_bonus(dnode_t *dn)
	{
	ASSERT(RW_WRITE_HELD(&dn->dn_struct_rwlock));

	ASSERT(dn->dn_bonus == NULL);
	dn->dn_bonus = dbuf_create(dn, 0, DMU_BONUS_BLKID, dn->dn_dbuf, NULL);
	}

	int
	dbuf_spill_set_blksz(dmu_buf_t db_fake, uint64_t blksz, dmu_tx_t tx)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;

	if (db->db_blkid != DMU_SPILL_BLKID)
	return (SET_ERROR(ENOTSUP));
	if (blksz == 0)
	blksz = SPA_MINBLOCKSIZE;
	ASSERT3U(blksz, <=, spa_maxblocksize(dmu_objset_spa(db->db_objset)));
	blksz = P2ROUNDUP(blksz, SPA_MINBLOCKSIZE);

	dbuf_new_size(db, blksz, tx);

	return (0);
	}

	void
	dbuf_rm_spill(dnode_t dn, dmu_tx_t tx)
	{
	dbuf_free_range(dn, DMU_SPILL_BLKID, DMU_SPILL_BLKID, tx);
	}

	#pragma weak dmu_buf_add_ref = dbuf_add_ref
	void
	dbuf_add_ref(dmu_buf_impl_t db, void tag)
	{
	int64_t holds = zfs_refcount_add(&db->db_holds, tag);
	VERIFY3S(holds, >, 1);
	}

	#pragma weak dmu_buf_try_add_ref = dbuf_try_add_ref
	boolean_t
	dbuf_try_add_ref(dmu_buf_t db_fake, objset_t os, uint64_t obj, uint64_t blkid,
	void *tag)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;
	dmu_buf_impl_t *found_db;
	boolean_t result = B_FALSE;

	if (blkid == DMU_BONUS_BLKID)
	found_db = dbuf_find_bonus(os, obj);
	else
	found_db = dbuf_find(os, obj, 0, blkid);

	if (found_db != NULL) {
	if (db == found_db && dbuf_refcount(db) > db->db_dirtycnt) {
	(void) zfs_refcount_add(&db->db_holds, tag);
	result = B_TRUE;
	}
	mutex_exit(&found_db->db_mtx);
	}
	return (result);
	}

	/*
	* If you call dbuf_rele() you had better not be referencing the dnode handle
	* unless you have some other direct or indirect hold on the dnode. (An indirect
	* hold is a hold on one of the dnode's dbufs, including the bonus buffer.)
	* Without that, the dbuf_rele() could lead to a dnode_rele() followed by the
	* dnode's parent dbuf evicting its dnode handles.
	*/
	void
	dbuf_rele(dmu_buf_impl_t db, void tag)
	{
	mutex_enter(&db->db_mtx);
	dbuf_rele_and_unlock(db, tag, B_FALSE);
	}

	void
	dmu_buf_rele(dmu_buf_t db, void tag)
	{
	dbuf_rele((dmu_buf_impl_t *)db, tag);
	}

	/*
	* dbuf_rele() for an already-locked dbuf. This is necessary to allow
	* db_dirtycnt and db_holds to be updated atomically. The 'evicting'
	* argument should be set if we are already in the dbuf-evicting code
	* path, in which case we don't want to recursively evict. This allows us to
	* avoid deeply nested stacks that would have a call flow similar to this:
	*
	* dbuf_rele()-->dbuf_rele_and_unlock()-->dbuf_evict_notify()
	* ^ \|
	* \| \|
	* +-----dbuf_destroy()<--dbuf_evict_one()<--------+
	*
	*/
	void
	dbuf_rele_and_unlock(dmu_buf_impl_t db, void tag, boolean_t evicting)
	{
	int64_t holds;
	uint64_t size;

	ASSERT(MUTEX_HELD(&db->db_mtx));
	DBUF_VERIFY(db);

	/*
	* Remove the reference to the dbuf before removing its hold on the
	* dnode so we can guarantee in dnode_move() that a referenced bonus
	* buffer has a corresponding dnode hold.
	*/
	holds = zfs_refcount_remove(&db->db_holds, tag);
	ASSERT(holds >= 0);

	/*
	* We can't freeze indirects if there is a possibility that they
	* may be modified in the current syncing context.
	*/
	if (db->db_buf != NULL &&
	holds == (db->db_level == 0 ? db->db_dirtycnt : 0)) {
	arc_buf_freeze(db->db_buf);
	}

	if (holds == db->db_dirtycnt &&
	db->db_level == 0 && db->db_user_immediate_evict)
	dbuf_evict_user(db);

	if (holds == 0) {
	if (db->db_blkid == DMU_BONUS_BLKID) {
	dnode_t *dn;
	boolean_t evict_dbuf = db->db_pending_evict;

	/*
	* If the dnode moves here, we cannot cross this
	* barrier until the move completes.
	*/
	DB_DNODE_ENTER(db);

	dn = DB_DNODE(db);
	atomic_dec_32(&dn->dn_dbufs_count);

	/*
	* Decrementing the dbuf count means that the bonus
	* buffer's dnode hold is no longer discounted in
	* dnode_move(). The dnode cannot move until after
	* the dnode_rele() below.
	*/
	DB_DNODE_EXIT(db);

	/*
	* Do not reference db after its lock is dropped.
	* Another thread may evict it.
	*/
	mutex_exit(&db->db_mtx);

	if (evict_dbuf)
	dnode_evict_bonus(dn);

	dnode_rele(dn, db);
	} else if (db->db_buf == NULL) {
	/*
	* This is a special case: we never associated this
	* dbuf with any data allocated from the ARC.
	*/
	ASSERT(db->db_state == DB_UNCACHED \|\|
	db->db_state == DB_NOFILL);
	dbuf_destroy(db);
	} else if (arc_released(db->db_buf)) {
	/*
	* This dbuf has anonymous data associated with it.
	*/
	dbuf_destroy(db);
	} else {
	boolean_t do_arc_evict = B_FALSE;
	blkptr_t bp;
	spa_t *spa = dmu_objset_spa(db->db_objset);

	if (!DBUF_IS_CACHEABLE(db) &&
	db->db_blkptr != NULL &&
	!BP_IS_HOLE(db->db_blkptr) &&
	!BP_IS_EMBEDDED(db->db_blkptr)) {
	do_arc_evict = B_TRUE;
	bp = *db->db_blkptr;
	}

	if (!DBUF_IS_CACHEABLE(db) \|\|
	db->db_pending_evict) {
	dbuf_destroy(db);
	} else if (!multilist_link_active(&db->db_cache_link)) {
	ASSERT3U(db->db_caching_status, ==,
	DB_NO_CACHE);

	dbuf_cached_state_t dcs =
	dbuf_include_in_metadata_cache(db) ?
	DB_DBUF_METADATA_CACHE : DB_DBUF_CACHE;
	db->db_caching_status = dcs;

	multilist_insert(dbuf_caches[dcs].cache, db);
	size = zfs_refcount_add_many(
	&dbuf_caches[dcs].size,
	db->db.db_size, db);

	if (dcs == DB_DBUF_METADATA_CACHE) {
	DBUF_STAT_BUMP(metadata_cache_count);
	DBUF_STAT_MAX(
	metadata_cache_size_bytes_max,
	size);
	} else {
	DBUF_STAT_BUMP(
	cache_levels[db->db_level]);
	DBUF_STAT_BUMP(cache_count);
	DBUF_STAT_INCR(
	cache_levels_bytes[db->db_level],
	db->db.db_size);
	DBUF_STAT_MAX(cache_size_bytes_max,
	size);
	}
	mutex_exit(&db->db_mtx);

	if (dcs == DB_DBUF_CACHE && !evicting)
	dbuf_evict_notify(size);
	}

	if (do_arc_evict)
	arc_freed(spa, &bp);
	}
	} else {
	mutex_exit(&db->db_mtx);
	}

	}

	#pragma weak dmu_buf_refcount = dbuf_refcount
	uint64_t
	dbuf_refcount(dmu_buf_impl_t *db)
	{
	return (zfs_refcount_count(&db->db_holds));
	}

	uint64_t
	dmu_buf_user_refcount(dmu_buf_t *db_fake)
	{
	uint64_t holds;
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;

	mutex_enter(&db->db_mtx);
	ASSERT3U(zfs_refcount_count(&db->db_holds), >=, db->db_dirtycnt);
	holds = zfs_refcount_count(&db->db_holds) - db->db_dirtycnt;
	mutex_exit(&db->db_mtx);

	return (holds);
	}

	void *
	dmu_buf_replace_user(dmu_buf_t db_fake, dmu_buf_user_t old_user,
	dmu_buf_user_t *new_user)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;

	mutex_enter(&db->db_mtx);
	dbuf_verify_user(db, DBVU_NOT_EVICTING);
	if (db->db_user == old_user)
	db->db_user = new_user;
	else
	old_user = db->db_user;
	dbuf_verify_user(db, DBVU_NOT_EVICTING);
	mutex_exit(&db->db_mtx);

	return (old_user);
	}

	void *
	dmu_buf_set_user(dmu_buf_t db_fake, dmu_buf_user_t user)
	{
	return (dmu_buf_replace_user(db_fake, NULL, user));
	}

	void *
	dmu_buf_set_user_ie(dmu_buf_t db_fake, dmu_buf_user_t user)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;

	db->db_user_immediate_evict = TRUE;
	return (dmu_buf_set_user(db_fake, user));
	}

	void *
	dmu_buf_remove_user(dmu_buf_t db_fake, dmu_buf_user_t user)
	{
	return (dmu_buf_replace_user(db_fake, user, NULL));
	}

	void *
	dmu_buf_get_user(dmu_buf_t *db_fake)
	{
	dmu_buf_impl_t db = (dmu_buf_impl_t )db_fake;

	dbuf_verify_user(db, DBVU_NOT_EVICTING);
	return (db->db_user);
	}

	void
	dmu_buf_user_evict_wait()
	{
	taskq_wait(dbu_evict_taskq);
	}

	blkptr_t *
	dmu_buf_get_blkptr(dmu_buf_t *db)
	{
	dmu_buf_impl_t dbi = (dmu_buf_impl_t )db;
	return (dbi->db_blkptr);
	}

	objset_t *
	dmu_buf_get_objset(dmu_buf_t *db)
	{
	dmu_buf_impl_t dbi = (dmu_buf_impl_t )db;
	return (dbi->db_objset);
	}

	dnode_t *
	dmu_buf_dnode_enter(dmu_buf_t *db)
	{
	dmu_buf_impl_t dbi = (dmu_buf_impl_t )db;
	DB_DNODE_ENTER(dbi);
	return (DB_DNODE(dbi));
	}

	void
	dmu_buf_dnode_exit(dmu_buf_t *db)
	{
	dmu_buf_impl_t dbi = (dmu_buf_impl_t )db;
	DB_DNODE_EXIT(dbi);
	}

	static void
	dbuf_check_blkptr(dnode_t dn, dmu_buf_impl_t db)
	{
	/* ASSERT(dmu_tx_is_syncing(tx) */
	ASSERT(MUTEX_HELD(&db->db_mtx));

	if (db->db_blkptr != NULL)
	return;

	if (db->db_blkid == DMU_SPILL_BLKID) {
	db->db_blkptr = DN_SPILL_BLKPTR(dn->dn_phys);
	BP_ZERO(db->db_blkptr);
	return;
	}
	if (db->db_level == dn->dn_phys->dn_nlevels-1) {
	/*
	* This buffer was allocated at a time when there was
	* no available blkptrs from the dnode, or it was
	* inappropriate to hook it in (i.e., nlevels mismatch).
	*/
	ASSERT(db->db_blkid < dn->dn_phys->dn_nblkptr);
	ASSERT(db->db_parent == NULL);
	db->db_parent = dn->dn_dbuf;
	db->db_blkptr = &dn->dn_phys->dn_blkptr[db->db_blkid];
	DBUF_VERIFY(db);
	} else {
	dmu_buf_impl_t *parent = db->db_parent;
	int epbs = dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;

	ASSERT(dn->dn_phys->dn_nlevels > 1);
	if (parent == NULL) {
	mutex_exit(&db->db_mtx);
	rw_enter(&dn->dn_struct_rwlock, RW_READER);
	parent = dbuf_hold_level(dn, db->db_level + 1,
	db->db_blkid >> epbs, db);
	rw_exit(&dn->dn_struct_rwlock);
	mutex_enter(&db->db_mtx);
	db->db_parent = parent;
	}
	db->db_blkptr = (blkptr_t *)parent->db.db_data +
	(db->db_blkid & ((1ULL << epbs) - 1));
	DBUF_VERIFY(db);
	}
	}

	static void
	dbuf_sync_bonus(dbuf_dirty_record_t dr, dmu_tx_t tx)
	{
	dmu_buf_impl_t *db = dr->dr_dbuf;
	void *data = dr->dt.dl.dr_data;

	ASSERT0(db->db_level);
	ASSERT(MUTEX_HELD(&db->db_mtx));
	ASSERT(DB_DNODE_HELD(db));
	ASSERT(db->db_blkid == DMU_BONUS_BLKID);
	ASSERT(data != NULL);

	dnode_t *dn = DB_DNODE(db);
	ASSERT3U(DN_MAX_BONUS_LEN(dn->dn_phys), <=,
	DN_SLOTS_TO_BONUSLEN(dn->dn_phys->dn_extra_slots + 1));
	bcopy(data, DN_BONUS(dn->dn_phys), DN_MAX_BONUS_LEN(dn->dn_phys));
	DB_DNODE_EXIT(db);

	dbuf_sync_leaf_verify_bonus_dnode(dr);

	dbuf_undirty_bonus(dr);
	dbuf_rele_and_unlock(db, (void *)(uintptr_t)tx->tx_txg, B_FALSE);
	}

	/*
	* When syncing out a blocks of dnodes, adjust the block to deal with
	* encryption. Normally, we make sure the block is decrypted before writing
	* it. If we have crypt params, then we are writing a raw (encrypted) block,
	* from a raw receive. In this case, set the ARC buf's crypt params so
	* that the BP will be filled with the correct byteorder, salt, iv, and mac.
	*/
	static void
	dbuf_prepare_encrypted_dnode_leaf(dbuf_dirty_record_t *dr)
	{
	int err;
	dmu_buf_impl_t *db = dr->dr_dbuf;

	ASSERT(MUTEX_HELD(&db->db_mtx));
	ASSERT3U(db->db.db_object, ==, DMU_META_DNODE_OBJECT);
	ASSERT3U(db->db_level, ==, 0);

	if (!db->db_objset->os_raw_receive && arc_is_encrypted(db->db_buf)) {
	zbookmark_phys_t zb;

	/*
	* Unfortunately, there is currently no mechanism for
	* syncing context to handle decryption errors. An error
	* here is only possible if an attacker maliciously
	* changed a dnode block and updated the associated
	* checksums going up the block tree.
	*/
	SET_BOOKMARK(&zb, dmu_objset_id(db->db_objset),
	db->db.db_object, db->db_level, db->db_blkid);
	err = arc_untransform(db->db_buf, db->db_objset->os_spa,
	&zb, B_TRUE);
	if (err)
	panic("Invalid dnode block MAC");
	} else if (dr->dt.dl.dr_has_raw_params) {
	(void) arc_release(dr->dt.dl.dr_data, db);
	arc_convert_to_raw(dr->dt.dl.dr_data,
	dmu_objset_id(db->db_objset),
	dr->dt.dl.dr_byteorder, DMU_OT_DNODE,
	dr->dt.dl.dr_salt, dr->dt.dl.dr_iv, dr->dt.dl.dr_mac);
	}
	}

	/*
	* dbuf_sync_indirect() is called recursively from dbuf_sync_list() so it
	* is critical the we not allow the compiler to inline this function in to
	* dbuf_sync_list() thereby drastically bloating the stack usage.
	*/
	noinline static void
	dbuf_sync_indirect(dbuf_dirty_record_t dr, dmu_tx_t tx)
	{
	dmu_buf_impl_t *db = dr->dr_dbuf;
	dnode_t *dn;
	zio_t *zio;

	ASSERT(dmu_tx_is_syncing(tx));

	dprintf_dbuf_bp(db, db->db_blkptr, "blkptr=%p", db->db_blkptr);

	mutex_enter(&db->db_mtx);

	ASSERT(db->db_level > 0);
	DBUF_VERIFY(db);

	/* Read the block if it hasn't been read yet. */
	if (db->db_buf == NULL) {
	mutex_exit(&db->db_mtx);
	(void) dbuf_read(db, NULL, DB_RF_MUST_SUCCEED);
	mutex_enter(&db->db_mtx);
	}
	ASSERT3U(db->db_state, ==, DB_CACHED);
	ASSERT(db->db_buf != NULL);

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	/* Indirect block size must match what the dnode thinks it is. */
	ASSERT3U(db->db.db_size, ==, 1<<dn->dn_phys->dn_indblkshift);
	dbuf_check_blkptr(dn, db);
	DB_DNODE_EXIT(db);

	/* Provide the pending dirty record to child dbufs */
	db->db_data_pending = dr;

	mutex_exit(&db->db_mtx);

	dbuf_write(dr, db->db_buf, tx);

	zio = dr->dr_zio;
	mutex_enter(&dr->dt.di.dr_mtx);
	dbuf_sync_list(&dr->dt.di.dr_children, db->db_level - 1, tx);
	ASSERT(list_head(&dr->dt.di.dr_children) == NULL);
	mutex_exit(&dr->dt.di.dr_mtx);
	zio_nowait(zio);
	}

	/*
	* Verify that the size of the data in our bonus buffer does not exceed
	* its recorded size.
	*
	* The purpose of this verification is to catch any cases in development
	* where the size of a phys structure (i.e space_map_phys_t) grows and,
	* due to incorrect feature management, older pools expect to read more
	* data even though they didn't actually write it to begin with.
	*
	* For a example, this would catch an error in the feature logic where we
	* open an older pool and we expect to write the space map histogram of
	* a space map with size SPACE_MAP_SIZE_V0.
	*/
	static void
	dbuf_sync_leaf_verify_bonus_dnode(dbuf_dirty_record_t *dr)
	{
	#ifdef ZFS_DEBUG
	dnode_t *dn = DB_DNODE(dr->dr_dbuf);

	/*
	* Encrypted bonus buffers can have data past their bonuslen.
	* Skip the verification of these blocks.
	*/
	if (DMU_OT_IS_ENCRYPTED(dn->dn_bonustype))
	return;

	uint16_t bonuslen = dn->dn_phys->dn_bonuslen;
	uint16_t maxbonuslen = DN_SLOTS_TO_BONUSLEN(dn->dn_num_slots);
	ASSERT3U(bonuslen, <=, maxbonuslen);

	arc_buf_t *datap = dr->dt.dl.dr_data;
	char datap_end = ((char )datap) + bonuslen;
	char datap_max = ((char )datap) + maxbonuslen;

	/* ensure that everything is zero after our data */
	for (; datap_end < datap_max; datap_end++)
	ASSERT(*datap_end == 0);
	#endif
	}

	/*
	* dbuf_sync_leaf() is called recursively from dbuf_sync_list() so it is
	* critical the we not allow the compiler to inline this function in to
	* dbuf_sync_list() thereby drastically bloating the stack usage.
	*/
	noinline static void
	dbuf_sync_leaf(dbuf_dirty_record_t dr, dmu_tx_t tx)
	{
	arc_buf_t **datap = &dr->dt.dl.dr_data;
	dmu_buf_impl_t *db = dr->dr_dbuf;
	dnode_t *dn;
	objset_t *os;
	uint64_t txg = tx->tx_txg;

	ASSERT(dmu_tx_is_syncing(tx));

	dprintf_dbuf_bp(db, db->db_blkptr, "blkptr=%p", db->db_blkptr);

	mutex_enter(&db->db_mtx);
	/*
	* To be synced, we must be dirtied. But we
	* might have been freed after the dirty.
	*/
	if (db->db_state == DB_UNCACHED) {
	/* This buffer has been freed since it was dirtied */
	ASSERT(db->db.db_data == NULL);
	} else if (db->db_state == DB_FILL) {
	/* This buffer was freed and is now being re-filled */
	ASSERT(db->db.db_data != dr->dt.dl.dr_data);
	} else {
	ASSERT(db->db_state == DB_CACHED \|\| db->db_state == DB_NOFILL);
	}
	DBUF_VERIFY(db);

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);

	if (db->db_blkid == DMU_SPILL_BLKID) {
	mutex_enter(&dn->dn_mtx);
	if (!(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR)) {
	/*
	* In the previous transaction group, the bonus buffer
	* was entirely used to store the attributes for the
	* dnode which overrode the dn_spill field. However,
	* when adding more attributes to the file a spill
	* block was required to hold the extra attributes.
	*
	* Make sure to clear the garbage left in the dn_spill
	* field from the previous attributes in the bonus
	* buffer. Otherwise, after writing out the spill
	* block to the new allocated dva, it will free
	* the old block pointed to by the invalid dn_spill.
	*/
	db->db_blkptr = NULL;
	}
	dn->dn_phys->dn_flags \|= DNODE_FLAG_SPILL_BLKPTR;
	mutex_exit(&dn->dn_mtx);
	}

	/*
	* If this is a bonus buffer, simply copy the bonus data into the
	* dnode. It will be written out when the dnode is synced (and it
	* will be synced, since it must have been dirty for dbuf_sync to
	* be called).
	*/
	if (db->db_blkid == DMU_BONUS_BLKID) {
	ASSERT(dr->dr_dbuf == db);
	dbuf_sync_bonus(dr, tx);
	return;
	}

	os = dn->dn_objset;

	/*
	* This function may have dropped the db_mtx lock allowing a dmu_sync
	* operation to sneak in. As a result, we need to ensure that we
	* don't check the dr_override_state until we have returned from
	* dbuf_check_blkptr.
	*/
	dbuf_check_blkptr(dn, db);

	/*
	* If this buffer is in the middle of an immediate write,
	* wait for the synchronous IO to complete.
	*/
	while (dr->dt.dl.dr_override_state == DR_IN_DMU_SYNC) {
	ASSERT(dn->dn_object != DMU_META_DNODE_OBJECT);
	cv_wait(&db->db_changed, &db->db_mtx);
	ASSERT(dr->dt.dl.dr_override_state != DR_NOT_OVERRIDDEN);
	}

	/*
	* If this is a dnode block, ensure it is appropriately encrypted
	* or decrypted, depending on what we are writing to it this txg.
	*/
	if (os->os_encrypted && dn->dn_object == DMU_META_DNODE_OBJECT)
	dbuf_prepare_encrypted_dnode_leaf(dr);

	if (db->db_state != DB_NOFILL &&
	dn->dn_object != DMU_META_DNODE_OBJECT &&
	zfs_refcount_count(&db->db_holds) > 1 &&
	dr->dt.dl.dr_override_state != DR_OVERRIDDEN &&
	*datap == db->db_buf) {
	/*
	* If this buffer is currently "in use" (i.e., there
	* are active holds and db_data still references it),
	* then make a copy before we start the write so that
	* any modifications from the open txg will not leak
	* into this write.
	*
	* NOTE: this copy does not need to be made for
	* objects only modified in the syncing context (e.g.
	* DNONE_DNODE blocks).
	*/
	*datap = dbuf_alloc_arcbuf_from_arcbuf(db, db->db_buf);
	bcopy(db->db.db_data, (datap)->b_data, arc_buf_size(datap));
	}
	db->db_data_pending = dr;

	mutex_exit(&db->db_mtx);

	dbuf_write(dr, *datap, tx);

	ASSERT(!list_link_active(&dr->dr_dirty_node));
	if (dn->dn_object == DMU_META_DNODE_OBJECT) {
	list_insert_tail(&dn->dn_dirty_records[txg & TXG_MASK], dr);
	DB_DNODE_EXIT(db);
	} else {
	/*
	* Although zio_nowait() does not "wait for an IO", it does
	* initiate the IO. If this is an empty write it seems plausible
	* that the IO could actually be completed before the nowait
	* returns. We need to DB_DNODE_EXIT() first in case
	* zio_nowait() invalidates the dbuf.
	*/
	DB_DNODE_EXIT(db);
	zio_nowait(dr->dr_zio);
	}
	}

	void
	dbuf_sync_list(list_t list, int level, dmu_tx_t tx)
	{
	dbuf_dirty_record_t *dr;

	while ((dr = list_head(list))) {
	if (dr->dr_zio != NULL) {
	/*
	* If we find an already initialized zio then we
	* are processing the meta-dnode, and we have finished.
	* The dbufs for all dnodes are put back on the list
	* during processing, so that we can zio_wait()
	* these IOs after initiating all child IOs.
	*/
	ASSERT3U(dr->dr_dbuf->db.db_object, ==,
	DMU_META_DNODE_OBJECT);
	break;
	}
	if (dr->dr_dbuf->db_blkid != DMU_BONUS_BLKID &&
	dr->dr_dbuf->db_blkid != DMU_SPILL_BLKID) {
	VERIFY3U(dr->dr_dbuf->db_level, ==, level);
	}
	list_remove(list, dr);
	if (dr->dr_dbuf->db_level > 0)
	dbuf_sync_indirect(dr, tx);
	else
	dbuf_sync_leaf(dr, tx);
	}
	}

	/* ARGSUSED */
	static void
	dbuf_write_ready(zio_t zio, arc_buf_t buf, void *vdb)
	{
	dmu_buf_impl_t *db = vdb;
	dnode_t *dn;
	blkptr_t *bp = zio->io_bp;
	blkptr_t *bp_orig = &zio->io_bp_orig;
	spa_t *spa = zio->io_spa;
	int64_t delta;
	uint64_t fill = 0;
	int i;

	ASSERT3P(db->db_blkptr, !=, NULL);
	ASSERT3P(&db->db_data_pending->dr_bp_copy, ==, bp);

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	delta = bp_get_dsize_sync(spa, bp) - bp_get_dsize_sync(spa, bp_orig);
	dnode_diduse_space(dn, delta - zio->io_prev_space_delta);
	zio->io_prev_space_delta = delta;

	if (bp->blk_birth != 0) {
	ASSERT((db->db_blkid != DMU_SPILL_BLKID &&
	BP_GET_TYPE(bp) == dn->dn_type) \|\|
	(db->db_blkid == DMU_SPILL_BLKID &&
	BP_GET_TYPE(bp) == dn->dn_bonustype) \|\|
	BP_IS_EMBEDDED(bp));
	ASSERT(BP_GET_LEVEL(bp) == db->db_level);
	}

	mutex_enter(&db->db_mtx);

	#ifdef ZFS_DEBUG
	if (db->db_blkid == DMU_SPILL_BLKID) {
	ASSERT(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR);
	ASSERT(!(BP_IS_HOLE(bp)) &&
	db->db_blkptr == DN_SPILL_BLKPTR(dn->dn_phys));
	}
	#endif

	if (db->db_level == 0) {
	mutex_enter(&dn->dn_mtx);
	if (db->db_blkid > dn->dn_phys->dn_maxblkid &&
	db->db_blkid != DMU_SPILL_BLKID) {
	ASSERT0(db->db_objset->os_raw_receive);
	dn->dn_phys->dn_maxblkid = db->db_blkid;
	}
	mutex_exit(&dn->dn_mtx);

	if (dn->dn_type == DMU_OT_DNODE) {
	i = 0;
	while (i < db->db.db_size) {
	dnode_phys_t *dnp =
	(void )(((char )db->db.db_data) + i);

	i += DNODE_MIN_SIZE;
	if (dnp->dn_type != DMU_OT_NONE) {
	fill++;
	i += dnp->dn_extra_slots *
	DNODE_MIN_SIZE;
	}
	}
	} else {
	if (BP_IS_HOLE(bp)) {
	fill = 0;
	} else {
	fill = 1;
	}
	}
	} else {
	blkptr_t *ibp = db->db.db_data;
	ASSERT3U(db->db.db_size, ==, 1<<dn->dn_phys->dn_indblkshift);
	for (i = db->db.db_size >> SPA_BLKPTRSHIFT; i > 0; i--, ibp++) {
	if (BP_IS_HOLE(ibp))
	continue;
	fill += BP_GET_FILL(ibp);
	}
	}
	DB_DNODE_EXIT(db);

	if (!BP_IS_EMBEDDED(bp))
	BP_SET_FILL(bp, fill);

	mutex_exit(&db->db_mtx);

	db_lock_type_t dblt = dmu_buf_lock_parent(db, RW_WRITER, FTAG);
	db->db_blkptr = bp;
	dmu_buf_unlock_parent(db, dblt, FTAG);
	}

	/* ARGSUSED */
	/*
	* This function gets called just prior to running through the compression
	* stage of the zio pipeline. If we're an indirect block comprised of only
	* holes, then we want this indirect to be compressed away to a hole. In
	* order to do that we must zero out any information about the holes that
	* this indirect points to prior to before we try to compress it.
	*/
	static void
	dbuf_write_children_ready(zio_t zio, arc_buf_t buf, void *vdb)
	{
	dmu_buf_impl_t *db = vdb;
	dnode_t *dn;
	blkptr_t *bp;
	unsigned int epbs, i;

	ASSERT3U(db->db_level, >, 0);
	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	epbs = dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
	ASSERT3U(epbs, <, 31);

	/* Determine if all our children are holes */
	for (i = 0, bp = db->db.db_data; i < 1ULL << epbs; i++, bp++) {
	if (!BP_IS_HOLE(bp))
	break;
	}

	/*
	* If all the children are holes, then zero them all out so that
	* we may get compressed away.
	*/
	if (i == 1ULL << epbs) {
	/*
	* We only found holes. Grab the rwlock to prevent
	* anybody from reading the blocks we're about to
	* zero out.
	*/
	rw_enter(&db->db_rwlock, RW_WRITER);
	bzero(db->db.db_data, db->db.db_size);
	rw_exit(&db->db_rwlock);
	}
	DB_DNODE_EXIT(db);
	}

	/*
	* The SPA will call this callback several times for each zio - once
	* for every physical child i/o (zio->io_phys_children times). This
	* allows the DMU to monitor the progress of each logical i/o. For example,
	* there may be 2 copies of an indirect block, or many fragments of a RAID-Z
	* block. There may be a long delay before all copies/fragments are completed,
	* so this callback allows us to retire dirty space gradually, as the physical
	* i/os complete.
	*/
	/* ARGSUSED */
	static void
	dbuf_write_physdone(zio_t zio, arc_buf_t buf, void *arg)
	{
	dmu_buf_impl_t *db = arg;
	objset_t *os = db->db_objset;
	dsl_pool_t *dp = dmu_objset_pool(os);
	dbuf_dirty_record_t *dr;
	int delta = 0;

	dr = db->db_data_pending;
	ASSERT3U(dr->dr_txg, ==, zio->io_txg);

	/*
	* The callback will be called io_phys_children times. Retire one
	* portion of our dirty space each time we are called. Any rounding
	* error will be cleaned up by dbuf_write_done().
	*/
	delta = dr->dr_accounted / zio->io_phys_children;
	dsl_pool_undirty_space(dp, delta, zio->io_txg);
	}

	/* ARGSUSED */
	static void
	dbuf_write_done(zio_t zio, arc_buf_t buf, void *vdb)
	{
	dmu_buf_impl_t *db = vdb;
	blkptr_t *bp_orig = &zio->io_bp_orig;
	blkptr_t *bp = db->db_blkptr;
	objset_t *os = db->db_objset;
	dmu_tx_t *tx = os->os_synctx;
	dbuf_dirty_record_t *dr;

	ASSERT0(zio->io_error);
	ASSERT(db->db_blkptr == bp);

	/*
	* For nopwrites and rewrites we ensure that the bp matches our
	* original and bypass all the accounting.
	*/
	if (zio->io_flags & (ZIO_FLAG_IO_REWRITE \| ZIO_FLAG_NOPWRITE)) {
	ASSERT(BP_EQUAL(bp, bp_orig));
	} else {
	dsl_dataset_t *ds = os->os_dsl_dataset;
	(void) dsl_dataset_block_kill(ds, bp_orig, tx, B_TRUE);
	dsl_dataset_block_born(ds, bp, tx);
	}

	mutex_enter(&db->db_mtx);

	DBUF_VERIFY(db);

	dr = db->db_data_pending;
	ASSERT(!list_link_active(&dr->dr_dirty_node));
	ASSERT(dr->dr_dbuf == db);
	ASSERT(list_next(&db->db_dirty_records, dr) == NULL);
	list_remove(&db->db_dirty_records, dr);

	#ifdef ZFS_DEBUG
	if (db->db_blkid == DMU_SPILL_BLKID) {
	dnode_t *dn;

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	ASSERT(dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR);
	ASSERT(!(BP_IS_HOLE(db->db_blkptr)) &&
	db->db_blkptr == DN_SPILL_BLKPTR(dn->dn_phys));
	DB_DNODE_EXIT(db);
	}
	#endif

	if (db->db_level == 0) {
	ASSERT(db->db_blkid != DMU_BONUS_BLKID);
	ASSERT(dr->dt.dl.dr_override_state == DR_NOT_OVERRIDDEN);
	if (db->db_state != DB_NOFILL) {
	if (dr->dt.dl.dr_data != db->db_buf)
	arc_buf_destroy(dr->dt.dl.dr_data, db);
	}
	} else {
	dnode_t *dn;

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	ASSERT(list_head(&dr->dt.di.dr_children) == NULL);
	ASSERT3U(db->db.db_size, ==, 1 << dn->dn_phys->dn_indblkshift);
	if (!BP_IS_HOLE(db->db_blkptr)) {
	int epbs __maybe_unused = dn->dn_phys->dn_indblkshift -
	SPA_BLKPTRSHIFT;
	ASSERT3U(db->db_blkid, <=,
	dn->dn_phys->dn_maxblkid >> (db->db_level * epbs));
	ASSERT3U(BP_GET_LSIZE(db->db_blkptr), ==,
	db->db.db_size);
	}
	DB_DNODE_EXIT(db);
	mutex_destroy(&dr->dt.di.dr_mtx);
	list_destroy(&dr->dt.di.dr_children);
	}

	cv_broadcast(&db->db_changed);
	ASSERT(db->db_dirtycnt > 0);
	db->db_dirtycnt -= 1;
	db->db_data_pending = NULL;
	dbuf_rele_and_unlock(db, (void *)(uintptr_t)tx->tx_txg, B_FALSE);

	/*
	* If we didn't do a physical write in this ZIO and we
	* still ended up here, it means that the space of the
	* dbuf that we just released (and undirtied) above hasn't
	* been marked as undirtied in the pool's accounting.
	*
	* Thus, we undirty that space in the pool's view of the
	* world here. For physical writes this type of update
	* happens in dbuf_write_physdone().
	*
	* If we did a physical write, cleanup any rounding errors
	* that came up due to writing multiple copies of a block
	* on disk [see dbuf_write_physdone()].
	*/
	if (zio->io_phys_children == 0) {
	dsl_pool_undirty_space(dmu_objset_pool(os),
	dr->dr_accounted, zio->io_txg);
	} else {
	dsl_pool_undirty_space(dmu_objset_pool(os),
	dr->dr_accounted % zio->io_phys_children, zio->io_txg);
	}

	kmem_free(dr, sizeof (dbuf_dirty_record_t));
	}

	static void
	dbuf_write_nofill_ready(zio_t *zio)
	{
	dbuf_write_ready(zio, NULL, zio->io_private);
	}

	static void
	dbuf_write_nofill_done(zio_t *zio)
	{
	dbuf_write_done(zio, NULL, zio->io_private);
	}

	static void
	dbuf_write_override_ready(zio_t *zio)
	{
	dbuf_dirty_record_t *dr = zio->io_private;
	dmu_buf_impl_t *db = dr->dr_dbuf;

	dbuf_write_ready(zio, NULL, db);
	}

	static void
	dbuf_write_override_done(zio_t *zio)
	{
	dbuf_dirty_record_t *dr = zio->io_private;
	dmu_buf_impl_t *db = dr->dr_dbuf;
	blkptr_t *obp = &dr->dt.dl.dr_overridden_by;

	mutex_enter(&db->db_mtx);
	if (!BP_EQUAL(zio->io_bp, obp)) {
	if (!BP_IS_HOLE(obp))
	dsl_free(spa_get_dsl(zio->io_spa), zio->io_txg, obp);
	arc_release(dr->dt.dl.dr_data, db);
	}
	mutex_exit(&db->db_mtx);

	dbuf_write_done(zio, NULL, db);

	if (zio->io_abd != NULL)
	abd_put(zio->io_abd);
	}

	typedef struct dbuf_remap_impl_callback_arg {
	objset_t *drica_os;
	uint64_t drica_blk_birth;
	dmu_tx_t *drica_tx;
	} dbuf_remap_impl_callback_arg_t;

	static void
	dbuf_remap_impl_callback(uint64_t vdev, uint64_t offset, uint64_t size,
	void *arg)
	{
	dbuf_remap_impl_callback_arg_t *drica = arg;
	objset_t *os = drica->drica_os;
	spa_t *spa = dmu_objset_spa(os);
	dmu_tx_t *tx = drica->drica_tx;

	ASSERT(dsl_pool_sync_context(spa_get_dsl(spa)));

	if (os == spa_meta_objset(spa)) {
	spa_vdev_indirect_mark_obsolete(spa, vdev, offset, size, tx);
	} else {
	dsl_dataset_block_remapped(dmu_objset_ds(os), vdev, offset,
	size, drica->drica_blk_birth, tx);
	}
	}

	static void
	dbuf_remap_impl(dnode_t dn, blkptr_t bp, krwlock_t rw, dmu_tx_t tx)
	{
	blkptr_t bp_copy = *bp;
	spa_t *spa = dmu_objset_spa(dn->dn_objset);
	dbuf_remap_impl_callback_arg_t drica;

	ASSERT(dsl_pool_sync_context(spa_get_dsl(spa)));

	drica.drica_os = dn->dn_objset;
	drica.drica_blk_birth = bp->blk_birth;
	drica.drica_tx = tx;
	if (spa_remap_blkptr(spa, &bp_copy, dbuf_remap_impl_callback,
	&drica)) {
	/*
	* If the blkptr being remapped is tracked by a livelist,
	* then we need to make sure the livelist reflects the update.
	* First, cancel out the old blkptr by appending a 'FREE'
	* entry. Next, add an 'ALLOC' to track the new version. This
	* way we avoid trying to free an inaccurate blkptr at delete.
	* Note that embedded blkptrs are not tracked in livelists.
	*/
	if (dn->dn_objset != spa_meta_objset(spa)) {
	dsl_dataset_t *ds = dmu_objset_ds(dn->dn_objset);
	if (dsl_deadlist_is_open(&ds->ds_dir->dd_livelist) &&
	bp->blk_birth > ds->ds_dir->dd_origin_txg) {
	ASSERT(!BP_IS_EMBEDDED(bp));
	ASSERT(dsl_dir_is_clone(ds->ds_dir));
	ASSERT(spa_feature_is_enabled(spa,
	SPA_FEATURE_LIVELIST));
	bplist_append(&ds->ds_dir->dd_pending_frees,
	bp);
	bplist_append(&ds->ds_dir->dd_pending_allocs,
	&bp_copy);
	}
	}

	/*
	* The db_rwlock prevents dbuf_read_impl() from
	* dereferencing the BP while we are changing it. To
	* avoid lock contention, only grab it when we are actually
	* changing the BP.
	*/
	if (rw != NULL)
	rw_enter(rw, RW_WRITER);
	*bp = bp_copy;
	if (rw != NULL)
	rw_exit(rw);
	}
	}

	/*
	* Remap any existing BP's to concrete vdevs, if possible.
	*/
	static void
	dbuf_remap(dnode_t dn, dmu_buf_impl_t db, dmu_tx_t *tx)
	{
	spa_t *spa = dmu_objset_spa(db->db_objset);
	ASSERT(dsl_pool_sync_context(spa_get_dsl(spa)));

	if (!spa_feature_is_active(spa, SPA_FEATURE_DEVICE_REMOVAL))
	return;

	if (db->db_level > 0) {
	blkptr_t *bp = db->db.db_data;
	for (int i = 0; i < db->db.db_size >> SPA_BLKPTRSHIFT; i++) {
	dbuf_remap_impl(dn, &bp[i], &db->db_rwlock, tx);
	}
	} else if (db->db.db_object == DMU_META_DNODE_OBJECT) {
	dnode_phys_t *dnp = db->db.db_data;
	ASSERT3U(db->db_dnode_handle->dnh_dnode->dn_type, ==,
	DMU_OT_DNODE);
	for (int i = 0; i < db->db.db_size >> DNODE_SHIFT;
	i += dnp[i].dn_extra_slots + 1) {
	for (int j = 0; j < dnp[i].dn_nblkptr; j++) {
	krwlock_t *lock = (dn->dn_dbuf == NULL ? NULL :
	&dn->dn_dbuf->db_rwlock);
	dbuf_remap_impl(dn, &dnp[i].dn_blkptr[j], lock,
	tx);
	}
	}
	}
	}


	/* Issue I/O to commit a dirty buffer to disk. */
	static void
	dbuf_write(dbuf_dirty_record_t dr, arc_buf_t data, dmu_tx_t *tx)
	{
	dmu_buf_impl_t *db = dr->dr_dbuf;
	dnode_t *dn;
	objset_t *os;
	dmu_buf_impl_t *parent = db->db_parent;
	uint64_t txg = tx->tx_txg;
	zbookmark_phys_t zb;
	zio_prop_t zp;
	zio_t pio; / parent I/O */
	int wp_flag = 0;

	ASSERT(dmu_tx_is_syncing(tx));

	DB_DNODE_ENTER(db);
	dn = DB_DNODE(db);
	os = dn->dn_objset;

	if (db->db_state != DB_NOFILL) {
	if (db->db_level > 0 \|\| dn->dn_type == DMU_OT_DNODE) {
	/*
	* Private object buffers are released here rather
	* than in dbuf_dirty() since they are only modified
	* in the syncing context and we don't want the
	* overhead of making multiple copies of the data.
	*/
	if (BP_IS_HOLE(db->db_blkptr)) {
	arc_buf_thaw(data);
	} else {
	dbuf_release_bp(db);
	}
	dbuf_remap(dn, db, tx);
	}
	}

	if (parent != dn->dn_dbuf) {
	/* Our parent is an indirect block. */
	/* We have a dirty parent that has been scheduled for write. */
	ASSERT(parent && parent->db_data_pending);
	/* Our parent's buffer is one level closer to the dnode. */
	ASSERT(db->db_level == parent->db_level-1);
	/*
	* We're about to modify our parent's db_data by modifying
	* our block pointer, so the parent must be released.
	*/
	ASSERT(arc_released(parent->db_buf));
	pio = parent->db_data_pending->dr_zio;
	} else {
	/* Our parent is the dnode itself. */
	ASSERT((db->db_level == dn->dn_phys->dn_nlevels-1 &&
	db->db_blkid != DMU_SPILL_BLKID) \|\|
	(db->db_blkid == DMU_SPILL_BLKID && db->db_level == 0));
	if (db->db_blkid != DMU_SPILL_BLKID)
	ASSERT3P(db->db_blkptr, ==,
	&dn->dn_phys->dn_blkptr[db->db_blkid]);
	pio = dn->dn_zio;
	}

	ASSERT(db->db_level == 0 \|\| data == db->db_buf);
	ASSERT3U(db->db_blkptr->blk_birth, <=, txg);
	ASSERT(pio);

	SET_BOOKMARK(&zb, os->os_dsl_dataset ?
	os->os_dsl_dataset->ds_object : DMU_META_OBJSET,
	db->db.db_object, db->db_level, db->db_blkid);

	if (db->db_blkid == DMU_SPILL_BLKID)
	wp_flag = WP_SPILL;
	wp_flag \|= (db->db_state == DB_NOFILL) ? WP_NOFILL : 0;

	dmu_write_policy(os, dn, db->db_level, wp_flag, &zp);
	DB_DNODE_EXIT(db);

	/*
	* We copy the blkptr now (rather than when we instantiate the dirty
	* record), because its value can change between open context and
	* syncing context. We do not need to hold dn_struct_rwlock to read
	* db_blkptr because we are in syncing context.
	*/
	dr->dr_bp_copy = *db->db_blkptr;

	if (db->db_level == 0 &&
	dr->dt.dl.dr_override_state == DR_OVERRIDDEN) {
	/*
	* The BP for this block has been provided by open context
	* (by dmu_sync() or dmu_buf_write_embedded()).
	*/
	abd_t *contents = (data != NULL) ?
	abd_get_from_buf(data->b_data, arc_buf_size(data)) : NULL;

	dr->dr_zio = zio_write(pio, os->os_spa, txg, &dr->dr_bp_copy,
	contents, db->db.db_size, db->db.db_size, &zp,
	dbuf_write_override_ready, NULL, NULL,
	dbuf_write_override_done,
	dr, ZIO_PRIORITY_ASYNC_WRITE, ZIO_FLAG_MUSTSUCCEED, &zb);
	mutex_enter(&db->db_mtx);
	dr->dt.dl.dr_override_state = DR_NOT_OVERRIDDEN;
	zio_write_override(dr->dr_zio, &dr->dt.dl.dr_overridden_by,
	dr->dt.dl.dr_copies, dr->dt.dl.dr_nopwrite);
	mutex_exit(&db->db_mtx);
	} else if (db->db_state == DB_NOFILL) {
	ASSERT(zp.zp_checksum == ZIO_CHECKSUM_OFF \|\|
	zp.zp_checksum == ZIO_CHECKSUM_NOPARITY);
	dr->dr_zio = zio_write(pio, os->os_spa, txg,
	&dr->dr_bp_copy, NULL, db->db.db_size, db->db.db_size, &zp,
	dbuf_write_nofill_ready, NULL, NULL,
	dbuf_write_nofill_done, db,
	ZIO_PRIORITY_ASYNC_WRITE,
	ZIO_FLAG_MUSTSUCCEED \| ZIO_FLAG_NODATA, &zb);
	} else {
	ASSERT(arc_released(data));

	/*
	* For indirect blocks, we want to setup the children
	* ready callback so that we can properly handle an indirect
	* block that only contains holes.
	*/
	arc_write_done_func_t *children_ready_cb = NULL;
	if (db->db_level != 0)
	children_ready_cb = dbuf_write_children_ready;

	dr->dr_zio = arc_write(pio, os->os_spa, txg,
	&dr->dr_bp_copy, data, DBUF_IS_L2CACHEABLE(db),
	&zp, dbuf_write_ready,
	children_ready_cb, dbuf_write_physdone,
	dbuf_write_done, db, ZIO_PRIORITY_ASYNC_WRITE,
	ZIO_FLAG_MUSTSUCCEED, &zb);
	}
	}

	EXPORT_SYMBOL(dbuf_find);
	EXPORT_SYMBOL(dbuf_is_metadata);
	EXPORT_SYMBOL(dbuf_destroy);
	EXPORT_SYMBOL(dbuf_loan_arcbuf);
	EXPORT_SYMBOL(dbuf_whichblock);
	EXPORT_SYMBOL(dbuf_read);
	EXPORT_SYMBOL(dbuf_unoverride);
	EXPORT_SYMBOL(dbuf_free_range);
	EXPORT_SYMBOL(dbuf_new_size);
	EXPORT_SYMBOL(dbuf_release_bp);
	EXPORT_SYMBOL(dbuf_dirty);
	EXPORT_SYMBOL(dmu_buf_set_crypt_params);
	EXPORT_SYMBOL(dmu_buf_will_dirty);
	EXPORT_SYMBOL(dmu_buf_is_dirty);
	EXPORT_SYMBOL(dmu_buf_will_not_fill);
	EXPORT_SYMBOL(dmu_buf_will_fill);
	EXPORT_SYMBOL(dmu_buf_fill_done);
	EXPORT_SYMBOL(dmu_buf_rele);
	EXPORT_SYMBOL(dbuf_assign_arcbuf);
	EXPORT_SYMBOL(dbuf_prefetch);
	EXPORT_SYMBOL(dbuf_hold_impl);
	EXPORT_SYMBOL(dbuf_hold);
	EXPORT_SYMBOL(dbuf_hold_level);
	EXPORT_SYMBOL(dbuf_create_bonus);
	EXPORT_SYMBOL(dbuf_spill_set_blksz);
	EXPORT_SYMBOL(dbuf_rm_spill);
	EXPORT_SYMBOL(dbuf_add_ref);
	EXPORT_SYMBOL(dbuf_rele);
	EXPORT_SYMBOL(dbuf_rele_and_unlock);
	EXPORT_SYMBOL(dbuf_refcount);
	EXPORT_SYMBOL(dbuf_sync_list);
	EXPORT_SYMBOL(dmu_buf_set_user);
	EXPORT_SYMBOL(dmu_buf_set_user_ie);
	EXPORT_SYMBOL(dmu_buf_get_user);
	EXPORT_SYMBOL(dmu_buf_get_blkptr);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_dbuf_cache, dbuf_cache_, max_bytes, ULONG, ZMOD_RW,
	"Maximum size in bytes of the dbuf cache.");

	ZFS_MODULE_PARAM(zfs_dbuf_cache, dbuf_cache_, hiwater_pct, UINT, ZMOD_RW,
	"Percentage over dbuf_cache_max_bytes when dbufs must be evicted "
	"directly.");

	ZFS_MODULE_PARAM(zfs_dbuf_cache, dbuf_cache_, lowater_pct, UINT, ZMOD_RW,
	"Percentage below dbuf_cache_max_bytes when the evict thread stops "
	"evicting dbufs.");

	ZFS_MODULE_PARAM(zfs_dbuf, dbuf_, metadata_cache_max_bytes, ULONG, ZMOD_RW,
	"Maximum size in bytes of the dbuf metadata cache.");

	ZFS_MODULE_PARAM(zfs_dbuf, dbuf_, cache_shift, INT, ZMOD_RW,
	"Set the size of the dbuf cache to a log2 fraction of arc size.");

	ZFS_MODULE_PARAM(zfs_dbuf, dbuf_, metadata_cache_shift, INT, ZMOD_RW,
	"Set the size of the dbuf metadata cache to a log2 fraction of arc "
	"size.");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/dmu_redact.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/dmu_redact.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/dmu_redact.c (revision 365892)
	@@ -1,1186 +1,1199 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2017, 2018 by Delphix. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/txg.h>
	#include <sys/dmu_objset.h>
	#include <sys/dmu_traverse.h>
	#include <sys/dmu_redact.h>
	#include <sys/bqueue.h>
	#include <sys/objlist.h>
	#include <sys/dmu_tx.h>
	#ifdef _KERNEL
	#include <sys/zfs_vfsops.h>
	#include <sys/zap.h>
	#include <sys/zfs_znode.h>
	#endif

	/*
	* This controls the number of entries in the buffer the redaction_list_update
	* synctask uses to buffer writes to the redaction list.
	*/
	int redact_sync_bufsize = 1024;

	/*
	* Controls how often to update the redaction list when creating a redaction
	* list.
	*/
	uint64_t redaction_list_update_interval_ns = 1000 * 1000 * 1000ULL; /* NS */

	/*
	* This tunable controls the length of the queues that zfs redact worker threads
	* use to communicate. If the dmu_redact_snap thread is blocking on these
	* queues, this variable may need to be increased. If there is a significant
	* slowdown at the start of a redact operation as these threads consume all the
	* available IO resources, or the queues are consuming too much memory, this
	* variable may need to be decreased.
	*/
	int zfs_redact_queue_length = 1024 * 1024;

	/*
	* These tunables control the fill fraction of the queues by zfs redact. The
	* fill fraction controls the frequency with which threads have to be
	* cv_signaled. If a lot of cpu time is being spent on cv_signal, then these
	* should be tuned down. If the queues empty before the signalled thread can
	* catch up, then these should be tuned up.
	*/
	uint64_t zfs_redact_queue_ff = 20;

	struct redact_record {
	bqueue_node_t ln;
	boolean_t eos_marker; /* Marks the end of the stream */
	uint64_t start_object;
	uint64_t start_blkid;
	uint64_t end_object;
	uint64_t end_blkid;
	uint8_t indblkshift;
	uint32_t datablksz;
	};

	struct redact_thread_arg {
	bqueue_t q;
	objset_t os; / Objset to traverse */
	dsl_dataset_t ds; / Dataset to traverse */
	struct redact_record *current_record;
	int error_code;
	boolean_t cancel;
	zbookmark_phys_t resume;
	objlist_t *deleted_objs;
	uint64_t *num_blocks_visited;
	uint64_t ignore_object; /* ignore further callbacks on this */
	uint64_t txg; /* txg to traverse since */
	};

	/*
	* The redaction node is a wrapper around the redaction record that is used
	* by the redaction merging thread to sort the records and determine overlaps.
	*
	* It contains two nodes; one sorts the records by their start_zb, and the other
	* sorts the records by their end_zb.
	*/
	struct redact_node {
	avl_node_t avl_node_start;
	avl_node_t avl_node_end;
	struct redact_record *record;
	struct redact_thread_arg *rt_arg;
	uint32_t thread_num;
	};

	struct merge_data {
	list_t md_redact_block_pending;
	redact_block_phys_t md_coalesce_block;
	uint64_t md_last_time;
	redact_block_phys_t md_furthest[TXG_SIZE];
	/* Lists of struct redact_block_list_node. */
	list_t md_blocks[TXG_SIZE];
	boolean_t md_synctask_txg[TXG_SIZE];
	uint64_t md_latest_synctask_txg;
	redaction_list_t *md_redaction_list;
	};

	/*
	* A wrapper around struct redact_block so it can be stored in a list_t.
	*/
	struct redact_block_list_node {
	redact_block_phys_t block;
	list_node_t node;
	};

	/*
	* We've found a new redaction candidate. In order to improve performance, we
	* coalesce these blocks when they're adjacent to each other. This function
	* handles that. If the new candidate block range is immediately after the
	* range we're building, coalesce it into the range we're building. Otherwise,
	* put the record we're building on the queue, and update the build pointer to
	* point to the new record.
	*/
	static void
	record_merge_enqueue(bqueue_t q, struct redact_record *build,
	struct redact_record *new)
	{
	if (new->eos_marker) {
	if (*build != NULL)
	bqueue_enqueue(q, build, sizeof (build));
	bqueue_enqueue_flush(q, new, sizeof (*new));
	return;
	}
	if (*build == NULL) {
	*build = new;
	return;
	}
	struct redact_record curbuild = build;
	if ((curbuild->end_object == new->start_object &&
	curbuild->end_blkid + 1 == new->start_blkid &&
	curbuild->end_blkid != UINT64_MAX) \|\|
	(curbuild->end_object + 1 == new->start_object &&
	curbuild->end_blkid == UINT64_MAX && new->start_blkid == 0)) {
	curbuild->end_object = new->end_object;
	curbuild->end_blkid = new->end_blkid;
	kmem_free(new, sizeof (*new));
	} else {
	bqueue_enqueue(q, curbuild, sizeof (*curbuild));
	*build = new;
	}
	}
	#ifdef _KERNEL
	struct objnode {
	avl_node_t node;
	uint64_t obj;
	};

	static int
	objnode_compare(const void o1, const void o2)
	{
	const struct objnode *obj1 = o1;
	const struct objnode *obj2 = o2;
	if (obj1->obj < obj2->obj)
	return (-1);
	if (obj1->obj > obj2->obj)
	return (1);
	return (0);
	}


	static objlist_t *
	zfs_get_deleteq(objset_t *os)
	{
	objlist_t *deleteq_objlist = objlist_create();
	uint64_t deleteq_obj;
	zap_cursor_t zc;
	zap_attribute_t za;
	dmu_object_info_t doi;

	ASSERT3U(os->os_phys->os_type, ==, DMU_OST_ZFS);
	VERIFY0(dmu_object_info(os, MASTER_NODE_OBJ, &doi));
	ASSERT3U(doi.doi_type, ==, DMU_OT_MASTER_NODE);

	VERIFY0(zap_lookup(os, MASTER_NODE_OBJ,
	ZFS_UNLINKED_SET, sizeof (uint64_t), 1, &deleteq_obj));

	/*
	* In order to insert objects into the objlist, they must be in sorted
	* order. We don't know what order we'll get them out of the ZAP in, so
	* we insert them into and remove them from an avl_tree_t to sort them.
	*/
	avl_tree_t at;
	avl_create(&at, objnode_compare, sizeof (struct objnode),
	offsetof(struct objnode, node));

	for (zap_cursor_init(&zc, os, deleteq_obj);
	zap_cursor_retrieve(&zc, &za) == 0; zap_cursor_advance(&zc)) {
	struct objnode obj = kmem_zalloc(sizeof (obj), KM_SLEEP);
	obj->obj = za.za_first_integer;
	avl_add(&at, obj);
	}
	zap_cursor_fini(&zc);

	struct objnode next, found = avl_first(&at);
	while (found != NULL) {
	next = AVL_NEXT(&at, found);
	objlist_insert(deleteq_objlist, found->obj);
	found = next;
	}

	void *cookie = NULL;
	while ((found = avl_destroy_nodes(&at, &cookie)) != NULL)
	kmem_free(found, sizeof (*found));
	avl_destroy(&at);
	return (deleteq_objlist);
	}
	#endif

	/*
	* This is the callback function to traverse_dataset for the redaction threads
	* for dmu_redact_snap. This thread is responsible for creating redaction
	* records for all the data that is modified by the snapshots we're redacting
	* with respect to. Redaction records represent ranges of data that have been
	* modified by one of the redaction snapshots, and are stored in the
	* redact_record struct. We need to create redaction records for three
	* cases:
	*
	* First, if there's a normal write, we need to create a redaction record for
	* that block.
	*
	* Second, if there's a hole, we need to create a redaction record that covers
	* the whole range of the hole. If the hole is in the meta-dnode, it must cover
	* every block in all of the objects in the hole.
	*
	* Third, if there is a deleted object, we need to create a redaction record for
	* all of the blocks in that object.
	*/
	/ARGSUSED/
	static int
	redact_cb(spa_t spa, zilog_t zilog, const blkptr_t *bp,
	const zbookmark_phys_t zb, const struct dnode_phys dnp, void *arg)
	{
	struct redact_thread_arg *rta = arg;
	struct redact_record *record;

	ASSERT(zb->zb_object == DMU_META_DNODE_OBJECT \|\|
	zb->zb_object >= rta->resume.zb_object);

	if (rta->cancel)
	return (SET_ERROR(EINTR));

	if (rta->ignore_object == zb->zb_object)
	return (0);

	/*
	* If we're visiting a dnode, we need to handle the case where the
	* object has been deleted.
	*/
	if (zb->zb_level == ZB_DNODE_LEVEL) {
	ASSERT3U(zb->zb_level, ==, ZB_DNODE_LEVEL);

	if (zb->zb_object == 0)
	return (0);

	/*
	* If the object has been deleted, redact all of the blocks in
	* it.
	*/
	if (dnp->dn_type == DMU_OT_NONE \|\|
	objlist_exists(rta->deleted_objs, zb->zb_object)) {
	rta->ignore_object = zb->zb_object;
	record = kmem_zalloc(sizeof (struct redact_record),
	KM_SLEEP);

	record->eos_marker = B_FALSE;
	record->start_object = record->end_object =
	zb->zb_object;
	record->start_blkid = 0;
	record->end_blkid = UINT64_MAX;
	record_merge_enqueue(&rta->q,
	&rta->current_record, record);
	}
	return (0);
	} else if (zb->zb_level < 0) {
	return (0);
	} else if (zb->zb_level > 0 && !BP_IS_HOLE(bp)) {
	/*
	* If this is an indirect block, but not a hole, it doesn't
	* provide any useful information for redaction, so ignore it.
	*/
	return (0);
	}

	/*
	* At this point, there are two options left for the type of block we're
	* looking at. Either this is a hole (which could be in the dnode or
	* the meta-dnode), or it's a level 0 block of some sort. If it's a
	* hole, we create a redaction record that covers the whole range. If
	* the hole is in a dnode, we need to redact all the blocks in that
	* hole. If the hole is in the meta-dnode, we instead need to redact
	* all blocks in every object covered by that hole. If it's a level 0
	* block, we only need to redact that single block.
	*/
	record = kmem_zalloc(sizeof (struct redact_record), KM_SLEEP);
	record->eos_marker = B_FALSE;

	record->start_object = record->end_object = zb->zb_object;
	if (BP_IS_HOLE(bp)) {
	record->start_blkid = zb->zb_blkid *
	bp_span_in_blocks(dnp->dn_indblkshift, zb->zb_level);

	record->end_blkid = ((zb->zb_blkid + 1) *
	bp_span_in_blocks(dnp->dn_indblkshift, zb->zb_level)) - 1;

	if (zb->zb_object == DMU_META_DNODE_OBJECT) {
	record->start_object = record->start_blkid *
	((SPA_MINBLOCKSIZE * dnp->dn_datablkszsec) /
	sizeof (dnode_phys_t));
	record->start_blkid = 0;
	record->end_object = ((record->end_blkid +
	1) * ((SPA_MINBLOCKSIZE * dnp->dn_datablkszsec) /
	sizeof (dnode_phys_t))) - 1;
	record->end_blkid = UINT64_MAX;
	}
	} else if (zb->zb_level != 0 \|\|
	zb->zb_object == DMU_META_DNODE_OBJECT) {
	kmem_free(record, sizeof (*record));
	return (0);
	} else {
	record->start_blkid = record->end_blkid = zb->zb_blkid;
	}
	record->indblkshift = dnp->dn_indblkshift;
	record->datablksz = dnp->dn_datablkszsec << SPA_MINBLOCKSHIFT;
	record_merge_enqueue(&rta->q, &rta->current_record, record);

	return (0);
	}

	static void
	redact_traverse_thread(void *arg)
	{
	struct redact_thread_arg *rt_arg = arg;
	int err;
	struct redact_record *data;
	#ifdef _KERNEL
	if (rt_arg->os->os_phys->os_type == DMU_OST_ZFS)
	rt_arg->deleted_objs = zfs_get_deleteq(rt_arg->os);
	else
	rt_arg->deleted_objs = objlist_create();
	#else
	rt_arg->deleted_objs = objlist_create();
	#endif

	err = traverse_dataset_resume(rt_arg->ds, rt_arg->txg,
	&rt_arg->resume, TRAVERSE_PRE \| TRAVERSE_PREFETCH_METADATA,
	redact_cb, rt_arg);

	if (err != EINTR)
	rt_arg->error_code = err;
	objlist_destroy(rt_arg->deleted_objs);
	data = kmem_zalloc(sizeof (*data), KM_SLEEP);
	data->eos_marker = B_TRUE;
	record_merge_enqueue(&rt_arg->q, &rt_arg->current_record, data);
	thread_exit();
	}

	static inline void
	create_zbookmark_from_obj_off(zbookmark_phys_t *zb, uint64_t object,
	uint64_t blkid)
	{
	zb->zb_object = object;
	zb->zb_level = 0;
	zb->zb_blkid = blkid;
	}

	/*
	* This is a utility function that can do the comparison for the start or ends
	* of the ranges in a redact_record.
	*/
	static int
	redact_range_compare(uint64_t obj1, uint64_t off1, uint32_t dbss1,
	uint64_t obj2, uint64_t off2, uint32_t dbss2)
	{
	zbookmark_phys_t z1, z2;
	create_zbookmark_from_obj_off(&z1, obj1, off1);
	create_zbookmark_from_obj_off(&z2, obj2, off2);

	return (zbookmark_compare(dbss1 >> SPA_MINBLOCKSHIFT, 0,
	dbss2 >> SPA_MINBLOCKSHIFT, 0, &z1, &z2));
	}

	/*
	* Compare two redaction records by their range's start location. Also makes
	* eos records always compare last. We use the thread number in the redact_node
	* to ensure that records do not compare equal (which is not allowed in our avl
	* trees).
	*/
	static int
	redact_node_compare_start(const void arg1, const void arg2)
	{
	const struct redact_node *rn1 = arg1;
	const struct redact_node *rn2 = arg2;
	const struct redact_record *rr1 = rn1->record;
	const struct redact_record *rr2 = rn2->record;
	if (rr1->eos_marker)
	return (1);
	if (rr2->eos_marker)
	return (-1);

	int cmp = redact_range_compare(rr1->start_object, rr1->start_blkid,
	rr1->datablksz, rr2->start_object, rr2->start_blkid,
	rr2->datablksz);
	if (cmp == 0)
	cmp = (rn1->thread_num < rn2->thread_num ? -1 : 1);
	return (cmp);
	}

	/*
	* Compare two redaction records by their range's end location. Also makes
	* eos records always compare last. We use the thread number in the redact_node
	* to ensure that records do not compare equal (which is not allowed in our avl
	* trees).
	*/
	static int
	redact_node_compare_end(const void arg1, const void arg2)
	{
	const struct redact_node *rn1 = arg1;
	const struct redact_node *rn2 = arg2;
	const struct redact_record *srr1 = rn1->record;
	const struct redact_record *srr2 = rn2->record;
	if (srr1->eos_marker)
	return (1);
	if (srr2->eos_marker)
	return (-1);

	int cmp = redact_range_compare(srr1->end_object, srr1->end_blkid,
	srr1->datablksz, srr2->end_object, srr2->end_blkid,
	srr2->datablksz);
	if (cmp == 0)
	cmp = (rn1->thread_num < rn2->thread_num ? -1 : 1);
	return (cmp);
	}

	/*
	* Utility function that compares two redaction records to determine if any part
	* of the "from" record is before any part of the "to" record. Also causes End
	* of Stream redaction records to compare after all others, so that the
	* redaction merging logic can stay simple.
	*/
	static boolean_t
	redact_record_before(const struct redact_record *from,
	const struct redact_record *to)
	{
	if (from->eos_marker == B_TRUE)
	return (B_FALSE);
	else if (to->eos_marker == B_TRUE)
	return (B_TRUE);
	return (redact_range_compare(from->start_object, from->start_blkid,
	from->datablksz, to->end_object, to->end_blkid,
	to->datablksz) <= 0);
	}

	/*
	* Pop a new redaction record off the queue, check that the records are in the
	* right order, and free the old data.
	*/
	static struct redact_record *
	get_next_redact_record(bqueue_t bq, struct redact_record prev)
	{
	struct redact_record *next = bqueue_dequeue(bq);
	ASSERT(redact_record_before(prev, next));
	kmem_free(prev, sizeof (*prev));
	return (next);
	}

	/*
	* Remove the given redaction node from both trees, pull a new redaction record
	* off the queue, free the old redaction record, update the redaction node, and
	* reinsert the node into the trees.
	*/
	static int
	update_avl_trees(avl_tree_t start_tree, avl_tree_t end_tree,
	struct redact_node *redact_node)
	{
	avl_remove(start_tree, redact_node);
	avl_remove(end_tree, redact_node);
	redact_node->record = get_next_redact_record(&redact_node->rt_arg->q,
	redact_node->record);
	avl_add(end_tree, redact_node);
	avl_add(start_tree, redact_node);
	return (redact_node->rt_arg->error_code);
	}

	/*
	* Synctask for updating redaction lists. We first take this txg's list of
	* redacted blocks and append those to the redaction list. We then update the
	* redaction list's bonus buffer. We store the furthest blocks we visited and
	* the list of snapshots that we're redacting with respect to. We need these so
	* that redacted sends and receives can be correctly resumed.
	*/
	static void
	redaction_list_update_sync(void arg, dmu_tx_t tx)
	{
	struct merge_data *md = arg;
	uint64_t txg = dmu_tx_get_txg(tx);
	list_t *list = &md->md_blocks[txg & TXG_MASK];
	redact_block_phys_t *furthest_visited =
	&md->md_furthest[txg & TXG_MASK];
	objset_t *mos = tx->tx_pool->dp_meta_objset;
	redaction_list_t *rl = md->md_redaction_list;
	int bufsize = redact_sync_bufsize;
	redact_block_phys_t buf = kmem_alloc(bufsize sizeof (*buf),
	KM_SLEEP);
	int index = 0;

	dmu_buf_will_dirty(rl->rl_dbuf, tx);

	for (struct redact_block_list_node *rbln = list_remove_head(list);
	rbln != NULL; rbln = list_remove_head(list)) {
	ASSERT3U(rbln->block.rbp_object, <=,
	furthest_visited->rbp_object);
	ASSERT(rbln->block.rbp_object < furthest_visited->rbp_object \|\|
	rbln->block.rbp_blkid <= furthest_visited->rbp_blkid);
	buf[index] = rbln->block;
	index++;
	if (index == bufsize) {
	dmu_write(mos, rl->rl_object,
	rl->rl_phys->rlp_num_entries * sizeof (*buf),
	bufsize * sizeof (*buf), buf, tx);
	rl->rl_phys->rlp_num_entries += bufsize;
	index = 0;
	}
	kmem_free(rbln, sizeof (*rbln));
	}
	if (index > 0) {
	dmu_write(mos, rl->rl_object, rl->rl_phys->rlp_num_entries *
	sizeof (buf), index sizeof (*buf), buf, tx);
	rl->rl_phys->rlp_num_entries += index;
	}
	kmem_free(buf, bufsize * sizeof (*buf));

	md->md_synctask_txg[txg & TXG_MASK] = B_FALSE;
	rl->rl_phys->rlp_last_object = furthest_visited->rbp_object;
	rl->rl_phys->rlp_last_blkid = furthest_visited->rbp_blkid;
	}

	static void
	commit_rl_updates(objset_t os, struct merge_data md, uint64_t object,
	uint64_t blkid)
	{
	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(os->os_spa)->dp_mos_dir);
	dmu_tx_hold_space(tx, sizeof (struct redact_block_list_node));
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));
	uint64_t txg = dmu_tx_get_txg(tx);
	if (!md->md_synctask_txg[txg & TXG_MASK]) {
	dsl_sync_task_nowait(dmu_tx_pool(tx),
	- redaction_list_update_sync, md, 5, ZFS_SPACE_CHECK_NONE,
	- tx);
	+ redaction_list_update_sync, md, tx);
	md->md_synctask_txg[txg & TXG_MASK] = B_TRUE;
	md->md_latest_synctask_txg = txg;
	}
	md->md_furthest[txg & TXG_MASK].rbp_object = object;
	md->md_furthest[txg & TXG_MASK].rbp_blkid = blkid;
	list_move_tail(&md->md_blocks[txg & TXG_MASK],
	&md->md_redact_block_pending);
	dmu_tx_commit(tx);
	md->md_last_time = gethrtime();
	}

	/*
	* We want to store the list of blocks that we're redacting in the bookmark's
	* redaction list. However, this list is stored in the MOS, which means it can
	* only be written to in syncing context. To get around this, we create a
	* synctask that will write to the mos for us. We tell it what to write by
	* a linked list for each current transaction group; every time we decide to
	* redact a block, we append it to the transaction group that is currently in
	* open context. We also update some progress information that the synctask
	* will store to enable resumable redacted sends.
	*/
	static void
	update_redaction_list(struct merge_data md, objset_t os,
	uint64_t object, uint64_t blkid, uint64_t endblkid, uint32_t blksz)
	{
	boolean_t enqueue = B_FALSE;
	redact_block_phys_t cur = {0};
	uint64_t count = endblkid - blkid + 1;
	while (count > REDACT_BLOCK_MAX_COUNT) {
	update_redaction_list(md, os, object, blkid,
	blkid + REDACT_BLOCK_MAX_COUNT - 1, blksz);
	blkid += REDACT_BLOCK_MAX_COUNT;
	count -= REDACT_BLOCK_MAX_COUNT;
	}
	redact_block_phys_t *coalesce = &md->md_coalesce_block;
	boolean_t new;
	if (coalesce->rbp_size_count == 0) {
	new = B_TRUE;
	enqueue = B_FALSE;
	} else {
	uint64_t old_count = redact_block_get_count(coalesce);
	if (coalesce->rbp_object == object &&
	coalesce->rbp_blkid + old_count == blkid &&
	old_count + count <= REDACT_BLOCK_MAX_COUNT) {
	ASSERT3U(redact_block_get_size(coalesce), ==, blksz);
	redact_block_set_count(coalesce, old_count + count);
	new = B_FALSE;
	enqueue = B_FALSE;
	} else {
	new = B_TRUE;
	enqueue = B_TRUE;
	}
	}

	if (new) {
	cur = *coalesce;
	coalesce->rbp_blkid = blkid;
	coalesce->rbp_object = object;

	redact_block_set_count(coalesce, count);
	redact_block_set_size(coalesce, blksz);
	}

	if (enqueue && redact_block_get_size(&cur) != 0) {
	struct redact_block_list_node *rbln =
	kmem_alloc(sizeof (struct redact_block_list_node),
	KM_SLEEP);
	rbln->block = cur;
	list_insert_tail(&md->md_redact_block_pending, rbln);
	}

	if (gethrtime() > md->md_last_time +
	redaction_list_update_interval_ns) {
	commit_rl_updates(os, md, object, blkid);
	}
	}

	/*
	* This thread merges all the redaction records provided by the worker threads,
	* and determines which blocks are redacted by all the snapshots. The algorithm
	* for doing so is similar to performing a merge in mergesort with n sub-lists
	* instead of 2, with some added complexity due to the fact that the entries are
	* ranges, not just single blocks. This algorithm relies on the fact that the
	* queues are sorted, which is ensured by the fact that traverse_dataset
	* traverses the dataset in a consistent order. We pull one entry off the front
	* of the queues of each secure dataset traversal thread. Then we repeat the
	* following: each record represents a range of blocks modified by one of the
	* redaction snapshots, and each block in that range may need to be redacted in
	* the send stream. Find the record with the latest start of its range, and the
	* record with the earliest end of its range. If the last start is before the
	* first end, then we know that the blocks in the range [last_start, first_end]
	* are covered by all of the ranges at the front of the queues, which means
	* every thread redacts that whole range. For example, let's say the ranges on
	* each queue look like this:
	*
	* Block Id 1 2 3 4 5 6 7 8 9 10 11
	* Thread 1 \| [====================]
	* Thread 2 \| [========]
	* Thread 3 \| [=================]
	*
	* Thread 3 has the last start (5), and the thread 2 has the last end (6). All
	* three threads modified the range [5,6], so that data should not be sent over
	* the wire. After we've determined whether or not to redact anything, we take
	* the record with the first end. We discard that record, and pull a new one
	* off the front of the queue it came from. In the above example, we would
	* discard Thread 2's record, and pull a new one. Let's say the next record we
	* pulled from Thread 2 covered range [10,11]. The new layout would look like
	* this:
	*
	* Block Id 1 2 3 4 5 6 7 8 9 10 11
	* Thread 1 \| [====================]
	* Thread 2 \| [==]
	* Thread 3 \| [=================]
	*
	* When we compare the last start (10, from Thread 2) and the first end (9, from
	* Thread 1), we see that the last start is greater than the first end.
	* Therefore, we do not redact anything from these records. We'll iterate by
	* replacing the record from Thread 1.
	*
	* We iterate by replacing the record with the lowest end because we know
	* that the record with the lowest end has helped us as much as it can. All the
	* ranges before it that we will ever redact have been redacted. In addition,
	* by replacing the one with the lowest end, we guarantee we catch all ranges
	* that need to be redacted. For example, if in the case above we had replaced
	* the record from Thread 1 instead, we might have ended up with the following:
	*
	* Block Id 1 2 3 4 5 6 7 8 9 10 11 12
	* Thread 1 \| [==]
	* Thread 2 \| [========]
	* Thread 3 \| [=================]
	*
	* If the next record from Thread 2 had been [8,10], for example, we should have
	* redacted part of that range, but because we updated Thread 1's record, we
	* missed it.
	*
	* We implement this algorithm by using two trees. The first sorts the
	* redaction records by their start_zb, and the second sorts them by their
	* end_zb. We use these to find the record with the last start and the record
	* with the first end. We create a record with that start and end, and send it
	* on. The overall runtime of this implementation is O(n log m), where n is the
	* total number of redaction records from all the different redaction snapshots,
	* and m is the number of redaction snapshots.
	*
	* If we redact with respect to zero snapshots, we create a redaction
	* record with the start object and blkid to 0, and the end object and blkid to
	* UINT64_MAX. This will result in us redacting every block.
	*/
	static int
	perform_thread_merge(bqueue_t *q, uint32_t num_threads,
	struct redact_thread_arg thread_args, boolean_t cancel)
	{
	struct redact_node *redact_nodes = NULL;
	avl_tree_t start_tree, end_tree;
	struct redact_record *record;
	struct redact_record *current_record = NULL;
	int err = 0;
	struct merge_data md = { {0} };
	list_create(&md.md_redact_block_pending,
	sizeof (struct redact_block_list_node),
	offsetof(struct redact_block_list_node, node));

	/*
	* If we're redacting with respect to zero snapshots, then no data is
	* permitted to be sent. We enqueue a record that redacts all blocks,
	* and an eos marker.
	*/
	if (num_threads == 0) {
	record = kmem_zalloc(sizeof (struct redact_record),
	KM_SLEEP);
	// We can't redact object 0, so don't try.
	record->start_object = 1;
	record->start_blkid = 0;
	record->end_object = record->end_blkid = UINT64_MAX;
	bqueue_enqueue(q, record, sizeof (*record));
	return (0);
	}
	if (num_threads > 0) {
	redact_nodes = kmem_zalloc(num_threads *
	sizeof (*redact_nodes), KM_SLEEP);
	}

	avl_create(&start_tree, redact_node_compare_start,
	sizeof (struct redact_node),
	offsetof(struct redact_node, avl_node_start));
	avl_create(&end_tree, redact_node_compare_end,
	sizeof (struct redact_node),
	offsetof(struct redact_node, avl_node_end));

	for (int i = 0; i < num_threads; i++) {
	struct redact_node *node = &redact_nodes[i];
	struct redact_thread_arg *targ = &thread_args[i];
	node->record = bqueue_dequeue(&targ->q);
	node->rt_arg = targ;
	node->thread_num = i;
	avl_add(&start_tree, node);
	avl_add(&end_tree, node);
	}

	/*
	* Once the first record in the end tree has returned EOS, every record
	* must be an EOS record, so we should stop.
	*/
	while (err == 0 && !((struct redact_node *)avl_first(&end_tree))->
	record->eos_marker) {
	if (*cancel) {
	err = EINTR;
	break;
	}
	struct redact_node *last_start = avl_last(&start_tree);
	struct redact_node *first_end = avl_first(&end_tree);

	/*
	* If the last start record is before the first end record,
	* then we have blocks that are redacted by all threads.
	* Therefore, we should redact them. Copy the record, and send
	* it to the main thread.
	*/
	if (redact_record_before(last_start->record,
	first_end->record)) {
	record = kmem_zalloc(sizeof (struct redact_record),
	KM_SLEEP);
	record = first_end->record;
	record->start_object = last_start->record->start_object;
	record->start_blkid = last_start->record->start_blkid;
	record_merge_enqueue(q, &current_record,
	record);
	}
	err = update_avl_trees(&start_tree, &end_tree, first_end);
	}

	/*
	* We're done; if we were cancelled, we need to cancel our workers and
	* clear out their queues. Either way, we need to remove every thread's
	* redact_node struct from the avl trees.
	*/
	for (int i = 0; i < num_threads; i++) {
	if (err != 0) {
	thread_args[i].cancel = B_TRUE;
	while (!redact_nodes[i].record->eos_marker) {
	(void) update_avl_trees(&start_tree, &end_tree,
	&redact_nodes[i]);
	}
	}
	avl_remove(&start_tree, &redact_nodes[i]);
	avl_remove(&end_tree, &redact_nodes[i]);
	kmem_free(redact_nodes[i].record,
	sizeof (struct redact_record));
	}

	avl_destroy(&start_tree);
	avl_destroy(&end_tree);
	kmem_free(redact_nodes, num_threads * sizeof (*redact_nodes));
	if (current_record != NULL)
	bqueue_enqueue(q, current_record, sizeof (current_record));
	return (err);
	}

	struct redact_merge_thread_arg {
	bqueue_t q;
	spa_t *spa;
	int numsnaps;
	struct redact_thread_arg *thr_args;
	boolean_t cancel;
	int error_code;
	};

	static void
	redact_merge_thread(void *arg)
	{
	struct redact_merge_thread_arg *rmta = arg;
	rmta->error_code = perform_thread_merge(&rmta->q,
	rmta->numsnaps, rmta->thr_args, &rmta->cancel);
	struct redact_record rec = kmem_zalloc(sizeof (rec), KM_SLEEP);
	rec->eos_marker = B_TRUE;
	bqueue_enqueue_flush(&rmta->q, rec, 1);
	thread_exit();
	}

	/*
	* Find the next object in or after the redaction range passed in, and hold
	* its dnode with the provided tag. Also update *object to contain the new
	* object number.
	*/
	static int
	hold_next_object(objset_t os, struct redact_record rec, void *tag,
	uint64_t object, dnode_t *dn)
	{
	int err = 0;
	if (*dn != NULL)
	dnode_rele(*dn, FTAG);
	*dn = NULL;
	if (*object < rec->start_object) {
	*object = rec->start_object - 1;
	}
	err = dmu_object_next(os, object, B_FALSE, 0);
	if (err != 0)
	return (err);

	err = dnode_hold(os, *object, tag, dn);
	while (err == 0 && (*object < rec->start_object \|\|
	DMU_OT_IS_METADATA((*dn)->dn_type))) {
	dnode_rele(*dn, tag);
	*dn = NULL;
	err = dmu_object_next(os, object, B_FALSE, 0);
	if (err != 0)
	break;
	err = dnode_hold(os, *object, tag, dn);
	}
	return (err);
	}

	static int
	perform_redaction(objset_t os, redaction_list_t rl,
	struct redact_merge_thread_arg *rmta)
	{
	int err = 0;
	bqueue_t *q = &rmta->q;
	struct redact_record *rec = NULL;
	struct merge_data md = { {0} };

	list_create(&md.md_redact_block_pending,
	sizeof (struct redact_block_list_node),
	offsetof(struct redact_block_list_node, node));
	md.md_redaction_list = rl;

	for (int i = 0; i < TXG_SIZE; i++) {
	list_create(&md.md_blocks[i],
	sizeof (struct redact_block_list_node),
	offsetof(struct redact_block_list_node, node));
	}
	dnode_t *dn = NULL;
	uint64_t prev_obj = 0;
	for (rec = bqueue_dequeue(q); !rec->eos_marker && err == 0;
	rec = get_next_redact_record(q, rec)) {
	ASSERT3U(rec->start_object, !=, 0);
	uint64_t object;
	if (prev_obj != rec->start_object) {
	object = rec->start_object - 1;
	err = hold_next_object(os, rec, FTAG, &object, &dn);
	} else {
	object = prev_obj;
	}
	while (err == 0 && object <= rec->end_object) {
	if (issig(JUSTLOOKING) && issig(FORREAL)) {
	err = EINTR;
	break;
	}
	/*
	* Part of the current object is contained somewhere in
	* the range covered by rec.
	*/
	uint64_t startblkid;
	uint64_t endblkid;
	uint64_t maxblkid = dn->dn_phys->dn_maxblkid;

	if (rec->start_object < object)
	startblkid = 0;
	else if (rec->start_blkid > maxblkid)
	break;
	else
	startblkid = rec->start_blkid;

	if (rec->end_object > object \|\| rec->end_blkid >
	maxblkid) {
	endblkid = maxblkid;
	} else {
	endblkid = rec->end_blkid;
	}
	update_redaction_list(&md, os, object, startblkid,
	endblkid, dn->dn_datablksz);

	if (object == rec->end_object)
	break;
	err = hold_next_object(os, rec, FTAG, &object, &dn);
	}
	if (err == ESRCH)
	err = 0;
	if (dn != NULL)
	prev_obj = object;
	}
	if (err == 0 && dn != NULL)
	dnode_rele(dn, FTAG);

	if (err == ESRCH)
	err = 0;
	rmta->cancel = B_TRUE;
	while (!rec->eos_marker)
	rec = get_next_redact_record(q, rec);
	kmem_free(rec, sizeof (*rec));

	/*
	* There may be a block that's being coalesced, sync that out before we
	* return.
	*/
	if (err == 0 && md.md_coalesce_block.rbp_size_count != 0) {
	struct redact_block_list_node *rbln =
	kmem_alloc(sizeof (struct redact_block_list_node),
	KM_SLEEP);
	rbln->block = md.md_coalesce_block;
	list_insert_tail(&md.md_redact_block_pending, rbln);
	}
	commit_rl_updates(os, &md, UINT64_MAX, UINT64_MAX);

	/*
	* Wait for all the redaction info to sync out before we return, so that
	* anyone who attempts to resume this redaction will have all the data
	* they need.
	*/
	dsl_pool_t *dp = spa_get_dsl(os->os_spa);
	if (md.md_latest_synctask_txg != 0)
	txg_wait_synced(dp, md.md_latest_synctask_txg);
	for (int i = 0; i < TXG_SIZE; i++)
	list_destroy(&md.md_blocks[i]);
	return (err);
	}

	static boolean_t
	redact_snaps_contains(uint64_t *snaps, uint64_t num_snaps, uint64_t guid)
	{
	for (int i = 0; i < num_snaps; i++) {
	if (snaps[i] == guid)
	return (B_TRUE);
	}
	return (B_FALSE);
	}

	int
	dmu_redact_snap(const char snapname, nvlist_t redactnvl,
	const char *redactbook)
	{
	int err = 0;
	dsl_pool_t *dp = NULL;
	dsl_dataset_t *ds = NULL;
	int numsnaps = 0;
	objset_t *os;
	struct redact_thread_arg *args = NULL;
	redaction_list_t *new_rl = NULL;
	+ char *newredactbook;

	if ((err = dsl_pool_hold(snapname, FTAG, &dp)) != 0)
	return (err);

	+ newredactbook = kmem_zalloc(sizeof (char) * ZFS_MAX_DATASET_NAME_LEN,
	+ KM_SLEEP);
	+
	if ((err = dsl_dataset_hold_flags(dp, snapname, DS_HOLD_FLAG_DECRYPT,
	FTAG, &ds)) != 0) {
	goto out;
	}
	dsl_dataset_long_hold(ds, FTAG);
	if (!ds->ds_is_snapshot \|\| dmu_objset_from_ds(ds, &os) != 0) {
	err = EINVAL;
	goto out;
	}
	if (dsl_dataset_feature_is_active(ds, SPA_FEATURE_REDACTED_DATASETS)) {
	err = EALREADY;
	goto out;
	}

	numsnaps = fnvlist_num_pairs(redactnvl);
	if (numsnaps > 0)
	args = kmem_zalloc(numsnaps * sizeof (*args), KM_SLEEP);

	nvpair_t *pair = NULL;
	for (int i = 0; i < numsnaps; i++) {
	pair = nvlist_next_nvpair(redactnvl, pair);
	const char *name = nvpair_name(pair);
	struct redact_thread_arg *rta = &args[i];
	err = dsl_dataset_hold_flags(dp, name, DS_HOLD_FLAG_DECRYPT,
	FTAG, &rta->ds);
	if (err != 0)
	break;
	/*
	* We want to do the long hold before we can get any other
	* errors, because the cleanup code will release the long
	* hold if rta->ds is filled in.
	*/
	dsl_dataset_long_hold(rta->ds, FTAG);

	err = dmu_objset_from_ds(rta->ds, &rta->os);
	if (err != 0)
	break;
	if (!dsl_dataset_is_before(rta->ds, ds, 0)) {
	err = EINVAL;
	break;
	}
	if (dsl_dataset_feature_is_active(rta->ds,
	SPA_FEATURE_REDACTED_DATASETS)) {
	err = EALREADY;
	break;

	}
	}
	VERIFY3P(nvlist_next_nvpair(redactnvl, pair), ==, NULL);
	if (err != 0)
	goto out;

	boolean_t resuming = B_FALSE;
	- char newredactbook[ZFS_MAX_DATASET_NAME_LEN];
	zfs_bookmark_phys_t bookmark;

	(void) strlcpy(newredactbook, snapname, ZFS_MAX_DATASET_NAME_LEN);
	char *c = strchr(newredactbook, '@');
	ASSERT3P(c, !=, NULL);
	int n = snprintf(c, ZFS_MAX_DATASET_NAME_LEN - (c - newredactbook),
	"#%s", redactbook);
	if (n >= ZFS_MAX_DATASET_NAME_LEN - (c - newredactbook)) {
	dsl_pool_rele(dp, FTAG);
	+ kmem_free(newredactbook,
	+ sizeof (char) * ZFS_MAX_DATASET_NAME_LEN);
	+ if (args != NULL)
	+ kmem_free(args, numsnaps * sizeof (*args));
	return (SET_ERROR(ENAMETOOLONG));
	}
	err = dsl_bookmark_lookup(dp, newredactbook, NULL, &bookmark);
	if (err == 0) {
	resuming = B_TRUE;
	if (bookmark.zbm_redaction_obj == 0) {
	err = EEXIST;
	goto out;
	}
	err = dsl_redaction_list_hold_obj(dp,
	bookmark.zbm_redaction_obj, FTAG, &new_rl);
	if (err != 0) {
	err = EIO;
	goto out;
	}
	dsl_redaction_list_long_hold(dp, new_rl, FTAG);
	if (new_rl->rl_phys->rlp_num_snaps != numsnaps) {
	err = ESRCH;
	goto out;
	}
	for (int i = 0; i < numsnaps; i++) {
	struct redact_thread_arg *rta = &args[i];
	if (!redact_snaps_contains(new_rl->rl_phys->rlp_snaps,
	new_rl->rl_phys->rlp_num_snaps,
	dsl_dataset_phys(rta->ds)->ds_guid)) {
	err = ESRCH;
	goto out;
	}
	}
	if (new_rl->rl_phys->rlp_last_blkid == UINT64_MAX &&
	new_rl->rl_phys->rlp_last_object == UINT64_MAX) {
	err = EEXIST;
	goto out;
	}
	dsl_pool_rele(dp, FTAG);
	dp = NULL;
	} else {
	uint64_t *guids = NULL;
	if (numsnaps > 0) {
	guids = kmem_zalloc(numsnaps * sizeof (uint64_t),
	KM_SLEEP);
	}
	for (int i = 0; i < numsnaps; i++) {
	struct redact_thread_arg *rta = &args[i];
	guids[i] = dsl_dataset_phys(rta->ds)->ds_guid;
	}

	dsl_pool_rele(dp, FTAG);
	dp = NULL;
	err = dsl_bookmark_create_redacted(newredactbook, snapname,
	numsnaps, guids, FTAG, &new_rl);
	kmem_free(guids, numsnaps * sizeof (uint64_t));
	if (err != 0) {
	goto out;
	}
	}

	for (int i = 0; i < numsnaps; i++) {
	struct redact_thread_arg *rta = &args[i];
	(void) bqueue_init(&rta->q, zfs_redact_queue_ff,
	zfs_redact_queue_length,
	offsetof(struct redact_record, ln));
	if (resuming) {
	rta->resume.zb_blkid =
	new_rl->rl_phys->rlp_last_blkid;
	rta->resume.zb_object =
	new_rl->rl_phys->rlp_last_object;
	}
	rta->txg = dsl_dataset_phys(ds)->ds_creation_txg;
	(void) thread_create(NULL, 0, redact_traverse_thread, rta,
	0, curproc, TS_RUN, minclsyspri);
	}
	- struct redact_merge_thread_arg rmta = { { {0} } };
	- (void) bqueue_init(&rmta.q, zfs_redact_queue_ff,
	+
	+ struct redact_merge_thread_arg *rmta;
	+ rmta = kmem_zalloc(sizeof (struct redact_merge_thread_arg), KM_SLEEP);
	+
	+ (void) bqueue_init(&rmta->q, zfs_redact_queue_ff,
	zfs_redact_queue_length, offsetof(struct redact_record, ln));
	- rmta.numsnaps = numsnaps;
	- rmta.spa = os->os_spa;
	- rmta.thr_args = args;
	- (void) thread_create(NULL, 0, redact_merge_thread, &rmta, 0, curproc,
	+ rmta->numsnaps = numsnaps;
	+ rmta->spa = os->os_spa;
	+ rmta->thr_args = args;
	+ (void) thread_create(NULL, 0, redact_merge_thread, rmta, 0, curproc,
	TS_RUN, minclsyspri);
	- err = perform_redaction(os, new_rl, &rmta);
	+ err = perform_redaction(os, new_rl, rmta);
	+ kmem_free(rmta, sizeof (struct redact_merge_thread_arg));
	+
	out:
	+ kmem_free(newredactbook, sizeof (char) * ZFS_MAX_DATASET_NAME_LEN);
	+
	if (new_rl != NULL) {
	dsl_redaction_list_long_rele(new_rl, FTAG);
	dsl_redaction_list_rele(new_rl, FTAG);
	}
	for (int i = 0; i < numsnaps; i++) {
	struct redact_thread_arg *rta = &args[i];
	/*
	* rta->ds may be NULL if we got an error while filling
	* it in.
	*/
	if (rta->ds != NULL) {
	dsl_dataset_long_rele(rta->ds, FTAG);
	dsl_dataset_rele_flags(rta->ds,
	DS_HOLD_FLAG_DECRYPT, FTAG);
	}
	}

	if (args != NULL)
	kmem_free(args, numsnaps * sizeof (*args));
	if (dp != NULL)
	dsl_pool_rele(dp, FTAG);
	if (ds != NULL) {
	dsl_dataset_long_rele(ds, FTAG);
	dsl_dataset_rele_flags(ds, DS_HOLD_FLAG_DECRYPT, FTAG);
	}
	return (SET_ERROR(err));

	}
	Index: vendor-sys/openzfs/dist/module/zfs/dnode.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/dnode.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/dnode.c (revision 365892)
	@@ -1,2575 +1,2578 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2012, 2019 by Delphix. All rights reserved.
	* Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/dbuf.h>
	#include <sys/dnode.h>
	#include <sys/dmu.h>
	#include <sys/dmu_impl.h>
	#include <sys/dmu_tx.h>
	#include <sys/dmu_objset.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_dataset.h>
	#include <sys/spa.h>
	#include <sys/zio.h>
	#include <sys/dmu_zfetch.h>
	#include <sys/range_tree.h>
	#include <sys/trace_zfs.h>
	#include <sys/zfs_project.h>

	dnode_stats_t dnode_stats = {
	{ "dnode_hold_dbuf_hold", KSTAT_DATA_UINT64 },
	{ "dnode_hold_dbuf_read", KSTAT_DATA_UINT64 },
	{ "dnode_hold_alloc_hits", KSTAT_DATA_UINT64 },
	{ "dnode_hold_alloc_misses", KSTAT_DATA_UINT64 },
	{ "dnode_hold_alloc_interior", KSTAT_DATA_UINT64 },
	{ "dnode_hold_alloc_lock_retry", KSTAT_DATA_UINT64 },
	{ "dnode_hold_alloc_lock_misses", KSTAT_DATA_UINT64 },
	{ "dnode_hold_alloc_type_none", KSTAT_DATA_UINT64 },
	{ "dnode_hold_free_hits", KSTAT_DATA_UINT64 },
	{ "dnode_hold_free_misses", KSTAT_DATA_UINT64 },
	{ "dnode_hold_free_lock_misses", KSTAT_DATA_UINT64 },
	{ "dnode_hold_free_lock_retry", KSTAT_DATA_UINT64 },
	{ "dnode_hold_free_overflow", KSTAT_DATA_UINT64 },
	{ "dnode_hold_free_refcount", KSTAT_DATA_UINT64 },
	{ "dnode_free_interior_lock_retry", KSTAT_DATA_UINT64 },
	{ "dnode_allocate", KSTAT_DATA_UINT64 },
	{ "dnode_reallocate", KSTAT_DATA_UINT64 },
	{ "dnode_buf_evict", KSTAT_DATA_UINT64 },
	{ "dnode_alloc_next_chunk", KSTAT_DATA_UINT64 },
	{ "dnode_alloc_race", KSTAT_DATA_UINT64 },
	{ "dnode_alloc_next_block", KSTAT_DATA_UINT64 },
	{ "dnode_move_invalid", KSTAT_DATA_UINT64 },
	{ "dnode_move_recheck1", KSTAT_DATA_UINT64 },
	{ "dnode_move_recheck2", KSTAT_DATA_UINT64 },
	{ "dnode_move_special", KSTAT_DATA_UINT64 },
	{ "dnode_move_handle", KSTAT_DATA_UINT64 },
	{ "dnode_move_rwlock", KSTAT_DATA_UINT64 },
	{ "dnode_move_active", KSTAT_DATA_UINT64 },
	};

	static kstat_t *dnode_ksp;
	static kmem_cache_t *dnode_cache;

	static dnode_phys_t dnode_phys_zero __maybe_unused;

	int zfs_default_bs = SPA_MINBLOCKSHIFT;
	int zfs_default_ibs = DN_MAX_INDBLKSHIFT;

	#ifdef _KERNEL
	static kmem_cbrc_t dnode_move(void , void , size_t, void *);
	#endif /* _KERNEL */

	static int
	dbuf_compare(const void x1, const void x2)
	{
	const dmu_buf_impl_t *d1 = x1;
	const dmu_buf_impl_t *d2 = x2;

	int cmp = TREE_CMP(d1->db_level, d2->db_level);
	if (likely(cmp))
	return (cmp);

	cmp = TREE_CMP(d1->db_blkid, d2->db_blkid);
	if (likely(cmp))
	return (cmp);

	if (d1->db_state == DB_SEARCH) {
	ASSERT3S(d2->db_state, !=, DB_SEARCH);
	return (-1);
	} else if (d2->db_state == DB_SEARCH) {
	ASSERT3S(d1->db_state, !=, DB_SEARCH);
	return (1);
	}

	return (TREE_PCMP(d1, d2));
	}

	/* ARGSUSED */
	static int
	dnode_cons(void arg, void unused, int kmflag)
	{
	dnode_t *dn = arg;
	int i;

	rw_init(&dn->dn_struct_rwlock, NULL, RW_NOLOCKDEP, NULL);
	mutex_init(&dn->dn_mtx, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&dn->dn_dbufs_mtx, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&dn->dn_notxholds, NULL, CV_DEFAULT, NULL);
	cv_init(&dn->dn_nodnholds, NULL, CV_DEFAULT, NULL);

	/*
	* Every dbuf has a reference, and dropping a tracked reference is
	* O(number of references), so don't track dn_holds.
	*/
	zfs_refcount_create_untracked(&dn->dn_holds);
	zfs_refcount_create(&dn->dn_tx_holds);
	list_link_init(&dn->dn_link);

	bzero(&dn->dn_next_nblkptr[0], sizeof (dn->dn_next_nblkptr));
	bzero(&dn->dn_next_nlevels[0], sizeof (dn->dn_next_nlevels));
	bzero(&dn->dn_next_indblkshift[0], sizeof (dn->dn_next_indblkshift));
	bzero(&dn->dn_next_bonustype[0], sizeof (dn->dn_next_bonustype));
	bzero(&dn->dn_rm_spillblk[0], sizeof (dn->dn_rm_spillblk));
	bzero(&dn->dn_next_bonuslen[0], sizeof (dn->dn_next_bonuslen));
	bzero(&dn->dn_next_blksz[0], sizeof (dn->dn_next_blksz));
	bzero(&dn->dn_next_maxblkid[0], sizeof (dn->dn_next_maxblkid));

	for (i = 0; i < TXG_SIZE; i++) {
	multilist_link_init(&dn->dn_dirty_link[i]);
	dn->dn_free_ranges[i] = NULL;
	list_create(&dn->dn_dirty_records[i],
	sizeof (dbuf_dirty_record_t),
	offsetof(dbuf_dirty_record_t, dr_dirty_node));
	}

	dn->dn_allocated_txg = 0;
	dn->dn_free_txg = 0;
	dn->dn_assigned_txg = 0;
	dn->dn_dirty_txg = 0;
	dn->dn_dirtyctx = 0;
	dn->dn_dirtyctx_firstset = NULL;
	dn->dn_bonus = NULL;
	dn->dn_have_spill = B_FALSE;
	dn->dn_zio = NULL;
	dn->dn_oldused = 0;
	dn->dn_oldflags = 0;
	dn->dn_olduid = 0;
	dn->dn_oldgid = 0;
	dn->dn_oldprojid = ZFS_DEFAULT_PROJID;
	dn->dn_newuid = 0;
	dn->dn_newgid = 0;
	dn->dn_newprojid = ZFS_DEFAULT_PROJID;
	dn->dn_id_flags = 0;

	dn->dn_dbufs_count = 0;
	avl_create(&dn->dn_dbufs, dbuf_compare, sizeof (dmu_buf_impl_t),
	offsetof(dmu_buf_impl_t, db_link));

	dn->dn_moved = 0;
	return (0);
	}

	/* ARGSUSED */
	static void
	dnode_dest(void arg, void unused)
	{
	int i;
	dnode_t *dn = arg;

	rw_destroy(&dn->dn_struct_rwlock);
	mutex_destroy(&dn->dn_mtx);
	mutex_destroy(&dn->dn_dbufs_mtx);
	cv_destroy(&dn->dn_notxholds);
	cv_destroy(&dn->dn_nodnholds);
	zfs_refcount_destroy(&dn->dn_holds);
	zfs_refcount_destroy(&dn->dn_tx_holds);
	ASSERT(!list_link_active(&dn->dn_link));

	for (i = 0; i < TXG_SIZE; i++) {
	ASSERT(!multilist_link_active(&dn->dn_dirty_link[i]));
	ASSERT3P(dn->dn_free_ranges[i], ==, NULL);
	list_destroy(&dn->dn_dirty_records[i]);
	ASSERT0(dn->dn_next_nblkptr[i]);
	ASSERT0(dn->dn_next_nlevels[i]);
	ASSERT0(dn->dn_next_indblkshift[i]);
	ASSERT0(dn->dn_next_bonustype[i]);
	ASSERT0(dn->dn_rm_spillblk[i]);
	ASSERT0(dn->dn_next_bonuslen[i]);
	ASSERT0(dn->dn_next_blksz[i]);
	ASSERT0(dn->dn_next_maxblkid[i]);
	}

	ASSERT0(dn->dn_allocated_txg);
	ASSERT0(dn->dn_free_txg);
	ASSERT0(dn->dn_assigned_txg);
	ASSERT0(dn->dn_dirty_txg);
	ASSERT0(dn->dn_dirtyctx);
	ASSERT3P(dn->dn_dirtyctx_firstset, ==, NULL);
	ASSERT3P(dn->dn_bonus, ==, NULL);
	ASSERT(!dn->dn_have_spill);
	ASSERT3P(dn->dn_zio, ==, NULL);
	ASSERT0(dn->dn_oldused);
	ASSERT0(dn->dn_oldflags);
	ASSERT0(dn->dn_olduid);
	ASSERT0(dn->dn_oldgid);
	ASSERT0(dn->dn_oldprojid);
	ASSERT0(dn->dn_newuid);
	ASSERT0(dn->dn_newgid);
	ASSERT0(dn->dn_newprojid);
	ASSERT0(dn->dn_id_flags);

	ASSERT0(dn->dn_dbufs_count);
	avl_destroy(&dn->dn_dbufs);
	}

	void
	dnode_init(void)
	{
	ASSERT(dnode_cache == NULL);
	dnode_cache = kmem_cache_create("dnode_t", sizeof (dnode_t),
	0, dnode_cons, dnode_dest, NULL, NULL, NULL, 0);
	kmem_cache_set_move(dnode_cache, dnode_move);

	dnode_ksp = kstat_create("zfs", 0, "dnodestats", "misc",
	KSTAT_TYPE_NAMED, sizeof (dnode_stats) / sizeof (kstat_named_t),
	KSTAT_FLAG_VIRTUAL);
	if (dnode_ksp != NULL) {
	dnode_ksp->ks_data = &dnode_stats;
	kstat_install(dnode_ksp);
	}
	}

	void
	dnode_fini(void)
	{
	if (dnode_ksp != NULL) {
	kstat_delete(dnode_ksp);
	dnode_ksp = NULL;
	}

	kmem_cache_destroy(dnode_cache);
	dnode_cache = NULL;
	}


	#ifdef ZFS_DEBUG
	void
	dnode_verify(dnode_t *dn)
	{
	int drop_struct_lock = FALSE;

	ASSERT(dn->dn_phys);
	ASSERT(dn->dn_objset);
	ASSERT(dn->dn_handle->dnh_dnode == dn);

	ASSERT(DMU_OT_IS_VALID(dn->dn_phys->dn_type));

	if (!(zfs_flags & ZFS_DEBUG_DNODE_VERIFY))
	return;

	if (!RW_WRITE_HELD(&dn->dn_struct_rwlock)) {
	rw_enter(&dn->dn_struct_rwlock, RW_READER);
	drop_struct_lock = TRUE;
	}
	if (dn->dn_phys->dn_type != DMU_OT_NONE \|\| dn->dn_allocated_txg != 0) {
	int i;
	int max_bonuslen = DN_SLOTS_TO_BONUSLEN(dn->dn_num_slots);
	ASSERT3U(dn->dn_indblkshift, <=, SPA_MAXBLOCKSHIFT);
	if (dn->dn_datablkshift) {
	ASSERT3U(dn->dn_datablkshift, >=, SPA_MINBLOCKSHIFT);
	ASSERT3U(dn->dn_datablkshift, <=, SPA_MAXBLOCKSHIFT);
	ASSERT3U(1<<dn->dn_datablkshift, ==, dn->dn_datablksz);
	}
	ASSERT3U(dn->dn_nlevels, <=, 30);
	ASSERT(DMU_OT_IS_VALID(dn->dn_type));
	ASSERT3U(dn->dn_nblkptr, >=, 1);
	ASSERT3U(dn->dn_nblkptr, <=, DN_MAX_NBLKPTR);
	ASSERT3U(dn->dn_bonuslen, <=, max_bonuslen);
	ASSERT3U(dn->dn_datablksz, ==,
	dn->dn_datablkszsec << SPA_MINBLOCKSHIFT);
	ASSERT3U(ISP2(dn->dn_datablksz), ==, dn->dn_datablkshift != 0);
	ASSERT3U((dn->dn_nblkptr - 1) * sizeof (blkptr_t) +
	dn->dn_bonuslen, <=, max_bonuslen);
	for (i = 0; i < TXG_SIZE; i++) {
	ASSERT3U(dn->dn_next_nlevels[i], <=, dn->dn_nlevels);
	}
	}
	if (dn->dn_phys->dn_type != DMU_OT_NONE)
	ASSERT3U(dn->dn_phys->dn_nlevels, <=, dn->dn_nlevels);
	ASSERT(DMU_OBJECT_IS_SPECIAL(dn->dn_object) \|\| dn->dn_dbuf != NULL);
	if (dn->dn_dbuf != NULL) {
	ASSERT3P(dn->dn_phys, ==,
	(dnode_phys_t *)dn->dn_dbuf->db.db_data +
	(dn->dn_object % (dn->dn_dbuf->db.db_size >> DNODE_SHIFT)));
	}
	if (drop_struct_lock)
	rw_exit(&dn->dn_struct_rwlock);
	}
	#endif

	void
	dnode_byteswap(dnode_phys_t *dnp)
	{
	uint64_t buf64 = (void)&dnp->dn_blkptr;
	int i;

	if (dnp->dn_type == DMU_OT_NONE) {
	bzero(dnp, sizeof (dnode_phys_t));
	return;
	}

	dnp->dn_datablkszsec = BSWAP_16(dnp->dn_datablkszsec);
	dnp->dn_bonuslen = BSWAP_16(dnp->dn_bonuslen);
	dnp->dn_extra_slots = BSWAP_8(dnp->dn_extra_slots);
	dnp->dn_maxblkid = BSWAP_64(dnp->dn_maxblkid);
	dnp->dn_used = BSWAP_64(dnp->dn_used);

	/*
	* dn_nblkptr is only one byte, so it's OK to read it in either
	* byte order. We can't read dn_bouslen.
	*/
	ASSERT(dnp->dn_indblkshift <= SPA_MAXBLOCKSHIFT);
	ASSERT(dnp->dn_nblkptr <= DN_MAX_NBLKPTR);
	for (i = 0; i < dnp->dn_nblkptr * sizeof (blkptr_t)/8; i++)
	buf64[i] = BSWAP_64(buf64[i]);

	/*
	* OK to check dn_bonuslen for zero, because it won't matter if
	* we have the wrong byte order. This is necessary because the
	* dnode dnode is smaller than a regular dnode.
	*/
	if (dnp->dn_bonuslen != 0) {
	/*
	* Note that the bonus length calculated here may be
	* longer than the actual bonus buffer. This is because
	* we always put the bonus buffer after the last block
	* pointer (instead of packing it against the end of the
	* dnode buffer).
	*/
	int off = (dnp->dn_nblkptr-1) * sizeof (blkptr_t);
	int slots = dnp->dn_extra_slots + 1;
	size_t len = DN_SLOTS_TO_BONUSLEN(slots) - off;
	dmu_object_byteswap_t byteswap;
	ASSERT(DMU_OT_IS_VALID(dnp->dn_bonustype));
	byteswap = DMU_OT_BYTESWAP(dnp->dn_bonustype);
	dmu_ot_byteswap[byteswap].ob_func(dnp->dn_bonus + off, len);
	}

	/* Swap SPILL block if we have one */
	if (dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR)
	byteswap_uint64_array(DN_SPILL_BLKPTR(dnp), sizeof (blkptr_t));
	}

	void
	dnode_buf_byteswap(void *vbuf, size_t size)
	{
	int i = 0;

	ASSERT3U(sizeof (dnode_phys_t), ==, (1<<DNODE_SHIFT));
	ASSERT((size & (sizeof (dnode_phys_t)-1)) == 0);

	while (i < size) {
	dnode_phys_t dnp = (void )(((char *)vbuf) + i);
	dnode_byteswap(dnp);

	i += DNODE_MIN_SIZE;
	if (dnp->dn_type != DMU_OT_NONE)
	i += dnp->dn_extra_slots * DNODE_MIN_SIZE;
	}
	}

	void
	dnode_setbonuslen(dnode_t dn, int newsize, dmu_tx_t tx)
	{
	ASSERT3U(zfs_refcount_count(&dn->dn_holds), >=, 1);

	dnode_setdirty(dn, tx);
	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);
	ASSERT3U(newsize, <=, DN_SLOTS_TO_BONUSLEN(dn->dn_num_slots) -
	(dn->dn_nblkptr-1) * sizeof (blkptr_t));

	if (newsize < dn->dn_bonuslen) {
	/* clear any data after the end of the new size */
	size_t diff = dn->dn_bonuslen - newsize;
	char data_end = ((char )dn->dn_bonus->db.db_data) + newsize;
	bzero(data_end, diff);
	}

	dn->dn_bonuslen = newsize;
	if (newsize == 0)
	dn->dn_next_bonuslen[tx->tx_txg & TXG_MASK] = DN_ZERO_BONUSLEN;
	else
	dn->dn_next_bonuslen[tx->tx_txg & TXG_MASK] = dn->dn_bonuslen;
	rw_exit(&dn->dn_struct_rwlock);
	}

	void
	dnode_setbonus_type(dnode_t dn, dmu_object_type_t newtype, dmu_tx_t tx)
	{
	ASSERT3U(zfs_refcount_count(&dn->dn_holds), >=, 1);
	dnode_setdirty(dn, tx);
	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);
	dn->dn_bonustype = newtype;
	dn->dn_next_bonustype[tx->tx_txg & TXG_MASK] = dn->dn_bonustype;
	rw_exit(&dn->dn_struct_rwlock);
	}

	void
	dnode_rm_spill(dnode_t dn, dmu_tx_t tx)
	{
	ASSERT3U(zfs_refcount_count(&dn->dn_holds), >=, 1);
	ASSERT(RW_WRITE_HELD(&dn->dn_struct_rwlock));
	dnode_setdirty(dn, tx);
	dn->dn_rm_spillblk[tx->tx_txg & TXG_MASK] = DN_KILL_SPILLBLK;
	dn->dn_have_spill = B_FALSE;
	}

	static void
	dnode_setdblksz(dnode_t *dn, int size)
	{
	ASSERT0(P2PHASE(size, SPA_MINBLOCKSIZE));
	ASSERT3U(size, <=, SPA_MAXBLOCKSIZE);
	ASSERT3U(size, >=, SPA_MINBLOCKSIZE);
	ASSERT3U(size >> SPA_MINBLOCKSHIFT, <,
	1<<(sizeof (dn->dn_phys->dn_datablkszsec) * 8));
	dn->dn_datablksz = size;
	dn->dn_datablkszsec = size >> SPA_MINBLOCKSHIFT;
	dn->dn_datablkshift = ISP2(size) ? highbit64(size - 1) : 0;
	}

	static dnode_t *
	dnode_create(objset_t os, dnode_phys_t dnp, dmu_buf_impl_t *db,
	uint64_t object, dnode_handle_t *dnh)
	{
	dnode_t *dn;

	dn = kmem_cache_alloc(dnode_cache, KM_SLEEP);
	dn->dn_moved = 0;

	/*
	* Defer setting dn_objset until the dnode is ready to be a candidate
	* for the dnode_move() callback.
	*/
	dn->dn_object = object;
	dn->dn_dbuf = db;
	dn->dn_handle = dnh;
	dn->dn_phys = dnp;

	if (dnp->dn_datablkszsec) {
	dnode_setdblksz(dn, dnp->dn_datablkszsec << SPA_MINBLOCKSHIFT);
	} else {
	dn->dn_datablksz = 0;
	dn->dn_datablkszsec = 0;
	dn->dn_datablkshift = 0;
	}
	dn->dn_indblkshift = dnp->dn_indblkshift;
	dn->dn_nlevels = dnp->dn_nlevels;
	dn->dn_type = dnp->dn_type;
	dn->dn_nblkptr = dnp->dn_nblkptr;
	dn->dn_checksum = dnp->dn_checksum;
	dn->dn_compress = dnp->dn_compress;
	dn->dn_bonustype = dnp->dn_bonustype;
	dn->dn_bonuslen = dnp->dn_bonuslen;
	dn->dn_num_slots = dnp->dn_extra_slots + 1;
	dn->dn_maxblkid = dnp->dn_maxblkid;
	dn->dn_have_spill = ((dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR) != 0);
	dn->dn_id_flags = 0;

	dmu_zfetch_init(&dn->dn_zfetch, dn);

	ASSERT(DMU_OT_IS_VALID(dn->dn_phys->dn_type));
	ASSERT(zrl_is_locked(&dnh->dnh_zrlock));
	ASSERT(!DN_SLOT_IS_PTR(dnh->dnh_dnode));

	mutex_enter(&os->os_lock);

	/*
	* Exclude special dnodes from os_dnodes so an empty os_dnodes
	* signifies that the special dnodes have no references from
	* their children (the entries in os_dnodes). This allows
	* dnode_destroy() to easily determine if the last child has
	* been removed and then complete eviction of the objset.
	*/
	if (!DMU_OBJECT_IS_SPECIAL(object))
	list_insert_head(&os->os_dnodes, dn);
	membar_producer();

	/*
	* Everything else must be valid before assigning dn_objset
	* makes the dnode eligible for dnode_move().
	*/
	dn->dn_objset = os;

	dnh->dnh_dnode = dn;
	mutex_exit(&os->os_lock);

	arc_space_consume(sizeof (dnode_t), ARC_SPACE_DNODE);

	return (dn);
	}

	/*
	* Caller must be holding the dnode handle, which is released upon return.
	*/
	static void
	dnode_destroy(dnode_t *dn)
	{
	objset_t *os = dn->dn_objset;
	boolean_t complete_os_eviction = B_FALSE;

	ASSERT((dn->dn_id_flags & DN_ID_NEW_EXIST) == 0);

	mutex_enter(&os->os_lock);
	POINTER_INVALIDATE(&dn->dn_objset);
	if (!DMU_OBJECT_IS_SPECIAL(dn->dn_object)) {
	list_remove(&os->os_dnodes, dn);
	complete_os_eviction =
	list_is_empty(&os->os_dnodes) &&
	list_link_active(&os->os_evicting_node);
	}
	mutex_exit(&os->os_lock);

	/* the dnode can no longer move, so we can release the handle */
	if (!zrl_is_locked(&dn->dn_handle->dnh_zrlock))
	zrl_remove(&dn->dn_handle->dnh_zrlock);

	dn->dn_allocated_txg = 0;
	dn->dn_free_txg = 0;
	dn->dn_assigned_txg = 0;
	dn->dn_dirty_txg = 0;

	dn->dn_dirtyctx = 0;
	dn->dn_dirtyctx_firstset = NULL;
	if (dn->dn_bonus != NULL) {
	mutex_enter(&dn->dn_bonus->db_mtx);
	dbuf_destroy(dn->dn_bonus);
	dn->dn_bonus = NULL;
	}
	dn->dn_zio = NULL;

	dn->dn_have_spill = B_FALSE;
	dn->dn_oldused = 0;
	dn->dn_oldflags = 0;
	dn->dn_olduid = 0;
	dn->dn_oldgid = 0;
	dn->dn_oldprojid = ZFS_DEFAULT_PROJID;
	dn->dn_newuid = 0;
	dn->dn_newgid = 0;
	dn->dn_newprojid = ZFS_DEFAULT_PROJID;
	dn->dn_id_flags = 0;

	dmu_zfetch_fini(&dn->dn_zfetch);
	kmem_cache_free(dnode_cache, dn);
	arc_space_return(sizeof (dnode_t), ARC_SPACE_DNODE);

	if (complete_os_eviction)
	dmu_objset_evict_done(os);
	}

	void
	dnode_allocate(dnode_t *dn, dmu_object_type_t ot, int blocksize, int ibs,
	dmu_object_type_t bonustype, int bonuslen, int dn_slots, dmu_tx_t *tx)
	{
	int i;

	ASSERT3U(dn_slots, >, 0);
	ASSERT3U(dn_slots << DNODE_SHIFT, <=,
	spa_maxdnodesize(dmu_objset_spa(dn->dn_objset)));
	ASSERT3U(blocksize, <=,
	spa_maxblocksize(dmu_objset_spa(dn->dn_objset)));
	if (blocksize == 0)
	blocksize = 1 << zfs_default_bs;
	else
	blocksize = P2ROUNDUP(blocksize, SPA_MINBLOCKSIZE);

	if (ibs == 0)
	ibs = zfs_default_ibs;

	ibs = MIN(MAX(ibs, DN_MIN_INDBLKSHIFT), DN_MAX_INDBLKSHIFT);

	dprintf("os=%p obj=%llu txg=%llu blocksize=%d ibs=%d dn_slots=%d\n",
	dn->dn_objset, dn->dn_object, tx->tx_txg, blocksize, ibs, dn_slots);
	DNODE_STAT_BUMP(dnode_allocate);

	ASSERT(dn->dn_type == DMU_OT_NONE);
	ASSERT(bcmp(dn->dn_phys, &dnode_phys_zero, sizeof (dnode_phys_t)) == 0);
	ASSERT(dn->dn_phys->dn_type == DMU_OT_NONE);
	ASSERT(ot != DMU_OT_NONE);
	ASSERT(DMU_OT_IS_VALID(ot));
	ASSERT((bonustype == DMU_OT_NONE && bonuslen == 0) \|\|
	(bonustype == DMU_OT_SA && bonuslen == 0) \|\|
	(bonustype != DMU_OT_NONE && bonuslen != 0));
	ASSERT(DMU_OT_IS_VALID(bonustype));
	ASSERT3U(bonuslen, <=, DN_SLOTS_TO_BONUSLEN(dn_slots));
	ASSERT(dn->dn_type == DMU_OT_NONE);
	ASSERT0(dn->dn_maxblkid);
	ASSERT0(dn->dn_allocated_txg);
	ASSERT0(dn->dn_assigned_txg);
	ASSERT0(dn->dn_dirty_txg);
	ASSERT(zfs_refcount_is_zero(&dn->dn_tx_holds));
	ASSERT3U(zfs_refcount_count(&dn->dn_holds), <=, 1);
	ASSERT(avl_is_empty(&dn->dn_dbufs));

	for (i = 0; i < TXG_SIZE; i++) {
	ASSERT0(dn->dn_next_nblkptr[i]);
	ASSERT0(dn->dn_next_nlevels[i]);
	ASSERT0(dn->dn_next_indblkshift[i]);
	ASSERT0(dn->dn_next_bonuslen[i]);
	ASSERT0(dn->dn_next_bonustype[i]);
	ASSERT0(dn->dn_rm_spillblk[i]);
	ASSERT0(dn->dn_next_blksz[i]);
	ASSERT0(dn->dn_next_maxblkid[i]);
	ASSERT(!multilist_link_active(&dn->dn_dirty_link[i]));
	ASSERT3P(list_head(&dn->dn_dirty_records[i]), ==, NULL);
	ASSERT3P(dn->dn_free_ranges[i], ==, NULL);
	}

	dn->dn_type = ot;
	dnode_setdblksz(dn, blocksize);
	dn->dn_indblkshift = ibs;
	dn->dn_nlevels = 1;
	dn->dn_num_slots = dn_slots;
	if (bonustype == DMU_OT_SA) /* Maximize bonus space for SA */
	dn->dn_nblkptr = 1;
	else {
	dn->dn_nblkptr = MIN(DN_MAX_NBLKPTR,
	1 + ((DN_SLOTS_TO_BONUSLEN(dn_slots) - bonuslen) >>
	SPA_BLKPTRSHIFT));
	}

	dn->dn_bonustype = bonustype;
	dn->dn_bonuslen = bonuslen;
	dn->dn_checksum = ZIO_CHECKSUM_INHERIT;
	dn->dn_compress = ZIO_COMPRESS_INHERIT;
	dn->dn_dirtyctx = 0;

	dn->dn_free_txg = 0;
	dn->dn_dirtyctx_firstset = NULL;

	dn->dn_allocated_txg = tx->tx_txg;
	dn->dn_id_flags = 0;

	dnode_setdirty(dn, tx);
	dn->dn_next_indblkshift[tx->tx_txg & TXG_MASK] = ibs;
	dn->dn_next_bonuslen[tx->tx_txg & TXG_MASK] = dn->dn_bonuslen;
	dn->dn_next_bonustype[tx->tx_txg & TXG_MASK] = dn->dn_bonustype;
	dn->dn_next_blksz[tx->tx_txg & TXG_MASK] = dn->dn_datablksz;
	}

	void
	dnode_reallocate(dnode_t *dn, dmu_object_type_t ot, int blocksize,
	dmu_object_type_t bonustype, int bonuslen, int dn_slots,
	boolean_t keep_spill, dmu_tx_t *tx)
	{
	int nblkptr;

	ASSERT3U(blocksize, >=, SPA_MINBLOCKSIZE);
	ASSERT3U(blocksize, <=,
	spa_maxblocksize(dmu_objset_spa(dn->dn_objset)));
	ASSERT0(blocksize % SPA_MINBLOCKSIZE);
	ASSERT(dn->dn_object != DMU_META_DNODE_OBJECT \|\| dmu_tx_private_ok(tx));
	ASSERT(tx->tx_txg != 0);
	ASSERT((bonustype == DMU_OT_NONE && bonuslen == 0) \|\|
	(bonustype != DMU_OT_NONE && bonuslen != 0) \|\|
	(bonustype == DMU_OT_SA && bonuslen == 0));
	ASSERT(DMU_OT_IS_VALID(bonustype));
	ASSERT3U(bonuslen, <=,
	DN_BONUS_SIZE(spa_maxdnodesize(dmu_objset_spa(dn->dn_objset))));
	ASSERT3U(bonuslen, <=, DN_BONUS_SIZE(dn_slots << DNODE_SHIFT));

	dnode_free_interior_slots(dn);
	DNODE_STAT_BUMP(dnode_reallocate);

	/* clean up any unreferenced dbufs */
	dnode_evict_dbufs(dn);

	dn->dn_id_flags = 0;

	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);
	dnode_setdirty(dn, tx);
	if (dn->dn_datablksz != blocksize) {
	/* change blocksize */
	ASSERT0(dn->dn_maxblkid);
	ASSERT(BP_IS_HOLE(&dn->dn_phys->dn_blkptr[0]) \|\|
	dnode_block_freed(dn, 0));

	dnode_setdblksz(dn, blocksize);
	dn->dn_next_blksz[tx->tx_txg & TXG_MASK] = blocksize;
	}
	if (dn->dn_bonuslen != bonuslen)
	dn->dn_next_bonuslen[tx->tx_txg & TXG_MASK] = bonuslen;

	if (bonustype == DMU_OT_SA) /* Maximize bonus space for SA */
	nblkptr = 1;
	else
	nblkptr = MIN(DN_MAX_NBLKPTR,
	1 + ((DN_SLOTS_TO_BONUSLEN(dn_slots) - bonuslen) >>
	SPA_BLKPTRSHIFT));
	if (dn->dn_bonustype != bonustype)
	dn->dn_next_bonustype[tx->tx_txg & TXG_MASK] = bonustype;
	if (dn->dn_nblkptr != nblkptr)
	dn->dn_next_nblkptr[tx->tx_txg & TXG_MASK] = nblkptr;
	if (dn->dn_phys->dn_flags & DNODE_FLAG_SPILL_BLKPTR && !keep_spill) {
	dbuf_rm_spill(dn, tx);
	dnode_rm_spill(dn, tx);
	}

	rw_exit(&dn->dn_struct_rwlock);

	/* change type */
	dn->dn_type = ot;

	/* change bonus size and type */
	mutex_enter(&dn->dn_mtx);
	dn->dn_bonustype = bonustype;
	dn->dn_bonuslen = bonuslen;
	dn->dn_num_slots = dn_slots;
	dn->dn_nblkptr = nblkptr;
	dn->dn_checksum = ZIO_CHECKSUM_INHERIT;
	dn->dn_compress = ZIO_COMPRESS_INHERIT;
	ASSERT3U(dn->dn_nblkptr, <=, DN_MAX_NBLKPTR);

	/* fix up the bonus db_size */
	if (dn->dn_bonus) {
	dn->dn_bonus->db.db_size =
	DN_SLOTS_TO_BONUSLEN(dn->dn_num_slots) -
	(dn->dn_nblkptr-1) * sizeof (blkptr_t);
	ASSERT(dn->dn_bonuslen <= dn->dn_bonus->db.db_size);
	}

	dn->dn_allocated_txg = tx->tx_txg;
	mutex_exit(&dn->dn_mtx);
	}

	#ifdef _KERNEL
	static void
	dnode_move_impl(dnode_t odn, dnode_t ndn)
	{
	int i;

	ASSERT(!RW_LOCK_HELD(&odn->dn_struct_rwlock));
	ASSERT(MUTEX_NOT_HELD(&odn->dn_mtx));
	ASSERT(MUTEX_NOT_HELD(&odn->dn_dbufs_mtx));
	ASSERT(!MUTEX_HELD(&odn->dn_zfetch.zf_lock));

	/* Copy fields. */
	ndn->dn_objset = odn->dn_objset;
	ndn->dn_object = odn->dn_object;
	ndn->dn_dbuf = odn->dn_dbuf;
	ndn->dn_handle = odn->dn_handle;
	ndn->dn_phys = odn->dn_phys;
	ndn->dn_type = odn->dn_type;
	ndn->dn_bonuslen = odn->dn_bonuslen;
	ndn->dn_bonustype = odn->dn_bonustype;
	ndn->dn_nblkptr = odn->dn_nblkptr;
	ndn->dn_checksum = odn->dn_checksum;
	ndn->dn_compress = odn->dn_compress;
	ndn->dn_nlevels = odn->dn_nlevels;
	ndn->dn_indblkshift = odn->dn_indblkshift;
	ndn->dn_datablkshift = odn->dn_datablkshift;
	ndn->dn_datablkszsec = odn->dn_datablkszsec;
	ndn->dn_datablksz = odn->dn_datablksz;
	ndn->dn_maxblkid = odn->dn_maxblkid;
	ndn->dn_num_slots = odn->dn_num_slots;
	bcopy(&odn->dn_next_type[0], &ndn->dn_next_type[0],
	sizeof (odn->dn_next_type));
	bcopy(&odn->dn_next_nblkptr[0], &ndn->dn_next_nblkptr[0],
	sizeof (odn->dn_next_nblkptr));
	bcopy(&odn->dn_next_nlevels[0], &ndn->dn_next_nlevels[0],
	sizeof (odn->dn_next_nlevels));
	bcopy(&odn->dn_next_indblkshift[0], &ndn->dn_next_indblkshift[0],
	sizeof (odn->dn_next_indblkshift));
	bcopy(&odn->dn_next_bonustype[0], &ndn->dn_next_bonustype[0],
	sizeof (odn->dn_next_bonustype));
	bcopy(&odn->dn_rm_spillblk[0], &ndn->dn_rm_spillblk[0],
	sizeof (odn->dn_rm_spillblk));
	bcopy(&odn->dn_next_bonuslen[0], &ndn->dn_next_bonuslen[0],
	sizeof (odn->dn_next_bonuslen));
	bcopy(&odn->dn_next_blksz[0], &ndn->dn_next_blksz[0],
	sizeof (odn->dn_next_blksz));
	bcopy(&odn->dn_next_maxblkid[0], &ndn->dn_next_maxblkid[0],
	sizeof (odn->dn_next_maxblkid));
	for (i = 0; i < TXG_SIZE; i++) {
	list_move_tail(&ndn->dn_dirty_records[i],
	&odn->dn_dirty_records[i]);
	}
	bcopy(&odn->dn_free_ranges[0], &ndn->dn_free_ranges[0],
	sizeof (odn->dn_free_ranges));
	ndn->dn_allocated_txg = odn->dn_allocated_txg;
	ndn->dn_free_txg = odn->dn_free_txg;
	ndn->dn_assigned_txg = odn->dn_assigned_txg;
	ndn->dn_dirty_txg = odn->dn_dirty_txg;
	ndn->dn_dirtyctx = odn->dn_dirtyctx;
	ndn->dn_dirtyctx_firstset = odn->dn_dirtyctx_firstset;
	ASSERT(zfs_refcount_count(&odn->dn_tx_holds) == 0);
	zfs_refcount_transfer(&ndn->dn_holds, &odn->dn_holds);
	ASSERT(avl_is_empty(&ndn->dn_dbufs));
	avl_swap(&ndn->dn_dbufs, &odn->dn_dbufs);
	ndn->dn_dbufs_count = odn->dn_dbufs_count;
	ndn->dn_bonus = odn->dn_bonus;
	ndn->dn_have_spill = odn->dn_have_spill;
	ndn->dn_zio = odn->dn_zio;
	ndn->dn_oldused = odn->dn_oldused;
	ndn->dn_oldflags = odn->dn_oldflags;
	ndn->dn_olduid = odn->dn_olduid;
	ndn->dn_oldgid = odn->dn_oldgid;
	ndn->dn_oldprojid = odn->dn_oldprojid;
	ndn->dn_newuid = odn->dn_newuid;
	ndn->dn_newgid = odn->dn_newgid;
	ndn->dn_newprojid = odn->dn_newprojid;
	ndn->dn_id_flags = odn->dn_id_flags;
	dmu_zfetch_init(&ndn->dn_zfetch, NULL);
	list_move_tail(&ndn->dn_zfetch.zf_stream, &odn->dn_zfetch.zf_stream);
	ndn->dn_zfetch.zf_dnode = odn->dn_zfetch.zf_dnode;

	/*
	* Update back pointers. Updating the handle fixes the back pointer of
	* every descendant dbuf as well as the bonus dbuf.
	*/
	ASSERT(ndn->dn_handle->dnh_dnode == odn);
	ndn->dn_handle->dnh_dnode = ndn;
	if (ndn->dn_zfetch.zf_dnode == odn) {
	ndn->dn_zfetch.zf_dnode = ndn;
	}

	/*
	* Invalidate the original dnode by clearing all of its back pointers.
	*/
	odn->dn_dbuf = NULL;
	odn->dn_handle = NULL;
	avl_create(&odn->dn_dbufs, dbuf_compare, sizeof (dmu_buf_impl_t),
	offsetof(dmu_buf_impl_t, db_link));
	odn->dn_dbufs_count = 0;
	odn->dn_bonus = NULL;
	dmu_zfetch_fini(&odn->dn_zfetch);

	/*
	* Set the low bit of the objset pointer to ensure that dnode_move()
	* recognizes the dnode as invalid in any subsequent callback.
	*/
	POINTER_INVALIDATE(&odn->dn_objset);

	/*
	* Satisfy the destructor.
	*/
	for (i = 0; i < TXG_SIZE; i++) {
	list_create(&odn->dn_dirty_records[i],
	sizeof (dbuf_dirty_record_t),
	offsetof(dbuf_dirty_record_t, dr_dirty_node));
	odn->dn_free_ranges[i] = NULL;
	odn->dn_next_nlevels[i] = 0;
	odn->dn_next_indblkshift[i] = 0;
	odn->dn_next_bonustype[i] = 0;
	odn->dn_rm_spillblk[i] = 0;
	odn->dn_next_bonuslen[i] = 0;
	odn->dn_next_blksz[i] = 0;
	}
	odn->dn_allocated_txg = 0;
	odn->dn_free_txg = 0;
	odn->dn_assigned_txg = 0;
	odn->dn_dirty_txg = 0;
	odn->dn_dirtyctx = 0;
	odn->dn_dirtyctx_firstset = NULL;
	odn->dn_have_spill = B_FALSE;
	odn->dn_zio = NULL;
	odn->dn_oldused = 0;
	odn->dn_oldflags = 0;
	odn->dn_olduid = 0;
	odn->dn_oldgid = 0;
	odn->dn_oldprojid = ZFS_DEFAULT_PROJID;
	odn->dn_newuid = 0;
	odn->dn_newgid = 0;
	odn->dn_newprojid = ZFS_DEFAULT_PROJID;
	odn->dn_id_flags = 0;

	/*
	* Mark the dnode.
	*/
	ndn->dn_moved = 1;
	odn->dn_moved = (uint8_t)-1;
	}

	/ARGSUSED/
	static kmem_cbrc_t
	dnode_move(void buf, void newbuf, size_t size, void *arg)
	{
	dnode_t odn = buf, ndn = newbuf;
	objset_t *os;
	int64_t refcount;
	uint32_t dbufs;

	/*
	* The dnode is on the objset's list of known dnodes if the objset
	* pointer is valid. We set the low bit of the objset pointer when
	* freeing the dnode to invalidate it, and the memory patterns written
	* by kmem (baddcafe and deadbeef) set at least one of the two low bits.
	* A newly created dnode sets the objset pointer last of all to indicate
	* that the dnode is known and in a valid state to be moved by this
	* function.
	*/
	os = odn->dn_objset;
	if (!POINTER_IS_VALID(os)) {
	DNODE_STAT_BUMP(dnode_move_invalid);
	return (KMEM_CBRC_DONT_KNOW);
	}

	/*
	* Ensure that the objset does not go away during the move.
	*/
	rw_enter(&os_lock, RW_WRITER);
	if (os != odn->dn_objset) {
	rw_exit(&os_lock);
	DNODE_STAT_BUMP(dnode_move_recheck1);
	return (KMEM_CBRC_DONT_KNOW);
	}

	/*
	* If the dnode is still valid, then so is the objset. We know that no
	* valid objset can be freed while we hold os_lock, so we can safely
	* ensure that the objset remains in use.
	*/
	mutex_enter(&os->os_lock);

	/*
	* Recheck the objset pointer in case the dnode was removed just before
	* acquiring the lock.
	*/
	if (os != odn->dn_objset) {
	mutex_exit(&os->os_lock);
	rw_exit(&os_lock);
	DNODE_STAT_BUMP(dnode_move_recheck2);
	return (KMEM_CBRC_DONT_KNOW);
	}

	/*
	* At this point we know that as long as we hold os->os_lock, the dnode
	* cannot be freed and fields within the dnode can be safely accessed.
	* The objset listing this dnode cannot go away as long as this dnode is
	* on its list.
	*/
	rw_exit(&os_lock);
	if (DMU_OBJECT_IS_SPECIAL(odn->dn_object)) {
	mutex_exit(&os->os_lock);
	DNODE_STAT_BUMP(dnode_move_special);
	return (KMEM_CBRC_NO);
	}
	ASSERT(odn->dn_dbuf != NULL); /* only "special" dnodes have no parent */

	/*
	* Lock the dnode handle to prevent the dnode from obtaining any new
	* holds. This also prevents the descendant dbufs and the bonus dbuf
	* from accessing the dnode, so that we can discount their holds. The
	* handle is safe to access because we know that while the dnode cannot
	* go away, neither can its handle. Once we hold dnh_zrlock, we can
	* safely move any dnode referenced only by dbufs.
	*/
	if (!zrl_tryenter(&odn->dn_handle->dnh_zrlock)) {
	mutex_exit(&os->os_lock);
	DNODE_STAT_BUMP(dnode_move_handle);
	return (KMEM_CBRC_LATER);
	}

	/*
	* Ensure a consistent view of the dnode's holds and the dnode's dbufs.
	* We need to guarantee that there is a hold for every dbuf in order to
	* determine whether the dnode is actively referenced. Falsely matching
	* a dbuf to an active hold would lead to an unsafe move. It's possible
	* that a thread already having an active dnode hold is about to add a
	* dbuf, and we can't compare hold and dbuf counts while the add is in
	* progress.
	*/
	if (!rw_tryenter(&odn->dn_struct_rwlock, RW_WRITER)) {
	zrl_exit(&odn->dn_handle->dnh_zrlock);
	mutex_exit(&os->os_lock);
	DNODE_STAT_BUMP(dnode_move_rwlock);
	return (KMEM_CBRC_LATER);
	}

	/*
	* A dbuf may be removed (evicted) without an active dnode hold. In that
	* case, the dbuf count is decremented under the handle lock before the
	* dbuf's hold is released. This order ensures that if we count the hold
	* after the dbuf is removed but before its hold is released, we will
	* treat the unmatched hold as active and exit safely. If we count the
	* hold before the dbuf is removed, the hold is discounted, and the
	* removal is blocked until the move completes.
	*/
	refcount = zfs_refcount_count(&odn->dn_holds);
	ASSERT(refcount >= 0);
	dbufs = DN_DBUFS_COUNT(odn);

	/* We can't have more dbufs than dnode holds. */
	ASSERT3U(dbufs, <=, refcount);
	DTRACE_PROBE3(dnode__move, dnode_t *, odn, int64_t, refcount,
	uint32_t, dbufs);

	if (refcount > dbufs) {
	rw_exit(&odn->dn_struct_rwlock);
	zrl_exit(&odn->dn_handle->dnh_zrlock);
	mutex_exit(&os->os_lock);
	DNODE_STAT_BUMP(dnode_move_active);
	return (KMEM_CBRC_LATER);
	}

	rw_exit(&odn->dn_struct_rwlock);

	/*
	* At this point we know that anyone with a hold on the dnode is not
	* actively referencing it. The dnode is known and in a valid state to
	* move. We're holding the locks needed to execute the critical section.
	*/
	dnode_move_impl(odn, ndn);

	list_link_replace(&odn->dn_link, &ndn->dn_link);
	/* If the dnode was safe to move, the refcount cannot have changed. */
	ASSERT(refcount == zfs_refcount_count(&ndn->dn_holds));
	ASSERT(dbufs == DN_DBUFS_COUNT(ndn));
	zrl_exit(&ndn->dn_handle->dnh_zrlock); /* handle has moved */
	mutex_exit(&os->os_lock);

	return (KMEM_CBRC_YES);
	}
	#endif /* _KERNEL */

	static void
	dnode_slots_hold(dnode_children_t *children, int idx, int slots)
	{
	ASSERT3S(idx + slots, <=, DNODES_PER_BLOCK);

	for (int i = idx; i < idx + slots; i++) {
	dnode_handle_t *dnh = &children->dnc_children[i];
	zrl_add(&dnh->dnh_zrlock);
	}
	}

	static void
	dnode_slots_rele(dnode_children_t *children, int idx, int slots)
	{
	ASSERT3S(idx + slots, <=, DNODES_PER_BLOCK);

	for (int i = idx; i < idx + slots; i++) {
	dnode_handle_t *dnh = &children->dnc_children[i];

	if (zrl_is_locked(&dnh->dnh_zrlock))
	zrl_exit(&dnh->dnh_zrlock);
	else
	zrl_remove(&dnh->dnh_zrlock);
	}
	}

	static int
	dnode_slots_tryenter(dnode_children_t *children, int idx, int slots)
	{
	ASSERT3S(idx + slots, <=, DNODES_PER_BLOCK);

	for (int i = idx; i < idx + slots; i++) {
	dnode_handle_t *dnh = &children->dnc_children[i];

	if (!zrl_tryenter(&dnh->dnh_zrlock)) {
	for (int j = idx; j < i; j++) {
	dnh = &children->dnc_children[j];
	zrl_exit(&dnh->dnh_zrlock);
	}

	return (0);
	}
	}

	return (1);
	}

	static void
	dnode_set_slots(dnode_children_t children, int idx, int slots, void ptr)
	{
	ASSERT3S(idx + slots, <=, DNODES_PER_BLOCK);

	for (int i = idx; i < idx + slots; i++) {
	dnode_handle_t *dnh = &children->dnc_children[i];
	dnh->dnh_dnode = ptr;
	}
	}

	static boolean_t
	dnode_check_slots_free(dnode_children_t *children, int idx, int slots)
	{
	ASSERT3S(idx + slots, <=, DNODES_PER_BLOCK);

	/*
	* If all dnode slots are either already free or
	* evictable return B_TRUE.
	*/
	for (int i = idx; i < idx + slots; i++) {
	dnode_handle_t *dnh = &children->dnc_children[i];
	dnode_t *dn = dnh->dnh_dnode;

	if (dn == DN_SLOT_FREE) {
	continue;
	} else if (DN_SLOT_IS_PTR(dn)) {
	mutex_enter(&dn->dn_mtx);
	boolean_t can_free = (dn->dn_type == DMU_OT_NONE &&
	zfs_refcount_is_zero(&dn->dn_holds) &&
	!DNODE_IS_DIRTY(dn));
	mutex_exit(&dn->dn_mtx);

	if (!can_free)
	return (B_FALSE);
	else
	continue;
	} else {
	return (B_FALSE);
	}
	}

	return (B_TRUE);
	}

	static void
	dnode_reclaim_slots(dnode_children_t *children, int idx, int slots)
	{
	ASSERT3S(idx + slots, <=, DNODES_PER_BLOCK);

	for (int i = idx; i < idx + slots; i++) {
	dnode_handle_t *dnh = &children->dnc_children[i];

	ASSERT(zrl_is_locked(&dnh->dnh_zrlock));

	if (DN_SLOT_IS_PTR(dnh->dnh_dnode)) {
	ASSERT3S(dnh->dnh_dnode->dn_type, ==, DMU_OT_NONE);
	dnode_destroy(dnh->dnh_dnode);
	dnh->dnh_dnode = DN_SLOT_FREE;
	}
	}
	}

	void
	dnode_free_interior_slots(dnode_t *dn)
	{
	dnode_children_t *children = dmu_buf_get_user(&dn->dn_dbuf->db);
	int epb = dn->dn_dbuf->db.db_size >> DNODE_SHIFT;
	int idx = (dn->dn_object & (epb - 1)) + 1;
	int slots = dn->dn_num_slots - 1;

	if (slots == 0)
	return;

	ASSERT3S(idx + slots, <=, DNODES_PER_BLOCK);

	while (!dnode_slots_tryenter(children, idx, slots)) {
	DNODE_STAT_BUMP(dnode_free_interior_lock_retry);
	cond_resched();
	}

	dnode_set_slots(children, idx, slots, DN_SLOT_FREE);
	dnode_slots_rele(children, idx, slots);
	}

	void
	dnode_special_close(dnode_handle_t *dnh)
	{
	dnode_t *dn = dnh->dnh_dnode;

	/*
	* Ensure dnode_rele_and_unlock() has released dn_mtx, after final
	* zfs_refcount_remove()
	*/
	mutex_enter(&dn->dn_mtx);
	if (zfs_refcount_count(&dn->dn_holds) > 0)
	cv_wait(&dn->dn_nodnholds, &dn->dn_mtx);
	mutex_exit(&dn->dn_mtx);
	ASSERT3U(zfs_refcount_count(&dn->dn_holds), ==, 0);

	ASSERT(dn->dn_dbuf == NULL \|\|
	dmu_buf_get_user(&dn->dn_dbuf->db) == NULL);
	zrl_add(&dnh->dnh_zrlock);
	dnode_destroy(dn); /* implicit zrl_remove() */
	zrl_destroy(&dnh->dnh_zrlock);
	dnh->dnh_dnode = NULL;
	}

	void
	dnode_special_open(objset_t os, dnode_phys_t dnp, uint64_t object,
	dnode_handle_t *dnh)
	{
	dnode_t *dn;

	zrl_init(&dnh->dnh_zrlock);
	- zrl_tryenter(&dnh->dnh_zrlock);
	+ VERIFY3U(1, ==, zrl_tryenter(&dnh->dnh_zrlock));

	dn = dnode_create(os, dnp, NULL, object, dnh);
	DNODE_VERIFY(dn);

	zrl_exit(&dnh->dnh_zrlock);
	}

	static void
	dnode_buf_evict_async(void *dbu)
	{
	dnode_children_t *dnc = dbu;

	DNODE_STAT_BUMP(dnode_buf_evict);

	for (int i = 0; i < dnc->dnc_count; i++) {
	dnode_handle_t *dnh = &dnc->dnc_children[i];
	dnode_t *dn;

	/*
	* The dnode handle lock guards against the dnode moving to
	* another valid address, so there is no need here to guard
	* against changes to or from NULL.
	*/
	if (!DN_SLOT_IS_PTR(dnh->dnh_dnode)) {
	zrl_destroy(&dnh->dnh_zrlock);
	dnh->dnh_dnode = DN_SLOT_UNINIT;
	continue;
	}

	zrl_add(&dnh->dnh_zrlock);
	dn = dnh->dnh_dnode;
	/*
	* If there are holds on this dnode, then there should
	* be holds on the dnode's containing dbuf as well; thus
	* it wouldn't be eligible for eviction and this function
	* would not have been called.
	*/
	ASSERT(zfs_refcount_is_zero(&dn->dn_holds));
	ASSERT(zfs_refcount_is_zero(&dn->dn_tx_holds));

	dnode_destroy(dn); /* implicit zrl_remove() for first slot */
	zrl_destroy(&dnh->dnh_zrlock);
	dnh->dnh_dnode = DN_SLOT_UNINIT;
	}
	kmem_free(dnc, sizeof (dnode_children_t) +
	dnc->dnc_count * sizeof (dnode_handle_t));
	}

	/*
	* When the DNODE_MUST_BE_FREE flag is set, the "slots" parameter is used
	* to ensure the hole at the specified object offset is large enough to
	* hold the dnode being created. The slots parameter is also used to ensure
	* a dnode does not span multiple dnode blocks. In both of these cases, if
	* a failure occurs, ENOSPC is returned. Keep in mind, these failure cases
	* are only possible when using DNODE_MUST_BE_FREE.
	*
	* If the DNODE_MUST_BE_ALLOCATED flag is set, "slots" must be 0.
	* dnode_hold_impl() will check if the requested dnode is already consumed
	* as an extra dnode slot by an large dnode, in which case it returns
	* ENOENT.
	*
	* If the DNODE_DRY_RUN flag is set, we don't actually hold the dnode, just
	* return whether the hold would succeed or not. tag and dnp should set to
	* NULL in this case.
	*
	* errors:
	* EINVAL - Invalid object number or flags.
	* ENOSPC - Hole too small to fulfill "slots" request (DNODE_MUST_BE_FREE)
	* EEXIST - Refers to an allocated dnode (DNODE_MUST_BE_FREE)
	* - Refers to a freeing dnode (DNODE_MUST_BE_FREE)
	* - Refers to an interior dnode slot (DNODE_MUST_BE_ALLOCATED)
	* ENOENT - The requested dnode is not allocated (DNODE_MUST_BE_ALLOCATED)
	* - The requested dnode is being freed (DNODE_MUST_BE_ALLOCATED)
	* EIO - I/O error when reading the meta dnode dbuf.
	*
	* succeeds even for free dnodes.
	*/
	int
	dnode_hold_impl(objset_t *os, uint64_t object, int flag, int slots,
	void tag, dnode_t *dnp)
	{
	int epb, idx, err;
	int drop_struct_lock = FALSE;
	int type;
	uint64_t blk;
	dnode_t mdn, dn;
	dmu_buf_impl_t *db;
	dnode_children_t *dnc;
	dnode_phys_t *dn_block;
	dnode_handle_t *dnh;

	ASSERT(!(flag & DNODE_MUST_BE_ALLOCATED) \|\| (slots == 0));
	ASSERT(!(flag & DNODE_MUST_BE_FREE) \|\| (slots > 0));
	IMPLY(flag & DNODE_DRY_RUN, (tag == NULL) && (dnp == NULL));

	/*
	* If you are holding the spa config lock as writer, you shouldn't
	* be asking the DMU to do anything unless it's the root pool
	* which may require us to read from the root filesystem while
	* holding some (not all) of the locks as writer.
	*/
	ASSERT(spa_config_held(os->os_spa, SCL_ALL, RW_WRITER) == 0 \|\|
	(spa_is_root(os->os_spa) &&
	spa_config_held(os->os_spa, SCL_STATE, RW_WRITER)));

	ASSERT((flag & DNODE_MUST_BE_ALLOCATED) \|\| (flag & DNODE_MUST_BE_FREE));

	if (object == DMU_USERUSED_OBJECT \|\| object == DMU_GROUPUSED_OBJECT \|\|
	object == DMU_PROJECTUSED_OBJECT) {
	if (object == DMU_USERUSED_OBJECT)
	dn = DMU_USERUSED_DNODE(os);
	else if (object == DMU_GROUPUSED_OBJECT)
	dn = DMU_GROUPUSED_DNODE(os);
	else
	dn = DMU_PROJECTUSED_DNODE(os);
	if (dn == NULL)
	return (SET_ERROR(ENOENT));
	type = dn->dn_type;
	if ((flag & DNODE_MUST_BE_ALLOCATED) && type == DMU_OT_NONE)
	return (SET_ERROR(ENOENT));
	if ((flag & DNODE_MUST_BE_FREE) && type != DMU_OT_NONE)
	return (SET_ERROR(EEXIST));
	DNODE_VERIFY(dn);
	/* Don't actually hold if dry run, just return 0 */
	if (!(flag & DNODE_DRY_RUN)) {
	(void) zfs_refcount_add(&dn->dn_holds, tag);
	*dnp = dn;
	}
	return (0);
	}

	if (object == 0 \|\| object >= DN_MAX_OBJECT)
	return (SET_ERROR(EINVAL));

	mdn = DMU_META_DNODE(os);
	ASSERT(mdn->dn_object == DMU_META_DNODE_OBJECT);

	DNODE_VERIFY(mdn);

	if (!RW_WRITE_HELD(&mdn->dn_struct_rwlock)) {
	rw_enter(&mdn->dn_struct_rwlock, RW_READER);
	drop_struct_lock = TRUE;
	}

	blk = dbuf_whichblock(mdn, 0, object * sizeof (dnode_phys_t));
	db = dbuf_hold(mdn, blk, FTAG);
	if (drop_struct_lock)
	rw_exit(&mdn->dn_struct_rwlock);
	if (db == NULL) {
	DNODE_STAT_BUMP(dnode_hold_dbuf_hold);
	return (SET_ERROR(EIO));
	}

	/*
	* We do not need to decrypt to read the dnode so it doesn't matter
	* if we get the encrypted or decrypted version.
	*/
	err = dbuf_read(db, NULL, DB_RF_CANFAIL \| DB_RF_NO_DECRYPT);
	if (err) {
	DNODE_STAT_BUMP(dnode_hold_dbuf_read);
	dbuf_rele(db, FTAG);
	return (err);
	}

	ASSERT3U(db->db.db_size, >=, 1<<DNODE_SHIFT);
	epb = db->db.db_size >> DNODE_SHIFT;

	idx = object & (epb - 1);
	dn_block = (dnode_phys_t *)db->db.db_data;

	ASSERT(DB_DNODE(db)->dn_type == DMU_OT_DNODE);
	dnc = dmu_buf_get_user(&db->db);
	dnh = NULL;
	if (dnc == NULL) {
	dnode_children_t *winner;
	int skip = 0;

	dnc = kmem_zalloc(sizeof (dnode_children_t) +
	epb * sizeof (dnode_handle_t), KM_SLEEP);
	dnc->dnc_count = epb;
	dnh = &dnc->dnc_children[0];

	/* Initialize dnode slot status from dnode_phys_t */
	for (int i = 0; i < epb; i++) {
	zrl_init(&dnh[i].dnh_zrlock);

	if (skip) {
	skip--;
	continue;
	}

	if (dn_block[i].dn_type != DMU_OT_NONE) {
	int interior = dn_block[i].dn_extra_slots;

	dnode_set_slots(dnc, i, 1, DN_SLOT_ALLOCATED);
	dnode_set_slots(dnc, i + 1, interior,
	DN_SLOT_INTERIOR);
	skip = interior;
	} else {
	dnh[i].dnh_dnode = DN_SLOT_FREE;
	skip = 0;
	}
	}

	dmu_buf_init_user(&dnc->dnc_dbu, NULL,
	dnode_buf_evict_async, NULL);
	winner = dmu_buf_set_user(&db->db, &dnc->dnc_dbu);
	if (winner != NULL) {

	for (int i = 0; i < epb; i++)
	zrl_destroy(&dnh[i].dnh_zrlock);

	kmem_free(dnc, sizeof (dnode_children_t) +
	epb * sizeof (dnode_handle_t));
	dnc = winner;
	}
	}

	ASSERT(dnc->dnc_count == epb);

	if (flag & DNODE_MUST_BE_ALLOCATED) {
	slots = 1;

	dnode_slots_hold(dnc, idx, slots);
	dnh = &dnc->dnc_children[idx];

	if (DN_SLOT_IS_PTR(dnh->dnh_dnode)) {
	dn = dnh->dnh_dnode;
	} else if (dnh->dnh_dnode == DN_SLOT_INTERIOR) {
	DNODE_STAT_BUMP(dnode_hold_alloc_interior);
	dnode_slots_rele(dnc, idx, slots);
	dbuf_rele(db, FTAG);
	return (SET_ERROR(EEXIST));
	} else if (dnh->dnh_dnode != DN_SLOT_ALLOCATED) {
	DNODE_STAT_BUMP(dnode_hold_alloc_misses);
	dnode_slots_rele(dnc, idx, slots);
	dbuf_rele(db, FTAG);
	return (SET_ERROR(ENOENT));
	} else {
	dnode_slots_rele(dnc, idx, slots);
	while (!dnode_slots_tryenter(dnc, idx, slots)) {
	DNODE_STAT_BUMP(dnode_hold_alloc_lock_retry);
	cond_resched();
	}

	/*
	* Someone else won the race and called dnode_create()
	* after we checked DN_SLOT_IS_PTR() above but before
	* we acquired the lock.
	*/
	if (DN_SLOT_IS_PTR(dnh->dnh_dnode)) {
	DNODE_STAT_BUMP(dnode_hold_alloc_lock_misses);
	dn = dnh->dnh_dnode;
	} else {
	dn = dnode_create(os, dn_block + idx, db,
	object, dnh);
	}
	}

	mutex_enter(&dn->dn_mtx);
	if (dn->dn_type == DMU_OT_NONE \|\| dn->dn_free_txg != 0) {
	DNODE_STAT_BUMP(dnode_hold_alloc_type_none);
	mutex_exit(&dn->dn_mtx);
	dnode_slots_rele(dnc, idx, slots);
	dbuf_rele(db, FTAG);
	return (SET_ERROR(ENOENT));
	}

	/* Don't actually hold if dry run, just return 0 */
	if (flag & DNODE_DRY_RUN) {
	mutex_exit(&dn->dn_mtx);
	dnode_slots_rele(dnc, idx, slots);
	dbuf_rele(db, FTAG);
	return (0);
	}

	DNODE_STAT_BUMP(dnode_hold_alloc_hits);
	} else if (flag & DNODE_MUST_BE_FREE) {

	if (idx + slots - 1 >= DNODES_PER_BLOCK) {
	DNODE_STAT_BUMP(dnode_hold_free_overflow);
	dbuf_rele(db, FTAG);
	return (SET_ERROR(ENOSPC));
	}

	dnode_slots_hold(dnc, idx, slots);

	if (!dnode_check_slots_free(dnc, idx, slots)) {
	DNODE_STAT_BUMP(dnode_hold_free_misses);
	dnode_slots_rele(dnc, idx, slots);
	dbuf_rele(db, FTAG);
	return (SET_ERROR(ENOSPC));
	}

	dnode_slots_rele(dnc, idx, slots);
	while (!dnode_slots_tryenter(dnc, idx, slots)) {
	DNODE_STAT_BUMP(dnode_hold_free_lock_retry);
	cond_resched();
	}

	if (!dnode_check_slots_free(dnc, idx, slots)) {
	DNODE_STAT_BUMP(dnode_hold_free_lock_misses);
	dnode_slots_rele(dnc, idx, slots);
	dbuf_rele(db, FTAG);
	return (SET_ERROR(ENOSPC));
	}

	/*
	* Allocated but otherwise free dnodes which would
	* be in the interior of a multi-slot dnodes need
	* to be freed. Single slot dnodes can be safely
	* re-purposed as a performance optimization.
	*/
	if (slots > 1)
	dnode_reclaim_slots(dnc, idx + 1, slots - 1);

	dnh = &dnc->dnc_children[idx];
	if (DN_SLOT_IS_PTR(dnh->dnh_dnode)) {
	dn = dnh->dnh_dnode;
	} else {
	dn = dnode_create(os, dn_block + idx, db,
	object, dnh);
	}

	mutex_enter(&dn->dn_mtx);
	if (!zfs_refcount_is_zero(&dn->dn_holds) \|\| dn->dn_free_txg) {
	DNODE_STAT_BUMP(dnode_hold_free_refcount);
	mutex_exit(&dn->dn_mtx);
	dnode_slots_rele(dnc, idx, slots);
	dbuf_rele(db, FTAG);
	return (SET_ERROR(EEXIST));
	}

	/* Don't actually hold if dry run, just return 0 */
	if (flag & DNODE_DRY_RUN) {
	mutex_exit(&dn->dn_mtx);
	dnode_slots_rele(dnc, idx, slots);
	dbuf_rele(db, FTAG);
	return (0);
	}

	dnode_set_slots(dnc, idx + 1, slots - 1, DN_SLOT_INTERIOR);
	DNODE_STAT_BUMP(dnode_hold_free_hits);
	} else {
	dbuf_rele(db, FTAG);
	return (SET_ERROR(EINVAL));
	}

	ASSERT0(dn->dn_free_txg);

	if (zfs_refcount_add(&dn->dn_holds, tag) == 1)
	dbuf_add_ref(db, dnh);

	mutex_exit(&dn->dn_mtx);

	/* Now we can rely on the hold to prevent the dnode from moving. */
	dnode_slots_rele(dnc, idx, slots);

	DNODE_VERIFY(dn);
	ASSERT3P(dnp, !=, NULL);
	ASSERT3P(dn->dn_dbuf, ==, db);
	ASSERT3U(dn->dn_object, ==, object);
	dbuf_rele(db, FTAG);

	*dnp = dn;
	return (0);
	}

	/*
	* Return held dnode if the object is allocated, NULL if not.
	*/
	int
	dnode_hold(objset_t os, uint64_t object, void tag, dnode_t **dnp)
	{
	return (dnode_hold_impl(os, object, DNODE_MUST_BE_ALLOCATED, 0, tag,
	dnp));
	}

	/*
	* Can only add a reference if there is already at least one
	* reference on the dnode. Returns FALSE if unable to add a
	* new reference.
	*/
	boolean_t
	dnode_add_ref(dnode_t dn, void tag)
	{
	mutex_enter(&dn->dn_mtx);
	if (zfs_refcount_is_zero(&dn->dn_holds)) {
	mutex_exit(&dn->dn_mtx);
	return (FALSE);
	}
	VERIFY(1 < zfs_refcount_add(&dn->dn_holds, tag));
	mutex_exit(&dn->dn_mtx);
	return (TRUE);
	}

	void
	dnode_rele(dnode_t dn, void tag)
	{
	mutex_enter(&dn->dn_mtx);
	dnode_rele_and_unlock(dn, tag, B_FALSE);
	}

	void
	dnode_rele_and_unlock(dnode_t dn, void tag, boolean_t evicting)
	{
	uint64_t refs;
	/* Get while the hold prevents the dnode from moving. */
	dmu_buf_impl_t *db = dn->dn_dbuf;
	dnode_handle_t *dnh = dn->dn_handle;

	refs = zfs_refcount_remove(&dn->dn_holds, tag);
	if (refs == 0)
	cv_broadcast(&dn->dn_nodnholds);
	mutex_exit(&dn->dn_mtx);
	/* dnode could get destroyed at this point, so don't use it anymore */

	/*
	* It's unsafe to release the last hold on a dnode by dnode_rele() or
	* indirectly by dbuf_rele() while relying on the dnode handle to
	* prevent the dnode from moving, since releasing the last hold could
	* result in the dnode's parent dbuf evicting its dnode handles. For
	* that reason anyone calling dnode_rele() or dbuf_rele() without some
	* other direct or indirect hold on the dnode must first drop the dnode
	* handle.
	*/
	ASSERT(refs > 0 \|\| dnh->dnh_zrlock.zr_owner != curthread);

	/* NOTE: the DNODE_DNODE does not have a dn_dbuf */
	if (refs == 0 && db != NULL) {
	/*
	* Another thread could add a hold to the dnode handle in
	* dnode_hold_impl() while holding the parent dbuf. Since the
	* hold on the parent dbuf prevents the handle from being
	* destroyed, the hold on the handle is OK. We can't yet assert
	* that the handle has zero references, but that will be
	* asserted anyway when the handle gets destroyed.
	*/
	mutex_enter(&db->db_mtx);
	dbuf_rele_and_unlock(db, dnh, evicting);
	}
	}

	/*
	* Test whether we can create a dnode at the specified location.
	*/
	int
	dnode_try_claim(objset_t *os, uint64_t object, int slots)
	{
	return (dnode_hold_impl(os, object, DNODE_MUST_BE_FREE \| DNODE_DRY_RUN,
	slots, NULL, NULL));
	}

	void
	dnode_setdirty(dnode_t dn, dmu_tx_t tx)
	{
	objset_t *os = dn->dn_objset;
	uint64_t txg = tx->tx_txg;

	if (DMU_OBJECT_IS_SPECIAL(dn->dn_object)) {
	dsl_dataset_dirty(os->os_dsl_dataset, tx);
	return;
	}

	DNODE_VERIFY(dn);

	#ifdef ZFS_DEBUG
	mutex_enter(&dn->dn_mtx);
	ASSERT(dn->dn_phys->dn_type \|\| dn->dn_allocated_txg);
	ASSERT(dn->dn_free_txg == 0 \|\| dn->dn_free_txg >= txg);
	mutex_exit(&dn->dn_mtx);
	#endif

	/*
	* Determine old uid/gid when necessary
	*/
	dmu_objset_userquota_get_ids(dn, B_TRUE, tx);

	multilist_t *dirtylist = os->os_dirty_dnodes[txg & TXG_MASK];
	multilist_sublist_t *mls = multilist_sublist_lock_obj(dirtylist, dn);

	/*
	* If we are already marked dirty, we're done.
	*/
	if (multilist_link_active(&dn->dn_dirty_link[txg & TXG_MASK])) {
	multilist_sublist_unlock(mls);
	return;
	}

	ASSERT(!zfs_refcount_is_zero(&dn->dn_holds) \|\|
	!avl_is_empty(&dn->dn_dbufs));
	ASSERT(dn->dn_datablksz != 0);
	ASSERT0(dn->dn_next_bonuslen[txg & TXG_MASK]);
	ASSERT0(dn->dn_next_blksz[txg & TXG_MASK]);
	ASSERT0(dn->dn_next_bonustype[txg & TXG_MASK]);

	dprintf_ds(os->os_dsl_dataset, "obj=%llu txg=%llu\n",
	dn->dn_object, txg);

	multilist_sublist_insert_head(mls, dn);

	multilist_sublist_unlock(mls);

	/*
	* The dnode maintains a hold on its containing dbuf as
	* long as there are holds on it. Each instantiated child
	* dbuf maintains a hold on the dnode. When the last child
	* drops its hold, the dnode will drop its hold on the
	* containing dbuf. We add a "dirty hold" here so that the
	* dnode will hang around after we finish processing its
	* children.
	*/
	VERIFY(dnode_add_ref(dn, (void *)(uintptr_t)tx->tx_txg));

	(void) dbuf_dirty(dn->dn_dbuf, tx);

	dsl_dataset_dirty(os->os_dsl_dataset, tx);
	}

	void
	dnode_free(dnode_t dn, dmu_tx_t tx)
	{
	mutex_enter(&dn->dn_mtx);
	if (dn->dn_type == DMU_OT_NONE \|\| dn->dn_free_txg) {
	mutex_exit(&dn->dn_mtx);
	return;
	}
	dn->dn_free_txg = tx->tx_txg;
	mutex_exit(&dn->dn_mtx);

	dnode_setdirty(dn, tx);
	}

	/*
	* Try to change the block size for the indicated dnode. This can only
	* succeed if there are no blocks allocated or dirty beyond first block
	*/
	int
	dnode_set_blksz(dnode_t dn, uint64_t size, int ibs, dmu_tx_t tx)
	{
	dmu_buf_impl_t *db;
	int err;

	ASSERT3U(size, <=, spa_maxblocksize(dmu_objset_spa(dn->dn_objset)));
	if (size == 0)
	size = SPA_MINBLOCKSIZE;
	else
	size = P2ROUNDUP(size, SPA_MINBLOCKSIZE);

	if (ibs == dn->dn_indblkshift)
	ibs = 0;

	if (size >> SPA_MINBLOCKSHIFT == dn->dn_datablkszsec && ibs == 0)
	return (0);

	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);

	/* Check for any allocated blocks beyond the first */
	if (dn->dn_maxblkid != 0)
	goto fail;

	mutex_enter(&dn->dn_dbufs_mtx);
	for (db = avl_first(&dn->dn_dbufs); db != NULL;
	db = AVL_NEXT(&dn->dn_dbufs, db)) {
	if (db->db_blkid != 0 && db->db_blkid != DMU_BONUS_BLKID &&
	db->db_blkid != DMU_SPILL_BLKID) {
	mutex_exit(&dn->dn_dbufs_mtx);
	goto fail;
	}
	}
	mutex_exit(&dn->dn_dbufs_mtx);

	if (ibs && dn->dn_nlevels != 1)
	goto fail;

	/* resize the old block */
	err = dbuf_hold_impl(dn, 0, 0, TRUE, FALSE, FTAG, &db);
	if (err == 0) {
	dbuf_new_size(db, size, tx);
	} else if (err != ENOENT) {
	goto fail;
	}

	dnode_setdblksz(dn, size);
	dnode_setdirty(dn, tx);
	dn->dn_next_blksz[tx->tx_txg&TXG_MASK] = size;
	if (ibs) {
	dn->dn_indblkshift = ibs;
	dn->dn_next_indblkshift[tx->tx_txg&TXG_MASK] = ibs;
	}
	/* release after we have fixed the blocksize in the dnode */
	if (db)
	dbuf_rele(db, FTAG);

	rw_exit(&dn->dn_struct_rwlock);
	return (0);

	fail:
	rw_exit(&dn->dn_struct_rwlock);
	return (SET_ERROR(ENOTSUP));
	}

	static void
	dnode_set_nlevels_impl(dnode_t dn, int new_nlevels, dmu_tx_t tx)
	{
	uint64_t txgoff = tx->tx_txg & TXG_MASK;
	int old_nlevels = dn->dn_nlevels;
	dmu_buf_impl_t *db;
	list_t *list;
	dbuf_dirty_record_t new, dr, *dr_next;

	ASSERT(RW_WRITE_HELD(&dn->dn_struct_rwlock));

	dn->dn_nlevels = new_nlevels;

	ASSERT3U(new_nlevels, >, dn->dn_next_nlevels[txgoff]);
	dn->dn_next_nlevels[txgoff] = new_nlevels;

	/* dirty the left indirects */
	db = dbuf_hold_level(dn, old_nlevels, 0, FTAG);
	ASSERT(db != NULL);
	new = dbuf_dirty(db, tx);
	dbuf_rele(db, FTAG);

	/* transfer the dirty records to the new indirect */
	mutex_enter(&dn->dn_mtx);
	mutex_enter(&new->dt.di.dr_mtx);
	list = &dn->dn_dirty_records[txgoff];
	for (dr = list_head(list); dr; dr = dr_next) {
	dr_next = list_next(&dn->dn_dirty_records[txgoff], dr);
	if (dr->dr_dbuf->db_level != new_nlevels-1 &&
	dr->dr_dbuf->db_blkid != DMU_BONUS_BLKID &&
	dr->dr_dbuf->db_blkid != DMU_SPILL_BLKID) {
	ASSERT(dr->dr_dbuf->db_level == old_nlevels-1);
	list_remove(&dn->dn_dirty_records[txgoff], dr);
	list_insert_tail(&new->dt.di.dr_children, dr);
	dr->dr_parent = new;
	}
	}
	mutex_exit(&new->dt.di.dr_mtx);
	mutex_exit(&dn->dn_mtx);
	}

	int
	dnode_set_nlevels(dnode_t dn, int nlevels, dmu_tx_t tx)
	{
	int ret = 0;

	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);

	if (dn->dn_nlevels == nlevels) {
	ret = 0;
	goto out;
	} else if (nlevels < dn->dn_nlevels) {
	ret = SET_ERROR(EINVAL);
	goto out;
	}

	dnode_set_nlevels_impl(dn, nlevels, tx);

	out:
	rw_exit(&dn->dn_struct_rwlock);
	return (ret);
	}

	/* read-holding callers must not rely on the lock being continuously held */
	void
	dnode_new_blkid(dnode_t dn, uint64_t blkid, dmu_tx_t tx, boolean_t have_read,
	boolean_t force)
	{
	int epbs, new_nlevels;
	uint64_t sz;

	ASSERT(blkid != DMU_BONUS_BLKID);

	ASSERT(have_read ?
	RW_READ_HELD(&dn->dn_struct_rwlock) :
	RW_WRITE_HELD(&dn->dn_struct_rwlock));

	/*
	* if we have a read-lock, check to see if we need to do any work
	* before upgrading to a write-lock.
	*/
	if (have_read) {
	if (blkid <= dn->dn_maxblkid)
	return;

	if (!rw_tryupgrade(&dn->dn_struct_rwlock)) {
	rw_exit(&dn->dn_struct_rwlock);
	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);
	}
	}

	/*
	* Raw sends (indicated by the force flag) require that we take the
	* given blkid even if the value is lower than the current value.
	*/
	if (!force && blkid <= dn->dn_maxblkid)
	goto out;

	/*
	* We use the (otherwise unused) top bit of dn_next_maxblkid[txgoff]
	* to indicate that this field is set. This allows us to set the
	* maxblkid to 0 on an existing object in dnode_sync().
	*/
	dn->dn_maxblkid = blkid;
	dn->dn_next_maxblkid[tx->tx_txg & TXG_MASK] =
	blkid \| DMU_NEXT_MAXBLKID_SET;

	/*
	* Compute the number of levels necessary to support the new maxblkid.
	* Raw sends will ensure nlevels is set correctly for us.
	*/
	new_nlevels = 1;
	epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;
	for (sz = dn->dn_nblkptr;
	sz <= blkid && sz >= dn->dn_nblkptr; sz <<= epbs)
	new_nlevels++;

	ASSERT3U(new_nlevels, <=, DN_MAX_LEVELS);

	if (!force) {
	if (new_nlevels > dn->dn_nlevels)
	dnode_set_nlevels_impl(dn, new_nlevels, tx);
	} else {
	ASSERT3U(dn->dn_nlevels, >=, new_nlevels);
	}

	out:
	if (have_read)
	rw_downgrade(&dn->dn_struct_rwlock);
	}

	static void
	dnode_dirty_l1(dnode_t dn, uint64_t l1blkid, dmu_tx_t tx)
	{
	dmu_buf_impl_t *db = dbuf_hold_level(dn, 1, l1blkid, FTAG);
	if (db != NULL) {
	dmu_buf_will_dirty(&db->db, tx);
	dbuf_rele(db, FTAG);
	}
	}

	/*
	* Dirty all the in-core level-1 dbufs in the range specified by start_blkid
	* and end_blkid.
	*/
	static void
	dnode_dirty_l1range(dnode_t *dn, uint64_t start_blkid, uint64_t end_blkid,
	dmu_tx_t *tx)
	{
	- dmu_buf_impl_t db_search;
	+ dmu_buf_impl_t *db_search;
	dmu_buf_impl_t *db;
	avl_index_t where;

	+ db_search = kmem_zalloc(sizeof (dmu_buf_impl_t), KM_SLEEP);
	+
	mutex_enter(&dn->dn_dbufs_mtx);

	- db_search.db_level = 1;
	- db_search.db_blkid = start_blkid + 1;
	- db_search.db_state = DB_SEARCH;
	+ db_search->db_level = 1;
	+ db_search->db_blkid = start_blkid + 1;
	+ db_search->db_state = DB_SEARCH;
	for (;;) {

	- db = avl_find(&dn->dn_dbufs, &db_search, &where);
	+ db = avl_find(&dn->dn_dbufs, db_search, &where);
	if (db == NULL)
	db = avl_nearest(&dn->dn_dbufs, where, AVL_AFTER);

	if (db == NULL \|\| db->db_level != 1 \|\|
	db->db_blkid >= end_blkid) {
	break;
	}

	/*
	* Setup the next blkid we want to search for.
	*/
	- db_search.db_blkid = db->db_blkid + 1;
	+ db_search->db_blkid = db->db_blkid + 1;
	ASSERT3U(db->db_blkid, >=, start_blkid);

	/*
	* If the dbuf transitions to DB_EVICTING while we're trying
	* to dirty it, then we will be unable to discover it in
	* the dbuf hash table. This will result in a call to
	* dbuf_create() which needs to acquire the dn_dbufs_mtx
	* lock. To avoid a deadlock, we drop the lock before
	* dirtying the level-1 dbuf.
	*/
	mutex_exit(&dn->dn_dbufs_mtx);
	dnode_dirty_l1(dn, db->db_blkid, tx);
	mutex_enter(&dn->dn_dbufs_mtx);
	}

	#ifdef ZFS_DEBUG
	/*
	* Walk all the in-core level-1 dbufs and verify they have been dirtied.
	*/
	- db_search.db_level = 1;
	- db_search.db_blkid = start_blkid + 1;
	- db_search.db_state = DB_SEARCH;
	- db = avl_find(&dn->dn_dbufs, &db_search, &where);
	+ db_search->db_level = 1;
	+ db_search->db_blkid = start_blkid + 1;
	+ db_search->db_state = DB_SEARCH;
	+ db = avl_find(&dn->dn_dbufs, db_search, &where);
	if (db == NULL)
	db = avl_nearest(&dn->dn_dbufs, where, AVL_AFTER);
	for (; db != NULL; db = AVL_NEXT(&dn->dn_dbufs, db)) {
	if (db->db_level != 1 \|\| db->db_blkid >= end_blkid)
	break;
	if (db->db_state != DB_EVICTING)
	ASSERT(db->db_dirtycnt > 0);
	}
	#endif
	+ kmem_free(db_search, sizeof (dmu_buf_impl_t));
	mutex_exit(&dn->dn_dbufs_mtx);
	}

	void
	dnode_set_dirtyctx(dnode_t dn, dmu_tx_t tx, void *tag)
	{
	/*
	* Don't set dirtyctx to SYNC if we're just modifying this as we
	* initialize the objset.
	*/
	if (dn->dn_dirtyctx == DN_UNDIRTIED) {
	dsl_dataset_t *ds = dn->dn_objset->os_dsl_dataset;

	if (ds != NULL) {
	rrw_enter(&ds->ds_bp_rwlock, RW_READER, tag);
	}
	if (!BP_IS_HOLE(dn->dn_objset->os_rootbp)) {
	if (dmu_tx_is_syncing(tx))
	dn->dn_dirtyctx = DN_DIRTY_SYNC;
	else
	dn->dn_dirtyctx = DN_DIRTY_OPEN;
	dn->dn_dirtyctx_firstset = tag;
	}
	if (ds != NULL) {
	rrw_exit(&ds->ds_bp_rwlock, tag);
	}
	}
	}

	void
	dnode_free_range(dnode_t dn, uint64_t off, uint64_t len, dmu_tx_t tx)
	{
	dmu_buf_impl_t *db;
	uint64_t blkoff, blkid, nblks;
	int blksz, blkshift, head, tail;
	int trunc = FALSE;
	int epbs;

	blksz = dn->dn_datablksz;
	blkshift = dn->dn_datablkshift;
	epbs = dn->dn_indblkshift - SPA_BLKPTRSHIFT;

	if (len == DMU_OBJECT_END) {
	len = UINT64_MAX - off;
	trunc = TRUE;
	}

	/*
	* First, block align the region to free:
	*/
	if (ISP2(blksz)) {
	head = P2NPHASE(off, blksz);
	blkoff = P2PHASE(off, blksz);
	if ((off >> blkshift) > dn->dn_maxblkid)
	return;
	} else {
	ASSERT(dn->dn_maxblkid == 0);
	if (off == 0 && len >= blksz) {
	/*
	* Freeing the whole block; fast-track this request.
	*/
	blkid = 0;
	nblks = 1;
	if (dn->dn_nlevels > 1) {
	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);
	dnode_dirty_l1(dn, 0, tx);
	rw_exit(&dn->dn_struct_rwlock);
	}
	goto done;
	} else if (off >= blksz) {
	/* Freeing past end-of-data */
	return;
	} else {
	/* Freeing part of the block. */
	head = blksz - off;
	ASSERT3U(head, >, 0);
	}
	blkoff = off;
	}
	/* zero out any partial block data at the start of the range */
	if (head) {
	int res;
	ASSERT3U(blkoff + head, ==, blksz);
	if (len < head)
	head = len;
	rw_enter(&dn->dn_struct_rwlock, RW_READER);
	res = dbuf_hold_impl(dn, 0, dbuf_whichblock(dn, 0, off),
	TRUE, FALSE, FTAG, &db);
	rw_exit(&dn->dn_struct_rwlock);
	if (res == 0) {
	caddr_t data;
	boolean_t dirty;

	db_lock_type_t dblt = dmu_buf_lock_parent(db, RW_READER,
	FTAG);
	/* don't dirty if it isn't on disk and isn't dirty */
	dirty = !list_is_empty(&db->db_dirty_records) \|\|
	(db->db_blkptr && !BP_IS_HOLE(db->db_blkptr));
	dmu_buf_unlock_parent(db, dblt, FTAG);
	if (dirty) {
	dmu_buf_will_dirty(&db->db, tx);
	data = db->db.db_data;
	bzero(data + blkoff, head);
	}
	dbuf_rele(db, FTAG);
	}
	off += head;
	len -= head;
	}

	/* If the range was less than one block, we're done */
	if (len == 0)
	return;

	/* If the remaining range is past end of file, we're done */
	if ((off >> blkshift) > dn->dn_maxblkid)
	return;

	ASSERT(ISP2(blksz));
	if (trunc)
	tail = 0;
	else
	tail = P2PHASE(len, blksz);

	ASSERT0(P2PHASE(off, blksz));
	/* zero out any partial block data at the end of the range */
	if (tail) {
	int res;
	if (len < tail)
	tail = len;
	rw_enter(&dn->dn_struct_rwlock, RW_READER);
	res = dbuf_hold_impl(dn, 0, dbuf_whichblock(dn, 0, off+len),
	TRUE, FALSE, FTAG, &db);
	rw_exit(&dn->dn_struct_rwlock);
	if (res == 0) {
	boolean_t dirty;
	/* don't dirty if not on disk and not dirty */
	db_lock_type_t type = dmu_buf_lock_parent(db, RW_READER,
	FTAG);
	dirty = !list_is_empty(&db->db_dirty_records) \|\|
	(db->db_blkptr && !BP_IS_HOLE(db->db_blkptr));
	dmu_buf_unlock_parent(db, type, FTAG);
	if (dirty) {
	dmu_buf_will_dirty(&db->db, tx);
	bzero(db->db.db_data, tail);
	}
	dbuf_rele(db, FTAG);
	}
	len -= tail;
	}

	/* If the range did not include a full block, we are done */
	if (len == 0)
	return;

	ASSERT(IS_P2ALIGNED(off, blksz));
	ASSERT(trunc \|\| IS_P2ALIGNED(len, blksz));
	blkid = off >> blkshift;
	nblks = len >> blkshift;
	if (trunc)
	nblks += 1;

	/*
	* Dirty all the indirect blocks in this range. Note that only
	* the first and last indirect blocks can actually be written
	* (if they were partially freed) -- they must be dirtied, even if
	* they do not exist on disk yet. The interior blocks will
	* be freed by free_children(), so they will not actually be written.
	* Even though these interior blocks will not be written, we
	* dirty them for two reasons:
	*
	* - It ensures that the indirect blocks remain in memory until
	* syncing context. (They have already been prefetched by
	* dmu_tx_hold_free(), so we don't have to worry about reading
	* them serially here.)
	*
	* - The dirty space accounting will put pressure on the txg sync
	* mechanism to begin syncing, and to delay transactions if there
	* is a large amount of freeing. Even though these indirect
	* blocks will not be written, we could need to write the same
	* amount of space if we copy the freed BPs into deadlists.
	*/
	if (dn->dn_nlevels > 1) {
	rw_enter(&dn->dn_struct_rwlock, RW_WRITER);
	uint64_t first, last;

	first = blkid >> epbs;
	dnode_dirty_l1(dn, first, tx);
	if (trunc)
	last = dn->dn_maxblkid >> epbs;
	else
	last = (blkid + nblks - 1) >> epbs;
	if (last != first)
	dnode_dirty_l1(dn, last, tx);

	dnode_dirty_l1range(dn, first, last, tx);

	int shift = dn->dn_datablkshift + dn->dn_indblkshift -
	SPA_BLKPTRSHIFT;
	for (uint64_t i = first + 1; i < last; i++) {
	/*
	* Set i to the blockid of the next non-hole
	* level-1 indirect block at or after i. Note
	* that dnode_next_offset() operates in terms of
	* level-0-equivalent bytes.
	*/
	uint64_t ibyte = i << shift;
	int err = dnode_next_offset(dn, DNODE_FIND_HAVELOCK,
	&ibyte, 2, 1, 0);
	i = ibyte >> shift;
	if (i >= last)
	break;

	/*
	* Normally we should not see an error, either
	* from dnode_next_offset() or dbuf_hold_level()
	* (except for ESRCH from dnode_next_offset).
	* If there is an i/o error, then when we read
	* this block in syncing context, it will use
	* ZIO_FLAG_MUSTSUCCEED, and thus hang/panic according
	* to the "failmode" property. dnode_next_offset()
	* doesn't have a flag to indicate MUSTSUCCEED.
	*/
	if (err != 0)
	break;

	dnode_dirty_l1(dn, i, tx);
	}
	rw_exit(&dn->dn_struct_rwlock);
	}

	done:
	/*
	* Add this range to the dnode range list.
	* We will finish up this free operation in the syncing phase.
	*/
	mutex_enter(&dn->dn_mtx);
	{
	int txgoff = tx->tx_txg & TXG_MASK;
	if (dn->dn_free_ranges[txgoff] == NULL) {
	dn->dn_free_ranges[txgoff] = range_tree_create(NULL,
	RANGE_SEG64, NULL, 0, 0);
	}
	range_tree_clear(dn->dn_free_ranges[txgoff], blkid, nblks);
	range_tree_add(dn->dn_free_ranges[txgoff], blkid, nblks);
	}
	dprintf_dnode(dn, "blkid=%llu nblks=%llu txg=%llu\n",
	blkid, nblks, tx->tx_txg);
	mutex_exit(&dn->dn_mtx);

	dbuf_free_range(dn, blkid, blkid + nblks - 1, tx);
	dnode_setdirty(dn, tx);
	}

	static boolean_t
	dnode_spill_freed(dnode_t *dn)
	{
	int i;

	mutex_enter(&dn->dn_mtx);
	for (i = 0; i < TXG_SIZE; i++) {
	if (dn->dn_rm_spillblk[i] == DN_KILL_SPILLBLK)
	break;
	}
	mutex_exit(&dn->dn_mtx);
	return (i < TXG_SIZE);
	}

	/* return TRUE if this blkid was freed in a recent txg, or FALSE if it wasn't */
	uint64_t
	dnode_block_freed(dnode_t *dn, uint64_t blkid)
	{
	void *dp = spa_get_dsl(dn->dn_objset->os_spa);
	int i;

	if (blkid == DMU_BONUS_BLKID)
	return (FALSE);

	/*
	* If we're in the process of opening the pool, dp will not be
	* set yet, but there shouldn't be anything dirty.
	*/
	if (dp == NULL)
	return (FALSE);

	if (dn->dn_free_txg)
	return (TRUE);

	if (blkid == DMU_SPILL_BLKID)
	return (dnode_spill_freed(dn));

	mutex_enter(&dn->dn_mtx);
	for (i = 0; i < TXG_SIZE; i++) {
	if (dn->dn_free_ranges[i] != NULL &&
	range_tree_contains(dn->dn_free_ranges[i], blkid, 1))
	break;
	}
	mutex_exit(&dn->dn_mtx);
	return (i < TXG_SIZE);
	}

	/* call from syncing context when we actually write/free space for this dnode */
	void
	dnode_diduse_space(dnode_t *dn, int64_t delta)
	{
	uint64_t space;
	dprintf_dnode(dn, "dn=%p dnp=%p used=%llu delta=%lld\n",
	dn, dn->dn_phys,
	(u_longlong_t)dn->dn_phys->dn_used,
	(longlong_t)delta);

	mutex_enter(&dn->dn_mtx);
	space = DN_USED_BYTES(dn->dn_phys);
	if (delta > 0) {
	ASSERT3U(space + delta, >=, space); /* no overflow */
	} else {
	ASSERT3U(space, >=, -delta); /* no underflow */
	}
	space += delta;
	if (spa_version(dn->dn_objset->os_spa) < SPA_VERSION_DNODE_BYTES) {
	ASSERT((dn->dn_phys->dn_flags & DNODE_FLAG_USED_BYTES) == 0);
	ASSERT0(P2PHASE(space, 1<<DEV_BSHIFT));
	dn->dn_phys->dn_used = space >> DEV_BSHIFT;
	} else {
	dn->dn_phys->dn_used = space;
	dn->dn_phys->dn_flags \|= DNODE_FLAG_USED_BYTES;
	}
	mutex_exit(&dn->dn_mtx);
	}

	/*
	* Scans a block at the indicated "level" looking for a hole or data,
	* depending on 'flags'.
	*
	* If level > 0, then we are scanning an indirect block looking at its
	* pointers. If level == 0, then we are looking at a block of dnodes.
	*
	* If we don't find what we are looking for in the block, we return ESRCH.
	* Otherwise, return with *offset pointing to the beginning (if searching
	* forwards) or end (if searching backwards) of the range covered by the
	* block pointer we matched on (or dnode).
	*
	* The basic search algorithm used below by dnode_next_offset() is to
	* use this function to search up the block tree (widen the search) until
	* we find something (i.e., we don't return ESRCH) and then search back
	* down the tree (narrow the search) until we reach our original search
	* level.
	*/
	static int
	dnode_next_offset_level(dnode_t dn, int flags, uint64_t offset,
	int lvl, uint64_t blkfill, uint64_t txg)
	{
	dmu_buf_impl_t *db = NULL;
	void *data = NULL;
	uint64_t epbs = dn->dn_phys->dn_indblkshift - SPA_BLKPTRSHIFT;
	uint64_t epb = 1ULL << epbs;
	uint64_t minfill, maxfill;
	boolean_t hole;
	int i, inc, error, span;

	ASSERT(RW_LOCK_HELD(&dn->dn_struct_rwlock));

	hole = ((flags & DNODE_FIND_HOLE) != 0);
	inc = (flags & DNODE_FIND_BACKWARDS) ? -1 : 1;
	ASSERT(txg == 0 \|\| !hole);

	if (lvl == dn->dn_phys->dn_nlevels) {
	error = 0;
	epb = dn->dn_phys->dn_nblkptr;
	data = dn->dn_phys->dn_blkptr;
	} else {
	uint64_t blkid = dbuf_whichblock(dn, lvl, *offset);
	error = dbuf_hold_impl(dn, lvl, blkid, TRUE, FALSE, FTAG, &db);
	if (error) {
	if (error != ENOENT)
	return (error);
	if (hole)
	return (0);
	/*
	* This can only happen when we are searching up
	* the block tree for data. We don't really need to
	* adjust the offset, as we will just end up looking
	* at the pointer to this block in its parent, and its
	* going to be unallocated, so we will skip over it.
	*/
	return (SET_ERROR(ESRCH));
	}
	error = dbuf_read(db, NULL,
	DB_RF_CANFAIL \| DB_RF_HAVESTRUCT \| DB_RF_NO_DECRYPT);
	if (error) {
	dbuf_rele(db, FTAG);
	return (error);
	}
	data = db->db.db_data;
	rw_enter(&db->db_rwlock, RW_READER);
	}

	if (db != NULL && txg != 0 && (db->db_blkptr == NULL \|\|
	db->db_blkptr->blk_birth <= txg \|\|
	BP_IS_HOLE(db->db_blkptr))) {
	/*
	* This can only happen when we are searching up the tree
	* and these conditions mean that we need to keep climbing.
	*/
	error = SET_ERROR(ESRCH);
	} else if (lvl == 0) {
	dnode_phys_t *dnp = data;

	ASSERT(dn->dn_type == DMU_OT_DNODE);
	ASSERT(!(flags & DNODE_FIND_BACKWARDS));

	for (i = (*offset >> DNODE_SHIFT) & (blkfill - 1);
	i < blkfill; i += dnp[i].dn_extra_slots + 1) {
	if ((dnp[i].dn_type == DMU_OT_NONE) == hole)
	break;
	}

	if (i == blkfill)
	error = SET_ERROR(ESRCH);

	offset = (offset & ~(DNODE_BLOCK_SIZE - 1)) +
	(i << DNODE_SHIFT);
	} else {
	blkptr_t *bp = data;
	uint64_t start = *offset;
	span = (lvl - 1) * epbs + dn->dn_datablkshift;
	minfill = 0;
	maxfill = blkfill << ((lvl - 1) * epbs);

	if (hole)
	maxfill--;
	else
	minfill++;

	if (span >= 8 * sizeof (*offset)) {
	/* This only happens on the highest indirection level */
	ASSERT3U((lvl - 1), ==, dn->dn_phys->dn_nlevels - 1);
	*offset = 0;
	} else {
	offset = offset >> span;
	}

	for (i = BF64_GET(*offset, 0, epbs);
	i >= 0 && i < epb; i += inc) {
	if (BP_GET_FILL(&bp[i]) >= minfill &&
	BP_GET_FILL(&bp[i]) <= maxfill &&
	(hole \|\| bp[i].blk_birth > txg))
	break;
	if (inc > 0 \|\| *offset > 0)
	*offset += inc;
	}

	if (span >= 8 * sizeof (*offset)) {
	*offset = start;
	} else {
	offset = offset << span;
	}

	if (inc < 0) {
	/* traversing backwards; position offset at the end */
	ASSERT3U(*offset, <=, start);
	offset = MIN(offset + (1ULL << span) - 1, start);
	} else if (*offset < start) {
	*offset = start;
	}
	if (i < 0 \|\| i >= epb)
	error = SET_ERROR(ESRCH);
	}

	if (db != NULL) {
	rw_exit(&db->db_rwlock);
	dbuf_rele(db, FTAG);
	}

	return (error);
	}

	/*
	* Find the next hole, data, or sparse region at or after *offset.
	* The value 'blkfill' tells us how many items we expect to find
	* in an L0 data block; this value is 1 for normal objects,
	* DNODES_PER_BLOCK for the meta dnode, and some fraction of
	* DNODES_PER_BLOCK when searching for sparse regions thereof.
	*
	* Examples:
	*
	* dnode_next_offset(dn, flags, offset, 1, 1, 0);
	* Finds the next/previous hole/data in a file.
	* Used in dmu_offset_next().
	*
	* dnode_next_offset(mdn, flags, offset, 0, DNODES_PER_BLOCK, txg);
	* Finds the next free/allocated dnode an objset's meta-dnode.
	* Only finds objects that have new contents since txg (ie.
	* bonus buffer changes and content removal are ignored).
	* Used in dmu_object_next().
	*
	* dnode_next_offset(mdn, DNODE_FIND_HOLE, offset, 2, DNODES_PER_BLOCK >> 2, 0);
	* Finds the next L2 meta-dnode bp that's at most 1/4 full.
	* Used in dmu_object_alloc().
	*/
	int
	dnode_next_offset(dnode_t dn, int flags, uint64_t offset,
	int minlvl, uint64_t blkfill, uint64_t txg)
	{
	uint64_t initial_offset = *offset;
	int lvl, maxlvl;
	int error = 0;

	if (!(flags & DNODE_FIND_HAVELOCK))
	rw_enter(&dn->dn_struct_rwlock, RW_READER);

	if (dn->dn_phys->dn_nlevels == 0) {
	error = SET_ERROR(ESRCH);
	goto out;
	}

	if (dn->dn_datablkshift == 0) {
	if (*offset < dn->dn_datablksz) {
	if (flags & DNODE_FIND_HOLE)
	*offset = dn->dn_datablksz;
	} else {
	error = SET_ERROR(ESRCH);
	}
	goto out;
	}

	maxlvl = dn->dn_phys->dn_nlevels;

	for (lvl = minlvl; lvl <= maxlvl; lvl++) {
	error = dnode_next_offset_level(dn,
	flags, offset, lvl, blkfill, txg);
	if (error != ESRCH)
	break;
	}

	while (error == 0 && --lvl >= minlvl) {
	error = dnode_next_offset_level(dn,
	flags, offset, lvl, blkfill, txg);
	}

	/*
	* There's always a "virtual hole" at the end of the object, even
	* if all BP's which physically exist are non-holes.
	*/
	if ((flags & DNODE_FIND_HOLE) && error == ESRCH && txg == 0 &&
	minlvl == 1 && blkfill == 1 && !(flags & DNODE_FIND_BACKWARDS)) {
	error = 0;
	}

	if (error == 0 && (flags & DNODE_FIND_BACKWARDS ?
	initial_offset < offset : initial_offset > offset))
	error = SET_ERROR(ESRCH);
	out:
	if (!(flags & DNODE_FIND_HAVELOCK))
	rw_exit(&dn->dn_struct_rwlock);

	return (error);
	}

	#if defined(_KERNEL)
	EXPORT_SYMBOL(dnode_hold);
	EXPORT_SYMBOL(dnode_rele);
	EXPORT_SYMBOL(dnode_set_nlevels);
	EXPORT_SYMBOL(dnode_set_blksz);
	EXPORT_SYMBOL(dnode_free_range);
	EXPORT_SYMBOL(dnode_evict_dbufs);
	EXPORT_SYMBOL(dnode_evict_bonus);
	#endif
	Index: vendor-sys/openzfs/dist/module/zfs/dsl_scan.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/dsl_scan.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/dsl_scan.c (revision 365892)
	@@ -1,4426 +1,4427 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2018 by Delphix. All rights reserved.
	* Copyright 2016 Gary Mills
	* Copyright (c) 2017, 2019, Datto Inc. All rights reserved.
	+ * Copyright (c) 2015, Nexenta Systems, Inc. All rights reserved.
	* Copyright 2019 Joyent, Inc.
	*/

	#include <sys/dsl_scan.h>
	#include <sys/dsl_pool.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_prop.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_synctask.h>
	#include <sys/dnode.h>
	#include <sys/dmu_tx.h>
	#include <sys/dmu_objset.h>
	#include <sys/arc.h>
	#include <sys/zap.h>
	#include <sys/zio.h>
	#include <sys/zfs_context.h>
	#include <sys/fs/zfs.h>
	#include <sys/zfs_znode.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev_impl.h>
	#include <sys/zil_impl.h>
	#include <sys/zio_checksum.h>
	#include <sys/ddt.h>
	#include <sys/sa.h>
	#include <sys/sa_impl.h>
	#include <sys/zfeature.h>
	#include <sys/abd.h>
	#include <sys/range_tree.h>
	#ifdef _KERNEL
	#include <sys/zfs_vfsops.h>
	#endif

	/*
	* Grand theory statement on scan queue sorting
	*
	* Scanning is implemented by recursively traversing all indirection levels
	* in an object and reading all blocks referenced from said objects. This
	* results in us approximately traversing the object from lowest logical
	* offset to the highest. For best performance, we would want the logical
	* blocks to be physically contiguous. However, this is frequently not the
	* case with pools given the allocation patterns of copy-on-write filesystems.
	* So instead, we put the I/Os into a reordering queue and issue them in a
	* way that will most benefit physical disks (LBA-order).
	*
	* Queue management:
	*
	* Ideally, we would want to scan all metadata and queue up all block I/O
	* prior to starting to issue it, because that allows us to do an optimal
	* sorting job. This can however consume large amounts of memory. Therefore
	* we continuously monitor the size of the queues and constrain them to 5%
	* (zfs_scan_mem_lim_fact) of physmem. If the queues grow larger than this
	* limit, we clear out a few of the largest extents at the head of the queues
	* to make room for more scanning. Hopefully, these extents will be fairly
	* large and contiguous, allowing us to approach sequential I/O throughput
	* even without a fully sorted tree.
	*
	* Metadata scanning takes place in dsl_scan_visit(), which is called from
	* dsl_scan_sync() every spa_sync(). If we have either fully scanned all
	* metadata on the pool, or we need to make room in memory because our
	* queues are too large, dsl_scan_visit() is postponed and
	* scan_io_queues_run() is called from dsl_scan_sync() instead. This implies
	* that metadata scanning and queued I/O issuing are mutually exclusive. This
	* allows us to provide maximum sequential I/O throughput for the majority of
	* I/O's issued since sequential I/O performance is significantly negatively
	* impacted if it is interleaved with random I/O.
	*
	* Implementation Notes
	*
	* One side effect of the queued scanning algorithm is that the scanning code
	* needs to be notified whenever a block is freed. This is needed to allow
	* the scanning code to remove these I/Os from the issuing queue. Additionally,
	* we do not attempt to queue gang blocks to be issued sequentially since this
	* is very hard to do and would have an extremely limited performance benefit.
	* Instead, we simply issue gang I/Os as soon as we find them using the legacy
	* algorithm.
	*
	* Backwards compatibility
	*
	* This new algorithm is backwards compatible with the legacy on-disk data
	* structures (and therefore does not require a new feature flag).
	* Periodically during scanning (see zfs_scan_checkpoint_intval), the scan
	* will stop scanning metadata (in logical order) and wait for all outstanding
	* sorted I/O to complete. Once this is done, we write out a checkpoint
	* bookmark, indicating that we have scanned everything logically before it.
	* If the pool is imported on a machine without the new sorting algorithm,
	* the scan simply resumes from the last checkpoint using the legacy algorithm.
	*/

	typedef int (scan_cb_t)(dsl_pool_t , const blkptr_t ,
	const zbookmark_phys_t *);

	static scan_cb_t dsl_scan_scrub_cb;

	static int scan_ds_queue_compare(const void a, const void b);
	static int scan_prefetch_queue_compare(const void a, const void b);
	static void scan_ds_queue_clear(dsl_scan_t *scn);
	static void scan_ds_prefetch_queue_clear(dsl_scan_t *scn);
	static boolean_t scan_ds_queue_contains(dsl_scan_t *scn, uint64_t dsobj,
	uint64_t *txg);
	static void scan_ds_queue_insert(dsl_scan_t *scn, uint64_t dsobj, uint64_t txg);
	static void scan_ds_queue_remove(dsl_scan_t *scn, uint64_t dsobj);
	static void scan_ds_queue_sync(dsl_scan_t scn, dmu_tx_t tx);
	static uint64_t dsl_scan_count_leaves(vdev_t *vd);

	extern int zfs_vdev_async_write_active_min_dirty_percent;

	/*
	* By default zfs will check to ensure it is not over the hard memory
	* limit before each txg. If finer-grained control of this is needed
	* this value can be set to 1 to enable checking before scanning each
	* block.
	*/
	int zfs_scan_strict_mem_lim = B_FALSE;

	/*
	* Maximum number of parallelly executed bytes per leaf vdev. We attempt
	* to strike a balance here between keeping the vdev queues full of I/Os
	* at all times and not overflowing the queues to cause long latency,
	* which would cause long txg sync times. No matter what, we will not
	* overload the drives with I/O, since that is protected by
	* zfs_vdev_scrub_max_active.
	*/
	unsigned long zfs_scan_vdev_limit = 4 << 20;

	int zfs_scan_issue_strategy = 0;
	int zfs_scan_legacy = B_FALSE; /* don't queue & sort zios, go direct */
	unsigned long zfs_scan_max_ext_gap = 2 << 20; /* in bytes */

	/*
	* fill_weight is non-tunable at runtime, so we copy it at module init from
	* zfs_scan_fill_weight. Runtime adjustments to zfs_scan_fill_weight would
	* break queue sorting.
	*/
	int zfs_scan_fill_weight = 3;
	static uint64_t fill_weight;

	/* See dsl_scan_should_clear() for details on the memory limit tunables */
	uint64_t zfs_scan_mem_lim_min = 16 << 20; /* bytes */
	uint64_t zfs_scan_mem_lim_soft_max = 128 << 20; /* bytes */
	int zfs_scan_mem_lim_fact = 20; /* fraction of physmem */
	int zfs_scan_mem_lim_soft_fact = 20; /* fraction of mem lim above */

	int zfs_scrub_min_time_ms = 1000; /* min millisecs to scrub per txg */
	int zfs_obsolete_min_time_ms = 500; /* min millisecs to obsolete per txg */
	int zfs_free_min_time_ms = 1000; /* min millisecs to free per txg */
	int zfs_resilver_min_time_ms = 3000; /* min millisecs to resilver per txg */
	int zfs_scan_checkpoint_intval = 7200; /* in seconds */
	int zfs_scan_suspend_progress = 0; /* set to prevent scans from progressing */
	int zfs_no_scrub_io = B_FALSE; /* set to disable scrub i/o */
	int zfs_no_scrub_prefetch = B_FALSE; /* set to disable scrub prefetch */
	enum ddt_class zfs_scrub_ddt_class_max = DDT_CLASS_DUPLICATE;
	/* max number of blocks to free in a single TXG */
	unsigned long zfs_async_block_max_blocks = ULONG_MAX;
	/* max number of dedup blocks to free in a single TXG */
	unsigned long zfs_max_async_dedup_frees = 100000;

	int zfs_resilver_disable_defer = 0; /* set to disable resilver deferring */

	/*
	* We wait a few txgs after importing a pool to begin scanning so that
	* the import / mounting code isn't held up by scrub / resilver IO.
	* Unfortunately, it is a bit difficult to determine exactly how long
	* this will take since userspace will trigger fs mounts asynchronously
	* and the kernel will create zvol minors asynchronously. As a result,
	* the value provided here is a bit arbitrary, but represents a
	* reasonable estimate of how many txgs it will take to finish fully
	* importing a pool
	*/
	#define SCAN_IMPORT_WAIT_TXGS 5

	#define DSL_SCAN_IS_SCRUB_RESILVER(scn) \
	((scn)->scn_phys.scn_func == POOL_SCAN_SCRUB \|\| \
	(scn)->scn_phys.scn_func == POOL_SCAN_RESILVER)

	/*
	* Enable/disable the processing of the free_bpobj object.
	*/
	int zfs_free_bpobj_enabled = 1;

	/* the order has to match pool_scan_type */
	static scan_cb_t *scan_funcs[POOL_SCAN_FUNCS] = {
	NULL,
	dsl_scan_scrub_cb, /* POOL_SCAN_SCRUB */
	dsl_scan_scrub_cb, /* POOL_SCAN_RESILVER */
	};

	/* In core node for the scn->scn_queue. Represents a dataset to be scanned */
	typedef struct {
	uint64_t sds_dsobj;
	uint64_t sds_txg;
	avl_node_t sds_node;
	} scan_ds_t;

	/*
	* This controls what conditions are placed on dsl_scan_sync_state():
	* SYNC_OPTIONAL) write out scn_phys iff scn_bytes_pending == 0
	* SYNC_MANDATORY) write out scn_phys always. scn_bytes_pending must be 0.
	* SYNC_CACHED) if scn_bytes_pending == 0, write out scn_phys. Otherwise
	* write out the scn_phys_cached version.
	* See dsl_scan_sync_state for details.
	*/
	typedef enum {
	SYNC_OPTIONAL,
	SYNC_MANDATORY,
	SYNC_CACHED
	} state_sync_type_t;

	/*
	* This struct represents the minimum information needed to reconstruct a
	* zio for sequential scanning. This is useful because many of these will
	* accumulate in the sequential IO queues before being issued, so saving
	* memory matters here.
	*/
	typedef struct scan_io {
	/* fields from blkptr_t */
	uint64_t sio_blk_prop;
	uint64_t sio_phys_birth;
	uint64_t sio_birth;
	zio_cksum_t sio_cksum;
	uint32_t sio_nr_dvas;

	/* fields from zio_t */
	uint32_t sio_flags;
	zbookmark_phys_t sio_zb;

	/* members for queue sorting */
	union {
	avl_node_t sio_addr_node; /* link into issuing queue */
	list_node_t sio_list_node; /* link for issuing to disk */
	} sio_nodes;

	/*
	* There may be up to SPA_DVAS_PER_BP DVAs here from the bp,
	* depending on how many were in the original bp. Only the
	* first DVA is really used for sorting and issuing purposes.
	* The other DVAs (if provided) simply exist so that the zio
	* layer can find additional copies to repair from in the
	* event of an error. This array must go at the end of the
	* struct to allow this for the variable number of elements.
	*/
	dva_t sio_dva[0];
	} scan_io_t;

	#define SIO_SET_OFFSET(sio, x) DVA_SET_OFFSET(&(sio)->sio_dva[0], x)
	#define SIO_SET_ASIZE(sio, x) DVA_SET_ASIZE(&(sio)->sio_dva[0], x)
	#define SIO_GET_OFFSET(sio) DVA_GET_OFFSET(&(sio)->sio_dva[0])
	#define SIO_GET_ASIZE(sio) DVA_GET_ASIZE(&(sio)->sio_dva[0])
	#define SIO_GET_END_OFFSET(sio) \
	(SIO_GET_OFFSET(sio) + SIO_GET_ASIZE(sio))
	#define SIO_GET_MUSED(sio) \
	(sizeof (scan_io_t) + ((sio)->sio_nr_dvas * sizeof (dva_t)))

	struct dsl_scan_io_queue {
	dsl_scan_t q_scn; / associated dsl_scan_t */
	vdev_t q_vd; / top-level vdev that this queue represents */

	/* trees used for sorting I/Os and extents of I/Os */
	range_tree_t *q_exts_by_addr;
	zfs_btree_t q_exts_by_size;
	avl_tree_t q_sios_by_addr;
	uint64_t q_sio_memused;

	/* members for zio rate limiting */
	uint64_t q_maxinflight_bytes;
	uint64_t q_inflight_bytes;
	kcondvar_t q_zio_cv; /* used under vd->vdev_scan_io_queue_lock */

	/* per txg statistics */
	uint64_t q_total_seg_size_this_txg;
	uint64_t q_segs_this_txg;
	uint64_t q_total_zio_size_this_txg;
	uint64_t q_zios_this_txg;
	};

	/* private data for dsl_scan_prefetch_cb() */
	typedef struct scan_prefetch_ctx {
	zfs_refcount_t spc_refcnt; /* refcount for memory management */
	dsl_scan_t spc_scn; / dsl_scan_t for the pool */
	boolean_t spc_root; /* is this prefetch for an objset? */
	uint8_t spc_indblkshift; /* dn_indblkshift of current dnode */
	uint16_t spc_datablkszsec; /* dn_idatablkszsec of current dnode */
	} scan_prefetch_ctx_t;

	/* private data for dsl_scan_prefetch() */
	typedef struct scan_prefetch_issue_ctx {
	avl_node_t spic_avl_node; /* link into scn->scn_prefetch_queue */
	scan_prefetch_ctx_t spic_spc; / spc for the callback */
	blkptr_t spic_bp; /* bp to prefetch */
	zbookmark_phys_t spic_zb; /* bookmark to prefetch */
	} scan_prefetch_issue_ctx_t;

	static void scan_exec_io(dsl_pool_t dp, const blkptr_t bp, int zio_flags,
	const zbookmark_phys_t zb, dsl_scan_io_queue_t queue);
	static void scan_io_queue_insert_impl(dsl_scan_io_queue_t *queue,
	scan_io_t *sio);

	static dsl_scan_io_queue_t scan_io_queue_create(vdev_t vd);
	static void scan_io_queues_destroy(dsl_scan_t *scn);

	static kmem_cache_t *sio_cache[SPA_DVAS_PER_BP];

	/* sio->sio_nr_dvas must be set so we know which cache to free from */
	static void
	sio_free(scan_io_t *sio)
	{
	ASSERT3U(sio->sio_nr_dvas, >, 0);
	ASSERT3U(sio->sio_nr_dvas, <=, SPA_DVAS_PER_BP);

	kmem_cache_free(sio_cache[sio->sio_nr_dvas - 1], sio);
	}

	/* It is up to the caller to set sio->sio_nr_dvas for freeing */
	static scan_io_t *
	sio_alloc(unsigned short nr_dvas)
	{
	ASSERT3U(nr_dvas, >, 0);
	ASSERT3U(nr_dvas, <=, SPA_DVAS_PER_BP);

	return (kmem_cache_alloc(sio_cache[nr_dvas - 1], KM_SLEEP));
	}

	void
	scan_init(void)
	{
	/*
	* This is used in ext_size_compare() to weight segments
	* based on how sparse they are. This cannot be changed
	* mid-scan and the tree comparison functions don't currently
	* have a mechanism for passing additional context to the
	* compare functions. Thus we store this value globally and
	* we only allow it to be set at module initialization time
	*/
	fill_weight = zfs_scan_fill_weight;

	for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
	char name[36];

	(void) snprintf(name, sizeof (name), "sio_cache_%d", i);
	sio_cache[i] = kmem_cache_create(name,
	(sizeof (scan_io_t) + ((i + 1) * sizeof (dva_t))),
	0, NULL, NULL, NULL, NULL, NULL, 0);
	}
	}

	void
	scan_fini(void)
	{
	for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
	kmem_cache_destroy(sio_cache[i]);
	}
	}

	static inline boolean_t
	dsl_scan_is_running(const dsl_scan_t *scn)
	{
	return (scn->scn_phys.scn_state == DSS_SCANNING);
	}

	boolean_t
	dsl_scan_resilvering(dsl_pool_t *dp)
	{
	return (dsl_scan_is_running(dp->dp_scan) &&
	dp->dp_scan->scn_phys.scn_func == POOL_SCAN_RESILVER);
	}

	static inline void
	sio2bp(const scan_io_t sio, blkptr_t bp)
	{
	bzero(bp, sizeof (*bp));
	bp->blk_prop = sio->sio_blk_prop;
	bp->blk_phys_birth = sio->sio_phys_birth;
	bp->blk_birth = sio->sio_birth;
	bp->blk_fill = 1; /* we always only work with data pointers */
	bp->blk_cksum = sio->sio_cksum;

	ASSERT3U(sio->sio_nr_dvas, >, 0);
	ASSERT3U(sio->sio_nr_dvas, <=, SPA_DVAS_PER_BP);

	bcopy(sio->sio_dva, bp->blk_dva, sio->sio_nr_dvas * sizeof (dva_t));
	}

	static inline void
	bp2sio(const blkptr_t bp, scan_io_t sio, int dva_i)
	{
	sio->sio_blk_prop = bp->blk_prop;
	sio->sio_phys_birth = bp->blk_phys_birth;
	sio->sio_birth = bp->blk_birth;
	sio->sio_cksum = bp->blk_cksum;
	sio->sio_nr_dvas = BP_GET_NDVAS(bp);

	/*
	* Copy the DVAs to the sio. We need all copies of the block so
	* that the self healing code can use the alternate copies if the
	* first is corrupted. We want the DVA at index dva_i to be first
	* in the sio since this is the primary one that we want to issue.
	*/
	for (int i = 0, j = dva_i; i < sio->sio_nr_dvas; i++, j++) {
	sio->sio_dva[i] = bp->blk_dva[j % sio->sio_nr_dvas];
	}
	}

	int
	dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
	{
	int err;
	dsl_scan_t *scn;
	spa_t *spa = dp->dp_spa;
	uint64_t f;

	scn = dp->dp_scan = kmem_zalloc(sizeof (dsl_scan_t), KM_SLEEP);
	scn->scn_dp = dp;

	/*
	* It's possible that we're resuming a scan after a reboot so
	* make sure that the scan_async_destroying flag is initialized
	* appropriately.
	*/
	ASSERT(!scn->scn_async_destroying);
	scn->scn_async_destroying = spa_feature_is_active(dp->dp_spa,
	SPA_FEATURE_ASYNC_DESTROY);

	/*
	* Calculate the max number of in-flight bytes for pool-wide
	* scanning operations (minimum 1MB). Limits for the issuing
	* phase are done per top-level vdev and are handled separately.
	*/
	scn->scn_maxinflight_bytes = MAX(zfs_scan_vdev_limit *
	dsl_scan_count_leaves(spa->spa_root_vdev), 1ULL << 20);

	avl_create(&scn->scn_queue, scan_ds_queue_compare, sizeof (scan_ds_t),
	offsetof(scan_ds_t, sds_node));
	avl_create(&scn->scn_prefetch_queue, scan_prefetch_queue_compare,
	sizeof (scan_prefetch_issue_ctx_t),
	offsetof(scan_prefetch_issue_ctx_t, spic_avl_node));

	err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	"scrub_func", sizeof (uint64_t), 1, &f);
	if (err == 0) {
	/*
	* There was an old-style scrub in progress. Restart a
	* new-style scrub from the beginning.
	*/
	scn->scn_restart_txg = txg;
	zfs_dbgmsg("old-style scrub was in progress; "
	"restarting new-style scrub in txg %llu",
	(longlong_t)scn->scn_restart_txg);

	/*
	* Load the queue obj from the old location so that it
	* can be freed by dsl_scan_done().
	*/
	(void) zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	"scrub_queue", sizeof (uint64_t), 1,
	&scn->scn_phys.scn_queue_obj);
	} else {
	err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
	&scn->scn_phys);
	/*
	* Detect if the pool contains the signature of #2094. If it
	* does properly update the scn->scn_phys structure and notify
	* the administrator by setting an errata for the pool.
	*/
	if (err == EOVERFLOW) {
	uint64_t zaptmp[SCAN_PHYS_NUMINTS + 1];
	VERIFY3S(SCAN_PHYS_NUMINTS, ==, 24);
	VERIFY3S(offsetof(dsl_scan_phys_t, scn_flags), ==,
	(23 * sizeof (uint64_t)));

	err = zap_lookup(dp->dp_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_SCAN,
	sizeof (uint64_t), SCAN_PHYS_NUMINTS + 1, &zaptmp);
	if (err == 0) {
	uint64_t overflow = zaptmp[SCAN_PHYS_NUMINTS];

	if (overflow & ~DSL_SCAN_FLAGS_MASK \|\|
	scn->scn_async_destroying) {
	spa->spa_errata =
	ZPOOL_ERRATA_ZOL_2094_ASYNC_DESTROY;
	return (EOVERFLOW);
	}

	bcopy(zaptmp, &scn->scn_phys,
	SCAN_PHYS_NUMINTS * sizeof (uint64_t));
	scn->scn_phys.scn_flags = overflow;

	/* Required scrub already in progress. */
	if (scn->scn_phys.scn_state == DSS_FINISHED \|\|
	scn->scn_phys.scn_state == DSS_CANCELED)
	spa->spa_errata =
	ZPOOL_ERRATA_ZOL_2094_SCRUB;
	}
	}

	if (err == ENOENT)
	return (0);
	else if (err)
	return (err);

	/*
	* We might be restarting after a reboot, so jump the issued
	* counter to how far we've scanned. We know we're consistent
	* up to here.
	*/
	scn->scn_issued_before_pass = scn->scn_phys.scn_examined;

	if (dsl_scan_is_running(scn) &&
	spa_prev_software_version(dp->dp_spa) < SPA_VERSION_SCAN) {
	/*
	* A new-type scrub was in progress on an old
	* pool, and the pool was accessed by old
	* software. Restart from the beginning, since
	* the old software may have changed the pool in
	* the meantime.
	*/
	scn->scn_restart_txg = txg;
	zfs_dbgmsg("new-style scrub was modified "
	"by old software; restarting in txg %llu",
	(longlong_t)scn->scn_restart_txg);
	} else if (dsl_scan_resilvering(dp)) {
	/*
	* If a resilver is in progress and there are already
	* errors, restart it instead of finishing this scan and
	* then restarting it. If there haven't been any errors
	* then remember that the incore DTL is valid.
	*/
	if (scn->scn_phys.scn_errors > 0) {
	scn->scn_restart_txg = txg;
	zfs_dbgmsg("resilver can't excise DTL_MISSING "
	"when finished; restarting in txg %llu",
	(u_longlong_t)scn->scn_restart_txg);
	} else {
	/* it's safe to excise DTL when finished */
	spa->spa_scrub_started = B_TRUE;
	}
	}
	}

	bcopy(&scn->scn_phys, &scn->scn_phys_cached, sizeof (scn->scn_phys));

	/* reload the queue into the in-core state */
	if (scn->scn_phys.scn_queue_obj != 0) {
	zap_cursor_t zc;
	zap_attribute_t za;

	for (zap_cursor_init(&zc, dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj);
	zap_cursor_retrieve(&zc, &za) == 0;
	(void) zap_cursor_advance(&zc)) {
	scan_ds_queue_insert(scn,
	zfs_strtonum(za.za_name, NULL),
	za.za_first_integer);
	}
	zap_cursor_fini(&zc);
	}

	spa_scan_stat_init(spa);
	return (0);
	}

	void
	dsl_scan_fini(dsl_pool_t *dp)
	{
	if (dp->dp_scan != NULL) {
	dsl_scan_t *scn = dp->dp_scan;

	if (scn->scn_taskq != NULL)
	taskq_destroy(scn->scn_taskq);

	scan_ds_queue_clear(scn);
	avl_destroy(&scn->scn_queue);
	scan_ds_prefetch_queue_clear(scn);
	avl_destroy(&scn->scn_prefetch_queue);

	kmem_free(dp->dp_scan, sizeof (dsl_scan_t));
	dp->dp_scan = NULL;
	}
	}

	static boolean_t
	dsl_scan_restarting(dsl_scan_t scn, dmu_tx_t tx)
	{
	return (scn->scn_restart_txg != 0 &&
	scn->scn_restart_txg <= tx->tx_txg);
	}

	boolean_t
	dsl_scan_resilver_scheduled(dsl_pool_t *dp)
	{
	return ((dp->dp_scan && dp->dp_scan->scn_restart_txg != 0) \|\|
	(spa_async_tasks(dp->dp_spa) & SPA_ASYNC_RESILVER));
	}

	boolean_t
	dsl_scan_scrubbing(const dsl_pool_t *dp)
	{
	dsl_scan_phys_t *scn_phys = &dp->dp_scan->scn_phys;

	return (scn_phys->scn_state == DSS_SCANNING &&
	scn_phys->scn_func == POOL_SCAN_SCRUB);
	}

	boolean_t
	dsl_scan_is_paused_scrub(const dsl_scan_t *scn)
	{
	return (dsl_scan_scrubbing(scn->scn_dp) &&
	scn->scn_phys.scn_flags & DSF_SCRUB_PAUSED);
	}

	/*
	* Writes out a persistent dsl_scan_phys_t record to the pool directory.
	* Because we can be running in the block sorting algorithm, we do not always
	* want to write out the record, only when it is "safe" to do so. This safety
	* condition is achieved by making sure that the sorting queues are empty
	* (scn_bytes_pending == 0). When this condition is not true, the sync'd state
	* is inconsistent with how much actual scanning progress has been made. The
	* kind of sync to be performed is specified by the sync_type argument. If the
	* sync is optional, we only sync if the queues are empty. If the sync is
	* mandatory, we do a hard ASSERT to make sure that the queues are empty. The
	* third possible state is a "cached" sync. This is done in response to:
	* 1) The dataset that was in the last sync'd dsl_scan_phys_t having been
	* destroyed, so we wouldn't be able to restart scanning from it.
	* 2) The snapshot that was in the last sync'd dsl_scan_phys_t having been
	* superseded by a newer snapshot.
	* 3) The dataset that was in the last sync'd dsl_scan_phys_t having been
	* swapped with its clone.
	* In all cases, a cached sync simply rewrites the last record we've written,
	* just slightly modified. For the modifications that are performed to the
	* last written dsl_scan_phys_t, see dsl_scan_ds_destroyed,
	* dsl_scan_ds_snapshotted and dsl_scan_ds_clone_swapped.
	*/
	static void
	dsl_scan_sync_state(dsl_scan_t scn, dmu_tx_t tx, state_sync_type_t sync_type)
	{
	int i;
	spa_t *spa = scn->scn_dp->dp_spa;

	ASSERT(sync_type != SYNC_MANDATORY \|\| scn->scn_bytes_pending == 0);
	if (scn->scn_bytes_pending == 0) {
	for (i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
	vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
	dsl_scan_io_queue_t *q = vd->vdev_scan_io_queue;

	if (q == NULL)
	continue;

	mutex_enter(&vd->vdev_scan_io_queue_lock);
	ASSERT3P(avl_first(&q->q_sios_by_addr), ==, NULL);
	ASSERT3P(zfs_btree_first(&q->q_exts_by_size, NULL), ==,
	NULL);
	ASSERT3P(range_tree_first(q->q_exts_by_addr), ==, NULL);
	mutex_exit(&vd->vdev_scan_io_queue_lock);
	}

	if (scn->scn_phys.scn_queue_obj != 0)
	scan_ds_queue_sync(scn, tx);
	VERIFY0(zap_update(scn->scn_dp->dp_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
	&scn->scn_phys, tx));
	bcopy(&scn->scn_phys, &scn->scn_phys_cached,
	sizeof (scn->scn_phys));

	if (scn->scn_checkpointing)
	zfs_dbgmsg("finish scan checkpoint");

	scn->scn_checkpointing = B_FALSE;
	scn->scn_last_checkpoint = ddi_get_lbolt();
	} else if (sync_type == SYNC_CACHED) {
	VERIFY0(zap_update(scn->scn_dp->dp_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
	&scn->scn_phys_cached, tx));
	}
	}

	/* ARGSUSED */
	static int
	dsl_scan_setup_check(void arg, dmu_tx_t tx)
	{
	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;

	if (dsl_scan_is_running(scn) \|\| vdev_rebuild_active(rvd))
	return (SET_ERROR(EBUSY));

	return (0);
	}

	static void
	dsl_scan_setup_sync(void arg, dmu_tx_t tx)
	{
	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
	pool_scan_func_t *funcp = arg;
	dmu_object_type_t ot = 0;
	dsl_pool_t *dp = scn->scn_dp;
	spa_t *spa = dp->dp_spa;

	ASSERT(!dsl_scan_is_running(scn));
	ASSERT(funcp > POOL_SCAN_NONE && funcp < POOL_SCAN_FUNCS);
	bzero(&scn->scn_phys, sizeof (scn->scn_phys));
	scn->scn_phys.scn_func = *funcp;
	scn->scn_phys.scn_state = DSS_SCANNING;
	scn->scn_phys.scn_min_txg = 0;
	scn->scn_phys.scn_max_txg = tx->tx_txg;
	scn->scn_phys.scn_ddt_class_max = DDT_CLASSES - 1; /* the entire DDT */
	scn->scn_phys.scn_start_time = gethrestime_sec();
	scn->scn_phys.scn_errors = 0;
	scn->scn_phys.scn_to_examine = spa->spa_root_vdev->vdev_stat.vs_alloc;
	scn->scn_issued_before_pass = 0;
	scn->scn_restart_txg = 0;
	scn->scn_done_txg = 0;
	scn->scn_last_checkpoint = 0;
	scn->scn_checkpointing = B_FALSE;
	spa_scan_stat_init(spa);

	if (DSL_SCAN_IS_SCRUB_RESILVER(scn)) {
	scn->scn_phys.scn_ddt_class_max = zfs_scrub_ddt_class_max;

	/* rewrite all disk labels */
	vdev_config_dirty(spa->spa_root_vdev);

	if (vdev_resilver_needed(spa->spa_root_vdev,
	&scn->scn_phys.scn_min_txg, &scn->scn_phys.scn_max_txg)) {
	nvlist_t *aux = fnvlist_alloc();
	fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE,
	"healing");
	spa_event_notify(spa, NULL, aux,
	ESC_ZFS_RESILVER_START);
	nvlist_free(aux);
	} else {
	spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_START);
	}

	spa->spa_scrub_started = B_TRUE;
	/*
	* If this is an incremental scrub, limit the DDT scrub phase
	* to just the auto-ditto class (for correctness); the rest
	* of the scrub should go faster using top-down pruning.
	*/
	if (scn->scn_phys.scn_min_txg > TXG_INITIAL)
	scn->scn_phys.scn_ddt_class_max = DDT_CLASS_DITTO;

	/*
	* When starting a resilver clear any existing rebuild state.
	* This is required to prevent stale rebuild status from
	* being reported when a rebuild is run, then a resilver and
	* finally a scrub. In which case only the scrub status
	* should be reported by 'zpool status'.
	*/
	if (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) {
	vdev_t *rvd = spa->spa_root_vdev;
	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
	vdev_t *vd = rvd->vdev_child[i];
	vdev_rebuild_clear_sync(
	(void *)(uintptr_t)vd->vdev_id, tx);
	}
	}
	}

	/* back to the generic stuff */

	if (dp->dp_blkstats == NULL) {
	dp->dp_blkstats =
	vmem_alloc(sizeof (zfs_all_blkstats_t), KM_SLEEP);
	mutex_init(&dp->dp_blkstats->zab_lock, NULL,
	MUTEX_DEFAULT, NULL);
	}
	bzero(&dp->dp_blkstats->zab_type, sizeof (dp->dp_blkstats->zab_type));

	if (spa_version(spa) < SPA_VERSION_DSL_SCRUB)
	ot = DMU_OT_ZAP_OTHER;

	scn->scn_phys.scn_queue_obj = zap_create(dp->dp_meta_objset,
	ot ? ot : DMU_OT_SCAN_QUEUE, DMU_OT_NONE, 0, tx);

	bcopy(&scn->scn_phys, &scn->scn_phys_cached, sizeof (scn->scn_phys));

	dsl_scan_sync_state(scn, tx, SYNC_MANDATORY);

	spa_history_log_internal(spa, "scan setup", tx,
	"func=%u mintxg=%llu maxtxg=%llu",
	*funcp, (u_longlong_t)scn->scn_phys.scn_min_txg,
	(u_longlong_t)scn->scn_phys.scn_max_txg);
	}

	/*
	* Called by the ZFS_IOC_POOL_SCAN ioctl to start a scrub or resilver.
	* Can also be called to resume a paused scrub.
	*/
	int
	dsl_scan(dsl_pool_t *dp, pool_scan_func_t func)
	{
	spa_t *spa = dp->dp_spa;
	dsl_scan_t *scn = dp->dp_scan;

	/*
	* Purge all vdev caches and probe all devices. We do this here
	* rather than in sync context because this requires a writer lock
	* on the spa_config lock, which we can't do from sync context. The
	* spa_scrub_reopen flag indicates that vdev_open() should not
	* attempt to start another scrub.
	*/
	spa_vdev_state_enter(spa, SCL_NONE);
	spa->spa_scrub_reopen = B_TRUE;
	vdev_reopen(spa->spa_root_vdev);
	spa->spa_scrub_reopen = B_FALSE;
	(void) spa_vdev_state_exit(spa, NULL, 0);

	if (func == POOL_SCAN_RESILVER) {
	dsl_scan_restart_resilver(spa->spa_dsl_pool, 0);
	return (0);
	}

	if (func == POOL_SCAN_SCRUB && dsl_scan_is_paused_scrub(scn)) {
	/* got scrub start cmd, resume paused scrub */
	int err = dsl_scrub_set_pause_resume(scn->scn_dp,
	POOL_SCRUB_NORMAL);
	if (err == 0) {
	spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_RESUME);
	return (SET_ERROR(ECANCELED));
	}

	return (SET_ERROR(err));
	}

	return (dsl_sync_task(spa_name(spa), dsl_scan_setup_check,
	dsl_scan_setup_sync, &func, 0, ZFS_SPACE_CHECK_EXTRA_RESERVED));
	}

	/* ARGSUSED */
	static void
	dsl_scan_done(dsl_scan_t scn, boolean_t complete, dmu_tx_t tx)
	{
	static const char *old_names[] = {
	"scrub_bookmark",
	"scrub_ddt_bookmark",
	"scrub_ddt_class_max",
	"scrub_queue",
	"scrub_min_txg",
	"scrub_max_txg",
	"scrub_func",
	"scrub_errors",
	NULL
	};

	dsl_pool_t *dp = scn->scn_dp;
	spa_t *spa = dp->dp_spa;
	int i;

	/* Remove any remnants of an old-style scrub. */
	for (i = 0; old_names[i]; i++) {
	(void) zap_remove(dp->dp_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, old_names[i], tx);
	}

	if (scn->scn_phys.scn_queue_obj != 0) {
	VERIFY0(dmu_object_free(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, tx));
	scn->scn_phys.scn_queue_obj = 0;
	}
	scan_ds_queue_clear(scn);
	scan_ds_prefetch_queue_clear(scn);

	scn->scn_phys.scn_flags &= ~DSF_SCRUB_PAUSED;

	/*
	* If we were "restarted" from a stopped state, don't bother
	* with anything else.
	*/
	if (!dsl_scan_is_running(scn)) {
	ASSERT(!scn->scn_is_sorted);
	return;
	}

	if (scn->scn_is_sorted) {
	scan_io_queues_destroy(scn);
	scn->scn_is_sorted = B_FALSE;

	if (scn->scn_taskq != NULL) {
	taskq_destroy(scn->scn_taskq);
	scn->scn_taskq = NULL;
	}
	}

	scn->scn_phys.scn_state = complete ? DSS_FINISHED : DSS_CANCELED;

	spa_notify_waiters(spa);

	if (dsl_scan_restarting(scn, tx))
	spa_history_log_internal(spa, "scan aborted, restarting", tx,
	"errors=%llu", (u_longlong_t)spa_get_errlog_size(spa));
	else if (!complete)
	spa_history_log_internal(spa, "scan cancelled", tx,
	"errors=%llu", (u_longlong_t)spa_get_errlog_size(spa));
	else
	spa_history_log_internal(spa, "scan done", tx,
	"errors=%llu", (u_longlong_t)spa_get_errlog_size(spa));

	if (DSL_SCAN_IS_SCRUB_RESILVER(scn)) {
	spa->spa_scrub_active = B_FALSE;

	/*
	* If the scrub/resilver completed, update all DTLs to
	* reflect this. Whether it succeeded or not, vacate
	* all temporary scrub DTLs.
	*
	* As the scrub does not currently support traversing
	* data that have been freed but are part of a checkpoint,
	* we don't mark the scrub as done in the DTLs as faults
	* may still exist in those vdevs.
	*/
	if (complete &&
	!spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
	vdev_dtl_reassess(spa->spa_root_vdev, tx->tx_txg,
	scn->scn_phys.scn_max_txg, B_TRUE, B_FALSE);

	if (scn->scn_phys.scn_min_txg) {
	nvlist_t *aux = fnvlist_alloc();
	fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE,
	"healing");
	spa_event_notify(spa, NULL, aux,
	ESC_ZFS_RESILVER_FINISH);
	nvlist_free(aux);
	} else {
	spa_event_notify(spa, NULL, NULL,
	ESC_ZFS_SCRUB_FINISH);
	}
	} else {
	vdev_dtl_reassess(spa->spa_root_vdev, tx->tx_txg,
	0, B_TRUE, B_FALSE);
	}
	spa_errlog_rotate(spa);

	/*
	* Don't clear flag until after vdev_dtl_reassess to ensure that
	* DTL_MISSING will get updated when possible.
	*/
	spa->spa_scrub_started = B_FALSE;

	/*
	* We may have finished replacing a device.
	* Let the async thread assess this and handle the detach.
	*/
	spa_async_request(spa, SPA_ASYNC_RESILVER_DONE);

	/*
	* Clear any resilver_deferred flags in the config.
	* If there are drives that need resilvering, kick
	* off an asynchronous request to start resilver.
	* vdev_clear_resilver_deferred() may update the config
	* before the resilver can restart. In the event of
	* a crash during this period, the spa loading code
	* will find the drives that need to be resilvered
	* and start the resilver then.
	*/
	if (spa_feature_is_enabled(spa, SPA_FEATURE_RESILVER_DEFER) &&
	vdev_clear_resilver_deferred(spa->spa_root_vdev, tx)) {
	spa_history_log_internal(spa,
	"starting deferred resilver", tx, "errors=%llu",
	(u_longlong_t)spa_get_errlog_size(spa));
	spa_async_request(spa, SPA_ASYNC_RESILVER);
	}
	}

	scn->scn_phys.scn_end_time = gethrestime_sec();

	if (spa->spa_errata == ZPOOL_ERRATA_ZOL_2094_SCRUB)
	spa->spa_errata = 0;

	ASSERT(!dsl_scan_is_running(scn));
	}

	/* ARGSUSED */
	static int
	dsl_scan_cancel_check(void arg, dmu_tx_t tx)
	{
	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;

	if (!dsl_scan_is_running(scn))
	return (SET_ERROR(ENOENT));
	return (0);
	}

	/* ARGSUSED */
	static void
	dsl_scan_cancel_sync(void arg, dmu_tx_t tx)
	{
	dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;

	dsl_scan_done(scn, B_FALSE, tx);
	dsl_scan_sync_state(scn, tx, SYNC_MANDATORY);
	spa_event_notify(scn->scn_dp->dp_spa, NULL, NULL, ESC_ZFS_SCRUB_ABORT);
	}

	int
	dsl_scan_cancel(dsl_pool_t *dp)
	{
	return (dsl_sync_task(spa_name(dp->dp_spa), dsl_scan_cancel_check,
	dsl_scan_cancel_sync, NULL, 3, ZFS_SPACE_CHECK_RESERVED));
	}

	static int
	dsl_scrub_pause_resume_check(void arg, dmu_tx_t tx)
	{
	pool_scrub_cmd_t *cmd = arg;
	dsl_pool_t *dp = dmu_tx_pool(tx);
	dsl_scan_t *scn = dp->dp_scan;

	if (*cmd == POOL_SCRUB_PAUSE) {
	/* can't pause a scrub when there is no in-progress scrub */
	if (!dsl_scan_scrubbing(dp))
	return (SET_ERROR(ENOENT));

	/* can't pause a paused scrub */
	if (dsl_scan_is_paused_scrub(scn))
	return (SET_ERROR(EBUSY));
	} else if (*cmd != POOL_SCRUB_NORMAL) {
	return (SET_ERROR(ENOTSUP));
	}

	return (0);
	}

	static void
	dsl_scrub_pause_resume_sync(void arg, dmu_tx_t tx)
	{
	pool_scrub_cmd_t *cmd = arg;
	dsl_pool_t *dp = dmu_tx_pool(tx);
	spa_t *spa = dp->dp_spa;
	dsl_scan_t *scn = dp->dp_scan;

	if (*cmd == POOL_SCRUB_PAUSE) {
	/* can't pause a scrub when there is no in-progress scrub */
	spa->spa_scan_pass_scrub_pause = gethrestime_sec();
	scn->scn_phys.scn_flags \|= DSF_SCRUB_PAUSED;
	scn->scn_phys_cached.scn_flags \|= DSF_SCRUB_PAUSED;
	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
	spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_PAUSED);
	spa_notify_waiters(spa);
	} else {
	ASSERT3U(*cmd, ==, POOL_SCRUB_NORMAL);
	if (dsl_scan_is_paused_scrub(scn)) {
	/*
	* We need to keep track of how much time we spend
	* paused per pass so that we can adjust the scrub rate
	* shown in the output of 'zpool status'
	*/
	spa->spa_scan_pass_scrub_spent_paused +=
	gethrestime_sec() - spa->spa_scan_pass_scrub_pause;
	spa->spa_scan_pass_scrub_pause = 0;
	scn->scn_phys.scn_flags &= ~DSF_SCRUB_PAUSED;
	scn->scn_phys_cached.scn_flags &= ~DSF_SCRUB_PAUSED;
	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
	}
	}
	}

	/*
	* Set scrub pause/resume state if it makes sense to do so
	*/
	int
	dsl_scrub_set_pause_resume(const dsl_pool_t *dp, pool_scrub_cmd_t cmd)
	{
	return (dsl_sync_task(spa_name(dp->dp_spa),
	dsl_scrub_pause_resume_check, dsl_scrub_pause_resume_sync, &cmd, 3,
	ZFS_SPACE_CHECK_RESERVED));
	}


	/* start a new scan, or restart an existing one. */
	void
	dsl_scan_restart_resilver(dsl_pool_t *dp, uint64_t txg)
	{
	if (txg == 0) {
	dmu_tx_t *tx;
	tx = dmu_tx_create_dd(dp->dp_mos_dir);
	VERIFY(0 == dmu_tx_assign(tx, TXG_WAIT));

	txg = dmu_tx_get_txg(tx);
	dp->dp_scan->scn_restart_txg = txg;
	dmu_tx_commit(tx);
	} else {
	dp->dp_scan->scn_restart_txg = txg;
	}
	zfs_dbgmsg("restarting resilver txg=%llu", (longlong_t)txg);
	}

	void
	dsl_free(dsl_pool_t dp, uint64_t txg, const blkptr_t bp)
	{
	zio_free(dp->dp_spa, txg, bp);
	}

	void
	dsl_free_sync(zio_t pio, dsl_pool_t dp, uint64_t txg, const blkptr_t *bpp)
	{
	ASSERT(dsl_pool_sync_context(dp));
	zio_nowait(zio_free_sync(pio, dp->dp_spa, txg, bpp, pio->io_flags));
	}

	static int
	scan_ds_queue_compare(const void a, const void b)
	{
	const scan_ds_t sds_a = a, sds_b = b;

	if (sds_a->sds_dsobj < sds_b->sds_dsobj)
	return (-1);
	if (sds_a->sds_dsobj == sds_b->sds_dsobj)
	return (0);
	return (1);
	}

	static void
	scan_ds_queue_clear(dsl_scan_t *scn)
	{
	void *cookie = NULL;
	scan_ds_t *sds;
	while ((sds = avl_destroy_nodes(&scn->scn_queue, &cookie)) != NULL) {
	kmem_free(sds, sizeof (*sds));
	}
	}

	static boolean_t
	scan_ds_queue_contains(dsl_scan_t scn, uint64_t dsobj, uint64_t txg)
	{
	scan_ds_t srch, *sds;

	srch.sds_dsobj = dsobj;
	sds = avl_find(&scn->scn_queue, &srch, NULL);
	if (sds != NULL && txg != NULL)
	*txg = sds->sds_txg;
	return (sds != NULL);
	}

	static void
	scan_ds_queue_insert(dsl_scan_t *scn, uint64_t dsobj, uint64_t txg)
	{
	scan_ds_t *sds;
	avl_index_t where;

	sds = kmem_zalloc(sizeof (*sds), KM_SLEEP);
	sds->sds_dsobj = dsobj;
	sds->sds_txg = txg;

	VERIFY3P(avl_find(&scn->scn_queue, sds, &where), ==, NULL);
	avl_insert(&scn->scn_queue, sds, where);
	}

	static void
	scan_ds_queue_remove(dsl_scan_t *scn, uint64_t dsobj)
	{
	scan_ds_t srch, *sds;

	srch.sds_dsobj = dsobj;

	sds = avl_find(&scn->scn_queue, &srch, NULL);
	VERIFY(sds != NULL);
	avl_remove(&scn->scn_queue, sds);
	kmem_free(sds, sizeof (*sds));
	}

	static void
	scan_ds_queue_sync(dsl_scan_t scn, dmu_tx_t tx)
	{
	dsl_pool_t *dp = scn->scn_dp;
	spa_t *spa = dp->dp_spa;
	dmu_object_type_t ot = (spa_version(spa) >= SPA_VERSION_DSL_SCRUB) ?
	DMU_OT_SCAN_QUEUE : DMU_OT_ZAP_OTHER;

	ASSERT0(scn->scn_bytes_pending);
	ASSERT(scn->scn_phys.scn_queue_obj != 0);

	VERIFY0(dmu_object_free(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, tx));
	scn->scn_phys.scn_queue_obj = zap_create(dp->dp_meta_objset, ot,
	DMU_OT_NONE, 0, tx);
	for (scan_ds_t *sds = avl_first(&scn->scn_queue);
	sds != NULL; sds = AVL_NEXT(&scn->scn_queue, sds)) {
	VERIFY0(zap_add_int_key(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, sds->sds_dsobj,
	sds->sds_txg, tx));
	}
	}

	/*
	* Computes the memory limit state that we're currently in. A sorted scan
	* needs quite a bit of memory to hold the sorting queue, so we need to
	* reasonably constrain the size so it doesn't impact overall system
	* performance. We compute two limits:
	* 1) Hard memory limit: if the amount of memory used by the sorting
	* queues on a pool gets above this value, we stop the metadata
	* scanning portion and start issuing the queued up and sorted
	* I/Os to reduce memory usage.
	* This limit is calculated as a fraction of physmem (by default 5%).
	* We constrain the lower bound of the hard limit to an absolute
	* minimum of zfs_scan_mem_lim_min (default: 16 MiB). We also constrain
	* the upper bound to 5% of the total pool size - no chance we'll
	* ever need that much memory, but just to keep the value in check.
	* 2) Soft memory limit: once we hit the hard memory limit, we start
	* issuing I/O to reduce queue memory usage, but we don't want to
	* completely empty out the queues, since we might be able to find I/Os
	* that will fill in the gaps of our non-sequential IOs at some point
	* in the future. So we stop the issuing of I/Os once the amount of
	* memory used drops below the soft limit (at which point we stop issuing
	* I/O and start scanning metadata again).
	*
	* This limit is calculated by subtracting a fraction of the hard
	* limit from the hard limit. By default this fraction is 5%, so
	* the soft limit is 95% of the hard limit. We cap the size of the
	* difference between the hard and soft limits at an absolute
	* maximum of zfs_scan_mem_lim_soft_max (default: 128 MiB) - this is
	* sufficient to not cause too frequent switching between the
	* metadata scan and I/O issue (even at 2k recordsize, 128 MiB's
	* worth of queues is about 1.2 GiB of on-pool data, so scanning
	* that should take at least a decent fraction of a second).
	*/
	static boolean_t
	dsl_scan_should_clear(dsl_scan_t *scn)
	{
	spa_t *spa = scn->scn_dp->dp_spa;
	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
	uint64_t alloc, mlim_hard, mlim_soft, mused;

	alloc = metaslab_class_get_alloc(spa_normal_class(spa));
	alloc += metaslab_class_get_alloc(spa_special_class(spa));
	alloc += metaslab_class_get_alloc(spa_dedup_class(spa));

	mlim_hard = MAX((physmem / zfs_scan_mem_lim_fact) * PAGESIZE,
	zfs_scan_mem_lim_min);
	mlim_hard = MIN(mlim_hard, alloc / 20);
	mlim_soft = mlim_hard - MIN(mlim_hard / zfs_scan_mem_lim_soft_fact,
	zfs_scan_mem_lim_soft_max);
	mused = 0;
	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
	vdev_t *tvd = rvd->vdev_child[i];
	dsl_scan_io_queue_t *queue;

	mutex_enter(&tvd->vdev_scan_io_queue_lock);
	queue = tvd->vdev_scan_io_queue;
	if (queue != NULL) {
	/* # extents in exts_by_size = # in exts_by_addr */
	mused += zfs_btree_numnodes(&queue->q_exts_by_size) *
	sizeof (range_seg_gap_t) + queue->q_sio_memused;
	}
	mutex_exit(&tvd->vdev_scan_io_queue_lock);
	}

	dprintf("current scan memory usage: %llu bytes\n", (longlong_t)mused);

	if (mused == 0)
	ASSERT0(scn->scn_bytes_pending);

	/*
	* If we are above our hard limit, we need to clear out memory.
	* If we are below our soft limit, we need to accumulate sequential IOs.
	* Otherwise, we should keep doing whatever we are currently doing.
	*/
	if (mused >= mlim_hard)
	return (B_TRUE);
	else if (mused < mlim_soft)
	return (B_FALSE);
	else
	return (scn->scn_clearing);
	}

	static boolean_t
	dsl_scan_check_suspend(dsl_scan_t scn, const zbookmark_phys_t zb)
	{
	/* we never skip user/group accounting objects */
	if (zb && (int64_t)zb->zb_object < 0)
	return (B_FALSE);

	if (scn->scn_suspending)
	return (B_TRUE); /* we're already suspending */

	if (!ZB_IS_ZERO(&scn->scn_phys.scn_bookmark))
	return (B_FALSE); /* we're resuming */

	/* We only know how to resume from level-0 and objset blocks. */
	if (zb && (zb->zb_level != 0 && zb->zb_level != ZB_ROOT_LEVEL))
	return (B_FALSE);

	/*
	* We suspend if:
	* - we have scanned for at least the minimum time (default 1 sec
	* for scrub, 3 sec for resilver), and either we have sufficient
	* dirty data that we are starting to write more quickly
	* (default 30%), someone is explicitly waiting for this txg
	* to complete, or we have used up all of the time in the txg
	* timeout (default 5 sec).
	* or
	* - the spa is shutting down because this pool is being exported
	* or the machine is rebooting.
	* or
	* - the scan queue has reached its memory use limit
	*/
	uint64_t curr_time_ns = gethrtime();
	uint64_t scan_time_ns = curr_time_ns - scn->scn_sync_start_time;
	uint64_t sync_time_ns = curr_time_ns -
	scn->scn_dp->dp_spa->spa_sync_starttime;
	int dirty_pct = scn->scn_dp->dp_dirty_total * 100 / zfs_dirty_data_max;
	int mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
	zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;

	if ((NSEC2MSEC(scan_time_ns) > mintime &&
	(dirty_pct >= zfs_vdev_async_write_active_min_dirty_percent \|\|
	txg_sync_waiting(scn->scn_dp) \|\|
	NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) \|\|
	spa_shutting_down(scn->scn_dp->dp_spa) \|\|
	(zfs_scan_strict_mem_lim && dsl_scan_should_clear(scn))) {
	if (zb && zb->zb_level == ZB_ROOT_LEVEL) {
	dprintf("suspending at first available bookmark "
	"%llx/%llx/%llx/%llx\n",
	(longlong_t)zb->zb_objset,
	(longlong_t)zb->zb_object,
	(longlong_t)zb->zb_level,
	(longlong_t)zb->zb_blkid);
	SET_BOOKMARK(&scn->scn_phys.scn_bookmark,
	zb->zb_objset, 0, 0, 0);
	} else if (zb != NULL) {
	dprintf("suspending at bookmark %llx/%llx/%llx/%llx\n",
	(longlong_t)zb->zb_objset,
	(longlong_t)zb->zb_object,
	(longlong_t)zb->zb_level,
	(longlong_t)zb->zb_blkid);
	scn->scn_phys.scn_bookmark = *zb;
	} else {
	#ifdef ZFS_DEBUG
	dsl_scan_phys_t *scnp = &scn->scn_phys;
	dprintf("suspending at at DDT bookmark "
	"%llx/%llx/%llx/%llx\n",
	(longlong_t)scnp->scn_ddt_bookmark.ddb_class,
	(longlong_t)scnp->scn_ddt_bookmark.ddb_type,
	(longlong_t)scnp->scn_ddt_bookmark.ddb_checksum,
	(longlong_t)scnp->scn_ddt_bookmark.ddb_cursor);
	#endif
	}
	scn->scn_suspending = B_TRUE;
	return (B_TRUE);
	}
	return (B_FALSE);
	}

	typedef struct zil_scan_arg {
	dsl_pool_t *zsa_dp;
	zil_header_t *zsa_zh;
	} zil_scan_arg_t;

	/* ARGSUSED */
	static int
	dsl_scan_zil_block(zilog_t zilog, blkptr_t bp, void *arg, uint64_t claim_txg)
	{
	zil_scan_arg_t *zsa = arg;
	dsl_pool_t *dp = zsa->zsa_dp;
	dsl_scan_t *scn = dp->dp_scan;
	zil_header_t *zh = zsa->zsa_zh;
	zbookmark_phys_t zb;

	ASSERT(!BP_IS_REDACTED(bp));
	if (BP_IS_HOLE(bp) \|\| bp->blk_birth <= scn->scn_phys.scn_cur_min_txg)
	return (0);

	/*
	* One block ("stubby") can be allocated a long time ago; we
	* want to visit that one because it has been allocated
	* (on-disk) even if it hasn't been claimed (even though for
	* scrub there's nothing to do to it).
	*/
	if (claim_txg == 0 && bp->blk_birth >= spa_min_claim_txg(dp->dp_spa))
	return (0);

	SET_BOOKMARK(&zb, zh->zh_log.blk_cksum.zc_word[ZIL_ZC_OBJSET],
	ZB_ZIL_OBJECT, ZB_ZIL_LEVEL, bp->blk_cksum.zc_word[ZIL_ZC_SEQ]);

	VERIFY(0 == scan_funcs[scn->scn_phys.scn_func](dp, bp, &zb));
	return (0);
	}

	/* ARGSUSED */
	static int
	dsl_scan_zil_record(zilog_t zilog, lr_t lrc, void *arg, uint64_t claim_txg)
	{
	if (lrc->lrc_txtype == TX_WRITE) {
	zil_scan_arg_t *zsa = arg;
	dsl_pool_t *dp = zsa->zsa_dp;
	dsl_scan_t *scn = dp->dp_scan;
	zil_header_t *zh = zsa->zsa_zh;
	lr_write_t lr = (lr_write_t )lrc;
	blkptr_t *bp = &lr->lr_blkptr;
	zbookmark_phys_t zb;

	ASSERT(!BP_IS_REDACTED(bp));
	if (BP_IS_HOLE(bp) \|\|
	bp->blk_birth <= scn->scn_phys.scn_cur_min_txg)
	return (0);

	/*
	* birth can be < claim_txg if this record's txg is
	* already txg sync'ed (but this log block contains
	* other records that are not synced)
	*/
	if (claim_txg == 0 \|\| bp->blk_birth < claim_txg)
	return (0);

	SET_BOOKMARK(&zb, zh->zh_log.blk_cksum.zc_word[ZIL_ZC_OBJSET],
	lr->lr_foid, ZB_ZIL_LEVEL,
	lr->lr_offset / BP_GET_LSIZE(bp));

	VERIFY(0 == scan_funcs[scn->scn_phys.scn_func](dp, bp, &zb));
	}
	return (0);
	}

	static void
	dsl_scan_zil(dsl_pool_t dp, zil_header_t zh)
	{
	uint64_t claim_txg = zh->zh_claim_txg;
	zil_scan_arg_t zsa = { dp, zh };
	zilog_t *zilog;

	ASSERT(spa_writeable(dp->dp_spa));

	/*
	* We only want to visit blocks that have been claimed but not yet
	* replayed (or, in read-only mode, blocks that would be claimed).
	*/
	if (claim_txg == 0)
	return;

	zilog = zil_alloc(dp->dp_meta_objset, zh);

	(void) zil_parse(zilog, dsl_scan_zil_block, dsl_scan_zil_record, &zsa,
	claim_txg, B_FALSE);

	zil_free(zilog);
	}

	/*
	* We compare scan_prefetch_issue_ctx_t's based on their bookmarks. The idea
	* here is to sort the AVL tree by the order each block will be needed.
	*/
	static int
	scan_prefetch_queue_compare(const void a, const void b)
	{
	const scan_prefetch_issue_ctx_t spic_a = a, spic_b = b;
	const scan_prefetch_ctx_t *spc_a = spic_a->spic_spc;
	const scan_prefetch_ctx_t *spc_b = spic_b->spic_spc;

	return (zbookmark_compare(spc_a->spc_datablkszsec,
	spc_a->spc_indblkshift, spc_b->spc_datablkszsec,
	spc_b->spc_indblkshift, &spic_a->spic_zb, &spic_b->spic_zb));
	}

	static void
	scan_prefetch_ctx_rele(scan_prefetch_ctx_t spc, void tag)
	{
	if (zfs_refcount_remove(&spc->spc_refcnt, tag) == 0) {
	zfs_refcount_destroy(&spc->spc_refcnt);
	kmem_free(spc, sizeof (scan_prefetch_ctx_t));
	}
	}

	static scan_prefetch_ctx_t *
	scan_prefetch_ctx_create(dsl_scan_t scn, dnode_phys_t dnp, void *tag)
	{
	scan_prefetch_ctx_t *spc;

	spc = kmem_alloc(sizeof (scan_prefetch_ctx_t), KM_SLEEP);
	zfs_refcount_create(&spc->spc_refcnt);
	zfs_refcount_add(&spc->spc_refcnt, tag);
	spc->spc_scn = scn;
	if (dnp != NULL) {
	spc->spc_datablkszsec = dnp->dn_datablkszsec;
	spc->spc_indblkshift = dnp->dn_indblkshift;
	spc->spc_root = B_FALSE;
	} else {
	spc->spc_datablkszsec = 0;
	spc->spc_indblkshift = 0;
	spc->spc_root = B_TRUE;
	}

	return (spc);
	}

	static void
	scan_prefetch_ctx_add_ref(scan_prefetch_ctx_t spc, void tag)
	{
	zfs_refcount_add(&spc->spc_refcnt, tag);
	}

	static void
	scan_ds_prefetch_queue_clear(dsl_scan_t *scn)
	{
	spa_t *spa = scn->scn_dp->dp_spa;
	void *cookie = NULL;
	scan_prefetch_issue_ctx_t *spic = NULL;

	mutex_enter(&spa->spa_scrub_lock);
	while ((spic = avl_destroy_nodes(&scn->scn_prefetch_queue,
	&cookie)) != NULL) {
	scan_prefetch_ctx_rele(spic->spic_spc, scn);
	kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
	}
	mutex_exit(&spa->spa_scrub_lock);
	}

	static boolean_t
	dsl_scan_check_prefetch_resume(scan_prefetch_ctx_t *spc,
	const zbookmark_phys_t *zb)
	{
	zbookmark_phys_t *last_zb = &spc->spc_scn->scn_prefetch_bookmark;
	dnode_phys_t tmp_dnp;
	dnode_phys_t *dnp = (spc->spc_root) ? NULL : &tmp_dnp;

	if (zb->zb_objset != last_zb->zb_objset)
	return (B_TRUE);
	if ((int64_t)zb->zb_object < 0)
	return (B_FALSE);

	tmp_dnp.dn_datablkszsec = spc->spc_datablkszsec;
	tmp_dnp.dn_indblkshift = spc->spc_indblkshift;

	if (zbookmark_subtree_completed(dnp, zb, last_zb))
	return (B_TRUE);

	return (B_FALSE);
	}

	static void
	dsl_scan_prefetch(scan_prefetch_ctx_t spc, blkptr_t bp, zbookmark_phys_t *zb)
	{
	avl_index_t idx;
	dsl_scan_t *scn = spc->spc_scn;
	spa_t *spa = scn->scn_dp->dp_spa;
	scan_prefetch_issue_ctx_t *spic;

	if (zfs_no_scrub_prefetch \|\| BP_IS_REDACTED(bp))
	return;

	if (BP_IS_HOLE(bp) \|\| bp->blk_birth <= scn->scn_phys.scn_cur_min_txg \|\|
	(BP_GET_LEVEL(bp) == 0 && BP_GET_TYPE(bp) != DMU_OT_DNODE &&
	BP_GET_TYPE(bp) != DMU_OT_OBJSET))
	return;

	if (dsl_scan_check_prefetch_resume(spc, zb))
	return;

	scan_prefetch_ctx_add_ref(spc, scn);
	spic = kmem_alloc(sizeof (scan_prefetch_issue_ctx_t), KM_SLEEP);
	spic->spic_spc = spc;
	spic->spic_bp = *bp;
	spic->spic_zb = *zb;

	/*
	* Add the IO to the queue of blocks to prefetch. This allows us to
	* prioritize blocks that we will need first for the main traversal
	* thread.
	*/
	mutex_enter(&spa->spa_scrub_lock);
	if (avl_find(&scn->scn_prefetch_queue, spic, &idx) != NULL) {
	/* this block is already queued for prefetch */
	kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
	scan_prefetch_ctx_rele(spc, scn);
	mutex_exit(&spa->spa_scrub_lock);
	return;
	}

	avl_insert(&scn->scn_prefetch_queue, spic, idx);
	cv_broadcast(&spa->spa_scrub_io_cv);
	mutex_exit(&spa->spa_scrub_lock);
	}

	static void
	dsl_scan_prefetch_dnode(dsl_scan_t scn, dnode_phys_t dnp,
	uint64_t objset, uint64_t object)
	{
	int i;
	zbookmark_phys_t zb;
	scan_prefetch_ctx_t *spc;

	if (dnp->dn_nblkptr == 0 && !(dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR))
	return;

	SET_BOOKMARK(&zb, objset, object, 0, 0);

	spc = scan_prefetch_ctx_create(scn, dnp, FTAG);

	for (i = 0; i < dnp->dn_nblkptr; i++) {
	zb.zb_level = BP_GET_LEVEL(&dnp->dn_blkptr[i]);
	zb.zb_blkid = i;
	dsl_scan_prefetch(spc, &dnp->dn_blkptr[i], &zb);
	}

	if (dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR) {
	zb.zb_level = 0;
	zb.zb_blkid = DMU_SPILL_BLKID;
	dsl_scan_prefetch(spc, DN_SPILL_BLKPTR(dnp), &zb);
	}

	scan_prefetch_ctx_rele(spc, FTAG);
	}

	static void
	dsl_scan_prefetch_cb(zio_t zio, const zbookmark_phys_t zb, const blkptr_t *bp,
	arc_buf_t buf, void private)
	{
	scan_prefetch_ctx_t *spc = private;
	dsl_scan_t *scn = spc->spc_scn;
	spa_t *spa = scn->scn_dp->dp_spa;

	/* broadcast that the IO has completed for rate limiting purposes */
	mutex_enter(&spa->spa_scrub_lock);
	ASSERT3U(spa->spa_scrub_inflight, >=, BP_GET_PSIZE(bp));
	spa->spa_scrub_inflight -= BP_GET_PSIZE(bp);
	cv_broadcast(&spa->spa_scrub_io_cv);
	mutex_exit(&spa->spa_scrub_lock);

	/* if there was an error or we are done prefetching, just cleanup */
	if (buf == NULL \|\| scn->scn_prefetch_stop)
	goto out;

	if (BP_GET_LEVEL(bp) > 0) {
	int i;
	blkptr_t *cbp;
	int epb = BP_GET_LSIZE(bp) >> SPA_BLKPTRSHIFT;
	zbookmark_phys_t czb;

	for (i = 0, cbp = buf->b_data; i < epb; i++, cbp++) {
	SET_BOOKMARK(&czb, zb->zb_objset, zb->zb_object,
	zb->zb_level - 1, zb->zb_blkid * epb + i);
	dsl_scan_prefetch(spc, cbp, &czb);
	}
	} else if (BP_GET_TYPE(bp) == DMU_OT_DNODE) {
	dnode_phys_t *cdnp;
	int i;
	int epb = BP_GET_LSIZE(bp) >> DNODE_SHIFT;

	for (i = 0, cdnp = buf->b_data; i < epb;
	i += cdnp->dn_extra_slots + 1,
	cdnp += cdnp->dn_extra_slots + 1) {
	dsl_scan_prefetch_dnode(scn, cdnp,
	zb->zb_objset, zb->zb_blkid * epb + i);
	}
	} else if (BP_GET_TYPE(bp) == DMU_OT_OBJSET) {
	objset_phys_t *osp = buf->b_data;

	dsl_scan_prefetch_dnode(scn, &osp->os_meta_dnode,
	zb->zb_objset, DMU_META_DNODE_OBJECT);

	if (OBJSET_BUF_HAS_USERUSED(buf)) {
	dsl_scan_prefetch_dnode(scn,
	&osp->os_groupused_dnode, zb->zb_objset,
	DMU_GROUPUSED_OBJECT);
	dsl_scan_prefetch_dnode(scn,
	&osp->os_userused_dnode, zb->zb_objset,
	DMU_USERUSED_OBJECT);
	}
	}

	out:
	if (buf != NULL)
	arc_buf_destroy(buf, private);
	scan_prefetch_ctx_rele(spc, scn);
	}

	/* ARGSUSED */
	static void
	dsl_scan_prefetch_thread(void *arg)
	{
	dsl_scan_t *scn = arg;
	spa_t *spa = scn->scn_dp->dp_spa;
	scan_prefetch_issue_ctx_t *spic;

	/* loop until we are told to stop */
	while (!scn->scn_prefetch_stop) {
	arc_flags_t flags = ARC_FLAG_NOWAIT \|
	ARC_FLAG_PRESCIENT_PREFETCH \| ARC_FLAG_PREFETCH;
	int zio_flags = ZIO_FLAG_CANFAIL \| ZIO_FLAG_SCAN_THREAD;

	mutex_enter(&spa->spa_scrub_lock);

	/*
	* Wait until we have an IO to issue and are not above our
	* maximum in flight limit.
	*/
	while (!scn->scn_prefetch_stop &&
	(avl_numnodes(&scn->scn_prefetch_queue) == 0 \|\|
	spa->spa_scrub_inflight >= scn->scn_maxinflight_bytes)) {
	cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
	}

	/* recheck if we should stop since we waited for the cv */
	if (scn->scn_prefetch_stop) {
	mutex_exit(&spa->spa_scrub_lock);
	break;
	}

	/* remove the prefetch IO from the tree */
	spic = avl_first(&scn->scn_prefetch_queue);
	spa->spa_scrub_inflight += BP_GET_PSIZE(&spic->spic_bp);
	avl_remove(&scn->scn_prefetch_queue, spic);

	mutex_exit(&spa->spa_scrub_lock);

	if (BP_IS_PROTECTED(&spic->spic_bp)) {
	ASSERT(BP_GET_TYPE(&spic->spic_bp) == DMU_OT_DNODE \|\|
	BP_GET_TYPE(&spic->spic_bp) == DMU_OT_OBJSET);
	ASSERT3U(BP_GET_LEVEL(&spic->spic_bp), ==, 0);
	zio_flags \|= ZIO_FLAG_RAW;
	}

	/* issue the prefetch asynchronously */
	(void) arc_read(scn->scn_zio_root, scn->scn_dp->dp_spa,
	&spic->spic_bp, dsl_scan_prefetch_cb, spic->spic_spc,
	ZIO_PRIORITY_SCRUB, zio_flags, &flags, &spic->spic_zb);

	kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
	}

	ASSERT(scn->scn_prefetch_stop);

	/* free any prefetches we didn't get to complete */
	mutex_enter(&spa->spa_scrub_lock);
	while ((spic = avl_first(&scn->scn_prefetch_queue)) != NULL) {
	avl_remove(&scn->scn_prefetch_queue, spic);
	scan_prefetch_ctx_rele(spic->spic_spc, scn);
	kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
	}
	ASSERT0(avl_numnodes(&scn->scn_prefetch_queue));
	mutex_exit(&spa->spa_scrub_lock);
	}

	static boolean_t
	dsl_scan_check_resume(dsl_scan_t scn, const dnode_phys_t dnp,
	const zbookmark_phys_t *zb)
	{
	/*
	* We never skip over user/group accounting objects (obj<0)
	*/
	if (!ZB_IS_ZERO(&scn->scn_phys.scn_bookmark) &&
	(int64_t)zb->zb_object >= 0) {
	/*
	* If we already visited this bp & everything below (in
	* a prior txg sync), don't bother doing it again.
	*/
	if (zbookmark_subtree_completed(dnp, zb,
	&scn->scn_phys.scn_bookmark))
	return (B_TRUE);

	/*
	* If we found the block we're trying to resume from, or
	* we went past it to a different object, zero it out to
	* indicate that it's OK to start checking for suspending
	* again.
	*/
	if (bcmp(zb, &scn->scn_phys.scn_bookmark, sizeof (*zb)) == 0 \|\|
	zb->zb_object > scn->scn_phys.scn_bookmark.zb_object) {
	dprintf("resuming at %llx/%llx/%llx/%llx\n",
	(longlong_t)zb->zb_objset,
	(longlong_t)zb->zb_object,
	(longlong_t)zb->zb_level,
	(longlong_t)zb->zb_blkid);
	bzero(&scn->scn_phys.scn_bookmark, sizeof (*zb));
	}
	}
	return (B_FALSE);
	}

	static void dsl_scan_visitbp(blkptr_t bp, const zbookmark_phys_t zb,
	dnode_phys_t dnp, dsl_dataset_t ds, dsl_scan_t *scn,
	dmu_objset_type_t ostype, dmu_tx_t *tx);
	inline __attribute__((always_inline)) static void dsl_scan_visitdnode(
	dsl_scan_t , dsl_dataset_t ds, dmu_objset_type_t ostype,
	dnode_phys_t dnp, uint64_t object, dmu_tx_t tx);

	/*
	* Return nonzero on i/o error.
	* Return new buf to write out in *bufp.
	*/
	inline __attribute__((always_inline)) static int
	dsl_scan_recurse(dsl_scan_t scn, dsl_dataset_t ds, dmu_objset_type_t ostype,
	dnode_phys_t dnp, const blkptr_t bp,
	const zbookmark_phys_t zb, dmu_tx_t tx)
	{
	dsl_pool_t *dp = scn->scn_dp;
	int zio_flags = ZIO_FLAG_CANFAIL \| ZIO_FLAG_SCAN_THREAD;
	int err;

	ASSERT(!BP_IS_REDACTED(bp));

	if (BP_GET_LEVEL(bp) > 0) {
	arc_flags_t flags = ARC_FLAG_WAIT;
	int i;
	blkptr_t *cbp;
	int epb = BP_GET_LSIZE(bp) >> SPA_BLKPTRSHIFT;
	arc_buf_t *buf;

	err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
	ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
	if (err) {
	scn->scn_phys.scn_errors++;
	return (err);
	}
	for (i = 0, cbp = buf->b_data; i < epb; i++, cbp++) {
	zbookmark_phys_t czb;

	SET_BOOKMARK(&czb, zb->zb_objset, zb->zb_object,
	zb->zb_level - 1,
	zb->zb_blkid * epb + i);
	dsl_scan_visitbp(cbp, &czb, dnp,
	ds, scn, ostype, tx);
	}
	arc_buf_destroy(buf, &buf);
	} else if (BP_GET_TYPE(bp) == DMU_OT_DNODE) {
	arc_flags_t flags = ARC_FLAG_WAIT;
	dnode_phys_t *cdnp;
	int i;
	int epb = BP_GET_LSIZE(bp) >> DNODE_SHIFT;
	arc_buf_t *buf;

	if (BP_IS_PROTECTED(bp)) {
	ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
	zio_flags \|= ZIO_FLAG_RAW;
	}

	err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
	ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
	if (err) {
	scn->scn_phys.scn_errors++;
	return (err);
	}
	for (i = 0, cdnp = buf->b_data; i < epb;
	i += cdnp->dn_extra_slots + 1,
	cdnp += cdnp->dn_extra_slots + 1) {
	dsl_scan_visitdnode(scn, ds, ostype,
	cdnp, zb->zb_blkid * epb + i, tx);
	}

	arc_buf_destroy(buf, &buf);
	} else if (BP_GET_TYPE(bp) == DMU_OT_OBJSET) {
	arc_flags_t flags = ARC_FLAG_WAIT;
	objset_phys_t *osp;
	arc_buf_t *buf;

	err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
	ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
	if (err) {
	scn->scn_phys.scn_errors++;
	return (err);
	}

	osp = buf->b_data;

	dsl_scan_visitdnode(scn, ds, osp->os_type,
	&osp->os_meta_dnode, DMU_META_DNODE_OBJECT, tx);

	if (OBJSET_BUF_HAS_USERUSED(buf)) {
	/*
	* We also always visit user/group/project accounting
	* objects, and never skip them, even if we are
	* suspending. This is necessary so that the
	* space deltas from this txg get integrated.
	*/
	if (OBJSET_BUF_HAS_PROJECTUSED(buf))
	dsl_scan_visitdnode(scn, ds, osp->os_type,
	&osp->os_projectused_dnode,
	DMU_PROJECTUSED_OBJECT, tx);
	dsl_scan_visitdnode(scn, ds, osp->os_type,
	&osp->os_groupused_dnode,
	DMU_GROUPUSED_OBJECT, tx);
	dsl_scan_visitdnode(scn, ds, osp->os_type,
	&osp->os_userused_dnode,
	DMU_USERUSED_OBJECT, tx);
	}
	arc_buf_destroy(buf, &buf);
	}

	return (0);
	}

	inline __attribute__((always_inline)) static void
	dsl_scan_visitdnode(dsl_scan_t scn, dsl_dataset_t ds,
	dmu_objset_type_t ostype, dnode_phys_t *dnp,
	uint64_t object, dmu_tx_t *tx)
	{
	int j;

	for (j = 0; j < dnp->dn_nblkptr; j++) {
	zbookmark_phys_t czb;

	SET_BOOKMARK(&czb, ds ? ds->ds_object : 0, object,
	dnp->dn_nlevels - 1, j);
	dsl_scan_visitbp(&dnp->dn_blkptr[j],
	&czb, dnp, ds, scn, ostype, tx);
	}

	if (dnp->dn_flags & DNODE_FLAG_SPILL_BLKPTR) {
	zbookmark_phys_t czb;
	SET_BOOKMARK(&czb, ds ? ds->ds_object : 0, object,
	0, DMU_SPILL_BLKID);
	dsl_scan_visitbp(DN_SPILL_BLKPTR(dnp),
	&czb, dnp, ds, scn, ostype, tx);
	}
	}

	/*
	* The arguments are in this order because mdb can only print the
	* first 5; we want them to be useful.
	*/
	static void
	dsl_scan_visitbp(blkptr_t bp, const zbookmark_phys_t zb,
	dnode_phys_t dnp, dsl_dataset_t ds, dsl_scan_t *scn,
	dmu_objset_type_t ostype, dmu_tx_t *tx)
	{
	dsl_pool_t *dp = scn->scn_dp;
	blkptr_t *bp_toread = NULL;

	if (dsl_scan_check_suspend(scn, zb))
	return;

	if (dsl_scan_check_resume(scn, dnp, zb))
	return;

	scn->scn_visited_this_txg++;

	/*
	* This debugging is commented out to conserve stack space. This
	* function is called recursively and the debugging adds several
	* bytes to the stack for each call. It can be commented back in
	* if required to debug an issue in dsl_scan_visitbp().
	*
	* dprintf_bp(bp,
	* "visiting ds=%p/%llu zb=%llx/%llx/%llx/%llx bp=%p",
	* ds, ds ? ds->ds_object : 0,
	* zb->zb_objset, zb->zb_object, zb->zb_level, zb->zb_blkid,
	* bp);
	*/

	if (BP_IS_HOLE(bp)) {
	scn->scn_holes_this_txg++;
	return;
	}

	if (BP_IS_REDACTED(bp)) {
	ASSERT(dsl_dataset_feature_is_active(ds,
	SPA_FEATURE_REDACTED_DATASETS));
	return;
	}

	if (bp->blk_birth <= scn->scn_phys.scn_cur_min_txg) {
	scn->scn_lt_min_this_txg++;
	return;
	}

	bp_toread = kmem_alloc(sizeof (blkptr_t), KM_SLEEP);
	bp_toread = bp;

	if (dsl_scan_recurse(scn, ds, ostype, dnp, bp_toread, zb, tx) != 0)
	goto out;

	/*
	* If dsl_scan_ddt() has already visited this block, it will have
	* already done any translations or scrubbing, so don't call the
	* callback again.
	*/
	if (ddt_class_contains(dp->dp_spa,
	scn->scn_phys.scn_ddt_class_max, bp)) {
	scn->scn_ddt_contained_this_txg++;
	goto out;
	}

	/*
	* If this block is from the future (after cur_max_txg), then we
	* are doing this on behalf of a deleted snapshot, and we will
	* revisit the future block on the next pass of this dataset.
	* Don't scan it now unless we need to because something
	* under it was modified.
	*/
	if (BP_PHYSICAL_BIRTH(bp) > scn->scn_phys.scn_cur_max_txg) {
	scn->scn_gt_max_this_txg++;
	goto out;
	}

	scan_funcs[scn->scn_phys.scn_func](dp, bp, zb);

	out:
	kmem_free(bp_toread, sizeof (blkptr_t));
	}

	static void
	dsl_scan_visit_rootbp(dsl_scan_t scn, dsl_dataset_t ds, blkptr_t *bp,
	dmu_tx_t *tx)
	{
	zbookmark_phys_t zb;
	scan_prefetch_ctx_t *spc;

	SET_BOOKMARK(&zb, ds ? ds->ds_object : DMU_META_OBJSET,
	ZB_ROOT_OBJECT, ZB_ROOT_LEVEL, ZB_ROOT_BLKID);

	if (ZB_IS_ZERO(&scn->scn_phys.scn_bookmark)) {
	SET_BOOKMARK(&scn->scn_prefetch_bookmark,
	zb.zb_objset, 0, 0, 0);
	} else {
	scn->scn_prefetch_bookmark = scn->scn_phys.scn_bookmark;
	}

	scn->scn_objsets_visited_this_txg++;

	spc = scan_prefetch_ctx_create(scn, NULL, FTAG);
	dsl_scan_prefetch(spc, bp, &zb);
	scan_prefetch_ctx_rele(spc, FTAG);

	dsl_scan_visitbp(bp, &zb, NULL, ds, scn, DMU_OST_NONE, tx);

	dprintf_ds(ds, "finished scan%s", "");
	}

	static void
	ds_destroyed_scn_phys(dsl_dataset_t ds, dsl_scan_phys_t scn_phys)
	{
	if (scn_phys->scn_bookmark.zb_objset == ds->ds_object) {
	if (ds->ds_is_snapshot) {
	/*
	* Note:
	* - scn_cur_{min,max}_txg stays the same.
	* - Setting the flag is not really necessary if
	* scn_cur_max_txg == scn_max_txg, because there
	* is nothing after this snapshot that we care
	* about. However, we set it anyway and then
	* ignore it when we retraverse it in
	* dsl_scan_visitds().
	*/
	scn_phys->scn_bookmark.zb_objset =
	dsl_dataset_phys(ds)->ds_next_snap_obj;
	zfs_dbgmsg("destroying ds %llu; currently traversing; "
	"reset zb_objset to %llu",
	(u_longlong_t)ds->ds_object,
	(u_longlong_t)dsl_dataset_phys(ds)->
	ds_next_snap_obj);
	scn_phys->scn_flags \|= DSF_VISIT_DS_AGAIN;
	} else {
	SET_BOOKMARK(&scn_phys->scn_bookmark,
	ZB_DESTROYED_OBJSET, 0, 0, 0);
	zfs_dbgmsg("destroying ds %llu; currently traversing; "
	"reset bookmark to -1,0,0,0",
	(u_longlong_t)ds->ds_object);
	}
	}
	}

	/*
	* Invoked when a dataset is destroyed. We need to make sure that:
	*
	* 1) If it is the dataset that was currently being scanned, we write
	* a new dsl_scan_phys_t and marking the objset reference in it
	* as destroyed.
	* 2) Remove it from the work queue, if it was present.
	*
	* If the dataset was actually a snapshot, instead of marking the dataset
	* as destroyed, we instead substitute the next snapshot in line.
	*/
	void
	dsl_scan_ds_destroyed(dsl_dataset_t ds, dmu_tx_t tx)
	{
	dsl_pool_t *dp = ds->ds_dir->dd_pool;
	dsl_scan_t *scn = dp->dp_scan;
	uint64_t mintxg;

	if (!dsl_scan_is_running(scn))
	return;

	ds_destroyed_scn_phys(ds, &scn->scn_phys);
	ds_destroyed_scn_phys(ds, &scn->scn_phys_cached);

	if (scan_ds_queue_contains(scn, ds->ds_object, &mintxg)) {
	scan_ds_queue_remove(scn, ds->ds_object);
	if (ds->ds_is_snapshot)
	scan_ds_queue_insert(scn,
	dsl_dataset_phys(ds)->ds_next_snap_obj, mintxg);
	}

	if (zap_lookup_int_key(dp->dp_meta_objset, scn->scn_phys.scn_queue_obj,
	ds->ds_object, &mintxg) == 0) {
	ASSERT3U(dsl_dataset_phys(ds)->ds_num_children, <=, 1);
	VERIFY3U(0, ==, zap_remove_int(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, ds->ds_object, tx));
	if (ds->ds_is_snapshot) {
	/*
	* We keep the same mintxg; it could be >
	* ds_creation_txg if the previous snapshot was
	* deleted too.
	*/
	VERIFY(zap_add_int_key(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj,
	dsl_dataset_phys(ds)->ds_next_snap_obj,
	mintxg, tx) == 0);
	zfs_dbgmsg("destroying ds %llu; in queue; "
	"replacing with %llu",
	(u_longlong_t)ds->ds_object,
	(u_longlong_t)dsl_dataset_phys(ds)->
	ds_next_snap_obj);
	} else {
	zfs_dbgmsg("destroying ds %llu; in queue; removing",
	(u_longlong_t)ds->ds_object);
	}
	}

	/*
	* dsl_scan_sync() should be called after this, and should sync
	* out our changed state, but just to be safe, do it here.
	*/
	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
	}

	static void
	ds_snapshotted_bookmark(dsl_dataset_t ds, zbookmark_phys_t scn_bookmark)
	{
	if (scn_bookmark->zb_objset == ds->ds_object) {
	scn_bookmark->zb_objset =
	dsl_dataset_phys(ds)->ds_prev_snap_obj;
	zfs_dbgmsg("snapshotting ds %llu; currently traversing; "
	"reset zb_objset to %llu",
	(u_longlong_t)ds->ds_object,
	(u_longlong_t)dsl_dataset_phys(ds)->ds_prev_snap_obj);
	}
	}

	/*
	* Called when a dataset is snapshotted. If we were currently traversing
	* this snapshot, we reset our bookmark to point at the newly created
	* snapshot. We also modify our work queue to remove the old snapshot and
	* replace with the new one.
	*/
	void
	dsl_scan_ds_snapshotted(dsl_dataset_t ds, dmu_tx_t tx)
	{
	dsl_pool_t *dp = ds->ds_dir->dd_pool;
	dsl_scan_t *scn = dp->dp_scan;
	uint64_t mintxg;

	if (!dsl_scan_is_running(scn))
	return;

	ASSERT(dsl_dataset_phys(ds)->ds_prev_snap_obj != 0);

	ds_snapshotted_bookmark(ds, &scn->scn_phys.scn_bookmark);
	ds_snapshotted_bookmark(ds, &scn->scn_phys_cached.scn_bookmark);

	if (scan_ds_queue_contains(scn, ds->ds_object, &mintxg)) {
	scan_ds_queue_remove(scn, ds->ds_object);
	scan_ds_queue_insert(scn,
	dsl_dataset_phys(ds)->ds_prev_snap_obj, mintxg);
	}

	if (zap_lookup_int_key(dp->dp_meta_objset, scn->scn_phys.scn_queue_obj,
	ds->ds_object, &mintxg) == 0) {
	VERIFY3U(0, ==, zap_remove_int(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, ds->ds_object, tx));
	VERIFY(zap_add_int_key(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj,
	dsl_dataset_phys(ds)->ds_prev_snap_obj, mintxg, tx) == 0);
	zfs_dbgmsg("snapshotting ds %llu; in queue; "
	"replacing with %llu",
	(u_longlong_t)ds->ds_object,
	(u_longlong_t)dsl_dataset_phys(ds)->ds_prev_snap_obj);
	}

	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
	}

	static void
	ds_clone_swapped_bookmark(dsl_dataset_t ds1, dsl_dataset_t ds2,
	zbookmark_phys_t *scn_bookmark)
	{
	if (scn_bookmark->zb_objset == ds1->ds_object) {
	scn_bookmark->zb_objset = ds2->ds_object;
	zfs_dbgmsg("clone_swap ds %llu; currently traversing; "
	"reset zb_objset to %llu",
	(u_longlong_t)ds1->ds_object,
	(u_longlong_t)ds2->ds_object);
	} else if (scn_bookmark->zb_objset == ds2->ds_object) {
	scn_bookmark->zb_objset = ds1->ds_object;
	zfs_dbgmsg("clone_swap ds %llu; currently traversing; "
	"reset zb_objset to %llu",
	(u_longlong_t)ds2->ds_object,
	(u_longlong_t)ds1->ds_object);
	}
	}

	/*
	* Called when an origin dataset and its clone are swapped. If we were
	* currently traversing the dataset, we need to switch to traversing the
	* newly promoted clone.
	*/
	void
	dsl_scan_ds_clone_swapped(dsl_dataset_t ds1, dsl_dataset_t ds2, dmu_tx_t *tx)
	{
	dsl_pool_t *dp = ds1->ds_dir->dd_pool;
	dsl_scan_t *scn = dp->dp_scan;
	uint64_t mintxg1, mintxg2;
	boolean_t ds1_queued, ds2_queued;

	if (!dsl_scan_is_running(scn))
	return;

	ds_clone_swapped_bookmark(ds1, ds2, &scn->scn_phys.scn_bookmark);
	ds_clone_swapped_bookmark(ds1, ds2, &scn->scn_phys_cached.scn_bookmark);

	/*
	* Handle the in-memory scan queue.
	*/
	ds1_queued = scan_ds_queue_contains(scn, ds1->ds_object, &mintxg1);
	ds2_queued = scan_ds_queue_contains(scn, ds2->ds_object, &mintxg2);

	/* Sanity checking. */
	if (ds1_queued) {
	ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
	ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
	}
	if (ds2_queued) {
	ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
	ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
	}

	if (ds1_queued && ds2_queued) {
	/*
	* If both are queued, we don't need to do anything.
	* The swapping code below would not handle this case correctly,
	* since we can't insert ds2 if it is already there. That's
	* because scan_ds_queue_insert() prohibits a duplicate insert
	* and panics.
	*/
	} else if (ds1_queued) {
	scan_ds_queue_remove(scn, ds1->ds_object);
	scan_ds_queue_insert(scn, ds2->ds_object, mintxg1);
	} else if (ds2_queued) {
	scan_ds_queue_remove(scn, ds2->ds_object);
	scan_ds_queue_insert(scn, ds1->ds_object, mintxg2);
	}

	/*
	* Handle the on-disk scan queue.
	* The on-disk state is an out-of-date version of the in-memory state,
	* so the in-memory and on-disk values for ds1_queued and ds2_queued may
	* be different. Therefore we need to apply the swap logic to the
	* on-disk state independently of the in-memory state.
	*/
	ds1_queued = zap_lookup_int_key(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, ds1->ds_object, &mintxg1) == 0;
	ds2_queued = zap_lookup_int_key(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, ds2->ds_object, &mintxg2) == 0;

	/* Sanity checking. */
	if (ds1_queued) {
	ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
	ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
	}
	if (ds2_queued) {
	ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
	ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
	}

	if (ds1_queued && ds2_queued) {
	/*
	* If both are queued, we don't need to do anything.
	* Alternatively, we could check for EEXIST from
	* zap_add_int_key() and back out to the original state, but
	* that would be more work than checking for this case upfront.
	*/
	} else if (ds1_queued) {
	VERIFY3S(0, ==, zap_remove_int(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, ds1->ds_object, tx));
	VERIFY3S(0, ==, zap_add_int_key(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, ds2->ds_object, mintxg1, tx));
	zfs_dbgmsg("clone_swap ds %llu; in queue; "
	"replacing with %llu",
	(u_longlong_t)ds1->ds_object,
	(u_longlong_t)ds2->ds_object);
	} else if (ds2_queued) {
	VERIFY3S(0, ==, zap_remove_int(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, ds2->ds_object, tx));
	VERIFY3S(0, ==, zap_add_int_key(dp->dp_meta_objset,
	scn->scn_phys.scn_queue_obj, ds1->ds_object, mintxg2, tx));
	zfs_dbgmsg("clone_swap ds %llu; in queue; "
	"replacing with %llu",
	(u_longlong_t)ds2->ds_object,
	(u_longlong_t)ds1->ds_object);
	}

	dsl_scan_sync_state(scn, tx, SYNC_CACHED);
	}

	/* ARGSUSED */
	static int
	enqueue_clones_cb(dsl_pool_t dp, dsl_dataset_t hds, void *arg)
	{
	uint64_t originobj = (uint64_t )arg;
	dsl_dataset_t *ds;
	int err;
	dsl_scan_t *scn = dp->dp_scan;

	if (dsl_dir_phys(hds->ds_dir)->dd_origin_obj != originobj)
	return (0);

	err = dsl_dataset_hold_obj(dp, hds->ds_object, FTAG, &ds);
	if (err)
	return (err);

	while (dsl_dataset_phys(ds)->ds_prev_snap_obj != originobj) {
	dsl_dataset_t *prev;
	err = dsl_dataset_hold_obj(dp,
	dsl_dataset_phys(ds)->ds_prev_snap_obj, FTAG, &prev);

	dsl_dataset_rele(ds, FTAG);
	if (err)
	return (err);
	ds = prev;
	}
	scan_ds_queue_insert(scn, ds->ds_object,
	dsl_dataset_phys(ds)->ds_prev_snap_txg);
	dsl_dataset_rele(ds, FTAG);
	return (0);
	}

	static void
	dsl_scan_visitds(dsl_scan_t scn, uint64_t dsobj, dmu_tx_t tx)
	{
	dsl_pool_t *dp = scn->scn_dp;
	dsl_dataset_t *ds;

	VERIFY3U(0, ==, dsl_dataset_hold_obj(dp, dsobj, FTAG, &ds));

	if (scn->scn_phys.scn_cur_min_txg >=
	scn->scn_phys.scn_max_txg) {
	/*
	* This can happen if this snapshot was created after the
	* scan started, and we already completed a previous snapshot
	* that was created after the scan started. This snapshot
	* only references blocks with:
	*
	* birth < our ds_creation_txg
	* cur_min_txg is no less than ds_creation_txg.
	* We have already visited these blocks.
	* or
	* birth > scn_max_txg
	* The scan requested not to visit these blocks.
	*
	* Subsequent snapshots (and clones) can reference our
	* blocks, or blocks with even higher birth times.
	* Therefore we do not need to visit them either,
	* so we do not add them to the work queue.
	*
	* Note that checking for cur_min_txg >= cur_max_txg
	* is not sufficient, because in that case we may need to
	* visit subsequent snapshots. This happens when min_txg > 0,
	* which raises cur_min_txg. In this case we will visit
	* this dataset but skip all of its blocks, because the
	* rootbp's birth time is < cur_min_txg. Then we will
	* add the next snapshots/clones to the work queue.
	*/
	char *dsname = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP);
	dsl_dataset_name(ds, dsname);
	zfs_dbgmsg("scanning dataset %llu (%s) is unnecessary because "
	"cur_min_txg (%llu) >= max_txg (%llu)",
	(longlong_t)dsobj, dsname,
	(longlong_t)scn->scn_phys.scn_cur_min_txg,
	(longlong_t)scn->scn_phys.scn_max_txg);
	kmem_free(dsname, MAXNAMELEN);

	goto out;
	}

	/*
	* Only the ZIL in the head (non-snapshot) is valid. Even though
	* snapshots can have ZIL block pointers (which may be the same
	* BP as in the head), they must be ignored. In addition, $ORIGIN
	* doesn't have a objset (i.e. its ds_bp is a hole) so we don't
	* need to look for a ZIL in it either. So we traverse the ZIL here,
	* rather than in scan_recurse(), because the regular snapshot
	* block-sharing rules don't apply to it.
	*/
	if (!dsl_dataset_is_snapshot(ds) &&
	(dp->dp_origin_snap == NULL \|\|
	ds->ds_dir != dp->dp_origin_snap->ds_dir)) {
	objset_t *os;
	if (dmu_objset_from_ds(ds, &os) != 0) {
	goto out;
	}
	dsl_scan_zil(dp, &os->os_zil_header);
	}

	/*
	* Iterate over the bps in this ds.
	*/
	dmu_buf_will_dirty(ds->ds_dbuf, tx);
	rrw_enter(&ds->ds_bp_rwlock, RW_READER, FTAG);
	dsl_scan_visit_rootbp(scn, ds, &dsl_dataset_phys(ds)->ds_bp, tx);
	rrw_exit(&ds->ds_bp_rwlock, FTAG);

	char *dsname = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN, KM_SLEEP);
	dsl_dataset_name(ds, dsname);
	zfs_dbgmsg("scanned dataset %llu (%s) with min=%llu max=%llu; "
	"suspending=%u",
	(longlong_t)dsobj, dsname,
	(longlong_t)scn->scn_phys.scn_cur_min_txg,
	(longlong_t)scn->scn_phys.scn_cur_max_txg,
	(int)scn->scn_suspending);
	kmem_free(dsname, ZFS_MAX_DATASET_NAME_LEN);

	if (scn->scn_suspending)
	goto out;

	/*
	* We've finished this pass over this dataset.
	*/

	/*
	* If we did not completely visit this dataset, do another pass.
	*/
	if (scn->scn_phys.scn_flags & DSF_VISIT_DS_AGAIN) {
	zfs_dbgmsg("incomplete pass; visiting again");
	scn->scn_phys.scn_flags &= ~DSF_VISIT_DS_AGAIN;
	scan_ds_queue_insert(scn, ds->ds_object,
	scn->scn_phys.scn_cur_max_txg);
	goto out;
	}

	/*
	* Add descendant datasets to work queue.
	*/
	if (dsl_dataset_phys(ds)->ds_next_snap_obj != 0) {
	scan_ds_queue_insert(scn,
	dsl_dataset_phys(ds)->ds_next_snap_obj,
	dsl_dataset_phys(ds)->ds_creation_txg);
	}
	if (dsl_dataset_phys(ds)->ds_num_children > 1) {
	boolean_t usenext = B_FALSE;
	if (dsl_dataset_phys(ds)->ds_next_clones_obj != 0) {
	uint64_t count;
	/*
	* A bug in a previous version of the code could
	* cause upgrade_clones_cb() to not set
	* ds_next_snap_obj when it should, leading to a
	* missing entry. Therefore we can only use the
	* next_clones_obj when its count is correct.
	*/
	int err = zap_count(dp->dp_meta_objset,
	dsl_dataset_phys(ds)->ds_next_clones_obj, &count);
	if (err == 0 &&
	count == dsl_dataset_phys(ds)->ds_num_children - 1)
	usenext = B_TRUE;
	}

	if (usenext) {
	zap_cursor_t zc;
	zap_attribute_t za;
	for (zap_cursor_init(&zc, dp->dp_meta_objset,
	dsl_dataset_phys(ds)->ds_next_clones_obj);
	zap_cursor_retrieve(&zc, &za) == 0;
	(void) zap_cursor_advance(&zc)) {
	scan_ds_queue_insert(scn,
	zfs_strtonum(za.za_name, NULL),
	dsl_dataset_phys(ds)->ds_creation_txg);
	}
	zap_cursor_fini(&zc);
	} else {
	VERIFY0(dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
	enqueue_clones_cb, &ds->ds_object,
	DS_FIND_CHILDREN));
	}
	}

	out:
	dsl_dataset_rele(ds, FTAG);
	}

	/* ARGSUSED */
	static int
	enqueue_cb(dsl_pool_t dp, dsl_dataset_t hds, void *arg)
	{
	dsl_dataset_t *ds;
	int err;
	dsl_scan_t *scn = dp->dp_scan;

	err = dsl_dataset_hold_obj(dp, hds->ds_object, FTAG, &ds);
	if (err)
	return (err);

	while (dsl_dataset_phys(ds)->ds_prev_snap_obj != 0) {
	dsl_dataset_t *prev;
	err = dsl_dataset_hold_obj(dp,
	dsl_dataset_phys(ds)->ds_prev_snap_obj, FTAG, &prev);
	if (err) {
	dsl_dataset_rele(ds, FTAG);
	return (err);
	}

	/*
	* If this is a clone, we don't need to worry about it for now.
	*/
	if (dsl_dataset_phys(prev)->ds_next_snap_obj != ds->ds_object) {
	dsl_dataset_rele(ds, FTAG);
	dsl_dataset_rele(prev, FTAG);
	return (0);
	}
	dsl_dataset_rele(ds, FTAG);
	ds = prev;
	}

	scan_ds_queue_insert(scn, ds->ds_object,
	dsl_dataset_phys(ds)->ds_prev_snap_txg);
	dsl_dataset_rele(ds, FTAG);
	return (0);
	}

	/* ARGSUSED */
	void
	dsl_scan_ddt_entry(dsl_scan_t *scn, enum zio_checksum checksum,
	ddt_entry_t dde, dmu_tx_t tx)
	{
	const ddt_key_t *ddk = &dde->dde_key;
	ddt_phys_t *ddp = dde->dde_phys;
	blkptr_t bp;
	zbookmark_phys_t zb = { 0 };
	int p;

	if (!dsl_scan_is_running(scn))
	return;

	/*
	* This function is special because it is the only thing
	* that can add scan_io_t's to the vdev scan queues from
	* outside dsl_scan_sync(). For the most part this is ok
	* as long as it is called from within syncing context.
	* However, dsl_scan_sync() expects that no new sio's will
	* be added between when all the work for a scan is done
	* and the next txg when the scan is actually marked as
	* completed. This check ensures we do not issue new sio's
	* during this period.
	*/
	if (scn->scn_done_txg != 0)
	return;

	for (p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
	if (ddp->ddp_phys_birth == 0 \|\|
	ddp->ddp_phys_birth > scn->scn_phys.scn_max_txg)
	continue;
	ddt_bp_create(checksum, ddk, ddp, &bp);

	scn->scn_visited_this_txg++;
	scan_funcs[scn->scn_phys.scn_func](scn->scn_dp, &bp, &zb);
	}
	}

	/*
	* Scrub/dedup interaction.
	*
	* If there are N references to a deduped block, we don't want to scrub it
	* N times -- ideally, we should scrub it exactly once.
	*
	* We leverage the fact that the dde's replication class (enum ddt_class)
	* is ordered from highest replication class (DDT_CLASS_DITTO) to lowest
	* (DDT_CLASS_UNIQUE) so that we may walk the DDT in that order.
	*
	* To prevent excess scrubbing, the scrub begins by walking the DDT
	* to find all blocks with refcnt > 1, and scrubs each of these once.
	* Since there are two replication classes which contain blocks with
	* refcnt > 1, we scrub the highest replication class (DDT_CLASS_DITTO) first.
	* Finally the top-down scrub begins, only visiting blocks with refcnt == 1.
	*
	* There would be nothing more to say if a block's refcnt couldn't change
	* during a scrub, but of course it can so we must account for changes
	* in a block's replication class.
	*
	* Here's an example of what can occur:
	*
	* If a block has refcnt > 1 during the DDT scrub phase, but has refcnt == 1
	* when visited during the top-down scrub phase, it will be scrubbed twice.
	* This negates our scrub optimization, but is otherwise harmless.
	*
	* If a block has refcnt == 1 during the DDT scrub phase, but has refcnt > 1
	* on each visit during the top-down scrub phase, it will never be scrubbed.
	* To catch this, ddt_sync_entry() notifies the scrub code whenever a block's
	* reference class transitions to a higher level (i.e DDT_CLASS_UNIQUE to
	* DDT_CLASS_DUPLICATE); if it transitions from refcnt == 1 to refcnt > 1
	* while a scrub is in progress, it scrubs the block right then.
	*/
	static void
	dsl_scan_ddt(dsl_scan_t scn, dmu_tx_t tx)
	{
	ddt_bookmark_t *ddb = &scn->scn_phys.scn_ddt_bookmark;
	ddt_entry_t dde;
	int error;
	uint64_t n = 0;

	bzero(&dde, sizeof (ddt_entry_t));

	while ((error = ddt_walk(scn->scn_dp->dp_spa, ddb, &dde)) == 0) {
	ddt_t *ddt;

	if (ddb->ddb_class > scn->scn_phys.scn_ddt_class_max)
	break;
	dprintf("visiting ddb=%llu/%llu/%llu/%llx\n",
	(longlong_t)ddb->ddb_class,
	(longlong_t)ddb->ddb_type,
	(longlong_t)ddb->ddb_checksum,
	(longlong_t)ddb->ddb_cursor);

	/* There should be no pending changes to the dedup table */
	ddt = scn->scn_dp->dp_spa->spa_ddt[ddb->ddb_checksum];
	ASSERT(avl_first(&ddt->ddt_tree) == NULL);

	dsl_scan_ddt_entry(scn, ddb->ddb_checksum, &dde, tx);
	n++;

	if (dsl_scan_check_suspend(scn, NULL))
	break;
	}

	zfs_dbgmsg("scanned %llu ddt entries with class_max = %u; "
	"suspending=%u", (longlong_t)n,
	(int)scn->scn_phys.scn_ddt_class_max, (int)scn->scn_suspending);

	ASSERT(error == 0 \|\| error == ENOENT);
	ASSERT(error != ENOENT \|\|
	ddb->ddb_class > scn->scn_phys.scn_ddt_class_max);
	}

	static uint64_t
	dsl_scan_ds_maxtxg(dsl_dataset_t *ds)
	{
	uint64_t smt = ds->ds_dir->dd_pool->dp_scan->scn_phys.scn_max_txg;
	if (ds->ds_is_snapshot)
	return (MIN(smt, dsl_dataset_phys(ds)->ds_creation_txg));
	return (smt);
	}

	static void
	dsl_scan_visit(dsl_scan_t scn, dmu_tx_t tx)
	{
	scan_ds_t *sds;
	dsl_pool_t *dp = scn->scn_dp;

	if (scn->scn_phys.scn_ddt_bookmark.ddb_class <=
	scn->scn_phys.scn_ddt_class_max) {
	scn->scn_phys.scn_cur_min_txg = scn->scn_phys.scn_min_txg;
	scn->scn_phys.scn_cur_max_txg = scn->scn_phys.scn_max_txg;
	dsl_scan_ddt(scn, tx);
	if (scn->scn_suspending)
	return;
	}

	if (scn->scn_phys.scn_bookmark.zb_objset == DMU_META_OBJSET) {
	/* First do the MOS & ORIGIN */

	scn->scn_phys.scn_cur_min_txg = scn->scn_phys.scn_min_txg;
	scn->scn_phys.scn_cur_max_txg = scn->scn_phys.scn_max_txg;
	dsl_scan_visit_rootbp(scn, NULL,
	&dp->dp_meta_rootbp, tx);
	spa_set_rootblkptr(dp->dp_spa, &dp->dp_meta_rootbp);
	if (scn->scn_suspending)
	return;

	if (spa_version(dp->dp_spa) < SPA_VERSION_DSL_SCRUB) {
	VERIFY0(dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
	enqueue_cb, NULL, DS_FIND_CHILDREN));
	} else {
	dsl_scan_visitds(scn,
	dp->dp_origin_snap->ds_object, tx);
	}
	ASSERT(!scn->scn_suspending);
	} else if (scn->scn_phys.scn_bookmark.zb_objset !=
	ZB_DESTROYED_OBJSET) {
	uint64_t dsobj = scn->scn_phys.scn_bookmark.zb_objset;
	/*
	* If we were suspended, continue from here. Note if the
	* ds we were suspended on was deleted, the zb_objset may
	* be -1, so we will skip this and find a new objset
	* below.
	*/
	dsl_scan_visitds(scn, dsobj, tx);
	if (scn->scn_suspending)
	return;
	}

	/*
	* In case we suspended right at the end of the ds, zero the
	* bookmark so we don't think that we're still trying to resume.
	*/
	bzero(&scn->scn_phys.scn_bookmark, sizeof (zbookmark_phys_t));

	/*
	* Keep pulling things out of the dataset avl queue. Updates to the
	* persistent zap-object-as-queue happen only at checkpoints.
	*/
	while ((sds = avl_first(&scn->scn_queue)) != NULL) {
	dsl_dataset_t *ds;
	uint64_t dsobj = sds->sds_dsobj;
	uint64_t txg = sds->sds_txg;

	/* dequeue and free the ds from the queue */
	scan_ds_queue_remove(scn, dsobj);
	sds = NULL;

	/* set up min / max txg */
	VERIFY3U(0, ==, dsl_dataset_hold_obj(dp, dsobj, FTAG, &ds));
	if (txg != 0) {
	scn->scn_phys.scn_cur_min_txg =
	MAX(scn->scn_phys.scn_min_txg, txg);
	} else {
	scn->scn_phys.scn_cur_min_txg =
	MAX(scn->scn_phys.scn_min_txg,
	dsl_dataset_phys(ds)->ds_prev_snap_txg);
	}
	scn->scn_phys.scn_cur_max_txg = dsl_scan_ds_maxtxg(ds);
	dsl_dataset_rele(ds, FTAG);

	dsl_scan_visitds(scn, dsobj, tx);
	if (scn->scn_suspending)
	return;
	}

	/* No more objsets to fetch, we're done */
	scn->scn_phys.scn_bookmark.zb_objset = ZB_DESTROYED_OBJSET;
	ASSERT0(scn->scn_suspending);
	}

	static uint64_t
	dsl_scan_count_leaves(vdev_t *vd)
	{
	uint64_t i, leaves = 0;

	/* we only count leaves that belong to the main pool and are readable */
	if (vd->vdev_islog \|\| vd->vdev_isspare \|\|
	vd->vdev_isl2cache \|\| !vdev_readable(vd))
	return (0);

	if (vd->vdev_ops->vdev_op_leaf)
	return (1);

	for (i = 0; i < vd->vdev_children; i++) {
	leaves += dsl_scan_count_leaves(vd->vdev_child[i]);
	}

	return (leaves);
	}

	static void
	scan_io_queues_update_zio_stats(dsl_scan_io_queue_t q, const blkptr_t bp)
	{
	int i;
	uint64_t cur_size = 0;

	for (i = 0; i < BP_GET_NDVAS(bp); i++) {
	cur_size += DVA_GET_ASIZE(&bp->blk_dva[i]);
	}

	q->q_total_zio_size_this_txg += cur_size;
	q->q_zios_this_txg++;
	}

	static void
	scan_io_queues_update_seg_stats(dsl_scan_io_queue_t *q, uint64_t start,
	uint64_t end)
	{
	q->q_total_seg_size_this_txg += end - start;
	q->q_segs_this_txg++;
	}

	static boolean_t
	scan_io_queue_check_suspend(dsl_scan_t *scn)
	{
	/* See comment in dsl_scan_check_suspend() */
	uint64_t curr_time_ns = gethrtime();
	uint64_t scan_time_ns = curr_time_ns - scn->scn_sync_start_time;
	uint64_t sync_time_ns = curr_time_ns -
	scn->scn_dp->dp_spa->spa_sync_starttime;
	int dirty_pct = scn->scn_dp->dp_dirty_total * 100 / zfs_dirty_data_max;
	int mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
	zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;

	return ((NSEC2MSEC(scan_time_ns) > mintime &&
	(dirty_pct >= zfs_vdev_async_write_active_min_dirty_percent \|\|
	txg_sync_waiting(scn->scn_dp) \|\|
	NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) \|\|
	spa_shutting_down(scn->scn_dp->dp_spa));
	}

	/*
	* Given a list of scan_io_t's in io_list, this issues the I/Os out to
	* disk. This consumes the io_list and frees the scan_io_t's. This is
	* called when emptying queues, either when we're up against the memory
	* limit or when we have finished scanning. Returns B_TRUE if we stopped
	* processing the list before we finished. Any sios that were not issued
	* will remain in the io_list.
	*/
	static boolean_t
	scan_io_queue_issue(dsl_scan_io_queue_t queue, list_t io_list)
	{
	dsl_scan_t *scn = queue->q_scn;
	scan_io_t *sio;
	int64_t bytes_issued = 0;
	boolean_t suspended = B_FALSE;

	while ((sio = list_head(io_list)) != NULL) {
	blkptr_t bp;

	if (scan_io_queue_check_suspend(scn)) {
	suspended = B_TRUE;
	break;
	}

	sio2bp(sio, &bp);
	bytes_issued += SIO_GET_ASIZE(sio);
	scan_exec_io(scn->scn_dp, &bp, sio->sio_flags,
	&sio->sio_zb, queue);
	(void) list_remove_head(io_list);
	scan_io_queues_update_zio_stats(queue, &bp);
	sio_free(sio);
	}

	atomic_add_64(&scn->scn_bytes_pending, -bytes_issued);

	return (suspended);
	}

	/*
	* This function removes sios from an IO queue which reside within a given
	* range_seg_t and inserts them (in offset order) into a list. Note that
	* we only ever return a maximum of 32 sios at once. If there are more sios
	* to process within this segment that did not make it onto the list we
	* return B_TRUE and otherwise B_FALSE.
	*/
	static boolean_t
	scan_io_queue_gather(dsl_scan_io_queue_t queue, range_seg_t rs, list_t *list)
	{
	scan_io_t srch_sio, sio, *next_sio;
	avl_index_t idx;
	uint_t num_sios = 0;
	int64_t bytes_issued = 0;

	ASSERT(rs != NULL);
	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));

	srch_sio = sio_alloc(1);
	srch_sio->sio_nr_dvas = 1;
	SIO_SET_OFFSET(srch_sio, rs_get_start(rs, queue->q_exts_by_addr));

	/*
	* The exact start of the extent might not contain any matching zios,
	* so if that's the case, examine the next one in the tree.
	*/
	sio = avl_find(&queue->q_sios_by_addr, srch_sio, &idx);
	sio_free(srch_sio);

	if (sio == NULL)
	sio = avl_nearest(&queue->q_sios_by_addr, idx, AVL_AFTER);

	while (sio != NULL && SIO_GET_OFFSET(sio) < rs_get_end(rs,
	queue->q_exts_by_addr) && num_sios <= 32) {
	ASSERT3U(SIO_GET_OFFSET(sio), >=, rs_get_start(rs,
	queue->q_exts_by_addr));
	ASSERT3U(SIO_GET_END_OFFSET(sio), <=, rs_get_end(rs,
	queue->q_exts_by_addr));

	next_sio = AVL_NEXT(&queue->q_sios_by_addr, sio);
	avl_remove(&queue->q_sios_by_addr, sio);
	queue->q_sio_memused -= SIO_GET_MUSED(sio);

	bytes_issued += SIO_GET_ASIZE(sio);
	num_sios++;
	list_insert_tail(list, sio);
	sio = next_sio;
	}

	/*
	* We limit the number of sios we process at once to 32 to avoid
	* biting off more than we can chew. If we didn't take everything
	* in the segment we update it to reflect the work we were able to
	* complete. Otherwise, we remove it from the range tree entirely.
	*/
	if (sio != NULL && SIO_GET_OFFSET(sio) < rs_get_end(rs,
	queue->q_exts_by_addr)) {
	range_tree_adjust_fill(queue->q_exts_by_addr, rs,
	-bytes_issued);
	range_tree_resize_segment(queue->q_exts_by_addr, rs,
	SIO_GET_OFFSET(sio), rs_get_end(rs,
	queue->q_exts_by_addr) - SIO_GET_OFFSET(sio));

	return (B_TRUE);
	} else {
	uint64_t rstart = rs_get_start(rs, queue->q_exts_by_addr);
	uint64_t rend = rs_get_end(rs, queue->q_exts_by_addr);
	range_tree_remove(queue->q_exts_by_addr, rstart, rend - rstart);
	return (B_FALSE);
	}
	}

	/*
	* This is called from the queue emptying thread and selects the next
	* extent from which we are to issue I/Os. The behavior of this function
	* depends on the state of the scan, the current memory consumption and
	* whether or not we are performing a scan shutdown.
	* 1) We select extents in an elevator algorithm (LBA-order) if the scan
	* needs to perform a checkpoint
	* 2) We select the largest available extent if we are up against the
	* memory limit.
	* 3) Otherwise we don't select any extents.
	*/
	static range_seg_t *
	scan_io_queue_fetch_ext(dsl_scan_io_queue_t *queue)
	{
	dsl_scan_t *scn = queue->q_scn;
	range_tree_t *rt = queue->q_exts_by_addr;

	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
	ASSERT(scn->scn_is_sorted);

	/* handle tunable overrides */
	if (scn->scn_checkpointing \|\| scn->scn_clearing) {
	if (zfs_scan_issue_strategy == 1) {
	return (range_tree_first(rt));
	} else if (zfs_scan_issue_strategy == 2) {
	/*
	* We need to get the original entry in the by_addr
	* tree so we can modify it.
	*/
	range_seg_t *size_rs =
	zfs_btree_first(&queue->q_exts_by_size, NULL);
	if (size_rs == NULL)
	return (NULL);
	uint64_t start = rs_get_start(size_rs, rt);
	uint64_t size = rs_get_end(size_rs, rt) - start;
	range_seg_t *addr_rs = range_tree_find(rt, start,
	size);
	ASSERT3P(addr_rs, !=, NULL);
	ASSERT3U(rs_get_start(size_rs, rt), ==,
	rs_get_start(addr_rs, rt));
	ASSERT3U(rs_get_end(size_rs, rt), ==,
	rs_get_end(addr_rs, rt));
	return (addr_rs);
	}
	}

	/*
	* During normal clearing, we want to issue our largest segments
	* first, keeping IO as sequential as possible, and leaving the
	* smaller extents for later with the hope that they might eventually
	* grow to larger sequential segments. However, when the scan is
	* checkpointing, no new extents will be added to the sorting queue,
	* so the way we are sorted now is as good as it will ever get.
	* In this case, we instead switch to issuing extents in LBA order.
	*/
	if (scn->scn_checkpointing) {
	return (range_tree_first(rt));
	} else if (scn->scn_clearing) {
	/*
	* We need to get the original entry in the by_addr
	* tree so we can modify it.
	*/
	range_seg_t *size_rs = zfs_btree_first(&queue->q_exts_by_size,
	NULL);
	if (size_rs == NULL)
	return (NULL);
	uint64_t start = rs_get_start(size_rs, rt);
	uint64_t size = rs_get_end(size_rs, rt) - start;
	range_seg_t *addr_rs = range_tree_find(rt, start, size);
	ASSERT3P(addr_rs, !=, NULL);
	ASSERT3U(rs_get_start(size_rs, rt), ==, rs_get_start(addr_rs,
	rt));
	ASSERT3U(rs_get_end(size_rs, rt), ==, rs_get_end(addr_rs, rt));
	return (addr_rs);
	} else {
	return (NULL);
	}
	}

	static void
	scan_io_queues_run_one(void *arg)
	{
	dsl_scan_io_queue_t *queue = arg;
	kmutex_t *q_lock = &queue->q_vd->vdev_scan_io_queue_lock;
	boolean_t suspended = B_FALSE;
	range_seg_t *rs = NULL;
	scan_io_t *sio = NULL;
	list_t sio_list;
	uint64_t bytes_per_leaf = zfs_scan_vdev_limit;
	uint64_t nr_leaves = dsl_scan_count_leaves(queue->q_vd);

	ASSERT(queue->q_scn->scn_is_sorted);

	list_create(&sio_list, sizeof (scan_io_t),
	offsetof(scan_io_t, sio_nodes.sio_list_node));
	mutex_enter(q_lock);

	/* calculate maximum in-flight bytes for this txg (min 1MB) */
	queue->q_maxinflight_bytes =
	MAX(nr_leaves * bytes_per_leaf, 1ULL << 20);

	/* reset per-queue scan statistics for this txg */
	queue->q_total_seg_size_this_txg = 0;
	queue->q_segs_this_txg = 0;
	queue->q_total_zio_size_this_txg = 0;
	queue->q_zios_this_txg = 0;

	/* loop until we run out of time or sios */
	while ((rs = scan_io_queue_fetch_ext(queue)) != NULL) {
	uint64_t seg_start = 0, seg_end = 0;
	boolean_t more_left = B_TRUE;

	ASSERT(list_is_empty(&sio_list));

	/* loop while we still have sios left to process in this rs */
	while (more_left) {
	scan_io_t first_sio, last_sio;

	/*
	* We have selected which extent needs to be
	* processed next. Gather up the corresponding sios.
	*/
	more_left = scan_io_queue_gather(queue, rs, &sio_list);
	ASSERT(!list_is_empty(&sio_list));
	first_sio = list_head(&sio_list);
	last_sio = list_tail(&sio_list);

	seg_end = SIO_GET_END_OFFSET(last_sio);
	if (seg_start == 0)
	seg_start = SIO_GET_OFFSET(first_sio);

	/*
	* Issuing sios can take a long time so drop the
	* queue lock. The sio queue won't be updated by
	* other threads since we're in syncing context so
	* we can be sure that our trees will remain exactly
	* as we left them.
	*/
	mutex_exit(q_lock);
	suspended = scan_io_queue_issue(queue, &sio_list);
	mutex_enter(q_lock);

	if (suspended)
	break;
	}

	/* update statistics for debugging purposes */
	scan_io_queues_update_seg_stats(queue, seg_start, seg_end);

	if (suspended)
	break;
	}

	/*
	* If we were suspended in the middle of processing,
	* requeue any unfinished sios and exit.
	*/
	while ((sio = list_head(&sio_list)) != NULL) {
	list_remove(&sio_list, sio);
	scan_io_queue_insert_impl(queue, sio);
	}

	mutex_exit(q_lock);
	list_destroy(&sio_list);
	}

	/*
	* Performs an emptying run on all scan queues in the pool. This just
	* punches out one thread per top-level vdev, each of which processes
	* only that vdev's scan queue. We can parallelize the I/O here because
	* we know that each queue's I/Os only affect its own top-level vdev.
	*
	* This function waits for the queue runs to complete, and must be
	* called from dsl_scan_sync (or in general, syncing context).
	*/
	static void
	scan_io_queues_run(dsl_scan_t *scn)
	{
	spa_t *spa = scn->scn_dp->dp_spa;

	ASSERT(scn->scn_is_sorted);
	ASSERT(spa_config_held(spa, SCL_CONFIG, RW_READER));

	if (scn->scn_bytes_pending == 0)
	return;

	if (scn->scn_taskq == NULL) {
	int nthreads = spa->spa_root_vdev->vdev_children;

	/*
	* We need to make this taskq always execute as many
	* threads in parallel as we have top-level vdevs and no
	* less, otherwise strange serialization of the calls to
	* scan_io_queues_run_one can occur during spa_sync runs
	* and that significantly impacts performance.
	*/
	scn->scn_taskq = taskq_create("dsl_scan_iss", nthreads,
	minclsyspri, nthreads, nthreads, TASKQ_PREPOPULATE);
	}

	for (uint64_t i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
	vdev_t *vd = spa->spa_root_vdev->vdev_child[i];

	mutex_enter(&vd->vdev_scan_io_queue_lock);
	if (vd->vdev_scan_io_queue != NULL) {
	VERIFY(taskq_dispatch(scn->scn_taskq,
	scan_io_queues_run_one, vd->vdev_scan_io_queue,
	TQ_SLEEP) != TASKQID_INVALID);
	}
	mutex_exit(&vd->vdev_scan_io_queue_lock);
	}

	/*
	* Wait for the queues to finish issuing their IOs for this run
	* before we return. There may still be IOs in flight at this
	* point.
	*/
	taskq_wait(scn->scn_taskq);
	}

	static boolean_t
	dsl_scan_async_block_should_pause(dsl_scan_t *scn)
	{
	uint64_t elapsed_nanosecs;

	if (zfs_recover)
	return (B_FALSE);

	if (zfs_async_block_max_blocks != 0 &&
	scn->scn_visited_this_txg >= zfs_async_block_max_blocks) {
	return (B_TRUE);
	}

	if (zfs_max_async_dedup_frees != 0 &&
	scn->scn_dedup_frees_this_txg >= zfs_max_async_dedup_frees) {
	return (B_TRUE);
	}

	elapsed_nanosecs = gethrtime() - scn->scn_sync_start_time;
	return (elapsed_nanosecs / NANOSEC > zfs_txg_timeout \|\|
	(NSEC2MSEC(elapsed_nanosecs) > scn->scn_async_block_min_time_ms &&
	txg_sync_waiting(scn->scn_dp)) \|\|
	spa_shutting_down(scn->scn_dp->dp_spa));
	}

	static int
	dsl_scan_free_block_cb(void arg, const blkptr_t bp, dmu_tx_t *tx)
	{
	dsl_scan_t *scn = arg;

	if (!scn->scn_is_bptree \|\|
	(BP_GET_LEVEL(bp) == 0 && BP_GET_TYPE(bp) != DMU_OT_OBJSET)) {
	if (dsl_scan_async_block_should_pause(scn))
	return (SET_ERROR(ERESTART));
	}

	zio_nowait(zio_free_sync(scn->scn_zio_root, scn->scn_dp->dp_spa,
	dmu_tx_get_txg(tx), bp, 0));
	dsl_dir_diduse_space(tx->tx_pool->dp_free_dir, DD_USED_HEAD,
	-bp_get_dsize_sync(scn->scn_dp->dp_spa, bp),
	-BP_GET_PSIZE(bp), -BP_GET_UCSIZE(bp), tx);
	scn->scn_visited_this_txg++;
	if (BP_GET_DEDUP(bp))
	scn->scn_dedup_frees_this_txg++;
	return (0);
	}

	static void
	dsl_scan_update_stats(dsl_scan_t *scn)
	{
	spa_t *spa = scn->scn_dp->dp_spa;
	uint64_t i;
	uint64_t seg_size_total = 0, zio_size_total = 0;
	uint64_t seg_count_total = 0, zio_count_total = 0;

	for (i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
	vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
	dsl_scan_io_queue_t *queue = vd->vdev_scan_io_queue;

	if (queue == NULL)
	continue;

	seg_size_total += queue->q_total_seg_size_this_txg;
	zio_size_total += queue->q_total_zio_size_this_txg;
	seg_count_total += queue->q_segs_this_txg;
	zio_count_total += queue->q_zios_this_txg;
	}

	if (seg_count_total == 0 \|\| zio_count_total == 0) {
	scn->scn_avg_seg_size_this_txg = 0;
	scn->scn_avg_zio_size_this_txg = 0;
	scn->scn_segs_this_txg = 0;
	scn->scn_zios_this_txg = 0;
	return;
	}

	scn->scn_avg_seg_size_this_txg = seg_size_total / seg_count_total;
	scn->scn_avg_zio_size_this_txg = zio_size_total / zio_count_total;
	scn->scn_segs_this_txg = seg_count_total;
	scn->scn_zios_this_txg = zio_count_total;
	}

	static int
	bpobj_dsl_scan_free_block_cb(void arg, const blkptr_t bp, boolean_t bp_freed,
	dmu_tx_t *tx)
	{
	ASSERT(!bp_freed);
	return (dsl_scan_free_block_cb(arg, bp, tx));
	}

	static int
	dsl_scan_obsolete_block_cb(void arg, const blkptr_t bp, boolean_t bp_freed,
	dmu_tx_t *tx)
	{
	ASSERT(!bp_freed);
	dsl_scan_t *scn = arg;
	const dva_t *dva = &bp->blk_dva[0];

	if (dsl_scan_async_block_should_pause(scn))
	return (SET_ERROR(ERESTART));

	spa_vdev_indirect_mark_obsolete(scn->scn_dp->dp_spa,
	DVA_GET_VDEV(dva), DVA_GET_OFFSET(dva),
	DVA_GET_ASIZE(dva), tx);
	scn->scn_visited_this_txg++;
	return (0);
	}

	boolean_t
	dsl_scan_active(dsl_scan_t *scn)
	{
	spa_t *spa = scn->scn_dp->dp_spa;
	uint64_t used = 0, comp, uncomp;
	boolean_t clones_left;

	if (spa->spa_load_state != SPA_LOAD_NONE)
	return (B_FALSE);
	if (spa_shutting_down(spa))
	return (B_FALSE);
	if ((dsl_scan_is_running(scn) && !dsl_scan_is_paused_scrub(scn)) \|\|
	(scn->scn_async_destroying && !scn->scn_async_stalled))
	return (B_TRUE);

	if (spa_version(scn->scn_dp->dp_spa) >= SPA_VERSION_DEADLISTS) {
	(void) bpobj_space(&scn->scn_dp->dp_free_bpobj,
	&used, &comp, &uncomp);
	}
	clones_left = spa_livelist_delete_check(spa);
	return ((used != 0) \|\| (clones_left));
	}

	static boolean_t
	dsl_scan_check_deferred(vdev_t *vd)
	{
	boolean_t need_resilver = B_FALSE;

	for (int c = 0; c < vd->vdev_children; c++) {
	need_resilver \|=
	dsl_scan_check_deferred(vd->vdev_child[c]);
	}

	if (!vdev_is_concrete(vd) \|\| vd->vdev_aux \|\|
	!vd->vdev_ops->vdev_op_leaf)
	return (need_resilver);

	if (!vd->vdev_resilver_deferred)
	need_resilver = B_TRUE;

	return (need_resilver);
	}

	static boolean_t
	dsl_scan_need_resilver(spa_t spa, const dva_t dva, size_t psize,
	uint64_t phys_birth)
	{
	vdev_t *vd;

	vd = vdev_lookup_top(spa, DVA_GET_VDEV(dva));

	if (vd->vdev_ops == &vdev_indirect_ops) {
	/*
	* The indirect vdev can point to multiple
	* vdevs. For simplicity, always create
	* the resilver zio_t. zio_vdev_io_start()
	* will bypass the child resilver i/o's if
	* they are on vdevs that don't have DTL's.
	*/
	return (B_TRUE);
	}

	if (DVA_GET_GANG(dva)) {
	/*
	* Gang members may be spread across multiple
	* vdevs, so the best estimate we have is the
	* scrub range, which has already been checked.
	* XXX -- it would be better to change our
	* allocation policy to ensure that all
	* gang members reside on the same vdev.
	*/
	return (B_TRUE);
	}

	/*
	* Check if the txg falls within the range which must be
	* resilvered. DVAs outside this range can always be skipped.
	*/
	if (!vdev_dtl_contains(vd, DTL_PARTIAL, phys_birth, 1))
	return (B_FALSE);

	/*
	* Check if the top-level vdev must resilver this offset.
	* When the offset does not intersect with a dirty leaf DTL
	* then it may be possible to skip the resilver IO. The psize
	* is provided instead of asize to simplify the check for RAIDZ.
	*/
	if (!vdev_dtl_need_resilver(vd, DVA_GET_OFFSET(dva), psize))
	return (B_FALSE);

	/*
	* Check that this top-level vdev has a device under it which
	* is resilvering and is not deferred.
	*/
	if (!dsl_scan_check_deferred(vd))
	return (B_FALSE);

	return (B_TRUE);
	}

	static int
	dsl_process_async_destroys(dsl_pool_t dp, dmu_tx_t tx)
	{
	dsl_scan_t *scn = dp->dp_scan;
	spa_t *spa = dp->dp_spa;
	int err = 0;

	if (spa_suspend_async_destroy(spa))
	return (0);

	if (zfs_free_bpobj_enabled &&
	spa_version(spa) >= SPA_VERSION_DEADLISTS) {
	scn->scn_is_bptree = B_FALSE;
	scn->scn_async_block_min_time_ms = zfs_free_min_time_ms;
	scn->scn_zio_root = zio_root(spa, NULL,
	NULL, ZIO_FLAG_MUSTSUCCEED);
	err = bpobj_iterate(&dp->dp_free_bpobj,
	bpobj_dsl_scan_free_block_cb, scn, tx);
	VERIFY0(zio_wait(scn->scn_zio_root));
	scn->scn_zio_root = NULL;

	if (err != 0 && err != ERESTART)
	zfs_panic_recover("error %u from bpobj_iterate()", err);
	}

	if (err == 0 && spa_feature_is_active(spa, SPA_FEATURE_ASYNC_DESTROY)) {
	ASSERT(scn->scn_async_destroying);
	scn->scn_is_bptree = B_TRUE;
	scn->scn_zio_root = zio_root(spa, NULL,
	NULL, ZIO_FLAG_MUSTSUCCEED);
	err = bptree_iterate(dp->dp_meta_objset,
	dp->dp_bptree_obj, B_TRUE, dsl_scan_free_block_cb, scn, tx);
	VERIFY0(zio_wait(scn->scn_zio_root));
	scn->scn_zio_root = NULL;

	if (err == EIO \|\| err == ECKSUM) {
	err = 0;
	} else if (err != 0 && err != ERESTART) {
	zfs_panic_recover("error %u from "
	"traverse_dataset_destroyed()", err);
	}

	if (bptree_is_empty(dp->dp_meta_objset, dp->dp_bptree_obj)) {
	/* finished; deactivate async destroy feature */
	spa_feature_decr(spa, SPA_FEATURE_ASYNC_DESTROY, tx);
	ASSERT(!spa_feature_is_active(spa,
	SPA_FEATURE_ASYNC_DESTROY));
	VERIFY0(zap_remove(dp->dp_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_BPTREE_OBJ, tx));
	VERIFY0(bptree_free(dp->dp_meta_objset,
	dp->dp_bptree_obj, tx));
	dp->dp_bptree_obj = 0;
	scn->scn_async_destroying = B_FALSE;
	scn->scn_async_stalled = B_FALSE;
	} else {
	/*
	* If we didn't make progress, mark the async
	* destroy as stalled, so that we will not initiate
	* a spa_sync() on its behalf. Note that we only
	* check this if we are not finished, because if the
	* bptree had no blocks for us to visit, we can
	* finish without "making progress".
	*/
	scn->scn_async_stalled =
	(scn->scn_visited_this_txg == 0);
	}
	}
	if (scn->scn_visited_this_txg) {
	zfs_dbgmsg("freed %llu blocks in %llums from "
	"free_bpobj/bptree txg %llu; err=%u",
	(longlong_t)scn->scn_visited_this_txg,
	(longlong_t)
	NSEC2MSEC(gethrtime() - scn->scn_sync_start_time),
	(longlong_t)tx->tx_txg, err);
	scn->scn_visited_this_txg = 0;
	scn->scn_dedup_frees_this_txg = 0;

	/*
	* Write out changes to the DDT that may be required as a
	* result of the blocks freed. This ensures that the DDT
	* is clean when a scrub/resilver runs.
	*/
	ddt_sync(spa, tx->tx_txg);
	}
	if (err != 0)
	return (err);
	if (dp->dp_free_dir != NULL && !scn->scn_async_destroying &&
	zfs_free_leak_on_eio &&
	(dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes != 0 \|\|
	dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes != 0 \|\|
	dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes != 0)) {
	/*
	* We have finished background destroying, but there is still
	* some space left in the dp_free_dir. Transfer this leaked
	* space to the dp_leak_dir.
	*/
	if (dp->dp_leak_dir == NULL) {
	rrw_enter(&dp->dp_config_rwlock, RW_WRITER, FTAG);
	(void) dsl_dir_create_sync(dp, dp->dp_root_dir,
	LEAK_DIR_NAME, tx);
	VERIFY0(dsl_pool_open_special_dir(dp,
	LEAK_DIR_NAME, &dp->dp_leak_dir));
	rrw_exit(&dp->dp_config_rwlock, FTAG);
	}
	dsl_dir_diduse_space(dp->dp_leak_dir, DD_USED_HEAD,
	dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes,
	dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes,
	dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes, tx);
	dsl_dir_diduse_space(dp->dp_free_dir, DD_USED_HEAD,
	-dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes,
	-dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes,
	-dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes, tx);
	}

	if (dp->dp_free_dir != NULL && !scn->scn_async_destroying &&
	!spa_livelist_delete_check(spa)) {
	/* finished; verify that space accounting went to zero */
	ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes);
	ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes);
	ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes);
	}

	spa_notify_waiters(spa);

	EQUIV(bpobj_is_open(&dp->dp_obsolete_bpobj),
	0 == zap_contains(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_OBSOLETE_BPOBJ));
	if (err == 0 && bpobj_is_open(&dp->dp_obsolete_bpobj)) {
	ASSERT(spa_feature_is_active(dp->dp_spa,
	SPA_FEATURE_OBSOLETE_COUNTS));

	scn->scn_is_bptree = B_FALSE;
	scn->scn_async_block_min_time_ms = zfs_obsolete_min_time_ms;
	err = bpobj_iterate(&dp->dp_obsolete_bpobj,
	dsl_scan_obsolete_block_cb, scn, tx);
	if (err != 0 && err != ERESTART)
	zfs_panic_recover("error %u from bpobj_iterate()", err);

	if (bpobj_is_empty(&dp->dp_obsolete_bpobj))
	dsl_pool_destroy_obsolete_bpobj(dp, tx);
	}
	return (0);
	}

	/*
	* This is the primary entry point for scans that is called from syncing
	* context. Scans must happen entirely during syncing context so that we
	* can guarantee that blocks we are currently scanning will not change out
	* from under us. While a scan is active, this function controls how quickly
	* transaction groups proceed, instead of the normal handling provided by
	* txg_sync_thread().
	*/
	void
	dsl_scan_sync(dsl_pool_t dp, dmu_tx_t tx)
	{
	int err = 0;
	dsl_scan_t *scn = dp->dp_scan;
	spa_t *spa = dp->dp_spa;
	state_sync_type_t sync_type = SYNC_OPTIONAL;

	if (spa->spa_resilver_deferred &&
	!spa_feature_is_active(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER))
	spa_feature_incr(spa, SPA_FEATURE_RESILVER_DEFER, tx);

	/*
	* Check for scn_restart_txg before checking spa_load_state, so
	* that we can restart an old-style scan while the pool is being
	* imported (see dsl_scan_init). We also restart scans if there
	* is a deferred resilver and the user has manually disabled
	* deferred resilvers via the tunable.
	*/
	if (dsl_scan_restarting(scn, tx) \|\|
	(spa->spa_resilver_deferred && zfs_resilver_disable_defer)) {
	pool_scan_func_t func = POOL_SCAN_SCRUB;
	dsl_scan_done(scn, B_FALSE, tx);
	if (vdev_resilver_needed(spa->spa_root_vdev, NULL, NULL))
	func = POOL_SCAN_RESILVER;
	zfs_dbgmsg("restarting scan func=%u txg=%llu",
	func, (longlong_t)tx->tx_txg);
	dsl_scan_setup_sync(&func, tx);
	}

	/*
	* Only process scans in sync pass 1.
	*/
	if (spa_sync_pass(spa) > 1)
	return;

	/*
	* If the spa is shutting down, then stop scanning. This will
	* ensure that the scan does not dirty any new data during the
	* shutdown phase.
	*/
	if (spa_shutting_down(spa))
	return;

	/*
	* If the scan is inactive due to a stalled async destroy, try again.
	*/
	if (!scn->scn_async_stalled && !dsl_scan_active(scn))
	return;

	/* reset scan statistics */
	scn->scn_visited_this_txg = 0;
	scn->scn_dedup_frees_this_txg = 0;
	scn->scn_holes_this_txg = 0;
	scn->scn_lt_min_this_txg = 0;
	scn->scn_gt_max_this_txg = 0;
	scn->scn_ddt_contained_this_txg = 0;
	scn->scn_objsets_visited_this_txg = 0;
	scn->scn_avg_seg_size_this_txg = 0;
	scn->scn_segs_this_txg = 0;
	scn->scn_avg_zio_size_this_txg = 0;
	scn->scn_zios_this_txg = 0;
	scn->scn_suspending = B_FALSE;
	scn->scn_sync_start_time = gethrtime();
	spa->spa_scrub_active = B_TRUE;

	/*
	* First process the async destroys. If we suspend, don't do
	* any scrubbing or resilvering. This ensures that there are no
	* async destroys while we are scanning, so the scan code doesn't
	* have to worry about traversing it. It is also faster to free the
	* blocks than to scrub them.
	*/
	err = dsl_process_async_destroys(dp, tx);
	if (err != 0)
	return;

	if (!dsl_scan_is_running(scn) \|\| dsl_scan_is_paused_scrub(scn))
	return;

	/*
	* Wait a few txgs after importing to begin scanning so that
	* we can get the pool imported quickly.
	*/
	if (spa->spa_syncing_txg < spa->spa_first_txg + SCAN_IMPORT_WAIT_TXGS)
	return;

	/*
	* zfs_scan_suspend_progress can be set to disable scan progress.
	* We don't want to spin the txg_sync thread, so we add a delay
	* here to simulate the time spent doing a scan. This is mostly
	* useful for testing and debugging.
	*/
	if (zfs_scan_suspend_progress) {
	uint64_t scan_time_ns = gethrtime() - scn->scn_sync_start_time;
	int mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
	zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;

	while (zfs_scan_suspend_progress &&
	!txg_sync_waiting(scn->scn_dp) &&
	!spa_shutting_down(scn->scn_dp->dp_spa) &&
	NSEC2MSEC(scan_time_ns) < mintime) {
	delay(hz);
	scan_time_ns = gethrtime() - scn->scn_sync_start_time;
	}
	return;
	}

	/*
	* It is possible to switch from unsorted to sorted at any time,
	* but afterwards the scan will remain sorted unless reloaded from
	* a checkpoint after a reboot.
	*/
	if (!zfs_scan_legacy) {
	scn->scn_is_sorted = B_TRUE;
	if (scn->scn_last_checkpoint == 0)
	scn->scn_last_checkpoint = ddi_get_lbolt();
	}

	/*
	* For sorted scans, determine what kind of work we will be doing
	* this txg based on our memory limitations and whether or not we
	* need to perform a checkpoint.
	*/
	if (scn->scn_is_sorted) {
	/*
	* If we are over our checkpoint interval, set scn_clearing
	* so that we can begin checkpointing immediately. The
	* checkpoint allows us to save a consistent bookmark
	* representing how much data we have scrubbed so far.
	* Otherwise, use the memory limit to determine if we should
	* scan for metadata or start issue scrub IOs. We accumulate
	* metadata until we hit our hard memory limit at which point
	* we issue scrub IOs until we are at our soft memory limit.
	*/
	if (scn->scn_checkpointing \|\|
	ddi_get_lbolt() - scn->scn_last_checkpoint >
	SEC_TO_TICK(zfs_scan_checkpoint_intval)) {
	if (!scn->scn_checkpointing)
	zfs_dbgmsg("begin scan checkpoint");

	scn->scn_checkpointing = B_TRUE;
	scn->scn_clearing = B_TRUE;
	} else {
	boolean_t should_clear = dsl_scan_should_clear(scn);
	if (should_clear && !scn->scn_clearing) {
	zfs_dbgmsg("begin scan clearing");
	scn->scn_clearing = B_TRUE;
	} else if (!should_clear && scn->scn_clearing) {
	zfs_dbgmsg("finish scan clearing");
	scn->scn_clearing = B_FALSE;
	}
	}
	} else {
	ASSERT0(scn->scn_checkpointing);
	ASSERT0(scn->scn_clearing);
	}

	if (!scn->scn_clearing && scn->scn_done_txg == 0) {
	/* Need to scan metadata for more blocks to scrub */
	dsl_scan_phys_t *scnp = &scn->scn_phys;
	taskqid_t prefetch_tqid;
	uint64_t bytes_per_leaf = zfs_scan_vdev_limit;
	uint64_t nr_leaves = dsl_scan_count_leaves(spa->spa_root_vdev);

	/*
	* Recalculate the max number of in-flight bytes for pool-wide
	* scanning operations (minimum 1MB). Limits for the issuing
	* phase are done per top-level vdev and are handled separately.
	*/
	scn->scn_maxinflight_bytes =
	MAX(nr_leaves * bytes_per_leaf, 1ULL << 20);

	if (scnp->scn_ddt_bookmark.ddb_class <=
	scnp->scn_ddt_class_max) {
	ASSERT(ZB_IS_ZERO(&scnp->scn_bookmark));
	zfs_dbgmsg("doing scan sync txg %llu; "
	"ddt bm=%llu/%llu/%llu/%llx",
	(longlong_t)tx->tx_txg,
	(longlong_t)scnp->scn_ddt_bookmark.ddb_class,
	(longlong_t)scnp->scn_ddt_bookmark.ddb_type,
	(longlong_t)scnp->scn_ddt_bookmark.ddb_checksum,
	(longlong_t)scnp->scn_ddt_bookmark.ddb_cursor);
	} else {
	zfs_dbgmsg("doing scan sync txg %llu; "
	"bm=%llu/%llu/%llu/%llu",
	(longlong_t)tx->tx_txg,
	(longlong_t)scnp->scn_bookmark.zb_objset,
	(longlong_t)scnp->scn_bookmark.zb_object,
	(longlong_t)scnp->scn_bookmark.zb_level,
	(longlong_t)scnp->scn_bookmark.zb_blkid);
	}

	scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
	NULL, ZIO_FLAG_CANFAIL);

	scn->scn_prefetch_stop = B_FALSE;
	prefetch_tqid = taskq_dispatch(dp->dp_sync_taskq,
	dsl_scan_prefetch_thread, scn, TQ_SLEEP);
	ASSERT(prefetch_tqid != TASKQID_INVALID);

	dsl_pool_config_enter(dp, FTAG);
	dsl_scan_visit(scn, tx);
	dsl_pool_config_exit(dp, FTAG);

	mutex_enter(&dp->dp_spa->spa_scrub_lock);
	scn->scn_prefetch_stop = B_TRUE;
	cv_broadcast(&spa->spa_scrub_io_cv);
	mutex_exit(&dp->dp_spa->spa_scrub_lock);

	taskq_wait_id(dp->dp_sync_taskq, prefetch_tqid);
	(void) zio_wait(scn->scn_zio_root);
	scn->scn_zio_root = NULL;

	zfs_dbgmsg("scan visited %llu blocks in %llums "
	"(%llu os's, %llu holes, %llu < mintxg, "
	"%llu in ddt, %llu > maxtxg)",
	(longlong_t)scn->scn_visited_this_txg,
	(longlong_t)NSEC2MSEC(gethrtime() -
	scn->scn_sync_start_time),
	(longlong_t)scn->scn_objsets_visited_this_txg,
	(longlong_t)scn->scn_holes_this_txg,
	(longlong_t)scn->scn_lt_min_this_txg,
	(longlong_t)scn->scn_ddt_contained_this_txg,
	(longlong_t)scn->scn_gt_max_this_txg);

	if (!scn->scn_suspending) {
	ASSERT0(avl_numnodes(&scn->scn_queue));
	scn->scn_done_txg = tx->tx_txg + 1;
	if (scn->scn_is_sorted) {
	scn->scn_checkpointing = B_TRUE;
	scn->scn_clearing = B_TRUE;
	}
	zfs_dbgmsg("scan complete txg %llu",
	(longlong_t)tx->tx_txg);
	}
	} else if (scn->scn_is_sorted && scn->scn_bytes_pending != 0) {
	ASSERT(scn->scn_clearing);

	/* need to issue scrubbing IOs from per-vdev queues */
	scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
	NULL, ZIO_FLAG_CANFAIL);
	scan_io_queues_run(scn);
	(void) zio_wait(scn->scn_zio_root);
	scn->scn_zio_root = NULL;

	/* calculate and dprintf the current memory usage */
	(void) dsl_scan_should_clear(scn);
	dsl_scan_update_stats(scn);

	zfs_dbgmsg("scan issued %llu blocks (%llu segs) in %llums "
	"(avg_block_size = %llu, avg_seg_size = %llu)",
	(longlong_t)scn->scn_zios_this_txg,
	(longlong_t)scn->scn_segs_this_txg,
	(longlong_t)NSEC2MSEC(gethrtime() -
	scn->scn_sync_start_time),
	(longlong_t)scn->scn_avg_zio_size_this_txg,
	(longlong_t)scn->scn_avg_seg_size_this_txg);
	} else if (scn->scn_done_txg != 0 && scn->scn_done_txg <= tx->tx_txg) {
	/* Finished with everything. Mark the scrub as complete */
	zfs_dbgmsg("scan issuing complete txg %llu",
	(longlong_t)tx->tx_txg);
	ASSERT3U(scn->scn_done_txg, !=, 0);
	ASSERT0(spa->spa_scrub_inflight);
	ASSERT0(scn->scn_bytes_pending);
	dsl_scan_done(scn, B_TRUE, tx);
	sync_type = SYNC_MANDATORY;
	}

	dsl_scan_sync_state(scn, tx, sync_type);
	}

	static void
	count_block(dsl_scan_t scn, zfs_all_blkstats_t zab, const blkptr_t *bp)
	{
	int i;

	/*
	* Don't count embedded bp's, since we already did the work of
	* scanning these when we scanned the containing block.
	*/
	if (BP_IS_EMBEDDED(bp))
	return;

	/*
	* Update the spa's stats on how many bytes we have issued.
	* Sequential scrubs create a zio for each DVA of the bp. Each
	* of these will include all DVAs for repair purposes, but the
	* zio code will only try the first one unless there is an issue.
	* Therefore, we should only count the first DVA for these IOs.
	*/
	if (scn->scn_is_sorted) {
	atomic_add_64(&scn->scn_dp->dp_spa->spa_scan_pass_issued,
	DVA_GET_ASIZE(&bp->blk_dva[0]));
	} else {
	spa_t *spa = scn->scn_dp->dp_spa;

	for (i = 0; i < BP_GET_NDVAS(bp); i++) {
	atomic_add_64(&spa->spa_scan_pass_issued,
	DVA_GET_ASIZE(&bp->blk_dva[i]));
	}
	}

	/*
	* If we resume after a reboot, zab will be NULL; don't record
	* incomplete stats in that case.
	*/
	if (zab == NULL)
	return;

	mutex_enter(&zab->zab_lock);

	for (i = 0; i < 4; i++) {
	int l = (i < 2) ? BP_GET_LEVEL(bp) : DN_MAX_LEVELS;
	int t = (i & 1) ? BP_GET_TYPE(bp) : DMU_OT_TOTAL;

	if (t & DMU_OT_NEWTYPE)
	t = DMU_OT_OTHER;
	zfs_blkstat_t *zb = &zab->zab_type[l][t];
	int equal;

	zb->zb_count++;
	zb->zb_asize += BP_GET_ASIZE(bp);
	zb->zb_lsize += BP_GET_LSIZE(bp);
	zb->zb_psize += BP_GET_PSIZE(bp);
	zb->zb_gangs += BP_COUNT_GANG(bp);

	switch (BP_GET_NDVAS(bp)) {
	case 2:
	if (DVA_GET_VDEV(&bp->blk_dva[0]) ==
	DVA_GET_VDEV(&bp->blk_dva[1]))
	zb->zb_ditto_2_of_2_samevdev++;
	break;
	case 3:
	equal = (DVA_GET_VDEV(&bp->blk_dva[0]) ==
	DVA_GET_VDEV(&bp->blk_dva[1])) +
	(DVA_GET_VDEV(&bp->blk_dva[0]) ==
	DVA_GET_VDEV(&bp->blk_dva[2])) +
	(DVA_GET_VDEV(&bp->blk_dva[1]) ==
	DVA_GET_VDEV(&bp->blk_dva[2]));
	if (equal == 1)
	zb->zb_ditto_2_of_3_samevdev++;
	else if (equal == 3)
	zb->zb_ditto_3_of_3_samevdev++;
	break;
	}
	}

	mutex_exit(&zab->zab_lock);
	}

	static void
	scan_io_queue_insert_impl(dsl_scan_io_queue_t queue, scan_io_t sio)
	{
	avl_index_t idx;
	int64_t asize = SIO_GET_ASIZE(sio);
	dsl_scan_t *scn = queue->q_scn;

	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));

	if (avl_find(&queue->q_sios_by_addr, sio, &idx) != NULL) {
	/* block is already scheduled for reading */
	atomic_add_64(&scn->scn_bytes_pending, -asize);
	sio_free(sio);
	return;
	}
	avl_insert(&queue->q_sios_by_addr, sio, idx);
	queue->q_sio_memused += SIO_GET_MUSED(sio);
	range_tree_add(queue->q_exts_by_addr, SIO_GET_OFFSET(sio), asize);
	}

	/*
	* Given all the info we got from our metadata scanning process, we
	* construct a scan_io_t and insert it into the scan sorting queue. The
	* I/O must already be suitable for us to process. This is controlled
	* by dsl_scan_enqueue().
	*/
	static void
	scan_io_queue_insert(dsl_scan_io_queue_t queue, const blkptr_t bp, int dva_i,
	int zio_flags, const zbookmark_phys_t *zb)
	{
	dsl_scan_t *scn = queue->q_scn;
	scan_io_t *sio = sio_alloc(BP_GET_NDVAS(bp));

	ASSERT0(BP_IS_GANG(bp));
	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));

	bp2sio(bp, sio, dva_i);
	sio->sio_flags = zio_flags;
	sio->sio_zb = *zb;

	/*
	* Increment the bytes pending counter now so that we can't
	* get an integer underflow in case the worker processes the
	* zio before we get to incrementing this counter.
	*/
	atomic_add_64(&scn->scn_bytes_pending, SIO_GET_ASIZE(sio));

	scan_io_queue_insert_impl(queue, sio);
	}

	/*
	* Given a set of I/O parameters as discovered by the metadata traversal
	* process, attempts to place the I/O into the sorted queues (if allowed),
	* or immediately executes the I/O.
	*/
	static void
	dsl_scan_enqueue(dsl_pool_t dp, const blkptr_t bp, int zio_flags,
	const zbookmark_phys_t *zb)
	{
	spa_t *spa = dp->dp_spa;

	ASSERT(!BP_IS_EMBEDDED(bp));

	/*
	* Gang blocks are hard to issue sequentially, so we just issue them
	* here immediately instead of queuing them.
	*/
	if (!dp->dp_scan->scn_is_sorted \|\| BP_IS_GANG(bp)) {
	scan_exec_io(dp, bp, zio_flags, zb, NULL);
	return;
	}

	for (int i = 0; i < BP_GET_NDVAS(bp); i++) {
	dva_t dva;
	vdev_t *vdev;

	dva = bp->blk_dva[i];
	vdev = vdev_lookup_top(spa, DVA_GET_VDEV(&dva));
	ASSERT(vdev != NULL);

	mutex_enter(&vdev->vdev_scan_io_queue_lock);
	if (vdev->vdev_scan_io_queue == NULL)
	vdev->vdev_scan_io_queue = scan_io_queue_create(vdev);
	ASSERT(dp->dp_scan != NULL);
	scan_io_queue_insert(vdev->vdev_scan_io_queue, bp,
	i, zio_flags, zb);
	mutex_exit(&vdev->vdev_scan_io_queue_lock);
	}
	}

	static int
	dsl_scan_scrub_cb(dsl_pool_t *dp,
	const blkptr_t bp, const zbookmark_phys_t zb)
	{
	dsl_scan_t *scn = dp->dp_scan;
	spa_t *spa = dp->dp_spa;
	uint64_t phys_birth = BP_PHYSICAL_BIRTH(bp);
	size_t psize = BP_GET_PSIZE(bp);
	boolean_t needs_io = B_FALSE;
	int zio_flags = ZIO_FLAG_SCAN_THREAD \| ZIO_FLAG_RAW \| ZIO_FLAG_CANFAIL;


	if (phys_birth <= scn->scn_phys.scn_min_txg \|\|
	phys_birth >= scn->scn_phys.scn_max_txg) {
	count_block(scn, dp->dp_blkstats, bp);
	return (0);
	}

	/* Embedded BP's have phys_birth==0, so we reject them above. */
	ASSERT(!BP_IS_EMBEDDED(bp));

	ASSERT(DSL_SCAN_IS_SCRUB_RESILVER(scn));
	if (scn->scn_phys.scn_func == POOL_SCAN_SCRUB) {
	zio_flags \|= ZIO_FLAG_SCRUB;
	needs_io = B_TRUE;
	} else {
	ASSERT3U(scn->scn_phys.scn_func, ==, POOL_SCAN_RESILVER);
	zio_flags \|= ZIO_FLAG_RESILVER;
	needs_io = B_FALSE;
	}

	/* If it's an intent log block, failure is expected. */
	if (zb->zb_level == ZB_ZIL_LEVEL)
	zio_flags \|= ZIO_FLAG_SPECULATIVE;

	for (int d = 0; d < BP_GET_NDVAS(bp); d++) {
	const dva_t *dva = &bp->blk_dva[d];

	/*
	* Keep track of how much data we've examined so that
	* zpool(1M) status can make useful progress reports.
	*/
	scn->scn_phys.scn_examined += DVA_GET_ASIZE(dva);
	spa->spa_scan_pass_exam += DVA_GET_ASIZE(dva);

	/* if it's a resilver, this may not be in the target range */
	if (!needs_io)
	needs_io = dsl_scan_need_resilver(spa, dva, psize,
	phys_birth);
	}

	if (needs_io && !zfs_no_scrub_io) {
	dsl_scan_enqueue(dp, bp, zio_flags, zb);
	} else {
	count_block(scn, dp->dp_blkstats, bp);
	}

	/* do not relocate this block */
	return (0);
	}

	static void
	dsl_scan_scrub_done(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	blkptr_t *bp = zio->io_bp;
	dsl_scan_io_queue_t *queue = zio->io_private;

	abd_free(zio->io_abd);

	if (queue == NULL) {
	mutex_enter(&spa->spa_scrub_lock);
	ASSERT3U(spa->spa_scrub_inflight, >=, BP_GET_PSIZE(bp));
	spa->spa_scrub_inflight -= BP_GET_PSIZE(bp);
	cv_broadcast(&spa->spa_scrub_io_cv);
	mutex_exit(&spa->spa_scrub_lock);
	} else {
	mutex_enter(&queue->q_vd->vdev_scan_io_queue_lock);
	ASSERT3U(queue->q_inflight_bytes, >=, BP_GET_PSIZE(bp));
	queue->q_inflight_bytes -= BP_GET_PSIZE(bp);
	cv_broadcast(&queue->q_zio_cv);
	mutex_exit(&queue->q_vd->vdev_scan_io_queue_lock);
	}

	if (zio->io_error && (zio->io_error != ECKSUM \|\|
	!(zio->io_flags & ZIO_FLAG_SPECULATIVE))) {
	atomic_inc_64(&spa->spa_dsl_pool->dp_scan->scn_phys.scn_errors);
	}
	}

	/*
	* Given a scanning zio's information, executes the zio. The zio need
	* not necessarily be only sortable, this function simply executes the
	* zio, no matter what it is. The optional queue argument allows the
	* caller to specify that they want per top level vdev IO rate limiting
	* instead of the legacy global limiting.
	*/
	static void
	scan_exec_io(dsl_pool_t dp, const blkptr_t bp, int zio_flags,
	const zbookmark_phys_t zb, dsl_scan_io_queue_t queue)
	{
	spa_t *spa = dp->dp_spa;
	dsl_scan_t *scn = dp->dp_scan;
	size_t size = BP_GET_PSIZE(bp);
	abd_t *data = abd_alloc_for_io(size, B_FALSE);

	ASSERT3U(scn->scn_maxinflight_bytes, >, 0);

	if (queue == NULL) {
	mutex_enter(&spa->spa_scrub_lock);
	while (spa->spa_scrub_inflight >= scn->scn_maxinflight_bytes)
	cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
	spa->spa_scrub_inflight += BP_GET_PSIZE(bp);
	mutex_exit(&spa->spa_scrub_lock);
	} else {
	kmutex_t *q_lock = &queue->q_vd->vdev_scan_io_queue_lock;

	mutex_enter(q_lock);
	while (queue->q_inflight_bytes >= queue->q_maxinflight_bytes)
	cv_wait(&queue->q_zio_cv, q_lock);
	queue->q_inflight_bytes += BP_GET_PSIZE(bp);
	mutex_exit(q_lock);
	}

	count_block(scn, dp->dp_blkstats, bp);
	zio_nowait(zio_read(scn->scn_zio_root, spa, bp, data, size,
	dsl_scan_scrub_done, queue, ZIO_PRIORITY_SCRUB, zio_flags, zb));
	}

	/*
	* This is the primary extent sorting algorithm. We balance two parameters:
	* 1) how many bytes of I/O are in an extent
	* 2) how well the extent is filled with I/O (as a fraction of its total size)
	* Since we allow extents to have gaps between their constituent I/Os, it's
	* possible to have a fairly large extent that contains the same amount of
	* I/O bytes than a much smaller extent, which just packs the I/O more tightly.
	* The algorithm sorts based on a score calculated from the extent's size,
	* the relative fill volume (in %) and a "fill weight" parameter that controls
	* the split between whether we prefer larger extents or more well populated
	* extents:
	*
	* SCORE = FILL_IN_BYTES + (FILL_IN_PERCENT * FILL_IN_BYTES * FILL_WEIGHT)
	*
	* Example:
	* 1) assume extsz = 64 MiB
	* 2) assume fill = 32 MiB (extent is half full)
	* 3) assume fill_weight = 3
	* 4) SCORE = 32M + (((32M * 100) / 64M) * 3 * 32M) / 100
	* SCORE = 32M + (50 * 3 * 32M) / 100
	* SCORE = 32M + (4800M / 100)
	* SCORE = 32M + 48M
	* ^ ^
	* \| +--- final total relative fill-based score
	* +--------- final total fill-based score
	* SCORE = 80M
	*
	* As can be seen, at fill_ratio=3, the algorithm is slightly biased towards
	* extents that are more completely filled (in a 3:2 ratio) vs just larger.
	* Note that as an optimization, we replace multiplication and division by
	* 100 with bitshifting by 7 (which effectively multiplies and divides by 128).
	*/
	static int
	ext_size_compare(const void x, const void y)
	{
	const range_seg_gap_t rsa = x, rsb = y;

	uint64_t sa = rsa->rs_end - rsa->rs_start;
	uint64_t sb = rsb->rs_end - rsb->rs_start;
	uint64_t score_a, score_b;

	score_a = rsa->rs_fill + ((((rsa->rs_fill << 7) / sa) *
	fill_weight * rsa->rs_fill) >> 7);
	score_b = rsb->rs_fill + ((((rsb->rs_fill << 7) / sb) *
	fill_weight * rsb->rs_fill) >> 7);

	if (score_a > score_b)
	return (-1);
	if (score_a == score_b) {
	if (rsa->rs_start < rsb->rs_start)
	return (-1);
	if (rsa->rs_start == rsb->rs_start)
	return (0);
	return (1);
	}
	return (1);
	}

	/*
	* Comparator for the q_sios_by_addr tree. Sorting is simply performed
	* based on LBA-order (from lowest to highest).
	*/
	static int
	sio_addr_compare(const void x, const void y)
	{
	const scan_io_t a = x, b = y;

	return (TREE_CMP(SIO_GET_OFFSET(a), SIO_GET_OFFSET(b)));
	}

	/* IO queues are created on demand when they are needed. */
	static dsl_scan_io_queue_t *
	scan_io_queue_create(vdev_t *vd)
	{
	dsl_scan_t *scn = vd->vdev_spa->spa_dsl_pool->dp_scan;
	dsl_scan_io_queue_t q = kmem_zalloc(sizeof (q), KM_SLEEP);

	q->q_scn = scn;
	q->q_vd = vd;
	q->q_sio_memused = 0;
	cv_init(&q->q_zio_cv, NULL, CV_DEFAULT, NULL);
	q->q_exts_by_addr = range_tree_create_impl(&rt_btree_ops, RANGE_SEG_GAP,
	&q->q_exts_by_size, 0, 0, ext_size_compare, zfs_scan_max_ext_gap);
	avl_create(&q->q_sios_by_addr, sio_addr_compare,
	sizeof (scan_io_t), offsetof(scan_io_t, sio_nodes.sio_addr_node));

	return (q);
	}

	/*
	* Destroys a scan queue and all segments and scan_io_t's contained in it.
	* No further execution of I/O occurs, anything pending in the queue is
	* simply freed without being executed.
	*/
	void
	dsl_scan_io_queue_destroy(dsl_scan_io_queue_t *queue)
	{
	dsl_scan_t *scn = queue->q_scn;
	scan_io_t *sio;
	void *cookie = NULL;
	int64_t bytes_dequeued = 0;

	ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));

	while ((sio = avl_destroy_nodes(&queue->q_sios_by_addr, &cookie)) !=
	NULL) {
	ASSERT(range_tree_contains(queue->q_exts_by_addr,
	SIO_GET_OFFSET(sio), SIO_GET_ASIZE(sio)));
	bytes_dequeued += SIO_GET_ASIZE(sio);
	queue->q_sio_memused -= SIO_GET_MUSED(sio);
	sio_free(sio);
	}

	ASSERT0(queue->q_sio_memused);
	atomic_add_64(&scn->scn_bytes_pending, -bytes_dequeued);
	range_tree_vacate(queue->q_exts_by_addr, NULL, queue);
	range_tree_destroy(queue->q_exts_by_addr);
	avl_destroy(&queue->q_sios_by_addr);
	cv_destroy(&queue->q_zio_cv);

	kmem_free(queue, sizeof (*queue));
	}

	/*
	* Properly transfers a dsl_scan_queue_t from `svd' to `tvd'. This is
	* called on behalf of vdev_top_transfer when creating or destroying
	* a mirror vdev due to zpool attach/detach.
	*/
	void
	dsl_scan_io_queue_vdev_xfer(vdev_t svd, vdev_t tvd)
	{
	mutex_enter(&svd->vdev_scan_io_queue_lock);
	mutex_enter(&tvd->vdev_scan_io_queue_lock);

	VERIFY3P(tvd->vdev_scan_io_queue, ==, NULL);
	tvd->vdev_scan_io_queue = svd->vdev_scan_io_queue;
	svd->vdev_scan_io_queue = NULL;
	if (tvd->vdev_scan_io_queue != NULL)
	tvd->vdev_scan_io_queue->q_vd = tvd;

	mutex_exit(&tvd->vdev_scan_io_queue_lock);
	mutex_exit(&svd->vdev_scan_io_queue_lock);
	}

	static void
	scan_io_queues_destroy(dsl_scan_t *scn)
	{
	vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;

	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
	vdev_t *tvd = rvd->vdev_child[i];

	mutex_enter(&tvd->vdev_scan_io_queue_lock);
	if (tvd->vdev_scan_io_queue != NULL)
	dsl_scan_io_queue_destroy(tvd->vdev_scan_io_queue);
	tvd->vdev_scan_io_queue = NULL;
	mutex_exit(&tvd->vdev_scan_io_queue_lock);
	}
	}

	static void
	dsl_scan_freed_dva(spa_t spa, const blkptr_t bp, int dva_i)
	{
	dsl_pool_t *dp = spa->spa_dsl_pool;
	dsl_scan_t *scn = dp->dp_scan;
	vdev_t *vdev;
	kmutex_t *q_lock;
	dsl_scan_io_queue_t *queue;
	scan_io_t srch_sio, sio;
	avl_index_t idx;
	uint64_t start, size;

	vdev = vdev_lookup_top(spa, DVA_GET_VDEV(&bp->blk_dva[dva_i]));
	ASSERT(vdev != NULL);
	q_lock = &vdev->vdev_scan_io_queue_lock;
	queue = vdev->vdev_scan_io_queue;

	mutex_enter(q_lock);
	if (queue == NULL) {
	mutex_exit(q_lock);
	return;
	}

	srch_sio = sio_alloc(BP_GET_NDVAS(bp));
	bp2sio(bp, srch_sio, dva_i);
	start = SIO_GET_OFFSET(srch_sio);
	size = SIO_GET_ASIZE(srch_sio);

	/*
	* We can find the zio in two states:
	* 1) Cold, just sitting in the queue of zio's to be issued at
	* some point in the future. In this case, all we do is
	* remove the zio from the q_sios_by_addr tree, decrement
	* its data volume from the containing range_seg_t and
	* resort the q_exts_by_size tree to reflect that the
	* range_seg_t has lost some of its 'fill'. We don't shorten
	* the range_seg_t - this is usually rare enough not to be
	* worth the extra hassle of trying keep track of precise
	* extent boundaries.
	* 2) Hot, where the zio is currently in-flight in
	* dsl_scan_issue_ios. In this case, we can't simply
	* reach in and stop the in-flight zio's, so we instead
	* block the caller. Eventually, dsl_scan_issue_ios will
	* be done with issuing the zio's it gathered and will
	* signal us.
	*/
	sio = avl_find(&queue->q_sios_by_addr, srch_sio, &idx);
	sio_free(srch_sio);

	if (sio != NULL) {
	int64_t asize = SIO_GET_ASIZE(sio);
	blkptr_t tmpbp;

	/* Got it while it was cold in the queue */
	ASSERT3U(start, ==, SIO_GET_OFFSET(sio));
	ASSERT3U(size, ==, asize);
	avl_remove(&queue->q_sios_by_addr, sio);
	queue->q_sio_memused -= SIO_GET_MUSED(sio);

	ASSERT(range_tree_contains(queue->q_exts_by_addr, start, size));
	range_tree_remove_fill(queue->q_exts_by_addr, start, size);

	/*
	* We only update scn_bytes_pending in the cold path,
	* otherwise it will already have been accounted for as
	* part of the zio's execution.
	*/
	atomic_add_64(&scn->scn_bytes_pending, -asize);

	/* count the block as though we issued it */
	sio2bp(sio, &tmpbp);
	count_block(scn, dp->dp_blkstats, &tmpbp);

	sio_free(sio);
	}
	mutex_exit(q_lock);
	}

	/*
	* Callback invoked when a zio_free() zio is executing. This needs to be
	* intercepted to prevent the zio from deallocating a particular portion
	* of disk space and it then getting reallocated and written to, while we
	* still have it queued up for processing.
	*/
	void
	dsl_scan_freed(spa_t spa, const blkptr_t bp)
	{
	dsl_pool_t *dp = spa->spa_dsl_pool;
	dsl_scan_t *scn = dp->dp_scan;

	ASSERT(!BP_IS_EMBEDDED(bp));
	ASSERT(scn != NULL);
	if (!dsl_scan_is_running(scn))
	return;

	for (int i = 0; i < BP_GET_NDVAS(bp); i++)
	dsl_scan_freed_dva(spa, bp, i);
	}

	/*
	* Check if a vdev needs resilvering (non-empty DTL), if so, and resilver has
	* not started, start it. Otherwise, only restart if max txg in DTL range is
	* greater than the max txg in the current scan. If the DTL max is less than
	* the scan max, then the vdev has not missed any new data since the resilver
	* started, so a restart is not needed.
	*/
	void
	dsl_scan_assess_vdev(dsl_pool_t dp, vdev_t vd)
	{
	uint64_t min, max;

	if (!vdev_resilver_needed(vd, &min, &max))
	return;

	if (!dsl_scan_resilvering(dp)) {
	spa_async_request(dp->dp_spa, SPA_ASYNC_RESILVER);
	return;
	}

	if (max <= dp->dp_scan->scn_phys.scn_max_txg)
	return;

	/* restart is needed, check if it can be deferred */
	if (spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER))
	vdev_defer_resilver(vd);
	else
	spa_async_request(dp->dp_spa, SPA_ASYNC_RESILVER);
	}

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs, zfs_, scan_vdev_limit, ULONG, ZMOD_RW,
	"Max bytes in flight per leaf vdev for scrubs and resilvers");

	ZFS_MODULE_PARAM(zfs, zfs_, scrub_min_time_ms, INT, ZMOD_RW,
	"Min millisecs to scrub per txg");

	ZFS_MODULE_PARAM(zfs, zfs_, obsolete_min_time_ms, INT, ZMOD_RW,
	"Min millisecs to obsolete per txg");

	ZFS_MODULE_PARAM(zfs, zfs_, free_min_time_ms, INT, ZMOD_RW,
	"Min millisecs to free per txg");

	ZFS_MODULE_PARAM(zfs, zfs_, resilver_min_time_ms, INT, ZMOD_RW,
	"Min millisecs to resilver per txg");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_suspend_progress, INT, ZMOD_RW,
	"Set to prevent scans from progressing");

	ZFS_MODULE_PARAM(zfs, zfs_, no_scrub_io, INT, ZMOD_RW,
	"Set to disable scrub I/O");

	ZFS_MODULE_PARAM(zfs, zfs_, no_scrub_prefetch, INT, ZMOD_RW,
	"Set to disable scrub prefetching");

	ZFS_MODULE_PARAM(zfs, zfs_, async_block_max_blocks, ULONG, ZMOD_RW,
	"Max number of blocks freed in one txg");

	ZFS_MODULE_PARAM(zfs, zfs_, max_async_dedup_frees, ULONG, ZMOD_RW,
	"Max number of dedup blocks freed in one txg");

	ZFS_MODULE_PARAM(zfs, zfs_, free_bpobj_enabled, INT, ZMOD_RW,
	"Enable processing of the free_bpobj");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_mem_lim_fact, INT, ZMOD_RW,
	"Fraction of RAM for scan hard limit");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_issue_strategy, INT, ZMOD_RW,
	"IO issuing strategy during scrubbing. "
	"0 = default, 1 = LBA, 2 = size");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_legacy, INT, ZMOD_RW,
	"Scrub using legacy non-sequential method");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_checkpoint_intval, INT, ZMOD_RW,
	"Scan progress on-disk checkpointing interval");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_max_ext_gap, ULONG, ZMOD_RW,
	"Max gap in bytes between sequential scrub / resilver I/Os");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_mem_lim_soft_fact, INT, ZMOD_RW,
	"Fraction of hard limit used as soft limit");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_strict_mem_lim, INT, ZMOD_RW,
	"Tunable to attempt to reduce lock contention");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_fill_weight, INT, ZMOD_RW,
	"Tunable to adjust bias towards more filled segments during scans");

	ZFS_MODULE_PARAM(zfs, zfs_, resilver_disable_defer, INT, ZMOD_RW,
	"Process all resilvers immediately");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/dsl_synctask.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/dsl_synctask.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/dsl_synctask.c (revision 365892)
	@@ -1,261 +1,257 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2012, 2017 by Delphix. All rights reserved.
	*/

	#include <sys/dmu.h>
	#include <sys/dmu_tx.h>
	#include <sys/dsl_pool.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_synctask.h>
	#include <sys/metaslab.h>

	#define DST_AVG_BLKSHIFT 14

	/* ARGSUSED */
	static int
	dsl_null_checkfunc(void arg, dmu_tx_t tx)
	{
	return (0);
	}

	static int
	dsl_sync_task_common(const char pool, dsl_checkfunc_t checkfunc,
	dsl_syncfunc_t syncfunc, dsl_sigfunc_t sigfunc, void *arg,
	int blocks_modified, zfs_space_check_t space_check, boolean_t early)
	{
	spa_t *spa;
	dmu_tx_t *tx;
	int err;
	dsl_sync_task_t dst = { { { NULL } } };
	dsl_pool_t *dp;

	err = spa_open(pool, &spa, FTAG);
	if (err != 0)
	return (err);
	dp = spa_get_dsl(spa);

	top:
	tx = dmu_tx_create_dd(dp->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));

	dst.dst_pool = dp;
	dst.dst_txg = dmu_tx_get_txg(tx);
	dst.dst_space = blocks_modified << DST_AVG_BLKSHIFT;
	dst.dst_space_check = space_check;
	dst.dst_checkfunc = checkfunc != NULL ? checkfunc : dsl_null_checkfunc;
	dst.dst_syncfunc = syncfunc;
	dst.dst_arg = arg;
	dst.dst_error = 0;
	dst.dst_nowaiter = B_FALSE;

	dsl_pool_config_enter(dp, FTAG);
	err = dst.dst_checkfunc(arg, tx);
	dsl_pool_config_exit(dp, FTAG);

	if (err != 0) {
	dmu_tx_commit(tx);
	spa_close(spa, FTAG);
	return (err);
	}

	txg_list_t *task_list = (early) ?
	&dp->dp_early_sync_tasks : &dp->dp_sync_tasks;
	VERIFY(txg_list_add_tail(task_list, &dst, dst.dst_txg));

	dmu_tx_commit(tx);

	if (sigfunc != NULL && txg_wait_synced_sig(dp, dst.dst_txg)) {
	/* current contract is to call func once */
	sigfunc(arg, tx);
	sigfunc = NULL; /* in case we're performing an EAGAIN retry */
	}
	txg_wait_synced(dp, dst.dst_txg);

	if (dst.dst_error == EAGAIN) {
	txg_wait_synced(dp, dst.dst_txg + TXG_DEFER_SIZE);
	goto top;
	}

	spa_close(spa, FTAG);
	return (dst.dst_error);
	}

	/*
	* Called from open context to perform a callback in syncing context. Waits
	* for the operation to complete.
	*
	* The checkfunc will be called from open context as a preliminary check
	* which can quickly fail. If it succeeds, it will be called again from
	* syncing context. The checkfunc should generally be designed to work
	* properly in either context, but if necessary it can check
	* dmu_tx_is_syncing(tx).
	*
	* The synctask infrastructure enforces proper locking strategy with respect
	* to the dp_config_rwlock -- the lock will always be held when the callbacks
	* are called. It will be held for read during the open-context (preliminary)
	* call to the checkfunc, and then held for write from syncing context during
	* the calls to the check and sync funcs.
	*
	* A dataset or pool name can be passed as the first argument. Typically,
	* the check func will hold, check the return value of the hold, and then
	* release the dataset. The sync func will VERIFYO(hold()) the dataset.
	* This is safe because no changes can be made between the check and sync funcs,
	* and the sync func will only be called if the check func successfully opened
	* the dataset.
	*/
	int
	dsl_sync_task(const char pool, dsl_checkfunc_t checkfunc,
	dsl_syncfunc_t syncfunc, void arg,
	int blocks_modified, zfs_space_check_t space_check)
	{
	return (dsl_sync_task_common(pool, checkfunc, syncfunc, NULL, arg,
	blocks_modified, space_check, B_FALSE));
	}

	/*
	* An early synctask works exactly as a standard synctask with one important
	* difference on the way it is handled during syncing context. Standard
	* synctasks run after we've written out all the dirty blocks of dirty
	* datasets. Early synctasks are executed before writing out any dirty data,
	* and thus before standard synctasks.
	*
	* For that reason, early synctasks can affect the process of writing dirty
	* changes to disk for the txg that they run and should be used with caution.
	* In addition, early synctasks should not dirty any metaslabs as this would
	* invalidate the precondition/invariant for subsequent early synctasks.
	* [see dsl_pool_sync() and dsl_early_sync_task_verify()]
	*/
	int
	dsl_early_sync_task(const char pool, dsl_checkfunc_t checkfunc,
	dsl_syncfunc_t syncfunc, void arg,
	int blocks_modified, zfs_space_check_t space_check)
	{
	return (dsl_sync_task_common(pool, checkfunc, syncfunc, NULL, arg,
	blocks_modified, space_check, B_TRUE));
	}

	/*
	* A standard synctask that can be interrupted from a signal. The sigfunc
	* is called once if a signal occurred while waiting for the task to sync.
	*/
	int
	dsl_sync_task_sig(const char pool, dsl_checkfunc_t checkfunc,
	dsl_syncfunc_t syncfunc, dsl_sigfunc_t sigfunc, void *arg,
	int blocks_modified, zfs_space_check_t space_check)
	{
	return (dsl_sync_task_common(pool, checkfunc, syncfunc, sigfunc, arg,
	blocks_modified, space_check, B_FALSE));
	}

	static void
	dsl_sync_task_nowait_common(dsl_pool_t dp, dsl_syncfunc_t syncfunc, void *arg,
	- int blocks_modified, zfs_space_check_t space_check, dmu_tx_t *tx,
	- boolean_t early)
	+ dmu_tx_t *tx, boolean_t early)
	{
	dsl_sync_task_t dst = kmem_zalloc(sizeof (dst), KM_SLEEP);

	dst->dst_pool = dp;
	dst->dst_txg = dmu_tx_get_txg(tx);
	- dst->dst_space = blocks_modified << DST_AVG_BLKSHIFT;
	- dst->dst_space_check = space_check;
	+ dst->dst_space_check = ZFS_SPACE_CHECK_NONE;
	dst->dst_checkfunc = dsl_null_checkfunc;
	dst->dst_syncfunc = syncfunc;
	dst->dst_arg = arg;
	dst->dst_error = 0;
	dst->dst_nowaiter = B_TRUE;

	txg_list_t *task_list = (early) ?
	&dp->dp_early_sync_tasks : &dp->dp_sync_tasks;
	VERIFY(txg_list_add_tail(task_list, dst, dst->dst_txg));
	}

	void
	dsl_sync_task_nowait(dsl_pool_t dp, dsl_syncfunc_t syncfunc, void *arg,
	- int blocks_modified, zfs_space_check_t space_check, dmu_tx_t *tx)
	+ dmu_tx_t *tx)
	{
	- dsl_sync_task_nowait_common(dp, syncfunc, arg,
	- blocks_modified, space_check, tx, B_FALSE);
	+ dsl_sync_task_nowait_common(dp, syncfunc, arg, tx, B_FALSE);
	}

	void
	dsl_early_sync_task_nowait(dsl_pool_t dp, dsl_syncfunc_t syncfunc, void *arg,
	- int blocks_modified, zfs_space_check_t space_check, dmu_tx_t *tx)
	+ dmu_tx_t *tx)
	{
	- dsl_sync_task_nowait_common(dp, syncfunc, arg,
	- blocks_modified, space_check, tx, B_TRUE);
	+ dsl_sync_task_nowait_common(dp, syncfunc, arg, tx, B_TRUE);
	}

	/*
	* Called in syncing context to execute the synctask.
	*/
	void
	dsl_sync_task_sync(dsl_sync_task_t dst, dmu_tx_t tx)
	{
	dsl_pool_t *dp = dst->dst_pool;

	ASSERT0(dst->dst_error);

	/*
	* Check for sufficient space.
	*
	* When the sync task was created, the caller specified the
	* type of space checking required. See the comment in
	* zfs_space_check_t for details on the semantics of each
	* type of space checking.
	*
	* We just check against what's on-disk; we don't want any
	* in-flight accounting to get in our way, because open context
	* may have already used up various in-core limits
	* (arc_tempreserve, dsl_pool_tempreserve).
	*/
	if (dst->dst_space_check != ZFS_SPACE_CHECK_NONE) {
	uint64_t quota = dsl_pool_unreserved_space(dp,
	dst->dst_space_check);
	uint64_t used = dsl_dir_phys(dp->dp_root_dir)->dd_used_bytes;

	/* MOS space is triple-dittoed, so we multiply by 3. */
	if (used + dst->dst_space * 3 > quota) {
	dst->dst_error = SET_ERROR(ENOSPC);
	if (dst->dst_nowaiter)
	kmem_free(dst, sizeof (*dst));
	return;
	}
	}

	/*
	* Check for errors by calling checkfunc.
	*/
	rrw_enter(&dp->dp_config_rwlock, RW_WRITER, FTAG);
	dst->dst_error = dst->dst_checkfunc(dst->dst_arg, tx);
	if (dst->dst_error == 0)
	dst->dst_syncfunc(dst->dst_arg, tx);
	rrw_exit(&dp->dp_config_rwlock, FTAG);
	if (dst->dst_nowaiter)
	kmem_free(dst, sizeof (*dst));
	}

	#if defined(_KERNEL)
	EXPORT_SYMBOL(dsl_sync_task);
	EXPORT_SYMBOL(dsl_sync_task_nowait);
	#endif
	Index: vendor-sys/openzfs/dist/module/zfs/fm.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/fm.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/fm.c (revision 365892)
	@@ -1,1674 +1,1686 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
	*/

	/*
	* Fault Management Architecture (FMA) Resource and Protocol Support
	*
	* The routines contained herein provide services to support kernel subsystems
	* in publishing fault management telemetry (see PSARC 2002/412 and 2003/089).
	*
	* Name-Value Pair Lists
	*
	* The embodiment of an FMA protocol element (event, fmri or authority) is a
	* name-value pair list (nvlist_t). FMA-specific nvlist constructor and
	* destructor functions, fm_nvlist_create() and fm_nvlist_destroy(), are used
	* to create an nvpair list using custom allocators. Callers may choose to
	* allocate either from the kernel memory allocator, or from a preallocated
	* buffer, useful in constrained contexts like high-level interrupt routines.
	*
	* Protocol Event and FMRI Construction
	*
	* Convenience routines are provided to construct nvlist events according to
	* the FMA Event Protocol and Naming Schema specification for ereports and
	* FMRIs for the dev, cpu, hc, mem, legacy hc and de schemes.
	*
	* ENA Manipulation
	*
	* Routines to generate ENA formats 0, 1 and 2 are available as well as
	* routines to increment formats 1 and 2. Individual fields within the
	* ENA are extractable via fm_ena_time_get(), fm_ena_id_get(),
	* fm_ena_format_get() and fm_ena_gen_get().
	*/

	#include <sys/types.h>
	#include <sys/time.h>
	#include <sys/list.h>
	#include <sys/nvpair.h>
	#include <sys/cmn_err.h>
	#include <sys/sysmacros.h>
	#include <sys/sunddi.h>
	#include <sys/systeminfo.h>
	#include <sys/fm/util.h>
	#include <sys/fm/protocol.h>
	#include <sys/kstat.h>
	#include <sys/zfs_context.h>
	#ifdef _KERNEL
	#include <sys/atomic.h>
	#include <sys/condvar.h>
	#include <sys/console.h>
	#include <sys/time.h>
	#include <sys/zfs_ioctl.h>

	int zfs_zevent_len_max = 0;
	int zfs_zevent_cols = 80;
	int zfs_zevent_console = 0;

	static int zevent_len_cur = 0;
	static int zevent_waiters = 0;
	static int zevent_flags = 0;

	/* Num events rate limited since the last time zfs_zevent_next() was called */
	static uint64_t ratelimit_dropped = 0;

	/*
	* The EID (Event IDentifier) is used to uniquely tag a zevent when it is
	* posted. The posted EIDs are monotonically increasing but not persistent.
	* They will be reset to the initial value (1) each time the kernel module is
	* loaded.
	*/
	static uint64_t zevent_eid = 0;

	static kmutex_t zevent_lock;
	static list_t zevent_list;
	static kcondvar_t zevent_cv;
	#endif /* _KERNEL */


	/*
	* Common fault management kstats to record event generation failures
	*/

	struct erpt_kstat {
	kstat_named_t erpt_dropped; /* num erpts dropped on post */
	kstat_named_t erpt_set_failed; /* num erpt set failures */
	kstat_named_t fmri_set_failed; /* num fmri set failures */
	kstat_named_t payload_set_failed; /* num payload set failures */
	+ kstat_named_t erpt_duplicates; /* num duplicate erpts */
	};

	static struct erpt_kstat erpt_kstat_data = {
	{ "erpt-dropped", KSTAT_DATA_UINT64 },
	{ "erpt-set-failed", KSTAT_DATA_UINT64 },
	{ "fmri-set-failed", KSTAT_DATA_UINT64 },
	- { "payload-set-failed", KSTAT_DATA_UINT64 }
	+ { "payload-set-failed", KSTAT_DATA_UINT64 },
	+ { "erpt-duplicates", KSTAT_DATA_UINT64 }
	};

	kstat_t *fm_ksp;

	#ifdef _KERNEL

	/*
	* Formatting utility function for fm_nvprintr. We attempt to wrap chunks of
	* output so they aren't split across console lines, and return the end column.
	*/
	/PRINTFLIKE4/
	static int
	fm_printf(int depth, int c, int cols, const char *format, ...)
	{
	va_list ap;
	int width;
	char c1;

	va_start(ap, format);
	width = vsnprintf(&c1, sizeof (c1), format, ap);
	va_end(ap);

	if (c + width >= cols) {
	console_printf("\n");
	c = 0;
	if (format[0] != ' ' && depth > 0) {
	console_printf(" ");
	c++;
	}
	}

	va_start(ap, format);
	console_vprintf(format, ap);
	va_end(ap);

	return ((c + width) % cols);
	}

	/*
	* Recursively print an nvlist in the specified column width and return the
	* column we end up in. This function is called recursively by fm_nvprint(),
	* below. We generically format the entire nvpair using hexadecimal
	* integers and strings, and elide any integer arrays. Arrays are basically
	* used for cache dumps right now, so we suppress them so as not to overwhelm
	* the amount of console output we produce at panic time. This can be further
	* enhanced as FMA technology grows based upon the needs of consumers. All
	* FMA telemetry is logged using the dump device transport, so the console
	* output serves only as a fallback in case this procedure is unsuccessful.
	*/
	static int
	fm_nvprintr(nvlist_t *nvl, int d, int c, int cols)
	{
	nvpair_t *nvp;

	for (nvp = nvlist_next_nvpair(nvl, NULL);
	nvp != NULL; nvp = nvlist_next_nvpair(nvl, nvp)) {

	data_type_t type = nvpair_type(nvp);
	const char *name = nvpair_name(nvp);

	boolean_t b;
	uint8_t i8;
	uint16_t i16;
	uint32_t i32;
	uint64_t i64;
	char *str;
	nvlist_t *cnv;

	if (strcmp(name, FM_CLASS) == 0)
	continue; /* already printed by caller */

	c = fm_printf(d, c, cols, " %s=", name);

	switch (type) {
	case DATA_TYPE_BOOLEAN:
	c = fm_printf(d + 1, c, cols, " 1");
	break;

	case DATA_TYPE_BOOLEAN_VALUE:
	(void) nvpair_value_boolean_value(nvp, &b);
	c = fm_printf(d + 1, c, cols, b ? "1" : "0");
	break;

	case DATA_TYPE_BYTE:
	(void) nvpair_value_byte(nvp, &i8);
	c = fm_printf(d + 1, c, cols, "0x%x", i8);
	break;

	case DATA_TYPE_INT8:
	(void) nvpair_value_int8(nvp, (void *)&i8);
	c = fm_printf(d + 1, c, cols, "0x%x", i8);
	break;

	case DATA_TYPE_UINT8:
	(void) nvpair_value_uint8(nvp, &i8);
	c = fm_printf(d + 1, c, cols, "0x%x", i8);
	break;

	case DATA_TYPE_INT16:
	(void) nvpair_value_int16(nvp, (void *)&i16);
	c = fm_printf(d + 1, c, cols, "0x%x", i16);
	break;

	case DATA_TYPE_UINT16:
	(void) nvpair_value_uint16(nvp, &i16);
	c = fm_printf(d + 1, c, cols, "0x%x", i16);
	break;

	case DATA_TYPE_INT32:
	(void) nvpair_value_int32(nvp, (void *)&i32);
	c = fm_printf(d + 1, c, cols, "0x%x", i32);
	break;

	case DATA_TYPE_UINT32:
	(void) nvpair_value_uint32(nvp, &i32);
	c = fm_printf(d + 1, c, cols, "0x%x", i32);
	break;

	case DATA_TYPE_INT64:
	(void) nvpair_value_int64(nvp, (void *)&i64);
	c = fm_printf(d + 1, c, cols, "0x%llx",
	(u_longlong_t)i64);
	break;

	case DATA_TYPE_UINT64:
	(void) nvpair_value_uint64(nvp, &i64);
	c = fm_printf(d + 1, c, cols, "0x%llx",
	(u_longlong_t)i64);
	break;

	case DATA_TYPE_HRTIME:
	(void) nvpair_value_hrtime(nvp, (void *)&i64);
	c = fm_printf(d + 1, c, cols, "0x%llx",
	(u_longlong_t)i64);
	break;

	case DATA_TYPE_STRING:
	(void) nvpair_value_string(nvp, &str);
	c = fm_printf(d + 1, c, cols, "\"%s\"",
	str ? str : "<NULL>");
	break;

	case DATA_TYPE_NVLIST:
	c = fm_printf(d + 1, c, cols, "[");
	(void) nvpair_value_nvlist(nvp, &cnv);
	c = fm_nvprintr(cnv, d + 1, c, cols);
	c = fm_printf(d + 1, c, cols, " ]");
	break;

	case DATA_TYPE_NVLIST_ARRAY: {
	nvlist_t **val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[");
	(void) nvpair_value_nvlist_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++) {
	c = fm_nvprintr(val[i], d + 1, c, cols);
	}
	c = fm_printf(d + 1, c, cols, " ]");
	}
	break;

	case DATA_TYPE_INT8_ARRAY: {
	int8_t *val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[ ");
	(void) nvpair_value_int8_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	c = fm_printf(d + 1, c, cols, "0x%llx ",
	(u_longlong_t)val[i]);

	c = fm_printf(d + 1, c, cols, "]");
	break;
	}

	case DATA_TYPE_UINT8_ARRAY: {
	uint8_t *val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[ ");
	(void) nvpair_value_uint8_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	c = fm_printf(d + 1, c, cols, "0x%llx ",
	(u_longlong_t)val[i]);

	c = fm_printf(d + 1, c, cols, "]");
	break;
	}

	case DATA_TYPE_INT16_ARRAY: {
	int16_t *val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[ ");
	(void) nvpair_value_int16_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	c = fm_printf(d + 1, c, cols, "0x%llx ",
	(u_longlong_t)val[i]);

	c = fm_printf(d + 1, c, cols, "]");
	break;
	}

	case DATA_TYPE_UINT16_ARRAY: {
	uint16_t *val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[ ");
	(void) nvpair_value_uint16_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	c = fm_printf(d + 1, c, cols, "0x%llx ",
	(u_longlong_t)val[i]);

	c = fm_printf(d + 1, c, cols, "]");
	break;
	}

	case DATA_TYPE_INT32_ARRAY: {
	int32_t *val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[ ");
	(void) nvpair_value_int32_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	c = fm_printf(d + 1, c, cols, "0x%llx ",
	(u_longlong_t)val[i]);

	c = fm_printf(d + 1, c, cols, "]");
	break;
	}

	case DATA_TYPE_UINT32_ARRAY: {
	uint32_t *val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[ ");
	(void) nvpair_value_uint32_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	c = fm_printf(d + 1, c, cols, "0x%llx ",
	(u_longlong_t)val[i]);

	c = fm_printf(d + 1, c, cols, "]");
	break;
	}

	case DATA_TYPE_INT64_ARRAY: {
	int64_t *val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[ ");
	(void) nvpair_value_int64_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	c = fm_printf(d + 1, c, cols, "0x%llx ",
	(u_longlong_t)val[i]);

	c = fm_printf(d + 1, c, cols, "]");
	break;
	}

	case DATA_TYPE_UINT64_ARRAY: {
	uint64_t *val;
	uint_t i, nelem;

	c = fm_printf(d + 1, c, cols, "[ ");
	(void) nvpair_value_uint64_array(nvp, &val, &nelem);
	for (i = 0; i < nelem; i++)
	c = fm_printf(d + 1, c, cols, "0x%llx ",
	(u_longlong_t)val[i]);

	c = fm_printf(d + 1, c, cols, "]");
	break;
	}

	case DATA_TYPE_STRING_ARRAY:
	case DATA_TYPE_BOOLEAN_ARRAY:
	case DATA_TYPE_BYTE_ARRAY:
	c = fm_printf(d + 1, c, cols, "[...]");
	break;

	case DATA_TYPE_UNKNOWN:
	case DATA_TYPE_DONTCARE:
	c = fm_printf(d + 1, c, cols, "<unknown>");
	break;
	}
	}

	return (c);
	}

	void
	fm_nvprint(nvlist_t *nvl)
	{
	char *class;
	int c = 0;

	console_printf("\n");

	if (nvlist_lookup_string(nvl, FM_CLASS, &class) == 0)
	c = fm_printf(0, c, zfs_zevent_cols, "%s", class);

	if (fm_nvprintr(nvl, 0, c, zfs_zevent_cols) != 0)
	console_printf("\n");

	console_printf("\n");
	}

	static zevent_t *
	zfs_zevent_alloc(void)
	{
	zevent_t *ev;

	ev = kmem_zalloc(sizeof (zevent_t), KM_SLEEP);

	list_create(&ev->ev_ze_list, sizeof (zfs_zevent_t),
	offsetof(zfs_zevent_t, ze_node));
	list_link_init(&ev->ev_node);

	return (ev);
	}

	static void
	zfs_zevent_free(zevent_t *ev)
	{
	/* Run provided cleanup callback */
	ev->ev_cb(ev->ev_nvl, ev->ev_detector);

	list_destroy(&ev->ev_ze_list);
	kmem_free(ev, sizeof (zevent_t));
	}

	static void
	zfs_zevent_drain(zevent_t *ev)
	{
	zfs_zevent_t *ze;

	ASSERT(MUTEX_HELD(&zevent_lock));
	list_remove(&zevent_list, ev);

	/* Remove references to this event in all private file data */
	while ((ze = list_head(&ev->ev_ze_list)) != NULL) {
	list_remove(&ev->ev_ze_list, ze);
	ze->ze_zevent = NULL;
	ze->ze_dropped++;
	}

	zfs_zevent_free(ev);
	}

	void
	zfs_zevent_drain_all(int *count)
	{
	zevent_t *ev;

	mutex_enter(&zevent_lock);
	while ((ev = list_head(&zevent_list)) != NULL)
	zfs_zevent_drain(ev);

	*count = zevent_len_cur;
	zevent_len_cur = 0;
	mutex_exit(&zevent_lock);
	}

	/*
	* New zevents are inserted at the head. If the maximum queue
	* length is exceeded a zevent will be drained from the tail.
	* As part of this any user space processes which currently have
	* a reference to this zevent_t in their private data will have
	* this reference set to NULL.
	*/
	static void
	zfs_zevent_insert(zevent_t *ev)
	{
	ASSERT(MUTEX_HELD(&zevent_lock));
	list_insert_head(&zevent_list, ev);

	if (zevent_len_cur >= zfs_zevent_len_max)
	zfs_zevent_drain(list_tail(&zevent_list));
	else
	zevent_len_cur++;
	}

	/*
	* Post a zevent. The cb will be called when nvl and detector are no longer
	* needed, i.e.:
	* - An error happened and a zevent can't be posted. In this case, cb is called
	* before zfs_zevent_post() returns.
	* - The event is being drained and freed.
	*/
	int
	zfs_zevent_post(nvlist_t nvl, nvlist_t detector, zevent_cb_t *cb)
	{
	inode_timespec_t tv;
	int64_t tv_array[2];
	uint64_t eid;
	size_t nvl_size = 0;
	zevent_t *ev;
	int error;

	ASSERT(cb != NULL);

	gethrestime(&tv);
	tv_array[0] = tv.tv_sec;
	tv_array[1] = tv.tv_nsec;

	error = nvlist_add_int64_array(nvl, FM_EREPORT_TIME, tv_array, 2);
	if (error) {
	atomic_inc_64(&erpt_kstat_data.erpt_set_failed.value.ui64);
	goto out;
	}

	eid = atomic_inc_64_nv(&zevent_eid);
	error = nvlist_add_uint64(nvl, FM_EREPORT_EID, eid);
	if (error) {
	atomic_inc_64(&erpt_kstat_data.erpt_set_failed.value.ui64);
	goto out;
	}

	error = nvlist_size(nvl, &nvl_size, NV_ENCODE_NATIVE);
	if (error) {
	atomic_inc_64(&erpt_kstat_data.erpt_dropped.value.ui64);
	goto out;
	}

	if (nvl_size > ERPT_DATA_SZ \|\| nvl_size == 0) {
	atomic_inc_64(&erpt_kstat_data.erpt_dropped.value.ui64);
	error = EOVERFLOW;
	goto out;
	}

	if (zfs_zevent_console)
	fm_nvprint(nvl);

	ev = zfs_zevent_alloc();
	if (ev == NULL) {
	atomic_inc_64(&erpt_kstat_data.erpt_dropped.value.ui64);
	error = ENOMEM;
	goto out;
	}

	ev->ev_nvl = nvl;
	ev->ev_detector = detector;
	ev->ev_cb = cb;
	ev->ev_eid = eid;

	mutex_enter(&zevent_lock);
	zfs_zevent_insert(ev);
	cv_broadcast(&zevent_cv);
	mutex_exit(&zevent_lock);

	out:
	if (error)
	cb(nvl, detector);

	return (error);
	}

	+void
	+zfs_zevent_track_duplicate(void)
	+{
	+ atomic_inc_64(&erpt_kstat_data.erpt_duplicates.value.ui64);
	+}
	+
	static int
	zfs_zevent_minor_to_state(minor_t minor, zfs_zevent_t **ze)
	{
	*ze = zfsdev_get_state(minor, ZST_ZEVENT);
	if (*ze == NULL)
	return (SET_ERROR(EBADF));

	return (0);
	}

	int
	zfs_zevent_fd_hold(int fd, minor_t minorp, zfs_zevent_t *ze)
	{
	int error;

	error = zfsdev_getminor(fd, minorp);
	if (error == 0)
	error = zfs_zevent_minor_to_state(*minorp, ze);

	if (error)
	zfs_zevent_fd_rele(fd);

	return (error);
	}

	void
	zfs_zevent_fd_rele(int fd)
	{
	zfs_file_put(fd);
	}

	/*
	* Get the next zevent in the stream and place a copy in 'event'. This
	* may fail with ENOMEM if the encoded nvlist size exceeds the passed
	* 'event_size'. In this case the stream pointer is not advanced and
	* and 'event_size' is set to the minimum required buffer size.
	*/
	int
	zfs_zevent_next(zfs_zevent_t ze, nvlist_t event, uint64_t event_size,
	uint64_t *dropped)
	{
	zevent_t *ev;
	size_t size;
	int error = 0;

	mutex_enter(&zevent_lock);
	if (ze->ze_zevent == NULL) {
	/* New stream start at the beginning/tail */
	ev = list_tail(&zevent_list);
	if (ev == NULL) {
	error = ENOENT;
	goto out;
	}
	} else {
	/*
	* Existing stream continue with the next element and remove
	* ourselves from the wait queue for the previous element
	*/
	ev = list_prev(&zevent_list, ze->ze_zevent);
	if (ev == NULL) {
	error = ENOENT;
	goto out;
	}
	}

	VERIFY(nvlist_size(ev->ev_nvl, &size, NV_ENCODE_NATIVE) == 0);
	if (size > *event_size) {
	*event_size = size;
	error = ENOMEM;
	goto out;
	}

	if (ze->ze_zevent)
	list_remove(&ze->ze_zevent->ev_ze_list, ze);

	ze->ze_zevent = ev;
	list_insert_head(&ev->ev_ze_list, ze);
	(void) nvlist_dup(ev->ev_nvl, event, KM_SLEEP);
	*dropped = ze->ze_dropped;

	#ifdef _KERNEL
	/* Include events dropped due to rate limiting */
	*dropped += ratelimit_dropped;
	ratelimit_dropped = 0;
	#endif
	ze->ze_dropped = 0;
	out:
	mutex_exit(&zevent_lock);

	return (error);
	}

	/*
	* Wait in an interruptible state for any new events.
	*/
	int
	zfs_zevent_wait(zfs_zevent_t *ze)
	{
	int error = EAGAIN;

	mutex_enter(&zevent_lock);
	zevent_waiters++;

	while (error == EAGAIN) {
	if (zevent_flags & ZEVENT_SHUTDOWN) {
	error = SET_ERROR(ESHUTDOWN);
	break;
	}

	error = cv_wait_sig(&zevent_cv, &zevent_lock);
	if (signal_pending(current)) {
	error = SET_ERROR(EINTR);
	break;
	} else if (!list_is_empty(&zevent_list)) {
	error = 0;
	continue;
	} else {
	error = EAGAIN;
	}
	}

	zevent_waiters--;
	mutex_exit(&zevent_lock);

	return (error);
	}

	/*
	* The caller may seek to a specific EID by passing that EID. If the EID
	* is still available in the posted list of events the cursor is positioned
	* there. Otherwise ENOENT is returned and the cursor is not moved.
	*
	* There are two reserved EIDs which may be passed and will never fail.
	* ZEVENT_SEEK_START positions the cursor at the start of the list, and
	* ZEVENT_SEEK_END positions the cursor at the end of the list.
	*/
	int
	zfs_zevent_seek(zfs_zevent_t *ze, uint64_t eid)
	{
	zevent_t *ev;
	int error = 0;

	mutex_enter(&zevent_lock);

	if (eid == ZEVENT_SEEK_START) {
	if (ze->ze_zevent)
	list_remove(&ze->ze_zevent->ev_ze_list, ze);

	ze->ze_zevent = NULL;
	goto out;
	}

	if (eid == ZEVENT_SEEK_END) {
	if (ze->ze_zevent)
	list_remove(&ze->ze_zevent->ev_ze_list, ze);

	ev = list_head(&zevent_list);
	if (ev) {
	ze->ze_zevent = ev;
	list_insert_head(&ev->ev_ze_list, ze);
	} else {
	ze->ze_zevent = NULL;
	}

	goto out;
	}

	for (ev = list_tail(&zevent_list); ev != NULL;
	ev = list_prev(&zevent_list, ev)) {
	if (ev->ev_eid == eid) {
	if (ze->ze_zevent)
	list_remove(&ze->ze_zevent->ev_ze_list, ze);

	ze->ze_zevent = ev;
	list_insert_head(&ev->ev_ze_list, ze);
	break;
	}
	}

	if (ev == NULL)
	error = ENOENT;

	out:
	mutex_exit(&zevent_lock);

	return (error);
	}

	void
	zfs_zevent_init(zfs_zevent_t **zep)
	{
	zfs_zevent_t *ze;

	ze = *zep = kmem_zalloc(sizeof (zfs_zevent_t), KM_SLEEP);
	list_link_init(&ze->ze_node);
	}

	void
	zfs_zevent_destroy(zfs_zevent_t *ze)
	{
	mutex_enter(&zevent_lock);
	if (ze->ze_zevent)
	list_remove(&ze->ze_zevent->ev_ze_list, ze);
	mutex_exit(&zevent_lock);

	kmem_free(ze, sizeof (zfs_zevent_t));
	}
	#endif /* _KERNEL */

	/*
	* Wrappers for FM nvlist allocators
	*/
	/* ARGSUSED */
	static void *
	i_fm_alloc(nv_alloc_t *nva, size_t size)
	{
	return (kmem_zalloc(size, KM_SLEEP));
	}

	/* ARGSUSED */
	static void
	i_fm_free(nv_alloc_t nva, void buf, size_t size)
	{
	kmem_free(buf, size);
	}

	const nv_alloc_ops_t fm_mem_alloc_ops = {
	.nv_ao_init = NULL,
	.nv_ao_fini = NULL,
	.nv_ao_alloc = i_fm_alloc,
	.nv_ao_free = i_fm_free,
	.nv_ao_reset = NULL
	};

	/*
	* Create and initialize a new nv_alloc_t for a fixed buffer, buf. A pointer
	* to the newly allocated nv_alloc_t structure is returned upon success or NULL
	* is returned to indicate that the nv_alloc structure could not be created.
	*/
	nv_alloc_t *
	fm_nva_xcreate(char *buf, size_t bufsz)
	{
	nv_alloc_t *nvhdl = kmem_zalloc(sizeof (nv_alloc_t), KM_SLEEP);

	if (bufsz == 0 \|\| nv_alloc_init(nvhdl, nv_fixed_ops, buf, bufsz) != 0) {
	kmem_free(nvhdl, sizeof (nv_alloc_t));
	return (NULL);
	}

	return (nvhdl);
	}

	/*
	* Destroy a previously allocated nv_alloc structure. The fixed buffer
	* associated with nva must be freed by the caller.
	*/
	void
	fm_nva_xdestroy(nv_alloc_t *nva)
	{
	nv_alloc_fini(nva);
	kmem_free(nva, sizeof (nv_alloc_t));
	}

	/*
	* Create a new nv list. A pointer to a new nv list structure is returned
	* upon success or NULL is returned to indicate that the structure could
	* not be created. The newly created nv list is created and managed by the
	* operations installed in nva. If nva is NULL, the default FMA nva
	* operations are installed and used.
	*
	* When called from the kernel and nva == NULL, this function must be called
	* from passive kernel context with no locks held that can prevent a
	* sleeping memory allocation from occurring. Otherwise, this function may
	* be called from other kernel contexts as long a valid nva created via
	* fm_nva_create() is supplied.
	*/
	nvlist_t *
	fm_nvlist_create(nv_alloc_t *nva)
	{
	int hdl_alloced = 0;
	nvlist_t *nvl;
	nv_alloc_t *nvhdl;

	if (nva == NULL) {
	nvhdl = kmem_zalloc(sizeof (nv_alloc_t), KM_SLEEP);

	if (nv_alloc_init(nvhdl, &fm_mem_alloc_ops, NULL, 0) != 0) {
	kmem_free(nvhdl, sizeof (nv_alloc_t));
	return (NULL);
	}
	hdl_alloced = 1;
	} else {
	nvhdl = nva;
	}

	if (nvlist_xalloc(&nvl, NV_UNIQUE_NAME, nvhdl) != 0) {
	if (hdl_alloced) {
	nv_alloc_fini(nvhdl);
	kmem_free(nvhdl, sizeof (nv_alloc_t));
	}
	return (NULL);
	}

	return (nvl);
	}

	/*
	* Destroy a previously allocated nvlist structure. flag indicates whether
	* or not the associated nva structure should be freed (FM_NVA_FREE) or
	* retained (FM_NVA_RETAIN). Retaining the nv alloc structure allows
	* it to be re-used for future nvlist creation operations.
	*/
	void
	fm_nvlist_destroy(nvlist_t *nvl, int flag)
	{
	nv_alloc_t *nva = nvlist_lookup_nv_alloc(nvl);

	nvlist_free(nvl);

	if (nva != NULL) {
	if (flag == FM_NVA_FREE)
	fm_nva_xdestroy(nva);
	}
	}

	int
	i_fm_payload_set(nvlist_t payload, const char name, va_list ap)
	{
	int nelem, ret = 0;
	data_type_t type;

	while (ret == 0 && name != NULL) {
	type = va_arg(ap, data_type_t);
	switch (type) {
	case DATA_TYPE_BYTE:
	ret = nvlist_add_byte(payload, name,
	va_arg(ap, uint_t));
	break;
	case DATA_TYPE_BYTE_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_byte_array(payload, name,
	va_arg(ap, uchar_t *), nelem);
	break;
	case DATA_TYPE_BOOLEAN_VALUE:
	ret = nvlist_add_boolean_value(payload, name,
	va_arg(ap, boolean_t));
	break;
	case DATA_TYPE_BOOLEAN_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_boolean_array(payload, name,
	va_arg(ap, boolean_t *), nelem);
	break;
	case DATA_TYPE_INT8:
	ret = nvlist_add_int8(payload, name,
	va_arg(ap, int));
	break;
	case DATA_TYPE_INT8_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_int8_array(payload, name,
	va_arg(ap, int8_t *), nelem);
	break;
	case DATA_TYPE_UINT8:
	ret = nvlist_add_uint8(payload, name,
	va_arg(ap, uint_t));
	break;
	case DATA_TYPE_UINT8_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_uint8_array(payload, name,
	va_arg(ap, uint8_t *), nelem);
	break;
	case DATA_TYPE_INT16:
	ret = nvlist_add_int16(payload, name,
	va_arg(ap, int));
	break;
	case DATA_TYPE_INT16_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_int16_array(payload, name,
	va_arg(ap, int16_t *), nelem);
	break;
	case DATA_TYPE_UINT16:
	ret = nvlist_add_uint16(payload, name,
	va_arg(ap, uint_t));
	break;
	case DATA_TYPE_UINT16_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_uint16_array(payload, name,
	va_arg(ap, uint16_t *), nelem);
	break;
	case DATA_TYPE_INT32:
	ret = nvlist_add_int32(payload, name,
	va_arg(ap, int32_t));
	break;
	case DATA_TYPE_INT32_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_int32_array(payload, name,
	va_arg(ap, int32_t *), nelem);
	break;
	case DATA_TYPE_UINT32:
	ret = nvlist_add_uint32(payload, name,
	va_arg(ap, uint32_t));
	break;
	case DATA_TYPE_UINT32_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_uint32_array(payload, name,
	va_arg(ap, uint32_t *), nelem);
	break;
	case DATA_TYPE_INT64:
	ret = nvlist_add_int64(payload, name,
	va_arg(ap, int64_t));
	break;
	case DATA_TYPE_INT64_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_int64_array(payload, name,
	va_arg(ap, int64_t *), nelem);
	break;
	case DATA_TYPE_UINT64:
	ret = nvlist_add_uint64(payload, name,
	va_arg(ap, uint64_t));
	break;
	case DATA_TYPE_UINT64_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_uint64_array(payload, name,
	va_arg(ap, uint64_t *), nelem);
	break;
	case DATA_TYPE_STRING:
	ret = nvlist_add_string(payload, name,
	va_arg(ap, char *));
	break;
	case DATA_TYPE_STRING_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_string_array(payload, name,
	va_arg(ap, char **), nelem);
	break;
	case DATA_TYPE_NVLIST:
	ret = nvlist_add_nvlist(payload, name,
	va_arg(ap, nvlist_t *));
	break;
	case DATA_TYPE_NVLIST_ARRAY:
	nelem = va_arg(ap, int);
	ret = nvlist_add_nvlist_array(payload, name,
	va_arg(ap, nvlist_t **), nelem);
	break;
	default:
	ret = EINVAL;
	}

	name = va_arg(ap, char *);
	}
	return (ret);
	}

	void
	fm_payload_set(nvlist_t *payload, ...)
	{
	int ret;
	const char *name;
	va_list ap;

	va_start(ap, payload);
	name = va_arg(ap, char *);
	ret = i_fm_payload_set(payload, name, ap);
	va_end(ap);

	if (ret)
	atomic_inc_64(&erpt_kstat_data.payload_set_failed.value.ui64);
	}

	/*
	* Set-up and validate the members of an ereport event according to:
	*
	* Member name Type Value
	* ====================================================
	* class string ereport
	* version uint8_t 0
	* ena uint64_t <ena>
	* detector nvlist_t <detector>
	* ereport-payload nvlist_t <var args>
	*
	* We don't actually add a 'version' member to the payload. Really,
	* the version quoted to us by our caller is that of the category 1
	* "ereport" event class (and we require FM_EREPORT_VERS0) but
	* the payload version of the actual leaf class event under construction
	* may be something else. Callers should supply a version in the varargs,
	* or (better) we could take two version arguments - one for the
	* ereport category 1 classification (expect FM_EREPORT_VERS0) and one
	* for the leaf class.
	*/
	void
	fm_ereport_set(nvlist_t ereport, int version, const char erpt_class,
	uint64_t ena, const nvlist_t *detector, ...)
	{
	char ereport_class[FM_MAX_CLASS];
	const char *name;
	va_list ap;
	int ret;

	if (version != FM_EREPORT_VERS0) {
	atomic_inc_64(&erpt_kstat_data.erpt_set_failed.value.ui64);
	return;
	}

	(void) snprintf(ereport_class, FM_MAX_CLASS, "%s.%s",
	FM_EREPORT_CLASS, erpt_class);
	if (nvlist_add_string(ereport, FM_CLASS, ereport_class) != 0) {
	atomic_inc_64(&erpt_kstat_data.erpt_set_failed.value.ui64);
	return;
	}

	if (nvlist_add_uint64(ereport, FM_EREPORT_ENA, ena)) {
	atomic_inc_64(&erpt_kstat_data.erpt_set_failed.value.ui64);
	}

	if (nvlist_add_nvlist(ereport, FM_EREPORT_DETECTOR,
	(nvlist_t *)detector) != 0) {
	atomic_inc_64(&erpt_kstat_data.erpt_set_failed.value.ui64);
	}

	va_start(ap, detector);
	name = va_arg(ap, const char *);
	ret = i_fm_payload_set(ereport, name, ap);
	va_end(ap);

	if (ret)
	atomic_inc_64(&erpt_kstat_data.erpt_set_failed.value.ui64);
	}

	/*
	* Set-up and validate the members of an hc fmri according to;
	*
	* Member name Type Value
	* ===================================================
	* version uint8_t 0
	* auth nvlist_t <auth>
	* hc-name string <name>
	* hc-id string <id>
	*
	* Note that auth and hc-id are optional members.
	*/

	#define HC_MAXPAIRS 20
	#define HC_MAXNAMELEN 50

	static int
	fm_fmri_hc_set_common(nvlist_t fmri, int version, const nvlist_t auth)
	{
	if (version != FM_HC_SCHEME_VERSION) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return (0);
	}

	if (nvlist_add_uint8(fmri, FM_VERSION, version) != 0 \|\|
	nvlist_add_string(fmri, FM_FMRI_SCHEME, FM_FMRI_SCHEME_HC) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return (0);
	}

	if (auth != NULL && nvlist_add_nvlist(fmri, FM_FMRI_AUTHORITY,
	(nvlist_t *)auth) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return (0);
	}

	return (1);
	}

	void
	fm_fmri_hc_set(nvlist_t fmri, int version, const nvlist_t auth,
	nvlist_t *snvl, int npairs, ...)
	{
	nv_alloc_t *nva = nvlist_lookup_nv_alloc(fmri);
	nvlist_t *pairs[HC_MAXPAIRS];
	va_list ap;
	int i;

	if (!fm_fmri_hc_set_common(fmri, version, auth))
	return;

	npairs = MIN(npairs, HC_MAXPAIRS);

	va_start(ap, npairs);
	for (i = 0; i < npairs; i++) {
	const char name = va_arg(ap, const char );
	uint32_t id = va_arg(ap, uint32_t);
	char idstr[11];

	(void) snprintf(idstr, sizeof (idstr), "%u", id);

	pairs[i] = fm_nvlist_create(nva);
	if (nvlist_add_string(pairs[i], FM_FMRI_HC_NAME, name) != 0 \|\|
	nvlist_add_string(pairs[i], FM_FMRI_HC_ID, idstr) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	}
	}
	va_end(ap);

	if (nvlist_add_nvlist_array(fmri, FM_FMRI_HC_LIST, pairs, npairs) != 0)
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);

	for (i = 0; i < npairs; i++)
	fm_nvlist_destroy(pairs[i], FM_NVA_RETAIN);

	if (snvl != NULL) {
	if (nvlist_add_nvlist(fmri, FM_FMRI_HC_SPECIFIC, snvl) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	}
	}
	}

	void
	fm_fmri_hc_create(nvlist_t fmri, int version, const nvlist_t auth,
	nvlist_t snvl, nvlist_t bboard, int npairs, ...)
	{
	nv_alloc_t *nva = nvlist_lookup_nv_alloc(fmri);
	nvlist_t *pairs[HC_MAXPAIRS];
	nvlist_t **hcl;
	uint_t n;
	int i, j;
	va_list ap;
	char hcname, hcid;

	if (!fm_fmri_hc_set_common(fmri, version, auth))
	return;

	/*
	* copy the bboard nvpairs to the pairs array
	*/
	if (nvlist_lookup_nvlist_array(bboard, FM_FMRI_HC_LIST, &hcl, &n)
	!= 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	for (i = 0; i < n; i++) {
	if (nvlist_lookup_string(hcl[i], FM_FMRI_HC_NAME,
	&hcname) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}
	if (nvlist_lookup_string(hcl[i], FM_FMRI_HC_ID, &hcid) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	pairs[i] = fm_nvlist_create(nva);
	if (nvlist_add_string(pairs[i], FM_FMRI_HC_NAME, hcname) != 0 \|\|
	nvlist_add_string(pairs[i], FM_FMRI_HC_ID, hcid) != 0) {
	for (j = 0; j <= i; j++) {
	if (pairs[j] != NULL)
	fm_nvlist_destroy(pairs[j],
	FM_NVA_RETAIN);
	}
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}
	}

	/*
	* create the pairs from passed in pairs
	*/
	npairs = MIN(npairs, HC_MAXPAIRS);

	va_start(ap, npairs);
	for (i = n; i < npairs + n; i++) {
	const char name = va_arg(ap, const char );
	uint32_t id = va_arg(ap, uint32_t);
	char idstr[11];
	(void) snprintf(idstr, sizeof (idstr), "%u", id);
	pairs[i] = fm_nvlist_create(nva);
	if (nvlist_add_string(pairs[i], FM_FMRI_HC_NAME, name) != 0 \|\|
	nvlist_add_string(pairs[i], FM_FMRI_HC_ID, idstr) != 0) {
	for (j = 0; j <= i; j++) {
	if (pairs[j] != NULL)
	fm_nvlist_destroy(pairs[j],
	FM_NVA_RETAIN);
	}
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}
	}
	va_end(ap);

	/*
	* Create the fmri hc list
	*/
	if (nvlist_add_nvlist_array(fmri, FM_FMRI_HC_LIST, pairs,
	npairs + n) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	for (i = 0; i < npairs + n; i++) {
	fm_nvlist_destroy(pairs[i], FM_NVA_RETAIN);
	}

	if (snvl != NULL) {
	if (nvlist_add_nvlist(fmri, FM_FMRI_HC_SPECIFIC, snvl) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}
	}
	}

	/*
	* Set-up and validate the members of an dev fmri according to:
	*
	* Member name Type Value
	* ====================================================
	* version uint8_t 0
	* auth nvlist_t <auth>
	* devpath string <devpath>
	* [devid] string <devid>
	* [target-port-l0id] string <target-port-lun0-id>
	*
	* Note that auth and devid are optional members.
	*/
	void
	fm_fmri_dev_set(nvlist_t fmri_dev, int version, const nvlist_t auth,
	const char devpath, const char devid, const char *tpl0)
	{
	int err = 0;

	if (version != DEV_SCHEME_VERSION0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	err \|= nvlist_add_uint8(fmri_dev, FM_VERSION, version);
	err \|= nvlist_add_string(fmri_dev, FM_FMRI_SCHEME, FM_FMRI_SCHEME_DEV);

	if (auth != NULL) {
	err \|= nvlist_add_nvlist(fmri_dev, FM_FMRI_AUTHORITY,
	(nvlist_t *)auth);
	}

	err \|= nvlist_add_string(fmri_dev, FM_FMRI_DEV_PATH, devpath);

	if (devid != NULL)
	err \|= nvlist_add_string(fmri_dev, FM_FMRI_DEV_ID, devid);

	if (tpl0 != NULL)
	err \|= nvlist_add_string(fmri_dev, FM_FMRI_DEV_TGTPTLUN0, tpl0);

	if (err)
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);

	}

	/*
	* Set-up and validate the members of an cpu fmri according to:
	*
	* Member name Type Value
	* ====================================================
	* version uint8_t 0
	* auth nvlist_t <auth>
	* cpuid uint32_t <cpu_id>
	* cpumask uint8_t <cpu_mask>
	* serial uint64_t <serial_id>
	*
	* Note that auth, cpumask, serial are optional members.
	*
	*/
	void
	fm_fmri_cpu_set(nvlist_t fmri_cpu, int version, const nvlist_t auth,
	uint32_t cpu_id, uint8_t cpu_maskp, const char serial_idp)
	{
	uint64_t *failedp = &erpt_kstat_data.fmri_set_failed.value.ui64;

	if (version < CPU_SCHEME_VERSION1) {
	atomic_inc_64(failedp);
	return;
	}

	if (nvlist_add_uint8(fmri_cpu, FM_VERSION, version) != 0) {
	atomic_inc_64(failedp);
	return;
	}

	if (nvlist_add_string(fmri_cpu, FM_FMRI_SCHEME,
	FM_FMRI_SCHEME_CPU) != 0) {
	atomic_inc_64(failedp);
	return;
	}

	if (auth != NULL && nvlist_add_nvlist(fmri_cpu, FM_FMRI_AUTHORITY,
	(nvlist_t *)auth) != 0)
	atomic_inc_64(failedp);

	if (nvlist_add_uint32(fmri_cpu, FM_FMRI_CPU_ID, cpu_id) != 0)
	atomic_inc_64(failedp);

	if (cpu_maskp != NULL && nvlist_add_uint8(fmri_cpu, FM_FMRI_CPU_MASK,
	*cpu_maskp) != 0)
	atomic_inc_64(failedp);

	if (serial_idp == NULL \|\| nvlist_add_string(fmri_cpu,
	FM_FMRI_CPU_SERIAL_ID, (char *)serial_idp) != 0)
	atomic_inc_64(failedp);
	}

	/*
	* Set-up and validate the members of a mem according to:
	*
	* Member name Type Value
	* ====================================================
	* version uint8_t 0
	* auth nvlist_t <auth> [optional]
	* unum string <unum>
	* serial string <serial> [optional*]
	* offset uint64_t <offset> [optional]
	*
	* * serial is required if offset is present
	*/
	void
	fm_fmri_mem_set(nvlist_t fmri, int version, const nvlist_t auth,
	const char unum, const char serial, uint64_t offset)
	{
	if (version != MEM_SCHEME_VERSION0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	if (!serial && (offset != (uint64_t)-1)) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	if (nvlist_add_uint8(fmri, FM_VERSION, version) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	if (nvlist_add_string(fmri, FM_FMRI_SCHEME, FM_FMRI_SCHEME_MEM) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	if (auth != NULL) {
	if (nvlist_add_nvlist(fmri, FM_FMRI_AUTHORITY,
	(nvlist_t *)auth) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	}
	}

	if (nvlist_add_string(fmri, FM_FMRI_MEM_UNUM, unum) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	}

	if (serial != NULL) {
	if (nvlist_add_string_array(fmri, FM_FMRI_MEM_SERIAL_ID,
	(char **)&serial, 1) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	}
	if (offset != (uint64_t)-1 && nvlist_add_uint64(fmri,
	FM_FMRI_MEM_OFFSET, offset) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	}
	}
	}

	void
	fm_fmri_zfs_set(nvlist_t *fmri, int version, uint64_t pool_guid,
	uint64_t vdev_guid)
	{
	if (version != ZFS_SCHEME_VERSION0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	if (nvlist_add_uint8(fmri, FM_VERSION, version) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	if (nvlist_add_string(fmri, FM_FMRI_SCHEME, FM_FMRI_SCHEME_ZFS) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	return;
	}

	if (nvlist_add_uint64(fmri, FM_FMRI_ZFS_POOL, pool_guid) != 0) {
	atomic_inc_64(&erpt_kstat_data.fmri_set_failed.value.ui64);
	}

	if (vdev_guid != 0) {
	if (nvlist_add_uint64(fmri, FM_FMRI_ZFS_VDEV, vdev_guid) != 0) {
	atomic_inc_64(
	&erpt_kstat_data.fmri_set_failed.value.ui64);
	}
	}
	}

	uint64_t
	fm_ena_increment(uint64_t ena)
	{
	uint64_t new_ena;

	switch (ENA_FORMAT(ena)) {
	case FM_ENA_FMT1:
	new_ena = ena + (1 << ENA_FMT1_GEN_SHFT);
	break;
	case FM_ENA_FMT2:
	new_ena = ena + (1 << ENA_FMT2_GEN_SHFT);
	break;
	default:
	new_ena = 0;
	}

	return (new_ena);
	}

	uint64_t
	fm_ena_generate_cpu(uint64_t timestamp, processorid_t cpuid, uchar_t format)
	{
	uint64_t ena = 0;

	switch (format) {
	case FM_ENA_FMT1:
	if (timestamp) {
	ena = (uint64_t)((format & ENA_FORMAT_MASK) \|
	((cpuid << ENA_FMT1_CPUID_SHFT) &
	ENA_FMT1_CPUID_MASK) \|
	((timestamp << ENA_FMT1_TIME_SHFT) &
	ENA_FMT1_TIME_MASK));
	} else {
	ena = (uint64_t)((format & ENA_FORMAT_MASK) \|
	((cpuid << ENA_FMT1_CPUID_SHFT) &
	ENA_FMT1_CPUID_MASK) \|
	((gethrtime() << ENA_FMT1_TIME_SHFT) &
	ENA_FMT1_TIME_MASK));
	}
	break;
	case FM_ENA_FMT2:
	ena = (uint64_t)((format & ENA_FORMAT_MASK) \|
	((timestamp << ENA_FMT2_TIME_SHFT) & ENA_FMT2_TIME_MASK));
	break;
	default:
	break;
	}

	return (ena);
	}

	uint64_t
	fm_ena_generate(uint64_t timestamp, uchar_t format)
	{
	uint64_t ena;

	kpreempt_disable();
	ena = fm_ena_generate_cpu(timestamp, getcpuid(), format);
	kpreempt_enable();

	return (ena);
	}

	uint64_t
	fm_ena_generation_get(uint64_t ena)
	{
	uint64_t gen;

	switch (ENA_FORMAT(ena)) {
	case FM_ENA_FMT1:
	gen = (ena & ENA_FMT1_GEN_MASK) >> ENA_FMT1_GEN_SHFT;
	break;
	case FM_ENA_FMT2:
	gen = (ena & ENA_FMT2_GEN_MASK) >> ENA_FMT2_GEN_SHFT;
	break;
	default:
	gen = 0;
	break;
	}

	return (gen);
	}

	uchar_t
	fm_ena_format_get(uint64_t ena)
	{

	return (ENA_FORMAT(ena));
	}

	uint64_t
	fm_ena_id_get(uint64_t ena)
	{
	uint64_t id;

	switch (ENA_FORMAT(ena)) {
	case FM_ENA_FMT1:
	id = (ena & ENA_FMT1_ID_MASK) >> ENA_FMT1_ID_SHFT;
	break;
	case FM_ENA_FMT2:
	id = (ena & ENA_FMT2_ID_MASK) >> ENA_FMT2_ID_SHFT;
	break;
	default:
	id = 0;
	}

	return (id);
	}

	uint64_t
	fm_ena_time_get(uint64_t ena)
	{
	uint64_t time;

	switch (ENA_FORMAT(ena)) {
	case FM_ENA_FMT1:
	time = (ena & ENA_FMT1_TIME_MASK) >> ENA_FMT1_TIME_SHFT;
	break;
	case FM_ENA_FMT2:
	time = (ena & ENA_FMT2_TIME_MASK) >> ENA_FMT2_TIME_SHFT;
	break;
	default:
	time = 0;
	}

	return (time);
	}

	#ifdef _KERNEL
	/*
	* Helper function to increment ereport dropped count. Used by the event
	* rate limiting code to give feedback to the user about how many events were
	* rate limited by including them in the 'dropped' count.
	*/
	void
	fm_erpt_dropped_increment(void)
	{
	atomic_inc_64(&ratelimit_dropped);
	}

	void
	fm_init(void)
	{
	zevent_len_cur = 0;
	zevent_flags = 0;

	if (zfs_zevent_len_max == 0)
	zfs_zevent_len_max = ERPT_MAX_ERRS * MAX(max_ncpus, 4);

	/* Initialize zevent allocation and generation kstats */
	fm_ksp = kstat_create("zfs", 0, "fm", "misc", KSTAT_TYPE_NAMED,
	sizeof (struct erpt_kstat) / sizeof (kstat_named_t),
	KSTAT_FLAG_VIRTUAL);

	if (fm_ksp != NULL) {
	fm_ksp->ks_data = &erpt_kstat_data;
	kstat_install(fm_ksp);
	} else {
	cmn_err(CE_NOTE, "failed to create fm/misc kstat\n");
	}

	mutex_init(&zevent_lock, NULL, MUTEX_DEFAULT, NULL);
	list_create(&zevent_list, sizeof (zevent_t),
	offsetof(zevent_t, ev_node));
	cv_init(&zevent_cv, NULL, CV_DEFAULT, NULL);
	+
	+ zfs_ereport_init();
	}

	void
	fm_fini(void)
	{
	int count;
	+
	+ zfs_ereport_fini();

	zfs_zevent_drain_all(&count);

	mutex_enter(&zevent_lock);
	cv_broadcast(&zevent_cv);

	zevent_flags \|= ZEVENT_SHUTDOWN;
	while (zevent_waiters > 0) {
	mutex_exit(&zevent_lock);
	schedule();
	mutex_enter(&zevent_lock);
	}
	mutex_exit(&zevent_lock);

	cv_destroy(&zevent_cv);
	list_destroy(&zevent_list);
	mutex_destroy(&zevent_lock);

	if (fm_ksp != NULL) {
	kstat_delete(fm_ksp);
	fm_ksp = NULL;
	}
	}
	#endif /* _KERNEL */

	ZFS_MODULE_PARAM(zfs_zevent, zfs_zevent_, len_max, INT, ZMOD_RW,
	"Max event queue length");

	ZFS_MODULE_PARAM(zfs_zevent, zfs_zevent_, cols, INT, ZMOD_RW,
	"Max event column width");

	ZFS_MODULE_PARAM(zfs_zevent, zfs_zevent_, console, INT, ZMOD_RW,
	"Log events to the console");
	Index: vendor-sys/openzfs/dist/module/zfs/metaslab.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/metaslab.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/metaslab.c (revision 365892)
	@@ -1,6236 +1,6237 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2019 by Delphix. All rights reserved.
	* Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
	+ * Copyright (c) 2015, Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2017, Intel Corporation.
	*/

	#include <sys/zfs_context.h>
	#include <sys/dmu.h>
	#include <sys/dmu_tx.h>
	#include <sys/space_map.h>
	#include <sys/metaslab_impl.h>
	#include <sys/vdev_impl.h>
	#include <sys/zio.h>
	#include <sys/spa_impl.h>
	#include <sys/zfeature.h>
	#include <sys/vdev_indirect_mapping.h>
	#include <sys/zap.h>
	#include <sys/btree.h>

	#define WITH_DF_BLOCK_ALLOCATOR

	#define GANG_ALLOCATION(flags) \
	((flags) & (METASLAB_GANG_CHILD \| METASLAB_GANG_HEADER))

	/*
	* Metaslab granularity, in bytes. This is roughly similar to what would be
	* referred to as the "stripe size" in traditional RAID arrays. In normal
	* operation, we will try to write this amount of data to a top-level vdev
	* before moving on to the next one.
	*/
	unsigned long metaslab_aliquot = 512 << 10;

	/*
	* For testing, make some blocks above a certain size be gang blocks.
	*/
	unsigned long metaslab_force_ganging = SPA_MAXBLOCKSIZE + 1;

	/*
	* In pools where the log space map feature is not enabled we touch
	* multiple metaslabs (and their respective space maps) with each
	* transaction group. Thus, we benefit from having a small space map
	* block size since it allows us to issue more I/O operations scattered
	* around the disk. So a sane default for the space map block size
	* is 8~16K.
	*/
	int zfs_metaslab_sm_blksz_no_log = (1 << 14);

	/*
	* When the log space map feature is enabled, we accumulate a lot of
	* changes per metaslab that are flushed once in a while so we benefit
	* from a bigger block size like 128K for the metaslab space maps.
	*/
	int zfs_metaslab_sm_blksz_with_log = (1 << 17);

	/*
	* The in-core space map representation is more compact than its on-disk form.
	* The zfs_condense_pct determines how much more compact the in-core
	* space map representation must be before we compact it on-disk.
	* Values should be greater than or equal to 100.
	*/
	int zfs_condense_pct = 200;

	/*
	* Condensing a metaslab is not guaranteed to actually reduce the amount of
	* space used on disk. In particular, a space map uses data in increments of
	* MAX(1 << ashift, space_map_blksz), so a metaslab might use the
	* same number of blocks after condensing. Since the goal of condensing is to
	* reduce the number of IOPs required to read the space map, we only want to
	* condense when we can be sure we will reduce the number of blocks used by the
	* space map. Unfortunately, we cannot precisely compute whether or not this is
	* the case in metaslab_should_condense since we are holding ms_lock. Instead,
	* we apply the following heuristic: do not condense a spacemap unless the
	* uncondensed size consumes greater than zfs_metaslab_condense_block_threshold
	* blocks.
	*/
	int zfs_metaslab_condense_block_threshold = 4;

	/*
	* The zfs_mg_noalloc_threshold defines which metaslab groups should
	* be eligible for allocation. The value is defined as a percentage of
	* free space. Metaslab groups that have more free space than
	* zfs_mg_noalloc_threshold are always eligible for allocations. Once
	* a metaslab group's free space is less than or equal to the
	* zfs_mg_noalloc_threshold the allocator will avoid allocating to that
	* group unless all groups in the pool have reached zfs_mg_noalloc_threshold.
	* Once all groups in the pool reach zfs_mg_noalloc_threshold then all
	* groups are allowed to accept allocations. Gang blocks are always
	* eligible to allocate on any metaslab group. The default value of 0 means
	* no metaslab group will be excluded based on this criterion.
	*/
	int zfs_mg_noalloc_threshold = 0;

	/*
	* Metaslab groups are considered eligible for allocations if their
	* fragmentation metric (measured as a percentage) is less than or
	* equal to zfs_mg_fragmentation_threshold. If a metaslab group
	* exceeds this threshold then it will be skipped unless all metaslab
	* groups within the metaslab class have also crossed this threshold.
	*
	* This tunable was introduced to avoid edge cases where we continue
	* allocating from very fragmented disks in our pool while other, less
	* fragmented disks, exists. On the other hand, if all disks in the
	* pool are uniformly approaching the threshold, the threshold can
	* be a speed bump in performance, where we keep switching the disks
	* that we allocate from (e.g. we allocate some segments from disk A
	* making it bypassing the threshold while freeing segments from disk
	* B getting its fragmentation below the threshold).
	*
	* Empirically, we've seen that our vdev selection for allocations is
	* good enough that fragmentation increases uniformly across all vdevs
	* the majority of the time. Thus we set the threshold percentage high
	* enough to avoid hitting the speed bump on pools that are being pushed
	* to the edge.
	*/
	int zfs_mg_fragmentation_threshold = 95;

	/*
	* Allow metaslabs to keep their active state as long as their fragmentation
	* percentage is less than or equal to zfs_metaslab_fragmentation_threshold. An
	* active metaslab that exceeds this threshold will no longer keep its active
	* status allowing better metaslabs to be selected.
	*/
	int zfs_metaslab_fragmentation_threshold = 70;

	/*
	* When set will load all metaslabs when pool is first opened.
	*/
	int metaslab_debug_load = 0;

	/*
	* When set will prevent metaslabs from being unloaded.
	*/
	int metaslab_debug_unload = 0;

	/*
	* Minimum size which forces the dynamic allocator to change
	* it's allocation strategy. Once the space map cannot satisfy
	* an allocation of this size then it switches to using more
	* aggressive strategy (i.e search by size rather than offset).
	*/
	uint64_t metaslab_df_alloc_threshold = SPA_OLD_MAXBLOCKSIZE;

	/*
	* The minimum free space, in percent, which must be available
	* in a space map to continue allocations in a first-fit fashion.
	* Once the space map's free space drops below this level we dynamically
	* switch to using best-fit allocations.
	*/
	int metaslab_df_free_pct = 4;

	/*
	* Maximum distance to search forward from the last offset. Without this
	* limit, fragmented pools can see >100,000 iterations and
	* metaslab_block_picker() becomes the performance limiting factor on
	* high-performance storage.
	*
	* With the default setting of 16MB, we typically see less than 500
	* iterations, even with very fragmented, ashift=9 pools. The maximum number
	* of iterations possible is:
	* metaslab_df_max_search / (2 * (1<<ashift))
	* With the default setting of 16MB this is 16*1024 (with ashift=9) or
	* 2048 (with ashift=12).
	*/
	int metaslab_df_max_search = 16 * 1024 * 1024;

	/*
	* Forces the metaslab_block_picker function to search for at least this many
	* segments forwards until giving up on finding a segment that the allocation
	* will fit into.
	*/
	uint32_t metaslab_min_search_count = 100;

	/*
	* If we are not searching forward (due to metaslab_df_max_search,
	* metaslab_df_free_pct, or metaslab_df_alloc_threshold), this tunable
	* controls what segment is used. If it is set, we will use the largest free
	* segment. If it is not set, we will use a segment of exactly the requested
	* size (or larger).
	*/
	int metaslab_df_use_largest_segment = B_FALSE;

	/*
	* Percentage of all cpus that can be used by the metaslab taskq.
	*/
	int metaslab_load_pct = 50;

	/*
	* These tunables control how long a metaslab will remain loaded after the
	* last allocation from it. A metaslab can't be unloaded until at least
	* metaslab_unload_delay TXG's and metaslab_unload_delay_ms milliseconds
	* have elapsed. However, zfs_metaslab_mem_limit may cause it to be
	* unloaded sooner. These settings are intended to be generous -- to keep
	* metaslabs loaded for a long time, reducing the rate of metaslab loading.
	*/
	int metaslab_unload_delay = 32;
	int metaslab_unload_delay_ms = 10 * 60 * 1000; /* ten minutes */

	/*
	* Max number of metaslabs per group to preload.
	*/
	int metaslab_preload_limit = 10;

	/*
	* Enable/disable preloading of metaslab.
	*/
	int metaslab_preload_enabled = B_TRUE;

	/*
	* Enable/disable fragmentation weighting on metaslabs.
	*/
	int metaslab_fragmentation_factor_enabled = B_TRUE;

	/*
	* Enable/disable lba weighting (i.e. outer tracks are given preference).
	*/
	int metaslab_lba_weighting_enabled = B_TRUE;

	/*
	* Enable/disable metaslab group biasing.
	*/
	int metaslab_bias_enabled = B_TRUE;

	/*
	* Enable/disable remapping of indirect DVAs to their concrete vdevs.
	*/
	boolean_t zfs_remap_blkptr_enable = B_TRUE;

	/*
	* Enable/disable segment-based metaslab selection.
	*/
	int zfs_metaslab_segment_weight_enabled = B_TRUE;

	/*
	* When using segment-based metaslab selection, we will continue
	* allocating from the active metaslab until we have exhausted
	* zfs_metaslab_switch_threshold of its buckets.
	*/
	int zfs_metaslab_switch_threshold = 2;

	/*
	* Internal switch to enable/disable the metaslab allocation tracing
	* facility.
	*/
	#ifdef _METASLAB_TRACING
	boolean_t metaslab_trace_enabled = B_TRUE;
	#endif

	/*
	* Maximum entries that the metaslab allocation tracing facility will keep
	* in a given list when running in non-debug mode. We limit the number
	* of entries in non-debug mode to prevent us from using up too much memory.
	* The limit should be sufficiently large that we don't expect any allocation
	* to every exceed this value. In debug mode, the system will panic if this
	* limit is ever reached allowing for further investigation.
	*/
	#ifdef _METASLAB_TRACING
	uint64_t metaslab_trace_max_entries = 5000;
	#endif

	/*
	* Maximum number of metaslabs per group that can be disabled
	* simultaneously.
	*/
	int max_disabled_ms = 3;

	/*
	* Time (in seconds) to respect ms_max_size when the metaslab is not loaded.
	* To avoid 64-bit overflow, don't set above UINT32_MAX.
	*/
	unsigned long zfs_metaslab_max_size_cache_sec = 3600; /* 1 hour */

	/*
	* Maximum percentage of memory to use on storing loaded metaslabs. If loading
	* a metaslab would take it over this percentage, the oldest selected metaslab
	* is automatically unloaded.
	*/
	int zfs_metaslab_mem_limit = 75;

	/*
	* Force the per-metaslab range trees to use 64-bit integers to store
	* segments. Used for debugging purposes.
	*/
	boolean_t zfs_metaslab_force_large_segs = B_FALSE;

	/*
	* By default we only store segments over a certain size in the size-sorted
	* metaslab trees (ms_allocatable_by_size and
	* ms_unflushed_frees_by_size). This dramatically reduces memory usage and
	* improves load and unload times at the cost of causing us to use slightly
	* larger segments than we would otherwise in some cases.
	*/
	uint32_t metaslab_by_size_min_shift = 14;

	static uint64_t metaslab_weight(metaslab_t *, boolean_t);
	static void metaslab_set_fragmentation(metaslab_t *, boolean_t);
	static void metaslab_free_impl(vdev_t *, uint64_t, uint64_t, boolean_t);
	static void metaslab_check_free_impl(vdev_t *, uint64_t, uint64_t);

	static void metaslab_passivate(metaslab_t *msp, uint64_t weight);
	static uint64_t metaslab_weight_from_range_tree(metaslab_t *msp);
	static void metaslab_flush_update(metaslab_t , dmu_tx_t );
	static unsigned int metaslab_idx_func(multilist_t , void );
	static void metaslab_evict(metaslab_t *, uint64_t);
	static void metaslab_rt_add(range_tree_t rt, range_seg_t rs, void *arg);
	#ifdef _METASLAB_TRACING
	kmem_cache_t *metaslab_alloc_trace_cache;

	typedef struct metaslab_stats {
	kstat_named_t metaslabstat_trace_over_limit;
	kstat_named_t metaslabstat_df_find_under_floor;
	kstat_named_t metaslabstat_reload_tree;
	} metaslab_stats_t;

	static metaslab_stats_t metaslab_stats = {
	{ "trace_over_limit", KSTAT_DATA_UINT64 },
	{ "df_find_under_floor", KSTAT_DATA_UINT64 },
	{ "reload_tree", KSTAT_DATA_UINT64 },
	};

	#define METASLABSTAT_BUMP(stat) \
	atomic_inc_64(&metaslab_stats.stat.value.ui64);


	kstat_t *metaslab_ksp;

	void
	metaslab_stat_init(void)
	{
	ASSERT(metaslab_alloc_trace_cache == NULL);
	metaslab_alloc_trace_cache = kmem_cache_create(
	"metaslab_alloc_trace_cache", sizeof (metaslab_alloc_trace_t),
	0, NULL, NULL, NULL, NULL, NULL, 0);
	metaslab_ksp = kstat_create("zfs", 0, "metaslab_stats",
	"misc", KSTAT_TYPE_NAMED, sizeof (metaslab_stats) /
	sizeof (kstat_named_t), KSTAT_FLAG_VIRTUAL);
	if (metaslab_ksp != NULL) {
	metaslab_ksp->ks_data = &metaslab_stats;
	kstat_install(metaslab_ksp);
	}
	}

	void
	metaslab_stat_fini(void)
	{
	if (metaslab_ksp != NULL) {
	kstat_delete(metaslab_ksp);
	metaslab_ksp = NULL;
	}

	kmem_cache_destroy(metaslab_alloc_trace_cache);
	metaslab_alloc_trace_cache = NULL;
	}
	#else

	void
	metaslab_stat_init(void)
	{
	}

	void
	metaslab_stat_fini(void)
	{
	}
	#endif

	/*
	* ==========================================================================
	* Metaslab classes
	* ==========================================================================
	*/
	metaslab_class_t *
	metaslab_class_create(spa_t spa, metaslab_ops_t ops)
	{
	metaslab_class_t *mc;

	mc = kmem_zalloc(sizeof (metaslab_class_t), KM_SLEEP);

	mc->mc_spa = spa;
	mc->mc_rotor = NULL;
	mc->mc_ops = ops;
	mutex_init(&mc->mc_lock, NULL, MUTEX_DEFAULT, NULL);
	mc->mc_metaslab_txg_list = multilist_create(sizeof (metaslab_t),
	offsetof(metaslab_t, ms_class_txg_node), metaslab_idx_func);
	mc->mc_alloc_slots = kmem_zalloc(spa->spa_alloc_count *
	sizeof (zfs_refcount_t), KM_SLEEP);
	mc->mc_alloc_max_slots = kmem_zalloc(spa->spa_alloc_count *
	sizeof (uint64_t), KM_SLEEP);
	for (int i = 0; i < spa->spa_alloc_count; i++)
	zfs_refcount_create_tracked(&mc->mc_alloc_slots[i]);

	return (mc);
	}

	void
	metaslab_class_destroy(metaslab_class_t *mc)
	{
	ASSERT(mc->mc_rotor == NULL);
	ASSERT(mc->mc_alloc == 0);
	ASSERT(mc->mc_deferred == 0);
	ASSERT(mc->mc_space == 0);
	ASSERT(mc->mc_dspace == 0);

	for (int i = 0; i < mc->mc_spa->spa_alloc_count; i++)
	zfs_refcount_destroy(&mc->mc_alloc_slots[i]);
	kmem_free(mc->mc_alloc_slots, mc->mc_spa->spa_alloc_count *
	sizeof (zfs_refcount_t));
	kmem_free(mc->mc_alloc_max_slots, mc->mc_spa->spa_alloc_count *
	sizeof (uint64_t));
	mutex_destroy(&mc->mc_lock);
	multilist_destroy(mc->mc_metaslab_txg_list);
	kmem_free(mc, sizeof (metaslab_class_t));
	}

	int
	metaslab_class_validate(metaslab_class_t *mc)
	{
	metaslab_group_t *mg;
	vdev_t *vd;

	/*
	* Must hold one of the spa_config locks.
	*/
	ASSERT(spa_config_held(mc->mc_spa, SCL_ALL, RW_READER) \|\|
	spa_config_held(mc->mc_spa, SCL_ALL, RW_WRITER));

	if ((mg = mc->mc_rotor) == NULL)
	return (0);

	do {
	vd = mg->mg_vd;
	ASSERT(vd->vdev_mg != NULL);
	ASSERT3P(vd->vdev_top, ==, vd);
	ASSERT3P(mg->mg_class, ==, mc);
	ASSERT3P(vd->vdev_ops, !=, &vdev_hole_ops);
	} while ((mg = mg->mg_next) != mc->mc_rotor);

	return (0);
	}

	static void
	metaslab_class_space_update(metaslab_class_t *mc, int64_t alloc_delta,
	int64_t defer_delta, int64_t space_delta, int64_t dspace_delta)
	{
	atomic_add_64(&mc->mc_alloc, alloc_delta);
	atomic_add_64(&mc->mc_deferred, defer_delta);
	atomic_add_64(&mc->mc_space, space_delta);
	atomic_add_64(&mc->mc_dspace, dspace_delta);
	}

	uint64_t
	metaslab_class_get_alloc(metaslab_class_t *mc)
	{
	return (mc->mc_alloc);
	}

	uint64_t
	metaslab_class_get_deferred(metaslab_class_t *mc)
	{
	return (mc->mc_deferred);
	}

	uint64_t
	metaslab_class_get_space(metaslab_class_t *mc)
	{
	return (mc->mc_space);
	}

	uint64_t
	metaslab_class_get_dspace(metaslab_class_t *mc)
	{
	return (spa_deflate(mc->mc_spa) ? mc->mc_dspace : mc->mc_space);
	}

	void
	metaslab_class_histogram_verify(metaslab_class_t *mc)
	{
	spa_t *spa = mc->mc_spa;
	vdev_t *rvd = spa->spa_root_vdev;
	uint64_t *mc_hist;
	int i;

	if ((zfs_flags & ZFS_DEBUG_HISTOGRAM_VERIFY) == 0)
	return;

	mc_hist = kmem_zalloc(sizeof (uint64_t) * RANGE_TREE_HISTOGRAM_SIZE,
	KM_SLEEP);

	for (int c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];
	metaslab_group_t *mg = tvd->vdev_mg;

	/*
	* Skip any holes, uninitialized top-levels, or
	* vdevs that are not in this metalab class.
	*/
	if (!vdev_is_concrete(tvd) \|\| tvd->vdev_ms_shift == 0 \|\|
	mg->mg_class != mc) {
	continue;
	}

	for (i = 0; i < RANGE_TREE_HISTOGRAM_SIZE; i++)
	mc_hist[i] += mg->mg_histogram[i];
	}

	for (i = 0; i < RANGE_TREE_HISTOGRAM_SIZE; i++)
	VERIFY3U(mc_hist[i], ==, mc->mc_histogram[i]);

	kmem_free(mc_hist, sizeof (uint64_t) * RANGE_TREE_HISTOGRAM_SIZE);
	}

	/*
	* Calculate the metaslab class's fragmentation metric. The metric
	* is weighted based on the space contribution of each metaslab group.
	* The return value will be a number between 0 and 100 (inclusive), or
	* ZFS_FRAG_INVALID if the metric has not been set. See comment above the
	* zfs_frag_table for more information about the metric.
	*/
	uint64_t
	metaslab_class_fragmentation(metaslab_class_t *mc)
	{
	vdev_t *rvd = mc->mc_spa->spa_root_vdev;
	uint64_t fragmentation = 0;

	spa_config_enter(mc->mc_spa, SCL_VDEV, FTAG, RW_READER);

	for (int c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];
	metaslab_group_t *mg = tvd->vdev_mg;

	/*
	* Skip any holes, uninitialized top-levels,
	* or vdevs that are not in this metalab class.
	*/
	if (!vdev_is_concrete(tvd) \|\| tvd->vdev_ms_shift == 0 \|\|
	mg->mg_class != mc) {
	continue;
	}

	/*
	* If a metaslab group does not contain a fragmentation
	* metric then just bail out.
	*/
	if (mg->mg_fragmentation == ZFS_FRAG_INVALID) {
	spa_config_exit(mc->mc_spa, SCL_VDEV, FTAG);
	return (ZFS_FRAG_INVALID);
	}

	/*
	* Determine how much this metaslab_group is contributing
	* to the overall pool fragmentation metric.
	*/
	fragmentation += mg->mg_fragmentation *
	metaslab_group_get_space(mg);
	}
	fragmentation /= metaslab_class_get_space(mc);

	ASSERT3U(fragmentation, <=, 100);
	spa_config_exit(mc->mc_spa, SCL_VDEV, FTAG);
	return (fragmentation);
	}

	/*
	* Calculate the amount of expandable space that is available in
	* this metaslab class. If a device is expanded then its expandable
	* space will be the amount of allocatable space that is currently not
	* part of this metaslab class.
	*/
	uint64_t
	metaslab_class_expandable_space(metaslab_class_t *mc)
	{
	vdev_t *rvd = mc->mc_spa->spa_root_vdev;
	uint64_t space = 0;

	spa_config_enter(mc->mc_spa, SCL_VDEV, FTAG, RW_READER);
	for (int c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];
	metaslab_group_t *mg = tvd->vdev_mg;

	if (!vdev_is_concrete(tvd) \|\| tvd->vdev_ms_shift == 0 \|\|
	mg->mg_class != mc) {
	continue;
	}

	/*
	* Calculate if we have enough space to add additional
	* metaslabs. We report the expandable space in terms
	* of the metaslab size since that's the unit of expansion.
	*/
	space += P2ALIGN(tvd->vdev_max_asize - tvd->vdev_asize,
	1ULL << tvd->vdev_ms_shift);
	}
	spa_config_exit(mc->mc_spa, SCL_VDEV, FTAG);
	return (space);
	}

	void
	metaslab_class_evict_old(metaslab_class_t *mc, uint64_t txg)
	{
	multilist_t *ml = mc->mc_metaslab_txg_list;
	for (int i = 0; i < multilist_get_num_sublists(ml); i++) {
	multilist_sublist_t *mls = multilist_sublist_lock(ml, i);
	metaslab_t *msp = multilist_sublist_head(mls);
	multilist_sublist_unlock(mls);
	while (msp != NULL) {
	mutex_enter(&msp->ms_lock);

	/*
	* If the metaslab has been removed from the list
	* (which could happen if we were at the memory limit
	* and it was evicted during this loop), then we can't
	* proceed and we should restart the sublist.
	*/
	if (!multilist_link_active(&msp->ms_class_txg_node)) {
	mutex_exit(&msp->ms_lock);
	i--;
	break;
	}
	mls = multilist_sublist_lock(ml, i);
	metaslab_t *next_msp = multilist_sublist_next(mls, msp);
	multilist_sublist_unlock(mls);
	if (txg >
	msp->ms_selected_txg + metaslab_unload_delay &&
	gethrtime() > msp->ms_selected_time +
	(uint64_t)MSEC2NSEC(metaslab_unload_delay_ms)) {
	metaslab_evict(msp, txg);
	} else {
	/*
	* Once we've hit a metaslab selected too
	* recently to evict, we're done evicting for
	* now.
	*/
	mutex_exit(&msp->ms_lock);
	break;
	}
	mutex_exit(&msp->ms_lock);
	msp = next_msp;
	}
	}
	}

	static int
	metaslab_compare(const void x1, const void x2)
	{
	const metaslab_t m1 = (const metaslab_t )x1;
	const metaslab_t m2 = (const metaslab_t )x2;

	int sort1 = 0;
	int sort2 = 0;
	if (m1->ms_allocator != -1 && m1->ms_primary)
	sort1 = 1;
	else if (m1->ms_allocator != -1 && !m1->ms_primary)
	sort1 = 2;
	if (m2->ms_allocator != -1 && m2->ms_primary)
	sort2 = 1;
	else if (m2->ms_allocator != -1 && !m2->ms_primary)
	sort2 = 2;

	/*
	* Sort inactive metaslabs first, then primaries, then secondaries. When
	* selecting a metaslab to allocate from, an allocator first tries its
	* primary, then secondary active metaslab. If it doesn't have active
	* metaslabs, or can't allocate from them, it searches for an inactive
	* metaslab to activate. If it can't find a suitable one, it will steal
	* a primary or secondary metaslab from another allocator.
	*/
	if (sort1 < sort2)
	return (-1);
	if (sort1 > sort2)
	return (1);

	int cmp = TREE_CMP(m2->ms_weight, m1->ms_weight);
	if (likely(cmp))
	return (cmp);

	IMPLY(TREE_CMP(m1->ms_start, m2->ms_start) == 0, m1 == m2);

	return (TREE_CMP(m1->ms_start, m2->ms_start));
	}

	/*
	* ==========================================================================
	* Metaslab groups
	* ==========================================================================
	*/
	/*
	* Update the allocatable flag and the metaslab group's capacity.
	* The allocatable flag is set to true if the capacity is below
	* the zfs_mg_noalloc_threshold or has a fragmentation value that is
	* greater than zfs_mg_fragmentation_threshold. If a metaslab group
	* transitions from allocatable to non-allocatable or vice versa then the
	* metaslab group's class is updated to reflect the transition.
	*/
	static void
	metaslab_group_alloc_update(metaslab_group_t *mg)
	{
	vdev_t *vd = mg->mg_vd;
	metaslab_class_t *mc = mg->mg_class;
	vdev_stat_t *vs = &vd->vdev_stat;
	boolean_t was_allocatable;
	boolean_t was_initialized;

	ASSERT(vd == vd->vdev_top);
	ASSERT3U(spa_config_held(mc->mc_spa, SCL_ALLOC, RW_READER), ==,
	SCL_ALLOC);

	mutex_enter(&mg->mg_lock);
	was_allocatable = mg->mg_allocatable;
	was_initialized = mg->mg_initialized;

	mg->mg_free_capacity = ((vs->vs_space - vs->vs_alloc) * 100) /
	(vs->vs_space + 1);

	mutex_enter(&mc->mc_lock);

	/*
	* If the metaslab group was just added then it won't
	* have any space until we finish syncing out this txg.
	* At that point we will consider it initialized and available
	* for allocations. We also don't consider non-activated
	* metaslab groups (e.g. vdevs that are in the middle of being removed)
	* to be initialized, because they can't be used for allocation.
	*/
	mg->mg_initialized = metaslab_group_initialized(mg);
	if (!was_initialized && mg->mg_initialized) {
	mc->mc_groups++;
	} else if (was_initialized && !mg->mg_initialized) {
	ASSERT3U(mc->mc_groups, >, 0);
	mc->mc_groups--;
	}
	if (mg->mg_initialized)
	mg->mg_no_free_space = B_FALSE;

	/*
	* A metaslab group is considered allocatable if it has plenty
	* of free space or is not heavily fragmented. We only take
	* fragmentation into account if the metaslab group has a valid
	* fragmentation metric (i.e. a value between 0 and 100).
	*/
	mg->mg_allocatable = (mg->mg_activation_count > 0 &&
	mg->mg_free_capacity > zfs_mg_noalloc_threshold &&
	(mg->mg_fragmentation == ZFS_FRAG_INVALID \|\|
	mg->mg_fragmentation <= zfs_mg_fragmentation_threshold));

	/*
	* The mc_alloc_groups maintains a count of the number of
	* groups in this metaslab class that are still above the
	* zfs_mg_noalloc_threshold. This is used by the allocating
	* threads to determine if they should avoid allocations to
	* a given group. The allocator will avoid allocations to a group
	* if that group has reached or is below the zfs_mg_noalloc_threshold
	* and there are still other groups that are above the threshold.
	* When a group transitions from allocatable to non-allocatable or
	* vice versa we update the metaslab class to reflect that change.
	* When the mc_alloc_groups value drops to 0 that means that all
	* groups have reached the zfs_mg_noalloc_threshold making all groups
	* eligible for allocations. This effectively means that all devices
	* are balanced again.
	*/
	if (was_allocatable && !mg->mg_allocatable)
	mc->mc_alloc_groups--;
	else if (!was_allocatable && mg->mg_allocatable)
	mc->mc_alloc_groups++;
	mutex_exit(&mc->mc_lock);

	mutex_exit(&mg->mg_lock);
	}

	int
	metaslab_sort_by_flushed(const void va, const void vb)
	{
	const metaslab_t *a = va;
	const metaslab_t *b = vb;

	int cmp = TREE_CMP(a->ms_unflushed_txg, b->ms_unflushed_txg);
	if (likely(cmp))
	return (cmp);

	uint64_t a_vdev_id = a->ms_group->mg_vd->vdev_id;
	uint64_t b_vdev_id = b->ms_group->mg_vd->vdev_id;
	cmp = TREE_CMP(a_vdev_id, b_vdev_id);
	if (cmp)
	return (cmp);

	return (TREE_CMP(a->ms_id, b->ms_id));
	}

	metaslab_group_t *
	metaslab_group_create(metaslab_class_t mc, vdev_t vd, int allocators)
	{
	metaslab_group_t *mg;

	mg = kmem_zalloc(sizeof (metaslab_group_t), KM_SLEEP);
	mutex_init(&mg->mg_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&mg->mg_ms_disabled_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&mg->mg_ms_disabled_cv, NULL, CV_DEFAULT, NULL);
	avl_create(&mg->mg_metaslab_tree, metaslab_compare,
	sizeof (metaslab_t), offsetof(metaslab_t, ms_group_node));
	mg->mg_vd = vd;
	mg->mg_class = mc;
	mg->mg_activation_count = 0;
	mg->mg_initialized = B_FALSE;
	mg->mg_no_free_space = B_TRUE;
	mg->mg_allocators = allocators;

	mg->mg_allocator = kmem_zalloc(allocators *
	sizeof (metaslab_group_allocator_t), KM_SLEEP);
	for (int i = 0; i < allocators; i++) {
	metaslab_group_allocator_t *mga = &mg->mg_allocator[i];
	zfs_refcount_create_tracked(&mga->mga_alloc_queue_depth);
	}

	mg->mg_taskq = taskq_create("metaslab_group_taskq", metaslab_load_pct,
	maxclsyspri, 10, INT_MAX, TASKQ_THREADS_CPU_PCT \| TASKQ_DYNAMIC);

	return (mg);
	}

	void
	metaslab_group_destroy(metaslab_group_t *mg)
	{
	ASSERT(mg->mg_prev == NULL);
	ASSERT(mg->mg_next == NULL);
	/*
	* We may have gone below zero with the activation count
	* either because we never activated in the first place or
	* because we're done, and possibly removing the vdev.
	*/
	ASSERT(mg->mg_activation_count <= 0);

	taskq_destroy(mg->mg_taskq);
	avl_destroy(&mg->mg_metaslab_tree);
	mutex_destroy(&mg->mg_lock);
	mutex_destroy(&mg->mg_ms_disabled_lock);
	cv_destroy(&mg->mg_ms_disabled_cv);

	for (int i = 0; i < mg->mg_allocators; i++) {
	metaslab_group_allocator_t *mga = &mg->mg_allocator[i];
	zfs_refcount_destroy(&mga->mga_alloc_queue_depth);
	}
	kmem_free(mg->mg_allocator, mg->mg_allocators *
	sizeof (metaslab_group_allocator_t));

	kmem_free(mg, sizeof (metaslab_group_t));
	}

	void
	metaslab_group_activate(metaslab_group_t *mg)
	{
	metaslab_class_t *mc = mg->mg_class;
	metaslab_group_t mgprev, mgnext;

	ASSERT3U(spa_config_held(mc->mc_spa, SCL_ALLOC, RW_WRITER), !=, 0);

	ASSERT(mc->mc_rotor != mg);
	ASSERT(mg->mg_prev == NULL);
	ASSERT(mg->mg_next == NULL);
	ASSERT(mg->mg_activation_count <= 0);

	if (++mg->mg_activation_count <= 0)
	return;

	mg->mg_aliquot = metaslab_aliquot * MAX(1, mg->mg_vd->vdev_children);
	metaslab_group_alloc_update(mg);

	if ((mgprev = mc->mc_rotor) == NULL) {
	mg->mg_prev = mg;
	mg->mg_next = mg;
	} else {
	mgnext = mgprev->mg_next;
	mg->mg_prev = mgprev;
	mg->mg_next = mgnext;
	mgprev->mg_next = mg;
	mgnext->mg_prev = mg;
	}
	mc->mc_rotor = mg;
	}

	/*
	* Passivate a metaslab group and remove it from the allocation rotor.
	* Callers must hold both the SCL_ALLOC and SCL_ZIO lock prior to passivating
	* a metaslab group. This function will momentarily drop spa_config_locks
	* that are lower than the SCL_ALLOC lock (see comment below).
	*/
	void
	metaslab_group_passivate(metaslab_group_t *mg)
	{
	metaslab_class_t *mc = mg->mg_class;
	spa_t *spa = mc->mc_spa;
	metaslab_group_t mgprev, mgnext;
	int locks = spa_config_held(spa, SCL_ALL, RW_WRITER);

	ASSERT3U(spa_config_held(spa, SCL_ALLOC \| SCL_ZIO, RW_WRITER), ==,
	(SCL_ALLOC \| SCL_ZIO));

	if (--mg->mg_activation_count != 0) {
	ASSERT(mc->mc_rotor != mg);
	ASSERT(mg->mg_prev == NULL);
	ASSERT(mg->mg_next == NULL);
	ASSERT(mg->mg_activation_count < 0);
	return;
	}

	/*
	* The spa_config_lock is an array of rwlocks, ordered as
	* follows (from highest to lowest):
	* SCL_CONFIG > SCL_STATE > SCL_L2ARC > SCL_ALLOC >
	* SCL_ZIO > SCL_FREE > SCL_VDEV
	* (For more information about the spa_config_lock see spa_misc.c)
	* The higher the lock, the broader its coverage. When we passivate
	* a metaslab group, we must hold both the SCL_ALLOC and the SCL_ZIO
	* config locks. However, the metaslab group's taskq might be trying
	* to preload metaslabs so we must drop the SCL_ZIO lock and any
	* lower locks to allow the I/O to complete. At a minimum,
	* we continue to hold the SCL_ALLOC lock, which prevents any future
	* allocations from taking place and any changes to the vdev tree.
	*/
	spa_config_exit(spa, locks & ~(SCL_ZIO - 1), spa);
	taskq_wait_outstanding(mg->mg_taskq, 0);
	spa_config_enter(spa, locks & ~(SCL_ZIO - 1), spa, RW_WRITER);
	metaslab_group_alloc_update(mg);
	for (int i = 0; i < mg->mg_allocators; i++) {
	metaslab_group_allocator_t *mga = &mg->mg_allocator[i];
	metaslab_t *msp = mga->mga_primary;
	if (msp != NULL) {
	mutex_enter(&msp->ms_lock);
	metaslab_passivate(msp,
	metaslab_weight_from_range_tree(msp));
	mutex_exit(&msp->ms_lock);
	}
	msp = mga->mga_secondary;
	if (msp != NULL) {
	mutex_enter(&msp->ms_lock);
	metaslab_passivate(msp,
	metaslab_weight_from_range_tree(msp));
	mutex_exit(&msp->ms_lock);
	}
	}

	mgprev = mg->mg_prev;
	mgnext = mg->mg_next;

	if (mg == mgnext) {
	mc->mc_rotor = NULL;
	} else {
	mc->mc_rotor = mgnext;
	mgprev->mg_next = mgnext;
	mgnext->mg_prev = mgprev;
	}

	mg->mg_prev = NULL;
	mg->mg_next = NULL;
	}

	boolean_t
	metaslab_group_initialized(metaslab_group_t *mg)
	{
	vdev_t *vd = mg->mg_vd;
	vdev_stat_t *vs = &vd->vdev_stat;

	return (vs->vs_space != 0 && mg->mg_activation_count > 0);
	}

	uint64_t
	metaslab_group_get_space(metaslab_group_t *mg)
	{
	return ((1ULL << mg->mg_vd->vdev_ms_shift) * mg->mg_vd->vdev_ms_count);
	}

	void
	metaslab_group_histogram_verify(metaslab_group_t *mg)
	{
	uint64_t *mg_hist;
	vdev_t *vd = mg->mg_vd;
	uint64_t ashift = vd->vdev_ashift;
	int i;

	if ((zfs_flags & ZFS_DEBUG_HISTOGRAM_VERIFY) == 0)
	return;

	mg_hist = kmem_zalloc(sizeof (uint64_t) * RANGE_TREE_HISTOGRAM_SIZE,
	KM_SLEEP);

	ASSERT3U(RANGE_TREE_HISTOGRAM_SIZE, >=,
	SPACE_MAP_HISTOGRAM_SIZE + ashift);

	for (int m = 0; m < vd->vdev_ms_count; m++) {
	metaslab_t *msp = vd->vdev_ms[m];

	/* skip if not active or not a member */
	if (msp->ms_sm == NULL \|\| msp->ms_group != mg)
	continue;

	for (i = 0; i < SPACE_MAP_HISTOGRAM_SIZE; i++)
	mg_hist[i + ashift] +=
	msp->ms_sm->sm_phys->smp_histogram[i];
	}

	for (i = 0; i < RANGE_TREE_HISTOGRAM_SIZE; i ++)
	VERIFY3U(mg_hist[i], ==, mg->mg_histogram[i]);

	kmem_free(mg_hist, sizeof (uint64_t) * RANGE_TREE_HISTOGRAM_SIZE);
	}

	static void
	metaslab_group_histogram_add(metaslab_group_t mg, metaslab_t msp)
	{
	metaslab_class_t *mc = mg->mg_class;
	uint64_t ashift = mg->mg_vd->vdev_ashift;

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	if (msp->ms_sm == NULL)
	return;

	mutex_enter(&mg->mg_lock);
	for (int i = 0; i < SPACE_MAP_HISTOGRAM_SIZE; i++) {
	mg->mg_histogram[i + ashift] +=
	msp->ms_sm->sm_phys->smp_histogram[i];
	mc->mc_histogram[i + ashift] +=
	msp->ms_sm->sm_phys->smp_histogram[i];
	}
	mutex_exit(&mg->mg_lock);
	}

	void
	metaslab_group_histogram_remove(metaslab_group_t mg, metaslab_t msp)
	{
	metaslab_class_t *mc = mg->mg_class;
	uint64_t ashift = mg->mg_vd->vdev_ashift;

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	if (msp->ms_sm == NULL)
	return;

	mutex_enter(&mg->mg_lock);
	for (int i = 0; i < SPACE_MAP_HISTOGRAM_SIZE; i++) {
	ASSERT3U(mg->mg_histogram[i + ashift], >=,
	msp->ms_sm->sm_phys->smp_histogram[i]);
	ASSERT3U(mc->mc_histogram[i + ashift], >=,
	msp->ms_sm->sm_phys->smp_histogram[i]);

	mg->mg_histogram[i + ashift] -=
	msp->ms_sm->sm_phys->smp_histogram[i];
	mc->mc_histogram[i + ashift] -=
	msp->ms_sm->sm_phys->smp_histogram[i];
	}
	mutex_exit(&mg->mg_lock);
	}

	static void
	metaslab_group_add(metaslab_group_t mg, metaslab_t msp)
	{
	ASSERT(msp->ms_group == NULL);
	mutex_enter(&mg->mg_lock);
	msp->ms_group = mg;
	msp->ms_weight = 0;
	avl_add(&mg->mg_metaslab_tree, msp);
	mutex_exit(&mg->mg_lock);

	mutex_enter(&msp->ms_lock);
	metaslab_group_histogram_add(mg, msp);
	mutex_exit(&msp->ms_lock);
	}

	static void
	metaslab_group_remove(metaslab_group_t mg, metaslab_t msp)
	{
	mutex_enter(&msp->ms_lock);
	metaslab_group_histogram_remove(mg, msp);
	mutex_exit(&msp->ms_lock);

	mutex_enter(&mg->mg_lock);
	ASSERT(msp->ms_group == mg);
	avl_remove(&mg->mg_metaslab_tree, msp);

	metaslab_class_t *mc = msp->ms_group->mg_class;
	multilist_sublist_t *mls =
	multilist_sublist_lock_obj(mc->mc_metaslab_txg_list, msp);
	if (multilist_link_active(&msp->ms_class_txg_node))
	multilist_sublist_remove(mls, msp);
	multilist_sublist_unlock(mls);

	msp->ms_group = NULL;
	mutex_exit(&mg->mg_lock);
	}

	static void
	metaslab_group_sort_impl(metaslab_group_t mg, metaslab_t msp, uint64_t weight)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));
	ASSERT(MUTEX_HELD(&mg->mg_lock));
	ASSERT(msp->ms_group == mg);

	avl_remove(&mg->mg_metaslab_tree, msp);
	msp->ms_weight = weight;
	avl_add(&mg->mg_metaslab_tree, msp);

	}

	static void
	metaslab_group_sort(metaslab_group_t mg, metaslab_t msp, uint64_t weight)
	{
	/*
	* Although in principle the weight can be any value, in
	* practice we do not use values in the range [1, 511].
	*/
	ASSERT(weight >= SPA_MINBLOCKSIZE \|\| weight == 0);
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	mutex_enter(&mg->mg_lock);
	metaslab_group_sort_impl(mg, msp, weight);
	mutex_exit(&mg->mg_lock);
	}

	/*
	* Calculate the fragmentation for a given metaslab group. We can use
	* a simple average here since all metaslabs within the group must have
	* the same size. The return value will be a value between 0 and 100
	* (inclusive), or ZFS_FRAG_INVALID if less than half of the metaslab in this
	* group have a fragmentation metric.
	*/
	uint64_t
	metaslab_group_fragmentation(metaslab_group_t *mg)
	{
	vdev_t *vd = mg->mg_vd;
	uint64_t fragmentation = 0;
	uint64_t valid_ms = 0;

	for (int m = 0; m < vd->vdev_ms_count; m++) {
	metaslab_t *msp = vd->vdev_ms[m];

	if (msp->ms_fragmentation == ZFS_FRAG_INVALID)
	continue;
	if (msp->ms_group != mg)
	continue;

	valid_ms++;
	fragmentation += msp->ms_fragmentation;
	}

	if (valid_ms <= mg->mg_vd->vdev_ms_count / 2)
	return (ZFS_FRAG_INVALID);

	fragmentation /= valid_ms;
	ASSERT3U(fragmentation, <=, 100);
	return (fragmentation);
	}

	/*
	* Determine if a given metaslab group should skip allocations. A metaslab
	* group should avoid allocations if its free capacity is less than the
	* zfs_mg_noalloc_threshold or its fragmentation metric is greater than
	* zfs_mg_fragmentation_threshold and there is at least one metaslab group
	* that can still handle allocations. If the allocation throttle is enabled
	* then we skip allocations to devices that have reached their maximum
	* allocation queue depth unless the selected metaslab group is the only
	* eligible group remaining.
	*/
	static boolean_t
	metaslab_group_allocatable(metaslab_group_t mg, metaslab_group_t rotor,
	uint64_t psize, int allocator, int d)
	{
	spa_t *spa = mg->mg_vd->vdev_spa;
	metaslab_class_t *mc = mg->mg_class;

	/*
	* We can only consider skipping this metaslab group if it's
	* in the normal metaslab class and there are other metaslab
	* groups to select from. Otherwise, we always consider it eligible
	* for allocations.
	*/
	if ((mc != spa_normal_class(spa) &&
	mc != spa_special_class(spa) &&
	mc != spa_dedup_class(spa)) \|\|
	mc->mc_groups <= 1)
	return (B_TRUE);

	/*
	* If the metaslab group's mg_allocatable flag is set (see comments
	* in metaslab_group_alloc_update() for more information) and
	* the allocation throttle is disabled then allow allocations to this
	* device. However, if the allocation throttle is enabled then
	* check if we have reached our allocation limit (mg_alloc_queue_depth)
	* to determine if we should allow allocations to this metaslab group.
	* If all metaslab groups are no longer considered allocatable
	* (mc_alloc_groups == 0) or we're trying to allocate the smallest
	* gang block size then we allow allocations on this metaslab group
	* regardless of the mg_allocatable or throttle settings.
	*/
	if (mg->mg_allocatable) {
	metaslab_group_allocator_t *mga = &mg->mg_allocator[allocator];
	int64_t qdepth;
	uint64_t qmax = mga->mga_cur_max_alloc_queue_depth;

	if (!mc->mc_alloc_throttle_enabled)
	return (B_TRUE);

	/*
	* If this metaslab group does not have any free space, then
	* there is no point in looking further.
	*/
	if (mg->mg_no_free_space)
	return (B_FALSE);

	/*
	* Relax allocation throttling for ditto blocks. Due to
	* random imbalances in allocation it tends to push copies
	* to one vdev, that looks a bit better at the moment.
	*/
	qmax = qmax * (4 + d) / 4;

	qdepth = zfs_refcount_count(&mga->mga_alloc_queue_depth);

	/*
	* If this metaslab group is below its qmax or it's
	* the only allocatable metasable group, then attempt
	* to allocate from it.
	*/
	if (qdepth < qmax \|\| mc->mc_alloc_groups == 1)
	return (B_TRUE);
	ASSERT3U(mc->mc_alloc_groups, >, 1);

	/*
	* Since this metaslab group is at or over its qmax, we
	* need to determine if there are metaslab groups after this
	* one that might be able to handle this allocation. This is
	* racy since we can't hold the locks for all metaslab
	* groups at the same time when we make this check.
	*/
	for (metaslab_group_t *mgp = mg->mg_next;
	mgp != rotor; mgp = mgp->mg_next) {
	metaslab_group_allocator_t *mgap =
	&mgp->mg_allocator[allocator];
	qmax = mgap->mga_cur_max_alloc_queue_depth;
	qmax = qmax * (4 + d) / 4;
	qdepth =
	zfs_refcount_count(&mgap->mga_alloc_queue_depth);

	/*
	* If there is another metaslab group that
	* might be able to handle the allocation, then
	* we return false so that we skip this group.
	*/
	if (qdepth < qmax && !mgp->mg_no_free_space)
	return (B_FALSE);
	}

	/*
	* We didn't find another group to handle the allocation
	* so we can't skip this metaslab group even though
	* we are at or over our qmax.
	*/
	return (B_TRUE);

	} else if (mc->mc_alloc_groups == 0 \|\| psize == SPA_MINBLOCKSIZE) {
	return (B_TRUE);
	}
	return (B_FALSE);
	}

	/*
	* ==========================================================================
	* Range tree callbacks
	* ==========================================================================
	*/

	/*
	* Comparison function for the private size-ordered tree using 32-bit
	* ranges. Tree is sorted by size, larger sizes at the end of the tree.
	*/
	static int
	metaslab_rangesize32_compare(const void x1, const void x2)
	{
	const range_seg32_t *r1 = x1;
	const range_seg32_t *r2 = x2;

	uint64_t rs_size1 = r1->rs_end - r1->rs_start;
	uint64_t rs_size2 = r2->rs_end - r2->rs_start;

	int cmp = TREE_CMP(rs_size1, rs_size2);
	if (likely(cmp))
	return (cmp);

	return (TREE_CMP(r1->rs_start, r2->rs_start));
	}

	/*
	* Comparison function for the private size-ordered tree using 64-bit
	* ranges. Tree is sorted by size, larger sizes at the end of the tree.
	*/
	static int
	metaslab_rangesize64_compare(const void x1, const void x2)
	{
	const range_seg64_t *r1 = x1;
	const range_seg64_t *r2 = x2;

	uint64_t rs_size1 = r1->rs_end - r1->rs_start;
	uint64_t rs_size2 = r2->rs_end - r2->rs_start;

	int cmp = TREE_CMP(rs_size1, rs_size2);
	if (likely(cmp))
	return (cmp);

	return (TREE_CMP(r1->rs_start, r2->rs_start));
	}
	typedef struct metaslab_rt_arg {
	zfs_btree_t *mra_bt;
	uint32_t mra_floor_shift;
	} metaslab_rt_arg_t;

	struct mssa_arg {
	range_tree_t *rt;
	metaslab_rt_arg_t *mra;
	};

	static void
	metaslab_size_sorted_add(void *arg, uint64_t start, uint64_t size)
	{
	struct mssa_arg *mssap = arg;
	range_tree_t *rt = mssap->rt;
	metaslab_rt_arg_t *mrap = mssap->mra;
	range_seg_max_t seg = {0};
	rs_set_start(&seg, rt, start);
	rs_set_end(&seg, rt, start + size);
	metaslab_rt_add(rt, &seg, mrap);
	}

	static void
	metaslab_size_tree_full_load(range_tree_t *rt)
	{
	metaslab_rt_arg_t *mrap = rt->rt_arg;
	#ifdef _METASLAB_TRACING
	METASLABSTAT_BUMP(metaslabstat_reload_tree);
	#endif
	ASSERT0(zfs_btree_numnodes(mrap->mra_bt));
	mrap->mra_floor_shift = 0;
	struct mssa_arg arg = {0};
	arg.rt = rt;
	arg.mra = mrap;
	range_tree_walk(rt, metaslab_size_sorted_add, &arg);
	}

	/*
	* Create any block allocator specific components. The current allocators
	* rely on using both a size-ordered range_tree_t and an array of uint64_t's.
	*/
	/* ARGSUSED */
	static void
	metaslab_rt_create(range_tree_t rt, void arg)
	{
	metaslab_rt_arg_t *mrap = arg;
	zfs_btree_t *size_tree = mrap->mra_bt;

	size_t size;
	int (compare) (const void , const void *);
	switch (rt->rt_type) {
	case RANGE_SEG32:
	size = sizeof (range_seg32_t);
	compare = metaslab_rangesize32_compare;
	break;
	case RANGE_SEG64:
	size = sizeof (range_seg64_t);
	compare = metaslab_rangesize64_compare;
	break;
	default:
	panic("Invalid range seg type %d", rt->rt_type);
	}
	zfs_btree_create(size_tree, compare, size);
	mrap->mra_floor_shift = metaslab_by_size_min_shift;
	}

	/* ARGSUSED */
	static void
	metaslab_rt_destroy(range_tree_t rt, void arg)
	{
	metaslab_rt_arg_t *mrap = arg;
	zfs_btree_t *size_tree = mrap->mra_bt;

	zfs_btree_destroy(size_tree);
	kmem_free(mrap, sizeof (*mrap));
	}

	/* ARGSUSED */
	static void
	metaslab_rt_add(range_tree_t rt, range_seg_t rs, void *arg)
	{
	metaslab_rt_arg_t *mrap = arg;
	zfs_btree_t *size_tree = mrap->mra_bt;

	if (rs_get_end(rs, rt) - rs_get_start(rs, rt) <
	(1 << mrap->mra_floor_shift))
	return;

	zfs_btree_add(size_tree, rs);
	}

	/* ARGSUSED */
	static void
	metaslab_rt_remove(range_tree_t rt, range_seg_t rs, void *arg)
	{
	metaslab_rt_arg_t *mrap = arg;
	zfs_btree_t *size_tree = mrap->mra_bt;

	if (rs_get_end(rs, rt) - rs_get_start(rs, rt) < (1 <<
	mrap->mra_floor_shift))
	return;

	zfs_btree_remove(size_tree, rs);
	}

	/* ARGSUSED */
	static void
	metaslab_rt_vacate(range_tree_t rt, void arg)
	{
	metaslab_rt_arg_t *mrap = arg;
	zfs_btree_t *size_tree = mrap->mra_bt;
	zfs_btree_clear(size_tree);
	zfs_btree_destroy(size_tree);

	metaslab_rt_create(rt, arg);
	}

	static range_tree_ops_t metaslab_rt_ops = {
	.rtop_create = metaslab_rt_create,
	.rtop_destroy = metaslab_rt_destroy,
	.rtop_add = metaslab_rt_add,
	.rtop_remove = metaslab_rt_remove,
	.rtop_vacate = metaslab_rt_vacate
	};

	/*
	* ==========================================================================
	* Common allocator routines
	* ==========================================================================
	*/

	/*
	* Return the maximum contiguous segment within the metaslab.
	*/
	uint64_t
	metaslab_largest_allocatable(metaslab_t *msp)
	{
	zfs_btree_t *t = &msp->ms_allocatable_by_size;
	range_seg_t *rs;

	if (t == NULL)
	return (0);
	if (zfs_btree_numnodes(t) == 0)
	metaslab_size_tree_full_load(msp->ms_allocatable);

	rs = zfs_btree_last(t, NULL);
	if (rs == NULL)
	return (0);

	return (rs_get_end(rs, msp->ms_allocatable) - rs_get_start(rs,
	msp->ms_allocatable));
	}

	/*
	* Return the maximum contiguous segment within the unflushed frees of this
	* metaslab.
	*/
	static uint64_t
	metaslab_largest_unflushed_free(metaslab_t *msp)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	if (msp->ms_unflushed_frees == NULL)
	return (0);

	if (zfs_btree_numnodes(&msp->ms_unflushed_frees_by_size) == 0)
	metaslab_size_tree_full_load(msp->ms_unflushed_frees);
	range_seg_t *rs = zfs_btree_last(&msp->ms_unflushed_frees_by_size,
	NULL);
	if (rs == NULL)
	return (0);

	/*
	* When a range is freed from the metaslab, that range is added to
	* both the unflushed frees and the deferred frees. While the block
	* will eventually be usable, if the metaslab were loaded the range
	* would not be added to the ms_allocatable tree until TXG_DEFER_SIZE
	* txgs had passed. As a result, when attempting to estimate an upper
	* bound for the largest currently-usable free segment in the
	* metaslab, we need to not consider any ranges currently in the defer
	* trees. This algorithm approximates the largest available chunk in
	* the largest range in the unflushed_frees tree by taking the first
	* chunk. While this may be a poor estimate, it should only remain so
	* briefly and should eventually self-correct as frees are no longer
	* deferred. Similar logic applies to the ms_freed tree. See
	* metaslab_load() for more details.
	*
	* There are two primary sources of inaccuracy in this estimate. Both
	* are tolerated for performance reasons. The first source is that we
	* only check the largest segment for overlaps. Smaller segments may
	* have more favorable overlaps with the other trees, resulting in
	* larger usable chunks. Second, we only look at the first chunk in
	* the largest segment; there may be other usable chunks in the
	* largest segment, but we ignore them.
	*/
	uint64_t rstart = rs_get_start(rs, msp->ms_unflushed_frees);
	uint64_t rsize = rs_get_end(rs, msp->ms_unflushed_frees) - rstart;
	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	uint64_t start = 0;
	uint64_t size = 0;
	boolean_t found = range_tree_find_in(msp->ms_defer[t], rstart,
	rsize, &start, &size);
	if (found) {
	if (rstart == start)
	return (0);
	rsize = start - rstart;
	}
	}

	uint64_t start = 0;
	uint64_t size = 0;
	boolean_t found = range_tree_find_in(msp->ms_freed, rstart,
	rsize, &start, &size);
	if (found)
	rsize = start - rstart;

	return (rsize);
	}

	static range_seg_t *
	metaslab_block_find(zfs_btree_t t, range_tree_t rt, uint64_t start,
	uint64_t size, zfs_btree_index_t *where)
	{
	range_seg_t *rs;
	range_seg_max_t rsearch;

	rs_set_start(&rsearch, rt, start);
	rs_set_end(&rsearch, rt, start + size);

	rs = zfs_btree_find(t, &rsearch, where);
	if (rs == NULL) {
	rs = zfs_btree_next(t, where, where);
	}

	return (rs);
	}

	#if defined(WITH_DF_BLOCK_ALLOCATOR) \|\| \
	defined(WITH_CF_BLOCK_ALLOCATOR)
	/*
	* This is a helper function that can be used by the allocator to find a
	* suitable block to allocate. This will search the specified B-tree looking
	* for a block that matches the specified criteria.
	*/
	static uint64_t
	metaslab_block_picker(range_tree_t rt, uint64_t cursor, uint64_t size,
	uint64_t max_search)
	{
	if (*cursor == 0)
	*cursor = rt->rt_start;
	zfs_btree_t *bt = &rt->rt_root;
	zfs_btree_index_t where;
	range_seg_t rs = metaslab_block_find(bt, rt, cursor, size, &where);
	uint64_t first_found;
	int count_searched = 0;

	if (rs != NULL)
	first_found = rs_get_start(rs, rt);

	while (rs != NULL && (rs_get_start(rs, rt) - first_found <=
	max_search \|\| count_searched < metaslab_min_search_count)) {
	uint64_t offset = rs_get_start(rs, rt);
	if (offset + size <= rs_get_end(rs, rt)) {
	*cursor = offset + size;
	return (offset);
	}
	rs = zfs_btree_next(bt, &where, &where);
	count_searched++;
	}

	*cursor = 0;
	return (-1ULL);
	}
	#endif /* WITH_DF/CF_BLOCK_ALLOCATOR */

	#if defined(WITH_DF_BLOCK_ALLOCATOR)
	/*
	* ==========================================================================
	* Dynamic Fit (df) block allocator
	*
	* Search for a free chunk of at least this size, starting from the last
	* offset (for this alignment of block) looking for up to
	* metaslab_df_max_search bytes (16MB). If a large enough free chunk is not
	* found within 16MB, then return a free chunk of exactly the requested size (or
	* larger).
	*
	* If it seems like searching from the last offset will be unproductive, skip
	* that and just return a free chunk of exactly the requested size (or larger).
	* This is based on metaslab_df_alloc_threshold and metaslab_df_free_pct. This
	* mechanism is probably not very useful and may be removed in the future.
	*
	* The behavior when not searching can be changed to return the largest free
	* chunk, instead of a free chunk of exactly the requested size, by setting
	* metaslab_df_use_largest_segment.
	* ==========================================================================
	*/
	static uint64_t
	metaslab_df_alloc(metaslab_t *msp, uint64_t size)
	{
	/*
	* Find the largest power of 2 block size that evenly divides the
	* requested size. This is used to try to allocate blocks with similar
	* alignment from the same area of the metaslab (i.e. same cursor
	* bucket) but it does not guarantee that other allocations sizes
	* may exist in the same region.
	*/
	uint64_t align = size & -size;
	uint64_t *cursor = &msp->ms_lbas[highbit64(align) - 1];
	range_tree_t *rt = msp->ms_allocatable;
	int free_pct = range_tree_space(rt) * 100 / msp->ms_size;
	uint64_t offset;

	ASSERT(MUTEX_HELD(&msp->ms_lock));

	/*
	* If we're running low on space, find a segment based on size,
	* rather than iterating based on offset.
	*/
	if (metaslab_largest_allocatable(msp) < metaslab_df_alloc_threshold \|\|
	free_pct < metaslab_df_free_pct) {
	offset = -1;
	} else {
	offset = metaslab_block_picker(rt,
	cursor, size, metaslab_df_max_search);
	}

	if (offset == -1) {
	range_seg_t *rs;
	if (zfs_btree_numnodes(&msp->ms_allocatable_by_size) == 0)
	metaslab_size_tree_full_load(msp->ms_allocatable);
	if (metaslab_df_use_largest_segment) {
	/* use largest free segment */
	rs = zfs_btree_last(&msp->ms_allocatable_by_size, NULL);
	} else {
	zfs_btree_index_t where;
	/* use segment of this size, or next largest */
	#ifdef _METASLAB_TRACING
	metaslab_rt_arg_t *mrap = msp->ms_allocatable->rt_arg;
	if (size < (1 << mrap->mra_floor_shift)) {
	METASLABSTAT_BUMP(
	metaslabstat_df_find_under_floor);
	}
	#endif
	rs = metaslab_block_find(&msp->ms_allocatable_by_size,
	rt, msp->ms_start, size, &where);
	}
	if (rs != NULL && rs_get_start(rs, rt) + size <= rs_get_end(rs,
	rt)) {
	offset = rs_get_start(rs, rt);
	*cursor = offset + size;
	}
	}

	return (offset);
	}

	static metaslab_ops_t metaslab_df_ops = {
	metaslab_df_alloc
	};

	metaslab_ops_t *zfs_metaslab_ops = &metaslab_df_ops;
	#endif /* WITH_DF_BLOCK_ALLOCATOR */

	#if defined(WITH_CF_BLOCK_ALLOCATOR)
	/*
	* ==========================================================================
	* Cursor fit block allocator -
	* Select the largest region in the metaslab, set the cursor to the beginning
	* of the range and the cursor_end to the end of the range. As allocations
	* are made advance the cursor. Continue allocating from the cursor until
	* the range is exhausted and then find a new range.
	* ==========================================================================
	*/
	static uint64_t
	metaslab_cf_alloc(metaslab_t *msp, uint64_t size)
	{
	range_tree_t *rt = msp->ms_allocatable;
	zfs_btree_t *t = &msp->ms_allocatable_by_size;
	uint64_t *cursor = &msp->ms_lbas[0];
	uint64_t *cursor_end = &msp->ms_lbas[1];
	uint64_t offset = 0;

	ASSERT(MUTEX_HELD(&msp->ms_lock));

	ASSERT3U(cursor_end, >=, cursor);

	if ((cursor + size) > cursor_end) {
	range_seg_t *rs;

	if (zfs_btree_numnodes(t) == 0)
	metaslab_size_tree_full_load(msp->ms_allocatable);
	rs = zfs_btree_last(t, NULL);
	if (rs == NULL \|\| (rs_get_end(rs, rt) - rs_get_start(rs, rt)) <
	size)
	return (-1ULL);

	*cursor = rs_get_start(rs, rt);
	*cursor_end = rs_get_end(rs, rt);
	}

	offset = *cursor;
	*cursor += size;

	return (offset);
	}

	static metaslab_ops_t metaslab_cf_ops = {
	metaslab_cf_alloc
	};

	metaslab_ops_t *zfs_metaslab_ops = &metaslab_cf_ops;
	#endif /* WITH_CF_BLOCK_ALLOCATOR */

	#if defined(WITH_NDF_BLOCK_ALLOCATOR)
	/*
	* ==========================================================================
	* New dynamic fit allocator -
	* Select a region that is large enough to allocate 2^metaslab_ndf_clump_shift
	* contiguous blocks. If no region is found then just use the largest segment
	* that remains.
	* ==========================================================================
	*/

	/*
	* Determines desired number of contiguous blocks (2^metaslab_ndf_clump_shift)
	* to request from the allocator.
	*/
	uint64_t metaslab_ndf_clump_shift = 4;

	static uint64_t
	metaslab_ndf_alloc(metaslab_t *msp, uint64_t size)
	{
	zfs_btree_t *t = &msp->ms_allocatable->rt_root;
	range_tree_t *rt = msp->ms_allocatable;
	zfs_btree_index_t where;
	range_seg_t *rs;
	range_seg_max_t rsearch;
	uint64_t hbit = highbit64(size);
	uint64_t *cursor = &msp->ms_lbas[hbit - 1];
	uint64_t max_size = metaslab_largest_allocatable(msp);

	ASSERT(MUTEX_HELD(&msp->ms_lock));

	if (max_size < size)
	return (-1ULL);

	rs_set_start(&rsearch, rt, *cursor);
	rs_set_end(&rsearch, rt, *cursor + size);

	rs = zfs_btree_find(t, &rsearch, &where);
	if (rs == NULL \|\| (rs_get_end(rs, rt) - rs_get_start(rs, rt)) < size) {
	t = &msp->ms_allocatable_by_size;

	rs_set_start(&rsearch, rt, 0);
	rs_set_end(&rsearch, rt, MIN(max_size, 1ULL << (hbit +
	metaslab_ndf_clump_shift)));

	rs = zfs_btree_find(t, &rsearch, &where);
	if (rs == NULL)
	rs = zfs_btree_next(t, &where, &where);
	ASSERT(rs != NULL);
	}

	if ((rs_get_end(rs, rt) - rs_get_start(rs, rt)) >= size) {
	*cursor = rs_get_start(rs, rt) + size;
	return (rs_get_start(rs, rt));
	}
	return (-1ULL);
	}

	static metaslab_ops_t metaslab_ndf_ops = {
	metaslab_ndf_alloc
	};

	metaslab_ops_t *zfs_metaslab_ops = &metaslab_ndf_ops;
	#endif /* WITH_NDF_BLOCK_ALLOCATOR */


	/*
	* ==========================================================================
	* Metaslabs
	* ==========================================================================
	*/

	/*
	* Wait for any in-progress metaslab loads to complete.
	*/
	static void
	metaslab_load_wait(metaslab_t *msp)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	while (msp->ms_loading) {
	ASSERT(!msp->ms_loaded);
	cv_wait(&msp->ms_load_cv, &msp->ms_lock);
	}
	}

	/*
	* Wait for any in-progress flushing to complete.
	*/
	static void
	metaslab_flush_wait(metaslab_t *msp)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	while (msp->ms_flushing)
	cv_wait(&msp->ms_flush_cv, &msp->ms_lock);
	}

	static unsigned int
	metaslab_idx_func(multilist_t ml, void arg)
	{
	metaslab_t *msp = arg;
	return (msp->ms_id % multilist_get_num_sublists(ml));
	}

	uint64_t
	metaslab_allocated_space(metaslab_t *msp)
	{
	return (msp->ms_allocated_space);
	}

	/*
	* Verify that the space accounting on disk matches the in-core range_trees.
	*/
	static void
	metaslab_verify_space(metaslab_t *msp, uint64_t txg)
	{
	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;
	uint64_t allocating = 0;
	uint64_t sm_free_space, msp_free_space;

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	ASSERT(!msp->ms_condensing);

	if ((zfs_flags & ZFS_DEBUG_METASLAB_VERIFY) == 0)
	return;

	/*
	* We can only verify the metaslab space when we're called
	* from syncing context with a loaded metaslab that has an
	* allocated space map. Calling this in non-syncing context
	* does not provide a consistent view of the metaslab since
	* we're performing allocations in the future.
	*/
	if (txg != spa_syncing_txg(spa) \|\| msp->ms_sm == NULL \|\|
	!msp->ms_loaded)
	return;

	/*
	* Even though the smp_alloc field can get negative,
	* when it comes to a metaslab's space map, that should
	* never be the case.
	*/
	ASSERT3S(space_map_allocated(msp->ms_sm), >=, 0);

	ASSERT3U(space_map_allocated(msp->ms_sm), >=,
	range_tree_space(msp->ms_unflushed_frees));

	ASSERT3U(metaslab_allocated_space(msp), ==,
	space_map_allocated(msp->ms_sm) +
	range_tree_space(msp->ms_unflushed_allocs) -
	range_tree_space(msp->ms_unflushed_frees));

	sm_free_space = msp->ms_size - metaslab_allocated_space(msp);

	/*
	* Account for future allocations since we would have
	* already deducted that space from the ms_allocatable.
	*/
	for (int t = 0; t < TXG_CONCURRENT_STATES; t++) {
	allocating +=
	range_tree_space(msp->ms_allocating[(txg + t) & TXG_MASK]);
	}
	ASSERT3U(allocating + msp->ms_allocated_this_txg, ==,
	msp->ms_allocating_total);

	ASSERT3U(msp->ms_deferspace, ==,
	range_tree_space(msp->ms_defer[0]) +
	range_tree_space(msp->ms_defer[1]));

	msp_free_space = range_tree_space(msp->ms_allocatable) + allocating +
	msp->ms_deferspace + range_tree_space(msp->ms_freed);

	VERIFY3U(sm_free_space, ==, msp_free_space);
	}

	static void
	metaslab_aux_histograms_clear(metaslab_t *msp)
	{
	/*
	* Auxiliary histograms are only cleared when resetting them,
	* which can only happen while the metaslab is loaded.
	*/
	ASSERT(msp->ms_loaded);

	bzero(msp->ms_synchist, sizeof (msp->ms_synchist));
	for (int t = 0; t < TXG_DEFER_SIZE; t++)
	bzero(msp->ms_deferhist[t], sizeof (msp->ms_deferhist[t]));
	}

	static void
	metaslab_aux_histogram_add(uint64_t *histogram, uint64_t shift,
	range_tree_t *rt)
	{
	/*
	* This is modeled after space_map_histogram_add(), so refer to that
	* function for implementation details. We want this to work like
	* the space map histogram, and not the range tree histogram, as we
	* are essentially constructing a delta that will be later subtracted
	* from the space map histogram.
	*/
	int idx = 0;
	for (int i = shift; i < RANGE_TREE_HISTOGRAM_SIZE; i++) {
	ASSERT3U(i, >=, idx + shift);
	histogram[idx] += rt->rt_histogram[i] << (i - idx - shift);

	if (idx < SPACE_MAP_HISTOGRAM_SIZE - 1) {
	ASSERT3U(idx + shift, ==, i);
	idx++;
	ASSERT3U(idx, <, SPACE_MAP_HISTOGRAM_SIZE);
	}
	}
	}

	/*
	* Called at every sync pass that the metaslab gets synced.
	*
	* The reason is that we want our auxiliary histograms to be updated
	* wherever the metaslab's space map histogram is updated. This way
	* we stay consistent on which parts of the metaslab space map's
	* histogram are currently not available for allocations (e.g because
	* they are in the defer, freed, and freeing trees).
	*/
	static void
	metaslab_aux_histograms_update(metaslab_t *msp)
	{
	space_map_t *sm = msp->ms_sm;
	ASSERT(sm != NULL);

	/*
	* This is similar to the metaslab's space map histogram updates
	* that take place in metaslab_sync(). The only difference is that
	* we only care about segments that haven't made it into the
	* ms_allocatable tree yet.
	*/
	if (msp->ms_loaded) {
	metaslab_aux_histograms_clear(msp);

	metaslab_aux_histogram_add(msp->ms_synchist,
	sm->sm_shift, msp->ms_freed);

	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	metaslab_aux_histogram_add(msp->ms_deferhist[t],
	sm->sm_shift, msp->ms_defer[t]);
	}
	}

	metaslab_aux_histogram_add(msp->ms_synchist,
	sm->sm_shift, msp->ms_freeing);
	}

	/*
	* Called every time we are done syncing (writing to) the metaslab,
	* i.e. at the end of each sync pass.
	* [see the comment in metaslab_impl.h for ms_synchist, ms_deferhist]
	*/
	static void
	metaslab_aux_histograms_update_done(metaslab_t *msp, boolean_t defer_allowed)
	{
	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;
	space_map_t *sm = msp->ms_sm;

	if (sm == NULL) {
	/*
	* We came here from metaslab_init() when creating/opening a
	* pool, looking at a metaslab that hasn't had any allocations
	* yet.
	*/
	return;
	}

	/*
	* This is similar to the actions that we take for the ms_freed
	* and ms_defer trees in metaslab_sync_done().
	*/
	uint64_t hist_index = spa_syncing_txg(spa) % TXG_DEFER_SIZE;
	if (defer_allowed) {
	bcopy(msp->ms_synchist, msp->ms_deferhist[hist_index],
	sizeof (msp->ms_synchist));
	} else {
	bzero(msp->ms_deferhist[hist_index],
	sizeof (msp->ms_deferhist[hist_index]));
	}
	bzero(msp->ms_synchist, sizeof (msp->ms_synchist));
	}

	/*
	* Ensure that the metaslab's weight and fragmentation are consistent
	* with the contents of the histogram (either the range tree's histogram
	* or the space map's depending whether the metaslab is loaded).
	*/
	static void
	metaslab_verify_weight_and_frag(metaslab_t *msp)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	if ((zfs_flags & ZFS_DEBUG_METASLAB_VERIFY) == 0)
	return;

	/*
	* We can end up here from vdev_remove_complete(), in which case we
	* cannot do these assertions because we hold spa config locks and
	* thus we are not allowed to read from the DMU.
	*
	* We check if the metaslab group has been removed and if that's
	* the case we return immediately as that would mean that we are
	* here from the aforementioned code path.
	*/
	if (msp->ms_group == NULL)
	return;

	/*
	* Devices being removed always return a weight of 0 and leave
	* fragmentation and ms_max_size as is - there is nothing for
	* us to verify here.
	*/
	vdev_t *vd = msp->ms_group->mg_vd;
	if (vd->vdev_removing)
	return;

	/*
	* If the metaslab is dirty it probably means that we've done
	* some allocations or frees that have changed our histograms
	* and thus the weight.
	*/
	for (int t = 0; t < TXG_SIZE; t++) {
	if (txg_list_member(&vd->vdev_ms_list, msp, t))
	return;
	}

	/*
	* This verification checks that our in-memory state is consistent
	* with what's on disk. If the pool is read-only then there aren't
	* any changes and we just have the initially-loaded state.
	*/
	if (!spa_writeable(msp->ms_group->mg_vd->vdev_spa))
	return;

	/* some extra verification for in-core tree if you can */
	if (msp->ms_loaded) {
	range_tree_stat_verify(msp->ms_allocatable);
	VERIFY(space_map_histogram_verify(msp->ms_sm,
	msp->ms_allocatable));
	}

	uint64_t weight = msp->ms_weight;
	uint64_t was_active = msp->ms_weight & METASLAB_ACTIVE_MASK;
	boolean_t space_based = WEIGHT_IS_SPACEBASED(msp->ms_weight);
	uint64_t frag = msp->ms_fragmentation;
	uint64_t max_segsize = msp->ms_max_size;

	msp->ms_weight = 0;
	msp->ms_fragmentation = 0;

	/*
	* This function is used for verification purposes and thus should
	* not introduce any side-effects/mutations on the system's state.
	*
	* Regardless of whether metaslab_weight() thinks this metaslab
	* should be active or not, we want to ensure that the actual weight
	* (and therefore the value of ms_weight) would be the same if it
	* was to be recalculated at this point.
	*
	* In addition we set the nodirty flag so metaslab_weight() does
	* not dirty the metaslab for future TXGs (e.g. when trying to
	* force condensing to upgrade the metaslab spacemaps).
	*/
	msp->ms_weight = metaslab_weight(msp, B_TRUE) \| was_active;

	VERIFY3U(max_segsize, ==, msp->ms_max_size);

	/*
	* If the weight type changed then there is no point in doing
	* verification. Revert fields to their original values.
	*/
	if ((space_based && !WEIGHT_IS_SPACEBASED(msp->ms_weight)) \|\|
	(!space_based && WEIGHT_IS_SPACEBASED(msp->ms_weight))) {
	msp->ms_fragmentation = frag;
	msp->ms_weight = weight;
	return;
	}

	VERIFY3U(msp->ms_fragmentation, ==, frag);
	VERIFY3U(msp->ms_weight, ==, weight);
	}

	/*
	* If we're over the zfs_metaslab_mem_limit, select the loaded metaslab from
	* this class that was used longest ago, and attempt to unload it. We don't
	* want to spend too much time in this loop to prevent performance
	* degradation, and we expect that most of the time this operation will
	* succeed. Between that and the normal unloading processing during txg sync,
	* we expect this to keep the metaslab memory usage under control.
	*/
	static void
	metaslab_potentially_evict(metaslab_class_t *mc)
	{
	#ifdef _KERNEL
	uint64_t allmem = arc_all_memory();
	uint64_t inuse = spl_kmem_cache_inuse(zfs_btree_leaf_cache);
	uint64_t size = spl_kmem_cache_entry_size(zfs_btree_leaf_cache);
	int tries = 0;
	for (; allmem * zfs_metaslab_mem_limit / 100 < inuse * size &&
	tries < multilist_get_num_sublists(mc->mc_metaslab_txg_list) * 2;
	tries++) {
	unsigned int idx = multilist_get_random_index(
	mc->mc_metaslab_txg_list);
	multilist_sublist_t *mls =
	multilist_sublist_lock(mc->mc_metaslab_txg_list, idx);
	metaslab_t *msp = multilist_sublist_head(mls);
	multilist_sublist_unlock(mls);
	while (msp != NULL && allmem * zfs_metaslab_mem_limit / 100 <
	inuse * size) {
	VERIFY3P(mls, ==, multilist_sublist_lock(
	mc->mc_metaslab_txg_list, idx));
	ASSERT3U(idx, ==,
	metaslab_idx_func(mc->mc_metaslab_txg_list, msp));

	if (!multilist_link_active(&msp->ms_class_txg_node)) {
	multilist_sublist_unlock(mls);
	break;
	}
	metaslab_t *next_msp = multilist_sublist_next(mls, msp);
	multilist_sublist_unlock(mls);
	/*
	* If the metaslab is currently loading there are two
	* cases. If it's the metaslab we're evicting, we
	* can't continue on or we'll panic when we attempt to
	* recursively lock the mutex. If it's another
	* metaslab that's loading, it can be safely skipped,
	* since we know it's very new and therefore not a
	* good eviction candidate. We check later once the
	* lock is held that the metaslab is fully loaded
	* before actually unloading it.
	*/
	if (msp->ms_loading) {
	msp = next_msp;
	inuse =
	spl_kmem_cache_inuse(zfs_btree_leaf_cache);
	continue;
	}
	/*
	* We can't unload metaslabs with no spacemap because
	* they're not ready to be unloaded yet. We can't
	* unload metaslabs with outstanding allocations
	* because doing so could cause the metaslab's weight
	* to decrease while it's unloaded, which violates an
	* invariant that we use to prevent unnecessary
	* loading. We also don't unload metaslabs that are
	* currently active because they are high-weight
	* metaslabs that are likely to be used in the near
	* future.
	*/
	mutex_enter(&msp->ms_lock);
	if (msp->ms_allocator == -1 && msp->ms_sm != NULL &&
	msp->ms_allocating_total == 0) {
	metaslab_unload(msp);
	}
	mutex_exit(&msp->ms_lock);
	msp = next_msp;
	inuse = spl_kmem_cache_inuse(zfs_btree_leaf_cache);
	}
	}
	#endif
	}

	static int
	metaslab_load_impl(metaslab_t *msp)
	{
	int error = 0;

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	ASSERT(msp->ms_loading);
	ASSERT(!msp->ms_condensing);

	/*
	* We temporarily drop the lock to unblock other operations while we
	* are reading the space map. Therefore, metaslab_sync() and
	* metaslab_sync_done() can run at the same time as we do.
	*
	* If we are using the log space maps, metaslab_sync() can't write to
	* the metaslab's space map while we are loading as we only write to
	* it when we are flushing the metaslab, and that can't happen while
	* we are loading it.
	*
	* If we are not using log space maps though, metaslab_sync() can
	* append to the space map while we are loading. Therefore we load
	* only entries that existed when we started the load. Additionally,
	* metaslab_sync_done() has to wait for the load to complete because
	* there are potential races like metaslab_load() loading parts of the
	* space map that are currently being appended by metaslab_sync(). If
	* we didn't, the ms_allocatable would have entries that
	* metaslab_sync_done() would try to re-add later.
	*
	* That's why before dropping the lock we remember the synced length
	* of the metaslab and read up to that point of the space map,
	* ignoring entries appended by metaslab_sync() that happen after we
	* drop the lock.
	*/
	uint64_t length = msp->ms_synced_length;
	mutex_exit(&msp->ms_lock);

	hrtime_t load_start = gethrtime();
	metaslab_rt_arg_t *mrap;
	if (msp->ms_allocatable->rt_arg == NULL) {
	mrap = kmem_zalloc(sizeof (*mrap), KM_SLEEP);
	} else {
	mrap = msp->ms_allocatable->rt_arg;
	msp->ms_allocatable->rt_ops = NULL;
	msp->ms_allocatable->rt_arg = NULL;
	}
	mrap->mra_bt = &msp->ms_allocatable_by_size;
	mrap->mra_floor_shift = metaslab_by_size_min_shift;

	if (msp->ms_sm != NULL) {
	error = space_map_load_length(msp->ms_sm, msp->ms_allocatable,
	SM_FREE, length);

	/* Now, populate the size-sorted tree. */
	metaslab_rt_create(msp->ms_allocatable, mrap);
	msp->ms_allocatable->rt_ops = &metaslab_rt_ops;
	msp->ms_allocatable->rt_arg = mrap;

	struct mssa_arg arg = {0};
	arg.rt = msp->ms_allocatable;
	arg.mra = mrap;
	range_tree_walk(msp->ms_allocatable, metaslab_size_sorted_add,
	&arg);
	} else {
	/*
	* Add the size-sorted tree first, since we don't need to load
	* the metaslab from the spacemap.
	*/
	metaslab_rt_create(msp->ms_allocatable, mrap);
	msp->ms_allocatable->rt_ops = &metaslab_rt_ops;
	msp->ms_allocatable->rt_arg = mrap;
	/*
	* The space map has not been allocated yet, so treat
	* all the space in the metaslab as free and add it to the
	* ms_allocatable tree.
	*/
	range_tree_add(msp->ms_allocatable,
	msp->ms_start, msp->ms_size);

	if (msp->ms_freed != NULL) {
	/*
	* If the ms_sm doesn't exist, this means that this
	* metaslab hasn't gone through metaslab_sync() and
	* thus has never been dirtied. So we shouldn't
	* expect any unflushed allocs or frees from previous
	* TXGs.
	*
	* Note: ms_freed and all the other trees except for
	* the ms_allocatable, can be NULL at this point only
	* if this is a new metaslab of a vdev that just got
	* expanded.
	*/
	ASSERT(range_tree_is_empty(msp->ms_unflushed_allocs));
	ASSERT(range_tree_is_empty(msp->ms_unflushed_frees));
	}
	}

	/*
	* We need to grab the ms_sync_lock to prevent metaslab_sync() from
	* changing the ms_sm (or log_sm) and the metaslab's range trees
	* while we are about to use them and populate the ms_allocatable.
	* The ms_lock is insufficient for this because metaslab_sync() doesn't
	* hold the ms_lock while writing the ms_checkpointing tree to disk.
	*/
	mutex_enter(&msp->ms_sync_lock);
	mutex_enter(&msp->ms_lock);

	ASSERT(!msp->ms_condensing);
	ASSERT(!msp->ms_flushing);

	if (error != 0) {
	mutex_exit(&msp->ms_sync_lock);
	return (error);
	}

	ASSERT3P(msp->ms_group, !=, NULL);
	msp->ms_loaded = B_TRUE;

	/*
	* Apply all the unflushed changes to ms_allocatable right
	* away so any manipulations we do below have a clear view
	* of what is allocated and what is free.
	*/
	range_tree_walk(msp->ms_unflushed_allocs,
	range_tree_remove, msp->ms_allocatable);
	range_tree_walk(msp->ms_unflushed_frees,
	range_tree_add, msp->ms_allocatable);

	msp->ms_loaded = B_TRUE;

	ASSERT3P(msp->ms_group, !=, NULL);
	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;
	if (spa_syncing_log_sm(spa) != NULL) {
	ASSERT(spa_feature_is_enabled(spa,
	SPA_FEATURE_LOG_SPACEMAP));

	/*
	* If we use a log space map we add all the segments
	* that are in ms_unflushed_frees so they are available
	* for allocation.
	*
	* ms_allocatable needs to contain all free segments
	* that are ready for allocations (thus not segments
	* from ms_freeing, ms_freed, and the ms_defer trees).
	* But if we grab the lock in this code path at a sync
	* pass later that 1, then it also contains the
	* segments of ms_freed (they were added to it earlier
	* in this path through ms_unflushed_frees). So we
	* need to remove all the segments that exist in
	* ms_freed from ms_allocatable as they will be added
	* later in metaslab_sync_done().
	*
	* When there's no log space map, the ms_allocatable
	* correctly doesn't contain any segments that exist
	* in ms_freed [see ms_synced_length].
	*/
	range_tree_walk(msp->ms_freed,
	range_tree_remove, msp->ms_allocatable);
	}

	/*
	* If we are not using the log space map, ms_allocatable
	* contains the segments that exist in the ms_defer trees
	* [see ms_synced_length]. Thus we need to remove them
	* from ms_allocatable as they will be added again in
	* metaslab_sync_done().
	*
	* If we are using the log space map, ms_allocatable still
	* contains the segments that exist in the ms_defer trees.
	* Not because it read them through the ms_sm though. But
	* because these segments are part of ms_unflushed_frees
	* whose segments we add to ms_allocatable earlier in this
	* code path.
	*/
	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	range_tree_walk(msp->ms_defer[t],
	range_tree_remove, msp->ms_allocatable);
	}

	/*
	* Call metaslab_recalculate_weight_and_sort() now that the
	* metaslab is loaded so we get the metaslab's real weight.
	*
	* Unless this metaslab was created with older software and
	* has not yet been converted to use segment-based weight, we
	* expect the new weight to be better or equal to the weight
	* that the metaslab had while it was not loaded. This is
	* because the old weight does not take into account the
	* consolidation of adjacent segments between TXGs. [see
	* comment for ms_synchist and ms_deferhist[] for more info]
	*/
	uint64_t weight = msp->ms_weight;
	uint64_t max_size = msp->ms_max_size;
	metaslab_recalculate_weight_and_sort(msp);
	if (!WEIGHT_IS_SPACEBASED(weight))
	ASSERT3U(weight, <=, msp->ms_weight);
	msp->ms_max_size = metaslab_largest_allocatable(msp);
	ASSERT3U(max_size, <=, msp->ms_max_size);
	hrtime_t load_end = gethrtime();
	msp->ms_load_time = load_end;
	zfs_dbgmsg("metaslab_load: txg %llu, spa %s, vdev_id %llu, "
	"ms_id %llu, smp_length %llu, "
	"unflushed_allocs %llu, unflushed_frees %llu, "
	"freed %llu, defer %llu + %llu, unloaded time %llu ms, "
	"loading_time %lld ms, ms_max_size %llu, "
	"max size error %lld, "
	"old_weight %llx, new_weight %llx",
	spa_syncing_txg(spa), spa_name(spa),
	msp->ms_group->mg_vd->vdev_id, msp->ms_id,
	space_map_length(msp->ms_sm),
	range_tree_space(msp->ms_unflushed_allocs),
	range_tree_space(msp->ms_unflushed_frees),
	range_tree_space(msp->ms_freed),
	range_tree_space(msp->ms_defer[0]),
	range_tree_space(msp->ms_defer[1]),
	(longlong_t)((load_start - msp->ms_unload_time) / 1000000),
	(longlong_t)((load_end - load_start) / 1000000),
	msp->ms_max_size, msp->ms_max_size - max_size,
	weight, msp->ms_weight);

	metaslab_verify_space(msp, spa_syncing_txg(spa));
	mutex_exit(&msp->ms_sync_lock);
	return (0);
	}

	int
	metaslab_load(metaslab_t *msp)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	/*
	* There may be another thread loading the same metaslab, if that's
	* the case just wait until the other thread is done and return.
	*/
	metaslab_load_wait(msp);
	if (msp->ms_loaded)
	return (0);
	VERIFY(!msp->ms_loading);
	ASSERT(!msp->ms_condensing);

	/*
	* We set the loading flag BEFORE potentially dropping the lock to
	* wait for an ongoing flush (see ms_flushing below). This way other
	* threads know that there is already a thread that is loading this
	* metaslab.
	*/
	msp->ms_loading = B_TRUE;

	/*
	* Wait for any in-progress flushing to finish as we drop the ms_lock
	* both here (during space_map_load()) and in metaslab_flush() (when
	* we flush our changes to the ms_sm).
	*/
	if (msp->ms_flushing)
	metaslab_flush_wait(msp);

	/*
	* In the possibility that we were waiting for the metaslab to be
	* flushed (where we temporarily dropped the ms_lock), ensure that
	* no one else loaded the metaslab somehow.
	*/
	ASSERT(!msp->ms_loaded);

	/*
	* If we're loading a metaslab in the normal class, consider evicting
	* another one to keep our memory usage under the limit defined by the
	* zfs_metaslab_mem_limit tunable.
	*/
	if (spa_normal_class(msp->ms_group->mg_class->mc_spa) ==
	msp->ms_group->mg_class) {
	metaslab_potentially_evict(msp->ms_group->mg_class);
	}

	int error = metaslab_load_impl(msp);

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	msp->ms_loading = B_FALSE;
	cv_broadcast(&msp->ms_load_cv);

	return (error);
	}

	void
	metaslab_unload(metaslab_t *msp)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	/*
	* This can happen if a metaslab is selected for eviction (in
	* metaslab_potentially_evict) and then unloaded during spa_sync (via
	* metaslab_class_evict_old).
	*/
	if (!msp->ms_loaded)
	return;

	range_tree_vacate(msp->ms_allocatable, NULL, NULL);
	msp->ms_loaded = B_FALSE;
	msp->ms_unload_time = gethrtime();

	msp->ms_activation_weight = 0;
	msp->ms_weight &= ~METASLAB_ACTIVE_MASK;

	if (msp->ms_group != NULL) {
	metaslab_class_t *mc = msp->ms_group->mg_class;
	multilist_sublist_t *mls =
	multilist_sublist_lock_obj(mc->mc_metaslab_txg_list, msp);
	if (multilist_link_active(&msp->ms_class_txg_node))
	multilist_sublist_remove(mls, msp);
	multilist_sublist_unlock(mls);

	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;
	zfs_dbgmsg("metaslab_unload: txg %llu, spa %s, vdev_id %llu, "
	"ms_id %llu, weight %llx, "
	"selected txg %llu (%llu ms ago), alloc_txg %llu, "
	"loaded %llu ms ago, max_size %llu",
	spa_syncing_txg(spa), spa_name(spa),
	msp->ms_group->mg_vd->vdev_id, msp->ms_id,
	msp->ms_weight,
	msp->ms_selected_txg,
	(msp->ms_unload_time - msp->ms_selected_time) / 1000 / 1000,
	msp->ms_alloc_txg,
	(msp->ms_unload_time - msp->ms_load_time) / 1000 / 1000,
	msp->ms_max_size);
	}

	/*
	* We explicitly recalculate the metaslab's weight based on its space
	* map (as it is now not loaded). We want unload metaslabs to always
	* have their weights calculated from the space map histograms, while
	* loaded ones have it calculated from their in-core range tree
	* [see metaslab_load()]. This way, the weight reflects the information
	* available in-core, whether it is loaded or not.
	*
	* If ms_group == NULL means that we came here from metaslab_fini(),
	* at which point it doesn't make sense for us to do the recalculation
	* and the sorting.
	*/
	if (msp->ms_group != NULL)
	metaslab_recalculate_weight_and_sort(msp);
	}

	/*
	* We want to optimize the memory use of the per-metaslab range
	* trees. To do this, we store the segments in the range trees in
	* units of sectors, zero-indexing from the start of the metaslab. If
	* the vdev_ms_shift - the vdev_ashift is less than 32, we can store
	* the ranges using two uint32_ts, rather than two uint64_ts.
	*/
	range_seg_type_t
	metaslab_calculate_range_tree_type(vdev_t vdev, metaslab_t msp,
	uint64_t start, uint64_t shift)
	{
	if (vdev->vdev_ms_shift - vdev->vdev_ashift < 32 &&
	!zfs_metaslab_force_large_segs) {
	*shift = vdev->vdev_ashift;
	*start = msp->ms_start;
	return (RANGE_SEG32);
	} else {
	*shift = 0;
	*start = 0;
	return (RANGE_SEG64);
	}
	}

	void
	metaslab_set_selected_txg(metaslab_t *msp, uint64_t txg)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));
	metaslab_class_t *mc = msp->ms_group->mg_class;
	multilist_sublist_t *mls =
	multilist_sublist_lock_obj(mc->mc_metaslab_txg_list, msp);
	if (multilist_link_active(&msp->ms_class_txg_node))
	multilist_sublist_remove(mls, msp);
	msp->ms_selected_txg = txg;
	msp->ms_selected_time = gethrtime();
	multilist_sublist_insert_tail(mls, msp);
	multilist_sublist_unlock(mls);
	}

	void
	metaslab_space_update(vdev_t vd, metaslab_class_t mc, int64_t alloc_delta,
	int64_t defer_delta, int64_t space_delta)
	{
	vdev_space_update(vd, alloc_delta, defer_delta, space_delta);

	ASSERT3P(vd->vdev_spa->spa_root_vdev, ==, vd->vdev_parent);
	ASSERT(vd->vdev_ms_count != 0);

	metaslab_class_space_update(mc, alloc_delta, defer_delta, space_delta,
	vdev_deflated_space(vd, space_delta));
	}

	int
	metaslab_init(metaslab_group_t *mg, uint64_t id, uint64_t object,
	uint64_t txg, metaslab_t **msp)
	{
	vdev_t *vd = mg->mg_vd;
	spa_t *spa = vd->vdev_spa;
	objset_t *mos = spa->spa_meta_objset;
	metaslab_t *ms;
	int error;

	ms = kmem_zalloc(sizeof (metaslab_t), KM_SLEEP);
	mutex_init(&ms->ms_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&ms->ms_sync_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&ms->ms_load_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&ms->ms_flush_cv, NULL, CV_DEFAULT, NULL);
	multilist_link_init(&ms->ms_class_txg_node);

	ms->ms_id = id;
	ms->ms_start = id << vd->vdev_ms_shift;
	ms->ms_size = 1ULL << vd->vdev_ms_shift;
	ms->ms_allocator = -1;
	ms->ms_new = B_TRUE;

	/*
	* We only open space map objects that already exist. All others
	* will be opened when we finally allocate an object for it.
	*
	* Note:
	* When called from vdev_expand(), we can't call into the DMU as
	* we are holding the spa_config_lock as a writer and we would
	* deadlock [see relevant comment in vdev_metaslab_init()]. in
	* that case, the object parameter is zero though, so we won't
	* call into the DMU.
	*/
	if (object != 0) {
	error = space_map_open(&ms->ms_sm, mos, object, ms->ms_start,
	ms->ms_size, vd->vdev_ashift);

	if (error != 0) {
	kmem_free(ms, sizeof (metaslab_t));
	return (error);
	}

	ASSERT(ms->ms_sm != NULL);
	ms->ms_allocated_space = space_map_allocated(ms->ms_sm);
	}

	range_seg_type_t type;
	uint64_t shift, start;
	type = metaslab_calculate_range_tree_type(vd, ms, &start, &shift);

	/*
	* We create the ms_allocatable here, but we don't create the
	* other range trees until metaslab_sync_done(). This serves
	* two purposes: it allows metaslab_sync_done() to detect the
	* addition of new space; and for debugging, it ensures that
	* we'd data fault on any attempt to use this metaslab before
	* it's ready.
	*/
	ms->ms_allocatable = range_tree_create(NULL, type, NULL, start, shift);

	ms->ms_trim = range_tree_create(NULL, type, NULL, start, shift);

	metaslab_group_add(mg, ms);
	metaslab_set_fragmentation(ms, B_FALSE);

	/*
	* If we're opening an existing pool (txg == 0) or creating
	* a new one (txg == TXG_INITIAL), all space is available now.
	* If we're adding space to an existing pool, the new space
	* does not become available until after this txg has synced.
	* The metaslab's weight will also be initialized when we sync
	* out this txg. This ensures that we don't attempt to allocate
	* from it before we have initialized it completely.
	*/
	if (txg <= TXG_INITIAL) {
	metaslab_sync_done(ms, 0);
	metaslab_space_update(vd, mg->mg_class,
	metaslab_allocated_space(ms), 0, 0);
	}

	if (txg != 0) {
	vdev_dirty(vd, 0, NULL, txg);
	vdev_dirty(vd, VDD_METASLAB, ms, txg);
	}

	*msp = ms;

	return (0);
	}

	static void
	metaslab_fini_flush_data(metaslab_t *msp)
	{
	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;

	if (metaslab_unflushed_txg(msp) == 0) {
	ASSERT3P(avl_find(&spa->spa_metaslabs_by_flushed, msp, NULL),
	==, NULL);
	return;
	}
	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP));

	mutex_enter(&spa->spa_flushed_ms_lock);
	avl_remove(&spa->spa_metaslabs_by_flushed, msp);
	mutex_exit(&spa->spa_flushed_ms_lock);

	spa_log_sm_decrement_mscount(spa, metaslab_unflushed_txg(msp));
	spa_log_summary_decrement_mscount(spa, metaslab_unflushed_txg(msp));
	}

	uint64_t
	metaslab_unflushed_changes_memused(metaslab_t *ms)
	{
	return ((range_tree_numsegs(ms->ms_unflushed_allocs) +
	range_tree_numsegs(ms->ms_unflushed_frees)) *
	ms->ms_unflushed_allocs->rt_root.bt_elem_size);
	}

	void
	metaslab_fini(metaslab_t *msp)
	{
	metaslab_group_t *mg = msp->ms_group;
	vdev_t *vd = mg->mg_vd;
	spa_t *spa = vd->vdev_spa;

	metaslab_fini_flush_data(msp);

	metaslab_group_remove(mg, msp);

	mutex_enter(&msp->ms_lock);
	VERIFY(msp->ms_group == NULL);
	metaslab_space_update(vd, mg->mg_class,
	-metaslab_allocated_space(msp), 0, -msp->ms_size);

	space_map_close(msp->ms_sm);
	msp->ms_sm = NULL;

	metaslab_unload(msp);
	range_tree_destroy(msp->ms_allocatable);
	range_tree_destroy(msp->ms_freeing);
	range_tree_destroy(msp->ms_freed);

	ASSERT3U(spa->spa_unflushed_stats.sus_memused, >=,
	metaslab_unflushed_changes_memused(msp));
	spa->spa_unflushed_stats.sus_memused -=
	metaslab_unflushed_changes_memused(msp);
	range_tree_vacate(msp->ms_unflushed_allocs, NULL, NULL);
	range_tree_destroy(msp->ms_unflushed_allocs);
	range_tree_vacate(msp->ms_unflushed_frees, NULL, NULL);
	range_tree_destroy(msp->ms_unflushed_frees);

	for (int t = 0; t < TXG_SIZE; t++) {
	range_tree_destroy(msp->ms_allocating[t]);
	}

	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	range_tree_destroy(msp->ms_defer[t]);
	}
	ASSERT0(msp->ms_deferspace);

	range_tree_destroy(msp->ms_checkpointing);

	for (int t = 0; t < TXG_SIZE; t++)
	ASSERT(!txg_list_member(&vd->vdev_ms_list, msp, t));

	range_tree_vacate(msp->ms_trim, NULL, NULL);
	range_tree_destroy(msp->ms_trim);

	mutex_exit(&msp->ms_lock);
	cv_destroy(&msp->ms_load_cv);
	cv_destroy(&msp->ms_flush_cv);
	mutex_destroy(&msp->ms_lock);
	mutex_destroy(&msp->ms_sync_lock);
	ASSERT3U(msp->ms_allocator, ==, -1);

	kmem_free(msp, sizeof (metaslab_t));
	}

	#define FRAGMENTATION_TABLE_SIZE 17

	/*
	* This table defines a segment size based fragmentation metric that will
	* allow each metaslab to derive its own fragmentation value. This is done
	* by calculating the space in each bucket of the spacemap histogram and
	* multiplying that by the fragmentation metric in this table. Doing
	* this for all buckets and dividing it by the total amount of free
	* space in this metaslab (i.e. the total free space in all buckets) gives
	* us the fragmentation metric. This means that a high fragmentation metric
	* equates to most of the free space being comprised of small segments.
	* Conversely, if the metric is low, then most of the free space is in
	* large segments. A 10% change in fragmentation equates to approximately
	* double the number of segments.
	*
	* This table defines 0% fragmented space using 16MB segments. Testing has
	* shown that segments that are greater than or equal to 16MB do not suffer
	* from drastic performance problems. Using this value, we derive the rest
	* of the table. Since the fragmentation value is never stored on disk, it
	* is possible to change these calculations in the future.
	*/
	int zfs_frag_table[FRAGMENTATION_TABLE_SIZE] = {
	100, /* 512B */
	100, /* 1K */
	98, /* 2K */
	95, /* 4K */
	90, /* 8K */
	80, /* 16K */
	70, /* 32K */
	60, /* 64K */
	50, /* 128K */
	40, /* 256K */
	30, /* 512K */
	20, /* 1M */
	15, /* 2M */
	10, /* 4M */
	5, /* 8M */
	0 /* 16M */
	};

	/*
	* Calculate the metaslab's fragmentation metric and set ms_fragmentation.
	* Setting this value to ZFS_FRAG_INVALID means that the metaslab has not
	* been upgraded and does not support this metric. Otherwise, the return
	* value should be in the range [0, 100].
	*/
	static void
	metaslab_set_fragmentation(metaslab_t *msp, boolean_t nodirty)
	{
	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;
	uint64_t fragmentation = 0;
	uint64_t total = 0;
	boolean_t feature_enabled = spa_feature_is_enabled(spa,
	SPA_FEATURE_SPACEMAP_HISTOGRAM);

	if (!feature_enabled) {
	msp->ms_fragmentation = ZFS_FRAG_INVALID;
	return;
	}

	/*
	* A null space map means that the entire metaslab is free
	* and thus is not fragmented.
	*/
	if (msp->ms_sm == NULL) {
	msp->ms_fragmentation = 0;
	return;
	}

	/*
	* If this metaslab's space map has not been upgraded, flag it
	* so that we upgrade next time we encounter it.
	*/
	if (msp->ms_sm->sm_dbuf->db_size != sizeof (space_map_phys_t)) {
	uint64_t txg = spa_syncing_txg(spa);
	vdev_t *vd = msp->ms_group->mg_vd;

	/*
	* If we've reached the final dirty txg, then we must
	* be shutting down the pool. We don't want to dirty
	* any data past this point so skip setting the condense
	* flag. We can retry this action the next time the pool
	* is imported. We also skip marking this metaslab for
	* condensing if the caller has explicitly set nodirty.
	*/
	if (!nodirty &&
	spa_writeable(spa) && txg < spa_final_dirty_txg(spa)) {
	msp->ms_condense_wanted = B_TRUE;
	vdev_dirty(vd, VDD_METASLAB, msp, txg + 1);
	zfs_dbgmsg("txg %llu, requesting force condense: "
	"ms_id %llu, vdev_id %llu", txg, msp->ms_id,
	vd->vdev_id);
	}
	msp->ms_fragmentation = ZFS_FRAG_INVALID;
	return;
	}

	for (int i = 0; i < SPACE_MAP_HISTOGRAM_SIZE; i++) {
	uint64_t space = 0;
	uint8_t shift = msp->ms_sm->sm_shift;

	int idx = MIN(shift - SPA_MINBLOCKSHIFT + i,
	FRAGMENTATION_TABLE_SIZE - 1);

	if (msp->ms_sm->sm_phys->smp_histogram[i] == 0)
	continue;

	space = msp->ms_sm->sm_phys->smp_histogram[i] << (i + shift);
	total += space;

	ASSERT3U(idx, <, FRAGMENTATION_TABLE_SIZE);
	fragmentation += space * zfs_frag_table[idx];
	}

	if (total > 0)
	fragmentation /= total;
	ASSERT3U(fragmentation, <=, 100);

	msp->ms_fragmentation = fragmentation;
	}

	/*
	* Compute a weight -- a selection preference value -- for the given metaslab.
	* This is based on the amount of free space, the level of fragmentation,
	* the LBA range, and whether the metaslab is loaded.
	*/
	static uint64_t
	metaslab_space_weight(metaslab_t *msp)
	{
	metaslab_group_t *mg = msp->ms_group;
	vdev_t *vd = mg->mg_vd;
	uint64_t weight, space;

	ASSERT(MUTEX_HELD(&msp->ms_lock));

	/*
	* The baseline weight is the metaslab's free space.
	*/
	space = msp->ms_size - metaslab_allocated_space(msp);

	if (metaslab_fragmentation_factor_enabled &&
	msp->ms_fragmentation != ZFS_FRAG_INVALID) {
	/*
	* Use the fragmentation information to inversely scale
	* down the baseline weight. We need to ensure that we
	* don't exclude this metaslab completely when it's 100%
	* fragmented. To avoid this we reduce the fragmented value
	* by 1.
	*/
	space = (space * (100 - (msp->ms_fragmentation - 1))) / 100;

	/*
	* If space < SPA_MINBLOCKSIZE, then we will not allocate from
	* this metaslab again. The fragmentation metric may have
	* decreased the space to something smaller than
	* SPA_MINBLOCKSIZE, so reset the space to SPA_MINBLOCKSIZE
	* so that we can consume any remaining space.
	*/
	if (space > 0 && space < SPA_MINBLOCKSIZE)
	space = SPA_MINBLOCKSIZE;
	}
	weight = space;

	/*
	* Modern disks have uniform bit density and constant angular velocity.
	* Therefore, the outer recording zones are faster (higher bandwidth)
	* than the inner zones by the ratio of outer to inner track diameter,
	* which is typically around 2:1. We account for this by assigning
	* higher weight to lower metaslabs (multiplier ranging from 2x to 1x).
	* In effect, this means that we'll select the metaslab with the most
	* free bandwidth rather than simply the one with the most free space.
	*/
	if (!vd->vdev_nonrot && metaslab_lba_weighting_enabled) {
	weight = 2 * weight - (msp->ms_id * weight) / vd->vdev_ms_count;
	ASSERT(weight >= space && weight <= 2 * space);
	}

	/*
	* If this metaslab is one we're actively using, adjust its
	* weight to make it preferable to any inactive metaslab so
	* we'll polish it off. If the fragmentation on this metaslab
	* has exceed our threshold, then don't mark it active.
	*/
	if (msp->ms_loaded && msp->ms_fragmentation != ZFS_FRAG_INVALID &&
	msp->ms_fragmentation <= zfs_metaslab_fragmentation_threshold) {
	weight \|= (msp->ms_weight & METASLAB_ACTIVE_MASK);
	}

	WEIGHT_SET_SPACEBASED(weight);
	return (weight);
	}

	/*
	* Return the weight of the specified metaslab, according to the segment-based
	* weighting algorithm. The metaslab must be loaded. This function can
	* be called within a sync pass since it relies only on the metaslab's
	* range tree which is always accurate when the metaslab is loaded.
	*/
	static uint64_t
	metaslab_weight_from_range_tree(metaslab_t *msp)
	{
	uint64_t weight = 0;
	uint32_t segments = 0;

	ASSERT(msp->ms_loaded);

	for (int i = RANGE_TREE_HISTOGRAM_SIZE - 1; i >= SPA_MINBLOCKSHIFT;
	i--) {
	uint8_t shift = msp->ms_group->mg_vd->vdev_ashift;
	int max_idx = SPACE_MAP_HISTOGRAM_SIZE + shift - 1;

	segments <<= 1;
	segments += msp->ms_allocatable->rt_histogram[i];

	/*
	* The range tree provides more precision than the space map
	* and must be downgraded so that all values fit within the
	* space map's histogram. This allows us to compare loaded
	* vs. unloaded metaslabs to determine which metaslab is
	* considered "best".
	*/
	if (i > max_idx)
	continue;

	if (segments != 0) {
	WEIGHT_SET_COUNT(weight, segments);
	WEIGHT_SET_INDEX(weight, i);
	WEIGHT_SET_ACTIVE(weight, 0);
	break;
	}
	}
	return (weight);
	}

	/*
	* Calculate the weight based on the on-disk histogram. Should be applied
	* only to unloaded metaslabs (i.e no incoming allocations) in-order to
	* give results consistent with the on-disk state
	*/
	static uint64_t
	metaslab_weight_from_spacemap(metaslab_t *msp)
	{
	space_map_t *sm = msp->ms_sm;
	ASSERT(!msp->ms_loaded);
	ASSERT(sm != NULL);
	ASSERT3U(space_map_object(sm), !=, 0);
	ASSERT3U(sm->sm_dbuf->db_size, ==, sizeof (space_map_phys_t));

	/*
	* Create a joint histogram from all the segments that have made
	* it to the metaslab's space map histogram, that are not yet
	* available for allocation because they are still in the freeing
	* pipeline (e.g. freeing, freed, and defer trees). Then subtract
	* these segments from the space map's histogram to get a more
	* accurate weight.
	*/
	uint64_t deferspace_histogram[SPACE_MAP_HISTOGRAM_SIZE] = {0};
	for (int i = 0; i < SPACE_MAP_HISTOGRAM_SIZE; i++)
	deferspace_histogram[i] += msp->ms_synchist[i];
	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	for (int i = 0; i < SPACE_MAP_HISTOGRAM_SIZE; i++) {
	deferspace_histogram[i] += msp->ms_deferhist[t][i];
	}
	}

	uint64_t weight = 0;
	for (int i = SPACE_MAP_HISTOGRAM_SIZE - 1; i >= 0; i--) {
	ASSERT3U(sm->sm_phys->smp_histogram[i], >=,
	deferspace_histogram[i]);
	uint64_t count =
	sm->sm_phys->smp_histogram[i] - deferspace_histogram[i];
	if (count != 0) {
	WEIGHT_SET_COUNT(weight, count);
	WEIGHT_SET_INDEX(weight, i + sm->sm_shift);
	WEIGHT_SET_ACTIVE(weight, 0);
	break;
	}
	}
	return (weight);
	}

	/*
	* Compute a segment-based weight for the specified metaslab. The weight
	* is determined by highest bucket in the histogram. The information
	* for the highest bucket is encoded into the weight value.
	*/
	static uint64_t
	metaslab_segment_weight(metaslab_t *msp)
	{
	metaslab_group_t *mg = msp->ms_group;
	uint64_t weight = 0;
	uint8_t shift = mg->mg_vd->vdev_ashift;

	ASSERT(MUTEX_HELD(&msp->ms_lock));

	/*
	* The metaslab is completely free.
	*/
	if (metaslab_allocated_space(msp) == 0) {
	int idx = highbit64(msp->ms_size) - 1;
	int max_idx = SPACE_MAP_HISTOGRAM_SIZE + shift - 1;

	if (idx < max_idx) {
	WEIGHT_SET_COUNT(weight, 1ULL);
	WEIGHT_SET_INDEX(weight, idx);
	} else {
	WEIGHT_SET_COUNT(weight, 1ULL << (idx - max_idx));
	WEIGHT_SET_INDEX(weight, max_idx);
	}
	WEIGHT_SET_ACTIVE(weight, 0);
	ASSERT(!WEIGHT_IS_SPACEBASED(weight));
	return (weight);
	}

	ASSERT3U(msp->ms_sm->sm_dbuf->db_size, ==, sizeof (space_map_phys_t));

	/*
	* If the metaslab is fully allocated then just make the weight 0.
	*/
	if (metaslab_allocated_space(msp) == msp->ms_size)
	return (0);
	/*
	* If the metaslab is already loaded, then use the range tree to
	* determine the weight. Otherwise, we rely on the space map information
	* to generate the weight.
	*/
	if (msp->ms_loaded) {
	weight = metaslab_weight_from_range_tree(msp);
	} else {
	weight = metaslab_weight_from_spacemap(msp);
	}

	/*
	* If the metaslab was active the last time we calculated its weight
	* then keep it active. We want to consume the entire region that
	* is associated with this weight.
	*/
	if (msp->ms_activation_weight != 0 && weight != 0)
	WEIGHT_SET_ACTIVE(weight, WEIGHT_GET_ACTIVE(msp->ms_weight));
	return (weight);
	}

	/*
	* Determine if we should attempt to allocate from this metaslab. If the
	* metaslab is loaded, then we can determine if the desired allocation
	* can be satisfied by looking at the size of the maximum free segment
	* on that metaslab. Otherwise, we make our decision based on the metaslab's
	* weight. For segment-based weighting we can determine the maximum
	* allocation based on the index encoded in its value. For space-based
	* weights we rely on the entire weight (excluding the weight-type bit).
	*/
	static boolean_t
	metaslab_should_allocate(metaslab_t *msp, uint64_t asize, boolean_t try_hard)
	{
	/*
	* If the metaslab is loaded, ms_max_size is definitive and we can use
	* the fast check. If it's not, the ms_max_size is a lower bound (once
	* set), and we should use the fast check as long as we're not in
	* try_hard and it's been less than zfs_metaslab_max_size_cache_sec
	* seconds since the metaslab was unloaded.
	*/
	if (msp->ms_loaded \|\|
	(msp->ms_max_size != 0 && !try_hard && gethrtime() <
	msp->ms_unload_time + SEC2NSEC(zfs_metaslab_max_size_cache_sec)))
	return (msp->ms_max_size >= asize);

	boolean_t should_allocate;
	if (!WEIGHT_IS_SPACEBASED(msp->ms_weight)) {
	/*
	* The metaslab segment weight indicates segments in the
	* range [2^i, 2^(i+1)), where i is the index in the weight.
	* Since the asize might be in the middle of the range, we
	* should attempt the allocation if asize < 2^(i+1).
	*/
	should_allocate = (asize <
	1ULL << (WEIGHT_GET_INDEX(msp->ms_weight) + 1));
	} else {
	should_allocate = (asize <=
	(msp->ms_weight & ~METASLAB_WEIGHT_TYPE));
	}

	return (should_allocate);
	}

	static uint64_t
	metaslab_weight(metaslab_t *msp, boolean_t nodirty)
	{
	vdev_t *vd = msp->ms_group->mg_vd;
	spa_t *spa = vd->vdev_spa;
	uint64_t weight;

	ASSERT(MUTEX_HELD(&msp->ms_lock));

	metaslab_set_fragmentation(msp, nodirty);

	/*
	* Update the maximum size. If the metaslab is loaded, this will
	* ensure that we get an accurate maximum size if newly freed space
	* has been added back into the free tree. If the metaslab is
	* unloaded, we check if there's a larger free segment in the
	* unflushed frees. This is a lower bound on the largest allocatable
	* segment size. Coalescing of adjacent entries may reveal larger
	* allocatable segments, but we aren't aware of those until loading
	* the space map into a range tree.
	*/
	if (msp->ms_loaded) {
	msp->ms_max_size = metaslab_largest_allocatable(msp);
	} else {
	msp->ms_max_size = MAX(msp->ms_max_size,
	metaslab_largest_unflushed_free(msp));
	}

	/*
	* Segment-based weighting requires space map histogram support.
	*/
	if (zfs_metaslab_segment_weight_enabled &&
	spa_feature_is_enabled(spa, SPA_FEATURE_SPACEMAP_HISTOGRAM) &&
	(msp->ms_sm == NULL \|\| msp->ms_sm->sm_dbuf->db_size ==
	sizeof (space_map_phys_t))) {
	weight = metaslab_segment_weight(msp);
	} else {
	weight = metaslab_space_weight(msp);
	}
	return (weight);
	}

	void
	metaslab_recalculate_weight_and_sort(metaslab_t *msp)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	/* note: we preserve the mask (e.g. indication of primary, etc..) */
	uint64_t was_active = msp->ms_weight & METASLAB_ACTIVE_MASK;
	metaslab_group_sort(msp->ms_group, msp,
	metaslab_weight(msp, B_FALSE) \| was_active);
	}

	static int
	metaslab_activate_allocator(metaslab_group_t mg, metaslab_t msp,
	int allocator, uint64_t activation_weight)
	{
	metaslab_group_allocator_t *mga = &mg->mg_allocator[allocator];
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	/*
	* If we're activating for the claim code, we don't want to actually
	* set the metaslab up for a specific allocator.
	*/
	if (activation_weight == METASLAB_WEIGHT_CLAIM) {
	ASSERT0(msp->ms_activation_weight);
	msp->ms_activation_weight = msp->ms_weight;
	metaslab_group_sort(mg, msp, msp->ms_weight \|
	activation_weight);
	return (0);
	}

	metaslab_t **mspp = (activation_weight == METASLAB_WEIGHT_PRIMARY ?
	&mga->mga_primary : &mga->mga_secondary);

	mutex_enter(&mg->mg_lock);
	if (*mspp != NULL) {
	mutex_exit(&mg->mg_lock);
	return (EEXIST);
	}

	*mspp = msp;
	ASSERT3S(msp->ms_allocator, ==, -1);
	msp->ms_allocator = allocator;
	msp->ms_primary = (activation_weight == METASLAB_WEIGHT_PRIMARY);

	ASSERT0(msp->ms_activation_weight);
	msp->ms_activation_weight = msp->ms_weight;
	metaslab_group_sort_impl(mg, msp,
	msp->ms_weight \| activation_weight);
	mutex_exit(&mg->mg_lock);

	return (0);
	}

	static int
	metaslab_activate(metaslab_t *msp, int allocator, uint64_t activation_weight)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	/*
	* The current metaslab is already activated for us so there
	* is nothing to do. Already activated though, doesn't mean
	* that this metaslab is activated for our allocator nor our
	* requested activation weight. The metaslab could have started
	* as an active one for our allocator but changed allocators
	* while we were waiting to grab its ms_lock or we stole it
	* [see find_valid_metaslab()]. This means that there is a
	* possibility of passivating a metaslab of another allocator
	* or from a different activation mask, from this thread.
	*/
	if ((msp->ms_weight & METASLAB_ACTIVE_MASK) != 0) {
	ASSERT(msp->ms_loaded);
	return (0);
	}

	int error = metaslab_load(msp);
	if (error != 0) {
	metaslab_group_sort(msp->ms_group, msp, 0);
	return (error);
	}

	/*
	* When entering metaslab_load() we may have dropped the
	* ms_lock because we were loading this metaslab, or we
	* were waiting for another thread to load it for us. In
	* that scenario, we recheck the weight of the metaslab
	* to see if it was activated by another thread.
	*
	* If the metaslab was activated for another allocator or
	* it was activated with a different activation weight (e.g.
	* we wanted to make it a primary but it was activated as
	* secondary) we return error (EBUSY).
	*
	* If the metaslab was activated for the same allocator
	* and requested activation mask, skip activating it.
	*/
	if ((msp->ms_weight & METASLAB_ACTIVE_MASK) != 0) {
	if (msp->ms_allocator != allocator)
	return (EBUSY);

	if ((msp->ms_weight & activation_weight) == 0)
	return (SET_ERROR(EBUSY));

	EQUIV((activation_weight == METASLAB_WEIGHT_PRIMARY),
	msp->ms_primary);
	return (0);
	}

	/*
	* If the metaslab has literally 0 space, it will have weight 0. In
	* that case, don't bother activating it. This can happen if the
	* metaslab had space during find_valid_metaslab, but another thread
	* loaded it and used all that space while we were waiting to grab the
	* lock.
	*/
	if (msp->ms_weight == 0) {
	ASSERT0(range_tree_space(msp->ms_allocatable));
	return (SET_ERROR(ENOSPC));
	}

	if ((error = metaslab_activate_allocator(msp->ms_group, msp,
	allocator, activation_weight)) != 0) {
	return (error);
	}

	ASSERT(msp->ms_loaded);
	ASSERT(msp->ms_weight & METASLAB_ACTIVE_MASK);

	return (0);
	}

	static void
	metaslab_passivate_allocator(metaslab_group_t mg, metaslab_t msp,
	uint64_t weight)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));
	ASSERT(msp->ms_loaded);

	if (msp->ms_weight & METASLAB_WEIGHT_CLAIM) {
	metaslab_group_sort(mg, msp, weight);
	return;
	}

	mutex_enter(&mg->mg_lock);
	ASSERT3P(msp->ms_group, ==, mg);
	ASSERT3S(0, <=, msp->ms_allocator);
	ASSERT3U(msp->ms_allocator, <, mg->mg_allocators);

	metaslab_group_allocator_t *mga = &mg->mg_allocator[msp->ms_allocator];
	if (msp->ms_primary) {
	ASSERT3P(mga->mga_primary, ==, msp);
	ASSERT(msp->ms_weight & METASLAB_WEIGHT_PRIMARY);
	mga->mga_primary = NULL;
	} else {
	ASSERT3P(mga->mga_secondary, ==, msp);
	ASSERT(msp->ms_weight & METASLAB_WEIGHT_SECONDARY);
	mga->mga_secondary = NULL;
	}
	msp->ms_allocator = -1;
	metaslab_group_sort_impl(mg, msp, weight);
	mutex_exit(&mg->mg_lock);
	}

	static void
	metaslab_passivate(metaslab_t *msp, uint64_t weight)
	{
	uint64_t size __maybe_unused = weight & ~METASLAB_WEIGHT_TYPE;

	/*
	* If size < SPA_MINBLOCKSIZE, then we will not allocate from
	* this metaslab again. In that case, it had better be empty,
	* or we would be leaving space on the table.
	*/
	ASSERT(!WEIGHT_IS_SPACEBASED(msp->ms_weight) \|\|
	size >= SPA_MINBLOCKSIZE \|\|
	range_tree_space(msp->ms_allocatable) == 0);
	ASSERT0(weight & METASLAB_ACTIVE_MASK);

	ASSERT(msp->ms_activation_weight != 0);
	msp->ms_activation_weight = 0;
	metaslab_passivate_allocator(msp->ms_group, msp, weight);
	ASSERT0(msp->ms_weight & METASLAB_ACTIVE_MASK);
	}

	/*
	* Segment-based metaslabs are activated once and remain active until
	* we either fail an allocation attempt (similar to space-based metaslabs)
	* or have exhausted the free space in zfs_metaslab_switch_threshold
	* buckets since the metaslab was activated. This function checks to see
	* if we've exhausted the zfs_metaslab_switch_threshold buckets in the
	* metaslab and passivates it proactively. This will allow us to select a
	* metaslab with a larger contiguous region, if any, remaining within this
	* metaslab group. If we're in sync pass > 1, then we continue using this
	* metaslab so that we don't dirty more block and cause more sync passes.
	*/
	static void
	metaslab_segment_may_passivate(metaslab_t *msp)
	{
	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;

	if (WEIGHT_IS_SPACEBASED(msp->ms_weight) \|\| spa_sync_pass(spa) > 1)
	return;

	/*
	* Since we are in the middle of a sync pass, the most accurate
	* information that is accessible to us is the in-core range tree
	* histogram; calculate the new weight based on that information.
	*/
	uint64_t weight = metaslab_weight_from_range_tree(msp);
	int activation_idx = WEIGHT_GET_INDEX(msp->ms_activation_weight);
	int current_idx = WEIGHT_GET_INDEX(weight);

	if (current_idx <= activation_idx - zfs_metaslab_switch_threshold)
	metaslab_passivate(msp, weight);
	}

	static void
	metaslab_preload(void *arg)
	{
	metaslab_t *msp = arg;
	metaslab_class_t *mc = msp->ms_group->mg_class;
	spa_t *spa = mc->mc_spa;
	fstrans_cookie_t cookie = spl_fstrans_mark();

	ASSERT(!MUTEX_HELD(&msp->ms_group->mg_lock));

	mutex_enter(&msp->ms_lock);
	(void) metaslab_load(msp);
	metaslab_set_selected_txg(msp, spa_syncing_txg(spa));
	mutex_exit(&msp->ms_lock);
	spl_fstrans_unmark(cookie);
	}

	static void
	metaslab_group_preload(metaslab_group_t *mg)
	{
	spa_t *spa = mg->mg_vd->vdev_spa;
	metaslab_t *msp;
	avl_tree_t *t = &mg->mg_metaslab_tree;
	int m = 0;

	if (spa_shutting_down(spa) \|\| !metaslab_preload_enabled) {
	taskq_wait_outstanding(mg->mg_taskq, 0);
	return;
	}

	mutex_enter(&mg->mg_lock);

	/*
	* Load the next potential metaslabs
	*/
	for (msp = avl_first(t); msp != NULL; msp = AVL_NEXT(t, msp)) {
	ASSERT3P(msp->ms_group, ==, mg);

	/*
	* We preload only the maximum number of metaslabs specified
	* by metaslab_preload_limit. If a metaslab is being forced
	* to condense then we preload it too. This will ensure
	* that force condensing happens in the next txg.
	*/
	if (++m > metaslab_preload_limit && !msp->ms_condense_wanted) {
	continue;
	}

	VERIFY(taskq_dispatch(mg->mg_taskq, metaslab_preload,
	msp, TQ_SLEEP) != TASKQID_INVALID);
	}
	mutex_exit(&mg->mg_lock);
	}

	/*
	* Determine if the space map's on-disk footprint is past our tolerance for
	* inefficiency. We would like to use the following criteria to make our
	* decision:
	*
	* 1. Do not condense if the size of the space map object would dramatically
	* increase as a result of writing out the free space range tree.
	*
	* 2. Condense if the on on-disk space map representation is at least
	* zfs_condense_pct/100 times the size of the optimal representation
	* (i.e. zfs_condense_pct = 110 and in-core = 1MB, optimal = 1.1MB).
	*
	* 3. Do not condense if the on-disk size of the space map does not actually
	* decrease.
	*
	* Unfortunately, we cannot compute the on-disk size of the space map in this
	* context because we cannot accurately compute the effects of compression, etc.
	* Instead, we apply the heuristic described in the block comment for
	* zfs_metaslab_condense_block_threshold - we only condense if the space used
	* is greater than a threshold number of blocks.
	*/
	static boolean_t
	metaslab_should_condense(metaslab_t *msp)
	{
	space_map_t *sm = msp->ms_sm;
	vdev_t *vd = msp->ms_group->mg_vd;
	uint64_t vdev_blocksize = 1 << vd->vdev_ashift;

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	ASSERT(msp->ms_loaded);
	ASSERT(sm != NULL);
	ASSERT3U(spa_sync_pass(vd->vdev_spa), ==, 1);

	/*
	* We always condense metaslabs that are empty and metaslabs for
	* which a condense request has been made.
	*/
	if (range_tree_numsegs(msp->ms_allocatable) == 0 \|\|
	msp->ms_condense_wanted)
	return (B_TRUE);

	uint64_t record_size = MAX(sm->sm_blksz, vdev_blocksize);
	uint64_t object_size = space_map_length(sm);
	uint64_t optimal_size = space_map_estimate_optimal_size(sm,
	msp->ms_allocatable, SM_NO_VDEVID);

	return (object_size >= (optimal_size * zfs_condense_pct / 100) &&
	object_size > zfs_metaslab_condense_block_threshold * record_size);
	}

	/*
	* Condense the on-disk space map representation to its minimized form.
	* The minimized form consists of a small number of allocations followed
	* by the entries of the free range tree (ms_allocatable). The condensed
	* spacemap contains all the entries of previous TXGs (including those in
	* the pool-wide log spacemaps; thus this is effectively a superset of
	* metaslab_flush()), but this TXG's entries still need to be written.
	*/
	static void
	metaslab_condense(metaslab_t msp, dmu_tx_t tx)
	{
	range_tree_t *condense_tree;
	space_map_t *sm = msp->ms_sm;
	uint64_t txg = dmu_tx_get_txg(tx);
	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	ASSERT(msp->ms_loaded);
	ASSERT(msp->ms_sm != NULL);

	/*
	* In order to condense the space map, we need to change it so it
	* only describes which segments are currently allocated and free.
	*
	* All the current free space resides in the ms_allocatable, all
	* the ms_defer trees, and all the ms_allocating trees. We ignore
	* ms_freed because it is empty because we're in sync pass 1. We
	* ignore ms_freeing because these changes are not yet reflected
	* in the spacemap (they will be written later this txg).
	*
	* So to truncate the space map to represent all the entries of
	* previous TXGs we do the following:
	*
	* 1] We create a range tree (condense tree) that is 100% empty.
	* 2] We add to it all segments found in the ms_defer trees
	* as those segments are marked as free in the original space
	* map. We do the same with the ms_allocating trees for the same
	* reason. Adding these segments should be a relatively
	* inexpensive operation since we expect these trees to have a
	* small number of nodes.
	* 3] We vacate any unflushed allocs, since they are not frees we
	* need to add to the condense tree. Then we vacate any
	* unflushed frees as they should already be part of ms_allocatable.
	* 4] At this point, we would ideally like to add all segments
	* in the ms_allocatable tree from the condense tree. This way
	* we would write all the entries of the condense tree as the
	* condensed space map, which would only contain freed
	* segments with everything else assumed to be allocated.
	*
	* Doing so can be prohibitively expensive as ms_allocatable can
	* be large, and therefore computationally expensive to add to
	* the condense_tree. Instead we first sync out an entry marking
	* everything as allocated, then the condense_tree and then the
	* ms_allocatable, in the condensed space map. While this is not
	* optimal, it is typically close to optimal and more importantly
	* much cheaper to compute.
	*
	* 5] Finally, as both of the unflushed trees were written to our
	* new and condensed metaslab space map, we basically flushed
	* all the unflushed changes to disk, thus we call
	* metaslab_flush_update().
	*/
	ASSERT3U(spa_sync_pass(spa), ==, 1);
	ASSERT(range_tree_is_empty(msp->ms_freed)); /* since it is pass 1 */

	zfs_dbgmsg("condensing: txg %llu, msp[%llu] %px, vdev id %llu, "
	"spa %s, smp size %llu, segments %lu, forcing condense=%s", txg,
	msp->ms_id, msp, msp->ms_group->mg_vd->vdev_id,
	spa->spa_name, space_map_length(msp->ms_sm),
	range_tree_numsegs(msp->ms_allocatable),
	msp->ms_condense_wanted ? "TRUE" : "FALSE");

	msp->ms_condense_wanted = B_FALSE;

	range_seg_type_t type;
	uint64_t shift, start;
	type = metaslab_calculate_range_tree_type(msp->ms_group->mg_vd, msp,
	&start, &shift);

	condense_tree = range_tree_create(NULL, type, NULL, start, shift);

	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	range_tree_walk(msp->ms_defer[t],
	range_tree_add, condense_tree);
	}

	for (int t = 0; t < TXG_CONCURRENT_STATES; t++) {
	range_tree_walk(msp->ms_allocating[(txg + t) & TXG_MASK],
	range_tree_add, condense_tree);
	}

	ASSERT3U(spa->spa_unflushed_stats.sus_memused, >=,
	metaslab_unflushed_changes_memused(msp));
	spa->spa_unflushed_stats.sus_memused -=
	metaslab_unflushed_changes_memused(msp);
	range_tree_vacate(msp->ms_unflushed_allocs, NULL, NULL);
	range_tree_vacate(msp->ms_unflushed_frees, NULL, NULL);

	/*
	* We're about to drop the metaslab's lock thus allowing other
	* consumers to change it's content. Set the metaslab's ms_condensing
	* flag to ensure that allocations on this metaslab do not occur
	* while we're in the middle of committing it to disk. This is only
	* critical for ms_allocatable as all other range trees use per TXG
	* views of their content.
	*/
	msp->ms_condensing = B_TRUE;

	mutex_exit(&msp->ms_lock);
	uint64_t object = space_map_object(msp->ms_sm);
	space_map_truncate(sm,
	spa_feature_is_enabled(spa, SPA_FEATURE_LOG_SPACEMAP) ?
	zfs_metaslab_sm_blksz_with_log : zfs_metaslab_sm_blksz_no_log, tx);

	/*
	* space_map_truncate() may have reallocated the spacemap object.
	* If so, update the vdev_ms_array.
	*/
	if (space_map_object(msp->ms_sm) != object) {
	object = space_map_object(msp->ms_sm);
	dmu_write(spa->spa_meta_objset,
	msp->ms_group->mg_vd->vdev_ms_array, sizeof (uint64_t) *
	msp->ms_id, sizeof (uint64_t), &object, tx);
	}

	/*
	* Note:
	* When the log space map feature is enabled, each space map will
	* always have ALLOCS followed by FREES for each sync pass. This is
	* typically true even when the log space map feature is disabled,
	* except from the case where a metaslab goes through metaslab_sync()
	* and gets condensed. In that case the metaslab's space map will have
	* ALLOCS followed by FREES (due to condensing) followed by ALLOCS
	* followed by FREES (due to space_map_write() in metaslab_sync()) for
	* sync pass 1.
	*/
	range_tree_t *tmp_tree = range_tree_create(NULL, type, NULL, start,
	shift);
	range_tree_add(tmp_tree, msp->ms_start, msp->ms_size);
	space_map_write(sm, tmp_tree, SM_ALLOC, SM_NO_VDEVID, tx);
	space_map_write(sm, msp->ms_allocatable, SM_FREE, SM_NO_VDEVID, tx);
	space_map_write(sm, condense_tree, SM_FREE, SM_NO_VDEVID, tx);

	range_tree_vacate(condense_tree, NULL, NULL);
	range_tree_destroy(condense_tree);
	range_tree_vacate(tmp_tree, NULL, NULL);
	range_tree_destroy(tmp_tree);
	mutex_enter(&msp->ms_lock);

	msp->ms_condensing = B_FALSE;
	metaslab_flush_update(msp, tx);
	}

	/*
	* Called when the metaslab has been flushed (its own spacemap now reflects
	* all the contents of the pool-wide spacemap log). Updates the metaslab's
	* metadata and any pool-wide related log space map data (e.g. summary,
	* obsolete logs, etc..) to reflect that.
	*/
	static void
	metaslab_flush_update(metaslab_t msp, dmu_tx_t tx)
	{
	metaslab_group_t *mg = msp->ms_group;
	spa_t *spa = mg->mg_vd->vdev_spa;

	ASSERT(MUTEX_HELD(&msp->ms_lock));

	ASSERT3U(spa_sync_pass(spa), ==, 1);
	ASSERT(range_tree_is_empty(msp->ms_unflushed_allocs));
	ASSERT(range_tree_is_empty(msp->ms_unflushed_frees));

	/*
	* Just because a metaslab got flushed, that doesn't mean that
	* it will pass through metaslab_sync_done(). Thus, make sure to
	* update ms_synced_length here in case it doesn't.
	*/
	msp->ms_synced_length = space_map_length(msp->ms_sm);

	/*
	* We may end up here from metaslab_condense() without the
	* feature being active. In that case this is a no-op.
	*/
	if (!spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP))
	return;

	ASSERT(spa_syncing_log_sm(spa) != NULL);
	ASSERT(msp->ms_sm != NULL);
	ASSERT(metaslab_unflushed_txg(msp) != 0);
	ASSERT3P(avl_find(&spa->spa_metaslabs_by_flushed, msp, NULL), ==, msp);

	VERIFY3U(tx->tx_txg, <=, spa_final_dirty_txg(spa));

	/* update metaslab's position in our flushing tree */
	uint64_t ms_prev_flushed_txg = metaslab_unflushed_txg(msp);
	mutex_enter(&spa->spa_flushed_ms_lock);
	avl_remove(&spa->spa_metaslabs_by_flushed, msp);
	metaslab_set_unflushed_txg(msp, spa_syncing_txg(spa), tx);
	avl_add(&spa->spa_metaslabs_by_flushed, msp);
	mutex_exit(&spa->spa_flushed_ms_lock);

	/* update metaslab counts of spa_log_sm_t nodes */
	spa_log_sm_decrement_mscount(spa, ms_prev_flushed_txg);
	spa_log_sm_increment_current_mscount(spa);

	/* cleanup obsolete logs if any */
	uint64_t log_blocks_before = spa_log_sm_nblocks(spa);
	spa_cleanup_old_sm_logs(spa, tx);
	uint64_t log_blocks_after = spa_log_sm_nblocks(spa);
	VERIFY3U(log_blocks_after, <=, log_blocks_before);

	/* update log space map summary */
	uint64_t blocks_gone = log_blocks_before - log_blocks_after;
	spa_log_summary_add_flushed_metaslab(spa);
	spa_log_summary_decrement_mscount(spa, ms_prev_flushed_txg);
	spa_log_summary_decrement_blkcount(spa, blocks_gone);
	}

	boolean_t
	metaslab_flush(metaslab_t msp, dmu_tx_t tx)
	{
	spa_t *spa = msp->ms_group->mg_vd->vdev_spa;

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	ASSERT3U(spa_sync_pass(spa), ==, 1);
	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP));

	ASSERT(msp->ms_sm != NULL);
	ASSERT(metaslab_unflushed_txg(msp) != 0);
	ASSERT(avl_find(&spa->spa_metaslabs_by_flushed, msp, NULL) != NULL);

	/*
	* There is nothing wrong with flushing the same metaslab twice, as
	* this codepath should work on that case. However, the current
	* flushing scheme makes sure to avoid this situation as we would be
	* making all these calls without having anything meaningful to write
	* to disk. We assert this behavior here.
	*/
	ASSERT3U(metaslab_unflushed_txg(msp), <, dmu_tx_get_txg(tx));

	/*
	* We can not flush while loading, because then we would
	* not load the ms_unflushed_{allocs,frees}.
	*/
	if (msp->ms_loading)
	return (B_FALSE);

	metaslab_verify_space(msp, dmu_tx_get_txg(tx));
	metaslab_verify_weight_and_frag(msp);

	/*
	* Metaslab condensing is effectively flushing. Therefore if the
	* metaslab can be condensed we can just condense it instead of
	* flushing it.
	*
	* Note that metaslab_condense() does call metaslab_flush_update()
	* so we can just return immediately after condensing. We also
	* don't need to care about setting ms_flushing or broadcasting
	* ms_flush_cv, even if we temporarily drop the ms_lock in
	* metaslab_condense(), as the metaslab is already loaded.
	*/
	if (msp->ms_loaded && metaslab_should_condense(msp)) {
	metaslab_group_t *mg = msp->ms_group;

	/*
	* For all histogram operations below refer to the
	* comments of metaslab_sync() where we follow a
	* similar procedure.
	*/
	metaslab_group_histogram_verify(mg);
	metaslab_class_histogram_verify(mg->mg_class);
	metaslab_group_histogram_remove(mg, msp);

	metaslab_condense(msp, tx);

	space_map_histogram_clear(msp->ms_sm);
	space_map_histogram_add(msp->ms_sm, msp->ms_allocatable, tx);
	ASSERT(range_tree_is_empty(msp->ms_freed));
	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	space_map_histogram_add(msp->ms_sm,
	msp->ms_defer[t], tx);
	}
	metaslab_aux_histograms_update(msp);

	metaslab_group_histogram_add(mg, msp);
	metaslab_group_histogram_verify(mg);
	metaslab_class_histogram_verify(mg->mg_class);

	metaslab_verify_space(msp, dmu_tx_get_txg(tx));

	/*
	* Since we recreated the histogram (and potentially
	* the ms_sm too while condensing) ensure that the
	* weight is updated too because we are not guaranteed
	* that this metaslab is dirty and will go through
	* metaslab_sync_done().
	*/
	metaslab_recalculate_weight_and_sort(msp);
	return (B_TRUE);
	}

	msp->ms_flushing = B_TRUE;
	uint64_t sm_len_before = space_map_length(msp->ms_sm);

	mutex_exit(&msp->ms_lock);
	space_map_write(msp->ms_sm, msp->ms_unflushed_allocs, SM_ALLOC,
	SM_NO_VDEVID, tx);
	space_map_write(msp->ms_sm, msp->ms_unflushed_frees, SM_FREE,
	SM_NO_VDEVID, tx);
	mutex_enter(&msp->ms_lock);

	uint64_t sm_len_after = space_map_length(msp->ms_sm);
	if (zfs_flags & ZFS_DEBUG_LOG_SPACEMAP) {
	zfs_dbgmsg("flushing: txg %llu, spa %s, vdev_id %llu, "
	"ms_id %llu, unflushed_allocs %llu, unflushed_frees %llu, "
	"appended %llu bytes", dmu_tx_get_txg(tx), spa_name(spa),
	msp->ms_group->mg_vd->vdev_id, msp->ms_id,
	range_tree_space(msp->ms_unflushed_allocs),
	range_tree_space(msp->ms_unflushed_frees),
	(sm_len_after - sm_len_before));
	}

	ASSERT3U(spa->spa_unflushed_stats.sus_memused, >=,
	metaslab_unflushed_changes_memused(msp));
	spa->spa_unflushed_stats.sus_memused -=
	metaslab_unflushed_changes_memused(msp);
	range_tree_vacate(msp->ms_unflushed_allocs, NULL, NULL);
	range_tree_vacate(msp->ms_unflushed_frees, NULL, NULL);

	metaslab_verify_space(msp, dmu_tx_get_txg(tx));
	metaslab_verify_weight_and_frag(msp);

	metaslab_flush_update(msp, tx);

	metaslab_verify_space(msp, dmu_tx_get_txg(tx));
	metaslab_verify_weight_and_frag(msp);

	msp->ms_flushing = B_FALSE;
	cv_broadcast(&msp->ms_flush_cv);
	return (B_TRUE);
	}

	/*
	* Write a metaslab to disk in the context of the specified transaction group.
	*/
	void
	metaslab_sync(metaslab_t *msp, uint64_t txg)
	{
	metaslab_group_t *mg = msp->ms_group;
	vdev_t *vd = mg->mg_vd;
	spa_t *spa = vd->vdev_spa;
	objset_t *mos = spa_meta_objset(spa);
	range_tree_t *alloctree = msp->ms_allocating[txg & TXG_MASK];
	dmu_tx_t *tx;

	ASSERT(!vd->vdev_ishole);

	/*
	* This metaslab has just been added so there's no work to do now.
	*/
	if (msp->ms_freeing == NULL) {
	ASSERT3P(alloctree, ==, NULL);
	return;
	}

	ASSERT3P(alloctree, !=, NULL);
	ASSERT3P(msp->ms_freeing, !=, NULL);
	ASSERT3P(msp->ms_freed, !=, NULL);
	ASSERT3P(msp->ms_checkpointing, !=, NULL);
	ASSERT3P(msp->ms_trim, !=, NULL);

	/*
	* Normally, we don't want to process a metaslab if there are no
	* allocations or frees to perform. However, if the metaslab is being
	* forced to condense, it's loaded and we're not beyond the final
	* dirty txg, we need to let it through. Not condensing beyond the
	* final dirty txg prevents an issue where metaslabs that need to be
	* condensed but were loaded for other reasons could cause a panic
	* here. By only checking the txg in that branch of the conditional,
	* we preserve the utility of the VERIFY statements in all other
	* cases.
	*/
	if (range_tree_is_empty(alloctree) &&
	range_tree_is_empty(msp->ms_freeing) &&
	range_tree_is_empty(msp->ms_checkpointing) &&
	!(msp->ms_loaded && msp->ms_condense_wanted &&
	txg <= spa_final_dirty_txg(spa)))
	return;


	VERIFY3U(txg, <=, spa_final_dirty_txg(spa));

	/*
	* The only state that can actually be changing concurrently
	* with metaslab_sync() is the metaslab's ms_allocatable. No
	* other thread can be modifying this txg's alloc, freeing,
	* freed, or space_map_phys_t. We drop ms_lock whenever we
	* could call into the DMU, because the DMU can call down to
	* us (e.g. via zio_free()) at any time.
	*
	* The spa_vdev_remove_thread() can be reading metaslab state
	* concurrently, and it is locked out by the ms_sync_lock.
	* Note that the ms_lock is insufficient for this, because it
	* is dropped by space_map_write().
	*/
	tx = dmu_tx_create_assigned(spa_get_dsl(spa), txg);

	/*
	* Generate a log space map if one doesn't exist already.
	*/
	spa_generate_syncing_log_sm(spa, tx);

	if (msp->ms_sm == NULL) {
	uint64_t new_object = space_map_alloc(mos,
	spa_feature_is_enabled(spa, SPA_FEATURE_LOG_SPACEMAP) ?
	zfs_metaslab_sm_blksz_with_log :
	zfs_metaslab_sm_blksz_no_log, tx);
	VERIFY3U(new_object, !=, 0);

	dmu_write(mos, vd->vdev_ms_array, sizeof (uint64_t) *
	msp->ms_id, sizeof (uint64_t), &new_object, tx);

	VERIFY0(space_map_open(&msp->ms_sm, mos, new_object,
	msp->ms_start, msp->ms_size, vd->vdev_ashift));
	ASSERT(msp->ms_sm != NULL);

	ASSERT(range_tree_is_empty(msp->ms_unflushed_allocs));
	ASSERT(range_tree_is_empty(msp->ms_unflushed_frees));
	ASSERT0(metaslab_allocated_space(msp));
	}

	if (metaslab_unflushed_txg(msp) == 0 &&
	spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP)) {
	ASSERT(spa_syncing_log_sm(spa) != NULL);

	metaslab_set_unflushed_txg(msp, spa_syncing_txg(spa), tx);
	spa_log_sm_increment_current_mscount(spa);
	spa_log_summary_add_flushed_metaslab(spa);

	ASSERT(msp->ms_sm != NULL);
	mutex_enter(&spa->spa_flushed_ms_lock);
	avl_add(&spa->spa_metaslabs_by_flushed, msp);
	mutex_exit(&spa->spa_flushed_ms_lock);

	ASSERT(range_tree_is_empty(msp->ms_unflushed_allocs));
	ASSERT(range_tree_is_empty(msp->ms_unflushed_frees));
	}

	if (!range_tree_is_empty(msp->ms_checkpointing) &&
	vd->vdev_checkpoint_sm == NULL) {
	ASSERT(spa_has_checkpoint(spa));

	uint64_t new_object = space_map_alloc(mos,
	zfs_vdev_standard_sm_blksz, tx);
	VERIFY3U(new_object, !=, 0);

	VERIFY0(space_map_open(&vd->vdev_checkpoint_sm,
	mos, new_object, 0, vd->vdev_asize, vd->vdev_ashift));
	ASSERT3P(vd->vdev_checkpoint_sm, !=, NULL);

	/*
	* We save the space map object as an entry in vdev_top_zap
	* so it can be retrieved when the pool is reopened after an
	* export or through zdb.
	*/
	VERIFY0(zap_add(vd->vdev_spa->spa_meta_objset,
	vd->vdev_top_zap, VDEV_TOP_ZAP_POOL_CHECKPOINT_SM,
	sizeof (new_object), 1, &new_object, tx));
	}

	mutex_enter(&msp->ms_sync_lock);
	mutex_enter(&msp->ms_lock);

	/*
	* Note: metaslab_condense() clears the space map's histogram.
	* Therefore we must verify and remove this histogram before
	* condensing.
	*/
	metaslab_group_histogram_verify(mg);
	metaslab_class_histogram_verify(mg->mg_class);
	metaslab_group_histogram_remove(mg, msp);

	if (spa->spa_sync_pass == 1 && msp->ms_loaded &&
	metaslab_should_condense(msp))
	metaslab_condense(msp, tx);

	/*
	* We'll be going to disk to sync our space accounting, thus we
	* drop the ms_lock during that time so allocations coming from
	* open-context (ZIL) for future TXGs do not block.
	*/
	mutex_exit(&msp->ms_lock);
	space_map_t *log_sm = spa_syncing_log_sm(spa);
	if (log_sm != NULL) {
	ASSERT(spa_feature_is_enabled(spa, SPA_FEATURE_LOG_SPACEMAP));

	space_map_write(log_sm, alloctree, SM_ALLOC,
	vd->vdev_id, tx);
	space_map_write(log_sm, msp->ms_freeing, SM_FREE,
	vd->vdev_id, tx);
	mutex_enter(&msp->ms_lock);

	ASSERT3U(spa->spa_unflushed_stats.sus_memused, >=,
	metaslab_unflushed_changes_memused(msp));
	spa->spa_unflushed_stats.sus_memused -=
	metaslab_unflushed_changes_memused(msp);
	range_tree_remove_xor_add(alloctree,
	msp->ms_unflushed_frees, msp->ms_unflushed_allocs);
	range_tree_remove_xor_add(msp->ms_freeing,
	msp->ms_unflushed_allocs, msp->ms_unflushed_frees);
	spa->spa_unflushed_stats.sus_memused +=
	metaslab_unflushed_changes_memused(msp);
	} else {
	ASSERT(!spa_feature_is_enabled(spa, SPA_FEATURE_LOG_SPACEMAP));

	space_map_write(msp->ms_sm, alloctree, SM_ALLOC,
	SM_NO_VDEVID, tx);
	space_map_write(msp->ms_sm, msp->ms_freeing, SM_FREE,
	SM_NO_VDEVID, tx);
	mutex_enter(&msp->ms_lock);
	}

	msp->ms_allocated_space += range_tree_space(alloctree);
	ASSERT3U(msp->ms_allocated_space, >=,
	range_tree_space(msp->ms_freeing));
	msp->ms_allocated_space -= range_tree_space(msp->ms_freeing);

	if (!range_tree_is_empty(msp->ms_checkpointing)) {
	ASSERT(spa_has_checkpoint(spa));
	ASSERT3P(vd->vdev_checkpoint_sm, !=, NULL);

	/*
	* Since we are doing writes to disk and the ms_checkpointing
	* tree won't be changing during that time, we drop the
	* ms_lock while writing to the checkpoint space map, for the
	* same reason mentioned above.
	*/
	mutex_exit(&msp->ms_lock);
	space_map_write(vd->vdev_checkpoint_sm,
	msp->ms_checkpointing, SM_FREE, SM_NO_VDEVID, tx);
	mutex_enter(&msp->ms_lock);

	spa->spa_checkpoint_info.sci_dspace +=
	range_tree_space(msp->ms_checkpointing);
	vd->vdev_stat.vs_checkpoint_space +=
	range_tree_space(msp->ms_checkpointing);
	ASSERT3U(vd->vdev_stat.vs_checkpoint_space, ==,
	-space_map_allocated(vd->vdev_checkpoint_sm));

	range_tree_vacate(msp->ms_checkpointing, NULL, NULL);
	}

	if (msp->ms_loaded) {
	/*
	* When the space map is loaded, we have an accurate
	* histogram in the range tree. This gives us an opportunity
	* to bring the space map's histogram up-to-date so we clear
	* it first before updating it.
	*/
	space_map_histogram_clear(msp->ms_sm);
	space_map_histogram_add(msp->ms_sm, msp->ms_allocatable, tx);

	/*
	* Since we've cleared the histogram we need to add back
	* any free space that has already been processed, plus
	* any deferred space. This allows the on-disk histogram
	* to accurately reflect all free space even if some space
	* is not yet available for allocation (i.e. deferred).
	*/
	space_map_histogram_add(msp->ms_sm, msp->ms_freed, tx);

	/*
	* Add back any deferred free space that has not been
	* added back into the in-core free tree yet. This will
	* ensure that we don't end up with a space map histogram
	* that is completely empty unless the metaslab is fully
	* allocated.
	*/
	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	space_map_histogram_add(msp->ms_sm,
	msp->ms_defer[t], tx);
	}
	}

	/*
	* Always add the free space from this sync pass to the space
	* map histogram. We want to make sure that the on-disk histogram
	* accounts for all free space. If the space map is not loaded,
	* then we will lose some accuracy but will correct it the next
	* time we load the space map.
	*/
	space_map_histogram_add(msp->ms_sm, msp->ms_freeing, tx);
	metaslab_aux_histograms_update(msp);

	metaslab_group_histogram_add(mg, msp);
	metaslab_group_histogram_verify(mg);
	metaslab_class_histogram_verify(mg->mg_class);

	/*
	* For sync pass 1, we avoid traversing this txg's free range tree
	* and instead will just swap the pointers for freeing and freed.
	* We can safely do this since the freed_tree is guaranteed to be
	* empty on the initial pass.
	*
	* Keep in mind that even if we are currently using a log spacemap
	* we want current frees to end up in the ms_allocatable (but not
	* get appended to the ms_sm) so their ranges can be reused as usual.
	*/
	if (spa_sync_pass(spa) == 1) {
	range_tree_swap(&msp->ms_freeing, &msp->ms_freed);
	ASSERT0(msp->ms_allocated_this_txg);
	} else {
	range_tree_vacate(msp->ms_freeing,
	range_tree_add, msp->ms_freed);
	}
	msp->ms_allocated_this_txg += range_tree_space(alloctree);
	range_tree_vacate(alloctree, NULL, NULL);

	ASSERT0(range_tree_space(msp->ms_allocating[txg & TXG_MASK]));
	ASSERT0(range_tree_space(msp->ms_allocating[TXG_CLEAN(txg)
	& TXG_MASK]));
	ASSERT0(range_tree_space(msp->ms_freeing));
	ASSERT0(range_tree_space(msp->ms_checkpointing));

	mutex_exit(&msp->ms_lock);

	/*
	* Verify that the space map object ID has been recorded in the
	* vdev_ms_array.
	*/
	uint64_t object;
	VERIFY0(dmu_read(mos, vd->vdev_ms_array,
	msp->ms_id * sizeof (uint64_t), sizeof (uint64_t), &object, 0));
	VERIFY3U(object, ==, space_map_object(msp->ms_sm));

	mutex_exit(&msp->ms_sync_lock);
	dmu_tx_commit(tx);
	}

	static void
	metaslab_evict(metaslab_t *msp, uint64_t txg)
	{
	if (!msp->ms_loaded \|\| msp->ms_disabled != 0)
	return;

	for (int t = 1; t < TXG_CONCURRENT_STATES; t++) {
	VERIFY0(range_tree_space(
	msp->ms_allocating[(txg + t) & TXG_MASK]));
	}
	if (msp->ms_allocator != -1)
	metaslab_passivate(msp, msp->ms_weight & ~METASLAB_ACTIVE_MASK);

	if (!metaslab_debug_unload)
	metaslab_unload(msp);
	}

	/*
	* Called after a transaction group has completely synced to mark
	* all of the metaslab's free space as usable.
	*/
	void
	metaslab_sync_done(metaslab_t *msp, uint64_t txg)
	{
	metaslab_group_t *mg = msp->ms_group;
	vdev_t *vd = mg->mg_vd;
	spa_t *spa = vd->vdev_spa;
	range_tree_t **defer_tree;
	int64_t alloc_delta, defer_delta;
	boolean_t defer_allowed = B_TRUE;

	ASSERT(!vd->vdev_ishole);

	mutex_enter(&msp->ms_lock);

	/*
	* If this metaslab is just becoming available, initialize its
	* range trees and add its capacity to the vdev.
	*/
	if (msp->ms_freed == NULL) {
	range_seg_type_t type;
	uint64_t shift, start;
	type = metaslab_calculate_range_tree_type(vd, msp, &start,
	&shift);

	for (int t = 0; t < TXG_SIZE; t++) {
	ASSERT(msp->ms_allocating[t] == NULL);

	msp->ms_allocating[t] = range_tree_create(NULL, type,
	NULL, start, shift);
	}

	ASSERT3P(msp->ms_freeing, ==, NULL);
	msp->ms_freeing = range_tree_create(NULL, type, NULL, start,
	shift);

	ASSERT3P(msp->ms_freed, ==, NULL);
	msp->ms_freed = range_tree_create(NULL, type, NULL, start,
	shift);

	for (int t = 0; t < TXG_DEFER_SIZE; t++) {
	ASSERT3P(msp->ms_defer[t], ==, NULL);
	msp->ms_defer[t] = range_tree_create(NULL, type, NULL,
	start, shift);
	}

	ASSERT3P(msp->ms_checkpointing, ==, NULL);
	msp->ms_checkpointing = range_tree_create(NULL, type, NULL,
	start, shift);

	ASSERT3P(msp->ms_unflushed_allocs, ==, NULL);
	msp->ms_unflushed_allocs = range_tree_create(NULL, type, NULL,
	start, shift);

	metaslab_rt_arg_t mrap = kmem_zalloc(sizeof (mrap), KM_SLEEP);
	mrap->mra_bt = &msp->ms_unflushed_frees_by_size;
	mrap->mra_floor_shift = metaslab_by_size_min_shift;
	ASSERT3P(msp->ms_unflushed_frees, ==, NULL);
	msp->ms_unflushed_frees = range_tree_create(&metaslab_rt_ops,
	type, mrap, start, shift);

	metaslab_space_update(vd, mg->mg_class, 0, 0, msp->ms_size);
	}
	ASSERT0(range_tree_space(msp->ms_freeing));
	ASSERT0(range_tree_space(msp->ms_checkpointing));

	defer_tree = &msp->ms_defer[txg % TXG_DEFER_SIZE];

	uint64_t free_space = metaslab_class_get_space(spa_normal_class(spa)) -
	metaslab_class_get_alloc(spa_normal_class(spa));
	if (free_space <= spa_get_slop_space(spa) \|\| vd->vdev_removing) {
	defer_allowed = B_FALSE;
	}

	defer_delta = 0;
	alloc_delta = msp->ms_allocated_this_txg -
	range_tree_space(msp->ms_freed);

	if (defer_allowed) {
	defer_delta = range_tree_space(msp->ms_freed) -
	range_tree_space(*defer_tree);
	} else {
	defer_delta -= range_tree_space(*defer_tree);
	}
	metaslab_space_update(vd, mg->mg_class, alloc_delta + defer_delta,
	defer_delta, 0);

	if (spa_syncing_log_sm(spa) == NULL) {
	/*
	* If there's a metaslab_load() in progress and we don't have
	* a log space map, it means that we probably wrote to the
	* metaslab's space map. If this is the case, we need to
	* make sure that we wait for the load to complete so that we
	* have a consistent view at the in-core side of the metaslab.
	*/
	metaslab_load_wait(msp);
	} else {
	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP));
	}

	/*
	* When auto-trimming is enabled, free ranges which are added to
	* ms_allocatable are also be added to ms_trim. The ms_trim tree is
	* periodically consumed by the vdev_autotrim_thread() which issues
	* trims for all ranges and then vacates the tree. The ms_trim tree
	* can be discarded at any time with the sole consequence of recent
	* frees not being trimmed.
	*/
	if (spa_get_autotrim(spa) == SPA_AUTOTRIM_ON) {
	range_tree_walk(*defer_tree, range_tree_add, msp->ms_trim);
	if (!defer_allowed) {
	range_tree_walk(msp->ms_freed, range_tree_add,
	msp->ms_trim);
	}
	} else {
	range_tree_vacate(msp->ms_trim, NULL, NULL);
	}

	/*
	* Move the frees from the defer_tree back to the free
	* range tree (if it's loaded). Swap the freed_tree and
	* the defer_tree -- this is safe to do because we've
	* just emptied out the defer_tree.
	*/
	range_tree_vacate(*defer_tree,
	msp->ms_loaded ? range_tree_add : NULL, msp->ms_allocatable);
	if (defer_allowed) {
	range_tree_swap(&msp->ms_freed, defer_tree);
	} else {
	range_tree_vacate(msp->ms_freed,
	msp->ms_loaded ? range_tree_add : NULL,
	msp->ms_allocatable);
	}

	msp->ms_synced_length = space_map_length(msp->ms_sm);

	msp->ms_deferspace += defer_delta;
	ASSERT3S(msp->ms_deferspace, >=, 0);
	ASSERT3S(msp->ms_deferspace, <=, msp->ms_size);
	if (msp->ms_deferspace != 0) {
	/*
	* Keep syncing this metaslab until all deferred frees
	* are back in circulation.
	*/
	vdev_dirty(vd, VDD_METASLAB, msp, txg + 1);
	}
	metaslab_aux_histograms_update_done(msp, defer_allowed);

	if (msp->ms_new) {
	msp->ms_new = B_FALSE;
	mutex_enter(&mg->mg_lock);
	mg->mg_ms_ready++;
	mutex_exit(&mg->mg_lock);
	}

	/*
	* Re-sort metaslab within its group now that we've adjusted
	* its allocatable space.
	*/
	metaslab_recalculate_weight_and_sort(msp);

	ASSERT0(range_tree_space(msp->ms_allocating[txg & TXG_MASK]));
	ASSERT0(range_tree_space(msp->ms_freeing));
	ASSERT0(range_tree_space(msp->ms_freed));
	ASSERT0(range_tree_space(msp->ms_checkpointing));
	msp->ms_allocating_total -= msp->ms_allocated_this_txg;
	msp->ms_allocated_this_txg = 0;
	mutex_exit(&msp->ms_lock);
	}

	void
	metaslab_sync_reassess(metaslab_group_t *mg)
	{
	spa_t *spa = mg->mg_class->mc_spa;

	spa_config_enter(spa, SCL_ALLOC, FTAG, RW_READER);
	metaslab_group_alloc_update(mg);
	mg->mg_fragmentation = metaslab_group_fragmentation(mg);

	/*
	* Preload the next potential metaslabs but only on active
	* metaslab groups. We can get into a state where the metaslab
	* is no longer active since we dirty metaslabs as we remove a
	* a device, thus potentially making the metaslab group eligible
	* for preloading.
	*/
	if (mg->mg_activation_count > 0) {
	metaslab_group_preload(mg);
	}
	spa_config_exit(spa, SCL_ALLOC, FTAG);
	}

	/*
	* When writing a ditto block (i.e. more than one DVA for a given BP) on
	* the same vdev as an existing DVA of this BP, then try to allocate it
	* on a different metaslab than existing DVAs (i.e. a unique metaslab).
	*/
	static boolean_t
	metaslab_is_unique(metaslab_t msp, dva_t dva)
	{
	uint64_t dva_ms_id;

	if (DVA_GET_ASIZE(dva) == 0)
	return (B_TRUE);

	if (msp->ms_group->mg_vd->vdev_id != DVA_GET_VDEV(dva))
	return (B_TRUE);

	dva_ms_id = DVA_GET_OFFSET(dva) >> msp->ms_group->mg_vd->vdev_ms_shift;

	return (msp->ms_id != dva_ms_id);
	}

	/*
	* ==========================================================================
	* Metaslab allocation tracing facility
	* ==========================================================================
	*/
	#ifdef _METASLAB_TRACING

	/*
	* Add an allocation trace element to the allocation tracing list.
	*/
	static void
	metaslab_trace_add(zio_alloc_list_t zal, metaslab_group_t mg,
	metaslab_t *msp, uint64_t psize, uint32_t dva_id, uint64_t offset,
	int allocator)
	{
	metaslab_alloc_trace_t *mat;

	if (!metaslab_trace_enabled)
	return;

	/*
	* When the tracing list reaches its maximum we remove
	* the second element in the list before adding a new one.
	* By removing the second element we preserve the original
	* entry as a clue to what allocations steps have already been
	* performed.
	*/
	if (zal->zal_size == metaslab_trace_max_entries) {
	metaslab_alloc_trace_t *mat_next;
	#ifdef ZFS_DEBUG
	panic("too many entries in allocation list");
	#endif
	METASLABSTAT_BUMP(metaslabstat_trace_over_limit);
	zal->zal_size--;
	mat_next = list_next(&zal->zal_list, list_head(&zal->zal_list));
	list_remove(&zal->zal_list, mat_next);
	kmem_cache_free(metaslab_alloc_trace_cache, mat_next);
	}

	mat = kmem_cache_alloc(metaslab_alloc_trace_cache, KM_SLEEP);
	list_link_init(&mat->mat_list_node);
	mat->mat_mg = mg;
	mat->mat_msp = msp;
	mat->mat_size = psize;
	mat->mat_dva_id = dva_id;
	mat->mat_offset = offset;
	mat->mat_weight = 0;
	mat->mat_allocator = allocator;

	if (msp != NULL)
	mat->mat_weight = msp->ms_weight;

	/*
	* The list is part of the zio so locking is not required. Only
	* a single thread will perform allocations for a given zio.
	*/
	list_insert_tail(&zal->zal_list, mat);
	zal->zal_size++;

	ASSERT3U(zal->zal_size, <=, metaslab_trace_max_entries);
	}

	void
	metaslab_trace_init(zio_alloc_list_t *zal)
	{
	list_create(&zal->zal_list, sizeof (metaslab_alloc_trace_t),
	offsetof(metaslab_alloc_trace_t, mat_list_node));
	zal->zal_size = 0;
	}

	void
	metaslab_trace_fini(zio_alloc_list_t *zal)
	{
	metaslab_alloc_trace_t *mat;

	while ((mat = list_remove_head(&zal->zal_list)) != NULL)
	kmem_cache_free(metaslab_alloc_trace_cache, mat);
	list_destroy(&zal->zal_list);
	zal->zal_size = 0;
	}
	#else

	#define metaslab_trace_add(zal, mg, msp, psize, id, off, alloc)

	void
	metaslab_trace_init(zio_alloc_list_t *zal)
	{
	}

	void
	metaslab_trace_fini(zio_alloc_list_t *zal)
	{
	}

	#endif /* _METASLAB_TRACING */

	/*
	* ==========================================================================
	* Metaslab block operations
	* ==========================================================================
	*/

	static void
	metaslab_group_alloc_increment(spa_t spa, uint64_t vdev, void tag, int flags,
	int allocator)
	{
	if (!(flags & METASLAB_ASYNC_ALLOC) \|\|
	(flags & METASLAB_DONT_THROTTLE))
	return;

	metaslab_group_t *mg = vdev_lookup_top(spa, vdev)->vdev_mg;
	if (!mg->mg_class->mc_alloc_throttle_enabled)
	return;

	metaslab_group_allocator_t *mga = &mg->mg_allocator[allocator];
	(void) zfs_refcount_add(&mga->mga_alloc_queue_depth, tag);
	}

	static void
	metaslab_group_increment_qdepth(metaslab_group_t *mg, int allocator)
	{
	metaslab_group_allocator_t *mga = &mg->mg_allocator[allocator];
	uint64_t max = mg->mg_max_alloc_queue_depth;
	uint64_t cur = mga->mga_cur_max_alloc_queue_depth;
	while (cur < max) {
	if (atomic_cas_64(&mga->mga_cur_max_alloc_queue_depth,
	cur, cur + 1) == cur) {
	atomic_inc_64(
	&mg->mg_class->mc_alloc_max_slots[allocator]);
	return;
	}
	cur = mga->mga_cur_max_alloc_queue_depth;
	}
	}

	void
	metaslab_group_alloc_decrement(spa_t spa, uint64_t vdev, void tag, int flags,
	int allocator, boolean_t io_complete)
	{
	if (!(flags & METASLAB_ASYNC_ALLOC) \|\|
	(flags & METASLAB_DONT_THROTTLE))
	return;

	metaslab_group_t *mg = vdev_lookup_top(spa, vdev)->vdev_mg;
	if (!mg->mg_class->mc_alloc_throttle_enabled)
	return;

	metaslab_group_allocator_t *mga = &mg->mg_allocator[allocator];
	(void) zfs_refcount_remove(&mga->mga_alloc_queue_depth, tag);
	if (io_complete)
	metaslab_group_increment_qdepth(mg, allocator);
	}

	void
	metaslab_group_alloc_verify(spa_t spa, const blkptr_t bp, void *tag,
	int allocator)
	{
	#ifdef ZFS_DEBUG
	const dva_t *dva = bp->blk_dva;
	int ndvas = BP_GET_NDVAS(bp);

	for (int d = 0; d < ndvas; d++) {
	uint64_t vdev = DVA_GET_VDEV(&dva[d]);
	metaslab_group_t *mg = vdev_lookup_top(spa, vdev)->vdev_mg;
	metaslab_group_allocator_t *mga = &mg->mg_allocator[allocator];
	VERIFY(zfs_refcount_not_held(&mga->mga_alloc_queue_depth, tag));
	}
	#endif
	}

	static uint64_t
	metaslab_block_alloc(metaslab_t *msp, uint64_t size, uint64_t txg)
	{
	uint64_t start;
	range_tree_t *rt = msp->ms_allocatable;
	metaslab_class_t *mc = msp->ms_group->mg_class;

	ASSERT(MUTEX_HELD(&msp->ms_lock));
	VERIFY(!msp->ms_condensing);
	VERIFY0(msp->ms_disabled);

	start = mc->mc_ops->msop_alloc(msp, size);
	if (start != -1ULL) {
	metaslab_group_t *mg = msp->ms_group;
	vdev_t *vd = mg->mg_vd;

	VERIFY0(P2PHASE(start, 1ULL << vd->vdev_ashift));
	VERIFY0(P2PHASE(size, 1ULL << vd->vdev_ashift));
	VERIFY3U(range_tree_space(rt) - size, <=, msp->ms_size);
	range_tree_remove(rt, start, size);
	range_tree_clear(msp->ms_trim, start, size);

	if (range_tree_is_empty(msp->ms_allocating[txg & TXG_MASK]))
	vdev_dirty(mg->mg_vd, VDD_METASLAB, msp, txg);

	range_tree_add(msp->ms_allocating[txg & TXG_MASK], start, size);
	msp->ms_allocating_total += size;

	/* Track the last successful allocation */
	msp->ms_alloc_txg = txg;
	metaslab_verify_space(msp, txg);
	}

	/*
	* Now that we've attempted the allocation we need to update the
	* metaslab's maximum block size since it may have changed.
	*/
	msp->ms_max_size = metaslab_largest_allocatable(msp);
	return (start);
	}

	/*
	* Find the metaslab with the highest weight that is less than what we've
	* already tried. In the common case, this means that we will examine each
	* metaslab at most once. Note that concurrent callers could reorder metaslabs
	* by activation/passivation once we have dropped the mg_lock. If a metaslab is
	* activated by another thread, and we fail to allocate from the metaslab we
	* have selected, we may not try the newly-activated metaslab, and instead
	* activate another metaslab. This is not optimal, but generally does not cause
	* any problems (a possible exception being if every metaslab is completely full
	* except for the newly-activated metaslab which we fail to examine).
	*/
	static metaslab_t *
	find_valid_metaslab(metaslab_group_t *mg, uint64_t activation_weight,
	dva_t *dva, int d, boolean_t want_unique, uint64_t asize, int allocator,
	boolean_t try_hard, zio_alloc_list_t zal, metaslab_t search,
	boolean_t *was_active)
	{
	avl_index_t idx;
	avl_tree_t *t = &mg->mg_metaslab_tree;
	metaslab_t *msp = avl_find(t, search, &idx);
	if (msp == NULL)
	msp = avl_nearest(t, idx, AVL_AFTER);

	for (; msp != NULL; msp = AVL_NEXT(t, msp)) {
	int i;
	if (!metaslab_should_allocate(msp, asize, try_hard)) {
	metaslab_trace_add(zal, mg, msp, asize, d,
	TRACE_TOO_SMALL, allocator);
	continue;
	}

	/*
	* If the selected metaslab is condensing or disabled,
	* skip it.
	*/
	if (msp->ms_condensing \|\| msp->ms_disabled > 0)
	continue;

	*was_active = msp->ms_allocator != -1;
	/*
	* If we're activating as primary, this is our first allocation
	* from this disk, so we don't need to check how close we are.
	* If the metaslab under consideration was already active,
	* we're getting desperate enough to steal another allocator's
	* metaslab, so we still don't care about distances.
	*/
	if (activation_weight == METASLAB_WEIGHT_PRIMARY \|\| *was_active)
	break;

	for (i = 0; i < d; i++) {
	if (want_unique &&
	!metaslab_is_unique(msp, &dva[i]))
	break; /* try another metaslab */
	}
	if (i == d)
	break;
	}

	if (msp != NULL) {
	search->ms_weight = msp->ms_weight;
	search->ms_start = msp->ms_start + 1;
	search->ms_allocator = msp->ms_allocator;
	search->ms_primary = msp->ms_primary;
	}
	return (msp);
	}

	static void
	metaslab_active_mask_verify(metaslab_t *msp)
	{
	ASSERT(MUTEX_HELD(&msp->ms_lock));

	if ((zfs_flags & ZFS_DEBUG_METASLAB_VERIFY) == 0)
	return;

	if ((msp->ms_weight & METASLAB_ACTIVE_MASK) == 0)
	return;

	if (msp->ms_weight & METASLAB_WEIGHT_PRIMARY) {
	VERIFY0(msp->ms_weight & METASLAB_WEIGHT_SECONDARY);
	VERIFY0(msp->ms_weight & METASLAB_WEIGHT_CLAIM);
	VERIFY3S(msp->ms_allocator, !=, -1);
	VERIFY(msp->ms_primary);
	return;
	}

	if (msp->ms_weight & METASLAB_WEIGHT_SECONDARY) {
	VERIFY0(msp->ms_weight & METASLAB_WEIGHT_PRIMARY);
	VERIFY0(msp->ms_weight & METASLAB_WEIGHT_CLAIM);
	VERIFY3S(msp->ms_allocator, !=, -1);
	VERIFY(!msp->ms_primary);
	return;
	}

	if (msp->ms_weight & METASLAB_WEIGHT_CLAIM) {
	VERIFY0(msp->ms_weight & METASLAB_WEIGHT_PRIMARY);
	VERIFY0(msp->ms_weight & METASLAB_WEIGHT_SECONDARY);
	VERIFY3S(msp->ms_allocator, ==, -1);
	return;
	}
	}

	/* ARGSUSED */
	static uint64_t
	metaslab_group_alloc_normal(metaslab_group_t mg, zio_alloc_list_t zal,
	uint64_t asize, uint64_t txg, boolean_t want_unique, dva_t *dva, int d,
	int allocator, boolean_t try_hard)
	{
	metaslab_t *msp = NULL;
	uint64_t offset = -1ULL;

	uint64_t activation_weight = METASLAB_WEIGHT_PRIMARY;
	for (int i = 0; i < d; i++) {
	if (activation_weight == METASLAB_WEIGHT_PRIMARY &&
	DVA_GET_VDEV(&dva[i]) == mg->mg_vd->vdev_id) {
	activation_weight = METASLAB_WEIGHT_SECONDARY;
	} else if (activation_weight == METASLAB_WEIGHT_SECONDARY &&
	DVA_GET_VDEV(&dva[i]) == mg->mg_vd->vdev_id) {
	activation_weight = METASLAB_WEIGHT_CLAIM;
	break;
	}
	}

	/*
	* If we don't have enough metaslabs active to fill the entire array, we
	* just use the 0th slot.
	*/
	if (mg->mg_ms_ready < mg->mg_allocators * 3)
	allocator = 0;
	metaslab_group_allocator_t *mga = &mg->mg_allocator[allocator];

	ASSERT3U(mg->mg_vd->vdev_ms_count, >=, 2);

	metaslab_t search = kmem_alloc(sizeof (search), KM_SLEEP);
	search->ms_weight = UINT64_MAX;
	search->ms_start = 0;
	/*
	* At the end of the metaslab tree are the already-active metaslabs,
	* first the primaries, then the secondaries. When we resume searching
	* through the tree, we need to consider ms_allocator and ms_primary so
	* we start in the location right after where we left off, and don't
	* accidentally loop forever considering the same metaslabs.
	*/
	search->ms_allocator = -1;
	search->ms_primary = B_TRUE;
	for (;;) {
	boolean_t was_active = B_FALSE;

	mutex_enter(&mg->mg_lock);

	if (activation_weight == METASLAB_WEIGHT_PRIMARY &&
	mga->mga_primary != NULL) {
	msp = mga->mga_primary;

	/*
	* Even though we don't hold the ms_lock for the
	* primary metaslab, those fields should not
	* change while we hold the mg_lock. Thus it is
	* safe to make assertions on them.
	*/
	ASSERT(msp->ms_primary);
	ASSERT3S(msp->ms_allocator, ==, allocator);
	ASSERT(msp->ms_loaded);

	was_active = B_TRUE;
	ASSERT(msp->ms_weight & METASLAB_ACTIVE_MASK);
	} else if (activation_weight == METASLAB_WEIGHT_SECONDARY &&
	mga->mga_secondary != NULL) {
	msp = mga->mga_secondary;

	/*
	* See comment above about the similar assertions
	* for the primary metaslab.
	*/
	ASSERT(!msp->ms_primary);
	ASSERT3S(msp->ms_allocator, ==, allocator);
	ASSERT(msp->ms_loaded);

	was_active = B_TRUE;
	ASSERT(msp->ms_weight & METASLAB_ACTIVE_MASK);
	} else {
	msp = find_valid_metaslab(mg, activation_weight, dva, d,
	want_unique, asize, allocator, try_hard, zal,
	search, &was_active);
	}

	mutex_exit(&mg->mg_lock);
	if (msp == NULL) {
	kmem_free(search, sizeof (*search));
	return (-1ULL);
	}
	mutex_enter(&msp->ms_lock);

	metaslab_active_mask_verify(msp);

	/*
	* This code is disabled out because of issues with
	* tracepoints in non-gpl kernel modules.
	*/
	#if 0
	DTRACE_PROBE3(ms__activation__attempt,
	metaslab_t *, msp, uint64_t, activation_weight,
	boolean_t, was_active);
	#endif

	/*
	* Ensure that the metaslab we have selected is still
	* capable of handling our request. It's possible that
	* another thread may have changed the weight while we
	* were blocked on the metaslab lock. We check the
	* active status first to see if we need to set_selected_txg
	* a new metaslab.
	*/
	if (was_active && !(msp->ms_weight & METASLAB_ACTIVE_MASK)) {
	ASSERT3S(msp->ms_allocator, ==, -1);
	mutex_exit(&msp->ms_lock);
	continue;
	}

	/*
	* If the metaslab was activated for another allocator
	* while we were waiting in the ms_lock above, or it's
	* a primary and we're seeking a secondary (or vice versa),
	* we go back and select a new metaslab.
	*/
	if (!was_active && (msp->ms_weight & METASLAB_ACTIVE_MASK) &&
	(msp->ms_allocator != -1) &&
	(msp->ms_allocator != allocator \|\| ((activation_weight ==
	METASLAB_WEIGHT_PRIMARY) != msp->ms_primary))) {
	ASSERT(msp->ms_loaded);
	ASSERT((msp->ms_weight & METASLAB_WEIGHT_CLAIM) \|\|
	msp->ms_allocator != -1);
	mutex_exit(&msp->ms_lock);
	continue;
	}

	/*
	* This metaslab was used for claiming regions allocated
	* by the ZIL during pool import. Once these regions are
	* claimed we don't need to keep the CLAIM bit set
	* anymore. Passivate this metaslab to zero its activation
	* mask.
	*/
	if (msp->ms_weight & METASLAB_WEIGHT_CLAIM &&
	activation_weight != METASLAB_WEIGHT_CLAIM) {
	ASSERT(msp->ms_loaded);
	ASSERT3S(msp->ms_allocator, ==, -1);
	metaslab_passivate(msp, msp->ms_weight &
	~METASLAB_WEIGHT_CLAIM);
	mutex_exit(&msp->ms_lock);
	continue;
	}

	metaslab_set_selected_txg(msp, txg);

	int activation_error =
	metaslab_activate(msp, allocator, activation_weight);
	metaslab_active_mask_verify(msp);

	/*
	* If the metaslab was activated by another thread for
	* another allocator or activation_weight (EBUSY), or it
	* failed because another metaslab was assigned as primary
	* for this allocator (EEXIST) we continue using this
	* metaslab for our allocation, rather than going on to a
	* worse metaslab (we waited for that metaslab to be loaded
	* after all).
	*
	* If the activation failed due to an I/O error or ENOSPC we
	* skip to the next metaslab.
	*/
	boolean_t activated;
	if (activation_error == 0) {
	activated = B_TRUE;
	} else if (activation_error == EBUSY \|\|
	activation_error == EEXIST) {
	activated = B_FALSE;
	} else {
	mutex_exit(&msp->ms_lock);
	continue;
	}
	ASSERT(msp->ms_loaded);

	/*
	* Now that we have the lock, recheck to see if we should
	* continue to use this metaslab for this allocation. The
	* the metaslab is now loaded so metaslab_should_allocate()
	* can accurately determine if the allocation attempt should
	* proceed.
	*/
	if (!metaslab_should_allocate(msp, asize, try_hard)) {
	/* Passivate this metaslab and select a new one. */
	metaslab_trace_add(zal, mg, msp, asize, d,
	TRACE_TOO_SMALL, allocator);
	goto next;
	}

	/*
	* If this metaslab is currently condensing then pick again
	* as we can't manipulate this metaslab until it's committed
	* to disk. If this metaslab is being initialized, we shouldn't
	* allocate from it since the allocated region might be
	* overwritten after allocation.
	*/
	if (msp->ms_condensing) {
	metaslab_trace_add(zal, mg, msp, asize, d,
	TRACE_CONDENSING, allocator);
	if (activated) {
	metaslab_passivate(msp, msp->ms_weight &
	~METASLAB_ACTIVE_MASK);
	}
	mutex_exit(&msp->ms_lock);
	continue;
	} else if (msp->ms_disabled > 0) {
	metaslab_trace_add(zal, mg, msp, asize, d,
	TRACE_DISABLED, allocator);
	if (activated) {
	metaslab_passivate(msp, msp->ms_weight &
	~METASLAB_ACTIVE_MASK);
	}
	mutex_exit(&msp->ms_lock);
	continue;
	}

	offset = metaslab_block_alloc(msp, asize, txg);
	metaslab_trace_add(zal, mg, msp, asize, d, offset, allocator);

	if (offset != -1ULL) {
	/* Proactively passivate the metaslab, if needed */
	if (activated)
	metaslab_segment_may_passivate(msp);
	break;
	}
	next:
	ASSERT(msp->ms_loaded);

	/*
	* This code is disabled out because of issues with
	* tracepoints in non-gpl kernel modules.
	*/
	#if 0
	DTRACE_PROBE2(ms__alloc__failure, metaslab_t *, msp,
	uint64_t, asize);
	#endif

	/*
	* We were unable to allocate from this metaslab so determine
	* a new weight for this metaslab. Now that we have loaded
	* the metaslab we can provide a better hint to the metaslab
	* selector.
	*
	* For space-based metaslabs, we use the maximum block size.
	* This information is only available when the metaslab
	* is loaded and is more accurate than the generic free
	* space weight that was calculated by metaslab_weight().
	* This information allows us to quickly compare the maximum
	* available allocation in the metaslab to the allocation
	* size being requested.
	*
	* For segment-based metaslabs, determine the new weight
	* based on the highest bucket in the range tree. We
	* explicitly use the loaded segment weight (i.e. the range
	* tree histogram) since it contains the space that is
	* currently available for allocation and is accurate
	* even within a sync pass.
	*/
	uint64_t weight;
	if (WEIGHT_IS_SPACEBASED(msp->ms_weight)) {
	weight = metaslab_largest_allocatable(msp);
	WEIGHT_SET_SPACEBASED(weight);
	} else {
	weight = metaslab_weight_from_range_tree(msp);
	}

	if (activated) {
	metaslab_passivate(msp, weight);
	} else {
	/*
	* For the case where we use the metaslab that is
	* active for another allocator we want to make
	* sure that we retain the activation mask.
	*
	* Note that we could attempt to use something like
	* metaslab_recalculate_weight_and_sort() that
	* retains the activation mask here. That function
	* uses metaslab_weight() to set the weight though
	* which is not as accurate as the calculations
	* above.
	*/
	weight \|= msp->ms_weight & METASLAB_ACTIVE_MASK;
	metaslab_group_sort(mg, msp, weight);
	}
	metaslab_active_mask_verify(msp);

	/*
	* We have just failed an allocation attempt, check
	* that metaslab_should_allocate() agrees. Otherwise,
	* we may end up in an infinite loop retrying the same
	* metaslab.
	*/
	ASSERT(!metaslab_should_allocate(msp, asize, try_hard));

	mutex_exit(&msp->ms_lock);
	}
	mutex_exit(&msp->ms_lock);
	kmem_free(search, sizeof (*search));
	return (offset);
	}

	static uint64_t
	metaslab_group_alloc(metaslab_group_t mg, zio_alloc_list_t zal,
	uint64_t asize, uint64_t txg, boolean_t want_unique, dva_t *dva, int d,
	int allocator, boolean_t try_hard)
	{
	uint64_t offset;
	ASSERT(mg->mg_initialized);

	offset = metaslab_group_alloc_normal(mg, zal, asize, txg, want_unique,
	dva, d, allocator, try_hard);

	mutex_enter(&mg->mg_lock);
	if (offset == -1ULL) {
	mg->mg_failed_allocations++;
	metaslab_trace_add(zal, mg, NULL, asize, d,
	TRACE_GROUP_FAILURE, allocator);
	if (asize == SPA_GANGBLOCKSIZE) {
	/*
	* This metaslab group was unable to allocate
	* the minimum gang block size so it must be out of
	* space. We must notify the allocation throttle
	* to start skipping allocation attempts to this
	* metaslab group until more space becomes available.
	* Note: this failure cannot be caused by the
	* allocation throttle since the allocation throttle
	* is only responsible for skipping devices and
	* not failing block allocations.
	*/
	mg->mg_no_free_space = B_TRUE;
	}
	}
	mg->mg_allocations++;
	mutex_exit(&mg->mg_lock);
	return (offset);
	}

	/*
	* Allocate a block for the specified i/o.
	*/
	int
	metaslab_alloc_dva(spa_t spa, metaslab_class_t mc, uint64_t psize,
	dva_t dva, int d, dva_t hintdva, uint64_t txg, int flags,
	zio_alloc_list_t *zal, int allocator)
	{
	metaslab_group_t mg, fast_mg, *rotor;
	vdev_t *vd;
	boolean_t try_hard = B_FALSE;

	ASSERT(!DVA_IS_VALID(&dva[d]));

	/*
	* For testing, make some blocks above a certain size be gang blocks.
	* This will result in more split blocks when using device removal,
	* and a large number of split blocks coupled with ztest-induced
	* damage can result in extremely long reconstruction times. This
	* will also test spilling from special to normal.
	*/
	if (psize >= metaslab_force_ganging && (spa_get_random(100) < 3)) {
	metaslab_trace_add(zal, NULL, NULL, psize, d, TRACE_FORCE_GANG,
	allocator);
	return (SET_ERROR(ENOSPC));
	}

	/*
	* Start at the rotor and loop through all mgs until we find something.
	* Note that there's no locking on mc_rotor or mc_aliquot because
	* nothing actually breaks if we miss a few updates -- we just won't
	* allocate quite as evenly. It all balances out over time.
	*
	* If we are doing ditto or log blocks, try to spread them across
	* consecutive vdevs. If we're forced to reuse a vdev before we've
	* allocated all of our ditto blocks, then try and spread them out on
	* that vdev as much as possible. If it turns out to not be possible,
	* gradually lower our standards until anything becomes acceptable.
	* Also, allocating on consecutive vdevs (as opposed to random vdevs)
	* gives us hope of containing our fault domains to something we're
	* able to reason about. Otherwise, any two top-level vdev failures
	* will guarantee the loss of data. With consecutive allocation,
	* only two adjacent top-level vdev failures will result in data loss.
	*
	* If we are doing gang blocks (hintdva is non-NULL), try to keep
	* ourselves on the same vdev as our gang block header. That
	* way, we can hope for locality in vdev_cache, plus it makes our
	* fault domains something tractable.
	*/
	if (hintdva) {
	vd = vdev_lookup_top(spa, DVA_GET_VDEV(&hintdva[d]));

	/*
	* It's possible the vdev we're using as the hint no
	* longer exists or its mg has been closed (e.g. by
	* device removal). Consult the rotor when
	* all else fails.
	*/
	if (vd != NULL && vd->vdev_mg != NULL) {
	mg = vd->vdev_mg;

	if (flags & METASLAB_HINTBP_AVOID &&
	mg->mg_next != NULL)
	mg = mg->mg_next;
	} else {
	mg = mc->mc_rotor;
	}
	} else if (d != 0) {
	vd = vdev_lookup_top(spa, DVA_GET_VDEV(&dva[d - 1]));
	mg = vd->vdev_mg->mg_next;
	} else if (flags & METASLAB_FASTWRITE) {
	mg = fast_mg = mc->mc_rotor;

	do {
	if (fast_mg->mg_vd->vdev_pending_fastwrite <
	mg->mg_vd->vdev_pending_fastwrite)
	mg = fast_mg;
	} while ((fast_mg = fast_mg->mg_next) != mc->mc_rotor);

	} else {
	ASSERT(mc->mc_rotor != NULL);
	mg = mc->mc_rotor;
	}

	/*
	* If the hint put us into the wrong metaslab class, or into a
	* metaslab group that has been passivated, just follow the rotor.
	*/
	if (mg->mg_class != mc \|\| mg->mg_activation_count <= 0)
	mg = mc->mc_rotor;

	rotor = mg;
	top:
	do {
	boolean_t allocatable;

	ASSERT(mg->mg_activation_count == 1);
	vd = mg->mg_vd;

	/*
	* Don't allocate from faulted devices.
	*/
	if (try_hard) {
	spa_config_enter(spa, SCL_ZIO, FTAG, RW_READER);
	allocatable = vdev_allocatable(vd);
	spa_config_exit(spa, SCL_ZIO, FTAG);
	} else {
	allocatable = vdev_allocatable(vd);
	}

	/*
	* Determine if the selected metaslab group is eligible
	* for allocations. If we're ganging then don't allow
	* this metaslab group to skip allocations since that would
	* inadvertently return ENOSPC and suspend the pool
	* even though space is still available.
	*/
	if (allocatable && !GANG_ALLOCATION(flags) && !try_hard) {
	allocatable = metaslab_group_allocatable(mg, rotor,
	psize, allocator, d);
	}

	if (!allocatable) {
	metaslab_trace_add(zal, mg, NULL, psize, d,
	TRACE_NOT_ALLOCATABLE, allocator);
	goto next;
	}

	ASSERT(mg->mg_initialized);

	/*
	* Avoid writing single-copy data to a failing,
	* non-redundant vdev, unless we've already tried all
	* other vdevs.
	*/
	if ((vd->vdev_stat.vs_write_errors > 0 \|\|
	vd->vdev_state < VDEV_STATE_HEALTHY) &&
	d == 0 && !try_hard && vd->vdev_children == 0) {
	metaslab_trace_add(zal, mg, NULL, psize, d,
	TRACE_VDEV_ERROR, allocator);
	goto next;
	}

	ASSERT(mg->mg_class == mc);

	uint64_t asize = vdev_psize_to_asize(vd, psize);
	ASSERT(P2PHASE(asize, 1ULL << vd->vdev_ashift) == 0);

	/*
	* If we don't need to try hard, then require that the
	* block be on a different metaslab from any other DVAs
	* in this BP (unique=true). If we are trying hard, then
	* allow any metaslab to be used (unique=false).
	*/
	uint64_t offset = metaslab_group_alloc(mg, zal, asize, txg,
	!try_hard, dva, d, allocator, try_hard);

	if (offset != -1ULL) {
	/*
	* If we've just selected this metaslab group,
	* figure out whether the corresponding vdev is
	* over- or under-used relative to the pool,
	* and set an allocation bias to even it out.
	*
	* Bias is also used to compensate for unequally
	* sized vdevs so that space is allocated fairly.
	*/
	if (mc->mc_aliquot == 0 && metaslab_bias_enabled) {
	vdev_stat_t *vs = &vd->vdev_stat;
	int64_t vs_free = vs->vs_space - vs->vs_alloc;
	int64_t mc_free = mc->mc_space - mc->mc_alloc;
	int64_t ratio;

	/*
	* Calculate how much more or less we should
	* try to allocate from this device during
	* this iteration around the rotor.
	*
	* This basically introduces a zero-centered
	* bias towards the devices with the most
	* free space, while compensating for vdev
	* size differences.
	*
	* Examples:
	* vdev V1 = 16M/128M
	* vdev V2 = 16M/128M
	* ratio(V1) = 100% ratio(V2) = 100%
	*
	* vdev V1 = 16M/128M
	* vdev V2 = 64M/128M
	* ratio(V1) = 127% ratio(V2) = 72%
	*
	* vdev V1 = 16M/128M
	* vdev V2 = 64M/512M
	* ratio(V1) = 40% ratio(V2) = 160%
	*/
	ratio = (vs_free * mc->mc_alloc_groups * 100) /
	(mc_free + 1);
	mg->mg_bias = ((ratio - 100) *
	(int64_t)mg->mg_aliquot) / 100;
	} else if (!metaslab_bias_enabled) {
	mg->mg_bias = 0;
	}

	if ((flags & METASLAB_FASTWRITE) \|\|
	atomic_add_64_nv(&mc->mc_aliquot, asize) >=
	mg->mg_aliquot + mg->mg_bias) {
	mc->mc_rotor = mg->mg_next;
	mc->mc_aliquot = 0;
	}

	DVA_SET_VDEV(&dva[d], vd->vdev_id);
	DVA_SET_OFFSET(&dva[d], offset);
	DVA_SET_GANG(&dva[d],
	((flags & METASLAB_GANG_HEADER) ? 1 : 0));
	DVA_SET_ASIZE(&dva[d], asize);

	if (flags & METASLAB_FASTWRITE) {
	atomic_add_64(&vd->vdev_pending_fastwrite,
	psize);
	}

	return (0);
	}
	next:
	mc->mc_rotor = mg->mg_next;
	mc->mc_aliquot = 0;
	} while ((mg = mg->mg_next) != rotor);

	/*
	* If we haven't tried hard, do so now.
	*/
	if (!try_hard) {
	try_hard = B_TRUE;
	goto top;
	}

	bzero(&dva[d], sizeof (dva_t));

	metaslab_trace_add(zal, rotor, NULL, psize, d, TRACE_ENOSPC, allocator);
	return (SET_ERROR(ENOSPC));
	}

	void
	metaslab_free_concrete(vdev_t *vd, uint64_t offset, uint64_t asize,
	boolean_t checkpoint)
	{
	metaslab_t *msp;
	spa_t *spa = vd->vdev_spa;

	ASSERT(vdev_is_concrete(vd));
	ASSERT3U(spa_config_held(spa, SCL_ALL, RW_READER), !=, 0);
	ASSERT3U(offset >> vd->vdev_ms_shift, <, vd->vdev_ms_count);

	msp = vd->vdev_ms[offset >> vd->vdev_ms_shift];

	VERIFY(!msp->ms_condensing);
	VERIFY3U(offset, >=, msp->ms_start);
	VERIFY3U(offset + asize, <=, msp->ms_start + msp->ms_size);
	VERIFY0(P2PHASE(offset, 1ULL << vd->vdev_ashift));
	VERIFY0(P2PHASE(asize, 1ULL << vd->vdev_ashift));

	metaslab_check_free_impl(vd, offset, asize);

	mutex_enter(&msp->ms_lock);
	if (range_tree_is_empty(msp->ms_freeing) &&
	range_tree_is_empty(msp->ms_checkpointing)) {
	vdev_dirty(vd, VDD_METASLAB, msp, spa_syncing_txg(spa));
	}

	if (checkpoint) {
	ASSERT(spa_has_checkpoint(spa));
	range_tree_add(msp->ms_checkpointing, offset, asize);
	} else {
	range_tree_add(msp->ms_freeing, offset, asize);
	}
	mutex_exit(&msp->ms_lock);
	}

	/* ARGSUSED */
	void
	metaslab_free_impl_cb(uint64_t inner_offset, vdev_t *vd, uint64_t offset,
	uint64_t size, void *arg)
	{
	boolean_t *checkpoint = arg;

	ASSERT3P(checkpoint, !=, NULL);

	if (vd->vdev_ops->vdev_op_remap != NULL)
	vdev_indirect_mark_obsolete(vd, offset, size);
	else
	metaslab_free_impl(vd, offset, size, *checkpoint);
	}

	static void
	metaslab_free_impl(vdev_t *vd, uint64_t offset, uint64_t size,
	boolean_t checkpoint)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT3U(spa_config_held(spa, SCL_ALL, RW_READER), !=, 0);

	if (spa_syncing_txg(spa) > spa_freeze_txg(spa))
	return;

	if (spa->spa_vdev_removal != NULL &&
	spa->spa_vdev_removal->svr_vdev_id == vd->vdev_id &&
	vdev_is_concrete(vd)) {
	/*
	* Note: we check if the vdev is concrete because when
	* we complete the removal, we first change the vdev to be
	* an indirect vdev (in open context), and then (in syncing
	* context) clear spa_vdev_removal.
	*/
	free_from_removing_vdev(vd, offset, size);
	} else if (vd->vdev_ops->vdev_op_remap != NULL) {
	vdev_indirect_mark_obsolete(vd, offset, size);
	vd->vdev_ops->vdev_op_remap(vd, offset, size,
	metaslab_free_impl_cb, &checkpoint);
	} else {
	metaslab_free_concrete(vd, offset, size, checkpoint);
	}
	}

	typedef struct remap_blkptr_cb_arg {
	blkptr_t *rbca_bp;
	spa_remap_cb_t rbca_cb;
	vdev_t *rbca_remap_vd;
	uint64_t rbca_remap_offset;
	void *rbca_cb_arg;
	} remap_blkptr_cb_arg_t;

	static void
	remap_blkptr_cb(uint64_t inner_offset, vdev_t *vd, uint64_t offset,
	uint64_t size, void *arg)
	{
	remap_blkptr_cb_arg_t *rbca = arg;
	blkptr_t *bp = rbca->rbca_bp;

	/* We can not remap split blocks. */
	if (size != DVA_GET_ASIZE(&bp->blk_dva[0]))
	return;
	ASSERT0(inner_offset);

	if (rbca->rbca_cb != NULL) {
	/*
	* At this point we know that we are not handling split
	* blocks and we invoke the callback on the previous
	* vdev which must be indirect.
	*/
	ASSERT3P(rbca->rbca_remap_vd->vdev_ops, ==, &vdev_indirect_ops);

	rbca->rbca_cb(rbca->rbca_remap_vd->vdev_id,
	rbca->rbca_remap_offset, size, rbca->rbca_cb_arg);

	/* set up remap_blkptr_cb_arg for the next call */
	rbca->rbca_remap_vd = vd;
	rbca->rbca_remap_offset = offset;
	}

	/*
	* The phys birth time is that of dva[0]. This ensures that we know
	* when each dva was written, so that resilver can determine which
	* blocks need to be scrubbed (i.e. those written during the time
	* the vdev was offline). It also ensures that the key used in
	* the ARC hash table is unique (i.e. dva[0] + phys_birth). If
	* we didn't change the phys_birth, a lookup in the ARC for a
	* remapped BP could find the data that was previously stored at
	* this vdev + offset.
	*/
	vdev_t *oldvd = vdev_lookup_top(vd->vdev_spa,
	DVA_GET_VDEV(&bp->blk_dva[0]));
	vdev_indirect_births_t *vib = oldvd->vdev_indirect_births;
	bp->blk_phys_birth = vdev_indirect_births_physbirth(vib,
	DVA_GET_OFFSET(&bp->blk_dva[0]), DVA_GET_ASIZE(&bp->blk_dva[0]));

	DVA_SET_VDEV(&bp->blk_dva[0], vd->vdev_id);
	DVA_SET_OFFSET(&bp->blk_dva[0], offset);
	}

	/*
	* If the block pointer contains any indirect DVAs, modify them to refer to
	* concrete DVAs. Note that this will sometimes not be possible, leaving
	* the indirect DVA in place. This happens if the indirect DVA spans multiple
	* segments in the mapping (i.e. it is a "split block").
	*
	* If the BP was remapped, calls the callback on the original dva (note the
	* callback can be called multiple times if the original indirect DVA refers
	* to another indirect DVA, etc).
	*
	* Returns TRUE if the BP was remapped.
	*/
	boolean_t
	spa_remap_blkptr(spa_t spa, blkptr_t bp, spa_remap_cb_t callback, void *arg)
	{
	remap_blkptr_cb_arg_t rbca;

	if (!zfs_remap_blkptr_enable)
	return (B_FALSE);

	if (!spa_feature_is_enabled(spa, SPA_FEATURE_OBSOLETE_COUNTS))
	return (B_FALSE);

	/*
	* Dedup BP's can not be remapped, because ddt_phys_select() depends
	* on DVA[0] being the same in the BP as in the DDT (dedup table).
	*/
	if (BP_GET_DEDUP(bp))
	return (B_FALSE);

	/*
	* Gang blocks can not be remapped, because
	* zio_checksum_gang_verifier() depends on the DVA[0] that's in
	* the BP used to read the gang block header (GBH) being the same
	* as the DVA[0] that we allocated for the GBH.
	*/
	if (BP_IS_GANG(bp))
	return (B_FALSE);

	/*
	* Embedded BP's have no DVA to remap.
	*/
	if (BP_GET_NDVAS(bp) < 1)
	return (B_FALSE);

	/*
	* Note: we only remap dva[0]. If we remapped other dvas, we
	* would no longer know what their phys birth txg is.
	*/
	dva_t *dva = &bp->blk_dva[0];

	uint64_t offset = DVA_GET_OFFSET(dva);
	uint64_t size = DVA_GET_ASIZE(dva);
	vdev_t *vd = vdev_lookup_top(spa, DVA_GET_VDEV(dva));

	if (vd->vdev_ops->vdev_op_remap == NULL)
	return (B_FALSE);

	rbca.rbca_bp = bp;
	rbca.rbca_cb = callback;
	rbca.rbca_remap_vd = vd;
	rbca.rbca_remap_offset = offset;
	rbca.rbca_cb_arg = arg;

	/*
	* remap_blkptr_cb() will be called in order for each level of
	* indirection, until a concrete vdev is reached or a split block is
	* encountered. old_vd and old_offset are updated within the callback
	* as we go from the one indirect vdev to the next one (either concrete
	* or indirect again) in that order.
	*/
	vd->vdev_ops->vdev_op_remap(vd, offset, size, remap_blkptr_cb, &rbca);

	/* Check if the DVA wasn't remapped because it is a split block */
	if (DVA_GET_VDEV(&rbca.rbca_bp->blk_dva[0]) == vd->vdev_id)
	return (B_FALSE);

	return (B_TRUE);
	}

	/*
	* Undo the allocation of a DVA which happened in the given transaction group.
	*/
	void
	metaslab_unalloc_dva(spa_t spa, const dva_t dva, uint64_t txg)
	{
	metaslab_t *msp;
	vdev_t *vd;
	uint64_t vdev = DVA_GET_VDEV(dva);
	uint64_t offset = DVA_GET_OFFSET(dva);
	uint64_t size = DVA_GET_ASIZE(dva);

	ASSERT(DVA_IS_VALID(dva));
	ASSERT3U(spa_config_held(spa, SCL_ALL, RW_READER), !=, 0);

	if (txg > spa_freeze_txg(spa))
	return;

	if ((vd = vdev_lookup_top(spa, vdev)) == NULL \|\| !DVA_IS_VALID(dva) \|\|
	(offset >> vd->vdev_ms_shift) >= vd->vdev_ms_count) {
	zfs_panic_recover("metaslab_free_dva(): bad DVA %llu:%llu:%llu",
	(u_longlong_t)vdev, (u_longlong_t)offset,
	(u_longlong_t)size);
	return;
	}

	ASSERT(!vd->vdev_removing);
	ASSERT(vdev_is_concrete(vd));
	ASSERT0(vd->vdev_indirect_config.vic_mapping_object);
	ASSERT3P(vd->vdev_indirect_mapping, ==, NULL);

	if (DVA_GET_GANG(dva))
	size = vdev_psize_to_asize(vd, SPA_GANGBLOCKSIZE);

	msp = vd->vdev_ms[offset >> vd->vdev_ms_shift];

	mutex_enter(&msp->ms_lock);
	range_tree_remove(msp->ms_allocating[txg & TXG_MASK],
	offset, size);
	msp->ms_allocating_total -= size;

	VERIFY(!msp->ms_condensing);
	VERIFY3U(offset, >=, msp->ms_start);
	VERIFY3U(offset + size, <=, msp->ms_start + msp->ms_size);
	VERIFY3U(range_tree_space(msp->ms_allocatable) + size, <=,
	msp->ms_size);
	VERIFY0(P2PHASE(offset, 1ULL << vd->vdev_ashift));
	VERIFY0(P2PHASE(size, 1ULL << vd->vdev_ashift));
	range_tree_add(msp->ms_allocatable, offset, size);
	mutex_exit(&msp->ms_lock);
	}

	/*
	* Free the block represented by the given DVA.
	*/
	void
	metaslab_free_dva(spa_t spa, const dva_t dva, boolean_t checkpoint)
	{
	uint64_t vdev = DVA_GET_VDEV(dva);
	uint64_t offset = DVA_GET_OFFSET(dva);
	uint64_t size = DVA_GET_ASIZE(dva);
	vdev_t *vd = vdev_lookup_top(spa, vdev);

	ASSERT(DVA_IS_VALID(dva));
	ASSERT3U(spa_config_held(spa, SCL_ALL, RW_READER), !=, 0);

	if (DVA_GET_GANG(dva)) {
	size = vdev_psize_to_asize(vd, SPA_GANGBLOCKSIZE);
	}

	metaslab_free_impl(vd, offset, size, checkpoint);
	}

	/*
	* Reserve some allocation slots. The reservation system must be called
	* before we call into the allocator. If there aren't any available slots
	* then the I/O will be throttled until an I/O completes and its slots are
	* freed up. The function returns true if it was successful in placing
	* the reservation.
	*/
	boolean_t
	metaslab_class_throttle_reserve(metaslab_class_t *mc, int slots, int allocator,
	zio_t *zio, int flags)
	{
	uint64_t available_slots = 0;
	boolean_t slot_reserved = B_FALSE;
	uint64_t max = mc->mc_alloc_max_slots[allocator];

	ASSERT(mc->mc_alloc_throttle_enabled);
	mutex_enter(&mc->mc_lock);

	uint64_t reserved_slots =
	zfs_refcount_count(&mc->mc_alloc_slots[allocator]);
	if (reserved_slots < max)
	available_slots = max - reserved_slots;

	if (slots <= available_slots \|\| GANG_ALLOCATION(flags) \|\|
	flags & METASLAB_MUST_RESERVE) {
	/*
	* We reserve the slots individually so that we can unreserve
	* them individually when an I/O completes.
	*/
	for (int d = 0; d < slots; d++) {
	reserved_slots =
	zfs_refcount_add(&mc->mc_alloc_slots[allocator],
	zio);
	}
	zio->io_flags \|= ZIO_FLAG_IO_ALLOCATING;
	slot_reserved = B_TRUE;
	}

	mutex_exit(&mc->mc_lock);
	return (slot_reserved);
	}

	void
	metaslab_class_throttle_unreserve(metaslab_class_t *mc, int slots,
	int allocator, zio_t *zio)
	{
	ASSERT(mc->mc_alloc_throttle_enabled);
	mutex_enter(&mc->mc_lock);
	for (int d = 0; d < slots; d++) {
	(void) zfs_refcount_remove(&mc->mc_alloc_slots[allocator],
	zio);
	}
	mutex_exit(&mc->mc_lock);
	}

	static int
	metaslab_claim_concrete(vdev_t *vd, uint64_t offset, uint64_t size,
	uint64_t txg)
	{
	metaslab_t *msp;
	spa_t *spa = vd->vdev_spa;
	int error = 0;

	if (offset >> vd->vdev_ms_shift >= vd->vdev_ms_count)
	return (SET_ERROR(ENXIO));

	ASSERT3P(vd->vdev_ms, !=, NULL);
	msp = vd->vdev_ms[offset >> vd->vdev_ms_shift];

	mutex_enter(&msp->ms_lock);

	if ((txg != 0 && spa_writeable(spa)) \|\| !msp->ms_loaded) {
	error = metaslab_activate(msp, 0, METASLAB_WEIGHT_CLAIM);
	if (error == EBUSY) {
	ASSERT(msp->ms_loaded);
	ASSERT(msp->ms_weight & METASLAB_ACTIVE_MASK);
	error = 0;
	}
	}

	if (error == 0 &&
	!range_tree_contains(msp->ms_allocatable, offset, size))
	error = SET_ERROR(ENOENT);

	if (error \|\| txg == 0) { /* txg == 0 indicates dry run */
	mutex_exit(&msp->ms_lock);
	return (error);
	}

	VERIFY(!msp->ms_condensing);
	VERIFY0(P2PHASE(offset, 1ULL << vd->vdev_ashift));
	VERIFY0(P2PHASE(size, 1ULL << vd->vdev_ashift));
	VERIFY3U(range_tree_space(msp->ms_allocatable) - size, <=,
	msp->ms_size);
	range_tree_remove(msp->ms_allocatable, offset, size);
	range_tree_clear(msp->ms_trim, offset, size);

	if (spa_writeable(spa)) { /* don't dirty if we're zdb(1M) */
	metaslab_class_t *mc = msp->ms_group->mg_class;
	multilist_sublist_t *mls =
	multilist_sublist_lock_obj(mc->mc_metaslab_txg_list, msp);
	if (!multilist_link_active(&msp->ms_class_txg_node)) {
	msp->ms_selected_txg = txg;
	multilist_sublist_insert_head(mls, msp);
	}
	multilist_sublist_unlock(mls);

	if (range_tree_is_empty(msp->ms_allocating[txg & TXG_MASK]))
	vdev_dirty(vd, VDD_METASLAB, msp, txg);
	range_tree_add(msp->ms_allocating[txg & TXG_MASK],
	offset, size);
	msp->ms_allocating_total += size;
	}

	mutex_exit(&msp->ms_lock);

	return (0);
	}

	typedef struct metaslab_claim_cb_arg_t {
	uint64_t mcca_txg;
	int mcca_error;
	} metaslab_claim_cb_arg_t;

	/* ARGSUSED */
	static void
	metaslab_claim_impl_cb(uint64_t inner_offset, vdev_t *vd, uint64_t offset,
	uint64_t size, void *arg)
	{
	metaslab_claim_cb_arg_t *mcca_arg = arg;

	if (mcca_arg->mcca_error == 0) {
	mcca_arg->mcca_error = metaslab_claim_concrete(vd, offset,
	size, mcca_arg->mcca_txg);
	}
	}

	int
	metaslab_claim_impl(vdev_t *vd, uint64_t offset, uint64_t size, uint64_t txg)
	{
	if (vd->vdev_ops->vdev_op_remap != NULL) {
	metaslab_claim_cb_arg_t arg;

	/*
	* Only zdb(1M) can claim on indirect vdevs. This is used
	* to detect leaks of mapped space (that are not accounted
	* for in the obsolete counts, spacemap, or bpobj).
	*/
	ASSERT(!spa_writeable(vd->vdev_spa));
	arg.mcca_error = 0;
	arg.mcca_txg = txg;

	vd->vdev_ops->vdev_op_remap(vd, offset, size,
	metaslab_claim_impl_cb, &arg);

	if (arg.mcca_error == 0) {
	arg.mcca_error = metaslab_claim_concrete(vd,
	offset, size, txg);
	}
	return (arg.mcca_error);
	} else {
	return (metaslab_claim_concrete(vd, offset, size, txg));
	}
	}

	/*
	* Intent log support: upon opening the pool after a crash, notify the SPA
	* of blocks that the intent log has allocated for immediate write, but
	* which are still considered free by the SPA because the last transaction
	* group didn't commit yet.
	*/
	static int
	metaslab_claim_dva(spa_t spa, const dva_t dva, uint64_t txg)
	{
	uint64_t vdev = DVA_GET_VDEV(dva);
	uint64_t offset = DVA_GET_OFFSET(dva);
	uint64_t size = DVA_GET_ASIZE(dva);
	vdev_t *vd;

	if ((vd = vdev_lookup_top(spa, vdev)) == NULL) {
	return (SET_ERROR(ENXIO));
	}

	ASSERT(DVA_IS_VALID(dva));

	if (DVA_GET_GANG(dva))
	size = vdev_psize_to_asize(vd, SPA_GANGBLOCKSIZE);

	return (metaslab_claim_impl(vd, offset, size, txg));
	}

	int
	metaslab_alloc(spa_t spa, metaslab_class_t mc, uint64_t psize, blkptr_t *bp,
	int ndvas, uint64_t txg, blkptr_t *hintbp, int flags,
	zio_alloc_list_t zal, zio_t zio, int allocator)
	{
	dva_t *dva = bp->blk_dva;
	dva_t *hintdva = (hintbp != NULL) ? hintbp->blk_dva : NULL;
	int error = 0;

	ASSERT(bp->blk_birth == 0);
	ASSERT(BP_PHYSICAL_BIRTH(bp) == 0);

	spa_config_enter(spa, SCL_ALLOC, FTAG, RW_READER);

	if (mc->mc_rotor == NULL) { /* no vdevs in this class */
	spa_config_exit(spa, SCL_ALLOC, FTAG);
	return (SET_ERROR(ENOSPC));
	}

	ASSERT(ndvas > 0 && ndvas <= spa_max_replication(spa));
	ASSERT(BP_GET_NDVAS(bp) == 0);
	ASSERT(hintbp == NULL \|\| ndvas <= BP_GET_NDVAS(hintbp));
	ASSERT3P(zal, !=, NULL);

	for (int d = 0; d < ndvas; d++) {
	error = metaslab_alloc_dva(spa, mc, psize, dva, d, hintdva,
	txg, flags, zal, allocator);
	if (error != 0) {
	for (d--; d >= 0; d--) {
	metaslab_unalloc_dva(spa, &dva[d], txg);
	metaslab_group_alloc_decrement(spa,
	DVA_GET_VDEV(&dva[d]), zio, flags,
	allocator, B_FALSE);
	bzero(&dva[d], sizeof (dva_t));
	}
	spa_config_exit(spa, SCL_ALLOC, FTAG);
	return (error);
	} else {
	/*
	* Update the metaslab group's queue depth
	* based on the newly allocated dva.
	*/
	metaslab_group_alloc_increment(spa,
	DVA_GET_VDEV(&dva[d]), zio, flags, allocator);
	}

	}
	ASSERT(error == 0);
	ASSERT(BP_GET_NDVAS(bp) == ndvas);

	spa_config_exit(spa, SCL_ALLOC, FTAG);

	BP_SET_BIRTH(bp, txg, 0);

	return (0);
	}

	void
	metaslab_free(spa_t spa, const blkptr_t bp, uint64_t txg, boolean_t now)
	{
	const dva_t *dva = bp->blk_dva;
	int ndvas = BP_GET_NDVAS(bp);

	ASSERT(!BP_IS_HOLE(bp));
	ASSERT(!now \|\| bp->blk_birth >= spa_syncing_txg(spa));

	/*
	* If we have a checkpoint for the pool we need to make sure that
	* the blocks that we free that are part of the checkpoint won't be
	* reused until the checkpoint is discarded or we revert to it.
	*
	* The checkpoint flag is passed down the metaslab_free code path
	* and is set whenever we want to add a block to the checkpoint's
	* accounting. That is, we "checkpoint" blocks that existed at the
	* time the checkpoint was created and are therefore referenced by
	* the checkpointed uberblock.
	*
	* Note that, we don't checkpoint any blocks if the current
	* syncing txg <= spa_checkpoint_txg. We want these frees to sync
	* normally as they will be referenced by the checkpointed uberblock.
	*/
	boolean_t checkpoint = B_FALSE;
	if (bp->blk_birth <= spa->spa_checkpoint_txg &&
	spa_syncing_txg(spa) > spa->spa_checkpoint_txg) {
	/*
	* At this point, if the block is part of the checkpoint
	* there is no way it was created in the current txg.
	*/
	ASSERT(!now);
	ASSERT3U(spa_syncing_txg(spa), ==, txg);
	checkpoint = B_TRUE;
	}

	spa_config_enter(spa, SCL_FREE, FTAG, RW_READER);

	for (int d = 0; d < ndvas; d++) {
	if (now) {
	metaslab_unalloc_dva(spa, &dva[d], txg);
	} else {
	ASSERT3U(txg, ==, spa_syncing_txg(spa));
	metaslab_free_dva(spa, &dva[d], checkpoint);
	}
	}

	spa_config_exit(spa, SCL_FREE, FTAG);
	}

	int
	metaslab_claim(spa_t spa, const blkptr_t bp, uint64_t txg)
	{
	const dva_t *dva = bp->blk_dva;
	int ndvas = BP_GET_NDVAS(bp);
	int error = 0;

	ASSERT(!BP_IS_HOLE(bp));

	if (txg != 0) {
	/*
	* First do a dry run to make sure all DVAs are claimable,
	* so we don't have to unwind from partial failures below.
	*/
	if ((error = metaslab_claim(spa, bp, 0)) != 0)
	return (error);
	}

	spa_config_enter(spa, SCL_ALLOC, FTAG, RW_READER);

	for (int d = 0; d < ndvas; d++) {
	error = metaslab_claim_dva(spa, &dva[d], txg);
	if (error != 0)
	break;
	}

	spa_config_exit(spa, SCL_ALLOC, FTAG);

	ASSERT(error == 0 \|\| txg == 0);

	return (error);
	}

	void
	metaslab_fastwrite_mark(spa_t spa, const blkptr_t bp)
	{
	const dva_t *dva = bp->blk_dva;
	int ndvas = BP_GET_NDVAS(bp);
	uint64_t psize = BP_GET_PSIZE(bp);
	int d;
	vdev_t *vd;

	ASSERT(!BP_IS_HOLE(bp));
	ASSERT(!BP_IS_EMBEDDED(bp));
	ASSERT(psize > 0);

	spa_config_enter(spa, SCL_VDEV, FTAG, RW_READER);

	for (d = 0; d < ndvas; d++) {
	if ((vd = vdev_lookup_top(spa, DVA_GET_VDEV(&dva[d]))) == NULL)
	continue;
	atomic_add_64(&vd->vdev_pending_fastwrite, psize);
	}

	spa_config_exit(spa, SCL_VDEV, FTAG);
	}

	void
	metaslab_fastwrite_unmark(spa_t spa, const blkptr_t bp)
	{
	const dva_t *dva = bp->blk_dva;
	int ndvas = BP_GET_NDVAS(bp);
	uint64_t psize = BP_GET_PSIZE(bp);
	int d;
	vdev_t *vd;

	ASSERT(!BP_IS_HOLE(bp));
	ASSERT(!BP_IS_EMBEDDED(bp));
	ASSERT(psize > 0);

	spa_config_enter(spa, SCL_VDEV, FTAG, RW_READER);

	for (d = 0; d < ndvas; d++) {
	if ((vd = vdev_lookup_top(spa, DVA_GET_VDEV(&dva[d]))) == NULL)
	continue;
	ASSERT3U(vd->vdev_pending_fastwrite, >=, psize);
	atomic_sub_64(&vd->vdev_pending_fastwrite, psize);
	}

	spa_config_exit(spa, SCL_VDEV, FTAG);
	}

	/* ARGSUSED */
	static void
	metaslab_check_free_impl_cb(uint64_t inner, vdev_t *vd, uint64_t offset,
	uint64_t size, void *arg)
	{
	if (vd->vdev_ops == &vdev_indirect_ops)
	return;

	metaslab_check_free_impl(vd, offset, size);
	}

	static void
	metaslab_check_free_impl(vdev_t *vd, uint64_t offset, uint64_t size)
	{
	metaslab_t *msp;
	spa_t *spa __maybe_unused = vd->vdev_spa;

	if ((zfs_flags & ZFS_DEBUG_ZIO_FREE) == 0)
	return;

	if (vd->vdev_ops->vdev_op_remap != NULL) {
	vd->vdev_ops->vdev_op_remap(vd, offset, size,
	metaslab_check_free_impl_cb, NULL);
	return;
	}

	ASSERT(vdev_is_concrete(vd));
	ASSERT3U(offset >> vd->vdev_ms_shift, <, vd->vdev_ms_count);
	ASSERT3U(spa_config_held(spa, SCL_ALL, RW_READER), !=, 0);

	msp = vd->vdev_ms[offset >> vd->vdev_ms_shift];

	mutex_enter(&msp->ms_lock);
	if (msp->ms_loaded) {
	range_tree_verify_not_present(msp->ms_allocatable,
	offset, size);
	}

	/*
	* Check all segments that currently exist in the freeing pipeline.
	*
	* It would intuitively make sense to also check the current allocating
	* tree since metaslab_unalloc_dva() exists for extents that are
	* allocated and freed in the same sync pass within the same txg.
	* Unfortunately there are places (e.g. the ZIL) where we allocate a
	* segment but then we free part of it within the same txg
	* [see zil_sync()]. Thus, we don't call range_tree_verify() in the
	* current allocating tree.
	*/
	range_tree_verify_not_present(msp->ms_freeing, offset, size);
	range_tree_verify_not_present(msp->ms_checkpointing, offset, size);
	range_tree_verify_not_present(msp->ms_freed, offset, size);
	for (int j = 0; j < TXG_DEFER_SIZE; j++)
	range_tree_verify_not_present(msp->ms_defer[j], offset, size);
	range_tree_verify_not_present(msp->ms_trim, offset, size);
	mutex_exit(&msp->ms_lock);
	}

	void
	metaslab_check_free(spa_t spa, const blkptr_t bp)
	{
	if ((zfs_flags & ZFS_DEBUG_ZIO_FREE) == 0)
	return;

	spa_config_enter(spa, SCL_VDEV, FTAG, RW_READER);
	for (int i = 0; i < BP_GET_NDVAS(bp); i++) {
	uint64_t vdev = DVA_GET_VDEV(&bp->blk_dva[i]);
	vdev_t *vd = vdev_lookup_top(spa, vdev);
	uint64_t offset = DVA_GET_OFFSET(&bp->blk_dva[i]);
	uint64_t size = DVA_GET_ASIZE(&bp->blk_dva[i]);

	if (DVA_GET_GANG(&bp->blk_dva[i]))
	size = vdev_psize_to_asize(vd, SPA_GANGBLOCKSIZE);

	ASSERT3P(vd, !=, NULL);

	metaslab_check_free_impl(vd, offset, size);
	}
	spa_config_exit(spa, SCL_VDEV, FTAG);
	}

	static void
	metaslab_group_disable_wait(metaslab_group_t *mg)
	{
	ASSERT(MUTEX_HELD(&mg->mg_ms_disabled_lock));
	while (mg->mg_disabled_updating) {
	cv_wait(&mg->mg_ms_disabled_cv, &mg->mg_ms_disabled_lock);
	}
	}

	static void
	metaslab_group_disabled_increment(metaslab_group_t *mg)
	{
	ASSERT(MUTEX_HELD(&mg->mg_ms_disabled_lock));
	ASSERT(mg->mg_disabled_updating);

	while (mg->mg_ms_disabled >= max_disabled_ms) {
	cv_wait(&mg->mg_ms_disabled_cv, &mg->mg_ms_disabled_lock);
	}
	mg->mg_ms_disabled++;
	ASSERT3U(mg->mg_ms_disabled, <=, max_disabled_ms);
	}

	/*
	* Mark the metaslab as disabled to prevent any allocations on this metaslab.
	* We must also track how many metaslabs are currently disabled within a
	* metaslab group and limit them to prevent allocation failures from
	* occurring because all metaslabs are disabled.
	*/
	void
	metaslab_disable(metaslab_t *msp)
	{
	ASSERT(!MUTEX_HELD(&msp->ms_lock));
	metaslab_group_t *mg = msp->ms_group;

	mutex_enter(&mg->mg_ms_disabled_lock);

	/*
	* To keep an accurate count of how many threads have disabled
	* a specific metaslab group, we only allow one thread to mark
	* the metaslab group at a time. This ensures that the value of
	* ms_disabled will be accurate when we decide to mark a metaslab
	* group as disabled. To do this we force all other threads
	* to wait till the metaslab's mg_disabled_updating flag is no
	* longer set.
	*/
	metaslab_group_disable_wait(mg);
	mg->mg_disabled_updating = B_TRUE;
	if (msp->ms_disabled == 0) {
	metaslab_group_disabled_increment(mg);
	}
	mutex_enter(&msp->ms_lock);
	msp->ms_disabled++;
	mutex_exit(&msp->ms_lock);

	mg->mg_disabled_updating = B_FALSE;
	cv_broadcast(&mg->mg_ms_disabled_cv);
	mutex_exit(&mg->mg_ms_disabled_lock);
	}

	void
	metaslab_enable(metaslab_t *msp, boolean_t sync, boolean_t unload)
	{
	metaslab_group_t *mg = msp->ms_group;
	spa_t *spa = mg->mg_vd->vdev_spa;

	/*
	* Wait for the outstanding IO to be synced to prevent newly
	* allocated blocks from being overwritten. This used by
	* initialize and TRIM which are modifying unallocated space.
	*/
	if (sync)
	txg_wait_synced(spa_get_dsl(spa), 0);

	mutex_enter(&mg->mg_ms_disabled_lock);
	mutex_enter(&msp->ms_lock);
	if (--msp->ms_disabled == 0) {
	mg->mg_ms_disabled--;
	cv_broadcast(&mg->mg_ms_disabled_cv);
	if (unload)
	metaslab_unload(msp);
	}
	mutex_exit(&msp->ms_lock);
	mutex_exit(&mg->mg_ms_disabled_lock);
	}

	static void
	metaslab_update_ondisk_flush_data(metaslab_t ms, dmu_tx_t tx)
	{
	vdev_t *vd = ms->ms_group->mg_vd;
	spa_t *spa = vd->vdev_spa;
	objset_t *mos = spa_meta_objset(spa);

	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP));

	metaslab_unflushed_phys_t entry = {
	.msp_unflushed_txg = metaslab_unflushed_txg(ms),
	};
	uint64_t entry_size = sizeof (entry);
	uint64_t entry_offset = ms->ms_id * entry_size;

	uint64_t object = 0;
	int err = zap_lookup(mos, vd->vdev_top_zap,
	VDEV_TOP_ZAP_MS_UNFLUSHED_PHYS_TXGS, sizeof (uint64_t), 1,
	&object);
	if (err == ENOENT) {
	object = dmu_object_alloc(mos, DMU_OTN_UINT64_METADATA,
	SPA_OLD_MAXBLOCKSIZE, DMU_OT_NONE, 0, tx);
	VERIFY0(zap_add(mos, vd->vdev_top_zap,
	VDEV_TOP_ZAP_MS_UNFLUSHED_PHYS_TXGS, sizeof (uint64_t), 1,
	&object, tx));
	} else {
	VERIFY0(err);
	}

	dmu_write(spa_meta_objset(spa), object, entry_offset, entry_size,
	&entry, tx);
	}

	void
	metaslab_set_unflushed_txg(metaslab_t ms, uint64_t txg, dmu_tx_t tx)
	{
	spa_t *spa = ms->ms_group->mg_vd->vdev_spa;

	if (!spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP))
	return;

	ms->ms_unflushed_txg = txg;
	metaslab_update_ondisk_flush_data(ms, tx);
	}

	uint64_t
	metaslab_unflushed_txg(metaslab_t *ms)
	{
	return (ms->ms_unflushed_txg);
	}

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, aliquot, ULONG, ZMOD_RW,
	"Allocation granularity (a.k.a. stripe size)");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, debug_load, INT, ZMOD_RW,
	"Load all metaslabs when pool is first opened");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, debug_unload, INT, ZMOD_RW,
	"Prevent metaslabs from being unloaded");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, preload_enabled, INT, ZMOD_RW,
	"Preload potential metaslabs during reassessment");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, unload_delay, INT, ZMOD_RW,
	"Delay in txgs after metaslab was last used before unloading");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, unload_delay_ms, INT, ZMOD_RW,
	"Delay in milliseconds after metaslab was last used before unloading");

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_mg, zfs_mg_, noalloc_threshold, INT, ZMOD_RW,
	"Percentage of metaslab group size that should be free to make it "
	"eligible for allocation");

	ZFS_MODULE_PARAM(zfs_mg, zfs_mg_, fragmentation_threshold, INT, ZMOD_RW,
	"Percentage of metaslab group size that should be considered eligible "
	"for allocations unless all metaslab groups within the metaslab class "
	"have also crossed this threshold");

	ZFS_MODULE_PARAM(zfs_metaslab, zfs_metaslab_, fragmentation_threshold, INT,
	ZMOD_RW, "Fragmentation for metaslab to allow allocation");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, fragmentation_factor_enabled, INT, ZMOD_RW,
	"Use the fragmentation metric to prefer less fragmented metaslabs");
	/* END CSTYLED */

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, lba_weighting_enabled, INT, ZMOD_RW,
	"Prefer metaslabs with lower LBAs");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, bias_enabled, INT, ZMOD_RW,
	"Enable metaslab group biasing");

	ZFS_MODULE_PARAM(zfs_metaslab, zfs_metaslab_, segment_weight_enabled, INT,
	ZMOD_RW, "Enable segment-based metaslab selection");

	ZFS_MODULE_PARAM(zfs_metaslab, zfs_metaslab_, switch_threshold, INT, ZMOD_RW,
	"Segment-based metaslab selection maximum buckets before switching");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, force_ganging, ULONG, ZMOD_RW,
	"Blocks larger than this size are forced to be gang blocks");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, df_max_search, INT, ZMOD_RW,
	"Max distance (bytes) to search forward before using size tree");

	ZFS_MODULE_PARAM(zfs_metaslab, metaslab_, df_use_largest_segment, INT, ZMOD_RW,
	"When looking in size tree, use largest segment instead of exact fit");

	ZFS_MODULE_PARAM(zfs_metaslab, zfs_metaslab_, max_size_cache_sec, ULONG,
	ZMOD_RW, "How long to trust the cached max chunk size of a metaslab");

	ZFS_MODULE_PARAM(zfs_metaslab, zfs_metaslab_, mem_limit, INT, ZMOD_RW,
	"Percentage of memory that can be used to store metaslab range trees");
	Index: vendor-sys/openzfs/dist/module/zfs/mmp.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/mmp.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/mmp.c (revision 365892)
	@@ -1,728 +1,732 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2017 by Lawrence Livermore National Security, LLC.
	*/

	#include <sys/abd.h>
	#include <sys/mmp.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/time.h>
	#include <sys/vdev.h>
	#include <sys/vdev_impl.h>
	#include <sys/zfs_context.h>
	#include <sys/callb.h>

	/*
	* Multi-Modifier Protection (MMP) attempts to prevent a user from importing
	* or opening a pool on more than one host at a time. In particular, it
	* prevents "zpool import -f" on a host from succeeding while the pool is
	* already imported on another host. There are many other ways in which a
	* device could be used by two hosts for different purposes at the same time
	* resulting in pool damage. This implementation does not attempt to detect
	* those cases.
	*
	* MMP operates by ensuring there are frequent visible changes on disk (a
	* "heartbeat") at all times. And by altering the import process to check
	* for these changes and failing the import when they are detected. This
	* functionality is enabled by setting the 'multihost' pool property to on.
	*
	* Uberblocks written by the txg_sync thread always go into the first
	* (N-MMP_BLOCKS_PER_LABEL) slots, the remaining slots are reserved for MMP.
	* They are used to hold uberblocks which are exactly the same as the last
	* synced uberblock except that the ub_timestamp and mmp_config are frequently
	* updated. Like all other uberblocks, the slot is written with an embedded
	* checksum, and slots with invalid checksums are ignored. This provides the
	* "heartbeat", with no risk of overwriting good uberblocks that must be
	* preserved, e.g. previous txgs and associated block pointers.
	*
	* Three optional fields are added to uberblock structure; ub_mmp_magic,
	* ub_mmp_config, and ub_mmp_delay. The ub_mmp_magic value allows zfs to tell
	* whether the other ub_mmp_* fields are valid. The ub_mmp_config field tells
	* the importing host the settings of zfs_multihost_interval and
	* zfs_multihost_fail_intervals on the host which last had (or currently has)
	* the pool imported. These determine how long a host must wait to detect
	* activity in the pool, before concluding the pool is not in use. The
	* mmp_delay field is a decaying average of the amount of time between
	* completion of successive MMP writes, in nanoseconds. It indicates whether
	* MMP is enabled.
	*
	* During import an activity test may now be performed to determine if
	* the pool is in use. The activity test is typically required if the
	* ZPOOL_CONFIG_HOSTID does not match the system hostid, the pool state is
	* POOL_STATE_ACTIVE, and the pool is not a root pool.
	*
	* The activity test finds the "best" uberblock (highest txg, timestamp, and, if
	* ub_mmp_magic is valid, sequence number from ub_mmp_config). It then waits
	* some time, and finds the "best" uberblock again. If any of the mentioned
	* fields have different values in the newly read uberblock, the pool is in use
	* by another host and the import fails. In order to assure the accuracy of the
	* activity test, the default values result in an activity test duration of 20x
	* the mmp write interval.
	*
	* The duration of the "zpool import" activity test depends on the information
	* available in the "best" uberblock:
	*
	* 1) If uberblock was written by zfs-0.8 or newer and fail_intervals > 0:
	* ub_mmp_config.fail_intervals * ub_mmp_config.multihost_interval * 2
	*
	* In this case, a weak guarantee is provided. Since the host which last had
	* the pool imported will suspend the pool if no mmp writes land within
	* fail_intervals * multihost_interval ms, the absence of writes during that
	* time means either the pool is not imported, or it is imported but the pool
	* is suspended and no further writes will occur.
	*
	* Note that resuming the suspended pool on the remote host would invalidate
	* this guarantee, and so it is not allowed.
	*
	* The factor of 2 provides a conservative safety factor and derives from
	* MMP_IMPORT_SAFETY_FACTOR;
	*
	* 2) If uberblock was written by zfs-0.8 or newer and fail_intervals == 0:
	* (ub_mmp_config.multihost_interval + ub_mmp_delay) *
	* zfs_multihost_import_intervals
	*
	* In this case no guarantee can provided. However, as long as some devices
	* are healthy and connected, it is likely that at least one write will land
	* within (multihost_interval + mmp_delay) because multihost_interval is
	* enough time for a write to be attempted to each leaf vdev, and mmp_delay
	* is enough for one to land, based on past delays. Multiplying by
	* zfs_multihost_import_intervals provides a conservative safety factor.
	*
	* 3) If uberblock was written by zfs-0.7:
	* (zfs_multihost_interval + ub_mmp_delay) * zfs_multihost_import_intervals
	*
	* The same logic as case #2 applies, but we do not know remote tunables.
	*
	* We use the local value for zfs_multihost_interval because the original MMP
	* did not record this value in the uberblock.
	*
	* ub_mmp_delay >= (zfs_multihost_interval / leaves), so if the other host
	* has a much larger zfs_multihost_interval set, ub_mmp_delay will reflect
	* that. We will have waited enough time for zfs_multihost_import_intervals
	* writes to be issued and all but one to land.
	*
	* single device pool example delays
	*
	* import_delay = (1 + 1) * 20 = 40s #defaults, no I/O delay
	* import_delay = (1 + 10) * 20 = 220s #defaults, 10s I/O delay
	* import_delay = (10 + 10) * 20 = 400s #10s multihost_interval,
	* no I/O delay
	* 100 device pool example delays
	*
	* import_delay = (1 + .01) * 20 = 20s #defaults, no I/O delay
	* import_delay = (1 + 10) * 20 = 220s #defaults, 10s I/O delay
	* import_delay = (10 + .1) * 20 = 202s #10s multihost_interval,
	* no I/O delay
	*
	* 4) Otherwise, this uberblock was written by a pre-MMP zfs:
	* zfs_multihost_import_intervals * zfs_multihost_interval
	*
	* In this case local tunables are used. By default this product = 10s, long
	* enough for a pool with any activity at all to write at least one
	* uberblock. No guarantee can be provided.
	*
	* Additionally, the duration is then extended by a random 25% to attempt to to
	* detect simultaneous imports. For example, if both partner hosts are rebooted
	* at the same time and automatically attempt to import the pool.
	*/

	/*
	* Used to control the frequency of mmp writes which are performed when the
	* 'multihost' pool property is on. This is one factor used to determine the
	* length of the activity check during import.
	*
	* On average an mmp write will be issued for each leaf vdev every
	* zfs_multihost_interval milliseconds. In practice, the observed period can
	* vary with the I/O load and this observed value is the ub_mmp_delay which is
	* stored in the uberblock. The minimum allowed value is 100 ms.
	*/
	ulong_t zfs_multihost_interval = MMP_DEFAULT_INTERVAL;

	/*
	* Used to control the duration of the activity test on import. Smaller values
	* of zfs_multihost_import_intervals will reduce the import time but increase
	* the risk of failing to detect an active pool. The total activity check time
	* is never allowed to drop below one second. A value of 0 is ignored and
	* treated as if it was set to 1.
	*/
	uint_t zfs_multihost_import_intervals = MMP_DEFAULT_IMPORT_INTERVALS;

	/*
	* Controls the behavior of the pool when mmp write failures or delays are
	* detected.
	*
	* When zfs_multihost_fail_intervals = 0, mmp write failures or delays are
	* ignored. The failures will still be reported to the ZED which depending on
	* its configuration may take action such as suspending the pool or taking a
	* device offline.
	*
	* When zfs_multihost_fail_intervals > 0, the pool will be suspended if
	* zfs_multihost_fail_intervals * zfs_multihost_interval milliseconds pass
	* without a successful mmp write. This guarantees the activity test will see
	* mmp writes if the pool is imported. A value of 1 is ignored and treated as
	* if it was set to 2, because a single leaf vdev pool will issue a write once
	* per multihost_interval and thus any variation in latency would cause the
	* pool to be suspended.
	*/
	uint_t zfs_multihost_fail_intervals = MMP_DEFAULT_FAIL_INTERVALS;

	char *mmp_tag = "mmp_write_uberblock";
	static void mmp_thread(void *arg);

	void
	mmp_init(spa_t *spa)
	{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_init(&mmp->mmp_thread_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&mmp->mmp_thread_cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&mmp->mmp_io_lock, NULL, MUTEX_DEFAULT, NULL);
	mmp->mmp_kstat_id = 1;
	-
	- /*
	- * mmp_write_done() calculates mmp_delay based on prior mmp_delay and
	- * the elapsed time since the last write. For the first mmp write,
	- * there is no "last write", so we start with fake non-zero values.
	- */
	- mmp->mmp_last_write = gethrtime();
	- mmp->mmp_delay = MSEC2NSEC(MMP_INTERVAL_OK(zfs_multihost_interval));
	}

	void
	mmp_fini(spa_t *spa)
	{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_destroy(&mmp->mmp_thread_lock);
	cv_destroy(&mmp->mmp_thread_cv);
	mutex_destroy(&mmp->mmp_io_lock);
	}

	static void
	mmp_thread_enter(mmp_thread_t mmp, callb_cpr_t cpr)
	{
	CALLB_CPR_INIT(cpr, &mmp->mmp_thread_lock, callb_generic_cpr, FTAG);
	mutex_enter(&mmp->mmp_thread_lock);
	}

	static void
	mmp_thread_exit(mmp_thread_t mmp, kthread_t mpp, callb_cpr_t cpr)
	{
	ASSERT(*mpp != NULL);
	*mpp = NULL;
	cv_broadcast(&mmp->mmp_thread_cv);
	CALLB_CPR_EXIT(cpr); /* drops &mmp->mmp_thread_lock */
	thread_exit();
	}

	void
	mmp_thread_start(spa_t *spa)
	{
	mmp_thread_t *mmp = &spa->spa_mmp;

	if (spa_writeable(spa)) {
	mutex_enter(&mmp->mmp_thread_lock);
	if (!mmp->mmp_thread) {
	mmp->mmp_thread = thread_create(NULL, 0, mmp_thread,
	spa, 0, &p0, TS_RUN, defclsyspri);
	zfs_dbgmsg("MMP thread started pool '%s' "
	"gethrtime %llu", spa_name(spa), gethrtime());
	}
	mutex_exit(&mmp->mmp_thread_lock);
	}
	}

	void
	mmp_thread_stop(spa_t *spa)
	{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_enter(&mmp->mmp_thread_lock);
	mmp->mmp_thread_exiting = 1;
	cv_broadcast(&mmp->mmp_thread_cv);

	while (mmp->mmp_thread) {
	cv_wait(&mmp->mmp_thread_cv, &mmp->mmp_thread_lock);
	}
	mutex_exit(&mmp->mmp_thread_lock);
	zfs_dbgmsg("MMP thread stopped pool '%s' gethrtime %llu",
	spa_name(spa), gethrtime());

	ASSERT(mmp->mmp_thread == NULL);
	mmp->mmp_thread_exiting = 0;
	}

	typedef enum mmp_vdev_state_flag {
	MMP_FAIL_NOT_WRITABLE = (1 << 0),
	MMP_FAIL_WRITE_PENDING = (1 << 1),
	} mmp_vdev_state_flag_t;

	/*
	* Find a leaf vdev to write an MMP block to. It must not have an outstanding
	* mmp write (if so a new write will also likely block). If there is no usable
	* leaf, a nonzero error value is returned. The error value returned is a bit
	* field.
	*
	* MMP_FAIL_WRITE_PENDING One or more leaf vdevs are writeable, but have an
	* outstanding MMP write.
	* MMP_FAIL_NOT_WRITABLE One or more leaf vdevs are not writeable.
	*/

	static int
	mmp_next_leaf(spa_t *spa)
	{
	vdev_t *leaf;
	vdev_t *starting_leaf;
	int fail_mask = 0;

	ASSERT(MUTEX_HELD(&spa->spa_mmp.mmp_io_lock));
	ASSERT(spa_config_held(spa, SCL_STATE, RW_READER));
	ASSERT(list_link_active(&spa->spa_leaf_list.list_head) == B_TRUE);
	ASSERT(!list_is_empty(&spa->spa_leaf_list));

	if (spa->spa_mmp.mmp_leaf_last_gen != spa->spa_leaf_list_gen) {
	spa->spa_mmp.mmp_last_leaf = list_head(&spa->spa_leaf_list);
	spa->spa_mmp.mmp_leaf_last_gen = spa->spa_leaf_list_gen;
	}

	leaf = spa->spa_mmp.mmp_last_leaf;
	if (leaf == NULL)
	leaf = list_head(&spa->spa_leaf_list);
	starting_leaf = leaf;

	do {
	leaf = list_next(&spa->spa_leaf_list, leaf);
	if (leaf == NULL)
	leaf = list_head(&spa->spa_leaf_list);

	if (!vdev_writeable(leaf)) {
	fail_mask \|= MMP_FAIL_NOT_WRITABLE;
	} else if (leaf->vdev_mmp_pending != 0) {
	fail_mask \|= MMP_FAIL_WRITE_PENDING;
	} else {
	spa->spa_mmp.mmp_last_leaf = leaf;
	return (0);
	}
	} while (leaf != starting_leaf);

	ASSERT(fail_mask);

	return (fail_mask);
	}

	/*
	* MMP writes are issued on a fixed schedule, but may complete at variable,
	* much longer, intervals. The mmp_delay captures long periods between
	* successful writes for any reason, including disk latency, scheduling delays,
	* etc.
	*
	* The mmp_delay is usually calculated as a decaying average, but if the latest
	* delay is higher we do not average it, so that we do not hide sudden spikes
	* which the importing host must wait for.
	*
	* If writes are occurring frequently, such as due to a high rate of txg syncs,
	* the mmp_delay could become very small. Since those short delays depend on
	* activity we cannot count on, we never allow mmp_delay to get lower than rate
	* expected if only mmp_thread writes occur.
	*
	* If an mmp write was skipped or fails, and we have already waited longer than
	* mmp_delay, we need to update it so the next write reflects the longer delay.
	*
	* Do not set mmp_delay if the multihost property is not on, so as not to
	* trigger an activity check on import.
	*/
	static void
	mmp_delay_update(spa_t *spa, boolean_t write_completed)
	{
	mmp_thread_t *mts = &spa->spa_mmp;
	hrtime_t delay = gethrtime() - mts->mmp_last_write;

	ASSERT(MUTEX_HELD(&mts->mmp_io_lock));

	if (spa_multihost(spa) == B_FALSE) {
	mts->mmp_delay = 0;
	return;
	}

	if (delay > mts->mmp_delay)
	mts->mmp_delay = delay;

	if (write_completed == B_FALSE)
	return;

	mts->mmp_last_write = gethrtime();

	/*
	* strictly less than, in case delay was changed above.
	*/
	if (delay < mts->mmp_delay) {
	hrtime_t min_delay =
	MSEC2NSEC(MMP_INTERVAL_OK(zfs_multihost_interval)) /
	MAX(1, vdev_count_leaves(spa));
	mts->mmp_delay = MAX(((delay + mts->mmp_delay * 127) / 128),
	min_delay);
	}
	}

	static void
	mmp_write_done(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	vdev_t *vd = zio->io_vd;
	mmp_thread_t *mts = zio->io_private;

	mutex_enter(&mts->mmp_io_lock);
	uint64_t mmp_kstat_id = vd->vdev_mmp_kstat_id;
	hrtime_t mmp_write_duration = gethrtime() - vd->vdev_mmp_pending;

	mmp_delay_update(spa, (zio->io_error == 0));

	vd->vdev_mmp_pending = 0;
	vd->vdev_mmp_kstat_id = 0;

	mutex_exit(&mts->mmp_io_lock);
	spa_config_exit(spa, SCL_STATE, mmp_tag);

	spa_mmp_history_set(spa, mmp_kstat_id, zio->io_error,
	mmp_write_duration);

	abd_free(zio->io_abd);
	}

	/*
	* When the uberblock on-disk is updated by a spa_sync,
	* creating a new "best" uberblock, update the one stored
	* in the mmp thread state, used for mmp writes.
	*/
	void
	mmp_update_uberblock(spa_t spa, uberblock_t ub)
	{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_enter(&mmp->mmp_io_lock);
	mmp->mmp_ub = *ub;
	mmp->mmp_seq = 1;
	mmp->mmp_ub.ub_timestamp = gethrestime_sec();
	mmp_delay_update(spa, B_TRUE);
	mutex_exit(&mmp->mmp_io_lock);
	}

	/*
	* Choose a random vdev, label, and MMP block, and write over it
	* with a copy of the last-synced uberblock, whose timestamp
	* has been updated to reflect that the pool is in use.
	*/
	static void
	mmp_write_uberblock(spa_t *spa)
	{
	int flags = ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_CANFAIL;
	mmp_thread_t *mmp = &spa->spa_mmp;
	uberblock_t *ub;
	vdev_t *vd = NULL;
	int label, error;
	uint64_t offset;

	hrtime_t lock_acquire_time = gethrtime();
	spa_config_enter(spa, SCL_STATE, mmp_tag, RW_READER);
	lock_acquire_time = gethrtime() - lock_acquire_time;
	if (lock_acquire_time > (MSEC2NSEC(MMP_MIN_INTERVAL) / 10))
	zfs_dbgmsg("MMP SCL_STATE acquisition pool '%s' took %llu ns "
	"gethrtime %llu", spa_name(spa), lock_acquire_time,
	gethrtime());

	mutex_enter(&mmp->mmp_io_lock);

	error = mmp_next_leaf(spa);

	/*
	* spa_mmp_history has two types of entries:
	* Issued MMP write: records time issued, error status, etc.
	* Skipped MMP write: an MMP write could not be issued because no
	* suitable leaf vdev was available. See comment above struct
	* spa_mmp_history for details.
	*/

	if (error) {
	mmp_delay_update(spa, B_FALSE);
	if (mmp->mmp_skip_error == error) {
	spa_mmp_history_set_skip(spa, mmp->mmp_kstat_id - 1);
	} else {
	mmp->mmp_skip_error = error;
	spa_mmp_history_add(spa, mmp->mmp_ub.ub_txg,
	gethrestime_sec(), mmp->mmp_delay, NULL, 0,
	mmp->mmp_kstat_id++, error);
	zfs_dbgmsg("MMP error choosing leaf pool '%s' "
	"gethrtime %llu fail_mask %#x", spa_name(spa),
	gethrtime(), error);
	}
	mutex_exit(&mmp->mmp_io_lock);
	spa_config_exit(spa, SCL_STATE, mmp_tag);
	return;
	}

	vd = spa->spa_mmp.mmp_last_leaf;
	if (mmp->mmp_skip_error != 0) {
	mmp->mmp_skip_error = 0;
	zfs_dbgmsg("MMP write after skipping due to unavailable "
	"leaves, pool '%s' gethrtime %llu leaf %#llu",
	spa_name(spa), gethrtime(), vd->vdev_guid);
	}

	if (mmp->mmp_zio_root == NULL)
	mmp->mmp_zio_root = zio_root(spa, NULL, NULL,
	flags \| ZIO_FLAG_GODFATHER);

	if (mmp->mmp_ub.ub_timestamp != gethrestime_sec()) {
	/*
	* Want to reset mmp_seq when timestamp advances because after
	* an mmp_seq wrap new values will not be chosen by
	* uberblock_compare() as the "best".
	*/
	mmp->mmp_ub.ub_timestamp = gethrestime_sec();
	mmp->mmp_seq = 1;
	}

	ub = &mmp->mmp_ub;
	ub->ub_mmp_magic = MMP_MAGIC;
	ub->ub_mmp_delay = mmp->mmp_delay;
	ub->ub_mmp_config = MMP_SEQ_SET(mmp->mmp_seq) \|
	MMP_INTERVAL_SET(MMP_INTERVAL_OK(zfs_multihost_interval)) \|
	MMP_FAIL_INT_SET(MMP_FAIL_INTVS_OK(
	zfs_multihost_fail_intervals));
	vd->vdev_mmp_pending = gethrtime();
	vd->vdev_mmp_kstat_id = mmp->mmp_kstat_id;

	zio_t *zio = zio_null(mmp->mmp_zio_root, spa, NULL, NULL, NULL, flags);
	abd_t *ub_abd = abd_alloc_for_io(VDEV_UBERBLOCK_SIZE(vd), B_TRUE);
	abd_zero(ub_abd, VDEV_UBERBLOCK_SIZE(vd));
	abd_copy_from_buf(ub_abd, ub, sizeof (uberblock_t));

	mmp->mmp_seq++;
	mmp->mmp_kstat_id++;
	mutex_exit(&mmp->mmp_io_lock);

	offset = VDEV_UBERBLOCK_OFFSET(vd, VDEV_UBERBLOCK_COUNT(vd) -
	MMP_BLOCKS_PER_LABEL + spa_get_random(MMP_BLOCKS_PER_LABEL));

	label = spa_get_random(VDEV_LABELS);
	vdev_label_write(zio, vd, label, ub_abd, offset,
	VDEV_UBERBLOCK_SIZE(vd), mmp_write_done, mmp,
	flags \| ZIO_FLAG_DONT_PROPAGATE);

	(void) spa_mmp_history_add(spa, ub->ub_txg, ub->ub_timestamp,
	ub->ub_mmp_delay, vd, label, vd->vdev_mmp_kstat_id, 0);

	zio_nowait(zio);
	}

	static void
	mmp_thread(void *arg)
	{
	spa_t spa = (spa_t )arg;
	mmp_thread_t *mmp = &spa->spa_mmp;
	boolean_t suspended = spa_suspended(spa);
	boolean_t multihost = spa_multihost(spa);
	uint64_t mmp_interval = MSEC2NSEC(MMP_INTERVAL_OK(
	zfs_multihost_interval));
	uint32_t mmp_fail_intervals = MMP_FAIL_INTVS_OK(
	zfs_multihost_fail_intervals);
	hrtime_t mmp_fail_ns = mmp_fail_intervals * mmp_interval;
	boolean_t last_spa_suspended = suspended;
	boolean_t last_spa_multihost = multihost;
	uint64_t last_mmp_interval = mmp_interval;
	uint32_t last_mmp_fail_intervals = mmp_fail_intervals;
	hrtime_t last_mmp_fail_ns = mmp_fail_ns;
	callb_cpr_t cpr;
	int skip_wait = 0;

	mmp_thread_enter(mmp, &cpr);

	+ /*
	+ * There have been no MMP writes yet. Setting mmp_last_write here gives
	+ * us one mmp_fail_ns period, which is consistent with the activity
	+ * check duration, to try to land an MMP write before MMP suspends the
	+ * pool (if so configured).
	+ */
	+
	+ mutex_enter(&mmp->mmp_io_lock);
	+ mmp->mmp_last_write = gethrtime();
	+ mmp->mmp_delay = MSEC2NSEC(MMP_INTERVAL_OK(zfs_multihost_interval));
	+ mutex_exit(&mmp->mmp_io_lock);
	+
	while (!mmp->mmp_thread_exiting) {
	hrtime_t next_time = gethrtime() +
	MSEC2NSEC(MMP_DEFAULT_INTERVAL);
	int leaves = MAX(vdev_count_leaves(spa), 1);

	/* Detect changes in tunables or state */

	last_spa_suspended = suspended;
	last_spa_multihost = multihost;
	suspended = spa_suspended(spa);
	multihost = spa_multihost(spa);

	last_mmp_interval = mmp_interval;
	last_mmp_fail_intervals = mmp_fail_intervals;
	last_mmp_fail_ns = mmp_fail_ns;
	mmp_interval = MSEC2NSEC(MMP_INTERVAL_OK(
	zfs_multihost_interval));
	mmp_fail_intervals = MMP_FAIL_INTVS_OK(
	zfs_multihost_fail_intervals);

	/* Smooth so pool is not suspended when reducing tunables */
	if (mmp_fail_intervals * mmp_interval < mmp_fail_ns) {
	mmp_fail_ns = (mmp_fail_ns * 31 +
	mmp_fail_intervals * mmp_interval) / 32;
	} else {
	mmp_fail_ns = mmp_fail_intervals *
	mmp_interval;
	}

	if (mmp_interval != last_mmp_interval \|\|
	mmp_fail_intervals != last_mmp_fail_intervals) {
	/*
	* We want other hosts to see new tunables as quickly as
	* possible. Write out at higher frequency than usual.
	*/
	skip_wait += leaves;
	}

	if (multihost)
	next_time = gethrtime() + mmp_interval / leaves;

	if (mmp_fail_ns != last_mmp_fail_ns) {
	zfs_dbgmsg("MMP interval change pool '%s' "
	"gethrtime %llu last_mmp_interval %llu "
	"mmp_interval %llu last_mmp_fail_intervals %u "
	"mmp_fail_intervals %u mmp_fail_ns %llu "
	"skip_wait %d leaves %d next_time %llu",
	spa_name(spa), gethrtime(), last_mmp_interval,
	mmp_interval, last_mmp_fail_intervals,
	mmp_fail_intervals, mmp_fail_ns, skip_wait, leaves,
	next_time);
	}

	/*
	* MMP off => on, or suspended => !suspended:
	* No writes occurred recently. Update mmp_last_write to give
	* us some time to try.
	*/
	if ((!last_spa_multihost && multihost) \|\|
	(last_spa_suspended && !suspended)) {
	zfs_dbgmsg("MMP state change pool '%s': gethrtime %llu "
	"last_spa_multihost %u multihost %u "
	"last_spa_suspended %u suspended %u",
	spa_name(spa), last_spa_multihost, multihost,
	last_spa_suspended, suspended);
	mutex_enter(&mmp->mmp_io_lock);
	mmp->mmp_last_write = gethrtime();
	mmp->mmp_delay = mmp_interval;
	mutex_exit(&mmp->mmp_io_lock);
	}

	/*
	* MMP on => off:
	* mmp_delay == 0 tells importing node to skip activity check.
	*/
	if (last_spa_multihost && !multihost) {
	mutex_enter(&mmp->mmp_io_lock);
	mmp->mmp_delay = 0;
	mutex_exit(&mmp->mmp_io_lock);
	}

	/*
	* Suspend the pool if no MMP write has succeeded in over
	* mmp_interval * mmp_fail_intervals nanoseconds.
	*/
	if (multihost && !suspended && mmp_fail_intervals &&
	(gethrtime() - mmp->mmp_last_write) > mmp_fail_ns) {
	zfs_dbgmsg("MMP suspending pool '%s': gethrtime %llu "
	"mmp_last_write %llu mmp_interval %llu "
	"mmp_fail_intervals %llu mmp_fail_ns %llu",
	spa_name(spa), (u_longlong_t)gethrtime(),
	(u_longlong_t)mmp->mmp_last_write,
	(u_longlong_t)mmp_interval,
	(u_longlong_t)mmp_fail_intervals,
	(u_longlong_t)mmp_fail_ns);
	cmn_err(CE_WARN, "MMP writes to pool '%s' have not "
	"succeeded in over %llu ms; suspending pool. "
	"Hrtime %llu",
	spa_name(spa),
	NSEC2MSEC(gethrtime() - mmp->mmp_last_write),
	gethrtime());
	zio_suspend(spa, NULL, ZIO_SUSPEND_MMP);
	}

	if (multihost && !suspended)
	mmp_write_uberblock(spa);

	if (skip_wait > 0) {
	next_time = gethrtime() + MSEC2NSEC(MMP_MIN_INTERVAL) /
	leaves;
	skip_wait--;
	}

	CALLB_CPR_SAFE_BEGIN(&cpr);
	- (void) cv_timedwait_sig_hires(&mmp->mmp_thread_cv,
	+ (void) cv_timedwait_idle_hires(&mmp->mmp_thread_cv,
	&mmp->mmp_thread_lock, next_time, USEC2NSEC(100),
	CALLOUT_FLAG_ABSOLUTE);
	CALLB_CPR_SAFE_END(&cpr, &mmp->mmp_thread_lock);
	}

	/* Outstanding writes are allowed to complete. */
	zio_wait(mmp->mmp_zio_root);

	mmp->mmp_zio_root = NULL;
	mmp_thread_exit(mmp, &mmp->mmp_thread, &cpr);
	}

	/*
	* Signal the MMP thread to wake it, when it is sleeping on
	* its cv. Used when some module parameter has changed and
	* we want the thread to know about it.
	* Only signal if the pool is active and mmp thread is
	* running, otherwise there is no thread to wake.
	*/
	static void
	mmp_signal_thread(spa_t *spa)
	{
	mmp_thread_t *mmp = &spa->spa_mmp;

	mutex_enter(&mmp->mmp_thread_lock);
	if (mmp->mmp_thread)
	cv_broadcast(&mmp->mmp_thread_cv);
	mutex_exit(&mmp->mmp_thread_lock);
	}

	void
	mmp_signal_all_threads(void)
	{
	spa_t *spa = NULL;

	mutex_enter(&spa_namespace_lock);
	while ((spa = spa_next(spa))) {
	if (spa->spa_state == POOL_STATE_ACTIVE)
	mmp_signal_thread(spa);
	}
	mutex_exit(&spa_namespace_lock);
	}

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM_CALL(zfs_multihost, zfs_multihost_, interval,
	param_set_multihost_interval, param_get_ulong, ZMOD_RW,
	"Milliseconds between mmp writes to each leaf");
	/* END CSTYLED */

	ZFS_MODULE_PARAM(zfs_multihost, zfs_multihost_, fail_intervals, UINT, ZMOD_RW,
	"Max allowed period without a successful mmp write");

	ZFS_MODULE_PARAM(zfs_multihost, zfs_multihost_, import_intervals, UINT, ZMOD_RW,
	"Number of zfs_multihost_interval periods to wait for activity");
	Index: vendor-sys/openzfs/dist/module/zfs/range_tree.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/range_tree.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/range_tree.c (revision 365892)
	@@ -1,921 +1,922 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
	* Use is subject to license terms.
	*/
	/*
	* Copyright (c) 2013, 2019 by Delphix. All rights reserved.
	+ * Copyright (c) 2015, Nexenta Systems, Inc. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/dmu.h>
	#include <sys/dnode.h>
	#include <sys/zio.h>
	#include <sys/range_tree.h>

	/*
	* Range trees are tree-based data structures that can be used to
	* track free space or generally any space allocation information.
	* A range tree keeps track of individual segments and automatically
	* provides facilities such as adjacent extent merging and extent
	* splitting in response to range add/remove requests.
	*
	* A range tree starts out completely empty, with no segments in it.
	* Adding an allocation via range_tree_add to the range tree can either:
	* 1) create a new extent
	* 2) extend an adjacent extent
	* 3) merge two adjacent extents
	* Conversely, removing an allocation via range_tree_remove can:
	* 1) completely remove an extent
	* 2) shorten an extent (if the allocation was near one of its ends)
	* 3) split an extent into two extents, in effect punching a hole
	*
	* A range tree is also capable of 'bridging' gaps when adding
	* allocations. This is useful for cases when close proximity of
	* allocations is an important detail that needs to be represented
	* in the range tree. See range_tree_set_gap(). The default behavior
	* is not to bridge gaps (i.e. the maximum allowed gap size is 0).
	*
	* In order to traverse a range tree, use either the range_tree_walk()
	* or range_tree_vacate() functions.
	*
	* To obtain more accurate information on individual segment
	* operations that the range tree performs "under the hood", you can
	* specify a set of callbacks by passing a range_tree_ops_t structure
	* to the range_tree_create function. Any callbacks that are non-NULL
	* are then called at the appropriate times.
	*
	* The range tree code also supports a special variant of range trees
	* that can bridge small gaps between segments. This kind of tree is used
	* by the dsl scanning code to group I/Os into mostly sequential chunks to
	* optimize disk performance. The code here attempts to do this with as
	* little memory and computational overhead as possible. One limitation of
	* this implementation is that segments of range trees with gaps can only
	* support removing complete segments.
	*/

	static inline void
	rs_copy(range_seg_t src, range_seg_t dest, range_tree_t *rt)
	{
	ASSERT3U(rt->rt_type, <=, RANGE_SEG_NUM_TYPES);
	size_t size = 0;
	switch (rt->rt_type) {
	case RANGE_SEG32:
	size = sizeof (range_seg32_t);
	break;
	case RANGE_SEG64:
	size = sizeof (range_seg64_t);
	break;
	case RANGE_SEG_GAP:
	size = sizeof (range_seg_gap_t);
	break;
	default:
	VERIFY(0);
	}
	bcopy(src, dest, size);
	}

	void
	range_tree_stat_verify(range_tree_t *rt)
	{
	range_seg_t *rs;
	zfs_btree_index_t where;
	uint64_t hist[RANGE_TREE_HISTOGRAM_SIZE] = { 0 };
	int i;

	for (rs = zfs_btree_first(&rt->rt_root, &where); rs != NULL;
	rs = zfs_btree_next(&rt->rt_root, &where, &where)) {
	uint64_t size = rs_get_end(rs, rt) - rs_get_start(rs, rt);
	int idx = highbit64(size) - 1;

	hist[idx]++;
	ASSERT3U(hist[idx], !=, 0);
	}

	for (i = 0; i < RANGE_TREE_HISTOGRAM_SIZE; i++) {
	if (hist[i] != rt->rt_histogram[i]) {
	zfs_dbgmsg("i=%d, hist=%px, hist=%llu, rt_hist=%llu",
	i, hist, hist[i], rt->rt_histogram[i]);
	}
	VERIFY3U(hist[i], ==, rt->rt_histogram[i]);
	}
	}

	static void
	range_tree_stat_incr(range_tree_t rt, range_seg_t rs)
	{
	uint64_t size = rs_get_end(rs, rt) - rs_get_start(rs, rt);
	int idx = highbit64(size) - 1;

	ASSERT(size != 0);
	ASSERT3U(idx, <,
	sizeof (rt->rt_histogram) / sizeof (*rt->rt_histogram));

	rt->rt_histogram[idx]++;
	ASSERT3U(rt->rt_histogram[idx], !=, 0);
	}

	static void
	range_tree_stat_decr(range_tree_t rt, range_seg_t rs)
	{
	uint64_t size = rs_get_end(rs, rt) - rs_get_start(rs, rt);
	int idx = highbit64(size) - 1;

	ASSERT(size != 0);
	ASSERT3U(idx, <,
	sizeof (rt->rt_histogram) / sizeof (*rt->rt_histogram));

	ASSERT3U(rt->rt_histogram[idx], !=, 0);
	rt->rt_histogram[idx]--;
	}

	static int
	range_tree_seg32_compare(const void x1, const void x2)
	{
	const range_seg32_t *r1 = x1;
	const range_seg32_t *r2 = x2;

	ASSERT3U(r1->rs_start, <=, r1->rs_end);
	ASSERT3U(r2->rs_start, <=, r2->rs_end);

	return ((r1->rs_start >= r2->rs_end) - (r1->rs_end <= r2->rs_start));
	}

	static int
	range_tree_seg64_compare(const void x1, const void x2)
	{
	const range_seg64_t *r1 = x1;
	const range_seg64_t *r2 = x2;

	ASSERT3U(r1->rs_start, <=, r1->rs_end);
	ASSERT3U(r2->rs_start, <=, r2->rs_end);

	return ((r1->rs_start >= r2->rs_end) - (r1->rs_end <= r2->rs_start));
	}

	static int
	range_tree_seg_gap_compare(const void x1, const void x2)
	{
	const range_seg_gap_t *r1 = x1;
	const range_seg_gap_t *r2 = x2;

	ASSERT3U(r1->rs_start, <=, r1->rs_end);
	ASSERT3U(r2->rs_start, <=, r2->rs_end);

	return ((r1->rs_start >= r2->rs_end) - (r1->rs_end <= r2->rs_start));
	}

	range_tree_t *
	range_tree_create_impl(range_tree_ops_t ops, range_seg_type_t type, void arg,
	uint64_t start, uint64_t shift,
	int (zfs_btree_compare) (const void , const void *),
	uint64_t gap)
	{
	range_tree_t *rt = kmem_zalloc(sizeof (range_tree_t), KM_SLEEP);

	ASSERT3U(shift, <, 64);
	ASSERT3U(type, <=, RANGE_SEG_NUM_TYPES);
	size_t size;
	int (compare) (const void , const void *);
	switch (type) {
	case RANGE_SEG32:
	size = sizeof (range_seg32_t);
	compare = range_tree_seg32_compare;
	break;
	case RANGE_SEG64:
	size = sizeof (range_seg64_t);
	compare = range_tree_seg64_compare;
	break;
	case RANGE_SEG_GAP:
	size = sizeof (range_seg_gap_t);
	compare = range_tree_seg_gap_compare;
	break;
	default:
	panic("Invalid range seg type %d", type);
	}
	zfs_btree_create(&rt->rt_root, compare, size);

	rt->rt_ops = ops;
	rt->rt_gap = gap;
	rt->rt_arg = arg;
	rt->rt_type = type;
	rt->rt_start = start;
	rt->rt_shift = shift;
	rt->rt_btree_compare = zfs_btree_compare;

	if (rt->rt_ops != NULL && rt->rt_ops->rtop_create != NULL)
	rt->rt_ops->rtop_create(rt, rt->rt_arg);

	return (rt);
	}

	range_tree_t *
	range_tree_create(range_tree_ops_t *ops, range_seg_type_t type,
	void *arg, uint64_t start, uint64_t shift)
	{
	return (range_tree_create_impl(ops, type, arg, start, shift, NULL, 0));
	}

	void
	range_tree_destroy(range_tree_t *rt)
	{
	VERIFY0(rt->rt_space);

	if (rt->rt_ops != NULL && rt->rt_ops->rtop_destroy != NULL)
	rt->rt_ops->rtop_destroy(rt, rt->rt_arg);

	zfs_btree_destroy(&rt->rt_root);
	kmem_free(rt, sizeof (*rt));
	}

	void
	range_tree_adjust_fill(range_tree_t rt, range_seg_t rs, int64_t delta)
	{
	if (delta < 0 && delta * -1 >= rs_get_fill(rs, rt)) {
	zfs_panic_recover("zfs: attempting to decrease fill to or "
	"below 0; probable double remove in segment [%llx:%llx]",
	(longlong_t)rs_get_start(rs, rt),
	(longlong_t)rs_get_end(rs, rt));
	}
	if (rs_get_fill(rs, rt) + delta > rs_get_end(rs, rt) -
	rs_get_start(rs, rt)) {
	zfs_panic_recover("zfs: attempting to increase fill beyond "
	"max; probable double add in segment [%llx:%llx]",
	(longlong_t)rs_get_start(rs, rt),
	(longlong_t)rs_get_end(rs, rt));
	}

	if (rt->rt_ops != NULL && rt->rt_ops->rtop_remove != NULL)
	rt->rt_ops->rtop_remove(rt, rs, rt->rt_arg);
	rs_set_fill(rs, rt, rs_get_fill(rs, rt) + delta);
	if (rt->rt_ops != NULL && rt->rt_ops->rtop_add != NULL)
	rt->rt_ops->rtop_add(rt, rs, rt->rt_arg);
	}

	static void
	range_tree_add_impl(void *arg, uint64_t start, uint64_t size, uint64_t fill)
	{
	range_tree_t *rt = arg;
	zfs_btree_index_t where;
	range_seg_t rs_before, rs_after, *rs;
	range_seg_max_t tmp, rsearch;
	uint64_t end = start + size, gap = rt->rt_gap;
	uint64_t bridge_size = 0;
	boolean_t merge_before, merge_after;

	ASSERT3U(size, !=, 0);
	ASSERT3U(fill, <=, size);
	ASSERT3U(start + size, >, start);

	rs_set_start(&rsearch, rt, start);
	rs_set_end(&rsearch, rt, end);
	rs = zfs_btree_find(&rt->rt_root, &rsearch, &where);

	/*
	* If this is a gap-supporting range tree, it is possible that we
	* are inserting into an existing segment. In this case simply
	* bump the fill count and call the remove / add callbacks. If the
	* new range will extend an existing segment, we remove the
	* existing one, apply the new extent to it and re-insert it using
	* the normal code paths.
	*/
	if (rs != NULL) {
	if (gap == 0) {
	zfs_panic_recover("zfs: adding existent segment to "
	"range tree (offset=%llx size=%llx)",
	(longlong_t)start, (longlong_t)size);
	return;
	}
	uint64_t rstart = rs_get_start(rs, rt);
	uint64_t rend = rs_get_end(rs, rt);
	if (rstart <= start && rend >= end) {
	range_tree_adjust_fill(rt, rs, fill);
	return;
	}

	zfs_btree_remove(&rt->rt_root, rs);
	if (rt->rt_ops != NULL && rt->rt_ops->rtop_remove != NULL)
	rt->rt_ops->rtop_remove(rt, rs, rt->rt_arg);

	range_tree_stat_decr(rt, rs);
	rt->rt_space -= rend - rstart;

	fill += rs_get_fill(rs, rt);
	start = MIN(start, rstart);
	end = MAX(end, rend);
	size = end - start;

	range_tree_add_impl(rt, start, size, fill);
	return;
	}

	ASSERT3P(rs, ==, NULL);

	/*
	* Determine whether or not we will have to merge with our neighbors.
	* If gap != 0, we might need to merge with our neighbors even if we
	* aren't directly touching.
	*/
	zfs_btree_index_t where_before, where_after;
	rs_before = zfs_btree_prev(&rt->rt_root, &where, &where_before);
	rs_after = zfs_btree_next(&rt->rt_root, &where, &where_after);

	merge_before = (rs_before != NULL && rs_get_end(rs_before, rt) >=
	start - gap);
	merge_after = (rs_after != NULL && rs_get_start(rs_after, rt) <= end +
	gap);

	if (merge_before && gap != 0)
	bridge_size += start - rs_get_end(rs_before, rt);
	if (merge_after && gap != 0)
	bridge_size += rs_get_start(rs_after, rt) - end;

	if (merge_before && merge_after) {
	if (rt->rt_ops != NULL && rt->rt_ops->rtop_remove != NULL) {
	rt->rt_ops->rtop_remove(rt, rs_before, rt->rt_arg);
	rt->rt_ops->rtop_remove(rt, rs_after, rt->rt_arg);
	}

	range_tree_stat_decr(rt, rs_before);
	range_tree_stat_decr(rt, rs_after);

	rs_copy(rs_after, &tmp, rt);
	uint64_t before_start = rs_get_start_raw(rs_before, rt);
	uint64_t before_fill = rs_get_fill(rs_before, rt);
	uint64_t after_fill = rs_get_fill(rs_after, rt);
	zfs_btree_remove_idx(&rt->rt_root, &where_before);

	/*
	* We have to re-find the node because our old reference is
	* invalid as soon as we do any mutating btree operations.
	*/
	rs_after = zfs_btree_find(&rt->rt_root, &tmp, &where_after);
	rs_set_start_raw(rs_after, rt, before_start);
	rs_set_fill(rs_after, rt, after_fill + before_fill + fill);
	rs = rs_after;
	} else if (merge_before) {
	if (rt->rt_ops != NULL && rt->rt_ops->rtop_remove != NULL)
	rt->rt_ops->rtop_remove(rt, rs_before, rt->rt_arg);

	range_tree_stat_decr(rt, rs_before);

	uint64_t before_fill = rs_get_fill(rs_before, rt);
	rs_set_end(rs_before, rt, end);
	rs_set_fill(rs_before, rt, before_fill + fill);
	rs = rs_before;
	} else if (merge_after) {
	if (rt->rt_ops != NULL && rt->rt_ops->rtop_remove != NULL)
	rt->rt_ops->rtop_remove(rt, rs_after, rt->rt_arg);

	range_tree_stat_decr(rt, rs_after);

	uint64_t after_fill = rs_get_fill(rs_after, rt);
	rs_set_start(rs_after, rt, start);
	rs_set_fill(rs_after, rt, after_fill + fill);
	rs = rs_after;
	} else {
	rs = &tmp;

	rs_set_start(rs, rt, start);
	rs_set_end(rs, rt, end);
	rs_set_fill(rs, rt, fill);
	zfs_btree_add_idx(&rt->rt_root, rs, &where);
	}

	if (gap != 0) {
	ASSERT3U(rs_get_fill(rs, rt), <=, rs_get_end(rs, rt) -
	rs_get_start(rs, rt));
	} else {
	ASSERT3U(rs_get_fill(rs, rt), ==, rs_get_end(rs, rt) -
	rs_get_start(rs, rt));
	}

	if (rt->rt_ops != NULL && rt->rt_ops->rtop_add != NULL)
	rt->rt_ops->rtop_add(rt, rs, rt->rt_arg);

	range_tree_stat_incr(rt, rs);
	rt->rt_space += size + bridge_size;
	}

	void
	range_tree_add(void *arg, uint64_t start, uint64_t size)
	{
	range_tree_add_impl(arg, start, size, size);
	}

	static void
	range_tree_remove_impl(range_tree_t *rt, uint64_t start, uint64_t size,
	boolean_t do_fill)
	{
	zfs_btree_index_t where;
	range_seg_t *rs;
	range_seg_max_t rsearch, rs_tmp;
	uint64_t end = start + size;
	boolean_t left_over, right_over;

	VERIFY3U(size, !=, 0);
	VERIFY3U(size, <=, rt->rt_space);
	if (rt->rt_type == RANGE_SEG64)
	ASSERT3U(start + size, >, start);

	rs_set_start(&rsearch, rt, start);
	rs_set_end(&rsearch, rt, end);
	rs = zfs_btree_find(&rt->rt_root, &rsearch, &where);

	/* Make sure we completely overlap with someone */
	if (rs == NULL) {
	zfs_panic_recover("zfs: removing nonexistent segment from "
	"range tree (offset=%llx size=%llx)",
	(longlong_t)start, (longlong_t)size);
	return;
	}

	/*
	* Range trees with gap support must only remove complete segments
	* from the tree. This allows us to maintain accurate fill accounting
	* and to ensure that bridged sections are not leaked. If we need to
	* remove less than the full segment, we can only adjust the fill count.
	*/
	if (rt->rt_gap != 0) {
	if (do_fill) {
	if (rs_get_fill(rs, rt) == size) {
	start = rs_get_start(rs, rt);
	end = rs_get_end(rs, rt);
	size = end - start;
	} else {
	range_tree_adjust_fill(rt, rs, -size);
	return;
	}
	} else if (rs_get_start(rs, rt) != start \|\|
	rs_get_end(rs, rt) != end) {
	zfs_panic_recover("zfs: freeing partial segment of "
	"gap tree (offset=%llx size=%llx) of "
	"(offset=%llx size=%llx)",
	(longlong_t)start, (longlong_t)size,
	(longlong_t)rs_get_start(rs, rt),
	(longlong_t)rs_get_end(rs, rt) - rs_get_start(rs,
	rt));
	return;
	}
	}

	VERIFY3U(rs_get_start(rs, rt), <=, start);
	VERIFY3U(rs_get_end(rs, rt), >=, end);

	left_over = (rs_get_start(rs, rt) != start);
	right_over = (rs_get_end(rs, rt) != end);

	range_tree_stat_decr(rt, rs);

	if (rt->rt_ops != NULL && rt->rt_ops->rtop_remove != NULL)
	rt->rt_ops->rtop_remove(rt, rs, rt->rt_arg);

	if (left_over && right_over) {
	range_seg_max_t newseg;
	rs_set_start(&newseg, rt, end);
	rs_set_end_raw(&newseg, rt, rs_get_end_raw(rs, rt));
	rs_set_fill(&newseg, rt, rs_get_end(rs, rt) - end);
	range_tree_stat_incr(rt, &newseg);

	// This modifies the buffer already inside the range tree
	rs_set_end(rs, rt, start);

	rs_copy(rs, &rs_tmp, rt);
	if (zfs_btree_next(&rt->rt_root, &where, &where) != NULL)
	zfs_btree_add_idx(&rt->rt_root, &newseg, &where);
	else
	zfs_btree_add(&rt->rt_root, &newseg);

	if (rt->rt_ops != NULL && rt->rt_ops->rtop_add != NULL)
	rt->rt_ops->rtop_add(rt, &newseg, rt->rt_arg);
	} else if (left_over) {
	// This modifies the buffer already inside the range tree
	rs_set_end(rs, rt, start);
	rs_copy(rs, &rs_tmp, rt);
	} else if (right_over) {
	// This modifies the buffer already inside the range tree
	rs_set_start(rs, rt, end);
	rs_copy(rs, &rs_tmp, rt);
	} else {
	zfs_btree_remove_idx(&rt->rt_root, &where);
	rs = NULL;
	}

	if (rs != NULL) {
	/*
	* The fill of the leftover segment will always be equal to
	* the size, since we do not support removing partial segments
	* of range trees with gaps.
	*/
	rs_set_fill_raw(rs, rt, rs_get_end_raw(rs, rt) -
	rs_get_start_raw(rs, rt));
	range_tree_stat_incr(rt, &rs_tmp);

	if (rt->rt_ops != NULL && rt->rt_ops->rtop_add != NULL)
	rt->rt_ops->rtop_add(rt, &rs_tmp, rt->rt_arg);
	}

	rt->rt_space -= size;
	}

	void
	range_tree_remove(void *arg, uint64_t start, uint64_t size)
	{
	range_tree_remove_impl(arg, start, size, B_FALSE);
	}

	void
	range_tree_remove_fill(range_tree_t *rt, uint64_t start, uint64_t size)
	{
	range_tree_remove_impl(rt, start, size, B_TRUE);
	}

	void
	range_tree_resize_segment(range_tree_t rt, range_seg_t rs,
	uint64_t newstart, uint64_t newsize)
	{
	int64_t delta = newsize - (rs_get_end(rs, rt) - rs_get_start(rs, rt));

	range_tree_stat_decr(rt, rs);
	if (rt->rt_ops != NULL && rt->rt_ops->rtop_remove != NULL)
	rt->rt_ops->rtop_remove(rt, rs, rt->rt_arg);

	rs_set_start(rs, rt, newstart);
	rs_set_end(rs, rt, newstart + newsize);

	range_tree_stat_incr(rt, rs);
	if (rt->rt_ops != NULL && rt->rt_ops->rtop_add != NULL)
	rt->rt_ops->rtop_add(rt, rs, rt->rt_arg);

	rt->rt_space += delta;
	}

	static range_seg_t *
	range_tree_find_impl(range_tree_t *rt, uint64_t start, uint64_t size)
	{
	range_seg_max_t rsearch;
	uint64_t end = start + size;

	VERIFY(size != 0);

	rs_set_start(&rsearch, rt, start);
	rs_set_end(&rsearch, rt, end);
	return (zfs_btree_find(&rt->rt_root, &rsearch, NULL));
	}

	range_seg_t *
	range_tree_find(range_tree_t *rt, uint64_t start, uint64_t size)
	{
	if (rt->rt_type == RANGE_SEG64)
	ASSERT3U(start + size, >, start);

	range_seg_t *rs = range_tree_find_impl(rt, start, size);
	if (rs != NULL && rs_get_start(rs, rt) <= start &&
	rs_get_end(rs, rt) >= start + size) {
	return (rs);
	}
	return (NULL);
	}

	void
	range_tree_verify_not_present(range_tree_t *rt, uint64_t off, uint64_t size)
	{
	range_seg_t *rs = range_tree_find(rt, off, size);
	if (rs != NULL)
	panic("segment already in tree; rs=%p", (void *)rs);
	}

	boolean_t
	range_tree_contains(range_tree_t *rt, uint64_t start, uint64_t size)
	{
	return (range_tree_find(rt, start, size) != NULL);
	}

	/*
	* Returns the first subset of the given range which overlaps with the range
	* tree. Returns true if there is a segment in the range, and false if there
	* isn't.
	*/
	boolean_t
	range_tree_find_in(range_tree_t *rt, uint64_t start, uint64_t size,
	uint64_t ostart, uint64_t osize)
	{
	if (rt->rt_type == RANGE_SEG64)
	ASSERT3U(start + size, >, start);

	range_seg_max_t rsearch;
	rs_set_start(&rsearch, rt, start);
	rs_set_end_raw(&rsearch, rt, rs_get_start_raw(&rsearch, rt) + 1);

	zfs_btree_index_t where;
	range_seg_t *rs = zfs_btree_find(&rt->rt_root, &rsearch, &where);
	if (rs != NULL) {
	*ostart = start;
	*osize = MIN(size, rs_get_end(rs, rt) - start);
	return (B_TRUE);
	}

	rs = zfs_btree_next(&rt->rt_root, &where, &where);
	if (rs == NULL \|\| rs_get_start(rs, rt) > start + size)
	return (B_FALSE);

	*ostart = rs_get_start(rs, rt);
	*osize = MIN(start + size, rs_get_end(rs, rt)) -
	rs_get_start(rs, rt);
	return (B_TRUE);
	}

	/*
	* Ensure that this range is not in the tree, regardless of whether
	* it is currently in the tree.
	*/
	void
	range_tree_clear(range_tree_t *rt, uint64_t start, uint64_t size)
	{
	range_seg_t *rs;

	if (size == 0)
	return;

	if (rt->rt_type == RANGE_SEG64)
	ASSERT3U(start + size, >, start);

	while ((rs = range_tree_find_impl(rt, start, size)) != NULL) {
	uint64_t free_start = MAX(rs_get_start(rs, rt), start);
	uint64_t free_end = MIN(rs_get_end(rs, rt), start + size);
	range_tree_remove(rt, free_start, free_end - free_start);
	}
	}

	void
	range_tree_swap(range_tree_t rtsrc, range_tree_t rtdst)
	{
	range_tree_t *rt;

	ASSERT0(range_tree_space(*rtdst));
	ASSERT0(zfs_btree_numnodes(&(*rtdst)->rt_root));

	rt = *rtsrc;
	rtsrc = rtdst;
	*rtdst = rt;
	}

	void
	range_tree_vacate(range_tree_t rt, range_tree_func_t func, void *arg)
	{
	if (rt->rt_ops != NULL && rt->rt_ops->rtop_vacate != NULL)
	rt->rt_ops->rtop_vacate(rt, rt->rt_arg);

	if (func != NULL) {
	range_seg_t *rs;
	zfs_btree_index_t *cookie = NULL;

	while ((rs = zfs_btree_destroy_nodes(&rt->rt_root, &cookie)) !=
	NULL) {
	func(arg, rs_get_start(rs, rt), rs_get_end(rs, rt) -
	rs_get_start(rs, rt));
	}
	} else {
	zfs_btree_clear(&rt->rt_root);
	}

	bzero(rt->rt_histogram, sizeof (rt->rt_histogram));
	rt->rt_space = 0;
	}

	void
	range_tree_walk(range_tree_t rt, range_tree_func_t func, void *arg)
	{
	zfs_btree_index_t where;
	for (range_seg_t *rs = zfs_btree_first(&rt->rt_root, &where);
	rs != NULL; rs = zfs_btree_next(&rt->rt_root, &where, &where)) {
	func(arg, rs_get_start(rs, rt), rs_get_end(rs, rt) -
	rs_get_start(rs, rt));
	}
	}

	range_seg_t *
	range_tree_first(range_tree_t *rt)
	{
	return (zfs_btree_first(&rt->rt_root, NULL));
	}

	uint64_t
	range_tree_space(range_tree_t *rt)
	{
	return (rt->rt_space);
	}

	uint64_t
	range_tree_numsegs(range_tree_t *rt)
	{
	return ((rt == NULL) ? 0 : zfs_btree_numnodes(&rt->rt_root));
	}

	boolean_t
	range_tree_is_empty(range_tree_t *rt)
	{
	ASSERT(rt != NULL);
	return (range_tree_space(rt) == 0);
	}

	/* ARGSUSED */
	void
	rt_btree_create(range_tree_t rt, void arg)
	{
	zfs_btree_t *size_tree = arg;

	size_t size;
	switch (rt->rt_type) {
	case RANGE_SEG32:
	size = sizeof (range_seg32_t);
	break;
	case RANGE_SEG64:
	size = sizeof (range_seg64_t);
	break;
	case RANGE_SEG_GAP:
	size = sizeof (range_seg_gap_t);
	break;
	default:
	panic("Invalid range seg type %d", rt->rt_type);
	}
	zfs_btree_create(size_tree, rt->rt_btree_compare, size);
	}

	/* ARGSUSED */
	void
	rt_btree_destroy(range_tree_t rt, void arg)
	{
	zfs_btree_t *size_tree = arg;
	ASSERT0(zfs_btree_numnodes(size_tree));

	zfs_btree_destroy(size_tree);
	}

	/* ARGSUSED */
	void
	rt_btree_add(range_tree_t rt, range_seg_t rs, void *arg)
	{
	zfs_btree_t *size_tree = arg;

	zfs_btree_add(size_tree, rs);
	}

	/* ARGSUSED */
	void
	rt_btree_remove(range_tree_t rt, range_seg_t rs, void *arg)
	{
	zfs_btree_t *size_tree = arg;

	zfs_btree_remove(size_tree, rs);
	}

	/* ARGSUSED */
	void
	rt_btree_vacate(range_tree_t rt, void arg)
	{
	zfs_btree_t *size_tree = arg;
	zfs_btree_clear(size_tree);
	zfs_btree_destroy(size_tree);

	rt_btree_create(rt, arg);
	}

	range_tree_ops_t rt_btree_ops = {
	.rtop_create = rt_btree_create,
	.rtop_destroy = rt_btree_destroy,
	.rtop_add = rt_btree_add,
	.rtop_remove = rt_btree_remove,
	.rtop_vacate = rt_btree_vacate
	};

	/*
	* Remove any overlapping ranges between the given segment [start, end)
	* from removefrom. Add non-overlapping leftovers to addto.
	*/
	void
	range_tree_remove_xor_add_segment(uint64_t start, uint64_t end,
	range_tree_t removefrom, range_tree_t addto)
	{
	zfs_btree_index_t where;
	range_seg_max_t starting_rs;
	rs_set_start(&starting_rs, removefrom, start);
	rs_set_end_raw(&starting_rs, removefrom, rs_get_start_raw(&starting_rs,
	removefrom) + 1);

	range_seg_t *curr = zfs_btree_find(&removefrom->rt_root,
	&starting_rs, &where);

	if (curr == NULL)
	curr = zfs_btree_next(&removefrom->rt_root, &where, &where);

	range_seg_t *next;
	for (; curr != NULL; curr = next) {
	if (start == end)
	return;
	VERIFY3U(start, <, end);

	/* there is no overlap */
	if (end <= rs_get_start(curr, removefrom)) {
	range_tree_add(addto, start, end - start);
	return;
	}

	uint64_t overlap_start = MAX(rs_get_start(curr, removefrom),
	start);
	uint64_t overlap_end = MIN(rs_get_end(curr, removefrom),
	end);
	uint64_t overlap_size = overlap_end - overlap_start;
	ASSERT3S(overlap_size, >, 0);
	range_seg_max_t rs;
	rs_copy(curr, &rs, removefrom);

	range_tree_remove(removefrom, overlap_start, overlap_size);

	if (start < overlap_start)
	range_tree_add(addto, start, overlap_start - start);

	start = overlap_end;
	next = zfs_btree_find(&removefrom->rt_root, &rs, &where);
	/*
	* If we find something here, we only removed part of the
	* curr segment. Either there's some left at the end
	* because we've reached the end of the range we're removing,
	* or there's some left at the start because we started
	* partway through the range. Either way, we continue with
	* the loop. If it's the former, we'll return at the start of
	* the loop, and if it's the latter we'll see if there is more
	* area to process.
	*/
	if (next != NULL) {
	ASSERT(start == end \|\| start == rs_get_end(&rs,
	removefrom));
	}

	next = zfs_btree_next(&removefrom->rt_root, &where, &where);
	}
	VERIFY3P(curr, ==, NULL);

	if (start != end) {
	VERIFY3U(start, <, end);
	range_tree_add(addto, start, end - start);
	} else {
	VERIFY3U(start, ==, end);
	}
	}

	/*
	* For each entry in rt, if it exists in removefrom, remove it
	* from removefrom. Otherwise, add it to addto.
	*/
	void
	range_tree_remove_xor_add(range_tree_t rt, range_tree_t removefrom,
	range_tree_t *addto)
	{
	zfs_btree_index_t where;
	for (range_seg_t *rs = zfs_btree_first(&rt->rt_root, &where); rs;
	rs = zfs_btree_next(&rt->rt_root, &where, &where)) {
	range_tree_remove_xor_add_segment(rs_get_start(rs, rt),
	rs_get_end(rs, rt), removefrom, addto);
	}
	}

	uint64_t
	range_tree_min(range_tree_t *rt)
	{
	range_seg_t *rs = zfs_btree_first(&rt->rt_root, NULL);
	return (rs != NULL ? rs_get_start(rs, rt) : 0);
	}

	uint64_t
	range_tree_max(range_tree_t *rt)
	{
	range_seg_t *rs = zfs_btree_last(&rt->rt_root, NULL);
	return (rs != NULL ? rs_get_end(rs, rt) : 0);
	}

	uint64_t
	range_tree_span(range_tree_t *rt)
	{
	return (range_tree_max(rt) - range_tree_min(rt));
	}
	Index: vendor-sys/openzfs/dist/module/zfs/spa.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/spa.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/spa.c (revision 365892)
	@@ -1,9756 +1,9768 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	- * Copyright (c) 2011, 2019 by Delphix. All rights reserved.
	+ * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2018, Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2014 Spectra Logic Corporation, All rights reserved.
	* Copyright 2013 Saso Kiselkov. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright 2016 Toomas Soome <tsoome@me.com>
	* Copyright (c) 2016 Actifio, Inc. All rights reserved.
	* Copyright 2018 Joyent, Inc.
	* Copyright (c) 2017, 2019, Datto Inc. All rights reserved.
	* Copyright 2017 Joyent, Inc.
	* Copyright (c) 2017, Intel Corporation.
	*/

	/*
	* SPA: Storage Pool Allocator
	*
	* This file contains all the routines used when modifying on-disk SPA state.
	* This includes opening, importing, destroying, exporting a pool, and syncing a
	* pool.
	*/

	#include <sys/zfs_context.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/spa_impl.h>
	#include <sys/zio.h>
	#include <sys/zio_checksum.h>
	#include <sys/dmu.h>
	#include <sys/dmu_tx.h>
	#include <sys/zap.h>
	#include <sys/zil.h>
	#include <sys/ddt.h>
	#include <sys/vdev_impl.h>
	#include <sys/vdev_removal.h>
	#include <sys/vdev_indirect_mapping.h>
	#include <sys/vdev_indirect_births.h>
	#include <sys/vdev_initialize.h>
	#include <sys/vdev_rebuild.h>
	#include <sys/vdev_trim.h>
	#include <sys/vdev_disk.h>
	#include <sys/metaslab.h>
	#include <sys/metaslab_impl.h>
	#include <sys/mmp.h>
	#include <sys/uberblock_impl.h>
	#include <sys/txg.h>
	#include <sys/avl.h>
	#include <sys/bpobj.h>
	#include <sys/dmu_traverse.h>
	#include <sys/dmu_objset.h>
	#include <sys/unique.h>
	#include <sys/dsl_pool.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_prop.h>
	#include <sys/dsl_synctask.h>
	#include <sys/fs/zfs.h>
	#include <sys/arc.h>
	#include <sys/callb.h>
	#include <sys/systeminfo.h>
	#include <sys/spa_boot.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/dsl_scan.h>
	#include <sys/zfeature.h>
	#include <sys/dsl_destroy.h>
	#include <sys/zvol.h>

	#ifdef _KERNEL
	#include <sys/fm/protocol.h>
	#include <sys/fm/util.h>
	#include <sys/callb.h>
	#include <sys/zone.h>
	#include <sys/vmsystm.h>
	#endif /* _KERNEL */

	#include "zfs_prop.h"
	#include "zfs_comutil.h"

	/*
	* The interval, in seconds, at which failed configuration cache file writes
	* should be retried.
	*/
	int zfs_ccw_retry_interval = 300;

	typedef enum zti_modes {
	ZTI_MODE_FIXED, /* value is # of threads (min 1) */
	ZTI_MODE_BATCH, /* cpu-intensive; value is ignored */
	ZTI_MODE_NULL, /* don't create a taskq */
	ZTI_NMODES
	} zti_modes_t;

	#define ZTI_P(n, q) { ZTI_MODE_FIXED, (n), (q) }
	#define ZTI_PCT(n) { ZTI_MODE_ONLINE_PERCENT, (n), 1 }
	#define ZTI_BATCH { ZTI_MODE_BATCH, 0, 1 }
	#define ZTI_NULL { ZTI_MODE_NULL, 0, 0 }

	#define ZTI_N(n) ZTI_P(n, 1)
	#define ZTI_ONE ZTI_N(1)

	typedef struct zio_taskq_info {
	zti_modes_t zti_mode;
	uint_t zti_value;
	uint_t zti_count;
	} zio_taskq_info_t;

	static const char *const zio_taskq_types[ZIO_TASKQ_TYPES] = {
	"iss", "iss_h", "int", "int_h"
	};

	/*
	* This table defines the taskq settings for each ZFS I/O type. When
	* initializing a pool, we use this table to create an appropriately sized
	* taskq. Some operations are low volume and therefore have a small, static
	* number of threads assigned to their taskqs using the ZTI_N(#) or ZTI_ONE
	* macros. Other operations process a large amount of data; the ZTI_BATCH
	* macro causes us to create a taskq oriented for throughput. Some operations
	* are so high frequency and short-lived that the taskq itself can become a
	* point of lock contention. The ZTI_P(#, #) macro indicates that we need an
	* additional degree of parallelism specified by the number of threads per-
	* taskq and the number of taskqs; when dispatching an event in this case, the
	* particular taskq is chosen at random.
	*
	* The different taskq priorities are to handle the different contexts (issue
	* and interrupt) and then to reserve threads for ZIO_PRIORITY_NOW I/Os that
	* need to be handled with minimum delay.
	*/
	const zio_taskq_info_t zio_taskqs[ZIO_TYPES][ZIO_TASKQ_TYPES] = {
	/* ISSUE ISSUE_HIGH INTR INTR_HIGH */
	{ ZTI_ONE, ZTI_NULL, ZTI_ONE, ZTI_NULL }, /* NULL */
	{ ZTI_N(8), ZTI_NULL, ZTI_P(12, 8), ZTI_NULL }, /* READ */
	{ ZTI_BATCH, ZTI_N(5), ZTI_P(12, 8), ZTI_N(5) }, /* WRITE */
	{ ZTI_P(12, 8), ZTI_NULL, ZTI_ONE, ZTI_NULL }, /* FREE */
	{ ZTI_ONE, ZTI_NULL, ZTI_ONE, ZTI_NULL }, /* CLAIM */
	{ ZTI_ONE, ZTI_NULL, ZTI_ONE, ZTI_NULL }, /* IOCTL */
	{ ZTI_N(4), ZTI_NULL, ZTI_ONE, ZTI_NULL }, /* TRIM */
	};

	static void spa_sync_version(void arg, dmu_tx_t tx);
	static void spa_sync_props(void arg, dmu_tx_t tx);
	static boolean_t spa_has_active_shared_spare(spa_t *spa);
	static int spa_load_impl(spa_t spa, spa_import_type_t type, char *ereport);
	static void spa_vdev_resilver_done(spa_t *spa);

	uint_t zio_taskq_batch_pct = 75; /* 1 thread per cpu in pset */
	boolean_t zio_taskq_sysdc = B_TRUE; /* use SDC scheduling class */
	uint_t zio_taskq_basedc = 80; /* base duty cycle */

	boolean_t spa_create_process = B_TRUE; /* no process ==> no sysdc */

	/*
	* Report any spa_load_verify errors found, but do not fail spa_load.
	* This is used by zdb to analyze non-idle pools.
	*/
	boolean_t spa_load_verify_dryrun = B_FALSE;

	/*
	* This (illegal) pool name is used when temporarily importing a spa_t in order
	* to get the vdev stats associated with the imported devices.
	*/
	#define TRYIMPORT_NAME "$import"

	/*
	* For debugging purposes: print out vdev tree during pool import.
	*/
	int spa_load_print_vdev_tree = B_FALSE;

	/*
	* A non-zero value for zfs_max_missing_tvds means that we allow importing
	* pools with missing top-level vdevs. This is strictly intended for advanced
	* pool recovery cases since missing data is almost inevitable. Pools with
	* missing devices can only be imported read-only for safety reasons, and their
	* fail-mode will be automatically set to "continue".
	*
	* With 1 missing vdev we should be able to import the pool and mount all
	* datasets. User data that was not modified after the missing device has been
	* added should be recoverable. This means that snapshots created prior to the
	* addition of that device should be completely intact.
	*
	* With 2 missing vdevs, some datasets may fail to mount since there are
	* dataset statistics that are stored as regular metadata. Some data might be
	* recoverable if those vdevs were added recently.
	*
	* With 3 or more missing vdevs, the pool is severely damaged and MOS entries
	* may be missing entirely. Chances of data recovery are very low. Note that
	* there are also risks of performing an inadvertent rewind as we might be
	* missing all the vdevs with the latest uberblocks.
	*/
	unsigned long zfs_max_missing_tvds = 0;

	/*
	* The parameters below are similar to zfs_max_missing_tvds but are only
	* intended for a preliminary open of the pool with an untrusted config which
	* might be incomplete or out-dated.
	*
	* We are more tolerant for pools opened from a cachefile since we could have
	* an out-dated cachefile where a device removal was not registered.
	* We could have set the limit arbitrarily high but in the case where devices
	* are really missing we would want to return the proper error codes; we chose
	* SPA_DVAS_PER_BP - 1 so that some copies of the MOS would still be available
	* and we get a chance to retrieve the trusted config.
	*/
	uint64_t zfs_max_missing_tvds_cachefile = SPA_DVAS_PER_BP - 1;

	/*
	* In the case where config was assembled by scanning device paths (/dev/dsks
	* by default) we are less tolerant since all the existing devices should have
	* been detected and we want spa_load to return the right error codes.
	*/
	uint64_t zfs_max_missing_tvds_scan = 0;

	/*
	* Debugging aid that pauses spa_sync() towards the end.
	*/
	boolean_t zfs_pause_spa_sync = B_FALSE;

	/*
	* Variables to indicate the livelist condense zthr func should wait at certain
	* points for the livelist to be removed - used to test condense/destroy races
	*/
	int zfs_livelist_condense_zthr_pause = 0;
	int zfs_livelist_condense_sync_pause = 0;

	/*
	* Variables to track whether or not condense cancellation has been
	* triggered in testing.
	*/
	int zfs_livelist_condense_sync_cancel = 0;
	int zfs_livelist_condense_zthr_cancel = 0;

	/*
	* Variable to track whether or not extra ALLOC blkptrs were added to a
	* livelist entry while it was being condensed (caused by the way we track
	* remapped blkptrs in dbuf_remap_impl)
	*/
	int zfs_livelist_condense_new_alloc = 0;

	/*
	* ==========================================================================
	* SPA properties routines
	* ==========================================================================
	*/

	/*
	* Add a (source=src, propname=propval) list to an nvlist.
	*/
	static void
	spa_prop_add_list(nvlist_t nvl, zpool_prop_t prop, char strval,
	uint64_t intval, zprop_source_t src)
	{
	const char *propname = zpool_prop_to_name(prop);
	nvlist_t *propval;

	VERIFY(nvlist_alloc(&propval, NV_UNIQUE_NAME, KM_SLEEP) == 0);
	VERIFY(nvlist_add_uint64(propval, ZPROP_SOURCE, src) == 0);

	if (strval != NULL)
	VERIFY(nvlist_add_string(propval, ZPROP_VALUE, strval) == 0);
	else
	VERIFY(nvlist_add_uint64(propval, ZPROP_VALUE, intval) == 0);

	VERIFY(nvlist_add_nvlist(nvl, propname, propval) == 0);
	nvlist_free(propval);
	}

	/*
	* Get property values from the spa configuration.
	*/
	static void
	spa_prop_get_config(spa_t spa, nvlist_t *nvp)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	dsl_pool_t *pool = spa->spa_dsl_pool;
	uint64_t size, alloc, cap, version;
	const zprop_source_t src = ZPROP_SRC_NONE;
	spa_config_dirent_t *dp;
	metaslab_class_t *mc = spa_normal_class(spa);

	ASSERT(MUTEX_HELD(&spa->spa_props_lock));

	if (rvd != NULL) {
	alloc = metaslab_class_get_alloc(mc);
	alloc += metaslab_class_get_alloc(spa_special_class(spa));
	alloc += metaslab_class_get_alloc(spa_dedup_class(spa));

	size = metaslab_class_get_space(mc);
	size += metaslab_class_get_space(spa_special_class(spa));
	size += metaslab_class_get_space(spa_dedup_class(spa));

	spa_prop_add_list(*nvp, ZPOOL_PROP_NAME, spa_name(spa), 0, src);
	spa_prop_add_list(*nvp, ZPOOL_PROP_SIZE, NULL, size, src);
	spa_prop_add_list(*nvp, ZPOOL_PROP_ALLOCATED, NULL, alloc, src);
	spa_prop_add_list(*nvp, ZPOOL_PROP_FREE, NULL,
	size - alloc, src);
	spa_prop_add_list(*nvp, ZPOOL_PROP_CHECKPOINT, NULL,
	spa->spa_checkpoint_info.sci_dspace, src);

	spa_prop_add_list(*nvp, ZPOOL_PROP_FRAGMENTATION, NULL,
	metaslab_class_fragmentation(mc), src);
	spa_prop_add_list(*nvp, ZPOOL_PROP_EXPANDSZ, NULL,
	metaslab_class_expandable_space(mc), src);
	spa_prop_add_list(*nvp, ZPOOL_PROP_READONLY, NULL,
	(spa_mode(spa) == SPA_MODE_READ), src);

	cap = (size == 0) ? 0 : (alloc * 100 / size);
	spa_prop_add_list(*nvp, ZPOOL_PROP_CAPACITY, NULL, cap, src);

	spa_prop_add_list(*nvp, ZPOOL_PROP_DEDUPRATIO, NULL,
	ddt_get_pool_dedup_ratio(spa), src);

	spa_prop_add_list(*nvp, ZPOOL_PROP_HEALTH, NULL,
	rvd->vdev_state, src);

	version = spa_version(spa);
	if (version == zpool_prop_default_numeric(ZPOOL_PROP_VERSION)) {
	spa_prop_add_list(*nvp, ZPOOL_PROP_VERSION, NULL,
	version, ZPROP_SRC_DEFAULT);
	} else {
	spa_prop_add_list(*nvp, ZPOOL_PROP_VERSION, NULL,
	version, ZPROP_SRC_LOCAL);
	}
	spa_prop_add_list(*nvp, ZPOOL_PROP_LOAD_GUID,
	NULL, spa_load_guid(spa), src);
	}

	if (pool != NULL) {
	/*
	* The $FREE directory was introduced in SPA_VERSION_DEADLISTS,
	* when opening pools before this version freedir will be NULL.
	*/
	if (pool->dp_free_dir != NULL) {
	spa_prop_add_list(*nvp, ZPOOL_PROP_FREEING, NULL,
	dsl_dir_phys(pool->dp_free_dir)->dd_used_bytes,
	src);
	} else {
	spa_prop_add_list(*nvp, ZPOOL_PROP_FREEING,
	NULL, 0, src);
	}

	if (pool->dp_leak_dir != NULL) {
	spa_prop_add_list(*nvp, ZPOOL_PROP_LEAKED, NULL,
	dsl_dir_phys(pool->dp_leak_dir)->dd_used_bytes,
	src);
	} else {
	spa_prop_add_list(*nvp, ZPOOL_PROP_LEAKED,
	NULL, 0, src);
	}
	}

	spa_prop_add_list(*nvp, ZPOOL_PROP_GUID, NULL, spa_guid(spa), src);

	if (spa->spa_comment != NULL) {
	spa_prop_add_list(*nvp, ZPOOL_PROP_COMMENT, spa->spa_comment,
	0, ZPROP_SRC_LOCAL);
	}

	if (spa->spa_root != NULL)
	spa_prop_add_list(*nvp, ZPOOL_PROP_ALTROOT, spa->spa_root,
	0, ZPROP_SRC_LOCAL);

	if (spa_feature_is_enabled(spa, SPA_FEATURE_LARGE_BLOCKS)) {
	spa_prop_add_list(*nvp, ZPOOL_PROP_MAXBLOCKSIZE, NULL,
	MIN(zfs_max_recordsize, SPA_MAXBLOCKSIZE), ZPROP_SRC_NONE);
	} else {
	spa_prop_add_list(*nvp, ZPOOL_PROP_MAXBLOCKSIZE, NULL,
	SPA_OLD_MAXBLOCKSIZE, ZPROP_SRC_NONE);
	}

	if (spa_feature_is_enabled(spa, SPA_FEATURE_LARGE_DNODE)) {
	spa_prop_add_list(*nvp, ZPOOL_PROP_MAXDNODESIZE, NULL,
	DNODE_MAX_SIZE, ZPROP_SRC_NONE);
	} else {
	spa_prop_add_list(*nvp, ZPOOL_PROP_MAXDNODESIZE, NULL,
	DNODE_MIN_SIZE, ZPROP_SRC_NONE);
	}

	if ((dp = list_head(&spa->spa_config_list)) != NULL) {
	if (dp->scd_path == NULL) {
	spa_prop_add_list(*nvp, ZPOOL_PROP_CACHEFILE,
	"none", 0, ZPROP_SRC_LOCAL);
	} else if (strcmp(dp->scd_path, spa_config_path) != 0) {
	spa_prop_add_list(*nvp, ZPOOL_PROP_CACHEFILE,
	dp->scd_path, 0, ZPROP_SRC_LOCAL);
	}
	}
	}

	/*
	* Get zpool property values.
	*/
	int
	spa_prop_get(spa_t spa, nvlist_t *nvp)
	{
	objset_t *mos = spa->spa_meta_objset;
	zap_cursor_t zc;
	zap_attribute_t za;
	dsl_pool_t *dp;
	int err;

	err = nvlist_alloc(nvp, NV_UNIQUE_NAME, KM_SLEEP);
	if (err)
	return (err);

	dp = spa_get_dsl(spa);
	dsl_pool_config_enter(dp, FTAG);
	mutex_enter(&spa->spa_props_lock);

	/*
	* Get properties from the spa config.
	*/
	spa_prop_get_config(spa, nvp);

	/* If no pool property object, no more prop to get. */
	if (mos == NULL \|\| spa->spa_pool_props_object == 0)
	goto out;

	/*
	* Get properties from the MOS pool property object.
	*/
	for (zap_cursor_init(&zc, mos, spa->spa_pool_props_object);
	(err = zap_cursor_retrieve(&zc, &za)) == 0;
	zap_cursor_advance(&zc)) {
	uint64_t intval = 0;
	char *strval = NULL;
	zprop_source_t src = ZPROP_SRC_DEFAULT;
	zpool_prop_t prop;

	if ((prop = zpool_name_to_prop(za.za_name)) == ZPOOL_PROP_INVAL)
	continue;

	switch (za.za_integer_length) {
	case 8:
	/* integer property */
	if (za.za_first_integer !=
	zpool_prop_default_numeric(prop))
	src = ZPROP_SRC_LOCAL;

	if (prop == ZPOOL_PROP_BOOTFS) {
	dsl_dataset_t *ds = NULL;

	err = dsl_dataset_hold_obj(dp,
	za.za_first_integer, FTAG, &ds);
	if (err != 0)
	break;

	strval = kmem_alloc(ZFS_MAX_DATASET_NAME_LEN,
	KM_SLEEP);
	dsl_dataset_name(ds, strval);
	dsl_dataset_rele(ds, FTAG);
	} else {
	strval = NULL;
	intval = za.za_first_integer;
	}

	spa_prop_add_list(*nvp, prop, strval, intval, src);

	if (strval != NULL)
	kmem_free(strval, ZFS_MAX_DATASET_NAME_LEN);

	break;

	case 1:
	/* string property */
	strval = kmem_alloc(za.za_num_integers, KM_SLEEP);
	err = zap_lookup(mos, spa->spa_pool_props_object,
	za.za_name, 1, za.za_num_integers, strval);
	if (err) {
	kmem_free(strval, za.za_num_integers);
	break;
	}
	spa_prop_add_list(*nvp, prop, strval, 0, src);
	kmem_free(strval, za.za_num_integers);
	break;

	default:
	break;
	}
	}
	zap_cursor_fini(&zc);
	out:
	mutex_exit(&spa->spa_props_lock);
	dsl_pool_config_exit(dp, FTAG);
	if (err && err != ENOENT) {
	nvlist_free(*nvp);
	*nvp = NULL;
	return (err);
	}

	return (0);
	}

	/*
	* Validate the given pool properties nvlist and modify the list
	* for the property values to be set.
	*/
	static int
	spa_prop_validate(spa_t spa, nvlist_t props)
	{
	nvpair_t *elem;
	int error = 0, reset_bootfs = 0;
	uint64_t objnum = 0;
	boolean_t has_feature = B_FALSE;

	elem = NULL;
	while ((elem = nvlist_next_nvpair(props, elem)) != NULL) {
	uint64_t intval;
	char strval, slash, check, fname;
	const char *propname = nvpair_name(elem);
	zpool_prop_t prop = zpool_name_to_prop(propname);

	switch (prop) {
	case ZPOOL_PROP_INVAL:
	if (!zpool_prop_feature(propname)) {
	error = SET_ERROR(EINVAL);
	break;
	}

	/*
	* Sanitize the input.
	*/
	if (nvpair_type(elem) != DATA_TYPE_UINT64) {
	error = SET_ERROR(EINVAL);
	break;
	}

	if (nvpair_value_uint64(elem, &intval) != 0) {
	error = SET_ERROR(EINVAL);
	break;
	}

	if (intval != 0) {
	error = SET_ERROR(EINVAL);
	break;
	}

	fname = strchr(propname, '@') + 1;
	if (zfeature_lookup_name(fname, NULL) != 0) {
	error = SET_ERROR(EINVAL);
	break;
	}

	has_feature = B_TRUE;
	break;

	case ZPOOL_PROP_VERSION:
	error = nvpair_value_uint64(elem, &intval);
	if (!error &&
	(intval < spa_version(spa) \|\|
	intval > SPA_VERSION_BEFORE_FEATURES \|\|
	has_feature))
	error = SET_ERROR(EINVAL);
	break;

	case ZPOOL_PROP_DELEGATION:
	case ZPOOL_PROP_AUTOREPLACE:
	case ZPOOL_PROP_LISTSNAPS:
	case ZPOOL_PROP_AUTOEXPAND:
	case ZPOOL_PROP_AUTOTRIM:
	error = nvpair_value_uint64(elem, &intval);
	if (!error && intval > 1)
	error = SET_ERROR(EINVAL);
	break;

	case ZPOOL_PROP_MULTIHOST:
	error = nvpair_value_uint64(elem, &intval);
	if (!error && intval > 1)
	error = SET_ERROR(EINVAL);

	if (!error) {
	uint32_t hostid = zone_get_hostid(NULL);
	if (hostid)
	spa->spa_hostid = hostid;
	else
	error = SET_ERROR(ENOTSUP);
	}

	break;

	case ZPOOL_PROP_BOOTFS:
	/*
	* If the pool version is less than SPA_VERSION_BOOTFS,
	* or the pool is still being created (version == 0),
	* the bootfs property cannot be set.
	*/
	if (spa_version(spa) < SPA_VERSION_BOOTFS) {
	error = SET_ERROR(ENOTSUP);
	break;
	}

	/*
	* Make sure the vdev config is bootable
	*/
	if (!vdev_is_bootable(spa->spa_root_vdev)) {
	error = SET_ERROR(ENOTSUP);
	break;
	}

	reset_bootfs = 1;

	error = nvpair_value_string(elem, &strval);

	if (!error) {
	objset_t *os;

	if (strval == NULL \|\| strval[0] == '\0') {
	objnum = zpool_prop_default_numeric(
	ZPOOL_PROP_BOOTFS);
	break;
	}

	error = dmu_objset_hold(strval, FTAG, &os);
	if (error != 0)
	break;

	/* Must be ZPL. */
	if (dmu_objset_type(os) != DMU_OST_ZFS) {
	error = SET_ERROR(ENOTSUP);
	} else {
	objnum = dmu_objset_id(os);
	}
	dmu_objset_rele(os, FTAG);
	}
	break;

	case ZPOOL_PROP_FAILUREMODE:
	error = nvpair_value_uint64(elem, &intval);
	if (!error && intval > ZIO_FAILURE_MODE_PANIC)
	error = SET_ERROR(EINVAL);

	/*
	* This is a special case which only occurs when
	* the pool has completely failed. This allows
	* the user to change the in-core failmode property
	* without syncing it out to disk (I/Os might
	* currently be blocked). We do this by returning
	* EIO to the caller (spa_prop_set) to trick it
	* into thinking we encountered a property validation
	* error.
	*/
	if (!error && spa_suspended(spa)) {
	spa->spa_failmode = intval;
	error = SET_ERROR(EIO);
	}
	break;

	case ZPOOL_PROP_CACHEFILE:
	if ((error = nvpair_value_string(elem, &strval)) != 0)
	break;

	if (strval[0] == '\0')
	break;

	if (strcmp(strval, "none") == 0)
	break;

	if (strval[0] != '/') {
	error = SET_ERROR(EINVAL);
	break;
	}

	slash = strrchr(strval, '/');
	ASSERT(slash != NULL);

	if (slash[1] == '\0' \|\| strcmp(slash, "/.") == 0 \|\|
	strcmp(slash, "/..") == 0)
	error = SET_ERROR(EINVAL);
	break;

	case ZPOOL_PROP_COMMENT:
	if ((error = nvpair_value_string(elem, &strval)) != 0)
	break;
	for (check = strval; *check != '\0'; check++) {
	if (!isprint(*check)) {
	error = SET_ERROR(EINVAL);
	break;
	}
	}
	if (strlen(strval) > ZPROP_MAX_COMMENT)
	error = SET_ERROR(E2BIG);
	break;

	default:
	break;
	}

	if (error)
	break;
	}

	(void) nvlist_remove_all(props,
	zpool_prop_to_name(ZPOOL_PROP_DEDUPDITTO));

	if (!error && reset_bootfs) {
	error = nvlist_remove(props,
	zpool_prop_to_name(ZPOOL_PROP_BOOTFS), DATA_TYPE_STRING);

	if (!error) {
	error = nvlist_add_uint64(props,
	zpool_prop_to_name(ZPOOL_PROP_BOOTFS), objnum);
	}
	}

	return (error);
	}

	void
	spa_configfile_set(spa_t spa, nvlist_t nvp, boolean_t need_sync)
	{
	char *cachefile;
	spa_config_dirent_t *dp;

	if (nvlist_lookup_string(nvp, zpool_prop_to_name(ZPOOL_PROP_CACHEFILE),
	&cachefile) != 0)
	return;

	dp = kmem_alloc(sizeof (spa_config_dirent_t),
	KM_SLEEP);

	if (cachefile[0] == '\0')
	dp->scd_path = spa_strdup(spa_config_path);
	else if (strcmp(cachefile, "none") == 0)
	dp->scd_path = NULL;
	else
	dp->scd_path = spa_strdup(cachefile);

	list_insert_head(&spa->spa_config_list, dp);
	if (need_sync)
	spa_async_request(spa, SPA_ASYNC_CONFIG_UPDATE);
	}

	int
	spa_prop_set(spa_t spa, nvlist_t nvp)
	{
	int error;
	nvpair_t *elem = NULL;
	boolean_t need_sync = B_FALSE;

	if ((error = spa_prop_validate(spa, nvp)) != 0)
	return (error);

	while ((elem = nvlist_next_nvpair(nvp, elem)) != NULL) {
	zpool_prop_t prop = zpool_name_to_prop(nvpair_name(elem));

	if (prop == ZPOOL_PROP_CACHEFILE \|\|
	prop == ZPOOL_PROP_ALTROOT \|\|
	prop == ZPOOL_PROP_READONLY)
	continue;

	if (prop == ZPOOL_PROP_VERSION \|\| prop == ZPOOL_PROP_INVAL) {
	uint64_t ver;

	if (prop == ZPOOL_PROP_VERSION) {
	VERIFY(nvpair_value_uint64(elem, &ver) == 0);
	} else {
	ASSERT(zpool_prop_feature(nvpair_name(elem)));
	ver = SPA_VERSION_FEATURES;
	need_sync = B_TRUE;
	}

	/* Save time if the version is already set. */
	if (ver == spa_version(spa))
	continue;

	/*
	* In addition to the pool directory object, we might
	* create the pool properties object, the features for
	* read object, the features for write object, or the
	* feature descriptions object.
	*/
	error = dsl_sync_task(spa->spa_name, NULL,
	spa_sync_version, &ver,
	6, ZFS_SPACE_CHECK_RESERVED);
	if (error)
	return (error);
	continue;
	}

	need_sync = B_TRUE;
	break;
	}

	if (need_sync) {
	return (dsl_sync_task(spa->spa_name, NULL, spa_sync_props,
	nvp, 6, ZFS_SPACE_CHECK_RESERVED));
	}

	return (0);
	}

	/*
	* If the bootfs property value is dsobj, clear it.
	*/
	void
	spa_prop_clear_bootfs(spa_t spa, uint64_t dsobj, dmu_tx_t tx)
	{
	if (spa->spa_bootfs == dsobj && spa->spa_pool_props_object != 0) {
	VERIFY(zap_remove(spa->spa_meta_objset,
	spa->spa_pool_props_object,
	zpool_prop_to_name(ZPOOL_PROP_BOOTFS), tx) == 0);
	spa->spa_bootfs = 0;
	}
	}

	/ARGSUSED/
	static int
	spa_change_guid_check(void arg, dmu_tx_t tx)
	{
	uint64_t *newguid __maybe_unused = arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *rvd = spa->spa_root_vdev;
	uint64_t vdev_state;

	if (spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
	int error = (spa_has_checkpoint(spa)) ?
	ZFS_ERR_CHECKPOINT_EXISTS : ZFS_ERR_DISCARDING_CHECKPOINT;
	return (SET_ERROR(error));
	}

	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);
	vdev_state = rvd->vdev_state;
	spa_config_exit(spa, SCL_STATE, FTAG);

	if (vdev_state != VDEV_STATE_HEALTHY)
	return (SET_ERROR(ENXIO));

	ASSERT3U(spa_guid(spa), !=, *newguid);

	return (0);
	}

	static void
	spa_change_guid_sync(void arg, dmu_tx_t tx)
	{
	uint64_t *newguid = arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	uint64_t oldguid;
	vdev_t *rvd = spa->spa_root_vdev;

	oldguid = spa_guid(spa);

	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);
	rvd->vdev_guid = *newguid;
	rvd->vdev_guid_sum += (*newguid - oldguid);
	vdev_config_dirty(rvd);
	spa_config_exit(spa, SCL_STATE, FTAG);

	spa_history_log_internal(spa, "guid change", tx, "old=%llu new=%llu",
	(u_longlong_t)oldguid, (u_longlong_t)*newguid);
	}

	/*
	* Change the GUID for the pool. This is done so that we can later
	* re-import a pool built from a clone of our own vdevs. We will modify
	* the root vdev's guid, our own pool guid, and then mark all of our
	* vdevs dirty. Note that we must make sure that all our vdevs are
	* online when we do this, or else any vdevs that weren't present
	* would be orphaned from our pool. We are also going to issue a
	* sysevent to update any watchers.
	*/
	int
	spa_change_guid(spa_t *spa)
	{
	int error;
	uint64_t guid;

	mutex_enter(&spa->spa_vdev_top_lock);
	mutex_enter(&spa_namespace_lock);
	guid = spa_generate_guid(NULL);

	error = dsl_sync_task(spa->spa_name, spa_change_guid_check,
	spa_change_guid_sync, &guid, 5, ZFS_SPACE_CHECK_RESERVED);

	if (error == 0) {
	spa_write_cachefile(spa, B_FALSE, B_TRUE);
	spa_event_notify(spa, NULL, NULL, ESC_ZFS_POOL_REGUID);
	}

	mutex_exit(&spa_namespace_lock);
	mutex_exit(&spa->spa_vdev_top_lock);

	return (error);
	}

	/*
	* ==========================================================================
	* SPA state manipulation (open/create/destroy/import/export)
	* ==========================================================================
	*/

	static int
	spa_error_entry_compare(const void a, const void b)
	{
	const spa_error_entry_t sa = (const spa_error_entry_t )a;
	const spa_error_entry_t sb = (const spa_error_entry_t )b;
	int ret;

	ret = memcmp(&sa->se_bookmark, &sb->se_bookmark,
	sizeof (zbookmark_phys_t));

	return (TREE_ISIGN(ret));
	}

	/*
	* Utility function which retrieves copies of the current logs and
	* re-initializes them in the process.
	*/
	void
	spa_get_errlists(spa_t spa, avl_tree_t last, avl_tree_t *scrub)
	{
	ASSERT(MUTEX_HELD(&spa->spa_errlist_lock));

	bcopy(&spa->spa_errlist_last, last, sizeof (avl_tree_t));
	bcopy(&spa->spa_errlist_scrub, scrub, sizeof (avl_tree_t));

	avl_create(&spa->spa_errlist_scrub,
	spa_error_entry_compare, sizeof (spa_error_entry_t),
	offsetof(spa_error_entry_t, se_avl));
	avl_create(&spa->spa_errlist_last,
	spa_error_entry_compare, sizeof (spa_error_entry_t),
	offsetof(spa_error_entry_t, se_avl));
	}

	static void
	spa_taskqs_init(spa_t *spa, zio_type_t t, zio_taskq_type_t q)
	{
	const zio_taskq_info_t *ztip = &zio_taskqs[t][q];
	enum zti_modes mode = ztip->zti_mode;
	uint_t value = ztip->zti_value;
	uint_t count = ztip->zti_count;
	spa_taskqs_t *tqs = &spa->spa_zio_taskq[t][q];
	uint_t flags = 0;
	boolean_t batch = B_FALSE;

	if (mode == ZTI_MODE_NULL) {
	tqs->stqs_count = 0;
	tqs->stqs_taskq = NULL;
	return;
	}

	ASSERT3U(count, >, 0);

	tqs->stqs_count = count;
	tqs->stqs_taskq = kmem_alloc(count * sizeof (taskq_t *), KM_SLEEP);

	switch (mode) {
	case ZTI_MODE_FIXED:
	ASSERT3U(value, >=, 1);
	value = MAX(value, 1);
	flags \|= TASKQ_DYNAMIC;
	break;

	case ZTI_MODE_BATCH:
	batch = B_TRUE;
	flags \|= TASKQ_THREADS_CPU_PCT;
	value = MIN(zio_taskq_batch_pct, 100);
	break;

	default:
	panic("unrecognized mode for %s_%s taskq (%u:%u) in "
	"spa_activate()",
	zio_type_name[t], zio_taskq_types[q], mode, value);
	break;
	}

	for (uint_t i = 0; i < count; i++) {
	taskq_t *tq;
	char name[32];

	(void) snprintf(name, sizeof (name), "%s_%s",
	zio_type_name[t], zio_taskq_types[q]);

	if (zio_taskq_sysdc && spa->spa_proc != &p0) {
	if (batch)
	flags \|= TASKQ_DC_BATCH;

	tq = taskq_create_sysdc(name, value, 50, INT_MAX,
	spa->spa_proc, zio_taskq_basedc, flags);
	} else {
	pri_t pri = maxclsyspri;
	/*
	* The write issue taskq can be extremely CPU
	* intensive. Run it at slightly less important
	- * priority than the other taskqs. Under Linux this
	- * means incrementing the priority value on platforms
	- * like illumos it should be decremented.
	+ * priority than the other taskqs.
	+ *
	+ * Under Linux and FreeBSD this means incrementing
	+ * the priority value as opposed to platforms like
	+ * illumos where it should be decremented.
	+ *
	+ * On FreeBSD, if priorities divided by four (RQ_PPQ)
	+ * are equal then a difference between them is
	+ * insignificant.
	*/
	- if (t == ZIO_TYPE_WRITE && q == ZIO_TASKQ_ISSUE)
	+ if (t == ZIO_TYPE_WRITE && q == ZIO_TASKQ_ISSUE) {
	+#if defined(__linux__)
	pri++;
	-
	+#elif defined(__FreeBSD__)
	+ pri += 4;
	+#else
	+#error "unknown OS"
	+#endif
	+ }
	tq = taskq_create_proc(name, value, pri, 50,
	INT_MAX, spa->spa_proc, flags);
	}

	tqs->stqs_taskq[i] = tq;
	}
	}

	static void
	spa_taskqs_fini(spa_t *spa, zio_type_t t, zio_taskq_type_t q)
	{
	spa_taskqs_t *tqs = &spa->spa_zio_taskq[t][q];

	if (tqs->stqs_taskq == NULL) {
	ASSERT3U(tqs->stqs_count, ==, 0);
	return;
	}

	for (uint_t i = 0; i < tqs->stqs_count; i++) {
	ASSERT3P(tqs->stqs_taskq[i], !=, NULL);
	taskq_destroy(tqs->stqs_taskq[i]);
	}

	kmem_free(tqs->stqs_taskq, tqs->stqs_count * sizeof (taskq_t *));
	tqs->stqs_taskq = NULL;
	}

	/*
	* Dispatch a task to the appropriate taskq for the ZFS I/O type and priority.
	* Note that a type may have multiple discrete taskqs to avoid lock contention
	* on the taskq itself. In that case we choose which taskq at random by using
	* the low bits of gethrtime().
	*/
	void
	spa_taskq_dispatch_ent(spa_t *spa, zio_type_t t, zio_taskq_type_t q,
	task_func_t func, void arg, uint_t flags, taskq_ent_t *ent)
	{
	spa_taskqs_t *tqs = &spa->spa_zio_taskq[t][q];
	taskq_t *tq;

	ASSERT3P(tqs->stqs_taskq, !=, NULL);
	ASSERT3U(tqs->stqs_count, !=, 0);

	if (tqs->stqs_count == 1) {
	tq = tqs->stqs_taskq[0];
	} else {
	tq = tqs->stqs_taskq[((uint64_t)gethrtime()) % tqs->stqs_count];
	}

	taskq_dispatch_ent(tq, func, arg, flags, ent);
	}

	/*
	* Same as spa_taskq_dispatch_ent() but block on the task until completion.
	*/
	void
	spa_taskq_dispatch_sync(spa_t *spa, zio_type_t t, zio_taskq_type_t q,
	task_func_t func, void arg, uint_t flags)
	{
	spa_taskqs_t *tqs = &spa->spa_zio_taskq[t][q];
	taskq_t *tq;
	taskqid_t id;

	ASSERT3P(tqs->stqs_taskq, !=, NULL);
	ASSERT3U(tqs->stqs_count, !=, 0);

	if (tqs->stqs_count == 1) {
	tq = tqs->stqs_taskq[0];
	} else {
	tq = tqs->stqs_taskq[((uint64_t)gethrtime()) % tqs->stqs_count];
	}

	id = taskq_dispatch(tq, func, arg, flags);
	if (id)
	taskq_wait_id(tq, id);
	}

	static void
	spa_create_zio_taskqs(spa_t *spa)
	{
	for (int t = 0; t < ZIO_TYPES; t++) {
	for (int q = 0; q < ZIO_TASKQ_TYPES; q++) {
	spa_taskqs_init(spa, t, q);
	}
	}
	}

	/*
	* Disabled until spa_thread() can be adapted for Linux.
	*/
	#undef HAVE_SPA_THREAD

	#if defined(_KERNEL) && defined(HAVE_SPA_THREAD)
	static void
	spa_thread(void *arg)
	{
	psetid_t zio_taskq_psrset_bind = PS_NONE;
	callb_cpr_t cprinfo;

	spa_t *spa = arg;
	user_t *pu = PTOU(curproc);

	CALLB_CPR_INIT(&cprinfo, &spa->spa_proc_lock, callb_generic_cpr,
	spa->spa_name);

	ASSERT(curproc != &p0);
	(void) snprintf(pu->u_psargs, sizeof (pu->u_psargs),
	"zpool-%s", spa->spa_name);
	(void) strlcpy(pu->u_comm, pu->u_psargs, sizeof (pu->u_comm));

	/* bind this thread to the requested psrset */
	if (zio_taskq_psrset_bind != PS_NONE) {
	pool_lock();
	mutex_enter(&cpu_lock);
	mutex_enter(&pidlock);
	mutex_enter(&curproc->p_lock);

	if (cpupart_bind_thread(curthread, zio_taskq_psrset_bind,
	0, NULL, NULL) == 0) {
	curthread->t_bind_pset = zio_taskq_psrset_bind;
	} else {
	cmn_err(CE_WARN,
	"Couldn't bind process for zfs pool \"%s\" to "
	"pset %d\n", spa->spa_name, zio_taskq_psrset_bind);
	}

	mutex_exit(&curproc->p_lock);
	mutex_exit(&pidlock);
	mutex_exit(&cpu_lock);
	pool_unlock();
	}

	if (zio_taskq_sysdc) {
	sysdc_thread_enter(curthread, 100, 0);
	}

	spa->spa_proc = curproc;
	spa->spa_did = curthread->t_did;

	spa_create_zio_taskqs(spa);

	mutex_enter(&spa->spa_proc_lock);
	ASSERT(spa->spa_proc_state == SPA_PROC_CREATED);

	spa->spa_proc_state = SPA_PROC_ACTIVE;
	cv_broadcast(&spa->spa_proc_cv);

	CALLB_CPR_SAFE_BEGIN(&cprinfo);
	while (spa->spa_proc_state == SPA_PROC_ACTIVE)
	cv_wait(&spa->spa_proc_cv, &spa->spa_proc_lock);
	CALLB_CPR_SAFE_END(&cprinfo, &spa->spa_proc_lock);

	ASSERT(spa->spa_proc_state == SPA_PROC_DEACTIVATE);
	spa->spa_proc_state = SPA_PROC_GONE;
	spa->spa_proc = &p0;
	cv_broadcast(&spa->spa_proc_cv);
	CALLB_CPR_EXIT(&cprinfo); /* drops spa_proc_lock */

	mutex_enter(&curproc->p_lock);
	lwp_exit();
	}
	#endif

	/*
	* Activate an uninitialized pool.
	*/
	static void
	spa_activate(spa_t *spa, spa_mode_t mode)
	{
	ASSERT(spa->spa_state == POOL_STATE_UNINITIALIZED);

	spa->spa_state = POOL_STATE_ACTIVE;
	spa->spa_mode = mode;

	spa->spa_normal_class = metaslab_class_create(spa, zfs_metaslab_ops);
	spa->spa_log_class = metaslab_class_create(spa, zfs_metaslab_ops);
	spa->spa_special_class = metaslab_class_create(spa, zfs_metaslab_ops);
	spa->spa_dedup_class = metaslab_class_create(spa, zfs_metaslab_ops);

	/* Try to create a covering process */
	mutex_enter(&spa->spa_proc_lock);
	ASSERT(spa->spa_proc_state == SPA_PROC_NONE);
	ASSERT(spa->spa_proc == &p0);
	spa->spa_did = 0;

	#ifdef HAVE_SPA_THREAD
	/* Only create a process if we're going to be around a while. */
	if (spa_create_process && strcmp(spa->spa_name, TRYIMPORT_NAME) != 0) {
	if (newproc(spa_thread, (caddr_t)spa, syscid, maxclsyspri,
	NULL, 0) == 0) {
	spa->spa_proc_state = SPA_PROC_CREATED;
	while (spa->spa_proc_state == SPA_PROC_CREATED) {
	cv_wait(&spa->spa_proc_cv,
	&spa->spa_proc_lock);
	}
	ASSERT(spa->spa_proc_state == SPA_PROC_ACTIVE);
	ASSERT(spa->spa_proc != &p0);
	ASSERT(spa->spa_did != 0);
	} else {
	#ifdef _KERNEL
	cmn_err(CE_WARN,
	"Couldn't create process for zfs pool \"%s\"\n",
	spa->spa_name);
	#endif
	}
	}
	#endif /* HAVE_SPA_THREAD */
	mutex_exit(&spa->spa_proc_lock);

	/* If we didn't create a process, we need to create our taskqs. */
	if (spa->spa_proc == &p0) {
	spa_create_zio_taskqs(spa);
	}

	for (size_t i = 0; i < TXG_SIZE; i++) {
	spa->spa_txg_zio[i] = zio_root(spa, NULL, NULL,
	ZIO_FLAG_CANFAIL);
	}

	list_create(&spa->spa_config_dirty_list, sizeof (vdev_t),
	offsetof(vdev_t, vdev_config_dirty_node));
	list_create(&spa->spa_evicting_os_list, sizeof (objset_t),
	offsetof(objset_t, os_evicting_node));
	list_create(&spa->spa_state_dirty_list, sizeof (vdev_t),
	offsetof(vdev_t, vdev_state_dirty_node));

	txg_list_create(&spa->spa_vdev_txg_list, spa,
	offsetof(struct vdev, vdev_txg_node));

	avl_create(&spa->spa_errlist_scrub,
	spa_error_entry_compare, sizeof (spa_error_entry_t),
	offsetof(spa_error_entry_t, se_avl));
	avl_create(&spa->spa_errlist_last,
	spa_error_entry_compare, sizeof (spa_error_entry_t),
	offsetof(spa_error_entry_t, se_avl));

	spa_keystore_init(&spa->spa_keystore);

	/*
	* This taskq is used to perform zvol-minor-related tasks
	* asynchronously. This has several advantages, including easy
	* resolution of various deadlocks (zfsonlinux bug #3681).
	*
	* The taskq must be single threaded to ensure tasks are always
	* processed in the order in which they were dispatched.
	*
	* A taskq per pool allows one to keep the pools independent.
	* This way if one pool is suspended, it will not impact another.
	*
	* The preferred location to dispatch a zvol minor task is a sync
	* task. In this context, there is easy access to the spa_t and minimal
	* error handling is required because the sync task must succeed.
	*/
	spa->spa_zvol_taskq = taskq_create("z_zvol", 1, defclsyspri,
	1, INT_MAX, 0);

	/*
	* Taskq dedicated to prefetcher threads: this is used to prevent the
	* pool traverse code from monopolizing the global (and limited)
	* system_taskq by inappropriately scheduling long running tasks on it.
	*/
	spa->spa_prefetch_taskq = taskq_create("z_prefetch", boot_ncpus,
	defclsyspri, 1, INT_MAX, TASKQ_DYNAMIC);

	/*
	* The taskq to upgrade datasets in this pool. Currently used by
	* feature SPA_FEATURE_USEROBJ_ACCOUNTING/SPA_FEATURE_PROJECT_QUOTA.
	*/
	spa->spa_upgrade_taskq = taskq_create("z_upgrade", boot_ncpus,
	defclsyspri, 1, INT_MAX, TASKQ_DYNAMIC);
	}

	/*
	* Opposite of spa_activate().
	*/
	static void
	spa_deactivate(spa_t *spa)
	{
	ASSERT(spa->spa_sync_on == B_FALSE);
	ASSERT(spa->spa_dsl_pool == NULL);
	ASSERT(spa->spa_root_vdev == NULL);
	ASSERT(spa->spa_async_zio_root == NULL);
	ASSERT(spa->spa_state != POOL_STATE_UNINITIALIZED);

	spa_evicting_os_wait(spa);

	if (spa->spa_zvol_taskq) {
	taskq_destroy(spa->spa_zvol_taskq);
	spa->spa_zvol_taskq = NULL;
	}

	if (spa->spa_prefetch_taskq) {
	taskq_destroy(spa->spa_prefetch_taskq);
	spa->spa_prefetch_taskq = NULL;
	}

	if (spa->spa_upgrade_taskq) {
	taskq_destroy(spa->spa_upgrade_taskq);
	spa->spa_upgrade_taskq = NULL;
	}

	txg_list_destroy(&spa->spa_vdev_txg_list);

	list_destroy(&spa->spa_config_dirty_list);
	list_destroy(&spa->spa_evicting_os_list);
	list_destroy(&spa->spa_state_dirty_list);

	taskq_cancel_id(system_delay_taskq, spa->spa_deadman_tqid);

	for (int t = 0; t < ZIO_TYPES; t++) {
	for (int q = 0; q < ZIO_TASKQ_TYPES; q++) {
	spa_taskqs_fini(spa, t, q);
	}
	}

	for (size_t i = 0; i < TXG_SIZE; i++) {
	ASSERT3P(spa->spa_txg_zio[i], !=, NULL);
	VERIFY0(zio_wait(spa->spa_txg_zio[i]));
	spa->spa_txg_zio[i] = NULL;
	}

	metaslab_class_destroy(spa->spa_normal_class);
	spa->spa_normal_class = NULL;

	metaslab_class_destroy(spa->spa_log_class);
	spa->spa_log_class = NULL;

	metaslab_class_destroy(spa->spa_special_class);
	spa->spa_special_class = NULL;

	metaslab_class_destroy(spa->spa_dedup_class);
	spa->spa_dedup_class = NULL;

	/*
	* If this was part of an import or the open otherwise failed, we may
	* still have errors left in the queues. Empty them just in case.
	*/
	spa_errlog_drain(spa);
	avl_destroy(&spa->spa_errlist_scrub);
	avl_destroy(&spa->spa_errlist_last);

	spa_keystore_fini(&spa->spa_keystore);

	spa->spa_state = POOL_STATE_UNINITIALIZED;

	mutex_enter(&spa->spa_proc_lock);
	if (spa->spa_proc_state != SPA_PROC_NONE) {
	ASSERT(spa->spa_proc_state == SPA_PROC_ACTIVE);
	spa->spa_proc_state = SPA_PROC_DEACTIVATE;
	cv_broadcast(&spa->spa_proc_cv);
	while (spa->spa_proc_state == SPA_PROC_DEACTIVATE) {
	ASSERT(spa->spa_proc != &p0);
	cv_wait(&spa->spa_proc_cv, &spa->spa_proc_lock);
	}
	ASSERT(spa->spa_proc_state == SPA_PROC_GONE);
	spa->spa_proc_state = SPA_PROC_NONE;
	}
	ASSERT(spa->spa_proc == &p0);
	mutex_exit(&spa->spa_proc_lock);

	/*
	* We want to make sure spa_thread() has actually exited the ZFS
	* module, so that the module can't be unloaded out from underneath
	* it.
	*/
	if (spa->spa_did != 0) {
	thread_join(spa->spa_did);
	spa->spa_did = 0;
	}
	}

	/*
	* Verify a pool configuration, and construct the vdev tree appropriately. This
	* will create all the necessary vdevs in the appropriate layout, with each vdev
	* in the CLOSED state. This will prep the pool before open/creation/import.
	* All vdev validation is done by the vdev_alloc() routine.
	*/
	int
	spa_config_parse(spa_t spa, vdev_t vdp, nvlist_t nv, vdev_t *parent,
	uint_t id, int atype)
	{
	nvlist_t **child;
	uint_t children;
	int error;

	if ((error = vdev_alloc(spa, vdp, nv, parent, id, atype)) != 0)
	return (error);

	if ((*vdp)->vdev_ops->vdev_op_leaf)
	return (0);

	error = nvlist_lookup_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	&child, &children);

	if (error == ENOENT)
	return (0);

	if (error) {
	vdev_free(*vdp);
	*vdp = NULL;
	return (SET_ERROR(EINVAL));
	}

	for (int c = 0; c < children; c++) {
	vdev_t *vd;
	if ((error = spa_config_parse(spa, &vd, child[c], *vdp, c,
	atype)) != 0) {
	vdev_free(*vdp);
	*vdp = NULL;
	return (error);
	}
	}

	ASSERT(*vdp != NULL);

	return (0);
	}

	static boolean_t
	spa_should_flush_logs_on_unload(spa_t *spa)
	{
	if (!spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP))
	return (B_FALSE);

	if (!spa_writeable(spa))
	return (B_FALSE);

	if (!spa->spa_sync_on)
	return (B_FALSE);

	if (spa_state(spa) != POOL_STATE_EXPORTED)
	return (B_FALSE);

	if (zfs_keep_log_spacemaps_at_export)
	return (B_FALSE);

	return (B_TRUE);
	}

	/*
	* Opens a transaction that will set the flag that will instruct
	* spa_sync to attempt to flush all the metaslabs for that txg.
	*/
	static void
	spa_unload_log_sm_flush_all(spa_t *spa)
	{
	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));

	ASSERT3U(spa->spa_log_flushall_txg, ==, 0);
	spa->spa_log_flushall_txg = dmu_tx_get_txg(tx);

	dmu_tx_commit(tx);
	txg_wait_synced(spa_get_dsl(spa), spa->spa_log_flushall_txg);
	}

	static void
	spa_unload_log_sm_metadata(spa_t *spa)
	{
	void *cookie = NULL;
	spa_log_sm_t *sls;
	while ((sls = avl_destroy_nodes(&spa->spa_sm_logs_by_txg,
	&cookie)) != NULL) {
	VERIFY0(sls->sls_mscount);
	kmem_free(sls, sizeof (spa_log_sm_t));
	}

	for (log_summary_entry_t *e = list_head(&spa->spa_log_summary);
	e != NULL; e = list_head(&spa->spa_log_summary)) {
	VERIFY0(e->lse_mscount);
	list_remove(&spa->spa_log_summary, e);
	kmem_free(e, sizeof (log_summary_entry_t));
	}

	spa->spa_unflushed_stats.sus_nblocks = 0;
	spa->spa_unflushed_stats.sus_memused = 0;
	spa->spa_unflushed_stats.sus_blocklimit = 0;
	}

	static void
	spa_destroy_aux_threads(spa_t *spa)
	{
	if (spa->spa_condense_zthr != NULL) {
	zthr_destroy(spa->spa_condense_zthr);
	spa->spa_condense_zthr = NULL;
	}
	if (spa->spa_checkpoint_discard_zthr != NULL) {
	zthr_destroy(spa->spa_checkpoint_discard_zthr);
	spa->spa_checkpoint_discard_zthr = NULL;
	}
	if (spa->spa_livelist_delete_zthr != NULL) {
	zthr_destroy(spa->spa_livelist_delete_zthr);
	spa->spa_livelist_delete_zthr = NULL;
	}
	if (spa->spa_livelist_condense_zthr != NULL) {
	zthr_destroy(spa->spa_livelist_condense_zthr);
	spa->spa_livelist_condense_zthr = NULL;
	}
	}

	/*
	* Opposite of spa_load().
	*/
	static void
	spa_unload(spa_t *spa)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	ASSERT(spa_state(spa) != POOL_STATE_UNINITIALIZED);

	spa_import_progress_remove(spa_guid(spa));
	spa_load_note(spa, "UNLOADING");

	spa_wake_waiters(spa);

	/*
	* If the log space map feature is enabled and the pool is getting
	* exported (but not destroyed), we want to spend some time flushing
	* as many metaslabs as we can in an attempt to destroy log space
	* maps and save import time.
	*/
	if (spa_should_flush_logs_on_unload(spa))
	spa_unload_log_sm_flush_all(spa);

	/*
	* Stop async tasks.
	*/
	spa_async_suspend(spa);

	if (spa->spa_root_vdev) {
	vdev_t *root_vdev = spa->spa_root_vdev;
	vdev_initialize_stop_all(root_vdev, VDEV_INITIALIZE_ACTIVE);
	vdev_trim_stop_all(root_vdev, VDEV_TRIM_ACTIVE);
	vdev_autotrim_stop_all(spa);
	vdev_rebuild_stop_all(spa);
	}

	/*
	* Stop syncing.
	*/
	if (spa->spa_sync_on) {
	txg_sync_stop(spa->spa_dsl_pool);
	spa->spa_sync_on = B_FALSE;
	}

	/*
	* This ensures that there is no async metaslab prefetching
	* while we attempt to unload the spa.
	*/
	if (spa->spa_root_vdev != NULL) {
	for (int c = 0; c < spa->spa_root_vdev->vdev_children; c++) {
	vdev_t *vc = spa->spa_root_vdev->vdev_child[c];
	if (vc->vdev_mg != NULL)
	taskq_wait(vc->vdev_mg->mg_taskq);
	}
	}

	if (spa->spa_mmp.mmp_thread)
	mmp_thread_stop(spa);

	/*
	* Wait for any outstanding async I/O to complete.
	*/
	if (spa->spa_async_zio_root != NULL) {
	for (int i = 0; i < max_ncpus; i++)
	(void) zio_wait(spa->spa_async_zio_root[i]);
	kmem_free(spa->spa_async_zio_root, max_ncpus * sizeof (void *));
	spa->spa_async_zio_root = NULL;
	}

	if (spa->spa_vdev_removal != NULL) {
	spa_vdev_removal_destroy(spa->spa_vdev_removal);
	spa->spa_vdev_removal = NULL;
	}

	spa_destroy_aux_threads(spa);

	spa_condense_fini(spa);

	bpobj_close(&spa->spa_deferred_bpobj);

	spa_config_enter(spa, SCL_ALL, spa, RW_WRITER);

	/*
	* Close all vdevs.
	*/
	if (spa->spa_root_vdev)
	vdev_free(spa->spa_root_vdev);
	ASSERT(spa->spa_root_vdev == NULL);

	/*
	* Close the dsl pool.
	*/
	if (spa->spa_dsl_pool) {
	dsl_pool_close(spa->spa_dsl_pool);
	spa->spa_dsl_pool = NULL;
	spa->spa_meta_objset = NULL;
	}

	ddt_unload(spa);
	spa_unload_log_sm_metadata(spa);

	/*
	* Drop and purge level 2 cache
	*/
	spa_l2cache_drop(spa);

	for (int i = 0; i < spa->spa_spares.sav_count; i++)
	vdev_free(spa->spa_spares.sav_vdevs[i]);
	if (spa->spa_spares.sav_vdevs) {
	kmem_free(spa->spa_spares.sav_vdevs,
	spa->spa_spares.sav_count * sizeof (void *));
	spa->spa_spares.sav_vdevs = NULL;
	}
	if (spa->spa_spares.sav_config) {
	nvlist_free(spa->spa_spares.sav_config);
	spa->spa_spares.sav_config = NULL;
	}
	spa->spa_spares.sav_count = 0;

	for (int i = 0; i < spa->spa_l2cache.sav_count; i++) {
	vdev_clear_stats(spa->spa_l2cache.sav_vdevs[i]);
	vdev_free(spa->spa_l2cache.sav_vdevs[i]);
	}
	if (spa->spa_l2cache.sav_vdevs) {
	kmem_free(spa->spa_l2cache.sav_vdevs,
	spa->spa_l2cache.sav_count * sizeof (void *));
	spa->spa_l2cache.sav_vdevs = NULL;
	}
	if (spa->spa_l2cache.sav_config) {
	nvlist_free(spa->spa_l2cache.sav_config);
	spa->spa_l2cache.sav_config = NULL;
	}
	spa->spa_l2cache.sav_count = 0;

	spa->spa_async_suspended = 0;

	spa->spa_indirect_vdevs_loaded = B_FALSE;

	if (spa->spa_comment != NULL) {
	spa_strfree(spa->spa_comment);
	spa->spa_comment = NULL;
	}

	spa_config_exit(spa, SCL_ALL, spa);
	}

	/*
	* Load (or re-load) the current list of vdevs describing the active spares for
	* this pool. When this is called, we have some form of basic information in
	* 'spa_spares.sav_config'. We parse this into vdevs, try to open them, and
	* then re-generate a more complete list including status information.
	*/
	void
	spa_load_spares(spa_t *spa)
	{
	nvlist_t **spares;
	uint_t nspares;
	int i;
	vdev_t vd, tvd;

	#ifndef _KERNEL
	/*
	* zdb opens both the current state of the pool and the
	* checkpointed state (if present), with a different spa_t.
	*
	* As spare vdevs are shared among open pools, we skip loading
	* them when we load the checkpointed state of the pool.
	*/
	if (!spa_writeable(spa))
	return;
	#endif

	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	/*
	* First, close and free any existing spare vdevs.
	*/
	for (i = 0; i < spa->spa_spares.sav_count; i++) {
	vd = spa->spa_spares.sav_vdevs[i];

	/* Undo the call to spa_activate() below */
	if ((tvd = spa_lookup_by_guid(spa, vd->vdev_guid,
	B_FALSE)) != NULL && tvd->vdev_isspare)
	spa_spare_remove(tvd);
	vdev_close(vd);
	vdev_free(vd);
	}

	if (spa->spa_spares.sav_vdevs)
	kmem_free(spa->spa_spares.sav_vdevs,
	spa->spa_spares.sav_count * sizeof (void *));

	if (spa->spa_spares.sav_config == NULL)
	nspares = 0;
	else
	VERIFY(nvlist_lookup_nvlist_array(spa->spa_spares.sav_config,
	ZPOOL_CONFIG_SPARES, &spares, &nspares) == 0);

	spa->spa_spares.sav_count = (int)nspares;
	spa->spa_spares.sav_vdevs = NULL;

	if (nspares == 0)
	return;

	/*
	* Construct the array of vdevs, opening them to get status in the
	* process. For each spare, there is potentially two different vdev_t
	* structures associated with it: one in the list of spares (used only
	* for basic validation purposes) and one in the active vdev
	* configuration (if it's spared in). During this phase we open and
	* validate each vdev on the spare list. If the vdev also exists in the
	* active configuration, then we also mark this vdev as an active spare.
	*/
	spa->spa_spares.sav_vdevs = kmem_zalloc(nspares * sizeof (void *),
	KM_SLEEP);
	for (i = 0; i < spa->spa_spares.sav_count; i++) {
	VERIFY(spa_config_parse(spa, &vd, spares[i], NULL, 0,
	VDEV_ALLOC_SPARE) == 0);
	ASSERT(vd != NULL);

	spa->spa_spares.sav_vdevs[i] = vd;

	if ((tvd = spa_lookup_by_guid(spa, vd->vdev_guid,
	B_FALSE)) != NULL) {
	if (!tvd->vdev_isspare)
	spa_spare_add(tvd);

	/*
	* We only mark the spare active if we were successfully
	* able to load the vdev. Otherwise, importing a pool
	* with a bad active spare would result in strange
	* behavior, because multiple pool would think the spare
	* is actively in use.
	*
	* There is a vulnerability here to an equally bizarre
	* circumstance, where a dead active spare is later
	* brought back to life (onlined or otherwise). Given
	* the rarity of this scenario, and the extra complexity
	* it adds, we ignore the possibility.
	*/
	if (!vdev_is_dead(tvd))
	spa_spare_activate(tvd);
	}

	vd->vdev_top = vd;
	vd->vdev_aux = &spa->spa_spares;

	if (vdev_open(vd) != 0)
	continue;

	if (vdev_validate_aux(vd) == 0)
	spa_spare_add(vd);
	}

	/*
	* Recompute the stashed list of spares, with status information
	* this time.
	*/
	VERIFY(nvlist_remove(spa->spa_spares.sav_config, ZPOOL_CONFIG_SPARES,
	DATA_TYPE_NVLIST_ARRAY) == 0);

	spares = kmem_alloc(spa->spa_spares.sav_count * sizeof (void *),
	KM_SLEEP);
	for (i = 0; i < spa->spa_spares.sav_count; i++)
	spares[i] = vdev_config_generate(spa,
	spa->spa_spares.sav_vdevs[i], B_TRUE, VDEV_CONFIG_SPARE);
	VERIFY(nvlist_add_nvlist_array(spa->spa_spares.sav_config,
	ZPOOL_CONFIG_SPARES, spares, spa->spa_spares.sav_count) == 0);
	for (i = 0; i < spa->spa_spares.sav_count; i++)
	nvlist_free(spares[i]);
	kmem_free(spares, spa->spa_spares.sav_count * sizeof (void *));
	}

	/*
	* Load (or re-load) the current list of vdevs describing the active l2cache for
	* this pool. When this is called, we have some form of basic information in
	* 'spa_l2cache.sav_config'. We parse this into vdevs, try to open them, and
	* then re-generate a more complete list including status information.
	* Devices which are already active have their details maintained, and are
	* not re-opened.
	*/
	void
	spa_load_l2cache(spa_t *spa)
	{
	nvlist_t **l2cache = NULL;
	uint_t nl2cache;
	int i, j, oldnvdevs;
	uint64_t guid;
	vdev_t vd, oldvdevs, *newvdevs;
	spa_aux_vdev_t *sav = &spa->spa_l2cache;

	#ifndef _KERNEL
	/*
	* zdb opens both the current state of the pool and the
	* checkpointed state (if present), with a different spa_t.
	*
	* As L2 caches are part of the ARC which is shared among open
	* pools, we skip loading them when we load the checkpointed
	* state of the pool.
	*/
	if (!spa_writeable(spa))
	return;
	#endif

	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	oldvdevs = sav->sav_vdevs;
	oldnvdevs = sav->sav_count;
	sav->sav_vdevs = NULL;
	sav->sav_count = 0;

	if (sav->sav_config == NULL) {
	nl2cache = 0;
	newvdevs = NULL;
	goto out;
	}

	VERIFY(nvlist_lookup_nvlist_array(sav->sav_config,
	ZPOOL_CONFIG_L2CACHE, &l2cache, &nl2cache) == 0);
	newvdevs = kmem_alloc(nl2cache * sizeof (void *), KM_SLEEP);

	/*
	* Process new nvlist of vdevs.
	*/
	for (i = 0; i < nl2cache; i++) {
	VERIFY(nvlist_lookup_uint64(l2cache[i], ZPOOL_CONFIG_GUID,
	&guid) == 0);

	newvdevs[i] = NULL;
	for (j = 0; j < oldnvdevs; j++) {
	vd = oldvdevs[j];
	if (vd != NULL && guid == vd->vdev_guid) {
	/*
	* Retain previous vdev for add/remove ops.
	*/
	newvdevs[i] = vd;
	oldvdevs[j] = NULL;
	break;
	}
	}

	if (newvdevs[i] == NULL) {
	/*
	* Create new vdev
	*/
	VERIFY(spa_config_parse(spa, &vd, l2cache[i], NULL, 0,
	VDEV_ALLOC_L2CACHE) == 0);
	ASSERT(vd != NULL);
	newvdevs[i] = vd;

	/*
	* Commit this vdev as an l2cache device,
	* even if it fails to open.
	*/
	spa_l2cache_add(vd);

	vd->vdev_top = vd;
	vd->vdev_aux = sav;

	spa_l2cache_activate(vd);

	if (vdev_open(vd) != 0)
	continue;

	(void) vdev_validate_aux(vd);

	if (!vdev_is_dead(vd))
	l2arc_add_vdev(spa, vd);

	/*
	* Upon cache device addition to a pool or pool
	* creation with a cache device or if the header
	* of the device is invalid we issue an async
	* TRIM command for the whole device which will
	* execute if l2arc_trim_ahead > 0.
	*/
	spa_async_request(spa, SPA_ASYNC_L2CACHE_TRIM);
	}
	}

	sav->sav_vdevs = newvdevs;
	sav->sav_count = (int)nl2cache;

	/*
	* Recompute the stashed list of l2cache devices, with status
	* information this time.
	*/
	VERIFY(nvlist_remove(sav->sav_config, ZPOOL_CONFIG_L2CACHE,
	DATA_TYPE_NVLIST_ARRAY) == 0);

	if (sav->sav_count > 0)
	l2cache = kmem_alloc(sav->sav_count * sizeof (void *),
	KM_SLEEP);
	for (i = 0; i < sav->sav_count; i++)
	l2cache[i] = vdev_config_generate(spa,
	sav->sav_vdevs[i], B_TRUE, VDEV_CONFIG_L2CACHE);
	VERIFY(nvlist_add_nvlist_array(sav->sav_config,
	ZPOOL_CONFIG_L2CACHE, l2cache, sav->sav_count) == 0);

	out:
	/*
	* Purge vdevs that were dropped
	*/
	for (i = 0; i < oldnvdevs; i++) {
	uint64_t pool;

	vd = oldvdevs[i];
	if (vd != NULL) {
	ASSERT(vd->vdev_isl2cache);

	if (spa_l2cache_exists(vd->vdev_guid, &pool) &&
	pool != 0ULL && l2arc_vdev_present(vd))
	l2arc_remove_vdev(vd);
	vdev_clear_stats(vd);
	vdev_free(vd);
	}
	}

	if (oldvdevs)
	kmem_free(oldvdevs, oldnvdevs * sizeof (void *));

	for (i = 0; i < sav->sav_count; i++)
	nvlist_free(l2cache[i]);
	if (sav->sav_count)
	kmem_free(l2cache, sav->sav_count * sizeof (void *));
	}

	static int
	load_nvlist(spa_t spa, uint64_t obj, nvlist_t *value)
	{
	dmu_buf_t *db;
	char *packed = NULL;
	size_t nvsize = 0;
	int error;
	*value = NULL;

	error = dmu_bonus_hold(spa->spa_meta_objset, obj, FTAG, &db);
	if (error)
	return (error);

	nvsize = (uint64_t )db->db_data;
	dmu_buf_rele(db, FTAG);

	packed = vmem_alloc(nvsize, KM_SLEEP);
	error = dmu_read(spa->spa_meta_objset, obj, 0, nvsize, packed,
	DMU_READ_PREFETCH);
	if (error == 0)
	error = nvlist_unpack(packed, nvsize, value, 0);
	vmem_free(packed, nvsize);

	return (error);
	}

	/*
	* Concrete top-level vdevs that are not missing and are not logs. At every
	* spa_sync we write new uberblocks to at least SPA_SYNC_MIN_VDEVS core tvds.
	*/
	static uint64_t
	spa_healthy_core_tvds(spa_t *spa)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	uint64_t tvds = 0;

	for (uint64_t i = 0; i < rvd->vdev_children; i++) {
	vdev_t *vd = rvd->vdev_child[i];
	if (vd->vdev_islog)
	continue;
	if (vdev_is_concrete(vd) && !vdev_is_dead(vd))
	tvds++;
	}

	return (tvds);
	}

	/*
	* Checks to see if the given vdev could not be opened, in which case we post a
	* sysevent to notify the autoreplace code that the device has been removed.
	*/
	static void
	spa_check_removed(vdev_t *vd)
	{
	for (uint64_t c = 0; c < vd->vdev_children; c++)
	spa_check_removed(vd->vdev_child[c]);

	if (vd->vdev_ops->vdev_op_leaf && vdev_is_dead(vd) &&
	vdev_is_concrete(vd)) {
	zfs_post_autoreplace(vd->vdev_spa, vd);
	spa_event_notify(vd->vdev_spa, vd, NULL, ESC_ZFS_VDEV_CHECK);
	}
	}

	static int
	spa_check_for_missing_logs(spa_t *spa)
	{
	vdev_t *rvd = spa->spa_root_vdev;

	/*
	* If we're doing a normal import, then build up any additional
	* diagnostic information about missing log devices.
	* We'll pass this up to the user for further processing.
	*/
	if (!(spa->spa_import_flags & ZFS_IMPORT_MISSING_LOG)) {
	nvlist_t *child, nv;
	uint64_t idx = 0;

	child = kmem_alloc(rvd->vdev_children * sizeof (nvlist_t *),
	KM_SLEEP);
	VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);

	for (uint64_t c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];

	/*
	* We consider a device as missing only if it failed
	* to open (i.e. offline or faulted is not considered
	* as missing).
	*/
	if (tvd->vdev_islog &&
	tvd->vdev_state == VDEV_STATE_CANT_OPEN) {
	child[idx++] = vdev_config_generate(spa, tvd,
	B_FALSE, VDEV_CONFIG_MISSING);
	}
	}

	if (idx > 0) {
	fnvlist_add_nvlist_array(nv,
	ZPOOL_CONFIG_CHILDREN, child, idx);
	fnvlist_add_nvlist(spa->spa_load_info,
	ZPOOL_CONFIG_MISSING_DEVICES, nv);

	for (uint64_t i = 0; i < idx; i++)
	nvlist_free(child[i]);
	}
	nvlist_free(nv);
	kmem_free(child, rvd->vdev_children * sizeof (char **));

	if (idx > 0) {
	spa_load_failed(spa, "some log devices are missing");
	vdev_dbgmsg_print_tree(rvd, 2);
	return (SET_ERROR(ENXIO));
	}
	} else {
	for (uint64_t c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];

	if (tvd->vdev_islog &&
	tvd->vdev_state == VDEV_STATE_CANT_OPEN) {
	spa_set_log_state(spa, SPA_LOG_CLEAR);
	spa_load_note(spa, "some log devices are "
	"missing, ZIL is dropped.");
	vdev_dbgmsg_print_tree(rvd, 2);
	break;
	}
	}
	}

	return (0);
	}

	/*
	* Check for missing log devices
	*/
	static boolean_t
	spa_check_logs(spa_t *spa)
	{
	boolean_t rv = B_FALSE;
	dsl_pool_t *dp = spa_get_dsl(spa);

	switch (spa->spa_log_state) {
	default:
	break;
	case SPA_LOG_MISSING:
	/* need to recheck in case slog has been restored */
	case SPA_LOG_UNKNOWN:
	rv = (dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
	zil_check_log_chain, NULL, DS_FIND_CHILDREN) != 0);
	if (rv)
	spa_set_log_state(spa, SPA_LOG_MISSING);
	break;
	}
	return (rv);
	}

	static boolean_t
	spa_passivate_log(spa_t *spa)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	boolean_t slog_found = B_FALSE;

	ASSERT(spa_config_held(spa, SCL_ALLOC, RW_WRITER));

	if (!spa_has_slogs(spa))
	return (B_FALSE);

	for (int c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];
	metaslab_group_t *mg = tvd->vdev_mg;

	if (tvd->vdev_islog) {
	metaslab_group_passivate(mg);
	slog_found = B_TRUE;
	}
	}

	return (slog_found);
	}

	static void
	spa_activate_log(spa_t *spa)
	{
	vdev_t *rvd = spa->spa_root_vdev;

	ASSERT(spa_config_held(spa, SCL_ALLOC, RW_WRITER));

	for (int c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];
	metaslab_group_t *mg = tvd->vdev_mg;

	if (tvd->vdev_islog)
	metaslab_group_activate(mg);
	}
	}

	int
	spa_reset_logs(spa_t *spa)
	{
	int error;

	error = dmu_objset_find(spa_name(spa), zil_reset,
	NULL, DS_FIND_CHILDREN);
	if (error == 0) {
	/*
	* We successfully offlined the log device, sync out the
	* current txg so that the "stubby" block can be removed
	* by zil_sync().
	*/
	txg_wait_synced(spa->spa_dsl_pool, 0);
	}
	return (error);
	}

	static void
	spa_aux_check_removed(spa_aux_vdev_t *sav)
	{
	for (int i = 0; i < sav->sav_count; i++)
	spa_check_removed(sav->sav_vdevs[i]);
	}

	void
	spa_claim_notify(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;

	if (zio->io_error)
	return;

	mutex_enter(&spa->spa_props_lock); /* any mutex will do */
	if (spa->spa_claim_max_txg < zio->io_bp->blk_birth)
	spa->spa_claim_max_txg = zio->io_bp->blk_birth;
	mutex_exit(&spa->spa_props_lock);
	}

	typedef struct spa_load_error {
	uint64_t sle_meta_count;
	uint64_t sle_data_count;
	} spa_load_error_t;

	static void
	spa_load_verify_done(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;
	spa_load_error_t *sle = zio->io_private;
	dmu_object_type_t type = BP_GET_TYPE(bp);
	int error = zio->io_error;
	spa_t *spa = zio->io_spa;

	abd_free(zio->io_abd);
	if (error) {
	if ((BP_GET_LEVEL(bp) != 0 \|\| DMU_OT_IS_METADATA(type)) &&
	type != DMU_OT_INTENT_LOG)
	atomic_inc_64(&sle->sle_meta_count);
	else
	atomic_inc_64(&sle->sle_data_count);
	}

	mutex_enter(&spa->spa_scrub_lock);
	spa->spa_load_verify_bytes -= BP_GET_PSIZE(bp);
	cv_broadcast(&spa->spa_scrub_io_cv);
	mutex_exit(&spa->spa_scrub_lock);
	}

	/*
	* Maximum number of inflight bytes is the log2 fraction of the arc size.
	* By default, we set it to 1/16th of the arc.
	*/
	int spa_load_verify_shift = 4;
	int spa_load_verify_metadata = B_TRUE;
	int spa_load_verify_data = B_TRUE;

	/ARGSUSED/
	static int
	spa_load_verify_cb(spa_t spa, zilog_t zilog, const blkptr_t *bp,
	const zbookmark_phys_t zb, const dnode_phys_t dnp, void *arg)
	{
	if (zb->zb_level == ZB_DNODE_LEVEL \|\| BP_IS_HOLE(bp) \|\|
	BP_IS_EMBEDDED(bp) \|\| BP_IS_REDACTED(bp))
	return (0);
	/*
	* Note: normally this routine will not be called if
	* spa_load_verify_metadata is not set. However, it may be useful
	* to manually set the flag after the traversal has begun.
	*/
	if (!spa_load_verify_metadata)
	return (0);
	if (!BP_IS_METADATA(bp) && !spa_load_verify_data)
	return (0);

	uint64_t maxinflight_bytes =
	arc_target_bytes() >> spa_load_verify_shift;
	zio_t *rio = arg;
	size_t size = BP_GET_PSIZE(bp);

	mutex_enter(&spa->spa_scrub_lock);
	while (spa->spa_load_verify_bytes >= maxinflight_bytes)
	cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
	spa->spa_load_verify_bytes += size;
	mutex_exit(&spa->spa_scrub_lock);

	zio_nowait(zio_read(rio, spa, bp, abd_alloc_for_io(size, B_FALSE), size,
	spa_load_verify_done, rio->io_private, ZIO_PRIORITY_SCRUB,
	ZIO_FLAG_SPECULATIVE \| ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_SCRUB \| ZIO_FLAG_RAW, zb));
	return (0);
	}

	/* ARGSUSED */
	static int
	verify_dataset_name_len(dsl_pool_t dp, dsl_dataset_t ds, void *arg)
	{
	if (dsl_dataset_namelen(ds) >= ZFS_MAX_DATASET_NAME_LEN)
	return (SET_ERROR(ENAMETOOLONG));

	return (0);
	}

	static int
	spa_load_verify(spa_t *spa)
	{
	zio_t *rio;
	spa_load_error_t sle = { 0 };
	zpool_load_policy_t policy;
	boolean_t verify_ok = B_FALSE;
	int error = 0;

	zpool_get_load_policy(spa->spa_config, &policy);

	if (policy.zlp_rewind & ZPOOL_NEVER_REWIND)
	return (0);

	dsl_pool_config_enter(spa->spa_dsl_pool, FTAG);
	error = dmu_objset_find_dp(spa->spa_dsl_pool,
	spa->spa_dsl_pool->dp_root_dir_obj, verify_dataset_name_len, NULL,
	DS_FIND_CHILDREN);
	dsl_pool_config_exit(spa->spa_dsl_pool, FTAG);
	if (error != 0)
	return (error);

	rio = zio_root(spa, NULL, &sle,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE);

	if (spa_load_verify_metadata) {
	if (spa->spa_extreme_rewind) {
	spa_load_note(spa, "performing a complete scan of the "
	"pool since extreme rewind is on. This may take "
	"a very long time.\n (spa_load_verify_data=%u, "
	"spa_load_verify_metadata=%u)",
	spa_load_verify_data, spa_load_verify_metadata);
	}

	error = traverse_pool(spa, spa->spa_verify_min_txg,
	TRAVERSE_PRE \| TRAVERSE_PREFETCH_METADATA \|
	TRAVERSE_NO_DECRYPT, spa_load_verify_cb, rio);
	}

	(void) zio_wait(rio);
	ASSERT0(spa->spa_load_verify_bytes);

	spa->spa_load_meta_errors = sle.sle_meta_count;
	spa->spa_load_data_errors = sle.sle_data_count;

	if (sle.sle_meta_count != 0 \|\| sle.sle_data_count != 0) {
	spa_load_note(spa, "spa_load_verify found %llu metadata errors "
	"and %llu data errors", (u_longlong_t)sle.sle_meta_count,
	(u_longlong_t)sle.sle_data_count);
	}

	if (spa_load_verify_dryrun \|\|
	(!error && sle.sle_meta_count <= policy.zlp_maxmeta &&
	sle.sle_data_count <= policy.zlp_maxdata)) {
	int64_t loss = 0;

	verify_ok = B_TRUE;
	spa->spa_load_txg = spa->spa_uberblock.ub_txg;
	spa->spa_load_txg_ts = spa->spa_uberblock.ub_timestamp;

	loss = spa->spa_last_ubsync_txg_ts - spa->spa_load_txg_ts;
	VERIFY(nvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_LOAD_TIME, spa->spa_load_txg_ts) == 0);
	VERIFY(nvlist_add_int64(spa->spa_load_info,
	ZPOOL_CONFIG_REWIND_TIME, loss) == 0);
	VERIFY(nvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_LOAD_DATA_ERRORS, sle.sle_data_count) == 0);
	} else {
	spa->spa_load_max_txg = spa->spa_uberblock.ub_txg;
	}

	if (spa_load_verify_dryrun)
	return (0);

	if (error) {
	if (error != ENXIO && error != EIO)
	error = SET_ERROR(EIO);
	return (error);
	}

	return (verify_ok ? 0 : EIO);
	}

	/*
	* Find a value in the pool props object.
	*/
	static void
	spa_prop_find(spa_t spa, zpool_prop_t prop, uint64_t val)
	{
	(void) zap_lookup(spa->spa_meta_objset, spa->spa_pool_props_object,
	zpool_prop_to_name(prop), sizeof (uint64_t), 1, val);
	}

	/*
	* Find a value in the pool directory object.
	*/
	static int
	spa_dir_prop(spa_t spa, const char name, uint64_t *val, boolean_t log_enoent)
	{
	int error = zap_lookup(spa->spa_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	name, sizeof (uint64_t), 1, val);

	if (error != 0 && (error != ENOENT \|\| log_enoent)) {
	spa_load_failed(spa, "couldn't get '%s' value in MOS directory "
	"[error=%d]", name, error);
	}

	return (error);
	}

	static int
	spa_vdev_err(vdev_t *vdev, vdev_aux_t aux, int err)
	{
	vdev_set_state(vdev, B_TRUE, VDEV_STATE_CANT_OPEN, aux);
	return (SET_ERROR(err));
	}

	boolean_t
	spa_livelist_delete_check(spa_t *spa)
	{
	return (spa->spa_livelists_to_delete != 0);
	}

	/* ARGSUSED */
	static boolean_t
	spa_livelist_delete_cb_check(void arg, zthr_t z)
	{
	spa_t *spa = arg;
	return (spa_livelist_delete_check(spa));
	}

	static int
	delete_blkptr_cb(void arg, const blkptr_t bp, dmu_tx_t *tx)
	{
	spa_t *spa = arg;
	zio_free(spa, tx->tx_txg, bp);
	dsl_dir_diduse_space(tx->tx_pool->dp_free_dir, DD_USED_HEAD,
	-bp_get_dsize_sync(spa, bp),
	-BP_GET_PSIZE(bp), -BP_GET_UCSIZE(bp), tx);
	return (0);
	}

	static int
	dsl_get_next_livelist_obj(objset_t os, uint64_t zap_obj, uint64_t llp)
	{
	int err;
	zap_cursor_t zc;
	zap_attribute_t za;
	zap_cursor_init(&zc, os, zap_obj);
	err = zap_cursor_retrieve(&zc, &za);
	zap_cursor_fini(&zc);
	if (err == 0)
	*llp = za.za_first_integer;
	return (err);
	}

	/*
	* Components of livelist deletion that must be performed in syncing
	* context: freeing block pointers and updating the pool-wide data
	* structures to indicate how much work is left to do
	*/
	typedef struct sublist_delete_arg {
	spa_t *spa;
	dsl_deadlist_t *ll;
	uint64_t key;
	bplist_t *to_free;
	} sublist_delete_arg_t;

	static void
	sublist_delete_sync(void arg, dmu_tx_t tx)
	{
	sublist_delete_arg_t *sda = arg;
	spa_t *spa = sda->spa;
	dsl_deadlist_t *ll = sda->ll;
	uint64_t key = sda->key;
	bplist_t *to_free = sda->to_free;

	bplist_iterate(to_free, delete_blkptr_cb, spa, tx);
	dsl_deadlist_remove_entry(ll, key, tx);
	}

	typedef struct livelist_delete_arg {
	spa_t *spa;
	uint64_t ll_obj;
	uint64_t zap_obj;
	} livelist_delete_arg_t;

	static void
	livelist_delete_sync(void arg, dmu_tx_t tx)
	{
	livelist_delete_arg_t *lda = arg;
	spa_t *spa = lda->spa;
	uint64_t ll_obj = lda->ll_obj;
	uint64_t zap_obj = lda->zap_obj;
	objset_t *mos = spa->spa_meta_objset;
	uint64_t count;

	/* free the livelist and decrement the feature count */
	VERIFY0(zap_remove_int(mos, zap_obj, ll_obj, tx));
	dsl_deadlist_free(mos, ll_obj, tx);
	spa_feature_decr(spa, SPA_FEATURE_LIVELIST, tx);
	VERIFY0(zap_count(mos, zap_obj, &count));
	if (count == 0) {
	/* no more livelists to delete */
	VERIFY0(zap_remove(mos, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_DELETED_CLONES, tx));
	VERIFY0(zap_destroy(mos, zap_obj, tx));
	spa->spa_livelists_to_delete = 0;
	spa_notify_waiters(spa);
	}
	}

	/*
	* Load in the value for the livelist to be removed and open it. Then,
	* load its first sublist and determine which block pointers should actually
	* be freed. Then, call a synctask which performs the actual frees and updates
	* the pool-wide livelist data.
	*/
	/* ARGSUSED */
	static void
	spa_livelist_delete_cb(void arg, zthr_t z)
	{
	spa_t *spa = arg;
	uint64_t ll_obj = 0, count;
	objset_t *mos = spa->spa_meta_objset;
	uint64_t zap_obj = spa->spa_livelists_to_delete;
	/*
	* Determine the next livelist to delete. This function should only
	* be called if there is at least one deleted clone.
	*/
	VERIFY0(dsl_get_next_livelist_obj(mos, zap_obj, &ll_obj));
	VERIFY0(zap_count(mos, ll_obj, &count));
	if (count > 0) {
	- dsl_deadlist_t ll = { 0 };
	+ dsl_deadlist_t *ll;
	dsl_deadlist_entry_t *dle;
	bplist_t to_free;
	- dsl_deadlist_open(&ll, mos, ll_obj);
	- dle = dsl_deadlist_first(&ll);
	+ ll = kmem_zalloc(sizeof (dsl_deadlist_t), KM_SLEEP);
	+ dsl_deadlist_open(ll, mos, ll_obj);
	+ dle = dsl_deadlist_first(ll);
	ASSERT3P(dle, !=, NULL);
	bplist_create(&to_free);
	int err = dsl_process_sub_livelist(&dle->dle_bpobj, &to_free,
	z, NULL);
	if (err == 0) {
	sublist_delete_arg_t sync_arg = {
	.spa = spa,
	- .ll = &ll,
	+ .ll = ll,
	.key = dle->dle_mintxg,
	.to_free = &to_free
	};
	zfs_dbgmsg("deleting sublist (id %llu) from"
	" livelist %llu, %d remaining",
	dle->dle_bpobj.bpo_object, ll_obj, count - 1);
	VERIFY0(dsl_sync_task(spa_name(spa), NULL,
	sublist_delete_sync, &sync_arg, 0,
	ZFS_SPACE_CHECK_DESTROY));
	} else {
	VERIFY3U(err, ==, EINTR);
	}
	bplist_clear(&to_free);
	bplist_destroy(&to_free);
	- dsl_deadlist_close(&ll);
	+ dsl_deadlist_close(ll);
	+ kmem_free(ll, sizeof (dsl_deadlist_t));
	} else {
	livelist_delete_arg_t sync_arg = {
	.spa = spa,
	.ll_obj = ll_obj,
	.zap_obj = zap_obj
	};
	zfs_dbgmsg("deletion of livelist %llu completed", ll_obj);
	VERIFY0(dsl_sync_task(spa_name(spa), NULL, livelist_delete_sync,
	&sync_arg, 0, ZFS_SPACE_CHECK_DESTROY));
	}
	}

	static void
	spa_start_livelist_destroy_thread(spa_t *spa)
	{
	ASSERT3P(spa->spa_livelist_delete_zthr, ==, NULL);
	spa->spa_livelist_delete_zthr =
	zthr_create("z_livelist_destroy",
	spa_livelist_delete_cb_check, spa_livelist_delete_cb, spa);
	}

	typedef struct livelist_new_arg {
	bplist_t *allocs;
	bplist_t *frees;
	} livelist_new_arg_t;

	static int
	livelist_track_new_cb(void arg, const blkptr_t bp, boolean_t bp_freed,
	dmu_tx_t *tx)
	{
	ASSERT(tx == NULL);
	livelist_new_arg_t *lna = arg;
	if (bp_freed) {
	bplist_append(lna->frees, bp);
	} else {
	bplist_append(lna->allocs, bp);
	zfs_livelist_condense_new_alloc++;
	}
	return (0);
	}

	typedef struct livelist_condense_arg {
	spa_t *spa;
	bplist_t to_keep;
	uint64_t first_size;
	uint64_t next_size;
	} livelist_condense_arg_t;

	static void
	spa_livelist_condense_sync(void arg, dmu_tx_t tx)
	{
	livelist_condense_arg_t *lca = arg;
	spa_t *spa = lca->spa;
	bplist_t new_frees;
	dsl_dataset_t *ds = spa->spa_to_condense.ds;

	/* Have we been cancelled? */
	if (spa->spa_to_condense.cancelled) {
	zfs_livelist_condense_sync_cancel++;
	goto out;
	}

	dsl_deadlist_entry_t *first = spa->spa_to_condense.first;
	dsl_deadlist_entry_t *next = spa->spa_to_condense.next;
	dsl_deadlist_t *ll = &ds->ds_dir->dd_livelist;

	/*
	* It's possible that the livelist was changed while the zthr was
	* running. Therefore, we need to check for new blkptrs in the two
	* entries being condensed and continue to track them in the livelist.
	* Because of the way we handle remapped blkptrs (see dbuf_remap_impl),
	* it's possible that the newly added blkptrs are FREEs or ALLOCs so
	* we need to sort them into two different bplists.
	*/
	uint64_t first_obj = first->dle_bpobj.bpo_object;
	uint64_t next_obj = next->dle_bpobj.bpo_object;
	uint64_t cur_first_size = first->dle_bpobj.bpo_phys->bpo_num_blkptrs;
	uint64_t cur_next_size = next->dle_bpobj.bpo_phys->bpo_num_blkptrs;

	bplist_create(&new_frees);
	livelist_new_arg_t new_bps = {
	.allocs = &lca->to_keep,
	.frees = &new_frees,
	};

	if (cur_first_size > lca->first_size) {
	VERIFY0(livelist_bpobj_iterate_from_nofree(&first->dle_bpobj,
	livelist_track_new_cb, &new_bps, lca->first_size));
	}
	if (cur_next_size > lca->next_size) {
	VERIFY0(livelist_bpobj_iterate_from_nofree(&next->dle_bpobj,
	livelist_track_new_cb, &new_bps, lca->next_size));
	}

	dsl_deadlist_clear_entry(first, ll, tx);
	ASSERT(bpobj_is_empty(&first->dle_bpobj));
	dsl_deadlist_remove_entry(ll, next->dle_mintxg, tx);

	bplist_iterate(&lca->to_keep, dsl_deadlist_insert_alloc_cb, ll, tx);
	bplist_iterate(&new_frees, dsl_deadlist_insert_free_cb, ll, tx);
	bplist_destroy(&new_frees);

	char dsname[ZFS_MAX_DATASET_NAME_LEN];
	dsl_dataset_name(ds, dsname);
	zfs_dbgmsg("txg %llu condensing livelist of %s (id %llu), bpobj %llu "
	"(%llu blkptrs) and bpobj %llu (%llu blkptrs) -> bpobj %llu "
	"(%llu blkptrs)", tx->tx_txg, dsname, ds->ds_object, first_obj,
	cur_first_size, next_obj, cur_next_size,
	first->dle_bpobj.bpo_object,
	first->dle_bpobj.bpo_phys->bpo_num_blkptrs);
	out:
	dmu_buf_rele(ds->ds_dbuf, spa);
	spa->spa_to_condense.ds = NULL;
	bplist_clear(&lca->to_keep);
	bplist_destroy(&lca->to_keep);
	kmem_free(lca, sizeof (livelist_condense_arg_t));
	spa->spa_to_condense.syncing = B_FALSE;
	}

	static void
	spa_livelist_condense_cb(void arg, zthr_t t)
	{
	while (zfs_livelist_condense_zthr_pause &&
	!(zthr_has_waiters(t) \|\| zthr_iscancelled(t)))
	delay(1);

	spa_t *spa = arg;
	dsl_deadlist_entry_t *first = spa->spa_to_condense.first;
	dsl_deadlist_entry_t *next = spa->spa_to_condense.next;
	uint64_t first_size, next_size;

	livelist_condense_arg_t *lca =
	kmem_alloc(sizeof (livelist_condense_arg_t), KM_SLEEP);
	bplist_create(&lca->to_keep);

	/*
	* Process the livelists (matching FREEs and ALLOCs) in open context
	* so we have minimal work in syncing context to condense.
	*
	* We save bpobj sizes (first_size and next_size) to use later in
	* syncing context to determine if entries were added to these sublists
	* while in open context. This is possible because the clone is still
	* active and open for normal writes and we want to make sure the new,
	* unprocessed blockpointers are inserted into the livelist normally.
	*
	* Note that dsl_process_sub_livelist() both stores the size number of
	* blockpointers and iterates over them while the bpobj's lock held, so
	* the sizes returned to us are consistent which what was actually
	* processed.
	*/
	int err = dsl_process_sub_livelist(&first->dle_bpobj, &lca->to_keep, t,
	&first_size);
	if (err == 0)
	err = dsl_process_sub_livelist(&next->dle_bpobj, &lca->to_keep,
	t, &next_size);

	if (err == 0) {
	while (zfs_livelist_condense_sync_pause &&
	!(zthr_has_waiters(t) \|\| zthr_iscancelled(t)))
	delay(1);

	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	dmu_tx_mark_netfree(tx);
	dmu_tx_hold_space(tx, 1);
	err = dmu_tx_assign(tx, TXG_NOWAIT \| TXG_NOTHROTTLE);
	if (err == 0) {
	/*
	* Prevent the condense zthr restarting before
	* the synctask completes.
	*/
	spa->spa_to_condense.syncing = B_TRUE;
	lca->spa = spa;
	lca->first_size = first_size;
	lca->next_size = next_size;
	dsl_sync_task_nowait(spa_get_dsl(spa),
	- spa_livelist_condense_sync, lca, 0,
	- ZFS_SPACE_CHECK_NONE, tx);
	+ spa_livelist_condense_sync, lca, tx);
	dmu_tx_commit(tx);
	return;
	}
	}
	/*
	* Condensing can not continue: either it was externally stopped or
	* we were unable to assign to a tx because the pool has run out of
	* space. In the second case, we'll just end up trying to condense
	* again in a later txg.
	*/
	ASSERT(err != 0);
	bplist_clear(&lca->to_keep);
	bplist_destroy(&lca->to_keep);
	kmem_free(lca, sizeof (livelist_condense_arg_t));
	dmu_buf_rele(spa->spa_to_condense.ds->ds_dbuf, spa);
	spa->spa_to_condense.ds = NULL;
	if (err == EINTR)
	zfs_livelist_condense_zthr_cancel++;
	}

	/* ARGSUSED */
	/*
	* Check that there is something to condense but that a condense is not
	* already in progress and that condensing has not been cancelled.
	*/
	static boolean_t
	spa_livelist_condense_cb_check(void arg, zthr_t z)
	{
	spa_t *spa = arg;
	if ((spa->spa_to_condense.ds != NULL) &&
	(spa->spa_to_condense.syncing == B_FALSE) &&
	(spa->spa_to_condense.cancelled == B_FALSE)) {
	return (B_TRUE);
	}
	return (B_FALSE);
	}

	static void
	spa_start_livelist_condensing_thread(spa_t *spa)
	{
	spa->spa_to_condense.ds = NULL;
	spa->spa_to_condense.first = NULL;
	spa->spa_to_condense.next = NULL;
	spa->spa_to_condense.syncing = B_FALSE;
	spa->spa_to_condense.cancelled = B_FALSE;

	ASSERT3P(spa->spa_livelist_condense_zthr, ==, NULL);
	spa->spa_livelist_condense_zthr =
	zthr_create("z_livelist_condense",
	spa_livelist_condense_cb_check,
	spa_livelist_condense_cb, spa);
	}

	static void
	spa_spawn_aux_threads(spa_t *spa)
	{
	ASSERT(spa_writeable(spa));

	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	spa_start_indirect_condensing_thread(spa);
	spa_start_livelist_destroy_thread(spa);
	spa_start_livelist_condensing_thread(spa);

	ASSERT3P(spa->spa_checkpoint_discard_zthr, ==, NULL);
	spa->spa_checkpoint_discard_zthr =
	zthr_create("z_checkpoint_discard",
	spa_checkpoint_discard_thread_check,
	spa_checkpoint_discard_thread, spa);
	}

	/*
	* Fix up config after a partly-completed split. This is done with the
	* ZPOOL_CONFIG_SPLIT nvlist. Both the splitting pool and the split-off
	* pool have that entry in their config, but only the splitting one contains
	* a list of all the guids of the vdevs that are being split off.
	*
	* This function determines what to do with that list: either rejoin
	* all the disks to the pool, or complete the splitting process. To attempt
	* the rejoin, each disk that is offlined is marked online again, and
	* we do a reopen() call. If the vdev label for every disk that was
	* marked online indicates it was successfully split off (VDEV_AUX_SPLIT_POOL)
	* then we call vdev_split() on each disk, and complete the split.
	*
	* Otherwise we leave the config alone, with all the vdevs in place in
	* the original pool.
	*/
	static void
	spa_try_repair(spa_t spa, nvlist_t config)
	{
	uint_t extracted;
	uint64_t *glist;
	uint_t i, gcount;
	nvlist_t *nvl;
	vdev_t **vd;
	boolean_t attempt_reopen;

	if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_SPLIT, &nvl) != 0)
	return;

	/* check that the config is complete */
	if (nvlist_lookup_uint64_array(nvl, ZPOOL_CONFIG_SPLIT_LIST,
	&glist, &gcount) != 0)
	return;

	vd = kmem_zalloc(gcount * sizeof (vdev_t *), KM_SLEEP);

	/* attempt to online all the vdevs & validate */
	attempt_reopen = B_TRUE;
	for (i = 0; i < gcount; i++) {
	if (glist[i] == 0) /* vdev is hole */
	continue;

	vd[i] = spa_lookup_by_guid(spa, glist[i], B_FALSE);
	if (vd[i] == NULL) {
	/*
	* Don't bother attempting to reopen the disks;
	* just do the split.
	*/
	attempt_reopen = B_FALSE;
	} else {
	/* attempt to re-online it */
	vd[i]->vdev_offline = B_FALSE;
	}
	}

	if (attempt_reopen) {
	vdev_reopen(spa->spa_root_vdev);

	/* check each device to see what state it's in */
	for (extracted = 0, i = 0; i < gcount; i++) {
	if (vd[i] != NULL &&
	vd[i]->vdev_stat.vs_aux != VDEV_AUX_SPLIT_POOL)
	break;
	++extracted;
	}
	}

	/*
	* If every disk has been moved to the new pool, or if we never
	* even attempted to look at them, then we split them off for
	* good.
	*/
	if (!attempt_reopen \|\| gcount == extracted) {
	for (i = 0; i < gcount; i++)
	if (vd[i] != NULL)
	vdev_split(vd[i]);
	vdev_reopen(spa->spa_root_vdev);
	}

	kmem_free(vd, gcount * sizeof (vdev_t *));
	}

	static int
	spa_load(spa_t *spa, spa_load_state_t state, spa_import_type_t type)
	{
	char *ereport = FM_EREPORT_ZFS_POOL;
	int error;

	spa->spa_load_state = state;
	(void) spa_import_progress_set_state(spa_guid(spa),
	spa_load_state(spa));

	gethrestime(&spa->spa_loaded_ts);
	error = spa_load_impl(spa, type, &ereport);

	/*
	* Don't count references from objsets that are already closed
	* and are making their way through the eviction process.
	*/
	spa_evicting_os_wait(spa);
	spa->spa_minref = zfs_refcount_count(&spa->spa_refcount);
	if (error) {
	if (error != EEXIST) {
	spa->spa_loaded_ts.tv_sec = 0;
	spa->spa_loaded_ts.tv_nsec = 0;
	}
	if (error != EBADF) {
	(void) zfs_ereport_post(ereport, spa,
	- NULL, NULL, NULL, 0, 0);
	+ NULL, NULL, NULL, 0);
	}
	}
	spa->spa_load_state = error ? SPA_LOAD_ERROR : SPA_LOAD_NONE;
	spa->spa_ena = 0;

	(void) spa_import_progress_set_state(spa_guid(spa),
	spa_load_state(spa));

	return (error);
	}

	#ifdef ZFS_DEBUG
	/*
	* Count the number of per-vdev ZAPs associated with all of the vdevs in the
	* vdev tree rooted in the given vd, and ensure that each ZAP is present in the
	* spa's per-vdev ZAP list.
	*/
	static uint64_t
	vdev_count_verify_zaps(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;
	uint64_t total = 0;

	if (vd->vdev_top_zap != 0) {
	total++;
	ASSERT0(zap_lookup_int(spa->spa_meta_objset,
	spa->spa_all_vdev_zaps, vd->vdev_top_zap));
	}
	if (vd->vdev_leaf_zap != 0) {
	total++;
	ASSERT0(zap_lookup_int(spa->spa_meta_objset,
	spa->spa_all_vdev_zaps, vd->vdev_leaf_zap));
	}

	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	total += vdev_count_verify_zaps(vd->vdev_child[i]);
	}

	return (total);
	}
	#endif

	/*
	* Determine whether the activity check is required.
	*/
	static boolean_t
	spa_activity_check_required(spa_t spa, uberblock_t ub, nvlist_t *label,
	nvlist_t *config)
	{
	uint64_t state = 0;
	uint64_t hostid = 0;
	uint64_t tryconfig_txg = 0;
	uint64_t tryconfig_timestamp = 0;
	uint16_t tryconfig_mmp_seq = 0;
	nvlist_t *nvinfo;

	if (nvlist_exists(config, ZPOOL_CONFIG_LOAD_INFO)) {
	nvinfo = fnvlist_lookup_nvlist(config, ZPOOL_CONFIG_LOAD_INFO);
	(void) nvlist_lookup_uint64(nvinfo, ZPOOL_CONFIG_MMP_TXG,
	&tryconfig_txg);
	(void) nvlist_lookup_uint64(config, ZPOOL_CONFIG_TIMESTAMP,
	&tryconfig_timestamp);
	(void) nvlist_lookup_uint16(nvinfo, ZPOOL_CONFIG_MMP_SEQ,
	&tryconfig_mmp_seq);
	}

	(void) nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_STATE, &state);

	/*
	* Disable the MMP activity check - This is used by zdb which
	* is intended to be used on potentially active pools.
	*/
	if (spa->spa_import_flags & ZFS_IMPORT_SKIP_MMP)
	return (B_FALSE);

	/*
	* Skip the activity check when the MMP feature is disabled.
	*/
	if (ub->ub_mmp_magic == MMP_MAGIC && ub->ub_mmp_delay == 0)
	return (B_FALSE);

	/*
	* If the tryconfig_ values are nonzero, they are the results of an
	* earlier tryimport. If they all match the uberblock we just found,
	* then the pool has not changed and we return false so we do not test
	* a second time.
	*/
	if (tryconfig_txg && tryconfig_txg == ub->ub_txg &&
	tryconfig_timestamp && tryconfig_timestamp == ub->ub_timestamp &&
	tryconfig_mmp_seq && tryconfig_mmp_seq ==
	(MMP_SEQ_VALID(ub) ? MMP_SEQ(ub) : 0))
	return (B_FALSE);

	/*
	* Allow the activity check to be skipped when importing the pool
	* on the same host which last imported it. Since the hostid from
	* configuration may be stale use the one read from the label.
	*/
	if (nvlist_exists(label, ZPOOL_CONFIG_HOSTID))
	hostid = fnvlist_lookup_uint64(label, ZPOOL_CONFIG_HOSTID);

	if (hostid == spa_get_hostid(spa))
	return (B_FALSE);

	/*
	* Skip the activity test when the pool was cleanly exported.
	*/
	if (state != POOL_STATE_ACTIVE)
	return (B_FALSE);

	return (B_TRUE);
	}

	/*
	* Nanoseconds the activity check must watch for changes on-disk.
	*/
	static uint64_t
	spa_activity_check_duration(spa_t spa, uberblock_t ub)
	{
	uint64_t import_intervals = MAX(zfs_multihost_import_intervals, 1);
	uint64_t multihost_interval = MSEC2NSEC(
	MMP_INTERVAL_OK(zfs_multihost_interval));
	uint64_t import_delay = MAX(NANOSEC, import_intervals *
	multihost_interval);

	/*
	* Local tunables determine a minimum duration except for the case
	* where we know when the remote host will suspend the pool if MMP
	* writes do not land.
	*
	* See Big Theory comment at the top of mmp.c for the reasoning behind
	* these cases and times.
	*/

	ASSERT(MMP_IMPORT_SAFETY_FACTOR >= 100);

	if (MMP_INTERVAL_VALID(ub) && MMP_FAIL_INT_VALID(ub) &&
	MMP_FAIL_INT(ub) > 0) {

	/* MMP on remote host will suspend pool after failed writes */
	import_delay = MMP_FAIL_INT(ub) * MSEC2NSEC(MMP_INTERVAL(ub)) *
	MMP_IMPORT_SAFETY_FACTOR / 100;

	zfs_dbgmsg("fail_intvals>0 import_delay=%llu ub_mmp "
	"mmp_fails=%llu ub_mmp mmp_interval=%llu "
	"import_intervals=%u", import_delay, MMP_FAIL_INT(ub),
	MMP_INTERVAL(ub), import_intervals);

	} else if (MMP_INTERVAL_VALID(ub) && MMP_FAIL_INT_VALID(ub) &&
	MMP_FAIL_INT(ub) == 0) {

	/* MMP on remote host will never suspend pool */
	import_delay = MAX(import_delay, (MSEC2NSEC(MMP_INTERVAL(ub)) +
	ub->ub_mmp_delay) * import_intervals);

	zfs_dbgmsg("fail_intvals=0 import_delay=%llu ub_mmp "
	"mmp_interval=%llu ub_mmp_delay=%llu "
	"import_intervals=%u", import_delay, MMP_INTERVAL(ub),
	ub->ub_mmp_delay, import_intervals);

	} else if (MMP_VALID(ub)) {
	/*
	* zfs-0.7 compatibility case
	*/

	import_delay = MAX(import_delay, (multihost_interval +
	ub->ub_mmp_delay) * import_intervals);

	zfs_dbgmsg("import_delay=%llu ub_mmp_delay=%llu "
	"import_intervals=%u leaves=%u", import_delay,
	ub->ub_mmp_delay, import_intervals,
	vdev_count_leaves(spa));
	} else {
	/* Using local tunings is the only reasonable option */
	zfs_dbgmsg("pool last imported on non-MMP aware "
	"host using import_delay=%llu multihost_interval=%llu "
	"import_intervals=%u", import_delay, multihost_interval,
	import_intervals);
	}

	return (import_delay);
	}

	/*
	* Perform the import activity check. If the user canceled the import or
	* we detected activity then fail.
	*/
	static int
	spa_activity_check(spa_t spa, uberblock_t ub, nvlist_t *config)
	{
	uint64_t txg = ub->ub_txg;
	uint64_t timestamp = ub->ub_timestamp;
	uint64_t mmp_config = ub->ub_mmp_config;
	uint16_t mmp_seq = MMP_SEQ_VALID(ub) ? MMP_SEQ(ub) : 0;
	uint64_t import_delay;
	hrtime_t import_expire;
	nvlist_t *mmp_label = NULL;
	vdev_t *rvd = spa->spa_root_vdev;
	kcondvar_t cv;
	kmutex_t mtx;
	int error = 0;

	cv_init(&cv, NULL, CV_DEFAULT, NULL);
	mutex_init(&mtx, NULL, MUTEX_DEFAULT, NULL);
	mutex_enter(&mtx);

	/*
	* If ZPOOL_CONFIG_MMP_TXG is present an activity check was performed
	* during the earlier tryimport. If the txg recorded there is 0 then
	* the pool is known to be active on another host.
	*
	* Otherwise, the pool might be in use on another host. Check for
	* changes in the uberblocks on disk if necessary.
	*/
	if (nvlist_exists(config, ZPOOL_CONFIG_LOAD_INFO)) {
	nvlist_t *nvinfo = fnvlist_lookup_nvlist(config,
	ZPOOL_CONFIG_LOAD_INFO);

	if (nvlist_exists(nvinfo, ZPOOL_CONFIG_MMP_TXG) &&
	fnvlist_lookup_uint64(nvinfo, ZPOOL_CONFIG_MMP_TXG) == 0) {
	vdev_uberblock_load(rvd, ub, &mmp_label);
	error = SET_ERROR(EREMOTEIO);
	goto out;
	}
	}

	import_delay = spa_activity_check_duration(spa, ub);

	/* Add a small random factor in case of simultaneous imports (0-25%) */
	import_delay += import_delay * spa_get_random(250) / 1000;

	import_expire = gethrtime() + import_delay;

	while (gethrtime() < import_expire) {
	(void) spa_import_progress_set_mmp_check(spa_guid(spa),
	NSEC2SEC(import_expire - gethrtime()));

	vdev_uberblock_load(rvd, ub, &mmp_label);

	if (txg != ub->ub_txg \|\| timestamp != ub->ub_timestamp \|\|
	mmp_seq != (MMP_SEQ_VALID(ub) ? MMP_SEQ(ub) : 0)) {
	zfs_dbgmsg("multihost activity detected "
	"txg %llu ub_txg %llu "
	"timestamp %llu ub_timestamp %llu "
	"mmp_config %#llx ub_mmp_config %#llx",
	txg, ub->ub_txg, timestamp, ub->ub_timestamp,
	mmp_config, ub->ub_mmp_config);

	error = SET_ERROR(EREMOTEIO);
	break;
	}

	if (mmp_label) {
	nvlist_free(mmp_label);
	mmp_label = NULL;
	}

	error = cv_timedwait_sig(&cv, &mtx, ddi_get_lbolt() + hz);
	if (error != -1) {
	error = SET_ERROR(EINTR);
	break;
	}
	error = 0;
	}

	out:
	mutex_exit(&mtx);
	mutex_destroy(&mtx);
	cv_destroy(&cv);

	/*
	* If the pool is determined to be active store the status in the
	* spa->spa_load_info nvlist. If the remote hostname or hostid are
	* available from configuration read from disk store them as well.
	* This allows 'zpool import' to generate a more useful message.
	*
	* ZPOOL_CONFIG_MMP_STATE - observed pool status (mandatory)
	* ZPOOL_CONFIG_MMP_HOSTNAME - hostname from the active pool
	* ZPOOL_CONFIG_MMP_HOSTID - hostid from the active pool
	*/
	if (error == EREMOTEIO) {
	char *hostname = "<unknown>";
	uint64_t hostid = 0;

	if (mmp_label) {
	if (nvlist_exists(mmp_label, ZPOOL_CONFIG_HOSTNAME)) {
	hostname = fnvlist_lookup_string(mmp_label,
	ZPOOL_CONFIG_HOSTNAME);
	fnvlist_add_string(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_HOSTNAME, hostname);
	}

	if (nvlist_exists(mmp_label, ZPOOL_CONFIG_HOSTID)) {
	hostid = fnvlist_lookup_uint64(mmp_label,
	ZPOOL_CONFIG_HOSTID);
	fnvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_HOSTID, hostid);
	}
	}

	fnvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_STATE, MMP_STATE_ACTIVE);
	fnvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_TXG, 0);

	error = spa_vdev_err(rvd, VDEV_AUX_ACTIVE, EREMOTEIO);
	}

	if (mmp_label)
	nvlist_free(mmp_label);

	return (error);
	}

	static int
	spa_verify_host(spa_t spa, nvlist_t mos_config)
	{
	uint64_t hostid;
	char *hostname;
	uint64_t myhostid = 0;

	if (!spa_is_root(spa) && nvlist_lookup_uint64(mos_config,
	ZPOOL_CONFIG_HOSTID, &hostid) == 0) {
	hostname = fnvlist_lookup_string(mos_config,
	ZPOOL_CONFIG_HOSTNAME);

	myhostid = zone_get_hostid(NULL);

	if (hostid != 0 && myhostid != 0 && hostid != myhostid) {
	cmn_err(CE_WARN, "pool '%s' could not be "
	"loaded as it was last accessed by "
	"another system (host: %s hostid: 0x%llx). "
	"See: https://openzfs.github.io/openzfs-docs/msg/"
	"ZFS-8000-EY",
	spa_name(spa), hostname, (u_longlong_t)hostid);
	spa_load_failed(spa, "hostid verification failed: pool "
	"last accessed by host: %s (hostid: 0x%llx)",
	hostname, (u_longlong_t)hostid);
	return (SET_ERROR(EBADF));
	}
	}

	return (0);
	}

	static int
	spa_ld_parse_config(spa_t *spa, spa_import_type_t type)
	{
	int error = 0;
	nvlist_t nvtree, nvl, *config = spa->spa_config;
	int parse;
	vdev_t *rvd;
	uint64_t pool_guid;
	char *comment;

	/*
	* Versioning wasn't explicitly added to the label until later, so if
	* it's not present treat it as the initial version.
	*/
	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_VERSION,
	&spa->spa_ubsync.ub_version) != 0)
	spa->spa_ubsync.ub_version = SPA_VERSION_INITIAL;

	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &pool_guid)) {
	spa_load_failed(spa, "invalid config provided: '%s' missing",
	ZPOOL_CONFIG_POOL_GUID);
	return (SET_ERROR(EINVAL));
	}

	/*
	* If we are doing an import, ensure that the pool is not already
	* imported by checking if its pool guid already exists in the
	* spa namespace.
	*
	* The only case that we allow an already imported pool to be
	* imported again, is when the pool is checkpointed and we want to
	* look at its checkpointed state from userland tools like zdb.
	*/
	#ifdef _KERNEL
	if ((spa->spa_load_state == SPA_LOAD_IMPORT \|\|
	spa->spa_load_state == SPA_LOAD_TRYIMPORT) &&
	spa_guid_exists(pool_guid, 0)) {
	#else
	if ((spa->spa_load_state == SPA_LOAD_IMPORT \|\|
	spa->spa_load_state == SPA_LOAD_TRYIMPORT) &&
	spa_guid_exists(pool_guid, 0) &&
	!spa_importing_readonly_checkpoint(spa)) {
	#endif
	spa_load_failed(spa, "a pool with guid %llu is already open",
	(u_longlong_t)pool_guid);
	return (SET_ERROR(EEXIST));
	}

	spa->spa_config_guid = pool_guid;

	nvlist_free(spa->spa_load_info);
	spa->spa_load_info = fnvlist_alloc();

	ASSERT(spa->spa_comment == NULL);
	if (nvlist_lookup_string(config, ZPOOL_CONFIG_COMMENT, &comment) == 0)
	spa->spa_comment = spa_strdup(comment);

	(void) nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_TXG,
	&spa->spa_config_txg);

	if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_SPLIT, &nvl) == 0)
	spa->spa_config_splitting = fnvlist_dup(nvl);

	if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE, &nvtree)) {
	spa_load_failed(spa, "invalid config provided: '%s' missing",
	ZPOOL_CONFIG_VDEV_TREE);
	return (SET_ERROR(EINVAL));
	}

	/*
	* Create "The Godfather" zio to hold all async IOs
	*/
	spa->spa_async_zio_root = kmem_alloc(max_ncpus * sizeof (void *),
	KM_SLEEP);
	for (int i = 0; i < max_ncpus; i++) {
	spa->spa_async_zio_root[i] = zio_root(spa, NULL, NULL,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE \|
	ZIO_FLAG_GODFATHER);
	}

	/*
	* Parse the configuration into a vdev tree. We explicitly set the
	* value that will be returned by spa_version() since parsing the
	* configuration requires knowing the version number.
	*/
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	parse = (type == SPA_IMPORT_EXISTING ?
	VDEV_ALLOC_LOAD : VDEV_ALLOC_SPLIT);
	error = spa_config_parse(spa, &rvd, nvtree, NULL, 0, parse);
	spa_config_exit(spa, SCL_ALL, FTAG);

	if (error != 0) {
	spa_load_failed(spa, "unable to parse config [error=%d]",
	error);
	return (error);
	}

	ASSERT(spa->spa_root_vdev == rvd);
	ASSERT3U(spa->spa_min_ashift, >=, SPA_MINBLOCKSHIFT);
	ASSERT3U(spa->spa_max_ashift, <=, SPA_MAXBLOCKSHIFT);

	if (type != SPA_IMPORT_ASSEMBLE) {
	ASSERT(spa_guid(spa) == pool_guid);
	}

	return (0);
	}

	/*
	* Recursively open all vdevs in the vdev tree. This function is called twice:
	* first with the untrusted config, then with the trusted config.
	*/
	static int
	spa_ld_open_vdevs(spa_t *spa)
	{
	int error = 0;

	/*
	* spa_missing_tvds_allowed defines how many top-level vdevs can be
	* missing/unopenable for the root vdev to be still considered openable.
	*/
	if (spa->spa_trust_config) {
	spa->spa_missing_tvds_allowed = zfs_max_missing_tvds;
	} else if (spa->spa_config_source == SPA_CONFIG_SRC_CACHEFILE) {
	spa->spa_missing_tvds_allowed = zfs_max_missing_tvds_cachefile;
	} else if (spa->spa_config_source == SPA_CONFIG_SRC_SCAN) {
	spa->spa_missing_tvds_allowed = zfs_max_missing_tvds_scan;
	} else {
	spa->spa_missing_tvds_allowed = 0;
	}

	spa->spa_missing_tvds_allowed =
	MAX(zfs_max_missing_tvds, spa->spa_missing_tvds_allowed);

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	error = vdev_open(spa->spa_root_vdev);
	spa_config_exit(spa, SCL_ALL, FTAG);

	if (spa->spa_missing_tvds != 0) {
	spa_load_note(spa, "vdev tree has %lld missing top-level "
	"vdevs.", (u_longlong_t)spa->spa_missing_tvds);
	if (spa->spa_trust_config && (spa->spa_mode & SPA_MODE_WRITE)) {
	/*
	* Although theoretically we could allow users to open
	* incomplete pools in RW mode, we'd need to add a lot
	* of extra logic (e.g. adjust pool space to account
	* for missing vdevs).
	* This limitation also prevents users from accidentally
	* opening the pool in RW mode during data recovery and
	* damaging it further.
	*/
	spa_load_note(spa, "pools with missing top-level "
	"vdevs can only be opened in read-only mode.");
	error = SET_ERROR(ENXIO);
	} else {
	spa_load_note(spa, "current settings allow for maximum "
	"%lld missing top-level vdevs at this stage.",
	(u_longlong_t)spa->spa_missing_tvds_allowed);
	}
	}
	if (error != 0) {
	spa_load_failed(spa, "unable to open vdev tree [error=%d]",
	error);
	}
	if (spa->spa_missing_tvds != 0 \|\| error != 0)
	vdev_dbgmsg_print_tree(spa->spa_root_vdev, 2);

	return (error);
	}

	/*
	* We need to validate the vdev labels against the configuration that
	* we have in hand. This function is called twice: first with an untrusted
	* config, then with a trusted config. The validation is more strict when the
	* config is trusted.
	*/
	static int
	spa_ld_validate_vdevs(spa_t *spa)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	error = vdev_validate(rvd);
	spa_config_exit(spa, SCL_ALL, FTAG);

	if (error != 0) {
	spa_load_failed(spa, "vdev_validate failed [error=%d]", error);
	return (error);
	}

	if (rvd->vdev_state <= VDEV_STATE_CANT_OPEN) {
	spa_load_failed(spa, "cannot open vdev tree after invalidating "
	"some vdevs");
	vdev_dbgmsg_print_tree(rvd, 2);
	return (SET_ERROR(ENXIO));
	}

	return (0);
	}

	static void
	spa_ld_select_uberblock_done(spa_t spa, uberblock_t ub)
	{
	spa->spa_state = POOL_STATE_ACTIVE;
	spa->spa_ubsync = spa->spa_uberblock;
	spa->spa_verify_min_txg = spa->spa_extreme_rewind ?
	TXG_INITIAL - 1 : spa_last_synced_txg(spa) - TXG_DEFER_SIZE - 1;
	spa->spa_first_txg = spa->spa_last_ubsync_txg ?
	spa->spa_last_ubsync_txg : spa_last_synced_txg(spa) + 1;
	spa->spa_claim_max_txg = spa->spa_first_txg;
	spa->spa_prev_software_version = ub->ub_software_version;
	}

	static int
	spa_ld_select_uberblock(spa_t *spa, spa_import_type_t type)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	nvlist_t *label;
	uberblock_t *ub = &spa->spa_uberblock;
	boolean_t activity_check = B_FALSE;

	/*
	* If we are opening the checkpointed state of the pool by
	* rewinding to it, at this point we will have written the
	* checkpointed uberblock to the vdev labels, so searching
	* the labels will find the right uberblock. However, if
	* we are opening the checkpointed state read-only, we have
	* not modified the labels. Therefore, we must ignore the
	* labels and continue using the spa_uberblock that was set
	* by spa_ld_checkpoint_rewind.
	*
	* Note that it would be fine to ignore the labels when
	* rewinding (opening writeable) as well. However, if we
	* crash just after writing the labels, we will end up
	* searching the labels. Doing so in the common case means
	* that this code path gets exercised normally, rather than
	* just in the edge case.
	*/
	if (ub->ub_checkpoint_txg != 0 &&
	spa_importing_readonly_checkpoint(spa)) {
	spa_ld_select_uberblock_done(spa, ub);
	return (0);
	}

	/*
	* Find the best uberblock.
	*/
	vdev_uberblock_load(rvd, ub, &label);

	/*
	* If we weren't able to find a single valid uberblock, return failure.
	*/
	if (ub->ub_txg == 0) {
	nvlist_free(label);
	spa_load_failed(spa, "no valid uberblock found");
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, ENXIO));
	}

	if (spa->spa_load_max_txg != UINT64_MAX) {
	(void) spa_import_progress_set_max_txg(spa_guid(spa),
	(u_longlong_t)spa->spa_load_max_txg);
	}
	spa_load_note(spa, "using uberblock with txg=%llu",
	(u_longlong_t)ub->ub_txg);


	/*
	* For pools which have the multihost property on determine if the
	* pool is truly inactive and can be safely imported. Prevent
	* hosts which don't have a hostid set from importing the pool.
	*/
	activity_check = spa_activity_check_required(spa, ub, label,
	spa->spa_config);
	if (activity_check) {
	if (ub->ub_mmp_magic == MMP_MAGIC && ub->ub_mmp_delay &&
	spa_get_hostid(spa) == 0) {
	nvlist_free(label);
	fnvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_STATE, MMP_STATE_NO_HOSTID);
	return (spa_vdev_err(rvd, VDEV_AUX_ACTIVE, EREMOTEIO));
	}

	int error = spa_activity_check(spa, ub, spa->spa_config);
	if (error) {
	nvlist_free(label);
	return (error);
	}

	fnvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_STATE, MMP_STATE_INACTIVE);
	fnvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_TXG, ub->ub_txg);
	fnvlist_add_uint16(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_SEQ,
	(MMP_SEQ_VALID(ub) ? MMP_SEQ(ub) : 0));
	}

	/*
	* If the pool has an unsupported version we can't open it.
	*/
	if (!SPA_VERSION_IS_SUPPORTED(ub->ub_version)) {
	nvlist_free(label);
	spa_load_failed(spa, "version %llu is not supported",
	(u_longlong_t)ub->ub_version);
	return (spa_vdev_err(rvd, VDEV_AUX_VERSION_NEWER, ENOTSUP));
	}

	if (ub->ub_version >= SPA_VERSION_FEATURES) {
	nvlist_t *features;

	/*
	* If we weren't able to find what's necessary for reading the
	* MOS in the label, return failure.
	*/
	if (label == NULL) {
	spa_load_failed(spa, "label config unavailable");
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA,
	ENXIO));
	}

	if (nvlist_lookup_nvlist(label, ZPOOL_CONFIG_FEATURES_FOR_READ,
	&features) != 0) {
	nvlist_free(label);
	spa_load_failed(spa, "invalid label: '%s' missing",
	ZPOOL_CONFIG_FEATURES_FOR_READ);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA,
	ENXIO));
	}

	/*
	* Update our in-core representation with the definitive values
	* from the label.
	*/
	nvlist_free(spa->spa_label_features);
	VERIFY(nvlist_dup(features, &spa->spa_label_features, 0) == 0);
	}

	nvlist_free(label);

	/*
	* Look through entries in the label nvlist's features_for_read. If
	* there is a feature listed there which we don't understand then we
	* cannot open a pool.
	*/
	if (ub->ub_version >= SPA_VERSION_FEATURES) {
	nvlist_t *unsup_feat;

	VERIFY(nvlist_alloc(&unsup_feat, NV_UNIQUE_NAME, KM_SLEEP) ==
	0);

	for (nvpair_t *nvp = nvlist_next_nvpair(spa->spa_label_features,
	NULL); nvp != NULL;
	nvp = nvlist_next_nvpair(spa->spa_label_features, nvp)) {
	if (!zfeature_is_supported(nvpair_name(nvp))) {
	VERIFY(nvlist_add_string(unsup_feat,
	nvpair_name(nvp), "") == 0);
	}
	}

	if (!nvlist_empty(unsup_feat)) {
	VERIFY(nvlist_add_nvlist(spa->spa_load_info,
	ZPOOL_CONFIG_UNSUP_FEAT, unsup_feat) == 0);
	nvlist_free(unsup_feat);
	spa_load_failed(spa, "some features are unsupported");
	return (spa_vdev_err(rvd, VDEV_AUX_UNSUP_FEAT,
	ENOTSUP));
	}

	nvlist_free(unsup_feat);
	}

	if (type != SPA_IMPORT_ASSEMBLE && spa->spa_config_splitting) {
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	spa_try_repair(spa, spa->spa_config);
	spa_config_exit(spa, SCL_ALL, FTAG);
	nvlist_free(spa->spa_config_splitting);
	spa->spa_config_splitting = NULL;
	}

	/*
	* Initialize internal SPA structures.
	*/
	spa_ld_select_uberblock_done(spa, ub);

	return (0);
	}

	static int
	spa_ld_open_rootbp(spa_t *spa)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	error = dsl_pool_init(spa, spa->spa_first_txg, &spa->spa_dsl_pool);
	if (error != 0) {
	spa_load_failed(spa, "unable to open rootbp in dsl_pool_init "
	"[error=%d]", error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}
	spa->spa_meta_objset = spa->spa_dsl_pool->dp_meta_objset;

	return (0);
	}

	static int
	spa_ld_trusted_config(spa_t *spa, spa_import_type_t type,
	boolean_t reloading)
	{
	vdev_t mrvd, rvd = spa->spa_root_vdev;
	nvlist_t nv, mos_config, *policy;
	int error = 0, copy_error;
	uint64_t healthy_tvds, healthy_tvds_mos;
	uint64_t mos_config_txg;

	if (spa_dir_prop(spa, DMU_POOL_CONFIG, &spa->spa_config_object, B_TRUE)
	!= 0)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));

	/*
	* If we're assembling a pool from a split, the config provided is
	* already trusted so there is nothing to do.
	*/
	if (type == SPA_IMPORT_ASSEMBLE)
	return (0);

	healthy_tvds = spa_healthy_core_tvds(spa);

	if (load_nvlist(spa, spa->spa_config_object, &mos_config)
	!= 0) {
	spa_load_failed(spa, "unable to retrieve MOS config");
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	/*
	* If we are doing an open, pool owner wasn't verified yet, thus do
	* the verification here.
	*/
	if (spa->spa_load_state == SPA_LOAD_OPEN) {
	error = spa_verify_host(spa, mos_config);
	if (error != 0) {
	nvlist_free(mos_config);
	return (error);
	}
	}

	nv = fnvlist_lookup_nvlist(mos_config, ZPOOL_CONFIG_VDEV_TREE);

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);

	/*
	* Build a new vdev tree from the trusted config
	*/
	VERIFY(spa_config_parse(spa, &mrvd, nv, NULL, 0, VDEV_ALLOC_LOAD) == 0);

	/*
	* Vdev paths in the MOS may be obsolete. If the untrusted config was
	* obtained by scanning /dev/dsk, then it will have the right vdev
	* paths. We update the trusted MOS config with this information.
	* We first try to copy the paths with vdev_copy_path_strict, which
	* succeeds only when both configs have exactly the same vdev tree.
	* If that fails, we fall back to a more flexible method that has a
	* best effort policy.
	*/
	copy_error = vdev_copy_path_strict(rvd, mrvd);
	if (copy_error != 0 \|\| spa_load_print_vdev_tree) {
	spa_load_note(spa, "provided vdev tree:");
	vdev_dbgmsg_print_tree(rvd, 2);
	spa_load_note(spa, "MOS vdev tree:");
	vdev_dbgmsg_print_tree(mrvd, 2);
	}
	if (copy_error != 0) {
	spa_load_note(spa, "vdev_copy_path_strict failed, falling "
	"back to vdev_copy_path_relaxed");
	vdev_copy_path_relaxed(rvd, mrvd);
	}

	vdev_close(rvd);
	vdev_free(rvd);
	spa->spa_root_vdev = mrvd;
	rvd = mrvd;
	spa_config_exit(spa, SCL_ALL, FTAG);

	/*
	* We will use spa_config if we decide to reload the spa or if spa_load
	* fails and we rewind. We must thus regenerate the config using the
	* MOS information with the updated paths. ZPOOL_LOAD_POLICY is used to
	* pass settings on how to load the pool and is not stored in the MOS.
	* We copy it over to our new, trusted config.
	*/
	mos_config_txg = fnvlist_lookup_uint64(mos_config,
	ZPOOL_CONFIG_POOL_TXG);
	nvlist_free(mos_config);
	mos_config = spa_config_generate(spa, NULL, mos_config_txg, B_FALSE);
	if (nvlist_lookup_nvlist(spa->spa_config, ZPOOL_LOAD_POLICY,
	&policy) == 0)
	fnvlist_add_nvlist(mos_config, ZPOOL_LOAD_POLICY, policy);
	spa_config_set(spa, mos_config);
	spa->spa_config_source = SPA_CONFIG_SRC_MOS;

	/*
	* Now that we got the config from the MOS, we should be more strict
	* in checking blkptrs and can make assumptions about the consistency
	* of the vdev tree. spa_trust_config must be set to true before opening
	* vdevs in order for them to be writeable.
	*/
	spa->spa_trust_config = B_TRUE;

	/*
	* Open and validate the new vdev tree
	*/
	error = spa_ld_open_vdevs(spa);
	if (error != 0)
	return (error);

	error = spa_ld_validate_vdevs(spa);
	if (error != 0)
	return (error);

	if (copy_error != 0 \|\| spa_load_print_vdev_tree) {
	spa_load_note(spa, "final vdev tree:");
	vdev_dbgmsg_print_tree(rvd, 2);
	}

	if (spa->spa_load_state != SPA_LOAD_TRYIMPORT &&
	!spa->spa_extreme_rewind && zfs_max_missing_tvds == 0) {
	/*
	* Sanity check to make sure that we are indeed loading the
	* latest uberblock. If we missed SPA_SYNC_MIN_VDEVS tvds
	* in the config provided and they happened to be the only ones
	* to have the latest uberblock, we could involuntarily perform
	* an extreme rewind.
	*/
	healthy_tvds_mos = spa_healthy_core_tvds(spa);
	if (healthy_tvds_mos - healthy_tvds >=
	SPA_SYNC_MIN_VDEVS) {
	spa_load_note(spa, "config provided misses too many "
	"top-level vdevs compared to MOS (%lld vs %lld). ",
	(u_longlong_t)healthy_tvds,
	(u_longlong_t)healthy_tvds_mos);
	spa_load_note(spa, "vdev tree:");
	vdev_dbgmsg_print_tree(rvd, 2);
	if (reloading) {
	spa_load_failed(spa, "config was already "
	"provided from MOS. Aborting.");
	return (spa_vdev_err(rvd,
	VDEV_AUX_CORRUPT_DATA, EIO));
	}
	spa_load_note(spa, "spa must be reloaded using MOS "
	"config");
	return (SET_ERROR(EAGAIN));
	}
	}

	error = spa_check_for_missing_logs(spa);
	if (error != 0)
	return (spa_vdev_err(rvd, VDEV_AUX_BAD_GUID_SUM, ENXIO));

	if (rvd->vdev_guid_sum != spa->spa_uberblock.ub_guid_sum) {
	spa_load_failed(spa, "uberblock guid sum doesn't match MOS "
	"guid sum (%llu != %llu)",
	(u_longlong_t)spa->spa_uberblock.ub_guid_sum,
	(u_longlong_t)rvd->vdev_guid_sum);
	return (spa_vdev_err(rvd, VDEV_AUX_BAD_GUID_SUM,
	ENXIO));
	}

	return (0);
	}

	static int
	spa_ld_open_indirect_vdev_metadata(spa_t *spa)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	/*
	* Everything that we read before spa_remove_init() must be stored
	* on concreted vdevs. Therefore we do this as early as possible.
	*/
	error = spa_remove_init(spa);
	if (error != 0) {
	spa_load_failed(spa, "spa_remove_init failed [error=%d]",
	error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	/*
	* Retrieve information needed to condense indirect vdev mappings.
	*/
	error = spa_condense_init(spa);
	if (error != 0) {
	spa_load_failed(spa, "spa_condense_init failed [error=%d]",
	error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, error));
	}

	return (0);
	}

	static int
	spa_ld_check_features(spa_t spa, boolean_t missing_feat_writep)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	if (spa_version(spa) >= SPA_VERSION_FEATURES) {
	boolean_t missing_feat_read = B_FALSE;
	nvlist_t unsup_feat, enabled_feat;

	if (spa_dir_prop(spa, DMU_POOL_FEATURES_FOR_READ,
	&spa->spa_feat_for_read_obj, B_TRUE) != 0) {
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	if (spa_dir_prop(spa, DMU_POOL_FEATURES_FOR_WRITE,
	&spa->spa_feat_for_write_obj, B_TRUE) != 0) {
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	if (spa_dir_prop(spa, DMU_POOL_FEATURE_DESCRIPTIONS,
	&spa->spa_feat_desc_obj, B_TRUE) != 0) {
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	enabled_feat = fnvlist_alloc();
	unsup_feat = fnvlist_alloc();

	if (!spa_features_check(spa, B_FALSE,
	unsup_feat, enabled_feat))
	missing_feat_read = B_TRUE;

	if (spa_writeable(spa) \|\|
	spa->spa_load_state == SPA_LOAD_TRYIMPORT) {
	if (!spa_features_check(spa, B_TRUE,
	unsup_feat, enabled_feat)) {
	*missing_feat_writep = B_TRUE;
	}
	}

	fnvlist_add_nvlist(spa->spa_load_info,
	ZPOOL_CONFIG_ENABLED_FEAT, enabled_feat);

	if (!nvlist_empty(unsup_feat)) {
	fnvlist_add_nvlist(spa->spa_load_info,
	ZPOOL_CONFIG_UNSUP_FEAT, unsup_feat);
	}

	fnvlist_free(enabled_feat);
	fnvlist_free(unsup_feat);

	if (!missing_feat_read) {
	fnvlist_add_boolean(spa->spa_load_info,
	ZPOOL_CONFIG_CAN_RDONLY);
	}

	/*
	* If the state is SPA_LOAD_TRYIMPORT, our objective is
	* twofold: to determine whether the pool is available for
	* import in read-write mode and (if it is not) whether the
	* pool is available for import in read-only mode. If the pool
	* is available for import in read-write mode, it is displayed
	* as available in userland; if it is not available for import
	* in read-only mode, it is displayed as unavailable in
	* userland. If the pool is available for import in read-only
	* mode but not read-write mode, it is displayed as unavailable
	* in userland with a special note that the pool is actually
	* available for open in read-only mode.
	*
	* As a result, if the state is SPA_LOAD_TRYIMPORT and we are
	* missing a feature for write, we must first determine whether
	* the pool can be opened read-only before returning to
	* userland in order to know whether to display the
	* abovementioned note.
	*/
	if (missing_feat_read \|\| (*missing_feat_writep &&
	spa_writeable(spa))) {
	spa_load_failed(spa, "pool uses unsupported features");
	return (spa_vdev_err(rvd, VDEV_AUX_UNSUP_FEAT,
	ENOTSUP));
	}

	/*
	* Load refcounts for ZFS features from disk into an in-memory
	* cache during SPA initialization.
	*/
	for (spa_feature_t i = 0; i < SPA_FEATURES; i++) {
	uint64_t refcount;

	error = feature_get_refcount_from_disk(spa,
	&spa_feature_table[i], &refcount);
	if (error == 0) {
	spa->spa_feat_refcount_cache[i] = refcount;
	} else if (error == ENOTSUP) {
	spa->spa_feat_refcount_cache[i] =
	SPA_FEATURE_DISABLED;
	} else {
	spa_load_failed(spa, "error getting refcount "
	"for feature %s [error=%d]",
	spa_feature_table[i].fi_guid, error);
	return (spa_vdev_err(rvd,
	VDEV_AUX_CORRUPT_DATA, EIO));
	}
	}
	}

	if (spa_feature_is_active(spa, SPA_FEATURE_ENABLED_TXG)) {
	if (spa_dir_prop(spa, DMU_POOL_FEATURE_ENABLED_TXG,
	&spa->spa_feat_enabled_txg_obj, B_TRUE) != 0)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	/*
	* Encryption was added before bookmark_v2, even though bookmark_v2
	* is now a dependency. If this pool has encryption enabled without
	* bookmark_v2, trigger an errata message.
	*/
	if (spa_feature_is_enabled(spa, SPA_FEATURE_ENCRYPTION) &&
	!spa_feature_is_enabled(spa, SPA_FEATURE_BOOKMARK_V2)) {
	spa->spa_errata = ZPOOL_ERRATA_ZOL_8308_ENCRYPTION;
	}

	return (0);
	}

	static int
	spa_ld_load_special_directories(spa_t *spa)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	spa->spa_is_initializing = B_TRUE;
	error = dsl_pool_open(spa->spa_dsl_pool);
	spa->spa_is_initializing = B_FALSE;
	if (error != 0) {
	spa_load_failed(spa, "dsl_pool_open failed [error=%d]", error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	return (0);
	}

	static int
	spa_ld_get_props(spa_t *spa)
	{
	int error = 0;
	uint64_t obj;
	vdev_t *rvd = spa->spa_root_vdev;

	/* Grab the checksum salt from the MOS. */
	error = zap_lookup(spa->spa_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_CHECKSUM_SALT, 1,
	sizeof (spa->spa_cksum_salt.zcs_bytes),
	spa->spa_cksum_salt.zcs_bytes);
	if (error == ENOENT) {
	/* Generate a new salt for subsequent use */
	(void) random_get_pseudo_bytes(spa->spa_cksum_salt.zcs_bytes,
	sizeof (spa->spa_cksum_salt.zcs_bytes));
	} else if (error != 0) {
	spa_load_failed(spa, "unable to retrieve checksum salt from "
	"MOS [error=%d]", error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	if (spa_dir_prop(spa, DMU_POOL_SYNC_BPOBJ, &obj, B_TRUE) != 0)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	error = bpobj_open(&spa->spa_deferred_bpobj, spa->spa_meta_objset, obj);
	if (error != 0) {
	spa_load_failed(spa, "error opening deferred-frees bpobj "
	"[error=%d]", error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	/*
	* Load the bit that tells us to use the new accounting function
	* (raid-z deflation). If we have an older pool, this will not
	* be present.
	*/
	error = spa_dir_prop(spa, DMU_POOL_DEFLATE, &spa->spa_deflate, B_FALSE);
	if (error != 0 && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));

	error = spa_dir_prop(spa, DMU_POOL_CREATION_VERSION,
	&spa->spa_creation_version, B_FALSE);
	if (error != 0 && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));

	/*
	* Load the persistent error log. If we have an older pool, this will
	* not be present.
	*/
	error = spa_dir_prop(spa, DMU_POOL_ERRLOG_LAST, &spa->spa_errlog_last,
	B_FALSE);
	if (error != 0 && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));

	error = spa_dir_prop(spa, DMU_POOL_ERRLOG_SCRUB,
	&spa->spa_errlog_scrub, B_FALSE);
	if (error != 0 && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));

	/*
	* Load the livelist deletion field. If a livelist is queued for
	* deletion, indicate that in the spa
	*/
	error = spa_dir_prop(spa, DMU_POOL_DELETED_CLONES,
	&spa->spa_livelists_to_delete, B_FALSE);
	if (error != 0 && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));

	/*
	* Load the history object. If we have an older pool, this
	* will not be present.
	*/
	error = spa_dir_prop(spa, DMU_POOL_HISTORY, &spa->spa_history, B_FALSE);
	if (error != 0 && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));

	/*
	* Load the per-vdev ZAP map. If we have an older pool, this will not
	* be present; in this case, defer its creation to a later time to
	* avoid dirtying the MOS this early / out of sync context. See
	* spa_sync_config_object.
	*/

	/* The sentinel is only available in the MOS config. */
	nvlist_t *mos_config;
	if (load_nvlist(spa, spa->spa_config_object, &mos_config) != 0) {
	spa_load_failed(spa, "unable to retrieve MOS config");
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	error = spa_dir_prop(spa, DMU_POOL_VDEV_ZAP_MAP,
	&spa->spa_all_vdev_zaps, B_FALSE);

	if (error == ENOENT) {
	VERIFY(!nvlist_exists(mos_config,
	ZPOOL_CONFIG_HAS_PER_VDEV_ZAPS));
	spa->spa_avz_action = AVZ_ACTION_INITIALIZE;
	ASSERT0(vdev_count_verify_zaps(spa->spa_root_vdev));
	} else if (error != 0) {
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	} else if (!nvlist_exists(mos_config, ZPOOL_CONFIG_HAS_PER_VDEV_ZAPS)) {
	/*
	* An older version of ZFS overwrote the sentinel value, so
	* we have orphaned per-vdev ZAPs in the MOS. Defer their
	* destruction to later; see spa_sync_config_object.
	*/
	spa->spa_avz_action = AVZ_ACTION_DESTROY;
	/*
	* We're assuming that no vdevs have had their ZAPs created
	* before this. Better be sure of it.
	*/
	ASSERT0(vdev_count_verify_zaps(spa->spa_root_vdev));
	}
	nvlist_free(mos_config);

	spa->spa_delegation = zpool_prop_default_numeric(ZPOOL_PROP_DELEGATION);

	error = spa_dir_prop(spa, DMU_POOL_PROPS, &spa->spa_pool_props_object,
	B_FALSE);
	if (error && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));

	if (error == 0) {
	uint64_t autoreplace;

	spa_prop_find(spa, ZPOOL_PROP_BOOTFS, &spa->spa_bootfs);
	spa_prop_find(spa, ZPOOL_PROP_AUTOREPLACE, &autoreplace);
	spa_prop_find(spa, ZPOOL_PROP_DELEGATION, &spa->spa_delegation);
	spa_prop_find(spa, ZPOOL_PROP_FAILUREMODE, &spa->spa_failmode);
	spa_prop_find(spa, ZPOOL_PROP_AUTOEXPAND, &spa->spa_autoexpand);
	spa_prop_find(spa, ZPOOL_PROP_MULTIHOST, &spa->spa_multihost);
	spa_prop_find(spa, ZPOOL_PROP_AUTOTRIM, &spa->spa_autotrim);
	spa->spa_autoreplace = (autoreplace != 0);
	}

	/*
	* If we are importing a pool with missing top-level vdevs,
	* we enforce that the pool doesn't panic or get suspended on
	* error since the likelihood of missing data is extremely high.
	*/
	if (spa->spa_missing_tvds > 0 &&
	spa->spa_failmode != ZIO_FAILURE_MODE_CONTINUE &&
	spa->spa_load_state != SPA_LOAD_TRYIMPORT) {
	spa_load_note(spa, "forcing failmode to 'continue' "
	"as some top level vdevs are missing");
	spa->spa_failmode = ZIO_FAILURE_MODE_CONTINUE;
	}

	return (0);
	}

	static int
	spa_ld_open_aux_vdevs(spa_t *spa, spa_import_type_t type)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	/*
	* If we're assembling the pool from the split-off vdevs of
	* an existing pool, we don't want to attach the spares & cache
	* devices.
	*/

	/*
	* Load any hot spares for this pool.
	*/
	error = spa_dir_prop(spa, DMU_POOL_SPARES, &spa->spa_spares.sav_object,
	B_FALSE);
	if (error != 0 && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	if (error == 0 && type != SPA_IMPORT_ASSEMBLE) {
	ASSERT(spa_version(spa) >= SPA_VERSION_SPARES);
	if (load_nvlist(spa, spa->spa_spares.sav_object,
	&spa->spa_spares.sav_config) != 0) {
	spa_load_failed(spa, "error loading spares nvlist");
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	spa_load_spares(spa);
	spa_config_exit(spa, SCL_ALL, FTAG);
	} else if (error == 0) {
	spa->spa_spares.sav_sync = B_TRUE;
	}

	/*
	* Load any level 2 ARC devices for this pool.
	*/
	error = spa_dir_prop(spa, DMU_POOL_L2CACHE,
	&spa->spa_l2cache.sav_object, B_FALSE);
	if (error != 0 && error != ENOENT)
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	if (error == 0 && type != SPA_IMPORT_ASSEMBLE) {
	ASSERT(spa_version(spa) >= SPA_VERSION_L2CACHE);
	if (load_nvlist(spa, spa->spa_l2cache.sav_object,
	&spa->spa_l2cache.sav_config) != 0) {
	spa_load_failed(spa, "error loading l2cache nvlist");
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	spa_load_l2cache(spa);
	spa_config_exit(spa, SCL_ALL, FTAG);
	} else if (error == 0) {
	spa->spa_l2cache.sav_sync = B_TRUE;
	}

	return (0);
	}

	static int
	spa_ld_load_vdev_metadata(spa_t *spa)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	/*
	* If the 'multihost' property is set, then never allow a pool to
	* be imported when the system hostid is zero. The exception to
	* this rule is zdb which is always allowed to access pools.
	*/
	if (spa_multihost(spa) && spa_get_hostid(spa) == 0 &&
	(spa->spa_import_flags & ZFS_IMPORT_SKIP_MMP) == 0) {
	fnvlist_add_uint64(spa->spa_load_info,
	ZPOOL_CONFIG_MMP_STATE, MMP_STATE_NO_HOSTID);
	return (spa_vdev_err(rvd, VDEV_AUX_ACTIVE, EREMOTEIO));
	}

	/*
	* If the 'autoreplace' property is set, then post a resource notifying
	* the ZFS DE that it should not issue any faults for unopenable
	* devices. We also iterate over the vdevs, and post a sysevent for any
	* unopenable vdevs so that the normal autoreplace handler can take
	* over.
	*/
	if (spa->spa_autoreplace && spa->spa_load_state != SPA_LOAD_TRYIMPORT) {
	spa_check_removed(spa->spa_root_vdev);
	/*
	* For the import case, this is done in spa_import(), because
	* at this point we're using the spare definitions from
	* the MOS config, not necessarily from the userland config.
	*/
	if (spa->spa_load_state != SPA_LOAD_IMPORT) {
	spa_aux_check_removed(&spa->spa_spares);
	spa_aux_check_removed(&spa->spa_l2cache);
	}
	}

	/*
	* Load the vdev metadata such as metaslabs, DTLs, spacemap object, etc.
	*/
	error = vdev_load(rvd);
	if (error != 0) {
	spa_load_failed(spa, "vdev_load failed [error=%d]", error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, error));
	}

	error = spa_ld_log_spacemaps(spa);
	if (error != 0) {
	spa_load_failed(spa, "spa_ld_log_sm_data failed [error=%d]",
	error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, error));
	}

	/*
	* Propagate the leaf DTLs we just loaded all the way up the vdev tree.
	*/
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	vdev_dtl_reassess(rvd, 0, 0, B_FALSE, B_FALSE);
	spa_config_exit(spa, SCL_ALL, FTAG);

	return (0);
	}

	static int
	spa_ld_load_dedup_tables(spa_t *spa)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	error = ddt_load(spa);
	if (error != 0) {
	spa_load_failed(spa, "ddt_load failed [error=%d]", error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA, EIO));
	}

	return (0);
	}

	static int
	spa_ld_verify_logs(spa_t spa, spa_import_type_t type, char *ereport)
	{
	vdev_t *rvd = spa->spa_root_vdev;

	if (type != SPA_IMPORT_ASSEMBLE && spa_writeable(spa)) {
	boolean_t missing = spa_check_logs(spa);
	if (missing) {
	if (spa->spa_missing_tvds != 0) {
	spa_load_note(spa, "spa_check_logs failed "
	"so dropping the logs");
	} else {
	*ereport = FM_EREPORT_ZFS_LOG_REPLAY;
	spa_load_failed(spa, "spa_check_logs failed");
	return (spa_vdev_err(rvd, VDEV_AUX_BAD_LOG,
	ENXIO));
	}
	}
	}

	return (0);
	}

	static int
	spa_ld_verify_pool_data(spa_t *spa)
	{
	int error = 0;
	vdev_t *rvd = spa->spa_root_vdev;

	/*
	* We've successfully opened the pool, verify that we're ready
	* to start pushing transactions.
	*/
	if (spa->spa_load_state != SPA_LOAD_TRYIMPORT) {
	error = spa_load_verify(spa);
	if (error != 0) {
	spa_load_failed(spa, "spa_load_verify failed "
	"[error=%d]", error);
	return (spa_vdev_err(rvd, VDEV_AUX_CORRUPT_DATA,
	error));
	}
	}

	return (0);
	}

	static void
	spa_ld_claim_log_blocks(spa_t *spa)
	{
	dmu_tx_t *tx;
	dsl_pool_t *dp = spa_get_dsl(spa);

	/*
	* Claim log blocks that haven't been committed yet.
	* This must all happen in a single txg.
	* Note: spa_claim_max_txg is updated by spa_claim_notify(),
	* invoked from zil_claim_log_block()'s i/o done callback.
	* Price of rollback is that we abandon the log.
	*/
	spa->spa_claiming = B_TRUE;

	tx = dmu_tx_create_assigned(dp, spa_first_txg(spa));
	(void) dmu_objset_find_dp(dp, dp->dp_root_dir_obj,
	zil_claim, tx, DS_FIND_CHILDREN);
	dmu_tx_commit(tx);

	spa->spa_claiming = B_FALSE;

	spa_set_log_state(spa, SPA_LOG_GOOD);
	}

	static void
	spa_ld_check_for_config_update(spa_t *spa, uint64_t config_cache_txg,
	boolean_t update_config_cache)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	int need_update = B_FALSE;

	/*
	* If the config cache is stale, or we have uninitialized
	* metaslabs (see spa_vdev_add()), then update the config.
	*
	* If this is a verbatim import, trust the current
	* in-core spa_config and update the disk labels.
	*/
	if (update_config_cache \|\| config_cache_txg != spa->spa_config_txg \|\|
	spa->spa_load_state == SPA_LOAD_IMPORT \|\|
	spa->spa_load_state == SPA_LOAD_RECOVER \|\|
	(spa->spa_import_flags & ZFS_IMPORT_VERBATIM))
	need_update = B_TRUE;

	for (int c = 0; c < rvd->vdev_children; c++)
	if (rvd->vdev_child[c]->vdev_ms_array == 0)
	need_update = B_TRUE;

	/*
	* Update the config cache asynchronously in case we're the
	* root pool, in which case the config cache isn't writable yet.
	*/
	if (need_update)
	spa_async_request(spa, SPA_ASYNC_CONFIG_UPDATE);
	}

	static void
	spa_ld_prepare_for_reload(spa_t *spa)
	{
	spa_mode_t mode = spa->spa_mode;
	int async_suspended = spa->spa_async_suspended;

	spa_unload(spa);
	spa_deactivate(spa);
	spa_activate(spa, mode);

	/*
	* We save the value of spa_async_suspended as it gets reset to 0 by
	* spa_unload(). We want to restore it back to the original value before
	* returning as we might be calling spa_async_resume() later.
	*/
	spa->spa_async_suspended = async_suspended;
	}

	static int
	spa_ld_read_checkpoint_txg(spa_t *spa)
	{
	uberblock_t checkpoint;
	int error = 0;

	ASSERT0(spa->spa_checkpoint_txg);
	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	error = zap_lookup(spa->spa_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_ZPOOL_CHECKPOINT, sizeof (uint64_t),
	sizeof (uberblock_t) / sizeof (uint64_t), &checkpoint);

	if (error == ENOENT)
	return (0);

	if (error != 0)
	return (error);

	ASSERT3U(checkpoint.ub_txg, !=, 0);
	ASSERT3U(checkpoint.ub_checkpoint_txg, !=, 0);
	ASSERT3U(checkpoint.ub_timestamp, !=, 0);
	spa->spa_checkpoint_txg = checkpoint.ub_txg;
	spa->spa_checkpoint_info.sci_timestamp = checkpoint.ub_timestamp;

	return (0);
	}

	static int
	spa_ld_mos_init(spa_t *spa, spa_import_type_t type)
	{
	int error = 0;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	ASSERT(spa->spa_config_source != SPA_CONFIG_SRC_NONE);

	/*
	* Never trust the config that is provided unless we are assembling
	* a pool following a split.
	* This means don't trust blkptrs and the vdev tree in general. This
	* also effectively puts the spa in read-only mode since
	* spa_writeable() checks for spa_trust_config to be true.
	* We will later load a trusted config from the MOS.
	*/
	if (type != SPA_IMPORT_ASSEMBLE)
	spa->spa_trust_config = B_FALSE;

	/*
	* Parse the config provided to create a vdev tree.
	*/
	error = spa_ld_parse_config(spa, type);
	if (error != 0)
	return (error);

	spa_import_progress_add(spa);

	/*
	* Now that we have the vdev tree, try to open each vdev. This involves
	* opening the underlying physical device, retrieving its geometry and
	* probing the vdev with a dummy I/O. The state of each vdev will be set
	* based on the success of those operations. After this we'll be ready
	* to read from the vdevs.
	*/
	error = spa_ld_open_vdevs(spa);
	if (error != 0)
	return (error);

	/*
	* Read the label of each vdev and make sure that the GUIDs stored
	* there match the GUIDs in the config provided.
	* If we're assembling a new pool that's been split off from an
	* existing pool, the labels haven't yet been updated so we skip
	* validation for now.
	*/
	if (type != SPA_IMPORT_ASSEMBLE) {
	error = spa_ld_validate_vdevs(spa);
	if (error != 0)
	return (error);
	}

	/*
	* Read all vdev labels to find the best uberblock (i.e. latest,
	* unless spa_load_max_txg is set) and store it in spa_uberblock. We
	* get the list of features required to read blkptrs in the MOS from
	* the vdev label with the best uberblock and verify that our version
	* of zfs supports them all.
	*/
	error = spa_ld_select_uberblock(spa, type);
	if (error != 0)
	return (error);

	/*
	* Pass that uberblock to the dsl_pool layer which will open the root
	* blkptr. This blkptr points to the latest version of the MOS and will
	* allow us to read its contents.
	*/
	error = spa_ld_open_rootbp(spa);
	if (error != 0)
	return (error);

	return (0);
	}

	static int
	spa_ld_checkpoint_rewind(spa_t *spa)
	{
	uberblock_t checkpoint;
	int error = 0;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	ASSERT(spa->spa_import_flags & ZFS_IMPORT_CHECKPOINT);

	error = zap_lookup(spa->spa_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_ZPOOL_CHECKPOINT, sizeof (uint64_t),
	sizeof (uberblock_t) / sizeof (uint64_t), &checkpoint);

	if (error != 0) {
	spa_load_failed(spa, "unable to retrieve checkpointed "
	"uberblock from the MOS config [error=%d]", error);

	if (error == ENOENT)
	error = ZFS_ERR_NO_CHECKPOINT;

	return (error);
	}

	ASSERT3U(checkpoint.ub_txg, <, spa->spa_uberblock.ub_txg);
	ASSERT3U(checkpoint.ub_txg, ==, checkpoint.ub_checkpoint_txg);

	/*
	* We need to update the txg and timestamp of the checkpointed
	* uberblock to be higher than the latest one. This ensures that
	* the checkpointed uberblock is selected if we were to close and
	* reopen the pool right after we've written it in the vdev labels.
	* (also see block comment in vdev_uberblock_compare)
	*/
	checkpoint.ub_txg = spa->spa_uberblock.ub_txg + 1;
	checkpoint.ub_timestamp = gethrestime_sec();

	/*
	* Set current uberblock to be the checkpointed uberblock.
	*/
	spa->spa_uberblock = checkpoint;

	/*
	* If we are doing a normal rewind, then the pool is open for
	* writing and we sync the "updated" checkpointed uberblock to
	* disk. Once this is done, we've basically rewound the whole
	* pool and there is no way back.
	*
	* There are cases when we don't want to attempt and sync the
	* checkpointed uberblock to disk because we are opening a
	* pool as read-only. Specifically, verifying the checkpointed
	* state with zdb, and importing the checkpointed state to get
	* a "preview" of its content.
	*/
	if (spa_writeable(spa)) {
	vdev_t *rvd = spa->spa_root_vdev;

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	vdev_t *svd[SPA_SYNC_MIN_VDEVS] = { NULL };
	int svdcount = 0;
	int children = rvd->vdev_children;
	int c0 = spa_get_random(children);

	for (int c = 0; c < children; c++) {
	vdev_t *vd = rvd->vdev_child[(c0 + c) % children];

	/* Stop when revisiting the first vdev */
	if (c > 0 && svd[0] == vd)
	break;

	if (vd->vdev_ms_array == 0 \|\| vd->vdev_islog \|\|
	!vdev_is_concrete(vd))
	continue;

	svd[svdcount++] = vd;
	if (svdcount == SPA_SYNC_MIN_VDEVS)
	break;
	}
	error = vdev_config_sync(svd, svdcount, spa->spa_first_txg);
	if (error == 0)
	spa->spa_last_synced_guid = rvd->vdev_guid;
	spa_config_exit(spa, SCL_ALL, FTAG);

	if (error != 0) {
	spa_load_failed(spa, "failed to write checkpointed "
	"uberblock to the vdev labels [error=%d]", error);
	return (error);
	}
	}

	return (0);
	}

	static int
	spa_ld_mos_with_trusted_config(spa_t *spa, spa_import_type_t type,
	boolean_t *update_config_cache)
	{
	int error;

	/*
	* Parse the config for pool, open and validate vdevs,
	* select an uberblock, and use that uberblock to open
	* the MOS.
	*/
	error = spa_ld_mos_init(spa, type);
	if (error != 0)
	return (error);

	/*
	* Retrieve the trusted config stored in the MOS and use it to create
	* a new, exact version of the vdev tree, then reopen all vdevs.
	*/
	error = spa_ld_trusted_config(spa, type, B_FALSE);
	if (error == EAGAIN) {
	if (update_config_cache != NULL)
	*update_config_cache = B_TRUE;

	/*
	* Redo the loading process with the trusted config if it is
	* too different from the untrusted config.
	*/
	spa_ld_prepare_for_reload(spa);
	spa_load_note(spa, "RELOADING");
	error = spa_ld_mos_init(spa, type);
	if (error != 0)
	return (error);

	error = spa_ld_trusted_config(spa, type, B_TRUE);
	if (error != 0)
	return (error);

	} else if (error != 0) {
	return (error);
	}

	return (0);
	}

	/*
	* Load an existing storage pool, using the config provided. This config
	* describes which vdevs are part of the pool and is later validated against
	* partial configs present in each vdev's label and an entire copy of the
	* config stored in the MOS.
	*/
	static int
	spa_load_impl(spa_t spa, spa_import_type_t type, char *ereport)
	{
	int error = 0;
	boolean_t missing_feat_write = B_FALSE;
	boolean_t checkpoint_rewind =
	(spa->spa_import_flags & ZFS_IMPORT_CHECKPOINT);
	boolean_t update_config_cache = B_FALSE;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	ASSERT(spa->spa_config_source != SPA_CONFIG_SRC_NONE);

	spa_load_note(spa, "LOADING");

	error = spa_ld_mos_with_trusted_config(spa, type, &update_config_cache);
	if (error != 0)
	return (error);

	/*
	* If we are rewinding to the checkpoint then we need to repeat
	* everything we've done so far in this function but this time
	* selecting the checkpointed uberblock and using that to open
	* the MOS.
	*/
	if (checkpoint_rewind) {
	/*
	* If we are rewinding to the checkpoint update config cache
	* anyway.
	*/
	update_config_cache = B_TRUE;

	/*
	* Extract the checkpointed uberblock from the current MOS
	* and use this as the pool's uberblock from now on. If the
	* pool is imported as writeable we also write the checkpoint
	* uberblock to the labels, making the rewind permanent.
	*/
	error = spa_ld_checkpoint_rewind(spa);
	if (error != 0)
	return (error);

	/*
	* Redo the loading process again with the
	* checkpointed uberblock.
	*/
	spa_ld_prepare_for_reload(spa);
	spa_load_note(spa, "LOADING checkpointed uberblock");
	error = spa_ld_mos_with_trusted_config(spa, type, NULL);
	if (error != 0)
	return (error);
	}

	/*
	* Retrieve the checkpoint txg if the pool has a checkpoint.
	*/
	error = spa_ld_read_checkpoint_txg(spa);
	if (error != 0)
	return (error);

	/*
	* Retrieve the mapping of indirect vdevs. Those vdevs were removed
	* from the pool and their contents were re-mapped to other vdevs. Note
	* that everything that we read before this step must have been
	* rewritten on concrete vdevs after the last device removal was
	* initiated. Otherwise we could be reading from indirect vdevs before
	* we have loaded their mappings.
	*/
	error = spa_ld_open_indirect_vdev_metadata(spa);
	if (error != 0)
	return (error);

	/*
	* Retrieve the full list of active features from the MOS and check if
	* they are all supported.
	*/
	error = spa_ld_check_features(spa, &missing_feat_write);
	if (error != 0)
	return (error);

	/*
	* Load several special directories from the MOS needed by the dsl_pool
	* layer.
	*/
	error = spa_ld_load_special_directories(spa);
	if (error != 0)
	return (error);

	/*
	* Retrieve pool properties from the MOS.
	*/
	error = spa_ld_get_props(spa);
	if (error != 0)
	return (error);

	/*
	* Retrieve the list of auxiliary devices - cache devices and spares -
	* and open them.
	*/
	error = spa_ld_open_aux_vdevs(spa, type);
	if (error != 0)
	return (error);

	/*
	* Load the metadata for all vdevs. Also check if unopenable devices
	* should be autoreplaced.
	*/
	error = spa_ld_load_vdev_metadata(spa);
	if (error != 0)
	return (error);

	error = spa_ld_load_dedup_tables(spa);
	if (error != 0)
	return (error);

	/*
	* Verify the logs now to make sure we don't have any unexpected errors
	* when we claim log blocks later.
	*/
	error = spa_ld_verify_logs(spa, type, ereport);
	if (error != 0)
	return (error);

	if (missing_feat_write) {
	ASSERT(spa->spa_load_state == SPA_LOAD_TRYIMPORT);

	/*
	* At this point, we know that we can open the pool in
	* read-only mode but not read-write mode. We now have enough
	* information and can return to userland.
	*/
	return (spa_vdev_err(spa->spa_root_vdev, VDEV_AUX_UNSUP_FEAT,
	ENOTSUP));
	}

	/*
	* Traverse the last txgs to make sure the pool was left off in a safe
	* state. When performing an extreme rewind, we verify the whole pool,
	* which can take a very long time.
	*/
	error = spa_ld_verify_pool_data(spa);
	if (error != 0)
	return (error);

	/*
	* Calculate the deflated space for the pool. This must be done before
	* we write anything to the pool because we'd need to update the space
	* accounting using the deflated sizes.
	*/
	spa_update_dspace(spa);

	/*
	* We have now retrieved all the information we needed to open the
	* pool. If we are importing the pool in read-write mode, a few
	* additional steps must be performed to finish the import.
	*/
	if (spa_writeable(spa) && (spa->spa_load_state == SPA_LOAD_RECOVER \|\|
	spa->spa_load_max_txg == UINT64_MAX)) {
	uint64_t config_cache_txg = spa->spa_config_txg;

	ASSERT(spa->spa_load_state != SPA_LOAD_TRYIMPORT);

	/*
	* In case of a checkpoint rewind, log the original txg
	* of the checkpointed uberblock.
	*/
	if (checkpoint_rewind) {
	spa_history_log_internal(spa, "checkpoint rewind",
	NULL, "rewound state to txg=%llu",
	(u_longlong_t)spa->spa_uberblock.ub_checkpoint_txg);
	}

	/*
	* Traverse the ZIL and claim all blocks.
	*/
	spa_ld_claim_log_blocks(spa);

	/*
	* Kick-off the syncing thread.
	*/
	spa->spa_sync_on = B_TRUE;
	txg_sync_start(spa->spa_dsl_pool);
	mmp_thread_start(spa);

	/*
	* Wait for all claims to sync. We sync up to the highest
	* claimed log block birth time so that claimed log blocks
	* don't appear to be from the future. spa_claim_max_txg
	* will have been set for us by ZIL traversal operations
	* performed above.
	*/
	txg_wait_synced(spa->spa_dsl_pool, spa->spa_claim_max_txg);

	/*
	* Check if we need to request an update of the config. On the
	* next sync, we would update the config stored in vdev labels
	* and the cachefile (by default /etc/zfs/zpool.cache).
	*/
	spa_ld_check_for_config_update(spa, config_cache_txg,
	update_config_cache);

	/*
	* Check if a rebuild was in progress and if so resume it.
	* Then check all DTLs to see if anything needs resilvering.
	* The resilver will be deferred if a rebuild was started.
	*/
	if (vdev_rebuild_active(spa->spa_root_vdev)) {
	vdev_rebuild_restart(spa);
	} else if (!dsl_scan_resilvering(spa->spa_dsl_pool) &&
	vdev_resilver_needed(spa->spa_root_vdev, NULL, NULL)) {
	spa_async_request(spa, SPA_ASYNC_RESILVER);
	}

	/*
	* Log the fact that we booted up (so that we can detect if
	* we rebooted in the middle of an operation).
	*/
	spa_history_log_version(spa, "open", NULL);

	spa_restart_removal(spa);
	spa_spawn_aux_threads(spa);

	/*
	* Delete any inconsistent datasets.
	*
	* Note:
	* Since we may be issuing deletes for clones here,
	* we make sure to do so after we've spawned all the
	* auxiliary threads above (from which the livelist
	* deletion zthr is part of).
	*/
	(void) dmu_objset_find(spa_name(spa),
	dsl_destroy_inconsistent, NULL, DS_FIND_CHILDREN);

	/*
	* Clean up any stale temporary dataset userrefs.
	*/
	dsl_pool_clean_tmp_userrefs(spa->spa_dsl_pool);

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	vdev_initialize_restart(spa->spa_root_vdev);
	vdev_trim_restart(spa->spa_root_vdev);
	vdev_autotrim_restart(spa);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	}

	spa_import_progress_remove(spa_guid(spa));
	spa_async_request(spa, SPA_ASYNC_L2CACHE_REBUILD);

	spa_load_note(spa, "LOADED");

	return (0);
	}

	static int
	spa_load_retry(spa_t *spa, spa_load_state_t state)
	{
	spa_mode_t mode = spa->spa_mode;

	spa_unload(spa);
	spa_deactivate(spa);

	spa->spa_load_max_txg = spa->spa_uberblock.ub_txg - 1;

	spa_activate(spa, mode);
	spa_async_suspend(spa);

	spa_load_note(spa, "spa_load_retry: rewind, max txg: %llu",
	(u_longlong_t)spa->spa_load_max_txg);

	return (spa_load(spa, state, SPA_IMPORT_EXISTING));
	}

	/*
	* If spa_load() fails this function will try loading prior txg's. If
	* 'state' is SPA_LOAD_RECOVER and one of these loads succeeds the pool
	* will be rewound to that txg. If 'state' is not SPA_LOAD_RECOVER this
	* function will not rewind the pool and will return the same error as
	* spa_load().
	*/
	static int
	spa_load_best(spa_t *spa, spa_load_state_t state, uint64_t max_request,
	int rewind_flags)
	{
	nvlist_t *loadinfo = NULL;
	nvlist_t *config = NULL;
	int load_error, rewind_error;
	uint64_t safe_rewind_txg;
	uint64_t min_txg;

	if (spa->spa_load_txg && state == SPA_LOAD_RECOVER) {
	spa->spa_load_max_txg = spa->spa_load_txg;
	spa_set_log_state(spa, SPA_LOG_CLEAR);
	} else {
	spa->spa_load_max_txg = max_request;
	if (max_request != UINT64_MAX)
	spa->spa_extreme_rewind = B_TRUE;
	}

	load_error = rewind_error = spa_load(spa, state, SPA_IMPORT_EXISTING);
	if (load_error == 0)
	return (0);
	if (load_error == ZFS_ERR_NO_CHECKPOINT) {
	/*
	* When attempting checkpoint-rewind on a pool with no
	* checkpoint, we should not attempt to load uberblocks
	* from previous txgs when spa_load fails.
	*/
	ASSERT(spa->spa_import_flags & ZFS_IMPORT_CHECKPOINT);
	spa_import_progress_remove(spa_guid(spa));
	return (load_error);
	}

	if (spa->spa_root_vdev != NULL)
	config = spa_config_generate(spa, NULL, -1ULL, B_TRUE);

	spa->spa_last_ubsync_txg = spa->spa_uberblock.ub_txg;
	spa->spa_last_ubsync_txg_ts = spa->spa_uberblock.ub_timestamp;

	if (rewind_flags & ZPOOL_NEVER_REWIND) {
	nvlist_free(config);
	spa_import_progress_remove(spa_guid(spa));
	return (load_error);
	}

	if (state == SPA_LOAD_RECOVER) {
	/* Price of rolling back is discarding txgs, including log */
	spa_set_log_state(spa, SPA_LOG_CLEAR);
	} else {
	/*
	* If we aren't rolling back save the load info from our first
	* import attempt so that we can restore it after attempting
	* to rewind.
	*/
	loadinfo = spa->spa_load_info;
	spa->spa_load_info = fnvlist_alloc();
	}

	spa->spa_load_max_txg = spa->spa_last_ubsync_txg;
	safe_rewind_txg = spa->spa_last_ubsync_txg - TXG_DEFER_SIZE;
	min_txg = (rewind_flags & ZPOOL_EXTREME_REWIND) ?
	TXG_INITIAL : safe_rewind_txg;

	/*
	* Continue as long as we're finding errors, we're still within
	* the acceptable rewind range, and we're still finding uberblocks
	*/
	while (rewind_error && spa->spa_uberblock.ub_txg >= min_txg &&
	spa->spa_uberblock.ub_txg <= spa->spa_load_max_txg) {
	if (spa->spa_load_max_txg < safe_rewind_txg)
	spa->spa_extreme_rewind = B_TRUE;
	rewind_error = spa_load_retry(spa, state);
	}

	spa->spa_extreme_rewind = B_FALSE;
	spa->spa_load_max_txg = UINT64_MAX;

	if (config && (rewind_error \|\| state != SPA_LOAD_RECOVER))
	spa_config_set(spa, config);
	else
	nvlist_free(config);

	if (state == SPA_LOAD_RECOVER) {
	ASSERT3P(loadinfo, ==, NULL);
	spa_import_progress_remove(spa_guid(spa));
	return (rewind_error);
	} else {
	/* Store the rewind info as part of the initial load info */
	fnvlist_add_nvlist(loadinfo, ZPOOL_CONFIG_REWIND_INFO,
	spa->spa_load_info);

	/* Restore the initial load info */
	fnvlist_free(spa->spa_load_info);
	spa->spa_load_info = loadinfo;

	spa_import_progress_remove(spa_guid(spa));
	return (load_error);
	}
	}

	/*
	* Pool Open/Import
	*
	* The import case is identical to an open except that the configuration is sent
	* down from userland, instead of grabbed from the configuration cache. For the
	* case of an open, the pool configuration will exist in the
	* POOL_STATE_UNINITIALIZED state.
	*
	* The stats information (gen/count/ustats) is used to gather vdev statistics at
	* the same time open the pool, without having to keep around the spa_t in some
	* ambiguous state.
	*/
	static int
	spa_open_common(const char pool, spa_t spapp, void tag, nvlist_t *nvpolicy,
	nvlist_t **config)
	{
	spa_t *spa;
	spa_load_state_t state = SPA_LOAD_OPEN;
	int error;
	int locked = B_FALSE;
	int firstopen = B_FALSE;

	*spapp = NULL;

	/*
	* As disgusting as this is, we need to support recursive calls to this
	* function because dsl_dir_open() is called during spa_load(), and ends
	* up calling spa_open() again. The real fix is to figure out how to
	* avoid dsl_dir_open() calling this in the first place.
	*/
	if (MUTEX_NOT_HELD(&spa_namespace_lock)) {
	mutex_enter(&spa_namespace_lock);
	locked = B_TRUE;
	}

	if ((spa = spa_lookup(pool)) == NULL) {
	if (locked)
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(ENOENT));
	}

	if (spa->spa_state == POOL_STATE_UNINITIALIZED) {
	zpool_load_policy_t policy;

	firstopen = B_TRUE;

	zpool_get_load_policy(nvpolicy ? nvpolicy : spa->spa_config,
	&policy);
	if (policy.zlp_rewind & ZPOOL_DO_REWIND)
	state = SPA_LOAD_RECOVER;

	spa_activate(spa, spa_mode_global);

	if (state != SPA_LOAD_RECOVER)
	spa->spa_last_ubsync_txg = spa->spa_load_txg = 0;
	spa->spa_config_source = SPA_CONFIG_SRC_CACHEFILE;

	zfs_dbgmsg("spa_open_common: opening %s", pool);
	error = spa_load_best(spa, state, policy.zlp_txg,
	policy.zlp_rewind);

	if (error == EBADF) {
	/*
	* If vdev_validate() returns failure (indicated by
	* EBADF), it indicates that one of the vdevs indicates
	* that the pool has been exported or destroyed. If
	* this is the case, the config cache is out of sync and
	* we should remove the pool from the namespace.
	*/
	spa_unload(spa);
	spa_deactivate(spa);
	spa_write_cachefile(spa, B_TRUE, B_TRUE);
	spa_remove(spa);
	if (locked)
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(ENOENT));
	}

	if (error) {
	/*
	* We can't open the pool, but we still have useful
	* information: the state of each vdev after the
	* attempted vdev_open(). Return this to the user.
	*/
	if (config != NULL && spa->spa_config) {
	VERIFY(nvlist_dup(spa->spa_config, config,
	KM_SLEEP) == 0);
	VERIFY(nvlist_add_nvlist(*config,
	ZPOOL_CONFIG_LOAD_INFO,
	spa->spa_load_info) == 0);
	}
	spa_unload(spa);
	spa_deactivate(spa);
	spa->spa_last_open_failed = error;
	if (locked)
	mutex_exit(&spa_namespace_lock);
	*spapp = NULL;
	return (error);
	}
	}

	spa_open_ref(spa, tag);

	if (config != NULL)
	*config = spa_config_generate(spa, NULL, -1ULL, B_TRUE);

	/*
	* If we've recovered the pool, pass back any information we
	* gathered while doing the load.
	*/
	if (state == SPA_LOAD_RECOVER) {
	VERIFY(nvlist_add_nvlist(*config, ZPOOL_CONFIG_LOAD_INFO,
	spa->spa_load_info) == 0);
	}

	if (locked) {
	spa->spa_last_open_failed = 0;
	spa->spa_last_ubsync_txg = 0;
	spa->spa_load_txg = 0;
	mutex_exit(&spa_namespace_lock);
	}

	if (firstopen)
	zvol_create_minors_recursive(spa_name(spa));

	*spapp = spa;

	return (0);
	}

	int
	spa_open_rewind(const char name, spa_t spapp, void tag, nvlist_t *policy,
	nvlist_t **config)
	{
	return (spa_open_common(name, spapp, tag, policy, config));
	}

	int
	spa_open(const char name, spa_t spapp, void tag)
	{
	return (spa_open_common(name, spapp, tag, NULL, NULL));
	}

	/*
	* Lookup the given spa_t, incrementing the inject count in the process,
	* preventing it from being exported or destroyed.
	*/
	spa_t *
	spa_inject_addref(char *name)
	{
	spa_t *spa;

	mutex_enter(&spa_namespace_lock);
	if ((spa = spa_lookup(name)) == NULL) {
	mutex_exit(&spa_namespace_lock);
	return (NULL);
	}
	spa->spa_inject_ref++;
	mutex_exit(&spa_namespace_lock);

	return (spa);
	}

	void
	spa_inject_delref(spa_t *spa)
	{
	mutex_enter(&spa_namespace_lock);
	spa->spa_inject_ref--;
	mutex_exit(&spa_namespace_lock);
	}

	/*
	* Add spares device information to the nvlist.
	*/
	static void
	spa_add_spares(spa_t spa, nvlist_t config)
	{
	nvlist_t **spares;
	uint_t i, nspares;
	nvlist_t *nvroot;
	uint64_t guid;
	vdev_stat_t *vs;
	uint_t vsc;
	uint64_t pool;

	ASSERT(spa_config_held(spa, SCL_CONFIG, RW_READER));

	if (spa->spa_spares.sav_count == 0)
	return;

	VERIFY(nvlist_lookup_nvlist(config,
	ZPOOL_CONFIG_VDEV_TREE, &nvroot) == 0);
	VERIFY(nvlist_lookup_nvlist_array(spa->spa_spares.sav_config,
	ZPOOL_CONFIG_SPARES, &spares, &nspares) == 0);
	if (nspares != 0) {
	VERIFY(nvlist_add_nvlist_array(nvroot,
	ZPOOL_CONFIG_SPARES, spares, nspares) == 0);
	VERIFY(nvlist_lookup_nvlist_array(nvroot,
	ZPOOL_CONFIG_SPARES, &spares, &nspares) == 0);

	/*
	* Go through and find any spares which have since been
	* repurposed as an active spare. If this is the case, update
	* their status appropriately.
	*/
	for (i = 0; i < nspares; i++) {
	VERIFY(nvlist_lookup_uint64(spares[i],
	ZPOOL_CONFIG_GUID, &guid) == 0);
	if (spa_spare_exists(guid, &pool, NULL) &&
	pool != 0ULL) {
	VERIFY(nvlist_lookup_uint64_array(
	spares[i], ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t **)&vs, &vsc) == 0);
	vs->vs_state = VDEV_STATE_CANT_OPEN;
	vs->vs_aux = VDEV_AUX_SPARED;
	}
	}
	}
	}

	/*
	* Add l2cache device information to the nvlist, including vdev stats.
	*/
	static void
	spa_add_l2cache(spa_t spa, nvlist_t config)
	{
	nvlist_t **l2cache;
	uint_t i, j, nl2cache;
	nvlist_t *nvroot;
	uint64_t guid;
	vdev_t *vd;
	vdev_stat_t *vs;
	uint_t vsc;

	ASSERT(spa_config_held(spa, SCL_CONFIG, RW_READER));

	if (spa->spa_l2cache.sav_count == 0)
	return;

	VERIFY(nvlist_lookup_nvlist(config,
	ZPOOL_CONFIG_VDEV_TREE, &nvroot) == 0);
	VERIFY(nvlist_lookup_nvlist_array(spa->spa_l2cache.sav_config,
	ZPOOL_CONFIG_L2CACHE, &l2cache, &nl2cache) == 0);
	if (nl2cache != 0) {
	VERIFY(nvlist_add_nvlist_array(nvroot,
	ZPOOL_CONFIG_L2CACHE, l2cache, nl2cache) == 0);
	VERIFY(nvlist_lookup_nvlist_array(nvroot,
	ZPOOL_CONFIG_L2CACHE, &l2cache, &nl2cache) == 0);

	/*
	* Update level 2 cache device stats.
	*/

	for (i = 0; i < nl2cache; i++) {
	VERIFY(nvlist_lookup_uint64(l2cache[i],
	ZPOOL_CONFIG_GUID, &guid) == 0);

	vd = NULL;
	for (j = 0; j < spa->spa_l2cache.sav_count; j++) {
	if (guid ==
	spa->spa_l2cache.sav_vdevs[j]->vdev_guid) {
	vd = spa->spa_l2cache.sav_vdevs[j];
	break;
	}
	}
	ASSERT(vd != NULL);

	VERIFY(nvlist_lookup_uint64_array(l2cache[i],
	ZPOOL_CONFIG_VDEV_STATS, (uint64_t **)&vs, &vsc)
	== 0);
	vdev_get_stats(vd, vs);
	vdev_config_generate_stats(vd, l2cache[i]);

	}
	}
	}

	static void
	spa_feature_stats_from_disk(spa_t spa, nvlist_t features)
	{
	zap_cursor_t zc;
	zap_attribute_t za;

	if (spa->spa_feat_for_read_obj != 0) {
	for (zap_cursor_init(&zc, spa->spa_meta_objset,
	spa->spa_feat_for_read_obj);
	zap_cursor_retrieve(&zc, &za) == 0;
	zap_cursor_advance(&zc)) {
	ASSERT(za.za_integer_length == sizeof (uint64_t) &&
	za.za_num_integers == 1);
	VERIFY0(nvlist_add_uint64(features, za.za_name,
	za.za_first_integer));
	}
	zap_cursor_fini(&zc);
	}

	if (spa->spa_feat_for_write_obj != 0) {
	for (zap_cursor_init(&zc, spa->spa_meta_objset,
	spa->spa_feat_for_write_obj);
	zap_cursor_retrieve(&zc, &za) == 0;
	zap_cursor_advance(&zc)) {
	ASSERT(za.za_integer_length == sizeof (uint64_t) &&
	za.za_num_integers == 1);
	VERIFY0(nvlist_add_uint64(features, za.za_name,
	za.za_first_integer));
	}
	zap_cursor_fini(&zc);
	}
	}

	static void
	spa_feature_stats_from_cache(spa_t spa, nvlist_t features)
	{
	int i;

	for (i = 0; i < SPA_FEATURES; i++) {
	zfeature_info_t feature = spa_feature_table[i];
	uint64_t refcount;

	if (feature_get_refcount(spa, &feature, &refcount) != 0)
	continue;

	VERIFY0(nvlist_add_uint64(features, feature.fi_guid, refcount));
	}
	}

	/*
	* Store a list of pool features and their reference counts in the
	* config.
	*
	* The first time this is called on a spa, allocate a new nvlist, fetch
	* the pool features and reference counts from disk, then save the list
	* in the spa. In subsequent calls on the same spa use the saved nvlist
	* and refresh its values from the cached reference counts. This
	* ensures we don't block here on I/O on a suspended pool so 'zpool
	* clear' can resume the pool.
	*/
	static void
	spa_add_feature_stats(spa_t spa, nvlist_t config)
	{
	nvlist_t *features;

	ASSERT(spa_config_held(spa, SCL_CONFIG, RW_READER));

	mutex_enter(&spa->spa_feat_stats_lock);
	features = spa->spa_feat_stats;

	if (features != NULL) {
	spa_feature_stats_from_cache(spa, features);
	} else {
	VERIFY0(nvlist_alloc(&features, NV_UNIQUE_NAME, KM_SLEEP));
	spa->spa_feat_stats = features;
	spa_feature_stats_from_disk(spa, features);
	}

	VERIFY0(nvlist_add_nvlist(config, ZPOOL_CONFIG_FEATURE_STATS,
	features));

	mutex_exit(&spa->spa_feat_stats_lock);
	}

	int
	spa_get_stats(const char name, nvlist_t *config,
	char *altroot, size_t buflen)
	{
	int error;
	spa_t *spa;

	*config = NULL;
	error = spa_open_common(name, &spa, FTAG, NULL, config);

	if (spa != NULL) {
	/*
	* This still leaves a window of inconsistency where the spares
	* or l2cache devices could change and the config would be
	* self-inconsistent.
	*/
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	if (*config != NULL) {
	uint64_t loadtimes[2];

	loadtimes[0] = spa->spa_loaded_ts.tv_sec;
	loadtimes[1] = spa->spa_loaded_ts.tv_nsec;
	VERIFY(nvlist_add_uint64_array(*config,
	ZPOOL_CONFIG_LOADED_TIME, loadtimes, 2) == 0);

	VERIFY(nvlist_add_uint64(*config,
	ZPOOL_CONFIG_ERRCOUNT,
	spa_get_errlog_size(spa)) == 0);

	if (spa_suspended(spa)) {
	VERIFY(nvlist_add_uint64(*config,
	ZPOOL_CONFIG_SUSPENDED,
	spa->spa_failmode) == 0);
	VERIFY(nvlist_add_uint64(*config,
	ZPOOL_CONFIG_SUSPENDED_REASON,
	spa->spa_suspended) == 0);
	}

	spa_add_spares(spa, *config);
	spa_add_l2cache(spa, *config);
	spa_add_feature_stats(spa, *config);
	}
	}

	/*
	* We want to get the alternate root even for faulted pools, so we cheat
	* and call spa_lookup() directly.
	*/
	if (altroot) {
	if (spa == NULL) {
	mutex_enter(&spa_namespace_lock);
	spa = spa_lookup(name);
	if (spa)
	spa_altroot(spa, altroot, buflen);
	else
	altroot[0] = '\0';
	spa = NULL;
	mutex_exit(&spa_namespace_lock);
	} else {
	spa_altroot(spa, altroot, buflen);
	}
	}

	if (spa != NULL) {
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	spa_close(spa, FTAG);
	}

	return (error);
	}

	/*
	* Validate that the auxiliary device array is well formed. We must have an
	* array of nvlists, each which describes a valid leaf vdev. If this is an
	* import (mode is VDEV_ALLOC_SPARE), then we allow corrupted spares to be
	* specified, as long as they are well-formed.
	*/
	static int
	spa_validate_aux_devs(spa_t spa, nvlist_t nvroot, uint64_t crtxg, int mode,
	spa_aux_vdev_t sav, const char config, uint64_t version,
	vdev_labeltype_t label)
	{
	nvlist_t **dev;
	uint_t i, ndev;
	vdev_t *vd;
	int error;

	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	/*
	* It's acceptable to have no devs specified.
	*/
	if (nvlist_lookup_nvlist_array(nvroot, config, &dev, &ndev) != 0)
	return (0);

	if (ndev == 0)
	return (SET_ERROR(EINVAL));

	/*
	* Make sure the pool is formatted with a version that supports this
	* device type.
	*/
	if (spa_version(spa) < version)
	return (SET_ERROR(ENOTSUP));

	/*
	* Set the pending device list so we correctly handle device in-use
	* checking.
	*/
	sav->sav_pending = dev;
	sav->sav_npending = ndev;

	for (i = 0; i < ndev; i++) {
	if ((error = spa_config_parse(spa, &vd, dev[i], NULL, 0,
	mode)) != 0)
	goto out;

	if (!vd->vdev_ops->vdev_op_leaf) {
	vdev_free(vd);
	error = SET_ERROR(EINVAL);
	goto out;
	}

	vd->vdev_top = vd;

	if ((error = vdev_open(vd)) == 0 &&
	(error = vdev_label_init(vd, crtxg, label)) == 0) {
	VERIFY(nvlist_add_uint64(dev[i], ZPOOL_CONFIG_GUID,
	vd->vdev_guid) == 0);
	}

	vdev_free(vd);

	if (error &&
	(mode != VDEV_ALLOC_SPARE && mode != VDEV_ALLOC_L2CACHE))
	goto out;
	else
	error = 0;
	}

	out:
	sav->sav_pending = NULL;
	sav->sav_npending = 0;
	return (error);
	}

	static int
	spa_validate_aux(spa_t spa, nvlist_t nvroot, uint64_t crtxg, int mode)
	{
	int error;

	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	if ((error = spa_validate_aux_devs(spa, nvroot, crtxg, mode,
	&spa->spa_spares, ZPOOL_CONFIG_SPARES, SPA_VERSION_SPARES,
	VDEV_LABEL_SPARE)) != 0) {
	return (error);
	}

	return (spa_validate_aux_devs(spa, nvroot, crtxg, mode,
	&spa->spa_l2cache, ZPOOL_CONFIG_L2CACHE, SPA_VERSION_L2CACHE,
	VDEV_LABEL_L2CACHE));
	}

	static void
	spa_set_aux_vdevs(spa_aux_vdev_t sav, nvlist_t *devs, int ndevs,
	const char *config)
	{
	int i;

	if (sav->sav_config != NULL) {
	nvlist_t **olddevs;
	uint_t oldndevs;
	nvlist_t **newdevs;

	/*
	* Generate new dev list by concatenating with the
	* current dev list.
	*/
	VERIFY(nvlist_lookup_nvlist_array(sav->sav_config, config,
	&olddevs, &oldndevs) == 0);

	newdevs = kmem_alloc(sizeof (void )
	(ndevs + oldndevs), KM_SLEEP);
	for (i = 0; i < oldndevs; i++)
	VERIFY(nvlist_dup(olddevs[i], &newdevs[i],
	KM_SLEEP) == 0);
	for (i = 0; i < ndevs; i++)
	VERIFY(nvlist_dup(devs[i], &newdevs[i + oldndevs],
	KM_SLEEP) == 0);

	VERIFY(nvlist_remove(sav->sav_config, config,
	DATA_TYPE_NVLIST_ARRAY) == 0);

	VERIFY(nvlist_add_nvlist_array(sav->sav_config,
	config, newdevs, ndevs + oldndevs) == 0);
	for (i = 0; i < oldndevs + ndevs; i++)
	nvlist_free(newdevs[i]);
	kmem_free(newdevs, (oldndevs + ndevs) * sizeof (void *));
	} else {
	/*
	* Generate a new dev list.
	*/
	VERIFY(nvlist_alloc(&sav->sav_config, NV_UNIQUE_NAME,
	KM_SLEEP) == 0);
	VERIFY(nvlist_add_nvlist_array(sav->sav_config, config,
	devs, ndevs) == 0);
	}
	}

	/*
	* Stop and drop level 2 ARC devices
	*/
	void
	spa_l2cache_drop(spa_t *spa)
	{
	vdev_t *vd;
	int i;
	spa_aux_vdev_t *sav = &spa->spa_l2cache;

	for (i = 0; i < sav->sav_count; i++) {
	uint64_t pool;

	vd = sav->sav_vdevs[i];
	ASSERT(vd != NULL);

	if (spa_l2cache_exists(vd->vdev_guid, &pool) &&
	pool != 0ULL && l2arc_vdev_present(vd))
	l2arc_remove_vdev(vd);
	}
	}

	/*
	* Verify encryption parameters for spa creation. If we are encrypting, we must
	* have the encryption feature flag enabled.
	*/
	static int
	spa_create_check_encryption_params(dsl_crypto_params_t *dcp,
	boolean_t has_encryption)
	{
	if (dcp->cp_crypt != ZIO_CRYPT_OFF &&
	dcp->cp_crypt != ZIO_CRYPT_INHERIT &&
	!has_encryption)
	return (SET_ERROR(ENOTSUP));

	return (dmu_objset_create_crypt_check(NULL, dcp, NULL));
	}

	/*
	* Pool Creation
	*/
	int
	spa_create(const char pool, nvlist_t nvroot, nvlist_t *props,
	nvlist_t zplprops, dsl_crypto_params_t dcp)
	{
	spa_t *spa;
	char *altroot = NULL;
	vdev_t *rvd;
	dsl_pool_t *dp;
	dmu_tx_t *tx;
	int error = 0;
	uint64_t txg = TXG_INITIAL;
	nvlist_t spares, l2cache;
	uint_t nspares, nl2cache;
	uint64_t version, obj;
	boolean_t has_features;
	boolean_t has_encryption;
	boolean_t has_allocclass;
	spa_feature_t feat;
	char *feat_name;
	char *poolname;
	nvlist_t *nvl;

	if (props == NULL \|\|
	nvlist_lookup_string(props, "tname", &poolname) != 0)
	poolname = (char *)pool;

	/*
	* If this pool already exists, return failure.
	*/
	mutex_enter(&spa_namespace_lock);
	if (spa_lookup(poolname) != NULL) {
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(EEXIST));
	}

	/*
	* Allocate a new spa_t structure.
	*/
	nvl = fnvlist_alloc();
	fnvlist_add_string(nvl, ZPOOL_CONFIG_POOL_NAME, pool);
	(void) nvlist_lookup_string(props,
	zpool_prop_to_name(ZPOOL_PROP_ALTROOT), &altroot);
	spa = spa_add(poolname, nvl, altroot);
	fnvlist_free(nvl);
	spa_activate(spa, spa_mode_global);

	if (props && (error = spa_prop_validate(spa, props))) {
	spa_deactivate(spa);
	spa_remove(spa);
	mutex_exit(&spa_namespace_lock);
	return (error);
	}

	/*
	* Temporary pool names should never be written to disk.
	*/
	if (poolname != pool)
	spa->spa_import_flags \|= ZFS_IMPORT_TEMP_NAME;

	has_features = B_FALSE;
	has_encryption = B_FALSE;
	has_allocclass = B_FALSE;
	for (nvpair_t *elem = nvlist_next_nvpair(props, NULL);
	elem != NULL; elem = nvlist_next_nvpair(props, elem)) {
	if (zpool_prop_feature(nvpair_name(elem))) {
	has_features = B_TRUE;

	feat_name = strchr(nvpair_name(elem), '@') + 1;
	VERIFY0(zfeature_lookup_name(feat_name, &feat));
	if (feat == SPA_FEATURE_ENCRYPTION)
	has_encryption = B_TRUE;
	if (feat == SPA_FEATURE_ALLOCATION_CLASSES)
	has_allocclass = B_TRUE;
	}
	}

	/* verify encryption params, if they were provided */
	if (dcp != NULL) {
	error = spa_create_check_encryption_params(dcp, has_encryption);
	if (error != 0) {
	spa_deactivate(spa);
	spa_remove(spa);
	mutex_exit(&spa_namespace_lock);
	return (error);
	}
	}
	if (!has_allocclass && zfs_special_devs(nvroot, NULL)) {
	spa_deactivate(spa);
	spa_remove(spa);
	mutex_exit(&spa_namespace_lock);
	return (ENOTSUP);
	}

	if (has_features \|\| nvlist_lookup_uint64(props,
	zpool_prop_to_name(ZPOOL_PROP_VERSION), &version) != 0) {
	version = SPA_VERSION;
	}
	ASSERT(SPA_VERSION_IS_SUPPORTED(version));

	spa->spa_first_txg = txg;
	spa->spa_uberblock.ub_txg = txg - 1;
	spa->spa_uberblock.ub_version = version;
	spa->spa_ubsync = spa->spa_uberblock;
	spa->spa_load_state = SPA_LOAD_CREATE;
	spa->spa_removing_phys.sr_state = DSS_NONE;
	spa->spa_removing_phys.sr_removing_vdev = -1;
	spa->spa_removing_phys.sr_prev_indirect_vdev = -1;
	spa->spa_indirect_vdevs_loaded = B_TRUE;

	/*
	* Create "The Godfather" zio to hold all async IOs
	*/
	spa->spa_async_zio_root = kmem_alloc(max_ncpus * sizeof (void *),
	KM_SLEEP);
	for (int i = 0; i < max_ncpus; i++) {
	spa->spa_async_zio_root[i] = zio_root(spa, NULL, NULL,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE \|
	ZIO_FLAG_GODFATHER);
	}

	/*
	* Create the root vdev.
	*/
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);

	error = spa_config_parse(spa, &rvd, nvroot, NULL, 0, VDEV_ALLOC_ADD);

	ASSERT(error != 0 \|\| rvd != NULL);
	ASSERT(error != 0 \|\| spa->spa_root_vdev == rvd);

	if (error == 0 && !zfs_allocatable_devs(nvroot))
	error = SET_ERROR(EINVAL);

	if (error == 0 &&
	(error = vdev_create(rvd, txg, B_FALSE)) == 0 &&
	(error = spa_validate_aux(spa, nvroot, txg,
	VDEV_ALLOC_ADD)) == 0) {
	/*
	* instantiate the metaslab groups (this will dirty the vdevs)
	* we can no longer error exit past this point
	*/
	for (int c = 0; error == 0 && c < rvd->vdev_children; c++) {
	vdev_t *vd = rvd->vdev_child[c];

	- vdev_ashift_optimize(vd);
	vdev_metaslab_set_size(vd);
	vdev_expand(vd, txg);
	}
	}

	spa_config_exit(spa, SCL_ALL, FTAG);

	if (error != 0) {
	spa_unload(spa);
	spa_deactivate(spa);
	spa_remove(spa);
	mutex_exit(&spa_namespace_lock);
	return (error);
	}

	/*
	* Get the list of spares, if specified.
	*/
	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_SPARES,
	&spares, &nspares) == 0) {
	VERIFY(nvlist_alloc(&spa->spa_spares.sav_config, NV_UNIQUE_NAME,
	KM_SLEEP) == 0);
	VERIFY(nvlist_add_nvlist_array(spa->spa_spares.sav_config,
	ZPOOL_CONFIG_SPARES, spares, nspares) == 0);
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	spa_load_spares(spa);
	spa_config_exit(spa, SCL_ALL, FTAG);
	spa->spa_spares.sav_sync = B_TRUE;
	}

	/*
	* Get the list of level 2 cache devices, if specified.
	*/
	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_L2CACHE,
	&l2cache, &nl2cache) == 0) {
	VERIFY(nvlist_alloc(&spa->spa_l2cache.sav_config,
	NV_UNIQUE_NAME, KM_SLEEP) == 0);
	VERIFY(nvlist_add_nvlist_array(spa->spa_l2cache.sav_config,
	ZPOOL_CONFIG_L2CACHE, l2cache, nl2cache) == 0);
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	spa_load_l2cache(spa);
	spa_config_exit(spa, SCL_ALL, FTAG);
	spa->spa_l2cache.sav_sync = B_TRUE;
	}

	spa->spa_is_initializing = B_TRUE;
	spa->spa_dsl_pool = dp = dsl_pool_create(spa, zplprops, dcp, txg);
	spa->spa_is_initializing = B_FALSE;

	/*
	* Create DDTs (dedup tables).
	*/
	ddt_create(spa);

	spa_update_dspace(spa);

	tx = dmu_tx_create_assigned(dp, txg);

	/*
	* Create the pool's history object.
	*/
	if (version >= SPA_VERSION_ZPOOL_HISTORY && !spa->spa_history)
	spa_history_create_obj(spa, tx);

	spa_event_notify(spa, NULL, NULL, ESC_ZFS_POOL_CREATE);
	spa_history_log_version(spa, "create", tx);

	/*
	* Create the pool config object.
	*/
	spa->spa_config_object = dmu_object_alloc(spa->spa_meta_objset,
	DMU_OT_PACKED_NVLIST, SPA_CONFIG_BLOCKSIZE,
	DMU_OT_PACKED_NVLIST_SIZE, sizeof (uint64_t), tx);

	if (zap_add(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_CONFIG,
	sizeof (uint64_t), 1, &spa->spa_config_object, tx) != 0) {
	cmn_err(CE_PANIC, "failed to add pool config");
	}

	if (zap_add(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_CREATION_VERSION,
	sizeof (uint64_t), 1, &version, tx) != 0) {
	cmn_err(CE_PANIC, "failed to add pool version");
	}

	/* Newly created pools with the right version are always deflated. */
	if (version >= SPA_VERSION_RAIDZ_DEFLATE) {
	spa->spa_deflate = TRUE;
	if (zap_add(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_DEFLATE,
	sizeof (uint64_t), 1, &spa->spa_deflate, tx) != 0) {
	cmn_err(CE_PANIC, "failed to add deflate");
	}
	}

	/*
	* Create the deferred-free bpobj. Turn off compression
	* because sync-to-convergence takes longer if the blocksize
	* keeps changing.
	*/
	obj = bpobj_alloc(spa->spa_meta_objset, 1 << 14, tx);
	dmu_object_set_compress(spa->spa_meta_objset, obj,
	ZIO_COMPRESS_OFF, tx);
	if (zap_add(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_SYNC_BPOBJ,
	sizeof (uint64_t), 1, &obj, tx) != 0) {
	cmn_err(CE_PANIC, "failed to add bpobj");
	}
	VERIFY3U(0, ==, bpobj_open(&spa->spa_deferred_bpobj,
	spa->spa_meta_objset, obj));

	/*
	* Generate some random noise for salted checksums to operate on.
	*/
	(void) random_get_pseudo_bytes(spa->spa_cksum_salt.zcs_bytes,
	sizeof (spa->spa_cksum_salt.zcs_bytes));

	/*
	* Set pool properties.
	*/
	spa->spa_bootfs = zpool_prop_default_numeric(ZPOOL_PROP_BOOTFS);
	spa->spa_delegation = zpool_prop_default_numeric(ZPOOL_PROP_DELEGATION);
	spa->spa_failmode = zpool_prop_default_numeric(ZPOOL_PROP_FAILUREMODE);
	spa->spa_autoexpand = zpool_prop_default_numeric(ZPOOL_PROP_AUTOEXPAND);
	spa->spa_multihost = zpool_prop_default_numeric(ZPOOL_PROP_MULTIHOST);
	spa->spa_autotrim = zpool_prop_default_numeric(ZPOOL_PROP_AUTOTRIM);

	if (props != NULL) {
	spa_configfile_set(spa, props, B_FALSE);
	spa_sync_props(props, tx);
	}

	dmu_tx_commit(tx);

	spa->spa_sync_on = B_TRUE;
	txg_sync_start(dp);
	mmp_thread_start(spa);
	txg_wait_synced(dp, txg);

	spa_spawn_aux_threads(spa);

	spa_write_cachefile(spa, B_FALSE, B_TRUE);

	/*
	* Don't count references from objsets that are already closed
	* and are making their way through the eviction process.
	*/
	spa_evicting_os_wait(spa);
	spa->spa_minref = zfs_refcount_count(&spa->spa_refcount);
	spa->spa_load_state = SPA_LOAD_NONE;

	mutex_exit(&spa_namespace_lock);

	return (0);
	}

	/*
	* Import a non-root pool into the system.
	*/
	int
	spa_import(char pool, nvlist_t config, nvlist_t *props, uint64_t flags)
	{
	spa_t *spa;
	char *altroot = NULL;
	spa_load_state_t state = SPA_LOAD_IMPORT;
	zpool_load_policy_t policy;
	spa_mode_t mode = spa_mode_global;
	uint64_t readonly = B_FALSE;
	int error;
	nvlist_t *nvroot;
	nvlist_t spares, l2cache;
	uint_t nspares, nl2cache;

	/*
	* If a pool with this name exists, return failure.
	*/
	mutex_enter(&spa_namespace_lock);
	if (spa_lookup(pool) != NULL) {
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(EEXIST));
	}

	/*
	* Create and initialize the spa structure.
	*/
	(void) nvlist_lookup_string(props,
	zpool_prop_to_name(ZPOOL_PROP_ALTROOT), &altroot);
	(void) nvlist_lookup_uint64(props,
	zpool_prop_to_name(ZPOOL_PROP_READONLY), &readonly);
	if (readonly)
	mode = SPA_MODE_READ;
	spa = spa_add(pool, config, altroot);
	spa->spa_import_flags = flags;

	/*
	* Verbatim import - Take a pool and insert it into the namespace
	* as if it had been loaded at boot.
	*/
	if (spa->spa_import_flags & ZFS_IMPORT_VERBATIM) {
	if (props != NULL)
	spa_configfile_set(spa, props, B_FALSE);

	spa_write_cachefile(spa, B_FALSE, B_TRUE);
	spa_event_notify(spa, NULL, NULL, ESC_ZFS_POOL_IMPORT);
	zfs_dbgmsg("spa_import: verbatim import of %s", pool);
	mutex_exit(&spa_namespace_lock);
	return (0);
	}

	spa_activate(spa, mode);

	/*
	* Don't start async tasks until we know everything is healthy.
	*/
	spa_async_suspend(spa);

	zpool_get_load_policy(config, &policy);
	if (policy.zlp_rewind & ZPOOL_DO_REWIND)
	state = SPA_LOAD_RECOVER;

	spa->spa_config_source = SPA_CONFIG_SRC_TRYIMPORT;

	if (state != SPA_LOAD_RECOVER) {
	spa->spa_last_ubsync_txg = spa->spa_load_txg = 0;
	zfs_dbgmsg("spa_import: importing %s", pool);
	} else {
	zfs_dbgmsg("spa_import: importing %s, max_txg=%lld "
	"(RECOVERY MODE)", pool, (longlong_t)policy.zlp_txg);
	}
	error = spa_load_best(spa, state, policy.zlp_txg, policy.zlp_rewind);

	/*
	* Propagate anything learned while loading the pool and pass it
	* back to caller (i.e. rewind info, missing devices, etc).
	*/
	VERIFY(nvlist_add_nvlist(config, ZPOOL_CONFIG_LOAD_INFO,
	spa->spa_load_info) == 0);

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	/*
	* Toss any existing sparelist, as it doesn't have any validity
	* anymore, and conflicts with spa_has_spare().
	*/
	if (spa->spa_spares.sav_config) {
	nvlist_free(spa->spa_spares.sav_config);
	spa->spa_spares.sav_config = NULL;
	spa_load_spares(spa);
	}
	if (spa->spa_l2cache.sav_config) {
	nvlist_free(spa->spa_l2cache.sav_config);
	spa->spa_l2cache.sav_config = NULL;
	spa_load_l2cache(spa);
	}

	VERIFY(nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
	&nvroot) == 0);
	spa_config_exit(spa, SCL_ALL, FTAG);

	if (props != NULL)
	spa_configfile_set(spa, props, B_FALSE);

	if (error != 0 \|\| (props && spa_writeable(spa) &&
	(error = spa_prop_set(spa, props)))) {
	spa_unload(spa);
	spa_deactivate(spa);
	spa_remove(spa);
	mutex_exit(&spa_namespace_lock);
	return (error);
	}

	spa_async_resume(spa);

	/*
	* Override any spares and level 2 cache devices as specified by
	* the user, as these may have correct device names/devids, etc.
	*/
	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_SPARES,
	&spares, &nspares) == 0) {
	if (spa->spa_spares.sav_config)
	VERIFY(nvlist_remove(spa->spa_spares.sav_config,
	ZPOOL_CONFIG_SPARES, DATA_TYPE_NVLIST_ARRAY) == 0);
	else
	VERIFY(nvlist_alloc(&spa->spa_spares.sav_config,
	NV_UNIQUE_NAME, KM_SLEEP) == 0);
	VERIFY(nvlist_add_nvlist_array(spa->spa_spares.sav_config,
	ZPOOL_CONFIG_SPARES, spares, nspares) == 0);
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	spa_load_spares(spa);
	spa_config_exit(spa, SCL_ALL, FTAG);
	spa->spa_spares.sav_sync = B_TRUE;
	}
	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_L2CACHE,
	&l2cache, &nl2cache) == 0) {
	if (spa->spa_l2cache.sav_config)
	VERIFY(nvlist_remove(spa->spa_l2cache.sav_config,
	ZPOOL_CONFIG_L2CACHE, DATA_TYPE_NVLIST_ARRAY) == 0);
	else
	VERIFY(nvlist_alloc(&spa->spa_l2cache.sav_config,
	NV_UNIQUE_NAME, KM_SLEEP) == 0);
	VERIFY(nvlist_add_nvlist_array(spa->spa_l2cache.sav_config,
	ZPOOL_CONFIG_L2CACHE, l2cache, nl2cache) == 0);
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	spa_load_l2cache(spa);
	spa_config_exit(spa, SCL_ALL, FTAG);
	spa->spa_l2cache.sav_sync = B_TRUE;
	}

	/*
	* Check for any removed devices.
	*/
	if (spa->spa_autoreplace) {
	spa_aux_check_removed(&spa->spa_spares);
	spa_aux_check_removed(&spa->spa_l2cache);
	}

	if (spa_writeable(spa)) {
	/*
	* Update the config cache to include the newly-imported pool.
	*/
	spa_config_update(spa, SPA_CONFIG_UPDATE_POOL);
	}

	/*
	* It's possible that the pool was expanded while it was exported.
	* We kick off an async task to handle this for us.
	*/
	spa_async_request(spa, SPA_ASYNC_AUTOEXPAND);

	spa_history_log_version(spa, "import", NULL);

	spa_event_notify(spa, NULL, NULL, ESC_ZFS_POOL_IMPORT);

	mutex_exit(&spa_namespace_lock);

	zvol_create_minors_recursive(pool);

	return (0);
	}

	nvlist_t *
	spa_tryimport(nvlist_t *tryconfig)
	{
	nvlist_t *config = NULL;
	char poolname, cachefile;
	spa_t *spa;
	uint64_t state;
	int error;
	zpool_load_policy_t policy;

	if (nvlist_lookup_string(tryconfig, ZPOOL_CONFIG_POOL_NAME, &poolname))
	return (NULL);

	if (nvlist_lookup_uint64(tryconfig, ZPOOL_CONFIG_POOL_STATE, &state))
	return (NULL);

	/*
	* Create and initialize the spa structure.
	*/
	mutex_enter(&spa_namespace_lock);
	spa = spa_add(TRYIMPORT_NAME, tryconfig, NULL);
	spa_activate(spa, SPA_MODE_READ);

	/*
	* Rewind pool if a max txg was provided.
	*/
	zpool_get_load_policy(spa->spa_config, &policy);
	if (policy.zlp_txg != UINT64_MAX) {
	spa->spa_load_max_txg = policy.zlp_txg;
	spa->spa_extreme_rewind = B_TRUE;
	zfs_dbgmsg("spa_tryimport: importing %s, max_txg=%lld",
	poolname, (longlong_t)policy.zlp_txg);
	} else {
	zfs_dbgmsg("spa_tryimport: importing %s", poolname);
	}

	if (nvlist_lookup_string(tryconfig, ZPOOL_CONFIG_CACHEFILE, &cachefile)
	== 0) {
	zfs_dbgmsg("spa_tryimport: using cachefile '%s'", cachefile);
	spa->spa_config_source = SPA_CONFIG_SRC_CACHEFILE;
	} else {
	spa->spa_config_source = SPA_CONFIG_SRC_SCAN;
	}

	error = spa_load(spa, SPA_LOAD_TRYIMPORT, SPA_IMPORT_EXISTING);

	/*
	* If 'tryconfig' was at least parsable, return the current config.
	*/
	if (spa->spa_root_vdev != NULL) {
	config = spa_config_generate(spa, NULL, -1ULL, B_TRUE);
	VERIFY(nvlist_add_string(config, ZPOOL_CONFIG_POOL_NAME,
	poolname) == 0);
	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_POOL_STATE,
	state) == 0);
	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_TIMESTAMP,
	spa->spa_uberblock.ub_timestamp) == 0);
	VERIFY(nvlist_add_nvlist(config, ZPOOL_CONFIG_LOAD_INFO,
	spa->spa_load_info) == 0);
	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_ERRATA,
	spa->spa_errata) == 0);

	/*
	* If the bootfs property exists on this pool then we
	* copy it out so that external consumers can tell which
	* pools are bootable.
	*/
	if ((!error \|\| error == EEXIST) && spa->spa_bootfs) {
	char *tmpname = kmem_alloc(MAXPATHLEN, KM_SLEEP);

	/*
	* We have to play games with the name since the
	* pool was opened as TRYIMPORT_NAME.
	*/
	if (dsl_dsobj_to_dsname(spa_name(spa),
	spa->spa_bootfs, tmpname) == 0) {
	char *cp;
	char *dsname;

	dsname = kmem_alloc(MAXPATHLEN, KM_SLEEP);

	cp = strchr(tmpname, '/');
	if (cp == NULL) {
	(void) strlcpy(dsname, tmpname,
	MAXPATHLEN);
	} else {
	(void) snprintf(dsname, MAXPATHLEN,
	"%s/%s", poolname, ++cp);
	}
	VERIFY(nvlist_add_string(config,
	ZPOOL_CONFIG_BOOTFS, dsname) == 0);
	kmem_free(dsname, MAXPATHLEN);
	}
	kmem_free(tmpname, MAXPATHLEN);
	}

	/*
	* Add the list of hot spares and level 2 cache devices.
	*/
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	spa_add_spares(spa, config);
	spa_add_l2cache(spa, config);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	}

	spa_unload(spa);
	spa_deactivate(spa);
	spa_remove(spa);
	mutex_exit(&spa_namespace_lock);

	return (config);
	}

	/*
	* Pool export/destroy
	*
	* The act of destroying or exporting a pool is very simple. We make sure there
	* is no more pending I/O and any references to the pool are gone. Then, we
	* update the pool state and sync all the labels to disk, removing the
	* configuration from the cache afterwards. If the 'hardforce' flag is set, then
	* we don't sync the labels or remove the configuration cache.
	*/
	static int
	spa_export_common(char pool, int new_state, nvlist_t *oldconfig,
	boolean_t force, boolean_t hardforce)
	{
	spa_t *spa;

	if (oldconfig)
	*oldconfig = NULL;

	if (!(spa_mode_global & SPA_MODE_WRITE))
	return (SET_ERROR(EROFS));

	mutex_enter(&spa_namespace_lock);
	if ((spa = spa_lookup(pool)) == NULL) {
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(ENOENT));
	}

	if (spa->spa_is_exporting) {
	/* the pool is being exported by another thread */
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(ZFS_ERR_EXPORT_IN_PROGRESS));
	}
	spa->spa_is_exporting = B_TRUE;

	/*
	* Put a hold on the pool, drop the namespace lock, stop async tasks,
	* reacquire the namespace lock, and see if we can export.
	*/
	spa_open_ref(spa, FTAG);
	mutex_exit(&spa_namespace_lock);
	spa_async_suspend(spa);
	if (spa->spa_zvol_taskq) {
	zvol_remove_minors(spa, spa_name(spa), B_TRUE);
	taskq_wait(spa->spa_zvol_taskq);
	}
	mutex_enter(&spa_namespace_lock);
	spa_close(spa, FTAG);

	if (spa->spa_state == POOL_STATE_UNINITIALIZED)
	goto export_spa;
	/*
	* The pool will be in core if it's openable, in which case we can
	* modify its state. Objsets may be open only because they're dirty,
	* so we have to force it to sync before checking spa_refcnt.
	*/
	if (spa->spa_sync_on) {
	txg_wait_synced(spa->spa_dsl_pool, 0);
	spa_evicting_os_wait(spa);
	}

	/*
	* A pool cannot be exported or destroyed if there are active
	* references. If we are resetting a pool, allow references by
	* fault injection handlers.
	*/
	if (!spa_refcount_zero(spa) \|\|
	(spa->spa_inject_ref != 0 &&
	new_state != POOL_STATE_UNINITIALIZED)) {
	spa_async_resume(spa);
	spa->spa_is_exporting = B_FALSE;
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(EBUSY));
	}

	if (spa->spa_sync_on) {
	/*
	* A pool cannot be exported if it has an active shared spare.
	* This is to prevent other pools stealing the active spare
	* from an exported pool. At user's own will, such pool can
	* be forcedly exported.
	*/
	if (!force && new_state == POOL_STATE_EXPORTED &&
	spa_has_active_shared_spare(spa)) {
	spa_async_resume(spa);
	spa->spa_is_exporting = B_FALSE;
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(EXDEV));
	}

	/*
	* We're about to export or destroy this pool. Make sure
	* we stop all initialization and trim activity here before
	* we set the spa_final_txg. This will ensure that all
	* dirty data resulting from the initialization is
	* committed to disk before we unload the pool.
	*/
	if (spa->spa_root_vdev != NULL) {
	vdev_t *rvd = spa->spa_root_vdev;
	vdev_initialize_stop_all(rvd, VDEV_INITIALIZE_ACTIVE);
	vdev_trim_stop_all(rvd, VDEV_TRIM_ACTIVE);
	vdev_autotrim_stop_all(spa);
	vdev_rebuild_stop_all(spa);
	}

	/*
	* We want this to be reflected on every label,
	* so mark them all dirty. spa_unload() will do the
	* final sync that pushes these changes out.
	*/
	if (new_state != POOL_STATE_UNINITIALIZED && !hardforce) {
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	spa->spa_state = new_state;
	spa->spa_final_txg = spa_last_synced_txg(spa) +
	TXG_DEFER_SIZE + 1;
	vdev_config_dirty(spa->spa_root_vdev);
	spa_config_exit(spa, SCL_ALL, FTAG);
	}
	}

	export_spa:
	if (new_state == POOL_STATE_DESTROYED)
	spa_event_notify(spa, NULL, NULL, ESC_ZFS_POOL_DESTROY);
	else if (new_state == POOL_STATE_EXPORTED)
	spa_event_notify(spa, NULL, NULL, ESC_ZFS_POOL_EXPORT);

	if (spa->spa_state != POOL_STATE_UNINITIALIZED) {
	spa_unload(spa);
	spa_deactivate(spa);
	}

	if (oldconfig && spa->spa_config)
	VERIFY(nvlist_dup(spa->spa_config, oldconfig, 0) == 0);

	if (new_state != POOL_STATE_UNINITIALIZED) {
	if (!hardforce)
	spa_write_cachefile(spa, B_TRUE, B_TRUE);
	spa_remove(spa);
	} else {
	/*
	* If spa_remove() is not called for this spa_t and
	* there is any possibility that it can be reused,
	* we make sure to reset the exporting flag.
	*/
	spa->spa_is_exporting = B_FALSE;
	}

	mutex_exit(&spa_namespace_lock);
	return (0);
	}

	/*
	* Destroy a storage pool.
	*/
	int
	spa_destroy(char *pool)
	{
	return (spa_export_common(pool, POOL_STATE_DESTROYED, NULL,
	B_FALSE, B_FALSE));
	}

	/*
	* Export a storage pool.
	*/
	int
	spa_export(char pool, nvlist_t *oldconfig, boolean_t force,
	boolean_t hardforce)
	{
	return (spa_export_common(pool, POOL_STATE_EXPORTED, oldconfig,
	force, hardforce));
	}

	/*
	* Similar to spa_export(), this unloads the spa_t without actually removing it
	* from the namespace in any way.
	*/
	int
	spa_reset(char *pool)
	{
	return (spa_export_common(pool, POOL_STATE_UNINITIALIZED, NULL,
	B_FALSE, B_FALSE));
	}

	/*
	* ==========================================================================
	* Device manipulation
	* ==========================================================================
	*/

	/*
	* Add a device to a storage pool.
	*/
	int
	spa_vdev_add(spa_t spa, nvlist_t nvroot)
	{
	uint64_t txg;
	int error;
	vdev_t *rvd = spa->spa_root_vdev;
	vdev_t vd, tvd;
	nvlist_t spares, l2cache;
	uint_t nspares, nl2cache;

	ASSERT(spa_writeable(spa));

	txg = spa_vdev_enter(spa);

	if ((error = spa_config_parse(spa, &vd, nvroot, NULL, 0,
	VDEV_ALLOC_ADD)) != 0)
	return (spa_vdev_exit(spa, NULL, txg, error));

	spa->spa_pending_vdev = vd; /* spa_vdev_exit() will clear this */

	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_SPARES, &spares,
	&nspares) != 0)
	nspares = 0;

	if (nvlist_lookup_nvlist_array(nvroot, ZPOOL_CONFIG_L2CACHE, &l2cache,
	&nl2cache) != 0)
	nl2cache = 0;

	if (vd->vdev_children == 0 && nspares == 0 && nl2cache == 0)
	return (spa_vdev_exit(spa, vd, txg, EINVAL));

	if (vd->vdev_children != 0 &&
	(error = vdev_create(vd, txg, B_FALSE)) != 0)
	return (spa_vdev_exit(spa, vd, txg, error));

	/*
	* We must validate the spares and l2cache devices after checking the
	* children. Otherwise, vdev_inuse() will blindly overwrite the spare.
	*/
	if ((error = spa_validate_aux(spa, nvroot, txg, VDEV_ALLOC_ADD)) != 0)
	return (spa_vdev_exit(spa, vd, txg, error));

	/*
	* If we are in the middle of a device removal, we can only add
	* devices which match the existing devices in the pool.
	* If we are in the middle of a removal, or have some indirect
	* vdevs, we can not add raidz toplevels.
	*/
	if (spa->spa_vdev_removal != NULL \|\|
	spa->spa_removing_phys.sr_prev_indirect_vdev != -1) {
	for (int c = 0; c < vd->vdev_children; c++) {
	tvd = vd->vdev_child[c];
	if (spa->spa_vdev_removal != NULL &&
	tvd->vdev_ashift != spa->spa_max_ashift) {
	return (spa_vdev_exit(spa, vd, txg, EINVAL));
	}
	/* Fail if top level vdev is raidz */
	if (tvd->vdev_ops == &vdev_raidz_ops) {
	return (spa_vdev_exit(spa, vd, txg, EINVAL));
	}
	/*
	* Need the top level mirror to be
	* a mirror of leaf vdevs only
	*/
	if (tvd->vdev_ops == &vdev_mirror_ops) {
	for (uint64_t cid = 0;
	cid < tvd->vdev_children; cid++) {
	vdev_t *cvd = tvd->vdev_child[cid];
	if (!cvd->vdev_ops->vdev_op_leaf) {
	return (spa_vdev_exit(spa, vd,
	txg, EINVAL));
	}
	}
	}
	}
	}

	for (int c = 0; c < vd->vdev_children; c++) {
	tvd = vd->vdev_child[c];
	vdev_remove_child(vd, tvd);
	tvd->vdev_id = rvd->vdev_children;
	vdev_add_child(rvd, tvd);
	vdev_config_dirty(tvd);
	}

	if (nspares != 0) {
	spa_set_aux_vdevs(&spa->spa_spares, spares, nspares,
	ZPOOL_CONFIG_SPARES);
	spa_load_spares(spa);
	spa->spa_spares.sav_sync = B_TRUE;
	}

	if (nl2cache != 0) {
	spa_set_aux_vdevs(&spa->spa_l2cache, l2cache, nl2cache,
	ZPOOL_CONFIG_L2CACHE);
	spa_load_l2cache(spa);
	spa->spa_l2cache.sav_sync = B_TRUE;
	}

	/*
	* We have to be careful when adding new vdevs to an existing pool.
	* If other threads start allocating from these vdevs before we
	* sync the config cache, and we lose power, then upon reboot we may
	* fail to open the pool because there are DVAs that the config cache
	* can't translate. Therefore, we first add the vdevs without
	* initializing metaslabs; sync the config cache (via spa_vdev_exit());
	* and then let spa_config_update() initialize the new metaslabs.
	*
	* spa_load() checks for added-but-not-initialized vdevs, so that
	* if we lose power at any point in this sequence, the remaining
	* steps will be completed the next time we load the pool.
	*/
	(void) spa_vdev_exit(spa, vd, txg, 0);

	mutex_enter(&spa_namespace_lock);
	spa_config_update(spa, SPA_CONFIG_UPDATE_POOL);
	spa_event_notify(spa, NULL, NULL, ESC_ZFS_VDEV_ADD);
	mutex_exit(&spa_namespace_lock);

	return (0);
	}

	/*
	* Attach a device to a mirror. The arguments are the path to any device
	* in the mirror, and the nvroot for the new device. If the path specifies
	* a device that is not mirrored, we automatically insert the mirror vdev.
	*
	* If 'replacing' is specified, the new device is intended to replace the
	* existing device; in this case the two devices are made into their own
	* mirror using the 'replacing' vdev, which is functionally identical to
	* the mirror vdev (it actually reuses all the same ops) but has a few
	* extra rules: you can't attach to it after it's been created, and upon
	* completion of resilvering, the first disk (the one being replaced)
	* is automatically detached.
	*
	* If 'rebuild' is specified, then sequential reconstruction (a.ka. rebuild)
	* should be performed instead of traditional healing reconstruction. From
	* an administrators perspective these are both resilver operations.
	*/
	int
	spa_vdev_attach(spa_t spa, uint64_t guid, nvlist_t nvroot, int replacing,
	int rebuild)
	{
	uint64_t txg, dtl_max_txg;
	vdev_t *rvd = spa->spa_root_vdev;
	vdev_t oldvd, newvd, newrootvd, pvd, *tvd;
	vdev_ops_t *pvops;
	char oldvdpath, newvdpath;
	int newvd_isspare;
	int error;

	ASSERT(spa_writeable(spa));

	txg = spa_vdev_enter(spa);

	oldvd = spa_lookup_by_guid(spa, guid, B_FALSE);

	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	if (spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
	error = (spa_has_checkpoint(spa)) ?
	ZFS_ERR_CHECKPOINT_EXISTS : ZFS_ERR_DISCARDING_CHECKPOINT;
	return (spa_vdev_exit(spa, NULL, txg, error));
	}

	if (rebuild) {
	if (!spa_feature_is_enabled(spa, SPA_FEATURE_DEVICE_REBUILD))
	return (spa_vdev_exit(spa, NULL, txg, ENOTSUP));

	if (dsl_scan_resilvering(spa_get_dsl(spa)))
	return (spa_vdev_exit(spa, NULL, txg,
	ZFS_ERR_RESILVER_IN_PROGRESS));
	} else {
	if (vdev_rebuild_active(rvd))
	return (spa_vdev_exit(spa, NULL, txg,
	ZFS_ERR_REBUILD_IN_PROGRESS));
	}

	if (spa->spa_vdev_removal != NULL)
	return (spa_vdev_exit(spa, NULL, txg, EBUSY));

	if (oldvd == NULL)
	return (spa_vdev_exit(spa, NULL, txg, ENODEV));

	if (!oldvd->vdev_ops->vdev_op_leaf)
	return (spa_vdev_exit(spa, NULL, txg, ENOTSUP));

	pvd = oldvd->vdev_parent;

	if ((error = spa_config_parse(spa, &newrootvd, nvroot, NULL, 0,
	VDEV_ALLOC_ATTACH)) != 0)
	return (spa_vdev_exit(spa, NULL, txg, EINVAL));

	if (newrootvd->vdev_children != 1)
	return (spa_vdev_exit(spa, newrootvd, txg, EINVAL));

	newvd = newrootvd->vdev_child[0];

	if (!newvd->vdev_ops->vdev_op_leaf)
	return (spa_vdev_exit(spa, newrootvd, txg, EINVAL));

	if ((error = vdev_create(newrootvd, txg, replacing)) != 0)
	return (spa_vdev_exit(spa, newrootvd, txg, error));

	/*
	* Spares can't replace logs
	*/
	if (oldvd->vdev_top->vdev_islog && newvd->vdev_isspare)
	return (spa_vdev_exit(spa, newrootvd, txg, ENOTSUP));

	if (rebuild) {
	/*
	* For rebuilds, the parent vdev must support reconstruction
	* using only space maps. This means the only allowable
	* parents are the root vdev or a mirror vdev.
	*/
	if (pvd->vdev_ops != &vdev_mirror_ops &&
	pvd->vdev_ops != &vdev_root_ops) {
	return (spa_vdev_exit(spa, newrootvd, txg, ENOTSUP));
	}
	}

	if (!replacing) {
	/*
	* For attach, the only allowable parent is a mirror or the root
	* vdev.
	*/
	if (pvd->vdev_ops != &vdev_mirror_ops &&
	pvd->vdev_ops != &vdev_root_ops)
	return (spa_vdev_exit(spa, newrootvd, txg, ENOTSUP));

	pvops = &vdev_mirror_ops;
	} else {
	/*
	* Active hot spares can only be replaced by inactive hot
	* spares.
	*/
	if (pvd->vdev_ops == &vdev_spare_ops &&
	oldvd->vdev_isspare &&
	!spa_has_spare(spa, newvd->vdev_guid))
	return (spa_vdev_exit(spa, newrootvd, txg, ENOTSUP));

	/*
	* If the source is a hot spare, and the parent isn't already a
	* spare, then we want to create a new hot spare. Otherwise, we
	* want to create a replacing vdev. The user is not allowed to
	* attach to a spared vdev child unless the 'isspare' state is
	* the same (spare replaces spare, non-spare replaces
	* non-spare).
	*/
	if (pvd->vdev_ops == &vdev_replacing_ops &&
	spa_version(spa) < SPA_VERSION_MULTI_REPLACE) {
	return (spa_vdev_exit(spa, newrootvd, txg, ENOTSUP));
	} else if (pvd->vdev_ops == &vdev_spare_ops &&
	newvd->vdev_isspare != oldvd->vdev_isspare) {
	return (spa_vdev_exit(spa, newrootvd, txg, ENOTSUP));
	}

	if (newvd->vdev_isspare)
	pvops = &vdev_spare_ops;
	else
	pvops = &vdev_replacing_ops;
	}

	/*
	* Make sure the new device is big enough.
	*/
	if (newvd->vdev_asize < vdev_get_min_asize(oldvd))
	return (spa_vdev_exit(spa, newrootvd, txg, EOVERFLOW));

	/*
	* The new device cannot have a higher alignment requirement
	* than the top-level vdev.
	*/
	if (newvd->vdev_ashift > oldvd->vdev_top->vdev_ashift)
	return (spa_vdev_exit(spa, newrootvd, txg, ENOTSUP));

	/*
	* If this is an in-place replacement, update oldvd's path and devid
	* to make it distinguishable from newvd, and unopenable from now on.
	*/
	if (strcmp(oldvd->vdev_path, newvd->vdev_path) == 0) {
	spa_strfree(oldvd->vdev_path);
	oldvd->vdev_path = kmem_alloc(strlen(newvd->vdev_path) + 5,
	KM_SLEEP);
	(void) snprintf(oldvd->vdev_path, strlen(newvd->vdev_path) + 5,
	"%s/%s", newvd->vdev_path, "old");
	if (oldvd->vdev_devid != NULL) {
	spa_strfree(oldvd->vdev_devid);
	oldvd->vdev_devid = NULL;
	}
	}

	/*
	* If the parent is not a mirror, or if we're replacing, insert the new
	* mirror/replacing/spare vdev above oldvd.
	*/
	if (pvd->vdev_ops != pvops)
	pvd = vdev_add_parent(oldvd, pvops);

	ASSERT(pvd->vdev_top->vdev_parent == rvd);
	ASSERT(pvd->vdev_ops == pvops);
	ASSERT(oldvd->vdev_parent == pvd);

	/*
	* Extract the new device from its root and add it to pvd.
	*/
	vdev_remove_child(newrootvd, newvd);
	newvd->vdev_id = pvd->vdev_children;
	newvd->vdev_crtxg = oldvd->vdev_crtxg;
	vdev_add_child(pvd, newvd);

	/*
	* Reevaluate the parent vdev state.
	*/
	vdev_propagate_state(pvd);

	tvd = newvd->vdev_top;
	ASSERT(pvd->vdev_top == tvd);
	ASSERT(tvd->vdev_parent == rvd);

	vdev_config_dirty(tvd);

	/*
	* Set newvd's DTL to [TXG_INITIAL, dtl_max_txg) so that we account
	* for any dmu_sync-ed blocks. It will propagate upward when
	* spa_vdev_exit() calls vdev_dtl_reassess().
	*/
	dtl_max_txg = txg + TXG_CONCURRENT_STATES;

	vdev_dtl_dirty(newvd, DTL_MISSING,
	TXG_INITIAL, dtl_max_txg - TXG_INITIAL);

	if (newvd->vdev_isspare) {
	spa_spare_activate(newvd);
	spa_event_notify(spa, newvd, NULL, ESC_ZFS_VDEV_SPARE);
	}

	oldvdpath = spa_strdup(oldvd->vdev_path);
	newvdpath = spa_strdup(newvd->vdev_path);
	newvd_isspare = newvd->vdev_isspare;

	/*
	* Mark newvd's DTL dirty in this txg.
	*/
	vdev_dirty(tvd, VDD_DTL, newvd, txg);

	/*
	* Schedule the resilver or rebuild to restart in the future. We do
	* this to ensure that dmu_sync-ed blocks have been stitched into the
	* respective datasets.
	*/
	if (rebuild) {
	newvd->vdev_rebuild_txg = txg;

	vdev_rebuild(tvd);
	} else {
	newvd->vdev_resilver_txg = txg;

	if (dsl_scan_resilvering(spa_get_dsl(spa)) &&
	spa_feature_is_enabled(spa, SPA_FEATURE_RESILVER_DEFER)) {
	vdev_defer_resilver(newvd);
	} else {
	dsl_scan_restart_resilver(spa->spa_dsl_pool,
	dtl_max_txg);
	}
	}

	if (spa->spa_bootfs)
	spa_event_notify(spa, newvd, NULL, ESC_ZFS_BOOTFS_VDEV_ATTACH);

	spa_event_notify(spa, newvd, NULL, ESC_ZFS_VDEV_ATTACH);

	/*
	* Commit the config
	*/
	(void) spa_vdev_exit(spa, newrootvd, dtl_max_txg, 0);

	spa_history_log_internal(spa, "vdev attach", NULL,
	"%s vdev=%s %s vdev=%s",
	replacing && newvd_isspare ? "spare in" :
	replacing ? "replace" : "attach", newvdpath,
	replacing ? "for" : "to", oldvdpath);

	spa_strfree(oldvdpath);
	spa_strfree(newvdpath);

	return (0);
	}

	/*
	* Detach a device from a mirror or replacing vdev.
	*
	* If 'replace_done' is specified, only detach if the parent
	* is a replacing vdev.
	*/
	int
	spa_vdev_detach(spa_t *spa, uint64_t guid, uint64_t pguid, int replace_done)
	{
	uint64_t txg;
	int error;
	vdev_t *rvd __maybe_unused = spa->spa_root_vdev;
	vdev_t vd, pvd, cvd, tvd;
	boolean_t unspare = B_FALSE;
	uint64_t unspare_guid = 0;
	char *vdpath;

	ASSERT(spa_writeable(spa));

	txg = spa_vdev_detach_enter(spa, guid);

	vd = spa_lookup_by_guid(spa, guid, B_FALSE);

	/*
	* Besides being called directly from the userland through the
	* ioctl interface, spa_vdev_detach() can be potentially called
	* at the end of spa_vdev_resilver_done().
	*
	* In the regular case, when we have a checkpoint this shouldn't
	* happen as we never empty the DTLs of a vdev during the scrub
	* [see comment in dsl_scan_done()]. Thus spa_vdev_resilvering_done()
	* should never get here when we have a checkpoint.
	*
	* That said, even in a case when we checkpoint the pool exactly
	* as spa_vdev_resilver_done() calls this function everything
	* should be fine as the resilver will return right away.
	*/
	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	if (spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
	error = (spa_has_checkpoint(spa)) ?
	ZFS_ERR_CHECKPOINT_EXISTS : ZFS_ERR_DISCARDING_CHECKPOINT;
	return (spa_vdev_exit(spa, NULL, txg, error));
	}

	if (vd == NULL)
	return (spa_vdev_exit(spa, NULL, txg, ENODEV));

	if (!vd->vdev_ops->vdev_op_leaf)
	return (spa_vdev_exit(spa, NULL, txg, ENOTSUP));

	pvd = vd->vdev_parent;

	/*
	* If the parent/child relationship is not as expected, don't do it.
	* Consider M(A,R(B,C)) -- that is, a mirror of A with a replacing
	* vdev that's replacing B with C. The user's intent in replacing
	* is to go from M(A,B) to M(A,C). If the user decides to cancel
	* the replace by detaching C, the expected behavior is to end up
	* M(A,B). But suppose that right after deciding to detach C,
	* the replacement of B completes. We would have M(A,C), and then
	* ask to detach C, which would leave us with just A -- not what
	* the user wanted. To prevent this, we make sure that the
	* parent/child relationship hasn't changed -- in this example,
	* that C's parent is still the replacing vdev R.
	*/
	if (pvd->vdev_guid != pguid && pguid != 0)
	return (spa_vdev_exit(spa, NULL, txg, EBUSY));

	/*
	* Only 'replacing' or 'spare' vdevs can be replaced.
	*/
	if (replace_done && pvd->vdev_ops != &vdev_replacing_ops &&
	pvd->vdev_ops != &vdev_spare_ops)
	return (spa_vdev_exit(spa, NULL, txg, ENOTSUP));

	ASSERT(pvd->vdev_ops != &vdev_spare_ops \|\|
	spa_version(spa) >= SPA_VERSION_SPARES);

	/*
	* Only mirror, replacing, and spare vdevs support detach.
	*/
	if (pvd->vdev_ops != &vdev_replacing_ops &&
	pvd->vdev_ops != &vdev_mirror_ops &&
	pvd->vdev_ops != &vdev_spare_ops)
	return (spa_vdev_exit(spa, NULL, txg, ENOTSUP));

	/*
	* If this device has the only valid copy of some data,
	* we cannot safely detach it.
	*/
	if (vdev_dtl_required(vd))
	return (spa_vdev_exit(spa, NULL, txg, EBUSY));

	ASSERT(pvd->vdev_children >= 2);

	/*
	* If we are detaching the second disk from a replacing vdev, then
	* check to see if we changed the original vdev's path to have "/old"
	* at the end in spa_vdev_attach(). If so, undo that change now.
	*/
	if (pvd->vdev_ops == &vdev_replacing_ops && vd->vdev_id > 0 &&
	vd->vdev_path != NULL) {
	size_t len = strlen(vd->vdev_path);

	for (int c = 0; c < pvd->vdev_children; c++) {
	cvd = pvd->vdev_child[c];

	if (cvd == vd \|\| cvd->vdev_path == NULL)
	continue;

	if (strncmp(cvd->vdev_path, vd->vdev_path, len) == 0 &&
	strcmp(cvd->vdev_path + len, "/old") == 0) {
	spa_strfree(cvd->vdev_path);
	cvd->vdev_path = spa_strdup(vd->vdev_path);
	break;
	}
	}
	}

	/*
	* If we are detaching the original disk from a spare, then it implies
	* that the spare should become a real disk, and be removed from the
	* active spare list for the pool.
	*/
	if (pvd->vdev_ops == &vdev_spare_ops &&
	vd->vdev_id == 0 &&
	pvd->vdev_child[pvd->vdev_children - 1]->vdev_isspare)
	unspare = B_TRUE;

	/*
	* Erase the disk labels so the disk can be used for other things.
	* This must be done after all other error cases are handled,
	* but before we disembowel vd (so we can still do I/O to it).
	* But if we can't do it, don't treat the error as fatal --
	* it may be that the unwritability of the disk is the reason
	* it's being detached!
	*/
	error = vdev_label_init(vd, 0, VDEV_LABEL_REMOVE);

	/*
	* Remove vd from its parent and compact the parent's children.
	*/
	vdev_remove_child(pvd, vd);
	vdev_compact_children(pvd);

	/*
	* Remember one of the remaining children so we can get tvd below.
	*/
	cvd = pvd->vdev_child[pvd->vdev_children - 1];

	/*
	* If we need to remove the remaining child from the list of hot spares,
	* do it now, marking the vdev as no longer a spare in the process.
	* We must do this before vdev_remove_parent(), because that can
	* change the GUID if it creates a new toplevel GUID. For a similar
	* reason, we must remove the spare now, in the same txg as the detach;
	* otherwise someone could attach a new sibling, change the GUID, and
	* the subsequent attempt to spa_vdev_remove(unspare_guid) would fail.
	*/
	if (unspare) {
	ASSERT(cvd->vdev_isspare);
	spa_spare_remove(cvd);
	unspare_guid = cvd->vdev_guid;
	(void) spa_vdev_remove(spa, unspare_guid, B_TRUE);
	cvd->vdev_unspare = B_TRUE;
	}

	/*
	* If the parent mirror/replacing vdev only has one child,
	* the parent is no longer needed. Remove it from the tree.
	*/
	if (pvd->vdev_children == 1) {
	if (pvd->vdev_ops == &vdev_spare_ops)
	cvd->vdev_unspare = B_FALSE;
	vdev_remove_parent(cvd);
	}

	/*
	* We don't set tvd until now because the parent we just removed
	* may have been the previous top-level vdev.
	*/
	tvd = cvd->vdev_top;
	ASSERT(tvd->vdev_parent == rvd);

	/*
	* Reevaluate the parent vdev state.
	*/
	vdev_propagate_state(cvd);

	/*
	* If the 'autoexpand' property is set on the pool then automatically
	* try to expand the size of the pool. For example if the device we
	* just detached was smaller than the others, it may be possible to
	* add metaslabs (i.e. grow the pool). We need to reopen the vdev
	* first so that we can obtain the updated sizes of the leaf vdevs.
	*/
	if (spa->spa_autoexpand) {
	vdev_reopen(tvd);
	vdev_expand(tvd, txg);
	}

	vdev_config_dirty(tvd);

	/*
	* Mark vd's DTL as dirty in this txg. vdev_dtl_sync() will see that
	* vd->vdev_detached is set and free vd's DTL object in syncing context.
	* But first make sure we're not on any other txg's DTL list, to
	* prevent vd from being accessed after it's freed.
	*/
	vdpath = spa_strdup(vd->vdev_path ? vd->vdev_path : "none");
	for (int t = 0; t < TXG_SIZE; t++)
	(void) txg_list_remove_this(&tvd->vdev_dtl_list, vd, t);
	vd->vdev_detached = B_TRUE;
	vdev_dirty(tvd, VDD_DTL, vd, txg);

	spa_event_notify(spa, vd, NULL, ESC_ZFS_VDEV_REMOVE);
	spa_notify_waiters(spa);

	/* hang on to the spa before we release the lock */
	spa_open_ref(spa, FTAG);

	error = spa_vdev_exit(spa, vd, txg, 0);

	spa_history_log_internal(spa, "detach", NULL,
	"vdev=%s", vdpath);
	spa_strfree(vdpath);

	/*
	* If this was the removal of the original device in a hot spare vdev,
	* then we want to go through and remove the device from the hot spare
	* list of every other pool.
	*/
	if (unspare) {
	spa_t *altspa = NULL;

	mutex_enter(&spa_namespace_lock);
	while ((altspa = spa_next(altspa)) != NULL) {
	if (altspa->spa_state != POOL_STATE_ACTIVE \|\|
	altspa == spa)
	continue;

	spa_open_ref(altspa, FTAG);
	mutex_exit(&spa_namespace_lock);
	(void) spa_vdev_remove(altspa, unspare_guid, B_TRUE);
	mutex_enter(&spa_namespace_lock);
	spa_close(altspa, FTAG);
	}
	mutex_exit(&spa_namespace_lock);

	/* search the rest of the vdevs for spares to remove */
	spa_vdev_resilver_done(spa);
	}

	/* all done with the spa; OK to release */
	mutex_enter(&spa_namespace_lock);
	spa_close(spa, FTAG);
	mutex_exit(&spa_namespace_lock);

	return (error);
	}

	static int
	spa_vdev_initialize_impl(spa_t *spa, uint64_t guid, uint64_t cmd_type,
	list_t *vd_list)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	spa_config_enter(spa, SCL_CONFIG \| SCL_STATE, FTAG, RW_READER);

	/* Look up vdev and ensure it's a leaf. */
	vdev_t *vd = spa_lookup_by_guid(spa, guid, B_FALSE);
	if (vd == NULL \|\| vd->vdev_detached) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (SET_ERROR(ENODEV));
	} else if (!vd->vdev_ops->vdev_op_leaf \|\| !vdev_is_concrete(vd)) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (SET_ERROR(EINVAL));
	} else if (!vdev_writeable(vd)) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (SET_ERROR(EROFS));
	}
	mutex_enter(&vd->vdev_initialize_lock);
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);

	/*
	* When we activate an initialize action we check to see
	* if the vdev_initialize_thread is NULL. We do this instead
	* of using the vdev_initialize_state since there might be
	* a previous initialization process which has completed but
	* the thread is not exited.
	*/
	if (cmd_type == POOL_INITIALIZE_START &&
	(vd->vdev_initialize_thread != NULL \|\|
	vd->vdev_top->vdev_removing)) {
	mutex_exit(&vd->vdev_initialize_lock);
	return (SET_ERROR(EBUSY));
	} else if (cmd_type == POOL_INITIALIZE_CANCEL &&
	(vd->vdev_initialize_state != VDEV_INITIALIZE_ACTIVE &&
	vd->vdev_initialize_state != VDEV_INITIALIZE_SUSPENDED)) {
	mutex_exit(&vd->vdev_initialize_lock);
	return (SET_ERROR(ESRCH));
	} else if (cmd_type == POOL_INITIALIZE_SUSPEND &&
	vd->vdev_initialize_state != VDEV_INITIALIZE_ACTIVE) {
	mutex_exit(&vd->vdev_initialize_lock);
	return (SET_ERROR(ESRCH));
	}

	switch (cmd_type) {
	case POOL_INITIALIZE_START:
	vdev_initialize(vd);
	break;
	case POOL_INITIALIZE_CANCEL:
	vdev_initialize_stop(vd, VDEV_INITIALIZE_CANCELED, vd_list);
	break;
	case POOL_INITIALIZE_SUSPEND:
	vdev_initialize_stop(vd, VDEV_INITIALIZE_SUSPENDED, vd_list);
	break;
	default:
	panic("invalid cmd_type %llu", (unsigned long long)cmd_type);
	}
	mutex_exit(&vd->vdev_initialize_lock);

	return (0);
	}

	int
	spa_vdev_initialize(spa_t spa, nvlist_t nv, uint64_t cmd_type,
	nvlist_t *vdev_errlist)
	{
	int total_errors = 0;
	list_t vd_list;

	list_create(&vd_list, sizeof (vdev_t),
	offsetof(vdev_t, vdev_initialize_node));

	/*
	* We hold the namespace lock through the whole function
	* to prevent any changes to the pool while we're starting or
	* stopping initialization. The config and state locks are held so that
	* we can properly assess the vdev state before we commit to
	* the initializing operation.
	*/
	mutex_enter(&spa_namespace_lock);

	for (nvpair_t *pair = nvlist_next_nvpair(nv, NULL);
	pair != NULL; pair = nvlist_next_nvpair(nv, pair)) {
	uint64_t vdev_guid = fnvpair_value_uint64(pair);

	int error = spa_vdev_initialize_impl(spa, vdev_guid, cmd_type,
	&vd_list);
	if (error != 0) {
	char guid_as_str[MAXNAMELEN];

	(void) snprintf(guid_as_str, sizeof (guid_as_str),
	"%llu", (unsigned long long)vdev_guid);
	fnvlist_add_int64(vdev_errlist, guid_as_str, error);
	total_errors++;
	}
	}

	/* Wait for all initialize threads to stop. */
	vdev_initialize_stop_wait(spa, &vd_list);

	/* Sync out the initializing state */
	txg_wait_synced(spa->spa_dsl_pool, 0);
	mutex_exit(&spa_namespace_lock);

	list_destroy(&vd_list);

	return (total_errors);
	}

	static int
	spa_vdev_trim_impl(spa_t *spa, uint64_t guid, uint64_t cmd_type,
	uint64_t rate, boolean_t partial, boolean_t secure, list_t *vd_list)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	spa_config_enter(spa, SCL_CONFIG \| SCL_STATE, FTAG, RW_READER);

	/* Look up vdev and ensure it's a leaf. */
	vdev_t *vd = spa_lookup_by_guid(spa, guid, B_FALSE);
	if (vd == NULL \|\| vd->vdev_detached) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (SET_ERROR(ENODEV));
	} else if (!vd->vdev_ops->vdev_op_leaf \|\| !vdev_is_concrete(vd)) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (SET_ERROR(EINVAL));
	} else if (!vdev_writeable(vd)) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (SET_ERROR(EROFS));
	} else if (!vd->vdev_has_trim) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (SET_ERROR(EOPNOTSUPP));
	} else if (secure && !vd->vdev_has_securetrim) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (SET_ERROR(EOPNOTSUPP));
	}
	mutex_enter(&vd->vdev_trim_lock);
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);

	/*
	* When we activate a TRIM action we check to see if the
	* vdev_trim_thread is NULL. We do this instead of using the
	* vdev_trim_state since there might be a previous TRIM process
	* which has completed but the thread is not exited.
	*/
	if (cmd_type == POOL_TRIM_START &&
	(vd->vdev_trim_thread != NULL \|\| vd->vdev_top->vdev_removing)) {
	mutex_exit(&vd->vdev_trim_lock);
	return (SET_ERROR(EBUSY));
	} else if (cmd_type == POOL_TRIM_CANCEL &&
	(vd->vdev_trim_state != VDEV_TRIM_ACTIVE &&
	vd->vdev_trim_state != VDEV_TRIM_SUSPENDED)) {
	mutex_exit(&vd->vdev_trim_lock);
	return (SET_ERROR(ESRCH));
	} else if (cmd_type == POOL_TRIM_SUSPEND &&
	vd->vdev_trim_state != VDEV_TRIM_ACTIVE) {
	mutex_exit(&vd->vdev_trim_lock);
	return (SET_ERROR(ESRCH));
	}

	switch (cmd_type) {
	case POOL_TRIM_START:
	vdev_trim(vd, rate, partial, secure);
	break;
	case POOL_TRIM_CANCEL:
	vdev_trim_stop(vd, VDEV_TRIM_CANCELED, vd_list);
	break;
	case POOL_TRIM_SUSPEND:
	vdev_trim_stop(vd, VDEV_TRIM_SUSPENDED, vd_list);
	break;
	default:
	panic("invalid cmd_type %llu", (unsigned long long)cmd_type);
	}
	mutex_exit(&vd->vdev_trim_lock);

	return (0);
	}

	/*
	* Initiates a manual TRIM for the requested vdevs. This kicks off individual
	* TRIM threads for each child vdev. These threads pass over all of the free
	* space in the vdev's metaslabs and issues TRIM commands for that space.
	*/
	int
	spa_vdev_trim(spa_t spa, nvlist_t nv, uint64_t cmd_type, uint64_t rate,
	boolean_t partial, boolean_t secure, nvlist_t *vdev_errlist)
	{
	int total_errors = 0;
	list_t vd_list;

	list_create(&vd_list, sizeof (vdev_t),
	offsetof(vdev_t, vdev_trim_node));

	/*
	* We hold the namespace lock through the whole function
	* to prevent any changes to the pool while we're starting or
	* stopping TRIM. The config and state locks are held so that
	* we can properly assess the vdev state before we commit to
	* the TRIM operation.
	*/
	mutex_enter(&spa_namespace_lock);

	for (nvpair_t *pair = nvlist_next_nvpair(nv, NULL);
	pair != NULL; pair = nvlist_next_nvpair(nv, pair)) {
	uint64_t vdev_guid = fnvpair_value_uint64(pair);

	int error = spa_vdev_trim_impl(spa, vdev_guid, cmd_type,
	rate, partial, secure, &vd_list);
	if (error != 0) {
	char guid_as_str[MAXNAMELEN];

	(void) snprintf(guid_as_str, sizeof (guid_as_str),
	"%llu", (unsigned long long)vdev_guid);
	fnvlist_add_int64(vdev_errlist, guid_as_str, error);
	total_errors++;
	}
	}

	/* Wait for all TRIM threads to stop. */
	vdev_trim_stop_wait(spa, &vd_list);

	/* Sync out the TRIM state */
	txg_wait_synced(spa->spa_dsl_pool, 0);
	mutex_exit(&spa_namespace_lock);

	list_destroy(&vd_list);

	return (total_errors);
	}

	/*
	* Split a set of devices from their mirrors, and create a new pool from them.
	*/
	int
	spa_vdev_split_mirror(spa_t spa, char newname, nvlist_t *config,
	nvlist_t *props, boolean_t exp)
	{
	int error = 0;
	uint64_t txg, *glist;
	spa_t *newspa;
	uint_t c, children, lastlog;
	nvlist_t *child, nvl, *tmp;
	dmu_tx_t *tx;
	char *altroot = NULL;
	vdev_t rvd, vml = NULL; / vdev modify list */
	boolean_t activate_slog;

	ASSERT(spa_writeable(spa));

	txg = spa_vdev_enter(spa);

	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	if (spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
	error = (spa_has_checkpoint(spa)) ?
	ZFS_ERR_CHECKPOINT_EXISTS : ZFS_ERR_DISCARDING_CHECKPOINT;
	return (spa_vdev_exit(spa, NULL, txg, error));
	}

	/* clear the log and flush everything up to now */
	activate_slog = spa_passivate_log(spa);
	(void) spa_vdev_config_exit(spa, NULL, txg, 0, FTAG);
	error = spa_reset_logs(spa);
	txg = spa_vdev_config_enter(spa);

	if (activate_slog)
	spa_activate_log(spa);

	if (error != 0)
	return (spa_vdev_exit(spa, NULL, txg, error));

	/* check new spa name before going any further */
	if (spa_lookup(newname) != NULL)
	return (spa_vdev_exit(spa, NULL, txg, EEXIST));

	/*
	* scan through all the children to ensure they're all mirrors
	*/
	if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE, &nvl) != 0 \|\|
	nvlist_lookup_nvlist_array(nvl, ZPOOL_CONFIG_CHILDREN, &child,
	&children) != 0)
	return (spa_vdev_exit(spa, NULL, txg, EINVAL));

	/* first, check to ensure we've got the right child count */
	rvd = spa->spa_root_vdev;
	lastlog = 0;
	for (c = 0; c < rvd->vdev_children; c++) {
	vdev_t *vd = rvd->vdev_child[c];

	/* don't count the holes & logs as children */
	if (vd->vdev_islog \|\| (vd->vdev_ops != &vdev_indirect_ops &&
	!vdev_is_concrete(vd))) {
	if (lastlog == 0)
	lastlog = c;
	continue;
	}

	lastlog = 0;
	}
	if (children != (lastlog != 0 ? lastlog : rvd->vdev_children))
	return (spa_vdev_exit(spa, NULL, txg, EINVAL));

	/* next, ensure no spare or cache devices are part of the split */
	if (nvlist_lookup_nvlist(nvl, ZPOOL_CONFIG_SPARES, &tmp) == 0 \|\|
	nvlist_lookup_nvlist(nvl, ZPOOL_CONFIG_L2CACHE, &tmp) == 0)
	return (spa_vdev_exit(spa, NULL, txg, EINVAL));

	vml = kmem_zalloc(children * sizeof (vdev_t *), KM_SLEEP);
	glist = kmem_zalloc(children * sizeof (uint64_t), KM_SLEEP);

	/* then, loop over each vdev and validate it */
	for (c = 0; c < children; c++) {
	uint64_t is_hole = 0;

	(void) nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_IS_HOLE,
	&is_hole);

	if (is_hole != 0) {
	if (spa->spa_root_vdev->vdev_child[c]->vdev_ishole \|\|
	spa->spa_root_vdev->vdev_child[c]->vdev_islog) {
	continue;
	} else {
	error = SET_ERROR(EINVAL);
	break;
	}
	}

	/* deal with indirect vdevs */
	if (spa->spa_root_vdev->vdev_child[c]->vdev_ops ==
	&vdev_indirect_ops)
	continue;

	/* which disk is going to be split? */
	if (nvlist_lookup_uint64(child[c], ZPOOL_CONFIG_GUID,
	&glist[c]) != 0) {
	error = SET_ERROR(EINVAL);
	break;
	}

	/* look it up in the spa */
	vml[c] = spa_lookup_by_guid(spa, glist[c], B_FALSE);
	if (vml[c] == NULL) {
	error = SET_ERROR(ENODEV);
	break;
	}

	/* make sure there's nothing stopping the split */
	if (vml[c]->vdev_parent->vdev_ops != &vdev_mirror_ops \|\|
	vml[c]->vdev_islog \|\|
	!vdev_is_concrete(vml[c]) \|\|
	vml[c]->vdev_isspare \|\|
	vml[c]->vdev_isl2cache \|\|
	!vdev_writeable(vml[c]) \|\|
	vml[c]->vdev_children != 0 \|\|
	vml[c]->vdev_state != VDEV_STATE_HEALTHY \|\|
	c != spa->spa_root_vdev->vdev_child[c]->vdev_id) {
	error = SET_ERROR(EINVAL);
	break;
	}

	if (vdev_dtl_required(vml[c]) \|\|
	vdev_resilver_needed(vml[c], NULL, NULL)) {
	error = SET_ERROR(EBUSY);
	break;
	}

	/* we need certain info from the top level */
	VERIFY(nvlist_add_uint64(child[c], ZPOOL_CONFIG_METASLAB_ARRAY,
	vml[c]->vdev_top->vdev_ms_array) == 0);
	VERIFY(nvlist_add_uint64(child[c], ZPOOL_CONFIG_METASLAB_SHIFT,
	vml[c]->vdev_top->vdev_ms_shift) == 0);
	VERIFY(nvlist_add_uint64(child[c], ZPOOL_CONFIG_ASIZE,
	vml[c]->vdev_top->vdev_asize) == 0);
	VERIFY(nvlist_add_uint64(child[c], ZPOOL_CONFIG_ASHIFT,
	vml[c]->vdev_top->vdev_ashift) == 0);

	/* transfer per-vdev ZAPs */
	ASSERT3U(vml[c]->vdev_leaf_zap, !=, 0);
	VERIFY0(nvlist_add_uint64(child[c],
	ZPOOL_CONFIG_VDEV_LEAF_ZAP, vml[c]->vdev_leaf_zap));

	ASSERT3U(vml[c]->vdev_top->vdev_top_zap, !=, 0);
	VERIFY0(nvlist_add_uint64(child[c],
	ZPOOL_CONFIG_VDEV_TOP_ZAP,
	vml[c]->vdev_parent->vdev_top_zap));
	}

	if (error != 0) {
	kmem_free(vml, children * sizeof (vdev_t *));
	kmem_free(glist, children * sizeof (uint64_t));
	return (spa_vdev_exit(spa, NULL, txg, error));
	}

	/* stop writers from using the disks */
	for (c = 0; c < children; c++) {
	if (vml[c] != NULL)
	vml[c]->vdev_offline = B_TRUE;
	}
	vdev_reopen(spa->spa_root_vdev);

	/*
	* Temporarily record the splitting vdevs in the spa config. This
	* will disappear once the config is regenerated.
	*/
	VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
	VERIFY(nvlist_add_uint64_array(nvl, ZPOOL_CONFIG_SPLIT_LIST,
	glist, children) == 0);
	kmem_free(glist, children * sizeof (uint64_t));

	mutex_enter(&spa->spa_props_lock);
	VERIFY(nvlist_add_nvlist(spa->spa_config, ZPOOL_CONFIG_SPLIT,
	nvl) == 0);
	mutex_exit(&spa->spa_props_lock);
	spa->spa_config_splitting = nvl;
	vdev_config_dirty(spa->spa_root_vdev);

	/* configure and create the new pool */
	VERIFY(nvlist_add_string(config, ZPOOL_CONFIG_POOL_NAME, newname) == 0);
	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_POOL_STATE,
	exp ? POOL_STATE_EXPORTED : POOL_STATE_ACTIVE) == 0);
	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_VERSION,
	spa_version(spa)) == 0);
	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_POOL_TXG,
	spa->spa_config_txg) == 0);
	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_POOL_GUID,
	spa_generate_guid(NULL)) == 0);
	VERIFY0(nvlist_add_boolean(config, ZPOOL_CONFIG_HAS_PER_VDEV_ZAPS));
	(void) nvlist_lookup_string(props,
	zpool_prop_to_name(ZPOOL_PROP_ALTROOT), &altroot);

	/* add the new pool to the namespace */
	newspa = spa_add(newname, config, altroot);
	newspa->spa_avz_action = AVZ_ACTION_REBUILD;
	newspa->spa_config_txg = spa->spa_config_txg;
	spa_set_log_state(newspa, SPA_LOG_CLEAR);

	/* release the spa config lock, retaining the namespace lock */
	spa_vdev_config_exit(spa, NULL, txg, 0, FTAG);

	if (zio_injection_enabled)
	zio_handle_panic_injection(spa, FTAG, 1);

	spa_activate(newspa, spa_mode_global);
	spa_async_suspend(newspa);

	/*
	* Temporarily stop the initializing and TRIM activity. We set the
	* state to ACTIVE so that we know to resume initializing or TRIM
	* once the split has completed.
	*/
	list_t vd_initialize_list;
	list_create(&vd_initialize_list, sizeof (vdev_t),
	offsetof(vdev_t, vdev_initialize_node));

	list_t vd_trim_list;
	list_create(&vd_trim_list, sizeof (vdev_t),
	offsetof(vdev_t, vdev_trim_node));

	for (c = 0; c < children; c++) {
	if (vml[c] != NULL && vml[c]->vdev_ops != &vdev_indirect_ops) {
	mutex_enter(&vml[c]->vdev_initialize_lock);
	vdev_initialize_stop(vml[c],
	VDEV_INITIALIZE_ACTIVE, &vd_initialize_list);
	mutex_exit(&vml[c]->vdev_initialize_lock);

	mutex_enter(&vml[c]->vdev_trim_lock);
	vdev_trim_stop(vml[c], VDEV_TRIM_ACTIVE, &vd_trim_list);
	mutex_exit(&vml[c]->vdev_trim_lock);
	}
	}

	vdev_initialize_stop_wait(spa, &vd_initialize_list);
	vdev_trim_stop_wait(spa, &vd_trim_list);

	list_destroy(&vd_initialize_list);
	list_destroy(&vd_trim_list);

	newspa->spa_config_source = SPA_CONFIG_SRC_SPLIT;
	newspa->spa_is_splitting = B_TRUE;

	/* create the new pool from the disks of the original pool */
	error = spa_load(newspa, SPA_LOAD_IMPORT, SPA_IMPORT_ASSEMBLE);
	if (error)
	goto out;

	/* if that worked, generate a real config for the new pool */
	if (newspa->spa_root_vdev != NULL) {
	VERIFY(nvlist_alloc(&newspa->spa_config_splitting,
	NV_UNIQUE_NAME, KM_SLEEP) == 0);
	VERIFY(nvlist_add_uint64(newspa->spa_config_splitting,
	ZPOOL_CONFIG_SPLIT_GUID, spa_guid(spa)) == 0);
	spa_config_set(newspa, spa_config_generate(newspa, NULL, -1ULL,
	B_TRUE));
	}

	/* set the props */
	if (props != NULL) {
	spa_configfile_set(newspa, props, B_FALSE);
	error = spa_prop_set(newspa, props);
	if (error)
	goto out;
	}

	/* flush everything */
	txg = spa_vdev_config_enter(newspa);
	vdev_config_dirty(newspa->spa_root_vdev);
	(void) spa_vdev_config_exit(newspa, NULL, txg, 0, FTAG);

	if (zio_injection_enabled)
	zio_handle_panic_injection(spa, FTAG, 2);

	spa_async_resume(newspa);

	/* finally, update the original pool's config */
	txg = spa_vdev_config_enter(spa);
	tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	error = dmu_tx_assign(tx, TXG_WAIT);
	if (error != 0)
	dmu_tx_abort(tx);
	for (c = 0; c < children; c++) {
	if (vml[c] != NULL && vml[c]->vdev_ops != &vdev_indirect_ops) {
	vdev_t *tvd = vml[c]->vdev_top;

	/*
	* Need to be sure the detachable VDEV is not
	* on any other txg's DTL list to prevent it
	* from being accessed after it's freed.
	*/
	for (int t = 0; t < TXG_SIZE; t++) {
	(void) txg_list_remove_this(
	&tvd->vdev_dtl_list, vml[c], t);
	}

	vdev_split(vml[c]);
	if (error == 0)
	spa_history_log_internal(spa, "detach", tx,
	"vdev=%s", vml[c]->vdev_path);

	vdev_free(vml[c]);
	}
	}
	spa->spa_avz_action = AVZ_ACTION_REBUILD;
	vdev_config_dirty(spa->spa_root_vdev);
	spa->spa_config_splitting = NULL;
	nvlist_free(nvl);
	if (error == 0)
	dmu_tx_commit(tx);
	(void) spa_vdev_exit(spa, NULL, txg, 0);

	if (zio_injection_enabled)
	zio_handle_panic_injection(spa, FTAG, 3);

	/* split is complete; log a history record */
	spa_history_log_internal(newspa, "split", NULL,
	"from pool %s", spa_name(spa));

	newspa->spa_is_splitting = B_FALSE;
	kmem_free(vml, children * sizeof (vdev_t *));

	/* if we're not going to mount the filesystems in userland, export */
	if (exp)
	error = spa_export_common(newname, POOL_STATE_EXPORTED, NULL,
	B_FALSE, B_FALSE);

	return (error);

	out:
	spa_unload(newspa);
	spa_deactivate(newspa);
	spa_remove(newspa);

	txg = spa_vdev_config_enter(spa);

	/* re-online all offlined disks */
	for (c = 0; c < children; c++) {
	if (vml[c] != NULL)
	vml[c]->vdev_offline = B_FALSE;
	}

	/* restart initializing or trimming disks as necessary */
	spa_async_request(spa, SPA_ASYNC_INITIALIZE_RESTART);
	spa_async_request(spa, SPA_ASYNC_TRIM_RESTART);
	spa_async_request(spa, SPA_ASYNC_AUTOTRIM_RESTART);

	vdev_reopen(spa->spa_root_vdev);

	nvlist_free(spa->spa_config_splitting);
	spa->spa_config_splitting = NULL;
	(void) spa_vdev_exit(spa, NULL, txg, error);

	kmem_free(vml, children * sizeof (vdev_t *));
	return (error);
	}

	/*
	* Find any device that's done replacing, or a vdev marked 'unspare' that's
	* currently spared, so we can detach it.
	*/
	static vdev_t *
	spa_vdev_resilver_done_hunt(vdev_t *vd)
	{
	vdev_t newvd, oldvd;

	for (int c = 0; c < vd->vdev_children; c++) {
	oldvd = spa_vdev_resilver_done_hunt(vd->vdev_child[c]);
	if (oldvd != NULL)
	return (oldvd);
	}

	/*
	* Check for a completed replacement. We always consider the first
	* vdev in the list to be the oldest vdev, and the last one to be
	* the newest (see spa_vdev_attach() for how that works). In
	* the case where the newest vdev is faulted, we will not automatically
	* remove it after a resilver completes. This is OK as it will require
	* user intervention to determine which disk the admin wishes to keep.
	*/
	if (vd->vdev_ops == &vdev_replacing_ops) {
	ASSERT(vd->vdev_children > 1);

	newvd = vd->vdev_child[vd->vdev_children - 1];
	oldvd = vd->vdev_child[0];

	if (vdev_dtl_empty(newvd, DTL_MISSING) &&
	vdev_dtl_empty(newvd, DTL_OUTAGE) &&
	!vdev_dtl_required(oldvd))
	return (oldvd);
	}

	/*
	* Check for a completed resilver with the 'unspare' flag set.
	* Also potentially update faulted state.
	*/
	if (vd->vdev_ops == &vdev_spare_ops) {
	vdev_t *first = vd->vdev_child[0];
	vdev_t *last = vd->vdev_child[vd->vdev_children - 1];

	if (last->vdev_unspare) {
	oldvd = first;
	newvd = last;
	} else if (first->vdev_unspare) {
	oldvd = last;
	newvd = first;
	} else {
	oldvd = NULL;
	}

	if (oldvd != NULL &&
	vdev_dtl_empty(newvd, DTL_MISSING) &&
	vdev_dtl_empty(newvd, DTL_OUTAGE) &&
	!vdev_dtl_required(oldvd))
	return (oldvd);

	vdev_propagate_state(vd);

	/*
	* If there are more than two spares attached to a disk,
	* and those spares are not required, then we want to
	* attempt to free them up now so that they can be used
	* by other pools. Once we're back down to a single
	* disk+spare, we stop removing them.
	*/
	if (vd->vdev_children > 2) {
	newvd = vd->vdev_child[1];

	if (newvd->vdev_isspare && last->vdev_isspare &&
	vdev_dtl_empty(last, DTL_MISSING) &&
	vdev_dtl_empty(last, DTL_OUTAGE) &&
	!vdev_dtl_required(newvd))
	return (newvd);
	}
	}

	return (NULL);
	}

	static void
	spa_vdev_resilver_done(spa_t *spa)
	{
	vdev_t vd, pvd, *ppvd;
	uint64_t guid, sguid, pguid, ppguid;

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);

	while ((vd = spa_vdev_resilver_done_hunt(spa->spa_root_vdev)) != NULL) {
	pvd = vd->vdev_parent;
	ppvd = pvd->vdev_parent;
	guid = vd->vdev_guid;
	pguid = pvd->vdev_guid;
	ppguid = ppvd->vdev_guid;
	sguid = 0;
	/*
	* If we have just finished replacing a hot spared device, then
	* we need to detach the parent's first child (the original hot
	* spare) as well.
	*/
	if (ppvd->vdev_ops == &vdev_spare_ops && pvd->vdev_id == 0 &&
	ppvd->vdev_children == 2) {
	ASSERT(pvd->vdev_ops == &vdev_replacing_ops);
	sguid = ppvd->vdev_child[1]->vdev_guid;
	}
	ASSERT(vd->vdev_resilver_txg == 0 \|\| !vdev_dtl_required(vd));

	spa_config_exit(spa, SCL_ALL, FTAG);
	if (spa_vdev_detach(spa, guid, pguid, B_TRUE) != 0)
	return;
	if (sguid && spa_vdev_detach(spa, sguid, ppguid, B_TRUE) != 0)
	return;
	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	}

	spa_config_exit(spa, SCL_ALL, FTAG);

	/*
	* If a detach was not performed above replace waiters will not have
	* been notified. In which case we must do so now.
	*/
	spa_notify_waiters(spa);
	}

	/*
	* Update the stored path or FRU for this vdev.
	*/
	static int
	spa_vdev_set_common(spa_t spa, uint64_t guid, const char value,
	boolean_t ispath)
	{
	vdev_t *vd;
	boolean_t sync = B_FALSE;

	ASSERT(spa_writeable(spa));

	spa_vdev_state_enter(spa, SCL_ALL);

	if ((vd = spa_lookup_by_guid(spa, guid, B_TRUE)) == NULL)
	return (spa_vdev_state_exit(spa, NULL, ENOENT));

	if (!vd->vdev_ops->vdev_op_leaf)
	return (spa_vdev_state_exit(spa, NULL, ENOTSUP));

	if (ispath) {
	if (strcmp(value, vd->vdev_path) != 0) {
	spa_strfree(vd->vdev_path);
	vd->vdev_path = spa_strdup(value);
	sync = B_TRUE;
	}
	} else {
	if (vd->vdev_fru == NULL) {
	vd->vdev_fru = spa_strdup(value);
	sync = B_TRUE;
	} else if (strcmp(value, vd->vdev_fru) != 0) {
	spa_strfree(vd->vdev_fru);
	vd->vdev_fru = spa_strdup(value);
	sync = B_TRUE;
	}
	}

	return (spa_vdev_state_exit(spa, sync ? vd : NULL, 0));
	}

	int
	spa_vdev_setpath(spa_t spa, uint64_t guid, const char newpath)
	{
	return (spa_vdev_set_common(spa, guid, newpath, B_TRUE));
	}

	int
	spa_vdev_setfru(spa_t spa, uint64_t guid, const char newfru)
	{
	return (spa_vdev_set_common(spa, guid, newfru, B_FALSE));
	}

	/*
	* ==========================================================================
	* SPA Scanning
	* ==========================================================================
	*/
	int
	spa_scrub_pause_resume(spa_t *spa, pool_scrub_cmd_t cmd)
	{
	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == 0);

	if (dsl_scan_resilvering(spa->spa_dsl_pool))
	return (SET_ERROR(EBUSY));

	return (dsl_scrub_set_pause_resume(spa->spa_dsl_pool, cmd));
	}

	int
	spa_scan_stop(spa_t *spa)
	{
	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == 0);
	if (dsl_scan_resilvering(spa->spa_dsl_pool))
	return (SET_ERROR(EBUSY));
	return (dsl_scan_cancel(spa->spa_dsl_pool));
	}

	int
	spa_scan(spa_t *spa, pool_scan_func_t func)
	{
	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == 0);

	if (func >= POOL_SCAN_FUNCS \|\| func == POOL_SCAN_NONE)
	return (SET_ERROR(ENOTSUP));

	if (func == POOL_SCAN_RESILVER &&
	!spa_feature_is_enabled(spa, SPA_FEATURE_RESILVER_DEFER))
	return (SET_ERROR(ENOTSUP));

	/*
	* If a resilver was requested, but there is no DTL on a
	* writeable leaf device, we have nothing to do.
	*/
	if (func == POOL_SCAN_RESILVER &&
	!vdev_resilver_needed(spa->spa_root_vdev, NULL, NULL)) {
	spa_async_request(spa, SPA_ASYNC_RESILVER_DONE);
	return (0);
	}

	return (dsl_scan(spa->spa_dsl_pool, func));
	}

	/*
	* ==========================================================================
	* SPA async task processing
	* ==========================================================================
	*/

	static void
	spa_async_remove(spa_t spa, vdev_t vd)
	{
	if (vd->vdev_remove_wanted) {
	vd->vdev_remove_wanted = B_FALSE;
	vd->vdev_delayed_close = B_FALSE;
	vdev_set_state(vd, B_FALSE, VDEV_STATE_REMOVED, VDEV_AUX_NONE);

	/*
	* We want to clear the stats, but we don't want to do a full
	* vdev_clear() as that will cause us to throw away
	* degraded/faulted state as well as attempt to reopen the
	* device, all of which is a waste.
	*/
	vd->vdev_stat.vs_read_errors = 0;
	vd->vdev_stat.vs_write_errors = 0;
	vd->vdev_stat.vs_checksum_errors = 0;

	vdev_state_dirty(vd->vdev_top);
	}

	for (int c = 0; c < vd->vdev_children; c++)
	spa_async_remove(spa, vd->vdev_child[c]);
	}

	static void
	spa_async_probe(spa_t spa, vdev_t vd)
	{
	if (vd->vdev_probe_wanted) {
	vd->vdev_probe_wanted = B_FALSE;
	vdev_reopen(vd); /* vdev_open() does the actual probe */
	}

	for (int c = 0; c < vd->vdev_children; c++)
	spa_async_probe(spa, vd->vdev_child[c]);
	}

	static void
	spa_async_autoexpand(spa_t spa, vdev_t vd)
	{
	if (!spa->spa_autoexpand)
	return;

	for (int c = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];
	spa_async_autoexpand(spa, cvd);
	}

	if (!vd->vdev_ops->vdev_op_leaf \|\| vd->vdev_physpath == NULL)
	return;

	spa_event_notify(vd->vdev_spa, vd, NULL, ESC_ZFS_VDEV_AUTOEXPAND);
	}

	static void
	spa_async_thread(void *arg)
	{
	spa_t spa = (spa_t )arg;
	dsl_pool_t *dp = spa->spa_dsl_pool;
	int tasks;

	ASSERT(spa->spa_sync_on);

	mutex_enter(&spa->spa_async_lock);
	tasks = spa->spa_async_tasks;
	spa->spa_async_tasks = 0;
	mutex_exit(&spa->spa_async_lock);

	/*
	* See if the config needs to be updated.
	*/
	if (tasks & SPA_ASYNC_CONFIG_UPDATE) {
	uint64_t old_space, new_space;

	mutex_enter(&spa_namespace_lock);
	old_space = metaslab_class_get_space(spa_normal_class(spa));
	old_space += metaslab_class_get_space(spa_special_class(spa));
	old_space += metaslab_class_get_space(spa_dedup_class(spa));

	spa_config_update(spa, SPA_CONFIG_UPDATE_POOL);

	new_space = metaslab_class_get_space(spa_normal_class(spa));
	new_space += metaslab_class_get_space(spa_special_class(spa));
	new_space += metaslab_class_get_space(spa_dedup_class(spa));
	mutex_exit(&spa_namespace_lock);

	/*
	* If the pool grew as a result of the config update,
	* then log an internal history event.
	*/
	if (new_space != old_space) {
	spa_history_log_internal(spa, "vdev online", NULL,
	"pool '%s' size: %llu(+%llu)",
	spa_name(spa), (u_longlong_t)new_space,
	(u_longlong_t)(new_space - old_space));
	}
	}

	/*
	* See if any devices need to be marked REMOVED.
	*/
	if (tasks & SPA_ASYNC_REMOVE) {
	spa_vdev_state_enter(spa, SCL_NONE);
	spa_async_remove(spa, spa->spa_root_vdev);
	for (int i = 0; i < spa->spa_l2cache.sav_count; i++)
	spa_async_remove(spa, spa->spa_l2cache.sav_vdevs[i]);
	for (int i = 0; i < spa->spa_spares.sav_count; i++)
	spa_async_remove(spa, spa->spa_spares.sav_vdevs[i]);
	(void) spa_vdev_state_exit(spa, NULL, 0);
	}

	if ((tasks & SPA_ASYNC_AUTOEXPAND) && !spa_suspended(spa)) {
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	spa_async_autoexpand(spa, spa->spa_root_vdev);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	}

	/*
	* See if any devices need to be probed.
	*/
	if (tasks & SPA_ASYNC_PROBE) {
	spa_vdev_state_enter(spa, SCL_NONE);
	spa_async_probe(spa, spa->spa_root_vdev);
	(void) spa_vdev_state_exit(spa, NULL, 0);
	}

	/*
	* If any devices are done replacing, detach them.
	*/
	if (tasks & SPA_ASYNC_RESILVER_DONE)
	spa_vdev_resilver_done(spa);

	/*
	* If any devices are done replacing, detach them. Then if no
	* top-level vdevs are rebuilding attempt to kick off a scrub.
	*/
	if (tasks & SPA_ASYNC_REBUILD_DONE) {
	spa_vdev_resilver_done(spa);

	if (!vdev_rebuild_active(spa->spa_root_vdev))
	(void) dsl_scan(spa->spa_dsl_pool, POOL_SCAN_SCRUB);
	}

	/*
	* Kick off a resilver.
	*/
	if (tasks & SPA_ASYNC_RESILVER &&
	!vdev_rebuild_active(spa->spa_root_vdev) &&
	(!dsl_scan_resilvering(dp) \|\|
	!spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER)))
	dsl_scan_restart_resilver(dp, 0);

	if (tasks & SPA_ASYNC_INITIALIZE_RESTART) {
	mutex_enter(&spa_namespace_lock);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	vdev_initialize_restart(spa->spa_root_vdev);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	mutex_exit(&spa_namespace_lock);
	}

	if (tasks & SPA_ASYNC_TRIM_RESTART) {
	mutex_enter(&spa_namespace_lock);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	vdev_trim_restart(spa->spa_root_vdev);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	mutex_exit(&spa_namespace_lock);
	}

	if (tasks & SPA_ASYNC_AUTOTRIM_RESTART) {
	mutex_enter(&spa_namespace_lock);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	vdev_autotrim_restart(spa);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	mutex_exit(&spa_namespace_lock);
	}

	/*
	* Kick off L2 cache whole device TRIM.
	*/
	if (tasks & SPA_ASYNC_L2CACHE_TRIM) {
	mutex_enter(&spa_namespace_lock);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	vdev_trim_l2arc(spa);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	mutex_exit(&spa_namespace_lock);
	}

	/*
	* Kick off L2 cache rebuilding.
	*/
	if (tasks & SPA_ASYNC_L2CACHE_REBUILD) {
	mutex_enter(&spa_namespace_lock);
	spa_config_enter(spa, SCL_L2ARC, FTAG, RW_READER);
	l2arc_spa_rebuild_start(spa);
	spa_config_exit(spa, SCL_L2ARC, FTAG);
	mutex_exit(&spa_namespace_lock);
	}

	/*
	* Let the world know that we're done.
	*/
	mutex_enter(&spa->spa_async_lock);
	spa->spa_async_thread = NULL;
	cv_broadcast(&spa->spa_async_cv);
	mutex_exit(&spa->spa_async_lock);
	thread_exit();
	}

	void
	spa_async_suspend(spa_t *spa)
	{
	mutex_enter(&spa->spa_async_lock);
	spa->spa_async_suspended++;
	while (spa->spa_async_thread != NULL)
	cv_wait(&spa->spa_async_cv, &spa->spa_async_lock);
	mutex_exit(&spa->spa_async_lock);

	spa_vdev_remove_suspend(spa);

	zthr_t *condense_thread = spa->spa_condense_zthr;
	if (condense_thread != NULL)
	zthr_cancel(condense_thread);

	zthr_t *discard_thread = spa->spa_checkpoint_discard_zthr;
	if (discard_thread != NULL)
	zthr_cancel(discard_thread);

	zthr_t *ll_delete_thread = spa->spa_livelist_delete_zthr;
	if (ll_delete_thread != NULL)
	zthr_cancel(ll_delete_thread);

	zthr_t *ll_condense_thread = spa->spa_livelist_condense_zthr;
	if (ll_condense_thread != NULL)
	zthr_cancel(ll_condense_thread);
	}

	void
	spa_async_resume(spa_t *spa)
	{
	mutex_enter(&spa->spa_async_lock);
	ASSERT(spa->spa_async_suspended != 0);
	spa->spa_async_suspended--;
	mutex_exit(&spa->spa_async_lock);
	spa_restart_removal(spa);

	zthr_t *condense_thread = spa->spa_condense_zthr;
	if (condense_thread != NULL)
	zthr_resume(condense_thread);

	zthr_t *discard_thread = spa->spa_checkpoint_discard_zthr;
	if (discard_thread != NULL)
	zthr_resume(discard_thread);

	zthr_t *ll_delete_thread = spa->spa_livelist_delete_zthr;
	if (ll_delete_thread != NULL)
	zthr_resume(ll_delete_thread);

	zthr_t *ll_condense_thread = spa->spa_livelist_condense_zthr;
	if (ll_condense_thread != NULL)
	zthr_resume(ll_condense_thread);
	}

	static boolean_t
	spa_async_tasks_pending(spa_t *spa)
	{
	uint_t non_config_tasks;
	uint_t config_task;
	boolean_t config_task_suspended;

	non_config_tasks = spa->spa_async_tasks & ~SPA_ASYNC_CONFIG_UPDATE;
	config_task = spa->spa_async_tasks & SPA_ASYNC_CONFIG_UPDATE;
	if (spa->spa_ccw_fail_time == 0) {
	config_task_suspended = B_FALSE;
	} else {
	config_task_suspended =
	(gethrtime() - spa->spa_ccw_fail_time) <
	((hrtime_t)zfs_ccw_retry_interval * NANOSEC);
	}

	return (non_config_tasks \|\| (config_task && !config_task_suspended));
	}

	static void
	spa_async_dispatch(spa_t *spa)
	{
	mutex_enter(&spa->spa_async_lock);
	if (spa_async_tasks_pending(spa) &&
	!spa->spa_async_suspended &&
	spa->spa_async_thread == NULL)
	spa->spa_async_thread = thread_create(NULL, 0,
	spa_async_thread, spa, 0, &p0, TS_RUN, maxclsyspri);
	mutex_exit(&spa->spa_async_lock);
	}

	void
	spa_async_request(spa_t *spa, int task)
	{
	zfs_dbgmsg("spa=%s async request task=%u", spa->spa_name, task);
	mutex_enter(&spa->spa_async_lock);
	spa->spa_async_tasks \|= task;
	mutex_exit(&spa->spa_async_lock);
	}

	int
	spa_async_tasks(spa_t *spa)
	{
	return (spa->spa_async_tasks);
	}

	/*
	* ==========================================================================
	* SPA syncing routines
	* ==========================================================================
	*/


	static int
	bpobj_enqueue_cb(void arg, const blkptr_t bp, boolean_t bp_freed,
	dmu_tx_t *tx)
	{
	bpobj_t *bpo = arg;
	bpobj_enqueue(bpo, bp, bp_freed, tx);
	return (0);
	}

	int
	bpobj_enqueue_alloc_cb(void arg, const blkptr_t bp, dmu_tx_t *tx)
	{
	return (bpobj_enqueue_cb(arg, bp, B_FALSE, tx));
	}

	int
	bpobj_enqueue_free_cb(void arg, const blkptr_t bp, dmu_tx_t *tx)
	{
	return (bpobj_enqueue_cb(arg, bp, B_TRUE, tx));
	}

	static int
	spa_free_sync_cb(void arg, const blkptr_t bp, dmu_tx_t *tx)
	{
	zio_t *pio = arg;

	zio_nowait(zio_free_sync(pio, pio->io_spa, dmu_tx_get_txg(tx), bp,
	pio->io_flags));
	return (0);
	}

	static int
	bpobj_spa_free_sync_cb(void arg, const blkptr_t bp, boolean_t bp_freed,
	dmu_tx_t *tx)
	{
	ASSERT(!bp_freed);
	return (spa_free_sync_cb(arg, bp, tx));
	}

	/*
	* Note: this simple function is not inlined to make it easier to dtrace the
	* amount of time spent syncing frees.
	*/
	static void
	spa_sync_frees(spa_t spa, bplist_t bpl, dmu_tx_t *tx)
	{
	zio_t *zio = zio_root(spa, NULL, NULL, 0);
	bplist_iterate(bpl, spa_free_sync_cb, zio, tx);
	VERIFY(zio_wait(zio) == 0);
	}

	/*
	* Note: this simple function is not inlined to make it easier to dtrace the
	* amount of time spent syncing deferred frees.
	*/
	static void
	spa_sync_deferred_frees(spa_t spa, dmu_tx_t tx)
	{
	if (spa_sync_pass(spa) != 1)
	return;

	/*
	* Note:
	* If the log space map feature is active, we stop deferring
	* frees to the next TXG and therefore running this function
	* would be considered a no-op as spa_deferred_bpobj should
	* not have any entries.
	*
	* That said we run this function anyway (instead of returning
	* immediately) for the edge-case scenario where we just
	* activated the log space map feature in this TXG but we have
	* deferred frees from the previous TXG.
	*/
	zio_t *zio = zio_root(spa, NULL, NULL, 0);
	VERIFY3U(bpobj_iterate(&spa->spa_deferred_bpobj,
	bpobj_spa_free_sync_cb, zio, tx), ==, 0);
	VERIFY0(zio_wait(zio));
	}

	static void
	spa_sync_nvlist(spa_t spa, uint64_t obj, nvlist_t nv, dmu_tx_t *tx)
	{
	char *packed = NULL;
	size_t bufsize;
	size_t nvsize = 0;
	dmu_buf_t *db;

	VERIFY(nvlist_size(nv, &nvsize, NV_ENCODE_XDR) == 0);

	/*
	* Write full (SPA_CONFIG_BLOCKSIZE) blocks of configuration
	* information. This avoids the dmu_buf_will_dirty() path and
	* saves us a pre-read to get data we don't actually care about.
	*/
	bufsize = P2ROUNDUP((uint64_t)nvsize, SPA_CONFIG_BLOCKSIZE);
	packed = vmem_alloc(bufsize, KM_SLEEP);

	VERIFY(nvlist_pack(nv, &packed, &nvsize, NV_ENCODE_XDR,
	KM_SLEEP) == 0);
	bzero(packed + nvsize, bufsize - nvsize);

	dmu_write(spa->spa_meta_objset, obj, 0, bufsize, packed, tx);

	vmem_free(packed, bufsize);

	VERIFY(0 == dmu_bonus_hold(spa->spa_meta_objset, obj, FTAG, &db));
	dmu_buf_will_dirty(db, tx);
	(uint64_t )db->db_data = nvsize;
	dmu_buf_rele(db, FTAG);
	}

	static void
	spa_sync_aux_dev(spa_t spa, spa_aux_vdev_t sav, dmu_tx_t *tx,
	const char config, const char entry)
	{
	nvlist_t *nvroot;
	nvlist_t **list;
	int i;

	if (!sav->sav_sync)
	return;

	/*
	* Update the MOS nvlist describing the list of available devices.
	* spa_validate_aux() will have already made sure this nvlist is
	* valid and the vdevs are labeled appropriately.
	*/
	if (sav->sav_object == 0) {
	sav->sav_object = dmu_object_alloc(spa->spa_meta_objset,
	DMU_OT_PACKED_NVLIST, 1 << 14, DMU_OT_PACKED_NVLIST_SIZE,
	sizeof (uint64_t), tx);
	VERIFY(zap_update(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, entry, sizeof (uint64_t), 1,
	&sav->sav_object, tx) == 0);
	}

	VERIFY(nvlist_alloc(&nvroot, NV_UNIQUE_NAME, KM_SLEEP) == 0);
	if (sav->sav_count == 0) {
	VERIFY(nvlist_add_nvlist_array(nvroot, config, NULL, 0) == 0);
	} else {
	list = kmem_alloc(sav->sav_countsizeof (void ), KM_SLEEP);
	for (i = 0; i < sav->sav_count; i++)
	list[i] = vdev_config_generate(spa, sav->sav_vdevs[i],
	B_FALSE, VDEV_CONFIG_L2CACHE);
	VERIFY(nvlist_add_nvlist_array(nvroot, config, list,
	sav->sav_count) == 0);
	for (i = 0; i < sav->sav_count; i++)
	nvlist_free(list[i]);
	kmem_free(list, sav->sav_count * sizeof (void *));
	}

	spa_sync_nvlist(spa, sav->sav_object, nvroot, tx);
	nvlist_free(nvroot);

	sav->sav_sync = B_FALSE;
	}

	/*
	* Rebuild spa's all-vdev ZAP from the vdev ZAPs indicated in each vdev_t.
	* The all-vdev ZAP must be empty.
	*/
	static void
	spa_avz_build(vdev_t vd, uint64_t avz, dmu_tx_t tx)
	{
	spa_t *spa = vd->vdev_spa;

	if (vd->vdev_top_zap != 0) {
	VERIFY0(zap_add_int(spa->spa_meta_objset, avz,
	vd->vdev_top_zap, tx));
	}
	if (vd->vdev_leaf_zap != 0) {
	VERIFY0(zap_add_int(spa->spa_meta_objset, avz,
	vd->vdev_leaf_zap, tx));
	}
	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	spa_avz_build(vd->vdev_child[i], avz, tx);
	}
	}

	static void
	spa_sync_config_object(spa_t spa, dmu_tx_t tx)
	{
	nvlist_t *config;

	/*
	* If the pool is being imported from a pre-per-vdev-ZAP version of ZFS,
	* its config may not be dirty but we still need to build per-vdev ZAPs.
	* Similarly, if the pool is being assembled (e.g. after a split), we
	* need to rebuild the AVZ although the config may not be dirty.
	*/
	if (list_is_empty(&spa->spa_config_dirty_list) &&
	spa->spa_avz_action == AVZ_ACTION_NONE)
	return;

	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);

	ASSERT(spa->spa_avz_action == AVZ_ACTION_NONE \|\|
	spa->spa_avz_action == AVZ_ACTION_INITIALIZE \|\|
	spa->spa_all_vdev_zaps != 0);

	if (spa->spa_avz_action == AVZ_ACTION_REBUILD) {
	/* Make and build the new AVZ */
	uint64_t new_avz = zap_create(spa->spa_meta_objset,
	DMU_OTN_ZAP_METADATA, DMU_OT_NONE, 0, tx);
	spa_avz_build(spa->spa_root_vdev, new_avz, tx);

	/* Diff old AVZ with new one */
	zap_cursor_t zc;
	zap_attribute_t za;

	for (zap_cursor_init(&zc, spa->spa_meta_objset,
	spa->spa_all_vdev_zaps);
	zap_cursor_retrieve(&zc, &za) == 0;
	zap_cursor_advance(&zc)) {
	uint64_t vdzap = za.za_first_integer;
	if (zap_lookup_int(spa->spa_meta_objset, new_avz,
	vdzap) == ENOENT) {
	/*
	* ZAP is listed in old AVZ but not in new one;
	* destroy it
	*/
	VERIFY0(zap_destroy(spa->spa_meta_objset, vdzap,
	tx));
	}
	}

	zap_cursor_fini(&zc);

	/* Destroy the old AVZ */
	VERIFY0(zap_destroy(spa->spa_meta_objset,
	spa->spa_all_vdev_zaps, tx));

	/* Replace the old AVZ in the dir obj with the new one */
	VERIFY0(zap_update(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_VDEV_ZAP_MAP,
	sizeof (new_avz), 1, &new_avz, tx));

	spa->spa_all_vdev_zaps = new_avz;
	} else if (spa->spa_avz_action == AVZ_ACTION_DESTROY) {
	zap_cursor_t zc;
	zap_attribute_t za;

	/* Walk through the AVZ and destroy all listed ZAPs */
	for (zap_cursor_init(&zc, spa->spa_meta_objset,
	spa->spa_all_vdev_zaps);
	zap_cursor_retrieve(&zc, &za) == 0;
	zap_cursor_advance(&zc)) {
	uint64_t zap = za.za_first_integer;
	VERIFY0(zap_destroy(spa->spa_meta_objset, zap, tx));
	}

	zap_cursor_fini(&zc);

	/* Destroy and unlink the AVZ itself */
	VERIFY0(zap_destroy(spa->spa_meta_objset,
	spa->spa_all_vdev_zaps, tx));
	VERIFY0(zap_remove(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_VDEV_ZAP_MAP, tx));
	spa->spa_all_vdev_zaps = 0;
	}

	if (spa->spa_all_vdev_zaps == 0) {
	spa->spa_all_vdev_zaps = zap_create_link(spa->spa_meta_objset,
	DMU_OTN_ZAP_METADATA, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_VDEV_ZAP_MAP, tx);
	}
	spa->spa_avz_action = AVZ_ACTION_NONE;

	/* Create ZAPs for vdevs that don't have them. */
	vdev_construct_zaps(spa->spa_root_vdev, tx);

	config = spa_config_generate(spa, spa->spa_root_vdev,
	dmu_tx_get_txg(tx), B_FALSE);

	/*
	* If we're upgrading the spa version then make sure that
	* the config object gets updated with the correct version.
	*/
	if (spa->spa_ubsync.ub_version < spa->spa_uberblock.ub_version)
	fnvlist_add_uint64(config, ZPOOL_CONFIG_VERSION,
	spa->spa_uberblock.ub_version);

	spa_config_exit(spa, SCL_STATE, FTAG);

	nvlist_free(spa->spa_config_syncing);
	spa->spa_config_syncing = config;

	spa_sync_nvlist(spa, spa->spa_config_object, config, tx);
	}

	static void
	spa_sync_version(void arg, dmu_tx_t tx)
	{
	uint64_t *versionp = arg;
	uint64_t version = *versionp;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;

	/*
	* Setting the version is special cased when first creating the pool.
	*/
	ASSERT(tx->tx_txg != TXG_INITIAL);

	ASSERT(SPA_VERSION_IS_SUPPORTED(version));
	ASSERT(version >= spa_version(spa));

	spa->spa_uberblock.ub_version = version;
	vdev_config_dirty(spa->spa_root_vdev);
	spa_history_log_internal(spa, "set", tx, "version=%lld",
	(longlong_t)version);
	}

	/*
	* Set zpool properties.
	*/
	static void
	spa_sync_props(void arg, dmu_tx_t tx)
	{
	nvlist_t *nvp = arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	objset_t *mos = spa->spa_meta_objset;
	nvpair_t *elem = NULL;

	mutex_enter(&spa->spa_props_lock);

	while ((elem = nvlist_next_nvpair(nvp, elem))) {
	uint64_t intval;
	char strval, fname;
	zpool_prop_t prop;
	const char *propname;
	zprop_type_t proptype;
	spa_feature_t fid;

	switch (prop = zpool_name_to_prop(nvpair_name(elem))) {
	case ZPOOL_PROP_INVAL:
	/*
	* We checked this earlier in spa_prop_validate().
	*/
	ASSERT(zpool_prop_feature(nvpair_name(elem)));

	fname = strchr(nvpair_name(elem), '@') + 1;
	VERIFY0(zfeature_lookup_name(fname, &fid));

	spa_feature_enable(spa, fid, tx);
	spa_history_log_internal(spa, "set", tx,
	"%s=enabled", nvpair_name(elem));
	break;

	case ZPOOL_PROP_VERSION:
	intval = fnvpair_value_uint64(elem);
	/*
	* The version is synced separately before other
	* properties and should be correct by now.
	*/
	ASSERT3U(spa_version(spa), >=, intval);
	break;

	case ZPOOL_PROP_ALTROOT:
	/*
	* 'altroot' is a non-persistent property. It should
	* have been set temporarily at creation or import time.
	*/
	ASSERT(spa->spa_root != NULL);
	break;

	case ZPOOL_PROP_READONLY:
	case ZPOOL_PROP_CACHEFILE:
	/*
	* 'readonly' and 'cachefile' are also non-persistent
	* properties.
	*/
	break;
	case ZPOOL_PROP_COMMENT:
	strval = fnvpair_value_string(elem);
	if (spa->spa_comment != NULL)
	spa_strfree(spa->spa_comment);
	spa->spa_comment = spa_strdup(strval);
	/*
	* We need to dirty the configuration on all the vdevs
	* so that their labels get updated. It's unnecessary
	* to do this for pool creation since the vdev's
	* configuration has already been dirtied.
	*/
	if (tx->tx_txg != TXG_INITIAL)
	vdev_config_dirty(spa->spa_root_vdev);
	spa_history_log_internal(spa, "set", tx,
	"%s=%s", nvpair_name(elem), strval);
	break;
	default:
	/*
	* Set pool property values in the poolprops mos object.
	*/
	if (spa->spa_pool_props_object == 0) {
	spa->spa_pool_props_object =
	zap_create_link(mos, DMU_OT_POOL_PROPS,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_PROPS,
	tx);
	}

	/* normalize the property name */
	propname = zpool_prop_to_name(prop);
	proptype = zpool_prop_get_type(prop);

	if (nvpair_type(elem) == DATA_TYPE_STRING) {
	ASSERT(proptype == PROP_TYPE_STRING);
	strval = fnvpair_value_string(elem);
	VERIFY0(zap_update(mos,
	spa->spa_pool_props_object, propname,
	1, strlen(strval) + 1, strval, tx));
	spa_history_log_internal(spa, "set", tx,
	"%s=%s", nvpair_name(elem), strval);
	} else if (nvpair_type(elem) == DATA_TYPE_UINT64) {
	intval = fnvpair_value_uint64(elem);

	if (proptype == PROP_TYPE_INDEX) {
	const char *unused;
	VERIFY0(zpool_prop_index_to_string(
	prop, intval, &unused));
	}
	VERIFY0(zap_update(mos,
	spa->spa_pool_props_object, propname,
	8, 1, &intval, tx));
	spa_history_log_internal(spa, "set", tx,
	"%s=%lld", nvpair_name(elem),
	(longlong_t)intval);
	} else {
	ASSERT(0); /* not allowed */
	}

	switch (prop) {
	case ZPOOL_PROP_DELEGATION:
	spa->spa_delegation = intval;
	break;
	case ZPOOL_PROP_BOOTFS:
	spa->spa_bootfs = intval;
	break;
	case ZPOOL_PROP_FAILUREMODE:
	spa->spa_failmode = intval;
	break;
	case ZPOOL_PROP_AUTOTRIM:
	spa->spa_autotrim = intval;
	spa_async_request(spa,
	SPA_ASYNC_AUTOTRIM_RESTART);
	break;
	case ZPOOL_PROP_AUTOEXPAND:
	spa->spa_autoexpand = intval;
	if (tx->tx_txg != TXG_INITIAL)
	spa_async_request(spa,
	SPA_ASYNC_AUTOEXPAND);
	break;
	case ZPOOL_PROP_MULTIHOST:
	spa->spa_multihost = intval;
	break;
	default:
	break;
	}
	}

	}

	mutex_exit(&spa->spa_props_lock);
	}

	/*
	* Perform one-time upgrade on-disk changes. spa_version() does not
	* reflect the new version this txg, so there must be no changes this
	* txg to anything that the upgrade code depends on after it executes.
	* Therefore this must be called after dsl_pool_sync() does the sync
	* tasks.
	*/
	static void
	spa_sync_upgrades(spa_t spa, dmu_tx_t tx)
	{
	if (spa_sync_pass(spa) != 1)
	return;

	dsl_pool_t *dp = spa->spa_dsl_pool;
	rrw_enter(&dp->dp_config_rwlock, RW_WRITER, FTAG);

	if (spa->spa_ubsync.ub_version < SPA_VERSION_ORIGIN &&
	spa->spa_uberblock.ub_version >= SPA_VERSION_ORIGIN) {
	dsl_pool_create_origin(dp, tx);

	/* Keeping the origin open increases spa_minref */
	spa->spa_minref += 3;
	}

	if (spa->spa_ubsync.ub_version < SPA_VERSION_NEXT_CLONES &&
	spa->spa_uberblock.ub_version >= SPA_VERSION_NEXT_CLONES) {
	dsl_pool_upgrade_clones(dp, tx);
	}

	if (spa->spa_ubsync.ub_version < SPA_VERSION_DIR_CLONES &&
	spa->spa_uberblock.ub_version >= SPA_VERSION_DIR_CLONES) {
	dsl_pool_upgrade_dir_clones(dp, tx);

	/* Keeping the freedir open increases spa_minref */
	spa->spa_minref += 3;
	}

	if (spa->spa_ubsync.ub_version < SPA_VERSION_FEATURES &&
	spa->spa_uberblock.ub_version >= SPA_VERSION_FEATURES) {
	spa_feature_create_zap_objects(spa, tx);
	}

	/*
	* LZ4_COMPRESS feature's behaviour was changed to activate_on_enable
	* when possibility to use lz4 compression for metadata was added
	* Old pools that have this feature enabled must be upgraded to have
	* this feature active
	*/
	if (spa->spa_uberblock.ub_version >= SPA_VERSION_FEATURES) {
	boolean_t lz4_en = spa_feature_is_enabled(spa,
	SPA_FEATURE_LZ4_COMPRESS);
	boolean_t lz4_ac = spa_feature_is_active(spa,
	SPA_FEATURE_LZ4_COMPRESS);

	if (lz4_en && !lz4_ac)
	spa_feature_incr(spa, SPA_FEATURE_LZ4_COMPRESS, tx);
	}

	/*
	* If we haven't written the salt, do so now. Note that the
	* feature may not be activated yet, but that's fine since
	* the presence of this ZAP entry is backwards compatible.
	*/
	if (zap_contains(spa->spa_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_CHECKSUM_SALT) == ENOENT) {
	VERIFY0(zap_add(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_CHECKSUM_SALT, 1,
	sizeof (spa->spa_cksum_salt.zcs_bytes),
	spa->spa_cksum_salt.zcs_bytes, tx));
	}

	rrw_exit(&dp->dp_config_rwlock, FTAG);
	}

	static void
	vdev_indirect_state_sync_verify(vdev_t *vd)
	{
	vdev_indirect_mapping_t *vim __maybe_unused = vd->vdev_indirect_mapping;
	vdev_indirect_births_t *vib __maybe_unused = vd->vdev_indirect_births;

	if (vd->vdev_ops == &vdev_indirect_ops) {
	ASSERT(vim != NULL);
	ASSERT(vib != NULL);
	}

	uint64_t obsolete_sm_object = 0;
	ASSERT0(vdev_obsolete_sm_object(vd, &obsolete_sm_object));
	if (obsolete_sm_object != 0) {
	ASSERT(vd->vdev_obsolete_sm != NULL);
	ASSERT(vd->vdev_removing \|\|
	vd->vdev_ops == &vdev_indirect_ops);
	ASSERT(vdev_indirect_mapping_num_entries(vim) > 0);
	ASSERT(vdev_indirect_mapping_bytes_mapped(vim) > 0);
	ASSERT3U(obsolete_sm_object, ==,
	space_map_object(vd->vdev_obsolete_sm));
	ASSERT3U(vdev_indirect_mapping_bytes_mapped(vim), >=,
	space_map_allocated(vd->vdev_obsolete_sm));
	}
	ASSERT(vd->vdev_obsolete_segments != NULL);

	/*
	* Since frees / remaps to an indirect vdev can only
	* happen in syncing context, the obsolete segments
	* tree must be empty when we start syncing.
	*/
	ASSERT0(range_tree_space(vd->vdev_obsolete_segments));
	}

	/*
	* Set the top-level vdev's max queue depth. Evaluate each top-level's
	* async write queue depth in case it changed. The max queue depth will
	* not change in the middle of syncing out this txg.
	*/
	static void
	spa_sync_adjust_vdev_max_queue_depth(spa_t *spa)
	{
	ASSERT(spa_writeable(spa));

	vdev_t *rvd = spa->spa_root_vdev;
	uint32_t max_queue_depth = zfs_vdev_async_write_max_active *
	zfs_vdev_queue_depth_pct / 100;
	metaslab_class_t *normal = spa_normal_class(spa);
	metaslab_class_t *special = spa_special_class(spa);
	metaslab_class_t *dedup = spa_dedup_class(spa);

	uint64_t slots_per_allocator = 0;
	for (int c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];

	metaslab_group_t *mg = tvd->vdev_mg;
	if (mg == NULL \|\| !metaslab_group_initialized(mg))
	continue;

	metaslab_class_t *mc = mg->mg_class;
	if (mc != normal && mc != special && mc != dedup)
	continue;

	/*
	* It is safe to do a lock-free check here because only async
	* allocations look at mg_max_alloc_queue_depth, and async
	* allocations all happen from spa_sync().
	*/
	for (int i = 0; i < mg->mg_allocators; i++) {
	ASSERT0(zfs_refcount_count(
	&(mg->mg_allocator[i].mga_alloc_queue_depth)));
	}
	mg->mg_max_alloc_queue_depth = max_queue_depth;

	for (int i = 0; i < mg->mg_allocators; i++) {
	mg->mg_allocator[i].mga_cur_max_alloc_queue_depth =
	zfs_vdev_def_queue_depth;
	}
	slots_per_allocator += zfs_vdev_def_queue_depth;
	}

	for (int i = 0; i < spa->spa_alloc_count; i++) {
	ASSERT0(zfs_refcount_count(&normal->mc_alloc_slots[i]));
	ASSERT0(zfs_refcount_count(&special->mc_alloc_slots[i]));
	ASSERT0(zfs_refcount_count(&dedup->mc_alloc_slots[i]));
	normal->mc_alloc_max_slots[i] = slots_per_allocator;
	special->mc_alloc_max_slots[i] = slots_per_allocator;
	dedup->mc_alloc_max_slots[i] = slots_per_allocator;
	}
	normal->mc_alloc_throttle_enabled = zio_dva_throttle_enabled;
	special->mc_alloc_throttle_enabled = zio_dva_throttle_enabled;
	dedup->mc_alloc_throttle_enabled = zio_dva_throttle_enabled;
	}

	static void
	spa_sync_condense_indirect(spa_t spa, dmu_tx_t tx)
	{
	ASSERT(spa_writeable(spa));

	vdev_t *rvd = spa->spa_root_vdev;
	for (int c = 0; c < rvd->vdev_children; c++) {
	vdev_t *vd = rvd->vdev_child[c];
	vdev_indirect_state_sync_verify(vd);

	if (vdev_indirect_should_condense(vd)) {
	spa_condense_indirect_start_sync(vd, tx);
	break;
	}
	}
	}

	static void
	spa_sync_iterate_to_convergence(spa_t spa, dmu_tx_t tx)
	{
	objset_t *mos = spa->spa_meta_objset;
	dsl_pool_t *dp = spa->spa_dsl_pool;
	uint64_t txg = tx->tx_txg;
	bplist_t *free_bpl = &spa->spa_free_bplist[txg & TXG_MASK];

	do {
	int pass = ++spa->spa_sync_pass;

	spa_sync_config_object(spa, tx);
	spa_sync_aux_dev(spa, &spa->spa_spares, tx,
	ZPOOL_CONFIG_SPARES, DMU_POOL_SPARES);
	spa_sync_aux_dev(spa, &spa->spa_l2cache, tx,
	ZPOOL_CONFIG_L2CACHE, DMU_POOL_L2CACHE);
	spa_errlog_sync(spa, txg);
	dsl_pool_sync(dp, txg);

	if (pass < zfs_sync_pass_deferred_free \|\|
	spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP)) {
	/*
	* If the log space map feature is active we don't
	* care about deferred frees and the deferred bpobj
	* as the log space map should effectively have the
	* same results (i.e. appending only to one object).
	*/
	spa_sync_frees(spa, free_bpl, tx);
	} else {
	/*
	* We can not defer frees in pass 1, because
	* we sync the deferred frees later in pass 1.
	*/
	ASSERT3U(pass, >, 1);
	bplist_iterate(free_bpl, bpobj_enqueue_alloc_cb,
	&spa->spa_deferred_bpobj, tx);
	}

	ddt_sync(spa, txg);
	dsl_scan_sync(dp, tx);
	svr_sync(spa, tx);
	spa_sync_upgrades(spa, tx);

	spa_flush_metaslabs(spa, tx);

	vdev_t *vd = NULL;
	while ((vd = txg_list_remove(&spa->spa_vdev_txg_list, txg))
	!= NULL)
	vdev_sync(vd, txg);

	/*
	* Note: We need to check if the MOS is dirty because we could
	* have marked the MOS dirty without updating the uberblock
	* (e.g. if we have sync tasks but no dirty user data). We need
	* to check the uberblock's rootbp because it is updated if we
	* have synced out dirty data (though in this case the MOS will
	* most likely also be dirty due to second order effects, we
	* don't want to rely on that here).
	*/
	if (pass == 1 &&
	spa->spa_uberblock.ub_rootbp.blk_birth < txg &&
	!dmu_objset_is_dirty(mos, txg)) {
	/*
	* Nothing changed on the first pass, therefore this
	* TXG is a no-op. Avoid syncing deferred frees, so
	* that we can keep this TXG as a no-op.
	*/
	ASSERT(txg_list_empty(&dp->dp_dirty_datasets, txg));
	ASSERT(txg_list_empty(&dp->dp_dirty_dirs, txg));
	ASSERT(txg_list_empty(&dp->dp_sync_tasks, txg));
	ASSERT(txg_list_empty(&dp->dp_early_sync_tasks, txg));
	break;
	}

	spa_sync_deferred_frees(spa, tx);
	} while (dmu_objset_is_dirty(mos, txg));
	}

	/*
	* Rewrite the vdev configuration (which includes the uberblock) to
	* commit the transaction group.
	*
	* If there are no dirty vdevs, we sync the uberblock to a few random
	* top-level vdevs that are known to be visible in the config cache
	* (see spa_vdev_add() for a complete description). If there are dirty
	* vdevs, sync the uberblock to all vdevs.
	*/
	static void
	spa_sync_rewrite_vdev_config(spa_t spa, dmu_tx_t tx)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	uint64_t txg = tx->tx_txg;

	for (;;) {
	int error = 0;

	/*
	* We hold SCL_STATE to prevent vdev open/close/etc.
	* while we're attempting to write the vdev labels.
	*/
	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);

	if (list_is_empty(&spa->spa_config_dirty_list)) {
	vdev_t *svd[SPA_SYNC_MIN_VDEVS] = { NULL };
	int svdcount = 0;
	int children = rvd->vdev_children;
	int c0 = spa_get_random(children);

	for (int c = 0; c < children; c++) {
	vdev_t *vd =
	rvd->vdev_child[(c0 + c) % children];

	/* Stop when revisiting the first vdev */
	if (c > 0 && svd[0] == vd)
	break;

	if (vd->vdev_ms_array == 0 \|\|
	vd->vdev_islog \|\|
	!vdev_is_concrete(vd))
	continue;

	svd[svdcount++] = vd;
	if (svdcount == SPA_SYNC_MIN_VDEVS)
	break;
	}
	error = vdev_config_sync(svd, svdcount, txg);
	} else {
	error = vdev_config_sync(rvd->vdev_child,
	rvd->vdev_children, txg);
	}

	if (error == 0)
	spa->spa_last_synced_guid = rvd->vdev_guid;

	spa_config_exit(spa, SCL_STATE, FTAG);

	if (error == 0)
	break;
	zio_suspend(spa, NULL, ZIO_SUSPEND_IOERR);
	zio_resume_wait(spa);
	}
	}

	/*
	* Sync the specified transaction group. New blocks may be dirtied as
	* part of the process, so we iterate until it converges.
	*/
	void
	spa_sync(spa_t *spa, uint64_t txg)
	{
	vdev_t *vd = NULL;

	VERIFY(spa_writeable(spa));

	/*
	* Wait for i/os issued in open context that need to complete
	* before this txg syncs.
	*/
	(void) zio_wait(spa->spa_txg_zio[txg & TXG_MASK]);
	spa->spa_txg_zio[txg & TXG_MASK] = zio_root(spa, NULL, NULL,
	ZIO_FLAG_CANFAIL);

	/*
	* Lock out configuration changes.
	*/
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	spa->spa_syncing_txg = txg;
	spa->spa_sync_pass = 0;

	for (int i = 0; i < spa->spa_alloc_count; i++) {
	mutex_enter(&spa->spa_alloc_locks[i]);
	VERIFY0(avl_numnodes(&spa->spa_alloc_trees[i]));
	mutex_exit(&spa->spa_alloc_locks[i]);
	}

	/*
	* If there are any pending vdev state changes, convert them
	* into config changes that go out with this transaction group.
	*/
	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);
	while (list_head(&spa->spa_state_dirty_list) != NULL) {
	/*
	* We need the write lock here because, for aux vdevs,
	* calling vdev_config_dirty() modifies sav_config.
	* This is ugly and will become unnecessary when we
	* eliminate the aux vdev wart by integrating all vdevs
	* into the root vdev tree.
	*/
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	spa_config_enter(spa, SCL_CONFIG \| SCL_STATE, FTAG, RW_WRITER);
	while ((vd = list_head(&spa->spa_state_dirty_list)) != NULL) {
	vdev_state_clean(vd);
	vdev_config_dirty(vd);
	}
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	spa_config_enter(spa, SCL_CONFIG \| SCL_STATE, FTAG, RW_READER);
	}
	spa_config_exit(spa, SCL_STATE, FTAG);

	dsl_pool_t *dp = spa->spa_dsl_pool;
	dmu_tx_t *tx = dmu_tx_create_assigned(dp, txg);

	spa->spa_sync_starttime = gethrtime();
	taskq_cancel_id(system_delay_taskq, spa->spa_deadman_tqid);
	spa->spa_deadman_tqid = taskq_dispatch_delay(system_delay_taskq,
	spa_deadman, spa, TQ_SLEEP, ddi_get_lbolt() +
	NSEC_TO_TICK(spa->spa_deadman_synctime));

	/*
	* If we are upgrading to SPA_VERSION_RAIDZ_DEFLATE this txg,
	* set spa_deflate if we have no raid-z vdevs.
	*/
	if (spa->spa_ubsync.ub_version < SPA_VERSION_RAIDZ_DEFLATE &&
	spa->spa_uberblock.ub_version >= SPA_VERSION_RAIDZ_DEFLATE) {
	vdev_t *rvd = spa->spa_root_vdev;

	int i;
	for (i = 0; i < rvd->vdev_children; i++) {
	vd = rvd->vdev_child[i];
	if (vd->vdev_deflate_ratio != SPA_MINBLOCKSIZE)
	break;
	}
	if (i == rvd->vdev_children) {
	spa->spa_deflate = TRUE;
	VERIFY0(zap_add(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_DEFLATE,
	sizeof (uint64_t), 1, &spa->spa_deflate, tx));
	}
	}

	spa_sync_adjust_vdev_max_queue_depth(spa);

	spa_sync_condense_indirect(spa, tx);

	spa_sync_iterate_to_convergence(spa, tx);

	#ifdef ZFS_DEBUG
	if (!list_is_empty(&spa->spa_config_dirty_list)) {
	/*
	* Make sure that the number of ZAPs for all the vdevs matches
	* the number of ZAPs in the per-vdev ZAP list. This only gets
	* called if the config is dirty; otherwise there may be
	* outstanding AVZ operations that weren't completed in
	* spa_sync_config_object.
	*/
	uint64_t all_vdev_zap_entry_count;
	ASSERT0(zap_count(spa->spa_meta_objset,
	spa->spa_all_vdev_zaps, &all_vdev_zap_entry_count));
	ASSERT3U(vdev_count_verify_zaps(spa->spa_root_vdev), ==,
	all_vdev_zap_entry_count);
	}
	#endif

	if (spa->spa_vdev_removal != NULL) {
	ASSERT0(spa->spa_vdev_removal->svr_bytes_done[txg & TXG_MASK]);
	}

	spa_sync_rewrite_vdev_config(spa, tx);
	dmu_tx_commit(tx);

	taskq_cancel_id(system_delay_taskq, spa->spa_deadman_tqid);
	spa->spa_deadman_tqid = 0;

	/*
	* Clear the dirty config list.
	*/
	while ((vd = list_head(&spa->spa_config_dirty_list)) != NULL)
	vdev_config_clean(vd);

	/*
	* Now that the new config has synced transactionally,
	* let it become visible to the config cache.
	*/
	if (spa->spa_config_syncing != NULL) {
	spa_config_set(spa, spa->spa_config_syncing);
	spa->spa_config_txg = txg;
	spa->spa_config_syncing = NULL;
	}

	dsl_pool_sync_done(dp, txg);

	for (int i = 0; i < spa->spa_alloc_count; i++) {
	mutex_enter(&spa->spa_alloc_locks[i]);
	VERIFY0(avl_numnodes(&spa->spa_alloc_trees[i]));
	mutex_exit(&spa->spa_alloc_locks[i]);
	}

	/*
	* Update usable space statistics.
	*/
	while ((vd = txg_list_remove(&spa->spa_vdev_txg_list, TXG_CLEAN(txg)))
	!= NULL)
	vdev_sync_done(vd, txg);

	metaslab_class_evict_old(spa->spa_normal_class, txg);
	metaslab_class_evict_old(spa->spa_log_class, txg);

	spa_sync_close_syncing_log_sm(spa);

	spa_update_dspace(spa);

	/*
	* It had better be the case that we didn't dirty anything
	* since vdev_config_sync().
	*/
	ASSERT(txg_list_empty(&dp->dp_dirty_datasets, txg));
	ASSERT(txg_list_empty(&dp->dp_dirty_dirs, txg));
	ASSERT(txg_list_empty(&spa->spa_vdev_txg_list, txg));

	while (zfs_pause_spa_sync)
	delay(1);

	spa->spa_sync_pass = 0;

	/*
	* Update the last synced uberblock here. We want to do this at
	* the end of spa_sync() so that consumers of spa_last_synced_txg()
	* will be guaranteed that all the processing associated with
	* that txg has been completed.
	*/
	spa->spa_ubsync = spa->spa_uberblock;
	spa_config_exit(spa, SCL_CONFIG, FTAG);

	spa_handle_ignored_writes(spa);

	/*
	* If any async tasks have been requested, kick them off.
	*/
	spa_async_dispatch(spa);
	}

	/*
	* Sync all pools. We don't want to hold the namespace lock across these
	* operations, so we take a reference on the spa_t and drop the lock during the
	* sync.
	*/
	void
	spa_sync_allpools(void)
	{
	spa_t *spa = NULL;
	mutex_enter(&spa_namespace_lock);
	while ((spa = spa_next(spa)) != NULL) {
	if (spa_state(spa) != POOL_STATE_ACTIVE \|\|
	!spa_writeable(spa) \|\| spa_suspended(spa))
	continue;
	spa_open_ref(spa, FTAG);
	mutex_exit(&spa_namespace_lock);
	txg_wait_synced(spa_get_dsl(spa), 0);
	mutex_enter(&spa_namespace_lock);
	spa_close(spa, FTAG);
	}
	mutex_exit(&spa_namespace_lock);
	}

	/*
	* ==========================================================================
	* Miscellaneous routines
	* ==========================================================================
	*/

	/*
	* Remove all pools in the system.
	*/
	void
	spa_evict_all(void)
	{
	spa_t *spa;

	/*
	* Remove all cached state. All pools should be closed now,
	* so every spa in the AVL tree should be unreferenced.
	*/
	mutex_enter(&spa_namespace_lock);
	while ((spa = spa_next(NULL)) != NULL) {
	/*
	* Stop async tasks. The async thread may need to detach
	* a device that's been replaced, which requires grabbing
	* spa_namespace_lock, so we must drop it here.
	*/
	spa_open_ref(spa, FTAG);
	mutex_exit(&spa_namespace_lock);
	spa_async_suspend(spa);
	mutex_enter(&spa_namespace_lock);
	spa_close(spa, FTAG);

	if (spa->spa_state != POOL_STATE_UNINITIALIZED) {
	spa_unload(spa);
	spa_deactivate(spa);
	}
	spa_remove(spa);
	}
	mutex_exit(&spa_namespace_lock);
	}

	vdev_t *
	spa_lookup_by_guid(spa_t *spa, uint64_t guid, boolean_t aux)
	{
	vdev_t *vd;
	int i;

	if ((vd = vdev_lookup_by_guid(spa->spa_root_vdev, guid)) != NULL)
	return (vd);

	if (aux) {
	for (i = 0; i < spa->spa_l2cache.sav_count; i++) {
	vd = spa->spa_l2cache.sav_vdevs[i];
	if (vd->vdev_guid == guid)
	return (vd);
	}

	for (i = 0; i < spa->spa_spares.sav_count; i++) {
	vd = spa->spa_spares.sav_vdevs[i];
	if (vd->vdev_guid == guid)
	return (vd);
	}
	}

	return (NULL);
	}

	void
	spa_upgrade(spa_t *spa, uint64_t version)
	{
	ASSERT(spa_writeable(spa));

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);

	/*
	* This should only be called for a non-faulted pool, and since a
	* future version would result in an unopenable pool, this shouldn't be
	* possible.
	*/
	ASSERT(SPA_VERSION_IS_SUPPORTED(spa->spa_uberblock.ub_version));
	ASSERT3U(version, >=, spa->spa_uberblock.ub_version);

	spa->spa_uberblock.ub_version = version;
	vdev_config_dirty(spa->spa_root_vdev);

	spa_config_exit(spa, SCL_ALL, FTAG);

	txg_wait_synced(spa_get_dsl(spa), 0);
	}

	boolean_t
	spa_has_spare(spa_t *spa, uint64_t guid)
	{
	int i;
	uint64_t spareguid;
	spa_aux_vdev_t *sav = &spa->spa_spares;

	for (i = 0; i < sav->sav_count; i++)
	if (sav->sav_vdevs[i]->vdev_guid == guid)
	return (B_TRUE);

	for (i = 0; i < sav->sav_npending; i++) {
	if (nvlist_lookup_uint64(sav->sav_pending[i], ZPOOL_CONFIG_GUID,
	&spareguid) == 0 && spareguid == guid)
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	/*
	* Check if a pool has an active shared spare device.
	* Note: reference count of an active spare is 2, as a spare and as a replace
	*/
	static boolean_t
	spa_has_active_shared_spare(spa_t *spa)
	{
	int i, refcnt;
	uint64_t pool;
	spa_aux_vdev_t *sav = &spa->spa_spares;

	for (i = 0; i < sav->sav_count; i++) {
	if (spa_spare_exists(sav->sav_vdevs[i]->vdev_guid, &pool,
	&refcnt) && pool != 0ULL && pool == spa_guid(spa) &&
	refcnt > 2)
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	uint64_t
	spa_total_metaslabs(spa_t *spa)
	{
	vdev_t *rvd = spa->spa_root_vdev;

	uint64_t m = 0;
	for (uint64_t c = 0; c < rvd->vdev_children; c++) {
	vdev_t *vd = rvd->vdev_child[c];
	if (!vdev_is_concrete(vd))
	continue;
	m += vd->vdev_ms_count;
	}
	return (m);
	}

	/*
	* Notify any waiting threads that some activity has switched from being in-
	* progress to not-in-progress so that the thread can wake up and determine
	* whether it is finished waiting.
	*/
	void
	spa_notify_waiters(spa_t *spa)
	{
	/*
	* Acquiring spa_activities_lock here prevents the cv_broadcast from
	* happening between the waiting thread's check and cv_wait.
	*/
	mutex_enter(&spa->spa_activities_lock);
	cv_broadcast(&spa->spa_activities_cv);
	mutex_exit(&spa->spa_activities_lock);
	}

	/*
	* Notify any waiting threads that the pool is exporting, and then block until
	* they are finished using the spa_t.
	*/
	void
	spa_wake_waiters(spa_t *spa)
	{
	mutex_enter(&spa->spa_activities_lock);
	spa->spa_waiters_cancel = B_TRUE;
	cv_broadcast(&spa->spa_activities_cv);
	while (spa->spa_waiters != 0)
	cv_wait(&spa->spa_waiters_cv, &spa->spa_activities_lock);
	spa->spa_waiters_cancel = B_FALSE;
	mutex_exit(&spa->spa_activities_lock);
	}

	/* Whether the vdev or any of its descendants are being initialized/trimmed. */
	static boolean_t
	spa_vdev_activity_in_progress_impl(vdev_t *vd, zpool_wait_activity_t activity)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(spa_config_held(spa, SCL_CONFIG \| SCL_STATE, RW_READER));
	ASSERT(MUTEX_HELD(&spa->spa_activities_lock));
	ASSERT(activity == ZPOOL_WAIT_INITIALIZE \|\|
	activity == ZPOOL_WAIT_TRIM);

	kmutex_t *lock = activity == ZPOOL_WAIT_INITIALIZE ?
	&vd->vdev_initialize_lock : &vd->vdev_trim_lock;

	mutex_exit(&spa->spa_activities_lock);
	mutex_enter(lock);
	mutex_enter(&spa->spa_activities_lock);

	boolean_t in_progress = (activity == ZPOOL_WAIT_INITIALIZE) ?
	(vd->vdev_initialize_state == VDEV_INITIALIZE_ACTIVE) :
	(vd->vdev_trim_state == VDEV_TRIM_ACTIVE);
	mutex_exit(lock);

	if (in_progress)
	return (B_TRUE);

	for (int i = 0; i < vd->vdev_children; i++) {
	if (spa_vdev_activity_in_progress_impl(vd->vdev_child[i],
	activity))
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	/*
	* If use_guid is true, this checks whether the vdev specified by guid is
	* being initialized/trimmed. Otherwise, it checks whether any vdev in the pool
	* is being initialized/trimmed. The caller must hold the config lock and
	* spa_activities_lock.
	*/
	static int
	spa_vdev_activity_in_progress(spa_t *spa, boolean_t use_guid, uint64_t guid,
	zpool_wait_activity_t activity, boolean_t *in_progress)
	{
	mutex_exit(&spa->spa_activities_lock);
	spa_config_enter(spa, SCL_CONFIG \| SCL_STATE, FTAG, RW_READER);
	mutex_enter(&spa->spa_activities_lock);

	vdev_t *vd;
	if (use_guid) {
	vd = spa_lookup_by_guid(spa, guid, B_FALSE);
	if (vd == NULL \|\| !vd->vdev_ops->vdev_op_leaf) {
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (EINVAL);
	}
	} else {
	vd = spa->spa_root_vdev;
	}

	*in_progress = spa_vdev_activity_in_progress_impl(vd, activity);

	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	return (0);
	}

	/*
	* Locking for waiting threads
	* ---------------------------
	*
	* Waiting threads need a way to check whether a given activity is in progress,
	* and then, if it is, wait for it to complete. Each activity will have some
	* in-memory representation of the relevant on-disk state which can be used to
	* determine whether or not the activity is in progress. The in-memory state and
	* the locking used to protect it will be different for each activity, and may
	* not be suitable for use with a cvar (e.g., some state is protected by the
	* config lock). To allow waiting threads to wait without any races, another
	* lock, spa_activities_lock, is used.
	*
	* When the state is checked, both the activity-specific lock (if there is one)
	* and spa_activities_lock are held. In some cases, the activity-specific lock
	* is acquired explicitly (e.g. the config lock). In others, the locking is
	* internal to some check (e.g. bpobj_is_empty). After checking, the waiting
	* thread releases the activity-specific lock and, if the activity is in
	* progress, then cv_waits using spa_activities_lock.
	*
	* The waiting thread is woken when another thread, one completing some
	* activity, updates the state of the activity and then calls
	* spa_notify_waiters, which will cv_broadcast. This 'completing' thread only
	* needs to hold its activity-specific lock when updating the state, and this
	* lock can (but doesn't have to) be dropped before calling spa_notify_waiters.
	*
	* Because spa_notify_waiters acquires spa_activities_lock before broadcasting,
	* and because it is held when the waiting thread checks the state of the
	* activity, it can never be the case that the completing thread both updates
	* the activity state and cv_broadcasts in between the waiting thread's check
	* and cv_wait. Thus, a waiting thread can never miss a wakeup.
	*
	* In order to prevent deadlock, when the waiting thread does its check, in some
	* cases it will temporarily drop spa_activities_lock in order to acquire the
	* activity-specific lock. The order in which spa_activities_lock and the
	* activity specific lock are acquired in the waiting thread is determined by
	* the order in which they are acquired in the completing thread; if the
	* completing thread calls spa_notify_waiters with the activity-specific lock
	* held, then the waiting thread must also acquire the activity-specific lock
	* first.
	*/

	static int
	spa_activity_in_progress(spa_t *spa, zpool_wait_activity_t activity,
	boolean_t use_tag, uint64_t tag, boolean_t *in_progress)
	{
	int error = 0;

	ASSERT(MUTEX_HELD(&spa->spa_activities_lock));

	switch (activity) {
	case ZPOOL_WAIT_CKPT_DISCARD:
	*in_progress =
	(spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT) &&
	zap_contains(spa_meta_objset(spa),
	DMU_POOL_DIRECTORY_OBJECT, DMU_POOL_ZPOOL_CHECKPOINT) ==
	ENOENT);
	break;
	case ZPOOL_WAIT_FREE:
	*in_progress = ((spa_version(spa) >= SPA_VERSION_DEADLISTS &&
	!bpobj_is_empty(&spa->spa_dsl_pool->dp_free_bpobj)) \|\|
	spa_feature_is_active(spa, SPA_FEATURE_ASYNC_DESTROY) \|\|
	spa_livelist_delete_check(spa));
	break;
	case ZPOOL_WAIT_INITIALIZE:
	case ZPOOL_WAIT_TRIM:
	error = spa_vdev_activity_in_progress(spa, use_tag, tag,
	activity, in_progress);
	break;
	case ZPOOL_WAIT_REPLACE:
	mutex_exit(&spa->spa_activities_lock);
	spa_config_enter(spa, SCL_CONFIG \| SCL_STATE, FTAG, RW_READER);
	mutex_enter(&spa->spa_activities_lock);

	*in_progress = vdev_replace_in_progress(spa->spa_root_vdev);
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);
	break;
	case ZPOOL_WAIT_REMOVE:
	*in_progress = (spa->spa_removing_phys.sr_state ==
	DSS_SCANNING);
	break;
	case ZPOOL_WAIT_RESILVER:
	if ((*in_progress = vdev_rebuild_active(spa->spa_root_vdev)))
	break;
	/* fall through */
	case ZPOOL_WAIT_SCRUB:
	{
	boolean_t scanning, paused, is_scrub;
	dsl_scan_t *scn = spa->spa_dsl_pool->dp_scan;

	is_scrub = (scn->scn_phys.scn_func == POOL_SCAN_SCRUB);
	scanning = (scn->scn_phys.scn_state == DSS_SCANNING);
	paused = dsl_scan_is_paused_scrub(scn);
	*in_progress = (scanning && !paused &&
	is_scrub == (activity == ZPOOL_WAIT_SCRUB));
	break;
	}
	default:
	panic("unrecognized value for activity %d", activity);
	}

	return (error);
	}

	static int
	spa_wait_common(const char *pool, zpool_wait_activity_t activity,
	boolean_t use_tag, uint64_t tag, boolean_t *waited)
	{
	/*
	* The tag is used to distinguish between instances of an activity.
	* 'initialize' and 'trim' are the only activities that we use this for.
	* The other activities can only have a single instance in progress in a
	* pool at one time, making the tag unnecessary.
	*
	* There can be multiple devices being replaced at once, but since they
	* all finish once resilvering finishes, we don't bother keeping track
	* of them individually, we just wait for them all to finish.
	*/
	if (use_tag && activity != ZPOOL_WAIT_INITIALIZE &&
	activity != ZPOOL_WAIT_TRIM)
	return (EINVAL);

	if (activity < 0 \|\| activity >= ZPOOL_WAIT_NUM_ACTIVITIES)
	return (EINVAL);

	spa_t *spa;
	int error = spa_open(pool, &spa, FTAG);
	if (error != 0)
	return (error);

	/*
	* Increment the spa's waiter count so that we can call spa_close and
	* still ensure that the spa_t doesn't get freed before this thread is
	* finished with it when the pool is exported. We want to call spa_close
	* before we start waiting because otherwise the additional ref would
	* prevent the pool from being exported or destroyed throughout the
	* potentially long wait.
	*/
	mutex_enter(&spa->spa_activities_lock);
	spa->spa_waiters++;
	spa_close(spa, FTAG);

	*waited = B_FALSE;
	for (;;) {
	boolean_t in_progress;
	error = spa_activity_in_progress(spa, activity, use_tag, tag,
	&in_progress);

	if (error \|\| !in_progress \|\| spa->spa_waiters_cancel)
	break;

	*waited = B_TRUE;

	if (cv_wait_sig(&spa->spa_activities_cv,
	&spa->spa_activities_lock) == 0) {
	error = EINTR;
	break;
	}
	}

	spa->spa_waiters--;
	cv_signal(&spa->spa_waiters_cv);
	mutex_exit(&spa->spa_activities_lock);

	return (error);
	}

	/*
	* Wait for a particular instance of the specified activity to complete, where
	* the instance is identified by 'tag'
	*/
	int
	spa_wait_tag(const char *pool, zpool_wait_activity_t activity, uint64_t tag,
	boolean_t *waited)
	{
	return (spa_wait_common(pool, activity, B_TRUE, tag, waited));
	}

	/*
	* Wait for all instances of the specified activity complete
	*/
	int
	spa_wait(const char pool, zpool_wait_activity_t activity, boolean_t waited)
	{

	return (spa_wait_common(pool, activity, B_FALSE, 0, waited));
	}

	sysevent_t *
	spa_event_create(spa_t spa, vdev_t vd, nvlist_t hist_nvl, const char name)
	{
	sysevent_t *ev = NULL;
	#ifdef _KERNEL
	nvlist_t *resource;

	resource = zfs_event_create(spa, vd, FM_SYSEVENT_CLASS, name, hist_nvl);
	if (resource) {
	ev = kmem_alloc(sizeof (sysevent_t), KM_SLEEP);
	ev->resource = resource;
	}
	#endif
	return (ev);
	}

	void
	spa_event_post(sysevent_t *ev)
	{
	#ifdef _KERNEL
	if (ev) {
	zfs_zevent_post(ev->resource, NULL, zfs_zevent_post_cb);
	kmem_free(ev, sizeof (*ev));
	}
	#endif
	}

	/*
	* Post a zevent corresponding to the given sysevent. The 'name' must be one
	* of the event definitions in sys/sysevent/eventdefs.h. The payload will be
	* filled in from the spa and (optionally) the vdev. This doesn't do anything
	* in the userland libzpool, as we don't want consumers to misinterpret ztest
	* or zdb as real changes.
	*/
	void
	spa_event_notify(spa_t spa, vdev_t vd, nvlist_t hist_nvl, const char name)
	{
	spa_event_post(spa_event_create(spa, vd, hist_nvl, name));
	}

	/* state manipulation functions */
	EXPORT_SYMBOL(spa_open);
	EXPORT_SYMBOL(spa_open_rewind);
	EXPORT_SYMBOL(spa_get_stats);
	EXPORT_SYMBOL(spa_create);
	EXPORT_SYMBOL(spa_import);
	EXPORT_SYMBOL(spa_tryimport);
	EXPORT_SYMBOL(spa_destroy);
	EXPORT_SYMBOL(spa_export);
	EXPORT_SYMBOL(spa_reset);
	EXPORT_SYMBOL(spa_async_request);
	EXPORT_SYMBOL(spa_async_suspend);
	EXPORT_SYMBOL(spa_async_resume);
	EXPORT_SYMBOL(spa_inject_addref);
	EXPORT_SYMBOL(spa_inject_delref);
	EXPORT_SYMBOL(spa_scan_stat_init);
	EXPORT_SYMBOL(spa_scan_get_stats);

	/* device manipulation */
	EXPORT_SYMBOL(spa_vdev_add);
	EXPORT_SYMBOL(spa_vdev_attach);
	EXPORT_SYMBOL(spa_vdev_detach);
	EXPORT_SYMBOL(spa_vdev_setpath);
	EXPORT_SYMBOL(spa_vdev_setfru);
	EXPORT_SYMBOL(spa_vdev_split_mirror);

	/* spare statech is global across all pools) */
	EXPORT_SYMBOL(spa_spare_add);
	EXPORT_SYMBOL(spa_spare_remove);
	EXPORT_SYMBOL(spa_spare_exists);
	EXPORT_SYMBOL(spa_spare_activate);

	/* L2ARC statech is global across all pools) */
	EXPORT_SYMBOL(spa_l2cache_add);
	EXPORT_SYMBOL(spa_l2cache_remove);
	EXPORT_SYMBOL(spa_l2cache_exists);
	EXPORT_SYMBOL(spa_l2cache_activate);
	EXPORT_SYMBOL(spa_l2cache_drop);

	/* scanning */
	EXPORT_SYMBOL(spa_scan);
	EXPORT_SYMBOL(spa_scan_stop);

	/* spa syncing */
	EXPORT_SYMBOL(spa_sync); /* only for DMU use */
	EXPORT_SYMBOL(spa_sync_allpools);

	/* properties */
	EXPORT_SYMBOL(spa_prop_set);
	EXPORT_SYMBOL(spa_prop_get);
	EXPORT_SYMBOL(spa_prop_clear_bootfs);

	/* asynchronous event notification */
	EXPORT_SYMBOL(spa_event_notify);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_spa, spa_, load_verify_shift, INT, ZMOD_RW,
	"log2(fraction of arc that can be used by inflight I/Os when "
	"verifying pool during import");

	ZFS_MODULE_PARAM(zfs_spa, spa_, load_verify_metadata, INT, ZMOD_RW,
	"Set to traverse metadata on pool import");

	ZFS_MODULE_PARAM(zfs_spa, spa_, load_verify_data, INT, ZMOD_RW,
	"Set to traverse data on pool import");

	ZFS_MODULE_PARAM(zfs_spa, spa_, load_print_vdev_tree, INT, ZMOD_RW,
	"Print vdev tree to zfs_dbgmsg during pool import");

	ZFS_MODULE_PARAM(zfs_zio, zio_, taskq_batch_pct, UINT, ZMOD_RD,
	"Percentage of CPUs to run an IO worker thread");

	ZFS_MODULE_PARAM(zfs, zfs_, max_missing_tvds, ULONG, ZMOD_RW,
	"Allow importing pool with up to this number of missing top-level "
	"vdevs (in read-only mode)");

	ZFS_MODULE_PARAM(zfs_livelist_condense, zfs_livelist_condense_, zthr_pause, INT, ZMOD_RW,
	"Set the livelist condense zthr to pause");

	ZFS_MODULE_PARAM(zfs_livelist_condense, zfs_livelist_condense_, sync_pause, INT, ZMOD_RW,
	"Set the livelist condense synctask to pause");

	ZFS_MODULE_PARAM(zfs_livelist_condense, zfs_livelist_condense_, sync_cancel, INT, ZMOD_RW,
	"Whether livelist condensing was canceled in the synctask");

	ZFS_MODULE_PARAM(zfs_livelist_condense, zfs_livelist_condense_, zthr_cancel, INT, ZMOD_RW,
	"Whether livelist condensing was canceled in the zthr function");

	ZFS_MODULE_PARAM(zfs_livelist_condense, zfs_livelist_condense_, new_alloc, INT, ZMOD_RW,
	"Whether extra ALLOC blkptrs were added to a livelist entry while it "
	"was being condensed");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/spa_config.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/spa_config.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/spa_config.c (revision 365892)
	@@ -1,621 +1,619 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright 2011 Nexenta Systems, Inc. All rights reserved.
	- * Copyright (c) 2011, 2018 by Delphix. All rights reserved.
	+ * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright 2017 Joyent, Inc.
	*/

	#include <sys/spa.h>
	#include <sys/file.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/spa_impl.h>
	#include <sys/nvpair.h>
	#include <sys/uio.h>
	#include <sys/fs/zfs.h>
	#include <sys/vdev_impl.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/systeminfo.h>
	#include <sys/sunddi.h>
	#include <sys/zfeature.h>
	#include <sys/zfs_file.h>
	#ifdef _KERNEL
	#include <sys/zone.h>
	#endif

	/*
	* Pool configuration repository.
	*
	* Pool configuration is stored as a packed nvlist on the filesystem. By
	* default, all pools are stored in /etc/zfs/zpool.cache and loaded on boot
	* (when the ZFS module is loaded). Pools can also have the 'cachefile'
	* property set that allows them to be stored in an alternate location until
	* the control of external software.
	*
	* For each cache file, we have a single nvlist which holds all the
	* configuration information. When the module loads, we read this information
	* from /etc/zfs/zpool.cache and populate the SPA namespace. This namespace is
	* maintained independently in spa.c. Whenever the namespace is modified, or
	* the configuration of a pool is changed, we call spa_write_cachefile(), which
	* walks through all the active pools and writes the configuration to disk.
	*/

	static uint64_t spa_config_generation = 1;

	/*
	* This can be overridden in userland to preserve an alternate namespace for
	* userland pools when doing testing.
	*/
	char *spa_config_path = ZPOOL_CACHE;
	int zfs_autoimport_disable = 1;

	/*
	* Called when the module is first loaded, this routine loads the configuration
	* file into the SPA namespace. It does not actually open or load the pools; it
	* only populates the namespace.
	*/
	void
	spa_config_load(void)
	{
	void *buf = NULL;
	nvlist_t nvlist, child;
	nvpair_t *nvpair;
	char *pathname;
	zfs_file_t *fp;
	zfs_file_attr_t zfa;
	uint64_t fsize;
	int err;

	#ifdef _KERNEL
	if (zfs_autoimport_disable)
	return;
	#endif

	/*
	* Open the configuration file.
	*/
	pathname = kmem_alloc(MAXPATHLEN, KM_SLEEP);

	(void) snprintf(pathname, MAXPATHLEN, "%s", spa_config_path);

	err = zfs_file_open(pathname, O_RDONLY, 0, &fp);

	#ifdef __FreeBSD__
	if (err)
	err = zfs_file_open(ZPOOL_CACHE_BOOT, O_RDONLY, 0, &fp);
	#endif
	kmem_free(pathname, MAXPATHLEN);

	if (err)
	return;

	if (zfs_file_getattr(fp, &zfa))
	goto out;

	fsize = zfa.zfa_size;
	buf = kmem_alloc(fsize, KM_SLEEP);

	/*
	* Read the nvlist from the file.
	*/
	if (zfs_file_read(fp, buf, fsize, NULL) < 0)
	goto out;

	/*
	* Unpack the nvlist.
	*/
	if (nvlist_unpack(buf, fsize, &nvlist, KM_SLEEP) != 0)
	goto out;

	/*
	* Iterate over all elements in the nvlist, creating a new spa_t for
	* each one with the specified configuration.
	*/
	mutex_enter(&spa_namespace_lock);
	nvpair = NULL;
	while ((nvpair = nvlist_next_nvpair(nvlist, nvpair)) != NULL) {
	if (nvpair_type(nvpair) != DATA_TYPE_NVLIST)
	continue;

	child = fnvpair_value_nvlist(nvpair);

	if (spa_lookup(nvpair_name(nvpair)) != NULL)
	continue;
	(void) spa_add(nvpair_name(nvpair), child, NULL);
	}
	mutex_exit(&spa_namespace_lock);

	nvlist_free(nvlist);

	out:
	if (buf != NULL)
	kmem_free(buf, fsize);

	zfs_file_close(fp);
	}

	static int
	spa_config_remove(spa_config_dirent_t *dp)
	{
	int error = 0;

	/*
	* Remove the cache file. If zfs_file_unlink() in not supported by the
	* platform fallback to truncating the file which is functionally
	* equivalent.
	*/
	error = zfs_file_unlink(dp->scd_path);
	if (error == EOPNOTSUPP) {
	int flags = O_RDWR \| O_TRUNC;
	zfs_file_t *fp;

	error = zfs_file_open(dp->scd_path, flags, 0644, &fp);
	if (error == 0) {
	(void) zfs_file_fsync(fp, O_SYNC);
	(void) zfs_file_close(fp);
	}
	}

	return (error);
	}

	static int
	spa_config_write(spa_config_dirent_t dp, nvlist_t nvl)
	{
	size_t buflen;
	char *buf;
	int oflags = O_RDWR \| O_TRUNC \| O_CREAT \| O_LARGEFILE;
	char *temp;
	int err;
	zfs_file_t *fp;

	/*
	* If the nvlist is empty (NULL), then remove the old cachefile.
	*/
	if (nvl == NULL) {
	err = spa_config_remove(dp);
	if (err == ENOENT)
	err = 0;

	return (err);
	}

	/*
	* Pack the configuration into a buffer.
	*/
	buf = fnvlist_pack(nvl, &buflen);
	temp = kmem_zalloc(MAXPATHLEN, KM_SLEEP);

	/*
	* Write the configuration to disk. Due to the complexity involved
	* in performing a rename and remove from within the kernel the file
	* is instead truncated and overwritten in place. This way we always
	* have a consistent view of the data or a zero length file.
	*/
	err = zfs_file_open(dp->scd_path, oflags, 0644, &fp);
	if (err == 0) {
	err = zfs_file_write(fp, buf, buflen, NULL);
	if (err == 0)
	err = zfs_file_fsync(fp, O_SYNC);

	zfs_file_close(fp);
	if (err)
	(void) spa_config_remove(dp);
	}
	fnvlist_pack_free(buf, buflen);
	kmem_free(temp, MAXPATHLEN);
	return (err);
	}

	/*
	* Synchronize pool configuration to disk. This must be called with the
	* namespace lock held. Synchronizing the pool cache is typically done after
	* the configuration has been synced to the MOS. This exposes a window where
	* the MOS config will have been updated but the cache file has not. If
	* the system were to crash at that instant then the cached config may not
	* contain the correct information to open the pool and an explicit import
	* would be required.
	*/
	void
	spa_write_cachefile(spa_t *target, boolean_t removing, boolean_t postsysevent)
	{
	spa_config_dirent_t dp, tdp;
	nvlist_t *nvl;
	char *pool_name;
	boolean_t ccw_failure;
	int error = 0;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	if (!(spa_mode_global & SPA_MODE_WRITE))
	return;

	/*
	* Iterate over all cachefiles for the pool, past or present. When the
	* cachefile is changed, the new one is pushed onto this list, allowing
	* us to update previous cachefiles that no longer contain this pool.
	*/
	ccw_failure = B_FALSE;
	for (dp = list_head(&target->spa_config_list); dp != NULL;
	dp = list_next(&target->spa_config_list, dp)) {
	spa_t *spa = NULL;
	if (dp->scd_path == NULL)
	continue;

	/*
	* Iterate over all pools, adding any matching pools to 'nvl'.
	*/
	nvl = NULL;
	while ((spa = spa_next(spa)) != NULL) {
	/*
	* Skip over our own pool if we're about to remove
	* ourselves from the spa namespace or any pool that
	* is readonly. Since we cannot guarantee that a
	* readonly pool would successfully import upon reboot,
	* we don't allow them to be written to the cache file.
	*/
	if ((spa == target && removing) \|\|
	!spa_writeable(spa))
	continue;

	mutex_enter(&spa->spa_props_lock);
	tdp = list_head(&spa->spa_config_list);
	if (spa->spa_config == NULL \|\|
	tdp == NULL \|\|
	tdp->scd_path == NULL \|\|
	strcmp(tdp->scd_path, dp->scd_path) != 0) {
	mutex_exit(&spa->spa_props_lock);
	continue;
	}

	if (nvl == NULL)
	nvl = fnvlist_alloc();

	if (spa->spa_import_flags & ZFS_IMPORT_TEMP_NAME)
	pool_name = fnvlist_lookup_string(
	spa->spa_config, ZPOOL_CONFIG_POOL_NAME);
	else
	pool_name = spa_name(spa);

	fnvlist_add_nvlist(nvl, pool_name, spa->spa_config);
	mutex_exit(&spa->spa_props_lock);
	}

	error = spa_config_write(dp, nvl);
	if (error != 0)
	ccw_failure = B_TRUE;
	nvlist_free(nvl);
	}

	if (ccw_failure) {
	/*
	* Keep trying so that configuration data is
	* written if/when any temporary filesystem
	* resource issues are resolved.
	*/
	if (target->spa_ccw_fail_time == 0) {
	(void) zfs_ereport_post(
	FM_EREPORT_ZFS_CONFIG_CACHE_WRITE,
	- target, NULL, NULL, NULL, 0, 0);
	+ target, NULL, NULL, NULL, 0);
	}
	target->spa_ccw_fail_time = gethrtime();
	spa_async_request(target, SPA_ASYNC_CONFIG_UPDATE);
	} else {
	/*
	* Do not rate limit future attempts to update
	* the config cache.
	*/
	target->spa_ccw_fail_time = 0;
	}

	/*
	* Remove any config entries older than the current one.
	*/
	dp = list_head(&target->spa_config_list);
	while ((tdp = list_next(&target->spa_config_list, dp)) != NULL) {
	list_remove(&target->spa_config_list, tdp);
	if (tdp->scd_path != NULL)
	spa_strfree(tdp->scd_path);
	kmem_free(tdp, sizeof (spa_config_dirent_t));
	}

	spa_config_generation++;

	if (postsysevent)
	spa_event_notify(target, NULL, NULL, ESC_ZFS_CONFIG_SYNC);
	}

	/*
	* Sigh. Inside a local zone, we don't have access to /etc/zfs/zpool.cache,
	* and we don't want to allow the local zone to see all the pools anyway.
	* So we have to invent the ZFS_IOC_CONFIG ioctl to grab the configuration
	* information for all pool visible within the zone.
	*/
	nvlist_t *
	spa_all_configs(uint64_t *generation)
	{
	nvlist_t *pools;
	spa_t *spa = NULL;

	if (*generation == spa_config_generation)
	return (NULL);

	pools = fnvlist_alloc();

	mutex_enter(&spa_namespace_lock);
	while ((spa = spa_next(spa)) != NULL) {
	if (INGLOBALZONE(curproc) \|\|
	zone_dataset_visible(spa_name(spa), NULL)) {
	mutex_enter(&spa->spa_props_lock);
	fnvlist_add_nvlist(pools, spa_name(spa),
	spa->spa_config);
	mutex_exit(&spa->spa_props_lock);
	}
	}
	*generation = spa_config_generation;
	mutex_exit(&spa_namespace_lock);

	return (pools);
	}

	void
	spa_config_set(spa_t spa, nvlist_t config)
	{
	mutex_enter(&spa->spa_props_lock);
	if (spa->spa_config != NULL && spa->spa_config != config)
	nvlist_free(spa->spa_config);
	spa->spa_config = config;
	mutex_exit(&spa->spa_props_lock);
	}

	/*
	* Generate the pool's configuration based on the current in-core state.
	*
	* We infer whether to generate a complete config or just one top-level config
	* based on whether vd is the root vdev.
	*/
	nvlist_t *
	spa_config_generate(spa_t spa, vdev_t vd, uint64_t txg, int getstats)
	{
	nvlist_t config, nvroot;
	vdev_t *rvd = spa->spa_root_vdev;
	unsigned long hostid = 0;
	boolean_t locked = B_FALSE;
	uint64_t split_guid;
	char *pool_name;

	if (vd == NULL) {
	vd = rvd;
	locked = B_TRUE;
	spa_config_enter(spa, SCL_CONFIG \| SCL_STATE, FTAG, RW_READER);
	}

	ASSERT(spa_config_held(spa, SCL_CONFIG \| SCL_STATE, RW_READER) ==
	(SCL_CONFIG \| SCL_STATE));

	/*
	* If txg is -1, report the current value of spa->spa_config_txg.
	*/
	if (txg == -1ULL)
	txg = spa->spa_config_txg;

	/*
	* Originally, users had to handle spa namespace collisions by either
	* exporting the already imported pool or by specifying a new name for
	* the pool with a conflicting name. In the case of root pools from
	* virtual guests, neither approach to collision resolution is
	* reasonable. This is addressed by extending the new name syntax with
	* an option to specify that the new name is temporary. When specified,
	* ZFS_IMPORT_TEMP_NAME will be set in spa->spa_import_flags to tell us
	* to use the previous name, which we do below.
	*/
	if (spa->spa_import_flags & ZFS_IMPORT_TEMP_NAME) {
	VERIFY0(nvlist_lookup_string(spa->spa_config,
	ZPOOL_CONFIG_POOL_NAME, &pool_name));
	} else
	pool_name = spa_name(spa);

	config = fnvlist_alloc();

	fnvlist_add_uint64(config, ZPOOL_CONFIG_VERSION, spa_version(spa));
	fnvlist_add_string(config, ZPOOL_CONFIG_POOL_NAME, pool_name);
	fnvlist_add_uint64(config, ZPOOL_CONFIG_POOL_STATE, spa_state(spa));
	fnvlist_add_uint64(config, ZPOOL_CONFIG_POOL_TXG, txg);
	fnvlist_add_uint64(config, ZPOOL_CONFIG_POOL_GUID, spa_guid(spa));
	fnvlist_add_uint64(config, ZPOOL_CONFIG_ERRATA, spa->spa_errata);
	if (spa->spa_comment != NULL)
	fnvlist_add_string(config, ZPOOL_CONFIG_COMMENT,
	spa->spa_comment);

	hostid = spa_get_hostid(spa);
	if (hostid != 0)
	fnvlist_add_uint64(config, ZPOOL_CONFIG_HOSTID, hostid);
	fnvlist_add_string(config, ZPOOL_CONFIG_HOSTNAME, utsname()->nodename);

	int config_gen_flags = 0;
	if (vd != rvd) {
	fnvlist_add_uint64(config, ZPOOL_CONFIG_TOP_GUID,
	vd->vdev_top->vdev_guid);
	fnvlist_add_uint64(config, ZPOOL_CONFIG_GUID,
	vd->vdev_guid);
	if (vd->vdev_isspare)
	fnvlist_add_uint64(config,
	ZPOOL_CONFIG_IS_SPARE, 1ULL);
	if (vd->vdev_islog)
	fnvlist_add_uint64(config,
	ZPOOL_CONFIG_IS_LOG, 1ULL);
	vd = vd->vdev_top; /* label contains top config */
	} else {
	/*
	* Only add the (potentially large) split information
	* in the mos config, and not in the vdev labels
	*/
	if (spa->spa_config_splitting != NULL)
	fnvlist_add_nvlist(config, ZPOOL_CONFIG_SPLIT,
	spa->spa_config_splitting);

	fnvlist_add_boolean(config, ZPOOL_CONFIG_HAS_PER_VDEV_ZAPS);

	config_gen_flags \|= VDEV_CONFIG_MOS;
	}

	/*
	* Add the top-level config. We even add this on pools which
	* don't support holes in the namespace.
	*/
	vdev_top_config_generate(spa, config);

	/*
	* If we're splitting, record the original pool's guid.
	*/
	if (spa->spa_config_splitting != NULL &&
	nvlist_lookup_uint64(spa->spa_config_splitting,
	ZPOOL_CONFIG_SPLIT_GUID, &split_guid) == 0) {
	fnvlist_add_uint64(config, ZPOOL_CONFIG_SPLIT_GUID, split_guid);
	}

	nvroot = vdev_config_generate(spa, vd, getstats, config_gen_flags);
	fnvlist_add_nvlist(config, ZPOOL_CONFIG_VDEV_TREE, nvroot);
	nvlist_free(nvroot);

	/*
	* Store what's necessary for reading the MOS in the label.
	*/
	fnvlist_add_nvlist(config, ZPOOL_CONFIG_FEATURES_FOR_READ,
	spa->spa_label_features);

	if (getstats && spa_load_state(spa) == SPA_LOAD_NONE) {
	ddt_histogram_t *ddh;
	ddt_stat_t *dds;
	ddt_object_t *ddo;

	ddh = kmem_zalloc(sizeof (ddt_histogram_t), KM_SLEEP);
	ddt_get_dedup_histogram(spa, ddh);
	fnvlist_add_uint64_array(config,
	ZPOOL_CONFIG_DDT_HISTOGRAM,
	(uint64_t )ddh, sizeof (ddh) / sizeof (uint64_t));
	kmem_free(ddh, sizeof (ddt_histogram_t));

	ddo = kmem_zalloc(sizeof (ddt_object_t), KM_SLEEP);
	ddt_get_dedup_object_stats(spa, ddo);
	fnvlist_add_uint64_array(config,
	ZPOOL_CONFIG_DDT_OBJ_STATS,
	(uint64_t )ddo, sizeof (ddo) / sizeof (uint64_t));
	kmem_free(ddo, sizeof (ddt_object_t));

	dds = kmem_zalloc(sizeof (ddt_stat_t), KM_SLEEP);
	ddt_get_dedup_stats(spa, dds);
	fnvlist_add_uint64_array(config,
	ZPOOL_CONFIG_DDT_STATS,
	(uint64_t )dds, sizeof (dds) / sizeof (uint64_t));
	kmem_free(dds, sizeof (ddt_stat_t));
	}

	if (locked)
	spa_config_exit(spa, SCL_CONFIG \| SCL_STATE, FTAG);

	return (config);
	}

	/*
	* Update all disk labels, generate a fresh config based on the current
	* in-core state, and sync the global config cache (do not sync the config
	* cache if this is a booting rootpool).
	*/
	void
	spa_config_update(spa_t *spa, int what)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	uint64_t txg;
	int c;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	txg = spa_last_synced_txg(spa) + 1;
	if (what == SPA_CONFIG_UPDATE_POOL) {
	vdev_config_dirty(rvd);
	} else {
	/*
	* If we have top-level vdevs that were added but have
	* not yet been prepared for allocation, do that now.
	* (It's safe now because the config cache is up to date,
	* so it will be able to translate the new DVAs.)
	* See comments in spa_vdev_add() for full details.
	*/
	for (c = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];

	/*
	* Explicitly skip vdevs that are indirect or
	* log vdevs that are being removed. The reason
	* is that both of those can have vdev_ms_array
	* set to 0 and we wouldn't want to change their
	* metaslab size nor call vdev_expand() on them.
	*/
	if (!vdev_is_concrete(tvd) \|\|
	(tvd->vdev_islog && tvd->vdev_removing))
	continue;

	- if (tvd->vdev_ms_array == 0) {
	- vdev_ashift_optimize(tvd);
	+ if (tvd->vdev_ms_array == 0)
	vdev_metaslab_set_size(tvd);
	- }
	vdev_expand(tvd, txg);
	}
	}
	spa_config_exit(spa, SCL_ALL, FTAG);

	/*
	* Wait for the mosconfig to be regenerated and synced.
	*/
	txg_wait_synced(spa->spa_dsl_pool, txg);

	/*
	* Update the global config cache to reflect the new mosconfig.
	*/
	if (!spa->spa_is_root) {
	spa_write_cachefile(spa, B_FALSE,
	what != SPA_CONFIG_UPDATE_POOL);
	}

	if (what == SPA_CONFIG_UPDATE_POOL)
	spa_config_update(spa, SPA_CONFIG_UPDATE_VDEVS);
	}

	EXPORT_SYMBOL(spa_config_load);
	EXPORT_SYMBOL(spa_all_configs);
	EXPORT_SYMBOL(spa_config_set);
	EXPORT_SYMBOL(spa_config_generate);
	EXPORT_SYMBOL(spa_config_update);

	/* BEGIN CSTYLED */
	#ifdef __linux__
	/* string sysctls require a char array on FreeBSD */
	ZFS_MODULE_PARAM(zfs_spa, spa_, config_path, STRING, ZMOD_RD,
	"SPA config file (/etc/zfs/zpool.cache)");
	#endif

	ZFS_MODULE_PARAM(zfs, zfs_, autoimport_disable, INT, ZMOD_RW,
	"Disable pool import at module load");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/spa_history.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/spa_history.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/spa_history.c (revision 365892)
	@@ -1,629 +1,628 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2018 by Delphix. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright 2017 Joyent, Inc.
	*/

	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/zap.h>
	#include <sys/dsl_synctask.h>
	#include <sys/dmu_tx.h>
	#include <sys/dmu_objset.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_dir.h>
	#include <sys/cmn_err.h>
	#include <sys/sunddi.h>
	#include <sys/cred.h>
	#include "zfs_comutil.h"
	#include "zfs_gitrev.h"
	#ifdef _KERNEL
	#include <sys/zone.h>
	#endif

	/*
	* Routines to manage the on-disk history log.
	*
	* The history log is stored as a dmu object containing
	* <packed record length, record nvlist> tuples.
	*
	* Where "record nvlist" is an nvlist containing uint64_ts and strings, and
	* "packed record length" is the packed length of the "record nvlist" stored
	* as a little endian uint64_t.
	*
	* The log is implemented as a ring buffer, though the original creation
	* of the pool ('zpool create') is never overwritten.
	*
	* The history log is tracked as object 'spa_t::spa_history'. The bonus buffer
	* of 'spa_history' stores the offsets for logging/retrieving history as
	* 'spa_history_phys_t'. 'sh_pool_create_len' is the ending offset in bytes of
	* where the 'zpool create' record is stored. This allows us to never
	* overwrite the original creation of the pool. 'sh_phys_max_off' is the
	* physical ending offset in bytes of the log. This tells you the length of
	* the buffer. 'sh_eof' is the logical EOF (in bytes). Whenever a record
	* is added, 'sh_eof' is incremented by the size of the record.
	* 'sh_eof' is never decremented. 'sh_bof' is the logical BOF (in bytes).
	* This is where the consumer should start reading from after reading in
	* the 'zpool create' portion of the log.
	*
	* 'sh_records_lost' keeps track of how many records have been overwritten
	* and permanently lost.
	*/

	/* convert a logical offset to physical */
	static uint64_t
	spa_history_log_to_phys(uint64_t log_off, spa_history_phys_t *shpp)
	{
	uint64_t phys_len;

	phys_len = shpp->sh_phys_max_off - shpp->sh_pool_create_len;
	return ((log_off - shpp->sh_pool_create_len) % phys_len
	+ shpp->sh_pool_create_len);
	}

	void
	spa_history_create_obj(spa_t spa, dmu_tx_t tx)
	{
	dmu_buf_t *dbp;
	spa_history_phys_t *shpp;
	objset_t *mos = spa->spa_meta_objset;

	ASSERT0(spa->spa_history);
	spa->spa_history = dmu_object_alloc(mos, DMU_OT_SPA_HISTORY,
	SPA_OLD_MAXBLOCKSIZE, DMU_OT_SPA_HISTORY_OFFSETS,
	sizeof (spa_history_phys_t), tx);

	VERIFY0(zap_add(mos, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_HISTORY, sizeof (uint64_t), 1,
	&spa->spa_history, tx));

	VERIFY0(dmu_bonus_hold(mos, spa->spa_history, FTAG, &dbp));
	ASSERT3U(dbp->db_size, >=, sizeof (spa_history_phys_t));

	shpp = dbp->db_data;
	dmu_buf_will_dirty(dbp, tx);

	/*
	* Figure out maximum size of history log. We set it at
	* 0.1% of pool size, with a max of 1G and min of 128KB.
	*/
	shpp->sh_phys_max_off =
	metaslab_class_get_dspace(spa_normal_class(spa)) / 1000;
	shpp->sh_phys_max_off = MIN(shpp->sh_phys_max_off, 1<<30);
	shpp->sh_phys_max_off = MAX(shpp->sh_phys_max_off, 128<<10);

	dmu_buf_rele(dbp, FTAG);
	}

	/*
	* Change 'sh_bof' to the beginning of the next record.
	*/
	static int
	spa_history_advance_bof(spa_t spa, spa_history_phys_t shpp)
	{
	objset_t *mos = spa->spa_meta_objset;
	uint64_t firstread, reclen, phys_bof;
	char buf[sizeof (reclen)];
	int err;

	phys_bof = spa_history_log_to_phys(shpp->sh_bof, shpp);
	firstread = MIN(sizeof (reclen), shpp->sh_phys_max_off - phys_bof);

	if ((err = dmu_read(mos, spa->spa_history, phys_bof, firstread,
	buf, DMU_READ_PREFETCH)) != 0)
	return (err);
	if (firstread != sizeof (reclen)) {
	if ((err = dmu_read(mos, spa->spa_history,
	shpp->sh_pool_create_len, sizeof (reclen) - firstread,
	buf + firstread, DMU_READ_PREFETCH)) != 0)
	return (err);
	}

	reclen = LE_64(((uint64_t )buf));
	shpp->sh_bof += reclen + sizeof (reclen);
	shpp->sh_records_lost++;
	return (0);
	}

	static int
	spa_history_write(spa_t spa, void buf, uint64_t len, spa_history_phys_t *shpp,
	dmu_tx_t *tx)
	{
	uint64_t firstwrite, phys_eof;
	objset_t *mos = spa->spa_meta_objset;
	int err;

	ASSERT(MUTEX_HELD(&spa->spa_history_lock));

	/* see if we need to reset logical BOF */
	while (shpp->sh_phys_max_off - shpp->sh_pool_create_len -
	(shpp->sh_eof - shpp->sh_bof) <= len) {
	if ((err = spa_history_advance_bof(spa, shpp)) != 0) {
	return (err);
	}
	}

	phys_eof = spa_history_log_to_phys(shpp->sh_eof, shpp);
	firstwrite = MIN(len, shpp->sh_phys_max_off - phys_eof);
	shpp->sh_eof += len;
	dmu_write(mos, spa->spa_history, phys_eof, firstwrite, buf, tx);

	len -= firstwrite;
	if (len > 0) {
	/* write out the rest at the beginning of physical file */
	dmu_write(mos, spa->spa_history, shpp->sh_pool_create_len,
	len, (char *)buf + firstwrite, tx);
	}

	return (0);
	}

	/*
	* Post a history sysevent.
	*
	* The nvlist_t* passed into this function will be transformed into a new
	* nvlist where:
	*
	* 1. Nested nvlists will be flattened to a single level
	* 2. Keys will have their names normalized (to remove any problematic
	* characters, such as whitespace)
	*
	* The nvlist_t passed into this function will duplicated and should be freed
	* by caller.
	*
	*/
	static void
	spa_history_log_notify(spa_t spa, nvlist_t nvl)
	{
	nvlist_t *hist_nvl = fnvlist_alloc();
	uint64_t uint64;
	char *string;

	if (nvlist_lookup_string(nvl, ZPOOL_HIST_CMD, &string) == 0)
	fnvlist_add_string(hist_nvl, ZFS_EV_HIST_CMD, string);

	if (nvlist_lookup_string(nvl, ZPOOL_HIST_INT_NAME, &string) == 0)
	fnvlist_add_string(hist_nvl, ZFS_EV_HIST_INT_NAME, string);

	if (nvlist_lookup_string(nvl, ZPOOL_HIST_ZONE, &string) == 0)
	fnvlist_add_string(hist_nvl, ZFS_EV_HIST_ZONE, string);

	if (nvlist_lookup_string(nvl, ZPOOL_HIST_HOST, &string) == 0)
	fnvlist_add_string(hist_nvl, ZFS_EV_HIST_HOST, string);

	if (nvlist_lookup_string(nvl, ZPOOL_HIST_DSNAME, &string) == 0)
	fnvlist_add_string(hist_nvl, ZFS_EV_HIST_DSNAME, string);

	if (nvlist_lookup_string(nvl, ZPOOL_HIST_INT_STR, &string) == 0)
	fnvlist_add_string(hist_nvl, ZFS_EV_HIST_INT_STR, string);

	if (nvlist_lookup_string(nvl, ZPOOL_HIST_IOCTL, &string) == 0)
	fnvlist_add_string(hist_nvl, ZFS_EV_HIST_IOCTL, string);

	if (nvlist_lookup_string(nvl, ZPOOL_HIST_INT_NAME, &string) == 0)
	fnvlist_add_string(hist_nvl, ZFS_EV_HIST_INT_NAME, string);

	if (nvlist_lookup_uint64(nvl, ZPOOL_HIST_DSID, &uint64) == 0)
	fnvlist_add_uint64(hist_nvl, ZFS_EV_HIST_DSID, uint64);

	if (nvlist_lookup_uint64(nvl, ZPOOL_HIST_TXG, &uint64) == 0)
	fnvlist_add_uint64(hist_nvl, ZFS_EV_HIST_TXG, uint64);

	if (nvlist_lookup_uint64(nvl, ZPOOL_HIST_TIME, &uint64) == 0)
	fnvlist_add_uint64(hist_nvl, ZFS_EV_HIST_TIME, uint64);

	if (nvlist_lookup_uint64(nvl, ZPOOL_HIST_WHO, &uint64) == 0)
	fnvlist_add_uint64(hist_nvl, ZFS_EV_HIST_WHO, uint64);

	if (nvlist_lookup_uint64(nvl, ZPOOL_HIST_INT_EVENT, &uint64) == 0)
	fnvlist_add_uint64(hist_nvl, ZFS_EV_HIST_INT_EVENT, uint64);

	spa_event_notify(spa, NULL, hist_nvl, ESC_ZFS_HISTORY_EVENT);

	nvlist_free(hist_nvl);
	}

	/*
	* Write out a history event.
	*/
	/ARGSUSED/
	static void
	spa_history_log_sync(void arg, dmu_tx_t tx)
	{
	nvlist_t *nvl = arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	objset_t *mos = spa->spa_meta_objset;
	dmu_buf_t *dbp;
	spa_history_phys_t *shpp;
	size_t reclen;
	uint64_t le_len;
	char *record_packed = NULL;
	int ret;

	/*
	* If we have an older pool that doesn't have a command
	* history object, create it now.
	*/
	mutex_enter(&spa->spa_history_lock);
	if (!spa->spa_history)
	spa_history_create_obj(spa, tx);
	mutex_exit(&spa->spa_history_lock);

	/*
	* Get the offset of where we need to write via the bonus buffer.
	* Update the offset when the write completes.
	*/
	VERIFY0(dmu_bonus_hold(mos, spa->spa_history, FTAG, &dbp));
	shpp = dbp->db_data;

	dmu_buf_will_dirty(dbp, tx);

	#ifdef ZFS_DEBUG
	{
	dmu_object_info_t doi;
	dmu_object_info_from_db(dbp, &doi);
	ASSERT3U(doi.doi_bonus_type, ==, DMU_OT_SPA_HISTORY_OFFSETS);
	}
	#endif

	fnvlist_add_uint64(nvl, ZPOOL_HIST_TIME, gethrestime_sec());
	fnvlist_add_string(nvl, ZPOOL_HIST_HOST, utsname()->nodename);

	if (nvlist_exists(nvl, ZPOOL_HIST_CMD)) {
	zfs_dbgmsg("command: %s",
	fnvlist_lookup_string(nvl, ZPOOL_HIST_CMD));
	} else if (nvlist_exists(nvl, ZPOOL_HIST_INT_NAME)) {
	if (nvlist_exists(nvl, ZPOOL_HIST_DSNAME)) {
	zfs_dbgmsg("txg %lld %s %s (id %llu) %s",
	fnvlist_lookup_uint64(nvl, ZPOOL_HIST_TXG),
	fnvlist_lookup_string(nvl, ZPOOL_HIST_INT_NAME),
	fnvlist_lookup_string(nvl, ZPOOL_HIST_DSNAME),
	fnvlist_lookup_uint64(nvl, ZPOOL_HIST_DSID),
	fnvlist_lookup_string(nvl, ZPOOL_HIST_INT_STR));
	} else {
	zfs_dbgmsg("txg %lld %s %s",
	fnvlist_lookup_uint64(nvl, ZPOOL_HIST_TXG),
	fnvlist_lookup_string(nvl, ZPOOL_HIST_INT_NAME),
	fnvlist_lookup_string(nvl, ZPOOL_HIST_INT_STR));
	}
	/*
	* The history sysevent is posted only for internal history
	* messages to show what has happened, not how it happened. For
	* example, the following command:
	*
	* # zfs destroy -r tank/foo
	*
	* will result in one sysevent posted per dataset that is
	* destroyed as a result of the command - which could be more
	* than one event in total. By contrast, if the sysevent was
	* posted as a result of the ZPOOL_HIST_CMD key being present
	* it would result in only one sysevent being posted with the
	* full command line arguments, requiring the consumer to know
	* how to parse and understand zfs(1M) command invocations.
	*/
	spa_history_log_notify(spa, nvl);
	} else if (nvlist_exists(nvl, ZPOOL_HIST_IOCTL)) {
	zfs_dbgmsg("ioctl %s",
	fnvlist_lookup_string(nvl, ZPOOL_HIST_IOCTL));
	}

	VERIFY3U(nvlist_pack(nvl, &record_packed, &reclen, NV_ENCODE_NATIVE,
	KM_SLEEP), ==, 0);

	mutex_enter(&spa->spa_history_lock);

	/* write out the packed length as little endian */
	le_len = LE_64((uint64_t)reclen);
	ret = spa_history_write(spa, &le_len, sizeof (le_len), shpp, tx);
	if (!ret)
	ret = spa_history_write(spa, record_packed, reclen, shpp, tx);

	/* The first command is the create, which we keep forever */
	if (ret == 0 && shpp->sh_pool_create_len == 0 &&
	nvlist_exists(nvl, ZPOOL_HIST_CMD)) {
	shpp->sh_pool_create_len = shpp->sh_bof = shpp->sh_eof;
	}

	mutex_exit(&spa->spa_history_lock);
	fnvlist_pack_free(record_packed, reclen);
	dmu_buf_rele(dbp, FTAG);
	fnvlist_free(nvl);
	}

	/*
	* Write out a history event.
	*/
	int
	spa_history_log(spa_t spa, const char msg)
	{
	int err;
	nvlist_t *nvl = fnvlist_alloc();

	fnvlist_add_string(nvl, ZPOOL_HIST_CMD, msg);
	err = spa_history_log_nvl(spa, nvl);
	fnvlist_free(nvl);
	return (err);
	}

	int
	spa_history_log_nvl(spa_t spa, nvlist_t nvl)
	{
	int err = 0;
	dmu_tx_t *tx;
	nvlist_t nvarg, in_nvl = NULL;

	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY \|\| !spa_writeable(spa))
	return (SET_ERROR(EINVAL));

	err = nvlist_lookup_nvlist(nvl, ZPOOL_HIST_INPUT_NVL, &in_nvl);
	if (err == 0) {
	(void) nvlist_remove_all(in_nvl, ZPOOL_HIDDEN_ARGS);
	}

	tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	err = dmu_tx_assign(tx, TXG_WAIT);
	if (err) {
	dmu_tx_abort(tx);
	return (err);
	}

	VERIFY0(nvlist_dup(nvl, &nvarg, KM_SLEEP));
	if (spa_history_zone() != NULL) {
	fnvlist_add_string(nvarg, ZPOOL_HIST_ZONE,
	spa_history_zone());
	}
	fnvlist_add_uint64(nvarg, ZPOOL_HIST_WHO, crgetruid(CRED()));

	/* Kick this off asynchronously; errors are ignored. */
	- dsl_sync_task_nowait(spa_get_dsl(spa), spa_history_log_sync,
	- nvarg, 0, ZFS_SPACE_CHECK_NONE, tx);
	+ dsl_sync_task_nowait(spa_get_dsl(spa), spa_history_log_sync, nvarg, tx);
	dmu_tx_commit(tx);

	/* spa_history_log_sync will free nvl */
	return (err);
	}

	/*
	* Read out the command history.
	*/
	int
	spa_history_get(spa_t spa, uint64_t offp, uint64_t len, char buf)
	{
	objset_t *mos = spa->spa_meta_objset;
	dmu_buf_t *dbp;
	uint64_t read_len, phys_read_off, phys_eof;
	uint64_t leftover = 0;
	spa_history_phys_t *shpp;
	int err;

	/*
	* If the command history doesn't exist (older pool),
	* that's ok, just return ENOENT.
	*/
	if (!spa->spa_history)
	return (SET_ERROR(ENOENT));

	/*
	* The history is logged asynchronously, so when they request
	* the first chunk of history, make sure everything has been
	* synced to disk so that we get it.
	*/
	if (*offp == 0 && spa_writeable(spa))
	txg_wait_synced(spa_get_dsl(spa), 0);

	if ((err = dmu_bonus_hold(mos, spa->spa_history, FTAG, &dbp)) != 0)
	return (err);
	shpp = dbp->db_data;

	#ifdef ZFS_DEBUG
	{
	dmu_object_info_t doi;
	dmu_object_info_from_db(dbp, &doi);
	ASSERT3U(doi.doi_bonus_type, ==, DMU_OT_SPA_HISTORY_OFFSETS);
	}
	#endif

	mutex_enter(&spa->spa_history_lock);
	phys_eof = spa_history_log_to_phys(shpp->sh_eof, shpp);

	if (*offp < shpp->sh_pool_create_len) {
	/* read in just the zpool create history */
	phys_read_off = *offp;
	read_len = MIN(*len, shpp->sh_pool_create_len -
	phys_read_off);
	} else {
	/*
	* Need to reset passed in offset to BOF if the passed in
	* offset has since been overwritten.
	*/
	offp = MAX(offp, shpp->sh_bof);
	phys_read_off = spa_history_log_to_phys(*offp, shpp);

	/*
	* Read up to the minimum of what the user passed down or
	* the EOF (physical or logical). If we hit physical EOF,
	* use 'leftover' to read from the physical BOF.
	*/
	if (phys_read_off <= phys_eof) {
	read_len = MIN(*len, phys_eof - phys_read_off);
	} else {
	read_len = MIN(*len,
	shpp->sh_phys_max_off - phys_read_off);
	if (phys_read_off + *len > shpp->sh_phys_max_off) {
	leftover = MIN(*len - read_len,
	phys_eof - shpp->sh_pool_create_len);
	}
	}
	}

	/* offset for consumer to use next */
	*offp += read_len + leftover;

	/* tell the consumer how much you actually read */
	*len = read_len + leftover;

	if (read_len == 0) {
	mutex_exit(&spa->spa_history_lock);
	dmu_buf_rele(dbp, FTAG);
	return (0);
	}

	err = dmu_read(mos, spa->spa_history, phys_read_off, read_len, buf,
	DMU_READ_PREFETCH);
	if (leftover && err == 0) {
	err = dmu_read(mos, spa->spa_history, shpp->sh_pool_create_len,
	leftover, buf + read_len, DMU_READ_PREFETCH);
	}
	mutex_exit(&spa->spa_history_lock);

	dmu_buf_rele(dbp, FTAG);
	return (err);
	}

	/*
	* The nvlist will be consumed by this call.
	*/
	static void
	log_internal(nvlist_t nvl, const char operation, spa_t *spa,
	dmu_tx_t tx, const char fmt, va_list adx)
	{
	char *msg;

	/*
	* If this is part of creating a pool, not everything is
	* initialized yet, so don't bother logging the internal events.
	* Likewise if the pool is not writeable.
	*/
	if (spa_is_initializing(spa) \|\| !spa_writeable(spa)) {
	fnvlist_free(nvl);
	return;
	}

	msg = kmem_vasprintf(fmt, adx);
	fnvlist_add_string(nvl, ZPOOL_HIST_INT_STR, msg);
	kmem_strfree(msg);

	fnvlist_add_string(nvl, ZPOOL_HIST_INT_NAME, operation);
	fnvlist_add_uint64(nvl, ZPOOL_HIST_TXG, tx->tx_txg);

	if (dmu_tx_is_syncing(tx)) {
	spa_history_log_sync(nvl, tx);
	} else {
	dsl_sync_task_nowait(spa_get_dsl(spa),
	- spa_history_log_sync, nvl, 0, ZFS_SPACE_CHECK_NONE, tx);
	+ spa_history_log_sync, nvl, tx);
	}
	/* spa_history_log_sync() will free nvl */
	}

	void
	spa_history_log_internal(spa_t spa, const char operation,
	dmu_tx_t tx, const char fmt, ...)
	{
	dmu_tx_t *htx = tx;
	va_list adx;

	/* create a tx if we didn't get one */
	if (tx == NULL) {
	htx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	if (dmu_tx_assign(htx, TXG_WAIT) != 0) {
	dmu_tx_abort(htx);
	return;
	}
	}

	va_start(adx, fmt);
	log_internal(fnvlist_alloc(), operation, spa, htx, fmt, adx);
	va_end(adx);

	/* if we didn't get a tx from the caller, commit the one we made */
	if (tx == NULL)
	dmu_tx_commit(htx);
	}

	void
	spa_history_log_internal_ds(dsl_dataset_t ds, const char operation,
	dmu_tx_t tx, const char fmt, ...)
	{
	va_list adx;
	char namebuf[ZFS_MAX_DATASET_NAME_LEN];
	nvlist_t *nvl = fnvlist_alloc();

	ASSERT(tx != NULL);

	dsl_dataset_name(ds, namebuf);
	fnvlist_add_string(nvl, ZPOOL_HIST_DSNAME, namebuf);
	fnvlist_add_uint64(nvl, ZPOOL_HIST_DSID, ds->ds_object);

	va_start(adx, fmt);
	log_internal(nvl, operation, dsl_dataset_get_spa(ds), tx, fmt, adx);
	va_end(adx);
	}

	void
	spa_history_log_internal_dd(dsl_dir_t dd, const char operation,
	dmu_tx_t tx, const char fmt, ...)
	{
	va_list adx;
	char namebuf[ZFS_MAX_DATASET_NAME_LEN];
	nvlist_t *nvl = fnvlist_alloc();

	ASSERT(tx != NULL);

	dsl_dir_name(dd, namebuf);
	fnvlist_add_string(nvl, ZPOOL_HIST_DSNAME, namebuf);
	fnvlist_add_uint64(nvl, ZPOOL_HIST_DSID,
	dsl_dir_phys(dd)->dd_head_dataset_obj);

	va_start(adx, fmt);
	log_internal(nvl, operation, dd->dd_pool->dp_spa, tx, fmt, adx);
	va_end(adx);
	}

	void
	spa_history_log_version(spa_t spa, const char operation, dmu_tx_t *tx)
	{
	utsname_t *u = utsname();

	spa_history_log_internal(spa, operation, tx,
	"pool version %llu; software version %s; uts %s %s %s %s",
	(u_longlong_t)spa_version(spa), ZFS_META_GITREV,
	u->nodename, u->release, u->version, u->machine);
	}

	#ifndef _KERNEL
	const char *
	spa_history_zone(void)
	{
	return (NULL);
	}
	#endif

	#if defined(_KERNEL)
	EXPORT_SYMBOL(spa_history_create_obj);
	EXPORT_SYMBOL(spa_history_get);
	EXPORT_SYMBOL(spa_history_log);
	EXPORT_SYMBOL(spa_history_log_internal);
	EXPORT_SYMBOL(spa_history_log_version);
	#endif
	Index: vendor-sys/openzfs/dist/module/zfs/txg.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/txg.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/txg.c (revision 365892)
	@@ -1,1059 +1,1055 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Portions Copyright 2011 Martin Matuska
	* Copyright (c) 2012, 2019 by Delphix. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/txg_impl.h>
	#include <sys/dmu_impl.h>
	#include <sys/spa_impl.h>
	#include <sys/dmu_tx.h>
	#include <sys/dsl_pool.h>
	#include <sys/dsl_scan.h>
	#include <sys/zil.h>
	#include <sys/callb.h>
	#include <sys/trace_zfs.h>

	/*
	* ZFS Transaction Groups
	* ----------------------
	*
	* ZFS transaction groups are, as the name implies, groups of transactions
	* that act on persistent state. ZFS asserts consistency at the granularity of
	* these transaction groups. Each successive transaction group (txg) is
	* assigned a 64-bit consecutive identifier. There are three active
	* transaction group states: open, quiescing, or syncing. At any given time,
	* there may be an active txg associated with each state; each active txg may
	* either be processing, or blocked waiting to enter the next state. There may
	* be up to three active txgs, and there is always a txg in the open state
	* (though it may be blocked waiting to enter the quiescing state). In broad
	* strokes, transactions -- operations that change in-memory structures -- are
	* accepted into the txg in the open state, and are completed while the txg is
	* in the open or quiescing states. The accumulated changes are written to
	* disk in the syncing state.
	*
	* Open
	*
	* When a new txg becomes active, it first enters the open state. New
	* transactions -- updates to in-memory structures -- are assigned to the
	* currently open txg. There is always a txg in the open state so that ZFS can
	* accept new changes (though the txg may refuse new changes if it has hit
	* some limit). ZFS advances the open txg to the next state for a variety of
	* reasons such as it hitting a time or size threshold, or the execution of an
	* administrative action that must be completed in the syncing state.
	*
	* Quiescing
	*
	* After a txg exits the open state, it enters the quiescing state. The
	* quiescing state is intended to provide a buffer between accepting new
	* transactions in the open state and writing them out to stable storage in
	* the syncing state. While quiescing, transactions can continue their
	* operation without delaying either of the other states. Typically, a txg is
	* in the quiescing state very briefly since the operations are bounded by
	* software latencies rather than, say, slower I/O latencies. After all
	* transactions complete, the txg is ready to enter the next state.
	*
	* Syncing
	*
	* In the syncing state, the in-memory state built up during the open and (to
	* a lesser degree) the quiescing states is written to stable storage. The
	* process of writing out modified data can, in turn modify more data. For
	* example when we write new blocks, we need to allocate space for them; those
	* allocations modify metadata (space maps)... which themselves must be
	* written to stable storage. During the sync state, ZFS iterates, writing out
	* data until it converges and all in-memory changes have been written out.
	* The first such pass is the largest as it encompasses all the modified user
	* data (as opposed to filesystem metadata). Subsequent passes typically have
	* far less data to write as they consist exclusively of filesystem metadata.
	*
	* To ensure convergence, after a certain number of passes ZFS begins
	* overwriting locations on stable storage that had been allocated earlier in
	* the syncing state (and subsequently freed). ZFS usually allocates new
	* blocks to optimize for large, continuous, writes. For the syncing state to
	* converge however it must complete a pass where no new blocks are allocated
	* since each allocation requires a modification of persistent metadata.
	* Further, to hasten convergence, after a prescribed number of passes, ZFS
	* also defers frees, and stops compressing.
	*
	* In addition to writing out user data, we must also execute synctasks during
	* the syncing context. A synctask is the mechanism by which some
	* administrative activities work such as creating and destroying snapshots or
	* datasets. Note that when a synctask is initiated it enters the open txg,
	* and ZFS then pushes that txg as quickly as possible to completion of the
	* syncing state in order to reduce the latency of the administrative
	* activity. To complete the syncing state, ZFS writes out a new uberblock,
	* the root of the tree of blocks that comprise all state stored on the ZFS
	* pool. Finally, if there is a quiesced txg waiting, we signal that it can
	* now transition to the syncing state.
	*/

	static void txg_sync_thread(void *arg);
	static void txg_quiesce_thread(void *arg);

	int zfs_txg_timeout = 5; /* max seconds worth of delta per txg */

	/*
	* Prepare the txg subsystem.
	*/
	void
	txg_init(dsl_pool_t *dp, uint64_t txg)
	{
	tx_state_t *tx = &dp->dp_tx;
	int c;
	bzero(tx, sizeof (tx_state_t));

	tx->tx_cpu = vmem_zalloc(max_ncpus * sizeof (tx_cpu_t), KM_SLEEP);

	for (c = 0; c < max_ncpus; c++) {
	int i;

	mutex_init(&tx->tx_cpu[c].tc_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&tx->tx_cpu[c].tc_open_lock, NULL, MUTEX_NOLOCKDEP,
	NULL);
	for (i = 0; i < TXG_SIZE; i++) {
	cv_init(&tx->tx_cpu[c].tc_cv[i], NULL, CV_DEFAULT,
	NULL);
	list_create(&tx->tx_cpu[c].tc_callbacks[i],
	sizeof (dmu_tx_callback_t),
	offsetof(dmu_tx_callback_t, dcb_node));
	}
	}

	mutex_init(&tx->tx_sync_lock, NULL, MUTEX_DEFAULT, NULL);

	cv_init(&tx->tx_sync_more_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&tx->tx_sync_done_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&tx->tx_quiesce_more_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&tx->tx_quiesce_done_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&tx->tx_exit_cv, NULL, CV_DEFAULT, NULL);

	tx->tx_open_txg = txg;
	}

	/*
	* Close down the txg subsystem.
	*/
	void
	txg_fini(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;
	int c;

	ASSERT0(tx->tx_threads);

	mutex_destroy(&tx->tx_sync_lock);

	cv_destroy(&tx->tx_sync_more_cv);
	cv_destroy(&tx->tx_sync_done_cv);
	cv_destroy(&tx->tx_quiesce_more_cv);
	cv_destroy(&tx->tx_quiesce_done_cv);
	cv_destroy(&tx->tx_exit_cv);

	for (c = 0; c < max_ncpus; c++) {
	int i;

	mutex_destroy(&tx->tx_cpu[c].tc_open_lock);
	mutex_destroy(&tx->tx_cpu[c].tc_lock);
	for (i = 0; i < TXG_SIZE; i++) {
	cv_destroy(&tx->tx_cpu[c].tc_cv[i]);
	list_destroy(&tx->tx_cpu[c].tc_callbacks[i]);
	}
	}

	if (tx->tx_commit_cb_taskq != NULL)
	taskq_destroy(tx->tx_commit_cb_taskq);

	vmem_free(tx->tx_cpu, max_ncpus * sizeof (tx_cpu_t));

	bzero(tx, sizeof (tx_state_t));
	}

	/*
	* Start syncing transaction groups.
	*/
	void
	txg_sync_start(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;

	mutex_enter(&tx->tx_sync_lock);

	dprintf("pool %p\n", dp);

	ASSERT0(tx->tx_threads);

	tx->tx_threads = 2;

	tx->tx_quiesce_thread = thread_create(NULL, 0, txg_quiesce_thread,
	dp, 0, &p0, TS_RUN, defclsyspri);

	/*
	* The sync thread can need a larger-than-default stack size on
	* 32-bit x86. This is due in part to nested pools and
	* scrub_visitbp() recursion.
	*/
	tx->tx_sync_thread = thread_create(NULL, 0, txg_sync_thread,
	dp, 0, &p0, TS_RUN, defclsyspri);

	mutex_exit(&tx->tx_sync_lock);
	}

	static void
	txg_thread_enter(tx_state_t tx, callb_cpr_t cpr)
	{
	CALLB_CPR_INIT(cpr, &tx->tx_sync_lock, callb_generic_cpr, FTAG);
	mutex_enter(&tx->tx_sync_lock);
	}

	static void
	txg_thread_exit(tx_state_t tx, callb_cpr_t cpr, kthread_t **tpp)
	{
	ASSERT(*tpp != NULL);
	*tpp = NULL;
	tx->tx_threads--;
	cv_broadcast(&tx->tx_exit_cv);
	CALLB_CPR_EXIT(cpr); /* drops &tx->tx_sync_lock */
	thread_exit();
	}

	static void
	txg_thread_wait(tx_state_t tx, callb_cpr_t cpr, kcondvar_t *cv, clock_t time)
	{
	CALLB_CPR_SAFE_BEGIN(cpr);

	- /*
	- * cv_wait_sig() is used instead of cv_wait() in order to prevent
	- * this process from incorrectly contributing to the system load
	- * average when idle.
	- */
	if (time) {
	- (void) cv_timedwait_sig(cv, &tx->tx_sync_lock,
	+ (void) cv_timedwait_idle(cv, &tx->tx_sync_lock,
	ddi_get_lbolt() + time);
	} else {
	- cv_wait_sig(cv, &tx->tx_sync_lock);
	+ cv_wait_idle(cv, &tx->tx_sync_lock);
	}

	CALLB_CPR_SAFE_END(cpr, &tx->tx_sync_lock);
	}

	/*
	* Stop syncing transaction groups.
	*/
	void
	txg_sync_stop(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;

	dprintf("pool %p\n", dp);
	/*
	* Finish off any work in progress.
	*/
	ASSERT3U(tx->tx_threads, ==, 2);

	/*
	* We need to ensure that we've vacated the deferred metaslab trees.
	*/
	txg_wait_synced(dp, tx->tx_open_txg + TXG_DEFER_SIZE);

	/*
	* Wake all sync threads and wait for them to die.
	*/
	mutex_enter(&tx->tx_sync_lock);

	ASSERT3U(tx->tx_threads, ==, 2);

	tx->tx_exiting = 1;

	cv_broadcast(&tx->tx_quiesce_more_cv);
	cv_broadcast(&tx->tx_quiesce_done_cv);
	cv_broadcast(&tx->tx_sync_more_cv);

	while (tx->tx_threads != 0)
	cv_wait(&tx->tx_exit_cv, &tx->tx_sync_lock);

	tx->tx_exiting = 0;

	mutex_exit(&tx->tx_sync_lock);
	}

	uint64_t
	txg_hold_open(dsl_pool_t dp, txg_handle_t th)
	{
	tx_state_t *tx = &dp->dp_tx;
	tx_cpu_t *tc;
	uint64_t txg;

	/*
	* It appears the processor id is simply used as a "random"
	* number to index into the array, and there isn't any other
	* significance to the chosen tx_cpu. Because.. Why not use
	* the current cpu to index into the array?
	*/
	kpreempt_disable();
	tc = &tx->tx_cpu[CPU_SEQID];
	kpreempt_enable();

	mutex_enter(&tc->tc_open_lock);
	txg = tx->tx_open_txg;

	mutex_enter(&tc->tc_lock);
	tc->tc_count[txg & TXG_MASK]++;
	mutex_exit(&tc->tc_lock);

	th->th_cpu = tc;
	th->th_txg = txg;

	return (txg);
	}

	void
	txg_rele_to_quiesce(txg_handle_t *th)
	{
	tx_cpu_t *tc = th->th_cpu;

	ASSERT(!MUTEX_HELD(&tc->tc_lock));
	mutex_exit(&tc->tc_open_lock);
	}

	void
	txg_register_callbacks(txg_handle_t th, list_t tx_callbacks)
	{
	tx_cpu_t *tc = th->th_cpu;
	int g = th->th_txg & TXG_MASK;

	mutex_enter(&tc->tc_lock);
	list_move_tail(&tc->tc_callbacks[g], tx_callbacks);
	mutex_exit(&tc->tc_lock);
	}

	void
	txg_rele_to_sync(txg_handle_t *th)
	{
	tx_cpu_t *tc = th->th_cpu;
	int g = th->th_txg & TXG_MASK;

	mutex_enter(&tc->tc_lock);
	ASSERT(tc->tc_count[g] != 0);
	if (--tc->tc_count[g] == 0)
	cv_broadcast(&tc->tc_cv[g]);
	mutex_exit(&tc->tc_lock);

	th->th_cpu = NULL; /* defensive */
	}

	/*
	* Blocks until all transactions in the group are committed.
	*
	* On return, the transaction group has reached a stable state in which it can
	* then be passed off to the syncing context.
	*/
	static void
	txg_quiesce(dsl_pool_t *dp, uint64_t txg)
	{
	tx_state_t *tx = &dp->dp_tx;
	uint64_t tx_open_time;
	int g = txg & TXG_MASK;
	int c;

	/*
	* Grab all tc_open_locks so nobody else can get into this txg.
	*/
	for (c = 0; c < max_ncpus; c++)
	mutex_enter(&tx->tx_cpu[c].tc_open_lock);

	ASSERT(txg == tx->tx_open_txg);
	tx->tx_open_txg++;
	tx->tx_open_time = tx_open_time = gethrtime();

	DTRACE_PROBE2(txg__quiescing, dsl_pool_t *, dp, uint64_t, txg);
	DTRACE_PROBE2(txg__opened, dsl_pool_t *, dp, uint64_t, tx->tx_open_txg);

	/*
	* Now that we've incremented tx_open_txg, we can let threads
	* enter the next transaction group.
	*/
	for (c = 0; c < max_ncpus; c++)
	mutex_exit(&tx->tx_cpu[c].tc_open_lock);

	spa_txg_history_set(dp->dp_spa, txg, TXG_STATE_OPEN, tx_open_time);
	spa_txg_history_add(dp->dp_spa, txg + 1, tx_open_time);

	/*
	* Quiesce the transaction group by waiting for everyone to txg_exit().
	*/
	for (c = 0; c < max_ncpus; c++) {
	tx_cpu_t *tc = &tx->tx_cpu[c];
	mutex_enter(&tc->tc_lock);
	while (tc->tc_count[g] != 0)
	cv_wait(&tc->tc_cv[g], &tc->tc_lock);
	mutex_exit(&tc->tc_lock);
	}

	spa_txg_history_set(dp->dp_spa, txg, TXG_STATE_QUIESCED, gethrtime());
	}

	static void
	txg_do_callbacks(list_t *cb_list)
	{
	dmu_tx_do_callbacks(cb_list, 0);

	list_destroy(cb_list);

	kmem_free(cb_list, sizeof (list_t));
	}

	/*
	* Dispatch the commit callbacks registered on this txg to worker threads.
	*
	* If no callbacks are registered for a given TXG, nothing happens.
	* This function creates a taskq for the associated pool, if needed.
	*/
	static void
	txg_dispatch_callbacks(dsl_pool_t *dp, uint64_t txg)
	{
	int c;
	tx_state_t *tx = &dp->dp_tx;
	list_t *cb_list;

	for (c = 0; c < max_ncpus; c++) {
	tx_cpu_t *tc = &tx->tx_cpu[c];
	/*
	* No need to lock tx_cpu_t at this point, since this can
	* only be called once a txg has been synced.
	*/

	int g = txg & TXG_MASK;

	if (list_is_empty(&tc->tc_callbacks[g]))
	continue;

	if (tx->tx_commit_cb_taskq == NULL) {
	/*
	* Commit callback taskq hasn't been created yet.
	*/
	tx->tx_commit_cb_taskq = taskq_create("tx_commit_cb",
	boot_ncpus, defclsyspri, boot_ncpus, boot_ncpus * 2,
	TASKQ_PREPOPULATE \| TASKQ_DYNAMIC);
	}

	cb_list = kmem_alloc(sizeof (list_t), KM_SLEEP);
	list_create(cb_list, sizeof (dmu_tx_callback_t),
	offsetof(dmu_tx_callback_t, dcb_node));

	list_move_tail(cb_list, &tc->tc_callbacks[g]);

	(void) taskq_dispatch(tx->tx_commit_cb_taskq, (task_func_t *)
	txg_do_callbacks, cb_list, TQ_SLEEP);
	}
	}

	/*
	* Wait for pending commit callbacks of already-synced transactions to finish
	* processing.
	* Calling this function from within a commit callback will deadlock.
	*/
	void
	txg_wait_callbacks(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;

	if (tx->tx_commit_cb_taskq != NULL)
	taskq_wait_outstanding(tx->tx_commit_cb_taskq, 0);
	}

	static boolean_t
	txg_is_syncing(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;
	ASSERT(MUTEX_HELD(&tx->tx_sync_lock));
	return (tx->tx_syncing_txg != 0);
	}

	static boolean_t
	txg_is_quiescing(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;
	ASSERT(MUTEX_HELD(&tx->tx_sync_lock));
	return (tx->tx_quiescing_txg != 0);
	}

	static boolean_t
	txg_has_quiesced_to_sync(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;
	ASSERT(MUTEX_HELD(&tx->tx_sync_lock));
	return (tx->tx_quiesced_txg != 0);
	}

	static void
	txg_sync_thread(void *arg)
	{
	dsl_pool_t *dp = arg;
	spa_t *spa = dp->dp_spa;
	tx_state_t *tx = &dp->dp_tx;
	callb_cpr_t cpr;
	clock_t start, delta;

	(void) spl_fstrans_mark();
	txg_thread_enter(tx, &cpr);

	start = delta = 0;
	for (;;) {
	clock_t timeout = zfs_txg_timeout * hz;
	clock_t timer;
	uint64_t txg;
	uint64_t dirty_min_bytes =
	zfs_dirty_data_max * zfs_dirty_data_sync_percent / 100;

	/*
	* We sync when we're scanning, there's someone waiting
	* on us, or the quiesce thread has handed off a txg to
	* us, or we have reached our timeout.
	*/
	timer = (delta >= timeout ? 0 : timeout - delta);
	while (!dsl_scan_active(dp->dp_scan) &&
	!tx->tx_exiting && timer > 0 &&
	tx->tx_synced_txg >= tx->tx_sync_txg_waiting &&
	!txg_has_quiesced_to_sync(dp) &&
	dp->dp_dirty_total < dirty_min_bytes) {
	dprintf("waiting; tx_synced=%llu waiting=%llu dp=%p\n",
	tx->tx_synced_txg, tx->tx_sync_txg_waiting, dp);
	txg_thread_wait(tx, &cpr, &tx->tx_sync_more_cv, timer);
	delta = ddi_get_lbolt() - start;
	timer = (delta > timeout ? 0 : timeout - delta);
	}

	/*
	* Wait until the quiesce thread hands off a txg to us,
	* prompting it to do so if necessary.
	*/
	while (!tx->tx_exiting && !txg_has_quiesced_to_sync(dp)) {
	if (tx->tx_quiesce_txg_waiting < tx->tx_open_txg+1)
	tx->tx_quiesce_txg_waiting = tx->tx_open_txg+1;
	cv_broadcast(&tx->tx_quiesce_more_cv);
	txg_thread_wait(tx, &cpr, &tx->tx_quiesce_done_cv, 0);
	}

	if (tx->tx_exiting)
	txg_thread_exit(tx, &cpr, &tx->tx_sync_thread);

	/*
	* Consume the quiesced txg which has been handed off to
	* us. This may cause the quiescing thread to now be
	* able to quiesce another txg, so we must signal it.
	*/
	ASSERT(tx->tx_quiesced_txg != 0);
	txg = tx->tx_quiesced_txg;
	tx->tx_quiesced_txg = 0;
	tx->tx_syncing_txg = txg;
	DTRACE_PROBE2(txg__syncing, dsl_pool_t *, dp, uint64_t, txg);
	cv_broadcast(&tx->tx_quiesce_more_cv);

	dprintf("txg=%llu quiesce_txg=%llu sync_txg=%llu\n",
	txg, tx->tx_quiesce_txg_waiting, tx->tx_sync_txg_waiting);
	mutex_exit(&tx->tx_sync_lock);

	txg_stat_t *ts = spa_txg_history_init_io(spa, txg, dp);
	start = ddi_get_lbolt();
	spa_sync(spa, txg);
	delta = ddi_get_lbolt() - start;
	spa_txg_history_fini_io(spa, ts);

	mutex_enter(&tx->tx_sync_lock);
	tx->tx_synced_txg = txg;
	tx->tx_syncing_txg = 0;
	DTRACE_PROBE2(txg__synced, dsl_pool_t *, dp, uint64_t, txg);
	cv_broadcast(&tx->tx_sync_done_cv);

	/*
	* Dispatch commit callbacks to worker threads.
	*/
	txg_dispatch_callbacks(dp, txg);
	}
	}

	static void
	txg_quiesce_thread(void *arg)
	{
	dsl_pool_t *dp = arg;
	tx_state_t *tx = &dp->dp_tx;
	callb_cpr_t cpr;

	txg_thread_enter(tx, &cpr);

	for (;;) {
	uint64_t txg;

	/*
	* We quiesce when there's someone waiting on us.
	* However, we can only have one txg in "quiescing" or
	* "quiesced, waiting to sync" state. So we wait until
	* the "quiesced, waiting to sync" txg has been consumed
	* by the sync thread.
	*/
	while (!tx->tx_exiting &&
	(tx->tx_open_txg >= tx->tx_quiesce_txg_waiting \|\|
	txg_has_quiesced_to_sync(dp)))
	txg_thread_wait(tx, &cpr, &tx->tx_quiesce_more_cv, 0);

	if (tx->tx_exiting)
	txg_thread_exit(tx, &cpr, &tx->tx_quiesce_thread);

	txg = tx->tx_open_txg;
	dprintf("txg=%llu quiesce_txg=%llu sync_txg=%llu\n",
	txg, tx->tx_quiesce_txg_waiting,
	tx->tx_sync_txg_waiting);
	tx->tx_quiescing_txg = txg;

	mutex_exit(&tx->tx_sync_lock);
	txg_quiesce(dp, txg);
	mutex_enter(&tx->tx_sync_lock);

	/*
	* Hand this txg off to the sync thread.
	*/
	dprintf("quiesce done, handing off txg %llu\n", txg);
	tx->tx_quiescing_txg = 0;
	tx->tx_quiesced_txg = txg;
	DTRACE_PROBE2(txg__quiesced, dsl_pool_t *, dp, uint64_t, txg);
	cv_broadcast(&tx->tx_sync_more_cv);
	cv_broadcast(&tx->tx_quiesce_done_cv);
	}
	}

	/*
	* Delay this thread by delay nanoseconds if we are still in the open
	* transaction group and there is already a waiting txg quiescing or quiesced.
	* Abort the delay if this txg stalls or enters the quiescing state.
	*/
	void
	txg_delay(dsl_pool_t *dp, uint64_t txg, hrtime_t delay, hrtime_t resolution)
	{
	tx_state_t *tx = &dp->dp_tx;
	hrtime_t start = gethrtime();

	/* don't delay if this txg could transition to quiescing immediately */
	if (tx->tx_open_txg > txg \|\|
	tx->tx_syncing_txg == txg-1 \|\| tx->tx_synced_txg == txg-1)
	return;

	mutex_enter(&tx->tx_sync_lock);
	if (tx->tx_open_txg > txg \|\| tx->tx_synced_txg == txg-1) {
	mutex_exit(&tx->tx_sync_lock);
	return;
	}

	while (gethrtime() - start < delay &&
	tx->tx_syncing_txg < txg-1 && !txg_stalled(dp)) {
	(void) cv_timedwait_hires(&tx->tx_quiesce_more_cv,
	&tx->tx_sync_lock, delay, resolution, 0);
	}

	DMU_TX_STAT_BUMP(dmu_tx_delay);

	mutex_exit(&tx->tx_sync_lock);
	}

	static boolean_t
	txg_wait_synced_impl(dsl_pool_t *dp, uint64_t txg, boolean_t wait_sig)
	{
	tx_state_t *tx = &dp->dp_tx;

	ASSERT(!dsl_pool_config_held(dp));

	mutex_enter(&tx->tx_sync_lock);
	ASSERT3U(tx->tx_threads, ==, 2);
	if (txg == 0)
	txg = tx->tx_open_txg + TXG_DEFER_SIZE;
	if (tx->tx_sync_txg_waiting < txg)
	tx->tx_sync_txg_waiting = txg;
	dprintf("txg=%llu quiesce_txg=%llu sync_txg=%llu\n",
	txg, tx->tx_quiesce_txg_waiting, tx->tx_sync_txg_waiting);
	while (tx->tx_synced_txg < txg) {
	dprintf("broadcasting sync more "
	"tx_synced=%llu waiting=%llu dp=%px\n",
	tx->tx_synced_txg, tx->tx_sync_txg_waiting, dp);
	cv_broadcast(&tx->tx_sync_more_cv);
	if (wait_sig) {
	/*
	* Condition wait here but stop if the thread receives a
	* signal. The caller may call txg_wait_synced*() again
	* to resume waiting for this txg.
	*/
	if (cv_wait_io_sig(&tx->tx_sync_done_cv,
	&tx->tx_sync_lock) == 0) {
	mutex_exit(&tx->tx_sync_lock);
	return (B_TRUE);
	}
	} else {
	cv_wait_io(&tx->tx_sync_done_cv, &tx->tx_sync_lock);
	}
	}
	mutex_exit(&tx->tx_sync_lock);
	return (B_FALSE);
	}

	void
	txg_wait_synced(dsl_pool_t *dp, uint64_t txg)
	{
	VERIFY0(txg_wait_synced_impl(dp, txg, B_FALSE));
	}

	/*
	* Similar to a txg_wait_synced but it can be interrupted from a signal.
	* Returns B_TRUE if the thread was signaled while waiting.
	*/
	boolean_t
	txg_wait_synced_sig(dsl_pool_t *dp, uint64_t txg)
	{
	return (txg_wait_synced_impl(dp, txg, B_TRUE));
	}

	/*
	* Wait for the specified open transaction group. Set should_quiesce
	* when the current open txg should be quiesced immediately.
	*/
	void
	txg_wait_open(dsl_pool_t *dp, uint64_t txg, boolean_t should_quiesce)
	{
	tx_state_t *tx = &dp->dp_tx;

	ASSERT(!dsl_pool_config_held(dp));

	mutex_enter(&tx->tx_sync_lock);
	ASSERT3U(tx->tx_threads, ==, 2);
	if (txg == 0)
	txg = tx->tx_open_txg + 1;
	if (tx->tx_quiesce_txg_waiting < txg && should_quiesce)
	tx->tx_quiesce_txg_waiting = txg;
	dprintf("txg=%llu quiesce_txg=%llu sync_txg=%llu\n",
	txg, tx->tx_quiesce_txg_waiting, tx->tx_sync_txg_waiting);
	while (tx->tx_open_txg < txg) {
	cv_broadcast(&tx->tx_quiesce_more_cv);
	/*
	* Callers setting should_quiesce will use cv_wait_io() and
	* be accounted for as iowait time. Otherwise, the caller is
	* understood to be idle and cv_wait_sig() is used to prevent
	* incorrectly inflating the system load average.
	*/
	if (should_quiesce == B_TRUE) {
	cv_wait_io(&tx->tx_quiesce_done_cv, &tx->tx_sync_lock);
	} else {
	- cv_wait_sig(&tx->tx_quiesce_done_cv, &tx->tx_sync_lock);
	+ cv_wait_idle(&tx->tx_quiesce_done_cv,
	+ &tx->tx_sync_lock);
	}
	}
	mutex_exit(&tx->tx_sync_lock);
	}

	/*
	* If there isn't a txg syncing or in the pipeline, push another txg through
	* the pipeline by quiescing the open txg.
	*/
	void
	txg_kick(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;

	ASSERT(!dsl_pool_config_held(dp));

	mutex_enter(&tx->tx_sync_lock);
	if (!txg_is_syncing(dp) &&
	!txg_is_quiescing(dp) &&
	tx->tx_quiesce_txg_waiting <= tx->tx_open_txg &&
	tx->tx_sync_txg_waiting <= tx->tx_synced_txg &&
	tx->tx_quiesced_txg <= tx->tx_synced_txg) {
	tx->tx_quiesce_txg_waiting = tx->tx_open_txg + 1;
	cv_broadcast(&tx->tx_quiesce_more_cv);
	}
	mutex_exit(&tx->tx_sync_lock);
	}

	boolean_t
	txg_stalled(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;
	return (tx->tx_quiesce_txg_waiting > tx->tx_open_txg);
	}

	boolean_t
	txg_sync_waiting(dsl_pool_t *dp)
	{
	tx_state_t *tx = &dp->dp_tx;

	return (tx->tx_syncing_txg <= tx->tx_sync_txg_waiting \|\|
	tx->tx_quiesced_txg != 0);
	}

	/*
	* Verify that this txg is active (open, quiescing, syncing). Non-active
	* txg's should not be manipulated.
	*/
	#ifdef ZFS_DEBUG
	void
	txg_verify(spa_t *spa, uint64_t txg)
	{
	dsl_pool_t *dp __maybe_unused = spa_get_dsl(spa);
	if (txg <= TXG_INITIAL \|\| txg == ZILTEST_TXG)
	return;
	ASSERT3U(txg, <=, dp->dp_tx.tx_open_txg);
	ASSERT3U(txg, >=, dp->dp_tx.tx_synced_txg);
	ASSERT3U(txg, >=, dp->dp_tx.tx_open_txg - TXG_CONCURRENT_STATES);
	}
	#endif

	/*
	* Per-txg object lists.
	*/
	void
	txg_list_create(txg_list_t tl, spa_t spa, size_t offset)
	{
	int t;

	mutex_init(&tl->tl_lock, NULL, MUTEX_DEFAULT, NULL);

	tl->tl_offset = offset;
	tl->tl_spa = spa;

	for (t = 0; t < TXG_SIZE; t++)
	tl->tl_head[t] = NULL;
	}

	static boolean_t
	txg_list_empty_impl(txg_list_t *tl, uint64_t txg)
	{
	ASSERT(MUTEX_HELD(&tl->tl_lock));
	TXG_VERIFY(tl->tl_spa, txg);
	return (tl->tl_head[txg & TXG_MASK] == NULL);
	}

	boolean_t
	txg_list_empty(txg_list_t *tl, uint64_t txg)
	{
	mutex_enter(&tl->tl_lock);
	boolean_t ret = txg_list_empty_impl(tl, txg);
	mutex_exit(&tl->tl_lock);

	return (ret);
	}

	void
	txg_list_destroy(txg_list_t *tl)
	{
	int t;

	mutex_enter(&tl->tl_lock);
	for (t = 0; t < TXG_SIZE; t++)
	ASSERT(txg_list_empty_impl(tl, t));
	mutex_exit(&tl->tl_lock);

	mutex_destroy(&tl->tl_lock);
	}

	/*
	* Returns true if all txg lists are empty.
	*
	* Warning: this is inherently racy (an item could be added immediately
	* after this function returns).
	*/
	boolean_t
	txg_all_lists_empty(txg_list_t *tl)
	{
	mutex_enter(&tl->tl_lock);
	for (int i = 0; i < TXG_SIZE; i++) {
	if (!txg_list_empty_impl(tl, i)) {
	mutex_exit(&tl->tl_lock);
	return (B_FALSE);
	}
	}
	mutex_exit(&tl->tl_lock);
	return (B_TRUE);
	}

	/*
	* Add an entry to the list (unless it's already on the list).
	* Returns B_TRUE if it was actually added.
	*/
	boolean_t
	txg_list_add(txg_list_t tl, void p, uint64_t txg)
	{
	int t = txg & TXG_MASK;
	txg_node_t tn = (txg_node_t )((char *)p + tl->tl_offset);
	boolean_t add;

	TXG_VERIFY(tl->tl_spa, txg);
	mutex_enter(&tl->tl_lock);
	add = (tn->tn_member[t] == 0);
	if (add) {
	tn->tn_member[t] = 1;
	tn->tn_next[t] = tl->tl_head[t];
	tl->tl_head[t] = tn;
	}
	mutex_exit(&tl->tl_lock);

	return (add);
	}

	/*
	* Add an entry to the end of the list, unless it's already on the list.
	* (walks list to find end)
	* Returns B_TRUE if it was actually added.
	*/
	boolean_t
	txg_list_add_tail(txg_list_t tl, void p, uint64_t txg)
	{
	int t = txg & TXG_MASK;
	txg_node_t tn = (txg_node_t )((char *)p + tl->tl_offset);
	boolean_t add;

	TXG_VERIFY(tl->tl_spa, txg);
	mutex_enter(&tl->tl_lock);
	add = (tn->tn_member[t] == 0);
	if (add) {
	txg_node_t **tp;

	for (tp = &tl->tl_head[t]; tp != NULL; tp = &(tp)->tn_next[t])
	continue;

	tn->tn_member[t] = 1;
	tn->tn_next[t] = NULL;
	*tp = tn;
	}
	mutex_exit(&tl->tl_lock);

	return (add);
	}

	/*
	* Remove the head of the list and return it.
	*/
	void *
	txg_list_remove(txg_list_t *tl, uint64_t txg)
	{
	int t = txg & TXG_MASK;
	txg_node_t *tn;
	void *p = NULL;

	TXG_VERIFY(tl->tl_spa, txg);
	mutex_enter(&tl->tl_lock);
	if ((tn = tl->tl_head[t]) != NULL) {
	ASSERT(tn->tn_member[t]);
	ASSERT(tn->tn_next[t] == NULL \|\| tn->tn_next[t]->tn_member[t]);
	p = (char *)tn - tl->tl_offset;
	tl->tl_head[t] = tn->tn_next[t];
	tn->tn_next[t] = NULL;
	tn->tn_member[t] = 0;
	}
	mutex_exit(&tl->tl_lock);

	return (p);
	}

	/*
	* Remove a specific item from the list and return it.
	*/
	void *
	txg_list_remove_this(txg_list_t tl, void p, uint64_t txg)
	{
	int t = txg & TXG_MASK;
	txg_node_t tn, *tp;

	TXG_VERIFY(tl->tl_spa, txg);
	mutex_enter(&tl->tl_lock);

	for (tp = &tl->tl_head[t]; (tn = *tp) != NULL; tp = &tn->tn_next[t]) {
	if ((char *)tn - tl->tl_offset == p) {
	*tp = tn->tn_next[t];
	tn->tn_next[t] = NULL;
	tn->tn_member[t] = 0;
	mutex_exit(&tl->tl_lock);
	return (p);
	}
	}

	mutex_exit(&tl->tl_lock);

	return (NULL);
	}

	boolean_t
	txg_list_member(txg_list_t tl, void p, uint64_t txg)
	{
	int t = txg & TXG_MASK;
	txg_node_t tn = (txg_node_t )((char *)p + tl->tl_offset);

	TXG_VERIFY(tl->tl_spa, txg);
	return (tn->tn_member[t] != 0);
	}

	/*
	* Walk a txg list
	*/
	void *
	txg_list_head(txg_list_t *tl, uint64_t txg)
	{
	int t = txg & TXG_MASK;
	txg_node_t *tn;

	mutex_enter(&tl->tl_lock);
	tn = tl->tl_head[t];
	mutex_exit(&tl->tl_lock);

	TXG_VERIFY(tl->tl_spa, txg);
	return (tn == NULL ? NULL : (char *)tn - tl->tl_offset);
	}

	void *
	txg_list_next(txg_list_t tl, void p, uint64_t txg)
	{
	int t = txg & TXG_MASK;
	txg_node_t tn = (txg_node_t )((char *)p + tl->tl_offset);

	TXG_VERIFY(tl->tl_spa, txg);

	mutex_enter(&tl->tl_lock);
	tn = tn->tn_next[t];
	mutex_exit(&tl->tl_lock);

	return (tn == NULL ? NULL : (char *)tn - tl->tl_offset);
	}

	EXPORT_SYMBOL(txg_init);
	EXPORT_SYMBOL(txg_fini);
	EXPORT_SYMBOL(txg_sync_start);
	EXPORT_SYMBOL(txg_sync_stop);
	EXPORT_SYMBOL(txg_hold_open);
	EXPORT_SYMBOL(txg_rele_to_quiesce);
	EXPORT_SYMBOL(txg_rele_to_sync);
	EXPORT_SYMBOL(txg_register_callbacks);
	EXPORT_SYMBOL(txg_delay);
	EXPORT_SYMBOL(txg_wait_synced);
	EXPORT_SYMBOL(txg_wait_open);
	EXPORT_SYMBOL(txg_wait_callbacks);
	EXPORT_SYMBOL(txg_stalled);
	EXPORT_SYMBOL(txg_sync_waiting);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_txg, zfs_txg_, timeout, INT, ZMOD_RW,
	"Max seconds worth of delta per txg");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/vdev.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev.c (revision 365892)
	@@ -1,5091 +1,5112 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright 2017 Nexenta Systems, Inc.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright 2016 Toomas Soome <tsoome@me.com>
	* Copyright 2017 Joyent, Inc.
	* Copyright (c) 2017, Intel Corporation.
	* Copyright (c) 2019, Datto Inc. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/bpobj.h>
	#include <sys/dmu.h>
	#include <sys/dmu_tx.h>
	#include <sys/dsl_dir.h>
	#include <sys/vdev_impl.h>
	#include <sys/vdev_rebuild.h>
	#include <sys/uberblock_impl.h>
	#include <sys/metaslab.h>
	#include <sys/metaslab_impl.h>
	#include <sys/space_map.h>
	#include <sys/space_reftree.h>
	#include <sys/zio.h>
	#include <sys/zap.h>
	#include <sys/fs/zfs.h>
	#include <sys/arc.h>
	#include <sys/zil.h>
	#include <sys/dsl_scan.h>
	#include <sys/abd.h>
	#include <sys/vdev_initialize.h>
	#include <sys/vdev_trim.h>
	#include <sys/zvol.h>
	#include <sys/zfs_ratelimit.h>

	/* default target for number of metaslabs per top-level vdev */
	int zfs_vdev_default_ms_count = 200;

	/* minimum number of metaslabs per top-level vdev */
	int zfs_vdev_min_ms_count = 16;

	/* practical upper limit of total metaslabs per top-level vdev */
	int zfs_vdev_ms_count_limit = 1ULL << 17;

	/* lower limit for metaslab size (512M) */
	int zfs_vdev_default_ms_shift = 29;

	/* upper limit for metaslab size (16G) */
	int zfs_vdev_max_ms_shift = 34;

	int vdev_validate_skip = B_FALSE;

	/*
	* Since the DTL space map of a vdev is not expected to have a lot of
	* entries, we default its block size to 4K.
	*/
	int zfs_vdev_dtl_sm_blksz = (1 << 12);

	/*
	* Rate limit slow IO (delay) events to this many per second.
	*/
	unsigned int zfs_slow_io_events_per_second = 20;

	/*
	* Rate limit checksum events after this many checksum errors per second.
	*/
	unsigned int zfs_checksum_events_per_second = 20;

	/*
	* Ignore errors during scrub/resilver. Allows to work around resilver
	* upon import when there are pool errors.
	*/
	int zfs_scan_ignore_errors = 0;

	/*
	* vdev-wide space maps that have lots of entries written to them at
	* the end of each transaction can benefit from a higher I/O bandwidth
	* (e.g. vdev_obsolete_sm), thus we default their block size to 128K.
	*/
	int zfs_vdev_standard_sm_blksz = (1 << 17);

	/*
	* Tunable parameter for debugging or performance analysis. Setting this
	* will cause pool corruption on power loss if a volatile out-of-order
	* write cache is enabled.
	*/
	int zfs_nocacheflush = 0;

	uint64_t zfs_vdev_max_auto_ashift = ASHIFT_MAX;
	uint64_t zfs_vdev_min_auto_ashift = ASHIFT_MIN;

	/PRINTFLIKE2/
	void
	vdev_dbgmsg(vdev_t vd, const char fmt, ...)
	{
	va_list adx;
	char buf[256];

	va_start(adx, fmt);
	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
	va_end(adx);

	if (vd->vdev_path != NULL) {
	zfs_dbgmsg("%s vdev '%s': %s", vd->vdev_ops->vdev_op_type,
	vd->vdev_path, buf);
	} else {
	zfs_dbgmsg("%s-%llu vdev (guid %llu): %s",
	vd->vdev_ops->vdev_op_type,
	(u_longlong_t)vd->vdev_id,
	(u_longlong_t)vd->vdev_guid, buf);
	}
	}

	void
	vdev_dbgmsg_print_tree(vdev_t *vd, int indent)
	{
	char state[20];

	if (vd->vdev_ishole \|\| vd->vdev_ops == &vdev_missing_ops) {
	zfs_dbgmsg("%*svdev %u: %s", indent, "", vd->vdev_id,
	vd->vdev_ops->vdev_op_type);
	return;
	}

	switch (vd->vdev_state) {
	case VDEV_STATE_UNKNOWN:
	(void) snprintf(state, sizeof (state), "unknown");
	break;
	case VDEV_STATE_CLOSED:
	(void) snprintf(state, sizeof (state), "closed");
	break;
	case VDEV_STATE_OFFLINE:
	(void) snprintf(state, sizeof (state), "offline");
	break;
	case VDEV_STATE_REMOVED:
	(void) snprintf(state, sizeof (state), "removed");
	break;
	case VDEV_STATE_CANT_OPEN:
	(void) snprintf(state, sizeof (state), "can't open");
	break;
	case VDEV_STATE_FAULTED:
	(void) snprintf(state, sizeof (state), "faulted");
	break;
	case VDEV_STATE_DEGRADED:
	(void) snprintf(state, sizeof (state), "degraded");
	break;
	case VDEV_STATE_HEALTHY:
	(void) snprintf(state, sizeof (state), "healthy");
	break;
	default:
	(void) snprintf(state, sizeof (state), "<state %u>",
	(uint_t)vd->vdev_state);
	}

	zfs_dbgmsg("%*svdev %u: %s%s, guid: %llu, path: %s, %s", indent,
	"", (int)vd->vdev_id, vd->vdev_ops->vdev_op_type,
	vd->vdev_islog ? " (log)" : "",
	(u_longlong_t)vd->vdev_guid,
	vd->vdev_path ? vd->vdev_path : "N/A", state);

	for (uint64_t i = 0; i < vd->vdev_children; i++)
	vdev_dbgmsg_print_tree(vd->vdev_child[i], indent + 2);
	}

	/*
	* Virtual device management.
	*/

	static vdev_ops_t *vdev_ops_table[] = {
	&vdev_root_ops,
	&vdev_raidz_ops,
	&vdev_mirror_ops,
	&vdev_replacing_ops,
	&vdev_spare_ops,
	&vdev_disk_ops,
	&vdev_file_ops,
	&vdev_missing_ops,
	&vdev_hole_ops,
	&vdev_indirect_ops,
	NULL
	};

	/*
	* Given a vdev type, return the appropriate ops vector.
	*/
	static vdev_ops_t *
	vdev_getops(const char *type)
	{
	vdev_ops_t ops, *opspp;

	for (opspp = vdev_ops_table; (ops = *opspp) != NULL; opspp++)
	if (strcmp(ops->vdev_op_type, type) == 0)
	break;

	return (ops);
	}

	/* ARGSUSED */
	void
	vdev_default_xlate(vdev_t vd, const range_seg64_t in, range_seg64_t *res)
	{
	res->rs_start = in->rs_start;
	res->rs_end = in->rs_end;
	}

	/*
	* Derive the enumerated allocation bias from string input.
	* String origin is either the per-vdev zap or zpool(1M).
	*/
	static vdev_alloc_bias_t
	vdev_derive_alloc_bias(const char *bias)
	{
	vdev_alloc_bias_t alloc_bias = VDEV_BIAS_NONE;

	if (strcmp(bias, VDEV_ALLOC_BIAS_LOG) == 0)
	alloc_bias = VDEV_BIAS_LOG;
	else if (strcmp(bias, VDEV_ALLOC_BIAS_SPECIAL) == 0)
	alloc_bias = VDEV_BIAS_SPECIAL;
	else if (strcmp(bias, VDEV_ALLOC_BIAS_DEDUP) == 0)
	alloc_bias = VDEV_BIAS_DEDUP;

	return (alloc_bias);
	}

	/*
	* Default asize function: return the MAX of psize with the asize of
	* all children. This is what's used by anything other than RAID-Z.
	*/
	uint64_t
	vdev_default_asize(vdev_t *vd, uint64_t psize)
	{
	uint64_t asize = P2ROUNDUP(psize, 1ULL << vd->vdev_top->vdev_ashift);
	uint64_t csize;

	for (int c = 0; c < vd->vdev_children; c++) {
	csize = vdev_psize_to_asize(vd->vdev_child[c], psize);
	asize = MAX(asize, csize);
	}

	return (asize);
	}

	/*
	* Get the minimum allocatable size. We define the allocatable size as
	* the vdev's asize rounded to the nearest metaslab. This allows us to
	* replace or attach devices which don't have the same physical size but
	* can still satisfy the same number of allocations.
	*/
	uint64_t
	vdev_get_min_asize(vdev_t *vd)
	{
	vdev_t *pvd = vd->vdev_parent;

	/*
	* If our parent is NULL (inactive spare or cache) or is the root,
	* just return our own asize.
	*/
	if (pvd == NULL)
	return (vd->vdev_asize);

	/*
	* The top-level vdev just returns the allocatable size rounded
	* to the nearest metaslab.
	*/
	if (vd == vd->vdev_top)
	return (P2ALIGN(vd->vdev_asize, 1ULL << vd->vdev_ms_shift));

	/*
	* The allocatable space for a raidz vdev is N * sizeof(smallest child),
	* so each child must provide at least 1/Nth of its asize.
	*/
	if (pvd->vdev_ops == &vdev_raidz_ops)
	return ((pvd->vdev_min_asize + pvd->vdev_children - 1) /
	pvd->vdev_children);

	return (pvd->vdev_min_asize);
	}

	void
	vdev_set_min_asize(vdev_t *vd)
	{
	vd->vdev_min_asize = vdev_get_min_asize(vd);

	for (int c = 0; c < vd->vdev_children; c++)
	vdev_set_min_asize(vd->vdev_child[c]);
	}

	vdev_t *
	vdev_lookup_top(spa_t *spa, uint64_t vdev)
	{
	vdev_t *rvd = spa->spa_root_vdev;

	ASSERT(spa_config_held(spa, SCL_ALL, RW_READER) != 0);

	if (vdev < rvd->vdev_children) {
	ASSERT(rvd->vdev_child[vdev] != NULL);
	return (rvd->vdev_child[vdev]);
	}

	return (NULL);
	}

	vdev_t *
	vdev_lookup_by_guid(vdev_t *vd, uint64_t guid)
	{
	vdev_t *mvd;

	if (vd->vdev_guid == guid)
	return (vd);

	for (int c = 0; c < vd->vdev_children; c++)
	if ((mvd = vdev_lookup_by_guid(vd->vdev_child[c], guid)) !=
	NULL)
	return (mvd);

	return (NULL);
	}

	static int
	vdev_count_leaves_impl(vdev_t *vd)
	{
	int n = 0;

	if (vd->vdev_ops->vdev_op_leaf)
	return (1);

	for (int c = 0; c < vd->vdev_children; c++)
	n += vdev_count_leaves_impl(vd->vdev_child[c]);

	return (n);
	}

	int
	vdev_count_leaves(spa_t *spa)
	{
	int rc;

	spa_config_enter(spa, SCL_VDEV, FTAG, RW_READER);
	rc = vdev_count_leaves_impl(spa->spa_root_vdev);
	spa_config_exit(spa, SCL_VDEV, FTAG);

	return (rc);
	}

	void
	vdev_add_child(vdev_t pvd, vdev_t cvd)
	{
	size_t oldsize, newsize;
	uint64_t id = cvd->vdev_id;
	vdev_t **newchild;

	ASSERT(spa_config_held(cvd->vdev_spa, SCL_ALL, RW_WRITER) == SCL_ALL);
	ASSERT(cvd->vdev_parent == NULL);

	cvd->vdev_parent = pvd;

	if (pvd == NULL)
	return;

	ASSERT(id >= pvd->vdev_children \|\| pvd->vdev_child[id] == NULL);

	oldsize = pvd->vdev_children * sizeof (vdev_t *);
	pvd->vdev_children = MAX(pvd->vdev_children, id + 1);
	newsize = pvd->vdev_children * sizeof (vdev_t *);

	newchild = kmem_alloc(newsize, KM_SLEEP);
	if (pvd->vdev_child != NULL) {
	bcopy(pvd->vdev_child, newchild, oldsize);
	kmem_free(pvd->vdev_child, oldsize);
	}

	pvd->vdev_child = newchild;
	pvd->vdev_child[id] = cvd;

	cvd->vdev_top = (pvd->vdev_top ? pvd->vdev_top: cvd);
	ASSERT(cvd->vdev_top->vdev_parent->vdev_parent == NULL);

	/*
	* Walk up all ancestors to update guid sum.
	*/
	for (; pvd != NULL; pvd = pvd->vdev_parent)
	pvd->vdev_guid_sum += cvd->vdev_guid_sum;

	if (cvd->vdev_ops->vdev_op_leaf) {
	list_insert_head(&cvd->vdev_spa->spa_leaf_list, cvd);
	cvd->vdev_spa->spa_leaf_list_gen++;
	}
	}

	void
	vdev_remove_child(vdev_t pvd, vdev_t cvd)
	{
	int c;
	uint_t id = cvd->vdev_id;

	ASSERT(cvd->vdev_parent == pvd);

	if (pvd == NULL)
	return;

	ASSERT(id < pvd->vdev_children);
	ASSERT(pvd->vdev_child[id] == cvd);

	pvd->vdev_child[id] = NULL;
	cvd->vdev_parent = NULL;

	for (c = 0; c < pvd->vdev_children; c++)
	if (pvd->vdev_child[c])
	break;

	if (c == pvd->vdev_children) {
	kmem_free(pvd->vdev_child, c * sizeof (vdev_t *));
	pvd->vdev_child = NULL;
	pvd->vdev_children = 0;
	}

	if (cvd->vdev_ops->vdev_op_leaf) {
	spa_t *spa = cvd->vdev_spa;
	list_remove(&spa->spa_leaf_list, cvd);
	spa->spa_leaf_list_gen++;
	}

	/*
	* Walk up all ancestors to update guid sum.
	*/
	for (; pvd != NULL; pvd = pvd->vdev_parent)
	pvd->vdev_guid_sum -= cvd->vdev_guid_sum;
	}

	/*
	* Remove any holes in the child array.
	*/
	void
	vdev_compact_children(vdev_t *pvd)
	{
	vdev_t *newchild, cvd;
	int oldc = pvd->vdev_children;
	int newc;

	ASSERT(spa_config_held(pvd->vdev_spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	if (oldc == 0)
	return;

	for (int c = newc = 0; c < oldc; c++)
	if (pvd->vdev_child[c])
	newc++;

	if (newc > 0) {
	newchild = kmem_zalloc(newc * sizeof (vdev_t *), KM_SLEEP);

	for (int c = newc = 0; c < oldc; c++) {
	if ((cvd = pvd->vdev_child[c]) != NULL) {
	newchild[newc] = cvd;
	cvd->vdev_id = newc++;
	}
	}
	} else {
	newchild = NULL;
	}

	kmem_free(pvd->vdev_child, oldc * sizeof (vdev_t *));
	pvd->vdev_child = newchild;
	pvd->vdev_children = newc;
	}

	/*
	* Allocate and minimally initialize a vdev_t.
	*/
	vdev_t *
	vdev_alloc_common(spa_t spa, uint_t id, uint64_t guid, vdev_ops_t ops)
	{
	vdev_t *vd;
	vdev_indirect_config_t *vic;

	vd = kmem_zalloc(sizeof (vdev_t), KM_SLEEP);
	vic = &vd->vdev_indirect_config;

	if (spa->spa_root_vdev == NULL) {
	ASSERT(ops == &vdev_root_ops);
	spa->spa_root_vdev = vd;
	spa->spa_load_guid = spa_generate_guid(NULL);
	}

	if (guid == 0 && ops != &vdev_hole_ops) {
	if (spa->spa_root_vdev == vd) {
	/*
	* The root vdev's guid will also be the pool guid,
	* which must be unique among all pools.
	*/
	guid = spa_generate_guid(NULL);
	} else {
	/*
	* Any other vdev's guid must be unique within the pool.
	*/
	guid = spa_generate_guid(spa);
	}
	ASSERT(!spa_guid_exists(spa_guid(spa), guid));
	}

	vd->vdev_spa = spa;
	vd->vdev_id = id;
	vd->vdev_guid = guid;
	vd->vdev_guid_sum = guid;
	vd->vdev_ops = ops;
	vd->vdev_state = VDEV_STATE_CLOSED;
	vd->vdev_ishole = (ops == &vdev_hole_ops);
	vic->vic_prev_indirect_vdev = UINT64_MAX;

	rw_init(&vd->vdev_indirect_rwlock, NULL, RW_DEFAULT, NULL);
	mutex_init(&vd->vdev_obsolete_lock, NULL, MUTEX_DEFAULT, NULL);
	vd->vdev_obsolete_segments = range_tree_create(NULL, RANGE_SEG64, NULL,
	0, 0);

	/*
	* Initialize rate limit structs for events. We rate limit ZIO delay
	* and checksum events so that we don't overwhelm ZED with thousands
	* of events when a disk is acting up.
	*/
	zfs_ratelimit_init(&vd->vdev_delay_rl, &zfs_slow_io_events_per_second,
	1);
	zfs_ratelimit_init(&vd->vdev_checksum_rl,
	&zfs_checksum_events_per_second, 1);

	list_link_init(&vd->vdev_config_dirty_node);
	list_link_init(&vd->vdev_state_dirty_node);
	list_link_init(&vd->vdev_initialize_node);
	list_link_init(&vd->vdev_leaf_node);
	list_link_init(&vd->vdev_trim_node);
	mutex_init(&vd->vdev_dtl_lock, NULL, MUTEX_NOLOCKDEP, NULL);
	mutex_init(&vd->vdev_stat_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&vd->vdev_probe_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&vd->vdev_scan_io_queue_lock, NULL, MUTEX_DEFAULT, NULL);

	mutex_init(&vd->vdev_initialize_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&vd->vdev_initialize_io_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&vd->vdev_initialize_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&vd->vdev_initialize_io_cv, NULL, CV_DEFAULT, NULL);

	mutex_init(&vd->vdev_trim_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&vd->vdev_autotrim_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&vd->vdev_trim_io_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&vd->vdev_trim_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&vd->vdev_autotrim_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&vd->vdev_trim_io_cv, NULL, CV_DEFAULT, NULL);

	mutex_init(&vd->vdev_rebuild_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&vd->vdev_rebuild_io_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&vd->vdev_rebuild_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&vd->vdev_rebuild_io_cv, NULL, CV_DEFAULT, NULL);

	for (int t = 0; t < DTL_TYPES; t++) {
	vd->vdev_dtl[t] = range_tree_create(NULL, RANGE_SEG64, NULL, 0,
	0);
	}

	txg_list_create(&vd->vdev_ms_list, spa,
	offsetof(struct metaslab, ms_txg_node));
	txg_list_create(&vd->vdev_dtl_list, spa,
	offsetof(struct vdev, vdev_dtl_node));
	vd->vdev_stat.vs_timestamp = gethrtime();
	vdev_queue_init(vd);
	vdev_cache_init(vd);

	return (vd);
	}

	/*
	* Allocate a new vdev. The 'alloctype' is used to control whether we are
	* creating a new vdev or loading an existing one - the behavior is slightly
	* different for each case.
	*/
	int
	vdev_alloc(spa_t spa, vdev_t vdp, nvlist_t nv, vdev_t *parent, uint_t id,
	int alloctype)
	{
	vdev_ops_t *ops;
	char *type;
	uint64_t guid = 0, islog, nparity;
	vdev_t *vd;
	vdev_indirect_config_t *vic;
	char *tmp = NULL;
	int rc;
	vdev_alloc_bias_t alloc_bias = VDEV_BIAS_NONE;
	boolean_t top_level = (parent && !parent->vdev_parent);

	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_TYPE, &type) != 0)
	return (SET_ERROR(EINVAL));

	if ((ops = vdev_getops(type)) == NULL)
	return (SET_ERROR(EINVAL));

	/*
	* If this is a load, get the vdev guid from the nvlist.
	* Otherwise, vdev_alloc_common() will generate one for us.
	*/
	if (alloctype == VDEV_ALLOC_LOAD) {
	uint64_t label_id;

	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_ID, &label_id) \|\|
	label_id != id)
	return (SET_ERROR(EINVAL));

	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID, &guid) != 0)
	return (SET_ERROR(EINVAL));
	} else if (alloctype == VDEV_ALLOC_SPARE) {
	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID, &guid) != 0)
	return (SET_ERROR(EINVAL));
	} else if (alloctype == VDEV_ALLOC_L2CACHE) {
	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID, &guid) != 0)
	return (SET_ERROR(EINVAL));
	} else if (alloctype == VDEV_ALLOC_ROOTPOOL) {
	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_GUID, &guid) != 0)
	return (SET_ERROR(EINVAL));
	}

	/*
	* The first allocated vdev must be of type 'root'.
	*/
	if (ops != &vdev_root_ops && spa->spa_root_vdev == NULL)
	return (SET_ERROR(EINVAL));

	/*
	* Determine whether we're a log vdev.
	*/
	islog = 0;
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_IS_LOG, &islog);
	if (islog && spa_version(spa) < SPA_VERSION_SLOGS)
	return (SET_ERROR(ENOTSUP));

	if (ops == &vdev_hole_ops && spa_version(spa) < SPA_VERSION_HOLES)
	return (SET_ERROR(ENOTSUP));

	/*
	* Set the nparity property for RAID-Z vdevs.
	*/
	nparity = -1ULL;
	if (ops == &vdev_raidz_ops) {
	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_NPARITY,
	&nparity) == 0) {
	if (nparity == 0 \|\| nparity > VDEV_RAIDZ_MAXPARITY)
	return (SET_ERROR(EINVAL));
	/*
	* Previous versions could only support 1 or 2 parity
	* device.
	*/
	if (nparity > 1 &&
	spa_version(spa) < SPA_VERSION_RAIDZ2)
	return (SET_ERROR(ENOTSUP));
	if (nparity > 2 &&
	spa_version(spa) < SPA_VERSION_RAIDZ3)
	return (SET_ERROR(ENOTSUP));
	} else {
	/*
	* We require the parity to be specified for SPAs that
	* support multiple parity levels.
	*/
	if (spa_version(spa) >= SPA_VERSION_RAIDZ2)
	return (SET_ERROR(EINVAL));
	/*
	* Otherwise, we default to 1 parity device for RAID-Z.
	*/
	nparity = 1;
	}
	} else {
	nparity = 0;
	}
	ASSERT(nparity != -1ULL);

	/*
	* If creating a top-level vdev, check for allocation classes input
	*/
	if (top_level && alloctype == VDEV_ALLOC_ADD) {
	char *bias;

	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_ALLOCATION_BIAS,
	&bias) == 0) {
	alloc_bias = vdev_derive_alloc_bias(bias);

	/* spa_vdev_add() expects feature to be enabled */
	if (spa->spa_load_state != SPA_LOAD_CREATE &&
	!spa_feature_is_enabled(spa,
	SPA_FEATURE_ALLOCATION_CLASSES)) {
	return (SET_ERROR(ENOTSUP));
	}
	}
	}

	vd = vdev_alloc_common(spa, id, guid, ops);
	vic = &vd->vdev_indirect_config;

	vd->vdev_islog = islog;
	vd->vdev_nparity = nparity;
	if (top_level && alloc_bias != VDEV_BIAS_NONE)
	vd->vdev_alloc_bias = alloc_bias;

	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_PATH, &vd->vdev_path) == 0)
	vd->vdev_path = spa_strdup(vd->vdev_path);

	/*
	* ZPOOL_CONFIG_AUX_STATE = "external" means we previously forced a
	* fault on a vdev and want it to persist across imports (like with
	* zpool offline -f).
	*/
	rc = nvlist_lookup_string(nv, ZPOOL_CONFIG_AUX_STATE, &tmp);
	if (rc == 0 && tmp != NULL && strcmp(tmp, "external") == 0) {
	vd->vdev_stat.vs_aux = VDEV_AUX_EXTERNAL;
	vd->vdev_faulted = 1;
	vd->vdev_label_aux = VDEV_AUX_EXTERNAL;
	}

	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_DEVID, &vd->vdev_devid) == 0)
	vd->vdev_devid = spa_strdup(vd->vdev_devid);
	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_PHYS_PATH,
	&vd->vdev_physpath) == 0)
	vd->vdev_physpath = spa_strdup(vd->vdev_physpath);

	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_VDEV_ENC_SYSFS_PATH,
	&vd->vdev_enc_sysfs_path) == 0)
	vd->vdev_enc_sysfs_path = spa_strdup(vd->vdev_enc_sysfs_path);

	if (nvlist_lookup_string(nv, ZPOOL_CONFIG_FRU, &vd->vdev_fru) == 0)
	vd->vdev_fru = spa_strdup(vd->vdev_fru);

	/*
	* Set the whole_disk property. If it's not specified, leave the value
	* as -1.
	*/
	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_WHOLE_DISK,
	&vd->vdev_wholedisk) != 0)
	vd->vdev_wholedisk = -1ULL;

	ASSERT0(vic->vic_mapping_object);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_INDIRECT_OBJECT,
	&vic->vic_mapping_object);
	ASSERT0(vic->vic_births_object);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_INDIRECT_BIRTHS,
	&vic->vic_births_object);
	ASSERT3U(vic->vic_prev_indirect_vdev, ==, UINT64_MAX);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_PREV_INDIRECT_VDEV,
	&vic->vic_prev_indirect_vdev);

	/*
	* Look for the 'not present' flag. This will only be set if the device
	* was not present at the time of import.
	*/
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_NOT_PRESENT,
	&vd->vdev_not_present);

	/*
	* Get the alignment requirement.
	*/
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_ASHIFT, &vd->vdev_ashift);

	/*
	* Retrieve the vdev creation time.
	*/
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_CREATE_TXG,
	&vd->vdev_crtxg);

	/*
	* If we're a top-level vdev, try to load the allocation parameters.
	*/
	if (top_level &&
	(alloctype == VDEV_ALLOC_LOAD \|\| alloctype == VDEV_ALLOC_SPLIT)) {
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_METASLAB_ARRAY,
	&vd->vdev_ms_array);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_METASLAB_SHIFT,
	&vd->vdev_ms_shift);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_ASIZE,
	&vd->vdev_asize);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_REMOVING,
	&vd->vdev_removing);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_VDEV_TOP_ZAP,
	&vd->vdev_top_zap);
	} else {
	ASSERT0(vd->vdev_top_zap);
	}

	if (top_level && alloctype != VDEV_ALLOC_ATTACH) {
	ASSERT(alloctype == VDEV_ALLOC_LOAD \|\|
	alloctype == VDEV_ALLOC_ADD \|\|
	alloctype == VDEV_ALLOC_SPLIT \|\|
	alloctype == VDEV_ALLOC_ROOTPOOL);
	/* Note: metaslab_group_create() is now deferred */
	}

	if (vd->vdev_ops->vdev_op_leaf &&
	(alloctype == VDEV_ALLOC_LOAD \|\| alloctype == VDEV_ALLOC_SPLIT)) {
	(void) nvlist_lookup_uint64(nv,
	ZPOOL_CONFIG_VDEV_LEAF_ZAP, &vd->vdev_leaf_zap);
	} else {
	ASSERT0(vd->vdev_leaf_zap);
	}

	/*
	* If we're a leaf vdev, try to load the DTL object and other state.
	*/

	if (vd->vdev_ops->vdev_op_leaf &&
	(alloctype == VDEV_ALLOC_LOAD \|\| alloctype == VDEV_ALLOC_L2CACHE \|\|
	alloctype == VDEV_ALLOC_ROOTPOOL)) {
	if (alloctype == VDEV_ALLOC_LOAD) {
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_DTL,
	&vd->vdev_dtl_object);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_UNSPARE,
	&vd->vdev_unspare);
	}

	if (alloctype == VDEV_ALLOC_ROOTPOOL) {
	uint64_t spare = 0;

	if (nvlist_lookup_uint64(nv, ZPOOL_CONFIG_IS_SPARE,
	&spare) == 0 && spare)
	spa_spare_add(vd);
	}

	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_OFFLINE,
	&vd->vdev_offline);

	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_RESILVER_TXG,
	&vd->vdev_resilver_txg);

	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_REBUILD_TXG,
	&vd->vdev_rebuild_txg);

	if (nvlist_exists(nv, ZPOOL_CONFIG_RESILVER_DEFER))
	vdev_defer_resilver(vd);

	/*
	* In general, when importing a pool we want to ignore the
	* persistent fault state, as the diagnosis made on another
	* system may not be valid in the current context. The only
	* exception is if we forced a vdev to a persistently faulted
	* state with 'zpool offline -f'. The persistent fault will
	* remain across imports until cleared.
	*
	* Local vdevs will remain in the faulted state.
	*/
	if (spa_load_state(spa) == SPA_LOAD_OPEN \|\|
	spa_load_state(spa) == SPA_LOAD_IMPORT) {
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_FAULTED,
	&vd->vdev_faulted);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_DEGRADED,
	&vd->vdev_degraded);
	(void) nvlist_lookup_uint64(nv, ZPOOL_CONFIG_REMOVED,
	&vd->vdev_removed);

	if (vd->vdev_faulted \|\| vd->vdev_degraded) {
	char *aux;

	vd->vdev_label_aux =
	VDEV_AUX_ERR_EXCEEDED;
	if (nvlist_lookup_string(nv,
	ZPOOL_CONFIG_AUX_STATE, &aux) == 0 &&
	strcmp(aux, "external") == 0)
	vd->vdev_label_aux = VDEV_AUX_EXTERNAL;
	else
	vd->vdev_faulted = 0ULL;
	}
	}
	}

	/*
	* Add ourselves to the parent's list of children.
	*/
	vdev_add_child(parent, vd);

	*vdp = vd;

	return (0);
	}

	void
	vdev_free(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT3P(vd->vdev_initialize_thread, ==, NULL);
	ASSERT3P(vd->vdev_trim_thread, ==, NULL);
	ASSERT3P(vd->vdev_autotrim_thread, ==, NULL);
	ASSERT3P(vd->vdev_rebuild_thread, ==, NULL);

	/*
	* Scan queues are normally destroyed at the end of a scan. If the
	* queue exists here, that implies the vdev is being removed while
	* the scan is still running.
	*/
	if (vd->vdev_scan_io_queue != NULL) {
	mutex_enter(&vd->vdev_scan_io_queue_lock);
	dsl_scan_io_queue_destroy(vd->vdev_scan_io_queue);
	vd->vdev_scan_io_queue = NULL;
	mutex_exit(&vd->vdev_scan_io_queue_lock);
	}

	/*
	* vdev_free() implies closing the vdev first. This is simpler than
	* trying to ensure complicated semantics for all callers.
	*/
	vdev_close(vd);

	ASSERT(!list_link_active(&vd->vdev_config_dirty_node));
	ASSERT(!list_link_active(&vd->vdev_state_dirty_node));

	/*
	* Free all children.
	*/
	for (int c = 0; c < vd->vdev_children; c++)
	vdev_free(vd->vdev_child[c]);

	ASSERT(vd->vdev_child == NULL);
	ASSERT(vd->vdev_guid_sum == vd->vdev_guid);

	/*
	* Discard allocation state.
	*/
	if (vd->vdev_mg != NULL) {
	vdev_metaslab_fini(vd);
	metaslab_group_destroy(vd->vdev_mg);
	vd->vdev_mg = NULL;
	}

	ASSERT0(vd->vdev_stat.vs_space);
	ASSERT0(vd->vdev_stat.vs_dspace);
	ASSERT0(vd->vdev_stat.vs_alloc);

	/*
	* Remove this vdev from its parent's child list.
	*/
	vdev_remove_child(vd->vdev_parent, vd);

	ASSERT(vd->vdev_parent == NULL);
	ASSERT(!list_link_active(&vd->vdev_leaf_node));

	/*
	* Clean up vdev structure.
	*/
	vdev_queue_fini(vd);
	vdev_cache_fini(vd);

	if (vd->vdev_path)
	spa_strfree(vd->vdev_path);
	if (vd->vdev_devid)
	spa_strfree(vd->vdev_devid);
	if (vd->vdev_physpath)
	spa_strfree(vd->vdev_physpath);

	if (vd->vdev_enc_sysfs_path)
	spa_strfree(vd->vdev_enc_sysfs_path);

	if (vd->vdev_fru)
	spa_strfree(vd->vdev_fru);

	if (vd->vdev_isspare)
	spa_spare_remove(vd);
	if (vd->vdev_isl2cache)
	spa_l2cache_remove(vd);

	txg_list_destroy(&vd->vdev_ms_list);
	txg_list_destroy(&vd->vdev_dtl_list);

	mutex_enter(&vd->vdev_dtl_lock);
	space_map_close(vd->vdev_dtl_sm);
	for (int t = 0; t < DTL_TYPES; t++) {
	range_tree_vacate(vd->vdev_dtl[t], NULL, NULL);
	range_tree_destroy(vd->vdev_dtl[t]);
	}
	mutex_exit(&vd->vdev_dtl_lock);

	EQUIV(vd->vdev_indirect_births != NULL,
	vd->vdev_indirect_mapping != NULL);
	if (vd->vdev_indirect_births != NULL) {
	vdev_indirect_mapping_close(vd->vdev_indirect_mapping);
	vdev_indirect_births_close(vd->vdev_indirect_births);
	}

	if (vd->vdev_obsolete_sm != NULL) {
	ASSERT(vd->vdev_removing \|\|
	vd->vdev_ops == &vdev_indirect_ops);
	space_map_close(vd->vdev_obsolete_sm);
	vd->vdev_obsolete_sm = NULL;
	}
	range_tree_destroy(vd->vdev_obsolete_segments);
	rw_destroy(&vd->vdev_indirect_rwlock);
	mutex_destroy(&vd->vdev_obsolete_lock);

	mutex_destroy(&vd->vdev_dtl_lock);
	mutex_destroy(&vd->vdev_stat_lock);
	mutex_destroy(&vd->vdev_probe_lock);
	mutex_destroy(&vd->vdev_scan_io_queue_lock);

	mutex_destroy(&vd->vdev_initialize_lock);
	mutex_destroy(&vd->vdev_initialize_io_lock);
	cv_destroy(&vd->vdev_initialize_io_cv);
	cv_destroy(&vd->vdev_initialize_cv);

	mutex_destroy(&vd->vdev_trim_lock);
	mutex_destroy(&vd->vdev_autotrim_lock);
	mutex_destroy(&vd->vdev_trim_io_lock);
	cv_destroy(&vd->vdev_trim_cv);
	cv_destroy(&vd->vdev_autotrim_cv);
	cv_destroy(&vd->vdev_trim_io_cv);

	mutex_destroy(&vd->vdev_rebuild_lock);
	mutex_destroy(&vd->vdev_rebuild_io_lock);
	cv_destroy(&vd->vdev_rebuild_cv);
	cv_destroy(&vd->vdev_rebuild_io_cv);

	zfs_ratelimit_fini(&vd->vdev_delay_rl);
	zfs_ratelimit_fini(&vd->vdev_checksum_rl);

	if (vd == spa->spa_root_vdev)
	spa->spa_root_vdev = NULL;

	kmem_free(vd, sizeof (vdev_t));
	}

	/*
	* Transfer top-level vdev state from svd to tvd.
	*/
	static void
	vdev_top_transfer(vdev_t svd, vdev_t tvd)
	{
	spa_t *spa = svd->vdev_spa;
	metaslab_t *msp;
	vdev_t *vd;
	int t;

	ASSERT(tvd == tvd->vdev_top);

	tvd->vdev_pending_fastwrite = svd->vdev_pending_fastwrite;
	tvd->vdev_ms_array = svd->vdev_ms_array;
	tvd->vdev_ms_shift = svd->vdev_ms_shift;
	tvd->vdev_ms_count = svd->vdev_ms_count;
	tvd->vdev_top_zap = svd->vdev_top_zap;

	svd->vdev_ms_array = 0;
	svd->vdev_ms_shift = 0;
	svd->vdev_ms_count = 0;
	svd->vdev_top_zap = 0;

	if (tvd->vdev_mg)
	ASSERT3P(tvd->vdev_mg, ==, svd->vdev_mg);
	tvd->vdev_mg = svd->vdev_mg;
	tvd->vdev_ms = svd->vdev_ms;

	svd->vdev_mg = NULL;
	svd->vdev_ms = NULL;

	if (tvd->vdev_mg != NULL)
	tvd->vdev_mg->mg_vd = tvd;

	tvd->vdev_checkpoint_sm = svd->vdev_checkpoint_sm;
	svd->vdev_checkpoint_sm = NULL;

	tvd->vdev_alloc_bias = svd->vdev_alloc_bias;
	svd->vdev_alloc_bias = VDEV_BIAS_NONE;

	tvd->vdev_stat.vs_alloc = svd->vdev_stat.vs_alloc;
	tvd->vdev_stat.vs_space = svd->vdev_stat.vs_space;
	tvd->vdev_stat.vs_dspace = svd->vdev_stat.vs_dspace;

	svd->vdev_stat.vs_alloc = 0;
	svd->vdev_stat.vs_space = 0;
	svd->vdev_stat.vs_dspace = 0;

	/*
	* State which may be set on a top-level vdev that's in the
	* process of being removed.
	*/
	ASSERT0(tvd->vdev_indirect_config.vic_births_object);
	ASSERT0(tvd->vdev_indirect_config.vic_mapping_object);
	ASSERT3U(tvd->vdev_indirect_config.vic_prev_indirect_vdev, ==, -1ULL);
	ASSERT3P(tvd->vdev_indirect_mapping, ==, NULL);
	ASSERT3P(tvd->vdev_indirect_births, ==, NULL);
	ASSERT3P(tvd->vdev_obsolete_sm, ==, NULL);
	ASSERT0(tvd->vdev_removing);
	ASSERT0(tvd->vdev_rebuilding);
	tvd->vdev_removing = svd->vdev_removing;
	tvd->vdev_rebuilding = svd->vdev_rebuilding;
	tvd->vdev_rebuild_config = svd->vdev_rebuild_config;
	tvd->vdev_indirect_config = svd->vdev_indirect_config;
	tvd->vdev_indirect_mapping = svd->vdev_indirect_mapping;
	tvd->vdev_indirect_births = svd->vdev_indirect_births;
	range_tree_swap(&svd->vdev_obsolete_segments,
	&tvd->vdev_obsolete_segments);
	tvd->vdev_obsolete_sm = svd->vdev_obsolete_sm;
	svd->vdev_indirect_config.vic_mapping_object = 0;
	svd->vdev_indirect_config.vic_births_object = 0;
	svd->vdev_indirect_config.vic_prev_indirect_vdev = -1ULL;
	svd->vdev_indirect_mapping = NULL;
	svd->vdev_indirect_births = NULL;
	svd->vdev_obsolete_sm = NULL;
	svd->vdev_removing = 0;
	svd->vdev_rebuilding = 0;

	for (t = 0; t < TXG_SIZE; t++) {
	while ((msp = txg_list_remove(&svd->vdev_ms_list, t)) != NULL)
	(void) txg_list_add(&tvd->vdev_ms_list, msp, t);
	while ((vd = txg_list_remove(&svd->vdev_dtl_list, t)) != NULL)
	(void) txg_list_add(&tvd->vdev_dtl_list, vd, t);
	if (txg_list_remove_this(&spa->spa_vdev_txg_list, svd, t))
	(void) txg_list_add(&spa->spa_vdev_txg_list, tvd, t);
	}

	if (list_link_active(&svd->vdev_config_dirty_node)) {
	vdev_config_clean(svd);
	vdev_config_dirty(tvd);
	}

	if (list_link_active(&svd->vdev_state_dirty_node)) {
	vdev_state_clean(svd);
	vdev_state_dirty(tvd);
	}

	tvd->vdev_deflate_ratio = svd->vdev_deflate_ratio;
	svd->vdev_deflate_ratio = 0;

	tvd->vdev_islog = svd->vdev_islog;
	svd->vdev_islog = 0;

	dsl_scan_io_queue_vdev_xfer(svd, tvd);
	}

	static void
	vdev_top_update(vdev_t tvd, vdev_t vd)
	{
	if (vd == NULL)
	return;

	vd->vdev_top = tvd;

	for (int c = 0; c < vd->vdev_children; c++)
	vdev_top_update(tvd, vd->vdev_child[c]);
	}

	/*
	* Add a mirror/replacing vdev above an existing vdev.
	*/
	vdev_t *
	vdev_add_parent(vdev_t cvd, vdev_ops_t ops)
	{
	spa_t *spa = cvd->vdev_spa;
	vdev_t *pvd = cvd->vdev_parent;
	vdev_t *mvd;

	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	mvd = vdev_alloc_common(spa, cvd->vdev_id, 0, ops);

	mvd->vdev_asize = cvd->vdev_asize;
	mvd->vdev_min_asize = cvd->vdev_min_asize;
	mvd->vdev_max_asize = cvd->vdev_max_asize;
	mvd->vdev_psize = cvd->vdev_psize;
	mvd->vdev_ashift = cvd->vdev_ashift;
	mvd->vdev_logical_ashift = cvd->vdev_logical_ashift;
	mvd->vdev_physical_ashift = cvd->vdev_physical_ashift;
	mvd->vdev_state = cvd->vdev_state;
	mvd->vdev_crtxg = cvd->vdev_crtxg;

	vdev_remove_child(pvd, cvd);
	vdev_add_child(pvd, mvd);
	cvd->vdev_id = mvd->vdev_children;
	vdev_add_child(mvd, cvd);
	vdev_top_update(cvd->vdev_top, cvd->vdev_top);

	if (mvd == mvd->vdev_top)
	vdev_top_transfer(cvd, mvd);

	return (mvd);
	}

	/*
	* Remove a 1-way mirror/replacing vdev from the tree.
	*/
	void
	vdev_remove_parent(vdev_t *cvd)
	{
	vdev_t *mvd = cvd->vdev_parent;
	vdev_t *pvd = mvd->vdev_parent;

	ASSERT(spa_config_held(cvd->vdev_spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	ASSERT(mvd->vdev_children == 1);
	ASSERT(mvd->vdev_ops == &vdev_mirror_ops \|\|
	mvd->vdev_ops == &vdev_replacing_ops \|\|
	mvd->vdev_ops == &vdev_spare_ops);
	cvd->vdev_ashift = mvd->vdev_ashift;
	cvd->vdev_logical_ashift = mvd->vdev_logical_ashift;
	cvd->vdev_physical_ashift = mvd->vdev_physical_ashift;
	vdev_remove_child(mvd, cvd);
	vdev_remove_child(pvd, mvd);

	/*
	* If cvd will replace mvd as a top-level vdev, preserve mvd's guid.
	* Otherwise, we could have detached an offline device, and when we
	* go to import the pool we'll think we have two top-level vdevs,
	* instead of a different version of the same top-level vdev.
	*/
	if (mvd->vdev_top == mvd) {
	uint64_t guid_delta = mvd->vdev_guid - cvd->vdev_guid;
	cvd->vdev_orig_guid = cvd->vdev_guid;
	cvd->vdev_guid += guid_delta;
	cvd->vdev_guid_sum += guid_delta;

	/*
	* If pool not set for autoexpand, we need to also preserve
	* mvd's asize to prevent automatic expansion of cvd.
	* Otherwise if we are adjusting the mirror by attaching and
	* detaching children of non-uniform sizes, the mirror could
	* autoexpand, unexpectedly requiring larger devices to
	* re-establish the mirror.
	*/
	if (!cvd->vdev_spa->spa_autoexpand)
	cvd->vdev_asize = mvd->vdev_asize;
	}
	cvd->vdev_id = mvd->vdev_id;
	vdev_add_child(pvd, cvd);
	vdev_top_update(cvd->vdev_top, cvd->vdev_top);

	if (cvd == cvd->vdev_top)
	vdev_top_transfer(mvd, cvd);

	ASSERT(mvd->vdev_children == 0);
	vdev_free(mvd);
	}

	static void
	vdev_metaslab_group_create(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	/*
	* metaslab_group_create was delayed until allocation bias was available
	*/
	if (vd->vdev_mg == NULL) {
	metaslab_class_t *mc;

	if (vd->vdev_islog && vd->vdev_alloc_bias == VDEV_BIAS_NONE)
	vd->vdev_alloc_bias = VDEV_BIAS_LOG;

	ASSERT3U(vd->vdev_islog, ==,
	(vd->vdev_alloc_bias == VDEV_BIAS_LOG));

	switch (vd->vdev_alloc_bias) {
	case VDEV_BIAS_LOG:
	mc = spa_log_class(spa);
	break;
	case VDEV_BIAS_SPECIAL:
	mc = spa_special_class(spa);
	break;
	case VDEV_BIAS_DEDUP:
	mc = spa_dedup_class(spa);
	break;
	default:
	mc = spa_normal_class(spa);
	}

	vd->vdev_mg = metaslab_group_create(mc, vd,
	spa->spa_alloc_count);

	/*
	* The spa ashift values currently only reflect the
	* general vdev classes. Class destination is late
	* binding so ashift checking had to wait until now
	*/
	if (vd->vdev_top == vd && vd->vdev_ashift != 0 &&
	mc == spa_normal_class(spa) && vd->vdev_aux == NULL) {
	if (vd->vdev_ashift > spa->spa_max_ashift)
	spa->spa_max_ashift = vd->vdev_ashift;
	if (vd->vdev_ashift < spa->spa_min_ashift)
	spa->spa_min_ashift = vd->vdev_ashift;
	}
	}
	}

	int
	vdev_metaslab_init(vdev_t *vd, uint64_t txg)
	{
	spa_t *spa = vd->vdev_spa;
	objset_t *mos = spa->spa_meta_objset;
	uint64_t m;
	uint64_t oldc = vd->vdev_ms_count;
	uint64_t newc = vd->vdev_asize >> vd->vdev_ms_shift;
	metaslab_t **mspp;
	int error;
	boolean_t expanding = (oldc != 0);

	ASSERT(txg == 0 \|\| spa_config_held(spa, SCL_ALLOC, RW_WRITER));

	/*
	* This vdev is not being allocated from yet or is a hole.
	*/
	if (vd->vdev_ms_shift == 0)
	return (0);

	ASSERT(!vd->vdev_ishole);

	ASSERT(oldc <= newc);

	mspp = vmem_zalloc(newc * sizeof (*mspp), KM_SLEEP);

	if (expanding) {
	bcopy(vd->vdev_ms, mspp, oldc * sizeof (*mspp));
	vmem_free(vd->vdev_ms, oldc * sizeof (*mspp));
	}

	vd->vdev_ms = mspp;
	vd->vdev_ms_count = newc;
	for (m = oldc; m < newc; m++) {
	uint64_t object = 0;

	/*
	* vdev_ms_array may be 0 if we are creating the "fake"
	* metaslabs for an indirect vdev for zdb's leak detection.
	* See zdb_leak_init().
	*/
	if (txg == 0 && vd->vdev_ms_array != 0) {
	error = dmu_read(mos, vd->vdev_ms_array,
	m * sizeof (uint64_t), sizeof (uint64_t), &object,
	DMU_READ_PREFETCH);
	if (error != 0) {
	vdev_dbgmsg(vd, "unable to read the metaslab "
	"array [error=%d]", error);
	return (error);
	}
	}

	#ifndef _KERNEL
	/*
	* To accommodate zdb_leak_init() fake indirect
	* metaslabs, we allocate a metaslab group for
	* indirect vdevs which normally don't have one.
	*/
	if (vd->vdev_mg == NULL) {
	ASSERT0(vdev_is_concrete(vd));
	vdev_metaslab_group_create(vd);
	}
	#endif
	error = metaslab_init(vd->vdev_mg, m, object, txg,
	&(vd->vdev_ms[m]));
	if (error != 0) {
	vdev_dbgmsg(vd, "metaslab_init failed [error=%d]",
	error);
	return (error);
	}
	}

	if (txg == 0)
	spa_config_enter(spa, SCL_ALLOC, FTAG, RW_WRITER);

	/*
	* If the vdev is being removed we don't activate
	* the metaslabs since we want to ensure that no new
	* allocations are performed on this device.
	*/
	if (!expanding && !vd->vdev_removing) {
	metaslab_group_activate(vd->vdev_mg);
	}

	if (txg == 0)
	spa_config_exit(spa, SCL_ALLOC, FTAG);

	/*
	* Regardless whether this vdev was just added or it is being
	* expanded, the metaslab count has changed. Recalculate the
	* block limit.
	*/
	spa_log_sm_set_blocklimit(spa);

	return (0);
	}

	void
	vdev_metaslab_fini(vdev_t *vd)
	{
	if (vd->vdev_checkpoint_sm != NULL) {
	ASSERT(spa_feature_is_active(vd->vdev_spa,
	SPA_FEATURE_POOL_CHECKPOINT));
	space_map_close(vd->vdev_checkpoint_sm);
	/*
	* Even though we close the space map, we need to set its
	* pointer to NULL. The reason is that vdev_metaslab_fini()
	* may be called multiple times for certain operations
	* (i.e. when destroying a pool) so we need to ensure that
	* this clause never executes twice. This logic is similar
	* to the one used for the vdev_ms clause below.
	*/
	vd->vdev_checkpoint_sm = NULL;
	}

	if (vd->vdev_ms != NULL) {
	metaslab_group_t *mg = vd->vdev_mg;
	metaslab_group_passivate(mg);

	uint64_t count = vd->vdev_ms_count;
	for (uint64_t m = 0; m < count; m++) {
	metaslab_t *msp = vd->vdev_ms[m];
	if (msp != NULL)
	metaslab_fini(msp);
	}
	vmem_free(vd->vdev_ms, count * sizeof (metaslab_t *));
	vd->vdev_ms = NULL;

	vd->vdev_ms_count = 0;

	for (int i = 0; i < RANGE_TREE_HISTOGRAM_SIZE; i++)
	ASSERT0(mg->mg_histogram[i]);
	}
	ASSERT0(vd->vdev_ms_count);
	ASSERT3U(vd->vdev_pending_fastwrite, ==, 0);
	}

	typedef struct vdev_probe_stats {
	boolean_t vps_readable;
	boolean_t vps_writeable;
	int vps_flags;
	} vdev_probe_stats_t;

	static void
	vdev_probe_done(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	vdev_t *vd = zio->io_vd;
	vdev_probe_stats_t *vps = zio->io_private;

	ASSERT(vd->vdev_probe_zio != NULL);

	if (zio->io_type == ZIO_TYPE_READ) {
	if (zio->io_error == 0)
	vps->vps_readable = 1;
	if (zio->io_error == 0 && spa_writeable(spa)) {
	zio_nowait(zio_write_phys(vd->vdev_probe_zio, vd,
	zio->io_offset, zio->io_size, zio->io_abd,
	ZIO_CHECKSUM_OFF, vdev_probe_done, vps,
	ZIO_PRIORITY_SYNC_WRITE, vps->vps_flags, B_TRUE));
	} else {
	abd_free(zio->io_abd);
	}
	} else if (zio->io_type == ZIO_TYPE_WRITE) {
	if (zio->io_error == 0)
	vps->vps_writeable = 1;
	abd_free(zio->io_abd);
	} else if (zio->io_type == ZIO_TYPE_NULL) {
	zio_t *pio;
	zio_link_t *zl;

	vd->vdev_cant_read \|= !vps->vps_readable;
	vd->vdev_cant_write \|= !vps->vps_writeable;

	if (vdev_readable(vd) &&
	(vdev_writeable(vd) \|\| !spa_writeable(spa))) {
	zio->io_error = 0;
	} else {
	ASSERT(zio->io_error != 0);
	vdev_dbgmsg(vd, "failed probe");
	(void) zfs_ereport_post(FM_EREPORT_ZFS_PROBE_FAILURE,
	- spa, vd, NULL, NULL, 0, 0);
	+ spa, vd, NULL, NULL, 0);
	zio->io_error = SET_ERROR(ENXIO);
	}

	mutex_enter(&vd->vdev_probe_lock);
	ASSERT(vd->vdev_probe_zio == zio);
	vd->vdev_probe_zio = NULL;
	mutex_exit(&vd->vdev_probe_lock);

	zl = NULL;
	while ((pio = zio_walk_parents(zio, &zl)) != NULL)
	if (!vdev_accessible(vd, pio))
	pio->io_error = SET_ERROR(ENXIO);

	kmem_free(vps, sizeof (*vps));
	}
	}

	/*
	* Determine whether this device is accessible.
	*
	* Read and write to several known locations: the pad regions of each
	* vdev label but the first, which we leave alone in case it contains
	* a VTOC.
	*/
	zio_t *
	vdev_probe(vdev_t vd, zio_t zio)
	{
	spa_t *spa = vd->vdev_spa;
	vdev_probe_stats_t *vps = NULL;
	zio_t *pio;

	ASSERT(vd->vdev_ops->vdev_op_leaf);

	/*
	* Don't probe the probe.
	*/
	if (zio && (zio->io_flags & ZIO_FLAG_PROBE))
	return (NULL);

	/*
	* To prevent 'probe storms' when a device fails, we create
	* just one probe i/o at a time. All zios that want to probe
	* this vdev will become parents of the probe io.
	*/
	mutex_enter(&vd->vdev_probe_lock);

	if ((pio = vd->vdev_probe_zio) == NULL) {
	vps = kmem_zalloc(sizeof (*vps), KM_SLEEP);

	vps->vps_flags = ZIO_FLAG_CANFAIL \| ZIO_FLAG_PROBE \|
	ZIO_FLAG_DONT_CACHE \| ZIO_FLAG_DONT_AGGREGATE \|
	ZIO_FLAG_TRYHARD;

	if (spa_config_held(spa, SCL_ZIO, RW_WRITER)) {
	/*
	* vdev_cant_read and vdev_cant_write can only
	* transition from TRUE to FALSE when we have the
	* SCL_ZIO lock as writer; otherwise they can only
	* transition from FALSE to TRUE. This ensures that
	* any zio looking at these values can assume that
	* failures persist for the life of the I/O. That's
	* important because when a device has intermittent
	* connectivity problems, we want to ensure that
	* they're ascribed to the device (ENXIO) and not
	* the zio (EIO).
	*
	* Since we hold SCL_ZIO as writer here, clear both
	* values so the probe can reevaluate from first
	* principles.
	*/
	vps->vps_flags \|= ZIO_FLAG_CONFIG_WRITER;
	vd->vdev_cant_read = B_FALSE;
	vd->vdev_cant_write = B_FALSE;
	}

	vd->vdev_probe_zio = pio = zio_null(NULL, spa, vd,
	vdev_probe_done, vps,
	vps->vps_flags \| ZIO_FLAG_DONT_PROPAGATE);

	/*
	* We can't change the vdev state in this context, so we
	* kick off an async task to do it on our behalf.
	*/
	if (zio != NULL) {
	vd->vdev_probe_wanted = B_TRUE;
	spa_async_request(spa, SPA_ASYNC_PROBE);
	}
	}

	if (zio != NULL)
	zio_add_child(zio, pio);

	mutex_exit(&vd->vdev_probe_lock);

	if (vps == NULL) {
	ASSERT(zio != NULL);
	return (NULL);
	}

	for (int l = 1; l < VDEV_LABELS; l++) {
	zio_nowait(zio_read_phys(pio, vd,
	vdev_label_offset(vd->vdev_psize, l,
	offsetof(vdev_label_t, vl_be)), VDEV_PAD_SIZE,
	abd_alloc_for_io(VDEV_PAD_SIZE, B_TRUE),
	ZIO_CHECKSUM_OFF, vdev_probe_done, vps,
	ZIO_PRIORITY_SYNC_READ, vps->vps_flags, B_TRUE));
	}

	if (zio == NULL)
	return (pio);

	zio_nowait(pio);
	return (NULL);
	}

	static void
	vdev_open_child(void *arg)
	{
	vdev_t *vd = arg;

	vd->vdev_open_thread = curthread;
	vd->vdev_open_error = vdev_open(vd);
	vd->vdev_open_thread = NULL;
	}

	static boolean_t
	vdev_uses_zvols(vdev_t *vd)
	{
	#ifdef _KERNEL
	if (zvol_is_zvol(vd->vdev_path))
	return (B_TRUE);
	#endif

	for (int c = 0; c < vd->vdev_children; c++)
	if (vdev_uses_zvols(vd->vdev_child[c]))
	return (B_TRUE);

	return (B_FALSE);
	}

	void
	vdev_open_children(vdev_t *vd)
	{
	taskq_t *tq;
	int children = vd->vdev_children;

	/*
	* in order to handle pools on top of zvols, do the opens
	* in a single thread so that the same thread holds the
	* spa_namespace_lock
	*/
	if (vdev_uses_zvols(vd)) {
	retry_sync:
	for (int c = 0; c < children; c++)
	vd->vdev_child[c]->vdev_open_error =
	vdev_open(vd->vdev_child[c]);
	} else {
	tq = taskq_create("vdev_open", children, minclsyspri,
	children, children, TASKQ_PREPOPULATE);
	if (tq == NULL)
	goto retry_sync;

	for (int c = 0; c < children; c++)
	VERIFY(taskq_dispatch(tq, vdev_open_child,
	vd->vdev_child[c], TQ_SLEEP) != TASKQID_INVALID);

	taskq_destroy(tq);
	}

	vd->vdev_nonrot = B_TRUE;

	for (int c = 0; c < children; c++)
	vd->vdev_nonrot &= vd->vdev_child[c]->vdev_nonrot;
	}

	/*
	* Compute the raidz-deflation ratio. Note, we hard-code
	* in 128k (1 << 17) because it is the "typical" blocksize.
	* Even though SPA_MAXBLOCKSIZE changed, this algorithm can not change,
	* otherwise it would inconsistently account for existing bp's.
	*/
	static void
	vdev_set_deflate_ratio(vdev_t *vd)
	{
	if (vd == vd->vdev_top && !vd->vdev_ishole && vd->vdev_ashift != 0) {
	vd->vdev_deflate_ratio = (1 << 17) /
	(vdev_psize_to_asize(vd, 1 << 17) >> SPA_MINBLOCKSHIFT);
	}
	}

	/*
	+ * Maximize performance by inflating the configured ashift for top level
	+ * vdevs to be as close to the physical ashift as possible while maintaining
	+ * administrator defined limits and ensuring it doesn't go below the
	+ * logical ashift.
	+ */
	+static void
	+vdev_ashift_optimize(vdev_t *vd)
	+{
	+ ASSERT(vd == vd->vdev_top);
	+
	+ if (vd->vdev_ashift < vd->vdev_physical_ashift) {
	+ vd->vdev_ashift = MIN(
	+ MAX(zfs_vdev_max_auto_ashift, vd->vdev_ashift),
	+ MAX(zfs_vdev_min_auto_ashift,
	+ vd->vdev_physical_ashift));
	+ } else {
	+ /*
	+ * If the logical and physical ashifts are the same, then
	+ * we ensure that the top-level vdev's ashift is not smaller
	+ * than our minimum ashift value. For the unusual case
	+ * where logical ashift > physical ashift, we can't cap
	+ * the calculated ashift based on max ashift as that
	+ * would cause failures.
	+ * We still check if we need to increase it to match
	+ * the min ashift.
	+ */
	+ vd->vdev_ashift = MAX(zfs_vdev_min_auto_ashift,
	+ vd->vdev_ashift);
	+ }
	+}
	+
	+/*
	* Prepare a virtual device for access.
	*/
	int
	vdev_open(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;
	int error;
	uint64_t osize = 0;
	uint64_t max_osize = 0;
	uint64_t asize, max_asize, psize;
	uint64_t logical_ashift = 0;
	uint64_t physical_ashift = 0;

	ASSERT(vd->vdev_open_thread == curthread \|\|
	spa_config_held(spa, SCL_STATE_ALL, RW_WRITER) == SCL_STATE_ALL);
	ASSERT(vd->vdev_state == VDEV_STATE_CLOSED \|\|
	vd->vdev_state == VDEV_STATE_CANT_OPEN \|\|
	vd->vdev_state == VDEV_STATE_OFFLINE);

	vd->vdev_stat.vs_aux = VDEV_AUX_NONE;
	vd->vdev_cant_read = B_FALSE;
	vd->vdev_cant_write = B_FALSE;
	vd->vdev_min_asize = vdev_get_min_asize(vd);

	/*
	* If this vdev is not removed, check its fault status. If it's
	* faulted, bail out of the open.
	*/
	if (!vd->vdev_removed && vd->vdev_faulted) {
	ASSERT(vd->vdev_children == 0);
	ASSERT(vd->vdev_label_aux == VDEV_AUX_ERR_EXCEEDED \|\|
	vd->vdev_label_aux == VDEV_AUX_EXTERNAL);
	vdev_set_state(vd, B_TRUE, VDEV_STATE_FAULTED,
	vd->vdev_label_aux);
	return (SET_ERROR(ENXIO));
	} else if (vd->vdev_offline) {
	ASSERT(vd->vdev_children == 0);
	vdev_set_state(vd, B_TRUE, VDEV_STATE_OFFLINE, VDEV_AUX_NONE);
	return (SET_ERROR(ENXIO));
	}

	error = vd->vdev_ops->vdev_op_open(vd, &osize, &max_osize,
	&logical_ashift, &physical_ashift);
	/*
	* Physical volume size should never be larger than its max size, unless
	* the disk has shrunk while we were reading it or the device is buggy
	* or damaged: either way it's not safe for use, bail out of the open.
	*/
	if (osize > max_osize) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_OPEN_FAILED);
	return (SET_ERROR(ENXIO));
	}

	/*
	* Reset the vdev_reopening flag so that we actually close
	* the vdev on error.
	*/
	vd->vdev_reopening = B_FALSE;
	if (zio_injection_enabled && error == 0)
	error = zio_handle_device_injection(vd, NULL, SET_ERROR(ENXIO));

	if (error) {
	if (vd->vdev_removed &&
	vd->vdev_stat.vs_aux != VDEV_AUX_OPEN_FAILED)
	vd->vdev_removed = B_FALSE;

	if (vd->vdev_stat.vs_aux == VDEV_AUX_CHILDREN_OFFLINE) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_OFFLINE,
	vd->vdev_stat.vs_aux);
	} else {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	vd->vdev_stat.vs_aux);
	}
	return (error);
	}

	vd->vdev_removed = B_FALSE;

	/*
	* Recheck the faulted flag now that we have confirmed that
	* the vdev is accessible. If we're faulted, bail.
	*/
	if (vd->vdev_faulted) {
	ASSERT(vd->vdev_children == 0);
	ASSERT(vd->vdev_label_aux == VDEV_AUX_ERR_EXCEEDED \|\|
	vd->vdev_label_aux == VDEV_AUX_EXTERNAL);
	vdev_set_state(vd, B_TRUE, VDEV_STATE_FAULTED,
	vd->vdev_label_aux);
	return (SET_ERROR(ENXIO));
	}

	if (vd->vdev_degraded) {
	ASSERT(vd->vdev_children == 0);
	vdev_set_state(vd, B_TRUE, VDEV_STATE_DEGRADED,
	VDEV_AUX_ERR_EXCEEDED);
	} else {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_HEALTHY, 0);
	}

	/*
	* For hole or missing vdevs we just return success.
	*/
	if (vd->vdev_ishole \|\| vd->vdev_ops == &vdev_missing_ops)
	return (0);

	for (int c = 0; c < vd->vdev_children; c++) {
	if (vd->vdev_child[c]->vdev_state != VDEV_STATE_HEALTHY) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_DEGRADED,
	VDEV_AUX_NONE);
	break;
	}
	}

	osize = P2ALIGN(osize, (uint64_t)sizeof (vdev_label_t));
	max_osize = P2ALIGN(max_osize, (uint64_t)sizeof (vdev_label_t));

	if (vd->vdev_children == 0) {
	if (osize < SPA_MINDEVSIZE) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_TOO_SMALL);
	return (SET_ERROR(EOVERFLOW));
	}
	psize = osize;
	asize = osize - (VDEV_LABEL_START_SIZE + VDEV_LABEL_END_SIZE);
	max_asize = max_osize - (VDEV_LABEL_START_SIZE +
	VDEV_LABEL_END_SIZE);
	} else {
	if (vd->vdev_parent != NULL && osize < SPA_MINDEVSIZE -
	(VDEV_LABEL_START_SIZE + VDEV_LABEL_END_SIZE)) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_TOO_SMALL);
	return (SET_ERROR(EOVERFLOW));
	}
	psize = 0;
	asize = osize;
	max_asize = max_osize;
	}

	/*
	* If the vdev was expanded, record this so that we can re-create the
	* uberblock rings in labels {2,3}, during the next sync.
	*/
	if ((psize > vd->vdev_psize) && (vd->vdev_psize != 0))
	vd->vdev_copy_uberblocks = B_TRUE;

	vd->vdev_psize = psize;

	/*
	* Make sure the allocatable size hasn't shrunk too much.
	*/
	if (asize < vd->vdev_min_asize) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_BAD_LABEL);
	return (SET_ERROR(EINVAL));
	}

	+ /*
	+ * We can always set the logical/physical ashift members since
	+ * their values are only used to calculate the vdev_ashift when
	+ * the device is first added to the config. These values should
	+ * not be used for anything else since they may change whenever
	+ * the device is reopened and we don't store them in the label.
	+ */
	vd->vdev_physical_ashift =
	MAX(physical_ashift, vd->vdev_physical_ashift);
	- vd->vdev_logical_ashift = MAX(logical_ashift, vd->vdev_logical_ashift);
	- vd->vdev_ashift = MAX(vd->vdev_logical_ashift, vd->vdev_ashift);
	+ vd->vdev_logical_ashift = MAX(logical_ashift,
	+ vd->vdev_logical_ashift);

	- if (vd->vdev_logical_ashift > ASHIFT_MAX) {
	- vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	- VDEV_AUX_ASHIFT_TOO_BIG);
	- return (SET_ERROR(EDOM));
	- }
	-
	if (vd->vdev_asize == 0) {
	/*
	* This is the first-ever open, so use the computed values.
	* For compatibility, a different ashift can be requested.
	*/
	vd->vdev_asize = asize;
	vd->vdev_max_asize = max_asize;
	+
	+ /*
	+ * If the vdev_ashift was not overriden at creation time,
	+ * then set it the logical ashift and optimize the ashift.
	+ */
	+ if (vd->vdev_ashift == 0) {
	+ vd->vdev_ashift = vd->vdev_logical_ashift;
	+
	+ if (vd->vdev_logical_ashift > ASHIFT_MAX) {
	+ vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	+ VDEV_AUX_ASHIFT_TOO_BIG);
	+ return (SET_ERROR(EDOM));
	+ }
	+
	+ if (vd->vdev_top == vd) {
	+ vdev_ashift_optimize(vd);
	+ }
	+ }
	if (vd->vdev_ashift != 0 && (vd->vdev_ashift < ASHIFT_MIN \|\|
	vd->vdev_ashift > ASHIFT_MAX)) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_BAD_ASHIFT);
	return (SET_ERROR(EDOM));
	}
	} else {
	/*
	* Make sure the alignment required hasn't increased.
	*/
	if (vd->vdev_ashift > vd->vdev_top->vdev_ashift &&
	vd->vdev_ops->vdev_op_leaf) {
	(void) zfs_ereport_post(
	FM_EREPORT_ZFS_DEVICE_BAD_ASHIFT,
	- spa, vd, NULL, NULL, 0, 0);
	+ spa, vd, NULL, NULL, 0);
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_BAD_LABEL);
	return (SET_ERROR(EDOM));
	-
	}
	vd->vdev_max_asize = max_asize;
	}

	/*
	* If all children are healthy we update asize if either:
	* The asize has increased, due to a device expansion caused by dynamic
	* LUN growth or vdev replacement, and automatic expansion is enabled;
	* making the additional space available.
	*
	* The asize has decreased, due to a device shrink usually caused by a
	* vdev replace with a smaller device. This ensures that calculations
	* based of max_asize and asize e.g. esize are always valid. It's safe
	* to do this as we've already validated that asize is greater than
	* vdev_min_asize.
	*/
	if (vd->vdev_state == VDEV_STATE_HEALTHY &&
	((asize > vd->vdev_asize &&
	(vd->vdev_expanding \|\| spa->spa_autoexpand)) \|\|
	(asize < vd->vdev_asize)))
	vd->vdev_asize = asize;

	vdev_set_min_asize(vd);

	/*
	* Ensure we can issue some IO before declaring the
	* vdev open for business.
	*/
	if (vd->vdev_ops->vdev_op_leaf &&
	(error = zio_wait(vdev_probe(vd, NULL))) != 0) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_FAULTED,
	VDEV_AUX_ERR_EXCEEDED);
	return (error);
	}

	/*
	* Track the min and max ashift values for normal data devices.
	*/
	if (vd->vdev_top == vd && vd->vdev_ashift != 0 &&
	vd->vdev_alloc_bias == VDEV_BIAS_NONE &&
	vd->vdev_islog == 0 && vd->vdev_aux == NULL) {
	if (vd->vdev_ashift > spa->spa_max_ashift)
	spa->spa_max_ashift = vd->vdev_ashift;
	if (vd->vdev_ashift < spa->spa_min_ashift)
	spa->spa_min_ashift = vd->vdev_ashift;
	}

	/*
	* If this is a leaf vdev, assess whether a resilver is needed.
	* But don't do this if we are doing a reopen for a scrub, since
	* this would just restart the scrub we are already doing.
	*/
	if (vd->vdev_ops->vdev_op_leaf && !spa->spa_scrub_reopen)
	dsl_scan_assess_vdev(spa->spa_dsl_pool, vd);

	return (0);
	}

	/*
	* Called once the vdevs are all opened, this routine validates the label
	* contents. This needs to be done before vdev_load() so that we don't
	* inadvertently do repair I/Os to the wrong device.
	*
	* This function will only return failure if one of the vdevs indicates that it
	* has since been destroyed or exported. This is only possible if
	* /etc/zfs/zpool.cache was readonly at the time. Otherwise, the vdev state
	* will be updated but the function will return 0.
	*/
	int
	vdev_validate(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;
	nvlist_t *label;
	uint64_t guid = 0, aux_guid = 0, top_guid;
	uint64_t state;
	nvlist_t *nvl;
	uint64_t txg;

	if (vdev_validate_skip)
	return (0);

	for (uint64_t c = 0; c < vd->vdev_children; c++)
	if (vdev_validate(vd->vdev_child[c]) != 0)
	return (SET_ERROR(EBADF));

	/*
	* If the device has already failed, or was marked offline, don't do
	* any further validation. Otherwise, label I/O will fail and we will
	* overwrite the previous state.
	*/
	if (!vd->vdev_ops->vdev_op_leaf \|\| !vdev_readable(vd))
	return (0);

	/*
	* If we are performing an extreme rewind, we allow for a label that
	* was modified at a point after the current txg.
	* If config lock is not held do not check for the txg. spa_sync could
	* be updating the vdev's label before updating spa_last_synced_txg.
	*/
	if (spa->spa_extreme_rewind \|\| spa_last_synced_txg(spa) == 0 \|\|
	spa_config_held(spa, SCL_CONFIG, RW_WRITER) != SCL_CONFIG)
	txg = UINT64_MAX;
	else
	txg = spa_last_synced_txg(spa);

	if ((label = vdev_label_read_config(vd, txg)) == NULL) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_BAD_LABEL);
	vdev_dbgmsg(vd, "vdev_validate: failed reading config for "
	"txg %llu", (u_longlong_t)txg);
	return (0);
	}

	/*
	* Determine if this vdev has been split off into another
	* pool. If so, then refuse to open it.
	*/
	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_SPLIT_GUID,
	&aux_guid) == 0 && aux_guid == spa_guid(spa)) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_SPLIT_POOL);
	nvlist_free(label);
	vdev_dbgmsg(vd, "vdev_validate: vdev split into other pool");
	return (0);
	}

	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_GUID, &guid) != 0) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	nvlist_free(label);
	vdev_dbgmsg(vd, "vdev_validate: '%s' missing from label",
	ZPOOL_CONFIG_POOL_GUID);
	return (0);
	}

	/*
	* If config is not trusted then ignore the spa guid check. This is
	* necessary because if the machine crashed during a re-guid the new
	* guid might have been written to all of the vdev labels, but not the
	* cached config. The check will be performed again once we have the
	* trusted config from the MOS.
	*/
	if (spa->spa_trust_config && guid != spa_guid(spa)) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	nvlist_free(label);
	vdev_dbgmsg(vd, "vdev_validate: vdev label pool_guid doesn't "
	"match config (%llu != %llu)", (u_longlong_t)guid,
	(u_longlong_t)spa_guid(spa));
	return (0);
	}

	if (nvlist_lookup_nvlist(label, ZPOOL_CONFIG_VDEV_TREE, &nvl)
	!= 0 \|\| nvlist_lookup_uint64(nvl, ZPOOL_CONFIG_ORIG_GUID,
	&aux_guid) != 0)
	aux_guid = 0;

	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_GUID, &guid) != 0) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	nvlist_free(label);
	vdev_dbgmsg(vd, "vdev_validate: '%s' missing from label",
	ZPOOL_CONFIG_GUID);
	return (0);
	}

	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_TOP_GUID, &top_guid)
	!= 0) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	nvlist_free(label);
	vdev_dbgmsg(vd, "vdev_validate: '%s' missing from label",
	ZPOOL_CONFIG_TOP_GUID);
	return (0);
	}

	/*
	* If this vdev just became a top-level vdev because its sibling was
	* detached, it will have adopted the parent's vdev guid -- but the
	* label may or may not be on disk yet. Fortunately, either version
	* of the label will have the same top guid, so if we're a top-level
	* vdev, we can safely compare to that instead.
	* However, if the config comes from a cachefile that failed to update
	* after the detach, a top-level vdev will appear as a non top-level
	* vdev in the config. Also relax the constraints if we perform an
	* extreme rewind.
	*
	* If we split this vdev off instead, then we also check the
	* original pool's guid. We don't want to consider the vdev
	* corrupt if it is partway through a split operation.
	*/
	if (vd->vdev_guid != guid && vd->vdev_guid != aux_guid) {
	boolean_t mismatch = B_FALSE;
	if (spa->spa_trust_config && !spa->spa_extreme_rewind) {
	if (vd != vd->vdev_top \|\| vd->vdev_guid != top_guid)
	mismatch = B_TRUE;
	} else {
	if (vd->vdev_guid != top_guid &&
	vd->vdev_top->vdev_guid != guid)
	mismatch = B_TRUE;
	}

	if (mismatch) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	nvlist_free(label);
	vdev_dbgmsg(vd, "vdev_validate: config guid "
	"doesn't match label guid");
	vdev_dbgmsg(vd, "CONFIG: guid %llu, top_guid %llu",
	(u_longlong_t)vd->vdev_guid,
	(u_longlong_t)vd->vdev_top->vdev_guid);
	vdev_dbgmsg(vd, "LABEL: guid %llu, top_guid %llu, "
	"aux_guid %llu", (u_longlong_t)guid,
	(u_longlong_t)top_guid, (u_longlong_t)aux_guid);
	return (0);
	}
	}

	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_STATE,
	&state) != 0) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	nvlist_free(label);
	vdev_dbgmsg(vd, "vdev_validate: '%s' missing from label",
	ZPOOL_CONFIG_POOL_STATE);
	return (0);
	}

	nvlist_free(label);

	/*
	* If this is a verbatim import, no need to check the
	* state of the pool.
	*/
	if (!(spa->spa_import_flags & ZFS_IMPORT_VERBATIM) &&
	spa_load_state(spa) == SPA_LOAD_OPEN &&
	state != POOL_STATE_ACTIVE) {
	vdev_dbgmsg(vd, "vdev_validate: invalid pool state (%llu) "
	"for spa %s", (u_longlong_t)state, spa->spa_name);
	return (SET_ERROR(EBADF));
	}

	/*
	* If we were able to open and validate a vdev that was
	* previously marked permanently unavailable, clear that state
	* now.
	*/
	if (vd->vdev_not_present)
	vd->vdev_not_present = 0;

	return (0);
	}

	static void
	vdev_copy_path_impl(vdev_t svd, vdev_t dvd)
	{
	if (svd->vdev_path != NULL && dvd->vdev_path != NULL) {
	if (strcmp(svd->vdev_path, dvd->vdev_path) != 0) {
	zfs_dbgmsg("vdev_copy_path: vdev %llu: path changed "
	"from '%s' to '%s'", (u_longlong_t)dvd->vdev_guid,
	dvd->vdev_path, svd->vdev_path);
	spa_strfree(dvd->vdev_path);
	dvd->vdev_path = spa_strdup(svd->vdev_path);
	}
	} else if (svd->vdev_path != NULL) {
	dvd->vdev_path = spa_strdup(svd->vdev_path);
	zfs_dbgmsg("vdev_copy_path: vdev %llu: path set to '%s'",
	(u_longlong_t)dvd->vdev_guid, dvd->vdev_path);
	}
	}

	/*
	* Recursively copy vdev paths from one vdev to another. Source and destination
	* vdev trees must have same geometry otherwise return error. Intended to copy
	* paths from userland config into MOS config.
	*/
	int
	vdev_copy_path_strict(vdev_t svd, vdev_t dvd)
	{
	if ((svd->vdev_ops == &vdev_missing_ops) \|\|
	(svd->vdev_ishole && dvd->vdev_ishole) \|\|
	(dvd->vdev_ops == &vdev_indirect_ops))
	return (0);

	if (svd->vdev_ops != dvd->vdev_ops) {
	vdev_dbgmsg(svd, "vdev_copy_path: vdev type mismatch: %s != %s",
	svd->vdev_ops->vdev_op_type, dvd->vdev_ops->vdev_op_type);
	return (SET_ERROR(EINVAL));
	}

	if (svd->vdev_guid != dvd->vdev_guid) {
	vdev_dbgmsg(svd, "vdev_copy_path: guids mismatch (%llu != "
	"%llu)", (u_longlong_t)svd->vdev_guid,
	(u_longlong_t)dvd->vdev_guid);
	return (SET_ERROR(EINVAL));
	}

	if (svd->vdev_children != dvd->vdev_children) {
	vdev_dbgmsg(svd, "vdev_copy_path: children count mismatch: "
	"%llu != %llu", (u_longlong_t)svd->vdev_children,
	(u_longlong_t)dvd->vdev_children);
	return (SET_ERROR(EINVAL));
	}

	for (uint64_t i = 0; i < svd->vdev_children; i++) {
	int error = vdev_copy_path_strict(svd->vdev_child[i],
	dvd->vdev_child[i]);
	if (error != 0)
	return (error);
	}

	if (svd->vdev_ops->vdev_op_leaf)
	vdev_copy_path_impl(svd, dvd);

	return (0);
	}

	static void
	vdev_copy_path_search(vdev_t stvd, vdev_t dvd)
	{
	ASSERT(stvd->vdev_top == stvd);
	ASSERT3U(stvd->vdev_id, ==, dvd->vdev_top->vdev_id);

	for (uint64_t i = 0; i < dvd->vdev_children; i++) {
	vdev_copy_path_search(stvd, dvd->vdev_child[i]);
	}

	if (!dvd->vdev_ops->vdev_op_leaf \|\| !vdev_is_concrete(dvd))
	return;

	/*
	* The idea here is that while a vdev can shift positions within
	* a top vdev (when replacing, attaching mirror, etc.) it cannot
	* step outside of it.
	*/
	vdev_t *vd = vdev_lookup_by_guid(stvd, dvd->vdev_guid);

	if (vd == NULL \|\| vd->vdev_ops != dvd->vdev_ops)
	return;

	ASSERT(vd->vdev_ops->vdev_op_leaf);

	vdev_copy_path_impl(vd, dvd);
	}

	/*
	* Recursively copy vdev paths from one root vdev to another. Source and
	* destination vdev trees may differ in geometry. For each destination leaf
	* vdev, search a vdev with the same guid and top vdev id in the source.
	* Intended to copy paths from userland config into MOS config.
	*/
	void
	vdev_copy_path_relaxed(vdev_t srvd, vdev_t drvd)
	{
	uint64_t children = MIN(srvd->vdev_children, drvd->vdev_children);
	ASSERT(srvd->vdev_ops == &vdev_root_ops);
	ASSERT(drvd->vdev_ops == &vdev_root_ops);

	for (uint64_t i = 0; i < children; i++) {
	vdev_copy_path_search(srvd->vdev_child[i],
	drvd->vdev_child[i]);
	}
	}

	/*
	* Close a virtual device.
	*/
	void
	vdev_close(vdev_t *vd)
	{
	vdev_t *pvd = vd->vdev_parent;
	spa_t *spa __maybe_unused = vd->vdev_spa;

	ASSERT(spa_config_held(spa, SCL_STATE_ALL, RW_WRITER) == SCL_STATE_ALL);

	/*
	* If our parent is reopening, then we are as well, unless we are
	* going offline.
	*/
	if (pvd != NULL && pvd->vdev_reopening)
	vd->vdev_reopening = (pvd->vdev_reopening && !vd->vdev_offline);

	vd->vdev_ops->vdev_op_close(vd);

	vdev_cache_purge(vd);

	/*
	* We record the previous state before we close it, so that if we are
	* doing a reopen(), we don't generate FMA ereports if we notice that
	* it's still faulted.
	*/
	vd->vdev_prevstate = vd->vdev_state;

	if (vd->vdev_offline)
	vd->vdev_state = VDEV_STATE_OFFLINE;
	else
	vd->vdev_state = VDEV_STATE_CLOSED;
	vd->vdev_stat.vs_aux = VDEV_AUX_NONE;
	}

	void
	vdev_hold(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(spa_is_root(spa));
	if (spa->spa_state == POOL_STATE_UNINITIALIZED)
	return;

	for (int c = 0; c < vd->vdev_children; c++)
	vdev_hold(vd->vdev_child[c]);

	if (vd->vdev_ops->vdev_op_leaf)
	vd->vdev_ops->vdev_op_hold(vd);
	}

	void
	vdev_rele(vdev_t *vd)
	{
	ASSERT(spa_is_root(vd->vdev_spa));
	for (int c = 0; c < vd->vdev_children; c++)
	vdev_rele(vd->vdev_child[c]);

	if (vd->vdev_ops->vdev_op_leaf)
	vd->vdev_ops->vdev_op_rele(vd);
	}

	/*
	* Reopen all interior vdevs and any unopened leaves. We don't actually
	* reopen leaf vdevs which had previously been opened as they might deadlock
	* on the spa_config_lock. Instead we only obtain the leaf's physical size.
	* If the leaf has never been opened then open it, as usual.
	*/
	void
	vdev_reopen(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(spa_config_held(spa, SCL_STATE_ALL, RW_WRITER) == SCL_STATE_ALL);

	/* set the reopening flag unless we're taking the vdev offline */
	vd->vdev_reopening = !vd->vdev_offline;
	vdev_close(vd);
	(void) vdev_open(vd);

	/*
	* Call vdev_validate() here to make sure we have the same device.
	* Otherwise, a device with an invalid label could be successfully
	* opened in response to vdev_reopen().
	*/
	if (vd->vdev_aux) {
	(void) vdev_validate_aux(vd);
	if (vdev_readable(vd) && vdev_writeable(vd) &&
	vd->vdev_aux == &spa->spa_l2cache) {
	/*
	* In case the vdev is present we should evict all ARC
	* buffers and pointers to log blocks and reclaim their
	* space before restoring its contents to L2ARC.
	*/
	if (l2arc_vdev_present(vd)) {
	l2arc_rebuild_vdev(vd, B_TRUE);
	} else {
	l2arc_add_vdev(spa, vd);
	}
	spa_async_request(spa, SPA_ASYNC_L2CACHE_REBUILD);
	spa_async_request(spa, SPA_ASYNC_L2CACHE_TRIM);
	}
	} else {
	(void) vdev_validate(vd);
	}

	/*
	* Reassess parent vdev's health.
	*/
	vdev_propagate_state(vd);
	}

	int
	vdev_create(vdev_t *vd, uint64_t txg, boolean_t isreplacing)
	{
	int error;

	/*
	* Normally, partial opens (e.g. of a mirror) are allowed.
	* For a create, however, we want to fail the request if
	* there are any components we can't open.
	*/
	error = vdev_open(vd);

	if (error \|\| vd->vdev_state != VDEV_STATE_HEALTHY) {
	vdev_close(vd);
	return (error ? error : SET_ERROR(ENXIO));
	}

	/*
	* Recursively load DTLs and initialize all labels.
	*/
	if ((error = vdev_dtl_load(vd)) != 0 \|\|
	(error = vdev_label_init(vd, txg, isreplacing ?
	VDEV_LABEL_REPLACE : VDEV_LABEL_CREATE)) != 0) {
	vdev_close(vd);
	return (error);
	}

	return (0);
	}

	void
	vdev_metaslab_set_size(vdev_t *vd)
	{
	uint64_t asize = vd->vdev_asize;
	uint64_t ms_count = asize >> zfs_vdev_default_ms_shift;
	uint64_t ms_shift;

	/*
	* There are two dimensions to the metaslab sizing calculation:
	* the size of the metaslab and the count of metaslabs per vdev.
	*
	* The default values used below are a good balance between memory
	* usage (larger metaslab size means more memory needed for loaded
	* metaslabs; more metaslabs means more memory needed for the
	* metaslab_t structs), metaslab load time (larger metaslabs take
	* longer to load), and metaslab sync time (more metaslabs means
	* more time spent syncing all of them).
	*
	* In general, we aim for zfs_vdev_default_ms_count (200) metaslabs.
	* The range of the dimensions are as follows:
	*
	* 2^29 <= ms_size <= 2^34
	* 16 <= ms_count <= 131,072
	*
	* On the lower end of vdev sizes, we aim for metaslabs sizes of
	* at least 512MB (2^29) to minimize fragmentation effects when
	* testing with smaller devices. However, the count constraint
	* of at least 16 metaslabs will override this minimum size goal.
	*
	* On the upper end of vdev sizes, we aim for a maximum metaslab
	* size of 16GB. However, we will cap the total count to 2^17
	* metaslabs to keep our memory footprint in check and let the
	* metaslab size grow from there if that limit is hit.
	*
	* The net effect of applying above constrains is summarized below.
	*
	* vdev size metaslab count
	* --------------\|-----------------
	* < 8GB ~16
	* 8GB - 100GB one per 512MB
	* 100GB - 3TB ~200
	* 3TB - 2PB one per 16GB
	* > 2PB ~131,072
	* --------------------------------
	*
	* Finally, note that all of the above calculate the initial
	* number of metaslabs. Expanding a top-level vdev will result
	* in additional metaslabs being allocated making it possible
	* to exceed the zfs_vdev_ms_count_limit.
	*/

	if (ms_count < zfs_vdev_min_ms_count)
	ms_shift = highbit64(asize / zfs_vdev_min_ms_count);
	else if (ms_count > zfs_vdev_default_ms_count)
	ms_shift = highbit64(asize / zfs_vdev_default_ms_count);
	else
	ms_shift = zfs_vdev_default_ms_shift;

	if (ms_shift < SPA_MAXBLOCKSHIFT) {
	ms_shift = SPA_MAXBLOCKSHIFT;
	} else if (ms_shift > zfs_vdev_max_ms_shift) {
	ms_shift = zfs_vdev_max_ms_shift;
	/* cap the total count to constrain memory footprint */
	if ((asize >> ms_shift) > zfs_vdev_ms_count_limit)
	ms_shift = highbit64(asize / zfs_vdev_ms_count_limit);
	}

	vd->vdev_ms_shift = ms_shift;
	ASSERT3U(vd->vdev_ms_shift, >=, SPA_MAXBLOCKSHIFT);
	}

	-/*
	- * Maximize performance by inflating the configured ashift for top level
	- * vdevs to be as close to the physical ashift as possible while maintaining
	- * administrator defined limits and ensuring it doesn't go below the
	- * logical ashift.
	- */
	void
	-vdev_ashift_optimize(vdev_t *vd)
	-{
	- if (vd == vd->vdev_top) {
	- if (vd->vdev_ashift < vd->vdev_physical_ashift) {
	- vd->vdev_ashift = MIN(
	- MAX(zfs_vdev_max_auto_ashift, vd->vdev_ashift),
	- MAX(zfs_vdev_min_auto_ashift,
	- vd->vdev_physical_ashift));
	- } else {
	- /*
	- * Unusual case where logical ashift > physical ashift
	- * so we can't cap the calculated ashift based on max
	- * ashift as that would cause failures.
	- * We still check if we need to increase it to match
	- * the min ashift.
	- */
	- vd->vdev_ashift = MAX(zfs_vdev_min_auto_ashift,
	- vd->vdev_ashift);
	- }
	- }
	-}
	-
	-void
	vdev_dirty(vdev_t vd, int flags, void arg, uint64_t txg)
	{
	ASSERT(vd == vd->vdev_top);
	/* indirect vdevs don't have metaslabs or dtls */
	ASSERT(vdev_is_concrete(vd) \|\| flags == 0);
	ASSERT(ISP2(flags));
	ASSERT(spa_writeable(vd->vdev_spa));

	if (flags & VDD_METASLAB)
	(void) txg_list_add(&vd->vdev_ms_list, arg, txg);

	if (flags & VDD_DTL)
	(void) txg_list_add(&vd->vdev_dtl_list, arg, txg);

	(void) txg_list_add(&vd->vdev_spa->spa_vdev_txg_list, vd, txg);
	}

	void
	vdev_dirty_leaves(vdev_t *vd, int flags, uint64_t txg)
	{
	for (int c = 0; c < vd->vdev_children; c++)
	vdev_dirty_leaves(vd->vdev_child[c], flags, txg);

	if (vd->vdev_ops->vdev_op_leaf)
	vdev_dirty(vd->vdev_top, flags, vd, txg);
	}

	/*
	* DTLs.
	*
	* A vdev's DTL (dirty time log) is the set of transaction groups for which
	* the vdev has less than perfect replication. There are four kinds of DTL:
	*
	* DTL_MISSING: txgs for which the vdev has no valid copies of the data
	*
	* DTL_PARTIAL: txgs for which data is available, but not fully replicated
	*
	* DTL_SCRUB: the txgs that could not be repaired by the last scrub; upon
	* scrub completion, DTL_SCRUB replaces DTL_MISSING in the range of
	* txgs that was scrubbed.
	*
	* DTL_OUTAGE: txgs which cannot currently be read, whether due to
	* persistent errors or just some device being offline.
	* Unlike the other three, the DTL_OUTAGE map is not generally
	* maintained; it's only computed when needed, typically to
	* determine whether a device can be detached.
	*
	* For leaf vdevs, DTL_MISSING and DTL_PARTIAL are identical: the device
	* either has the data or it doesn't.
	*
	* For interior vdevs such as mirror and RAID-Z the picture is more complex.
	* A vdev's DTL_PARTIAL is the union of its children's DTL_PARTIALs, because
	* if any child is less than fully replicated, then so is its parent.
	* A vdev's DTL_MISSING is a modified union of its children's DTL_MISSINGs,
	* comprising only those txgs which appear in 'maxfaults' or more children;
	* those are the txgs we don't have enough replication to read. For example,
	* double-parity RAID-Z can tolerate up to two missing devices (maxfaults == 2);
	* thus, its DTL_MISSING consists of the set of txgs that appear in more than
	* two child DTL_MISSING maps.
	*
	* It should be clear from the above that to compute the DTLs and outage maps
	* for all vdevs, it suffices to know just the leaf vdevs' DTL_MISSING maps.
	* Therefore, that is all we keep on disk. When loading the pool, or after
	* a configuration change, we generate all other DTLs from first principles.
	*/
	void
	vdev_dtl_dirty(vdev_t *vd, vdev_dtl_type_t t, uint64_t txg, uint64_t size)
	{
	range_tree_t *rt = vd->vdev_dtl[t];

	ASSERT(t < DTL_TYPES);
	ASSERT(vd != vd->vdev_spa->spa_root_vdev);
	ASSERT(spa_writeable(vd->vdev_spa));

	mutex_enter(&vd->vdev_dtl_lock);
	if (!range_tree_contains(rt, txg, size))
	range_tree_add(rt, txg, size);
	mutex_exit(&vd->vdev_dtl_lock);
	}

	boolean_t
	vdev_dtl_contains(vdev_t *vd, vdev_dtl_type_t t, uint64_t txg, uint64_t size)
	{
	range_tree_t *rt = vd->vdev_dtl[t];
	boolean_t dirty = B_FALSE;

	ASSERT(t < DTL_TYPES);
	ASSERT(vd != vd->vdev_spa->spa_root_vdev);

	/*
	* While we are loading the pool, the DTLs have not been loaded yet.
	* Ignore the DTLs and try all devices. This avoids a recursive
	* mutex enter on the vdev_dtl_lock, and also makes us try hard
	* when loading the pool (relying on the checksum to ensure that
	* we get the right data -- note that we while loading, we are
	* only reading the MOS, which is always checksummed).
	*/
	if (vd->vdev_spa->spa_load_state != SPA_LOAD_NONE)
	return (B_FALSE);

	mutex_enter(&vd->vdev_dtl_lock);
	if (!range_tree_is_empty(rt))
	dirty = range_tree_contains(rt, txg, size);
	mutex_exit(&vd->vdev_dtl_lock);

	return (dirty);
	}

	boolean_t
	vdev_dtl_empty(vdev_t *vd, vdev_dtl_type_t t)
	{
	range_tree_t *rt = vd->vdev_dtl[t];
	boolean_t empty;

	mutex_enter(&vd->vdev_dtl_lock);
	empty = range_tree_is_empty(rt);
	mutex_exit(&vd->vdev_dtl_lock);

	return (empty);
	}

	/*
	* Returns B_TRUE if vdev determines offset needs to be resilvered.
	*/
	boolean_t
	vdev_dtl_need_resilver(vdev_t *vd, uint64_t offset, size_t psize)
	{
	ASSERT(vd != vd->vdev_spa->spa_root_vdev);

	if (vd->vdev_ops->vdev_op_need_resilver == NULL \|\|
	vd->vdev_ops->vdev_op_leaf)
	return (B_TRUE);

	return (vd->vdev_ops->vdev_op_need_resilver(vd, offset, psize));
	}

	/*
	* Returns the lowest txg in the DTL range.
	*/
	static uint64_t
	vdev_dtl_min(vdev_t *vd)
	{
	ASSERT(MUTEX_HELD(&vd->vdev_dtl_lock));
	ASSERT3U(range_tree_space(vd->vdev_dtl[DTL_MISSING]), !=, 0);
	ASSERT0(vd->vdev_children);

	return (range_tree_min(vd->vdev_dtl[DTL_MISSING]) - 1);
	}

	/*
	* Returns the highest txg in the DTL.
	*/
	static uint64_t
	vdev_dtl_max(vdev_t *vd)
	{
	ASSERT(MUTEX_HELD(&vd->vdev_dtl_lock));
	ASSERT3U(range_tree_space(vd->vdev_dtl[DTL_MISSING]), !=, 0);
	ASSERT0(vd->vdev_children);

	return (range_tree_max(vd->vdev_dtl[DTL_MISSING]));
	}

	/*
	* Determine if a resilvering vdev should remove any DTL entries from
	* its range. If the vdev was resilvering for the entire duration of the
	* scan then it should excise that range from its DTLs. Otherwise, this
	* vdev is considered partially resilvered and should leave its DTL
	* entries intact. The comment in vdev_dtl_reassess() describes how we
	* excise the DTLs.
	*/
	static boolean_t
	vdev_dtl_should_excise(vdev_t *vd, boolean_t rebuild_done)
	{
	ASSERT0(vd->vdev_children);

	if (vd->vdev_state < VDEV_STATE_DEGRADED)
	return (B_FALSE);

	if (vd->vdev_resilver_deferred)
	return (B_FALSE);

	if (range_tree_is_empty(vd->vdev_dtl[DTL_MISSING]))
	return (B_TRUE);

	if (rebuild_done) {
	vdev_rebuild_t *vr = &vd->vdev_top->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	/* Rebuild not initiated by attach */
	if (vd->vdev_rebuild_txg == 0)
	return (B_TRUE);

	/*
	* When a rebuild completes without error then all missing data
	* up to the rebuild max txg has been reconstructed and the DTL
	* is eligible for excision.
	*/
	if (vrp->vrp_rebuild_state == VDEV_REBUILD_COMPLETE &&
	vdev_dtl_max(vd) <= vrp->vrp_max_txg) {
	ASSERT3U(vrp->vrp_min_txg, <=, vdev_dtl_min(vd));
	ASSERT3U(vrp->vrp_min_txg, <, vd->vdev_rebuild_txg);
	ASSERT3U(vd->vdev_rebuild_txg, <=, vrp->vrp_max_txg);
	return (B_TRUE);
	}
	} else {
	dsl_scan_t *scn = vd->vdev_spa->spa_dsl_pool->dp_scan;
	dsl_scan_phys_t *scnp __maybe_unused = &scn->scn_phys;

	/* Resilver not initiated by attach */
	if (vd->vdev_resilver_txg == 0)
	return (B_TRUE);

	/*
	* When a resilver is initiated the scan will assign the
	* scn_max_txg value to the highest txg value that exists
	* in all DTLs. If this device's max DTL is not part of this
	* scan (i.e. it is not in the range (scn_min_txg, scn_max_txg]
	* then it is not eligible for excision.
	*/
	if (vdev_dtl_max(vd) <= scn->scn_phys.scn_max_txg) {
	ASSERT3U(scnp->scn_min_txg, <=, vdev_dtl_min(vd));
	ASSERT3U(scnp->scn_min_txg, <, vd->vdev_resilver_txg);
	ASSERT3U(vd->vdev_resilver_txg, <=, scnp->scn_max_txg);
	return (B_TRUE);
	}
	}

	return (B_FALSE);
	}

	/*
	* Reassess DTLs after a config change or scrub completion. If txg == 0 no
	* write operations will be issued to the pool.
	*/
	void
	vdev_dtl_reassess(vdev_t *vd, uint64_t txg, uint64_t scrub_txg,
	boolean_t scrub_done, boolean_t rebuild_done)
	{
	spa_t *spa = vd->vdev_spa;
	avl_tree_t reftree;
	int minref;

	ASSERT(spa_config_held(spa, SCL_ALL, RW_READER) != 0);

	for (int c = 0; c < vd->vdev_children; c++)
	vdev_dtl_reassess(vd->vdev_child[c], txg,
	scrub_txg, scrub_done, rebuild_done);

	if (vd == spa->spa_root_vdev \|\| !vdev_is_concrete(vd) \|\| vd->vdev_aux)
	return;

	if (vd->vdev_ops->vdev_op_leaf) {
	dsl_scan_t *scn = spa->spa_dsl_pool->dp_scan;
	vdev_rebuild_t *vr = &vd->vdev_top->vdev_rebuild_config;
	boolean_t check_excise = B_FALSE;
	boolean_t wasempty = B_TRUE;

	mutex_enter(&vd->vdev_dtl_lock);

	/*
	* If requested, pretend the scan or rebuild completed cleanly.
	*/
	if (zfs_scan_ignore_errors) {
	if (scn != NULL)
	scn->scn_phys.scn_errors = 0;
	if (vr != NULL)
	vr->vr_rebuild_phys.vrp_errors = 0;
	}

	if (scrub_txg != 0 &&
	!range_tree_is_empty(vd->vdev_dtl[DTL_MISSING])) {
	wasempty = B_FALSE;
	zfs_dbgmsg("guid:%llu txg:%llu scrub:%llu started:%d "
	"dtl:%llu/%llu errors:%llu",
	(u_longlong_t)vd->vdev_guid, (u_longlong_t)txg,
	(u_longlong_t)scrub_txg, spa->spa_scrub_started,
	(u_longlong_t)vdev_dtl_min(vd),
	(u_longlong_t)vdev_dtl_max(vd),
	(u_longlong_t)(scn ? scn->scn_phys.scn_errors : 0));
	}

	/*
	* If we've completed a scrub/resilver or a rebuild cleanly
	* then determine if this vdev should remove any DTLs. We
	* only want to excise regions on vdevs that were available
	* during the entire duration of this scan.
	*/
	if (rebuild_done &&
	vr != NULL && vr->vr_rebuild_phys.vrp_errors == 0) {
	check_excise = B_TRUE;
	} else {
	if (spa->spa_scrub_started \|\|
	(scn != NULL && scn->scn_phys.scn_errors == 0)) {
	check_excise = B_TRUE;
	}
	}

	if (scrub_txg && check_excise &&
	vdev_dtl_should_excise(vd, rebuild_done)) {
	/*
	* We completed a scrub, resilver or rebuild up to
	* scrub_txg. If we did it without rebooting, then
	* the scrub dtl will be valid, so excise the old
	* region and fold in the scrub dtl. Otherwise,
	* leave the dtl as-is if there was an error.
	*
	* There's little trick here: to excise the beginning
	* of the DTL_MISSING map, we put it into a reference
	* tree and then add a segment with refcnt -1 that
	* covers the range [0, scrub_txg). This means
	* that each txg in that range has refcnt -1 or 0.
	* We then add DTL_SCRUB with a refcnt of 2, so that
	* entries in the range [0, scrub_txg) will have a
	* positive refcnt -- either 1 or 2. We then convert
	* the reference tree into the new DTL_MISSING map.
	*/
	space_reftree_create(&reftree);
	space_reftree_add_map(&reftree,
	vd->vdev_dtl[DTL_MISSING], 1);
	space_reftree_add_seg(&reftree, 0, scrub_txg, -1);
	space_reftree_add_map(&reftree,
	vd->vdev_dtl[DTL_SCRUB], 2);
	space_reftree_generate_map(&reftree,
	vd->vdev_dtl[DTL_MISSING], 1);
	space_reftree_destroy(&reftree);

	if (!range_tree_is_empty(vd->vdev_dtl[DTL_MISSING])) {
	zfs_dbgmsg("update DTL_MISSING:%llu/%llu",
	(u_longlong_t)vdev_dtl_min(vd),
	(u_longlong_t)vdev_dtl_max(vd));
	} else if (!wasempty) {
	zfs_dbgmsg("DTL_MISSING is now empty");
	}
	}
	range_tree_vacate(vd->vdev_dtl[DTL_PARTIAL], NULL, NULL);
	range_tree_walk(vd->vdev_dtl[DTL_MISSING],
	range_tree_add, vd->vdev_dtl[DTL_PARTIAL]);
	if (scrub_done)
	range_tree_vacate(vd->vdev_dtl[DTL_SCRUB], NULL, NULL);
	range_tree_vacate(vd->vdev_dtl[DTL_OUTAGE], NULL, NULL);
	if (!vdev_readable(vd))
	range_tree_add(vd->vdev_dtl[DTL_OUTAGE], 0, -1ULL);
	else
	range_tree_walk(vd->vdev_dtl[DTL_MISSING],
	range_tree_add, vd->vdev_dtl[DTL_OUTAGE]);

	/*
	* If the vdev was resilvering or rebuilding and no longer
	* has any DTLs then reset the appropriate flag and dirty
	* the top level so that we persist the change.
	*/
	if (txg != 0 &&
	range_tree_is_empty(vd->vdev_dtl[DTL_MISSING]) &&
	range_tree_is_empty(vd->vdev_dtl[DTL_OUTAGE])) {
	if (vd->vdev_rebuild_txg != 0) {
	vd->vdev_rebuild_txg = 0;
	vdev_config_dirty(vd->vdev_top);
	} else if (vd->vdev_resilver_txg != 0) {
	vd->vdev_resilver_txg = 0;
	vdev_config_dirty(vd->vdev_top);
	}
	}

	mutex_exit(&vd->vdev_dtl_lock);

	if (txg != 0)
	vdev_dirty(vd->vdev_top, VDD_DTL, vd, txg);
	return;
	}

	mutex_enter(&vd->vdev_dtl_lock);
	for (int t = 0; t < DTL_TYPES; t++) {
	/* account for child's outage in parent's missing map */
	int s = (t == DTL_MISSING) ? DTL_OUTAGE: t;
	if (t == DTL_SCRUB)
	continue; /* leaf vdevs only */
	if (t == DTL_PARTIAL)
	minref = 1; /* i.e. non-zero */
	else if (vd->vdev_nparity != 0)
	minref = vd->vdev_nparity + 1; /* RAID-Z */
	else
	minref = vd->vdev_children; /* any kind of mirror */
	space_reftree_create(&reftree);
	for (int c = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];
	mutex_enter(&cvd->vdev_dtl_lock);
	space_reftree_add_map(&reftree, cvd->vdev_dtl[s], 1);
	mutex_exit(&cvd->vdev_dtl_lock);
	}
	space_reftree_generate_map(&reftree, vd->vdev_dtl[t], minref);
	space_reftree_destroy(&reftree);
	}
	mutex_exit(&vd->vdev_dtl_lock);
	}

	int
	vdev_dtl_load(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;
	objset_t *mos = spa->spa_meta_objset;
	int error = 0;

	if (vd->vdev_ops->vdev_op_leaf && vd->vdev_dtl_object != 0) {
	ASSERT(vdev_is_concrete(vd));

	error = space_map_open(&vd->vdev_dtl_sm, mos,
	vd->vdev_dtl_object, 0, -1ULL, 0);
	if (error)
	return (error);
	ASSERT(vd->vdev_dtl_sm != NULL);

	mutex_enter(&vd->vdev_dtl_lock);
	error = space_map_load(vd->vdev_dtl_sm,
	vd->vdev_dtl[DTL_MISSING], SM_ALLOC);
	mutex_exit(&vd->vdev_dtl_lock);

	return (error);
	}

	for (int c = 0; c < vd->vdev_children; c++) {
	error = vdev_dtl_load(vd->vdev_child[c]);
	if (error != 0)
	break;
	}

	return (error);
	}

	static void
	vdev_zap_allocation_data(vdev_t vd, dmu_tx_t tx)
	{
	spa_t *spa = vd->vdev_spa;
	objset_t *mos = spa->spa_meta_objset;
	vdev_alloc_bias_t alloc_bias = vd->vdev_alloc_bias;
	const char *string;

	ASSERT(alloc_bias != VDEV_BIAS_NONE);

	string =
	(alloc_bias == VDEV_BIAS_LOG) ? VDEV_ALLOC_BIAS_LOG :
	(alloc_bias == VDEV_BIAS_SPECIAL) ? VDEV_ALLOC_BIAS_SPECIAL :
	(alloc_bias == VDEV_BIAS_DEDUP) ? VDEV_ALLOC_BIAS_DEDUP : NULL;

	ASSERT(string != NULL);
	VERIFY0(zap_add(mos, vd->vdev_top_zap, VDEV_TOP_ZAP_ALLOCATION_BIAS,
	1, strlen(string) + 1, string, tx));

	if (alloc_bias == VDEV_BIAS_SPECIAL \|\| alloc_bias == VDEV_BIAS_DEDUP) {
	spa_activate_allocation_classes(spa, tx);
	}
	}

	void
	vdev_destroy_unlink_zap(vdev_t vd, uint64_t zapobj, dmu_tx_t tx)
	{
	spa_t *spa = vd->vdev_spa;

	VERIFY0(zap_destroy(spa->spa_meta_objset, zapobj, tx));
	VERIFY0(zap_remove_int(spa->spa_meta_objset, spa->spa_all_vdev_zaps,
	zapobj, tx));
	}

	uint64_t
	vdev_create_link_zap(vdev_t vd, dmu_tx_t tx)
	{
	spa_t *spa = vd->vdev_spa;
	uint64_t zap = zap_create(spa->spa_meta_objset, DMU_OTN_ZAP_METADATA,
	DMU_OT_NONE, 0, tx);

	ASSERT(zap != 0);
	VERIFY0(zap_add_int(spa->spa_meta_objset, spa->spa_all_vdev_zaps,
	zap, tx));

	return (zap);
	}

	void
	vdev_construct_zaps(vdev_t vd, dmu_tx_t tx)
	{
	if (vd->vdev_ops != &vdev_hole_ops &&
	vd->vdev_ops != &vdev_missing_ops &&
	vd->vdev_ops != &vdev_root_ops &&
	!vd->vdev_top->vdev_removing) {
	if (vd->vdev_ops->vdev_op_leaf && vd->vdev_leaf_zap == 0) {
	vd->vdev_leaf_zap = vdev_create_link_zap(vd, tx);
	}
	if (vd == vd->vdev_top && vd->vdev_top_zap == 0) {
	vd->vdev_top_zap = vdev_create_link_zap(vd, tx);
	if (vd->vdev_alloc_bias != VDEV_BIAS_NONE)
	vdev_zap_allocation_data(vd, tx);
	}
	}

	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	vdev_construct_zaps(vd->vdev_child[i], tx);
	}
	}

	static void
	vdev_dtl_sync(vdev_t *vd, uint64_t txg)
	{
	spa_t *spa = vd->vdev_spa;
	range_tree_t *rt = vd->vdev_dtl[DTL_MISSING];
	objset_t *mos = spa->spa_meta_objset;
	range_tree_t *rtsync;
	dmu_tx_t *tx;
	uint64_t object = space_map_object(vd->vdev_dtl_sm);

	ASSERT(vdev_is_concrete(vd));
	ASSERT(vd->vdev_ops->vdev_op_leaf);

	tx = dmu_tx_create_assigned(spa->spa_dsl_pool, txg);

	if (vd->vdev_detached \|\| vd->vdev_top->vdev_removing) {
	mutex_enter(&vd->vdev_dtl_lock);
	space_map_free(vd->vdev_dtl_sm, tx);
	space_map_close(vd->vdev_dtl_sm);
	vd->vdev_dtl_sm = NULL;
	mutex_exit(&vd->vdev_dtl_lock);

	/*
	* We only destroy the leaf ZAP for detached leaves or for
	* removed log devices. Removed data devices handle leaf ZAP
	* cleanup later, once cancellation is no longer possible.
	*/
	if (vd->vdev_leaf_zap != 0 && (vd->vdev_detached \|\|
	vd->vdev_top->vdev_islog)) {
	vdev_destroy_unlink_zap(vd, vd->vdev_leaf_zap, tx);
	vd->vdev_leaf_zap = 0;
	}

	dmu_tx_commit(tx);
	return;
	}

	if (vd->vdev_dtl_sm == NULL) {
	uint64_t new_object;

	new_object = space_map_alloc(mos, zfs_vdev_dtl_sm_blksz, tx);
	VERIFY3U(new_object, !=, 0);

	VERIFY0(space_map_open(&vd->vdev_dtl_sm, mos, new_object,
	0, -1ULL, 0));
	ASSERT(vd->vdev_dtl_sm != NULL);
	}

	rtsync = range_tree_create(NULL, RANGE_SEG64, NULL, 0, 0);

	mutex_enter(&vd->vdev_dtl_lock);
	range_tree_walk(rt, range_tree_add, rtsync);
	mutex_exit(&vd->vdev_dtl_lock);

	space_map_truncate(vd->vdev_dtl_sm, zfs_vdev_dtl_sm_blksz, tx);
	space_map_write(vd->vdev_dtl_sm, rtsync, SM_ALLOC, SM_NO_VDEVID, tx);
	range_tree_vacate(rtsync, NULL, NULL);

	range_tree_destroy(rtsync);

	/*
	* If the object for the space map has changed then dirty
	* the top level so that we update the config.
	*/
	if (object != space_map_object(vd->vdev_dtl_sm)) {
	vdev_dbgmsg(vd, "txg %llu, spa %s, DTL old object %llu, "
	"new object %llu", (u_longlong_t)txg, spa_name(spa),
	(u_longlong_t)object,
	(u_longlong_t)space_map_object(vd->vdev_dtl_sm));
	vdev_config_dirty(vd->vdev_top);
	}

	dmu_tx_commit(tx);
	}

	/*
	* Determine whether the specified vdev can be offlined/detached/removed
	* without losing data.
	*/
	boolean_t
	vdev_dtl_required(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;
	vdev_t *tvd = vd->vdev_top;
	uint8_t cant_read = vd->vdev_cant_read;
	boolean_t required;

	ASSERT(spa_config_held(spa, SCL_STATE_ALL, RW_WRITER) == SCL_STATE_ALL);

	if (vd == spa->spa_root_vdev \|\| vd == tvd)
	return (B_TRUE);

	/*
	* Temporarily mark the device as unreadable, and then determine
	* whether this results in any DTL outages in the top-level vdev.
	* If not, we can safely offline/detach/remove the device.
	*/
	vd->vdev_cant_read = B_TRUE;
	vdev_dtl_reassess(tvd, 0, 0, B_FALSE, B_FALSE);
	required = !vdev_dtl_empty(tvd, DTL_OUTAGE);
	vd->vdev_cant_read = cant_read;
	vdev_dtl_reassess(tvd, 0, 0, B_FALSE, B_FALSE);

	if (!required && zio_injection_enabled) {
	required = !!zio_handle_device_injection(vd, NULL,
	SET_ERROR(ECHILD));
	}

	return (required);
	}

	/*
	* Determine if resilver is needed, and if so the txg range.
	*/
	boolean_t
	vdev_resilver_needed(vdev_t vd, uint64_t minp, uint64_t *maxp)
	{
	boolean_t needed = B_FALSE;
	uint64_t thismin = UINT64_MAX;
	uint64_t thismax = 0;

	if (vd->vdev_children == 0) {
	mutex_enter(&vd->vdev_dtl_lock);
	if (!range_tree_is_empty(vd->vdev_dtl[DTL_MISSING]) &&
	vdev_writeable(vd)) {

	thismin = vdev_dtl_min(vd);
	thismax = vdev_dtl_max(vd);
	needed = B_TRUE;
	}
	mutex_exit(&vd->vdev_dtl_lock);
	} else {
	for (int c = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];
	uint64_t cmin, cmax;

	if (vdev_resilver_needed(cvd, &cmin, &cmax)) {
	thismin = MIN(thismin, cmin);
	thismax = MAX(thismax, cmax);
	needed = B_TRUE;
	}
	}
	}

	if (needed && minp) {
	*minp = thismin;
	*maxp = thismax;
	}
	return (needed);
	}

	/*
	* Gets the checkpoint space map object from the vdev's ZAP. On success sm_obj
	* will contain either the checkpoint spacemap object or zero if none exists.
	* All other errors are returned to the caller.
	*/
	int
	vdev_checkpoint_sm_object(vdev_t vd, uint64_t sm_obj)
	{
	ASSERT0(spa_config_held(vd->vdev_spa, SCL_ALL, RW_WRITER));

	if (vd->vdev_top_zap == 0) {
	*sm_obj = 0;
	return (0);
	}

	int error = zap_lookup(spa_meta_objset(vd->vdev_spa), vd->vdev_top_zap,
	VDEV_TOP_ZAP_POOL_CHECKPOINT_SM, sizeof (uint64_t), 1, sm_obj);
	if (error == ENOENT) {
	*sm_obj = 0;
	error = 0;
	}

	return (error);
	}

	int
	vdev_load(vdev_t *vd)
	{
	int error = 0;

	/*
	* Recursively load all children.
	*/
	for (int c = 0; c < vd->vdev_children; c++) {
	error = vdev_load(vd->vdev_child[c]);
	if (error != 0) {
	return (error);
	}
	}

	vdev_set_deflate_ratio(vd);

	/*
	* On spa_load path, grab the allocation bias from our zap
	*/
	if (vd == vd->vdev_top && vd->vdev_top_zap != 0) {
	spa_t *spa = vd->vdev_spa;
	char bias_str[64];

	error = zap_lookup(spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_ALLOCATION_BIAS, 1, sizeof (bias_str),
	bias_str);
	if (error == 0) {
	ASSERT(vd->vdev_alloc_bias == VDEV_BIAS_NONE);
	vd->vdev_alloc_bias = vdev_derive_alloc_bias(bias_str);
	} else if (error != ENOENT) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	vdev_dbgmsg(vd, "vdev_load: zap_lookup(top_zap=%llu) "
	"failed [error=%d]", vd->vdev_top_zap, error);
	return (error);
	}
	}

	/*
	* Load any rebuild state from the top-level vdev zap.
	*/
	if (vd == vd->vdev_top && vd->vdev_top_zap != 0) {
	error = vdev_rebuild_load(vd);
	if (error && error != ENOTSUP) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	vdev_dbgmsg(vd, "vdev_load: vdev_rebuild_load "
	"failed [error=%d]", error);
	return (error);
	}
	}

	/*
	* If this is a top-level vdev, initialize its metaslabs.
	*/
	if (vd == vd->vdev_top && vdev_is_concrete(vd)) {
	vdev_metaslab_group_create(vd);

	if (vd->vdev_ashift == 0 \|\| vd->vdev_asize == 0) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	vdev_dbgmsg(vd, "vdev_load: invalid size. ashift=%llu, "
	"asize=%llu", (u_longlong_t)vd->vdev_ashift,
	(u_longlong_t)vd->vdev_asize);
	return (SET_ERROR(ENXIO));
	}

	error = vdev_metaslab_init(vd, 0);
	if (error != 0) {
	vdev_dbgmsg(vd, "vdev_load: metaslab_init failed "
	"[error=%d]", error);
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	return (error);
	}

	uint64_t checkpoint_sm_obj;
	error = vdev_checkpoint_sm_object(vd, &checkpoint_sm_obj);
	if (error == 0 && checkpoint_sm_obj != 0) {
	objset_t *mos = spa_meta_objset(vd->vdev_spa);
	ASSERT(vd->vdev_asize != 0);
	ASSERT3P(vd->vdev_checkpoint_sm, ==, NULL);

	error = space_map_open(&vd->vdev_checkpoint_sm,
	mos, checkpoint_sm_obj, 0, vd->vdev_asize,
	vd->vdev_ashift);
	if (error != 0) {
	vdev_dbgmsg(vd, "vdev_load: space_map_open "
	"failed for checkpoint spacemap (obj %llu) "
	"[error=%d]",
	(u_longlong_t)checkpoint_sm_obj, error);
	return (error);
	}
	ASSERT3P(vd->vdev_checkpoint_sm, !=, NULL);

	/*
	* Since the checkpoint_sm contains free entries
	* exclusively we can use space_map_allocated() to
	* indicate the cumulative checkpointed space that
	* has been freed.
	*/
	vd->vdev_stat.vs_checkpoint_space =
	-space_map_allocated(vd->vdev_checkpoint_sm);
	vd->vdev_spa->spa_checkpoint_info.sci_dspace +=
	vd->vdev_stat.vs_checkpoint_space;
	} else if (error != 0) {
	vdev_dbgmsg(vd, "vdev_load: failed to retrieve "
	"checkpoint space map object from vdev ZAP "
	"[error=%d]", error);
	return (error);
	}
	}

	/*
	* If this is a leaf vdev, load its DTL.
	*/
	if (vd->vdev_ops->vdev_op_leaf && (error = vdev_dtl_load(vd)) != 0) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	vdev_dbgmsg(vd, "vdev_load: vdev_dtl_load failed "
	"[error=%d]", error);
	return (error);
	}

	uint64_t obsolete_sm_object;
	error = vdev_obsolete_sm_object(vd, &obsolete_sm_object);
	if (error == 0 && obsolete_sm_object != 0) {
	objset_t *mos = vd->vdev_spa->spa_meta_objset;
	ASSERT(vd->vdev_asize != 0);
	ASSERT3P(vd->vdev_obsolete_sm, ==, NULL);

	if ((error = space_map_open(&vd->vdev_obsolete_sm, mos,
	obsolete_sm_object, 0, vd->vdev_asize, 0))) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	vdev_dbgmsg(vd, "vdev_load: space_map_open failed for "
	"obsolete spacemap (obj %llu) [error=%d]",
	(u_longlong_t)obsolete_sm_object, error);
	return (error);
	}
	} else if (error != 0) {
	vdev_dbgmsg(vd, "vdev_load: failed to retrieve obsolete "
	"space map object from vdev ZAP [error=%d]", error);
	return (error);
	}

	return (0);
	}

	/*
	* The special vdev case is used for hot spares and l2cache devices. Its
	* sole purpose it to set the vdev state for the associated vdev. To do this,
	* we make sure that we can open the underlying device, then try to read the
	* label, and make sure that the label is sane and that it hasn't been
	* repurposed to another pool.
	*/
	int
	vdev_validate_aux(vdev_t *vd)
	{
	nvlist_t *label;
	uint64_t guid, version;
	uint64_t state;

	if (!vdev_readable(vd))
	return (0);

	if ((label = vdev_label_read_config(vd, -1ULL)) == NULL) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	return (-1);
	}

	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_VERSION, &version) != 0 \|\|
	!SPA_VERSION_IS_SUPPORTED(version) \|\|
	nvlist_lookup_uint64(label, ZPOOL_CONFIG_GUID, &guid) != 0 \|\|
	guid != vd->vdev_guid \|\|
	nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_STATE, &state) != 0) {
	vdev_set_state(vd, B_TRUE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	nvlist_free(label);
	return (-1);
	}

	/*
	* We don't actually check the pool state here. If it's in fact in
	* use by another pool, we update this fact on the fly when requested.
	*/
	nvlist_free(label);
	return (0);
	}

	static void
	vdev_destroy_ms_flush_data(vdev_t vd, dmu_tx_t tx)
	{
	objset_t *mos = spa_meta_objset(vd->vdev_spa);

	if (vd->vdev_top_zap == 0)
	return;

	uint64_t object = 0;
	int err = zap_lookup(mos, vd->vdev_top_zap,
	VDEV_TOP_ZAP_MS_UNFLUSHED_PHYS_TXGS, sizeof (uint64_t), 1, &object);
	if (err == ENOENT)
	return;
	VERIFY0(err);

	VERIFY0(dmu_object_free(mos, object, tx));
	VERIFY0(zap_remove(mos, vd->vdev_top_zap,
	VDEV_TOP_ZAP_MS_UNFLUSHED_PHYS_TXGS, tx));
	}

	/*
	* Free the objects used to store this vdev's spacemaps, and the array
	* that points to them.
	*/
	void
	vdev_destroy_spacemaps(vdev_t vd, dmu_tx_t tx)
	{
	if (vd->vdev_ms_array == 0)
	return;

	objset_t *mos = vd->vdev_spa->spa_meta_objset;
	uint64_t array_count = vd->vdev_asize >> vd->vdev_ms_shift;
	size_t array_bytes = array_count * sizeof (uint64_t);
	uint64_t *smobj_array = kmem_alloc(array_bytes, KM_SLEEP);
	VERIFY0(dmu_read(mos, vd->vdev_ms_array, 0,
	array_bytes, smobj_array, 0));

	for (uint64_t i = 0; i < array_count; i++) {
	uint64_t smobj = smobj_array[i];
	if (smobj == 0)
	continue;

	space_map_free_obj(mos, smobj, tx);
	}

	kmem_free(smobj_array, array_bytes);
	VERIFY0(dmu_object_free(mos, vd->vdev_ms_array, tx));
	vdev_destroy_ms_flush_data(vd, tx);
	vd->vdev_ms_array = 0;
	}

	static void
	vdev_remove_empty_log(vdev_t *vd, uint64_t txg)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(vd->vdev_islog);
	ASSERT(vd == vd->vdev_top);
	ASSERT3U(txg, ==, spa_syncing_txg(spa));

	dmu_tx_t *tx = dmu_tx_create_assigned(spa_get_dsl(spa), txg);

	vdev_destroy_spacemaps(vd, tx);
	if (vd->vdev_top_zap != 0) {
	vdev_destroy_unlink_zap(vd, vd->vdev_top_zap, tx);
	vd->vdev_top_zap = 0;
	}

	dmu_tx_commit(tx);
	}

	void
	vdev_sync_done(vdev_t *vd, uint64_t txg)
	{
	metaslab_t *msp;
	boolean_t reassess = !txg_list_empty(&vd->vdev_ms_list, TXG_CLEAN(txg));

	ASSERT(vdev_is_concrete(vd));

	while ((msp = txg_list_remove(&vd->vdev_ms_list, TXG_CLEAN(txg)))
	!= NULL)
	metaslab_sync_done(msp, txg);

	if (reassess)
	metaslab_sync_reassess(vd->vdev_mg);
	}

	void
	vdev_sync(vdev_t *vd, uint64_t txg)
	{
	spa_t *spa = vd->vdev_spa;
	vdev_t *lvd;
	metaslab_t *msp;

	ASSERT3U(txg, ==, spa->spa_syncing_txg);
	dmu_tx_t *tx = dmu_tx_create_assigned(spa->spa_dsl_pool, txg);
	if (range_tree_space(vd->vdev_obsolete_segments) > 0) {
	ASSERT(vd->vdev_removing \|\|
	vd->vdev_ops == &vdev_indirect_ops);

	vdev_indirect_sync_obsolete(vd, tx);

	/*
	* If the vdev is indirect, it can't have dirty
	* metaslabs or DTLs.
	*/
	if (vd->vdev_ops == &vdev_indirect_ops) {
	ASSERT(txg_list_empty(&vd->vdev_ms_list, txg));
	ASSERT(txg_list_empty(&vd->vdev_dtl_list, txg));
	dmu_tx_commit(tx);
	return;
	}
	}

	ASSERT(vdev_is_concrete(vd));

	if (vd->vdev_ms_array == 0 && vd->vdev_ms_shift != 0 &&
	!vd->vdev_removing) {
	ASSERT(vd == vd->vdev_top);
	ASSERT0(vd->vdev_indirect_config.vic_mapping_object);
	vd->vdev_ms_array = dmu_object_alloc(spa->spa_meta_objset,
	DMU_OT_OBJECT_ARRAY, 0, DMU_OT_NONE, 0, tx);
	ASSERT(vd->vdev_ms_array != 0);
	vdev_config_dirty(vd);
	}

	while ((msp = txg_list_remove(&vd->vdev_ms_list, txg)) != NULL) {
	metaslab_sync(msp, txg);
	(void) txg_list_add(&vd->vdev_ms_list, msp, TXG_CLEAN(txg));
	}

	while ((lvd = txg_list_remove(&vd->vdev_dtl_list, txg)) != NULL)
	vdev_dtl_sync(lvd, txg);

	/*
	* If this is an empty log device being removed, destroy the
	* metadata associated with it.
	*/
	if (vd->vdev_islog && vd->vdev_stat.vs_alloc == 0 && vd->vdev_removing)
	vdev_remove_empty_log(vd, txg);

	(void) txg_list_add(&spa->spa_vdev_txg_list, vd, TXG_CLEAN(txg));
	dmu_tx_commit(tx);
	}

	uint64_t
	vdev_psize_to_asize(vdev_t *vd, uint64_t psize)
	{
	return (vd->vdev_ops->vdev_op_asize(vd, psize));
	}

	/*
	* Mark the given vdev faulted. A faulted vdev behaves as if the device could
	* not be opened, and no I/O is attempted.
	*/
	int
	vdev_fault(spa_t *spa, uint64_t guid, vdev_aux_t aux)
	{
	vdev_t vd, tvd;

	spa_vdev_state_enter(spa, SCL_NONE);

	if ((vd = spa_lookup_by_guid(spa, guid, B_TRUE)) == NULL)
	return (spa_vdev_state_exit(spa, NULL, SET_ERROR(ENODEV)));

	if (!vd->vdev_ops->vdev_op_leaf)
	return (spa_vdev_state_exit(spa, NULL, SET_ERROR(ENOTSUP)));

	tvd = vd->vdev_top;

	/*
	* If user did a 'zpool offline -f' then make the fault persist across
	* reboots.
	*/
	if (aux == VDEV_AUX_EXTERNAL_PERSIST) {
	/*
	* There are two kinds of forced faults: temporary and
	* persistent. Temporary faults go away at pool import, while
	* persistent faults stay set. Both types of faults can be
	* cleared with a zpool clear.
	*
	* We tell if a vdev is persistently faulted by looking at the
	* ZPOOL_CONFIG_AUX_STATE nvpair. If it's set to "external" at
	* import then it's a persistent fault. Otherwise, it's
	* temporary. We get ZPOOL_CONFIG_AUX_STATE set to "external"
	* by setting vd.vdev_stat.vs_aux to VDEV_AUX_EXTERNAL. This
	* tells vdev_config_generate() (which gets run later) to set
	* ZPOOL_CONFIG_AUX_STATE to "external" in the nvlist.
	*/
	vd->vdev_stat.vs_aux = VDEV_AUX_EXTERNAL;
	vd->vdev_tmpoffline = B_FALSE;
	aux = VDEV_AUX_EXTERNAL;
	} else {
	vd->vdev_tmpoffline = B_TRUE;
	}

	/*
	* We don't directly use the aux state here, but if we do a
	* vdev_reopen(), we need this value to be present to remember why we
	* were faulted.
	*/
	vd->vdev_label_aux = aux;

	/*
	* Faulted state takes precedence over degraded.
	*/
	vd->vdev_delayed_close = B_FALSE;
	vd->vdev_faulted = 1ULL;
	vd->vdev_degraded = 0ULL;
	vdev_set_state(vd, B_FALSE, VDEV_STATE_FAULTED, aux);

	/*
	* If this device has the only valid copy of the data, then
	* back off and simply mark the vdev as degraded instead.
	*/
	if (!tvd->vdev_islog && vd->vdev_aux == NULL && vdev_dtl_required(vd)) {
	vd->vdev_degraded = 1ULL;
	vd->vdev_faulted = 0ULL;

	/*
	* If we reopen the device and it's not dead, only then do we
	* mark it degraded.
	*/
	vdev_reopen(tvd);

	if (vdev_readable(vd))
	vdev_set_state(vd, B_FALSE, VDEV_STATE_DEGRADED, aux);
	}

	return (spa_vdev_state_exit(spa, vd, 0));
	}

	/*
	* Mark the given vdev degraded. A degraded vdev is purely an indication to the
	* user that something is wrong. The vdev continues to operate as normal as far
	* as I/O is concerned.
	*/
	int
	vdev_degrade(spa_t *spa, uint64_t guid, vdev_aux_t aux)
	{
	vdev_t *vd;

	spa_vdev_state_enter(spa, SCL_NONE);

	if ((vd = spa_lookup_by_guid(spa, guid, B_TRUE)) == NULL)
	return (spa_vdev_state_exit(spa, NULL, SET_ERROR(ENODEV)));

	if (!vd->vdev_ops->vdev_op_leaf)
	return (spa_vdev_state_exit(spa, NULL, SET_ERROR(ENOTSUP)));

	/*
	* If the vdev is already faulted, then don't do anything.
	*/
	if (vd->vdev_faulted \|\| vd->vdev_degraded)
	return (spa_vdev_state_exit(spa, NULL, 0));

	vd->vdev_degraded = 1ULL;
	if (!vdev_is_dead(vd))
	vdev_set_state(vd, B_FALSE, VDEV_STATE_DEGRADED,
	aux);

	return (spa_vdev_state_exit(spa, vd, 0));
	}

	/*
	* Online the given vdev.
	*
	* If 'ZFS_ONLINE_UNSPARE' is set, it implies two things. First, any attached
	* spare device should be detached when the device finishes resilvering.
	* Second, the online should be treated like a 'test' online case, so no FMA
	* events are generated if the device fails to open.
	*/
	int
	vdev_online(spa_t spa, uint64_t guid, uint64_t flags, vdev_state_t newstate)
	{
	vdev_t vd, tvd, pvd, rvd = spa->spa_root_vdev;
	boolean_t wasoffline;
	vdev_state_t oldstate;

	spa_vdev_state_enter(spa, SCL_NONE);

	if ((vd = spa_lookup_by_guid(spa, guid, B_TRUE)) == NULL)
	return (spa_vdev_state_exit(spa, NULL, SET_ERROR(ENODEV)));

	if (!vd->vdev_ops->vdev_op_leaf)
	return (spa_vdev_state_exit(spa, NULL, SET_ERROR(ENOTSUP)));

	wasoffline = (vd->vdev_offline \|\| vd->vdev_tmpoffline);
	oldstate = vd->vdev_state;

	tvd = vd->vdev_top;
	vd->vdev_offline = B_FALSE;
	vd->vdev_tmpoffline = B_FALSE;
	vd->vdev_checkremove = !!(flags & ZFS_ONLINE_CHECKREMOVE);
	vd->vdev_forcefault = !!(flags & ZFS_ONLINE_FORCEFAULT);

	/* XXX - L2ARC 1.0 does not support expansion */
	if (!vd->vdev_aux) {
	for (pvd = vd; pvd != rvd; pvd = pvd->vdev_parent)
	pvd->vdev_expanding = !!((flags & ZFS_ONLINE_EXPAND) \|\|
	spa->spa_autoexpand);
	vd->vdev_expansion_time = gethrestime_sec();
	}

	vdev_reopen(tvd);
	vd->vdev_checkremove = vd->vdev_forcefault = B_FALSE;

	if (!vd->vdev_aux) {
	for (pvd = vd; pvd != rvd; pvd = pvd->vdev_parent)
	pvd->vdev_expanding = B_FALSE;
	}

	if (newstate)
	*newstate = vd->vdev_state;
	if ((flags & ZFS_ONLINE_UNSPARE) &&
	!vdev_is_dead(vd) && vd->vdev_parent &&
	vd->vdev_parent->vdev_ops == &vdev_spare_ops &&
	vd->vdev_parent->vdev_child[0] == vd)
	vd->vdev_unspare = B_TRUE;

	if ((flags & ZFS_ONLINE_EXPAND) \|\| spa->spa_autoexpand) {

	/* XXX - L2ARC 1.0 does not support expansion */
	if (vd->vdev_aux)
	return (spa_vdev_state_exit(spa, vd, ENOTSUP));
	spa_async_request(spa, SPA_ASYNC_CONFIG_UPDATE);
	}

	/* Restart initializing if necessary */
	mutex_enter(&vd->vdev_initialize_lock);
	if (vdev_writeable(vd) &&
	vd->vdev_initialize_thread == NULL &&
	vd->vdev_initialize_state == VDEV_INITIALIZE_ACTIVE) {
	(void) vdev_initialize(vd);
	}
	mutex_exit(&vd->vdev_initialize_lock);

	/*
	* Restart trimming if necessary. We do not restart trimming for cache
	* devices here. This is triggered by l2arc_rebuild_vdev()
	* asynchronously for the whole device or in l2arc_evict() as it evicts
	* space for upcoming writes.
	*/
	mutex_enter(&vd->vdev_trim_lock);
	if (vdev_writeable(vd) && !vd->vdev_isl2cache &&
	vd->vdev_trim_thread == NULL &&
	vd->vdev_trim_state == VDEV_TRIM_ACTIVE) {
	(void) vdev_trim(vd, vd->vdev_trim_rate, vd->vdev_trim_partial,
	vd->vdev_trim_secure);
	}
	mutex_exit(&vd->vdev_trim_lock);

	if (wasoffline \|\|
	(oldstate < VDEV_STATE_DEGRADED &&
	vd->vdev_state >= VDEV_STATE_DEGRADED))
	spa_event_notify(spa, vd, NULL, ESC_ZFS_VDEV_ONLINE);

	return (spa_vdev_state_exit(spa, vd, 0));
	}

	static int
	vdev_offline_locked(spa_t *spa, uint64_t guid, uint64_t flags)
	{
	vdev_t vd, tvd;
	int error = 0;
	uint64_t generation;
	metaslab_group_t *mg;

	top:
	spa_vdev_state_enter(spa, SCL_ALLOC);

	if ((vd = spa_lookup_by_guid(spa, guid, B_TRUE)) == NULL)
	return (spa_vdev_state_exit(spa, NULL, SET_ERROR(ENODEV)));

	if (!vd->vdev_ops->vdev_op_leaf)
	return (spa_vdev_state_exit(spa, NULL, SET_ERROR(ENOTSUP)));

	tvd = vd->vdev_top;
	mg = tvd->vdev_mg;
	generation = spa->spa_config_generation + 1;

	/*
	* If the device isn't already offline, try to offline it.
	*/
	if (!vd->vdev_offline) {
	/*
	* If this device has the only valid copy of some data,
	* don't allow it to be offlined. Log devices are always
	* expendable.
	*/
	if (!tvd->vdev_islog && vd->vdev_aux == NULL &&
	vdev_dtl_required(vd))
	return (spa_vdev_state_exit(spa, NULL,
	SET_ERROR(EBUSY)));

	/*
	* If the top-level is a slog and it has had allocations
	* then proceed. We check that the vdev's metaslab group
	* is not NULL since it's possible that we may have just
	* added this vdev but not yet initialized its metaslabs.
	*/
	if (tvd->vdev_islog && mg != NULL) {
	/*
	* Prevent any future allocations.
	*/
	metaslab_group_passivate(mg);
	(void) spa_vdev_state_exit(spa, vd, 0);

	error = spa_reset_logs(spa);

	/*
	* If the log device was successfully reset but has
	* checkpointed data, do not offline it.
	*/
	if (error == 0 &&
	tvd->vdev_checkpoint_sm != NULL) {
	ASSERT3U(space_map_allocated(
	tvd->vdev_checkpoint_sm), !=, 0);
	error = ZFS_ERR_CHECKPOINT_EXISTS;
	}

	spa_vdev_state_enter(spa, SCL_ALLOC);

	/*
	* Check to see if the config has changed.
	*/
	if (error \|\| generation != spa->spa_config_generation) {
	metaslab_group_activate(mg);
	if (error)
	return (spa_vdev_state_exit(spa,
	vd, error));
	(void) spa_vdev_state_exit(spa, vd, 0);
	goto top;
	}
	ASSERT0(tvd->vdev_stat.vs_alloc);
	}

	/*
	* Offline this device and reopen its top-level vdev.
	* If the top-level vdev is a log device then just offline
	* it. Otherwise, if this action results in the top-level
	* vdev becoming unusable, undo it and fail the request.
	*/
	vd->vdev_offline = B_TRUE;
	vdev_reopen(tvd);

	if (!tvd->vdev_islog && vd->vdev_aux == NULL &&
	vdev_is_dead(tvd)) {
	vd->vdev_offline = B_FALSE;
	vdev_reopen(tvd);
	return (spa_vdev_state_exit(spa, NULL,
	SET_ERROR(EBUSY)));
	}

	/*
	* Add the device back into the metaslab rotor so that
	* once we online the device it's open for business.
	*/
	if (tvd->vdev_islog && mg != NULL)
	metaslab_group_activate(mg);
	}

	vd->vdev_tmpoffline = !!(flags & ZFS_OFFLINE_TEMPORARY);

	return (spa_vdev_state_exit(spa, vd, 0));
	}

	int
	vdev_offline(spa_t *spa, uint64_t guid, uint64_t flags)
	{
	int error;

	mutex_enter(&spa->spa_vdev_top_lock);
	error = vdev_offline_locked(spa, guid, flags);
	mutex_exit(&spa->spa_vdev_top_lock);

	return (error);
	}

	/*
	* Clear the error counts associated with this vdev. Unlike vdev_online() and
	* vdev_offline(), we assume the spa config is locked. We also clear all
	* children. If 'vd' is NULL, then the user wants to clear all vdevs.
	*/
	void
	vdev_clear(spa_t spa, vdev_t vd)
	{
	vdev_t *rvd = spa->spa_root_vdev;

	ASSERT(spa_config_held(spa, SCL_STATE_ALL, RW_WRITER) == SCL_STATE_ALL);

	if (vd == NULL)
	vd = rvd;

	vd->vdev_stat.vs_read_errors = 0;
	vd->vdev_stat.vs_write_errors = 0;
	vd->vdev_stat.vs_checksum_errors = 0;
	vd->vdev_stat.vs_slow_ios = 0;

	for (int c = 0; c < vd->vdev_children; c++)
	vdev_clear(spa, vd->vdev_child[c]);

	/*
	* It makes no sense to "clear" an indirect vdev.
	*/
	if (!vdev_is_concrete(vd))
	return;

	/*
	* If we're in the FAULTED state or have experienced failed I/O, then
	* clear the persistent state and attempt to reopen the device. We
	* also mark the vdev config dirty, so that the new faulted state is
	* written out to disk.
	*/
	if (vd->vdev_faulted \|\| vd->vdev_degraded \|\|
	!vdev_readable(vd) \|\| !vdev_writeable(vd)) {
	/*
	* When reopening in response to a clear event, it may be due to
	* a fmadm repair request. In this case, if the device is
	* still broken, we want to still post the ereport again.
	*/
	vd->vdev_forcefault = B_TRUE;

	vd->vdev_faulted = vd->vdev_degraded = 0ULL;
	vd->vdev_cant_read = B_FALSE;
	vd->vdev_cant_write = B_FALSE;
	vd->vdev_stat.vs_aux = 0;

	vdev_reopen(vd == rvd ? rvd : vd->vdev_top);

	vd->vdev_forcefault = B_FALSE;

	if (vd != rvd && vdev_writeable(vd->vdev_top))
	vdev_state_dirty(vd->vdev_top);

	/* If a resilver isn't required, check if vdevs can be culled */
	if (vd->vdev_aux == NULL && !vdev_is_dead(vd) &&
	!dsl_scan_resilvering(spa->spa_dsl_pool) &&
	!dsl_scan_resilver_scheduled(spa->spa_dsl_pool))
	spa_async_request(spa, SPA_ASYNC_RESILVER_DONE);

	spa_event_notify(spa, vd, NULL, ESC_ZFS_VDEV_CLEAR);
	}

	/*
	* When clearing a FMA-diagnosed fault, we always want to
	* unspare the device, as we assume that the original spare was
	* done in response to the FMA fault.
	*/
	if (!vdev_is_dead(vd) && vd->vdev_parent != NULL &&
	vd->vdev_parent->vdev_ops == &vdev_spare_ops &&
	vd->vdev_parent->vdev_child[0] == vd)
	vd->vdev_unspare = B_TRUE;
	}

	boolean_t
	vdev_is_dead(vdev_t *vd)
	{
	/*
	* Holes and missing devices are always considered "dead".
	* This simplifies the code since we don't have to check for
	* these types of devices in the various code paths.
	* Instead we rely on the fact that we skip over dead devices
	* before issuing I/O to them.
	*/
	return (vd->vdev_state < VDEV_STATE_DEGRADED \|\|
	vd->vdev_ops == &vdev_hole_ops \|\|
	vd->vdev_ops == &vdev_missing_ops);
	}

	boolean_t
	vdev_readable(vdev_t *vd)
	{
	return (!vdev_is_dead(vd) && !vd->vdev_cant_read);
	}

	boolean_t
	vdev_writeable(vdev_t *vd)
	{
	return (!vdev_is_dead(vd) && !vd->vdev_cant_write &&
	vdev_is_concrete(vd));
	}

	boolean_t
	vdev_allocatable(vdev_t *vd)
	{
	uint64_t state = vd->vdev_state;

	/*
	* We currently allow allocations from vdevs which may be in the
	* process of reopening (i.e. VDEV_STATE_CLOSED). If the device
	* fails to reopen then we'll catch it later when we're holding
	* the proper locks. Note that we have to get the vdev state
	* in a local variable because although it changes atomically,
	* we're asking two separate questions about it.
	*/
	return (!(state < VDEV_STATE_DEGRADED && state != VDEV_STATE_CLOSED) &&
	!vd->vdev_cant_write && vdev_is_concrete(vd) &&
	vd->vdev_mg->mg_initialized);
	}

	boolean_t
	vdev_accessible(vdev_t vd, zio_t zio)
	{
	ASSERT(zio->io_vd == vd);

	if (vdev_is_dead(vd) \|\| vd->vdev_remove_wanted)
	return (B_FALSE);

	if (zio->io_type == ZIO_TYPE_READ)
	return (!vd->vdev_cant_read);

	if (zio->io_type == ZIO_TYPE_WRITE)
	return (!vd->vdev_cant_write);

	return (B_TRUE);
	}

	static void
	vdev_get_child_stat(vdev_t cvd, vdev_stat_t vs, vdev_stat_t *cvs)
	{
	for (int t = 0; t < VS_ZIO_TYPES; t++) {
	vs->vs_ops[t] += cvs->vs_ops[t];
	vs->vs_bytes[t] += cvs->vs_bytes[t];
	}

	cvs->vs_scan_removing = cvd->vdev_removing;
	}

	/*
	* Get extended stats
	*/
	static void
	vdev_get_child_stat_ex(vdev_t cvd, vdev_stat_ex_t vsx, vdev_stat_ex_t *cvsx)
	{
	int t, b;
	for (t = 0; t < ZIO_TYPES; t++) {
	for (b = 0; b < ARRAY_SIZE(vsx->vsx_disk_histo[0]); b++)
	vsx->vsx_disk_histo[t][b] += cvsx->vsx_disk_histo[t][b];

	for (b = 0; b < ARRAY_SIZE(vsx->vsx_total_histo[0]); b++) {
	vsx->vsx_total_histo[t][b] +=
	cvsx->vsx_total_histo[t][b];
	}
	}

	for (t = 0; t < ZIO_PRIORITY_NUM_QUEUEABLE; t++) {
	for (b = 0; b < ARRAY_SIZE(vsx->vsx_queue_histo[0]); b++) {
	vsx->vsx_queue_histo[t][b] +=
	cvsx->vsx_queue_histo[t][b];
	}
	vsx->vsx_active_queue[t] += cvsx->vsx_active_queue[t];
	vsx->vsx_pend_queue[t] += cvsx->vsx_pend_queue[t];

	for (b = 0; b < ARRAY_SIZE(vsx->vsx_ind_histo[0]); b++)
	vsx->vsx_ind_histo[t][b] += cvsx->vsx_ind_histo[t][b];

	for (b = 0; b < ARRAY_SIZE(vsx->vsx_agg_histo[0]); b++)
	vsx->vsx_agg_histo[t][b] += cvsx->vsx_agg_histo[t][b];
	}

	}

	boolean_t
	vdev_is_spacemap_addressable(vdev_t *vd)
	{
	if (spa_feature_is_active(vd->vdev_spa, SPA_FEATURE_SPACEMAP_V2))
	return (B_TRUE);

	/*
	* If double-word space map entries are not enabled we assume
	* 47 bits of the space map entry are dedicated to the entry's
	* offset (see SM_OFFSET_BITS in space_map.h). We then use that
	* to calculate the maximum address that can be described by a
	* space map entry for the given device.
	*/
	uint64_t shift = vd->vdev_ashift + SM_OFFSET_BITS;

	if (shift >= 63) /* detect potential overflow */
	return (B_TRUE);

	return (vd->vdev_asize < (1ULL << shift));
	}

	/*
	* Get statistics for the given vdev.
	*/
	static void
	vdev_get_stats_ex_impl(vdev_t vd, vdev_stat_t vs, vdev_stat_ex_t *vsx)
	{
	int t;
	/*
	* If we're getting stats on the root vdev, aggregate the I/O counts
	* over all top-level vdevs (i.e. the direct children of the root).
	*/
	if (!vd->vdev_ops->vdev_op_leaf) {
	if (vs) {
	memset(vs->vs_ops, 0, sizeof (vs->vs_ops));
	memset(vs->vs_bytes, 0, sizeof (vs->vs_bytes));
	}
	if (vsx)
	memset(vsx, 0, sizeof (*vsx));

	for (int c = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];
	vdev_stat_t *cvs = &cvd->vdev_stat;
	vdev_stat_ex_t *cvsx = &cvd->vdev_stat_ex;

	vdev_get_stats_ex_impl(cvd, cvs, cvsx);
	if (vs)
	vdev_get_child_stat(cvd, vs, cvs);
	if (vsx)
	vdev_get_child_stat_ex(cvd, vsx, cvsx);

	}
	} else {
	/*
	* We're a leaf. Just copy our ZIO active queue stats in. The
	* other leaf stats are updated in vdev_stat_update().
	*/
	if (!vsx)
	return;

	memcpy(vsx, &vd->vdev_stat_ex, sizeof (vd->vdev_stat_ex));

	for (t = 0; t < ARRAY_SIZE(vd->vdev_queue.vq_class); t++) {
	vsx->vsx_active_queue[t] =
	vd->vdev_queue.vq_class[t].vqc_active;
	vsx->vsx_pend_queue[t] = avl_numnodes(
	&vd->vdev_queue.vq_class[t].vqc_queued_tree);
	}
	}
	}

	void
	vdev_get_stats_ex(vdev_t vd, vdev_stat_t vs, vdev_stat_ex_t *vsx)
	{
	vdev_t *tvd = vd->vdev_top;
	mutex_enter(&vd->vdev_stat_lock);
	if (vs) {
	bcopy(&vd->vdev_stat, vs, sizeof (*vs));
	vs->vs_timestamp = gethrtime() - vs->vs_timestamp;
	vs->vs_state = vd->vdev_state;
	vs->vs_rsize = vdev_get_min_asize(vd);

	if (vd->vdev_ops->vdev_op_leaf) {
	vs->vs_rsize += VDEV_LABEL_START_SIZE +
	VDEV_LABEL_END_SIZE;
	/*
	* Report initializing progress. Since we don't
	* have the initializing locks held, this is only
	* an estimate (although a fairly accurate one).
	*/
	vs->vs_initialize_bytes_done =
	vd->vdev_initialize_bytes_done;
	vs->vs_initialize_bytes_est =
	vd->vdev_initialize_bytes_est;
	vs->vs_initialize_state = vd->vdev_initialize_state;
	vs->vs_initialize_action_time =
	vd->vdev_initialize_action_time;

	/*
	* Report manual TRIM progress. Since we don't have
	* the manual TRIM locks held, this is only an
	* estimate (although fairly accurate one).
	*/
	vs->vs_trim_notsup = !vd->vdev_has_trim;
	vs->vs_trim_bytes_done = vd->vdev_trim_bytes_done;
	vs->vs_trim_bytes_est = vd->vdev_trim_bytes_est;
	vs->vs_trim_state = vd->vdev_trim_state;
	vs->vs_trim_action_time = vd->vdev_trim_action_time;

	/* Set when there is a deferred resilver. */
	vs->vs_resilver_deferred = vd->vdev_resilver_deferred;
	}

	/*
	* Report expandable space on top-level, non-auxiliary devices
	* only. The expandable space is reported in terms of metaslab
	* sized units since that determines how much space the pool
	* can expand.
	*/
	if (vd->vdev_aux == NULL && tvd != NULL) {
	vs->vs_esize = P2ALIGN(
	vd->vdev_max_asize - vd->vdev_asize,
	1ULL << tvd->vdev_ms_shift);
	}

	vs->vs_configured_ashift = vd->vdev_top != NULL
	? vd->vdev_top->vdev_ashift : vd->vdev_ashift;
	vs->vs_logical_ashift = vd->vdev_logical_ashift;
	vs->vs_physical_ashift = vd->vdev_physical_ashift;

	/*
	* Report fragmentation and rebuild progress for top-level,
	* non-auxiliary, concrete devices.
	*/
	if (vd->vdev_aux == NULL && vd == vd->vdev_top &&
	vdev_is_concrete(vd)) {
	vs->vs_fragmentation = (vd->vdev_mg != NULL) ?
	vd->vdev_mg->mg_fragmentation : 0;
	}
	}

	vdev_get_stats_ex_impl(vd, vs, vsx);
	mutex_exit(&vd->vdev_stat_lock);
	}

	void
	vdev_get_stats(vdev_t vd, vdev_stat_t vs)
	{
	return (vdev_get_stats_ex(vd, vs, NULL));
	}

	void
	vdev_clear_stats(vdev_t *vd)
	{
	mutex_enter(&vd->vdev_stat_lock);
	vd->vdev_stat.vs_space = 0;
	vd->vdev_stat.vs_dspace = 0;
	vd->vdev_stat.vs_alloc = 0;
	mutex_exit(&vd->vdev_stat_lock);
	}

	void
	vdev_scan_stat_init(vdev_t *vd)
	{
	vdev_stat_t *vs = &vd->vdev_stat;

	for (int c = 0; c < vd->vdev_children; c++)
	vdev_scan_stat_init(vd->vdev_child[c]);

	mutex_enter(&vd->vdev_stat_lock);
	vs->vs_scan_processed = 0;
	mutex_exit(&vd->vdev_stat_lock);
	}

	void
	vdev_stat_update(zio_t *zio, uint64_t psize)
	{
	spa_t *spa = zio->io_spa;
	vdev_t *rvd = spa->spa_root_vdev;
	vdev_t *vd = zio->io_vd ? zio->io_vd : rvd;
	vdev_t *pvd;
	uint64_t txg = zio->io_txg;
	vdev_stat_t *vs = &vd->vdev_stat;
	vdev_stat_ex_t *vsx = &vd->vdev_stat_ex;
	zio_type_t type = zio->io_type;
	int flags = zio->io_flags;

	/*
	* If this i/o is a gang leader, it didn't do any actual work.
	*/
	if (zio->io_gang_tree)
	return;

	if (zio->io_error == 0) {
	/*
	* If this is a root i/o, don't count it -- we've already
	* counted the top-level vdevs, and vdev_get_stats() will
	* aggregate them when asked. This reduces contention on
	* the root vdev_stat_lock and implicitly handles blocks
	* that compress away to holes, for which there is no i/o.
	* (Holes never create vdev children, so all the counters
	* remain zero, which is what we want.)
	*
	* Note: this only applies to successful i/o (io_error == 0)
	* because unlike i/o counts, errors are not additive.
	* When reading a ditto block, for example, failure of
	* one top-level vdev does not imply a root-level error.
	*/
	if (vd == rvd)
	return;

	ASSERT(vd == zio->io_vd);

	if (flags & ZIO_FLAG_IO_BYPASS)
	return;

	mutex_enter(&vd->vdev_stat_lock);

	if (flags & ZIO_FLAG_IO_REPAIR) {
	/*
	* Repair is the result of a resilver issued by the
	* scan thread (spa_sync).
	*/
	if (flags & ZIO_FLAG_SCAN_THREAD) {
	dsl_scan_t *scn = spa->spa_dsl_pool->dp_scan;
	dsl_scan_phys_t *scn_phys = &scn->scn_phys;
	uint64_t *processed = &scn_phys->scn_processed;

	if (vd->vdev_ops->vdev_op_leaf)
	atomic_add_64(processed, psize);
	vs->vs_scan_processed += psize;
	}

	/*
	* Repair is the result of a rebuild issued by the
	* rebuild thread (vdev_rebuild_thread).
	*/
	if (zio->io_priority == ZIO_PRIORITY_REBUILD) {
	vdev_t *tvd = vd->vdev_top;
	vdev_rebuild_t *vr = &tvd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;
	uint64_t *rebuilt = &vrp->vrp_bytes_rebuilt;

	if (vd->vdev_ops->vdev_op_leaf)
	atomic_add_64(rebuilt, psize);
	vs->vs_rebuild_processed += psize;
	}

	if (flags & ZIO_FLAG_SELF_HEAL)
	vs->vs_self_healed += psize;
	}

	/*
	* The bytes/ops/histograms are recorded at the leaf level and
	* aggregated into the higher level vdevs in vdev_get_stats().
	*/
	if (vd->vdev_ops->vdev_op_leaf &&
	(zio->io_priority < ZIO_PRIORITY_NUM_QUEUEABLE)) {
	zio_type_t vs_type = type;
	zio_priority_t priority = zio->io_priority;

	/*
	* TRIM ops and bytes are reported to user space as
	* ZIO_TYPE_IOCTL. This is done to preserve the
	* vdev_stat_t structure layout for user space.
	*/
	if (type == ZIO_TYPE_TRIM)
	vs_type = ZIO_TYPE_IOCTL;

	/*
	* Solely for the purposes of 'zpool iostat -lqrw'
	* reporting use the priority to catagorize the IO.
	* Only the following are reported to user space:
	*
	* ZIO_PRIORITY_SYNC_READ,
	* ZIO_PRIORITY_SYNC_WRITE,
	* ZIO_PRIORITY_ASYNC_READ,
	* ZIO_PRIORITY_ASYNC_WRITE,
	* ZIO_PRIORITY_SCRUB,
	* ZIO_PRIORITY_TRIM.
	*/
	if (priority == ZIO_PRIORITY_REBUILD) {
	priority = ((type == ZIO_TYPE_WRITE) ?
	ZIO_PRIORITY_ASYNC_WRITE :
	ZIO_PRIORITY_SCRUB);
	} else if (priority == ZIO_PRIORITY_INITIALIZING) {
	ASSERT3U(type, ==, ZIO_TYPE_WRITE);
	priority = ZIO_PRIORITY_ASYNC_WRITE;
	} else if (priority == ZIO_PRIORITY_REMOVAL) {
	priority = ((type == ZIO_TYPE_WRITE) ?
	ZIO_PRIORITY_ASYNC_WRITE :
	ZIO_PRIORITY_ASYNC_READ);
	}

	vs->vs_ops[vs_type]++;
	vs->vs_bytes[vs_type] += psize;

	if (flags & ZIO_FLAG_DELEGATED) {
	vsx->vsx_agg_histo[priority]
	[RQ_HISTO(zio->io_size)]++;
	} else {
	vsx->vsx_ind_histo[priority]
	[RQ_HISTO(zio->io_size)]++;
	}

	if (zio->io_delta && zio->io_delay) {
	vsx->vsx_queue_histo[priority]
	[L_HISTO(zio->io_delta - zio->io_delay)]++;
	vsx->vsx_disk_histo[type]
	[L_HISTO(zio->io_delay)]++;
	vsx->vsx_total_histo[type]
	[L_HISTO(zio->io_delta)]++;
	}
	}

	mutex_exit(&vd->vdev_stat_lock);
	return;
	}

	if (flags & ZIO_FLAG_SPECULATIVE)
	return;

	/*
	* If this is an I/O error that is going to be retried, then ignore the
	* error. Otherwise, the user may interpret B_FAILFAST I/O errors as
	* hard errors, when in reality they can happen for any number of
	* innocuous reasons (bus resets, MPxIO link failure, etc).
	*/
	if (zio->io_error == EIO &&
	!(zio->io_flags & ZIO_FLAG_IO_RETRY))
	return;

	/*
	* Intent logs writes won't propagate their error to the root
	* I/O so don't mark these types of failures as pool-level
	* errors.
	*/
	if (zio->io_vd == NULL && (zio->io_flags & ZIO_FLAG_DONT_PROPAGATE))
	return;

	if (spa->spa_load_state == SPA_LOAD_NONE &&
	type == ZIO_TYPE_WRITE && txg != 0 &&
	(!(flags & ZIO_FLAG_IO_REPAIR) \|\|
	(flags & ZIO_FLAG_SCAN_THREAD) \|\|
	spa->spa_claiming)) {
	/*
	* This is either a normal write (not a repair), or it's
	* a repair induced by the scrub thread, or it's a repair
	* made by zil_claim() during spa_load() in the first txg.
	* In the normal case, we commit the DTL change in the same
	* txg as the block was born. In the scrub-induced repair
	* case, we know that scrubs run in first-pass syncing context,
	* so we commit the DTL change in spa_syncing_txg(spa).
	* In the zil_claim() case, we commit in spa_first_txg(spa).
	*
	* We currently do not make DTL entries for failed spontaneous
	* self-healing writes triggered by normal (non-scrubbing)
	* reads, because we have no transactional context in which to
	* do so -- and it's not clear that it'd be desirable anyway.
	*/
	if (vd->vdev_ops->vdev_op_leaf) {
	uint64_t commit_txg = txg;
	if (flags & ZIO_FLAG_SCAN_THREAD) {
	ASSERT(flags & ZIO_FLAG_IO_REPAIR);
	ASSERT(spa_sync_pass(spa) == 1);
	vdev_dtl_dirty(vd, DTL_SCRUB, txg, 1);
	commit_txg = spa_syncing_txg(spa);
	} else if (spa->spa_claiming) {
	ASSERT(flags & ZIO_FLAG_IO_REPAIR);
	commit_txg = spa_first_txg(spa);
	}
	ASSERT(commit_txg >= spa_syncing_txg(spa));
	if (vdev_dtl_contains(vd, DTL_MISSING, txg, 1))
	return;
	for (pvd = vd; pvd != rvd; pvd = pvd->vdev_parent)
	vdev_dtl_dirty(pvd, DTL_PARTIAL, txg, 1);
	vdev_dirty(vd->vdev_top, VDD_DTL, vd, commit_txg);
	}
	if (vd != rvd)
	vdev_dtl_dirty(vd, DTL_MISSING, txg, 1);
	}
	}

	int64_t
	vdev_deflated_space(vdev_t *vd, int64_t space)
	{
	ASSERT((space & (SPA_MINBLOCKSIZE-1)) == 0);
	ASSERT(vd->vdev_deflate_ratio != 0 \|\| vd->vdev_isl2cache);

	return ((space >> SPA_MINBLOCKSHIFT) * vd->vdev_deflate_ratio);
	}

	/*
	* Update the in-core space usage stats for this vdev, its metaslab class,
	* and the root vdev.
	*/
	void
	vdev_space_update(vdev_t *vd, int64_t alloc_delta, int64_t defer_delta,
	int64_t space_delta)
	{
	int64_t dspace_delta;
	spa_t *spa = vd->vdev_spa;
	vdev_t *rvd = spa->spa_root_vdev;

	ASSERT(vd == vd->vdev_top);

	/*
	* Apply the inverse of the psize-to-asize (ie. RAID-Z) space-expansion
	* factor. We must calculate this here and not at the root vdev
	* because the root vdev's psize-to-asize is simply the max of its
	* children's, thus not accurate enough for us.
	*/
	dspace_delta = vdev_deflated_space(vd, space_delta);

	mutex_enter(&vd->vdev_stat_lock);
	/* ensure we won't underflow */
	if (alloc_delta < 0) {
	ASSERT3U(vd->vdev_stat.vs_alloc, >=, -alloc_delta);
	}

	vd->vdev_stat.vs_alloc += alloc_delta;
	vd->vdev_stat.vs_space += space_delta;
	vd->vdev_stat.vs_dspace += dspace_delta;
	mutex_exit(&vd->vdev_stat_lock);

	/* every class but log contributes to root space stats */
	if (vd->vdev_mg != NULL && !vd->vdev_islog) {
	ASSERT(!vd->vdev_isl2cache);
	mutex_enter(&rvd->vdev_stat_lock);
	rvd->vdev_stat.vs_alloc += alloc_delta;
	rvd->vdev_stat.vs_space += space_delta;
	rvd->vdev_stat.vs_dspace += dspace_delta;
	mutex_exit(&rvd->vdev_stat_lock);
	}
	/* Note: metaslab_class_space_update moved to metaslab_space_update */
	}

	/*
	* Mark a top-level vdev's config as dirty, placing it on the dirty list
	* so that it will be written out next time the vdev configuration is synced.
	* If the root vdev is specified (vdev_top == NULL), dirty all top-level vdevs.
	*/
	void
	vdev_config_dirty(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;
	vdev_t *rvd = spa->spa_root_vdev;
	int c;

	ASSERT(spa_writeable(spa));

	/*
	* If this is an aux vdev (as with l2cache and spare devices), then we
	* update the vdev config manually and set the sync flag.
	*/
	if (vd->vdev_aux != NULL) {
	spa_aux_vdev_t *sav = vd->vdev_aux;
	nvlist_t **aux;
	uint_t naux;

	for (c = 0; c < sav->sav_count; c++) {
	if (sav->sav_vdevs[c] == vd)
	break;
	}

	if (c == sav->sav_count) {
	/*
	* We're being removed. There's nothing more to do.
	*/
	ASSERT(sav->sav_sync == B_TRUE);
	return;
	}

	sav->sav_sync = B_TRUE;

	if (nvlist_lookup_nvlist_array(sav->sav_config,
	ZPOOL_CONFIG_L2CACHE, &aux, &naux) != 0) {
	VERIFY(nvlist_lookup_nvlist_array(sav->sav_config,
	ZPOOL_CONFIG_SPARES, &aux, &naux) == 0);
	}

	ASSERT(c < naux);

	/*
	* Setting the nvlist in the middle if the array is a little
	* sketchy, but it will work.
	*/
	nvlist_free(aux[c]);
	aux[c] = vdev_config_generate(spa, vd, B_TRUE, 0);

	return;
	}

	/*
	* The dirty list is protected by the SCL_CONFIG lock. The caller
	* must either hold SCL_CONFIG as writer, or must be the sync thread
	* (which holds SCL_CONFIG as reader). There's only one sync thread,
	* so this is sufficient to ensure mutual exclusion.
	*/
	ASSERT(spa_config_held(spa, SCL_CONFIG, RW_WRITER) \|\|
	(dsl_pool_sync_context(spa_get_dsl(spa)) &&
	spa_config_held(spa, SCL_CONFIG, RW_READER)));

	if (vd == rvd) {
	for (c = 0; c < rvd->vdev_children; c++)
	vdev_config_dirty(rvd->vdev_child[c]);
	} else {
	ASSERT(vd == vd->vdev_top);

	if (!list_link_active(&vd->vdev_config_dirty_node) &&
	vdev_is_concrete(vd)) {
	list_insert_head(&spa->spa_config_dirty_list, vd);
	}
	}
	}

	void
	vdev_config_clean(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(spa_config_held(spa, SCL_CONFIG, RW_WRITER) \|\|
	(dsl_pool_sync_context(spa_get_dsl(spa)) &&
	spa_config_held(spa, SCL_CONFIG, RW_READER)));

	ASSERT(list_link_active(&vd->vdev_config_dirty_node));
	list_remove(&spa->spa_config_dirty_list, vd);
	}

	/*
	* Mark a top-level vdev's state as dirty, so that the next pass of
	* spa_sync() can convert this into vdev_config_dirty(). We distinguish
	* the state changes from larger config changes because they require
	* much less locking, and are often needed for administrative actions.
	*/
	void
	vdev_state_dirty(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(spa_writeable(spa));
	ASSERT(vd == vd->vdev_top);

	/*
	* The state list is protected by the SCL_STATE lock. The caller
	* must either hold SCL_STATE as writer, or must be the sync thread
	* (which holds SCL_STATE as reader). There's only one sync thread,
	* so this is sufficient to ensure mutual exclusion.
	*/
	ASSERT(spa_config_held(spa, SCL_STATE, RW_WRITER) \|\|
	(dsl_pool_sync_context(spa_get_dsl(spa)) &&
	spa_config_held(spa, SCL_STATE, RW_READER)));

	if (!list_link_active(&vd->vdev_state_dirty_node) &&
	vdev_is_concrete(vd))
	list_insert_head(&spa->spa_state_dirty_list, vd);
	}

	void
	vdev_state_clean(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(spa_config_held(spa, SCL_STATE, RW_WRITER) \|\|
	(dsl_pool_sync_context(spa_get_dsl(spa)) &&
	spa_config_held(spa, SCL_STATE, RW_READER)));

	ASSERT(list_link_active(&vd->vdev_state_dirty_node));
	list_remove(&spa->spa_state_dirty_list, vd);
	}

	/*
	* Propagate vdev state up from children to parent.
	*/
	void
	vdev_propagate_state(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;
	vdev_t *rvd = spa->spa_root_vdev;
	int degraded = 0, faulted = 0;
	int corrupted = 0;
	vdev_t *child;

	if (vd->vdev_children > 0) {
	for (int c = 0; c < vd->vdev_children; c++) {
	child = vd->vdev_child[c];

	/*
	* Don't factor holes or indirect vdevs into the
	* decision.
	*/
	if (!vdev_is_concrete(child))
	continue;

	if (!vdev_readable(child) \|\|
	(!vdev_writeable(child) && spa_writeable(spa))) {
	/*
	* Root special: if there is a top-level log
	* device, treat the root vdev as if it were
	* degraded.
	*/
	if (child->vdev_islog && vd == rvd)
	degraded++;
	else
	faulted++;
	} else if (child->vdev_state <= VDEV_STATE_DEGRADED) {
	degraded++;
	}

	if (child->vdev_stat.vs_aux == VDEV_AUX_CORRUPT_DATA)
	corrupted++;
	}

	vd->vdev_ops->vdev_op_state_change(vd, faulted, degraded);

	/*
	* Root special: if there is a top-level vdev that cannot be
	* opened due to corrupted metadata, then propagate the root
	* vdev's aux state as 'corrupt' rather than 'insufficient
	* replicas'.
	*/
	if (corrupted && vd == rvd &&
	rvd->vdev_state == VDEV_STATE_CANT_OPEN)
	vdev_set_state(rvd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_CORRUPT_DATA);
	}

	if (vd->vdev_parent)
	vdev_propagate_state(vd->vdev_parent);
	}

	/*
	* Set a vdev's state. If this is during an open, we don't update the parent
	* state, because we're in the process of opening children depth-first.
	* Otherwise, we propagate the change to the parent.
	*
	* If this routine places a device in a faulted state, an appropriate ereport is
	* generated.
	*/
	void
	vdev_set_state(vdev_t *vd, boolean_t isopen, vdev_state_t state, vdev_aux_t aux)
	{
	uint64_t save_state;
	spa_t *spa = vd->vdev_spa;

	if (state == vd->vdev_state) {
	/*
	* Since vdev_offline() code path is already in an offline
	* state we can miss a statechange event to OFFLINE. Check
	* the previous state to catch this condition.
	*/
	if (vd->vdev_ops->vdev_op_leaf &&
	(state == VDEV_STATE_OFFLINE) &&
	(vd->vdev_prevstate >= VDEV_STATE_FAULTED)) {
	/* post an offline state change */
	zfs_post_state_change(spa, vd, vd->vdev_prevstate);
	}
	vd->vdev_stat.vs_aux = aux;
	return;
	}

	save_state = vd->vdev_state;

	vd->vdev_state = state;
	vd->vdev_stat.vs_aux = aux;

	/*
	* If we are setting the vdev state to anything but an open state, then
	* always close the underlying device unless the device has requested
	* a delayed close (i.e. we're about to remove or fault the device).
	* Otherwise, we keep accessible but invalid devices open forever.
	* We don't call vdev_close() itself, because that implies some extra
	* checks (offline, etc) that we don't want here. This is limited to
	* leaf devices, because otherwise closing the device will affect other
	* children.
	*/
	if (!vd->vdev_delayed_close && vdev_is_dead(vd) &&
	vd->vdev_ops->vdev_op_leaf)
	vd->vdev_ops->vdev_op_close(vd);

	if (vd->vdev_removed &&
	state == VDEV_STATE_CANT_OPEN &&
	(aux == VDEV_AUX_OPEN_FAILED \|\| vd->vdev_checkremove)) {
	/*
	* If the previous state is set to VDEV_STATE_REMOVED, then this
	* device was previously marked removed and someone attempted to
	* reopen it. If this failed due to a nonexistent device, then
	* keep the device in the REMOVED state. We also let this be if
	* it is one of our special test online cases, which is only
	* attempting to online the device and shouldn't generate an FMA
	* fault.
	*/
	vd->vdev_state = VDEV_STATE_REMOVED;
	vd->vdev_stat.vs_aux = VDEV_AUX_NONE;
	} else if (state == VDEV_STATE_REMOVED) {
	vd->vdev_removed = B_TRUE;
	} else if (state == VDEV_STATE_CANT_OPEN) {
	/*
	* If we fail to open a vdev during an import or recovery, we
	* mark it as "not available", which signifies that it was
	* never there to begin with. Failure to open such a device
	* is not considered an error.
	*/
	if ((spa_load_state(spa) == SPA_LOAD_IMPORT \|\|
	spa_load_state(spa) == SPA_LOAD_RECOVER) &&
	vd->vdev_ops->vdev_op_leaf)
	vd->vdev_not_present = 1;

	/*
	* Post the appropriate ereport. If the 'prevstate' field is
	* set to something other than VDEV_STATE_UNKNOWN, it indicates
	* that this is part of a vdev_reopen(). In this case, we don't
	* want to post the ereport if the device was already in the
	* CANT_OPEN state beforehand.
	*
	* If the 'checkremove' flag is set, then this is an attempt to
	* online the device in response to an insertion event. If we
	* hit this case, then we have detected an insertion event for a
	* faulted or offline device that wasn't in the removed state.
	* In this scenario, we don't post an ereport because we are
	* about to replace the device, or attempt an online with
	* vdev_forcefault, which will generate the fault for us.
	*/
	if ((vd->vdev_prevstate != state \|\| vd->vdev_forcefault) &&
	!vd->vdev_not_present && !vd->vdev_checkremove &&
	vd != spa->spa_root_vdev) {
	const char *class;

	switch (aux) {
	case VDEV_AUX_OPEN_FAILED:
	class = FM_EREPORT_ZFS_DEVICE_OPEN_FAILED;
	break;
	case VDEV_AUX_CORRUPT_DATA:
	class = FM_EREPORT_ZFS_DEVICE_CORRUPT_DATA;
	break;
	case VDEV_AUX_NO_REPLICAS:
	class = FM_EREPORT_ZFS_DEVICE_NO_REPLICAS;
	break;
	case VDEV_AUX_BAD_GUID_SUM:
	class = FM_EREPORT_ZFS_DEVICE_BAD_GUID_SUM;
	break;
	case VDEV_AUX_TOO_SMALL:
	class = FM_EREPORT_ZFS_DEVICE_TOO_SMALL;
	break;
	case VDEV_AUX_BAD_LABEL:
	class = FM_EREPORT_ZFS_DEVICE_BAD_LABEL;
	break;
	case VDEV_AUX_BAD_ASHIFT:
	class = FM_EREPORT_ZFS_DEVICE_BAD_ASHIFT;
	break;
	default:
	class = FM_EREPORT_ZFS_DEVICE_UNKNOWN;
	}

	(void) zfs_ereport_post(class, spa, vd, NULL, NULL,
	- save_state, 0);
	+ save_state);
	}

	/* Erase any notion of persistent removed state */
	vd->vdev_removed = B_FALSE;
	} else {
	vd->vdev_removed = B_FALSE;
	}

	/*
	* Notify ZED of any significant state-change on a leaf vdev.
	*
	*/
	if (vd->vdev_ops->vdev_op_leaf) {
	/* preserve original state from a vdev_reopen() */
	if ((vd->vdev_prevstate != VDEV_STATE_UNKNOWN) &&
	(vd->vdev_prevstate != vd->vdev_state) &&
	(save_state <= VDEV_STATE_CLOSED))
	save_state = vd->vdev_prevstate;

	/* filter out state change due to initial vdev_open */
	if (save_state > VDEV_STATE_CLOSED)
	zfs_post_state_change(spa, vd, save_state);
	}

	if (!isopen && vd->vdev_parent)
	vdev_propagate_state(vd->vdev_parent);
	}

	boolean_t
	vdev_children_are_offline(vdev_t *vd)
	{
	ASSERT(!vd->vdev_ops->vdev_op_leaf);

	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	if (vd->vdev_child[i]->vdev_state != VDEV_STATE_OFFLINE)
	return (B_FALSE);
	}

	return (B_TRUE);
	}

	/*
	* Check the vdev configuration to ensure that it's capable of supporting
	* a root pool. We do not support partial configuration.
	*/
	boolean_t
	vdev_is_bootable(vdev_t *vd)
	{
	if (!vd->vdev_ops->vdev_op_leaf) {
	const char *vdev_type = vd->vdev_ops->vdev_op_type;

	if (strcmp(vdev_type, VDEV_TYPE_MISSING) == 0 \|\|
	strcmp(vdev_type, VDEV_TYPE_INDIRECT) == 0) {
	return (B_FALSE);
	}
	}

	for (int c = 0; c < vd->vdev_children; c++) {
	if (!vdev_is_bootable(vd->vdev_child[c]))
	return (B_FALSE);
	}
	return (B_TRUE);
	}

	boolean_t
	vdev_is_concrete(vdev_t *vd)
	{
	vdev_ops_t *ops = vd->vdev_ops;
	if (ops == &vdev_indirect_ops \|\| ops == &vdev_hole_ops \|\|
	ops == &vdev_missing_ops \|\| ops == &vdev_root_ops) {
	return (B_FALSE);
	} else {
	return (B_TRUE);
	}
	}

	/*
	* Determine if a log device has valid content. If the vdev was
	* removed or faulted in the MOS config then we know that
	* the content on the log device has already been written to the pool.
	*/
	boolean_t
	vdev_log_state_valid(vdev_t *vd)
	{
	if (vd->vdev_ops->vdev_op_leaf && !vd->vdev_faulted &&
	!vd->vdev_removed)
	return (B_TRUE);

	for (int c = 0; c < vd->vdev_children; c++)
	if (vdev_log_state_valid(vd->vdev_child[c]))
	return (B_TRUE);

	return (B_FALSE);
	}

	/*
	* Expand a vdev if possible.
	*/
	void
	vdev_expand(vdev_t *vd, uint64_t txg)
	{
	ASSERT(vd->vdev_top == vd);
	ASSERT(spa_config_held(vd->vdev_spa, SCL_ALL, RW_WRITER) == SCL_ALL);
	ASSERT(vdev_is_concrete(vd));

	vdev_set_deflate_ratio(vd);

	if ((vd->vdev_asize >> vd->vdev_ms_shift) > vd->vdev_ms_count &&
	vdev_is_concrete(vd)) {
	vdev_metaslab_group_create(vd);
	VERIFY(vdev_metaslab_init(vd, txg) == 0);
	vdev_config_dirty(vd);
	}
	}

	/*
	* Split a vdev.
	*/
	void
	vdev_split(vdev_t *vd)
	{
	vdev_t cvd, pvd = vd->vdev_parent;

	vdev_remove_child(pvd, vd);
	vdev_compact_children(pvd);

	cvd = pvd->vdev_child[0];
	if (pvd->vdev_children == 1) {
	vdev_remove_parent(cvd);
	cvd->vdev_splitting = B_TRUE;
	}
	vdev_propagate_state(cvd);
	}

	void
	vdev_deadman(vdev_t vd, char tag)
	{
	for (int c = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];

	vdev_deadman(cvd, tag);
	}

	if (vd->vdev_ops->vdev_op_leaf) {
	vdev_queue_t *vq = &vd->vdev_queue;

	mutex_enter(&vq->vq_lock);
	if (avl_numnodes(&vq->vq_active_tree) > 0) {
	spa_t *spa = vd->vdev_spa;
	zio_t *fio;
	uint64_t delta;

	zfs_dbgmsg("slow vdev: %s has %d active IOs",
	vd->vdev_path, avl_numnodes(&vq->vq_active_tree));

	/*
	* Look at the head of all the pending queues,
	* if any I/O has been outstanding for longer than
	* the spa_deadman_synctime invoke the deadman logic.
	*/
	fio = avl_first(&vq->vq_active_tree);
	delta = gethrtime() - fio->io_timestamp;
	if (delta > spa_deadman_synctime(spa))
	zio_deadman(fio, tag);
	}
	mutex_exit(&vq->vq_lock);
	}
	}

	void
	vdev_defer_resilver(vdev_t *vd)
	{
	ASSERT(vd->vdev_ops->vdev_op_leaf);

	vd->vdev_resilver_deferred = B_TRUE;
	vd->vdev_spa->spa_resilver_deferred = B_TRUE;
	}

	/*
	* Clears the resilver deferred flag on all leaf devs under vd. Returns
	* B_TRUE if we have devices that need to be resilvered and are available to
	* accept resilver I/Os.
	*/
	boolean_t
	vdev_clear_resilver_deferred(vdev_t vd, dmu_tx_t tx)
	{
	boolean_t resilver_needed = B_FALSE;
	spa_t *spa = vd->vdev_spa;

	for (int c = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];
	resilver_needed \|= vdev_clear_resilver_deferred(cvd, tx);
	}

	if (vd == spa->spa_root_vdev &&
	spa_feature_is_active(spa, SPA_FEATURE_RESILVER_DEFER)) {
	spa_feature_decr(spa, SPA_FEATURE_RESILVER_DEFER, tx);
	vdev_config_dirty(vd);
	spa->spa_resilver_deferred = B_FALSE;
	return (resilver_needed);
	}

	if (!vdev_is_concrete(vd) \|\| vd->vdev_aux \|\|
	!vd->vdev_ops->vdev_op_leaf)
	return (resilver_needed);

	vd->vdev_resilver_deferred = B_FALSE;

	return (!vdev_is_dead(vd) && !vd->vdev_offline &&
	vdev_resilver_needed(vd, NULL, NULL));
	}

	/*
	* Translate a logical range to the physical range for the specified vdev_t.
	* This function is initially called with a leaf vdev and will walk each
	* parent vdev until it reaches a top-level vdev. Once the top-level is
	* reached the physical range is initialized and the recursive function
	* begins to unwind. As it unwinds it calls the parent's vdev specific
	* translation function to do the real conversion.
	*/
	void
	vdev_xlate(vdev_t vd, const range_seg64_t logical_rs,
	range_seg64_t *physical_rs)
	{
	/*
	* Walk up the vdev tree
	*/
	if (vd != vd->vdev_top) {
	vdev_xlate(vd->vdev_parent, logical_rs, physical_rs);
	} else {
	/*
	* We've reached the top-level vdev, initialize the
	* physical range to the logical range and start to
	* unwind.
	*/
	physical_rs->rs_start = logical_rs->rs_start;
	physical_rs->rs_end = logical_rs->rs_end;
	return;
	}

	vdev_t *pvd = vd->vdev_parent;
	ASSERT3P(pvd, !=, NULL);
	ASSERT3P(pvd->vdev_ops->vdev_op_xlate, !=, NULL);

	/*
	* As this recursive function unwinds, translate the logical
	* range into its physical components by calling the
	* vdev specific translate function.
	*/
	range_seg64_t intermediate = { 0 };
	pvd->vdev_ops->vdev_op_xlate(vd, physical_rs, &intermediate);

	physical_rs->rs_start = intermediate.rs_start;
	physical_rs->rs_end = intermediate.rs_end;
	}

	/*
	* Look at the vdev tree and determine whether any devices are currently being
	* replaced.
	*/
	boolean_t
	vdev_replace_in_progress(vdev_t *vdev)
	{
	ASSERT(spa_config_held(vdev->vdev_spa, SCL_ALL, RW_READER) != 0);

	if (vdev->vdev_ops == &vdev_replacing_ops)
	return (B_TRUE);

	/*
	* A 'spare' vdev indicates that we have a replace in progress, unless
	* it has exactly two children, and the second, the hot spare, has
	* finished being resilvered.
	*/
	if (vdev->vdev_ops == &vdev_spare_ops && (vdev->vdev_children > 2 \|\|
	!vdev_dtl_empty(vdev->vdev_child[1], DTL_MISSING)))
	return (B_TRUE);

	for (int i = 0; i < vdev->vdev_children; i++) {
	if (vdev_replace_in_progress(vdev->vdev_child[i]))
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	EXPORT_SYMBOL(vdev_fault);
	EXPORT_SYMBOL(vdev_degrade);
	EXPORT_SYMBOL(vdev_online);
	EXPORT_SYMBOL(vdev_offline);
	EXPORT_SYMBOL(vdev_clear);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_vdev, zfs_vdev_, default_ms_count, INT, ZMOD_RW,
	"Target number of metaslabs per top-level vdev");

	ZFS_MODULE_PARAM(zfs_vdev, zfs_vdev_, default_ms_shift, INT, ZMOD_RW,
	"Default limit for metaslab size");

	ZFS_MODULE_PARAM(zfs_vdev, zfs_vdev_, min_ms_count, INT, ZMOD_RW,
	"Minimum number of metaslabs per top-level vdev");

	ZFS_MODULE_PARAM(zfs_vdev, zfs_vdev_, ms_count_limit, INT, ZMOD_RW,
	"Practical upper limit of total metaslabs per top-level vdev");

	ZFS_MODULE_PARAM(zfs, zfs_, slow_io_events_per_second, UINT, ZMOD_RW,
	"Rate limit slow IO (delay) events to this many per second");

	ZFS_MODULE_PARAM(zfs, zfs_, checksum_events_per_second, UINT, ZMOD_RW,
	"Rate limit checksum events to this many checksum errors per second "
	"(do not set below zed threshold).");

	ZFS_MODULE_PARAM(zfs, zfs_, scan_ignore_errors, INT, ZMOD_RW,
	"Ignore errors during resilver/scrub");

	ZFS_MODULE_PARAM(zfs_vdev, vdev_, validate_skip, INT, ZMOD_RW,
	"Bypass vdev_validate()");

	ZFS_MODULE_PARAM(zfs, zfs_, nocacheflush, INT, ZMOD_RW,
	"Disable cache flushes");

	ZFS_MODULE_PARAM_CALL(zfs_vdev, zfs_vdev_, min_auto_ashift,
	param_set_min_auto_ashift, param_get_ulong, ZMOD_RW,
	"Minimum ashift used when creating new top-level vdevs");

	ZFS_MODULE_PARAM_CALL(zfs_vdev, zfs_vdev_, max_auto_ashift,
	param_set_max_auto_ashift, param_get_ulong, ZMOD_RW,
	"Maximum ashift used when optimizing for logical -> physical sector "
	"size on new top-level vdevs");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/vdev_indirect.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev_indirect.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev_indirect.c (revision 365892)
	@@ -1,1890 +1,1890 @@
	/*
	* CDDL HEADER START
	*
	* This file and its contents are supplied under the terms of the
	* Common Development and Distribution License ("CDDL"), version 1.0.
	* You may only use this file in accordance with the terms of version
	* 1.0 of the CDDL.
	*
	* A full copy of the text of the CDDL should have accompanied this
	* source. A copy of the CDDL is also available via the Internet at
	* http://www.illumos.org/license/CDDL.
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2014, 2017 by Delphix. All rights reserved.
	* Copyright (c) 2019, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
	- * Copyright (c) 2014, 2019 by Delphix. All rights reserved.
	+ * Copyright (c) 2014, 2020 by Delphix. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev_impl.h>
	#include <sys/fs/zfs.h>
	#include <sys/zio.h>
	#include <sys/zio_checksum.h>
	#include <sys/metaslab.h>
	#include <sys/dmu.h>
	#include <sys/vdev_indirect_mapping.h>
	#include <sys/dmu_tx.h>
	#include <sys/dsl_synctask.h>
	#include <sys/zap.h>
	#include <sys/abd.h>
	#include <sys/zthr.h>

	/*
	* An indirect vdev corresponds to a vdev that has been removed. Since
	* we cannot rewrite block pointers of snapshots, etc., we keep a
	* mapping from old location on the removed device to the new location
	* on another device in the pool and use this mapping whenever we need
	* to access the DVA. Unfortunately, this mapping did not respect
	* logical block boundaries when it was first created, and so a DVA on
	* this indirect vdev may be "split" into multiple sections that each
	* map to a different location. As a consequence, not all DVAs can be
	* translated to an equivalent new DVA. Instead we must provide a
	* "vdev_remap" operation that executes a callback on each contiguous
	* segment of the new location. This function is used in multiple ways:
	*
	* - i/os to this vdev use the callback to determine where the
	* data is now located, and issue child i/os for each segment's new
	* location.
	*
	* - frees and claims to this vdev use the callback to free or claim
	* each mapped segment. (Note that we don't actually need to claim
	* log blocks on indirect vdevs, because we don't allocate to
	* removing vdevs. However, zdb uses zio_claim() for its leak
	* detection.)
	*/

	/*
	* "Big theory statement" for how we mark blocks obsolete.
	*
	* When a block on an indirect vdev is freed or remapped, a section of
	* that vdev's mapping may no longer be referenced (aka "obsolete"). We
	* keep track of how much of each mapping entry is obsolete. When
	* an entry becomes completely obsolete, we can remove it, thus reducing
	* the memory used by the mapping. The complete picture of obsolescence
	* is given by the following data structures, described below:
	* - the entry-specific obsolete count
	* - the vdev-specific obsolete spacemap
	* - the pool-specific obsolete bpobj
	*
	* == On disk data structures used ==
	*
	* We track the obsolete space for the pool using several objects. Each
	* of these objects is created on demand and freed when no longer
	* needed, and is assumed to be empty if it does not exist.
	* SPA_FEATURE_OBSOLETE_COUNTS includes the count of these objects.
	*
	* - Each vic_mapping_object (associated with an indirect vdev) can
	* have a vimp_counts_object. This is an array of uint32_t's
	* with the same number of entries as the vic_mapping_object. When
	* the mapping is condensed, entries from the vic_obsolete_sm_object
	* (see below) are folded into the counts. Therefore, each
	* obsolete_counts entry tells us the number of bytes in the
	* corresponding mapping entry that were not referenced when the
	* mapping was last condensed.
	*
	* - Each indirect or removing vdev can have a vic_obsolete_sm_object.
	* This is a space map containing an alloc entry for every DVA that
	* has been obsoleted since the last time this indirect vdev was
	* condensed. We use this object in order to improve performance
	* when marking a DVA as obsolete. Instead of modifying an arbitrary
	* offset of the vimp_counts_object, we only need to append an entry
	* to the end of this object. When a DVA becomes obsolete, it is
	* added to the obsolete space map. This happens when the DVA is
	* freed, remapped and not referenced by a snapshot, or the last
	* snapshot referencing it is destroyed.
	*
	* - Each dataset can have a ds_remap_deadlist object. This is a
	* deadlist object containing all blocks that were remapped in this
	* dataset but referenced in a previous snapshot. Blocks can only
	* appear on this list if they were remapped (dsl_dataset_block_remapped);
	* blocks that were killed in a head dataset are put on the normal
	* ds_deadlist and marked obsolete when they are freed.
	*
	* - The pool can have a dp_obsolete_bpobj. This is a list of blocks
	* in the pool that need to be marked obsolete. When a snapshot is
	* destroyed, we move some of the ds_remap_deadlist to the obsolete
	* bpobj (see dsl_destroy_snapshot_handle_remaps()). We then
	* asynchronously process the obsolete bpobj, moving its entries to
	* the specific vdevs' obsolete space maps.
	*
	* == Summary of how we mark blocks as obsolete ==
	*
	* - When freeing a block: if any DVA is on an indirect vdev, append to
	* vic_obsolete_sm_object.
	* - When remapping a block, add dva to ds_remap_deadlist (if prev snap
	* references; otherwise append to vic_obsolete_sm_object).
	* - When freeing a snapshot: move parts of ds_remap_deadlist to
	* dp_obsolete_bpobj (same algorithm as ds_deadlist).
	* - When syncing the spa: process dp_obsolete_bpobj, moving ranges to
	* individual vdev's vic_obsolete_sm_object.
	*/

	/*
	* "Big theory statement" for how we condense indirect vdevs.
	*
	* Condensing an indirect vdev's mapping is the process of determining
	* the precise counts of obsolete space for each mapping entry (by
	* integrating the obsolete spacemap into the obsolete counts) and
	* writing out a new mapping that contains only referenced entries.
	*
	* We condense a vdev when we expect the mapping to shrink (see
	* vdev_indirect_should_condense()), but only perform one condense at a
	* time to limit the memory usage. In addition, we use a separate
	* open-context thread (spa_condense_indirect_thread) to incrementally
	* create the new mapping object in a way that minimizes the impact on
	* the rest of the system.
	*
	* == Generating a new mapping ==
	*
	* To generate a new mapping, we follow these steps:
	*
	* 1. Save the old obsolete space map and create a new mapping object
	* (see spa_condense_indirect_start_sync()). This initializes the
	* spa_condensing_indirect_phys with the "previous obsolete space map",
	* which is now read only. Newly obsolete DVAs will be added to a
	* new (initially empty) obsolete space map, and will not be
	* considered as part of this condense operation.
	*
	* 2. Construct in memory the precise counts of obsolete space for each
	* mapping entry, by incorporating the obsolete space map into the
	* counts. (See vdev_indirect_mapping_load_obsolete_{counts,spacemap}().)
	*
	* 3. Iterate through each mapping entry, writing to the new mapping any
	* entries that are not completely obsolete (i.e. which don't have
	* obsolete count == mapping length). (See
	* spa_condense_indirect_generate_new_mapping().)
	*
	* 4. Destroy the old mapping object and switch over to the new one
	* (spa_condense_indirect_complete_sync).
	*
	* == Restarting from failure ==
	*
	* To restart the condense when we import/open the pool, we must start
	* at the 2nd step above: reconstruct the precise counts in memory,
	* based on the space map + counts. Then in the 3rd step, we start
	* iterating where we left off: at vimp_max_offset of the new mapping
	* object.
	*/

	int zfs_condense_indirect_vdevs_enable = B_TRUE;

	/*
	* Condense if at least this percent of the bytes in the mapping is
	* obsolete. With the default of 25%, the amount of space mapped
	* will be reduced to 1% of its original size after at most 16
	* condenses. Higher values will condense less often (causing less
	* i/o); lower values will reduce the mapping size more quickly.
	*/
	int zfs_indirect_condense_obsolete_pct = 25;

	/*
	* Condense if the obsolete space map takes up more than this amount of
	* space on disk (logically). This limits the amount of disk space
	* consumed by the obsolete space map; the default of 1GB is small enough
	* that we typically don't mind "wasting" it.
	*/
	unsigned long zfs_condense_max_obsolete_bytes = 1024 * 1024 * 1024;

	/*
	* Don't bother condensing if the mapping uses less than this amount of
	* memory. The default of 128KB is considered a "trivial" amount of
	* memory and not worth reducing.
	*/
	unsigned long zfs_condense_min_mapping_bytes = 128 * 1024;

	/*
	* This is used by the test suite so that it can ensure that certain
	* actions happen while in the middle of a condense (which might otherwise
	* complete too quickly). If used to reduce the performance impact of
	* condensing in production, a maximum value of 1 should be sufficient.
	*/
	int zfs_condense_indirect_commit_entry_delay_ms = 0;

	/*
	* If an indirect split block contains more than this many possible unique
	* combinations when being reconstructed, consider it too computationally
	* expensive to check them all. Instead, try at most 100 randomly-selected
	* combinations each time the block is accessed. This allows all segment
	* copies to participate fairly in the reconstruction when all combinations
	* cannot be checked and prevents repeated use of one bad copy.
	*/
	int zfs_reconstruct_indirect_combinations_max = 4096;

	/*
	* Enable to simulate damaged segments and validate reconstruction. This
	* is intentionally not exposed as a module parameter.
	*/
	unsigned long zfs_reconstruct_indirect_damage_fraction = 0;

	/*
	* The indirect_child_t represents the vdev that we will read from, when we
	* need to read all copies of the data (e.g. for scrub or reconstruction).
	* For plain (non-mirror) top-level vdevs (i.e. is_vdev is not a mirror),
	* ic_vdev is the same as is_vdev. However, for mirror top-level vdevs,
	* ic_vdev is a child of the mirror.
	*/
	typedef struct indirect_child {
	abd_t *ic_data;
	vdev_t *ic_vdev;

	/*
	* ic_duplicate is NULL when the ic_data contents are unique, when it
	* is determined to be a duplicate it references the primary child.
	*/
	struct indirect_child *ic_duplicate;
	list_node_t ic_node; /* node on is_unique_child */
	} indirect_child_t;

	/*
	* The indirect_split_t represents one mapped segment of an i/o to the
	* indirect vdev. For non-split (contiguously-mapped) blocks, there will be
	* only one indirect_split_t, with is_split_offset==0 and is_size==io_size.
	* For split blocks, there will be several of these.
	*/
	typedef struct indirect_split {
	list_node_t is_node; /* link on iv_splits */

	/*
	* is_split_offset is the offset into the i/o.
	* This is the sum of the previous splits' is_size's.
	*/
	uint64_t is_split_offset;

	vdev_t is_vdev; / top-level vdev */
	uint64_t is_target_offset; /* offset on is_vdev */
	uint64_t is_size;
	int is_children; /* number of entries in is_child[] */
	int is_unique_children; /* number of entries in is_unique_child */
	list_t is_unique_child;

	/*
	* is_good_child is the child that we are currently using to
	* attempt reconstruction.
	*/
	indirect_child_t *is_good_child;

	indirect_child_t is_child[1]; /* variable-length */
	} indirect_split_t;

	/*
	* The indirect_vsd_t is associated with each i/o to the indirect vdev.
	* It is the "Vdev-Specific Data" in the zio_t's io_vsd.
	*/
	typedef struct indirect_vsd {
	boolean_t iv_split_block;
	boolean_t iv_reconstruct;
	uint64_t iv_unique_combinations;
	uint64_t iv_attempts;
	uint64_t iv_attempts_max;

	list_t iv_splits; /* list of indirect_split_t's */
	} indirect_vsd_t;

	static void
	vdev_indirect_map_free(zio_t *zio)
	{
	indirect_vsd_t *iv = zio->io_vsd;

	indirect_split_t *is;
	while ((is = list_head(&iv->iv_splits)) != NULL) {
	for (int c = 0; c < is->is_children; c++) {
	indirect_child_t *ic = &is->is_child[c];
	if (ic->ic_data != NULL)
	abd_free(ic->ic_data);
	}
	list_remove(&iv->iv_splits, is);

	indirect_child_t *ic;
	while ((ic = list_head(&is->is_unique_child)) != NULL)
	list_remove(&is->is_unique_child, ic);

	list_destroy(&is->is_unique_child);

	kmem_free(is,
	offsetof(indirect_split_t, is_child[is->is_children]));
	}
	kmem_free(iv, sizeof (*iv));
	}

	static const zio_vsd_ops_t vdev_indirect_vsd_ops = {
	.vsd_free = vdev_indirect_map_free,
	.vsd_cksum_report = zio_vsd_default_cksum_report
	};

	/*
	* Mark the given offset and size as being obsolete.
	*/
	void
	vdev_indirect_mark_obsolete(vdev_t *vd, uint64_t offset, uint64_t size)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT3U(vd->vdev_indirect_config.vic_mapping_object, !=, 0);
	ASSERT(vd->vdev_removing \|\| vd->vdev_ops == &vdev_indirect_ops);
	ASSERT(size > 0);
	VERIFY(vdev_indirect_mapping_entry_for_offset(
	vd->vdev_indirect_mapping, offset) != NULL);

	if (spa_feature_is_enabled(spa, SPA_FEATURE_OBSOLETE_COUNTS)) {
	mutex_enter(&vd->vdev_obsolete_lock);
	range_tree_add(vd->vdev_obsolete_segments, offset, size);
	mutex_exit(&vd->vdev_obsolete_lock);
	vdev_dirty(vd, 0, NULL, spa_syncing_txg(spa));
	}
	}

	/*
	* Mark the DVA vdev_id:offset:size as being obsolete in the given tx. This
	* wrapper is provided because the DMU does not know about vdev_t's and
	* cannot directly call vdev_indirect_mark_obsolete.
	*/
	void
	spa_vdev_indirect_mark_obsolete(spa_t *spa, uint64_t vdev_id, uint64_t offset,
	uint64_t size, dmu_tx_t *tx)
	{
	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	ASSERT(dmu_tx_is_syncing(tx));

	/* The DMU can only remap indirect vdevs. */
	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);
	vdev_indirect_mark_obsolete(vd, offset, size);
	}

	static spa_condensing_indirect_t *
	spa_condensing_indirect_create(spa_t *spa)
	{
	spa_condensing_indirect_phys_t *scip =
	&spa->spa_condensing_indirect_phys;
	spa_condensing_indirect_t sci = kmem_zalloc(sizeof (sci), KM_SLEEP);
	objset_t *mos = spa->spa_meta_objset;

	for (int i = 0; i < TXG_SIZE; i++) {
	list_create(&sci->sci_new_mapping_entries[i],
	sizeof (vdev_indirect_mapping_entry_t),
	offsetof(vdev_indirect_mapping_entry_t, vime_node));
	}

	sci->sci_new_mapping =
	vdev_indirect_mapping_open(mos, scip->scip_next_mapping_object);

	return (sci);
	}

	static void
	spa_condensing_indirect_destroy(spa_condensing_indirect_t *sci)
	{
	for (int i = 0; i < TXG_SIZE; i++)
	list_destroy(&sci->sci_new_mapping_entries[i]);

	if (sci->sci_new_mapping != NULL)
	vdev_indirect_mapping_close(sci->sci_new_mapping);

	kmem_free(sci, sizeof (*sci));
	}

	boolean_t
	vdev_indirect_should_condense(vdev_t *vd)
	{
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	spa_t *spa = vd->vdev_spa;

	ASSERT(dsl_pool_sync_context(spa->spa_dsl_pool));

	if (!zfs_condense_indirect_vdevs_enable)
	return (B_FALSE);

	/*
	* We can only condense one indirect vdev at a time.
	*/
	if (spa->spa_condensing_indirect != NULL)
	return (B_FALSE);

	if (spa_shutting_down(spa))
	return (B_FALSE);

	/*
	* The mapping object size must not change while we are
	* condensing, so we can only condense indirect vdevs
	* (not vdevs that are still in the middle of being removed).
	*/
	if (vd->vdev_ops != &vdev_indirect_ops)
	return (B_FALSE);

	/*
	* If nothing new has been marked obsolete, there is no
	* point in condensing.
	*/
	uint64_t obsolete_sm_obj __maybe_unused;
	ASSERT0(vdev_obsolete_sm_object(vd, &obsolete_sm_obj));
	if (vd->vdev_obsolete_sm == NULL) {
	ASSERT0(obsolete_sm_obj);
	return (B_FALSE);
	}

	ASSERT(vd->vdev_obsolete_sm != NULL);

	ASSERT3U(obsolete_sm_obj, ==, space_map_object(vd->vdev_obsolete_sm));

	uint64_t bytes_mapped = vdev_indirect_mapping_bytes_mapped(vim);
	uint64_t bytes_obsolete = space_map_allocated(vd->vdev_obsolete_sm);
	uint64_t mapping_size = vdev_indirect_mapping_size(vim);
	uint64_t obsolete_sm_size = space_map_length(vd->vdev_obsolete_sm);

	ASSERT3U(bytes_obsolete, <=, bytes_mapped);

	/*
	* If a high percentage of the bytes that are mapped have become
	* obsolete, condense (unless the mapping is already small enough).
	* This has a good chance of reducing the amount of memory used
	* by the mapping.
	*/
	if (bytes_obsolete * 100 / bytes_mapped >=
	zfs_indirect_condense_obsolete_pct &&
	mapping_size > zfs_condense_min_mapping_bytes) {
	zfs_dbgmsg("should condense vdev %llu because obsolete "
	"spacemap covers %d%% of %lluMB mapping",
	(u_longlong_t)vd->vdev_id,
	(int)(bytes_obsolete * 100 / bytes_mapped),
	(u_longlong_t)bytes_mapped / 1024 / 1024);
	return (B_TRUE);
	}

	/*
	* If the obsolete space map takes up too much space on disk,
	* condense in order to free up this disk space.
	*/
	if (obsolete_sm_size >= zfs_condense_max_obsolete_bytes) {
	zfs_dbgmsg("should condense vdev %llu because obsolete sm "
	"length %lluMB >= max size %lluMB",
	(u_longlong_t)vd->vdev_id,
	(u_longlong_t)obsolete_sm_size / 1024 / 1024,
	(u_longlong_t)zfs_condense_max_obsolete_bytes /
	1024 / 1024);
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	/*
	* This sync task completes (finishes) a condense, deleting the old
	* mapping and replacing it with the new one.
	*/
	static void
	spa_condense_indirect_complete_sync(void arg, dmu_tx_t tx)
	{
	spa_condensing_indirect_t *sci = arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	spa_condensing_indirect_phys_t *scip =
	&spa->spa_condensing_indirect_phys;
	vdev_t *vd = vdev_lookup_top(spa, scip->scip_vdev);
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;
	objset_t *mos = spa->spa_meta_objset;
	vdev_indirect_mapping_t *old_mapping = vd->vdev_indirect_mapping;
	uint64_t old_count = vdev_indirect_mapping_num_entries(old_mapping);
	uint64_t new_count =
	vdev_indirect_mapping_num_entries(sci->sci_new_mapping);

	ASSERT(dmu_tx_is_syncing(tx));
	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);
	ASSERT3P(sci, ==, spa->spa_condensing_indirect);
	for (int i = 0; i < TXG_SIZE; i++) {
	ASSERT(list_is_empty(&sci->sci_new_mapping_entries[i]));
	}
	ASSERT(vic->vic_mapping_object != 0);
	ASSERT3U(vd->vdev_id, ==, scip->scip_vdev);
	ASSERT(scip->scip_next_mapping_object != 0);
	ASSERT(scip->scip_prev_obsolete_sm_object != 0);

	/*
	* Reset vdev_indirect_mapping to refer to the new object.
	*/
	rw_enter(&vd->vdev_indirect_rwlock, RW_WRITER);
	vdev_indirect_mapping_close(vd->vdev_indirect_mapping);
	vd->vdev_indirect_mapping = sci->sci_new_mapping;
	rw_exit(&vd->vdev_indirect_rwlock);

	sci->sci_new_mapping = NULL;
	vdev_indirect_mapping_free(mos, vic->vic_mapping_object, tx);
	vic->vic_mapping_object = scip->scip_next_mapping_object;
	scip->scip_next_mapping_object = 0;

	space_map_free_obj(mos, scip->scip_prev_obsolete_sm_object, tx);
	spa_feature_decr(spa, SPA_FEATURE_OBSOLETE_COUNTS, tx);
	scip->scip_prev_obsolete_sm_object = 0;

	scip->scip_vdev = 0;

	VERIFY0(zap_remove(mos, DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_CONDENSING_INDIRECT, tx));
	spa_condensing_indirect_destroy(spa->spa_condensing_indirect);
	spa->spa_condensing_indirect = NULL;

	zfs_dbgmsg("finished condense of vdev %llu in txg %llu: "
	"new mapping object %llu has %llu entries "
	"(was %llu entries)",
	vd->vdev_id, dmu_tx_get_txg(tx), vic->vic_mapping_object,
	new_count, old_count);

	vdev_config_dirty(spa->spa_root_vdev);
	}

	/*
	* This sync task appends entries to the new mapping object.
	*/
	static void
	spa_condense_indirect_commit_sync(void arg, dmu_tx_t tx)
	{
	spa_condensing_indirect_t *sci = arg;
	uint64_t txg = dmu_tx_get_txg(tx);
	spa_t *spa __maybe_unused = dmu_tx_pool(tx)->dp_spa;

	ASSERT(dmu_tx_is_syncing(tx));
	ASSERT3P(sci, ==, spa->spa_condensing_indirect);

	vdev_indirect_mapping_add_entries(sci->sci_new_mapping,
	&sci->sci_new_mapping_entries[txg & TXG_MASK], tx);
	ASSERT(list_is_empty(&sci->sci_new_mapping_entries[txg & TXG_MASK]));
	}

	/*
	* Open-context function to add one entry to the new mapping. The new
	* entry will be remembered and written from syncing context.
	*/
	static void
	spa_condense_indirect_commit_entry(spa_t *spa,
	vdev_indirect_mapping_entry_phys_t *vimep, uint32_t count)
	{
	spa_condensing_indirect_t *sci = spa->spa_condensing_indirect;

	ASSERT3U(count, <, DVA_GET_ASIZE(&vimep->vimep_dst));

	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	dmu_tx_hold_space(tx, sizeof (*vimep) + sizeof (count));
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));
	int txgoff = dmu_tx_get_txg(tx) & TXG_MASK;

	/*
	* If we are the first entry committed this txg, kick off the sync
	* task to write to the MOS on our behalf.
	*/
	if (list_is_empty(&sci->sci_new_mapping_entries[txgoff])) {
	dsl_sync_task_nowait(dmu_tx_pool(tx),
	- spa_condense_indirect_commit_sync, sci,
	- 0, ZFS_SPACE_CHECK_NONE, tx);
	+ spa_condense_indirect_commit_sync, sci, tx);
	}

	vdev_indirect_mapping_entry_t *vime =
	kmem_alloc(sizeof (*vime), KM_SLEEP);
	vime->vime_mapping = *vimep;
	vime->vime_obsolete_count = count;
	list_insert_tail(&sci->sci_new_mapping_entries[txgoff], vime);

	dmu_tx_commit(tx);
	}

	static void
	spa_condense_indirect_generate_new_mapping(vdev_t *vd,
	uint32_t obsolete_counts, uint64_t start_index, zthr_t zthr)
	{
	spa_t *spa = vd->vdev_spa;
	uint64_t mapi = start_index;
	vdev_indirect_mapping_t *old_mapping = vd->vdev_indirect_mapping;
	uint64_t old_num_entries =
	vdev_indirect_mapping_num_entries(old_mapping);

	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);
	ASSERT3U(vd->vdev_id, ==, spa->spa_condensing_indirect_phys.scip_vdev);

	zfs_dbgmsg("starting condense of vdev %llu from index %llu",
	(u_longlong_t)vd->vdev_id,
	(u_longlong_t)mapi);

	while (mapi < old_num_entries) {

	if (zthr_iscancelled(zthr)) {
	zfs_dbgmsg("pausing condense of vdev %llu "
	"at index %llu", (u_longlong_t)vd->vdev_id,
	(u_longlong_t)mapi);
	break;
	}

	vdev_indirect_mapping_entry_phys_t *entry =
	&old_mapping->vim_entries[mapi];
	uint64_t entry_size = DVA_GET_ASIZE(&entry->vimep_dst);
	ASSERT3U(obsolete_counts[mapi], <=, entry_size);
	if (obsolete_counts[mapi] < entry_size) {
	spa_condense_indirect_commit_entry(spa, entry,
	obsolete_counts[mapi]);

	/*
	* This delay may be requested for testing, debugging,
	* or performance reasons.
	*/
	hrtime_t now = gethrtime();
	hrtime_t sleep_until = now + MSEC2NSEC(
	zfs_condense_indirect_commit_entry_delay_ms);
	zfs_sleep_until(sleep_until);
	}

	mapi++;
	}
	}

	/* ARGSUSED */
	static boolean_t
	spa_condense_indirect_thread_check(void arg, zthr_t zthr)
	{
	spa_t *spa = arg;

	return (spa->spa_condensing_indirect != NULL);
	}

	/* ARGSUSED */
	static void
	spa_condense_indirect_thread(void arg, zthr_t zthr)
	{
	spa_t *spa = arg;
	vdev_t *vd;

	ASSERT3P(spa->spa_condensing_indirect, !=, NULL);
	spa_config_enter(spa, SCL_VDEV, FTAG, RW_READER);
	vd = vdev_lookup_top(spa, spa->spa_condensing_indirect_phys.scip_vdev);
	ASSERT3P(vd, !=, NULL);
	spa_config_exit(spa, SCL_VDEV, FTAG);

	spa_condensing_indirect_t *sci = spa->spa_condensing_indirect;
	spa_condensing_indirect_phys_t *scip =
	&spa->spa_condensing_indirect_phys;
	uint32_t *counts;
	uint64_t start_index;
	vdev_indirect_mapping_t *old_mapping = vd->vdev_indirect_mapping;
	space_map_t *prev_obsolete_sm = NULL;

	ASSERT3U(vd->vdev_id, ==, scip->scip_vdev);
	ASSERT(scip->scip_next_mapping_object != 0);
	ASSERT(scip->scip_prev_obsolete_sm_object != 0);
	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);

	for (int i = 0; i < TXG_SIZE; i++) {
	/*
	* The list must start out empty in order for the
	* _commit_sync() sync task to be properly registered
	* on the first call to _commit_entry(); so it's wise
	* to double check and ensure we actually are starting
	* with empty lists.
	*/
	ASSERT(list_is_empty(&sci->sci_new_mapping_entries[i]));
	}

	VERIFY0(space_map_open(&prev_obsolete_sm, spa->spa_meta_objset,
	scip->scip_prev_obsolete_sm_object, 0, vd->vdev_asize, 0));
	counts = vdev_indirect_mapping_load_obsolete_counts(old_mapping);
	if (prev_obsolete_sm != NULL) {
	vdev_indirect_mapping_load_obsolete_spacemap(old_mapping,
	counts, prev_obsolete_sm);
	}
	space_map_close(prev_obsolete_sm);

	/*
	* Generate new mapping. Determine what index to continue from
	* based on the max offset that we've already written in the
	* new mapping.
	*/
	uint64_t max_offset =
	vdev_indirect_mapping_max_offset(sci->sci_new_mapping);
	if (max_offset == 0) {
	/* We haven't written anything to the new mapping yet. */
	start_index = 0;
	} else {
	/*
	* Pick up from where we left off. _entry_for_offset()
	* returns a pointer into the vim_entries array. If
	* max_offset is greater than any of the mappings
	* contained in the table NULL will be returned and
	* that indicates we've exhausted our iteration of the
	* old_mapping.
	*/

	vdev_indirect_mapping_entry_phys_t *entry =
	vdev_indirect_mapping_entry_for_offset_or_next(old_mapping,
	max_offset);

	if (entry == NULL) {
	/*
	* We've already written the whole new mapping.
	* This special value will cause us to skip the
	* generate_new_mapping step and just do the sync
	* task to complete the condense.
	*/
	start_index = UINT64_MAX;
	} else {
	start_index = entry - old_mapping->vim_entries;
	ASSERT3U(start_index, <,
	vdev_indirect_mapping_num_entries(old_mapping));
	}
	}

	spa_condense_indirect_generate_new_mapping(vd, counts,
	start_index, zthr);

	vdev_indirect_mapping_free_obsolete_counts(old_mapping, counts);

	/*
	* If the zthr has received a cancellation signal while running
	* in generate_new_mapping() or at any point after that, then bail
	* early. We don't want to complete the condense if the spa is
	* shutting down.
	*/
	if (zthr_iscancelled(zthr))
	return;

	VERIFY0(dsl_sync_task(spa_name(spa), NULL,
	spa_condense_indirect_complete_sync, sci, 0,
	ZFS_SPACE_CHECK_EXTRA_RESERVED));
	}

	/*
	* Sync task to begin the condensing process.
	*/
	void
	spa_condense_indirect_start_sync(vdev_t vd, dmu_tx_t tx)
	{
	spa_t *spa = vd->vdev_spa;
	spa_condensing_indirect_phys_t *scip =
	&spa->spa_condensing_indirect_phys;

	ASSERT0(scip->scip_next_mapping_object);
	ASSERT0(scip->scip_prev_obsolete_sm_object);
	ASSERT0(scip->scip_vdev);
	ASSERT(dmu_tx_is_syncing(tx));
	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);
	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_OBSOLETE_COUNTS));
	ASSERT(vdev_indirect_mapping_num_entries(vd->vdev_indirect_mapping));

	uint64_t obsolete_sm_obj;
	VERIFY0(vdev_obsolete_sm_object(vd, &obsolete_sm_obj));
	ASSERT3U(obsolete_sm_obj, !=, 0);

	scip->scip_vdev = vd->vdev_id;
	scip->scip_next_mapping_object =
	vdev_indirect_mapping_alloc(spa->spa_meta_objset, tx);

	scip->scip_prev_obsolete_sm_object = obsolete_sm_obj;

	/*
	* We don't need to allocate a new space map object, since
	* vdev_indirect_sync_obsolete will allocate one when needed.
	*/
	space_map_close(vd->vdev_obsolete_sm);
	vd->vdev_obsolete_sm = NULL;
	VERIFY0(zap_remove(spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_INDIRECT_OBSOLETE_SM, tx));

	VERIFY0(zap_add(spa->spa_dsl_pool->dp_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_CONDENSING_INDIRECT, sizeof (uint64_t),
	sizeof (*scip) / sizeof (uint64_t), scip, tx));

	ASSERT3P(spa->spa_condensing_indirect, ==, NULL);
	spa->spa_condensing_indirect = spa_condensing_indirect_create(spa);

	zfs_dbgmsg("starting condense of vdev %llu in txg %llu: "
	"posm=%llu nm=%llu",
	vd->vdev_id, dmu_tx_get_txg(tx),
	(u_longlong_t)scip->scip_prev_obsolete_sm_object,
	(u_longlong_t)scip->scip_next_mapping_object);

	zthr_wakeup(spa->spa_condense_zthr);
	}

	/*
	* Sync to the given vdev's obsolete space map any segments that are no longer
	* referenced as of the given txg.
	*
	* If the obsolete space map doesn't exist yet, create and open it.
	*/
	void
	vdev_indirect_sync_obsolete(vdev_t vd, dmu_tx_t tx)
	{
	spa_t *spa = vd->vdev_spa;
	vdev_indirect_config_t *vic __maybe_unused = &vd->vdev_indirect_config;

	ASSERT3U(vic->vic_mapping_object, !=, 0);
	ASSERT(range_tree_space(vd->vdev_obsolete_segments) > 0);
	ASSERT(vd->vdev_removing \|\| vd->vdev_ops == &vdev_indirect_ops);
	ASSERT(spa_feature_is_enabled(spa, SPA_FEATURE_OBSOLETE_COUNTS));

	uint64_t obsolete_sm_object;
	VERIFY0(vdev_obsolete_sm_object(vd, &obsolete_sm_object));
	if (obsolete_sm_object == 0) {
	obsolete_sm_object = space_map_alloc(spa->spa_meta_objset,
	zfs_vdev_standard_sm_blksz, tx);

	ASSERT(vd->vdev_top_zap != 0);
	VERIFY0(zap_add(vd->vdev_spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_INDIRECT_OBSOLETE_SM,
	sizeof (obsolete_sm_object), 1, &obsolete_sm_object, tx));
	ASSERT0(vdev_obsolete_sm_object(vd, &obsolete_sm_object));
	ASSERT3U(obsolete_sm_object, !=, 0);

	spa_feature_incr(spa, SPA_FEATURE_OBSOLETE_COUNTS, tx);
	VERIFY0(space_map_open(&vd->vdev_obsolete_sm,
	spa->spa_meta_objset, obsolete_sm_object,
	0, vd->vdev_asize, 0));
	}

	ASSERT(vd->vdev_obsolete_sm != NULL);
	ASSERT3U(obsolete_sm_object, ==,
	space_map_object(vd->vdev_obsolete_sm));

	space_map_write(vd->vdev_obsolete_sm,
	vd->vdev_obsolete_segments, SM_ALLOC, SM_NO_VDEVID, tx);
	range_tree_vacate(vd->vdev_obsolete_segments, NULL, NULL);
	}

	int
	spa_condense_init(spa_t *spa)
	{
	int error = zap_lookup(spa->spa_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_CONDENSING_INDIRECT, sizeof (uint64_t),
	sizeof (spa->spa_condensing_indirect_phys) / sizeof (uint64_t),
	&spa->spa_condensing_indirect_phys);
	if (error == 0) {
	if (spa_writeable(spa)) {
	spa->spa_condensing_indirect =
	spa_condensing_indirect_create(spa);
	}
	return (0);
	} else if (error == ENOENT) {
	return (0);
	} else {
	return (error);
	}
	}

	void
	spa_condense_fini(spa_t *spa)
	{
	if (spa->spa_condensing_indirect != NULL) {
	spa_condensing_indirect_destroy(spa->spa_condensing_indirect);
	spa->spa_condensing_indirect = NULL;
	}
	}

	void
	spa_start_indirect_condensing_thread(spa_t *spa)
	{
	ASSERT3P(spa->spa_condense_zthr, ==, NULL);
	spa->spa_condense_zthr = zthr_create("z_indirect_condense",
	spa_condense_indirect_thread_check,
	spa_condense_indirect_thread, spa);
	}

	/*
	* Gets the obsolete spacemap object from the vdev's ZAP. On success sm_obj
	* will contain either the obsolete spacemap object or zero if none exists.
	* All other errors are returned to the caller.
	*/
	int
	vdev_obsolete_sm_object(vdev_t vd, uint64_t sm_obj)
	{
	ASSERT0(spa_config_held(vd->vdev_spa, SCL_ALL, RW_WRITER));

	if (vd->vdev_top_zap == 0) {
	*sm_obj = 0;
	return (0);
	}

	int error = zap_lookup(vd->vdev_spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_INDIRECT_OBSOLETE_SM, sizeof (uint64_t), 1, sm_obj);
	if (error == ENOENT) {
	*sm_obj = 0;
	error = 0;
	}

	return (error);
	}

	/*
	* Gets the obsolete count are precise spacemap object from the vdev's ZAP.
	* On success are_precise will be set to reflect if the counts are precise.
	* All other errors are returned to the caller.
	*/
	int
	vdev_obsolete_counts_are_precise(vdev_t vd, boolean_t are_precise)
	{
	ASSERT0(spa_config_held(vd->vdev_spa, SCL_ALL, RW_WRITER));

	if (vd->vdev_top_zap == 0) {
	*are_precise = B_FALSE;
	return (0);
	}

	uint64_t val = 0;
	int error = zap_lookup(vd->vdev_spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_OBSOLETE_COUNTS_ARE_PRECISE, sizeof (val), 1, &val);
	if (error == 0) {
	*are_precise = (val != 0);
	} else if (error == ENOENT) {
	*are_precise = B_FALSE;
	error = 0;
	}

	return (error);
	}

	/* ARGSUSED */
	static void
	vdev_indirect_close(vdev_t *vd)
	{
	}

	/* ARGSUSED */
	static int
	vdev_indirect_open(vdev_t vd, uint64_t psize, uint64_t *max_psize,
	uint64_t logical_ashift, uint64_t physical_ashift)
	{
	psize = max_psize = vd->vdev_asize +
	VDEV_LABEL_START_SIZE + VDEV_LABEL_END_SIZE;
	*logical_ashift = vd->vdev_ashift;
	*physical_ashift = vd->vdev_physical_ashift;
	return (0);
	}

	typedef struct remap_segment {
	vdev_t *rs_vd;
	uint64_t rs_offset;
	uint64_t rs_asize;
	uint64_t rs_split_offset;
	list_node_t rs_node;
	} remap_segment_t;

	static remap_segment_t *
	rs_alloc(vdev_t *vd, uint64_t offset, uint64_t asize, uint64_t split_offset)
	{
	remap_segment_t *rs = kmem_alloc(sizeof (remap_segment_t), KM_SLEEP);
	rs->rs_vd = vd;
	rs->rs_offset = offset;
	rs->rs_asize = asize;
	rs->rs_split_offset = split_offset;
	return (rs);
	}

	/*
	* Given an indirect vdev and an extent on that vdev, it duplicates the
	* physical entries of the indirect mapping that correspond to the extent
	* to a new array and returns a pointer to it. In addition, copied_entries
	* is populated with the number of mapping entries that were duplicated.
	*
	* Note that the function assumes that the caller holds vdev_indirect_rwlock.
	* This ensures that the mapping won't change due to condensing as we
	* copy over its contents.
	*
	* Finally, since we are doing an allocation, it is up to the caller to
	* free the array allocated in this function.
	*/
	static vdev_indirect_mapping_entry_phys_t *
	vdev_indirect_mapping_duplicate_adjacent_entries(vdev_t *vd, uint64_t offset,
	uint64_t asize, uint64_t *copied_entries)
	{
	vdev_indirect_mapping_entry_phys_t *duplicate_mappings = NULL;
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	uint64_t entries = 0;

	ASSERT(RW_READ_HELD(&vd->vdev_indirect_rwlock));

	vdev_indirect_mapping_entry_phys_t *first_mapping =
	vdev_indirect_mapping_entry_for_offset(vim, offset);
	ASSERT3P(first_mapping, !=, NULL);

	vdev_indirect_mapping_entry_phys_t *m = first_mapping;
	while (asize > 0) {
	uint64_t size = DVA_GET_ASIZE(&m->vimep_dst);

	ASSERT3U(offset, >=, DVA_MAPPING_GET_SRC_OFFSET(m));
	ASSERT3U(offset, <, DVA_MAPPING_GET_SRC_OFFSET(m) + size);

	uint64_t inner_offset = offset - DVA_MAPPING_GET_SRC_OFFSET(m);
	uint64_t inner_size = MIN(asize, size - inner_offset);

	offset += inner_size;
	asize -= inner_size;
	entries++;
	m++;
	}

	size_t copy_length = entries * sizeof (*first_mapping);
	duplicate_mappings = kmem_alloc(copy_length, KM_SLEEP);
	bcopy(first_mapping, duplicate_mappings, copy_length);
	*copied_entries = entries;

	return (duplicate_mappings);
	}

	/*
	* Goes through the relevant indirect mappings until it hits a concrete vdev
	* and issues the callback. On the way to the concrete vdev, if any other
	* indirect vdevs are encountered, then the callback will also be called on
	* each of those indirect vdevs. For example, if the segment is mapped to
	* segment A on indirect vdev 1, and then segment A on indirect vdev 1 is
	* mapped to segment B on concrete vdev 2, then the callback will be called on
	* both vdev 1 and vdev 2.
	*
	* While the callback passed to vdev_indirect_remap() is called on every vdev
	* the function encounters, certain callbacks only care about concrete vdevs.
	* These types of callbacks should return immediately and explicitly when they
	* are called on an indirect vdev.
	*
	* Because there is a possibility that a DVA section in the indirect device
	* has been split into multiple sections in our mapping, we keep track
	* of the relevant contiguous segments of the new location (remap_segment_t)
	* in a stack. This way we can call the callback for each of the new sections
	* created by a single section of the indirect device. Note though, that in
	* this scenario the callbacks in each split block won't occur in-order in
	* terms of offset, so callers should not make any assumptions about that.
	*
	* For callbacks that don't handle split blocks and immediately return when
	* they encounter them (as is the case for remap_blkptr_cb), the caller can
	* assume that its callback will be applied from the first indirect vdev
	* encountered to the last one and then the concrete vdev, in that order.
	*/
	static void
	vdev_indirect_remap(vdev_t *vd, uint64_t offset, uint64_t asize,
	void (func)(uint64_t, vdev_t , uint64_t, uint64_t, void ), void arg)
	{
	list_t stack;
	spa_t *spa = vd->vdev_spa;

	list_create(&stack, sizeof (remap_segment_t),
	offsetof(remap_segment_t, rs_node));

	for (remap_segment_t *rs = rs_alloc(vd, offset, asize, 0);
	rs != NULL; rs = list_remove_head(&stack)) {
	vdev_t *v = rs->rs_vd;
	uint64_t num_entries = 0;

	ASSERT(spa_config_held(spa, SCL_ALL, RW_READER) != 0);
	ASSERT(rs->rs_asize > 0);

	/*
	* Note: As this function can be called from open context
	* (e.g. zio_read()), we need the following rwlock to
	* prevent the mapping from being changed by condensing.
	*
	* So we grab the lock and we make a copy of the entries
	* that are relevant to the extent that we are working on.
	* Once that is done, we drop the lock and iterate over
	* our copy of the mapping. Once we are done with the with
	* the remap segment and we free it, we also free our copy
	* of the indirect mapping entries that are relevant to it.
	*
	* This way we don't need to wait until the function is
	* finished with a segment, to condense it. In addition, we
	* don't need a recursive rwlock for the case that a call to
	* vdev_indirect_remap() needs to call itself (through the
	* codepath of its callback) for the same vdev in the middle
	* of its execution.
	*/
	rw_enter(&v->vdev_indirect_rwlock, RW_READER);
	ASSERT3P(v->vdev_indirect_mapping, !=, NULL);

	vdev_indirect_mapping_entry_phys_t *mapping =
	vdev_indirect_mapping_duplicate_adjacent_entries(v,
	rs->rs_offset, rs->rs_asize, &num_entries);
	ASSERT3P(mapping, !=, NULL);
	ASSERT3U(num_entries, >, 0);
	rw_exit(&v->vdev_indirect_rwlock);

	for (uint64_t i = 0; i < num_entries; i++) {
	/*
	* Note: the vdev_indirect_mapping can not change
	* while we are running. It only changes while the
	* removal is in progress, and then only from syncing
	* context. While a removal is in progress, this
	* function is only called for frees, which also only
	* happen from syncing context.
	*/
	vdev_indirect_mapping_entry_phys_t *m = &mapping[i];

	ASSERT3P(m, !=, NULL);
	ASSERT3U(rs->rs_asize, >, 0);

	uint64_t size = DVA_GET_ASIZE(&m->vimep_dst);
	uint64_t dst_offset = DVA_GET_OFFSET(&m->vimep_dst);
	uint64_t dst_vdev = DVA_GET_VDEV(&m->vimep_dst);

	ASSERT3U(rs->rs_offset, >=,
	DVA_MAPPING_GET_SRC_OFFSET(m));
	ASSERT3U(rs->rs_offset, <,
	DVA_MAPPING_GET_SRC_OFFSET(m) + size);
	ASSERT3U(dst_vdev, !=, v->vdev_id);

	uint64_t inner_offset = rs->rs_offset -
	DVA_MAPPING_GET_SRC_OFFSET(m);
	uint64_t inner_size =
	MIN(rs->rs_asize, size - inner_offset);

	vdev_t *dst_v = vdev_lookup_top(spa, dst_vdev);
	ASSERT3P(dst_v, !=, NULL);

	if (dst_v->vdev_ops == &vdev_indirect_ops) {
	list_insert_head(&stack,
	rs_alloc(dst_v, dst_offset + inner_offset,
	inner_size, rs->rs_split_offset));

	}

	if ((zfs_flags & ZFS_DEBUG_INDIRECT_REMAP) &&
	IS_P2ALIGNED(inner_size, 2 * SPA_MINBLOCKSIZE)) {
	/*
	* Note: This clause exists only solely for
	* testing purposes. We use it to ensure that
	* split blocks work and that the callbacks
	* using them yield the same result if issued
	* in reverse order.
	*/
	uint64_t inner_half = inner_size / 2;

	func(rs->rs_split_offset + inner_half, dst_v,
	dst_offset + inner_offset + inner_half,
	inner_half, arg);

	func(rs->rs_split_offset, dst_v,
	dst_offset + inner_offset,
	inner_half, arg);
	} else {
	func(rs->rs_split_offset, dst_v,
	dst_offset + inner_offset,
	inner_size, arg);
	}

	rs->rs_offset += inner_size;
	rs->rs_asize -= inner_size;
	rs->rs_split_offset += inner_size;
	}
	VERIFY0(rs->rs_asize);

	kmem_free(mapping, num_entries * sizeof (*mapping));
	kmem_free(rs, sizeof (remap_segment_t));
	}
	list_destroy(&stack);
	}

	static void
	vdev_indirect_child_io_done(zio_t *zio)
	{
	zio_t *pio = zio->io_private;

	mutex_enter(&pio->io_lock);
	pio->io_error = zio_worst_error(pio->io_error, zio->io_error);
	mutex_exit(&pio->io_lock);

	abd_put(zio->io_abd);
	}

	/*
	* This is a callback for vdev_indirect_remap() which allocates an
	* indirect_split_t for each split segment and adds it to iv_splits.
	*/
	static void
	vdev_indirect_gather_splits(uint64_t split_offset, vdev_t *vd, uint64_t offset,
	uint64_t size, void *arg)
	{
	zio_t *zio = arg;
	indirect_vsd_t *iv = zio->io_vsd;

	ASSERT3P(vd, !=, NULL);

	if (vd->vdev_ops == &vdev_indirect_ops)
	return;

	int n = 1;
	if (vd->vdev_ops == &vdev_mirror_ops)
	n = vd->vdev_children;

	indirect_split_t *is =
	kmem_zalloc(offsetof(indirect_split_t, is_child[n]), KM_SLEEP);

	is->is_children = n;
	is->is_size = size;
	is->is_split_offset = split_offset;
	is->is_target_offset = offset;
	is->is_vdev = vd;
	list_create(&is->is_unique_child, sizeof (indirect_child_t),
	offsetof(indirect_child_t, ic_node));

	/*
	* Note that we only consider multiple copies of the data for
	* mirror vdevs. We don't for "replacing" or "spare" vdevs, even
	* though they use the same ops as mirror, because there's only one
	* "good" copy under the replacing/spare.
	*/
	if (vd->vdev_ops == &vdev_mirror_ops) {
	for (int i = 0; i < n; i++) {
	is->is_child[i].ic_vdev = vd->vdev_child[i];
	list_link_init(&is->is_child[i].ic_node);
	}
	} else {
	is->is_child[0].ic_vdev = vd;
	}

	list_insert_tail(&iv->iv_splits, is);
	}

	static void
	vdev_indirect_read_split_done(zio_t *zio)
	{
	indirect_child_t *ic = zio->io_private;

	if (zio->io_error != 0) {
	/*
	* Clear ic_data to indicate that we do not have data for this
	* child.
	*/
	abd_free(ic->ic_data);
	ic->ic_data = NULL;
	}
	}

	/*
	* Issue reads for all copies (mirror children) of all splits.
	*/
	static void
	vdev_indirect_read_all(zio_t *zio)
	{
	indirect_vsd_t *iv = zio->io_vsd;

	ASSERT3U(zio->io_type, ==, ZIO_TYPE_READ);

	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	for (int i = 0; i < is->is_children; i++) {
	indirect_child_t *ic = &is->is_child[i];

	if (!vdev_readable(ic->ic_vdev))
	continue;

	/*
	* Note, we may read from a child whose DTL
	* indicates that the data may not be present here.
	* While this might result in a few i/os that will
	* likely return incorrect data, it simplifies the
	* code since we can treat scrub and resilver
	* identically. (The incorrect data will be
	* detected and ignored when we verify the
	* checksum.)
	*/

	ic->ic_data = abd_alloc_sametype(zio->io_abd,
	is->is_size);
	ic->ic_duplicate = NULL;

	zio_nowait(zio_vdev_child_io(zio, NULL,
	ic->ic_vdev, is->is_target_offset, ic->ic_data,
	is->is_size, zio->io_type, zio->io_priority, 0,
	vdev_indirect_read_split_done, ic));
	}
	}
	iv->iv_reconstruct = B_TRUE;
	}

	static void
	vdev_indirect_io_start(zio_t *zio)
	{
	spa_t *spa __maybe_unused = zio->io_spa;
	indirect_vsd_t iv = kmem_zalloc(sizeof (iv), KM_SLEEP);
	list_create(&iv->iv_splits,
	sizeof (indirect_split_t), offsetof(indirect_split_t, is_node));

	zio->io_vsd = iv;
	zio->io_vsd_ops = &vdev_indirect_vsd_ops;

	ASSERT(spa_config_held(spa, SCL_ALL, RW_READER) != 0);
	if (zio->io_type != ZIO_TYPE_READ) {
	ASSERT3U(zio->io_type, ==, ZIO_TYPE_WRITE);
	/*
	* Note: this code can handle other kinds of writes,
	* but we don't expect them.
	*/
	ASSERT((zio->io_flags & (ZIO_FLAG_SELF_HEAL \|
	ZIO_FLAG_RESILVER \| ZIO_FLAG_INDUCE_DAMAGE)) != 0);
	}

	vdev_indirect_remap(zio->io_vd, zio->io_offset, zio->io_size,
	vdev_indirect_gather_splits, zio);

	indirect_split_t *first = list_head(&iv->iv_splits);
	if (first->is_size == zio->io_size) {
	/*
	* This is not a split block; we are pointing to the entire
	* data, which will checksum the same as the original data.
	* Pass the BP down so that the child i/o can verify the
	* checksum, and try a different location if available
	* (e.g. on a mirror).
	*
	* While this special case could be handled the same as the
	* general (split block) case, doing it this way ensures
	* that the vast majority of blocks on indirect vdevs
	* (which are not split) are handled identically to blocks
	* on non-indirect vdevs. This allows us to be less strict
	* about performance in the general (but rare) case.
	*/
	ASSERT0(first->is_split_offset);
	ASSERT3P(list_next(&iv->iv_splits, first), ==, NULL);
	zio_nowait(zio_vdev_child_io(zio, zio->io_bp,
	first->is_vdev, first->is_target_offset,
	abd_get_offset(zio->io_abd, 0),
	zio->io_size, zio->io_type, zio->io_priority, 0,
	vdev_indirect_child_io_done, zio));
	} else {
	iv->iv_split_block = B_TRUE;
	if (zio->io_type == ZIO_TYPE_READ &&
	zio->io_flags & (ZIO_FLAG_SCRUB \| ZIO_FLAG_RESILVER)) {
	/*
	* Read all copies. Note that for simplicity,
	* we don't bother consulting the DTL in the
	* resilver case.
	*/
	vdev_indirect_read_all(zio);
	} else {
	/*
	* If this is a read zio, we read one copy of each
	* split segment, from the top-level vdev. Since
	* we don't know the checksum of each split
	* individually, the child zio can't ensure that
	* we get the right data. E.g. if it's a mirror,
	* it will just read from a random (healthy) leaf
	* vdev. We have to verify the checksum in
	* vdev_indirect_io_done().
	*
	* For write zios, the vdev code will ensure we write
	* to all children.
	*/
	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	zio_nowait(zio_vdev_child_io(zio, NULL,
	is->is_vdev, is->is_target_offset,
	abd_get_offset(zio->io_abd,
	is->is_split_offset), is->is_size,
	zio->io_type, zio->io_priority, 0,
	vdev_indirect_child_io_done, zio));
	}

	}
	}

	zio_execute(zio);
	}

	/*
	* Report a checksum error for a child.
	*/
	static void
	vdev_indirect_checksum_error(zio_t *zio,
	indirect_split_t is, indirect_child_t ic)
	{
	vdev_t *vd = ic->ic_vdev;

	if (zio->io_flags & ZIO_FLAG_SPECULATIVE)
	return;

	mutex_enter(&vd->vdev_stat_lock);
	vd->vdev_stat.vs_checksum_errors++;
	mutex_exit(&vd->vdev_stat_lock);

	zio_bad_cksum_t zbc = {{{ 0 }}};
	abd_t *bad_abd = ic->ic_data;
	abd_t *good_abd = is->is_good_child->ic_data;
	(void) zfs_ereport_post_checksum(zio->io_spa, vd, NULL, zio,
	is->is_target_offset, is->is_size, good_abd, bad_abd, &zbc);
	}

	/*
	* Issue repair i/os for any incorrect copies. We do this by comparing
	* each split segment's correct data (is_good_child's ic_data) with each
	* other copy of the data. If they differ, then we overwrite the bad data
	* with the good copy. Note that we do this without regard for the DTL's,
	* which simplifies this code and also issues the optimal number of writes
	* (based on which copies actually read bad data, as opposed to which we
	* think might be wrong). For the same reason, we always use
	* ZIO_FLAG_SELF_HEAL, to bypass the DTL check in zio_vdev_io_start().
	*/
	static void
	vdev_indirect_repair(zio_t *zio)
	{
	indirect_vsd_t *iv = zio->io_vsd;

	enum zio_flag flags = ZIO_FLAG_IO_REPAIR;

	if (!(zio->io_flags & (ZIO_FLAG_SCRUB \| ZIO_FLAG_RESILVER)))
	flags \|= ZIO_FLAG_SELF_HEAL;

	if (!spa_writeable(zio->io_spa))
	return;

	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	for (int c = 0; c < is->is_children; c++) {
	indirect_child_t *ic = &is->is_child[c];
	if (ic == is->is_good_child)
	continue;
	if (ic->ic_data == NULL)
	continue;
	if (ic->ic_duplicate == is->is_good_child)
	continue;

	zio_nowait(zio_vdev_child_io(zio, NULL,
	ic->ic_vdev, is->is_target_offset,
	is->is_good_child->ic_data, is->is_size,
	ZIO_TYPE_WRITE, ZIO_PRIORITY_ASYNC_WRITE,
	ZIO_FLAG_IO_REPAIR \| ZIO_FLAG_SELF_HEAL,
	NULL, NULL));

	vdev_indirect_checksum_error(zio, is, ic);
	}
	}
	}

	/*
	* Report checksum errors on all children that we read from.
	*/
	static void
	vdev_indirect_all_checksum_errors(zio_t *zio)
	{
	indirect_vsd_t *iv = zio->io_vsd;

	if (zio->io_flags & ZIO_FLAG_SPECULATIVE)
	return;

	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	for (int c = 0; c < is->is_children; c++) {
	indirect_child_t *ic = &is->is_child[c];

	if (ic->ic_data == NULL)
	continue;

	vdev_t *vd = ic->ic_vdev;

	- mutex_enter(&vd->vdev_stat_lock);
	- vd->vdev_stat.vs_checksum_errors++;
	- mutex_exit(&vd->vdev_stat_lock);
	-
	- (void) zfs_ereport_post_checksum(zio->io_spa, vd,
	+ int ret = zfs_ereport_post_checksum(zio->io_spa, vd,
	NULL, zio, is->is_target_offset, is->is_size,
	NULL, NULL, NULL);
	+ if (ret != EALREADY) {
	+ mutex_enter(&vd->vdev_stat_lock);
	+ vd->vdev_stat.vs_checksum_errors++;
	+ mutex_exit(&vd->vdev_stat_lock);
	+ }
	}
	}
	}

	/*
	* Copy data from all the splits to a main zio then validate the checksum.
	* If then checksum is successfully validated return success.
	*/
	static int
	vdev_indirect_splits_checksum_validate(indirect_vsd_t iv, zio_t zio)
	{
	zio_bad_cksum_t zbc;

	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {

	ASSERT3P(is->is_good_child->ic_data, !=, NULL);
	ASSERT3P(is->is_good_child->ic_duplicate, ==, NULL);

	abd_copy_off(zio->io_abd, is->is_good_child->ic_data,
	is->is_split_offset, 0, is->is_size);
	}

	return (zio_checksum_error(zio, &zbc));
	}

	/*
	* There are relatively few possible combinations making it feasible to
	* deterministically check them all. We do this by setting the good_child
	* to the next unique split version. If we reach the end of the list then
	* "carry over" to the next unique split version (like counting in base
	* is_unique_children, but each digit can have a different base).
	*/
	static int
	vdev_indirect_splits_enumerate_all(indirect_vsd_t iv, zio_t zio)
	{
	boolean_t more = B_TRUE;

	iv->iv_attempts = 0;

	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is))
	is->is_good_child = list_head(&is->is_unique_child);

	while (more == B_TRUE) {
	iv->iv_attempts++;
	more = B_FALSE;

	if (vdev_indirect_splits_checksum_validate(iv, zio) == 0)
	return (0);

	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	is->is_good_child = list_next(&is->is_unique_child,
	is->is_good_child);
	if (is->is_good_child != NULL) {
	more = B_TRUE;
	break;
	}

	is->is_good_child = list_head(&is->is_unique_child);
	}
	}

	ASSERT3S(iv->iv_attempts, <=, iv->iv_unique_combinations);

	return (SET_ERROR(ECKSUM));
	}

	/*
	* There are too many combinations to try all of them in a reasonable amount
	* of time. So try a fixed number of random combinations from the unique
	* split versions, after which we'll consider the block unrecoverable.
	*/
	static int
	vdev_indirect_splits_enumerate_randomly(indirect_vsd_t iv, zio_t zio)
	{
	iv->iv_attempts = 0;

	while (iv->iv_attempts < iv->iv_attempts_max) {
	iv->iv_attempts++;

	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	indirect_child_t *ic = list_head(&is->is_unique_child);
	int children = is->is_unique_children;

	for (int i = spa_get_random(children); i > 0; i--)
	ic = list_next(&is->is_unique_child, ic);

	ASSERT3P(ic, !=, NULL);
	is->is_good_child = ic;
	}

	if (vdev_indirect_splits_checksum_validate(iv, zio) == 0)
	return (0);
	}

	return (SET_ERROR(ECKSUM));
	}

	/*
	* This is a validation function for reconstruction. It randomly selects
	* a good combination, if one can be found, and then it intentionally
	* damages all other segment copes by zeroing them. This forces the
	* reconstruction algorithm to locate the one remaining known good copy.
	*/
	static int
	vdev_indirect_splits_damage(indirect_vsd_t iv, zio_t zio)
	{
	int error;

	/* Presume all the copies are unique for initial selection. */
	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	is->is_unique_children = 0;

	for (int i = 0; i < is->is_children; i++) {
	indirect_child_t *ic = &is->is_child[i];
	if (ic->ic_data != NULL) {
	is->is_unique_children++;
	list_insert_tail(&is->is_unique_child, ic);
	}
	}

	if (list_is_empty(&is->is_unique_child)) {
	error = SET_ERROR(EIO);
	goto out;
	}
	}

	/*
	* Set each is_good_child to a randomly-selected child which
	* is known to contain validated data.
	*/
	error = vdev_indirect_splits_enumerate_randomly(iv, zio);
	if (error)
	goto out;

	/*
	* Damage all but the known good copy by zeroing it. This will
	* result in two or less unique copies per indirect_child_t.
	* Both may need to be checked in order to reconstruct the block.
	* Set iv->iv_attempts_max such that all unique combinations will
	* enumerated, but limit the damage to at most 12 indirect splits.
	*/
	iv->iv_attempts_max = 1;

	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	for (int c = 0; c < is->is_children; c++) {
	indirect_child_t *ic = &is->is_child[c];

	if (ic == is->is_good_child)
	continue;
	if (ic->ic_data == NULL)
	continue;

	abd_zero(ic->ic_data, abd_get_size(ic->ic_data));
	}

	iv->iv_attempts_max *= 2;
	if (iv->iv_attempts_max >= (1ULL << 12)) {
	iv->iv_attempts_max = UINT64_MAX;
	break;
	}
	}

	out:
	/* Empty the unique children lists so they can be reconstructed. */
	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	indirect_child_t *ic;
	while ((ic = list_head(&is->is_unique_child)) != NULL)
	list_remove(&is->is_unique_child, ic);

	is->is_unique_children = 0;
	}

	return (error);
	}

	/*
	* This function is called when we have read all copies of the data and need
	* to try to find a combination of copies that gives us the right checksum.
	*
	* If we pointed to any mirror vdevs, this effectively does the job of the
	* mirror. The mirror vdev code can't do its own job because we don't know
	* the checksum of each split segment individually.
	*
	* We have to try every unique combination of copies of split segments, until
	* we find one that checksums correctly. Duplicate segment copies are first
	* identified and latter skipped during reconstruction. This optimization
	* reduces the search space and ensures that of the remaining combinations
	* at most one is correct.
	*
	* When the total number of combinations is small they can all be checked.
	* For example, if we have 3 segments in the split, and each points to a
	* 2-way mirror with unique copies, we will have the following pieces of data:
	*
	* \| mirror child
	* split \| [0] [1]
	* ======\|=====================
	* A \| data_A_0 data_A_1
	* B \| data_B_0 data_B_1
	* C \| data_C_0 data_C_1
	*
	* We will try the following (mirror children)^(number of splits) (2^3=8)
	* combinations, which is similar to bitwise-little-endian counting in
	* binary. In general each "digit" corresponds to a split segment, and the
	* base of each digit is is_children, which can be different for each
	* digit.
	*
	* "low bit" "high bit"
	* v v
	* data_A_0 data_B_0 data_C_0
	* data_A_1 data_B_0 data_C_0
	* data_A_0 data_B_1 data_C_0
	* data_A_1 data_B_1 data_C_0
	* data_A_0 data_B_0 data_C_1
	* data_A_1 data_B_0 data_C_1
	* data_A_0 data_B_1 data_C_1
	* data_A_1 data_B_1 data_C_1
	*
	* Note that the split segments may be on the same or different top-level
	* vdevs. In either case, we may need to try lots of combinations (see
	* zfs_reconstruct_indirect_combinations_max). This ensures that if a mirror
	* has small silent errors on all of its children, we can still reconstruct
	* the correct data, as long as those errors are at sufficiently-separated
	* offsets (specifically, separated by the largest block size - default of
	* 128KB, but up to 16MB).
	*/
	static void
	vdev_indirect_reconstruct_io_done(zio_t *zio)
	{
	indirect_vsd_t *iv = zio->io_vsd;
	boolean_t known_good = B_FALSE;
	int error;

	iv->iv_unique_combinations = 1;
	iv->iv_attempts_max = UINT64_MAX;

	if (zfs_reconstruct_indirect_combinations_max > 0)
	iv->iv_attempts_max = zfs_reconstruct_indirect_combinations_max;

	/*
	* If nonzero, every 1/x blocks will be damaged, in order to validate
	* reconstruction when there are split segments with damaged copies.
	* Known_good will be TRUE when reconstruction is known to be possible.
	*/
	if (zfs_reconstruct_indirect_damage_fraction != 0 &&
	spa_get_random(zfs_reconstruct_indirect_damage_fraction) == 0)
	known_good = (vdev_indirect_splits_damage(iv, zio) == 0);

	/*
	* Determine the unique children for a split segment and add them
	* to the is_unique_child list. By restricting reconstruction
	* to these children, only unique combinations will be considered.
	* This can vastly reduce the search space when there are a large
	* number of indirect splits.
	*/
	for (indirect_split_t *is = list_head(&iv->iv_splits);
	is != NULL; is = list_next(&iv->iv_splits, is)) {
	is->is_unique_children = 0;

	for (int i = 0; i < is->is_children; i++) {
	indirect_child_t *ic_i = &is->is_child[i];

	if (ic_i->ic_data == NULL \|\|
	ic_i->ic_duplicate != NULL)
	continue;

	for (int j = i + 1; j < is->is_children; j++) {
	indirect_child_t *ic_j = &is->is_child[j];

	if (ic_j->ic_data == NULL \|\|
	ic_j->ic_duplicate != NULL)
	continue;

	if (abd_cmp(ic_i->ic_data, ic_j->ic_data) == 0)
	ic_j->ic_duplicate = ic_i;
	}

	is->is_unique_children++;
	list_insert_tail(&is->is_unique_child, ic_i);
	}

	/* Reconstruction is impossible, no valid children */
	EQUIV(list_is_empty(&is->is_unique_child),
	is->is_unique_children == 0);
	if (list_is_empty(&is->is_unique_child)) {
	zio->io_error = EIO;
	vdev_indirect_all_checksum_errors(zio);
	zio_checksum_verified(zio);
	return;
	}

	iv->iv_unique_combinations *= is->is_unique_children;
	}

	if (iv->iv_unique_combinations <= iv->iv_attempts_max)
	error = vdev_indirect_splits_enumerate_all(iv, zio);
	else
	error = vdev_indirect_splits_enumerate_randomly(iv, zio);

	if (error != 0) {
	/* All attempted combinations failed. */
	ASSERT3B(known_good, ==, B_FALSE);
	zio->io_error = error;
	vdev_indirect_all_checksum_errors(zio);
	} else {
	/*
	* The checksum has been successfully validated. Issue
	* repair I/Os to any copies of splits which don't match
	* the validated version.
	*/
	ASSERT0(vdev_indirect_splits_checksum_validate(iv, zio));
	vdev_indirect_repair(zio);
	zio_checksum_verified(zio);
	}
	}

	static void
	vdev_indirect_io_done(zio_t *zio)
	{
	indirect_vsd_t *iv = zio->io_vsd;

	if (iv->iv_reconstruct) {
	/*
	* We have read all copies of the data (e.g. from mirrors),
	* either because this was a scrub/resilver, or because the
	* one-copy read didn't checksum correctly.
	*/
	vdev_indirect_reconstruct_io_done(zio);
	return;
	}

	if (!iv->iv_split_block) {
	/*
	* This was not a split block, so we passed the BP down,
	* and the checksum was handled by the (one) child zio.
	*/
	return;
	}

	zio_bad_cksum_t zbc;
	int ret = zio_checksum_error(zio, &zbc);
	if (ret == 0) {
	zio_checksum_verified(zio);
	return;
	}

	/*
	* The checksum didn't match. Read all copies of all splits, and
	* then we will try to reconstruct. The next time
	* vdev_indirect_io_done() is called, iv_reconstruct will be set.
	*/
	vdev_indirect_read_all(zio);

	zio_vdev_io_redone(zio);
	}

	vdev_ops_t vdev_indirect_ops = {
	.vdev_op_open = vdev_indirect_open,
	.vdev_op_close = vdev_indirect_close,
	.vdev_op_asize = vdev_default_asize,
	.vdev_op_io_start = vdev_indirect_io_start,
	.vdev_op_io_done = vdev_indirect_io_done,
	.vdev_op_state_change = NULL,
	.vdev_op_need_resilver = NULL,
	.vdev_op_hold = NULL,
	.vdev_op_rele = NULL,
	.vdev_op_remap = vdev_indirect_remap,
	.vdev_op_xlate = NULL,
	.vdev_op_type = VDEV_TYPE_INDIRECT, /* name of this vdev type */
	.vdev_op_leaf = B_FALSE /* leaf vdev */
	};

	EXPORT_SYMBOL(spa_condense_fini);
	EXPORT_SYMBOL(spa_start_indirect_condensing_thread);
	EXPORT_SYMBOL(spa_condense_indirect_start_sync);
	EXPORT_SYMBOL(spa_condense_init);
	EXPORT_SYMBOL(spa_vdev_indirect_mark_obsolete);
	EXPORT_SYMBOL(vdev_indirect_mark_obsolete);
	EXPORT_SYMBOL(vdev_indirect_should_condense);
	EXPORT_SYMBOL(vdev_indirect_sync_obsolete);
	EXPORT_SYMBOL(vdev_obsolete_counts_are_precise);
	EXPORT_SYMBOL(vdev_obsolete_sm_object);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_condense, zfs_condense_, indirect_vdevs_enable, INT, ZMOD_RW,
	"Whether to attempt condensing indirect vdev mappings");

	ZFS_MODULE_PARAM(zfs_condense, zfs_condense_, min_mapping_bytes, ULONG, ZMOD_RW,
	"Don't bother condensing if the mapping uses less than this amount of "
	"memory");

	ZFS_MODULE_PARAM(zfs_condense, zfs_condense_, max_obsolete_bytes, ULONG, ZMOD_RW,
	"Minimum size obsolete spacemap to attempt condensing");

	ZFS_MODULE_PARAM(zfs_condense, zfs_condense_, indirect_commit_entry_delay_ms, INT, ZMOD_RW,
	"Used by tests to ensure certain actions happen in the middle of a "
	"condense. A maximum value of 1 should be sufficient.");

	ZFS_MODULE_PARAM(zfs_reconstruct, zfs_reconstruct_, indirect_combinations_max, INT, ZMOD_RW,
	"Maximum number of combinations when reconstructing split segments");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/vdev_initialize.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev_initialize.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev_initialize.c (revision 365892)
	@@ -1,750 +1,749 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2016, 2019 by Delphix. All rights reserved.
	*/

	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/txg.h>
	#include <sys/vdev_impl.h>
	#include <sys/metaslab_impl.h>
	#include <sys/dsl_synctask.h>
	#include <sys/zap.h>
	#include <sys/dmu_tx.h>
	#include <sys/vdev_initialize.h>

	/*
	* Value that is written to disk during initialization.
	*/
	#ifdef _ILP32
	unsigned long zfs_initialize_value = 0xdeadbeefUL;
	#else
	unsigned long zfs_initialize_value = 0xdeadbeefdeadbeeeULL;
	#endif

	/* maximum number of I/Os outstanding per leaf vdev */
	int zfs_initialize_limit = 1;

	/* size of initializing writes; default 1MiB, see zfs_remove_max_segment */
	unsigned long zfs_initialize_chunk_size = 1024 * 1024;

	static boolean_t
	vdev_initialize_should_stop(vdev_t *vd)
	{
	return (vd->vdev_initialize_exit_wanted \|\| !vdev_writeable(vd) \|\|
	vd->vdev_detached \|\| vd->vdev_top->vdev_removing);
	}

	static void
	vdev_initialize_zap_update_sync(void arg, dmu_tx_t tx)
	{
	/*
	* We pass in the guid instead of the vdev_t since the vdev may
	* have been freed prior to the sync task being processed. This
	* happens when a vdev is detached as we call spa_config_vdev_exit(),
	* stop the initializing thread, schedule the sync task, and free
	* the vdev. Later when the scheduled sync task is invoked, it would
	* find that the vdev has been freed.
	*/
	uint64_t guid = (uint64_t )arg;
	uint64_t txg = dmu_tx_get_txg(tx);
	kmem_free(arg, sizeof (uint64_t));

	vdev_t *vd = spa_lookup_by_guid(tx->tx_pool->dp_spa, guid, B_FALSE);
	if (vd == NULL \|\| vd->vdev_top->vdev_removing \|\| !vdev_is_concrete(vd))
	return;

	uint64_t last_offset = vd->vdev_initialize_offset[txg & TXG_MASK];
	vd->vdev_initialize_offset[txg & TXG_MASK] = 0;

	VERIFY(vd->vdev_leaf_zap != 0);

	objset_t *mos = vd->vdev_spa->spa_meta_objset;

	if (last_offset > 0) {
	vd->vdev_initialize_last_offset = last_offset;
	VERIFY0(zap_update(mos, vd->vdev_leaf_zap,
	VDEV_LEAF_ZAP_INITIALIZE_LAST_OFFSET,
	sizeof (last_offset), 1, &last_offset, tx));
	}
	if (vd->vdev_initialize_action_time > 0) {
	uint64_t val = (uint64_t)vd->vdev_initialize_action_time;
	VERIFY0(zap_update(mos, vd->vdev_leaf_zap,
	VDEV_LEAF_ZAP_INITIALIZE_ACTION_TIME, sizeof (val),
	1, &val, tx));
	}

	uint64_t initialize_state = vd->vdev_initialize_state;
	VERIFY0(zap_update(mos, vd->vdev_leaf_zap,
	VDEV_LEAF_ZAP_INITIALIZE_STATE, sizeof (initialize_state), 1,
	&initialize_state, tx));
	}

	static void
	vdev_initialize_change_state(vdev_t *vd, vdev_initializing_state_t new_state)
	{
	ASSERT(MUTEX_HELD(&vd->vdev_initialize_lock));
	spa_t *spa = vd->vdev_spa;

	if (new_state == vd->vdev_initialize_state)
	return;

	/*
	* Copy the vd's guid, this will be freed by the sync task.
	*/
	uint64_t *guid = kmem_zalloc(sizeof (uint64_t), KM_SLEEP);
	*guid = vd->vdev_guid;

	/*
	* If we're suspending, then preserving the original start time.
	*/
	if (vd->vdev_initialize_state != VDEV_INITIALIZE_SUSPENDED) {
	vd->vdev_initialize_action_time = gethrestime_sec();
	}
	vd->vdev_initialize_state = new_state;

	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));
	dsl_sync_task_nowait(spa_get_dsl(spa), vdev_initialize_zap_update_sync,
	- guid, 2, ZFS_SPACE_CHECK_NONE, tx);
	+ guid, tx);

	switch (new_state) {
	case VDEV_INITIALIZE_ACTIVE:
	spa_history_log_internal(spa, "initialize", tx,
	"vdev=%s activated", vd->vdev_path);
	break;
	case VDEV_INITIALIZE_SUSPENDED:
	spa_history_log_internal(spa, "initialize", tx,
	"vdev=%s suspended", vd->vdev_path);
	break;
	case VDEV_INITIALIZE_CANCELED:
	spa_history_log_internal(spa, "initialize", tx,
	"vdev=%s canceled", vd->vdev_path);
	break;
	case VDEV_INITIALIZE_COMPLETE:
	spa_history_log_internal(spa, "initialize", tx,
	"vdev=%s complete", vd->vdev_path);
	break;
	default:
	panic("invalid state %llu", (unsigned long long)new_state);
	}

	dmu_tx_commit(tx);

	if (new_state != VDEV_INITIALIZE_ACTIVE)
	spa_notify_waiters(spa);
	}

	static void
	vdev_initialize_cb(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;
	mutex_enter(&vd->vdev_initialize_io_lock);
	if (zio->io_error == ENXIO && !vdev_writeable(vd)) {
	/*
	* The I/O failed because the vdev was unavailable; roll the
	* last offset back. (This works because spa_sync waits on
	* spa_txg_zio before it runs sync tasks.)
	*/
	uint64_t *off =
	&vd->vdev_initialize_offset[zio->io_txg & TXG_MASK];
	off = MIN(off, zio->io_offset);
	} else {
	/*
	* Since initializing is best-effort, we ignore I/O errors and
	* rely on vdev_probe to determine if the errors are more
	* critical.
	*/
	if (zio->io_error != 0)
	vd->vdev_stat.vs_initialize_errors++;

	vd->vdev_initialize_bytes_done += zio->io_orig_size;
	}
	ASSERT3U(vd->vdev_initialize_inflight, >, 0);
	vd->vdev_initialize_inflight--;
	cv_broadcast(&vd->vdev_initialize_io_cv);
	mutex_exit(&vd->vdev_initialize_io_lock);

	spa_config_exit(vd->vdev_spa, SCL_STATE_ALL, vd);
	}

	/* Takes care of physical writing and limiting # of concurrent ZIOs. */
	static int
	vdev_initialize_write(vdev_t vd, uint64_t start, uint64_t size, abd_t data)
	{
	spa_t *spa = vd->vdev_spa;

	/* Limit inflight initializing I/Os */
	mutex_enter(&vd->vdev_initialize_io_lock);
	while (vd->vdev_initialize_inflight >= zfs_initialize_limit) {
	cv_wait(&vd->vdev_initialize_io_cv,
	&vd->vdev_initialize_io_lock);
	}
	vd->vdev_initialize_inflight++;
	mutex_exit(&vd->vdev_initialize_io_lock);

	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));
	uint64_t txg = dmu_tx_get_txg(tx);

	spa_config_enter(spa, SCL_STATE_ALL, vd, RW_READER);
	mutex_enter(&vd->vdev_initialize_lock);

	if (vd->vdev_initialize_offset[txg & TXG_MASK] == 0) {
	uint64_t *guid = kmem_zalloc(sizeof (uint64_t), KM_SLEEP);
	*guid = vd->vdev_guid;

	/* This is the first write of this txg. */
	dsl_sync_task_nowait(spa_get_dsl(spa),
	- vdev_initialize_zap_update_sync, guid, 2,
	- ZFS_SPACE_CHECK_RESERVED, tx);
	+ vdev_initialize_zap_update_sync, guid, tx);
	}

	/*
	* We know the vdev struct will still be around since all
	* consumers of vdev_free must stop the initialization first.
	*/
	if (vdev_initialize_should_stop(vd)) {
	mutex_enter(&vd->vdev_initialize_io_lock);
	ASSERT3U(vd->vdev_initialize_inflight, >, 0);
	vd->vdev_initialize_inflight--;
	mutex_exit(&vd->vdev_initialize_io_lock);
	spa_config_exit(vd->vdev_spa, SCL_STATE_ALL, vd);
	mutex_exit(&vd->vdev_initialize_lock);
	dmu_tx_commit(tx);
	return (SET_ERROR(EINTR));
	}
	mutex_exit(&vd->vdev_initialize_lock);

	vd->vdev_initialize_offset[txg & TXG_MASK] = start + size;
	zio_nowait(zio_write_phys(spa->spa_txg_zio[txg & TXG_MASK], vd, start,
	size, data, ZIO_CHECKSUM_OFF, vdev_initialize_cb, NULL,
	ZIO_PRIORITY_INITIALIZING, ZIO_FLAG_CANFAIL, B_FALSE));
	/* vdev_initialize_cb releases SCL_STATE_ALL */

	dmu_tx_commit(tx);

	return (0);
	}

	/*
	* Callback to fill each ABD chunk with zfs_initialize_value. len must be
	* divisible by sizeof (uint64_t), and buf must be 8-byte aligned. The ABD
	* allocation will guarantee these for us.
	*/
	/* ARGSUSED */
	static int
	vdev_initialize_block_fill(void buf, size_t len, void unused)
	{
	ASSERT0(len % sizeof (uint64_t));
	#ifdef _ILP32
	for (uint64_t i = 0; i < len; i += sizeof (uint32_t)) {
	(uint32_t )((char *)(buf) + i) = zfs_initialize_value;
	}
	#else
	for (uint64_t i = 0; i < len; i += sizeof (uint64_t)) {
	(uint64_t )((char *)(buf) + i) = zfs_initialize_value;
	}
	#endif
	return (0);
	}

	static abd_t *
	vdev_initialize_block_alloc(void)
	{
	/* Allocate ABD for filler data */
	abd_t *data = abd_alloc_for_io(zfs_initialize_chunk_size, B_FALSE);

	ASSERT0(zfs_initialize_chunk_size % sizeof (uint64_t));
	(void) abd_iterate_func(data, 0, zfs_initialize_chunk_size,
	vdev_initialize_block_fill, NULL);

	return (data);
	}

	static void
	vdev_initialize_block_free(abd_t *data)
	{
	abd_free(data);
	}

	static int
	vdev_initialize_ranges(vdev_t vd, abd_t data)
	{
	range_tree_t *rt = vd->vdev_initialize_tree;
	zfs_btree_t *bt = &rt->rt_root;
	zfs_btree_index_t where;

	for (range_seg_t *rs = zfs_btree_first(bt, &where); rs != NULL;
	rs = zfs_btree_next(bt, &where, &where)) {
	uint64_t size = rs_get_end(rs, rt) - rs_get_start(rs, rt);

	/* Split range into legally-sized physical chunks */
	uint64_t writes_required =
	((size - 1) / zfs_initialize_chunk_size) + 1;

	for (uint64_t w = 0; w < writes_required; w++) {
	int error;

	error = vdev_initialize_write(vd,
	VDEV_LABEL_START_SIZE + rs_get_start(rs, rt) +
	(w * zfs_initialize_chunk_size),
	MIN(size - (w * zfs_initialize_chunk_size),
	zfs_initialize_chunk_size), data);
	if (error != 0)
	return (error);
	}
	}
	return (0);
	}

	static void
	vdev_initialize_calculate_progress(vdev_t *vd)
	{
	ASSERT(spa_config_held(vd->vdev_spa, SCL_CONFIG, RW_READER) \|\|
	spa_config_held(vd->vdev_spa, SCL_CONFIG, RW_WRITER));
	ASSERT(vd->vdev_leaf_zap != 0);

	vd->vdev_initialize_bytes_est = 0;
	vd->vdev_initialize_bytes_done = 0;

	for (uint64_t i = 0; i < vd->vdev_top->vdev_ms_count; i++) {
	metaslab_t *msp = vd->vdev_top->vdev_ms[i];
	mutex_enter(&msp->ms_lock);

	uint64_t ms_free = msp->ms_size -
	metaslab_allocated_space(msp);

	if (vd->vdev_top->vdev_ops == &vdev_raidz_ops)
	ms_free /= vd->vdev_top->vdev_children;

	/*
	* Convert the metaslab range to a physical range
	* on our vdev. We use this to determine if we are
	* in the middle of this metaslab range.
	*/
	range_seg64_t logical_rs, physical_rs;
	logical_rs.rs_start = msp->ms_start;
	logical_rs.rs_end = msp->ms_start + msp->ms_size;
	vdev_xlate(vd, &logical_rs, &physical_rs);

	if (vd->vdev_initialize_last_offset <= physical_rs.rs_start) {
	vd->vdev_initialize_bytes_est += ms_free;
	mutex_exit(&msp->ms_lock);
	continue;
	} else if (vd->vdev_initialize_last_offset >
	physical_rs.rs_end) {
	vd->vdev_initialize_bytes_done += ms_free;
	vd->vdev_initialize_bytes_est += ms_free;
	mutex_exit(&msp->ms_lock);
	continue;
	}

	/*
	* If we get here, we're in the middle of initializing this
	* metaslab. Load it and walk the free tree for more accurate
	* progress estimation.
	*/
	VERIFY0(metaslab_load(msp));

	zfs_btree_index_t where;
	range_tree_t *rt = msp->ms_allocatable;
	for (range_seg_t *rs =
	zfs_btree_first(&rt->rt_root, &where); rs;
	rs = zfs_btree_next(&rt->rt_root, &where,
	&where)) {
	logical_rs.rs_start = rs_get_start(rs, rt);
	logical_rs.rs_end = rs_get_end(rs, rt);
	vdev_xlate(vd, &logical_rs, &physical_rs);

	uint64_t size = physical_rs.rs_end -
	physical_rs.rs_start;
	vd->vdev_initialize_bytes_est += size;
	if (vd->vdev_initialize_last_offset >
	physical_rs.rs_end) {
	vd->vdev_initialize_bytes_done += size;
	} else if (vd->vdev_initialize_last_offset >
	physical_rs.rs_start &&
	vd->vdev_initialize_last_offset <
	physical_rs.rs_end) {
	vd->vdev_initialize_bytes_done +=
	vd->vdev_initialize_last_offset -
	physical_rs.rs_start;
	}
	}
	mutex_exit(&msp->ms_lock);
	}
	}

	static int
	vdev_initialize_load(vdev_t *vd)
	{
	int err = 0;
	ASSERT(spa_config_held(vd->vdev_spa, SCL_CONFIG, RW_READER) \|\|
	spa_config_held(vd->vdev_spa, SCL_CONFIG, RW_WRITER));
	ASSERT(vd->vdev_leaf_zap != 0);

	if (vd->vdev_initialize_state == VDEV_INITIALIZE_ACTIVE \|\|
	vd->vdev_initialize_state == VDEV_INITIALIZE_SUSPENDED) {
	err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_INITIALIZE_LAST_OFFSET,
	sizeof (vd->vdev_initialize_last_offset), 1,
	&vd->vdev_initialize_last_offset);
	if (err == ENOENT) {
	vd->vdev_initialize_last_offset = 0;
	err = 0;
	}
	}

	vdev_initialize_calculate_progress(vd);
	return (err);
	}

	/*
	* Convert the logical range into a physical range and add it to our
	* avl tree.
	*/
	static void
	vdev_initialize_range_add(void *arg, uint64_t start, uint64_t size)
	{
	vdev_t *vd = arg;
	range_seg64_t logical_rs, physical_rs;
	logical_rs.rs_start = start;
	logical_rs.rs_end = start + size;

	ASSERT(vd->vdev_ops->vdev_op_leaf);
	vdev_xlate(vd, &logical_rs, &physical_rs);

	IMPLY(vd->vdev_top == vd,
	logical_rs.rs_start == physical_rs.rs_start);
	IMPLY(vd->vdev_top == vd,
	logical_rs.rs_end == physical_rs.rs_end);

	/* Only add segments that we have not visited yet */
	if (physical_rs.rs_end <= vd->vdev_initialize_last_offset)
	return;

	/* Pick up where we left off mid-range. */
	if (vd->vdev_initialize_last_offset > physical_rs.rs_start) {
	zfs_dbgmsg("range write: vd %s changed (%llu, %llu) to "
	"(%llu, %llu)", vd->vdev_path,
	(u_longlong_t)physical_rs.rs_start,
	(u_longlong_t)physical_rs.rs_end,
	(u_longlong_t)vd->vdev_initialize_last_offset,
	(u_longlong_t)physical_rs.rs_end);
	ASSERT3U(physical_rs.rs_end, >,
	vd->vdev_initialize_last_offset);
	physical_rs.rs_start = vd->vdev_initialize_last_offset;
	}
	ASSERT3U(physical_rs.rs_end, >=, physical_rs.rs_start);

	/*
	* With raidz, it's possible that the logical range does not live on
	* this leaf vdev. We only add the physical range to this vdev's if it
	* has a length greater than 0.
	*/
	if (physical_rs.rs_end > physical_rs.rs_start) {
	range_tree_add(vd->vdev_initialize_tree, physical_rs.rs_start,
	physical_rs.rs_end - physical_rs.rs_start);
	} else {
	ASSERT3U(physical_rs.rs_end, ==, physical_rs.rs_start);
	}
	}

	static void
	vdev_initialize_thread(void *arg)
	{
	vdev_t *vd = arg;
	spa_t *spa = vd->vdev_spa;
	int error = 0;
	uint64_t ms_count = 0;

	ASSERT(vdev_is_concrete(vd));
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	vd->vdev_initialize_last_offset = 0;
	VERIFY0(vdev_initialize_load(vd));

	abd_t *deadbeef = vdev_initialize_block_alloc();

	vd->vdev_initialize_tree = range_tree_create(NULL, RANGE_SEG64, NULL,
	0, 0);

	for (uint64_t i = 0; !vd->vdev_detached &&
	i < vd->vdev_top->vdev_ms_count; i++) {
	metaslab_t *msp = vd->vdev_top->vdev_ms[i];
	boolean_t unload_when_done = B_FALSE;

	/*
	* If we've expanded the top-level vdev or it's our
	* first pass, calculate our progress.
	*/
	if (vd->vdev_top->vdev_ms_count != ms_count) {
	vdev_initialize_calculate_progress(vd);
	ms_count = vd->vdev_top->vdev_ms_count;
	}

	spa_config_exit(spa, SCL_CONFIG, FTAG);
	metaslab_disable(msp);
	mutex_enter(&msp->ms_lock);
	if (!msp->ms_loaded && !msp->ms_loading)
	unload_when_done = B_TRUE;
	VERIFY0(metaslab_load(msp));

	range_tree_walk(msp->ms_allocatable, vdev_initialize_range_add,
	vd);
	mutex_exit(&msp->ms_lock);

	error = vdev_initialize_ranges(vd, deadbeef);
	metaslab_enable(msp, B_TRUE, unload_when_done);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	range_tree_vacate(vd->vdev_initialize_tree, NULL, NULL);
	if (error != 0)
	break;
	}

	spa_config_exit(spa, SCL_CONFIG, FTAG);
	mutex_enter(&vd->vdev_initialize_io_lock);
	while (vd->vdev_initialize_inflight > 0) {
	cv_wait(&vd->vdev_initialize_io_cv,
	&vd->vdev_initialize_io_lock);
	}
	mutex_exit(&vd->vdev_initialize_io_lock);

	range_tree_destroy(vd->vdev_initialize_tree);
	vdev_initialize_block_free(deadbeef);
	vd->vdev_initialize_tree = NULL;

	mutex_enter(&vd->vdev_initialize_lock);
	if (!vd->vdev_initialize_exit_wanted && vdev_writeable(vd)) {
	vdev_initialize_change_state(vd, VDEV_INITIALIZE_COMPLETE);
	}
	ASSERT(vd->vdev_initialize_thread != NULL \|\|
	vd->vdev_initialize_inflight == 0);

	/*
	* Drop the vdev_initialize_lock while we sync out the
	* txg since it's possible that a device might be trying to
	* come online and must check to see if it needs to restart an
	* initialization. That thread will be holding the spa_config_lock
	* which would prevent the txg_wait_synced from completing.
	*/
	mutex_exit(&vd->vdev_initialize_lock);
	txg_wait_synced(spa_get_dsl(spa), 0);
	mutex_enter(&vd->vdev_initialize_lock);

	vd->vdev_initialize_thread = NULL;
	cv_broadcast(&vd->vdev_initialize_cv);
	mutex_exit(&vd->vdev_initialize_lock);

	thread_exit();
	}

	/*
	* Initiates a device. Caller must hold vdev_initialize_lock.
	* Device must be a leaf and not already be initializing.
	*/
	void
	vdev_initialize(vdev_t *vd)
	{
	ASSERT(MUTEX_HELD(&vd->vdev_initialize_lock));
	ASSERT(vd->vdev_ops->vdev_op_leaf);
	ASSERT(vdev_is_concrete(vd));
	ASSERT3P(vd->vdev_initialize_thread, ==, NULL);
	ASSERT(!vd->vdev_detached);
	ASSERT(!vd->vdev_initialize_exit_wanted);
	ASSERT(!vd->vdev_top->vdev_removing);

	vdev_initialize_change_state(vd, VDEV_INITIALIZE_ACTIVE);
	vd->vdev_initialize_thread = thread_create(NULL, 0,
	vdev_initialize_thread, vd, 0, &p0, TS_RUN, maxclsyspri);
	}

	/*
	* Wait for the initialize thread to be terminated (cancelled or stopped).
	*/
	static void
	vdev_initialize_stop_wait_impl(vdev_t *vd)
	{
	ASSERT(MUTEX_HELD(&vd->vdev_initialize_lock));

	while (vd->vdev_initialize_thread != NULL)
	cv_wait(&vd->vdev_initialize_cv, &vd->vdev_initialize_lock);

	ASSERT3P(vd->vdev_initialize_thread, ==, NULL);
	vd->vdev_initialize_exit_wanted = B_FALSE;
	}

	/*
	* Wait for vdev initialize threads which were either to cleanly exit.
	*/
	void
	vdev_initialize_stop_wait(spa_t spa, list_t vd_list)
	{
	vdev_t *vd;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	while ((vd = list_remove_head(vd_list)) != NULL) {
	mutex_enter(&vd->vdev_initialize_lock);
	vdev_initialize_stop_wait_impl(vd);
	mutex_exit(&vd->vdev_initialize_lock);
	}
	}

	/*
	* Stop initializing a device, with the resultant initializing state being
	* tgt_state. For blocking behavior pass NULL for vd_list. Otherwise, when
	* a list_t is provided the stopping vdev is inserted in to the list. Callers
	* are then required to call vdev_initialize_stop_wait() to block for all the
	* initialization threads to exit. The caller must hold vdev_initialize_lock
	* and must not be writing to the spa config, as the initializing thread may
	* try to enter the config as a reader before exiting.
	*/
	void
	vdev_initialize_stop(vdev_t *vd, vdev_initializing_state_t tgt_state,
	list_t *vd_list)
	{
	ASSERT(!spa_config_held(vd->vdev_spa, SCL_CONFIG\|SCL_STATE, RW_WRITER));
	ASSERT(MUTEX_HELD(&vd->vdev_initialize_lock));
	ASSERT(vd->vdev_ops->vdev_op_leaf);
	ASSERT(vdev_is_concrete(vd));

	/*
	* Allow cancel requests to proceed even if the initialize thread
	* has stopped.
	*/
	if (vd->vdev_initialize_thread == NULL &&
	tgt_state != VDEV_INITIALIZE_CANCELED) {
	return;
	}

	vdev_initialize_change_state(vd, tgt_state);
	vd->vdev_initialize_exit_wanted = B_TRUE;

	if (vd_list == NULL) {
	vdev_initialize_stop_wait_impl(vd);
	} else {
	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	list_insert_tail(vd_list, vd);
	}
	}

	static void
	vdev_initialize_stop_all_impl(vdev_t *vd, vdev_initializing_state_t tgt_state,
	list_t *vd_list)
	{
	if (vd->vdev_ops->vdev_op_leaf && vdev_is_concrete(vd)) {
	mutex_enter(&vd->vdev_initialize_lock);
	vdev_initialize_stop(vd, tgt_state, vd_list);
	mutex_exit(&vd->vdev_initialize_lock);
	return;
	}

	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	vdev_initialize_stop_all_impl(vd->vdev_child[i], tgt_state,
	vd_list);
	}
	}

	/*
	* Convenience function to stop initializing of a vdev tree and set all
	* initialize thread pointers to NULL.
	*/
	void
	vdev_initialize_stop_all(vdev_t *vd, vdev_initializing_state_t tgt_state)
	{
	spa_t *spa = vd->vdev_spa;
	list_t vd_list;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	list_create(&vd_list, sizeof (vdev_t),
	offsetof(vdev_t, vdev_initialize_node));

	vdev_initialize_stop_all_impl(vd, tgt_state, &vd_list);
	vdev_initialize_stop_wait(spa, &vd_list);

	if (vd->vdev_spa->spa_sync_on) {
	/* Make sure that our state has been synced to disk */
	txg_wait_synced(spa_get_dsl(vd->vdev_spa), 0);
	}

	list_destroy(&vd_list);
	}

	void
	vdev_initialize_restart(vdev_t *vd)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	ASSERT(!spa_config_held(vd->vdev_spa, SCL_ALL, RW_WRITER));

	if (vd->vdev_leaf_zap != 0) {
	mutex_enter(&vd->vdev_initialize_lock);
	uint64_t initialize_state = VDEV_INITIALIZE_NONE;
	int err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_INITIALIZE_STATE,
	sizeof (initialize_state), 1, &initialize_state);
	ASSERT(err == 0 \|\| err == ENOENT);
	vd->vdev_initialize_state = initialize_state;

	uint64_t timestamp = 0;
	err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_INITIALIZE_ACTION_TIME,
	sizeof (timestamp), 1, &timestamp);
	ASSERT(err == 0 \|\| err == ENOENT);
	vd->vdev_initialize_action_time = timestamp;

	if (vd->vdev_initialize_state == VDEV_INITIALIZE_SUSPENDED \|\|
	vd->vdev_offline) {
	/* load progress for reporting, but don't resume */
	VERIFY0(vdev_initialize_load(vd));
	} else if (vd->vdev_initialize_state ==
	VDEV_INITIALIZE_ACTIVE && vdev_writeable(vd) &&
	!vd->vdev_top->vdev_removing &&
	vd->vdev_initialize_thread == NULL) {
	vdev_initialize(vd);
	}

	mutex_exit(&vd->vdev_initialize_lock);
	}

	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	vdev_initialize_restart(vd->vdev_child[i]);
	}
	}

	EXPORT_SYMBOL(vdev_initialize);
	EXPORT_SYMBOL(vdev_initialize_stop);
	EXPORT_SYMBOL(vdev_initialize_stop_all);
	EXPORT_SYMBOL(vdev_initialize_stop_wait);
	EXPORT_SYMBOL(vdev_initialize_restart);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs, zfs_, initialize_value, ULONG, ZMOD_RW,
	"Value written during zpool initialize");

	ZFS_MODULE_PARAM(zfs, zfs_, initialize_chunk_size, ULONG, ZMOD_RW,
	"Size in bytes of writes by zpool initialize");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/vdev_label.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev_label.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev_label.c (revision 365892)
	@@ -1,1901 +1,1967 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2012, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2017, Intel Corporation.
	*/

	/*
	* Virtual Device Labels
	* ---------------------
	*
	* The vdev label serves several distinct purposes:
	*
	* 1. Uniquely identify this device as part of a ZFS pool and confirm its
	* identity within the pool.
	*
	* 2. Verify that all the devices given in a configuration are present
	* within the pool.
	*
	* 3. Determine the uberblock for the pool.
	*
	* 4. In case of an import operation, determine the configuration of the
	* toplevel vdev of which it is a part.
	*
	* 5. If an import operation cannot find all the devices in the pool,
	* provide enough information to the administrator to determine which
	* devices are missing.
	*
	* It is important to note that while the kernel is responsible for writing the
	* label, it only consumes the information in the first three cases. The
	* latter information is only consumed in userland when determining the
	* configuration to import a pool.
	*
	*
	* Label Organization
	* ------------------
	*
	* Before describing the contents of the label, it's important to understand how
	* the labels are written and updated with respect to the uberblock.
	*
	* When the pool configuration is altered, either because it was newly created
	* or a device was added, we want to update all the labels such that we can deal
	* with fatal failure at any point. To this end, each disk has two labels which
	* are updated before and after the uberblock is synced. Assuming we have
	* labels and an uberblock with the following transaction groups:
	*
	* L1 UB L2
	* +------+ +------+ +------+
	* \| \| \| \| \| \|
	* \| t10 \| \| t10 \| \| t10 \|
	* \| \| \| \| \| \|
	* +------+ +------+ +------+
	*
	* In this stable state, the labels and the uberblock were all updated within
	* the same transaction group (10). Each label is mirrored and checksummed, so
	* that we can detect when we fail partway through writing the label.
	*
	* In order to identify which labels are valid, the labels are written in the
	* following manner:
	*
	* 1. For each vdev, update 'L1' to the new label
	* 2. Update the uberblock
	* 3. For each vdev, update 'L2' to the new label
	*
	* Given arbitrary failure, we can determine the correct label to use based on
	* the transaction group. If we fail after updating L1 but before updating the
	* UB, we will notice that L1's transaction group is greater than the uberblock,
	* so L2 must be valid. If we fail after writing the uberblock but before
	* writing L2, we will notice that L2's transaction group is less than L1, and
	* therefore L1 is valid.
	*
	* Another added complexity is that not every label is updated when the config
	* is synced. If we add a single device, we do not want to have to re-write
	* every label for every device in the pool. This means that both L1 and L2 may
	* be older than the pool uberblock, because the necessary information is stored
	* on another vdev.
	*
	*
	* On-disk Format
	* --------------
	*
	* The vdev label consists of two distinct parts, and is wrapped within the
	* vdev_label_t structure. The label includes 8k of padding to permit legacy
	* VTOC disk labels, but is otherwise ignored.
	*
	* The first half of the label is a packed nvlist which contains pool wide
	* properties, per-vdev properties, and configuration information. It is
	* described in more detail below.
	*
	* The latter half of the label consists of a redundant array of uberblocks.
	* These uberblocks are updated whenever a transaction group is committed,
	* or when the configuration is updated. When a pool is loaded, we scan each
	* vdev for the 'best' uberblock.
	*
	*
	* Configuration Information
	* -------------------------
	*
	* The nvlist describing the pool and vdev contains the following elements:
	*
	* version ZFS on-disk version
	* name Pool name
	* state Pool state
	* txg Transaction group in which this label was written
	* pool_guid Unique identifier for this pool
	* vdev_tree An nvlist describing vdev tree.
	* features_for_read
	* An nvlist of the features necessary for reading the MOS.
	*
	* Each leaf device label also contains the following:
	*
	* top_guid Unique ID for top-level vdev in which this is contained
	* guid Unique ID for the leaf vdev
	*
	* The 'vs' configuration follows the format described in 'spa_config.c'.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/dmu.h>
	#include <sys/zap.h>
	#include <sys/vdev.h>
	#include <sys/vdev_impl.h>
	#include <sys/uberblock_impl.h>
	#include <sys/metaslab.h>
	#include <sys/metaslab_impl.h>
	#include <sys/zio.h>
	#include <sys/dsl_scan.h>
	#include <sys/abd.h>
	#include <sys/fs/zfs.h>
	+#include <sys/byteorder.h>
	+#include <sys/zfs_bootenv.h>

	/*
	* Basic routines to read and write from a vdev label.
	* Used throughout the rest of this file.
	*/
	uint64_t
	vdev_label_offset(uint64_t psize, int l, uint64_t offset)
	{
	ASSERT(offset < sizeof (vdev_label_t));
	ASSERT(P2PHASE_TYPED(psize, sizeof (vdev_label_t), uint64_t) == 0);

	return (offset + l * sizeof (vdev_label_t) + (l < VDEV_LABELS / 2 ?
	0 : psize - VDEV_LABELS * sizeof (vdev_label_t)));
	}

	/*
	* Returns back the vdev label associated with the passed in offset.
	*/
	int
	vdev_label_number(uint64_t psize, uint64_t offset)
	{
	int l;

	if (offset >= psize - VDEV_LABEL_END_SIZE) {
	offset -= psize - VDEV_LABEL_END_SIZE;
	offset += (VDEV_LABELS / 2) * sizeof (vdev_label_t);
	}
	l = offset / sizeof (vdev_label_t);
	return (l < VDEV_LABELS ? l : -1);
	}

	static void
	vdev_label_read(zio_t zio, vdev_t vd, int l, abd_t *buf, uint64_t offset,
	uint64_t size, zio_done_func_t done, void private, int flags)
	{
	ASSERT(
	spa_config_held(zio->io_spa, SCL_STATE, RW_READER) == SCL_STATE \|\|
	spa_config_held(zio->io_spa, SCL_STATE, RW_WRITER) == SCL_STATE);
	ASSERT(flags & ZIO_FLAG_CONFIG_WRITER);

	zio_nowait(zio_read_phys(zio, vd,
	vdev_label_offset(vd->vdev_psize, l, offset),
	size, buf, ZIO_CHECKSUM_LABEL, done, private,
	ZIO_PRIORITY_SYNC_READ, flags, B_TRUE));
	}

	void
	vdev_label_write(zio_t zio, vdev_t vd, int l, abd_t *buf, uint64_t offset,
	uint64_t size, zio_done_func_t done, void private, int flags)
	{
	ASSERT(
	spa_config_held(zio->io_spa, SCL_STATE, RW_READER) == SCL_STATE \|\|
	spa_config_held(zio->io_spa, SCL_STATE, RW_WRITER) == SCL_STATE);
	ASSERT(flags & ZIO_FLAG_CONFIG_WRITER);

	zio_nowait(zio_write_phys(zio, vd,
	vdev_label_offset(vd->vdev_psize, l, offset),
	size, buf, ZIO_CHECKSUM_LABEL, done, private,
	ZIO_PRIORITY_SYNC_WRITE, flags, B_TRUE));
	}

	/*
	* Generate the nvlist representing this vdev's stats
	*/
	void
	vdev_config_generate_stats(vdev_t vd, nvlist_t nv)
	{
	nvlist_t *nvx;
	vdev_stat_t *vs;
	vdev_stat_ex_t *vsx;

	vs = kmem_alloc(sizeof (*vs), KM_SLEEP);
	vsx = kmem_alloc(sizeof (*vsx), KM_SLEEP);

	vdev_get_stats_ex(vd, vs, vsx);
	fnvlist_add_uint64_array(nv, ZPOOL_CONFIG_VDEV_STATS,
	(uint64_t )vs, sizeof (vs) / sizeof (uint64_t));

	/*
	* Add extended stats into a special extended stats nvlist. This keeps
	* all the extended stats nicely grouped together. The extended stats
	* nvlist is then added to the main nvlist.
	*/
	nvx = fnvlist_alloc();

	/* ZIOs in flight to disk */
	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SYNC_R_ACTIVE_QUEUE,
	vsx->vsx_active_queue[ZIO_PRIORITY_SYNC_READ]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SYNC_W_ACTIVE_QUEUE,
	vsx->vsx_active_queue[ZIO_PRIORITY_SYNC_WRITE]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_ASYNC_R_ACTIVE_QUEUE,
	vsx->vsx_active_queue[ZIO_PRIORITY_ASYNC_READ]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_ASYNC_W_ACTIVE_QUEUE,
	vsx->vsx_active_queue[ZIO_PRIORITY_ASYNC_WRITE]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SCRUB_ACTIVE_QUEUE,
	vsx->vsx_active_queue[ZIO_PRIORITY_SCRUB]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_TRIM_ACTIVE_QUEUE,
	vsx->vsx_active_queue[ZIO_PRIORITY_TRIM]);

	/* ZIOs pending */
	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SYNC_R_PEND_QUEUE,
	vsx->vsx_pend_queue[ZIO_PRIORITY_SYNC_READ]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SYNC_W_PEND_QUEUE,
	vsx->vsx_pend_queue[ZIO_PRIORITY_SYNC_WRITE]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_ASYNC_R_PEND_QUEUE,
	vsx->vsx_pend_queue[ZIO_PRIORITY_ASYNC_READ]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_ASYNC_W_PEND_QUEUE,
	vsx->vsx_pend_queue[ZIO_PRIORITY_ASYNC_WRITE]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SCRUB_PEND_QUEUE,
	vsx->vsx_pend_queue[ZIO_PRIORITY_SCRUB]);

	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_TRIM_PEND_QUEUE,
	vsx->vsx_pend_queue[ZIO_PRIORITY_TRIM]);

	/* Histograms */
	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_TOT_R_LAT_HISTO,
	vsx->vsx_total_histo[ZIO_TYPE_READ],
	ARRAY_SIZE(vsx->vsx_total_histo[ZIO_TYPE_READ]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_TOT_W_LAT_HISTO,
	vsx->vsx_total_histo[ZIO_TYPE_WRITE],
	ARRAY_SIZE(vsx->vsx_total_histo[ZIO_TYPE_WRITE]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_DISK_R_LAT_HISTO,
	vsx->vsx_disk_histo[ZIO_TYPE_READ],
	ARRAY_SIZE(vsx->vsx_disk_histo[ZIO_TYPE_READ]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_DISK_W_LAT_HISTO,
	vsx->vsx_disk_histo[ZIO_TYPE_WRITE],
	ARRAY_SIZE(vsx->vsx_disk_histo[ZIO_TYPE_WRITE]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_R_LAT_HISTO,
	vsx->vsx_queue_histo[ZIO_PRIORITY_SYNC_READ],
	ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_SYNC_READ]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_W_LAT_HISTO,
	vsx->vsx_queue_histo[ZIO_PRIORITY_SYNC_WRITE],
	ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_SYNC_WRITE]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_R_LAT_HISTO,
	vsx->vsx_queue_histo[ZIO_PRIORITY_ASYNC_READ],
	ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_ASYNC_READ]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_W_LAT_HISTO,
	vsx->vsx_queue_histo[ZIO_PRIORITY_ASYNC_WRITE],
	ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_ASYNC_WRITE]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SCRUB_LAT_HISTO,
	vsx->vsx_queue_histo[ZIO_PRIORITY_SCRUB],
	ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_SCRUB]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_TRIM_LAT_HISTO,
	vsx->vsx_queue_histo[ZIO_PRIORITY_TRIM],
	ARRAY_SIZE(vsx->vsx_queue_histo[ZIO_PRIORITY_TRIM]));

	/* Request sizes */
	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_IND_R_HISTO,
	vsx->vsx_ind_histo[ZIO_PRIORITY_SYNC_READ],
	ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_SYNC_READ]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_IND_W_HISTO,
	vsx->vsx_ind_histo[ZIO_PRIORITY_SYNC_WRITE],
	ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_SYNC_WRITE]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_IND_R_HISTO,
	vsx->vsx_ind_histo[ZIO_PRIORITY_ASYNC_READ],
	ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_ASYNC_READ]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_IND_W_HISTO,
	vsx->vsx_ind_histo[ZIO_PRIORITY_ASYNC_WRITE],
	ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_ASYNC_WRITE]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_IND_SCRUB_HISTO,
	vsx->vsx_ind_histo[ZIO_PRIORITY_SCRUB],
	ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_SCRUB]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_IND_TRIM_HISTO,
	vsx->vsx_ind_histo[ZIO_PRIORITY_TRIM],
	ARRAY_SIZE(vsx->vsx_ind_histo[ZIO_PRIORITY_TRIM]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_AGG_R_HISTO,
	vsx->vsx_agg_histo[ZIO_PRIORITY_SYNC_READ],
	ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_SYNC_READ]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_SYNC_AGG_W_HISTO,
	vsx->vsx_agg_histo[ZIO_PRIORITY_SYNC_WRITE],
	ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_SYNC_WRITE]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_AGG_R_HISTO,
	vsx->vsx_agg_histo[ZIO_PRIORITY_ASYNC_READ],
	ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_ASYNC_READ]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_ASYNC_AGG_W_HISTO,
	vsx->vsx_agg_histo[ZIO_PRIORITY_ASYNC_WRITE],
	ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_ASYNC_WRITE]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_AGG_SCRUB_HISTO,
	vsx->vsx_agg_histo[ZIO_PRIORITY_SCRUB],
	ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_SCRUB]));

	fnvlist_add_uint64_array(nvx, ZPOOL_CONFIG_VDEV_AGG_TRIM_HISTO,
	vsx->vsx_agg_histo[ZIO_PRIORITY_TRIM],
	ARRAY_SIZE(vsx->vsx_agg_histo[ZIO_PRIORITY_TRIM]));

	/* IO delays */
	fnvlist_add_uint64(nvx, ZPOOL_CONFIG_VDEV_SLOW_IOS, vs->vs_slow_ios);

	/* Add extended stats nvlist to main nvlist */
	fnvlist_add_nvlist(nv, ZPOOL_CONFIG_VDEV_STATS_EX, nvx);

	fnvlist_free(nvx);
	kmem_free(vs, sizeof (*vs));
	kmem_free(vsx, sizeof (*vsx));
	}

	static void
	root_vdev_actions_getprogress(vdev_t vd, nvlist_t nvl)
	{
	spa_t *spa = vd->vdev_spa;

	if (vd != spa->spa_root_vdev)
	return;

	/* provide either current or previous scan information */
	pool_scan_stat_t ps;
	if (spa_scan_get_stats(spa, &ps) == 0) {
	fnvlist_add_uint64_array(nvl,
	ZPOOL_CONFIG_SCAN_STATS, (uint64_t *)&ps,
	sizeof (pool_scan_stat_t) / sizeof (uint64_t));
	}

	pool_removal_stat_t prs;
	if (spa_removal_get_stats(spa, &prs) == 0) {
	fnvlist_add_uint64_array(nvl,
	ZPOOL_CONFIG_REMOVAL_STATS, (uint64_t *)&prs,
	sizeof (prs) / sizeof (uint64_t));
	}

	pool_checkpoint_stat_t pcs;
	if (spa_checkpoint_get_stats(spa, &pcs) == 0) {
	fnvlist_add_uint64_array(nvl,
	ZPOOL_CONFIG_CHECKPOINT_STATS, (uint64_t *)&pcs,
	sizeof (pcs) / sizeof (uint64_t));
	}
	}

	static void
	top_vdev_actions_getprogress(vdev_t vd, nvlist_t nvl)
	{
	if (vd == vd->vdev_top) {
	vdev_rebuild_stat_t vrs;
	if (vdev_rebuild_get_stats(vd, &vrs) == 0) {
	fnvlist_add_uint64_array(nvl,
	ZPOOL_CONFIG_REBUILD_STATS, (uint64_t *)&vrs,
	sizeof (vrs) / sizeof (uint64_t));
	}
	}
	}

	/*
	* Generate the nvlist representing this vdev's config.
	*/
	nvlist_t *
	vdev_config_generate(spa_t spa, vdev_t vd, boolean_t getstats,
	vdev_config_flag_t flags)
	{
	nvlist_t *nv = NULL;
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;

	nv = fnvlist_alloc();

	fnvlist_add_string(nv, ZPOOL_CONFIG_TYPE, vd->vdev_ops->vdev_op_type);
	if (!(flags & (VDEV_CONFIG_SPARE \| VDEV_CONFIG_L2CACHE)))
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_ID, vd->vdev_id);
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_GUID, vd->vdev_guid);

	if (vd->vdev_path != NULL)
	fnvlist_add_string(nv, ZPOOL_CONFIG_PATH, vd->vdev_path);

	if (vd->vdev_devid != NULL)
	fnvlist_add_string(nv, ZPOOL_CONFIG_DEVID, vd->vdev_devid);

	if (vd->vdev_physpath != NULL)
	fnvlist_add_string(nv, ZPOOL_CONFIG_PHYS_PATH,
	vd->vdev_physpath);

	if (vd->vdev_enc_sysfs_path != NULL)
	fnvlist_add_string(nv, ZPOOL_CONFIG_VDEV_ENC_SYSFS_PATH,
	vd->vdev_enc_sysfs_path);

	if (vd->vdev_fru != NULL)
	fnvlist_add_string(nv, ZPOOL_CONFIG_FRU, vd->vdev_fru);

	if (vd->vdev_nparity != 0) {
	ASSERT(strcmp(vd->vdev_ops->vdev_op_type,
	VDEV_TYPE_RAIDZ) == 0);

	/*
	* Make sure someone hasn't managed to sneak a fancy new vdev
	* into a crufty old storage pool.
	*/
	ASSERT(vd->vdev_nparity == 1 \|\|
	(vd->vdev_nparity <= 2 &&
	spa_version(spa) >= SPA_VERSION_RAIDZ2) \|\|
	(vd->vdev_nparity <= 3 &&
	spa_version(spa) >= SPA_VERSION_RAIDZ3));

	/*
	* Note that we'll add the nparity tag even on storage pools
	* that only support a single parity device -- older software
	* will just ignore it.
	*/
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_NPARITY, vd->vdev_nparity);
	}

	if (vd->vdev_wholedisk != -1ULL)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_WHOLE_DISK,
	vd->vdev_wholedisk);

	if (vd->vdev_not_present && !(flags & VDEV_CONFIG_MISSING))
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_NOT_PRESENT, 1);

	if (vd->vdev_isspare)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_IS_SPARE, 1);

	if (!(flags & (VDEV_CONFIG_SPARE \| VDEV_CONFIG_L2CACHE)) &&
	vd == vd->vdev_top) {
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_METASLAB_ARRAY,
	vd->vdev_ms_array);
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_METASLAB_SHIFT,
	vd->vdev_ms_shift);
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_ASHIFT, vd->vdev_ashift);
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_ASIZE,
	vd->vdev_asize);
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_IS_LOG, vd->vdev_islog);
	if (vd->vdev_removing) {
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_REMOVING,
	vd->vdev_removing);
	}

	/* zpool command expects alloc class data */
	if (getstats && vd->vdev_alloc_bias != VDEV_BIAS_NONE) {
	const char *bias = NULL;

	switch (vd->vdev_alloc_bias) {
	case VDEV_BIAS_LOG:
	bias = VDEV_ALLOC_BIAS_LOG;
	break;
	case VDEV_BIAS_SPECIAL:
	bias = VDEV_ALLOC_BIAS_SPECIAL;
	break;
	case VDEV_BIAS_DEDUP:
	bias = VDEV_ALLOC_BIAS_DEDUP;
	break;
	default:
	ASSERT3U(vd->vdev_alloc_bias, ==,
	VDEV_BIAS_NONE);
	}
	fnvlist_add_string(nv, ZPOOL_CONFIG_ALLOCATION_BIAS,
	bias);
	}
	}

	if (vd->vdev_dtl_sm != NULL) {
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_DTL,
	space_map_object(vd->vdev_dtl_sm));
	}

	if (vic->vic_mapping_object != 0) {
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_INDIRECT_OBJECT,
	vic->vic_mapping_object);
	}

	if (vic->vic_births_object != 0) {
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_INDIRECT_BIRTHS,
	vic->vic_births_object);
	}

	if (vic->vic_prev_indirect_vdev != UINT64_MAX) {
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_PREV_INDIRECT_VDEV,
	vic->vic_prev_indirect_vdev);
	}

	if (vd->vdev_crtxg)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_CREATE_TXG, vd->vdev_crtxg);

	if (vd->vdev_expansion_time)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_EXPANSION_TIME,
	vd->vdev_expansion_time);

	if (flags & VDEV_CONFIG_MOS) {
	if (vd->vdev_leaf_zap != 0) {
	ASSERT(vd->vdev_ops->vdev_op_leaf);
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_VDEV_LEAF_ZAP,
	vd->vdev_leaf_zap);
	}

	if (vd->vdev_top_zap != 0) {
	ASSERT(vd == vd->vdev_top);
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_VDEV_TOP_ZAP,
	vd->vdev_top_zap);
	}

	if (vd->vdev_resilver_deferred) {
	ASSERT(vd->vdev_ops->vdev_op_leaf);
	ASSERT(spa->spa_resilver_deferred);
	fnvlist_add_boolean(nv, ZPOOL_CONFIG_RESILVER_DEFER);
	}
	}

	if (getstats) {
	vdev_config_generate_stats(vd, nv);

	root_vdev_actions_getprogress(vd, nv);
	top_vdev_actions_getprogress(vd, nv);

	/*
	* Note: this can be called from open context
	* (spa_get_stats()), so we need the rwlock to prevent
	* the mapping from being changed by condensing.
	*/
	rw_enter(&vd->vdev_indirect_rwlock, RW_READER);
	if (vd->vdev_indirect_mapping != NULL) {
	ASSERT(vd->vdev_indirect_births != NULL);
	vdev_indirect_mapping_t *vim =
	vd->vdev_indirect_mapping;
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_INDIRECT_SIZE,
	vdev_indirect_mapping_size(vim));
	}
	rw_exit(&vd->vdev_indirect_rwlock);
	if (vd->vdev_mg != NULL &&
	vd->vdev_mg->mg_fragmentation != ZFS_FRAG_INVALID) {
	/*
	* Compute approximately how much memory would be used
	* for the indirect mapping if this device were to
	* be removed.
	*
	* Note: If the frag metric is invalid, then not
	* enough metaslabs have been converted to have
	* histograms.
	*/
	uint64_t seg_count = 0;
	uint64_t to_alloc = vd->vdev_stat.vs_alloc;

	/*
	* There are the same number of allocated segments
	* as free segments, so we will have at least one
	* entry per free segment. However, small free
	* segments (smaller than vdev_removal_max_span)
	* will be combined with adjacent allocated segments
	* as a single mapping.
	*/
	for (int i = 0; i < RANGE_TREE_HISTOGRAM_SIZE; i++) {
	if (1ULL << (i + 1) < vdev_removal_max_span) {
	to_alloc +=
	vd->vdev_mg->mg_histogram[i] <<
	(i + 1);
	} else {
	seg_count +=
	vd->vdev_mg->mg_histogram[i];
	}
	}

	/*
	* The maximum length of a mapping is
	* zfs_remove_max_segment, so we need at least one entry
	* per zfs_remove_max_segment of allocated data.
	*/
	seg_count += to_alloc / spa_remove_max_segment(spa);

	fnvlist_add_uint64(nv, ZPOOL_CONFIG_INDIRECT_SIZE,
	seg_count *
	sizeof (vdev_indirect_mapping_entry_phys_t));
	}
	}

	if (!vd->vdev_ops->vdev_op_leaf) {
	nvlist_t **child;
	int c, idx;

	ASSERT(!vd->vdev_ishole);

	child = kmem_alloc(vd->vdev_children * sizeof (nvlist_t *),
	KM_SLEEP);

	for (c = 0, idx = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];

	/*
	* If we're generating an nvlist of removing
	* vdevs then skip over any device which is
	* not being removed.
	*/
	if ((flags & VDEV_CONFIG_REMOVING) &&
	!cvd->vdev_removing)
	continue;

	child[idx++] = vdev_config_generate(spa, cvd,
	getstats, flags);
	}

	if (idx) {
	fnvlist_add_nvlist_array(nv, ZPOOL_CONFIG_CHILDREN,
	child, idx);
	}

	for (c = 0; c < idx; c++)
	nvlist_free(child[c]);

	kmem_free(child, vd->vdev_children * sizeof (nvlist_t *));

	} else {
	const char *aux = NULL;

	if (vd->vdev_offline && !vd->vdev_tmpoffline)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_OFFLINE, B_TRUE);
	if (vd->vdev_resilver_txg != 0)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_RESILVER_TXG,
	vd->vdev_resilver_txg);
	if (vd->vdev_rebuild_txg != 0)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_REBUILD_TXG,
	vd->vdev_rebuild_txg);
	if (vd->vdev_faulted)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_FAULTED, B_TRUE);
	if (vd->vdev_degraded)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_DEGRADED, B_TRUE);
	if (vd->vdev_removed)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_REMOVED, B_TRUE);
	if (vd->vdev_unspare)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_UNSPARE, B_TRUE);
	if (vd->vdev_ishole)
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_IS_HOLE, B_TRUE);

	/* Set the reason why we're FAULTED/DEGRADED. */
	switch (vd->vdev_stat.vs_aux) {
	case VDEV_AUX_ERR_EXCEEDED:
	aux = "err_exceeded";
	break;

	case VDEV_AUX_EXTERNAL:
	aux = "external";
	break;
	}

	if (aux != NULL && !vd->vdev_tmpoffline) {
	fnvlist_add_string(nv, ZPOOL_CONFIG_AUX_STATE, aux);
	} else {
	/*
	* We're healthy - clear any previous AUX_STATE values.
	*/
	if (nvlist_exists(nv, ZPOOL_CONFIG_AUX_STATE))
	nvlist_remove_all(nv, ZPOOL_CONFIG_AUX_STATE);
	}

	if (vd->vdev_splitting && vd->vdev_orig_guid != 0LL) {
	fnvlist_add_uint64(nv, ZPOOL_CONFIG_ORIG_GUID,
	vd->vdev_orig_guid);
	}
	}

	return (nv);
	}

	/*
	* Generate a view of the top-level vdevs. If we currently have holes
	* in the namespace, then generate an array which contains a list of holey
	* vdevs. Additionally, add the number of top-level children that currently
	* exist.
	*/
	void
	vdev_top_config_generate(spa_t spa, nvlist_t config)
	{
	vdev_t *rvd = spa->spa_root_vdev;
	uint64_t *array;
	uint_t c, idx;

	array = kmem_alloc(rvd->vdev_children * sizeof (uint64_t), KM_SLEEP);

	for (c = 0, idx = 0; c < rvd->vdev_children; c++) {
	vdev_t *tvd = rvd->vdev_child[c];

	if (tvd->vdev_ishole) {
	array[idx++] = c;
	}
	}

	if (idx) {
	VERIFY(nvlist_add_uint64_array(config, ZPOOL_CONFIG_HOLE_ARRAY,
	array, idx) == 0);
	}

	VERIFY(nvlist_add_uint64(config, ZPOOL_CONFIG_VDEV_CHILDREN,
	rvd->vdev_children) == 0);

	kmem_free(array, rvd->vdev_children * sizeof (uint64_t));
	}

	/*
	* Returns the configuration from the label of the given vdev. For vdevs
	* which don't have a txg value stored on their label (i.e. spares/cache)
	* or have not been completely initialized (txg = 0) just return
	* the configuration from the first valid label we find. Otherwise,
	* find the most up-to-date label that does not exceed the specified
	* 'txg' value.
	*/
	nvlist_t *
	vdev_label_read_config(vdev_t *vd, uint64_t txg)
	{
	spa_t *spa = vd->vdev_spa;
	nvlist_t *config = NULL;
	vdev_phys_t *vp;
	abd_t *vp_abd;
	zio_t *zio;
	uint64_t best_txg = 0;
	uint64_t label_txg = 0;
	int error = 0;
	int flags = ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_SPECULATIVE;

	ASSERT(spa_config_held(spa, SCL_STATE_ALL, RW_WRITER) == SCL_STATE_ALL);

	if (!vdev_readable(vd))
	return (NULL);

	vp_abd = abd_alloc_linear(sizeof (vdev_phys_t), B_TRUE);
	vp = abd_to_buf(vp_abd);

	retry:
	for (int l = 0; l < VDEV_LABELS; l++) {
	nvlist_t *label = NULL;

	zio = zio_root(spa, NULL, NULL, flags);

	vdev_label_read(zio, vd, l, vp_abd,
	offsetof(vdev_label_t, vl_vdev_phys),
	sizeof (vdev_phys_t), NULL, NULL, flags);

	if (zio_wait(zio) == 0 &&
	nvlist_unpack(vp->vp_nvlist, sizeof (vp->vp_nvlist),
	&label, 0) == 0) {
	/*
	* Auxiliary vdevs won't have txg values in their
	* labels and newly added vdevs may not have been
	* completely initialized so just return the
	* configuration from the first valid label we
	* encounter.
	*/
	error = nvlist_lookup_uint64(label,
	ZPOOL_CONFIG_POOL_TXG, &label_txg);
	if ((error \|\| label_txg == 0) && !config) {
	config = label;
	break;
	} else if (label_txg <= txg && label_txg > best_txg) {
	best_txg = label_txg;
	nvlist_free(config);
	config = fnvlist_dup(label);
	}
	}

	if (label != NULL) {
	nvlist_free(label);
	label = NULL;
	}
	}

	if (config == NULL && !(flags & ZIO_FLAG_TRYHARD)) {
	flags \|= ZIO_FLAG_TRYHARD;
	goto retry;
	}

	/*
	* We found a valid label but it didn't pass txg restrictions.
	*/
	if (config == NULL && label_txg != 0) {
	vdev_dbgmsg(vd, "label discarded as txg is too large "
	"(%llu > %llu)", (u_longlong_t)label_txg,
	(u_longlong_t)txg);
	}

	abd_free(vp_abd);

	return (config);
	}

	/*
	* Determine if a device is in use. The 'spare_guid' parameter will be filled
	* in with the device guid if this spare is active elsewhere on the system.
	*/
	static boolean_t
	vdev_inuse(vdev_t *vd, uint64_t crtxg, vdev_labeltype_t reason,
	uint64_t spare_guid, uint64_t l2cache_guid)
	{
	spa_t *spa = vd->vdev_spa;
	uint64_t state, pool_guid, device_guid, txg, spare_pool;
	uint64_t vdtxg = 0;
	nvlist_t *label;

	if (spare_guid)
	*spare_guid = 0ULL;
	if (l2cache_guid)
	*l2cache_guid = 0ULL;

	/*
	* Read the label, if any, and perform some basic sanity checks.
	*/
	if ((label = vdev_label_read_config(vd, -1ULL)) == NULL)
	return (B_FALSE);

	(void) nvlist_lookup_uint64(label, ZPOOL_CONFIG_CREATE_TXG,
	&vdtxg);

	if (nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_STATE,
	&state) != 0 \|\|
	nvlist_lookup_uint64(label, ZPOOL_CONFIG_GUID,
	&device_guid) != 0) {
	nvlist_free(label);
	return (B_FALSE);
	}

	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
	(nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_GUID,
	&pool_guid) != 0 \|\|
	nvlist_lookup_uint64(label, ZPOOL_CONFIG_POOL_TXG,
	&txg) != 0)) {
	nvlist_free(label);
	return (B_FALSE);
	}

	nvlist_free(label);

	/*
	* Check to see if this device indeed belongs to the pool it claims to
	* be a part of. The only way this is allowed is if the device is a hot
	* spare (which we check for later on).
	*/
	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
	!spa_guid_exists(pool_guid, device_guid) &&
	!spa_spare_exists(device_guid, NULL, NULL) &&
	!spa_l2cache_exists(device_guid, NULL))
	return (B_FALSE);

	/*
	* If the transaction group is zero, then this an initialized (but
	* unused) label. This is only an error if the create transaction
	* on-disk is the same as the one we're using now, in which case the
	* user has attempted to add the same vdev multiple times in the same
	* transaction.
	*/
	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
	txg == 0 && vdtxg == crtxg)
	return (B_TRUE);

	/*
	* Check to see if this is a spare device. We do an explicit check for
	* spa_has_spare() here because it may be on our pending list of spares
	* to add. We also check if it is an l2cache device.
	*/
	if (spa_spare_exists(device_guid, &spare_pool, NULL) \|\|
	spa_has_spare(spa, device_guid)) {
	if (spare_guid)
	*spare_guid = device_guid;

	switch (reason) {
	case VDEV_LABEL_CREATE:
	case VDEV_LABEL_L2CACHE:
	return (B_TRUE);

	case VDEV_LABEL_REPLACE:
	return (!spa_has_spare(spa, device_guid) \|\|
	spare_pool != 0ULL);

	case VDEV_LABEL_SPARE:
	return (spa_has_spare(spa, device_guid));
	default:
	break;
	}
	}

	/*
	* Check to see if this is an l2cache device.
	*/
	if (spa_l2cache_exists(device_guid, NULL))
	return (B_TRUE);

	/*
	* We can't rely on a pool's state if it's been imported
	* read-only. Instead we look to see if the pools is marked
	* read-only in the namespace and set the state to active.
	*/
	if (state != POOL_STATE_SPARE && state != POOL_STATE_L2CACHE &&
	(spa = spa_by_guid(pool_guid, device_guid)) != NULL &&
	spa_mode(spa) == SPA_MODE_READ)
	state = POOL_STATE_ACTIVE;

	/*
	* If the device is marked ACTIVE, then this device is in use by another
	* pool on the system.
	*/
	return (state == POOL_STATE_ACTIVE);
	}

	/*
	* Initialize a vdev label. We check to make sure each leaf device is not in
	* use, and writable. We put down an initial label which we will later
	* overwrite with a complete label. Note that it's important to do this
	* sequentially, not in parallel, so that we catch cases of multiple use of the
	* same leaf vdev in the vdev we're creating -- e.g. mirroring a disk with
	* itself.
	*/
	int
	vdev_label_init(vdev_t *vd, uint64_t crtxg, vdev_labeltype_t reason)
	{
	spa_t *spa = vd->vdev_spa;
	nvlist_t *label;
	vdev_phys_t *vp;
	abd_t *vp_abd;
	abd_t *bootenv;
	uberblock_t *ub;
	abd_t *ub_abd;
	zio_t *zio;
	char *buf;
	size_t buflen;
	int error;
	uint64_t spare_guid = 0, l2cache_guid = 0;
	int flags = ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_CANFAIL;

	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	for (int c = 0; c < vd->vdev_children; c++)
	if ((error = vdev_label_init(vd->vdev_child[c],
	crtxg, reason)) != 0)
	return (error);

	/* Track the creation time for this vdev */
	vd->vdev_crtxg = crtxg;

	if (!vd->vdev_ops->vdev_op_leaf \|\| !spa_writeable(spa))
	return (0);

	/*
	* Dead vdevs cannot be initialized.
	*/
	if (vdev_is_dead(vd))
	return (SET_ERROR(EIO));

	/*
	* Determine if the vdev is in use.
	*/
	if (reason != VDEV_LABEL_REMOVE && reason != VDEV_LABEL_SPLIT &&
	vdev_inuse(vd, crtxg, reason, &spare_guid, &l2cache_guid))
	return (SET_ERROR(EBUSY));

	/*
	* If this is a request to add or replace a spare or l2cache device
	* that is in use elsewhere on the system, then we must update the
	* guid (which was initialized to a random value) to reflect the
	* actual GUID (which is shared between multiple pools).
	*/
	if (reason != VDEV_LABEL_REMOVE && reason != VDEV_LABEL_L2CACHE &&
	spare_guid != 0ULL) {
	uint64_t guid_delta = spare_guid - vd->vdev_guid;

	vd->vdev_guid += guid_delta;

	for (vdev_t *pvd = vd; pvd != NULL; pvd = pvd->vdev_parent)
	pvd->vdev_guid_sum += guid_delta;

	/*
	* If this is a replacement, then we want to fallthrough to the
	* rest of the code. If we're adding a spare, then it's already
	* labeled appropriately and we can just return.
	*/
	if (reason == VDEV_LABEL_SPARE)
	return (0);
	ASSERT(reason == VDEV_LABEL_REPLACE \|\|
	reason == VDEV_LABEL_SPLIT);
	}

	if (reason != VDEV_LABEL_REMOVE && reason != VDEV_LABEL_SPARE &&
	l2cache_guid != 0ULL) {
	uint64_t guid_delta = l2cache_guid - vd->vdev_guid;

	vd->vdev_guid += guid_delta;

	for (vdev_t *pvd = vd; pvd != NULL; pvd = pvd->vdev_parent)
	pvd->vdev_guid_sum += guid_delta;

	/*
	* If this is a replacement, then we want to fallthrough to the
	* rest of the code. If we're adding an l2cache, then it's
	* already labeled appropriately and we can just return.
	*/
	if (reason == VDEV_LABEL_L2CACHE)
	return (0);
	ASSERT(reason == VDEV_LABEL_REPLACE);
	}

	/*
	* Initialize its label.
	*/
	vp_abd = abd_alloc_linear(sizeof (vdev_phys_t), B_TRUE);
	abd_zero(vp_abd, sizeof (vdev_phys_t));
	vp = abd_to_buf(vp_abd);

	/*
	* Generate a label describing the pool and our top-level vdev.
	* We mark it as being from txg 0 to indicate that it's not
	* really part of an active pool just yet. The labels will
	* be written again with a meaningful txg by spa_sync().
	*/
	if (reason == VDEV_LABEL_SPARE \|\|
	(reason == VDEV_LABEL_REMOVE && vd->vdev_isspare)) {
	/*
	* For inactive hot spares, we generate a special label that
	* identifies as a mutually shared hot spare. We write the
	* label if we are adding a hot spare, or if we are removing an
	* active hot spare (in which case we want to revert the
	* labels).
	*/
	VERIFY(nvlist_alloc(&label, NV_UNIQUE_NAME, KM_SLEEP) == 0);

	VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_VERSION,
	spa_version(spa)) == 0);
	VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_POOL_STATE,
	POOL_STATE_SPARE) == 0);
	VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_GUID,
	vd->vdev_guid) == 0);
	} else if (reason == VDEV_LABEL_L2CACHE \|\|
	(reason == VDEV_LABEL_REMOVE && vd->vdev_isl2cache)) {
	/*
	* For level 2 ARC devices, add a special label.
	*/
	VERIFY(nvlist_alloc(&label, NV_UNIQUE_NAME, KM_SLEEP) == 0);

	VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_VERSION,
	spa_version(spa)) == 0);
	VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_POOL_STATE,
	POOL_STATE_L2CACHE) == 0);
	VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_GUID,
	vd->vdev_guid) == 0);
	} else {
	uint64_t txg = 0ULL;

	if (reason == VDEV_LABEL_SPLIT)
	txg = spa->spa_uberblock.ub_txg;
	label = spa_config_generate(spa, vd, txg, B_FALSE);

	/*
	* Add our creation time. This allows us to detect multiple
	* vdev uses as described above, and automatically expires if we
	* fail.
	*/
	VERIFY(nvlist_add_uint64(label, ZPOOL_CONFIG_CREATE_TXG,
	crtxg) == 0);
	}

	buf = vp->vp_nvlist;
	buflen = sizeof (vp->vp_nvlist);

	error = nvlist_pack(label, &buf, &buflen, NV_ENCODE_XDR, KM_SLEEP);
	if (error != 0) {
	nvlist_free(label);
	abd_free(vp_abd);
	/* EFAULT means nvlist_pack ran out of room */
	return (SET_ERROR(error == EFAULT ? ENAMETOOLONG : EINVAL));
	}

	/*
	* Initialize uberblock template.
	*/
	ub_abd = abd_alloc_linear(VDEV_UBERBLOCK_RING, B_TRUE);
	abd_zero(ub_abd, VDEV_UBERBLOCK_RING);
	abd_copy_from_buf(ub_abd, &spa->spa_uberblock, sizeof (uberblock_t));
	ub = abd_to_buf(ub_abd);
	ub->ub_txg = 0;

	/* Initialize the 2nd padding area. */
	bootenv = abd_alloc_for_io(VDEV_PAD_SIZE, B_TRUE);
	abd_zero(bootenv, VDEV_PAD_SIZE);

	/*
	* Write everything in parallel.
	*/
	retry:
	zio = zio_root(spa, NULL, NULL, flags);

	for (int l = 0; l < VDEV_LABELS; l++) {

	vdev_label_write(zio, vd, l, vp_abd,
	offsetof(vdev_label_t, vl_vdev_phys),
	sizeof (vdev_phys_t), NULL, NULL, flags);

	/*
	* Skip the 1st padding area.
	* Zero out the 2nd padding area where it might have
	* left over data from previous filesystem format.
	*/
	vdev_label_write(zio, vd, l, bootenv,
	offsetof(vdev_label_t, vl_be),
	VDEV_PAD_SIZE, NULL, NULL, flags);

	vdev_label_write(zio, vd, l, ub_abd,
	offsetof(vdev_label_t, vl_uberblock),
	VDEV_UBERBLOCK_RING, NULL, NULL, flags);
	}

	error = zio_wait(zio);

	if (error != 0 && !(flags & ZIO_FLAG_TRYHARD)) {
	flags \|= ZIO_FLAG_TRYHARD;
	goto retry;
	}

	nvlist_free(label);
	abd_free(bootenv);
	abd_free(ub_abd);
	abd_free(vp_abd);

	/*
	* If this vdev hasn't been previously identified as a spare, then we
	* mark it as such only if a) we are labeling it as a spare, or b) it
	* exists as a spare elsewhere in the system. Do the same for
	* level 2 ARC devices.
	*/
	if (error == 0 && !vd->vdev_isspare &&
	(reason == VDEV_LABEL_SPARE \|\|
	spa_spare_exists(vd->vdev_guid, NULL, NULL)))
	spa_spare_add(vd);

	if (error == 0 && !vd->vdev_isl2cache &&
	(reason == VDEV_LABEL_L2CACHE \|\|
	spa_l2cache_exists(vd->vdev_guid, NULL)))
	spa_l2cache_add(vd);

	return (error);
	}

	/*
	* Done callback for vdev_label_read_bootenv_impl. If this is the first
	* callback to finish, store our abd in the callback pointer. Otherwise, we
	* just free our abd and return.
	*/
	static void
	vdev_label_read_bootenv_done(zio_t *zio)
	{
	zio_t *rio = zio->io_private;
	abd_t **cbp = rio->io_private;

	ASSERT3U(zio->io_size, ==, VDEV_PAD_SIZE);

	if (zio->io_error == 0) {
	mutex_enter(&rio->io_lock);
	if (*cbp == NULL) {
	/* Will free this buffer in vdev_label_read_bootenv. */
	*cbp = zio->io_abd;
	} else {
	abd_free(zio->io_abd);
	}
	mutex_exit(&rio->io_lock);
	} else {
	abd_free(zio->io_abd);
	}
	}

	static void
	vdev_label_read_bootenv_impl(zio_t zio, vdev_t vd, int flags)
	{
	for (int c = 0; c < vd->vdev_children; c++)
	vdev_label_read_bootenv_impl(zio, vd->vdev_child[c], flags);

	/*
	* We just use the first label that has a correct checksum; the
	* bootloader should have rewritten them all to be the same on boot,
	* and any changes we made since boot have been the same across all
	* labels.
	- *
	- * While grub supports writing to all four labels, other bootloaders
	- * don't, so we only use the first two labels to store boot
	- * information.
	*/
	if (vd->vdev_ops->vdev_op_leaf && vdev_readable(vd)) {
	- for (int l = 0; l < VDEV_LABELS / 2; l++) {
	+ for (int l = 0; l < VDEV_LABELS; l++) {
	vdev_label_read(zio, vd, l,
	abd_alloc_linear(VDEV_PAD_SIZE, B_FALSE),
	offsetof(vdev_label_t, vl_be), VDEV_PAD_SIZE,
	vdev_label_read_bootenv_done, zio, flags);
	}
	}
	}

	int
	-vdev_label_read_bootenv(vdev_t rvd, nvlist_t command)
	+vdev_label_read_bootenv(vdev_t rvd, nvlist_t bootenv)
	{
	+ nvlist_t *config;
	spa_t *spa = rvd->vdev_spa;
	abd_t *abd = NULL;
	int flags = ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_SPECULATIVE \| ZIO_FLAG_TRYHARD;

	- ASSERT(command);
	+ ASSERT(bootenv);
	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	zio_t *zio = zio_root(spa, NULL, &abd, flags);
	vdev_label_read_bootenv_impl(zio, rvd, flags);
	int err = zio_wait(zio);

	if (abd != NULL) {
	+ char *buf;
	vdev_boot_envblock_t *vbe = abd_to_buf(abd);
	- if (vbe->vbe_version != VB_RAW) {
	- abd_free(abd);
	- return (SET_ERROR(ENOTSUP));
	+
	+ vbe->vbe_version = ntohll(vbe->vbe_version);
	+ switch (vbe->vbe_version) {
	+ case VB_RAW:
	+ /*
	+ * if we have textual data in vbe_bootenv, create nvlist
	+ * with key "envmap".
	+ */
	+ fnvlist_add_uint64(bootenv, BOOTENV_VERSION, VB_RAW);
	+ vbe->vbe_bootenv[sizeof (vbe->vbe_bootenv) - 1] = '\0';
	+ fnvlist_add_string(bootenv, GRUB_ENVMAP,
	+ vbe->vbe_bootenv);
	+ break;
	+
	+ case VB_NVLIST:
	+ err = nvlist_unpack(vbe->vbe_bootenv,
	+ sizeof (vbe->vbe_bootenv), &config, 0);
	+ if (err == 0) {
	+ fnvlist_merge(bootenv, config);
	+ nvlist_free(config);
	+ break;
	+ }
	+ /* FALLTHROUGH */
	+ default:
	+ /* Check for FreeBSD zfs bootonce command string */
	+ buf = abd_to_buf(abd);
	+ if (*buf == '\0') {
	+ fnvlist_add_uint64(bootenv, BOOTENV_VERSION,
	+ VB_NVLIST);
	+ break;
	+ }
	+ fnvlist_add_string(bootenv, FREEBSD_BOOTONCE, buf);
	}
	- vbe->vbe_bootenv[sizeof (vbe->vbe_bootenv) - 1] = '\0';
	- fnvlist_add_string(command, "envmap", vbe->vbe_bootenv);
	- /* abd was allocated in vdev_label_read_bootenv_impl() */
	+
	+ /*
	+ * abd was allocated in vdev_label_read_bootenv_impl()
	+ */
	abd_free(abd);
	- /* If we managed to read any successfully, return success. */
	+ /*
	+ * If we managed to read any successfully,
	+ * return success.
	+ */
	return (0);
	}
	return (err);
	}

	int
	-vdev_label_write_bootenv(vdev_t vd, char envmap)
	+vdev_label_write_bootenv(vdev_t vd, nvlist_t env)
	{
	zio_t *zio;
	spa_t *spa = vd->vdev_spa;
	vdev_boot_envblock_t *bootenv;
	int flags = ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_CANFAIL;
	- int error = ENXIO;
	+ int error;
	+ size_t nvsize;
	+ char *nvbuf;

	- if (strlen(envmap) >= sizeof (bootenv->vbe_bootenv)) {
	+ error = nvlist_size(env, &nvsize, NV_ENCODE_XDR);
	+ if (error != 0)
	+ return (SET_ERROR(error));
	+
	+ if (nvsize >= sizeof (bootenv->vbe_bootenv)) {
	return (SET_ERROR(E2BIG));
	}

	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	+ error = ENXIO;
	for (int c = 0; c < vd->vdev_children; c++) {
	- int child_err = vdev_label_write_bootenv(vd->vdev_child[c],
	- envmap);
	+ int child_err;
	+
	+ child_err = vdev_label_write_bootenv(vd->vdev_child[c], env);
	/*
	* As long as any of the disks managed to write all of their
	* labels successfully, return success.
	*/
	if (child_err == 0)
	error = child_err;
	}

	if (!vd->vdev_ops->vdev_op_leaf \|\| vdev_is_dead(vd) \|\|
	!vdev_writeable(vd)) {
	return (error);
	}
	ASSERT3U(sizeof (*bootenv), ==, VDEV_PAD_SIZE);
	abd_t *abd = abd_alloc_for_io(VDEV_PAD_SIZE, B_TRUE);
	abd_zero(abd, VDEV_PAD_SIZE);
	+
	bootenv = abd_borrow_buf_copy(abd, VDEV_PAD_SIZE);
	+ nvbuf = bootenv->vbe_bootenv;
	+ nvsize = sizeof (bootenv->vbe_bootenv);

	- char *buf = bootenv->vbe_bootenv;
	- (void) strlcpy(buf, envmap, sizeof (bootenv->vbe_bootenv));
	- bootenv->vbe_version = VB_RAW;
	- abd_return_buf_copy(abd, bootenv, VDEV_PAD_SIZE);
	+ bootenv->vbe_version = fnvlist_lookup_uint64(env, BOOTENV_VERSION);
	+ switch (bootenv->vbe_version) {
	+ case VB_RAW:
	+ if (nvlist_lookup_string(env, GRUB_ENVMAP, &nvbuf) == 0) {
	+ (void) strlcpy(bootenv->vbe_bootenv, nvbuf, nvsize);
	+ }
	+ error = 0;
	+ break;

	+ case VB_NVLIST:
	+ error = nvlist_pack(env, &nvbuf, &nvsize, NV_ENCODE_XDR,
	+ KM_SLEEP);
	+ break;
	+
	+ default:
	+ error = EINVAL;
	+ break;
	+ }
	+
	+ if (error == 0) {
	+ bootenv->vbe_version = htonll(bootenv->vbe_version);
	+ abd_return_buf_copy(abd, bootenv, VDEV_PAD_SIZE);
	+ } else {
	+ abd_free(abd);
	+ return (SET_ERROR(error));
	+ }
	+
	retry:
	zio = zio_root(spa, NULL, NULL, flags);
	- for (int l = 0; l < VDEV_LABELS / 2; l++) {
	+ for (int l = 0; l < VDEV_LABELS; l++) {
	vdev_label_write(zio, vd, l, abd,
	offsetof(vdev_label_t, vl_be),
	VDEV_PAD_SIZE, NULL, NULL, flags);
	}

	error = zio_wait(zio);
	if (error != 0 && !(flags & ZIO_FLAG_TRYHARD)) {
	flags \|= ZIO_FLAG_TRYHARD;
	goto retry;
	}

	abd_free(abd);
	return (error);
	}

	/*
	* ==========================================================================
	* uberblock load/sync
	* ==========================================================================
	*/

	/*
	* Consider the following situation: txg is safely synced to disk. We've
	* written the first uberblock for txg + 1, and then we lose power. When we
	* come back up, we fail to see the uberblock for txg + 1 because, say,
	* it was on a mirrored device and the replica to which we wrote txg + 1
	* is now offline. If we then make some changes and sync txg + 1, and then
	* the missing replica comes back, then for a few seconds we'll have two
	* conflicting uberblocks on disk with the same txg. The solution is simple:
	* among uberblocks with equal txg, choose the one with the latest timestamp.
	*/
	static int
	vdev_uberblock_compare(const uberblock_t ub1, const uberblock_t ub2)
	{
	int cmp = TREE_CMP(ub1->ub_txg, ub2->ub_txg);

	if (likely(cmp))
	return (cmp);

	cmp = TREE_CMP(ub1->ub_timestamp, ub2->ub_timestamp);
	if (likely(cmp))
	return (cmp);

	/*
	* If MMP_VALID(ub) && MMP_SEQ_VALID(ub) then the host has an MMP-aware
	* ZFS, e.g. zfsonlinux >= 0.7.
	*
	* If one ub has MMP and the other does not, they were written by
	* different hosts, which matters for MMP. So we treat no MMP/no SEQ as
	* a 0 value.
	*
	* Since timestamp and txg are the same if we get this far, either is
	* acceptable for importing the pool.
	*/
	unsigned int seq1 = 0;
	unsigned int seq2 = 0;

	if (MMP_VALID(ub1) && MMP_SEQ_VALID(ub1))
	seq1 = MMP_SEQ(ub1);

	if (MMP_VALID(ub2) && MMP_SEQ_VALID(ub2))
	seq2 = MMP_SEQ(ub2);

	return (TREE_CMP(seq1, seq2));
	}

	struct ubl_cbdata {
	uberblock_t ubl_ubbest; / Best uberblock */
	vdev_t ubl_vd; / vdev associated with the above */
	};

	static void
	vdev_uberblock_load_done(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;
	spa_t *spa = zio->io_spa;
	zio_t *rio = zio->io_private;
	uberblock_t *ub = abd_to_buf(zio->io_abd);
	struct ubl_cbdata *cbp = rio->io_private;

	ASSERT3U(zio->io_size, ==, VDEV_UBERBLOCK_SIZE(vd));

	if (zio->io_error == 0 && uberblock_verify(ub) == 0) {
	mutex_enter(&rio->io_lock);
	if (ub->ub_txg <= spa->spa_load_max_txg &&
	vdev_uberblock_compare(ub, cbp->ubl_ubbest) > 0) {
	/*
	* Keep track of the vdev in which this uberblock
	* was found. We will use this information later
	* to obtain the config nvlist associated with
	* this uberblock.
	*/
	cbp->ubl_ubbest = ub;
	cbp->ubl_vd = vd;
	}
	mutex_exit(&rio->io_lock);
	}

	abd_free(zio->io_abd);
	}

	static void
	vdev_uberblock_load_impl(zio_t zio, vdev_t vd, int flags,
	struct ubl_cbdata *cbp)
	{
	for (int c = 0; c < vd->vdev_children; c++)
	vdev_uberblock_load_impl(zio, vd->vdev_child[c], flags, cbp);

	if (vd->vdev_ops->vdev_op_leaf && vdev_readable(vd)) {
	for (int l = 0; l < VDEV_LABELS; l++) {
	for (int n = 0; n < VDEV_UBERBLOCK_COUNT(vd); n++) {
	vdev_label_read(zio, vd, l,
	abd_alloc_linear(VDEV_UBERBLOCK_SIZE(vd),
	B_TRUE), VDEV_UBERBLOCK_OFFSET(vd, n),
	VDEV_UBERBLOCK_SIZE(vd),
	vdev_uberblock_load_done, zio, flags);
	}
	}
	}
	}

	/*
	* Reads the 'best' uberblock from disk along with its associated
	* configuration. First, we read the uberblock array of each label of each
	* vdev, keeping track of the uberblock with the highest txg in each array.
	* Then, we read the configuration from the same vdev as the best uberblock.
	*/
	void
	vdev_uberblock_load(vdev_t rvd, uberblock_t ub, nvlist_t **config)
	{
	zio_t *zio;
	spa_t *spa = rvd->vdev_spa;
	struct ubl_cbdata cb;
	int flags = ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_SPECULATIVE \| ZIO_FLAG_TRYHARD;

	ASSERT(ub);
	ASSERT(config);

	bzero(ub, sizeof (uberblock_t));
	*config = NULL;

	cb.ubl_ubbest = ub;
	cb.ubl_vd = NULL;

	spa_config_enter(spa, SCL_ALL, FTAG, RW_WRITER);
	zio = zio_root(spa, NULL, &cb, flags);
	vdev_uberblock_load_impl(zio, rvd, flags, &cb);
	(void) zio_wait(zio);

	/*
	* It's possible that the best uberblock was discovered on a label
	* that has a configuration which was written in a future txg.
	* Search all labels on this vdev to find the configuration that
	* matches the txg for our uberblock.
	*/
	if (cb.ubl_vd != NULL) {
	vdev_dbgmsg(cb.ubl_vd, "best uberblock found for spa %s. "
	"txg %llu", spa->spa_name, (u_longlong_t)ub->ub_txg);

	*config = vdev_label_read_config(cb.ubl_vd, ub->ub_txg);
	if (*config == NULL && spa->spa_extreme_rewind) {
	vdev_dbgmsg(cb.ubl_vd, "failed to read label config. "
	"Trying again without txg restrictions.");
	*config = vdev_label_read_config(cb.ubl_vd, UINT64_MAX);
	}
	if (*config == NULL) {
	vdev_dbgmsg(cb.ubl_vd, "failed to read label config");
	}
	}
	spa_config_exit(spa, SCL_ALL, FTAG);
	}

	/*
	* For use when a leaf vdev is expanded.
	* The location of labels 2 and 3 changed, and at the new location the
	* uberblock rings are either empty or contain garbage. The sync will write
	* new configs there because the vdev is dirty, but expansion also needs the
	* uberblock rings copied. Read them from label 0 which did not move.
	*
	* Since the point is to populate labels {2,3} with valid uberblocks,
	* we zero uberblocks we fail to read or which are not valid.
	*/

	static void
	vdev_copy_uberblocks(vdev_t *vd)
	{
	abd_t *ub_abd;
	zio_t *write_zio;
	int locks = (SCL_L2ARC \| SCL_ZIO);
	int flags = ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_SPECULATIVE;

	ASSERT(spa_config_held(vd->vdev_spa, SCL_STATE, RW_READER) ==
	SCL_STATE);
	ASSERT(vd->vdev_ops->vdev_op_leaf);

	spa_config_enter(vd->vdev_spa, locks, FTAG, RW_READER);

	ub_abd = abd_alloc_linear(VDEV_UBERBLOCK_SIZE(vd), B_TRUE);

	write_zio = zio_root(vd->vdev_spa, NULL, NULL, flags);
	for (int n = 0; n < VDEV_UBERBLOCK_COUNT(vd); n++) {
	const int src_label = 0;
	zio_t *zio;

	zio = zio_root(vd->vdev_spa, NULL, NULL, flags);
	vdev_label_read(zio, vd, src_label, ub_abd,
	VDEV_UBERBLOCK_OFFSET(vd, n), VDEV_UBERBLOCK_SIZE(vd),
	NULL, NULL, flags);

	if (zio_wait(zio) \|\| uberblock_verify(abd_to_buf(ub_abd)))
	abd_zero(ub_abd, VDEV_UBERBLOCK_SIZE(vd));

	for (int l = 2; l < VDEV_LABELS; l++)
	vdev_label_write(write_zio, vd, l, ub_abd,
	VDEV_UBERBLOCK_OFFSET(vd, n),
	VDEV_UBERBLOCK_SIZE(vd), NULL, NULL,
	flags \| ZIO_FLAG_DONT_PROPAGATE);
	}
	(void) zio_wait(write_zio);

	spa_config_exit(vd->vdev_spa, locks, FTAG);

	abd_free(ub_abd);
	}

	/*
	* On success, increment root zio's count of good writes.
	* We only get credit for writes to known-visible vdevs; see spa_vdev_add().
	*/
	static void
	vdev_uberblock_sync_done(zio_t *zio)
	{
	uint64_t *good_writes = zio->io_private;

	if (zio->io_error == 0 && zio->io_vd->vdev_top->vdev_ms_array != 0)
	atomic_inc_64(good_writes);
	}

	/*
	* Write the uberblock to all labels of all leaves of the specified vdev.
	*/
	static void
	vdev_uberblock_sync(zio_t zio, uint64_t good_writes,
	uberblock_t ub, vdev_t vd, int flags)
	{
	for (uint64_t c = 0; c < vd->vdev_children; c++) {
	vdev_uberblock_sync(zio, good_writes,
	ub, vd->vdev_child[c], flags);
	}

	if (!vd->vdev_ops->vdev_op_leaf)
	return;

	if (!vdev_writeable(vd))
	return;

	/* If the vdev was expanded, need to copy uberblock rings. */
	if (vd->vdev_state == VDEV_STATE_HEALTHY &&
	vd->vdev_copy_uberblocks == B_TRUE) {
	vdev_copy_uberblocks(vd);
	vd->vdev_copy_uberblocks = B_FALSE;
	}

	int m = spa_multihost(vd->vdev_spa) ? MMP_BLOCKS_PER_LABEL : 0;
	int n = ub->ub_txg % (VDEV_UBERBLOCK_COUNT(vd) - m);

	/* Copy the uberblock_t into the ABD */
	abd_t *ub_abd = abd_alloc_for_io(VDEV_UBERBLOCK_SIZE(vd), B_TRUE);
	abd_zero(ub_abd, VDEV_UBERBLOCK_SIZE(vd));
	abd_copy_from_buf(ub_abd, ub, sizeof (uberblock_t));

	for (int l = 0; l < VDEV_LABELS; l++)
	vdev_label_write(zio, vd, l, ub_abd,
	VDEV_UBERBLOCK_OFFSET(vd, n), VDEV_UBERBLOCK_SIZE(vd),
	vdev_uberblock_sync_done, good_writes,
	flags \| ZIO_FLAG_DONT_PROPAGATE);

	abd_free(ub_abd);
	}

	/* Sync the uberblocks to all vdevs in svd[] */
	static int
	vdev_uberblock_sync_list(vdev_t *svd, int svdcount, uberblock_t ub, int flags)
	{
	spa_t *spa = svd[0]->vdev_spa;
	zio_t *zio;
	uint64_t good_writes = 0;

	zio = zio_root(spa, NULL, NULL, flags);

	for (int v = 0; v < svdcount; v++)
	vdev_uberblock_sync(zio, &good_writes, ub, svd[v], flags);

	(void) zio_wait(zio);

	/*
	* Flush the uberblocks to disk. This ensures that the odd labels
	* are no longer needed (because the new uberblocks and the even
	* labels are safely on disk), so it is safe to overwrite them.
	*/
	zio = zio_root(spa, NULL, NULL, flags);

	for (int v = 0; v < svdcount; v++) {
	if (vdev_writeable(svd[v])) {
	zio_flush(zio, svd[v]);
	}
	}

	(void) zio_wait(zio);

	return (good_writes >= 1 ? 0 : EIO);
	}

	/*
	* On success, increment the count of good writes for our top-level vdev.
	*/
	static void
	vdev_label_sync_done(zio_t *zio)
	{
	uint64_t *good_writes = zio->io_private;

	if (zio->io_error == 0)
	atomic_inc_64(good_writes);
	}

	/*
	* If there weren't enough good writes, indicate failure to the parent.
	*/
	static void
	vdev_label_sync_top_done(zio_t *zio)
	{
	uint64_t *good_writes = zio->io_private;

	if (*good_writes == 0)
	zio->io_error = SET_ERROR(EIO);

	kmem_free(good_writes, sizeof (uint64_t));
	}

	/*
	* We ignore errors for log and cache devices, simply free the private data.
	*/
	static void
	vdev_label_sync_ignore_done(zio_t *zio)
	{
	kmem_free(zio->io_private, sizeof (uint64_t));
	}

	/*
	* Write all even or odd labels to all leaves of the specified vdev.
	*/
	static void
	vdev_label_sync(zio_t zio, uint64_t good_writes,
	vdev_t *vd, int l, uint64_t txg, int flags)
	{
	nvlist_t *label;
	vdev_phys_t *vp;
	abd_t *vp_abd;
	char *buf;
	size_t buflen;

	for (int c = 0; c < vd->vdev_children; c++) {
	vdev_label_sync(zio, good_writes,
	vd->vdev_child[c], l, txg, flags);
	}

	if (!vd->vdev_ops->vdev_op_leaf)
	return;

	if (!vdev_writeable(vd))
	return;

	/*
	* Generate a label describing the top-level config to which we belong.
	*/
	label = spa_config_generate(vd->vdev_spa, vd, txg, B_FALSE);

	vp_abd = abd_alloc_linear(sizeof (vdev_phys_t), B_TRUE);
	abd_zero(vp_abd, sizeof (vdev_phys_t));
	vp = abd_to_buf(vp_abd);

	buf = vp->vp_nvlist;
	buflen = sizeof (vp->vp_nvlist);

	if (!nvlist_pack(label, &buf, &buflen, NV_ENCODE_XDR, KM_SLEEP)) {
	for (; l < VDEV_LABELS; l += 2) {
	vdev_label_write(zio, vd, l, vp_abd,
	offsetof(vdev_label_t, vl_vdev_phys),
	sizeof (vdev_phys_t),
	vdev_label_sync_done, good_writes,
	flags \| ZIO_FLAG_DONT_PROPAGATE);
	}
	}

	abd_free(vp_abd);
	nvlist_free(label);
	}

	static int
	vdev_label_sync_list(spa_t *spa, int l, uint64_t txg, int flags)
	{
	list_t *dl = &spa->spa_config_dirty_list;
	vdev_t *vd;
	zio_t *zio;
	int error;

	/*
	* Write the new labels to disk.
	*/
	zio = zio_root(spa, NULL, NULL, flags);

	for (vd = list_head(dl); vd != NULL; vd = list_next(dl, vd)) {
	uint64_t *good_writes;

	ASSERT(!vd->vdev_ishole);

	good_writes = kmem_zalloc(sizeof (uint64_t), KM_SLEEP);
	zio_t *vio = zio_null(zio, spa, NULL,
	(vd->vdev_islog \|\| vd->vdev_aux != NULL) ?
	vdev_label_sync_ignore_done : vdev_label_sync_top_done,
	good_writes, flags);
	vdev_label_sync(vio, good_writes, vd, l, txg, flags);
	zio_nowait(vio);
	}

	error = zio_wait(zio);

	/*
	* Flush the new labels to disk.
	*/
	zio = zio_root(spa, NULL, NULL, flags);

	for (vd = list_head(dl); vd != NULL; vd = list_next(dl, vd))
	zio_flush(zio, vd);

	(void) zio_wait(zio);

	return (error);
	}

	/*
	* Sync the uberblock and any changes to the vdev configuration.
	*
	* The order of operations is carefully crafted to ensure that
	* if the system panics or loses power at any time, the state on disk
	* is still transactionally consistent. The in-line comments below
	* describe the failure semantics at each stage.
	*
	* Moreover, vdev_config_sync() is designed to be idempotent: if it fails
	* at any time, you can just call it again, and it will resume its work.
	*/
	int
	vdev_config_sync(vdev_t **svd, int svdcount, uint64_t txg)
	{
	spa_t *spa = svd[0]->vdev_spa;
	uberblock_t *ub = &spa->spa_uberblock;
	int error = 0;
	int flags = ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_CANFAIL;

	ASSERT(svdcount != 0);
	retry:
	/*
	* Normally, we don't want to try too hard to write every label and
	* uberblock. If there is a flaky disk, we don't want the rest of the
	* sync process to block while we retry. But if we can't write a
	* single label out, we should retry with ZIO_FLAG_TRYHARD before
	* bailing out and declaring the pool faulted.
	*/
	if (error != 0) {
	if ((flags & ZIO_FLAG_TRYHARD) != 0)
	return (error);
	flags \|= ZIO_FLAG_TRYHARD;
	}

	ASSERT(ub->ub_txg <= txg);

	/*
	* If this isn't a resync due to I/O errors,
	* and nothing changed in this transaction group,
	* and the vdev configuration hasn't changed,
	* then there's nothing to do.
	*/
	if (ub->ub_txg < txg) {
	boolean_t changed = uberblock_update(ub, spa->spa_root_vdev,
	txg, spa->spa_mmp.mmp_delay);

	if (!changed && list_is_empty(&spa->spa_config_dirty_list))
	return (0);
	}

	if (txg > spa_freeze_txg(spa))
	return (0);

	ASSERT(txg <= spa->spa_final_txg);

	/*
	* Flush the write cache of every disk that's been written to
	* in this transaction group. This ensures that all blocks
	* written in this txg will be committed to stable storage
	* before any uberblock that references them.
	*/
	zio_t *zio = zio_root(spa, NULL, NULL, flags);

	for (vdev_t *vd =
	txg_list_head(&spa->spa_vdev_txg_list, TXG_CLEAN(txg)); vd != NULL;
	vd = txg_list_next(&spa->spa_vdev_txg_list, vd, TXG_CLEAN(txg)))
	zio_flush(zio, vd);

	(void) zio_wait(zio);

	/*
	* Sync out the even labels (L0, L2) for every dirty vdev. If the
	* system dies in the middle of this process, that's OK: all of the
	* even labels that made it to disk will be newer than any uberblock,
	* and will therefore be considered invalid. The odd labels (L1, L3),
	* which have not yet been touched, will still be valid. We flush
	* the new labels to disk to ensure that all even-label updates
	* are committed to stable storage before the uberblock update.
	*/
	if ((error = vdev_label_sync_list(spa, 0, txg, flags)) != 0) {
	if ((flags & ZIO_FLAG_TRYHARD) != 0) {
	zfs_dbgmsg("vdev_label_sync_list() returned error %d "
	"for pool '%s' when syncing out the even labels "
	"of dirty vdevs", error, spa_name(spa));
	}
	goto retry;
	}

	/*
	* Sync the uberblocks to all vdevs in svd[].
	* If the system dies in the middle of this step, there are two cases
	* to consider, and the on-disk state is consistent either way:
	*
	* (1) If none of the new uberblocks made it to disk, then the
	* previous uberblock will be the newest, and the odd labels
	* (which had not yet been touched) will be valid with respect
	* to that uberblock.
	*
	* (2) If one or more new uberblocks made it to disk, then they
	* will be the newest, and the even labels (which had all
	* been successfully committed) will be valid with respect
	* to the new uberblocks.
	*/
	if ((error = vdev_uberblock_sync_list(svd, svdcount, ub, flags)) != 0) {
	if ((flags & ZIO_FLAG_TRYHARD) != 0) {
	zfs_dbgmsg("vdev_uberblock_sync_list() returned error "
	"%d for pool '%s'", error, spa_name(spa));
	}
	goto retry;
	}

	if (spa_multihost(spa))
	mmp_update_uberblock(spa, ub);

	/*
	* Sync out odd labels for every dirty vdev. If the system dies
	* in the middle of this process, the even labels and the new
	* uberblocks will suffice to open the pool. The next time
	* the pool is opened, the first thing we'll do -- before any
	* user data is modified -- is mark every vdev dirty so that
	* all labels will be brought up to date. We flush the new labels
	* to disk to ensure that all odd-label updates are committed to
	* stable storage before the next transaction group begins.
	*/
	if ((error = vdev_label_sync_list(spa, 1, txg, flags)) != 0) {
	if ((flags & ZIO_FLAG_TRYHARD) != 0) {
	zfs_dbgmsg("vdev_label_sync_list() returned error %d "
	"for pool '%s' when syncing out the odd labels of "
	"dirty vdevs", error, spa_name(spa));
	}
	goto retry;
	}

	return (0);
	}
	Index: vendor-sys/openzfs/dist/module/zfs/vdev_mirror.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev_mirror.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev_mirror.c (revision 365892)
	@@ -1,863 +1,863 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright 2010 Sun Microsystems, Inc. All rights reserved.
	* Use is subject to license terms.
	*/

	/*
	* Copyright (c) 2012, 2015 by Delphix. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/dsl_pool.h>
	#include <sys/dsl_scan.h>
	#include <sys/vdev_impl.h>
	#include <sys/zio.h>
	#include <sys/abd.h>
	#include <sys/fs/zfs.h>

	/*
	* Vdev mirror kstats
	*/
	static kstat_t *mirror_ksp = NULL;

	typedef struct mirror_stats {
	kstat_named_t vdev_mirror_stat_rotating_linear;
	kstat_named_t vdev_mirror_stat_rotating_offset;
	kstat_named_t vdev_mirror_stat_rotating_seek;
	kstat_named_t vdev_mirror_stat_non_rotating_linear;
	kstat_named_t vdev_mirror_stat_non_rotating_seek;

	kstat_named_t vdev_mirror_stat_preferred_found;
	kstat_named_t vdev_mirror_stat_preferred_not_found;
	} mirror_stats_t;

	static mirror_stats_t mirror_stats = {
	/* New I/O follows directly the last I/O */
	{ "rotating_linear", KSTAT_DATA_UINT64 },
	/* New I/O is within zfs_vdev_mirror_rotating_seek_offset of the last */
	{ "rotating_offset", KSTAT_DATA_UINT64 },
	/* New I/O requires random seek */
	{ "rotating_seek", KSTAT_DATA_UINT64 },
	/* New I/O follows directly the last I/O (nonrot) */
	{ "non_rotating_linear", KSTAT_DATA_UINT64 },
	/* New I/O requires random seek (nonrot) */
	{ "non_rotating_seek", KSTAT_DATA_UINT64 },
	/* Preferred child vdev found */
	{ "preferred_found", KSTAT_DATA_UINT64 },
	/* Preferred child vdev not found or equal load */
	{ "preferred_not_found", KSTAT_DATA_UINT64 },

	};

	#define MIRROR_STAT(stat) (mirror_stats.stat.value.ui64)
	#define MIRROR_INCR(stat, val) atomic_add_64(&MIRROR_STAT(stat), val)
	#define MIRROR_BUMP(stat) MIRROR_INCR(stat, 1)

	void
	vdev_mirror_stat_init(void)
	{
	mirror_ksp = kstat_create("zfs", 0, "vdev_mirror_stats",
	"misc", KSTAT_TYPE_NAMED,
	sizeof (mirror_stats) / sizeof (kstat_named_t), KSTAT_FLAG_VIRTUAL);
	if (mirror_ksp != NULL) {
	mirror_ksp->ks_data = &mirror_stats;
	kstat_install(mirror_ksp);
	}
	}

	void
	vdev_mirror_stat_fini(void)
	{
	if (mirror_ksp != NULL) {
	kstat_delete(mirror_ksp);
	mirror_ksp = NULL;
	}
	}

	/*
	* Virtual device vector for mirroring.
	*/

	typedef struct mirror_child {
	vdev_t *mc_vd;
	uint64_t mc_offset;
	int mc_error;
	int mc_load;
	uint8_t mc_tried;
	uint8_t mc_skipped;
	uint8_t mc_speculative;
	} mirror_child_t;

	typedef struct mirror_map {
	int *mm_preferred;
	int mm_preferred_cnt;
	int mm_children;
	boolean_t mm_resilvering;
	boolean_t mm_root;
	mirror_child_t mm_child[];
	} mirror_map_t;

	static int vdev_mirror_shift = 21;

	/*
	* The load configuration settings below are tuned by default for
	* the case where all devices are of the same rotational type.
	*
	* If there is a mixture of rotating and non-rotating media, setting
	* zfs_vdev_mirror_non_rotating_seek_inc to 0 may well provide better results
	* as it will direct more reads to the non-rotating vdevs which are more likely
	* to have a higher performance.
	*/

	/* Rotating media load calculation configuration. */
	static int zfs_vdev_mirror_rotating_inc = 0;
	static int zfs_vdev_mirror_rotating_seek_inc = 5;
	static int zfs_vdev_mirror_rotating_seek_offset = 1 * 1024 * 1024;

	/* Non-rotating media load calculation configuration. */
	static int zfs_vdev_mirror_non_rotating_inc = 0;
	static int zfs_vdev_mirror_non_rotating_seek_inc = 1;

	static inline size_t
	vdev_mirror_map_size(int children)
	{
	return (offsetof(mirror_map_t, mm_child[children]) +
	sizeof (int) * children);
	}

	static inline mirror_map_t *
	vdev_mirror_map_alloc(int children, boolean_t resilvering, boolean_t root)
	{
	mirror_map_t *mm;

	mm = kmem_zalloc(vdev_mirror_map_size(children), KM_SLEEP);
	mm->mm_children = children;
	mm->mm_resilvering = resilvering;
	mm->mm_root = root;
	mm->mm_preferred = (int *)((uintptr_t)mm +
	offsetof(mirror_map_t, mm_child[children]));

	return (mm);
	}

	static void
	vdev_mirror_map_free(zio_t *zio)
	{
	mirror_map_t *mm = zio->io_vsd;

	kmem_free(mm, vdev_mirror_map_size(mm->mm_children));
	}

	static const zio_vsd_ops_t vdev_mirror_vsd_ops = {
	.vsd_free = vdev_mirror_map_free,
	.vsd_cksum_report = zio_vsd_default_cksum_report
	};

	static int
	vdev_mirror_load(mirror_map_t mm, vdev_t vd, uint64_t zio_offset)
	{
	uint64_t last_offset;
	int64_t offset_diff;
	int load;

	/* All DVAs have equal weight at the root. */
	if (mm->mm_root)
	return (INT_MAX);

	/*
	* We don't return INT_MAX if the device is resilvering i.e.
	* vdev_resilver_txg != 0 as when tested performance was slightly
	* worse overall when resilvering with compared to without.
	*/

	/* Fix zio_offset for leaf vdevs */
	if (vd->vdev_ops->vdev_op_leaf)
	zio_offset += VDEV_LABEL_START_SIZE;

	/* Standard load based on pending queue length. */
	load = vdev_queue_length(vd);
	last_offset = vdev_queue_last_offset(vd);

	if (vd->vdev_nonrot) {
	/* Non-rotating media. */
	if (last_offset == zio_offset) {
	MIRROR_BUMP(vdev_mirror_stat_non_rotating_linear);
	return (load + zfs_vdev_mirror_non_rotating_inc);
	}

	/*
	* Apply a seek penalty even for non-rotating devices as
	* sequential I/O's can be aggregated into fewer operations on
	* the device, thus avoiding unnecessary per-command overhead
	* and boosting performance.
	*/
	MIRROR_BUMP(vdev_mirror_stat_non_rotating_seek);
	return (load + zfs_vdev_mirror_non_rotating_seek_inc);
	}

	/* Rotating media I/O's which directly follow the last I/O. */
	if (last_offset == zio_offset) {
	MIRROR_BUMP(vdev_mirror_stat_rotating_linear);
	return (load + zfs_vdev_mirror_rotating_inc);
	}

	/*
	* Apply half the seek increment to I/O's within seek offset
	* of the last I/O issued to this vdev as they should incur less
	* of a seek increment.
	*/
	offset_diff = (int64_t)(last_offset - zio_offset);
	if (ABS(offset_diff) < zfs_vdev_mirror_rotating_seek_offset) {
	MIRROR_BUMP(vdev_mirror_stat_rotating_offset);
	return (load + (zfs_vdev_mirror_rotating_seek_inc / 2));
	}

	/* Apply the full seek increment to all other I/O's. */
	MIRROR_BUMP(vdev_mirror_stat_rotating_seek);
	return (load + zfs_vdev_mirror_rotating_seek_inc);
	}

	/*
	* Avoid inlining the function to keep vdev_mirror_io_start(), which
	* is this functions only caller, as small as possible on the stack.
	*/
	noinline static mirror_map_t *
	vdev_mirror_map_init(zio_t *zio)
	{
	mirror_map_t *mm = NULL;
	mirror_child_t *mc;
	vdev_t *vd = zio->io_vd;
	int c;

	if (vd == NULL) {
	dva_t *dva = zio->io_bp->blk_dva;
	spa_t *spa = zio->io_spa;
	dsl_scan_t *scn = spa->spa_dsl_pool->dp_scan;
	dva_t dva_copy[SPA_DVAS_PER_BP];

	/*
	* The sequential scrub code sorts and issues all DVAs
	* of a bp separately. Each of these IOs includes all
	* original DVA copies so that repairs can be performed
	* in the event of an error, but we only actually want
	* to check the first DVA since the others will be
	* checked by their respective sorted IOs. Only if we
	* hit an error will we try all DVAs upon retrying.
	*
	* Note: This check is safe even if the user switches
	* from a legacy scrub to a sequential one in the middle
	* of processing, since scn_is_sorted isn't updated until
	* all outstanding IOs from the previous scrub pass
	* complete.
	*/
	if ((zio->io_flags & ZIO_FLAG_SCRUB) &&
	!(zio->io_flags & ZIO_FLAG_IO_RETRY) &&
	dsl_scan_scrubbing(spa->spa_dsl_pool) &&
	scn->scn_is_sorted) {
	c = 1;
	} else {
	c = BP_GET_NDVAS(zio->io_bp);
	}

	/*
	* If the pool cannot be written to, then infer that some
	* DVAs might be invalid or point to vdevs that do not exist.
	* We skip them.
	*/
	if (!spa_writeable(spa)) {
	ASSERT3U(zio->io_type, ==, ZIO_TYPE_READ);
	int j = 0;
	for (int i = 0; i < c; i++) {
	if (zfs_dva_valid(spa, &dva[i], zio->io_bp))
	dva_copy[j++] = dva[i];
	}
	if (j == 0) {
	zio->io_vsd = NULL;
	zio->io_error = ENXIO;
	return (NULL);
	}
	if (j < c) {
	dva = dva_copy;
	c = j;
	}
	}

	mm = vdev_mirror_map_alloc(c, B_FALSE, B_TRUE);
	for (c = 0; c < mm->mm_children; c++) {
	mc = &mm->mm_child[c];

	mc->mc_vd = vdev_lookup_top(spa, DVA_GET_VDEV(&dva[c]));
	mc->mc_offset = DVA_GET_OFFSET(&dva[c]);
	if (mc->mc_vd == NULL) {
	kmem_free(mm, vdev_mirror_map_size(
	mm->mm_children));
	zio->io_vsd = NULL;
	zio->io_error = ENXIO;
	return (NULL);
	}
	}
	} else {
	/*
	* If we are resilvering, then we should handle scrub reads
	* differently; we shouldn't issue them to the resilvering
	* device because it might not have those blocks.
	*
	* We are resilvering iff:
	* 1) We are a replacing vdev (ie our name is "replacing-1" or
	* "spare-1" or something like that), and
	* 2) The pool is currently being resilvered.
	*
	* We cannot simply check vd->vdev_resilver_txg, because it's
	* not set in this path.
	*
	* Nor can we just check our vdev_ops; there are cases (such as
	* when a user types "zpool replace pool odev spare_dev" and
	* spare_dev is in the spare list, or when a spare device is
	* automatically used to replace a DEGRADED device) when
	* resilvering is complete but both the original vdev and the
	* spare vdev remain in the pool. That behavior is intentional.
	* It helps implement the policy that a spare should be
	* automatically removed from the pool after the user replaces
	* the device that originally failed.
	*
	* If a spa load is in progress, then spa_dsl_pool may be
	* uninitialized. But we shouldn't be resilvering during a spa
	* load anyway.
	*/
	boolean_t replacing = (vd->vdev_ops == &vdev_replacing_ops \|\|
	vd->vdev_ops == &vdev_spare_ops) &&
	spa_load_state(vd->vdev_spa) == SPA_LOAD_NONE &&
	dsl_scan_resilvering(vd->vdev_spa->spa_dsl_pool);
	mm = vdev_mirror_map_alloc(vd->vdev_children, replacing,
	B_FALSE);
	for (c = 0; c < mm->mm_children; c++) {
	mc = &mm->mm_child[c];
	mc->mc_vd = vd->vdev_child[c];
	mc->mc_offset = zio->io_offset;
	}
	}

	zio->io_vsd = mm;
	zio->io_vsd_ops = &vdev_mirror_vsd_ops;
	return (mm);
	}

	static int
	vdev_mirror_open(vdev_t vd, uint64_t asize, uint64_t *max_asize,
	uint64_t logical_ashift, uint64_t physical_ashift)
	{
	int numerrors = 0;
	int lasterror = 0;

	if (vd->vdev_children == 0) {
	vd->vdev_stat.vs_aux = VDEV_AUX_BAD_LABEL;
	return (SET_ERROR(EINVAL));
	}

	vdev_open_children(vd);

	for (int c = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];

	if (cvd->vdev_open_error) {
	lasterror = cvd->vdev_open_error;
	numerrors++;
	continue;
	}

	asize = MIN(asize - 1, cvd->vdev_asize - 1) + 1;
	max_asize = MIN(max_asize - 1, cvd->vdev_max_asize - 1) + 1;
	logical_ashift = MAX(logical_ashift, cvd->vdev_ashift);
	physical_ashift = MAX(physical_ashift,
	- vd->vdev_physical_ashift);
	+ cvd->vdev_physical_ashift);
	}

	if (numerrors == vd->vdev_children) {
	if (vdev_children_are_offline(vd))
	vd->vdev_stat.vs_aux = VDEV_AUX_CHILDREN_OFFLINE;
	else
	vd->vdev_stat.vs_aux = VDEV_AUX_NO_REPLICAS;
	return (lasterror);
	}

	return (0);
	}

	static void
	vdev_mirror_close(vdev_t *vd)
	{
	for (int c = 0; c < vd->vdev_children; c++)
	vdev_close(vd->vdev_child[c]);
	}

	static void
	vdev_mirror_child_done(zio_t *zio)
	{
	mirror_child_t *mc = zio->io_private;

	mc->mc_error = zio->io_error;
	mc->mc_tried = 1;
	mc->mc_skipped = 0;
	}

	static void
	vdev_mirror_scrub_done(zio_t *zio)
	{
	mirror_child_t *mc = zio->io_private;

	if (zio->io_error == 0) {
	zio_t *pio;
	zio_link_t *zl = NULL;

	mutex_enter(&zio->io_lock);
	while ((pio = zio_walk_parents(zio, &zl)) != NULL) {
	mutex_enter(&pio->io_lock);
	ASSERT3U(zio->io_size, >=, pio->io_size);
	abd_copy(pio->io_abd, zio->io_abd, pio->io_size);
	mutex_exit(&pio->io_lock);
	}
	mutex_exit(&zio->io_lock);
	}

	abd_free(zio->io_abd);

	mc->mc_error = zio->io_error;
	mc->mc_tried = 1;
	mc->mc_skipped = 0;
	}

	/*
	* Check the other, lower-index DVAs to see if they're on the same
	* vdev as the child we picked. If they are, use them since they
	* are likely to have been allocated from the primary metaslab in
	* use at the time, and hence are more likely to have locality with
	* single-copy data.
	*/
	static int
	vdev_mirror_dva_select(zio_t *zio, int p)
	{
	dva_t *dva = zio->io_bp->blk_dva;
	mirror_map_t *mm = zio->io_vsd;
	int preferred;
	int c;

	preferred = mm->mm_preferred[p];
	for (p--; p >= 0; p--) {
	c = mm->mm_preferred[p];
	if (DVA_GET_VDEV(&dva[c]) == DVA_GET_VDEV(&dva[preferred]))
	preferred = c;
	}
	return (preferred);
	}

	static int
	vdev_mirror_preferred_child_randomize(zio_t *zio)
	{
	mirror_map_t *mm = zio->io_vsd;
	int p;

	if (mm->mm_root) {
	p = spa_get_random(mm->mm_preferred_cnt);
	return (vdev_mirror_dva_select(zio, p));
	}

	/*
	* To ensure we don't always favour the first matching vdev,
	* which could lead to wear leveling issues on SSD's, we
	* use the I/O offset as a pseudo random seed into the vdevs
	* which have the lowest load.
	*/
	p = (zio->io_offset >> vdev_mirror_shift) % mm->mm_preferred_cnt;
	return (mm->mm_preferred[p]);
	}

	/*
	* Try to find a vdev whose DTL doesn't contain the block we want to read
	* preferring vdevs based on determined load.
	*
	* Try to find a child whose DTL doesn't contain the block we want to read.
	* If we can't, try the read on any vdev we haven't already tried.
	*/
	static int
	vdev_mirror_child_select(zio_t *zio)
	{
	mirror_map_t *mm = zio->io_vsd;
	uint64_t txg = zio->io_txg;
	int c, lowest_load;

	ASSERT(zio->io_bp == NULL \|\| BP_PHYSICAL_BIRTH(zio->io_bp) == txg);

	lowest_load = INT_MAX;
	mm->mm_preferred_cnt = 0;
	for (c = 0; c < mm->mm_children; c++) {
	mirror_child_t *mc;

	mc = &mm->mm_child[c];
	if (mc->mc_tried \|\| mc->mc_skipped)
	continue;

	if (mc->mc_vd == NULL \|\| !vdev_readable(mc->mc_vd)) {
	mc->mc_error = SET_ERROR(ENXIO);
	mc->mc_tried = 1; /* don't even try */
	mc->mc_skipped = 1;
	continue;
	}

	if (vdev_dtl_contains(mc->mc_vd, DTL_MISSING, txg, 1)) {
	mc->mc_error = SET_ERROR(ESTALE);
	mc->mc_skipped = 1;
	mc->mc_speculative = 1;
	continue;
	}

	mc->mc_load = vdev_mirror_load(mm, mc->mc_vd, mc->mc_offset);
	if (mc->mc_load > lowest_load)
	continue;

	if (mc->mc_load < lowest_load) {
	lowest_load = mc->mc_load;
	mm->mm_preferred_cnt = 0;
	}
	mm->mm_preferred[mm->mm_preferred_cnt] = c;
	mm->mm_preferred_cnt++;
	}

	if (mm->mm_preferred_cnt == 1) {
	MIRROR_BUMP(vdev_mirror_stat_preferred_found);
	return (mm->mm_preferred[0]);
	}

	if (mm->mm_preferred_cnt > 1) {
	MIRROR_BUMP(vdev_mirror_stat_preferred_not_found);
	return (vdev_mirror_preferred_child_randomize(zio));
	}

	/*
	* Every device is either missing or has this txg in its DTL.
	* Look for any child we haven't already tried before giving up.
	*/
	for (c = 0; c < mm->mm_children; c++) {
	if (!mm->mm_child[c].mc_tried)
	return (c);
	}

	/*
	* Every child failed. There's no place left to look.
	*/
	return (-1);
	}

	static void
	vdev_mirror_io_start(zio_t *zio)
	{
	mirror_map_t *mm;
	mirror_child_t *mc;
	int c, children;

	mm = vdev_mirror_map_init(zio);

	if (mm == NULL) {
	ASSERT(!spa_trust_config(zio->io_spa));
	ASSERT(zio->io_type == ZIO_TYPE_READ);
	zio_execute(zio);
	return;
	}

	if (zio->io_type == ZIO_TYPE_READ) {
	if (zio->io_bp != NULL &&
	(zio->io_flags & ZIO_FLAG_SCRUB) && !mm->mm_resilvering) {
	/*
	* For scrubbing reads (if we can verify the
	* checksum here, as indicated by io_bp being
	* non-NULL) we need to allocate a read buffer for
	* each child and issue reads to all children. If
	* any child succeeds, it will copy its data into
	* zio->io_data in vdev_mirror_scrub_done.
	*/
	for (c = 0; c < mm->mm_children; c++) {
	mc = &mm->mm_child[c];
	zio_nowait(zio_vdev_child_io(zio, zio->io_bp,
	mc->mc_vd, mc->mc_offset,
	abd_alloc_sametype(zio->io_abd,
	zio->io_size), zio->io_size,
	zio->io_type, zio->io_priority, 0,
	vdev_mirror_scrub_done, mc));
	}
	zio_execute(zio);
	return;
	}
	/*
	* For normal reads just pick one child.
	*/
	c = vdev_mirror_child_select(zio);
	children = (c >= 0);
	} else {
	ASSERT(zio->io_type == ZIO_TYPE_WRITE);

	/*
	* Writes go to all children.
	*/
	c = 0;
	children = mm->mm_children;
	}

	while (children--) {
	mc = &mm->mm_child[c];
	zio_nowait(zio_vdev_child_io(zio, zio->io_bp,
	mc->mc_vd, mc->mc_offset, zio->io_abd, zio->io_size,
	zio->io_type, zio->io_priority, 0,
	vdev_mirror_child_done, mc));
	c++;
	}

	zio_execute(zio);
	}

	static int
	vdev_mirror_worst_error(mirror_map_t *mm)
	{
	int error[2] = { 0, 0 };

	for (int c = 0; c < mm->mm_children; c++) {
	mirror_child_t *mc = &mm->mm_child[c];
	int s = mc->mc_speculative;
	error[s] = zio_worst_error(error[s], mc->mc_error);
	}

	return (error[0] ? error[0] : error[1]);
	}

	static void
	vdev_mirror_io_done(zio_t *zio)
	{
	mirror_map_t *mm = zio->io_vsd;
	mirror_child_t *mc;
	int c;
	int good_copies = 0;
	int unexpected_errors = 0;

	if (mm == NULL)
	return;

	for (c = 0; c < mm->mm_children; c++) {
	mc = &mm->mm_child[c];

	if (mc->mc_error) {
	if (!mc->mc_skipped)
	unexpected_errors++;
	} else if (mc->mc_tried) {
	good_copies++;
	}
	}

	if (zio->io_type == ZIO_TYPE_WRITE) {
	/*
	* XXX -- for now, treat partial writes as success.
	*
	* Now that we support write reallocation, it would be better
	* to treat partial failure as real failure unless there are
	* no non-degraded top-level vdevs left, and not update DTLs
	* if we intend to reallocate.
	*/
	/* XXPOLICY */
	if (good_copies != mm->mm_children) {
	/*
	* Always require at least one good copy.
	*
	* For ditto blocks (io_vd == NULL), require
	* all copies to be good.
	*
	* XXX -- for replacing vdevs, there's no great answer.
	* If the old device is really dead, we may not even
	* be able to access it -- so we only want to
	* require good writes to the new device. But if
	* the new device turns out to be flaky, we want
	* to be able to detach it -- which requires all
	* writes to the old device to have succeeded.
	*/
	if (good_copies == 0 \|\| zio->io_vd == NULL)
	zio->io_error = vdev_mirror_worst_error(mm);
	}
	return;
	}

	ASSERT(zio->io_type == ZIO_TYPE_READ);

	/*
	* If we don't have a good copy yet, keep trying other children.
	*/
	/* XXPOLICY */
	if (good_copies == 0 && (c = vdev_mirror_child_select(zio)) != -1) {
	ASSERT(c >= 0 && c < mm->mm_children);
	mc = &mm->mm_child[c];
	zio_vdev_io_redone(zio);
	zio_nowait(zio_vdev_child_io(zio, zio->io_bp,
	mc->mc_vd, mc->mc_offset, zio->io_abd, zio->io_size,
	ZIO_TYPE_READ, zio->io_priority, 0,
	vdev_mirror_child_done, mc));
	return;
	}

	/* XXPOLICY */
	if (good_copies == 0) {
	zio->io_error = vdev_mirror_worst_error(mm);
	ASSERT(zio->io_error != 0);
	}

	if (good_copies && spa_writeable(zio->io_spa) &&
	(unexpected_errors \|\|
	(zio->io_flags & ZIO_FLAG_RESILVER) \|\|
	((zio->io_flags & ZIO_FLAG_SCRUB) && mm->mm_resilvering))) {
	/*
	* Use the good data we have in hand to repair damaged children.
	*/
	for (c = 0; c < mm->mm_children; c++) {
	/*
	* Don't rewrite known good children.
	* Not only is it unnecessary, it could
	* actually be harmful: if the system lost
	* power while rewriting the only good copy,
	* there would be no good copies left!
	*/
	mc = &mm->mm_child[c];

	if (mc->mc_error == 0) {
	if (mc->mc_tried)
	continue;
	/*
	* We didn't try this child. We need to
	* repair it if:
	* 1. it's a scrub (in which case we have
	* tried everything that was healthy)
	* - or -
	* 2. it's an indirect vdev (in which case
	* it could point to any other vdev, which
	* might have a bad DTL)
	* - or -
	* 3. the DTL indicates that this data is
	* missing from this vdev
	*/
	if (!(zio->io_flags & ZIO_FLAG_SCRUB) &&
	mc->mc_vd->vdev_ops != &vdev_indirect_ops &&
	!vdev_dtl_contains(mc->mc_vd, DTL_PARTIAL,
	zio->io_txg, 1))
	continue;
	mc->mc_error = SET_ERROR(ESTALE);
	}

	zio_nowait(zio_vdev_child_io(zio, zio->io_bp,
	mc->mc_vd, mc->mc_offset,
	zio->io_abd, zio->io_size, ZIO_TYPE_WRITE,
	zio->io_priority == ZIO_PRIORITY_REBUILD ?
	ZIO_PRIORITY_REBUILD : ZIO_PRIORITY_ASYNC_WRITE,
	ZIO_FLAG_IO_REPAIR \| (unexpected_errors ?
	ZIO_FLAG_SELF_HEAL : 0), NULL, NULL));
	}
	}
	}

	static void
	vdev_mirror_state_change(vdev_t *vd, int faulted, int degraded)
	{
	if (faulted == vd->vdev_children) {
	if (vdev_children_are_offline(vd)) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_OFFLINE,
	VDEV_AUX_CHILDREN_OFFLINE);
	} else {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_NO_REPLICAS);
	}
	} else if (degraded + faulted != 0) {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_DEGRADED, VDEV_AUX_NONE);
	} else {
	vdev_set_state(vd, B_FALSE, VDEV_STATE_HEALTHY, VDEV_AUX_NONE);
	}
	}

	vdev_ops_t vdev_mirror_ops = {
	.vdev_op_open = vdev_mirror_open,
	.vdev_op_close = vdev_mirror_close,
	.vdev_op_asize = vdev_default_asize,
	.vdev_op_io_start = vdev_mirror_io_start,
	.vdev_op_io_done = vdev_mirror_io_done,
	.vdev_op_state_change = vdev_mirror_state_change,
	.vdev_op_need_resilver = NULL,
	.vdev_op_hold = NULL,
	.vdev_op_rele = NULL,
	.vdev_op_remap = NULL,
	.vdev_op_xlate = vdev_default_xlate,
	.vdev_op_type = VDEV_TYPE_MIRROR, /* name of this vdev type */
	.vdev_op_leaf = B_FALSE /* not a leaf vdev */
	};

	vdev_ops_t vdev_replacing_ops = {
	.vdev_op_open = vdev_mirror_open,
	.vdev_op_close = vdev_mirror_close,
	.vdev_op_asize = vdev_default_asize,
	.vdev_op_io_start = vdev_mirror_io_start,
	.vdev_op_io_done = vdev_mirror_io_done,
	.vdev_op_state_change = vdev_mirror_state_change,
	.vdev_op_need_resilver = NULL,
	.vdev_op_hold = NULL,
	.vdev_op_rele = NULL,
	.vdev_op_remap = NULL,
	.vdev_op_xlate = vdev_default_xlate,
	.vdev_op_type = VDEV_TYPE_REPLACING, /* name of this vdev type */
	.vdev_op_leaf = B_FALSE /* not a leaf vdev */
	};

	vdev_ops_t vdev_spare_ops = {
	.vdev_op_open = vdev_mirror_open,
	.vdev_op_close = vdev_mirror_close,
	.vdev_op_asize = vdev_default_asize,
	.vdev_op_io_start = vdev_mirror_io_start,
	.vdev_op_io_done = vdev_mirror_io_done,
	.vdev_op_state_change = vdev_mirror_state_change,
	.vdev_op_need_resilver = NULL,
	.vdev_op_hold = NULL,
	.vdev_op_rele = NULL,
	.vdev_op_remap = NULL,
	.vdev_op_xlate = vdev_default_xlate,
	.vdev_op_type = VDEV_TYPE_SPARE, /* name of this vdev type */
	.vdev_op_leaf = B_FALSE /* not a leaf vdev */
	};

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_vdev_mirror, zfs_vdev_mirror_, rotating_inc, INT, ZMOD_RW,
	"Rotating media load increment for non-seeking I/O's");

	ZFS_MODULE_PARAM(zfs_vdev_mirror, zfs_vdev_mirror_, rotating_seek_inc, INT, ZMOD_RW,
	"Rotating media load increment for seeking I/O's");

	ZFS_MODULE_PARAM(zfs_vdev_mirror, zfs_vdev_mirror_, rotating_seek_offset, INT, ZMOD_RW,
	"Offset in bytes from the last I/O which triggers "
	"a reduced rotating media seek increment");

	ZFS_MODULE_PARAM(zfs_vdev_mirror, zfs_vdev_mirror_, non_rotating_inc, INT, ZMOD_RW,
	"Non-rotating media load increment for non-seeking I/O's");

	ZFS_MODULE_PARAM(zfs_vdev_mirror, zfs_vdev_mirror_, non_rotating_seek_inc, INT, ZMOD_RW,
	"Non-rotating media load increment for seeking I/O's");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/vdev_raidz.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev_raidz.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev_raidz.c (revision 365892)
	@@ -1,2421 +1,2422 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	- * Copyright (c) 2012, 2019 by Delphix. All rights reserved.
	+ * Copyright (c) 2012, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2016 Gvozden Nešković. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa.h>
	#include <sys/vdev_impl.h>
	#include <sys/zio.h>
	#include <sys/zio_checksum.h>
	#include <sys/abd.h>
	#include <sys/fs/zfs.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/vdev_raidz.h>
	#include <sys/vdev_raidz_impl.h>

	#ifdef ZFS_DEBUG
	#include <sys/vdev.h> /* For vdev_xlate() in vdev_raidz_io_verify() */
	#endif

	/*
	* Virtual device vector for RAID-Z.
	*
	* This vdev supports single, double, and triple parity. For single parity,
	* we use a simple XOR of all the data columns. For double or triple parity,
	* we use a special case of Reed-Solomon coding. This extends the
	* technique described in "The mathematics of RAID-6" by H. Peter Anvin by
	* drawing on the system described in "A Tutorial on Reed-Solomon Coding for
	* Fault-Tolerance in RAID-like Systems" by James S. Plank on which the
	* former is also based. The latter is designed to provide higher performance
	* for writes.
	*
	* Note that the Plank paper claimed to support arbitrary N+M, but was then
	* amended six years later identifying a critical flaw that invalidates its
	* claims. Nevertheless, the technique can be adapted to work for up to
	* triple parity. For additional parity, the amendment "Note: Correction to
	* the 1997 Tutorial on Reed-Solomon Coding" by James S. Plank and Ying Ding
	* is viable, but the additional complexity means that write performance will
	* suffer.
	*
	* All of the methods above operate on a Galois field, defined over the
	* integers mod 2^N. In our case we choose N=8 for GF(8) so that all elements
	* can be expressed with a single byte. Briefly, the operations on the
	* field are defined as follows:
	*
	* o addition (+) is represented by a bitwise XOR
	* o subtraction (-) is therefore identical to addition: A + B = A - B
	* o multiplication of A by 2 is defined by the following bitwise expression:
	*
	* (A * 2)_7 = A_6
	* (A * 2)_6 = A_5
	* (A * 2)_5 = A_4
	* (A * 2)_4 = A_3 + A_7
	* (A * 2)_3 = A_2 + A_7
	* (A * 2)_2 = A_1 + A_7
	* (A * 2)_1 = A_0
	* (A * 2)_0 = A_7
	*
	* In C, multiplying by 2 is therefore ((a << 1) ^ ((a & 0x80) ? 0x1d : 0)).
	* As an aside, this multiplication is derived from the error correcting
	* primitive polynomial x^8 + x^4 + x^3 + x^2 + 1.
	*
	* Observe that any number in the field (except for 0) can be expressed as a
	* power of 2 -- a generator for the field. We store a table of the powers of
	* 2 and logs base 2 for quick look ups, and exploit the fact that A * B can
	* be rewritten as 2^(log_2(A) + log_2(B)) (where '+' is normal addition rather
	* than field addition). The inverse of a field element A (A^-1) is therefore
	* A ^ (255 - 1) = A^254.
	*
	* The up-to-three parity columns, P, Q, R over several data columns,
	* D_0, ... D_n-1, can be expressed by field operations:
	*
	* P = D_0 + D_1 + ... + D_n-2 + D_n-1
	* Q = 2^n-1 * D_0 + 2^n-2 * D_1 + ... + 2^1 * D_n-2 + 2^0 * D_n-1
	* = ((...((D_0) * 2 + D_1) * 2 + ...) * 2 + D_n-2) * 2 + D_n-1
	* R = 4^n-1 * D_0 + 4^n-2 * D_1 + ... + 4^1 * D_n-2 + 4^0 * D_n-1
	* = ((...((D_0) * 4 + D_1) * 4 + ...) * 4 + D_n-2) * 4 + D_n-1
	*
	* We chose 1, 2, and 4 as our generators because 1 corresponds to the trivial
	* XOR operation, and 2 and 4 can be computed quickly and generate linearly-
	* independent coefficients. (There are no additional coefficients that have
	* this property which is why the uncorrected Plank method breaks down.)
	*
	* See the reconstruction code below for how P, Q and R can used individually
	* or in concert to recover missing data columns.
	*/

	#define VDEV_RAIDZ_P 0
	#define VDEV_RAIDZ_Q 1
	#define VDEV_RAIDZ_R 2

	#define VDEV_RAIDZ_MUL_2(x) (((x) << 1) ^ (((x) & 0x80) ? 0x1d : 0))
	#define VDEV_RAIDZ_MUL_4(x) (VDEV_RAIDZ_MUL_2(VDEV_RAIDZ_MUL_2(x)))

	/*
	* We provide a mechanism to perform the field multiplication operation on a
	* 64-bit value all at once rather than a byte at a time. This works by
	* creating a mask from the top bit in each byte and using that to
	* conditionally apply the XOR of 0x1d.
	*/
	#define VDEV_RAIDZ_64MUL_2(x, mask) \
	{ \
	(mask) = (x) & 0x8080808080808080ULL; \
	(mask) = ((mask) << 1) - ((mask) >> 7); \
	(x) = (((x) << 1) & 0xfefefefefefefefeULL) ^ \
	((mask) & 0x1d1d1d1d1d1d1d1dULL); \
	}

	#define VDEV_RAIDZ_64MUL_4(x, mask) \
	{ \
	VDEV_RAIDZ_64MUL_2((x), mask); \
	VDEV_RAIDZ_64MUL_2((x), mask); \
	}

	void
	vdev_raidz_map_free(raidz_map_t *rm)
	{
	int c;

	for (c = 0; c < rm->rm_firstdatacol; c++) {
	abd_free(rm->rm_col[c].rc_abd);

	if (rm->rm_col[c].rc_gdata != NULL)
	abd_free(rm->rm_col[c].rc_gdata);
	}

	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++)
	abd_put(rm->rm_col[c].rc_abd);

	if (rm->rm_abd_copy != NULL)
	abd_free(rm->rm_abd_copy);

	kmem_free(rm, offsetof(raidz_map_t, rm_col[rm->rm_scols]));
	}

	static void
	vdev_raidz_map_free_vsd(zio_t *zio)
	{
	raidz_map_t *rm = zio->io_vsd;

	ASSERT0(rm->rm_freed);
	rm->rm_freed = 1;

	if (rm->rm_reports == 0)
	vdev_raidz_map_free(rm);
	}

	/ARGSUSED/
	static void
	vdev_raidz_cksum_free(void *arg, size_t ignored)
	{
	raidz_map_t *rm = arg;

	ASSERT3U(rm->rm_reports, >, 0);

	if (--rm->rm_reports == 0 && rm->rm_freed != 0)
	vdev_raidz_map_free(rm);
	}

	static void
	vdev_raidz_cksum_finish(zio_cksum_report_t zcr, const abd_t good_data)
	{
	raidz_map_t *rm = zcr->zcr_cbdata;
	const size_t c = zcr->zcr_cbinfo;
	size_t x, offset;

	const abd_t *good = NULL;
	const abd_t *bad = rm->rm_col[c].rc_abd;

	if (good_data == NULL) {
	zfs_ereport_finish_checksum(zcr, NULL, NULL, B_FALSE);
	return;
	}

	if (c < rm->rm_firstdatacol) {
	/*
	* The first time through, calculate the parity blocks for
	* the good data (this relies on the fact that the good
	* data never changes for a given logical ZIO)
	*/
	if (rm->rm_col[0].rc_gdata == NULL) {
	abd_t *bad_parity[VDEV_RAIDZ_MAXPARITY];

	/*
	* Set up the rm_col[]s to generate the parity for
	* good_data, first saving the parity bufs and
	* replacing them with buffers to hold the result.
	*/
	for (x = 0; x < rm->rm_firstdatacol; x++) {
	bad_parity[x] = rm->rm_col[x].rc_abd;
	rm->rm_col[x].rc_abd =
	rm->rm_col[x].rc_gdata =
	abd_alloc_sametype(rm->rm_col[x].rc_abd,
	rm->rm_col[x].rc_size);
	}

	/* fill in the data columns from good_data */
	offset = 0;
	for (; x < rm->rm_cols; x++) {
	abd_put(rm->rm_col[x].rc_abd);

	rm->rm_col[x].rc_abd =
	abd_get_offset_size((abd_t *)good_data,
	offset, rm->rm_col[x].rc_size);
	offset += rm->rm_col[x].rc_size;
	}

	/*
	* Construct the parity from the good data.
	*/
	vdev_raidz_generate_parity(rm);

	/* restore everything back to its original state */
	for (x = 0; x < rm->rm_firstdatacol; x++)
	rm->rm_col[x].rc_abd = bad_parity[x];

	offset = 0;
	for (x = rm->rm_firstdatacol; x < rm->rm_cols; x++) {
	abd_put(rm->rm_col[x].rc_abd);
	rm->rm_col[x].rc_abd = abd_get_offset_size(
	rm->rm_abd_copy, offset,
	rm->rm_col[x].rc_size);
	offset += rm->rm_col[x].rc_size;
	}
	}

	ASSERT3P(rm->rm_col[c].rc_gdata, !=, NULL);
	good = abd_get_offset_size(rm->rm_col[c].rc_gdata, 0,
	rm->rm_col[c].rc_size);
	} else {
	/* adjust good_data to point at the start of our column */
	offset = 0;
	for (x = rm->rm_firstdatacol; x < c; x++)
	offset += rm->rm_col[x].rc_size;

	good = abd_get_offset_size((abd_t *)good_data, offset,
	rm->rm_col[c].rc_size);
	}

	/* we drop the ereport if it ends up that the data was good */
	zfs_ereport_finish_checksum(zcr, good, bad, B_TRUE);
	abd_put((abd_t *)good);
	}

	/*
	* Invoked indirectly by zfs_ereport_start_checksum(), called
	* below when our read operation fails completely. The main point
	* is to keep a copy of everything we read from disk, so that at
	* vdev_raidz_cksum_finish() time we can compare it with the good data.
	*/
	static void
	vdev_raidz_cksum_report(zio_t zio, zio_cksum_report_t zcr, void *arg)
	{
	size_t c = (size_t)(uintptr_t)arg;
	size_t offset;

	raidz_map_t *rm = zio->io_vsd;
	size_t size;

	/* set up the report and bump the refcount */
	zcr->zcr_cbdata = rm;
	zcr->zcr_cbinfo = c;
	zcr->zcr_finish = vdev_raidz_cksum_finish;
	zcr->zcr_free = vdev_raidz_cksum_free;

	rm->rm_reports++;
	ASSERT3U(rm->rm_reports, >, 0);

	if (rm->rm_abd_copy != NULL)
	return;

	/*
	* It's the first time we're called for this raidz_map_t, so we need
	* to copy the data aside; there's no guarantee that our zio's buffer
	* won't be re-used for something else.
	*
	* Our parity data is already in separate buffers, so there's no need
	* to copy them.
	*/

	size = 0;
	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++)
	size += rm->rm_col[c].rc_size;

	rm->rm_abd_copy = abd_alloc_for_io(size, B_FALSE);

	for (offset = 0, c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	raidz_col_t *col = &rm->rm_col[c];
	abd_t *tmp = abd_get_offset_size(rm->rm_abd_copy, offset,
	col->rc_size);

	abd_copy(tmp, col->rc_abd, col->rc_size);

	abd_put(col->rc_abd);
	col->rc_abd = tmp;

	offset += col->rc_size;
	}
	ASSERT3U(offset, ==, size);
	}

	static const zio_vsd_ops_t vdev_raidz_vsd_ops = {
	.vsd_free = vdev_raidz_map_free_vsd,
	.vsd_cksum_report = vdev_raidz_cksum_report
	};

	/*
	* Divides the IO evenly across all child vdevs; usually, dcols is
	* the number of children in the target vdev.
	*
	* Avoid inlining the function to keep vdev_raidz_io_start(), which
	* is this functions only caller, as small as possible on the stack.
	*/
	noinline raidz_map_t *
	vdev_raidz_map_alloc(zio_t *zio, uint64_t ashift, uint64_t dcols,
	uint64_t nparity)
	{
	raidz_map_t *rm;
	/* The starting RAIDZ (parent) vdev sector of the block. */
	uint64_t b = zio->io_offset >> ashift;
	/* The zio's size in units of the vdev's minimum sector size. */
	uint64_t s = zio->io_size >> ashift;
	/* The first column for this stripe. */
	uint64_t f = b % dcols;
	/* The starting byte offset on each child vdev. */
	uint64_t o = (b / dcols) << ashift;
	uint64_t q, r, c, bc, col, acols, scols, coff, devidx, asize, tot;
	uint64_t off = 0;

	/*
	* "Quotient": The number of data sectors for this stripe on all but
	* the "big column" child vdevs that also contain "remainder" data.
	*/
	q = s / (dcols - nparity);

	/*
	* "Remainder": The number of partial stripe data sectors in this I/O.
	* This will add a sector to some, but not all, child vdevs.
	*/
	r = s - q * (dcols - nparity);

	/* The number of "big columns" - those which contain remainder data. */
	bc = (r == 0 ? 0 : r + nparity);

	/*
	* The total number of data and parity sectors associated with
	* this I/O.
	*/
	tot = s + nparity * (q + (r == 0 ? 0 : 1));

	/* acols: The columns that will be accessed. */
	/* scols: The columns that will be accessed or skipped. */
	if (q == 0) {
	/* Our I/O request doesn't span all child vdevs. */
	acols = bc;
	scols = MIN(dcols, roundup(bc, nparity + 1));
	} else {
	acols = dcols;
	scols = dcols;
	}

	ASSERT3U(acols, <=, scols);

	rm = kmem_alloc(offsetof(raidz_map_t, rm_col[scols]), KM_SLEEP);

	rm->rm_cols = acols;
	rm->rm_scols = scols;
	rm->rm_bigcols = bc;
	rm->rm_skipstart = bc;
	rm->rm_missingdata = 0;
	rm->rm_missingparity = 0;
	rm->rm_firstdatacol = nparity;
	rm->rm_abd_copy = NULL;
	rm->rm_reports = 0;
	rm->rm_freed = 0;
	rm->rm_ecksuminjected = 0;

	asize = 0;

	for (c = 0; c < scols; c++) {
	col = f + c;
	coff = o;
	if (col >= dcols) {
	col -= dcols;
	coff += 1ULL << ashift;
	}
	rm->rm_col[c].rc_devidx = col;
	rm->rm_col[c].rc_offset = coff;
	rm->rm_col[c].rc_abd = NULL;
	rm->rm_col[c].rc_gdata = NULL;
	rm->rm_col[c].rc_error = 0;
	rm->rm_col[c].rc_tried = 0;
	rm->rm_col[c].rc_skipped = 0;

	if (c >= acols)
	rm->rm_col[c].rc_size = 0;
	else if (c < bc)
	rm->rm_col[c].rc_size = (q + 1) << ashift;
	else
	rm->rm_col[c].rc_size = q << ashift;

	asize += rm->rm_col[c].rc_size;
	}

	ASSERT3U(asize, ==, tot << ashift);
	rm->rm_asize = roundup(asize, (nparity + 1) << ashift);
	rm->rm_nskip = roundup(tot, nparity + 1) - tot;
	ASSERT3U(rm->rm_asize - asize, ==, rm->rm_nskip << ashift);
	ASSERT3U(rm->rm_nskip, <=, nparity);

	for (c = 0; c < rm->rm_firstdatacol; c++)
	rm->rm_col[c].rc_abd =
	abd_alloc_linear(rm->rm_col[c].rc_size, B_FALSE);

	rm->rm_col[c].rc_abd = abd_get_offset_size(zio->io_abd, 0,
	rm->rm_col[c].rc_size);
	off = rm->rm_col[c].rc_size;

	for (c = c + 1; c < acols; c++) {
	rm->rm_col[c].rc_abd = abd_get_offset_size(zio->io_abd, off,
	rm->rm_col[c].rc_size);
	off += rm->rm_col[c].rc_size;
	}

	/*
	* If all data stored spans all columns, there's a danger that parity
	* will always be on the same device and, since parity isn't read
	* during normal operation, that device's I/O bandwidth won't be
	* used effectively. We therefore switch the parity every 1MB.
	*
	* ... at least that was, ostensibly, the theory. As a practical
	* matter unless we juggle the parity between all devices evenly, we
	* won't see any benefit. Further, occasional writes that aren't a
	* multiple of the LCM of the number of children and the minimum
	* stripe width are sufficient to avoid pessimal behavior.
	* Unfortunately, this decision created an implicit on-disk format
	* requirement that we need to support for all eternity, but only
	* for single-parity RAID-Z.
	*
	* If we intend to skip a sector in the zeroth column for padding
	* we must make sure to note this swap. We will never intend to
	* skip the first column since at least one data and one parity
	* column must appear in each row.
	*/
	ASSERT(rm->rm_cols >= 2);
	ASSERT(rm->rm_col[0].rc_size == rm->rm_col[1].rc_size);

	if (rm->rm_firstdatacol == 1 && (zio->io_offset & (1ULL << 20))) {
	devidx = rm->rm_col[0].rc_devidx;
	o = rm->rm_col[0].rc_offset;
	rm->rm_col[0].rc_devidx = rm->rm_col[1].rc_devidx;
	rm->rm_col[0].rc_offset = rm->rm_col[1].rc_offset;
	rm->rm_col[1].rc_devidx = devidx;
	rm->rm_col[1].rc_offset = o;

	if (rm->rm_skipstart == 0)
	rm->rm_skipstart = 1;
	}

	zio->io_vsd = rm;
	zio->io_vsd_ops = &vdev_raidz_vsd_ops;

	/* init RAIDZ parity ops */
	rm->rm_ops = vdev_raidz_math_get_ops();

	return (rm);
	}

	struct pqr_struct {
	uint64_t *p;
	uint64_t *q;
	uint64_t *r;
	};

	static int
	vdev_raidz_p_func(void buf, size_t size, void private)
	{
	struct pqr_struct *pqr = private;
	const uint64_t *src = buf;
	int i, cnt = size / sizeof (src[0]);

	ASSERT(pqr->p && !pqr->q && !pqr->r);

	for (i = 0; i < cnt; i++, src++, pqr->p++)
	pqr->p ^= src;

	return (0);
	}

	static int
	vdev_raidz_pq_func(void buf, size_t size, void private)
	{
	struct pqr_struct *pqr = private;
	const uint64_t *src = buf;
	uint64_t mask;
	int i, cnt = size / sizeof (src[0]);

	ASSERT(pqr->p && pqr->q && !pqr->r);

	for (i = 0; i < cnt; i++, src++, pqr->p++, pqr->q++) {
	pqr->p ^= src;
	VDEV_RAIDZ_64MUL_2(*pqr->q, mask);
	pqr->q ^= src;
	}

	return (0);
	}

	static int
	vdev_raidz_pqr_func(void buf, size_t size, void private)
	{
	struct pqr_struct *pqr = private;
	const uint64_t *src = buf;
	uint64_t mask;
	int i, cnt = size / sizeof (src[0]);

	ASSERT(pqr->p && pqr->q && pqr->r);

	for (i = 0; i < cnt; i++, src++, pqr->p++, pqr->q++, pqr->r++) {
	pqr->p ^= src;
	VDEV_RAIDZ_64MUL_2(*pqr->q, mask);
	pqr->q ^= src;
	VDEV_RAIDZ_64MUL_4(*pqr->r, mask);
	pqr->r ^= src;
	}

	return (0);
	}

	static void
	vdev_raidz_generate_parity_p(raidz_map_t *rm)
	{
	uint64_t *p;
	int c;
	abd_t *src;

	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	src = rm->rm_col[c].rc_abd;
	p = abd_to_buf(rm->rm_col[VDEV_RAIDZ_P].rc_abd);

	if (c == rm->rm_firstdatacol) {
	abd_copy_to_buf(p, src, rm->rm_col[c].rc_size);
	} else {
	struct pqr_struct pqr = { p, NULL, NULL };
	(void) abd_iterate_func(src, 0, rm->rm_col[c].rc_size,
	vdev_raidz_p_func, &pqr);
	}
	}
	}

	static void
	vdev_raidz_generate_parity_pq(raidz_map_t *rm)
	{
	uint64_t p, q, pcnt, ccnt, mask, i;
	int c;
	abd_t *src;

	pcnt = rm->rm_col[VDEV_RAIDZ_P].rc_size / sizeof (p[0]);
	ASSERT(rm->rm_col[VDEV_RAIDZ_P].rc_size ==
	rm->rm_col[VDEV_RAIDZ_Q].rc_size);

	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	src = rm->rm_col[c].rc_abd;
	p = abd_to_buf(rm->rm_col[VDEV_RAIDZ_P].rc_abd);
	q = abd_to_buf(rm->rm_col[VDEV_RAIDZ_Q].rc_abd);

	ccnt = rm->rm_col[c].rc_size / sizeof (p[0]);

	if (c == rm->rm_firstdatacol) {
	ASSERT(ccnt == pcnt \|\| ccnt == 0);
	abd_copy_to_buf(p, src, rm->rm_col[c].rc_size);
	(void) memcpy(q, p, rm->rm_col[c].rc_size);

	for (i = ccnt; i < pcnt; i++) {
	p[i] = 0;
	q[i] = 0;
	}
	} else {
	struct pqr_struct pqr = { p, q, NULL };

	ASSERT(ccnt <= pcnt);
	(void) abd_iterate_func(src, 0, rm->rm_col[c].rc_size,
	vdev_raidz_pq_func, &pqr);

	/*
	* Treat short columns as though they are full of 0s.
	* Note that there's therefore nothing needed for P.
	*/
	for (i = ccnt; i < pcnt; i++) {
	VDEV_RAIDZ_64MUL_2(q[i], mask);
	}
	}
	}
	}

	static void
	vdev_raidz_generate_parity_pqr(raidz_map_t *rm)
	{
	uint64_t p, q, *r, pcnt, ccnt, mask, i;
	int c;
	abd_t *src;

	pcnt = rm->rm_col[VDEV_RAIDZ_P].rc_size / sizeof (p[0]);
	ASSERT(rm->rm_col[VDEV_RAIDZ_P].rc_size ==
	rm->rm_col[VDEV_RAIDZ_Q].rc_size);
	ASSERT(rm->rm_col[VDEV_RAIDZ_P].rc_size ==
	rm->rm_col[VDEV_RAIDZ_R].rc_size);

	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	src = rm->rm_col[c].rc_abd;
	p = abd_to_buf(rm->rm_col[VDEV_RAIDZ_P].rc_abd);
	q = abd_to_buf(rm->rm_col[VDEV_RAIDZ_Q].rc_abd);
	r = abd_to_buf(rm->rm_col[VDEV_RAIDZ_R].rc_abd);

	ccnt = rm->rm_col[c].rc_size / sizeof (p[0]);

	if (c == rm->rm_firstdatacol) {
	ASSERT(ccnt == pcnt \|\| ccnt == 0);
	abd_copy_to_buf(p, src, rm->rm_col[c].rc_size);
	(void) memcpy(q, p, rm->rm_col[c].rc_size);
	(void) memcpy(r, p, rm->rm_col[c].rc_size);

	for (i = ccnt; i < pcnt; i++) {
	p[i] = 0;
	q[i] = 0;
	r[i] = 0;
	}
	} else {
	struct pqr_struct pqr = { p, q, r };

	ASSERT(ccnt <= pcnt);
	(void) abd_iterate_func(src, 0, rm->rm_col[c].rc_size,
	vdev_raidz_pqr_func, &pqr);

	/*
	* Treat short columns as though they are full of 0s.
	* Note that there's therefore nothing needed for P.
	*/
	for (i = ccnt; i < pcnt; i++) {
	VDEV_RAIDZ_64MUL_2(q[i], mask);
	VDEV_RAIDZ_64MUL_4(r[i], mask);
	}
	}
	}
	}

	/*
	* Generate RAID parity in the first virtual columns according to the number of
	* parity columns available.
	*/
	void
	vdev_raidz_generate_parity(raidz_map_t *rm)
	{
	/* Generate using the new math implementation */
	if (vdev_raidz_math_generate(rm) != RAIDZ_ORIGINAL_IMPL)
	return;

	switch (rm->rm_firstdatacol) {
	case 1:
	vdev_raidz_generate_parity_p(rm);
	break;
	case 2:
	vdev_raidz_generate_parity_pq(rm);
	break;
	case 3:
	vdev_raidz_generate_parity_pqr(rm);
	break;
	default:
	cmn_err(CE_PANIC, "invalid RAID-Z configuration");
	}
	}

	/* ARGSUSED */
	static int
	vdev_raidz_reconst_p_func(void dbuf, void sbuf, size_t size, void *private)
	{
	uint64_t *dst = dbuf;
	uint64_t *src = sbuf;
	int cnt = size / sizeof (src[0]);

	for (int i = 0; i < cnt; i++) {
	dst[i] ^= src[i];
	}

	return (0);
	}

	/* ARGSUSED */
	static int
	vdev_raidz_reconst_q_pre_func(void dbuf, void sbuf, size_t size,
	void *private)
	{
	uint64_t *dst = dbuf;
	uint64_t *src = sbuf;
	uint64_t mask;
	int cnt = size / sizeof (dst[0]);

	for (int i = 0; i < cnt; i++, dst++, src++) {
	VDEV_RAIDZ_64MUL_2(*dst, mask);
	dst ^= src;
	}

	return (0);
	}

	/* ARGSUSED */
	static int
	vdev_raidz_reconst_q_pre_tail_func(void buf, size_t size, void private)
	{
	uint64_t *dst = buf;
	uint64_t mask;
	int cnt = size / sizeof (dst[0]);

	for (int i = 0; i < cnt; i++, dst++) {
	/* same operation as vdev_raidz_reconst_q_pre_func() on dst */
	VDEV_RAIDZ_64MUL_2(*dst, mask);
	}

	return (0);
	}

	struct reconst_q_struct {
	uint64_t *q;
	int exp;
	};

	static int
	vdev_raidz_reconst_q_post_func(void buf, size_t size, void private)
	{
	struct reconst_q_struct *rq = private;
	uint64_t *dst = buf;
	int cnt = size / sizeof (dst[0]);

	for (int i = 0; i < cnt; i++, dst++, rq->q++) {
	int j;
	uint8_t *b;

	dst ^= rq->q;
	for (j = 0, b = (uint8_t *)dst; j < 8; j++, b++) {
	b = vdev_raidz_exp2(b, rq->exp);
	}
	}

	return (0);
	}

	struct reconst_pq_struct {
	uint8_t *p;
	uint8_t *q;
	uint8_t *pxy;
	uint8_t *qxy;
	int aexp;
	int bexp;
	};

	static int
	vdev_raidz_reconst_pq_func(void xbuf, void ybuf, size_t size, void *private)
	{
	struct reconst_pq_struct *rpq = private;
	uint8_t *xd = xbuf;
	uint8_t *yd = ybuf;

	for (int i = 0; i < size;
	i++, rpq->p++, rpq->q++, rpq->pxy++, rpq->qxy++, xd++, yd++) {
	xd = vdev_raidz_exp2(rpq->p ^ *rpq->pxy, rpq->aexp) ^
	vdev_raidz_exp2(rpq->q ^ rpq->qxy, rpq->bexp);
	yd = rpq->p ^ rpq->pxy ^ xd;
	}

	return (0);
	}

	static int
	vdev_raidz_reconst_pq_tail_func(void xbuf, size_t size, void private)
	{
	struct reconst_pq_struct *rpq = private;
	uint8_t *xd = xbuf;

	for (int i = 0; i < size;
	i++, rpq->p++, rpq->q++, rpq->pxy++, rpq->qxy++, xd++) {
	/* same operation as vdev_raidz_reconst_pq_func() on xd */
	xd = vdev_raidz_exp2(rpq->p ^ *rpq->pxy, rpq->aexp) ^
	vdev_raidz_exp2(rpq->q ^ rpq->qxy, rpq->bexp);
	}

	return (0);
	}

	static int
	vdev_raidz_reconstruct_p(raidz_map_t rm, int tgts, int ntgts)
	{
	int x = tgts[0];
	int c;
	abd_t dst, src;

	ASSERT(ntgts == 1);
	ASSERT(x >= rm->rm_firstdatacol);
	ASSERT(x < rm->rm_cols);

	ASSERT(rm->rm_col[x].rc_size <= rm->rm_col[VDEV_RAIDZ_P].rc_size);
	ASSERT(rm->rm_col[x].rc_size > 0);

	src = rm->rm_col[VDEV_RAIDZ_P].rc_abd;
	dst = rm->rm_col[x].rc_abd;

	abd_copy_from_buf(dst, abd_to_buf(src), rm->rm_col[x].rc_size);

	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	uint64_t size = MIN(rm->rm_col[x].rc_size,
	rm->rm_col[c].rc_size);

	src = rm->rm_col[c].rc_abd;
	dst = rm->rm_col[x].rc_abd;

	if (c == x)
	continue;

	(void) abd_iterate_func2(dst, src, 0, 0, size,
	vdev_raidz_reconst_p_func, NULL);
	}

	return (1 << VDEV_RAIDZ_P);
	}

	static int
	vdev_raidz_reconstruct_q(raidz_map_t rm, int tgts, int ntgts)
	{
	int x = tgts[0];
	int c, exp;
	abd_t dst, src;

	ASSERT(ntgts == 1);

	ASSERT(rm->rm_col[x].rc_size <= rm->rm_col[VDEV_RAIDZ_Q].rc_size);

	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	uint64_t size = (c == x) ? 0 : MIN(rm->rm_col[x].rc_size,
	rm->rm_col[c].rc_size);

	src = rm->rm_col[c].rc_abd;
	dst = rm->rm_col[x].rc_abd;

	if (c == rm->rm_firstdatacol) {
	abd_copy(dst, src, size);
	if (rm->rm_col[x].rc_size > size)
	abd_zero_off(dst, size,
	rm->rm_col[x].rc_size - size);

	} else {
	ASSERT3U(size, <=, rm->rm_col[x].rc_size);
	(void) abd_iterate_func2(dst, src, 0, 0, size,
	vdev_raidz_reconst_q_pre_func, NULL);
	(void) abd_iterate_func(dst,
	size, rm->rm_col[x].rc_size - size,
	vdev_raidz_reconst_q_pre_tail_func, NULL);
	}
	}

	src = rm->rm_col[VDEV_RAIDZ_Q].rc_abd;
	dst = rm->rm_col[x].rc_abd;
	exp = 255 - (rm->rm_cols - 1 - x);

	struct reconst_q_struct rq = { abd_to_buf(src), exp };
	(void) abd_iterate_func(dst, 0, rm->rm_col[x].rc_size,
	vdev_raidz_reconst_q_post_func, &rq);

	return (1 << VDEV_RAIDZ_Q);
	}

	static int
	vdev_raidz_reconstruct_pq(raidz_map_t rm, int tgts, int ntgts)
	{
	uint8_t p, q, pxy, qxy, tmp, a, b, aexp, bexp;
	abd_t pdata, qdata;
	uint64_t xsize, ysize;
	int x = tgts[0];
	int y = tgts[1];
	abd_t xd, yd;

	ASSERT(ntgts == 2);
	ASSERT(x < y);
	ASSERT(x >= rm->rm_firstdatacol);
	ASSERT(y < rm->rm_cols);

	ASSERT(rm->rm_col[x].rc_size >= rm->rm_col[y].rc_size);

	/*
	* Move the parity data aside -- we're going to compute parity as
	* though columns x and y were full of zeros -- Pxy and Qxy. We want to
	* reuse the parity generation mechanism without trashing the actual
	* parity so we make those columns appear to be full of zeros by
	* setting their lengths to zero.
	*/
	pdata = rm->rm_col[VDEV_RAIDZ_P].rc_abd;
	qdata = rm->rm_col[VDEV_RAIDZ_Q].rc_abd;
	xsize = rm->rm_col[x].rc_size;
	ysize = rm->rm_col[y].rc_size;

	rm->rm_col[VDEV_RAIDZ_P].rc_abd =
	abd_alloc_linear(rm->rm_col[VDEV_RAIDZ_P].rc_size, B_TRUE);
	rm->rm_col[VDEV_RAIDZ_Q].rc_abd =
	abd_alloc_linear(rm->rm_col[VDEV_RAIDZ_Q].rc_size, B_TRUE);
	rm->rm_col[x].rc_size = 0;
	rm->rm_col[y].rc_size = 0;

	vdev_raidz_generate_parity_pq(rm);

	rm->rm_col[x].rc_size = xsize;
	rm->rm_col[y].rc_size = ysize;

	p = abd_to_buf(pdata);
	q = abd_to_buf(qdata);
	pxy = abd_to_buf(rm->rm_col[VDEV_RAIDZ_P].rc_abd);
	qxy = abd_to_buf(rm->rm_col[VDEV_RAIDZ_Q].rc_abd);
	xd = rm->rm_col[x].rc_abd;
	yd = rm->rm_col[y].rc_abd;

	/*
	* We now have:
	* Pxy = P + D_x + D_y
	* Qxy = Q + 2^(ndevs - 1 - x) * D_x + 2^(ndevs - 1 - y) * D_y
	*
	* We can then solve for D_x:
	* D_x = A * (P + Pxy) + B * (Q + Qxy)
	* where
	* A = 2^(x - y) * (2^(x - y) + 1)^-1
	* B = 2^(ndevs - 1 - x) * (2^(x - y) + 1)^-1
	*
	* With D_x in hand, we can easily solve for D_y:
	* D_y = P + Pxy + D_x
	*/

	a = vdev_raidz_pow2[255 + x - y];
	b = vdev_raidz_pow2[255 - (rm->rm_cols - 1 - x)];
	tmp = 255 - vdev_raidz_log2[a ^ 1];

	aexp = vdev_raidz_log2[vdev_raidz_exp2(a, tmp)];
	bexp = vdev_raidz_log2[vdev_raidz_exp2(b, tmp)];

	ASSERT3U(xsize, >=, ysize);
	struct reconst_pq_struct rpq = { p, q, pxy, qxy, aexp, bexp };

	(void) abd_iterate_func2(xd, yd, 0, 0, ysize,
	vdev_raidz_reconst_pq_func, &rpq);
	(void) abd_iterate_func(xd, ysize, xsize - ysize,
	vdev_raidz_reconst_pq_tail_func, &rpq);

	abd_free(rm->rm_col[VDEV_RAIDZ_P].rc_abd);
	abd_free(rm->rm_col[VDEV_RAIDZ_Q].rc_abd);

	/*
	* Restore the saved parity data.
	*/
	rm->rm_col[VDEV_RAIDZ_P].rc_abd = pdata;
	rm->rm_col[VDEV_RAIDZ_Q].rc_abd = qdata;

	return ((1 << VDEV_RAIDZ_P) \| (1 << VDEV_RAIDZ_Q));
	}

	/* BEGIN CSTYLED */
	/*
	* In the general case of reconstruction, we must solve the system of linear
	* equations defined by the coefficients used to generate parity as well as
	* the contents of the data and parity disks. This can be expressed with
	* vectors for the original data (D) and the actual data (d) and parity (p)
	* and a matrix composed of the identity matrix (I) and a dispersal matrix (V):
	*
	* __ __ __ __
	* \| \| __ __ \| p_0 \|
	* \| V \| \| D_0 \| \| p_m-1 \|
	* \| \| x \| : \| = \| d_0 \|
	* \| I \| \| D_n-1 \| \| : \|
	* \| \| ~~ ~~ \| d_n-1 \|
	* ~~ ~~ ~~ ~~
	*
	* I is simply a square identity matrix of size n, and V is a vandermonde
	* matrix defined by the coefficients we chose for the various parity columns
	* (1, 2, 4). Note that these values were chosen both for simplicity, speedy
	* computation as well as linear separability.
	*
	* __ __ __ __
	* \| 1 .. 1 1 1 \| \| p_0 \|
	* \| 2^n-1 .. 4 2 1 \| __ __ \| : \|
	* \| 4^n-1 .. 16 4 1 \| \| D_0 \| \| p_m-1 \|
	* \| 1 .. 0 0 0 \| \| D_1 \| \| d_0 \|
	* \| 0 .. 0 0 0 \| x \| D_2 \| = \| d_1 \|
	* \| : : : : \| \| : \| \| d_2 \|
	* \| 0 .. 1 0 0 \| \| D_n-1 \| \| : \|
	* \| 0 .. 0 1 0 \| ~~ ~~ \| : \|
	* \| 0 .. 0 0 1 \| \| d_n-1 \|
	* ~~ ~~ ~~ ~~
	*
	* Note that I, V, d, and p are known. To compute D, we must invert the
	* matrix and use the known data and parity values to reconstruct the unknown
	* data values. We begin by removing the rows in V\|I and d\|p that correspond
	* to failed or missing columns; we then make V\|I square (n x n) and d\|p
	* sized n by removing rows corresponding to unused parity from the bottom up
	* to generate (V\|I)' and (d\|p)'. We can then generate the inverse of (V\|I)'
	* using Gauss-Jordan elimination. In the example below we use m=3 parity
	* columns, n=8 data columns, with errors in d_1, d_2, and p_1:
	* __ __
	* \| 1 1 1 1 1 1 1 1 \|
	* \| 128 64 32 16 8 4 2 1 \| <-----+-+-- missing disks
	* \| 19 205 116 29 64 16 4 1 \| / /
	* \| 1 0 0 0 0 0 0 0 \| / /
	* \| 0 1 0 0 0 0 0 0 \| <--' /
	* (V\|I) = \| 0 0 1 0 0 0 0 0 \| <---'
	* \| 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	* __ __
	* \| 1 1 1 1 1 1 1 1 \|
	* \| 128 64 32 16 8 4 2 1 \|
	* \| 19 205 116 29 64 16 4 1 \|
	* \| 1 0 0 0 0 0 0 0 \|
	* \| 0 1 0 0 0 0 0 0 \|
	* (V\|I)' = \| 0 0 1 0 0 0 0 0 \|
	* \| 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	*
	* Here we employ Gauss-Jordan elimination to find the inverse of (V\|I)'. We
	* have carefully chosen the seed values 1, 2, and 4 to ensure that this
	* matrix is not singular.
	* __ __
	* \| 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 \|
	* \| 19 205 116 29 64 16 4 1 0 1 0 0 0 0 0 0 \|
	* \| 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 \|
	* \| 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	* __ __
	* \| 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 \|
	* \| 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 \|
	* \| 19 205 116 29 64 16 4 1 0 1 0 0 0 0 0 0 \|
	* \| 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	* __ __
	* \| 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 \|
	* \| 0 1 1 0 0 0 0 0 1 0 1 1 1 1 1 1 \|
	* \| 0 205 116 0 0 0 0 0 0 1 19 29 64 16 4 1 \|
	* \| 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	* __ __
	* \| 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 \|
	* \| 0 1 1 0 0 0 0 0 1 0 1 1 1 1 1 1 \|
	* \| 0 0 185 0 0 0 0 0 205 1 222 208 141 221 201 204 \|
	* \| 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	* __ __
	* \| 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 \|
	* \| 0 1 1 0 0 0 0 0 1 0 1 1 1 1 1 1 \|
	* \| 0 0 1 0 0 0 0 0 166 100 4 40 158 168 216 209 \|
	* \| 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	* __ __
	* \| 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 \|
	* \| 0 1 0 0 0 0 0 0 167 100 5 41 159 169 217 208 \|
	* \| 0 0 1 0 0 0 0 0 166 100 4 40 158 168 216 209 \|
	* \| 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	* __ __
	* \| 0 0 1 0 0 0 0 0 \|
	* \| 167 100 5 41 159 169 217 208 \|
	* \| 166 100 4 40 158 168 216 209 \|
	* (V\|I)'^-1 = \| 0 0 0 1 0 0 0 0 \|
	* \| 0 0 0 0 1 0 0 0 \|
	* \| 0 0 0 0 0 1 0 0 \|
	* \| 0 0 0 0 0 0 1 0 \|
	* \| 0 0 0 0 0 0 0 1 \|
	* ~~ ~~
	*
	* We can then simply compute D = (V\|I)'^-1 x (d\|p)' to discover the values
	* of the missing data.
	*
	* As is apparent from the example above, the only non-trivial rows in the
	* inverse matrix correspond to the data disks that we're trying to
	* reconstruct. Indeed, those are the only rows we need as the others would
	* only be useful for reconstructing data known or assumed to be valid. For
	* that reason, we only build the coefficients in the rows that correspond to
	* targeted columns.
	*/
	/* END CSTYLED */

	static void
	vdev_raidz_matrix_init(raidz_map_t rm, int n, int nmap, int map,
	uint8_t **rows)
	{
	int i, j;
	int pow;

	ASSERT(n == rm->rm_cols - rm->rm_firstdatacol);

	/*
	* Fill in the missing rows of interest.
	*/
	for (i = 0; i < nmap; i++) {
	ASSERT3S(0, <=, map[i]);
	ASSERT3S(map[i], <=, 2);

	pow = map[i] * n;
	if (pow > 255)
	pow -= 255;
	ASSERT(pow <= 255);

	for (j = 0; j < n; j++) {
	pow -= map[i];
	if (pow < 0)
	pow += 255;
	rows[i][j] = vdev_raidz_pow2[pow];
	}
	}
	}

	static void
	vdev_raidz_matrix_invert(raidz_map_t rm, int n, int nmissing, int missing,
	uint8_t rows, uint8_t invrows, const uint8_t *used)
	{
	int i, j, ii, jj;
	uint8_t log;

	/*
	* Assert that the first nmissing entries from the array of used
	* columns correspond to parity columns and that subsequent entries
	* correspond to data columns.
	*/
	for (i = 0; i < nmissing; i++) {
	ASSERT3S(used[i], <, rm->rm_firstdatacol);
	}
	for (; i < n; i++) {
	ASSERT3S(used[i], >=, rm->rm_firstdatacol);
	}

	/*
	* First initialize the storage where we'll compute the inverse rows.
	*/
	for (i = 0; i < nmissing; i++) {
	for (j = 0; j < n; j++) {
	invrows[i][j] = (i == j) ? 1 : 0;
	}
	}

	/*
	* Subtract all trivial rows from the rows of consequence.
	*/
	for (i = 0; i < nmissing; i++) {
	for (j = nmissing; j < n; j++) {
	ASSERT3U(used[j], >=, rm->rm_firstdatacol);
	jj = used[j] - rm->rm_firstdatacol;
	ASSERT3S(jj, <, n);
	invrows[i][j] = rows[i][jj];
	rows[i][jj] = 0;
	}
	}

	/*
	* For each of the rows of interest, we must normalize it and subtract
	* a multiple of it from the other rows.
	*/
	for (i = 0; i < nmissing; i++) {
	for (j = 0; j < missing[i]; j++) {
	ASSERT0(rows[i][j]);
	}
	ASSERT3U(rows[i][missing[i]], !=, 0);

	/*
	* Compute the inverse of the first element and multiply each
	* element in the row by that value.
	*/
	log = 255 - vdev_raidz_log2[rows[i][missing[i]]];

	for (j = 0; j < n; j++) {
	rows[i][j] = vdev_raidz_exp2(rows[i][j], log);
	invrows[i][j] = vdev_raidz_exp2(invrows[i][j], log);
	}

	for (ii = 0; ii < nmissing; ii++) {
	if (i == ii)
	continue;

	ASSERT3U(rows[ii][missing[i]], !=, 0);

	log = vdev_raidz_log2[rows[ii][missing[i]]];

	for (j = 0; j < n; j++) {
	rows[ii][j] ^=
	vdev_raidz_exp2(rows[i][j], log);
	invrows[ii][j] ^=
	vdev_raidz_exp2(invrows[i][j], log);
	}
	}
	}

	/*
	* Verify that the data that is left in the rows are properly part of
	* an identity matrix.
	*/
	for (i = 0; i < nmissing; i++) {
	for (j = 0; j < n; j++) {
	if (j == missing[i]) {
	ASSERT3U(rows[i][j], ==, 1);
	} else {
	ASSERT0(rows[i][j]);
	}
	}
	}
	}

	static void
	vdev_raidz_matrix_reconstruct(raidz_map_t *rm, int n, int nmissing,
	int missing, uint8_t invrows, const uint8_t used)
	{
	int i, j, x, cc, c;
	uint8_t *src;
	uint64_t ccount;
	uint8_t *dst[VDEV_RAIDZ_MAXPARITY] = { NULL };
	uint64_t dcount[VDEV_RAIDZ_MAXPARITY] = { 0 };
	uint8_t log = 0;
	uint8_t val;
	int ll;
	uint8_t *invlog[VDEV_RAIDZ_MAXPARITY];
	uint8_t p, pp;
	size_t psize;

	psize = sizeof (invlog[0][0]) * n * nmissing;
	p = kmem_alloc(psize, KM_SLEEP);

	for (pp = p, i = 0; i < nmissing; i++) {
	invlog[i] = pp;
	pp += n;
	}

	for (i = 0; i < nmissing; i++) {
	for (j = 0; j < n; j++) {
	ASSERT3U(invrows[i][j], !=, 0);
	invlog[i][j] = vdev_raidz_log2[invrows[i][j]];
	}
	}

	for (i = 0; i < n; i++) {
	c = used[i];
	ASSERT3U(c, <, rm->rm_cols);

	src = abd_to_buf(rm->rm_col[c].rc_abd);
	ccount = rm->rm_col[c].rc_size;
	for (j = 0; j < nmissing; j++) {
	cc = missing[j] + rm->rm_firstdatacol;
	ASSERT3U(cc, >=, rm->rm_firstdatacol);
	ASSERT3U(cc, <, rm->rm_cols);
	ASSERT3U(cc, !=, c);

	dst[j] = abd_to_buf(rm->rm_col[cc].rc_abd);
	dcount[j] = rm->rm_col[cc].rc_size;
	}

	ASSERT(ccount >= rm->rm_col[missing[0]].rc_size \|\| i > 0);

	for (x = 0; x < ccount; x++, src++) {
	if (*src != 0)
	log = vdev_raidz_log2[*src];

	for (cc = 0; cc < nmissing; cc++) {
	if (x >= dcount[cc])
	continue;

	if (*src == 0) {
	val = 0;
	} else {
	if ((ll = log + invlog[cc][i]) >= 255)
	ll -= 255;
	val = vdev_raidz_pow2[ll];
	}

	if (i == 0)
	dst[cc][x] = val;
	else
	dst[cc][x] ^= val;
	}
	}
	}

	kmem_free(p, psize);
	}

	static int
	vdev_raidz_reconstruct_general(raidz_map_t rm, int tgts, int ntgts)
	{
	int n, i, c, t, tt;
	int nmissing_rows;
	int missing_rows[VDEV_RAIDZ_MAXPARITY];
	int parity_map[VDEV_RAIDZ_MAXPARITY];

	uint8_t p, pp;
	size_t psize;

	uint8_t *rows[VDEV_RAIDZ_MAXPARITY];
	uint8_t *invrows[VDEV_RAIDZ_MAXPARITY];
	uint8_t *used;

	abd_t **bufs = NULL;

	int code = 0;

	/*
	* Matrix reconstruction can't use scatter ABDs yet, so we allocate
	* temporary linear ABDs.
	*/
	if (!abd_is_linear(rm->rm_col[rm->rm_firstdatacol].rc_abd)) {
	bufs = kmem_alloc(rm->rm_cols * sizeof (abd_t *), KM_PUSHPAGE);

	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	raidz_col_t *col = &rm->rm_col[c];

	bufs[c] = col->rc_abd;
	col->rc_abd = abd_alloc_linear(col->rc_size, B_TRUE);
	abd_copy(col->rc_abd, bufs[c], col->rc_size);
	}
	}

	n = rm->rm_cols - rm->rm_firstdatacol;

	/*
	* Figure out which data columns are missing.
	*/
	nmissing_rows = 0;
	for (t = 0; t < ntgts; t++) {
	if (tgts[t] >= rm->rm_firstdatacol) {
	missing_rows[nmissing_rows++] =
	tgts[t] - rm->rm_firstdatacol;
	}
	}

	/*
	* Figure out which parity columns to use to help generate the missing
	* data columns.
	*/
	for (tt = 0, c = 0, i = 0; i < nmissing_rows; c++) {
	ASSERT(tt < ntgts);
	ASSERT(c < rm->rm_firstdatacol);

	/*
	* Skip any targeted parity columns.
	*/
	if (c == tgts[tt]) {
	tt++;
	continue;
	}

	code \|= 1 << c;

	parity_map[i] = c;
	i++;
	}

	ASSERT(code != 0);
	ASSERT3U(code, <, 1 << VDEV_RAIDZ_MAXPARITY);

	psize = (sizeof (rows[0][0]) + sizeof (invrows[0][0])) *
	nmissing_rows * n + sizeof (used[0]) * n;
	p = kmem_alloc(psize, KM_SLEEP);

	for (pp = p, i = 0; i < nmissing_rows; i++) {
	rows[i] = pp;
	pp += n;
	invrows[i] = pp;
	pp += n;
	}
	used = pp;

	for (i = 0; i < nmissing_rows; i++) {
	used[i] = parity_map[i];
	}

	for (tt = 0, c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	if (tt < nmissing_rows &&
	c == missing_rows[tt] + rm->rm_firstdatacol) {
	tt++;
	continue;
	}

	ASSERT3S(i, <, n);
	used[i] = c;
	i++;
	}

	/*
	* Initialize the interesting rows of the matrix.
	*/
	vdev_raidz_matrix_init(rm, n, nmissing_rows, parity_map, rows);

	/*
	* Invert the matrix.
	*/
	vdev_raidz_matrix_invert(rm, n, nmissing_rows, missing_rows, rows,
	invrows, used);

	/*
	* Reconstruct the missing data using the generated matrix.
	*/
	vdev_raidz_matrix_reconstruct(rm, n, nmissing_rows, missing_rows,
	invrows, used);

	kmem_free(p, psize);

	/*
	* copy back from temporary linear abds and free them
	*/
	if (bufs) {
	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	raidz_col_t *col = &rm->rm_col[c];

	abd_copy(bufs[c], col->rc_abd, col->rc_size);
	abd_free(col->rc_abd);
	col->rc_abd = bufs[c];
	}
	kmem_free(bufs, rm->rm_cols * sizeof (abd_t *));
	}

	return (code);
	}

	int
	vdev_raidz_reconstruct(raidz_map_t rm, const int t, int nt)
	{
	int tgts[VDEV_RAIDZ_MAXPARITY], *dt;
	int ntgts;
	int i, c, ret;
	int code;
	int nbadparity, nbaddata;
	int parity_valid[VDEV_RAIDZ_MAXPARITY];

	/*
	* The tgts list must already be sorted.
	*/
	for (i = 1; i < nt; i++) {
	ASSERT(t[i] > t[i - 1]);
	}

	nbadparity = rm->rm_firstdatacol;
	nbaddata = rm->rm_cols - nbadparity;
	ntgts = 0;
	for (i = 0, c = 0; c < rm->rm_cols; c++) {
	if (c < rm->rm_firstdatacol)
	parity_valid[c] = B_FALSE;

	if (i < nt && c == t[i]) {
	tgts[ntgts++] = c;
	i++;
	} else if (rm->rm_col[c].rc_error != 0) {
	tgts[ntgts++] = c;
	} else if (c >= rm->rm_firstdatacol) {
	nbaddata--;
	} else {
	parity_valid[c] = B_TRUE;
	nbadparity--;
	}
	}

	ASSERT(ntgts >= nt);
	ASSERT(nbaddata >= 0);
	ASSERT(nbaddata + nbadparity == ntgts);

	dt = &tgts[nbadparity];

	/* Reconstruct using the new math implementation */
	ret = vdev_raidz_math_reconstruct(rm, parity_valid, dt, nbaddata);
	if (ret != RAIDZ_ORIGINAL_IMPL)
	return (ret);

	/*
	* See if we can use any of our optimized reconstruction routines.
	*/
	switch (nbaddata) {
	case 1:
	if (parity_valid[VDEV_RAIDZ_P])
	return (vdev_raidz_reconstruct_p(rm, dt, 1));

	ASSERT(rm->rm_firstdatacol > 1);

	if (parity_valid[VDEV_RAIDZ_Q])
	return (vdev_raidz_reconstruct_q(rm, dt, 1));

	ASSERT(rm->rm_firstdatacol > 2);
	break;

	case 2:
	ASSERT(rm->rm_firstdatacol > 1);

	if (parity_valid[VDEV_RAIDZ_P] &&
	parity_valid[VDEV_RAIDZ_Q])
	return (vdev_raidz_reconstruct_pq(rm, dt, 2));

	ASSERT(rm->rm_firstdatacol > 2);

	break;
	}

	code = vdev_raidz_reconstruct_general(rm, tgts, ntgts);
	ASSERT(code < (1 << VDEV_RAIDZ_MAXPARITY));
	ASSERT(code > 0);
	return (code);
	}

	static int
	vdev_raidz_open(vdev_t vd, uint64_t asize, uint64_t *max_asize,
	uint64_t logical_ashift, uint64_t physical_ashift)
	{
	vdev_t *cvd;
	uint64_t nparity = vd->vdev_nparity;
	int c;
	int lasterror = 0;
	int numerrors = 0;

	ASSERT(nparity > 0);

	if (nparity > VDEV_RAIDZ_MAXPARITY \|\|
	vd->vdev_children < nparity + 1) {
	vd->vdev_stat.vs_aux = VDEV_AUX_BAD_LABEL;
	return (SET_ERROR(EINVAL));
	}

	vdev_open_children(vd);

	for (c = 0; c < vd->vdev_children; c++) {
	cvd = vd->vdev_child[c];

	if (cvd->vdev_open_error != 0) {
	lasterror = cvd->vdev_open_error;
	numerrors++;
	continue;
	}

	asize = MIN(asize - 1, cvd->vdev_asize - 1) + 1;
	max_asize = MIN(max_asize - 1, cvd->vdev_max_asize - 1) + 1;
	logical_ashift = MAX(logical_ashift, cvd->vdev_ashift);
	physical_ashift = MAX(physical_ashift,
	cvd->vdev_physical_ashift);
	}

	asize = vd->vdev_children;
	max_asize = vd->vdev_children;

	if (numerrors > nparity) {
	vd->vdev_stat.vs_aux = VDEV_AUX_NO_REPLICAS;
	return (lasterror);
	}

	return (0);
	}

	static void
	vdev_raidz_close(vdev_t *vd)
	{
	int c;

	for (c = 0; c < vd->vdev_children; c++)
	vdev_close(vd->vdev_child[c]);
	}

	static uint64_t
	vdev_raidz_asize(vdev_t *vd, uint64_t psize)
	{
	uint64_t asize;
	uint64_t ashift = vd->vdev_top->vdev_ashift;
	uint64_t cols = vd->vdev_children;
	uint64_t nparity = vd->vdev_nparity;

	asize = ((psize - 1) >> ashift) + 1;
	asize += nparity * ((asize + cols - nparity - 1) / (cols - nparity));
	asize = roundup(asize, nparity + 1) << ashift;

	return (asize);
	}

	static void
	vdev_raidz_child_done(zio_t *zio)
	{
	raidz_col_t *rc = zio->io_private;

	rc->rc_error = zio->io_error;
	rc->rc_tried = 1;
	rc->rc_skipped = 0;
	}

	static void
	vdev_raidz_io_verify(zio_t zio, raidz_map_t rm, int col)
	{
	#ifdef ZFS_DEBUG
	vdev_t *vd = zio->io_vd;
	vdev_t *tvd = vd->vdev_top;

	range_seg64_t logical_rs, physical_rs;
	logical_rs.rs_start = zio->io_offset;
	logical_rs.rs_end = logical_rs.rs_start +
	vdev_raidz_asize(zio->io_vd, zio->io_size);

	raidz_col_t *rc = &rm->rm_col[col];
	vdev_t *cvd = vd->vdev_child[rc->rc_devidx];

	vdev_xlate(cvd, &logical_rs, &physical_rs);
	ASSERT3U(rc->rc_offset, ==, physical_rs.rs_start);
	ASSERT3U(rc->rc_offset, <, physical_rs.rs_end);
	/*
	* It would be nice to assert that rs_end is equal
	* to rc_offset + rc_size but there might be an
	* optional I/O at the end that is not accounted in
	* rc_size.
	*/
	if (physical_rs.rs_end > rc->rc_offset + rc->rc_size) {
	ASSERT3U(physical_rs.rs_end, ==, rc->rc_offset +
	rc->rc_size + (1 << tvd->vdev_ashift));
	} else {
	ASSERT3U(physical_rs.rs_end, ==, rc->rc_offset + rc->rc_size);
	}
	#endif
	}

	/*
	* Start an IO operation on a RAIDZ VDev
	*
	* Outline:
	* - For write operations:
	* 1. Generate the parity data
	* 2. Create child zio write operations to each column's vdev, for both
	* data and parity.
	* 3. If the column skips any sectors for padding, create optional dummy
	* write zio children for those areas to improve aggregation continuity.
	* - For read operations:
	* 1. Create child zio read operations to each data column's vdev to read
	* the range of data required for zio.
	* 2. If this is a scrub or resilver operation, or if any of the data
	* vdevs have had errors, then create zio read operations to the parity
	* columns' VDevs as well.
	*/
	static void
	vdev_raidz_io_start(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;
	vdev_t *tvd = vd->vdev_top;
	vdev_t *cvd;
	raidz_map_t *rm;
	raidz_col_t *rc;
	int c, i;

	rm = vdev_raidz_map_alloc(zio, tvd->vdev_ashift, vd->vdev_children,
	vd->vdev_nparity);

	ASSERT3U(rm->rm_asize, ==, vdev_psize_to_asize(vd, zio->io_size));

	if (zio->io_type == ZIO_TYPE_WRITE) {
	vdev_raidz_generate_parity(rm);

	for (c = 0; c < rm->rm_cols; c++) {
	rc = &rm->rm_col[c];
	cvd = vd->vdev_child[rc->rc_devidx];

	/*
	* Verify physical to logical translation.
	*/
	vdev_raidz_io_verify(zio, rm, c);

	zio_nowait(zio_vdev_child_io(zio, NULL, cvd,
	rc->rc_offset, rc->rc_abd, rc->rc_size,
	zio->io_type, zio->io_priority, 0,
	vdev_raidz_child_done, rc));
	}

	/*
	* Generate optional I/Os for any skipped sectors to improve
	* aggregation contiguity.
	*/
	for (c = rm->rm_skipstart, i = 0; i < rm->rm_nskip; c++, i++) {
	ASSERT(c <= rm->rm_scols);
	if (c == rm->rm_scols)
	c = 0;
	rc = &rm->rm_col[c];
	cvd = vd->vdev_child[rc->rc_devidx];
	zio_nowait(zio_vdev_child_io(zio, NULL, cvd,
	rc->rc_offset + rc->rc_size, NULL,
	1 << tvd->vdev_ashift,
	zio->io_type, zio->io_priority,
	ZIO_FLAG_NODATA \| ZIO_FLAG_OPTIONAL, NULL, NULL));
	}

	zio_execute(zio);
	return;
	}

	ASSERT(zio->io_type == ZIO_TYPE_READ);

	/*
	* Iterate over the columns in reverse order so that we hit the parity
	* last -- any errors along the way will force us to read the parity.
	*/
	for (c = rm->rm_cols - 1; c >= 0; c--) {
	rc = &rm->rm_col[c];
	cvd = vd->vdev_child[rc->rc_devidx];
	if (!vdev_readable(cvd)) {
	if (c >= rm->rm_firstdatacol)
	rm->rm_missingdata++;
	else
	rm->rm_missingparity++;
	rc->rc_error = SET_ERROR(ENXIO);
	rc->rc_tried = 1; /* don't even try */
	rc->rc_skipped = 1;
	continue;
	}
	if (vdev_dtl_contains(cvd, DTL_MISSING, zio->io_txg, 1)) {
	if (c >= rm->rm_firstdatacol)
	rm->rm_missingdata++;
	else
	rm->rm_missingparity++;
	rc->rc_error = SET_ERROR(ESTALE);
	rc->rc_skipped = 1;
	continue;
	}
	if (c >= rm->rm_firstdatacol \|\| rm->rm_missingdata > 0 \|\|
	(zio->io_flags & (ZIO_FLAG_SCRUB \| ZIO_FLAG_RESILVER))) {
	zio_nowait(zio_vdev_child_io(zio, NULL, cvd,
	rc->rc_offset, rc->rc_abd, rc->rc_size,
	zio->io_type, zio->io_priority, 0,
	vdev_raidz_child_done, rc));
	}
	}

	zio_execute(zio);
	}


	/*
	* Report a checksum error for a child of a RAID-Z device.
	*/
	static void
	raidz_checksum_error(zio_t zio, raidz_col_t rc, abd_t *bad_data)
	{
	vdev_t *vd = zio->io_vd->vdev_child[rc->rc_devidx];

	if (!(zio->io_flags & ZIO_FLAG_SPECULATIVE)) {
	zio_bad_cksum_t zbc;
	raidz_map_t *rm = zio->io_vsd;

	- mutex_enter(&vd->vdev_stat_lock);
	- vd->vdev_stat.vs_checksum_errors++;
	- mutex_exit(&vd->vdev_stat_lock);
	-
	zbc.zbc_has_cksum = 0;
	zbc.zbc_injected = rm->rm_ecksuminjected;

	- (void) zfs_ereport_post_checksum(zio->io_spa, vd,
	+ int ret = zfs_ereport_post_checksum(zio->io_spa, vd,
	&zio->io_bookmark, zio, rc->rc_offset, rc->rc_size,
	rc->rc_abd, bad_data, &zbc);
	+ if (ret != EALREADY) {
	+ mutex_enter(&vd->vdev_stat_lock);
	+ vd->vdev_stat.vs_checksum_errors++;
	+ mutex_exit(&vd->vdev_stat_lock);
	+ }
	}
	}

	/*
	* We keep track of whether or not there were any injected errors, so that
	* any ereports we generate can note it.
	*/
	static int
	raidz_checksum_verify(zio_t *zio)
	{
	zio_bad_cksum_t zbc;
	raidz_map_t *rm = zio->io_vsd;

	bzero(&zbc, sizeof (zio_bad_cksum_t));

	int ret = zio_checksum_error(zio, &zbc);
	if (ret != 0 && zbc.zbc_injected != 0)
	rm->rm_ecksuminjected = 1;

	return (ret);
	}

	/*
	* Generate the parity from the data columns. If we tried and were able to
	* read the parity without error, verify that the generated parity matches the
	* data we read. If it doesn't, we fire off a checksum error. Return the
	* number such failures.
	*/
	static int
	raidz_parity_verify(zio_t zio, raidz_map_t rm)
	{
	abd_t *orig[VDEV_RAIDZ_MAXPARITY];
	int c, ret = 0;
	raidz_col_t *rc;

	blkptr_t *bp = zio->io_bp;
	enum zio_checksum checksum = (bp == NULL ? zio->io_prop.zp_checksum :
	(BP_IS_GANG(bp) ? ZIO_CHECKSUM_GANG_HEADER : BP_GET_CHECKSUM(bp)));

	if (checksum == ZIO_CHECKSUM_NOPARITY)
	return (ret);

	for (c = 0; c < rm->rm_firstdatacol; c++) {
	rc = &rm->rm_col[c];
	if (!rc->rc_tried \|\| rc->rc_error != 0)
	continue;

	orig[c] = abd_alloc_sametype(rc->rc_abd, rc->rc_size);
	abd_copy(orig[c], rc->rc_abd, rc->rc_size);
	}

	vdev_raidz_generate_parity(rm);

	for (c = 0; c < rm->rm_firstdatacol; c++) {
	rc = &rm->rm_col[c];
	if (!rc->rc_tried \|\| rc->rc_error != 0)
	continue;
	if (abd_cmp(orig[c], rc->rc_abd) != 0) {
	raidz_checksum_error(zio, rc, orig[c]);
	rc->rc_error = SET_ERROR(ECKSUM);
	ret++;
	}
	abd_free(orig[c]);
	}

	return (ret);
	}

	static int
	vdev_raidz_worst_error(raidz_map_t *rm)
	{
	int error = 0;

	for (int c = 0; c < rm->rm_cols; c++)
	error = zio_worst_error(error, rm->rm_col[c].rc_error);

	return (error);
	}

	/*
	* Iterate over all combinations of bad data and attempt a reconstruction.
	* Note that the algorithm below is non-optimal because it doesn't take into
	* account how reconstruction is actually performed. For example, with
	* triple-parity RAID-Z the reconstruction procedure is the same if column 4
	* is targeted as invalid as if columns 1 and 4 are targeted since in both
	* cases we'd only use parity information in column 0.
	*/
	static int
	vdev_raidz_combrec(zio_t *zio, int total_errors, int data_errors)
	{
	raidz_map_t *rm = zio->io_vsd;
	raidz_col_t *rc;
	abd_t *orig[VDEV_RAIDZ_MAXPARITY];
	int tstore[VDEV_RAIDZ_MAXPARITY + 2];
	int *tgts = &tstore[1];
	int curr, next, i, c, n;
	int code, ret = 0;

	ASSERT(total_errors < rm->rm_firstdatacol);

	/*
	* This simplifies one edge condition.
	*/
	tgts[-1] = -1;

	for (n = 1; n <= rm->rm_firstdatacol - total_errors; n++) {
	/*
	* Initialize the targets array by finding the first n columns
	* that contain no error.
	*
	* If there were no data errors, we need to ensure that we're
	* always explicitly attempting to reconstruct at least one
	* data column. To do this, we simply push the highest target
	* up into the data columns.
	*/
	for (c = 0, i = 0; i < n; i++) {
	if (i == n - 1 && data_errors == 0 &&
	c < rm->rm_firstdatacol) {
	c = rm->rm_firstdatacol;
	}

	while (rm->rm_col[c].rc_error != 0) {
	c++;
	ASSERT3S(c, <, rm->rm_cols);
	}

	tgts[i] = c++;
	}

	/*
	* Setting tgts[n] simplifies the other edge condition.
	*/
	tgts[n] = rm->rm_cols;

	/*
	* These buffers were allocated in previous iterations.
	*/
	for (i = 0; i < n - 1; i++) {
	ASSERT(orig[i] != NULL);
	}

	orig[n - 1] = abd_alloc_sametype(rm->rm_col[0].rc_abd,
	rm->rm_col[0].rc_size);

	curr = 0;
	next = tgts[curr];

	while (curr != n) {
	tgts[curr] = next;
	curr = 0;

	/*
	* Save off the original data that we're going to
	* attempt to reconstruct.
	*/
	for (i = 0; i < n; i++) {
	ASSERT(orig[i] != NULL);
	c = tgts[i];
	ASSERT3S(c, >=, 0);
	ASSERT3S(c, <, rm->rm_cols);
	rc = &rm->rm_col[c];
	abd_copy(orig[i], rc->rc_abd, rc->rc_size);
	}

	/*
	* Attempt a reconstruction and exit the outer loop on
	* success.
	*/
	code = vdev_raidz_reconstruct(rm, tgts, n);
	if (raidz_checksum_verify(zio) == 0) {

	for (i = 0; i < n; i++) {
	c = tgts[i];
	rc = &rm->rm_col[c];
	ASSERT(rc->rc_error == 0);
	if (rc->rc_tried)
	raidz_checksum_error(zio, rc,
	orig[i]);
	rc->rc_error = SET_ERROR(ECKSUM);
	}

	ret = code;
	goto done;
	}

	/*
	* Restore the original data.
	*/
	for (i = 0; i < n; i++) {
	c = tgts[i];
	rc = &rm->rm_col[c];
	abd_copy(rc->rc_abd, orig[i], rc->rc_size);
	}

	do {
	/*
	* Find the next valid column after the curr
	* position..
	*/
	for (next = tgts[curr] + 1;
	next < rm->rm_cols &&
	rm->rm_col[next].rc_error != 0; next++)
	continue;

	ASSERT(next <= tgts[curr + 1]);

	/*
	* If that spot is available, we're done here.
	*/
	if (next != tgts[curr + 1])
	break;

	/*
	* Otherwise, find the next valid column after
	* the previous position.
	*/
	for (c = tgts[curr - 1] + 1;
	rm->rm_col[c].rc_error != 0; c++)
	continue;

	tgts[curr] = c;
	curr++;

	} while (curr != n);
	}
	}
	n--;
	done:
	for (i = 0; i < n; i++)
	abd_free(orig[i]);

	return (ret);
	}

	/*
	* Complete an IO operation on a RAIDZ VDev
	*
	* Outline:
	* - For write operations:
	* 1. Check for errors on the child IOs.
	* 2. Return, setting an error code if too few child VDevs were written
	* to reconstruct the data later. Note that partial writes are
	* considered successful if they can be reconstructed at all.
	* - For read operations:
	* 1. Check for errors on the child IOs.
	* 2. If data errors occurred:
	* a. Try to reassemble the data from the parity available.
	* b. If we haven't yet read the parity drives, read them now.
	* c. If all parity drives have been read but the data still doesn't
	* reassemble with a correct checksum, then try combinatorial
	* reconstruction.
	* d. If that doesn't work, return an error.
	* 3. If there were unexpected errors or this is a resilver operation,
	* rewrite the vdevs that had errors.
	*/
	static void
	vdev_raidz_io_done(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;
	vdev_t *cvd;
	raidz_map_t *rm = zio->io_vsd;
	raidz_col_t *rc = NULL;
	int unexpected_errors = 0;
	int parity_errors = 0;
	int parity_untried = 0;
	int data_errors = 0;
	int total_errors = 0;
	int n, c;
	int tgts[VDEV_RAIDZ_MAXPARITY];
	int code;

	ASSERT(zio->io_bp != NULL); /* XXX need to add code to enforce this */

	ASSERT(rm->rm_missingparity <= rm->rm_firstdatacol);
	ASSERT(rm->rm_missingdata <= rm->rm_cols - rm->rm_firstdatacol);

	for (c = 0; c < rm->rm_cols; c++) {
	rc = &rm->rm_col[c];

	if (rc->rc_error) {
	ASSERT(rc->rc_error != ECKSUM); /* child has no bp */

	if (c < rm->rm_firstdatacol)
	parity_errors++;
	else
	data_errors++;

	if (!rc->rc_skipped)
	unexpected_errors++;

	total_errors++;
	} else if (c < rm->rm_firstdatacol && !rc->rc_tried) {
	parity_untried++;
	}
	}

	if (zio->io_type == ZIO_TYPE_WRITE) {
	/*
	* XXX -- for now, treat partial writes as a success.
	* (If we couldn't write enough columns to reconstruct
	* the data, the I/O failed. Otherwise, good enough.)
	*
	* Now that we support write reallocation, it would be better
	* to treat partial failure as real failure unless there are
	* no non-degraded top-level vdevs left, and not update DTLs
	* if we intend to reallocate.
	*/
	/* XXPOLICY */
	if (total_errors > rm->rm_firstdatacol)
	zio->io_error = vdev_raidz_worst_error(rm);

	return;
	}

	ASSERT(zio->io_type == ZIO_TYPE_READ);
	/*
	* There are three potential phases for a read:
	* 1. produce valid data from the columns read
	* 2. read all disks and try again
	* 3. perform combinatorial reconstruction
	*
	* Each phase is progressively both more expensive and less likely to
	* occur. If we encounter more errors than we can repair or all phases
	* fail, we have no choice but to return an error.
	*/

	/*
	* If the number of errors we saw was correctable -- less than or equal
	* to the number of parity disks read -- attempt to produce data that
	* has a valid checksum. Naturally, this case applies in the absence of
	* any errors.
	*/
	if (total_errors <= rm->rm_firstdatacol - parity_untried) {
	if (data_errors == 0) {
	if (raidz_checksum_verify(zio) == 0) {
	/*
	* If we read parity information (unnecessarily
	* as it happens since no reconstruction was
	* needed) regenerate and verify the parity.
	* We also regenerate parity when resilvering
	* so we can write it out to the failed device
	* later.
	*/
	if (parity_errors + parity_untried <
	rm->rm_firstdatacol \|\|
	(zio->io_flags & ZIO_FLAG_RESILVER)) {
	n = raidz_parity_verify(zio, rm);
	unexpected_errors += n;
	ASSERT(parity_errors + n <=
	rm->rm_firstdatacol);
	}
	goto done;
	}
	} else {
	/*
	* We either attempt to read all the parity columns or
	* none of them. If we didn't try to read parity, we
	* wouldn't be here in the correctable case. There must
	* also have been fewer parity errors than parity
	* columns or, again, we wouldn't be in this code path.
	*/
	ASSERT(parity_untried == 0);
	ASSERT(parity_errors < rm->rm_firstdatacol);

	/*
	* Identify the data columns that reported an error.
	*/
	n = 0;
	for (c = rm->rm_firstdatacol; c < rm->rm_cols; c++) {
	rc = &rm->rm_col[c];
	if (rc->rc_error != 0) {
	ASSERT(n < VDEV_RAIDZ_MAXPARITY);
	tgts[n++] = c;
	}
	}

	ASSERT(rm->rm_firstdatacol >= n);

	code = vdev_raidz_reconstruct(rm, tgts, n);

	if (raidz_checksum_verify(zio) == 0) {
	/*
	* If we read more parity disks than were used
	* for reconstruction, confirm that the other
	* parity disks produced correct data. This
	* routine is suboptimal in that it regenerates
	* the parity that we already used in addition
	* to the parity that we're attempting to
	* verify, but this should be a relatively
	* uncommon case, and can be optimized if it
	* becomes a problem. Note that we regenerate
	* parity when resilvering so we can write it
	* out to failed devices later.
	*/
	if (parity_errors < rm->rm_firstdatacol - n \|\|
	(zio->io_flags & ZIO_FLAG_RESILVER)) {
	n = raidz_parity_verify(zio, rm);
	unexpected_errors += n;
	ASSERT(parity_errors + n <=
	rm->rm_firstdatacol);
	}

	goto done;
	}
	}
	}

	/*
	* This isn't a typical situation -- either we got a read error or
	* a child silently returned bad data. Read every block so we can
	* try again with as much data and parity as we can track down. If
	* we've already been through once before, all children will be marked
	* as tried so we'll proceed to combinatorial reconstruction.
	*/
	unexpected_errors = 1;
	rm->rm_missingdata = 0;
	rm->rm_missingparity = 0;

	for (c = 0; c < rm->rm_cols; c++) {
	if (rm->rm_col[c].rc_tried)
	continue;

	zio_vdev_io_redone(zio);
	do {
	rc = &rm->rm_col[c];
	if (rc->rc_tried)
	continue;
	zio_nowait(zio_vdev_child_io(zio, NULL,
	vd->vdev_child[rc->rc_devidx],
	rc->rc_offset, rc->rc_abd, rc->rc_size,
	zio->io_type, zio->io_priority, 0,
	vdev_raidz_child_done, rc));
	} while (++c < rm->rm_cols);

	return;
	}

	/*
	* At this point we've attempted to reconstruct the data given the
	* errors we detected, and we've attempted to read all columns. There
	* must, therefore, be one or more additional problems -- silent errors
	* resulting in invalid data rather than explicit I/O errors resulting
	* in absent data. We check if there is enough additional data to
	* possibly reconstruct the data and then perform combinatorial
	* reconstruction over all possible combinations. If that fails,
	* we're cooked.
	*/
	if (total_errors > rm->rm_firstdatacol) {
	zio->io_error = vdev_raidz_worst_error(rm);

	} else if (total_errors < rm->rm_firstdatacol &&
	(code = vdev_raidz_combrec(zio, total_errors, data_errors)) != 0) {
	/*
	* If we didn't use all the available parity for the
	* combinatorial reconstruction, verify that the remaining
	* parity is correct.
	*/
	if (code != (1 << rm->rm_firstdatacol) - 1)
	(void) raidz_parity_verify(zio, rm);
	} else {
	/*
	* We're here because either:
	*
	* total_errors == rm_first_datacol, or
	* vdev_raidz_combrec() failed
	*
	* In either case, there is enough bad data to prevent
	* reconstruction.
	*
	* Start checksum ereports for all children which haven't
	* failed, and the IO wasn't speculative.
	*/
	zio->io_error = SET_ERROR(ECKSUM);

	if (!(zio->io_flags & ZIO_FLAG_SPECULATIVE)) {
	for (c = 0; c < rm->rm_cols; c++) {
	vdev_t *cvd;
	rc = &rm->rm_col[c];
	cvd = vd->vdev_child[rc->rc_devidx];
	- if (rc->rc_error == 0) {
	- zio_bad_cksum_t zbc;
	- zbc.zbc_has_cksum = 0;
	- zbc.zbc_injected =
	- rm->rm_ecksuminjected;
	+ if (rc->rc_error != 0)
	+ continue;

	+ zio_bad_cksum_t zbc;
	+ zbc.zbc_has_cksum = 0;
	+ zbc.zbc_injected = rm->rm_ecksuminjected;
	+
	+ int ret = zfs_ereport_start_checksum(
	+ zio->io_spa, cvd, &zio->io_bookmark, zio,
	+ rc->rc_offset, rc->rc_size,
	+ (void *)(uintptr_t)c, &zbc);
	+ if (ret != EALREADY) {
	mutex_enter(&cvd->vdev_stat_lock);
	cvd->vdev_stat.vs_checksum_errors++;
	mutex_exit(&cvd->vdev_stat_lock);
	-
	- zfs_ereport_start_checksum(
	- zio->io_spa, cvd,
	- &zio->io_bookmark, zio,
	- rc->rc_offset, rc->rc_size,
	- (void *)(uintptr_t)c, &zbc);
	}
	}
	}
	}

	done:
	zio_checksum_verified(zio);

	if (zio->io_error == 0 && spa_writeable(zio->io_spa) &&
	(unexpected_errors \|\| (zio->io_flags & ZIO_FLAG_RESILVER))) {
	/*
	* Use the good data we have in hand to repair damaged children.
	*/
	for (c = 0; c < rm->rm_cols; c++) {
	rc = &rm->rm_col[c];
	cvd = vd->vdev_child[rc->rc_devidx];

	if (rc->rc_error == 0)
	continue;

	zio_nowait(zio_vdev_child_io(zio, NULL, cvd,
	rc->rc_offset, rc->rc_abd, rc->rc_size,
	ZIO_TYPE_WRITE, ZIO_PRIORITY_ASYNC_WRITE,
	ZIO_FLAG_IO_REPAIR \| (unexpected_errors ?
	ZIO_FLAG_SELF_HEAL : 0), NULL, NULL));
	}
	}
	}

	static void
	vdev_raidz_state_change(vdev_t *vd, int faulted, int degraded)
	{
	if (faulted > vd->vdev_nparity)
	vdev_set_state(vd, B_FALSE, VDEV_STATE_CANT_OPEN,
	VDEV_AUX_NO_REPLICAS);
	else if (degraded + faulted != 0)
	vdev_set_state(vd, B_FALSE, VDEV_STATE_DEGRADED, VDEV_AUX_NONE);
	else
	vdev_set_state(vd, B_FALSE, VDEV_STATE_HEALTHY, VDEV_AUX_NONE);
	}

	/*
	* Determine if any portion of the provided block resides on a child vdev
	* with a dirty DTL and therefore needs to be resilvered. The function
	* assumes that at least one DTL is dirty which implies that full stripe
	* width blocks must be resilvered.
	*/
	static boolean_t
	vdev_raidz_need_resilver(vdev_t *vd, uint64_t offset, size_t psize)
	{
	uint64_t dcols = vd->vdev_children;
	uint64_t nparity = vd->vdev_nparity;
	uint64_t ashift = vd->vdev_top->vdev_ashift;
	/* The starting RAIDZ (parent) vdev sector of the block. */
	uint64_t b = offset >> ashift;
	/* The zio's size in units of the vdev's minimum sector size. */
	uint64_t s = ((psize - 1) >> ashift) + 1;
	/* The first column for this stripe. */
	uint64_t f = b % dcols;

	if (s + nparity >= dcols)
	return (B_TRUE);

	for (uint64_t c = 0; c < s + nparity; c++) {
	uint64_t devidx = (f + c) % dcols;
	vdev_t *cvd = vd->vdev_child[devidx];

	/*
	* dsl_scan_need_resilver() already checked vd with
	* vdev_dtl_contains(). So here just check cvd with
	* vdev_dtl_empty(), cheaper and a good approximation.
	*/
	if (!vdev_dtl_empty(cvd, DTL_PARTIAL))
	return (B_TRUE);
	}

	return (B_FALSE);
	}

	static void
	vdev_raidz_xlate(vdev_t cvd, const range_seg64_t in, range_seg64_t *res)
	{
	vdev_t *raidvd = cvd->vdev_parent;
	ASSERT(raidvd->vdev_ops == &vdev_raidz_ops);

	uint64_t width = raidvd->vdev_children;
	uint64_t tgt_col = cvd->vdev_id;
	uint64_t ashift = raidvd->vdev_top->vdev_ashift;

	/* make sure the offsets are block-aligned */
	ASSERT0(in->rs_start % (1 << ashift));
	ASSERT0(in->rs_end % (1 << ashift));
	uint64_t b_start = in->rs_start >> ashift;
	uint64_t b_end = in->rs_end >> ashift;

	uint64_t start_row = 0;
	if (b_start > tgt_col) /* avoid underflow */
	start_row = ((b_start - tgt_col - 1) / width) + 1;

	uint64_t end_row = 0;
	if (b_end > tgt_col)
	end_row = ((b_end - tgt_col - 1) / width) + 1;

	res->rs_start = start_row << ashift;
	res->rs_end = end_row << ashift;

	ASSERT3U(res->rs_start, <=, in->rs_start);
	ASSERT3U(res->rs_end - res->rs_start, <=, in->rs_end - in->rs_start);
	}

	vdev_ops_t vdev_raidz_ops = {
	.vdev_op_open = vdev_raidz_open,
	.vdev_op_close = vdev_raidz_close,
	.vdev_op_asize = vdev_raidz_asize,
	.vdev_op_io_start = vdev_raidz_io_start,
	.vdev_op_io_done = vdev_raidz_io_done,
	.vdev_op_state_change = vdev_raidz_state_change,
	.vdev_op_need_resilver = vdev_raidz_need_resilver,
	.vdev_op_hold = NULL,
	.vdev_op_rele = NULL,
	.vdev_op_remap = NULL,
	.vdev_op_xlate = vdev_raidz_xlate,
	.vdev_op_type = VDEV_TYPE_RAIDZ, /* name of this vdev type */
	.vdev_op_leaf = B_FALSE /* not a leaf vdev */
	};
	Index: vendor-sys/openzfs/dist/module/zfs/vdev_rebuild.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev_rebuild.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev_rebuild.c (revision 365892)
	@@ -1,1108 +1,1104 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	*
	* Copyright (c) 2018, Intel Corporation.
	* Copyright (c) 2020 by Lawrence Livermore National Security, LLC.
	*/

	#include <sys/vdev_impl.h>
	#include <sys/dsl_scan.h>
	#include <sys/spa_impl.h>
	#include <sys/metaslab_impl.h>
	#include <sys/vdev_rebuild.h>
	#include <sys/zio.h>
	#include <sys/dmu_tx.h>
	#include <sys/arc.h>
	#include <sys/zap.h>

	/*
	* This file contains the sequential reconstruction implementation for
	* resilvering. This form of resilvering is internally referred to as device
	* rebuild to avoid conflating it with the traditional healing reconstruction
	* performed by the dsl scan code.
	*
	* When replacing a device, or scrubbing the pool, ZFS has historically used
	* a process called resilvering which is a form of healing reconstruction.
	* This approach has the advantage that as blocks are read from disk their
	* checksums can be immediately verified and the data repaired. Unfortunately,
	* it also results in a random IO pattern to the disk even when extra care
	* is taken to sequentialize the IO as much as possible. This substantially
	* increases the time required to resilver the pool and restore redundancy.
	*
	* For mirrored devices it's possible to implement an alternate sequential
	* reconstruction strategy when resilvering. Sequential reconstruction
	* behaves like a traditional RAID rebuild and reconstructs a device in LBA
	* order without verifying the checksum. After this phase completes a second
	* scrub phase is started to verify all of the checksums. This two phase
	* process will take longer than the healing reconstruction described above.
	* However, it has that advantage that after the reconstruction first phase
	* completes redundancy has been restored. At this point the pool can incur
	* another device failure without risking data loss.
	*
	* There are a few noteworthy limitations and other advantages of resilvering
	* using sequential reconstruction vs healing reconstruction.
	*
	* Limitations:
	*
	* - Only supported for mirror vdev types. Due to the variable stripe
	* width used by raidz sequential reconstruction is not possible.
	*
	* - Block checksums are not verified during sequential reconstuction.
	* Similar to traditional RAID the parity/mirror data is reconstructed
	* but cannot be immediately double checked. For this reason when the
	* last active resilver completes the pool is automatically scrubbed.
	*
	* - Deferred resilvers using sequential reconstruction are not currently
	* supported. When adding another vdev to an active top-level resilver
	* it must be restarted.
	*
	* Advantages:
	*
	* - Sequential reconstuction is performed in LBA order which may be faster
	* than healing reconstuction particularly when using using HDDs (or
	* especially with SMR devices). Only allocated capacity is resilvered.
	*
	* - Sequential reconstruction is not constrained by ZFS block boundaries.
	* This allows it to issue larger IOs to disk which span multiple blocks
	* allowing all of these logical blocks to be repaired with a single IO.
	*
	* - Unlike a healing resilver or scrub which are pool wide operations,
	* sequential reconstruction is handled by the top-level mirror vdevs.
	* This allows for it to be started or canceled on a top-level vdev
	* without impacting any other top-level vdevs in the pool.
	*
	* - Data only referenced by a pool checkpoint will be repaired because
	* that space is reflected in the space maps. This differs for a
	* healing resilver or scrub which will not repair that data.
	*/


	/*
	* Maximum number of queued rebuild I/Os top-level vdev. The number of
	* concurrent rebuild I/Os issued to the device is controlled by the
	* zfs_vdev_rebuild_min_active and zfs_vdev_rebuild_max_active module
	* options.
	*/
	unsigned int zfs_rebuild_queue_limit = 20;

	/*
	* Size of rebuild reads; defaults to 1MiB and is capped at SPA_MAXBLOCKSIZE.
	*/
	unsigned long zfs_rebuild_max_segment = 1024 * 1024;

	/*
	* For vdev_rebuild_initiate_sync() and vdev_rebuild_reset_sync().
	*/
	static void vdev_rebuild_thread(void *arg);

	/*
	* Clear the per-vdev rebuild bytes value for a vdev tree.
	*/
	static void
	clear_rebuild_bytes(vdev_t *vd)
	{
	vdev_stat_t *vs = &vd->vdev_stat;

	for (uint64_t i = 0; i < vd->vdev_children; i++)
	clear_rebuild_bytes(vd->vdev_child[i]);

	mutex_enter(&vd->vdev_stat_lock);
	vs->vs_rebuild_processed = 0;
	mutex_exit(&vd->vdev_stat_lock);
	}

	/*
	* Determines whether a vdev_rebuild_thread() should be stopped.
	*/
	static boolean_t
	vdev_rebuild_should_stop(vdev_t *vd)
	{
	return (!vdev_writeable(vd) \|\| vd->vdev_removing \|\|
	vd->vdev_rebuild_exit_wanted \|\|
	vd->vdev_rebuild_cancel_wanted \|\|
	vd->vdev_rebuild_reset_wanted);
	}

	/*
	* Determine if the rebuild should be canceled. This may happen when all
	* vdevs with MISSING DTLs are detached.
	*/
	static boolean_t
	vdev_rebuild_should_cancel(vdev_t *vd)
	{
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	if (!vdev_resilver_needed(vd, &vrp->vrp_min_txg, &vrp->vrp_max_txg))
	return (B_TRUE);

	return (B_FALSE);
	}

	/*
	* The sync task for updating the on-disk state of a rebuild. This is
	* scheduled by vdev_rebuild_range().
	*/
	static void
	vdev_rebuild_update_sync(void arg, dmu_tx_t tx)
	{
	int vdev_id = (uintptr_t)arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;
	uint64_t txg = dmu_tx_get_txg(tx);

	mutex_enter(&vd->vdev_rebuild_lock);

	if (vr->vr_scan_offset[txg & TXG_MASK] > 0) {
	vrp->vrp_last_offset = vr->vr_scan_offset[txg & TXG_MASK];
	vr->vr_scan_offset[txg & TXG_MASK] = 0;
	}

	vrp->vrp_scan_time_ms = vr->vr_prev_scan_time_ms +
	NSEC2MSEC(gethrtime() - vr->vr_pass_start_time);

	VERIFY0(zap_update(vd->vdev_spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_VDEV_REBUILD_PHYS, sizeof (uint64_t),
	REBUILD_PHYS_ENTRIES, vrp, tx));

	mutex_exit(&vd->vdev_rebuild_lock);
	}

	/*
	* Initialize the on-disk state for a new rebuild, start the rebuild thread.
	*/
	static void
	vdev_rebuild_initiate_sync(void arg, dmu_tx_t tx)
	{
	int vdev_id = (uintptr_t)arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	ASSERT(vd->vdev_rebuilding);

	spa_feature_incr(vd->vdev_spa, SPA_FEATURE_DEVICE_REBUILD, tx);

	mutex_enter(&vd->vdev_rebuild_lock);
	bzero(vrp, sizeof (uint64_t) * REBUILD_PHYS_ENTRIES);
	vrp->vrp_rebuild_state = VDEV_REBUILD_ACTIVE;
	vrp->vrp_min_txg = 0;
	vrp->vrp_max_txg = dmu_tx_get_txg(tx);
	vrp->vrp_start_time = gethrestime_sec();
	vrp->vrp_scan_time_ms = 0;
	vr->vr_prev_scan_time_ms = 0;

	/*
	* Rebuilds are currently only used when replacing a device, in which
	* case there must be DTL_MISSING entries. In the future, we could
	* allow rebuilds to be used in a way similar to a scrub. This would
	* be useful because it would allow us to rebuild the space used by
	* pool checkpoints.
	*/
	VERIFY(vdev_resilver_needed(vd, &vrp->vrp_min_txg, &vrp->vrp_max_txg));

	VERIFY0(zap_update(vd->vdev_spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_VDEV_REBUILD_PHYS, sizeof (uint64_t),
	REBUILD_PHYS_ENTRIES, vrp, tx));

	spa_history_log_internal(spa, "rebuild", tx,
	"vdev_id=%llu vdev_guid=%llu started",
	(u_longlong_t)vd->vdev_id, (u_longlong_t)vd->vdev_guid);

	ASSERT3P(vd->vdev_rebuild_thread, ==, NULL);
	vd->vdev_rebuild_thread = thread_create(NULL, 0,
	vdev_rebuild_thread, vd, 0, &p0, TS_RUN, maxclsyspri);

	mutex_exit(&vd->vdev_rebuild_lock);
	}

	static void
	vdev_rebuild_log_notify(spa_t spa, vdev_t vd, char *name)
	{
	nvlist_t *aux = fnvlist_alloc();

	fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE, "sequential");
	spa_event_notify(spa, vd, aux, name);
	nvlist_free(aux);
	}

	/*
	* Called to request that a new rebuild be started. The feature will remain
	* active for the duration of the rebuild, then revert to the enabled state.
	*/
	static void
	vdev_rebuild_initiate(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(vd->vdev_top == vd);
	ASSERT(MUTEX_HELD(&vd->vdev_rebuild_lock));
	ASSERT(!vd->vdev_rebuilding);

	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));

	vd->vdev_rebuilding = B_TRUE;

	dsl_sync_task_nowait(spa_get_dsl(spa), vdev_rebuild_initiate_sync,
	- (void *)(uintptr_t)vd->vdev_id, 0, ZFS_SPACE_CHECK_NONE, tx);
	+ (void *)(uintptr_t)vd->vdev_id, tx);
	dmu_tx_commit(tx);

	vdev_rebuild_log_notify(spa, vd, ESC_ZFS_RESILVER_START);
	}

	/*
	* Update the on-disk state to completed when a rebuild finishes.
	*/
	static void
	vdev_rebuild_complete_sync(void arg, dmu_tx_t tx)
	{
	int vdev_id = (uintptr_t)arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	mutex_enter(&vd->vdev_rebuild_lock);
	vrp->vrp_rebuild_state = VDEV_REBUILD_COMPLETE;
	vrp->vrp_end_time = gethrestime_sec();

	VERIFY0(zap_update(vd->vdev_spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_VDEV_REBUILD_PHYS, sizeof (uint64_t),
	REBUILD_PHYS_ENTRIES, vrp, tx));

	vdev_dtl_reassess(vd, tx->tx_txg, vrp->vrp_max_txg, B_TRUE, B_TRUE);
	spa_feature_decr(vd->vdev_spa, SPA_FEATURE_DEVICE_REBUILD, tx);

	spa_history_log_internal(spa, "rebuild", tx,
	"vdev_id=%llu vdev_guid=%llu complete",
	(u_longlong_t)vd->vdev_id, (u_longlong_t)vd->vdev_guid);
	vdev_rebuild_log_notify(spa, vd, ESC_ZFS_RESILVER_FINISH);

	/* Handles detaching of spares */
	spa_async_request(spa, SPA_ASYNC_REBUILD_DONE);
	vd->vdev_rebuilding = B_FALSE;
	mutex_exit(&vd->vdev_rebuild_lock);

	spa_notify_waiters(spa);
	cv_broadcast(&vd->vdev_rebuild_cv);
	}

	/*
	* Update the on-disk state to canceled when a rebuild finishes.
	*/
	static void
	vdev_rebuild_cancel_sync(void arg, dmu_tx_t tx)
	{
	int vdev_id = (uintptr_t)arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	mutex_enter(&vd->vdev_rebuild_lock);
	vrp->vrp_rebuild_state = VDEV_REBUILD_CANCELED;
	vrp->vrp_end_time = gethrestime_sec();

	VERIFY0(zap_update(vd->vdev_spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_VDEV_REBUILD_PHYS, sizeof (uint64_t),
	REBUILD_PHYS_ENTRIES, vrp, tx));

	spa_feature_decr(vd->vdev_spa, SPA_FEATURE_DEVICE_REBUILD, tx);

	spa_history_log_internal(spa, "rebuild", tx,
	"vdev_id=%llu vdev_guid=%llu canceled",
	(u_longlong_t)vd->vdev_id, (u_longlong_t)vd->vdev_guid);
	vdev_rebuild_log_notify(spa, vd, ESC_ZFS_RESILVER_FINISH);

	vd->vdev_rebuild_cancel_wanted = B_FALSE;
	vd->vdev_rebuilding = B_FALSE;
	mutex_exit(&vd->vdev_rebuild_lock);

	spa_notify_waiters(spa);
	cv_broadcast(&vd->vdev_rebuild_cv);
	}

	/*
	* Resets the progress of a running rebuild. This will occur when a new
	* vdev is added to rebuild.
	*/
	static void
	vdev_rebuild_reset_sync(void arg, dmu_tx_t tx)
	{
	int vdev_id = (uintptr_t)arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	mutex_enter(&vd->vdev_rebuild_lock);

	ASSERT(vrp->vrp_rebuild_state == VDEV_REBUILD_ACTIVE);
	ASSERT3P(vd->vdev_rebuild_thread, ==, NULL);

	vrp->vrp_last_offset = 0;
	vrp->vrp_min_txg = 0;
	vrp->vrp_max_txg = dmu_tx_get_txg(tx);
	vrp->vrp_bytes_scanned = 0;
	vrp->vrp_bytes_issued = 0;
	vrp->vrp_bytes_rebuilt = 0;
	vrp->vrp_bytes_est = 0;
	vrp->vrp_scan_time_ms = 0;
	vr->vr_prev_scan_time_ms = 0;

	/* See vdev_rebuild_initiate_sync comment */
	VERIFY(vdev_resilver_needed(vd, &vrp->vrp_min_txg, &vrp->vrp_max_txg));

	VERIFY0(zap_update(vd->vdev_spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_VDEV_REBUILD_PHYS, sizeof (uint64_t),
	REBUILD_PHYS_ENTRIES, vrp, tx));

	spa_history_log_internal(spa, "rebuild", tx,
	"vdev_id=%llu vdev_guid=%llu reset",
	(u_longlong_t)vd->vdev_id, (u_longlong_t)vd->vdev_guid);

	vd->vdev_rebuild_reset_wanted = B_FALSE;
	ASSERT(vd->vdev_rebuilding);

	vd->vdev_rebuild_thread = thread_create(NULL, 0,
	vdev_rebuild_thread, vd, 0, &p0, TS_RUN, maxclsyspri);

	mutex_exit(&vd->vdev_rebuild_lock);
	}

	/*
	* Clear the last rebuild status.
	*/
	void
	vdev_rebuild_clear_sync(void arg, dmu_tx_t tx)
	{
	int vdev_id = (uintptr_t)arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;
	objset_t *mos = spa_meta_objset(spa);

	mutex_enter(&vd->vdev_rebuild_lock);

	if (!spa_feature_is_enabled(spa, SPA_FEATURE_DEVICE_REBUILD) \|\|
	vrp->vrp_rebuild_state == VDEV_REBUILD_ACTIVE) {
	mutex_exit(&vd->vdev_rebuild_lock);
	return;
	}

	clear_rebuild_bytes(vd);
	bzero(vrp, sizeof (uint64_t) * REBUILD_PHYS_ENTRIES);

	if (vd->vdev_top_zap != 0 && zap_contains(mos, vd->vdev_top_zap,
	VDEV_TOP_ZAP_VDEV_REBUILD_PHYS) == 0) {
	VERIFY0(zap_update(mos, vd->vdev_top_zap,
	VDEV_TOP_ZAP_VDEV_REBUILD_PHYS, sizeof (uint64_t),
	REBUILD_PHYS_ENTRIES, vrp, tx));
	}

	mutex_exit(&vd->vdev_rebuild_lock);
	}

	/*
	* The zio_done_func_t callback for each rebuild I/O issued. It's responsible
	* for updating the rebuild stats and limiting the number of in flight I/Os.
	*/
	static void
	vdev_rebuild_cb(zio_t *zio)
	{
	vdev_rebuild_t *vr = zio->io_private;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;
	vdev_t *vd = vr->vr_top_vdev;

	mutex_enter(&vd->vdev_rebuild_io_lock);
	if (zio->io_error == ENXIO && !vdev_writeable(vd)) {
	/*
	* The I/O failed because the top-level vdev was unavailable.
	* Attempt to roll back to the last completed offset, in order
	* resume from the correct location if the pool is resumed.
	* (This works because spa_sync waits on spa_txg_zio before
	* it runs sync tasks.)
	*/
	uint64_t *off = &vr->vr_scan_offset[zio->io_txg & TXG_MASK];
	off = MIN(off, zio->io_offset);
	} else if (zio->io_error) {
	vrp->vrp_errors++;
	}

	abd_free(zio->io_abd);

	ASSERT3U(vd->vdev_rebuild_inflight, >, 0);
	vd->vdev_rebuild_inflight--;
	cv_broadcast(&vd->vdev_rebuild_io_cv);
	mutex_exit(&vd->vdev_rebuild_io_lock);

	spa_config_exit(vd->vdev_spa, SCL_STATE_ALL, vd);
	}

	/*
	* Rebuild the data in this range by constructing a special dummy block
	* pointer for the given range. It has no relation to any existing blocks
	* in the pool. But by disabling checksum verification and issuing a scrub
	* I/O mirrored vdevs will replicate the block using any available mirror
	* leaf vdevs.
	*/
	static void
	vdev_rebuild_rebuild_block(vdev_rebuild_t *vr, uint64_t start, uint64_t asize,
	uint64_t txg)
	{
	vdev_t *vd = vr->vr_top_vdev;
	spa_t *spa = vd->vdev_spa;
	uint64_t psize = asize;

	ASSERT(vd->vdev_ops == &vdev_mirror_ops \|\|
	vd->vdev_ops == &vdev_replacing_ops \|\|
	vd->vdev_ops == &vdev_spare_ops);

	blkptr_t blk, *bp = &blk;
	BP_ZERO(bp);

	DVA_SET_VDEV(&bp->blk_dva[0], vd->vdev_id);
	DVA_SET_OFFSET(&bp->blk_dva[0], start);
	DVA_SET_GANG(&bp->blk_dva[0], 0);
	DVA_SET_ASIZE(&bp->blk_dva[0], asize);

	BP_SET_BIRTH(bp, TXG_INITIAL, TXG_INITIAL);
	BP_SET_LSIZE(bp, psize);
	BP_SET_PSIZE(bp, psize);
	BP_SET_COMPRESS(bp, ZIO_COMPRESS_OFF);
	BP_SET_CHECKSUM(bp, ZIO_CHECKSUM_OFF);
	BP_SET_TYPE(bp, DMU_OT_NONE);
	BP_SET_LEVEL(bp, 0);
	BP_SET_DEDUP(bp, 0);
	BP_SET_BYTEORDER(bp, ZFS_HOST_BYTEORDER);

	/*
	* We increment the issued bytes by the asize rather than the psize
	* so the scanned and issued bytes may be directly compared. This
	* is consistent with the scrub/resilver issued reporting.
	*/
	vr->vr_pass_bytes_issued += asize;
	vr->vr_rebuild_phys.vrp_bytes_issued += asize;

	zio_nowait(zio_read(spa->spa_txg_zio[txg & TXG_MASK], spa, bp,
	abd_alloc(psize, B_FALSE), psize, vdev_rebuild_cb, vr,
	ZIO_PRIORITY_REBUILD, ZIO_FLAG_RAW \| ZIO_FLAG_CANFAIL \|
	ZIO_FLAG_RESILVER, NULL));
	}

	/*
	* Issues a rebuild I/O and takes care of rate limiting the number of queued
	* rebuild I/Os. The provided start and size must be properly aligned for the
	* top-level vdev type being rebuilt.
	*/
	static int
	vdev_rebuild_range(vdev_rebuild_t *vr, uint64_t start, uint64_t size)
	{
	uint64_t ms_id __maybe_unused = vr->vr_scan_msp->ms_id;
	vdev_t *vd = vr->vr_top_vdev;
	spa_t *spa = vd->vdev_spa;

	ASSERT3U(ms_id, ==, start >> vd->vdev_ms_shift);
	ASSERT3U(ms_id, ==, (start + size - 1) >> vd->vdev_ms_shift);

	vr->vr_pass_bytes_scanned += size;
	vr->vr_rebuild_phys.vrp_bytes_scanned += size;

	mutex_enter(&vd->vdev_rebuild_io_lock);

	/* Limit in flight rebuild I/Os */
	while (vd->vdev_rebuild_inflight >= zfs_rebuild_queue_limit)
	cv_wait(&vd->vdev_rebuild_io_cv, &vd->vdev_rebuild_io_lock);

	vd->vdev_rebuild_inflight++;
	mutex_exit(&vd->vdev_rebuild_io_lock);

	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));
	uint64_t txg = dmu_tx_get_txg(tx);

	spa_config_enter(spa, SCL_STATE_ALL, vd, RW_READER);
	mutex_enter(&vd->vdev_rebuild_lock);

	/* This is the first I/O for this txg. */
	if (vr->vr_scan_offset[txg & TXG_MASK] == 0) {
	vr->vr_scan_offset[txg & TXG_MASK] = start;
	dsl_sync_task_nowait(spa_get_dsl(spa),
	vdev_rebuild_update_sync,
	- (void *)(uintptr_t)vd->vdev_id, 2,
	- ZFS_SPACE_CHECK_RESERVED, tx);
	+ (void *)(uintptr_t)vd->vdev_id, tx);
	}

	/* When exiting write out our progress. */
	if (vdev_rebuild_should_stop(vd)) {
	mutex_enter(&vd->vdev_rebuild_io_lock);
	vd->vdev_rebuild_inflight--;
	mutex_exit(&vd->vdev_rebuild_io_lock);
	spa_config_exit(vd->vdev_spa, SCL_STATE_ALL, vd);
	mutex_exit(&vd->vdev_rebuild_lock);
	dmu_tx_commit(tx);
	return (SET_ERROR(EINTR));
	}
	mutex_exit(&vd->vdev_rebuild_lock);

	vr->vr_scan_offset[txg & TXG_MASK] = start + size;
	vdev_rebuild_rebuild_block(vr, start, size, txg);

	dmu_tx_commit(tx);

	return (0);
	}

	/*
	* Split range into legally-sized logical chunks given the constraints of the
	* top-level mirror vdev type.
	*/
	static uint64_t
	vdev_rebuild_chunk_size(vdev_t *vd, uint64_t start, uint64_t size)
	{
	uint64_t chunk_size, max_asize, max_segment;

	ASSERT(vd->vdev_ops == &vdev_mirror_ops \|\|
	vd->vdev_ops == &vdev_replacing_ops \|\|
	vd->vdev_ops == &vdev_spare_ops);

	max_segment = MIN(P2ROUNDUP(zfs_rebuild_max_segment,
	1 << vd->vdev_ashift), SPA_MAXBLOCKSIZE);
	max_asize = vdev_psize_to_asize(vd, max_segment);
	chunk_size = MIN(size, max_asize);

	return (chunk_size);
	}

	/*
	* Issues rebuild I/Os for all ranges in the provided vr->vr_tree range tree.
	*/
	static int
	vdev_rebuild_ranges(vdev_rebuild_t *vr)
	{
	vdev_t *vd = vr->vr_top_vdev;
	zfs_btree_t *t = &vr->vr_scan_tree->rt_root;
	zfs_btree_index_t idx;
	int error;

	for (range_seg_t *rs = zfs_btree_first(t, &idx); rs != NULL;
	rs = zfs_btree_next(t, &idx, &idx)) {
	uint64_t start = rs_get_start(rs, vr->vr_scan_tree);
	uint64_t size = rs_get_end(rs, vr->vr_scan_tree) - start;

	/*
	* zfs_scan_suspend_progress can be set to disable rebuild
	* progress for testing. See comment in dsl_scan_sync().
	*/
	while (zfs_scan_suspend_progress &&
	!vdev_rebuild_should_stop(vd)) {
	delay(hz);
	}

	while (size > 0) {
	uint64_t chunk_size;

	chunk_size = vdev_rebuild_chunk_size(vd, start, size);

	error = vdev_rebuild_range(vr, start, chunk_size);
	if (error != 0)
	return (error);

	size -= chunk_size;
	start += chunk_size;
	}
	}

	return (0);
	}

	/*
	* Calculates the estimated capacity which remains to be scanned. Since
	* we traverse the pool in metaslab order only allocated capacity beyond
	* the vrp_last_offset need be considered. All lower offsets must have
	* already been rebuilt and are thus already included in vrp_bytes_scanned.
	*/
	static void
	vdev_rebuild_update_bytes_est(vdev_t *vd, uint64_t ms_id)
	{
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;
	uint64_t bytes_est = vrp->vrp_bytes_scanned;

	if (vrp->vrp_last_offset < vd->vdev_ms[ms_id]->ms_start)
	return;

	for (uint64_t i = ms_id; i < vd->vdev_ms_count; i++) {
	metaslab_t *msp = vd->vdev_ms[i];

	mutex_enter(&msp->ms_lock);
	bytes_est += metaslab_allocated_space(msp);
	mutex_exit(&msp->ms_lock);
	}

	vrp->vrp_bytes_est = bytes_est;
	}

	/*
	* Load from disk the top-level vdev's rebuild information.
	*/
	int
	vdev_rebuild_load(vdev_t *vd)
	{
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;
	spa_t *spa = vd->vdev_spa;
	int err = 0;

	mutex_enter(&vd->vdev_rebuild_lock);
	vd->vdev_rebuilding = B_FALSE;

	if (!spa_feature_is_enabled(spa, SPA_FEATURE_DEVICE_REBUILD)) {
	bzero(vrp, sizeof (uint64_t) * REBUILD_PHYS_ENTRIES);
	mutex_exit(&vd->vdev_rebuild_lock);
	return (SET_ERROR(ENOTSUP));
	}

	ASSERT(vd->vdev_top == vd);

	err = zap_lookup(spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_VDEV_REBUILD_PHYS, sizeof (uint64_t),
	REBUILD_PHYS_ENTRIES, vrp);

	/*
	* A missing or damaged VDEV_TOP_ZAP_VDEV_REBUILD_PHYS should
	* not prevent a pool from being imported. Clear the rebuild
	* status allowing a new resilver/rebuild to be started.
	*/
	if (err == ENOENT \|\| err == EOVERFLOW \|\| err == ECKSUM) {
	bzero(vrp, sizeof (uint64_t) * REBUILD_PHYS_ENTRIES);
	} else if (err) {
	mutex_exit(&vd->vdev_rebuild_lock);
	return (err);
	}

	vr->vr_prev_scan_time_ms = vrp->vrp_scan_time_ms;
	vr->vr_top_vdev = vd;

	mutex_exit(&vd->vdev_rebuild_lock);

	return (0);
	}

	/*
	* Each scan thread is responsible for rebuilding a top-level vdev. The
	* rebuild progress in tracked on-disk in VDEV_TOP_ZAP_VDEV_REBUILD_PHYS.
	*/
	static void
	vdev_rebuild_thread(void *arg)
	{
	vdev_t *vd = arg;
	spa_t *spa = vd->vdev_spa;
	int error = 0;

	/*
	* If there's a scrub in process request that it be stopped. This
	* is not required for a correct rebuild, but we do want rebuilds to
	* emulate the resilver behavior as much as possible.
	*/
	dsl_pool_t *dsl = spa_get_dsl(spa);
	if (dsl_scan_scrubbing(dsl))
	dsl_scan_cancel(dsl);

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	mutex_enter(&vd->vdev_rebuild_lock);

	ASSERT3P(vd->vdev_top, ==, vd);
	ASSERT3P(vd->vdev_rebuild_thread, !=, NULL);
	ASSERT(vd->vdev_rebuilding);
	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_DEVICE_REBUILD));
	ASSERT3B(vd->vdev_rebuild_cancel_wanted, ==, B_FALSE);
	ASSERT3B(vd->vdev_rebuild_reset_wanted, ==, B_FALSE);

	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;
	vr->vr_top_vdev = vd;
	vr->vr_scan_msp = NULL;
	vr->vr_scan_tree = range_tree_create(NULL, RANGE_SEG64, NULL, 0, 0);
	vr->vr_pass_start_time = gethrtime();
	vr->vr_pass_bytes_scanned = 0;
	vr->vr_pass_bytes_issued = 0;

	uint64_t update_est_time = gethrtime();
	vdev_rebuild_update_bytes_est(vd, 0);

	clear_rebuild_bytes(vr->vr_top_vdev);

	mutex_exit(&vd->vdev_rebuild_lock);

	/*
	* Systematically walk the metaslabs and issue rebuild I/Os for
	* all ranges in the allocated space map.
	*/
	for (uint64_t i = 0; i < vd->vdev_ms_count; i++) {
	metaslab_t *msp = vd->vdev_ms[i];
	vr->vr_scan_msp = msp;

	/*
	* Removal of vdevs from the vdev tree may eliminate the need
	* for the rebuild, in which case it should be canceled. The
	* vdev_rebuild_cancel_wanted flag is set until the sync task
	* completes. This may be after the rebuild thread exits.
	*/
	if (vdev_rebuild_should_cancel(vd)) {
	vd->vdev_rebuild_cancel_wanted = B_TRUE;
	error = EINTR;
	break;
	}

	ASSERT0(range_tree_space(vr->vr_scan_tree));

	/*
	* Disable any new allocations to this metaslab and wait
	* for any writes inflight to complete. This is needed to
	* ensure all allocated ranges are rebuilt.
	*/
	metaslab_disable(msp);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	txg_wait_synced(dsl, 0);

	mutex_enter(&msp->ms_sync_lock);
	mutex_enter(&msp->ms_lock);

	/*
	* When a metaslab has been allocated from read its allocated
	* ranges from the space map object in to the vr_scan_tree.
	* Then add inflight / unflushed ranges and remove inflight /
	* unflushed frees. This is the minimum range to be rebuilt.
	*/
	if (msp->ms_sm != NULL) {
	VERIFY0(space_map_load(msp->ms_sm,
	vr->vr_scan_tree, SM_ALLOC));

	for (int i = 0; i < TXG_SIZE; i++) {
	ASSERT0(range_tree_space(
	msp->ms_allocating[i]));
	}

	range_tree_walk(msp->ms_unflushed_allocs,
	range_tree_add, vr->vr_scan_tree);
	range_tree_walk(msp->ms_unflushed_frees,
	range_tree_remove, vr->vr_scan_tree);

	/*
	* Remove ranges which have already been rebuilt based
	* on the last offset. This can happen when restarting
	* a scan after exporting and re-importing the pool.
	*/
	range_tree_clear(vr->vr_scan_tree, 0,
	vrp->vrp_last_offset);
	}

	mutex_exit(&msp->ms_lock);
	mutex_exit(&msp->ms_sync_lock);

	/*
	* To provide an accurate estimate re-calculate the estimated
	* size every 5 minutes to account for recent allocations and
	* frees made space maps which have not yet been rebuilt.
	*/
	if (gethrtime() > update_est_time + SEC2NSEC(300)) {
	update_est_time = gethrtime();
	vdev_rebuild_update_bytes_est(vd, i);
	}

	/*
	* Walk the allocated space map and issue the rebuild I/O.
	*/
	error = vdev_rebuild_ranges(vr);
	range_tree_vacate(vr->vr_scan_tree, NULL, NULL);

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	metaslab_enable(msp, B_FALSE, B_FALSE);

	if (error != 0)
	break;
	}

	range_tree_destroy(vr->vr_scan_tree);
	spa_config_exit(spa, SCL_CONFIG, FTAG);

	/* Wait for any remaining rebuild I/O to complete */
	mutex_enter(&vd->vdev_rebuild_io_lock);
	while (vd->vdev_rebuild_inflight > 0)
	cv_wait(&vd->vdev_rebuild_io_cv, &vd->vdev_rebuild_io_lock);

	mutex_exit(&vd->vdev_rebuild_io_lock);

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	dsl_pool_t *dp = spa_get_dsl(spa);
	dmu_tx_t *tx = dmu_tx_create_dd(dp->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));

	mutex_enter(&vd->vdev_rebuild_lock);
	if (error == 0) {
	/*
	* After a successful rebuild clear the DTLs of all ranges
	* which were missing when the rebuild was started. These
	* ranges must have been rebuilt as a consequence of rebuilding
	* all allocated space. Note that unlike a scrub or resilver
	* the rebuild operation will reconstruct data only referenced
	* by a pool checkpoint. See the dsl_scan_done() comments.
	*/
	dsl_sync_task_nowait(dp, vdev_rebuild_complete_sync,
	- (void *)(uintptr_t)vd->vdev_id, 0,
	- ZFS_SPACE_CHECK_NONE, tx);
	+ (void *)(uintptr_t)vd->vdev_id, tx);
	} else if (vd->vdev_rebuild_cancel_wanted) {
	/*
	* The rebuild operation was canceled. This will occur when
	* a device participating in the rebuild is detached.
	*/
	dsl_sync_task_nowait(dp, vdev_rebuild_cancel_sync,
	- (void *)(uintptr_t)vd->vdev_id, 0,
	- ZFS_SPACE_CHECK_NONE, tx);
	+ (void *)(uintptr_t)vd->vdev_id, tx);
	} else if (vd->vdev_rebuild_reset_wanted) {
	/*
	* Reset the running rebuild without canceling and restarting
	* it. This will occur when a new device is attached and must
	* participate in the rebuild.
	*/
	dsl_sync_task_nowait(dp, vdev_rebuild_reset_sync,
	- (void *)(uintptr_t)vd->vdev_id, 0,
	- ZFS_SPACE_CHECK_NONE, tx);
	+ (void *)(uintptr_t)vd->vdev_id, tx);
	} else {
	/*
	* The rebuild operation should be suspended. This may occur
	* when detaching a child vdev or when exporting the pool. The
	* rebuild is left in the active state so it will be resumed.
	*/
	ASSERT(vrp->vrp_rebuild_state == VDEV_REBUILD_ACTIVE);
	vd->vdev_rebuilding = B_FALSE;
	}

	dmu_tx_commit(tx);

	vd->vdev_rebuild_thread = NULL;
	mutex_exit(&vd->vdev_rebuild_lock);
	spa_config_exit(spa, SCL_CONFIG, FTAG);

	cv_broadcast(&vd->vdev_rebuild_cv);

	thread_exit();
	}

	/*
	* Returns B_TRUE if any top-level vdev are rebuilding.
	*/
	boolean_t
	vdev_rebuild_active(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;
	boolean_t ret = B_FALSE;

	if (vd == spa->spa_root_vdev) {
	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	ret = vdev_rebuild_active(vd->vdev_child[i]);
	if (ret)
	return (ret);
	}
	} else if (vd->vdev_top_zap != 0) {
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	mutex_enter(&vd->vdev_rebuild_lock);
	ret = (vrp->vrp_rebuild_state == VDEV_REBUILD_ACTIVE);
	mutex_exit(&vd->vdev_rebuild_lock);
	}

	return (ret);
	}

	/*
	* Start a rebuild operation. The rebuild may be restarted when the
	* top-level vdev is currently actively rebuilding.
	*/
	void
	vdev_rebuild(vdev_t *vd)
	{
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp __maybe_unused = &vr->vr_rebuild_phys;

	ASSERT(vd->vdev_top == vd);
	ASSERT(vdev_is_concrete(vd));
	ASSERT(!vd->vdev_removing);
	ASSERT(spa_feature_is_enabled(vd->vdev_spa,
	SPA_FEATURE_DEVICE_REBUILD));

	mutex_enter(&vd->vdev_rebuild_lock);
	if (vd->vdev_rebuilding) {
	ASSERT3U(vrp->vrp_rebuild_state, ==, VDEV_REBUILD_ACTIVE);

	/*
	* Signal a running rebuild operation that it should restart
	* from the beginning because a new device was attached. The
	* vdev_rebuild_reset_wanted flag is set until the sync task
	* completes. This may be after the rebuild thread exits.
	*/
	if (!vd->vdev_rebuild_reset_wanted)
	vd->vdev_rebuild_reset_wanted = B_TRUE;
	} else {
	vdev_rebuild_initiate(vd);
	}
	mutex_exit(&vd->vdev_rebuild_lock);
	}

	static void
	vdev_rebuild_restart_impl(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	if (vd == spa->spa_root_vdev) {
	for (uint64_t i = 0; i < vd->vdev_children; i++)
	vdev_rebuild_restart_impl(vd->vdev_child[i]);

	} else if (vd->vdev_top_zap != 0) {
	vdev_rebuild_t *vr = &vd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	mutex_enter(&vd->vdev_rebuild_lock);
	if (vrp->vrp_rebuild_state == VDEV_REBUILD_ACTIVE &&
	vdev_writeable(vd) && !vd->vdev_rebuilding) {
	ASSERT(spa_feature_is_active(spa,
	SPA_FEATURE_DEVICE_REBUILD));
	vd->vdev_rebuilding = B_TRUE;
	vd->vdev_rebuild_thread = thread_create(NULL, 0,
	vdev_rebuild_thread, vd, 0, &p0, TS_RUN,
	maxclsyspri);
	}
	mutex_exit(&vd->vdev_rebuild_lock);
	}
	}

	/*
	* Conditionally restart all of the vdev_rebuild_thread's for a pool. The
	* feature flag must be active and the rebuild in the active state. This
	* cannot be used to start a new rebuild.
	*/
	void
	vdev_rebuild_restart(spa_t *spa)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	vdev_rebuild_restart_impl(spa->spa_root_vdev);
	}

	/*
	* Stop and wait for all of the vdev_rebuild_thread's associated with the
	* vdev tree provide to be terminated (canceled or stopped).
	*/
	void
	vdev_rebuild_stop_wait(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	if (vd == spa->spa_root_vdev) {
	for (uint64_t i = 0; i < vd->vdev_children; i++)
	vdev_rebuild_stop_wait(vd->vdev_child[i]);

	} else if (vd->vdev_top_zap != 0) {
	ASSERT(vd == vd->vdev_top);

	mutex_enter(&vd->vdev_rebuild_lock);
	if (vd->vdev_rebuild_thread != NULL) {
	vd->vdev_rebuild_exit_wanted = B_TRUE;
	while (vd->vdev_rebuilding) {
	cv_wait(&vd->vdev_rebuild_cv,
	&vd->vdev_rebuild_lock);
	}
	vd->vdev_rebuild_exit_wanted = B_FALSE;
	}
	mutex_exit(&vd->vdev_rebuild_lock);
	}
	}

	/*
	* Stop all rebuild operations but leave them in the active state so they
	* will be resumed when importing the pool.
	*/
	void
	vdev_rebuild_stop_all(spa_t *spa)
	{
	vdev_rebuild_stop_wait(spa->spa_root_vdev);
	}

	/*
	* Rebuild statistics reported per top-level vdev.
	*/
	int
	vdev_rebuild_get_stats(vdev_t tvd, vdev_rebuild_stat_t vrs)
	{
	spa_t *spa = tvd->vdev_spa;

	if (!spa_feature_is_enabled(spa, SPA_FEATURE_DEVICE_REBUILD))
	return (SET_ERROR(ENOTSUP));

	if (tvd != tvd->vdev_top \|\| tvd->vdev_top_zap == 0)
	return (SET_ERROR(EINVAL));

	int error = zap_contains(spa_meta_objset(spa),
	tvd->vdev_top_zap, VDEV_TOP_ZAP_VDEV_REBUILD_PHYS);

	if (error == ENOENT) {
	bzero(vrs, sizeof (vdev_rebuild_stat_t));
	vrs->vrs_state = VDEV_REBUILD_NONE;
	error = 0;
	} else if (error == 0) {
	vdev_rebuild_t *vr = &tvd->vdev_rebuild_config;
	vdev_rebuild_phys_t *vrp = &vr->vr_rebuild_phys;

	mutex_enter(&tvd->vdev_rebuild_lock);
	vrs->vrs_state = vrp->vrp_rebuild_state;
	vrs->vrs_start_time = vrp->vrp_start_time;
	vrs->vrs_end_time = vrp->vrp_end_time;
	vrs->vrs_scan_time_ms = vrp->vrp_scan_time_ms;
	vrs->vrs_bytes_scanned = vrp->vrp_bytes_scanned;
	vrs->vrs_bytes_issued = vrp->vrp_bytes_issued;
	vrs->vrs_bytes_rebuilt = vrp->vrp_bytes_rebuilt;
	vrs->vrs_bytes_est = vrp->vrp_bytes_est;
	vrs->vrs_errors = vrp->vrp_errors;
	vrs->vrs_pass_time_ms = NSEC2MSEC(gethrtime() -
	vr->vr_pass_start_time);
	vrs->vrs_pass_bytes_scanned = vr->vr_pass_bytes_scanned;
	vrs->vrs_pass_bytes_issued = vr->vr_pass_bytes_issued;
	mutex_exit(&tvd->vdev_rebuild_lock);
	}

	return (error);
	}

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs, zfs_, rebuild_max_segment, ULONG, ZMOD_RW,
	"Max segment size in bytes of rebuild reads");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/vdev_removal.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev_removal.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev_removal.c (revision 365892)
	@@ -1,2340 +1,2339 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Copyright (c) 2011, 2019 by Delphix. All rights reserved.
	* Copyright (c) 2019, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
	*/

	#include <sys/zfs_context.h>
	#include <sys/spa_impl.h>
	#include <sys/dmu.h>
	#include <sys/dmu_tx.h>
	#include <sys/zap.h>
	#include <sys/vdev_impl.h>
	#include <sys/metaslab.h>
	#include <sys/metaslab_impl.h>
	#include <sys/uberblock_impl.h>
	#include <sys/txg.h>
	#include <sys/avl.h>
	#include <sys/bpobj.h>
	#include <sys/dsl_pool.h>
	#include <sys/dsl_synctask.h>
	#include <sys/dsl_dir.h>
	#include <sys/arc.h>
	#include <sys/zfeature.h>
	#include <sys/vdev_indirect_births.h>
	#include <sys/vdev_indirect_mapping.h>
	#include <sys/abd.h>
	#include <sys/vdev_initialize.h>
	#include <sys/vdev_trim.h>
	#include <sys/trace_zfs.h>

	/*
	* This file contains the necessary logic to remove vdevs from a
	* storage pool. Currently, the only devices that can be removed
	* are log, cache, and spare devices; and top level vdevs from a pool
	* w/o raidz or mirrors. (Note that members of a mirror can be removed
	* by the detach operation.)
	*
	* Log vdevs are removed by evacuating them and then turning the vdev
	* into a hole vdev while holding spa config locks.
	*
	* Top level vdevs are removed and converted into an indirect vdev via
	* a multi-step process:
	*
	* - Disable allocations from this device (spa_vdev_remove_top).
	*
	* - From a new thread (spa_vdev_remove_thread), copy data from
	* the removing vdev to a different vdev. The copy happens in open
	* context (spa_vdev_copy_impl) and issues a sync task
	* (vdev_mapping_sync) so the sync thread can update the partial
	* indirect mappings in core and on disk.
	*
	* - If a free happens during a removal, it is freed from the
	* removing vdev, and if it has already been copied, from the new
	* location as well (free_from_removing_vdev).
	*
	* - After the removal is completed, the copy thread converts the vdev
	* into an indirect vdev (vdev_remove_complete) before instructing
	* the sync thread to destroy the space maps and finish the removal
	* (spa_finish_removal).
	*/

	typedef struct vdev_copy_arg {
	metaslab_t *vca_msp;
	uint64_t vca_outstanding_bytes;
	uint64_t vca_read_error_bytes;
	uint64_t vca_write_error_bytes;
	kcondvar_t vca_cv;
	kmutex_t vca_lock;
	} vdev_copy_arg_t;

	/*
	* The maximum amount of memory we can use for outstanding i/o while
	* doing a device removal. This determines how much i/o we can have
	* in flight concurrently.
	*/
	int zfs_remove_max_copy_bytes = 64 * 1024 * 1024;

	/*
	* The largest contiguous segment that we will attempt to allocate when
	* removing a device. This can be no larger than SPA_MAXBLOCKSIZE. If
	* there is a performance problem with attempting to allocate large blocks,
	* consider decreasing this.
	*
	* See also the accessor function spa_remove_max_segment().
	*/
	int zfs_remove_max_segment = SPA_MAXBLOCKSIZE;

	/*
	* Ignore hard IO errors during device removal. When set if a device
	* encounters hard IO error during the removal process the removal will
	* not be cancelled. This can result in a normally recoverable block
	* becoming permanently damaged and is not recommended.
	*/
	int zfs_removal_ignore_errors = 0;

	/*
	* Allow a remap segment to span free chunks of at most this size. The main
	* impact of a larger span is that we will read and write larger, more
	* contiguous chunks, with more "unnecessary" data -- trading off bandwidth
	* for iops. The value here was chosen to align with
	* zfs_vdev_read_gap_limit, which is a similar concept when doing regular
	* reads (but there's no reason it has to be the same).
	*
	* Additionally, a higher span will have the following relatively minor
	* effects:
	* - the mapping will be smaller, since one entry can cover more allocated
	* segments
	* - more of the fragmentation in the removing device will be preserved
	* - we'll do larger allocations, which may fail and fall back on smaller
	* allocations
	*/
	int vdev_removal_max_span = 32 * 1024;

	/*
	* This is used by the test suite so that it can ensure that certain
	* actions happen while in the middle of a removal.
	*/
	int zfs_removal_suspend_progress = 0;

	#define VDEV_REMOVAL_ZAP_OBJS "lzap"

	static void spa_vdev_remove_thread(void *arg);
	static int spa_vdev_remove_cancel_impl(spa_t *spa);

	static void
	spa_sync_removing_state(spa_t spa, dmu_tx_t tx)
	{
	VERIFY0(zap_update(spa->spa_dsl_pool->dp_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_REMOVING, sizeof (uint64_t),
	sizeof (spa->spa_removing_phys) / sizeof (uint64_t),
	&spa->spa_removing_phys, tx));
	}

	static nvlist_t *
	spa_nvlist_lookup_by_guid(nvlist_t **nvpp, int count, uint64_t target_guid)
	{
	for (int i = 0; i < count; i++) {
	uint64_t guid =
	fnvlist_lookup_uint64(nvpp[i], ZPOOL_CONFIG_GUID);

	if (guid == target_guid)
	return (nvpp[i]);
	}

	return (NULL);
	}

	static void
	spa_vdev_remove_aux(nvlist_t config, char name, nvlist_t **dev, int count,
	nvlist_t *dev_to_remove)
	{
	nvlist_t **newdev = NULL;

	if (count > 1)
	newdev = kmem_alloc((count - 1) * sizeof (void *), KM_SLEEP);

	for (int i = 0, j = 0; i < count; i++) {
	if (dev[i] == dev_to_remove)
	continue;
	VERIFY(nvlist_dup(dev[i], &newdev[j++], KM_SLEEP) == 0);
	}

	VERIFY(nvlist_remove(config, name, DATA_TYPE_NVLIST_ARRAY) == 0);
	VERIFY(nvlist_add_nvlist_array(config, name, newdev, count - 1) == 0);

	for (int i = 0; i < count - 1; i++)
	nvlist_free(newdev[i]);

	if (count > 1)
	kmem_free(newdev, (count - 1) * sizeof (void *));
	}

	static spa_vdev_removal_t *
	spa_vdev_removal_create(vdev_t *vd)
	{
	spa_vdev_removal_t svr = kmem_zalloc(sizeof (svr), KM_SLEEP);
	mutex_init(&svr->svr_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&svr->svr_cv, NULL, CV_DEFAULT, NULL);
	svr->svr_allocd_segs = range_tree_create(NULL, RANGE_SEG64, NULL, 0, 0);
	svr->svr_vdev_id = vd->vdev_id;

	for (int i = 0; i < TXG_SIZE; i++) {
	svr->svr_frees[i] = range_tree_create(NULL, RANGE_SEG64, NULL,
	0, 0);
	list_create(&svr->svr_new_segments[i],
	sizeof (vdev_indirect_mapping_entry_t),
	offsetof(vdev_indirect_mapping_entry_t, vime_node));
	}

	return (svr);
	}

	void
	spa_vdev_removal_destroy(spa_vdev_removal_t *svr)
	{
	for (int i = 0; i < TXG_SIZE; i++) {
	ASSERT0(svr->svr_bytes_done[i]);
	ASSERT0(svr->svr_max_offset_to_sync[i]);
	range_tree_destroy(svr->svr_frees[i]);
	list_destroy(&svr->svr_new_segments[i]);
	}

	range_tree_destroy(svr->svr_allocd_segs);
	mutex_destroy(&svr->svr_lock);
	cv_destroy(&svr->svr_cv);
	kmem_free(svr, sizeof (*svr));
	}

	/*
	* This is called as a synctask in the txg in which we will mark this vdev
	* as removing (in the config stored in the MOS).
	*
	* It begins the evacuation of a toplevel vdev by:
	* - initializing the spa_removing_phys which tracks this removal
	* - computing the amount of space to remove for accounting purposes
	* - dirtying all dbufs in the spa_config_object
	* - creating the spa_vdev_removal
	* - starting the spa_vdev_remove_thread
	*/
	static void
	vdev_remove_initiate_sync(void arg, dmu_tx_t tx)
	{
	int vdev_id = (uintptr_t)arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, vdev_id);
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;
	objset_t *mos = spa->spa_dsl_pool->dp_meta_objset;
	spa_vdev_removal_t *svr = NULL;
	uint64_t txg __maybe_unused = dmu_tx_get_txg(tx);

	ASSERT3P(vd->vdev_ops, !=, &vdev_raidz_ops);
	svr = spa_vdev_removal_create(vd);

	ASSERT(vd->vdev_removing);
	ASSERT3P(vd->vdev_indirect_mapping, ==, NULL);

	spa_feature_incr(spa, SPA_FEATURE_DEVICE_REMOVAL, tx);
	if (spa_feature_is_enabled(spa, SPA_FEATURE_OBSOLETE_COUNTS)) {
	/*
	* By activating the OBSOLETE_COUNTS feature, we prevent
	* the pool from being downgraded and ensure that the
	* refcounts are precise.
	*/
	spa_feature_incr(spa, SPA_FEATURE_OBSOLETE_COUNTS, tx);
	uint64_t one = 1;
	VERIFY0(zap_add(spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_OBSOLETE_COUNTS_ARE_PRECISE, sizeof (one), 1,
	&one, tx));
	boolean_t are_precise __maybe_unused;
	ASSERT0(vdev_obsolete_counts_are_precise(vd, &are_precise));
	ASSERT3B(are_precise, ==, B_TRUE);
	}

	vic->vic_mapping_object = vdev_indirect_mapping_alloc(mos, tx);
	vd->vdev_indirect_mapping =
	vdev_indirect_mapping_open(mos, vic->vic_mapping_object);
	vic->vic_births_object = vdev_indirect_births_alloc(mos, tx);
	vd->vdev_indirect_births =
	vdev_indirect_births_open(mos, vic->vic_births_object);
	spa->spa_removing_phys.sr_removing_vdev = vd->vdev_id;
	spa->spa_removing_phys.sr_start_time = gethrestime_sec();
	spa->spa_removing_phys.sr_end_time = 0;
	spa->spa_removing_phys.sr_state = DSS_SCANNING;
	spa->spa_removing_phys.sr_to_copy = 0;
	spa->spa_removing_phys.sr_copied = 0;

	/*
	* Note: We can't use vdev_stat's vs_alloc for sr_to_copy, because
	* there may be space in the defer tree, which is free, but still
	* counted in vs_alloc.
	*/
	for (uint64_t i = 0; i < vd->vdev_ms_count; i++) {
	metaslab_t *ms = vd->vdev_ms[i];
	if (ms->ms_sm == NULL)
	continue;

	spa->spa_removing_phys.sr_to_copy +=
	metaslab_allocated_space(ms);

	/*
	* Space which we are freeing this txg does not need to
	* be copied.
	*/
	spa->spa_removing_phys.sr_to_copy -=
	range_tree_space(ms->ms_freeing);

	ASSERT0(range_tree_space(ms->ms_freed));
	for (int t = 0; t < TXG_SIZE; t++)
	ASSERT0(range_tree_space(ms->ms_allocating[t]));
	}

	/*
	* Sync tasks are called before metaslab_sync(), so there should
	* be no already-synced metaslabs in the TXG_CLEAN list.
	*/
	ASSERT3P(txg_list_head(&vd->vdev_ms_list, TXG_CLEAN(txg)), ==, NULL);

	spa_sync_removing_state(spa, tx);

	/*
	* All blocks that we need to read the most recent mapping must be
	* stored on concrete vdevs. Therefore, we must dirty anything that
	* is read before spa_remove_init(). Specifically, the
	* spa_config_object. (Note that although we already modified the
	* spa_config_object in spa_sync_removing_state, that may not have
	* modified all blocks of the object.)
	*/
	dmu_object_info_t doi;
	VERIFY0(dmu_object_info(mos, DMU_POOL_DIRECTORY_OBJECT, &doi));
	for (uint64_t offset = 0; offset < doi.doi_max_offset; ) {
	dmu_buf_t *dbuf;
	VERIFY0(dmu_buf_hold(mos, DMU_POOL_DIRECTORY_OBJECT,
	offset, FTAG, &dbuf, 0));
	dmu_buf_will_dirty(dbuf, tx);
	offset += dbuf->db_size;
	dmu_buf_rele(dbuf, FTAG);
	}

	/*
	* Now that we've allocated the im_object, dirty the vdev to ensure
	* that the object gets written to the config on disk.
	*/
	vdev_config_dirty(vd);

	zfs_dbgmsg("starting removal thread for vdev %llu (%px) in txg %llu "
	"im_obj=%llu", vd->vdev_id, vd, dmu_tx_get_txg(tx),
	vic->vic_mapping_object);

	spa_history_log_internal(spa, "vdev remove started", tx,
	"%s vdev %llu %s", spa_name(spa), (u_longlong_t)vd->vdev_id,
	(vd->vdev_path != NULL) ? vd->vdev_path : "-");
	/*
	* Setting spa_vdev_removal causes subsequent frees to call
	* free_from_removing_vdev(). Note that we don't need any locking
	* because we are the sync thread, and metaslab_free_impl() is only
	* called from syncing context (potentially from a zio taskq thread,
	* but in any case only when there are outstanding free i/os, which
	* there are not).
	*/
	ASSERT3P(spa->spa_vdev_removal, ==, NULL);
	spa->spa_vdev_removal = svr;
	svr->svr_thread = thread_create(NULL, 0,
	spa_vdev_remove_thread, spa, 0, &p0, TS_RUN, minclsyspri);
	}

	/*
	* When we are opening a pool, we must read the mapping for each
	* indirect vdev in order from most recently removed to least
	* recently removed. We do this because the blocks for the mapping
	* of older indirect vdevs may be stored on more recently removed vdevs.
	* In order to read each indirect mapping object, we must have
	* initialized all more recently removed vdevs.
	*/
	int
	spa_remove_init(spa_t *spa)
	{
	int error;

	error = zap_lookup(spa->spa_dsl_pool->dp_meta_objset,
	DMU_POOL_DIRECTORY_OBJECT,
	DMU_POOL_REMOVING, sizeof (uint64_t),
	sizeof (spa->spa_removing_phys) / sizeof (uint64_t),
	&spa->spa_removing_phys);

	if (error == ENOENT) {
	spa->spa_removing_phys.sr_state = DSS_NONE;
	spa->spa_removing_phys.sr_removing_vdev = -1;
	spa->spa_removing_phys.sr_prev_indirect_vdev = -1;
	spa->spa_indirect_vdevs_loaded = B_TRUE;
	return (0);
	} else if (error != 0) {
	return (error);
	}

	if (spa->spa_removing_phys.sr_state == DSS_SCANNING) {
	/*
	* We are currently removing a vdev. Create and
	* initialize a spa_vdev_removal_t from the bonus
	* buffer of the removing vdevs vdev_im_object, and
	* initialize its partial mapping.
	*/
	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);
	vdev_t *vd = vdev_lookup_top(spa,
	spa->spa_removing_phys.sr_removing_vdev);

	if (vd == NULL) {
	spa_config_exit(spa, SCL_STATE, FTAG);
	return (EINVAL);
	}

	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;

	ASSERT(vdev_is_concrete(vd));
	spa_vdev_removal_t *svr = spa_vdev_removal_create(vd);
	ASSERT3U(svr->svr_vdev_id, ==, vd->vdev_id);
	ASSERT(vd->vdev_removing);

	vd->vdev_indirect_mapping = vdev_indirect_mapping_open(
	spa->spa_meta_objset, vic->vic_mapping_object);
	vd->vdev_indirect_births = vdev_indirect_births_open(
	spa->spa_meta_objset, vic->vic_births_object);
	spa_config_exit(spa, SCL_STATE, FTAG);

	spa->spa_vdev_removal = svr;
	}

	spa_config_enter(spa, SCL_STATE, FTAG, RW_READER);
	uint64_t indirect_vdev_id =
	spa->spa_removing_phys.sr_prev_indirect_vdev;
	while (indirect_vdev_id != UINT64_MAX) {
	vdev_t *vd = vdev_lookup_top(spa, indirect_vdev_id);
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;

	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);
	vd->vdev_indirect_mapping = vdev_indirect_mapping_open(
	spa->spa_meta_objset, vic->vic_mapping_object);
	vd->vdev_indirect_births = vdev_indirect_births_open(
	spa->spa_meta_objset, vic->vic_births_object);

	indirect_vdev_id = vic->vic_prev_indirect_vdev;
	}
	spa_config_exit(spa, SCL_STATE, FTAG);

	/*
	* Now that we've loaded all the indirect mappings, we can allow
	* reads from other blocks (e.g. via predictive prefetch).
	*/
	spa->spa_indirect_vdevs_loaded = B_TRUE;
	return (0);
	}

	void
	spa_restart_removal(spa_t *spa)
	{
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;

	if (svr == NULL)
	return;

	/*
	* In general when this function is called there is no
	* removal thread running. The only scenario where this
	* is not true is during spa_import() where this function
	* is called twice [once from spa_import_impl() and
	* spa_async_resume()]. Thus, in the scenario where we
	* import a pool that has an ongoing removal we don't
	* want to spawn a second thread.
	*/
	if (svr->svr_thread != NULL)
	return;

	if (!spa_writeable(spa))
	return;

	zfs_dbgmsg("restarting removal of %llu", svr->svr_vdev_id);
	svr->svr_thread = thread_create(NULL, 0, spa_vdev_remove_thread, spa,
	0, &p0, TS_RUN, minclsyspri);
	}

	/*
	* Process freeing from a device which is in the middle of being removed.
	* We must handle this carefully so that we attempt to copy freed data,
	* and we correctly free already-copied data.
	*/
	void
	free_from_removing_vdev(vdev_t *vd, uint64_t offset, uint64_t size)
	{
	spa_t *spa = vd->vdev_spa;
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	uint64_t txg = spa_syncing_txg(spa);
	uint64_t max_offset_yet = 0;

	ASSERT(vd->vdev_indirect_config.vic_mapping_object != 0);
	ASSERT3U(vd->vdev_indirect_config.vic_mapping_object, ==,
	vdev_indirect_mapping_object(vim));
	ASSERT3U(vd->vdev_id, ==, svr->svr_vdev_id);

	mutex_enter(&svr->svr_lock);

	/*
	* Remove the segment from the removing vdev's spacemap. This
	* ensures that we will not attempt to copy this space (if the
	* removal thread has not yet visited it), and also ensures
	* that we know what is actually allocated on the new vdevs
	* (needed if we cancel the removal).
	*
	* Note: we must do the metaslab_free_concrete() with the svr_lock
	* held, so that the remove_thread can not load this metaslab and then
	* visit this offset between the time that we metaslab_free_concrete()
	* and when we check to see if it has been visited.
	*
	* Note: The checkpoint flag is set to false as having/taking
	* a checkpoint and removing a device can't happen at the same
	* time.
	*/
	ASSERT(!spa_has_checkpoint(spa));
	metaslab_free_concrete(vd, offset, size, B_FALSE);

	uint64_t synced_size = 0;
	uint64_t synced_offset = 0;
	uint64_t max_offset_synced = vdev_indirect_mapping_max_offset(vim);
	if (offset < max_offset_synced) {
	/*
	* The mapping for this offset is already on disk.
	* Free from the new location.
	*
	* Note that we use svr_max_synced_offset because it is
	* updated atomically with respect to the in-core mapping.
	* By contrast, vim_max_offset is not.
	*
	* This block may be split between a synced entry and an
	* in-flight or unvisited entry. Only process the synced
	* portion of it here.
	*/
	synced_size = MIN(size, max_offset_synced - offset);
	synced_offset = offset;

	ASSERT3U(max_offset_yet, <=, max_offset_synced);
	max_offset_yet = max_offset_synced;

	DTRACE_PROBE3(remove__free__synced,
	spa_t *, spa,
	uint64_t, offset,
	uint64_t, synced_size);

	size -= synced_size;
	offset += synced_size;
	}

	/*
	* Look at all in-flight txgs starting from the currently syncing one
	* and see if a section of this free is being copied. By starting from
	* this txg and iterating forward, we might find that this region
	* was copied in two different txgs and handle it appropriately.
	*/
	for (int i = 0; i < TXG_CONCURRENT_STATES; i++) {
	int txgoff = (txg + i) & TXG_MASK;
	if (size > 0 && offset < svr->svr_max_offset_to_sync[txgoff]) {
	/*
	* The mapping for this offset is in flight, and
	* will be synced in txg+i.
	*/
	uint64_t inflight_size = MIN(size,
	svr->svr_max_offset_to_sync[txgoff] - offset);

	DTRACE_PROBE4(remove__free__inflight,
	spa_t *, spa,
	uint64_t, offset,
	uint64_t, inflight_size,
	uint64_t, txg + i);

	/*
	* We copy data in order of increasing offset.
	* Therefore the max_offset_to_sync[] must increase
	* (or be zero, indicating that nothing is being
	* copied in that txg).
	*/
	if (svr->svr_max_offset_to_sync[txgoff] != 0) {
	ASSERT3U(svr->svr_max_offset_to_sync[txgoff],
	>=, max_offset_yet);
	max_offset_yet =
	svr->svr_max_offset_to_sync[txgoff];
	}

	/*
	* We've already committed to copying this segment:
	* we have allocated space elsewhere in the pool for
	* it and have an IO outstanding to copy the data. We
	* cannot free the space before the copy has
	* completed, or else the copy IO might overwrite any
	* new data. To free that space, we record the
	* segment in the appropriate svr_frees tree and free
	* the mapped space later, in the txg where we have
	* completed the copy and synced the mapping (see
	* vdev_mapping_sync).
	*/
	range_tree_add(svr->svr_frees[txgoff],
	offset, inflight_size);
	size -= inflight_size;
	offset += inflight_size;

	/*
	* This space is already accounted for as being
	* done, because it is being copied in txg+i.
	* However, if i!=0, then it is being copied in
	* a future txg. If we crash after this txg
	* syncs but before txg+i syncs, then the space
	* will be free. Therefore we must account
	* for the space being done in this txg
	* (when it is freed) rather than the future txg
	* (when it will be copied).
	*/
	ASSERT3U(svr->svr_bytes_done[txgoff], >=,
	inflight_size);
	svr->svr_bytes_done[txgoff] -= inflight_size;
	svr->svr_bytes_done[txg & TXG_MASK] += inflight_size;
	}
	}
	ASSERT0(svr->svr_max_offset_to_sync[TXG_CLEAN(txg) & TXG_MASK]);

	if (size > 0) {
	/*
	* The copy thread has not yet visited this offset. Ensure
	* that it doesn't.
	*/

	DTRACE_PROBE3(remove__free__unvisited,
	spa_t *, spa,
	uint64_t, offset,
	uint64_t, size);

	if (svr->svr_allocd_segs != NULL)
	range_tree_clear(svr->svr_allocd_segs, offset, size);

	/*
	* Since we now do not need to copy this data, for
	* accounting purposes we have done our job and can count
	* it as completed.
	*/
	svr->svr_bytes_done[txg & TXG_MASK] += size;
	}
	mutex_exit(&svr->svr_lock);

	/*
	* Now that we have dropped svr_lock, process the synced portion
	* of this free.
	*/
	if (synced_size > 0) {
	vdev_indirect_mark_obsolete(vd, synced_offset, synced_size);

	/*
	* Note: this can only be called from syncing context,
	* and the vdev_indirect_mapping is only changed from the
	* sync thread, so we don't need svr_lock while doing
	* metaslab_free_impl_cb.
	*/
	boolean_t checkpoint = B_FALSE;
	vdev_indirect_ops.vdev_op_remap(vd, synced_offset, synced_size,
	metaslab_free_impl_cb, &checkpoint);
	}
	}

	/*
	* Stop an active removal and update the spa_removing phys.
	*/
	static void
	spa_finish_removal(spa_t spa, dsl_scan_state_t state, dmu_tx_t tx)
	{
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;
	ASSERT3U(dmu_tx_get_txg(tx), ==, spa_syncing_txg(spa));

	/* Ensure the removal thread has completed before we free the svr. */
	spa_vdev_remove_suspend(spa);

	ASSERT(state == DSS_FINISHED \|\| state == DSS_CANCELED);

	if (state == DSS_FINISHED) {
	spa_removing_phys_t *srp = &spa->spa_removing_phys;
	vdev_t *vd = vdev_lookup_top(spa, svr->svr_vdev_id);
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;

	if (srp->sr_prev_indirect_vdev != -1) {
	vdev_t *pvd;
	pvd = vdev_lookup_top(spa,
	srp->sr_prev_indirect_vdev);
	ASSERT3P(pvd->vdev_ops, ==, &vdev_indirect_ops);
	}

	vic->vic_prev_indirect_vdev = srp->sr_prev_indirect_vdev;
	srp->sr_prev_indirect_vdev = vd->vdev_id;
	}
	spa->spa_removing_phys.sr_state = state;
	spa->spa_removing_phys.sr_end_time = gethrestime_sec();

	spa->spa_vdev_removal = NULL;
	spa_vdev_removal_destroy(svr);

	spa_sync_removing_state(spa, tx);
	spa_notify_waiters(spa);

	vdev_config_dirty(spa->spa_root_vdev);
	}

	static void
	free_mapped_segment_cb(void *arg, uint64_t offset, uint64_t size)
	{
	vdev_t *vd = arg;
	vdev_indirect_mark_obsolete(vd, offset, size);
	boolean_t checkpoint = B_FALSE;
	vdev_indirect_ops.vdev_op_remap(vd, offset, size,
	metaslab_free_impl_cb, &checkpoint);
	}

	/*
	* On behalf of the removal thread, syncs an incremental bit more of
	* the indirect mapping to disk and updates the in-memory mapping.
	* Called as a sync task in every txg that the removal thread makes progress.
	*/
	static void
	vdev_mapping_sync(void arg, dmu_tx_t tx)
	{
	spa_vdev_removal_t *svr = arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, svr->svr_vdev_id);
	vdev_indirect_config_t *vic __maybe_unused = &vd->vdev_indirect_config;
	uint64_t txg = dmu_tx_get_txg(tx);
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;

	ASSERT(vic->vic_mapping_object != 0);
	ASSERT3U(txg, ==, spa_syncing_txg(spa));

	vdev_indirect_mapping_add_entries(vim,
	&svr->svr_new_segments[txg & TXG_MASK], tx);
	vdev_indirect_births_add_entry(vd->vdev_indirect_births,
	vdev_indirect_mapping_max_offset(vim), dmu_tx_get_txg(tx), tx);

	/*
	* Free the copied data for anything that was freed while the
	* mapping entries were in flight.
	*/
	mutex_enter(&svr->svr_lock);
	range_tree_vacate(svr->svr_frees[txg & TXG_MASK],
	free_mapped_segment_cb, vd);
	ASSERT3U(svr->svr_max_offset_to_sync[txg & TXG_MASK], >=,
	vdev_indirect_mapping_max_offset(vim));
	svr->svr_max_offset_to_sync[txg & TXG_MASK] = 0;
	mutex_exit(&svr->svr_lock);

	spa_sync_removing_state(spa, tx);
	}

	typedef struct vdev_copy_segment_arg {
	spa_t *vcsa_spa;
	dva_t *vcsa_dest_dva;
	uint64_t vcsa_txg;
	range_tree_t *vcsa_obsolete_segs;
	} vdev_copy_segment_arg_t;

	static void
	unalloc_seg(void *arg, uint64_t start, uint64_t size)
	{
	vdev_copy_segment_arg_t *vcsa = arg;
	spa_t *spa = vcsa->vcsa_spa;
	blkptr_t bp = { { { {0} } } };

	BP_SET_BIRTH(&bp, TXG_INITIAL, TXG_INITIAL);
	BP_SET_LSIZE(&bp, size);
	BP_SET_PSIZE(&bp, size);
	BP_SET_COMPRESS(&bp, ZIO_COMPRESS_OFF);
	BP_SET_CHECKSUM(&bp, ZIO_CHECKSUM_OFF);
	BP_SET_TYPE(&bp, DMU_OT_NONE);
	BP_SET_LEVEL(&bp, 0);
	BP_SET_DEDUP(&bp, 0);
	BP_SET_BYTEORDER(&bp, ZFS_HOST_BYTEORDER);

	DVA_SET_VDEV(&bp.blk_dva[0], DVA_GET_VDEV(vcsa->vcsa_dest_dva));
	DVA_SET_OFFSET(&bp.blk_dva[0],
	DVA_GET_OFFSET(vcsa->vcsa_dest_dva) + start);
	DVA_SET_ASIZE(&bp.blk_dva[0], size);

	zio_free(spa, vcsa->vcsa_txg, &bp);
	}

	/*
	* All reads and writes associated with a call to spa_vdev_copy_segment()
	* are done.
	*/
	static void
	spa_vdev_copy_segment_done(zio_t *zio)
	{
	vdev_copy_segment_arg_t *vcsa = zio->io_private;

	range_tree_vacate(vcsa->vcsa_obsolete_segs,
	unalloc_seg, vcsa);
	range_tree_destroy(vcsa->vcsa_obsolete_segs);
	kmem_free(vcsa, sizeof (*vcsa));

	spa_config_exit(zio->io_spa, SCL_STATE, zio->io_spa);
	}

	/*
	* The write of the new location is done.
	*/
	static void
	spa_vdev_copy_segment_write_done(zio_t *zio)
	{
	vdev_copy_arg_t *vca = zio->io_private;

	abd_free(zio->io_abd);

	mutex_enter(&vca->vca_lock);
	vca->vca_outstanding_bytes -= zio->io_size;

	if (zio->io_error != 0)
	vca->vca_write_error_bytes += zio->io_size;

	cv_signal(&vca->vca_cv);
	mutex_exit(&vca->vca_lock);
	}

	/*
	* The read of the old location is done. The parent zio is the write to
	* the new location. Allow it to start.
	*/
	static void
	spa_vdev_copy_segment_read_done(zio_t *zio)
	{
	vdev_copy_arg_t *vca = zio->io_private;

	if (zio->io_error != 0) {
	mutex_enter(&vca->vca_lock);
	vca->vca_read_error_bytes += zio->io_size;
	mutex_exit(&vca->vca_lock);
	}

	zio_nowait(zio_unique_parent(zio));
	}

	/*
	* If the old and new vdevs are mirrors, we will read both sides of the old
	* mirror, and write each copy to the corresponding side of the new mirror.
	* If the old and new vdevs have a different number of children, we will do
	* this as best as possible. Since we aren't verifying checksums, this
	* ensures that as long as there's a good copy of the data, we'll have a
	* good copy after the removal, even if there's silent damage to one side
	* of the mirror. If we're removing a mirror that has some silent damage,
	* we'll have exactly the same damage in the new location (assuming that
	* the new location is also a mirror).
	*
	* We accomplish this by creating a tree of zio_t's, with as many writes as
	* there are "children" of the new vdev (a non-redundant vdev counts as one
	* child, a 2-way mirror has 2 children, etc). Each write has an associated
	* read from a child of the old vdev. Typically there will be the same
	* number of children of the old and new vdevs. However, if there are more
	* children of the new vdev, some child(ren) of the old vdev will be issued
	* multiple reads. If there are more children of the old vdev, some copies
	* will be dropped.
	*
	* For example, the tree of zio_t's for a 2-way mirror is:
	*
	* null
	* / \
	* write(new vdev, child 0) write(new vdev, child 1)
	* \| \|
	* read(old vdev, child 0) read(old vdev, child 1)
	*
	* Child zio's complete before their parents complete. However, zio's
	* created with zio_vdev_child_io() may be issued before their children
	* complete. In this case we need to make sure that the children (reads)
	* complete before the parents (writes) are issued. We do this by not
	* calling zio_nowait() on each write until its corresponding read has
	* completed.
	*
	* The spa_config_lock must be held while zio's created by
	* zio_vdev_child_io() are in progress, to ensure that the vdev tree does
	* not change (e.g. due to a concurrent "zpool attach/detach"). The "null"
	* zio is needed to release the spa_config_lock after all the reads and
	* writes complete. (Note that we can't grab the config lock for each read,
	* because it is not reentrant - we could deadlock with a thread waiting
	* for a write lock.)
	*/
	static void
	spa_vdev_copy_one_child(vdev_copy_arg_t vca, zio_t nzio,
	vdev_t *source_vd, uint64_t source_offset,
	vdev_t *dest_child_vd, uint64_t dest_offset, int dest_id, uint64_t size)
	{
	ASSERT3U(spa_config_held(nzio->io_spa, SCL_ALL, RW_READER), !=, 0);

	/*
	* If the destination child in unwritable then there is no point
	* in issuing the source reads which cannot be written.
	*/
	if (!vdev_writeable(dest_child_vd))
	return;

	mutex_enter(&vca->vca_lock);
	vca->vca_outstanding_bytes += size;
	mutex_exit(&vca->vca_lock);

	abd_t *abd = abd_alloc_for_io(size, B_FALSE);

	vdev_t *source_child_vd = NULL;
	if (source_vd->vdev_ops == &vdev_mirror_ops && dest_id != -1) {
	/*
	* Source and dest are both mirrors. Copy from the same
	* child id as we are copying to (wrapping around if there
	* are more dest children than source children). If the
	* preferred source child is unreadable select another.
	*/
	for (int i = 0; i < source_vd->vdev_children; i++) {
	source_child_vd = source_vd->vdev_child[
	(dest_id + i) % source_vd->vdev_children];
	if (vdev_readable(source_child_vd))
	break;
	}
	} else {
	source_child_vd = source_vd;
	}

	/*
	* There should always be at least one readable source child or
	* the pool would be in a suspended state. Somehow selecting an
	* unreadable child would result in IO errors, the removal process
	* being cancelled, and the pool reverting to its pre-removal state.
	*/
	ASSERT3P(source_child_vd, !=, NULL);

	zio_t *write_zio = zio_vdev_child_io(nzio, NULL,
	dest_child_vd, dest_offset, abd, size,
	ZIO_TYPE_WRITE, ZIO_PRIORITY_REMOVAL,
	ZIO_FLAG_CANFAIL,
	spa_vdev_copy_segment_write_done, vca);

	zio_nowait(zio_vdev_child_io(write_zio, NULL,
	source_child_vd, source_offset, abd, size,
	ZIO_TYPE_READ, ZIO_PRIORITY_REMOVAL,
	ZIO_FLAG_CANFAIL,
	spa_vdev_copy_segment_read_done, vca));
	}

	/*
	* Allocate a new location for this segment, and create the zio_t's to
	* read from the old location and write to the new location.
	*/
	static int
	spa_vdev_copy_segment(vdev_t vd, range_tree_t segs,
	uint64_t maxalloc, uint64_t txg,
	vdev_copy_arg_t vca, zio_alloc_list_t zal)
	{
	metaslab_group_t *mg = vd->vdev_mg;
	spa_t *spa = vd->vdev_spa;
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;
	vdev_indirect_mapping_entry_t *entry;
	dva_t dst = {{ 0 }};
	uint64_t start = range_tree_min(segs);
	ASSERT0(P2PHASE(start, 1 << spa->spa_min_ashift));

	ASSERT3U(maxalloc, <=, SPA_MAXBLOCKSIZE);
	ASSERT0(P2PHASE(maxalloc, 1 << spa->spa_min_ashift));

	uint64_t size = range_tree_span(segs);
	if (range_tree_span(segs) > maxalloc) {
	/*
	* We can't allocate all the segments. Prefer to end
	* the allocation at the end of a segment, thus avoiding
	* additional split blocks.
	*/
	range_seg_max_t search;
	zfs_btree_index_t where;
	rs_set_start(&search, segs, start + maxalloc);
	rs_set_end(&search, segs, start + maxalloc);
	(void) zfs_btree_find(&segs->rt_root, &search, &where);
	range_seg_t *rs = zfs_btree_prev(&segs->rt_root, &where,
	&where);
	if (rs != NULL) {
	size = rs_get_end(rs, segs) - start;
	} else {
	/*
	* There are no segments that end before maxalloc.
	* I.e. the first segment is larger than maxalloc,
	* so we must split it.
	*/
	size = maxalloc;
	}
	}
	ASSERT3U(size, <=, maxalloc);
	ASSERT0(P2PHASE(size, 1 << spa->spa_min_ashift));

	/*
	* An allocation class might not have any remaining vdevs or space
	*/
	metaslab_class_t *mc = mg->mg_class;
	if (mc != spa_normal_class(spa) && mc->mc_groups <= 1)
	mc = spa_normal_class(spa);
	int error = metaslab_alloc_dva(spa, mc, size, &dst, 0, NULL, txg, 0,
	zal, 0);
	if (error == ENOSPC && mc != spa_normal_class(spa)) {
	error = metaslab_alloc_dva(spa, spa_normal_class(spa), size,
	&dst, 0, NULL, txg, 0, zal, 0);
	}
	if (error != 0)
	return (error);

	/*
	* Determine the ranges that are not actually needed. Offsets are
	* relative to the start of the range to be copied (i.e. relative to the
	* local variable "start").
	*/
	range_tree_t *obsolete_segs = range_tree_create(NULL, RANGE_SEG64, NULL,
	0, 0);

	zfs_btree_index_t where;
	range_seg_t *rs = zfs_btree_first(&segs->rt_root, &where);
	ASSERT3U(rs_get_start(rs, segs), ==, start);
	uint64_t prev_seg_end = rs_get_end(rs, segs);
	while ((rs = zfs_btree_next(&segs->rt_root, &where, &where)) != NULL) {
	if (rs_get_start(rs, segs) >= start + size) {
	break;
	} else {
	range_tree_add(obsolete_segs,
	prev_seg_end - start,
	rs_get_start(rs, segs) - prev_seg_end);
	}
	prev_seg_end = rs_get_end(rs, segs);
	}
	/* We don't end in the middle of an obsolete range */
	ASSERT3U(start + size, <=, prev_seg_end);

	range_tree_clear(segs, start, size);

	/*
	* We can't have any padding of the allocated size, otherwise we will
	* misunderstand what's allocated, and the size of the mapping. We
	* prevent padding by ensuring that all devices in the pool have the
	* same ashift, and the allocation size is a multiple of the ashift.
	*/
	VERIFY3U(DVA_GET_ASIZE(&dst), ==, size);

	entry = kmem_zalloc(sizeof (vdev_indirect_mapping_entry_t), KM_SLEEP);
	DVA_MAPPING_SET_SRC_OFFSET(&entry->vime_mapping, start);
	entry->vime_mapping.vimep_dst = dst;
	if (spa_feature_is_enabled(spa, SPA_FEATURE_OBSOLETE_COUNTS)) {
	entry->vime_obsolete_count = range_tree_space(obsolete_segs);
	}

	vdev_copy_segment_arg_t vcsa = kmem_zalloc(sizeof (vcsa), KM_SLEEP);
	vcsa->vcsa_dest_dva = &entry->vime_mapping.vimep_dst;
	vcsa->vcsa_obsolete_segs = obsolete_segs;
	vcsa->vcsa_spa = spa;
	vcsa->vcsa_txg = txg;

	/*
	* See comment before spa_vdev_copy_one_child().
	*/
	spa_config_enter(spa, SCL_STATE, spa, RW_READER);
	zio_t *nzio = zio_null(spa->spa_txg_zio[txg & TXG_MASK], spa, NULL,
	spa_vdev_copy_segment_done, vcsa, 0);
	vdev_t *dest_vd = vdev_lookup_top(spa, DVA_GET_VDEV(&dst));
	if (dest_vd->vdev_ops == &vdev_mirror_ops) {
	for (int i = 0; i < dest_vd->vdev_children; i++) {
	vdev_t *child = dest_vd->vdev_child[i];
	spa_vdev_copy_one_child(vca, nzio, vd, start,
	child, DVA_GET_OFFSET(&dst), i, size);
	}
	} else {
	spa_vdev_copy_one_child(vca, nzio, vd, start,
	dest_vd, DVA_GET_OFFSET(&dst), -1, size);
	}
	zio_nowait(nzio);

	list_insert_tail(&svr->svr_new_segments[txg & TXG_MASK], entry);
	ASSERT3U(start + size, <=, vd->vdev_ms_count << vd->vdev_ms_shift);
	vdev_dirty(vd, 0, NULL, txg);

	return (0);
	}

	/*
	* Complete the removal of a toplevel vdev. This is called as a
	* synctask in the same txg that we will sync out the new config (to the
	* MOS object) which indicates that this vdev is indirect.
	*/
	static void
	vdev_remove_complete_sync(void arg, dmu_tx_t tx)
	{
	spa_vdev_removal_t *svr = arg;
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	vdev_t *vd = vdev_lookup_top(spa, svr->svr_vdev_id);

	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);

	for (int i = 0; i < TXG_SIZE; i++) {
	ASSERT0(svr->svr_bytes_done[i]);
	}

	ASSERT3U(spa->spa_removing_phys.sr_copied, ==,
	spa->spa_removing_phys.sr_to_copy);

	vdev_destroy_spacemaps(vd, tx);

	/* destroy leaf zaps, if any */
	ASSERT3P(svr->svr_zaplist, !=, NULL);
	for (nvpair_t *pair = nvlist_next_nvpair(svr->svr_zaplist, NULL);
	pair != NULL;
	pair = nvlist_next_nvpair(svr->svr_zaplist, pair)) {
	vdev_destroy_unlink_zap(vd, fnvpair_value_uint64(pair), tx);
	}
	fnvlist_free(svr->svr_zaplist);

	spa_finish_removal(dmu_tx_pool(tx)->dp_spa, DSS_FINISHED, tx);
	/* vd->vdev_path is not available here */
	spa_history_log_internal(spa, "vdev remove completed", tx,
	"%s vdev %llu", spa_name(spa), (u_longlong_t)vd->vdev_id);
	}

	static void
	vdev_remove_enlist_zaps(vdev_t vd, nvlist_t zlist)
	{
	ASSERT3P(zlist, !=, NULL);
	ASSERT3P(vd->vdev_ops, !=, &vdev_raidz_ops);

	if (vd->vdev_leaf_zap != 0) {
	char zkey[32];
	(void) snprintf(zkey, sizeof (zkey), "%s-%llu",
	VDEV_REMOVAL_ZAP_OBJS, (u_longlong_t)vd->vdev_leaf_zap);
	fnvlist_add_uint64(zlist, zkey, vd->vdev_leaf_zap);
	}

	for (uint64_t id = 0; id < vd->vdev_children; id++) {
	vdev_remove_enlist_zaps(vd->vdev_child[id], zlist);
	}
	}

	static void
	vdev_remove_replace_with_indirect(vdev_t *vd, uint64_t txg)
	{
	vdev_t *ivd;
	dmu_tx_t *tx;
	spa_t *spa = vd->vdev_spa;
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;

	/*
	* First, build a list of leaf zaps to be destroyed.
	* This is passed to the sync context thread,
	* which does the actual unlinking.
	*/
	svr->svr_zaplist = fnvlist_alloc();
	vdev_remove_enlist_zaps(vd, svr->svr_zaplist);

	ivd = vdev_add_parent(vd, &vdev_indirect_ops);
	ivd->vdev_removing = 0;

	vd->vdev_leaf_zap = 0;

	vdev_remove_child(ivd, vd);
	vdev_compact_children(ivd);

	ASSERT(!list_link_active(&vd->vdev_state_dirty_node));

	mutex_enter(&svr->svr_lock);
	svr->svr_thread = NULL;
	cv_broadcast(&svr->svr_cv);
	mutex_exit(&svr->svr_lock);

	/* After this, we can not use svr. */
	tx = dmu_tx_create_assigned(spa->spa_dsl_pool, txg);
	- dsl_sync_task_nowait(spa->spa_dsl_pool, vdev_remove_complete_sync, svr,
	- 0, ZFS_SPACE_CHECK_NONE, tx);
	+ dsl_sync_task_nowait(spa->spa_dsl_pool,
	+ vdev_remove_complete_sync, svr, tx);
	dmu_tx_commit(tx);
	}

	/*
	* Complete the removal of a toplevel vdev. This is called in open
	* context by the removal thread after we have copied all vdev's data.
	*/
	static void
	vdev_remove_complete(spa_t *spa)
	{
	uint64_t txg;

	/*
	* Wait for any deferred frees to be synced before we call
	* vdev_metaslab_fini()
	*/
	txg_wait_synced(spa->spa_dsl_pool, 0);
	txg = spa_vdev_enter(spa);
	vdev_t *vd = vdev_lookup_top(spa, spa->spa_vdev_removal->svr_vdev_id);
	ASSERT3P(vd->vdev_initialize_thread, ==, NULL);
	ASSERT3P(vd->vdev_trim_thread, ==, NULL);
	ASSERT3P(vd->vdev_autotrim_thread, ==, NULL);

	sysevent_t *ev = spa_event_create(spa, vd, NULL,
	ESC_ZFS_VDEV_REMOVE_DEV);

	zfs_dbgmsg("finishing device removal for vdev %llu in txg %llu",
	vd->vdev_id, txg);

	/*
	* Discard allocation state.
	*/
	if (vd->vdev_mg != NULL) {
	vdev_metaslab_fini(vd);
	metaslab_group_destroy(vd->vdev_mg);
	vd->vdev_mg = NULL;
	spa_log_sm_set_blocklimit(spa);
	}
	ASSERT0(vd->vdev_stat.vs_space);
	ASSERT0(vd->vdev_stat.vs_dspace);

	vdev_remove_replace_with_indirect(vd, txg);

	/*
	* We now release the locks, allowing spa_sync to run and finish the
	* removal via vdev_remove_complete_sync in syncing context.
	*
	* Note that we hold on to the vdev_t that has been replaced. Since
	* it isn't part of the vdev tree any longer, it can't be concurrently
	* manipulated, even while we don't have the config lock.
	*/
	(void) spa_vdev_exit(spa, NULL, txg, 0);

	/*
	* Top ZAP should have been transferred to the indirect vdev in
	* vdev_remove_replace_with_indirect.
	*/
	ASSERT0(vd->vdev_top_zap);

	/*
	* Leaf ZAP should have been moved in vdev_remove_replace_with_indirect.
	*/
	ASSERT0(vd->vdev_leaf_zap);

	txg = spa_vdev_enter(spa);
	(void) vdev_label_init(vd, 0, VDEV_LABEL_REMOVE);
	/*
	* Request to update the config and the config cachefile.
	*/
	vdev_config_dirty(spa->spa_root_vdev);
	(void) spa_vdev_exit(spa, vd, txg, 0);

	if (ev != NULL)
	spa_event_post(ev);
	}

	/*
	* Evacuates a segment of size at most max_alloc from the vdev
	* via repeated calls to spa_vdev_copy_segment. If an allocation
	* fails, the pool is probably too fragmented to handle such a
	* large size, so decrease max_alloc so that the caller will not try
	* this size again this txg.
	*/
	static void
	spa_vdev_copy_impl(vdev_t vd, spa_vdev_removal_t svr, vdev_copy_arg_t *vca,
	uint64_t max_alloc, dmu_tx_t tx)
	{
	uint64_t txg = dmu_tx_get_txg(tx);
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;

	mutex_enter(&svr->svr_lock);

	/*
	* Determine how big of a chunk to copy. We can allocate up
	* to max_alloc bytes, and we can span up to vdev_removal_max_span
	* bytes of unallocated space at a time. "segs" will track the
	* allocated segments that we are copying. We may also be copying
	* free segments (of up to vdev_removal_max_span bytes).
	*/
	range_tree_t *segs = range_tree_create(NULL, RANGE_SEG64, NULL, 0, 0);
	for (;;) {
	range_tree_t *rt = svr->svr_allocd_segs;
	range_seg_t *rs = range_tree_first(rt);

	if (rs == NULL)
	break;

	uint64_t seg_length;

	if (range_tree_is_empty(segs)) {
	/* need to truncate the first seg based on max_alloc */
	seg_length = MIN(rs_get_end(rs, rt) - rs_get_start(rs,
	rt), *max_alloc);
	} else {
	if (rs_get_start(rs, rt) - range_tree_max(segs) >
	vdev_removal_max_span) {
	/*
	* Including this segment would cause us to
	* copy a larger unneeded chunk than is allowed.
	*/
	break;
	} else if (rs_get_end(rs, rt) - range_tree_min(segs) >
	*max_alloc) {
	/*
	* This additional segment would extend past
	* max_alloc. Rather than splitting this
	* segment, leave it for the next mapping.
	*/
	break;
	} else {
	seg_length = rs_get_end(rs, rt) -
	rs_get_start(rs, rt);
	}
	}

	range_tree_add(segs, rs_get_start(rs, rt), seg_length);
	range_tree_remove(svr->svr_allocd_segs,
	rs_get_start(rs, rt), seg_length);
	}

	if (range_tree_is_empty(segs)) {
	mutex_exit(&svr->svr_lock);
	range_tree_destroy(segs);
	return;
	}

	if (svr->svr_max_offset_to_sync[txg & TXG_MASK] == 0) {
	dsl_sync_task_nowait(dmu_tx_pool(tx), vdev_mapping_sync,
	- svr, 0, ZFS_SPACE_CHECK_NONE, tx);
	+ svr, tx);
	}

	svr->svr_max_offset_to_sync[txg & TXG_MASK] = range_tree_max(segs);

	/*
	* Note: this is the amount of allocated space
	* that we are taking care of each txg.
	*/
	svr->svr_bytes_done[txg & TXG_MASK] += range_tree_space(segs);

	mutex_exit(&svr->svr_lock);

	zio_alloc_list_t zal;
	metaslab_trace_init(&zal);
	uint64_t thismax = SPA_MAXBLOCKSIZE;
	while (!range_tree_is_empty(segs)) {
	int error = spa_vdev_copy_segment(vd,
	segs, thismax, txg, vca, &zal);

	if (error == ENOSPC) {
	/*
	* Cut our segment in half, and don't try this
	* segment size again this txg. Note that the
	* allocation size must be aligned to the highest
	* ashift in the pool, so that the allocation will
	* not be padded out to a multiple of the ashift,
	* which could cause us to think that this mapping
	* is larger than we intended.
	*/
	ASSERT3U(spa->spa_max_ashift, >=, SPA_MINBLOCKSHIFT);
	ASSERT3U(spa->spa_max_ashift, ==, spa->spa_min_ashift);
	uint64_t attempted =
	MIN(range_tree_span(segs), thismax);
	thismax = P2ROUNDUP(attempted / 2,
	1 << spa->spa_max_ashift);
	/*
	* The minimum-size allocation can not fail.
	*/
	ASSERT3U(attempted, >, 1 << spa->spa_max_ashift);
	*max_alloc = attempted - (1 << spa->spa_max_ashift);
	} else {
	ASSERT0(error);

	/*
	* We've performed an allocation, so reset the
	* alloc trace list.
	*/
	metaslab_trace_fini(&zal);
	metaslab_trace_init(&zal);
	}
	}
	metaslab_trace_fini(&zal);
	range_tree_destroy(segs);
	}

	/*
	* The size of each removal mapping is limited by the tunable
	* zfs_remove_max_segment, but we must adjust this to be a multiple of the
	* pool's ashift, so that we don't try to split individual sectors regardless
	* of the tunable value. (Note that device removal requires that all devices
	* have the same ashift, so there's no difference between spa_min_ashift and
	* spa_max_ashift.) The raw tunable should not be used elsewhere.
	*/
	uint64_t
	spa_remove_max_segment(spa_t *spa)
	{
	return (P2ROUNDUP(zfs_remove_max_segment, 1 << spa->spa_max_ashift));
	}

	/*
	* The removal thread operates in open context. It iterates over all
	* allocated space in the vdev, by loading each metaslab's spacemap.
	* For each contiguous segment of allocated space (capping the segment
	* size at SPA_MAXBLOCKSIZE), we:
	* - Allocate space for it on another vdev.
	* - Create a new mapping from the old location to the new location
	* (as a record in svr_new_segments).
	* - Initiate a physical read zio to get the data off the removing disk.
	* - In the read zio's done callback, initiate a physical write zio to
	* write it to the new vdev.
	* Note that all of this will take effect when a particular TXG syncs.
	* The sync thread ensures that all the phys reads and writes for the syncing
	* TXG have completed (see spa_txg_zio) and writes the new mappings to disk
	* (see vdev_mapping_sync()).
	*/
	static void
	spa_vdev_remove_thread(void *arg)
	{
	spa_t *spa = arg;
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;
	vdev_copy_arg_t vca;
	uint64_t max_alloc = spa_remove_max_segment(spa);
	uint64_t last_txg = 0;

	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	vdev_t *vd = vdev_lookup_top(spa, svr->svr_vdev_id);
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	uint64_t start_offset = vdev_indirect_mapping_max_offset(vim);

	ASSERT3P(vd->vdev_ops, !=, &vdev_indirect_ops);
	ASSERT(vdev_is_concrete(vd));
	ASSERT(vd->vdev_removing);
	ASSERT(vd->vdev_indirect_config.vic_mapping_object != 0);
	ASSERT(vim != NULL);

	mutex_init(&vca.vca_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&vca.vca_cv, NULL, CV_DEFAULT, NULL);
	vca.vca_outstanding_bytes = 0;
	vca.vca_read_error_bytes = 0;
	vca.vca_write_error_bytes = 0;

	mutex_enter(&svr->svr_lock);

	/*
	* Start from vim_max_offset so we pick up where we left off
	* if we are restarting the removal after opening the pool.
	*/
	uint64_t msi;
	for (msi = start_offset >> vd->vdev_ms_shift;
	msi < vd->vdev_ms_count && !svr->svr_thread_exit; msi++) {
	metaslab_t *msp = vd->vdev_ms[msi];
	ASSERT3U(msi, <=, vd->vdev_ms_count);

	ASSERT0(range_tree_space(svr->svr_allocd_segs));

	mutex_enter(&msp->ms_sync_lock);
	mutex_enter(&msp->ms_lock);

	/*
	* Assert nothing in flight -- ms_*tree is empty.
	*/
	for (int i = 0; i < TXG_SIZE; i++) {
	ASSERT0(range_tree_space(msp->ms_allocating[i]));
	}

	/*
	* If the metaslab has ever been allocated from (ms_sm!=NULL),
	* read the allocated segments from the space map object
	* into svr_allocd_segs. Since we do this while holding
	* svr_lock and ms_sync_lock, concurrent frees (which
	* would have modified the space map) will wait for us
	* to finish loading the spacemap, and then take the
	* appropriate action (see free_from_removing_vdev()).
	*/
	if (msp->ms_sm != NULL) {
	VERIFY0(space_map_load(msp->ms_sm,
	svr->svr_allocd_segs, SM_ALLOC));

	range_tree_walk(msp->ms_unflushed_allocs,
	range_tree_add, svr->svr_allocd_segs);
	range_tree_walk(msp->ms_unflushed_frees,
	range_tree_remove, svr->svr_allocd_segs);
	range_tree_walk(msp->ms_freeing,
	range_tree_remove, svr->svr_allocd_segs);

	/*
	* When we are resuming from a paused removal (i.e.
	* when importing a pool with a removal in progress),
	* discard any state that we have already processed.
	*/
	range_tree_clear(svr->svr_allocd_segs, 0, start_offset);
	}
	mutex_exit(&msp->ms_lock);
	mutex_exit(&msp->ms_sync_lock);

	vca.vca_msp = msp;
	zfs_dbgmsg("copying %llu segments for metaslab %llu",
	zfs_btree_numnodes(&svr->svr_allocd_segs->rt_root),
	msp->ms_id);

	while (!svr->svr_thread_exit &&
	!range_tree_is_empty(svr->svr_allocd_segs)) {

	mutex_exit(&svr->svr_lock);

	/*
	* We need to periodically drop the config lock so that
	* writers can get in. Additionally, we can't wait
	* for a txg to sync while holding a config lock
	* (since a waiting writer could cause a 3-way deadlock
	* with the sync thread, which also gets a config
	* lock for reader). So we can't hold the config lock
	* while calling dmu_tx_assign().
	*/
	spa_config_exit(spa, SCL_CONFIG, FTAG);

	/*
	* This delay will pause the removal around the point
	* specified by zfs_removal_suspend_progress. We do this
	* solely from the test suite or during debugging.
	*/
	uint64_t bytes_copied =
	spa->spa_removing_phys.sr_copied;
	for (int i = 0; i < TXG_SIZE; i++)
	bytes_copied += svr->svr_bytes_done[i];
	while (zfs_removal_suspend_progress &&
	!svr->svr_thread_exit)
	delay(hz);

	mutex_enter(&vca.vca_lock);
	while (vca.vca_outstanding_bytes >
	zfs_remove_max_copy_bytes) {
	cv_wait(&vca.vca_cv, &vca.vca_lock);
	}
	mutex_exit(&vca.vca_lock);

	dmu_tx_t *tx =
	dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);

	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));
	uint64_t txg = dmu_tx_get_txg(tx);

	/*
	* Reacquire the vdev_config lock. The vdev_t
	* that we're removing may have changed, e.g. due
	* to a vdev_attach or vdev_detach.
	*/
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	vd = vdev_lookup_top(spa, svr->svr_vdev_id);

	if (txg != last_txg)
	max_alloc = spa_remove_max_segment(spa);
	last_txg = txg;

	spa_vdev_copy_impl(vd, svr, &vca, &max_alloc, tx);

	dmu_tx_commit(tx);
	mutex_enter(&svr->svr_lock);
	}

	mutex_enter(&vca.vca_lock);
	if (zfs_removal_ignore_errors == 0 &&
	(vca.vca_read_error_bytes > 0 \|\|
	vca.vca_write_error_bytes > 0)) {
	svr->svr_thread_exit = B_TRUE;
	}
	mutex_exit(&vca.vca_lock);
	}

	mutex_exit(&svr->svr_lock);

	spa_config_exit(spa, SCL_CONFIG, FTAG);

	/*
	* Wait for all copies to finish before cleaning up the vca.
	*/
	txg_wait_synced(spa->spa_dsl_pool, 0);
	ASSERT0(vca.vca_outstanding_bytes);

	mutex_destroy(&vca.vca_lock);
	cv_destroy(&vca.vca_cv);

	if (svr->svr_thread_exit) {
	mutex_enter(&svr->svr_lock);
	range_tree_vacate(svr->svr_allocd_segs, NULL, NULL);
	svr->svr_thread = NULL;
	cv_broadcast(&svr->svr_cv);
	mutex_exit(&svr->svr_lock);

	/*
	* During the removal process an unrecoverable read or write
	* error was encountered. The removal process must be
	* cancelled or this damage may become permanent.
	*/
	if (zfs_removal_ignore_errors == 0 &&
	(vca.vca_read_error_bytes > 0 \|\|
	vca.vca_write_error_bytes > 0)) {
	zfs_dbgmsg("canceling removal due to IO errors: "
	"[read_error_bytes=%llu] [write_error_bytes=%llu]",
	vca.vca_read_error_bytes,
	vca.vca_write_error_bytes);
	spa_vdev_remove_cancel_impl(spa);
	}
	} else {
	ASSERT0(range_tree_space(svr->svr_allocd_segs));
	vdev_remove_complete(spa);
	}

	thread_exit();
	}

	void
	spa_vdev_remove_suspend(spa_t *spa)
	{
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;

	if (svr == NULL)
	return;

	mutex_enter(&svr->svr_lock);
	svr->svr_thread_exit = B_TRUE;
	while (svr->svr_thread != NULL)
	cv_wait(&svr->svr_cv, &svr->svr_lock);
	svr->svr_thread_exit = B_FALSE;
	mutex_exit(&svr->svr_lock);
	}

	/* ARGSUSED */
	static int
	spa_vdev_remove_cancel_check(void arg, dmu_tx_t tx)
	{
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;

	if (spa->spa_vdev_removal == NULL)
	return (ENOTACTIVE);
	return (0);
	}

	/*
	* Cancel a removal by freeing all entries from the partial mapping
	* and marking the vdev as no longer being removing.
	*/
	/* ARGSUSED */
	static void
	spa_vdev_remove_cancel_sync(void arg, dmu_tx_t tx)
	{
	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;
	vdev_t *vd = vdev_lookup_top(spa, svr->svr_vdev_id);
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;
	objset_t *mos = spa->spa_meta_objset;

	ASSERT3P(svr->svr_thread, ==, NULL);

	spa_feature_decr(spa, SPA_FEATURE_DEVICE_REMOVAL, tx);

	boolean_t are_precise;
	VERIFY0(vdev_obsolete_counts_are_precise(vd, &are_precise));
	if (are_precise) {
	spa_feature_decr(spa, SPA_FEATURE_OBSOLETE_COUNTS, tx);
	VERIFY0(zap_remove(spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_OBSOLETE_COUNTS_ARE_PRECISE, tx));
	}

	uint64_t obsolete_sm_object;
	VERIFY0(vdev_obsolete_sm_object(vd, &obsolete_sm_object));
	if (obsolete_sm_object != 0) {
	ASSERT(vd->vdev_obsolete_sm != NULL);
	ASSERT3U(obsolete_sm_object, ==,
	space_map_object(vd->vdev_obsolete_sm));

	space_map_free(vd->vdev_obsolete_sm, tx);
	VERIFY0(zap_remove(spa->spa_meta_objset, vd->vdev_top_zap,
	VDEV_TOP_ZAP_INDIRECT_OBSOLETE_SM, tx));
	space_map_close(vd->vdev_obsolete_sm);
	vd->vdev_obsolete_sm = NULL;
	spa_feature_decr(spa, SPA_FEATURE_OBSOLETE_COUNTS, tx);
	}
	for (int i = 0; i < TXG_SIZE; i++) {
	ASSERT(list_is_empty(&svr->svr_new_segments[i]));
	ASSERT3U(svr->svr_max_offset_to_sync[i], <=,
	vdev_indirect_mapping_max_offset(vim));
	}

	for (uint64_t msi = 0; msi < vd->vdev_ms_count; msi++) {
	metaslab_t *msp = vd->vdev_ms[msi];

	if (msp->ms_start >= vdev_indirect_mapping_max_offset(vim))
	break;

	ASSERT0(range_tree_space(svr->svr_allocd_segs));

	mutex_enter(&msp->ms_lock);

	/*
	* Assert nothing in flight -- ms_*tree is empty.
	*/
	for (int i = 0; i < TXG_SIZE; i++)
	ASSERT0(range_tree_space(msp->ms_allocating[i]));
	for (int i = 0; i < TXG_DEFER_SIZE; i++)
	ASSERT0(range_tree_space(msp->ms_defer[i]));
	ASSERT0(range_tree_space(msp->ms_freed));

	if (msp->ms_sm != NULL) {
	mutex_enter(&svr->svr_lock);
	VERIFY0(space_map_load(msp->ms_sm,
	svr->svr_allocd_segs, SM_ALLOC));

	range_tree_walk(msp->ms_unflushed_allocs,
	range_tree_add, svr->svr_allocd_segs);
	range_tree_walk(msp->ms_unflushed_frees,
	range_tree_remove, svr->svr_allocd_segs);
	range_tree_walk(msp->ms_freeing,
	range_tree_remove, svr->svr_allocd_segs);

	/*
	* Clear everything past what has been synced,
	* because we have not allocated mappings for it yet.
	*/
	uint64_t syncd = vdev_indirect_mapping_max_offset(vim);
	uint64_t sm_end = msp->ms_sm->sm_start +
	msp->ms_sm->sm_size;
	if (sm_end > syncd)
	range_tree_clear(svr->svr_allocd_segs,
	syncd, sm_end - syncd);

	mutex_exit(&svr->svr_lock);
	}
	mutex_exit(&msp->ms_lock);

	mutex_enter(&svr->svr_lock);
	range_tree_vacate(svr->svr_allocd_segs,
	free_mapped_segment_cb, vd);
	mutex_exit(&svr->svr_lock);
	}

	/*
	* Note: this must happen after we invoke free_mapped_segment_cb,
	* because it adds to the obsolete_segments.
	*/
	range_tree_vacate(vd->vdev_obsolete_segments, NULL, NULL);

	ASSERT3U(vic->vic_mapping_object, ==,
	vdev_indirect_mapping_object(vd->vdev_indirect_mapping));
	vdev_indirect_mapping_close(vd->vdev_indirect_mapping);
	vd->vdev_indirect_mapping = NULL;
	vdev_indirect_mapping_free(mos, vic->vic_mapping_object, tx);
	vic->vic_mapping_object = 0;

	ASSERT3U(vic->vic_births_object, ==,
	vdev_indirect_births_object(vd->vdev_indirect_births));
	vdev_indirect_births_close(vd->vdev_indirect_births);
	vd->vdev_indirect_births = NULL;
	vdev_indirect_births_free(mos, vic->vic_births_object, tx);
	vic->vic_births_object = 0;

	/*
	* We may have processed some frees from the removing vdev in this
	* txg, thus increasing svr_bytes_done; discard that here to
	* satisfy the assertions in spa_vdev_removal_destroy().
	* Note that future txg's can not have any bytes_done, because
	* future TXG's are only modified from open context, and we have
	* already shut down the copying thread.
	*/
	svr->svr_bytes_done[dmu_tx_get_txg(tx) & TXG_MASK] = 0;
	spa_finish_removal(spa, DSS_CANCELED, tx);

	vd->vdev_removing = B_FALSE;
	vdev_config_dirty(vd);

	zfs_dbgmsg("canceled device removal for vdev %llu in %llu",
	vd->vdev_id, dmu_tx_get_txg(tx));
	spa_history_log_internal(spa, "vdev remove canceled", tx,
	"%s vdev %llu %s", spa_name(spa),
	(u_longlong_t)vd->vdev_id,
	(vd->vdev_path != NULL) ? vd->vdev_path : "-");
	}

	static int
	spa_vdev_remove_cancel_impl(spa_t *spa)
	{
	uint64_t vdid = spa->spa_vdev_removal->svr_vdev_id;

	int error = dsl_sync_task(spa->spa_name, spa_vdev_remove_cancel_check,
	spa_vdev_remove_cancel_sync, NULL, 0,
	ZFS_SPACE_CHECK_EXTRA_RESERVED);

	if (error == 0) {
	spa_config_enter(spa, SCL_ALLOC \| SCL_VDEV, FTAG, RW_WRITER);
	vdev_t *vd = vdev_lookup_top(spa, vdid);
	metaslab_group_activate(vd->vdev_mg);
	spa_config_exit(spa, SCL_ALLOC \| SCL_VDEV, FTAG);
	}

	return (error);
	}

	int
	spa_vdev_remove_cancel(spa_t *spa)
	{
	spa_vdev_remove_suspend(spa);

	if (spa->spa_vdev_removal == NULL)
	return (ENOTACTIVE);

	return (spa_vdev_remove_cancel_impl(spa));
	}

	void
	svr_sync(spa_t spa, dmu_tx_t tx)
	{
	spa_vdev_removal_t *svr = spa->spa_vdev_removal;
	int txgoff = dmu_tx_get_txg(tx) & TXG_MASK;

	if (svr == NULL)
	return;

	/*
	* This check is necessary so that we do not dirty the
	* DIRECTORY_OBJECT via spa_sync_removing_state() when there
	* is nothing to do. Dirtying it every time would prevent us
	* from syncing-to-convergence.
	*/
	if (svr->svr_bytes_done[txgoff] == 0)
	return;

	/*
	* Update progress accounting.
	*/
	spa->spa_removing_phys.sr_copied += svr->svr_bytes_done[txgoff];
	svr->svr_bytes_done[txgoff] = 0;

	spa_sync_removing_state(spa, tx);
	}

	static void
	vdev_remove_make_hole_and_free(vdev_t *vd)
	{
	uint64_t id = vd->vdev_id;
	spa_t *spa = vd->vdev_spa;
	vdev_t *rvd = spa->spa_root_vdev;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	vdev_free(vd);

	vd = vdev_alloc_common(spa, id, 0, &vdev_hole_ops);
	vdev_add_child(rvd, vd);
	vdev_config_dirty(rvd);

	/*
	* Reassess the health of our root vdev.
	*/
	vdev_reopen(rvd);
	}

	/*
	* Remove a log device. The config lock is held for the specified TXG.
	*/
	static int
	spa_vdev_remove_log(vdev_t vd, uint64_t txg)
	{
	metaslab_group_t *mg = vd->vdev_mg;
	spa_t *spa = vd->vdev_spa;
	int error = 0;

	ASSERT(vd->vdev_islog);
	ASSERT(vd == vd->vdev_top);
	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	/*
	* Stop allocating from this vdev.
	*/
	metaslab_group_passivate(mg);

	/*
	* Wait for the youngest allocations and frees to sync,
	* and then wait for the deferral of those frees to finish.
	*/
	spa_vdev_config_exit(spa, NULL,
	*txg + TXG_CONCURRENT_STATES + TXG_DEFER_SIZE, 0, FTAG);

	/*
	* Cancel any initialize or TRIM which was in progress.
	*/
	vdev_initialize_stop_all(vd, VDEV_INITIALIZE_CANCELED);
	vdev_trim_stop_all(vd, VDEV_TRIM_CANCELED);
	vdev_autotrim_stop_wait(vd);

	/*
	* Evacuate the device. We don't hold the config lock as
	* writer since we need to do I/O but we do keep the
	* spa_namespace_lock held. Once this completes the device
	* should no longer have any blocks allocated on it.
	*/
	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	if (vd->vdev_stat.vs_alloc != 0)
	error = spa_reset_logs(spa);

	*txg = spa_vdev_config_enter(spa);

	if (error != 0) {
	metaslab_group_activate(mg);
	return (error);
	}
	ASSERT0(vd->vdev_stat.vs_alloc);

	/*
	* The evacuation succeeded. Remove any remaining MOS metadata
	* associated with this vdev, and wait for these changes to sync.
	*/
	vd->vdev_removing = B_TRUE;

	vdev_dirty_leaves(vd, VDD_DTL, *txg);
	vdev_config_dirty(vd);

	/*
	* When the log space map feature is enabled we look at
	* the vdev's top_zap to find the on-disk flush data of
	* the metaslab we just flushed. Thus, while removing a
	* log vdev we make sure to call vdev_metaslab_fini()
	* first, which removes all metaslabs of this vdev from
	* spa_metaslabs_by_flushed before vdev_remove_empty()
	* destroys the top_zap of this log vdev.
	*
	* This avoids the scenario where we flush a metaslab
	* from the log vdev being removed that doesn't have a
	* top_zap and end up failing to lookup its on-disk flush
	* data.
	*
	* We don't call metaslab_group_destroy() right away
	* though (it will be called in vdev_free() later) as
	* during metaslab_sync() of metaslabs from other vdevs
	* we may touch the metaslab group of this vdev through
	* metaslab_class_histogram_verify()
	*/
	vdev_metaslab_fini(vd);
	spa_log_sm_set_blocklimit(spa);

	spa_vdev_config_exit(spa, NULL, *txg, 0, FTAG);
	*txg = spa_vdev_config_enter(spa);

	sysevent_t *ev = spa_event_create(spa, vd, NULL,
	ESC_ZFS_VDEV_REMOVE_DEV);
	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	ASSERT(spa_config_held(spa, SCL_ALL, RW_WRITER) == SCL_ALL);

	/* The top ZAP should have been destroyed by vdev_remove_empty. */
	ASSERT0(vd->vdev_top_zap);
	/* The leaf ZAP should have been destroyed by vdev_dtl_sync. */
	ASSERT0(vd->vdev_leaf_zap);

	(void) vdev_label_init(vd, 0, VDEV_LABEL_REMOVE);

	if (list_link_active(&vd->vdev_state_dirty_node))
	vdev_state_clean(vd);
	if (list_link_active(&vd->vdev_config_dirty_node))
	vdev_config_clean(vd);

	ASSERT0(vd->vdev_stat.vs_alloc);

	/*
	* Clean up the vdev namespace.
	*/
	vdev_remove_make_hole_and_free(vd);

	if (ev != NULL)
	spa_event_post(ev);

	return (0);
	}

	static int
	spa_vdev_remove_top_check(vdev_t *vd)
	{
	spa_t *spa = vd->vdev_spa;

	if (vd != vd->vdev_top)
	return (SET_ERROR(ENOTSUP));

	if (!vdev_is_concrete(vd))
	return (SET_ERROR(ENOTSUP));

	if (!spa_feature_is_enabled(spa, SPA_FEATURE_DEVICE_REMOVAL))
	return (SET_ERROR(ENOTSUP));

	/* available space in the pool's normal class */
	uint64_t available = dsl_dir_space_available(
	spa->spa_dsl_pool->dp_root_dir, NULL, 0, B_TRUE);

	metaslab_class_t *mc = vd->vdev_mg->mg_class;

	/*
	* When removing a vdev from an allocation class that has
	* remaining vdevs, include available space from the class.
	*/
	if (mc != spa_normal_class(spa) && mc->mc_groups > 1) {
	uint64_t class_avail = metaslab_class_get_space(mc) -
	metaslab_class_get_alloc(mc);

	/* add class space, adjusted for overhead */
	available += (class_avail * 94) / 100;
	}

	/*
	* There has to be enough free space to remove the
	* device and leave double the "slop" space (i.e. we
	* must leave at least 3% of the pool free, in addition to
	* the normal slop space).
	*/
	if (available < vd->vdev_stat.vs_dspace + spa_get_slop_space(spa)) {
	return (SET_ERROR(ENOSPC));
	}

	/*
	* There can not be a removal in progress.
	*/
	if (spa->spa_removing_phys.sr_state == DSS_SCANNING)
	return (SET_ERROR(EBUSY));

	/*
	* The device must have all its data.
	*/
	if (!vdev_dtl_empty(vd, DTL_MISSING) \|\|
	!vdev_dtl_empty(vd, DTL_OUTAGE))
	return (SET_ERROR(EBUSY));

	/*
	* The device must be healthy.
	*/
	if (!vdev_readable(vd))
	return (SET_ERROR(EIO));

	/*
	* All vdevs in normal class must have the same ashift.
	*/
	if (spa->spa_max_ashift != spa->spa_min_ashift) {
	return (SET_ERROR(EINVAL));
	}

	/*
	* All vdevs in normal class must have the same ashift
	* and not be raidz.
	*/
	vdev_t *rvd = spa->spa_root_vdev;
	int num_indirect = 0;
	for (uint64_t id = 0; id < rvd->vdev_children; id++) {
	vdev_t *cvd = rvd->vdev_child[id];
	if (cvd->vdev_ashift != 0 && !cvd->vdev_islog)
	ASSERT3U(cvd->vdev_ashift, ==, spa->spa_max_ashift);
	if (cvd->vdev_ops == &vdev_indirect_ops)
	num_indirect++;
	if (!vdev_is_concrete(cvd))
	continue;
	if (cvd->vdev_ops == &vdev_raidz_ops)
	return (SET_ERROR(EINVAL));
	/*
	* Need the mirror to be mirror of leaf vdevs only
	*/
	if (cvd->vdev_ops == &vdev_mirror_ops) {
	for (uint64_t cid = 0;
	cid < cvd->vdev_children; cid++) {
	if (!cvd->vdev_child[cid]->vdev_ops->
	vdev_op_leaf)
	return (SET_ERROR(EINVAL));
	}
	}
	}

	return (0);
	}

	/*
	* Initiate removal of a top-level vdev, reducing the total space in the pool.
	* The config lock is held for the specified TXG. Once initiated,
	* evacuation of all allocated space (copying it to other vdevs) happens
	* in the background (see spa_vdev_remove_thread()), and can be canceled
	* (see spa_vdev_remove_cancel()). If successful, the vdev will
	* be transformed to an indirect vdev (see spa_vdev_remove_complete()).
	*/
	static int
	spa_vdev_remove_top(vdev_t vd, uint64_t txg)
	{
	spa_t *spa = vd->vdev_spa;
	int error;

	/*
	* Check for errors up-front, so that we don't waste time
	* passivating the metaslab group and clearing the ZIL if there
	* are errors.
	*/
	error = spa_vdev_remove_top_check(vd);
	if (error != 0)
	return (error);

	/*
	* Stop allocating from this vdev. Note that we must check
	* that this is not the only device in the pool before
	* passivating, otherwise we will not be able to make
	* progress because we can't allocate from any vdevs.
	* The above check for sufficient free space serves this
	* purpose.
	*/
	metaslab_group_t *mg = vd->vdev_mg;
	metaslab_group_passivate(mg);

	/*
	* Wait for the youngest allocations and frees to sync,
	* and then wait for the deferral of those frees to finish.
	*/
	spa_vdev_config_exit(spa, NULL,
	*txg + TXG_CONCURRENT_STATES + TXG_DEFER_SIZE, 0, FTAG);

	/*
	* We must ensure that no "stubby" log blocks are allocated
	* on the device to be removed. These blocks could be
	* written at any time, including while we are in the middle
	* of copying them.
	*/
	error = spa_reset_logs(spa);

	/*
	* We stop any initializing and TRIM that is currently in progress
	* but leave the state as "active". This will allow the process to
	* resume if the removal is canceled sometime later.
	*/
	vdev_initialize_stop_all(vd, VDEV_INITIALIZE_ACTIVE);
	vdev_trim_stop_all(vd, VDEV_TRIM_ACTIVE);
	vdev_autotrim_stop_wait(vd);

	*txg = spa_vdev_config_enter(spa);

	/*
	* Things might have changed while the config lock was dropped
	* (e.g. space usage). Check for errors again.
	*/
	if (error == 0)
	error = spa_vdev_remove_top_check(vd);

	if (error != 0) {
	metaslab_group_activate(mg);
	spa_async_request(spa, SPA_ASYNC_INITIALIZE_RESTART);
	spa_async_request(spa, SPA_ASYNC_TRIM_RESTART);
	spa_async_request(spa, SPA_ASYNC_AUTOTRIM_RESTART);
	return (error);
	}

	vd->vdev_removing = B_TRUE;

	vdev_dirty_leaves(vd, VDD_DTL, *txg);
	vdev_config_dirty(vd);
	dmu_tx_t tx = dmu_tx_create_assigned(spa->spa_dsl_pool, txg);
	dsl_sync_task_nowait(spa->spa_dsl_pool,
	- vdev_remove_initiate_sync,
	- (void *)(uintptr_t)vd->vdev_id, 0, ZFS_SPACE_CHECK_NONE, tx);
	+ vdev_remove_initiate_sync, (void *)(uintptr_t)vd->vdev_id, tx);
	dmu_tx_commit(tx);

	return (0);
	}

	/*
	* Remove a device from the pool.
	*
	* Removing a device from the vdev namespace requires several steps
	* and can take a significant amount of time. As a result we use
	* the spa_vdev_config_[enter/exit] functions which allow us to
	* grab and release the spa_config_lock while still holding the namespace
	* lock. During each step the configuration is synced out.
	*/
	int
	spa_vdev_remove(spa_t *spa, uint64_t guid, boolean_t unspare)
	{
	vdev_t *vd;
	nvlist_t spares, l2cache, *nv;
	uint64_t txg = 0;
	uint_t nspares, nl2cache;
	int error = 0, error_log;
	boolean_t locked = MUTEX_HELD(&spa_namespace_lock);
	sysevent_t *ev = NULL;
	char vd_type = NULL, vd_path = NULL;

	ASSERT(spa_writeable(spa));

	if (!locked)
	txg = spa_vdev_enter(spa);

	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	if (spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
	error = (spa_has_checkpoint(spa)) ?
	ZFS_ERR_CHECKPOINT_EXISTS : ZFS_ERR_DISCARDING_CHECKPOINT;

	if (!locked)
	return (spa_vdev_exit(spa, NULL, txg, error));

	return (error);
	}

	vd = spa_lookup_by_guid(spa, guid, B_FALSE);

	if (spa->spa_spares.sav_vdevs != NULL &&
	nvlist_lookup_nvlist_array(spa->spa_spares.sav_config,
	ZPOOL_CONFIG_SPARES, &spares, &nspares) == 0 &&
	(nv = spa_nvlist_lookup_by_guid(spares, nspares, guid)) != NULL) {
	/*
	* Only remove the hot spare if it's not currently in use
	* in this pool.
	*/
	if (vd == NULL \|\| unspare) {
	if (vd == NULL)
	vd = spa_lookup_by_guid(spa, guid, B_TRUE);
	ev = spa_event_create(spa, vd, NULL,
	ESC_ZFS_VDEV_REMOVE_AUX);

	vd_type = VDEV_TYPE_SPARE;
	vd_path = spa_strdup(fnvlist_lookup_string(
	nv, ZPOOL_CONFIG_PATH));
	spa_vdev_remove_aux(spa->spa_spares.sav_config,
	ZPOOL_CONFIG_SPARES, spares, nspares, nv);
	spa_load_spares(spa);
	spa->spa_spares.sav_sync = B_TRUE;
	} else {
	error = SET_ERROR(EBUSY);
	}
	} else if (spa->spa_l2cache.sav_vdevs != NULL &&
	nvlist_lookup_nvlist_array(spa->spa_l2cache.sav_config,
	ZPOOL_CONFIG_L2CACHE, &l2cache, &nl2cache) == 0 &&
	(nv = spa_nvlist_lookup_by_guid(l2cache, nl2cache, guid)) != NULL) {
	vd_type = VDEV_TYPE_L2CACHE;
	vd_path = spa_strdup(fnvlist_lookup_string(
	nv, ZPOOL_CONFIG_PATH));
	/*
	* Cache devices can always be removed.
	*/
	vd = spa_lookup_by_guid(spa, guid, B_TRUE);

	/*
	* Stop trimming the cache device. We need to release the
	* config lock to allow the syncing of TRIM transactions
	* without releasing the spa_namespace_lock. The same
	* strategy is employed in spa_vdev_remove_top().
	*/
	spa_vdev_config_exit(spa, NULL,
	txg + TXG_CONCURRENT_STATES + TXG_DEFER_SIZE, 0, FTAG);
	mutex_enter(&vd->vdev_trim_lock);
	vdev_trim_stop(vd, VDEV_TRIM_CANCELED, NULL);
	mutex_exit(&vd->vdev_trim_lock);
	txg = spa_vdev_config_enter(spa);

	ev = spa_event_create(spa, vd, NULL, ESC_ZFS_VDEV_REMOVE_AUX);
	spa_vdev_remove_aux(spa->spa_l2cache.sav_config,
	ZPOOL_CONFIG_L2CACHE, l2cache, nl2cache, nv);
	spa_load_l2cache(spa);
	spa->spa_l2cache.sav_sync = B_TRUE;
	} else if (vd != NULL && vd->vdev_islog) {
	ASSERT(!locked);
	vd_type = VDEV_TYPE_LOG;
	vd_path = spa_strdup((vd->vdev_path != NULL) ?
	vd->vdev_path : "-");
	error = spa_vdev_remove_log(vd, &txg);
	} else if (vd != NULL) {
	ASSERT(!locked);
	error = spa_vdev_remove_top(vd, &txg);
	} else {
	/*
	* There is no vdev of any kind with the specified guid.
	*/
	error = SET_ERROR(ENOENT);
	}

	error_log = error;

	if (!locked)
	error = spa_vdev_exit(spa, NULL, txg, error);

	/*
	* Logging must be done outside the spa config lock. Otherwise,
	* this code path could end up holding the spa config lock while
	* waiting for a txg_sync so it can write to the internal log.
	* Doing that would prevent the txg sync from actually happening,
	* causing a deadlock.
	*/
	if (error_log == 0 && vd_type != NULL && vd_path != NULL) {
	spa_history_log_internal(spa, "vdev remove", NULL,
	"%s vdev (%s) %s", spa_name(spa), vd_type, vd_path);
	}
	if (vd_path != NULL)
	spa_strfree(vd_path);

	if (ev != NULL)
	spa_event_post(ev);

	return (error);
	}

	int
	spa_removal_get_stats(spa_t spa, pool_removal_stat_t prs)
	{
	prs->prs_state = spa->spa_removing_phys.sr_state;

	if (prs->prs_state == DSS_NONE)
	return (SET_ERROR(ENOENT));

	prs->prs_removing_vdev = spa->spa_removing_phys.sr_removing_vdev;
	prs->prs_start_time = spa->spa_removing_phys.sr_start_time;
	prs->prs_end_time = spa->spa_removing_phys.sr_end_time;
	prs->prs_to_copy = spa->spa_removing_phys.sr_to_copy;
	prs->prs_copied = spa->spa_removing_phys.sr_copied;

	prs->prs_mapping_memory = 0;
	uint64_t indirect_vdev_id =
	spa->spa_removing_phys.sr_prev_indirect_vdev;
	while (indirect_vdev_id != -1) {
	vdev_t *vd = spa->spa_root_vdev->vdev_child[indirect_vdev_id];
	vdev_indirect_config_t *vic = &vd->vdev_indirect_config;
	vdev_indirect_mapping_t *vim = vd->vdev_indirect_mapping;

	ASSERT3P(vd->vdev_ops, ==, &vdev_indirect_ops);
	prs->prs_mapping_memory += vdev_indirect_mapping_size(vim);
	indirect_vdev_id = vic->vic_prev_indirect_vdev;
	}

	return (0);
	}

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_vdev, zfs_, removal_ignore_errors, INT, ZMOD_RW,
	"Ignore hard IO errors when removing device");

	ZFS_MODULE_PARAM(zfs_vdev, zfs_, remove_max_segment, INT, ZMOD_RW,
	"Largest contiguous segment to allocate when removing device");

	ZFS_MODULE_PARAM(zfs_vdev, vdev_, removal_max_span, INT, ZMOD_RW,
	"Largest span of free chunks a remap segment can span");

	ZFS_MODULE_PARAM(zfs_vdev, zfs_, removal_suspend_progress, INT, ZMOD_RW,
	"Pause device removal after this many bytes are copied "
	"(debug use only - causes removal to hang)");
	/* END CSTYLED */

	EXPORT_SYMBOL(free_from_removing_vdev);
	EXPORT_SYMBOL(spa_removal_get_stats);
	EXPORT_SYMBOL(spa_remove_init);
	EXPORT_SYMBOL(spa_restart_removal);
	EXPORT_SYMBOL(spa_vdev_removal_destroy);
	EXPORT_SYMBOL(spa_vdev_remove);
	EXPORT_SYMBOL(spa_vdev_remove_cancel);
	EXPORT_SYMBOL(spa_vdev_remove_suspend);
	EXPORT_SYMBOL(svr_sync);
	Index: vendor-sys/openzfs/dist/module/zfs/vdev_trim.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/vdev_trim.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/vdev_trim.c (revision 365892)
	@@ -1,1701 +1,1700 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2016 by Delphix. All rights reserved.
	* Copyright (c) 2019 by Lawrence Livermore National Security, LLC.
	*/

	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/txg.h>
	#include <sys/vdev_impl.h>
	#include <sys/vdev_trim.h>
	#include <sys/metaslab_impl.h>
	#include <sys/dsl_synctask.h>
	#include <sys/zap.h>
	#include <sys/dmu_tx.h>
	#include <sys/arc_impl.h>

	/*
	* TRIM is a feature which is used to notify a SSD that some previously
	* written space is no longer allocated by the pool. This is useful because
	* writes to a SSD must be performed to blocks which have first been erased.
	* Ensuring the SSD always has a supply of erased blocks for new writes
	* helps prevent the performance from deteriorating.
	*
	* There are two supported TRIM methods; manual and automatic.
	*
	* Manual TRIM:
	*
	* A manual TRIM is initiated by running the 'zpool trim' command. A single
	* 'vdev_trim' thread is created for each leaf vdev, and it is responsible for
	* managing that vdev TRIM process. This involves iterating over all the
	* metaslabs, calculating the unallocated space ranges, and then issuing the
	* required TRIM I/Os.
	*
	* While a metaslab is being actively trimmed it is not eligible to perform
	* new allocations. After traversing all of the metaslabs the thread is
	* terminated. Finally, both the requested options and current progress of
	* the TRIM are regularly written to the pool. This allows the TRIM to be
	* suspended and resumed as needed.
	*
	* Automatic TRIM:
	*
	* An automatic TRIM is enabled by setting the 'autotrim' pool property
	* to 'on'. When enabled, a `vdev_autotrim' thread is created for each
	* top-level (not leaf) vdev in the pool. These threads perform the same
	* core TRIM process as a manual TRIM, but with a few key differences.
	*
	* 1) Automatic TRIM happens continuously in the background and operates
	* solely on recently freed blocks (ms_trim not ms_allocatable).
	*
	* 2) Each thread is associated with a top-level (not leaf) vdev. This has
	* the benefit of simplifying the threading model, it makes it easier
	* to coordinate administrative commands, and it ensures only a single
	* metaslab is disabled at a time. Unlike manual TRIM, this means each
	* 'vdev_autotrim' thread is responsible for issuing TRIM I/Os for its
	* children.
	*
	* 3) There is no automatic TRIM progress information stored on disk, nor
	* is it reported by 'zpool status'.
	*
	* While the automatic TRIM process is highly effective it is more likely
	* than a manual TRIM to encounter tiny ranges. Ranges less than or equal to
	* 'zfs_trim_extent_bytes_min' (32k) are considered too small to efficiently
	* TRIM and are skipped. This means small amounts of freed space may not
	* be automatically trimmed.
	*
	* Furthermore, devices with attached hot spares and devices being actively
	* replaced are skipped. This is done to avoid adding additional stress to
	* a potentially unhealthy device and to minimize the required rebuild time.
	*
	* For this reason it may be beneficial to occasionally manually TRIM a pool
	* even when automatic TRIM is enabled.
	*/

	/*
	* Maximum size of TRIM I/O, ranges will be chunked in to 128MiB lengths.
	*/
	unsigned int zfs_trim_extent_bytes_max = 128 * 1024 * 1024;

	/*
	* Minimum size of TRIM I/O, extents smaller than 32Kib will be skipped.
	*/
	unsigned int zfs_trim_extent_bytes_min = 32 * 1024;

	/*
	* Skip uninitialized metaslabs during the TRIM process. This option is
	* useful for pools constructed from large thinly-provisioned devices where
	* TRIM operations are slow. As a pool ages an increasing fraction of
	* the pools metaslabs will be initialized progressively degrading the
	* usefulness of this option. This setting is stored when starting a
	* manual TRIM and will persist for the duration of the requested TRIM.
	*/
	unsigned int zfs_trim_metaslab_skip = 0;

	/*
	* Maximum number of queued TRIM I/Os per leaf vdev. The number of
	* concurrent TRIM I/Os issued to the device is controlled by the
	* zfs_vdev_trim_min_active and zfs_vdev_trim_max_active module options.
	*/
	unsigned int zfs_trim_queue_limit = 10;

	/*
	* The minimum number of transaction groups between automatic trims of a
	* metaslab. This setting represents a trade-off between issuing more
	* efficient TRIM operations, by allowing them to be aggregated longer,
	* and issuing them promptly so the trimmed space is available. Note
	* that this value is a minimum; metaslabs can be trimmed less frequently
	* when there are a large number of ranges which need to be trimmed.
	*
	* Increasing this value will allow frees to be aggregated for a longer
	* time. This can result is larger TRIM operations, and increased memory
	* usage in order to track the ranges to be trimmed. Decreasing this value
	* has the opposite effect. The default value of 32 was determined though
	* testing to be a reasonable compromise.
	*/
	unsigned int zfs_trim_txg_batch = 32;

	/*
	* The trim_args are a control structure which describe how a leaf vdev
	* should be trimmed. The core elements are the vdev, the metaslab being
	* trimmed and a range tree containing the extents to TRIM. All provided
	* ranges must be within the metaslab.
	*/
	typedef struct trim_args {
	/*
	* These fields are set by the caller of vdev_trim_ranges().
	*/
	vdev_t trim_vdev; / Leaf vdev to TRIM */
	metaslab_t trim_msp; / Disabled metaslab */
	range_tree_t trim_tree; / TRIM ranges (in metaslab) */
	trim_type_t trim_type; /* Manual or auto TRIM */
	uint64_t trim_extent_bytes_max; /* Maximum TRIM I/O size */
	uint64_t trim_extent_bytes_min; /* Minimum TRIM I/O size */
	enum trim_flag trim_flags; /* TRIM flags (secure) */

	/*
	* These fields are updated by vdev_trim_ranges().
	*/
	hrtime_t trim_start_time; /* Start time */
	uint64_t trim_bytes_done; /* Bytes trimmed */
	} trim_args_t;

	/*
	* Determines whether a vdev_trim_thread() should be stopped.
	*/
	static boolean_t
	vdev_trim_should_stop(vdev_t *vd)
	{
	return (vd->vdev_trim_exit_wanted \|\| !vdev_writeable(vd) \|\|
	vd->vdev_detached \|\| vd->vdev_top->vdev_removing);
	}

	/*
	* Determines whether a vdev_autotrim_thread() should be stopped.
	*/
	static boolean_t
	vdev_autotrim_should_stop(vdev_t *tvd)
	{
	return (tvd->vdev_autotrim_exit_wanted \|\|
	!vdev_writeable(tvd) \|\| tvd->vdev_removing \|\|
	spa_get_autotrim(tvd->vdev_spa) == SPA_AUTOTRIM_OFF);
	}

	/*
	* The sync task for updating the on-disk state of a manual TRIM. This
	* is scheduled by vdev_trim_change_state().
	*/
	static void
	vdev_trim_zap_update_sync(void arg, dmu_tx_t tx)
	{
	/*
	* We pass in the guid instead of the vdev_t since the vdev may
	* have been freed prior to the sync task being processed. This
	* happens when a vdev is detached as we call spa_config_vdev_exit(),
	* stop the trimming thread, schedule the sync task, and free
	* the vdev. Later when the scheduled sync task is invoked, it would
	* find that the vdev has been freed.
	*/
	uint64_t guid = (uint64_t )arg;
	uint64_t txg = dmu_tx_get_txg(tx);
	kmem_free(arg, sizeof (uint64_t));

	vdev_t *vd = spa_lookup_by_guid(tx->tx_pool->dp_spa, guid, B_FALSE);
	if (vd == NULL \|\| vd->vdev_top->vdev_removing \|\| !vdev_is_concrete(vd))
	return;

	uint64_t last_offset = vd->vdev_trim_offset[txg & TXG_MASK];
	vd->vdev_trim_offset[txg & TXG_MASK] = 0;

	VERIFY3U(vd->vdev_leaf_zap, !=, 0);

	objset_t *mos = vd->vdev_spa->spa_meta_objset;

	if (last_offset > 0 \|\| vd->vdev_trim_last_offset == UINT64_MAX) {

	if (vd->vdev_trim_last_offset == UINT64_MAX)
	last_offset = 0;

	vd->vdev_trim_last_offset = last_offset;
	VERIFY0(zap_update(mos, vd->vdev_leaf_zap,
	VDEV_LEAF_ZAP_TRIM_LAST_OFFSET,
	sizeof (last_offset), 1, &last_offset, tx));
	}

	if (vd->vdev_trim_action_time > 0) {
	uint64_t val = (uint64_t)vd->vdev_trim_action_time;
	VERIFY0(zap_update(mos, vd->vdev_leaf_zap,
	VDEV_LEAF_ZAP_TRIM_ACTION_TIME, sizeof (val),
	1, &val, tx));
	}

	if (vd->vdev_trim_rate > 0) {
	uint64_t rate = (uint64_t)vd->vdev_trim_rate;

	if (rate == UINT64_MAX)
	rate = 0;

	VERIFY0(zap_update(mos, vd->vdev_leaf_zap,
	VDEV_LEAF_ZAP_TRIM_RATE, sizeof (rate), 1, &rate, tx));
	}

	uint64_t partial = vd->vdev_trim_partial;
	if (partial == UINT64_MAX)
	partial = 0;

	VERIFY0(zap_update(mos, vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_PARTIAL,
	sizeof (partial), 1, &partial, tx));

	uint64_t secure = vd->vdev_trim_secure;
	if (secure == UINT64_MAX)
	secure = 0;

	VERIFY0(zap_update(mos, vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_SECURE,
	sizeof (secure), 1, &secure, tx));


	uint64_t trim_state = vd->vdev_trim_state;
	VERIFY0(zap_update(mos, vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_STATE,
	sizeof (trim_state), 1, &trim_state, tx));
	}

	/*
	* Update the on-disk state of a manual TRIM. This is called to request
	* that a TRIM be started/suspended/canceled, or to change one of the
	* TRIM options (partial, secure, rate).
	*/
	static void
	vdev_trim_change_state(vdev_t *vd, vdev_trim_state_t new_state,
	uint64_t rate, boolean_t partial, boolean_t secure)
	{
	ASSERT(MUTEX_HELD(&vd->vdev_trim_lock));
	spa_t *spa = vd->vdev_spa;

	if (new_state == vd->vdev_trim_state)
	return;

	/*
	* Copy the vd's guid, this will be freed by the sync task.
	*/
	uint64_t *guid = kmem_zalloc(sizeof (uint64_t), KM_SLEEP);
	*guid = vd->vdev_guid;

	/*
	* If we're suspending, then preserve the original start time.
	*/
	if (vd->vdev_trim_state != VDEV_TRIM_SUSPENDED) {
	vd->vdev_trim_action_time = gethrestime_sec();
	}

	/*
	* If we're activating, then preserve the requested rate and trim
	* method. Setting the last offset and rate to UINT64_MAX is used
	* as a sentinel to indicate they should be reset to default values.
	*/
	if (new_state == VDEV_TRIM_ACTIVE) {
	if (vd->vdev_trim_state == VDEV_TRIM_COMPLETE \|\|
	vd->vdev_trim_state == VDEV_TRIM_CANCELED) {
	vd->vdev_trim_last_offset = UINT64_MAX;
	vd->vdev_trim_rate = UINT64_MAX;
	vd->vdev_trim_partial = UINT64_MAX;
	vd->vdev_trim_secure = UINT64_MAX;
	}

	if (rate != 0)
	vd->vdev_trim_rate = rate;

	if (partial != 0)
	vd->vdev_trim_partial = partial;

	if (secure != 0)
	vd->vdev_trim_secure = secure;
	}

	boolean_t resumed = !!(vd->vdev_trim_state == VDEV_TRIM_SUSPENDED);
	vd->vdev_trim_state = new_state;

	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));
	dsl_sync_task_nowait(spa_get_dsl(spa), vdev_trim_zap_update_sync,
	- guid, 2, ZFS_SPACE_CHECK_NONE, tx);
	+ guid, tx);

	switch (new_state) {
	case VDEV_TRIM_ACTIVE:
	spa_event_notify(spa, vd, NULL,
	resumed ? ESC_ZFS_TRIM_RESUME : ESC_ZFS_TRIM_START);
	spa_history_log_internal(spa, "trim", tx,
	"vdev=%s activated", vd->vdev_path);
	break;
	case VDEV_TRIM_SUSPENDED:
	spa_event_notify(spa, vd, NULL, ESC_ZFS_TRIM_SUSPEND);
	spa_history_log_internal(spa, "trim", tx,
	"vdev=%s suspended", vd->vdev_path);
	break;
	case VDEV_TRIM_CANCELED:
	spa_event_notify(spa, vd, NULL, ESC_ZFS_TRIM_CANCEL);
	spa_history_log_internal(spa, "trim", tx,
	"vdev=%s canceled", vd->vdev_path);
	break;
	case VDEV_TRIM_COMPLETE:
	spa_event_notify(spa, vd, NULL, ESC_ZFS_TRIM_FINISH);
	spa_history_log_internal(spa, "trim", tx,
	"vdev=%s complete", vd->vdev_path);
	break;
	default:
	panic("invalid state %llu", (unsigned long long)new_state);
	}

	dmu_tx_commit(tx);

	if (new_state != VDEV_TRIM_ACTIVE)
	spa_notify_waiters(spa);
	}

	/*
	* The zio_done_func_t done callback for each manual TRIM issued. It is
	* responsible for updating the TRIM stats, reissuing failed TRIM I/Os,
	* and limiting the number of in flight TRIM I/Os.
	*/
	static void
	vdev_trim_cb(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;

	mutex_enter(&vd->vdev_trim_io_lock);
	if (zio->io_error == ENXIO && !vdev_writeable(vd)) {
	/*
	* The I/O failed because the vdev was unavailable; roll the
	* last offset back. (This works because spa_sync waits on
	* spa_txg_zio before it runs sync tasks.)
	*/
	uint64_t *offset =
	&vd->vdev_trim_offset[zio->io_txg & TXG_MASK];
	offset = MIN(offset, zio->io_offset);
	} else {
	if (zio->io_error != 0) {
	vd->vdev_stat.vs_trim_errors++;
	spa_iostats_trim_add(vd->vdev_spa, TRIM_TYPE_MANUAL,
	0, 0, 0, 0, 1, zio->io_orig_size);
	} else {
	spa_iostats_trim_add(vd->vdev_spa, TRIM_TYPE_MANUAL,
	1, zio->io_orig_size, 0, 0, 0, 0);
	}

	vd->vdev_trim_bytes_done += zio->io_orig_size;
	}

	ASSERT3U(vd->vdev_trim_inflight[TRIM_TYPE_MANUAL], >, 0);
	vd->vdev_trim_inflight[TRIM_TYPE_MANUAL]--;
	cv_broadcast(&vd->vdev_trim_io_cv);
	mutex_exit(&vd->vdev_trim_io_lock);

	spa_config_exit(vd->vdev_spa, SCL_STATE_ALL, vd);
	}

	/*
	* The zio_done_func_t done callback for each automatic TRIM issued. It
	* is responsible for updating the TRIM stats and limiting the number of
	* in flight TRIM I/Os. Automatic TRIM I/Os are best effort and are
	* never reissued on failure.
	*/
	static void
	vdev_autotrim_cb(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;

	mutex_enter(&vd->vdev_trim_io_lock);

	if (zio->io_error != 0) {
	vd->vdev_stat.vs_trim_errors++;
	spa_iostats_trim_add(vd->vdev_spa, TRIM_TYPE_AUTO,
	0, 0, 0, 0, 1, zio->io_orig_size);
	} else {
	spa_iostats_trim_add(vd->vdev_spa, TRIM_TYPE_AUTO,
	1, zio->io_orig_size, 0, 0, 0, 0);
	}

	ASSERT3U(vd->vdev_trim_inflight[TRIM_TYPE_AUTO], >, 0);
	vd->vdev_trim_inflight[TRIM_TYPE_AUTO]--;
	cv_broadcast(&vd->vdev_trim_io_cv);
	mutex_exit(&vd->vdev_trim_io_lock);

	spa_config_exit(vd->vdev_spa, SCL_STATE_ALL, vd);
	}

	/*
	* The zio_done_func_t done callback for each TRIM issued via
	* vdev_trim_simple(). It is responsible for updating the TRIM stats and
	* limiting the number of in flight TRIM I/Os. Simple TRIM I/Os are best
	* effort and are never reissued on failure.
	*/
	static void
	vdev_trim_simple_cb(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;

	mutex_enter(&vd->vdev_trim_io_lock);

	if (zio->io_error != 0) {
	vd->vdev_stat.vs_trim_errors++;
	spa_iostats_trim_add(vd->vdev_spa, TRIM_TYPE_SIMPLE,
	0, 0, 0, 0, 1, zio->io_orig_size);
	} else {
	spa_iostats_trim_add(vd->vdev_spa, TRIM_TYPE_SIMPLE,
	1, zio->io_orig_size, 0, 0, 0, 0);
	}

	ASSERT3U(vd->vdev_trim_inflight[TRIM_TYPE_SIMPLE], >, 0);
	vd->vdev_trim_inflight[TRIM_TYPE_SIMPLE]--;
	cv_broadcast(&vd->vdev_trim_io_cv);
	mutex_exit(&vd->vdev_trim_io_lock);

	spa_config_exit(vd->vdev_spa, SCL_STATE_ALL, vd);
	}
	/*
	* Returns the average trim rate in bytes/sec for the ta->trim_vdev.
	*/
	static uint64_t
	vdev_trim_calculate_rate(trim_args_t *ta)
	{
	return (ta->trim_bytes_done * 1000 /
	(NSEC2MSEC(gethrtime() - ta->trim_start_time) + 1));
	}

	/*
	* Issues a physical TRIM and takes care of rate limiting (bytes/sec)
	* and number of concurrent TRIM I/Os.
	*/
	static int
	vdev_trim_range(trim_args_t *ta, uint64_t start, uint64_t size)
	{
	vdev_t *vd = ta->trim_vdev;
	spa_t *spa = vd->vdev_spa;
	void *cb;

	mutex_enter(&vd->vdev_trim_io_lock);

	/*
	* Limit manual TRIM I/Os to the requested rate. This does not
	* apply to automatic TRIM since no per vdev rate can be specified.
	*/
	if (ta->trim_type == TRIM_TYPE_MANUAL) {
	while (vd->vdev_trim_rate != 0 && !vdev_trim_should_stop(vd) &&
	vdev_trim_calculate_rate(ta) > vd->vdev_trim_rate) {
	- cv_timedwait_sig(&vd->vdev_trim_io_cv,
	+ cv_timedwait_idle(&vd->vdev_trim_io_cv,
	&vd->vdev_trim_io_lock, ddi_get_lbolt() +
	MSEC_TO_TICK(10));
	}
	}
	ta->trim_bytes_done += size;

	/* Limit in flight trimming I/Os */
	while (vd->vdev_trim_inflight[0] + vd->vdev_trim_inflight[1] +
	vd->vdev_trim_inflight[2] >= zfs_trim_queue_limit) {
	cv_wait(&vd->vdev_trim_io_cv, &vd->vdev_trim_io_lock);
	}
	vd->vdev_trim_inflight[ta->trim_type]++;
	mutex_exit(&vd->vdev_trim_io_lock);

	dmu_tx_t *tx = dmu_tx_create_dd(spa_get_dsl(spa)->dp_mos_dir);
	VERIFY0(dmu_tx_assign(tx, TXG_WAIT));
	uint64_t txg = dmu_tx_get_txg(tx);

	spa_config_enter(spa, SCL_STATE_ALL, vd, RW_READER);
	mutex_enter(&vd->vdev_trim_lock);

	if (ta->trim_type == TRIM_TYPE_MANUAL &&
	vd->vdev_trim_offset[txg & TXG_MASK] == 0) {
	uint64_t *guid = kmem_zalloc(sizeof (uint64_t), KM_SLEEP);
	*guid = vd->vdev_guid;

	/* This is the first write of this txg. */
	dsl_sync_task_nowait(spa_get_dsl(spa),
	- vdev_trim_zap_update_sync, guid, 2,
	- ZFS_SPACE_CHECK_RESERVED, tx);
	+ vdev_trim_zap_update_sync, guid, tx);
	}

	/*
	* We know the vdev_t will still be around since all consumers of
	* vdev_free must stop the trimming first.
	*/
	if ((ta->trim_type == TRIM_TYPE_MANUAL &&
	vdev_trim_should_stop(vd)) \|\|
	(ta->trim_type == TRIM_TYPE_AUTO &&
	vdev_autotrim_should_stop(vd->vdev_top))) {
	mutex_enter(&vd->vdev_trim_io_lock);
	vd->vdev_trim_inflight[ta->trim_type]--;
	mutex_exit(&vd->vdev_trim_io_lock);
	spa_config_exit(vd->vdev_spa, SCL_STATE_ALL, vd);
	mutex_exit(&vd->vdev_trim_lock);
	dmu_tx_commit(tx);
	return (SET_ERROR(EINTR));
	}
	mutex_exit(&vd->vdev_trim_lock);

	if (ta->trim_type == TRIM_TYPE_MANUAL)
	vd->vdev_trim_offset[txg & TXG_MASK] = start + size;

	if (ta->trim_type == TRIM_TYPE_MANUAL) {
	cb = vdev_trim_cb;
	} else if (ta->trim_type == TRIM_TYPE_AUTO) {
	cb = vdev_autotrim_cb;
	} else {
	cb = vdev_trim_simple_cb;
	}

	zio_nowait(zio_trim(spa->spa_txg_zio[txg & TXG_MASK], vd,
	start, size, cb, NULL, ZIO_PRIORITY_TRIM, ZIO_FLAG_CANFAIL,
	ta->trim_flags));
	/* vdev_trim_cb and vdev_autotrim_cb release SCL_STATE_ALL */

	dmu_tx_commit(tx);

	return (0);
	}

	/*
	* Issues TRIM I/Os for all ranges in the provided ta->trim_tree range tree.
	* Additional parameters describing how the TRIM should be performed must
	* be set in the trim_args structure. See the trim_args definition for
	* additional information.
	*/
	static int
	vdev_trim_ranges(trim_args_t *ta)
	{
	vdev_t *vd = ta->trim_vdev;
	zfs_btree_t *t = &ta->trim_tree->rt_root;
	zfs_btree_index_t idx;
	uint64_t extent_bytes_max = ta->trim_extent_bytes_max;
	uint64_t extent_bytes_min = ta->trim_extent_bytes_min;
	spa_t *spa = vd->vdev_spa;

	ta->trim_start_time = gethrtime();
	ta->trim_bytes_done = 0;

	for (range_seg_t *rs = zfs_btree_first(t, &idx); rs != NULL;
	rs = zfs_btree_next(t, &idx, &idx)) {
	uint64_t size = rs_get_end(rs, ta->trim_tree) - rs_get_start(rs,
	ta->trim_tree);

	if (extent_bytes_min && size < extent_bytes_min) {
	spa_iostats_trim_add(spa, ta->trim_type,
	0, 0, 1, size, 0, 0);
	continue;
	}

	/* Split range into legally-sized physical chunks */
	uint64_t writes_required = ((size - 1) / extent_bytes_max) + 1;

	for (uint64_t w = 0; w < writes_required; w++) {
	int error;

	error = vdev_trim_range(ta, VDEV_LABEL_START_SIZE +
	rs_get_start(rs, ta->trim_tree) +
	(w *extent_bytes_max), MIN(size -
	(w * extent_bytes_max), extent_bytes_max));
	if (error != 0) {
	return (error);
	}
	}
	}

	return (0);
	}

	/*
	* Calculates the completion percentage of a manual TRIM.
	*/
	static void
	vdev_trim_calculate_progress(vdev_t *vd)
	{
	ASSERT(spa_config_held(vd->vdev_spa, SCL_CONFIG, RW_READER) \|\|
	spa_config_held(vd->vdev_spa, SCL_CONFIG, RW_WRITER));
	ASSERT(vd->vdev_leaf_zap != 0);

	vd->vdev_trim_bytes_est = 0;
	vd->vdev_trim_bytes_done = 0;

	for (uint64_t i = 0; i < vd->vdev_top->vdev_ms_count; i++) {
	metaslab_t *msp = vd->vdev_top->vdev_ms[i];
	mutex_enter(&msp->ms_lock);

	uint64_t ms_free = msp->ms_size -
	metaslab_allocated_space(msp);

	if (vd->vdev_top->vdev_ops == &vdev_raidz_ops)
	ms_free /= vd->vdev_top->vdev_children;

	/*
	* Convert the metaslab range to a physical range
	* on our vdev. We use this to determine if we are
	* in the middle of this metaslab range.
	*/
	range_seg64_t logical_rs, physical_rs;
	logical_rs.rs_start = msp->ms_start;
	logical_rs.rs_end = msp->ms_start + msp->ms_size;
	vdev_xlate(vd, &logical_rs, &physical_rs);

	if (vd->vdev_trim_last_offset <= physical_rs.rs_start) {
	vd->vdev_trim_bytes_est += ms_free;
	mutex_exit(&msp->ms_lock);
	continue;
	} else if (vd->vdev_trim_last_offset > physical_rs.rs_end) {
	vd->vdev_trim_bytes_done += ms_free;
	vd->vdev_trim_bytes_est += ms_free;
	mutex_exit(&msp->ms_lock);
	continue;
	}

	/*
	* If we get here, we're in the middle of trimming this
	* metaslab. Load it and walk the free tree for more
	* accurate progress estimation.
	*/
	VERIFY0(metaslab_load(msp));

	range_tree_t *rt = msp->ms_allocatable;
	zfs_btree_t *bt = &rt->rt_root;
	zfs_btree_index_t idx;
	for (range_seg_t *rs = zfs_btree_first(bt, &idx);
	rs != NULL; rs = zfs_btree_next(bt, &idx, &idx)) {
	logical_rs.rs_start = rs_get_start(rs, rt);
	logical_rs.rs_end = rs_get_end(rs, rt);
	vdev_xlate(vd, &logical_rs, &physical_rs);

	uint64_t size = physical_rs.rs_end -
	physical_rs.rs_start;
	vd->vdev_trim_bytes_est += size;
	if (vd->vdev_trim_last_offset >= physical_rs.rs_end) {
	vd->vdev_trim_bytes_done += size;
	} else if (vd->vdev_trim_last_offset >
	physical_rs.rs_start &&
	vd->vdev_trim_last_offset <=
	physical_rs.rs_end) {
	vd->vdev_trim_bytes_done +=
	vd->vdev_trim_last_offset -
	physical_rs.rs_start;
	}
	}
	mutex_exit(&msp->ms_lock);
	}
	}

	/*
	* Load from disk the vdev's manual TRIM information. This includes the
	* state, progress, and options provided when initiating the manual TRIM.
	*/
	static int
	vdev_trim_load(vdev_t *vd)
	{
	int err = 0;
	ASSERT(spa_config_held(vd->vdev_spa, SCL_CONFIG, RW_READER) \|\|
	spa_config_held(vd->vdev_spa, SCL_CONFIG, RW_WRITER));
	ASSERT(vd->vdev_leaf_zap != 0);

	if (vd->vdev_trim_state == VDEV_TRIM_ACTIVE \|\|
	vd->vdev_trim_state == VDEV_TRIM_SUSPENDED) {
	err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_LAST_OFFSET,
	sizeof (vd->vdev_trim_last_offset), 1,
	&vd->vdev_trim_last_offset);
	if (err == ENOENT) {
	vd->vdev_trim_last_offset = 0;
	err = 0;
	}

	if (err == 0) {
	err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_RATE,
	sizeof (vd->vdev_trim_rate), 1,
	&vd->vdev_trim_rate);
	if (err == ENOENT) {
	vd->vdev_trim_rate = 0;
	err = 0;
	}
	}

	if (err == 0) {
	err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_PARTIAL,
	sizeof (vd->vdev_trim_partial), 1,
	&vd->vdev_trim_partial);
	if (err == ENOENT) {
	vd->vdev_trim_partial = 0;
	err = 0;
	}
	}

	if (err == 0) {
	err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_SECURE,
	sizeof (vd->vdev_trim_secure), 1,
	&vd->vdev_trim_secure);
	if (err == ENOENT) {
	vd->vdev_trim_secure = 0;
	err = 0;
	}
	}
	}

	vdev_trim_calculate_progress(vd);

	return (err);
	}

	/*
	* Convert the logical range into a physical range and add it to the
	* range tree passed in the trim_args_t.
	*/
	static void
	vdev_trim_range_add(void *arg, uint64_t start, uint64_t size)
	{
	trim_args_t *ta = arg;
	vdev_t *vd = ta->trim_vdev;
	range_seg64_t logical_rs, physical_rs;
	logical_rs.rs_start = start;
	logical_rs.rs_end = start + size;

	/*
	* Every range to be trimmed must be part of ms_allocatable.
	* When ZFS_DEBUG_TRIM is set load the metaslab to verify this
	* is always the case.
	*/
	if (zfs_flags & ZFS_DEBUG_TRIM) {
	metaslab_t *msp = ta->trim_msp;
	VERIFY0(metaslab_load(msp));
	VERIFY3B(msp->ms_loaded, ==, B_TRUE);
	VERIFY(range_tree_contains(msp->ms_allocatable, start, size));
	}

	ASSERT(vd->vdev_ops->vdev_op_leaf);
	vdev_xlate(vd, &logical_rs, &physical_rs);

	IMPLY(vd->vdev_top == vd,
	logical_rs.rs_start == physical_rs.rs_start);
	IMPLY(vd->vdev_top == vd,
	logical_rs.rs_end == physical_rs.rs_end);

	/*
	* Only a manual trim will be traversing the vdev sequentially.
	* For an auto trim all valid ranges should be added.
	*/
	if (ta->trim_type == TRIM_TYPE_MANUAL) {

	/* Only add segments that we have not visited yet */
	if (physical_rs.rs_end <= vd->vdev_trim_last_offset)
	return;

	/* Pick up where we left off mid-range. */
	if (vd->vdev_trim_last_offset > physical_rs.rs_start) {
	ASSERT3U(physical_rs.rs_end, >,
	vd->vdev_trim_last_offset);
	physical_rs.rs_start = vd->vdev_trim_last_offset;
	}
	}

	ASSERT3U(physical_rs.rs_end, >=, physical_rs.rs_start);

	/*
	* With raidz, it's possible that the logical range does not live on
	* this leaf vdev. We only add the physical range to this vdev's if it
	* has a length greater than 0.
	*/
	if (physical_rs.rs_end > physical_rs.rs_start) {
	range_tree_add(ta->trim_tree, physical_rs.rs_start,
	physical_rs.rs_end - physical_rs.rs_start);
	} else {
	ASSERT3U(physical_rs.rs_end, ==, physical_rs.rs_start);
	}
	}

	/*
	* Each manual TRIM thread is responsible for trimming the unallocated
	* space for each leaf vdev. This is accomplished by sequentially iterating
	* over its top-level metaslabs and issuing TRIM I/O for the space described
	* by its ms_allocatable. While a metaslab is undergoing trimming it is
	* not eligible for new allocations.
	*/
	static void
	vdev_trim_thread(void *arg)
	{
	vdev_t *vd = arg;
	spa_t *spa = vd->vdev_spa;
	trim_args_t ta;
	int error = 0;

	/*
	* The VDEV_LEAF_ZAP_TRIM_* entries may have been updated by
	* vdev_trim(). Wait for the updated values to be reflected
	* in the zap in order to start with the requested settings.
	*/
	txg_wait_synced(spa_get_dsl(vd->vdev_spa), 0);

	ASSERT(vdev_is_concrete(vd));
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	vd->vdev_trim_last_offset = 0;
	vd->vdev_trim_rate = 0;
	vd->vdev_trim_partial = 0;
	vd->vdev_trim_secure = 0;

	VERIFY0(vdev_trim_load(vd));

	ta.trim_vdev = vd;
	ta.trim_extent_bytes_max = zfs_trim_extent_bytes_max;
	ta.trim_extent_bytes_min = zfs_trim_extent_bytes_min;
	ta.trim_tree = range_tree_create(NULL, RANGE_SEG64, NULL, 0, 0);
	ta.trim_type = TRIM_TYPE_MANUAL;
	ta.trim_flags = 0;

	/*
	* When a secure TRIM has been requested infer that the intent
	* is that everything must be trimmed. Override the default
	* minimum TRIM size to prevent ranges from being skipped.
	*/
	if (vd->vdev_trim_secure) {
	ta.trim_flags \|= ZIO_TRIM_SECURE;
	ta.trim_extent_bytes_min = SPA_MINBLOCKSIZE;
	}

	uint64_t ms_count = 0;
	for (uint64_t i = 0; !vd->vdev_detached &&
	i < vd->vdev_top->vdev_ms_count; i++) {
	metaslab_t *msp = vd->vdev_top->vdev_ms[i];

	/*
	* If we've expanded the top-level vdev or it's our
	* first pass, calculate our progress.
	*/
	if (vd->vdev_top->vdev_ms_count != ms_count) {
	vdev_trim_calculate_progress(vd);
	ms_count = vd->vdev_top->vdev_ms_count;
	}

	spa_config_exit(spa, SCL_CONFIG, FTAG);
	metaslab_disable(msp);
	mutex_enter(&msp->ms_lock);
	VERIFY0(metaslab_load(msp));

	/*
	* If a partial TRIM was requested skip metaslabs which have
	* never been initialized and thus have never been written.
	*/
	if (msp->ms_sm == NULL && vd->vdev_trim_partial) {
	mutex_exit(&msp->ms_lock);
	metaslab_enable(msp, B_FALSE, B_FALSE);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	vdev_trim_calculate_progress(vd);
	continue;
	}

	ta.trim_msp = msp;
	range_tree_walk(msp->ms_allocatable, vdev_trim_range_add, &ta);
	range_tree_vacate(msp->ms_trim, NULL, NULL);
	mutex_exit(&msp->ms_lock);

	error = vdev_trim_ranges(&ta);
	metaslab_enable(msp, B_TRUE, B_FALSE);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	range_tree_vacate(ta.trim_tree, NULL, NULL);
	if (error != 0)
	break;
	}

	spa_config_exit(spa, SCL_CONFIG, FTAG);
	mutex_enter(&vd->vdev_trim_io_lock);
	while (vd->vdev_trim_inflight[0] > 0) {
	cv_wait(&vd->vdev_trim_io_cv, &vd->vdev_trim_io_lock);
	}
	mutex_exit(&vd->vdev_trim_io_lock);

	range_tree_destroy(ta.trim_tree);

	mutex_enter(&vd->vdev_trim_lock);
	if (!vd->vdev_trim_exit_wanted && vdev_writeable(vd)) {
	vdev_trim_change_state(vd, VDEV_TRIM_COMPLETE,
	vd->vdev_trim_rate, vd->vdev_trim_partial,
	vd->vdev_trim_secure);
	}
	ASSERT(vd->vdev_trim_thread != NULL \|\| vd->vdev_trim_inflight[0] == 0);

	/*
	* Drop the vdev_trim_lock while we sync out the txg since it's
	* possible that a device might be trying to come online and must
	* check to see if it needs to restart a trim. That thread will be
	* holding the spa_config_lock which would prevent the txg_wait_synced
	* from completing.
	*/
	mutex_exit(&vd->vdev_trim_lock);
	txg_wait_synced(spa_get_dsl(spa), 0);
	mutex_enter(&vd->vdev_trim_lock);

	vd->vdev_trim_thread = NULL;
	cv_broadcast(&vd->vdev_trim_cv);
	mutex_exit(&vd->vdev_trim_lock);

	thread_exit();
	}

	/*
	* Initiates a manual TRIM for the vdev_t. Callers must hold vdev_trim_lock,
	* the vdev_t must be a leaf and cannot already be manually trimming.
	*/
	void
	vdev_trim(vdev_t *vd, uint64_t rate, boolean_t partial, boolean_t secure)
	{
	ASSERT(MUTEX_HELD(&vd->vdev_trim_lock));
	ASSERT(vd->vdev_ops->vdev_op_leaf);
	ASSERT(vdev_is_concrete(vd));
	ASSERT3P(vd->vdev_trim_thread, ==, NULL);
	ASSERT(!vd->vdev_detached);
	ASSERT(!vd->vdev_trim_exit_wanted);
	ASSERT(!vd->vdev_top->vdev_removing);

	vdev_trim_change_state(vd, VDEV_TRIM_ACTIVE, rate, partial, secure);
	vd->vdev_trim_thread = thread_create(NULL, 0,
	vdev_trim_thread, vd, 0, &p0, TS_RUN, maxclsyspri);
	}

	/*
	* Wait for the trimming thread to be terminated (canceled or stopped).
	*/
	static void
	vdev_trim_stop_wait_impl(vdev_t *vd)
	{
	ASSERT(MUTEX_HELD(&vd->vdev_trim_lock));

	while (vd->vdev_trim_thread != NULL)
	cv_wait(&vd->vdev_trim_cv, &vd->vdev_trim_lock);

	ASSERT3P(vd->vdev_trim_thread, ==, NULL);
	vd->vdev_trim_exit_wanted = B_FALSE;
	}

	/*
	* Wait for vdev trim threads which were listed to cleanly exit.
	*/
	void
	vdev_trim_stop_wait(spa_t spa, list_t vd_list)
	{
	vdev_t *vd;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	while ((vd = list_remove_head(vd_list)) != NULL) {
	mutex_enter(&vd->vdev_trim_lock);
	vdev_trim_stop_wait_impl(vd);
	mutex_exit(&vd->vdev_trim_lock);
	}
	}

	/*
	* Stop trimming a device, with the resultant trimming state being tgt_state.
	* For blocking behavior pass NULL for vd_list. Otherwise, when a list_t is
	* provided the stopping vdev is inserted in to the list. Callers are then
	* required to call vdev_trim_stop_wait() to block for all the trim threads
	* to exit. The caller must hold vdev_trim_lock and must not be writing to
	* the spa config, as the trimming thread may try to enter the config as a
	* reader before exiting.
	*/
	void
	vdev_trim_stop(vdev_t vd, vdev_trim_state_t tgt_state, list_t vd_list)
	{
	ASSERT(!spa_config_held(vd->vdev_spa, SCL_CONFIG\|SCL_STATE, RW_WRITER));
	ASSERT(MUTEX_HELD(&vd->vdev_trim_lock));
	ASSERT(vd->vdev_ops->vdev_op_leaf);
	ASSERT(vdev_is_concrete(vd));

	/*
	* Allow cancel requests to proceed even if the trim thread has
	* stopped.
	*/
	if (vd->vdev_trim_thread == NULL && tgt_state != VDEV_TRIM_CANCELED)
	return;

	vdev_trim_change_state(vd, tgt_state, 0, 0, 0);
	vd->vdev_trim_exit_wanted = B_TRUE;

	if (vd_list == NULL) {
	vdev_trim_stop_wait_impl(vd);
	} else {
	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	list_insert_tail(vd_list, vd);
	}
	}

	/*
	* Requests that all listed vdevs stop trimming.
	*/
	static void
	vdev_trim_stop_all_impl(vdev_t *vd, vdev_trim_state_t tgt_state,
	list_t *vd_list)
	{
	if (vd->vdev_ops->vdev_op_leaf && vdev_is_concrete(vd)) {
	mutex_enter(&vd->vdev_trim_lock);
	vdev_trim_stop(vd, tgt_state, vd_list);
	mutex_exit(&vd->vdev_trim_lock);
	return;
	}

	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	vdev_trim_stop_all_impl(vd->vdev_child[i], tgt_state,
	vd_list);
	}
	}

	/*
	* Convenience function to stop trimming of a vdev tree and set all trim
	* thread pointers to NULL.
	*/
	void
	vdev_trim_stop_all(vdev_t *vd, vdev_trim_state_t tgt_state)
	{
	spa_t *spa = vd->vdev_spa;
	list_t vd_list;
	vdev_t *vd_l2cache;

	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	list_create(&vd_list, sizeof (vdev_t),
	offsetof(vdev_t, vdev_trim_node));

	vdev_trim_stop_all_impl(vd, tgt_state, &vd_list);

	/*
	* Iterate over cache devices and request stop trimming the
	* whole device in case we export the pool or remove the cache
	* device prematurely.
	*/
	for (int i = 0; i < spa->spa_l2cache.sav_count; i++) {
	vd_l2cache = spa->spa_l2cache.sav_vdevs[i];
	vdev_trim_stop_all_impl(vd_l2cache, tgt_state, &vd_list);
	}

	vdev_trim_stop_wait(spa, &vd_list);

	if (vd->vdev_spa->spa_sync_on) {
	/* Make sure that our state has been synced to disk */
	txg_wait_synced(spa_get_dsl(vd->vdev_spa), 0);
	}

	list_destroy(&vd_list);
	}

	/*
	* Conditionally restarts a manual TRIM given its on-disk state.
	*/
	void
	vdev_trim_restart(vdev_t *vd)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));
	ASSERT(!spa_config_held(vd->vdev_spa, SCL_ALL, RW_WRITER));

	if (vd->vdev_leaf_zap != 0) {
	mutex_enter(&vd->vdev_trim_lock);
	uint64_t trim_state = VDEV_TRIM_NONE;
	int err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_STATE,
	sizeof (trim_state), 1, &trim_state);
	ASSERT(err == 0 \|\| err == ENOENT);
	vd->vdev_trim_state = trim_state;

	uint64_t timestamp = 0;
	err = zap_lookup(vd->vdev_spa->spa_meta_objset,
	vd->vdev_leaf_zap, VDEV_LEAF_ZAP_TRIM_ACTION_TIME,
	sizeof (timestamp), 1, &timestamp);
	ASSERT(err == 0 \|\| err == ENOENT);
	vd->vdev_trim_action_time = timestamp;

	if (vd->vdev_trim_state == VDEV_TRIM_SUSPENDED \|\|
	vd->vdev_offline) {
	/* load progress for reporting, but don't resume */
	VERIFY0(vdev_trim_load(vd));
	} else if (vd->vdev_trim_state == VDEV_TRIM_ACTIVE &&
	vdev_writeable(vd) && !vd->vdev_top->vdev_removing &&
	vd->vdev_trim_thread == NULL) {
	VERIFY0(vdev_trim_load(vd));
	vdev_trim(vd, vd->vdev_trim_rate,
	vd->vdev_trim_partial, vd->vdev_trim_secure);
	}

	mutex_exit(&vd->vdev_trim_lock);
	}

	for (uint64_t i = 0; i < vd->vdev_children; i++) {
	vdev_trim_restart(vd->vdev_child[i]);
	}
	}

	/*
	* Used by the automatic TRIM when ZFS_DEBUG_TRIM is set to verify that
	* every TRIM range is contained within ms_allocatable.
	*/
	static void
	vdev_trim_range_verify(void *arg, uint64_t start, uint64_t size)
	{
	trim_args_t *ta = arg;
	metaslab_t *msp = ta->trim_msp;

	VERIFY3B(msp->ms_loaded, ==, B_TRUE);
	VERIFY3U(msp->ms_disabled, >, 0);
	VERIFY(range_tree_contains(msp->ms_allocatable, start, size));
	}

	/*
	* Each automatic TRIM thread is responsible for managing the trimming of a
	* top-level vdev in the pool. No automatic TRIM state is maintained on-disk.
	*
	* N.B. This behavior is different from a manual TRIM where a thread
	* is created for each leaf vdev, instead of each top-level vdev.
	*/
	static void
	vdev_autotrim_thread(void *arg)
	{
	vdev_t *vd = arg;
	spa_t *spa = vd->vdev_spa;
	int shift = 0;

	mutex_enter(&vd->vdev_autotrim_lock);
	ASSERT3P(vd->vdev_top, ==, vd);
	ASSERT3P(vd->vdev_autotrim_thread, !=, NULL);
	mutex_exit(&vd->vdev_autotrim_lock);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	uint64_t extent_bytes_max = zfs_trim_extent_bytes_max;
	uint64_t extent_bytes_min = zfs_trim_extent_bytes_min;

	while (!vdev_autotrim_should_stop(vd)) {
	int txgs_per_trim = MAX(zfs_trim_txg_batch, 1);
	boolean_t issued_trim = B_FALSE;

	/*
	* All of the metaslabs are divided in to groups of size
	* num_metaslabs / zfs_trim_txg_batch. Each of these groups
	* is composed of metaslabs which are spread evenly over the
	* device.
	*
	* For example, when zfs_trim_txg_batch = 32 (default) then
	* group 0 will contain metaslabs 0, 32, 64, ...;
	* group 1 will contain metaslabs 1, 33, 65, ...;
	* group 2 will contain metaslabs 2, 34, 66, ...; and so on.
	*
	* On each pass through the while() loop one of these groups
	* is selected. This is accomplished by using a shift value
	* to select the starting metaslab, then striding over the
	* metaslabs using the zfs_trim_txg_batch size. This is
	* done to accomplish two things.
	*
	* 1) By dividing the metaslabs in to groups, and making sure
	* that each group takes a minimum of one txg to process.
	* Then zfs_trim_txg_batch controls the minimum number of
	* txgs which must occur before a metaslab is revisited.
	*
	* 2) Selecting non-consecutive metaslabs distributes the
	* TRIM commands for a group evenly over the entire device.
	* This can be advantageous for certain types of devices.
	*/
	for (uint64_t i = shift % txgs_per_trim; i < vd->vdev_ms_count;
	i += txgs_per_trim) {
	metaslab_t *msp = vd->vdev_ms[i];
	range_tree_t *trim_tree;

	spa_config_exit(spa, SCL_CONFIG, FTAG);
	metaslab_disable(msp);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	mutex_enter(&msp->ms_lock);

	/*
	* Skip the metaslab when it has never been allocated
	* or when there are no recent frees to trim.
	*/
	if (msp->ms_sm == NULL \|\|
	range_tree_is_empty(msp->ms_trim)) {
	mutex_exit(&msp->ms_lock);
	metaslab_enable(msp, B_FALSE, B_FALSE);
	continue;
	}

	/*
	* Skip the metaslab when it has already been disabled.
	* This may happen when a manual TRIM or initialize
	* operation is running concurrently. In the case
	* of a manual TRIM, the ms_trim tree will have been
	* vacated. Only ranges added after the manual TRIM
	* disabled the metaslab will be included in the tree.
	* These will be processed when the automatic TRIM
	* next revisits this metaslab.
	*/
	if (msp->ms_disabled > 1) {
	mutex_exit(&msp->ms_lock);
	metaslab_enable(msp, B_FALSE, B_FALSE);
	continue;
	}

	/*
	* Allocate an empty range tree which is swapped in
	* for the existing ms_trim tree while it is processed.
	*/
	trim_tree = range_tree_create(NULL, RANGE_SEG64, NULL,
	0, 0);
	range_tree_swap(&msp->ms_trim, &trim_tree);
	ASSERT(range_tree_is_empty(msp->ms_trim));

	/*
	* There are two cases when constructing the per-vdev
	* trim trees for a metaslab. If the top-level vdev
	* has no children then it is also a leaf and should
	* be trimmed. Otherwise our children are the leaves
	* and a trim tree should be constructed for each.
	*/
	trim_args_t *tap;
	uint64_t children = vd->vdev_children;
	if (children == 0) {
	children = 1;
	tap = kmem_zalloc(sizeof (trim_args_t) *
	children, KM_SLEEP);
	tap[0].trim_vdev = vd;
	} else {
	tap = kmem_zalloc(sizeof (trim_args_t) *
	children, KM_SLEEP);

	for (uint64_t c = 0; c < children; c++) {
	tap[c].trim_vdev = vd->vdev_child[c];
	}
	}

	for (uint64_t c = 0; c < children; c++) {
	trim_args_t *ta = &tap[c];
	vdev_t *cvd = ta->trim_vdev;

	ta->trim_msp = msp;
	ta->trim_extent_bytes_max = extent_bytes_max;
	ta->trim_extent_bytes_min = extent_bytes_min;
	ta->trim_type = TRIM_TYPE_AUTO;
	ta->trim_flags = 0;

	if (cvd->vdev_detached \|\|
	!vdev_writeable(cvd) \|\|
	!cvd->vdev_has_trim \|\|
	cvd->vdev_trim_thread != NULL) {
	continue;
	}

	/*
	* When a device has an attached hot spare, or
	* is being replaced it will not be trimmed.
	* This is done to avoid adding additional
	* stress to a potentially unhealthy device,
	* and to minimize the required rebuild time.
	*/
	if (!cvd->vdev_ops->vdev_op_leaf)
	continue;

	ta->trim_tree = range_tree_create(NULL,
	RANGE_SEG64, NULL, 0, 0);
	range_tree_walk(trim_tree,
	vdev_trim_range_add, ta);
	}

	mutex_exit(&msp->ms_lock);
	spa_config_exit(spa, SCL_CONFIG, FTAG);

	/*
	* Issue the TRIM I/Os for all ranges covered by the
	* TRIM trees. These ranges are safe to TRIM because
	* no new allocations will be performed until the call
	* to metaslab_enabled() below.
	*/
	for (uint64_t c = 0; c < children; c++) {
	trim_args_t *ta = &tap[c];

	/*
	* Always yield to a manual TRIM if one has
	* been started for the child vdev.
	*/
	if (ta->trim_tree == NULL \|\|
	ta->trim_vdev->vdev_trim_thread != NULL) {
	continue;
	}

	/*
	* After this point metaslab_enable() must be
	* called with the sync flag set. This is done
	* here because vdev_trim_ranges() is allowed
	* to be interrupted (EINTR) before issuing all
	* of the required TRIM I/Os.
	*/
	issued_trim = B_TRUE;

	int error = vdev_trim_ranges(ta);
	if (error)
	break;
	}

	/*
	* Verify every range which was trimmed is still
	* contained within the ms_allocatable tree.
	*/
	if (zfs_flags & ZFS_DEBUG_TRIM) {
	mutex_enter(&msp->ms_lock);
	VERIFY0(metaslab_load(msp));
	VERIFY3P(tap[0].trim_msp, ==, msp);
	range_tree_walk(trim_tree,
	vdev_trim_range_verify, &tap[0]);
	mutex_exit(&msp->ms_lock);
	}

	range_tree_vacate(trim_tree, NULL, NULL);
	range_tree_destroy(trim_tree);

	metaslab_enable(msp, issued_trim, B_FALSE);
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	for (uint64_t c = 0; c < children; c++) {
	trim_args_t *ta = &tap[c];

	if (ta->trim_tree == NULL)
	continue;

	range_tree_vacate(ta->trim_tree, NULL, NULL);
	range_tree_destroy(ta->trim_tree);
	}

	kmem_free(tap, sizeof (trim_args_t) * children);
	}

	spa_config_exit(spa, SCL_CONFIG, FTAG);

	/*
	* After completing the group of metaslabs wait for the next
	* open txg. This is done to make sure that a minimum of
	* zfs_trim_txg_batch txgs will occur before these metaslabs
	* are trimmed again.
	*/
	txg_wait_open(spa_get_dsl(spa), 0, issued_trim);

	shift++;
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);
	}

	for (uint64_t c = 0; c < vd->vdev_children; c++) {
	vdev_t *cvd = vd->vdev_child[c];
	mutex_enter(&cvd->vdev_trim_io_lock);

	while (cvd->vdev_trim_inflight[1] > 0) {
	cv_wait(&cvd->vdev_trim_io_cv,
	&cvd->vdev_trim_io_lock);
	}
	mutex_exit(&cvd->vdev_trim_io_lock);
	}

	spa_config_exit(spa, SCL_CONFIG, FTAG);

	/*
	* When exiting because the autotrim property was set to off, then
	* abandon any unprocessed ms_trim ranges to reclaim the memory.
	*/
	if (spa_get_autotrim(spa) == SPA_AUTOTRIM_OFF) {
	for (uint64_t i = 0; i < vd->vdev_ms_count; i++) {
	metaslab_t *msp = vd->vdev_ms[i];

	mutex_enter(&msp->ms_lock);
	range_tree_vacate(msp->ms_trim, NULL, NULL);
	mutex_exit(&msp->ms_lock);
	}
	}

	mutex_enter(&vd->vdev_autotrim_lock);
	ASSERT(vd->vdev_autotrim_thread != NULL);
	vd->vdev_autotrim_thread = NULL;
	cv_broadcast(&vd->vdev_autotrim_cv);
	mutex_exit(&vd->vdev_autotrim_lock);

	thread_exit();
	}

	/*
	* Starts an autotrim thread, if needed, for each top-level vdev which can be
	* trimmed. A top-level vdev which has been evacuated will never be trimmed.
	*/
	void
	vdev_autotrim(spa_t *spa)
	{
	vdev_t *root_vd = spa->spa_root_vdev;

	for (uint64_t i = 0; i < root_vd->vdev_children; i++) {
	vdev_t *tvd = root_vd->vdev_child[i];

	mutex_enter(&tvd->vdev_autotrim_lock);
	if (vdev_writeable(tvd) && !tvd->vdev_removing &&
	tvd->vdev_autotrim_thread == NULL) {
	ASSERT3P(tvd->vdev_top, ==, tvd);

	tvd->vdev_autotrim_thread = thread_create(NULL, 0,
	vdev_autotrim_thread, tvd, 0, &p0, TS_RUN,
	maxclsyspri);
	ASSERT(tvd->vdev_autotrim_thread != NULL);
	}
	mutex_exit(&tvd->vdev_autotrim_lock);
	}
	}

	/*
	* Wait for the vdev_autotrim_thread associated with the passed top-level
	* vdev to be terminated (canceled or stopped).
	*/
	void
	vdev_autotrim_stop_wait(vdev_t *tvd)
	{
	mutex_enter(&tvd->vdev_autotrim_lock);
	if (tvd->vdev_autotrim_thread != NULL) {
	tvd->vdev_autotrim_exit_wanted = B_TRUE;

	while (tvd->vdev_autotrim_thread != NULL) {
	cv_wait(&tvd->vdev_autotrim_cv,
	&tvd->vdev_autotrim_lock);
	}

	ASSERT3P(tvd->vdev_autotrim_thread, ==, NULL);
	tvd->vdev_autotrim_exit_wanted = B_FALSE;
	}
	mutex_exit(&tvd->vdev_autotrim_lock);
	}

	/*
	* Wait for all of the vdev_autotrim_thread associated with the pool to
	* be terminated (canceled or stopped).
	*/
	void
	vdev_autotrim_stop_all(spa_t *spa)
	{
	vdev_t *root_vd = spa->spa_root_vdev;

	for (uint64_t i = 0; i < root_vd->vdev_children; i++)
	vdev_autotrim_stop_wait(root_vd->vdev_child[i]);
	}

	/*
	* Conditionally restart all of the vdev_autotrim_thread's for the pool.
	*/
	void
	vdev_autotrim_restart(spa_t *spa)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	if (spa->spa_autotrim)
	vdev_autotrim(spa);
	}

	static void
	vdev_trim_l2arc_thread(void *arg)
	{
	vdev_t *vd = arg;
	spa_t *spa = vd->vdev_spa;
	l2arc_dev_t *dev = l2arc_vdev_get(vd);
	trim_args_t ta;
	range_seg64_t physical_rs;

	ASSERT(vdev_is_concrete(vd));
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_READER);

	vd->vdev_trim_last_offset = 0;
	vd->vdev_trim_rate = 0;
	vd->vdev_trim_partial = 0;
	vd->vdev_trim_secure = 0;

	bzero(&ta, sizeof (ta));
	ta.trim_vdev = vd;
	ta.trim_tree = range_tree_create(NULL, RANGE_SEG64, NULL, 0, 0);
	ta.trim_type = TRIM_TYPE_MANUAL;
	ta.trim_extent_bytes_max = zfs_trim_extent_bytes_max;
	ta.trim_extent_bytes_min = SPA_MINBLOCKSIZE;
	ta.trim_flags = 0;

	physical_rs.rs_start = vd->vdev_trim_bytes_done = 0;
	physical_rs.rs_end = vd->vdev_trim_bytes_est =
	vdev_get_min_asize(vd);

	range_tree_add(ta.trim_tree, physical_rs.rs_start,
	physical_rs.rs_end - physical_rs.rs_start);

	mutex_enter(&vd->vdev_trim_lock);
	vdev_trim_change_state(vd, VDEV_TRIM_ACTIVE, 0, 0, 0);
	mutex_exit(&vd->vdev_trim_lock);

	(void) vdev_trim_ranges(&ta);

	spa_config_exit(spa, SCL_CONFIG, FTAG);
	mutex_enter(&vd->vdev_trim_io_lock);
	while (vd->vdev_trim_inflight[TRIM_TYPE_MANUAL] > 0) {
	cv_wait(&vd->vdev_trim_io_cv, &vd->vdev_trim_io_lock);
	}
	mutex_exit(&vd->vdev_trim_io_lock);

	range_tree_vacate(ta.trim_tree, NULL, NULL);
	range_tree_destroy(ta.trim_tree);

	mutex_enter(&vd->vdev_trim_lock);
	if (!vd->vdev_trim_exit_wanted && vdev_writeable(vd)) {
	vdev_trim_change_state(vd, VDEV_TRIM_COMPLETE,
	vd->vdev_trim_rate, vd->vdev_trim_partial,
	vd->vdev_trim_secure);
	}
	ASSERT(vd->vdev_trim_thread != NULL \|\|
	vd->vdev_trim_inflight[TRIM_TYPE_MANUAL] == 0);

	/*
	* Drop the vdev_trim_lock while we sync out the txg since it's
	* possible that a device might be trying to come online and
	* must check to see if it needs to restart a trim. That thread
	* will be holding the spa_config_lock which would prevent the
	* txg_wait_synced from completing. Same strategy as in
	* vdev_trim_thread().
	*/
	mutex_exit(&vd->vdev_trim_lock);
	txg_wait_synced(spa_get_dsl(vd->vdev_spa), 0);
	mutex_enter(&vd->vdev_trim_lock);

	/*
	* Update the header of the cache device here, before
	* broadcasting vdev_trim_cv which may lead to the removal
	* of the device. The same applies for setting l2ad_trim_all to
	* false.
	*/
	spa_config_enter(vd->vdev_spa, SCL_L2ARC, vd,
	RW_READER);
	bzero(dev->l2ad_dev_hdr, dev->l2ad_dev_hdr_asize);
	l2arc_dev_hdr_update(dev);
	spa_config_exit(vd->vdev_spa, SCL_L2ARC, vd);

	vd->vdev_trim_thread = NULL;
	if (vd->vdev_trim_state == VDEV_TRIM_COMPLETE)
	dev->l2ad_trim_all = B_FALSE;

	cv_broadcast(&vd->vdev_trim_cv);
	mutex_exit(&vd->vdev_trim_lock);

	thread_exit();
	}

	/*
	* Punches out TRIM threads for the L2ARC devices in a spa and assigns them
	* to vd->vdev_trim_thread variable. This facilitates the management of
	* trimming the whole cache device using TRIM_TYPE_MANUAL upon addition
	* to a pool or pool creation or when the header of the device is invalid.
	*/
	void
	vdev_trim_l2arc(spa_t *spa)
	{
	ASSERT(MUTEX_HELD(&spa_namespace_lock));

	/*
	* Locate the spa's l2arc devices and kick off TRIM threads.
	*/
	for (int i = 0; i < spa->spa_l2cache.sav_count; i++) {
	vdev_t *vd = spa->spa_l2cache.sav_vdevs[i];
	l2arc_dev_t *dev = l2arc_vdev_get(vd);

	if (dev == NULL \|\| !dev->l2ad_trim_all) {
	/*
	* Don't attempt TRIM if the vdev is UNAVAIL or if the
	* cache device was not marked for whole device TRIM
	* (ie l2arc_trim_ahead = 0, or the L2ARC device header
	* is valid with trim_state = VDEV_TRIM_COMPLETE and
	* l2ad_log_entries > 0).
	*/
	continue;
	}

	mutex_enter(&vd->vdev_trim_lock);
	ASSERT(vd->vdev_ops->vdev_op_leaf);
	ASSERT(vdev_is_concrete(vd));
	ASSERT3P(vd->vdev_trim_thread, ==, NULL);
	ASSERT(!vd->vdev_detached);
	ASSERT(!vd->vdev_trim_exit_wanted);
	ASSERT(!vd->vdev_top->vdev_removing);
	vdev_trim_change_state(vd, VDEV_TRIM_ACTIVE, 0, 0, 0);
	vd->vdev_trim_thread = thread_create(NULL, 0,
	vdev_trim_l2arc_thread, vd, 0, &p0, TS_RUN, maxclsyspri);
	mutex_exit(&vd->vdev_trim_lock);
	}
	}

	/*
	* A wrapper which calls vdev_trim_ranges(). It is intended to be called
	* on leaf vdevs.
	*/
	int
	vdev_trim_simple(vdev_t *vd, uint64_t start, uint64_t size)
	{
	trim_args_t ta;
	range_seg64_t physical_rs;
	int error;
	physical_rs.rs_start = start;
	physical_rs.rs_end = start + size;

	ASSERT(vdev_is_concrete(vd));
	ASSERT(vd->vdev_ops->vdev_op_leaf);
	ASSERT(!vd->vdev_detached);
	ASSERT(!vd->vdev_top->vdev_removing);

	bzero(&ta, sizeof (ta));
	ta.trim_vdev = vd;
	ta.trim_tree = range_tree_create(NULL, RANGE_SEG64, NULL, 0, 0);
	ta.trim_type = TRIM_TYPE_SIMPLE;
	ta.trim_extent_bytes_max = zfs_trim_extent_bytes_max;
	ta.trim_extent_bytes_min = SPA_MINBLOCKSIZE;
	ta.trim_flags = 0;

	ASSERT3U(physical_rs.rs_end, >=, physical_rs.rs_start);

	if (physical_rs.rs_end > physical_rs.rs_start) {
	range_tree_add(ta.trim_tree, physical_rs.rs_start,
	physical_rs.rs_end - physical_rs.rs_start);
	} else {
	ASSERT3U(physical_rs.rs_end, ==, physical_rs.rs_start);
	}

	error = vdev_trim_ranges(&ta);

	mutex_enter(&vd->vdev_trim_io_lock);
	while (vd->vdev_trim_inflight[TRIM_TYPE_SIMPLE] > 0) {
	cv_wait(&vd->vdev_trim_io_cv, &vd->vdev_trim_io_lock);
	}
	mutex_exit(&vd->vdev_trim_io_lock);

	range_tree_vacate(ta.trim_tree, NULL, NULL);
	range_tree_destroy(ta.trim_tree);

	return (error);
	}

	EXPORT_SYMBOL(vdev_trim);
	EXPORT_SYMBOL(vdev_trim_stop);
	EXPORT_SYMBOL(vdev_trim_stop_all);
	EXPORT_SYMBOL(vdev_trim_stop_wait);
	EXPORT_SYMBOL(vdev_trim_restart);
	EXPORT_SYMBOL(vdev_autotrim);
	EXPORT_SYMBOL(vdev_autotrim_stop_all);
	EXPORT_SYMBOL(vdev_autotrim_stop_wait);
	EXPORT_SYMBOL(vdev_autotrim_restart);
	EXPORT_SYMBOL(vdev_trim_l2arc);
	EXPORT_SYMBOL(vdev_trim_simple);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_trim, zfs_trim_, extent_bytes_max, UINT, ZMOD_RW,
	"Max size of TRIM commands, larger will be split");

	ZFS_MODULE_PARAM(zfs_trim, zfs_trim_, extent_bytes_min, UINT, ZMOD_RW,
	"Min size of TRIM commands, smaller will be skipped");

	ZFS_MODULE_PARAM(zfs_trim, zfs_trim_, metaslab_skip, UINT, ZMOD_RW,
	"Skip metaslabs which have never been initialized");

	ZFS_MODULE_PARAM(zfs_trim, zfs_trim_, txg_batch, UINT, ZMOD_RW,
	"Min number of txgs to aggregate frees before issuing TRIM");

	ZFS_MODULE_PARAM(zfs_trim, zfs_trim_, queue_limit, UINT, ZMOD_RW,
	"Max queued TRIMs outstanding per leaf vdev");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/zfs_fm.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/zfs_fm.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/zfs_fm.c (revision 365892)
	@@ -1,1083 +1,1414 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
	* Use is subject to license terms.
	*/

	/*
	- * Copyright (c) 2012 by Delphix. All rights reserved.
	+ * Copyright (c) 2012,2020 by Delphix. All rights reserved.
	*/

	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev.h>
	#include <sys/vdev_impl.h>
	#include <sys/zio.h>
	#include <sys/zio_checksum.h>

	#include <sys/fm/fs/zfs.h>
	#include <sys/fm/protocol.h>
	#include <sys/fm/util.h>
	#include <sys/sysevent.h>

	/*
	* This general routine is responsible for generating all the different ZFS
	* ereports. The payload is dependent on the class, and which arguments are
	* supplied to the function:
	*
	* EREPORT POOL VDEV IO
	* block X X X
	* data X X
	* device X X
	* pool X
	*
	* If we are in a loading state, all errors are chained together by the same
	* SPA-wide ENA (Error Numeric Association).
	*
	* For isolated I/O requests, we get the ENA from the zio_t. The propagation
	* gets very complicated due to RAID-Z, gang blocks, and vdev caching. We want
	* to chain together all ereports associated with a logical piece of data. For
	* read I/Os, there are basically three 'types' of I/O, which form a roughly
	* layered diagram:
	*
	* +---------------+
	* \| Aggregate I/O \| No associated logical data or device
	* +---------------+
	* \|
	* V
	* +---------------+ Reads associated with a piece of logical data.
	* \| Read I/O \| This includes reads on behalf of RAID-Z,
	* +---------------+ mirrors, gang blocks, retries, etc.
	* \|
	* V
	* +---------------+ Reads associated with a particular device, but
	* \| Physical I/O \| no logical data. Issued as part of vdev caching
	* +---------------+ and I/O aggregation.
	*
	* Note that 'physical I/O' here is not the same terminology as used in the rest
	* of ZIO. Typically, 'physical I/O' simply means that there is no attached
	* blockpointer. But I/O with no associated block pointer can still be related
	* to a logical piece of data (i.e. RAID-Z requests).
	*
	* Purely physical I/O always have unique ENAs. They are not related to a
	* particular piece of logical data, and therefore cannot be chained together.
	* We still generate an ereport, but the DE doesn't correlate it with any
	* logical piece of data. When such an I/O fails, the delegated I/O requests
	* will issue a retry, which will trigger the 'real' ereport with the correct
	* ENA.
	*
	* We keep track of the ENA for a ZIO chain through the 'io_logical' member.
	* When a new logical I/O is issued, we set this to point to itself. Child I/Os
	* then inherit this pointer, so that when it is first set subsequent failures
	* will use the same ENA. For vdev cache fill and queue aggregation I/O,
	* this pointer is set to NULL, and no ereport will be generated (since it
	* doesn't actually correspond to any particular device or piece of data,
	* and the caller will always retry without caching or queueing anyway).
	*
	* For checksum errors, we want to include more information about the actual
	* error which occurs. Accordingly, we build an ereport when the error is
	* noticed, but instead of sending it in immediately, we hang it off of the
	* io_cksum_report field of the logical IO. When the logical IO completes
	* (successfully or not), zfs_ereport_finish_checksum() is called with the
	* good and bad versions of the buffer (if available), and we annotate the
	* ereport with information about the differences.
	*/
	+
	#ifdef _KERNEL
	+/*
	+ * Duplicate ereport Detection
	+ *
	+ * Some ereports are retained momentarily for detecting duplicates. These
	+ * are kept in a recent_events_node_t in both a time-ordered list and an AVL
	+ * tree of recent unique ereports.
	+ *
	+ * The lifespan of these recent ereports is bounded (15 mins) and a cleaner
	+ * task is used to purge stale entries.
	+ */
	+static list_t recent_events_list;
	+static avl_tree_t recent_events_tree;
	+static kmutex_t recent_events_lock;
	+static taskqid_t recent_events_cleaner_tqid;
	+
	+/*
	+ * Each node is about 128 bytes so 2,000 would consume 1/4 MiB.
	+ *
	+ * This setting can be changed dynamically and setting it to zero
	+ * disables duplicate detection.
	+ */
	+unsigned int zfs_zevent_retain_max = 2000;
	+
	+/*
	+ * The lifespan for a recent ereport entry. The default of 15 minutes is
	+ * intended to outlive the zfs diagnosis engine's threshold of 10 errors
	+ * over a period of 10 minutes.
	+ */
	+unsigned int zfs_zevent_retain_expire_secs = 900;
	+
	+typedef enum zfs_subclass {
	+ ZSC_IO,
	+ ZSC_DATA,
	+ ZSC_CHECKSUM
	+} zfs_subclass_t;
	+
	+typedef struct {
	+ /* common criteria */
	+ uint64_t re_pool_guid;
	+ uint64_t re_vdev_guid;
	+ int re_io_error;
	+ uint64_t re_io_size;
	+ uint64_t re_io_offset;
	+ zfs_subclass_t re_subclass;
	+ zio_priority_t re_io_priority;
	+
	+ /* logical zio criteria (optional) */
	+ zbookmark_phys_t re_io_bookmark;
	+
	+ /* internal state */
	+ avl_node_t re_tree_link;
	+ list_node_t re_list_link;
	+ uint64_t re_timestamp;
	+} recent_events_node_t;
	+
	+static int
	+recent_events_compare(const void a, const void b)
	+{
	+ const recent_events_node_t *node1 = a;
	+ const recent_events_node_t *node2 = b;
	+ int cmp;
	+
	+ /*
	+ * The comparison order here is somewhat arbitrary.
	+ * What's important is that if every criteria matches, then it
	+ * is a duplicate (i.e. compare returns 0)
	+ */
	+ if ((cmp = TREE_CMP(node1->re_subclass, node2->re_subclass)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(node1->re_pool_guid, node2->re_pool_guid)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(node1->re_vdev_guid, node2->re_vdev_guid)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(node1->re_io_error, node2->re_io_error)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(node1->re_io_priority, node2->re_io_priority)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(node1->re_io_size, node2->re_io_size)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(node1->re_io_offset, node2->re_io_offset)) != 0)
	+ return (cmp);
	+
	+ const zbookmark_phys_t *zb1 = &node1->re_io_bookmark;
	+ const zbookmark_phys_t *zb2 = &node2->re_io_bookmark;
	+
	+ if ((cmp = TREE_CMP(zb1->zb_objset, zb2->zb_objset)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(zb1->zb_object, zb2->zb_object)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(zb1->zb_level, zb2->zb_level)) != 0)
	+ return (cmp);
	+ if ((cmp = TREE_CMP(zb1->zb_blkid, zb2->zb_blkid)) != 0)
	+ return (cmp);
	+
	+ return (0);
	+}
	+
	+static void zfs_ereport_schedule_cleaner(void);
	+
	+/*
	+ * background task to clean stale recent event nodes.
	+ */
	+/ARGSUSED/
	+static void
	+zfs_ereport_cleaner(void *arg)
	+{
	+ recent_events_node_t *entry;
	+ uint64_t now = gethrtime();
	+
	+ /*
	+ * purge expired entries
	+ */
	+ mutex_enter(&recent_events_lock);
	+ while ((entry = list_tail(&recent_events_list)) != NULL) {
	+ uint64_t age = NSEC2SEC(now - entry->re_timestamp);
	+ if (age <= zfs_zevent_retain_expire_secs)
	+ break;
	+
	+ /* remove expired node */
	+ avl_remove(&recent_events_tree, entry);
	+ list_remove(&recent_events_list, entry);
	+ kmem_free(entry, sizeof (*entry));
	+ }
	+
	+ /* Restart the cleaner if more entries remain */
	+ recent_events_cleaner_tqid = 0;
	+ if (!list_is_empty(&recent_events_list))
	+ zfs_ereport_schedule_cleaner();
	+
	+ mutex_exit(&recent_events_lock);
	+}
	+
	+static void
	+zfs_ereport_schedule_cleaner(void)
	+{
	+ ASSERT(MUTEX_HELD(&recent_events_lock));
	+
	+ uint64_t timeout = SEC2NSEC(zfs_zevent_retain_expire_secs + 1);
	+
	+ recent_events_cleaner_tqid = taskq_dispatch_delay(
	+ system_delay_taskq, zfs_ereport_cleaner, NULL, TQ_SLEEP,
	+ ddi_get_lbolt() + NSEC_TO_TICK(timeout));
	+}
	+
	+/*
	+ * Check if an ereport would be a duplicate of one recently posted.
	+ *
	+ * An ereport is considered a duplicate if the set of criteria in
	+ * recent_events_node_t all match.
	+ *
	+ * Only FM_EREPORT_ZFS_IO, FM_EREPORT_ZFS_DATA, and FM_EREPORT_ZFS_CHECKSUM
	+ * are candidates for duplicate checking.
	+ */
	+static boolean_t
	+zfs_ereport_is_duplicate(const char subclass, spa_t spa, vdev_t *vd,
	+ const zbookmark_phys_t zb, zio_t zio, uint64_t offset, uint64_t size)
	+{
	+ recent_events_node_t search = {0}, *entry;
	+
	+ if (vd == NULL \|\| zio == NULL)
	+ return (B_FALSE);
	+
	+ if (zfs_zevent_retain_max == 0)
	+ return (B_FALSE);
	+
	+ if (strcmp(subclass, FM_EREPORT_ZFS_IO) == 0)
	+ search.re_subclass = ZSC_IO;
	+ else if (strcmp(subclass, FM_EREPORT_ZFS_DATA) == 0)
	+ search.re_subclass = ZSC_DATA;
	+ else if (strcmp(subclass, FM_EREPORT_ZFS_CHECKSUM) == 0)
	+ search.re_subclass = ZSC_CHECKSUM;
	+ else
	+ return (B_FALSE);
	+
	+ search.re_pool_guid = spa_guid(spa);
	+ search.re_vdev_guid = vd->vdev_guid;
	+ search.re_io_error = zio->io_error;
	+ search.re_io_priority = zio->io_priority;
	+ /* if size is supplied use it over what's in zio */
	+ if (size) {
	+ search.re_io_size = size;
	+ search.re_io_offset = offset;
	+ } else {
	+ search.re_io_size = zio->io_size;
	+ search.re_io_offset = zio->io_offset;
	+ }
	+
	+ /* grab optional logical zio criteria */
	+ if (zb != NULL) {
	+ search.re_io_bookmark.zb_objset = zb->zb_objset;
	+ search.re_io_bookmark.zb_object = zb->zb_object;
	+ search.re_io_bookmark.zb_level = zb->zb_level;
	+ search.re_io_bookmark.zb_blkid = zb->zb_blkid;
	+ }
	+
	+ uint64_t now = gethrtime();
	+
	+ mutex_enter(&recent_events_lock);
	+
	+ /* check if we have seen this one recently */
	+ entry = avl_find(&recent_events_tree, &search, NULL);
	+ if (entry != NULL) {
	+ uint64_t age = NSEC2SEC(now - entry->re_timestamp);
	+
	+ /*
	+ * There is still an active cleaner (since we're here).
	+ * Reset the last seen time for this duplicate entry
	+ * so that its lifespand gets extended.
	+ */
	+ list_remove(&recent_events_list, entry);
	+ list_insert_head(&recent_events_list, entry);
	+ entry->re_timestamp = now;
	+
	+ zfs_zevent_track_duplicate();
	+ mutex_exit(&recent_events_lock);
	+
	+ return (age <= zfs_zevent_retain_expire_secs);
	+ }
	+
	+ if (avl_numnodes(&recent_events_tree) >= zfs_zevent_retain_max) {
	+ /* recycle oldest node */
	+ entry = list_tail(&recent_events_list);
	+ ASSERT(entry != NULL);
	+ list_remove(&recent_events_list, entry);
	+ avl_remove(&recent_events_tree, entry);
	+ } else {
	+ entry = kmem_alloc(sizeof (recent_events_node_t), KM_SLEEP);
	+ }
	+
	+ /* record this as a recent ereport */
	+ *entry = search;
	+ avl_add(&recent_events_tree, entry);
	+ list_insert_head(&recent_events_list, entry);
	+ entry->re_timestamp = now;
	+
	+ /* Start a cleaner if not already scheduled */
	+ if (recent_events_cleaner_tqid == 0)
	+ zfs_ereport_schedule_cleaner();
	+
	+ mutex_exit(&recent_events_lock);
	+ return (B_FALSE);
	+}
	+
	void
	zfs_zevent_post_cb(nvlist_t nvl, nvlist_t detector)
	{
	if (nvl)
	fm_nvlist_destroy(nvl, FM_NVA_FREE);

	if (detector)
	fm_nvlist_destroy(detector, FM_NVA_FREE);
	}

	/*
	* We want to rate limit ZIO delay and checksum events so as to not
	* flood ZED when a disk is acting up.
	*
	* Returns 1 if we're ratelimiting, 0 if not.
	*/
	static int
	zfs_is_ratelimiting_event(const char subclass, vdev_t vd)
	{
	int rc = 0;
	/*
	* __ratelimit() returns 1 if we're not ratelimiting and 0 if we
	* are. Invert it to get our return value.
	*/
	if (strcmp(subclass, FM_EREPORT_ZFS_DELAY) == 0) {
	rc = !zfs_ratelimit(&vd->vdev_delay_rl);
	} else if (strcmp(subclass, FM_EREPORT_ZFS_CHECKSUM) == 0) {
	rc = !zfs_ratelimit(&vd->vdev_checksum_rl);
	}

	if (rc) {
	/* We're rate limiting */
	fm_erpt_dropped_increment();
	}

	return (rc);
	}

	/*
	* Return B_TRUE if the event actually posted, B_FALSE if not.
	*/
	static boolean_t
	zfs_ereport_start(nvlist_t ereport_out, nvlist_t detector_out,
	const char subclass, spa_t spa, vdev_t vd, const zbookmark_phys_t zb,
	zio_t *zio, uint64_t stateoroffset, uint64_t size)
	{
	nvlist_t ereport, detector;

	uint64_t ena;
	char class[64];

	- if (!zfs_ereport_is_valid(subclass, spa, vd, zio))
	- return (B_FALSE);
	-
	if ((ereport = fm_nvlist_create(NULL)) == NULL)
	return (B_FALSE);

	if ((detector = fm_nvlist_create(NULL)) == NULL) {
	fm_nvlist_destroy(ereport, FM_NVA_FREE);
	return (B_FALSE);
	}

	/*
	* Serialize ereport generation
	*/
	mutex_enter(&spa->spa_errlist_lock);

	/*
	* Determine the ENA to use for this event. If we are in a loading
	* state, use a SPA-wide ENA. Otherwise, if we are in an I/O state, use
	* a root zio-wide ENA. Otherwise, simply use a unique ENA.
	*/
	if (spa_load_state(spa) != SPA_LOAD_NONE) {
	if (spa->spa_ena == 0)
	spa->spa_ena = fm_ena_generate(0, FM_ENA_FMT1);
	ena = spa->spa_ena;
	} else if (zio != NULL && zio->io_logical != NULL) {
	if (zio->io_logical->io_ena == 0)
	zio->io_logical->io_ena =
	fm_ena_generate(0, FM_ENA_FMT1);
	ena = zio->io_logical->io_ena;
	} else {
	ena = fm_ena_generate(0, FM_ENA_FMT1);
	}

	/*
	* Construct the full class, detector, and other standard FMA fields.
	*/
	(void) snprintf(class, sizeof (class), "%s.%s",
	ZFS_ERROR_CLASS, subclass);

	fm_fmri_zfs_set(detector, FM_ZFS_SCHEME_VERSION, spa_guid(spa),
	vd != NULL ? vd->vdev_guid : 0);

	fm_ereport_set(ereport, FM_EREPORT_VERSION, class, ena, detector, NULL);

	/*
	* Construct the per-ereport payload, depending on which parameters are
	* passed in.
	*/

	/*
	* Generic payload members common to all ereports.
	*/
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_POOL, DATA_TYPE_STRING, spa_name(spa),
	FM_EREPORT_PAYLOAD_ZFS_POOL_GUID, DATA_TYPE_UINT64, spa_guid(spa),
	FM_EREPORT_PAYLOAD_ZFS_POOL_STATE, DATA_TYPE_UINT64,
	(uint64_t)spa_state(spa),
	FM_EREPORT_PAYLOAD_ZFS_POOL_CONTEXT, DATA_TYPE_INT32,
	(int32_t)spa_load_state(spa), NULL);

	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_POOL_FAILMODE,
	DATA_TYPE_STRING,
	spa_get_failmode(spa) == ZIO_FAILURE_MODE_WAIT ?
	FM_EREPORT_FAILMODE_WAIT :
	spa_get_failmode(spa) == ZIO_FAILURE_MODE_CONTINUE ?
	FM_EREPORT_FAILMODE_CONTINUE : FM_EREPORT_FAILMODE_PANIC,
	NULL);

	if (vd != NULL) {
	vdev_t *pvd = vd->vdev_parent;
	vdev_queue_t *vq = &vd->vdev_queue;
	vdev_stat_t *vs = &vd->vdev_stat;
	vdev_t *spare_vd;
	uint64_t *spare_guids;
	char **spare_paths;
	int i, spare_count;

	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_VDEV_GUID,
	DATA_TYPE_UINT64, vd->vdev_guid,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_TYPE,
	DATA_TYPE_STRING, vd->vdev_ops->vdev_op_type, NULL);
	if (vd->vdev_path != NULL)
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_PATH,
	DATA_TYPE_STRING, vd->vdev_path, NULL);
	if (vd->vdev_devid != NULL)
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_DEVID,
	DATA_TYPE_STRING, vd->vdev_devid, NULL);
	if (vd->vdev_fru != NULL)
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_FRU,
	DATA_TYPE_STRING, vd->vdev_fru, NULL);
	if (vd->vdev_enc_sysfs_path != NULL)
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_ENC_SYSFS_PATH,
	DATA_TYPE_STRING, vd->vdev_enc_sysfs_path, NULL);
	if (vd->vdev_ashift)
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_ASHIFT,
	DATA_TYPE_UINT64, vd->vdev_ashift, NULL);

	if (vq != NULL) {
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_COMP_TS,
	DATA_TYPE_UINT64, vq->vq_io_complete_ts, NULL);
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_DELTA_TS,
	DATA_TYPE_UINT64, vq->vq_io_delta_ts, NULL);
	}

	if (vs != NULL) {
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_READ_ERRORS,
	DATA_TYPE_UINT64, vs->vs_read_errors,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_WRITE_ERRORS,
	DATA_TYPE_UINT64, vs->vs_write_errors,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_CKSUM_ERRORS,
	DATA_TYPE_UINT64, vs->vs_checksum_errors,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_DELAYS,
	DATA_TYPE_UINT64, vs->vs_slow_ios,
	NULL);
	}

	if (pvd != NULL) {
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_PARENT_GUID,
	DATA_TYPE_UINT64, pvd->vdev_guid,
	FM_EREPORT_PAYLOAD_ZFS_PARENT_TYPE,
	DATA_TYPE_STRING, pvd->vdev_ops->vdev_op_type,
	NULL);
	if (pvd->vdev_path)
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_PARENT_PATH,
	DATA_TYPE_STRING, pvd->vdev_path, NULL);
	if (pvd->vdev_devid)
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_PARENT_DEVID,
	DATA_TYPE_STRING, pvd->vdev_devid, NULL);
	}

	spare_count = spa->spa_spares.sav_count;
	spare_paths = kmem_zalloc(sizeof (char ) spare_count,
	KM_SLEEP);
	spare_guids = kmem_zalloc(sizeof (uint64_t) * spare_count,
	KM_SLEEP);

	for (i = 0; i < spare_count; i++) {
	spare_vd = spa->spa_spares.sav_vdevs[i];
	if (spare_vd) {
	spare_paths[i] = spare_vd->vdev_path;
	spare_guids[i] = spare_vd->vdev_guid;
	}
	}

	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_VDEV_SPARE_PATHS,
	DATA_TYPE_STRING_ARRAY, spare_count, spare_paths,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_SPARE_GUIDS,
	DATA_TYPE_UINT64_ARRAY, spare_count, spare_guids, NULL);

	kmem_free(spare_guids, sizeof (uint64_t) * spare_count);
	kmem_free(spare_paths, sizeof (char ) spare_count);
	}

	if (zio != NULL) {
	/*
	* Payload common to all I/Os.
	*/
	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_ZIO_ERR,
	DATA_TYPE_INT32, zio->io_error, NULL);
	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_ZIO_FLAGS,
	DATA_TYPE_INT32, zio->io_flags, NULL);
	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_ZIO_STAGE,
	DATA_TYPE_UINT32, zio->io_stage, NULL);
	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_ZIO_PIPELINE,
	DATA_TYPE_UINT32, zio->io_pipeline, NULL);
	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_ZIO_DELAY,
	DATA_TYPE_UINT64, zio->io_delay, NULL);
	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_ZIO_TIMESTAMP,
	DATA_TYPE_UINT64, zio->io_timestamp, NULL);
	fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_ZIO_DELTA,
	DATA_TYPE_UINT64, zio->io_delta, NULL);
	+ fm_payload_set(ereport, FM_EREPORT_PAYLOAD_ZFS_ZIO_PRIORITY,
	+ DATA_TYPE_UINT32, zio->io_priority, NULL);

	/*
	* If the 'size' parameter is non-zero, it indicates this is a
	* RAID-Z or other I/O where the physical offset and length are
	* provided for us, instead of within the zio_t.
	*/
	if (vd != NULL) {
	if (size)
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_ZIO_OFFSET,
	DATA_TYPE_UINT64, stateoroffset,
	FM_EREPORT_PAYLOAD_ZFS_ZIO_SIZE,
	DATA_TYPE_UINT64, size, NULL);
	else
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_ZIO_OFFSET,
	DATA_TYPE_UINT64, zio->io_offset,
	FM_EREPORT_PAYLOAD_ZFS_ZIO_SIZE,
	DATA_TYPE_UINT64, zio->io_size, NULL);
	}
	} else if (vd != NULL) {
	/*
	* If we have a vdev but no zio, this is a device fault, and the
	* 'stateoroffset' parameter indicates the previous state of the
	* vdev.
	*/
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_PREV_STATE,
	DATA_TYPE_UINT64, stateoroffset, NULL);
	}

	/*
	* Payload for I/Os with corresponding logical information.
	*/
	if (zb != NULL && (zio == NULL \|\| zio->io_logical != NULL)) {
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_ZIO_OBJSET,
	DATA_TYPE_UINT64, zb->zb_objset,
	FM_EREPORT_PAYLOAD_ZFS_ZIO_OBJECT,
	DATA_TYPE_UINT64, zb->zb_object,
	FM_EREPORT_PAYLOAD_ZFS_ZIO_LEVEL,
	DATA_TYPE_INT64, zb->zb_level,
	FM_EREPORT_PAYLOAD_ZFS_ZIO_BLKID,
	DATA_TYPE_UINT64, zb->zb_blkid, NULL);
	}

	mutex_exit(&spa->spa_errlist_lock);

	*ereport_out = ereport;
	*detector_out = detector;
	return (B_TRUE);
	}

	/* if it's <= 128 bytes, save the corruption directly */
	#define ZFM_MAX_INLINE (128 / sizeof (uint64_t))

	#define MAX_RANGES 16

	typedef struct zfs_ecksum_info {
	/* histograms of set and cleared bits by bit number in a 64-bit word */
	uint32_t zei_histogram_set[sizeof (uint64_t) * NBBY];
	uint32_t zei_histogram_cleared[sizeof (uint64_t) * NBBY];

	/* inline arrays of bits set and cleared. */
	uint64_t zei_bits_set[ZFM_MAX_INLINE];
	uint64_t zei_bits_cleared[ZFM_MAX_INLINE];

	/*
	* for each range, the number of bits set and cleared. The Hamming
	* distance between the good and bad buffers is the sum of them all.
	*/
	uint32_t zei_range_sets[MAX_RANGES];
	uint32_t zei_range_clears[MAX_RANGES];

	struct zei_ranges {
	uint32_t zr_start;
	uint32_t zr_end;
	} zei_ranges[MAX_RANGES];

	size_t zei_range_count;
	uint32_t zei_mingap;
	uint32_t zei_allowed_mingap;

	} zfs_ecksum_info_t;

	static void
	update_histogram(uint64_t value_arg, uint32_t hist, uint32_t count)
	{
	size_t i;
	size_t bits = 0;
	uint64_t value = BE_64(value_arg);

	/* We store the bits in big-endian (largest-first) order */
	for (i = 0; i < 64; i++) {
	if (value & (1ull << i)) {
	hist[63 - i]++;
	++bits;
	}
	}
	/* update the count of bits changed */
	*count += bits;
	}

	/*
	* We've now filled up the range array, and need to increase "mingap" and
	* shrink the range list accordingly. zei_mingap is always the smallest
	* distance between array entries, so we set the new_allowed_gap to be
	* one greater than that. We then go through the list, joining together
	* any ranges which are closer than the new_allowed_gap.
	*
	* By construction, there will be at least one. We also update zei_mingap
	* to the new smallest gap, to prepare for our next invocation.
	*/
	static void
	zei_shrink_ranges(zfs_ecksum_info_t *eip)
	{
	uint32_t mingap = UINT32_MAX;
	uint32_t new_allowed_gap = eip->zei_mingap + 1;

	size_t idx, output;
	size_t max = eip->zei_range_count;

	struct zei_ranges *r = eip->zei_ranges;

	ASSERT3U(eip->zei_range_count, >, 0);
	ASSERT3U(eip->zei_range_count, <=, MAX_RANGES);

	output = idx = 0;
	while (idx < max - 1) {
	uint32_t start = r[idx].zr_start;
	uint32_t end = r[idx].zr_end;

	while (idx < max - 1) {
	idx++;

	uint32_t nstart = r[idx].zr_start;
	uint32_t nend = r[idx].zr_end;

	uint32_t gap = nstart - end;
	if (gap < new_allowed_gap) {
	end = nend;
	continue;
	}
	if (gap < mingap)
	mingap = gap;
	break;
	}
	r[output].zr_start = start;
	r[output].zr_end = end;
	output++;
	}
	ASSERT3U(output, <, eip->zei_range_count);
	eip->zei_range_count = output;
	eip->zei_mingap = mingap;
	eip->zei_allowed_mingap = new_allowed_gap;
	}

	static void
	zei_add_range(zfs_ecksum_info_t *eip, int start, int end)
	{
	struct zei_ranges *r = eip->zei_ranges;
	size_t count = eip->zei_range_count;

	if (count >= MAX_RANGES) {
	zei_shrink_ranges(eip);
	count = eip->zei_range_count;
	}
	if (count == 0) {
	eip->zei_mingap = UINT32_MAX;
	eip->zei_allowed_mingap = 1;
	} else {
	int gap = start - r[count - 1].zr_end;

	if (gap < eip->zei_allowed_mingap) {
	r[count - 1].zr_end = end;
	return;
	}
	if (gap < eip->zei_mingap)
	eip->zei_mingap = gap;
	}
	r[count].zr_start = start;
	r[count].zr_end = end;
	eip->zei_range_count++;
	}

	static size_t
	zei_range_total_size(zfs_ecksum_info_t *eip)
	{
	struct zei_ranges *r = eip->zei_ranges;
	size_t count = eip->zei_range_count;
	size_t result = 0;
	size_t idx;

	for (idx = 0; idx < count; idx++)
	result += (r[idx].zr_end - r[idx].zr_start);

	return (result);
	}

	static zfs_ecksum_info_t *
	annotate_ecksum(nvlist_t ereport, zio_bad_cksum_t info,
	const abd_t goodabd, const abd_t badabd, size_t size,
	boolean_t drop_if_identical)
	{
	const uint64_t *good;
	const uint64_t *bad;

	uint64_t allset = 0;
	uint64_t allcleared = 0;

	size_t nui64s = size / sizeof (uint64_t);

	size_t inline_size;
	int no_inline = 0;
	size_t idx;
	size_t range;

	size_t offset = 0;
	ssize_t start = -1;

	zfs_ecksum_info_t eip = kmem_zalloc(sizeof (eip), KM_SLEEP);

	/* don't do any annotation for injected checksum errors */
	if (info != NULL && info->zbc_injected)
	return (eip);

	if (info != NULL && info->zbc_has_cksum) {
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_CKSUM_EXPECTED,
	DATA_TYPE_UINT64_ARRAY,
	sizeof (info->zbc_expected) / sizeof (uint64_t),
	(uint64_t *)&info->zbc_expected,
	FM_EREPORT_PAYLOAD_ZFS_CKSUM_ACTUAL,
	DATA_TYPE_UINT64_ARRAY,
	sizeof (info->zbc_actual) / sizeof (uint64_t),
	(uint64_t *)&info->zbc_actual,
	FM_EREPORT_PAYLOAD_ZFS_CKSUM_ALGO,
	DATA_TYPE_STRING,
	info->zbc_checksum_name,
	NULL);

	if (info->zbc_byteswapped) {
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_CKSUM_BYTESWAP,
	DATA_TYPE_BOOLEAN, 1,
	NULL);
	}
	}

	if (badabd == NULL \|\| goodabd == NULL)
	return (eip);

	ASSERT3U(nui64s, <=, UINT32_MAX);
	ASSERT3U(size, ==, nui64s * sizeof (uint64_t));
	ASSERT3U(size, <=, SPA_MAXBLOCKSIZE);
	ASSERT3U(size, <=, UINT32_MAX);

	good = (const uint64_t ) abd_borrow_buf_copy((abd_t )goodabd, size);
	bad = (const uint64_t ) abd_borrow_buf_copy((abd_t )badabd, size);

	/* build up the range list by comparing the two buffers. */
	for (idx = 0; idx < nui64s; idx++) {
	if (good[idx] == bad[idx]) {
	if (start == -1)
	continue;

	zei_add_range(eip, start, idx);
	start = -1;
	} else {
	if (start != -1)
	continue;

	start = idx;
	}
	}
	if (start != -1)
	zei_add_range(eip, start, idx);

	/* See if it will fit in our inline buffers */
	inline_size = zei_range_total_size(eip);
	if (inline_size > ZFM_MAX_INLINE)
	no_inline = 1;

	/*
	* If there is no change and we want to drop if the buffers are
	* identical, do so.
	*/
	if (inline_size == 0 && drop_if_identical) {
	kmem_free(eip, sizeof (*eip));
	abd_return_buf((abd_t )goodabd, (void )good, size);
	abd_return_buf((abd_t )badabd, (void )bad, size);
	return (NULL);
	}

	/*
	* Now walk through the ranges, filling in the details of the
	* differences. Also convert our uint64_t-array offsets to byte
	* offsets.
	*/
	for (range = 0; range < eip->zei_range_count; range++) {
	size_t start = eip->zei_ranges[range].zr_start;
	size_t end = eip->zei_ranges[range].zr_end;

	for (idx = start; idx < end; idx++) {
	uint64_t set, cleared;

	// bits set in bad, but not in good
	set = ((~good[idx]) & bad[idx]);
	// bits set in good, but not in bad
	cleared = (good[idx] & (~bad[idx]));

	allset \|= set;
	allcleared \|= cleared;

	if (!no_inline) {
	ASSERT3U(offset, <, inline_size);
	eip->zei_bits_set[offset] = set;
	eip->zei_bits_cleared[offset] = cleared;
	offset++;
	}

	update_histogram(set, eip->zei_histogram_set,
	&eip->zei_range_sets[range]);
	update_histogram(cleared, eip->zei_histogram_cleared,
	&eip->zei_range_clears[range]);
	}

	/* convert to byte offsets */
	eip->zei_ranges[range].zr_start *= sizeof (uint64_t);
	eip->zei_ranges[range].zr_end *= sizeof (uint64_t);
	}

	abd_return_buf((abd_t )goodabd, (void )good, size);
	abd_return_buf((abd_t )badabd, (void )bad, size);

	eip->zei_allowed_mingap *= sizeof (uint64_t);
	inline_size *= sizeof (uint64_t);

	/* fill in ereport */
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_BAD_OFFSET_RANGES,
	DATA_TYPE_UINT32_ARRAY, 2 * eip->zei_range_count,
	(uint32_t *)eip->zei_ranges,
	FM_EREPORT_PAYLOAD_ZFS_BAD_RANGE_MIN_GAP,
	DATA_TYPE_UINT32, eip->zei_allowed_mingap,
	FM_EREPORT_PAYLOAD_ZFS_BAD_RANGE_SETS,
	DATA_TYPE_UINT32_ARRAY, eip->zei_range_count, eip->zei_range_sets,
	FM_EREPORT_PAYLOAD_ZFS_BAD_RANGE_CLEARS,
	DATA_TYPE_UINT32_ARRAY, eip->zei_range_count, eip->zei_range_clears,
	NULL);

	if (!no_inline) {
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_BAD_SET_BITS,
	DATA_TYPE_UINT8_ARRAY,
	inline_size, (uint8_t *)eip->zei_bits_set,
	FM_EREPORT_PAYLOAD_ZFS_BAD_CLEARED_BITS,
	DATA_TYPE_UINT8_ARRAY,
	inline_size, (uint8_t *)eip->zei_bits_cleared,
	NULL);
	} else {
	fm_payload_set(ereport,
	FM_EREPORT_PAYLOAD_ZFS_BAD_SET_HISTOGRAM,
	DATA_TYPE_UINT32_ARRAY,
	NBBY * sizeof (uint64_t), eip->zei_histogram_set,
	FM_EREPORT_PAYLOAD_ZFS_BAD_CLEARED_HISTOGRAM,
	DATA_TYPE_UINT32_ARRAY,
	NBBY * sizeof (uint64_t), eip->zei_histogram_cleared,
	NULL);
	}
	return (eip);
	}
	#endif

	/*
	* Make sure our event is still valid for the given zio/vdev/pool. For example,
	* we don't want to keep logging events for a faulted or missing vdev.
	*/
	boolean_t
	zfs_ereport_is_valid(const char subclass, spa_t spa, vdev_t vd, zio_t zio)
	{
	#ifdef _KERNEL
	/*
	* If we are doing a spa_tryimport() or in recovery mode,
	* ignore errors.
	*/
	if (spa_load_state(spa) == SPA_LOAD_TRYIMPORT \|\|
	spa_load_state(spa) == SPA_LOAD_RECOVER)
	return (B_FALSE);

	/*
	* If we are in the middle of opening a pool, and the previous attempt
	* failed, don't bother logging any new ereports - we're just going to
	* get the same diagnosis anyway.
	*/
	if (spa_load_state(spa) != SPA_LOAD_NONE &&
	spa->spa_last_open_failed)
	return (B_FALSE);

	if (zio != NULL) {
	/*
	* If this is not a read or write zio, ignore the error. This
	* can occur if the DKIOCFLUSHWRITECACHE ioctl fails.
	*/
	if (zio->io_type != ZIO_TYPE_READ &&
	zio->io_type != ZIO_TYPE_WRITE)
	return (B_FALSE);

	if (vd != NULL) {
	/*
	* If the vdev has already been marked as failing due
	* to a failed probe, then ignore any subsequent I/O
	* errors, as the DE will automatically fault the vdev
	* on the first such failure. This also catches cases
	* where vdev_remove_wanted is set and the device has
	* not yet been asynchronously placed into the REMOVED
	* state.
	*/
	if (zio->io_vd == vd && !vdev_accessible(vd, zio))
	return (B_FALSE);

	/*
	* Ignore checksum errors for reads from DTL regions of
	* leaf vdevs.
	*/
	if (zio->io_type == ZIO_TYPE_READ &&
	zio->io_error == ECKSUM &&
	vd->vdev_ops->vdev_op_leaf &&
	vdev_dtl_contains(vd, DTL_MISSING, zio->io_txg, 1))
	return (B_FALSE);
	}
	}

	/*
	* For probe failure, we want to avoid posting ereports if we've
	* already removed the device in the meantime.
	*/
	if (vd != NULL &&
	strcmp(subclass, FM_EREPORT_ZFS_PROBE_FAILURE) == 0 &&
	(vd->vdev_remove_wanted \|\| vd->vdev_state == VDEV_STATE_REMOVED))
	return (B_FALSE);

	/* Ignore bogus delay events (like from ioctls or unqueued IOs) */
	if ((strcmp(subclass, FM_EREPORT_ZFS_DELAY) == 0) &&
	(zio != NULL) && (!zio->io_timestamp)) {
	return (B_FALSE);
	}
	#endif
	return (B_TRUE);
	}

	/*
	- * Return 0 if event was posted, EINVAL if there was a problem posting it or
	- * EBUSY if the event was rate limited.
	+ * Post an ereport for the given subclass
	+ *
	+ * Returns
	+ * - 0 if an event was posted
	+ * - EINVAL if there was a problem posting event
	+ * - EBUSY if the event was rate limited
	+ * - EALREADY if the event was already posted (duplicate)
	*/
	int
	zfs_ereport_post(const char subclass, spa_t spa, vdev_t *vd,
	- const zbookmark_phys_t zb, zio_t zio, uint64_t stateoroffset,
	- uint64_t size)
	+ const zbookmark_phys_t zb, zio_t zio, uint64_t state)
	{
	int rc = 0;
	#ifdef _KERNEL
	nvlist_t *ereport = NULL;
	nvlist_t *detector = NULL;

	+ if (!zfs_ereport_is_valid(subclass, spa, vd, zio))
	+ return (EINVAL);
	+
	+ if (zfs_ereport_is_duplicate(subclass, spa, vd, zb, zio, 0, 0))
	+ return (SET_ERROR(EALREADY));
	+
	if (zfs_is_ratelimiting_event(subclass, vd))
	return (SET_ERROR(EBUSY));

	if (!zfs_ereport_start(&ereport, &detector, subclass, spa, vd,
	- zb, zio, stateoroffset, size))
	+ zb, zio, state, 0))
	return (SET_ERROR(EINVAL)); /* couldn't post event */

	if (ereport == NULL)
	return (SET_ERROR(EINVAL));

	/* Cleanup is handled by the callback function */
	rc = zfs_zevent_post(ereport, detector, zfs_zevent_post_cb);
	#endif
	return (rc);
	}

	-void
	+/*
	+ * Prepare a checksum ereport
	+ *
	+ * Returns
	+ * - 0 if an event was posted
	+ * - EINVAL if there was a problem posting event
	+ * - EBUSY if the event was rate limited
	+ * - EALREADY if the event was already posted (duplicate)
	+ */
	+int
	zfs_ereport_start_checksum(spa_t spa, vdev_t vd, const zbookmark_phys_t *zb,
	struct zio zio, uint64_t offset, uint64_t length, void arg,
	zio_bad_cksum_t *info)
	{
	zio_cksum_report_t *report;

	#ifdef _KERNEL
	+ if (!zfs_ereport_is_valid(FM_EREPORT_ZFS_CHECKSUM, spa, vd, zio))
	+ return (SET_ERROR(EINVAL));
	+
	+ if (zfs_ereport_is_duplicate(FM_EREPORT_ZFS_CHECKSUM, spa, vd, zb, zio,
	+ offset, length))
	+ return (SET_ERROR(EALREADY));
	+
	if (zfs_is_ratelimiting_event(FM_EREPORT_ZFS_CHECKSUM, vd))
	- return;
	+ return (SET_ERROR(EBUSY));
	#endif

	report = kmem_zalloc(sizeof (*report), KM_SLEEP);

	if (zio->io_vsd != NULL)
	zio->io_vsd_ops->vsd_cksum_report(zio, report, arg);
	else
	zio_vsd_default_cksum_report(zio, report, arg);

	/* copy the checksum failure information if it was provided */
	if (info != NULL) {
	report->zcr_ckinfo = kmem_zalloc(sizeof (*info), KM_SLEEP);
	bcopy(info, report->zcr_ckinfo, sizeof (*info));
	}

	report->zcr_align = 1ULL << vd->vdev_top->vdev_ashift;
	report->zcr_length = length;

	#ifdef _KERNEL
	(void) zfs_ereport_start(&report->zcr_ereport, &report->zcr_detector,
	FM_EREPORT_ZFS_CHECKSUM, spa, vd, zb, zio, offset, length);

	if (report->zcr_ereport == NULL) {
	zfs_ereport_free_checksum(report);
	- return;
	+ return (0);
	}
	#endif

	mutex_enter(&spa->spa_errlist_lock);
	report->zcr_next = zio->io_logical->io_cksum_report;
	zio->io_logical->io_cksum_report = report;
	mutex_exit(&spa->spa_errlist_lock);
	+ return (0);
	}

	void
	zfs_ereport_finish_checksum(zio_cksum_report_t report, const abd_t good_data,
	const abd_t *bad_data, boolean_t drop_if_identical)
	{
	#ifdef _KERNEL
	zfs_ecksum_info_t *info;

	info = annotate_ecksum(report->zcr_ereport, report->zcr_ckinfo,
	good_data, bad_data, report->zcr_length, drop_if_identical);
	if (info != NULL)
	zfs_zevent_post(report->zcr_ereport,
	report->zcr_detector, zfs_zevent_post_cb);
	else
	zfs_zevent_post_cb(report->zcr_ereport, report->zcr_detector);

	report->zcr_ereport = report->zcr_detector = NULL;
	if (info != NULL)
	kmem_free(info, sizeof (*info));
	#endif
	}

	void
	zfs_ereport_free_checksum(zio_cksum_report_t *rpt)
	{
	#ifdef _KERNEL
	if (rpt->zcr_ereport != NULL) {
	fm_nvlist_destroy(rpt->zcr_ereport,
	FM_NVA_FREE);
	fm_nvlist_destroy(rpt->zcr_detector,
	FM_NVA_FREE);
	}
	#endif
	rpt->zcr_free(rpt->zcr_cbdata, rpt->zcr_cbinfo);

	if (rpt->zcr_ckinfo != NULL)
	kmem_free(rpt->zcr_ckinfo, sizeof (*rpt->zcr_ckinfo));

	kmem_free(rpt, sizeof (*rpt));
	}

	-
	+/*
	+ * Post a checksum ereport
	+ *
	+ * Returns
	+ * - 0 if an event was posted
	+ * - EINVAL if there was a problem posting event
	+ * - EBUSY if the event was rate limited
	+ * - EALREADY if the event was already posted (duplicate)
	+ */
	int
	zfs_ereport_post_checksum(spa_t spa, vdev_t vd, const zbookmark_phys_t *zb,
	struct zio *zio, uint64_t offset, uint64_t length,
	const abd_t good_data, const abd_t bad_data, zio_bad_cksum_t *zbc)
	{
	int rc = 0;
	#ifdef _KERNEL
	nvlist_t *ereport = NULL;
	nvlist_t *detector = NULL;
	zfs_ecksum_info_t *info;

	+ if (!zfs_ereport_is_valid(FM_EREPORT_ZFS_CHECKSUM, spa, vd, zio))
	+ return (SET_ERROR(EINVAL));
	+
	+ if (zfs_ereport_is_duplicate(FM_EREPORT_ZFS_CHECKSUM, spa, vd, zb, zio,
	+ offset, length))
	+ return (SET_ERROR(EALREADY));
	+
	if (zfs_is_ratelimiting_event(FM_EREPORT_ZFS_CHECKSUM, vd))
	- return (EBUSY);
	+ return (SET_ERROR(EBUSY));

	if (!zfs_ereport_start(&ereport, &detector, FM_EREPORT_ZFS_CHECKSUM,
	spa, vd, zb, zio, offset, length) \|\| (ereport == NULL)) {
	return (SET_ERROR(EINVAL));
	}

	info = annotate_ecksum(ereport, zbc, good_data, bad_data, length,
	B_FALSE);

	if (info != NULL) {
	rc = zfs_zevent_post(ereport, detector, zfs_zevent_post_cb);
	kmem_free(info, sizeof (*info));
	}
	#endif
	return (rc);
	}

	/*
	* The 'sysevent.fs.zfs.*' events are signals posted to notify user space of
	* change in the pool. All sysevents are listed in sys/sysevent/eventdefs.h
	* and are designed to be consumed by the ZFS Event Daemon (ZED). For
	* additional details refer to the zed(8) man page.
	*/
	nvlist_t *
	zfs_event_create(spa_t spa, vdev_t vd, const char type, const char name,
	nvlist_t *aux)
	{
	nvlist_t *resource = NULL;
	#ifdef _KERNEL
	char class[64];

	if (spa_load_state(spa) == SPA_LOAD_TRYIMPORT)
	return (NULL);

	if ((resource = fm_nvlist_create(NULL)) == NULL)
	return (NULL);

	(void) snprintf(class, sizeof (class), "%s.%s.%s", type,
	ZFS_ERROR_CLASS, name);
	VERIFY0(nvlist_add_uint8(resource, FM_VERSION, FM_RSRC_VERSION));
	VERIFY0(nvlist_add_string(resource, FM_CLASS, class));
	VERIFY0(nvlist_add_string(resource,
	FM_EREPORT_PAYLOAD_ZFS_POOL, spa_name(spa)));
	VERIFY0(nvlist_add_uint64(resource,
	FM_EREPORT_PAYLOAD_ZFS_POOL_GUID, spa_guid(spa)));
	VERIFY0(nvlist_add_uint64(resource,
	FM_EREPORT_PAYLOAD_ZFS_POOL_STATE, spa_state(spa)));
	VERIFY0(nvlist_add_int32(resource,
	FM_EREPORT_PAYLOAD_ZFS_POOL_CONTEXT, spa_load_state(spa)));

	if (vd) {
	VERIFY0(nvlist_add_uint64(resource,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_GUID, vd->vdev_guid));
	VERIFY0(nvlist_add_uint64(resource,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_STATE, vd->vdev_state));
	if (vd->vdev_path != NULL)
	VERIFY0(nvlist_add_string(resource,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_PATH, vd->vdev_path));
	if (vd->vdev_devid != NULL)
	VERIFY0(nvlist_add_string(resource,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_DEVID, vd->vdev_devid));
	if (vd->vdev_fru != NULL)
	VERIFY0(nvlist_add_string(resource,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_FRU, vd->vdev_fru));
	if (vd->vdev_enc_sysfs_path != NULL)
	VERIFY0(nvlist_add_string(resource,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_ENC_SYSFS_PATH,
	vd->vdev_enc_sysfs_path));
	}

	/* also copy any optional payload data */
	if (aux) {
	nvpair_t *elem = NULL;

	while ((elem = nvlist_next_nvpair(aux, elem)) != NULL)
	(void) nvlist_add_nvpair(resource, elem);
	}

	#endif
	return (resource);
	}

	static void
	zfs_post_common(spa_t spa, vdev_t vd, const char type, const char name,
	nvlist_t *aux)
	{
	#ifdef _KERNEL
	nvlist_t *resource;

	resource = zfs_event_create(spa, vd, type, name, aux);
	if (resource)
	zfs_zevent_post(resource, NULL, zfs_zevent_post_cb);
	#endif
	}

	/*
	* The 'resource.fs.zfs.removed' event is an internal signal that the given vdev
	* has been removed from the system. This will cause the DE to ignore any
	* recent I/O errors, inferring that they are due to the asynchronous device
	* removal.
	*/
	void
	zfs_post_remove(spa_t spa, vdev_t vd)
	{
	zfs_post_common(spa, vd, FM_RSRC_CLASS, FM_RESOURCE_REMOVED, NULL);
	}

	/*
	* The 'resource.fs.zfs.autoreplace' event is an internal signal that the pool
	* has the 'autoreplace' property set, and therefore any broken vdevs will be
	* handled by higher level logic, and no vdev fault should be generated.
	*/
	void
	zfs_post_autoreplace(spa_t spa, vdev_t vd)
	{
	zfs_post_common(spa, vd, FM_RSRC_CLASS, FM_RESOURCE_AUTOREPLACE, NULL);
	}

	/*
	* The 'resource.fs.zfs.statechange' event is an internal signal that the
	* given vdev has transitioned its state to DEGRADED or HEALTHY. This will
	* cause the retire agent to repair any outstanding fault management cases
	* open because the device was not found (fault.fs.zfs.device).
	*/
	void
	zfs_post_state_change(spa_t spa, vdev_t vd, uint64_t laststate)
	{
	#ifdef _KERNEL
	nvlist_t *aux;

	/*
	* Add optional supplemental keys to payload
	*/
	aux = fm_nvlist_create(NULL);
	if (vd && aux) {
	if (vd->vdev_physpath) {
	(void) nvlist_add_string(aux,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_PHYSPATH,
	vd->vdev_physpath);
	}
	if (vd->vdev_enc_sysfs_path) {
	(void) nvlist_add_string(aux,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_ENC_SYSFS_PATH,
	vd->vdev_enc_sysfs_path);
	}

	(void) nvlist_add_uint64(aux,
	FM_EREPORT_PAYLOAD_ZFS_VDEV_LASTSTATE, laststate);
	}

	zfs_post_common(spa, vd, FM_RSRC_CLASS, FM_RESOURCE_STATECHANGE,
	aux);

	if (aux)
	fm_nvlist_destroy(aux, FM_NVA_FREE);
	#endif
	}

	-#if defined(_KERNEL)
	+#ifdef _KERNEL
	+void
	+zfs_ereport_init(void)
	+{
	+ mutex_init(&recent_events_lock, NULL, MUTEX_DEFAULT, NULL);
	+ list_create(&recent_events_list, sizeof (recent_events_node_t),
	+ offsetof(recent_events_node_t, re_list_link));
	+ avl_create(&recent_events_tree, recent_events_compare,
	+ sizeof (recent_events_node_t), offsetof(recent_events_node_t,
	+ re_tree_link));
	+}
	+
	+/*
	+ * This 'early' fini needs to run before zfs_fini() which on Linux waits
	+ * for the system_delay_taskq to drain.
	+ */
	+void
	+zfs_ereport_taskq_fini(void)
	+{
	+ mutex_enter(&recent_events_lock);
	+ if (recent_events_cleaner_tqid != 0) {
	+ taskq_cancel_id(system_delay_taskq, recent_events_cleaner_tqid);
	+ recent_events_cleaner_tqid = 0;
	+ }
	+ mutex_exit(&recent_events_lock);
	+}
	+
	+void
	+zfs_ereport_fini(void)
	+{
	+ recent_events_node_t *entry;
	+
	+ while ((entry = list_head(&recent_events_list)) != NULL) {
	+ avl_remove(&recent_events_tree, entry);
	+ list_remove(&recent_events_list, entry);
	+ kmem_free(entry, sizeof (*entry));
	+ }
	+ avl_destroy(&recent_events_tree);
	+ list_destroy(&recent_events_list);
	+ mutex_destroy(&recent_events_lock);
	+}
	+
	EXPORT_SYMBOL(zfs_ereport_post);
	EXPORT_SYMBOL(zfs_ereport_is_valid);
	EXPORT_SYMBOL(zfs_ereport_post_checksum);
	EXPORT_SYMBOL(zfs_post_remove);
	EXPORT_SYMBOL(zfs_post_autoreplace);
	EXPORT_SYMBOL(zfs_post_state_change);
	+
	+ZFS_MODULE_PARAM(zfs_zevent, zfs_zevent_, retain_max, UINT, ZMOD_RW,
	+ "Maximum recent zevents records to retain for duplicate checking");
	+ZFS_MODULE_PARAM(zfs_zevent, zfs_zevent_, retain_expire_secs, UINT, ZMOD_RW,
	+ "Expiration time for recent zevents records");
	#endif /* _KERNEL */
	Index: vendor-sys/openzfs/dist/module/zfs/zfs_ioctl.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/zfs_ioctl.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/zfs_ioctl.c (revision 365892)
	@@ -1,7630 +1,7629 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	* Portions Copyright 2011 Martin Matuska
	* Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
	* Portions Copyright 2012 Pawel Jakub Dawidek <pawel@dawidek.net>
	* Copyright (c) 2014, 2016 Joyent, Inc. All rights reserved.
	* Copyright 2016 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2014, Joyent, Inc. All rights reserved.
	* Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
	* Copyright (c) 2013 Steven Hartland. All rights reserved.
	* Copyright (c) 2014 Integros [integros.com]
	* Copyright 2016 Toomas Soome <tsoome@me.com>
	* Copyright (c) 2016 Actifio, Inc. All rights reserved.
	* Copyright (c) 2018, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
	* Copyright 2017 RackTop Systems.
	* Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
	* Copyright (c) 2019 Datto Inc.
	* Copyright (c) 2019, 2020 by Christian Schwarz. All rights reserved.
	* Copyright (c) 2019, Klara Inc.
	* Copyright (c) 2019, Allan Jude
	*/

	/*
	* ZFS ioctls.
	*
	* This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
	* pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
	*
	* There are two ways that we handle ioctls: the legacy way where almost
	* all of the logic is in the ioctl callback, and the new way where most
	* of the marshalling is handled in the common entry point, zfsdev_ioctl().
	*
	* Non-legacy ioctls should be registered by calling
	* zfs_ioctl_register() from zfs_ioctl_init(). The ioctl is invoked
	* from userland by lzc_ioctl().
	*
	* The registration arguments are as follows:
	*
	* const char *name
	* The name of the ioctl. This is used for history logging. If the
	* ioctl returns successfully (the callback returns 0), and allow_log
	* is true, then a history log entry will be recorded with the input &
	* output nvlists. The log entry can be printed with "zpool history -i".
	*
	* zfs_ioc_t ioc
	* The ioctl request number, which userland will pass to ioctl(2).
	* We want newer versions of libzfs and libzfs_core to run against
	* existing zfs kernel modules (i.e. a deferred reboot after an update).
	* Therefore the ioctl numbers cannot change from release to release.
	*
	* zfs_secpolicy_func_t *secpolicy
	* This function will be called before the zfs_ioc_func_t, to
	* determine if this operation is permitted. It should return EPERM
	* on failure, and 0 on success. Checks include determining if the
	* dataset is visible in this zone, and if the user has either all
	* zfs privileges in the zone (SYS_MOUNT), or has been granted permission
	* to do this operation on this dataset with "zfs allow".
	*
	* zfs_ioc_namecheck_t namecheck
	* This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
	* name, a dataset name, or nothing. If the name is not well-formed,
	* the ioctl will fail and the callback will not be called.
	* Therefore, the callback can assume that the name is well-formed
	* (e.g. is null-terminated, doesn't have more than one '@' character,
	* doesn't have invalid characters).
	*
	* zfs_ioc_poolcheck_t pool_check
	* This specifies requirements on the pool state. If the pool does
	* not meet them (is suspended or is readonly), the ioctl will fail
	* and the callback will not be called. If any checks are specified
	* (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
	* Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED \|
	* POOL_CHECK_READONLY).
	*
	* zfs_ioc_key_t *nvl_keys
	* The list of expected/allowable innvl input keys. This list is used
	* to validate the nvlist input to the ioctl.
	*
	* boolean_t smush_outnvlist
	* If smush_outnvlist is true, then the output is presumed to be a
	* list of errors, and it will be "smushed" down to fit into the
	* caller's buffer, by removing some entries and replacing them with a
	* single "N_MORE_ERRORS" entry indicating how many were removed. See
	* nvlist_smush() for details. If smush_outnvlist is false, and the
	* outnvlist does not fit into the userland-provided buffer, then the
	* ioctl will fail with ENOMEM.
	*
	* zfs_ioc_func_t *func
	* The callback function that will perform the operation.
	*
	* The callback should return 0 on success, or an error number on
	* failure. If the function fails, the userland ioctl will return -1,
	* and errno will be set to the callback's return value. The callback
	* will be called with the following arguments:
	*
	* const char *name
	* The name of the pool or dataset to operate on, from
	* zfs_cmd_t:zc_name. The 'namecheck' argument specifies the
	* expected type (pool, dataset, or none).
	*
	* nvlist_t *innvl
	* The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src. Or
	* NULL if no input nvlist was provided. Changes to this nvlist are
	* ignored. If the input nvlist could not be deserialized, the
	* ioctl will fail and the callback will not be called.
	*
	* nvlist_t *outnvl
	* The output nvlist, initially empty. The callback can fill it in,
	* and it will be returned to userland by serializing it into
	* zfs_cmd_t:zc_nvlist_dst. If it is non-empty, and serialization
	* fails (e.g. because the caller didn't supply a large enough
	* buffer), then the overall ioctl will fail. See the
	* 'smush_nvlist' argument above for additional behaviors.
	*
	* There are two typical uses of the output nvlist:
	* - To return state, e.g. property values. In this case,
	* smush_outnvlist should be false. If the buffer was not large
	* enough, the caller will reallocate a larger buffer and try
	* the ioctl again.
	*
	* - To return multiple errors from an ioctl which makes on-disk
	* changes. In this case, smush_outnvlist should be true.
	* Ioctls which make on-disk modifications should generally not
	* use the outnvl if they succeed, because the caller can not
	* distinguish between the operation failing, and
	* deserialization failing.
	*
	* IOCTL Interface Errors
	*
	* The following ioctl input errors can be returned:
	* ZFS_ERR_IOC_CMD_UNAVAIL the ioctl number is not supported by kernel
	* ZFS_ERR_IOC_ARG_UNAVAIL an input argument is not supported by kernel
	* ZFS_ERR_IOC_ARG_REQUIRED a required input argument is missing
	* ZFS_ERR_IOC_ARG_BADTYPE an input argument has an invalid type
	*/

	#include <sys/types.h>
	#include <sys/param.h>
	#include <sys/errno.h>
	#include <sys/uio.h>
	#include <sys/file.h>
	#include <sys/kmem.h>
	#include <sys/cmn_err.h>
	#include <sys/stat.h>
	#include <sys/zfs_ioctl.h>
	#include <sys/zfs_quota.h>
	#include <sys/zfs_vfsops.h>
	#include <sys/zfs_znode.h>
	#include <sys/zap.h>
	#include <sys/spa.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev.h>
	#include <sys/vdev_impl.h>
	#include <sys/dmu.h>
	#include <sys/dsl_dir.h>
	#include <sys/dsl_dataset.h>
	#include <sys/dsl_prop.h>
	#include <sys/dsl_deleg.h>
	#include <sys/dmu_objset.h>
	#include <sys/dmu_impl.h>
	#include <sys/dmu_redact.h>
	#include <sys/dmu_tx.h>
	#include <sys/sunddi.h>
	#include <sys/policy.h>
	#include <sys/zone.h>
	#include <sys/nvpair.h>
	#include <sys/pathname.h>
	#include <sys/fs/zfs.h>
	#include <sys/zfs_ctldir.h>
	#include <sys/zfs_dir.h>
	#include <sys/zfs_onexit.h>
	#include <sys/zvol.h>
	#include <sys/dsl_scan.h>
	#include <sys/fm/util.h>
	#include <sys/dsl_crypt.h>
	#include <sys/rrwlock.h>
	#include <sys/zfs_file.h>

	#include <sys/dmu_recv.h>
	#include <sys/dmu_send.h>
	#include <sys/dmu_recv.h>
	#include <sys/dsl_destroy.h>
	#include <sys/dsl_bookmark.h>
	#include <sys/dsl_userhold.h>
	#include <sys/zfeature.h>
	#include <sys/zcp.h>
	#include <sys/zio_checksum.h>
	#include <sys/vdev_removal.h>
	#include <sys/vdev_impl.h>
	#include <sys/vdev_initialize.h>
	#include <sys/vdev_trim.h>

	#include "zfs_namecheck.h"
	#include "zfs_prop.h"
	#include "zfs_deleg.h"
	#include "zfs_comutil.h"

	#include <sys/lua/lua.h>
	#include <sys/lua/lauxlib.h>
	#include <sys/zfs_ioctl_impl.h>

	kmutex_t zfsdev_state_lock;
	zfsdev_state_t *zfsdev_state_list;

	/*
	* Limit maximum nvlist size. We don't want users passing in insane values
	* for zc->zc_nvlist_src_size, since we will need to allocate that much memory.
	* Defaults to 0=auto which is handled by platform code.
	*/
	unsigned long zfs_max_nvlist_src_size = 0;

	uint_t zfs_fsyncer_key;
	uint_t zfs_allow_log_key;

	/* DATA_TYPE_ANY is used when zkey_type can vary. */
	#define DATA_TYPE_ANY DATA_TYPE_UNKNOWN

	typedef struct zfs_ioc_vec {
	zfs_ioc_legacy_func_t *zvec_legacy_func;
	zfs_ioc_func_t *zvec_func;
	zfs_secpolicy_func_t *zvec_secpolicy;
	zfs_ioc_namecheck_t zvec_namecheck;
	boolean_t zvec_allow_log;
	zfs_ioc_poolcheck_t zvec_pool_check;
	boolean_t zvec_smush_outnvlist;
	const char *zvec_name;
	const zfs_ioc_key_t *zvec_nvl_keys;
	size_t zvec_nvl_key_count;
	} zfs_ioc_vec_t;

	/* This array is indexed by zfs_userquota_prop_t */
	static const char *userquota_perms[] = {
	ZFS_DELEG_PERM_USERUSED,
	ZFS_DELEG_PERM_USERQUOTA,
	ZFS_DELEG_PERM_GROUPUSED,
	ZFS_DELEG_PERM_GROUPQUOTA,
	ZFS_DELEG_PERM_USEROBJUSED,
	ZFS_DELEG_PERM_USEROBJQUOTA,
	ZFS_DELEG_PERM_GROUPOBJUSED,
	ZFS_DELEG_PERM_GROUPOBJQUOTA,
	ZFS_DELEG_PERM_PROJECTUSED,
	ZFS_DELEG_PERM_PROJECTQUOTA,
	ZFS_DELEG_PERM_PROJECTOBJUSED,
	ZFS_DELEG_PERM_PROJECTOBJQUOTA,
	};

	static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
	static int zfs_ioc_id_quota_upgrade(zfs_cmd_t *zc);
	static int zfs_check_settable(const char name, nvpair_t property,
	cred_t *cr);
	static int zfs_check_clearable(char dataset, nvlist_t props,
	nvlist_t **errors);
	static int zfs_fill_zplprops_root(uint64_t, nvlist_t , nvlist_t ,
	boolean_t *);
	int zfs_set_prop_nvlist(const char , zprop_source_t, nvlist_t , nvlist_t *);
	static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);

	static void
	history_str_free(char *buf)
	{
	kmem_free(buf, HIS_MAX_RECORD_LEN);
	}

	static char *
	history_str_get(zfs_cmd_t *zc)
	{
	char *buf;

	if (zc->zc_history == 0)
	return (NULL);

	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
	if (copyinstr((void *)(uintptr_t)zc->zc_history,
	buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
	history_str_free(buf);
	return (NULL);
	}

	buf[HIS_MAX_RECORD_LEN -1] = '\0';

	return (buf);
	}

	/*
	* Return non-zero if the spa version is less than requested version.
	*/
	static int
	zfs_earlier_version(const char *name, int version)
	{
	spa_t *spa;

	if (spa_open(name, &spa, FTAG) == 0) {
	if (spa_version(spa) < version) {
	spa_close(spa, FTAG);
	return (1);
	}
	spa_close(spa, FTAG);
	}
	return (0);
	}

	/*
	* Return TRUE if the ZPL version is less than requested version.
	*/
	static boolean_t
	zpl_earlier_version(const char *name, int version)
	{
	objset_t *os;
	boolean_t rc = B_TRUE;

	if (dmu_objset_hold(name, FTAG, &os) == 0) {
	uint64_t zplversion;

	if (dmu_objset_type(os) != DMU_OST_ZFS) {
	dmu_objset_rele(os, FTAG);
	return (B_TRUE);
	}
	/* XXX reading from non-owned objset */
	if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
	rc = zplversion < version;
	dmu_objset_rele(os, FTAG);
	}
	return (rc);
	}

	static void
	zfs_log_history(zfs_cmd_t *zc)
	{
	spa_t *spa;
	char *buf;

	if ((buf = history_str_get(zc)) == NULL)
	return;

	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
	if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
	(void) spa_history_log(spa, buf);
	spa_close(spa, FTAG);
	}
	history_str_free(buf);
	}

	/*
	* Policy for top-level read operations (list pools). Requires no privileges,
	* and can be used in the local zone, as there is no associated dataset.
	*/
	/* ARGSUSED */
	static int
	zfs_secpolicy_none(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (0);
	}

	/*
	* Policy for dataset read operations (list children, get statistics). Requires
	* no privileges, but must be visible in the local zone.
	*/
	/* ARGSUSED */
	static int
	zfs_secpolicy_read(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	if (INGLOBALZONE(curproc) \|\|
	zone_dataset_visible(zc->zc_name, NULL))
	return (0);

	return (SET_ERROR(ENOENT));
	}

	static int
	zfs_dozonecheck_impl(const char dataset, uint64_t zoned, cred_t cr)
	{
	int writable = 1;

	/*
	* The dataset must be visible by this zone -- check this first
	* so they don't see EPERM on something they shouldn't know about.
	*/
	if (!INGLOBALZONE(curproc) &&
	!zone_dataset_visible(dataset, &writable))
	return (SET_ERROR(ENOENT));

	if (INGLOBALZONE(curproc)) {
	/*
	* If the fs is zoned, only root can access it from the
	* global zone.
	*/
	if (secpolicy_zfs(cr) && zoned)
	return (SET_ERROR(EPERM));
	} else {
	/*
	* If we are in a local zone, the 'zoned' property must be set.
	*/
	if (!zoned)
	return (SET_ERROR(EPERM));

	/* must be writable by this zone */
	if (!writable)
	return (SET_ERROR(EPERM));
	}
	return (0);
	}

	static int
	zfs_dozonecheck(const char dataset, cred_t cr)
	{
	uint64_t zoned;

	if (dsl_prop_get_integer(dataset, zfs_prop_to_name(ZFS_PROP_ZONED),
	&zoned, NULL))
	return (SET_ERROR(ENOENT));

	return (zfs_dozonecheck_impl(dataset, zoned, cr));
	}

	static int
	zfs_dozonecheck_ds(const char dataset, dsl_dataset_t ds, cred_t *cr)
	{
	uint64_t zoned;

	if (dsl_prop_get_int_ds(ds, zfs_prop_to_name(ZFS_PROP_ZONED), &zoned))
	return (SET_ERROR(ENOENT));

	return (zfs_dozonecheck_impl(dataset, zoned, cr));
	}

	static int
	zfs_secpolicy_write_perms_ds(const char name, dsl_dataset_t ds,
	const char perm, cred_t cr)
	{
	int error;

	error = zfs_dozonecheck_ds(name, ds, cr);
	if (error == 0) {
	error = secpolicy_zfs(cr);
	if (error != 0)
	error = dsl_deleg_access_impl(ds, perm, cr);
	}
	return (error);
	}

	static int
	zfs_secpolicy_write_perms(const char name, const char perm, cred_t *cr)
	{
	int error;
	dsl_dataset_t *ds;
	dsl_pool_t *dp;

	/*
	* First do a quick check for root in the global zone, which
	* is allowed to do all write_perms. This ensures that zfs_ioc_*
	* will get to handle nonexistent datasets.
	*/
	if (INGLOBALZONE(curproc) && secpolicy_zfs(cr) == 0)
	return (0);

	error = dsl_pool_hold(name, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold(dp, name, FTAG, &ds);
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);

	dsl_dataset_rele(ds, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	/*
	* Policy for setting the security label property.
	*
	* Returns 0 for success, non-zero for access and other errors.
	*/
	static int
	zfs_set_slabel_policy(const char name, char strval, cred_t *cr)
	{
	#ifdef HAVE_MLSLABEL
	char ds_hexsl[MAXNAMELEN];
	bslabel_t ds_sl, new_sl;
	boolean_t new_default = FALSE;
	uint64_t zoned;
	int needed_priv = -1;
	int error;

	/* First get the existing dataset label. */
	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
	1, sizeof (ds_hexsl), &ds_hexsl, NULL);
	if (error != 0)
	return (SET_ERROR(EPERM));

	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
	new_default = TRUE;

	/* The label must be translatable */
	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
	return (SET_ERROR(EINVAL));

	/*
	* In a non-global zone, disallow attempts to set a label that
	* doesn't match that of the zone; otherwise no other checks
	* are needed.
	*/
	if (!INGLOBALZONE(curproc)) {
	if (new_default \|\| !blequal(&new_sl, CR_SL(CRED())))
	return (SET_ERROR(EPERM));
	return (0);
	}

	/*
	* For global-zone datasets (i.e., those whose zoned property is
	* "off", verify that the specified new label is valid for the
	* global zone.
	*/
	if (dsl_prop_get_integer(name,
	zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
	return (SET_ERROR(EPERM));
	if (!zoned) {
	if (zfs_check_global_label(name, strval) != 0)
	return (SET_ERROR(EPERM));
	}

	/*
	* If the existing dataset label is nondefault, check if the
	* dataset is mounted (label cannot be changed while mounted).
	* Get the zfsvfs_t; if there isn't one, then the dataset isn't
	* mounted (or isn't a dataset, doesn't exist, ...).
	*/
	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
	objset_t *os;
	static char *setsl_tag = "setsl_tag";

	/*
	* Try to own the dataset; abort if there is any error,
	* (e.g., already mounted, in use, or other error).
	*/
	error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE, B_TRUE,
	setsl_tag, &os);
	if (error != 0)
	return (SET_ERROR(EPERM));

	dmu_objset_disown(os, B_TRUE, setsl_tag);

	if (new_default) {
	needed_priv = PRIV_FILE_DOWNGRADE_SL;
	goto out_check;
	}

	if (hexstr_to_label(strval, &new_sl) != 0)
	return (SET_ERROR(EPERM));

	if (blstrictdom(&ds_sl, &new_sl))
	needed_priv = PRIV_FILE_DOWNGRADE_SL;
	else if (blstrictdom(&new_sl, &ds_sl))
	needed_priv = PRIV_FILE_UPGRADE_SL;
	} else {
	/* dataset currently has a default label */
	if (!new_default)
	needed_priv = PRIV_FILE_UPGRADE_SL;
	}

	out_check:
	if (needed_priv != -1)
	return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
	return (0);
	#else
	return (SET_ERROR(ENOTSUP));
	#endif /* HAVE_MLSLABEL */
	}

	static int
	zfs_secpolicy_setprop(const char dsname, zfs_prop_t prop, nvpair_t propval,
	cred_t *cr)
	{
	char *strval;

	/*
	* Check permissions for special properties.
	*/
	switch (prop) {
	default:
	break;
	case ZFS_PROP_ZONED:
	/*
	* Disallow setting of 'zoned' from within a local zone.
	*/
	if (!INGLOBALZONE(curproc))
	return (SET_ERROR(EPERM));
	break;

	case ZFS_PROP_QUOTA:
	case ZFS_PROP_FILESYSTEM_LIMIT:
	case ZFS_PROP_SNAPSHOT_LIMIT:
	if (!INGLOBALZONE(curproc)) {
	uint64_t zoned;
	char setpoint[ZFS_MAX_DATASET_NAME_LEN];
	/*
	* Unprivileged users are allowed to modify the
	* limit on things under (ie. contained by)
	* the thing they own.
	*/
	if (dsl_prop_get_integer(dsname,
	zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, setpoint))
	return (SET_ERROR(EPERM));
	if (!zoned \|\| strlen(dsname) <= strlen(setpoint))
	return (SET_ERROR(EPERM));
	}
	break;

	case ZFS_PROP_MLSLABEL:
	if (!is_system_labeled())
	return (SET_ERROR(EPERM));

	if (nvpair_value_string(propval, &strval) == 0) {
	int err;

	err = zfs_set_slabel_policy(dsname, strval, CRED());
	if (err != 0)
	return (err);
	}
	break;
	}

	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_set_fsacl(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	int error;

	error = zfs_dozonecheck(zc->zc_name, cr);
	if (error != 0)
	return (error);

	/*
	* permission to set permissions will be evaluated later in
	* dsl_deleg_can_allow()
	*/
	return (0);
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_rollback(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_ROLLBACK, cr));
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_send(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	dsl_pool_t *dp;
	dsl_dataset_t *ds;
	char *cp;
	int error;

	/*
	* Generate the current snapshot name from the given objsetid, then
	* use that name for the secpolicy/zone checks.
	*/
	cp = strchr(zc->zc_name, '@');
	if (cp == NULL)
	return (SET_ERROR(EINVAL));
	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	dsl_dataset_name(ds, zc->zc_name);

	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
	ZFS_DELEG_PERM_SEND, cr);
	dsl_dataset_rele(ds, FTAG);
	dsl_pool_rele(dp, FTAG);

	return (error);
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_send_new(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_SEND, cr));
	}

	static int
	zfs_secpolicy_share(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (SET_ERROR(ENOTSUP));
	}

	static int
	zfs_secpolicy_smb_acl(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (SET_ERROR(ENOTSUP));
	}

	static int
	zfs_get_parent(const char datasetname, char parent, int parentsize)
	{
	char *cp;

	/*
	* Remove the @bla or /bla from the end of the name to get the parent.
	*/
	(void) strncpy(parent, datasetname, parentsize);
	cp = strrchr(parent, '@');
	if (cp != NULL) {
	cp[0] = '\0';
	} else {
	cp = strrchr(parent, '/');
	if (cp == NULL)
	return (SET_ERROR(ENOENT));
	cp[0] = '\0';
	}

	return (0);
	}

	int
	zfs_secpolicy_destroy_perms(const char name, cred_t cr)
	{
	int error;

	if ((error = zfs_secpolicy_write_perms(name,
	ZFS_DELEG_PERM_MOUNT, cr)) != 0)
	return (error);

	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_destroy(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
	}

	/*
	* Destroying snapshots with delegated permissions requires
	* descendant mount and destroy permissions.
	*/
	/* ARGSUSED */
	static int
	zfs_secpolicy_destroy_snaps(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	nvlist_t *snaps;
	nvpair_t pair, nextpair;
	int error = 0;

	snaps = fnvlist_lookup_nvlist(innvl, "snaps");

	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
	pair = nextpair) {
	nextpair = nvlist_next_nvpair(snaps, pair);
	error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
	if (error == ENOENT) {
	/*
	* Ignore any snapshots that don't exist (we consider
	* them "already destroyed"). Remove the name from the
	* nvl here in case the snapshot is created between
	* now and when we try to destroy it (in which case
	* we don't want to destroy it since we haven't
	* checked for permission).
	*/
	fnvlist_remove_nvpair(snaps, pair);
	error = 0;
	}
	if (error != 0)
	break;
	}

	return (error);
	}

	int
	zfs_secpolicy_rename_perms(const char from, const char to, cred_t *cr)
	{
	char parentname[ZFS_MAX_DATASET_NAME_LEN];
	int error;

	if ((error = zfs_secpolicy_write_perms(from,
	ZFS_DELEG_PERM_RENAME, cr)) != 0)
	return (error);

	if ((error = zfs_secpolicy_write_perms(from,
	ZFS_DELEG_PERM_MOUNT, cr)) != 0)
	return (error);

	if ((error = zfs_get_parent(to, parentname,
	sizeof (parentname))) != 0)
	return (error);

	if ((error = zfs_secpolicy_write_perms(parentname,
	ZFS_DELEG_PERM_CREATE, cr)) != 0)
	return (error);

	if ((error = zfs_secpolicy_write_perms(parentname,
	ZFS_DELEG_PERM_MOUNT, cr)) != 0)
	return (error);

	return (error);
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_rename(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_promote(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	dsl_pool_t *dp;
	dsl_dataset_t *clone;
	int error;

	error = zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_PROMOTE, cr);
	if (error != 0)
	return (error);

	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);

	if (error == 0) {
	char parentname[ZFS_MAX_DATASET_NAME_LEN];
	dsl_dataset_t *origin = NULL;
	dsl_dir_t *dd;
	dd = clone->ds_dir;

	error = dsl_dataset_hold_obj(dd->dd_pool,
	dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
	if (error != 0) {
	dsl_dataset_rele(clone, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
	ZFS_DELEG_PERM_MOUNT, cr);

	dsl_dataset_name(origin, parentname);
	if (error == 0) {
	error = zfs_secpolicy_write_perms_ds(parentname, origin,
	ZFS_DELEG_PERM_PROMOTE, cr);
	}
	dsl_dataset_rele(clone, FTAG);
	dsl_dataset_rele(origin, FTAG);
	}
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_recv(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	int error;

	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
	return (error);

	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_MOUNT, cr)) != 0)
	return (error);

	return (zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_CREATE, cr));
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_recv_new(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (zfs_secpolicy_recv(zc, innvl, cr));
	}

	int
	zfs_secpolicy_snapshot_perms(const char name, cred_t cr)
	{
	return (zfs_secpolicy_write_perms(name,
	ZFS_DELEG_PERM_SNAPSHOT, cr));
	}

	/*
	* Check for permission to create each snapshot in the nvlist.
	*/
	/* ARGSUSED */
	static int
	zfs_secpolicy_snapshot(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	nvlist_t *snaps;
	int error = 0;
	nvpair_t *pair;

	snaps = fnvlist_lookup_nvlist(innvl, "snaps");

	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
	pair = nvlist_next_nvpair(snaps, pair)) {
	char *name = nvpair_name(pair);
	char *atp = strchr(name, '@');

	if (atp == NULL) {
	error = SET_ERROR(EINVAL);
	break;
	}
	*atp = '\0';
	error = zfs_secpolicy_snapshot_perms(name, cr);
	*atp = '@';
	if (error != 0)
	break;
	}
	return (error);
	}

	/*
	* Check for permission to create each bookmark in the nvlist.
	*/
	/* ARGSUSED */
	static int
	zfs_secpolicy_bookmark(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	int error = 0;

	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
	pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
	char *name = nvpair_name(pair);
	char *hashp = strchr(name, '#');

	if (hashp == NULL) {
	error = SET_ERROR(EINVAL);
	break;
	}
	*hashp = '\0';
	error = zfs_secpolicy_write_perms(name,
	ZFS_DELEG_PERM_BOOKMARK, cr);
	*hashp = '#';
	if (error != 0)
	break;
	}
	return (error);
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_destroy_bookmarks(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	nvpair_t pair, nextpair;
	int error = 0;

	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
	pair = nextpair) {
	char *name = nvpair_name(pair);
	char *hashp = strchr(name, '#');
	nextpair = nvlist_next_nvpair(innvl, pair);

	if (hashp == NULL) {
	error = SET_ERROR(EINVAL);
	break;
	}

	*hashp = '\0';
	error = zfs_secpolicy_write_perms(name,
	ZFS_DELEG_PERM_DESTROY, cr);
	*hashp = '#';
	if (error == ENOENT) {
	/*
	* Ignore any filesystems that don't exist (we consider
	* their bookmarks "already destroyed"). Remove
	* the name from the nvl here in case the filesystem
	* is created between now and when we try to destroy
	* the bookmark (in which case we don't want to
	* destroy it since we haven't checked for permission).
	*/
	fnvlist_remove_nvpair(innvl, pair);
	error = 0;
	}
	if (error != 0)
	break;
	}

	return (error);
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_log_history(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	/*
	* Even root must have a proper TSD so that we know what pool
	* to log to.
	*/
	if (tsd_get(zfs_allow_log_key) == NULL)
	return (SET_ERROR(EPERM));
	return (0);
	}

	static int
	zfs_secpolicy_create_clone(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	char parentname[ZFS_MAX_DATASET_NAME_LEN];
	int error;
	char *origin;

	if ((error = zfs_get_parent(zc->zc_name, parentname,
	sizeof (parentname))) != 0)
	return (error);

	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
	(error = zfs_secpolicy_write_perms(origin,
	ZFS_DELEG_PERM_CLONE, cr)) != 0)
	return (error);

	if ((error = zfs_secpolicy_write_perms(parentname,
	ZFS_DELEG_PERM_CREATE, cr)) != 0)
	return (error);

	return (zfs_secpolicy_write_perms(parentname,
	ZFS_DELEG_PERM_MOUNT, cr));
	}

	/*
	* Policy for pool operations - create/destroy pools, add vdevs, etc. Requires
	* SYS_CONFIG privilege, which is not available in a local zone.
	*/
	/* ARGSUSED */
	int
	zfs_secpolicy_config(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	if (secpolicy_sys_config(cr, B_FALSE) != 0)
	return (SET_ERROR(EPERM));

	return (0);
	}

	/*
	* Policy for object to name lookups.
	*/
	/* ARGSUSED */
	static int
	zfs_secpolicy_diff(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	int error;

	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
	return (0);

	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
	return (error);
	}

	/*
	* Policy for fault injection. Requires all privileges.
	*/
	/* ARGSUSED */
	static int
	zfs_secpolicy_inject(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (secpolicy_zinject(cr));
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_inherit_prop(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);

	if (prop == ZPROP_INVAL) {
	if (!zfs_prop_user(zc->zc_value))
	return (SET_ERROR(EINVAL));
	return (zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_USERPROP, cr));
	} else {
	return (zfs_secpolicy_setprop(zc->zc_name, prop,
	NULL, cr));
	}
	}

	static int
	zfs_secpolicy_userspace_one(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	int err = zfs_secpolicy_read(zc, innvl, cr);
	if (err)
	return (err);

	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
	return (SET_ERROR(EINVAL));

	if (zc->zc_value[0] == 0) {
	/*
	* They are asking about a posix uid/gid. If it's
	* themself, allow it.
	*/
	if (zc->zc_objset_type == ZFS_PROP_USERUSED \|\|
	zc->zc_objset_type == ZFS_PROP_USERQUOTA \|\|
	zc->zc_objset_type == ZFS_PROP_USEROBJUSED \|\|
	zc->zc_objset_type == ZFS_PROP_USEROBJQUOTA) {
	if (zc->zc_guid == crgetuid(cr))
	return (0);
	} else if (zc->zc_objset_type == ZFS_PROP_GROUPUSED \|\|
	zc->zc_objset_type == ZFS_PROP_GROUPQUOTA \|\|
	zc->zc_objset_type == ZFS_PROP_GROUPOBJUSED \|\|
	zc->zc_objset_type == ZFS_PROP_GROUPOBJQUOTA) {
	if (groupmember(zc->zc_guid, cr))
	return (0);
	}
	/* else is for project quota/used */
	}

	return (zfs_secpolicy_write_perms(zc->zc_name,
	userquota_perms[zc->zc_objset_type], cr));
	}

	static int
	zfs_secpolicy_userspace_many(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	int err = zfs_secpolicy_read(zc, innvl, cr);
	if (err)
	return (err);

	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
	return (SET_ERROR(EINVAL));

	return (zfs_secpolicy_write_perms(zc->zc_name,
	userquota_perms[zc->zc_objset_type], cr));
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_userspace_upgrade(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
	NULL, cr));
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_hold(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	nvpair_t *pair;
	nvlist_t *holds;
	int error;

	holds = fnvlist_lookup_nvlist(innvl, "holds");

	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
	pair = nvlist_next_nvpair(holds, pair)) {
	char fsname[ZFS_MAX_DATASET_NAME_LEN];
	error = dmu_fsname(nvpair_name(pair), fsname);
	if (error != 0)
	return (error);
	error = zfs_secpolicy_write_perms(fsname,
	ZFS_DELEG_PERM_HOLD, cr);
	if (error != 0)
	return (error);
	}
	return (0);
	}

	/* ARGSUSED */
	static int
	zfs_secpolicy_release(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	nvpair_t *pair;
	int error;

	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
	pair = nvlist_next_nvpair(innvl, pair)) {
	char fsname[ZFS_MAX_DATASET_NAME_LEN];
	error = dmu_fsname(nvpair_name(pair), fsname);
	if (error != 0)
	return (error);
	error = zfs_secpolicy_write_perms(fsname,
	ZFS_DELEG_PERM_RELEASE, cr);
	if (error != 0)
	return (error);
	}
	return (0);
	}

	/*
	* Policy for allowing temporary snapshots to be taken or released
	*/
	static int
	zfs_secpolicy_tmp_snapshot(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	/*
	* A temporary snapshot is the same as a snapshot,
	* hold, destroy and release all rolled into one.
	* Delegated diff alone is sufficient that we allow this.
	*/
	int error;

	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_DIFF, cr)) == 0)
	return (0);

	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);

	if (innvl != NULL) {
	if (error == 0)
	error = zfs_secpolicy_hold(zc, innvl, cr);
	if (error == 0)
	error = zfs_secpolicy_release(zc, innvl, cr);
	if (error == 0)
	error = zfs_secpolicy_destroy(zc, innvl, cr);
	}
	return (error);
	}

	static int
	zfs_secpolicy_load_key(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_LOAD_KEY, cr));
	}

	static int
	zfs_secpolicy_change_key(zfs_cmd_t zc, nvlist_t innvl, cred_t *cr)
	{
	return (zfs_secpolicy_write_perms(zc->zc_name,
	ZFS_DELEG_PERM_CHANGE_KEY, cr));
	}

	/*
	* Returns the nvlist as specified by the user in the zfs_cmd_t.
	*/
	static int
	get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
	{
	char *packed;
	int error;
	nvlist_t *list = NULL;

	/*
	* Read in and unpack the user-supplied nvlist.
	*/
	if (size == 0)
	return (SET_ERROR(EINVAL));

	packed = vmem_alloc(size, KM_SLEEP);

	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
	iflag)) != 0) {
	vmem_free(packed, size);
	return (SET_ERROR(EFAULT));
	}

	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
	vmem_free(packed, size);
	return (error);
	}

	vmem_free(packed, size);

	*nvp = list;
	return (0);
	}

	/*
	* Reduce the size of this nvlist until it can be serialized in 'max' bytes.
	* Entries will be removed from the end of the nvlist, and one int32 entry
	* named "N_MORE_ERRORS" will be added indicating how many entries were
	* removed.
	*/
	static int
	nvlist_smush(nvlist_t *errors, size_t max)
	{
	size_t size;

	size = fnvlist_size(errors);

	if (size > max) {
	nvpair_t *more_errors;
	int n = 0;

	if (max < 1024)
	return (SET_ERROR(ENOMEM));

	fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
	more_errors = nvlist_prev_nvpair(errors, NULL);

	do {
	nvpair_t *pair = nvlist_prev_nvpair(errors,
	more_errors);
	fnvlist_remove_nvpair(errors, pair);
	n++;
	size = fnvlist_size(errors);
	} while (size > max);

	fnvlist_remove_nvpair(errors, more_errors);
	fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
	ASSERT3U(fnvlist_size(errors), <=, max);
	}

	return (0);
	}

	static int
	put_nvlist(zfs_cmd_t zc, nvlist_t nvl)
	{
	char *packed = NULL;
	int error = 0;
	size_t size;

	size = fnvlist_size(nvl);

	if (size > zc->zc_nvlist_dst_size) {
	error = SET_ERROR(ENOMEM);
	} else {
	packed = fnvlist_pack(nvl, &size);
	if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
	size, zc->zc_iflags) != 0)
	error = SET_ERROR(EFAULT);
	fnvlist_pack_free(packed, size);
	}

	zc->zc_nvlist_dst_size = size;
	zc->zc_nvlist_dst_filled = B_TRUE;
	return (error);
	}

	int
	getzfsvfs_impl(objset_t os, zfsvfs_t *zfvp)
	{
	int error = 0;
	if (dmu_objset_type(os) != DMU_OST_ZFS) {
	return (SET_ERROR(EINVAL));
	}

	mutex_enter(&os->os_user_ptr_lock);
	*zfvp = dmu_objset_get_user(os);
	/* bump s_active only when non-zero to prevent umount race */
	error = zfs_vfs_ref(zfvp);
	mutex_exit(&os->os_user_ptr_lock);
	return (error);
	}

	int
	getzfsvfs(const char dsname, zfsvfs_t *zfvp)
	{
	objset_t *os;
	int error;

	error = dmu_objset_hold(dsname, FTAG, &os);
	if (error != 0)
	return (error);

	error = getzfsvfs_impl(os, zfvp);
	dmu_objset_rele(os, FTAG);
	return (error);
	}

	/*
	* Find a zfsvfs_t for a mounted filesystem, or create our own, in which
	* case its z_sb will be NULL, and it will be opened as the owner.
	* If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
	* which prevents all inode ops from running.
	*/
	static int
	zfsvfs_hold(const char name, void tag, zfsvfs_t **zfvp, boolean_t writer)
	{
	int error = 0;

	if (getzfsvfs(name, zfvp) != 0)
	error = zfsvfs_create(name, B_FALSE, zfvp);
	if (error == 0) {
	rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
	RW_READER, tag);
	if ((*zfvp)->z_unmounted) {
	/*
	* XXX we could probably try again, since the unmounting
	* thread should be just about to disassociate the
	* objset from the zfsvfs.
	*/
	rrm_exit(&(*zfvp)->z_teardown_lock, tag);
	return (SET_ERROR(EBUSY));
	}
	}
	return (error);
	}

	static void
	zfsvfs_rele(zfsvfs_t zfsvfs, void tag)
	{
	rrm_exit(&zfsvfs->z_teardown_lock, tag);

	if (zfs_vfs_held(zfsvfs)) {
	zfs_vfs_rele(zfsvfs);
	} else {
	dmu_objset_disown(zfsvfs->z_os, B_TRUE, zfsvfs);
	zfsvfs_free(zfsvfs);
	}
	}

	static int
	zfs_ioc_pool_create(zfs_cmd_t *zc)
	{
	int error;
	nvlist_t config, props = NULL;
	nvlist_t *rootprops = NULL;
	nvlist_t *zplprops = NULL;
	dsl_crypto_params_t *dcp = NULL;
	char *spa_name = zc->zc_name;
	boolean_t unload_wkey = B_TRUE;

	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
	zc->zc_iflags, &config)))
	return (error);

	if (zc->zc_nvlist_src_size != 0 && (error =
	get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &props))) {
	nvlist_free(config);
	return (error);
	}

	if (props) {
	nvlist_t *nvl = NULL;
	nvlist_t *hidden_args = NULL;
	uint64_t version = SPA_VERSION;
	char *tname;

	(void) nvlist_lookup_uint64(props,
	zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
	if (!SPA_VERSION_IS_SUPPORTED(version)) {
	error = SET_ERROR(EINVAL);
	goto pool_props_bad;
	}
	(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
	if (nvl) {
	error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
	if (error != 0)
	goto pool_props_bad;
	(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
	}

	(void) nvlist_lookup_nvlist(props, ZPOOL_HIDDEN_ARGS,
	&hidden_args);
	error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE,
	rootprops, hidden_args, &dcp);
	if (error != 0)
	goto pool_props_bad;
	(void) nvlist_remove_all(props, ZPOOL_HIDDEN_ARGS);

	VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
	error = zfs_fill_zplprops_root(version, rootprops,
	zplprops, NULL);
	if (error != 0)
	goto pool_props_bad;

	if (nvlist_lookup_string(props,
	zpool_prop_to_name(ZPOOL_PROP_TNAME), &tname) == 0)
	spa_name = tname;
	}

	error = spa_create(zc->zc_name, config, props, zplprops, dcp);

	/*
	* Set the remaining root properties
	*/
	if (!error && (error = zfs_set_prop_nvlist(spa_name,
	ZPROP_SRC_LOCAL, rootprops, NULL)) != 0) {
	(void) spa_destroy(spa_name);
	unload_wkey = B_FALSE; /* spa_destroy() unloads wrapping keys */
	}

	pool_props_bad:
	nvlist_free(rootprops);
	nvlist_free(zplprops);
	nvlist_free(config);
	nvlist_free(props);
	dsl_crypto_params_free(dcp, unload_wkey && !!error);

	return (error);
	}

	static int
	zfs_ioc_pool_destroy(zfs_cmd_t *zc)
	{
	int error;
	zfs_log_history(zc);
	error = spa_destroy(zc->zc_name);

	return (error);
	}

	static int
	zfs_ioc_pool_import(zfs_cmd_t *zc)
	{
	nvlist_t config, props = NULL;
	uint64_t guid;
	int error;

	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
	zc->zc_iflags, &config)) != 0)
	return (error);

	if (zc->zc_nvlist_src_size != 0 && (error =
	get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &props))) {
	nvlist_free(config);
	return (error);
	}

	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 \|\|
	guid != zc->zc_guid)
	error = SET_ERROR(EINVAL);
	else
	error = spa_import(zc->zc_name, config, props, zc->zc_cookie);

	if (zc->zc_nvlist_dst != 0) {
	int err;

	if ((err = put_nvlist(zc, config)) != 0)
	error = err;
	}

	nvlist_free(config);
	nvlist_free(props);

	return (error);
	}

	static int
	zfs_ioc_pool_export(zfs_cmd_t *zc)
	{
	int error;
	boolean_t force = (boolean_t)zc->zc_cookie;
	boolean_t hardforce = (boolean_t)zc->zc_guid;

	zfs_log_history(zc);
	error = spa_export(zc->zc_name, NULL, force, hardforce);

	return (error);
	}

	static int
	zfs_ioc_pool_configs(zfs_cmd_t *zc)
	{
	nvlist_t *configs;
	int error;

	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
	return (SET_ERROR(EEXIST));

	error = put_nvlist(zc, configs);

	nvlist_free(configs);

	return (error);
	}

	/*
	* inputs:
	* zc_name name of the pool
	*
	* outputs:
	* zc_cookie real errno
	* zc_nvlist_dst config nvlist
	* zc_nvlist_dst_size size of config nvlist
	*/
	static int
	zfs_ioc_pool_stats(zfs_cmd_t *zc)
	{
	nvlist_t *config;
	int error;
	int ret = 0;

	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
	sizeof (zc->zc_value));

	if (config != NULL) {
	ret = put_nvlist(zc, config);
	nvlist_free(config);

	/*
	* The config may be present even if 'error' is non-zero.
	* In this case we return success, and preserve the real errno
	* in 'zc_cookie'.
	*/
	zc->zc_cookie = error;
	} else {
	ret = error;
	}

	return (ret);
	}

	/*
	* Try to import the given pool, returning pool stats as appropriate so that
	* user land knows which devices are available and overall pool health.
	*/
	static int
	zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
	{
	nvlist_t tryconfig, config = NULL;
	int error;

	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
	zc->zc_iflags, &tryconfig)) != 0)
	return (error);

	config = spa_tryimport(tryconfig);

	nvlist_free(tryconfig);

	if (config == NULL)
	return (SET_ERROR(EINVAL));

	error = put_nvlist(zc, config);
	nvlist_free(config);

	return (error);
	}

	/*
	* inputs:
	* zc_name name of the pool
	* zc_cookie scan func (pool_scan_func_t)
	* zc_flags scrub pause/resume flag (pool_scrub_cmd_t)
	*/
	static int
	zfs_ioc_pool_scan(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;

	if (zc->zc_flags >= POOL_SCRUB_FLAGS_END)
	return (SET_ERROR(EINVAL));

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
	return (error);

	if (zc->zc_flags == POOL_SCRUB_PAUSE)
	error = spa_scrub_pause_resume(spa, POOL_SCRUB_PAUSE);
	else if (zc->zc_cookie == POOL_SCAN_NONE)
	error = spa_scan_stop(spa);
	else
	error = spa_scan(spa, zc->zc_cookie);

	spa_close(spa, FTAG);

	return (error);
	}

	static int
	zfs_ioc_pool_freeze(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;

	error = spa_open(zc->zc_name, &spa, FTAG);
	if (error == 0) {
	spa_freeze(spa);
	spa_close(spa, FTAG);
	}
	return (error);
	}

	static int
	zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
	return (error);

	if (zc->zc_cookie < spa_version(spa) \|\|
	!SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
	spa_close(spa, FTAG);
	return (SET_ERROR(EINVAL));
	}

	spa_upgrade(spa, zc->zc_cookie);
	spa_close(spa, FTAG);

	return (error);
	}

	static int
	zfs_ioc_pool_get_history(zfs_cmd_t *zc)
	{
	spa_t *spa;
	char *hist_buf;
	uint64_t size;
	int error;

	if ((size = zc->zc_history_len) == 0)
	return (SET_ERROR(EINVAL));

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
	return (error);

	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
	spa_close(spa, FTAG);
	return (SET_ERROR(ENOTSUP));
	}

	hist_buf = vmem_alloc(size, KM_SLEEP);
	if ((error = spa_history_get(spa, &zc->zc_history_offset,
	&zc->zc_history_len, hist_buf)) == 0) {
	error = ddi_copyout(hist_buf,
	(void *)(uintptr_t)zc->zc_history,
	zc->zc_history_len, zc->zc_iflags);
	}

	spa_close(spa, FTAG);
	vmem_free(hist_buf, size);
	return (error);
	}

	static int
	zfs_ioc_pool_reguid(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;

	error = spa_open(zc->zc_name, &spa, FTAG);
	if (error == 0) {
	error = spa_change_guid(spa);
	spa_close(spa, FTAG);
	}
	return (error);
	}

	static int
	zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
	{
	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_obj object to find
	*
	* outputs:
	* zc_value name of object
	*/
	static int
	zfs_ioc_obj_to_path(zfs_cmd_t *zc)
	{
	objset_t *os;
	int error;

	/* XXX reading from objset not owned */
	if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
	FTAG, &os)) != 0)
	return (error);
	if (dmu_objset_type(os) != DMU_OST_ZFS) {
	dmu_objset_rele_flags(os, B_TRUE, FTAG);
	return (SET_ERROR(EINVAL));
	}
	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
	sizeof (zc->zc_value));
	dmu_objset_rele_flags(os, B_TRUE, FTAG);

	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_obj object to find
	*
	* outputs:
	* zc_stat stats on object
	* zc_value path to object
	*/
	static int
	zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
	{
	objset_t *os;
	int error;

	/* XXX reading from objset not owned */
	if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
	FTAG, &os)) != 0)
	return (error);
	if (dmu_objset_type(os) != DMU_OST_ZFS) {
	dmu_objset_rele_flags(os, B_TRUE, FTAG);
	return (SET_ERROR(EINVAL));
	}
	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
	sizeof (zc->zc_value));
	dmu_objset_rele_flags(os, B_TRUE, FTAG);

	return (error);
	}

	static int
	zfs_ioc_vdev_add(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;
	nvlist_t *config;

	error = spa_open(zc->zc_name, &spa, FTAG);
	if (error != 0)
	return (error);

	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
	zc->zc_iflags, &config);
	if (error == 0) {
	error = spa_vdev_add(spa, config);
	nvlist_free(config);
	}
	spa_close(spa, FTAG);
	return (error);
	}

	/*
	* inputs:
	* zc_name name of the pool
	* zc_guid guid of vdev to remove
	* zc_cookie cancel removal
	*/
	static int
	zfs_ioc_vdev_remove(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;

	error = spa_open(zc->zc_name, &spa, FTAG);
	if (error != 0)
	return (error);
	if (zc->zc_cookie != 0) {
	error = spa_vdev_remove_cancel(spa);
	} else {
	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
	}
	spa_close(spa, FTAG);
	return (error);
	}

	static int
	zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;
	vdev_state_t newstate = VDEV_STATE_UNKNOWN;

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
	return (error);
	switch (zc->zc_cookie) {
	case VDEV_STATE_ONLINE:
	error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
	break;

	case VDEV_STATE_OFFLINE:
	error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
	break;

	case VDEV_STATE_FAULTED:
	if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
	zc->zc_obj != VDEV_AUX_EXTERNAL &&
	zc->zc_obj != VDEV_AUX_EXTERNAL_PERSIST)
	zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;

	error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
	break;

	case VDEV_STATE_DEGRADED:
	if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
	zc->zc_obj != VDEV_AUX_EXTERNAL)
	zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;

	error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
	break;

	default:
	error = SET_ERROR(EINVAL);
	}
	zc->zc_cookie = newstate;
	spa_close(spa, FTAG);
	return (error);
	}

	static int
	zfs_ioc_vdev_attach(zfs_cmd_t *zc)
	{
	spa_t *spa;
	nvlist_t *config;
	int replacing = zc->zc_cookie;
	int rebuild = zc->zc_simple;
	int error;

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
	return (error);

	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
	zc->zc_iflags, &config)) == 0) {
	error = spa_vdev_attach(spa, zc->zc_guid, config, replacing,
	rebuild);
	nvlist_free(config);
	}

	spa_close(spa, FTAG);
	return (error);
	}

	static int
	zfs_ioc_vdev_detach(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
	return (error);

	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);

	spa_close(spa, FTAG);
	return (error);
	}

	static int
	zfs_ioc_vdev_split(zfs_cmd_t *zc)
	{
	spa_t *spa;
	nvlist_t config, props = NULL;
	int error;
	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
	return (error);

	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
	zc->zc_iflags, &config))) {
	spa_close(spa, FTAG);
	return (error);
	}

	if (zc->zc_nvlist_src_size != 0 && (error =
	get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &props))) {
	spa_close(spa, FTAG);
	nvlist_free(config);
	return (error);
	}

	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);

	spa_close(spa, FTAG);

	nvlist_free(config);
	nvlist_free(props);

	return (error);
	}

	static int
	zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
	{
	spa_t *spa;
	char *path = zc->zc_value;
	uint64_t guid = zc->zc_guid;
	int error;

	error = spa_open(zc->zc_name, &spa, FTAG);
	if (error != 0)
	return (error);

	error = spa_vdev_setpath(spa, guid, path);
	spa_close(spa, FTAG);
	return (error);
	}

	static int
	zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
	{
	spa_t *spa;
	char *fru = zc->zc_value;
	uint64_t guid = zc->zc_guid;
	int error;

	error = spa_open(zc->zc_name, &spa, FTAG);
	if (error != 0)
	return (error);

	error = spa_vdev_setfru(spa, guid, fru);
	spa_close(spa, FTAG);
	return (error);
	}

	static int
	zfs_ioc_objset_stats_impl(zfs_cmd_t zc, objset_t os)
	{
	int error = 0;
	nvlist_t *nv;

	dmu_objset_fast_stat(os, &zc->zc_objset_stats);

	if (zc->zc_nvlist_dst != 0 &&
	(error = dsl_prop_get_all(os, &nv)) == 0) {
	dmu_objset_stats(os, nv);
	/*
	* NB: zvol_get_stats() will read the objset contents,
	* which we aren't supposed to do with a
	* DS_MODE_USER hold, because it could be
	* inconsistent. So this is a bit of a workaround...
	* XXX reading without owning
	*/
	if (!zc->zc_objset_stats.dds_inconsistent &&
	dmu_objset_type(os) == DMU_OST_ZVOL) {
	error = zvol_get_stats(os, nv);
	if (error == EIO) {
	nvlist_free(nv);
	return (error);
	}
	VERIFY0(error);
	}
	if (error == 0)
	error = put_nvlist(zc, nv);
	nvlist_free(nv);
	}

	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_nvlist_dst_size size of buffer for property nvlist
	*
	* outputs:
	* zc_objset_stats stats
	* zc_nvlist_dst property nvlist
	* zc_nvlist_dst_size size of property nvlist
	*/
	static int
	zfs_ioc_objset_stats(zfs_cmd_t *zc)
	{
	objset_t *os;
	int error;

	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
	if (error == 0) {
	error = zfs_ioc_objset_stats_impl(zc, os);
	dmu_objset_rele(os, FTAG);
	}

	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_nvlist_dst_size size of buffer for property nvlist
	*
	* outputs:
	* zc_nvlist_dst received property nvlist
	* zc_nvlist_dst_size size of received property nvlist
	*
	* Gets received properties (distinct from local properties on or after
	* SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
	* local property values.
	*/
	static int
	zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
	{
	int error = 0;
	nvlist_t *nv;

	/*
	* Without this check, we would return local property values if the
	* caller has not already received properties on or after
	* SPA_VERSION_RECVD_PROPS.
	*/
	if (!dsl_prop_get_hasrecvd(zc->zc_name))
	return (SET_ERROR(ENOTSUP));

	if (zc->zc_nvlist_dst != 0 &&
	(error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
	error = put_nvlist(zc, nv);
	nvlist_free(nv);
	}

	return (error);
	}

	static int
	nvl_add_zplprop(objset_t os, nvlist_t props, zfs_prop_t prop)
	{
	uint64_t value;
	int error;

	/*
	* zfs_get_zplprop() will either find a value or give us
	* the default value (if there is one).
	*/
	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
	return (error);
	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
	return (0);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_nvlist_dst_size size of buffer for zpl property nvlist
	*
	* outputs:
	* zc_nvlist_dst zpl property nvlist
	* zc_nvlist_dst_size size of zpl property nvlist
	*/
	static int
	zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
	{
	objset_t *os;
	int err;

	/* XXX reading without owning */
	if ((err = dmu_objset_hold(zc->zc_name, FTAG, &os)))
	return (err);

	dmu_objset_fast_stat(os, &zc->zc_objset_stats);

	/*
	* NB: nvl_add_zplprop() will read the objset contents,
	* which we aren't supposed to do with a DS_MODE_USER
	* hold, because it could be inconsistent.
	*/
	if (zc->zc_nvlist_dst != 0 &&
	!zc->zc_objset_stats.dds_inconsistent &&
	dmu_objset_type(os) == DMU_OST_ZFS) {
	nvlist_t *nv;

	VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
	if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
	(err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
	(err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
	(err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
	err = put_nvlist(zc, nv);
	nvlist_free(nv);
	} else {
	err = SET_ERROR(ENOENT);
	}
	dmu_objset_rele(os, FTAG);
	return (err);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_cookie zap cursor
	* zc_nvlist_dst_size size of buffer for property nvlist
	*
	* outputs:
	* zc_name name of next filesystem
	* zc_cookie zap cursor
	* zc_objset_stats stats
	* zc_nvlist_dst property nvlist
	* zc_nvlist_dst_size size of property nvlist
	*/
	static int
	zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
	{
	objset_t *os;
	int error;
	char *p;
	size_t orig_len = strlen(zc->zc_name);

	top:
	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os))) {
	if (error == ENOENT)
	error = SET_ERROR(ESRCH);
	return (error);
	}

	p = strrchr(zc->zc_name, '/');
	if (p == NULL \|\| p[1] != '\0')
	(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
	p = zc->zc_name + strlen(zc->zc_name);

	do {
	error = dmu_dir_list_next(os,
	sizeof (zc->zc_name) - (p - zc->zc_name), p,
	NULL, &zc->zc_cookie);
	if (error == ENOENT)
	error = SET_ERROR(ESRCH);
	} while (error == 0 && zfs_dataset_name_hidden(zc->zc_name));
	dmu_objset_rele(os, FTAG);

	/*
	* If it's an internal dataset (ie. with a '$' in its name),
	* don't try to get stats for it, otherwise we'll return ENOENT.
	*/
	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
	error = zfs_ioc_objset_stats(zc); /* fill in the stats */
	if (error == ENOENT) {
	/* We lost a race with destroy, get the next one. */
	zc->zc_name[orig_len] = '\0';
	goto top;
	}
	}
	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_cookie zap cursor
	* zc_nvlist_src iteration range nvlist
	* zc_nvlist_src_size size of iteration range nvlist
	*
	* outputs:
	* zc_name name of next snapshot
	* zc_objset_stats stats
	* zc_nvlist_dst property nvlist
	* zc_nvlist_dst_size size of property nvlist
	*/
	static int
	zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
	{
	int error;
	objset_t os, ossnap;
	dsl_dataset_t *ds;
	uint64_t min_txg = 0, max_txg = 0;

	if (zc->zc_nvlist_src_size != 0) {
	nvlist_t *props = NULL;
	error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &props);
	if (error != 0)
	return (error);
	(void) nvlist_lookup_uint64(props, SNAP_ITER_MIN_TXG,
	&min_txg);
	(void) nvlist_lookup_uint64(props, SNAP_ITER_MAX_TXG,
	&max_txg);
	nvlist_free(props);
	}

	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
	if (error != 0) {
	return (error == ENOENT ? SET_ERROR(ESRCH) : error);
	}

	/*
	* A dataset name of maximum length cannot have any snapshots,
	* so exit immediately.
	*/
	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >=
	ZFS_MAX_DATASET_NAME_LEN) {
	dmu_objset_rele(os, FTAG);
	return (SET_ERROR(ESRCH));
	}

	while (error == 0) {
	if (issig(JUSTLOOKING) && issig(FORREAL)) {
	error = SET_ERROR(EINTR);
	break;
	}

	error = dmu_snapshot_list_next(os,
	sizeof (zc->zc_name) - strlen(zc->zc_name),
	zc->zc_name + strlen(zc->zc_name), &zc->zc_obj,
	&zc->zc_cookie, NULL);
	if (error == ENOENT) {
	error = SET_ERROR(ESRCH);
	break;
	} else if (error != 0) {
	break;
	}

	error = dsl_dataset_hold_obj(dmu_objset_pool(os), zc->zc_obj,
	FTAG, &ds);
	if (error != 0)
	break;

	if ((min_txg != 0 && dsl_get_creationtxg(ds) < min_txg) \|\|
	(max_txg != 0 && dsl_get_creationtxg(ds) > max_txg)) {
	dsl_dataset_rele(ds, FTAG);
	/* undo snapshot name append */
	*(strchr(zc->zc_name, '@') + 1) = '\0';
	/* skip snapshot */
	continue;
	}

	if (zc->zc_simple) {
	dsl_dataset_rele(ds, FTAG);
	break;
	}

	if ((error = dmu_objset_from_ds(ds, &ossnap)) != 0) {
	dsl_dataset_rele(ds, FTAG);
	break;
	}
	if ((error = zfs_ioc_objset_stats_impl(zc, ossnap)) != 0) {
	dsl_dataset_rele(ds, FTAG);
	break;
	}
	dsl_dataset_rele(ds, FTAG);
	break;
	}

	dmu_objset_rele(os, FTAG);
	/* if we failed, undo the @ that we tacked on to zc_name */
	if (error != 0)
	*strchr(zc->zc_name, '@') = '\0';
	return (error);
	}

	static int
	zfs_prop_set_userquota(const char dsname, nvpair_t pair)
	{
	const char *propname = nvpair_name(pair);
	uint64_t *valary;
	unsigned int vallen;
	const char *domain;
	char *dash;
	zfs_userquota_prop_t type;
	uint64_t rid;
	uint64_t quota;
	zfsvfs_t *zfsvfs;
	int err;

	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
	nvlist_t *attrs;
	VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
	if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
	&pair) != 0)
	return (SET_ERROR(EINVAL));
	}

	/*
	* A correctly constructed propname is encoded as
	* userquota@<rid>-<domain>.
	*/
	if ((dash = strchr(propname, '-')) == NULL \|\|
	nvpair_value_uint64_array(pair, &valary, &vallen) != 0 \|\|
	vallen != 3)
	return (SET_ERROR(EINVAL));

	domain = dash + 1;
	type = valary[0];
	rid = valary[1];
	quota = valary[2];

	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
	if (err == 0) {
	err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
	zfsvfs_rele(zfsvfs, FTAG);
	}

	return (err);
	}

	/*
	* If the named property is one that has a special function to set its value,
	* return 0 on success and a positive error code on failure; otherwise if it is
	* not one of the special properties handled by this function, return -1.
	*
	* XXX: It would be better for callers of the property interface if we handled
	* these special cases in dsl_prop.c (in the dsl layer).
	*/
	static int
	zfs_prop_set_special(const char *dsname, zprop_source_t source,
	nvpair_t *pair)
	{
	const char *propname = nvpair_name(pair);
	zfs_prop_t prop = zfs_name_to_prop(propname);
	uint64_t intval = 0;
	char *strval = NULL;
	int err = -1;

	if (prop == ZPROP_INVAL) {
	if (zfs_prop_userquota(propname))
	return (zfs_prop_set_userquota(dsname, pair));
	return (-1);
	}

	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
	nvlist_t *attrs;
	VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
	VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
	&pair) == 0);
	}

	/* all special properties are numeric except for keylocation */
	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
	strval = fnvpair_value_string(pair);
	} else {
	intval = fnvpair_value_uint64(pair);
	}

	switch (prop) {
	case ZFS_PROP_QUOTA:
	err = dsl_dir_set_quota(dsname, source, intval);
	break;
	case ZFS_PROP_REFQUOTA:
	err = dsl_dataset_set_refquota(dsname, source, intval);
	break;
	case ZFS_PROP_FILESYSTEM_LIMIT:
	case ZFS_PROP_SNAPSHOT_LIMIT:
	if (intval == UINT64_MAX) {
	/* clearing the limit, just do it */
	err = 0;
	} else {
	err = dsl_dir_activate_fs_ss_limit(dsname);
	}
	/*
	* Set err to -1 to force the zfs_set_prop_nvlist code down the
	* default path to set the value in the nvlist.
	*/
	if (err == 0)
	err = -1;
	break;
	case ZFS_PROP_KEYLOCATION:
	err = dsl_crypto_can_set_keylocation(dsname, strval);

	/*
	* Set err to -1 to force the zfs_set_prop_nvlist code down the
	* default path to set the value in the nvlist.
	*/
	if (err == 0)
	err = -1;
	break;
	case ZFS_PROP_RESERVATION:
	err = dsl_dir_set_reservation(dsname, source, intval);
	break;
	case ZFS_PROP_REFRESERVATION:
	err = dsl_dataset_set_refreservation(dsname, source, intval);
	break;
	case ZFS_PROP_COMPRESSION:
	err = dsl_dataset_set_compression(dsname, source, intval);
	/*
	* Set err to -1 to force the zfs_set_prop_nvlist code down the
	* default path to set the value in the nvlist.
	*/
	if (err == 0)
	err = -1;
	break;
	case ZFS_PROP_VOLSIZE:
	err = zvol_set_volsize(dsname, intval);
	break;
	case ZFS_PROP_SNAPDEV:
	err = zvol_set_snapdev(dsname, source, intval);
	break;
	case ZFS_PROP_VOLMODE:
	err = zvol_set_volmode(dsname, source, intval);
	break;
	case ZFS_PROP_VERSION:
	{
	zfsvfs_t *zfsvfs;

	if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
	break;

	err = zfs_set_version(zfsvfs, intval);
	zfsvfs_rele(zfsvfs, FTAG);

	if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
	zfs_cmd_t *zc;

	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
	(void) strlcpy(zc->zc_name, dsname,
	sizeof (zc->zc_name));
	(void) zfs_ioc_userspace_upgrade(zc);
	(void) zfs_ioc_id_quota_upgrade(zc);
	kmem_free(zc, sizeof (zfs_cmd_t));
	}
	break;
	}
	default:
	err = -1;
	}

	return (err);
	}

	/*
	* This function is best effort. If it fails to set any of the given properties,
	* it continues to set as many as it can and returns the last error
	* encountered. If the caller provides a non-NULL errlist, it will be filled in
	* with the list of names of all the properties that failed along with the
	* corresponding error numbers.
	*
	* If every property is set successfully, zero is returned and errlist is not
	* modified.
	*/
	int
	zfs_set_prop_nvlist(const char dsname, zprop_source_t source, nvlist_t nvl,
	nvlist_t *errlist)
	{
	nvpair_t *pair;
	nvpair_t *propval;
	int rv = 0;
	uint64_t intval;
	char *strval;

	nvlist_t *genericnvl = fnvlist_alloc();
	nvlist_t *retrynvl = fnvlist_alloc();
	retry:
	pair = NULL;
	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
	const char *propname = nvpair_name(pair);
	zfs_prop_t prop = zfs_name_to_prop(propname);
	int err = 0;

	/* decode the property value */
	propval = pair;
	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
	nvlist_t *attrs;
	attrs = fnvpair_value_nvlist(pair);
	if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
	&propval) != 0)
	err = SET_ERROR(EINVAL);
	}

	/* Validate value type */
	if (err == 0 && source == ZPROP_SRC_INHERITED) {
	/* inherited properties are expected to be booleans */
	if (nvpair_type(propval) != DATA_TYPE_BOOLEAN)
	err = SET_ERROR(EINVAL);
	} else if (err == 0 && prop == ZPROP_INVAL) {
	if (zfs_prop_user(propname)) {
	if (nvpair_type(propval) != DATA_TYPE_STRING)
	err = SET_ERROR(EINVAL);
	} else if (zfs_prop_userquota(propname)) {
	if (nvpair_type(propval) !=
	DATA_TYPE_UINT64_ARRAY)
	err = SET_ERROR(EINVAL);
	} else {
	err = SET_ERROR(EINVAL);
	}
	} else if (err == 0) {
	if (nvpair_type(propval) == DATA_TYPE_STRING) {
	if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
	err = SET_ERROR(EINVAL);
	} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
	const char *unused;

	intval = fnvpair_value_uint64(propval);

	switch (zfs_prop_get_type(prop)) {
	case PROP_TYPE_NUMBER:
	break;
	case PROP_TYPE_STRING:
	err = SET_ERROR(EINVAL);
	break;
	case PROP_TYPE_INDEX:
	if (zfs_prop_index_to_string(prop,
	intval, &unused) != 0)
	err =
	SET_ERROR(ZFS_ERR_BADPROP);
	break;
	default:
	cmn_err(CE_PANIC,
	"unknown property type");
	}
	} else {
	err = SET_ERROR(EINVAL);
	}
	}

	/* Validate permissions */
	if (err == 0)
	err = zfs_check_settable(dsname, pair, CRED());

	if (err == 0) {
	if (source == ZPROP_SRC_INHERITED)
	err = -1; /* does not need special handling */
	else
	err = zfs_prop_set_special(dsname, source,
	pair);
	if (err == -1) {
	/*
	* For better performance we build up a list of
	* properties to set in a single transaction.
	*/
	err = nvlist_add_nvpair(genericnvl, pair);
	} else if (err != 0 && nvl != retrynvl) {
	/*
	* This may be a spurious error caused by
	* receiving quota and reservation out of order.
	* Try again in a second pass.
	*/
	err = nvlist_add_nvpair(retrynvl, pair);
	}
	}

	if (err != 0) {
	if (errlist != NULL)
	fnvlist_add_int32(errlist, propname, err);
	rv = err;
	}
	}

	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
	nvl = retrynvl;
	goto retry;
	}

	if (!nvlist_empty(genericnvl) &&
	dsl_props_set(dsname, source, genericnvl) != 0) {
	/*
	* If this fails, we still want to set as many properties as we
	* can, so try setting them individually.
	*/
	pair = NULL;
	while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
	const char *propname = nvpair_name(pair);
	int err = 0;

	propval = pair;
	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
	nvlist_t *attrs;
	attrs = fnvpair_value_nvlist(pair);
	propval = fnvlist_lookup_nvpair(attrs,
	ZPROP_VALUE);
	}

	if (nvpair_type(propval) == DATA_TYPE_STRING) {
	strval = fnvpair_value_string(propval);
	err = dsl_prop_set_string(dsname, propname,
	source, strval);
	} else if (nvpair_type(propval) == DATA_TYPE_BOOLEAN) {
	err = dsl_prop_inherit(dsname, propname,
	source);
	} else {
	intval = fnvpair_value_uint64(propval);
	err = dsl_prop_set_int(dsname, propname, source,
	intval);
	}

	if (err != 0) {
	if (errlist != NULL) {
	fnvlist_add_int32(errlist, propname,
	err);
	}
	rv = err;
	}
	}
	}
	nvlist_free(genericnvl);
	nvlist_free(retrynvl);

	return (rv);
	}

	/*
	* Check that all the properties are valid user properties.
	*/
	static int
	zfs_check_userprops(nvlist_t *nvl)
	{
	nvpair_t *pair = NULL;

	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
	const char *propname = nvpair_name(pair);

	if (!zfs_prop_user(propname) \|\|
	nvpair_type(pair) != DATA_TYPE_STRING)
	return (SET_ERROR(EINVAL));

	if (strlen(propname) >= ZAP_MAXNAMELEN)
	return (SET_ERROR(ENAMETOOLONG));

	if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
	return (SET_ERROR(E2BIG));
	}
	return (0);
	}

	static void
	props_skip(nvlist_t props, nvlist_t skipped, nvlist_t **newprops)
	{
	nvpair_t *pair;

	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);

	pair = NULL;
	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
	if (nvlist_exists(skipped, nvpair_name(pair)))
	continue;

	VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
	}
	}

	static int
	clear_received_props(const char dsname, nvlist_t props,
	nvlist_t *skipped)
	{
	int err = 0;
	nvlist_t *cleared_props = NULL;
	props_skip(props, skipped, &cleared_props);
	if (!nvlist_empty(cleared_props)) {
	/*
	* Acts on local properties until the dataset has received
	* properties at least once on or after SPA_VERSION_RECVD_PROPS.
	*/
	zprop_source_t flags = (ZPROP_SRC_NONE \|
	(dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
	err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
	}
	nvlist_free(cleared_props);
	return (err);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_value name of property to set
	* zc_nvlist_src{_size} nvlist of properties to apply
	* zc_cookie received properties flag
	*
	* outputs:
	* zc_nvlist_dst{_size} error for each unapplied received property
	*/
	static int
	zfs_ioc_set_prop(zfs_cmd_t *zc)
	{
	nvlist_t *nvl;
	boolean_t received = zc->zc_cookie;
	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
	ZPROP_SRC_LOCAL);
	nvlist_t *errors;
	int error;

	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &nvl)) != 0)
	return (error);

	if (received) {
	nvlist_t *origprops;

	if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
	(void) clear_received_props(zc->zc_name,
	origprops, nvl);
	nvlist_free(origprops);
	}

	error = dsl_prop_set_hasrecvd(zc->zc_name);
	}

	errors = fnvlist_alloc();
	if (error == 0)
	error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);

	if (zc->zc_nvlist_dst != 0 && errors != NULL) {
	(void) put_nvlist(zc, errors);
	}

	nvlist_free(errors);
	nvlist_free(nvl);
	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_value name of property to inherit
	* zc_cookie revert to received value if TRUE
	*
	* outputs: none
	*/
	static int
	zfs_ioc_inherit_prop(zfs_cmd_t *zc)
	{
	const char *propname = zc->zc_value;
	zfs_prop_t prop = zfs_name_to_prop(propname);
	boolean_t received = zc->zc_cookie;
	zprop_source_t source = (received
	? ZPROP_SRC_NONE /* revert to received value, if any */
	: ZPROP_SRC_INHERITED); /* explicitly inherit */
	nvlist_t *dummy;
	nvpair_t *pair;
	zprop_type_t type;
	int err;

	if (!received) {
	/*
	* Only check this in the non-received case. We want to allow
	* 'inherit -S' to revert non-inheritable properties like quota
	* and reservation to the received or default values even though
	* they are not considered inheritable.
	*/
	if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
	return (SET_ERROR(EINVAL));
	}

	if (prop == ZPROP_INVAL) {
	if (!zfs_prop_user(propname))
	return (SET_ERROR(EINVAL));

	type = PROP_TYPE_STRING;
	} else if (prop == ZFS_PROP_VOLSIZE \|\| prop == ZFS_PROP_VERSION) {
	return (SET_ERROR(EINVAL));
	} else {
	type = zfs_prop_get_type(prop);
	}

	/*
	* zfs_prop_set_special() expects properties in the form of an
	* nvpair with type info.
	*/
	dummy = fnvlist_alloc();

	switch (type) {
	case PROP_TYPE_STRING:
	VERIFY(0 == nvlist_add_string(dummy, propname, ""));
	break;
	case PROP_TYPE_NUMBER:
	case PROP_TYPE_INDEX:
	VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
	break;
	default:
	err = SET_ERROR(EINVAL);
	goto errout;
	}

	pair = nvlist_next_nvpair(dummy, NULL);
	if (pair == NULL) {
	err = SET_ERROR(EINVAL);
	} else {
	err = zfs_prop_set_special(zc->zc_name, source, pair);
	if (err == -1) /* property is not "special", needs handling */
	err = dsl_prop_inherit(zc->zc_name, zc->zc_value,
	source);
	}

	errout:
	nvlist_free(dummy);
	return (err);
	}

	static int
	zfs_ioc_pool_set_props(zfs_cmd_t *zc)
	{
	nvlist_t *props;
	spa_t *spa;
	int error;
	nvpair_t *pair;

	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &props)))
	return (error);

	/*
	* If the only property is the configfile, then just do a spa_lookup()
	* to handle the faulted case.
	*/
	pair = nvlist_next_nvpair(props, NULL);
	if (pair != NULL && strcmp(nvpair_name(pair),
	zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
	nvlist_next_nvpair(props, pair) == NULL) {
	mutex_enter(&spa_namespace_lock);
	if ((spa = spa_lookup(zc->zc_name)) != NULL) {
	spa_configfile_set(spa, props, B_FALSE);
	spa_write_cachefile(spa, B_FALSE, B_TRUE);
	}
	mutex_exit(&spa_namespace_lock);
	if (spa != NULL) {
	nvlist_free(props);
	return (0);
	}
	}

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
	nvlist_free(props);
	return (error);
	}

	error = spa_prop_set(spa, props);

	nvlist_free(props);
	spa_close(spa, FTAG);

	return (error);
	}

	static int
	zfs_ioc_pool_get_props(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;
	nvlist_t *nvp = NULL;

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
	/*
	* If the pool is faulted, there may be properties we can still
	* get (such as altroot and cachefile), so attempt to get them
	* anyway.
	*/
	mutex_enter(&spa_namespace_lock);
	if ((spa = spa_lookup(zc->zc_name)) != NULL)
	error = spa_prop_get(spa, &nvp);
	mutex_exit(&spa_namespace_lock);
	} else {
	error = spa_prop_get(spa, &nvp);
	spa_close(spa, FTAG);
	}

	if (error == 0 && zc->zc_nvlist_dst != 0)
	error = put_nvlist(zc, nvp);
	else
	error = SET_ERROR(EFAULT);

	nvlist_free(nvp);
	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_nvlist_src{_size} nvlist of delegated permissions
	* zc_perm_action allow/unallow flag
	*
	* outputs: none
	*/
	static int
	zfs_ioc_set_fsacl(zfs_cmd_t *zc)
	{
	int error;
	nvlist_t *fsaclnv = NULL;

	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &fsaclnv)) != 0)
	return (error);

	/*
	* Verify nvlist is constructed correctly
	*/
	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
	nvlist_free(fsaclnv);
	return (SET_ERROR(EINVAL));
	}

	/*
	* If we don't have PRIV_SYS_MOUNT, then validate
	* that user is allowed to hand out each permission in
	* the nvlist(s)
	*/

	error = secpolicy_zfs(CRED());
	if (error != 0) {
	if (zc->zc_perm_action == B_FALSE) {
	error = dsl_deleg_can_allow(zc->zc_name,
	fsaclnv, CRED());
	} else {
	error = dsl_deleg_can_unallow(zc->zc_name,
	fsaclnv, CRED());
	}
	}

	if (error == 0)
	error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);

	nvlist_free(fsaclnv);
	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	*
	* outputs:
	* zc_nvlist_src{_size} nvlist of delegated permissions
	*/
	static int
	zfs_ioc_get_fsacl(zfs_cmd_t *zc)
	{
	nvlist_t *nvp;
	int error;

	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
	error = put_nvlist(zc, nvp);
	nvlist_free(nvp);
	}

	return (error);
	}

	/* ARGSUSED */
	static void
	zfs_create_cb(objset_t os, void arg, cred_t cr, dmu_tx_t tx)
	{
	zfs_creat_t *zct = arg;

	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
	}

	#define ZFS_PROP_UNDEFINED ((uint64_t)-1)

	/*
	* inputs:
	* os parent objset pointer (NULL if root fs)
	* fuids_ok fuids allowed in this version of the spa?
	* sa_ok SAs allowed in this version of the spa?
	* createprops list of properties requested by creator
	*
	* outputs:
	* zplprops values for the zplprops we attach to the master node object
	* is_ci true if requested file system will be purely case-insensitive
	*
	* Determine the settings for utf8only, normalization and
	* casesensitivity. Specific values may have been requested by the
	* creator and/or we can inherit values from the parent dataset. If
	* the file system is of too early a vintage, a creator can not
	* request settings for these properties, even if the requested
	* setting is the default value. We don't actually want to create dsl
	* properties for these, so remove them from the source nvlist after
	* processing.
	*/
	static int
	zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
	boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
	nvlist_t zplprops, boolean_t is_ci)
	{
	uint64_t sense = ZFS_PROP_UNDEFINED;
	uint64_t norm = ZFS_PROP_UNDEFINED;
	uint64_t u8 = ZFS_PROP_UNDEFINED;
	int error;

	ASSERT(zplprops != NULL);

	/* parent dataset must be a filesystem */
	if (os != NULL && os->os_phys->os_type != DMU_OST_ZFS)
	return (SET_ERROR(ZFS_ERR_WRONG_PARENT));

	/*
	* Pull out creator prop choices, if any.
	*/
	if (createprops) {
	(void) nvlist_lookup_uint64(createprops,
	zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
	(void) nvlist_lookup_uint64(createprops,
	zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
	(void) nvlist_remove_all(createprops,
	zfs_prop_to_name(ZFS_PROP_NORMALIZE));
	(void) nvlist_lookup_uint64(createprops,
	zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
	(void) nvlist_remove_all(createprops,
	zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
	(void) nvlist_lookup_uint64(createprops,
	zfs_prop_to_name(ZFS_PROP_CASE), &sense);
	(void) nvlist_remove_all(createprops,
	zfs_prop_to_name(ZFS_PROP_CASE));
	}

	/*
	* If the zpl version requested is whacky or the file system
	* or pool is version is too "young" to support normalization
	* and the creator tried to set a value for one of the props,
	* error out.
	*/
	if ((zplver < ZPL_VERSION_INITIAL \|\| zplver > ZPL_VERSION) \|\|
	(zplver >= ZPL_VERSION_FUID && !fuids_ok) \|\|
	(zplver >= ZPL_VERSION_SA && !sa_ok) \|\|
	(zplver < ZPL_VERSION_NORMALIZATION &&
	(norm != ZFS_PROP_UNDEFINED \|\| u8 != ZFS_PROP_UNDEFINED \|\|
	sense != ZFS_PROP_UNDEFINED)))
	return (SET_ERROR(ENOTSUP));

	/*
	* Put the version in the zplprops
	*/
	VERIFY(nvlist_add_uint64(zplprops,
	zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);

	if (norm == ZFS_PROP_UNDEFINED &&
	(error = zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm)) != 0)
	return (error);
	VERIFY(nvlist_add_uint64(zplprops,
	zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);

	/*
	* If we're normalizing, names must always be valid UTF-8 strings.
	*/
	if (norm)
	u8 = 1;
	if (u8 == ZFS_PROP_UNDEFINED &&
	(error = zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8)) != 0)
	return (error);
	VERIFY(nvlist_add_uint64(zplprops,
	zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);

	if (sense == ZFS_PROP_UNDEFINED &&
	(error = zfs_get_zplprop(os, ZFS_PROP_CASE, &sense)) != 0)
	return (error);
	VERIFY(nvlist_add_uint64(zplprops,
	zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);

	if (is_ci)
	*is_ci = (sense == ZFS_CASE_INSENSITIVE);

	return (0);
	}

	static int
	zfs_fill_zplprops(const char dataset, nvlist_t createprops,
	nvlist_t zplprops, boolean_t is_ci)
	{
	boolean_t fuids_ok, sa_ok;
	uint64_t zplver = ZPL_VERSION;
	objset_t *os = NULL;
	char parentname[ZFS_MAX_DATASET_NAME_LEN];
	spa_t *spa;
	uint64_t spa_vers;
	int error;

	zfs_get_parent(dataset, parentname, sizeof (parentname));

	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
	return (error);

	spa_vers = spa_version(spa);
	spa_close(spa, FTAG);

	zplver = zfs_zpl_version_map(spa_vers);
	fuids_ok = (zplver >= ZPL_VERSION_FUID);
	sa_ok = (zplver >= ZPL_VERSION_SA);

	/*
	* Open parent object set so we can inherit zplprop values.
	*/
	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
	return (error);

	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
	zplprops, is_ci);
	dmu_objset_rele(os, FTAG);
	return (error);
	}

	static int
	zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
	nvlist_t zplprops, boolean_t is_ci)
	{
	boolean_t fuids_ok;
	boolean_t sa_ok;
	uint64_t zplver = ZPL_VERSION;
	int error;

	zplver = zfs_zpl_version_map(spa_vers);
	fuids_ok = (zplver >= ZPL_VERSION_FUID);
	sa_ok = (zplver >= ZPL_VERSION_SA);

	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
	createprops, zplprops, is_ci);
	return (error);
	}

	/*
	* innvl: {
	* "type" -> dmu_objset_type_t (int32)
	* (optional) "props" -> { prop -> value }
	* (optional) "hidden_args" -> { "wkeydata" -> value }
	* raw uint8_t array of encryption wrapping key data (32 bytes)
	* }
	*
	* outnvl: propname -> error code (int32)
	*/

	static const zfs_ioc_key_t zfs_keys_create[] = {
	{"type", DATA_TYPE_INT32, 0},
	{"props", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	{"hidden_args", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	};

	static int
	zfs_ioc_create(const char fsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	int error = 0;
	zfs_creat_t zct = { 0 };
	nvlist_t *nvprops = NULL;
	nvlist_t *hidden_args = NULL;
	void (cbfunc)(objset_t os, void arg, cred_t cr, dmu_tx_t *tx);
	dmu_objset_type_t type;
	boolean_t is_insensitive = B_FALSE;
	dsl_crypto_params_t *dcp = NULL;

	type = (dmu_objset_type_t)fnvlist_lookup_int32(innvl, "type");
	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
	(void) nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);

	switch (type) {
	case DMU_OST_ZFS:
	cbfunc = zfs_create_cb;
	break;

	case DMU_OST_ZVOL:
	cbfunc = zvol_create_cb;
	break;

	default:
	cbfunc = NULL;
	break;
	}
	if (strchr(fsname, '@') \|\|
	strchr(fsname, '%'))
	return (SET_ERROR(EINVAL));

	zct.zct_props = nvprops;

	if (cbfunc == NULL)
	return (SET_ERROR(EINVAL));

	if (type == DMU_OST_ZVOL) {
	uint64_t volsize, volblocksize;

	if (nvprops == NULL)
	return (SET_ERROR(EINVAL));
	if (nvlist_lookup_uint64(nvprops,
	zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
	return (SET_ERROR(EINVAL));

	if ((error = nvlist_lookup_uint64(nvprops,
	zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
	&volblocksize)) != 0 && error != ENOENT)
	return (SET_ERROR(EINVAL));

	if (error != 0)
	volblocksize = zfs_prop_default_numeric(
	ZFS_PROP_VOLBLOCKSIZE);

	if ((error = zvol_check_volblocksize(fsname,
	volblocksize)) != 0 \|\|
	(error = zvol_check_volsize(volsize,
	volblocksize)) != 0)
	return (error);
	} else if (type == DMU_OST_ZFS) {
	int error;

	/*
	* We have to have normalization and
	* case-folding flags correct when we do the
	* file system creation, so go figure them out
	* now.
	*/
	VERIFY(nvlist_alloc(&zct.zct_zplprops,
	NV_UNIQUE_NAME, KM_SLEEP) == 0);
	error = zfs_fill_zplprops(fsname, nvprops,
	zct.zct_zplprops, &is_insensitive);
	if (error != 0) {
	nvlist_free(zct.zct_zplprops);
	return (error);
	}
	}

	error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE, nvprops,
	hidden_args, &dcp);
	if (error != 0) {
	nvlist_free(zct.zct_zplprops);
	return (error);
	}

	error = dmu_objset_create(fsname, type,
	is_insensitive ? DS_FLAG_CI_DATASET : 0, dcp, cbfunc, &zct);

	nvlist_free(zct.zct_zplprops);
	dsl_crypto_params_free(dcp, !!error);

	/*
	* It would be nice to do this atomically.
	*/
	if (error == 0) {
	error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
	nvprops, outnvl);
	if (error != 0) {
	spa_t *spa;
	int error2;

	/*
	* Volumes will return EBUSY and cannot be destroyed
	* until all asynchronous minor handling (e.g. from
	* setting the volmode property) has completed. Wait for
	* the spa_zvol_taskq to drain then retry.
	*/
	error2 = dsl_destroy_head(fsname);
	while ((error2 == EBUSY) && (type == DMU_OST_ZVOL)) {
	error2 = spa_open(fsname, &spa, FTAG);
	if (error2 == 0) {
	taskq_wait(spa->spa_zvol_taskq);
	spa_close(spa, FTAG);
	}
	error2 = dsl_destroy_head(fsname);
	}
	}
	}
	return (error);
	}

	/*
	* innvl: {
	* "origin" -> name of origin snapshot
	* (optional) "props" -> { prop -> value }
	* (optional) "hidden_args" -> { "wkeydata" -> value }
	* raw uint8_t array of encryption wrapping key data (32 bytes)
	* }
	*
	* outputs:
	* outnvl: propname -> error code (int32)
	*/
	static const zfs_ioc_key_t zfs_keys_clone[] = {
	{"origin", DATA_TYPE_STRING, 0},
	{"props", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	{"hidden_args", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	};

	static int
	zfs_ioc_clone(const char fsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	int error = 0;
	nvlist_t *nvprops = NULL;
	char *origin_name;

	origin_name = fnvlist_lookup_string(innvl, "origin");
	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);

	if (strchr(fsname, '@') \|\|
	strchr(fsname, '%'))
	return (SET_ERROR(EINVAL));

	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
	return (SET_ERROR(EINVAL));

	error = dmu_objset_clone(fsname, origin_name);

	/*
	* It would be nice to do this atomically.
	*/
	if (error == 0) {
	error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
	nvprops, outnvl);
	if (error != 0)
	(void) dsl_destroy_head(fsname);
	}
	return (error);
	}

	static const zfs_ioc_key_t zfs_keys_remap[] = {
	/* no nvl keys */
	};

	/* ARGSUSED */
	static int
	zfs_ioc_remap(const char fsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	/* This IOCTL is no longer supported. */
	return (0);
	}

	/*
	* innvl: {
	* "snaps" -> { snapshot1, snapshot2 }
	* (optional) "props" -> { prop -> value (string) }
	* }
	*
	* outnvl: snapshot -> error code (int32)
	*/
	static const zfs_ioc_key_t zfs_keys_snapshot[] = {
	{"snaps", DATA_TYPE_NVLIST, 0},
	{"props", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	};

	static int
	zfs_ioc_snapshot(const char poolname, nvlist_t innvl, nvlist_t *outnvl)
	{
	nvlist_t *snaps;
	nvlist_t *props = NULL;
	int error, poollen;
	nvpair_t *pair;

	(void) nvlist_lookup_nvlist(innvl, "props", &props);
	if (!nvlist_empty(props) &&
	zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
	return (SET_ERROR(ENOTSUP));
	if ((error = zfs_check_userprops(props)) != 0)
	return (error);

	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
	poollen = strlen(poolname);
	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
	pair = nvlist_next_nvpair(snaps, pair)) {
	const char *name = nvpair_name(pair);
	char *cp = strchr(name, '@');

	/*
	* The snap name must contain an @, and the part after it must
	* contain only valid characters.
	*/
	if (cp == NULL \|\|
	zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
	return (SET_ERROR(EINVAL));

	/*
	* The snap must be in the specified pool.
	*/
	if (strncmp(name, poolname, poollen) != 0 \|\|
	(name[poollen] != '/' && name[poollen] != '@'))
	return (SET_ERROR(EXDEV));

	/*
	* Check for permission to set the properties on the fs.
	*/
	if (!nvlist_empty(props)) {
	*cp = '\0';
	error = zfs_secpolicy_write_perms(name,
	ZFS_DELEG_PERM_USERPROP, CRED());
	*cp = '@';
	if (error != 0)
	return (error);
	}

	/* This must be the only snap of this fs. */
	for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
	pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
	if (strncmp(name, nvpair_name(pair2), cp - name + 1)
	== 0) {
	return (SET_ERROR(EXDEV));
	}
	}
	}

	error = dsl_dataset_snapshot(snaps, props, outnvl);

	return (error);
	}

	/*
	* innvl: "message" -> string
	*/
	static const zfs_ioc_key_t zfs_keys_log_history[] = {
	{"message", DATA_TYPE_STRING, 0},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_log_history(const char unused, nvlist_t innvl, nvlist_t *outnvl)
	{
	char *message;
	spa_t *spa;
	int error;
	char *poolname;

	/*
	* The poolname in the ioctl is not set, we get it from the TSD,
	* which was set at the end of the last successful ioctl that allows
	* logging. The secpolicy func already checked that it is set.
	* Only one log ioctl is allowed after each successful ioctl, so
	* we clear the TSD here.
	*/
	poolname = tsd_get(zfs_allow_log_key);
	if (poolname == NULL)
	return (SET_ERROR(EINVAL));
	(void) tsd_set(zfs_allow_log_key, NULL);
	error = spa_open(poolname, &spa, FTAG);
	kmem_strfree(poolname);
	if (error != 0)
	return (error);

	message = fnvlist_lookup_string(innvl, "message");

	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
	spa_close(spa, FTAG);
	return (SET_ERROR(ENOTSUP));
	}

	error = spa_history_log(spa, message);
	spa_close(spa, FTAG);
	return (error);
	}

	/*
	* This ioctl is used to set the bootenv configuration on the current
	* pool. This configuration is stored in the second padding area of the label,
	- * and it is used by the GRUB bootloader used on Linux to store the contents
	- * of the grubenv file. The file is stored as raw ASCII, and is protected by
	- * an embedded checksum. By default, GRUB will check if the boot filesystem
	- * supports storing the environment data in a special location, and if so,
	- * will invoke filesystem specific logic to retrieve it. This can be overridden
	- * by a variable, should the user so desire.
	+ * and it is used by the bootloader(s) to store the bootloader and/or system
	+ * specific data.
	+ * The data is stored as nvlist data stream, and is protected by
	+ * an embedded checksum.
	+ * The version can have two possible values:
	+ * VB_RAW: nvlist should have key GRUB_ENVMAP, value DATA_TYPE_STRING.
	+ * VB_NVLIST: nvlist with arbitrary <key, value> pairs.
	*/
	-/* ARGSUSED */
	static const zfs_ioc_key_t zfs_keys_set_bootenv[] = {
	- {"envmap", DATA_TYPE_STRING, 0},
	+ {"version", DATA_TYPE_UINT64, 0},
	+ {"<keys>", DATA_TYPE_ANY, ZK_OPTIONAL \| ZK_WILDCARDLIST},
	};

	static int
	zfs_ioc_set_bootenv(const char name, nvlist_t innvl, nvlist_t *outnvl)
	{
	- char *envmap;
	int error;
	spa_t *spa;

	- envmap = fnvlist_lookup_string(innvl, "envmap");
	if ((error = spa_open(name, &spa, FTAG)) != 0)
	return (error);
	spa_vdev_state_enter(spa, SCL_ALL);
	- error = vdev_label_write_bootenv(spa->spa_root_vdev, envmap);
	+ error = vdev_label_write_bootenv(spa->spa_root_vdev, innvl);
	(void) spa_vdev_state_exit(spa, NULL, 0);
	spa_close(spa, FTAG);
	return (error);
	}

	static const zfs_ioc_key_t zfs_keys_get_bootenv[] = {
	/* no nvl keys */
	};

	-/* ARGSUSED */
	static int
	zfs_ioc_get_bootenv(const char name, nvlist_t innvl, nvlist_t *outnvl)
	{
	spa_t *spa;
	int error;

	if ((error = spa_open(name, &spa, FTAG)) != 0)
	return (error);
	spa_vdev_state_enter(spa, SCL_ALL);
	error = vdev_label_read_bootenv(spa->spa_root_vdev, outnvl);
	(void) spa_vdev_state_exit(spa, NULL, 0);
	spa_close(spa, FTAG);
	return (error);
	}

	/*
	* The dp_config_rwlock must not be held when calling this, because the
	* unmount may need to write out data.
	*
	* This function is best-effort. Callers must deal gracefully if it
	* remains mounted (or is remounted after this call).
	*
	* Returns 0 if the argument is not a snapshot, or it is not currently a
	* filesystem, or we were able to unmount it. Returns error code otherwise.
	*/
	void
	zfs_unmount_snap(const char *snapname)
	{
	if (strchr(snapname, '@') == NULL)
	return;

	(void) zfsctl_snapshot_unmount((char *)snapname, MNT_FORCE);
	}

	/* ARGSUSED */
	static int
	zfs_unmount_snap_cb(const char snapname, void arg)
	{
	zfs_unmount_snap(snapname);
	return (0);
	}

	/*
	* When a clone is destroyed, its origin may also need to be destroyed,
	* in which case it must be unmounted. This routine will do that unmount
	* if necessary.
	*/
	void
	zfs_destroy_unmount_origin(const char *fsname)
	{
	int error;
	objset_t *os;
	dsl_dataset_t *ds;

	error = dmu_objset_hold(fsname, FTAG, &os);
	if (error != 0)
	return;
	ds = dmu_objset_ds(os);
	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
	char originname[ZFS_MAX_DATASET_NAME_LEN];
	dsl_dataset_name(ds->ds_prev, originname);
	dmu_objset_rele(os, FTAG);
	zfs_unmount_snap(originname);
	} else {
	dmu_objset_rele(os, FTAG);
	}
	}

	/*
	* innvl: {
	* "snaps" -> { snapshot1, snapshot2 }
	* (optional boolean) "defer"
	* }
	*
	* outnvl: snapshot -> error code (int32)
	*/
	static const zfs_ioc_key_t zfs_keys_destroy_snaps[] = {
	{"snaps", DATA_TYPE_NVLIST, 0},
	{"defer", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_destroy_snaps(const char poolname, nvlist_t innvl, nvlist_t *outnvl)
	{
	int poollen;
	nvlist_t *snaps;
	nvpair_t *pair;
	boolean_t defer;
	spa_t *spa;

	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
	defer = nvlist_exists(innvl, "defer");

	poollen = strlen(poolname);
	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
	pair = nvlist_next_nvpair(snaps, pair)) {
	const char *name = nvpair_name(pair);

	/*
	* The snap must be in the specified pool to prevent the
	* invalid removal of zvol minors below.
	*/
	if (strncmp(name, poolname, poollen) != 0 \|\|
	(name[poollen] != '/' && name[poollen] != '@'))
	return (SET_ERROR(EXDEV));

	zfs_unmount_snap(nvpair_name(pair));
	if (spa_open(name, &spa, FTAG) == 0) {
	zvol_remove_minors(spa, name, B_TRUE);
	spa_close(spa, FTAG);
	}
	}

	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
	}

	/*
	* Create bookmarks. The bookmark names are of the form <fs>#<bmark>.
	* All bookmarks and snapshots must be in the same pool.
	* dsl_bookmark_create_nvl_validate describes the nvlist schema in more detail.
	*
	* innvl: {
	* new_bookmark1 -> existing_snapshot,
	* new_bookmark2 -> existing_bookmark,
	* }
	*
	* outnvl: bookmark -> error code (int32)
	*
	*/
	static const zfs_ioc_key_t zfs_keys_bookmark[] = {
	{"<bookmark>...", DATA_TYPE_STRING, ZK_WILDCARDLIST},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_bookmark(const char poolname, nvlist_t innvl, nvlist_t *outnvl)
	{
	return (dsl_bookmark_create(innvl, outnvl));
	}

	/*
	* innvl: {
	* property 1, property 2, ...
	* }
	*
	* outnvl: {
	* bookmark name 1 -> { property 1, property 2, ... },
	* bookmark name 2 -> { property 1, property 2, ... }
	* }
	*
	*/
	static const zfs_ioc_key_t zfs_keys_get_bookmarks[] = {
	{"<property>...", DATA_TYPE_BOOLEAN, ZK_WILDCARDLIST \| ZK_OPTIONAL},
	};

	static int
	zfs_ioc_get_bookmarks(const char fsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	return (dsl_get_bookmarks(fsname, innvl, outnvl));
	}

	/*
	* innvl is not used.
	*
	* outnvl: {
	* property 1, property 2, ...
	* }
	*
	*/
	static const zfs_ioc_key_t zfs_keys_get_bookmark_props[] = {
	/* no nvl keys */
	};

	/* ARGSUSED */
	static int
	zfs_ioc_get_bookmark_props(const char bookmark, nvlist_t innvl,
	nvlist_t *outnvl)
	{
	char fsname[ZFS_MAX_DATASET_NAME_LEN];
	char *bmname;

	bmname = strchr(bookmark, '#');
	if (bmname == NULL)
	return (SET_ERROR(EINVAL));
	bmname++;

	(void) strlcpy(fsname, bookmark, sizeof (fsname));
	*(strchr(fsname, '#')) = '\0';

	return (dsl_get_bookmark_props(fsname, bmname, outnvl));
	}

	/*
	* innvl: {
	* bookmark name 1, bookmark name 2
	* }
	*
	* outnvl: bookmark -> error code (int32)
	*
	*/
	static const zfs_ioc_key_t zfs_keys_destroy_bookmarks[] = {
	{"<bookmark>...", DATA_TYPE_BOOLEAN, ZK_WILDCARDLIST},
	};

	static int
	zfs_ioc_destroy_bookmarks(const char poolname, nvlist_t innvl,
	nvlist_t *outnvl)
	{
	int error, poollen;

	poollen = strlen(poolname);
	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
	pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
	const char *name = nvpair_name(pair);
	const char *cp = strchr(name, '#');

	/*
	* The bookmark name must contain an #, and the part after it
	* must contain only valid characters.
	*/
	if (cp == NULL \|\|
	zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
	return (SET_ERROR(EINVAL));

	/*
	* The bookmark must be in the specified pool.
	*/
	if (strncmp(name, poolname, poollen) != 0 \|\|
	(name[poollen] != '/' && name[poollen] != '#'))
	return (SET_ERROR(EXDEV));
	}

	error = dsl_bookmark_destroy(innvl, outnvl);
	return (error);
	}

	static const zfs_ioc_key_t zfs_keys_channel_program[] = {
	{"program", DATA_TYPE_STRING, 0},
	{"arg", DATA_TYPE_ANY, 0},
	{"sync", DATA_TYPE_BOOLEAN_VALUE, ZK_OPTIONAL},
	{"instrlimit", DATA_TYPE_UINT64, ZK_OPTIONAL},
	{"memlimit", DATA_TYPE_UINT64, ZK_OPTIONAL},
	};

	static int
	zfs_ioc_channel_program(const char poolname, nvlist_t innvl,
	nvlist_t *outnvl)
	{
	char *program;
	uint64_t instrlimit, memlimit;
	boolean_t sync_flag;
	nvpair_t *nvarg = NULL;

	program = fnvlist_lookup_string(innvl, ZCP_ARG_PROGRAM);
	if (0 != nvlist_lookup_boolean_value(innvl, ZCP_ARG_SYNC, &sync_flag)) {
	sync_flag = B_TRUE;
	}
	if (0 != nvlist_lookup_uint64(innvl, ZCP_ARG_INSTRLIMIT, &instrlimit)) {
	instrlimit = ZCP_DEFAULT_INSTRLIMIT;
	}
	if (0 != nvlist_lookup_uint64(innvl, ZCP_ARG_MEMLIMIT, &memlimit)) {
	memlimit = ZCP_DEFAULT_MEMLIMIT;
	}
	nvarg = fnvlist_lookup_nvpair(innvl, ZCP_ARG_ARGLIST);

	if (instrlimit == 0 \|\| instrlimit > zfs_lua_max_instrlimit)
	return (SET_ERROR(EINVAL));
	if (memlimit == 0 \|\| memlimit > zfs_lua_max_memlimit)
	return (SET_ERROR(EINVAL));

	return (zcp_eval(poolname, program, sync_flag, instrlimit, memlimit,
	nvarg, outnvl));
	}

	/*
	* innvl: unused
	* outnvl: empty
	*/
	static const zfs_ioc_key_t zfs_keys_pool_checkpoint[] = {
	/* no nvl keys */
	};

	/* ARGSUSED */
	static int
	zfs_ioc_pool_checkpoint(const char poolname, nvlist_t innvl, nvlist_t *outnvl)
	{
	return (spa_checkpoint(poolname));
	}

	/*
	* innvl: unused
	* outnvl: empty
	*/
	static const zfs_ioc_key_t zfs_keys_pool_discard_checkpoint[] = {
	/* no nvl keys */
	};

	/* ARGSUSED */
	static int
	zfs_ioc_pool_discard_checkpoint(const char poolname, nvlist_t innvl,
	nvlist_t *outnvl)
	{
	return (spa_checkpoint_discard(poolname));
	}

	/*
	* inputs:
	* zc_name name of dataset to destroy
	* zc_defer_destroy mark for deferred destroy
	*
	* outputs: none
	*/
	static int
	zfs_ioc_destroy(zfs_cmd_t *zc)
	{
	objset_t *os;
	dmu_objset_type_t ost;
	int err;

	err = dmu_objset_hold(zc->zc_name, FTAG, &os);
	if (err != 0)
	return (err);
	ost = dmu_objset_type(os);
	dmu_objset_rele(os, FTAG);

	if (ost == DMU_OST_ZFS)
	zfs_unmount_snap(zc->zc_name);

	if (strchr(zc->zc_name, '@')) {
	err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
	} else {
	err = dsl_destroy_head(zc->zc_name);
	if (err == EEXIST) {
	/*
	* It is possible that the given DS may have
	* hidden child (%recv) datasets - "leftovers"
	* resulting from the previously interrupted
	* 'zfs receive'.
	*
	* 6 extra bytes for /%recv
	*/
	char namebuf[ZFS_MAX_DATASET_NAME_LEN + 6];

	if (snprintf(namebuf, sizeof (namebuf), "%s/%s",
	zc->zc_name, recv_clone_name) >=
	sizeof (namebuf))
	return (SET_ERROR(EINVAL));

	/*
	* Try to remove the hidden child (%recv) and after
	* that try to remove the target dataset.
	* If the hidden child (%recv) does not exist
	* the original error (EEXIST) will be returned
	*/
	err = dsl_destroy_head(namebuf);
	if (err == 0)
	err = dsl_destroy_head(zc->zc_name);
	else if (err == ENOENT)
	err = SET_ERROR(EEXIST);
	}
	}

	return (err);
	}

	/*
	* innvl: {
	* "initialize_command" -> POOL_INITIALIZE_{CANCEL\|START\|SUSPEND} (uint64)
	* "initialize_vdevs": { -> guids to initialize (nvlist)
	* "vdev_path_1": vdev_guid_1, (uint64),
	* "vdev_path_2": vdev_guid_2, (uint64),
	* ...
	* },
	* }
	*
	* outnvl: {
	* "initialize_vdevs": { -> initialization errors (nvlist)
	* "vdev_path_1": errno, see function body for possible errnos (uint64)
	* "vdev_path_2": errno, ... (uint64)
	* ...
	* }
	* }
	*
	* EINVAL is returned for an unknown commands or if any of the provided vdev
	* guids have be specified with a type other than uint64.
	*/
	static const zfs_ioc_key_t zfs_keys_pool_initialize[] = {
	{ZPOOL_INITIALIZE_COMMAND, DATA_TYPE_UINT64, 0},
	{ZPOOL_INITIALIZE_VDEVS, DATA_TYPE_NVLIST, 0}
	};

	static int
	zfs_ioc_pool_initialize(const char poolname, nvlist_t innvl, nvlist_t *outnvl)
	{
	uint64_t cmd_type;
	if (nvlist_lookup_uint64(innvl, ZPOOL_INITIALIZE_COMMAND,
	&cmd_type) != 0) {
	return (SET_ERROR(EINVAL));
	}

	if (!(cmd_type == POOL_INITIALIZE_CANCEL \|\|
	cmd_type == POOL_INITIALIZE_START \|\|
	cmd_type == POOL_INITIALIZE_SUSPEND)) {
	return (SET_ERROR(EINVAL));
	}

	nvlist_t *vdev_guids;
	if (nvlist_lookup_nvlist(innvl, ZPOOL_INITIALIZE_VDEVS,
	&vdev_guids) != 0) {
	return (SET_ERROR(EINVAL));
	}

	for (nvpair_t *pair = nvlist_next_nvpair(vdev_guids, NULL);
	pair != NULL; pair = nvlist_next_nvpair(vdev_guids, pair)) {
	uint64_t vdev_guid;
	if (nvpair_value_uint64(pair, &vdev_guid) != 0) {
	return (SET_ERROR(EINVAL));
	}
	}

	spa_t *spa;
	int error = spa_open(poolname, &spa, FTAG);
	if (error != 0)
	return (error);

	nvlist_t *vdev_errlist = fnvlist_alloc();
	int total_errors = spa_vdev_initialize(spa, vdev_guids, cmd_type,
	vdev_errlist);

	if (fnvlist_size(vdev_errlist) > 0) {
	fnvlist_add_nvlist(outnvl, ZPOOL_INITIALIZE_VDEVS,
	vdev_errlist);
	}
	fnvlist_free(vdev_errlist);

	spa_close(spa, FTAG);
	return (total_errors > 0 ? EINVAL : 0);
	}

	/*
	* innvl: {
	* "trim_command" -> POOL_TRIM_{CANCEL\|START\|SUSPEND} (uint64)
	* "trim_vdevs": { -> guids to TRIM (nvlist)
	* "vdev_path_1": vdev_guid_1, (uint64),
	* "vdev_path_2": vdev_guid_2, (uint64),
	* ...
	* },
	* "trim_rate" -> Target TRIM rate in bytes/sec.
	* "trim_secure" -> Set to request a secure TRIM.
	* }
	*
	* outnvl: {
	* "trim_vdevs": { -> TRIM errors (nvlist)
	* "vdev_path_1": errno, see function body for possible errnos (uint64)
	* "vdev_path_2": errno, ... (uint64)
	* ...
	* }
	* }
	*
	* EINVAL is returned for an unknown commands or if any of the provided vdev
	* guids have be specified with a type other than uint64.
	*/
	static const zfs_ioc_key_t zfs_keys_pool_trim[] = {
	{ZPOOL_TRIM_COMMAND, DATA_TYPE_UINT64, 0},
	{ZPOOL_TRIM_VDEVS, DATA_TYPE_NVLIST, 0},
	{ZPOOL_TRIM_RATE, DATA_TYPE_UINT64, ZK_OPTIONAL},
	{ZPOOL_TRIM_SECURE, DATA_TYPE_BOOLEAN_VALUE, ZK_OPTIONAL},
	};

	static int
	zfs_ioc_pool_trim(const char poolname, nvlist_t innvl, nvlist_t *outnvl)
	{
	uint64_t cmd_type;
	if (nvlist_lookup_uint64(innvl, ZPOOL_TRIM_COMMAND, &cmd_type) != 0)
	return (SET_ERROR(EINVAL));

	if (!(cmd_type == POOL_TRIM_CANCEL \|\|
	cmd_type == POOL_TRIM_START \|\|
	cmd_type == POOL_TRIM_SUSPEND)) {
	return (SET_ERROR(EINVAL));
	}

	nvlist_t *vdev_guids;
	if (nvlist_lookup_nvlist(innvl, ZPOOL_TRIM_VDEVS, &vdev_guids) != 0)
	return (SET_ERROR(EINVAL));

	for (nvpair_t *pair = nvlist_next_nvpair(vdev_guids, NULL);
	pair != NULL; pair = nvlist_next_nvpair(vdev_guids, pair)) {
	uint64_t vdev_guid;
	if (nvpair_value_uint64(pair, &vdev_guid) != 0) {
	return (SET_ERROR(EINVAL));
	}
	}

	/* Optional, defaults to maximum rate when not provided */
	uint64_t rate;
	if (nvlist_lookup_uint64(innvl, ZPOOL_TRIM_RATE, &rate) != 0)
	rate = 0;

	/* Optional, defaults to standard TRIM when not provided */
	boolean_t secure;
	if (nvlist_lookup_boolean_value(innvl, ZPOOL_TRIM_SECURE,
	&secure) != 0) {
	secure = B_FALSE;
	}

	spa_t *spa;
	int error = spa_open(poolname, &spa, FTAG);
	if (error != 0)
	return (error);

	nvlist_t *vdev_errlist = fnvlist_alloc();
	int total_errors = spa_vdev_trim(spa, vdev_guids, cmd_type,
	rate, !!zfs_trim_metaslab_skip, secure, vdev_errlist);

	if (fnvlist_size(vdev_errlist) > 0)
	fnvlist_add_nvlist(outnvl, ZPOOL_TRIM_VDEVS, vdev_errlist);

	fnvlist_free(vdev_errlist);

	spa_close(spa, FTAG);
	return (total_errors > 0 ? EINVAL : 0);
	}

	/*
	* This ioctl waits for activity of a particular type to complete. If there is
	* no activity of that type in progress, it returns immediately, and the
	* returned value "waited" is false. If there is activity in progress, and no
	* tag is passed in, the ioctl blocks until all activity of that type is
	* complete, and then returns with "waited" set to true.
	*
	* If a tag is provided, it identifies a particular instance of an activity to
	* wait for. Currently, this is only valid for use with 'initialize', because
	* that is the only activity for which there can be multiple instances running
	* concurrently. In the case of 'initialize', the tag corresponds to the guid of
	* the vdev on which to wait.
	*
	* If a thread waiting in the ioctl receives a signal, the call will return
	* immediately, and the return value will be EINTR.
	*
	* innvl: {
	* "wait_activity" -> int32_t
	* (optional) "wait_tag" -> uint64_t
	* }
	*
	* outnvl: "waited" -> boolean_t
	*/
	static const zfs_ioc_key_t zfs_keys_pool_wait[] = {
	{ZPOOL_WAIT_ACTIVITY, DATA_TYPE_INT32, 0},
	{ZPOOL_WAIT_TAG, DATA_TYPE_UINT64, ZK_OPTIONAL},
	};

	static int
	zfs_ioc_wait(const char name, nvlist_t innvl, nvlist_t *outnvl)
	{
	int32_t activity;
	uint64_t tag;
	boolean_t waited;
	int error;

	if (nvlist_lookup_int32(innvl, ZPOOL_WAIT_ACTIVITY, &activity) != 0)
	return (EINVAL);

	if (nvlist_lookup_uint64(innvl, ZPOOL_WAIT_TAG, &tag) == 0)
	error = spa_wait_tag(name, activity, tag, &waited);
	else
	error = spa_wait(name, activity, &waited);

	if (error == 0)
	fnvlist_add_boolean_value(outnvl, ZPOOL_WAIT_WAITED, waited);

	return (error);
	}

	/*
	* This ioctl waits for activity of a particular type to complete. If there is
	* no activity of that type in progress, it returns immediately, and the
	* returned value "waited" is false. If there is activity in progress, and no
	* tag is passed in, the ioctl blocks until all activity of that type is
	* complete, and then returns with "waited" set to true.
	*
	* If a thread waiting in the ioctl receives a signal, the call will return
	* immediately, and the return value will be EINTR.
	*
	* innvl: {
	* "wait_activity" -> int32_t
	* }
	*
	* outnvl: "waited" -> boolean_t
	*/
	static const zfs_ioc_key_t zfs_keys_fs_wait[] = {
	{ZFS_WAIT_ACTIVITY, DATA_TYPE_INT32, 0},
	};

	static int
	zfs_ioc_wait_fs(const char name, nvlist_t innvl, nvlist_t *outnvl)
	{
	int32_t activity;
	boolean_t waited = B_FALSE;
	int error;
	dsl_pool_t *dp;
	dsl_dir_t *dd;
	dsl_dataset_t *ds;

	if (nvlist_lookup_int32(innvl, ZFS_WAIT_ACTIVITY, &activity) != 0)
	return (SET_ERROR(EINVAL));

	if (activity >= ZFS_WAIT_NUM_ACTIVITIES \|\| activity < 0)
	return (SET_ERROR(EINVAL));

	if ((error = dsl_pool_hold(name, FTAG, &dp)) != 0)
	return (error);

	if ((error = dsl_dataset_hold(dp, name, FTAG, &ds)) != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	dd = ds->ds_dir;
	mutex_enter(&dd->dd_activity_lock);
	dd->dd_activity_waiters++;

	/*
	* We get a long-hold here so that the dsl_dataset_t and dsl_dir_t
	* aren't evicted while we're waiting. Normally this is prevented by
	* holding the pool, but we can't do that while we're waiting since
	* that would prevent TXGs from syncing out. Some of the functionality
	* of long-holds (e.g. preventing deletion) is unnecessary for this
	* case, since we would cancel the waiters before proceeding with a
	* deletion. An alternative mechanism for keeping the dataset around
	* could be developed but this is simpler.
	*/
	dsl_dataset_long_hold(ds, FTAG);
	dsl_pool_rele(dp, FTAG);

	error = dsl_dir_wait(dd, ds, activity, &waited);

	dsl_dataset_long_rele(ds, FTAG);
	dd->dd_activity_waiters--;
	if (dd->dd_activity_waiters == 0)
	cv_signal(&dd->dd_activity_cv);
	mutex_exit(&dd->dd_activity_lock);

	dsl_dataset_rele(ds, FTAG);

	if (error == 0)
	fnvlist_add_boolean_value(outnvl, ZFS_WAIT_WAITED, waited);

	return (error);
	}

	/*
	* fsname is name of dataset to rollback (to most recent snapshot)
	*
	* innvl may contain name of expected target snapshot
	*
	* outnvl: "target" -> name of most recent snapshot
	* }
	*/
	static const zfs_ioc_key_t zfs_keys_rollback[] = {
	{"target", DATA_TYPE_STRING, ZK_OPTIONAL},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_rollback(const char fsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	zfsvfs_t *zfsvfs;
	zvol_state_handle_t *zv;
	char *target = NULL;
	int error;

	(void) nvlist_lookup_string(innvl, "target", &target);
	if (target != NULL) {
	const char *cp = strchr(target, '@');

	/*
	* The snap name must contain an @, and the part after it must
	* contain only valid characters.
	*/
	if (cp == NULL \|\|
	zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
	return (SET_ERROR(EINVAL));
	}

	if (getzfsvfs(fsname, &zfsvfs) == 0) {
	dsl_dataset_t *ds;

	ds = dmu_objset_ds(zfsvfs->z_os);
	error = zfs_suspend_fs(zfsvfs);
	if (error == 0) {
	int resume_err;

	error = dsl_dataset_rollback(fsname, target, zfsvfs,
	outnvl);
	resume_err = zfs_resume_fs(zfsvfs, ds);
	error = error ? error : resume_err;
	}
	zfs_vfs_rele(zfsvfs);
	} else if ((zv = zvol_suspend(fsname)) != NULL) {
	error = dsl_dataset_rollback(fsname, target, zvol_tag(zv),
	outnvl);
	zvol_resume(zv);
	} else {
	error = dsl_dataset_rollback(fsname, target, NULL, outnvl);
	}
	return (error);
	}

	static int
	recursive_unmount(const char fsname, void arg)
	{
	const char *snapname = arg;
	char *fullname;

	fullname = kmem_asprintf("%s@%s", fsname, snapname);
	zfs_unmount_snap(fullname);
	kmem_strfree(fullname);

	return (0);
	}

	/*
	*
	* snapname is the snapshot to redact.
	* innvl: {
	* "bookname" -> (string)
	* shortname of the redaction bookmark to generate
	* "snapnv" -> (nvlist, values ignored)
	* snapshots to redact snapname with respect to
	* }
	*
	* outnvl is unused
	*/

	/* ARGSUSED */
	static const zfs_ioc_key_t zfs_keys_redact[] = {
	{"bookname", DATA_TYPE_STRING, 0},
	{"snapnv", DATA_TYPE_NVLIST, 0},
	};
	static int
	zfs_ioc_redact(const char snapname, nvlist_t innvl, nvlist_t *outnvl)
	{
	nvlist_t *redactnvl = NULL;
	char *redactbook = NULL;

	if (nvlist_lookup_nvlist(innvl, "snapnv", &redactnvl) != 0)
	return (SET_ERROR(EINVAL));
	if (fnvlist_num_pairs(redactnvl) == 0)
	return (SET_ERROR(ENXIO));
	if (nvlist_lookup_string(innvl, "bookname", &redactbook) != 0)
	return (SET_ERROR(EINVAL));

	return (dmu_redact_snap(snapname, redactnvl, redactbook));
	}

	/*
	* inputs:
	* zc_name old name of dataset
	* zc_value new name of dataset
	* zc_cookie recursive flag (only valid for snapshots)
	*
	* outputs: none
	*/
	static int
	zfs_ioc_rename(zfs_cmd_t *zc)
	{
	objset_t *os;
	dmu_objset_type_t ost;
	boolean_t recursive = zc->zc_cookie & 1;
	boolean_t nounmount = !!(zc->zc_cookie & 2);
	char *at;
	int err;

	/* "zfs rename" from and to ...%recv datasets should both fail */
	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
	if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0 \|\|
	dataset_namecheck(zc->zc_value, NULL, NULL) != 0 \|\|
	strchr(zc->zc_name, '%') \|\| strchr(zc->zc_value, '%'))
	return (SET_ERROR(EINVAL));

	err = dmu_objset_hold(zc->zc_name, FTAG, &os);
	if (err != 0)
	return (err);
	ost = dmu_objset_type(os);
	dmu_objset_rele(os, FTAG);

	at = strchr(zc->zc_name, '@');
	if (at != NULL) {
	/* snaps must be in same fs */
	int error;

	if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
	return (SET_ERROR(EXDEV));
	*at = '\0';
	if (ost == DMU_OST_ZFS && !nounmount) {
	error = dmu_objset_find(zc->zc_name,
	recursive_unmount, at + 1,
	recursive ? DS_FIND_CHILDREN : 0);
	if (error != 0) {
	*at = '@';
	return (error);
	}
	}
	error = dsl_dataset_rename_snapshot(zc->zc_name,
	at + 1, strchr(zc->zc_value, '@') + 1, recursive);
	*at = '@';

	return (error);
	} else {
	return (dsl_dir_rename(zc->zc_name, zc->zc_value));
	}
	}

	static int
	zfs_check_settable(const char dsname, nvpair_t pair, cred_t *cr)
	{
	const char *propname = nvpair_name(pair);
	boolean_t issnap = (strchr(dsname, '@') != NULL);
	zfs_prop_t prop = zfs_name_to_prop(propname);
	uint64_t intval, compval;
	int err;

	if (prop == ZPROP_INVAL) {
	if (zfs_prop_user(propname)) {
	if ((err = zfs_secpolicy_write_perms(dsname,
	ZFS_DELEG_PERM_USERPROP, cr)))
	return (err);
	return (0);
	}

	if (!issnap && zfs_prop_userquota(propname)) {
	const char *perm = NULL;
	const char *uq_prefix =
	zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
	const char *gq_prefix =
	zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
	const char *uiq_prefix =
	zfs_userquota_prop_prefixes[ZFS_PROP_USEROBJQUOTA];
	const char *giq_prefix =
	zfs_userquota_prop_prefixes[ZFS_PROP_GROUPOBJQUOTA];
	const char *pq_prefix =
	zfs_userquota_prop_prefixes[ZFS_PROP_PROJECTQUOTA];
	const char *piq_prefix = zfs_userquota_prop_prefixes[\
	ZFS_PROP_PROJECTOBJQUOTA];

	if (strncmp(propname, uq_prefix,
	strlen(uq_prefix)) == 0) {
	perm = ZFS_DELEG_PERM_USERQUOTA;
	} else if (strncmp(propname, uiq_prefix,
	strlen(uiq_prefix)) == 0) {
	perm = ZFS_DELEG_PERM_USEROBJQUOTA;
	} else if (strncmp(propname, gq_prefix,
	strlen(gq_prefix)) == 0) {
	perm = ZFS_DELEG_PERM_GROUPQUOTA;
	} else if (strncmp(propname, giq_prefix,
	strlen(giq_prefix)) == 0) {
	perm = ZFS_DELEG_PERM_GROUPOBJQUOTA;
	} else if (strncmp(propname, pq_prefix,
	strlen(pq_prefix)) == 0) {
	perm = ZFS_DELEG_PERM_PROJECTQUOTA;
	} else if (strncmp(propname, piq_prefix,
	strlen(piq_prefix)) == 0) {
	perm = ZFS_DELEG_PERM_PROJECTOBJQUOTA;
	} else {
	/* {USER\|GROUP\|PROJECT}USED are read-only */
	return (SET_ERROR(EINVAL));
	}

	if ((err = zfs_secpolicy_write_perms(dsname, perm, cr)))
	return (err);
	return (0);
	}

	return (SET_ERROR(EINVAL));
	}

	if (issnap)
	return (SET_ERROR(EINVAL));

	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
	/*
	* dsl_prop_get_all_impl() returns properties in this
	* format.
	*/
	nvlist_t *attrs;
	VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
	VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
	&pair) == 0);
	}

	/*
	* Check that this value is valid for this pool version
	*/
	switch (prop) {
	case ZFS_PROP_COMPRESSION:
	/*
	* If the user specified gzip compression, make sure
	* the SPA supports it. We ignore any errors here since
	* we'll catch them later.
	*/
	if (nvpair_value_uint64(pair, &intval) == 0) {
	compval = ZIO_COMPRESS_ALGO(intval);
	if (compval >= ZIO_COMPRESS_GZIP_1 &&
	compval <= ZIO_COMPRESS_GZIP_9 &&
	zfs_earlier_version(dsname,
	SPA_VERSION_GZIP_COMPRESSION)) {
	return (SET_ERROR(ENOTSUP));
	}

	if (compval == ZIO_COMPRESS_ZLE &&
	zfs_earlier_version(dsname,
	SPA_VERSION_ZLE_COMPRESSION))
	return (SET_ERROR(ENOTSUP));

	if (compval == ZIO_COMPRESS_LZ4) {
	spa_t *spa;

	if ((err = spa_open(dsname, &spa, FTAG)) != 0)
	return (err);

	if (!spa_feature_is_enabled(spa,
	SPA_FEATURE_LZ4_COMPRESS)) {
	spa_close(spa, FTAG);
	return (SET_ERROR(ENOTSUP));
	}
	spa_close(spa, FTAG);
	}

	if (compval == ZIO_COMPRESS_ZSTD) {
	spa_t *spa;

	if ((err = spa_open(dsname, &spa, FTAG)) != 0)
	return (err);

	if (!spa_feature_is_enabled(spa,
	SPA_FEATURE_ZSTD_COMPRESS)) {
	spa_close(spa, FTAG);
	return (SET_ERROR(ENOTSUP));
	}
	spa_close(spa, FTAG);
	}
	}
	break;

	case ZFS_PROP_COPIES:
	if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
	return (SET_ERROR(ENOTSUP));
	break;

	case ZFS_PROP_VOLBLOCKSIZE:
	case ZFS_PROP_RECORDSIZE:
	/* Record sizes above 128k need the feature to be enabled */
	if (nvpair_value_uint64(pair, &intval) == 0 &&
	intval > SPA_OLD_MAXBLOCKSIZE) {
	spa_t *spa;

	/*
	* We don't allow setting the property above 1MB,
	* unless the tunable has been changed.
	*/
	if (intval > zfs_max_recordsize \|\|
	intval > SPA_MAXBLOCKSIZE)
	return (SET_ERROR(ERANGE));

	if ((err = spa_open(dsname, &spa, FTAG)) != 0)
	return (err);

	if (!spa_feature_is_enabled(spa,
	SPA_FEATURE_LARGE_BLOCKS)) {
	spa_close(spa, FTAG);
	return (SET_ERROR(ENOTSUP));
	}
	spa_close(spa, FTAG);
	}
	break;

	case ZFS_PROP_DNODESIZE:
	/* Dnode sizes above 512 need the feature to be enabled */
	if (nvpair_value_uint64(pair, &intval) == 0 &&
	intval != ZFS_DNSIZE_LEGACY) {
	spa_t *spa;

	if ((err = spa_open(dsname, &spa, FTAG)) != 0)
	return (err);

	if (!spa_feature_is_enabled(spa,
	SPA_FEATURE_LARGE_DNODE)) {
	spa_close(spa, FTAG);
	return (SET_ERROR(ENOTSUP));
	}
	spa_close(spa, FTAG);
	}
	break;

	case ZFS_PROP_SPECIAL_SMALL_BLOCKS:
	/*
	* This property could require the allocation classes
	* feature to be active for setting, however we allow
	* it so that tests of settable properties succeed.
	* The CLI will issue a warning in this case.
	*/
	break;

	case ZFS_PROP_SHARESMB:
	if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
	return (SET_ERROR(ENOTSUP));
	break;

	case ZFS_PROP_ACLINHERIT:
	if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
	nvpair_value_uint64(pair, &intval) == 0) {
	if (intval == ZFS_ACL_PASSTHROUGH_X &&
	zfs_earlier_version(dsname,
	SPA_VERSION_PASSTHROUGH_X))
	return (SET_ERROR(ENOTSUP));
	}
	break;
	case ZFS_PROP_CHECKSUM:
	case ZFS_PROP_DEDUP:
	{
	spa_feature_t feature;
	spa_t *spa;
	int err;

	/* dedup feature version checks */
	if (prop == ZFS_PROP_DEDUP &&
	zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
	return (SET_ERROR(ENOTSUP));

	if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
	nvpair_value_uint64(pair, &intval) == 0) {
	/* check prop value is enabled in features */
	feature = zio_checksum_to_feature(
	intval & ZIO_CHECKSUM_MASK);
	if (feature == SPA_FEATURE_NONE)
	break;

	if ((err = spa_open(dsname, &spa, FTAG)) != 0)
	return (err);

	if (!spa_feature_is_enabled(spa, feature)) {
	spa_close(spa, FTAG);
	return (SET_ERROR(ENOTSUP));
	}
	spa_close(spa, FTAG);
	}
	break;
	}

	default:
	break;
	}

	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
	}

	/*
	* Removes properties from the given props list that fail permission checks
	* needed to clear them and to restore them in case of a receive error. For each
	* property, make sure we have both set and inherit permissions.
	*
	* Returns the first error encountered if any permission checks fail. If the
	* caller provides a non-NULL errlist, it also gives the complete list of names
	* of all the properties that failed a permission check along with the
	* corresponding error numbers. The caller is responsible for freeing the
	* returned errlist.
	*
	* If every property checks out successfully, zero is returned and the list
	* pointed at by errlist is NULL.
	*/
	static int
	zfs_check_clearable(char dataset, nvlist_t props, nvlist_t **errlist)
	{
	zfs_cmd_t *zc;
	nvpair_t pair, next_pair;
	nvlist_t *errors;
	int err, rv = 0;

	if (props == NULL)
	return (0);

	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);

	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
	(void) strlcpy(zc->zc_name, dataset, sizeof (zc->zc_name));
	pair = nvlist_next_nvpair(props, NULL);
	while (pair != NULL) {
	next_pair = nvlist_next_nvpair(props, pair);

	(void) strlcpy(zc->zc_value, nvpair_name(pair),
	sizeof (zc->zc_value));
	if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 \|\|
	(err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
	VERIFY(nvlist_remove_nvpair(props, pair) == 0);
	VERIFY(nvlist_add_int32(errors,
	zc->zc_value, err) == 0);
	}
	pair = next_pair;
	}
	kmem_free(zc, sizeof (zfs_cmd_t));

	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
	nvlist_free(errors);
	errors = NULL;
	} else {
	VERIFY(nvpair_value_int32(pair, &rv) == 0);
	}

	if (errlist == NULL)
	nvlist_free(errors);
	else
	*errlist = errors;

	return (rv);
	}

	static boolean_t
	propval_equals(nvpair_t p1, nvpair_t p2)
	{
	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
	/* dsl_prop_get_all_impl() format */
	nvlist_t *attrs;
	VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
	VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
	&p1) == 0);
	}

	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
	nvlist_t *attrs;
	VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
	VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
	&p2) == 0);
	}

	if (nvpair_type(p1) != nvpair_type(p2))
	return (B_FALSE);

	if (nvpair_type(p1) == DATA_TYPE_STRING) {
	char valstr1, valstr2;

	VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
	VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
	return (strcmp(valstr1, valstr2) == 0);
	} else {
	uint64_t intval1, intval2;

	VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
	VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
	return (intval1 == intval2);
	}
	}

	/*
	* Remove properties from props if they are not going to change (as determined
	* by comparison with origprops). Remove them from origprops as well, since we
	* do not need to clear or restore properties that won't change.
	*/
	static void
	props_reduce(nvlist_t props, nvlist_t origprops)
	{
	nvpair_t pair, next_pair;

	if (origprops == NULL)
	return; /* all props need to be received */

	pair = nvlist_next_nvpair(props, NULL);
	while (pair != NULL) {
	const char *propname = nvpair_name(pair);
	nvpair_t *match;

	next_pair = nvlist_next_nvpair(props, pair);

	if ((nvlist_lookup_nvpair(origprops, propname,
	&match) != 0) \|\| !propval_equals(pair, match))
	goto next; /* need to set received value */

	/* don't clear the existing received value */
	(void) nvlist_remove_nvpair(origprops, match);
	/* don't bother receiving the property */
	(void) nvlist_remove_nvpair(props, pair);
	next:
	pair = next_pair;
	}
	}

	/*
	* Extract properties that cannot be set PRIOR to the receipt of a dataset.
	* For example, refquota cannot be set until after the receipt of a dataset,
	* because in replication streams, an older/earlier snapshot may exceed the
	* refquota. We want to receive the older/earlier snapshot, but setting
	* refquota pre-receipt will set the dsl's ACTUAL quota, which will prevent
	* the older/earlier snapshot from being received (with EDQUOT).
	*
	* The ZFS test "zfs_receive_011_pos" demonstrates such a scenario.
	*
	* libzfs will need to be judicious handling errors encountered by props
	* extracted by this function.
	*/
	static nvlist_t *
	extract_delay_props(nvlist_t *props)
	{
	nvlist_t *delayprops;
	nvpair_t nvp, tmp;
	static const zfs_prop_t delayable[] = {
	ZFS_PROP_REFQUOTA,
	ZFS_PROP_KEYLOCATION,
	0
	};
	int i;

	VERIFY(nvlist_alloc(&delayprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);

	for (nvp = nvlist_next_nvpair(props, NULL); nvp != NULL;
	nvp = nvlist_next_nvpair(props, nvp)) {
	/*
	* strcmp() is safe because zfs_prop_to_name() always returns
	* a bounded string.
	*/
	for (i = 0; delayable[i] != 0; i++) {
	if (strcmp(zfs_prop_to_name(delayable[i]),
	nvpair_name(nvp)) == 0) {
	break;
	}
	}
	if (delayable[i] != 0) {
	tmp = nvlist_prev_nvpair(props, nvp);
	VERIFY(nvlist_add_nvpair(delayprops, nvp) == 0);
	VERIFY(nvlist_remove_nvpair(props, nvp) == 0);
	nvp = tmp;
	}
	}

	if (nvlist_empty(delayprops)) {
	nvlist_free(delayprops);
	delayprops = NULL;
	}
	return (delayprops);
	}

	static void
	zfs_allow_log_destroy(void *arg)
	{
	char *poolname = arg;

	if (poolname != NULL)
	kmem_strfree(poolname);
	}

	#ifdef ZFS_DEBUG
	static boolean_t zfs_ioc_recv_inject_err;
	#endif

	/*
	* nvlist 'errors' is always allocated. It will contain descriptions of
	* encountered errors, if any. It's the callers responsibility to free.
	*/
	static int
	zfs_ioc_recv_impl(char tofs, char tosnap, char origin, nvlist_t recvprops,
	nvlist_t localprops, nvlist_t hidden_args, boolean_t force,
	boolean_t resumable, int input_fd,
	dmu_replay_record_t begin_record, uint64_t read_bytes,
	uint64_t errflags, nvlist_t *errors)
	{
	dmu_recv_cookie_t drc;
	int error = 0;
	int props_error = 0;
	offset_t off, noff;
	nvlist_t *local_delayprops = NULL;
	nvlist_t *recv_delayprops = NULL;
	nvlist_t origprops = NULL; / existing properties */
	nvlist_t origrecvd = NULL; / existing received properties */
	boolean_t first_recvd_props = B_FALSE;
	boolean_t tofs_was_redacted;
	zfs_file_t *input_fp;

	*read_bytes = 0;
	*errflags = 0;
	*errors = fnvlist_alloc();
	off = 0;

	if ((error = zfs_file_get(input_fd, &input_fp)))
	return (error);

	noff = off = zfs_file_off(input_fp);
	error = dmu_recv_begin(tofs, tosnap, begin_record, force,
	resumable, localprops, hidden_args, origin, &drc, input_fp,
	&off);
	if (error != 0)
	goto out;
	tofs_was_redacted = dsl_get_redacted(drc.drc_ds);

	/*
	* Set properties before we receive the stream so that they are applied
	* to the new data. Note that we must call dmu_recv_stream() if
	* dmu_recv_begin() succeeds.
	*/
	if (recvprops != NULL && !drc.drc_newfs) {
	if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
	SPA_VERSION_RECVD_PROPS &&
	!dsl_prop_get_hasrecvd(tofs))
	first_recvd_props = B_TRUE;

	/*
	* If new received properties are supplied, they are to
	* completely replace the existing received properties,
	* so stash away the existing ones.
	*/
	if (dsl_prop_get_received(tofs, &origrecvd) == 0) {
	nvlist_t *errlist = NULL;
	/*
	* Don't bother writing a property if its value won't
	* change (and avoid the unnecessary security checks).
	*
	* The first receive after SPA_VERSION_RECVD_PROPS is a
	* special case where we blow away all local properties
	* regardless.
	*/
	if (!first_recvd_props)
	props_reduce(recvprops, origrecvd);
	if (zfs_check_clearable(tofs, origrecvd, &errlist) != 0)
	(void) nvlist_merge(*errors, errlist, 0);
	nvlist_free(errlist);

	if (clear_received_props(tofs, origrecvd,
	first_recvd_props ? NULL : recvprops) != 0)
	*errflags \|= ZPROP_ERR_NOCLEAR;
	} else {
	*errflags \|= ZPROP_ERR_NOCLEAR;
	}
	}

	/*
	* Stash away existing properties so we can restore them on error unless
	* we're doing the first receive after SPA_VERSION_RECVD_PROPS, in which
	* case "origrecvd" will take care of that.
	*/
	if (localprops != NULL && !drc.drc_newfs && !first_recvd_props) {
	objset_t *os;
	if (dmu_objset_hold(tofs, FTAG, &os) == 0) {
	if (dsl_prop_get_all(os, &origprops) != 0) {
	*errflags \|= ZPROP_ERR_NOCLEAR;
	}
	dmu_objset_rele(os, FTAG);
	} else {
	*errflags \|= ZPROP_ERR_NOCLEAR;
	}
	}

	if (recvprops != NULL) {
	props_error = dsl_prop_set_hasrecvd(tofs);

	if (props_error == 0) {
	recv_delayprops = extract_delay_props(recvprops);
	(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
	recvprops, *errors);
	}
	}

	if (localprops != NULL) {
	nvlist_t *oprops = fnvlist_alloc();
	nvlist_t *xprops = fnvlist_alloc();
	nvpair_t *nvp = NULL;

	while ((nvp = nvlist_next_nvpair(localprops, nvp)) != NULL) {
	if (nvpair_type(nvp) == DATA_TYPE_BOOLEAN) {
	/* -x property */
	const char *name = nvpair_name(nvp);
	zfs_prop_t prop = zfs_name_to_prop(name);
	if (prop != ZPROP_INVAL) {
	if (!zfs_prop_inheritable(prop))
	continue;
	} else if (!zfs_prop_user(name))
	continue;
	fnvlist_add_boolean(xprops, name);
	} else {
	/* -o property=value */
	fnvlist_add_nvpair(oprops, nvp);
	}
	}

	local_delayprops = extract_delay_props(oprops);
	(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_LOCAL,
	oprops, *errors);
	(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_INHERITED,
	xprops, *errors);

	nvlist_free(oprops);
	nvlist_free(xprops);
	}

	error = dmu_recv_stream(&drc, &off);

	if (error == 0) {
	zfsvfs_t *zfsvfs = NULL;
	zvol_state_handle_t *zv = NULL;

	if (getzfsvfs(tofs, &zfsvfs) == 0) {
	/* online recv */
	dsl_dataset_t *ds;
	int end_err;
	boolean_t stream_is_redacted = DMU_GET_FEATUREFLAGS(
	begin_record->drr_u.drr_begin.
	drr_versioninfo) & DMU_BACKUP_FEATURE_REDACTED;

	ds = dmu_objset_ds(zfsvfs->z_os);
	error = zfs_suspend_fs(zfsvfs);
	/*
	* If the suspend fails, then the recv_end will
	* likely also fail, and clean up after itself.
	*/
	end_err = dmu_recv_end(&drc, zfsvfs);
	/*
	* If the dataset was not redacted, but we received a
	* redacted stream onto it, we need to unmount the
	* dataset. Otherwise, resume the filesystem.
	*/
	if (error == 0 && !drc.drc_newfs &&
	stream_is_redacted && !tofs_was_redacted) {
	error = zfs_end_fs(zfsvfs, ds);
	} else if (error == 0) {
	error = zfs_resume_fs(zfsvfs, ds);
	}
	error = error ? error : end_err;
	zfs_vfs_rele(zfsvfs);
	} else if ((zv = zvol_suspend(tofs)) != NULL) {
	error = dmu_recv_end(&drc, zvol_tag(zv));
	zvol_resume(zv);
	} else {
	error = dmu_recv_end(&drc, NULL);
	}

	/* Set delayed properties now, after we're done receiving. */
	if (recv_delayprops != NULL && error == 0) {
	(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
	recv_delayprops, *errors);
	}
	if (local_delayprops != NULL && error == 0) {
	(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_LOCAL,
	local_delayprops, *errors);
	}
	}

	/*
	* Merge delayed props back in with initial props, in case
	* we're DEBUG and zfs_ioc_recv_inject_err is set (which means
	* we have to make sure clear_received_props() includes
	* the delayed properties).
	*
	* Since zfs_ioc_recv_inject_err is only in DEBUG kernels,
	* using ASSERT() will be just like a VERIFY.
	*/
	if (recv_delayprops != NULL) {
	ASSERT(nvlist_merge(recvprops, recv_delayprops, 0) == 0);
	nvlist_free(recv_delayprops);
	}
	if (local_delayprops != NULL) {
	ASSERT(nvlist_merge(localprops, local_delayprops, 0) == 0);
	nvlist_free(local_delayprops);
	}
	*read_bytes = off - noff;

	#ifdef ZFS_DEBUG
	if (zfs_ioc_recv_inject_err) {
	zfs_ioc_recv_inject_err = B_FALSE;
	error = 1;
	}
	#endif

	/*
	* On error, restore the original props.
	*/
	if (error != 0 && recvprops != NULL && !drc.drc_newfs) {
	if (clear_received_props(tofs, recvprops, NULL) != 0) {
	/*
	* We failed to clear the received properties.
	* Since we may have left a $recvd value on the
	* system, we can't clear the $hasrecvd flag.
	*/
	*errflags \|= ZPROP_ERR_NORESTORE;
	} else if (first_recvd_props) {
	dsl_prop_unset_hasrecvd(tofs);
	}

	if (origrecvd == NULL && !drc.drc_newfs) {
	/* We failed to stash the original properties. */
	*errflags \|= ZPROP_ERR_NORESTORE;
	}

	/*
	* dsl_props_set() will not convert RECEIVED to LOCAL on or
	* after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
	* explicitly if we're restoring local properties cleared in the
	* first new-style receive.
	*/
	if (origrecvd != NULL &&
	zfs_set_prop_nvlist(tofs, (first_recvd_props ?
	ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
	origrecvd, NULL) != 0) {
	/*
	* We stashed the original properties but failed to
	* restore them.
	*/
	*errflags \|= ZPROP_ERR_NORESTORE;
	}
	}
	if (error != 0 && localprops != NULL && !drc.drc_newfs &&
	!first_recvd_props) {
	nvlist_t *setprops;
	nvlist_t *inheritprops;
	nvpair_t *nvp;

	if (origprops == NULL) {
	/* We failed to stash the original properties. */
	*errflags \|= ZPROP_ERR_NORESTORE;
	goto out;
	}

	/* Restore original props */
	setprops = fnvlist_alloc();
	inheritprops = fnvlist_alloc();
	nvp = NULL;
	while ((nvp = nvlist_next_nvpair(localprops, nvp)) != NULL) {
	const char *name = nvpair_name(nvp);
	const char *source;
	nvlist_t *attrs;

	if (!nvlist_exists(origprops, name)) {
	/*
	* Property was not present or was explicitly
	* inherited before the receive, restore this.
	*/
	fnvlist_add_boolean(inheritprops, name);
	continue;
	}
	attrs = fnvlist_lookup_nvlist(origprops, name);
	source = fnvlist_lookup_string(attrs, ZPROP_SOURCE);

	/* Skip received properties */
	if (strcmp(source, ZPROP_SOURCE_VAL_RECVD) == 0)
	continue;

	if (strcmp(source, tofs) == 0) {
	/* Property was locally set */
	fnvlist_add_nvlist(setprops, name, attrs);
	} else {
	/* Property was implicitly inherited */
	fnvlist_add_boolean(inheritprops, name);
	}
	}

	if (zfs_set_prop_nvlist(tofs, ZPROP_SRC_LOCAL, setprops,
	NULL) != 0)
	*errflags \|= ZPROP_ERR_NORESTORE;
	if (zfs_set_prop_nvlist(tofs, ZPROP_SRC_INHERITED, inheritprops,
	NULL) != 0)
	*errflags \|= ZPROP_ERR_NORESTORE;

	nvlist_free(setprops);
	nvlist_free(inheritprops);
	}
	out:
	zfs_file_put(input_fd);
	nvlist_free(origrecvd);
	nvlist_free(origprops);

	if (error == 0)
	error = props_error;

	return (error);
	}

	/*
	* inputs:
	* zc_name name of containing filesystem (unused)
	* zc_nvlist_src{_size} nvlist of properties to apply
	* zc_nvlist_conf{_size} nvlist of properties to exclude
	* (DATA_TYPE_BOOLEAN) and override (everything else)
	* zc_value name of snapshot to create
	* zc_string name of clone origin (if DRR_FLAG_CLONE)
	* zc_cookie file descriptor to recv from
	* zc_begin_record the BEGIN record of the stream (not byteswapped)
	* zc_guid force flag
	*
	* outputs:
	* zc_cookie number of bytes read
	* zc_obj zprop_errflags_t
	* zc_nvlist_dst{_size} error for each unapplied received property
	*/
	static int
	zfs_ioc_recv(zfs_cmd_t *zc)
	{
	dmu_replay_record_t begin_record;
	nvlist_t *errors = NULL;
	nvlist_t *recvdprops = NULL;
	nvlist_t *localprops = NULL;
	char *origin = NULL;
	char *tosnap;
	char tofs[ZFS_MAX_DATASET_NAME_LEN];
	int error = 0;

	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 \|\|
	strchr(zc->zc_value, '@') == NULL \|\|
	strchr(zc->zc_value, '%'))
	return (SET_ERROR(EINVAL));

	(void) strlcpy(tofs, zc->zc_value, sizeof (tofs));
	tosnap = strchr(tofs, '@');
	*tosnap++ = '\0';

	if (zc->zc_nvlist_src != 0 &&
	(error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &recvdprops)) != 0)
	return (error);

	if (zc->zc_nvlist_conf != 0 &&
	(error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
	zc->zc_iflags, &localprops)) != 0)
	return (error);

	if (zc->zc_string[0])
	origin = zc->zc_string;

	begin_record.drr_type = DRR_BEGIN;
	begin_record.drr_payloadlen = 0;
	begin_record.drr_u.drr_begin = zc->zc_begin_record;

	error = zfs_ioc_recv_impl(tofs, tosnap, origin, recvdprops, localprops,
	NULL, zc->zc_guid, B_FALSE, zc->zc_cookie, &begin_record,
	&zc->zc_cookie, &zc->zc_obj, &errors);
	nvlist_free(recvdprops);
	nvlist_free(localprops);

	/*
	* Now that all props, initial and delayed, are set, report the prop
	* errors to the caller.
	*/
	if (zc->zc_nvlist_dst_size != 0 && errors != NULL &&
	(nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 \|\|
	put_nvlist(zc, errors) != 0)) {
	/*
	* Caller made zc->zc_nvlist_dst less than the minimum expected
	* size or supplied an invalid address.
	*/
	error = SET_ERROR(EINVAL);
	}

	nvlist_free(errors);

	return (error);
	}

	/*
	* innvl: {
	* "snapname" -> full name of the snapshot to create
	* (optional) "props" -> received properties to set (nvlist)
	* (optional) "localprops" -> override and exclude properties (nvlist)
	* (optional) "origin" -> name of clone origin (DRR_FLAG_CLONE)
	* "begin_record" -> non-byteswapped dmu_replay_record_t
	* "input_fd" -> file descriptor to read stream from (int32)
	* (optional) "force" -> force flag (value ignored)
	* (optional) "resumable" -> resumable flag (value ignored)
	* (optional) "cleanup_fd" -> unused
	* (optional) "action_handle" -> unused
	* (optional) "hidden_args" -> { "wkeydata" -> value }
	* }
	*
	* outnvl: {
	* "read_bytes" -> number of bytes read
	* "error_flags" -> zprop_errflags_t
	* "errors" -> error for each unapplied received property (nvlist)
	* }
	*/
	static const zfs_ioc_key_t zfs_keys_recv_new[] = {
	{"snapname", DATA_TYPE_STRING, 0},
	{"props", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	{"localprops", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	{"origin", DATA_TYPE_STRING, ZK_OPTIONAL},
	{"begin_record", DATA_TYPE_BYTE_ARRAY, 0},
	{"input_fd", DATA_TYPE_INT32, 0},
	{"force", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"resumable", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"cleanup_fd", DATA_TYPE_INT32, ZK_OPTIONAL},
	{"action_handle", DATA_TYPE_UINT64, ZK_OPTIONAL},
	{"hidden_args", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	};

	static int
	zfs_ioc_recv_new(const char fsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	dmu_replay_record_t *begin_record;
	uint_t begin_record_size;
	nvlist_t *errors = NULL;
	nvlist_t *recvprops = NULL;
	nvlist_t *localprops = NULL;
	nvlist_t *hidden_args = NULL;
	char *snapname;
	char *origin = NULL;
	char *tosnap;
	char tofs[ZFS_MAX_DATASET_NAME_LEN];
	boolean_t force;
	boolean_t resumable;
	uint64_t read_bytes = 0;
	uint64_t errflags = 0;
	int input_fd = -1;
	int error;

	snapname = fnvlist_lookup_string(innvl, "snapname");

	if (dataset_namecheck(snapname, NULL, NULL) != 0 \|\|
	strchr(snapname, '@') == NULL \|\|
	strchr(snapname, '%'))
	return (SET_ERROR(EINVAL));

	(void) strlcpy(tofs, snapname, sizeof (tofs));
	tosnap = strchr(tofs, '@');
	*tosnap++ = '\0';

	error = nvlist_lookup_string(innvl, "origin", &origin);
	if (error && error != ENOENT)
	return (error);

	error = nvlist_lookup_byte_array(innvl, "begin_record",
	(uchar_t **)&begin_record, &begin_record_size);
	if (error != 0 \|\| begin_record_size != sizeof (*begin_record))
	return (SET_ERROR(EINVAL));

	input_fd = fnvlist_lookup_int32(innvl, "input_fd");

	force = nvlist_exists(innvl, "force");
	resumable = nvlist_exists(innvl, "resumable");

	/* we still use "props" here for backwards compatibility */
	error = nvlist_lookup_nvlist(innvl, "props", &recvprops);
	if (error && error != ENOENT)
	return (error);

	error = nvlist_lookup_nvlist(innvl, "localprops", &localprops);
	if (error && error != ENOENT)
	return (error);

	error = nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);
	if (error && error != ENOENT)
	return (error);

	error = zfs_ioc_recv_impl(tofs, tosnap, origin, recvprops, localprops,
	hidden_args, force, resumable, input_fd, begin_record,
	&read_bytes, &errflags, &errors);

	fnvlist_add_uint64(outnvl, "read_bytes", read_bytes);
	fnvlist_add_uint64(outnvl, "error_flags", errflags);
	fnvlist_add_nvlist(outnvl, "errors", errors);

	nvlist_free(errors);
	nvlist_free(recvprops);
	nvlist_free(localprops);

	return (error);
	}

	typedef struct dump_bytes_io {
	zfs_file_t *dbi_fp;
	caddr_t dbi_buf;
	int dbi_len;
	int dbi_err;
	} dump_bytes_io_t;

	static void
	dump_bytes_cb(void *arg)
	{
	dump_bytes_io_t dbi = (dump_bytes_io_t )arg;
	zfs_file_t *fp;
	caddr_t buf;

	fp = dbi->dbi_fp;
	buf = dbi->dbi_buf;

	dbi->dbi_err = zfs_file_write(fp, buf, dbi->dbi_len, NULL);
	}

	static int
	dump_bytes(objset_t os, void buf, int len, void *arg)
	{
	dump_bytes_io_t dbi;

	dbi.dbi_fp = arg;
	dbi.dbi_buf = buf;
	dbi.dbi_len = len;

	#if defined(HAVE_LARGE_STACKS)
	dump_bytes_cb(&dbi);
	#else
	/*
	* The vn_rdwr() call is performed in a taskq to ensure that there is
	* always enough stack space to write safely to the target filesystem.
	* The ZIO_TYPE_FREE threads are used because there can be a lot of
	* them and they are used in vdev_file.c for a similar purpose.
	*/
	spa_taskq_dispatch_sync(dmu_objset_spa(os), ZIO_TYPE_FREE,
	ZIO_TASKQ_ISSUE, dump_bytes_cb, &dbi, TQ_SLEEP);
	#endif /* HAVE_LARGE_STACKS */

	return (dbi.dbi_err);
	}

	/*
	* inputs:
	* zc_name name of snapshot to send
	* zc_cookie file descriptor to send stream to
	* zc_obj fromorigin flag (mutually exclusive with zc_fromobj)
	* zc_sendobj objsetid of snapshot to send
	* zc_fromobj objsetid of incremental fromsnap (may be zero)
	* zc_guid if set, estimate size of stream only. zc_cookie is ignored.
	* output size in zc_objset_type.
	* zc_flags lzc_send_flags
	*
	* outputs:
	* zc_objset_type estimated size, if zc_guid is set
	*
	* NOTE: This is no longer the preferred interface, any new functionality
	* should be added to zfs_ioc_send_new() instead.
	*/
	static int
	zfs_ioc_send(zfs_cmd_t *zc)
	{
	int error;
	offset_t off;
	boolean_t estimate = (zc->zc_guid != 0);
	boolean_t embedok = (zc->zc_flags & 0x1);
	boolean_t large_block_ok = (zc->zc_flags & 0x2);
	boolean_t compressok = (zc->zc_flags & 0x4);
	boolean_t rawok = (zc->zc_flags & 0x8);
	boolean_t savedok = (zc->zc_flags & 0x10);

	if (zc->zc_obj != 0) {
	dsl_pool_t *dp;
	dsl_dataset_t *tosnap;

	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	if (dsl_dir_is_clone(tosnap->ds_dir))
	zc->zc_fromobj =
	dsl_dir_phys(tosnap->ds_dir)->dd_origin_obj;
	dsl_dataset_rele(tosnap, FTAG);
	dsl_pool_rele(dp, FTAG);
	}

	if (estimate) {
	dsl_pool_t *dp;
	dsl_dataset_t *tosnap;
	dsl_dataset_t *fromsnap = NULL;

	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj,
	FTAG, &tosnap);
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	if (zc->zc_fromobj != 0) {
	error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
	FTAG, &fromsnap);
	if (error != 0) {
	dsl_dataset_rele(tosnap, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}
	}

	error = dmu_send_estimate_fast(tosnap, fromsnap, NULL,
	compressok \|\| rawok, savedok, &zc->zc_objset_type);

	if (fromsnap != NULL)
	dsl_dataset_rele(fromsnap, FTAG);
	dsl_dataset_rele(tosnap, FTAG);
	dsl_pool_rele(dp, FTAG);
	} else {
	zfs_file_t *fp;
	dmu_send_outparams_t out = {0};

	if ((error = zfs_file_get(zc->zc_cookie, &fp)))
	return (error);

	off = zfs_file_off(fp);
	out.dso_outfunc = dump_bytes;
	out.dso_arg = fp;
	out.dso_dryrun = B_FALSE;
	error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
	zc->zc_fromobj, embedok, large_block_ok, compressok,
	rawok, savedok, zc->zc_cookie, &off, &out);

	zfs_file_put(zc->zc_cookie);
	}
	return (error);
	}

	/*
	* inputs:
	* zc_name name of snapshot on which to report progress
	* zc_cookie file descriptor of send stream
	*
	* outputs:
	* zc_cookie number of bytes written in send stream thus far
	* zc_objset_type logical size of data traversed by send thus far
	*/
	static int
	zfs_ioc_send_progress(zfs_cmd_t *zc)
	{
	dsl_pool_t *dp;
	dsl_dataset_t *ds;
	dmu_sendstatus_t *dsp = NULL;
	int error;

	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	mutex_enter(&ds->ds_sendstream_lock);

	/*
	* Iterate over all the send streams currently active on this dataset.
	* If there's one which matches the specified file descriptor _and_ the
	* stream was started by the current process, return the progress of
	* that stream.
	*/

	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
	dsp = list_next(&ds->ds_sendstreams, dsp)) {
	if (dsp->dss_outfd == zc->zc_cookie &&
	zfs_proc_is_caller(dsp->dss_proc))
	break;
	}

	if (dsp != NULL) {
	zc->zc_cookie = atomic_cas_64((volatile uint64_t *)dsp->dss_off,
	0, 0);
	/* This is the closest thing we have to atomic_read_64. */
	zc->zc_objset_type = atomic_cas_64(&dsp->dss_blocks, 0, 0);
	} else {
	error = SET_ERROR(ENOENT);
	}

	mutex_exit(&ds->ds_sendstream_lock);
	dsl_dataset_rele(ds, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	static int
	zfs_ioc_inject_fault(zfs_cmd_t *zc)
	{
	int id, error;

	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
	&zc->zc_inject_record);

	if (error == 0)
	zc->zc_guid = (uint64_t)id;

	return (error);
	}

	static int
	zfs_ioc_clear_fault(zfs_cmd_t *zc)
	{
	return (zio_clear_fault((int)zc->zc_guid));
	}

	static int
	zfs_ioc_inject_list_next(zfs_cmd_t *zc)
	{
	int id = (int)zc->zc_guid;
	int error;

	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
	&zc->zc_inject_record);

	zc->zc_guid = id;

	return (error);
	}

	static int
	zfs_ioc_error_log(zfs_cmd_t *zc)
	{
	spa_t *spa;
	int error;
	size_t count = (size_t)zc->zc_nvlist_dst_size;

	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
	return (error);

	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
	&count);
	if (error == 0)
	zc->zc_nvlist_dst_size = count;
	else
	zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);

	spa_close(spa, FTAG);

	return (error);
	}

	static int
	zfs_ioc_clear(zfs_cmd_t *zc)
	{
	spa_t *spa;
	vdev_t *vd;
	int error;

	/*
	* On zpool clear we also fix up missing slogs
	*/
	mutex_enter(&spa_namespace_lock);
	spa = spa_lookup(zc->zc_name);
	if (spa == NULL) {
	mutex_exit(&spa_namespace_lock);
	return (SET_ERROR(EIO));
	}
	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
	/* we need to let spa_open/spa_load clear the chains */
	spa_set_log_state(spa, SPA_LOG_CLEAR);
	}
	spa->spa_last_open_failed = 0;
	mutex_exit(&spa_namespace_lock);

	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
	error = spa_open(zc->zc_name, &spa, FTAG);
	} else {
	nvlist_t *policy;
	nvlist_t *config = NULL;

	if (zc->zc_nvlist_src == 0)
	return (SET_ERROR(EINVAL));

	if ((error = get_nvlist(zc->zc_nvlist_src,
	zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
	error = spa_open_rewind(zc->zc_name, &spa, FTAG,
	policy, &config);
	if (config != NULL) {
	int err;

	if ((err = put_nvlist(zc, config)) != 0)
	error = err;
	nvlist_free(config);
	}
	nvlist_free(policy);
	}
	}

	if (error != 0)
	return (error);

	/*
	* If multihost is enabled, resuming I/O is unsafe as another
	* host may have imported the pool.
	*/
	if (spa_multihost(spa) && spa_suspended(spa))
	return (SET_ERROR(EINVAL));

	spa_vdev_state_enter(spa, SCL_NONE);

	if (zc->zc_guid == 0) {
	vd = NULL;
	} else {
	vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
	if (vd == NULL) {
	error = SET_ERROR(ENODEV);
	(void) spa_vdev_state_exit(spa, NULL, error);
	spa_close(spa, FTAG);
	return (error);
	}
	}

	vdev_clear(spa, vd);

	(void) spa_vdev_state_exit(spa, spa_suspended(spa) ?
	NULL : spa->spa_root_vdev, 0);

	/*
	* Resume any suspended I/Os.
	*/
	if (zio_resume(spa) != 0)
	error = SET_ERROR(EIO);

	spa_close(spa, FTAG);

	return (error);
	}

	/*
	* Reopen all the vdevs associated with the pool.
	*
	* innvl: {
	* "scrub_restart" -> when true and scrub is running, allow to restart
	* scrub as the side effect of the reopen (boolean).
	* }
	*
	* outnvl is unused
	*/
	static const zfs_ioc_key_t zfs_keys_pool_reopen[] = {
	{"scrub_restart", DATA_TYPE_BOOLEAN_VALUE, ZK_OPTIONAL},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_pool_reopen(const char pool, nvlist_t innvl, nvlist_t *outnvl)
	{
	spa_t *spa;
	int error;
	boolean_t rc, scrub_restart = B_TRUE;

	if (innvl) {
	error = nvlist_lookup_boolean_value(innvl,
	"scrub_restart", &rc);
	if (error == 0)
	scrub_restart = rc;
	}

	error = spa_open(pool, &spa, FTAG);
	if (error != 0)
	return (error);

	spa_vdev_state_enter(spa, SCL_NONE);

	/*
	* If the scrub_restart flag is B_FALSE and a scrub is already
	* in progress then set spa_scrub_reopen flag to B_TRUE so that
	* we don't restart the scrub as a side effect of the reopen.
	* Otherwise, let vdev_open() decided if a resilver is required.
	*/

	spa->spa_scrub_reopen = (!scrub_restart &&
	dsl_scan_scrubbing(spa->spa_dsl_pool));
	vdev_reopen(spa->spa_root_vdev);
	spa->spa_scrub_reopen = B_FALSE;

	(void) spa_vdev_state_exit(spa, NULL, 0);
	spa_close(spa, FTAG);
	return (0);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	*
	* outputs:
	* zc_string name of conflicting snapshot, if there is one
	*/
	static int
	zfs_ioc_promote(zfs_cmd_t *zc)
	{
	dsl_pool_t *dp;
	dsl_dataset_t ds, ods;
	char origin[ZFS_MAX_DATASET_NAME_LEN];
	char *cp;
	int error;

	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
	if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0 \|\|
	strchr(zc->zc_name, '%'))
	return (SET_ERROR(EINVAL));

	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	if (!dsl_dir_is_clone(ds->ds_dir)) {
	dsl_dataset_rele(ds, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (SET_ERROR(EINVAL));
	}

	error = dsl_dataset_hold_obj(dp,
	dsl_dir_phys(ds->ds_dir)->dd_origin_obj, FTAG, &ods);
	if (error != 0) {
	dsl_dataset_rele(ds, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	dsl_dataset_name(ods, origin);
	dsl_dataset_rele(ods, FTAG);
	dsl_dataset_rele(ds, FTAG);
	dsl_pool_rele(dp, FTAG);

	/*
	* We don't need to unmount all the origin fs's snapshots, but
	* it's easier.
	*/
	cp = strchr(origin, '@');
	if (cp)
	*cp = '\0';
	(void) dmu_objset_find(origin,
	zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
	}

	/*
	* Retrieve a single {user\|group\|project}{used\|quota}@... property.
	*
	* inputs:
	* zc_name name of filesystem
	* zc_objset_type zfs_userquota_prop_t
	* zc_value domain name (eg. "S-1-234-567-89")
	* zc_guid RID/UID/GID
	*
	* outputs:
	* zc_cookie property value
	*/
	static int
	zfs_ioc_userspace_one(zfs_cmd_t *zc)
	{
	zfsvfs_t *zfsvfs;
	int error;

	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
	return (SET_ERROR(EINVAL));

	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
	if (error != 0)
	return (error);

	error = zfs_userspace_one(zfsvfs,
	zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
	zfsvfs_rele(zfsvfs, FTAG);

	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_cookie zap cursor
	* zc_objset_type zfs_userquota_prop_t
	* zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
	*
	* outputs:
	* zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t)
	* zc_cookie zap cursor
	*/
	static int
	zfs_ioc_userspace_many(zfs_cmd_t *zc)
	{
	zfsvfs_t *zfsvfs;
	int bufsize = zc->zc_nvlist_dst_size;

	if (bufsize <= 0)
	return (SET_ERROR(ENOMEM));

	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
	if (error != 0)
	return (error);

	void *buf = vmem_alloc(bufsize, KM_SLEEP);

	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
	buf, &zc->zc_nvlist_dst_size);

	if (error == 0) {
	error = xcopyout(buf,
	(void *)(uintptr_t)zc->zc_nvlist_dst,
	zc->zc_nvlist_dst_size);
	}
	vmem_free(buf, bufsize);
	zfsvfs_rele(zfsvfs, FTAG);

	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	*
	* outputs:
	* none
	*/
	static int
	zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
	{
	objset_t *os;
	int error = 0;
	zfsvfs_t *zfsvfs;

	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
	if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
	/*
	* If userused is not enabled, it may be because the
	* objset needs to be closed & reopened (to grow the
	* objset_phys_t). Suspend/resume the fs will do that.
	*/
	dsl_dataset_t ds, newds;

	ds = dmu_objset_ds(zfsvfs->z_os);
	error = zfs_suspend_fs(zfsvfs);
	if (error == 0) {
	dmu_objset_refresh_ownership(ds, &newds,
	B_TRUE, zfsvfs);
	error = zfs_resume_fs(zfsvfs, newds);
	}
	}
	if (error == 0)
	error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
	zfs_vfs_rele(zfsvfs);
	} else {
	/* XXX kind of reading contents without owning */
	error = dmu_objset_hold_flags(zc->zc_name, B_TRUE, FTAG, &os);
	if (error != 0)
	return (error);

	error = dmu_objset_userspace_upgrade(os);
	dmu_objset_rele_flags(os, B_TRUE, FTAG);
	}

	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	*
	* outputs:
	* none
	*/
	static int
	zfs_ioc_id_quota_upgrade(zfs_cmd_t *zc)
	{
	objset_t *os;
	int error;

	error = dmu_objset_hold_flags(zc->zc_name, B_TRUE, FTAG, &os);
	if (error != 0)
	return (error);

	if (dmu_objset_userobjspace_upgradable(os) \|\|
	dmu_objset_projectquota_upgradable(os)) {
	mutex_enter(&os->os_upgrade_lock);
	if (os->os_upgrade_id == 0) {
	/* clear potential error code and retry */
	os->os_upgrade_status = 0;
	mutex_exit(&os->os_upgrade_lock);

	dmu_objset_id_quota_upgrade(os);
	} else {
	mutex_exit(&os->os_upgrade_lock);
	}

	dsl_pool_rele(dmu_objset_pool(os), FTAG);

	taskq_wait_id(os->os_spa->spa_upgrade_taskq, os->os_upgrade_id);
	error = os->os_upgrade_status;
	} else {
	dsl_pool_rele(dmu_objset_pool(os), FTAG);
	}

	dsl_dataset_rele_flags(dmu_objset_ds(os), DS_HOLD_FLAG_DECRYPT, FTAG);

	return (error);
	}

	static int
	zfs_ioc_share(zfs_cmd_t *zc)
	{
	return (SET_ERROR(ENOSYS));
	}

	ace_t full_access[] = {
	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
	};

	/*
	* inputs:
	* zc_name name of containing filesystem
	* zc_obj object # beyond which we want next in-use object #
	*
	* outputs:
	* zc_obj next in-use object #
	*/
	static int
	zfs_ioc_next_obj(zfs_cmd_t *zc)
	{
	objset_t *os = NULL;
	int error;

	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
	if (error != 0)
	return (error);

	error = dmu_object_next(os, &zc->zc_obj, B_FALSE, 0);

	dmu_objset_rele(os, FTAG);
	return (error);
	}

	/*
	* inputs:
	* zc_name name of filesystem
	* zc_value prefix name for snapshot
	* zc_cleanup_fd cleanup-on-exit file descriptor for calling process
	*
	* outputs:
	* zc_value short name of new snapshot
	*/
	static int
	zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
	{
	char *snap_name;
	char *hold_name;
	int error;
	minor_t minor;

	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
	if (error != 0)
	return (error);

	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
	(u_longlong_t)ddi_get_lbolt64());
	hold_name = kmem_asprintf("%%%s", zc->zc_value);

	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
	hold_name);
	if (error == 0)
	(void) strlcpy(zc->zc_value, snap_name,
	sizeof (zc->zc_value));
	kmem_strfree(snap_name);
	kmem_strfree(hold_name);
	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
	return (error);
	}

	/*
	* inputs:
	* zc_name name of "to" snapshot
	* zc_value name of "from" snapshot
	* zc_cookie file descriptor to write diff data on
	*
	* outputs:
	* dmu_diff_record_t's to the file descriptor
	*/
	static int
	zfs_ioc_diff(zfs_cmd_t *zc)
	{
	zfs_file_t *fp;
	offset_t off;
	int error;

	if ((error = zfs_file_get(zc->zc_cookie, &fp)))
	return (error);

	off = zfs_file_off(fp);
	error = dmu_diff(zc->zc_name, zc->zc_value, fp, &off);

	zfs_file_put(zc->zc_cookie);

	return (error);
	}

	static int
	zfs_ioc_smb_acl(zfs_cmd_t *zc)
	{
	return (SET_ERROR(ENOTSUP));
	}

	/*
	* innvl: {
	* "holds" -> { snapname -> holdname (string), ... }
	* (optional) "cleanup_fd" -> fd (int32)
	* }
	*
	* outnvl: {
	* snapname -> error value (int32)
	* ...
	* }
	*/
	static const zfs_ioc_key_t zfs_keys_hold[] = {
	{"holds", DATA_TYPE_NVLIST, 0},
	{"cleanup_fd", DATA_TYPE_INT32, ZK_OPTIONAL},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_hold(const char pool, nvlist_t args, nvlist_t *errlist)
	{
	nvpair_t *pair;
	nvlist_t *holds;
	int cleanup_fd = -1;
	int error;
	minor_t minor = 0;

	holds = fnvlist_lookup_nvlist(args, "holds");

	/* make sure the user didn't pass us any invalid (empty) tags */
	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
	pair = nvlist_next_nvpair(holds, pair)) {
	char *htag;

	error = nvpair_value_string(pair, &htag);
	if (error != 0)
	return (SET_ERROR(error));

	if (strlen(htag) == 0)
	return (SET_ERROR(EINVAL));
	}

	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
	error = zfs_onexit_fd_hold(cleanup_fd, &minor);
	if (error != 0)
	return (SET_ERROR(error));
	}

	error = dsl_dataset_user_hold(holds, minor, errlist);
	if (minor != 0)
	zfs_onexit_fd_rele(cleanup_fd);
	return (SET_ERROR(error));
	}

	/*
	* innvl is not used.
	*
	* outnvl: {
	* holdname -> time added (uint64 seconds since epoch)
	* ...
	* }
	*/
	static const zfs_ioc_key_t zfs_keys_get_holds[] = {
	/* no nvl keys */
	};

	/* ARGSUSED */
	static int
	zfs_ioc_get_holds(const char snapname, nvlist_t args, nvlist_t *outnvl)
	{
	return (dsl_dataset_get_holds(snapname, outnvl));
	}

	/*
	* innvl: {
	* snapname -> { holdname, ... }
	* ...
	* }
	*
	* outnvl: {
	* snapname -> error value (int32)
	* ...
	* }
	*/
	static const zfs_ioc_key_t zfs_keys_release[] = {
	{"<snapname>...", DATA_TYPE_NVLIST, ZK_WILDCARDLIST},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_release(const char pool, nvlist_t holds, nvlist_t *errlist)
	{
	return (dsl_dataset_user_release(holds, errlist));
	}

	/*
	* inputs:
	* zc_guid flags (ZEVENT_NONBLOCK)
	* zc_cleanup_fd zevent file descriptor
	*
	* outputs:
	* zc_nvlist_dst next nvlist event
	* zc_cookie dropped events since last get
	*/
	static int
	zfs_ioc_events_next(zfs_cmd_t *zc)
	{
	zfs_zevent_t *ze;
	nvlist_t *event = NULL;
	minor_t minor;
	uint64_t dropped = 0;
	int error;

	error = zfs_zevent_fd_hold(zc->zc_cleanup_fd, &minor, &ze);
	if (error != 0)
	return (error);

	do {
	error = zfs_zevent_next(ze, &event,
	&zc->zc_nvlist_dst_size, &dropped);
	if (event != NULL) {
	zc->zc_cookie = dropped;
	error = put_nvlist(zc, event);
	nvlist_free(event);
	}

	if (zc->zc_guid & ZEVENT_NONBLOCK)
	break;

	if ((error == 0) \|\| (error != ENOENT))
	break;

	error = zfs_zevent_wait(ze);
	if (error != 0)
	break;
	} while (1);

	zfs_zevent_fd_rele(zc->zc_cleanup_fd);

	return (error);
	}

	/*
	* outputs:
	* zc_cookie cleared events count
	*/
	static int
	zfs_ioc_events_clear(zfs_cmd_t *zc)
	{
	int count;

	zfs_zevent_drain_all(&count);
	zc->zc_cookie = count;

	return (0);
	}

	/*
	* inputs:
	* zc_guid eid \| ZEVENT_SEEK_START \| ZEVENT_SEEK_END
	* zc_cleanup zevent file descriptor
	*/
	static int
	zfs_ioc_events_seek(zfs_cmd_t *zc)
	{
	zfs_zevent_t *ze;
	minor_t minor;
	int error;

	error = zfs_zevent_fd_hold(zc->zc_cleanup_fd, &minor, &ze);
	if (error != 0)
	return (error);

	error = zfs_zevent_seek(ze, zc->zc_guid);
	zfs_zevent_fd_rele(zc->zc_cleanup_fd);

	return (error);
	}

	/*
	* inputs:
	* zc_name name of later filesystem or snapshot
	* zc_value full name of old snapshot or bookmark
	*
	* outputs:
	* zc_cookie space in bytes
	* zc_objset_type compressed space in bytes
	* zc_perm_action uncompressed space in bytes
	*/
	static int
	zfs_ioc_space_written(zfs_cmd_t *zc)
	{
	int error;
	dsl_pool_t *dp;
	dsl_dataset_t *new;

	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
	if (error != 0)
	return (error);
	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}
	if (strchr(zc->zc_value, '#') != NULL) {
	zfs_bookmark_phys_t bmp;
	error = dsl_bookmark_lookup(dp, zc->zc_value,
	new, &bmp);
	if (error == 0) {
	error = dsl_dataset_space_written_bookmark(&bmp, new,
	&zc->zc_cookie,
	&zc->zc_objset_type, &zc->zc_perm_action);
	}
	} else {
	dsl_dataset_t *old;
	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);

	if (error == 0) {
	error = dsl_dataset_space_written(old, new,
	&zc->zc_cookie,
	&zc->zc_objset_type, &zc->zc_perm_action);
	dsl_dataset_rele(old, FTAG);
	}
	}
	dsl_dataset_rele(new, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	/*
	* innvl: {
	* "firstsnap" -> snapshot name
	* }
	*
	* outnvl: {
	* "used" -> space in bytes
	* "compressed" -> compressed space in bytes
	* "uncompressed" -> uncompressed space in bytes
	* }
	*/
	static const zfs_ioc_key_t zfs_keys_space_snaps[] = {
	{"firstsnap", DATA_TYPE_STRING, 0},
	};

	static int
	zfs_ioc_space_snaps(const char lastsnap, nvlist_t innvl, nvlist_t *outnvl)
	{
	int error;
	dsl_pool_t *dp;
	dsl_dataset_t new, old;
	char *firstsnap;
	uint64_t used, comp, uncomp;

	firstsnap = fnvlist_lookup_string(innvl, "firstsnap");

	error = dsl_pool_hold(lastsnap, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
	if (error == 0 && !new->ds_is_snapshot) {
	dsl_dataset_rele(new, FTAG);
	error = SET_ERROR(EINVAL);
	}
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}
	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
	if (error == 0 && !old->ds_is_snapshot) {
	dsl_dataset_rele(old, FTAG);
	error = SET_ERROR(EINVAL);
	}
	if (error != 0) {
	dsl_dataset_rele(new, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
	dsl_dataset_rele(old, FTAG);
	dsl_dataset_rele(new, FTAG);
	dsl_pool_rele(dp, FTAG);
	fnvlist_add_uint64(outnvl, "used", used);
	fnvlist_add_uint64(outnvl, "compressed", comp);
	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
	return (error);
	}

	/*
	* innvl: {
	* "fd" -> file descriptor to write stream to (int32)
	* (optional) "fromsnap" -> full snap name to send an incremental from
	* (optional) "largeblockok" -> (value ignored)
	* indicates that blocks > 128KB are permitted
	* (optional) "embedok" -> (value ignored)
	* presence indicates DRR_WRITE_EMBEDDED records are permitted
	* (optional) "compressok" -> (value ignored)
	* presence indicates compressed DRR_WRITE records are permitted
	* (optional) "rawok" -> (value ignored)
	* presence indicates raw encrypted records should be used.
	* (optional) "savedok" -> (value ignored)
	* presence indicates we should send a partially received snapshot
	* (optional) "resume_object" and "resume_offset" -> (uint64)
	* if present, resume send stream from specified object and offset.
	* (optional) "redactbook" -> (string)
	* if present, use this bookmark's redaction list to generate a redacted
	* send stream
	* }
	*
	* outnvl is unused
	*/
	static const zfs_ioc_key_t zfs_keys_send_new[] = {
	{"fd", DATA_TYPE_INT32, 0},
	{"fromsnap", DATA_TYPE_STRING, ZK_OPTIONAL},
	{"largeblockok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"embedok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"compressok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"rawok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"savedok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"resume_object", DATA_TYPE_UINT64, ZK_OPTIONAL},
	{"resume_offset", DATA_TYPE_UINT64, ZK_OPTIONAL},
	{"redactbook", DATA_TYPE_STRING, ZK_OPTIONAL},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_send_new(const char snapname, nvlist_t innvl, nvlist_t *outnvl)
	{
	int error;
	offset_t off;
	char *fromname = NULL;
	int fd;
	zfs_file_t *fp;
	boolean_t largeblockok;
	boolean_t embedok;
	boolean_t compressok;
	boolean_t rawok;
	boolean_t savedok;
	uint64_t resumeobj = 0;
	uint64_t resumeoff = 0;
	char *redactbook = NULL;

	fd = fnvlist_lookup_int32(innvl, "fd");

	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);

	largeblockok = nvlist_exists(innvl, "largeblockok");
	embedok = nvlist_exists(innvl, "embedok");
	compressok = nvlist_exists(innvl, "compressok");
	rawok = nvlist_exists(innvl, "rawok");
	savedok = nvlist_exists(innvl, "savedok");

	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);

	(void) nvlist_lookup_string(innvl, "redactbook", &redactbook);

	if ((error = zfs_file_get(fd, &fp)))
	return (error);

	off = zfs_file_off(fp);

	dmu_send_outparams_t out = {0};
	out.dso_outfunc = dump_bytes;
	out.dso_arg = fp;
	out.dso_dryrun = B_FALSE;
	error = dmu_send(snapname, fromname, embedok, largeblockok,
	compressok, rawok, savedok, resumeobj, resumeoff,
	redactbook, fd, &off, &out);

	zfs_file_put(fd);
	return (error);
	}

	/* ARGSUSED */
	static int
	send_space_sum(objset_t os, void buf, int len, void *arg)
	{
	uint64_t *size = arg;
	*size += len;
	return (0);
	}

	/*
	* Determine approximately how large a zfs send stream will be -- the number
	* of bytes that will be written to the fd supplied to zfs_ioc_send_new().
	*
	* innvl: {
	* (optional) "from" -> full snap or bookmark name to send an incremental
	* from
	* (optional) "largeblockok" -> (value ignored)
	* indicates that blocks > 128KB are permitted
	* (optional) "embedok" -> (value ignored)
	* presence indicates DRR_WRITE_EMBEDDED records are permitted
	* (optional) "compressok" -> (value ignored)
	* presence indicates compressed DRR_WRITE records are permitted
	* (optional) "rawok" -> (value ignored)
	* presence indicates raw encrypted records should be used.
	* (optional) "fd" -> file descriptor to use as a cookie for progress
	* tracking (int32)
	* }
	*
	* outnvl: {
	* "space" -> bytes of space (uint64)
	* }
	*/
	static const zfs_ioc_key_t zfs_keys_send_space[] = {
	{"from", DATA_TYPE_STRING, ZK_OPTIONAL},
	{"fromsnap", DATA_TYPE_STRING, ZK_OPTIONAL},
	{"largeblockok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"embedok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"compressok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"rawok", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	{"fd", DATA_TYPE_INT32, ZK_OPTIONAL},
	{"redactbook", DATA_TYPE_STRING, ZK_OPTIONAL},
	{"resumeobj", DATA_TYPE_UINT64, ZK_OPTIONAL},
	{"resumeoff", DATA_TYPE_UINT64, ZK_OPTIONAL},
	{"bytes", DATA_TYPE_UINT64, ZK_OPTIONAL},
	};

	static int
	zfs_ioc_send_space(const char snapname, nvlist_t innvl, nvlist_t *outnvl)
	{
	dsl_pool_t *dp;
	dsl_dataset_t *tosnap;
	dsl_dataset_t *fromsnap = NULL;
	int error;
	char *fromname = NULL;
	char *redactlist_book = NULL;
	boolean_t largeblockok;
	boolean_t embedok;
	boolean_t compressok;
	boolean_t rawok;
	boolean_t savedok;
	uint64_t space = 0;
	boolean_t full_estimate = B_FALSE;
	uint64_t resumeobj = 0;
	uint64_t resumeoff = 0;
	uint64_t resume_bytes = 0;
	int32_t fd = -1;
	zfs_bookmark_phys_t zbm = {0};

	error = dsl_pool_hold(snapname, FTAG, &dp);
	if (error != 0)
	return (error);

	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
	if (error != 0) {
	dsl_pool_rele(dp, FTAG);
	return (error);
	}
	(void) nvlist_lookup_int32(innvl, "fd", &fd);

	largeblockok = nvlist_exists(innvl, "largeblockok");
	embedok = nvlist_exists(innvl, "embedok");
	compressok = nvlist_exists(innvl, "compressok");
	rawok = nvlist_exists(innvl, "rawok");
	savedok = nvlist_exists(innvl, "savedok");
	boolean_t from = (nvlist_lookup_string(innvl, "from", &fromname) == 0);
	boolean_t altbook = (nvlist_lookup_string(innvl, "redactbook",
	&redactlist_book) == 0);

	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
	(void) nvlist_lookup_uint64(innvl, "bytes", &resume_bytes);

	if (altbook) {
	full_estimate = B_TRUE;
	} else if (from) {
	if (strchr(fromname, '#')) {
	error = dsl_bookmark_lookup(dp, fromname, tosnap, &zbm);

	/*
	* dsl_bookmark_lookup() will fail with EXDEV if
	* the from-bookmark and tosnap are at the same txg.
	* However, it's valid to do a send (and therefore,
	* a send estimate) from and to the same time point,
	* if the bookmark is redacted (the incremental send
	* can change what's redacted on the target). In
	* this case, dsl_bookmark_lookup() fills in zbm
	* but returns EXDEV. Ignore this error.
	*/
	if (error == EXDEV && zbm.zbm_redaction_obj != 0 &&
	zbm.zbm_guid ==
	dsl_dataset_phys(tosnap)->ds_guid)
	error = 0;

	if (error != 0) {
	dsl_dataset_rele(tosnap, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}
	if (zbm.zbm_redaction_obj != 0 \|\| !(zbm.zbm_flags &
	ZBM_FLAG_HAS_FBN)) {
	full_estimate = B_TRUE;
	}
	} else if (strchr(fromname, '@')) {
	error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
	if (error != 0) {
	dsl_dataset_rele(tosnap, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (error);
	}

	if (!dsl_dataset_is_before(tosnap, fromsnap, 0)) {
	full_estimate = B_TRUE;
	dsl_dataset_rele(fromsnap, FTAG);
	}
	} else {
	/*
	* from is not properly formatted as a snapshot or
	* bookmark
	*/
	dsl_dataset_rele(tosnap, FTAG);
	dsl_pool_rele(dp, FTAG);
	return (SET_ERROR(EINVAL));
	}
	}

	if (full_estimate) {
	dmu_send_outparams_t out = {0};
	offset_t off = 0;
	out.dso_outfunc = send_space_sum;
	out.dso_arg = &space;
	out.dso_dryrun = B_TRUE;
	/*
	* We have to release these holds so dmu_send can take them. It
	* will do all the error checking we need.
	*/
	dsl_dataset_rele(tosnap, FTAG);
	dsl_pool_rele(dp, FTAG);
	error = dmu_send(snapname, fromname, embedok, largeblockok,
	compressok, rawok, savedok, resumeobj, resumeoff,
	redactlist_book, fd, &off, &out);
	} else {
	error = dmu_send_estimate_fast(tosnap, fromsnap,
	(from && strchr(fromname, '#') != NULL ? &zbm : NULL),
	compressok \|\| rawok, savedok, &space);
	space -= resume_bytes;
	if (fromsnap != NULL)
	dsl_dataset_rele(fromsnap, FTAG);
	dsl_dataset_rele(tosnap, FTAG);
	dsl_pool_rele(dp, FTAG);
	}

	fnvlist_add_uint64(outnvl, "space", space);

	return (error);
	}

	/*
	* Sync the currently open TXG to disk for the specified pool.
	* This is somewhat similar to 'zfs_sync()'.
	* For cases that do not result in error this ioctl will wait for
	* the currently open TXG to commit before returning back to the caller.
	*
	* innvl: {
	* "force" -> when true, force uberblock update even if there is no dirty data.
	* In addition this will cause the vdev configuration to be written
	* out including updating the zpool cache file. (boolean_t)
	* }
	*
	* onvl is unused
	*/
	static const zfs_ioc_key_t zfs_keys_pool_sync[] = {
	{"force", DATA_TYPE_BOOLEAN_VALUE, 0},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_pool_sync(const char pool, nvlist_t innvl, nvlist_t *onvl)
	{
	int err;
	boolean_t force = B_FALSE;
	spa_t *spa;

	if ((err = spa_open(pool, &spa, FTAG)) != 0)
	return (err);

	if (innvl)
	force = fnvlist_lookup_boolean_value(innvl, "force");

	if (force) {
	spa_config_enter(spa, SCL_CONFIG, FTAG, RW_WRITER);
	vdev_config_dirty(spa->spa_root_vdev);
	spa_config_exit(spa, SCL_CONFIG, FTAG);
	}
	txg_wait_synced(spa_get_dsl(spa), 0);

	spa_close(spa, FTAG);

	return (err);
	}

	/*
	* Load a user's wrapping key into the kernel.
	* innvl: {
	* "hidden_args" -> { "wkeydata" -> value }
	* raw uint8_t array of encryption wrapping key data (32 bytes)
	* (optional) "noop" -> (value ignored)
	* presence indicated key should only be verified, not loaded
	* }
	*/
	static const zfs_ioc_key_t zfs_keys_load_key[] = {
	{"hidden_args", DATA_TYPE_NVLIST, 0},
	{"noop", DATA_TYPE_BOOLEAN, ZK_OPTIONAL},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_load_key(const char dsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	int ret;
	dsl_crypto_params_t *dcp = NULL;
	nvlist_t *hidden_args;
	boolean_t noop = nvlist_exists(innvl, "noop");

	if (strchr(dsname, '@') != NULL \|\| strchr(dsname, '%') != NULL) {
	ret = SET_ERROR(EINVAL);
	goto error;
	}

	hidden_args = fnvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS);

	ret = dsl_crypto_params_create_nvlist(DCP_CMD_NONE, NULL,
	hidden_args, &dcp);
	if (ret != 0)
	goto error;

	ret = spa_keystore_load_wkey(dsname, dcp, noop);
	if (ret != 0)
	goto error;

	dsl_crypto_params_free(dcp, noop);

	return (0);

	error:
	dsl_crypto_params_free(dcp, B_TRUE);
	return (ret);
	}

	/*
	* Unload a user's wrapping key from the kernel.
	* Both innvl and outnvl are unused.
	*/
	static const zfs_ioc_key_t zfs_keys_unload_key[] = {
	/* no nvl keys */
	};

	/* ARGSUSED */
	static int
	zfs_ioc_unload_key(const char dsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	int ret = 0;

	if (strchr(dsname, '@') != NULL \|\| strchr(dsname, '%') != NULL) {
	ret = (SET_ERROR(EINVAL));
	goto out;
	}

	ret = spa_keystore_unload_wkey(dsname);
	if (ret != 0)
	goto out;

	out:
	return (ret);
	}

	/*
	* Changes a user's wrapping key used to decrypt a dataset. The keyformat,
	* keylocation, pbkdf2salt, and pbkdf2iters properties can also be specified
	* here to change how the key is derived in userspace.
	*
	* innvl: {
	* "hidden_args" (optional) -> { "wkeydata" -> value }
	* raw uint8_t array of new encryption wrapping key data (32 bytes)
	* "props" (optional) -> { prop -> value }
	* }
	*
	* outnvl is unused
	*/
	static const zfs_ioc_key_t zfs_keys_change_key[] = {
	{"crypt_cmd", DATA_TYPE_UINT64, ZK_OPTIONAL},
	{"hidden_args", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	{"props", DATA_TYPE_NVLIST, ZK_OPTIONAL},
	};

	/* ARGSUSED */
	static int
	zfs_ioc_change_key(const char dsname, nvlist_t innvl, nvlist_t *outnvl)
	{
	int ret;
	uint64_t cmd = DCP_CMD_NONE;
	dsl_crypto_params_t *dcp = NULL;
	nvlist_t args = NULL, hidden_args = NULL;

	if (strchr(dsname, '@') != NULL \|\| strchr(dsname, '%') != NULL) {
	ret = (SET_ERROR(EINVAL));
	goto error;
	}

	(void) nvlist_lookup_uint64(innvl, "crypt_cmd", &cmd);
	(void) nvlist_lookup_nvlist(innvl, "props", &args);
	(void) nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);

	ret = dsl_crypto_params_create_nvlist(cmd, args, hidden_args, &dcp);
	if (ret != 0)
	goto error;

	ret = spa_keystore_change_key(dsname, dcp);
	if (ret != 0)
	goto error;

	dsl_crypto_params_free(dcp, B_FALSE);

	return (0);

	error:
	dsl_crypto_params_free(dcp, B_TRUE);
	return (ret);
	}

	static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];

	static void
	zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
	zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
	boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
	{
	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];

	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
	ASSERT3U(ioc, <, ZFS_IOC_LAST);
	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
	ASSERT3P(vec->zvec_func, ==, NULL);

	vec->zvec_legacy_func = func;
	vec->zvec_secpolicy = secpolicy;
	vec->zvec_namecheck = namecheck;
	vec->zvec_allow_log = log_history;
	vec->zvec_pool_check = pool_check;
	}

	/*
	* See the block comment at the beginning of this file for details on
	* each argument to this function.
	*/
	void
	zfs_ioctl_register(const char name, zfs_ioc_t ioc, zfs_ioc_func_t func,
	zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
	zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
	boolean_t allow_log, const zfs_ioc_key_t *nvl_keys, size_t num_keys)
	{
	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];

	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
	ASSERT3U(ioc, <, ZFS_IOC_LAST);
	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
	ASSERT3P(vec->zvec_func, ==, NULL);

	/* if we are logging, the name must be valid */
	ASSERT(!allow_log \|\| namecheck != NO_NAME);

	vec->zvec_name = name;
	vec->zvec_func = func;
	vec->zvec_secpolicy = secpolicy;
	vec->zvec_namecheck = namecheck;
	vec->zvec_pool_check = pool_check;
	vec->zvec_smush_outnvlist = smush_outnvlist;
	vec->zvec_allow_log = allow_log;
	vec->zvec_nvl_keys = nvl_keys;
	vec->zvec_nvl_key_count = num_keys;
	}

	static void
	zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
	zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
	zfs_ioc_poolcheck_t pool_check)
	{
	zfs_ioctl_register_legacy(ioc, func, secpolicy,
	POOL_NAME, log_history, pool_check);
	}

	void
	zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
	zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
	{
	zfs_ioctl_register_legacy(ioc, func, secpolicy,
	DATASET_NAME, B_FALSE, pool_check);
	}

	static void
	zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
	{
	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
	POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY);
	}

	static void
	zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
	zfs_secpolicy_func_t *secpolicy)
	{
	zfs_ioctl_register_legacy(ioc, func, secpolicy,
	NO_NAME, B_FALSE, POOL_CHECK_NONE);
	}

	static void
	zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
	zfs_ioc_legacy_func_t func, zfs_secpolicy_func_t secpolicy)
	{
	zfs_ioctl_register_legacy(ioc, func, secpolicy,
	DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
	}

	static void
	zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
	{
	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
	zfs_secpolicy_read);
	}

	static void
	zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
	zfs_secpolicy_func_t *secpolicy)
	{
	zfs_ioctl_register_legacy(ioc, func, secpolicy,
	DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY);
	}

	static void
	zfs_ioctl_init(void)
	{
	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
	zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_snapshot, ARRAY_SIZE(zfs_keys_snapshot));

	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
	zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_FALSE, B_FALSE,
	zfs_keys_log_history, ARRAY_SIZE(zfs_keys_log_history));

	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
	zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
	POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
	zfs_keys_space_snaps, ARRAY_SIZE(zfs_keys_space_snaps));

	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
	zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
	POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
	zfs_keys_send_new, ARRAY_SIZE(zfs_keys_send_new));

	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
	zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
	POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
	zfs_keys_send_space, ARRAY_SIZE(zfs_keys_send_space));

	zfs_ioctl_register("create", ZFS_IOC_CREATE,
	zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_create, ARRAY_SIZE(zfs_keys_create));

	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
	zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_clone, ARRAY_SIZE(zfs_keys_clone));

	zfs_ioctl_register("remap", ZFS_IOC_REMAP,
	zfs_ioc_remap, zfs_secpolicy_none, DATASET_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_FALSE, B_TRUE,
	zfs_keys_remap, ARRAY_SIZE(zfs_keys_remap));

	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
	zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_destroy_snaps, ARRAY_SIZE(zfs_keys_destroy_snaps));

	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
	zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_hold, ARRAY_SIZE(zfs_keys_hold));
	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
	zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_release, ARRAY_SIZE(zfs_keys_release));

	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
	zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
	POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
	zfs_keys_get_holds, ARRAY_SIZE(zfs_keys_get_holds));

	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
	zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_FALSE, B_TRUE,
	zfs_keys_rollback, ARRAY_SIZE(zfs_keys_rollback));

	zfs_ioctl_register("bookmark", ZFS_IOC_BOOKMARK,
	zfs_ioc_bookmark, zfs_secpolicy_bookmark, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_bookmark, ARRAY_SIZE(zfs_keys_bookmark));

	zfs_ioctl_register("get_bookmarks", ZFS_IOC_GET_BOOKMARKS,
	zfs_ioc_get_bookmarks, zfs_secpolicy_read, DATASET_NAME,
	POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
	zfs_keys_get_bookmarks, ARRAY_SIZE(zfs_keys_get_bookmarks));

	zfs_ioctl_register("get_bookmark_props", ZFS_IOC_GET_BOOKMARK_PROPS,
	zfs_ioc_get_bookmark_props, zfs_secpolicy_read, ENTITY_NAME,
	POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE, zfs_keys_get_bookmark_props,
	ARRAY_SIZE(zfs_keys_get_bookmark_props));

	zfs_ioctl_register("destroy_bookmarks", ZFS_IOC_DESTROY_BOOKMARKS,
	zfs_ioc_destroy_bookmarks, zfs_secpolicy_destroy_bookmarks,
	POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_destroy_bookmarks,
	ARRAY_SIZE(zfs_keys_destroy_bookmarks));

	zfs_ioctl_register("receive", ZFS_IOC_RECV_NEW,
	zfs_ioc_recv_new, zfs_secpolicy_recv_new, DATASET_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_recv_new, ARRAY_SIZE(zfs_keys_recv_new));
	zfs_ioctl_register("load-key", ZFS_IOC_LOAD_KEY,
	zfs_ioc_load_key, zfs_secpolicy_load_key,
	DATASET_NAME, POOL_CHECK_SUSPENDED, B_TRUE, B_TRUE,
	zfs_keys_load_key, ARRAY_SIZE(zfs_keys_load_key));
	zfs_ioctl_register("unload-key", ZFS_IOC_UNLOAD_KEY,
	zfs_ioc_unload_key, zfs_secpolicy_load_key,
	DATASET_NAME, POOL_CHECK_SUSPENDED, B_TRUE, B_TRUE,
	zfs_keys_unload_key, ARRAY_SIZE(zfs_keys_unload_key));
	zfs_ioctl_register("change-key", ZFS_IOC_CHANGE_KEY,
	zfs_ioc_change_key, zfs_secpolicy_change_key,
	DATASET_NAME, POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY,
	B_TRUE, B_TRUE, zfs_keys_change_key,
	ARRAY_SIZE(zfs_keys_change_key));

	zfs_ioctl_register("sync", ZFS_IOC_POOL_SYNC,
	zfs_ioc_pool_sync, zfs_secpolicy_none, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_FALSE, B_FALSE,
	zfs_keys_pool_sync, ARRAY_SIZE(zfs_keys_pool_sync));
	zfs_ioctl_register("reopen", ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
	zfs_secpolicy_config, POOL_NAME, POOL_CHECK_SUSPENDED, B_TRUE,
	B_TRUE, zfs_keys_pool_reopen, ARRAY_SIZE(zfs_keys_pool_reopen));

	zfs_ioctl_register("channel_program", ZFS_IOC_CHANNEL_PROGRAM,
	zfs_ioc_channel_program, zfs_secpolicy_config,
	POOL_NAME, POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE,
	B_TRUE, zfs_keys_channel_program,
	ARRAY_SIZE(zfs_keys_channel_program));

	zfs_ioctl_register("redact", ZFS_IOC_REDACT,
	zfs_ioc_redact, zfs_secpolicy_config, DATASET_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_redact, ARRAY_SIZE(zfs_keys_redact));

	zfs_ioctl_register("zpool_checkpoint", ZFS_IOC_POOL_CHECKPOINT,
	zfs_ioc_pool_checkpoint, zfs_secpolicy_config, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_pool_checkpoint, ARRAY_SIZE(zfs_keys_pool_checkpoint));

	zfs_ioctl_register("zpool_discard_checkpoint",
	ZFS_IOC_POOL_DISCARD_CHECKPOINT, zfs_ioc_pool_discard_checkpoint,
	zfs_secpolicy_config, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_pool_discard_checkpoint,
	ARRAY_SIZE(zfs_keys_pool_discard_checkpoint));

	zfs_ioctl_register("initialize", ZFS_IOC_POOL_INITIALIZE,
	zfs_ioc_pool_initialize, zfs_secpolicy_config, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_pool_initialize, ARRAY_SIZE(zfs_keys_pool_initialize));

	zfs_ioctl_register("trim", ZFS_IOC_POOL_TRIM,
	zfs_ioc_pool_trim, zfs_secpolicy_config, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_TRUE, B_TRUE,
	zfs_keys_pool_trim, ARRAY_SIZE(zfs_keys_pool_trim));

	zfs_ioctl_register("wait", ZFS_IOC_WAIT,
	zfs_ioc_wait, zfs_secpolicy_none, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_FALSE, B_FALSE,
	zfs_keys_pool_wait, ARRAY_SIZE(zfs_keys_pool_wait));

	zfs_ioctl_register("wait_fs", ZFS_IOC_WAIT_FS,
	zfs_ioc_wait_fs, zfs_secpolicy_none, DATASET_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_FALSE, B_FALSE,
	zfs_keys_fs_wait, ARRAY_SIZE(zfs_keys_fs_wait));

	zfs_ioctl_register("set_bootenv", ZFS_IOC_SET_BOOTENV,
	zfs_ioc_set_bootenv, zfs_secpolicy_config, POOL_NAME,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY, B_FALSE, B_TRUE,
	zfs_keys_set_bootenv, ARRAY_SIZE(zfs_keys_set_bootenv));

	zfs_ioctl_register("get_bootenv", ZFS_IOC_GET_BOOTENV,
	zfs_ioc_get_bootenv, zfs_secpolicy_none, POOL_NAME,
	POOL_CHECK_SUSPENDED, B_FALSE, B_TRUE,
	zfs_keys_get_bootenv, ARRAY_SIZE(zfs_keys_get_bootenv));

	/* IOCTLS that use the legacy function signature */

	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
	zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);

	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
	zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
	zfs_ioc_pool_scan);
	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
	zfs_ioc_pool_upgrade);
	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
	zfs_ioc_vdev_add);
	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
	zfs_ioc_vdev_remove);
	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
	zfs_ioc_vdev_set_state);
	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
	zfs_ioc_vdev_attach);
	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
	zfs_ioc_vdev_detach);
	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
	zfs_ioc_vdev_setpath);
	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
	zfs_ioc_vdev_setfru);
	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
	zfs_ioc_pool_set_props);
	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
	zfs_ioc_vdev_split);
	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
	zfs_ioc_pool_reguid);

	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
	zfs_ioc_pool_configs, zfs_secpolicy_none);
	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
	zfs_ioc_pool_tryimport, zfs_secpolicy_config);
	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
	zfs_ioc_inject_fault, zfs_secpolicy_inject);
	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
	zfs_ioc_clear_fault, zfs_secpolicy_inject);
	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
	zfs_ioc_inject_list_next, zfs_secpolicy_inject);

	/*
	* pool destroy, and export don't log the history as part of
	* zfsdev_ioctl, but rather zfs_ioc_pool_export
	* does the logging of those commands.
	*/
	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
	zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
	zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);

	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
	zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
	zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);

	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
	zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
	zfs_ioc_dsobj_to_dsname,
	zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
	zfs_ioc_pool_get_history,
	zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);

	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
	zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);

	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
	zfs_secpolicy_config, B_TRUE, POOL_CHECK_READONLY);

	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
	zfs_ioc_space_written);
	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
	zfs_ioc_objset_recvd_props);
	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
	zfs_ioc_next_obj);
	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
	zfs_ioc_get_fsacl);
	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
	zfs_ioc_objset_stats);
	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
	zfs_ioc_objset_zplprops);
	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
	zfs_ioc_dataset_list_next);
	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
	zfs_ioc_snapshot_list_next);
	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
	zfs_ioc_send_progress);

	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
	zfs_ioc_diff, zfs_secpolicy_diff);
	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
	zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
	zfs_ioc_obj_to_path, zfs_secpolicy_diff);
	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
	zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
	zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
	zfs_ioc_send, zfs_secpolicy_send);

	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
	zfs_secpolicy_none);
	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
	zfs_secpolicy_destroy);
	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
	zfs_secpolicy_rename);
	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
	zfs_secpolicy_recv);
	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
	zfs_secpolicy_promote);
	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
	zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
	zfs_secpolicy_set_fsacl);

	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
	zfs_secpolicy_share, POOL_CHECK_NONE);
	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
	zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
	zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY);
	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
	zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
	POOL_CHECK_SUSPENDED \| POOL_CHECK_READONLY);

	zfs_ioctl_register_legacy(ZFS_IOC_EVENTS_NEXT, zfs_ioc_events_next,
	zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_NONE);
	zfs_ioctl_register_legacy(ZFS_IOC_EVENTS_CLEAR, zfs_ioc_events_clear,
	zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_NONE);
	zfs_ioctl_register_legacy(ZFS_IOC_EVENTS_SEEK, zfs_ioc_events_seek,
	zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_NONE);

	zfs_ioctl_init_os();
	}

	/*
	* Verify that for non-legacy ioctls the input nvlist
	* pairs match against the expected input.
	*
	* Possible errors are:
	* ZFS_ERR_IOC_ARG_UNAVAIL An unrecognized nvpair was encountered
	* ZFS_ERR_IOC_ARG_REQUIRED A required nvpair is missing
	* ZFS_ERR_IOC_ARG_BADTYPE Invalid type for nvpair
	*/
	static int
	zfs_check_input_nvpairs(nvlist_t innvl, const zfs_ioc_vec_t vec)
	{
	const zfs_ioc_key_t *nvl_keys = vec->zvec_nvl_keys;
	boolean_t required_keys_found = B_FALSE;

	/*
	* examine each input pair
	*/
	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
	pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
	char *name = nvpair_name(pair);
	data_type_t type = nvpair_type(pair);
	boolean_t identified = B_FALSE;

	/*
	* check pair against the documented names and type
	*/
	for (int k = 0; k < vec->zvec_nvl_key_count; k++) {
	/* if not a wild card name, check for an exact match */
	if ((nvl_keys[k].zkey_flags & ZK_WILDCARDLIST) == 0 &&
	strcmp(nvl_keys[k].zkey_name, name) != 0)
	continue;

	identified = B_TRUE;

	if (nvl_keys[k].zkey_type != DATA_TYPE_ANY &&
	nvl_keys[k].zkey_type != type) {
	return (SET_ERROR(ZFS_ERR_IOC_ARG_BADTYPE));
	}

	if (nvl_keys[k].zkey_flags & ZK_OPTIONAL)
	continue;

	required_keys_found = B_TRUE;
	break;
	}

	/* allow an 'optional' key, everything else is invalid */
	if (!identified &&
	(strcmp(name, "optional") != 0 \|\|
	type != DATA_TYPE_NVLIST)) {
	return (SET_ERROR(ZFS_ERR_IOC_ARG_UNAVAIL));
	}
	}

	/* verify that all required keys were found */
	for (int k = 0; k < vec->zvec_nvl_key_count; k++) {
	if (nvl_keys[k].zkey_flags & ZK_OPTIONAL)
	continue;

	if (nvl_keys[k].zkey_flags & ZK_WILDCARDLIST) {
	/* at least one non-optional key is expected here */
	if (!required_keys_found)
	return (SET_ERROR(ZFS_ERR_IOC_ARG_REQUIRED));
	continue;
	}

	if (!nvlist_exists(innvl, nvl_keys[k].zkey_name))
	return (SET_ERROR(ZFS_ERR_IOC_ARG_REQUIRED));
	}

	return (0);
	}

	static int
	pool_status_check(const char *name, zfs_ioc_namecheck_t type,
	zfs_ioc_poolcheck_t check)
	{
	spa_t *spa;
	int error;

	ASSERT(type == POOL_NAME \|\| type == DATASET_NAME \|\|
	type == ENTITY_NAME);

	if (check & POOL_CHECK_NONE)
	return (0);

	error = spa_open(name, &spa, FTAG);
	if (error == 0) {
	if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
	error = SET_ERROR(EAGAIN);
	else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
	error = SET_ERROR(EROFS);
	spa_close(spa, FTAG);
	}
	return (error);
	}

	int
	zfsdev_getminor(int fd, minor_t *minorp)
	{
	zfsdev_state_t zs, fpd;
	zfs_file_t *fp;
	int rc;

	ASSERT(!MUTEX_HELD(&zfsdev_state_lock));

	if ((rc = zfs_file_get(fd, &fp)))
	return (rc);

	fpd = zfs_file_private(fp);
	if (fpd == NULL)
	return (SET_ERROR(EBADF));

	mutex_enter(&zfsdev_state_lock);

	for (zs = zfsdev_state_list; zs != NULL; zs = zs->zs_next) {

	if (zs->zs_minor == -1)
	continue;

	if (fpd == zs) {
	*minorp = fpd->zs_minor;
	mutex_exit(&zfsdev_state_lock);
	return (0);
	}
	}

	mutex_exit(&zfsdev_state_lock);

	return (SET_ERROR(EBADF));
	}

	static void *
	zfsdev_get_state_impl(minor_t minor, enum zfsdev_state_type which)
	{
	zfsdev_state_t *zs;

	for (zs = zfsdev_state_list; zs != NULL; zs = zs->zs_next) {
	if (zs->zs_minor == minor) {
	smp_rmb();
	switch (which) {
	case ZST_ONEXIT:
	return (zs->zs_onexit);
	case ZST_ZEVENT:
	return (zs->zs_zevent);
	case ZST_ALL:
	return (zs);
	}
	}
	}

	return (NULL);
	}

	void *
	zfsdev_get_state(minor_t minor, enum zfsdev_state_type which)
	{
	void *ptr;

	ptr = zfsdev_get_state_impl(minor, which);

	return (ptr);
	}

	/*
	* Find a free minor number. The zfsdev_state_list is expected to
	* be short since it is only a list of currently open file handles.
	*/
	minor_t
	zfsdev_minor_alloc(void)
	{
	static minor_t last_minor = 0;
	minor_t m;

	ASSERT(MUTEX_HELD(&zfsdev_state_lock));

	for (m = last_minor + 1; m != last_minor; m++) {
	if (m > ZFSDEV_MAX_MINOR)
	m = 1;
	if (zfsdev_get_state_impl(m, ZST_ALL) == NULL) {
	last_minor = m;
	return (m);
	}
	}

	return (0);
	}

	long
	zfsdev_ioctl_common(uint_t vecnum, zfs_cmd_t *zc, int flag)
	{
	int error, cmd;
	const zfs_ioc_vec_t *vec;
	char *saved_poolname = NULL;
	uint64_t max_nvlist_src_size;
	size_t saved_poolname_len = 0;
	nvlist_t *innvl = NULL;
	fstrans_cookie_t cookie;

	cmd = vecnum;
	error = 0;
	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
	return (SET_ERROR(ZFS_ERR_IOC_CMD_UNAVAIL));

	vec = &zfs_ioc_vec[vecnum];

	/*
	* The registered ioctl list may be sparse, verify that either
	* a normal or legacy handler are registered.
	*/
	if (vec->zvec_func == NULL && vec->zvec_legacy_func == NULL)
	return (SET_ERROR(ZFS_ERR_IOC_CMD_UNAVAIL));

	zc->zc_iflags = flag & FKIOCTL;
	max_nvlist_src_size = zfs_max_nvlist_src_size_os();
	if (zc->zc_nvlist_src_size > max_nvlist_src_size) {
	/*
	* Make sure the user doesn't pass in an insane value for
	* zc_nvlist_src_size. We have to check, since we will end
	* up allocating that much memory inside of get_nvlist(). This
	* prevents a nefarious user from allocating tons of kernel
	* memory.
	*
	* Also, we return EINVAL instead of ENOMEM here. The reason
	* being that returning ENOMEM from an ioctl() has a special
	* connotation; that the user's size value is too small and
	* needs to be expanded to hold the nvlist. See
	* zcmd_expand_dst_nvlist() for details.
	*/
	error = SET_ERROR(EINVAL); /* User's size too big */

	} else if (zc->zc_nvlist_src_size != 0) {
	error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
	zc->zc_iflags, &innvl);
	if (error != 0)
	goto out;
	}

	/*
	* Ensure that all pool/dataset names are valid before we pass down to
	* the lower layers.
	*/
	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
	switch (vec->zvec_namecheck) {
	case POOL_NAME:
	if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
	error = SET_ERROR(EINVAL);
	else
	error = pool_status_check(zc->zc_name,
	vec->zvec_namecheck, vec->zvec_pool_check);
	break;

	case DATASET_NAME:
	if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
	error = SET_ERROR(EINVAL);
	else
	error = pool_status_check(zc->zc_name,
	vec->zvec_namecheck, vec->zvec_pool_check);
	break;

	case ENTITY_NAME:
	if (entity_namecheck(zc->zc_name, NULL, NULL) != 0) {
	error = SET_ERROR(EINVAL);
	} else {
	error = pool_status_check(zc->zc_name,
	vec->zvec_namecheck, vec->zvec_pool_check);
	}
	break;

	case NO_NAME:
	break;
	}
	/*
	* Ensure that all input pairs are valid before we pass them down
	* to the lower layers.
	*
	* The vectored functions can use fnvlist_lookup_{type} for any
	* required pairs since zfs_check_input_nvpairs() confirmed that
	* they exist and are of the correct type.
	*/
	if (error == 0 && vec->zvec_func != NULL) {
	error = zfs_check_input_nvpairs(innvl, vec);
	if (error != 0)
	goto out;
	}

	if (error == 0) {
	cookie = spl_fstrans_mark();
	error = vec->zvec_secpolicy(zc, innvl, CRED());
	spl_fstrans_unmark(cookie);
	}

	if (error != 0)
	goto out;

	/* legacy ioctls can modify zc_name */
	/*
	* Can't use kmem_strdup() as we might truncate the string and
	* kmem_strfree() would then free with incorrect size.
	*/
	saved_poolname_len = strlen(zc->zc_name) + 1;
	saved_poolname = kmem_alloc(saved_poolname_len, KM_SLEEP);

	strlcpy(saved_poolname, zc->zc_name, saved_poolname_len);
	saved_poolname[strcspn(saved_poolname, "/@#")] = '\0';

	if (vec->zvec_func != NULL) {
	nvlist_t *outnvl;
	int puterror = 0;
	spa_t *spa;
	nvlist_t *lognv = NULL;

	ASSERT(vec->zvec_legacy_func == NULL);

	/*
	* Add the innvl to the lognv before calling the func,
	* in case the func changes the innvl.
	*/
	if (vec->zvec_allow_log) {
	lognv = fnvlist_alloc();
	fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
	vec->zvec_name);
	if (!nvlist_empty(innvl)) {
	fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
	innvl);
	}
	}

	outnvl = fnvlist_alloc();
	cookie = spl_fstrans_mark();
	error = vec->zvec_func(zc->zc_name, innvl, outnvl);
	spl_fstrans_unmark(cookie);

	/*
	* Some commands can partially execute, modify state, and still
	* return an error. In these cases, attempt to record what
	* was modified.
	*/
	if ((error == 0 \|\|
	(cmd == ZFS_IOC_CHANNEL_PROGRAM && error != EINVAL)) &&
	vec->zvec_allow_log &&
	spa_open(zc->zc_name, &spa, FTAG) == 0) {
	if (!nvlist_empty(outnvl)) {
	fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
	outnvl);
	}
	if (error != 0) {
	fnvlist_add_int64(lognv, ZPOOL_HIST_ERRNO,
	error);
	}
	(void) spa_history_log_nvl(spa, lognv);
	spa_close(spa, FTAG);
	}
	fnvlist_free(lognv);

	if (!nvlist_empty(outnvl) \|\| zc->zc_nvlist_dst_size != 0) {
	int smusherror = 0;
	if (vec->zvec_smush_outnvlist) {
	smusherror = nvlist_smush(outnvl,
	zc->zc_nvlist_dst_size);
	}
	if (smusherror == 0)
	puterror = put_nvlist(zc, outnvl);
	}

	if (puterror != 0)
	error = puterror;

	nvlist_free(outnvl);
	} else {
	cookie = spl_fstrans_mark();
	error = vec->zvec_legacy_func(zc);
	spl_fstrans_unmark(cookie);
	}

	out:
	nvlist_free(innvl);
	if (error == 0 && vec->zvec_allow_log) {
	char *s = tsd_get(zfs_allow_log_key);
	if (s != NULL)
	kmem_strfree(s);
	(void) tsd_set(zfs_allow_log_key, kmem_strdup(saved_poolname));
	}
	if (saved_poolname != NULL)
	kmem_free(saved_poolname, saved_poolname_len);

	return (error);
	}

	int
	zfs_kmod_init(void)
	{
	int error;

	if ((error = zvol_init()) != 0)
	return (error);

	spa_init(SPA_MODE_READ \| SPA_MODE_WRITE);
	zfs_init();

	zfs_ioctl_init();

	mutex_init(&zfsdev_state_lock, NULL, MUTEX_DEFAULT, NULL);
	zfsdev_state_list = kmem_zalloc(sizeof (zfsdev_state_t), KM_SLEEP);
	zfsdev_state_list->zs_minor = -1;

	if ((error = zfsdev_attach()) != 0)
	goto out;

	tsd_create(&zfs_fsyncer_key, NULL);
	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);

	return (0);
	out:
	zfs_fini();
	spa_fini();
	zvol_fini();

	return (error);
	}

	void
	zfs_kmod_fini(void)
	{
	zfsdev_state_t zs, zsnext = NULL;

	zfsdev_detach();

	mutex_destroy(&zfsdev_state_lock);

	for (zs = zfsdev_state_list; zs != NULL; zs = zsnext) {
	zsnext = zs->zs_next;
	if (zs->zs_onexit)
	zfs_onexit_destroy(zs->zs_onexit);
	if (zs->zs_zevent)
	zfs_zevent_destroy(zs->zs_zevent);
	kmem_free(zs, sizeof (zfsdev_state_t));
	}

	+ zfs_ereport_taskq_fini(); /* run before zfs_fini() on Linux */
	zfs_fini();
	spa_fini();
	zvol_fini();

	tsd_destroy(&zfs_fsyncer_key);
	tsd_destroy(&rrw_tsd_key);
	tsd_destroy(&zfs_allow_log_key);
	}

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs, zfs_, max_nvlist_src_size, ULONG, ZMOD_RW,
	"Maximum size in bytes allowed for src nvlist passed with ZFS ioctls");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/zio.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/zio.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/zio.c (revision 365892)
	@@ -1,4969 +1,4971 @@
	/*
	* CDDL HEADER START
	*
	* The contents of this file are subject to the terms of the
	* Common Development and Distribution License (the "License").
	* You may not use this file except in compliance with the License.
	*
	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	* or http://www.opensolaris.org/os/licensing.
	* See the License for the specific language governing permissions
	* and limitations under the License.
	*
	* When distributing Covered Code, include this CDDL HEADER in each
	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	* If applicable, add the following below this CDDL HEADER, with the
	* fields enclosed by brackets "[]" replaced with your own identifying
	* information: Portions Copyright [yyyy] [name of copyright owner]
	*
	* CDDL HEADER END
	*/
	/*
	* Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
	- * Copyright (c) 2011, 2019 by Delphix. All rights reserved.
	+ * Copyright (c) 2011, 2020 by Delphix. All rights reserved.
	* Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
	* Copyright (c) 2017, Intel Corporation.
	* Copyright (c) 2019, Klara Inc.
	* Copyright (c) 2019, Allan Jude
	*/

	#include <sys/sysmacros.h>
	#include <sys/zfs_context.h>
	#include <sys/fm/fs/zfs.h>
	#include <sys/spa.h>
	#include <sys/txg.h>
	#include <sys/spa_impl.h>
	#include <sys/vdev_impl.h>
	#include <sys/vdev_trim.h>
	#include <sys/zio_impl.h>
	#include <sys/zio_compress.h>
	#include <sys/zio_checksum.h>
	#include <sys/dmu_objset.h>
	#include <sys/arc.h>
	#include <sys/ddt.h>
	#include <sys/blkptr.h>
	#include <sys/zfeature.h>
	#include <sys/dsl_scan.h>
	#include <sys/metaslab_impl.h>
	#include <sys/time.h>
	#include <sys/trace_zfs.h>
	#include <sys/abd.h>
	#include <sys/dsl_crypt.h>
	#include <cityhash.h>

	/*
	* ==========================================================================
	* I/O type descriptions
	* ==========================================================================
	*/
	const char *zio_type_name[ZIO_TYPES] = {
	/*
	* Note: Linux kernel thread name length is limited
	* so these names will differ from upstream open zfs.
	*/
	"z_null", "z_rd", "z_wr", "z_fr", "z_cl", "z_ioctl", "z_trim"
	};

	int zio_dva_throttle_enabled = B_TRUE;
	int zio_deadman_log_all = B_FALSE;

	/*
	* ==========================================================================
	* I/O kmem caches
	* ==========================================================================
	*/
	kmem_cache_t *zio_cache;
	kmem_cache_t *zio_link_cache;
	kmem_cache_t *zio_buf_cache[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
	kmem_cache_t *zio_data_buf_cache[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
	#if defined(ZFS_DEBUG) && !defined(_KERNEL)
	uint64_t zio_buf_cache_allocs[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
	uint64_t zio_buf_cache_frees[SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT];
	#endif

	/* Mark IOs as "slow" if they take longer than 30 seconds */
	int zio_slow_io_ms = (30 * MILLISEC);

	#define BP_SPANB(indblkshift, level) \
	(((uint64_t)1) << ((level) * ((indblkshift) - SPA_BLKPTRSHIFT)))
	#define COMPARE_META_LEVEL 0x80000000ul
	/*
	* The following actions directly effect the spa's sync-to-convergence logic.
	* The values below define the sync pass when we start performing the action.
	* Care should be taken when changing these values as they directly impact
	* spa_sync() performance. Tuning these values may introduce subtle performance
	* pathologies and should only be done in the context of performance analysis.
	* These tunables will eventually be removed and replaced with #defines once
	* enough analysis has been done to determine optimal values.
	*
	* The 'zfs_sync_pass_deferred_free' pass must be greater than 1 to ensure that
	* regular blocks are not deferred.
	*
	* Starting in sync pass 8 (zfs_sync_pass_dont_compress), we disable
	* compression (including of metadata). In practice, we don't have this
	* many sync passes, so this has no effect.
	*
	* The original intent was that disabling compression would help the sync
	* passes to converge. However, in practice disabling compression increases
	* the average number of sync passes, because when we turn compression off, a
	* lot of block's size will change and thus we have to re-allocate (not
	* overwrite) them. It also increases the number of 128KB allocations (e.g.
	* for indirect blocks and spacemaps) because these will not be compressed.
	* The 128K allocations are especially detrimental to performance on highly
	* fragmented systems, which may have very few free segments of this size,
	* and may need to load new metaslabs to satisfy 128K allocations.
	*/
	int zfs_sync_pass_deferred_free = 2; /* defer frees starting in this pass */
	int zfs_sync_pass_dont_compress = 8; /* don't compress starting in this pass */
	int zfs_sync_pass_rewrite = 2; /* rewrite new bps starting in this pass */

	/*
	* An allocating zio is one that either currently has the DVA allocate
	* stage set or will have it later in its lifetime.
	*/
	#define IO_IS_ALLOCATING(zio) ((zio)->io_orig_pipeline & ZIO_STAGE_DVA_ALLOCATE)

	/*
	* Enable smaller cores by excluding metadata
	* allocations as well.
	*/
	int zio_exclude_metadata = 0;
	int zio_requeue_io_start_cut_in_line = 1;

	#ifdef ZFS_DEBUG
	int zio_buf_debug_limit = 16384;
	#else
	int zio_buf_debug_limit = 0;
	#endif

	static inline void __zio_execute(zio_t *zio);

	static void zio_taskq_dispatch(zio_t *, zio_taskq_type_t, boolean_t);

	void
	zio_init(void)
	{
	size_t c;
	vmem_t *data_alloc_arena = NULL;

	zio_cache = kmem_cache_create("zio_cache",
	sizeof (zio_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
	zio_link_cache = kmem_cache_create("zio_link_cache",
	sizeof (zio_link_t), 0, NULL, NULL, NULL, NULL, NULL, 0);

	/*
	* For small buffers, we want a cache for each multiple of
	* SPA_MINBLOCKSIZE. For larger buffers, we want a cache
	* for each quarter-power of 2.
	*/
	for (c = 0; c < SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT; c++) {
	size_t size = (c + 1) << SPA_MINBLOCKSHIFT;
	size_t p2 = size;
	size_t align = 0;
	size_t data_cflags, cflags;

	data_cflags = KMC_NODEBUG;
	cflags = (zio_exclude_metadata \|\| size > zio_buf_debug_limit) ?
	KMC_NODEBUG : 0;

	#if defined(_ILP32) && defined(_KERNEL)
	/*
	* Cache size limited to 1M on 32-bit platforms until ARC
	* buffers no longer require virtual address space.
	*/
	if (size > zfs_max_recordsize)
	break;
	#endif

	while (!ISP2(p2))
	p2 &= p2 - 1;

	#ifndef _KERNEL
	/*
	* If we are using watchpoints, put each buffer on its own page,
	* to eliminate the performance overhead of trapping to the
	* kernel when modifying a non-watched buffer that shares the
	* page with a watched buffer.
	*/
	if (arc_watch && !IS_P2ALIGNED(size, PAGESIZE))
	continue;
	/*
	* Here's the problem - on 4K native devices in userland on
	* Linux using O_DIRECT, buffers must be 4K aligned or I/O
	* will fail with EINVAL, causing zdb (and others) to coredump.
	* Since userland probably doesn't need optimized buffer caches,
	* we just force 4K alignment on everything.
	*/
	align = 8 * SPA_MINBLOCKSIZE;
	#else
	if (size < PAGESIZE) {
	align = SPA_MINBLOCKSIZE;
	} else if (IS_P2ALIGNED(size, p2 >> 2)) {
	align = PAGESIZE;
	}
	#endif

	if (align != 0) {
	char name[36];
	(void) snprintf(name, sizeof (name), "zio_buf_%lu",
	(ulong_t)size);
	zio_buf_cache[c] = kmem_cache_create(name, size,
	align, NULL, NULL, NULL, NULL, NULL, cflags);

	(void) snprintf(name, sizeof (name), "zio_data_buf_%lu",
	(ulong_t)size);
	zio_data_buf_cache[c] = kmem_cache_create(name, size,
	align, NULL, NULL, NULL, NULL,
	data_alloc_arena, data_cflags);
	}
	}

	while (--c != 0) {
	ASSERT(zio_buf_cache[c] != NULL);
	if (zio_buf_cache[c - 1] == NULL)
	zio_buf_cache[c - 1] = zio_buf_cache[c];

	ASSERT(zio_data_buf_cache[c] != NULL);
	if (zio_data_buf_cache[c - 1] == NULL)
	zio_data_buf_cache[c - 1] = zio_data_buf_cache[c];
	}

	zio_inject_init();

	lz4_init();
	}

	void
	zio_fini(void)
	{
	size_t c;
	kmem_cache_t *last_cache = NULL;
	kmem_cache_t *last_data_cache = NULL;

	for (c = 0; c < SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT; c++) {
	#ifdef _ILP32
	/*
	* Cache size limited to 1M on 32-bit platforms until ARC
	* buffers no longer require virtual address space.
	*/
	if (((c + 1) << SPA_MINBLOCKSHIFT) > zfs_max_recordsize)
	break;
	#endif
	#if defined(ZFS_DEBUG) && !defined(_KERNEL)
	if (zio_buf_cache_allocs[c] != zio_buf_cache_frees[c])
	(void) printf("zio_fini: [%d] %llu != %llu\n",
	(int)((c + 1) << SPA_MINBLOCKSHIFT),
	(long long unsigned)zio_buf_cache_allocs[c],
	(long long unsigned)zio_buf_cache_frees[c]);
	#endif
	if (zio_buf_cache[c] != last_cache) {
	last_cache = zio_buf_cache[c];
	kmem_cache_destroy(zio_buf_cache[c]);
	}
	zio_buf_cache[c] = NULL;

	if (zio_data_buf_cache[c] != last_data_cache) {
	last_data_cache = zio_data_buf_cache[c];
	kmem_cache_destroy(zio_data_buf_cache[c]);
	}
	zio_data_buf_cache[c] = NULL;
	}

	kmem_cache_destroy(zio_link_cache);
	kmem_cache_destroy(zio_cache);

	zio_inject_fini();

	lz4_fini();
	}

	/*
	* ==========================================================================
	* Allocate and free I/O buffers
	* ==========================================================================
	*/

	/*
	* Use zio_buf_alloc to allocate ZFS metadata. This data will appear in a
	* crashdump if the kernel panics, so use it judiciously. Obviously, it's
	* useful to inspect ZFS metadata, but if possible, we should avoid keeping
	* excess / transient data in-core during a crashdump.
	*/
	void *
	zio_buf_alloc(size_t size)
	{
	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;

	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
	#if defined(ZFS_DEBUG) && !defined(_KERNEL)
	atomic_add_64(&zio_buf_cache_allocs[c], 1);
	#endif

	return (kmem_cache_alloc(zio_buf_cache[c], KM_PUSHPAGE));
	}

	/*
	* Use zio_data_buf_alloc to allocate data. The data will not appear in a
	* crashdump if the kernel panics. This exists so that we will limit the amount
	* of ZFS data that shows up in a kernel crashdump. (Thus reducing the amount
	* of kernel heap dumped to disk when the kernel panics)
	*/
	void *
	zio_data_buf_alloc(size_t size)
	{
	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;

	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);

	return (kmem_cache_alloc(zio_data_buf_cache[c], KM_PUSHPAGE));
	}

	void
	zio_buf_free(void *buf, size_t size)
	{
	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;

	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);
	#if defined(ZFS_DEBUG) && !defined(_KERNEL)
	atomic_add_64(&zio_buf_cache_frees[c], 1);
	#endif

	kmem_cache_free(zio_buf_cache[c], buf);
	}

	void
	zio_data_buf_free(void *buf, size_t size)
	{
	size_t c = (size - 1) >> SPA_MINBLOCKSHIFT;

	VERIFY3U(c, <, SPA_MAXBLOCKSIZE >> SPA_MINBLOCKSHIFT);

	kmem_cache_free(zio_data_buf_cache[c], buf);
	}

	static void
	zio_abd_free(void *abd, size_t size)
	{
	abd_free((abd_t *)abd);
	}

	/*
	* ==========================================================================
	* Push and pop I/O transform buffers
	* ==========================================================================
	*/
	void
	zio_push_transform(zio_t zio, abd_t data, uint64_t size, uint64_t bufsize,
	zio_transform_func_t *transform)
	{
	zio_transform_t *zt = kmem_alloc(sizeof (zio_transform_t), KM_SLEEP);

	zt->zt_orig_abd = zio->io_abd;
	zt->zt_orig_size = zio->io_size;
	zt->zt_bufsize = bufsize;
	zt->zt_transform = transform;

	zt->zt_next = zio->io_transform_stack;
	zio->io_transform_stack = zt;

	zio->io_abd = data;
	zio->io_size = size;
	}

	void
	zio_pop_transforms(zio_t *zio)
	{
	zio_transform_t *zt;

	while ((zt = zio->io_transform_stack) != NULL) {
	if (zt->zt_transform != NULL)
	zt->zt_transform(zio,
	zt->zt_orig_abd, zt->zt_orig_size);

	if (zt->zt_bufsize != 0)
	abd_free(zio->io_abd);

	zio->io_abd = zt->zt_orig_abd;
	zio->io_size = zt->zt_orig_size;
	zio->io_transform_stack = zt->zt_next;

	kmem_free(zt, sizeof (zio_transform_t));
	}
	}

	/*
	* ==========================================================================
	* I/O transform callbacks for subblocks, decompression, and decryption
	* ==========================================================================
	*/
	static void
	zio_subblock(zio_t zio, abd_t data, uint64_t size)
	{
	ASSERT(zio->io_size > size);

	if (zio->io_type == ZIO_TYPE_READ)
	abd_copy(data, zio->io_abd, size);
	}

	static void
	zio_decompress(zio_t zio, abd_t data, uint64_t size)
	{
	if (zio->io_error == 0) {
	void *tmp = abd_borrow_buf(data, size);
	int ret = zio_decompress_data(BP_GET_COMPRESS(zio->io_bp),
	zio->io_abd, tmp, zio->io_size, size,
	&zio->io_prop.zp_complevel);
	abd_return_buf_copy(data, tmp, size);

	if (zio_injection_enabled && ret == 0)
	ret = zio_handle_fault_injection(zio, EINVAL);

	if (ret != 0)
	zio->io_error = SET_ERROR(EIO);
	}
	}

	static void
	zio_decrypt(zio_t zio, abd_t data, uint64_t size)
	{
	int ret;
	void *tmp;
	blkptr_t *bp = zio->io_bp;
	spa_t *spa = zio->io_spa;
	uint64_t dsobj = zio->io_bookmark.zb_objset;
	uint64_t lsize = BP_GET_LSIZE(bp);
	dmu_object_type_t ot = BP_GET_TYPE(bp);
	uint8_t salt[ZIO_DATA_SALT_LEN];
	uint8_t iv[ZIO_DATA_IV_LEN];
	uint8_t mac[ZIO_DATA_MAC_LEN];
	boolean_t no_crypt = B_FALSE;

	ASSERT(BP_USES_CRYPT(bp));
	ASSERT3U(size, !=, 0);

	if (zio->io_error != 0)
	return;

	/*
	* Verify the cksum of MACs stored in an indirect bp. It will always
	* be possible to verify this since it does not require an encryption
	* key.
	*/
	if (BP_HAS_INDIRECT_MAC_CKSUM(bp)) {
	zio_crypt_decode_mac_bp(bp, mac);

	if (BP_GET_COMPRESS(bp) != ZIO_COMPRESS_OFF) {
	/*
	* We haven't decompressed the data yet, but
	* zio_crypt_do_indirect_mac_checksum() requires
	* decompressed data to be able to parse out the MACs
	* from the indirect block. We decompress it now and
	* throw away the result after we are finished.
	*/
	tmp = zio_buf_alloc(lsize);
	ret = zio_decompress_data(BP_GET_COMPRESS(bp),
	zio->io_abd, tmp, zio->io_size, lsize,
	&zio->io_prop.zp_complevel);
	if (ret != 0) {
	ret = SET_ERROR(EIO);
	goto error;
	}
	ret = zio_crypt_do_indirect_mac_checksum(B_FALSE,
	tmp, lsize, BP_SHOULD_BYTESWAP(bp), mac);
	zio_buf_free(tmp, lsize);
	} else {
	ret = zio_crypt_do_indirect_mac_checksum_abd(B_FALSE,
	zio->io_abd, size, BP_SHOULD_BYTESWAP(bp), mac);
	}
	abd_copy(data, zio->io_abd, size);

	if (zio_injection_enabled && ot != DMU_OT_DNODE && ret == 0) {
	ret = zio_handle_decrypt_injection(spa,
	&zio->io_bookmark, ot, ECKSUM);
	}
	if (ret != 0)
	goto error;

	return;
	}

	/*
	* If this is an authenticated block, just check the MAC. It would be
	* nice to separate this out into its own flag, but for the moment
	* enum zio_flag is out of bits.
	*/
	if (BP_IS_AUTHENTICATED(bp)) {
	if (ot == DMU_OT_OBJSET) {
	ret = spa_do_crypt_objset_mac_abd(B_FALSE, spa,
	dsobj, zio->io_abd, size, BP_SHOULD_BYTESWAP(bp));
	} else {
	zio_crypt_decode_mac_bp(bp, mac);
	ret = spa_do_crypt_mac_abd(B_FALSE, spa, dsobj,
	zio->io_abd, size, mac);
	if (zio_injection_enabled && ret == 0) {
	ret = zio_handle_decrypt_injection(spa,
	&zio->io_bookmark, ot, ECKSUM);
	}
	}
	abd_copy(data, zio->io_abd, size);

	if (ret != 0)
	goto error;

	return;
	}

	zio_crypt_decode_params_bp(bp, salt, iv);

	if (ot == DMU_OT_INTENT_LOG) {
	tmp = abd_borrow_buf_copy(zio->io_abd, sizeof (zil_chain_t));
	zio_crypt_decode_mac_zil(tmp, mac);
	abd_return_buf(zio->io_abd, tmp, sizeof (zil_chain_t));
	} else {
	zio_crypt_decode_mac_bp(bp, mac);
	}

	ret = spa_do_crypt_abd(B_FALSE, spa, &zio->io_bookmark, BP_GET_TYPE(bp),
	BP_GET_DEDUP(bp), BP_SHOULD_BYTESWAP(bp), salt, iv, mac, size, data,
	zio->io_abd, &no_crypt);
	if (no_crypt)
	abd_copy(data, zio->io_abd, size);

	if (ret != 0)
	goto error;

	return;

	error:
	/* assert that the key was found unless this was speculative */
	ASSERT(ret != EACCES \|\| (zio->io_flags & ZIO_FLAG_SPECULATIVE));

	/*
	* If there was a decryption / authentication error return EIO as
	* the io_error. If this was not a speculative zio, create an ereport.
	*/
	if (ret == ECKSUM) {
	zio->io_error = SET_ERROR(EIO);
	if ((zio->io_flags & ZIO_FLAG_SPECULATIVE) == 0) {
	spa_log_error(spa, &zio->io_bookmark);
	(void) zfs_ereport_post(FM_EREPORT_ZFS_AUTHENTICATION,
	- spa, NULL, &zio->io_bookmark, zio, 0, 0);
	+ spa, NULL, &zio->io_bookmark, zio, 0);
	}
	} else {
	zio->io_error = ret;
	}
	}

	/*
	* ==========================================================================
	* I/O parent/child relationships and pipeline interlocks
	* ==========================================================================
	*/
	zio_t *
	zio_walk_parents(zio_t cio, zio_link_t *zl)
	{
	list_t *pl = &cio->io_parent_list;

	zl = (zl == NULL) ? list_head(pl) : list_next(pl, *zl);
	if (*zl == NULL)
	return (NULL);

	ASSERT((*zl)->zl_child == cio);
	return ((*zl)->zl_parent);
	}

	zio_t *
	zio_walk_children(zio_t pio, zio_link_t *zl)
	{
	list_t *cl = &pio->io_child_list;

	ASSERT(MUTEX_HELD(&pio->io_lock));

	zl = (zl == NULL) ? list_head(cl) : list_next(cl, *zl);
	if (*zl == NULL)
	return (NULL);

	ASSERT((*zl)->zl_parent == pio);
	return ((*zl)->zl_child);
	}

	zio_t *
	zio_unique_parent(zio_t *cio)
	{
	zio_link_t *zl = NULL;
	zio_t *pio = zio_walk_parents(cio, &zl);

	VERIFY3P(zio_walk_parents(cio, &zl), ==, NULL);
	return (pio);
	}

	void
	zio_add_child(zio_t pio, zio_t cio)
	{
	zio_link_t *zl = kmem_cache_alloc(zio_link_cache, KM_SLEEP);

	/*
	* Logical I/Os can have logical, gang, or vdev children.
	* Gang I/Os can have gang or vdev children.
	* Vdev I/Os can only have vdev children.
	* The following ASSERT captures all of these constraints.
	*/
	ASSERT3S(cio->io_child_type, <=, pio->io_child_type);

	zl->zl_parent = pio;
	zl->zl_child = cio;

	mutex_enter(&pio->io_lock);
	mutex_enter(&cio->io_lock);

	ASSERT(pio->io_state[ZIO_WAIT_DONE] == 0);

	for (int w = 0; w < ZIO_WAIT_TYPES; w++)
	pio->io_children[cio->io_child_type][w] += !cio->io_state[w];

	list_insert_head(&pio->io_child_list, zl);
	list_insert_head(&cio->io_parent_list, zl);

	pio->io_child_count++;
	cio->io_parent_count++;

	mutex_exit(&cio->io_lock);
	mutex_exit(&pio->io_lock);
	}

	static void
	zio_remove_child(zio_t pio, zio_t cio, zio_link_t *zl)
	{
	ASSERT(zl->zl_parent == pio);
	ASSERT(zl->zl_child == cio);

	mutex_enter(&pio->io_lock);
	mutex_enter(&cio->io_lock);

	list_remove(&pio->io_child_list, zl);
	list_remove(&cio->io_parent_list, zl);

	pio->io_child_count--;
	cio->io_parent_count--;

	mutex_exit(&cio->io_lock);
	mutex_exit(&pio->io_lock);
	kmem_cache_free(zio_link_cache, zl);
	}

	static boolean_t
	zio_wait_for_children(zio_t *zio, uint8_t childbits, enum zio_wait_type wait)
	{
	boolean_t waiting = B_FALSE;

	mutex_enter(&zio->io_lock);
	ASSERT(zio->io_stall == NULL);
	for (int c = 0; c < ZIO_CHILD_TYPES; c++) {
	if (!(ZIO_CHILD_BIT_IS_SET(childbits, c)))
	continue;

	uint64_t *countp = &zio->io_children[c][wait];
	if (*countp != 0) {
	zio->io_stage >>= 1;
	ASSERT3U(zio->io_stage, !=, ZIO_STAGE_OPEN);
	zio->io_stall = countp;
	waiting = B_TRUE;
	break;
	}
	}
	mutex_exit(&zio->io_lock);
	return (waiting);
	}

	__attribute__((always_inline))
	static inline void
	zio_notify_parent(zio_t pio, zio_t zio, enum zio_wait_type wait,
	zio_t **next_to_executep)
	{
	uint64_t *countp = &pio->io_children[zio->io_child_type][wait];
	int *errorp = &pio->io_child_error[zio->io_child_type];

	mutex_enter(&pio->io_lock);
	if (zio->io_error && !(zio->io_flags & ZIO_FLAG_DONT_PROPAGATE))
	errorp = zio_worst_error(errorp, zio->io_error);
	pio->io_reexecute \|= zio->io_reexecute;
	ASSERT3U(*countp, >, 0);

	(*countp)--;

	if (*countp == 0 && pio->io_stall == countp) {
	zio_taskq_type_t type =
	pio->io_stage < ZIO_STAGE_VDEV_IO_START ? ZIO_TASKQ_ISSUE :
	ZIO_TASKQ_INTERRUPT;
	pio->io_stall = NULL;
	mutex_exit(&pio->io_lock);

	/*
	* If we can tell the caller to execute this parent next, do
	* so. Otherwise dispatch the parent zio as its own task.
	*
	* Having the caller execute the parent when possible reduces
	* locking on the zio taskq's, reduces context switch
	* overhead, and has no recursion penalty. Note that one
	* read from disk typically causes at least 3 zio's: a
	* zio_null(), the logical zio_read(), and then a physical
	* zio. When the physical ZIO completes, we are able to call
	* zio_done() on all 3 of these zio's from one invocation of
	* zio_execute() by returning the parent back to
	* zio_execute(). Since the parent isn't executed until this
	* thread returns back to zio_execute(), the caller should do
	* so promptly.
	*
	* In other cases, dispatching the parent prevents
	* overflowing the stack when we have deeply nested
	* parent-child relationships, as we do with the "mega zio"
	* of writes for spa_sync(), and the chain of ZIL blocks.
	*/
	if (next_to_executep != NULL && *next_to_executep == NULL) {
	*next_to_executep = pio;
	} else {
	zio_taskq_dispatch(pio, type, B_FALSE);
	}
	} else {
	mutex_exit(&pio->io_lock);
	}
	}

	static void
	zio_inherit_child_errors(zio_t *zio, enum zio_child c)
	{
	if (zio->io_child_error[c] != 0 && zio->io_error == 0)
	zio->io_error = zio->io_child_error[c];
	}

	int
	zio_bookmark_compare(const void x1, const void x2)
	{
	const zio_t *z1 = x1;
	const zio_t *z2 = x2;

	if (z1->io_bookmark.zb_objset < z2->io_bookmark.zb_objset)
	return (-1);
	if (z1->io_bookmark.zb_objset > z2->io_bookmark.zb_objset)
	return (1);

	if (z1->io_bookmark.zb_object < z2->io_bookmark.zb_object)
	return (-1);
	if (z1->io_bookmark.zb_object > z2->io_bookmark.zb_object)
	return (1);

	if (z1->io_bookmark.zb_level < z2->io_bookmark.zb_level)
	return (-1);
	if (z1->io_bookmark.zb_level > z2->io_bookmark.zb_level)
	return (1);

	if (z1->io_bookmark.zb_blkid < z2->io_bookmark.zb_blkid)
	return (-1);
	if (z1->io_bookmark.zb_blkid > z2->io_bookmark.zb_blkid)
	return (1);

	if (z1 < z2)
	return (-1);
	if (z1 > z2)
	return (1);

	return (0);
	}

	/*
	* ==========================================================================
	* Create the various types of I/O (read, write, free, etc)
	* ==========================================================================
	*/
	static zio_t *
	zio_create(zio_t pio, spa_t spa, uint64_t txg, const blkptr_t *bp,
	abd_t data, uint64_t lsize, uint64_t psize, zio_done_func_t done,
	void *private, zio_type_t type, zio_priority_t priority,
	enum zio_flag flags, vdev_t *vd, uint64_t offset,
	const zbookmark_phys_t *zb, enum zio_stage stage,
	enum zio_stage pipeline)
	{
	zio_t *zio;

	IMPLY(type != ZIO_TYPE_TRIM, psize <= SPA_MAXBLOCKSIZE);
	ASSERT(P2PHASE(psize, SPA_MINBLOCKSIZE) == 0);
	ASSERT(P2PHASE(offset, SPA_MINBLOCKSIZE) == 0);

	ASSERT(!vd \|\| spa_config_held(spa, SCL_STATE_ALL, RW_READER));
	ASSERT(!bp \|\| !(flags & ZIO_FLAG_CONFIG_WRITER));
	ASSERT(vd \|\| stage == ZIO_STAGE_OPEN);

	IMPLY(lsize != psize, (flags & ZIO_FLAG_RAW_COMPRESS) != 0);

	zio = kmem_cache_alloc(zio_cache, KM_SLEEP);
	bzero(zio, sizeof (zio_t));

	mutex_init(&zio->io_lock, NULL, MUTEX_NOLOCKDEP, NULL);
	cv_init(&zio->io_cv, NULL, CV_DEFAULT, NULL);

	list_create(&zio->io_parent_list, sizeof (zio_link_t),
	offsetof(zio_link_t, zl_parent_node));
	list_create(&zio->io_child_list, sizeof (zio_link_t),
	offsetof(zio_link_t, zl_child_node));
	metaslab_trace_init(&zio->io_alloc_list);

	if (vd != NULL)
	zio->io_child_type = ZIO_CHILD_VDEV;
	else if (flags & ZIO_FLAG_GANG_CHILD)
	zio->io_child_type = ZIO_CHILD_GANG;
	else if (flags & ZIO_FLAG_DDT_CHILD)
	zio->io_child_type = ZIO_CHILD_DDT;
	else
	zio->io_child_type = ZIO_CHILD_LOGICAL;

	if (bp != NULL) {
	zio->io_bp = (blkptr_t *)bp;
	zio->io_bp_copy = *bp;
	zio->io_bp_orig = *bp;
	if (type != ZIO_TYPE_WRITE \|\|
	zio->io_child_type == ZIO_CHILD_DDT)
	zio->io_bp = &zio->io_bp_copy; /* so caller can free */
	if (zio->io_child_type == ZIO_CHILD_LOGICAL)
	zio->io_logical = zio;
	if (zio->io_child_type > ZIO_CHILD_GANG && BP_IS_GANG(bp))
	pipeline \|= ZIO_GANG_STAGES;
	}

	zio->io_spa = spa;
	zio->io_txg = txg;
	zio->io_done = done;
	zio->io_private = private;
	zio->io_type = type;
	zio->io_priority = priority;
	zio->io_vd = vd;
	zio->io_offset = offset;
	zio->io_orig_abd = zio->io_abd = data;
	zio->io_orig_size = zio->io_size = psize;
	zio->io_lsize = lsize;
	zio->io_orig_flags = zio->io_flags = flags;
	zio->io_orig_stage = zio->io_stage = stage;
	zio->io_orig_pipeline = zio->io_pipeline = pipeline;
	zio->io_pipeline_trace = ZIO_STAGE_OPEN;

	zio->io_state[ZIO_WAIT_READY] = (stage >= ZIO_STAGE_READY);
	zio->io_state[ZIO_WAIT_DONE] = (stage >= ZIO_STAGE_DONE);

	if (zb != NULL)
	zio->io_bookmark = *zb;

	if (pio != NULL) {
	if (zio->io_metaslab_class == NULL)
	zio->io_metaslab_class = pio->io_metaslab_class;
	if (zio->io_logical == NULL)
	zio->io_logical = pio->io_logical;
	if (zio->io_child_type == ZIO_CHILD_GANG)
	zio->io_gang_leader = pio->io_gang_leader;
	zio_add_child(pio, zio);
	}

	taskq_init_ent(&zio->io_tqent);

	return (zio);
	}

	static void
	zio_destroy(zio_t *zio)
	{
	metaslab_trace_fini(&zio->io_alloc_list);
	list_destroy(&zio->io_parent_list);
	list_destroy(&zio->io_child_list);
	mutex_destroy(&zio->io_lock);
	cv_destroy(&zio->io_cv);
	kmem_cache_free(zio_cache, zio);
	}

	zio_t *
	zio_null(zio_t pio, spa_t spa, vdev_t vd, zio_done_func_t done,
	void *private, enum zio_flag flags)
	{
	zio_t *zio;

	zio = zio_create(pio, spa, 0, NULL, NULL, 0, 0, done, private,
	ZIO_TYPE_NULL, ZIO_PRIORITY_NOW, flags, vd, 0, NULL,
	ZIO_STAGE_OPEN, ZIO_INTERLOCK_PIPELINE);

	return (zio);
	}

	zio_t *
	zio_root(spa_t spa, zio_done_func_t done, void *private, enum zio_flag flags)
	{
	return (zio_null(NULL, spa, NULL, done, private, flags));
	}

	static int
	zfs_blkptr_verify_log(spa_t spa, const blkptr_t bp,
	enum blk_verify_flag blk_verify, const char *fmt, ...)
	{
	va_list adx;
	char buf[256];

	va_start(adx, fmt);
	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
	va_end(adx);

	switch (blk_verify) {
	case BLK_VERIFY_HALT:
	dprintf_bp(bp, "blkptr at %p dprintf_bp():", bp);
	zfs_panic_recover("%s: %s", spa_name(spa), buf);
	break;
	case BLK_VERIFY_LOG:
	zfs_dbgmsg("%s: %s", spa_name(spa), buf);
	break;
	case BLK_VERIFY_ONLY:
	break;
	}

	return (1);
	}

	/*
	* Verify the block pointer fields contain reasonable values. This means
	* it only contains known object types, checksum/compression identifiers,
	* block sizes within the maximum allowed limits, valid DVAs, etc.
	*
	* If everything checks out B_TRUE is returned. The zfs_blkptr_verify
	* argument controls the behavior when an invalid field is detected.
	*
	* Modes for zfs_blkptr_verify:
	* 1) BLK_VERIFY_ONLY (evaluate the block)
	* 2) BLK_VERIFY_LOG (evaluate the block and log problems)
	* 3) BLK_VERIFY_HALT (call zfs_panic_recover on error)
	*/
	boolean_t
	zfs_blkptr_verify(spa_t spa, const blkptr_t bp, boolean_t config_held,
	enum blk_verify_flag blk_verify)
	{
	int errors = 0;

	if (!DMU_OT_IS_VALID(BP_GET_TYPE(bp))) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p has invalid TYPE %llu",
	bp, (longlong_t)BP_GET_TYPE(bp));
	}
	if (BP_GET_CHECKSUM(bp) >= ZIO_CHECKSUM_FUNCTIONS \|\|
	BP_GET_CHECKSUM(bp) <= ZIO_CHECKSUM_ON) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p has invalid CHECKSUM %llu",
	bp, (longlong_t)BP_GET_CHECKSUM(bp));
	}
	if (BP_GET_COMPRESS(bp) >= ZIO_COMPRESS_FUNCTIONS \|\|
	BP_GET_COMPRESS(bp) <= ZIO_COMPRESS_ON) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p has invalid COMPRESS %llu",
	bp, (longlong_t)BP_GET_COMPRESS(bp));
	}
	if (BP_GET_LSIZE(bp) > SPA_MAXBLOCKSIZE) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p has invalid LSIZE %llu",
	bp, (longlong_t)BP_GET_LSIZE(bp));
	}
	if (BP_GET_PSIZE(bp) > SPA_MAXBLOCKSIZE) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p has invalid PSIZE %llu",
	bp, (longlong_t)BP_GET_PSIZE(bp));
	}

	if (BP_IS_EMBEDDED(bp)) {
	if (BPE_GET_ETYPE(bp) >= NUM_BP_EMBEDDED_TYPES) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p has invalid ETYPE %llu",
	bp, (longlong_t)BPE_GET_ETYPE(bp));
	}
	}

	/*
	* Do not verify individual DVAs if the config is not trusted. This
	* will be done once the zio is executed in vdev_mirror_map_alloc.
	*/
	if (!spa->spa_trust_config)
	return (B_TRUE);

	if (!config_held)
	spa_config_enter(spa, SCL_VDEV, bp, RW_READER);
	else
	ASSERT(spa_config_held(spa, SCL_VDEV, RW_WRITER));
	/*
	* Pool-specific checks.
	*
	* Note: it would be nice to verify that the blk_birth and
	* BP_PHYSICAL_BIRTH() are not too large. However, spa_freeze()
	* allows the birth time of log blocks (and dmu_sync()-ed blocks
	* that are in the log) to be arbitrarily large.
	*/
	for (int i = 0; i < BP_GET_NDVAS(bp); i++) {
	uint64_t vdevid = DVA_GET_VDEV(&bp->blk_dva[i]);

	if (vdevid >= spa->spa_root_vdev->vdev_children) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p DVA %u has invalid VDEV %llu",
	bp, i, (longlong_t)vdevid);
	continue;
	}
	vdev_t *vd = spa->spa_root_vdev->vdev_child[vdevid];
	if (vd == NULL) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p DVA %u has invalid VDEV %llu",
	bp, i, (longlong_t)vdevid);
	continue;
	}
	if (vd->vdev_ops == &vdev_hole_ops) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p DVA %u has hole VDEV %llu",
	bp, i, (longlong_t)vdevid);
	continue;
	}
	if (vd->vdev_ops == &vdev_missing_ops) {
	/*
	* "missing" vdevs are valid during import, but we
	* don't have their detailed info (e.g. asize), so
	* we can't perform any more checks on them.
	*/
	continue;
	}
	uint64_t offset = DVA_GET_OFFSET(&bp->blk_dva[i]);
	uint64_t asize = DVA_GET_ASIZE(&bp->blk_dva[i]);
	if (BP_IS_GANG(bp))
	asize = vdev_psize_to_asize(vd, SPA_GANGBLOCKSIZE);
	if (offset + asize > vd->vdev_asize) {
	errors += zfs_blkptr_verify_log(spa, bp, blk_verify,
	"blkptr at %p DVA %u has invalid OFFSET %llu",
	bp, i, (longlong_t)offset);
	}
	}
	if (errors > 0)
	dprintf_bp(bp, "blkptr at %p dprintf_bp():", bp);
	if (!config_held)
	spa_config_exit(spa, SCL_VDEV, bp);

	return (errors == 0);
	}

	boolean_t
	zfs_dva_valid(spa_t spa, const dva_t dva, const blkptr_t *bp)
	{
	uint64_t vdevid = DVA_GET_VDEV(dva);

	if (vdevid >= spa->spa_root_vdev->vdev_children)
	return (B_FALSE);

	vdev_t *vd = spa->spa_root_vdev->vdev_child[vdevid];
	if (vd == NULL)
	return (B_FALSE);

	if (vd->vdev_ops == &vdev_hole_ops)
	return (B_FALSE);

	if (vd->vdev_ops == &vdev_missing_ops) {
	return (B_FALSE);
	}

	uint64_t offset = DVA_GET_OFFSET(dva);
	uint64_t asize = DVA_GET_ASIZE(dva);

	if (BP_IS_GANG(bp))
	asize = vdev_psize_to_asize(vd, SPA_GANGBLOCKSIZE);
	if (offset + asize > vd->vdev_asize)
	return (B_FALSE);

	return (B_TRUE);
	}

	zio_t *
	zio_read(zio_t pio, spa_t spa, const blkptr_t *bp,
	abd_t data, uint64_t size, zio_done_func_t done, void *private,
	zio_priority_t priority, enum zio_flag flags, const zbookmark_phys_t *zb)
	{
	zio_t *zio;

	(void) zfs_blkptr_verify(spa, bp, flags & ZIO_FLAG_CONFIG_WRITER,
	BLK_VERIFY_HALT);

	zio = zio_create(pio, spa, BP_PHYSICAL_BIRTH(bp), bp,
	data, size, size, done, private,
	ZIO_TYPE_READ, priority, flags, NULL, 0, zb,
	ZIO_STAGE_OPEN, (flags & ZIO_FLAG_DDT_CHILD) ?
	ZIO_DDT_CHILD_READ_PIPELINE : ZIO_READ_PIPELINE);

	return (zio);
	}

	zio_t *
	zio_write(zio_t pio, spa_t spa, uint64_t txg, blkptr_t *bp,
	abd_t data, uint64_t lsize, uint64_t psize, const zio_prop_t zp,
	zio_done_func_t ready, zio_done_func_t children_ready,
	zio_done_func_t physdone, zio_done_func_t done,
	void *private, zio_priority_t priority, enum zio_flag flags,
	const zbookmark_phys_t *zb)
	{
	zio_t *zio;

	ASSERT(zp->zp_checksum >= ZIO_CHECKSUM_OFF &&
	zp->zp_checksum < ZIO_CHECKSUM_FUNCTIONS &&
	zp->zp_compress >= ZIO_COMPRESS_OFF &&
	zp->zp_compress < ZIO_COMPRESS_FUNCTIONS &&
	DMU_OT_IS_VALID(zp->zp_type) &&
	zp->zp_level < 32 &&
	zp->zp_copies > 0 &&
	zp->zp_copies <= spa_max_replication(spa));

	zio = zio_create(pio, spa, txg, bp, data, lsize, psize, done, private,
	ZIO_TYPE_WRITE, priority, flags, NULL, 0, zb,
	ZIO_STAGE_OPEN, (flags & ZIO_FLAG_DDT_CHILD) ?
	ZIO_DDT_CHILD_WRITE_PIPELINE : ZIO_WRITE_PIPELINE);

	zio->io_ready = ready;
	zio->io_children_ready = children_ready;
	zio->io_physdone = physdone;
	zio->io_prop = *zp;

	/*
	* Data can be NULL if we are going to call zio_write_override() to
	* provide the already-allocated BP. But we may need the data to
	* verify a dedup hit (if requested). In this case, don't try to
	* dedup (just take the already-allocated BP verbatim). Encrypted
	* dedup blocks need data as well so we also disable dedup in this
	* case.
	*/
	if (data == NULL &&
	(zio->io_prop.zp_dedup_verify \|\| zio->io_prop.zp_encrypt)) {
	zio->io_prop.zp_dedup = zio->io_prop.zp_dedup_verify = B_FALSE;
	}

	return (zio);
	}

	zio_t *
	zio_rewrite(zio_t pio, spa_t spa, uint64_t txg, blkptr_t bp, abd_t data,
	uint64_t size, zio_done_func_t done, void private,
	zio_priority_t priority, enum zio_flag flags, zbookmark_phys_t *zb)
	{
	zio_t *zio;

	zio = zio_create(pio, spa, txg, bp, data, size, size, done, private,
	ZIO_TYPE_WRITE, priority, flags \| ZIO_FLAG_IO_REWRITE, NULL, 0, zb,
	ZIO_STAGE_OPEN, ZIO_REWRITE_PIPELINE);

	return (zio);
	}

	void
	zio_write_override(zio_t zio, blkptr_t bp, int copies, boolean_t nopwrite)
	{
	ASSERT(zio->io_type == ZIO_TYPE_WRITE);
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
	ASSERT(zio->io_stage == ZIO_STAGE_OPEN);
	ASSERT(zio->io_txg == spa_syncing_txg(zio->io_spa));

	/*
	* We must reset the io_prop to match the values that existed
	* when the bp was first written by dmu_sync() keeping in mind
	* that nopwrite and dedup are mutually exclusive.
	*/
	zio->io_prop.zp_dedup = nopwrite ? B_FALSE : zio->io_prop.zp_dedup;
	zio->io_prop.zp_nopwrite = nopwrite;
	zio->io_prop.zp_copies = copies;
	zio->io_bp_override = bp;
	}

	void
	zio_free(spa_t spa, uint64_t txg, const blkptr_t bp)
	{

	(void) zfs_blkptr_verify(spa, bp, B_FALSE, BLK_VERIFY_HALT);

	/*
	* The check for EMBEDDED is a performance optimization. We
	* process the free here (by ignoring it) rather than
	* putting it on the list and then processing it in zio_free_sync().
	*/
	if (BP_IS_EMBEDDED(bp))
	return;
	metaslab_check_free(spa, bp);

	/*
	* Frees that are for the currently-syncing txg, are not going to be
	* deferred, and which will not need to do a read (i.e. not GANG or
	* DEDUP), can be processed immediately. Otherwise, put them on the
	* in-memory list for later processing.
	*
	* Note that we only defer frees after zfs_sync_pass_deferred_free
	* when the log space map feature is disabled. [see relevant comment
	* in spa_sync_iterate_to_convergence()]
	*/
	if (BP_IS_GANG(bp) \|\|
	BP_GET_DEDUP(bp) \|\|
	txg != spa->spa_syncing_txg \|\|
	(spa_sync_pass(spa) >= zfs_sync_pass_deferred_free &&
	!spa_feature_is_active(spa, SPA_FEATURE_LOG_SPACEMAP))) {
	bplist_append(&spa->spa_free_bplist[txg & TXG_MASK], bp);
	} else {
	VERIFY3P(zio_free_sync(NULL, spa, txg, bp, 0), ==, NULL);
	}
	}

	/*
	* To improve performance, this function may return NULL if we were able
	* to do the free immediately. This avoids the cost of creating a zio
	* (and linking it to the parent, etc).
	*/
	zio_t *
	zio_free_sync(zio_t pio, spa_t spa, uint64_t txg, const blkptr_t *bp,
	enum zio_flag flags)
	{
	ASSERT(!BP_IS_HOLE(bp));
	ASSERT(spa_syncing_txg(spa) == txg);

	if (BP_IS_EMBEDDED(bp))
	return (NULL);

	metaslab_check_free(spa, bp);
	arc_freed(spa, bp);
	dsl_scan_freed(spa, bp);

	if (BP_IS_GANG(bp) \|\| BP_GET_DEDUP(bp)) {
	/*
	* GANG and DEDUP blocks can induce a read (for the gang block
	* header, or the DDT), so issue them asynchronously so that
	* this thread is not tied up.
	*/
	enum zio_stage stage =
	ZIO_FREE_PIPELINE \| ZIO_STAGE_ISSUE_ASYNC;

	return (zio_create(pio, spa, txg, bp, NULL, BP_GET_PSIZE(bp),
	BP_GET_PSIZE(bp), NULL, NULL,
	ZIO_TYPE_FREE, ZIO_PRIORITY_NOW,
	flags, NULL, 0, NULL, ZIO_STAGE_OPEN, stage));
	} else {
	metaslab_free(spa, bp, txg, B_FALSE);
	return (NULL);
	}
	}

	zio_t *
	zio_claim(zio_t pio, spa_t spa, uint64_t txg, const blkptr_t *bp,
	zio_done_func_t done, void private, enum zio_flag flags)
	{
	zio_t *zio;

	(void) zfs_blkptr_verify(spa, bp, flags & ZIO_FLAG_CONFIG_WRITER,
	BLK_VERIFY_HALT);

	if (BP_IS_EMBEDDED(bp))
	return (zio_null(pio, spa, NULL, NULL, NULL, 0));

	/*
	* A claim is an allocation of a specific block. Claims are needed
	* to support immediate writes in the intent log. The issue is that
	* immediate writes contain committed data, but in a txg that was
	* not committed. Upon opening the pool after an unclean shutdown,
	* the intent log claims all blocks that contain immediate write data
	* so that the SPA knows they're in use.
	*
	* All claims must be resolved in the first txg -- before the SPA
	* starts allocating blocks -- so that nothing is allocated twice.
	* If txg == 0 we just verify that the block is claimable.
	*/
	ASSERT3U(spa->spa_uberblock.ub_rootbp.blk_birth, <,
	spa_min_claim_txg(spa));
	ASSERT(txg == spa_min_claim_txg(spa) \|\| txg == 0);
	ASSERT(!BP_GET_DEDUP(bp) \|\| !spa_writeable(spa)); /* zdb(1M) */

	zio = zio_create(pio, spa, txg, bp, NULL, BP_GET_PSIZE(bp),
	BP_GET_PSIZE(bp), done, private, ZIO_TYPE_CLAIM, ZIO_PRIORITY_NOW,
	flags, NULL, 0, NULL, ZIO_STAGE_OPEN, ZIO_CLAIM_PIPELINE);
	ASSERT0(zio->io_queued_timestamp);

	return (zio);
	}

	zio_t *
	zio_ioctl(zio_t pio, spa_t spa, vdev_t *vd, int cmd,
	zio_done_func_t done, void private, enum zio_flag flags)
	{
	zio_t *zio;
	int c;

	if (vd->vdev_children == 0) {
	zio = zio_create(pio, spa, 0, NULL, NULL, 0, 0, done, private,
	ZIO_TYPE_IOCTL, ZIO_PRIORITY_NOW, flags, vd, 0, NULL,
	ZIO_STAGE_OPEN, ZIO_IOCTL_PIPELINE);

	zio->io_cmd = cmd;
	} else {
	zio = zio_null(pio, spa, NULL, NULL, NULL, flags);

	for (c = 0; c < vd->vdev_children; c++)
	zio_nowait(zio_ioctl(zio, spa, vd->vdev_child[c], cmd,
	done, private, flags));
	}

	return (zio);
	}

	zio_t *
	zio_trim(zio_t pio, vdev_t vd, uint64_t offset, uint64_t size,
	zio_done_func_t done, void private, zio_priority_t priority,
	enum zio_flag flags, enum trim_flag trim_flags)
	{
	zio_t *zio;

	ASSERT0(vd->vdev_children);
	ASSERT0(P2PHASE(offset, 1ULL << vd->vdev_ashift));
	ASSERT0(P2PHASE(size, 1ULL << vd->vdev_ashift));
	ASSERT3U(size, !=, 0);

	zio = zio_create(pio, vd->vdev_spa, 0, NULL, NULL, size, size, done,
	private, ZIO_TYPE_TRIM, priority, flags \| ZIO_FLAG_PHYSICAL,
	vd, offset, NULL, ZIO_STAGE_OPEN, ZIO_TRIM_PIPELINE);
	zio->io_trim_flags = trim_flags;

	return (zio);
	}

	zio_t *
	zio_read_phys(zio_t pio, vdev_t vd, uint64_t offset, uint64_t size,
	abd_t data, int checksum, zio_done_func_t done, void *private,
	zio_priority_t priority, enum zio_flag flags, boolean_t labels)
	{
	zio_t *zio;

	ASSERT(vd->vdev_children == 0);
	ASSERT(!labels \|\| offset + size <= VDEV_LABEL_START_SIZE \|\|
	offset >= vd->vdev_psize - VDEV_LABEL_END_SIZE);
	ASSERT3U(offset + size, <=, vd->vdev_psize);

	zio = zio_create(pio, vd->vdev_spa, 0, NULL, data, size, size, done,
	private, ZIO_TYPE_READ, priority, flags \| ZIO_FLAG_PHYSICAL, vd,
	offset, NULL, ZIO_STAGE_OPEN, ZIO_READ_PHYS_PIPELINE);

	zio->io_prop.zp_checksum = checksum;

	return (zio);
	}

	zio_t *
	zio_write_phys(zio_t pio, vdev_t vd, uint64_t offset, uint64_t size,
	abd_t data, int checksum, zio_done_func_t done, void *private,
	zio_priority_t priority, enum zio_flag flags, boolean_t labels)
	{
	zio_t *zio;

	ASSERT(vd->vdev_children == 0);
	ASSERT(!labels \|\| offset + size <= VDEV_LABEL_START_SIZE \|\|
	offset >= vd->vdev_psize - VDEV_LABEL_END_SIZE);
	ASSERT3U(offset + size, <=, vd->vdev_psize);

	zio = zio_create(pio, vd->vdev_spa, 0, NULL, data, size, size, done,
	private, ZIO_TYPE_WRITE, priority, flags \| ZIO_FLAG_PHYSICAL, vd,
	offset, NULL, ZIO_STAGE_OPEN, ZIO_WRITE_PHYS_PIPELINE);

	zio->io_prop.zp_checksum = checksum;

	if (zio_checksum_table[checksum].ci_flags & ZCHECKSUM_FLAG_EMBEDDED) {
	/*
	* zec checksums are necessarily destructive -- they modify
	* the end of the write buffer to hold the verifier/checksum.
	* Therefore, we must make a local copy in case the data is
	* being written to multiple places in parallel.
	*/
	abd_t *wbuf = abd_alloc_sametype(data, size);
	abd_copy(wbuf, data, size);

	zio_push_transform(zio, wbuf, size, size, NULL);
	}

	return (zio);
	}

	/*
	* Create a child I/O to do some work for us.
	*/
	zio_t *
	zio_vdev_child_io(zio_t pio, blkptr_t bp, vdev_t *vd, uint64_t offset,
	abd_t *data, uint64_t size, int type, zio_priority_t priority,
	enum zio_flag flags, zio_done_func_t done, void private)
	{
	enum zio_stage pipeline = ZIO_VDEV_CHILD_PIPELINE;
	zio_t *zio;

	/*
	* vdev child I/Os do not propagate their error to the parent.
	* Therefore, for correct operation the caller must check for
	* and handle the error in the child i/o's done callback.
	* The only exceptions are i/os that we don't care about
	* (OPTIONAL or REPAIR).
	*/
	ASSERT((flags & ZIO_FLAG_OPTIONAL) \|\| (flags & ZIO_FLAG_IO_REPAIR) \|\|
	done != NULL);

	if (type == ZIO_TYPE_READ && bp != NULL) {
	/*
	* If we have the bp, then the child should perform the
	* checksum and the parent need not. This pushes error
	* detection as close to the leaves as possible and
	* eliminates redundant checksums in the interior nodes.
	*/
	pipeline \|= ZIO_STAGE_CHECKSUM_VERIFY;
	pio->io_pipeline &= ~ZIO_STAGE_CHECKSUM_VERIFY;
	}

	if (vd->vdev_ops->vdev_op_leaf) {
	ASSERT0(vd->vdev_children);
	offset += VDEV_LABEL_START_SIZE;
	}

	flags \|= ZIO_VDEV_CHILD_FLAGS(pio);

	/*
	* If we've decided to do a repair, the write is not speculative --
	* even if the original read was.
	*/
	if (flags & ZIO_FLAG_IO_REPAIR)
	flags &= ~ZIO_FLAG_SPECULATIVE;

	/*
	* If we're creating a child I/O that is not associated with a
	* top-level vdev, then the child zio is not an allocating I/O.
	* If this is a retried I/O then we ignore it since we will
	* have already processed the original allocating I/O.
	*/
	if (flags & ZIO_FLAG_IO_ALLOCATING &&
	(vd != vd->vdev_top \|\| (flags & ZIO_FLAG_IO_RETRY))) {
	ASSERT(pio->io_metaslab_class != NULL);
	ASSERT(pio->io_metaslab_class->mc_alloc_throttle_enabled);
	ASSERT(type == ZIO_TYPE_WRITE);
	ASSERT(priority == ZIO_PRIORITY_ASYNC_WRITE);
	ASSERT(!(flags & ZIO_FLAG_IO_REPAIR));
	ASSERT(!(pio->io_flags & ZIO_FLAG_IO_REWRITE) \|\|
	pio->io_child_type == ZIO_CHILD_GANG);

	flags &= ~ZIO_FLAG_IO_ALLOCATING;
	}


	zio = zio_create(pio, pio->io_spa, pio->io_txg, bp, data, size, size,
	done, private, type, priority, flags, vd, offset, &pio->io_bookmark,
	ZIO_STAGE_VDEV_IO_START >> 1, pipeline);
	ASSERT3U(zio->io_child_type, ==, ZIO_CHILD_VDEV);

	zio->io_physdone = pio->io_physdone;
	if (vd->vdev_ops->vdev_op_leaf && zio->io_logical != NULL)
	zio->io_logical->io_phys_children++;

	return (zio);
	}

	zio_t *
	zio_vdev_delegated_io(vdev_t vd, uint64_t offset, abd_t data, uint64_t size,
	zio_type_t type, zio_priority_t priority, enum zio_flag flags,
	zio_done_func_t done, void private)
	{
	zio_t *zio;

	ASSERT(vd->vdev_ops->vdev_op_leaf);

	zio = zio_create(NULL, vd->vdev_spa, 0, NULL,
	data, size, size, done, private, type, priority,
	flags \| ZIO_FLAG_CANFAIL \| ZIO_FLAG_DONT_RETRY \| ZIO_FLAG_DELEGATED,
	vd, offset, NULL,
	ZIO_STAGE_VDEV_IO_START >> 1, ZIO_VDEV_CHILD_PIPELINE);

	return (zio);
	}

	void
	zio_flush(zio_t zio, vdev_t vd)
	{
	zio_nowait(zio_ioctl(zio, zio->io_spa, vd, DKIOCFLUSHWRITECACHE,
	NULL, NULL,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_DONT_PROPAGATE \| ZIO_FLAG_DONT_RETRY));
	}

	void
	zio_shrink(zio_t *zio, uint64_t size)
	{
	ASSERT3P(zio->io_executor, ==, NULL);
	ASSERT3U(zio->io_orig_size, ==, zio->io_size);
	ASSERT3U(size, <=, zio->io_size);

	/*
	* We don't shrink for raidz because of problems with the
	* reconstruction when reading back less than the block size.
	* Note, BP_IS_RAIDZ() assumes no compression.
	*/
	ASSERT(BP_GET_COMPRESS(zio->io_bp) == ZIO_COMPRESS_OFF);
	if (!BP_IS_RAIDZ(zio->io_bp)) {
	/* we are not doing a raw write */
	ASSERT3U(zio->io_size, ==, zio->io_lsize);
	zio->io_orig_size = zio->io_size = zio->io_lsize = size;
	}
	}

	/*
	* ==========================================================================
	* Prepare to read and write logical blocks
	* ==========================================================================
	*/

	static zio_t *
	zio_read_bp_init(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;
	uint64_t psize =
	BP_IS_EMBEDDED(bp) ? BPE_GET_PSIZE(bp) : BP_GET_PSIZE(bp);

	ASSERT3P(zio->io_bp, ==, &zio->io_bp_copy);

	if (BP_GET_COMPRESS(bp) != ZIO_COMPRESS_OFF &&
	zio->io_child_type == ZIO_CHILD_LOGICAL &&
	!(zio->io_flags & ZIO_FLAG_RAW_COMPRESS)) {
	zio_push_transform(zio, abd_alloc_sametype(zio->io_abd, psize),
	psize, psize, zio_decompress);
	}

	if (((BP_IS_PROTECTED(bp) && !(zio->io_flags & ZIO_FLAG_RAW_ENCRYPT)) \|\|
	BP_HAS_INDIRECT_MAC_CKSUM(bp)) &&
	zio->io_child_type == ZIO_CHILD_LOGICAL) {
	zio_push_transform(zio, abd_alloc_sametype(zio->io_abd, psize),
	psize, psize, zio_decrypt);
	}

	if (BP_IS_EMBEDDED(bp) && BPE_GET_ETYPE(bp) == BP_EMBEDDED_TYPE_DATA) {
	int psize = BPE_GET_PSIZE(bp);
	void *data = abd_borrow_buf(zio->io_abd, psize);

	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
	decode_embedded_bp_compressed(bp, data);
	abd_return_buf_copy(zio->io_abd, data, psize);
	} else {
	ASSERT(!BP_IS_EMBEDDED(bp));
	ASSERT3P(zio->io_bp, ==, &zio->io_bp_copy);
	}

	if (!DMU_OT_IS_METADATA(BP_GET_TYPE(bp)) && BP_GET_LEVEL(bp) == 0)
	zio->io_flags \|= ZIO_FLAG_DONT_CACHE;

	if (BP_GET_TYPE(bp) == DMU_OT_DDT_ZAP)
	zio->io_flags \|= ZIO_FLAG_DONT_CACHE;

	if (BP_GET_DEDUP(bp) && zio->io_child_type == ZIO_CHILD_LOGICAL)
	zio->io_pipeline = ZIO_DDT_READ_PIPELINE;

	return (zio);
	}

	static zio_t *
	zio_write_bp_init(zio_t *zio)
	{
	if (!IO_IS_ALLOCATING(zio))
	return (zio);

	ASSERT(zio->io_child_type != ZIO_CHILD_DDT);

	if (zio->io_bp_override) {
	blkptr_t *bp = zio->io_bp;
	zio_prop_t *zp = &zio->io_prop;

	ASSERT(bp->blk_birth != zio->io_txg);
	ASSERT(BP_GET_DEDUP(zio->io_bp_override) == 0);

	bp = zio->io_bp_override;
	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;

	if (BP_IS_EMBEDDED(bp))
	return (zio);

	/*
	* If we've been overridden and nopwrite is set then
	* set the flag accordingly to indicate that a nopwrite
	* has already occurred.
	*/
	if (!BP_IS_HOLE(bp) && zp->zp_nopwrite) {
	ASSERT(!zp->zp_dedup);
	ASSERT3U(BP_GET_CHECKSUM(bp), ==, zp->zp_checksum);
	zio->io_flags \|= ZIO_FLAG_NOPWRITE;
	return (zio);
	}

	ASSERT(!zp->zp_nopwrite);

	if (BP_IS_HOLE(bp) \|\| !zp->zp_dedup)
	return (zio);

	ASSERT((zio_checksum_table[zp->zp_checksum].ci_flags &
	ZCHECKSUM_FLAG_DEDUP) \|\| zp->zp_dedup_verify);

	if (BP_GET_CHECKSUM(bp) == zp->zp_checksum &&
	!zp->zp_encrypt) {
	BP_SET_DEDUP(bp, 1);
	zio->io_pipeline \|= ZIO_STAGE_DDT_WRITE;
	return (zio);
	}

	/*
	* We were unable to handle this as an override bp, treat
	* it as a regular write I/O.
	*/
	zio->io_bp_override = NULL;
	*bp = zio->io_bp_orig;
	zio->io_pipeline = zio->io_orig_pipeline;
	}

	return (zio);
	}

	static zio_t *
	zio_write_compress(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	zio_prop_t *zp = &zio->io_prop;
	enum zio_compress compress = zp->zp_compress;
	blkptr_t *bp = zio->io_bp;
	uint64_t lsize = zio->io_lsize;
	uint64_t psize = zio->io_size;
	int pass = 1;

	/*
	* If our children haven't all reached the ready stage,
	* wait for them and then repeat this pipeline stage.
	*/
	if (zio_wait_for_children(zio, ZIO_CHILD_LOGICAL_BIT \|
	ZIO_CHILD_GANG_BIT, ZIO_WAIT_READY)) {
	return (NULL);
	}

	if (!IO_IS_ALLOCATING(zio))
	return (zio);

	if (zio->io_children_ready != NULL) {
	/*
	* Now that all our children are ready, run the callback
	* associated with this zio in case it wants to modify the
	* data to be written.
	*/
	ASSERT3U(zp->zp_level, >, 0);
	zio->io_children_ready(zio);
	}

	ASSERT(zio->io_child_type != ZIO_CHILD_DDT);
	ASSERT(zio->io_bp_override == NULL);

	if (!BP_IS_HOLE(bp) && bp->blk_birth == zio->io_txg) {
	/*
	* We're rewriting an existing block, which means we're
	* working on behalf of spa_sync(). For spa_sync() to
	* converge, it must eventually be the case that we don't
	* have to allocate new blocks. But compression changes
	* the blocksize, which forces a reallocate, and makes
	* convergence take longer. Therefore, after the first
	* few passes, stop compressing to ensure convergence.
	*/
	pass = spa_sync_pass(spa);

	ASSERT(zio->io_txg == spa_syncing_txg(spa));
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
	ASSERT(!BP_GET_DEDUP(bp));

	if (pass >= zfs_sync_pass_dont_compress)
	compress = ZIO_COMPRESS_OFF;

	/* Make sure someone doesn't change their mind on overwrites */
	ASSERT(BP_IS_EMBEDDED(bp) \|\| MIN(zp->zp_copies + BP_IS_GANG(bp),
	spa_max_replication(spa)) == BP_GET_NDVAS(bp));
	}

	/* If it's a compressed write that is not raw, compress the buffer. */
	if (compress != ZIO_COMPRESS_OFF &&
	!(zio->io_flags & ZIO_FLAG_RAW_COMPRESS)) {
	void *cbuf = zio_buf_alloc(lsize);
	psize = zio_compress_data(compress, zio->io_abd, cbuf, lsize,
	zp->zp_complevel);
	if (psize == 0 \|\| psize >= lsize) {
	compress = ZIO_COMPRESS_OFF;
	zio_buf_free(cbuf, lsize);
	} else if (!zp->zp_dedup && !zp->zp_encrypt &&
	psize <= BPE_PAYLOAD_SIZE &&
	zp->zp_level == 0 && !DMU_OT_HAS_FILL(zp->zp_type) &&
	spa_feature_is_enabled(spa, SPA_FEATURE_EMBEDDED_DATA)) {
	encode_embedded_bp_compressed(bp,
	cbuf, compress, lsize, psize);
	BPE_SET_ETYPE(bp, BP_EMBEDDED_TYPE_DATA);
	BP_SET_TYPE(bp, zio->io_prop.zp_type);
	BP_SET_LEVEL(bp, zio->io_prop.zp_level);
	zio_buf_free(cbuf, lsize);
	bp->blk_birth = zio->io_txg;
	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
	ASSERT(spa_feature_is_active(spa,
	SPA_FEATURE_EMBEDDED_DATA));
	return (zio);
	} else {
	/*
	* Round up compressed size up to the ashift
	* of the smallest-ashift device, and zero the tail.
	* This ensures that the compressed size of the BP
	* (and thus compressratio property) are correct,
	* in that we charge for the padding used to fill out
	* the last sector.
	*/
	ASSERT3U(spa->spa_min_ashift, >=, SPA_MINBLOCKSHIFT);
	size_t rounded = (size_t)P2ROUNDUP(psize,
	1ULL << spa->spa_min_ashift);
	if (rounded >= lsize) {
	compress = ZIO_COMPRESS_OFF;
	zio_buf_free(cbuf, lsize);
	psize = lsize;
	} else {
	abd_t *cdata = abd_get_from_buf(cbuf, lsize);
	abd_take_ownership_of_buf(cdata, B_TRUE);
	abd_zero_off(cdata, psize, rounded - psize);
	psize = rounded;
	zio_push_transform(zio, cdata,
	psize, lsize, NULL);
	}
	}

	/*
	* We were unable to handle this as an override bp, treat
	* it as a regular write I/O.
	*/
	zio->io_bp_override = NULL;
	*bp = zio->io_bp_orig;
	zio->io_pipeline = zio->io_orig_pipeline;

	} else if ((zio->io_flags & ZIO_FLAG_RAW_ENCRYPT) != 0 &&
	zp->zp_type == DMU_OT_DNODE) {
	/*
	* The DMU actually relies on the zio layer's compression
	* to free metadnode blocks that have had all contained
	* dnodes freed. As a result, even when doing a raw
	* receive, we must check whether the block can be compressed
	* to a hole.
	*/
	psize = zio_compress_data(ZIO_COMPRESS_EMPTY,
	zio->io_abd, NULL, lsize, zp->zp_complevel);
	if (psize == 0 \|\| psize >= lsize)
	compress = ZIO_COMPRESS_OFF;
	} else {
	ASSERT3U(psize, !=, 0);
	}

	/*
	* The final pass of spa_sync() must be all rewrites, but the first
	* few passes offer a trade-off: allocating blocks defers convergence,
	* but newly allocated blocks are sequential, so they can be written
	* to disk faster. Therefore, we allow the first few passes of
	* spa_sync() to allocate new blocks, but force rewrites after that.
	* There should only be a handful of blocks after pass 1 in any case.
	*/
	if (!BP_IS_HOLE(bp) && bp->blk_birth == zio->io_txg &&
	BP_GET_PSIZE(bp) == psize &&
	pass >= zfs_sync_pass_rewrite) {
	VERIFY3U(psize, !=, 0);
	enum zio_stage gang_stages = zio->io_pipeline & ZIO_GANG_STAGES;

	zio->io_pipeline = ZIO_REWRITE_PIPELINE \| gang_stages;
	zio->io_flags \|= ZIO_FLAG_IO_REWRITE;
	} else {
	BP_ZERO(bp);
	zio->io_pipeline = ZIO_WRITE_PIPELINE;
	}

	if (psize == 0) {
	if (zio->io_bp_orig.blk_birth != 0 &&
	spa_feature_is_active(spa, SPA_FEATURE_HOLE_BIRTH)) {
	BP_SET_LSIZE(bp, lsize);
	BP_SET_TYPE(bp, zp->zp_type);
	BP_SET_LEVEL(bp, zp->zp_level);
	BP_SET_BIRTH(bp, zio->io_txg, 0);
	}
	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
	} else {
	ASSERT(zp->zp_checksum != ZIO_CHECKSUM_GANG_HEADER);
	BP_SET_LSIZE(bp, lsize);
	BP_SET_TYPE(bp, zp->zp_type);
	BP_SET_LEVEL(bp, zp->zp_level);
	BP_SET_PSIZE(bp, psize);
	BP_SET_COMPRESS(bp, compress);
	BP_SET_CHECKSUM(bp, zp->zp_checksum);
	BP_SET_DEDUP(bp, zp->zp_dedup);
	BP_SET_BYTEORDER(bp, ZFS_HOST_BYTEORDER);
	if (zp->zp_dedup) {
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
	ASSERT(!zp->zp_encrypt \|\|
	DMU_OT_IS_ENCRYPTED(zp->zp_type));
	zio->io_pipeline = ZIO_DDT_WRITE_PIPELINE;
	}
	if (zp->zp_nopwrite) {
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
	zio->io_pipeline \|= ZIO_STAGE_NOP_WRITE;
	}
	}
	return (zio);
	}

	static zio_t *
	zio_free_bp_init(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;

	if (zio->io_child_type == ZIO_CHILD_LOGICAL) {
	if (BP_GET_DEDUP(bp))
	zio->io_pipeline = ZIO_DDT_FREE_PIPELINE;
	}

	ASSERT3P(zio->io_bp, ==, &zio->io_bp_copy);

	return (zio);
	}

	/*
	* ==========================================================================
	* Execute the I/O pipeline
	* ==========================================================================
	*/

	static void
	zio_taskq_dispatch(zio_t *zio, zio_taskq_type_t q, boolean_t cutinline)
	{
	spa_t *spa = zio->io_spa;
	zio_type_t t = zio->io_type;
	int flags = (cutinline ? TQ_FRONT : 0);

	/*
	* If we're a config writer or a probe, the normal issue and
	* interrupt threads may all be blocked waiting for the config lock.
	* In this case, select the otherwise-unused taskq for ZIO_TYPE_NULL.
	*/
	if (zio->io_flags & (ZIO_FLAG_CONFIG_WRITER \| ZIO_FLAG_PROBE))
	t = ZIO_TYPE_NULL;

	/*
	* A similar issue exists for the L2ARC write thread until L2ARC 2.0.
	*/
	if (t == ZIO_TYPE_WRITE && zio->io_vd && zio->io_vd->vdev_aux)
	t = ZIO_TYPE_NULL;

	/*
	* If this is a high priority I/O, then use the high priority taskq if
	* available.
	*/
	if ((zio->io_priority == ZIO_PRIORITY_NOW \|\|
	zio->io_priority == ZIO_PRIORITY_SYNC_WRITE) &&
	spa->spa_zio_taskq[t][q + 1].stqs_count != 0)
	q++;

	ASSERT3U(q, <, ZIO_TASKQ_TYPES);

	/*
	* NB: We are assuming that the zio can only be dispatched
	* to a single taskq at a time. It would be a grievous error
	* to dispatch the zio to another taskq at the same time.
	*/
	ASSERT(taskq_empty_ent(&zio->io_tqent));
	spa_taskq_dispatch_ent(spa, t, q, (task_func_t *)zio_execute, zio,
	flags, &zio->io_tqent);
	}

	static boolean_t
	zio_taskq_member(zio_t *zio, zio_taskq_type_t q)
	{
	spa_t *spa = zio->io_spa;

	taskq_t *tq = taskq_of_curthread();

	for (zio_type_t t = 0; t < ZIO_TYPES; t++) {
	spa_taskqs_t *tqs = &spa->spa_zio_taskq[t][q];
	uint_t i;
	for (i = 0; i < tqs->stqs_count; i++) {
	if (tqs->stqs_taskq[i] == tq)
	return (B_TRUE);
	}
	}

	return (B_FALSE);
	}

	static zio_t *
	zio_issue_async(zio_t *zio)
	{
	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_FALSE);

	return (NULL);
	}

	void
	zio_interrupt(zio_t *zio)
	{
	zio_taskq_dispatch(zio, ZIO_TASKQ_INTERRUPT, B_FALSE);
	}

	void
	zio_delay_interrupt(zio_t *zio)
	{
	/*
	* The timeout_generic() function isn't defined in userspace, so
	* rather than trying to implement the function, the zio delay
	* functionality has been disabled for userspace builds.
	*/

	#ifdef _KERNEL
	/*
	* If io_target_timestamp is zero, then no delay has been registered
	* for this IO, thus jump to the end of this function and "skip" the
	* delay; issuing it directly to the zio layer.
	*/
	if (zio->io_target_timestamp != 0) {
	hrtime_t now = gethrtime();

	if (now >= zio->io_target_timestamp) {
	/*
	* This IO has already taken longer than the target
	* delay to complete, so we don't want to delay it
	* any longer; we "miss" the delay and issue it
	* directly to the zio layer. This is likely due to
	* the target latency being set to a value less than
	* the underlying hardware can satisfy (e.g. delay
	* set to 1ms, but the disks take 10ms to complete an
	* IO request).
	*/

	DTRACE_PROBE2(zio__delay__miss, zio_t *, zio,
	hrtime_t, now);

	zio_interrupt(zio);
	} else {
	taskqid_t tid;
	hrtime_t diff = zio->io_target_timestamp - now;
	clock_t expire_at_tick = ddi_get_lbolt() +
	NSEC_TO_TICK(diff);

	DTRACE_PROBE3(zio__delay__hit, zio_t *, zio,
	hrtime_t, now, hrtime_t, diff);

	if (NSEC_TO_TICK(diff) == 0) {
	/* Our delay is less than a jiffy - just spin */
	zfs_sleep_until(zio->io_target_timestamp);
	zio_interrupt(zio);
	} else {
	/*
	* Use taskq_dispatch_delay() in the place of
	* OpenZFS's timeout_generic().
	*/
	tid = taskq_dispatch_delay(system_taskq,
	(task_func_t *)zio_interrupt,
	zio, TQ_NOSLEEP, expire_at_tick);
	if (tid == TASKQID_INVALID) {
	/*
	* Couldn't allocate a task. Just
	* finish the zio without a delay.
	*/
	zio_interrupt(zio);
	}
	}
	}
	return;
	}
	#endif
	DTRACE_PROBE1(zio__delay__skip, zio_t *, zio);
	zio_interrupt(zio);
	}

	static void
	zio_deadman_impl(zio_t *pio, int ziodepth)
	{
	zio_t cio, cio_next;
	zio_link_t *zl = NULL;
	vdev_t *vd = pio->io_vd;

	if (zio_deadman_log_all \|\| (vd != NULL && vd->vdev_ops->vdev_op_leaf)) {
	vdev_queue_t *vq = vd ? &vd->vdev_queue : NULL;
	zbookmark_phys_t *zb = &pio->io_bookmark;
	uint64_t delta = gethrtime() - pio->io_timestamp;
	uint64_t failmode = spa_get_deadman_failmode(pio->io_spa);

	zfs_dbgmsg("slow zio[%d]: zio=%px timestamp=%llu "
	"delta=%llu queued=%llu io=%llu "
	"path=%s last=%llu "
	"type=%d priority=%d flags=0x%x "
	"stage=0x%x pipeline=0x%x pipeline-trace=0x%x "
	"objset=%llu object=%llu level=%llu blkid=%llu "
	"offset=%llu size=%llu error=%d",
	ziodepth, pio, pio->io_timestamp,
	delta, pio->io_delta, pio->io_delay,
	vd ? vd->vdev_path : "NULL", vq ? vq->vq_io_complete_ts : 0,
	pio->io_type, pio->io_priority, pio->io_flags,
	pio->io_stage, pio->io_pipeline, pio->io_pipeline_trace,
	zb->zb_objset, zb->zb_object, zb->zb_level, zb->zb_blkid,
	pio->io_offset, pio->io_size, pio->io_error);
	(void) zfs_ereport_post(FM_EREPORT_ZFS_DEADMAN,
	- pio->io_spa, vd, zb, pio, 0, 0);
	+ pio->io_spa, vd, zb, pio, 0);

	if (failmode == ZIO_FAILURE_MODE_CONTINUE &&
	taskq_empty_ent(&pio->io_tqent)) {
	zio_interrupt(pio);
	}
	}

	mutex_enter(&pio->io_lock);
	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
	cio_next = zio_walk_children(pio, &zl);
	zio_deadman_impl(cio, ziodepth + 1);
	}
	mutex_exit(&pio->io_lock);
	}

	/*
	* Log the critical information describing this zio and all of its children
	* using the zfs_dbgmsg() interface then post deadman event for the ZED.
	*/
	void
	zio_deadman(zio_t pio, char tag)
	{
	spa_t *spa = pio->io_spa;
	char *name = spa_name(spa);

	if (!zfs_deadman_enabled \|\| spa_suspended(spa))
	return;

	zio_deadman_impl(pio, 0);

	switch (spa_get_deadman_failmode(spa)) {
	case ZIO_FAILURE_MODE_WAIT:
	zfs_dbgmsg("%s waiting for hung I/O to pool '%s'", tag, name);
	break;

	case ZIO_FAILURE_MODE_CONTINUE:
	zfs_dbgmsg("%s restarting hung I/O for pool '%s'", tag, name);
	break;

	case ZIO_FAILURE_MODE_PANIC:
	fm_panic("%s determined I/O to pool '%s' is hung.", tag, name);
	break;
	}
	}

	/*
	* Execute the I/O pipeline until one of the following occurs:
	* (1) the I/O completes; (2) the pipeline stalls waiting for
	* dependent child I/Os; (3) the I/O issues, so we're waiting
	* for an I/O completion interrupt; (4) the I/O is delegated by
	* vdev-level caching or aggregation; (5) the I/O is deferred
	* due to vdev-level queueing; (6) the I/O is handed off to
	* another thread. In all cases, the pipeline stops whenever
	* there's no CPU work; it never burns a thread in cv_wait_io().
	*
	* There's no locking on io_stage because there's no legitimate way
	* for multiple threads to be attempting to process the same I/O.
	*/
	static zio_pipe_stage_t *zio_pipeline[];

	/*
	* zio_execute() is a wrapper around the static function
	* __zio_execute() so that we can force __zio_execute() to be
	* inlined. This reduces stack overhead which is important
	* because __zio_execute() is called recursively in several zio
	* code paths. zio_execute() itself cannot be inlined because
	* it is externally visible.
	*/
	void
	zio_execute(zio_t *zio)
	{
	fstrans_cookie_t cookie;

	cookie = spl_fstrans_mark();
	__zio_execute(zio);
	spl_fstrans_unmark(cookie);
	}

	/*
	* Used to determine if in the current context the stack is sized large
	* enough to allow zio_execute() to be called recursively. A minimum
	* stack size of 16K is required to avoid needing to re-dispatch the zio.
	*/
	static boolean_t
	zio_execute_stack_check(zio_t *zio)
	{
	#if !defined(HAVE_LARGE_STACKS)
	dsl_pool_t *dp = spa_get_dsl(zio->io_spa);

	/* Executing in txg_sync_thread() context. */
	if (dp && curthread == dp->dp_tx.tx_sync_thread)
	return (B_TRUE);

	/* Pool initialization outside of zio_taskq context. */
	if (dp && spa_is_initializing(dp->dp_spa) &&
	!zio_taskq_member(zio, ZIO_TASKQ_ISSUE) &&
	!zio_taskq_member(zio, ZIO_TASKQ_ISSUE_HIGH))
	return (B_TRUE);
	#endif /* HAVE_LARGE_STACKS */

	return (B_FALSE);
	}

	__attribute__((always_inline))
	static inline void
	__zio_execute(zio_t *zio)
	{
	ASSERT3U(zio->io_queued_timestamp, >, 0);

	while (zio->io_stage < ZIO_STAGE_DONE) {
	enum zio_stage pipeline = zio->io_pipeline;
	enum zio_stage stage = zio->io_stage;

	zio->io_executor = curthread;

	ASSERT(!MUTEX_HELD(&zio->io_lock));
	ASSERT(ISP2(stage));
	ASSERT(zio->io_stall == NULL);

	do {
	stage <<= 1;
	} while ((stage & pipeline) == 0);

	ASSERT(stage <= ZIO_STAGE_DONE);

	/*
	* If we are in interrupt context and this pipeline stage
	* will grab a config lock that is held across I/O,
	* or may wait for an I/O that needs an interrupt thread
	* to complete, issue async to avoid deadlock.
	*
	* For VDEV_IO_START, we cut in line so that the io will
	* be sent to disk promptly.
	*/
	if ((stage & ZIO_BLOCKING_STAGES) && zio->io_vd == NULL &&
	zio_taskq_member(zio, ZIO_TASKQ_INTERRUPT)) {
	boolean_t cut = (stage == ZIO_STAGE_VDEV_IO_START) ?
	zio_requeue_io_start_cut_in_line : B_FALSE;
	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, cut);
	return;
	}

	/*
	* If the current context doesn't have large enough stacks
	* the zio must be issued asynchronously to prevent overflow.
	*/
	if (zio_execute_stack_check(zio)) {
	boolean_t cut = (stage == ZIO_STAGE_VDEV_IO_START) ?
	zio_requeue_io_start_cut_in_line : B_FALSE;
	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, cut);
	return;
	}

	zio->io_stage = stage;
	zio->io_pipeline_trace \|= zio->io_stage;

	/*
	* The zio pipeline stage returns the next zio to execute
	* (typically the same as this one), or NULL if we should
	* stop.
	*/
	zio = zio_pipeline[highbit64(stage) - 1](zio);

	if (zio == NULL)
	return;
	}
	}


	/*
	* ==========================================================================
	* Initiate I/O, either sync or async
	* ==========================================================================
	*/
	int
	zio_wait(zio_t *zio)
	{
	/*
	* Some routines, like zio_free_sync(), may return a NULL zio
	* to avoid the performance overhead of creating and then destroying
	* an unneeded zio. For the callers' simplicity, we accept a NULL
	* zio and ignore it.
	*/
	if (zio == NULL)
	return (0);

	long timeout = MSEC_TO_TICK(zfs_deadman_ziotime_ms);
	int error;

	ASSERT3S(zio->io_stage, ==, ZIO_STAGE_OPEN);
	ASSERT3P(zio->io_executor, ==, NULL);

	zio->io_waiter = curthread;
	ASSERT0(zio->io_queued_timestamp);
	zio->io_queued_timestamp = gethrtime();

	__zio_execute(zio);

	mutex_enter(&zio->io_lock);
	while (zio->io_executor != NULL) {
	error = cv_timedwait_io(&zio->io_cv, &zio->io_lock,
	ddi_get_lbolt() + timeout);

	if (zfs_deadman_enabled && error == -1 &&
	gethrtime() - zio->io_queued_timestamp >
	spa_deadman_ziotime(zio->io_spa)) {
	mutex_exit(&zio->io_lock);
	timeout = MSEC_TO_TICK(zfs_deadman_checktime_ms);
	zio_deadman(zio, FTAG);
	mutex_enter(&zio->io_lock);
	}
	}
	mutex_exit(&zio->io_lock);

	error = zio->io_error;
	zio_destroy(zio);

	return (error);
	}

	void
	zio_nowait(zio_t *zio)
	{
	/*
	* See comment in zio_wait().
	*/
	if (zio == NULL)
	return;

	ASSERT3P(zio->io_executor, ==, NULL);

	if (zio->io_child_type == ZIO_CHILD_LOGICAL &&
	zio_unique_parent(zio) == NULL) {
	zio_t *pio;

	/*
	* This is a logical async I/O with no parent to wait for it.
	* We add it to the spa_async_root_zio "Godfather" I/O which
	* will ensure they complete prior to unloading the pool.
	*/
	spa_t *spa = zio->io_spa;
	kpreempt_disable();
	pio = spa->spa_async_zio_root[CPU_SEQID];
	kpreempt_enable();

	zio_add_child(pio, zio);
	}

	ASSERT0(zio->io_queued_timestamp);
	zio->io_queued_timestamp = gethrtime();
	__zio_execute(zio);
	}

	/*
	* ==========================================================================
	* Reexecute, cancel, or suspend/resume failed I/O
	* ==========================================================================
	*/

	static void
	zio_reexecute(zio_t *pio)
	{
	zio_t cio, cio_next;

	ASSERT(pio->io_child_type == ZIO_CHILD_LOGICAL);
	ASSERT(pio->io_orig_stage == ZIO_STAGE_OPEN);
	ASSERT(pio->io_gang_leader == NULL);
	ASSERT(pio->io_gang_tree == NULL);

	pio->io_flags = pio->io_orig_flags;
	pio->io_stage = pio->io_orig_stage;
	pio->io_pipeline = pio->io_orig_pipeline;
	pio->io_reexecute = 0;
	pio->io_flags \|= ZIO_FLAG_REEXECUTED;
	pio->io_pipeline_trace = 0;
	pio->io_error = 0;
	for (int w = 0; w < ZIO_WAIT_TYPES; w++)
	pio->io_state[w] = 0;
	for (int c = 0; c < ZIO_CHILD_TYPES; c++)
	pio->io_child_error[c] = 0;

	if (IO_IS_ALLOCATING(pio))
	BP_ZERO(pio->io_bp);

	/*
	* As we reexecute pio's children, new children could be created.
	* New children go to the head of pio's io_child_list, however,
	* so we will (correctly) not reexecute them. The key is that
	* the remainder of pio's io_child_list, from 'cio_next' onward,
	* cannot be affected by any side effects of reexecuting 'cio'.
	*/
	zio_link_t *zl = NULL;
	mutex_enter(&pio->io_lock);
	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
	cio_next = zio_walk_children(pio, &zl);
	for (int w = 0; w < ZIO_WAIT_TYPES; w++)
	pio->io_children[cio->io_child_type][w]++;
	mutex_exit(&pio->io_lock);
	zio_reexecute(cio);
	mutex_enter(&pio->io_lock);
	}
	mutex_exit(&pio->io_lock);

	/*
	* Now that all children have been reexecuted, execute the parent.
	* We don't reexecute "The Godfather" I/O here as it's the
	* responsibility of the caller to wait on it.
	*/
	if (!(pio->io_flags & ZIO_FLAG_GODFATHER)) {
	pio->io_queued_timestamp = gethrtime();
	__zio_execute(pio);
	}
	}

	void
	zio_suspend(spa_t spa, zio_t zio, zio_suspend_reason_t reason)
	{
	if (spa_get_failmode(spa) == ZIO_FAILURE_MODE_PANIC)
	fm_panic("Pool '%s' has encountered an uncorrectable I/O "
	"failure and the failure mode property for this pool "
	"is set to panic.", spa_name(spa));

	cmn_err(CE_WARN, "Pool '%s' has encountered an uncorrectable I/O "
	"failure and has been suspended.\n", spa_name(spa));

	(void) zfs_ereport_post(FM_EREPORT_ZFS_IO_FAILURE, spa, NULL,
	- NULL, NULL, 0, 0);
	+ NULL, NULL, 0);

	mutex_enter(&spa->spa_suspend_lock);

	if (spa->spa_suspend_zio_root == NULL)
	spa->spa_suspend_zio_root = zio_root(spa, NULL, NULL,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE \|
	ZIO_FLAG_GODFATHER);

	spa->spa_suspended = reason;

	if (zio != NULL) {
	ASSERT(!(zio->io_flags & ZIO_FLAG_GODFATHER));
	ASSERT(zio != spa->spa_suspend_zio_root);
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);
	ASSERT(zio_unique_parent(zio) == NULL);
	ASSERT(zio->io_stage == ZIO_STAGE_DONE);
	zio_add_child(spa->spa_suspend_zio_root, zio);
	}

	mutex_exit(&spa->spa_suspend_lock);
	}

	int
	zio_resume(spa_t *spa)
	{
	zio_t *pio;

	/*
	* Reexecute all previously suspended i/o.
	*/
	mutex_enter(&spa->spa_suspend_lock);
	spa->spa_suspended = ZIO_SUSPEND_NONE;
	cv_broadcast(&spa->spa_suspend_cv);
	pio = spa->spa_suspend_zio_root;
	spa->spa_suspend_zio_root = NULL;
	mutex_exit(&spa->spa_suspend_lock);

	if (pio == NULL)
	return (0);

	zio_reexecute(pio);
	return (zio_wait(pio));
	}

	void
	zio_resume_wait(spa_t *spa)
	{
	mutex_enter(&spa->spa_suspend_lock);
	while (spa_suspended(spa))
	cv_wait(&spa->spa_suspend_cv, &spa->spa_suspend_lock);
	mutex_exit(&spa->spa_suspend_lock);
	}

	/*
	* ==========================================================================
	* Gang blocks.
	*
	* A gang block is a collection of small blocks that looks to the DMU
	* like one large block. When zio_dva_allocate() cannot find a block
	* of the requested size, due to either severe fragmentation or the pool
	* being nearly full, it calls zio_write_gang_block() to construct the
	* block from smaller fragments.
	*
	* A gang block consists of a gang header (zio_gbh_phys_t) and up to
	* three (SPA_GBH_NBLKPTRS) gang members. The gang header is just like
	* an indirect block: it's an array of block pointers. It consumes
	* only one sector and hence is allocatable regardless of fragmentation.
	* The gang header's bps point to its gang members, which hold the data.
	*
	* Gang blocks are self-checksumming, using the bp's <vdev, offset, txg>
	* as the verifier to ensure uniqueness of the SHA256 checksum.
	* Critically, the gang block bp's blk_cksum is the checksum of the data,
	* not the gang header. This ensures that data block signatures (needed for
	* deduplication) are independent of how the block is physically stored.
	*
	* Gang blocks can be nested: a gang member may itself be a gang block.
	* Thus every gang block is a tree in which root and all interior nodes are
	* gang headers, and the leaves are normal blocks that contain user data.
	* The root of the gang tree is called the gang leader.
	*
	* To perform any operation (read, rewrite, free, claim) on a gang block,
	* zio_gang_assemble() first assembles the gang tree (minus data leaves)
	* in the io_gang_tree field of the original logical i/o by recursively
	* reading the gang leader and all gang headers below it. This yields
	* an in-core tree containing the contents of every gang header and the
	* bps for every constituent of the gang block.
	*
	* With the gang tree now assembled, zio_gang_issue() just walks the gang tree
	* and invokes a callback on each bp. To free a gang block, zio_gang_issue()
	* calls zio_free_gang() -- a trivial wrapper around zio_free() -- for each bp.
	* zio_claim_gang() provides a similarly trivial wrapper for zio_claim().
	* zio_read_gang() is a wrapper around zio_read() that omits reading gang
	* headers, since we already have those in io_gang_tree. zio_rewrite_gang()
	* performs a zio_rewrite() of the data or, for gang headers, a zio_rewrite()
	* of the gang header plus zio_checksum_compute() of the data to update the
	* gang header's blk_cksum as described above.
	*
	* The two-phase assemble/issue model solves the problem of partial failure --
	* what if you'd freed part of a gang block but then couldn't read the
	* gang header for another part? Assembling the entire gang tree first
	* ensures that all the necessary gang header I/O has succeeded before
	* starting the actual work of free, claim, or write. Once the gang tree
	* is assembled, free and claim are in-memory operations that cannot fail.
	*
	* In the event that a gang write fails, zio_dva_unallocate() walks the
	* gang tree to immediately free (i.e. insert back into the space map)
	* everything we've allocated. This ensures that we don't get ENOSPC
	* errors during repeated suspend/resume cycles due to a flaky device.
	*
	* Gang rewrites only happen during sync-to-convergence. If we can't assemble
	* the gang tree, we won't modify the block, so we can safely defer the free
	* (knowing that the block is still intact). If we can assemble the gang
	* tree, then even if some of the rewrites fail, zio_dva_unallocate() will free
	* each constituent bp and we can allocate a new block on the next sync pass.
	*
	* In all cases, the gang tree allows complete recovery from partial failure.
	* ==========================================================================
	*/

	static void
	zio_gang_issue_func_done(zio_t *zio)
	{
	abd_put(zio->io_abd);
	}

	static zio_t *
	zio_read_gang(zio_t pio, blkptr_t bp, zio_gang_node_t gn, abd_t data,
	uint64_t offset)
	{
	if (gn != NULL)
	return (pio);

	return (zio_read(pio, pio->io_spa, bp, abd_get_offset(data, offset),
	BP_GET_PSIZE(bp), zio_gang_issue_func_done,
	NULL, pio->io_priority, ZIO_GANG_CHILD_FLAGS(pio),
	&pio->io_bookmark));
	}

	static zio_t *
	zio_rewrite_gang(zio_t pio, blkptr_t bp, zio_gang_node_t gn, abd_t data,
	uint64_t offset)
	{
	zio_t *zio;

	if (gn != NULL) {
	abd_t *gbh_abd =
	abd_get_from_buf(gn->gn_gbh, SPA_GANGBLOCKSIZE);
	zio = zio_rewrite(pio, pio->io_spa, pio->io_txg, bp,
	gbh_abd, SPA_GANGBLOCKSIZE, zio_gang_issue_func_done, NULL,
	pio->io_priority, ZIO_GANG_CHILD_FLAGS(pio),
	&pio->io_bookmark);
	/*
	* As we rewrite each gang header, the pipeline will compute
	* a new gang block header checksum for it; but no one will
	* compute a new data checksum, so we do that here. The one
	* exception is the gang leader: the pipeline already computed
	* its data checksum because that stage precedes gang assembly.
	* (Presently, nothing actually uses interior data checksums;
	* this is just good hygiene.)
	*/
	if (gn != pio->io_gang_leader->io_gang_tree) {
	abd_t *buf = abd_get_offset(data, offset);

	zio_checksum_compute(zio, BP_GET_CHECKSUM(bp),
	buf, BP_GET_PSIZE(bp));

	abd_put(buf);
	}
	/*
	* If we are here to damage data for testing purposes,
	* leave the GBH alone so that we can detect the damage.
	*/
	if (pio->io_gang_leader->io_flags & ZIO_FLAG_INDUCE_DAMAGE)
	zio->io_pipeline &= ~ZIO_VDEV_IO_STAGES;
	} else {
	zio = zio_rewrite(pio, pio->io_spa, pio->io_txg, bp,
	abd_get_offset(data, offset), BP_GET_PSIZE(bp),
	zio_gang_issue_func_done, NULL, pio->io_priority,
	ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);
	}

	return (zio);
	}

	/* ARGSUSED */
	static zio_t *
	zio_free_gang(zio_t pio, blkptr_t bp, zio_gang_node_t gn, abd_t data,
	uint64_t offset)
	{
	zio_t *zio = zio_free_sync(pio, pio->io_spa, pio->io_txg, bp,
	ZIO_GANG_CHILD_FLAGS(pio));
	if (zio == NULL) {
	zio = zio_null(pio, pio->io_spa,
	NULL, NULL, NULL, ZIO_GANG_CHILD_FLAGS(pio));
	}
	return (zio);
	}

	/* ARGSUSED */
	static zio_t *
	zio_claim_gang(zio_t pio, blkptr_t bp, zio_gang_node_t gn, abd_t data,
	uint64_t offset)
	{
	return (zio_claim(pio, pio->io_spa, pio->io_txg, bp,
	NULL, NULL, ZIO_GANG_CHILD_FLAGS(pio)));
	}

	static zio_gang_issue_func_t *zio_gang_issue_func[ZIO_TYPES] = {
	NULL,
	zio_read_gang,
	zio_rewrite_gang,
	zio_free_gang,
	zio_claim_gang,
	NULL
	};

	static void zio_gang_tree_assemble_done(zio_t *zio);

	static zio_gang_node_t *
	zio_gang_node_alloc(zio_gang_node_t **gnpp)
	{
	zio_gang_node_t *gn;

	ASSERT(*gnpp == NULL);

	gn = kmem_zalloc(sizeof (*gn), KM_SLEEP);
	gn->gn_gbh = zio_buf_alloc(SPA_GANGBLOCKSIZE);
	*gnpp = gn;

	return (gn);
	}

	static void
	zio_gang_node_free(zio_gang_node_t **gnpp)
	{
	zio_gang_node_t gn = gnpp;

	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++)
	ASSERT(gn->gn_child[g] == NULL);

	zio_buf_free(gn->gn_gbh, SPA_GANGBLOCKSIZE);
	kmem_free(gn, sizeof (*gn));
	*gnpp = NULL;
	}

	static void
	zio_gang_tree_free(zio_gang_node_t **gnpp)
	{
	zio_gang_node_t gn = gnpp;

	if (gn == NULL)
	return;

	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++)
	zio_gang_tree_free(&gn->gn_child[g]);

	zio_gang_node_free(gnpp);
	}

	static void
	zio_gang_tree_assemble(zio_t gio, blkptr_t bp, zio_gang_node_t **gnpp)
	{
	zio_gang_node_t *gn = zio_gang_node_alloc(gnpp);
	abd_t *gbh_abd = abd_get_from_buf(gn->gn_gbh, SPA_GANGBLOCKSIZE);

	ASSERT(gio->io_gang_leader == gio);
	ASSERT(BP_IS_GANG(bp));

	zio_nowait(zio_read(gio, gio->io_spa, bp, gbh_abd, SPA_GANGBLOCKSIZE,
	zio_gang_tree_assemble_done, gn, gio->io_priority,
	ZIO_GANG_CHILD_FLAGS(gio), &gio->io_bookmark));
	}

	static void
	zio_gang_tree_assemble_done(zio_t *zio)
	{
	zio_t *gio = zio->io_gang_leader;
	zio_gang_node_t *gn = zio->io_private;
	blkptr_t *bp = zio->io_bp;

	ASSERT(gio == zio_unique_parent(zio));
	ASSERT(zio->io_child_count == 0);

	if (zio->io_error)
	return;

	/* this ABD was created from a linear buf in zio_gang_tree_assemble */
	if (BP_SHOULD_BYTESWAP(bp))
	byteswap_uint64_array(abd_to_buf(zio->io_abd), zio->io_size);

	ASSERT3P(abd_to_buf(zio->io_abd), ==, gn->gn_gbh);
	ASSERT(zio->io_size == SPA_GANGBLOCKSIZE);
	ASSERT(gn->gn_gbh->zg_tail.zec_magic == ZEC_MAGIC);

	abd_put(zio->io_abd);

	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
	blkptr_t *gbp = &gn->gn_gbh->zg_blkptr[g];
	if (!BP_IS_GANG(gbp))
	continue;
	zio_gang_tree_assemble(gio, gbp, &gn->gn_child[g]);
	}
	}

	static void
	zio_gang_tree_issue(zio_t pio, zio_gang_node_t gn, blkptr_t bp, abd_t data,
	uint64_t offset)
	{
	zio_t *gio = pio->io_gang_leader;
	zio_t *zio;

	ASSERT(BP_IS_GANG(bp) == !!gn);
	ASSERT(BP_GET_CHECKSUM(bp) == BP_GET_CHECKSUM(gio->io_bp));
	ASSERT(BP_GET_LSIZE(bp) == BP_GET_PSIZE(bp) \|\| gn == gio->io_gang_tree);

	/*
	* If you're a gang header, your data is in gn->gn_gbh.
	* If you're a gang member, your data is in 'data' and gn == NULL.
	*/
	zio = zio_gang_issue_func[gio->io_type](pio, bp, gn, data, offset);

	if (gn != NULL) {
	ASSERT(gn->gn_gbh->zg_tail.zec_magic == ZEC_MAGIC);

	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
	blkptr_t *gbp = &gn->gn_gbh->zg_blkptr[g];
	if (BP_IS_HOLE(gbp))
	continue;
	zio_gang_tree_issue(zio, gn->gn_child[g], gbp, data,
	offset);
	offset += BP_GET_PSIZE(gbp);
	}
	}

	if (gn == gio->io_gang_tree)
	ASSERT3U(gio->io_size, ==, offset);

	if (zio != pio)
	zio_nowait(zio);
	}

	static zio_t *
	zio_gang_assemble(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;

	ASSERT(BP_IS_GANG(bp) && zio->io_gang_leader == NULL);
	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);

	zio->io_gang_leader = zio;

	zio_gang_tree_assemble(zio, bp, &zio->io_gang_tree);

	return (zio);
	}

	static zio_t *
	zio_gang_issue(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;

	if (zio_wait_for_children(zio, ZIO_CHILD_GANG_BIT, ZIO_WAIT_DONE)) {
	return (NULL);
	}

	ASSERT(BP_IS_GANG(bp) && zio->io_gang_leader == zio);
	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);

	if (zio->io_child_error[ZIO_CHILD_GANG] == 0)
	zio_gang_tree_issue(zio, zio->io_gang_tree, bp, zio->io_abd,
	0);
	else
	zio_gang_tree_free(&zio->io_gang_tree);

	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;

	return (zio);
	}

	static void
	zio_write_gang_member_ready(zio_t *zio)
	{
	zio_t *pio = zio_unique_parent(zio);
	dva_t *cdva = zio->io_bp->blk_dva;
	dva_t *pdva = pio->io_bp->blk_dva;
	uint64_t asize;
	zio_t *gio __maybe_unused = zio->io_gang_leader;

	if (BP_IS_HOLE(zio->io_bp))
	return;

	ASSERT(BP_IS_HOLE(&zio->io_bp_orig));

	ASSERT(zio->io_child_type == ZIO_CHILD_GANG);
	ASSERT3U(zio->io_prop.zp_copies, ==, gio->io_prop.zp_copies);
	ASSERT3U(zio->io_prop.zp_copies, <=, BP_GET_NDVAS(zio->io_bp));
	ASSERT3U(pio->io_prop.zp_copies, <=, BP_GET_NDVAS(pio->io_bp));
	ASSERT3U(BP_GET_NDVAS(zio->io_bp), <=, BP_GET_NDVAS(pio->io_bp));

	mutex_enter(&pio->io_lock);
	for (int d = 0; d < BP_GET_NDVAS(zio->io_bp); d++) {
	ASSERT(DVA_GET_GANG(&pdva[d]));
	asize = DVA_GET_ASIZE(&pdva[d]);
	asize += DVA_GET_ASIZE(&cdva[d]);
	DVA_SET_ASIZE(&pdva[d], asize);
	}
	mutex_exit(&pio->io_lock);
	}

	static void
	zio_write_gang_done(zio_t *zio)
	{
	/*
	* The io_abd field will be NULL for a zio with no data. The io_flags
	* will initially have the ZIO_FLAG_NODATA bit flag set, but we can't
	* check for it here as it is cleared in zio_ready.
	*/
	if (zio->io_abd != NULL)
	abd_put(zio->io_abd);
	}

	static zio_t *
	zio_write_gang_block(zio_t *pio)
	{
	spa_t *spa = pio->io_spa;
	metaslab_class_t *mc = spa_normal_class(spa);
	blkptr_t *bp = pio->io_bp;
	zio_t *gio = pio->io_gang_leader;
	zio_t *zio;
	zio_gang_node_t gn, *gnpp;
	zio_gbh_phys_t *gbh;
	abd_t *gbh_abd;
	uint64_t txg = pio->io_txg;
	uint64_t resid = pio->io_size;
	uint64_t lsize;
	int copies = gio->io_prop.zp_copies;
	int gbh_copies;
	zio_prop_t zp;
	int error;
	boolean_t has_data = !(pio->io_flags & ZIO_FLAG_NODATA);

	/*
	* encrypted blocks need DVA[2] free so encrypted gang headers can't
	* have a third copy.
	*/
	gbh_copies = MIN(copies + 1, spa_max_replication(spa));
	if (gio->io_prop.zp_encrypt && gbh_copies >= SPA_DVAS_PER_BP)
	gbh_copies = SPA_DVAS_PER_BP - 1;

	int flags = METASLAB_HINTBP_FAVOR \| METASLAB_GANG_HEADER;
	if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
	ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
	ASSERT(has_data);

	flags \|= METASLAB_ASYNC_ALLOC;
	VERIFY(zfs_refcount_held(&mc->mc_alloc_slots[pio->io_allocator],
	pio));

	/*
	* The logical zio has already placed a reservation for
	* 'copies' allocation slots but gang blocks may require
	* additional copies. These additional copies
	* (i.e. gbh_copies - copies) are guaranteed to succeed
	* since metaslab_class_throttle_reserve() always allows
	* additional reservations for gang blocks.
	*/
	VERIFY(metaslab_class_throttle_reserve(mc, gbh_copies - copies,
	pio->io_allocator, pio, flags));
	}

	error = metaslab_alloc(spa, mc, SPA_GANGBLOCKSIZE,
	bp, gbh_copies, txg, pio == gio ? NULL : gio->io_bp, flags,
	&pio->io_alloc_list, pio, pio->io_allocator);
	if (error) {
	if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
	ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
	ASSERT(has_data);

	/*
	* If we failed to allocate the gang block header then
	* we remove any additional allocation reservations that
	* we placed here. The original reservation will
	* be removed when the logical I/O goes to the ready
	* stage.
	*/
	metaslab_class_throttle_unreserve(mc,
	gbh_copies - copies, pio->io_allocator, pio);
	}

	pio->io_error = error;
	return (pio);
	}

	if (pio == gio) {
	gnpp = &gio->io_gang_tree;
	} else {
	gnpp = pio->io_private;
	ASSERT(pio->io_ready == zio_write_gang_member_ready);
	}

	gn = zio_gang_node_alloc(gnpp);
	gbh = gn->gn_gbh;
	bzero(gbh, SPA_GANGBLOCKSIZE);
	gbh_abd = abd_get_from_buf(gbh, SPA_GANGBLOCKSIZE);

	/*
	* Create the gang header.
	*/
	zio = zio_rewrite(pio, spa, txg, bp, gbh_abd, SPA_GANGBLOCKSIZE,
	zio_write_gang_done, NULL, pio->io_priority,
	ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);

	/*
	* Create and nowait the gang children.
	*/
	for (int g = 0; resid != 0; resid -= lsize, g++) {
	lsize = P2ROUNDUP(resid / (SPA_GBH_NBLKPTRS - g),
	SPA_MINBLOCKSIZE);
	ASSERT(lsize >= SPA_MINBLOCKSIZE && lsize <= resid);

	zp.zp_checksum = gio->io_prop.zp_checksum;
	zp.zp_compress = ZIO_COMPRESS_OFF;
	zp.zp_complevel = gio->io_prop.zp_complevel;
	zp.zp_type = DMU_OT_NONE;
	zp.zp_level = 0;
	zp.zp_copies = gio->io_prop.zp_copies;
	zp.zp_dedup = B_FALSE;
	zp.zp_dedup_verify = B_FALSE;
	zp.zp_nopwrite = B_FALSE;
	zp.zp_encrypt = gio->io_prop.zp_encrypt;
	zp.zp_byteorder = gio->io_prop.zp_byteorder;
	bzero(zp.zp_salt, ZIO_DATA_SALT_LEN);
	bzero(zp.zp_iv, ZIO_DATA_IV_LEN);
	bzero(zp.zp_mac, ZIO_DATA_MAC_LEN);

	zio_t *cio = zio_write(zio, spa, txg, &gbh->zg_blkptr[g],
	has_data ? abd_get_offset(pio->io_abd, pio->io_size -
	resid) : NULL, lsize, lsize, &zp,
	zio_write_gang_member_ready, NULL, NULL,
	zio_write_gang_done, &gn->gn_child[g], pio->io_priority,
	ZIO_GANG_CHILD_FLAGS(pio), &pio->io_bookmark);

	if (pio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
	ASSERT(pio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
	ASSERT(has_data);

	/*
	* Gang children won't throttle but we should
	* account for their work, so reserve an allocation
	* slot for them here.
	*/
	VERIFY(metaslab_class_throttle_reserve(mc,
	zp.zp_copies, cio->io_allocator, cio, flags));
	}
	zio_nowait(cio);
	}

	/*
	* Set pio's pipeline to just wait for zio to finish.
	*/
	pio->io_pipeline = ZIO_INTERLOCK_PIPELINE;

	/*
	* We didn't allocate this bp, so make sure it doesn't get unmarked.
	*/
	pio->io_flags &= ~ZIO_FLAG_FASTWRITE;

	zio_nowait(zio);

	return (pio);
	}

	/*
	* The zio_nop_write stage in the pipeline determines if allocating a
	* new bp is necessary. The nopwrite feature can handle writes in
	* either syncing or open context (i.e. zil writes) and as a result is
	* mutually exclusive with dedup.
	*
	* By leveraging a cryptographically secure checksum, such as SHA256, we
	* can compare the checksums of the new data and the old to determine if
	* allocating a new block is required. Note that our requirements for
	* cryptographic strength are fairly weak: there can't be any accidental
	* hash collisions, but we don't need to be secure against intentional
	* (malicious) collisions. To trigger a nopwrite, you have to be able
	* to write the file to begin with, and triggering an incorrect (hash
	* collision) nopwrite is no worse than simply writing to the file.
	* That said, there are no known attacks against the checksum algorithms
	* used for nopwrite, assuming that the salt and the checksums
	* themselves remain secret.
	*/
	static zio_t *
	zio_nop_write(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;
	blkptr_t *bp_orig = &zio->io_bp_orig;
	zio_prop_t *zp = &zio->io_prop;

	ASSERT(BP_GET_LEVEL(bp) == 0);
	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REWRITE));
	ASSERT(zp->zp_nopwrite);
	ASSERT(!zp->zp_dedup);
	ASSERT(zio->io_bp_override == NULL);
	ASSERT(IO_IS_ALLOCATING(zio));

	/*
	* Check to see if the original bp and the new bp have matching
	* characteristics (i.e. same checksum, compression algorithms, etc).
	* If they don't then just continue with the pipeline which will
	* allocate a new bp.
	*/
	if (BP_IS_HOLE(bp_orig) \|\|
	!(zio_checksum_table[BP_GET_CHECKSUM(bp)].ci_flags &
	ZCHECKSUM_FLAG_NOPWRITE) \|\|
	BP_IS_ENCRYPTED(bp) \|\| BP_IS_ENCRYPTED(bp_orig) \|\|
	BP_GET_CHECKSUM(bp) != BP_GET_CHECKSUM(bp_orig) \|\|
	BP_GET_COMPRESS(bp) != BP_GET_COMPRESS(bp_orig) \|\|
	BP_GET_DEDUP(bp) != BP_GET_DEDUP(bp_orig) \|\|
	zp->zp_copies != BP_GET_NDVAS(bp_orig))
	return (zio);

	/*
	* If the checksums match then reset the pipeline so that we
	* avoid allocating a new bp and issuing any I/O.
	*/
	if (ZIO_CHECKSUM_EQUAL(bp->blk_cksum, bp_orig->blk_cksum)) {
	ASSERT(zio_checksum_table[zp->zp_checksum].ci_flags &
	ZCHECKSUM_FLAG_NOPWRITE);
	ASSERT3U(BP_GET_PSIZE(bp), ==, BP_GET_PSIZE(bp_orig));
	ASSERT3U(BP_GET_LSIZE(bp), ==, BP_GET_LSIZE(bp_orig));
	ASSERT(zp->zp_compress != ZIO_COMPRESS_OFF);
	ASSERT(bcmp(&bp->blk_prop, &bp_orig->blk_prop,
	sizeof (uint64_t)) == 0);

	/*
	* If we're overwriting a block that is currently on an
	* indirect vdev, then ignore the nopwrite request and
	* allow a new block to be allocated on a concrete vdev.
	*/
	spa_config_enter(zio->io_spa, SCL_VDEV, FTAG, RW_READER);
	vdev_t *tvd = vdev_lookup_top(zio->io_spa,
	DVA_GET_VDEV(&bp->blk_dva[0]));
	if (tvd->vdev_ops == &vdev_indirect_ops) {
	spa_config_exit(zio->io_spa, SCL_VDEV, FTAG);
	return (zio);
	}
	spa_config_exit(zio->io_spa, SCL_VDEV, FTAG);

	bp = bp_orig;
	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;
	zio->io_flags \|= ZIO_FLAG_NOPWRITE;
	}

	return (zio);
	}

	/*
	* ==========================================================================
	* Dedup
	* ==========================================================================
	*/
	static void
	zio_ddt_child_read_done(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;
	ddt_entry_t *dde = zio->io_private;
	ddt_phys_t *ddp;
	zio_t *pio = zio_unique_parent(zio);

	mutex_enter(&pio->io_lock);
	ddp = ddt_phys_select(dde, bp);
	if (zio->io_error == 0)
	ddt_phys_clear(ddp); /* this ddp doesn't need repair */

	if (zio->io_error == 0 && dde->dde_repair_abd == NULL)
	dde->dde_repair_abd = zio->io_abd;
	else
	abd_free(zio->io_abd);
	mutex_exit(&pio->io_lock);
	}

	static zio_t *
	zio_ddt_read_start(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;

	ASSERT(BP_GET_DEDUP(bp));
	ASSERT(BP_GET_PSIZE(bp) == zio->io_size);
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);

	if (zio->io_child_error[ZIO_CHILD_DDT]) {
	ddt_t *ddt = ddt_select(zio->io_spa, bp);
	ddt_entry_t *dde = ddt_repair_start(ddt, bp);
	ddt_phys_t *ddp = dde->dde_phys;
	ddt_phys_t *ddp_self = ddt_phys_select(dde, bp);
	blkptr_t blk;

	ASSERT(zio->io_vsd == NULL);
	zio->io_vsd = dde;

	if (ddp_self == NULL)
	return (zio);

	for (int p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
	if (ddp->ddp_phys_birth == 0 \|\| ddp == ddp_self)
	continue;
	ddt_bp_create(ddt->ddt_checksum, &dde->dde_key, ddp,
	&blk);
	zio_nowait(zio_read(zio, zio->io_spa, &blk,
	abd_alloc_for_io(zio->io_size, B_TRUE),
	zio->io_size, zio_ddt_child_read_done, dde,
	zio->io_priority, ZIO_DDT_CHILD_FLAGS(zio) \|
	ZIO_FLAG_DONT_PROPAGATE, &zio->io_bookmark));
	}
	return (zio);
	}

	zio_nowait(zio_read(zio, zio->io_spa, bp,
	zio->io_abd, zio->io_size, NULL, NULL, zio->io_priority,
	ZIO_DDT_CHILD_FLAGS(zio), &zio->io_bookmark));

	return (zio);
	}

	static zio_t *
	zio_ddt_read_done(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;

	if (zio_wait_for_children(zio, ZIO_CHILD_DDT_BIT, ZIO_WAIT_DONE)) {
	return (NULL);
	}

	ASSERT(BP_GET_DEDUP(bp));
	ASSERT(BP_GET_PSIZE(bp) == zio->io_size);
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);

	if (zio->io_child_error[ZIO_CHILD_DDT]) {
	ddt_t *ddt = ddt_select(zio->io_spa, bp);
	ddt_entry_t *dde = zio->io_vsd;
	if (ddt == NULL) {
	ASSERT(spa_load_state(zio->io_spa) != SPA_LOAD_NONE);
	return (zio);
	}
	if (dde == NULL) {
	zio->io_stage = ZIO_STAGE_DDT_READ_START >> 1;
	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_FALSE);
	return (NULL);
	}
	if (dde->dde_repair_abd != NULL) {
	abd_copy(zio->io_abd, dde->dde_repair_abd,
	zio->io_size);
	zio->io_child_error[ZIO_CHILD_DDT] = 0;
	}
	ddt_repair_done(ddt, dde);
	zio->io_vsd = NULL;
	}

	ASSERT(zio->io_vsd == NULL);

	return (zio);
	}

	static boolean_t
	zio_ddt_collision(zio_t zio, ddt_t ddt, ddt_entry_t *dde)
	{
	spa_t *spa = zio->io_spa;
	boolean_t do_raw = !!(zio->io_flags & ZIO_FLAG_RAW);

	ASSERT(!(zio->io_bp_override && do_raw));

	/*
	* Note: we compare the original data, not the transformed data,
	* because when zio->io_bp is an override bp, we will not have
	* pushed the I/O transforms. That's an important optimization
	* because otherwise we'd compress/encrypt all dmu_sync() data twice.
	* However, we should never get a raw, override zio so in these
	* cases we can compare the io_abd directly. This is useful because
	* it allows us to do dedup verification even if we don't have access
	* to the original data (for instance, if the encryption keys aren't
	* loaded).
	*/

	for (int p = DDT_PHYS_SINGLE; p <= DDT_PHYS_TRIPLE; p++) {
	zio_t *lio = dde->dde_lead_zio[p];

	if (lio != NULL && do_raw) {
	return (lio->io_size != zio->io_size \|\|
	abd_cmp(zio->io_abd, lio->io_abd) != 0);
	} else if (lio != NULL) {
	return (lio->io_orig_size != zio->io_orig_size \|\|
	abd_cmp(zio->io_orig_abd, lio->io_orig_abd) != 0);
	}
	}

	for (int p = DDT_PHYS_SINGLE; p <= DDT_PHYS_TRIPLE; p++) {
	ddt_phys_t *ddp = &dde->dde_phys[p];

	if (ddp->ddp_phys_birth != 0 && do_raw) {
	blkptr_t blk = *zio->io_bp;
	uint64_t psize;
	abd_t *tmpabd;
	int error;

	ddt_bp_fill(ddp, &blk, ddp->ddp_phys_birth);
	psize = BP_GET_PSIZE(&blk);

	if (psize != zio->io_size)
	return (B_TRUE);

	ddt_exit(ddt);

	tmpabd = abd_alloc_for_io(psize, B_TRUE);

	error = zio_wait(zio_read(NULL, spa, &blk, tmpabd,
	psize, NULL, NULL, ZIO_PRIORITY_SYNC_READ,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE \|
	ZIO_FLAG_RAW, &zio->io_bookmark));

	if (error == 0) {
	if (abd_cmp(tmpabd, zio->io_abd) != 0)
	error = SET_ERROR(ENOENT);
	}

	abd_free(tmpabd);
	ddt_enter(ddt);
	return (error != 0);
	} else if (ddp->ddp_phys_birth != 0) {
	arc_buf_t *abuf = NULL;
	arc_flags_t aflags = ARC_FLAG_WAIT;
	blkptr_t blk = *zio->io_bp;
	int error;

	ddt_bp_fill(ddp, &blk, ddp->ddp_phys_birth);

	if (BP_GET_LSIZE(&blk) != zio->io_orig_size)
	return (B_TRUE);

	ddt_exit(ddt);

	error = arc_read(NULL, spa, &blk,
	arc_getbuf_func, &abuf, ZIO_PRIORITY_SYNC_READ,
	ZIO_FLAG_CANFAIL \| ZIO_FLAG_SPECULATIVE,
	&aflags, &zio->io_bookmark);

	if (error == 0) {
	if (abd_cmp_buf(zio->io_orig_abd, abuf->b_data,
	zio->io_orig_size) != 0)
	error = SET_ERROR(ENOENT);
	arc_buf_destroy(abuf, &abuf);
	}

	ddt_enter(ddt);
	return (error != 0);
	}
	}

	return (B_FALSE);
	}

	static void
	zio_ddt_child_write_ready(zio_t *zio)
	{
	int p = zio->io_prop.zp_copies;
	ddt_t *ddt = ddt_select(zio->io_spa, zio->io_bp);
	ddt_entry_t *dde = zio->io_private;
	ddt_phys_t *ddp = &dde->dde_phys[p];
	zio_t *pio;

	if (zio->io_error)
	return;

	ddt_enter(ddt);

	ASSERT(dde->dde_lead_zio[p] == zio);

	ddt_phys_fill(ddp, zio->io_bp);

	zio_link_t *zl = NULL;
	while ((pio = zio_walk_parents(zio, &zl)) != NULL)
	ddt_bp_fill(ddp, pio->io_bp, zio->io_txg);

	ddt_exit(ddt);
	}

	static void
	zio_ddt_child_write_done(zio_t *zio)
	{
	int p = zio->io_prop.zp_copies;
	ddt_t *ddt = ddt_select(zio->io_spa, zio->io_bp);
	ddt_entry_t *dde = zio->io_private;
	ddt_phys_t *ddp = &dde->dde_phys[p];

	ddt_enter(ddt);

	ASSERT(ddp->ddp_refcnt == 0);
	ASSERT(dde->dde_lead_zio[p] == zio);
	dde->dde_lead_zio[p] = NULL;

	if (zio->io_error == 0) {
	zio_link_t *zl = NULL;
	while (zio_walk_parents(zio, &zl) != NULL)
	ddt_phys_addref(ddp);
	} else {
	ddt_phys_clear(ddp);
	}

	ddt_exit(ddt);
	}

	static zio_t *
	zio_ddt_write(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	blkptr_t *bp = zio->io_bp;
	uint64_t txg = zio->io_txg;
	zio_prop_t *zp = &zio->io_prop;
	int p = zp->zp_copies;
	zio_t *cio = NULL;
	ddt_t *ddt = ddt_select(spa, bp);
	ddt_entry_t *dde;
	ddt_phys_t *ddp;

	ASSERT(BP_GET_DEDUP(bp));
	ASSERT(BP_GET_CHECKSUM(bp) == zp->zp_checksum);
	ASSERT(BP_IS_HOLE(bp) \|\| zio->io_bp_override);
	ASSERT(!(zio->io_bp_override && (zio->io_flags & ZIO_FLAG_RAW)));

	ddt_enter(ddt);
	dde = ddt_lookup(ddt, bp, B_TRUE);
	ddp = &dde->dde_phys[p];

	if (zp->zp_dedup_verify && zio_ddt_collision(zio, ddt, dde)) {
	/*
	* If we're using a weak checksum, upgrade to a strong checksum
	* and try again. If we're already using a strong checksum,
	* we can't resolve it, so just convert to an ordinary write.
	* (And automatically e-mail a paper to Nature?)
	*/
	if (!(zio_checksum_table[zp->zp_checksum].ci_flags &
	ZCHECKSUM_FLAG_DEDUP)) {
	zp->zp_checksum = spa_dedup_checksum(spa);
	zio_pop_transforms(zio);
	zio->io_stage = ZIO_STAGE_OPEN;
	BP_ZERO(bp);
	} else {
	zp->zp_dedup = B_FALSE;
	BP_SET_DEDUP(bp, B_FALSE);
	}
	ASSERT(!BP_GET_DEDUP(bp));
	zio->io_pipeline = ZIO_WRITE_PIPELINE;
	ddt_exit(ddt);
	return (zio);
	}

	if (ddp->ddp_phys_birth != 0 \|\| dde->dde_lead_zio[p] != NULL) {
	if (ddp->ddp_phys_birth != 0)
	ddt_bp_fill(ddp, bp, txg);
	if (dde->dde_lead_zio[p] != NULL)
	zio_add_child(zio, dde->dde_lead_zio[p]);
	else
	ddt_phys_addref(ddp);
	} else if (zio->io_bp_override) {
	ASSERT(bp->blk_birth == txg);
	ASSERT(BP_EQUAL(bp, zio->io_bp_override));
	ddt_phys_fill(ddp, bp);
	ddt_phys_addref(ddp);
	} else {
	cio = zio_write(zio, spa, txg, bp, zio->io_orig_abd,
	zio->io_orig_size, zio->io_orig_size, zp,
	zio_ddt_child_write_ready, NULL, NULL,
	zio_ddt_child_write_done, dde, zio->io_priority,
	ZIO_DDT_CHILD_FLAGS(zio), &zio->io_bookmark);

	zio_push_transform(cio, zio->io_abd, zio->io_size, 0, NULL);
	dde->dde_lead_zio[p] = cio;
	}

	ddt_exit(ddt);

	zio_nowait(cio);

	return (zio);
	}

	ddt_entry_t freedde; / for debugging */

	static zio_t *
	zio_ddt_free(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	blkptr_t *bp = zio->io_bp;
	ddt_t *ddt = ddt_select(spa, bp);
	ddt_entry_t *dde;
	ddt_phys_t *ddp;

	ASSERT(BP_GET_DEDUP(bp));
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);

	ddt_enter(ddt);
	freedde = dde = ddt_lookup(ddt, bp, B_TRUE);
	if (dde) {
	ddp = ddt_phys_select(dde, bp);
	if (ddp)
	ddt_phys_decref(ddp);
	}
	ddt_exit(ddt);

	return (zio);
	}

	/*
	* ==========================================================================
	* Allocate and free blocks
	* ==========================================================================
	*/

	static zio_t *
	zio_io_to_allocate(spa_t *spa, int allocator)
	{
	zio_t *zio;

	ASSERT(MUTEX_HELD(&spa->spa_alloc_locks[allocator]));

	zio = avl_first(&spa->spa_alloc_trees[allocator]);
	if (zio == NULL)
	return (NULL);

	ASSERT(IO_IS_ALLOCATING(zio));

	/*
	* Try to place a reservation for this zio. If we're unable to
	* reserve then we throttle.
	*/
	ASSERT3U(zio->io_allocator, ==, allocator);
	if (!metaslab_class_throttle_reserve(zio->io_metaslab_class,
	zio->io_prop.zp_copies, zio->io_allocator, zio, 0)) {
	return (NULL);
	}

	avl_remove(&spa->spa_alloc_trees[allocator], zio);
	ASSERT3U(zio->io_stage, <, ZIO_STAGE_DVA_ALLOCATE);

	return (zio);
	}

	static zio_t *
	zio_dva_throttle(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	zio_t *nio;
	metaslab_class_t *mc;

	/* locate an appropriate allocation class */
	mc = spa_preferred_class(spa, zio->io_size, zio->io_prop.zp_type,
	zio->io_prop.zp_level, zio->io_prop.zp_zpl_smallblk);

	if (zio->io_priority == ZIO_PRIORITY_SYNC_WRITE \|\|
	!mc->mc_alloc_throttle_enabled \|\|
	zio->io_child_type == ZIO_CHILD_GANG \|\|
	zio->io_flags & ZIO_FLAG_NODATA) {
	return (zio);
	}

	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);

	ASSERT3U(zio->io_queued_timestamp, >, 0);
	ASSERT(zio->io_stage == ZIO_STAGE_DVA_THROTTLE);

	zbookmark_phys_t *bm = &zio->io_bookmark;
	/*
	* We want to try to use as many allocators as possible to help improve
	* performance, but we also want logically adjacent IOs to be physically
	* adjacent to improve sequential read performance. We chunk each object
	* into 2^20 block regions, and then hash based on the objset, object,
	* level, and region to accomplish both of these goals.
	*/
	zio->io_allocator = cityhash4(bm->zb_objset, bm->zb_object,
	bm->zb_level, bm->zb_blkid >> 20) % spa->spa_alloc_count;
	mutex_enter(&spa->spa_alloc_locks[zio->io_allocator]);
	ASSERT(zio->io_type == ZIO_TYPE_WRITE);
	zio->io_metaslab_class = mc;
	avl_add(&spa->spa_alloc_trees[zio->io_allocator], zio);
	nio = zio_io_to_allocate(spa, zio->io_allocator);
	mutex_exit(&spa->spa_alloc_locks[zio->io_allocator]);
	return (nio);
	}

	static void
	zio_allocate_dispatch(spa_t *spa, int allocator)
	{
	zio_t *zio;

	mutex_enter(&spa->spa_alloc_locks[allocator]);
	zio = zio_io_to_allocate(spa, allocator);
	mutex_exit(&spa->spa_alloc_locks[allocator]);
	if (zio == NULL)
	return;

	ASSERT3U(zio->io_stage, ==, ZIO_STAGE_DVA_THROTTLE);
	ASSERT0(zio->io_error);
	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE, B_TRUE);
	}

	static zio_t *
	zio_dva_allocate(zio_t *zio)
	{
	spa_t *spa = zio->io_spa;
	metaslab_class_t *mc;
	blkptr_t *bp = zio->io_bp;
	int error;
	int flags = 0;

	if (zio->io_gang_leader == NULL) {
	ASSERT(zio->io_child_type > ZIO_CHILD_GANG);
	zio->io_gang_leader = zio;
	}

	ASSERT(BP_IS_HOLE(bp));
	ASSERT0(BP_GET_NDVAS(bp));
	ASSERT3U(zio->io_prop.zp_copies, >, 0);
	ASSERT3U(zio->io_prop.zp_copies, <=, spa_max_replication(spa));
	ASSERT3U(zio->io_size, ==, BP_GET_PSIZE(bp));

	flags \|= (zio->io_flags & ZIO_FLAG_FASTWRITE) ? METASLAB_FASTWRITE : 0;
	if (zio->io_flags & ZIO_FLAG_NODATA)
	flags \|= METASLAB_DONT_THROTTLE;
	if (zio->io_flags & ZIO_FLAG_GANG_CHILD)
	flags \|= METASLAB_GANG_CHILD;
	if (zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE)
	flags \|= METASLAB_ASYNC_ALLOC;

	/*
	* if not already chosen, locate an appropriate allocation class
	*/
	mc = zio->io_metaslab_class;
	if (mc == NULL) {
	mc = spa_preferred_class(spa, zio->io_size,
	zio->io_prop.zp_type, zio->io_prop.zp_level,
	zio->io_prop.zp_zpl_smallblk);
	zio->io_metaslab_class = mc;
	}

	error = metaslab_alloc(spa, mc, zio->io_size, bp,
	zio->io_prop.zp_copies, zio->io_txg, NULL, flags,
	&zio->io_alloc_list, zio, zio->io_allocator);

	/*
	* Fallback to normal class when an alloc class is full
	*/
	if (error == ENOSPC && mc != spa_normal_class(spa)) {
	/*
	* If throttling, transfer reservation over to normal class.
	* The io_allocator slot can remain the same even though we
	* are switching classes.
	*/
	if (mc->mc_alloc_throttle_enabled &&
	(zio->io_flags & ZIO_FLAG_IO_ALLOCATING)) {
	metaslab_class_throttle_unreserve(mc,
	zio->io_prop.zp_copies, zio->io_allocator, zio);
	zio->io_flags &= ~ZIO_FLAG_IO_ALLOCATING;

	mc = spa_normal_class(spa);
	VERIFY(metaslab_class_throttle_reserve(mc,
	zio->io_prop.zp_copies, zio->io_allocator, zio,
	flags \| METASLAB_MUST_RESERVE));
	} else {
	mc = spa_normal_class(spa);
	}
	zio->io_metaslab_class = mc;

	error = metaslab_alloc(spa, mc, zio->io_size, bp,
	zio->io_prop.zp_copies, zio->io_txg, NULL, flags,
	&zio->io_alloc_list, zio, zio->io_allocator);
	}

	if (error != 0) {
	zfs_dbgmsg("%s: metaslab allocation failure: zio %px, "
	"size %llu, error %d", spa_name(spa), zio, zio->io_size,
	error);
	if (error == ENOSPC && zio->io_size > SPA_MINBLOCKSIZE)
	return (zio_write_gang_block(zio));
	zio->io_error = error;
	}

	return (zio);
	}

	static zio_t *
	zio_dva_free(zio_t *zio)
	{
	metaslab_free(zio->io_spa, zio->io_bp, zio->io_txg, B_FALSE);

	return (zio);
	}

	static zio_t *
	zio_dva_claim(zio_t *zio)
	{
	int error;

	error = metaslab_claim(zio->io_spa, zio->io_bp, zio->io_txg);
	if (error)
	zio->io_error = error;

	return (zio);
	}

	/*
	* Undo an allocation. This is used by zio_done() when an I/O fails
	* and we want to give back the block we just allocated.
	* This handles both normal blocks and gang blocks.
	*/
	static void
	zio_dva_unallocate(zio_t zio, zio_gang_node_t gn, blkptr_t *bp)
	{
	ASSERT(bp->blk_birth == zio->io_txg \|\| BP_IS_HOLE(bp));
	ASSERT(zio->io_bp_override == NULL);

	if (!BP_IS_HOLE(bp))
	metaslab_free(zio->io_spa, bp, bp->blk_birth, B_TRUE);

	if (gn != NULL) {
	for (int g = 0; g < SPA_GBH_NBLKPTRS; g++) {
	zio_dva_unallocate(zio, gn->gn_child[g],
	&gn->gn_gbh->zg_blkptr[g]);
	}
	}
	}

	/*
	* Try to allocate an intent log block. Return 0 on success, errno on failure.
	*/
	int
	zio_alloc_zil(spa_t spa, objset_t os, uint64_t txg, blkptr_t *new_bp,
	uint64_t size, boolean_t *slog)
	{
	int error = 1;
	zio_alloc_list_t io_alloc_list;

	ASSERT(txg > spa_syncing_txg(spa));

	metaslab_trace_init(&io_alloc_list);

	/*
	* Block pointer fields are useful to metaslabs for stats and debugging.
	* Fill in the obvious ones before calling into metaslab_alloc().
	*/
	BP_SET_TYPE(new_bp, DMU_OT_INTENT_LOG);
	BP_SET_PSIZE(new_bp, size);
	BP_SET_LEVEL(new_bp, 0);

	/*
	* When allocating a zil block, we don't have information about
	* the final destination of the block except the objset it's part
	* of, so we just hash the objset ID to pick the allocator to get
	* some parallelism.
	*/
	error = metaslab_alloc(spa, spa_log_class(spa), size, new_bp, 1,
	txg, NULL, METASLAB_FASTWRITE, &io_alloc_list, NULL,
	cityhash4(0, 0, 0, os->os_dsl_dataset->ds_object) %
	spa->spa_alloc_count);
	if (error == 0) {
	*slog = TRUE;
	} else {
	error = metaslab_alloc(spa, spa_normal_class(spa), size,
	new_bp, 1, txg, NULL, METASLAB_FASTWRITE,
	&io_alloc_list, NULL, cityhash4(0, 0, 0,
	os->os_dsl_dataset->ds_object) % spa->spa_alloc_count);
	if (error == 0)
	*slog = FALSE;
	}
	metaslab_trace_fini(&io_alloc_list);

	if (error == 0) {
	BP_SET_LSIZE(new_bp, size);
	BP_SET_PSIZE(new_bp, size);
	BP_SET_COMPRESS(new_bp, ZIO_COMPRESS_OFF);
	BP_SET_CHECKSUM(new_bp,
	spa_version(spa) >= SPA_VERSION_SLIM_ZIL
	? ZIO_CHECKSUM_ZILOG2 : ZIO_CHECKSUM_ZILOG);
	BP_SET_TYPE(new_bp, DMU_OT_INTENT_LOG);
	BP_SET_LEVEL(new_bp, 0);
	BP_SET_DEDUP(new_bp, 0);
	BP_SET_BYTEORDER(new_bp, ZFS_HOST_BYTEORDER);

	/*
	* encrypted blocks will require an IV and salt. We generate
	* these now since we will not be rewriting the bp at
	* rewrite time.
	*/
	if (os->os_encrypted) {
	uint8_t iv[ZIO_DATA_IV_LEN];
	uint8_t salt[ZIO_DATA_SALT_LEN];

	BP_SET_CRYPT(new_bp, B_TRUE);
	VERIFY0(spa_crypt_get_salt(spa,
	dmu_objset_id(os), salt));
	VERIFY0(zio_crypt_generate_iv(iv));

	zio_crypt_encode_params_bp(new_bp, salt, iv);
	}
	} else {
	zfs_dbgmsg("%s: zil block allocation failure: "
	"size %llu, error %d", spa_name(spa), size, error);
	}

	return (error);
	}

	/*
	* ==========================================================================
	* Read and write to physical devices
	* ==========================================================================
	*/

	/*
	* Issue an I/O to the underlying vdev. Typically the issue pipeline
	* stops after this stage and will resume upon I/O completion.
	* However, there are instances where the vdev layer may need to
	* continue the pipeline when an I/O was not issued. Since the I/O
	* that was sent to the vdev layer might be different than the one
	* currently active in the pipeline (see vdev_queue_io()), we explicitly
	* force the underlying vdev layers to call either zio_execute() or
	* zio_interrupt() to ensure that the pipeline continues with the correct I/O.
	*/
	static zio_t *
	zio_vdev_io_start(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;
	uint64_t align;
	spa_t *spa = zio->io_spa;

	zio->io_delay = 0;

	ASSERT(zio->io_error == 0);
	ASSERT(zio->io_child_error[ZIO_CHILD_VDEV] == 0);

	if (vd == NULL) {
	if (!(zio->io_flags & ZIO_FLAG_CONFIG_WRITER))
	spa_config_enter(spa, SCL_ZIO, zio, RW_READER);

	/*
	* The mirror_ops handle multiple DVAs in a single BP.
	*/
	vdev_mirror_ops.vdev_op_io_start(zio);
	return (NULL);
	}

	ASSERT3P(zio->io_logical, !=, zio);
	if (zio->io_type == ZIO_TYPE_WRITE) {
	ASSERT(spa->spa_trust_config);

	/*
	* Note: the code can handle other kinds of writes,
	* but we don't expect them.
	*/
	if (zio->io_vd->vdev_removing) {
	ASSERT(zio->io_flags &
	(ZIO_FLAG_PHYSICAL \| ZIO_FLAG_SELF_HEAL \|
	ZIO_FLAG_RESILVER \| ZIO_FLAG_INDUCE_DAMAGE));
	}
	}

	align = 1ULL << vd->vdev_top->vdev_ashift;

	if (!(zio->io_flags & ZIO_FLAG_PHYSICAL) &&
	P2PHASE(zio->io_size, align) != 0) {
	/* Transform logical writes to be a full physical block size. */
	uint64_t asize = P2ROUNDUP(zio->io_size, align);
	abd_t *abuf = abd_alloc_sametype(zio->io_abd, asize);
	ASSERT(vd == vd->vdev_top);
	if (zio->io_type == ZIO_TYPE_WRITE) {
	abd_copy(abuf, zio->io_abd, zio->io_size);
	abd_zero_off(abuf, zio->io_size, asize - zio->io_size);
	}
	zio_push_transform(zio, abuf, asize, asize, zio_subblock);
	}

	/*
	* If this is not a physical io, make sure that it is properly aligned
	* before proceeding.
	*/
	if (!(zio->io_flags & ZIO_FLAG_PHYSICAL)) {
	ASSERT0(P2PHASE(zio->io_offset, align));
	ASSERT0(P2PHASE(zio->io_size, align));
	} else {
	/*
	* For physical writes, we allow 512b aligned writes and assume
	* the device will perform a read-modify-write as necessary.
	*/
	ASSERT0(P2PHASE(zio->io_offset, SPA_MINBLOCKSIZE));
	ASSERT0(P2PHASE(zio->io_size, SPA_MINBLOCKSIZE));
	}

	VERIFY(zio->io_type != ZIO_TYPE_WRITE \|\| spa_writeable(spa));

	/*
	* If this is a repair I/O, and there's no self-healing involved --
	* that is, we're just resilvering what we expect to resilver --
	* then don't do the I/O unless zio's txg is actually in vd's DTL.
	* This prevents spurious resilvering.
	*
	* There are a few ways that we can end up creating these spurious
	* resilver i/os:
	*
	* 1. A resilver i/o will be issued if any DVA in the BP has a
	* dirty DTL. The mirror code will issue resilver writes to
	* each DVA, including the one(s) that are not on vdevs with dirty
	* DTLs.
	*
	* 2. With nested replication, which happens when we have a
	* "replacing" or "spare" vdev that's a child of a mirror or raidz.
	* For example, given mirror(replacing(A+B), C), it's likely that
	* only A is out of date (it's the new device). In this case, we'll
	* read from C, then use the data to resilver A+B -- but we don't
	* actually want to resilver B, just A. The top-level mirror has no
	* way to know this, so instead we just discard unnecessary repairs
	* as we work our way down the vdev tree.
	*
	* 3. ZTEST also creates mirrors of mirrors, mirrors of raidz, etc.
	* The same logic applies to any form of nested replication: ditto
	* + mirror, RAID-Z + replacing, etc.
	*
	* However, indirect vdevs point off to other vdevs which may have
	* DTL's, so we never bypass them. The child i/os on concrete vdevs
	* will be properly bypassed instead.
	*/
	if ((zio->io_flags & ZIO_FLAG_IO_REPAIR) &&
	!(zio->io_flags & ZIO_FLAG_SELF_HEAL) &&
	zio->io_txg != 0 && /* not a delegated i/o */
	vd->vdev_ops != &vdev_indirect_ops &&
	!vdev_dtl_contains(vd, DTL_PARTIAL, zio->io_txg, 1)) {
	ASSERT(zio->io_type == ZIO_TYPE_WRITE);
	zio_vdev_io_bypass(zio);
	return (zio);
	}

	if (vd->vdev_ops->vdev_op_leaf && (zio->io_type == ZIO_TYPE_READ \|\|
	zio->io_type == ZIO_TYPE_WRITE \|\| zio->io_type == ZIO_TYPE_TRIM)) {

	if (zio->io_type == ZIO_TYPE_READ && vdev_cache_read(zio))
	return (zio);

	if ((zio = vdev_queue_io(zio)) == NULL)
	return (NULL);

	if (!vdev_accessible(vd, zio)) {
	zio->io_error = SET_ERROR(ENXIO);
	zio_interrupt(zio);
	return (NULL);
	}
	zio->io_delay = gethrtime();
	}

	vd->vdev_ops->vdev_op_io_start(zio);
	return (NULL);
	}

	static zio_t *
	zio_vdev_io_done(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;
	vdev_ops_t *ops = vd ? vd->vdev_ops : &vdev_mirror_ops;
	boolean_t unexpected_error = B_FALSE;

	if (zio_wait_for_children(zio, ZIO_CHILD_VDEV_BIT, ZIO_WAIT_DONE)) {
	return (NULL);
	}

	ASSERT(zio->io_type == ZIO_TYPE_READ \|\|
	zio->io_type == ZIO_TYPE_WRITE \|\| zio->io_type == ZIO_TYPE_TRIM);

	if (zio->io_delay)
	zio->io_delay = gethrtime() - zio->io_delay;

	if (vd != NULL && vd->vdev_ops->vdev_op_leaf) {

	vdev_queue_io_done(zio);

	if (zio->io_type == ZIO_TYPE_WRITE)
	vdev_cache_write(zio);

	if (zio_injection_enabled && zio->io_error == 0)
	zio->io_error = zio_handle_device_injections(vd, zio,
	EIO, EILSEQ);

	if (zio_injection_enabled && zio->io_error == 0)
	zio->io_error = zio_handle_label_injection(zio, EIO);

	if (zio->io_error && zio->io_type != ZIO_TYPE_TRIM) {
	if (!vdev_accessible(vd, zio)) {
	zio->io_error = SET_ERROR(ENXIO);
	} else {
	unexpected_error = B_TRUE;
	}
	}
	}

	ops->vdev_op_io_done(zio);

	if (unexpected_error)
	VERIFY(vdev_probe(vd, zio) == NULL);

	return (zio);
	}

	/*
	* This function is used to change the priority of an existing zio that is
	* currently in-flight. This is used by the arc to upgrade priority in the
	* event that a demand read is made for a block that is currently queued
	* as a scrub or async read IO. Otherwise, the high priority read request
	* would end up having to wait for the lower priority IO.
	*/
	void
	zio_change_priority(zio_t *pio, zio_priority_t priority)
	{
	zio_t cio, cio_next;
	zio_link_t *zl = NULL;

	ASSERT3U(priority, <, ZIO_PRIORITY_NUM_QUEUEABLE);

	if (pio->io_vd != NULL && pio->io_vd->vdev_ops->vdev_op_leaf) {
	vdev_queue_change_io_priority(pio, priority);
	} else {
	pio->io_priority = priority;
	}

	mutex_enter(&pio->io_lock);
	for (cio = zio_walk_children(pio, &zl); cio != NULL; cio = cio_next) {
	cio_next = zio_walk_children(pio, &zl);
	zio_change_priority(cio, priority);
	}
	mutex_exit(&pio->io_lock);
	}

	/*
	* For non-raidz ZIOs, we can just copy aside the bad data read from the
	* disk, and use that to finish the checksum ereport later.
	*/
	static void
	zio_vsd_default_cksum_finish(zio_cksum_report_t *zcr,
	const abd_t *good_buf)
	{
	/* no processing needed */
	zfs_ereport_finish_checksum(zcr, good_buf, zcr->zcr_cbdata, B_FALSE);
	}

	/ARGSUSED/
	void
	zio_vsd_default_cksum_report(zio_t zio, zio_cksum_report_t zcr, void *ignored)
	{
	void *abd = abd_alloc_sametype(zio->io_abd, zio->io_size);

	abd_copy(abd, zio->io_abd, zio->io_size);

	zcr->zcr_cbinfo = zio->io_size;
	zcr->zcr_cbdata = abd;
	zcr->zcr_finish = zio_vsd_default_cksum_finish;
	zcr->zcr_free = zio_abd_free;
	}

	static zio_t *
	zio_vdev_io_assess(zio_t *zio)
	{
	vdev_t *vd = zio->io_vd;

	if (zio_wait_for_children(zio, ZIO_CHILD_VDEV_BIT, ZIO_WAIT_DONE)) {
	return (NULL);
	}

	if (vd == NULL && !(zio->io_flags & ZIO_FLAG_CONFIG_WRITER))
	spa_config_exit(zio->io_spa, SCL_ZIO, zio);

	if (zio->io_vsd != NULL) {
	zio->io_vsd_ops->vsd_free(zio);
	zio->io_vsd = NULL;
	}

	if (zio_injection_enabled && zio->io_error == 0)
	zio->io_error = zio_handle_fault_injection(zio, EIO);

	/*
	* If the I/O failed, determine whether we should attempt to retry it.
	*
	* On retry, we cut in line in the issue queue, since we don't want
	* compression/checksumming/etc. work to prevent our (cheap) IO reissue.
	*/
	if (zio->io_error && vd == NULL &&
	!(zio->io_flags & (ZIO_FLAG_DONT_RETRY \| ZIO_FLAG_IO_RETRY))) {
	ASSERT(!(zio->io_flags & ZIO_FLAG_DONT_QUEUE)); /* not a leaf */
	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_BYPASS)); /* not a leaf */
	zio->io_error = 0;
	zio->io_flags \|= ZIO_FLAG_IO_RETRY \|
	ZIO_FLAG_DONT_CACHE \| ZIO_FLAG_DONT_AGGREGATE;
	zio->io_stage = ZIO_STAGE_VDEV_IO_START >> 1;
	zio_taskq_dispatch(zio, ZIO_TASKQ_ISSUE,
	zio_requeue_io_start_cut_in_line);
	return (NULL);
	}

	/*
	* If we got an error on a leaf device, convert it to ENXIO
	* if the device is not accessible at all.
	*/
	if (zio->io_error && vd != NULL && vd->vdev_ops->vdev_op_leaf &&
	!vdev_accessible(vd, zio))
	zio->io_error = SET_ERROR(ENXIO);

	/*
	* If we can't write to an interior vdev (mirror or RAID-Z),
	* set vdev_cant_write so that we stop trying to allocate from it.
	*/
	if (zio->io_error == ENXIO && zio->io_type == ZIO_TYPE_WRITE &&
	vd != NULL && !vd->vdev_ops->vdev_op_leaf) {
	vd->vdev_cant_write = B_TRUE;
	}

	/*
	* If a cache flush returns ENOTSUP or ENOTTY, we know that no future
	* attempts will ever succeed. In this case we set a persistent
	* boolean flag so that we don't bother with it in the future.
	*/
	if ((zio->io_error == ENOTSUP \|\| zio->io_error == ENOTTY) &&
	zio->io_type == ZIO_TYPE_IOCTL &&
	zio->io_cmd == DKIOCFLUSHWRITECACHE && vd != NULL)
	vd->vdev_nowritecache = B_TRUE;

	if (zio->io_error)
	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;

	if (vd != NULL && vd->vdev_ops->vdev_op_leaf &&
	zio->io_physdone != NULL) {
	ASSERT(!(zio->io_flags & ZIO_FLAG_DELEGATED));
	ASSERT(zio->io_child_type == ZIO_CHILD_VDEV);
	zio->io_physdone(zio->io_logical);
	}

	return (zio);
	}

	void
	zio_vdev_io_reissue(zio_t *zio)
	{
	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_START);
	ASSERT(zio->io_error == 0);

	zio->io_stage >>= 1;
	}

	void
	zio_vdev_io_redone(zio_t *zio)
	{
	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_DONE);

	zio->io_stage >>= 1;
	}

	void
	zio_vdev_io_bypass(zio_t *zio)
	{
	ASSERT(zio->io_stage == ZIO_STAGE_VDEV_IO_START);
	ASSERT(zio->io_error == 0);

	zio->io_flags \|= ZIO_FLAG_IO_BYPASS;
	zio->io_stage = ZIO_STAGE_VDEV_IO_ASSESS >> 1;
	}

	/*
	* ==========================================================================
	* Encrypt and store encryption parameters
	* ==========================================================================
	*/


	/*
	* This function is used for ZIO_STAGE_ENCRYPT. It is responsible for
	* managing the storage of encryption parameters and passing them to the
	* lower-level encryption functions.
	*/
	static zio_t *
	zio_encrypt(zio_t *zio)
	{
	zio_prop_t *zp = &zio->io_prop;
	spa_t *spa = zio->io_spa;
	blkptr_t *bp = zio->io_bp;
	uint64_t psize = BP_GET_PSIZE(bp);
	uint64_t dsobj = zio->io_bookmark.zb_objset;
	dmu_object_type_t ot = BP_GET_TYPE(bp);
	void *enc_buf = NULL;
	abd_t *eabd = NULL;
	uint8_t salt[ZIO_DATA_SALT_LEN];
	uint8_t iv[ZIO_DATA_IV_LEN];
	uint8_t mac[ZIO_DATA_MAC_LEN];
	boolean_t no_crypt = B_FALSE;

	/* the root zio already encrypted the data */
	if (zio->io_child_type == ZIO_CHILD_GANG)
	return (zio);

	/* only ZIL blocks are re-encrypted on rewrite */
	if (!IO_IS_ALLOCATING(zio) && ot != DMU_OT_INTENT_LOG)
	return (zio);

	if (!(zp->zp_encrypt \|\| BP_IS_ENCRYPTED(bp))) {
	BP_SET_CRYPT(bp, B_FALSE);
	return (zio);
	}

	/* if we are doing raw encryption set the provided encryption params */
	if (zio->io_flags & ZIO_FLAG_RAW_ENCRYPT) {
	ASSERT0(BP_GET_LEVEL(bp));
	BP_SET_CRYPT(bp, B_TRUE);
	BP_SET_BYTEORDER(bp, zp->zp_byteorder);
	if (ot != DMU_OT_OBJSET)
	zio_crypt_encode_mac_bp(bp, zp->zp_mac);

	/* dnode blocks must be written out in the provided byteorder */
	if (zp->zp_byteorder != ZFS_HOST_BYTEORDER &&
	ot == DMU_OT_DNODE) {
	void *bswap_buf = zio_buf_alloc(psize);
	abd_t *babd = abd_get_from_buf(bswap_buf, psize);

	ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
	abd_copy_to_buf(bswap_buf, zio->io_abd, psize);
	dmu_ot_byteswap[DMU_OT_BYTESWAP(ot)].ob_func(bswap_buf,
	psize);

	abd_take_ownership_of_buf(babd, B_TRUE);
	zio_push_transform(zio, babd, psize, psize, NULL);
	}

	if (DMU_OT_IS_ENCRYPTED(ot))
	zio_crypt_encode_params_bp(bp, zp->zp_salt, zp->zp_iv);
	return (zio);
	}

	/* indirect blocks only maintain a cksum of the lower level MACs */
	if (BP_GET_LEVEL(bp) > 0) {
	BP_SET_CRYPT(bp, B_TRUE);
	VERIFY0(zio_crypt_do_indirect_mac_checksum_abd(B_TRUE,
	zio->io_orig_abd, BP_GET_LSIZE(bp), BP_SHOULD_BYTESWAP(bp),
	mac));
	zio_crypt_encode_mac_bp(bp, mac);
	return (zio);
	}

	/*
	* Objset blocks are a special case since they have 2 256-bit MACs
	* embedded within them.
	*/
	if (ot == DMU_OT_OBJSET) {
	ASSERT0(DMU_OT_IS_ENCRYPTED(ot));
	ASSERT3U(BP_GET_COMPRESS(bp), ==, ZIO_COMPRESS_OFF);
	BP_SET_CRYPT(bp, B_TRUE);
	VERIFY0(spa_do_crypt_objset_mac_abd(B_TRUE, spa, dsobj,
	zio->io_abd, psize, BP_SHOULD_BYTESWAP(bp)));
	return (zio);
	}

	/* unencrypted object types are only authenticated with a MAC */
	if (!DMU_OT_IS_ENCRYPTED(ot)) {
	BP_SET_CRYPT(bp, B_TRUE);
	VERIFY0(spa_do_crypt_mac_abd(B_TRUE, spa, dsobj,
	zio->io_abd, psize, mac));
	zio_crypt_encode_mac_bp(bp, mac);
	return (zio);
	}

	/*
	* Later passes of sync-to-convergence may decide to rewrite data
	* in place to avoid more disk reallocations. This presents a problem
	* for encryption because this constitutes rewriting the new data with
	* the same encryption key and IV. However, this only applies to blocks
	* in the MOS (particularly the spacemaps) and we do not encrypt the
	* MOS. We assert that the zio is allocating or an intent log write
	* to enforce this.
	*/
	ASSERT(IO_IS_ALLOCATING(zio) \|\| ot == DMU_OT_INTENT_LOG);
	ASSERT(BP_GET_LEVEL(bp) == 0 \|\| ot == DMU_OT_INTENT_LOG);
	ASSERT(spa_feature_is_active(spa, SPA_FEATURE_ENCRYPTION));
	ASSERT3U(psize, !=, 0);

	enc_buf = zio_buf_alloc(psize);
	eabd = abd_get_from_buf(enc_buf, psize);
	abd_take_ownership_of_buf(eabd, B_TRUE);

	/*
	* For an explanation of what encryption parameters are stored
	* where, see the block comment in zio_crypt.c.
	*/
	if (ot == DMU_OT_INTENT_LOG) {
	zio_crypt_decode_params_bp(bp, salt, iv);
	} else {
	BP_SET_CRYPT(bp, B_TRUE);
	}

	/* Perform the encryption. This should not fail */
	VERIFY0(spa_do_crypt_abd(B_TRUE, spa, &zio->io_bookmark,
	BP_GET_TYPE(bp), BP_GET_DEDUP(bp), BP_SHOULD_BYTESWAP(bp),
	salt, iv, mac, psize, zio->io_abd, eabd, &no_crypt));

	/* encode encryption metadata into the bp */
	if (ot == DMU_OT_INTENT_LOG) {
	/*
	* ZIL blocks store the MAC in the embedded checksum, so the
	* transform must always be applied.
	*/
	zio_crypt_encode_mac_zil(enc_buf, mac);
	zio_push_transform(zio, eabd, psize, psize, NULL);
	} else {
	BP_SET_CRYPT(bp, B_TRUE);
	zio_crypt_encode_params_bp(bp, salt, iv);
	zio_crypt_encode_mac_bp(bp, mac);

	if (no_crypt) {
	ASSERT3U(ot, ==, DMU_OT_DNODE);
	abd_free(eabd);
	} else {
	zio_push_transform(zio, eabd, psize, psize, NULL);
	}
	}

	return (zio);
	}

	/*
	* ==========================================================================
	* Generate and verify checksums
	* ==========================================================================
	*/
	static zio_t *
	zio_checksum_generate(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;
	enum zio_checksum checksum;

	if (bp == NULL) {
	/*
	* This is zio_write_phys().
	* We're either generating a label checksum, or none at all.
	*/
	checksum = zio->io_prop.zp_checksum;

	if (checksum == ZIO_CHECKSUM_OFF)
	return (zio);

	ASSERT(checksum == ZIO_CHECKSUM_LABEL);
	} else {
	if (BP_IS_GANG(bp) && zio->io_child_type == ZIO_CHILD_GANG) {
	ASSERT(!IO_IS_ALLOCATING(zio));
	checksum = ZIO_CHECKSUM_GANG_HEADER;
	} else {
	checksum = BP_GET_CHECKSUM(bp);
	}
	}

	zio_checksum_compute(zio, checksum, zio->io_abd, zio->io_size);

	return (zio);
	}

	static zio_t *
	zio_checksum_verify(zio_t *zio)
	{
	zio_bad_cksum_t info;
	blkptr_t *bp = zio->io_bp;
	int error;

	ASSERT(zio->io_vd != NULL);

	if (bp == NULL) {
	/*
	* This is zio_read_phys().
	* We're either verifying a label checksum, or nothing at all.
	*/
	if (zio->io_prop.zp_checksum == ZIO_CHECKSUM_OFF)
	return (zio);

	ASSERT(zio->io_prop.zp_checksum == ZIO_CHECKSUM_LABEL);
	}

	if ((error = zio_checksum_error(zio, &info)) != 0) {
	zio->io_error = error;
	if (error == ECKSUM &&
	!(zio->io_flags & ZIO_FLAG_SPECULATIVE)) {
	- mutex_enter(&zio->io_vd->vdev_stat_lock);
	- zio->io_vd->vdev_stat.vs_checksum_errors++;
	- mutex_exit(&zio->io_vd->vdev_stat_lock);
	-
	- zfs_ereport_start_checksum(zio->io_spa,
	+ int ret = zfs_ereport_start_checksum(zio->io_spa,
	zio->io_vd, &zio->io_bookmark, zio,
	zio->io_offset, zio->io_size, NULL, &info);
	+
	+ if (ret != EALREADY) {
	+ mutex_enter(&zio->io_vd->vdev_stat_lock);
	+ zio->io_vd->vdev_stat.vs_checksum_errors++;
	+ mutex_exit(&zio->io_vd->vdev_stat_lock);
	+ }
	}
	}

	return (zio);
	}

	/*
	* Called by RAID-Z to ensure we don't compute the checksum twice.
	*/
	void
	zio_checksum_verified(zio_t *zio)
	{
	zio->io_pipeline &= ~ZIO_STAGE_CHECKSUM_VERIFY;
	}

	/*
	* ==========================================================================
	* Error rank. Error are ranked in the order 0, ENXIO, ECKSUM, EIO, other.
	* An error of 0 indicates success. ENXIO indicates whole-device failure,
	* which may be transient (e.g. unplugged) or permanent. ECKSUM and EIO
	* indicate errors that are specific to one I/O, and most likely permanent.
	* Any other error is presumed to be worse because we weren't expecting it.
	* ==========================================================================
	*/
	int
	zio_worst_error(int e1, int e2)
	{
	static int zio_error_rank[] = { 0, ENXIO, ECKSUM, EIO };
	int r1, r2;

	for (r1 = 0; r1 < sizeof (zio_error_rank) / sizeof (int); r1++)
	if (e1 == zio_error_rank[r1])
	break;

	for (r2 = 0; r2 < sizeof (zio_error_rank) / sizeof (int); r2++)
	if (e2 == zio_error_rank[r2])
	break;

	return (r1 > r2 ? e1 : e2);
	}

	/*
	* ==========================================================================
	* I/O completion
	* ==========================================================================
	*/
	static zio_t *
	zio_ready(zio_t *zio)
	{
	blkptr_t *bp = zio->io_bp;
	zio_t pio, pio_next;
	zio_link_t *zl = NULL;

	if (zio_wait_for_children(zio, ZIO_CHILD_GANG_BIT \| ZIO_CHILD_DDT_BIT,
	ZIO_WAIT_READY)) {
	return (NULL);
	}

	if (zio->io_ready) {
	ASSERT(IO_IS_ALLOCATING(zio));
	ASSERT(bp->blk_birth == zio->io_txg \|\| BP_IS_HOLE(bp) \|\|
	(zio->io_flags & ZIO_FLAG_NOPWRITE));
	ASSERT(zio->io_children[ZIO_CHILD_GANG][ZIO_WAIT_READY] == 0);

	zio->io_ready(zio);
	}

	if (bp != NULL && bp != &zio->io_bp_copy)
	zio->io_bp_copy = *bp;

	if (zio->io_error != 0) {
	zio->io_pipeline = ZIO_INTERLOCK_PIPELINE;

	if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
	ASSERT(IO_IS_ALLOCATING(zio));
	ASSERT(zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
	ASSERT(zio->io_metaslab_class != NULL);

	/*
	* We were unable to allocate anything, unreserve and
	* issue the next I/O to allocate.
	*/
	metaslab_class_throttle_unreserve(
	zio->io_metaslab_class, zio->io_prop.zp_copies,
	zio->io_allocator, zio);
	zio_allocate_dispatch(zio->io_spa, zio->io_allocator);
	}
	}

	mutex_enter(&zio->io_lock);
	zio->io_state[ZIO_WAIT_READY] = 1;
	pio = zio_walk_parents(zio, &zl);
	mutex_exit(&zio->io_lock);

	/*
	* As we notify zio's parents, new parents could be added.
	* New parents go to the head of zio's io_parent_list, however,
	* so we will (correctly) not notify them. The remainder of zio's
	* io_parent_list, from 'pio_next' onward, cannot change because
	* all parents must wait for us to be done before they can be done.
	*/
	for (; pio != NULL; pio = pio_next) {
	pio_next = zio_walk_parents(zio, &zl);
	zio_notify_parent(pio, zio, ZIO_WAIT_READY, NULL);
	}

	if (zio->io_flags & ZIO_FLAG_NODATA) {
	if (BP_IS_GANG(bp)) {
	zio->io_flags &= ~ZIO_FLAG_NODATA;
	} else {
	ASSERT((uintptr_t)zio->io_abd < SPA_MAXBLOCKSIZE);
	zio->io_pipeline &= ~ZIO_VDEV_IO_STAGES;
	}
	}

	if (zio_injection_enabled &&
	zio->io_spa->spa_syncing_txg == zio->io_txg)
	zio_handle_ignored_writes(zio);

	return (zio);
	}

	/*
	* Update the allocation throttle accounting.
	*/
	static void
	zio_dva_throttle_done(zio_t *zio)
	{
	zio_t *lio __maybe_unused = zio->io_logical;
	zio_t *pio = zio_unique_parent(zio);
	vdev_t *vd = zio->io_vd;
	int flags = METASLAB_ASYNC_ALLOC;

	ASSERT3P(zio->io_bp, !=, NULL);
	ASSERT3U(zio->io_type, ==, ZIO_TYPE_WRITE);
	ASSERT3U(zio->io_priority, ==, ZIO_PRIORITY_ASYNC_WRITE);
	ASSERT3U(zio->io_child_type, ==, ZIO_CHILD_VDEV);
	ASSERT(vd != NULL);
	ASSERT3P(vd, ==, vd->vdev_top);
	ASSERT(zio_injection_enabled \|\| !(zio->io_flags & ZIO_FLAG_IO_RETRY));
	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REPAIR));
	ASSERT(zio->io_flags & ZIO_FLAG_IO_ALLOCATING);
	ASSERT(!(lio->io_flags & ZIO_FLAG_IO_REWRITE));
	ASSERT(!(lio->io_orig_flags & ZIO_FLAG_NODATA));

	/*
	* Parents of gang children can have two flavors -- ones that
	* allocated the gang header (will have ZIO_FLAG_IO_REWRITE set)
	* and ones that allocated the constituent blocks. The allocation
	* throttle needs to know the allocating parent zio so we must find
	* it here.
	*/
	if (pio->io_child_type == ZIO_CHILD_GANG) {
	/*
	* If our parent is a rewrite gang child then our grandparent
	* would have been the one that performed the allocation.
	*/
	if (pio->io_flags & ZIO_FLAG_IO_REWRITE)
	pio = zio_unique_parent(pio);
	flags \|= METASLAB_GANG_CHILD;
	}

	ASSERT(IO_IS_ALLOCATING(pio));
	ASSERT3P(zio, !=, zio->io_logical);
	ASSERT(zio->io_logical != NULL);
	ASSERT(!(zio->io_flags & ZIO_FLAG_IO_REPAIR));
	ASSERT0(zio->io_flags & ZIO_FLAG_NOPWRITE);
	ASSERT(zio->io_metaslab_class != NULL);

	mutex_enter(&pio->io_lock);
	metaslab_group_alloc_decrement(zio->io_spa, vd->vdev_id, pio, flags,
	pio->io_allocator, B_TRUE);
	mutex_exit(&pio->io_lock);

	metaslab_class_throttle_unreserve(zio->io_metaslab_class, 1,
	pio->io_allocator, pio);

	/*
	* Call into the pipeline to see if there is more work that
	* needs to be done. If there is work to be done it will be
	* dispatched to another taskq thread.
	*/
	zio_allocate_dispatch(zio->io_spa, pio->io_allocator);
	}

	static zio_t *
	zio_done(zio_t *zio)
	{
	/*
	* Always attempt to keep stack usage minimal here since
	* we can be called recursively up to 19 levels deep.
	*/
	const uint64_t psize = zio->io_size;
	zio_t pio, pio_next;
	zio_link_t *zl = NULL;

	/*
	* If our children haven't all completed,
	* wait for them and then repeat this pipeline stage.
	*/
	if (zio_wait_for_children(zio, ZIO_CHILD_ALL_BITS, ZIO_WAIT_DONE)) {
	return (NULL);
	}

	/*
	* If the allocation throttle is enabled, then update the accounting.
	* We only track child I/Os that are part of an allocating async
	* write. We must do this since the allocation is performed
	* by the logical I/O but the actual write is done by child I/Os.
	*/
	if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING &&
	zio->io_child_type == ZIO_CHILD_VDEV) {
	ASSERT(zio->io_metaslab_class != NULL);
	ASSERT(zio->io_metaslab_class->mc_alloc_throttle_enabled);
	zio_dva_throttle_done(zio);
	}

	/*
	* If the allocation throttle is enabled, verify that
	* we have decremented the refcounts for every I/O that was throttled.
	*/
	if (zio->io_flags & ZIO_FLAG_IO_ALLOCATING) {
	ASSERT(zio->io_type == ZIO_TYPE_WRITE);
	ASSERT(zio->io_priority == ZIO_PRIORITY_ASYNC_WRITE);
	ASSERT(zio->io_bp != NULL);

	metaslab_group_alloc_verify(zio->io_spa, zio->io_bp, zio,
	zio->io_allocator);
	VERIFY(zfs_refcount_not_held(
	&zio->io_metaslab_class->mc_alloc_slots[zio->io_allocator],
	zio));
	}


	for (int c = 0; c < ZIO_CHILD_TYPES; c++)
	for (int w = 0; w < ZIO_WAIT_TYPES; w++)
	ASSERT(zio->io_children[c][w] == 0);

	if (zio->io_bp != NULL && !BP_IS_EMBEDDED(zio->io_bp)) {
	ASSERT(zio->io_bp->blk_pad[0] == 0);
	ASSERT(zio->io_bp->blk_pad[1] == 0);
	ASSERT(bcmp(zio->io_bp, &zio->io_bp_copy,
	sizeof (blkptr_t)) == 0 \|\|
	(zio->io_bp == zio_unique_parent(zio)->io_bp));
	if (zio->io_type == ZIO_TYPE_WRITE && !BP_IS_HOLE(zio->io_bp) &&
	zio->io_bp_override == NULL &&
	!(zio->io_flags & ZIO_FLAG_IO_REPAIR)) {
	ASSERT3U(zio->io_prop.zp_copies, <=,
	BP_GET_NDVAS(zio->io_bp));
	ASSERT(BP_COUNT_GANG(zio->io_bp) == 0 \|\|
	(BP_COUNT_GANG(zio->io_bp) ==
	BP_GET_NDVAS(zio->io_bp)));
	}
	if (zio->io_flags & ZIO_FLAG_NOPWRITE)
	VERIFY(BP_EQUAL(zio->io_bp, &zio->io_bp_orig));
	}

	/*
	* If there were child vdev/gang/ddt errors, they apply to us now.
	*/
	zio_inherit_child_errors(zio, ZIO_CHILD_VDEV);
	zio_inherit_child_errors(zio, ZIO_CHILD_GANG);
	zio_inherit_child_errors(zio, ZIO_CHILD_DDT);

	/*
	* If the I/O on the transformed data was successful, generate any
	* checksum reports now while we still have the transformed data.
	*/
	if (zio->io_error == 0) {
	while (zio->io_cksum_report != NULL) {
	zio_cksum_report_t *zcr = zio->io_cksum_report;
	uint64_t align = zcr->zcr_align;
	uint64_t asize = P2ROUNDUP(psize, align);
	abd_t *adata = zio->io_abd;

	if (asize != psize) {
	adata = abd_alloc(asize, B_TRUE);
	abd_copy(adata, zio->io_abd, psize);
	abd_zero_off(adata, psize, asize - psize);
	}

	zio->io_cksum_report = zcr->zcr_next;
	zcr->zcr_next = NULL;
	zcr->zcr_finish(zcr, adata);
	zfs_ereport_free_checksum(zcr);

	if (asize != psize)
	abd_free(adata);
	}
	}

	zio_pop_transforms(zio); /* note: may set zio->io_error */

	vdev_stat_update(zio, psize);

	/*
	* If this I/O is attached to a particular vdev is slow, exceeding
	* 30 seconds to complete, post an error described the I/O delay.
	* We ignore these errors if the device is currently unavailable.
	*/
	if (zio->io_delay >= MSEC2NSEC(zio_slow_io_ms)) {
	if (zio->io_vd != NULL && !vdev_is_dead(zio->io_vd)) {
	/*
	* We want to only increment our slow IO counters if
	* the IO is valid (i.e. not if the drive is removed).
	*
	* zfs_ereport_post() will also do these checks, but
	* it can also ratelimit and have other failures, so we
	* need to increment the slow_io counters independent
	* of it.
	*/
	if (zfs_ereport_is_valid(FM_EREPORT_ZFS_DELAY,
	zio->io_spa, zio->io_vd, zio)) {
	mutex_enter(&zio->io_vd->vdev_stat_lock);
	zio->io_vd->vdev_stat.vs_slow_ios++;
	mutex_exit(&zio->io_vd->vdev_stat_lock);

	(void) zfs_ereport_post(FM_EREPORT_ZFS_DELAY,
	zio->io_spa, zio->io_vd, &zio->io_bookmark,
	- zio, 0, 0);
	+ zio, 0);
	}
	}
	}

	if (zio->io_error) {
	/*
	* If this I/O is attached to a particular vdev,
	* generate an error message describing the I/O failure
	* at the block level. We ignore these errors if the
	* device is currently unavailable.
	*/
	if (zio->io_error != ECKSUM && zio->io_vd != NULL &&
	!vdev_is_dead(zio->io_vd)) {
	- mutex_enter(&zio->io_vd->vdev_stat_lock);
	- if (zio->io_type == ZIO_TYPE_READ) {
	- zio->io_vd->vdev_stat.vs_read_errors++;
	- } else if (zio->io_type == ZIO_TYPE_WRITE) {
	- zio->io_vd->vdev_stat.vs_write_errors++;
	+ int ret = zfs_ereport_post(FM_EREPORT_ZFS_IO,
	+ zio->io_spa, zio->io_vd, &zio->io_bookmark, zio, 0);
	+ if (ret != EALREADY) {
	+ mutex_enter(&zio->io_vd->vdev_stat_lock);
	+ if (zio->io_type == ZIO_TYPE_READ)
	+ zio->io_vd->vdev_stat.vs_read_errors++;
	+ else if (zio->io_type == ZIO_TYPE_WRITE)
	+ zio->io_vd->vdev_stat.vs_write_errors++;
	+ mutex_exit(&zio->io_vd->vdev_stat_lock);
	}
	- mutex_exit(&zio->io_vd->vdev_stat_lock);
	-
	- (void) zfs_ereport_post(FM_EREPORT_ZFS_IO, zio->io_spa,
	- zio->io_vd, &zio->io_bookmark, zio, 0, 0);
	}

	if ((zio->io_error == EIO \|\| !(zio->io_flags &
	(ZIO_FLAG_SPECULATIVE \| ZIO_FLAG_DONT_PROPAGATE))) &&
	zio == zio->io_logical) {
	/*
	* For logical I/O requests, tell the SPA to log the
	* error and generate a logical data ereport.
	*/
	spa_log_error(zio->io_spa, &zio->io_bookmark);
	(void) zfs_ereport_post(FM_EREPORT_ZFS_DATA,
	- zio->io_spa, NULL, &zio->io_bookmark, zio, 0, 0);
	+ zio->io_spa, NULL, &zio->io_bookmark, zio, 0);
	}
	}

	if (zio->io_error && zio == zio->io_logical) {
	/*
	* Determine whether zio should be reexecuted. This will
	* propagate all the way to the root via zio_notify_parent().
	*/
	ASSERT(zio->io_vd == NULL && zio->io_bp != NULL);
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);

	if (IO_IS_ALLOCATING(zio) &&
	!(zio->io_flags & ZIO_FLAG_CANFAIL)) {
	if (zio->io_error != ENOSPC)
	zio->io_reexecute \|= ZIO_REEXECUTE_NOW;
	else
	zio->io_reexecute \|= ZIO_REEXECUTE_SUSPEND;
	}

	if ((zio->io_type == ZIO_TYPE_READ \|\|
	zio->io_type == ZIO_TYPE_FREE) &&
	!(zio->io_flags & ZIO_FLAG_SCAN_THREAD) &&
	zio->io_error == ENXIO &&
	spa_load_state(zio->io_spa) == SPA_LOAD_NONE &&
	spa_get_failmode(zio->io_spa) != ZIO_FAILURE_MODE_CONTINUE)
	zio->io_reexecute \|= ZIO_REEXECUTE_SUSPEND;

	if (!(zio->io_flags & ZIO_FLAG_CANFAIL) && !zio->io_reexecute)
	zio->io_reexecute \|= ZIO_REEXECUTE_SUSPEND;

	/*
	* Here is a possibly good place to attempt to do
	* either combinatorial reconstruction or error correction
	* based on checksums. It also might be a good place
	* to send out preliminary ereports before we suspend
	* processing.
	*/
	}

	/*
	* If there were logical child errors, they apply to us now.
	* We defer this until now to avoid conflating logical child
	* errors with errors that happened to the zio itself when
	* updating vdev stats and reporting FMA events above.
	*/
	zio_inherit_child_errors(zio, ZIO_CHILD_LOGICAL);

	if ((zio->io_error \|\| zio->io_reexecute) &&
	IO_IS_ALLOCATING(zio) && zio->io_gang_leader == zio &&
	!(zio->io_flags & (ZIO_FLAG_IO_REWRITE \| ZIO_FLAG_NOPWRITE)))
	zio_dva_unallocate(zio, zio->io_gang_tree, zio->io_bp);

	zio_gang_tree_free(&zio->io_gang_tree);

	/*
	* Godfather I/Os should never suspend.
	*/
	if ((zio->io_flags & ZIO_FLAG_GODFATHER) &&
	(zio->io_reexecute & ZIO_REEXECUTE_SUSPEND))
	zio->io_reexecute &= ~ZIO_REEXECUTE_SUSPEND;

	if (zio->io_reexecute) {
	/*
	* This is a logical I/O that wants to reexecute.
	*
	* Reexecute is top-down. When an i/o fails, if it's not
	* the root, it simply notifies its parent and sticks around.
	* The parent, seeing that it still has children in zio_done(),
	* does the same. This percolates all the way up to the root.
	* The root i/o will reexecute or suspend the entire tree.
	*
	* This approach ensures that zio_reexecute() honors
	* all the original i/o dependency relationships, e.g.
	* parents not executing until children are ready.
	*/
	ASSERT(zio->io_child_type == ZIO_CHILD_LOGICAL);

	zio->io_gang_leader = NULL;

	mutex_enter(&zio->io_lock);
	zio->io_state[ZIO_WAIT_DONE] = 1;
	mutex_exit(&zio->io_lock);

	/*
	* "The Godfather" I/O monitors its children but is
	* not a true parent to them. It will track them through
	* the pipeline but severs its ties whenever they get into
	* trouble (e.g. suspended). This allows "The Godfather"
	* I/O to return status without blocking.
	*/
	zl = NULL;
	for (pio = zio_walk_parents(zio, &zl); pio != NULL;
	pio = pio_next) {
	zio_link_t *remove_zl = zl;
	pio_next = zio_walk_parents(zio, &zl);

	if ((pio->io_flags & ZIO_FLAG_GODFATHER) &&
	(zio->io_reexecute & ZIO_REEXECUTE_SUSPEND)) {
	zio_remove_child(pio, zio, remove_zl);
	/*
	* This is a rare code path, so we don't
	* bother with "next_to_execute".
	*/
	zio_notify_parent(pio, zio, ZIO_WAIT_DONE,
	NULL);
	}
	}

	if ((pio = zio_unique_parent(zio)) != NULL) {
	/*
	* We're not a root i/o, so there's nothing to do
	* but notify our parent. Don't propagate errors
	* upward since we haven't permanently failed yet.
	*/
	ASSERT(!(zio->io_flags & ZIO_FLAG_GODFATHER));
	zio->io_flags \|= ZIO_FLAG_DONT_PROPAGATE;
	/*
	* This is a rare code path, so we don't bother with
	* "next_to_execute".
	*/
	zio_notify_parent(pio, zio, ZIO_WAIT_DONE, NULL);
	} else if (zio->io_reexecute & ZIO_REEXECUTE_SUSPEND) {
	/*
	* We'd fail again if we reexecuted now, so suspend
	* until conditions improve (e.g. device comes online).
	*/
	zio_suspend(zio->io_spa, zio, ZIO_SUSPEND_IOERR);
	} else {
	/*
	* Reexecution is potentially a huge amount of work.
	* Hand it off to the otherwise-unused claim taskq.
	*/
	ASSERT(taskq_empty_ent(&zio->io_tqent));
	spa_taskq_dispatch_ent(zio->io_spa,
	ZIO_TYPE_CLAIM, ZIO_TASKQ_ISSUE,
	(task_func_t *)zio_reexecute, zio, 0,
	&zio->io_tqent);
	}
	return (NULL);
	}

	ASSERT(zio->io_child_count == 0);
	ASSERT(zio->io_reexecute == 0);
	ASSERT(zio->io_error == 0 \|\| (zio->io_flags & ZIO_FLAG_CANFAIL));

	/*
	* Report any checksum errors, since the I/O is complete.
	*/
	while (zio->io_cksum_report != NULL) {
	zio_cksum_report_t *zcr = zio->io_cksum_report;
	zio->io_cksum_report = zcr->zcr_next;
	zcr->zcr_next = NULL;
	zcr->zcr_finish(zcr, NULL);
	zfs_ereport_free_checksum(zcr);
	}

	if (zio->io_flags & ZIO_FLAG_FASTWRITE && zio->io_bp &&
	!BP_IS_HOLE(zio->io_bp) && !BP_IS_EMBEDDED(zio->io_bp) &&
	!(zio->io_flags & ZIO_FLAG_NOPWRITE)) {
	metaslab_fastwrite_unmark(zio->io_spa, zio->io_bp);
	}

	/*
	* It is the responsibility of the done callback to ensure that this
	* particular zio is no longer discoverable for adoption, and as
	* such, cannot acquire any new parents.
	*/
	if (zio->io_done)
	zio->io_done(zio);

	mutex_enter(&zio->io_lock);
	zio->io_state[ZIO_WAIT_DONE] = 1;
	mutex_exit(&zio->io_lock);

	/*
	* We are done executing this zio. We may want to execute a parent
	* next. See the comment in zio_notify_parent().
	*/
	zio_t *next_to_execute = NULL;
	zl = NULL;
	for (pio = zio_walk_parents(zio, &zl); pio != NULL; pio = pio_next) {
	zio_link_t *remove_zl = zl;
	pio_next = zio_walk_parents(zio, &zl);
	zio_remove_child(pio, zio, remove_zl);
	zio_notify_parent(pio, zio, ZIO_WAIT_DONE, &next_to_execute);
	}

	if (zio->io_waiter != NULL) {
	mutex_enter(&zio->io_lock);
	zio->io_executor = NULL;
	cv_broadcast(&zio->io_cv);
	mutex_exit(&zio->io_lock);
	} else {
	zio_destroy(zio);
	}

	return (next_to_execute);
	}

	/*
	* ==========================================================================
	* I/O pipeline definition
	* ==========================================================================
	*/
	static zio_pipe_stage_t *zio_pipeline[] = {
	NULL,
	zio_read_bp_init,
	zio_write_bp_init,
	zio_free_bp_init,
	zio_issue_async,
	zio_write_compress,
	zio_encrypt,
	zio_checksum_generate,
	zio_nop_write,
	zio_ddt_read_start,
	zio_ddt_read_done,
	zio_ddt_write,
	zio_ddt_free,
	zio_gang_assemble,
	zio_gang_issue,
	zio_dva_throttle,
	zio_dva_allocate,
	zio_dva_free,
	zio_dva_claim,
	zio_ready,
	zio_vdev_io_start,
	zio_vdev_io_done,
	zio_vdev_io_assess,
	zio_checksum_verify,
	zio_done
	};




	/*
	* Compare two zbookmark_phys_t's to see which we would reach first in a
	* pre-order traversal of the object tree.
	*
	* This is simple in every case aside from the meta-dnode object. For all other
	* objects, we traverse them in order (object 1 before object 2, and so on).
	* However, all of these objects are traversed while traversing object 0, since
	* the data it points to is the list of objects. Thus, we need to convert to a
	* canonical representation so we can compare meta-dnode bookmarks to
	* non-meta-dnode bookmarks.
	*
	* We do this by calculating "equivalents" for each field of the zbookmark.
	* zbookmarks outside of the meta-dnode use their own object and level, and
	* calculate the level 0 equivalent (the first L0 blkid that is contained in the
	* blocks this bookmark refers to) by multiplying their blkid by their span
	* (the number of L0 blocks contained within one block at their level).
	* zbookmarks inside the meta-dnode calculate their object equivalent
	* (which is L0equiv * dnodes per data block), use 0 for their L0equiv, and use
	* level + 1<<31 (any value larger than a level could ever be) for their level.
	* This causes them to always compare before a bookmark in their object
	* equivalent, compare appropriately to bookmarks in other objects, and to
	* compare appropriately to other bookmarks in the meta-dnode.
	*/
	int
	zbookmark_compare(uint16_t dbss1, uint8_t ibs1, uint16_t dbss2, uint8_t ibs2,
	const zbookmark_phys_t zb1, const zbookmark_phys_t zb2)
	{
	/*
	* These variables represent the "equivalent" values for the zbookmark,
	* after converting zbookmarks inside the meta dnode to their
	* normal-object equivalents.
	*/
	uint64_t zb1obj, zb2obj;
	uint64_t zb1L0, zb2L0;
	uint64_t zb1level, zb2level;

	if (zb1->zb_object == zb2->zb_object &&
	zb1->zb_level == zb2->zb_level &&
	zb1->zb_blkid == zb2->zb_blkid)
	return (0);

	IMPLY(zb1->zb_level > 0, ibs1 >= SPA_MINBLOCKSHIFT);
	IMPLY(zb2->zb_level > 0, ibs2 >= SPA_MINBLOCKSHIFT);

	/*
	* BP_SPANB calculates the span in blocks.
	*/
	zb1L0 = (zb1->zb_blkid) * BP_SPANB(ibs1, zb1->zb_level);
	zb2L0 = (zb2->zb_blkid) * BP_SPANB(ibs2, zb2->zb_level);

	if (zb1->zb_object == DMU_META_DNODE_OBJECT) {
	zb1obj = zb1L0 * (dbss1 << (SPA_MINBLOCKSHIFT - DNODE_SHIFT));
	zb1L0 = 0;
	zb1level = zb1->zb_level + COMPARE_META_LEVEL;
	} else {
	zb1obj = zb1->zb_object;
	zb1level = zb1->zb_level;
	}

	if (zb2->zb_object == DMU_META_DNODE_OBJECT) {
	zb2obj = zb2L0 * (dbss2 << (SPA_MINBLOCKSHIFT - DNODE_SHIFT));
	zb2L0 = 0;
	zb2level = zb2->zb_level + COMPARE_META_LEVEL;
	} else {
	zb2obj = zb2->zb_object;
	zb2level = zb2->zb_level;
	}

	/* Now that we have a canonical representation, do the comparison. */
	if (zb1obj != zb2obj)
	return (zb1obj < zb2obj ? -1 : 1);
	else if (zb1L0 != zb2L0)
	return (zb1L0 < zb2L0 ? -1 : 1);
	else if (zb1level != zb2level)
	return (zb1level > zb2level ? -1 : 1);
	/*
	* This can (theoretically) happen if the bookmarks have the same object
	* and level, but different blkids, if the block sizes are not the same.
	* There is presently no way to change the indirect block sizes
	*/
	return (0);
	}

	/*
	* This function checks the following: given that last_block is the place that
	* our traversal stopped last time, does that guarantee that we've visited
	* every node under subtree_root? Therefore, we can't just use the raw output
	* of zbookmark_compare. We have to pass in a modified version of
	* subtree_root; by incrementing the block id, and then checking whether
	* last_block is before or equal to that, we can tell whether or not having
	* visited last_block implies that all of subtree_root's children have been
	* visited.
	*/
	boolean_t
	zbookmark_subtree_completed(const dnode_phys_t *dnp,
	const zbookmark_phys_t subtree_root, const zbookmark_phys_t last_block)
	{
	zbookmark_phys_t mod_zb = *subtree_root;
	mod_zb.zb_blkid++;
	ASSERT(last_block->zb_level == 0);

	/* The objset_phys_t isn't before anything. */
	if (dnp == NULL)
	return (B_FALSE);

	/*
	* We pass in 1ULL << (DNODE_BLOCK_SHIFT - SPA_MINBLOCKSHIFT) for the
	* data block size in sectors, because that variable is only used if
	* the bookmark refers to a block in the meta-dnode. Since we don't
	* know without examining it what object it refers to, and there's no
	* harm in passing in this value in other cases, we always pass it in.
	*
	* We pass in 0 for the indirect block size shift because zb2 must be
	* level 0. The indirect block size is only used to calculate the span
	* of the bookmark, but since the bookmark must be level 0, the span is
	* always 1, so the math works out.
	*
	* If you make changes to how the zbookmark_compare code works, be sure
	* to make sure that this code still works afterwards.
	*/
	return (zbookmark_compare(dnp->dn_datablkszsec, dnp->dn_indblkshift,
	1ULL << (DNODE_BLOCK_SHIFT - SPA_MINBLOCKSHIFT), 0, &mod_zb,
	last_block) <= 0);
	}

	EXPORT_SYMBOL(zio_type_name);
	EXPORT_SYMBOL(zio_buf_alloc);
	EXPORT_SYMBOL(zio_data_buf_alloc);
	EXPORT_SYMBOL(zio_buf_free);
	EXPORT_SYMBOL(zio_data_buf_free);

	/* BEGIN CSTYLED */
	ZFS_MODULE_PARAM(zfs_zio, zio_, slow_io_ms, INT, ZMOD_RW,
	"Max I/O completion time (milliseconds) before marking it as slow");

	ZFS_MODULE_PARAM(zfs_zio, zio_, requeue_io_start_cut_in_line, INT, ZMOD_RW,
	"Prioritize requeued I/O");

	ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_deferred_free, INT, ZMOD_RW,
	"Defer frees starting in this pass");

	ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_dont_compress, INT, ZMOD_RW,
	"Don't compress starting in this pass");

	ZFS_MODULE_PARAM(zfs, zfs_, sync_pass_rewrite, INT, ZMOD_RW,
	"Rewrite new bps starting in this pass");

	ZFS_MODULE_PARAM(zfs_zio, zio_, dva_throttle_enabled, INT, ZMOD_RW,
	"Throttle block allocations in the ZIO pipeline");

	ZFS_MODULE_PARAM(zfs_zio, zio_, deadman_log_all, INT, ZMOD_RW,
	"Log all slow ZIOs, not just those with vdevs");
	/* END CSTYLED */
	Index: vendor-sys/openzfs/dist/module/zfs/zthr.c
	===================================================================
	--- vendor-sys/openzfs/dist/module/zfs/zthr.c (revision 365891)
	+++ vendor-sys/openzfs/dist/module/zfs/zthr.c (revision 365892)
	@@ -1,536 +1,536 @@
	/*
	* CDDL HEADER START
	*
	* This file and its contents are supplied under the terms of the
	* Common Development and Distribution License ("CDDL"), version 1.0.
	* You may only use this file in accordance with the terms of version
	* 1.0 of the CDDL.
	*
	* A full copy of the text of the CDDL should have accompanied this
	* source. A copy of the CDDL is also available via the Internet at
	* http://www.illumos.org/license/CDDL.
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2017, 2020 by Delphix. All rights reserved.
	*/

	/*
	* ZTHR Infrastructure
	* ===================
	*
	* ZTHR threads are used for isolated operations that span multiple txgs
	* within a SPA. They generally exist from SPA creation/loading and until
	* the SPA is exported/destroyed. The ideal requirements for an operation
	* to be modeled with a zthr are the following:
	*
	* 1] The operation needs to run over multiple txgs.
	* 2] There is be a single point of reference in memory or on disk that
	* indicates whether the operation should run/is running or has
	* stopped.
	*
	* If the operation satisfies the above then the following rules guarantee
	* a certain level of correctness:
	*
	* 1] Any thread EXCEPT the zthr changes the work indicator from stopped
	* to running but not the opposite.
	* 2] Only the zthr can change the work indicator from running to stopped
	* (e.g. when it is done) but not the opposite.
	*
	* This way a normal zthr cycle should go like this:
	*
	* 1] An external thread changes the work indicator from stopped to
	* running and wakes up the zthr.
	* 2] The zthr wakes up, checks the indicator and starts working.
	* 3] When the zthr is done, it changes the indicator to stopped, allowing
	* a new cycle to start.
	*
	* Besides being awakened by other threads, a zthr can be configured
	* during creation to wakeup on its own after a specified interval
	* [see zthr_create_timer()].
	*
	* Note: ZTHR threads are NOT a replacement for generic threads! Please
	* ensure that they fit your use-case well before using them.
	*
	* == ZTHR creation
	*
	- * Every zthr needs three inputs to start running:
	+ * Every zthr needs four inputs to start running:
	*
	* 1] A user-defined checker function (checkfunc) that decides whether
	* the zthr should start working or go to sleep. The function should
	* return TRUE when the zthr needs to work or FALSE to let it sleep,
	* and should adhere to the following signature:
	* boolean_t checkfunc_name(void args, zthr_t t);
	*
	* 2] A user-defined ZTHR function (func) which the zthr executes when
	* it is not sleeping. The function should adhere to the following
	* signature type:
	* void func_name(void args, zthr_t t);
	*
	* 3] A void args pointer that will be passed to checkfunc and func
	* implicitly by the infrastructure.
	*
	+ * 4] A name for the thread. This string must be valid for the lifetime
	+ * of the zthr.
	+ *
	* The reason why the above API needs two different functions,
	* instead of one that both checks and does the work, has to do with
	* the zthr's internal state lock (zthr_state_lock) and the allowed
	* cancellation windows. We want to hold the zthr_state_lock while
	* running checkfunc but not while running func. This way the zthr
	* can be cancelled while doing work and not while checking for work.
	*
	* To start a zthr:
	* zthr_t *zthr_pointer = zthr_create(checkfunc, func, args);
	* or
	* zthr_t *zthr_pointer = zthr_create_timer(checkfunc, func,
	* args, max_sleep);
	*
	* After that you should be able to wakeup, cancel, and resume the
	* zthr from another thread using the zthr_pointer.
	*
	* NOTE: ZTHR threads could potentially wake up spuriously and the
	* user should take this into account when writing a checkfunc.
	* [see ZTHR state transitions]
	*
	* == ZTHR wakeup
	*
	* ZTHR wakeup should be used when new work is added for the zthr. The
	* sleeping zthr will wakeup, see that it has more work to complete
	* and proceed. This can be invoked from open or syncing context.
	*
	* To wakeup a zthr:
	* zthr_wakeup(zthr_t *t)
	*
	* == ZTHR cancellation and resumption
	*
	* ZTHR threads must be cancelled when their SPA is being exported
	* or when they need to be paused so they don't interfere with other
	* operations.
	*
	* To cancel a zthr:
	* zthr_cancel(zthr_pointer);
	*
	* To resume it:
	* zthr_resume(zthr_pointer);
	*
	* ZTHR cancel and resume should be invoked in open context during the
	* lifecycle of the pool as it is imported, exported or destroyed.
	*
	* A zthr will implicitly check if it has received a cancellation
	* signal every time func returns and every time it wakes up [see
	* ZTHR state transitions below].
	*
	* At times, waiting for the zthr's func to finish its job may take
	* time. This may be very time-consuming for some operations that
	* need to cancel the SPA's zthrs (e.g spa_export). For this scenario
	* the user can explicitly make their ZTHR function aware of incoming
	* cancellation signals using zthr_iscancelled(). A common pattern for
	* that looks like this:
	*
	* int
	* func_name(void args, zthr_t t)
	* {
	* ... <unpack args> ...
	* while (!work_done && !zthr_iscancelled(t)) {
	* ... <do more work> ...
	* }
	* }
	*
	* == ZTHR cleanup
	*
	* Cancelling a zthr doesn't clean up its metadata (internal locks,
	* function pointers to func and checkfunc, etc..). This is because
	* we want to keep them around in case we want to resume the execution
	* of the zthr later. Similarly for zthrs that exit themselves.
	*
	* To completely cleanup a zthr, cancel it first to ensure that it
	* is not running and then use zthr_destroy().
	*
	* == ZTHR state transitions
	*
	* zthr creation
	* +
	* \|
	* \| woke up
	* \| +--------------+ sleep
	* \| \| ^
	* \| \| \|
	* \| \| \| FALSE
	* \| \| \|
	* v v FALSE +
	* cancelled? +---------> checkfunc?
	* + ^ +
	* \| \| \|
	* \| \| \| TRUE
	* \| \| \|
	* \| \| func returned v
	* \| +---------------+ func
	* \|
	* \| TRUE
	* \|
	* v
	* zthr stopped running
	*
	* == Implementation of ZTHR requests
	*
	* ZTHR cancel and resume are requests on a zthr to change its
	* internal state. These requests are serialized using the
	* zthr_request_lock, while changes in its internal state are
	* protected by the zthr_state_lock. A request will first acquire
	* the zthr_request_lock and then immediately acquire the
	* zthr_state_lock. We do this so that incoming requests are
	* serialized using the request lock, while still allowing us
	* to use the state lock for thread communication via zthr_cv.
	*
	* ZTHR wakeup broadcasts to zthr_cv, causing sleeping threads
	* to wakeup. It acquires the zthr_state_lock but not the
	* zthr_request_lock, so that a wakeup on a zthr in the middle
	* of being cancelled will not block.
	*/

	#include <sys/zfs_context.h>
	#include <sys/zthr.h>

	struct zthr {
	/* running thread doing the work */
	kthread_t *zthr_thread;

	/* lock protecting internal data & invariants */
	kmutex_t zthr_state_lock;

	/* mutex that serializes external requests */
	kmutex_t zthr_request_lock;

	/* notification mechanism for requests */
	kcondvar_t zthr_cv;

	/* flag set to true if we are canceling the zthr */
	boolean_t zthr_cancel;

	/* flag set to true if we are waiting for the zthr to finish */
	boolean_t zthr_haswaiters;
	kcondvar_t zthr_wait_cv;
	/*
	* maximum amount of time that the zthr is spent sleeping;
	* if this is 0, the thread doesn't wake up until it gets
	* signaled.
	*/
	hrtime_t zthr_sleep_timeout;

	/* consumer-provided callbacks & data */
	zthr_checkfunc_t *zthr_checkfunc;
	zthr_func_t *zthr_func;
	void *zthr_arg;
	+ const char *zthr_name;
	};

	static void
	zthr_procedure(void *arg)
	{
	zthr_t *t = arg;

	mutex_enter(&t->zthr_state_lock);
	ASSERT3P(t->zthr_thread, ==, curthread);

	while (!t->zthr_cancel) {
	if (t->zthr_checkfunc(t->zthr_arg, t)) {
	mutex_exit(&t->zthr_state_lock);
	t->zthr_func(t->zthr_arg, t);
	mutex_enter(&t->zthr_state_lock);
	} else {
	- /*
	- * cv_wait_sig() is used instead of cv_wait() in
	- * order to prevent this process from incorrectly
	- * contributing to the system load average when idle.
	- */
	if (t->zthr_sleep_timeout == 0) {
	- cv_wait_sig(&t->zthr_cv, &t->zthr_state_lock);
	+ cv_wait_idle(&t->zthr_cv, &t->zthr_state_lock);
	} else {
	- (void) cv_timedwait_sig_hires(&t->zthr_cv,
	+ (void) cv_timedwait_idle_hires(&t->zthr_cv,
	&t->zthr_state_lock, t->zthr_sleep_timeout,
	MSEC2NSEC(1), 0);
	}
	}
	if (t->zthr_haswaiters) {
	t->zthr_haswaiters = B_FALSE;
	cv_broadcast(&t->zthr_wait_cv);
	}
	}

	/*
	* Clear out the kernel thread metadata and notify the
	* zthr_cancel() thread that we've stopped running.
	*/
	t->zthr_thread = NULL;
	t->zthr_cancel = B_FALSE;
	cv_broadcast(&t->zthr_cv);

	mutex_exit(&t->zthr_state_lock);
	thread_exit();
	}

	zthr_t *
	zthr_create(const char zthr_name, zthr_checkfunc_t checkfunc,
	zthr_func_t func, void arg)
	{
	return (zthr_create_timer(zthr_name, checkfunc,
	func, arg, (hrtime_t)0));
	}

	/*
	* Create a zthr with specified maximum sleep time. If the time
	* in sleeping state exceeds max_sleep, a wakeup(do the check and
	* start working if required) will be triggered.
	*/
	zthr_t *
	zthr_create_timer(const char zthr_name, zthr_checkfunc_t checkfunc,
	zthr_func_t func, void arg, hrtime_t max_sleep)
	{
	zthr_t t = kmem_zalloc(sizeof (t), KM_SLEEP);
	mutex_init(&t->zthr_state_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&t->zthr_request_lock, NULL, MUTEX_DEFAULT, NULL);
	cv_init(&t->zthr_cv, NULL, CV_DEFAULT, NULL);
	cv_init(&t->zthr_wait_cv, NULL, CV_DEFAULT, NULL);

	mutex_enter(&t->zthr_state_lock);
	t->zthr_checkfunc = checkfunc;
	t->zthr_func = func;
	t->zthr_arg = arg;
	t->zthr_sleep_timeout = max_sleep;
	+ t->zthr_name = zthr_name;

	t->zthr_thread = thread_create_named(zthr_name, NULL, 0,
	zthr_procedure, t, 0, &p0, TS_RUN, minclsyspri);

	mutex_exit(&t->zthr_state_lock);

	return (t);
	}

	void
	zthr_destroy(zthr_t *t)
	{
	ASSERT(!MUTEX_HELD(&t->zthr_state_lock));
	ASSERT(!MUTEX_HELD(&t->zthr_request_lock));
	VERIFY3P(t->zthr_thread, ==, NULL);
	mutex_destroy(&t->zthr_request_lock);
	mutex_destroy(&t->zthr_state_lock);
	cv_destroy(&t->zthr_cv);
	cv_destroy(&t->zthr_wait_cv);
	kmem_free(t, sizeof (*t));
	}

	/*
	* Wake up the zthr if it is sleeping. If the thread has been cancelled
	* or is in the process of being cancelled, this is a no-op.
	*/
	void
	zthr_wakeup(zthr_t *t)
	{
	mutex_enter(&t->zthr_state_lock);

	/*
	* There are 5 states that we can find the zthr when issuing
	* this broadcast:
	*
	* [1] The common case of the thread being asleep, at which
	* point the broadcast will wake it up.
	* [2] The thread has been cancelled. Waking up a cancelled
	* thread is a no-op. Any work that is still left to be
	* done should be handled the next time the thread is
	* resumed.
	* [3] The thread is doing work and is already up, so this
	* is basically a no-op.
	* [4] The thread was just created/resumed, in which case the
	* behavior is similar to [3].
	* [5] The thread is in the middle of being cancelled, which
	* will be a no-op.
	*/
	cv_broadcast(&t->zthr_cv);

	mutex_exit(&t->zthr_state_lock);
	}

	/*
	* Sends a cancel request to the zthr and blocks until the zthr is
	* cancelled. If the zthr is not running (e.g. has been cancelled
	* already), this is a no-op. Note that this function should not be
	* called from syncing context as it could deadlock with the zthr_func.
	*/
	void
	zthr_cancel(zthr_t *t)
	{
	mutex_enter(&t->zthr_request_lock);
	mutex_enter(&t->zthr_state_lock);

	/*
	* Since we are holding the zthr_state_lock at this point
	* we can find the state in one of the following 4 states:
	*
	* [1] The thread has already been cancelled, therefore
	* there is nothing for us to do.
	* [2] The thread is sleeping so we set the flag, broadcast
	* the CV and wait for it to exit.
	* [3] The thread is doing work, in which case we just set
	* the flag and wait for it to finish.
	* [4] The thread was just created/resumed, in which case
	* the behavior is similar to [3].
	*
	* Since requests are serialized, by the time that we get
	* control back we expect that the zthr is cancelled and
	* not running anymore.
	*/
	if (t->zthr_thread != NULL) {
	t->zthr_cancel = B_TRUE;

	/* broadcast in case the zthr is sleeping */
	cv_broadcast(&t->zthr_cv);

	while (t->zthr_thread != NULL)
	cv_wait(&t->zthr_cv, &t->zthr_state_lock);

	ASSERT(!t->zthr_cancel);
	}

	mutex_exit(&t->zthr_state_lock);
	mutex_exit(&t->zthr_request_lock);
	}

	/*
	* Sends a resume request to the supplied zthr. If the zthr is already
	* running this is a no-op. Note that this function should not be
	* called from syncing context as it could deadlock with the zthr_func.
	*/
	void
	zthr_resume(zthr_t *t)
	{
	mutex_enter(&t->zthr_request_lock);
	mutex_enter(&t->zthr_state_lock);

	ASSERT3P(&t->zthr_checkfunc, !=, NULL);
	ASSERT3P(&t->zthr_func, !=, NULL);
	ASSERT(!t->zthr_cancel);
	ASSERT(!t->zthr_haswaiters);

	/*
	* There are 4 states that we find the zthr in at this point
	* given the locks that we hold:
	*
	* [1] The zthr was cancelled, so we spawn a new thread for
	* the zthr (common case).
	* [2] The zthr is running at which point this is a no-op.
	* [3] The zthr is sleeping at which point this is a no-op.
	* [4] The zthr was just spawned at which point this is a
	* no-op.
	*/
	if (t->zthr_thread == NULL) {
	- t->zthr_thread = thread_create(NULL, 0, zthr_procedure, t,
	- 0, &p0, TS_RUN, minclsyspri);
	+ t->zthr_thread = thread_create_named(t->zthr_name, NULL, 0,
	+ zthr_procedure, t, 0, &p0, TS_RUN, minclsyspri);
	}

	mutex_exit(&t->zthr_state_lock);
	mutex_exit(&t->zthr_request_lock);
	}

	/*
	* This function is intended to be used by the zthr itself
	* (specifically the zthr_func callback provided) to check
	* if another thread has signaled it to stop running before
	* doing some expensive operation.
	*
	* returns TRUE if we are in the middle of trying to cancel
	* this thread.
	*
	* returns FALSE otherwise.
	*/
	boolean_t
	zthr_iscancelled(zthr_t *t)
	{
	ASSERT3P(t->zthr_thread, ==, curthread);

	/*
	* The majority of the functions here grab zthr_request_lock
	* first and then zthr_state_lock. This function only grabs
	* the zthr_state_lock. That is because this function should
	* only be called from the zthr_func to check if someone has
	* issued a zthr_cancel() on the thread. If there is a zthr_cancel()
	* happening concurrently, attempting to grab the request lock
	* here would result in a deadlock.
	*
	* By grabbing only the zthr_state_lock this function is allowed
	* to run concurrently with a zthr_cancel() request.
	*/
	mutex_enter(&t->zthr_state_lock);
	boolean_t cancelled = t->zthr_cancel;
	mutex_exit(&t->zthr_state_lock);
	return (cancelled);
	}

	/*
	* Wait for the zthr to finish its current function. Similar to
	* zthr_iscancelled, you can use zthr_has_waiters to have the zthr_func end
	* early. Unlike zthr_cancel, the thread is not destroyed. If the zthr was
	* sleeping or cancelled, return immediately.
	*/
	void
	zthr_wait_cycle_done(zthr_t *t)
	{
	mutex_enter(&t->zthr_state_lock);

	/*
	* Since we are holding the zthr_state_lock at this point
	* we can find the state in one of the following 5 states:
	*
	* [1] The thread has already cancelled, therefore
	* there is nothing for us to do.
	* [2] The thread is sleeping so we set the flag, broadcast
	* the CV and wait for it to exit.
	* [3] The thread is doing work, in which case we just set
	* the flag and wait for it to finish.
	* [4] The thread was just created/resumed, in which case
	* the behavior is similar to [3].
	* [5] The thread is the middle of being cancelled, which is
	* similar to [3]. We'll wait for the cancel, which is
	* waiting for the zthr func.
	*
	* Since requests are serialized, by the time that we get
	* control back we expect that the zthr has completed it's
	* zthr_func.
	*/
	if (t->zthr_thread != NULL) {
	t->zthr_haswaiters = B_TRUE;

	/* broadcast in case the zthr is sleeping */
	cv_broadcast(&t->zthr_cv);

	while ((t->zthr_haswaiters) && (t->zthr_thread != NULL))
	cv_wait(&t->zthr_wait_cv, &t->zthr_state_lock);

	ASSERT(!t->zthr_haswaiters);
	}

	mutex_exit(&t->zthr_state_lock);
	}

	/*
	* This function is intended to be used by the zthr itself
	* to check if another thread is waiting on it to finish
	*
	* returns TRUE if we have been asked to finish.
	*
	* returns FALSE otherwise.
	*/
	boolean_t
	zthr_has_waiters(zthr_t *t)
	{
	ASSERT3P(t->zthr_thread, ==, curthread);

	mutex_enter(&t->zthr_state_lock);

	/*
	* Similarly to zthr_iscancelled(), we only grab the
	* zthr_state_lock so that the zthr itself can use this
	* to check for the request.
	*/
	boolean_t has_waiters = t->zthr_haswaiters;
	mutex_exit(&t->zthr_state_lock);
	return (has_waiters);
	}
	Index: vendor-sys/openzfs/dist/rpm/generic/zfs.spec.in
	===================================================================
	--- vendor-sys/openzfs/dist/rpm/generic/zfs.spec.in (revision 365891)
	+++ vendor-sys/openzfs/dist/rpm/generic/zfs.spec.in (revision 365892)
	@@ -1,523 +1,524 @@
	%global _sbindir /sbin
	%global _libdir /%{_lib}

	# Set the default udev directory based on distribution.
	%if %{undefined _udevdir}
	%if 0%{?fedora} >= 17 \|\| 0%{?rhel} >= 7 \|\| 0%{?centos} >= 7
	%global _udevdir %{_prefix}/lib/udev
	%else
	%global _udevdir /lib/udev
	%endif
	%endif

	# Set the default udevrule directory based on distribution.
	%if %{undefined _udevruledir}
	%if 0%{?fedora} >= 17 \|\| 0%{?rhel} >= 7 \|\| 0%{?centos} >= 7
	%global _udevruledir %{_prefix}/lib/udev/rules.d
	%else
	%global _udevruledir /lib/udev/rules.d
	%endif
	%endif

	# Set the default dracut directory based on distribution.
	%if %{undefined _dracutdir}
	%if 0%{?fedora} >= 17 \|\| 0%{?rhel} >= 7 \|\| 0%{?centos} >= 7
	%global _dracutdir %{_prefix}/lib/dracut
	%else
	%global _dracutdir %{_prefix}/share/dracut
	%endif
	%endif

	%if %{undefined _initconfdir}
	%global _initconfdir /etc/sysconfig
	%endif

	%if %{undefined _unitdir}
	%global _unitdir %{_prefix}/lib/systemd/system
	%endif

	%if %{undefined _presetdir}
	%global _presetdir %{_prefix}/lib/systemd/system-preset
	%endif

	%if %{undefined _modulesloaddir}
	%global _modulesloaddir %{_prefix}/lib/modules-load.d
	%endif

	%if %{undefined _systemdgeneratordir}
	%global _systemdgeneratordir %{_prefix}/lib/systemd/system-generators
	%endif

	%if %{undefined _pkgconfigdir}
	%global _pkgconfigdir %{_prefix}/%{_lib}/pkgconfig
	%endif

	%bcond_with debug
	%bcond_with debuginfo
	%bcond_with asan
	%bcond_with systemd
	%bcond_with pam

	# Generic enable switch for systemd
	%if %{with systemd}
	%define _systemd 1
	%endif

	# RHEL >= 7 comes with systemd
	%if 0%{?rhel} >= 7
	%define _systemd 1
	%endif

	# Fedora >= 15 comes with systemd, but only >= 18 has
	# the proper macros
	%if 0%{?fedora} >= 18
	%define _systemd 1
	%endif

	# opensuse >= 12.1 comes with systemd, but only >= 13.1
	# has the proper macros
	%if 0%{?suse_version} >= 1310
	%define _systemd 1
	%endif

	# When not specified default to distribution provided version. This
	# is normally Python 3, but for RHEL <= 7 only Python 2 is provided.
	%if %{undefined __use_python}
	%if 0%{?rhel} && 0%{?rhel} <= 7
	%define __python /usr/bin/python2
	%define __python_pkg_version 2
	%define __python_cffi_pkg python-cffi
	%define __python_setuptools_pkg python-setuptools
	%else
	%define __python /usr/bin/python3
	%define __python_pkg_version 3
	%define __python_cffi_pkg python3-cffi
	%define __python_setuptools_pkg python3-setuptools
	%endif
	%else
	%define __python %{__use_python}
	%define __python_pkg_version %{__use_python_pkg_version}
	%define __python_cffi_pkg python%{__python_pkg_version}-cffi
	%define __python_setuptools_pkg python%{__python_pkg_version}-setuptools
	%endif
	%define __python_sitelib %(%{__python} -Esc "from distutils.sysconfig import get_python_lib; print(get_python_lib())")

	# By default python-pyzfs is enabled, with the exception of
	# RHEL 6 which by default uses Python 2.6 which is too old.
	%if 0%{?rhel} == 6
	%bcond_with pyzfs
	%else
	%bcond_without pyzfs
	%endif

	Name: @PACKAGE@
	Version: @VERSION@
	Release: @RELEASE@%{?dist}
	Summary: Commands to control the kernel modules and libraries

	Group: System Environment/Kernel
	License: @ZFS_META_LICENSE@
	URL: https://zfsonlinux.org/
	Source0: %{name}-%{version}.tar.gz
	BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
	Requires: libzpool2 = %{version}
	Requires: libnvpair1 = %{version}
	Requires: libuutil1 = %{version}
	Requires: libzfs2 = %{version}
	Requires: %{name}-kmod = %{version}
	Provides: %{name}-kmod-common = %{version}
	Obsoletes: spl

	# zfs-fuse provides the same commands and man pages that ZoL does. Renaming
	# those on either side would conflict with all available documentation.
	Conflicts: zfs-fuse

	%if 0%{?rhel}%{?fedora}%{?suse_version}
	BuildRequires: gcc, make
	BuildRequires: zlib-devel
	BuildRequires: libuuid-devel
	BuildRequires: libblkid-devel
	BuildRequires: libudev-devel
	BuildRequires: libattr-devel
	BuildRequires: openssl-devel
	%if 0%{?fedora} >= 28 \|\| 0%{?rhel} >= 8 \|\| 0%{?centos} >= 8
	BuildRequires: libtirpc-devel
	%endif
	Requires: openssl
	%if 0%{?_systemd}
	BuildRequires: systemd
	%endif
	%endif

	%if 0%{?_systemd}
	Requires(post): systemd
	Requires(preun): systemd
	Requires(postun): systemd
	%endif

	# The zpool iostat/status -c scripts call some utilities like lsblk and iostat
	Requires: util-linux
	Requires: sysstat

	%description
	This package contains the core ZFS command line utilities.

	%package -n libzpool2
	Summary: Native ZFS pool library for Linux
	Group: System Environment/Kernel

	%description -n libzpool2
	This package contains the zpool library, which provides support
	for managing zpools

	%post -n libzpool2 -p /sbin/ldconfig
	%postun -n libzpool2 -p /sbin/ldconfig

	%package -n libnvpair1
	Summary: Solaris name-value library for Linux
	Group: System Environment/Kernel

	%description -n libnvpair1
	This package contains routines for packing and unpacking name-value
	pairs. This functionality is used to portably transport data across
	process boundaries, between kernel and user space, and can be used
	to write self describing data structures on disk.

	%post -n libnvpair1 -p /sbin/ldconfig
	%postun -n libnvpair1 -p /sbin/ldconfig

	%package -n libuutil1
	Summary: Solaris userland utility library for Linux
	Group: System Environment/Kernel

	%description -n libuutil1
	This library provides a variety of compatibility functions for ZFS on Linux:
	* libspl: The Solaris Porting Layer userland library, which provides APIs
	that make it possible to run Solaris user code in a Linux environment
	with relatively minimal modification.
	* libavl: The Adelson-Velskii Landis balanced binary tree manipulation
	library.
	* libefi: The Extensible Firmware Interface library for GUID disk
	partitioning.
	* libshare: NFS, SMB, and iSCSI service integration for ZFS.

	%post -n libuutil1 -p /sbin/ldconfig
	%postun -n libuutil1 -p /sbin/ldconfig

	%package -n libzfs2
	Summary: Native ZFS filesystem library for Linux
	Group: System Environment/Kernel

	%description -n libzfs2
	This package provides support for managing ZFS filesystems

	%post -n libzfs2 -p /sbin/ldconfig
	%postun -n libzfs2 -p /sbin/ldconfig

	%package -n libzfs2-devel
	Summary: Development headers
	Group: System Environment/Kernel
	Requires: libzfs2 = %{version}
	Requires: libzpool2 = %{version}
	Requires: libnvpair1 = %{version}
	Requires: libuutil1 = %{version}
	Provides: libzpool2-devel
	Provides: libnvpair1-devel
	Provides: libuutil1-devel
	Obsoletes: zfs-devel

	%description -n libzfs2-devel
	This package contains the header files needed for building additional
	applications against the ZFS libraries.

	%package test
	Summary: Test infrastructure
	Group: System Environment/Kernel
	Requires: %{name}%{?_isa} = %{version}-%{release}
	Requires: parted
	Requires: lsscsi
	Requires: mdadm
	Requires: bc
	Requires: ksh
	Requires: fio
	Requires: acl
	Requires: sudo
	Requires: sysstat
	Requires: libaio
	Requires: python%{__python_pkg_version}
	%if 0%{?rhel}%{?fedora}%{?suse_version}
	BuildRequires: libaio-devel
	%endif
	AutoReqProv: no

	%description test
	This package contains test infrastructure and support scripts for
	validating the file system.

	%package dracut
	Summary: Dracut module
	Group: System Environment/Kernel
	BuildArch: noarch
	Requires: %{name} >= %{version}
	Requires: dracut
	Requires: /usr/bin/awk
	Requires: grep

	%description dracut
	This package contains a dracut module used to construct an initramfs
	image which is ZFS aware.

	%if %{with pyzfs}
	%package -n python%{__python_pkg_version}-pyzfs
	Summary: Python %{python_version} wrapper for libzfs_core
	Group: Development/Languages/Python
	License: Apache-2.0
	BuildArch: noarch
	Requires: libzfs2 = %{version}
	Requires: libnvpair1 = %{version}
	Requires: libffi
	Requires: python%{__python_pkg_version}
	Requires: %{__python_cffi_pkg}
	%if 0%{?rhel}%{?fedora}%{?suse_version}
	BuildRequires: python%{__python_pkg_version}-devel
	BuildRequires: %{__python_cffi_pkg}
	BuildRequires: %{__python_setuptools_pkg}
	BuildRequires: libffi-devel
	%endif

	%description -n python%{__python_pkg_version}-pyzfs
	This package provides a python wrapper for the libzfs_core C library.
	%endif

	%if 0%{?_initramfs}
	%package initramfs
	Summary: Initramfs module
	Group: System Environment/Kernel
	Requires: %{name}%{?_isa} = %{version}-%{release}
	Requires: %{name} = %{version}-%{release}
	Requires: initramfs-tools

	%description initramfs
	This package contains a initramfs module used to construct an initramfs
	image which is ZFS aware.
	%endif

	%prep
	%if %{with debug}
	%define debug --enable-debug
	%else
	%define debug --disable-debug
	%endif

	%if %{with debuginfo}
	%define debuginfo --enable-debuginfo
	%else
	%define debuginfo --disable-debuginfo
	%endif

	%if %{with asan}
	%define asan --enable-asan
	%else
	%define asan --disable-asan
	%endif

	%if 0%{?_systemd}
	%define systemd --enable-systemd --with-systemdunitdir=%{_unitdir} --with-systemdpresetdir=%{_presetdir} --with-systemdmodulesloaddir=%{_modulesloaddir} --with-systemdgeneratordir=%{_systemdgeneratordir} --disable-sysvinit
	%define systemd_svcs zfs-import-cache.service zfs-import-scan.service zfs-mount.service zfs-share.service zfs-zed.service zfs.target zfs-import.target zfs-volume-wait.service zfs-volumes.target
	%else
	%define systemd --enable-sysvinit --disable-systemd
	%endif

	%if %{with pyzfs}
	%define pyzfs --enable-pyzfs
	%else
	%define pyzfs --disable-pyzfs
	%endif

	%if %{with pam}
	%define pam --enable-pam
	%else
	%define pam --disable-pam
	%endif

	%setup -q

	%build
	%configure \
	--with-config=user \
	--with-udevdir=%{_udevdir} \
	--with-udevruledir=%{_udevruledir} \
	--with-dracutdir=%{_dracutdir} \
	--with-pamconfigsdir=%{_datadir}/pam-configs \
	--with-pammoduledir=%{_libdir}/security \
	--with-python=%{__python} \
	--with-pkgconfigdir=%{_pkgconfigdir} \
	--disable-static \
	%{debug} \
	%{debuginfo} \
	%{asan} \
	%{systemd} \
	%{pam} \
	%{pyzfs}
	make %{?_smp_mflags}

	%install
	%{__rm} -rf $RPM_BUILD_ROOT
	make install DESTDIR=%{?buildroot}
	find %{?buildroot}%{_libdir} -name '*.la' -exec rm -f {} \;
	%if 0%{!?__brp_mangle_shebangs:1}
	find %{?buildroot}%{_bindir} \
	$ -name arc_summary -or -name arcstat -or -name dbufstat $ \
	-exec %{__sed} -i 's\|^#!.*\|#!%{__python}\|' {} \;
	find %{?buildroot}%{_datadir} \
	$ -name test-runner.py -or -name zts-report.py $ \
	-exec %{__sed} -i 's\|^#!.*\|#!%{__python}\|' {} \;
	%endif

	%post
	%if 0%{?_systemd}
	%if 0%{?systemd_post:1}
	%systemd_post %{systemd_svcs}
	%else
	if [ "$1" = "1" -o "$1" = "install" ] ; then
	# Initial installation
	systemctl preset %{systemd_svcs} >/dev/null \|\| true
	fi
	%endif
	%else
	if [ -x /sbin/chkconfig ]; then
	/sbin/chkconfig --add zfs-import
	/sbin/chkconfig --add zfs-mount
	/sbin/chkconfig --add zfs-share
	/sbin/chkconfig --add zfs-zed
	fi
	%endif
	exit 0

	# On RHEL/CentOS 7 the static nodes aren't refreshed by default after
	# installing a package. This is the default behavior for Fedora.
	%posttrans
	%if 0%{?rhel} == 7 \|\| 0%{?centos} == 7
	systemctl restart kmod-static-nodes
	systemctl restart systemd-tmpfiles-setup-dev
	udevadm trigger
	%endif

	%preun
	%if 0%{?_systemd}
	%if 0%{?systemd_preun:1}
	%systemd_preun %{systemd_svcs}
	%else
	if [ "$1" = "0" -o "$1" = "remove" ] ; then
	# Package removal, not upgrade
	systemctl --no-reload disable %{systemd_svcs} >/dev/null \|\| true
	systemctl stop %{systemd_svcs} >/dev/null \|\| true
	fi
	%endif
	%else
	if [ "$1" = "0" -o "$1" = "remove" ] && [ -x /sbin/chkconfig ]; then
	/sbin/chkconfig --del zfs-import
	/sbin/chkconfig --del zfs-mount
	/sbin/chkconfig --del zfs-share
	/sbin/chkconfig --del zfs-zed
	fi
	%endif
	exit 0

	%postun
	%if 0%{?_systemd}
	%if 0%{?systemd_postun:1}
	%systemd_postun %{systemd_svcs}
	%else
	systemctl --system daemon-reload >/dev/null \|\| true
	%endif
	%endif

	%files
	# Core utilities
	%{_sbindir}/*
	%{_bindir}/raidz_test
	%{_bindir}/zgenhostid
	%{_bindir}/zvol_wait
	# Optional Python 2/3 scripts
	%{_bindir}/arc_summary
	%{_bindir}/arcstat
	%{_bindir}/dbufstat
	# Man pages
	%{_mandir}/man1/*
	%{_mandir}/man5/*
	%{_mandir}/man8/*
	# Configuration files and scripts
	%{_libexecdir}/%{name}
	%{_udevdir}/vdev_id
	%{_udevdir}/zvol_id
	%{_udevdir}/rules.d/*
	%if ! 0%{?_systemd} \|\| 0%{?_initramfs}
	# Files needed for sysvinit and initramfs-tools
	%{_sysconfdir}/%{name}/zfs-functions
	%config(noreplace) %{_initconfdir}/zfs
	%else
	%exclude %{_sysconfdir}/%{name}/zfs-functions
	%exclude %{_initconfdir}/zfs
	%endif
	%if 0%{?_systemd}
	%{_unitdir}/*
	%{_presetdir}/*
	%{_modulesloaddir}/*
	%{_systemdgeneratordir}/*
	%else
	%config(noreplace) %{_sysconfdir}/init.d/*
	%endif
	%config(noreplace) %{_sysconfdir}/%{name}/zed.d/*
	%config(noreplace) %{_sysconfdir}/%{name}/zpool.d/*
	%config(noreplace) %{_sysconfdir}/%{name}/vdev_id.conf.*.example
	%attr(440, root, root) %config(noreplace) %{_sysconfdir}/sudoers.d/*
	%if %{with pam}
	%{_libdir}/security/*
	%{_datadir}/pam-configs/*
	%endif

	%files -n libzpool2
	%{_libdir}/libzpool.so.*

	%files -n libnvpair1
	%{_libdir}/libnvpair.so.*

	%files -n libuutil1
	%{_libdir}/libuutil.so.*

	%files -n libzfs2
	%{_libdir}/libzfs.so.

	%files -n libzfs2-devel
	%{_pkgconfigdir}/libzfs.pc
	+%{_pkgconfigdir}/libzfsbootenv.pc
	%{_pkgconfigdir}/libzfs_core.pc
	%{_libdir}/*.so
	%{_includedir}/*
	%doc AUTHORS COPYRIGHT LICENSE NOTICE README.md

	%files test
	%{_datadir}/%{name}

	%files dracut
	%doc contrib/dracut/README.dracut.markdown
	%{_dracutdir}/modules.d/*

	%if %{with pyzfs}
	%files -n python%{__python_pkg_version}-pyzfs
	%doc contrib/pyzfs/README
	%doc contrib/pyzfs/LICENSE
	%defattr(-,root,root,-)
	%{__python_sitelib}/libzfs_core/*
	%{__python_sitelib}/pyzfs*
	%endif

	%if 0%{?_initramfs}
	%files initramfs
	%doc contrib/initramfs/README.initramfs.markdown
	/usr/share/initramfs-tools/*
	%else
	# Since we're not building the initramfs package,
	# ignore those files.
	%exclude /usr/share/initramfs-tools
	%endif
	Index: vendor-sys/openzfs/dist/scripts/zfs-tests.sh
	===================================================================
	--- vendor-sys/openzfs/dist/scripts/zfs-tests.sh (revision 365891)
	+++ vendor-sys/openzfs/dist/scripts/zfs-tests.sh (revision 365892)
	@@ -1,706 +1,706 @@
	#!/bin/sh
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License, Version 1.0 only
	# (the "License"). You may not use this file except in compliance
	# with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	BASE_DIR=$(dirname "$0")
	SCRIPT_COMMON=common.sh
	if [ -f "${BASE_DIR}/${SCRIPT_COMMON}" ]; then
	. "${BASE_DIR}/${SCRIPT_COMMON}"
	else
	echo "Missing helper script ${SCRIPT_COMMON}" && exit 1
	fi

	PROG=zfs-tests.sh
	VERBOSE="no"
	QUIET=""
	CLEANUP="yes"
	CLEANUPALL="no"
	LOOPBACK="yes"
	STACK_TRACER="no"
	FILESIZE="4G"
	DEFAULT_RUNFILES="common.run,$(uname \| tr '[:upper:]' '[:lower:]').run"
	RUNFILES=${RUNFILES:-$DEFAULT_RUNFILES}
	FILEDIR=${FILEDIR:-/var/tmp}
	DISKS=${DISKS:-""}
	SINGLETEST=""
	SINGLETESTUSER="root"
	TAGS=""
	ITERATIONS=1
	ZFS_DBGMSG="$STF_SUITE/callbacks/zfs_dbgmsg.ksh"
	ZFS_DMESG="$STF_SUITE/callbacks/zfs_dmesg.ksh"
	UNAME=$(uname -s)

	# Override some defaults if on FreeBSD
	if [ "$UNAME" = "FreeBSD" ] ; then
	TESTFAIL_CALLBACKS=${TESTFAIL_CALLBACKS:-"$ZFS_DMESG"}
	LOSETUP=/sbin/mdconfig
	DMSETUP=/sbin/gpart
	else
	ZFS_MMP="$STF_SUITE/callbacks/zfs_mmp.ksh"
	TESTFAIL_CALLBACKS=${TESTFAIL_CALLBACKS:-"$ZFS_DBGMSG:$ZFS_DMESG:$ZFS_MMP"}
	LOSETUP=${LOSETUP:-/sbin/losetup}
	DMSETUP=${DMSETUP:-/sbin/dmsetup}
	fi

	#
	# Log an informational message when additional verbosity is enabled.
	#
	msg() {
	if [ "$VERBOSE" = "yes" ]; then
	echo "$@"
	fi
	}

	#
	# Log a failure message, cleanup, and return an error.
	#
	fail() {
	echo "$PROG: $1" >&2
	cleanup
	exit 1
	}

	cleanup_freebsd_loopback() {
	for TEST_LOOPBACK in ${LOOPBACKS}; do
	if [ -c "/dev/${TEST_LOOPBACK}" ]; then
	sudo "${LOSETUP}" -d -u "${TEST_LOOPBACK}" \|\|
	echo "Failed to destroy: ${TEST_LOOPBACK}"
	fi
	done
	}

	cleanup_linux_loopback() {
	for TEST_LOOPBACK in ${LOOPBACKS}; do
	LOOP_DEV=$(basename "$TEST_LOOPBACK")
	DM_DEV=$(sudo "${DMSETUP}" ls 2>/dev/null \| \
	grep "${LOOP_DEV}" \| cut -f1)

	if [ -n "$DM_DEV" ]; then
	sudo "${DMSETUP}" remove "${DM_DEV}" \|\|
	echo "Failed to remove: ${DM_DEV}"
	fi

	if [ -n "${TEST_LOOPBACK}" ]; then
	sudo "${LOSETUP}" -d "${TEST_LOOPBACK}" \|\|
	echo "Failed to remove: ${TEST_LOOPBACK}"
	fi
	done
	}

	#
	# Attempt to remove loopback devices and files which where created earlier
	# by this script to run the test framework. The '-k' option may be passed
	# to the script to suppress cleanup for debugging purposes.
	#
	cleanup() {
	if [ "$CLEANUP" = "no" ]; then
	return 0
	fi


	if [ "$LOOPBACK" = "yes" ]; then
	if [ "$UNAME" = "FreeBSD" ] ; then
	cleanup_freebsd_loopback
	else
	cleanup_linux_loopback
	fi
	fi

	for TEST_FILE in ${FILES}; do
	rm -f "${TEST_FILE}" >/dev/null 2>&1
	done

	if [ "$STF_PATH_REMOVE" = "yes" ] && [ -d "$STF_PATH" ]; then
	rm -Rf "$STF_PATH"
	fi
	}
	trap cleanup EXIT

	#
	# Attempt to remove all testpools (testpool.XXX), unopened dm devices,
	# loopback devices, and files. This is a useful way to cleanup a previous
	# test run failure which has left the system in an unknown state. This can
	# be dangerous and should only be used in a dedicated test environment.
	#
	cleanup_all() {
	TEST_POOLS=$(sudo "$ZPOOL" list -H -o name \| grep testpool)
	if [ "$UNAME" = "FreeBSD" ] ; then
	TEST_LOOPBACKS=$(sudo "${LOSETUP}" -l)
	else
	TEST_LOOPBACKS=$(sudo "${LOSETUP}" -a\|grep file-vdev\|cut -f1 -d:)
	fi
	TEST_FILES=$(ls /var/tmp/file-vdev* 2>/dev/null)

	msg
	msg "--- Cleanup ---"
	msg "Removing pool(s): $(echo "${TEST_POOLS}" \| tr '\n' ' ')"
	for TEST_POOL in $TEST_POOLS; do
	sudo "$ZPOOL" destroy "${TEST_POOL}"
	done

	if [ "$UNAME" != "FreeBSD" ] ; then
	msg "Removing dm(s): $(sudo "${DMSETUP}" ls \|
	grep loop \| tr '\n' ' ')"
	sudo "${DMSETUP}" remove_all
	fi

	msg "Removing loopback(s): $(echo "${TEST_LOOPBACKS}" \| tr '\n' ' ')"
	for TEST_LOOPBACK in $TEST_LOOPBACKS; do
	if [ "$UNAME" = "FreeBSD" ] ; then
	sudo "${LOSETUP}" -d -u "${TEST_LOOPBACK}"
	else
	sudo "${LOSETUP}" -d "${TEST_LOOPBACK}"
	fi
	done

	msg "Removing files(s): $(echo "${TEST_FILES}" \| tr '\n' ' ')"
	for TEST_FILE in $TEST_FILES; do
	sudo rm -f "${TEST_FILE}"
	done
	}

	#
	# Takes a name as the only arguments and looks for the following variations
	# on that name. If one is found it is returned.
	#
	# $RUNFILE_DIR/<name>
	# $RUNFILE_DIR/<name>.run
	# <name>
	# <name>.run
	#
	find_runfile() {
	NAME=$1
	RESULT=""

	if [ -f "$RUNFILE_DIR/$NAME" ]; then
	RESULT="$RUNFILE_DIR/$NAME"
	elif [ -f "$RUNFILE_DIR/$NAME.run" ]; then
	RESULT="$RUNFILE_DIR/$NAME.run"
	elif [ -f "$NAME" ]; then
	RESULT="$NAME"
	elif [ -f "$NAME.run" ]; then
	RESULT="$NAME.run"
	fi

	echo "$RESULT"
	}

	#
	# Symlink file if it appears under any of the given paths.
	#
	create_links() {
	dir_list="$1"
	file_list="$2"

	[ -n "$STF_PATH" ] \|\| fail "STF_PATH wasn't correctly set"

	for i in $file_list; do
	for j in $dir_list; do
	[ ! -e "$STF_PATH/$i" ] \|\| continue

	if [ ! -d "$j/$i" ] && [ -e "$j/$i" ]; then
	ln -sf "$j/$i" "$STF_PATH/$i" \|\| \
	fail "Couldn't link $i"
	break
	fi
	done

	[ ! -e "$STF_PATH/$i" ] && \
	STF_MISSING_BIN="$STF_MISSING_BIN $i"
	done
	STF_MISSING_BIN=${STF_MISSING_BIN# }
	}

	#
	# Constrain the path to limit the available binaries to a known set.
	# When running in-tree a top level ./bin/ directory is created for
	# convenience, otherwise a temporary directory is used.
	#
	constrain_path() {
	. "$STF_SUITE/include/commands.cfg"

	# On FreeBSD, base system zfs utils are in /sbin and OpenZFS utils
	# install to /usr/local/sbin. To avoid testing the wrong utils we
	# need /usr/local to come before / in the path search order.
	SYSTEM_DIRS="/usr/local/bin /usr/local/sbin"
	SYSTEM_DIRS="$SYSTEM_DIRS /usr/bin /usr/sbin /bin /sbin"

	if [ "$INTREE" = "yes" ]; then
	# Constrained path set to ./zfs/bin/
	STF_PATH="$BIN_DIR"
	STF_PATH_REMOVE="no"
	STF_MISSING_BIN=""
	if [ ! -d "$STF_PATH" ]; then
	mkdir "$STF_PATH"
	chmod 755 "$STF_PATH" \|\| fail "Couldn't chmod $STF_PATH"
	fi

	# Special case links for standard zfs utilities
	DIRS="$(find "$CMD_DIR" -type d \( ! -name .deps -a \
	! -name .libs \) -print \| tr '\n' ' ')"
	create_links "$DIRS" "$ZFS_FILES"

	# Special case links for zfs test suite utilities
	DIRS="$(find "$STF_SUITE" -type d \( ! -name .deps -a \
	! -name .libs \) -print \| tr '\n' ' ')"
	create_links "$DIRS" "$ZFSTEST_FILES"
	else
	# Constrained path set to /var/tmp/constrained_path.*
	SYSTEMDIR=${SYSTEMDIR:-/var/tmp/constrained_path.XXXX}
	STF_PATH=$(mktemp -d "$SYSTEMDIR")
	STF_PATH_REMOVE="yes"
	STF_MISSING_BIN=""

	chmod 755 "$STF_PATH" \|\| fail "Couldn't chmod $STF_PATH"

	# Special case links for standard zfs utilities
	create_links "$SYSTEM_DIRS" "$ZFS_FILES"

	# Special case links for zfs test suite utilities
	create_links "$STF_SUITE/bin" "$ZFSTEST_FILES"
	fi

	# Standard system utilities
	SYSTEM_FILES="$SYSTEM_FILES_COMMON"
	if [ "$UNAME" = "FreeBSD" ] ; then
	SYSTEM_FILES="$SYSTEM_FILES $SYSTEM_FILES_FREEBSD"
	else
	SYSTEM_FILES="$SYSTEM_FILES $SYSTEM_FILES_LINUX"
	fi
	create_links "$SYSTEM_DIRS" "$SYSTEM_FILES"

	# Exceptions
	ln -fs "$STF_PATH/awk" "$STF_PATH/nawk"
	if [ "$UNAME" = "Linux" ] ; then
	ln -fs /sbin/fsck.ext4 "$STF_PATH/fsck"
	ln -fs /sbin/mkfs.ext4 "$STF_PATH/newfs"
	ln -fs "$STF_PATH/gzip" "$STF_PATH/compress"
	ln -fs "$STF_PATH/gunzip" "$STF_PATH/uncompress"
	ln -fs "$STF_PATH/exportfs" "$STF_PATH/share"
	ln -fs "$STF_PATH/exportfs" "$STF_PATH/unshare"
	elif [ "$UNAME" = "FreeBSD" ] ; then
	ln -fs /usr/local/bin/ksh93 "$STF_PATH/ksh"
	fi
	}

	#
	# Output a useful usage message.
	#
	usage() {
	cat << EOF
	USAGE:
	-$0 [hvqxkfS] [-s SIZE] [-r RUNFILES] [-t PATH] [-u USER]
	+$0 [-hvqxkfS] [-s SIZE] [-r RUNFILES] [-t PATH] [-u USER]

	DESCRIPTION:
	ZFS Test Suite launch script

	OPTIONS:
	-h Show this message
	-v Verbose zfs-tests.sh output
	-q Quiet test-runner output
	-x Remove all testpools, dm, lo, and files (unsafe)
	-k Disable cleanup after test failure
	-f Use files only, disables block device tests
	-S Enable stack tracer (negative performance impact)
	-c Only create and populate constrained path
	-n NFSFILE Use the nfsfile to determine the NFS configuration
	-I NUM Number of iterations
	-d DIR Use DIR for files and loopback devices
	-s SIZE Use vdevs of SIZE (default: 4G)
	-r RUNFILES Run tests in RUNFILES (default: ${DEFAULT_RUNFILES})
	-t PATH Run single test at PATH relative to test suite
	-T TAGS Comma separated list of tags (default: 'functional')
	-u USER Run single test as USER (default: root)

	EXAMPLES:
	# Run the default (linux) suite of tests and output the configuration used.
	$0 -v

	# Run a smaller suite of tests designed to run more quickly.
	$0 -r linux-fast

	# Run a single test
	$0 -t tests/functional/cli_root/zfs_bookmark/zfs_bookmark_cliargs.ksh

	# Cleanup a previous run of the test suite prior to testing, run the
	# default (linux) suite of tests and perform no cleanup on exit.
	$0 -x

	EOF
	}

	while getopts 'hvqxkfScn:d:s:r:?t:T:u:I:' OPTION; do
	case $OPTION in
	h)
	usage
	exit 1
	;;
	v)
	# shellcheck disable=SC2034
	VERBOSE="yes"
	;;
	q)
	QUIET="yes"
	;;
	x)
	CLEANUPALL="yes"
	;;
	k)
	CLEANUP="no"
	;;
	f)
	LOOPBACK="no"
	;;
	S)
	STACK_TRACER="yes"
	;;
	c)
	constrain_path
	exit
	;;
	n)
	nfsfile=$OPTARG
	[ -f "$nfsfile" ] \|\| fail "Cannot read file: $nfsfile"
	export NFS=1
	. "$nfsfile"
	;;
	d)
	FILEDIR="$OPTARG"
	;;
	I)
	ITERATIONS="$OPTARG"
	if [ "$ITERATIONS" -le 0 ]; then
	fail "Iterations must be greater than 0."
	fi
	;;
	s)
	FILESIZE="$OPTARG"
	;;
	r)
	RUNFILES="$OPTARG"
	;;
	t)
	if [ -n "$SINGLETEST" ]; then
	fail "-t can only be provided once."
	fi
	SINGLETEST="$OPTARG"
	;;
	T)
	TAGS="$OPTARG"
	;;
	u)
	SINGLETESTUSER="$OPTARG"
	;;
	?)
	usage
	exit
	;;
	esac
	done

	shift $((OPTIND-1))

	FILES=${FILES:-"$FILEDIR/file-vdev0 $FILEDIR/file-vdev1 $FILEDIR/file-vdev2"}
	LOOPBACKS=${LOOPBACKS:-""}

	if [ -n "$SINGLETEST" ]; then
	if [ -n "$TAGS" ]; then
	fail "-t and -T are mutually exclusive."
	fi
	RUNFILE_DIR="/var/tmp"
	RUNFILES="zfs-tests.$$.run"
	SINGLEQUIET="False"

	if [ -n "$QUIET" ]; then
	SINGLEQUIET="True"
	fi

	cat >$RUNFILE_DIR/$RUNFILES << EOF
	[DEFAULT]
	pre =
	quiet = $SINGLEQUIET
	pre_user = root
	user = $SINGLETESTUSER
	timeout = 600
	post_user = root
	post =
	outputdir = /var/tmp/test_results
	EOF
	SINGLETESTDIR=$(dirname "$SINGLETEST")
	SINGLETESTFILE=$(basename "$SINGLETEST")
	SETUPSCRIPT=
	CLEANUPSCRIPT=

	if [ -f "$STF_SUITE/$SINGLETESTDIR/setup.ksh" ]; then
	SETUPSCRIPT="setup"
	fi

	if [ -f "$STF_SUITE/$SINGLETESTDIR/cleanup.ksh" ]; then
	CLEANUPSCRIPT="cleanup"
	fi

	cat >>$RUNFILE_DIR/$RUNFILES << EOF

	[$SINGLETESTDIR]
	tests = ['$SINGLETESTFILE']
	pre = $SETUPSCRIPT
	post = $CLEANUPSCRIPT
	tags = ['functional']
	EOF
	fi

	#
	# Use default tag if none was specified
	#
	TAGS=${TAGS:='functional'}

	#
	# Attempt to locate the runfiles describing the test workload.
	#
	R=""
	IFS=,
	for RUNFILE in $RUNFILES; do
	if [ -n "$RUNFILE" ]; then
	SAVED_RUNFILE="$RUNFILE"
	RUNFILE=$(find_runfile "$RUNFILE")
	[ -z "$RUNFILE" ] && fail "Cannot find runfile: $SAVED_RUNFILE"
	R="$R,$RUNFILE"
	fi

	if [ ! -r "$RUNFILE" ]; then
	fail "Cannot read runfile: $RUNFILE"
	fi
	done
	unset IFS
	RUNFILES=${R#,}

	#
	# This script should not be run as root. Instead the test user, which may
	# be a normal user account, needs to be configured such that it can
	# run commands via sudo passwordlessly.
	#
	if [ "$(id -u)" = "0" ]; then
	fail "This script must not be run as root."
	fi

	if [ "$(sudo whoami)" != "root" ]; then
	fail "Passwordless sudo access required."
	fi

	#
	# Constrain the available binaries to a known set.
	#
	constrain_path

	#
	# Check if ksh exists
	#
	if [ "$UNAME" = "FreeBSD" ]; then
	sudo ln -fs /usr/local/bin/ksh93 /bin/ksh
	fi
	[ -e "$STF_PATH/ksh" ] \|\| fail "This test suite requires ksh."
	[ -e "$STF_SUITE/include/default.cfg" ] \|\| fail \
	"Missing $STF_SUITE/include/default.cfg file."

	#
	# Verify the ZFS module stack is loaded.
	#
	if [ "$STACK_TRACER" = "yes" ]; then
	sudo "${ZFS_SH}" -S >/dev/null 2>&1
	else
	sudo "${ZFS_SH}" >/dev/null 2>&1
	fi

	#
	# Attempt to cleanup all previous state for a new test run.
	#
	if [ "$CLEANUPALL" = "yes" ]; then
	cleanup_all
	fi

	#
	# By default preserve any existing pools
	# NOTE: Since 'zpool list' outputs a newline-delimited list convert $KEEP from
	# space-delimited to newline-delimited.
	#
	if [ -z "${KEEP}" ]; then
	KEEP="$(sudo "$ZPOOL" list -H -o name)"
	if [ -z "${KEEP}" ]; then
	KEEP="rpool"
	fi
	else
	KEEP="$(echo "$KEEP" \| tr '[:blank:]' '\n')"
	fi

	#
	# NOTE: The following environment variables are undocumented
	# and should be used for testing purposes only:
	#
	# __ZFS_POOL_EXCLUDE - don't iterate over the pools it lists
	# __ZFS_POOL_RESTRICT - iterate only over the pools it lists
	#
	# See libzfs/libzfs_config.c for more information.
	#
	if [ "$UNAME" = "FreeBSD" ] ; then
	__ZFS_POOL_EXCLUDE="$(echo "$KEEP" \| tr -s '\n' ' ')"
	else
	__ZFS_POOL_EXCLUDE="$(echo "$KEEP" \| sed ':a;N;s/\n/ /g;ba')"
	fi

	. "$STF_SUITE/include/default.cfg"

	msg
	msg "--- Configuration ---"
	msg "Runfiles: $RUNFILES"
	msg "STF_TOOLS: $STF_TOOLS"
	msg "STF_SUITE: $STF_SUITE"
	msg "STF_PATH: $STF_PATH"

	#
	# No DISKS have been provided so a basic file or loopback based devices
	# must be created for the test suite to use.
	#
	if [ -z "${DISKS}" ]; then
	#
	# Create sparse files for the test suite. These may be used
	# directory or have loopback devices layered on them.
	#
	for TEST_FILE in ${FILES}; do
	[ -f "$TEST_FILE" ] && fail "Failed file exists: ${TEST_FILE}"
	truncate -s "${FILESIZE}" "${TEST_FILE}" \|\|
	fail "Failed creating: ${TEST_FILE} ($?)"
	done

	#
	# If requested setup loopback devices backed by the sparse files.
	#
	if [ "$LOOPBACK" = "yes" ]; then
	test -x "$LOSETUP" \|\| fail "$LOSETUP utility must be installed"

	for TEST_FILE in ${FILES}; do
	if [ "$UNAME" = "FreeBSD" ] ; then
	MDDEVICE=$(sudo "${LOSETUP}" -a -t vnode -f "${TEST_FILE}")
	if [ -z "$MDDEVICE" ] ; then
	fail "Failed: ${TEST_FILE} -> loopback"
	fi
	DISKS="$DISKS $MDDEVICE"
	LOOPBACKS="$LOOPBACKS $MDDEVICE"
	else
	TEST_LOOPBACK=$(sudo "${LOSETUP}" -f)
	sudo "${LOSETUP}" "${TEST_LOOPBACK}" "${TEST_FILE}" \|\|
	fail "Failed: ${TEST_FILE} -> ${TEST_LOOPBACK}"
	BASELOOPBACK=$(basename "$TEST_LOOPBACK")
	DISKS="$DISKS $BASELOOPBACK"
	LOOPBACKS="$LOOPBACKS $TEST_LOOPBACK"
	fi
	done
	DISKS=${DISKS# }
	LOOPBACKS=${LOOPBACKS# }
	else
	DISKS="$FILES"
	fi
	fi

	NUM_DISKS=$(echo "${DISKS}" \| awk '{print NF}')
	[ "$NUM_DISKS" -lt 3 ] && fail "Not enough disks ($NUM_DISKS/3 minimum)"

	#
	# Disable SELinux until the ZFS Test Suite has been updated accordingly.
	#
	if [ -x "$STF_PATH/setenforce" ]; then
	sudo setenforce permissive >/dev/null 2>&1
	fi

	#
	# Enable internal ZFS debug log and clear it.
	#
	if [ -e /sys/module/zfs/parameters/zfs_dbgmsg_enable ]; then
	sudo /bin/sh -c "echo 1 >/sys/module/zfs/parameters/zfs_dbgmsg_enable"
	sudo /bin/sh -c "echo 0 >/proc/spl/kstat/zfs/dbgmsg"
	fi

	msg "FILEDIR: $FILEDIR"
	msg "FILES: $FILES"
	msg "LOOPBACKS: $LOOPBACKS"
	msg "DISKS: $DISKS"
	msg "NUM_DISKS: $NUM_DISKS"
	msg "FILESIZE: $FILESIZE"
	msg "ITERATIONS: $ITERATIONS"
	msg "TAGS: $TAGS"
	msg "STACK_TRACER: $STACK_TRACER"
	msg "Keep pool(s): $KEEP"
	msg "Missing util(s): $STF_MISSING_BIN"
	msg ""

	export STF_TOOLS
	export STF_SUITE
	export STF_PATH
	export DISKS
	export FILEDIR
	export KEEP
	export __ZFS_POOL_EXCLUDE
	export TESTFAIL_CALLBACKS
	export PATH=$STF_PATH

	if [ "$UNAME" = "FreeBSD" ] ; then
	mkdir -p "$FILEDIR" \|\| true
	RESULTS_FILE=$(mktemp -u "${FILEDIR}/zts-results.XXXX")
	REPORT_FILE=$(mktemp -u "${FILEDIR}/zts-report.XXXX")
	else
	RESULTS_FILE=$(mktemp -u -t zts-results.XXXX -p "$FILEDIR")
	REPORT_FILE=$(mktemp -u -t zts-report.XXXX -p "$FILEDIR")
	fi

	#
	# Run all the tests as specified.
	#
	msg "${TEST_RUNNER} ${QUIET:+-q}" \
	"-c \"${RUNFILES}\"" \
	"-T \"${TAGS}\"" \
	"-i \"${STF_SUITE}\"" \
	"-I \"${ITERATIONS}\""
	${TEST_RUNNER} ${QUIET:+-q} \
	-c "${RUNFILES}" \
	-T "${TAGS}" \
	-i "${STF_SUITE}" \
	-I "${ITERATIONS}" \
	2>&1 \| tee "$RESULTS_FILE"

	#
	# Analyze the results.
	#
	${ZTS_REPORT} "$RESULTS_FILE" >"$REPORT_FILE"
	RESULT=$?
	cat "$REPORT_FILE"

	RESULTS_DIR=$(awk '/^Log directory/ { print $3 }' "$RESULTS_FILE")
	if [ -d "$RESULTS_DIR" ]; then
	cat "$RESULTS_FILE" "$REPORT_FILE" >"$RESULTS_DIR/results"
	fi

	rm -f "$RESULTS_FILE" "$REPORT_FILE"

	if [ -n "$SINGLETEST" ]; then
	rm -f "$RUNFILES" >/dev/null 2>&1
	fi

	exit ${RESULT}
	Index: vendor-sys/openzfs/dist/tests/runfiles/common.run
	===================================================================
	--- vendor-sys/openzfs/dist/tests/runfiles/common.run (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/runfiles/common.run (revision 365892)
	@@ -1,900 +1,900 @@
	#
	# This file and its contents are supplied under the terms of the
	# Common Development and Distribution License ("CDDL"), version 1.0.
	# You may only use this file in accordance with the terms of version
	# 1.0 of the CDDL.
	#
	# A full copy of the text of the CDDL should have accompanied this
	# source. A copy of the CDDL is also available via the Internet at
	# http://www.illumos.org/license/CDDL.
	#

	[DEFAULT]
	pre = setup
	quiet = False
	pre_user = root
	user = root
	timeout = 600
	post_user = root
	post = cleanup
	failsafe_user = root
	failsafe = callbacks/zfs_failsafe
	outputdir = /var/tmp/test_results
	tags = ['functional']

	[tests/functional/alloc_class]
	tests = ['alloc_class_001_pos', 'alloc_class_002_neg', 'alloc_class_003_pos',
	'alloc_class_004_pos', 'alloc_class_005_pos', 'alloc_class_006_pos',
	'alloc_class_007_pos', 'alloc_class_008_pos', 'alloc_class_009_pos',
	'alloc_class_010_pos', 'alloc_class_011_neg', 'alloc_class_012_pos',
	'alloc_class_013_pos']
	tags = ['functional', 'alloc_class']

	[tests/functional/atime]
	tests = ['atime_001_pos', 'atime_002_neg', 'root_atime_off', 'root_atime_on']
	tags = ['functional', 'atime']

	[tests/functional/bootfs]
	tests = ['bootfs_001_pos', 'bootfs_002_neg', 'bootfs_003_pos',
	'bootfs_004_neg', 'bootfs_005_neg', 'bootfs_006_pos', 'bootfs_007_pos',
	'bootfs_008_pos']
	tags = ['functional', 'bootfs']

	[tests/functional/btree]
	tests = ['btree_positive', 'btree_negative']
	tags = ['functional', 'btree']
	pre =
	post =

	[tests/functional/cache]
	tests = ['cache_001_pos', 'cache_002_pos', 'cache_003_pos', 'cache_004_neg',
	'cache_005_neg', 'cache_006_pos', 'cache_007_neg', 'cache_008_neg',
	'cache_009_pos', 'cache_010_pos', 'cache_011_pos', 'cache_012_pos']
	tags = ['functional', 'cache']

	[tests/functional/cachefile]
	tests = ['cachefile_001_pos', 'cachefile_002_pos', 'cachefile_003_pos',
	'cachefile_004_pos']
	tags = ['functional', 'cachefile']

	[tests/functional/casenorm]
	tests = ['case_all_values', 'norm_all_values', 'mixed_create_failure',
	'sensitive_none_lookup', 'sensitive_none_delete',
	'sensitive_formd_lookup', 'sensitive_formd_delete',
	'insensitive_none_lookup', 'insensitive_none_delete',
	'insensitive_formd_lookup', 'insensitive_formd_delete',
	'mixed_none_lookup', 'mixed_none_lookup_ci', 'mixed_none_delete',
	'mixed_formd_lookup', 'mixed_formd_lookup_ci', 'mixed_formd_delete']
	tags = ['functional', 'casenorm']

	[tests/functional/channel_program/lua_core]
	tests = ['tst.args_to_lua', 'tst.divide_by_zero', 'tst.exists',
	'tst.integer_illegal', 'tst.integer_overflow', 'tst.language_functions_neg',
	'tst.language_functions_pos', 'tst.large_prog', 'tst.libraries',
	'tst.memory_limit', 'tst.nested_neg', 'tst.nested_pos', 'tst.nvlist_to_lua',
	'tst.recursive_neg', 'tst.recursive_pos', 'tst.return_large',
	'tst.return_nvlist_neg', 'tst.return_nvlist_pos',
	'tst.return_recursive_table', 'tst.stack_gsub', 'tst.timeout']
	tags = ['functional', 'channel_program', 'lua_core']

	[tests/functional/channel_program/synctask_core]
	tests = ['tst.destroy_fs', 'tst.destroy_snap', 'tst.get_count_and_limit',
	'tst.get_index_props', 'tst.get_mountpoint', 'tst.get_neg',
	'tst.get_number_props', 'tst.get_string_props', 'tst.get_type',
	'tst.get_userquota', 'tst.get_written', 'tst.inherit', 'tst.list_bookmarks',
	'tst.list_children', 'tst.list_clones', 'tst.list_holds',
	'tst.list_snapshots', 'tst.list_system_props',
	'tst.list_user_props', 'tst.parse_args_neg','tst.promote_conflict',
	'tst.promote_multiple', 'tst.promote_simple', 'tst.rollback_mult',
	'tst.rollback_one', 'tst.set_props', 'tst.snapshot_destroy', 'tst.snapshot_neg',
	'tst.snapshot_recursive', 'tst.snapshot_simple',
	'tst.bookmark.create', 'tst.bookmark.copy',
	'tst.terminate_by_signal'
	]
	tags = ['functional', 'channel_program', 'synctask_core']

	[tests/functional/checksum]
	tests = ['run_sha2_test', 'run_skein_test', 'filetest_001_pos']
	tags = ['functional', 'checksum']

	[tests/functional/clean_mirror]
	tests = [ 'clean_mirror_001_pos', 'clean_mirror_002_pos',
	'clean_mirror_003_pos', 'clean_mirror_004_pos']
	tags = ['functional', 'clean_mirror']

	[tests/functional/cli_root/zdb]
	tests = ['zdb_002_pos', 'zdb_003_pos', 'zdb_004_pos', 'zdb_005_pos',
	'zdb_006_pos', 'zdb_args_neg', 'zdb_args_pos',
	'zdb_block_size_histogram', 'zdb_checksum', 'zdb_decompress',
	'zdb_display_block', 'zdb_object_range_neg', 'zdb_object_range_pos',
	'zdb_objset_id', 'zdb_decompress_zstd']
	pre =
	post =
	tags = ['functional', 'cli_root', 'zdb']

	[tests/functional/cli_root/zfs]
	tests = ['zfs_001_neg', 'zfs_002_pos']
	tags = ['functional', 'cli_root', 'zfs']

	[tests/functional/cli_root/zfs_bookmark]
	tests = ['zfs_bookmark_cliargs']
	tags = ['functional', 'cli_root', 'zfs_bookmark']

	[tests/functional/cli_root/zfs_change-key]
	tests = ['zfs_change-key', 'zfs_change-key_child', 'zfs_change-key_format',
	'zfs_change-key_inherit', 'zfs_change-key_load', 'zfs_change-key_location',
	'zfs_change-key_pbkdf2iters', 'zfs_change-key_clones']
	tags = ['functional', 'cli_root', 'zfs_change-key']

	[tests/functional/cli_root/zfs_clone]
	tests = ['zfs_clone_001_neg', 'zfs_clone_002_pos', 'zfs_clone_003_pos',
	'zfs_clone_004_pos', 'zfs_clone_005_pos', 'zfs_clone_006_pos',
	'zfs_clone_007_pos', 'zfs_clone_008_neg', 'zfs_clone_009_neg',
	'zfs_clone_010_pos', 'zfs_clone_encrypted', 'zfs_clone_deeply_nested']
	tags = ['functional', 'cli_root', 'zfs_clone']

	[tests/functional/cli_root/zfs_copies]
	tests = ['zfs_copies_001_pos', 'zfs_copies_002_pos', 'zfs_copies_003_pos',
	'zfs_copies_004_neg', 'zfs_copies_005_neg', 'zfs_copies_006_pos']
	tags = ['functional', 'cli_root', 'zfs_copies']

	[tests/functional/cli_root/zfs_create]
	tests = ['zfs_create_001_pos', 'zfs_create_002_pos', 'zfs_create_003_pos',
	'zfs_create_004_pos', 'zfs_create_005_pos', 'zfs_create_006_pos',
	'zfs_create_007_pos', 'zfs_create_008_neg', 'zfs_create_009_neg',
	'zfs_create_010_neg', 'zfs_create_011_pos', 'zfs_create_012_pos',
	'zfs_create_013_pos', 'zfs_create_014_pos', 'zfs_create_encrypted',
	'zfs_create_crypt_combos', 'zfs_create_dryrun', 'zfs_create_verbose']
	tags = ['functional', 'cli_root', 'zfs_create']

	[tests/functional/cli_root/zfs_destroy]
	tests = ['zfs_clone_livelist_condense_and_disable',
	'zfs_clone_livelist_condense_races', 'zfs_destroy_001_pos',
	'zfs_destroy_002_pos', 'zfs_destroy_003_pos',
	'zfs_destroy_004_pos', 'zfs_destroy_005_neg', 'zfs_destroy_006_neg',
	'zfs_destroy_007_neg', 'zfs_destroy_008_pos', 'zfs_destroy_009_pos',
	'zfs_destroy_010_pos', 'zfs_destroy_011_pos', 'zfs_destroy_012_pos',
	'zfs_destroy_013_neg', 'zfs_destroy_014_pos', 'zfs_destroy_015_pos',
	'zfs_destroy_016_pos', 'zfs_destroy_clone_livelist',
	'zfs_destroy_dev_removal', 'zfs_destroy_dev_removal_condense']
	tags = ['functional', 'cli_root', 'zfs_destroy']

	[tests/functional/cli_root/zfs_diff]
	tests = ['zfs_diff_changes', 'zfs_diff_cliargs', 'zfs_diff_timestamp',
	'zfs_diff_types', 'zfs_diff_encrypted']
	tags = ['functional', 'cli_root', 'zfs_diff']

	[tests/functional/cli_root/zfs_get]
	tests = ['zfs_get_001_pos', 'zfs_get_002_pos', 'zfs_get_003_pos',
	'zfs_get_004_pos', 'zfs_get_005_neg', 'zfs_get_006_neg', 'zfs_get_007_neg',
	'zfs_get_008_pos', 'zfs_get_009_pos', 'zfs_get_010_neg']
	tags = ['functional', 'cli_root', 'zfs_get']

	[tests/functional/cli_root/zfs_ids_to_path]
	tests = ['zfs_ids_to_path_001_pos']
	tags = ['functional', 'cli_root', 'zfs_ids_to_path']

	[tests/functional/cli_root/zfs_inherit]
	tests = ['zfs_inherit_001_neg', 'zfs_inherit_002_neg', 'zfs_inherit_003_pos',
	'zfs_inherit_mountpoint']
	tags = ['functional', 'cli_root', 'zfs_inherit']

	[tests/functional/cli_root/zfs_load-key]
	tests = ['zfs_load-key', 'zfs_load-key_all', 'zfs_load-key_file',
	'zfs_load-key_location', 'zfs_load-key_noop', 'zfs_load-key_recursive']
	tags = ['functional', 'cli_root', 'zfs_load-key']

	[tests/functional/cli_root/zfs_mount]
	tests = ['zfs_mount_001_pos', 'zfs_mount_002_pos', 'zfs_mount_003_pos',
	'zfs_mount_004_pos', 'zfs_mount_005_pos', 'zfs_mount_007_pos',
	'zfs_mount_009_neg', 'zfs_mount_010_neg', 'zfs_mount_011_neg',
	'zfs_mount_012_pos', 'zfs_mount_all_001_pos', 'zfs_mount_encrypted',
	'zfs_mount_remount', 'zfs_mount_all_fail', 'zfs_mount_all_mountpoints',
	'zfs_mount_test_race']
	tags = ['functional', 'cli_root', 'zfs_mount']

	[tests/functional/cli_root/zfs_program]
	tests = ['zfs_program_json']
	tags = ['functional', 'cli_root', 'zfs_program']

	[tests/functional/cli_root/zfs_promote]
	tests = ['zfs_promote_001_pos', 'zfs_promote_002_pos', 'zfs_promote_003_pos',
	'zfs_promote_004_pos', 'zfs_promote_005_pos', 'zfs_promote_006_neg',
	'zfs_promote_007_neg', 'zfs_promote_008_pos', 'zfs_promote_encryptionroot']
	tags = ['functional', 'cli_root', 'zfs_promote']

	[tests/functional/cli_root/zfs_property]
	tests = ['zfs_written_property_001_pos']
	tags = ['functional', 'cli_root', 'zfs_property']

	[tests/functional/cli_root/zfs_receive]
	tests = ['zfs_receive_001_pos', 'zfs_receive_002_pos', 'zfs_receive_003_pos',
	'zfs_receive_004_neg', 'zfs_receive_005_neg', 'zfs_receive_006_pos',
	'zfs_receive_007_neg', 'zfs_receive_008_pos', 'zfs_receive_009_neg',
	'zfs_receive_010_pos', 'zfs_receive_011_pos', 'zfs_receive_012_pos',
	'zfs_receive_013_pos', 'zfs_receive_014_pos', 'zfs_receive_015_pos',
	'zfs_receive_016_pos', 'receive-o-x_props_override',
	'zfs_receive_from_encrypted', 'zfs_receive_to_encrypted',
	'zfs_receive_raw', 'zfs_receive_raw_incremental', 'zfs_receive_-e',
	'zfs_receive_raw_-d', 'zfs_receive_from_zstd', 'zfs_receive_new_props']
	tags = ['functional', 'cli_root', 'zfs_receive']

	[tests/functional/cli_root/zfs_rename]
	tests = ['zfs_rename_001_pos', 'zfs_rename_002_pos', 'zfs_rename_003_pos',
	'zfs_rename_004_neg', 'zfs_rename_005_neg', 'zfs_rename_006_pos',
	'zfs_rename_007_pos', 'zfs_rename_008_pos', 'zfs_rename_009_neg',
	'zfs_rename_010_neg', 'zfs_rename_011_pos', 'zfs_rename_012_neg',
	'zfs_rename_013_pos', 'zfs_rename_014_neg', 'zfs_rename_encrypted_child',
	'zfs_rename_to_encrypted', 'zfs_rename_mountpoint', 'zfs_rename_nounmount']
	tags = ['functional', 'cli_root', 'zfs_rename']

	[tests/functional/cli_root/zfs_reservation]
	tests = ['zfs_reservation_001_pos', 'zfs_reservation_002_pos']
	tags = ['functional', 'cli_root', 'zfs_reservation']

	[tests/functional/cli_root/zfs_rollback]
	tests = ['zfs_rollback_001_pos', 'zfs_rollback_002_pos',
	'zfs_rollback_003_neg', 'zfs_rollback_004_neg']
	tags = ['functional', 'cli_root', 'zfs_rollback']

	[tests/functional/cli_root/zfs_send]
	tests = ['zfs_send_001_pos', 'zfs_send_002_pos', 'zfs_send_003_pos',
	'zfs_send_004_neg', 'zfs_send_005_pos', 'zfs_send_006_pos',
	'zfs_send_007_pos', 'zfs_send_encrypted', 'zfs_send_raw',
	'zfs_send_sparse', 'zfs_send-b']
	tags = ['functional', 'cli_root', 'zfs_send']

	[tests/functional/cli_root/zfs_set]
	tests = ['cache_001_pos', 'cache_002_neg', 'canmount_001_pos',
	'canmount_002_pos', 'canmount_003_pos', 'canmount_004_pos',
	'checksum_001_pos', 'compression_001_pos', 'mountpoint_001_pos',
	'mountpoint_002_pos', 'reservation_001_neg', 'user_property_002_pos',
	'share_mount_001_neg', 'snapdir_001_pos', 'onoffs_001_pos',
	'user_property_001_pos', 'user_property_003_neg', 'readonly_001_pos',
	'user_property_004_pos', 'version_001_neg', 'zfs_set_001_neg',
	'zfs_set_002_neg', 'zfs_set_003_neg', 'property_alias_001_pos',
	'mountpoint_003_pos', 'ro_props_001_pos', 'zfs_set_keylocation',
	'zfs_set_feature_activation']
	tags = ['functional', 'cli_root', 'zfs_set']

	[tests/functional/cli_root/zfs_share]
	tests = ['zfs_share_001_pos', 'zfs_share_002_pos', 'zfs_share_003_pos',
	'zfs_share_004_pos', 'zfs_share_006_pos', 'zfs_share_008_neg',
	'zfs_share_010_neg', 'zfs_share_011_pos', 'zfs_share_concurrent_shares']
	tags = ['functional', 'cli_root', 'zfs_share']

	[tests/functional/cli_root/zfs_snapshot]
	tests = ['zfs_snapshot_001_neg', 'zfs_snapshot_002_neg',
	'zfs_snapshot_003_neg', 'zfs_snapshot_004_neg', 'zfs_snapshot_005_neg',
	'zfs_snapshot_006_pos', 'zfs_snapshot_007_neg', 'zfs_snapshot_008_neg',
	'zfs_snapshot_009_pos']
	tags = ['functional', 'cli_root', 'zfs_snapshot']

	[tests/functional/cli_root/zfs_unload-key]
	tests = ['zfs_unload-key', 'zfs_unload-key_all', 'zfs_unload-key_recursive']
	tags = ['functional', 'cli_root', 'zfs_unload-key']

	[tests/functional/cli_root/zfs_unmount]
	tests = ['zfs_unmount_001_pos', 'zfs_unmount_002_pos', 'zfs_unmount_003_pos',
	'zfs_unmount_004_pos', 'zfs_unmount_005_pos', 'zfs_unmount_006_pos',
	'zfs_unmount_007_neg', 'zfs_unmount_008_neg', 'zfs_unmount_009_pos',
	'zfs_unmount_all_001_pos', 'zfs_unmount_nested', 'zfs_unmount_unload_keys']
	tags = ['functional', 'cli_root', 'zfs_unmount']

	[tests/functional/cli_root/zfs_unshare]
	tests = ['zfs_unshare_001_pos', 'zfs_unshare_002_pos', 'zfs_unshare_003_pos',
	'zfs_unshare_004_neg', 'zfs_unshare_005_neg', 'zfs_unshare_006_pos',
	'zfs_unshare_007_pos']
	tags = ['functional', 'cli_root', 'zfs_unshare']

	[tests/functional/cli_root/zfs_upgrade]
	tests = ['zfs_upgrade_001_pos', 'zfs_upgrade_002_pos', 'zfs_upgrade_003_pos',
	'zfs_upgrade_004_pos', 'zfs_upgrade_005_pos', 'zfs_upgrade_006_neg',
	'zfs_upgrade_007_neg']
	tags = ['functional', 'cli_root', 'zfs_upgrade']

	[tests/functional/cli_root/zfs_wait]
	tests = ['zfs_wait_deleteq']
	tags = ['functional', 'cli_root', 'zfs_wait']

	[tests/functional/cli_root/zpool]
	tests = ['zpool_001_neg', 'zpool_002_pos', 'zpool_003_pos', 'zpool_colors']
	tags = ['functional', 'cli_root', 'zpool']

	[tests/functional/cli_root/zpool_add]
	tests = ['zpool_add_001_pos', 'zpool_add_002_pos', 'zpool_add_003_pos',
	'zpool_add_004_pos', 'zpool_add_006_pos', 'zpool_add_007_neg',
	'zpool_add_008_neg', 'zpool_add_009_neg', 'zpool_add_010_pos',
	'add-o_ashift', 'add_prop_ashift']
	tags = ['functional', 'cli_root', 'zpool_add']

	[tests/functional/cli_root/zpool_attach]
	tests = ['zpool_attach_001_neg', 'attach-o_ashift']
	tags = ['functional', 'cli_root', 'zpool_attach']

	[tests/functional/cli_root/zpool_clear]
	tests = ['zpool_clear_001_pos', 'zpool_clear_002_neg', 'zpool_clear_003_neg',
	'zpool_clear_readonly']
	tags = ['functional', 'cli_root', 'zpool_clear']

	[tests/functional/cli_root/zpool_create]
	tests = ['zpool_create_001_pos', 'zpool_create_002_pos',
	'zpool_create_003_pos', 'zpool_create_004_pos', 'zpool_create_005_pos',
	'zpool_create_006_pos', 'zpool_create_007_neg', 'zpool_create_008_pos',
	'zpool_create_009_neg', 'zpool_create_010_neg', 'zpool_create_011_neg',
	'zpool_create_012_neg', 'zpool_create_014_neg', 'zpool_create_015_neg',
	'zpool_create_017_neg', 'zpool_create_018_pos', 'zpool_create_019_pos',
	'zpool_create_020_pos', 'zpool_create_021_pos', 'zpool_create_022_pos',
	'zpool_create_023_neg', 'zpool_create_024_pos',
	'zpool_create_encrypted', 'zpool_create_crypt_combos',
	'zpool_create_features_001_pos', 'zpool_create_features_002_pos',
	'zpool_create_features_003_pos', 'zpool_create_features_004_neg',
	'zpool_create_features_005_pos',
	'create-o_ashift', 'zpool_create_tempname']
	tags = ['functional', 'cli_root', 'zpool_create']

	[tests/functional/cli_root/zpool_destroy]
	tests = ['zpool_destroy_001_pos', 'zpool_destroy_002_pos',
	'zpool_destroy_003_neg']
	pre =
	post =
	tags = ['functional', 'cli_root', 'zpool_destroy']

	[tests/functional/cli_root/zpool_detach]
	tests = ['zpool_detach_001_neg']
	tags = ['functional', 'cli_root', 'zpool_detach']

	[tests/functional/cli_root/zpool_events]
	tests = ['zpool_events_clear', 'zpool_events_cliargs', 'zpool_events_follow',
	- 'zpool_events_poolname', 'zpool_events_errors']
	+ 'zpool_events_poolname', 'zpool_events_errors', 'zpool_events_duplicates']
	tags = ['functional', 'cli_root', 'zpool_events']

	[tests/functional/cli_root/zpool_export]
	tests = ['zpool_export_001_pos', 'zpool_export_002_pos',
	'zpool_export_003_neg', 'zpool_export_004_pos']
	tags = ['functional', 'cli_root', 'zpool_export']

	[tests/functional/cli_root/zpool_get]
	tests = ['zpool_get_001_pos', 'zpool_get_002_pos', 'zpool_get_003_pos',
	'zpool_get_004_neg', 'zpool_get_005_pos']
	tags = ['functional', 'cli_root', 'zpool_get']

	[tests/functional/cli_root/zpool_history]
	tests = ['zpool_history_001_neg', 'zpool_history_002_pos']
	tags = ['functional', 'cli_root', 'zpool_history']

	[tests/functional/cli_root/zpool_import]
	tests = ['zpool_import_001_pos', 'zpool_import_002_pos',
	'zpool_import_003_pos', 'zpool_import_004_pos', 'zpool_import_005_pos',
	'zpool_import_006_pos', 'zpool_import_007_pos', 'zpool_import_008_pos',
	'zpool_import_009_neg', 'zpool_import_010_pos', 'zpool_import_011_neg',
	'zpool_import_012_pos', 'zpool_import_013_neg', 'zpool_import_014_pos',
	'zpool_import_015_pos',
	'zpool_import_features_001_pos', 'zpool_import_features_002_neg',
	'zpool_import_features_003_pos', 'zpool_import_missing_001_pos',
	'zpool_import_missing_002_pos', 'zpool_import_missing_003_pos',
	'zpool_import_rename_001_pos', 'zpool_import_all_001_pos',
	'zpool_import_encrypted', 'zpool_import_encrypted_load',
	'zpool_import_errata3', 'zpool_import_errata4',
	'import_cachefile_device_added',
	'import_cachefile_device_removed',
	'import_cachefile_device_replaced',
	'import_cachefile_mirror_attached',
	'import_cachefile_mirror_detached',
	'import_cachefile_shared_device',
	'import_devices_missing',
	'import_paths_changed',
	'import_rewind_config_changed',
	'import_rewind_device_replaced']
	tags = ['functional', 'cli_root', 'zpool_import']

	[tests/functional/cli_root/zpool_labelclear]
	tests = ['zpool_labelclear_active', 'zpool_labelclear_exported',
	'zpool_labelclear_removed', 'zpool_labelclear_valid']
	pre =
	post =
	tags = ['functional', 'cli_root', 'zpool_labelclear']

	[tests/functional/cli_root/zpool_initialize]
	tests = ['zpool_initialize_attach_detach_add_remove',
	'zpool_initialize_import_export',
	'zpool_initialize_offline_export_import_online',
	'zpool_initialize_online_offline',
	'zpool_initialize_split',
	'zpool_initialize_start_and_cancel_neg',
	'zpool_initialize_start_and_cancel_pos',
	'zpool_initialize_suspend_resume',
	'zpool_initialize_unsupported_vdevs',
	'zpool_initialize_verify_checksums',
	'zpool_initialize_verify_initialized']
	pre =
	tags = ['functional', 'cli_root', 'zpool_initialize']

	[tests/functional/cli_root/zpool_offline]
	tests = ['zpool_offline_001_pos', 'zpool_offline_002_neg',
	'zpool_offline_003_pos']
	tags = ['functional', 'cli_root', 'zpool_offline']

	[tests/functional/cli_root/zpool_online]
	tests = ['zpool_online_001_pos', 'zpool_online_002_neg']
	tags = ['functional', 'cli_root', 'zpool_online']

	[tests/functional/cli_root/zpool_remove]
	tests = ['zpool_remove_001_neg', 'zpool_remove_002_pos',
	'zpool_remove_003_pos']
	tags = ['functional', 'cli_root', 'zpool_remove']

	[tests/functional/cli_root/zpool_replace]
	tests = ['zpool_replace_001_neg', 'replace-o_ashift', 'replace_prop_ashift']
	tags = ['functional', 'cli_root', 'zpool_replace']

	[tests/functional/cli_root/zpool_resilver]
	tests = ['zpool_resilver_bad_args', 'zpool_resilver_restart']
	tags = ['functional', 'cli_root', 'zpool_resilver']

	[tests/functional/cli_root/zpool_scrub]
	tests = ['zpool_scrub_001_neg', 'zpool_scrub_002_pos', 'zpool_scrub_003_pos',
	'zpool_scrub_004_pos', 'zpool_scrub_005_pos',
	'zpool_scrub_encrypted_unloaded', 'zpool_scrub_print_repairing',
	'zpool_scrub_offline_device', 'zpool_scrub_multiple_copies']
	tags = ['functional', 'cli_root', 'zpool_scrub']

	[tests/functional/cli_root/zpool_set]
	tests = ['zpool_set_001_pos', 'zpool_set_002_neg', 'zpool_set_003_neg',
	'zpool_set_ashift', 'zpool_set_features']
	tags = ['functional', 'cli_root', 'zpool_set']

	[tests/functional/cli_root/zpool_split]
	tests = ['zpool_split_cliargs', 'zpool_split_devices',
	'zpool_split_encryption', 'zpool_split_props', 'zpool_split_vdevs',
	'zpool_split_resilver', 'zpool_split_indirect']
	tags = ['functional', 'cli_root', 'zpool_split']

	[tests/functional/cli_root/zpool_status]
	tests = ['zpool_status_001_pos', 'zpool_status_002_pos']
	tags = ['functional', 'cli_root', 'zpool_status']

	[tests/functional/cli_root/zpool_sync]
	tests = ['zpool_sync_001_pos', 'zpool_sync_002_neg']
	tags = ['functional', 'cli_root', 'zpool_sync']

	[tests/functional/cli_root/zpool_trim]
	tests = ['zpool_trim_attach_detach_add_remove',
	'zpool_trim_import_export', 'zpool_trim_multiple', 'zpool_trim_neg',
	'zpool_trim_offline_export_import_online', 'zpool_trim_online_offline',
	'zpool_trim_partial', 'zpool_trim_rate', 'zpool_trim_rate_neg',
	'zpool_trim_secure', 'zpool_trim_split', 'zpool_trim_start_and_cancel_neg',
	'zpool_trim_start_and_cancel_pos', 'zpool_trim_suspend_resume',
	'zpool_trim_unsupported_vdevs', 'zpool_trim_verify_checksums',
	'zpool_trim_verify_trimmed']
	tags = ['functional', 'zpool_trim']

	[tests/functional/cli_root/zpool_upgrade]
	tests = ['zpool_upgrade_001_pos', 'zpool_upgrade_002_pos',
	'zpool_upgrade_003_pos', 'zpool_upgrade_004_pos',
	'zpool_upgrade_005_neg', 'zpool_upgrade_006_neg',
	'zpool_upgrade_007_pos', 'zpool_upgrade_008_pos',
	'zpool_upgrade_009_neg']
	tags = ['functional', 'cli_root', 'zpool_upgrade']

	[tests/functional/cli_root/zpool_wait]
	tests = ['zpool_wait_discard', 'zpool_wait_freeing',
	'zpool_wait_initialize_basic', 'zpool_wait_initialize_cancel',
	'zpool_wait_initialize_flag', 'zpool_wait_multiple',
	'zpool_wait_no_activity', 'zpool_wait_remove', 'zpool_wait_remove_cancel',
	'zpool_wait_trim_basic', 'zpool_wait_trim_cancel', 'zpool_wait_trim_flag',
	'zpool_wait_usage']
	tags = ['functional', 'cli_root', 'zpool_wait']

	[tests/functional/cli_root/zpool_wait/scan]
	tests = ['zpool_wait_replace_cancel', 'zpool_wait_rebuild',
	'zpool_wait_resilver', 'zpool_wait_scrub_cancel',
	'zpool_wait_replace', 'zpool_wait_scrub_basic', 'zpool_wait_scrub_flag']
	tags = ['functional', 'cli_root', 'zpool_wait']

	[tests/functional/cli_user/misc]
	tests = ['zdb_001_neg', 'zfs_001_neg', 'zfs_allow_001_neg',
	'zfs_clone_001_neg', 'zfs_create_001_neg', 'zfs_destroy_001_neg',
	'zfs_get_001_neg', 'zfs_inherit_001_neg', 'zfs_mount_001_neg',
	'zfs_promote_001_neg', 'zfs_receive_001_neg', 'zfs_rename_001_neg',
	'zfs_rollback_001_neg', 'zfs_send_001_neg', 'zfs_set_001_neg',
	'zfs_share_001_neg', 'zfs_snapshot_001_neg', 'zfs_unallow_001_neg',
	'zfs_unmount_001_neg', 'zfs_unshare_001_neg', 'zfs_upgrade_001_neg',
	'zpool_001_neg', 'zpool_add_001_neg', 'zpool_attach_001_neg',
	'zpool_clear_001_neg', 'zpool_create_001_neg', 'zpool_destroy_001_neg',
	'zpool_detach_001_neg', 'zpool_export_001_neg', 'zpool_get_001_neg',
	'zpool_history_001_neg', 'zpool_import_001_neg', 'zpool_import_002_neg',
	'zpool_offline_001_neg', 'zpool_online_001_neg', 'zpool_remove_001_neg',
	'zpool_replace_001_neg', 'zpool_scrub_001_neg', 'zpool_set_001_neg',
	'zpool_status_001_neg', 'zpool_upgrade_001_neg', 'arcstat_001_pos',
	'arc_summary_001_pos', 'arc_summary_002_neg', 'zpool_wait_privilege']
	user =
	tags = ['functional', 'cli_user', 'misc']

	[tests/functional/cli_user/zfs_list]
	tests = ['zfs_list_001_pos', 'zfs_list_002_pos', 'zfs_list_003_pos',
	'zfs_list_004_neg', 'zfs_list_007_pos', 'zfs_list_008_neg']
	user =
	tags = ['functional', 'cli_user', 'zfs_list']

	[tests/functional/cli_user/zpool_iostat]
	tests = ['zpool_iostat_001_neg', 'zpool_iostat_002_pos',
	'zpool_iostat_003_neg', 'zpool_iostat_004_pos',
	'zpool_iostat_005_pos', 'zpool_iostat_-c_disable',
	'zpool_iostat_-c_homedir', 'zpool_iostat_-c_searchpath']
	user =
	tags = ['functional', 'cli_user', 'zpool_iostat']

	[tests/functional/cli_user/zpool_list]
	tests = ['zpool_list_001_pos', 'zpool_list_002_neg']
	user =
	tags = ['functional', 'cli_user', 'zpool_list']

	[tests/functional/cli_user/zpool_status]
	tests = ['zpool_status_003_pos', 'zpool_status_-c_disable',
	'zpool_status_-c_homedir', 'zpool_status_-c_searchpath']
	user =
	tags = ['functional', 'cli_user', 'zpool_status']

	[tests/functional/compression]
	tests = ['compress_001_pos', 'compress_002_pos', 'compress_003_pos',
	'l2arc_compressed_arc', 'l2arc_compressed_arc_disabled',
	'l2arc_encrypted', 'l2arc_encrypted_no_compressed_arc']
	tags = ['functional', 'compression']

	[tests/functional/cp_files]
	tests = ['cp_files_001_pos']
	tags = ['functional', 'cp_files']

	[tests/functional/ctime]
	tests = ['ctime_001_pos' ]
	tags = ['functional', 'ctime']

	[tests/functional/delegate]
	tests = ['zfs_allow_001_pos', 'zfs_allow_002_pos', 'zfs_allow_003_pos',
	'zfs_allow_004_pos', 'zfs_allow_005_pos', 'zfs_allow_006_pos',
	'zfs_allow_007_pos', 'zfs_allow_008_pos', 'zfs_allow_009_neg',
	'zfs_allow_010_pos', 'zfs_allow_011_neg', 'zfs_allow_012_neg',
	'zfs_unallow_001_pos', 'zfs_unallow_002_pos', 'zfs_unallow_003_pos',
	'zfs_unallow_004_pos', 'zfs_unallow_005_pos', 'zfs_unallow_006_pos',
	'zfs_unallow_007_neg', 'zfs_unallow_008_neg']
	tags = ['functional', 'delegate']

	[tests/functional/exec]
	tests = ['exec_001_pos', 'exec_002_neg']
	tags = ['functional', 'exec']

	[tests/functional/features/async_destroy]
	tests = ['async_destroy_001_pos']
	tags = ['functional', 'features', 'async_destroy']

	[tests/functional/features/large_dnode]
	tests = ['large_dnode_001_pos', 'large_dnode_003_pos', 'large_dnode_004_neg',
	'large_dnode_005_pos', 'large_dnode_007_neg', 'large_dnode_009_pos']
	tags = ['functional', 'features', 'large_dnode']

	[tests/functional/grow]
	pre =
	post =
	tests = ['grow_pool_001_pos', 'grow_replicas_001_pos']
	tags = ['functional', 'grow']

	[tests/functional/history]
	tests = ['history_001_pos', 'history_002_pos', 'history_003_pos',
	'history_004_pos', 'history_005_neg', 'history_006_neg',
	'history_007_pos', 'history_008_pos', 'history_009_pos',
	'history_010_pos']
	tags = ['functional', 'history']

	[tests/functional/hkdf]
	tests = ['run_hkdf_test']
	tags = ['functional', 'hkdf']

	[tests/functional/inheritance]
	tests = ['inherit_001_pos']
	pre =
	tags = ['functional', 'inheritance']

	[tests/functional/io]
	tests = ['sync', 'psync', 'posixaio', 'mmap']
	tags = ['functional', 'io']

	[tests/functional/inuse]
	tests = ['inuse_004_pos', 'inuse_005_pos', 'inuse_008_pos', 'inuse_009_pos']
	post =
	tags = ['functional', 'inuse']

	[tests/functional/large_files]
	tests = ['large_files_001_pos', 'large_files_002_pos']
	tags = ['functional', 'large_files']

	[tests/functional/largest_pool]
	tests = ['largest_pool_001_pos']
	pre =
	post =
	tags = ['functional', 'largest_pool']

	[tests/functional/limits]
	tests = ['filesystem_count', 'filesystem_limit', 'snapshot_count',
	'snapshot_limit']
	tags = ['functional', 'limits']

	[tests/functional/link_count]
	tests = ['link_count_001', 'link_count_root_inode']
	tags = ['functional', 'link_count']

	[tests/functional/migration]
	tests = ['migration_001_pos', 'migration_002_pos', 'migration_003_pos',
	'migration_004_pos', 'migration_005_pos', 'migration_006_pos',
	'migration_007_pos', 'migration_008_pos', 'migration_009_pos',
	'migration_010_pos', 'migration_011_pos', 'migration_012_pos']
	tags = ['functional', 'migration']

	[tests/functional/mmap]
	tests = ['mmap_write_001_pos', 'mmap_read_001_pos']
	tags = ['functional', 'mmap']

	[tests/functional/mount]
	tests = ['umount_001', 'umountall_001']
	tags = ['functional', 'mount']

	[tests/functional/mv_files]
	tests = ['mv_files_001_pos', 'mv_files_002_pos', 'random_creation']
	tags = ['functional', 'mv_files']

	[tests/functional/nestedfs]
	tests = ['nestedfs_001_pos']
	tags = ['functional', 'nestedfs']

	[tests/functional/no_space]
	tests = ['enospc_001_pos', 'enospc_002_pos', 'enospc_003_pos',
	'enospc_df']
	tags = ['functional', 'no_space']

	[tests/functional/nopwrite]
	tests = ['nopwrite_copies', 'nopwrite_mtime', 'nopwrite_negative',
	'nopwrite_promoted_clone', 'nopwrite_recsize', 'nopwrite_sync',
	'nopwrite_varying_compression', 'nopwrite_volume']
	tags = ['functional', 'nopwrite']

	[tests/functional/online_offline]
	tests = ['online_offline_001_pos', 'online_offline_002_neg',
	'online_offline_003_neg']
	tags = ['functional', 'online_offline']

	[tests/functional/persist_l2arc]
	tests = ['persist_l2arc_001_pos', 'persist_l2arc_002_pos',
	'persist_l2arc_003_neg', 'persist_l2arc_004_pos', 'persist_l2arc_005_pos',
	'persist_l2arc_006_pos', 'persist_l2arc_007_pos', 'persist_l2arc_008_pos']
	tags = ['functional', 'persist_l2arc']

	[tests/functional/pool_checkpoint]
	tests = ['checkpoint_after_rewind', 'checkpoint_big_rewind',
	'checkpoint_capacity', 'checkpoint_conf_change', 'checkpoint_discard',
	'checkpoint_discard_busy', 'checkpoint_discard_many',
	'checkpoint_indirect', 'checkpoint_invalid', 'checkpoint_lun_expsz',
	'checkpoint_open', 'checkpoint_removal', 'checkpoint_rewind',
	'checkpoint_ro_rewind', 'checkpoint_sm_scale', 'checkpoint_twice',
	'checkpoint_vdev_add', 'checkpoint_zdb', 'checkpoint_zhack_feat']
	tags = ['functional', 'pool_checkpoint']
	timeout = 1800

	[tests/functional/pool_names]
	tests = ['pool_names_001_pos', 'pool_names_002_neg']
	pre =
	post =
	tags = ['functional', 'pool_names']

	[tests/functional/poolversion]
	tests = ['poolversion_001_pos', 'poolversion_002_pos']
	tags = ['functional', 'poolversion']

	[tests/functional/pyzfs]
	tests = ['pyzfs_unittest']
	pre =
	post =
	tags = ['functional', 'pyzfs']

	[tests/functional/quota]
	tests = ['quota_001_pos', 'quota_002_pos', 'quota_003_pos',
	'quota_004_pos', 'quota_005_pos', 'quota_006_neg']
	tags = ['functional', 'quota']

	[tests/functional/redacted_send]
	tests = ['redacted_compressed', 'redacted_contents', 'redacted_deleted',
	'redacted_disabled_feature', 'redacted_embedded', 'redacted_holes',
	'redacted_incrementals', 'redacted_largeblocks', 'redacted_many_clones',
	'redacted_mixed_recsize', 'redacted_mounts', 'redacted_negative',
	'redacted_origin', 'redacted_props', 'redacted_resume', 'redacted_size',
	'redacted_volume']
	tags = ['functional', 'redacted_send']

	[tests/functional/raidz]
	tests = ['raidz_001_neg', 'raidz_002_pos']
	tags = ['functional', 'raidz']

	[tests/functional/redundancy]
	tests = ['redundancy_001_pos', 'redundancy_002_pos', 'redundancy_003_pos',
	'redundancy_004_neg']
	tags = ['functional', 'redundancy']

	[tests/functional/refquota]
	tests = ['refquota_001_pos', 'refquota_002_pos', 'refquota_003_pos',
	'refquota_004_pos', 'refquota_005_pos', 'refquota_006_neg',
	'refquota_007_neg', 'refquota_008_neg']
	tags = ['functional', 'refquota']

	[tests/functional/refreserv]
	tests = ['refreserv_001_pos', 'refreserv_002_pos', 'refreserv_003_pos',
	'refreserv_004_pos', 'refreserv_005_pos', 'refreserv_multi_raidz',
	'refreserv_raidz']
	tags = ['functional', 'refreserv']

	[tests/functional/removal]
	pre =
	tests = ['removal_all_vdev', 'removal_cancel', 'removal_check_space',
	'removal_condense_export', 'removal_multiple_indirection',
	'removal_nopwrite', 'removal_remap_deadlists',
	'removal_resume_export', 'removal_sanity', 'removal_with_add',
	'removal_with_create_fs', 'removal_with_dedup',
	'removal_with_errors', 'removal_with_export',
	'removal_with_ganging', 'removal_with_faulted',
	'removal_with_remove', 'removal_with_scrub', 'removal_with_send',
	'removal_with_send_recv', 'removal_with_snapshot',
	'removal_with_write', 'removal_with_zdb', 'remove_expanded',
	'remove_mirror', 'remove_mirror_sanity', 'remove_raidz',
	'remove_indirect']
	tags = ['functional', 'removal']

	[tests/functional/rename_dirs]
	tests = ['rename_dirs_001_pos']
	tags = ['functional', 'rename_dirs']

	[tests/functional/replacement]
	tests = ['attach_import', 'attach_multiple', 'attach_rebuild',
	'attach_resilver', 'detach', 'rebuild_disabled_feature',
	'rebuild_multiple', 'rebuild_raidz', 'replace_import', 'replace_rebuild',
	'replace_resilver', 'resilver_restart_001', 'resilver_restart_002',
	'scrub_cancel']
	tags = ['functional', 'replacement']

	[tests/functional/reservation]
	tests = ['reservation_001_pos', 'reservation_002_pos', 'reservation_003_pos',
	'reservation_004_pos', 'reservation_005_pos', 'reservation_006_pos',
	'reservation_007_pos', 'reservation_008_pos', 'reservation_009_pos',
	'reservation_010_pos', 'reservation_011_pos', 'reservation_012_pos',
	'reservation_013_pos', 'reservation_014_pos', 'reservation_015_pos',
	'reservation_016_pos', 'reservation_017_pos', 'reservation_018_pos',
	'reservation_019_pos', 'reservation_020_pos', 'reservation_021_neg',
	'reservation_022_pos']
	tags = ['functional', 'reservation']

	[tests/functional/rootpool]
	tests = ['rootpool_002_neg', 'rootpool_003_neg', 'rootpool_007_pos']
	tags = ['functional', 'rootpool']

	[tests/functional/rsend]
	tests = ['recv_dedup', 'recv_dedup_encrypted_zvol', 'rsend_001_pos',
	'rsend_002_pos', 'rsend_003_pos', 'rsend_004_pos', 'rsend_005_pos',
	'rsend_006_pos', 'rsend_007_pos', 'rsend_008_pos', 'rsend_009_pos',
	'rsend_010_pos', 'rsend_011_pos', 'rsend_012_pos', 'rsend_013_pos',
	'rsend_014_pos', 'rsend_016_neg', 'rsend_019_pos', 'rsend_020_pos',
	'rsend_021_pos', 'rsend_022_pos', 'rsend_024_pos',
	'send-c_verify_ratio', 'send-c_verify_contents', 'send-c_props',
	'send-c_incremental', 'send-c_volume', 'send-c_zstreamdump',
	'send-c_lz4_disabled', 'send-c_recv_lz4_disabled',
	'send-c_mixed_compression', 'send-c_stream_size_estimate',
	'send-c_embedded_blocks', 'send-c_resume', 'send-cpL_varied_recsize',
	'send-c_recv_dedup', 'send-L_toggle', 'send_encrypted_hierarchy',
	'send_encrypted_props', 'send_encrypted_truncated_files',
	'send_freeobjects', 'send_realloc_files',
	'send_realloc_encrypted_files', 'send_spill_block', 'send_holds',
	'send_hole_birth', 'send_mixed_raw', 'send-wR_encrypted_zvol',
	'send_partial_dataset']
	tags = ['functional', 'rsend']

	[tests/functional/scrub_mirror]
	tests = ['scrub_mirror_001_pos', 'scrub_mirror_002_pos',
	'scrub_mirror_003_pos', 'scrub_mirror_004_pos']
	tags = ['functional', 'scrub_mirror']

	[tests/functional/slog]
	tests = ['slog_001_pos', 'slog_002_pos', 'slog_003_pos', 'slog_004_pos',
	'slog_005_pos', 'slog_006_pos', 'slog_007_pos', 'slog_008_neg',
	'slog_009_neg', 'slog_010_neg', 'slog_011_neg', 'slog_012_neg',
	'slog_013_pos', 'slog_014_pos', 'slog_015_neg', 'slog_replay_fs_001',
	'slog_replay_fs_002', 'slog_replay_volume']
	tags = ['functional', 'slog']

	[tests/functional/snapshot]
	tests = ['clone_001_pos', 'rollback_001_pos', 'rollback_002_pos',
	'rollback_003_pos', 'snapshot_001_pos', 'snapshot_002_pos',
	'snapshot_003_pos', 'snapshot_004_pos', 'snapshot_005_pos',
	'snapshot_006_pos', 'snapshot_007_pos', 'snapshot_008_pos',
	'snapshot_009_pos', 'snapshot_010_pos', 'snapshot_011_pos',
	'snapshot_012_pos', 'snapshot_013_pos', 'snapshot_014_pos',
	'snapshot_017_pos']
	tags = ['functional', 'snapshot']

	[tests/functional/snapused]
	tests = ['snapused_001_pos', 'snapused_002_pos', 'snapused_003_pos',
	'snapused_004_pos', 'snapused_005_pos']
	tags = ['functional', 'snapused']

	[tests/functional/sparse]
	tests = ['sparse_001_pos']
	tags = ['functional', 'sparse']

	[tests/functional/suid]
	tests = ['suid_write_to_suid', 'suid_write_to_sgid', 'suid_write_to_suid_sgid',
	'suid_write_to_none']
	tags = ['functional', 'suid']

	[tests/functional/threadsappend]
	tests = ['threadsappend_001_pos']
	tags = ['functional', 'threadsappend']

	[tests/functional/trim]
	tests = ['autotrim_integrity', 'autotrim_config', 'autotrim_trim_integrity',
	'trim_integrity', 'trim_config', 'trim_l2arc']
	tags = ['functional', 'trim']

	[tests/functional/truncate]
	tests = ['truncate_001_pos', 'truncate_002_pos', 'truncate_timestamps']
	tags = ['functional', 'truncate']

	[tests/functional/upgrade]
	tests = ['upgrade_userobj_001_pos', 'upgrade_readonly_pool']
	tags = ['functional', 'upgrade']

	[tests/functional/userquota]
	tests = [
	'userquota_001_pos', 'userquota_002_pos', 'userquota_003_pos',
	'userquota_004_pos', 'userquota_005_neg', 'userquota_006_pos',
	'userquota_007_pos', 'userquota_008_pos', 'userquota_009_pos',
	'userquota_010_pos', 'userquota_011_pos', 'userquota_012_neg',
	'userspace_001_pos', 'userspace_002_pos']
	tags = ['functional', 'userquota']

	[tests/functional/vdev_zaps]
	tests = ['vdev_zaps_001_pos', 'vdev_zaps_002_pos', 'vdev_zaps_003_pos',
	'vdev_zaps_004_pos', 'vdev_zaps_005_pos', 'vdev_zaps_006_pos',
	'vdev_zaps_007_pos']
	tags = ['functional', 'vdev_zaps']

	[tests/functional/write_dirs]
	tests = ['write_dirs_001_pos', 'write_dirs_002_pos']
	tags = ['functional', 'write_dirs']

	[tests/functional/xattr]
	tests = ['xattr_001_pos', 'xattr_002_neg', 'xattr_003_neg', 'xattr_004_pos',
	'xattr_005_pos', 'xattr_006_pos', 'xattr_007_neg',
	'xattr_011_pos', 'xattr_012_pos', 'xattr_013_pos']
	tags = ['functional', 'xattr']

	[tests/functional/zvol/zvol_ENOSPC]
	tests = ['zvol_ENOSPC_001_pos']
	tags = ['functional', 'zvol', 'zvol_ENOSPC']

	[tests/functional/zvol/zvol_cli]
	tests = ['zvol_cli_001_pos', 'zvol_cli_002_pos', 'zvol_cli_003_neg']
	tags = ['functional', 'zvol', 'zvol_cli']

	[tests/functional/zvol/zvol_misc]
	tests = ['zvol_misc_002_pos', 'zvol_misc_hierarchy', 'zvol_misc_rename_inuse',
	'zvol_misc_snapdev', 'zvol_misc_volmode', 'zvol_misc_zil']
	tags = ['functional', 'zvol', 'zvol_misc']

	[tests/functional/zvol/zvol_swap]
	tests = ['zvol_swap_001_pos', 'zvol_swap_002_pos', 'zvol_swap_004_pos']
	tags = ['functional', 'zvol', 'zvol_swap']

	[tests/functional/libzfs]
	tests = ['many_fds', 'libzfs_input']
	tags = ['functional', 'libzfs']

	[tests/functional/log_spacemap]
	tests = ['log_spacemap_import_logs']
	pre =
	post =
	tags = ['functional', 'log_spacemap']
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/cmd/libzfs_input_check/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/cmd/libzfs_input_check/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/cmd/libzfs_input_check/Makefile.am (revision 365892)
	@@ -1,10 +1,17 @@
	include $(top_srcdir)/config/Rules.am

	pkgexecdir = $(datadir)/@PACKAGE@/zfs-tests/bin

	pkgexec_PROGRAMS = libzfs_input_check

	+if BUILD_FREEBSD
	+DEFAULT_INCLUDES += -I$(top_srcdir)/include/os/freebsd/zfs
	+endif
	+if BUILD_LINUX
	+DEFAULT_INCLUDES += -I$(top_srcdir)/include/os/linux/zfs
	+endif
	+
	libzfs_input_check_SOURCES = libzfs_input_check.c
	libzfs_input_check_LDADD = \
	$(abs_top_builddir)/lib/libzfs_core/libzfs_core.la \
	$(abs_top_builddir)/lib/libnvpair/libnvpair.la
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/cmd/libzfs_input_check/libzfs_input_check.c
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/cmd/libzfs_input_check/libzfs_input_check.c (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/cmd/libzfs_input_check/libzfs_input_check.c (revision 365892)
	@@ -1,1060 +1,1063 @@
	/*
	* CDDL HEADER START
	*
	* This file and its contents are supplied under the terms of the
	* Common Development and Distribution License ("CDDL"), version 1.0.
	* You may only use this file in accordance with the terms of version
	* 1.0 of the CDDL.
	*
	* A full copy of the text of the CDDL should have accompanied this
	* source. A copy of the CDDL is also available via the Internet at
	* http://www.illumos.org/license/CDDL.
	*
	* CDDL HEADER END
	*/

	/*
	* Copyright (c) 2018 by Delphix. All rights reserved.
	*/

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <strings.h>
	#include <libzfs_core.h>
	#include <libzutil.h>

	#include <sys/nvpair.h>
	+#include <sys/vdev_impl.h>
	#include <sys/zfs_ioctl.h>
	+#include <sys/zfs_bootenv.h>

	/*
	* Test the nvpair inputs for the non-legacy zfs ioctl commands.
	*/

	boolean_t unexpected_failures;
	int zfs_fd;
	const char *active_test;

	/*
	* Tracks which zfs_ioc_t commands were tested
	*/
	boolean_t ioc_tested[ZFS_IOC_LAST - ZFS_IOC_FIRST];

	/*
	* Legacy ioctls that are skipped (for now)
	*/
	static unsigned ioc_skip[] = {
	ZFS_IOC_POOL_CREATE,
	ZFS_IOC_POOL_DESTROY,
	ZFS_IOC_POOL_IMPORT,
	ZFS_IOC_POOL_EXPORT,
	ZFS_IOC_POOL_CONFIGS,
	ZFS_IOC_POOL_STATS,
	ZFS_IOC_POOL_TRYIMPORT,
	ZFS_IOC_POOL_SCAN,
	ZFS_IOC_POOL_FREEZE,
	ZFS_IOC_POOL_UPGRADE,
	ZFS_IOC_POOL_GET_HISTORY,

	ZFS_IOC_VDEV_ADD,
	ZFS_IOC_VDEV_REMOVE,
	ZFS_IOC_VDEV_SET_STATE,
	ZFS_IOC_VDEV_ATTACH,
	ZFS_IOC_VDEV_DETACH,
	ZFS_IOC_VDEV_SETPATH,
	ZFS_IOC_VDEV_SETFRU,

	ZFS_IOC_OBJSET_STATS,
	ZFS_IOC_OBJSET_ZPLPROPS,
	ZFS_IOC_DATASET_LIST_NEXT,
	ZFS_IOC_SNAPSHOT_LIST_NEXT,
	ZFS_IOC_SET_PROP,
	ZFS_IOC_DESTROY,
	ZFS_IOC_RENAME,
	ZFS_IOC_RECV,
	ZFS_IOC_SEND,
	ZFS_IOC_INJECT_FAULT,
	ZFS_IOC_CLEAR_FAULT,
	ZFS_IOC_INJECT_LIST_NEXT,
	ZFS_IOC_ERROR_LOG,
	ZFS_IOC_CLEAR,
	ZFS_IOC_PROMOTE,
	ZFS_IOC_DSOBJ_TO_DSNAME,
	ZFS_IOC_OBJ_TO_PATH,
	ZFS_IOC_POOL_SET_PROPS,
	ZFS_IOC_POOL_GET_PROPS,
	ZFS_IOC_SET_FSACL,
	ZFS_IOC_GET_FSACL,
	ZFS_IOC_SHARE,
	ZFS_IOC_INHERIT_PROP,
	ZFS_IOC_SMB_ACL,
	ZFS_IOC_USERSPACE_ONE,
	ZFS_IOC_USERSPACE_MANY,
	ZFS_IOC_USERSPACE_UPGRADE,
	ZFS_IOC_OBJSET_RECVD_PROPS,
	ZFS_IOC_VDEV_SPLIT,
	ZFS_IOC_NEXT_OBJ,
	ZFS_IOC_DIFF,
	ZFS_IOC_TMP_SNAPSHOT,
	ZFS_IOC_OBJ_TO_STATS,
	ZFS_IOC_SPACE_WRITTEN,
	ZFS_IOC_POOL_REGUID,
	ZFS_IOC_SEND_PROGRESS,
	ZFS_IOC_EVENTS_NEXT,
	ZFS_IOC_EVENTS_CLEAR,
	ZFS_IOC_EVENTS_SEEK,
	ZFS_IOC_NEXTBOOT,
	ZFS_IOC_JAIL,
	ZFS_IOC_UNJAIL,
	};


	#define IOC_INPUT_TEST(ioc, name, req, opt, err) \
	IOC_INPUT_TEST_IMPL(ioc, name, req, opt, err, B_FALSE)

	#define IOC_INPUT_TEST_WILD(ioc, name, req, opt, err) \
	IOC_INPUT_TEST_IMPL(ioc, name, req, opt, err, B_TRUE)

	#define IOC_INPUT_TEST_IMPL(ioc, name, req, opt, err, wild) \
	do { \
	active_test = __func__ + 5; \
	ioc_tested[ioc - ZFS_IOC_FIRST] = B_TRUE; \
	lzc_ioctl_test(ioc, name, req, opt, err, wild); \
	} while (0)

	/*
	* run a zfs ioctl command, verify expected results and log failures
	*/
	static void
	lzc_ioctl_run(zfs_ioc_t ioc, const char name, nvlist_t innvl, int expected)
	{
	zfs_cmd_t zc = {"\0"};
	char *packed = NULL;
	const char *variant;
	size_t size = 0;
	int error = 0;

	switch (expected) {
	case ZFS_ERR_IOC_ARG_UNAVAIL:
	variant = "unsupported input";
	break;
	case ZFS_ERR_IOC_ARG_REQUIRED:
	variant = "missing input";
	break;
	case ZFS_ERR_IOC_ARG_BADTYPE:
	variant = "invalid input type";
	break;
	default:
	variant = "valid input";
	break;
	}

	packed = fnvlist_pack(innvl, &size);
	(void) strlcpy(zc.zc_name, name, sizeof (zc.zc_name));
	zc.zc_name[sizeof (zc.zc_name) - 1] = '\0';
	zc.zc_nvlist_src = (uint64_t)(uintptr_t)packed;
	zc.zc_nvlist_src_size = size;
	zc.zc_nvlist_dst_size = MAX(size * 2, 128 * 1024);
	zc.zc_nvlist_dst = (uint64_t)(uintptr_t)malloc(zc.zc_nvlist_dst_size);

	if (zfs_ioctl_fd(zfs_fd, ioc, &zc) != 0)
	error = errno;

	if (error != expected) {
	unexpected_failures = B_TRUE;
	(void) fprintf(stderr, "%s: Unexpected result with %s, "
	"error %d (expecting %d)\n",
	active_test, variant, error, expected);
	}

	fnvlist_pack_free(packed, size);
	free((void *)(uintptr_t)zc.zc_nvlist_dst);
	}

	/*
	* Test each ioc for the following ioctl input errors:
	* ZFS_ERR_IOC_ARG_UNAVAIL an input argument is not supported by kernel
	* ZFS_ERR_IOC_ARG_REQUIRED a required input argument is missing
	* ZFS_ERR_IOC_ARG_BADTYPE an input argument has an invalid type
	*/
	static int
	lzc_ioctl_test(zfs_ioc_t ioc, const char name, nvlist_t required,
	nvlist_t *optional, int expected_error, boolean_t wildcard)
	{
	nvlist_t *input = fnvlist_alloc();
	nvlist_t *future = fnvlist_alloc();
	int error = 0;

	if (required != NULL) {
	for (nvpair_t *pair = nvlist_next_nvpair(required, NULL);
	pair != NULL; pair = nvlist_next_nvpair(required, pair)) {
	fnvlist_add_nvpair(input, pair);
	}
	}
	if (optional != NULL) {
	for (nvpair_t *pair = nvlist_next_nvpair(optional, NULL);
	pair != NULL; pair = nvlist_next_nvpair(optional, pair)) {
	fnvlist_add_nvpair(input, pair);
	}
	}

	/*
	* Generic input run with 'optional' nvlist pair
	*/
	if (!wildcard)
	fnvlist_add_nvlist(input, "optional", future);
	lzc_ioctl_run(ioc, name, input, expected_error);
	if (!wildcard)
	fnvlist_remove(input, "optional");

	/*
	* Bogus input value
	*/
	if (!wildcard) {
	fnvlist_add_string(input, "bogus_input", "bogus");
	lzc_ioctl_run(ioc, name, input, ZFS_ERR_IOC_ARG_UNAVAIL);
	fnvlist_remove(input, "bogus_input");
	}

	/*
	* Missing required inputs
	*/
	if (required != NULL) {
	nvlist_t *empty = fnvlist_alloc();
	lzc_ioctl_run(ioc, name, empty, ZFS_ERR_IOC_ARG_REQUIRED);
	nvlist_free(empty);
	}

	/*
	* Wrong nvpair type
	*/
	if (required != NULL \|\| optional != NULL) {
	/*
	* switch the type of one of the input pairs
	*/
	for (nvpair_t *pair = nvlist_next_nvpair(input, NULL);
	pair != NULL; pair = nvlist_next_nvpair(input, pair)) {
	char pname[MAXNAMELEN];
	data_type_t ptype;

	strlcpy(pname, nvpair_name(pair), sizeof (pname));
	pname[sizeof (pname) - 1] = '\0';
	ptype = nvpair_type(pair);
	fnvlist_remove_nvpair(input, pair);

	switch (ptype) {
	case DATA_TYPE_STRING:
	fnvlist_add_uint64(input, pname, 42);
	break;
	default:
	fnvlist_add_string(input, pname, "bogus");
	break;
	}
	}
	lzc_ioctl_run(ioc, name, input, ZFS_ERR_IOC_ARG_BADTYPE);
	}

	nvlist_free(future);
	nvlist_free(input);

	return (error);
	}

	static void
	test_pool_sync(const char *pool)
	{
	nvlist_t *required = fnvlist_alloc();

	fnvlist_add_boolean_value(required, "force", B_TRUE);

	IOC_INPUT_TEST(ZFS_IOC_POOL_SYNC, pool, required, NULL, 0);

	nvlist_free(required);
	}

	static void
	test_pool_reopen(const char *pool)
	{
	nvlist_t *optional = fnvlist_alloc();

	fnvlist_add_boolean_value(optional, "scrub_restart", B_FALSE);

	IOC_INPUT_TEST(ZFS_IOC_POOL_REOPEN, pool, NULL, optional, 0);

	nvlist_free(optional);
	}

	static void
	test_pool_checkpoint(const char *pool)
	{
	IOC_INPUT_TEST(ZFS_IOC_POOL_CHECKPOINT, pool, NULL, NULL, 0);
	}

	static void
	test_pool_discard_checkpoint(const char *pool)
	{
	int err = lzc_pool_checkpoint(pool);
	if (err == 0 \|\| err == ZFS_ERR_CHECKPOINT_EXISTS)
	IOC_INPUT_TEST(ZFS_IOC_POOL_DISCARD_CHECKPOINT, pool, NULL,
	NULL, 0);
	}

	static void
	test_log_history(const char *pool)
	{
	nvlist_t *required = fnvlist_alloc();

	fnvlist_add_string(required, "message", "input check");

	IOC_INPUT_TEST(ZFS_IOC_LOG_HISTORY, pool, required, NULL, 0);

	nvlist_free(required);
	}

	static void
	test_create(const char *pool)
	{
	char dataset[MAXNAMELEN + 32];

	(void) snprintf(dataset, sizeof (dataset), "%s/create-fs", pool);

	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();
	nvlist_t *props = fnvlist_alloc();

	fnvlist_add_int32(required, "type", DMU_OST_ZFS);
	fnvlist_add_uint64(props, "recordsize", 8192);
	fnvlist_add_nvlist(optional, "props", props);

	IOC_INPUT_TEST(ZFS_IOC_CREATE, dataset, required, optional, 0);

	nvlist_free(required);
	nvlist_free(optional);
	}

	static void
	test_snapshot(const char pool, const char snapshot)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();
	nvlist_t *snaps = fnvlist_alloc();
	nvlist_t *props = fnvlist_alloc();

	fnvlist_add_boolean(snaps, snapshot);
	fnvlist_add_nvlist(required, "snaps", snaps);

	fnvlist_add_string(props, "org.openzfs:launch", "September 17th, 2013");
	fnvlist_add_nvlist(optional, "props", props);

	IOC_INPUT_TEST(ZFS_IOC_SNAPSHOT, pool, required, optional, 0);

	nvlist_free(props);
	nvlist_free(snaps);
	nvlist_free(optional);
	nvlist_free(required);
	}

	static void
	test_space_snaps(const char *snapshot)
	{
	nvlist_t *required = fnvlist_alloc();
	fnvlist_add_string(required, "firstsnap", snapshot);

	IOC_INPUT_TEST(ZFS_IOC_SPACE_SNAPS, snapshot, required, NULL, 0);

	nvlist_free(required);
	}

	static void
	test_destroy_snaps(const char pool, const char snapshot)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *snaps = fnvlist_alloc();

	fnvlist_add_boolean(snaps, snapshot);
	fnvlist_add_nvlist(required, "snaps", snaps);

	IOC_INPUT_TEST(ZFS_IOC_DESTROY_SNAPS, pool, required, NULL, 0);

	nvlist_free(snaps);
	nvlist_free(required);
	}


	static void
	test_bookmark(const char pool, const char snapshot, const char *bookmark)
	{
	nvlist_t *required = fnvlist_alloc();

	fnvlist_add_string(required, bookmark, snapshot);

	IOC_INPUT_TEST_WILD(ZFS_IOC_BOOKMARK, pool, required, NULL, 0);

	nvlist_free(required);
	}

	static void
	test_get_bookmarks(const char *dataset)
	{
	nvlist_t *optional = fnvlist_alloc();

	fnvlist_add_boolean(optional, "guid");
	fnvlist_add_boolean(optional, "createtxg");
	fnvlist_add_boolean(optional, "creation");

	IOC_INPUT_TEST_WILD(ZFS_IOC_GET_BOOKMARKS, dataset, NULL, optional, 0);

	nvlist_free(optional);
	}

	static void
	test_destroy_bookmarks(const char pool, const char bookmark)
	{
	nvlist_t *required = fnvlist_alloc();

	fnvlist_add_boolean(required, bookmark);

	IOC_INPUT_TEST_WILD(ZFS_IOC_DESTROY_BOOKMARKS, pool, required, NULL, 0);

	nvlist_free(required);
	}

	static void
	test_clone(const char snapshot, const char clone)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();
	nvlist_t *props = fnvlist_alloc();

	fnvlist_add_string(required, "origin", snapshot);

	IOC_INPUT_TEST(ZFS_IOC_CLONE, clone, required, NULL, 0);

	nvlist_free(props);
	nvlist_free(optional);
	nvlist_free(required);
	}

	static void
	test_rollback(const char dataset, const char snapshot)
	{
	nvlist_t *optional = fnvlist_alloc();

	fnvlist_add_string(optional, "target", snapshot);

	IOC_INPUT_TEST(ZFS_IOC_ROLLBACK, dataset, NULL, optional, B_FALSE);

	nvlist_free(optional);
	}

	static void
	test_hold(const char pool, const char snapshot)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();
	nvlist_t *holds = fnvlist_alloc();

	fnvlist_add_string(holds, snapshot, "libzfs_check_hold");
	fnvlist_add_nvlist(required, "holds", holds);
	fnvlist_add_int32(optional, "cleanup_fd", zfs_fd);

	IOC_INPUT_TEST(ZFS_IOC_HOLD, pool, required, optional, 0);

	nvlist_free(holds);
	nvlist_free(optional);
	nvlist_free(required);
	}

	static void
	test_get_holds(const char *snapshot)
	{
	IOC_INPUT_TEST(ZFS_IOC_GET_HOLDS, snapshot, NULL, NULL, 0);
	}

	static void
	test_release(const char pool, const char snapshot)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *release = fnvlist_alloc();

	fnvlist_add_boolean(release, "libzfs_check_hold");
	fnvlist_add_nvlist(required, snapshot, release);

	IOC_INPUT_TEST_WILD(ZFS_IOC_RELEASE, pool, required, NULL, 0);

	nvlist_free(release);
	nvlist_free(required);
	}


	static void
	test_send_new(const char *snapshot, int fd)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();

	fnvlist_add_int32(required, "fd", fd);

	fnvlist_add_boolean(optional, "largeblockok");
	fnvlist_add_boolean(optional, "embedok");
	fnvlist_add_boolean(optional, "compressok");
	fnvlist_add_boolean(optional, "rawok");

	/*
	* TODO - Resumable send is harder to set up. So we currently
	* ignore testing for that variant.
	*/
	#if 0
	fnvlist_add_string(optional, "fromsnap", from);
	fnvlist_add_uint64(optional, "resume_object", resumeobj);
	fnvlist_add_uint64(optional, "resume_offset", offset);
	fnvlist_add_boolean(optional, "savedok");
	#endif
	IOC_INPUT_TEST(ZFS_IOC_SEND_NEW, snapshot, required, optional, 0);

	nvlist_free(optional);
	nvlist_free(required);
	}

	static void
	test_recv_new(const char *dataset, int fd)
	{
	dmu_replay_record_t drr = { 0 };
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();
	nvlist_t *props = fnvlist_alloc();
	char snapshot[MAXNAMELEN + 32];
	ssize_t count;

	int cleanup_fd = open(ZFS_DEV, O_RDWR);

	(void) snprintf(snapshot, sizeof (snapshot), "%s@replicant", dataset);

	count = pread(fd, &drr, sizeof (drr), 0);
	if (count != sizeof (drr)) {
	(void) fprintf(stderr, "could not read stream: %s\n",
	strerror(errno));
	}

	fnvlist_add_string(required, "snapname", snapshot);
	fnvlist_add_byte_array(required, "begin_record", (uchar_t *)&drr,
	sizeof (drr));
	fnvlist_add_int32(required, "input_fd", fd);

	fnvlist_add_string(props, "org.openzfs:launch", "September 17th, 2013");
	fnvlist_add_nvlist(optional, "localprops", props);
	fnvlist_add_boolean(optional, "force");
	fnvlist_add_int32(optional, "cleanup_fd", cleanup_fd);

	/*
	* TODO - Resumable receive is harder to set up. So we currently
	* ignore testing for one.
	*/
	#if 0
	fnvlist_add_nvlist(optional, "props", recvdprops);
	fnvlist_add_string(optional, "origin", origin);
	fnvlist_add_boolean(optional, "resumable");
	fnvlist_add_uint64(optional, "action_handle", *action_handle);
	#endif
	IOC_INPUT_TEST(ZFS_IOC_RECV_NEW, dataset, required, optional,
	ZFS_ERR_STREAM_TRUNCATED);

	nvlist_free(props);
	nvlist_free(optional);
	nvlist_free(required);

	(void) close(cleanup_fd);
	}

	static void
	test_send_space(const char snapshot1, const char snapshot2)
	{
	nvlist_t *optional = fnvlist_alloc();

	fnvlist_add_string(optional, "from", snapshot1);
	fnvlist_add_boolean(optional, "largeblockok");
	fnvlist_add_boolean(optional, "embedok");
	fnvlist_add_boolean(optional, "compressok");
	fnvlist_add_boolean(optional, "rawok");

	IOC_INPUT_TEST(ZFS_IOC_SEND_SPACE, snapshot2, NULL, optional, 0);

	nvlist_free(optional);
	}

	static void
	test_remap(const char *dataset)
	{
	IOC_INPUT_TEST(ZFS_IOC_REMAP, dataset, NULL, NULL, 0);
	}

	static void
	test_channel_program(const char *pool)
	{
	const char *program =
	"arg = ...\n"
	"argv = arg[\"argv\"]\n"
	"return argv[1]";
	char *const argv[1] = { "Hello World!" };
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();
	nvlist_t *args = fnvlist_alloc();

	fnvlist_add_string(required, "program", program);
	fnvlist_add_string_array(args, "argv", argv, 1);
	fnvlist_add_nvlist(required, "arg", args);

	fnvlist_add_boolean_value(optional, "sync", B_TRUE);
	fnvlist_add_uint64(optional, "instrlimit", 1000 * 1000);
	fnvlist_add_uint64(optional, "memlimit", 8192 * 1024);

	IOC_INPUT_TEST(ZFS_IOC_CHANNEL_PROGRAM, pool, required, optional, 0);

	nvlist_free(args);
	nvlist_free(optional);
	nvlist_free(required);
	}

	#define WRAPPING_KEY_LEN 32

	static void
	test_load_key(const char *dataset)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();
	nvlist_t *hidden = fnvlist_alloc();
	uint8_t keydata[WRAPPING_KEY_LEN] = {0};

	fnvlist_add_uint8_array(hidden, "wkeydata", keydata, sizeof (keydata));
	fnvlist_add_nvlist(required, "hidden_args", hidden);
	fnvlist_add_boolean(optional, "noop");

	IOC_INPUT_TEST(ZFS_IOC_LOAD_KEY, dataset, required, optional, EINVAL);
	nvlist_free(hidden);
	nvlist_free(optional);
	nvlist_free(required);
	}

	static void
	test_change_key(const char *dataset)
	{
	IOC_INPUT_TEST(ZFS_IOC_CHANGE_KEY, dataset, NULL, NULL, EINVAL);
	}

	static void
	test_unload_key(const char *dataset)
	{
	IOC_INPUT_TEST(ZFS_IOC_UNLOAD_KEY, dataset, NULL, NULL, EACCES);
	}

	static void
	test_vdev_initialize(const char *pool)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *vdev_guids = fnvlist_alloc();

	fnvlist_add_uint64(vdev_guids, "path", 0xdeadbeefdeadbeef);
	fnvlist_add_uint64(required, ZPOOL_INITIALIZE_COMMAND,
	POOL_INITIALIZE_START);
	fnvlist_add_nvlist(required, ZPOOL_INITIALIZE_VDEVS, vdev_guids);

	IOC_INPUT_TEST(ZFS_IOC_POOL_INITIALIZE, pool, required, NULL, EINVAL);
	nvlist_free(vdev_guids);
	nvlist_free(required);
	}

	static void
	test_vdev_trim(const char *pool)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();
	nvlist_t *vdev_guids = fnvlist_alloc();

	fnvlist_add_uint64(vdev_guids, "path", 0xdeadbeefdeadbeef);
	fnvlist_add_uint64(required, ZPOOL_TRIM_COMMAND, POOL_TRIM_START);
	fnvlist_add_nvlist(required, ZPOOL_TRIM_VDEVS, vdev_guids);
	fnvlist_add_uint64(optional, ZPOOL_TRIM_RATE, 1ULL << 30);
	fnvlist_add_boolean_value(optional, ZPOOL_TRIM_SECURE, B_TRUE);

	IOC_INPUT_TEST(ZFS_IOC_POOL_TRIM, pool, required, optional, EINVAL);
	nvlist_free(vdev_guids);
	nvlist_free(optional);
	nvlist_free(required);
	}

	static int
	zfs_destroy(const char *dataset)
	{
	zfs_cmd_t zc = {"\0"};
	int err;

	(void) strlcpy(zc.zc_name, dataset, sizeof (zc.zc_name));
	zc.zc_name[sizeof (zc.zc_name) - 1] = '\0';
	err = zfs_ioctl_fd(zfs_fd, ZFS_IOC_DESTROY, &zc);

	return (err == 0 ? 0 : errno);
	}

	static void
	test_redact(const char snapshot1, const char snapshot2)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *snapnv = fnvlist_alloc();
	char bookmark[MAXNAMELEN + 32];

	fnvlist_add_string(required, "bookname", "testbookmark");
	fnvlist_add_boolean(snapnv, snapshot2);
	fnvlist_add_nvlist(required, "snapnv", snapnv);

	IOC_INPUT_TEST(ZFS_IOC_REDACT, snapshot1, required, NULL, 0);

	nvlist_free(snapnv);
	nvlist_free(required);

	strlcpy(bookmark, snapshot1, sizeof (bookmark));
	*strchr(bookmark, '@') = '\0';
	strlcat(bookmark, "#testbookmark", sizeof (bookmark) -
	strlen(bookmark));
	zfs_destroy(bookmark);
	}

	static void
	test_get_bookmark_props(const char *bookmark)
	{
	IOC_INPUT_TEST(ZFS_IOC_GET_BOOKMARK_PROPS, bookmark, NULL, NULL, 0);
	}

	static void
	test_wait(const char *pool)
	{
	nvlist_t *required = fnvlist_alloc();
	nvlist_t *optional = fnvlist_alloc();

	fnvlist_add_int32(required, "wait_activity", 2);
	fnvlist_add_uint64(optional, "wait_tag", 0xdeadbeefdeadbeef);

	IOC_INPUT_TEST(ZFS_IOC_WAIT, pool, required, optional, EINVAL);

	nvlist_free(required);
	nvlist_free(optional);
	}

	static void
	test_wait_fs(const char *dataset)
	{
	nvlist_t *required = fnvlist_alloc();

	fnvlist_add_int32(required, "wait_activity", 2);

	IOC_INPUT_TEST(ZFS_IOC_WAIT_FS, dataset, required, NULL, EINVAL);

	nvlist_free(required);
	}

	static void
	test_get_bootenv(const char *pool)
	{
	IOC_INPUT_TEST(ZFS_IOC_GET_BOOTENV, pool, NULL, NULL, 0);
	}

	static void
	test_set_bootenv(const char *pool)
	{
	nvlist_t *required = fnvlist_alloc();

	- fnvlist_add_string(required, "envmap", "test");
	+ fnvlist_add_uint64(required, "version", VB_RAW);
	+ fnvlist_add_string(required, GRUB_ENVMAP, "test");

	- IOC_INPUT_TEST(ZFS_IOC_SET_BOOTENV, pool, required, NULL, 0);
	+ IOC_INPUT_TEST_WILD(ZFS_IOC_SET_BOOTENV, pool, required, NULL, 0);

	nvlist_free(required);
	}

	static void
	zfs_ioc_input_tests(const char *pool)
	{
	char filepath[] = "/tmp/ioc_test_file_XXXXXX";
	char dataset[ZFS_MAX_DATASET_NAME_LEN];
	char snapbase[ZFS_MAX_DATASET_NAME_LEN + 32];
	char snapshot[ZFS_MAX_DATASET_NAME_LEN + 32];
	char bookmark[ZFS_MAX_DATASET_NAME_LEN + 32];
	char backup[ZFS_MAX_DATASET_NAME_LEN];
	char clone[ZFS_MAX_DATASET_NAME_LEN];
	char clonesnap[ZFS_MAX_DATASET_NAME_LEN + 32];
	int tmpfd, err;

	/*
	* Setup names and create a working dataset
	*/
	(void) snprintf(dataset, sizeof (dataset), "%s/test-fs", pool);
	(void) snprintf(snapbase, sizeof (snapbase), "%s@snapbase", dataset);
	(void) snprintf(snapshot, sizeof (snapshot), "%s@snapshot", dataset);
	(void) snprintf(bookmark, sizeof (bookmark), "%s#bookmark", dataset);
	(void) snprintf(clone, sizeof (clone), "%s/test-fs-clone", pool);
	(void) snprintf(clonesnap, sizeof (clonesnap), "%s@snap", clone);
	(void) snprintf(backup, sizeof (backup), "%s/backup", pool);

	err = lzc_create(dataset, DMU_OST_ZFS, NULL, NULL, 0);
	if (err) {
	(void) fprintf(stderr, "could not create '%s': %s\n",
	dataset, strerror(errno));
	exit(2);
	}

	tmpfd = mkstemp(filepath);
	if (tmpfd < 0) {
	(void) fprintf(stderr, "could not create '%s': %s\n",
	filepath, strerror(errno));
	exit(2);
	}

	/*
	* run a test for each ioctl
	* Note that some test build on previous test operations
	*/
	test_pool_sync(pool);
	test_pool_reopen(pool);
	test_pool_checkpoint(pool);
	test_pool_discard_checkpoint(pool);
	test_log_history(pool);

	test_create(dataset);
	test_snapshot(pool, snapbase);
	test_snapshot(pool, snapshot);

	test_space_snaps(snapshot);
	test_send_space(snapbase, snapshot);
	test_send_new(snapshot, tmpfd);
	test_recv_new(backup, tmpfd);

	test_bookmark(pool, snapshot, bookmark);
	test_get_bookmarks(dataset);
	test_get_bookmark_props(bookmark);
	test_destroy_bookmarks(pool, bookmark);

	test_hold(pool, snapshot);
	test_get_holds(snapshot);
	test_release(pool, snapshot);

	test_clone(snapshot, clone);
	test_snapshot(pool, clonesnap);
	test_redact(snapshot, clonesnap);
	zfs_destroy(clonesnap);
	zfs_destroy(clone);

	test_rollback(dataset, snapshot);
	test_destroy_snaps(pool, snapshot);
	test_destroy_snaps(pool, snapbase);

	test_remap(dataset);
	test_channel_program(pool);

	test_load_key(dataset);
	test_change_key(dataset);
	test_unload_key(dataset);

	test_vdev_initialize(pool);
	test_vdev_trim(pool);

	test_wait(pool);
	test_wait_fs(dataset);

	test_set_bootenv(pool);
	test_get_bootenv(pool);

	/*
	* cleanup
	*/
	zfs_cmd_t zc = {"\0"};

	nvlist_t *snaps = fnvlist_alloc();
	fnvlist_add_boolean(snaps, snapshot);
	(void) lzc_destroy_snaps(snaps, B_FALSE, NULL);
	nvlist_free(snaps);

	(void) zfs_destroy(dataset);
	(void) zfs_destroy(backup);

	(void) close(tmpfd);
	(void) unlink(filepath);

	/*
	* All the unused slots should yield ZFS_ERR_IOC_CMD_UNAVAIL
	*/
	for (int i = 0; i < ARRAY_SIZE(ioc_skip); i++) {
	if (ioc_tested[ioc_skip[i] - ZFS_IOC_FIRST])
	(void) fprintf(stderr, "cmd %d tested, not skipped!\n",
	(int)(ioc_skip[i] - ZFS_IOC_FIRST));

	ioc_tested[ioc_skip[i] - ZFS_IOC_FIRST] = B_TRUE;
	}

	(void) strlcpy(zc.zc_name, pool, sizeof (zc.zc_name));
	zc.zc_name[sizeof (zc.zc_name) - 1] = '\0';

	for (unsigned ioc = ZFS_IOC_FIRST; ioc < ZFS_IOC_LAST; ioc++) {
	unsigned cmd = ioc - ZFS_IOC_FIRST;

	if (ioc_tested[cmd])
	continue;

	if (zfs_ioctl_fd(zfs_fd, ioc, &zc) != 0 &&
	errno != ZFS_ERR_IOC_CMD_UNAVAIL) {
	(void) fprintf(stderr, "cmd %d is missing a test case "
	"(%d)\n", cmd, errno);
	}
	}
	}

	enum zfs_ioc_ref {
	#ifdef __FreeBSD__
	ZFS_IOC_BASE = 0,
	#else
	ZFS_IOC_BASE = ('Z' << 8),
	#endif
	ZFS_IOC_PLATFORM_BASE = ZFS_IOC_BASE + 0x80,
	};

	/*
	* Canonical reference check of /dev/zfs ioctl numbers.
	* These cannot change and new ioctl numbers must be appended.
	*/
	static boolean_t
	validate_ioc_values(void)
	{
	boolean_t result = B_TRUE;

	#define CHECK(expr) do { \
	if (!(expr)) { \
	result = B_FALSE; \
	fprintf(stderr, "(%s) === FALSE\n", #expr); \
	} \
	} while (0)

	CHECK(ZFS_IOC_BASE + 0 == ZFS_IOC_POOL_CREATE);
	CHECK(ZFS_IOC_BASE + 1 == ZFS_IOC_POOL_DESTROY);
	CHECK(ZFS_IOC_BASE + 2 == ZFS_IOC_POOL_IMPORT);
	CHECK(ZFS_IOC_BASE + 3 == ZFS_IOC_POOL_EXPORT);
	CHECK(ZFS_IOC_BASE + 4 == ZFS_IOC_POOL_CONFIGS);
	CHECK(ZFS_IOC_BASE + 5 == ZFS_IOC_POOL_STATS);
	CHECK(ZFS_IOC_BASE + 6 == ZFS_IOC_POOL_TRYIMPORT);
	CHECK(ZFS_IOC_BASE + 7 == ZFS_IOC_POOL_SCAN);
	CHECK(ZFS_IOC_BASE + 8 == ZFS_IOC_POOL_FREEZE);
	CHECK(ZFS_IOC_BASE + 9 == ZFS_IOC_POOL_UPGRADE);
	CHECK(ZFS_IOC_BASE + 10 == ZFS_IOC_POOL_GET_HISTORY);
	CHECK(ZFS_IOC_BASE + 11 == ZFS_IOC_VDEV_ADD);
	CHECK(ZFS_IOC_BASE + 12 == ZFS_IOC_VDEV_REMOVE);
	CHECK(ZFS_IOC_BASE + 13 == ZFS_IOC_VDEV_SET_STATE);
	CHECK(ZFS_IOC_BASE + 14 == ZFS_IOC_VDEV_ATTACH);
	CHECK(ZFS_IOC_BASE + 15 == ZFS_IOC_VDEV_DETACH);
	CHECK(ZFS_IOC_BASE + 16 == ZFS_IOC_VDEV_SETPATH);
	CHECK(ZFS_IOC_BASE + 17 == ZFS_IOC_VDEV_SETFRU);
	CHECK(ZFS_IOC_BASE + 18 == ZFS_IOC_OBJSET_STATS);
	CHECK(ZFS_IOC_BASE + 19 == ZFS_IOC_OBJSET_ZPLPROPS);
	CHECK(ZFS_IOC_BASE + 20 == ZFS_IOC_DATASET_LIST_NEXT);
	CHECK(ZFS_IOC_BASE + 21 == ZFS_IOC_SNAPSHOT_LIST_NEXT);
	CHECK(ZFS_IOC_BASE + 22 == ZFS_IOC_SET_PROP);
	CHECK(ZFS_IOC_BASE + 23 == ZFS_IOC_CREATE);
	CHECK(ZFS_IOC_BASE + 24 == ZFS_IOC_DESTROY);
	CHECK(ZFS_IOC_BASE + 25 == ZFS_IOC_ROLLBACK);
	CHECK(ZFS_IOC_BASE + 26 == ZFS_IOC_RENAME);
	CHECK(ZFS_IOC_BASE + 27 == ZFS_IOC_RECV);
	CHECK(ZFS_IOC_BASE + 28 == ZFS_IOC_SEND);
	CHECK(ZFS_IOC_BASE + 29 == ZFS_IOC_INJECT_FAULT);
	CHECK(ZFS_IOC_BASE + 30 == ZFS_IOC_CLEAR_FAULT);
	CHECK(ZFS_IOC_BASE + 31 == ZFS_IOC_INJECT_LIST_NEXT);
	CHECK(ZFS_IOC_BASE + 32 == ZFS_IOC_ERROR_LOG);
	CHECK(ZFS_IOC_BASE + 33 == ZFS_IOC_CLEAR);
	CHECK(ZFS_IOC_BASE + 34 == ZFS_IOC_PROMOTE);
	CHECK(ZFS_IOC_BASE + 35 == ZFS_IOC_SNAPSHOT);
	CHECK(ZFS_IOC_BASE + 36 == ZFS_IOC_DSOBJ_TO_DSNAME);
	CHECK(ZFS_IOC_BASE + 37 == ZFS_IOC_OBJ_TO_PATH);
	CHECK(ZFS_IOC_BASE + 38 == ZFS_IOC_POOL_SET_PROPS);
	CHECK(ZFS_IOC_BASE + 39 == ZFS_IOC_POOL_GET_PROPS);
	CHECK(ZFS_IOC_BASE + 40 == ZFS_IOC_SET_FSACL);
	CHECK(ZFS_IOC_BASE + 41 == ZFS_IOC_GET_FSACL);
	CHECK(ZFS_IOC_BASE + 42 == ZFS_IOC_SHARE);
	CHECK(ZFS_IOC_BASE + 43 == ZFS_IOC_INHERIT_PROP);
	CHECK(ZFS_IOC_BASE + 44 == ZFS_IOC_SMB_ACL);
	CHECK(ZFS_IOC_BASE + 45 == ZFS_IOC_USERSPACE_ONE);
	CHECK(ZFS_IOC_BASE + 46 == ZFS_IOC_USERSPACE_MANY);
	CHECK(ZFS_IOC_BASE + 47 == ZFS_IOC_USERSPACE_UPGRADE);
	CHECK(ZFS_IOC_BASE + 48 == ZFS_IOC_HOLD);
	CHECK(ZFS_IOC_BASE + 49 == ZFS_IOC_RELEASE);
	CHECK(ZFS_IOC_BASE + 50 == ZFS_IOC_GET_HOLDS);
	CHECK(ZFS_IOC_BASE + 51 == ZFS_IOC_OBJSET_RECVD_PROPS);
	CHECK(ZFS_IOC_BASE + 52 == ZFS_IOC_VDEV_SPLIT);
	CHECK(ZFS_IOC_BASE + 53 == ZFS_IOC_NEXT_OBJ);
	CHECK(ZFS_IOC_BASE + 54 == ZFS_IOC_DIFF);
	CHECK(ZFS_IOC_BASE + 55 == ZFS_IOC_TMP_SNAPSHOT);
	CHECK(ZFS_IOC_BASE + 56 == ZFS_IOC_OBJ_TO_STATS);
	CHECK(ZFS_IOC_BASE + 57 == ZFS_IOC_SPACE_WRITTEN);
	CHECK(ZFS_IOC_BASE + 58 == ZFS_IOC_SPACE_SNAPS);
	CHECK(ZFS_IOC_BASE + 59 == ZFS_IOC_DESTROY_SNAPS);
	CHECK(ZFS_IOC_BASE + 60 == ZFS_IOC_POOL_REGUID);
	CHECK(ZFS_IOC_BASE + 61 == ZFS_IOC_POOL_REOPEN);
	CHECK(ZFS_IOC_BASE + 62 == ZFS_IOC_SEND_PROGRESS);
	CHECK(ZFS_IOC_BASE + 63 == ZFS_IOC_LOG_HISTORY);
	CHECK(ZFS_IOC_BASE + 64 == ZFS_IOC_SEND_NEW);
	CHECK(ZFS_IOC_BASE + 65 == ZFS_IOC_SEND_SPACE);
	CHECK(ZFS_IOC_BASE + 66 == ZFS_IOC_CLONE);
	CHECK(ZFS_IOC_BASE + 67 == ZFS_IOC_BOOKMARK);
	CHECK(ZFS_IOC_BASE + 68 == ZFS_IOC_GET_BOOKMARKS);
	CHECK(ZFS_IOC_BASE + 69 == ZFS_IOC_DESTROY_BOOKMARKS);
	CHECK(ZFS_IOC_BASE + 70 == ZFS_IOC_RECV_NEW);
	CHECK(ZFS_IOC_BASE + 71 == ZFS_IOC_POOL_SYNC);
	CHECK(ZFS_IOC_BASE + 72 == ZFS_IOC_CHANNEL_PROGRAM);
	CHECK(ZFS_IOC_BASE + 73 == ZFS_IOC_LOAD_KEY);
	CHECK(ZFS_IOC_BASE + 74 == ZFS_IOC_UNLOAD_KEY);
	CHECK(ZFS_IOC_BASE + 75 == ZFS_IOC_CHANGE_KEY);
	CHECK(ZFS_IOC_BASE + 76 == ZFS_IOC_REMAP);
	CHECK(ZFS_IOC_BASE + 77 == ZFS_IOC_POOL_CHECKPOINT);
	CHECK(ZFS_IOC_BASE + 78 == ZFS_IOC_POOL_DISCARD_CHECKPOINT);
	CHECK(ZFS_IOC_BASE + 79 == ZFS_IOC_POOL_INITIALIZE);
	CHECK(ZFS_IOC_BASE + 80 == ZFS_IOC_POOL_TRIM);
	CHECK(ZFS_IOC_BASE + 81 == ZFS_IOC_REDACT);
	CHECK(ZFS_IOC_BASE + 82 == ZFS_IOC_GET_BOOKMARK_PROPS);
	CHECK(ZFS_IOC_BASE + 83 == ZFS_IOC_WAIT);
	CHECK(ZFS_IOC_BASE + 84 == ZFS_IOC_WAIT_FS);
	CHECK(ZFS_IOC_PLATFORM_BASE + 1 == ZFS_IOC_EVENTS_NEXT);
	CHECK(ZFS_IOC_PLATFORM_BASE + 2 == ZFS_IOC_EVENTS_CLEAR);
	CHECK(ZFS_IOC_PLATFORM_BASE + 3 == ZFS_IOC_EVENTS_SEEK);
	CHECK(ZFS_IOC_PLATFORM_BASE + 4 == ZFS_IOC_NEXTBOOT);
	CHECK(ZFS_IOC_PLATFORM_BASE + 5 == ZFS_IOC_JAIL);
	CHECK(ZFS_IOC_PLATFORM_BASE + 6 == ZFS_IOC_UNJAIL);
	CHECK(ZFS_IOC_PLATFORM_BASE + 7 == ZFS_IOC_SET_BOOTENV);
	CHECK(ZFS_IOC_PLATFORM_BASE + 8 == ZFS_IOC_GET_BOOTENV);

	#undef CHECK

	return (result);
	}

	int
	main(int argc, const char *argv[])
	{
	if (argc != 2) {
	(void) fprintf(stderr, "usage: %s <pool>\n", argv[0]);
	exit(2);
	}

	if (!validate_ioc_values()) {
	(void) fprintf(stderr, "WARNING: zfs_ioc_t has binary "
	"incompatible command values\n");
	exit(3);
	}

	(void) libzfs_core_init();
	zfs_fd = open(ZFS_DEV, O_RDWR);
	if (zfs_fd < 0) {
	(void) fprintf(stderr, "open: %s\n", strerror(errno));
	libzfs_core_fini();
	exit(2);
	}

	zfs_ioc_input_tests(argv[1]);

	(void) close(zfs_fd);
	libzfs_core_fini();

	return (unexpected_failures);
	}
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/include/commands.cfg
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/include/commands.cfg (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/include/commands.cfg (revision 365892)
	@@ -1,218 +1,219 @@
	#
	# Copyright (c) 2016, 2019 by Delphix. All rights reserved.
	# These variables are used by zfs-tests.sh to constrain which utilities
	# may be used by the suite. The suite will create a directory which is
	# the only element of $PATH and create symlinks from that dir to the
	# binaries listed below.
	#
	# Please keep the contents of each variable sorted for ease of reading
	# and maintenance.
	#
	export SYSTEM_FILES_COMMON='arp
	awk
	base64
	basename
	bc
	bunzip2
	bzcat
	cat
	chgrp
	chmod
	chown
	cksum
	cmp
	cp
	cpio
	cut
	date
	dd
	df
	diff
	dirname
	dmesg
	du
	echo
	egrep
	expr
	false
	file
	find
	fio
	getconf
	getent
	getfacl
	grep
	gunzip
	gzip
	head
	hostname
	id
	iostat
	kill
	ksh
	ln
	logname
	ls
	mkdir
	mknod
	mktemp
	mount
	mv
	net
	od
	openssl
	pamtester
	pax
	pgrep
	ping
	pkill
	printenv
	printf
	ps
	pwd
	python
	python2
	python3
	quotaon
	readlink
	rm
	rmdir
	scp
	script
	sed
	seq
	setfacl
	sh
	sleep
	sort
	ssh
	stat
	strings
	su
	sudo
	sum
	swapoff
	swapon
	sync
	tail
	tar
	tee
	timeout
	touch
	tr
	true
	truncate
	umask
	umount
	uname
	+ uniq
	uuidgen
	vmstat
	wait
	wc
	which
	xargs'

	export SYSTEM_FILES_FREEBSD='chflags
	compress
	diskinfo
	dumpon
	env
	fsck
	getextattr
	gpart
	jail
	jexec
	jls
	lsextattr
	md5
	mdconfig
	mkfifo
	newfs
	pw
	rmextattr
	setextattr
	sha256
	showmount
	swapctl
	sysctl
	uncompress'

	export SYSTEM_FILES_LINUX='attr
	bash
	blkid
	blockdev
	chattr
	dmidecode
	exportfs
	fallocate
	fdisk
	free
	getfattr
	groupadd
	groupdel
	groupmod
	hostid
	losetup
	lsattr
	lsblk
	lscpu
	lsmod
	lsscsi
	md5sum
	mkswap
	modprobe
	mpstat
	nproc
	parted
	perf
	setenforce
	setfattr
	sha256sum
	udevadm
	useradd
	userdel
	usermod'

	export ZFS_FILES='zdb
	zfs
	zhack
	zinject
	zpool
	ztest
	raidz_test
	arc_summary
	arcstat
	dbufstat
	zed
	zgenhostid
	zstream
	zstreamdump
	zfs_ids_to_path'

	export ZFSTEST_FILES='btree_test
	chg_usr_exec
	devname2devid
	dir_rd_update
	file_check
	file_trunc
	file_write
	get_diff
	largest_file
	libzfs_input_check
	mkbusy
	mkfile
	mkfiles
	mktree
	mmap_exec
	mmap_libaio
	mmapwrite
	nvlist_to_lua
	randfree_file
	randwritecomp
	readmmap
	rename_dir
	rm_lnkcnt_zero_file
	threadsappend
	user_ns_exec
	xattrtest
	stride_dd'
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/include/tunables.cfg
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/include/tunables.cfg (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/include/tunables.cfg (revision 365892)
	@@ -1,89 +1,91 @@
	# This file exports variables for each tunable used in the test suite.
	#
	# Different platforms use different names for most tunables. To avoid littering
	# the tests with conditional logic for deciding how to set each tunable, the
	# logic is instead consolidated to this one file.
	#
	# Any use of tunables in tests must use a name defined here. New entries
	# should be added to the table as needed. Please keep the table sorted
	# alphabetically for ease of maintenance.
	#
	# Platform-specific tunables should still use a NAME from this table for
	# consistency. Enter UNSUPPORTED in the column for platforms on which the
	# tunable is not implemented.

	UNAME=$(uname)

	# NAME FreeBSD tunable Linux tunable
	cat <<%%%% \|
	ADMIN_SNAPSHOT UNSUPPORTED zfs_admin_snapshot
	ALLOW_REDACTED_DATASET_MOUNT allow_redacted_dataset_mount zfs_allow_redacted_dataset_mount
	ARC_MAX arc.max zfs_arc_max
	ARC_MIN arc.min zfs_arc_min
	ASYNC_BLOCK_MAX_BLOCKS async_block_max_blocks zfs_async_block_max_blocks
	CHECKSUM_EVENTS_PER_SECOND checksum_events_per_second zfs_checksum_events_per_second
	COMMIT_TIMEOUT_PCT commit_timeout_pct zfs_commit_timeout_pct
	COMPRESSED_ARC_ENABLED compressed_arc_enabled zfs_compressed_arc_enabled
	CONDENSE_INDIRECT_COMMIT_ENTRY_DELAY_MS condense.indirect_commit_entry_delay_ms zfs_condense_indirect_commit_entry_delay_ms
	CONDENSE_MIN_MAPPING_BYTES condense.min_mapping_bytes zfs_condense_min_mapping_bytes
	DBUF_CACHE_MAX_BYTES dbuf_cache.max_bytes dbuf_cache_max_bytes
	DEADMAN_CHECKTIME_MS deadman_checktime_ms zfs_deadman_checktime_ms
	DEADMAN_FAILMODE deadman_failmode zfs_deadman_failmode
	DEADMAN_SYNCTIME_MS deadman_synctime_ms zfs_deadman_synctime_ms
	DEADMAN_ZIOTIME_MS deadman_ziotime_ms zfs_deadman_ziotime_ms
	DISABLE_IVSET_GUID_CHECK disable_ivset_guid_check zfs_disable_ivset_guid_check
	INITIALIZE_CHUNK_SIZE initialize_chunk_size zfs_initialize_chunk_size
	INITIALIZE_VALUE initialize_value zfs_initialize_value
	KEEP_LOG_SPACEMAPS_AT_EXPORT keep_log_spacemaps_at_export zfs_keep_log_spacemaps_at_export
	LUA_MAX_MEMLIMIT lua.max_memlimit zfs_lua_max_memlimit
	L2ARC_NOPREFETCH l2arc.noprefetch l2arc_noprefetch
	L2ARC_REBUILD_BLOCKS_MIN_L2SIZE l2arc.rebuild_blocks_min_l2size l2arc_rebuild_blocks_min_l2size
	L2ARC_REBUILD_ENABLED l2arc.rebuild_enabled l2arc_rebuild_enabled
	L2ARC_TRIM_AHEAD l2arc.trim_ahead l2arc_trim_ahead
	L2ARC_WRITE_BOOST l2arc.write_boost l2arc_write_boost
	L2ARC_WRITE_MAX l2arc.write_max l2arc_write_max
	LIVELIST_CONDENSE_NEW_ALLOC livelist.condense.new_alloc zfs_livelist_condense_new_alloc
	LIVELIST_CONDENSE_SYNC_CANCEL livelist.condense.sync_cancel zfs_livelist_condense_sync_cancel
	LIVELIST_CONDENSE_SYNC_PAUSE livelist.condense.sync_pause zfs_livelist_condense_sync_pause
	LIVELIST_CONDENSE_ZTHR_CANCEL livelist.condense.zthr_cancel zfs_livelist_condense_zthr_cancel
	LIVELIST_CONDENSE_ZTHR_PAUSE livelist.condense.zthr_pause zfs_livelist_condense_zthr_pause
	LIVELIST_MAX_ENTRIES livelist.max_entries zfs_livelist_max_entries
	LIVELIST_MIN_PERCENT_SHARED livelist.min_percent_shared zfs_livelist_min_percent_shared
	MAX_DATASET_NESTING max_dataset_nesting zfs_max_dataset_nesting
	MAX_MISSING_TVDS max_missing_tvds zfs_max_missing_tvds
	METASLAB_DEBUG_LOAD metaslab.debug_load metaslab_debug_load
	METASLAB_FORCE_GANGING metaslab.force_ganging metaslab_force_ganging
	MULTIHOST_FAIL_INTERVALS multihost.fail_intervals zfs_multihost_fail_intervals
	MULTIHOST_HISTORY multihost.history zfs_multihost_history
	MULTIHOST_IMPORT_INTERVALS multihost.import_intervals zfs_multihost_import_intervals
	MULTIHOST_INTERVAL multihost.interval zfs_multihost_interval
	OVERRIDE_ESTIMATE_RECORDSIZE send.override_estimate_recordsize zfs_override_estimate_recordsize
	REMOVAL_SUSPEND_PROGRESS removal_suspend_progress zfs_removal_suspend_progress
	REMOVE_MAX_SEGMENT remove_max_segment zfs_remove_max_segment
	RESILVER_MIN_TIME_MS resilver_min_time_ms zfs_resilver_min_time_ms
	SCAN_LEGACY scan_legacy zfs_scan_legacy
	SCAN_SUSPEND_PROGRESS scan_suspend_progress zfs_scan_suspend_progress
	SCAN_VDEV_LIMIT scan_vdev_limit zfs_scan_vdev_limit
	SEND_HOLES_WITHOUT_BIRTH_TIME send_holes_without_birth_time send_holes_without_birth_time
	SLOW_IO_EVENTS_PER_SECOND slow_io_events_per_second zfs_slow_io_events_per_second
	SPA_ASIZE_INFLATION spa.asize_inflation spa_asize_inflation
	SPA_DISCARD_MEMORY_LIMIT spa.discard_memory_limit zfs_spa_discard_memory_limit
	SPA_LOAD_VERIFY_DATA spa.load_verify_data spa_load_verify_data
	SPA_LOAD_VERIFY_METADATA spa.load_verify_metadata spa_load_verify_metadata
	TRIM_EXTENT_BYTES_MIN trim.extent_bytes_min zfs_trim_extent_bytes_min
	TRIM_METASLAB_SKIP trim.metaslab_skip zfs_trim_metaslab_skip
	TRIM_TXG_BATCH trim.txg_batch zfs_trim_txg_batch
	TXG_HISTORY txg.history zfs_txg_history
	TXG_TIMEOUT txg.timeout zfs_txg_timeout
	UNLINK_SUSPEND_PROGRESS UNSUPPORTED zfs_unlink_suspend_progress
	+VDEV_FILE_PHYSICAL_ASHIFT vdev.file.physical_ashift vdev_file_physical_ashift
	VDEV_MIN_MS_COUNT vdev.min_ms_count zfs_vdev_min_ms_count
	VDEV_VALIDATE_SKIP vdev.validate_skip vdev_validate_skip
	VOL_INHIBIT_DEV UNSUPPORTED zvol_inhibit_dev
	VOL_MODE vol.mode zvol_volmode
	VOL_RECURSIVE vol.recursive UNSUPPORTED
	ZEVENT_LEN_MAX zevent.len_max zfs_zevent_len_max
	+ZEVENT_RETAIN_MAX zevent.retain_max zfs_zevent_retain_max
	ZIO_SLOW_IO_MS zio.slow_io_ms zio_slow_io_ms
	%%%%
	while read name FreeBSD Linux; do
	eval "export ${name}=\$${UNAME}"
	done
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/posix_001_pos.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/posix_001_pos.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/posix_001_pos.ksh (revision 365892)
	@@ -1,97 +1,97 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2008 Sun Microsystems, Inc. All rights reserved.
	# Use is subject to license terms.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/acl/acl_common.kshlib

	#
	# Copyright (c) 2012 by Delphix. All rights reserved.
	#

	#
	# DESCRIPTION:
	-# Verify that user can access file/directory if acltype=posixacl.
	+# Verify that user can access file/directory if acltype=posix.
	#
	# STRATEGY:
	# 1. Test access to file (mode=rw-)
	# a. Can modify file
	# b. Can't create new file
	# b. Can't execute file
	#

	verify_runnable "both"

	function cleanup
	{
	rmdir $TESTDIR/dir.0
	}

	-log_assert "Verify acltype=posixacl works on file"
	+log_assert "Verify acltype=posix works on file"
	log_onexit cleanup

	# Test access to FILE
	log_note "Testing access to FILE"
	log_must touch $TESTDIR/file.0
	log_must setfacl -m g:$ZFS_ACL_STAFF_GROUP:rw $TESTDIR/file.0
	getfacl $TESTDIR/file.0 2> /dev/null \| egrep -q \
	"^group:$ZFS_ACL_STAFF_GROUP:rw-$"
	if [ "$?" -eq "0" ]; then
	# Should be able to write to file
	log_must user_run $ZFS_ACL_STAFF1 \
	"echo 'echo test > /dev/null' > $TESTDIR/file.0"

	# Since $TESTDIR is 777, create a new dir with controlled permissions
	# for testing that creating a new file is not allowed.
	log_must mkdir $TESTDIR/dir.0
	log_must chmod 700 $TESTDIR/dir.0
	log_must setfacl -m g:$ZFS_ACL_STAFF_GROUP:rw $TESTDIR/dir.0
	# Confirm permissions
	ls -l $TESTDIR \|grep "dir.0" \|grep -q "drwxrw----+"
	if [ "$?" -ne "0" ]; then
	msk=$(ls -l $TESTDIR \|grep "dir.0" \| awk '{print $1}')
	log_note "expected mask drwxrw----+ but found $msk"
	log_fail "Expected permissions were not set."
	fi
	getfacl $TESTDIR/dir.0 2> /dev/null \| egrep -q \
	"^group:$ZFS_ACL_STAFF_GROUP:rw-$"
	if [ "$?" -ne "0" ]; then
	acl=$(getfacl $TESTDIR/dir.0 2> /dev/null)
	log_note $acl
	log_fail "ACL group:$ZFS_ACL_STAFF_GROUP:rw- was not set."
	fi
	# Should NOT be able to create new file
	log_mustnot user_run $ZFS_ACL_STAFF1 "touch $TESTDIR/dir.0/file.1"

	# Root should be able to run file, but not user
	chmod +x $TESTDIR/file.0
	log_must $TESTDIR/file.0
	log_mustnot user_run $ZFS_ACL_STAFF1 $TESTDIR/file.0

	log_pass "POSIX ACL mode works on files"
	else
	log_fail "Group '$ZFS_ACL_STAFF_GROUP' does not have 'rw' as specified"
	fi
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/posix_002_pos.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/posix_002_pos.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/posix_002_pos.ksh (revision 365892)
	@@ -1,76 +1,76 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2008 Sun Microsystems, Inc. All rights reserved.
	# Use is subject to license terms.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/acl/acl_common.kshlib

	#
	# Copyright (c) 2012 by Delphix. All rights reserved.
	#

	#
	# DESCRIPTION:
	-# Verify that user can access file/directory if acltype=posixacl.
	+# Verify that user can access file/directory if acltype=posix.
	#
	# STRATEGY:
	# 1. Test access to directory (mode=-wx)
	# a. Can create file in dir
	# b. Can't list directory
	#

	verify_runnable "both"
	-log_assert "Verify acltype=posixacl works on directory"
	+log_assert "Verify acltype=posix works on directory"

	# Test access to DIRECTORY
	log_note "Testing access to DIRECTORY"
	log_must mkdir $TESTDIR/dir.0
	# Eliminate access by "other" including our test group,
	# we want access controlled only by the ACLs.
	log_must chmod 700 $TESTDIR/dir.0
	log_must setfacl -m g:$ZFS_ACL_STAFF_GROUP:wx $TESTDIR/dir.0
	# Confirm permissions
	ls -l $TESTDIR \|grep "dir.0" \|grep -q "drwx-wx---+"
	if [ "$?" -ne "0" ]; then
	msk=$(ls -l $TESTDIR \|grep "dir.0" \| awk '{print $1}')
	log_note "expected mask drwx-wx---+ but found $msk"
	log_fail "Expected permissions were not set."
	fi
	getfacl $TESTDIR/dir.0 2> /dev/null \| egrep -q \
	"^group:$ZFS_ACL_STAFF_GROUP:-wx$"
	if [ "$?" -eq "0" ]; then
	# Should be able to create file in directory
	log_must user_run $ZFS_ACL_STAFF1 "touch $TESTDIR/dir.0/file.0"

	# Should NOT be able to list files in directory
	log_mustnot user_run $ZFS_ACL_STAFF1 "ls -l $TESTDIR/dir.0"

	log_pass "POSIX ACL mode works on directories"
	else
	acl=$(getfacl $TESTDIR/dir.0 2> /dev/null)
	log_note $acl
	log_fail "Group '$ZFS_ACL_STAFF_GROUP' does not have '-wx' as specified"
	fi
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/setup.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/setup.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/acl/posix/setup.ksh (revision 365892)
	@@ -1,52 +1,52 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
	# Use is subject to license terms.
	#

	#
	# Copyright (c) 2016 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/acl/acl_common.kshlib

	log_must getfacl --version
	log_must setfacl --version

	cleanup_user_group

	# Create staff group and add user to it
	log_must add_group $ZFS_ACL_STAFF_GROUP
	log_must add_user $ZFS_ACL_STAFF_GROUP $ZFS_ACL_STAFF1

	DISK=${DISKS%% *}
	default_setup_noexit $DISK
	log_must chmod 777 $TESTDIR

	# Use POSIX ACLs on filesystem
	-log_must zfs set acltype=posixacl $TESTPOOL/$TESTFS
	+log_must zfs set acltype=posix $TESTPOOL/$TESTFS
	log_must zfs set xattr=sa $TESTPOOL/$TESTFS

	log_pass
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_add/add-o_ashift.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_add/add-o_ashift.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_add/add-o_ashift.ksh (revision 365892)
	@@ -1,85 +1,108 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2017, loli10K. All rights reserved.
	+# Copyright (c) 2020 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/cli_root/zpool_add/zpool_add.kshlib

	#
	# DESCRIPTION:
	# 'zpool add -o ashift=<n> ...' should work with different ashift
	# values.
	#
	# STRATEGY:
	# 1. Create a pool with default values.
	# 2. Verify 'zpool add -o ashift=<n>' works with allowed values (9-16).
	-# 3. Verify 'zpool add -o ashift=<n>' doesn't accept other invalid values.
	+# 3. Verify setting kernel tunable for file vdevs works correctly.
	+# 4. Verify 'zpool add -o ashift=<n>' doesn't accept other invalid values.
	#

	verify_runnable "global"

	function cleanup
	{
	+ log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT $orig_ashift
	poolexists $TESTPOOL && destroy_pool $TESTPOOL
	rm -f $disk1 $disk2
	}

	log_assert "zpool add -o ashift=<n>' works with different ashift values"
	log_onexit cleanup

	disk1=$TEST_BASE_DIR/disk1
	disk2=$TEST_BASE_DIR/disk2
	log_must mkfile $SIZE $disk1
	log_must mkfile $SIZE $disk2

	+orig_ashift=$(get_tunable VDEV_FILE_PHYSICAL_ASHIFT)
	+
	typeset ashifts=("9" "10" "11" "12" "13" "14" "15" "16")
	for ashift in ${ashifts[@]}
	do
	log_must zpool create $TESTPOOL $disk1
	log_must zpool add -o ashift=$ashift $TESTPOOL $disk2
	verify_ashift $disk2 $ashift
	if [[ $? -ne 0 ]]
	then
	log_fail "Device was added without setting ashift value to "\
	"$ashift"
	fi
	# clean things for the next run
	+ log_must zpool destroy $TESTPOOL
	+ log_must zpool labelclear $disk1
	+ log_must zpool labelclear $disk2
	+
	+ #
	+ # Make sure we can also set the ashift using the tunable.
	+ #
	+ log_must zpool create $TESTPOOL $disk1
	+ log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT $ashift
	+ log_must zpool add $TESTPOOL $disk2
	+ verify_ashift $disk2 $ashift
	+ if [[ $? -ne 0 ]]
	+ then
	+ log_fail "Device was added without setting ashift value to "\
	+ "$ashift"
	+ fi
	+ # clean things for the next run
	+ log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT $orig_ashift
	log_must zpool destroy $TESTPOOL
	log_must zpool labelclear $disk1
	log_must zpool labelclear $disk2
	done

	typeset badvals=("off" "on" "1" "8" "17" "1b" "ff" "-")
	for badval in ${badvals[@]}
	do
	log_must zpool create $TESTPOOL $disk1
	log_mustnot zpool add -o ashift="$badval" $TESTPOOL $disk2
	# clean things for the next run
	log_must zpool destroy $TESTPOOL
	log_must zpool labelclear $disk1
	log_mustnot zpool labelclear $disk2
	done

	log_pass "zpool add -o ashift=<n>' works with different ashift values"
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_add/add_prop_ashift.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_add/add_prop_ashift.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_add/add_prop_ashift.ksh (revision 365892)
	@@ -1,94 +1,104 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2017, loli10K. All rights reserved.
	+# Copyright (c) 2020 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/cli_root/zpool_create/zpool_create.shlib

	#
	# DESCRIPTION:
	# 'zpool add' should use the ashift pool property value as default.
	#
	# STRATEGY:
	# 1. Create a pool with default values.
	# 2. Verify 'zpool add' uses the ashift pool property value when adding
	# a new device.
	# 3. Verify the default ashift value can still be overridden by manually
	# specifying '-o ashift=<n>' from the command line.
	#

	verify_runnable "global"

	function cleanup
	{
	+ log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT $orig_ashift
	poolexists $TESTPOOL && destroy_pool $TESTPOOL
	log_must rm -f $disk1 $disk2
	}

	log_assert "'zpool add' uses the ashift pool property value as default."
	log_onexit cleanup

	disk1=$TEST_BASE_DIR/disk1
	disk2=$TEST_BASE_DIR/disk2
	log_must mkfile $SIZE $disk1
	log_must mkfile $SIZE $disk2
	+
	+orig_ashift=$(get_tunable VDEV_FILE_PHYSICAL_ASHIFT)
	+#
	+# Set the file vdev's ashift to the max. Overriding
	+# the ashift using the -o ashift property should still
	+# be honored.
	+#
	+log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT 16

	typeset ashifts=("9" "10" "11" "12" "13" "14" "15" "16")
	for ashift in ${ashifts[@]}
	do
	log_must zpool create -o ashift=$ashift $TESTPOOL $disk1
	log_must zpool add $TESTPOOL $disk2
	verify_ashift $disk2 $ashift
	if [[ $? -ne 0 ]]
	then
	log_fail "Device was added without setting ashift value to "\
	"$ashift"
	fi
	# clean things for the next run
	log_must zpool destroy $TESTPOOL
	log_must zpool labelclear $disk1
	log_must zpool labelclear $disk2
	done

	for ashift in ${ashifts[@]}
	do
	for cmdval in ${ashifts[@]}
	do
	log_must zpool create -o ashift=$ashift $TESTPOOL $disk1
	log_must zpool add -o ashift=$cmdval $TESTPOOL $disk2
	verify_ashift $disk2 $cmdval
	if [[ $? -ne 0 ]]
	then
	log_fail "Device was added without setting ashift " \
	"value to $cmdval"
	fi
	# clean things for the next run
	log_must zpool destroy $TESTPOOL
	log_must zpool labelclear $disk1
	log_must zpool labelclear $disk2
	done
	done

	log_pass "'zpool add' uses the ashift pool property value."
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_attach/attach-o_ashift.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_attach/attach-o_ashift.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_attach/attach-o_ashift.ksh (revision 365892)
	@@ -1,100 +1,110 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2017, loli10K. All rights reserved.
	+# Copyright (c) 2020 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/cli_root/zpool_create/zpool_create.shlib

	#
	# DESCRIPTION:
	# 'zpool attach -o ashift=<n> ...' should work with different ashift
	# values.
	#
	# STRATEGY:
	# 1. Create various pools with different ashift values.
	# 2. Verify 'attach -o ashift=<n>' works only with allowed values.
	#

	verify_runnable "global"

	function cleanup
	{
	+ log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT $orig_ashift
	poolexists $TESTPOOL1 && destroy_pool $TESTPOOL1
	rm -f $disk1 $disk2
	}

	log_assert "zpool attach -o ashift=<n>' works with different ashift values"
	log_onexit cleanup

	disk1=$TEST_BASE_DIR/disk1
	disk2=$TEST_BASE_DIR/disk2
	log_must truncate -s $SIZE $disk1
	log_must truncate -s $SIZE $disk2
	+
	+orig_ashift=$(get_tunable VDEV_FILE_PHYSICAL_ASHIFT)
	+#
	+# Set the file vdev's ashift to the max. Overriding
	+# the ashift using the -o ashift property should still
	+# be honored.
	+#
	+log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT 16

	typeset ashifts=("9" "10" "11" "12" "13" "14" "15" "16")
	for ashift in ${ashifts[@]}
	do
	for cmdval in ${ashifts[@]}
	do
	log_must zpool create -o ashift=$ashift $TESTPOOL1 $disk1
	verify_ashift $disk1 $ashift
	if [[ $? -ne 0 ]]
	then
	log_fail "Pool was created without setting ashift " \
	"value to $ashift"
	fi
	# ashift_of(attached_disk) <= ashift_of(existing_vdev)
	if [[ $cmdval -le $ashift ]]
	then
	log_must zpool attach -o ashift=$cmdval $TESTPOOL1 \
	$disk1 $disk2
	verify_ashift $disk2 $ashift
	if [[ $? -ne 0 ]]
	then
	log_fail "Device was attached without " \
	"setting ashift value to $ashift"
	fi
	else
	log_mustnot zpool attach -o ashift=$cmdval $TESTPOOL1 \
	$disk1 $disk2
	fi
	# clean things for the next run
	log_must zpool destroy $TESTPOOL1
	log_must zpool labelclear $disk1
	log_must zpool labelclear $disk2
	done
	done

	typeset badvals=("off" "on" "1" "8" "17" "1b" "ff" "-")
	for badval in ${badvals[@]}
	do
	log_must zpool create $TESTPOOL1 $disk1
	log_mustnot zpool attach -o ashift=$badval $TESTPOOL1 $disk1 $disk2
	log_must zpool destroy $TESTPOOL1
	log_must zpool labelclear $disk1
	log_mustnot zpool labelclear $disk2
	done

	log_pass "zpool attach -o ashift=<n>' works with different ashift values"
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_create/zpool_create_021_pos.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_create/zpool_create_021_pos.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_create/zpool_create_021_pos.ksh (revision 365892)
	@@ -1,93 +1,93 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2009 Sun Microsystems, Inc. All rights reserved.
	# Use is subject to license terms.
	#

	#
	# Copyright (c) 2012, 2016 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/cli_root/zfs_create/zfs_create_common.kshlib
	. $STF_SUITE/tests/functional/cli_root/zpool_create/zpool_create.shlib

	#
	# DESCRIPTION:
	# 'zpool create -O property=value pool' can successfully create a pool
	# with correct filesystem property set.
	#
	# STRATEGY:
	# 1. Create a storage pool with -O option
	# 2. Verify the pool created successfully
	# 3. Verify the filesystem property is correctly set
	#

	verify_runnable "global"

	function cleanup
	{
	datasetexists $TESTPOOL && destroy_pool $TESTPOOL
	}

	log_onexit cleanup

	log_assert "'zpool create -O property=value pool' can successfully create a pool \
	with correct filesystem property set."

	set -A RW_FS_PROP "quota=536870912" \
	"reservation=536870912" \
	"recordsize=262144" \
	"mountpoint=/tmp/mnt$$" \
	"checksum=fletcher2" \
	"compression=lzjb" \
	"atime=off" \
	"devices=off" \
	"exec=off" \
	"setuid=off" \
	"readonly=on" \
	"snapdir=visible" \
	- "acltype=posixacl" \
	+ "acltype=posix" \
	"aclinherit=discard" \
	"canmount=off"
	if is_freebsd; then
	RW_FS_PROP+=("jailed=on")
	else
	RW_FS_PROP+=("zoned=on")
	fi

	typeset -i i=0
	while (( $i < ${#RW_FS_PROP[*]} )); do
	log_must zpool create -O ${RW_FS_PROP[$i]} -f $TESTPOOL $DISKS
	datasetexists $TESTPOOL \|\| \
	log_fail "zpool create $TESTPOOL fail."
	propertycheck $TESTPOOL ${RW_FS_PROP[i]} \|\| \
	log_fail "${RW_FS_PROP[i]} is failed to set."
	log_must zpool destroy $TESTPOOL
	(( i = i + 1 ))
	done

	log_pass "'zpool create -O property=value pool' can successfully create a pool \
	with correct filesystem property set."

	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_create/zpool_create_022_pos.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_create/zpool_create_022_pos.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_create/zpool_create_022_pos.ksh (revision 365892)
	@@ -1,95 +1,95 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2009 Sun Microsystems, Inc. All rights reserved.
	# Use is subject to license terms.
	#

	#
	# Copyright (c) 2012, 2016 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/cli_root/zfs_create/zfs_create_common.kshlib
	. $STF_SUITE/tests/functional/cli_root/zpool_create/zpool_create.shlib

	#
	# DESCRIPTION:
	# 'zpool create -O property=value pool' can successfully create a pool
	# with multiple filesystem properties set.
	#
	# STRATEGY:
	# 1. Create a storage pool with multiple -O options
	# 2. Verify the pool created successfully
	# 3. Verify the properties are correctly set
	#

	verify_runnable "global"

	function cleanup
	{
	poolexists $TESTPOOL && destroy_pool $TESTPOOL
	}

	log_onexit cleanup

	log_assert "'zpool create -O property=value pool' can successfully create a pool \
	with multiple filesystem properties set."

	set -A RW_FS_PROP "quota=536870912" \
	"reservation=536870912" \
	"recordsize=262144" \
	"mountpoint=/tmp/mnt$$" \
	"checksum=fletcher2" \
	"compression=lzjb" \
	"atime=off" \
	"devices=off" \
	"exec=off" \
	"setuid=off" \
	"readonly=on" \
	"snapdir=visible" \
	- "acltype=posixacl" \
	+ "acltype=posix" \
	"aclinherit=discard" \
	"canmount=off"

	typeset -i i=0
	typeset opts=""

	while (( $i < ${#RW_FS_PROP[*]} )); do
	opts="$opts -O ${RW_FS_PROP[$i]}"
	(( i = i + 1 ))
	done

	log_must zpool create $opts -f $TESTPOOL $DISKS
	datasetexists $TESTPOOL \|\| log_fail "zpool create $TESTPOOL fail."

	i=0
	while (( $i < ${#RW_FS_PROP[*]} )); do
	propertycheck $TESTPOOL ${RW_FS_PROP[i]} \|\| \
	log_fail "${RW_FS_PROP[i]} is failed to set."
	(( i = i + 1 ))
	done

	log_pass "'zpool create -O property=value pool' can successfully create a pool \
	with multiple filesystem properties set."

	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/.gitignore
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/.gitignore (nonexistent)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/.gitignore (revision 365892)
	@@ -0,0 +1 @@
	+/ereports
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/Makefile.am
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/Makefile.am (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/Makefile.am (revision 365892)
	@@ -1,13 +1,25 @@
	+include $(top_srcdir)/config/Rules.am
	+
	pkgdatadir = $(datadir)/@PACKAGE@/zfs-tests/tests/functional/cli_root/zpool_events
	+pkgexecdir = $(datadir)/@PACKAGE@/zfs-tests/tests/functional/cli_root/zpool_events
	+
	dist_pkgdata_SCRIPTS = \
	setup.ksh \
	cleanup.ksh \
	zpool_events_clear.ksh \
	zpool_events_cliargs.ksh \
	zpool_events_follow.ksh \
	zpool_events_poolname.ksh \
	- zpool_events_errors.ksh
	+ zpool_events_errors.ksh \
	+ zpool_events_duplicates.ksh

	dist_pkgdata_DATA = \
	zpool_events.cfg \
	zpool_events.kshlib
	+
	+ereports_LDADD = \
	+ $(abs_top_builddir)/lib/libnvpair/libnvpair.la \
	+ $(abs_top_builddir)/lib/libzfs/libzfs.la
	+
	+pkgexec_PROGRAMS = ereports
	+ereports_SOURCES = ereports.c
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/ereports.c
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/ereports.c (nonexistent)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/ereports.c (revision 365892)
	@@ -0,0 +1,174 @@
	+/*
	+ * CDDL HEADER START
	+ *
	+ * This file and its contents are supplied under the terms of the
	+ * Common Development and Distribution License ("CDDL"), version 1.0.
	+ * You may only use this file in accordance with the terms of version
	+ * 1.0 of the CDDL.
	+ *
	+ * A full copy of the text of the CDDL should have accompanied this
	+ * source. A copy of the CDDL is also available via the Internet at
	+ * http://www.illumos.org/license/CDDL.
	+ *
	+ * CDDL HEADER END
	+ */
	+
	+/*
	+ * Copyright (c) 2020 by Delphix. All rights reserved.
	+ */
	+
	+#include <assert.h>
	+#include <fcntl.h>
	+#include <stdio.h>
	+#include <libzfs.h>
	+#include <sys/zfs_ioctl.h>
	+#include <sys/nvpair.h>
	+#include <sys/fm/protocol.h>
	+#include <sys/fm/fs/zfs.h>
	+
	+/*
	+ * Command to output io and checksum ereport values, one per line.
	+ * Used by zpool_events_duplicates.ksh to check for duplicate events.
	+ *
	+ * example output line:
	+ *
	+ * checksum "error_pool" 0x856dd01ce52e336 0x000034 0x000400 0x000a402c00
	+ * 0x000004 0x000000 0x000000 0x000000 0x000001
	+ */
	+
	+/*
	+ * Our ereport duplicate criteria
	+ *
	+ * When the class and all of these values match, then an ereport is
	+ * considered to be a duplicate.
	+ */
	+static const char *criteria_name[] = {
	+ FM_EREPORT_PAYLOAD_ZFS_POOL,
	+ FM_EREPORT_PAYLOAD_ZFS_VDEV_GUID,
	+ FM_EREPORT_PAYLOAD_ZFS_ZIO_ERR,
	+ FM_EREPORT_PAYLOAD_ZFS_ZIO_SIZE,
	+ FM_EREPORT_PAYLOAD_ZFS_ZIO_OFFSET,
	+ FM_EREPORT_PAYLOAD_ZFS_ZIO_PRIORITY,
	+
	+ /* logical zio criteriai (optional) */
	+ FM_EREPORT_PAYLOAD_ZFS_ZIO_OBJSET,
	+ FM_EREPORT_PAYLOAD_ZFS_ZIO_OBJECT,
	+ FM_EREPORT_PAYLOAD_ZFS_ZIO_BLKID,
	+ FM_EREPORT_PAYLOAD_ZFS_ZIO_LEVEL,
	+};
	+
	+#define CRITERIA_NAMES_COUNT ARRAY_SIZE(criteria_name)
	+
	+static void
	+print_ereport_line(nvlist_t *nvl)
	+{
	+ char *class;
	+ int last = CRITERIA_NAMES_COUNT - 1;
	+
	+ /*
	+ * For the test case context, we only want to see 'io' and
	+ * 'checksum' subclass. We skip 'data' to minimize the output.
	+ */
	+ if (nvlist_lookup_string(nvl, FM_CLASS, &class) != 0 \|\|
	+ strstr(class, "ereport.fs.zfs.") == NULL \|\|
	+ strcmp(class, "ereport.fs.zfs.data") == 0) {
	+ return;
	+ }
	+
	+ (void) printf("%s\t", class + strlen("ereport.fs.zfs."));
	+
	+ for (int i = 0; i < CRITERIA_NAMES_COUNT; i++) {
	+ nvpair_t *nvp;
	+ uint32_t i32 = 0;
	+ uint64_t i64 = 0;
	+ char *str = NULL;
	+
	+ if (nvlist_lookup_nvpair(nvl, criteria_name[i], &nvp) != 0) {
	+ /* print a proxy for optional criteria */
	+ (void) printf("--------");
	+ (void) printf("%c", i == last ? '\n' : '\t');
	+ continue;
	+ }
	+
	+ switch (nvpair_type(nvp)) {
	+ case DATA_TYPE_STRING:
	+ (void) nvpair_value_string(nvp, &str);
	+ (void) printf("\"%s\"", str ? str : "<NULL>");
	+ break;
	+
	+ case DATA_TYPE_INT32:
	+ (void) nvpair_value_int32(nvp, (void *)&i32);
	+ (void) printf("0x%06x", i32);
	+ break;
	+
	+ case DATA_TYPE_UINT32:
	+ (void) nvpair_value_uint32(nvp, &i32);
	+ (void) printf("0x%06x", i32);
	+ break;
	+
	+ case DATA_TYPE_INT64:
	+ (void) nvpair_value_int64(nvp, (void *)&i64);
	+ (void) printf("0x%06llx", (u_longlong_t)i64);
	+ break;
	+
	+ case DATA_TYPE_UINT64:
	+ (void) nvpair_value_uint64(nvp, &i64);
	+ if (strcmp(FM_EREPORT_PAYLOAD_ZFS_ZIO_OFFSET,
	+ criteria_name[i]) == 0)
	+ (void) printf("0x%010llx", (u_longlong_t)i64);
	+ else
	+ (void) printf("0x%06llx", (u_longlong_t)i64);
	+ break;
	+ default:
	+ (void) printf("<unknown>");
	+ break;
	+ }
	+ (void) printf("%c", i == last ? '\n' : '\t');
	+ }
	+}
	+
	+static void
	+ereports_dump(libzfs_handle_t *zhdl, int zevent_fd)
	+{
	+ nvlist_t *nvl;
	+ int ret, dropped;
	+
	+ while (1) {
	+ ret = zpool_events_next(zhdl, &nvl, &dropped, ZEVENT_NONBLOCK,
	+ zevent_fd);
	+ if (ret \|\| nvl == NULL)
	+ break;
	+ if (dropped > 0)
	+ (void) fprintf(stdout, "dropped %d events\n", dropped);
	+ print_ereport_line(nvl);
	+ (void) fflush(stdout);
	+ nvlist_free(nvl);
	+ }
	+}
	+
	+/* ARGSUSED */
	+int
	+main(int argc, char **argv)
	+{
	+ libzfs_handle_t *hdl;
	+ int fd;
	+
	+ hdl = libzfs_init();
	+ if (hdl == NULL) {
	+ (void) fprintf(stderr, "libzfs_init: %s\n", strerror(errno));
	+ exit(2);
	+ }
	+ fd = open(ZFS_DEV, O_RDWR);
	+ if (fd < 0) {
	+ (void) fprintf(stderr, "open: %s\n", strerror(errno));
	+ libzfs_fini(hdl);
	+ exit(2);
	+ }
	+
	+ ereports_dump(hdl, fd);
	+
	+ (void) close(fd);
	+ libzfs_fini(hdl);
	+
	+ return (0);
	+}

	Property changes on: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/ereports.c
	___________________________________________________________________
	Added: svn:eol-style
	## -0,0 +1 ##
	+native
	\ No newline at end of property
	Added: svn:mime-type
	## -0,0 +1 ##
	+text/plain
	\ No newline at end of property
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/zpool_events_duplicates.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/zpool_events_duplicates.ksh (nonexistent)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_events/zpool_events_duplicates.ksh (revision 365892)
	@@ -0,0 +1,155 @@
	+#!/bin/ksh -p
	+# CDDL HEADER START
	+#
	+# The contents of this file are subject to the terms of the
	+# Common Development and Distribution License (the "License").
	+# You may not use this file except in compliance with the License.
	+#
	+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	+# or http://www.opensolaris.org/os/licensing.
	+# See the License for the specific language governing permissions
	+# and limitations under the License.
	+#
	+# When distributing Covered Code, include this CDDL HEADER in each
	+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	+# If applicable, add the following below this CDDL HEADER, with the
	+# fields enclosed by brackets "[]" replaced with your own identifying
	+# information: Portions Copyright [yyyy] [name of copyright owner]
	+#
	+# CDDL HEADER END
	+#
	+
	+#
	+# Copyright (c) 2018 by Lawrence Livermore National Security, LLC.
	+# Copyright (c) 2020 by Delphix. All rights reserved.
	+#
	+
	+# DESCRIPTION:
	+# Verify that duplicate I/O ereport errors are not posted
	+#
	+# STRATEGY:
	+# 1. Create a mirror pool
	+# 2. Inject duplicate read/write IO errors and checksum errors
	+# 3. Verify there are no duplicate events being posted
	+#
	+
	+. $STF_SUITE/include/libtest.shlib
	+
	+verify_runnable "both"
	+
	+MOUNTDIR=$TEST_BASE_DIR/mount
	+FILEPATH=$MOUNTDIR/badfile
	+VDEV1=$TEST_BASE_DIR/vfile1
	+VDEV2=$TEST_BASE_DIR/vfile2
	+POOL=error_pool
	+FILESIZE="10M"
	+OLD_LEN_MAX=$(get_tunable ZEVENT_LEN_MAX)
	+RETAIN_MAX=$(get_tunable ZEVENT_RETAIN_MAX)
	+
	+EREPORTS="$STF_SUITE/tests/functional/cli_root/zpool_events/ereports"
	+
	+duplicates=false
	+
	+function cleanup
	+{
	+ log_must set_tunable64 ZEVENT_LEN_MAX $OLD_LEN_MAX
	+
	+ log_must zinject -c all
	+ if poolexists $POOL ; then
	+ destroy_pool $POOL
	+ fi
	+ log_must rm -f $VDEV1 $VDEV2
	+}
	+
	+log_assert "Duplicate I/O ereport errors are not posted"
	+log_note "zevent retain max setting: $RETAIN_MAX"
	+
	+log_onexit cleanup
	+
	+# Set our threshold high to avoid dropping events.
	+set_tunable64 ZEVENT_LEN_MAX 20000
	+
	+log_must truncate -s $MINVDEVSIZE $VDEV1 $VDEV2
	+log_must mkdir -p $MOUNTDIR
	+
	+#
	+# $1: test type - corrupt (checksum error), io
	+# $2: read, write
	+function do_dup_test
	+{
	+ ERR=$1
	+ RW=$2
	+
	+ log_note "Testing $ERR $RW ereports"
	+ log_must zpool create -f -m $MOUNTDIR -o failmode=continue $POOL mirror $VDEV1 $VDEV2
	+ log_must zpool events -c
	+ log_must zfs set compression=off $POOL
	+
	+ if [ "$RW" == "read" ] ; then
	+ log_must mkfile $FILESIZE $FILEPATH
	+
	+ # unmount and mount filesystems to purge file from ARC
	+ # to force reads to go through error inject handler
	+ log_must zfs unmount $POOL
	+ log_must zfs mount $POOL
	+
	+ # all reads from this file get an error
	+ if [ "$ERR" == "corrupt" ] ; then
	+ log_must zinject -a -t data -e checksum -T read $FILEPATH
	+ else
	+ log_must zinject -a -t data -e io -T read $FILEPATH
	+ fi
	+
	+ # Read the file a few times to generate some
	+ # duplicate errors of the same blocks
	+ # shellcheck disable=SC2034
	+ for i in {1..15}; do
	+ dd if=$FILEPATH of=/dev/null bs=128K > /dev/null 2>&1
	+ done
	+ log_must zinject -c all
	+ fi
	+
	+ log_must zinject -d $VDEV1 -e $ERR -T $RW -f 100 $POOL
	+
	+ if [ "$RW" == "write" ] ; then
	+ log_must mkfile $FILESIZE $FILEPATH
	+ log_must zpool sync $POOL
	+ else
	+ # scrub twice to generate some duplicates
	+ log_must zpool scrub $POOL
	+ log_must zpool wait -t scrub $POOL
	+ log_must zpool scrub $POOL
	+ log_must zpool wait -t scrub $POOL
	+ fi
	+
	+ log_must zinject -c all
	+
	+ # Wait for the pool to settle down and finish resilvering (if
	+ # necessary). We want the errors to stop incrementing before we
	+ # check for duplicates.
	+ zpool wait -t resilver $POOL
	+
	+ ereports="$($EREPORTS \| sort)"
	+ actual=$(echo "$ereports" \| wc -l)
	+ unique=$(echo "$ereports" \| uniq \| wc -l)
	+ log_note "$actual total $ERR $RW ereports where $unique were unique"
	+
	+ if [ $actual -gt $unique ] ; then
	+ log_note "UNEXPECTED -- $((actual-unique)) duplicate $ERR $RW ereports"
	+ echo "$ereports"
	+ duplicates=true
	+ fi
	+
	+ log_must zpool destroy $POOL
	+}
	+
	+do_dup_test "corrupt" "read"
	+do_dup_test "io" "read"
	+do_dup_test "io" "write"
	+
	+if $duplicates; then
	+ log_fail "FAILED -- Duplicate I/O ereport errors encountered"
	+else
	+ log_pass "Duplicate I/O ereport errors are not posted"
	+fi
	+
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_replace/replace-o_ashift.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_replace/replace-o_ashift.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_replace/replace-o_ashift.ksh (revision 365892)
	@@ -1,101 +1,111 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2017, loli10K. All rights reserved.
	+# Copyright (c) 2020 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/cli_root/zpool_create/zpool_create.shlib

	#
	# DESCRIPTION:
	# 'zpool replace -o ashift=<n> ...' should work with different ashift
	# values.
	#
	# STRATEGY:
	# 1. Create various pools with different ashift values.
	# 2. Verify 'replace -o ashift=<n>' works only with allowed values.
	#

	verify_runnable "global"

	function cleanup
	{
	+ log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT $orig_ashift
	poolexists $TESTPOOL1 && destroy_pool $TESTPOOL1
	rm -f $disk1 $disk2
	}

	log_assert "zpool replace -o ashift=<n>' works with different ashift values"
	log_onexit cleanup

	disk1=$TEST_BASE_DIR/disk1
	disk2=$TEST_BASE_DIR/disk2
	log_must truncate -s $SIZE $disk1
	log_must truncate -s $SIZE $disk2
	+
	+orig_ashift=$(get_tunable VDEV_FILE_PHYSICAL_ASHIFT)
	+#
	+# Set the file vdev's ashift to the max. Overriding
	+# the ashift using the -o ashift property should still
	+# be honored.
	+#
	+log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT 16

	typeset ashifts=("9" "10" "11" "12" "13" "14" "15" "16")
	for ashift in ${ashifts[@]}
	do
	for cmdval in ${ashifts[@]}
	do
	log_must zpool create -o ashift=$ashift $TESTPOOL1 $disk1
	verify_ashift $disk1 $ashift
	if [[ $? -ne 0 ]]
	then
	log_fail "Pool was created without setting ashift " \
	"value to $ashift"
	fi
	# ashift_of(replacing_disk) <= ashift_of(existing_vdev)
	if [[ $cmdval -le $ashift ]]
	then
	log_must zpool replace -o ashift=$cmdval $TESTPOOL1 \
	$disk1 $disk2
	verify_ashift $disk2 $ashift
	if [[ $? -ne 0 ]]
	then
	log_fail "Device was replaced without " \
	"setting ashift value to $ashift"
	fi
	wait_replacing $TESTPOOL1
	else
	log_mustnot zpool replace -o ashift=$cmdval $TESTPOOL1 \
	$disk1 $disk2
	fi
	# clean things for the next run
	log_must zpool destroy $TESTPOOL1
	log_must zpool labelclear $disk1
	log_must zpool labelclear $disk2
	done
	done

	typeset badvals=("off" "on" "1" "8" "17" "1b" "ff" "-")
	for badval in ${badvals[@]}
	do
	log_must zpool create $TESTPOOL1 $disk1
	log_mustnot zpool replace -o ashift=$badval $TESTPOOL1 $disk1 $disk2
	log_must zpool destroy $TESTPOOL1
	log_must zpool labelclear $disk1
	log_mustnot zpool labelclear $disk2
	done

	log_pass "zpool replace -o ashift=<n>' works with different ashift values"
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_replace/replace_prop_ashift.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_replace/replace_prop_ashift.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_replace/replace_prop_ashift.ksh (revision 365892)
	@@ -1,97 +1,107 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2017, loli10K. All rights reserved.
	+# Copyright (c) 2020 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/cli_root/zpool_create/zpool_create.shlib

	#
	# DESCRIPTION:
	# 'zpool replace' should use the ashift pool property value as default.
	#
	# STRATEGY:
	# 1. Create a pool with default values.
	# 2. Verify 'zpool replace' uses the ashift pool property value when
	# replacing an existing device.
	# 3. Verify the default ashift value can still be overridden by manually
	# specifying '-o ashift=<n>' from the command line.
	#

	verify_runnable "global"

	function cleanup
	{
	+ log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT $orig_ashift
	poolexists $TESTPOOL1 && destroy_pool $TESTPOOL1
	rm -f $disk1 $disk2
	}

	log_assert "'zpool replace' uses the ashift pool property value as default."
	log_onexit cleanup

	disk1=$TEST_BASE_DIR/disk1
	disk2=$TEST_BASE_DIR/disk2
	log_must truncate -s $SIZE $disk1
	log_must truncate -s $SIZE $disk2
	+
	+orig_ashift=$(get_tunable VDEV_FILE_PHYSICAL_ASHIFT)
	+#
	+# Set the file vdev's ashift to the max. Overriding
	+# the ashift using the -o ashift property should still
	+# be honored.
	+#
	+log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT 16

	typeset ashifts=("9" "10" "11" "12" "13" "14" "15" "16")
	for ashift in ${ashifts[@]}
	do
	for pprop in ${ashifts[@]}
	do
	log_must zpool create -o ashift=$ashift $TESTPOOL1 $disk1
	log_must zpool set ashift=$pprop $TESTPOOL1
	# ashift_of(replacing_disk) <= ashift_of(existing_vdev)
	if [[ $pprop -le $ashift ]]
	then
	log_must zpool replace $TESTPOOL1 $disk1 $disk2
	wait_replacing $TESTPOOL1
	verify_ashift $disk2 $ashift
	if [[ $? -ne 0 ]]
	then
	log_fail "Device was replaced without " \
	"setting ashift value to $ashift"
	fi
	else
	# cannot replace if pool prop ashift > vdev ashift
	log_mustnot zpool replace $TESTPOOL1 $disk1 $disk2
	# verify we can override the pool prop value manually
	log_must zpool replace -o ashift=$ashift $TESTPOOL1 \
	$disk1 $disk2
	wait_replacing $TESTPOOL1
	verify_ashift $disk2 $ashift
	if [[ $? -ne 0 ]]
	then
	log_fail "Device was replaced without " \
	"setting ashift value to $ashift"
	fi
	fi
	# clean things for the next run
	log_must zpool destroy $TESTPOOL1
	log_must zpool labelclear $disk1
	log_must zpool labelclear $disk2
	done
	done

	log_pass "'zpool replace' uses the ashift pool property value."
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_set/zpool_set_ashift.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_set/zpool_set_ashift.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_root/zpool_set/zpool_set_ashift.ksh (revision 365892)
	@@ -1,78 +1,88 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2017, loli10K. All rights reserved.
	+# Copyright (c) 2020 by Delphix. All rights reserved.
	#

	. $STF_SUITE/include/libtest.shlib
	. $STF_SUITE/tests/functional/cli_root/zpool_create/zpool_create.shlib

	#
	# DESCRIPTION:
	#
	# zpool set can modify 'ashift' property
	#
	# STRATEGY:
	# 1. Create a pool
	# 2. Verify that we can set 'ashift' only to allowed values on that pool
	#

	verify_runnable "global"

	function cleanup
	{
	+ log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT $orig_ashift
	destroy_pool $TESTPOOL1
	rm -f $disk
	}

	typeset goodvals=("0" "9" "10" "11" "12" "13" "14" "15" "16")
	typeset badvals=("off" "on" "1" "8" "17" "1b" "ff" "-")

	log_onexit cleanup

	log_assert "zpool set can modify 'ashift' property"
	+
	+orig_ashift=$(get_tunable VDEV_FILE_PHYSICAL_ASHIFT)
	+#
	+# Set the file vdev's ashift to the max. Overriding
	+# the ashift using the -o ashift property should still
	+# be honored.
	+#
	+log_must set_tunable64 VDEV_FILE_PHYSICAL_ASHIFT 16

	disk=$TEST_BASE_DIR/disk
	log_must mkfile $SIZE $disk
	log_must zpool create $TESTPOOL1 $disk

	for ashift in ${goodvals[@]}
	do
	log_must zpool set ashift=$ashift $TESTPOOL1
	typeset value=$(get_pool_prop ashift $TESTPOOL1)
	if [[ "$ashift" != "$value" ]]; then
	log_fail "'zpool set' did not update ashift value to $ashift "\
	"(current = $value)"
	fi
	done

	for ashift in ${badvals[@]}
	do
	log_mustnot zpool set ashift=$ashift $TESTPOOL1
	typeset value=$(get_pool_prop ashift $TESTPOOL1)
	if [[ "$ashift" == "$value" ]]; then
	log_fail "'zpool set' incorrectly set ashift value to $value"
	fi
	done

	log_pass "zpool set can modify 'ashift' property"
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_user/misc/misc.cfg
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_user/misc/misc.cfg (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/cli_user/misc/misc.cfg (revision 365892)
	@@ -1,123 +1,123 @@
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2007 Sun Microsystems, Inc. All rights reserved.
	# Use is subject to license terms.
	#

	#
	# Copyright (c) 2013 by Delphix. All rights reserved.
	#

	if is_linux; then
	# these are the set of setable ZFS properties
	PROP_NAMES="\
	acltype atime \
	checksum compression devices \
	exec mountpoint quota readonly \
	recordsize reservation setuid \
	snapdir"

	# these are a set of values we apply, for use when testing the
	# zfs get/set subcommands - ordered as per the list above so we
	# can iterate over both sets in an array
	PROP_VALS="\
	- posixacl on \
	+ posix on \
	fletcher2 on on \
	on legacy none on \
	128K none on \
	visible"

	# these are an alternate set of property values
	PROP_ALTVALS="\
	- noacl off \
	+ off off \
	fletcher4 lzjb off \
	off /tmp/zfstest 100M off \
	512 10m off \
	hidden"
	elif is_freebsd; then
	PROP_NAMES="\
	acltype atime \
	checksum compression devices \
	exec mountpoint quota readonly \
	recordsize reservation setuid \
	snapdir"

	# these are a set of values we apply, for use when testing the
	# zfs get/set subcommands - ordered as per the list above so we
	# can iterate over both sets in an array
	PROP_VALS="\
	- posixacl on \
	+ posix on \
	fletcher2 on on \
	on legacy none on \
	128K none on \
	visible"

	# these are an alternate set of property values
	PROP_ALTVALS="\
	- noacl off \
	+ off off \
	fletcher4 lzjb off \
	off /tmp/zfstest 100M off \
	512 10m off \
	hidden"

	else
	# these are the set of setable ZFS properties
	PROP_NAMES="\
	aclinherit aclmode atime \
	checksum compression devices \
	exec mountpoint quota readonly \
	recordsize reservation setuid sharenfs \
	snapdir"

	# these are a set of values we apply, for use when testing the
	# zfs get/set subcommands - ordered as per the list above so we
	# can iterate over both sets in an array
	PROP_VALS="\
	passthrough discard on \
	fletcher2 on on \
	on legacy none on \
	128K none on on \
	visible"

	# these are an alternate set of property values
	PROP_ALTVALS="\
	passthrough-x groupmask off \
	fletcher4 lzjb off \
	off /tmp/zfstest 100M off \
	512 10m off off \
	hidden"
	fi

	# additional properties to worry about: canmount copies xattr zoned version

	POOL_PROPS="\
	failmode autoreplace"

	POOL_VALS="\
	continue on"

	POOL_ALTVALS="\
	panic off"

	export TESTSNAP=testsnap-misc
	export TESTCLCT=testclct-misc
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/history/history_002_pos.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/history/history_002_pos.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/history/history_002_pos.ksh (revision 365892)
	@@ -1,198 +1,198 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright 2009 Sun Microsystems, Inc. All rights reserved.
	# Use is subject to license terms.

	#
	# Copyright (c) 2013, 2016 by Delphix. All rights reserved.
	#

	. $STF_SUITE/tests/functional/history/history_common.kshlib

	#
	# DESCRIPTION:
	# Create a scenario to verify the following zfs subcommands are logged.
	# create, destroy, clone, rename, snapshot, rollback, set, inherit,
	# receive, promote, hold and release.
	#
	# STRATEGY:
	# 1. Verify that all the zfs commands listed (barring send) produce an
	# entry in the pool history.
	#

	verify_runnable "global"

	function cleanup
	{

	[[ -f $tmpfile ]] && rm -f $tmpfile
	[[ -f $tmpfile2 ]] && rm -f $tmpfile2
	for dataset in $fs $newfs $fsclone $vol $newvol $volclone; do
	datasetexists $dataset && zfs destroy -Rf $dataset
	done
	rm -rf /history.$$
	}

	log_assert "Verify zfs sub-commands which modify state are logged."
	log_onexit cleanup

	fs=$TESTPOOL/$TESTFS1; newfs=$TESTPOOL/newfs; fsclone=$TESTPOOL/clone
	vol=$TESTPOOL/$TESTVOL ; newvol=$TESTPOOL/newvol; volclone=$TESTPOOL/volclone
	fssnap=$fs@fssnap; fssnap2=$fs@fssnap2
	volsnap=$vol@volsnap; volsnap2=$vol@volsnap2
	tmpfile=$TEST_BASE_DIR/tmpfile.$$ ; tmpfile2=$TEST_BASE_DIR/tmpfile2.$$

	if is_linux; then
	# property value property value
	#
	props=(
	quota 64M recordsize 512
	reservation 32M reservation none
	mountpoint /history.$$ mountpoint legacy
	mountpoint none compression lz4
	compression on compression off
	- compression lzjb acltype noacl
	- acltype posixacl xattr sa
	+ compression lzjb acltype off
	+ acltype posix xattr sa
	atime on atime off
	devices on devices off
	exec on exec off
	setuid on setuid off
	readonly on readonly off
	zoned on zoned off
	snapdir hidden snapdir visible
	aclinherit discard aclinherit noallow
	aclinherit secure aclinherit passthrough
	canmount off canmount on
	xattr on xattr off
	compression gzip compression gzip-$((RANDOM%9 + 1))
	compression zstd compression zstd-$((RANDOM%9 + 1))
	compression zstd-fast copies $((RANDOM%3 + 1))
	compression zstd-fast-$((RANDOM%9 + 1))
	)
	elif is_freebsd; then
	# property value property value
	#
	props=(
	quota 64M recordsize 512
	reservation 32M reservation none
	mountpoint /history.$$ mountpoint legacy
	mountpoint none sharenfs on
	sharenfs off
	compression on compression off
	compression lzjb aclmode discard
	aclmode groupmask aclmode passthrough
	atime on atime off
	devices on devices off
	exec on exec off
	setuid on setuid off
	readonly on readonly off
	jailed on jailed off
	snapdir hidden snapdir visible
	aclinherit discard aclinherit noallow
	aclinherit secure aclinherit passthrough
	canmount off canmount on
	compression gzip compression gzip-$((RANDOM%9 + 1))
	compression zstd compression zstd-$((RANDOM%9 + 1))
	compression zstd-fast copies $((RANDOM%3 + 1))
	compression zstd-fast-$((RANDOM%9 + 1))
	)
	else
	# property value property value
	#
	props=(
	quota 64M recordsize 512
	reservation 32M reservation none
	mountpoint /history.$$ mountpoint legacy
	mountpoint none sharenfs on
	sharenfs off
	compression on compression off
	compression lzjb aclmode discard
	aclmode groupmask aclmode passthrough
	atime on atime off
	devices on devices off
	exec on exec off
	setuid on setuid off
	readonly on readonly off
	zoned on zoned off
	snapdir hidden snapdir visible
	aclinherit discard aclinherit noallow
	aclinherit secure aclinherit passthrough
	canmount off canmount on
	xattr on xattr off
	compression gzip compression gzip-$((RANDOM%9 + 1))
	copies $((RANDOM%3 + 1))
	)
	fi

	run_and_verify "zfs create $fs"
	# Set all the property for filesystem
	typeset -i i=0
	while ((i < ${#props[@]})) ; do
	run_and_verify "zfs set ${props[$i]}=${props[((i+1))]} $fs"

	# quota, reservation, canmount can not be inherited.
	#
	if [[ ${props[$i]} != "quota" && ${props[$i]} != "reservation" && \
	${props[$i]} != "canmount" ]];
	then
	run_and_verify "zfs inherit ${props[$i]} $fs"
	fi

	((i += 2))
	done

	run_and_verify "zfs create -V 64M $vol"
	run_and_verify "zfs set volsize=32M $vol"
	run_and_verify "zfs snapshot $fssnap"
	run_and_verify "zfs hold tag $fssnap"
	run_and_verify "zfs release tag $fssnap"
	run_and_verify "zfs snapshot $volsnap"
	run_and_verify "zfs snapshot $fssnap2"
	run_and_verify "zfs snapshot $volsnap2"

	# Send isn't logged...
	log_must eval "zfs send -i $fssnap $fssnap2 > $tmpfile"
	log_must eval "zfs send -i $volsnap $volsnap2 > $tmpfile2"
	# Verify that's true
	zpool history $TESTPOOL \| grep 'zfs send' >/dev/null 2>&1 && \
	log_fail "'zfs send' found in history of \"$TESTPOOL\""

	run_and_verify "zfs destroy $fssnap2"
	run_and_verify "zfs destroy $volsnap2"
	run_and_verify "zfs receive $fs < $tmpfile"
	run_and_verify "zfs receive $vol < $tmpfile2"
	run_and_verify "zfs rollback -r $fssnap"
	run_and_verify "zfs rollback -r $volsnap"
	run_and_verify "zfs clone $fssnap $fsclone"
	run_and_verify "zfs clone $volsnap $volclone"
	run_and_verify "zfs rename $fs $newfs"
	run_and_verify "zfs rename $vol $newvol"
	run_and_verify "zfs promote $fsclone"
	run_and_verify "zfs promote $volclone"
	run_and_verify "zfs destroy $newfs"
	run_and_verify "zfs destroy $newvol"
	run_and_verify "zfs destroy -rf $fsclone"
	run_and_verify "zfs destroy -rf $volclone"

	log_pass "zfs sub-commands which modify state are logged passed."
	Index: vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/rsend/rsend_012_pos.ksh
	===================================================================
	--- vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/rsend/rsend_012_pos.ksh (revision 365891)
	+++ vendor-sys/openzfs/dist/tests/zfs-tests/tests/functional/rsend/rsend_012_pos.ksh (revision 365892)
	@@ -1,186 +1,186 @@
	#!/bin/ksh -p
	#
	# CDDL HEADER START
	#
	# The contents of this file are subject to the terms of the
	# Common Development and Distribution License (the "License").
	# You may not use this file except in compliance with the License.
	#
	# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	# or http://www.opensolaris.org/os/licensing.
	# See the License for the specific language governing permissions
	# and limitations under the License.
	#
	# When distributing Covered Code, include this CDDL HEADER in each
	# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	# If applicable, add the following below this CDDL HEADER, with the
	# fields enclosed by brackets "[]" replaced with your own identifying
	# information: Portions Copyright [yyyy] [name of copyright owner]
	#
	# CDDL HEADER END
	#

	#
	# Copyright (c) 2009, Sun Microsystems Inc. All rights reserved.
	# Copyright (c) 2013, 2016, Delphix. All rights reserved.
	# Use is subject to license terms.
	#

	. $STF_SUITE/include/properties.shlib
	. $STF_SUITE/tests/functional/rsend/rsend.kshlib

	#
	# DESCRIPTION:
	# zfs send -R will backup all the filesystem properties correctly.
	#
	# STRATEGY:
	# 1. Setting properties for all the filesystem and volumes randomly
	# 2. Backup all the data from POOL by send -R
	# 3. Restore all the data in POOL2
	# 4. Verify all the properties in the two pools are the same
	#

	verify_runnable "global"

	function edited_prop
	{
	typeset behaviour=$1
	typeset ds=$2
	typeset backfile=$TESTDIR/edited_prop_$ds

	case $behaviour in
	"get")
	typeset props=$(zfs inherit 2>&1 \| \
	awk '$2=="YES" {print $1}' \| \
	egrep -v "^vol\|\.\.\.$")
	for item in $props ; do
	if [[ $item == "mlslabel" ]] && \
	! is_te_enabled ; then
	continue
	fi
	zfs get -H -o property,value $item $ds >> \
	$backfile
	if (($? != 0)); then
	log_fail "zfs get -H -o property,value"\
	"$item $ds > $backfile"
	fi
	done
	;;
	"set")
	if [[ ! -f $backfile ]] ; then
	log_fail "$ds need backup properties firstly."
	fi

	typeset prop value
	while read prop value ; do
	eval zfs set $prop='$value' $ds
	if (($? != 0)); then
	log_fail "zfs set $prop=$value $ds"
	fi
	done < $backfile
	;;
	*)
	log_fail "Unrecognized behaviour: $behaviour"
	esac
	}

	function cleanup
	{
	log_must cleanup_pool $POOL
	log_must cleanup_pool $POOL2

	log_must edited_prop "set" $POOL
	log_must edited_prop "set" $POOL2

	typeset prop
	for prop in $(fs_inherit_prop) ; do
	log_must zfs inherit $prop $POOL
	log_must zfs inherit $prop $POOL2
	done

	log_must setup_test_model $POOL

	if [[ -d $TESTDIR ]]; then
	log_must rm -rf $TESTDIR/*
	fi
	}

	log_assert "Verify zfs send -R will backup all the filesystem properties " \
	"correctly."
	log_onexit cleanup

	log_must edited_prop "get" $POOL
	log_must edited_prop "get" $POOL2

	for fs in "$POOL" "$POOL/pclone" "$POOL/$FS" "$POOL/$FS/fs1" \
	"$POOL/$FS/fs1/fs2" "$POOL/$FS/fs1/fclone" ; do
	rand_set_prop $fs aclinherit "discard" "noallow" "secure" "passthrough"
	rand_set_prop $fs checksum "on" "off" "fletcher2" "fletcher4" "sha256"
	- rand_set_prop $fs acltype "off" "noacl" "posixacl"
	+ rand_set_prop $fs acltype "off" "posix" "noacl" "posixacl"
	rand_set_prop $fs atime "on" "off"
	rand_set_prop $fs checksum "on" "off" "fletcher2" "fletcher4" "sha256"
	rand_set_prop $fs compression "${compress_prop_vals[@]}"
	rand_set_prop $fs copies "1" "2" "3"
	rand_set_prop $fs devices "on" "off"
	rand_set_prop $fs exec "on" "off"
	rand_set_prop $fs quota "512M" "1024M"
	rand_set_prop $fs recordsize "512" "2K" "8K" "32K" "128K"
	rand_set_prop $fs dnodesize "legacy" "auto" "1k" "2k" "4k" "8k" "16k"
	rand_set_prop $fs setuid "on" "off"
	rand_set_prop $fs snapdir "hidden" "visible"
	if ! is_freebsd; then
	rand_set_prop $fs xattr "on" "off"
	fi
	rand_set_prop $fs user:prop "aaa" "bbb" "23421" "()-+?"
	done

	for vol in "$POOL/vol" "$POOL/$FS/vol" ; do
	rand_set_prop $vol checksum "on" "off" "fletcher2" "fletcher4" "sha256"
	rand_set_prop $vol compression "${compress_prop_vals[@]}"
	rand_set_prop $vol readonly "on" "off"
	rand_set_prop $vol copies "1" "2" "3"
	rand_set_prop $vol user:prop "aaa" "bbb" "23421" "()-+?"
	done


	# Verify inherited property can be received
	rand_set_prop $POOL redundant_metadata "all" "most"
	rand_set_prop $POOL sync "standard" "always" "disabled"

	#
	# Duplicate POOL2 for testing
	#
	log_must eval "zfs send -R $POOL@final > $BACKDIR/pool-final-R"
	log_must eval "zfs receive -d -F $POOL2 < $BACKDIR/pool-final-R"

	#
	# Define all the POOL/POOL2 datasets pair
	#
	set -A pair "$POOL" "$POOL2" \
	"$POOL/$FS" "$POOL2/$FS" \
	"$POOL/$FS/fs1" "$POOL2/$FS/fs1" \
	"$POOL/$FS/fs1/fs2" "$POOL2/$FS/fs1/fs2" \
	"$POOL/pclone" "$POOL2/pclone" \
	"$POOL/$FS/fs1/fclone" "$POOL2/$FS/fs1/fclone" \
	"$POOL/vol" "$POOL2/vol" \
	"$POOL/$FS/vol" "$POOL2/$FS/vol"

	typeset -i i=0
	while ((i < ${#pair[@]})); do
	log_must cmp_ds_prop ${pair[$i]} ${pair[((i+1))]}

	((i += 2))
	done


	zpool upgrade -v \| grep "Snapshot properties" > /dev/null 2>&1
	if (( $? == 0 )) ; then
	i=0
	while ((i < ${#pair[@]})); do
	log_must cmp_ds_prop ${pair[$i]}@final ${pair[((i+1))]}@final
	((i += 2))
	done
	fi

	log_pass "Verify zfs send -R will backup all the filesystem properties " \
	"correctly."

File Metadata

Mime Type: application/octet-stream
Expires: Sun, Apr 21, 4:34 PM (1 d, 23 h)
Storage Engine: chunks
Storage Format: Chunks
Storage Handle: KA1WOL1Zl.t7
Default Alt Text: (4 MB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions