]> git.proxmox.com Git - mirror_zfs.git/blobdiff - module/zfs/dsl_scan.c
ddt: typedef ddt_type and ddt_class
[mirror_zfs.git] / module / zfs / dsl_scan.c
index a08353c1598a92d7ac1df9c157e2eead6acafe9c..060a5cc36d703c5c622e0a0595fbe8ecf388ab6a 100644 (file)
@@ -6,7 +6,7 @@
  * You may not use this file except in compliance with the License.
  *
  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
- * or http://www.opensolaris.org/os/licensing.
+ * or https://opensource.org/licenses/CDDL-1.0.
  * See the License for the specific language governing permissions
  * and limitations under the License.
  *
  */
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
+ * Copyright (c) 2011, 2021 by Delphix. All rights reserved.
  * Copyright 2016 Gary Mills
- * Copyright (c) 2017 Datto Inc.
- * Copyright 2017 Joyent, Inc.
+ * Copyright (c) 2017, 2019, Datto Inc. All rights reserved.
+ * Copyright (c) 2015, Nexenta Systems, Inc. All rights reserved.
+ * Copyright 2019 Joyent, Inc.
  */
 
 #include <sys/dsl_scan.h>
@@ -36,6 +37,7 @@
 #include <sys/dmu_tx.h>
 #include <sys/dmu_objset.h>
 #include <sys/arc.h>
+#include <sys/arc_impl.h>
 #include <sys/zap.h>
 #include <sys/zio.h>
 #include <sys/zfs_context.h>
 #include <sys/vdev_impl.h>
 #include <sys/zil_impl.h>
 #include <sys/zio_checksum.h>
+#include <sys/brt.h>
 #include <sys/ddt.h>
 #include <sys/sa.h>
 #include <sys/sa_impl.h>
 #include <sys/zfeature.h>
 #include <sys/abd.h>
 #include <sys/range_tree.h>
+#include <sys/dbuf.h>
 #ifdef _KERNEL
 #include <sys/zfs_vfsops.h>
 #endif
@@ -119,14 +123,26 @@ static scan_cb_t dsl_scan_scrub_cb;
 static int scan_ds_queue_compare(const void *a, const void *b);
 static int scan_prefetch_queue_compare(const void *a, const void *b);
 static void scan_ds_queue_clear(dsl_scan_t *scn);
+static void scan_ds_prefetch_queue_clear(dsl_scan_t *scn);
 static boolean_t scan_ds_queue_contains(dsl_scan_t *scn, uint64_t dsobj,
     uint64_t *txg);
 static void scan_ds_queue_insert(dsl_scan_t *scn, uint64_t dsobj, uint64_t txg);
 static void scan_ds_queue_remove(dsl_scan_t *scn, uint64_t dsobj);
 static void scan_ds_queue_sync(dsl_scan_t *scn, dmu_tx_t *tx);
-static uint64_t dsl_scan_count_leaves(vdev_t *vd);
+static uint64_t dsl_scan_count_data_disks(spa_t *spa);
+static void read_by_block_level(dsl_scan_t *scn, zbookmark_phys_t zb);
 
-extern int zfs_vdev_async_write_active_min_dirty_percent;
+extern uint_t zfs_vdev_async_write_active_min_dirty_percent;
+static int zfs_scan_blkstats = 0;
+
+/*
+ * 'zpool status' uses bytes processed per pass to report throughput and
+ * estimate time remaining.  We define a pass to start when the scanning
+ * phase completes for a sequential resilver.  Optionally, this value
+ * may be used to reset the pass statistics every N txgs to provide an
+ * estimated completion time based on currently observed performance.
+ */
+static uint_t zfs_scan_report_txgs = 0;
 
 /*
  * By default zfs will check to ensure it is not over the hard memory
@@ -134,7 +150,7 @@ extern int zfs_vdev_async_write_active_min_dirty_percent;
  * this value can be set to 1 to enable checking before scanning each
  * block.
  */
-int zfs_scan_strict_mem_lim = B_FALSE;
+static int zfs_scan_strict_mem_lim = B_FALSE;
 
 /*
  * Maximum number of parallelly executed bytes per leaf vdev. We attempt
@@ -144,36 +160,57 @@ int zfs_scan_strict_mem_lim = B_FALSE;
  * overload the drives with I/O, since that is protected by
  * zfs_vdev_scrub_max_active.
  */
-unsigned long zfs_scan_vdev_limit = 4 << 20;
+static uint64_t zfs_scan_vdev_limit = 16 << 20;
+
+static uint_t zfs_scan_issue_strategy = 0;
 
-int zfs_scan_issue_strategy = 0;
-int zfs_scan_legacy = B_FALSE; /* don't queue & sort zios, go direct */
-unsigned long zfs_scan_max_ext_gap = 2 << 20; /* in bytes */
+/* don't queue & sort zios, go direct */
+static int zfs_scan_legacy = B_FALSE;
+static uint64_t zfs_scan_max_ext_gap = 2 << 20; /* in bytes */
 
 /*
  * fill_weight is non-tunable at runtime, so we copy it at module init from
  * zfs_scan_fill_weight. Runtime adjustments to zfs_scan_fill_weight would
  * break queue sorting.
  */
-int zfs_scan_fill_weight = 3;
+static uint_t zfs_scan_fill_weight = 3;
 static uint64_t fill_weight;
 
 /* See dsl_scan_should_clear() for details on the memory limit tunables */
-uint64_t zfs_scan_mem_lim_min = 16 << 20;      /* bytes */
-uint64_t zfs_scan_mem_lim_soft_max = 128 << 20;        /* bytes */
-int zfs_scan_mem_lim_fact = 20;                /* fraction of physmem */
-int zfs_scan_mem_lim_soft_fact = 20;   /* fraction of mem lim above */
-
-int zfs_scrub_min_time_ms = 1000; /* min millisecs to scrub per txg */
-int zfs_obsolete_min_time_ms = 500; /* min millisecs to obsolete per txg */
-int zfs_free_min_time_ms = 1000; /* min millisecs to free per txg */
-int zfs_resilver_min_time_ms = 3000; /* min millisecs to resilver per txg */
-int zfs_scan_checkpoint_intval = 7200; /* in seconds */
-int zfs_no_scrub_io = B_FALSE; /* set to disable scrub i/o */
-int zfs_no_scrub_prefetch = B_FALSE; /* set to disable scrub prefetch */
-enum ddt_class zfs_scrub_ddt_class_max = DDT_CLASS_DUPLICATE;
+static const uint64_t zfs_scan_mem_lim_min = 16 << 20; /* bytes */
+static const uint64_t zfs_scan_mem_lim_soft_max = 128 << 20;   /* bytes */
+
+
+/* fraction of physmem */
+static uint_t zfs_scan_mem_lim_fact = 20;
+
+/* fraction of mem lim above */
+static uint_t zfs_scan_mem_lim_soft_fact = 20;
+
+/* minimum milliseconds to scrub per txg */
+static uint_t zfs_scrub_min_time_ms = 1000;
+
+/* minimum milliseconds to obsolete per txg */
+static uint_t zfs_obsolete_min_time_ms = 500;
+
+/* minimum milliseconds to free per txg */
+static uint_t zfs_free_min_time_ms = 1000;
+
+/* minimum milliseconds to resilver per txg */
+static uint_t zfs_resilver_min_time_ms = 3000;
+
+static uint_t zfs_scan_checkpoint_intval = 7200; /* in seconds */
+int zfs_scan_suspend_progress = 0; /* set to prevent scans from progressing */
+static int zfs_no_scrub_io = B_FALSE; /* set to disable scrub i/o */
+static int zfs_no_scrub_prefetch = B_FALSE; /* set to disable scrub prefetch */
+static const ddt_class_t zfs_scrub_ddt_class_max = DDT_CLASS_DUPLICATE;
 /* max number of blocks to free in a single TXG */
-unsigned long zfs_async_block_max_blocks = 100000;
+static uint64_t zfs_async_block_max_blocks = UINT64_MAX;
+/* max number of dedup blocks to free in a single TXG */
+static uint64_t zfs_max_async_dedup_frees = 100000;
+
+/* set to disable resilver deferring */
+static int zfs_resilver_disable_defer = B_FALSE;
 
 /*
  * We wait a few txgs after importing a pool to begin scanning so that
@@ -194,7 +231,10 @@ unsigned long zfs_async_block_max_blocks = 100000;
 /*
  * Enable/disable the processing of the free_bpobj object.
  */
-int zfs_free_bpobj_enabled = 1;
+static int zfs_free_bpobj_enabled = 1;
+
+/* Error blocks to be scrubbed in one txg. */
+static uint_t zfs_scrub_error_blocks_per_txg = 1 << 12;
 
 /* the order has to match pool_scan_type */
 static scan_cb_t *scan_funcs[POOL_SCAN_FUNCS] = {
@@ -212,9 +252,9 @@ typedef struct {
 
 /*
  * This controls what conditions are placed on dsl_scan_sync_state():
- * SYNC_OPTIONAL) write out scn_phys iff scn_bytes_pending == 0
- * SYNC_MANDATORY) write out scn_phys always. scn_bytes_pending must be 0.
- * SYNC_CACHED) if scn_bytes_pending == 0, write out scn_phys. Otherwise
+ * SYNC_OPTIONAL) write out scn_phys iff scn_queues_pending == 0
+ * SYNC_MANDATORY) write out scn_phys always. scn_queues_pending must be 0.
+ * SYNC_CACHED) if scn_queues_pending == 0, write out scn_phys. Otherwise
  *     write out the scn_phys_cached version.
  * See dsl_scan_sync_state for details.
  */
@@ -232,32 +272,54 @@ typedef enum {
  */
 typedef struct scan_io {
        /* fields from blkptr_t */
-       uint64_t                sio_offset;
        uint64_t                sio_blk_prop;
        uint64_t                sio_phys_birth;
        uint64_t                sio_birth;
        zio_cksum_t             sio_cksum;
-       uint32_t                sio_asize;
+       uint32_t                sio_nr_dvas;
 
        /* fields from zio_t */
-       int                     sio_flags;
+       uint32_t                sio_flags;
        zbookmark_phys_t        sio_zb;
 
        /* members for queue sorting */
        union {
-               avl_node_t      sio_addr_node; /* link into issueing queue */
+               avl_node_t      sio_addr_node; /* link into issuing queue */
                list_node_t     sio_list_node; /* link for issuing to disk */
        } sio_nodes;
+
+       /*
+        * There may be up to SPA_DVAS_PER_BP DVAs here from the bp,
+        * depending on how many were in the original bp. Only the
+        * first DVA is really used for sorting and issuing purposes.
+        * The other DVAs (if provided) simply exist so that the zio
+        * layer can find additional copies to repair from in the
+        * event of an error. This array must go at the end of the
+        * struct to allow this for the variable number of elements.
+        */
+       dva_t                   sio_dva[];
 } scan_io_t;
 
+#define        SIO_SET_OFFSET(sio, x)          DVA_SET_OFFSET(&(sio)->sio_dva[0], x)
+#define        SIO_SET_ASIZE(sio, x)           DVA_SET_ASIZE(&(sio)->sio_dva[0], x)
+#define        SIO_GET_OFFSET(sio)             DVA_GET_OFFSET(&(sio)->sio_dva[0])
+#define        SIO_GET_ASIZE(sio)              DVA_GET_ASIZE(&(sio)->sio_dva[0])
+#define        SIO_GET_END_OFFSET(sio)         \
+       (SIO_GET_OFFSET(sio) + SIO_GET_ASIZE(sio))
+#define        SIO_GET_MUSED(sio)              \
+       (sizeof (scan_io_t) + ((sio)->sio_nr_dvas * sizeof (dva_t)))
+
 struct dsl_scan_io_queue {
        dsl_scan_t      *q_scn; /* associated dsl_scan_t */
        vdev_t          *q_vd; /* top-level vdev that this queue represents */
+       zio_t           *q_zio; /* scn_zio_root child for waiting on IO */
 
        /* trees used for sorting I/Os and extents of I/Os */
        range_tree_t    *q_exts_by_addr;
-       avl_tree_t      q_exts_by_size;
+       zfs_btree_t     q_exts_by_size;
        avl_tree_t      q_sios_by_addr;
+       uint64_t        q_sio_memused;
+       uint64_t        q_last_ext_addr;
 
        /* members for zio rate limiting */
        uint64_t        q_maxinflight_bytes;
@@ -273,7 +335,7 @@ struct dsl_scan_io_queue {
 
 /* private data for dsl_scan_prefetch_cb() */
 typedef struct scan_prefetch_ctx {
-       refcount_t spc_refcnt;          /* refcount for memory management */
+       zfs_refcount_t spc_refcnt;      /* refcount for memory management */
        dsl_scan_t *spc_scn;            /* dsl_scan_t for the pool */
        boolean_t spc_root;             /* is this prefetch for an objset? */
        uint8_t spc_indblkshift;        /* dn_indblkshift of current dnode */
@@ -296,7 +358,27 @@ static void scan_io_queue_insert_impl(dsl_scan_io_queue_t *queue,
 static dsl_scan_io_queue_t *scan_io_queue_create(vdev_t *vd);
 static void scan_io_queues_destroy(dsl_scan_t *scn);
 
-static kmem_cache_t *sio_cache;
+static kmem_cache_t *sio_cache[SPA_DVAS_PER_BP];
+
+/* sio->sio_nr_dvas must be set so we know which cache to free from */
+static void
+sio_free(scan_io_t *sio)
+{
+       ASSERT3U(sio->sio_nr_dvas, >, 0);
+       ASSERT3U(sio->sio_nr_dvas, <=, SPA_DVAS_PER_BP);
+
+       kmem_cache_free(sio_cache[sio->sio_nr_dvas - 1], sio);
+}
+
+/* It is up to the caller to set sio->sio_nr_dvas for freeing */
+static scan_io_t *
+sio_alloc(unsigned short nr_dvas)
+{
+       ASSERT3U(nr_dvas, >, 0);
+       ASSERT3U(nr_dvas, <=, SPA_DVAS_PER_BP);
+
+       return (kmem_cache_alloc(sio_cache[nr_dvas - 1], KM_SLEEP));
+}
 
 void
 scan_init(void)
@@ -311,14 +393,22 @@ scan_init(void)
         */
        fill_weight = zfs_scan_fill_weight;
 
-       sio_cache = kmem_cache_create("sio_cache",
-           sizeof (scan_io_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
+       for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
+               char name[36];
+
+               (void) snprintf(name, sizeof (name), "sio_cache_%d", i);
+               sio_cache[i] = kmem_cache_create(name,
+                   (sizeof (scan_io_t) + ((i + 1) * sizeof (dva_t))),
+                   0, NULL, NULL, NULL, NULL, NULL, 0);
+       }
 }
 
 void
 scan_fini(void)
 {
-       kmem_cache_destroy(sio_cache);
+       for (int i = 0; i < SPA_DVAS_PER_BP; i++) {
+               kmem_cache_destroy(sio_cache[i]);
+       }
 }
 
 static inline boolean_t
@@ -335,29 +425,39 @@ dsl_scan_resilvering(dsl_pool_t *dp)
 }
 
 static inline void
-sio2bp(const scan_io_t *sio, blkptr_t *bp, uint64_t vdev_id)
+sio2bp(const scan_io_t *sio, blkptr_t *bp)
 {
-       bzero(bp, sizeof (*bp));
-       DVA_SET_ASIZE(&bp->blk_dva[0], sio->sio_asize);
-       DVA_SET_VDEV(&bp->blk_dva[0], vdev_id);
-       DVA_SET_OFFSET(&bp->blk_dva[0], sio->sio_offset);
+       memset(bp, 0, sizeof (*bp));
        bp->blk_prop = sio->sio_blk_prop;
        bp->blk_phys_birth = sio->sio_phys_birth;
        bp->blk_birth = sio->sio_birth;
        bp->blk_fill = 1;       /* we always only work with data pointers */
        bp->blk_cksum = sio->sio_cksum;
+
+       ASSERT3U(sio->sio_nr_dvas, >, 0);
+       ASSERT3U(sio->sio_nr_dvas, <=, SPA_DVAS_PER_BP);
+
+       memcpy(bp->blk_dva, sio->sio_dva, sio->sio_nr_dvas * sizeof (dva_t));
 }
 
 static inline void
 bp2sio(const blkptr_t *bp, scan_io_t *sio, int dva_i)
 {
-       /* we discard the vdev id, since we can deduce it from the queue */
-       sio->sio_offset = DVA_GET_OFFSET(&bp->blk_dva[dva_i]);
-       sio->sio_asize = DVA_GET_ASIZE(&bp->blk_dva[dva_i]);
        sio->sio_blk_prop = bp->blk_prop;
        sio->sio_phys_birth = bp->blk_phys_birth;
        sio->sio_birth = bp->blk_birth;
        sio->sio_cksum = bp->blk_cksum;
+       sio->sio_nr_dvas = BP_GET_NDVAS(bp);
+
+       /*
+        * Copy the DVAs to the sio. We need all copies of the block so
+        * that the self healing code can use the alternate copies if the
+        * first is corrupted. We want the DVA at index dva_i to be first
+        * in the sio since this is the primary one that we want to issue.
+        */
+       for (int i = 0, j = dva_i; i < sio->sio_nr_dvas; i++, j++) {
+               sio->sio_dva[i] = bp->blk_dva[j % sio->sio_nr_dvas];
+       }
 }
 
 int
@@ -382,13 +482,13 @@ dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
 
        /*
         * Calculate the max number of in-flight bytes for pool-wide
-        * scanning operations (minimum 1MB). Limits for the issuing
-        * phase are done per top-level vdev and are handled separately.
+        * scanning operations (minimum 1MB, maximum 1/4 of arc_c_max).
+        * Limits for the issuing phase are done per top-level vdev and
+        * are handled separately.
         */
-       scn->scn_maxinflight_bytes = MAX(zfs_scan_vdev_limit *
-           dsl_scan_count_leaves(spa->spa_root_vdev), 1ULL << 20);
+       scn->scn_maxinflight_bytes = MIN(arc_c_max / 4, MAX(1ULL << 20,
+           zfs_scan_vdev_limit * dsl_scan_count_data_disks(spa)));
 
-       bcopy(&scn->scn_phys, &scn->scn_phys_cached, sizeof (scn->scn_phys));
        avl_create(&scn->scn_queue, scan_ds_queue_compare, sizeof (scan_ds_t),
            offsetof(scan_ds_t, sds_node));
        avl_create(&scn->scn_prefetch_queue, scan_prefetch_queue_compare,
@@ -403,8 +503,9 @@ dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
                 * new-style scrub from the beginning.
                 */
                scn->scn_restart_txg = txg;
-               zfs_dbgmsg("old-style scrub was in progress; "
+               zfs_dbgmsg("old-style scrub was in progress for %s; "
                    "restarting new-style scrub in txg %llu",
+                   spa->spa_name,
                    (longlong_t)scn->scn_restart_txg);
 
                /*
@@ -415,9 +516,17 @@ dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
                    "scrub_queue", sizeof (uint64_t), 1,
                    &scn->scn_phys.scn_queue_obj);
        } else {
+               err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
+                   DMU_POOL_ERRORSCRUB, sizeof (uint64_t),
+                   ERRORSCRUB_PHYS_NUMINTS, &scn->errorscrub_phys);
+
+               if (err != 0 && err != ENOENT)
+                       return (err);
+
                err = zap_lookup(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
                    DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
                    &scn->scn_phys);
+
                /*
                 * Detect if the pool contains the signature of #2094.  If it
                 * does properly update the scn->scn_phys structure and notify
@@ -442,7 +551,7 @@ dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
                                        return (EOVERFLOW);
                                }
 
-                               bcopy(zaptmp, &scn->scn_phys,
+                               memcpy(&scn->scn_phys, zaptmp,
                                    SCAN_PHYS_NUMINTS * sizeof (uint64_t));
                                scn->scn_phys.scn_flags = overflow;
 
@@ -464,7 +573,8 @@ dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
                 * counter to how far we've scanned. We know we're consistent
                 * up to here.
                 */
-               scn->scn_issued_before_pass = scn->scn_phys.scn_examined;
+               scn->scn_issued_before_pass = scn->scn_phys.scn_examined -
+                   scn->scn_phys.scn_skipped;
 
                if (dsl_scan_is_running(scn) &&
                    spa_prev_software_version(dp->dp_spa) < SPA_VERSION_SCAN) {
@@ -476,12 +586,33 @@ dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
                         * the meantime.
                         */
                        scn->scn_restart_txg = txg;
-                       zfs_dbgmsg("new-style scrub was modified "
+                       zfs_dbgmsg("new-style scrub for %s was modified "
                            "by old software; restarting in txg %llu",
+                           spa->spa_name,
                            (longlong_t)scn->scn_restart_txg);
+               } else if (dsl_scan_resilvering(dp)) {
+                       /*
+                        * If a resilver is in progress and there are already
+                        * errors, restart it instead of finishing this scan and
+                        * then restarting it. If there haven't been any errors
+                        * then remember that the incore DTL is valid.
+                        */
+                       if (scn->scn_phys.scn_errors > 0) {
+                               scn->scn_restart_txg = txg;
+                               zfs_dbgmsg("resilver can't excise DTL_MISSING "
+                                   "when finished; restarting on %s in txg "
+                                   "%llu",
+                                   spa->spa_name,
+                                   (u_longlong_t)scn->scn_restart_txg);
+                       } else {
+                               /* it's safe to excise DTL when finished */
+                               spa->spa_scrub_started = B_TRUE;
+                       }
                }
        }
 
+       memcpy(&scn->scn_phys_cached, &scn->scn_phys, sizeof (scn->scn_phys));
+
        /* reload the queue into the in-core state */
        if (scn->scn_phys.scn_queue_obj != 0) {
                zap_cursor_t zc;
@@ -499,6 +630,8 @@ dsl_scan_init(dsl_pool_t *dp, uint64_t txg)
        }
 
        spa_scan_stat_init(spa);
+       vdev_scan_stat_init(spa->spa_root_vdev);
+
        return (0);
 }
 
@@ -510,8 +643,10 @@ dsl_scan_fini(dsl_pool_t *dp)
 
                if (scn->scn_taskq != NULL)
                        taskq_destroy(scn->scn_taskq);
+
                scan_ds_queue_clear(scn);
                avl_destroy(&scn->scn_queue);
+               scan_ds_prefetch_queue_clear(scn);
                avl_destroy(&scn->scn_prefetch_queue);
 
                kmem_free(dp->dp_scan, sizeof (dsl_scan_t));
@@ -526,6 +661,13 @@ dsl_scan_restarting(dsl_scan_t *scn, dmu_tx_t *tx)
            scn->scn_restart_txg <= tx->tx_txg);
 }
 
+boolean_t
+dsl_scan_resilver_scheduled(dsl_pool_t *dp)
+{
+       return ((dp->dp_scan && dp->dp_scan->scn_restart_txg != 0) ||
+           (spa_async_tasks(dp->dp_spa) & SPA_ASYNC_RESILVER));
+}
+
 boolean_t
 dsl_scan_scrubbing(const dsl_pool_t *dp)
 {
@@ -535,6 +677,22 @@ dsl_scan_scrubbing(const dsl_pool_t *dp)
            scn_phys->scn_func == POOL_SCAN_SCRUB);
 }
 
+boolean_t
+dsl_errorscrubbing(const dsl_pool_t *dp)
+{
+       dsl_errorscrub_phys_t *errorscrub_phys = &dp->dp_scan->errorscrub_phys;
+
+       return (errorscrub_phys->dep_state == DSS_ERRORSCRUBBING &&
+           errorscrub_phys->dep_func == POOL_SCAN_ERRORSCRUB);
+}
+
+boolean_t
+dsl_errorscrub_is_paused(const dsl_scan_t *scn)
+{
+       return (dsl_errorscrubbing(scn->scn_dp) &&
+           scn->errorscrub_phys.dep_paused_flags);
+}
+
 boolean_t
 dsl_scan_is_paused_scrub(const dsl_scan_t *scn)
 {
@@ -542,12 +700,74 @@ dsl_scan_is_paused_scrub(const dsl_scan_t *scn)
            scn->scn_phys.scn_flags & DSF_SCRUB_PAUSED);
 }
 
+static void
+dsl_errorscrub_sync_state(dsl_scan_t *scn, dmu_tx_t *tx)
+{
+       scn->errorscrub_phys.dep_cursor =
+           zap_cursor_serialize(&scn->errorscrub_cursor);
+
+       VERIFY0(zap_update(scn->scn_dp->dp_meta_objset,
+           DMU_POOL_DIRECTORY_OBJECT,
+           DMU_POOL_ERRORSCRUB, sizeof (uint64_t), ERRORSCRUB_PHYS_NUMINTS,
+           &scn->errorscrub_phys, tx));
+}
+
+static void
+dsl_errorscrub_setup_sync(void *arg, dmu_tx_t *tx)
+{
+       dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
+       pool_scan_func_t *funcp = arg;
+       dsl_pool_t *dp = scn->scn_dp;
+       spa_t *spa = dp->dp_spa;
+
+       ASSERT(!dsl_scan_is_running(scn));
+       ASSERT(!dsl_errorscrubbing(scn->scn_dp));
+       ASSERT(*funcp > POOL_SCAN_NONE && *funcp < POOL_SCAN_FUNCS);
+
+       memset(&scn->errorscrub_phys, 0, sizeof (scn->errorscrub_phys));
+       scn->errorscrub_phys.dep_func = *funcp;
+       scn->errorscrub_phys.dep_state = DSS_ERRORSCRUBBING;
+       scn->errorscrub_phys.dep_start_time = gethrestime_sec();
+       scn->errorscrub_phys.dep_to_examine = spa_get_last_errlog_size(spa);
+       scn->errorscrub_phys.dep_examined = 0;
+       scn->errorscrub_phys.dep_errors = 0;
+       scn->errorscrub_phys.dep_cursor = 0;
+       zap_cursor_init_serialized(&scn->errorscrub_cursor,
+           spa->spa_meta_objset, spa->spa_errlog_last,
+           scn->errorscrub_phys.dep_cursor);
+
+       vdev_config_dirty(spa->spa_root_vdev);
+       spa_event_notify(spa, NULL, NULL, ESC_ZFS_ERRORSCRUB_START);
+
+       dsl_errorscrub_sync_state(scn, tx);
+
+       spa_history_log_internal(spa, "error scrub setup", tx,
+           "func=%u mintxg=%u maxtxg=%llu",
+           *funcp, 0, (u_longlong_t)tx->tx_txg);
+}
+
+static int
+dsl_errorscrub_setup_check(void *arg, dmu_tx_t *tx)
+{
+       (void) arg;
+       dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
+
+       if (dsl_scan_is_running(scn) || (dsl_errorscrubbing(scn->scn_dp))) {
+               return (SET_ERROR(EBUSY));
+       }
+
+       if (spa_get_last_errlog_size(scn->scn_dp->dp_spa) == 0) {
+               return (ECANCELED);
+       }
+       return (0);
+}
+
 /*
  * Writes out a persistent dsl_scan_phys_t record to the pool directory.
  * Because we can be running in the block sorting algorithm, we do not always
  * want to write out the record, only when it is "safe" to do so. This safety
  * condition is achieved by making sure that the sorting queues are empty
- * (scn_bytes_pending == 0). When this condition is not true, the sync'd state
+ * (scn_queues_pending == 0). When this condition is not true, the sync'd state
  * is inconsistent with how much actual scanning progress has been made. The
  * kind of sync to be performed is specified by the sync_type argument. If the
  * sync is optional, we only sync if the queues are empty. If the sync is
@@ -570,8 +790,8 @@ dsl_scan_sync_state(dsl_scan_t *scn, dmu_tx_t *tx, state_sync_type_t sync_type)
        int i;
        spa_t *spa = scn->scn_dp->dp_spa;
 
-       ASSERT(sync_type != SYNC_MANDATORY || scn->scn_bytes_pending == 0);
-       if (scn->scn_bytes_pending == 0) {
+       ASSERT(sync_type != SYNC_MANDATORY || scn->scn_queues_pending == 0);
+       if (scn->scn_queues_pending == 0) {
                for (i = 0; i < spa->spa_root_vdev->vdev_children; i++) {
                        vdev_t *vd = spa->spa_root_vdev->vdev_child[i];
                        dsl_scan_io_queue_t *q = vd->vdev_scan_io_queue;
@@ -581,7 +801,8 @@ dsl_scan_sync_state(dsl_scan_t *scn, dmu_tx_t *tx, state_sync_type_t sync_type)
 
                        mutex_enter(&vd->vdev_scan_io_queue_lock);
                        ASSERT3P(avl_first(&q->q_sios_by_addr), ==, NULL);
-                       ASSERT3P(avl_first(&q->q_exts_by_size), ==, NULL);
+                       ASSERT3P(zfs_btree_first(&q->q_exts_by_size, NULL), ==,
+                           NULL);
                        ASSERT3P(range_tree_first(q->q_exts_by_addr), ==, NULL);
                        mutex_exit(&vd->vdev_scan_io_queue_lock);
                }
@@ -592,11 +813,12 @@ dsl_scan_sync_state(dsl_scan_t *scn, dmu_tx_t *tx, state_sync_type_t sync_type)
                    DMU_POOL_DIRECTORY_OBJECT,
                    DMU_POOL_SCAN, sizeof (uint64_t), SCAN_PHYS_NUMINTS,
                    &scn->scn_phys, tx));
-               bcopy(&scn->scn_phys, &scn->scn_phys_cached,
+               memcpy(&scn->scn_phys_cached, &scn->scn_phys,
                    sizeof (scn->scn_phys));
 
                if (scn->scn_checkpointing)
-                       zfs_dbgmsg("finish scan checkpoint");
+                       zfs_dbgmsg("finish scan checkpoint for %s",
+                           spa->spa_name);
 
                scn->scn_checkpointing = B_FALSE;
                scn->scn_last_checkpoint = ddi_get_lbolt();
@@ -608,21 +830,24 @@ dsl_scan_sync_state(dsl_scan_t *scn, dmu_tx_t *tx, state_sync_type_t sync_type)
        }
 }
 
-/* ARGSUSED */
-static int
+int
 dsl_scan_setup_check(void *arg, dmu_tx_t *tx)
 {
+       (void) arg;
        dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
+       vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
 
-       if (dsl_scan_is_running(scn))
+       if (dsl_scan_is_running(scn) || vdev_rebuild_active(rvd) ||
+           dsl_errorscrubbing(scn->scn_dp))
                return (SET_ERROR(EBUSY));
 
        return (0);
 }
 
-static void
+void
 dsl_scan_setup_sync(void *arg, dmu_tx_t *tx)
 {
+       (void) arg;
        dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
        pool_scan_func_t *funcp = arg;
        dmu_object_type_t ot = 0;
@@ -631,7 +856,15 @@ dsl_scan_setup_sync(void *arg, dmu_tx_t *tx)
 
        ASSERT(!dsl_scan_is_running(scn));
        ASSERT(*funcp > POOL_SCAN_NONE && *funcp < POOL_SCAN_FUNCS);
-       bzero(&scn->scn_phys, sizeof (scn->scn_phys));
+       memset(&scn->scn_phys, 0, sizeof (scn->scn_phys));
+
+       /*
+        * If we are starting a fresh scrub, we erase the error scrub
+        * information from disk.
+        */
+       memset(&scn->errorscrub_phys, 0, sizeof (scn->errorscrub_phys));
+       dsl_errorscrub_sync_state(scn, tx);
+
        scn->scn_phys.scn_func = *funcp;
        scn->scn_phys.scn_state = DSS_SCANNING;
        scn->scn_phys.scn_min_txg = 0;
@@ -646,6 +879,7 @@ dsl_scan_setup_sync(void *arg, dmu_tx_t *tx)
        scn->scn_last_checkpoint = 0;
        scn->scn_checkpointing = B_FALSE;
        spa_scan_stat_init(spa);
+       vdev_scan_stat_init(spa->spa_root_vdev);
 
        if (DSL_SCAN_IS_SCRUB_RESILVER(scn)) {
                scn->scn_phys.scn_ddt_class_max = zfs_scrub_ddt_class_max;
@@ -655,8 +889,12 @@ dsl_scan_setup_sync(void *arg, dmu_tx_t *tx)
 
                if (vdev_resilver_needed(spa->spa_root_vdev,
                    &scn->scn_phys.scn_min_txg, &scn->scn_phys.scn_max_txg)) {
-                       spa_event_notify(spa, NULL, NULL,
+                       nvlist_t *aux = fnvlist_alloc();
+                       fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE,
+                           "healing");
+                       spa_event_notify(spa, NULL, aux,
                            ESC_ZFS_RESILVER_START);
+                       nvlist_free(aux);
                } else {
                        spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_START);
                }
@@ -670,17 +908,38 @@ dsl_scan_setup_sync(void *arg, dmu_tx_t *tx)
                if (scn->scn_phys.scn_min_txg > TXG_INITIAL)
                        scn->scn_phys.scn_ddt_class_max = DDT_CLASS_DITTO;
 
+               /*
+                * When starting a resilver clear any existing rebuild state.
+                * This is required to prevent stale rebuild status from
+                * being reported when a rebuild is run, then a resilver and
+                * finally a scrub.  In which case only the scrub status
+                * should be reported by 'zpool status'.
+                */
+               if (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) {
+                       vdev_t *rvd = spa->spa_root_vdev;
+                       for (uint64_t i = 0; i < rvd->vdev_children; i++) {
+                               vdev_t *vd = rvd->vdev_child[i];
+                               vdev_rebuild_clear_sync(
+                                   (void *)(uintptr_t)vd->vdev_id, tx);
+                       }
+               }
        }
 
        /* back to the generic stuff */
 
-       if (dp->dp_blkstats == NULL) {
-               dp->dp_blkstats =
-                   vmem_alloc(sizeof (zfs_all_blkstats_t), KM_SLEEP);
-               mutex_init(&dp->dp_blkstats->zab_lock, NULL,
-                   MUTEX_DEFAULT, NULL);
+       if (zfs_scan_blkstats) {
+               if (dp->dp_blkstats == NULL) {
+                       dp->dp_blkstats =
+                           vmem_alloc(sizeof (zfs_all_blkstats_t), KM_SLEEP);
+               }
+               memset(&dp->dp_blkstats->zab_type, 0,
+                   sizeof (dp->dp_blkstats->zab_type));
+       } else {
+               if (dp->dp_blkstats) {
+                       vmem_free(dp->dp_blkstats, sizeof (zfs_all_blkstats_t));
+                       dp->dp_blkstats = NULL;
+               }
        }
-       bzero(&dp->dp_blkstats->zab_type, sizeof (dp->dp_blkstats->zab_type));
 
        if (spa_version(spa) < SPA_VERSION_DSL_SCRUB)
                ot = DMU_OT_ZAP_OTHER;
@@ -688,18 +947,20 @@ dsl_scan_setup_sync(void *arg, dmu_tx_t *tx)
        scn->scn_phys.scn_queue_obj = zap_create(dp->dp_meta_objset,
            ot ? ot : DMU_OT_SCAN_QUEUE, DMU_OT_NONE, 0, tx);
 
-       bcopy(&scn->scn_phys, &scn->scn_phys_cached, sizeof (scn->scn_phys));
+       memcpy(&scn->scn_phys_cached, &scn->scn_phys, sizeof (scn->scn_phys));
 
        dsl_scan_sync_state(scn, tx, SYNC_MANDATORY);
 
        spa_history_log_internal(spa, "scan setup", tx,
            "func=%u mintxg=%llu maxtxg=%llu",
-           *funcp, scn->scn_phys.scn_min_txg, scn->scn_phys.scn_max_txg);
+           *funcp, (u_longlong_t)scn->scn_phys.scn_min_txg,
+           (u_longlong_t)scn->scn_phys.scn_max_txg);
 }
 
 /*
- * Called by the ZFS_IOC_POOL_SCAN ioctl to start a scrub or resilver.
- * Can also be called to resume a paused scrub.
+ * Called by ZFS_IOC_POOL_SCRUB and ZFS_IOC_POOL_SCAN ioctl to start a scrub,
+ * error scrub or resilver. Can also be called to resume a paused scrub or
+ * error scrub.
  */
 int
 dsl_scan(dsl_pool_t *dp, pool_scan_func_t func)
@@ -720,15 +981,39 @@ dsl_scan(dsl_pool_t *dp, pool_scan_func_t func)
        spa->spa_scrub_reopen = B_FALSE;
        (void) spa_vdev_state_exit(spa, NULL, 0);
 
+       if (func == POOL_SCAN_RESILVER) {
+               dsl_scan_restart_resilver(spa->spa_dsl_pool, 0);
+               return (0);
+       }
+
+       if (func == POOL_SCAN_ERRORSCRUB) {
+               if (dsl_errorscrub_is_paused(dp->dp_scan)) {
+                       /*
+                        * got error scrub start cmd, resume paused error scrub.
+                        */
+                       int err = dsl_scrub_set_pause_resume(scn->scn_dp,
+                           POOL_SCRUB_NORMAL);
+                       if (err == 0) {
+                               spa_event_notify(spa, NULL, NULL,
+                                   ESC_ZFS_ERRORSCRUB_RESUME);
+                               return (ECANCELED);
+                       }
+                       return (SET_ERROR(err));
+               }
+
+               return (dsl_sync_task(spa_name(dp->dp_spa),
+                   dsl_errorscrub_setup_check, dsl_errorscrub_setup_sync,
+                   &func, 0, ZFS_SPACE_CHECK_RESERVED));
+       }
+
        if (func == POOL_SCAN_SCRUB && dsl_scan_is_paused_scrub(scn)) {
                /* got scrub start cmd, resume paused scrub */
                int err = dsl_scrub_set_pause_resume(scn->scn_dp,
                    POOL_SCRUB_NORMAL);
                if (err == 0) {
                        spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_RESUME);
-                       return (ECANCELED);
+                       return (SET_ERROR(ECANCELED));
                }
-
                return (SET_ERROR(err));
        }
 
@@ -736,7 +1021,33 @@ dsl_scan(dsl_pool_t *dp, pool_scan_func_t func)
            dsl_scan_setup_sync, &func, 0, ZFS_SPACE_CHECK_EXTRA_RESERVED));
 }
 
-/* ARGSUSED */
+static void
+dsl_errorscrub_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
+{
+       dsl_pool_t *dp = scn->scn_dp;
+       spa_t *spa = dp->dp_spa;
+
+       if (complete) {
+               spa_event_notify(spa, NULL, NULL, ESC_ZFS_ERRORSCRUB_FINISH);
+               spa_history_log_internal(spa, "error scrub done", tx,
+                   "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
+       } else {
+               spa_history_log_internal(spa, "error scrub canceled", tx,
+                   "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
+       }
+
+       scn->errorscrub_phys.dep_state = complete ? DSS_FINISHED : DSS_CANCELED;
+       spa->spa_scrub_active = B_FALSE;
+       spa_errlog_rotate(spa);
+       scn->errorscrub_phys.dep_end_time = gethrestime_sec();
+       zap_cursor_fini(&scn->errorscrub_cursor);
+
+       if (spa->spa_errata == ZPOOL_ERRATA_ZOL_2094_SCRUB)
+               spa->spa_errata = 0;
+
+       ASSERT(!dsl_errorscrubbing(scn->scn_dp));
+}
+
 static void
 dsl_scan_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
 {
@@ -768,6 +1079,7 @@ dsl_scan_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
                scn->scn_phys.scn_queue_obj = 0;
        }
        scan_ds_queue_clear(scn);
+       scan_ds_prefetch_queue_clear(scn);
 
        scn->scn_phys.scn_flags &= ~DSF_SCRUB_PAUSED;
 
@@ -792,18 +1104,19 @@ dsl_scan_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
 
        scn->scn_phys.scn_state = complete ? DSS_FINISHED : DSS_CANCELED;
 
+       spa_notify_waiters(spa);
+
        if (dsl_scan_restarting(scn, tx))
                spa_history_log_internal(spa, "scan aborted, restarting", tx,
-                   "errors=%llu", spa_get_errlog_size(spa));
+                   "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
        else if (!complete)
                spa_history_log_internal(spa, "scan cancelled", tx,
-                   "errors=%llu", spa_get_errlog_size(spa));
+                   "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
        else
                spa_history_log_internal(spa, "scan done", tx,
-                   "errors=%llu", spa_get_errlog_size(spa));
+                   "errors=%llu", (u_longlong_t)spa_approx_errlog_size(spa));
 
        if (DSL_SCAN_IS_SCRUB_RESILVER(scn)) {
-               spa->spa_scrub_started = B_FALSE;
                spa->spa_scrub_active = B_FALSE;
 
                /*
@@ -819,22 +1132,58 @@ dsl_scan_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
                if (complete &&
                    !spa_feature_is_active(spa, SPA_FEATURE_POOL_CHECKPOINT)) {
                        vdev_dtl_reassess(spa->spa_root_vdev, tx->tx_txg,
-                           scn->scn_phys.scn_max_txg, B_TRUE);
-
-                       spa_event_notify(spa, NULL, NULL,
-                           scn->scn_phys.scn_min_txg ?
-                           ESC_ZFS_RESILVER_FINISH : ESC_ZFS_SCRUB_FINISH);
+                           scn->scn_phys.scn_max_txg, B_TRUE, B_FALSE);
+
+                       if (scn->scn_phys.scn_min_txg) {
+                               nvlist_t *aux = fnvlist_alloc();
+                               fnvlist_add_string(aux, ZFS_EV_RESILVER_TYPE,
+                                   "healing");
+                               spa_event_notify(spa, NULL, aux,
+                                   ESC_ZFS_RESILVER_FINISH);
+                               nvlist_free(aux);
+                       } else {
+                               spa_event_notify(spa, NULL, NULL,
+                                   ESC_ZFS_SCRUB_FINISH);
+                       }
                } else {
                        vdev_dtl_reassess(spa->spa_root_vdev, tx->tx_txg,
-                           0, B_TRUE);
+                           0, B_TRUE, B_FALSE);
                }
                spa_errlog_rotate(spa);
 
+               /*
+                * Don't clear flag until after vdev_dtl_reassess to ensure that
+                * DTL_MISSING will get updated when possible.
+                */
+               spa->spa_scrub_started = B_FALSE;
+
                /*
                 * We may have finished replacing a device.
                 * Let the async thread assess this and handle the detach.
                 */
                spa_async_request(spa, SPA_ASYNC_RESILVER_DONE);
+
+               /*
+                * Clear any resilver_deferred flags in the config.
+                * If there are drives that need resilvering, kick
+                * off an asynchronous request to start resilver.
+                * vdev_clear_resilver_deferred() may update the config
+                * before the resilver can restart. In the event of
+                * a crash during this period, the spa loading code
+                * will find the drives that need to be resilvered
+                * and start the resilver then.
+                */
+               if (spa_feature_is_enabled(spa, SPA_FEATURE_RESILVER_DEFER) &&
+                   vdev_clear_resilver_deferred(spa->spa_root_vdev, tx)) {
+                       spa_history_log_internal(spa,
+                           "starting deferred resilver", tx, "errors=%llu",
+                           (u_longlong_t)spa_approx_errlog_size(spa));
+                       spa_async_request(spa, SPA_ASYNC_RESILVER);
+               }
+
+               /* Clear recent error events (i.e. duplicate events tracking) */
+               if (complete)
+                       zfs_ereport_clear(spa, NULL);
        }
 
        scn->scn_phys.scn_end_time = gethrestime_sec();
@@ -845,10 +1194,96 @@ dsl_scan_done(dsl_scan_t *scn, boolean_t complete, dmu_tx_t *tx)
        ASSERT(!dsl_scan_is_running(scn));
 }
 
-/* ARGSUSED */
+static int
+dsl_errorscrub_pause_resume_check(void *arg, dmu_tx_t *tx)
+{
+       pool_scrub_cmd_t *cmd = arg;
+       dsl_pool_t *dp = dmu_tx_pool(tx);
+       dsl_scan_t *scn = dp->dp_scan;
+
+       if (*cmd == POOL_SCRUB_PAUSE) {
+               /*
+                * can't pause a error scrub when there is no in-progress
+                * error scrub.
+                */
+               if (!dsl_errorscrubbing(dp))
+                       return (SET_ERROR(ENOENT));
+
+               /* can't pause a paused error scrub */
+               if (dsl_errorscrub_is_paused(scn))
+                       return (SET_ERROR(EBUSY));
+       } else if (*cmd != POOL_SCRUB_NORMAL) {
+               return (SET_ERROR(ENOTSUP));
+       }
+
+       return (0);
+}
+
+static void
+dsl_errorscrub_pause_resume_sync(void *arg, dmu_tx_t *tx)
+{
+       pool_scrub_cmd_t *cmd = arg;
+       dsl_pool_t *dp = dmu_tx_pool(tx);
+       spa_t *spa = dp->dp_spa;
+       dsl_scan_t *scn = dp->dp_scan;
+
+       if (*cmd == POOL_SCRUB_PAUSE) {
+               spa->spa_scan_pass_errorscrub_pause = gethrestime_sec();
+               scn->errorscrub_phys.dep_paused_flags = B_TRUE;
+               dsl_errorscrub_sync_state(scn, tx);
+               spa_event_notify(spa, NULL, NULL, ESC_ZFS_ERRORSCRUB_PAUSED);
+       } else {
+               ASSERT3U(*cmd, ==, POOL_SCRUB_NORMAL);
+               if (dsl_errorscrub_is_paused(scn)) {
+                       /*
+                        * We need to keep track of how much time we spend
+                        * paused per pass so that we can adjust the error scrub
+                        * rate shown in the output of 'zpool status'.
+                        */
+                       spa->spa_scan_pass_errorscrub_spent_paused +=
+                           gethrestime_sec() -
+                           spa->spa_scan_pass_errorscrub_pause;
+
+                       spa->spa_scan_pass_errorscrub_pause = 0;
+                       scn->errorscrub_phys.dep_paused_flags = B_FALSE;
+
+                       zap_cursor_init_serialized(
+                           &scn->errorscrub_cursor,
+                           spa->spa_meta_objset, spa->spa_errlog_last,
+                           scn->errorscrub_phys.dep_cursor);
+
+                       dsl_errorscrub_sync_state(scn, tx);
+               }
+       }
+}
+
+static int
+dsl_errorscrub_cancel_check(void *arg, dmu_tx_t *tx)
+{
+       (void) arg;
+       dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
+       /* can't cancel a error scrub when there is no one in-progress */
+       if (!dsl_errorscrubbing(scn->scn_dp))
+               return (SET_ERROR(ENOENT));
+       return (0);
+}
+
+static void
+dsl_errorscrub_cancel_sync(void *arg, dmu_tx_t *tx)
+{
+       (void) arg;
+       dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
+
+       dsl_errorscrub_done(scn, B_FALSE, tx);
+       dsl_errorscrub_sync_state(scn, tx);
+       spa_event_notify(scn->scn_dp->dp_spa, NULL, NULL,
+           ESC_ZFS_ERRORSCRUB_ABORT);
+}
+
 static int
 dsl_scan_cancel_check(void *arg, dmu_tx_t *tx)
 {
+       (void) arg;
        dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
 
        if (!dsl_scan_is_running(scn))
@@ -856,10 +1291,10 @@ dsl_scan_cancel_check(void *arg, dmu_tx_t *tx)
        return (0);
 }
 
-/* ARGSUSED */
 static void
 dsl_scan_cancel_sync(void *arg, dmu_tx_t *tx)
 {
+       (void) arg;
        dsl_scan_t *scn = dmu_tx_pool(tx)->dp_scan;
 
        dsl_scan_done(scn, B_FALSE, tx);
@@ -870,6 +1305,11 @@ dsl_scan_cancel_sync(void *arg, dmu_tx_t *tx)
 int
 dsl_scan_cancel(dsl_pool_t *dp)
 {
+       if (dsl_errorscrubbing(dp)) {
+               return (dsl_sync_task(spa_name(dp->dp_spa),
+                   dsl_errorscrub_cancel_check, dsl_errorscrub_cancel_sync,
+                   NULL, 3, ZFS_SPACE_CHECK_RESERVED));
+       }
        return (dsl_sync_task(spa_name(dp->dp_spa), dsl_scan_cancel_check,
            dsl_scan_cancel_sync, NULL, 3, ZFS_SPACE_CHECK_RESERVED));
 }
@@ -908,8 +1348,10 @@ dsl_scrub_pause_resume_sync(void *arg, dmu_tx_t *tx)
                /* can't pause a scrub when there is no in-progress scrub */
                spa->spa_scan_pass_scrub_pause = gethrestime_sec();
                scn->scn_phys.scn_flags |= DSF_SCRUB_PAUSED;
+               scn->scn_phys_cached.scn_flags |= DSF_SCRUB_PAUSED;
                dsl_scan_sync_state(scn, tx, SYNC_CACHED);
                spa_event_notify(spa, NULL, NULL, ESC_ZFS_SCRUB_PAUSED);
+               spa_notify_waiters(spa);
        } else {
                ASSERT3U(*cmd, ==, POOL_SCRUB_NORMAL);
                if (dsl_scan_is_paused_scrub(scn)) {
@@ -922,6 +1364,7 @@ dsl_scrub_pause_resume_sync(void *arg, dmu_tx_t *tx)
                            gethrestime_sec() - spa->spa_scan_pass_scrub_pause;
                        spa->spa_scan_pass_scrub_pause = 0;
                        scn->scn_phys.scn_flags &= ~DSF_SCRUB_PAUSED;
+                       scn->scn_phys_cached.scn_flags &= ~DSF_SCRUB_PAUSED;
                        dsl_scan_sync_state(scn, tx, SYNC_CACHED);
                }
        }
@@ -933,6 +1376,12 @@ dsl_scrub_pause_resume_sync(void *arg, dmu_tx_t *tx)
 int
 dsl_scrub_set_pause_resume(const dsl_pool_t *dp, pool_scrub_cmd_t cmd)
 {
+       if (dsl_errorscrubbing(dp)) {
+               return (dsl_sync_task(spa_name(dp->dp_spa),
+                   dsl_errorscrub_pause_resume_check,
+                   dsl_errorscrub_pause_resume_sync, &cmd, 3,
+                   ZFS_SPACE_CHECK_RESERVED));
+       }
        return (dsl_sync_task(spa_name(dp->dp_spa),
            dsl_scrub_pause_resume_check, dsl_scrub_pause_resume_sync, &cmd, 3,
            ZFS_SPACE_CHECK_RESERVED));
@@ -941,7 +1390,7 @@ dsl_scrub_set_pause_resume(const dsl_pool_t *dp, pool_scrub_cmd_t cmd)
 
 /* start a new scan, or restart an existing one. */
 void
-dsl_resilver_restart(dsl_pool_t *dp, uint64_t txg)
+dsl_scan_restart_resilver(dsl_pool_t *dp, uint64_t txg)
 {
        if (txg == 0) {
                dmu_tx_t *tx;
@@ -954,7 +1403,8 @@ dsl_resilver_restart(dsl_pool_t *dp, uint64_t txg)
        } else {
                dp->dp_scan->scn_restart_txg = txg;
        }
-       zfs_dbgmsg("restarting resilver txg=%llu", (longlong_t)txg);
+       zfs_dbgmsg("restarting resilver for %s at txg=%llu",
+           dp->dp_spa->spa_name, (longlong_t)txg);
 }
 
 void
@@ -1039,7 +1489,7 @@ scan_ds_queue_sync(dsl_scan_t *scn, dmu_tx_t *tx)
        dmu_object_type_t ot = (spa_version(spa) >= SPA_VERSION_DSL_SCRUB) ?
            DMU_OT_SCAN_QUEUE : DMU_OT_ZAP_OTHER;
 
-       ASSERT0(scn->scn_bytes_pending);
+       ASSERT0(scn->scn_queues_pending);
        ASSERT(scn->scn_phys.scn_queue_obj != 0);
 
        VERIFY0(dmu_object_free(dp->dp_meta_objset,
@@ -1089,10 +1539,13 @@ scan_ds_queue_sync(dsl_scan_t *scn, dmu_tx_t *tx)
 static boolean_t
 dsl_scan_should_clear(dsl_scan_t *scn)
 {
+       spa_t *spa = scn->scn_dp->dp_spa;
        vdev_t *rvd = scn->scn_dp->dp_spa->spa_root_vdev;
-       uint64_t mlim_hard, mlim_soft, mused;
-       uint64_t alloc = metaslab_class_get_alloc(spa_normal_class(
-           scn->scn_dp->dp_spa));
+       uint64_t alloc, mlim_hard, mlim_soft, mused;
+
+       alloc = metaslab_class_get_alloc(spa_normal_class(spa));
+       alloc += metaslab_class_get_alloc(spa_special_class(spa));
+       alloc += metaslab_class_get_alloc(spa_dedup_class(spa));
 
        mlim_hard = MAX((physmem / zfs_scan_mem_lim_fact) * PAGESIZE,
            zfs_scan_mem_lim_min);
@@ -1107,11 +1560,13 @@ dsl_scan_should_clear(dsl_scan_t *scn)
                mutex_enter(&tvd->vdev_scan_io_queue_lock);
                queue = tvd->vdev_scan_io_queue;
                if (queue != NULL) {
-                       /* #extents in exts_by_size = # in exts_by_addr */
-                       mused += avl_numnodes(&queue->q_exts_by_size) *
-                           sizeof (range_seg_t) +
-                           avl_numnodes(&queue->q_sios_by_addr) *
-                           sizeof (scan_io_t);
+                       /*
+                        * # of extents in exts_by_addr = # in exts_by_size.
+                        * B-tree efficiency is ~75%, but can be as low as 50%.
+                        */
+                       mused += zfs_btree_numnodes(&queue->q_exts_by_size) *
+                           ((sizeof (range_seg_gap_t) + sizeof (uint64_t)) *
+                           3 / 2) + queue->q_sio_memused;
                }
                mutex_exit(&tvd->vdev_scan_io_queue_lock);
        }
@@ -1119,7 +1574,7 @@ dsl_scan_should_clear(dsl_scan_t *scn)
        dprintf("current scan memory usage: %llu bytes\n", (longlong_t)mused);
 
        if (mused == 0)
-               ASSERT0(scn->scn_bytes_pending);
+               ASSERT0(scn->scn_queues_pending);
 
        /*
         * If we are above our hard limit, we need to clear out memory.
@@ -1147,8 +1602,8 @@ dsl_scan_check_suspend(dsl_scan_t *scn, const zbookmark_phys_t *zb)
        if (!ZB_IS_ZERO(&scn->scn_phys.scn_bookmark))
                return (B_FALSE); /* we're resuming */
 
-       /* We only know how to resume from level-0 blocks. */
-       if (zb && zb->zb_level != 0)
+       /* We only know how to resume from level-0 and objset blocks. */
+       if (zb && (zb->zb_level != 0 && zb->zb_level != ZB_ROOT_LEVEL))
                return (B_FALSE);
 
        /*
@@ -1169,17 +1624,27 @@ dsl_scan_check_suspend(dsl_scan_t *scn, const zbookmark_phys_t *zb)
        uint64_t scan_time_ns = curr_time_ns - scn->scn_sync_start_time;
        uint64_t sync_time_ns = curr_time_ns -
            scn->scn_dp->dp_spa->spa_sync_starttime;
-       int dirty_pct = scn->scn_dp->dp_dirty_total * 100 / zfs_dirty_data_max;
-       int mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
+       uint64_t dirty_min_bytes = zfs_dirty_data_max *
+           zfs_vdev_async_write_active_min_dirty_percent / 100;
+       uint_t mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
            zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;
 
        if ((NSEC2MSEC(scan_time_ns) > mintime &&
-           (dirty_pct >= zfs_vdev_async_write_active_min_dirty_percent ||
+           (scn->scn_dp->dp_dirty_total >= dirty_min_bytes ||
            txg_sync_waiting(scn->scn_dp) ||
            NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) ||
            spa_shutting_down(scn->scn_dp->dp_spa) ||
            (zfs_scan_strict_mem_lim && dsl_scan_should_clear(scn))) {
-               if (zb) {
+               if (zb && zb->zb_level == ZB_ROOT_LEVEL) {
+                       dprintf("suspending at first available bookmark "
+                           "%llx/%llx/%llx/%llx\n",
+                           (longlong_t)zb->zb_objset,
+                           (longlong_t)zb->zb_object,
+                           (longlong_t)zb->zb_level,
+                           (longlong_t)zb->zb_blkid);
+                       SET_BOOKMARK(&scn->scn_phys.scn_bookmark,
+                           zb->zb_objset, 0, 0, 0);
+               } else if (zb != NULL) {
                        dprintf("suspending at bookmark %llx/%llx/%llx/%llx\n",
                            (longlong_t)zb->zb_objset,
                            (longlong_t)zb->zb_object,
@@ -1203,21 +1668,59 @@ dsl_scan_check_suspend(dsl_scan_t *scn, const zbookmark_phys_t *zb)
        return (B_FALSE);
 }
 
+static boolean_t
+dsl_error_scrub_check_suspend(dsl_scan_t *scn, const zbookmark_phys_t *zb)
+{
+       /*
+        * We suspend if:
+        *  - we have scrubbed for at least the minimum time (default 1 sec
+        *    for error scrub), someone is explicitly waiting for this txg
+        *    to complete, or we have used up all of the time in the txg
+        *    timeout (default 5 sec).
+        *  or
+        *  - the spa is shutting down because this pool is being exported
+        *    or the machine is rebooting.
+        */
+       uint64_t curr_time_ns = gethrtime();
+       uint64_t error_scrub_time_ns = curr_time_ns - scn->scn_sync_start_time;
+       uint64_t sync_time_ns = curr_time_ns -
+           scn->scn_dp->dp_spa->spa_sync_starttime;
+       int mintime = zfs_scrub_min_time_ms;
+
+       if ((NSEC2MSEC(error_scrub_time_ns) > mintime &&
+           (txg_sync_waiting(scn->scn_dp) ||
+           NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) ||
+           spa_shutting_down(scn->scn_dp->dp_spa)) {
+               if (zb) {
+                       dprintf("error scrub suspending at bookmark "
+                           "%llx/%llx/%llx/%llx\n",
+                           (longlong_t)zb->zb_objset,
+                           (longlong_t)zb->zb_object,
+                           (longlong_t)zb->zb_level,
+                           (longlong_t)zb->zb_blkid);
+               }
+               return (B_TRUE);
+       }
+       return (B_FALSE);
+}
+
 typedef struct zil_scan_arg {
        dsl_pool_t      *zsa_dp;
        zil_header_t    *zsa_zh;
 } zil_scan_arg_t;
 
-/* ARGSUSED */
 static int
-dsl_scan_zil_block(zilog_t *zilog, blkptr_t *bp, void *arg, uint64_t claim_txg)
+dsl_scan_zil_block(zilog_t *zilog, const blkptr_t *bp, void *arg,
+    uint64_t claim_txg)
 {
+       (void) zilog;
        zil_scan_arg_t *zsa = arg;
        dsl_pool_t *dp = zsa->zsa_dp;
        dsl_scan_t *scn = dp->dp_scan;
        zil_header_t *zh = zsa->zsa_zh;
        zbookmark_phys_t zb;
 
+       ASSERT(!BP_IS_REDACTED(bp));
        if (BP_IS_HOLE(bp) || bp->blk_birth <= scn->scn_phys.scn_cur_min_txg)
                return (0);
 
@@ -1237,19 +1740,21 @@ dsl_scan_zil_block(zilog_t *zilog, blkptr_t *bp, void *arg, uint64_t claim_txg)
        return (0);
 }
 
-/* ARGSUSED */
 static int
-dsl_scan_zil_record(zilog_t *zilog, lr_t *lrc, void *arg, uint64_t claim_txg)
+dsl_scan_zil_record(zilog_t *zilog, const lr_t *lrc, void *arg,
+    uint64_t claim_txg)
 {
+       (void) zilog;
        if (lrc->lrc_txtype == TX_WRITE) {
                zil_scan_arg_t *zsa = arg;
                dsl_pool_t *dp = zsa->zsa_dp;
                dsl_scan_t *scn = dp->dp_scan;
                zil_header_t *zh = zsa->zsa_zh;
-               lr_write_t *lr = (lr_write_t *)lrc;
-               blkptr_t *bp = &lr->lr_blkptr;
+               const lr_write_t *lr = (const lr_write_t *)lrc;
+               const blkptr_t *bp = &lr->lr_blkptr;
                zbookmark_phys_t zb;
 
+               ASSERT(!BP_IS_REDACTED(bp));
                if (BP_IS_HOLE(bp) ||
                    bp->blk_birth <= scn->scn_phys.scn_cur_min_txg)
                        return (0);
@@ -1262,6 +1767,7 @@ dsl_scan_zil_record(zilog_t *zilog, lr_t *lrc, void *arg, uint64_t claim_txg)
                if (claim_txg == 0 || bp->blk_birth < claim_txg)
                        return (0);
 
+               ASSERT3U(BP_GET_LSIZE(bp), !=, 0);
                SET_BOOKMARK(&zb, zh->zh_log.blk_cksum.zc_word[ZIL_ZC_OBJSET],
                    lr->lr_foid, ZB_ZIL_LEVEL,
                    lr->lr_offset / BP_GET_LSIZE(bp));
@@ -1312,22 +1818,22 @@ scan_prefetch_queue_compare(const void *a, const void *b)
 }
 
 static void
-scan_prefetch_ctx_rele(scan_prefetch_ctx_t *spc, void *tag)
+scan_prefetch_ctx_rele(scan_prefetch_ctx_t *spc, const void *tag)
 {
-       if (refcount_remove(&spc->spc_refcnt, tag) == 0) {
-               refcount_destroy(&spc->spc_refcnt);
+       if (zfs_refcount_remove(&spc->spc_refcnt, tag) == 0) {
+               zfs_refcount_destroy(&spc->spc_refcnt);
                kmem_free(spc, sizeof (scan_prefetch_ctx_t));
        }
 }
 
 static scan_prefetch_ctx_t *
-scan_prefetch_ctx_create(dsl_scan_t *scn, dnode_phys_t *dnp, void *tag)
+scan_prefetch_ctx_create(dsl_scan_t *scn, dnode_phys_t *dnp, const void *tag)
 {
        scan_prefetch_ctx_t *spc;
 
        spc = kmem_alloc(sizeof (scan_prefetch_ctx_t), KM_SLEEP);
-       refcount_create(&spc->spc_refcnt);
-       refcount_add(&spc->spc_refcnt, tag);
+       zfs_refcount_create(&spc->spc_refcnt);
+       zfs_refcount_add(&spc->spc_refcnt, tag);
        spc->spc_scn = scn;
        if (dnp != NULL) {
                spc->spc_datablkszsec = dnp->dn_datablkszsec;
@@ -1343,9 +1849,25 @@ scan_prefetch_ctx_create(dsl_scan_t *scn, dnode_phys_t *dnp, void *tag)
 }
 
 static void
-scan_prefetch_ctx_add_ref(scan_prefetch_ctx_t *spc, void *tag)
+scan_prefetch_ctx_add_ref(scan_prefetch_ctx_t *spc, const void *tag)
+{
+       zfs_refcount_add(&spc->spc_refcnt, tag);
+}
+
+static void
+scan_ds_prefetch_queue_clear(dsl_scan_t *scn)
 {
-       refcount_add(&spc->spc_refcnt, tag);
+       spa_t *spa = scn->scn_dp->dp_spa;
+       void *cookie = NULL;
+       scan_prefetch_issue_ctx_t *spic = NULL;
+
+       mutex_enter(&spa->spa_scrub_lock);
+       while ((spic = avl_destroy_nodes(&scn->scn_prefetch_queue,
+           &cookie)) != NULL) {
+               scan_prefetch_ctx_rele(spic->spic_spc, scn);
+               kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
+       }
+       mutex_exit(&spa->spa_scrub_lock);
 }
 
 static boolean_t
@@ -1378,7 +1900,7 @@ dsl_scan_prefetch(scan_prefetch_ctx_t *spc, blkptr_t *bp, zbookmark_phys_t *zb)
        spa_t *spa = scn->scn_dp->dp_spa;
        scan_prefetch_issue_ctx_t *spic;
 
-       if (zfs_no_scrub_prefetch)
+       if (zfs_no_scrub_prefetch || BP_IS_REDACTED(bp))
                return;
 
        if (BP_IS_HOLE(bp) || bp->blk_birth <= scn->scn_phys.scn_cur_min_txg ||
@@ -1444,10 +1966,11 @@ dsl_scan_prefetch_dnode(dsl_scan_t *scn, dnode_phys_t *dnp,
        scan_prefetch_ctx_rele(spc, FTAG);
 }
 
-void
+static void
 dsl_scan_prefetch_cb(zio_t *zio, const zbookmark_phys_t *zb, const blkptr_t *bp,
     arc_buf_t *buf, void *private)
 {
+       (void) zio;
        scan_prefetch_ctx_t *spc = private;
        dsl_scan_t *scn = spc->spc_scn;
        spa_t *spa = scn->scn_dp->dp_spa;
@@ -1492,6 +2015,11 @@ dsl_scan_prefetch_cb(zio_t *zio, const zbookmark_phys_t *zb, const blkptr_t *bp,
                    zb->zb_objset, DMU_META_DNODE_OBJECT);
 
                if (OBJSET_BUF_HAS_USERUSED(buf)) {
+                       if (OBJSET_BUF_HAS_PROJECTUSED(buf)) {
+                               dsl_scan_prefetch_dnode(scn,
+                                   &osp->os_projectused_dnode, zb->zb_objset,
+                                   DMU_PROJECTUSED_OBJECT);
+                       }
                        dsl_scan_prefetch_dnode(scn,
                            &osp->os_groupused_dnode, zb->zb_objset,
                            DMU_GROUPUSED_OBJECT);
@@ -1507,7 +2035,6 @@ out:
        scan_prefetch_ctx_rele(spc, scn);
 }
 
-/* ARGSUSED */
 static void
 dsl_scan_prefetch_thread(void *arg)
 {
@@ -1553,10 +2080,16 @@ dsl_scan_prefetch_thread(void *arg)
                        zio_flags |= ZIO_FLAG_RAW;
                }
 
+               /* We don't need data L1 buffer since we do not prefetch L0. */
+               blkptr_t *bp = &spic->spic_bp;
+               if (BP_GET_LEVEL(bp) == 1 && BP_GET_TYPE(bp) != DMU_OT_DNODE &&
+                   BP_GET_TYPE(bp) != DMU_OT_OBJSET)
+                       flags |= ARC_FLAG_NO_BUF;
+
                /* issue the prefetch asynchronously */
-               (void) arc_read(scn->scn_zio_root, scn->scn_dp->dp_spa,
-                   &spic->spic_bp, dsl_scan_prefetch_cb, spic->spic_spc,
-                   ZIO_PRIORITY_SCRUB, zio_flags, &flags, &spic->spic_zb);
+               (void) arc_read(scn->scn_zio_root, spa, bp,
+                   dsl_scan_prefetch_cb, spic->spic_spc, ZIO_PRIORITY_SCRUB,
+                   zio_flags, &flags, &spic->spic_zb);
 
                kmem_free(spic, sizeof (scan_prefetch_issue_ctx_t));
        }
@@ -1593,24 +2126,23 @@ dsl_scan_check_resume(dsl_scan_t *scn, const dnode_phys_t *dnp,
 
                /*
                 * If we found the block we're trying to resume from, or
-                * we went past it to a different object, zero it out to
-                * indicate that it's OK to start checking for suspending
-                * again.
+                * we went past it, zero it out to indicate that it's OK
+                * to start checking for suspending again.
                 */
-               if (bcmp(zb, &scn->scn_phys.scn_bookmark, sizeof (*zb)) == 0 ||
-                   zb->zb_object > scn->scn_phys.scn_bookmark.zb_object) {
+               if (zbookmark_subtree_tbd(dnp, zb,
+                   &scn->scn_phys.scn_bookmark)) {
                        dprintf("resuming at %llx/%llx/%llx/%llx\n",
                            (longlong_t)zb->zb_objset,
                            (longlong_t)zb->zb_object,
                            (longlong_t)zb->zb_level,
                            (longlong_t)zb->zb_blkid);
-                       bzero(&scn->scn_phys.scn_bookmark, sizeof (*zb));
+                       memset(&scn->scn_phys.scn_bookmark, 0, sizeof (*zb));
                }
        }
        return (B_FALSE);
 }
 
-static void dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
+static void dsl_scan_visitbp(const blkptr_t *bp, const zbookmark_phys_t *zb,
     dnode_phys_t *dnp, dsl_dataset_t *ds, dsl_scan_t *scn,
     dmu_objset_type_t ostype, dmu_tx_t *tx);
 inline __attribute__((always_inline)) static void dsl_scan_visitdnode(
@@ -1627,9 +2159,25 @@ dsl_scan_recurse(dsl_scan_t *scn, dsl_dataset_t *ds, dmu_objset_type_t ostype,
     const zbookmark_phys_t *zb, dmu_tx_t *tx)
 {
        dsl_pool_t *dp = scn->scn_dp;
+       spa_t *spa = dp->dp_spa;
        int zio_flags = ZIO_FLAG_CANFAIL | ZIO_FLAG_SCAN_THREAD;
        int err;
 
+       ASSERT(!BP_IS_REDACTED(bp));
+
+       /*
+        * There is an unlikely case of encountering dnodes with contradicting
+        * dn_bonuslen and DNODE_FLAG_SPILL_BLKPTR flag before in files created
+        * or modified before commit 4254acb was merged. As it is not possible
+        * to know which of the two is correct, report an error.
+        */
+       if (dnp != NULL &&
+           dnp->dn_bonuslen > DN_MAX_BONUS_LEN(dnp)) {
+               scn->scn_phys.scn_errors++;
+               spa_log_error(spa, zb, &bp->blk_birth);
+               return (SET_ERROR(EINVAL));
+       }
+
        if (BP_GET_LEVEL(bp) > 0) {
                arc_flags_t flags = ARC_FLAG_WAIT;
                int i;
@@ -1637,7 +2185,7 @@ dsl_scan_recurse(dsl_scan_t *scn, dsl_dataset_t *ds, dmu_objset_type_t ostype,
                int epb = BP_GET_LSIZE(bp) >> SPA_BLKPTRSHIFT;
                arc_buf_t *buf;
 
-               err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
+               err = arc_read(NULL, spa, bp, arc_getbuf_func, &buf,
                    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
                if (err) {
                        scn->scn_phys.scn_errors++;
@@ -1665,7 +2213,7 @@ dsl_scan_recurse(dsl_scan_t *scn, dsl_dataset_t *ds, dmu_objset_type_t ostype,
                        zio_flags |= ZIO_FLAG_RAW;
                }
 
-               err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
+               err = arc_read(NULL, spa, bp, arc_getbuf_func, &buf,
                    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
                if (err) {
                        scn->scn_phys.scn_errors++;
@@ -1684,7 +2232,7 @@ dsl_scan_recurse(dsl_scan_t *scn, dsl_dataset_t *ds, dmu_objset_type_t ostype,
                objset_phys_t *osp;
                arc_buf_t *buf;
 
-               err = arc_read(NULL, dp->dp_spa, bp, arc_getbuf_func, &buf,
+               err = arc_read(NULL, spa, bp, arc_getbuf_func, &buf,
                    ZIO_PRIORITY_SCRUB, zio_flags, &flags, zb);
                if (err) {
                        scn->scn_phys.scn_errors++;
@@ -1715,6 +2263,15 @@ dsl_scan_recurse(dsl_scan_t *scn, dsl_dataset_t *ds, dmu_objset_type_t ostype,
                            DMU_USERUSED_OBJECT, tx);
                }
                arc_buf_destroy(buf, &buf);
+       } else if (!zfs_blkptr_verify(spa, bp,
+           BLK_CONFIG_NEEDED, BLK_VERIFY_LOG)) {
+               /*
+                * Sanity check the block pointer contents, this is handled
+                * by arc_read() for the cases above.
+                */
+               scn->scn_phys.scn_errors++;
+               spa_log_error(spa, zb, &bp->blk_birth);
+               return (SET_ERROR(EINVAL));
        }
 
        return (0);
@@ -1750,12 +2307,11 @@ dsl_scan_visitdnode(dsl_scan_t *scn, dsl_dataset_t *ds,
  * first 5; we want them to be useful.
  */
 static void
-dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
+dsl_scan_visitbp(const blkptr_t *bp, const zbookmark_phys_t *zb,
     dnode_phys_t *dnp, dsl_dataset_t *ds, dsl_scan_t *scn,
     dmu_objset_type_t ostype, dmu_tx_t *tx)
 {
        dsl_pool_t *dp = scn->scn_dp;
-       blkptr_t *bp_toread = NULL;
 
        if (dsl_scan_check_suspend(scn, zb))
                return;
@@ -1765,34 +2321,39 @@ dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
 
        scn->scn_visited_this_txg++;
 
-       /*
-        * This debugging is commented out to conserve stack space.  This
-        * function is called recursively and the debugging addes several
-        * bytes to the stack for each call.  It can be commented back in
-        * if required to debug an issue in dsl_scan_visitbp().
-        *
-        * dprintf_bp(bp,
-        *     "visiting ds=%p/%llu zb=%llx/%llx/%llx/%llx bp=%p",
-        *     ds, ds ? ds->ds_object : 0,
-        *     zb->zb_objset, zb->zb_object, zb->zb_level, zb->zb_blkid,
-        *     bp);
-        */
-
        if (BP_IS_HOLE(bp)) {
                scn->scn_holes_this_txg++;
                return;
        }
 
+       if (BP_IS_REDACTED(bp)) {
+               ASSERT(dsl_dataset_feature_is_active(ds,
+                   SPA_FEATURE_REDACTED_DATASETS));
+               return;
+       }
+
+       /*
+        * Check if this block contradicts any filesystem flags.
+        */
+       spa_feature_t f = SPA_FEATURE_LARGE_BLOCKS;
+       if (BP_GET_LSIZE(bp) > SPA_OLD_MAXBLOCKSIZE)
+               ASSERT(dsl_dataset_feature_is_active(ds, f));
+
+       f = zio_checksum_to_feature(BP_GET_CHECKSUM(bp));
+       if (f != SPA_FEATURE_NONE)
+               ASSERT(dsl_dataset_feature_is_active(ds, f));
+
+       f = zio_compress_to_feature(BP_GET_COMPRESS(bp));
+       if (f != SPA_FEATURE_NONE)
+               ASSERT(dsl_dataset_feature_is_active(ds, f));
+
        if (bp->blk_birth <= scn->scn_phys.scn_cur_min_txg) {
                scn->scn_lt_min_this_txg++;
                return;
        }
 
-       bp_toread = kmem_alloc(sizeof (blkptr_t), KM_SLEEP);
-       *bp_toread = *bp;
-
-       if (dsl_scan_recurse(scn, ds, ostype, dnp, bp_toread, zb, tx) != 0)
-               goto out;
+       if (dsl_scan_recurse(scn, ds, ostype, dnp, bp, zb, tx) != 0)
+               return;
 
        /*
         * If dsl_scan_ddt() has already visited this block, it will have
@@ -1802,7 +2363,7 @@ dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
        if (ddt_class_contains(dp->dp_spa,
            scn->scn_phys.scn_ddt_class_max, bp)) {
                scn->scn_ddt_contained_this_txg++;
-               goto out;
+               return;
        }
 
        /*
@@ -1814,13 +2375,10 @@ dsl_scan_visitbp(blkptr_t *bp, const zbookmark_phys_t *zb,
         */
        if (BP_PHYSICAL_BIRTH(bp) > scn->scn_phys.scn_cur_max_txg) {
                scn->scn_gt_max_this_txg++;
-               goto out;
+               return;
        }
 
        scan_funcs[scn->scn_phys.scn_func](dp, bp, zb);
-
-out:
-       kmem_free(bp_toread, sizeof (blkptr_t));
 }
 
 static void
@@ -1868,18 +2426,20 @@ ds_destroyed_scn_phys(dsl_dataset_t *ds, dsl_scan_phys_t *scn_phys)
                         */
                        scn_phys->scn_bookmark.zb_objset =
                            dsl_dataset_phys(ds)->ds_next_snap_obj;
-                       zfs_dbgmsg("destroying ds %llu; currently traversing; "
-                           "reset zb_objset to %llu",
+                       zfs_dbgmsg("destroying ds %llu on %s; currently "
+                           "traversing; reset zb_objset to %llu",
                            (u_longlong_t)ds->ds_object,
+                           ds->ds_dir->dd_pool->dp_spa->spa_name,
                            (u_longlong_t)dsl_dataset_phys(ds)->
                            ds_next_snap_obj);
                        scn_phys->scn_flags |= DSF_VISIT_DS_AGAIN;
                } else {
                        SET_BOOKMARK(&scn_phys->scn_bookmark,
                            ZB_DESTROYED_OBJSET, 0, 0, 0);
-                       zfs_dbgmsg("destroying ds %llu; currently traversing; "
-                           "reset bookmark to -1,0,0,0",
-                           (u_longlong_t)ds->ds_object);
+                       zfs_dbgmsg("destroying ds %llu on %s; currently "
+                           "traversing; reset bookmark to -1,0,0,0",
+                           (u_longlong_t)ds->ds_object,
+                           ds->ds_dir->dd_pool->dp_spa->spa_name);
                }
        }
 }
@@ -1930,14 +2490,17 @@ dsl_scan_ds_destroyed(dsl_dataset_t *ds, dmu_tx_t *tx)
                            scn->scn_phys.scn_queue_obj,
                            dsl_dataset_phys(ds)->ds_next_snap_obj,
                            mintxg, tx) == 0);
-                       zfs_dbgmsg("destroying ds %llu; in queue; "
+                       zfs_dbgmsg("destroying ds %llu on %s; in queue; "
                            "replacing with %llu",
                            (u_longlong_t)ds->ds_object,
+                           dp->dp_spa->spa_name,
                            (u_longlong_t)dsl_dataset_phys(ds)->
                            ds_next_snap_obj);
                } else {
-                       zfs_dbgmsg("destroying ds %llu; in queue; removing",
-                           (u_longlong_t)ds->ds_object);
+                       zfs_dbgmsg("destroying ds %llu on %s; in queue; "
+                           "removing",
+                           (u_longlong_t)ds->ds_object,
+                           dp->dp_spa->spa_name);
                }
        }
 
@@ -1954,9 +2517,10 @@ ds_snapshotted_bookmark(dsl_dataset_t *ds, zbookmark_phys_t *scn_bookmark)
        if (scn_bookmark->zb_objset == ds->ds_object) {
                scn_bookmark->zb_objset =
                    dsl_dataset_phys(ds)->ds_prev_snap_obj;
-               zfs_dbgmsg("snapshotting ds %llu; currently traversing; "
+               zfs_dbgmsg("snapshotting ds %llu on %s; currently traversing; "
                    "reset zb_objset to %llu",
                    (u_longlong_t)ds->ds_object,
+                   ds->ds_dir->dd_pool->dp_spa->spa_name,
                    (u_longlong_t)dsl_dataset_phys(ds)->ds_prev_snap_obj);
        }
 }
@@ -1995,9 +2559,10 @@ dsl_scan_ds_snapshotted(dsl_dataset_t *ds, dmu_tx_t *tx)
                VERIFY(zap_add_int_key(dp->dp_meta_objset,
                    scn->scn_phys.scn_queue_obj,
                    dsl_dataset_phys(ds)->ds_prev_snap_obj, mintxg, tx) == 0);
-               zfs_dbgmsg("snapshotting ds %llu; in queue; "
+               zfs_dbgmsg("snapshotting ds %llu on %s; in queue; "
                    "replacing with %llu",
                    (u_longlong_t)ds->ds_object,
+                   dp->dp_spa->spa_name,
                    (u_longlong_t)dsl_dataset_phys(ds)->ds_prev_snap_obj);
        }
 
@@ -2010,30 +2575,33 @@ ds_clone_swapped_bookmark(dsl_dataset_t *ds1, dsl_dataset_t *ds2,
 {
        if (scn_bookmark->zb_objset == ds1->ds_object) {
                scn_bookmark->zb_objset = ds2->ds_object;
-               zfs_dbgmsg("clone_swap ds %llu; currently traversing; "
+               zfs_dbgmsg("clone_swap ds %llu on %s; currently traversing; "
                    "reset zb_objset to %llu",
                    (u_longlong_t)ds1->ds_object,
+                   ds1->ds_dir->dd_pool->dp_spa->spa_name,
                    (u_longlong_t)ds2->ds_object);
        } else if (scn_bookmark->zb_objset == ds2->ds_object) {
                scn_bookmark->zb_objset = ds1->ds_object;
-               zfs_dbgmsg("clone_swap ds %llu; currently traversing; "
+               zfs_dbgmsg("clone_swap ds %llu on %s; currently traversing; "
                    "reset zb_objset to %llu",
                    (u_longlong_t)ds2->ds_object,
+                   ds2->ds_dir->dd_pool->dp_spa->spa_name,
                    (u_longlong_t)ds1->ds_object);
        }
 }
 
 /*
- * Called when a parent dataset and its clone are swapped. If we were
+ * Called when an origin dataset and its clone are swapped.  If we were
  * currently traversing the dataset, we need to switch to traversing the
- * newly promoted parent.
+ * newly promoted clone.
  */
 void
 dsl_scan_ds_clone_swapped(dsl_dataset_t *ds1, dsl_dataset_t *ds2, dmu_tx_t *tx)
 {
        dsl_pool_t *dp = ds1->ds_dir->dd_pool;
        dsl_scan_t *scn = dp->dp_scan;
-       uint64_t mintxg;
+       uint64_t mintxg1, mintxg2;
+       boolean_t ds1_queued, ds2_queued;
 
        if (!dsl_scan_is_running(scn))
                return;
@@ -2041,54 +2609,92 @@ dsl_scan_ds_clone_swapped(dsl_dataset_t *ds1, dsl_dataset_t *ds2, dmu_tx_t *tx)
        ds_clone_swapped_bookmark(ds1, ds2, &scn->scn_phys.scn_bookmark);
        ds_clone_swapped_bookmark(ds1, ds2, &scn->scn_phys_cached.scn_bookmark);
 
-       if (scan_ds_queue_contains(scn, ds1->ds_object, &mintxg)) {
-               scan_ds_queue_remove(scn, ds1->ds_object);
-               scan_ds_queue_insert(scn, ds2->ds_object, mintxg);
+       /*
+        * Handle the in-memory scan queue.
+        */
+       ds1_queued = scan_ds_queue_contains(scn, ds1->ds_object, &mintxg1);
+       ds2_queued = scan_ds_queue_contains(scn, ds2->ds_object, &mintxg2);
+
+       /* Sanity checking. */
+       if (ds1_queued) {
+               ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
+               ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
+       }
+       if (ds2_queued) {
+               ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
+               ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
        }
-       if (scan_ds_queue_contains(scn, ds2->ds_object, &mintxg)) {
+
+       if (ds1_queued && ds2_queued) {
+               /*
+                * If both are queued, we don't need to do anything.
+                * The swapping code below would not handle this case correctly,
+                * since we can't insert ds2 if it is already there. That's
+                * because scan_ds_queue_insert() prohibits a duplicate insert
+                * and panics.
+                */
+       } else if (ds1_queued) {
+               scan_ds_queue_remove(scn, ds1->ds_object);
+               scan_ds_queue_insert(scn, ds2->ds_object, mintxg1);
+       } else if (ds2_queued) {
                scan_ds_queue_remove(scn, ds2->ds_object);
-               scan_ds_queue_insert(scn, ds1->ds_object, mintxg);
+               scan_ds_queue_insert(scn, ds1->ds_object, mintxg2);
        }
 
-       if (zap_lookup_int_key(dp->dp_meta_objset, scn->scn_phys.scn_queue_obj,
-           ds1->ds_object, &mintxg) == 0) {
-               int err;
-               ASSERT3U(mintxg, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
-               ASSERT3U(mintxg, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
-               VERIFY3U(0, ==, zap_remove_int(dp->dp_meta_objset,
+       /*
+        * Handle the on-disk scan queue.
+        * The on-disk state is an out-of-date version of the in-memory state,
+        * so the in-memory and on-disk values for ds1_queued and ds2_queued may
+        * be different. Therefore we need to apply the swap logic to the
+        * on-disk state independently of the in-memory state.
+        */
+       ds1_queued = zap_lookup_int_key(dp->dp_meta_objset,
+           scn->scn_phys.scn_queue_obj, ds1->ds_object, &mintxg1) == 0;
+       ds2_queued = zap_lookup_int_key(dp->dp_meta_objset,
+           scn->scn_phys.scn_queue_obj, ds2->ds_object, &mintxg2) == 0;
+
+       /* Sanity checking. */
+       if (ds1_queued) {
+               ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
+               ASSERT3U(mintxg1, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
+       }
+       if (ds2_queued) {
+               ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
+               ASSERT3U(mintxg2, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
+       }
+
+       if (ds1_queued && ds2_queued) {
+               /*
+                * If both are queued, we don't need to do anything.
+                * Alternatively, we could check for EEXIST from
+                * zap_add_int_key() and back out to the original state, but
+                * that would be more work than checking for this case upfront.
+                */
+       } else if (ds1_queued) {
+               VERIFY3S(0, ==, zap_remove_int(dp->dp_meta_objset,
                    scn->scn_phys.scn_queue_obj, ds1->ds_object, tx));
-               err = zap_add_int_key(dp->dp_meta_objset,
-                   scn->scn_phys.scn_queue_obj, ds2->ds_object, mintxg, tx);
-               VERIFY(err == 0 || err == EEXIST);
-               if (err == EEXIST) {
-                       /* Both were there to begin with */
-                       VERIFY(0 == zap_add_int_key(dp->dp_meta_objset,
-                           scn->scn_phys.scn_queue_obj,
-                           ds1->ds_object, mintxg, tx));
-               }
-               zfs_dbgmsg("clone_swap ds %llu; in queue; "
+               VERIFY3S(0, ==, zap_add_int_key(dp->dp_meta_objset,
+                   scn->scn_phys.scn_queue_obj, ds2->ds_object, mintxg1, tx));
+               zfs_dbgmsg("clone_swap ds %llu on %s; in queue; "
                    "replacing with %llu",
                    (u_longlong_t)ds1->ds_object,
+                   dp->dp_spa->spa_name,
                    (u_longlong_t)ds2->ds_object);
-       }
-       if (zap_lookup_int_key(dp->dp_meta_objset, scn->scn_phys.scn_queue_obj,
-           ds2->ds_object, &mintxg) == 0) {
-               ASSERT3U(mintxg, ==, dsl_dataset_phys(ds1)->ds_prev_snap_txg);
-               ASSERT3U(mintxg, ==, dsl_dataset_phys(ds2)->ds_prev_snap_txg);
-               VERIFY3U(0, ==, zap_remove_int(dp->dp_meta_objset,
+       } else if (ds2_queued) {
+               VERIFY3S(0, ==, zap_remove_int(dp->dp_meta_objset,
                    scn->scn_phys.scn_queue_obj, ds2->ds_object, tx));
-               VERIFY(0 == zap_add_int_key(dp->dp_meta_objset,
-                   scn->scn_phys.scn_queue_obj, ds1->ds_object, mintxg, tx));
-               zfs_dbgmsg("clone_swap ds %llu; in queue; "
+               VERIFY3S(0, ==, zap_add_int_key(dp->dp_meta_objset,
+                   scn->scn_phys.scn_queue_obj, ds1->ds_object, mintxg2, tx));
+               zfs_dbgmsg("clone_swap ds %llu on %s; in queue; "
                    "replacing with %llu",
                    (u_longlong_t)ds2->ds_object,
+                   dp->dp_spa->spa_name,
                    (u_longlong_t)ds1->ds_object);
        }
 
        dsl_scan_sync_state(scn, tx, SYNC_CACHED);
 }
 
-/* ARGSUSED */
 static int
 enqueue_clones_cb(dsl_pool_t *dp, dsl_dataset_t *hds, void *arg)
 {
@@ -2216,7 +2822,8 @@ dsl_scan_visitds(dsl_scan_t *scn, uint64_t dsobj, dmu_tx_t *tx)
         * If we did not completely visit this dataset, do another pass.
         */
        if (scn->scn_phys.scn_flags & DSF_VISIT_DS_AGAIN) {
-               zfs_dbgmsg("incomplete pass; visiting again");
+               zfs_dbgmsg("incomplete pass on %s; visiting again",
+                   dp->dp_spa->spa_name);
                scn->scn_phys.scn_flags &= ~DSF_VISIT_DS_AGAIN;
                scan_ds_queue_insert(scn, ds->ds_object,
                    scn->scn_phys.scn_cur_max_txg);
@@ -2272,10 +2879,10 @@ out:
        dsl_dataset_rele(ds, FTAG);
 }
 
-/* ARGSUSED */
 static int
 enqueue_cb(dsl_pool_t *dp, dsl_dataset_t *hds, void *arg)
 {
+       (void) arg;
        dsl_dataset_t *ds;
        int err;
        dsl_scan_t *scn = dp->dp_scan;
@@ -2311,21 +2918,34 @@ enqueue_cb(dsl_pool_t *dp, dsl_dataset_t *hds, void *arg)
        return (0);
 }
 
-/* ARGSUSED */
 void
 dsl_scan_ddt_entry(dsl_scan_t *scn, enum zio_checksum checksum,
     ddt_entry_t *dde, dmu_tx_t *tx)
 {
+       (void) tx;
        const ddt_key_t *ddk = &dde->dde_key;
        ddt_phys_t *ddp = dde->dde_phys;
        blkptr_t bp;
        zbookmark_phys_t zb = { 0 };
-       int p;
 
        if (!dsl_scan_is_running(scn))
                return;
 
-       for (p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
+       /*
+        * This function is special because it is the only thing
+        * that can add scan_io_t's to the vdev scan queues from
+        * outside dsl_scan_sync(). For the most part this is ok
+        * as long as it is called from within syncing context.
+        * However, dsl_scan_sync() expects that no new sio's will
+        * be added between when all the work for a scan is done
+        * and the next txg when the scan is actually marked as
+        * completed. This check ensures we do not issue new sio's
+        * during this period.
+        */
+       if (scn->scn_done_txg != 0)
+               return;
+
+       for (int p = 0; p < DDT_PHYS_TYPES; p++, ddp++) {
                if (ddp->ddp_phys_birth == 0 ||
                    ddp->ddp_phys_birth > scn->scn_phys.scn_max_txg)
                        continue;
@@ -2342,7 +2962,7 @@ dsl_scan_ddt_entry(dsl_scan_t *scn, enum zio_checksum checksum,
  * If there are N references to a deduped block, we don't want to scrub it
  * N times -- ideally, we should scrub it exactly once.
  *
- * We leverage the fact that the dde's replication class (enum ddt_class)
+ * We leverage the fact that the dde's replication class (ddt_class_t)
  * is ordered from highest replication class (DDT_CLASS_DITTO) to lowest
  * (DDT_CLASS_UNIQUE) so that we may walk the DDT in that order.
  *
@@ -2373,12 +2993,10 @@ static void
 dsl_scan_ddt(dsl_scan_t *scn, dmu_tx_t *tx)
 {
        ddt_bookmark_t *ddb = &scn->scn_phys.scn_ddt_bookmark;
-       ddt_entry_t dde;
+       ddt_entry_t dde = {{{{0}}}};
        int error;
        uint64_t n = 0;
 
-       bzero(&dde, sizeof (ddt_entry_t));
-
        while ((error = ddt_walk(scn->scn_dp->dp_spa, ddb, &dde)) == 0) {
                ddt_t *ddt;
 
@@ -2401,8 +3019,8 @@ dsl_scan_ddt(dsl_scan_t *scn, dmu_tx_t *tx)
                        break;
        }
 
-       zfs_dbgmsg("scanned %llu ddt entries with class_max = %u; "
-           "suspending=%u", (longlong_t)n,
+       zfs_dbgmsg("scanned %llu ddt entries on %s with class_max = %u; "
+           "suspending=%u", (longlong_t)n, scn->scn_dp->dp_spa->spa_name,
            (int)scn->scn_phys.scn_ddt_class_max, (int)scn->scn_suspending);
 
        ASSERT(error == 0 || error == ENOENT);
@@ -2441,7 +3059,6 @@ dsl_scan_visit(dsl_scan_t *scn, dmu_tx_t *tx)
                scn->scn_phys.scn_cur_max_txg = scn->scn_phys.scn_max_txg;
                dsl_scan_visit_rootbp(scn, NULL,
                    &dp->dp_meta_rootbp, tx);
-               spa_set_rootblkptr(dp->dp_spa, &dp->dp_meta_rootbp);
                if (scn->scn_suspending)
                        return;
 
@@ -2471,7 +3088,7 @@ dsl_scan_visit(dsl_scan_t *scn, dmu_tx_t *tx)
         * In case we suspended right at the end of the ds, zero the
         * bookmark so we don't think that we're still trying to resume.
         */
-       bzero(&scn->scn_phys.scn_bookmark, sizeof (zbookmark_phys_t));
+       memset(&scn->scn_phys.scn_bookmark, 0, sizeof (zbookmark_phys_t));
 
        /*
         * Keep pulling things out of the dataset avl queue. Updates to the
@@ -2510,22 +3127,17 @@ dsl_scan_visit(dsl_scan_t *scn, dmu_tx_t *tx)
 }
 
 static uint64_t
-dsl_scan_count_leaves(vdev_t *vd)
+dsl_scan_count_data_disks(spa_t *spa)
 {
+       vdev_t *rvd = spa->spa_root_vdev;
        uint64_t i, leaves = 0;
 
-       /* we only count leaves that belong to the main pool and are readable */
-       if (vd->vdev_islog || vd->vdev_isspare ||
-           vd->vdev_isl2cache || !vdev_readable(vd))
-               return (0);
-
-       if (vd->vdev_ops->vdev_op_leaf)
-               return (1);
-
-       for (i = 0; i < vd->vdev_children; i++) {
-               leaves += dsl_scan_count_leaves(vd->vdev_child[i]);
+       for (i = 0; i < rvd->vdev_children; i++) {
+               vdev_t *vd = rvd->vdev_child[i];
+               if (vd->vdev_islog || vd->vdev_isspare || vd->vdev_isl2cache)
+                       continue;
+               leaves += vdev_get_ndisks(vd) - vdev_get_nparity(vd);
        }
-
        return (leaves);
 }
 
@@ -2559,12 +3171,13 @@ scan_io_queue_check_suspend(dsl_scan_t *scn)
        uint64_t scan_time_ns = curr_time_ns - scn->scn_sync_start_time;
        uint64_t sync_time_ns = curr_time_ns -
            scn->scn_dp->dp_spa->spa_sync_starttime;
-       int dirty_pct = scn->scn_dp->dp_dirty_total * 100 / zfs_dirty_data_max;
-       int mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
+       uint64_t dirty_min_bytes = zfs_dirty_data_max *
+           zfs_vdev_async_write_active_min_dirty_percent / 100;
+       uint_t mintime = (scn->scn_phys.scn_func == POOL_SCAN_RESILVER) ?
            zfs_resilver_min_time_ms : zfs_scrub_min_time_ms;
 
        return ((NSEC2MSEC(scan_time_ns) > mintime &&
-           (dirty_pct >= zfs_vdev_async_write_active_min_dirty_percent ||
+           (scn->scn_dp->dp_dirty_total >= dirty_min_bytes ||
            txg_sync_waiting(scn->scn_dp) ||
            NSEC2SEC(sync_time_ns) >= zfs_txg_timeout)) ||
            spa_shutting_down(scn->scn_dp->dp_spa));
@@ -2583,7 +3196,6 @@ scan_io_queue_issue(dsl_scan_io_queue_t *queue, list_t *io_list)
 {
        dsl_scan_t *scn = queue->q_scn;
        scan_io_t *sio;
-       int64_t bytes_issued = 0;
        boolean_t suspended = B_FALSE;
 
        while ((sio = list_head(io_list)) != NULL) {
@@ -2594,17 +3206,13 @@ scan_io_queue_issue(dsl_scan_io_queue_t *queue, list_t *io_list)
                        break;
                }
 
-               sio2bp(sio, &bp, queue->q_vd->vdev_id);
-               bytes_issued += sio->sio_asize;
+               sio2bp(sio, &bp);
                scan_exec_io(scn->scn_dp, &bp, sio->sio_flags,
                    &sio->sio_zb, queue);
                (void) list_remove_head(io_list);
                scan_io_queues_update_zio_stats(queue, &bp);
-               kmem_cache_free(sio_cache, sio);
+               sio_free(sio);
        }
-
-       atomic_add_64(&scn->scn_bytes_pending, -bytes_issued);
-
        return (suspended);
 }
 
@@ -2618,7 +3226,7 @@ scan_io_queue_issue(dsl_scan_io_queue_t *queue, list_t *io_list)
 static boolean_t
 scan_io_queue_gather(dsl_scan_io_queue_t *queue, range_seg_t *rs, list_t *list)
 {
-       scan_io_t srch_sio, *sio, *next_sio;
+       scan_io_t *srch_sio, *sio, *next_sio;
        avl_index_t idx;
        uint_t num_sios = 0;
        int64_t bytes_issued = 0;
@@ -2626,24 +3234,34 @@ scan_io_queue_gather(dsl_scan_io_queue_t *queue, range_seg_t *rs, list_t *list)
        ASSERT(rs != NULL);
        ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
 
-       srch_sio.sio_offset = rs->rs_start;
+       srch_sio = sio_alloc(1);
+       srch_sio->sio_nr_dvas = 1;
+       SIO_SET_OFFSET(srch_sio, rs_get_start(rs, queue->q_exts_by_addr));
 
        /*
         * The exact start of the extent might not contain any matching zios,
         * so if that's the case, examine the next one in the tree.
         */
-       sio = avl_find(&queue->q_sios_by_addr, &srch_sio, &idx);
+       sio = avl_find(&queue->q_sios_by_addr, srch_sio, &idx);
+       sio_free(srch_sio);
+
        if (sio == NULL)
                sio = avl_nearest(&queue->q_sios_by_addr, idx, AVL_AFTER);
 
-       while (sio != NULL && sio->sio_offset < rs->rs_end && num_sios <= 32) {
-               ASSERT3U(sio->sio_offset, >=, rs->rs_start);
-               ASSERT3U(sio->sio_offset + sio->sio_asize, <=, rs->rs_end);
+       while (sio != NULL && SIO_GET_OFFSET(sio) < rs_get_end(rs,
+           queue->q_exts_by_addr) && num_sios <= 32) {
+               ASSERT3U(SIO_GET_OFFSET(sio), >=, rs_get_start(rs,
+                   queue->q_exts_by_addr));
+               ASSERT3U(SIO_GET_END_OFFSET(sio), <=, rs_get_end(rs,
+                   queue->q_exts_by_addr));
 
                next_sio = AVL_NEXT(&queue->q_sios_by_addr, sio);
                avl_remove(&queue->q_sios_by_addr, sio);
+               if (avl_is_empty(&queue->q_sios_by_addr))
+                       atomic_add_64(&queue->q_scn->scn_queues_pending, -1);
+               queue->q_sio_memused -= SIO_GET_MUSED(sio);
 
-               bytes_issued += sio->sio_asize;
+               bytes_issued += SIO_GET_ASIZE(sio);
                num_sios++;
                list_insert_tail(list, sio);
                sio = next_sio;
@@ -2655,16 +3273,20 @@ scan_io_queue_gather(dsl_scan_io_queue_t *queue, range_seg_t *rs, list_t *list)
         * in the segment we update it to reflect the work we were able to
         * complete. Otherwise, we remove it from the range tree entirely.
         */
-       if (sio != NULL && sio->sio_offset < rs->rs_end) {
+       if (sio != NULL && SIO_GET_OFFSET(sio) < rs_get_end(rs,
+           queue->q_exts_by_addr)) {
                range_tree_adjust_fill(queue->q_exts_by_addr, rs,
                    -bytes_issued);
                range_tree_resize_segment(queue->q_exts_by_addr, rs,
-                   sio->sio_offset, rs->rs_end - sio->sio_offset);
-
+                   SIO_GET_OFFSET(sio), rs_get_end(rs,
+                   queue->q_exts_by_addr) - SIO_GET_OFFSET(sio));
+               queue->q_last_ext_addr = SIO_GET_OFFSET(sio);
                return (B_TRUE);
        } else {
-               range_tree_remove(queue->q_exts_by_addr, rs->rs_start,
-                   rs->rs_end - rs->rs_start);
+               uint64_t rstart = rs_get_start(rs, queue->q_exts_by_addr);
+               uint64_t rend = rs_get_end(rs, queue->q_exts_by_addr);
+               range_tree_remove(queue->q_exts_by_addr, rstart, rend - rstart);
+               queue->q_last_ext_addr = -1;
                return (B_FALSE);
        }
 }
@@ -2684,18 +3306,13 @@ static range_seg_t *
 scan_io_queue_fetch_ext(dsl_scan_io_queue_t *queue)
 {
        dsl_scan_t *scn = queue->q_scn;
+       range_tree_t *rt = queue->q_exts_by_addr;
 
        ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
        ASSERT(scn->scn_is_sorted);
 
-       /* handle tunable overrides */
-       if (scn->scn_checkpointing || scn->scn_clearing) {
-               if (zfs_scan_issue_strategy == 1) {
-                       return (range_tree_first(queue->q_exts_by_addr));
-               } else if (zfs_scan_issue_strategy == 2) {
-                       return (avl_first(&queue->q_exts_by_size));
-               }
-       }
+       if (!scn->scn_checkpointing && !scn->scn_clearing)
+               return (NULL);
 
        /*
         * During normal clearing, we want to issue our largest segments
@@ -2706,13 +3323,42 @@ scan_io_queue_fetch_ext(dsl_scan_io_queue_t *queue)
         * so the way we are sorted now is as good as it will ever get.
         * In this case, we instead switch to issuing extents in LBA order.
         */
-       if (scn->scn_checkpointing) {
-               return (range_tree_first(queue->q_exts_by_addr));
-       } else if (scn->scn_clearing) {
-               return (avl_first(&queue->q_exts_by_size));
-       } else {
-               return (NULL);
+       if ((zfs_scan_issue_strategy < 1 && scn->scn_checkpointing) ||
+           zfs_scan_issue_strategy == 1)
+               return (range_tree_first(rt));
+
+       /*
+        * Try to continue previous extent if it is not completed yet.  After
+        * shrink in scan_io_queue_gather() it may no longer be the best, but
+        * otherwise we leave shorter remnant every txg.
+        */
+       uint64_t start;
+       uint64_t size = 1ULL << rt->rt_shift;
+       range_seg_t *addr_rs;
+       if (queue->q_last_ext_addr != -1) {
+               start = queue->q_last_ext_addr;
+               addr_rs = range_tree_find(rt, start, size);
+               if (addr_rs != NULL)
+                       return (addr_rs);
        }
+
+       /*
+        * Nothing to continue, so find new best extent.
+        */
+       uint64_t *v = zfs_btree_first(&queue->q_exts_by_size, NULL);
+       if (v == NULL)
+               return (NULL);
+       queue->q_last_ext_addr = start = *v << rt->rt_shift;
+
+       /*
+        * We need to get the original entry in the by_addr tree so we can
+        * modify it.
+        */
+       addr_rs = range_tree_find(rt, start, size);
+       ASSERT3P(addr_rs, !=, NULL);
+       ASSERT3U(rs_get_start(addr_rs, rt), ==, start);
+       ASSERT3U(rs_get_end(addr_rs, rt), >, start);
+       return (addr_rs);
 }
 
 static void
@@ -2721,21 +3367,23 @@ scan_io_queues_run_one(void *arg)
        dsl_scan_io_queue_t *queue = arg;
        kmutex_t *q_lock = &queue->q_vd->vdev_scan_io_queue_lock;
        boolean_t suspended = B_FALSE;
-       range_seg_t *rs = NULL;
-       scan_io_t *sio = NULL;
+       range_seg_t *rs;
+       scan_io_t *sio;
+       zio_t *zio;
        list_t sio_list;
-       uint64_t bytes_per_leaf = zfs_scan_vdev_limit;
-       uint64_t nr_leaves = dsl_scan_count_leaves(queue->q_vd);
 
        ASSERT(queue->q_scn->scn_is_sorted);
 
        list_create(&sio_list, sizeof (scan_io_t),
            offsetof(scan_io_t, sio_nodes.sio_list_node));
+       zio = zio_null(queue->q_scn->scn_zio_root, queue->q_scn->scn_dp->dp_spa,
+           NULL, NULL, NULL, ZIO_FLAG_CANFAIL);
        mutex_enter(q_lock);
+       queue->q_zio = zio;
 
-       /* calculate maximum in-flight bytes for this txg (min 1MB) */
-       queue->q_maxinflight_bytes =
-           MAX(nr_leaves * bytes_per_leaf, 1ULL << 20);
+       /* Calculate maximum in-flight bytes for this vdev. */
+       queue->q_maxinflight_bytes = MAX(1, zfs_scan_vdev_limit *
+           (vdev_get_ndisks(queue->q_vd) - vdev_get_nparity(queue->q_vd)));
 
        /* reset per-queue scan statistics for this txg */
        queue->q_total_seg_size_this_txg = 0;
@@ -2746,12 +3394,12 @@ scan_io_queues_run_one(void *arg)
        /* loop until we run out of time or sios */
        while ((rs = scan_io_queue_fetch_ext(queue)) != NULL) {
                uint64_t seg_start = 0, seg_end = 0;
-               boolean_t more_left = B_TRUE;
+               boolean_t more_left;
 
                ASSERT(list_is_empty(&sio_list));
 
                /* loop while we still have sios left to process in this rs */
-               while (more_left) {
+               do {
                        scan_io_t *first_sio, *last_sio;
 
                        /*
@@ -2763,9 +3411,9 @@ scan_io_queues_run_one(void *arg)
                        first_sio = list_head(&sio_list);
                        last_sio = list_tail(&sio_list);
 
-                       seg_end = last_sio->sio_offset + last_sio->sio_asize;
+                       seg_end = SIO_GET_END_OFFSET(last_sio);
                        if (seg_start == 0)
-                               seg_start = first_sio->sio_offset;
+                               seg_start = SIO_GET_OFFSET(first_sio);
 
                        /*
                         * Issuing sios can take a long time so drop the
@@ -2780,7 +3428,7 @@ scan_io_queues_run_one(void *arg)
 
                        if (suspended)
                                break;
-               }
+               } while (more_left);
 
                /* update statistics for debugging purposes */
                scan_io_queues_update_seg_stats(queue, seg_start, seg_end);
@@ -2793,12 +3441,12 @@ scan_io_queues_run_one(void *arg)
         * If we were suspended in the middle of processing,
         * requeue any unfinished sios and exit.
         */
-       while ((sio = list_head(&sio_list)) != NULL) {
-               list_remove(&sio_list, sio);
+       while ((sio = list_remove_head(&sio_list)) != NULL)
                scan_io_queue_insert_impl(queue, sio);
-       }
 
+       queue->q_zio = NULL;
        mutex_exit(q_lock);
+       zio_nowait(zio);
        list_destroy(&sio_list);
 }
 
@@ -2819,7 +3467,7 @@ scan_io_queues_run(dsl_scan_t *scn)
        ASSERT(scn->scn_is_sorted);
        ASSERT(spa_config_held(spa, SCL_CONFIG, RW_READER));
 
-       if (scn->scn_bytes_pending == 0)
+       if (scn->scn_queues_pending == 0)
                return;
 
        if (scn->scn_taskq == NULL) {
@@ -2864,8 +3512,15 @@ dsl_scan_async_block_should_pause(dsl_scan_t *scn)
        if (zfs_recover)
                return (B_FALSE);
 
-       if (scn->scn_visited_this_txg >= zfs_async_block_max_blocks)
+       if (zfs_async_block_max_blocks != 0 &&
+           scn->scn_visited_this_txg >= zfs_async_block_max_blocks) {
+               return (B_TRUE);
+       }
+
+       if (zfs_max_async_dedup_frees != 0 &&
+           scn->scn_dedup_frees_this_txg >= zfs_max_async_dedup_frees) {
                return (B_TRUE);
+       }
 
        elapsed_nanosecs = gethrtime() - scn->scn_sync_start_time;
        return (elapsed_nanosecs / NANOSEC > zfs_txg_timeout ||
@@ -2891,6 +3546,8 @@ dsl_scan_free_block_cb(void *arg, const blkptr_t *bp, dmu_tx_t *tx)
            -bp_get_dsize_sync(scn->scn_dp->dp_spa, bp),
            -BP_GET_PSIZE(bp), -BP_GET_UCSIZE(bp), tx);
        scn->scn_visited_this_txg++;
+       if (BP_GET_DEDUP(bp))
+               scn->scn_dedup_frees_this_txg++;
        return (0);
 }
 
@@ -2930,8 +3587,18 @@ dsl_scan_update_stats(dsl_scan_t *scn)
 }
 
 static int
-dsl_scan_obsolete_block_cb(void *arg, const blkptr_t *bp, dmu_tx_t *tx)
+bpobj_dsl_scan_free_block_cb(void *arg, const blkptr_t *bp, boolean_t bp_freed,
+    dmu_tx_t *tx)
+{
+       ASSERT(!bp_freed);
+       return (dsl_scan_free_block_cb(arg, bp, tx));
+}
+
+static int
+dsl_scan_obsolete_block_cb(void *arg, const blkptr_t *bp, boolean_t bp_freed,
+    dmu_tx_t *tx)
 {
+       ASSERT(!bp_freed);
        dsl_scan_t *scn = arg;
        const dva_t *dva = &bp->blk_dva[0];
 
@@ -2950,6 +3617,7 @@ dsl_scan_active(dsl_scan_t *scn)
 {
        spa_t *spa = scn->scn_dp->dp_spa;
        uint64_t used = 0, comp, uncomp;
+       boolean_t clones_left;
 
        if (spa->spa_load_state != SPA_LOAD_NONE)
                return (B_FALSE);
@@ -2963,7 +3631,41 @@ dsl_scan_active(dsl_scan_t *scn)
                (void) bpobj_space(&scn->scn_dp->dp_free_bpobj,
                    &used, &comp, &uncomp);
        }
-       return (used != 0);
+       clones_left = spa_livelist_delete_check(spa);
+       return ((used != 0) || (clones_left));
+}
+
+boolean_t
+dsl_errorscrub_active(dsl_scan_t *scn)
+{
+       spa_t *spa = scn->scn_dp->dp_spa;
+       if (spa->spa_load_state != SPA_LOAD_NONE)
+               return (B_FALSE);
+       if (spa_shutting_down(spa))
+               return (B_FALSE);
+       if (dsl_errorscrubbing(scn->scn_dp))
+               return (B_TRUE);
+       return (B_FALSE);
+}
+
+static boolean_t
+dsl_scan_check_deferred(vdev_t *vd)
+{
+       boolean_t need_resilver = B_FALSE;
+
+       for (int c = 0; c < vd->vdev_children; c++) {
+               need_resilver |=
+                   dsl_scan_check_deferred(vd->vdev_child[c]);
+       }
+
+       if (!vdev_is_concrete(vd) || vd->vdev_aux ||
+           !vd->vdev_ops->vdev_op_leaf)
+               return (need_resilver);
+
+       if (!vd->vdev_resilver_deferred)
+               need_resilver = B_TRUE;
+
+       return (need_resilver);
 }
 
 static boolean_t
@@ -2997,20 +3699,20 @@ dsl_scan_need_resilver(spa_t *spa, const dva_t *dva, size_t psize,
                return (B_TRUE);
        }
 
-       /*
-        * Check if the txg falls within the range which must be
-        * resilvered.  DVAs outside this range can always be skipped.
-        */
-       if (!vdev_dtl_contains(vd, DTL_PARTIAL, phys_birth, 1))
-               return (B_FALSE);
-
        /*
         * Check if the top-level vdev must resilver this offset.
         * When the offset does not intersect with a dirty leaf DTL
         * then it may be possible to skip the resilver IO.  The psize
         * is provided instead of asize to simplify the check for RAIDZ.
         */
-       if (!vdev_dtl_need_resilver(vd, DVA_GET_OFFSET(dva), psize))
+       if (!vdev_dtl_need_resilver(vd, dva, psize, phys_birth))
+               return (B_FALSE);
+
+       /*
+        * Check that this top-level vdev has a device under it which
+        * is resilvering and is not deferred.
+        */
+       if (!dsl_scan_check_deferred(vd))
                return (B_FALSE);
 
        return (B_TRUE);
@@ -3033,7 +3735,7 @@ dsl_process_async_destroys(dsl_pool_t *dp, dmu_tx_t *tx)
                scn->scn_zio_root = zio_root(spa, NULL,
                    NULL, ZIO_FLAG_MUSTSUCCEED);
                err = bpobj_iterate(&dp->dp_free_bpobj,
-                   dsl_scan_free_block_cb, scn, tx);
+                   bpobj_dsl_scan_free_block_cb, scn, tx);
                VERIFY0(zio_wait(scn->scn_zio_root));
                scn->scn_zio_root = NULL;
 
@@ -3086,19 +3788,21 @@ dsl_process_async_destroys(dsl_pool_t *dp, dmu_tx_t *tx)
        }
        if (scn->scn_visited_this_txg) {
                zfs_dbgmsg("freed %llu blocks in %llums from "
-                   "free_bpobj/bptree txg %llu; err=%u",
+                   "free_bpobj/bptree on %s in txg %llu; err=%u",
                    (longlong_t)scn->scn_visited_this_txg,
                    (longlong_t)
                    NSEC2MSEC(gethrtime() - scn->scn_sync_start_time),
-                   (longlong_t)tx->tx_txg, err);
+                   spa->spa_name, (longlong_t)tx->tx_txg, err);
                scn->scn_visited_this_txg = 0;
+               scn->scn_dedup_frees_this_txg = 0;
 
                /*
-                * Write out changes to the DDT that may be required as a
-                * result of the blocks freed.  This ensures that the DDT
-                * is clean when a scrub/resilver runs.
+                * Write out changes to the DDT and the BRT that may be required
+                * as a result of the blocks freed.  This ensures that the DDT
+                * and the BRT are clean when a scrub/resilver runs.
                 */
                ddt_sync(spa, tx->tx_txg);
+               brt_sync(spa, tx->tx_txg);
        }
        if (err != 0)
                return (err);
@@ -3130,13 +3834,16 @@ dsl_process_async_destroys(dsl_pool_t *dp, dmu_tx_t *tx)
                    -dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes, tx);
        }
 
-       if (dp->dp_free_dir != NULL && !scn->scn_async_destroying) {
+       if (dp->dp_free_dir != NULL && !scn->scn_async_destroying &&
+           !spa_livelist_delete_check(spa)) {
                /* finished; verify that space accounting went to zero */
                ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_used_bytes);
                ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_compressed_bytes);
                ASSERT0(dsl_dir_phys(dp->dp_free_dir)->dd_uncompressed_bytes);
        }
 
+       spa_notify_waiters(spa);
+
        EQUIV(bpobj_is_open(&dp->dp_obsolete_bpobj),
            0 == zap_contains(dp->dp_meta_objset, DMU_POOL_DIRECTORY_OBJECT,
            DMU_POOL_OBSOLETE_BPOBJ));
@@ -3157,10 +3864,391 @@ dsl_process_async_destroys(dsl_pool_t *dp, dmu_tx_t *tx)
        return (0);
 }
 
+static void
+name_to_bookmark(char *buf, zbookmark_phys_t *zb)
+{
+       zb->zb_objset = zfs_strtonum(buf, &buf);
+       ASSERT(*buf == ':');
+       zb->zb_object = zfs_strtonum(buf + 1, &buf);
+       ASSERT(*buf == ':');
+       zb->zb_level = (int)zfs_strtonum(buf + 1, &buf);
+       ASSERT(*buf == ':');
+       zb->zb_blkid = zfs_strtonum(buf + 1, &buf);
+       ASSERT(*buf == '\0');
+}
+
+static void
+name_to_object(char *buf, uint64_t *obj)
+{
+       *obj = zfs_strtonum(buf, &buf);
+       ASSERT(*buf == '\0');
+}
+
+static void
+read_by_block_level(dsl_scan_t *scn, zbookmark_phys_t zb)
+{
+       dsl_pool_t *dp = scn->scn_dp;
+       dsl_dataset_t *ds;
+       objset_t *os;
+       if (dsl_dataset_hold_obj(dp, zb.zb_objset, FTAG, &ds) != 0)
+               return;
+
+       if (dmu_objset_from_ds(ds, &os) != 0) {
+               dsl_dataset_rele(ds, FTAG);
+               return;
+       }
+
+       /*
+        * If the key is not loaded dbuf_dnode_findbp() will error out with
+        * EACCES. However in that case dnode_hold() will eventually call
+        * dbuf_read()->zio_wait() which may call spa_log_error(). This will
+        * lead to a deadlock due to us holding the mutex spa_errlist_lock.
+        * Avoid this by checking here if the keys are loaded, if not return.
+        * If the keys are not loaded the head_errlog feature is meaningless
+        * as we cannot figure out the birth txg of the block pointer.
+        */
+       if (dsl_dataset_get_keystatus(ds->ds_dir) ==
+           ZFS_KEYSTATUS_UNAVAILABLE) {
+               dsl_dataset_rele(ds, FTAG);
+               return;
+       }
+
+       dnode_t *dn;
+       blkptr_t bp;
+
+       if (dnode_hold(os, zb.zb_object, FTAG, &dn) != 0) {
+               dsl_dataset_rele(ds, FTAG);
+               return;
+       }
+
+       rw_enter(&dn->dn_struct_rwlock, RW_READER);
+       int error = dbuf_dnode_findbp(dn, zb.zb_level, zb.zb_blkid, &bp, NULL,
+           NULL);
+
+       if (error) {
+               rw_exit(&dn->dn_struct_rwlock);
+               dnode_rele(dn, FTAG);
+               dsl_dataset_rele(ds, FTAG);
+               return;
+       }
+
+       if (!error && BP_IS_HOLE(&bp)) {
+               rw_exit(&dn->dn_struct_rwlock);
+               dnode_rele(dn, FTAG);
+               dsl_dataset_rele(ds, FTAG);
+               return;
+       }
+
+       int zio_flags = ZIO_FLAG_SCAN_THREAD | ZIO_FLAG_RAW |
+           ZIO_FLAG_CANFAIL | ZIO_FLAG_SCRUB;
+
+       /* If it's an intent log block, failure is expected. */
+       if (zb.zb_level == ZB_ZIL_LEVEL)
+               zio_flags |= ZIO_FLAG_SPECULATIVE;
+
+       ASSERT(!BP_IS_EMBEDDED(&bp));
+       scan_exec_io(dp, &bp, zio_flags, &zb, NULL);
+       rw_exit(&dn->dn_struct_rwlock);
+       dnode_rele(dn, FTAG);
+       dsl_dataset_rele(ds, FTAG);
+}
+
+/*
+ * We keep track of the scrubbed error blocks in "count". This will be used
+ * when deciding whether we exceeded zfs_scrub_error_blocks_per_txg. This
+ * function is modelled after check_filesystem().
+ */
+static int
+scrub_filesystem(spa_t *spa, uint64_t fs, zbookmark_err_phys_t *zep,
+    int *count)
+{
+       dsl_dataset_t *ds;
+       dsl_pool_t *dp = spa->spa_dsl_pool;
+       dsl_scan_t *scn = dp->dp_scan;
+
+       int error = dsl_dataset_hold_obj(dp, fs, FTAG, &ds);
+       if (error != 0)
+               return (error);
+
+       uint64_t latest_txg;
+       uint64_t txg_to_consider = spa->spa_syncing_txg;
+       boolean_t check_snapshot = B_TRUE;
+
+       error = find_birth_txg(ds, zep, &latest_txg);
+
+       /*
+        * If find_birth_txg() errors out, then err on the side of caution and
+        * proceed. In worst case scenario scrub all objects. If zep->zb_birth
+        * is 0 (e.g. in case of encryption with unloaded keys) also proceed to
+        * scrub all objects.
+        */
+       if (error == 0 && zep->zb_birth == latest_txg) {
+               /* Block neither free nor re written. */
+               zbookmark_phys_t zb;
+               zep_to_zb(fs, zep, &zb);
+               scn->scn_zio_root = zio_root(spa, NULL, NULL,
+                   ZIO_FLAG_CANFAIL);
+               /* We have already acquired the config lock for spa */
+               read_by_block_level(scn, zb);
+
+               (void) zio_wait(scn->scn_zio_root);
+               scn->scn_zio_root = NULL;
+
+               scn->errorscrub_phys.dep_examined++;
+               scn->errorscrub_phys.dep_to_examine--;
+               (*count)++;
+               if ((*count) == zfs_scrub_error_blocks_per_txg ||
+                   dsl_error_scrub_check_suspend(scn, &zb)) {
+                       dsl_dataset_rele(ds, FTAG);
+                       return (SET_ERROR(EFAULT));
+               }
+
+               check_snapshot = B_FALSE;
+       } else if (error == 0) {
+               txg_to_consider = latest_txg;
+       }
+
+       /*
+        * Retrieve the number of snapshots if the dataset is not a snapshot.
+        */
+       uint64_t snap_count = 0;
+       if (dsl_dataset_phys(ds)->ds_snapnames_zapobj != 0) {
+
+               error = zap_count(spa->spa_meta_objset,
+                   dsl_dataset_phys(ds)->ds_snapnames_zapobj, &snap_count);
+
+               if (error != 0) {
+                       dsl_dataset_rele(ds, FTAG);
+                       return (error);
+               }
+       }
+
+       if (snap_count == 0) {
+               /* Filesystem without snapshots. */
+               dsl_dataset_rele(ds, FTAG);
+               return (0);
+       }
+
+       uint64_t snap_obj = dsl_dataset_phys(ds)->ds_prev_snap_obj;
+       uint64_t snap_obj_txg = dsl_dataset_phys(ds)->ds_prev_snap_txg;
+
+       dsl_dataset_rele(ds, FTAG);
+
+       /* Check only snapshots created from this file system. */
+       while (snap_obj != 0 && zep->zb_birth < snap_obj_txg &&
+           snap_obj_txg <= txg_to_consider) {
+
+               error = dsl_dataset_hold_obj(dp, snap_obj, FTAG, &ds);
+               if (error != 0)
+                       return (error);
+
+               if (dsl_dir_phys(ds->ds_dir)->dd_head_dataset_obj != fs) {
+                       snap_obj = dsl_dataset_phys(ds)->ds_prev_snap_obj;
+                       snap_obj_txg = dsl_dataset_phys(ds)->ds_prev_snap_txg;
+                       dsl_dataset_rele(ds, FTAG);
+                       continue;
+               }
+
+               boolean_t affected = B_TRUE;
+               if (check_snapshot) {
+                       uint64_t blk_txg;
+                       error = find_birth_txg(ds, zep, &blk_txg);
+
+                       /*
+                        * Scrub the snapshot also when zb_birth == 0 or when
+                        * find_birth_txg() returns an error.
+                        */
+                       affected = (error == 0 && zep->zb_birth == blk_txg) ||
+                           (error != 0) || (zep->zb_birth == 0);
+               }
+
+               /* Scrub snapshots. */
+               if (affected) {
+                       zbookmark_phys_t zb;
+                       zep_to_zb(snap_obj, zep, &zb);
+                       scn->scn_zio_root = zio_root(spa, NULL, NULL,
+                           ZIO_FLAG_CANFAIL);
+                       /* We have already acquired the config lock for spa */
+                       read_by_block_level(scn, zb);
+
+                       (void) zio_wait(scn->scn_zio_root);
+                       scn->scn_zio_root = NULL;
+
+                       scn->errorscrub_phys.dep_examined++;
+                       scn->errorscrub_phys.dep_to_examine--;
+                       (*count)++;
+                       if ((*count) == zfs_scrub_error_blocks_per_txg ||
+                           dsl_error_scrub_check_suspend(scn, &zb)) {
+                               dsl_dataset_rele(ds, FTAG);
+                               return (EFAULT);
+                       }
+               }
+               snap_obj_txg = dsl_dataset_phys(ds)->ds_prev_snap_txg;
+               snap_obj = dsl_dataset_phys(ds)->ds_prev_snap_obj;
+               dsl_dataset_rele(ds, FTAG);
+       }
+       return (0);
+}
+
+void
+dsl_errorscrub_sync(dsl_pool_t *dp, dmu_tx_t *tx)
+{
+       spa_t *spa = dp->dp_spa;
+       dsl_scan_t *scn = dp->dp_scan;
+
+       /*
+        * Only process scans in sync pass 1.
+        */
+
+       if (spa_sync_pass(spa) > 1)
+               return;
+
+       /*
+        * If the spa is shutting down, then stop scanning. This will
+        * ensure that the scan does not dirty any new data during the
+        * shutdown phase.
+        */
+       if (spa_shutting_down(spa))
+               return;
+
+       if (!dsl_errorscrub_active(scn) || dsl_errorscrub_is_paused(scn)) {
+               return;
+       }
+
+       if (dsl_scan_resilvering(scn->scn_dp)) {
+               /* cancel the error scrub if resilver started */
+               dsl_scan_cancel(scn->scn_dp);
+               return;
+       }
+
+       spa->spa_scrub_active = B_TRUE;
+       scn->scn_sync_start_time = gethrtime();
+
+       /*
+        * zfs_scan_suspend_progress can be set to disable scrub progress.
+        * See more detailed comment in dsl_scan_sync().
+        */
+       if (zfs_scan_suspend_progress) {
+               uint64_t scan_time_ns = gethrtime() - scn->scn_sync_start_time;
+               int mintime = zfs_scrub_min_time_ms;
+
+               while (zfs_scan_suspend_progress &&
+                   !txg_sync_waiting(scn->scn_dp) &&
+                   !spa_shutting_down(scn->scn_dp->dp_spa) &&
+                   NSEC2MSEC(scan_time_ns) < mintime) {
+                       delay(hz);
+                       scan_time_ns = gethrtime() - scn->scn_sync_start_time;
+               }
+               return;
+       }
+
+       int i = 0;
+       zap_attribute_t *za;
+       zbookmark_phys_t *zb;
+       boolean_t limit_exceeded = B_FALSE;
+
+       za = kmem_zalloc(sizeof (zap_attribute_t), KM_SLEEP);
+       zb = kmem_zalloc(sizeof (zbookmark_phys_t), KM_SLEEP);
+
+       if (!spa_feature_is_enabled(spa, SPA_FEATURE_HEAD_ERRLOG)) {
+               for (; zap_cursor_retrieve(&scn->errorscrub_cursor, za) == 0;
+                   zap_cursor_advance(&scn->errorscrub_cursor)) {
+                       name_to_bookmark(za->za_name, zb);
+
+                       scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
+                           NULL, ZIO_FLAG_CANFAIL);
+                       dsl_pool_config_enter(dp, FTAG);
+                       read_by_block_level(scn, *zb);
+                       dsl_pool_config_exit(dp, FTAG);
+
+                       (void) zio_wait(scn->scn_zio_root);
+                       scn->scn_zio_root = NULL;
+
+                       scn->errorscrub_phys.dep_examined += 1;
+                       scn->errorscrub_phys.dep_to_examine -= 1;
+                       i++;
+                       if (i == zfs_scrub_error_blocks_per_txg ||
+                           dsl_error_scrub_check_suspend(scn, zb)) {
+                               limit_exceeded = B_TRUE;
+                               break;
+                       }
+               }
+
+               if (!limit_exceeded)
+                       dsl_errorscrub_done(scn, B_TRUE, tx);
+
+               dsl_errorscrub_sync_state(scn, tx);
+               kmem_free(za, sizeof (*za));
+               kmem_free(zb, sizeof (*zb));
+               return;
+       }
+
+       int error = 0;
+       for (; zap_cursor_retrieve(&scn->errorscrub_cursor, za) == 0;
+           zap_cursor_advance(&scn->errorscrub_cursor)) {
+
+               zap_cursor_t *head_ds_cursor;
+               zap_attribute_t *head_ds_attr;
+               zbookmark_err_phys_t head_ds_block;
+
+               head_ds_cursor = kmem_zalloc(sizeof (zap_cursor_t), KM_SLEEP);
+               head_ds_attr = kmem_zalloc(sizeof (zap_attribute_t), KM_SLEEP);
+
+               uint64_t head_ds_err_obj = za->za_first_integer;
+               uint64_t head_ds;
+               name_to_object(za->za_name, &head_ds);
+               boolean_t config_held = B_FALSE;
+               uint64_t top_affected_fs;
+
+               for (zap_cursor_init(head_ds_cursor, spa->spa_meta_objset,
+                   head_ds_err_obj); zap_cursor_retrieve(head_ds_cursor,
+                   head_ds_attr) == 0; zap_cursor_advance(head_ds_cursor)) {
+
+                       name_to_errphys(head_ds_attr->za_name, &head_ds_block);
+
+                       /*
+                        * In case we are called from spa_sync the pool
+                        * config is already held.
+                        */
+                       if (!dsl_pool_config_held(dp)) {
+                               dsl_pool_config_enter(dp, FTAG);
+                               config_held = B_TRUE;
+                       }
+
+                       error = find_top_affected_fs(spa,
+                           head_ds, &head_ds_block, &top_affected_fs);
+                       if (error)
+                               break;
+
+                       error = scrub_filesystem(spa, top_affected_fs,
+                           &head_ds_block, &i);
+
+                       if (error == SET_ERROR(EFAULT)) {
+                               limit_exceeded = B_TRUE;
+                               break;
+                       }
+               }
+
+               zap_cursor_fini(head_ds_cursor);
+               kmem_free(head_ds_cursor, sizeof (*head_ds_cursor));
+               kmem_free(head_ds_attr, sizeof (*head_ds_attr));
+
+               if (config_held)
+                       dsl_pool_config_exit(dp, FTAG);
+       }
+
+       kmem_free(za, sizeof (*za));
+       kmem_free(zb, sizeof (*zb));
+       if (!limit_exceeded)
+               dsl_errorscrub_done(scn, B_TRUE, tx);
+
+       dsl_errorscrub_sync_state(scn, tx);
+}
+
 /*
  * This is the primary entry point for scans that is called from syncing
  * context. Scans must happen entirely during syncing context so that we
- * cna guarantee that blocks we are currently scanning will not change out
+ * can guarantee that blocks we are currently scanning will not change out
  * from under us. While a scan is active, this function controls how quickly
  * transaction groups proceed, instead of the normal handling provided by
  * txg_sync_thread().
@@ -3173,18 +4261,25 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
        spa_t *spa = dp->dp_spa;
        state_sync_type_t sync_type = SYNC_OPTIONAL;
 
+       if (spa->spa_resilver_deferred &&
+           !spa_feature_is_active(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER))
+               spa_feature_incr(spa, SPA_FEATURE_RESILVER_DEFER, tx);
+
        /*
         * Check for scn_restart_txg before checking spa_load_state, so
         * that we can restart an old-style scan while the pool is being
-        * imported (see dsl_scan_init).
+        * imported (see dsl_scan_init). We also restart scans if there
+        * is a deferred resilver and the user has manually disabled
+        * deferred resilvers via the tunable.
         */
-       if (dsl_scan_restarting(scn, tx)) {
+       if (dsl_scan_restarting(scn, tx) ||
+           (spa->spa_resilver_deferred && zfs_resilver_disable_defer)) {
                pool_scan_func_t func = POOL_SCAN_SCRUB;
                dsl_scan_done(scn, B_FALSE, tx);
                if (vdev_resilver_needed(spa->spa_root_vdev, NULL, NULL))
                        func = POOL_SCAN_RESILVER;
-               zfs_dbgmsg("restarting scan func=%u txg=%llu",
-                   func, (longlong_t)tx->tx_txg);
+               zfs_dbgmsg("restarting scan func=%u on %s txg=%llu",
+                   func, dp->dp_spa->spa_name, (longlong_t)tx->tx_txg);
                dsl_scan_setup_sync(&func, tx);
        }
 
@@ -3210,6 +4305,7 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
 
        /* reset scan statistics */
        scn->scn_visited_this_txg = 0;
+       scn->scn_dedup_frees_this_txg = 0;
        scn->scn_holes_this_txg = 0;
        scn->scn_lt_min_this_txg = 0;
        scn->scn_gt_max_this_txg = 0;
@@ -3244,6 +4340,38 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
        if (spa->spa_syncing_txg < spa->spa_first_txg + SCAN_IMPORT_WAIT_TXGS)
                return;
 
+       /*
+        * zfs_scan_suspend_progress can be set to disable scan progress.
+        * We don't want to spin the txg_sync thread, so we add a delay
+        * here to simulate the time spent doing a scan. This is mostly
+        * useful for testing and debugging.
+        */
+       if (zfs_scan_suspend_progress) {
+               uint64_t scan_time_ns = gethrtime() - scn->scn_sync_start_time;
+               uint_t mintime = (scn->scn_phys.scn_func ==
+                   POOL_SCAN_RESILVER) ? zfs_resilver_min_time_ms :
+                   zfs_scrub_min_time_ms;
+
+               while (zfs_scan_suspend_progress &&
+                   !txg_sync_waiting(scn->scn_dp) &&
+                   !spa_shutting_down(scn->scn_dp->dp_spa) &&
+                   NSEC2MSEC(scan_time_ns) < mintime) {
+                       delay(hz);
+                       scan_time_ns = gethrtime() - scn->scn_sync_start_time;
+               }
+               return;
+       }
+
+       /*
+        * Disabled by default, set zfs_scan_report_txgs to report
+        * average performance over the last zfs_scan_report_txgs TXGs.
+        */
+       if (zfs_scan_report_txgs != 0 &&
+           tx->tx_txg % zfs_scan_report_txgs == 0) {
+               scn->scn_issued_before_pass += spa->spa_scan_pass_issued;
+               spa_scan_stat_init(spa);
+       }
+
        /*
         * It is possible to switch from unsorted to sorted at any time,
         * but afterwards the scan will remain sorted unless reloaded from
@@ -3275,17 +4403,20 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
                    ddi_get_lbolt() - scn->scn_last_checkpoint >
                    SEC_TO_TICK(zfs_scan_checkpoint_intval)) {
                        if (!scn->scn_checkpointing)
-                               zfs_dbgmsg("begin scan checkpoint");
+                               zfs_dbgmsg("begin scan checkpoint for %s",
+                                   spa->spa_name);
 
                        scn->scn_checkpointing = B_TRUE;
                        scn->scn_clearing = B_TRUE;
                } else {
                        boolean_t should_clear = dsl_scan_should_clear(scn);
                        if (should_clear && !scn->scn_clearing) {
-                               zfs_dbgmsg("begin scan clearing");
+                               zfs_dbgmsg("begin scan clearing for %s",
+                                   spa->spa_name);
                                scn->scn_clearing = B_TRUE;
                        } else if (!should_clear && scn->scn_clearing) {
-                               zfs_dbgmsg("finish scan clearing");
+                               zfs_dbgmsg("finish scan clearing for %s",
+                                   spa->spa_name);
                                scn->scn_clearing = B_FALSE;
                        }
                }
@@ -3298,30 +4429,31 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
                /* Need to scan metadata for more blocks to scrub */
                dsl_scan_phys_t *scnp = &scn->scn_phys;
                taskqid_t prefetch_tqid;
-               uint64_t bytes_per_leaf = zfs_scan_vdev_limit;
-               uint64_t nr_leaves = dsl_scan_count_leaves(spa->spa_root_vdev);
 
                /*
-                * Recalculate the max number of in-flight bytes for pool-wide
-                * scanning operations (minimum 1MB). Limits for the issuing
-                * phase are done per top-level vdev and are handled separately.
+                * Calculate the max number of in-flight bytes for pool-wide
+                * scanning operations (minimum 1MB, maximum 1/4 of arc_c_max).
+                * Limits for the issuing phase are done per top-level vdev and
+                * are handled separately.
                 */
-               scn->scn_maxinflight_bytes =
-                   MAX(nr_leaves * bytes_per_leaf, 1ULL << 20);
+               scn->scn_maxinflight_bytes = MIN(arc_c_max / 4, MAX(1ULL << 20,
+                   zfs_scan_vdev_limit * dsl_scan_count_data_disks(spa)));
 
                if (scnp->scn_ddt_bookmark.ddb_class <=
                    scnp->scn_ddt_class_max) {
                        ASSERT(ZB_IS_ZERO(&scnp->scn_bookmark));
-                       zfs_dbgmsg("doing scan sync txg %llu; "
+                       zfs_dbgmsg("doing scan sync for %s txg %llu; "
                            "ddt bm=%llu/%llu/%llu/%llx",
+                           spa->spa_name,
                            (longlong_t)tx->tx_txg,
                            (longlong_t)scnp->scn_ddt_bookmark.ddb_class,
                            (longlong_t)scnp->scn_ddt_bookmark.ddb_type,
                            (longlong_t)scnp->scn_ddt_bookmark.ddb_checksum,
                            (longlong_t)scnp->scn_ddt_bookmark.ddb_cursor);
                } else {
-                       zfs_dbgmsg("doing scan sync txg %llu; "
+                       zfs_dbgmsg("doing scan sync for %s txg %llu; "
                            "bm=%llu/%llu/%llu/%llu",
+                           spa->spa_name,
                            (longlong_t)tx->tx_txg,
                            (longlong_t)scnp->scn_bookmark.zb_objset,
                            (longlong_t)scnp->scn_bookmark.zb_object,
@@ -3350,10 +4482,11 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
                (void) zio_wait(scn->scn_zio_root);
                scn->scn_zio_root = NULL;
 
-               zfs_dbgmsg("scan visited %llu blocks in %llums "
+               zfs_dbgmsg("scan visited %llu blocks of %s in %llums "
                    "(%llu os's, %llu holes, %llu < mintxg, "
                    "%llu in ddt, %llu > maxtxg)",
                    (longlong_t)scn->scn_visited_this_txg,
+                   spa->spa_name,
                    (longlong_t)NSEC2MSEC(gethrtime() -
                    scn->scn_sync_start_time),
                    (longlong_t)scn->scn_objsets_visited_this_txg,
@@ -3368,11 +4501,17 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
                        if (scn->scn_is_sorted) {
                                scn->scn_checkpointing = B_TRUE;
                                scn->scn_clearing = B_TRUE;
+                               scn->scn_issued_before_pass +=
+                                   spa->spa_scan_pass_issued;
+                               spa_scan_stat_init(spa);
                        }
-                       zfs_dbgmsg("scan complete txg %llu",
+                       zfs_dbgmsg("scan complete for %s txg %llu",
+                           spa->spa_name,
                            (longlong_t)tx->tx_txg);
                }
-       } else if (scn->scn_is_sorted && scn->scn_bytes_pending != 0) {
+       } else if (scn->scn_is_sorted && scn->scn_queues_pending != 0) {
+               ASSERT(scn->scn_clearing);
+
                /* need to issue scrubbing IOs from per-vdev queues */
                scn->scn_zio_root = zio_root(dp->dp_spa, NULL,
                    NULL, ZIO_FLAG_CANFAIL);
@@ -3384,9 +4523,10 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
                (void) dsl_scan_should_clear(scn);
                dsl_scan_update_stats(scn);
 
-               zfs_dbgmsg("scan issued %llu blocks (%llu segs) in %llums "
-                   "(avg_block_size = %llu, avg_seg_size = %llu)",
+               zfs_dbgmsg("scan issued %llu blocks for %s (%llu segs) "
+                   "in %llums (avg_block_size = %llu, avg_seg_size = %llu)",
                    (longlong_t)scn->scn_zios_this_txg,
+                   spa->spa_name,
                    (longlong_t)scn->scn_segs_this_txg,
                    (longlong_t)NSEC2MSEC(gethrtime() -
                    scn->scn_sync_start_time),
@@ -3394,11 +4534,12 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
                    (longlong_t)scn->scn_avg_seg_size_this_txg);
        } else if (scn->scn_done_txg != 0 && scn->scn_done_txg <= tx->tx_txg) {
                /* Finished with everything. Mark the scrub as complete */
-               zfs_dbgmsg("scan issuing complete txg %llu",
-                   (longlong_t)tx->tx_txg);
+               zfs_dbgmsg("scan issuing complete txg %llu for %s",
+                   (longlong_t)tx->tx_txg,
+                   spa->spa_name);
                ASSERT3U(scn->scn_done_txg, !=, 0);
                ASSERT0(spa->spa_scrub_inflight);
-               ASSERT0(scn->scn_bytes_pending);
+               ASSERT0(scn->scn_queues_pending);
                dsl_scan_done(scn, B_TRUE, tx);
                sync_type = SYNC_MANDATORY;
        }
@@ -3407,16 +4548,38 @@ dsl_scan_sync(dsl_pool_t *dp, dmu_tx_t *tx)
 }
 
 static void
-count_block(dsl_scan_t *scn, zfs_all_blkstats_t *zab, const blkptr_t *bp)
+count_block_issued(spa_t *spa, const blkptr_t *bp, boolean_t all)
 {
-       int i;
+       /*
+        * Don't count embedded bp's, since we already did the work of
+        * scanning these when we scanned the containing block.
+        */
+       if (BP_IS_EMBEDDED(bp))
+               return;
 
-       /* update the spa's stats on how many bytes we have issued */
-       for (i = 0; i < BP_GET_NDVAS(bp); i++) {
-               atomic_add_64(&scn->scn_dp->dp_spa->spa_scan_pass_issued,
-                   DVA_GET_ASIZE(&bp->blk_dva[i]));
-       }
+       /*
+        * Update the spa's stats on how many bytes we have issued.
+        * Sequential scrubs create a zio for each DVA of the bp. Each
+        * of these will include all DVAs for repair purposes, but the
+        * zio code will only try the first one unless there is an issue.
+        * Therefore, we should only count the first DVA for these IOs.
+        */
+       atomic_add_64(&spa->spa_scan_pass_issued,
+           all ? BP_GET_ASIZE(bp) : DVA_GET_ASIZE(&bp->blk_dva[0]));
+}
+
+static void
+count_block_skipped(dsl_scan_t *scn, const blkptr_t *bp, boolean_t all)
+{
+       if (BP_IS_EMBEDDED(bp))
+               return;
+       atomic_add_64(&scn->scn_phys.scn_skipped,
+           all ? BP_GET_ASIZE(bp) : DVA_GET_ASIZE(&bp->blk_dva[0]));
+}
 
+static void
+count_block(zfs_all_blkstats_t *zab, const blkptr_t *bp)
+{
        /*
         * If we resume after a reboot, zab will be NULL; don't record
         * incomplete stats in that case.
@@ -3424,9 +4587,7 @@ count_block(dsl_scan_t *scn, zfs_all_blkstats_t *zab, const blkptr_t *bp)
        if (zab == NULL)
                return;
 
-       mutex_enter(&zab->zab_lock);
-
-       for (i = 0; i < 4; i++) {
+       for (int i = 0; i < 4; i++) {
                int l = (i < 2) ? BP_GET_LEVEL(bp) : DN_MAX_LEVELS;
                int t = (i & 1) ? BP_GET_TYPE(bp) : DMU_OT_TOTAL;
 
@@ -3461,27 +4622,27 @@ count_block(dsl_scan_t *scn, zfs_all_blkstats_t *zab, const blkptr_t *bp)
                        break;
                }
        }
-
-       mutex_exit(&zab->zab_lock);
 }
 
 static void
 scan_io_queue_insert_impl(dsl_scan_io_queue_t *queue, scan_io_t *sio)
 {
        avl_index_t idx;
-       int64_t asize = sio->sio_asize;
        dsl_scan_t *scn = queue->q_scn;
 
        ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
 
+       if (unlikely(avl_is_empty(&queue->q_sios_by_addr)))
+               atomic_add_64(&scn->scn_queues_pending, 1);
        if (avl_find(&queue->q_sios_by_addr, sio, &idx) != NULL) {
                /* block is already scheduled for reading */
-               atomic_add_64(&scn->scn_bytes_pending, -asize);
-               kmem_cache_free(sio_cache, sio);
+               sio_free(sio);
                return;
        }
        avl_insert(&queue->q_sios_by_addr, sio, idx);
-       range_tree_add(queue->q_exts_by_addr, sio->sio_offset, asize);
+       queue->q_sio_memused += SIO_GET_MUSED(sio);
+       range_tree_add(queue->q_exts_by_addr, SIO_GET_OFFSET(sio),
+           SIO_GET_ASIZE(sio));
 }
 
 /*
@@ -3494,8 +4655,7 @@ static void
 scan_io_queue_insert(dsl_scan_io_queue_t *queue, const blkptr_t *bp, int dva_i,
     int zio_flags, const zbookmark_phys_t *zb)
 {
-       dsl_scan_t *scn = queue->q_scn;
-       scan_io_t *sio = kmem_cache_alloc(sio_cache, KM_SLEEP);
+       scan_io_t *sio = sio_alloc(BP_GET_NDVAS(bp));
 
        ASSERT0(BP_IS_GANG(bp));
        ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
@@ -3504,13 +4664,7 @@ scan_io_queue_insert(dsl_scan_io_queue_t *queue, const blkptr_t *bp, int dva_i,
        sio->sio_flags = zio_flags;
        sio->sio_zb = *zb;
 
-       /*
-        * Increment the bytes pending counter now so that we can't
-        * get an integer underflow in case the worker processes the
-        * zio before we get to incrementing this counter.
-        */
-       atomic_add_64(&scn->scn_bytes_pending, sio->sio_asize);
-
+       queue->q_last_ext_addr = -1;
        scan_io_queue_insert_impl(queue, sio);
 }
 
@@ -3565,11 +4719,12 @@ dsl_scan_scrub_cb(dsl_pool_t *dp,
        boolean_t needs_io = B_FALSE;
        int zio_flags = ZIO_FLAG_SCAN_THREAD | ZIO_FLAG_RAW | ZIO_FLAG_CANFAIL;
 
-       count_block(scn, dp->dp_blkstats, bp);
-
+       count_block(dp->dp_blkstats, bp);
        if (phys_birth <= scn->scn_phys.scn_min_txg ||
-           phys_birth >= scn->scn_phys.scn_max_txg)
+           phys_birth >= scn->scn_phys.scn_max_txg) {
+               count_block_skipped(scn, bp, B_TRUE);
                return (0);
+       }
 
        /* Embedded BP's have phys_birth==0, so we reject them above. */
        ASSERT(!BP_IS_EMBEDDED(bp));
@@ -3593,10 +4748,11 @@ dsl_scan_scrub_cb(dsl_pool_t *dp,
 
                /*
                 * Keep track of how much data we've examined so that
-                * zpool(1M) status can make useful progress reports.
+                * zpool(8) status can make useful progress reports.
                 */
-               scn->scn_phys.scn_examined += DVA_GET_ASIZE(dva);
-               spa->spa_scan_pass_exam += DVA_GET_ASIZE(dva);
+               uint64_t asize = DVA_GET_ASIZE(dva);
+               scn->scn_phys.scn_examined += asize;
+               spa->spa_scan_pass_exam += asize;
 
                /* if it's a resilver, this may not be in the target range */
                if (!needs_io)
@@ -3607,7 +4763,7 @@ dsl_scan_scrub_cb(dsl_pool_t *dp,
        if (needs_io && !zfs_no_scrub_io) {
                dsl_scan_enqueue(dp, bp, zio_flags, zb);
        } else {
-               count_block(scn, dp->dp_blkstats, bp);
+               count_block_skipped(scn, bp, B_TRUE);
        }
 
        /* do not relocate this block */
@@ -3639,7 +4795,14 @@ dsl_scan_scrub_done(zio_t *zio)
 
        if (zio->io_error && (zio->io_error != ECKSUM ||
            !(zio->io_flags & ZIO_FLAG_SPECULATIVE))) {
-               atomic_inc_64(&spa->spa_dsl_pool->dp_scan->scn_phys.scn_errors);
+               if (dsl_errorscrubbing(spa->spa_dsl_pool) &&
+                   !dsl_errorscrub_is_paused(spa->spa_dsl_pool->dp_scan)) {
+                       atomic_inc_64(&spa->spa_dsl_pool->dp_scan
+                           ->errorscrub_phys.dep_errors);
+               } else {
+                       atomic_inc_64(&spa->spa_dsl_pool->dp_scan->scn_phys
+                           .scn_errors);
+               }
        }
 }
 
@@ -3658,28 +4821,32 @@ scan_exec_io(dsl_pool_t *dp, const blkptr_t *bp, int zio_flags,
        dsl_scan_t *scn = dp->dp_scan;
        size_t size = BP_GET_PSIZE(bp);
        abd_t *data = abd_alloc_for_io(size, B_FALSE);
-
-       ASSERT3U(scn->scn_maxinflight_bytes, >, 0);
+       zio_t *pio;
 
        if (queue == NULL) {
+               ASSERT3U(scn->scn_maxinflight_bytes, >, 0);
                mutex_enter(&spa->spa_scrub_lock);
                while (spa->spa_scrub_inflight >= scn->scn_maxinflight_bytes)
                        cv_wait(&spa->spa_scrub_io_cv, &spa->spa_scrub_lock);
                spa->spa_scrub_inflight += BP_GET_PSIZE(bp);
                mutex_exit(&spa->spa_scrub_lock);
+               pio = scn->scn_zio_root;
        } else {
                kmutex_t *q_lock = &queue->q_vd->vdev_scan_io_queue_lock;
 
+               ASSERT3U(queue->q_maxinflight_bytes, >, 0);
                mutex_enter(q_lock);
                while (queue->q_inflight_bytes >= queue->q_maxinflight_bytes)
                        cv_wait(&queue->q_zio_cv, q_lock);
                queue->q_inflight_bytes += BP_GET_PSIZE(bp);
+               pio = queue->q_zio;
                mutex_exit(q_lock);
        }
 
-       count_block(scn, dp->dp_blkstats, bp);
-       zio_nowait(zio_read(scn->scn_zio_root, spa, bp, data, size,
-           dsl_scan_scrub_done, queue, ZIO_PRIORITY_SCRUB, zio_flags, zb));
+       ASSERT(pio != NULL);
+       count_block_issued(spa, bp, queue == NULL);
+       zio_nowait(zio_read(pio, spa, bp, data, size, dsl_scan_scrub_done,
+           queue, ZIO_PRIORITY_SCRUB, zio_flags, zb));
 }
 
 /*
@@ -3712,33 +4879,94 @@ scan_exec_io(dsl_pool_t *dp, const blkptr_t *bp, int zio_flags,
  * As can be seen, at fill_ratio=3, the algorithm is slightly biased towards
  * extents that are more completely filled (in a 3:2 ratio) vs just larger.
  * Note that as an optimization, we replace multiplication and division by
- * 100 with bitshifting by 7 (which effecitvely multiplies and divides by 128).
+ * 100 with bitshifting by 7 (which effectively multiplies and divides by 128).
+ *
+ * Since we do not care if one extent is only few percent better than another,
+ * compress the score into 6 bits via binary logarithm AKA highbit64() and
+ * put into otherwise unused due to ashift high bits of offset.  This allows
+ * to reduce q_exts_by_size B-tree elements to only 64 bits and compare them
+ * with single operation.  Plus it makes scrubs more sequential and reduces
+ * chances that minor extent change move it within the B-tree.
  */
+__attribute__((always_inline)) inline
 static int
 ext_size_compare(const void *x, const void *y)
 {
-       const range_seg_t *rsa = x, *rsb = y;
-       uint64_t sa = rsa->rs_end - rsa->rs_start,
-           sb = rsb->rs_end - rsb->rs_start;
-       uint64_t score_a, score_b;
+       const uint64_t *a = x, *b = y;
 
-       score_a = rsa->rs_fill + ((((rsa->rs_fill << 7) / sa) *
-           fill_weight * rsa->rs_fill) >> 7);
-       score_b = rsb->rs_fill + ((((rsb->rs_fill << 7) / sb) *
-           fill_weight * rsb->rs_fill) >> 7);
+       return (TREE_CMP(*a, *b));
+}
 
-       if (score_a > score_b)
-               return (-1);
-       if (score_a == score_b) {
-               if (rsa->rs_start < rsb->rs_start)
-                       return (-1);
-               if (rsa->rs_start == rsb->rs_start)
-                       return (0);
-               return (1);
-       }
-       return (1);
+ZFS_BTREE_FIND_IN_BUF_FUNC(ext_size_find_in_buf, uint64_t,
+    ext_size_compare)
+
+static void
+ext_size_create(range_tree_t *rt, void *arg)
+{
+       (void) rt;
+       zfs_btree_t *size_tree = arg;
+
+       zfs_btree_create(size_tree, ext_size_compare, ext_size_find_in_buf,
+           sizeof (uint64_t));
+}
+
+static void
+ext_size_destroy(range_tree_t *rt, void *arg)
+{
+       (void) rt;
+       zfs_btree_t *size_tree = arg;
+       ASSERT0(zfs_btree_numnodes(size_tree));
+
+       zfs_btree_destroy(size_tree);
 }
 
+static uint64_t
+ext_size_value(range_tree_t *rt, range_seg_gap_t *rsg)
+{
+       (void) rt;
+       uint64_t size = rsg->rs_end - rsg->rs_start;
+       uint64_t score = rsg->rs_fill + ((((rsg->rs_fill << 7) / size) *
+           fill_weight * rsg->rs_fill) >> 7);
+       ASSERT3U(rt->rt_shift, >=, 8);
+       return (((uint64_t)(64 - highbit64(score)) << 56) | rsg->rs_start);
+}
+
+static void
+ext_size_add(range_tree_t *rt, range_seg_t *rs, void *arg)
+{
+       zfs_btree_t *size_tree = arg;
+       ASSERT3U(rt->rt_type, ==, RANGE_SEG_GAP);
+       uint64_t v = ext_size_value(rt, (range_seg_gap_t *)rs);
+       zfs_btree_add(size_tree, &v);
+}
+
+static void
+ext_size_remove(range_tree_t *rt, range_seg_t *rs, void *arg)
+{
+       zfs_btree_t *size_tree = arg;
+       ASSERT3U(rt->rt_type, ==, RANGE_SEG_GAP);
+       uint64_t v = ext_size_value(rt, (range_seg_gap_t *)rs);
+       zfs_btree_remove(size_tree, &v);
+}
+
+static void
+ext_size_vacate(range_tree_t *rt, void *arg)
+{
+       zfs_btree_t *size_tree = arg;
+       zfs_btree_clear(size_tree);
+       zfs_btree_destroy(size_tree);
+
+       ext_size_create(rt, arg);
+}
+
+static const range_tree_ops_t ext_size_ops = {
+       .rtop_create = ext_size_create,
+       .rtop_destroy = ext_size_destroy,
+       .rtop_add = ext_size_add,
+       .rtop_remove = ext_size_remove,
+       .rtop_vacate = ext_size_vacate
+};
+
 /*
  * Comparator for the q_sios_by_addr tree. Sorting is simply performed
  * based on LBA-order (from lowest to highest).
@@ -3748,11 +4976,7 @@ sio_addr_compare(const void *x, const void *y)
 {
        const scan_io_t *a = x, *b = y;
 
-       if (a->sio_offset < b->sio_offset)
-               return (-1);
-       if (a->sio_offset == b->sio_offset)
-               return (0);
-       return (1);
+       return (TREE_CMP(SIO_GET_OFFSET(a), SIO_GET_OFFSET(b)));
 }
 
 /* IO queues are created on demand when they are needed. */
@@ -3764,9 +4988,11 @@ scan_io_queue_create(vdev_t *vd)
 
        q->q_scn = scn;
        q->q_vd = vd;
+       q->q_sio_memused = 0;
+       q->q_last_ext_addr = -1;
        cv_init(&q->q_zio_cv, NULL, CV_DEFAULT, NULL);
-       q->q_exts_by_addr = range_tree_create_impl(&rt_avl_ops,
-           &q->q_exts_by_size, ext_size_compare, zfs_scan_max_ext_gap);
+       q->q_exts_by_addr = range_tree_create_gap(&ext_size_ops, RANGE_SEG_GAP,
+           &q->q_exts_by_size, 0, vd->vdev_ashift, zfs_scan_max_ext_gap);
        avl_create(&q->q_sios_by_addr, sio_addr_compare,
            sizeof (scan_io_t), offsetof(scan_io_t, sio_nodes.sio_addr_node));
 
@@ -3784,19 +5010,20 @@ dsl_scan_io_queue_destroy(dsl_scan_io_queue_t *queue)
        dsl_scan_t *scn = queue->q_scn;
        scan_io_t *sio;
        void *cookie = NULL;
-       int64_t bytes_dequeued = 0;
 
        ASSERT(MUTEX_HELD(&queue->q_vd->vdev_scan_io_queue_lock));
 
+       if (!avl_is_empty(&queue->q_sios_by_addr))
+               atomic_add_64(&scn->scn_queues_pending, -1);
        while ((sio = avl_destroy_nodes(&queue->q_sios_by_addr, &cookie)) !=
            NULL) {
                ASSERT(range_tree_contains(queue->q_exts_by_addr,
-                   sio->sio_offset, sio->sio_asize));
-               bytes_dequeued += sio->sio_asize;
-               kmem_cache_free(sio_cache, sio);
+                   SIO_GET_OFFSET(sio), SIO_GET_ASIZE(sio)));
+               queue->q_sio_memused -= SIO_GET_MUSED(sio);
+               sio_free(sio);
        }
 
-       atomic_add_64(&scn->scn_bytes_pending, -bytes_dequeued);
+       ASSERT0(queue->q_sio_memused);
        range_tree_vacate(queue->q_exts_by_addr, NULL, queue);
        range_tree_destroy(queue->q_exts_by_addr);
        avl_destroy(&queue->q_sios_by_addr);
@@ -3850,7 +5077,7 @@ dsl_scan_freed_dva(spa_t *spa, const blkptr_t *bp, int dva_i)
        vdev_t *vdev;
        kmutex_t *q_lock;
        dsl_scan_io_queue_t *queue;
-       scan_io_t srch, *sio;
+       scan_io_t *srch_sio, *sio;
        avl_index_t idx;
        uint64_t start, size;
 
@@ -3865,9 +5092,10 @@ dsl_scan_freed_dva(spa_t *spa, const blkptr_t *bp, int dva_i)
                return;
        }
 
-       bp2sio(bp, &srch, dva_i);
-       start = srch.sio_offset;
-       size = srch.sio_asize;
+       srch_sio = sio_alloc(BP_GET_NDVAS(bp));
+       bp2sio(bp, srch_sio, dva_i);
+       start = SIO_GET_OFFSET(srch_sio);
+       size = SIO_GET_ASIZE(srch_sio);
 
        /*
         * We can find the zio in two states:
@@ -3887,31 +5115,28 @@ dsl_scan_freed_dva(spa_t *spa, const blkptr_t *bp, int dva_i)
         *      be done with issuing the zio's it gathered and will
         *      signal us.
         */
-       sio = avl_find(&queue->q_sios_by_addr, &srch, &idx);
+       sio = avl_find(&queue->q_sios_by_addr, srch_sio, &idx);
+       sio_free(srch_sio);
+
        if (sio != NULL) {
-               int64_t asize = sio->sio_asize;
                blkptr_t tmpbp;
 
                /* Got it while it was cold in the queue */
-               ASSERT3U(start, ==, sio->sio_offset);
-               ASSERT3U(size, ==, asize);
+               ASSERT3U(start, ==, SIO_GET_OFFSET(sio));
+               ASSERT3U(size, ==, SIO_GET_ASIZE(sio));
                avl_remove(&queue->q_sios_by_addr, sio);
+               if (avl_is_empty(&queue->q_sios_by_addr))
+                       atomic_add_64(&scn->scn_queues_pending, -1);
+               queue->q_sio_memused -= SIO_GET_MUSED(sio);
 
                ASSERT(range_tree_contains(queue->q_exts_by_addr, start, size));
                range_tree_remove_fill(queue->q_exts_by_addr, start, size);
 
-               /*
-                * We only update scn_bytes_pending in the cold path,
-                * otherwise it will already have been accounted for as
-                * part of the zio's execution.
-                */
-               atomic_add_64(&scn->scn_bytes_pending, -asize);
-
-               /* count the block as though we issued it */
-               sio2bp(sio, &tmpbp, dva_i);
-               count_block(scn, dp->dp_blkstats, &tmpbp);
+               /* count the block as though we skipped it */
+               sio2bp(sio, &tmpbp);
+               count_block_skipped(scn, &tmpbp, B_FALSE);
 
-               kmem_cache_free(sio_cache, sio);
+               sio_free(sio);
        }
        mutex_exit(q_lock);
 }
@@ -3937,66 +5162,102 @@ dsl_scan_freed(spa_t *spa, const blkptr_t *bp)
                dsl_scan_freed_dva(spa, bp, i);
 }
 
-#if defined(_KERNEL)
-/* CSTYLED */
-module_param(zfs_scan_vdev_limit, ulong, 0644);
-MODULE_PARM_DESC(zfs_scan_vdev_limit,
+/*
+ * Check if a vdev needs resilvering (non-empty DTL), if so, and resilver has
+ * not started, start it. Otherwise, only restart if max txg in DTL range is
+ * greater than the max txg in the current scan. If the DTL max is less than
+ * the scan max, then the vdev has not missed any new data since the resilver
+ * started, so a restart is not needed.
+ */
+void
+dsl_scan_assess_vdev(dsl_pool_t *dp, vdev_t *vd)
+{
+       uint64_t min, max;
+
+       if (!vdev_resilver_needed(vd, &min, &max))
+               return;
+
+       if (!dsl_scan_resilvering(dp)) {
+               spa_async_request(dp->dp_spa, SPA_ASYNC_RESILVER);
+               return;
+       }
+
+       if (max <= dp->dp_scan->scn_phys.scn_max_txg)
+               return;
+
+       /* restart is needed, check if it can be deferred */
+       if (spa_feature_is_enabled(dp->dp_spa, SPA_FEATURE_RESILVER_DEFER))
+               vdev_defer_resilver(vd);
+       else
+               spa_async_request(dp->dp_spa, SPA_ASYNC_RESILVER);
+}
+
+ZFS_MODULE_PARAM(zfs, zfs_, scan_vdev_limit, U64, ZMOD_RW,
        "Max bytes in flight per leaf vdev for scrubs and resilvers");
 
-module_param(zfs_scrub_min_time_ms, int, 0644);
-MODULE_PARM_DESC(zfs_scrub_min_time_ms, "Min millisecs to scrub per txg");
+ZFS_MODULE_PARAM(zfs, zfs_, scrub_min_time_ms, UINT, ZMOD_RW,
+       "Min millisecs to scrub per txg");
+
+ZFS_MODULE_PARAM(zfs, zfs_, obsolete_min_time_ms, UINT, ZMOD_RW,
+       "Min millisecs to obsolete per txg");
 
-module_param(zfs_obsolete_min_time_ms, int, 0644);
-MODULE_PARM_DESC(zfs_obsolete_min_time_ms, "Min millisecs to obsolete per txg");
+ZFS_MODULE_PARAM(zfs, zfs_, free_min_time_ms, UINT, ZMOD_RW,
+       "Min millisecs to free per txg");
 
-module_param(zfs_free_min_time_ms, int, 0644);
-MODULE_PARM_DESC(zfs_free_min_time_ms, "Min millisecs to free per txg");
+ZFS_MODULE_PARAM(zfs, zfs_, resilver_min_time_ms, UINT, ZMOD_RW,
+       "Min millisecs to resilver per txg");
 
-module_param(zfs_resilver_min_time_ms, int, 0644);
-MODULE_PARM_DESC(zfs_resilver_min_time_ms, "Min millisecs to resilver per txg");
+ZFS_MODULE_PARAM(zfs, zfs_, scan_suspend_progress, INT, ZMOD_RW,
+       "Set to prevent scans from progressing");
 
-module_param(zfs_no_scrub_io, int, 0644);
-MODULE_PARM_DESC(zfs_no_scrub_io, "Set to disable scrub I/O");
+ZFS_MODULE_PARAM(zfs, zfs_, no_scrub_io, INT, ZMOD_RW,
+       "Set to disable scrub I/O");
 
-module_param(zfs_no_scrub_prefetch, int, 0644);
-MODULE_PARM_DESC(zfs_no_scrub_prefetch, "Set to disable scrub prefetching");
+ZFS_MODULE_PARAM(zfs, zfs_, no_scrub_prefetch, INT, ZMOD_RW,
+       "Set to disable scrub prefetching");
 
-/* CSTYLED */
-module_param(zfs_async_block_max_blocks, ulong, 0644);
-MODULE_PARM_DESC(zfs_async_block_max_blocks,
+ZFS_MODULE_PARAM(zfs, zfs_, async_block_max_blocks, U64, ZMOD_RW,
        "Max number of blocks freed in one txg");
 
-module_param(zfs_free_bpobj_enabled, int, 0644);
-MODULE_PARM_DESC(zfs_free_bpobj_enabled, "Enable processing of the free_bpobj");
+ZFS_MODULE_PARAM(zfs, zfs_, max_async_dedup_frees, U64, ZMOD_RW,
+       "Max number of dedup blocks freed in one txg");
 
-module_param(zfs_scan_mem_lim_fact, int, 0644);
-MODULE_PARM_DESC(zfs_scan_mem_lim_fact, "Fraction of RAM for scan hard limit");
+ZFS_MODULE_PARAM(zfs, zfs_, free_bpobj_enabled, INT, ZMOD_RW,
+       "Enable processing of the free_bpobj");
 
-module_param(zfs_scan_issue_strategy, int, 0644);
-MODULE_PARM_DESC(zfs_scan_issue_strategy,
+ZFS_MODULE_PARAM(zfs, zfs_, scan_blkstats, INT, ZMOD_RW,
+       "Enable block statistics calculation during scrub");
+
+ZFS_MODULE_PARAM(zfs, zfs_, scan_mem_lim_fact, UINT, ZMOD_RW,
+       "Fraction of RAM for scan hard limit");
+
+ZFS_MODULE_PARAM(zfs, zfs_, scan_issue_strategy, UINT, ZMOD_RW,
        "IO issuing strategy during scrubbing. 0 = default, 1 = LBA, 2 = size");
 
-module_param(zfs_scan_legacy, int, 0644);
-MODULE_PARM_DESC(zfs_scan_legacy, "Scrub using legacy non-sequential method");
+ZFS_MODULE_PARAM(zfs, zfs_, scan_legacy, INT, ZMOD_RW,
+       "Scrub using legacy non-sequential method");
 
-module_param(zfs_scan_checkpoint_intval, int, 0644);
-MODULE_PARM_DESC(zfs_scan_checkpoint_intval,
+ZFS_MODULE_PARAM(zfs, zfs_, scan_checkpoint_intval, UINT, ZMOD_RW,
        "Scan progress on-disk checkpointing interval");
 
-/* CSTYLED */
-module_param(zfs_scan_max_ext_gap, ulong, 0644);
-MODULE_PARM_DESC(zfs_scan_max_ext_gap,
+ZFS_MODULE_PARAM(zfs, zfs_, scan_max_ext_gap, U64, ZMOD_RW,
        "Max gap in bytes between sequential scrub / resilver I/Os");
 
-module_param(zfs_scan_mem_lim_soft_fact, int, 0644);
-MODULE_PARM_DESC(zfs_scan_mem_lim_soft_fact,
+ZFS_MODULE_PARAM(zfs, zfs_, scan_mem_lim_soft_fact, UINT, ZMOD_RW,
        "Fraction of hard limit used as soft limit");
 
-module_param(zfs_scan_strict_mem_lim, int, 0644);
-MODULE_PARM_DESC(zfs_scan_strict_mem_lim,
+ZFS_MODULE_PARAM(zfs, zfs_, scan_strict_mem_lim, INT, ZMOD_RW,
        "Tunable to attempt to reduce lock contention");
 
-module_param(zfs_scan_fill_weight, int, 0644);
-MODULE_PARM_DESC(zfs_scan_fill_weight,
+ZFS_MODULE_PARAM(zfs, zfs_, scan_fill_weight, UINT, ZMOD_RW,
        "Tunable to adjust bias towards more filled segments during scans");
-#endif
+
+ZFS_MODULE_PARAM(zfs, zfs_, scan_report_txgs, UINT, ZMOD_RW,
+       "Tunable to report resilver performance over the last N txgs");
+
+ZFS_MODULE_PARAM(zfs, zfs_, resilver_disable_defer, INT, ZMOD_RW,
+       "Process all resilvers immediately");
+
+ZFS_MODULE_PARAM(zfs, zfs_, scrub_error_blocks_per_txg, UINT, ZMOD_RW,
+       "Error blocks to be scrubbed in one txg");
+/* END CSTYLED */