--- a/usr/src/uts/common/fs/zfs/zio.c	Sat Jun 07 18:59:39 2008 -0700
+++ b/usr/src/uts/common/fs/zfs/zio.c	Mon Jun 09 14:58:17 2008 +0100
@@ -1457,7 +1457,7 @@
 	int crypt = zio->io_crypt;
 	int crypt_error;
 	blkptr_t *bp = zio->io_bp;
-	void *mac = NULL;
+	zio_cksum_t *mac = NULL;
 	size_t maclen;
 	void *cbuf;
 	uint64_t cbufsize;
@@ -1490,14 +1490,14 @@
 	 * is needed.  The io_txg is used by some mechansims as input
 	 * into the IV generation routine.
 	 *
-	 * If the algorithm has a mac we store it in the lower part of
-	 * the bp checksum. Note we don't need to pass in the length of
-	 * the mac since it is already checked for in zio_encrypt_data.
+	 * Note we don't need to pass in the length of the mac since 
+	 * it is already checked for in zio_encrypt_data.
 	 * Caller of zio_encrypt_data is responsible for freeing buffers
 	 * including the mac.
 	 */
 	crypt_error = zio_encrypt_data(crypt, zio->io_spa, &zio->io_bookmark,
-	    zio->io_txg, zio->io_data, zio->io_size, &cbuf, &cbufsize, &mac);
+	    zio->io_txg, zio->io_data, zio->io_size, &cbuf, &cbufsize,
+	    (void **)&mac);
 
 	/*
 	 * One possible failure is not having access to the
@@ -1515,13 +1515,15 @@
 		return (ZIO_PIPELINE_STOP);
 	}
 
+	/*
+	 * The mac is stored in the blkptr as the top two words of the checksum.
+	 */
 	maclen = zio_crypt_table[crypt].ci_maclen;
-	if (maclen != 0) {
-		ASSERT3U(maclen, <=, 16);
-		ASSERT3U((uintptr_t)mac, !=, NULL);
-		bcopy(mac, &bp->blk_cksum.zc_word[0], maclen);
-		kmem_free(mac, maclen);
-	}
+	ASSERT3U(maclen, ==, 16);
+	ASSERT3U((uintptr_t)mac, !=, NULL);
+	bp->blk_cksum.zc_word[2] = BE_64(mac->zc_word[0]);
+	bp->blk_cksum.zc_word[3] = BE_64(mac->zc_word[1]);
+	kmem_free(mac, maclen);
 
 	zio_push_transform(zio, cbuf, cbufsize, cbufsize);
 	BP_SET_CRYPT(zio->io_bp, crypt);
@@ -1537,6 +1539,7 @@
 	void *data;
 	uint64_t size;
 	uint64_t bufsize;
+	uint64_t mac[2];
 	int crypt_error;
 
 	if (spa_version(zio->io_spa) < SPA_VERSION_CRYPTO)
@@ -1560,17 +1563,15 @@
 	
 	zio_pop_transform(zio, &data, &size, &bufsize);
 
+	ASSERT3U(16, ==, zio_crypt_table[crypt].ci_maclen);
 	/*
-	 * If the crypt says we have a mac it is stored in the blkptr
-	 * as part of the checksum.
-	 * Pass the checksum data into zio_decrypt_data separate from the real 
-	 * data seems like a good idea, and let it deal with how to pass
-	 * it to the relevant crypto function.
+	 * The mac is stored in the blkptr as the top two words of the checksum.
 	 */
+	mac[0] = BE_64(bp->blk_cksum.zc_word[2]);
+	mac[1] = BE_64(bp->blk_cksum.zc_word[3]);
 
 	crypt_error = zio_decrypt_data(crypt, zio->io_spa, &zio->io_bookmark, 
-	    bp->blk_birth, data, size, &bp->blk_cksum.zc_word[0],
-	    zio->io_data, zio->io_size);
+	    bp->blk_birth, data, size, &mac, zio->io_data, zio->io_size);
 
 	/*
 	 * One possible failure is not having access to the