xref: /illumos-gate/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision 8c69cc8fbe729fa7b091e901c4b50508ccc6bb33)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2011-2012 Pawel Jakub Dawidek. All rights reserved.
25  * Portions Copyright 2011 Martin Matuska
26  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
27  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
28  * Copyright (c) 2014, 2016 Joyent, Inc. All rights reserved.
29  * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
30  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
31  * Copyright (c) 2013 Steven Hartland. All rights reserved.
32  * Copyright (c) 2014 Integros [integros.com]
33  * Copyright 2016 Toomas Soome <tsoome@me.com>
34  * Copyright 2017 RackTop Systems.
35  * Copyright (c) 2017 Datto Inc.
36  */
37 
38 /*
39  * ZFS ioctls.
40  *
41  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
42  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
43  *
44  * There are two ways that we handle ioctls: the legacy way where almost
45  * all of the logic is in the ioctl callback, and the new way where most
46  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
47  *
48  * Non-legacy ioctls should be registered by calling
49  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
50  * from userland by lzc_ioctl().
51  *
52  * The registration arguments are as follows:
53  *
54  * const char *name
55  *   The name of the ioctl.  This is used for history logging.  If the
56  *   ioctl returns successfully (the callback returns 0), and allow_log
57  *   is true, then a history log entry will be recorded with the input &
58  *   output nvlists.  The log entry can be printed with "zpool history -i".
59  *
60  * zfs_ioc_t ioc
61  *   The ioctl request number, which userland will pass to ioctl(2).
62  *   The ioctl numbers can change from release to release, because
63  *   the caller (libzfs) must be matched to the kernel.
64  *
65  * zfs_secpolicy_func_t *secpolicy
66  *   This function will be called before the zfs_ioc_func_t, to
67  *   determine if this operation is permitted.  It should return EPERM
68  *   on failure, and 0 on success.  Checks include determining if the
69  *   dataset is visible in this zone, and if the user has either all
70  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
71  *   to do this operation on this dataset with "zfs allow".
72  *
73  * zfs_ioc_namecheck_t namecheck
74  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
75  *   name, a dataset name, or nothing.  If the name is not well-formed,
76  *   the ioctl will fail and the callback will not be called.
77  *   Therefore, the callback can assume that the name is well-formed
78  *   (e.g. is null-terminated, doesn't have more than one '@' character,
79  *   doesn't have invalid characters).
80  *
81  * zfs_ioc_poolcheck_t pool_check
82  *   This specifies requirements on the pool state.  If the pool does
83  *   not meet them (is suspended or is readonly), the ioctl will fail
84  *   and the callback will not be called.  If any checks are specified
85  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
86  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
87  *   POOL_CHECK_READONLY).
88  *
89  * boolean_t smush_outnvlist
90  *   If smush_outnvlist is true, then the output is presumed to be a
91  *   list of errors, and it will be "smushed" down to fit into the
92  *   caller's buffer, by removing some entries and replacing them with a
93  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
94  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
95  *   outnvlist does not fit into the userland-provided buffer, then the
96  *   ioctl will fail with ENOMEM.
97  *
98  * zfs_ioc_func_t *func
99  *   The callback function that will perform the operation.
100  *
101  *   The callback should return 0 on success, or an error number on
102  *   failure.  If the function fails, the userland ioctl will return -1,
103  *   and errno will be set to the callback's return value.  The callback
104  *   will be called with the following arguments:
105  *
106  *   const char *name
107  *     The name of the pool or dataset to operate on, from
108  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
109  *     expected type (pool, dataset, or none).
110  *
111  *   nvlist_t *innvl
112  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
113  *     NULL if no input nvlist was provided.  Changes to this nvlist are
114  *     ignored.  If the input nvlist could not be deserialized, the
115  *     ioctl will fail and the callback will not be called.
116  *
117  *   nvlist_t *outnvl
118  *     The output nvlist, initially empty.  The callback can fill it in,
119  *     and it will be returned to userland by serializing it into
120  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
121  *     fails (e.g. because the caller didn't supply a large enough
122  *     buffer), then the overall ioctl will fail.  See the
123  *     'smush_nvlist' argument above for additional behaviors.
124  *
125  *     There are two typical uses of the output nvlist:
126  *       - To return state, e.g. property values.  In this case,
127  *         smush_outnvlist should be false.  If the buffer was not large
128  *         enough, the caller will reallocate a larger buffer and try
129  *         the ioctl again.
130  *
131  *       - To return multiple errors from an ioctl which makes on-disk
132  *         changes.  In this case, smush_outnvlist should be true.
133  *         Ioctls which make on-disk modifications should generally not
134  *         use the outnvl if they succeed, because the caller can not
135  *         distinguish between the operation failing, and
136  *         deserialization failing.
137  */
138 
139 #include <sys/types.h>
140 #include <sys/param.h>
141 #include <sys/errno.h>
142 #include <sys/uio.h>
143 #include <sys/buf.h>
144 #include <sys/modctl.h>
145 #include <sys/open.h>
146 #include <sys/file.h>
147 #include <sys/kmem.h>
148 #include <sys/conf.h>
149 #include <sys/cmn_err.h>
150 #include <sys/stat.h>
151 #include <sys/zfs_ioctl.h>
152 #include <sys/zfs_vfsops.h>
153 #include <sys/zfs_znode.h>
154 #include <sys/zap.h>
155 #include <sys/spa.h>
156 #include <sys/spa_impl.h>
157 #include <sys/vdev.h>
158 #include <sys/priv_impl.h>
159 #include <sys/dmu.h>
160 #include <sys/dsl_dir.h>
161 #include <sys/dsl_dataset.h>
162 #include <sys/dsl_prop.h>
163 #include <sys/dsl_deleg.h>
164 #include <sys/dmu_objset.h>
165 #include <sys/dmu_impl.h>
166 #include <sys/dmu_tx.h>
167 #include <sys/ddi.h>
168 #include <sys/sunddi.h>
169 #include <sys/sunldi.h>
170 #include <sys/policy.h>
171 #include <sys/zone.h>
172 #include <sys/nvpair.h>
173 #include <sys/pathname.h>
174 #include <sys/mount.h>
175 #include <sys/sdt.h>
176 #include <sys/fs/zfs.h>
177 #include <sys/zfs_ctldir.h>
178 #include <sys/zfs_dir.h>
179 #include <sys/zfs_onexit.h>
180 #include <sys/zvol.h>
181 #include <sys/dsl_scan.h>
182 #include <sharefs/share.h>
183 #include <sys/dmu_objset.h>
184 #include <sys/dmu_send.h>
185 #include <sys/dsl_destroy.h>
186 #include <sys/dsl_bookmark.h>
187 #include <sys/dsl_userhold.h>
188 #include <sys/zfeature.h>
189 #include <sys/zcp.h>
190 #include <sys/zio_checksum.h>
191 
192 #include "zfs_namecheck.h"
193 #include "zfs_prop.h"
194 #include "zfs_deleg.h"
195 #include "zfs_comutil.h"
196 
197 #include "lua.h"
198 #include "lauxlib.h"
199 
200 extern struct modlfs zfs_modlfs;
201 
202 extern void zfs_init(void);
203 extern void zfs_fini(void);
204 
205 ldi_ident_t zfs_li = NULL;
206 dev_info_t *zfs_dip;
207 
208 uint_t zfs_fsyncer_key;
209 extern uint_t rrw_tsd_key;
210 static uint_t zfs_allow_log_key;
211 
212 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
213 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
214 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
215 
216 typedef enum {
217 	NO_NAME,
218 	POOL_NAME,
219 	DATASET_NAME
220 } zfs_ioc_namecheck_t;
221 
222 typedef enum {
223 	POOL_CHECK_NONE		= 1 << 0,
224 	POOL_CHECK_SUSPENDED	= 1 << 1,
225 	POOL_CHECK_READONLY	= 1 << 2,
226 } zfs_ioc_poolcheck_t;
227 
228 typedef struct zfs_ioc_vec {
229 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
230 	zfs_ioc_func_t		*zvec_func;
231 	zfs_secpolicy_func_t	*zvec_secpolicy;
232 	zfs_ioc_namecheck_t	zvec_namecheck;
233 	boolean_t		zvec_allow_log;
234 	zfs_ioc_poolcheck_t	zvec_pool_check;
235 	boolean_t		zvec_smush_outnvlist;
236 	const char		*zvec_name;
237 } zfs_ioc_vec_t;
238 
239 /* This array is indexed by zfs_userquota_prop_t */
240 static const char *userquota_perms[] = {
241 	ZFS_DELEG_PERM_USERUSED,
242 	ZFS_DELEG_PERM_USERQUOTA,
243 	ZFS_DELEG_PERM_GROUPUSED,
244 	ZFS_DELEG_PERM_GROUPQUOTA,
245 };
246 
247 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
248 static int zfs_check_settable(const char *name, nvpair_t *property,
249     cred_t *cr);
250 static int zfs_check_clearable(char *dataset, nvlist_t *props,
251     nvlist_t **errors);
252 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
253     boolean_t *);
254 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
255 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
256 
257 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
258 
259 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
260 void
261 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
262 {
263 	const char *newfile;
264 	char buf[512];
265 	va_list adx;
266 
267 	/*
268 	 * Get rid of annoying "../common/" prefix to filename.
269 	 */
270 	newfile = strrchr(file, '/');
271 	if (newfile != NULL) {
272 		newfile = newfile + 1; /* Get rid of leading / */
273 	} else {
274 		newfile = file;
275 	}
276 
277 	va_start(adx, fmt);
278 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
279 	va_end(adx);
280 
281 	/*
282 	 * To get this data, use the zfs-dprintf probe as so:
283 	 * dtrace -q -n 'zfs-dprintf \
284 	 *	/stringof(arg0) == "dbuf.c"/ \
285 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
286 	 * arg0 = file name
287 	 * arg1 = function name
288 	 * arg2 = line number
289 	 * arg3 = message
290 	 */
291 	DTRACE_PROBE4(zfs__dprintf,
292 	    char *, newfile, char *, func, int, line, char *, buf);
293 }
294 
295 static void
296 history_str_free(char *buf)
297 {
298 	kmem_free(buf, HIS_MAX_RECORD_LEN);
299 }
300 
301 static char *
302 history_str_get(zfs_cmd_t *zc)
303 {
304 	char *buf;
305 
306 	if (zc->zc_history == NULL)
307 		return (NULL);
308 
309 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
310 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
311 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
312 		history_str_free(buf);
313 		return (NULL);
314 	}
315 
316 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
317 
318 	return (buf);
319 }
320 
321 /*
322  * Check to see if the named dataset is currently defined as bootable
323  */
324 static boolean_t
325 zfs_is_bootfs(const char *name)
326 {
327 	objset_t *os;
328 
329 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
330 		boolean_t ret;
331 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
332 		dmu_objset_rele(os, FTAG);
333 		return (ret);
334 	}
335 	return (B_FALSE);
336 }
337 
338 /*
339  * Return non-zero if the spa version is less than requested version.
340  */
341 static int
342 zfs_earlier_version(const char *name, int version)
343 {
344 	spa_t *spa;
345 
346 	if (spa_open(name, &spa, FTAG) == 0) {
347 		if (spa_version(spa) < version) {
348 			spa_close(spa, FTAG);
349 			return (1);
350 		}
351 		spa_close(spa, FTAG);
352 	}
353 	return (0);
354 }
355 
356 /*
357  * Return TRUE if the ZPL version is less than requested version.
358  */
359 static boolean_t
360 zpl_earlier_version(const char *name, int version)
361 {
362 	objset_t *os;
363 	boolean_t rc = B_TRUE;
364 
365 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
366 		uint64_t zplversion;
367 
368 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
369 			dmu_objset_rele(os, FTAG);
370 			return (B_TRUE);
371 		}
372 		/* XXX reading from non-owned objset */
373 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
374 			rc = zplversion < version;
375 		dmu_objset_rele(os, FTAG);
376 	}
377 	return (rc);
378 }
379 
380 static void
381 zfs_log_history(zfs_cmd_t *zc)
382 {
383 	spa_t *spa;
384 	char *buf;
385 
386 	if ((buf = history_str_get(zc)) == NULL)
387 		return;
388 
389 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
390 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
391 			(void) spa_history_log(spa, buf);
392 		spa_close(spa, FTAG);
393 	}
394 	history_str_free(buf);
395 }
396 
397 /*
398  * Policy for top-level read operations (list pools).  Requires no privileges,
399  * and can be used in the local zone, as there is no associated dataset.
400  */
401 /* ARGSUSED */
402 static int
403 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
404 {
405 	return (0);
406 }
407 
408 /*
409  * Policy for dataset read operations (list children, get statistics).  Requires
410  * no privileges, but must be visible in the local zone.
411  */
412 /* ARGSUSED */
413 static int
414 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
415 {
416 	if (INGLOBALZONE(curproc) ||
417 	    zone_dataset_visible(zc->zc_name, NULL))
418 		return (0);
419 
420 	return (SET_ERROR(ENOENT));
421 }
422 
423 static int
424 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
425 {
426 	int writable = 1;
427 
428 	/*
429 	 * The dataset must be visible by this zone -- check this first
430 	 * so they don't see EPERM on something they shouldn't know about.
431 	 */
432 	if (!INGLOBALZONE(curproc) &&
433 	    !zone_dataset_visible(dataset, &writable))
434 		return (SET_ERROR(ENOENT));
435 
436 	if (INGLOBALZONE(curproc)) {
437 		/*
438 		 * If the fs is zoned, only root can access it from the
439 		 * global zone.
440 		 */
441 		if (secpolicy_zfs(cr) && zoned)
442 			return (SET_ERROR(EPERM));
443 	} else {
444 		/*
445 		 * If we are in a local zone, the 'zoned' property must be set.
446 		 */
447 		if (!zoned)
448 			return (SET_ERROR(EPERM));
449 
450 		/* must be writable by this zone */
451 		if (!writable)
452 			return (SET_ERROR(EPERM));
453 	}
454 	return (0);
455 }
456 
457 static int
458 zfs_dozonecheck(const char *dataset, cred_t *cr)
459 {
460 	uint64_t zoned;
461 
462 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
463 		return (SET_ERROR(ENOENT));
464 
465 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
466 }
467 
468 static int
469 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
470 {
471 	uint64_t zoned;
472 
473 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
474 		return (SET_ERROR(ENOENT));
475 
476 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
477 }
478 
479 static int
480 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
481     const char *perm, cred_t *cr)
482 {
483 	int error;
484 
485 	error = zfs_dozonecheck_ds(name, ds, cr);
486 	if (error == 0) {
487 		error = secpolicy_zfs(cr);
488 		if (error != 0)
489 			error = dsl_deleg_access_impl(ds, perm, cr);
490 	}
491 	return (error);
492 }
493 
494 static int
495 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
496 {
497 	int error;
498 	dsl_dataset_t *ds;
499 	dsl_pool_t *dp;
500 
501 	/*
502 	 * First do a quick check for root in the global zone, which
503 	 * is allowed to do all write_perms.  This ensures that zfs_ioc_*
504 	 * will get to handle nonexistent datasets.
505 	 */
506 	if (INGLOBALZONE(curproc) && secpolicy_zfs(cr) == 0)
507 		return (0);
508 
509 	error = dsl_pool_hold(name, FTAG, &dp);
510 	if (error != 0)
511 		return (error);
512 
513 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
514 	if (error != 0) {
515 		dsl_pool_rele(dp, FTAG);
516 		return (error);
517 	}
518 
519 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
520 
521 	dsl_dataset_rele(ds, FTAG);
522 	dsl_pool_rele(dp, FTAG);
523 	return (error);
524 }
525 
526 /*
527  * Policy for setting the security label property.
528  *
529  * Returns 0 for success, non-zero for access and other errors.
530  */
531 static int
532 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
533 {
534 	char		ds_hexsl[MAXNAMELEN];
535 	bslabel_t	ds_sl, new_sl;
536 	boolean_t	new_default = FALSE;
537 	uint64_t	zoned;
538 	int		needed_priv = -1;
539 	int		error;
540 
541 	/* First get the existing dataset label. */
542 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
543 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
544 	if (error != 0)
545 		return (SET_ERROR(EPERM));
546 
547 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
548 		new_default = TRUE;
549 
550 	/* The label must be translatable */
551 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
552 		return (SET_ERROR(EINVAL));
553 
554 	/*
555 	 * In a non-global zone, disallow attempts to set a label that
556 	 * doesn't match that of the zone; otherwise no other checks
557 	 * are needed.
558 	 */
559 	if (!INGLOBALZONE(curproc)) {
560 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
561 			return (SET_ERROR(EPERM));
562 		return (0);
563 	}
564 
565 	/*
566 	 * For global-zone datasets (i.e., those whose zoned property is
567 	 * "off", verify that the specified new label is valid for the
568 	 * global zone.
569 	 */
570 	if (dsl_prop_get_integer(name,
571 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
572 		return (SET_ERROR(EPERM));
573 	if (!zoned) {
574 		if (zfs_check_global_label(name, strval) != 0)
575 			return (SET_ERROR(EPERM));
576 	}
577 
578 	/*
579 	 * If the existing dataset label is nondefault, check if the
580 	 * dataset is mounted (label cannot be changed while mounted).
581 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
582 	 * mounted (or isn't a dataset, doesn't exist, ...).
583 	 */
584 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
585 		objset_t *os;
586 		static char *setsl_tag = "setsl_tag";
587 
588 		/*
589 		 * Try to own the dataset; abort if there is any error,
590 		 * (e.g., already mounted, in use, or other error).
591 		 */
592 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
593 		    setsl_tag, &os);
594 		if (error != 0)
595 			return (SET_ERROR(EPERM));
596 
597 		dmu_objset_disown(os, setsl_tag);
598 
599 		if (new_default) {
600 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
601 			goto out_check;
602 		}
603 
604 		if (hexstr_to_label(strval, &new_sl) != 0)
605 			return (SET_ERROR(EPERM));
606 
607 		if (blstrictdom(&ds_sl, &new_sl))
608 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
609 		else if (blstrictdom(&new_sl, &ds_sl))
610 			needed_priv = PRIV_FILE_UPGRADE_SL;
611 	} else {
612 		/* dataset currently has a default label */
613 		if (!new_default)
614 			needed_priv = PRIV_FILE_UPGRADE_SL;
615 	}
616 
617 out_check:
618 	if (needed_priv != -1)
619 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
620 	return (0);
621 }
622 
623 static int
624 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
625     cred_t *cr)
626 {
627 	char *strval;
628 
629 	/*
630 	 * Check permissions for special properties.
631 	 */
632 	switch (prop) {
633 	case ZFS_PROP_ZONED:
634 		/*
635 		 * Disallow setting of 'zoned' from within a local zone.
636 		 */
637 		if (!INGLOBALZONE(curproc))
638 			return (SET_ERROR(EPERM));
639 		break;
640 
641 	case ZFS_PROP_QUOTA:
642 	case ZFS_PROP_FILESYSTEM_LIMIT:
643 	case ZFS_PROP_SNAPSHOT_LIMIT:
644 		if (!INGLOBALZONE(curproc)) {
645 			uint64_t zoned;
646 			char setpoint[ZFS_MAX_DATASET_NAME_LEN];
647 			/*
648 			 * Unprivileged users are allowed to modify the
649 			 * limit on things *under* (ie. contained by)
650 			 * the thing they own.
651 			 */
652 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
653 			    setpoint))
654 				return (SET_ERROR(EPERM));
655 			if (!zoned || strlen(dsname) <= strlen(setpoint))
656 				return (SET_ERROR(EPERM));
657 		}
658 		break;
659 
660 	case ZFS_PROP_MLSLABEL:
661 		if (!is_system_labeled())
662 			return (SET_ERROR(EPERM));
663 
664 		if (nvpair_value_string(propval, &strval) == 0) {
665 			int err;
666 
667 			err = zfs_set_slabel_policy(dsname, strval, CRED());
668 			if (err != 0)
669 				return (err);
670 		}
671 		break;
672 	}
673 
674 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
675 }
676 
677 /* ARGSUSED */
678 static int
679 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
680 {
681 	int error;
682 
683 	error = zfs_dozonecheck(zc->zc_name, cr);
684 	if (error != 0)
685 		return (error);
686 
687 	/*
688 	 * permission to set permissions will be evaluated later in
689 	 * dsl_deleg_can_allow()
690 	 */
691 	return (0);
692 }
693 
694 /* ARGSUSED */
695 static int
696 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
697 {
698 	return (zfs_secpolicy_write_perms(zc->zc_name,
699 	    ZFS_DELEG_PERM_ROLLBACK, cr));
700 }
701 
702 /* ARGSUSED */
703 static int
704 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
705 {
706 	dsl_pool_t *dp;
707 	dsl_dataset_t *ds;
708 	char *cp;
709 	int error;
710 
711 	/*
712 	 * Generate the current snapshot name from the given objsetid, then
713 	 * use that name for the secpolicy/zone checks.
714 	 */
715 	cp = strchr(zc->zc_name, '@');
716 	if (cp == NULL)
717 		return (SET_ERROR(EINVAL));
718 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
719 	if (error != 0)
720 		return (error);
721 
722 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
723 	if (error != 0) {
724 		dsl_pool_rele(dp, FTAG);
725 		return (error);
726 	}
727 
728 	dsl_dataset_name(ds, zc->zc_name);
729 
730 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
731 	    ZFS_DELEG_PERM_SEND, cr);
732 	dsl_dataset_rele(ds, FTAG);
733 	dsl_pool_rele(dp, FTAG);
734 
735 	return (error);
736 }
737 
738 /* ARGSUSED */
739 static int
740 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
741 {
742 	return (zfs_secpolicy_write_perms(zc->zc_name,
743 	    ZFS_DELEG_PERM_SEND, cr));
744 }
745 
746 /* ARGSUSED */
747 static int
748 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
749 {
750 	vnode_t *vp;
751 	int error;
752 
753 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
754 	    NO_FOLLOW, NULL, &vp)) != 0)
755 		return (error);
756 
757 	/* Now make sure mntpnt and dataset are ZFS */
758 
759 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
760 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
761 	    zc->zc_name) != 0)) {
762 		VN_RELE(vp);
763 		return (SET_ERROR(EPERM));
764 	}
765 
766 	VN_RELE(vp);
767 	return (dsl_deleg_access(zc->zc_name,
768 	    ZFS_DELEG_PERM_SHARE, cr));
769 }
770 
771 int
772 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
773 {
774 	if (!INGLOBALZONE(curproc))
775 		return (SET_ERROR(EPERM));
776 
777 	if (secpolicy_nfs(cr) == 0) {
778 		return (0);
779 	} else {
780 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
781 	}
782 }
783 
784 int
785 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
786 {
787 	if (!INGLOBALZONE(curproc))
788 		return (SET_ERROR(EPERM));
789 
790 	if (secpolicy_smb(cr) == 0) {
791 		return (0);
792 	} else {
793 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
794 	}
795 }
796 
797 static int
798 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
799 {
800 	char *cp;
801 
802 	/*
803 	 * Remove the @bla or /bla from the end of the name to get the parent.
804 	 */
805 	(void) strncpy(parent, datasetname, parentsize);
806 	cp = strrchr(parent, '@');
807 	if (cp != NULL) {
808 		cp[0] = '\0';
809 	} else {
810 		cp = strrchr(parent, '/');
811 		if (cp == NULL)
812 			return (SET_ERROR(ENOENT));
813 		cp[0] = '\0';
814 	}
815 
816 	return (0);
817 }
818 
819 int
820 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
821 {
822 	int error;
823 
824 	if ((error = zfs_secpolicy_write_perms(name,
825 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
826 		return (error);
827 
828 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
829 }
830 
831 /* ARGSUSED */
832 static int
833 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
834 {
835 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
836 }
837 
838 /*
839  * Destroying snapshots with delegated permissions requires
840  * descendant mount and destroy permissions.
841  */
842 /* ARGSUSED */
843 static int
844 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
845 {
846 	nvlist_t *snaps;
847 	nvpair_t *pair, *nextpair;
848 	int error = 0;
849 
850 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
851 		return (SET_ERROR(EINVAL));
852 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
853 	    pair = nextpair) {
854 		nextpair = nvlist_next_nvpair(snaps, pair);
855 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
856 		if (error == ENOENT) {
857 			/*
858 			 * Ignore any snapshots that don't exist (we consider
859 			 * them "already destroyed").  Remove the name from the
860 			 * nvl here in case the snapshot is created between
861 			 * now and when we try to destroy it (in which case
862 			 * we don't want to destroy it since we haven't
863 			 * checked for permission).
864 			 */
865 			fnvlist_remove_nvpair(snaps, pair);
866 			error = 0;
867 		}
868 		if (error != 0)
869 			break;
870 	}
871 
872 	return (error);
873 }
874 
875 int
876 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
877 {
878 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
879 	int	error;
880 
881 	if ((error = zfs_secpolicy_write_perms(from,
882 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
883 		return (error);
884 
885 	if ((error = zfs_secpolicy_write_perms(from,
886 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
887 		return (error);
888 
889 	if ((error = zfs_get_parent(to, parentname,
890 	    sizeof (parentname))) != 0)
891 		return (error);
892 
893 	if ((error = zfs_secpolicy_write_perms(parentname,
894 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
895 		return (error);
896 
897 	if ((error = zfs_secpolicy_write_perms(parentname,
898 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
899 		return (error);
900 
901 	return (error);
902 }
903 
904 /* ARGSUSED */
905 static int
906 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
907 {
908 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
909 }
910 
911 /* ARGSUSED */
912 static int
913 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
914 {
915 	dsl_pool_t *dp;
916 	dsl_dataset_t *clone;
917 	int error;
918 
919 	error = zfs_secpolicy_write_perms(zc->zc_name,
920 	    ZFS_DELEG_PERM_PROMOTE, cr);
921 	if (error != 0)
922 		return (error);
923 
924 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
925 	if (error != 0)
926 		return (error);
927 
928 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
929 
930 	if (error == 0) {
931 		char parentname[ZFS_MAX_DATASET_NAME_LEN];
932 		dsl_dataset_t *origin = NULL;
933 		dsl_dir_t *dd;
934 		dd = clone->ds_dir;
935 
936 		error = dsl_dataset_hold_obj(dd->dd_pool,
937 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
938 		if (error != 0) {
939 			dsl_dataset_rele(clone, FTAG);
940 			dsl_pool_rele(dp, FTAG);
941 			return (error);
942 		}
943 
944 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
945 		    ZFS_DELEG_PERM_MOUNT, cr);
946 
947 		dsl_dataset_name(origin, parentname);
948 		if (error == 0) {
949 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
950 			    ZFS_DELEG_PERM_PROMOTE, cr);
951 		}
952 		dsl_dataset_rele(clone, FTAG);
953 		dsl_dataset_rele(origin, FTAG);
954 	}
955 	dsl_pool_rele(dp, FTAG);
956 	return (error);
957 }
958 
959 /* ARGSUSED */
960 static int
961 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
962 {
963 	int error;
964 
965 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
966 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
967 		return (error);
968 
969 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
970 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
971 		return (error);
972 
973 	return (zfs_secpolicy_write_perms(zc->zc_name,
974 	    ZFS_DELEG_PERM_CREATE, cr));
975 }
976 
977 int
978 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
979 {
980 	return (zfs_secpolicy_write_perms(name,
981 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
982 }
983 
984 /*
985  * Check for permission to create each snapshot in the nvlist.
986  */
987 /* ARGSUSED */
988 static int
989 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
990 {
991 	nvlist_t *snaps;
992 	int error = 0;
993 	nvpair_t *pair;
994 
995 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
996 		return (SET_ERROR(EINVAL));
997 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
998 	    pair = nvlist_next_nvpair(snaps, pair)) {
999 		char *name = nvpair_name(pair);
1000 		char *atp = strchr(name, '@');
1001 
1002 		if (atp == NULL) {
1003 			error = SET_ERROR(EINVAL);
1004 			break;
1005 		}
1006 		*atp = '\0';
1007 		error = zfs_secpolicy_snapshot_perms(name, cr);
1008 		*atp = '@';
1009 		if (error != 0)
1010 			break;
1011 	}
1012 	return (error);
1013 }
1014 
1015 /*
1016  * Check for permission to create each snapshot in the nvlist.
1017  */
1018 /* ARGSUSED */
1019 static int
1020 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1021 {
1022 	int error = 0;
1023 
1024 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1025 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1026 		char *name = nvpair_name(pair);
1027 		char *hashp = strchr(name, '#');
1028 
1029 		if (hashp == NULL) {
1030 			error = SET_ERROR(EINVAL);
1031 			break;
1032 		}
1033 		*hashp = '\0';
1034 		error = zfs_secpolicy_write_perms(name,
1035 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1036 		*hashp = '#';
1037 		if (error != 0)
1038 			break;
1039 	}
1040 	return (error);
1041 }
1042 
1043 /* ARGSUSED */
1044 static int
1045 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1046 {
1047 	nvpair_t *pair, *nextpair;
1048 	int error = 0;
1049 
1050 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1051 	    pair = nextpair) {
1052 		char *name = nvpair_name(pair);
1053 		char *hashp = strchr(name, '#');
1054 		nextpair = nvlist_next_nvpair(innvl, pair);
1055 
1056 		if (hashp == NULL) {
1057 			error = SET_ERROR(EINVAL);
1058 			break;
1059 		}
1060 
1061 		*hashp = '\0';
1062 		error = zfs_secpolicy_write_perms(name,
1063 		    ZFS_DELEG_PERM_DESTROY, cr);
1064 		*hashp = '#';
1065 		if (error == ENOENT) {
1066 			/*
1067 			 * Ignore any filesystems that don't exist (we consider
1068 			 * their bookmarks "already destroyed").  Remove
1069 			 * the name from the nvl here in case the filesystem
1070 			 * is created between now and when we try to destroy
1071 			 * the bookmark (in which case we don't want to
1072 			 * destroy it since we haven't checked for permission).
1073 			 */
1074 			fnvlist_remove_nvpair(innvl, pair);
1075 			error = 0;
1076 		}
1077 		if (error != 0)
1078 			break;
1079 	}
1080 
1081 	return (error);
1082 }
1083 
1084 /* ARGSUSED */
1085 static int
1086 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1087 {
1088 	/*
1089 	 * Even root must have a proper TSD so that we know what pool
1090 	 * to log to.
1091 	 */
1092 	if (tsd_get(zfs_allow_log_key) == NULL)
1093 		return (SET_ERROR(EPERM));
1094 	return (0);
1095 }
1096 
1097 static int
1098 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1099 {
1100 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
1101 	int	error;
1102 	char	*origin;
1103 
1104 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1105 	    sizeof (parentname))) != 0)
1106 		return (error);
1107 
1108 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1109 	    (error = zfs_secpolicy_write_perms(origin,
1110 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1111 		return (error);
1112 
1113 	if ((error = zfs_secpolicy_write_perms(parentname,
1114 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1115 		return (error);
1116 
1117 	return (zfs_secpolicy_write_perms(parentname,
1118 	    ZFS_DELEG_PERM_MOUNT, cr));
1119 }
1120 
1121 /*
1122  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1123  * SYS_CONFIG privilege, which is not available in a local zone.
1124  */
1125 /* ARGSUSED */
1126 static int
1127 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1128 {
1129 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1130 		return (SET_ERROR(EPERM));
1131 
1132 	return (0);
1133 }
1134 
1135 /*
1136  * Policy for object to name lookups.
1137  */
1138 /* ARGSUSED */
1139 static int
1140 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1141 {
1142 	int error;
1143 
1144 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1145 		return (0);
1146 
1147 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1148 	return (error);
1149 }
1150 
1151 /*
1152  * Policy for fault injection.  Requires all privileges.
1153  */
1154 /* ARGSUSED */
1155 static int
1156 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1157 {
1158 	return (secpolicy_zinject(cr));
1159 }
1160 
1161 /* ARGSUSED */
1162 static int
1163 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1164 {
1165 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1166 
1167 	if (prop == ZPROP_INVAL) {
1168 		if (!zfs_prop_user(zc->zc_value))
1169 			return (SET_ERROR(EINVAL));
1170 		return (zfs_secpolicy_write_perms(zc->zc_name,
1171 		    ZFS_DELEG_PERM_USERPROP, cr));
1172 	} else {
1173 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1174 		    NULL, cr));
1175 	}
1176 }
1177 
1178 static int
1179 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1180 {
1181 	int err = zfs_secpolicy_read(zc, innvl, cr);
1182 	if (err)
1183 		return (err);
1184 
1185 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1186 		return (SET_ERROR(EINVAL));
1187 
1188 	if (zc->zc_value[0] == 0) {
1189 		/*
1190 		 * They are asking about a posix uid/gid.  If it's
1191 		 * themself, allow it.
1192 		 */
1193 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1194 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1195 			if (zc->zc_guid == crgetuid(cr))
1196 				return (0);
1197 		} else {
1198 			if (groupmember(zc->zc_guid, cr))
1199 				return (0);
1200 		}
1201 	}
1202 
1203 	return (zfs_secpolicy_write_perms(zc->zc_name,
1204 	    userquota_perms[zc->zc_objset_type], cr));
1205 }
1206 
1207 static int
1208 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1209 {
1210 	int err = zfs_secpolicy_read(zc, innvl, cr);
1211 	if (err)
1212 		return (err);
1213 
1214 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1215 		return (SET_ERROR(EINVAL));
1216 
1217 	return (zfs_secpolicy_write_perms(zc->zc_name,
1218 	    userquota_perms[zc->zc_objset_type], cr));
1219 }
1220 
1221 /* ARGSUSED */
1222 static int
1223 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1224 {
1225 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1226 	    NULL, cr));
1227 }
1228 
1229 /* ARGSUSED */
1230 static int
1231 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1232 {
1233 	nvpair_t *pair;
1234 	nvlist_t *holds;
1235 	int error;
1236 
1237 	error = nvlist_lookup_nvlist(innvl, "holds", &holds);
1238 	if (error != 0)
1239 		return (SET_ERROR(EINVAL));
1240 
1241 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1242 	    pair = nvlist_next_nvpair(holds, pair)) {
1243 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1244 		error = dmu_fsname(nvpair_name(pair), fsname);
1245 		if (error != 0)
1246 			return (error);
1247 		error = zfs_secpolicy_write_perms(fsname,
1248 		    ZFS_DELEG_PERM_HOLD, cr);
1249 		if (error != 0)
1250 			return (error);
1251 	}
1252 	return (0);
1253 }
1254 
1255 /* ARGSUSED */
1256 static int
1257 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1258 {
1259 	nvpair_t *pair;
1260 	int error;
1261 
1262 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1263 	    pair = nvlist_next_nvpair(innvl, pair)) {
1264 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1265 		error = dmu_fsname(nvpair_name(pair), fsname);
1266 		if (error != 0)
1267 			return (error);
1268 		error = zfs_secpolicy_write_perms(fsname,
1269 		    ZFS_DELEG_PERM_RELEASE, cr);
1270 		if (error != 0)
1271 			return (error);
1272 	}
1273 	return (0);
1274 }
1275 
1276 /*
1277  * Policy for allowing temporary snapshots to be taken or released
1278  */
1279 static int
1280 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1281 {
1282 	/*
1283 	 * A temporary snapshot is the same as a snapshot,
1284 	 * hold, destroy and release all rolled into one.
1285 	 * Delegated diff alone is sufficient that we allow this.
1286 	 */
1287 	int error;
1288 
1289 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1290 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1291 		return (0);
1292 
1293 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1294 	if (error == 0)
1295 		error = zfs_secpolicy_hold(zc, innvl, cr);
1296 	if (error == 0)
1297 		error = zfs_secpolicy_release(zc, innvl, cr);
1298 	if (error == 0)
1299 		error = zfs_secpolicy_destroy(zc, innvl, cr);
1300 	return (error);
1301 }
1302 
1303 /*
1304  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1305  */
1306 static int
1307 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1308 {
1309 	char *packed;
1310 	int error;
1311 	nvlist_t *list = NULL;
1312 
1313 	/*
1314 	 * Read in and unpack the user-supplied nvlist.
1315 	 */
1316 	if (size == 0)
1317 		return (SET_ERROR(EINVAL));
1318 
1319 	packed = kmem_alloc(size, KM_SLEEP);
1320 
1321 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1322 	    iflag)) != 0) {
1323 		kmem_free(packed, size);
1324 		return (SET_ERROR(EFAULT));
1325 	}
1326 
1327 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1328 		kmem_free(packed, size);
1329 		return (error);
1330 	}
1331 
1332 	kmem_free(packed, size);
1333 
1334 	*nvp = list;
1335 	return (0);
1336 }
1337 
1338 /*
1339  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1340  * Entries will be removed from the end of the nvlist, and one int32 entry
1341  * named "N_MORE_ERRORS" will be added indicating how many entries were
1342  * removed.
1343  */
1344 static int
1345 nvlist_smush(nvlist_t *errors, size_t max)
1346 {
1347 	size_t size;
1348 
1349 	size = fnvlist_size(errors);
1350 
1351 	if (size > max) {
1352 		nvpair_t *more_errors;
1353 		int n = 0;
1354 
1355 		if (max < 1024)
1356 			return (SET_ERROR(ENOMEM));
1357 
1358 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1359 		more_errors = nvlist_prev_nvpair(errors, NULL);
1360 
1361 		do {
1362 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1363 			    more_errors);
1364 			fnvlist_remove_nvpair(errors, pair);
1365 			n++;
1366 			size = fnvlist_size(errors);
1367 		} while (size > max);
1368 
1369 		fnvlist_remove_nvpair(errors, more_errors);
1370 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1371 		ASSERT3U(fnvlist_size(errors), <=, max);
1372 	}
1373 
1374 	return (0);
1375 }
1376 
1377 static int
1378 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1379 {
1380 	char *packed = NULL;
1381 	int error = 0;
1382 	size_t size;
1383 
1384 	size = fnvlist_size(nvl);
1385 
1386 	if (size > zc->zc_nvlist_dst_size) {
1387 		error = SET_ERROR(ENOMEM);
1388 	} else {
1389 		packed = fnvlist_pack(nvl, &size);
1390 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1391 		    size, zc->zc_iflags) != 0)
1392 			error = SET_ERROR(EFAULT);
1393 		fnvlist_pack_free(packed, size);
1394 	}
1395 
1396 	zc->zc_nvlist_dst_size = size;
1397 	zc->zc_nvlist_dst_filled = B_TRUE;
1398 	return (error);
1399 }
1400 
1401 int
1402 getzfsvfs_impl(objset_t *os, zfsvfs_t **zfvp)
1403 {
1404 	int error = 0;
1405 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1406 		return (SET_ERROR(EINVAL));
1407 	}
1408 
1409 	mutex_enter(&os->os_user_ptr_lock);
1410 	*zfvp = dmu_objset_get_user(os);
1411 	if (*zfvp) {
1412 		VFS_HOLD((*zfvp)->z_vfs);
1413 	} else {
1414 		error = SET_ERROR(ESRCH);
1415 	}
1416 	mutex_exit(&os->os_user_ptr_lock);
1417 	return (error);
1418 }
1419 
1420 int
1421 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1422 {
1423 	objset_t *os;
1424 	int error;
1425 
1426 	error = dmu_objset_hold(dsname, FTAG, &os);
1427 	if (error != 0)
1428 		return (error);
1429 
1430 	error = getzfsvfs_impl(os, zfvp);
1431 	dmu_objset_rele(os, FTAG);
1432 	return (error);
1433 }
1434 
1435 /*
1436  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1437  * case its z_vfs will be NULL, and it will be opened as the owner.
1438  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1439  * which prevents all vnode ops from running.
1440  */
1441 static int
1442 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1443 {
1444 	int error = 0;
1445 
1446 	if (getzfsvfs(name, zfvp) != 0)
1447 		error = zfsvfs_create(name, zfvp);
1448 	if (error == 0) {
1449 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1450 		    RW_READER, tag);
1451 		if ((*zfvp)->z_unmounted) {
1452 			/*
1453 			 * XXX we could probably try again, since the unmounting
1454 			 * thread should be just about to disassociate the
1455 			 * objset from the zfsvfs.
1456 			 */
1457 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1458 			return (SET_ERROR(EBUSY));
1459 		}
1460 	}
1461 	return (error);
1462 }
1463 
1464 static void
1465 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1466 {
1467 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1468 
1469 	if (zfsvfs->z_vfs) {
1470 		VFS_RELE(zfsvfs->z_vfs);
1471 	} else {
1472 		dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1473 		zfsvfs_free(zfsvfs);
1474 	}
1475 }
1476 
1477 static int
1478 zfs_ioc_pool_create(zfs_cmd_t *zc)
1479 {
1480 	int error;
1481 	nvlist_t *config, *props = NULL;
1482 	nvlist_t *rootprops = NULL;
1483 	nvlist_t *zplprops = NULL;
1484 
1485 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1486 	    zc->zc_iflags, &config))
1487 		return (error);
1488 
1489 	if (zc->zc_nvlist_src_size != 0 && (error =
1490 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1491 	    zc->zc_iflags, &props))) {
1492 		nvlist_free(config);
1493 		return (error);
1494 	}
1495 
1496 	if (props) {
1497 		nvlist_t *nvl = NULL;
1498 		uint64_t version = SPA_VERSION;
1499 
1500 		(void) nvlist_lookup_uint64(props,
1501 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1502 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1503 			error = SET_ERROR(EINVAL);
1504 			goto pool_props_bad;
1505 		}
1506 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1507 		if (nvl) {
1508 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1509 			if (error != 0) {
1510 				nvlist_free(config);
1511 				nvlist_free(props);
1512 				return (error);
1513 			}
1514 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1515 		}
1516 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1517 		error = zfs_fill_zplprops_root(version, rootprops,
1518 		    zplprops, NULL);
1519 		if (error != 0)
1520 			goto pool_props_bad;
1521 	}
1522 
1523 	error = spa_create(zc->zc_name, config, props, zplprops);
1524 
1525 	/*
1526 	 * Set the remaining root properties
1527 	 */
1528 	if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1529 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1530 		(void) spa_destroy(zc->zc_name);
1531 
1532 pool_props_bad:
1533 	nvlist_free(rootprops);
1534 	nvlist_free(zplprops);
1535 	nvlist_free(config);
1536 	nvlist_free(props);
1537 
1538 	return (error);
1539 }
1540 
1541 static int
1542 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1543 {
1544 	int error;
1545 	zfs_log_history(zc);
1546 	error = spa_destroy(zc->zc_name);
1547 	if (error == 0)
1548 		zvol_remove_minors(zc->zc_name);
1549 	return (error);
1550 }
1551 
1552 static int
1553 zfs_ioc_pool_import(zfs_cmd_t *zc)
1554 {
1555 	nvlist_t *config, *props = NULL;
1556 	uint64_t guid;
1557 	int error;
1558 
1559 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1560 	    zc->zc_iflags, &config)) != 0)
1561 		return (error);
1562 
1563 	if (zc->zc_nvlist_src_size != 0 && (error =
1564 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1565 	    zc->zc_iflags, &props))) {
1566 		nvlist_free(config);
1567 		return (error);
1568 	}
1569 
1570 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1571 	    guid != zc->zc_guid)
1572 		error = SET_ERROR(EINVAL);
1573 	else
1574 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1575 
1576 	if (zc->zc_nvlist_dst != 0) {
1577 		int err;
1578 
1579 		if ((err = put_nvlist(zc, config)) != 0)
1580 			error = err;
1581 	}
1582 
1583 	nvlist_free(config);
1584 
1585 	nvlist_free(props);
1586 
1587 	return (error);
1588 }
1589 
1590 static int
1591 zfs_ioc_pool_export(zfs_cmd_t *zc)
1592 {
1593 	int error;
1594 	boolean_t force = (boolean_t)zc->zc_cookie;
1595 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1596 
1597 	zfs_log_history(zc);
1598 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1599 	if (error == 0)
1600 		zvol_remove_minors(zc->zc_name);
1601 	return (error);
1602 }
1603 
1604 static int
1605 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1606 {
1607 	nvlist_t *configs;
1608 	int error;
1609 
1610 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1611 		return (SET_ERROR(EEXIST));
1612 
1613 	error = put_nvlist(zc, configs);
1614 
1615 	nvlist_free(configs);
1616 
1617 	return (error);
1618 }
1619 
1620 /*
1621  * inputs:
1622  * zc_name		name of the pool
1623  *
1624  * outputs:
1625  * zc_cookie		real errno
1626  * zc_nvlist_dst	config nvlist
1627  * zc_nvlist_dst_size	size of config nvlist
1628  */
1629 static int
1630 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1631 {
1632 	nvlist_t *config;
1633 	int error;
1634 	int ret = 0;
1635 
1636 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1637 	    sizeof (zc->zc_value));
1638 
1639 	if (config != NULL) {
1640 		ret = put_nvlist(zc, config);
1641 		nvlist_free(config);
1642 
1643 		/*
1644 		 * The config may be present even if 'error' is non-zero.
1645 		 * In this case we return success, and preserve the real errno
1646 		 * in 'zc_cookie'.
1647 		 */
1648 		zc->zc_cookie = error;
1649 	} else {
1650 		ret = error;
1651 	}
1652 
1653 	return (ret);
1654 }
1655 
1656 /*
1657  * Try to import the given pool, returning pool stats as appropriate so that
1658  * user land knows which devices are available and overall pool health.
1659  */
1660 static int
1661 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1662 {
1663 	nvlist_t *tryconfig, *config;
1664 	int error;
1665 
1666 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1667 	    zc->zc_iflags, &tryconfig)) != 0)
1668 		return (error);
1669 
1670 	config = spa_tryimport(tryconfig);
1671 
1672 	nvlist_free(tryconfig);
1673 
1674 	if (config == NULL)
1675 		return (SET_ERROR(EINVAL));
1676 
1677 	error = put_nvlist(zc, config);
1678 	nvlist_free(config);
1679 
1680 	return (error);
1681 }
1682 
1683 /*
1684  * inputs:
1685  * zc_name              name of the pool
1686  * zc_cookie            scan func (pool_scan_func_t)
1687  * zc_flags             scrub pause/resume flag (pool_scrub_cmd_t)
1688  */
1689 static int
1690 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1691 {
1692 	spa_t *spa;
1693 	int error;
1694 
1695 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1696 		return (error);
1697 
1698 	if (zc->zc_flags >= POOL_SCRUB_FLAGS_END)
1699 		return (SET_ERROR(EINVAL));
1700 
1701 	if (zc->zc_flags == POOL_SCRUB_PAUSE)
1702 		error = spa_scrub_pause_resume(spa, POOL_SCRUB_PAUSE);
1703 	else if (zc->zc_cookie == POOL_SCAN_NONE)
1704 		error = spa_scan_stop(spa);
1705 	else
1706 		error = spa_scan(spa, zc->zc_cookie);
1707 
1708 	spa_close(spa, FTAG);
1709 
1710 	return (error);
1711 }
1712 
1713 static int
1714 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1715 {
1716 	spa_t *spa;
1717 	int error;
1718 
1719 	error = spa_open(zc->zc_name, &spa, FTAG);
1720 	if (error == 0) {
1721 		spa_freeze(spa);
1722 		spa_close(spa, FTAG);
1723 	}
1724 	return (error);
1725 }
1726 
1727 static int
1728 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1729 {
1730 	spa_t *spa;
1731 	int error;
1732 
1733 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1734 		return (error);
1735 
1736 	if (zc->zc_cookie < spa_version(spa) ||
1737 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1738 		spa_close(spa, FTAG);
1739 		return (SET_ERROR(EINVAL));
1740 	}
1741 
1742 	spa_upgrade(spa, zc->zc_cookie);
1743 	spa_close(spa, FTAG);
1744 
1745 	return (error);
1746 }
1747 
1748 static int
1749 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1750 {
1751 	spa_t *spa;
1752 	char *hist_buf;
1753 	uint64_t size;
1754 	int error;
1755 
1756 	if ((size = zc->zc_history_len) == 0)
1757 		return (SET_ERROR(EINVAL));
1758 
1759 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1760 		return (error);
1761 
1762 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1763 		spa_close(spa, FTAG);
1764 		return (SET_ERROR(ENOTSUP));
1765 	}
1766 
1767 	hist_buf = kmem_alloc(size, KM_SLEEP);
1768 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1769 	    &zc->zc_history_len, hist_buf)) == 0) {
1770 		error = ddi_copyout(hist_buf,
1771 		    (void *)(uintptr_t)zc->zc_history,
1772 		    zc->zc_history_len, zc->zc_iflags);
1773 	}
1774 
1775 	spa_close(spa, FTAG);
1776 	kmem_free(hist_buf, size);
1777 	return (error);
1778 }
1779 
1780 static int
1781 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1782 {
1783 	spa_t *spa;
1784 	int error;
1785 
1786 	error = spa_open(zc->zc_name, &spa, FTAG);
1787 	if (error == 0) {
1788 		error = spa_change_guid(spa);
1789 		spa_close(spa, FTAG);
1790 	}
1791 	return (error);
1792 }
1793 
1794 static int
1795 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1796 {
1797 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1798 }
1799 
1800 /*
1801  * inputs:
1802  * zc_name		name of filesystem
1803  * zc_obj		object to find
1804  *
1805  * outputs:
1806  * zc_value		name of object
1807  */
1808 static int
1809 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1810 {
1811 	objset_t *os;
1812 	int error;
1813 
1814 	/* XXX reading from objset not owned */
1815 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1816 		return (error);
1817 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1818 		dmu_objset_rele(os, FTAG);
1819 		return (SET_ERROR(EINVAL));
1820 	}
1821 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1822 	    sizeof (zc->zc_value));
1823 	dmu_objset_rele(os, FTAG);
1824 
1825 	return (error);
1826 }
1827 
1828 /*
1829  * inputs:
1830  * zc_name		name of filesystem
1831  * zc_obj		object to find
1832  *
1833  * outputs:
1834  * zc_stat		stats on object
1835  * zc_value		path to object
1836  */
1837 static int
1838 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1839 {
1840 	objset_t *os;
1841 	int error;
1842 
1843 	/* XXX reading from objset not owned */
1844 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1845 		return (error);
1846 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1847 		dmu_objset_rele(os, FTAG);
1848 		return (SET_ERROR(EINVAL));
1849 	}
1850 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1851 	    sizeof (zc->zc_value));
1852 	dmu_objset_rele(os, FTAG);
1853 
1854 	return (error);
1855 }
1856 
1857 static int
1858 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1859 {
1860 	spa_t *spa;
1861 	int error;
1862 	nvlist_t *config, **l2cache, **spares;
1863 	uint_t nl2cache = 0, nspares = 0;
1864 
1865 	error = spa_open(zc->zc_name, &spa, FTAG);
1866 	if (error != 0)
1867 		return (error);
1868 
1869 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1870 	    zc->zc_iflags, &config);
1871 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1872 	    &l2cache, &nl2cache);
1873 
1874 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1875 	    &spares, &nspares);
1876 
1877 	/*
1878 	 * A root pool with concatenated devices is not supported.
1879 	 * Thus, can not add a device to a root pool.
1880 	 *
1881 	 * Intent log device can not be added to a rootpool because
1882 	 * during mountroot, zil is replayed, a seperated log device
1883 	 * can not be accessed during the mountroot time.
1884 	 *
1885 	 * l2cache and spare devices are ok to be added to a rootpool.
1886 	 */
1887 	if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1888 		nvlist_free(config);
1889 		spa_close(spa, FTAG);
1890 		return (SET_ERROR(EDOM));
1891 	}
1892 
1893 	if (error == 0) {
1894 		error = spa_vdev_add(spa, config);
1895 		nvlist_free(config);
1896 	}
1897 	spa_close(spa, FTAG);
1898 	return (error);
1899 }
1900 
1901 /*
1902  * inputs:
1903  * zc_name		name of the pool
1904  * zc_nvlist_conf	nvlist of devices to remove
1905  * zc_cookie		to stop the remove?
1906  */
1907 static int
1908 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1909 {
1910 	spa_t *spa;
1911 	int error;
1912 
1913 	error = spa_open(zc->zc_name, &spa, FTAG);
1914 	if (error != 0)
1915 		return (error);
1916 	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1917 	spa_close(spa, FTAG);
1918 	return (error);
1919 }
1920 
1921 static int
1922 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1923 {
1924 	spa_t *spa;
1925 	int error;
1926 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1927 
1928 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1929 		return (error);
1930 	switch (zc->zc_cookie) {
1931 	case VDEV_STATE_ONLINE:
1932 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1933 		break;
1934 
1935 	case VDEV_STATE_OFFLINE:
1936 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1937 		break;
1938 
1939 	case VDEV_STATE_FAULTED:
1940 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1941 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1942 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1943 
1944 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1945 		break;
1946 
1947 	case VDEV_STATE_DEGRADED:
1948 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1949 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1950 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1951 
1952 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1953 		break;
1954 
1955 	default:
1956 		error = SET_ERROR(EINVAL);
1957 	}
1958 	zc->zc_cookie = newstate;
1959 	spa_close(spa, FTAG);
1960 	return (error);
1961 }
1962 
1963 static int
1964 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1965 {
1966 	spa_t *spa;
1967 	int replacing = zc->zc_cookie;
1968 	nvlist_t *config;
1969 	int error;
1970 
1971 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1972 		return (error);
1973 
1974 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1975 	    zc->zc_iflags, &config)) == 0) {
1976 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
1977 		nvlist_free(config);
1978 	}
1979 
1980 	spa_close(spa, FTAG);
1981 	return (error);
1982 }
1983 
1984 static int
1985 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
1986 {
1987 	spa_t *spa;
1988 	int error;
1989 
1990 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1991 		return (error);
1992 
1993 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
1994 
1995 	spa_close(spa, FTAG);
1996 	return (error);
1997 }
1998 
1999 static int
2000 zfs_ioc_vdev_split(zfs_cmd_t *zc)
2001 {
2002 	spa_t *spa;
2003 	nvlist_t *config, *props = NULL;
2004 	int error;
2005 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
2006 
2007 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2008 		return (error);
2009 
2010 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2011 	    zc->zc_iflags, &config)) {
2012 		spa_close(spa, FTAG);
2013 		return (error);
2014 	}
2015 
2016 	if (zc->zc_nvlist_src_size != 0 && (error =
2017 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2018 	    zc->zc_iflags, &props))) {
2019 		spa_close(spa, FTAG);
2020 		nvlist_free(config);
2021 		return (error);
2022 	}
2023 
2024 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2025 
2026 	spa_close(spa, FTAG);
2027 
2028 	nvlist_free(config);
2029 	nvlist_free(props);
2030 
2031 	return (error);
2032 }
2033 
2034 static int
2035 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2036 {
2037 	spa_t *spa;
2038 	char *path = zc->zc_value;
2039 	uint64_t guid = zc->zc_guid;
2040 	int error;
2041 
2042 	error = spa_open(zc->zc_name, &spa, FTAG);
2043 	if (error != 0)
2044 		return (error);
2045 
2046 	error = spa_vdev_setpath(spa, guid, path);
2047 	spa_close(spa, FTAG);
2048 	return (error);
2049 }
2050 
2051 static int
2052 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2053 {
2054 	spa_t *spa;
2055 	char *fru = zc->zc_value;
2056 	uint64_t guid = zc->zc_guid;
2057 	int error;
2058 
2059 	error = spa_open(zc->zc_name, &spa, FTAG);
2060 	if (error != 0)
2061 		return (error);
2062 
2063 	error = spa_vdev_setfru(spa, guid, fru);
2064 	spa_close(spa, FTAG);
2065 	return (error);
2066 }
2067 
2068 static int
2069 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2070 {
2071 	int error = 0;
2072 	nvlist_t *nv;
2073 
2074 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2075 
2076 	if (zc->zc_nvlist_dst != 0 &&
2077 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2078 		dmu_objset_stats(os, nv);
2079 		/*
2080 		 * NB: zvol_get_stats() will read the objset contents,
2081 		 * which we aren't supposed to do with a
2082 		 * DS_MODE_USER hold, because it could be
2083 		 * inconsistent.  So this is a bit of a workaround...
2084 		 * XXX reading with out owning
2085 		 */
2086 		if (!zc->zc_objset_stats.dds_inconsistent &&
2087 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2088 			error = zvol_get_stats(os, nv);
2089 			if (error == EIO)
2090 				return (error);
2091 			VERIFY0(error);
2092 		}
2093 		error = put_nvlist(zc, nv);
2094 		nvlist_free(nv);
2095 	}
2096 
2097 	return (error);
2098 }
2099 
2100 /*
2101  * inputs:
2102  * zc_name		name of filesystem
2103  * zc_nvlist_dst_size	size of buffer for property nvlist
2104  *
2105  * outputs:
2106  * zc_objset_stats	stats
2107  * zc_nvlist_dst	property nvlist
2108  * zc_nvlist_dst_size	size of property nvlist
2109  */
2110 static int
2111 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2112 {
2113 	objset_t *os;
2114 	int error;
2115 
2116 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2117 	if (error == 0) {
2118 		error = zfs_ioc_objset_stats_impl(zc, os);
2119 		dmu_objset_rele(os, FTAG);
2120 	}
2121 
2122 	return (error);
2123 }
2124 
2125 /*
2126  * inputs:
2127  * zc_name		name of filesystem
2128  * zc_nvlist_dst_size	size of buffer for property nvlist
2129  *
2130  * outputs:
2131  * zc_nvlist_dst	received property nvlist
2132  * zc_nvlist_dst_size	size of received property nvlist
2133  *
2134  * Gets received properties (distinct from local properties on or after
2135  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2136  * local property values.
2137  */
2138 static int
2139 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2140 {
2141 	int error = 0;
2142 	nvlist_t *nv;
2143 
2144 	/*
2145 	 * Without this check, we would return local property values if the
2146 	 * caller has not already received properties on or after
2147 	 * SPA_VERSION_RECVD_PROPS.
2148 	 */
2149 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2150 		return (SET_ERROR(ENOTSUP));
2151 
2152 	if (zc->zc_nvlist_dst != 0 &&
2153 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2154 		error = put_nvlist(zc, nv);
2155 		nvlist_free(nv);
2156 	}
2157 
2158 	return (error);
2159 }
2160 
2161 static int
2162 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2163 {
2164 	uint64_t value;
2165 	int error;
2166 
2167 	/*
2168 	 * zfs_get_zplprop() will either find a value or give us
2169 	 * the default value (if there is one).
2170 	 */
2171 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2172 		return (error);
2173 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2174 	return (0);
2175 }
2176 
2177 /*
2178  * inputs:
2179  * zc_name		name of filesystem
2180  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2181  *
2182  * outputs:
2183  * zc_nvlist_dst	zpl property nvlist
2184  * zc_nvlist_dst_size	size of zpl property nvlist
2185  */
2186 static int
2187 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2188 {
2189 	objset_t *os;
2190 	int err;
2191 
2192 	/* XXX reading without owning */
2193 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2194 		return (err);
2195 
2196 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2197 
2198 	/*
2199 	 * NB: nvl_add_zplprop() will read the objset contents,
2200 	 * which we aren't supposed to do with a DS_MODE_USER
2201 	 * hold, because it could be inconsistent.
2202 	 */
2203 	if (zc->zc_nvlist_dst != NULL &&
2204 	    !zc->zc_objset_stats.dds_inconsistent &&
2205 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2206 		nvlist_t *nv;
2207 
2208 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2209 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2210 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2211 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2212 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2213 			err = put_nvlist(zc, nv);
2214 		nvlist_free(nv);
2215 	} else {
2216 		err = SET_ERROR(ENOENT);
2217 	}
2218 	dmu_objset_rele(os, FTAG);
2219 	return (err);
2220 }
2221 
2222 static boolean_t
2223 dataset_name_hidden(const char *name)
2224 {
2225 	/*
2226 	 * Skip over datasets that are not visible in this zone,
2227 	 * internal datasets (which have a $ in their name), and
2228 	 * temporary datasets (which have a % in their name).
2229 	 */
2230 	if (strchr(name, '$') != NULL)
2231 		return (B_TRUE);
2232 	if (strchr(name, '%') != NULL)
2233 		return (B_TRUE);
2234 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2235 		return (B_TRUE);
2236 	return (B_FALSE);
2237 }
2238 
2239 /*
2240  * inputs:
2241  * zc_name		name of filesystem
2242  * zc_cookie		zap cursor
2243  * zc_nvlist_dst_size	size of buffer for property nvlist
2244  *
2245  * outputs:
2246  * zc_name		name of next filesystem
2247  * zc_cookie		zap cursor
2248  * zc_objset_stats	stats
2249  * zc_nvlist_dst	property nvlist
2250  * zc_nvlist_dst_size	size of property nvlist
2251  */
2252 static int
2253 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2254 {
2255 	objset_t *os;
2256 	int error;
2257 	char *p;
2258 	size_t orig_len = strlen(zc->zc_name);
2259 
2260 top:
2261 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2262 		if (error == ENOENT)
2263 			error = SET_ERROR(ESRCH);
2264 		return (error);
2265 	}
2266 
2267 	p = strrchr(zc->zc_name, '/');
2268 	if (p == NULL || p[1] != '\0')
2269 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2270 	p = zc->zc_name + strlen(zc->zc_name);
2271 
2272 	do {
2273 		error = dmu_dir_list_next(os,
2274 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2275 		    NULL, &zc->zc_cookie);
2276 		if (error == ENOENT)
2277 			error = SET_ERROR(ESRCH);
2278 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2279 	dmu_objset_rele(os, FTAG);
2280 
2281 	/*
2282 	 * If it's an internal dataset (ie. with a '$' in its name),
2283 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2284 	 */
2285 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2286 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2287 		if (error == ENOENT) {
2288 			/* We lost a race with destroy, get the next one. */
2289 			zc->zc_name[orig_len] = '\0';
2290 			goto top;
2291 		}
2292 	}
2293 	return (error);
2294 }
2295 
2296 /*
2297  * inputs:
2298  * zc_name		name of filesystem
2299  * zc_cookie		zap cursor
2300  * zc_nvlist_dst_size	size of buffer for property nvlist
2301  * zc_simple		when set, only name is requested
2302  *
2303  * outputs:
2304  * zc_name		name of next snapshot
2305  * zc_objset_stats	stats
2306  * zc_nvlist_dst	property nvlist
2307  * zc_nvlist_dst_size	size of property nvlist
2308  */
2309 static int
2310 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2311 {
2312 	objset_t *os;
2313 	int error;
2314 
2315 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2316 	if (error != 0) {
2317 		return (error == ENOENT ? ESRCH : error);
2318 	}
2319 
2320 	/*
2321 	 * A dataset name of maximum length cannot have any snapshots,
2322 	 * so exit immediately.
2323 	 */
2324 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >=
2325 	    ZFS_MAX_DATASET_NAME_LEN) {
2326 		dmu_objset_rele(os, FTAG);
2327 		return (SET_ERROR(ESRCH));
2328 	}
2329 
2330 	error = dmu_snapshot_list_next(os,
2331 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2332 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2333 	    NULL);
2334 
2335 	if (error == 0 && !zc->zc_simple) {
2336 		dsl_dataset_t *ds;
2337 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2338 
2339 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2340 		if (error == 0) {
2341 			objset_t *ossnap;
2342 
2343 			error = dmu_objset_from_ds(ds, &ossnap);
2344 			if (error == 0)
2345 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2346 			dsl_dataset_rele(ds, FTAG);
2347 		}
2348 	} else if (error == ENOENT) {
2349 		error = SET_ERROR(ESRCH);
2350 	}
2351 
2352 	dmu_objset_rele(os, FTAG);
2353 	/* if we failed, undo the @ that we tacked on to zc_name */
2354 	if (error != 0)
2355 		*strchr(zc->zc_name, '@') = '\0';
2356 	return (error);
2357 }
2358 
2359 static int
2360 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2361 {
2362 	const char *propname = nvpair_name(pair);
2363 	uint64_t *valary;
2364 	unsigned int vallen;
2365 	const char *domain;
2366 	char *dash;
2367 	zfs_userquota_prop_t type;
2368 	uint64_t rid;
2369 	uint64_t quota;
2370 	zfsvfs_t *zfsvfs;
2371 	int err;
2372 
2373 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2374 		nvlist_t *attrs;
2375 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2376 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2377 		    &pair) != 0)
2378 			return (SET_ERROR(EINVAL));
2379 	}
2380 
2381 	/*
2382 	 * A correctly constructed propname is encoded as
2383 	 * userquota@<rid>-<domain>.
2384 	 */
2385 	if ((dash = strchr(propname, '-')) == NULL ||
2386 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2387 	    vallen != 3)
2388 		return (SET_ERROR(EINVAL));
2389 
2390 	domain = dash + 1;
2391 	type = valary[0];
2392 	rid = valary[1];
2393 	quota = valary[2];
2394 
2395 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2396 	if (err == 0) {
2397 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2398 		zfsvfs_rele(zfsvfs, FTAG);
2399 	}
2400 
2401 	return (err);
2402 }
2403 
2404 /*
2405  * If the named property is one that has a special function to set its value,
2406  * return 0 on success and a positive error code on failure; otherwise if it is
2407  * not one of the special properties handled by this function, return -1.
2408  *
2409  * XXX: It would be better for callers of the property interface if we handled
2410  * these special cases in dsl_prop.c (in the dsl layer).
2411  */
2412 static int
2413 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2414     nvpair_t *pair)
2415 {
2416 	const char *propname = nvpair_name(pair);
2417 	zfs_prop_t prop = zfs_name_to_prop(propname);
2418 	uint64_t intval;
2419 	int err = -1;
2420 
2421 	if (prop == ZPROP_INVAL) {
2422 		if (zfs_prop_userquota(propname))
2423 			return (zfs_prop_set_userquota(dsname, pair));
2424 		return (-1);
2425 	}
2426 
2427 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2428 		nvlist_t *attrs;
2429 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2430 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2431 		    &pair) == 0);
2432 	}
2433 
2434 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2435 		return (-1);
2436 
2437 	VERIFY(0 == nvpair_value_uint64(pair, &intval));
2438 
2439 	switch (prop) {
2440 	case ZFS_PROP_QUOTA:
2441 		err = dsl_dir_set_quota(dsname, source, intval);
2442 		break;
2443 	case ZFS_PROP_REFQUOTA:
2444 		err = dsl_dataset_set_refquota(dsname, source, intval);
2445 		break;
2446 	case ZFS_PROP_FILESYSTEM_LIMIT:
2447 	case ZFS_PROP_SNAPSHOT_LIMIT:
2448 		if (intval == UINT64_MAX) {
2449 			/* clearing the limit, just do it */
2450 			err = 0;
2451 		} else {
2452 			err = dsl_dir_activate_fs_ss_limit(dsname);
2453 		}
2454 		/*
2455 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2456 		 * default path to set the value in the nvlist.
2457 		 */
2458 		if (err == 0)
2459 			err = -1;
2460 		break;
2461 	case ZFS_PROP_RESERVATION:
2462 		err = dsl_dir_set_reservation(dsname, source, intval);
2463 		break;
2464 	case ZFS_PROP_REFRESERVATION:
2465 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2466 		break;
2467 	case ZFS_PROP_VOLSIZE:
2468 		err = zvol_set_volsize(dsname, intval);
2469 		break;
2470 	case ZFS_PROP_VERSION:
2471 	{
2472 		zfsvfs_t *zfsvfs;
2473 
2474 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2475 			break;
2476 
2477 		err = zfs_set_version(zfsvfs, intval);
2478 		zfsvfs_rele(zfsvfs, FTAG);
2479 
2480 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2481 			zfs_cmd_t *zc;
2482 
2483 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2484 			(void) strcpy(zc->zc_name, dsname);
2485 			(void) zfs_ioc_userspace_upgrade(zc);
2486 			kmem_free(zc, sizeof (zfs_cmd_t));
2487 		}
2488 		break;
2489 	}
2490 	default:
2491 		err = -1;
2492 	}
2493 
2494 	return (err);
2495 }
2496 
2497 /*
2498  * This function is best effort. If it fails to set any of the given properties,
2499  * it continues to set as many as it can and returns the last error
2500  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2501  * with the list of names of all the properties that failed along with the
2502  * corresponding error numbers.
2503  *
2504  * If every property is set successfully, zero is returned and errlist is not
2505  * modified.
2506  */
2507 int
2508 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2509     nvlist_t *errlist)
2510 {
2511 	nvpair_t *pair;
2512 	nvpair_t *propval;
2513 	int rv = 0;
2514 	uint64_t intval;
2515 	char *strval;
2516 	nvlist_t *genericnvl = fnvlist_alloc();
2517 	nvlist_t *retrynvl = fnvlist_alloc();
2518 
2519 retry:
2520 	pair = NULL;
2521 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2522 		const char *propname = nvpair_name(pair);
2523 		zfs_prop_t prop = zfs_name_to_prop(propname);
2524 		int err = 0;
2525 
2526 		/* decode the property value */
2527 		propval = pair;
2528 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2529 			nvlist_t *attrs;
2530 			attrs = fnvpair_value_nvlist(pair);
2531 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2532 			    &propval) != 0)
2533 				err = SET_ERROR(EINVAL);
2534 		}
2535 
2536 		/* Validate value type */
2537 		if (err == 0 && prop == ZPROP_INVAL) {
2538 			if (zfs_prop_user(propname)) {
2539 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2540 					err = SET_ERROR(EINVAL);
2541 			} else if (zfs_prop_userquota(propname)) {
2542 				if (nvpair_type(propval) !=
2543 				    DATA_TYPE_UINT64_ARRAY)
2544 					err = SET_ERROR(EINVAL);
2545 			} else {
2546 				err = SET_ERROR(EINVAL);
2547 			}
2548 		} else if (err == 0) {
2549 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2550 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2551 					err = SET_ERROR(EINVAL);
2552 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2553 				const char *unused;
2554 
2555 				intval = fnvpair_value_uint64(propval);
2556 
2557 				switch (zfs_prop_get_type(prop)) {
2558 				case PROP_TYPE_NUMBER:
2559 					break;
2560 				case PROP_TYPE_STRING:
2561 					err = SET_ERROR(EINVAL);
2562 					break;
2563 				case PROP_TYPE_INDEX:
2564 					if (zfs_prop_index_to_string(prop,
2565 					    intval, &unused) != 0)
2566 						err = SET_ERROR(EINVAL);
2567 					break;
2568 				default:
2569 					cmn_err(CE_PANIC,
2570 					    "unknown property type");
2571 				}
2572 			} else {
2573 				err = SET_ERROR(EINVAL);
2574 			}
2575 		}
2576 
2577 		/* Validate permissions */
2578 		if (err == 0)
2579 			err = zfs_check_settable(dsname, pair, CRED());
2580 
2581 		if (err == 0) {
2582 			err = zfs_prop_set_special(dsname, source, pair);
2583 			if (err == -1) {
2584 				/*
2585 				 * For better performance we build up a list of
2586 				 * properties to set in a single transaction.
2587 				 */
2588 				err = nvlist_add_nvpair(genericnvl, pair);
2589 			} else if (err != 0 && nvl != retrynvl) {
2590 				/*
2591 				 * This may be a spurious error caused by
2592 				 * receiving quota and reservation out of order.
2593 				 * Try again in a second pass.
2594 				 */
2595 				err = nvlist_add_nvpair(retrynvl, pair);
2596 			}
2597 		}
2598 
2599 		if (err != 0) {
2600 			if (errlist != NULL)
2601 				fnvlist_add_int32(errlist, propname, err);
2602 			rv = err;
2603 		}
2604 	}
2605 
2606 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2607 		nvl = retrynvl;
2608 		goto retry;
2609 	}
2610 
2611 	if (!nvlist_empty(genericnvl) &&
2612 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2613 		/*
2614 		 * If this fails, we still want to set as many properties as we
2615 		 * can, so try setting them individually.
2616 		 */
2617 		pair = NULL;
2618 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2619 			const char *propname = nvpair_name(pair);
2620 			int err = 0;
2621 
2622 			propval = pair;
2623 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2624 				nvlist_t *attrs;
2625 				attrs = fnvpair_value_nvlist(pair);
2626 				propval = fnvlist_lookup_nvpair(attrs,
2627 				    ZPROP_VALUE);
2628 			}
2629 
2630 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2631 				strval = fnvpair_value_string(propval);
2632 				err = dsl_prop_set_string(dsname, propname,
2633 				    source, strval);
2634 			} else {
2635 				intval = fnvpair_value_uint64(propval);
2636 				err = dsl_prop_set_int(dsname, propname, source,
2637 				    intval);
2638 			}
2639 
2640 			if (err != 0) {
2641 				if (errlist != NULL) {
2642 					fnvlist_add_int32(errlist, propname,
2643 					    err);
2644 				}
2645 				rv = err;
2646 			}
2647 		}
2648 	}
2649 	nvlist_free(genericnvl);
2650 	nvlist_free(retrynvl);
2651 
2652 	return (rv);
2653 }
2654 
2655 /*
2656  * Check that all the properties are valid user properties.
2657  */
2658 static int
2659 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2660 {
2661 	nvpair_t *pair = NULL;
2662 	int error = 0;
2663 
2664 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2665 		const char *propname = nvpair_name(pair);
2666 
2667 		if (!zfs_prop_user(propname) ||
2668 		    nvpair_type(pair) != DATA_TYPE_STRING)
2669 			return (SET_ERROR(EINVAL));
2670 
2671 		if (error = zfs_secpolicy_write_perms(fsname,
2672 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2673 			return (error);
2674 
2675 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2676 			return (SET_ERROR(ENAMETOOLONG));
2677 
2678 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2679 			return (E2BIG);
2680 	}
2681 	return (0);
2682 }
2683 
2684 static void
2685 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2686 {
2687 	nvpair_t *pair;
2688 
2689 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2690 
2691 	pair = NULL;
2692 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2693 		if (nvlist_exists(skipped, nvpair_name(pair)))
2694 			continue;
2695 
2696 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2697 	}
2698 }
2699 
2700 static int
2701 clear_received_props(const char *dsname, nvlist_t *props,
2702     nvlist_t *skipped)
2703 {
2704 	int err = 0;
2705 	nvlist_t *cleared_props = NULL;
2706 	props_skip(props, skipped, &cleared_props);
2707 	if (!nvlist_empty(cleared_props)) {
2708 		/*
2709 		 * Acts on local properties until the dataset has received
2710 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2711 		 */
2712 		zprop_source_t flags = (ZPROP_SRC_NONE |
2713 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2714 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2715 	}
2716 	nvlist_free(cleared_props);
2717 	return (err);
2718 }
2719 
2720 /*
2721  * inputs:
2722  * zc_name		name of filesystem
2723  * zc_value		name of property to set
2724  * zc_nvlist_src{_size}	nvlist of properties to apply
2725  * zc_cookie		received properties flag
2726  *
2727  * outputs:
2728  * zc_nvlist_dst{_size} error for each unapplied received property
2729  */
2730 static int
2731 zfs_ioc_set_prop(zfs_cmd_t *zc)
2732 {
2733 	nvlist_t *nvl;
2734 	boolean_t received = zc->zc_cookie;
2735 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2736 	    ZPROP_SRC_LOCAL);
2737 	nvlist_t *errors;
2738 	int error;
2739 
2740 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2741 	    zc->zc_iflags, &nvl)) != 0)
2742 		return (error);
2743 
2744 	if (received) {
2745 		nvlist_t *origprops;
2746 
2747 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2748 			(void) clear_received_props(zc->zc_name,
2749 			    origprops, nvl);
2750 			nvlist_free(origprops);
2751 		}
2752 
2753 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2754 	}
2755 
2756 	errors = fnvlist_alloc();
2757 	if (error == 0)
2758 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2759 
2760 	if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2761 		(void) put_nvlist(zc, errors);
2762 	}
2763 
2764 	nvlist_free(errors);
2765 	nvlist_free(nvl);
2766 	return (error);
2767 }
2768 
2769 /*
2770  * inputs:
2771  * zc_name		name of filesystem
2772  * zc_value		name of property to inherit
2773  * zc_cookie		revert to received value if TRUE
2774  *
2775  * outputs:		none
2776  */
2777 static int
2778 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2779 {
2780 	const char *propname = zc->zc_value;
2781 	zfs_prop_t prop = zfs_name_to_prop(propname);
2782 	boolean_t received = zc->zc_cookie;
2783 	zprop_source_t source = (received
2784 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2785 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2786 
2787 	if (received) {
2788 		nvlist_t *dummy;
2789 		nvpair_t *pair;
2790 		zprop_type_t type;
2791 		int err;
2792 
2793 		/*
2794 		 * zfs_prop_set_special() expects properties in the form of an
2795 		 * nvpair with type info.
2796 		 */
2797 		if (prop == ZPROP_INVAL) {
2798 			if (!zfs_prop_user(propname))
2799 				return (SET_ERROR(EINVAL));
2800 
2801 			type = PROP_TYPE_STRING;
2802 		} else if (prop == ZFS_PROP_VOLSIZE ||
2803 		    prop == ZFS_PROP_VERSION) {
2804 			return (SET_ERROR(EINVAL));
2805 		} else {
2806 			type = zfs_prop_get_type(prop);
2807 		}
2808 
2809 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2810 
2811 		switch (type) {
2812 		case PROP_TYPE_STRING:
2813 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2814 			break;
2815 		case PROP_TYPE_NUMBER:
2816 		case PROP_TYPE_INDEX:
2817 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2818 			break;
2819 		default:
2820 			nvlist_free(dummy);
2821 			return (SET_ERROR(EINVAL));
2822 		}
2823 
2824 		pair = nvlist_next_nvpair(dummy, NULL);
2825 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2826 		nvlist_free(dummy);
2827 		if (err != -1)
2828 			return (err); /* special property already handled */
2829 	} else {
2830 		/*
2831 		 * Only check this in the non-received case. We want to allow
2832 		 * 'inherit -S' to revert non-inheritable properties like quota
2833 		 * and reservation to the received or default values even though
2834 		 * they are not considered inheritable.
2835 		 */
2836 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2837 			return (SET_ERROR(EINVAL));
2838 	}
2839 
2840 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2841 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2842 }
2843 
2844 static int
2845 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2846 {
2847 	nvlist_t *props;
2848 	spa_t *spa;
2849 	int error;
2850 	nvpair_t *pair;
2851 
2852 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2853 	    zc->zc_iflags, &props))
2854 		return (error);
2855 
2856 	/*
2857 	 * If the only property is the configfile, then just do a spa_lookup()
2858 	 * to handle the faulted case.
2859 	 */
2860 	pair = nvlist_next_nvpair(props, NULL);
2861 	if (pair != NULL && strcmp(nvpair_name(pair),
2862 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2863 	    nvlist_next_nvpair(props, pair) == NULL) {
2864 		mutex_enter(&spa_namespace_lock);
2865 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2866 			spa_configfile_set(spa, props, B_FALSE);
2867 			spa_config_sync(spa, B_FALSE, B_TRUE);
2868 		}
2869 		mutex_exit(&spa_namespace_lock);
2870 		if (spa != NULL) {
2871 			nvlist_free(props);
2872 			return (0);
2873 		}
2874 	}
2875 
2876 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2877 		nvlist_free(props);
2878 		return (error);
2879 	}
2880 
2881 	error = spa_prop_set(spa, props);
2882 
2883 	nvlist_free(props);
2884 	spa_close(spa, FTAG);
2885 
2886 	return (error);
2887 }
2888 
2889 static int
2890 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2891 {
2892 	spa_t *spa;
2893 	int error;
2894 	nvlist_t *nvp = NULL;
2895 
2896 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2897 		/*
2898 		 * If the pool is faulted, there may be properties we can still
2899 		 * get (such as altroot and cachefile), so attempt to get them
2900 		 * anyway.
2901 		 */
2902 		mutex_enter(&spa_namespace_lock);
2903 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
2904 			error = spa_prop_get(spa, &nvp);
2905 		mutex_exit(&spa_namespace_lock);
2906 	} else {
2907 		error = spa_prop_get(spa, &nvp);
2908 		spa_close(spa, FTAG);
2909 	}
2910 
2911 	if (error == 0 && zc->zc_nvlist_dst != NULL)
2912 		error = put_nvlist(zc, nvp);
2913 	else
2914 		error = SET_ERROR(EFAULT);
2915 
2916 	nvlist_free(nvp);
2917 	return (error);
2918 }
2919 
2920 /*
2921  * inputs:
2922  * zc_name		name of filesystem
2923  * zc_nvlist_src{_size}	nvlist of delegated permissions
2924  * zc_perm_action	allow/unallow flag
2925  *
2926  * outputs:		none
2927  */
2928 static int
2929 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2930 {
2931 	int error;
2932 	nvlist_t *fsaclnv = NULL;
2933 
2934 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2935 	    zc->zc_iflags, &fsaclnv)) != 0)
2936 		return (error);
2937 
2938 	/*
2939 	 * Verify nvlist is constructed correctly
2940 	 */
2941 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2942 		nvlist_free(fsaclnv);
2943 		return (SET_ERROR(EINVAL));
2944 	}
2945 
2946 	/*
2947 	 * If we don't have PRIV_SYS_MOUNT, then validate
2948 	 * that user is allowed to hand out each permission in
2949 	 * the nvlist(s)
2950 	 */
2951 
2952 	error = secpolicy_zfs(CRED());
2953 	if (error != 0) {
2954 		if (zc->zc_perm_action == B_FALSE) {
2955 			error = dsl_deleg_can_allow(zc->zc_name,
2956 			    fsaclnv, CRED());
2957 		} else {
2958 			error = dsl_deleg_can_unallow(zc->zc_name,
2959 			    fsaclnv, CRED());
2960 		}
2961 	}
2962 
2963 	if (error == 0)
2964 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2965 
2966 	nvlist_free(fsaclnv);
2967 	return (error);
2968 }
2969 
2970 /*
2971  * inputs:
2972  * zc_name		name of filesystem
2973  *
2974  * outputs:
2975  * zc_nvlist_src{_size}	nvlist of delegated permissions
2976  */
2977 static int
2978 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
2979 {
2980 	nvlist_t *nvp;
2981 	int error;
2982 
2983 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
2984 		error = put_nvlist(zc, nvp);
2985 		nvlist_free(nvp);
2986 	}
2987 
2988 	return (error);
2989 }
2990 
2991 /* ARGSUSED */
2992 static void
2993 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
2994 {
2995 	zfs_creat_t *zct = arg;
2996 
2997 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
2998 }
2999 
3000 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3001 
3002 /*
3003  * inputs:
3004  * os			parent objset pointer (NULL if root fs)
3005  * fuids_ok		fuids allowed in this version of the spa?
3006  * sa_ok		SAs allowed in this version of the spa?
3007  * createprops		list of properties requested by creator
3008  *
3009  * outputs:
3010  * zplprops	values for the zplprops we attach to the master node object
3011  * is_ci	true if requested file system will be purely case-insensitive
3012  *
3013  * Determine the settings for utf8only, normalization and
3014  * casesensitivity.  Specific values may have been requested by the
3015  * creator and/or we can inherit values from the parent dataset.  If
3016  * the file system is of too early a vintage, a creator can not
3017  * request settings for these properties, even if the requested
3018  * setting is the default value.  We don't actually want to create dsl
3019  * properties for these, so remove them from the source nvlist after
3020  * processing.
3021  */
3022 static int
3023 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3024     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3025     nvlist_t *zplprops, boolean_t *is_ci)
3026 {
3027 	uint64_t sense = ZFS_PROP_UNDEFINED;
3028 	uint64_t norm = ZFS_PROP_UNDEFINED;
3029 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3030 
3031 	ASSERT(zplprops != NULL);
3032 
3033 	if (os != NULL && os->os_phys->os_type != DMU_OST_ZFS)
3034 		return (SET_ERROR(EINVAL));
3035 
3036 	/*
3037 	 * Pull out creator prop choices, if any.
3038 	 */
3039 	if (createprops) {
3040 		(void) nvlist_lookup_uint64(createprops,
3041 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3042 		(void) nvlist_lookup_uint64(createprops,
3043 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3044 		(void) nvlist_remove_all(createprops,
3045 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3046 		(void) nvlist_lookup_uint64(createprops,
3047 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3048 		(void) nvlist_remove_all(createprops,
3049 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3050 		(void) nvlist_lookup_uint64(createprops,
3051 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3052 		(void) nvlist_remove_all(createprops,
3053 		    zfs_prop_to_name(ZFS_PROP_CASE));
3054 	}
3055 
3056 	/*
3057 	 * If the zpl version requested is whacky or the file system
3058 	 * or pool is version is too "young" to support normalization
3059 	 * and the creator tried to set a value for one of the props,
3060 	 * error out.
3061 	 */
3062 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3063 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3064 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3065 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3066 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3067 	    sense != ZFS_PROP_UNDEFINED)))
3068 		return (SET_ERROR(ENOTSUP));
3069 
3070 	/*
3071 	 * Put the version in the zplprops
3072 	 */
3073 	VERIFY(nvlist_add_uint64(zplprops,
3074 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3075 
3076 	if (norm == ZFS_PROP_UNDEFINED)
3077 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3078 	VERIFY(nvlist_add_uint64(zplprops,
3079 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3080 
3081 	/*
3082 	 * If we're normalizing, names must always be valid UTF-8 strings.
3083 	 */
3084 	if (norm)
3085 		u8 = 1;
3086 	if (u8 == ZFS_PROP_UNDEFINED)
3087 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3088 	VERIFY(nvlist_add_uint64(zplprops,
3089 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3090 
3091 	if (sense == ZFS_PROP_UNDEFINED)
3092 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3093 	VERIFY(nvlist_add_uint64(zplprops,
3094 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3095 
3096 	if (is_ci)
3097 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3098 
3099 	return (0);
3100 }
3101 
3102 static int
3103 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3104     nvlist_t *zplprops, boolean_t *is_ci)
3105 {
3106 	boolean_t fuids_ok, sa_ok;
3107 	uint64_t zplver = ZPL_VERSION;
3108 	objset_t *os = NULL;
3109 	char parentname[ZFS_MAX_DATASET_NAME_LEN];
3110 	char *cp;
3111 	spa_t *spa;
3112 	uint64_t spa_vers;
3113 	int error;
3114 
3115 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3116 	cp = strrchr(parentname, '/');
3117 	ASSERT(cp != NULL);
3118 	cp[0] = '\0';
3119 
3120 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3121 		return (error);
3122 
3123 	spa_vers = spa_version(spa);
3124 	spa_close(spa, FTAG);
3125 
3126 	zplver = zfs_zpl_version_map(spa_vers);
3127 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3128 	sa_ok = (zplver >= ZPL_VERSION_SA);
3129 
3130 	/*
3131 	 * Open parent object set so we can inherit zplprop values.
3132 	 */
3133 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3134 		return (error);
3135 
3136 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3137 	    zplprops, is_ci);
3138 	dmu_objset_rele(os, FTAG);
3139 	return (error);
3140 }
3141 
3142 static int
3143 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3144     nvlist_t *zplprops, boolean_t *is_ci)
3145 {
3146 	boolean_t fuids_ok;
3147 	boolean_t sa_ok;
3148 	uint64_t zplver = ZPL_VERSION;
3149 	int error;
3150 
3151 	zplver = zfs_zpl_version_map(spa_vers);
3152 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3153 	sa_ok = (zplver >= ZPL_VERSION_SA);
3154 
3155 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3156 	    createprops, zplprops, is_ci);
3157 	return (error);
3158 }
3159 
3160 /*
3161  * innvl: {
3162  *     "type" -> dmu_objset_type_t (int32)
3163  *     (optional) "props" -> { prop -> value }
3164  * }
3165  *
3166  * outnvl: propname -> error code (int32)
3167  */
3168 static int
3169 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3170 {
3171 	int error = 0;
3172 	zfs_creat_t zct = { 0 };
3173 	nvlist_t *nvprops = NULL;
3174 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3175 	int32_t type32;
3176 	dmu_objset_type_t type;
3177 	boolean_t is_insensitive = B_FALSE;
3178 
3179 	if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3180 		return (SET_ERROR(EINVAL));
3181 	type = type32;
3182 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3183 
3184 	switch (type) {
3185 	case DMU_OST_ZFS:
3186 		cbfunc = zfs_create_cb;
3187 		break;
3188 
3189 	case DMU_OST_ZVOL:
3190 		cbfunc = zvol_create_cb;
3191 		break;
3192 
3193 	default:
3194 		cbfunc = NULL;
3195 		break;
3196 	}
3197 	if (strchr(fsname, '@') ||
3198 	    strchr(fsname, '%'))
3199 		return (SET_ERROR(EINVAL));
3200 
3201 	zct.zct_props = nvprops;
3202 
3203 	if (cbfunc == NULL)
3204 		return (SET_ERROR(EINVAL));
3205 
3206 	if (type == DMU_OST_ZVOL) {
3207 		uint64_t volsize, volblocksize;
3208 
3209 		if (nvprops == NULL)
3210 			return (SET_ERROR(EINVAL));
3211 		if (nvlist_lookup_uint64(nvprops,
3212 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3213 			return (SET_ERROR(EINVAL));
3214 
3215 		if ((error = nvlist_lookup_uint64(nvprops,
3216 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3217 		    &volblocksize)) != 0 && error != ENOENT)
3218 			return (SET_ERROR(EINVAL));
3219 
3220 		if (error != 0)
3221 			volblocksize = zfs_prop_default_numeric(
3222 			    ZFS_PROP_VOLBLOCKSIZE);
3223 
3224 		if ((error = zvol_check_volblocksize(
3225 		    volblocksize)) != 0 ||
3226 		    (error = zvol_check_volsize(volsize,
3227 		    volblocksize)) != 0)
3228 			return (error);
3229 	} else if (type == DMU_OST_ZFS) {
3230 		int error;
3231 
3232 		/*
3233 		 * We have to have normalization and
3234 		 * case-folding flags correct when we do the
3235 		 * file system creation, so go figure them out
3236 		 * now.
3237 		 */
3238 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3239 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3240 		error = zfs_fill_zplprops(fsname, nvprops,
3241 		    zct.zct_zplprops, &is_insensitive);
3242 		if (error != 0) {
3243 			nvlist_free(zct.zct_zplprops);
3244 			return (error);
3245 		}
3246 	}
3247 
3248 	error = dmu_objset_create(fsname, type,
3249 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3250 	nvlist_free(zct.zct_zplprops);
3251 
3252 	/*
3253 	 * It would be nice to do this atomically.
3254 	 */
3255 	if (error == 0) {
3256 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3257 		    nvprops, outnvl);
3258 		if (error != 0)
3259 			(void) dsl_destroy_head(fsname);
3260 	}
3261 	return (error);
3262 }
3263 
3264 /*
3265  * innvl: {
3266  *     "origin" -> name of origin snapshot
3267  *     (optional) "props" -> { prop -> value }
3268  * }
3269  *
3270  * outnvl: propname -> error code (int32)
3271  */
3272 static int
3273 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3274 {
3275 	int error = 0;
3276 	nvlist_t *nvprops = NULL;
3277 	char *origin_name;
3278 
3279 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3280 		return (SET_ERROR(EINVAL));
3281 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3282 
3283 	if (strchr(fsname, '@') ||
3284 	    strchr(fsname, '%'))
3285 		return (SET_ERROR(EINVAL));
3286 
3287 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3288 		return (SET_ERROR(EINVAL));
3289 	error = dmu_objset_clone(fsname, origin_name);
3290 	if (error != 0)
3291 		return (error);
3292 
3293 	/*
3294 	 * It would be nice to do this atomically.
3295 	 */
3296 	if (error == 0) {
3297 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3298 		    nvprops, outnvl);
3299 		if (error != 0)
3300 			(void) dsl_destroy_head(fsname);
3301 	}
3302 	return (error);
3303 }
3304 
3305 /*
3306  * innvl: {
3307  *     "snaps" -> { snapshot1, snapshot2 }
3308  *     (optional) "props" -> { prop -> value (string) }
3309  * }
3310  *
3311  * outnvl: snapshot -> error code (int32)
3312  */
3313 static int
3314 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3315 {
3316 	nvlist_t *snaps;
3317 	nvlist_t *props = NULL;
3318 	int error, poollen;
3319 	nvpair_t *pair;
3320 
3321 	(void) nvlist_lookup_nvlist(innvl, "props", &props);
3322 	if ((error = zfs_check_userprops(poolname, props)) != 0)
3323 		return (error);
3324 
3325 	if (!nvlist_empty(props) &&
3326 	    zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3327 		return (SET_ERROR(ENOTSUP));
3328 
3329 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3330 		return (SET_ERROR(EINVAL));
3331 	poollen = strlen(poolname);
3332 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3333 	    pair = nvlist_next_nvpair(snaps, pair)) {
3334 		const char *name = nvpair_name(pair);
3335 		const char *cp = strchr(name, '@');
3336 
3337 		/*
3338 		 * The snap name must contain an @, and the part after it must
3339 		 * contain only valid characters.
3340 		 */
3341 		if (cp == NULL ||
3342 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3343 			return (SET_ERROR(EINVAL));
3344 
3345 		/*
3346 		 * The snap must be in the specified pool.
3347 		 */
3348 		if (strncmp(name, poolname, poollen) != 0 ||
3349 		    (name[poollen] != '/' && name[poollen] != '@'))
3350 			return (SET_ERROR(EXDEV));
3351 
3352 		/* This must be the only snap of this fs. */
3353 		for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3354 		    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3355 			if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3356 			    == 0) {
3357 				return (SET_ERROR(EXDEV));
3358 			}
3359 		}
3360 	}
3361 
3362 	error = dsl_dataset_snapshot(snaps, props, outnvl);
3363 	return (error);
3364 }
3365 
3366 /*
3367  * innvl: "message" -> string
3368  */
3369 /* ARGSUSED */
3370 static int
3371 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3372 {
3373 	char *message;
3374 	spa_t *spa;
3375 	int error;
3376 	char *poolname;
3377 
3378 	/*
3379 	 * The poolname in the ioctl is not set, we get it from the TSD,
3380 	 * which was set at the end of the last successful ioctl that allows
3381 	 * logging.  The secpolicy func already checked that it is set.
3382 	 * Only one log ioctl is allowed after each successful ioctl, so
3383 	 * we clear the TSD here.
3384 	 */
3385 	poolname = tsd_get(zfs_allow_log_key);
3386 	(void) tsd_set(zfs_allow_log_key, NULL);
3387 	error = spa_open(poolname, &spa, FTAG);
3388 	strfree(poolname);
3389 	if (error != 0)
3390 		return (error);
3391 
3392 	if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3393 		spa_close(spa, FTAG);
3394 		return (SET_ERROR(EINVAL));
3395 	}
3396 
3397 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3398 		spa_close(spa, FTAG);
3399 		return (SET_ERROR(ENOTSUP));
3400 	}
3401 
3402 	error = spa_history_log(spa, message);
3403 	spa_close(spa, FTAG);
3404 	return (error);
3405 }
3406 
3407 /*
3408  * The dp_config_rwlock must not be held when calling this, because the
3409  * unmount may need to write out data.
3410  *
3411  * This function is best-effort.  Callers must deal gracefully if it
3412  * remains mounted (or is remounted after this call).
3413  *
3414  * Returns 0 if the argument is not a snapshot, or it is not currently a
3415  * filesystem, or we were able to unmount it.  Returns error code otherwise.
3416  */
3417 void
3418 zfs_unmount_snap(const char *snapname)
3419 {
3420 	vfs_t *vfsp = NULL;
3421 	zfsvfs_t *zfsvfs = NULL;
3422 
3423 	if (strchr(snapname, '@') == NULL)
3424 		return;
3425 
3426 	int err = getzfsvfs(snapname, &zfsvfs);
3427 	if (err != 0) {
3428 		ASSERT3P(zfsvfs, ==, NULL);
3429 		return;
3430 	}
3431 	vfsp = zfsvfs->z_vfs;
3432 
3433 	ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3434 
3435 	err = vn_vfswlock(vfsp->vfs_vnodecovered);
3436 	VFS_RELE(vfsp);
3437 	if (err != 0)
3438 		return;
3439 
3440 	/*
3441 	 * Always force the unmount for snapshots.
3442 	 */
3443 	(void) dounmount(vfsp, MS_FORCE, kcred);
3444 }
3445 
3446 /* ARGSUSED */
3447 static int
3448 zfs_unmount_snap_cb(const char *snapname, void *arg)
3449 {
3450 	zfs_unmount_snap(snapname);
3451 	return (0);
3452 }
3453 
3454 /*
3455  * When a clone is destroyed, its origin may also need to be destroyed,
3456  * in which case it must be unmounted.  This routine will do that unmount
3457  * if necessary.
3458  */
3459 void
3460 zfs_destroy_unmount_origin(const char *fsname)
3461 {
3462 	int error;
3463 	objset_t *os;
3464 	dsl_dataset_t *ds;
3465 
3466 	error = dmu_objset_hold(fsname, FTAG, &os);
3467 	if (error != 0)
3468 		return;
3469 	ds = dmu_objset_ds(os);
3470 	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3471 		char originname[ZFS_MAX_DATASET_NAME_LEN];
3472 		dsl_dataset_name(ds->ds_prev, originname);
3473 		dmu_objset_rele(os, FTAG);
3474 		zfs_unmount_snap(originname);
3475 	} else {
3476 		dmu_objset_rele(os, FTAG);
3477 	}
3478 }
3479 
3480 /*
3481  * innvl: {
3482  *     "snaps" -> { snapshot1, snapshot2 }
3483  *     (optional boolean) "defer"
3484  * }
3485  *
3486  * outnvl: snapshot -> error code (int32)
3487  *
3488  */
3489 /* ARGSUSED */
3490 static int
3491 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3492 {
3493 	nvlist_t *snaps;
3494 	nvpair_t *pair;
3495 	boolean_t defer;
3496 
3497 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3498 		return (SET_ERROR(EINVAL));
3499 	defer = nvlist_exists(innvl, "defer");
3500 
3501 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3502 	    pair = nvlist_next_nvpair(snaps, pair)) {
3503 		zfs_unmount_snap(nvpair_name(pair));
3504 	}
3505 
3506 	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3507 }
3508 
3509 /*
3510  * Create bookmarks.  Bookmark names are of the form <fs>#<bmark>.
3511  * All bookmarks must be in the same pool.
3512  *
3513  * innvl: {
3514  *     bookmark1 -> snapshot1, bookmark2 -> snapshot2
3515  * }
3516  *
3517  * outnvl: bookmark -> error code (int32)
3518  *
3519  */
3520 /* ARGSUSED */
3521 static int
3522 zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3523 {
3524 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3525 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3526 		char *snap_name;
3527 
3528 		/*
3529 		 * Verify the snapshot argument.
3530 		 */
3531 		if (nvpair_value_string(pair, &snap_name) != 0)
3532 			return (SET_ERROR(EINVAL));
3533 
3534 
3535 		/* Verify that the keys (bookmarks) are unique */
3536 		for (nvpair_t *pair2 = nvlist_next_nvpair(innvl, pair);
3537 		    pair2 != NULL; pair2 = nvlist_next_nvpair(innvl, pair2)) {
3538 			if (strcmp(nvpair_name(pair), nvpair_name(pair2)) == 0)
3539 				return (SET_ERROR(EINVAL));
3540 		}
3541 	}
3542 
3543 	return (dsl_bookmark_create(innvl, outnvl));
3544 }
3545 
3546 /*
3547  * innvl: {
3548  *     property 1, property 2, ...
3549  * }
3550  *
3551  * outnvl: {
3552  *     bookmark name 1 -> { property 1, property 2, ... },
3553  *     bookmark name 2 -> { property 1, property 2, ... }
3554  * }
3555  *
3556  */
3557 static int
3558 zfs_ioc_get_bookmarks(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3559 {
3560 	return (dsl_get_bookmarks(fsname, innvl, outnvl));
3561 }
3562 
3563 /*
3564  * innvl: {
3565  *     bookmark name 1, bookmark name 2
3566  * }
3567  *
3568  * outnvl: bookmark -> error code (int32)
3569  *
3570  */
3571 static int
3572 zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
3573     nvlist_t *outnvl)
3574 {
3575 	int error, poollen;
3576 
3577 	poollen = strlen(poolname);
3578 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3579 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3580 		const char *name = nvpair_name(pair);
3581 		const char *cp = strchr(name, '#');
3582 
3583 		/*
3584 		 * The bookmark name must contain an #, and the part after it
3585 		 * must contain only valid characters.
3586 		 */
3587 		if (cp == NULL ||
3588 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3589 			return (SET_ERROR(EINVAL));
3590 
3591 		/*
3592 		 * The bookmark must be in the specified pool.
3593 		 */
3594 		if (strncmp(name, poolname, poollen) != 0 ||
3595 		    (name[poollen] != '/' && name[poollen] != '#'))
3596 			return (SET_ERROR(EXDEV));
3597 	}
3598 
3599 	error = dsl_bookmark_destroy(innvl, outnvl);
3600 	return (error);
3601 }
3602 
3603 static int
3604 zfs_ioc_channel_program(const char *poolname, nvlist_t *innvl,
3605     nvlist_t *outnvl)
3606 {
3607 	char *program;
3608 	uint64_t instrlimit, memlimit;
3609 	boolean_t sync_flag;
3610 	nvpair_t *nvarg = NULL;
3611 
3612 	if (0 != nvlist_lookup_string(innvl, ZCP_ARG_PROGRAM, &program)) {
3613 		return (EINVAL);
3614 	}
3615 	if (0 != nvlist_lookup_boolean_value(innvl, ZCP_ARG_SYNC, &sync_flag)) {
3616 		sync_flag = B_TRUE;
3617 	}
3618 	if (0 != nvlist_lookup_uint64(innvl, ZCP_ARG_INSTRLIMIT, &instrlimit)) {
3619 		instrlimit = ZCP_DEFAULT_INSTRLIMIT;
3620 	}
3621 	if (0 != nvlist_lookup_uint64(innvl, ZCP_ARG_MEMLIMIT, &memlimit)) {
3622 		memlimit = ZCP_DEFAULT_MEMLIMIT;
3623 	}
3624 	if (0 != nvlist_lookup_nvpair(innvl, ZCP_ARG_ARGLIST, &nvarg)) {
3625 		return (EINVAL);
3626 	}
3627 
3628 	if (instrlimit == 0 || instrlimit > zfs_lua_max_instrlimit)
3629 		return (EINVAL);
3630 	if (memlimit == 0 || memlimit > zfs_lua_max_memlimit)
3631 		return (EINVAL);
3632 
3633 	return (zcp_eval(poolname, program, sync_flag, instrlimit, memlimit,
3634 	    nvarg, outnvl));
3635 }
3636 
3637 /*
3638  * inputs:
3639  * zc_name		name of dataset to destroy
3640  * zc_objset_type	type of objset
3641  * zc_defer_destroy	mark for deferred destroy
3642  *
3643  * outputs:		none
3644  */
3645 static int
3646 zfs_ioc_destroy(zfs_cmd_t *zc)
3647 {
3648 	int err;
3649 
3650 	if (zc->zc_objset_type == DMU_OST_ZFS)
3651 		zfs_unmount_snap(zc->zc_name);
3652 
3653 	if (strchr(zc->zc_name, '@'))
3654 		err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3655 	else
3656 		err = dsl_destroy_head(zc->zc_name);
3657 	if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3658 		(void) zvol_remove_minor(zc->zc_name);
3659 	return (err);
3660 }
3661 
3662 /*
3663  * fsname is name of dataset to rollback (to most recent snapshot)
3664  *
3665  * innvl may contain name of expected target snapshot
3666  *
3667  * outnvl: "target" -> name of most recent snapshot
3668  * }
3669  */
3670 /* ARGSUSED */
3671 static int
3672 zfs_ioc_rollback(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3673 {
3674 	zfsvfs_t *zfsvfs;
3675 	char *target = NULL;
3676 	int error;
3677 
3678 	(void) nvlist_lookup_string(innvl, "target", &target);
3679 	if (target != NULL) {
3680 		int fslen = strlen(fsname);
3681 
3682 		if (strncmp(fsname, target, fslen) != 0)
3683 			return (SET_ERROR(EINVAL));
3684 		if (target[fslen] != '@')
3685 			return (SET_ERROR(EINVAL));
3686 	}
3687 
3688 	if (getzfsvfs(fsname, &zfsvfs) == 0) {
3689 		dsl_dataset_t *ds;
3690 
3691 		ds = dmu_objset_ds(zfsvfs->z_os);
3692 		error = zfs_suspend_fs(zfsvfs);
3693 		if (error == 0) {
3694 			int resume_err;
3695 
3696 			error = dsl_dataset_rollback(fsname, target, zfsvfs,
3697 			    outnvl);
3698 			resume_err = zfs_resume_fs(zfsvfs, ds);
3699 			error = error ? error : resume_err;
3700 		}
3701 		VFS_RELE(zfsvfs->z_vfs);
3702 	} else {
3703 		error = dsl_dataset_rollback(fsname, target, NULL, outnvl);
3704 	}
3705 	return (error);
3706 }
3707 
3708 static int
3709 recursive_unmount(const char *fsname, void *arg)
3710 {
3711 	const char *snapname = arg;
3712 	char fullname[ZFS_MAX_DATASET_NAME_LEN];
3713 
3714 	(void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
3715 	zfs_unmount_snap(fullname);
3716 
3717 	return (0);
3718 }
3719 
3720 /*
3721  * inputs:
3722  * zc_name	old name of dataset
3723  * zc_value	new name of dataset
3724  * zc_cookie	recursive flag (only valid for snapshots)
3725  *
3726  * outputs:	none
3727  */
3728 static int
3729 zfs_ioc_rename(zfs_cmd_t *zc)
3730 {
3731 	boolean_t recursive = zc->zc_cookie & 1;
3732 	char *at;
3733 
3734 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3735 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3736 	    strchr(zc->zc_value, '%'))
3737 		return (SET_ERROR(EINVAL));
3738 
3739 	at = strchr(zc->zc_name, '@');
3740 	if (at != NULL) {
3741 		/* snaps must be in same fs */
3742 		int error;
3743 
3744 		if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
3745 			return (SET_ERROR(EXDEV));
3746 		*at = '\0';
3747 		if (zc->zc_objset_type == DMU_OST_ZFS) {
3748 			error = dmu_objset_find(zc->zc_name,
3749 			    recursive_unmount, at + 1,
3750 			    recursive ? DS_FIND_CHILDREN : 0);
3751 			if (error != 0) {
3752 				*at = '@';
3753 				return (error);
3754 			}
3755 		}
3756 		error = dsl_dataset_rename_snapshot(zc->zc_name,
3757 		    at + 1, strchr(zc->zc_value, '@') + 1, recursive);
3758 		*at = '@';
3759 
3760 		return (error);
3761 	} else {
3762 		if (zc->zc_objset_type == DMU_OST_ZVOL)
3763 			(void) zvol_remove_minor(zc->zc_name);
3764 		return (dsl_dir_rename(zc->zc_name, zc->zc_value));
3765 	}
3766 }
3767 
3768 static int
3769 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3770 {
3771 	const char *propname = nvpair_name(pair);
3772 	boolean_t issnap = (strchr(dsname, '@') != NULL);
3773 	zfs_prop_t prop = zfs_name_to_prop(propname);
3774 	uint64_t intval;
3775 	int err;
3776 
3777 	if (prop == ZPROP_INVAL) {
3778 		if (zfs_prop_user(propname)) {
3779 			if (err = zfs_secpolicy_write_perms(dsname,
3780 			    ZFS_DELEG_PERM_USERPROP, cr))
3781 				return (err);
3782 			return (0);
3783 		}
3784 
3785 		if (!issnap && zfs_prop_userquota(propname)) {
3786 			const char *perm = NULL;
3787 			const char *uq_prefix =
3788 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3789 			const char *gq_prefix =
3790 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3791 
3792 			if (strncmp(propname, uq_prefix,
3793 			    strlen(uq_prefix)) == 0) {
3794 				perm = ZFS_DELEG_PERM_USERQUOTA;
3795 			} else if (strncmp(propname, gq_prefix,
3796 			    strlen(gq_prefix)) == 0) {
3797 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
3798 			} else {
3799 				/* USERUSED and GROUPUSED are read-only */
3800 				return (SET_ERROR(EINVAL));
3801 			}
3802 
3803 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3804 				return (err);
3805 			return (0);
3806 		}
3807 
3808 		return (SET_ERROR(EINVAL));
3809 	}
3810 
3811 	if (issnap)
3812 		return (SET_ERROR(EINVAL));
3813 
3814 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3815 		/*
3816 		 * dsl_prop_get_all_impl() returns properties in this
3817 		 * format.
3818 		 */
3819 		nvlist_t *attrs;
3820 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3821 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3822 		    &pair) == 0);
3823 	}
3824 
3825 	/*
3826 	 * Check that this value is valid for this pool version
3827 	 */
3828 	switch (prop) {
3829 	case ZFS_PROP_COMPRESSION:
3830 		/*
3831 		 * If the user specified gzip compression, make sure
3832 		 * the SPA supports it. We ignore any errors here since
3833 		 * we'll catch them later.
3834 		 */
3835 		if (nvpair_value_uint64(pair, &intval) == 0) {
3836 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
3837 			    intval <= ZIO_COMPRESS_GZIP_9 &&
3838 			    zfs_earlier_version(dsname,
3839 			    SPA_VERSION_GZIP_COMPRESSION)) {
3840 				return (SET_ERROR(ENOTSUP));
3841 			}
3842 
3843 			if (intval == ZIO_COMPRESS_ZLE &&
3844 			    zfs_earlier_version(dsname,
3845 			    SPA_VERSION_ZLE_COMPRESSION))
3846 				return (SET_ERROR(ENOTSUP));
3847 
3848 			if (intval == ZIO_COMPRESS_LZ4) {
3849 				spa_t *spa;
3850 
3851 				if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3852 					return (err);
3853 
3854 				if (!spa_feature_is_enabled(spa,
3855 				    SPA_FEATURE_LZ4_COMPRESS)) {
3856 					spa_close(spa, FTAG);
3857 					return (SET_ERROR(ENOTSUP));
3858 				}
3859 				spa_close(spa, FTAG);
3860 			}
3861 
3862 			/*
3863 			 * If this is a bootable dataset then
3864 			 * verify that the compression algorithm
3865 			 * is supported for booting. We must return
3866 			 * something other than ENOTSUP since it
3867 			 * implies a downrev pool version.
3868 			 */
3869 			if (zfs_is_bootfs(dsname) &&
3870 			    !BOOTFS_COMPRESS_VALID(intval)) {
3871 				return (SET_ERROR(ERANGE));
3872 			}
3873 		}
3874 		break;
3875 
3876 	case ZFS_PROP_COPIES:
3877 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3878 			return (SET_ERROR(ENOTSUP));
3879 		break;
3880 
3881 	case ZFS_PROP_RECORDSIZE:
3882 		/* Record sizes above 128k need the feature to be enabled */
3883 		if (nvpair_value_uint64(pair, &intval) == 0 &&
3884 		    intval > SPA_OLD_MAXBLOCKSIZE) {
3885 			spa_t *spa;
3886 
3887 			/*
3888 			 * We don't allow setting the property above 1MB,
3889 			 * unless the tunable has been changed.
3890 			 */
3891 			if (intval > zfs_max_recordsize ||
3892 			    intval > SPA_MAXBLOCKSIZE)
3893 				return (SET_ERROR(ERANGE));
3894 
3895 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3896 				return (err);
3897 
3898 			if (!spa_feature_is_enabled(spa,
3899 			    SPA_FEATURE_LARGE_BLOCKS)) {
3900 				spa_close(spa, FTAG);
3901 				return (SET_ERROR(ENOTSUP));
3902 			}
3903 			spa_close(spa, FTAG);
3904 		}
3905 		break;
3906 
3907 	case ZFS_PROP_SHARESMB:
3908 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3909 			return (SET_ERROR(ENOTSUP));
3910 		break;
3911 
3912 	case ZFS_PROP_ACLINHERIT:
3913 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3914 		    nvpair_value_uint64(pair, &intval) == 0) {
3915 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
3916 			    zfs_earlier_version(dsname,
3917 			    SPA_VERSION_PASSTHROUGH_X))
3918 				return (SET_ERROR(ENOTSUP));
3919 		}
3920 		break;
3921 
3922 	case ZFS_PROP_CHECKSUM:
3923 	case ZFS_PROP_DEDUP:
3924 	{
3925 		spa_feature_t feature;
3926 		spa_t *spa;
3927 
3928 		/* dedup feature version checks */
3929 		if (prop == ZFS_PROP_DEDUP &&
3930 		    zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3931 			return (SET_ERROR(ENOTSUP));
3932 
3933 		if (nvpair_value_uint64(pair, &intval) != 0)
3934 			return (SET_ERROR(EINVAL));
3935 
3936 		/* check prop value is enabled in features */
3937 		feature = zio_checksum_to_feature(intval & ZIO_CHECKSUM_MASK);
3938 		if (feature == SPA_FEATURE_NONE)
3939 			break;
3940 
3941 		if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3942 			return (err);
3943 		/*
3944 		 * Salted checksums are not supported on root pools.
3945 		 */
3946 		if (spa_bootfs(spa) != 0 &&
3947 		    intval < ZIO_CHECKSUM_FUNCTIONS &&
3948 		    (zio_checksum_table[intval].ci_flags &
3949 		    ZCHECKSUM_FLAG_SALTED)) {
3950 			spa_close(spa, FTAG);
3951 			return (SET_ERROR(ERANGE));
3952 		}
3953 		if (!spa_feature_is_enabled(spa, feature)) {
3954 			spa_close(spa, FTAG);
3955 			return (SET_ERROR(ENOTSUP));
3956 		}
3957 		spa_close(spa, FTAG);
3958 		break;
3959 	}
3960 	}
3961 
3962 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3963 }
3964 
3965 /*
3966  * Checks for a race condition to make sure we don't increment a feature flag
3967  * multiple times.
3968  */
3969 static int
3970 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
3971 {
3972 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3973 	spa_feature_t *featurep = arg;
3974 
3975 	if (!spa_feature_is_active(spa, *featurep))
3976 		return (0);
3977 	else
3978 		return (SET_ERROR(EBUSY));
3979 }
3980 
3981 /*
3982  * The callback invoked on feature activation in the sync task caused by
3983  * zfs_prop_activate_feature.
3984  */
3985 static void
3986 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
3987 {
3988 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3989 	spa_feature_t *featurep = arg;
3990 
3991 	spa_feature_incr(spa, *featurep, tx);
3992 }
3993 
3994 /*
3995  * Activates a feature on a pool in response to a property setting. This
3996  * creates a new sync task which modifies the pool to reflect the feature
3997  * as being active.
3998  */
3999 static int
4000 zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature)
4001 {
4002 	int err;
4003 
4004 	/* EBUSY here indicates that the feature is already active */
4005 	err = dsl_sync_task(spa_name(spa),
4006 	    zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
4007 	    &feature, 2, ZFS_SPACE_CHECK_RESERVED);
4008 
4009 	if (err != 0 && err != EBUSY)
4010 		return (err);
4011 	else
4012 		return (0);
4013 }
4014 
4015 /*
4016  * Removes properties from the given props list that fail permission checks
4017  * needed to clear them and to restore them in case of a receive error. For each
4018  * property, make sure we have both set and inherit permissions.
4019  *
4020  * Returns the first error encountered if any permission checks fail. If the
4021  * caller provides a non-NULL errlist, it also gives the complete list of names
4022  * of all the properties that failed a permission check along with the
4023  * corresponding error numbers. The caller is responsible for freeing the
4024  * returned errlist.
4025  *
4026  * If every property checks out successfully, zero is returned and the list
4027  * pointed at by errlist is NULL.
4028  */
4029 static int
4030 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
4031 {
4032 	zfs_cmd_t *zc;
4033 	nvpair_t *pair, *next_pair;
4034 	nvlist_t *errors;
4035 	int err, rv = 0;
4036 
4037 	if (props == NULL)
4038 		return (0);
4039 
4040 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4041 
4042 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
4043 	(void) strcpy(zc->zc_name, dataset);
4044 	pair = nvlist_next_nvpair(props, NULL);
4045 	while (pair != NULL) {
4046 		next_pair = nvlist_next_nvpair(props, pair);
4047 
4048 		(void) strcpy(zc->zc_value, nvpair_name(pair));
4049 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
4050 		    (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
4051 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
4052 			VERIFY(nvlist_add_int32(errors,
4053 			    zc->zc_value, err) == 0);
4054 		}
4055 		pair = next_pair;
4056 	}
4057 	kmem_free(zc, sizeof (zfs_cmd_t));
4058 
4059 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
4060 		nvlist_free(errors);
4061 		errors = NULL;
4062 	} else {
4063 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
4064 	}
4065 
4066 	if (errlist == NULL)
4067 		nvlist_free(errors);
4068 	else
4069 		*errlist = errors;
4070 
4071 	return (rv);
4072 }
4073 
4074 static boolean_t
4075 propval_equals(nvpair_t *p1, nvpair_t *p2)
4076 {
4077 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
4078 		/* dsl_prop_get_all_impl() format */
4079 		nvlist_t *attrs;
4080 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
4081 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4082 		    &p1) == 0);
4083 	}
4084 
4085 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
4086 		nvlist_t *attrs;
4087 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
4088 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4089 		    &p2) == 0);
4090 	}
4091 
4092 	if (nvpair_type(p1) != nvpair_type(p2))
4093 		return (B_FALSE);
4094 
4095 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
4096 		char *valstr1, *valstr2;
4097 
4098 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
4099 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
4100 		return (strcmp(valstr1, valstr2) == 0);
4101 	} else {
4102 		uint64_t intval1, intval2;
4103 
4104 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
4105 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
4106 		return (intval1 == intval2);
4107 	}
4108 }
4109 
4110 /*
4111  * Remove properties from props if they are not going to change (as determined
4112  * by comparison with origprops). Remove them from origprops as well, since we
4113  * do not need to clear or restore properties that won't change.
4114  */
4115 static void
4116 props_reduce(nvlist_t *props, nvlist_t *origprops)
4117 {
4118 	nvpair_t *pair, *next_pair;
4119 
4120 	if (origprops == NULL)
4121 		return; /* all props need to be received */
4122 
4123 	pair = nvlist_next_nvpair(props, NULL);
4124 	while (pair != NULL) {
4125 		const char *propname = nvpair_name(pair);
4126 		nvpair_t *match;
4127 
4128 		next_pair = nvlist_next_nvpair(props, pair);
4129 
4130 		if ((nvlist_lookup_nvpair(origprops, propname,
4131 		    &match) != 0) || !propval_equals(pair, match))
4132 			goto next; /* need to set received value */
4133 
4134 		/* don't clear the existing received value */
4135 		(void) nvlist_remove_nvpair(origprops, match);
4136 		/* don't bother receiving the property */
4137 		(void) nvlist_remove_nvpair(props, pair);
4138 next:
4139 		pair = next_pair;
4140 	}
4141 }
4142 
4143 /*
4144  * Extract properties that cannot be set PRIOR to the receipt of a dataset.
4145  * For example, refquota cannot be set until after the receipt of a dataset,
4146  * because in replication streams, an older/earlier snapshot may exceed the
4147  * refquota.  We want to receive the older/earlier snapshot, but setting
4148  * refquota pre-receipt will set the dsl's ACTUAL quota, which will prevent
4149  * the older/earlier snapshot from being received (with EDQUOT).
4150  *
4151  * The ZFS test "zfs_receive_011_pos" demonstrates such a scenario.
4152  *
4153  * libzfs will need to be judicious handling errors encountered by props
4154  * extracted by this function.
4155  */
4156 static nvlist_t *
4157 extract_delay_props(nvlist_t *props)
4158 {
4159 	nvlist_t *delayprops;
4160 	nvpair_t *nvp, *tmp;
4161 	static const zfs_prop_t delayable[] = { ZFS_PROP_REFQUOTA, 0 };
4162 	int i;
4163 
4164 	VERIFY(nvlist_alloc(&delayprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4165 
4166 	for (nvp = nvlist_next_nvpair(props, NULL); nvp != NULL;
4167 	    nvp = nvlist_next_nvpair(props, nvp)) {
4168 		/*
4169 		 * strcmp() is safe because zfs_prop_to_name() always returns
4170 		 * a bounded string.
4171 		 */
4172 		for (i = 0; delayable[i] != 0; i++) {
4173 			if (strcmp(zfs_prop_to_name(delayable[i]),
4174 			    nvpair_name(nvp)) == 0) {
4175 				break;
4176 			}
4177 		}
4178 		if (delayable[i] != 0) {
4179 			tmp = nvlist_prev_nvpair(props, nvp);
4180 			VERIFY(nvlist_add_nvpair(delayprops, nvp) == 0);
4181 			VERIFY(nvlist_remove_nvpair(props, nvp) == 0);
4182 			nvp = tmp;
4183 		}
4184 	}
4185 
4186 	if (nvlist_empty(delayprops)) {
4187 		nvlist_free(delayprops);
4188 		delayprops = NULL;
4189 	}
4190 	return (delayprops);
4191 }
4192 
4193 #ifdef	DEBUG
4194 static boolean_t zfs_ioc_recv_inject_err;
4195 #endif
4196 
4197 /*
4198  * inputs:
4199  * zc_name		name of containing filesystem
4200  * zc_nvlist_src{_size}	nvlist of properties to apply
4201  * zc_value		name of snapshot to create
4202  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
4203  * zc_cookie		file descriptor to recv from
4204  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
4205  * zc_guid		force flag
4206  * zc_cleanup_fd	cleanup-on-exit file descriptor
4207  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
4208  * zc_resumable		if data is incomplete assume sender will resume
4209  *
4210  * outputs:
4211  * zc_cookie		number of bytes read
4212  * zc_nvlist_dst{_size} error for each unapplied received property
4213  * zc_obj		zprop_errflags_t
4214  * zc_action_handle	handle for this guid/ds mapping
4215  */
4216 static int
4217 zfs_ioc_recv(zfs_cmd_t *zc)
4218 {
4219 	file_t *fp;
4220 	dmu_recv_cookie_t drc;
4221 	boolean_t force = (boolean_t)zc->zc_guid;
4222 	int fd;
4223 	int error = 0;
4224 	int props_error = 0;
4225 	nvlist_t *errors;
4226 	offset_t off;
4227 	nvlist_t *props = NULL; /* sent properties */
4228 	nvlist_t *origprops = NULL; /* existing properties */
4229 	nvlist_t *delayprops = NULL; /* sent properties applied post-receive */
4230 	char *origin = NULL;
4231 	char *tosnap;
4232 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
4233 	boolean_t first_recvd_props = B_FALSE;
4234 
4235 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
4236 	    strchr(zc->zc_value, '@') == NULL ||
4237 	    strchr(zc->zc_value, '%'))
4238 		return (SET_ERROR(EINVAL));
4239 
4240 	(void) strcpy(tofs, zc->zc_value);
4241 	tosnap = strchr(tofs, '@');
4242 	*tosnap++ = '\0';
4243 
4244 	if (zc->zc_nvlist_src != NULL &&
4245 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
4246 	    zc->zc_iflags, &props)) != 0)
4247 		return (error);
4248 
4249 	fd = zc->zc_cookie;
4250 	fp = getf(fd);
4251 	if (fp == NULL) {
4252 		nvlist_free(props);
4253 		return (SET_ERROR(EBADF));
4254 	}
4255 
4256 	errors = fnvlist_alloc();
4257 
4258 	if (zc->zc_string[0])
4259 		origin = zc->zc_string;
4260 
4261 	error = dmu_recv_begin(tofs, tosnap,
4262 	    &zc->zc_begin_record, force, zc->zc_resumable, origin, &drc);
4263 	if (error != 0)
4264 		goto out;
4265 
4266 	/*
4267 	 * Set properties before we receive the stream so that they are applied
4268 	 * to the new data. Note that we must call dmu_recv_stream() if
4269 	 * dmu_recv_begin() succeeds.
4270 	 */
4271 	if (props != NULL && !drc.drc_newfs) {
4272 		if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
4273 		    SPA_VERSION_RECVD_PROPS &&
4274 		    !dsl_prop_get_hasrecvd(tofs))
4275 			first_recvd_props = B_TRUE;
4276 
4277 		/*
4278 		 * If new received properties are supplied, they are to
4279 		 * completely replace the existing received properties, so stash
4280 		 * away the existing ones.
4281 		 */
4282 		if (dsl_prop_get_received(tofs, &origprops) == 0) {
4283 			nvlist_t *errlist = NULL;
4284 			/*
4285 			 * Don't bother writing a property if its value won't
4286 			 * change (and avoid the unnecessary security checks).
4287 			 *
4288 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
4289 			 * special case where we blow away all local properties
4290 			 * regardless.
4291 			 */
4292 			if (!first_recvd_props)
4293 				props_reduce(props, origprops);
4294 			if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
4295 				(void) nvlist_merge(errors, errlist, 0);
4296 			nvlist_free(errlist);
4297 
4298 			if (clear_received_props(tofs, origprops,
4299 			    first_recvd_props ? NULL : props) != 0)
4300 				zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4301 		} else {
4302 			zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4303 		}
4304 	}
4305 
4306 	if (props != NULL) {
4307 		props_error = dsl_prop_set_hasrecvd(tofs);
4308 
4309 		if (props_error == 0) {
4310 			delayprops = extract_delay_props(props);
4311 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4312 			    props, errors);
4313 		}
4314 	}
4315 
4316 	off = fp->f_offset;
4317 	error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4318 	    &zc->zc_action_handle);
4319 
4320 	if (error == 0) {
4321 		zfsvfs_t *zfsvfs = NULL;
4322 
4323 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
4324 			/* online recv */
4325 			dsl_dataset_t *ds;
4326 			int end_err;
4327 
4328 			ds = dmu_objset_ds(zfsvfs->z_os);
4329 			error = zfs_suspend_fs(zfsvfs);
4330 			/*
4331 			 * If the suspend fails, then the recv_end will
4332 			 * likely also fail, and clean up after itself.
4333 			 */
4334 			end_err = dmu_recv_end(&drc, zfsvfs);
4335 			if (error == 0)
4336 				error = zfs_resume_fs(zfsvfs, ds);
4337 			error = error ? error : end_err;
4338 			VFS_RELE(zfsvfs->z_vfs);
4339 		} else {
4340 			error = dmu_recv_end(&drc, NULL);
4341 		}
4342 
4343 		/* Set delayed properties now, after we're done receiving. */
4344 		if (delayprops != NULL && error == 0) {
4345 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4346 			    delayprops, errors);
4347 		}
4348 	}
4349 
4350 	if (delayprops != NULL) {
4351 		/*
4352 		 * Merge delayed props back in with initial props, in case
4353 		 * we're DEBUG and zfs_ioc_recv_inject_err is set (which means
4354 		 * we have to make sure clear_received_props() includes
4355 		 * the delayed properties).
4356 		 *
4357 		 * Since zfs_ioc_recv_inject_err is only in DEBUG kernels,
4358 		 * using ASSERT() will be just like a VERIFY.
4359 		 */
4360 		ASSERT(nvlist_merge(props, delayprops, 0) == 0);
4361 		nvlist_free(delayprops);
4362 	}
4363 
4364 	/*
4365 	 * Now that all props, initial and delayed, are set, report the prop
4366 	 * errors to the caller.
4367 	 */
4368 	if (zc->zc_nvlist_dst_size != 0 &&
4369 	    (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4370 	    put_nvlist(zc, errors) != 0)) {
4371 		/*
4372 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
4373 		 * size or supplied an invalid address.
4374 		 */
4375 		props_error = SET_ERROR(EINVAL);
4376 	}
4377 
4378 	zc->zc_cookie = off - fp->f_offset;
4379 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4380 		fp->f_offset = off;
4381 
4382 #ifdef	DEBUG
4383 	if (zfs_ioc_recv_inject_err) {
4384 		zfs_ioc_recv_inject_err = B_FALSE;
4385 		error = 1;
4386 	}
4387 #endif
4388 	/*
4389 	 * On error, restore the original props.
4390 	 */
4391 	if (error != 0 && props != NULL && !drc.drc_newfs) {
4392 		if (clear_received_props(tofs, props, NULL) != 0) {
4393 			/*
4394 			 * We failed to clear the received properties.
4395 			 * Since we may have left a $recvd value on the
4396 			 * system, we can't clear the $hasrecvd flag.
4397 			 */
4398 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4399 		} else if (first_recvd_props) {
4400 			dsl_prop_unset_hasrecvd(tofs);
4401 		}
4402 
4403 		if (origprops == NULL && !drc.drc_newfs) {
4404 			/* We failed to stash the original properties. */
4405 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4406 		}
4407 
4408 		/*
4409 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
4410 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4411 		 * explictly if we're restoring local properties cleared in the
4412 		 * first new-style receive.
4413 		 */
4414 		if (origprops != NULL &&
4415 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4416 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4417 		    origprops, NULL) != 0) {
4418 			/*
4419 			 * We stashed the original properties but failed to
4420 			 * restore them.
4421 			 */
4422 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4423 		}
4424 	}
4425 out:
4426 	nvlist_free(props);
4427 	nvlist_free(origprops);
4428 	nvlist_free(errors);
4429 	releasef(fd);
4430 
4431 	if (error == 0)
4432 		error = props_error;
4433 
4434 	return (error);
4435 }
4436 
4437 /*
4438  * inputs:
4439  * zc_name	name of snapshot to send
4440  * zc_cookie	file descriptor to send stream to
4441  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
4442  * zc_sendobj	objsetid of snapshot to send
4443  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
4444  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
4445  *		output size in zc_objset_type.
4446  * zc_flags	lzc_send_flags
4447  *
4448  * outputs:
4449  * zc_objset_type	estimated size, if zc_guid is set
4450  */
4451 static int
4452 zfs_ioc_send(zfs_cmd_t *zc)
4453 {
4454 	int error;
4455 	offset_t off;
4456 	boolean_t estimate = (zc->zc_guid != 0);
4457 	boolean_t embedok = (zc->zc_flags & 0x1);
4458 	boolean_t large_block_ok = (zc->zc_flags & 0x2);
4459 	boolean_t compressok = (zc->zc_flags & 0x4);
4460 
4461 	if (zc->zc_obj != 0) {
4462 		dsl_pool_t *dp;
4463 		dsl_dataset_t *tosnap;
4464 
4465 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4466 		if (error != 0)
4467 			return (error);
4468 
4469 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4470 		if (error != 0) {
4471 			dsl_pool_rele(dp, FTAG);
4472 			return (error);
4473 		}
4474 
4475 		if (dsl_dir_is_clone(tosnap->ds_dir))
4476 			zc->zc_fromobj =
4477 			    dsl_dir_phys(tosnap->ds_dir)->dd_origin_obj;
4478 		dsl_dataset_rele(tosnap, FTAG);
4479 		dsl_pool_rele(dp, FTAG);
4480 	}
4481 
4482 	if (estimate) {
4483 		dsl_pool_t *dp;
4484 		dsl_dataset_t *tosnap;
4485 		dsl_dataset_t *fromsnap = NULL;
4486 
4487 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4488 		if (error != 0)
4489 			return (error);
4490 
4491 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4492 		if (error != 0) {
4493 			dsl_pool_rele(dp, FTAG);
4494 			return (error);
4495 		}
4496 
4497 		if (zc->zc_fromobj != 0) {
4498 			error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
4499 			    FTAG, &fromsnap);
4500 			if (error != 0) {
4501 				dsl_dataset_rele(tosnap, FTAG);
4502 				dsl_pool_rele(dp, FTAG);
4503 				return (error);
4504 			}
4505 		}
4506 
4507 		error = dmu_send_estimate(tosnap, fromsnap, compressok,
4508 		    &zc->zc_objset_type);
4509 
4510 		if (fromsnap != NULL)
4511 			dsl_dataset_rele(fromsnap, FTAG);
4512 		dsl_dataset_rele(tosnap, FTAG);
4513 		dsl_pool_rele(dp, FTAG);
4514 	} else {
4515 		file_t *fp = getf(zc->zc_cookie);
4516 		if (fp == NULL)
4517 			return (SET_ERROR(EBADF));
4518 
4519 		off = fp->f_offset;
4520 		error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
4521 		    zc->zc_fromobj, embedok, large_block_ok, compressok,
4522 		    zc->zc_cookie, fp->f_vnode, &off);
4523 
4524 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4525 			fp->f_offset = off;
4526 		releasef(zc->zc_cookie);
4527 	}
4528 	return (error);
4529 }
4530 
4531 /*
4532  * inputs:
4533  * zc_name	name of snapshot on which to report progress
4534  * zc_cookie	file descriptor of send stream
4535  *
4536  * outputs:
4537  * zc_cookie	number of bytes written in send stream thus far
4538  */
4539 static int
4540 zfs_ioc_send_progress(zfs_cmd_t *zc)
4541 {
4542 	dsl_pool_t *dp;
4543 	dsl_dataset_t *ds;
4544 	dmu_sendarg_t *dsp = NULL;
4545 	int error;
4546 
4547 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4548 	if (error != 0)
4549 		return (error);
4550 
4551 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4552 	if (error != 0) {
4553 		dsl_pool_rele(dp, FTAG);
4554 		return (error);
4555 	}
4556 
4557 	mutex_enter(&ds->ds_sendstream_lock);
4558 
4559 	/*
4560 	 * Iterate over all the send streams currently active on this dataset.
4561 	 * If there's one which matches the specified file descriptor _and_ the
4562 	 * stream was started by the current process, return the progress of
4563 	 * that stream.
4564 	 */
4565 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4566 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
4567 		if (dsp->dsa_outfd == zc->zc_cookie &&
4568 		    dsp->dsa_proc == curproc)
4569 			break;
4570 	}
4571 
4572 	if (dsp != NULL)
4573 		zc->zc_cookie = *(dsp->dsa_off);
4574 	else
4575 		error = SET_ERROR(ENOENT);
4576 
4577 	mutex_exit(&ds->ds_sendstream_lock);
4578 	dsl_dataset_rele(ds, FTAG);
4579 	dsl_pool_rele(dp, FTAG);
4580 	return (error);
4581 }
4582 
4583 static int
4584 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4585 {
4586 	int id, error;
4587 
4588 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4589 	    &zc->zc_inject_record);
4590 
4591 	if (error == 0)
4592 		zc->zc_guid = (uint64_t)id;
4593 
4594 	return (error);
4595 }
4596 
4597 static int
4598 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4599 {
4600 	return (zio_clear_fault((int)zc->zc_guid));
4601 }
4602 
4603 static int
4604 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4605 {
4606 	int id = (int)zc->zc_guid;
4607 	int error;
4608 
4609 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4610 	    &zc->zc_inject_record);
4611 
4612 	zc->zc_guid = id;
4613 
4614 	return (error);
4615 }
4616 
4617 static int
4618 zfs_ioc_error_log(zfs_cmd_t *zc)
4619 {
4620 	spa_t *spa;
4621 	int error;
4622 	size_t count = (size_t)zc->zc_nvlist_dst_size;
4623 
4624 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4625 		return (error);
4626 
4627 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4628 	    &count);
4629 	if (error == 0)
4630 		zc->zc_nvlist_dst_size = count;
4631 	else
4632 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4633 
4634 	spa_close(spa, FTAG);
4635 
4636 	return (error);
4637 }
4638 
4639 static int
4640 zfs_ioc_clear(zfs_cmd_t *zc)
4641 {
4642 	spa_t *spa;
4643 	vdev_t *vd;
4644 	int error;
4645 
4646 	/*
4647 	 * On zpool clear we also fix up missing slogs
4648 	 */
4649 	mutex_enter(&spa_namespace_lock);
4650 	spa = spa_lookup(zc->zc_name);
4651 	if (spa == NULL) {
4652 		mutex_exit(&spa_namespace_lock);
4653 		return (SET_ERROR(EIO));
4654 	}
4655 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4656 		/* we need to let spa_open/spa_load clear the chains */
4657 		spa_set_log_state(spa, SPA_LOG_CLEAR);
4658 	}
4659 	spa->spa_last_open_failed = 0;
4660 	mutex_exit(&spa_namespace_lock);
4661 
4662 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4663 		error = spa_open(zc->zc_name, &spa, FTAG);
4664 	} else {
4665 		nvlist_t *policy;
4666 		nvlist_t *config = NULL;
4667 
4668 		if (zc->zc_nvlist_src == NULL)
4669 			return (SET_ERROR(EINVAL));
4670 
4671 		if ((error = get_nvlist(zc->zc_nvlist_src,
4672 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4673 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4674 			    policy, &config);
4675 			if (config != NULL) {
4676 				int err;
4677 
4678 				if ((err = put_nvlist(zc, config)) != 0)
4679 					error = err;
4680 				nvlist_free(config);
4681 			}
4682 			nvlist_free(policy);
4683 		}
4684 	}
4685 
4686 	if (error != 0)
4687 		return (error);
4688 
4689 	spa_vdev_state_enter(spa, SCL_NONE);
4690 
4691 	if (zc->zc_guid == 0) {
4692 		vd = NULL;
4693 	} else {
4694 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4695 		if (vd == NULL) {
4696 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
4697 			spa_close(spa, FTAG);
4698 			return (SET_ERROR(ENODEV));
4699 		}
4700 	}
4701 
4702 	vdev_clear(spa, vd);
4703 
4704 	(void) spa_vdev_state_exit(spa, NULL, 0);
4705 
4706 	/*
4707 	 * Resume any suspended I/Os.
4708 	 */
4709 	if (zio_resume(spa) != 0)
4710 		error = SET_ERROR(EIO);
4711 
4712 	spa_close(spa, FTAG);
4713 
4714 	return (error);
4715 }
4716 
4717 static int
4718 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4719 {
4720 	spa_t *spa;
4721 	int error;
4722 
4723 	error = spa_open(zc->zc_name, &spa, FTAG);
4724 	if (error != 0)
4725 		return (error);
4726 
4727 	spa_vdev_state_enter(spa, SCL_NONE);
4728 
4729 	/*
4730 	 * If a resilver is already in progress then set the
4731 	 * spa_scrub_reopen flag to B_TRUE so that we don't restart
4732 	 * the scan as a side effect of the reopen. Otherwise, let
4733 	 * vdev_open() decided if a resilver is required.
4734 	 */
4735 	spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4736 	vdev_reopen(spa->spa_root_vdev);
4737 	spa->spa_scrub_reopen = B_FALSE;
4738 
4739 	(void) spa_vdev_state_exit(spa, NULL, 0);
4740 	spa_close(spa, FTAG);
4741 	return (0);
4742 }
4743 /*
4744  * inputs:
4745  * zc_name	name of filesystem
4746  *
4747  * outputs:
4748  * zc_string	name of conflicting snapshot, if there is one
4749  */
4750 static int
4751 zfs_ioc_promote(zfs_cmd_t *zc)
4752 {
4753 	dsl_pool_t *dp;
4754 	dsl_dataset_t *ds, *ods;
4755 	char origin[ZFS_MAX_DATASET_NAME_LEN];
4756 	char *cp;
4757 	int error;
4758 
4759 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4760 	if (error != 0)
4761 		return (error);
4762 
4763 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4764 	if (error != 0) {
4765 		dsl_pool_rele(dp, FTAG);
4766 		return (error);
4767 	}
4768 
4769 	if (!dsl_dir_is_clone(ds->ds_dir)) {
4770 		dsl_dataset_rele(ds, FTAG);
4771 		dsl_pool_rele(dp, FTAG);
4772 		return (SET_ERROR(EINVAL));
4773 	}
4774 
4775 	error = dsl_dataset_hold_obj(dp,
4776 	    dsl_dir_phys(ds->ds_dir)->dd_origin_obj, FTAG, &ods);
4777 	if (error != 0) {
4778 		dsl_dataset_rele(ds, FTAG);
4779 		dsl_pool_rele(dp, FTAG);
4780 		return (error);
4781 	}
4782 
4783 	dsl_dataset_name(ods, origin);
4784 	dsl_dataset_rele(ods, FTAG);
4785 	dsl_dataset_rele(ds, FTAG);
4786 	dsl_pool_rele(dp, FTAG);
4787 
4788 	/*
4789 	 * We don't need to unmount *all* the origin fs's snapshots, but
4790 	 * it's easier.
4791 	 */
4792 	cp = strchr(origin, '@');
4793 	if (cp)
4794 		*cp = '\0';
4795 	(void) dmu_objset_find(origin,
4796 	    zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
4797 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4798 }
4799 
4800 /*
4801  * Retrieve a single {user|group}{used|quota}@... property.
4802  *
4803  * inputs:
4804  * zc_name	name of filesystem
4805  * zc_objset_type zfs_userquota_prop_t
4806  * zc_value	domain name (eg. "S-1-234-567-89")
4807  * zc_guid	RID/UID/GID
4808  *
4809  * outputs:
4810  * zc_cookie	property value
4811  */
4812 static int
4813 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4814 {
4815 	zfsvfs_t *zfsvfs;
4816 	int error;
4817 
4818 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4819 		return (SET_ERROR(EINVAL));
4820 
4821 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4822 	if (error != 0)
4823 		return (error);
4824 
4825 	error = zfs_userspace_one(zfsvfs,
4826 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4827 	zfsvfs_rele(zfsvfs, FTAG);
4828 
4829 	return (error);
4830 }
4831 
4832 /*
4833  * inputs:
4834  * zc_name		name of filesystem
4835  * zc_cookie		zap cursor
4836  * zc_objset_type	zfs_userquota_prop_t
4837  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4838  *
4839  * outputs:
4840  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
4841  * zc_cookie	zap cursor
4842  */
4843 static int
4844 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4845 {
4846 	zfsvfs_t *zfsvfs;
4847 	int bufsize = zc->zc_nvlist_dst_size;
4848 
4849 	if (bufsize <= 0)
4850 		return (SET_ERROR(ENOMEM));
4851 
4852 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4853 	if (error != 0)
4854 		return (error);
4855 
4856 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
4857 
4858 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4859 	    buf, &zc->zc_nvlist_dst_size);
4860 
4861 	if (error == 0) {
4862 		error = xcopyout(buf,
4863 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
4864 		    zc->zc_nvlist_dst_size);
4865 	}
4866 	kmem_free(buf, bufsize);
4867 	zfsvfs_rele(zfsvfs, FTAG);
4868 
4869 	return (error);
4870 }
4871 
4872 /*
4873  * inputs:
4874  * zc_name		name of filesystem
4875  *
4876  * outputs:
4877  * none
4878  */
4879 static int
4880 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4881 {
4882 	objset_t *os;
4883 	int error = 0;
4884 	zfsvfs_t *zfsvfs;
4885 
4886 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4887 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4888 			/*
4889 			 * If userused is not enabled, it may be because the
4890 			 * objset needs to be closed & reopened (to grow the
4891 			 * objset_phys_t).  Suspend/resume the fs will do that.
4892 			 */
4893 			dsl_dataset_t *ds;
4894 
4895 			ds = dmu_objset_ds(zfsvfs->z_os);
4896 			error = zfs_suspend_fs(zfsvfs);
4897 			if (error == 0) {
4898 				dmu_objset_refresh_ownership(zfsvfs->z_os,
4899 				    zfsvfs);
4900 				error = zfs_resume_fs(zfsvfs, ds);
4901 			}
4902 		}
4903 		if (error == 0)
4904 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4905 		VFS_RELE(zfsvfs->z_vfs);
4906 	} else {
4907 		/* XXX kind of reading contents without owning */
4908 		error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4909 		if (error != 0)
4910 			return (error);
4911 
4912 		error = dmu_objset_userspace_upgrade(os);
4913 		dmu_objset_rele(os, FTAG);
4914 	}
4915 
4916 	return (error);
4917 }
4918 
4919 /*
4920  * We don't want to have a hard dependency
4921  * against some special symbols in sharefs
4922  * nfs, and smbsrv.  Determine them if needed when
4923  * the first file system is shared.
4924  * Neither sharefs, nfs or smbsrv are unloadable modules.
4925  */
4926 int (*znfsexport_fs)(void *arg);
4927 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4928 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4929 
4930 int zfs_nfsshare_inited;
4931 int zfs_smbshare_inited;
4932 
4933 ddi_modhandle_t nfs_mod;
4934 ddi_modhandle_t sharefs_mod;
4935 ddi_modhandle_t smbsrv_mod;
4936 kmutex_t zfs_share_lock;
4937 
4938 static int
4939 zfs_init_sharefs()
4940 {
4941 	int error;
4942 
4943 	ASSERT(MUTEX_HELD(&zfs_share_lock));
4944 	/* Both NFS and SMB shares also require sharetab support. */
4945 	if (sharefs_mod == NULL && ((sharefs_mod =
4946 	    ddi_modopen("fs/sharefs",
4947 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
4948 		return (SET_ERROR(ENOSYS));
4949 	}
4950 	if (zshare_fs == NULL && ((zshare_fs =
4951 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4952 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4953 		return (SET_ERROR(ENOSYS));
4954 	}
4955 	return (0);
4956 }
4957 
4958 static int
4959 zfs_ioc_share(zfs_cmd_t *zc)
4960 {
4961 	int error;
4962 	int opcode;
4963 
4964 	switch (zc->zc_share.z_sharetype) {
4965 	case ZFS_SHARE_NFS:
4966 	case ZFS_UNSHARE_NFS:
4967 		if (zfs_nfsshare_inited == 0) {
4968 			mutex_enter(&zfs_share_lock);
4969 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4970 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4971 				mutex_exit(&zfs_share_lock);
4972 				return (SET_ERROR(ENOSYS));
4973 			}
4974 			if (znfsexport_fs == NULL &&
4975 			    ((znfsexport_fs = (int (*)(void *))
4976 			    ddi_modsym(nfs_mod,
4977 			    "nfs_export", &error)) == NULL)) {
4978 				mutex_exit(&zfs_share_lock);
4979 				return (SET_ERROR(ENOSYS));
4980 			}
4981 			error = zfs_init_sharefs();
4982 			if (error != 0) {
4983 				mutex_exit(&zfs_share_lock);
4984 				return (SET_ERROR(ENOSYS));
4985 			}
4986 			zfs_nfsshare_inited = 1;
4987 			mutex_exit(&zfs_share_lock);
4988 		}
4989 		break;
4990 	case ZFS_SHARE_SMB:
4991 	case ZFS_UNSHARE_SMB:
4992 		if (zfs_smbshare_inited == 0) {
4993 			mutex_enter(&zfs_share_lock);
4994 			if (smbsrv_mod == NULL && ((smbsrv_mod =
4995 			    ddi_modopen("drv/smbsrv",
4996 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4997 				mutex_exit(&zfs_share_lock);
4998 				return (SET_ERROR(ENOSYS));
4999 			}
5000 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
5001 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
5002 			    "smb_server_share", &error)) == NULL)) {
5003 				mutex_exit(&zfs_share_lock);
5004 				return (SET_ERROR(ENOSYS));
5005 			}
5006 			error = zfs_init_sharefs();
5007 			if (error != 0) {
5008 				mutex_exit(&zfs_share_lock);
5009 				return (SET_ERROR(ENOSYS));
5010 			}
5011 			zfs_smbshare_inited = 1;
5012 			mutex_exit(&zfs_share_lock);
5013 		}
5014 		break;
5015 	default:
5016 		return (SET_ERROR(EINVAL));
5017 	}
5018 
5019 	switch (zc->zc_share.z_sharetype) {
5020 	case ZFS_SHARE_NFS:
5021 	case ZFS_UNSHARE_NFS:
5022 		if (error =
5023 		    znfsexport_fs((void *)
5024 		    (uintptr_t)zc->zc_share.z_exportdata))
5025 			return (error);
5026 		break;
5027 	case ZFS_SHARE_SMB:
5028 	case ZFS_UNSHARE_SMB:
5029 		if (error = zsmbexport_fs((void *)
5030 		    (uintptr_t)zc->zc_share.z_exportdata,
5031 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
5032 		    B_TRUE: B_FALSE)) {
5033 			return (error);
5034 		}
5035 		break;
5036 	}
5037 
5038 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
5039 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
5040 	    SHAREFS_ADD : SHAREFS_REMOVE;
5041 
5042 	/*
5043 	 * Add or remove share from sharetab
5044 	 */
5045 	error = zshare_fs(opcode,
5046 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
5047 	    zc->zc_share.z_sharemax);
5048 
5049 	return (error);
5050 
5051 }
5052 
5053 ace_t full_access[] = {
5054 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
5055 };
5056 
5057 /*
5058  * inputs:
5059  * zc_name		name of containing filesystem
5060  * zc_obj		object # beyond which we want next in-use object #
5061  *
5062  * outputs:
5063  * zc_obj		next in-use object #
5064  */
5065 static int
5066 zfs_ioc_next_obj(zfs_cmd_t *zc)
5067 {
5068 	objset_t *os = NULL;
5069 	int error;
5070 
5071 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
5072 	if (error != 0)
5073 		return (error);
5074 
5075 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
5076 	    dsl_dataset_phys(os->os_dsl_dataset)->ds_prev_snap_txg);
5077 
5078 	dmu_objset_rele(os, FTAG);
5079 	return (error);
5080 }
5081 
5082 /*
5083  * inputs:
5084  * zc_name		name of filesystem
5085  * zc_value		prefix name for snapshot
5086  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
5087  *
5088  * outputs:
5089  * zc_value		short name of new snapshot
5090  */
5091 static int
5092 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
5093 {
5094 	char *snap_name;
5095 	char *hold_name;
5096 	int error;
5097 	minor_t minor;
5098 
5099 	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
5100 	if (error != 0)
5101 		return (error);
5102 
5103 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
5104 	    (u_longlong_t)ddi_get_lbolt64());
5105 	hold_name = kmem_asprintf("%%%s", zc->zc_value);
5106 
5107 	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
5108 	    hold_name);
5109 	if (error == 0)
5110 		(void) strcpy(zc->zc_value, snap_name);
5111 	strfree(snap_name);
5112 	strfree(hold_name);
5113 	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
5114 	return (error);
5115 }
5116 
5117 /*
5118  * inputs:
5119  * zc_name		name of "to" snapshot
5120  * zc_value		name of "from" snapshot
5121  * zc_cookie		file descriptor to write diff data on
5122  *
5123  * outputs:
5124  * dmu_diff_record_t's to the file descriptor
5125  */
5126 static int
5127 zfs_ioc_diff(zfs_cmd_t *zc)
5128 {
5129 	file_t *fp;
5130 	offset_t off;
5131 	int error;
5132 
5133 	fp = getf(zc->zc_cookie);
5134 	if (fp == NULL)
5135 		return (SET_ERROR(EBADF));
5136 
5137 	off = fp->f_offset;
5138 
5139 	error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
5140 
5141 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5142 		fp->f_offset = off;
5143 	releasef(zc->zc_cookie);
5144 
5145 	return (error);
5146 }
5147 
5148 /*
5149  * Remove all ACL files in shares dir
5150  */
5151 static int
5152 zfs_smb_acl_purge(znode_t *dzp)
5153 {
5154 	zap_cursor_t	zc;
5155 	zap_attribute_t	zap;
5156 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
5157 	int error;
5158 
5159 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
5160 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
5161 	    zap_cursor_advance(&zc)) {
5162 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
5163 		    NULL, 0)) != 0)
5164 			break;
5165 	}
5166 	zap_cursor_fini(&zc);
5167 	return (error);
5168 }
5169 
5170 static int
5171 zfs_ioc_smb_acl(zfs_cmd_t *zc)
5172 {
5173 	vnode_t *vp;
5174 	znode_t *dzp;
5175 	vnode_t *resourcevp = NULL;
5176 	znode_t *sharedir;
5177 	zfsvfs_t *zfsvfs;
5178 	nvlist_t *nvlist;
5179 	char *src, *target;
5180 	vattr_t vattr;
5181 	vsecattr_t vsec;
5182 	int error = 0;
5183 
5184 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
5185 	    NO_FOLLOW, NULL, &vp)) != 0)
5186 		return (error);
5187 
5188 	/* Now make sure mntpnt and dataset are ZFS */
5189 
5190 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
5191 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
5192 	    zc->zc_name) != 0)) {
5193 		VN_RELE(vp);
5194 		return (SET_ERROR(EINVAL));
5195 	}
5196 
5197 	dzp = VTOZ(vp);
5198 	zfsvfs = dzp->z_zfsvfs;
5199 	ZFS_ENTER(zfsvfs);
5200 
5201 	/*
5202 	 * Create share dir if its missing.
5203 	 */
5204 	mutex_enter(&zfsvfs->z_lock);
5205 	if (zfsvfs->z_shares_dir == 0) {
5206 		dmu_tx_t *tx;
5207 
5208 		tx = dmu_tx_create(zfsvfs->z_os);
5209 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
5210 		    ZFS_SHARES_DIR);
5211 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
5212 		error = dmu_tx_assign(tx, TXG_WAIT);
5213 		if (error != 0) {
5214 			dmu_tx_abort(tx);
5215 		} else {
5216 			error = zfs_create_share_dir(zfsvfs, tx);
5217 			dmu_tx_commit(tx);
5218 		}
5219 		if (error != 0) {
5220 			mutex_exit(&zfsvfs->z_lock);
5221 			VN_RELE(vp);
5222 			ZFS_EXIT(zfsvfs);
5223 			return (error);
5224 		}
5225 	}
5226 	mutex_exit(&zfsvfs->z_lock);
5227 
5228 	ASSERT(zfsvfs->z_shares_dir);
5229 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
5230 		VN_RELE(vp);
5231 		ZFS_EXIT(zfsvfs);
5232 		return (error);
5233 	}
5234 
5235 	switch (zc->zc_cookie) {
5236 	case ZFS_SMB_ACL_ADD:
5237 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
5238 		vattr.va_type = VREG;
5239 		vattr.va_mode = S_IFREG|0777;
5240 		vattr.va_uid = 0;
5241 		vattr.va_gid = 0;
5242 
5243 		vsec.vsa_mask = VSA_ACE;
5244 		vsec.vsa_aclentp = &full_access;
5245 		vsec.vsa_aclentsz = sizeof (full_access);
5246 		vsec.vsa_aclcnt = 1;
5247 
5248 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
5249 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
5250 		if (resourcevp)
5251 			VN_RELE(resourcevp);
5252 		break;
5253 
5254 	case ZFS_SMB_ACL_REMOVE:
5255 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
5256 		    NULL, 0);
5257 		break;
5258 
5259 	case ZFS_SMB_ACL_RENAME:
5260 		if ((error = get_nvlist(zc->zc_nvlist_src,
5261 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
5262 			VN_RELE(vp);
5263 			VN_RELE(ZTOV(sharedir));
5264 			ZFS_EXIT(zfsvfs);
5265 			return (error);
5266 		}
5267 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
5268 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
5269 		    &target)) {
5270 			VN_RELE(vp);
5271 			VN_RELE(ZTOV(sharedir));
5272 			ZFS_EXIT(zfsvfs);
5273 			nvlist_free(nvlist);
5274 			return (error);
5275 		}
5276 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
5277 		    kcred, NULL, 0);
5278 		nvlist_free(nvlist);
5279 		break;
5280 
5281 	case ZFS_SMB_ACL_PURGE:
5282 		error = zfs_smb_acl_purge(sharedir);
5283 		break;
5284 
5285 	default:
5286 		error = SET_ERROR(EINVAL);
5287 		break;
5288 	}
5289 
5290 	VN_RELE(vp);
5291 	VN_RELE(ZTOV(sharedir));
5292 
5293 	ZFS_EXIT(zfsvfs);
5294 
5295 	return (error);
5296 }
5297 
5298 /*
5299  * innvl: {
5300  *     "holds" -> { snapname -> holdname (string), ... }
5301  *     (optional) "cleanup_fd" -> fd (int32)
5302  * }
5303  *
5304  * outnvl: {
5305  *     snapname -> error value (int32)
5306  *     ...
5307  * }
5308  */
5309 /* ARGSUSED */
5310 static int
5311 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
5312 {
5313 	nvpair_t *pair;
5314 	nvlist_t *holds;
5315 	int cleanup_fd = -1;
5316 	int error;
5317 	minor_t minor = 0;
5318 
5319 	error = nvlist_lookup_nvlist(args, "holds", &holds);
5320 	if (error != 0)
5321 		return (SET_ERROR(EINVAL));
5322 
5323 	/* make sure the user didn't pass us any invalid (empty) tags */
5324 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
5325 	    pair = nvlist_next_nvpair(holds, pair)) {
5326 		char *htag;
5327 
5328 		error = nvpair_value_string(pair, &htag);
5329 		if (error != 0)
5330 			return (SET_ERROR(error));
5331 
5332 		if (strlen(htag) == 0)
5333 			return (SET_ERROR(EINVAL));
5334 	}
5335 
5336 	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
5337 		error = zfs_onexit_fd_hold(cleanup_fd, &minor);
5338 		if (error != 0)
5339 			return (error);
5340 	}
5341 
5342 	error = dsl_dataset_user_hold(holds, minor, errlist);
5343 	if (minor != 0)
5344 		zfs_onexit_fd_rele(cleanup_fd);
5345 	return (error);
5346 }
5347 
5348 /*
5349  * innvl is not used.
5350  *
5351  * outnvl: {
5352  *    holdname -> time added (uint64 seconds since epoch)
5353  *    ...
5354  * }
5355  */
5356 /* ARGSUSED */
5357 static int
5358 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
5359 {
5360 	return (dsl_dataset_get_holds(snapname, outnvl));
5361 }
5362 
5363 /*
5364  * innvl: {
5365  *     snapname -> { holdname, ... }
5366  *     ...
5367  * }
5368  *
5369  * outnvl: {
5370  *     snapname -> error value (int32)
5371  *     ...
5372  * }
5373  */
5374 /* ARGSUSED */
5375 static int
5376 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
5377 {
5378 	return (dsl_dataset_user_release(holds, errlist));
5379 }
5380 
5381 /*
5382  * inputs:
5383  * zc_name		name of new filesystem or snapshot
5384  * zc_value		full name of old snapshot
5385  *
5386  * outputs:
5387  * zc_cookie		space in bytes
5388  * zc_objset_type	compressed space in bytes
5389  * zc_perm_action	uncompressed space in bytes
5390  */
5391 static int
5392 zfs_ioc_space_written(zfs_cmd_t *zc)
5393 {
5394 	int error;
5395 	dsl_pool_t *dp;
5396 	dsl_dataset_t *new, *old;
5397 
5398 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5399 	if (error != 0)
5400 		return (error);
5401 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
5402 	if (error != 0) {
5403 		dsl_pool_rele(dp, FTAG);
5404 		return (error);
5405 	}
5406 	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
5407 	if (error != 0) {
5408 		dsl_dataset_rele(new, FTAG);
5409 		dsl_pool_rele(dp, FTAG);
5410 		return (error);
5411 	}
5412 
5413 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5414 	    &zc->zc_objset_type, &zc->zc_perm_action);
5415 	dsl_dataset_rele(old, FTAG);
5416 	dsl_dataset_rele(new, FTAG);
5417 	dsl_pool_rele(dp, FTAG);
5418 	return (error);
5419 }
5420 
5421 /*
5422  * innvl: {
5423  *     "firstsnap" -> snapshot name
5424  * }
5425  *
5426  * outnvl: {
5427  *     "used" -> space in bytes
5428  *     "compressed" -> compressed space in bytes
5429  *     "uncompressed" -> uncompressed space in bytes
5430  * }
5431  */
5432 static int
5433 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5434 {
5435 	int error;
5436 	dsl_pool_t *dp;
5437 	dsl_dataset_t *new, *old;
5438 	char *firstsnap;
5439 	uint64_t used, comp, uncomp;
5440 
5441 	if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5442 		return (SET_ERROR(EINVAL));
5443 
5444 	error = dsl_pool_hold(lastsnap, FTAG, &dp);
5445 	if (error != 0)
5446 		return (error);
5447 
5448 	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
5449 	if (error == 0 && !new->ds_is_snapshot) {
5450 		dsl_dataset_rele(new, FTAG);
5451 		error = SET_ERROR(EINVAL);
5452 	}
5453 	if (error != 0) {
5454 		dsl_pool_rele(dp, FTAG);
5455 		return (error);
5456 	}
5457 	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
5458 	if (error == 0 && !old->ds_is_snapshot) {
5459 		dsl_dataset_rele(old, FTAG);
5460 		error = SET_ERROR(EINVAL);
5461 	}
5462 	if (error != 0) {
5463 		dsl_dataset_rele(new, FTAG);
5464 		dsl_pool_rele(dp, FTAG);
5465 		return (error);
5466 	}
5467 
5468 	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5469 	dsl_dataset_rele(old, FTAG);
5470 	dsl_dataset_rele(new, FTAG);
5471 	dsl_pool_rele(dp, FTAG);
5472 	fnvlist_add_uint64(outnvl, "used", used);
5473 	fnvlist_add_uint64(outnvl, "compressed", comp);
5474 	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5475 	return (error);
5476 }
5477 
5478 /*
5479  * innvl: {
5480  *     "fd" -> file descriptor to write stream to (int32)
5481  *     (optional) "fromsnap" -> full snap name to send an incremental from
5482  *     (optional) "largeblockok" -> (value ignored)
5483  *         indicates that blocks > 128KB are permitted
5484  *     (optional) "embedok" -> (value ignored)
5485  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
5486  *     (optional) "compressok" -> (value ignored)
5487  *         presence indicates compressed DRR_WRITE records are permitted
5488  *     (optional) "resume_object" and "resume_offset" -> (uint64)
5489  *         if present, resume send stream from specified object and offset.
5490  * }
5491  *
5492  * outnvl is unused
5493  */
5494 /* ARGSUSED */
5495 static int
5496 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5497 {
5498 	int error;
5499 	offset_t off;
5500 	char *fromname = NULL;
5501 	int fd;
5502 	boolean_t largeblockok;
5503 	boolean_t embedok;
5504 	boolean_t compressok;
5505 	uint64_t resumeobj = 0;
5506 	uint64_t resumeoff = 0;
5507 
5508 	error = nvlist_lookup_int32(innvl, "fd", &fd);
5509 	if (error != 0)
5510 		return (SET_ERROR(EINVAL));
5511 
5512 	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
5513 
5514 	largeblockok = nvlist_exists(innvl, "largeblockok");
5515 	embedok = nvlist_exists(innvl, "embedok");
5516 	compressok = nvlist_exists(innvl, "compressok");
5517 
5518 	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
5519 	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
5520 
5521 	file_t *fp = getf(fd);
5522 	if (fp == NULL)
5523 		return (SET_ERROR(EBADF));
5524 
5525 	off = fp->f_offset;
5526 	error = dmu_send(snapname, fromname, embedok, largeblockok, compressok,
5527 	    fd, resumeobj, resumeoff, fp->f_vnode, &off);
5528 
5529 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5530 		fp->f_offset = off;
5531 	releasef(fd);
5532 	return (error);
5533 }
5534 
5535 /*
5536  * Determine approximately how large a zfs send stream will be -- the number
5537  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5538  *
5539  * innvl: {
5540  *     (optional) "from" -> full snap or bookmark name to send an incremental
5541  *                          from
5542  *     (optional) "largeblockok" -> (value ignored)
5543  *         indicates that blocks > 128KB are permitted
5544  *     (optional) "embedok" -> (value ignored)
5545  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
5546  *     (optional) "compressok" -> (value ignored)
5547  *         presence indicates compressed DRR_WRITE records are permitted
5548  * }
5549  *
5550  * outnvl: {
5551  *     "space" -> bytes of space (uint64)
5552  * }
5553  */
5554 static int
5555 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5556 {
5557 	dsl_pool_t *dp;
5558 	dsl_dataset_t *tosnap;
5559 	int error;
5560 	char *fromname;
5561 	boolean_t compressok;
5562 	uint64_t space;
5563 
5564 	error = dsl_pool_hold(snapname, FTAG, &dp);
5565 	if (error != 0)
5566 		return (error);
5567 
5568 	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
5569 	if (error != 0) {
5570 		dsl_pool_rele(dp, FTAG);
5571 		return (error);
5572 	}
5573 
5574 	compressok = nvlist_exists(innvl, "compressok");
5575 
5576 	error = nvlist_lookup_string(innvl, "from", &fromname);
5577 	if (error == 0) {
5578 		if (strchr(fromname, '@') != NULL) {
5579 			/*
5580 			 * If from is a snapshot, hold it and use the more
5581 			 * efficient dmu_send_estimate to estimate send space
5582 			 * size using deadlists.
5583 			 */
5584 			dsl_dataset_t *fromsnap;
5585 			error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
5586 			if (error != 0)
5587 				goto out;
5588 			error = dmu_send_estimate(tosnap, fromsnap, compressok,
5589 			    &space);
5590 			dsl_dataset_rele(fromsnap, FTAG);
5591 		} else if (strchr(fromname, '#') != NULL) {
5592 			/*
5593 			 * If from is a bookmark, fetch the creation TXG of the
5594 			 * snapshot it was created from and use that to find
5595 			 * blocks that were born after it.
5596 			 */
5597 			zfs_bookmark_phys_t frombm;
5598 
5599 			error = dsl_bookmark_lookup(dp, fromname, tosnap,
5600 			    &frombm);
5601 			if (error != 0)
5602 				goto out;
5603 			error = dmu_send_estimate_from_txg(tosnap,
5604 			    frombm.zbm_creation_txg, compressok, &space);
5605 		} else {
5606 			/*
5607 			 * from is not properly formatted as a snapshot or
5608 			 * bookmark
5609 			 */
5610 			error = SET_ERROR(EINVAL);
5611 			goto out;
5612 		}
5613 	} else {
5614 		/*
5615 		 * If estimating the size of a full send, use dmu_send_estimate.
5616 		 */
5617 		error = dmu_send_estimate(tosnap, NULL, compressok, &space);
5618 	}
5619 
5620 	fnvlist_add_uint64(outnvl, "space", space);
5621 
5622 out:
5623 	dsl_dataset_rele(tosnap, FTAG);
5624 	dsl_pool_rele(dp, FTAG);
5625 	return (error);
5626 }
5627 
5628 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5629 
5630 static void
5631 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5632     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5633     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5634 {
5635 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5636 
5637 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5638 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5639 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5640 	ASSERT3P(vec->zvec_func, ==, NULL);
5641 
5642 	vec->zvec_legacy_func = func;
5643 	vec->zvec_secpolicy = secpolicy;
5644 	vec->zvec_namecheck = namecheck;
5645 	vec->zvec_allow_log = log_history;
5646 	vec->zvec_pool_check = pool_check;
5647 }
5648 
5649 /*
5650  * See the block comment at the beginning of this file for details on
5651  * each argument to this function.
5652  */
5653 static void
5654 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5655     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5656     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5657     boolean_t allow_log)
5658 {
5659 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5660 
5661 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5662 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5663 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5664 	ASSERT3P(vec->zvec_func, ==, NULL);
5665 
5666 	/* if we are logging, the name must be valid */
5667 	ASSERT(!allow_log || namecheck != NO_NAME);
5668 
5669 	vec->zvec_name = name;
5670 	vec->zvec_func = func;
5671 	vec->zvec_secpolicy = secpolicy;
5672 	vec->zvec_namecheck = namecheck;
5673 	vec->zvec_pool_check = pool_check;
5674 	vec->zvec_smush_outnvlist = smush_outnvlist;
5675 	vec->zvec_allow_log = allow_log;
5676 }
5677 
5678 static void
5679 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5680     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5681     zfs_ioc_poolcheck_t pool_check)
5682 {
5683 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5684 	    POOL_NAME, log_history, pool_check);
5685 }
5686 
5687 static void
5688 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5689     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5690 {
5691 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5692 	    DATASET_NAME, B_FALSE, pool_check);
5693 }
5694 
5695 static void
5696 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5697 {
5698 	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5699 	    POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5700 }
5701 
5702 static void
5703 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5704     zfs_secpolicy_func_t *secpolicy)
5705 {
5706 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5707 	    NO_NAME, B_FALSE, POOL_CHECK_NONE);
5708 }
5709 
5710 static void
5711 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5712     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5713 {
5714 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5715 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5716 }
5717 
5718 static void
5719 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5720 {
5721 	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5722 	    zfs_secpolicy_read);
5723 }
5724 
5725 static void
5726 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5727     zfs_secpolicy_func_t *secpolicy)
5728 {
5729 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5730 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5731 }
5732 
5733 static void
5734 zfs_ioctl_init(void)
5735 {
5736 	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5737 	    zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5738 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5739 
5740 	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5741 	    zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5742 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5743 
5744 	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5745 	    zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5746 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5747 
5748 	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5749 	    zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5750 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5751 
5752 	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5753 	    zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5754 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5755 
5756 	zfs_ioctl_register("create", ZFS_IOC_CREATE,
5757 	    zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5758 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5759 
5760 	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5761 	    zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5762 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5763 
5764 	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5765 	    zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5766 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5767 
5768 	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
5769 	    zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
5770 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5771 	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
5772 	    zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
5773 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5774 
5775 	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
5776 	    zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
5777 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5778 
5779 	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
5780 	    zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
5781 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE);
5782 
5783 	zfs_ioctl_register("bookmark", ZFS_IOC_BOOKMARK,
5784 	    zfs_ioc_bookmark, zfs_secpolicy_bookmark, POOL_NAME,
5785 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5786 
5787 	zfs_ioctl_register("get_bookmarks", ZFS_IOC_GET_BOOKMARKS,
5788 	    zfs_ioc_get_bookmarks, zfs_secpolicy_read, DATASET_NAME,
5789 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5790 
5791 	zfs_ioctl_register("destroy_bookmarks", ZFS_IOC_DESTROY_BOOKMARKS,
5792 	    zfs_ioc_destroy_bookmarks, zfs_secpolicy_destroy_bookmarks,
5793 	    POOL_NAME,
5794 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5795 
5796 	zfs_ioctl_register("channel_program", ZFS_IOC_CHANNEL_PROGRAM,
5797 	    zfs_ioc_channel_program, zfs_secpolicy_config,
5798 	    POOL_NAME, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE,
5799 	    B_TRUE);
5800 
5801 	/* IOCTLS that use the legacy function signature */
5802 
5803 	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5804 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5805 
5806 	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5807 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5808 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5809 	    zfs_ioc_pool_scan);
5810 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5811 	    zfs_ioc_pool_upgrade);
5812 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5813 	    zfs_ioc_vdev_add);
5814 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5815 	    zfs_ioc_vdev_remove);
5816 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5817 	    zfs_ioc_vdev_set_state);
5818 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5819 	    zfs_ioc_vdev_attach);
5820 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5821 	    zfs_ioc_vdev_detach);
5822 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5823 	    zfs_ioc_vdev_setpath);
5824 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5825 	    zfs_ioc_vdev_setfru);
5826 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5827 	    zfs_ioc_pool_set_props);
5828 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5829 	    zfs_ioc_vdev_split);
5830 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5831 	    zfs_ioc_pool_reguid);
5832 
5833 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5834 	    zfs_ioc_pool_configs, zfs_secpolicy_none);
5835 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5836 	    zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5837 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5838 	    zfs_ioc_inject_fault, zfs_secpolicy_inject);
5839 	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5840 	    zfs_ioc_clear_fault, zfs_secpolicy_inject);
5841 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5842 	    zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5843 
5844 	/*
5845 	 * pool destroy, and export don't log the history as part of
5846 	 * zfsdev_ioctl, but rather zfs_ioc_pool_export
5847 	 * does the logging of those commands.
5848 	 */
5849 	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5850 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5851 	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5852 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5853 
5854 	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5855 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5856 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5857 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5858 
5859 	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5860 	    zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5861 	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5862 	    zfs_ioc_dsobj_to_dsname,
5863 	    zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5864 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5865 	    zfs_ioc_pool_get_history,
5866 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5867 
5868 	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5869 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5870 
5871 	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5872 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5873 	zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5874 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5875 
5876 	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5877 	    zfs_ioc_space_written);
5878 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5879 	    zfs_ioc_objset_recvd_props);
5880 	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5881 	    zfs_ioc_next_obj);
5882 	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5883 	    zfs_ioc_get_fsacl);
5884 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5885 	    zfs_ioc_objset_stats);
5886 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5887 	    zfs_ioc_objset_zplprops);
5888 	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5889 	    zfs_ioc_dataset_list_next);
5890 	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5891 	    zfs_ioc_snapshot_list_next);
5892 	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5893 	    zfs_ioc_send_progress);
5894 
5895 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5896 	    zfs_ioc_diff, zfs_secpolicy_diff);
5897 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5898 	    zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5899 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5900 	    zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5901 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5902 	    zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5903 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5904 	    zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5905 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5906 	    zfs_ioc_send, zfs_secpolicy_send);
5907 
5908 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5909 	    zfs_secpolicy_none);
5910 	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5911 	    zfs_secpolicy_destroy);
5912 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5913 	    zfs_secpolicy_rename);
5914 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5915 	    zfs_secpolicy_recv);
5916 	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5917 	    zfs_secpolicy_promote);
5918 	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5919 	    zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5920 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5921 	    zfs_secpolicy_set_fsacl);
5922 
5923 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5924 	    zfs_secpolicy_share, POOL_CHECK_NONE);
5925 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5926 	    zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5927 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5928 	    zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5929 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5930 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5931 	    zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5932 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5933 }
5934 
5935 int
5936 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5937     zfs_ioc_poolcheck_t check)
5938 {
5939 	spa_t *spa;
5940 	int error;
5941 
5942 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
5943 
5944 	if (check & POOL_CHECK_NONE)
5945 		return (0);
5946 
5947 	error = spa_open(name, &spa, FTAG);
5948 	if (error == 0) {
5949 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5950 			error = SET_ERROR(EAGAIN);
5951 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5952 			error = SET_ERROR(EROFS);
5953 		spa_close(spa, FTAG);
5954 	}
5955 	return (error);
5956 }
5957 
5958 /*
5959  * Find a free minor number.
5960  */
5961 minor_t
5962 zfsdev_minor_alloc(void)
5963 {
5964 	static minor_t last_minor;
5965 	minor_t m;
5966 
5967 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5968 
5969 	for (m = last_minor + 1; m != last_minor; m++) {
5970 		if (m > ZFSDEV_MAX_MINOR)
5971 			m = 1;
5972 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5973 			last_minor = m;
5974 			return (m);
5975 		}
5976 	}
5977 
5978 	return (0);
5979 }
5980 
5981 static int
5982 zfs_ctldev_init(dev_t *devp)
5983 {
5984 	minor_t minor;
5985 	zfs_soft_state_t *zs;
5986 
5987 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5988 	ASSERT(getminor(*devp) == 0);
5989 
5990 	minor = zfsdev_minor_alloc();
5991 	if (minor == 0)
5992 		return (SET_ERROR(ENXIO));
5993 
5994 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5995 		return (SET_ERROR(EAGAIN));
5996 
5997 	*devp = makedevice(getemajor(*devp), minor);
5998 
5999 	zs = ddi_get_soft_state(zfsdev_state, minor);
6000 	zs->zss_type = ZSST_CTLDEV;
6001 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
6002 
6003 	return (0);
6004 }
6005 
6006 static void
6007 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
6008 {
6009 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
6010 
6011 	zfs_onexit_destroy(zo);
6012 	ddi_soft_state_free(zfsdev_state, minor);
6013 }
6014 
6015 void *
6016 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
6017 {
6018 	zfs_soft_state_t *zp;
6019 
6020 	zp = ddi_get_soft_state(zfsdev_state, minor);
6021 	if (zp == NULL || zp->zss_type != which)
6022 		return (NULL);
6023 
6024 	return (zp->zss_data);
6025 }
6026 
6027 static int
6028 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
6029 {
6030 	int error = 0;
6031 
6032 	if (getminor(*devp) != 0)
6033 		return (zvol_open(devp, flag, otyp, cr));
6034 
6035 	/* This is the control device. Allocate a new minor if requested. */
6036 	if (flag & FEXCL) {
6037 		mutex_enter(&zfsdev_state_lock);
6038 		error = zfs_ctldev_init(devp);
6039 		mutex_exit(&zfsdev_state_lock);
6040 	}
6041 
6042 	return (error);
6043 }
6044 
6045 static int
6046 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
6047 {
6048 	zfs_onexit_t *zo;
6049 	minor_t minor = getminor(dev);
6050 
6051 	if (minor == 0)
6052 		return (0);
6053 
6054 	mutex_enter(&zfsdev_state_lock);
6055 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
6056 	if (zo == NULL) {
6057 		mutex_exit(&zfsdev_state_lock);
6058 		return (zvol_close(dev, flag, otyp, cr));
6059 	}
6060 	zfs_ctldev_destroy(zo, minor);
6061 	mutex_exit(&zfsdev_state_lock);
6062 
6063 	return (0);
6064 }
6065 
6066 static int
6067 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
6068 {
6069 	zfs_cmd_t *zc;
6070 	uint_t vecnum;
6071 	int error, rc, len;
6072 	minor_t minor = getminor(dev);
6073 	const zfs_ioc_vec_t *vec;
6074 	char *saved_poolname = NULL;
6075 	nvlist_t *innvl = NULL;
6076 
6077 	if (minor != 0 &&
6078 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
6079 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
6080 
6081 	vecnum = cmd - ZFS_IOC_FIRST;
6082 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
6083 
6084 	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
6085 		return (SET_ERROR(EINVAL));
6086 	vec = &zfs_ioc_vec[vecnum];
6087 
6088 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
6089 
6090 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
6091 	if (error != 0) {
6092 		error = SET_ERROR(EFAULT);
6093 		goto out;
6094 	}
6095 
6096 	zc->zc_iflags = flag & FKIOCTL;
6097 	if (zc->zc_nvlist_src_size != 0) {
6098 		error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
6099 		    zc->zc_iflags, &innvl);
6100 		if (error != 0)
6101 			goto out;
6102 	}
6103 
6104 	/*
6105 	 * Ensure that all pool/dataset names are valid before we pass down to
6106 	 * the lower layers.
6107 	 */
6108 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
6109 	switch (vec->zvec_namecheck) {
6110 	case POOL_NAME:
6111 		if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
6112 			error = SET_ERROR(EINVAL);
6113 		else
6114 			error = pool_status_check(zc->zc_name,
6115 			    vec->zvec_namecheck, vec->zvec_pool_check);
6116 		break;
6117 
6118 	case DATASET_NAME:
6119 		if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
6120 			error = SET_ERROR(EINVAL);
6121 		else
6122 			error = pool_status_check(zc->zc_name,
6123 			    vec->zvec_namecheck, vec->zvec_pool_check);
6124 		break;
6125 
6126 	case NO_NAME:
6127 		break;
6128 	}
6129 
6130 
6131 	if (error == 0)
6132 		error = vec->zvec_secpolicy(zc, innvl, cr);
6133 
6134 	if (error != 0)
6135 		goto out;
6136 
6137 	/* legacy ioctls can modify zc_name */
6138 	len = strcspn(zc->zc_name, "/@#") + 1;
6139 	saved_poolname = kmem_alloc(len, KM_SLEEP);
6140 	(void) strlcpy(saved_poolname, zc->zc_name, len);
6141 
6142 	if (vec->zvec_func != NULL) {
6143 		nvlist_t *outnvl;
6144 		int puterror = 0;
6145 		spa_t *spa;
6146 		nvlist_t *lognv = NULL;
6147 
6148 		ASSERT(vec->zvec_legacy_func == NULL);
6149 
6150 		/*
6151 		 * Add the innvl to the lognv before calling the func,
6152 		 * in case the func changes the innvl.
6153 		 */
6154 		if (vec->zvec_allow_log) {
6155 			lognv = fnvlist_alloc();
6156 			fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
6157 			    vec->zvec_name);
6158 			if (!nvlist_empty(innvl)) {
6159 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
6160 				    innvl);
6161 			}
6162 		}
6163 
6164 		outnvl = fnvlist_alloc();
6165 		error = vec->zvec_func(zc->zc_name, innvl, outnvl);
6166 
6167 		/*
6168 		 * Some commands can partially execute, modfiy state, and still
6169 		 * return an error.  In these cases, attempt to record what
6170 		 * was modified.
6171 		 */
6172 		if ((error == 0 ||
6173 		    (cmd == ZFS_IOC_CHANNEL_PROGRAM && error != EINVAL)) &&
6174 		    vec->zvec_allow_log &&
6175 		    spa_open(zc->zc_name, &spa, FTAG) == 0) {
6176 			if (!nvlist_empty(outnvl)) {
6177 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
6178 				    outnvl);
6179 			}
6180 			if (error != 0) {
6181 				fnvlist_add_int64(lognv, ZPOOL_HIST_ERRNO,
6182 				    error);
6183 			}
6184 			(void) spa_history_log_nvl(spa, lognv);
6185 			spa_close(spa, FTAG);
6186 		}
6187 		fnvlist_free(lognv);
6188 
6189 		if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
6190 			int smusherror = 0;
6191 			if (vec->zvec_smush_outnvlist) {
6192 				smusherror = nvlist_smush(outnvl,
6193 				    zc->zc_nvlist_dst_size);
6194 			}
6195 			if (smusherror == 0)
6196 				puterror = put_nvlist(zc, outnvl);
6197 		}
6198 
6199 		if (puterror != 0)
6200 			error = puterror;
6201 
6202 		nvlist_free(outnvl);
6203 	} else {
6204 		error = vec->zvec_legacy_func(zc);
6205 	}
6206 
6207 out:
6208 	nvlist_free(innvl);
6209 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
6210 	if (error == 0 && rc != 0)
6211 		error = SET_ERROR(EFAULT);
6212 	if (error == 0 && vec->zvec_allow_log) {
6213 		char *s = tsd_get(zfs_allow_log_key);
6214 		if (s != NULL)
6215 			strfree(s);
6216 		(void) tsd_set(zfs_allow_log_key, saved_poolname);
6217 	} else {
6218 		if (saved_poolname != NULL)
6219 			strfree(saved_poolname);
6220 	}
6221 
6222 	kmem_free(zc, sizeof (zfs_cmd_t));
6223 	return (error);
6224 }
6225 
6226 static int
6227 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
6228 {
6229 	if (cmd != DDI_ATTACH)
6230 		return (DDI_FAILURE);
6231 
6232 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
6233 	    DDI_PSEUDO, 0) == DDI_FAILURE)
6234 		return (DDI_FAILURE);
6235 
6236 	zfs_dip = dip;
6237 
6238 	ddi_report_dev(dip);
6239 
6240 	return (DDI_SUCCESS);
6241 }
6242 
6243 static int
6244 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
6245 {
6246 	if (spa_busy() || zfs_busy() || zvol_busy())
6247 		return (DDI_FAILURE);
6248 
6249 	if (cmd != DDI_DETACH)
6250 		return (DDI_FAILURE);
6251 
6252 	zfs_dip = NULL;
6253 
6254 	ddi_prop_remove_all(dip);
6255 	ddi_remove_minor_node(dip, NULL);
6256 
6257 	return (DDI_SUCCESS);
6258 }
6259 
6260 /*ARGSUSED*/
6261 static int
6262 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
6263 {
6264 	switch (infocmd) {
6265 	case DDI_INFO_DEVT2DEVINFO:
6266 		*result = zfs_dip;
6267 		return (DDI_SUCCESS);
6268 
6269 	case DDI_INFO_DEVT2INSTANCE:
6270 		*result = (void *)0;
6271 		return (DDI_SUCCESS);
6272 	}
6273 
6274 	return (DDI_FAILURE);
6275 }
6276 
6277 /*
6278  * OK, so this is a little weird.
6279  *
6280  * /dev/zfs is the control node, i.e. minor 0.
6281  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
6282  *
6283  * /dev/zfs has basically nothing to do except serve up ioctls,
6284  * so most of the standard driver entry points are in zvol.c.
6285  */
6286 static struct cb_ops zfs_cb_ops = {
6287 	zfsdev_open,	/* open */
6288 	zfsdev_close,	/* close */
6289 	zvol_strategy,	/* strategy */
6290 	nodev,		/* print */
6291 	zvol_dump,	/* dump */
6292 	zvol_read,	/* read */
6293 	zvol_write,	/* write */
6294 	zfsdev_ioctl,	/* ioctl */
6295 	nodev,		/* devmap */
6296 	nodev,		/* mmap */
6297 	nodev,		/* segmap */
6298 	nochpoll,	/* poll */
6299 	ddi_prop_op,	/* prop_op */
6300 	NULL,		/* streamtab */
6301 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
6302 	CB_REV,		/* version */
6303 	nodev,		/* async read */
6304 	nodev,		/* async write */
6305 };
6306 
6307 static struct dev_ops zfs_dev_ops = {
6308 	DEVO_REV,	/* version */
6309 	0,		/* refcnt */
6310 	zfs_info,	/* info */
6311 	nulldev,	/* identify */
6312 	nulldev,	/* probe */
6313 	zfs_attach,	/* attach */
6314 	zfs_detach,	/* detach */
6315 	nodev,		/* reset */
6316 	&zfs_cb_ops,	/* driver operations */
6317 	NULL,		/* no bus operations */
6318 	NULL,		/* power */
6319 	ddi_quiesce_not_needed,	/* quiesce */
6320 };
6321 
6322 static struct modldrv zfs_modldrv = {
6323 	&mod_driverops,
6324 	"ZFS storage pool",
6325 	&zfs_dev_ops
6326 };
6327 
6328 static struct modlinkage modlinkage = {
6329 	MODREV_1,
6330 	(void *)&zfs_modlfs,
6331 	(void *)&zfs_modldrv,
6332 	NULL
6333 };
6334 
6335 static void
6336 zfs_allow_log_destroy(void *arg)
6337 {
6338 	char *poolname = arg;
6339 	strfree(poolname);
6340 }
6341 
6342 int
6343 _init(void)
6344 {
6345 	int error;
6346 
6347 	spa_init(FREAD | FWRITE);
6348 	zfs_init();
6349 	zvol_init();
6350 	zfs_ioctl_init();
6351 
6352 	if ((error = mod_install(&modlinkage)) != 0) {
6353 		zvol_fini();
6354 		zfs_fini();
6355 		spa_fini();
6356 		return (error);
6357 	}
6358 
6359 	tsd_create(&zfs_fsyncer_key, NULL);
6360 	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
6361 	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
6362 
6363 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
6364 	ASSERT(error == 0);
6365 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
6366 
6367 	return (0);
6368 }
6369 
6370 int
6371 _fini(void)
6372 {
6373 	int error;
6374 
6375 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
6376 		return (SET_ERROR(EBUSY));
6377 
6378 	if ((error = mod_remove(&modlinkage)) != 0)
6379 		return (error);
6380 
6381 	zvol_fini();
6382 	zfs_fini();
6383 	spa_fini();
6384 	if (zfs_nfsshare_inited)
6385 		(void) ddi_modclose(nfs_mod);
6386 	if (zfs_smbshare_inited)
6387 		(void) ddi_modclose(smbsrv_mod);
6388 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
6389 		(void) ddi_modclose(sharefs_mod);
6390 
6391 	tsd_destroy(&zfs_fsyncer_key);
6392 	ldi_ident_release(zfs_li);
6393 	zfs_li = NULL;
6394 	mutex_destroy(&zfs_share_lock);
6395 
6396 	return (error);
6397 }
6398 
6399 int
6400 _info(struct modinfo *modinfop)
6401 {
6402 	return (mod_info(&modlinkage, modinfop));
6403 }
6404