xref: /illumos-gate/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision ddb365bfc9e868ad24ccdcb0dc91af18b10df082)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 /*
27  * Copyright (c) 2011-2012 Pawel Jakub Dawidek. All rights reserved.
28  * Portions Copyright 2011 Martin Matuska
29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
30  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
31  * Copyright 2019 Joyent, Inc.
32  * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
33  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
34  * Copyright (c) 2013 Steven Hartland. All rights reserved.
35  * Copyright (c) 2014 Integros [integros.com]
36  * Copyright 2016 Toomas Soome <tsoome@me.com>
37  * Copyright (c) 2017, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
38  * Copyright 2017 RackTop Systems.
39  * Copyright (c) 2017, Datto, Inc. All rights reserved.
40  * Copyright 2021 The University of Queensland
41  */
42 
43 /*
44  * ZFS ioctls.
45  *
46  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
47  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
48  *
49  * There are two ways that we handle ioctls: the legacy way where almost
50  * all of the logic is in the ioctl callback, and the new way where most
51  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
52  *
53  * Non-legacy ioctls should be registered by calling
54  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
55  * from userland by lzc_ioctl().
56  *
57  * The registration arguments are as follows:
58  *
59  * const char *name
60  *   The name of the ioctl.  This is used for history logging.  If the
61  *   ioctl returns successfully (the callback returns 0), and allow_log
62  *   is true, then a history log entry will be recorded with the input &
63  *   output nvlists.  The log entry can be printed with "zpool history -i".
64  *
65  * zfs_ioc_t ioc
66  *   The ioctl request number, which userland will pass to ioctl(2).
67  *   We want newer versions of libzfs and libzfs_core to run against
68  *   existing zfs kernel modules (i.e. a deferred reboot after an update).
69  *   Therefore the ioctl numbers cannot change from release to release.
70  *
71  * zfs_secpolicy_func_t *secpolicy
72  *   This function will be called before the zfs_ioc_func_t, to
73  *   determine if this operation is permitted.  It should return EPERM
74  *   on failure, and 0 on success.  Checks include determining if the
75  *   dataset is visible in this zone, and if the user has either all
76  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
77  *   to do this operation on this dataset with "zfs allow".
78  *
79  * zfs_ioc_namecheck_t namecheck
80  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
81  *   name, a dataset name, or nothing.  If the name is not well-formed,
82  *   the ioctl will fail and the callback will not be called.
83  *   Therefore, the callback can assume that the name is well-formed
84  *   (e.g. is null-terminated, doesn't have more than one '@' character,
85  *   doesn't have invalid characters).
86  *
87  * zfs_ioc_poolcheck_t pool_check
88  *   This specifies requirements on the pool state.  If the pool does
89  *   not meet them (is suspended or is readonly), the ioctl will fail
90  *   and the callback will not be called.  If any checks are specified
91  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
92  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
93  *   POOL_CHECK_READONLY).
94  *
95  * zfs_ioc_key_t *nvl_keys
96  *  The list of expected/allowable innvl input keys. This list is used
97  *  to validate the nvlist input to the ioctl.
98  *
99  * boolean_t smush_outnvlist
100  *   If smush_outnvlist is true, then the output is presumed to be a
101  *   list of errors, and it will be "smushed" down to fit into the
102  *   caller's buffer, by removing some entries and replacing them with a
103  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
104  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
105  *   outnvlist does not fit into the userland-provided buffer, then the
106  *   ioctl will fail with ENOMEM.
107  *
108  * zfs_ioc_func_t *func
109  *   The callback function that will perform the operation.
110  *
111  *   The callback should return 0 on success, or an error number on
112  *   failure.  If the function fails, the userland ioctl will return -1,
113  *   and errno will be set to the callback's return value.  The callback
114  *   will be called with the following arguments:
115  *
116  *   const char *name
117  *     The name of the pool or dataset to operate on, from
118  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
119  *     expected type (pool, dataset, or none).
120  *
121  *   nvlist_t *innvl
122  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
123  *     NULL if no input nvlist was provided.  Changes to this nvlist are
124  *     ignored.  If the input nvlist could not be deserialized, the
125  *     ioctl will fail and the callback will not be called.
126  *
127  *   nvlist_t *outnvl
128  *     The output nvlist, initially empty.  The callback can fill it in,
129  *     and it will be returned to userland by serializing it into
130  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
131  *     fails (e.g. because the caller didn't supply a large enough
132  *     buffer), then the overall ioctl will fail.  See the
133  *     'smush_nvlist' argument above for additional behaviors.
134  *
135  *     There are two typical uses of the output nvlist:
136  *       - To return state, e.g. property values.  In this case,
137  *         smush_outnvlist should be false.  If the buffer was not large
138  *         enough, the caller will reallocate a larger buffer and try
139  *         the ioctl again.
140  *
141  *       - To return multiple errors from an ioctl which makes on-disk
142  *         changes.  In this case, smush_outnvlist should be true.
143  *         Ioctls which make on-disk modifications should generally not
144  *         use the outnvl if they succeed, because the caller can not
145  *         distinguish between the operation failing, and
146  *         deserialization failing.
147  *
148  * IOCTL Interface Errors
149  *
150  * The following ioctl input errors can be returned:
151  *   ZFS_ERR_IOC_CMD_UNAVAIL	the ioctl number is not supported by kernel
152  *   ZFS_ERR_IOC_ARG_UNAVAIL	an input argument is not supported by kernel
153  *   ZFS_ERR_IOC_ARG_REQUIRED	a required input argument is missing
154  *   ZFS_ERR_IOC_ARG_BADTYPE	an input argument has an invalid type
155  */
156 
157 #include <sys/types.h>
158 #include <sys/param.h>
159 #include <sys/errno.h>
160 #include <sys/uio.h>
161 #include <sys/buf.h>
162 #include <sys/modctl.h>
163 #include <sys/open.h>
164 #include <sys/file.h>
165 #include <sys/kmem.h>
166 #include <sys/conf.h>
167 #include <sys/cmn_err.h>
168 #include <sys/stat.h>
169 #include <sys/zfs_ioctl.h>
170 #include <sys/zfs_vfsops.h>
171 #include <sys/zfs_znode.h>
172 #include <sys/zap.h>
173 #include <sys/spa.h>
174 #include <sys/spa_impl.h>
175 #include <sys/vdev.h>
176 #include <sys/priv_impl.h>
177 #include <sys/dmu.h>
178 #include <sys/dsl_dir.h>
179 #include <sys/dsl_dataset.h>
180 #include <sys/dsl_prop.h>
181 #include <sys/dsl_deleg.h>
182 #include <sys/dmu_objset.h>
183 #include <sys/dmu_impl.h>
184 #include <sys/dmu_tx.h>
185 #include <sys/ddi.h>
186 #include <sys/sunddi.h>
187 #include <sys/sunldi.h>
188 #include <sys/policy.h>
189 #include <sys/zone.h>
190 #include <sys/nvpair.h>
191 #include <sys/pathname.h>
192 #include <sys/mount.h>
193 #include <sys/sdt.h>
194 #include <sys/fs/zfs.h>
195 #include <sys/zfs_ctldir.h>
196 #include <sys/zfs_dir.h>
197 #include <sys/zfs_onexit.h>
198 #include <sys/zvol.h>
199 #include <sys/dsl_scan.h>
200 #include <sharefs/share.h>
201 #include <sys/dmu_objset.h>
202 #include <sys/dmu_recv.h>
203 #include <sys/dmu_send.h>
204 #include <sys/dsl_destroy.h>
205 #include <sys/dsl_bookmark.h>
206 #include <sys/dsl_userhold.h>
207 #include <sys/zfeature.h>
208 #include <sys/zcp.h>
209 #include <sys/zio_checksum.h>
210 #include <sys/vdev_removal.h>
211 #include <sys/vdev_impl.h>
212 #include <sys/vdev_initialize.h>
213 #include <sys/vdev_trim.h>
214 #include <sys/dsl_crypt.h>
215 
216 #include "zfs_namecheck.h"
217 #include "zfs_prop.h"
218 #include "zfs_deleg.h"
219 #include "zfs_comutil.h"
220 
221 #include "lua.h"
222 #include "lauxlib.h"
223 
224 extern struct modlfs zfs_modlfs;
225 
226 extern void zfs_init(void);
227 extern void zfs_fini(void);
228 
229 ldi_ident_t zfs_li = NULL;
230 dev_info_t *zfs_dip;
231 
232 uint_t zfs_fsyncer_key;
233 extern uint_t rrw_tsd_key;
234 static uint_t zfs_allow_log_key;
235 
236 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
237 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
238 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
239 
240 /*
241  * IOC Keys are used to document and validate user->kernel interface inputs.
242  * See zfs_keys_recv_new for an example declaration. Any key name that is not
243  * listed will be rejected as input.
244  *
245  * The keyname 'optional' is always allowed, and must be an nvlist if present.
246  * Arguments which older kernels can safely ignore can be placed under the
247  * "optional" key.
248  *
249  * When adding new keys to an existing ioc for new functionality, consider:
250  *	- adding an entry into zfs_sysfs.c zfs_features[] list
251  *	- updating the libzfs_input_check.c test utility
252  *
253  * Note: in the ZK_WILDCARDLIST case, the name serves as documentation
254  * for the expected name (bookmark, snapshot, property, etc) but there
255  * is no validation in the preflight zfs_check_input_nvpairs() check.
256  */
257 typedef enum {
258 	ZK_OPTIONAL = 1 << 0,		/* pair is optional */
259 	ZK_WILDCARDLIST = 1 << 1,	/* one or more unspecified key names */
260 } ioc_key_flag_t;
261 
262 /* DATA_TYPE_ANY is used when zkey_type can vary. */
263 #define	DATA_TYPE_ANY	DATA_TYPE_UNKNOWN
264 
265 typedef struct zfs_ioc_key {
266 	const char	*zkey_name;
267 	data_type_t	zkey_type;
268 	ioc_key_flag_t	zkey_flags;
269 } zfs_ioc_key_t;
270 
271 typedef enum {
272 	NO_NAME,
273 	POOL_NAME,
274 	DATASET_NAME
275 } zfs_ioc_namecheck_t;
276 
277 typedef enum {
278 	POOL_CHECK_NONE		= 1 << 0,
279 	POOL_CHECK_SUSPENDED	= 1 << 1,
280 	POOL_CHECK_READONLY	= 1 << 2,
281 } zfs_ioc_poolcheck_t;
282 
283 typedef struct zfs_ioc_vec {
284 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
285 	zfs_ioc_func_t		*zvec_func;
286 	zfs_secpolicy_func_t	*zvec_secpolicy;
287 	zfs_ioc_namecheck_t	zvec_namecheck;
288 	boolean_t		zvec_allow_log;
289 	zfs_ioc_poolcheck_t	zvec_pool_check;
290 	boolean_t		zvec_smush_outnvlist;
291 	const char		*zvec_name;
292 	const zfs_ioc_key_t	*zvec_nvl_keys;
293 	size_t			zvec_nvl_key_count;
294 } zfs_ioc_vec_t;
295 
296 /* This array is indexed by zfs_userquota_prop_t */
297 static const char *userquota_perms[] = {
298 	ZFS_DELEG_PERM_USERUSED,
299 	ZFS_DELEG_PERM_USERQUOTA,
300 	ZFS_DELEG_PERM_GROUPUSED,
301 	ZFS_DELEG_PERM_GROUPQUOTA,
302 	ZFS_DELEG_PERM_USEROBJUSED,
303 	ZFS_DELEG_PERM_USEROBJQUOTA,
304 	ZFS_DELEG_PERM_GROUPOBJUSED,
305 	ZFS_DELEG_PERM_GROUPOBJQUOTA,
306 	ZFS_DELEG_PERM_PROJECTUSED,
307 	ZFS_DELEG_PERM_PROJECTQUOTA,
308 	ZFS_DELEG_PERM_PROJECTOBJUSED,
309 	ZFS_DELEG_PERM_PROJECTOBJQUOTA,
310 };
311 
312 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
313 static int zfs_ioc_id_quota_upgrade(zfs_cmd_t *zc);
314 static int zfs_check_settable(const char *name, nvpair_t *property,
315     cred_t *cr);
316 static int zfs_check_clearable(char *dataset, nvlist_t *props,
317     nvlist_t **errors);
318 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
319     boolean_t *);
320 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
321 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
322 
323 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
324 
325 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
326 void
327 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
328 {
329 	const char *newfile;
330 	char buf[512];
331 	va_list adx;
332 
333 	/*
334 	 * Get rid of annoying "../common/" prefix to filename.
335 	 */
336 	newfile = strrchr(file, '/');
337 	if (newfile != NULL) {
338 		newfile = newfile + 1; /* Get rid of leading / */
339 	} else {
340 		newfile = file;
341 	}
342 
343 	va_start(adx, fmt);
344 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
345 	va_end(adx);
346 
347 	/*
348 	 * To get this data, use the zfs-dprintf probe as so:
349 	 * dtrace -q -n 'zfs-dprintf \
350 	 *	/stringof(arg0) == "dbuf.c"/ \
351 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
352 	 * arg0 = file name
353 	 * arg1 = function name
354 	 * arg2 = line number
355 	 * arg3 = message
356 	 */
357 	DTRACE_PROBE4(zfs__dprintf,
358 	    char *, newfile, char *, func, int, line, char *, buf);
359 }
360 
361 static void
362 history_str_free(char *buf)
363 {
364 	kmem_free(buf, HIS_MAX_RECORD_LEN);
365 }
366 
367 static char *
368 history_str_get(zfs_cmd_t *zc)
369 {
370 	char *buf;
371 
372 	if (zc->zc_history == 0)
373 		return (NULL);
374 
375 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
376 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
377 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
378 		history_str_free(buf);
379 		return (NULL);
380 	}
381 
382 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
383 
384 	return (buf);
385 }
386 
387 /*
388  * Check to see if the named dataset is currently defined as bootable
389  */
390 static boolean_t
391 zfs_is_bootfs(const char *name)
392 {
393 	objset_t *os;
394 
395 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
396 		boolean_t ret;
397 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
398 		dmu_objset_rele(os, FTAG);
399 		return (ret);
400 	}
401 	return (B_FALSE);
402 }
403 
404 /*
405  * Return non-zero if the spa version is less than requested version.
406  */
407 static int
408 zfs_earlier_version(const char *name, int version)
409 {
410 	spa_t *spa;
411 
412 	if (spa_open(name, &spa, FTAG) == 0) {
413 		if (spa_version(spa) < version) {
414 			spa_close(spa, FTAG);
415 			return (1);
416 		}
417 		spa_close(spa, FTAG);
418 	}
419 	return (0);
420 }
421 
422 /*
423  * Return TRUE if the ZPL version is less than requested version.
424  */
425 static boolean_t
426 zpl_earlier_version(const char *name, int version)
427 {
428 	objset_t *os;
429 	boolean_t rc = B_TRUE;
430 
431 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
432 		uint64_t zplversion;
433 
434 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
435 			dmu_objset_rele(os, FTAG);
436 			return (B_TRUE);
437 		}
438 		/* XXX reading from non-owned objset */
439 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
440 			rc = zplversion < version;
441 		dmu_objset_rele(os, FTAG);
442 	}
443 	return (rc);
444 }
445 
446 static void
447 zfs_log_history(zfs_cmd_t *zc)
448 {
449 	spa_t *spa;
450 	char *buf;
451 
452 	if ((buf = history_str_get(zc)) == NULL)
453 		return;
454 
455 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
456 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
457 			(void) spa_history_log(spa, buf);
458 		spa_close(spa, FTAG);
459 	}
460 	history_str_free(buf);
461 }
462 
463 /*
464  * Policy for top-level read operations (list pools).  Requires no privileges,
465  * and can be used in the local zone, as there is no associated dataset.
466  */
467 /* ARGSUSED */
468 static int
469 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
470 {
471 	return (0);
472 }
473 
474 /*
475  * Policy for dataset read operations (list children, get statistics).  Requires
476  * no privileges, but must be visible in the local zone.
477  */
478 /* ARGSUSED */
479 static int
480 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
481 {
482 	if (INGLOBALZONE(curproc) ||
483 	    zone_dataset_visible(zc->zc_name, NULL))
484 		return (0);
485 
486 	return (SET_ERROR(ENOENT));
487 }
488 
489 static int
490 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
491 {
492 	int writable = 1;
493 
494 	/*
495 	 * The dataset must be visible by this zone -- check this first
496 	 * so they don't see EPERM on something they shouldn't know about.
497 	 */
498 	if (!INGLOBALZONE(curproc) &&
499 	    !zone_dataset_visible(dataset, &writable))
500 		return (SET_ERROR(ENOENT));
501 
502 	if (INGLOBALZONE(curproc)) {
503 		/*
504 		 * If the fs is zoned, only root can access it from the
505 		 * global zone.
506 		 */
507 		if (secpolicy_zfs(cr) && zoned)
508 			return (SET_ERROR(EPERM));
509 	} else {
510 		/*
511 		 * If we are in a local zone, the 'zoned' property must be set.
512 		 */
513 		if (!zoned)
514 			return (SET_ERROR(EPERM));
515 
516 		/* must be writable by this zone */
517 		if (!writable)
518 			return (SET_ERROR(EPERM));
519 	}
520 	return (0);
521 }
522 
523 static int
524 zfs_dozonecheck(const char *dataset, cred_t *cr)
525 {
526 	uint64_t zoned;
527 
528 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
529 		return (SET_ERROR(ENOENT));
530 
531 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
532 }
533 
534 static int
535 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
536 {
537 	uint64_t zoned;
538 
539 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
540 		return (SET_ERROR(ENOENT));
541 
542 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
543 }
544 
545 static int
546 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
547     const char *perm, cred_t *cr)
548 {
549 	int error;
550 
551 	error = zfs_dozonecheck_ds(name, ds, cr);
552 	if (error == 0) {
553 		error = secpolicy_zfs(cr);
554 		if (error != 0)
555 			error = dsl_deleg_access_impl(ds, perm, cr);
556 	}
557 	return (error);
558 }
559 
560 static int
561 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
562 {
563 	int error;
564 	dsl_dataset_t *ds;
565 	dsl_pool_t *dp;
566 
567 	/*
568 	 * First do a quick check for root in the global zone, which
569 	 * is allowed to do all write_perms.  This ensures that zfs_ioc_*
570 	 * will get to handle nonexistent datasets.
571 	 */
572 	if (INGLOBALZONE(curproc) && secpolicy_zfs(cr) == 0)
573 		return (0);
574 
575 	error = dsl_pool_hold(name, FTAG, &dp);
576 	if (error != 0)
577 		return (error);
578 
579 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
580 	if (error != 0) {
581 		dsl_pool_rele(dp, FTAG);
582 		return (error);
583 	}
584 
585 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
586 
587 	dsl_dataset_rele(ds, FTAG);
588 	dsl_pool_rele(dp, FTAG);
589 	return (error);
590 }
591 
592 /*
593  * Policy for setting the security label property.
594  *
595  * Returns 0 for success, non-zero for access and other errors.
596  */
597 static int
598 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
599 {
600 	char		ds_hexsl[MAXNAMELEN];
601 	bslabel_t	ds_sl, new_sl;
602 	boolean_t	new_default = FALSE;
603 	uint64_t	zoned;
604 	int		needed_priv = -1;
605 	int		error;
606 
607 	/* First get the existing dataset label. */
608 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
609 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
610 	if (error != 0)
611 		return (SET_ERROR(EPERM));
612 
613 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
614 		new_default = TRUE;
615 
616 	/* The label must be translatable */
617 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
618 		return (SET_ERROR(EINVAL));
619 
620 	/*
621 	 * In a non-global zone, disallow attempts to set a label that
622 	 * doesn't match that of the zone; otherwise no other checks
623 	 * are needed.
624 	 */
625 	if (!INGLOBALZONE(curproc)) {
626 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
627 			return (SET_ERROR(EPERM));
628 		return (0);
629 	}
630 
631 	/*
632 	 * For global-zone datasets (i.e., those whose zoned property is
633 	 * "off", verify that the specified new label is valid for the
634 	 * global zone.
635 	 */
636 	if (dsl_prop_get_integer(name,
637 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
638 		return (SET_ERROR(EPERM));
639 	if (!zoned) {
640 		if (zfs_check_global_label(name, strval) != 0)
641 			return (SET_ERROR(EPERM));
642 	}
643 
644 	/*
645 	 * If the existing dataset label is nondefault, check if the
646 	 * dataset is mounted (label cannot be changed while mounted).
647 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
648 	 * mounted (or isn't a dataset, doesn't exist, ...).
649 	 */
650 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
651 		objset_t *os;
652 		static char *setsl_tag = "setsl_tag";
653 
654 		/*
655 		 * Try to own the dataset; abort if there is any error,
656 		 * (e.g., already mounted, in use, or other error).
657 		 */
658 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE, B_TRUE,
659 		    setsl_tag, &os);
660 		if (error != 0)
661 			return (SET_ERROR(EPERM));
662 
663 		dmu_objset_disown(os, B_TRUE, setsl_tag);
664 
665 		if (new_default) {
666 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
667 			goto out_check;
668 		}
669 
670 		if (hexstr_to_label(strval, &new_sl) != 0)
671 			return (SET_ERROR(EPERM));
672 
673 		if (blstrictdom(&ds_sl, &new_sl))
674 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
675 		else if (blstrictdom(&new_sl, &ds_sl))
676 			needed_priv = PRIV_FILE_UPGRADE_SL;
677 	} else {
678 		/* dataset currently has a default label */
679 		if (!new_default)
680 			needed_priv = PRIV_FILE_UPGRADE_SL;
681 	}
682 
683 out_check:
684 	if (needed_priv != -1)
685 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
686 	return (0);
687 }
688 
689 static int
690 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
691     cred_t *cr)
692 {
693 	char *strval;
694 
695 	/*
696 	 * Check permissions for special properties.
697 	 */
698 	switch (prop) {
699 	case ZFS_PROP_ZONED:
700 		/*
701 		 * Disallow setting of 'zoned' from within a local zone.
702 		 */
703 		if (!INGLOBALZONE(curproc))
704 			return (SET_ERROR(EPERM));
705 		break;
706 
707 	case ZFS_PROP_QUOTA:
708 	case ZFS_PROP_FILESYSTEM_LIMIT:
709 	case ZFS_PROP_SNAPSHOT_LIMIT:
710 		if (!INGLOBALZONE(curproc)) {
711 			uint64_t zoned;
712 			char setpoint[ZFS_MAX_DATASET_NAME_LEN];
713 			/*
714 			 * Unprivileged users are allowed to modify the
715 			 * limit on things *under* (ie. contained by)
716 			 * the thing they own.
717 			 */
718 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
719 			    setpoint))
720 				return (SET_ERROR(EPERM));
721 			if (!zoned || strlen(dsname) <= strlen(setpoint))
722 				return (SET_ERROR(EPERM));
723 		}
724 		break;
725 
726 	case ZFS_PROP_MLSLABEL:
727 		if (!is_system_labeled())
728 			return (SET_ERROR(EPERM));
729 
730 		if (nvpair_value_string(propval, &strval) == 0) {
731 			int err;
732 
733 			err = zfs_set_slabel_policy(dsname, strval, CRED());
734 			if (err != 0)
735 				return (err);
736 		}
737 		break;
738 	}
739 
740 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
741 }
742 
743 /* ARGSUSED */
744 static int
745 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
746 {
747 	int error;
748 
749 	error = zfs_dozonecheck(zc->zc_name, cr);
750 	if (error != 0)
751 		return (error);
752 
753 	/*
754 	 * permission to set permissions will be evaluated later in
755 	 * dsl_deleg_can_allow()
756 	 */
757 	return (0);
758 }
759 
760 /* ARGSUSED */
761 static int
762 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
763 {
764 	return (zfs_secpolicy_write_perms(zc->zc_name,
765 	    ZFS_DELEG_PERM_ROLLBACK, cr));
766 }
767 
768 /* ARGSUSED */
769 static int
770 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
771 {
772 	dsl_pool_t *dp;
773 	dsl_dataset_t *ds;
774 	char *cp;
775 	int error;
776 
777 	/*
778 	 * Generate the current snapshot name from the given objsetid, then
779 	 * use that name for the secpolicy/zone checks.
780 	 */
781 	cp = strchr(zc->zc_name, '@');
782 	if (cp == NULL)
783 		return (SET_ERROR(EINVAL));
784 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
785 	if (error != 0)
786 		return (error);
787 
788 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
789 	if (error != 0) {
790 		dsl_pool_rele(dp, FTAG);
791 		return (error);
792 	}
793 
794 	dsl_dataset_name(ds, zc->zc_name);
795 
796 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
797 	    ZFS_DELEG_PERM_SEND, cr);
798 	dsl_dataset_rele(ds, FTAG);
799 	dsl_pool_rele(dp, FTAG);
800 
801 	return (error);
802 }
803 
804 /* ARGSUSED */
805 static int
806 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
807 {
808 	return (zfs_secpolicy_write_perms(zc->zc_name,
809 	    ZFS_DELEG_PERM_SEND, cr));
810 }
811 
812 /* ARGSUSED */
813 static int
814 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
815 {
816 	vnode_t *vp;
817 	int error;
818 
819 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
820 	    NO_FOLLOW, NULL, &vp)) != 0)
821 		return (error);
822 
823 	/* Now make sure mntpnt and dataset are ZFS */
824 
825 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
826 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
827 	    zc->zc_name) != 0)) {
828 		VN_RELE(vp);
829 		return (SET_ERROR(EPERM));
830 	}
831 
832 	VN_RELE(vp);
833 	return (dsl_deleg_access(zc->zc_name,
834 	    ZFS_DELEG_PERM_SHARE, cr));
835 }
836 
837 int
838 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
839 {
840 	if (secpolicy_nfs(cr) == 0) {
841 		return (0);
842 	} else {
843 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
844 	}
845 }
846 
847 int
848 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
849 {
850 	if (secpolicy_smb(cr) == 0) {
851 		return (0);
852 	} else {
853 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
854 	}
855 }
856 
857 static int
858 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
859 {
860 	char *cp;
861 
862 	/*
863 	 * Remove the @bla or /bla from the end of the name to get the parent.
864 	 */
865 	(void) strncpy(parent, datasetname, parentsize);
866 	cp = strrchr(parent, '@');
867 	if (cp != NULL) {
868 		cp[0] = '\0';
869 	} else {
870 		cp = strrchr(parent, '/');
871 		if (cp == NULL)
872 			return (SET_ERROR(ENOENT));
873 		cp[0] = '\0';
874 	}
875 
876 	return (0);
877 }
878 
879 int
880 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
881 {
882 	int error;
883 
884 	if ((error = zfs_secpolicy_write_perms(name,
885 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
886 		return (error);
887 
888 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
889 }
890 
891 /* ARGSUSED */
892 static int
893 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
894 {
895 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
896 }
897 
898 /*
899  * Destroying snapshots with delegated permissions requires
900  * descendant mount and destroy permissions.
901  */
902 /* ARGSUSED */
903 static int
904 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
905 {
906 	nvlist_t *snaps;
907 	nvpair_t *pair, *nextpair;
908 	int error = 0;
909 
910 	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
911 
912 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
913 	    pair = nextpair) {
914 		nextpair = nvlist_next_nvpair(snaps, pair);
915 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
916 		if (error == ENOENT) {
917 			/*
918 			 * Ignore any snapshots that don't exist (we consider
919 			 * them "already destroyed").  Remove the name from the
920 			 * nvl here in case the snapshot is created between
921 			 * now and when we try to destroy it (in which case
922 			 * we don't want to destroy it since we haven't
923 			 * checked for permission).
924 			 */
925 			fnvlist_remove_nvpair(snaps, pair);
926 			error = 0;
927 		}
928 		if (error != 0)
929 			break;
930 	}
931 
932 	return (error);
933 }
934 
935 int
936 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
937 {
938 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
939 	int	error;
940 
941 	if ((error = zfs_secpolicy_write_perms(from,
942 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
943 		return (error);
944 
945 	if ((error = zfs_secpolicy_write_perms(from,
946 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
947 		return (error);
948 
949 	if ((error = zfs_get_parent(to, parentname,
950 	    sizeof (parentname))) != 0)
951 		return (error);
952 
953 	if ((error = zfs_secpolicy_write_perms(parentname,
954 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
955 		return (error);
956 
957 	if ((error = zfs_secpolicy_write_perms(parentname,
958 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
959 		return (error);
960 
961 	return (error);
962 }
963 
964 /* ARGSUSED */
965 static int
966 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
967 {
968 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
969 }
970 
971 /* ARGSUSED */
972 static int
973 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
974 {
975 	dsl_pool_t *dp;
976 	dsl_dataset_t *clone;
977 	int error;
978 
979 	error = zfs_secpolicy_write_perms(zc->zc_name,
980 	    ZFS_DELEG_PERM_PROMOTE, cr);
981 	if (error != 0)
982 		return (error);
983 
984 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
985 	if (error != 0)
986 		return (error);
987 
988 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
989 
990 	if (error == 0) {
991 		char parentname[ZFS_MAX_DATASET_NAME_LEN];
992 		dsl_dataset_t *origin = NULL;
993 		dsl_dir_t *dd;
994 		dd = clone->ds_dir;
995 
996 		error = dsl_dataset_hold_obj(dd->dd_pool,
997 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
998 		if (error != 0) {
999 			dsl_dataset_rele(clone, FTAG);
1000 			dsl_pool_rele(dp, FTAG);
1001 			return (error);
1002 		}
1003 
1004 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
1005 		    ZFS_DELEG_PERM_MOUNT, cr);
1006 
1007 		dsl_dataset_name(origin, parentname);
1008 		if (error == 0) {
1009 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
1010 			    ZFS_DELEG_PERM_PROMOTE, cr);
1011 		}
1012 		dsl_dataset_rele(clone, FTAG);
1013 		dsl_dataset_rele(origin, FTAG);
1014 	}
1015 	dsl_pool_rele(dp, FTAG);
1016 	return (error);
1017 }
1018 
1019 /* ARGSUSED */
1020 static int
1021 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1022 {
1023 	int error;
1024 
1025 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1026 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
1027 		return (error);
1028 
1029 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1030 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
1031 		return (error);
1032 
1033 	return (zfs_secpolicy_write_perms(zc->zc_name,
1034 	    ZFS_DELEG_PERM_CREATE, cr));
1035 }
1036 
1037 int
1038 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
1039 {
1040 	return (zfs_secpolicy_write_perms(name,
1041 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
1042 }
1043 
1044 /*
1045  * Check for permission to create each snapshot in the nvlist.
1046  */
1047 /* ARGSUSED */
1048 static int
1049 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1050 {
1051 	nvlist_t *snaps;
1052 	int error = 0;
1053 	nvpair_t *pair;
1054 
1055 	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
1056 
1057 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
1058 	    pair = nvlist_next_nvpair(snaps, pair)) {
1059 		char *name = nvpair_name(pair);
1060 		char *atp = strchr(name, '@');
1061 
1062 		if (atp == NULL) {
1063 			error = SET_ERROR(EINVAL);
1064 			break;
1065 		}
1066 		*atp = '\0';
1067 		error = zfs_secpolicy_snapshot_perms(name, cr);
1068 		*atp = '@';
1069 		if (error != 0)
1070 			break;
1071 	}
1072 	return (error);
1073 }
1074 
1075 /*
1076  * Check for permission to create each bookmark in the nvlist.
1077  */
1078 /* ARGSUSED */
1079 static int
1080 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1081 {
1082 	int error = 0;
1083 
1084 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1085 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1086 		char *name = nvpair_name(pair);
1087 		char *hashp = strchr(name, '#');
1088 
1089 		if (hashp == NULL) {
1090 			error = SET_ERROR(EINVAL);
1091 			break;
1092 		}
1093 		*hashp = '\0';
1094 		error = zfs_secpolicy_write_perms(name,
1095 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1096 		*hashp = '#';
1097 		if (error != 0)
1098 			break;
1099 	}
1100 	return (error);
1101 }
1102 
1103 /* ARGSUSED */
1104 static int
1105 zfs_secpolicy_remap(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1106 {
1107 	return (zfs_secpolicy_write_perms(zc->zc_name,
1108 	    ZFS_DELEG_PERM_REMAP, cr));
1109 }
1110 
1111 /* ARGSUSED */
1112 static int
1113 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1114 {
1115 	nvpair_t *pair, *nextpair;
1116 	int error = 0;
1117 
1118 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1119 	    pair = nextpair) {
1120 		char *name = nvpair_name(pair);
1121 		char *hashp = strchr(name, '#');
1122 		nextpair = nvlist_next_nvpair(innvl, pair);
1123 
1124 		if (hashp == NULL) {
1125 			error = SET_ERROR(EINVAL);
1126 			break;
1127 		}
1128 
1129 		*hashp = '\0';
1130 		error = zfs_secpolicy_write_perms(name,
1131 		    ZFS_DELEG_PERM_DESTROY, cr);
1132 		*hashp = '#';
1133 		if (error == ENOENT) {
1134 			/*
1135 			 * Ignore any filesystems that don't exist (we consider
1136 			 * their bookmarks "already destroyed").  Remove
1137 			 * the name from the nvl here in case the filesystem
1138 			 * is created between now and when we try to destroy
1139 			 * the bookmark (in which case we don't want to
1140 			 * destroy it since we haven't checked for permission).
1141 			 */
1142 			fnvlist_remove_nvpair(innvl, pair);
1143 			error = 0;
1144 		}
1145 		if (error != 0)
1146 			break;
1147 	}
1148 
1149 	return (error);
1150 }
1151 
1152 /* ARGSUSED */
1153 static int
1154 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1155 {
1156 	/*
1157 	 * Even root must have a proper TSD so that we know what pool
1158 	 * to log to.
1159 	 */
1160 	if (tsd_get(zfs_allow_log_key) == NULL)
1161 		return (SET_ERROR(EPERM));
1162 	return (0);
1163 }
1164 
1165 static int
1166 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1167 {
1168 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
1169 	int	error;
1170 	char	*origin;
1171 
1172 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1173 	    sizeof (parentname))) != 0)
1174 		return (error);
1175 
1176 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1177 	    (error = zfs_secpolicy_write_perms(origin,
1178 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1179 		return (error);
1180 
1181 	if ((error = zfs_secpolicy_write_perms(parentname,
1182 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1183 		return (error);
1184 
1185 	return (zfs_secpolicy_write_perms(parentname,
1186 	    ZFS_DELEG_PERM_MOUNT, cr));
1187 }
1188 
1189 /*
1190  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1191  * SYS_CONFIG privilege, which is not available in a local zone.
1192  */
1193 /* ARGSUSED */
1194 static int
1195 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1196 {
1197 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1198 		return (SET_ERROR(EPERM));
1199 
1200 	return (0);
1201 }
1202 
1203 /*
1204  * Policy for object to name lookups.
1205  */
1206 /* ARGSUSED */
1207 static int
1208 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1209 {
1210 	int error;
1211 
1212 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1213 		return (0);
1214 
1215 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1216 	return (error);
1217 }
1218 
1219 /*
1220  * Policy for fault injection.  Requires all privileges.
1221  */
1222 /* ARGSUSED */
1223 static int
1224 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1225 {
1226 	return (secpolicy_zinject(cr));
1227 }
1228 
1229 /* ARGSUSED */
1230 static int
1231 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1232 {
1233 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1234 
1235 	if (prop == ZPROP_INVAL) {
1236 		if (!zfs_prop_user(zc->zc_value))
1237 			return (SET_ERROR(EINVAL));
1238 		return (zfs_secpolicy_write_perms(zc->zc_name,
1239 		    ZFS_DELEG_PERM_USERPROP, cr));
1240 	} else {
1241 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1242 		    NULL, cr));
1243 	}
1244 }
1245 
1246 static int
1247 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1248 {
1249 	int err = zfs_secpolicy_read(zc, innvl, cr);
1250 	if (err)
1251 		return (err);
1252 
1253 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1254 		return (SET_ERROR(EINVAL));
1255 
1256 	if (zc->zc_value[0] == 0) {
1257 		/*
1258 		 * They are asking about a posix uid/gid.  If it's
1259 		 * themself, allow it.
1260 		 */
1261 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1262 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA ||
1263 		    zc->zc_objset_type == ZFS_PROP_USEROBJUSED ||
1264 		    zc->zc_objset_type == ZFS_PROP_USEROBJQUOTA) {
1265 			if (zc->zc_guid == crgetuid(cr))
1266 				return (0);
1267 		} else if (zc->zc_objset_type == ZFS_PROP_GROUPUSED ||
1268 		    zc->zc_objset_type == ZFS_PROP_GROUPQUOTA ||
1269 		    zc->zc_objset_type == ZFS_PROP_GROUPOBJUSED ||
1270 		    zc->zc_objset_type == ZFS_PROP_GROUPOBJQUOTA) {
1271 			if (groupmember(zc->zc_guid, cr))
1272 				return (0);
1273 		}
1274 		/* else is for project quota/used */
1275 	}
1276 
1277 	return (zfs_secpolicy_write_perms(zc->zc_name,
1278 	    userquota_perms[zc->zc_objset_type], cr));
1279 }
1280 
1281 static int
1282 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1283 {
1284 	int err = zfs_secpolicy_read(zc, innvl, cr);
1285 	if (err)
1286 		return (err);
1287 
1288 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1289 		return (SET_ERROR(EINVAL));
1290 
1291 	return (zfs_secpolicy_write_perms(zc->zc_name,
1292 	    userquota_perms[zc->zc_objset_type], cr));
1293 }
1294 
1295 /* ARGSUSED */
1296 static int
1297 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1298 {
1299 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1300 	    NULL, cr));
1301 }
1302 
1303 /* ARGSUSED */
1304 static int
1305 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1306 {
1307 	nvpair_t *pair;
1308 	nvlist_t *holds;
1309 	int error;
1310 
1311 	holds = fnvlist_lookup_nvlist(innvl, "holds");
1312 
1313 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1314 	    pair = nvlist_next_nvpair(holds, pair)) {
1315 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1316 		error = dmu_fsname(nvpair_name(pair), fsname);
1317 		if (error != 0)
1318 			return (error);
1319 		error = zfs_secpolicy_write_perms(fsname,
1320 		    ZFS_DELEG_PERM_HOLD, cr);
1321 		if (error != 0)
1322 			return (error);
1323 	}
1324 	return (0);
1325 }
1326 
1327 /* ARGSUSED */
1328 static int
1329 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1330 {
1331 	nvpair_t *pair;
1332 	int error;
1333 
1334 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1335 	    pair = nvlist_next_nvpair(innvl, pair)) {
1336 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1337 		error = dmu_fsname(nvpair_name(pair), fsname);
1338 		if (error != 0)
1339 			return (error);
1340 		error = zfs_secpolicy_write_perms(fsname,
1341 		    ZFS_DELEG_PERM_RELEASE, cr);
1342 		if (error != 0)
1343 			return (error);
1344 	}
1345 	return (0);
1346 }
1347 
1348 /* ARGSUSED */
1349 static int
1350 zfs_secpolicy_load_key(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1351 {
1352 	return (zfs_secpolicy_write_perms(zc->zc_name,
1353 	    ZFS_DELEG_PERM_LOAD_KEY, cr));
1354 }
1355 
1356 /* ARGSUSED */
1357 static int
1358 zfs_secpolicy_change_key(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1359 {
1360 	return (zfs_secpolicy_write_perms(zc->zc_name,
1361 	    ZFS_DELEG_PERM_CHANGE_KEY, cr));
1362 }
1363 
1364 /*
1365  * Policy for allowing temporary snapshots to be taken or released
1366  */
1367 static int
1368 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1369 {
1370 	/*
1371 	 * A temporary snapshot is the same as a snapshot,
1372 	 * hold, destroy and release all rolled into one.
1373 	 * Delegated diff alone is sufficient that we allow this.
1374 	 */
1375 	int error;
1376 
1377 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1378 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1379 		return (0);
1380 
1381 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1382 
1383 	if (innvl != NULL) {
1384 		if (error == 0)
1385 			error = zfs_secpolicy_hold(zc, innvl, cr);
1386 		if (error == 0)
1387 			error = zfs_secpolicy_release(zc, innvl, cr);
1388 		if (error == 0)
1389 			error = zfs_secpolicy_destroy(zc, innvl, cr);
1390 	}
1391 	return (error);
1392 }
1393 
1394 /*
1395  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1396  */
1397 static int
1398 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1399 {
1400 	char *packed;
1401 	int error;
1402 	nvlist_t *list = NULL;
1403 
1404 	/*
1405 	 * Read in and unpack the user-supplied nvlist.
1406 	 */
1407 	if (size == 0)
1408 		return (SET_ERROR(EINVAL));
1409 
1410 	packed = kmem_alloc(size, KM_SLEEP);
1411 
1412 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1413 	    iflag)) != 0) {
1414 		kmem_free(packed, size);
1415 		return (SET_ERROR(EFAULT));
1416 	}
1417 
1418 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1419 		kmem_free(packed, size);
1420 		return (error);
1421 	}
1422 
1423 	kmem_free(packed, size);
1424 
1425 	*nvp = list;
1426 	return (0);
1427 }
1428 
1429 /*
1430  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1431  * Entries will be removed from the end of the nvlist, and one int32 entry
1432  * named "N_MORE_ERRORS" will be added indicating how many entries were
1433  * removed.
1434  */
1435 static int
1436 nvlist_smush(nvlist_t *errors, size_t max)
1437 {
1438 	size_t size;
1439 
1440 	size = fnvlist_size(errors);
1441 
1442 	if (size > max) {
1443 		nvpair_t *more_errors;
1444 		int n = 0;
1445 
1446 		if (max < 1024)
1447 			return (SET_ERROR(ENOMEM));
1448 
1449 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1450 		more_errors = nvlist_prev_nvpair(errors, NULL);
1451 
1452 		do {
1453 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1454 			    more_errors);
1455 			fnvlist_remove_nvpair(errors, pair);
1456 			n++;
1457 			size = fnvlist_size(errors);
1458 		} while (size > max);
1459 
1460 		fnvlist_remove_nvpair(errors, more_errors);
1461 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1462 		ASSERT3U(fnvlist_size(errors), <=, max);
1463 	}
1464 
1465 	return (0);
1466 }
1467 
1468 static int
1469 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1470 {
1471 	char *packed = NULL;
1472 	int error = 0;
1473 	size_t size;
1474 
1475 	size = fnvlist_size(nvl);
1476 
1477 	if (size > zc->zc_nvlist_dst_size) {
1478 		error = SET_ERROR(ENOMEM);
1479 	} else {
1480 		packed = fnvlist_pack(nvl, &size);
1481 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1482 		    size, zc->zc_iflags) != 0)
1483 			error = SET_ERROR(EFAULT);
1484 		fnvlist_pack_free(packed, size);
1485 	}
1486 
1487 	zc->zc_nvlist_dst_size = size;
1488 	zc->zc_nvlist_dst_filled = B_TRUE;
1489 	return (error);
1490 }
1491 
1492 int
1493 getzfsvfs_impl(objset_t *os, zfsvfs_t **zfvp)
1494 {
1495 	int error = 0;
1496 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1497 		return (SET_ERROR(EINVAL));
1498 	}
1499 
1500 	mutex_enter(&os->os_user_ptr_lock);
1501 	*zfvp = dmu_objset_get_user(os);
1502 	if (*zfvp) {
1503 		VFS_HOLD((*zfvp)->z_vfs);
1504 	} else {
1505 		error = SET_ERROR(ESRCH);
1506 	}
1507 	mutex_exit(&os->os_user_ptr_lock);
1508 	return (error);
1509 }
1510 
1511 int
1512 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1513 {
1514 	objset_t *os;
1515 	int error;
1516 
1517 	error = dmu_objset_hold(dsname, FTAG, &os);
1518 	if (error != 0)
1519 		return (error);
1520 
1521 	error = getzfsvfs_impl(os, zfvp);
1522 	dmu_objset_rele(os, FTAG);
1523 	return (error);
1524 }
1525 
1526 /*
1527  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1528  * case its z_vfs will be NULL, and it will be opened as the owner.
1529  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1530  * which prevents all vnode ops from running.
1531  */
1532 static int
1533 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1534 {
1535 	int error = 0;
1536 
1537 	if (getzfsvfs(name, zfvp) != 0)
1538 		error = zfsvfs_create(name, B_FALSE, zfvp);
1539 	if (error == 0) {
1540 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1541 		    RW_READER, tag);
1542 		if ((*zfvp)->z_unmounted) {
1543 			/*
1544 			 * XXX we could probably try again, since the unmounting
1545 			 * thread should be just about to disassociate the
1546 			 * objset from the zfsvfs.
1547 			 */
1548 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1549 			return (SET_ERROR(EBUSY));
1550 		}
1551 	}
1552 	return (error);
1553 }
1554 
1555 static void
1556 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1557 {
1558 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1559 
1560 	if (zfsvfs->z_vfs) {
1561 		VFS_RELE(zfsvfs->z_vfs);
1562 	} else {
1563 		dmu_objset_disown(zfsvfs->z_os, B_TRUE, zfsvfs);
1564 		zfsvfs_free(zfsvfs);
1565 	}
1566 }
1567 
1568 static int
1569 zfs_ioc_pool_create(zfs_cmd_t *zc)
1570 {
1571 	int error;
1572 	nvlist_t *config, *props = NULL;
1573 	nvlist_t *rootprops = NULL;
1574 	nvlist_t *zplprops = NULL;
1575 	char *spa_name = zc->zc_name;
1576 	dsl_crypto_params_t *dcp = NULL;
1577 
1578 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1579 	    zc->zc_iflags, &config))
1580 		return (error);
1581 
1582 	if (zc->zc_nvlist_src_size != 0 && (error =
1583 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1584 	    zc->zc_iflags, &props))) {
1585 		nvlist_free(config);
1586 		return (error);
1587 	}
1588 
1589 	if (props) {
1590 		nvlist_t *nvl = NULL;
1591 		nvlist_t *hidden_args = NULL;
1592 		uint64_t version = SPA_VERSION;
1593 		char *tname;
1594 
1595 		(void) nvlist_lookup_uint64(props,
1596 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1597 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1598 			error = SET_ERROR(EINVAL);
1599 			goto pool_props_bad;
1600 		}
1601 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1602 		if (nvl) {
1603 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1604 			if (error != 0) {
1605 				nvlist_free(config);
1606 				nvlist_free(props);
1607 				return (error);
1608 			}
1609 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1610 		}
1611 
1612 		(void) nvlist_lookup_nvlist(props, ZPOOL_HIDDEN_ARGS,
1613 		    &hidden_args);
1614 		error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE,
1615 		    rootprops, hidden_args, &dcp);
1616 		if (error != 0) {
1617 			nvlist_free(config);
1618 			nvlist_free(props);
1619 			return (error);
1620 		}
1621 		(void) nvlist_remove_all(props, ZPOOL_HIDDEN_ARGS);
1622 
1623 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1624 		error = zfs_fill_zplprops_root(version, rootprops,
1625 		    zplprops, NULL);
1626 		if (error != 0)
1627 			goto pool_props_bad;
1628 
1629 		if (nvlist_lookup_string(props,
1630 		    zpool_prop_to_name(ZPOOL_PROP_TNAME), &tname) == 0)
1631 			spa_name = tname;
1632 	}
1633 
1634 	error = spa_create(zc->zc_name, config, props, zplprops, dcp);
1635 
1636 	/*
1637 	 * Set the remaining root properties
1638 	 */
1639 	if (!error && (error = zfs_set_prop_nvlist(spa_name,
1640 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1641 		(void) spa_destroy(spa_name);
1642 
1643 pool_props_bad:
1644 	nvlist_free(rootprops);
1645 	nvlist_free(zplprops);
1646 	nvlist_free(config);
1647 	nvlist_free(props);
1648 	dsl_crypto_params_free(dcp, !!error);
1649 
1650 	return (error);
1651 }
1652 
1653 static int
1654 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1655 {
1656 	int error;
1657 	zfs_log_history(zc);
1658 	error = spa_destroy(zc->zc_name);
1659 	if (error == 0)
1660 		zvol_remove_minors(zc->zc_name);
1661 	return (error);
1662 }
1663 
1664 static int
1665 zfs_ioc_pool_import(zfs_cmd_t *zc)
1666 {
1667 	nvlist_t *config, *props = NULL;
1668 	uint64_t guid;
1669 	int error;
1670 
1671 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1672 	    zc->zc_iflags, &config)) != 0)
1673 		return (error);
1674 
1675 	if (zc->zc_nvlist_src_size != 0 && (error =
1676 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1677 	    zc->zc_iflags, &props))) {
1678 		nvlist_free(config);
1679 		return (error);
1680 	}
1681 
1682 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1683 	    guid != zc->zc_guid)
1684 		error = SET_ERROR(EINVAL);
1685 	else
1686 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1687 
1688 	if (zc->zc_nvlist_dst != 0) {
1689 		int err;
1690 
1691 		if ((err = put_nvlist(zc, config)) != 0)
1692 			error = err;
1693 	}
1694 
1695 	nvlist_free(config);
1696 
1697 	nvlist_free(props);
1698 
1699 	return (error);
1700 }
1701 
1702 static int
1703 zfs_ioc_pool_export(zfs_cmd_t *zc)
1704 {
1705 	int error;
1706 	boolean_t force = (boolean_t)zc->zc_cookie;
1707 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1708 
1709 	zfs_log_history(zc);
1710 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1711 	if (error == 0)
1712 		zvol_remove_minors(zc->zc_name);
1713 	return (error);
1714 }
1715 
1716 static int
1717 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1718 {
1719 	nvlist_t *configs;
1720 	int error;
1721 
1722 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1723 		return (SET_ERROR(EEXIST));
1724 
1725 	error = put_nvlist(zc, configs);
1726 
1727 	nvlist_free(configs);
1728 
1729 	return (error);
1730 }
1731 
1732 /*
1733  * inputs:
1734  * zc_name		name of the pool
1735  *
1736  * outputs:
1737  * zc_cookie		real errno
1738  * zc_nvlist_dst	config nvlist
1739  * zc_nvlist_dst_size	size of config nvlist
1740  */
1741 static int
1742 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1743 {
1744 	nvlist_t *config;
1745 	int error;
1746 	int ret = 0;
1747 
1748 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1749 	    sizeof (zc->zc_value));
1750 
1751 	if (config != NULL) {
1752 		ret = put_nvlist(zc, config);
1753 		nvlist_free(config);
1754 
1755 		/*
1756 		 * The config may be present even if 'error' is non-zero.
1757 		 * In this case we return success, and preserve the real errno
1758 		 * in 'zc_cookie'.
1759 		 */
1760 		zc->zc_cookie = error;
1761 	} else {
1762 		ret = error;
1763 	}
1764 
1765 	return (ret);
1766 }
1767 
1768 /*
1769  * Try to import the given pool, returning pool stats as appropriate so that
1770  * user land knows which devices are available and overall pool health.
1771  */
1772 static int
1773 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1774 {
1775 	nvlist_t *tryconfig, *config;
1776 	int error;
1777 
1778 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1779 	    zc->zc_iflags, &tryconfig)) != 0)
1780 		return (error);
1781 
1782 	config = spa_tryimport(tryconfig);
1783 
1784 	nvlist_free(tryconfig);
1785 
1786 	if (config == NULL)
1787 		return (SET_ERROR(EINVAL));
1788 
1789 	error = put_nvlist(zc, config);
1790 	nvlist_free(config);
1791 
1792 	return (error);
1793 }
1794 
1795 /*
1796  * inputs:
1797  * zc_name              name of the pool
1798  * zc_cookie            scan func (pool_scan_func_t)
1799  * zc_flags             scrub pause/resume flag (pool_scrub_cmd_t)
1800  */
1801 static int
1802 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1803 {
1804 	spa_t *spa;
1805 	int error;
1806 
1807 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1808 		return (error);
1809 
1810 	if (zc->zc_flags >= POOL_SCRUB_FLAGS_END)
1811 		return (SET_ERROR(EINVAL));
1812 
1813 	if (zc->zc_flags == POOL_SCRUB_PAUSE)
1814 		error = spa_scrub_pause_resume(spa, POOL_SCRUB_PAUSE);
1815 	else if (zc->zc_cookie == POOL_SCAN_NONE)
1816 		error = spa_scan_stop(spa);
1817 	else
1818 		error = spa_scan(spa, zc->zc_cookie);
1819 
1820 	spa_close(spa, FTAG);
1821 
1822 	return (error);
1823 }
1824 
1825 static int
1826 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1827 {
1828 	spa_t *spa;
1829 	int error;
1830 
1831 	error = spa_open(zc->zc_name, &spa, FTAG);
1832 	if (error == 0) {
1833 		spa_freeze(spa);
1834 		spa_close(spa, FTAG);
1835 	}
1836 	return (error);
1837 }
1838 
1839 static int
1840 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1841 {
1842 	spa_t *spa;
1843 	int error;
1844 
1845 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1846 		return (error);
1847 
1848 	if (zc->zc_cookie < spa_version(spa) ||
1849 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1850 		spa_close(spa, FTAG);
1851 		return (SET_ERROR(EINVAL));
1852 	}
1853 
1854 	spa_upgrade(spa, zc->zc_cookie);
1855 	spa_close(spa, FTAG);
1856 
1857 	return (error);
1858 }
1859 
1860 static int
1861 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1862 {
1863 	spa_t *spa;
1864 	char *hist_buf;
1865 	uint64_t size;
1866 	int error;
1867 
1868 	if ((size = zc->zc_history_len) == 0)
1869 		return (SET_ERROR(EINVAL));
1870 
1871 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1872 		return (error);
1873 
1874 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1875 		spa_close(spa, FTAG);
1876 		return (SET_ERROR(ENOTSUP));
1877 	}
1878 
1879 	hist_buf = kmem_alloc(size, KM_SLEEP);
1880 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1881 	    &zc->zc_history_len, hist_buf)) == 0) {
1882 		error = ddi_copyout(hist_buf,
1883 		    (void *)(uintptr_t)zc->zc_history,
1884 		    zc->zc_history_len, zc->zc_iflags);
1885 	}
1886 
1887 	spa_close(spa, FTAG);
1888 	kmem_free(hist_buf, size);
1889 	return (error);
1890 }
1891 
1892 static int
1893 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1894 {
1895 	spa_t *spa;
1896 	int error;
1897 
1898 	error = spa_open(zc->zc_name, &spa, FTAG);
1899 	if (error == 0) {
1900 		error = spa_change_guid(spa);
1901 		spa_close(spa, FTAG);
1902 	}
1903 	return (error);
1904 }
1905 
1906 static int
1907 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1908 {
1909 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1910 }
1911 
1912 /*
1913  * inputs:
1914  * zc_name		name of filesystem
1915  * zc_obj		object to find
1916  *
1917  * outputs:
1918  * zc_value		name of object
1919  */
1920 static int
1921 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1922 {
1923 	objset_t *os;
1924 	int error;
1925 
1926 	/* XXX reading from objset not owned */
1927 	if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
1928 	    FTAG, &os)) != 0)
1929 		return (error);
1930 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1931 		dmu_objset_rele_flags(os, B_TRUE, FTAG);
1932 		return (SET_ERROR(EINVAL));
1933 	}
1934 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1935 	    sizeof (zc->zc_value));
1936 	dmu_objset_rele_flags(os, B_TRUE, FTAG);
1937 
1938 	return (error);
1939 }
1940 
1941 /*
1942  * inputs:
1943  * zc_name		name of filesystem
1944  * zc_obj		object to find
1945  *
1946  * outputs:
1947  * zc_stat		stats on object
1948  * zc_value		path to object
1949  */
1950 static int
1951 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1952 {
1953 	objset_t *os;
1954 	int error;
1955 
1956 	/* XXX reading from objset not owned */
1957 	if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
1958 	    FTAG, &os)) != 0)
1959 		return (error);
1960 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1961 		dmu_objset_rele_flags(os, B_TRUE, FTAG);
1962 		return (SET_ERROR(EINVAL));
1963 	}
1964 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1965 	    sizeof (zc->zc_value));
1966 	dmu_objset_rele_flags(os, B_TRUE, FTAG);
1967 
1968 	return (error);
1969 }
1970 
1971 static int
1972 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1973 {
1974 	spa_t *spa;
1975 	int error;
1976 	nvlist_t *config;
1977 
1978 	error = spa_open(zc->zc_name, &spa, FTAG);
1979 	if (error != 0)
1980 		return (error);
1981 
1982 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1983 	    zc->zc_iflags, &config);
1984 
1985 	if (error == 0) {
1986 		error = spa_vdev_add(spa, config);
1987 		nvlist_free(config);
1988 	}
1989 	spa_close(spa, FTAG);
1990 	return (error);
1991 }
1992 
1993 /*
1994  * inputs:
1995  * zc_name		name of the pool
1996  * zc_guid		guid of vdev to remove
1997  * zc_cookie		cancel removal
1998  */
1999 static int
2000 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
2001 {
2002 	spa_t *spa;
2003 	int error;
2004 
2005 	error = spa_open(zc->zc_name, &spa, FTAG);
2006 	if (error != 0)
2007 		return (error);
2008 	if (zc->zc_cookie != 0) {
2009 		error = spa_vdev_remove_cancel(spa);
2010 	} else {
2011 		error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
2012 	}
2013 	spa_close(spa, FTAG);
2014 	return (error);
2015 }
2016 
2017 static int
2018 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
2019 {
2020 	spa_t *spa;
2021 	int error;
2022 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
2023 
2024 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2025 		return (error);
2026 	switch (zc->zc_cookie) {
2027 	case VDEV_STATE_ONLINE:
2028 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
2029 		break;
2030 
2031 	case VDEV_STATE_OFFLINE:
2032 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
2033 		break;
2034 
2035 	case VDEV_STATE_FAULTED:
2036 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
2037 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
2038 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
2039 
2040 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
2041 		break;
2042 
2043 	case VDEV_STATE_DEGRADED:
2044 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
2045 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
2046 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
2047 
2048 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
2049 		break;
2050 
2051 	default:
2052 		error = SET_ERROR(EINVAL);
2053 	}
2054 	zc->zc_cookie = newstate;
2055 	spa_close(spa, FTAG);
2056 	return (error);
2057 }
2058 
2059 static int
2060 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
2061 {
2062 	spa_t *spa;
2063 	int replacing = zc->zc_cookie;
2064 	nvlist_t *config;
2065 	int error;
2066 
2067 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2068 		return (error);
2069 
2070 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2071 	    zc->zc_iflags, &config)) == 0) {
2072 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
2073 		nvlist_free(config);
2074 	}
2075 
2076 	spa_close(spa, FTAG);
2077 	return (error);
2078 }
2079 
2080 static int
2081 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
2082 {
2083 	spa_t *spa;
2084 	int error;
2085 
2086 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2087 		return (error);
2088 
2089 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
2090 
2091 	spa_close(spa, FTAG);
2092 	return (error);
2093 }
2094 
2095 static int
2096 zfs_ioc_vdev_split(zfs_cmd_t *zc)
2097 {
2098 	spa_t *spa;
2099 	nvlist_t *config, *props = NULL;
2100 	int error;
2101 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
2102 
2103 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2104 		return (error);
2105 
2106 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2107 	    zc->zc_iflags, &config)) {
2108 		spa_close(spa, FTAG);
2109 		return (error);
2110 	}
2111 
2112 	if (zc->zc_nvlist_src_size != 0 && (error =
2113 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2114 	    zc->zc_iflags, &props))) {
2115 		spa_close(spa, FTAG);
2116 		nvlist_free(config);
2117 		return (error);
2118 	}
2119 
2120 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2121 
2122 	spa_close(spa, FTAG);
2123 
2124 	nvlist_free(config);
2125 	nvlist_free(props);
2126 
2127 	return (error);
2128 }
2129 
2130 static int
2131 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2132 {
2133 	spa_t *spa;
2134 	char *path = zc->zc_value;
2135 	uint64_t guid = zc->zc_guid;
2136 	int error;
2137 
2138 	error = spa_open(zc->zc_name, &spa, FTAG);
2139 	if (error != 0)
2140 		return (error);
2141 
2142 	error = spa_vdev_setpath(spa, guid, path);
2143 	spa_close(spa, FTAG);
2144 	return (error);
2145 }
2146 
2147 static int
2148 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2149 {
2150 	spa_t *spa;
2151 	char *fru = zc->zc_value;
2152 	uint64_t guid = zc->zc_guid;
2153 	int error;
2154 
2155 	error = spa_open(zc->zc_name, &spa, FTAG);
2156 	if (error != 0)
2157 		return (error);
2158 
2159 	error = spa_vdev_setfru(spa, guid, fru);
2160 	spa_close(spa, FTAG);
2161 	return (error);
2162 }
2163 
2164 static int
2165 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2166 {
2167 	int error = 0;
2168 	nvlist_t *nv;
2169 
2170 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2171 
2172 	if (zc->zc_nvlist_dst != 0 &&
2173 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2174 		dmu_objset_stats(os, nv);
2175 		/*
2176 		 * NB: zvol_get_stats() will read the objset contents,
2177 		 * which we aren't supposed to do with a
2178 		 * DS_MODE_USER hold, because it could be
2179 		 * inconsistent.  So this is a bit of a workaround...
2180 		 * XXX reading with out owning
2181 		 */
2182 		if (!zc->zc_objset_stats.dds_inconsistent &&
2183 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2184 			error = zvol_get_stats(os, nv);
2185 			if (error == EIO)
2186 				return (error);
2187 			VERIFY0(error);
2188 		}
2189 		error = put_nvlist(zc, nv);
2190 		nvlist_free(nv);
2191 	}
2192 
2193 	return (error);
2194 }
2195 
2196 /*
2197  * inputs:
2198  * zc_name		name of filesystem
2199  * zc_nvlist_dst_size	size of buffer for property nvlist
2200  *
2201  * outputs:
2202  * zc_objset_stats	stats
2203  * zc_nvlist_dst	property nvlist
2204  * zc_nvlist_dst_size	size of property nvlist
2205  */
2206 static int
2207 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2208 {
2209 	objset_t *os;
2210 	int error;
2211 
2212 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2213 	if (error == 0) {
2214 		error = zfs_ioc_objset_stats_impl(zc, os);
2215 		dmu_objset_rele(os, FTAG);
2216 	}
2217 
2218 	return (error);
2219 }
2220 
2221 /*
2222  * inputs:
2223  * zc_name		name of filesystem
2224  * zc_nvlist_dst_size	size of buffer for property nvlist
2225  *
2226  * outputs:
2227  * zc_nvlist_dst	received property nvlist
2228  * zc_nvlist_dst_size	size of received property nvlist
2229  *
2230  * Gets received properties (distinct from local properties on or after
2231  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2232  * local property values.
2233  */
2234 static int
2235 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2236 {
2237 	int error = 0;
2238 	nvlist_t *nv;
2239 
2240 	/*
2241 	 * Without this check, we would return local property values if the
2242 	 * caller has not already received properties on or after
2243 	 * SPA_VERSION_RECVD_PROPS.
2244 	 */
2245 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2246 		return (SET_ERROR(ENOTSUP));
2247 
2248 	if (zc->zc_nvlist_dst != 0 &&
2249 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2250 		error = put_nvlist(zc, nv);
2251 		nvlist_free(nv);
2252 	}
2253 
2254 	return (error);
2255 }
2256 
2257 static int
2258 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2259 {
2260 	uint64_t value;
2261 	int error;
2262 
2263 	/*
2264 	 * zfs_get_zplprop() will either find a value or give us
2265 	 * the default value (if there is one).
2266 	 */
2267 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2268 		return (error);
2269 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2270 	return (0);
2271 }
2272 
2273 /*
2274  * inputs:
2275  * zc_name		name of filesystem
2276  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2277  *
2278  * outputs:
2279  * zc_nvlist_dst	zpl property nvlist
2280  * zc_nvlist_dst_size	size of zpl property nvlist
2281  */
2282 static int
2283 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2284 {
2285 	objset_t *os;
2286 	int err;
2287 
2288 	/* XXX reading without owning */
2289 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2290 		return (err);
2291 
2292 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2293 
2294 	/*
2295 	 * NB: nvl_add_zplprop() will read the objset contents,
2296 	 * which we aren't supposed to do with a DS_MODE_USER
2297 	 * hold, because it could be inconsistent.
2298 	 */
2299 	if (zc->zc_nvlist_dst != 0 &&
2300 	    !zc->zc_objset_stats.dds_inconsistent &&
2301 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2302 		nvlist_t *nv;
2303 
2304 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2305 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2306 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2307 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2308 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2309 			err = put_nvlist(zc, nv);
2310 		nvlist_free(nv);
2311 	} else {
2312 		err = SET_ERROR(ENOENT);
2313 	}
2314 	dmu_objset_rele(os, FTAG);
2315 	return (err);
2316 }
2317 
2318 static boolean_t
2319 dataset_name_hidden(const char *name)
2320 {
2321 	/*
2322 	 * Skip over datasets that are not visible in this zone,
2323 	 * internal datasets (which have a $ in their name), and
2324 	 * temporary datasets (which have a % in their name).
2325 	 */
2326 	if (strchr(name, '$') != NULL)
2327 		return (B_TRUE);
2328 	if (strchr(name, '%') != NULL)
2329 		return (B_TRUE);
2330 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2331 		return (B_TRUE);
2332 	return (B_FALSE);
2333 }
2334 
2335 /*
2336  * inputs:
2337  * zc_name		name of filesystem
2338  * zc_cookie		zap cursor
2339  * zc_nvlist_dst_size	size of buffer for property nvlist
2340  *
2341  * outputs:
2342  * zc_name		name of next filesystem
2343  * zc_cookie		zap cursor
2344  * zc_objset_stats	stats
2345  * zc_nvlist_dst	property nvlist
2346  * zc_nvlist_dst_size	size of property nvlist
2347  */
2348 static int
2349 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2350 {
2351 	objset_t *os;
2352 	int error;
2353 	char *p;
2354 	size_t orig_len = strlen(zc->zc_name);
2355 
2356 top:
2357 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2358 		if (error == ENOENT)
2359 			error = SET_ERROR(ESRCH);
2360 		return (error);
2361 	}
2362 
2363 	p = strrchr(zc->zc_name, '/');
2364 	if (p == NULL || p[1] != '\0')
2365 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2366 	p = zc->zc_name + strlen(zc->zc_name);
2367 
2368 	do {
2369 		error = dmu_dir_list_next(os,
2370 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2371 		    NULL, &zc->zc_cookie);
2372 		if (error == ENOENT)
2373 			error = SET_ERROR(ESRCH);
2374 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2375 	dmu_objset_rele(os, FTAG);
2376 
2377 	/*
2378 	 * If it's an internal dataset (ie. with a '$' in its name),
2379 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2380 	 */
2381 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2382 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2383 		if (error == ENOENT) {
2384 			/* We lost a race with destroy, get the next one. */
2385 			zc->zc_name[orig_len] = '\0';
2386 			goto top;
2387 		}
2388 	}
2389 	return (error);
2390 }
2391 
2392 /*
2393  * inputs:
2394  * zc_name		name of filesystem
2395  * zc_cookie		zap cursor
2396  * zc_nvlist_dst_size	size of buffer for property nvlist
2397  * zc_simple		when set, only name is requested
2398  *
2399  * outputs:
2400  * zc_name		name of next snapshot
2401  * zc_objset_stats	stats
2402  * zc_nvlist_dst	property nvlist
2403  * zc_nvlist_dst_size	size of property nvlist
2404  */
2405 static int
2406 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2407 {
2408 	objset_t *os;
2409 	int error;
2410 
2411 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2412 	if (error != 0) {
2413 		return (error == ENOENT ? ESRCH : error);
2414 	}
2415 
2416 	/*
2417 	 * A dataset name of maximum length cannot have any snapshots,
2418 	 * so exit immediately.
2419 	 */
2420 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >=
2421 	    ZFS_MAX_DATASET_NAME_LEN) {
2422 		dmu_objset_rele(os, FTAG);
2423 		return (SET_ERROR(ESRCH));
2424 	}
2425 
2426 	error = dmu_snapshot_list_next(os,
2427 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2428 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2429 	    NULL);
2430 
2431 	if (error == 0 && !zc->zc_simple) {
2432 		dsl_dataset_t *ds;
2433 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2434 
2435 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2436 		if (error == 0) {
2437 			objset_t *ossnap;
2438 
2439 			error = dmu_objset_from_ds(ds, &ossnap);
2440 			if (error == 0)
2441 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2442 			dsl_dataset_rele(ds, FTAG);
2443 		}
2444 	} else if (error == ENOENT) {
2445 		error = SET_ERROR(ESRCH);
2446 	}
2447 
2448 	dmu_objset_rele(os, FTAG);
2449 	/* if we failed, undo the @ that we tacked on to zc_name */
2450 	if (error != 0)
2451 		*strchr(zc->zc_name, '@') = '\0';
2452 	return (error);
2453 }
2454 
2455 static int
2456 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2457 {
2458 	const char *propname = nvpair_name(pair);
2459 	uint64_t *valary;
2460 	unsigned int vallen;
2461 	const char *domain;
2462 	char *dash;
2463 	zfs_userquota_prop_t type;
2464 	uint64_t rid;
2465 	uint64_t quota;
2466 	zfsvfs_t *zfsvfs;
2467 	int err;
2468 
2469 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2470 		nvlist_t *attrs;
2471 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2472 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2473 		    &pair) != 0)
2474 			return (SET_ERROR(EINVAL));
2475 	}
2476 
2477 	/*
2478 	 * A correctly constructed propname is encoded as
2479 	 * userquota@<rid>-<domain>.
2480 	 */
2481 	if ((dash = strchr(propname, '-')) == NULL ||
2482 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2483 	    vallen != 3)
2484 		return (SET_ERROR(EINVAL));
2485 
2486 	domain = dash + 1;
2487 	type = valary[0];
2488 	rid = valary[1];
2489 	quota = valary[2];
2490 
2491 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2492 	if (err == 0) {
2493 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2494 		zfsvfs_rele(zfsvfs, FTAG);
2495 	}
2496 
2497 	return (err);
2498 }
2499 
2500 /*
2501  * If the named property is one that has a special function to set its value,
2502  * return 0 on success and a positive error code on failure; otherwise if it is
2503  * not one of the special properties handled by this function, return -1.
2504  *
2505  * XXX: It would be better for callers of the property interface if we handled
2506  * these special cases in dsl_prop.c (in the dsl layer).
2507  */
2508 static int
2509 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2510     nvpair_t *pair)
2511 {
2512 	const char *propname = nvpair_name(pair);
2513 	zfs_prop_t prop = zfs_name_to_prop(propname);
2514 	uint64_t intval = 0;
2515 	char *strval = NULL;
2516 	int err = -1;
2517 
2518 	if (prop == ZPROP_INVAL) {
2519 		if (zfs_prop_userquota(propname))
2520 			return (zfs_prop_set_userquota(dsname, pair));
2521 		return (-1);
2522 	}
2523 
2524 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2525 		nvlist_t *attrs;
2526 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2527 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2528 		    &pair) == 0);
2529 	}
2530 
2531 	/* all special properties are numeric except for keylocation */
2532 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
2533 		strval = fnvpair_value_string(pair);
2534 	} else {
2535 		intval = fnvpair_value_uint64(pair);
2536 	}
2537 
2538 	switch (prop) {
2539 	case ZFS_PROP_QUOTA:
2540 		err = dsl_dir_set_quota(dsname, source, intval);
2541 		break;
2542 	case ZFS_PROP_REFQUOTA:
2543 		err = dsl_dataset_set_refquota(dsname, source, intval);
2544 		break;
2545 	case ZFS_PROP_FILESYSTEM_LIMIT:
2546 	case ZFS_PROP_SNAPSHOT_LIMIT:
2547 		if (intval == UINT64_MAX) {
2548 			/* clearing the limit, just do it */
2549 			err = 0;
2550 		} else {
2551 			err = dsl_dir_activate_fs_ss_limit(dsname);
2552 		}
2553 		/*
2554 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2555 		 * default path to set the value in the nvlist.
2556 		 */
2557 		if (err == 0)
2558 			err = -1;
2559 		break;
2560 	case ZFS_PROP_KEYLOCATION:
2561 		err = dsl_crypto_can_set_keylocation(dsname, strval);
2562 
2563 		/*
2564 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2565 		 * default path to set the value in the nvlist.
2566 		 */
2567 		if (err == 0)
2568 			err = -1;
2569 		break;
2570 	case ZFS_PROP_RESERVATION:
2571 		err = dsl_dir_set_reservation(dsname, source, intval);
2572 		break;
2573 	case ZFS_PROP_REFRESERVATION:
2574 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2575 		break;
2576 	case ZFS_PROP_VOLSIZE:
2577 		err = zvol_set_volsize(dsname, intval);
2578 		break;
2579 	case ZFS_PROP_VERSION:
2580 	{
2581 		zfsvfs_t *zfsvfs;
2582 
2583 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2584 			break;
2585 
2586 		err = zfs_set_version(zfsvfs, intval);
2587 		zfsvfs_rele(zfsvfs, FTAG);
2588 
2589 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2590 			zfs_cmd_t *zc;
2591 
2592 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2593 			(void) strcpy(zc->zc_name, dsname);
2594 			(void) zfs_ioc_userspace_upgrade(zc);
2595 			(void) zfs_ioc_id_quota_upgrade(zc);
2596 			kmem_free(zc, sizeof (zfs_cmd_t));
2597 		}
2598 		break;
2599 	}
2600 	default:
2601 		err = -1;
2602 	}
2603 
2604 	return (err);
2605 }
2606 
2607 /*
2608  * This function is best effort. If it fails to set any of the given properties,
2609  * it continues to set as many as it can and returns the last error
2610  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2611  * with the list of names of all the properties that failed along with the
2612  * corresponding error numbers.
2613  *
2614  * If every property is set successfully, zero is returned and errlist is not
2615  * modified.
2616  */
2617 int
2618 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2619     nvlist_t *errlist)
2620 {
2621 	nvpair_t *pair;
2622 	nvpair_t *propval;
2623 	int rv = 0;
2624 	uint64_t intval;
2625 	char *strval;
2626 	nvlist_t *genericnvl = fnvlist_alloc();
2627 	nvlist_t *retrynvl = fnvlist_alloc();
2628 
2629 retry:
2630 	pair = NULL;
2631 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2632 		const char *propname = nvpair_name(pair);
2633 		zfs_prop_t prop = zfs_name_to_prop(propname);
2634 		int err = 0;
2635 
2636 		/* decode the property value */
2637 		propval = pair;
2638 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2639 			nvlist_t *attrs;
2640 			attrs = fnvpair_value_nvlist(pair);
2641 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2642 			    &propval) != 0)
2643 				err = SET_ERROR(EINVAL);
2644 		}
2645 
2646 		/* Validate value type */
2647 		if (err == 0 && source == ZPROP_SRC_INHERITED) {
2648 			/* inherited properties are expected to be booleans */
2649 			if (nvpair_type(propval) != DATA_TYPE_BOOLEAN)
2650 				err = SET_ERROR(EINVAL);
2651 		} else if (err == 0 && prop == ZPROP_INVAL) {
2652 			if (zfs_prop_user(propname)) {
2653 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2654 					err = SET_ERROR(EINVAL);
2655 			} else if (zfs_prop_userquota(propname)) {
2656 				if (nvpair_type(propval) !=
2657 				    DATA_TYPE_UINT64_ARRAY)
2658 					err = SET_ERROR(EINVAL);
2659 			} else {
2660 				err = SET_ERROR(EINVAL);
2661 			}
2662 		} else if (err == 0) {
2663 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2664 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2665 					err = SET_ERROR(EINVAL);
2666 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2667 				const char *unused;
2668 
2669 				intval = fnvpair_value_uint64(propval);
2670 
2671 				switch (zfs_prop_get_type(prop)) {
2672 				case PROP_TYPE_NUMBER:
2673 					break;
2674 				case PROP_TYPE_STRING:
2675 					err = SET_ERROR(EINVAL);
2676 					break;
2677 				case PROP_TYPE_INDEX:
2678 					if (zfs_prop_index_to_string(prop,
2679 					    intval, &unused) != 0)
2680 						err = SET_ERROR(EINVAL);
2681 					break;
2682 				default:
2683 					cmn_err(CE_PANIC,
2684 					    "unknown property type");
2685 				}
2686 			} else {
2687 				err = SET_ERROR(EINVAL);
2688 			}
2689 		}
2690 
2691 		/* Validate permissions */
2692 		if (err == 0)
2693 			err = zfs_check_settable(dsname, pair, CRED());
2694 
2695 		if (err == 0) {
2696 			if (source == ZPROP_SRC_INHERITED)
2697 				err = -1; /* does not need special handling */
2698 			else
2699 				err = zfs_prop_set_special(dsname, source,
2700 				    pair);
2701 			if (err == -1) {
2702 				/*
2703 				 * For better performance we build up a list of
2704 				 * properties to set in a single transaction.
2705 				 */
2706 				err = nvlist_add_nvpair(genericnvl, pair);
2707 			} else if (err != 0 && nvl != retrynvl) {
2708 				/*
2709 				 * This may be a spurious error caused by
2710 				 * receiving quota and reservation out of order.
2711 				 * Try again in a second pass.
2712 				 */
2713 				err = nvlist_add_nvpair(retrynvl, pair);
2714 			}
2715 		}
2716 
2717 		if (err != 0) {
2718 			if (errlist != NULL)
2719 				fnvlist_add_int32(errlist, propname, err);
2720 			rv = err;
2721 		}
2722 	}
2723 
2724 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2725 		nvl = retrynvl;
2726 		goto retry;
2727 	}
2728 
2729 	if (!nvlist_empty(genericnvl) &&
2730 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2731 		/*
2732 		 * If this fails, we still want to set as many properties as we
2733 		 * can, so try setting them individually.
2734 		 */
2735 		pair = NULL;
2736 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2737 			const char *propname = nvpair_name(pair);
2738 			int err = 0;
2739 
2740 			propval = pair;
2741 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2742 				nvlist_t *attrs;
2743 				attrs = fnvpair_value_nvlist(pair);
2744 				propval = fnvlist_lookup_nvpair(attrs,
2745 				    ZPROP_VALUE);
2746 			}
2747 
2748 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2749 				strval = fnvpair_value_string(propval);
2750 				err = dsl_prop_set_string(dsname, propname,
2751 				    source, strval);
2752 			} else if (nvpair_type(propval) == DATA_TYPE_BOOLEAN) {
2753 				err = dsl_prop_inherit(dsname, propname,
2754 				    source);
2755 			} else {
2756 				intval = fnvpair_value_uint64(propval);
2757 				err = dsl_prop_set_int(dsname, propname, source,
2758 				    intval);
2759 			}
2760 
2761 			if (err != 0) {
2762 				if (errlist != NULL) {
2763 					fnvlist_add_int32(errlist, propname,
2764 					    err);
2765 				}
2766 				rv = err;
2767 			}
2768 		}
2769 	}
2770 	nvlist_free(genericnvl);
2771 	nvlist_free(retrynvl);
2772 
2773 	return (rv);
2774 }
2775 
2776 /*
2777  * Check that all the properties are valid user properties.
2778  */
2779 static int
2780 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2781 {
2782 	nvpair_t *pair = NULL;
2783 	int error = 0;
2784 
2785 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2786 		const char *propname = nvpair_name(pair);
2787 
2788 		if (!zfs_prop_user(propname) ||
2789 		    nvpair_type(pair) != DATA_TYPE_STRING)
2790 			return (SET_ERROR(EINVAL));
2791 
2792 		if (error = zfs_secpolicy_write_perms(fsname,
2793 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2794 			return (error);
2795 
2796 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2797 			return (SET_ERROR(ENAMETOOLONG));
2798 
2799 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2800 			return (E2BIG);
2801 	}
2802 	return (0);
2803 }
2804 
2805 static void
2806 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2807 {
2808 	nvpair_t *pair;
2809 
2810 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2811 
2812 	pair = NULL;
2813 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2814 		if (nvlist_exists(skipped, nvpair_name(pair)))
2815 			continue;
2816 
2817 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2818 	}
2819 }
2820 
2821 static int
2822 clear_received_props(const char *dsname, nvlist_t *props,
2823     nvlist_t *skipped)
2824 {
2825 	int err = 0;
2826 	nvlist_t *cleared_props = NULL;
2827 	props_skip(props, skipped, &cleared_props);
2828 	if (!nvlist_empty(cleared_props)) {
2829 		/*
2830 		 * Acts on local properties until the dataset has received
2831 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2832 		 */
2833 		zprop_source_t flags = (ZPROP_SRC_NONE |
2834 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2835 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2836 	}
2837 	nvlist_free(cleared_props);
2838 	return (err);
2839 }
2840 
2841 /*
2842  * inputs:
2843  * zc_name		name of filesystem
2844  * zc_value		name of property to set
2845  * zc_nvlist_src{_size}	nvlist of properties to apply
2846  * zc_cookie		received properties flag
2847  *
2848  * outputs:
2849  * zc_nvlist_dst{_size} error for each unapplied received property
2850  */
2851 static int
2852 zfs_ioc_set_prop(zfs_cmd_t *zc)
2853 {
2854 	nvlist_t *nvl;
2855 	boolean_t received = zc->zc_cookie;
2856 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2857 	    ZPROP_SRC_LOCAL);
2858 	nvlist_t *errors;
2859 	int error;
2860 
2861 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2862 	    zc->zc_iflags, &nvl)) != 0)
2863 		return (error);
2864 
2865 	if (received) {
2866 		nvlist_t *origprops;
2867 
2868 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2869 			(void) clear_received_props(zc->zc_name,
2870 			    origprops, nvl);
2871 			nvlist_free(origprops);
2872 		}
2873 
2874 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2875 	}
2876 
2877 	errors = fnvlist_alloc();
2878 	if (error == 0)
2879 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2880 
2881 	if (zc->zc_nvlist_dst != 0 && errors != NULL) {
2882 		(void) put_nvlist(zc, errors);
2883 	}
2884 
2885 	nvlist_free(errors);
2886 	nvlist_free(nvl);
2887 	return (error);
2888 }
2889 
2890 /*
2891  * inputs:
2892  * zc_name		name of filesystem
2893  * zc_value		name of property to inherit
2894  * zc_cookie		revert to received value if TRUE
2895  *
2896  * outputs:		none
2897  */
2898 static int
2899 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2900 {
2901 	const char *propname = zc->zc_value;
2902 	zfs_prop_t prop = zfs_name_to_prop(propname);
2903 	boolean_t received = zc->zc_cookie;
2904 	zprop_source_t source = (received
2905 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2906 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2907 
2908 	if (received) {
2909 		nvlist_t *dummy;
2910 		nvpair_t *pair;
2911 		zprop_type_t type;
2912 		int err;
2913 
2914 		/*
2915 		 * zfs_prop_set_special() expects properties in the form of an
2916 		 * nvpair with type info.
2917 		 */
2918 		if (prop == ZPROP_INVAL) {
2919 			if (!zfs_prop_user(propname))
2920 				return (SET_ERROR(EINVAL));
2921 
2922 			type = PROP_TYPE_STRING;
2923 		} else if (prop == ZFS_PROP_VOLSIZE ||
2924 		    prop == ZFS_PROP_VERSION) {
2925 			return (SET_ERROR(EINVAL));
2926 		} else {
2927 			type = zfs_prop_get_type(prop);
2928 		}
2929 
2930 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2931 
2932 		switch (type) {
2933 		case PROP_TYPE_STRING:
2934 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2935 			break;
2936 		case PROP_TYPE_NUMBER:
2937 		case PROP_TYPE_INDEX:
2938 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2939 			break;
2940 		default:
2941 			nvlist_free(dummy);
2942 			return (SET_ERROR(EINVAL));
2943 		}
2944 
2945 		pair = nvlist_next_nvpair(dummy, NULL);
2946 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2947 		nvlist_free(dummy);
2948 		if (err != -1)
2949 			return (err); /* special property already handled */
2950 	} else {
2951 		/*
2952 		 * Only check this in the non-received case. We want to allow
2953 		 * 'inherit -S' to revert non-inheritable properties like quota
2954 		 * and reservation to the received or default values even though
2955 		 * they are not considered inheritable.
2956 		 */
2957 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2958 			return (SET_ERROR(EINVAL));
2959 	}
2960 
2961 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2962 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2963 }
2964 
2965 static int
2966 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2967 {
2968 	nvlist_t *props;
2969 	spa_t *spa;
2970 	int error;
2971 	nvpair_t *pair;
2972 
2973 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2974 	    zc->zc_iflags, &props))
2975 		return (error);
2976 
2977 	/*
2978 	 * If the only property is the configfile, then just do a spa_lookup()
2979 	 * to handle the faulted case.
2980 	 */
2981 	pair = nvlist_next_nvpair(props, NULL);
2982 	if (pair != NULL && strcmp(nvpair_name(pair),
2983 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2984 	    nvlist_next_nvpair(props, pair) == NULL) {
2985 		mutex_enter(&spa_namespace_lock);
2986 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2987 			spa_configfile_set(spa, props, B_FALSE);
2988 			spa_write_cachefile(spa, B_FALSE, B_TRUE);
2989 		}
2990 		mutex_exit(&spa_namespace_lock);
2991 		if (spa != NULL) {
2992 			nvlist_free(props);
2993 			return (0);
2994 		}
2995 	}
2996 
2997 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2998 		nvlist_free(props);
2999 		return (error);
3000 	}
3001 
3002 	error = spa_prop_set(spa, props);
3003 
3004 	nvlist_free(props);
3005 	spa_close(spa, FTAG);
3006 
3007 	return (error);
3008 }
3009 
3010 static int
3011 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
3012 {
3013 	spa_t *spa;
3014 	int error;
3015 	nvlist_t *nvp = NULL;
3016 
3017 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
3018 		/*
3019 		 * If the pool is faulted, there may be properties we can still
3020 		 * get (such as altroot and cachefile), so attempt to get them
3021 		 * anyway.
3022 		 */
3023 		mutex_enter(&spa_namespace_lock);
3024 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
3025 			error = spa_prop_get(spa, &nvp);
3026 		mutex_exit(&spa_namespace_lock);
3027 	} else {
3028 		error = spa_prop_get(spa, &nvp);
3029 		spa_close(spa, FTAG);
3030 	}
3031 
3032 	if (error == 0 && zc->zc_nvlist_dst != 0)
3033 		error = put_nvlist(zc, nvp);
3034 	else
3035 		error = SET_ERROR(EFAULT);
3036 
3037 	nvlist_free(nvp);
3038 	return (error);
3039 }
3040 
3041 /*
3042  * inputs:
3043  * zc_name		name of filesystem
3044  * zc_nvlist_src{_size}	nvlist of delegated permissions
3045  * zc_perm_action	allow/unallow flag
3046  *
3047  * outputs:		none
3048  */
3049 static int
3050 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
3051 {
3052 	int error;
3053 	nvlist_t *fsaclnv = NULL;
3054 
3055 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3056 	    zc->zc_iflags, &fsaclnv)) != 0)
3057 		return (error);
3058 
3059 	/*
3060 	 * Verify nvlist is constructed correctly
3061 	 */
3062 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
3063 		nvlist_free(fsaclnv);
3064 		return (SET_ERROR(EINVAL));
3065 	}
3066 
3067 	/*
3068 	 * If we don't have PRIV_SYS_MOUNT, then validate
3069 	 * that user is allowed to hand out each permission in
3070 	 * the nvlist(s)
3071 	 */
3072 
3073 	error = secpolicy_zfs(CRED());
3074 	if (error != 0) {
3075 		if (zc->zc_perm_action == B_FALSE) {
3076 			error = dsl_deleg_can_allow(zc->zc_name,
3077 			    fsaclnv, CRED());
3078 		} else {
3079 			error = dsl_deleg_can_unallow(zc->zc_name,
3080 			    fsaclnv, CRED());
3081 		}
3082 	}
3083 
3084 	if (error == 0)
3085 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
3086 
3087 	nvlist_free(fsaclnv);
3088 	return (error);
3089 }
3090 
3091 /*
3092  * inputs:
3093  * zc_name		name of filesystem
3094  *
3095  * outputs:
3096  * zc_nvlist_src{_size}	nvlist of delegated permissions
3097  */
3098 static int
3099 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
3100 {
3101 	nvlist_t *nvp;
3102 	int error;
3103 
3104 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
3105 		error = put_nvlist(zc, nvp);
3106 		nvlist_free(nvp);
3107 	}
3108 
3109 	return (error);
3110 }
3111 
3112 /* ARGSUSED */
3113 static void
3114 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
3115 {
3116 	zfs_creat_t *zct = arg;
3117 
3118 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
3119 }
3120 
3121 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3122 
3123 /*
3124  * inputs:
3125  * os			parent objset pointer (NULL if root fs)
3126  * fuids_ok		fuids allowed in this version of the spa?
3127  * sa_ok		SAs allowed in this version of the spa?
3128  * createprops		list of properties requested by creator
3129  *
3130  * outputs:
3131  * zplprops	values for the zplprops we attach to the master node object
3132  * is_ci	true if requested file system will be purely case-insensitive
3133  *
3134  * Determine the settings for utf8only, normalization and
3135  * casesensitivity.  Specific values may have been requested by the
3136  * creator and/or we can inherit values from the parent dataset.  If
3137  * the file system is of too early a vintage, a creator can not
3138  * request settings for these properties, even if the requested
3139  * setting is the default value.  We don't actually want to create dsl
3140  * properties for these, so remove them from the source nvlist after
3141  * processing.
3142  */
3143 static int
3144 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3145     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3146     nvlist_t *zplprops, boolean_t *is_ci)
3147 {
3148 	uint64_t sense = ZFS_PROP_UNDEFINED;
3149 	uint64_t norm = ZFS_PROP_UNDEFINED;
3150 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3151 
3152 	ASSERT(zplprops != NULL);
3153 
3154 	if (os != NULL && os->os_phys->os_type != DMU_OST_ZFS)
3155 		return (SET_ERROR(EINVAL));
3156 
3157 	/*
3158 	 * Pull out creator prop choices, if any.
3159 	 */
3160 	if (createprops) {
3161 		(void) nvlist_lookup_uint64(createprops,
3162 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3163 		(void) nvlist_lookup_uint64(createprops,
3164 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3165 		(void) nvlist_remove_all(createprops,
3166 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3167 		(void) nvlist_lookup_uint64(createprops,
3168 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3169 		(void) nvlist_remove_all(createprops,
3170 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3171 		(void) nvlist_lookup_uint64(createprops,
3172 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3173 		(void) nvlist_remove_all(createprops,
3174 		    zfs_prop_to_name(ZFS_PROP_CASE));
3175 	}
3176 
3177 	/*
3178 	 * If the zpl version requested is whacky or the file system
3179 	 * or pool is version is too "young" to support normalization
3180 	 * and the creator tried to set a value for one of the props,
3181 	 * error out.
3182 	 */
3183 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3184 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3185 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3186 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3187 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3188 	    sense != ZFS_PROP_UNDEFINED)))
3189 		return (SET_ERROR(ENOTSUP));
3190 
3191 	/*
3192 	 * Put the version in the zplprops
3193 	 */
3194 	VERIFY(nvlist_add_uint64(zplprops,
3195 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3196 
3197 	if (norm == ZFS_PROP_UNDEFINED)
3198 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3199 	VERIFY(nvlist_add_uint64(zplprops,
3200 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3201 
3202 	/*
3203 	 * If we're normalizing, names must always be valid UTF-8 strings.
3204 	 */
3205 	if (norm)
3206 		u8 = 1;
3207 	if (u8 == ZFS_PROP_UNDEFINED)
3208 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3209 	VERIFY(nvlist_add_uint64(zplprops,
3210 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3211 
3212 	if (sense == ZFS_PROP_UNDEFINED)
3213 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3214 	VERIFY(nvlist_add_uint64(zplprops,
3215 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3216 
3217 	if (is_ci)
3218 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3219 
3220 	return (0);
3221 }
3222 
3223 static int
3224 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3225     nvlist_t *zplprops, boolean_t *is_ci)
3226 {
3227 	boolean_t fuids_ok, sa_ok;
3228 	uint64_t zplver = ZPL_VERSION;
3229 	objset_t *os = NULL;
3230 	char parentname[ZFS_MAX_DATASET_NAME_LEN];
3231 	char *cp;
3232 	spa_t *spa;
3233 	uint64_t spa_vers;
3234 	int error;
3235 
3236 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3237 	cp = strrchr(parentname, '/');
3238 	ASSERT(cp != NULL);
3239 	cp[0] = '\0';
3240 
3241 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3242 		return (error);
3243 
3244 	spa_vers = spa_version(spa);
3245 	spa_close(spa, FTAG);
3246 
3247 	zplver = zfs_zpl_version_map(spa_vers);
3248 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3249 	sa_ok = (zplver >= ZPL_VERSION_SA);
3250 
3251 	/*
3252 	 * Open parent object set so we can inherit zplprop values.
3253 	 */
3254 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3255 		return (error);
3256 
3257 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3258 	    zplprops, is_ci);
3259 	dmu_objset_rele(os, FTAG);
3260 	return (error);
3261 }
3262 
3263 static int
3264 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3265     nvlist_t *zplprops, boolean_t *is_ci)
3266 {
3267 	boolean_t fuids_ok;
3268 	boolean_t sa_ok;
3269 	uint64_t zplver = ZPL_VERSION;
3270 	int error;
3271 
3272 	zplver = zfs_zpl_version_map(spa_vers);
3273 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3274 	sa_ok = (zplver >= ZPL_VERSION_SA);
3275 
3276 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3277 	    createprops, zplprops, is_ci);
3278 	return (error);
3279 }
3280 
3281 /*
3282  * innvl: {
3283  *     "type" -> dmu_objset_type_t (int32)
3284  *     (optional) "props" -> { prop -> value }
3285  *     (optional) "hidden_args" -> { "wkeydata" -> value }
3286  *         raw uint8_t array of encryption wrapping key data (32 bytes)
3287  * }
3288  *
3289  * outnvl: propname -> error code (int32)
3290  */
3291 
3292 static const zfs_ioc_key_t zfs_keys_create[] = {
3293 	{"type",	DATA_TYPE_INT32,	0},
3294 	{"props",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3295 	{"hidden_args",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3296 };
3297 
3298 static int
3299 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3300 {
3301 	int error = 0;
3302 	zfs_creat_t zct = { 0 };
3303 	nvlist_t *nvprops = NULL;
3304 	nvlist_t *hidden_args = NULL;
3305 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3306 	dmu_objset_type_t type;
3307 	boolean_t is_insensitive = B_FALSE;
3308 	dsl_crypto_params_t *dcp = NULL;
3309 
3310 	type = (dmu_objset_type_t)fnvlist_lookup_int32(innvl, "type");
3311 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3312 	(void) nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);
3313 
3314 	switch (type) {
3315 	case DMU_OST_ZFS:
3316 		cbfunc = zfs_create_cb;
3317 		break;
3318 
3319 	case DMU_OST_ZVOL:
3320 		cbfunc = zvol_create_cb;
3321 		break;
3322 
3323 	default:
3324 		cbfunc = NULL;
3325 		break;
3326 	}
3327 	if (strchr(fsname, '@') ||
3328 	    strchr(fsname, '%'))
3329 		return (SET_ERROR(EINVAL));
3330 
3331 	zct.zct_props = nvprops;
3332 
3333 	if (cbfunc == NULL)
3334 		return (SET_ERROR(EINVAL));
3335 
3336 	if (type == DMU_OST_ZVOL) {
3337 		uint64_t volsize, volblocksize;
3338 
3339 		if (nvprops == NULL)
3340 			return (SET_ERROR(EINVAL));
3341 		if (nvlist_lookup_uint64(nvprops,
3342 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3343 			return (SET_ERROR(EINVAL));
3344 
3345 		if ((error = nvlist_lookup_uint64(nvprops,
3346 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3347 		    &volblocksize)) != 0 && error != ENOENT)
3348 			return (SET_ERROR(EINVAL));
3349 
3350 		if (error != 0)
3351 			volblocksize = zfs_prop_default_numeric(
3352 			    ZFS_PROP_VOLBLOCKSIZE);
3353 
3354 		if ((error = zvol_check_volblocksize(
3355 		    volblocksize)) != 0 ||
3356 		    (error = zvol_check_volsize(volsize,
3357 		    volblocksize)) != 0)
3358 			return (error);
3359 	} else if (type == DMU_OST_ZFS) {
3360 		int error;
3361 
3362 		/*
3363 		 * We have to have normalization and
3364 		 * case-folding flags correct when we do the
3365 		 * file system creation, so go figure them out
3366 		 * now.
3367 		 */
3368 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3369 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3370 		error = zfs_fill_zplprops(fsname, nvprops,
3371 		    zct.zct_zplprops, &is_insensitive);
3372 		if (error != 0) {
3373 			nvlist_free(zct.zct_zplprops);
3374 			return (error);
3375 		}
3376 	}
3377 
3378 	error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE, nvprops,
3379 	    hidden_args, &dcp);
3380 	if (error != 0) {
3381 		nvlist_free(zct.zct_zplprops);
3382 		return (error);
3383 	}
3384 
3385 	error = dmu_objset_create(fsname, type,
3386 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, dcp, cbfunc, &zct);
3387 
3388 	nvlist_free(zct.zct_zplprops);
3389 	dsl_crypto_params_free(dcp, !!error);
3390 
3391 	/*
3392 	 * It would be nice to do this atomically.
3393 	 */
3394 	if (error == 0) {
3395 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3396 		    nvprops, outnvl);
3397 		if (error != 0)
3398 			(void) dsl_destroy_head(fsname);
3399 	}
3400 	return (error);
3401 }
3402 
3403 /*
3404  * innvl: {
3405  *     "origin" -> name of origin snapshot
3406  *     (optional) "props" -> { prop -> value }
3407  *     (optional) "hidden_args" -> { "wkeydata" -> value }
3408  *         raw uint8_t array of encryption wrapping key data (32 bytes)
3409  * }
3410  *
3411  * outnvl: propname -> error code (int32)
3412  */
3413 static const zfs_ioc_key_t zfs_keys_clone[] = {
3414 	{"origin",	DATA_TYPE_STRING,	0},
3415 	{"props",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3416 	{"hidden_args",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3417 };
3418 
3419 static int
3420 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3421 {
3422 	int error = 0;
3423 	nvlist_t *nvprops = NULL;
3424 	char *origin_name;
3425 
3426 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3427 		return (SET_ERROR(EINVAL));
3428 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3429 
3430 	if (strchr(fsname, '@') ||
3431 	    strchr(fsname, '%'))
3432 		return (SET_ERROR(EINVAL));
3433 
3434 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3435 		return (SET_ERROR(EINVAL));
3436 
3437 	error = dmu_objset_clone(fsname, origin_name);
3438 
3439 	/*
3440 	 * It would be nice to do this atomically.
3441 	 */
3442 	if (error == 0) {
3443 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3444 		    nvprops, outnvl);
3445 		if (error != 0)
3446 			(void) dsl_destroy_head(fsname);
3447 	}
3448 	return (error);
3449 }
3450 
3451 static const zfs_ioc_key_t zfs_keys_remap[] = {
3452 	/* no nvl keys */
3453 };
3454 
3455 /* ARGSUSED */
3456 static int
3457 zfs_ioc_remap(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3458 {
3459 	if (strchr(fsname, '@') ||
3460 	    strchr(fsname, '%'))
3461 		return (SET_ERROR(EINVAL));
3462 
3463 	return (dmu_objset_remap_indirects(fsname));
3464 }
3465 
3466 /*
3467  * innvl: {
3468  *     "snaps" -> { snapshot1, snapshot2 }
3469  *     (optional) "props" -> { prop -> value (string) }
3470  * }
3471  *
3472  * outnvl: snapshot -> error code (int32)
3473  */
3474 static const zfs_ioc_key_t zfs_keys_snapshot[] = {
3475 	{"snaps",	DATA_TYPE_NVLIST,	0},
3476 	{"props",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3477 };
3478 
3479 static int
3480 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3481 {
3482 	nvlist_t *snaps;
3483 	nvlist_t *props = NULL;
3484 	int error, poollen;
3485 	nvpair_t *pair;
3486 
3487 	(void) nvlist_lookup_nvlist(innvl, "props", &props);
3488 	if ((error = zfs_check_userprops(poolname, props)) != 0)
3489 		return (error);
3490 
3491 	if (!nvlist_empty(props) &&
3492 	    zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3493 		return (SET_ERROR(ENOTSUP));
3494 
3495 	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
3496 	poollen = strlen(poolname);
3497 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3498 	    pair = nvlist_next_nvpair(snaps, pair)) {
3499 		const char *name = nvpair_name(pair);
3500 		const char *cp = strchr(name, '@');
3501 
3502 		/*
3503 		 * The snap name must contain an @, and the part after it must
3504 		 * contain only valid characters.
3505 		 */
3506 		if (cp == NULL ||
3507 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3508 			return (SET_ERROR(EINVAL));
3509 
3510 		/*
3511 		 * The snap must be in the specified pool.
3512 		 */
3513 		if (strncmp(name, poolname, poollen) != 0 ||
3514 		    (name[poollen] != '/' && name[poollen] != '@'))
3515 			return (SET_ERROR(EXDEV));
3516 
3517 		/* This must be the only snap of this fs. */
3518 		for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3519 		    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3520 			if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3521 			    == 0) {
3522 				return (SET_ERROR(EXDEV));
3523 			}
3524 		}
3525 	}
3526 
3527 	error = dsl_dataset_snapshot(snaps, props, outnvl);
3528 	return (error);
3529 }
3530 
3531 /*
3532  * innvl: "message" -> string
3533  */
3534 static const zfs_ioc_key_t zfs_keys_log_history[] = {
3535 	{"message",	DATA_TYPE_STRING,	0},
3536 };
3537 
3538 /* ARGSUSED */
3539 static int
3540 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3541 {
3542 	char *message;
3543 	spa_t *spa;
3544 	int error;
3545 	char *poolname;
3546 
3547 	/*
3548 	 * The poolname in the ioctl is not set, we get it from the TSD,
3549 	 * which was set at the end of the last successful ioctl that allows
3550 	 * logging.  The secpolicy func already checked that it is set.
3551 	 * Only one log ioctl is allowed after each successful ioctl, so
3552 	 * we clear the TSD here.
3553 	 */
3554 	poolname = tsd_get(zfs_allow_log_key);
3555 	(void) tsd_set(zfs_allow_log_key, NULL);
3556 	error = spa_open(poolname, &spa, FTAG);
3557 	strfree(poolname);
3558 	if (error != 0)
3559 		return (error);
3560 
3561 	message = fnvlist_lookup_string(innvl, "message");
3562 
3563 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3564 		spa_close(spa, FTAG);
3565 		return (SET_ERROR(ENOTSUP));
3566 	}
3567 
3568 	error = spa_history_log(spa, message);
3569 	spa_close(spa, FTAG);
3570 	return (error);
3571 }
3572 
3573 /*
3574  * This ioctl is used to set the bootenv configuration on the current
3575  * pool. This configuration is stored in the second padding area of the label,
3576  * and it is used by the bootloader(s) to store bootloader and/or system
3577  * specific data.
3578  * The data is stored as nvlist data stream, and is protected by
3579  * an embedded checksum.
3580  * The version can have two possible values:
3581  * VB_RAW: nvlist should have key GRUB_ENVMAP, value DATA_TYPE_STRING.
3582  * VB_NVLIST: nvlist with arbitrary <key, value> pairs.
3583  */
3584 static const zfs_ioc_key_t zfs_keys_set_bootenv[] = {
3585 	{"version",	DATA_TYPE_UINT64, 0},
3586 	{"<keys>",	DATA_TYPE_ANY, ZK_OPTIONAL | ZK_WILDCARDLIST},
3587 };
3588 
3589 static int
3590 zfs_ioc_set_bootenv(const char *name, nvlist_t *innvl,
3591     nvlist_t *outnvl __unused)
3592 {
3593 	int error;
3594 	spa_t *spa;
3595 
3596 	if ((error = spa_open(name, &spa, FTAG)) != 0)
3597 		return (error);
3598 	spa_vdev_state_enter(spa, SCL_ALL);
3599 	error = vdev_label_write_bootenv(spa->spa_root_vdev, innvl);
3600 	(void) spa_vdev_state_exit(spa, NULL, 0);
3601 	spa_close(spa, FTAG);
3602 	return (error);
3603 }
3604 
3605 static const zfs_ioc_key_t zfs_keys_get_bootenv[] = {
3606 	/* no nvl keys */
3607 };
3608 
3609 static int
3610 zfs_ioc_get_bootenv(const char *name, nvlist_t *innvl __unused,
3611     nvlist_t *outnvl)
3612 {
3613 	spa_t *spa;
3614 	int error;
3615 
3616 	if ((error = spa_open(name, &spa, FTAG)) != 0)
3617 		return (error);
3618 	spa_vdev_state_enter(spa, SCL_ALL);
3619 	error = vdev_label_read_bootenv(spa->spa_root_vdev, outnvl);
3620 	(void) spa_vdev_state_exit(spa, NULL, 0);
3621 	spa_close(spa, FTAG);
3622 	return (error);
3623 }
3624 
3625 /*
3626  * The dp_config_rwlock must not be held when calling this, because the
3627  * unmount may need to write out data.
3628  *
3629  * This function is best-effort.  Callers must deal gracefully if it
3630  * remains mounted (or is remounted after this call).
3631  *
3632  * Returns 0 if the argument is not a snapshot, or it is not currently a
3633  * filesystem, or we were able to unmount it.  Returns error code otherwise.
3634  */
3635 void
3636 zfs_unmount_snap(const char *snapname)
3637 {
3638 	vfs_t *vfsp = NULL;
3639 	zfsvfs_t *zfsvfs = NULL;
3640 
3641 	if (strchr(snapname, '@') == NULL)
3642 		return;
3643 
3644 	int err = getzfsvfs(snapname, &zfsvfs);
3645 	if (err != 0) {
3646 		ASSERT3P(zfsvfs, ==, NULL);
3647 		return;
3648 	}
3649 	vfsp = zfsvfs->z_vfs;
3650 
3651 	ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3652 
3653 	err = vn_vfswlock(vfsp->vfs_vnodecovered);
3654 	VFS_RELE(vfsp);
3655 	if (err != 0)
3656 		return;
3657 
3658 	/*
3659 	 * Always force the unmount for snapshots.
3660 	 */
3661 	(void) dounmount(vfsp, MS_FORCE, kcred);
3662 }
3663 
3664 /* ARGSUSED */
3665 static int
3666 zfs_unmount_snap_cb(const char *snapname, void *arg)
3667 {
3668 	zfs_unmount_snap(snapname);
3669 	return (0);
3670 }
3671 
3672 /*
3673  * When a clone is destroyed, its origin may also need to be destroyed,
3674  * in which case it must be unmounted.  This routine will do that unmount
3675  * if necessary.
3676  */
3677 void
3678 zfs_destroy_unmount_origin(const char *fsname)
3679 {
3680 	int error;
3681 	objset_t *os;
3682 	dsl_dataset_t *ds;
3683 
3684 	error = dmu_objset_hold(fsname, FTAG, &os);
3685 	if (error != 0)
3686 		return;
3687 	ds = dmu_objset_ds(os);
3688 	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3689 		char originname[ZFS_MAX_DATASET_NAME_LEN];
3690 		dsl_dataset_name(ds->ds_prev, originname);
3691 		dmu_objset_rele(os, FTAG);
3692 		zfs_unmount_snap(originname);
3693 	} else {
3694 		dmu_objset_rele(os, FTAG);
3695 	}
3696 }
3697 
3698 /*
3699  * innvl: {
3700  *     "snaps" -> { snapshot1, snapshot2 }
3701  *     (optional boolean) "defer"
3702  * }
3703  *
3704  * outnvl: snapshot -> error code (int32)
3705  *
3706  */
3707 static const zfs_ioc_key_t zfs_keys_destroy_snaps[] = {
3708 	{"snaps",	DATA_TYPE_NVLIST,	0},
3709 	{"defer",	DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
3710 };
3711 
3712 /* ARGSUSED */
3713 static int
3714 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3715 {
3716 	nvlist_t *snaps;
3717 	nvpair_t *pair;
3718 	boolean_t defer;
3719 
3720 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3721 		return (SET_ERROR(EINVAL));
3722 	defer = nvlist_exists(innvl, "defer");
3723 
3724 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3725 	    pair = nvlist_next_nvpair(snaps, pair)) {
3726 		zfs_unmount_snap(nvpair_name(pair));
3727 	}
3728 
3729 	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3730 }
3731 
3732 /*
3733  * Create bookmarks.  Bookmark names are of the form <fs>#<bmark>.
3734  * All bookmarks must be in the same pool.
3735  *
3736  * innvl: {
3737  *     bookmark1 -> snapshot1, bookmark2 -> snapshot2
3738  * }
3739  *
3740  * outnvl: bookmark -> error code (int32)
3741  *
3742  */
3743 static const zfs_ioc_key_t zfs_keys_bookmark[] = {
3744 	{"<bookmark>...",	DATA_TYPE_STRING,	ZK_WILDCARDLIST},
3745 };
3746 
3747 /* ARGSUSED */
3748 static int
3749 zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3750 {
3751 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3752 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3753 		char *snap_name;
3754 
3755 		/*
3756 		 * Verify the snapshot argument.
3757 		 */
3758 		if (nvpair_value_string(pair, &snap_name) != 0)
3759 			return (SET_ERROR(EINVAL));
3760 
3761 
3762 		/* Verify that the keys (bookmarks) are unique */
3763 		for (nvpair_t *pair2 = nvlist_next_nvpair(innvl, pair);
3764 		    pair2 != NULL; pair2 = nvlist_next_nvpair(innvl, pair2)) {
3765 			if (strcmp(nvpair_name(pair), nvpair_name(pair2)) == 0)
3766 				return (SET_ERROR(EINVAL));
3767 		}
3768 	}
3769 
3770 	return (dsl_bookmark_create(innvl, outnvl));
3771 }
3772 
3773 /*
3774  * innvl: {
3775  *     property 1, property 2, ...
3776  * }
3777  *
3778  * outnvl: {
3779  *     bookmark name 1 -> { property 1, property 2, ... },
3780  *     bookmark name 2 -> { property 1, property 2, ... }
3781  * }
3782  *
3783  */
3784 static const zfs_ioc_key_t zfs_keys_get_bookmarks[] = {
3785 	{"<property>...", DATA_TYPE_BOOLEAN, ZK_WILDCARDLIST | ZK_OPTIONAL},
3786 };
3787 
3788 static int
3789 zfs_ioc_get_bookmarks(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3790 {
3791 	return (dsl_get_bookmarks(fsname, innvl, outnvl));
3792 }
3793 
3794 /*
3795  * innvl: {
3796  *     bookmark name 1, bookmark name 2
3797  * }
3798  *
3799  * outnvl: bookmark -> error code (int32)
3800  *
3801  */
3802 static const zfs_ioc_key_t zfs_keys_destroy_bookmarks[] = {
3803 	{"<bookmark>...",	DATA_TYPE_BOOLEAN,	ZK_WILDCARDLIST},
3804 };
3805 
3806 static int
3807 zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
3808     nvlist_t *outnvl)
3809 {
3810 	int error, poollen;
3811 
3812 	poollen = strlen(poolname);
3813 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3814 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3815 		const char *name = nvpair_name(pair);
3816 		const char *cp = strchr(name, '#');
3817 
3818 		/*
3819 		 * The bookmark name must contain an #, and the part after it
3820 		 * must contain only valid characters.
3821 		 */
3822 		if (cp == NULL ||
3823 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3824 			return (SET_ERROR(EINVAL));
3825 
3826 		/*
3827 		 * The bookmark must be in the specified pool.
3828 		 */
3829 		if (strncmp(name, poolname, poollen) != 0 ||
3830 		    (name[poollen] != '/' && name[poollen] != '#'))
3831 			return (SET_ERROR(EXDEV));
3832 	}
3833 
3834 	error = dsl_bookmark_destroy(innvl, outnvl);
3835 	return (error);
3836 }
3837 
3838 static const zfs_ioc_key_t zfs_keys_channel_program[] = {
3839 	{"program",	DATA_TYPE_STRING,		0},
3840 	{"arg",		DATA_TYPE_ANY,			0},
3841 	{"hidden_args",	DATA_TYPE_ANY,			ZK_OPTIONAL},
3842 	{"sync",	DATA_TYPE_BOOLEAN_VALUE,	ZK_OPTIONAL},
3843 	{"instrlimit",	DATA_TYPE_UINT64,		ZK_OPTIONAL},
3844 	{"memlimit",	DATA_TYPE_UINT64,		ZK_OPTIONAL},
3845 };
3846 
3847 static int
3848 zfs_ioc_channel_program(const char *poolname, nvlist_t *innvl,
3849     nvlist_t *outnvl)
3850 {
3851 	char *program;
3852 	uint64_t instrlimit, memlimit;
3853 	boolean_t sync_flag;
3854 	nvpair_t *nvarg = NULL;
3855 	nvlist_t *hidden_args = NULL;
3856 
3857 	program = fnvlist_lookup_string(innvl, ZCP_ARG_PROGRAM);
3858 	if (0 != nvlist_lookup_boolean_value(innvl, ZCP_ARG_SYNC, &sync_flag)) {
3859 		sync_flag = B_TRUE;
3860 	}
3861 	if (0 != nvlist_lookup_uint64(innvl, ZCP_ARG_INSTRLIMIT, &instrlimit)) {
3862 		instrlimit = ZCP_DEFAULT_INSTRLIMIT;
3863 	}
3864 	if (0 != nvlist_lookup_uint64(innvl, ZCP_ARG_MEMLIMIT, &memlimit)) {
3865 		memlimit = ZCP_DEFAULT_MEMLIMIT;
3866 	}
3867 	nvarg = fnvlist_lookup_nvpair(innvl, ZCP_ARG_ARGLIST);
3868 
3869 	/* hidden args are optional */
3870 	if (nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args) == 0) {
3871 		nvlist_t *argnvl = fnvpair_value_nvlist(nvarg);
3872 		int ret;
3873 
3874 		ret = nvlist_add_nvlist(argnvl, ZPOOL_HIDDEN_ARGS, hidden_args);
3875 		if (ret != 0)
3876 			return (ret);
3877 	}
3878 
3879 	if (instrlimit == 0 || instrlimit > zfs_lua_max_instrlimit)
3880 		return (EINVAL);
3881 	if (memlimit == 0 || memlimit > zfs_lua_max_memlimit)
3882 		return (EINVAL);
3883 
3884 	return (zcp_eval(poolname, program, sync_flag, instrlimit, memlimit,
3885 	    nvarg, outnvl));
3886 }
3887 
3888 /*
3889  * innvl: unused
3890  * outnvl: empty
3891  */
3892 static const zfs_ioc_key_t zfs_keys_pool_checkpoint[] = {
3893 	/* no nvl keys */
3894 };
3895 
3896 /* ARGSUSED */
3897 static int
3898 zfs_ioc_pool_checkpoint(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3899 {
3900 	return (spa_checkpoint(poolname));
3901 }
3902 
3903 /*
3904  * innvl: unused
3905  * outnvl: empty
3906  */
3907 static const zfs_ioc_key_t zfs_keys_pool_discard_checkpoint[] = {
3908 	/* no nvl keys */
3909 };
3910 
3911 /* ARGSUSED */
3912 static int
3913 zfs_ioc_pool_discard_checkpoint(const char *poolname, nvlist_t *innvl,
3914     nvlist_t *outnvl)
3915 {
3916 	return (spa_checkpoint_discard(poolname));
3917 }
3918 
3919 /*
3920  * inputs:
3921  * zc_name		name of dataset to destroy
3922  * zc_defer_destroy	mark for deferred destroy
3923  *
3924  * outputs:		none
3925  */
3926 static int
3927 zfs_ioc_destroy(zfs_cmd_t *zc)
3928 {
3929 	objset_t *os;
3930 	dmu_objset_type_t ost;
3931 	int err;
3932 
3933 	err = dmu_objset_hold(zc->zc_name, FTAG, &os);
3934 	if (err != 0)
3935 		return (err);
3936 	ost = dmu_objset_type(os);
3937 	dmu_objset_rele(os, FTAG);
3938 
3939 	if (ost == DMU_OST_ZFS)
3940 		zfs_unmount_snap(zc->zc_name);
3941 
3942 	if (strchr(zc->zc_name, '@')) {
3943 		err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3944 	} else {
3945 		err = dsl_destroy_head(zc->zc_name);
3946 		if (err == EEXIST) {
3947 			/*
3948 			 * It is possible that the given DS may have
3949 			 * hidden child (%recv) datasets - "leftovers"
3950 			 * resulting from the previously interrupted
3951 			 * 'zfs receive'.
3952 			 *
3953 			 * 6 extra bytes for /%recv
3954 			 */
3955 			char namebuf[ZFS_MAX_DATASET_NAME_LEN + 6];
3956 
3957 			if (snprintf(namebuf, sizeof (namebuf), "%s/%s",
3958 			    zc->zc_name, recv_clone_name) >=
3959 			    sizeof (namebuf))
3960 				return (SET_ERROR(EINVAL));
3961 
3962 			/*
3963 			 * Try to remove the hidden child (%recv) and after
3964 			 * that try to remove the target dataset.
3965 			 * If the hidden child (%recv) does not exist
3966 			 * the original error (EEXIST) will be returned
3967 			 */
3968 			err = dsl_destroy_head(namebuf);
3969 			if (err == 0)
3970 				err = dsl_destroy_head(zc->zc_name);
3971 			else if (err == ENOENT)
3972 				err = SET_ERROR(EEXIST);
3973 		}
3974 	}
3975 	if (ost == DMU_OST_ZVOL && err == 0)
3976 		(void) zvol_remove_minor(zc->zc_name);
3977 	return (err);
3978 }
3979 
3980 /*
3981  * innvl: {
3982  *     "initialize_command" -> POOL_INITIALIZE_{CANCEL|START|SUSPEND} (uint64)
3983  *     "initialize_vdevs": { -> guids to initialize (nvlist)
3984  *         "vdev_path_1": vdev_guid_1, (uint64),
3985  *         "vdev_path_2": vdev_guid_2, (uint64),
3986  *         ...
3987  *     },
3988  * }
3989  *
3990  * outnvl: {
3991  *     "initialize_vdevs": { -> initialization errors (nvlist)
3992  *         "vdev_path_1": errno, see function body for possible errnos (uint64)
3993  *         "vdev_path_2": errno, ... (uint64)
3994  *         ...
3995  *     }
3996  * }
3997  *
3998  * EINVAL is returned for an unknown command or if any of the provided vdev
3999  * guids have be specified with a type other than uint64.
4000  */
4001 static const zfs_ioc_key_t zfs_keys_pool_initialize[] = {
4002 	{ZPOOL_INITIALIZE_COMMAND,	DATA_TYPE_UINT64,	0},
4003 	{ZPOOL_INITIALIZE_VDEVS,	DATA_TYPE_NVLIST,	0}
4004 };
4005 
4006 static int
4007 zfs_ioc_pool_initialize(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
4008 {
4009 	uint64_t cmd_type;
4010 	if (nvlist_lookup_uint64(innvl, ZPOOL_INITIALIZE_COMMAND,
4011 	    &cmd_type) != 0) {
4012 		return (SET_ERROR(EINVAL));
4013 	}
4014 
4015 	if (!(cmd_type == POOL_INITIALIZE_CANCEL ||
4016 	    cmd_type == POOL_INITIALIZE_START ||
4017 	    cmd_type == POOL_INITIALIZE_SUSPEND)) {
4018 		return (SET_ERROR(EINVAL));
4019 	}
4020 
4021 	nvlist_t *vdev_guids;
4022 	if (nvlist_lookup_nvlist(innvl, ZPOOL_INITIALIZE_VDEVS,
4023 	    &vdev_guids) != 0) {
4024 		return (SET_ERROR(EINVAL));
4025 	}
4026 
4027 	for (nvpair_t *pair = nvlist_next_nvpair(vdev_guids, NULL);
4028 	    pair != NULL; pair = nvlist_next_nvpair(vdev_guids, pair)) {
4029 		uint64_t vdev_guid;
4030 		if (nvpair_value_uint64(pair, &vdev_guid) != 0) {
4031 			return (SET_ERROR(EINVAL));
4032 		}
4033 	}
4034 
4035 	spa_t *spa;
4036 	int error = spa_open(poolname, &spa, FTAG);
4037 	if (error != 0)
4038 		return (error);
4039 
4040 	nvlist_t *vdev_errlist = fnvlist_alloc();
4041 	int total_errors = spa_vdev_initialize(spa, vdev_guids, cmd_type,
4042 	    vdev_errlist);
4043 
4044 	if (fnvlist_size(vdev_errlist) > 0) {
4045 		fnvlist_add_nvlist(outnvl, ZPOOL_INITIALIZE_VDEVS,
4046 		    vdev_errlist);
4047 	}
4048 	fnvlist_free(vdev_errlist);
4049 
4050 	spa_close(spa, FTAG);
4051 	return (total_errors > 0 ? EINVAL : 0);
4052 }
4053 
4054 /*
4055  * innvl: {
4056  *     "trim_command" -> POOL_TRIM_{CANCEL|START|SUSPEND} (uint64)
4057  *     "trim_vdevs": { -> guids to TRIM (nvlist)
4058  *         "vdev_path_1": vdev_guid_1, (uint64),
4059  *         "vdev_path_2": vdev_guid_2, (uint64),
4060  *         ...
4061  *     },
4062  *     "trim_rate" -> Target TRIM rate in bytes/sec.
4063  *     "trim_secure" -> Set to request a secure TRIM.
4064  * }
4065  *
4066  * outnvl: {
4067  *     "trim_vdevs": { -> TRIM errors (nvlist)
4068  *         "vdev_path_1": errno, see function body for possible errnos (uint64)
4069  *         "vdev_path_2": errno, ... (uint64)
4070  *         ...
4071  *     }
4072  * }
4073  *
4074  * EINVAL is returned for an unknown command or if any of the provided vdev
4075  * guids have be specified with a type other than uint64.
4076  */
4077 static const zfs_ioc_key_t zfs_keys_pool_trim[] = {
4078 	{ZPOOL_TRIM_COMMAND,	DATA_TYPE_UINT64,		0},
4079 	{ZPOOL_TRIM_VDEVS,	DATA_TYPE_NVLIST,		0},
4080 	{ZPOOL_TRIM_RATE,	DATA_TYPE_UINT64,		ZK_OPTIONAL},
4081 	{ZPOOL_TRIM_SECURE,	DATA_TYPE_BOOLEAN_VALUE,	ZK_OPTIONAL},
4082 };
4083 
4084 static int
4085 zfs_ioc_pool_trim(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
4086 {
4087 	uint64_t cmd_type;
4088 	if (nvlist_lookup_uint64(innvl, ZPOOL_TRIM_COMMAND, &cmd_type) != 0)
4089 		return (SET_ERROR(EINVAL));
4090 
4091 	if (!(cmd_type == POOL_TRIM_CANCEL ||
4092 	    cmd_type == POOL_TRIM_START ||
4093 	    cmd_type == POOL_TRIM_SUSPEND)) {
4094 		return (SET_ERROR(EINVAL));
4095 	}
4096 
4097 	nvlist_t *vdev_guids;
4098 	if (nvlist_lookup_nvlist(innvl, ZPOOL_TRIM_VDEVS, &vdev_guids) != 0)
4099 		return (SET_ERROR(EINVAL));
4100 
4101 	for (nvpair_t *pair = nvlist_next_nvpair(vdev_guids, NULL);
4102 	    pair != NULL; pair = nvlist_next_nvpair(vdev_guids, pair)) {
4103 		uint64_t vdev_guid;
4104 		if (nvpair_value_uint64(pair, &vdev_guid) != 0) {
4105 			return (SET_ERROR(EINVAL));
4106 		}
4107 	}
4108 
4109 	/* Optional, defaults to maximum rate when not provided */
4110 	uint64_t rate;
4111 	if (nvlist_lookup_uint64(innvl, ZPOOL_TRIM_RATE, &rate) != 0)
4112 		rate = 0;
4113 
4114 	/* Optional, defaults to standard TRIM when not provided */
4115 	boolean_t secure;
4116 	if (nvlist_lookup_boolean_value(innvl, ZPOOL_TRIM_SECURE,
4117 	    &secure) != 0) {
4118 		secure = B_FALSE;
4119 	}
4120 
4121 	spa_t *spa;
4122 	int error = spa_open(poolname, &spa, FTAG);
4123 	if (error != 0)
4124 		return (error);
4125 
4126 	nvlist_t *vdev_errlist = fnvlist_alloc();
4127 	int total_errors = spa_vdev_trim(spa, vdev_guids, cmd_type,
4128 	    rate, !!zfs_trim_metaslab_skip, secure, vdev_errlist);
4129 
4130 	if (fnvlist_size(vdev_errlist) > 0)
4131 		fnvlist_add_nvlist(outnvl, ZPOOL_TRIM_VDEVS, vdev_errlist);
4132 
4133 	fnvlist_free(vdev_errlist);
4134 
4135 	spa_close(spa, FTAG);
4136 	return (total_errors > 0 ? EINVAL : 0);
4137 }
4138 
4139 /*
4140  * fsname is name of dataset to rollback (to most recent snapshot)
4141  *
4142  * innvl may contain name of expected target snapshot
4143  *
4144  * outnvl: "target" -> name of most recent snapshot
4145  * }
4146  */
4147 static const zfs_ioc_key_t zfs_keys_rollback[] = {
4148 	{"target",	DATA_TYPE_STRING,	ZK_OPTIONAL},
4149 };
4150 
4151 /* ARGSUSED */
4152 static int
4153 zfs_ioc_rollback(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
4154 {
4155 	zfsvfs_t *zfsvfs;
4156 	char *target = NULL;
4157 	int error;
4158 
4159 	(void) nvlist_lookup_string(innvl, "target", &target);
4160 	if (target != NULL) {
4161 		const char *cp = strchr(target, '@');
4162 
4163 		/*
4164 		 * The snap name must contain an @, and the part after it must
4165 		 * contain only valid characters.
4166 		 */
4167 		if (cp == NULL ||
4168 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
4169 			return (SET_ERROR(EINVAL));
4170 	}
4171 
4172 	if (getzfsvfs(fsname, &zfsvfs) == 0) {
4173 		dsl_dataset_t *ds;
4174 
4175 		ds = dmu_objset_ds(zfsvfs->z_os);
4176 		error = zfs_suspend_fs(zfsvfs);
4177 		if (error == 0) {
4178 			int resume_err;
4179 
4180 			error = dsl_dataset_rollback(fsname, target, zfsvfs,
4181 			    outnvl);
4182 			resume_err = zfs_resume_fs(zfsvfs, ds);
4183 			error = error ? error : resume_err;
4184 		}
4185 		VFS_RELE(zfsvfs->z_vfs);
4186 	} else {
4187 		error = dsl_dataset_rollback(fsname, target, NULL, outnvl);
4188 	}
4189 	return (error);
4190 }
4191 
4192 static int
4193 recursive_unmount(const char *fsname, void *arg)
4194 {
4195 	const char *snapname = arg;
4196 	char fullname[ZFS_MAX_DATASET_NAME_LEN];
4197 
4198 	(void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
4199 	zfs_unmount_snap(fullname);
4200 
4201 	return (0);
4202 }
4203 
4204 /*
4205  * inputs:
4206  * zc_name	old name of dataset
4207  * zc_value	new name of dataset
4208  * zc_cookie	recursive flag (only valid for snapshots)
4209  *
4210  * outputs:	none
4211  */
4212 static int
4213 zfs_ioc_rename(zfs_cmd_t *zc)
4214 {
4215 	objset_t *os;
4216 	dmu_objset_type_t ost;
4217 	boolean_t recursive = zc->zc_cookie & 1;
4218 	char *at;
4219 	int err;
4220 
4221 	/* "zfs rename" from and to ...%recv datasets should both fail */
4222 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
4223 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
4224 	if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0 ||
4225 	    dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
4226 	    strchr(zc->zc_name, '%') || strchr(zc->zc_value, '%'))
4227 		return (SET_ERROR(EINVAL));
4228 
4229 	err = dmu_objset_hold(zc->zc_name, FTAG, &os);
4230 	if (err != 0)
4231 		return (err);
4232 	ost = dmu_objset_type(os);
4233 	dmu_objset_rele(os, FTAG);
4234 
4235 	at = strchr(zc->zc_name, '@');
4236 	if (at != NULL) {
4237 		/* snaps must be in same fs */
4238 		int error;
4239 
4240 		if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
4241 			return (SET_ERROR(EXDEV));
4242 		*at = '\0';
4243 		if (ost == DMU_OST_ZFS) {
4244 			error = dmu_objset_find(zc->zc_name,
4245 			    recursive_unmount, at + 1,
4246 			    recursive ? DS_FIND_CHILDREN : 0);
4247 			if (error != 0) {
4248 				*at = '@';
4249 				return (error);
4250 			}
4251 		}
4252 		error = dsl_dataset_rename_snapshot(zc->zc_name,
4253 		    at + 1, strchr(zc->zc_value, '@') + 1, recursive);
4254 		*at = '@';
4255 
4256 		return (error);
4257 	} else {
4258 		if (ost == DMU_OST_ZVOL)
4259 			(void) zvol_remove_minor(zc->zc_name);
4260 		return (dsl_dir_rename(zc->zc_name, zc->zc_value));
4261 	}
4262 }
4263 
4264 static int
4265 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
4266 {
4267 	const char *propname = nvpair_name(pair);
4268 	boolean_t issnap = (strchr(dsname, '@') != NULL);
4269 	zfs_prop_t prop = zfs_name_to_prop(propname);
4270 	uint64_t intval;
4271 	int err;
4272 
4273 	if (prop == ZPROP_INVAL) {
4274 		if (zfs_prop_user(propname)) {
4275 			if (err = zfs_secpolicy_write_perms(dsname,
4276 			    ZFS_DELEG_PERM_USERPROP, cr))
4277 				return (err);
4278 			return (0);
4279 		}
4280 
4281 		if (!issnap && zfs_prop_userquota(propname)) {
4282 			const char *perm = NULL;
4283 			const char *uq_prefix =
4284 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
4285 			const char *gq_prefix =
4286 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
4287 			const char *uiq_prefix =
4288 			    zfs_userquota_prop_prefixes[ZFS_PROP_USEROBJQUOTA];
4289 			const char *giq_prefix =
4290 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPOBJQUOTA];
4291 			const char *pq_prefix =
4292 			    zfs_userquota_prop_prefixes[ZFS_PROP_PROJECTQUOTA];
4293 			const char *piq_prefix = zfs_userquota_prop_prefixes[\
4294 			    ZFS_PROP_PROJECTOBJQUOTA];
4295 
4296 			if (strncmp(propname, uq_prefix,
4297 			    strlen(uq_prefix)) == 0) {
4298 				perm = ZFS_DELEG_PERM_USERQUOTA;
4299 			} else if (strncmp(propname, uiq_prefix,
4300 			    strlen(uiq_prefix)) == 0) {
4301 				perm = ZFS_DELEG_PERM_USEROBJQUOTA;
4302 			} else if (strncmp(propname, gq_prefix,
4303 			    strlen(gq_prefix)) == 0) {
4304 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
4305 			} else if (strncmp(propname, giq_prefix,
4306 			    strlen(giq_prefix)) == 0) {
4307 				perm = ZFS_DELEG_PERM_GROUPOBJQUOTA;
4308 			} else if (strncmp(propname, pq_prefix,
4309 			    strlen(pq_prefix)) == 0) {
4310 				perm = ZFS_DELEG_PERM_PROJECTQUOTA;
4311 			} else if (strncmp(propname, piq_prefix,
4312 			    strlen(piq_prefix)) == 0) {
4313 				perm = ZFS_DELEG_PERM_PROJECTOBJQUOTA;
4314 			} else {
4315 				/* {USER|GROUP|PROJECT}USED are read-only */
4316 				return (SET_ERROR(EINVAL));
4317 			}
4318 
4319 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
4320 				return (err);
4321 			return (0);
4322 		}
4323 
4324 		return (SET_ERROR(EINVAL));
4325 	}
4326 
4327 	if (issnap)
4328 		return (SET_ERROR(EINVAL));
4329 
4330 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
4331 		/*
4332 		 * dsl_prop_get_all_impl() returns properties in this
4333 		 * format.
4334 		 */
4335 		nvlist_t *attrs;
4336 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
4337 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4338 		    &pair) == 0);
4339 	}
4340 
4341 	/*
4342 	 * Check that this value is valid for this pool version
4343 	 */
4344 	switch (prop) {
4345 	case ZFS_PROP_COMPRESSION:
4346 		/*
4347 		 * If the user specified gzip compression, make sure
4348 		 * the SPA supports it. We ignore any errors here since
4349 		 * we'll catch them later.
4350 		 */
4351 		if (nvpair_value_uint64(pair, &intval) == 0) {
4352 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
4353 			    intval <= ZIO_COMPRESS_GZIP_9 &&
4354 			    zfs_earlier_version(dsname,
4355 			    SPA_VERSION_GZIP_COMPRESSION)) {
4356 				return (SET_ERROR(ENOTSUP));
4357 			}
4358 
4359 			if (intval == ZIO_COMPRESS_ZLE &&
4360 			    zfs_earlier_version(dsname,
4361 			    SPA_VERSION_ZLE_COMPRESSION))
4362 				return (SET_ERROR(ENOTSUP));
4363 
4364 			if (intval == ZIO_COMPRESS_LZ4) {
4365 				spa_t *spa;
4366 
4367 				if ((err = spa_open(dsname, &spa, FTAG)) != 0)
4368 					return (err);
4369 
4370 				if (!spa_feature_is_enabled(spa,
4371 				    SPA_FEATURE_LZ4_COMPRESS)) {
4372 					spa_close(spa, FTAG);
4373 					return (SET_ERROR(ENOTSUP));
4374 				}
4375 				spa_close(spa, FTAG);
4376 			}
4377 
4378 			/*
4379 			 * If this is a bootable dataset then
4380 			 * verify that the compression algorithm
4381 			 * is supported for booting. We must return
4382 			 * something other than ENOTSUP since it
4383 			 * implies a downrev pool version.
4384 			 */
4385 			if (zfs_is_bootfs(dsname) &&
4386 			    !BOOTFS_COMPRESS_VALID(intval)) {
4387 				return (SET_ERROR(ERANGE));
4388 			}
4389 		}
4390 		break;
4391 
4392 	case ZFS_PROP_COPIES:
4393 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
4394 			return (SET_ERROR(ENOTSUP));
4395 		break;
4396 
4397 	case ZFS_PROP_RECORDSIZE:
4398 		/* Record sizes above 128k need the feature to be enabled */
4399 		if (nvpair_value_uint64(pair, &intval) == 0 &&
4400 		    intval > SPA_OLD_MAXBLOCKSIZE) {
4401 			spa_t *spa;
4402 
4403 			/*
4404 			 * We don't allow setting the property above 1MB,
4405 			 * unless the tunable has been changed.
4406 			 */
4407 			if (intval > zfs_max_recordsize ||
4408 			    intval > SPA_MAXBLOCKSIZE)
4409 				return (SET_ERROR(ERANGE));
4410 
4411 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
4412 				return (err);
4413 
4414 			if (!spa_feature_is_enabled(spa,
4415 			    SPA_FEATURE_LARGE_BLOCKS)) {
4416 				spa_close(spa, FTAG);
4417 				return (SET_ERROR(ENOTSUP));
4418 			}
4419 			spa_close(spa, FTAG);
4420 		}
4421 		break;
4422 
4423 	case ZFS_PROP_DNODESIZE:
4424 		/* Dnode sizes above 512 need the feature to be enabled */
4425 		if (nvpair_value_uint64(pair, &intval) == 0 &&
4426 		    intval != ZFS_DNSIZE_LEGACY) {
4427 			spa_t *spa;
4428 
4429 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
4430 				return (err);
4431 
4432 			if (!spa_feature_is_enabled(spa,
4433 			    SPA_FEATURE_LARGE_DNODE)) {
4434 				spa_close(spa, FTAG);
4435 				return (SET_ERROR(ENOTSUP));
4436 			}
4437 			spa_close(spa, FTAG);
4438 		}
4439 		break;
4440 
4441 	case ZFS_PROP_SPECIAL_SMALL_BLOCKS:
4442 		/*
4443 		 * This property could require the allocation classes
4444 		 * feature to be active for setting, however we allow
4445 		 * it so that tests of settable properties succeed.
4446 		 * The CLI will issue a warning in this case.
4447 		 */
4448 		break;
4449 
4450 	case ZFS_PROP_SHARESMB:
4451 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
4452 			return (SET_ERROR(ENOTSUP));
4453 		break;
4454 
4455 	case ZFS_PROP_ACLINHERIT:
4456 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
4457 		    nvpair_value_uint64(pair, &intval) == 0) {
4458 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
4459 			    zfs_earlier_version(dsname,
4460 			    SPA_VERSION_PASSTHROUGH_X))
4461 				return (SET_ERROR(ENOTSUP));
4462 		}
4463 		break;
4464 
4465 	case ZFS_PROP_CHECKSUM:
4466 	case ZFS_PROP_DEDUP:
4467 	{
4468 		spa_feature_t feature;
4469 		spa_t *spa;
4470 
4471 		/* dedup feature version checks */
4472 		if (prop == ZFS_PROP_DEDUP &&
4473 		    zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
4474 			return (SET_ERROR(ENOTSUP));
4475 
4476 		if (nvpair_value_uint64(pair, &intval) != 0)
4477 			return (SET_ERROR(EINVAL));
4478 
4479 		/* check prop value is enabled in features */
4480 		feature = zio_checksum_to_feature(intval & ZIO_CHECKSUM_MASK);
4481 		if (feature == SPA_FEATURE_NONE)
4482 			break;
4483 
4484 		if ((err = spa_open(dsname, &spa, FTAG)) != 0)
4485 			return (err);
4486 
4487 		if (!spa_feature_is_enabled(spa, feature)) {
4488 			spa_close(spa, FTAG);
4489 			return (SET_ERROR(ENOTSUP));
4490 		}
4491 		spa_close(spa, FTAG);
4492 		break;
4493 	}
4494 	}
4495 
4496 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
4497 }
4498 
4499 /*
4500  * Checks for a race condition to make sure we don't increment a feature flag
4501  * multiple times.
4502  */
4503 static int
4504 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
4505 {
4506 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
4507 	spa_feature_t *featurep = arg;
4508 
4509 	if (!spa_feature_is_active(spa, *featurep))
4510 		return (0);
4511 	else
4512 		return (SET_ERROR(EBUSY));
4513 }
4514 
4515 /*
4516  * The callback invoked on feature activation in the sync task caused by
4517  * zfs_prop_activate_feature.
4518  */
4519 static void
4520 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
4521 {
4522 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
4523 	spa_feature_t *featurep = arg;
4524 
4525 	spa_feature_incr(spa, *featurep, tx);
4526 }
4527 
4528 /*
4529  * Activates a feature on a pool in response to a property setting. This
4530  * creates a new sync task which modifies the pool to reflect the feature
4531  * as being active.
4532  */
4533 static int
4534 zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature)
4535 {
4536 	int err;
4537 
4538 	/* EBUSY here indicates that the feature is already active */
4539 	err = dsl_sync_task(spa_name(spa),
4540 	    zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
4541 	    &feature, 2, ZFS_SPACE_CHECK_RESERVED);
4542 
4543 	if (err != 0 && err != EBUSY)
4544 		return (err);
4545 	else
4546 		return (0);
4547 }
4548 
4549 /*
4550  * Removes properties from the given props list that fail permission checks
4551  * needed to clear them and to restore them in case of a receive error. For each
4552  * property, make sure we have both set and inherit permissions.
4553  *
4554  * Returns the first error encountered if any permission checks fail. If the
4555  * caller provides a non-NULL errlist, it also gives the complete list of names
4556  * of all the properties that failed a permission check along with the
4557  * corresponding error numbers. The caller is responsible for freeing the
4558  * returned errlist.
4559  *
4560  * If every property checks out successfully, zero is returned and the list
4561  * pointed at by errlist is NULL.
4562  */
4563 static int
4564 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
4565 {
4566 	zfs_cmd_t *zc;
4567 	nvpair_t *pair, *next_pair;
4568 	nvlist_t *errors;
4569 	int err, rv = 0;
4570 
4571 	if (props == NULL)
4572 		return (0);
4573 
4574 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4575 
4576 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
4577 	(void) strcpy(zc->zc_name, dataset);
4578 	pair = nvlist_next_nvpair(props, NULL);
4579 	while (pair != NULL) {
4580 		next_pair = nvlist_next_nvpair(props, pair);
4581 
4582 		(void) strcpy(zc->zc_value, nvpair_name(pair));
4583 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
4584 		    (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
4585 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
4586 			VERIFY(nvlist_add_int32(errors,
4587 			    zc->zc_value, err) == 0);
4588 		}
4589 		pair = next_pair;
4590 	}
4591 	kmem_free(zc, sizeof (zfs_cmd_t));
4592 
4593 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
4594 		nvlist_free(errors);
4595 		errors = NULL;
4596 	} else {
4597 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
4598 	}
4599 
4600 	if (errlist == NULL)
4601 		nvlist_free(errors);
4602 	else
4603 		*errlist = errors;
4604 
4605 	return (rv);
4606 }
4607 
4608 static boolean_t
4609 propval_equals(nvpair_t *p1, nvpair_t *p2)
4610 {
4611 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
4612 		/* dsl_prop_get_all_impl() format */
4613 		nvlist_t *attrs;
4614 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
4615 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4616 		    &p1) == 0);
4617 	}
4618 
4619 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
4620 		nvlist_t *attrs;
4621 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
4622 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4623 		    &p2) == 0);
4624 	}
4625 
4626 	if (nvpair_type(p1) != nvpair_type(p2))
4627 		return (B_FALSE);
4628 
4629 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
4630 		char *valstr1, *valstr2;
4631 
4632 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
4633 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
4634 		return (strcmp(valstr1, valstr2) == 0);
4635 	} else {
4636 		uint64_t intval1, intval2;
4637 
4638 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
4639 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
4640 		return (intval1 == intval2);
4641 	}
4642 }
4643 
4644 /*
4645  * Remove properties from props if they are not going to change (as determined
4646  * by comparison with origprops). Remove them from origprops as well, since we
4647  * do not need to clear or restore properties that won't change.
4648  */
4649 static void
4650 props_reduce(nvlist_t *props, nvlist_t *origprops)
4651 {
4652 	nvpair_t *pair, *next_pair;
4653 
4654 	if (origprops == NULL)
4655 		return; /* all props need to be received */
4656 
4657 	pair = nvlist_next_nvpair(props, NULL);
4658 	while (pair != NULL) {
4659 		const char *propname = nvpair_name(pair);
4660 		nvpair_t *match;
4661 
4662 		next_pair = nvlist_next_nvpair(props, pair);
4663 
4664 		if ((nvlist_lookup_nvpair(origprops, propname,
4665 		    &match) != 0) || !propval_equals(pair, match))
4666 			goto next; /* need to set received value */
4667 
4668 		/* don't clear the existing received value */
4669 		(void) nvlist_remove_nvpair(origprops, match);
4670 		/* don't bother receiving the property */
4671 		(void) nvlist_remove_nvpair(props, pair);
4672 next:
4673 		pair = next_pair;
4674 	}
4675 }
4676 
4677 /*
4678  * Extract properties that cannot be set PRIOR to the receipt of a dataset.
4679  * For example, refquota cannot be set until after the receipt of a dataset,
4680  * because in replication streams, an older/earlier snapshot may exceed the
4681  * refquota.  We want to receive the older/earlier snapshot, but setting
4682  * refquota pre-receipt will set the dsl's ACTUAL quota, which will prevent
4683  * the older/earlier snapshot from being received (with EDQUOT).
4684  *
4685  * The ZFS test "zfs_receive_011_pos" demonstrates such a scenario.
4686  *
4687  * libzfs will need to be judicious handling errors encountered by props
4688  * extracted by this function.
4689  */
4690 static nvlist_t *
4691 extract_delay_props(nvlist_t *props)
4692 {
4693 	nvlist_t *delayprops;
4694 	nvpair_t *nvp, *tmp;
4695 	static const zfs_prop_t delayable[] = {
4696 		ZFS_PROP_REFQUOTA,
4697 		ZFS_PROP_KEYLOCATION,
4698 		0
4699 	};
4700 	int i;
4701 
4702 	VERIFY(nvlist_alloc(&delayprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4703 
4704 	for (nvp = nvlist_next_nvpair(props, NULL); nvp != NULL;
4705 	    nvp = nvlist_next_nvpair(props, nvp)) {
4706 		/*
4707 		 * strcmp() is safe because zfs_prop_to_name() always returns
4708 		 * a bounded string.
4709 		 */
4710 		for (i = 0; delayable[i] != 0; i++) {
4711 			if (strcmp(zfs_prop_to_name(delayable[i]),
4712 			    nvpair_name(nvp)) == 0) {
4713 				break;
4714 			}
4715 		}
4716 		if (delayable[i] != 0) {
4717 			tmp = nvlist_prev_nvpair(props, nvp);
4718 			VERIFY(nvlist_add_nvpair(delayprops, nvp) == 0);
4719 			VERIFY(nvlist_remove_nvpair(props, nvp) == 0);
4720 			nvp = tmp;
4721 		}
4722 	}
4723 
4724 	if (nvlist_empty(delayprops)) {
4725 		nvlist_free(delayprops);
4726 		delayprops = NULL;
4727 	}
4728 	return (delayprops);
4729 }
4730 
4731 #ifdef	DEBUG
4732 static boolean_t zfs_ioc_recv_inject_err;
4733 #endif
4734 
4735 /*
4736  * nvlist 'errors' is always allocated. It will contain descriptions of
4737  * encountered errors, if any. It's the callers responsibility to free.
4738  */
4739 static int
4740 zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin, nvlist_t *recvprops,
4741     nvlist_t *localprops, nvlist_t *hidden_args, boolean_t force,
4742     boolean_t resumable, int input_fd, dmu_replay_record_t *begin_record,
4743     int cleanup_fd, uint64_t *read_bytes, uint64_t *errflags,
4744     uint64_t *action_handle, nvlist_t **errors)
4745 {
4746 	dmu_recv_cookie_t drc;
4747 	int error = 0;
4748 	int props_error = 0;
4749 	offset_t off;
4750 	nvlist_t *local_delayprops = NULL;
4751 	nvlist_t *recv_delayprops = NULL;
4752 	nvlist_t *origprops = NULL; /* existing properties */
4753 	nvlist_t *origrecvd = NULL; /* existing received properties */
4754 	boolean_t first_recvd_props = B_FALSE;
4755 	file_t *input_fp;
4756 
4757 	*read_bytes = 0;
4758 	*errflags = 0;
4759 	*errors = fnvlist_alloc();
4760 
4761 	input_fp = getf(input_fd);
4762 	if (input_fp == NULL)
4763 		return (SET_ERROR(EBADF));
4764 
4765 	error = dmu_recv_begin(tofs, tosnap, begin_record, force,
4766 	    resumable, localprops, hidden_args, origin, &drc);
4767 	if (error != 0)
4768 		goto out;
4769 
4770 	/*
4771 	 * Set properties before we receive the stream so that they are applied
4772 	 * to the new data. Note that we must call dmu_recv_stream() if
4773 	 * dmu_recv_begin() succeeds.
4774 	 */
4775 	if (recvprops != NULL && !drc.drc_newfs) {
4776 		if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
4777 		    SPA_VERSION_RECVD_PROPS &&
4778 		    !dsl_prop_get_hasrecvd(tofs))
4779 			first_recvd_props = B_TRUE;
4780 
4781 		/*
4782 		 * If new received properties are supplied, they are to
4783 		 * completely replace the existing received properties,
4784 		 * so stash away the existing ones.
4785 		 */
4786 		if (dsl_prop_get_received(tofs, &origrecvd) == 0) {
4787 			nvlist_t *errlist = NULL;
4788 			/*
4789 			 * Don't bother writing a property if its value won't
4790 			 * change (and avoid the unnecessary security checks).
4791 			 *
4792 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
4793 			 * special case where we blow away all local properties
4794 			 * regardless.
4795 			 */
4796 			if (!first_recvd_props)
4797 				props_reduce(recvprops, origrecvd);
4798 			if (zfs_check_clearable(tofs, origrecvd, &errlist) != 0)
4799 				(void) nvlist_merge(*errors, errlist, 0);
4800 			nvlist_free(errlist);
4801 
4802 			if (clear_received_props(tofs, origrecvd,
4803 			    first_recvd_props ? NULL : recvprops) != 0)
4804 				*errflags |= ZPROP_ERR_NOCLEAR;
4805 		} else {
4806 			*errflags |= ZPROP_ERR_NOCLEAR;
4807 		}
4808 	}
4809 
4810 	/*
4811 	 * Stash away existing properties so we can restore them on error unless
4812 	 * we're doing the first receive after SPA_VERSION_RECVD_PROPS, in which
4813 	 * case "origrecvd" will take care of that.
4814 	 */
4815 	if (localprops != NULL && !drc.drc_newfs && !first_recvd_props) {
4816 		objset_t *os;
4817 		if (dmu_objset_hold(tofs, FTAG, &os) == 0) {
4818 			if (dsl_prop_get_all(os, &origprops) != 0) {
4819 				*errflags |= ZPROP_ERR_NOCLEAR;
4820 			}
4821 			dmu_objset_rele(os, FTAG);
4822 		} else {
4823 			*errflags |= ZPROP_ERR_NOCLEAR;
4824 		}
4825 	}
4826 
4827 	if (recvprops != NULL) {
4828 		props_error = dsl_prop_set_hasrecvd(tofs);
4829 
4830 		if (props_error == 0) {
4831 			recv_delayprops = extract_delay_props(recvprops);
4832 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4833 			    recvprops, *errors);
4834 		}
4835 	}
4836 
4837 	if (localprops != NULL) {
4838 		nvlist_t *oprops = fnvlist_alloc();
4839 		nvlist_t *xprops = fnvlist_alloc();
4840 		nvpair_t *nvp = NULL;
4841 
4842 		while ((nvp = nvlist_next_nvpair(localprops, nvp)) != NULL) {
4843 			if (nvpair_type(nvp) == DATA_TYPE_BOOLEAN) {
4844 				/* -x property */
4845 				const char *name = nvpair_name(nvp);
4846 				zfs_prop_t prop = zfs_name_to_prop(name);
4847 				if (prop != ZPROP_INVAL) {
4848 					if (!zfs_prop_inheritable(prop))
4849 						continue;
4850 				} else if (!zfs_prop_user(name))
4851 					continue;
4852 				fnvlist_add_boolean(xprops, name);
4853 			} else {
4854 				/* -o property=value */
4855 				fnvlist_add_nvpair(oprops, nvp);
4856 			}
4857 		}
4858 
4859 		local_delayprops = extract_delay_props(oprops);
4860 		(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_LOCAL,
4861 		    oprops, *errors);
4862 		(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_INHERITED,
4863 		    xprops, *errors);
4864 
4865 		nvlist_free(oprops);
4866 		nvlist_free(xprops);
4867 	}
4868 
4869 	off = input_fp->f_offset;
4870 	error = dmu_recv_stream(&drc, input_fp->f_vnode, &off, cleanup_fd,
4871 	    action_handle);
4872 
4873 	if (error == 0) {
4874 		zfsvfs_t *zfsvfs = NULL;
4875 
4876 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
4877 			/* online recv */
4878 			dsl_dataset_t *ds;
4879 			int end_err;
4880 
4881 			ds = dmu_objset_ds(zfsvfs->z_os);
4882 			error = zfs_suspend_fs(zfsvfs);
4883 			/*
4884 			 * If the suspend fails, then the recv_end will
4885 			 * likely also fail, and clean up after itself.
4886 			 */
4887 			end_err = dmu_recv_end(&drc, zfsvfs);
4888 			if (error == 0)
4889 				error = zfs_resume_fs(zfsvfs, ds);
4890 			error = error ? error : end_err;
4891 			VFS_RELE(zfsvfs->z_vfs);
4892 		} else {
4893 			error = dmu_recv_end(&drc, NULL);
4894 		}
4895 
4896 		/* Set delayed properties now, after we're done receiving. */
4897 		if (recv_delayprops != NULL && error == 0) {
4898 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4899 			    recv_delayprops, *errors);
4900 		}
4901 		if (local_delayprops != NULL && error == 0) {
4902 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_LOCAL,
4903 			    local_delayprops, *errors);
4904 		}
4905 	}
4906 
4907 	/*
4908 	 * Merge delayed props back in with initial props, in case
4909 	 * we're DEBUG and zfs_ioc_recv_inject_err is set (which means
4910 	 * we have to make sure clear_received_props() includes
4911 	 * the delayed properties).
4912 	 *
4913 	 * Since zfs_ioc_recv_inject_err is only in DEBUG kernels,
4914 	 * using ASSERT() will be just like a VERIFY.
4915 	 */
4916 	if (recv_delayprops != NULL) {
4917 		ASSERT(nvlist_merge(recvprops, recv_delayprops, 0) == 0);
4918 		nvlist_free(recv_delayprops);
4919 	}
4920 	if (local_delayprops != NULL) {
4921 		ASSERT(nvlist_merge(localprops, local_delayprops, 0) == 0);
4922 		nvlist_free(local_delayprops);
4923 	}
4924 
4925 	*read_bytes = off - input_fp->f_offset;
4926 	if (VOP_SEEK(input_fp->f_vnode, input_fp->f_offset, &off, NULL) == 0)
4927 		input_fp->f_offset = off;
4928 
4929 #ifdef	DEBUG
4930 	if (zfs_ioc_recv_inject_err) {
4931 		zfs_ioc_recv_inject_err = B_FALSE;
4932 		error = 1;
4933 	}
4934 #endif
4935 
4936 	/*
4937 	 * On error, restore the original props.
4938 	 */
4939 	if (error != 0 && recvprops != NULL && !drc.drc_newfs) {
4940 		if (clear_received_props(tofs, recvprops, NULL) != 0) {
4941 			/*
4942 			 * We failed to clear the received properties.
4943 			 * Since we may have left a $recvd value on the
4944 			 * system, we can't clear the $hasrecvd flag.
4945 			 */
4946 			*errflags |= ZPROP_ERR_NORESTORE;
4947 		} else if (first_recvd_props) {
4948 			dsl_prop_unset_hasrecvd(tofs);
4949 		}
4950 
4951 		if (origrecvd == NULL && !drc.drc_newfs) {
4952 			/* We failed to stash the original properties. */
4953 			*errflags |= ZPROP_ERR_NORESTORE;
4954 		}
4955 
4956 		/*
4957 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
4958 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4959 		 * explicitly if we're restoring local properties cleared in the
4960 		 * first new-style receive.
4961 		 */
4962 		if (origrecvd != NULL &&
4963 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4964 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4965 		    origrecvd, NULL) != 0) {
4966 			/*
4967 			 * We stashed the original properties but failed to
4968 			 * restore them.
4969 			 */
4970 			*errflags |= ZPROP_ERR_NORESTORE;
4971 		}
4972 	}
4973 	if (error != 0 && localprops != NULL && !drc.drc_newfs &&
4974 	    !first_recvd_props) {
4975 		nvlist_t *setprops;
4976 		nvlist_t *inheritprops;
4977 		nvpair_t *nvp;
4978 
4979 		if (origprops == NULL) {
4980 			/* We failed to stash the original properties. */
4981 			*errflags |= ZPROP_ERR_NORESTORE;
4982 			goto out;
4983 		}
4984 
4985 		/* Restore original props */
4986 		setprops = fnvlist_alloc();
4987 		inheritprops = fnvlist_alloc();
4988 		nvp = NULL;
4989 		while ((nvp = nvlist_next_nvpair(localprops, nvp)) != NULL) {
4990 			const char *name = nvpair_name(nvp);
4991 			const char *source;
4992 			nvlist_t *attrs;
4993 
4994 			if (!nvlist_exists(origprops, name)) {
4995 				/*
4996 				 * Property was not present or was explicitly
4997 				 * inherited before the receive, restore this.
4998 				 */
4999 				fnvlist_add_boolean(inheritprops, name);
5000 				continue;
5001 			}
5002 			attrs = fnvlist_lookup_nvlist(origprops, name);
5003 			source = fnvlist_lookup_string(attrs, ZPROP_SOURCE);
5004 
5005 			/* Skip received properties */
5006 			if (strcmp(source, ZPROP_SOURCE_VAL_RECVD) == 0)
5007 				continue;
5008 
5009 			if (strcmp(source, tofs) == 0) {
5010 				/* Property was locally set */
5011 				fnvlist_add_nvlist(setprops, name, attrs);
5012 			} else {
5013 				/* Property was implicitly inherited */
5014 				fnvlist_add_boolean(inheritprops, name);
5015 			}
5016 		}
5017 
5018 		if (zfs_set_prop_nvlist(tofs, ZPROP_SRC_LOCAL, setprops,
5019 		    NULL) != 0)
5020 			*errflags |= ZPROP_ERR_NORESTORE;
5021 		if (zfs_set_prop_nvlist(tofs, ZPROP_SRC_INHERITED, inheritprops,
5022 		    NULL) != 0)
5023 			*errflags |= ZPROP_ERR_NORESTORE;
5024 
5025 		nvlist_free(setprops);
5026 		nvlist_free(inheritprops);
5027 	}
5028 out:
5029 	releasef(input_fd);
5030 	nvlist_free(origrecvd);
5031 	nvlist_free(origprops);
5032 
5033 	if (error == 0)
5034 		error = props_error;
5035 
5036 	return (error);
5037 }
5038 
5039 /*
5040  * inputs:
5041  * zc_name		name of containing filesystem
5042  * zc_nvlist_src{_size}	nvlist of received properties to apply
5043  * zc_nvlist_conf{_size} nvlist of local properties to apply
5044  * zc_history_offset{_len} nvlist of hidden args { "wkeydata" -> value }
5045  * zc_value		name of snapshot to create
5046  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
5047  * zc_cookie		file descriptor to recv from
5048  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
5049  * zc_guid		force flag
5050  * zc_cleanup_fd	cleanup-on-exit file descriptor
5051  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
5052  * zc_resumable		if data is incomplete assume sender will resume
5053  *
5054  * outputs:
5055  * zc_cookie		number of bytes read
5056  * zc_nvlist_dst{_size} error for each unapplied received property
5057  * zc_obj		zprop_errflags_t
5058  * zc_action_handle	handle for this guid/ds mapping
5059  */
5060 static int
5061 zfs_ioc_recv(zfs_cmd_t *zc)
5062 {
5063 	dmu_replay_record_t begin_record;
5064 	nvlist_t *errors = NULL;
5065 	nvlist_t *recvdprops = NULL;
5066 	nvlist_t *localprops = NULL;
5067 	nvlist_t *hidden_args = NULL;
5068 	char *origin = NULL;
5069 	char *tosnap;
5070 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
5071 	int error = 0;
5072 
5073 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
5074 	    strchr(zc->zc_value, '@') == NULL ||
5075 	    strchr(zc->zc_value, '%'))
5076 		return (SET_ERROR(EINVAL));
5077 
5078 	(void) strlcpy(tofs, zc->zc_value, sizeof (tofs));
5079 	tosnap = strchr(tofs, '@');
5080 	*tosnap++ = '\0';
5081 
5082 	if (zc->zc_nvlist_src != 0 &&
5083 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
5084 	    zc->zc_iflags, &recvdprops)) != 0)
5085 		return (error);
5086 
5087 	if (zc->zc_nvlist_conf != 0 &&
5088 	    (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
5089 	    zc->zc_iflags, &localprops)) != 0)
5090 		return (error);
5091 
5092 	if (zc->zc_history_offset != 0 &&
5093 	    (error = get_nvlist(zc->zc_history_offset, zc->zc_history_len,
5094 	    zc->zc_iflags, &hidden_args)) != 0)
5095 		return (error);
5096 
5097 	if (zc->zc_string[0])
5098 		origin = zc->zc_string;
5099 
5100 	begin_record.drr_type = DRR_BEGIN;
5101 	begin_record.drr_payloadlen = zc->zc_begin_record.drr_payloadlen;
5102 	begin_record.drr_u.drr_begin = zc->zc_begin_record.drr_u.drr_begin;
5103 
5104 	error = zfs_ioc_recv_impl(tofs, tosnap, origin, recvdprops, localprops,
5105 	    hidden_args, zc->zc_guid, zc->zc_resumable, zc->zc_cookie,
5106 	    &begin_record, zc->zc_cleanup_fd, &zc->zc_cookie, &zc->zc_obj,
5107 	    &zc->zc_action_handle, &errors);
5108 	nvlist_free(recvdprops);
5109 	nvlist_free(localprops);
5110 
5111 	/*
5112 	 * Now that all props, initial and delayed, are set, report the prop
5113 	 * errors to the caller.
5114 	 */
5115 	if (zc->zc_nvlist_dst_size != 0 && errors != NULL &&
5116 	    (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
5117 	    put_nvlist(zc, errors) != 0)) {
5118 		/*
5119 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
5120 		 * size or supplied an invalid address.
5121 		 */
5122 		error = SET_ERROR(EINVAL);
5123 	}
5124 
5125 	nvlist_free(errors);
5126 
5127 	return (error);
5128 }
5129 
5130 /*
5131  * inputs:
5132  * zc_name	name of snapshot to send
5133  * zc_cookie	file descriptor to send stream to
5134  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
5135  * zc_sendobj	objsetid of snapshot to send
5136  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
5137  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
5138  *		output size in zc_objset_type.
5139  * zc_flags	lzc_send_flags
5140  *
5141  * outputs:
5142  * zc_objset_type	estimated size, if zc_guid is set
5143  */
5144 static int
5145 zfs_ioc_send(zfs_cmd_t *zc)
5146 {
5147 	int error;
5148 	offset_t off;
5149 	boolean_t estimate = (zc->zc_guid != 0);
5150 	boolean_t embedok = (zc->zc_flags & 0x1);
5151 	boolean_t large_block_ok = (zc->zc_flags & 0x2);
5152 	boolean_t compressok = (zc->zc_flags & 0x4);
5153 	boolean_t rawok = (zc->zc_flags & 0x8);
5154 
5155 	if (zc->zc_obj != 0) {
5156 		dsl_pool_t *dp;
5157 		dsl_dataset_t *tosnap;
5158 
5159 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5160 		if (error != 0)
5161 			return (error);
5162 
5163 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
5164 		if (error != 0) {
5165 			dsl_pool_rele(dp, FTAG);
5166 			return (error);
5167 		}
5168 
5169 		if (dsl_dir_is_clone(tosnap->ds_dir))
5170 			zc->zc_fromobj =
5171 			    dsl_dir_phys(tosnap->ds_dir)->dd_origin_obj;
5172 		dsl_dataset_rele(tosnap, FTAG);
5173 		dsl_pool_rele(dp, FTAG);
5174 	}
5175 
5176 	if (estimate) {
5177 		dsl_pool_t *dp;
5178 		dsl_dataset_t *tosnap;
5179 		dsl_dataset_t *fromsnap = NULL;
5180 
5181 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5182 		if (error != 0)
5183 			return (error);
5184 
5185 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj,
5186 		    FTAG, &tosnap);
5187 		if (error != 0) {
5188 			dsl_pool_rele(dp, FTAG);
5189 			return (error);
5190 		}
5191 
5192 		if (zc->zc_fromobj != 0) {
5193 			error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
5194 			    FTAG, &fromsnap);
5195 			if (error != 0) {
5196 				dsl_dataset_rele(tosnap, FTAG);
5197 				dsl_pool_rele(dp, FTAG);
5198 				return (error);
5199 			}
5200 		}
5201 
5202 		error = dmu_send_estimate(tosnap, fromsnap, compressok || rawok,
5203 		    &zc->zc_objset_type);
5204 
5205 		if (fromsnap != NULL)
5206 			dsl_dataset_rele(fromsnap, FTAG);
5207 		dsl_dataset_rele(tosnap, FTAG);
5208 		dsl_pool_rele(dp, FTAG);
5209 	} else {
5210 		file_t *fp = getf(zc->zc_cookie);
5211 		if (fp == NULL)
5212 			return (SET_ERROR(EBADF));
5213 
5214 		off = fp->f_offset;
5215 		error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
5216 		    zc->zc_fromobj, embedok, large_block_ok, compressok, rawok,
5217 		    zc->zc_cookie, fp->f_vnode, &off);
5218 
5219 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5220 			fp->f_offset = off;
5221 		releasef(zc->zc_cookie);
5222 	}
5223 	return (error);
5224 }
5225 
5226 /*
5227  * inputs:
5228  * zc_name	name of snapshot on which to report progress
5229  * zc_cookie	file descriptor of send stream
5230  *
5231  * outputs:
5232  * zc_cookie	number of bytes written in send stream thus far
5233  */
5234 static int
5235 zfs_ioc_send_progress(zfs_cmd_t *zc)
5236 {
5237 	dsl_pool_t *dp;
5238 	dsl_dataset_t *ds;
5239 	dmu_sendarg_t *dsp = NULL;
5240 	int error;
5241 
5242 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5243 	if (error != 0)
5244 		return (error);
5245 
5246 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
5247 	if (error != 0) {
5248 		dsl_pool_rele(dp, FTAG);
5249 		return (error);
5250 	}
5251 
5252 	mutex_enter(&ds->ds_sendstream_lock);
5253 
5254 	/*
5255 	 * Iterate over all the send streams currently active on this dataset.
5256 	 * If there's one which matches the specified file descriptor _and_ the
5257 	 * stream was started by the current process, return the progress of
5258 	 * that stream.
5259 	 */
5260 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
5261 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
5262 		if (dsp->dsa_outfd == zc->zc_cookie &&
5263 		    dsp->dsa_proc == curproc)
5264 			break;
5265 	}
5266 
5267 	if (dsp != NULL)
5268 		zc->zc_cookie = *(dsp->dsa_off);
5269 	else
5270 		error = SET_ERROR(ENOENT);
5271 
5272 	mutex_exit(&ds->ds_sendstream_lock);
5273 	dsl_dataset_rele(ds, FTAG);
5274 	dsl_pool_rele(dp, FTAG);
5275 	return (error);
5276 }
5277 
5278 static int
5279 zfs_ioc_inject_fault(zfs_cmd_t *zc)
5280 {
5281 	int id, error;
5282 
5283 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
5284 	    &zc->zc_inject_record);
5285 
5286 	if (error == 0)
5287 		zc->zc_guid = (uint64_t)id;
5288 
5289 	return (error);
5290 }
5291 
5292 static int
5293 zfs_ioc_clear_fault(zfs_cmd_t *zc)
5294 {
5295 	return (zio_clear_fault((int)zc->zc_guid));
5296 }
5297 
5298 static int
5299 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
5300 {
5301 	int id = (int)zc->zc_guid;
5302 	int error;
5303 
5304 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
5305 	    &zc->zc_inject_record);
5306 
5307 	zc->zc_guid = id;
5308 
5309 	return (error);
5310 }
5311 
5312 static int
5313 zfs_ioc_error_log(zfs_cmd_t *zc)
5314 {
5315 	spa_t *spa;
5316 	int error;
5317 	size_t count = (size_t)zc->zc_nvlist_dst_size;
5318 
5319 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
5320 		return (error);
5321 
5322 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
5323 	    &count);
5324 	if (error == 0)
5325 		zc->zc_nvlist_dst_size = count;
5326 	else
5327 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
5328 
5329 	spa_close(spa, FTAG);
5330 
5331 	return (error);
5332 }
5333 
5334 static int
5335 zfs_ioc_clear(zfs_cmd_t *zc)
5336 {
5337 	spa_t *spa;
5338 	vdev_t *vd;
5339 	int error;
5340 
5341 	/*
5342 	 * On zpool clear we also fix up missing slogs
5343 	 */
5344 	mutex_enter(&spa_namespace_lock);
5345 	spa = spa_lookup(zc->zc_name);
5346 	if (spa == NULL) {
5347 		mutex_exit(&spa_namespace_lock);
5348 		return (SET_ERROR(EIO));
5349 	}
5350 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
5351 		/* we need to let spa_open/spa_load clear the chains */
5352 		spa_set_log_state(spa, SPA_LOG_CLEAR);
5353 	}
5354 	spa->spa_last_open_failed = 0;
5355 	mutex_exit(&spa_namespace_lock);
5356 
5357 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
5358 		error = spa_open(zc->zc_name, &spa, FTAG);
5359 	} else {
5360 		nvlist_t *policy;
5361 		nvlist_t *config = NULL;
5362 
5363 		if (zc->zc_nvlist_src == 0)
5364 			return (SET_ERROR(EINVAL));
5365 
5366 		if ((error = get_nvlist(zc->zc_nvlist_src,
5367 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
5368 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
5369 			    policy, &config);
5370 			if (config != NULL) {
5371 				int err;
5372 
5373 				if ((err = put_nvlist(zc, config)) != 0)
5374 					error = err;
5375 				nvlist_free(config);
5376 			}
5377 			nvlist_free(policy);
5378 		}
5379 	}
5380 
5381 	if (error != 0)
5382 		return (error);
5383 
5384 	/*
5385 	 * If multihost is enabled, resuming I/O is unsafe as another
5386 	 * host may have imported the pool.
5387 	 */
5388 	if (spa_multihost(spa) && spa_suspended(spa))
5389 		return (SET_ERROR(EINVAL));
5390 
5391 	spa_vdev_state_enter(spa, SCL_NONE);
5392 
5393 	if (zc->zc_guid == 0) {
5394 		vd = NULL;
5395 	} else {
5396 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
5397 		if (vd == NULL) {
5398 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
5399 			spa_close(spa, FTAG);
5400 			return (SET_ERROR(ENODEV));
5401 		}
5402 	}
5403 
5404 	vdev_clear(spa, vd);
5405 
5406 	(void) spa_vdev_state_exit(spa, NULL, 0);
5407 
5408 	/*
5409 	 * Resume any suspended I/Os.
5410 	 */
5411 	if (zio_resume(spa) != 0)
5412 		error = SET_ERROR(EIO);
5413 
5414 	spa_close(spa, FTAG);
5415 
5416 	return (error);
5417 }
5418 
5419 static int
5420 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
5421 {
5422 	spa_t *spa;
5423 	int error;
5424 
5425 	error = spa_open(zc->zc_name, &spa, FTAG);
5426 	if (error != 0)
5427 		return (error);
5428 
5429 	spa_vdev_state_enter(spa, SCL_NONE);
5430 
5431 	/*
5432 	 * If a resilver is already in progress then set the
5433 	 * spa_scrub_reopen flag to B_TRUE so that we don't restart
5434 	 * the scan as a side effect of the reopen. Otherwise, let
5435 	 * vdev_open() decided if a resilver is required.
5436 	 */
5437 	spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
5438 	vdev_reopen(spa->spa_root_vdev);
5439 	spa->spa_scrub_reopen = B_FALSE;
5440 
5441 	(void) spa_vdev_state_exit(spa, NULL, 0);
5442 	spa_close(spa, FTAG);
5443 	return (0);
5444 }
5445 /*
5446  * inputs:
5447  * zc_name	name of filesystem
5448  *
5449  * outputs:
5450  * zc_string	name of conflicting snapshot, if there is one
5451  */
5452 static int
5453 zfs_ioc_promote(zfs_cmd_t *zc)
5454 {
5455 	dsl_pool_t *dp;
5456 	dsl_dataset_t *ds, *ods;
5457 	char origin[ZFS_MAX_DATASET_NAME_LEN];
5458 	char *cp;
5459 	int error;
5460 
5461 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
5462 	if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0 ||
5463 	    strchr(zc->zc_name, '%'))
5464 		return (SET_ERROR(EINVAL));
5465 
5466 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5467 	if (error != 0)
5468 		return (error);
5469 
5470 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
5471 	if (error != 0) {
5472 		dsl_pool_rele(dp, FTAG);
5473 		return (error);
5474 	}
5475 
5476 	if (!dsl_dir_is_clone(ds->ds_dir)) {
5477 		dsl_dataset_rele(ds, FTAG);
5478 		dsl_pool_rele(dp, FTAG);
5479 		return (SET_ERROR(EINVAL));
5480 	}
5481 
5482 	error = dsl_dataset_hold_obj(dp,
5483 	    dsl_dir_phys(ds->ds_dir)->dd_origin_obj, FTAG, &ods);
5484 	if (error != 0) {
5485 		dsl_dataset_rele(ds, FTAG);
5486 		dsl_pool_rele(dp, FTAG);
5487 		return (error);
5488 	}
5489 
5490 	dsl_dataset_name(ods, origin);
5491 	dsl_dataset_rele(ods, FTAG);
5492 	dsl_dataset_rele(ds, FTAG);
5493 	dsl_pool_rele(dp, FTAG);
5494 
5495 	/*
5496 	 * We don't need to unmount *all* the origin fs's snapshots, but
5497 	 * it's easier.
5498 	 */
5499 	cp = strchr(origin, '@');
5500 	if (cp)
5501 		*cp = '\0';
5502 	(void) dmu_objset_find(origin,
5503 	    zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
5504 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
5505 }
5506 
5507 /*
5508  * Retrieve a single {user|group|project}{used|quota}@... property.
5509  *
5510  * inputs:
5511  * zc_name	name of filesystem
5512  * zc_objset_type zfs_userquota_prop_t
5513  * zc_value	domain name (eg. "S-1-234-567-89")
5514  * zc_guid	RID/UID/GID
5515  *
5516  * outputs:
5517  * zc_cookie	property value
5518  */
5519 static int
5520 zfs_ioc_userspace_one(zfs_cmd_t *zc)
5521 {
5522 	zfsvfs_t *zfsvfs;
5523 	int error;
5524 
5525 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
5526 		return (SET_ERROR(EINVAL));
5527 
5528 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
5529 	if (error != 0)
5530 		return (error);
5531 
5532 	error = zfs_userspace_one(zfsvfs,
5533 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
5534 	zfsvfs_rele(zfsvfs, FTAG);
5535 
5536 	return (error);
5537 }
5538 
5539 /*
5540  * inputs:
5541  * zc_name		name of filesystem
5542  * zc_cookie		zap cursor
5543  * zc_objset_type	zfs_userquota_prop_t
5544  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
5545  *
5546  * outputs:
5547  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
5548  * zc_cookie	zap cursor
5549  */
5550 static int
5551 zfs_ioc_userspace_many(zfs_cmd_t *zc)
5552 {
5553 	zfsvfs_t *zfsvfs;
5554 	int bufsize = zc->zc_nvlist_dst_size;
5555 
5556 	if (bufsize <= 0)
5557 		return (SET_ERROR(ENOMEM));
5558 
5559 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
5560 	if (error != 0)
5561 		return (error);
5562 
5563 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
5564 
5565 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
5566 	    buf, &zc->zc_nvlist_dst_size);
5567 
5568 	if (error == 0) {
5569 		error = xcopyout(buf,
5570 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
5571 		    zc->zc_nvlist_dst_size);
5572 	}
5573 	kmem_free(buf, bufsize);
5574 	zfsvfs_rele(zfsvfs, FTAG);
5575 
5576 	return (error);
5577 }
5578 
5579 /*
5580  * inputs:
5581  * zc_name		name of filesystem
5582  *
5583  * outputs:
5584  * none
5585  */
5586 static int
5587 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
5588 {
5589 	objset_t *os;
5590 	int error = 0;
5591 	zfsvfs_t *zfsvfs;
5592 
5593 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
5594 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
5595 			/*
5596 			 * If userused is not enabled, it may be because the
5597 			 * objset needs to be closed & reopened (to grow the
5598 			 * objset_phys_t).  Suspend/resume the fs will do that.
5599 			 */
5600 			dsl_dataset_t *ds, *newds;
5601 
5602 			ds = dmu_objset_ds(zfsvfs->z_os);
5603 			error = zfs_suspend_fs(zfsvfs);
5604 			if (error == 0) {
5605 				dmu_objset_refresh_ownership(ds, &newds,
5606 				    B_TRUE, zfsvfs);
5607 				error = zfs_resume_fs(zfsvfs, newds);
5608 			}
5609 		}
5610 		if (error == 0)
5611 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
5612 		VFS_RELE(zfsvfs->z_vfs);
5613 	} else {
5614 		/* XXX kind of reading contents without owning */
5615 		error = dmu_objset_hold_flags(zc->zc_name, B_TRUE, FTAG, &os);
5616 		if (error != 0)
5617 			return (error);
5618 
5619 		error = dmu_objset_userspace_upgrade(os);
5620 		dmu_objset_rele_flags(os, B_TRUE, FTAG);
5621 	}
5622 
5623 	return (error);
5624 }
5625 
5626 /*
5627  * inputs:
5628  * zc_name		name of filesystem
5629  *
5630  * outputs:
5631  * none
5632  */
5633 static int
5634 zfs_ioc_id_quota_upgrade(zfs_cmd_t *zc)
5635 {
5636 	objset_t *os;
5637 	int error;
5638 
5639 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
5640 	if (error != 0)
5641 		return (error);
5642 
5643 	if (dmu_objset_userobjspace_upgradable(os) ||
5644 	    dmu_objset_projectquota_upgradable(os)) {
5645 		mutex_enter(&os->os_upgrade_lock);
5646 		if (os->os_upgrade_id == 0) {
5647 			/* clear potential error code and retry */
5648 			os->os_upgrade_status = 0;
5649 			mutex_exit(&os->os_upgrade_lock);
5650 
5651 			dmu_objset_id_quota_upgrade(os);
5652 		} else {
5653 			mutex_exit(&os->os_upgrade_lock);
5654 		}
5655 
5656 		dsl_pool_rele(dmu_objset_pool(os), FTAG);
5657 
5658 		taskq_wait_id(os->os_spa->spa_upgrade_taskq, os->os_upgrade_id);
5659 		error = os->os_upgrade_status;
5660 	} else {
5661 		dsl_pool_rele(dmu_objset_pool(os), FTAG);
5662 	}
5663 
5664 	dsl_dataset_rele(dmu_objset_ds(os), FTAG);
5665 
5666 	return (error);
5667 }
5668 
5669 /*
5670  * We don't want to have a hard dependency
5671  * against some special symbols in sharefs
5672  * nfs, and smbsrv.  Determine them if needed when
5673  * the first file system is shared.
5674  * Neither sharefs, nfs or smbsrv are unloadable modules.
5675  */
5676 int (*znfsexport_fs)(void *arg);
5677 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
5678 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
5679 
5680 int zfs_nfsshare_inited;
5681 int zfs_smbshare_inited;
5682 
5683 ddi_modhandle_t nfs_mod;
5684 ddi_modhandle_t sharefs_mod;
5685 ddi_modhandle_t smbsrv_mod;
5686 kmutex_t zfs_share_lock;
5687 
5688 static int
5689 zfs_init_sharefs()
5690 {
5691 	int error;
5692 
5693 	ASSERT(MUTEX_HELD(&zfs_share_lock));
5694 	/* Both NFS and SMB shares also require sharetab support. */
5695 	if (sharefs_mod == NULL && ((sharefs_mod =
5696 	    ddi_modopen("fs/sharefs",
5697 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
5698 		return (SET_ERROR(ENOSYS));
5699 	}
5700 	if (zshare_fs == NULL && ((zshare_fs =
5701 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
5702 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
5703 		return (SET_ERROR(ENOSYS));
5704 	}
5705 	return (0);
5706 }
5707 
5708 static int
5709 zfs_ioc_share(zfs_cmd_t *zc)
5710 {
5711 	int error;
5712 	int opcode;
5713 
5714 	switch (zc->zc_share.z_sharetype) {
5715 	case ZFS_SHARE_NFS:
5716 	case ZFS_UNSHARE_NFS:
5717 		if (zfs_nfsshare_inited == 0) {
5718 			mutex_enter(&zfs_share_lock);
5719 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
5720 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
5721 				mutex_exit(&zfs_share_lock);
5722 				return (SET_ERROR(ENOSYS));
5723 			}
5724 			if (znfsexport_fs == NULL &&
5725 			    ((znfsexport_fs = (int (*)(void *))
5726 			    ddi_modsym(nfs_mod,
5727 			    "nfs_export", &error)) == NULL)) {
5728 				mutex_exit(&zfs_share_lock);
5729 				return (SET_ERROR(ENOSYS));
5730 			}
5731 			error = zfs_init_sharefs();
5732 			if (error != 0) {
5733 				mutex_exit(&zfs_share_lock);
5734 				return (SET_ERROR(ENOSYS));
5735 			}
5736 			zfs_nfsshare_inited = 1;
5737 			mutex_exit(&zfs_share_lock);
5738 		}
5739 		break;
5740 	case ZFS_SHARE_SMB:
5741 	case ZFS_UNSHARE_SMB:
5742 		if (zfs_smbshare_inited == 0) {
5743 			mutex_enter(&zfs_share_lock);
5744 			if (smbsrv_mod == NULL && ((smbsrv_mod =
5745 			    ddi_modopen("drv/smbsrv",
5746 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
5747 				mutex_exit(&zfs_share_lock);
5748 				return (SET_ERROR(ENOSYS));
5749 			}
5750 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
5751 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
5752 			    "smb_server_share", &error)) == NULL)) {
5753 				mutex_exit(&zfs_share_lock);
5754 				return (SET_ERROR(ENOSYS));
5755 			}
5756 			error = zfs_init_sharefs();
5757 			if (error != 0) {
5758 				mutex_exit(&zfs_share_lock);
5759 				return (SET_ERROR(ENOSYS));
5760 			}
5761 			zfs_smbshare_inited = 1;
5762 			mutex_exit(&zfs_share_lock);
5763 		}
5764 		break;
5765 	default:
5766 		return (SET_ERROR(EINVAL));
5767 	}
5768 
5769 	switch (zc->zc_share.z_sharetype) {
5770 	case ZFS_SHARE_NFS:
5771 	case ZFS_UNSHARE_NFS:
5772 		if (error =
5773 		    znfsexport_fs((void *)
5774 		    (uintptr_t)zc->zc_share.z_exportdata))
5775 			return (error);
5776 		break;
5777 	case ZFS_SHARE_SMB:
5778 	case ZFS_UNSHARE_SMB:
5779 		if (error = zsmbexport_fs((void *)
5780 		    (uintptr_t)zc->zc_share.z_exportdata,
5781 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
5782 		    B_TRUE: B_FALSE)) {
5783 			return (error);
5784 		}
5785 		break;
5786 	}
5787 
5788 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
5789 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
5790 	    SHAREFS_ADD : SHAREFS_REMOVE;
5791 
5792 	/*
5793 	 * Add or remove share from sharetab
5794 	 */
5795 	error = zshare_fs(opcode,
5796 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
5797 	    zc->zc_share.z_sharemax);
5798 
5799 	return (error);
5800 
5801 }
5802 
5803 ace_t full_access[] = {
5804 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
5805 };
5806 
5807 /*
5808  * inputs:
5809  * zc_name		name of containing filesystem
5810  * zc_obj		object # beyond which we want next in-use object #
5811  *
5812  * outputs:
5813  * zc_obj		next in-use object #
5814  */
5815 static int
5816 zfs_ioc_next_obj(zfs_cmd_t *zc)
5817 {
5818 	objset_t *os = NULL;
5819 	int error;
5820 
5821 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
5822 	if (error != 0)
5823 		return (error);
5824 
5825 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
5826 	    dsl_dataset_phys(os->os_dsl_dataset)->ds_prev_snap_txg);
5827 
5828 	dmu_objset_rele(os, FTAG);
5829 	return (error);
5830 }
5831 
5832 /*
5833  * inputs:
5834  * zc_name		name of filesystem
5835  * zc_value		prefix name for snapshot
5836  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
5837  *
5838  * outputs:
5839  * zc_value		short name of new snapshot
5840  */
5841 static int
5842 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
5843 {
5844 	char *snap_name;
5845 	char *hold_name;
5846 	int error;
5847 	minor_t minor;
5848 
5849 	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
5850 	if (error != 0)
5851 		return (error);
5852 
5853 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
5854 	    (u_longlong_t)ddi_get_lbolt64());
5855 	hold_name = kmem_asprintf("%%%s", zc->zc_value);
5856 
5857 	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
5858 	    hold_name);
5859 	if (error == 0)
5860 		(void) strcpy(zc->zc_value, snap_name);
5861 	strfree(snap_name);
5862 	strfree(hold_name);
5863 	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
5864 	return (error);
5865 }
5866 
5867 /*
5868  * inputs:
5869  * zc_name		name of "to" snapshot
5870  * zc_value		name of "from" snapshot
5871  * zc_cookie		file descriptor to write diff data on
5872  *
5873  * outputs:
5874  * dmu_diff_record_t's to the file descriptor
5875  */
5876 static int
5877 zfs_ioc_diff(zfs_cmd_t *zc)
5878 {
5879 	file_t *fp;
5880 	offset_t off;
5881 	int error;
5882 
5883 	fp = getf(zc->zc_cookie);
5884 	if (fp == NULL)
5885 		return (SET_ERROR(EBADF));
5886 
5887 	off = fp->f_offset;
5888 
5889 	error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
5890 
5891 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5892 		fp->f_offset = off;
5893 	releasef(zc->zc_cookie);
5894 
5895 	return (error);
5896 }
5897 
5898 /*
5899  * Remove all ACL files in shares dir
5900  */
5901 static int
5902 zfs_smb_acl_purge(znode_t *dzp)
5903 {
5904 	zap_cursor_t	zc;
5905 	zap_attribute_t	zap;
5906 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
5907 	int error;
5908 
5909 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
5910 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
5911 	    zap_cursor_advance(&zc)) {
5912 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
5913 		    NULL, 0)) != 0)
5914 			break;
5915 	}
5916 	zap_cursor_fini(&zc);
5917 	return (error);
5918 }
5919 
5920 static int
5921 zfs_ioc_smb_acl(zfs_cmd_t *zc)
5922 {
5923 	vnode_t *vp;
5924 	znode_t *dzp;
5925 	vnode_t *resourcevp = NULL;
5926 	znode_t *sharedir;
5927 	zfsvfs_t *zfsvfs;
5928 	nvlist_t *nvlist;
5929 	char *src, *target;
5930 	vattr_t vattr;
5931 	vsecattr_t vsec;
5932 	int error = 0;
5933 
5934 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
5935 	    NO_FOLLOW, NULL, &vp)) != 0)
5936 		return (error);
5937 
5938 	/* Now make sure mntpnt and dataset are ZFS */
5939 
5940 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
5941 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
5942 	    zc->zc_name) != 0)) {
5943 		VN_RELE(vp);
5944 		return (SET_ERROR(EINVAL));
5945 	}
5946 
5947 	dzp = VTOZ(vp);
5948 	zfsvfs = dzp->z_zfsvfs;
5949 	ZFS_ENTER(zfsvfs);
5950 
5951 	/*
5952 	 * Create share dir if its missing.
5953 	 */
5954 	mutex_enter(&zfsvfs->z_lock);
5955 	if (zfsvfs->z_shares_dir == 0) {
5956 		dmu_tx_t *tx;
5957 
5958 		tx = dmu_tx_create(zfsvfs->z_os);
5959 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
5960 		    ZFS_SHARES_DIR);
5961 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
5962 		error = dmu_tx_assign(tx, TXG_WAIT);
5963 		if (error != 0) {
5964 			dmu_tx_abort(tx);
5965 		} else {
5966 			error = zfs_create_share_dir(zfsvfs, tx);
5967 			dmu_tx_commit(tx);
5968 		}
5969 		if (error != 0) {
5970 			mutex_exit(&zfsvfs->z_lock);
5971 			VN_RELE(vp);
5972 			ZFS_EXIT(zfsvfs);
5973 			return (error);
5974 		}
5975 	}
5976 	mutex_exit(&zfsvfs->z_lock);
5977 
5978 	ASSERT(zfsvfs->z_shares_dir);
5979 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
5980 		VN_RELE(vp);
5981 		ZFS_EXIT(zfsvfs);
5982 		return (error);
5983 	}
5984 
5985 	switch (zc->zc_cookie) {
5986 	case ZFS_SMB_ACL_ADD:
5987 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
5988 		vattr.va_type = VREG;
5989 		vattr.va_mode = S_IFREG|0777;
5990 		vattr.va_uid = 0;
5991 		vattr.va_gid = 0;
5992 
5993 		vsec.vsa_mask = VSA_ACE;
5994 		vsec.vsa_aclentp = &full_access;
5995 		vsec.vsa_aclentsz = sizeof (full_access);
5996 		vsec.vsa_aclcnt = 1;
5997 
5998 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
5999 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
6000 		if (resourcevp)
6001 			VN_RELE(resourcevp);
6002 		break;
6003 
6004 	case ZFS_SMB_ACL_REMOVE:
6005 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
6006 		    NULL, 0);
6007 		break;
6008 
6009 	case ZFS_SMB_ACL_RENAME:
6010 		if ((error = get_nvlist(zc->zc_nvlist_src,
6011 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
6012 			VN_RELE(vp);
6013 			VN_RELE(ZTOV(sharedir));
6014 			ZFS_EXIT(zfsvfs);
6015 			return (error);
6016 		}
6017 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
6018 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
6019 		    &target)) {
6020 			VN_RELE(vp);
6021 			VN_RELE(ZTOV(sharedir));
6022 			ZFS_EXIT(zfsvfs);
6023 			nvlist_free(nvlist);
6024 			return (error);
6025 		}
6026 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
6027 		    kcred, NULL, 0);
6028 		nvlist_free(nvlist);
6029 		break;
6030 
6031 	case ZFS_SMB_ACL_PURGE:
6032 		error = zfs_smb_acl_purge(sharedir);
6033 		break;
6034 
6035 	default:
6036 		error = SET_ERROR(EINVAL);
6037 		break;
6038 	}
6039 
6040 	VN_RELE(vp);
6041 	VN_RELE(ZTOV(sharedir));
6042 
6043 	ZFS_EXIT(zfsvfs);
6044 
6045 	return (error);
6046 }
6047 
6048 /*
6049  * innvl: {
6050  *     "holds" -> { snapname -> holdname (string), ... }
6051  *     (optional) "cleanup_fd" -> fd (int32)
6052  * }
6053  *
6054  * outnvl: {
6055  *     snapname -> error value (int32)
6056  *     ...
6057  * }
6058  */
6059 static const zfs_ioc_key_t zfs_keys_hold[] = {
6060 	{"holds",		DATA_TYPE_NVLIST,	0},
6061 	{"cleanup_fd",		DATA_TYPE_INT32,	ZK_OPTIONAL},
6062 };
6063 
6064 /* ARGSUSED */
6065 static int
6066 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
6067 {
6068 	nvpair_t *pair;
6069 	nvlist_t *holds;
6070 	int cleanup_fd = -1;
6071 	int error;
6072 	minor_t minor = 0;
6073 
6074 	holds = fnvlist_lookup_nvlist(args, "holds");
6075 
6076 	/* make sure the user didn't pass us any invalid (empty) tags */
6077 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
6078 	    pair = nvlist_next_nvpair(holds, pair)) {
6079 		char *htag;
6080 
6081 		error = nvpair_value_string(pair, &htag);
6082 		if (error != 0)
6083 			return (SET_ERROR(error));
6084 
6085 		if (strlen(htag) == 0)
6086 			return (SET_ERROR(EINVAL));
6087 	}
6088 
6089 	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
6090 		error = zfs_onexit_fd_hold(cleanup_fd, &minor);
6091 		if (error != 0)
6092 			return (error);
6093 	}
6094 
6095 	error = dsl_dataset_user_hold(holds, minor, errlist);
6096 	if (minor != 0)
6097 		zfs_onexit_fd_rele(cleanup_fd);
6098 	return (error);
6099 }
6100 
6101 /*
6102  * innvl is not used.
6103  *
6104  * outnvl: {
6105  *    holdname -> time added (uint64 seconds since epoch)
6106  *    ...
6107  * }
6108  */
6109 static const zfs_ioc_key_t zfs_keys_get_holds[] = {
6110 	/* no nvl keys */
6111 };
6112 
6113 /* ARGSUSED */
6114 static int
6115 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
6116 {
6117 	return (dsl_dataset_get_holds(snapname, outnvl));
6118 }
6119 
6120 /*
6121  * innvl: {
6122  *     snapname -> { holdname, ... }
6123  *     ...
6124  * }
6125  *
6126  * outnvl: {
6127  *     snapname -> error value (int32)
6128  *     ...
6129  * }
6130  */
6131 static const zfs_ioc_key_t zfs_keys_release[] = {
6132 	{"<snapname>...",	DATA_TYPE_NVLIST,	ZK_WILDCARDLIST},
6133 };
6134 
6135 /* ARGSUSED */
6136 static int
6137 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
6138 {
6139 	return (dsl_dataset_user_release(holds, errlist));
6140 }
6141 
6142 /*
6143  * inputs:
6144  * zc_name		name of new filesystem or snapshot
6145  * zc_value		full name of old snapshot
6146  *
6147  * outputs:
6148  * zc_cookie		space in bytes
6149  * zc_objset_type	compressed space in bytes
6150  * zc_perm_action	uncompressed space in bytes
6151  */
6152 static int
6153 zfs_ioc_space_written(zfs_cmd_t *zc)
6154 {
6155 	int error;
6156 	dsl_pool_t *dp;
6157 	dsl_dataset_t *new, *old;
6158 
6159 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
6160 	if (error != 0)
6161 		return (error);
6162 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
6163 	if (error != 0) {
6164 		dsl_pool_rele(dp, FTAG);
6165 		return (error);
6166 	}
6167 	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
6168 	if (error != 0) {
6169 		dsl_dataset_rele(new, FTAG);
6170 		dsl_pool_rele(dp, FTAG);
6171 		return (error);
6172 	}
6173 
6174 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
6175 	    &zc->zc_objset_type, &zc->zc_perm_action);
6176 	dsl_dataset_rele(old, FTAG);
6177 	dsl_dataset_rele(new, FTAG);
6178 	dsl_pool_rele(dp, FTAG);
6179 	return (error);
6180 }
6181 
6182 /*
6183  * innvl: {
6184  *     "firstsnap" -> snapshot name
6185  * }
6186  *
6187  * outnvl: {
6188  *     "used" -> space in bytes
6189  *     "compressed" -> compressed space in bytes
6190  *     "uncompressed" -> uncompressed space in bytes
6191  * }
6192  */
6193 static const zfs_ioc_key_t zfs_keys_space_snaps[] = {
6194 	{"firstsnap",	DATA_TYPE_STRING,	0},
6195 };
6196 
6197 static int
6198 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
6199 {
6200 	int error;
6201 	dsl_pool_t *dp;
6202 	dsl_dataset_t *new, *old;
6203 	char *firstsnap;
6204 	uint64_t used, comp, uncomp;
6205 
6206 	firstsnap = fnvlist_lookup_string(innvl, "firstsnap");
6207 
6208 	error = dsl_pool_hold(lastsnap, FTAG, &dp);
6209 	if (error != 0)
6210 		return (error);
6211 
6212 	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
6213 	if (error == 0 && !new->ds_is_snapshot) {
6214 		dsl_dataset_rele(new, FTAG);
6215 		error = SET_ERROR(EINVAL);
6216 	}
6217 	if (error != 0) {
6218 		dsl_pool_rele(dp, FTAG);
6219 		return (error);
6220 	}
6221 	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
6222 	if (error == 0 && !old->ds_is_snapshot) {
6223 		dsl_dataset_rele(old, FTAG);
6224 		error = SET_ERROR(EINVAL);
6225 	}
6226 	if (error != 0) {
6227 		dsl_dataset_rele(new, FTAG);
6228 		dsl_pool_rele(dp, FTAG);
6229 		return (error);
6230 	}
6231 
6232 	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
6233 	dsl_dataset_rele(old, FTAG);
6234 	dsl_dataset_rele(new, FTAG);
6235 	dsl_pool_rele(dp, FTAG);
6236 	fnvlist_add_uint64(outnvl, "used", used);
6237 	fnvlist_add_uint64(outnvl, "compressed", comp);
6238 	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
6239 	return (error);
6240 }
6241 
6242 /*
6243  * innvl: {
6244  *     "fd" -> file descriptor to write stream to (int32)
6245  *     (optional) "fromsnap" -> full snap name to send an incremental from
6246  *     (optional) "largeblockok" -> (value ignored)
6247  *         indicates that blocks > 128KB are permitted
6248  *     (optional) "embedok" -> (value ignored)
6249  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
6250  *     (optional) "compressok" -> (value ignored)
6251  *         presence indicates compressed DRR_WRITE records are permitted
6252  *     (optional) "rawok" -> (value ignored)
6253  *         presence indicates raw encrypted records should be used.
6254  *     (optional) "resume_object" and "resume_offset" -> (uint64)
6255  *         if present, resume send stream from specified object and offset.
6256  * }
6257  *
6258  * outnvl is unused
6259  */
6260 static const zfs_ioc_key_t zfs_keys_send_new[] = {
6261 	{"fd",			DATA_TYPE_INT32,	0},
6262 	{"fromsnap",		DATA_TYPE_STRING,	ZK_OPTIONAL},
6263 	{"largeblockok",	DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6264 	{"embedok",		DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6265 	{"compressok",		DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6266 	{"rawok",		DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6267 	{"resume_object",	DATA_TYPE_UINT64,	ZK_OPTIONAL},
6268 	{"resume_offset",	DATA_TYPE_UINT64,	ZK_OPTIONAL},
6269 };
6270 
6271 /* ARGSUSED */
6272 static int
6273 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
6274 {
6275 	int error;
6276 	offset_t off;
6277 	char *fromname = NULL;
6278 	int fd;
6279 	boolean_t largeblockok;
6280 	boolean_t embedok;
6281 	boolean_t compressok;
6282 	boolean_t rawok;
6283 	uint64_t resumeobj = 0;
6284 	uint64_t resumeoff = 0;
6285 
6286 	fd = fnvlist_lookup_int32(innvl, "fd");
6287 
6288 	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
6289 
6290 	largeblockok = nvlist_exists(innvl, "largeblockok");
6291 	embedok = nvlist_exists(innvl, "embedok");
6292 	compressok = nvlist_exists(innvl, "compressok");
6293 	rawok = nvlist_exists(innvl, "rawok");
6294 
6295 	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
6296 	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
6297 
6298 	file_t *fp = getf(fd);
6299 	if (fp == NULL)
6300 		return (SET_ERROR(EBADF));
6301 
6302 	off = fp->f_offset;
6303 	error = dmu_send(snapname, fromname, embedok, largeblockok, compressok,
6304 	    rawok, fd, resumeobj, resumeoff, fp->f_vnode, &off);
6305 
6306 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
6307 		fp->f_offset = off;
6308 	releasef(fd);
6309 	return (error);
6310 }
6311 
6312 /*
6313  * Determine approximately how large a zfs send stream will be -- the number
6314  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
6315  *
6316  * innvl: {
6317  *     (optional) "from" -> full snap or bookmark name to send an incremental
6318  *                          from
6319  *     (optional) "largeblockok" -> (value ignored)
6320  *         indicates that blocks > 128KB are permitted
6321  *     (optional) "embedok" -> (value ignored)
6322  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
6323  *     (optional) "compressok" -> (value ignored)
6324  *         presence indicates compressed DRR_WRITE records are permitted
6325  * }
6326  *
6327  * outnvl: {
6328  *     "space" -> bytes of space (uint64)
6329  * }
6330  */
6331 static const zfs_ioc_key_t zfs_keys_send_space[] = {
6332 	{"from",		DATA_TYPE_STRING,	ZK_OPTIONAL},
6333 	{"fromsnap",		DATA_TYPE_STRING,	ZK_OPTIONAL},
6334 	{"largeblockok",	DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6335 	{"embedok",		DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6336 	{"compressok",		DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6337 	{"rawok",		DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6338 };
6339 
6340 static int
6341 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
6342 {
6343 	dsl_pool_t *dp;
6344 	dsl_dataset_t *tosnap;
6345 	int error;
6346 	char *fromname;
6347 	boolean_t compressok;
6348 	boolean_t rawok;
6349 	uint64_t space;
6350 
6351 	error = dsl_pool_hold(snapname, FTAG, &dp);
6352 	if (error != 0)
6353 		return (error);
6354 
6355 	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
6356 	if (error != 0) {
6357 		dsl_pool_rele(dp, FTAG);
6358 		return (error);
6359 	}
6360 
6361 	compressok = nvlist_exists(innvl, "compressok");
6362 	rawok = nvlist_exists(innvl, "rawok");
6363 
6364 	error = nvlist_lookup_string(innvl, "from", &fromname);
6365 	if (error == 0) {
6366 		if (strchr(fromname, '@') != NULL) {
6367 			/*
6368 			 * If from is a snapshot, hold it and use the more
6369 			 * efficient dmu_send_estimate to estimate send space
6370 			 * size using deadlists.
6371 			 */
6372 			dsl_dataset_t *fromsnap;
6373 			error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
6374 			if (error != 0)
6375 				goto out;
6376 			error = dmu_send_estimate(tosnap, fromsnap,
6377 			    compressok || rawok, &space);
6378 			dsl_dataset_rele(fromsnap, FTAG);
6379 		} else if (strchr(fromname, '#') != NULL) {
6380 			/*
6381 			 * If from is a bookmark, fetch the creation TXG of the
6382 			 * snapshot it was created from and use that to find
6383 			 * blocks that were born after it.
6384 			 */
6385 			zfs_bookmark_phys_t frombm;
6386 
6387 			error = dsl_bookmark_lookup(dp, fromname, tosnap,
6388 			    &frombm);
6389 			if (error != 0)
6390 				goto out;
6391 			error = dmu_send_estimate_from_txg(tosnap,
6392 			    frombm.zbm_creation_txg, compressok || rawok,
6393 			    &space);
6394 		} else {
6395 			/*
6396 			 * from is not properly formatted as a snapshot or
6397 			 * bookmark
6398 			 */
6399 			error = SET_ERROR(EINVAL);
6400 			goto out;
6401 		}
6402 	} else {
6403 		/*
6404 		 * If estimating the size of a full send, use dmu_send_estimate.
6405 		 */
6406 		error = dmu_send_estimate(tosnap, NULL, compressok || rawok,
6407 		    &space);
6408 	}
6409 
6410 	fnvlist_add_uint64(outnvl, "space", space);
6411 
6412 out:
6413 	dsl_dataset_rele(tosnap, FTAG);
6414 	dsl_pool_rele(dp, FTAG);
6415 	return (error);
6416 }
6417 
6418 /*
6419  * Sync the currently open TXG to disk for the specified pool.
6420  * This is somewhat similar to 'zfs_sync()'.
6421  * For cases that do not result in error this ioctl will wait for
6422  * the currently open TXG to commit before returning back to the caller.
6423  *
6424  * innvl: {
6425  *  "force" -> when true, force uberblock update even if there is no dirty data.
6426  *             In addition this will cause the vdev configuration to be written
6427  *             out including updating the zpool cache file. (boolean_t)
6428  * }
6429  *
6430  * onvl is unused
6431  */
6432 static const zfs_ioc_key_t zfs_keys_pool_sync[] = {
6433 	{"force",	DATA_TYPE_BOOLEAN_VALUE,	0},
6434 };
6435 
6436 /* ARGSUSED */
6437 static int
6438 zfs_ioc_pool_sync(const char *pool, nvlist_t *innvl, nvlist_t *onvl)
6439 {
6440 	int err;
6441 	boolean_t force = B_FALSE;
6442 	spa_t *spa;
6443 
6444 	if ((err = spa_open(pool, &spa, FTAG)) != 0)
6445 		return (err);
6446 
6447 	if (innvl)
6448 		force = fnvlist_lookup_boolean_value(innvl, "force");
6449 
6450 	if (force) {
6451 		spa_config_enter(spa, SCL_CONFIG, FTAG, RW_WRITER);
6452 		vdev_config_dirty(spa->spa_root_vdev);
6453 		spa_config_exit(spa, SCL_CONFIG, FTAG);
6454 	}
6455 	txg_wait_synced(spa_get_dsl(spa), 0);
6456 
6457 	spa_close(spa, FTAG);
6458 
6459 	return (err);
6460 }
6461 
6462 /*
6463  * Load a user's wrapping key into the kernel.
6464  * innvl: {
6465  *     "hidden_args" -> { "wkeydata" -> value }
6466  *         raw uint8_t array of encryption wrapping key data (32 bytes)
6467  *     (optional) "noop" -> (value ignored)
6468  *         presence indicated key should only be verified, not loaded
6469  * }
6470  */
6471 static const zfs_ioc_key_t zfs_keys_load_key[] = {
6472 	{"hidden_args",	DATA_TYPE_NVLIST,	0},
6473 	{"noop",	DATA_TYPE_BOOLEAN,	ZK_OPTIONAL},
6474 };
6475 
6476 /* ARGSUSED */
6477 static int
6478 zfs_ioc_load_key(const char *dsname, nvlist_t *innvl, nvlist_t *outnvl)
6479 {
6480 	int ret = 0;
6481 	dsl_crypto_params_t *dcp = NULL;
6482 	nvlist_t *hidden_args;
6483 	boolean_t noop = nvlist_exists(innvl, "noop");
6484 
6485 	if (strchr(dsname, '@') != NULL || strchr(dsname, '%') != NULL) {
6486 		ret = SET_ERROR(EINVAL);
6487 		goto error;
6488 	}
6489 
6490 	hidden_args = fnvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS);
6491 
6492 	ret = dsl_crypto_params_create_nvlist(DCP_CMD_NONE, NULL,
6493 	    hidden_args, &dcp);
6494 	if (ret != 0)
6495 		goto error;
6496 
6497 	ret = spa_keystore_load_wkey(dsname, dcp, noop);
6498 	if (ret != 0)
6499 		goto error;
6500 
6501 	dsl_crypto_params_free(dcp, noop);
6502 
6503 	return (0);
6504 
6505 error:
6506 	dsl_crypto_params_free(dcp, B_TRUE);
6507 	return (ret);
6508 }
6509 
6510 /*
6511  * Unload a user's wrapping key from the kernel.
6512  * Both innvl and outnvl are unused.
6513  */
6514 static const zfs_ioc_key_t zfs_keys_unload_key[] = {
6515 	/* no nvl keys */
6516 };
6517 
6518 /* ARGSUSED */
6519 static int
6520 zfs_ioc_unload_key(const char *dsname, nvlist_t *innvl, nvlist_t *outnvl)
6521 {
6522 	int ret = 0;
6523 
6524 	if (strchr(dsname, '@') != NULL || strchr(dsname, '%') != NULL) {
6525 		ret = (SET_ERROR(EINVAL));
6526 		goto out;
6527 	}
6528 
6529 	ret = spa_keystore_unload_wkey(dsname);
6530 	if (ret != 0)
6531 		goto out;
6532 
6533 out:
6534 	return (ret);
6535 }
6536 
6537 /*
6538  * Changes a user's wrapping key used to decrypt a dataset. The keyformat,
6539  * keylocation, pbkdf2salt, and  pbkdf2iters properties can also be specified
6540  * here to change how the key is derived in userspace.
6541  *
6542  * innvl: {
6543  *    "hidden_args" (optional) -> { "wkeydata" -> value }
6544  *         raw uint8_t array of new encryption wrapping key data (32 bytes)
6545  *    "props" (optional) -> { prop -> value }
6546  * }
6547  *
6548  * outnvl is unused
6549  */
6550 static const zfs_ioc_key_t zfs_keys_change_key[] = {
6551 	{"crypt_cmd",	DATA_TYPE_UINT64,	ZK_OPTIONAL},
6552 	{"hidden_args",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
6553 	{"props",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
6554 };
6555 
6556 /* ARGSUSED */
6557 static int
6558 zfs_ioc_change_key(const char *dsname, nvlist_t *innvl, nvlist_t *outnvl)
6559 {
6560 	int ret;
6561 	uint64_t cmd = DCP_CMD_NONE;
6562 	dsl_crypto_params_t *dcp = NULL;
6563 	nvlist_t *args = NULL, *hidden_args = NULL;
6564 
6565 	if (strchr(dsname, '@') != NULL || strchr(dsname, '%') != NULL) {
6566 		ret = (SET_ERROR(EINVAL));
6567 		goto error;
6568 	}
6569 
6570 	(void) nvlist_lookup_uint64(innvl, "crypt_cmd", &cmd);
6571 	(void) nvlist_lookup_nvlist(innvl, "props", &args);
6572 	(void) nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);
6573 
6574 	ret = dsl_crypto_params_create_nvlist(cmd, args, hidden_args, &dcp);
6575 	if (ret != 0)
6576 		goto error;
6577 
6578 	ret = spa_keystore_change_key(dsname, dcp);
6579 	if (ret != 0)
6580 		goto error;
6581 
6582 	dsl_crypto_params_free(dcp, B_FALSE);
6583 
6584 	return (0);
6585 
6586 error:
6587 	dsl_crypto_params_free(dcp, B_TRUE);
6588 	return (ret);
6589 }
6590 
6591 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
6592 
6593 static void
6594 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
6595     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
6596     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
6597 {
6598 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
6599 
6600 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
6601 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
6602 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
6603 	ASSERT3P(vec->zvec_func, ==, NULL);
6604 
6605 	vec->zvec_legacy_func = func;
6606 	vec->zvec_secpolicy = secpolicy;
6607 	vec->zvec_namecheck = namecheck;
6608 	vec->zvec_allow_log = log_history;
6609 	vec->zvec_pool_check = pool_check;
6610 }
6611 
6612 /*
6613  * See the block comment at the beginning of this file for details on
6614  * each argument to this function.
6615  */
6616 static void
6617 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
6618     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
6619     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
6620     boolean_t allow_log, const zfs_ioc_key_t *nvl_keys, size_t num_keys)
6621 {
6622 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
6623 
6624 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
6625 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
6626 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
6627 	ASSERT3P(vec->zvec_func, ==, NULL);
6628 
6629 	/* if we are logging, the name must be valid */
6630 	ASSERT(!allow_log || namecheck != NO_NAME);
6631 
6632 	vec->zvec_name = name;
6633 	vec->zvec_func = func;
6634 	vec->zvec_secpolicy = secpolicy;
6635 	vec->zvec_namecheck = namecheck;
6636 	vec->zvec_pool_check = pool_check;
6637 	vec->zvec_smush_outnvlist = smush_outnvlist;
6638 	vec->zvec_allow_log = allow_log;
6639 	vec->zvec_nvl_keys = nvl_keys;
6640 	vec->zvec_nvl_key_count = num_keys;
6641 }
6642 
6643 static void
6644 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
6645     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
6646     zfs_ioc_poolcheck_t pool_check)
6647 {
6648 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
6649 	    POOL_NAME, log_history, pool_check);
6650 }
6651 
6652 static void
6653 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
6654     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
6655 {
6656 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
6657 	    DATASET_NAME, B_FALSE, pool_check);
6658 }
6659 
6660 static void
6661 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
6662 {
6663 	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
6664 	    POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
6665 }
6666 
6667 static void
6668 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
6669     zfs_secpolicy_func_t *secpolicy)
6670 {
6671 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
6672 	    NO_NAME, B_FALSE, POOL_CHECK_NONE);
6673 }
6674 
6675 static void
6676 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
6677     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
6678 {
6679 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
6680 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
6681 }
6682 
6683 static void
6684 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
6685 {
6686 	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
6687 	    zfs_secpolicy_read);
6688 }
6689 
6690 static void
6691 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
6692     zfs_secpolicy_func_t *secpolicy)
6693 {
6694 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
6695 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
6696 }
6697 
6698 static void
6699 zfs_ioctl_init(void)
6700 {
6701 	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
6702 	    zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
6703 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6704 	    zfs_keys_snapshot, ARRAY_SIZE(zfs_keys_snapshot));
6705 
6706 	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
6707 	    zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
6708 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE,
6709 	    zfs_keys_log_history, ARRAY_SIZE(zfs_keys_log_history));
6710 
6711 	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
6712 	    zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
6713 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
6714 	    zfs_keys_space_snaps, ARRAY_SIZE(zfs_keys_space_snaps));
6715 
6716 	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
6717 	    zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
6718 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
6719 	    zfs_keys_send_new, ARRAY_SIZE(zfs_keys_send_new));
6720 
6721 	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
6722 	    zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
6723 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
6724 	    zfs_keys_send_space, ARRAY_SIZE(zfs_keys_send_space));
6725 
6726 	zfs_ioctl_register("create", ZFS_IOC_CREATE,
6727 	    zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
6728 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6729 	    zfs_keys_create, ARRAY_SIZE(zfs_keys_create));
6730 
6731 	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
6732 	    zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
6733 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6734 	    zfs_keys_clone, ARRAY_SIZE(zfs_keys_clone));
6735 
6736 	zfs_ioctl_register("remap", ZFS_IOC_REMAP,
6737 	    zfs_ioc_remap, zfs_secpolicy_remap, DATASET_NAME,
6738 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE,
6739 	    zfs_keys_remap, ARRAY_SIZE(zfs_keys_remap));
6740 
6741 	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
6742 	    zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
6743 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6744 	    zfs_keys_destroy_snaps, ARRAY_SIZE(zfs_keys_destroy_snaps));
6745 
6746 	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
6747 	    zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
6748 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6749 	    zfs_keys_hold, ARRAY_SIZE(zfs_keys_hold));
6750 	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
6751 	    zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
6752 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6753 	    zfs_keys_release, ARRAY_SIZE(zfs_keys_release));
6754 
6755 	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
6756 	    zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
6757 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
6758 	    zfs_keys_get_holds, ARRAY_SIZE(zfs_keys_get_holds));
6759 
6760 	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
6761 	    zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
6762 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE,
6763 	    zfs_keys_rollback, ARRAY_SIZE(zfs_keys_rollback));
6764 
6765 	zfs_ioctl_register("bookmark", ZFS_IOC_BOOKMARK,
6766 	    zfs_ioc_bookmark, zfs_secpolicy_bookmark, POOL_NAME,
6767 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6768 	    zfs_keys_bookmark, ARRAY_SIZE(zfs_keys_bookmark));
6769 
6770 	zfs_ioctl_register("get_bookmarks", ZFS_IOC_GET_BOOKMARKS,
6771 	    zfs_ioc_get_bookmarks, zfs_secpolicy_read, DATASET_NAME,
6772 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE,
6773 	    zfs_keys_get_bookmarks, ARRAY_SIZE(zfs_keys_get_bookmarks));
6774 
6775 	zfs_ioctl_register("destroy_bookmarks", ZFS_IOC_DESTROY_BOOKMARKS,
6776 	    zfs_ioc_destroy_bookmarks, zfs_secpolicy_destroy_bookmarks,
6777 	    POOL_NAME,
6778 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6779 	    zfs_keys_destroy_bookmarks,
6780 	    ARRAY_SIZE(zfs_keys_destroy_bookmarks));
6781 
6782 	zfs_ioctl_register("load-key", ZFS_IOC_LOAD_KEY,
6783 	    zfs_ioc_load_key, zfs_secpolicy_load_key,
6784 	    DATASET_NAME, POOL_CHECK_SUSPENDED, B_TRUE, B_TRUE,
6785 	    zfs_keys_load_key, ARRAY_SIZE(zfs_keys_load_key));
6786 	zfs_ioctl_register("unload-key", ZFS_IOC_UNLOAD_KEY,
6787 	    zfs_ioc_unload_key, zfs_secpolicy_load_key,
6788 	    DATASET_NAME, POOL_CHECK_SUSPENDED, B_TRUE, B_TRUE,
6789 	    zfs_keys_unload_key, ARRAY_SIZE(zfs_keys_unload_key));
6790 	zfs_ioctl_register("change-key", ZFS_IOC_CHANGE_KEY,
6791 	    zfs_ioc_change_key, zfs_secpolicy_change_key,
6792 	    DATASET_NAME, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY,
6793 	    B_TRUE, B_TRUE, zfs_keys_change_key,
6794 	    ARRAY_SIZE(zfs_keys_change_key));
6795 
6796 	zfs_ioctl_register("sync", ZFS_IOC_POOL_SYNC,
6797 	    zfs_ioc_pool_sync, zfs_secpolicy_none, POOL_NAME,
6798 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE,
6799 	    zfs_keys_pool_sync, ARRAY_SIZE(zfs_keys_pool_sync));
6800 
6801 	zfs_ioctl_register("channel_program", ZFS_IOC_CHANNEL_PROGRAM,
6802 	    zfs_ioc_channel_program, zfs_secpolicy_config,
6803 	    POOL_NAME, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE,
6804 	    B_TRUE, zfs_keys_channel_program,
6805 	    ARRAY_SIZE(zfs_keys_channel_program));
6806 
6807 	zfs_ioctl_register("zpool_checkpoint", ZFS_IOC_POOL_CHECKPOINT,
6808 	    zfs_ioc_pool_checkpoint, zfs_secpolicy_config, POOL_NAME,
6809 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6810 	    zfs_keys_pool_checkpoint, ARRAY_SIZE(zfs_keys_pool_checkpoint));
6811 
6812 	zfs_ioctl_register("zpool_discard_checkpoint",
6813 	    ZFS_IOC_POOL_DISCARD_CHECKPOINT, zfs_ioc_pool_discard_checkpoint,
6814 	    zfs_secpolicy_config, POOL_NAME,
6815 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6816 	    zfs_keys_pool_discard_checkpoint,
6817 	    ARRAY_SIZE(zfs_keys_pool_discard_checkpoint));
6818 
6819 	zfs_ioctl_register("initialize", ZFS_IOC_POOL_INITIALIZE,
6820 	    zfs_ioc_pool_initialize, zfs_secpolicy_config, POOL_NAME,
6821 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6822 	    zfs_keys_pool_initialize, ARRAY_SIZE(zfs_keys_pool_initialize));
6823 
6824 	zfs_ioctl_register("trim", ZFS_IOC_POOL_TRIM,
6825 	    zfs_ioc_pool_trim, zfs_secpolicy_config, POOL_NAME,
6826 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE,
6827 	    zfs_keys_pool_trim, ARRAY_SIZE(zfs_keys_pool_trim));
6828 
6829 	zfs_ioctl_register("set_bootenv", ZFS_IOC_SET_BOOTENV,
6830 	    zfs_ioc_set_bootenv, zfs_secpolicy_config, POOL_NAME,
6831 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE,
6832 	    zfs_keys_set_bootenv, ARRAY_SIZE(zfs_keys_set_bootenv));
6833 
6834 	zfs_ioctl_register("get_bootenv", ZFS_IOC_GET_BOOTENV,
6835 	    zfs_ioc_get_bootenv, zfs_secpolicy_none, POOL_NAME,
6836 	    POOL_CHECK_SUSPENDED, B_FALSE, B_TRUE,
6837 	    zfs_keys_get_bootenv, ARRAY_SIZE(zfs_keys_get_bootenv));
6838 
6839 	/* IOCTLS that use the legacy function signature */
6840 
6841 	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
6842 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
6843 
6844 	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
6845 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
6846 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
6847 	    zfs_ioc_pool_scan);
6848 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
6849 	    zfs_ioc_pool_upgrade);
6850 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
6851 	    zfs_ioc_vdev_add);
6852 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
6853 	    zfs_ioc_vdev_remove);
6854 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
6855 	    zfs_ioc_vdev_set_state);
6856 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
6857 	    zfs_ioc_vdev_attach);
6858 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
6859 	    zfs_ioc_vdev_detach);
6860 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
6861 	    zfs_ioc_vdev_setpath);
6862 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
6863 	    zfs_ioc_vdev_setfru);
6864 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
6865 	    zfs_ioc_pool_set_props);
6866 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
6867 	    zfs_ioc_vdev_split);
6868 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
6869 	    zfs_ioc_pool_reguid);
6870 
6871 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
6872 	    zfs_ioc_pool_configs, zfs_secpolicy_none);
6873 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
6874 	    zfs_ioc_pool_tryimport, zfs_secpolicy_config);
6875 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
6876 	    zfs_ioc_inject_fault, zfs_secpolicy_inject);
6877 	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
6878 	    zfs_ioc_clear_fault, zfs_secpolicy_inject);
6879 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
6880 	    zfs_ioc_inject_list_next, zfs_secpolicy_inject);
6881 
6882 	/*
6883 	 * pool destroy, and export don't log the history as part of
6884 	 * zfsdev_ioctl, but rather zfs_ioc_pool_export
6885 	 * does the logging of those commands.
6886 	 */
6887 	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
6888 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
6889 	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
6890 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
6891 
6892 	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
6893 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
6894 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
6895 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
6896 
6897 	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
6898 	    zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
6899 	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
6900 	    zfs_ioc_dsobj_to_dsname,
6901 	    zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
6902 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
6903 	    zfs_ioc_pool_get_history,
6904 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
6905 
6906 	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
6907 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
6908 
6909 	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
6910 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_READONLY);
6911 	zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
6912 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
6913 
6914 	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
6915 	    zfs_ioc_space_written);
6916 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
6917 	    zfs_ioc_objset_recvd_props);
6918 	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
6919 	    zfs_ioc_next_obj);
6920 	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
6921 	    zfs_ioc_get_fsacl);
6922 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
6923 	    zfs_ioc_objset_stats);
6924 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
6925 	    zfs_ioc_objset_zplprops);
6926 	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
6927 	    zfs_ioc_dataset_list_next);
6928 	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
6929 	    zfs_ioc_snapshot_list_next);
6930 	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
6931 	    zfs_ioc_send_progress);
6932 
6933 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
6934 	    zfs_ioc_diff, zfs_secpolicy_diff);
6935 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
6936 	    zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
6937 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
6938 	    zfs_ioc_obj_to_path, zfs_secpolicy_diff);
6939 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
6940 	    zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
6941 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
6942 	    zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
6943 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
6944 	    zfs_ioc_send, zfs_secpolicy_send);
6945 
6946 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
6947 	    zfs_secpolicy_none);
6948 	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
6949 	    zfs_secpolicy_destroy);
6950 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
6951 	    zfs_secpolicy_rename);
6952 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
6953 	    zfs_secpolicy_recv);
6954 	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
6955 	    zfs_secpolicy_promote);
6956 	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
6957 	    zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
6958 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
6959 	    zfs_secpolicy_set_fsacl);
6960 
6961 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
6962 	    zfs_secpolicy_share, POOL_CHECK_NONE);
6963 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
6964 	    zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
6965 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
6966 	    zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
6967 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
6968 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
6969 	    zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
6970 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
6971 }
6972 
6973 /*
6974  * Verify that for non-legacy ioctls the input nvlist
6975  * pairs match against the expected input.
6976  *
6977  * Possible errors are:
6978  * ZFS_ERR_IOC_ARG_UNAVAIL	An unrecognized nvpair was encountered
6979  * ZFS_ERR_IOC_ARG_REQUIRED	A required nvpair is missing
6980  * ZFS_ERR_IOC_ARG_BADTYPE	Invalid type for nvpair
6981  */
6982 static int
6983 zfs_check_input_nvpairs(nvlist_t *innvl, const zfs_ioc_vec_t *vec)
6984 {
6985 	const zfs_ioc_key_t *nvl_keys = vec->zvec_nvl_keys;
6986 	boolean_t required_keys_found = B_FALSE;
6987 
6988 	/*
6989 	 * examine each input pair
6990 	 */
6991 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
6992 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
6993 		char *name = nvpair_name(pair);
6994 		data_type_t type = nvpair_type(pair);
6995 		boolean_t identified = B_FALSE;
6996 
6997 		/*
6998 		 * check pair against the documented names and type
6999 		 */
7000 		for (int k = 0; k < vec->zvec_nvl_key_count; k++) {
7001 			/* if not a wild card name, check for an exact match */
7002 			if ((nvl_keys[k].zkey_flags & ZK_WILDCARDLIST) == 0 &&
7003 			    strcmp(nvl_keys[k].zkey_name, name) != 0)
7004 				continue;
7005 
7006 			identified = B_TRUE;
7007 
7008 			if (nvl_keys[k].zkey_type != DATA_TYPE_ANY &&
7009 			    nvl_keys[k].zkey_type != type) {
7010 				return (SET_ERROR(ZFS_ERR_IOC_ARG_BADTYPE));
7011 			}
7012 
7013 			if (nvl_keys[k].zkey_flags & ZK_OPTIONAL)
7014 				continue;
7015 
7016 			required_keys_found = B_TRUE;
7017 			break;
7018 		}
7019 
7020 		/* allow an 'optional' key, everything else is invalid */
7021 		if (!identified &&
7022 		    (strcmp(name, "optional") != 0 ||
7023 		    type != DATA_TYPE_NVLIST)) {
7024 			return (SET_ERROR(ZFS_ERR_IOC_ARG_UNAVAIL));
7025 		}
7026 	}
7027 
7028 	/* verify that all required keys were found */
7029 	for (int k = 0; k < vec->zvec_nvl_key_count; k++) {
7030 		if (nvl_keys[k].zkey_flags & ZK_OPTIONAL)
7031 			continue;
7032 
7033 		if (nvl_keys[k].zkey_flags & ZK_WILDCARDLIST) {
7034 			/* at least one non-optionial key is expected here */
7035 			if (!required_keys_found)
7036 				return (SET_ERROR(ZFS_ERR_IOC_ARG_REQUIRED));
7037 			continue;
7038 		}
7039 
7040 		if (!nvlist_exists(innvl, nvl_keys[k].zkey_name))
7041 			return (SET_ERROR(ZFS_ERR_IOC_ARG_REQUIRED));
7042 	}
7043 
7044 	return (0);
7045 }
7046 
7047 int
7048 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
7049     zfs_ioc_poolcheck_t check)
7050 {
7051 	spa_t *spa;
7052 	int error;
7053 
7054 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
7055 
7056 	if (check & POOL_CHECK_NONE)
7057 		return (0);
7058 
7059 	error = spa_open(name, &spa, FTAG);
7060 	if (error == 0) {
7061 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
7062 			error = SET_ERROR(EAGAIN);
7063 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
7064 			error = SET_ERROR(EROFS);
7065 		spa_close(spa, FTAG);
7066 	}
7067 	return (error);
7068 }
7069 
7070 /*
7071  * Find a free minor number.
7072  */
7073 minor_t
7074 zfsdev_minor_alloc(void)
7075 {
7076 	static minor_t last_minor;
7077 	minor_t m;
7078 
7079 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
7080 
7081 	for (m = last_minor + 1; m != last_minor; m++) {
7082 		if (m > ZFSDEV_MAX_MINOR)
7083 			m = 1;
7084 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
7085 			last_minor = m;
7086 			return (m);
7087 		}
7088 	}
7089 
7090 	return (0);
7091 }
7092 
7093 static int
7094 zfs_ctldev_init(dev_t *devp)
7095 {
7096 	minor_t minor;
7097 	zfs_soft_state_t *zs;
7098 
7099 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
7100 	ASSERT(getminor(*devp) == 0);
7101 
7102 	minor = zfsdev_minor_alloc();
7103 	if (minor == 0)
7104 		return (SET_ERROR(ENXIO));
7105 
7106 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
7107 		return (SET_ERROR(EAGAIN));
7108 
7109 	*devp = makedevice(getemajor(*devp), minor);
7110 
7111 	zs = ddi_get_soft_state(zfsdev_state, minor);
7112 	zs->zss_type = ZSST_CTLDEV;
7113 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
7114 
7115 	return (0);
7116 }
7117 
7118 static void
7119 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
7120 {
7121 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
7122 
7123 	zfs_onexit_destroy(zo);
7124 	ddi_soft_state_free(zfsdev_state, minor);
7125 }
7126 
7127 void *
7128 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
7129 {
7130 	zfs_soft_state_t *zp;
7131 
7132 	zp = ddi_get_soft_state(zfsdev_state, minor);
7133 	if (zp == NULL || zp->zss_type != which)
7134 		return (NULL);
7135 
7136 	return (zp->zss_data);
7137 }
7138 
7139 static int
7140 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
7141 {
7142 	int error = 0;
7143 
7144 	if (getminor(*devp) != 0)
7145 		return (zvol_open(devp, flag, otyp, cr));
7146 
7147 	/* This is the control device. Allocate a new minor if requested. */
7148 	if (flag & FEXCL) {
7149 		mutex_enter(&zfsdev_state_lock);
7150 		error = zfs_ctldev_init(devp);
7151 		mutex_exit(&zfsdev_state_lock);
7152 	}
7153 
7154 	return (error);
7155 }
7156 
7157 static int
7158 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
7159 {
7160 	zfs_onexit_t *zo;
7161 	minor_t minor = getminor(dev);
7162 
7163 	if (minor == 0)
7164 		return (0);
7165 
7166 	mutex_enter(&zfsdev_state_lock);
7167 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
7168 	if (zo == NULL) {
7169 		mutex_exit(&zfsdev_state_lock);
7170 		return (zvol_close(dev, flag, otyp, cr));
7171 	}
7172 	zfs_ctldev_destroy(zo, minor);
7173 	mutex_exit(&zfsdev_state_lock);
7174 
7175 	return (0);
7176 }
7177 
7178 static int
7179 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
7180 {
7181 	zfs_cmd_t *zc;
7182 	uint_t vecnum;
7183 	int error, rc, len;
7184 	minor_t minor = getminor(dev);
7185 	const zfs_ioc_vec_t *vec;
7186 	char *saved_poolname = NULL;
7187 	nvlist_t *innvl = NULL;
7188 
7189 	if (minor != 0 &&
7190 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
7191 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
7192 
7193 	vecnum = cmd - ZFS_IOC_FIRST;
7194 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
7195 
7196 	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
7197 		return (SET_ERROR(ZFS_ERR_IOC_CMD_UNAVAIL));
7198 	vec = &zfs_ioc_vec[vecnum];
7199 
7200 	/*
7201 	 * The registered ioctl list may be sparse, verify that either
7202 	 * a normal or legacy handler are registered.
7203 	 */
7204 	if (vec->zvec_func == NULL && vec->zvec_legacy_func == NULL)
7205 		return (SET_ERROR(ZFS_ERR_IOC_CMD_UNAVAIL));
7206 
7207 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
7208 
7209 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
7210 	if (error != 0) {
7211 		error = SET_ERROR(EFAULT);
7212 		goto out;
7213 	}
7214 
7215 	zc->zc_iflags = flag & FKIOCTL;
7216 	if (zc->zc_nvlist_src_size != 0) {
7217 		error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
7218 		    zc->zc_iflags, &innvl);
7219 		if (error != 0)
7220 			goto out;
7221 	}
7222 
7223 	/*
7224 	 * Ensure that all pool/dataset names are valid before we pass down to
7225 	 * the lower layers.
7226 	 */
7227 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
7228 	switch (vec->zvec_namecheck) {
7229 	case POOL_NAME:
7230 		if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
7231 			error = SET_ERROR(EINVAL);
7232 		else
7233 			error = pool_status_check(zc->zc_name,
7234 			    vec->zvec_namecheck, vec->zvec_pool_check);
7235 		break;
7236 
7237 	case DATASET_NAME:
7238 		if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
7239 			error = SET_ERROR(EINVAL);
7240 		else
7241 			error = pool_status_check(zc->zc_name,
7242 			    vec->zvec_namecheck, vec->zvec_pool_check);
7243 		break;
7244 
7245 	case NO_NAME:
7246 		break;
7247 	}
7248 
7249 	/*
7250 	 * Ensure that all input pairs are valid before we pass them down
7251 	 * to the lower layers.
7252 	 *
7253 	 * The vectored functions can use fnvlist_lookup_{type} for any
7254 	 * required pairs since zfs_check_input_nvpairs() confirmed that
7255 	 * they exist and are of the correct type.
7256 	 */
7257 	if (error == 0 && vec->zvec_func != NULL) {
7258 		error = zfs_check_input_nvpairs(innvl, vec);
7259 		if (error != 0)
7260 			goto out;
7261 	}
7262 
7263 	if (error == 0)
7264 		error = vec->zvec_secpolicy(zc, innvl, cr);
7265 
7266 	if (error != 0)
7267 		goto out;
7268 
7269 	/* legacy ioctls can modify zc_name */
7270 	len = strcspn(zc->zc_name, "/@#") + 1;
7271 	saved_poolname = kmem_alloc(len, KM_SLEEP);
7272 	(void) strlcpy(saved_poolname, zc->zc_name, len);
7273 
7274 	if (vec->zvec_func != NULL) {
7275 		nvlist_t *outnvl;
7276 		int puterror = 0;
7277 		spa_t *spa;
7278 		nvlist_t *lognv = NULL;
7279 
7280 		ASSERT(vec->zvec_legacy_func == NULL);
7281 
7282 		/*
7283 		 * Add the innvl to the lognv before calling the func,
7284 		 * in case the func changes the innvl.
7285 		 */
7286 		if (vec->zvec_allow_log) {
7287 			lognv = fnvlist_alloc();
7288 			fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
7289 			    vec->zvec_name);
7290 			if (!nvlist_empty(innvl)) {
7291 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
7292 				    innvl);
7293 			}
7294 		}
7295 
7296 		outnvl = fnvlist_alloc();
7297 		error = vec->zvec_func(zc->zc_name, innvl, outnvl);
7298 
7299 		/*
7300 		 * Some commands can partially execute, modify state, and still
7301 		 * return an error.  In these cases, attempt to record what
7302 		 * was modified.
7303 		 */
7304 		if ((error == 0 ||
7305 		    (cmd == ZFS_IOC_CHANNEL_PROGRAM && error != EINVAL)) &&
7306 		    vec->zvec_allow_log &&
7307 		    spa_open(zc->zc_name, &spa, FTAG) == 0) {
7308 			if (!nvlist_empty(outnvl)) {
7309 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
7310 				    outnvl);
7311 			}
7312 			if (error != 0) {
7313 				fnvlist_add_int64(lognv, ZPOOL_HIST_ERRNO,
7314 				    error);
7315 			}
7316 			(void) spa_history_log_nvl(spa, lognv);
7317 			spa_close(spa, FTAG);
7318 		}
7319 		fnvlist_free(lognv);
7320 
7321 		if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
7322 			int smusherror = 0;
7323 			if (vec->zvec_smush_outnvlist) {
7324 				smusherror = nvlist_smush(outnvl,
7325 				    zc->zc_nvlist_dst_size);
7326 			}
7327 			if (smusherror == 0)
7328 				puterror = put_nvlist(zc, outnvl);
7329 		}
7330 
7331 		if (puterror != 0)
7332 			error = puterror;
7333 
7334 		nvlist_free(outnvl);
7335 	} else {
7336 		error = vec->zvec_legacy_func(zc);
7337 	}
7338 
7339 out:
7340 	nvlist_free(innvl);
7341 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
7342 	if (error == 0 && rc != 0)
7343 		error = SET_ERROR(EFAULT);
7344 	if (error == 0 && vec->zvec_allow_log) {
7345 		char *s = tsd_get(zfs_allow_log_key);
7346 		if (s != NULL)
7347 			strfree(s);
7348 		(void) tsd_set(zfs_allow_log_key, saved_poolname);
7349 	} else {
7350 		if (saved_poolname != NULL)
7351 			strfree(saved_poolname);
7352 	}
7353 
7354 	kmem_free(zc, sizeof (zfs_cmd_t));
7355 	return (error);
7356 }
7357 
7358 static int
7359 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
7360 {
7361 	if (cmd != DDI_ATTACH)
7362 		return (DDI_FAILURE);
7363 
7364 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
7365 	    DDI_PSEUDO, 0) == DDI_FAILURE)
7366 		return (DDI_FAILURE);
7367 
7368 	zfs_dip = dip;
7369 
7370 	ddi_report_dev(dip);
7371 
7372 	return (DDI_SUCCESS);
7373 }
7374 
7375 static int
7376 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
7377 {
7378 	if (spa_busy() || zfs_busy() || zvol_busy())
7379 		return (DDI_FAILURE);
7380 
7381 	if (cmd != DDI_DETACH)
7382 		return (DDI_FAILURE);
7383 
7384 	zfs_dip = NULL;
7385 
7386 	ddi_prop_remove_all(dip);
7387 	ddi_remove_minor_node(dip, NULL);
7388 
7389 	return (DDI_SUCCESS);
7390 }
7391 
7392 /*ARGSUSED*/
7393 static int
7394 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
7395 {
7396 	switch (infocmd) {
7397 	case DDI_INFO_DEVT2DEVINFO:
7398 		*result = zfs_dip;
7399 		return (DDI_SUCCESS);
7400 
7401 	case DDI_INFO_DEVT2INSTANCE:
7402 		*result = (void *)0;
7403 		return (DDI_SUCCESS);
7404 	}
7405 
7406 	return (DDI_FAILURE);
7407 }
7408 
7409 /*
7410  * OK, so this is a little weird.
7411  *
7412  * /dev/zfs is the control node, i.e. minor 0.
7413  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
7414  *
7415  * /dev/zfs has basically nothing to do except serve up ioctls,
7416  * so most of the standard driver entry points are in zvol.c.
7417  */
7418 static struct cb_ops zfs_cb_ops = {
7419 	zfsdev_open,	/* open */
7420 	zfsdev_close,	/* close */
7421 	zvol_strategy,	/* strategy */
7422 	nodev,		/* print */
7423 	zvol_dump,	/* dump */
7424 	zvol_read,	/* read */
7425 	zvol_write,	/* write */
7426 	zfsdev_ioctl,	/* ioctl */
7427 	nodev,		/* devmap */
7428 	nodev,		/* mmap */
7429 	nodev,		/* segmap */
7430 	nochpoll,	/* poll */
7431 	ddi_prop_op,	/* prop_op */
7432 	NULL,		/* streamtab */
7433 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
7434 	CB_REV,		/* version */
7435 	nodev,		/* async read */
7436 	nodev,		/* async write */
7437 };
7438 
7439 static struct dev_ops zfs_dev_ops = {
7440 	DEVO_REV,	/* version */
7441 	0,		/* refcnt */
7442 	zfs_info,	/* info */
7443 	nulldev,	/* identify */
7444 	nulldev,	/* probe */
7445 	zfs_attach,	/* attach */
7446 	zfs_detach,	/* detach */
7447 	nodev,		/* reset */
7448 	&zfs_cb_ops,	/* driver operations */
7449 	NULL,		/* no bus operations */
7450 	NULL,		/* power */
7451 	ddi_quiesce_not_needed,	/* quiesce */
7452 };
7453 
7454 static struct modldrv zfs_modldrv = {
7455 	&mod_driverops,
7456 	"ZFS storage pool",
7457 	&zfs_dev_ops
7458 };
7459 
7460 static struct modlinkage modlinkage = {
7461 	MODREV_1,
7462 	(void *)&zfs_modlfs,
7463 	(void *)&zfs_modldrv,
7464 	NULL
7465 };
7466 
7467 static void
7468 zfs_allow_log_destroy(void *arg)
7469 {
7470 	char *poolname = arg;
7471 	strfree(poolname);
7472 }
7473 
7474 int
7475 _init(void)
7476 {
7477 	int error;
7478 
7479 	spa_init(FREAD | FWRITE);
7480 	zfs_init();
7481 	zvol_init();
7482 	zfs_ioctl_init();
7483 
7484 	if ((error = mod_install(&modlinkage)) != 0) {
7485 		zvol_fini();
7486 		zfs_fini();
7487 		spa_fini();
7488 		return (error);
7489 	}
7490 
7491 	tsd_create(&zfs_fsyncer_key, NULL);
7492 	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
7493 	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
7494 
7495 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
7496 	ASSERT(error == 0);
7497 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
7498 
7499 	return (0);
7500 }
7501 
7502 int
7503 _fini(void)
7504 {
7505 	int error;
7506 
7507 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
7508 		return (SET_ERROR(EBUSY));
7509 
7510 	if ((error = mod_remove(&modlinkage)) != 0)
7511 		return (error);
7512 
7513 	zvol_fini();
7514 	zfs_fini();
7515 	spa_fini();
7516 	if (zfs_nfsshare_inited)
7517 		(void) ddi_modclose(nfs_mod);
7518 	if (zfs_smbshare_inited)
7519 		(void) ddi_modclose(smbsrv_mod);
7520 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
7521 		(void) ddi_modclose(sharefs_mod);
7522 
7523 	tsd_destroy(&zfs_fsyncer_key);
7524 	ldi_ident_release(zfs_li);
7525 	zfs_li = NULL;
7526 	mutex_destroy(&zfs_share_lock);
7527 
7528 	return (error);
7529 }
7530 
7531 int
7532 _info(struct modinfo *modinfop)
7533 {
7534 	return (mod_info(&modlinkage, modinfop));
7535 }
7536