xref: /titanic_41/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision d2eb38229d10d0077809edfbdc66da785bc33379)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Portions Copyright 2011 Martin Matuska
25  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
26  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
27  * Copyright (c) 2013 by Delphix. All rights reserved.
28  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
29  * Copyright (c) 2013 Steven Hartland. All rights reserved.
30  */
31 
32 /*
33  * ZFS ioctls.
34  *
35  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
36  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
37  *
38  * There are two ways that we handle ioctls: the legacy way where almost
39  * all of the logic is in the ioctl callback, and the new way where most
40  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
41  *
42  * Non-legacy ioctls should be registered by calling
43  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
44  * from userland by lzc_ioctl().
45  *
46  * The registration arguments are as follows:
47  *
48  * const char *name
49  *   The name of the ioctl.  This is used for history logging.  If the
50  *   ioctl returns successfully (the callback returns 0), and allow_log
51  *   is true, then a history log entry will be recorded with the input &
52  *   output nvlists.  The log entry can be printed with "zpool history -i".
53  *
54  * zfs_ioc_t ioc
55  *   The ioctl request number, which userland will pass to ioctl(2).
56  *   The ioctl numbers can change from release to release, because
57  *   the caller (libzfs) must be matched to the kernel.
58  *
59  * zfs_secpolicy_func_t *secpolicy
60  *   This function will be called before the zfs_ioc_func_t, to
61  *   determine if this operation is permitted.  It should return EPERM
62  *   on failure, and 0 on success.  Checks include determining if the
63  *   dataset is visible in this zone, and if the user has either all
64  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
65  *   to do this operation on this dataset with "zfs allow".
66  *
67  * zfs_ioc_namecheck_t namecheck
68  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
69  *   name, a dataset name, or nothing.  If the name is not well-formed,
70  *   the ioctl will fail and the callback will not be called.
71  *   Therefore, the callback can assume that the name is well-formed
72  *   (e.g. is null-terminated, doesn't have more than one '@' character,
73  *   doesn't have invalid characters).
74  *
75  * zfs_ioc_poolcheck_t pool_check
76  *   This specifies requirements on the pool state.  If the pool does
77  *   not meet them (is suspended or is readonly), the ioctl will fail
78  *   and the callback will not be called.  If any checks are specified
79  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
80  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
81  *   POOL_CHECK_READONLY).
82  *
83  * boolean_t smush_outnvlist
84  *   If smush_outnvlist is true, then the output is presumed to be a
85  *   list of errors, and it will be "smushed" down to fit into the
86  *   caller's buffer, by removing some entries and replacing them with a
87  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
88  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
89  *   outnvlist does not fit into the userland-provided buffer, then the
90  *   ioctl will fail with ENOMEM.
91  *
92  * zfs_ioc_func_t *func
93  *   The callback function that will perform the operation.
94  *
95  *   The callback should return 0 on success, or an error number on
96  *   failure.  If the function fails, the userland ioctl will return -1,
97  *   and errno will be set to the callback's return value.  The callback
98  *   will be called with the following arguments:
99  *
100  *   const char *name
101  *     The name of the pool or dataset to operate on, from
102  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
103  *     expected type (pool, dataset, or none).
104  *
105  *   nvlist_t *innvl
106  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
107  *     NULL if no input nvlist was provided.  Changes to this nvlist are
108  *     ignored.  If the input nvlist could not be deserialized, the
109  *     ioctl will fail and the callback will not be called.
110  *
111  *   nvlist_t *outnvl
112  *     The output nvlist, initially empty.  The callback can fill it in,
113  *     and it will be returned to userland by serializing it into
114  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
115  *     fails (e.g. because the caller didn't supply a large enough
116  *     buffer), then the overall ioctl will fail.  See the
117  *     'smush_nvlist' argument above for additional behaviors.
118  *
119  *     There are two typical uses of the output nvlist:
120  *       - To return state, e.g. property values.  In this case,
121  *         smush_outnvlist should be false.  If the buffer was not large
122  *         enough, the caller will reallocate a larger buffer and try
123  *         the ioctl again.
124  *
125  *       - To return multiple errors from an ioctl which makes on-disk
126  *         changes.  In this case, smush_outnvlist should be true.
127  *         Ioctls which make on-disk modifications should generally not
128  *         use the outnvl if they succeed, because the caller can not
129  *         distinguish between the operation failing, and
130  *         deserialization failing.
131  */
132 
133 #include <sys/types.h>
134 #include <sys/param.h>
135 #include <sys/errno.h>
136 #include <sys/uio.h>
137 #include <sys/buf.h>
138 #include <sys/modctl.h>
139 #include <sys/open.h>
140 #include <sys/file.h>
141 #include <sys/kmem.h>
142 #include <sys/conf.h>
143 #include <sys/cmn_err.h>
144 #include <sys/stat.h>
145 #include <sys/zfs_ioctl.h>
146 #include <sys/zfs_vfsops.h>
147 #include <sys/zfs_znode.h>
148 #include <sys/zap.h>
149 #include <sys/spa.h>
150 #include <sys/spa_impl.h>
151 #include <sys/vdev.h>
152 #include <sys/priv_impl.h>
153 #include <sys/dmu.h>
154 #include <sys/dsl_dir.h>
155 #include <sys/dsl_dataset.h>
156 #include <sys/dsl_prop.h>
157 #include <sys/dsl_deleg.h>
158 #include <sys/dmu_objset.h>
159 #include <sys/dmu_impl.h>
160 #include <sys/dmu_tx.h>
161 #include <sys/ddi.h>
162 #include <sys/sunddi.h>
163 #include <sys/sunldi.h>
164 #include <sys/policy.h>
165 #include <sys/zone.h>
166 #include <sys/nvpair.h>
167 #include <sys/pathname.h>
168 #include <sys/mount.h>
169 #include <sys/sdt.h>
170 #include <sys/fs/zfs.h>
171 #include <sys/zfs_ctldir.h>
172 #include <sys/zfs_dir.h>
173 #include <sys/zfs_onexit.h>
174 #include <sys/zvol.h>
175 #include <sys/dsl_scan.h>
176 #include <sharefs/share.h>
177 #include <sys/dmu_objset.h>
178 #include <sys/dmu_send.h>
179 #include <sys/dsl_destroy.h>
180 #include <sys/dsl_userhold.h>
181 #include <sys/zfeature.h>
182 #include <sys/zfs_events.h>
183 
184 #include "zfs_namecheck.h"
185 #include "zfs_prop.h"
186 #include "zfs_deleg.h"
187 #include "zfs_comutil.h"
188 
189 extern struct modlfs zfs_modlfs;
190 
191 extern void zfs_init(void);
192 extern void zfs_fini(void);
193 
194 ldi_ident_t zfs_li = NULL;
195 dev_info_t *zfs_dip;
196 
197 uint_t zfs_fsyncer_key;
198 extern uint_t rrw_tsd_key;
199 static uint_t zfs_allow_log_key;
200 
201 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
202 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
203 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
204 
205 typedef enum {
206 	NO_NAME,
207 	POOL_NAME,
208 	DATASET_NAME
209 } zfs_ioc_namecheck_t;
210 
211 typedef enum {
212 	POOL_CHECK_NONE		= 1 << 0,
213 	POOL_CHECK_SUSPENDED	= 1 << 1,
214 	POOL_CHECK_READONLY	= 1 << 2,
215 } zfs_ioc_poolcheck_t;
216 
217 typedef struct zfs_ioc_vec {
218 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
219 	zfs_ioc_func_t		*zvec_func;
220 	zfs_secpolicy_func_t	*zvec_secpolicy;
221 	zfs_ioc_namecheck_t	zvec_namecheck;
222 	boolean_t		zvec_allow_log;
223 	zfs_ioc_poolcheck_t	zvec_pool_check;
224 	boolean_t		zvec_smush_outnvlist;
225 	const char		*zvec_name;
226 } zfs_ioc_vec_t;
227 
228 /* This array is indexed by zfs_userquota_prop_t */
229 static const char *userquota_perms[] = {
230 	ZFS_DELEG_PERM_USERUSED,
231 	ZFS_DELEG_PERM_USERQUOTA,
232 	ZFS_DELEG_PERM_GROUPUSED,
233 	ZFS_DELEG_PERM_GROUPQUOTA,
234 };
235 
236 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
237 static int zfs_check_settable(const char *name, nvpair_t *property,
238     cred_t *cr);
239 static int zfs_check_clearable(char *dataset, nvlist_t *props,
240     nvlist_t **errors);
241 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
242     boolean_t *);
243 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
244 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
245 
246 static int zfs_prop_activate_feature(spa_t *spa, zfeature_info_t *feature);
247 
248 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
249 void
250 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
251 {
252 	const char *newfile;
253 	char buf[512];
254 	va_list adx;
255 
256 	/*
257 	 * Get rid of annoying "../common/" prefix to filename.
258 	 */
259 	newfile = strrchr(file, '/');
260 	if (newfile != NULL) {
261 		newfile = newfile + 1; /* Get rid of leading / */
262 	} else {
263 		newfile = file;
264 	}
265 
266 	va_start(adx, fmt);
267 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
268 	va_end(adx);
269 
270 	/*
271 	 * To get this data, use the zfs-dprintf probe as so:
272 	 * dtrace -q -n 'zfs-dprintf \
273 	 *	/stringof(arg0) == "dbuf.c"/ \
274 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
275 	 * arg0 = file name
276 	 * arg1 = function name
277 	 * arg2 = line number
278 	 * arg3 = message
279 	 */
280 	DTRACE_PROBE4(zfs__dprintf,
281 	    char *, newfile, char *, func, int, line, char *, buf);
282 }
283 
284 static void
285 history_str_free(char *buf)
286 {
287 	kmem_free(buf, HIS_MAX_RECORD_LEN);
288 }
289 
290 static char *
291 history_str_get(zfs_cmd_t *zc)
292 {
293 	char *buf;
294 
295 	if (zc->zc_history == NULL)
296 		return (NULL);
297 
298 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
299 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
300 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
301 		history_str_free(buf);
302 		return (NULL);
303 	}
304 
305 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
306 
307 	return (buf);
308 }
309 
310 /*
311  * Check to see if the named dataset is currently defined as bootable
312  */
313 static boolean_t
314 zfs_is_bootfs(const char *name)
315 {
316 	objset_t *os;
317 
318 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
319 		boolean_t ret;
320 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
321 		dmu_objset_rele(os, FTAG);
322 		return (ret);
323 	}
324 	return (B_FALSE);
325 }
326 
327 /*
328  * Return non-zero if the spa version is less than requested version.
329  */
330 static int
331 zfs_earlier_version(const char *name, int version)
332 {
333 	spa_t *spa;
334 
335 	if (spa_open(name, &spa, FTAG) == 0) {
336 		if (spa_version(spa) < version) {
337 			spa_close(spa, FTAG);
338 			return (1);
339 		}
340 		spa_close(spa, FTAG);
341 	}
342 	return (0);
343 }
344 
345 /*
346  * Return TRUE if the ZPL version is less than requested version.
347  */
348 static boolean_t
349 zpl_earlier_version(const char *name, int version)
350 {
351 	objset_t *os;
352 	boolean_t rc = B_TRUE;
353 
354 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
355 		uint64_t zplversion;
356 
357 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
358 			dmu_objset_rele(os, FTAG);
359 			return (B_TRUE);
360 		}
361 		/* XXX reading from non-owned objset */
362 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
363 			rc = zplversion < version;
364 		dmu_objset_rele(os, FTAG);
365 	}
366 	return (rc);
367 }
368 
369 static void
370 zfs_log_history(zfs_cmd_t *zc)
371 {
372 	spa_t *spa;
373 	char *buf;
374 
375 	if ((buf = history_str_get(zc)) == NULL)
376 		return;
377 
378 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
379 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
380 			(void) spa_history_log(spa, buf);
381 		spa_close(spa, FTAG);
382 	}
383 	history_str_free(buf);
384 }
385 
386 /*
387  * Policy for top-level read operations (list pools).  Requires no privileges,
388  * and can be used in the local zone, as there is no associated dataset.
389  */
390 /* ARGSUSED */
391 static int
392 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
393 {
394 	return (0);
395 }
396 
397 /*
398  * Policy for dataset read operations (list children, get statistics).  Requires
399  * no privileges, but must be visible in the local zone.
400  */
401 /* ARGSUSED */
402 static int
403 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
404 {
405 	if (INGLOBALZONE(curproc) ||
406 	    zone_dataset_visible(zc->zc_name, NULL))
407 		return (0);
408 
409 	return (SET_ERROR(ENOENT));
410 }
411 
412 static int
413 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
414 {
415 	int writable = 1;
416 
417 	/*
418 	 * The dataset must be visible by this zone -- check this first
419 	 * so they don't see EPERM on something they shouldn't know about.
420 	 */
421 	if (!INGLOBALZONE(curproc) &&
422 	    !zone_dataset_visible(dataset, &writable))
423 		return (SET_ERROR(ENOENT));
424 
425 	if (INGLOBALZONE(curproc)) {
426 		/*
427 		 * If the fs is zoned, only root can access it from the
428 		 * global zone.
429 		 */
430 		if (secpolicy_zfs(cr) && zoned)
431 			return (SET_ERROR(EPERM));
432 	} else {
433 		/*
434 		 * If we are in a local zone, the 'zoned' property must be set.
435 		 */
436 		if (!zoned)
437 			return (SET_ERROR(EPERM));
438 
439 		/* must be writable by this zone */
440 		if (!writable)
441 			return (SET_ERROR(EPERM));
442 	}
443 	return (0);
444 }
445 
446 static int
447 zfs_dozonecheck(const char *dataset, cred_t *cr)
448 {
449 	uint64_t zoned;
450 
451 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
452 		return (SET_ERROR(ENOENT));
453 
454 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
455 }
456 
457 static int
458 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
459 {
460 	uint64_t zoned;
461 
462 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
463 		return (SET_ERROR(ENOENT));
464 
465 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
466 }
467 
468 static int
469 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
470     const char *perm, cred_t *cr)
471 {
472 	int error;
473 
474 	error = zfs_dozonecheck_ds(name, ds, cr);
475 	if (error == 0) {
476 		error = secpolicy_zfs(cr);
477 		if (error != 0)
478 			error = dsl_deleg_access_impl(ds, perm, cr);
479 	}
480 	return (error);
481 }
482 
483 static int
484 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
485 {
486 	int error;
487 	dsl_dataset_t *ds;
488 	dsl_pool_t *dp;
489 
490 	error = dsl_pool_hold(name, FTAG, &dp);
491 	if (error != 0)
492 		return (error);
493 
494 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
495 	if (error != 0) {
496 		dsl_pool_rele(dp, FTAG);
497 		return (error);
498 	}
499 
500 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
501 
502 	dsl_dataset_rele(ds, FTAG);
503 	dsl_pool_rele(dp, FTAG);
504 	return (error);
505 }
506 
507 /*
508  * Policy for setting the security label property.
509  *
510  * Returns 0 for success, non-zero for access and other errors.
511  */
512 static int
513 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
514 {
515 	char		ds_hexsl[MAXNAMELEN];
516 	bslabel_t	ds_sl, new_sl;
517 	boolean_t	new_default = FALSE;
518 	uint64_t	zoned;
519 	int		needed_priv = -1;
520 	int		error;
521 
522 	/* First get the existing dataset label. */
523 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
524 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
525 	if (error != 0)
526 		return (SET_ERROR(EPERM));
527 
528 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
529 		new_default = TRUE;
530 
531 	/* The label must be translatable */
532 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
533 		return (SET_ERROR(EINVAL));
534 
535 	/*
536 	 * In a non-global zone, disallow attempts to set a label that
537 	 * doesn't match that of the zone; otherwise no other checks
538 	 * are needed.
539 	 */
540 	if (!INGLOBALZONE(curproc)) {
541 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
542 			return (SET_ERROR(EPERM));
543 		return (0);
544 	}
545 
546 	/*
547 	 * For global-zone datasets (i.e., those whose zoned property is
548 	 * "off", verify that the specified new label is valid for the
549 	 * global zone.
550 	 */
551 	if (dsl_prop_get_integer(name,
552 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
553 		return (SET_ERROR(EPERM));
554 	if (!zoned) {
555 		if (zfs_check_global_label(name, strval) != 0)
556 			return (SET_ERROR(EPERM));
557 	}
558 
559 	/*
560 	 * If the existing dataset label is nondefault, check if the
561 	 * dataset is mounted (label cannot be changed while mounted).
562 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
563 	 * mounted (or isn't a dataset, doesn't exist, ...).
564 	 */
565 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
566 		objset_t *os;
567 		static char *setsl_tag = "setsl_tag";
568 
569 		/*
570 		 * Try to own the dataset; abort if there is any error,
571 		 * (e.g., already mounted, in use, or other error).
572 		 */
573 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
574 		    setsl_tag, &os);
575 		if (error != 0)
576 			return (SET_ERROR(EPERM));
577 
578 		dmu_objset_disown(os, setsl_tag);
579 
580 		if (new_default) {
581 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
582 			goto out_check;
583 		}
584 
585 		if (hexstr_to_label(strval, &new_sl) != 0)
586 			return (SET_ERROR(EPERM));
587 
588 		if (blstrictdom(&ds_sl, &new_sl))
589 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
590 		else if (blstrictdom(&new_sl, &ds_sl))
591 			needed_priv = PRIV_FILE_UPGRADE_SL;
592 	} else {
593 		/* dataset currently has a default label */
594 		if (!new_default)
595 			needed_priv = PRIV_FILE_UPGRADE_SL;
596 	}
597 
598 out_check:
599 	if (needed_priv != -1)
600 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
601 	return (0);
602 }
603 
604 static int
605 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
606     cred_t *cr)
607 {
608 	char *strval;
609 
610 	/*
611 	 * Check permissions for special properties.
612 	 */
613 	switch (prop) {
614 	case ZFS_PROP_ZONED:
615 		/*
616 		 * Disallow setting of 'zoned' from within a local zone.
617 		 */
618 		if (!INGLOBALZONE(curproc))
619 			return (SET_ERROR(EPERM));
620 		break;
621 
622 	case ZFS_PROP_QUOTA:
623 		if (!INGLOBALZONE(curproc)) {
624 			uint64_t zoned;
625 			char setpoint[MAXNAMELEN];
626 			/*
627 			 * Unprivileged users are allowed to modify the
628 			 * quota on things *under* (ie. contained by)
629 			 * the thing they own.
630 			 */
631 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
632 			    setpoint))
633 				return (SET_ERROR(EPERM));
634 			if (!zoned || strlen(dsname) <= strlen(setpoint))
635 				return (SET_ERROR(EPERM));
636 		}
637 		break;
638 
639 	case ZFS_PROP_MLSLABEL:
640 		if (!is_system_labeled())
641 			return (SET_ERROR(EPERM));
642 
643 		if (nvpair_value_string(propval, &strval) == 0) {
644 			int err;
645 
646 			err = zfs_set_slabel_policy(dsname, strval, CRED());
647 			if (err != 0)
648 				return (err);
649 		}
650 		break;
651 	}
652 
653 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
654 }
655 
656 /* ARGSUSED */
657 static int
658 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
659 {
660 	int error;
661 
662 	error = zfs_dozonecheck(zc->zc_name, cr);
663 	if (error != 0)
664 		return (error);
665 
666 	/*
667 	 * permission to set permissions will be evaluated later in
668 	 * dsl_deleg_can_allow()
669 	 */
670 	return (0);
671 }
672 
673 /* ARGSUSED */
674 static int
675 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
676 {
677 	return (zfs_secpolicy_write_perms(zc->zc_name,
678 	    ZFS_DELEG_PERM_ROLLBACK, cr));
679 }
680 
681 /* ARGSUSED */
682 static int
683 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
684 {
685 	dsl_pool_t *dp;
686 	dsl_dataset_t *ds;
687 	char *cp;
688 	int error;
689 
690 	/*
691 	 * Generate the current snapshot name from the given objsetid, then
692 	 * use that name for the secpolicy/zone checks.
693 	 */
694 	cp = strchr(zc->zc_name, '@');
695 	if (cp == NULL)
696 		return (SET_ERROR(EINVAL));
697 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
698 	if (error != 0)
699 		return (error);
700 
701 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
702 	if (error != 0) {
703 		dsl_pool_rele(dp, FTAG);
704 		return (error);
705 	}
706 
707 	dsl_dataset_name(ds, zc->zc_name);
708 
709 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
710 	    ZFS_DELEG_PERM_SEND, cr);
711 	dsl_dataset_rele(ds, FTAG);
712 	dsl_pool_rele(dp, FTAG);
713 
714 	return (error);
715 }
716 
717 /* ARGSUSED */
718 static int
719 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
720 {
721 	return (zfs_secpolicy_write_perms(zc->zc_name,
722 	    ZFS_DELEG_PERM_SEND, cr));
723 }
724 
725 /* ARGSUSED */
726 static int
727 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
728 {
729 	vnode_t *vp;
730 	int error;
731 
732 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
733 	    NO_FOLLOW, NULL, &vp)) != 0)
734 		return (error);
735 
736 	/* Now make sure mntpnt and dataset are ZFS */
737 
738 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
739 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
740 	    zc->zc_name) != 0)) {
741 		VN_RELE(vp);
742 		return (SET_ERROR(EPERM));
743 	}
744 
745 	VN_RELE(vp);
746 	return (dsl_deleg_access(zc->zc_name,
747 	    ZFS_DELEG_PERM_SHARE, cr));
748 }
749 
750 int
751 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
752 {
753 	if (!INGLOBALZONE(curproc))
754 		return (SET_ERROR(EPERM));
755 
756 	if (secpolicy_nfs(cr) == 0) {
757 		return (0);
758 	} else {
759 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
760 	}
761 }
762 
763 int
764 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
765 {
766 	if (!INGLOBALZONE(curproc))
767 		return (SET_ERROR(EPERM));
768 
769 	if (secpolicy_smb(cr) == 0) {
770 		return (0);
771 	} else {
772 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
773 	}
774 }
775 
776 static int
777 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
778 {
779 	char *cp;
780 
781 	/*
782 	 * Remove the @bla or /bla from the end of the name to get the parent.
783 	 */
784 	(void) strncpy(parent, datasetname, parentsize);
785 	cp = strrchr(parent, '@');
786 	if (cp != NULL) {
787 		cp[0] = '\0';
788 	} else {
789 		cp = strrchr(parent, '/');
790 		if (cp == NULL)
791 			return (SET_ERROR(ENOENT));
792 		cp[0] = '\0';
793 	}
794 
795 	return (0);
796 }
797 
798 int
799 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
800 {
801 	int error;
802 
803 	if ((error = zfs_secpolicy_write_perms(name,
804 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
805 		return (error);
806 
807 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
808 }
809 
810 /* ARGSUSED */
811 static int
812 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
813 {
814 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
815 }
816 
817 /*
818  * Destroying snapshots with delegated permissions requires
819  * descendant mount and destroy permissions.
820  */
821 /* ARGSUSED */
822 static int
823 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
824 {
825 	nvlist_t *snaps;
826 	nvpair_t *pair, *nextpair;
827 	int error = 0;
828 
829 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
830 		return (SET_ERROR(EINVAL));
831 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
832 	    pair = nextpair) {
833 		dsl_pool_t *dp;
834 		dsl_dataset_t *ds;
835 
836 		error = dsl_pool_hold(nvpair_name(pair), FTAG, &dp);
837 		if (error != 0)
838 			break;
839 		nextpair = nvlist_next_nvpair(snaps, pair);
840 		error = dsl_dataset_hold(dp, nvpair_name(pair), FTAG, &ds);
841 		if (error == 0)
842 			dsl_dataset_rele(ds, FTAG);
843 		dsl_pool_rele(dp, FTAG);
844 
845 		if (error == 0) {
846 			error = zfs_secpolicy_destroy_perms(nvpair_name(pair),
847 			    cr);
848 		} else if (error == ENOENT) {
849 			/*
850 			 * Ignore any snapshots that don't exist (we consider
851 			 * them "already destroyed").  Remove the name from the
852 			 * nvl here in case the snapshot is created between
853 			 * now and when we try to destroy it (in which case
854 			 * we don't want to destroy it since we haven't
855 			 * checked for permission).
856 			 */
857 			fnvlist_remove_nvpair(snaps, pair);
858 			error = 0;
859 		}
860 		if (error != 0)
861 			break;
862 	}
863 
864 	return (error);
865 }
866 
867 int
868 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
869 {
870 	char	parentname[MAXNAMELEN];
871 	int	error;
872 
873 	if ((error = zfs_secpolicy_write_perms(from,
874 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
875 		return (error);
876 
877 	if ((error = zfs_secpolicy_write_perms(from,
878 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
879 		return (error);
880 
881 	if ((error = zfs_get_parent(to, parentname,
882 	    sizeof (parentname))) != 0)
883 		return (error);
884 
885 	if ((error = zfs_secpolicy_write_perms(parentname,
886 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
887 		return (error);
888 
889 	if ((error = zfs_secpolicy_write_perms(parentname,
890 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
891 		return (error);
892 
893 	return (error);
894 }
895 
896 /* ARGSUSED */
897 static int
898 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
899 {
900 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
901 }
902 
903 /* ARGSUSED */
904 static int
905 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
906 {
907 	dsl_pool_t *dp;
908 	dsl_dataset_t *clone;
909 	int error;
910 
911 	error = zfs_secpolicy_write_perms(zc->zc_name,
912 	    ZFS_DELEG_PERM_PROMOTE, cr);
913 	if (error != 0)
914 		return (error);
915 
916 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
917 	if (error != 0)
918 		return (error);
919 
920 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
921 
922 	if (error == 0) {
923 		char parentname[MAXNAMELEN];
924 		dsl_dataset_t *origin = NULL;
925 		dsl_dir_t *dd;
926 		dd = clone->ds_dir;
927 
928 		error = dsl_dataset_hold_obj(dd->dd_pool,
929 		    dd->dd_phys->dd_origin_obj, FTAG, &origin);
930 		if (error != 0) {
931 			dsl_dataset_rele(clone, FTAG);
932 			dsl_pool_rele(dp, FTAG);
933 			return (error);
934 		}
935 
936 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
937 		    ZFS_DELEG_PERM_MOUNT, cr);
938 
939 		dsl_dataset_name(origin, parentname);
940 		if (error == 0) {
941 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
942 			    ZFS_DELEG_PERM_PROMOTE, cr);
943 		}
944 		dsl_dataset_rele(clone, FTAG);
945 		dsl_dataset_rele(origin, FTAG);
946 	}
947 	dsl_pool_rele(dp, FTAG);
948 	return (error);
949 }
950 
951 /* ARGSUSED */
952 static int
953 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
954 {
955 	int error;
956 
957 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
958 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
959 		return (error);
960 
961 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
962 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
963 		return (error);
964 
965 	return (zfs_secpolicy_write_perms(zc->zc_name,
966 	    ZFS_DELEG_PERM_CREATE, cr));
967 }
968 
969 int
970 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
971 {
972 	return (zfs_secpolicy_write_perms(name,
973 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
974 }
975 
976 /*
977  * Check for permission to create each snapshot in the nvlist.
978  */
979 /* ARGSUSED */
980 static int
981 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
982 {
983 	nvlist_t *snaps;
984 	int error = 0;
985 	nvpair_t *pair;
986 
987 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
988 		return (SET_ERROR(EINVAL));
989 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
990 	    pair = nvlist_next_nvpair(snaps, pair)) {
991 		char *name = nvpair_name(pair);
992 		char *atp = strchr(name, '@');
993 
994 		if (atp == NULL) {
995 			error = SET_ERROR(EINVAL);
996 			break;
997 		}
998 		*atp = '\0';
999 		error = zfs_secpolicy_snapshot_perms(name, cr);
1000 		*atp = '@';
1001 		if (error != 0)
1002 			break;
1003 	}
1004 	return (error);
1005 }
1006 
1007 /* ARGSUSED */
1008 static int
1009 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1010 {
1011 	/*
1012 	 * Even root must have a proper TSD so that we know what pool
1013 	 * to log to.
1014 	 */
1015 	if (tsd_get(zfs_allow_log_key) == NULL)
1016 		return (SET_ERROR(EPERM));
1017 	return (0);
1018 }
1019 
1020 static int
1021 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1022 {
1023 	char	parentname[MAXNAMELEN];
1024 	int	error;
1025 	char	*origin;
1026 
1027 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1028 	    sizeof (parentname))) != 0)
1029 		return (error);
1030 
1031 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1032 	    (error = zfs_secpolicy_write_perms(origin,
1033 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1034 		return (error);
1035 
1036 	if ((error = zfs_secpolicy_write_perms(parentname,
1037 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1038 		return (error);
1039 
1040 	return (zfs_secpolicy_write_perms(parentname,
1041 	    ZFS_DELEG_PERM_MOUNT, cr));
1042 }
1043 
1044 /*
1045  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1046  * SYS_CONFIG privilege, which is not available in a local zone.
1047  */
1048 /* ARGSUSED */
1049 static int
1050 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1051 {
1052 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1053 		return (SET_ERROR(EPERM));
1054 
1055 	return (0);
1056 }
1057 
1058 /*
1059  * Policy for object to name lookups.
1060  */
1061 /* ARGSUSED */
1062 static int
1063 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1064 {
1065 	int error;
1066 
1067 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1068 		return (0);
1069 
1070 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1071 	return (error);
1072 }
1073 
1074 /*
1075  * Policy for fault injection.  Requires all privileges.
1076  */
1077 /* ARGSUSED */
1078 static int
1079 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1080 {
1081 	return (secpolicy_zinject(cr));
1082 }
1083 
1084 /* ARGSUSED */
1085 static int
1086 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1087 {
1088 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1089 
1090 	if (prop == ZPROP_INVAL) {
1091 		if (!zfs_prop_user(zc->zc_value))
1092 			return (SET_ERROR(EINVAL));
1093 		return (zfs_secpolicy_write_perms(zc->zc_name,
1094 		    ZFS_DELEG_PERM_USERPROP, cr));
1095 	} else {
1096 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1097 		    NULL, cr));
1098 	}
1099 }
1100 
1101 static int
1102 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1103 {
1104 	int err = zfs_secpolicy_read(zc, innvl, cr);
1105 	if (err)
1106 		return (err);
1107 
1108 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1109 		return (SET_ERROR(EINVAL));
1110 
1111 	if (zc->zc_value[0] == 0) {
1112 		/*
1113 		 * They are asking about a posix uid/gid.  If it's
1114 		 * themself, allow it.
1115 		 */
1116 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1117 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1118 			if (zc->zc_guid == crgetuid(cr))
1119 				return (0);
1120 		} else {
1121 			if (groupmember(zc->zc_guid, cr))
1122 				return (0);
1123 		}
1124 	}
1125 
1126 	return (zfs_secpolicy_write_perms(zc->zc_name,
1127 	    userquota_perms[zc->zc_objset_type], cr));
1128 }
1129 
1130 static int
1131 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1132 {
1133 	int err = zfs_secpolicy_read(zc, innvl, cr);
1134 	if (err)
1135 		return (err);
1136 
1137 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1138 		return (SET_ERROR(EINVAL));
1139 
1140 	return (zfs_secpolicy_write_perms(zc->zc_name,
1141 	    userquota_perms[zc->zc_objset_type], cr));
1142 }
1143 
1144 /* ARGSUSED */
1145 static int
1146 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1147 {
1148 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1149 	    NULL, cr));
1150 }
1151 
1152 /* ARGSUSED */
1153 static int
1154 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1155 {
1156 	nvpair_t *pair;
1157 	nvlist_t *holds;
1158 	int error;
1159 
1160 	error = nvlist_lookup_nvlist(innvl, "holds", &holds);
1161 	if (error != 0)
1162 		return (SET_ERROR(EINVAL));
1163 
1164 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1165 	    pair = nvlist_next_nvpair(holds, pair)) {
1166 		char fsname[MAXNAMELEN];
1167 		error = dmu_fsname(nvpair_name(pair), fsname);
1168 		if (error != 0)
1169 			return (error);
1170 		error = zfs_secpolicy_write_perms(fsname,
1171 		    ZFS_DELEG_PERM_HOLD, cr);
1172 		if (error != 0)
1173 			return (error);
1174 	}
1175 	return (0);
1176 }
1177 
1178 /* ARGSUSED */
1179 static int
1180 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1181 {
1182 	nvpair_t *pair;
1183 	int error;
1184 
1185 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1186 	    pair = nvlist_next_nvpair(innvl, pair)) {
1187 		char fsname[MAXNAMELEN];
1188 		error = dmu_fsname(nvpair_name(pair), fsname);
1189 		if (error != 0)
1190 			return (error);
1191 		error = zfs_secpolicy_write_perms(fsname,
1192 		    ZFS_DELEG_PERM_RELEASE, cr);
1193 		if (error != 0)
1194 			return (error);
1195 	}
1196 	return (0);
1197 }
1198 
1199 /*
1200  * Policy for allowing temporary snapshots to be taken or released
1201  */
1202 static int
1203 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1204 {
1205 	/*
1206 	 * A temporary snapshot is the same as a snapshot,
1207 	 * hold, destroy and release all rolled into one.
1208 	 * Delegated diff alone is sufficient that we allow this.
1209 	 */
1210 	int error;
1211 
1212 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1213 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1214 		return (0);
1215 
1216 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1217 	if (error == 0)
1218 		error = zfs_secpolicy_hold(zc, innvl, cr);
1219 	if (error == 0)
1220 		error = zfs_secpolicy_release(zc, innvl, cr);
1221 	if (error == 0)
1222 		error = zfs_secpolicy_destroy(zc, innvl, cr);
1223 	return (error);
1224 }
1225 
1226 /*
1227  * Policy for allowing setting the zev callback list.
1228  */
1229 static int
1230 zfs_secpolicy_set_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1231 {
1232 	/* must be called from kernel context */
1233 	if (!(zc->zc_iflags & FKIOCTL))
1234 		return (SET_ERROR(EPERM));
1235 	/* callback pointer must be unset (set to default value) */
1236 	rw_enter(&rz_zev_rwlock, RW_READER);
1237 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
1238 		rw_exit(&rz_zev_rwlock);
1239 		return (SET_ERROR(EBUSY));
1240 	}
1241 	rw_exit(&rz_zev_rwlock);
1242 	return (0);
1243 }
1244 
1245 /*
1246  * Policy for allowing unsetting/resetting the zev callback list.
1247  */
1248 static int
1249 zfs_secpolicy_unset_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1250 {
1251 	/* must be called from kernel context */
1252 	if (!(zc->zc_iflags & FKIOCTL))
1253 		return (SET_ERROR(EPERM));
1254 	return (0);
1255 }
1256 
1257 /*
1258  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1259  */
1260 static int
1261 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1262 {
1263 	char *packed;
1264 	int error;
1265 	nvlist_t *list = NULL;
1266 
1267 	/*
1268 	 * Read in and unpack the user-supplied nvlist.
1269 	 */
1270 	if (size == 0)
1271 		return (SET_ERROR(EINVAL));
1272 
1273 	packed = kmem_alloc(size, KM_SLEEP);
1274 
1275 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1276 	    iflag)) != 0) {
1277 		kmem_free(packed, size);
1278 		return (error);
1279 	}
1280 
1281 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1282 		kmem_free(packed, size);
1283 		return (error);
1284 	}
1285 
1286 	kmem_free(packed, size);
1287 
1288 	*nvp = list;
1289 	return (0);
1290 }
1291 
1292 /*
1293  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1294  * Entries will be removed from the end of the nvlist, and one int32 entry
1295  * named "N_MORE_ERRORS" will be added indicating how many entries were
1296  * removed.
1297  */
1298 static int
1299 nvlist_smush(nvlist_t *errors, size_t max)
1300 {
1301 	size_t size;
1302 
1303 	size = fnvlist_size(errors);
1304 
1305 	if (size > max) {
1306 		nvpair_t *more_errors;
1307 		int n = 0;
1308 
1309 		if (max < 1024)
1310 			return (SET_ERROR(ENOMEM));
1311 
1312 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1313 		more_errors = nvlist_prev_nvpair(errors, NULL);
1314 
1315 		do {
1316 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1317 			    more_errors);
1318 			fnvlist_remove_nvpair(errors, pair);
1319 			n++;
1320 			size = fnvlist_size(errors);
1321 		} while (size > max);
1322 
1323 		fnvlist_remove_nvpair(errors, more_errors);
1324 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1325 		ASSERT3U(fnvlist_size(errors), <=, max);
1326 	}
1327 
1328 	return (0);
1329 }
1330 
1331 static int
1332 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1333 {
1334 	char *packed = NULL;
1335 	int error = 0;
1336 	size_t size;
1337 
1338 	size = fnvlist_size(nvl);
1339 
1340 	if (size > zc->zc_nvlist_dst_size) {
1341 		error = SET_ERROR(ENOMEM);
1342 	} else {
1343 		packed = fnvlist_pack(nvl, &size);
1344 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1345 		    size, zc->zc_iflags) != 0)
1346 			error = SET_ERROR(EFAULT);
1347 		fnvlist_pack_free(packed, size);
1348 	}
1349 
1350 	zc->zc_nvlist_dst_size = size;
1351 	zc->zc_nvlist_dst_filled = B_TRUE;
1352 	return (error);
1353 }
1354 
1355 static int
1356 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1357 {
1358 	objset_t *os;
1359 	int error;
1360 
1361 	error = dmu_objset_hold(dsname, FTAG, &os);
1362 	if (error != 0)
1363 		return (error);
1364 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1365 		dmu_objset_rele(os, FTAG);
1366 		return (SET_ERROR(EINVAL));
1367 	}
1368 
1369 	mutex_enter(&os->os_user_ptr_lock);
1370 	*zfvp = dmu_objset_get_user(os);
1371 	if (*zfvp) {
1372 		VFS_HOLD((*zfvp)->z_vfs);
1373 	} else {
1374 		error = SET_ERROR(ESRCH);
1375 	}
1376 	mutex_exit(&os->os_user_ptr_lock);
1377 	dmu_objset_rele(os, FTAG);
1378 	return (error);
1379 }
1380 
1381 /*
1382  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1383  * case its z_vfs will be NULL, and it will be opened as the owner.
1384  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1385  * which prevents all vnode ops from running.
1386  */
1387 static int
1388 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1389 {
1390 	int error = 0;
1391 
1392 	if (getzfsvfs(name, zfvp) != 0)
1393 		error = zfsvfs_create(name, zfvp);
1394 	if (error == 0) {
1395 		rrw_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1396 		    RW_READER, tag);
1397 		if ((*zfvp)->z_unmounted) {
1398 			/*
1399 			 * XXX we could probably try again, since the unmounting
1400 			 * thread should be just about to disassociate the
1401 			 * objset from the zfsvfs.
1402 			 */
1403 			rrw_exit(&(*zfvp)->z_teardown_lock, tag);
1404 			return (SET_ERROR(EBUSY));
1405 		}
1406 	}
1407 	return (error);
1408 }
1409 
1410 static void
1411 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1412 {
1413 	rrw_exit(&zfsvfs->z_teardown_lock, tag);
1414 
1415 	if (zfsvfs->z_vfs) {
1416 		VFS_RELE(zfsvfs->z_vfs);
1417 	} else {
1418 		dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1419 		zfsvfs_free(zfsvfs);
1420 	}
1421 }
1422 
1423 static int
1424 zfs_ioc_pool_create(zfs_cmd_t *zc)
1425 {
1426 	int error;
1427 	nvlist_t *config, *props = NULL;
1428 	nvlist_t *rootprops = NULL;
1429 	nvlist_t *zplprops = NULL;
1430 
1431 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1432 	    zc->zc_iflags, &config))
1433 		return (error);
1434 
1435 	if (zc->zc_nvlist_src_size != 0 && (error =
1436 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1437 	    zc->zc_iflags, &props))) {
1438 		nvlist_free(config);
1439 		return (error);
1440 	}
1441 
1442 	if (props) {
1443 		nvlist_t *nvl = NULL;
1444 		uint64_t version = SPA_VERSION;
1445 
1446 		(void) nvlist_lookup_uint64(props,
1447 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1448 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1449 			error = SET_ERROR(EINVAL);
1450 			goto pool_props_bad;
1451 		}
1452 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1453 		if (nvl) {
1454 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1455 			if (error != 0) {
1456 				nvlist_free(config);
1457 				nvlist_free(props);
1458 				return (error);
1459 			}
1460 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1461 		}
1462 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1463 		error = zfs_fill_zplprops_root(version, rootprops,
1464 		    zplprops, NULL);
1465 		if (error != 0)
1466 			goto pool_props_bad;
1467 	}
1468 
1469 	error = spa_create(zc->zc_name, config, props, zplprops);
1470 
1471 	/*
1472 	 * Set the remaining root properties
1473 	 */
1474 	if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1475 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1476 		(void) spa_destroy(zc->zc_name);
1477 
1478 pool_props_bad:
1479 	nvlist_free(rootprops);
1480 	nvlist_free(zplprops);
1481 	nvlist_free(config);
1482 	nvlist_free(props);
1483 
1484 	return (error);
1485 }
1486 
1487 static int
1488 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1489 {
1490 	int error;
1491 	zfs_log_history(zc);
1492 	error = spa_destroy(zc->zc_name);
1493 	if (error == 0)
1494 		zvol_remove_minors(zc->zc_name);
1495 	return (error);
1496 }
1497 
1498 static int
1499 zfs_ioc_pool_import(zfs_cmd_t *zc)
1500 {
1501 	nvlist_t *config, *props = NULL;
1502 	uint64_t guid;
1503 	int error;
1504 
1505 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1506 	    zc->zc_iflags, &config)) != 0)
1507 		return (error);
1508 
1509 	if (zc->zc_nvlist_src_size != 0 && (error =
1510 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1511 	    zc->zc_iflags, &props))) {
1512 		nvlist_free(config);
1513 		return (error);
1514 	}
1515 
1516 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1517 	    guid != zc->zc_guid)
1518 		error = SET_ERROR(EINVAL);
1519 	else
1520 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1521 
1522 	if (zc->zc_nvlist_dst != 0) {
1523 		int err;
1524 
1525 		if ((err = put_nvlist(zc, config)) != 0)
1526 			error = err;
1527 	}
1528 
1529 	nvlist_free(config);
1530 
1531 	if (props)
1532 		nvlist_free(props);
1533 
1534 	return (error);
1535 }
1536 
1537 static int
1538 zfs_ioc_pool_export(zfs_cmd_t *zc)
1539 {
1540 	int error;
1541 	boolean_t force = (boolean_t)zc->zc_cookie;
1542 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1543 
1544 	zfs_log_history(zc);
1545 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1546 	if (error == 0)
1547 		zvol_remove_minors(zc->zc_name);
1548 	return (error);
1549 }
1550 
1551 static int
1552 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1553 {
1554 	nvlist_t *configs;
1555 	int error;
1556 
1557 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1558 		return (SET_ERROR(EEXIST));
1559 
1560 	error = put_nvlist(zc, configs);
1561 
1562 	nvlist_free(configs);
1563 
1564 	return (error);
1565 }
1566 
1567 /*
1568  * inputs:
1569  * zc_name		name of the pool
1570  *
1571  * outputs:
1572  * zc_cookie		real errno
1573  * zc_nvlist_dst	config nvlist
1574  * zc_nvlist_dst_size	size of config nvlist
1575  */
1576 static int
1577 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1578 {
1579 	nvlist_t *config;
1580 	int error;
1581 	int ret = 0;
1582 
1583 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1584 	    sizeof (zc->zc_value));
1585 
1586 	if (config != NULL) {
1587 		ret = put_nvlist(zc, config);
1588 		nvlist_free(config);
1589 
1590 		/*
1591 		 * The config may be present even if 'error' is non-zero.
1592 		 * In this case we return success, and preserve the real errno
1593 		 * in 'zc_cookie'.
1594 		 */
1595 		zc->zc_cookie = error;
1596 	} else {
1597 		ret = error;
1598 	}
1599 
1600 	return (ret);
1601 }
1602 
1603 /*
1604  * Try to import the given pool, returning pool stats as appropriate so that
1605  * user land knows which devices are available and overall pool health.
1606  */
1607 static int
1608 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1609 {
1610 	nvlist_t *tryconfig, *config;
1611 	int error;
1612 
1613 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1614 	    zc->zc_iflags, &tryconfig)) != 0)
1615 		return (error);
1616 
1617 	config = spa_tryimport(tryconfig);
1618 
1619 	nvlist_free(tryconfig);
1620 
1621 	if (config == NULL)
1622 		return (SET_ERROR(EINVAL));
1623 
1624 	error = put_nvlist(zc, config);
1625 	nvlist_free(config);
1626 
1627 	return (error);
1628 }
1629 
1630 /*
1631  * inputs:
1632  * zc_name              name of the pool
1633  * zc_cookie            scan func (pool_scan_func_t)
1634  */
1635 static int
1636 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1637 {
1638 	spa_t *spa;
1639 	int error;
1640 
1641 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1642 		return (error);
1643 
1644 	if (zc->zc_cookie == POOL_SCAN_NONE)
1645 		error = spa_scan_stop(spa);
1646 	else
1647 		error = spa_scan(spa, zc->zc_cookie);
1648 
1649 	spa_close(spa, FTAG);
1650 
1651 	return (error);
1652 }
1653 
1654 static int
1655 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1656 {
1657 	spa_t *spa;
1658 	int error;
1659 
1660 	error = spa_open(zc->zc_name, &spa, FTAG);
1661 	if (error == 0) {
1662 		spa_freeze(spa);
1663 		spa_close(spa, FTAG);
1664 	}
1665 	return (error);
1666 }
1667 
1668 static int
1669 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1670 {
1671 	spa_t *spa;
1672 	int error;
1673 
1674 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1675 		return (error);
1676 
1677 	if (zc->zc_cookie < spa_version(spa) ||
1678 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1679 		spa_close(spa, FTAG);
1680 		return (SET_ERROR(EINVAL));
1681 	}
1682 
1683 	spa_upgrade(spa, zc->zc_cookie);
1684 	spa_close(spa, FTAG);
1685 
1686 	return (error);
1687 }
1688 
1689 static int
1690 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1691 {
1692 	spa_t *spa;
1693 	char *hist_buf;
1694 	uint64_t size;
1695 	int error;
1696 
1697 	if ((size = zc->zc_history_len) == 0)
1698 		return (SET_ERROR(EINVAL));
1699 
1700 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1701 		return (error);
1702 
1703 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1704 		spa_close(spa, FTAG);
1705 		return (SET_ERROR(ENOTSUP));
1706 	}
1707 
1708 	hist_buf = kmem_alloc(size, KM_SLEEP);
1709 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1710 	    &zc->zc_history_len, hist_buf)) == 0) {
1711 		error = ddi_copyout(hist_buf,
1712 		    (void *)(uintptr_t)zc->zc_history,
1713 		    zc->zc_history_len, zc->zc_iflags);
1714 	}
1715 
1716 	spa_close(spa, FTAG);
1717 	kmem_free(hist_buf, size);
1718 	return (error);
1719 }
1720 
1721 static int
1722 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1723 {
1724 	spa_t *spa;
1725 	int error;
1726 
1727 	error = spa_open(zc->zc_name, &spa, FTAG);
1728 	if (error == 0) {
1729 		error = spa_change_guid(spa);
1730 		spa_close(spa, FTAG);
1731 	}
1732 	return (error);
1733 }
1734 
1735 static int
1736 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1737 {
1738 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1739 }
1740 
1741 /*
1742  * inputs:
1743  * zc_name		name of filesystem
1744  * zc_obj		object to find
1745  *
1746  * outputs:
1747  * zc_value		name of object
1748  */
1749 static int
1750 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1751 {
1752 	objset_t *os;
1753 	int error;
1754 
1755 	/* XXX reading from objset not owned */
1756 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1757 		return (error);
1758 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1759 		dmu_objset_rele(os, FTAG);
1760 		return (SET_ERROR(EINVAL));
1761 	}
1762 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1763 	    sizeof (zc->zc_value));
1764 	dmu_objset_rele(os, FTAG);
1765 
1766 	return (error);
1767 }
1768 
1769 /*
1770  * inputs:
1771  * zc_name		name of filesystem
1772  * zc_obj		object to find
1773  *
1774  * outputs:
1775  * zc_stat		stats on object
1776  * zc_value		path to object
1777  */
1778 static int
1779 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1780 {
1781 	objset_t *os;
1782 	int error;
1783 
1784 	/* XXX reading from objset not owned */
1785 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1786 		return (error);
1787 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1788 		dmu_objset_rele(os, FTAG);
1789 		return (SET_ERROR(EINVAL));
1790 	}
1791 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1792 	    sizeof (zc->zc_value));
1793 	dmu_objset_rele(os, FTAG);
1794 
1795 	return (error);
1796 }
1797 
1798 static int
1799 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1800 {
1801 	spa_t *spa;
1802 	int error;
1803 	nvlist_t *config, **l2cache, **spares;
1804 	uint_t nl2cache = 0, nspares = 0;
1805 
1806 	error = spa_open(zc->zc_name, &spa, FTAG);
1807 	if (error != 0)
1808 		return (error);
1809 
1810 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1811 	    zc->zc_iflags, &config);
1812 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1813 	    &l2cache, &nl2cache);
1814 
1815 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1816 	    &spares, &nspares);
1817 
1818 	/*
1819 	 * A root pool with concatenated devices is not supported.
1820 	 * Thus, can not add a device to a root pool.
1821 	 *
1822 	 * Intent log device can not be added to a rootpool because
1823 	 * during mountroot, zil is replayed, a seperated log device
1824 	 * can not be accessed during the mountroot time.
1825 	 *
1826 	 * l2cache and spare devices are ok to be added to a rootpool.
1827 	 */
1828 	if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1829 		nvlist_free(config);
1830 		spa_close(spa, FTAG);
1831 		return (SET_ERROR(EDOM));
1832 	}
1833 
1834 	if (error == 0) {
1835 		error = spa_vdev_add(spa, config);
1836 		nvlist_free(config);
1837 	}
1838 	spa_close(spa, FTAG);
1839 	return (error);
1840 }
1841 
1842 /*
1843  * inputs:
1844  * zc_name		name of the pool
1845  * zc_nvlist_conf	nvlist of devices to remove
1846  * zc_cookie		to stop the remove?
1847  */
1848 static int
1849 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1850 {
1851 	spa_t *spa;
1852 	int error;
1853 
1854 	error = spa_open(zc->zc_name, &spa, FTAG);
1855 	if (error != 0)
1856 		return (error);
1857 	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1858 	spa_close(spa, FTAG);
1859 	return (error);
1860 }
1861 
1862 static int
1863 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1864 {
1865 	spa_t *spa;
1866 	int error;
1867 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1868 
1869 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1870 		return (error);
1871 	switch (zc->zc_cookie) {
1872 	case VDEV_STATE_ONLINE:
1873 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1874 		break;
1875 
1876 	case VDEV_STATE_OFFLINE:
1877 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1878 		break;
1879 
1880 	case VDEV_STATE_FAULTED:
1881 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1882 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1883 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1884 
1885 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1886 		break;
1887 
1888 	case VDEV_STATE_DEGRADED:
1889 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1890 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1891 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1892 
1893 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1894 		break;
1895 
1896 	default:
1897 		error = SET_ERROR(EINVAL);
1898 	}
1899 	zc->zc_cookie = newstate;
1900 	spa_close(spa, FTAG);
1901 	return (error);
1902 }
1903 
1904 static int
1905 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1906 {
1907 	spa_t *spa;
1908 	int replacing = zc->zc_cookie;
1909 	nvlist_t *config;
1910 	int error;
1911 
1912 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1913 		return (error);
1914 
1915 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1916 	    zc->zc_iflags, &config)) == 0) {
1917 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
1918 		nvlist_free(config);
1919 	}
1920 
1921 	spa_close(spa, FTAG);
1922 	return (error);
1923 }
1924 
1925 static int
1926 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
1927 {
1928 	spa_t *spa;
1929 	int error;
1930 
1931 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1932 		return (error);
1933 
1934 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
1935 
1936 	spa_close(spa, FTAG);
1937 	return (error);
1938 }
1939 
1940 static int
1941 zfs_ioc_vdev_split(zfs_cmd_t *zc)
1942 {
1943 	spa_t *spa;
1944 	nvlist_t *config, *props = NULL;
1945 	int error;
1946 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
1947 
1948 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1949 		return (error);
1950 
1951 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1952 	    zc->zc_iflags, &config)) {
1953 		spa_close(spa, FTAG);
1954 		return (error);
1955 	}
1956 
1957 	if (zc->zc_nvlist_src_size != 0 && (error =
1958 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1959 	    zc->zc_iflags, &props))) {
1960 		spa_close(spa, FTAG);
1961 		nvlist_free(config);
1962 		return (error);
1963 	}
1964 
1965 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
1966 
1967 	spa_close(spa, FTAG);
1968 
1969 	nvlist_free(config);
1970 	nvlist_free(props);
1971 
1972 	return (error);
1973 }
1974 
1975 static int
1976 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
1977 {
1978 	spa_t *spa;
1979 	char *path = zc->zc_value;
1980 	uint64_t guid = zc->zc_guid;
1981 	int error;
1982 
1983 	error = spa_open(zc->zc_name, &spa, FTAG);
1984 	if (error != 0)
1985 		return (error);
1986 
1987 	error = spa_vdev_setpath(spa, guid, path);
1988 	spa_close(spa, FTAG);
1989 	return (error);
1990 }
1991 
1992 static int
1993 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
1994 {
1995 	spa_t *spa;
1996 	char *fru = zc->zc_value;
1997 	uint64_t guid = zc->zc_guid;
1998 	int error;
1999 
2000 	error = spa_open(zc->zc_name, &spa, FTAG);
2001 	if (error != 0)
2002 		return (error);
2003 
2004 	error = spa_vdev_setfru(spa, guid, fru);
2005 	spa_close(spa, FTAG);
2006 	return (error);
2007 }
2008 
2009 static int
2010 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2011 {
2012 	int error = 0;
2013 	nvlist_t *nv;
2014 
2015 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2016 
2017 	if (zc->zc_nvlist_dst != 0 &&
2018 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2019 		dmu_objset_stats(os, nv);
2020 		/*
2021 		 * NB: zvol_get_stats() will read the objset contents,
2022 		 * which we aren't supposed to do with a
2023 		 * DS_MODE_USER hold, because it could be
2024 		 * inconsistent.  So this is a bit of a workaround...
2025 		 * XXX reading with out owning
2026 		 */
2027 		if (!zc->zc_objset_stats.dds_inconsistent &&
2028 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2029 			error = zvol_get_stats(os, nv);
2030 			if (error == EIO)
2031 				return (error);
2032 			VERIFY0(error);
2033 		}
2034 		error = put_nvlist(zc, nv);
2035 		nvlist_free(nv);
2036 	}
2037 
2038 	return (error);
2039 }
2040 
2041 /*
2042  * inputs:
2043  * zc_name		name of filesystem
2044  * zc_nvlist_dst_size	size of buffer for property nvlist
2045  *
2046  * outputs:
2047  * zc_objset_stats	stats
2048  * zc_nvlist_dst	property nvlist
2049  * zc_nvlist_dst_size	size of property nvlist
2050  */
2051 static int
2052 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2053 {
2054 	objset_t *os;
2055 	int error;
2056 
2057 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2058 	if (error == 0) {
2059 		error = zfs_ioc_objset_stats_impl(zc, os);
2060 		dmu_objset_rele(os, FTAG);
2061 	}
2062 
2063 	return (error);
2064 }
2065 
2066 /*
2067  * inputs:
2068  * zc_name		name of filesystem
2069  * zc_nvlist_dst_size	size of buffer for property nvlist
2070  *
2071  * outputs:
2072  * zc_nvlist_dst	received property nvlist
2073  * zc_nvlist_dst_size	size of received property nvlist
2074  *
2075  * Gets received properties (distinct from local properties on or after
2076  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2077  * local property values.
2078  */
2079 static int
2080 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2081 {
2082 	int error = 0;
2083 	nvlist_t *nv;
2084 
2085 	/*
2086 	 * Without this check, we would return local property values if the
2087 	 * caller has not already received properties on or after
2088 	 * SPA_VERSION_RECVD_PROPS.
2089 	 */
2090 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2091 		return (SET_ERROR(ENOTSUP));
2092 
2093 	if (zc->zc_nvlist_dst != 0 &&
2094 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2095 		error = put_nvlist(zc, nv);
2096 		nvlist_free(nv);
2097 	}
2098 
2099 	return (error);
2100 }
2101 
2102 static int
2103 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2104 {
2105 	uint64_t value;
2106 	int error;
2107 
2108 	/*
2109 	 * zfs_get_zplprop() will either find a value or give us
2110 	 * the default value (if there is one).
2111 	 */
2112 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2113 		return (error);
2114 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2115 	return (0);
2116 }
2117 
2118 /*
2119  * inputs:
2120  * zc_name		name of filesystem
2121  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2122  *
2123  * outputs:
2124  * zc_nvlist_dst	zpl property nvlist
2125  * zc_nvlist_dst_size	size of zpl property nvlist
2126  */
2127 static int
2128 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2129 {
2130 	objset_t *os;
2131 	int err;
2132 
2133 	/* XXX reading without owning */
2134 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2135 		return (err);
2136 
2137 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2138 
2139 	/*
2140 	 * NB: nvl_add_zplprop() will read the objset contents,
2141 	 * which we aren't supposed to do with a DS_MODE_USER
2142 	 * hold, because it could be inconsistent.
2143 	 */
2144 	if (zc->zc_nvlist_dst != NULL &&
2145 	    !zc->zc_objset_stats.dds_inconsistent &&
2146 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2147 		nvlist_t *nv;
2148 
2149 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2150 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2151 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2152 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2153 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2154 			err = put_nvlist(zc, nv);
2155 		nvlist_free(nv);
2156 	} else {
2157 		err = SET_ERROR(ENOENT);
2158 	}
2159 	dmu_objset_rele(os, FTAG);
2160 	return (err);
2161 }
2162 
2163 static boolean_t
2164 dataset_name_hidden(const char *name)
2165 {
2166 	/*
2167 	 * Skip over datasets that are not visible in this zone,
2168 	 * internal datasets (which have a $ in their name), and
2169 	 * temporary datasets (which have a % in their name).
2170 	 */
2171 	if (strchr(name, '$') != NULL)
2172 		return (B_TRUE);
2173 	if (strchr(name, '%') != NULL)
2174 		return (B_TRUE);
2175 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2176 		return (B_TRUE);
2177 	return (B_FALSE);
2178 }
2179 
2180 /*
2181  * inputs:
2182  * zc_name		name of filesystem
2183  * zc_cookie		zap cursor
2184  * zc_nvlist_dst_size	size of buffer for property nvlist
2185  *
2186  * outputs:
2187  * zc_name		name of next filesystem
2188  * zc_cookie		zap cursor
2189  * zc_objset_stats	stats
2190  * zc_nvlist_dst	property nvlist
2191  * zc_nvlist_dst_size	size of property nvlist
2192  */
2193 static int
2194 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2195 {
2196 	objset_t *os;
2197 	int error;
2198 	char *p;
2199 	size_t orig_len = strlen(zc->zc_name);
2200 
2201 top:
2202 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2203 		if (error == ENOENT)
2204 			error = SET_ERROR(ESRCH);
2205 		return (error);
2206 	}
2207 
2208 	p = strrchr(zc->zc_name, '/');
2209 	if (p == NULL || p[1] != '\0')
2210 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2211 	p = zc->zc_name + strlen(zc->zc_name);
2212 
2213 	do {
2214 		error = dmu_dir_list_next(os,
2215 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2216 		    NULL, &zc->zc_cookie);
2217 		if (error == ENOENT)
2218 			error = SET_ERROR(ESRCH);
2219 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2220 	dmu_objset_rele(os, FTAG);
2221 
2222 	/*
2223 	 * If it's an internal dataset (ie. with a '$' in its name),
2224 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2225 	 */
2226 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2227 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2228 		if (error == ENOENT) {
2229 			/* We lost a race with destroy, get the next one. */
2230 			zc->zc_name[orig_len] = '\0';
2231 			goto top;
2232 		}
2233 	}
2234 	return (error);
2235 }
2236 
2237 /*
2238  * inputs:
2239  * zc_name		name of filesystem
2240  * zc_cookie		zap cursor
2241  * zc_nvlist_dst_size	size of buffer for property nvlist
2242  *
2243  * outputs:
2244  * zc_name		name of next snapshot
2245  * zc_objset_stats	stats
2246  * zc_nvlist_dst	property nvlist
2247  * zc_nvlist_dst_size	size of property nvlist
2248  */
2249 static int
2250 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2251 {
2252 	objset_t *os;
2253 	int error;
2254 
2255 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2256 	if (error != 0) {
2257 		return (error == ENOENT ? ESRCH : error);
2258 	}
2259 
2260 	/*
2261 	 * A dataset name of maximum length cannot have any snapshots,
2262 	 * so exit immediately.
2263 	 */
2264 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
2265 		dmu_objset_rele(os, FTAG);
2266 		return (SET_ERROR(ESRCH));
2267 	}
2268 
2269 	error = dmu_snapshot_list_next(os,
2270 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2271 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2272 	    NULL);
2273 
2274 	if (error == 0) {
2275 		dsl_dataset_t *ds;
2276 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2277 
2278 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2279 		if (error == 0) {
2280 			objset_t *ossnap;
2281 
2282 			error = dmu_objset_from_ds(ds, &ossnap);
2283 			if (error == 0)
2284 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2285 			dsl_dataset_rele(ds, FTAG);
2286 		}
2287 	} else if (error == ENOENT) {
2288 		error = SET_ERROR(ESRCH);
2289 	}
2290 
2291 	dmu_objset_rele(os, FTAG);
2292 	/* if we failed, undo the @ that we tacked on to zc_name */
2293 	if (error != 0)
2294 		*strchr(zc->zc_name, '@') = '\0';
2295 	return (error);
2296 }
2297 
2298 static int
2299 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2300 {
2301 	const char *propname = nvpair_name(pair);
2302 	uint64_t *valary;
2303 	unsigned int vallen;
2304 	const char *domain;
2305 	char *dash;
2306 	zfs_userquota_prop_t type;
2307 	uint64_t rid;
2308 	uint64_t quota;
2309 	zfsvfs_t *zfsvfs;
2310 	int err;
2311 
2312 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2313 		nvlist_t *attrs;
2314 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2315 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2316 		    &pair) != 0)
2317 			return (SET_ERROR(EINVAL));
2318 	}
2319 
2320 	/*
2321 	 * A correctly constructed propname is encoded as
2322 	 * userquota@<rid>-<domain>.
2323 	 */
2324 	if ((dash = strchr(propname, '-')) == NULL ||
2325 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2326 	    vallen != 3)
2327 		return (SET_ERROR(EINVAL));
2328 
2329 	domain = dash + 1;
2330 	type = valary[0];
2331 	rid = valary[1];
2332 	quota = valary[2];
2333 
2334 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2335 	if (err == 0) {
2336 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2337 		zfsvfs_rele(zfsvfs, FTAG);
2338 	}
2339 
2340 	return (err);
2341 }
2342 
2343 /*
2344  * If the named property is one that has a special function to set its value,
2345  * return 0 on success and a positive error code on failure; otherwise if it is
2346  * not one of the special properties handled by this function, return -1.
2347  *
2348  * XXX: It would be better for callers of the property interface if we handled
2349  * these special cases in dsl_prop.c (in the dsl layer).
2350  */
2351 static int
2352 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2353     nvpair_t *pair)
2354 {
2355 	const char *propname = nvpair_name(pair);
2356 	zfs_prop_t prop = zfs_name_to_prop(propname);
2357 	uint64_t intval;
2358 	int err;
2359 
2360 	if (prop == ZPROP_INVAL) {
2361 		if (zfs_prop_userquota(propname))
2362 			return (zfs_prop_set_userquota(dsname, pair));
2363 		return (-1);
2364 	}
2365 
2366 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2367 		nvlist_t *attrs;
2368 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2369 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2370 		    &pair) == 0);
2371 	}
2372 
2373 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2374 		return (-1);
2375 
2376 	VERIFY(0 == nvpair_value_uint64(pair, &intval));
2377 
2378 	switch (prop) {
2379 	case ZFS_PROP_QUOTA:
2380 		err = dsl_dir_set_quota(dsname, source, intval);
2381 		break;
2382 	case ZFS_PROP_REFQUOTA:
2383 		err = dsl_dataset_set_refquota(dsname, source, intval);
2384 		break;
2385 	case ZFS_PROP_RESERVATION:
2386 		err = dsl_dir_set_reservation(dsname, source, intval);
2387 		break;
2388 	case ZFS_PROP_REFRESERVATION:
2389 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2390 		break;
2391 	case ZFS_PROP_VOLSIZE:
2392 		err = zvol_set_volsize(dsname, intval);
2393 		break;
2394 	case ZFS_PROP_VERSION:
2395 	{
2396 		zfsvfs_t *zfsvfs;
2397 
2398 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2399 			break;
2400 
2401 		err = zfs_set_version(zfsvfs, intval);
2402 		zfsvfs_rele(zfsvfs, FTAG);
2403 
2404 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2405 			zfs_cmd_t *zc;
2406 
2407 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2408 			(void) strcpy(zc->zc_name, dsname);
2409 			(void) zfs_ioc_userspace_upgrade(zc);
2410 			kmem_free(zc, sizeof (zfs_cmd_t));
2411 		}
2412 		break;
2413 	}
2414 	case ZFS_PROP_COMPRESSION:
2415 	{
2416 		if (intval == ZIO_COMPRESS_LZ4) {
2417 			zfeature_info_t *feature =
2418 			    &spa_feature_table[SPA_FEATURE_LZ4_COMPRESS];
2419 			spa_t *spa;
2420 
2421 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
2422 				return (err);
2423 
2424 			/*
2425 			 * Setting the LZ4 compression algorithm activates
2426 			 * the feature.
2427 			 */
2428 			if (!spa_feature_is_active(spa, feature)) {
2429 				if ((err = zfs_prop_activate_feature(spa,
2430 				    feature)) != 0) {
2431 					spa_close(spa, FTAG);
2432 					return (err);
2433 				}
2434 			}
2435 
2436 			spa_close(spa, FTAG);
2437 		}
2438 		/*
2439 		 * We still want the default set action to be performed in the
2440 		 * caller, we only performed zfeature settings here.
2441 		 */
2442 		err = -1;
2443 		break;
2444 	}
2445 
2446 	default:
2447 		err = -1;
2448 	}
2449 
2450 	return (err);
2451 }
2452 
2453 /*
2454  * This function is best effort. If it fails to set any of the given properties,
2455  * it continues to set as many as it can and returns the last error
2456  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2457  * with the list of names of all the properties that failed along with the
2458  * corresponding error numbers.
2459  *
2460  * If every property is set successfully, zero is returned and errlist is not
2461  * modified.
2462  */
2463 int
2464 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2465     nvlist_t *errlist)
2466 {
2467 	nvpair_t *pair;
2468 	nvpair_t *propval;
2469 	int rv = 0;
2470 	uint64_t intval;
2471 	char *strval;
2472 	nvlist_t *genericnvl = fnvlist_alloc();
2473 	nvlist_t *retrynvl = fnvlist_alloc();
2474 
2475 retry:
2476 	pair = NULL;
2477 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2478 		const char *propname = nvpair_name(pair);
2479 		zfs_prop_t prop = zfs_name_to_prop(propname);
2480 		int err = 0;
2481 
2482 		/* decode the property value */
2483 		propval = pair;
2484 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2485 			nvlist_t *attrs;
2486 			attrs = fnvpair_value_nvlist(pair);
2487 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2488 			    &propval) != 0)
2489 				err = SET_ERROR(EINVAL);
2490 		}
2491 
2492 		/* Validate value type */
2493 		if (err == 0 && prop == ZPROP_INVAL) {
2494 			if (zfs_prop_user(propname)) {
2495 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2496 					err = SET_ERROR(EINVAL);
2497 			} else if (zfs_prop_userquota(propname)) {
2498 				if (nvpair_type(propval) !=
2499 				    DATA_TYPE_UINT64_ARRAY)
2500 					err = SET_ERROR(EINVAL);
2501 			} else {
2502 				err = SET_ERROR(EINVAL);
2503 			}
2504 		} else if (err == 0) {
2505 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2506 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2507 					err = SET_ERROR(EINVAL);
2508 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2509 				const char *unused;
2510 
2511 				intval = fnvpair_value_uint64(propval);
2512 
2513 				switch (zfs_prop_get_type(prop)) {
2514 				case PROP_TYPE_NUMBER:
2515 					break;
2516 				case PROP_TYPE_STRING:
2517 					err = SET_ERROR(EINVAL);
2518 					break;
2519 				case PROP_TYPE_INDEX:
2520 					if (zfs_prop_index_to_string(prop,
2521 					    intval, &unused) != 0)
2522 						err = SET_ERROR(EINVAL);
2523 					break;
2524 				default:
2525 					cmn_err(CE_PANIC,
2526 					    "unknown property type");
2527 				}
2528 			} else {
2529 				err = SET_ERROR(EINVAL);
2530 			}
2531 		}
2532 
2533 		/* Validate permissions */
2534 		if (err == 0)
2535 			err = zfs_check_settable(dsname, pair, CRED());
2536 
2537 		if (err == 0) {
2538 			err = zfs_prop_set_special(dsname, source, pair);
2539 			if (err == -1) {
2540 				/*
2541 				 * For better performance we build up a list of
2542 				 * properties to set in a single transaction.
2543 				 */
2544 				err = nvlist_add_nvpair(genericnvl, pair);
2545 			} else if (err != 0 && nvl != retrynvl) {
2546 				/*
2547 				 * This may be a spurious error caused by
2548 				 * receiving quota and reservation out of order.
2549 				 * Try again in a second pass.
2550 				 */
2551 				err = nvlist_add_nvpair(retrynvl, pair);
2552 			}
2553 		}
2554 
2555 		if (err != 0) {
2556 			if (errlist != NULL)
2557 				fnvlist_add_int32(errlist, propname, err);
2558 			rv = err;
2559 		}
2560 	}
2561 
2562 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2563 		nvl = retrynvl;
2564 		goto retry;
2565 	}
2566 
2567 	if (!nvlist_empty(genericnvl) &&
2568 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2569 		/*
2570 		 * If this fails, we still want to set as many properties as we
2571 		 * can, so try setting them individually.
2572 		 */
2573 		pair = NULL;
2574 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2575 			const char *propname = nvpair_name(pair);
2576 			int err = 0;
2577 
2578 			propval = pair;
2579 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2580 				nvlist_t *attrs;
2581 				attrs = fnvpair_value_nvlist(pair);
2582 				propval = fnvlist_lookup_nvpair(attrs,
2583 				    ZPROP_VALUE);
2584 			}
2585 
2586 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2587 				strval = fnvpair_value_string(propval);
2588 				err = dsl_prop_set_string(dsname, propname,
2589 				    source, strval);
2590 			} else {
2591 				intval = fnvpair_value_uint64(propval);
2592 				err = dsl_prop_set_int(dsname, propname, source,
2593 				    intval);
2594 			}
2595 
2596 			if (err != 0) {
2597 				if (errlist != NULL) {
2598 					fnvlist_add_int32(errlist, propname,
2599 					    err);
2600 				}
2601 				rv = err;
2602 			}
2603 		}
2604 	}
2605 	nvlist_free(genericnvl);
2606 	nvlist_free(retrynvl);
2607 
2608 	return (rv);
2609 }
2610 
2611 /*
2612  * Check that all the properties are valid user properties.
2613  */
2614 static int
2615 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2616 {
2617 	nvpair_t *pair = NULL;
2618 	int error = 0;
2619 
2620 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2621 		const char *propname = nvpair_name(pair);
2622 		char *valstr;
2623 
2624 		if (!zfs_prop_user(propname) ||
2625 		    nvpair_type(pair) != DATA_TYPE_STRING)
2626 			return (SET_ERROR(EINVAL));
2627 
2628 		if (error = zfs_secpolicy_write_perms(fsname,
2629 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2630 			return (error);
2631 
2632 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2633 			return (SET_ERROR(ENAMETOOLONG));
2634 
2635 		VERIFY(nvpair_value_string(pair, &valstr) == 0);
2636 		if (strlen(valstr) >= ZAP_MAXVALUELEN)
2637 			return (E2BIG);
2638 	}
2639 	return (0);
2640 }
2641 
2642 static void
2643 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2644 {
2645 	nvpair_t *pair;
2646 
2647 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2648 
2649 	pair = NULL;
2650 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2651 		if (nvlist_exists(skipped, nvpair_name(pair)))
2652 			continue;
2653 
2654 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2655 	}
2656 }
2657 
2658 static int
2659 clear_received_props(const char *dsname, nvlist_t *props,
2660     nvlist_t *skipped)
2661 {
2662 	int err = 0;
2663 	nvlist_t *cleared_props = NULL;
2664 	props_skip(props, skipped, &cleared_props);
2665 	if (!nvlist_empty(cleared_props)) {
2666 		/*
2667 		 * Acts on local properties until the dataset has received
2668 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2669 		 */
2670 		zprop_source_t flags = (ZPROP_SRC_NONE |
2671 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2672 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2673 	}
2674 	nvlist_free(cleared_props);
2675 	return (err);
2676 }
2677 
2678 /*
2679  * inputs:
2680  * zc_name		name of filesystem
2681  * zc_value		name of property to set
2682  * zc_nvlist_src{_size}	nvlist of properties to apply
2683  * zc_cookie		received properties flag
2684  *
2685  * outputs:
2686  * zc_nvlist_dst{_size} error for each unapplied received property
2687  */
2688 static int
2689 zfs_ioc_set_prop(zfs_cmd_t *zc)
2690 {
2691 	nvlist_t *nvl;
2692 	boolean_t received = zc->zc_cookie;
2693 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2694 	    ZPROP_SRC_LOCAL);
2695 	nvlist_t *errors;
2696 	int error;
2697 
2698 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2699 	    zc->zc_iflags, &nvl)) != 0)
2700 		return (error);
2701 
2702 	if (received) {
2703 		nvlist_t *origprops;
2704 
2705 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2706 			(void) clear_received_props(zc->zc_name,
2707 			    origprops, nvl);
2708 			nvlist_free(origprops);
2709 		}
2710 
2711 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2712 	}
2713 
2714 	errors = fnvlist_alloc();
2715 	if (error == 0)
2716 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2717 
2718 	if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2719 		(void) put_nvlist(zc, errors);
2720 	}
2721 
2722 	nvlist_free(errors);
2723 	nvlist_free(nvl);
2724 	return (error);
2725 }
2726 
2727 /*
2728  * inputs:
2729  * zc_name		name of filesystem
2730  * zc_value		name of property to inherit
2731  * zc_cookie		revert to received value if TRUE
2732  *
2733  * outputs:		none
2734  */
2735 static int
2736 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2737 {
2738 	const char *propname = zc->zc_value;
2739 	zfs_prop_t prop = zfs_name_to_prop(propname);
2740 	boolean_t received = zc->zc_cookie;
2741 	zprop_source_t source = (received
2742 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2743 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2744 
2745 	if (received) {
2746 		nvlist_t *dummy;
2747 		nvpair_t *pair;
2748 		zprop_type_t type;
2749 		int err;
2750 
2751 		/*
2752 		 * zfs_prop_set_special() expects properties in the form of an
2753 		 * nvpair with type info.
2754 		 */
2755 		if (prop == ZPROP_INVAL) {
2756 			if (!zfs_prop_user(propname))
2757 				return (SET_ERROR(EINVAL));
2758 
2759 			type = PROP_TYPE_STRING;
2760 		} else if (prop == ZFS_PROP_VOLSIZE ||
2761 		    prop == ZFS_PROP_VERSION) {
2762 			return (SET_ERROR(EINVAL));
2763 		} else {
2764 			type = zfs_prop_get_type(prop);
2765 		}
2766 
2767 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2768 
2769 		switch (type) {
2770 		case PROP_TYPE_STRING:
2771 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2772 			break;
2773 		case PROP_TYPE_NUMBER:
2774 		case PROP_TYPE_INDEX:
2775 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2776 			break;
2777 		default:
2778 			nvlist_free(dummy);
2779 			return (SET_ERROR(EINVAL));
2780 		}
2781 
2782 		pair = nvlist_next_nvpair(dummy, NULL);
2783 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2784 		nvlist_free(dummy);
2785 		if (err != -1)
2786 			return (err); /* special property already handled */
2787 	} else {
2788 		/*
2789 		 * Only check this in the non-received case. We want to allow
2790 		 * 'inherit -S' to revert non-inheritable properties like quota
2791 		 * and reservation to the received or default values even though
2792 		 * they are not considered inheritable.
2793 		 */
2794 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2795 			return (SET_ERROR(EINVAL));
2796 	}
2797 
2798 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2799 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2800 }
2801 
2802 static int
2803 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2804 {
2805 	nvlist_t *props;
2806 	spa_t *spa;
2807 	int error;
2808 	nvpair_t *pair;
2809 
2810 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2811 	    zc->zc_iflags, &props))
2812 		return (error);
2813 
2814 	/*
2815 	 * If the only property is the configfile, then just do a spa_lookup()
2816 	 * to handle the faulted case.
2817 	 */
2818 	pair = nvlist_next_nvpair(props, NULL);
2819 	if (pair != NULL && strcmp(nvpair_name(pair),
2820 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2821 	    nvlist_next_nvpair(props, pair) == NULL) {
2822 		mutex_enter(&spa_namespace_lock);
2823 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2824 			spa_configfile_set(spa, props, B_FALSE);
2825 			spa_config_sync(spa, B_FALSE, B_TRUE);
2826 		}
2827 		mutex_exit(&spa_namespace_lock);
2828 		if (spa != NULL) {
2829 			nvlist_free(props);
2830 			return (0);
2831 		}
2832 	}
2833 
2834 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2835 		nvlist_free(props);
2836 		return (error);
2837 	}
2838 
2839 	error = spa_prop_set(spa, props);
2840 
2841 	nvlist_free(props);
2842 	spa_close(spa, FTAG);
2843 
2844 	return (error);
2845 }
2846 
2847 static int
2848 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2849 {
2850 	spa_t *spa;
2851 	int error;
2852 	nvlist_t *nvp = NULL;
2853 
2854 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2855 		/*
2856 		 * If the pool is faulted, there may be properties we can still
2857 		 * get (such as altroot and cachefile), so attempt to get them
2858 		 * anyway.
2859 		 */
2860 		mutex_enter(&spa_namespace_lock);
2861 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
2862 			error = spa_prop_get(spa, &nvp);
2863 		mutex_exit(&spa_namespace_lock);
2864 	} else {
2865 		error = spa_prop_get(spa, &nvp);
2866 		spa_close(spa, FTAG);
2867 	}
2868 
2869 	if (error == 0 && zc->zc_nvlist_dst != NULL)
2870 		error = put_nvlist(zc, nvp);
2871 	else
2872 		error = SET_ERROR(EFAULT);
2873 
2874 	nvlist_free(nvp);
2875 	return (error);
2876 }
2877 
2878 /*
2879  * inputs:
2880  * zc_name		name of filesystem
2881  * zc_nvlist_src{_size}	nvlist of delegated permissions
2882  * zc_perm_action	allow/unallow flag
2883  *
2884  * outputs:		none
2885  */
2886 static int
2887 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2888 {
2889 	int error;
2890 	nvlist_t *fsaclnv = NULL;
2891 
2892 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2893 	    zc->zc_iflags, &fsaclnv)) != 0)
2894 		return (error);
2895 
2896 	/*
2897 	 * Verify nvlist is constructed correctly
2898 	 */
2899 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2900 		nvlist_free(fsaclnv);
2901 		return (SET_ERROR(EINVAL));
2902 	}
2903 
2904 	/*
2905 	 * If we don't have PRIV_SYS_MOUNT, then validate
2906 	 * that user is allowed to hand out each permission in
2907 	 * the nvlist(s)
2908 	 */
2909 
2910 	error = secpolicy_zfs(CRED());
2911 	if (error != 0) {
2912 		if (zc->zc_perm_action == B_FALSE) {
2913 			error = dsl_deleg_can_allow(zc->zc_name,
2914 			    fsaclnv, CRED());
2915 		} else {
2916 			error = dsl_deleg_can_unallow(zc->zc_name,
2917 			    fsaclnv, CRED());
2918 		}
2919 	}
2920 
2921 	if (error == 0)
2922 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2923 
2924 	nvlist_free(fsaclnv);
2925 	return (error);
2926 }
2927 
2928 /*
2929  * inputs:
2930  * zc_name		name of filesystem
2931  *
2932  * outputs:
2933  * zc_nvlist_src{_size}	nvlist of delegated permissions
2934  */
2935 static int
2936 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
2937 {
2938 	nvlist_t *nvp;
2939 	int error;
2940 
2941 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
2942 		error = put_nvlist(zc, nvp);
2943 		nvlist_free(nvp);
2944 	}
2945 
2946 	return (error);
2947 }
2948 
2949 /*
2950  * Search the vfs list for a specified resource.  Returns a pointer to it
2951  * or NULL if no suitable entry is found. The caller of this routine
2952  * is responsible for releasing the returned vfs pointer.
2953  */
2954 static vfs_t *
2955 zfs_get_vfs(const char *resource)
2956 {
2957 	struct vfs *vfsp;
2958 	struct vfs *vfs_found = NULL;
2959 
2960 	vfs_list_read_lock();
2961 	vfsp = rootvfs;
2962 	do {
2963 		if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
2964 			VFS_HOLD(vfsp);
2965 			vfs_found = vfsp;
2966 			break;
2967 		}
2968 		vfsp = vfsp->vfs_next;
2969 	} while (vfsp != rootvfs);
2970 	vfs_list_unlock();
2971 	return (vfs_found);
2972 }
2973 
2974 /* ARGSUSED */
2975 static void
2976 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
2977 {
2978 	zfs_creat_t *zct = arg;
2979 
2980 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
2981 }
2982 
2983 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
2984 
2985 /*
2986  * inputs:
2987  * os			parent objset pointer (NULL if root fs)
2988  * fuids_ok		fuids allowed in this version of the spa?
2989  * sa_ok		SAs allowed in this version of the spa?
2990  * createprops		list of properties requested by creator
2991  *
2992  * outputs:
2993  * zplprops	values for the zplprops we attach to the master node object
2994  * is_ci	true if requested file system will be purely case-insensitive
2995  *
2996  * Determine the settings for utf8only, normalization and
2997  * casesensitivity.  Specific values may have been requested by the
2998  * creator and/or we can inherit values from the parent dataset.  If
2999  * the file system is of too early a vintage, a creator can not
3000  * request settings for these properties, even if the requested
3001  * setting is the default value.  We don't actually want to create dsl
3002  * properties for these, so remove them from the source nvlist after
3003  * processing.
3004  */
3005 static int
3006 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3007     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3008     nvlist_t *zplprops, boolean_t *is_ci)
3009 {
3010 	uint64_t sense = ZFS_PROP_UNDEFINED;
3011 	uint64_t norm = ZFS_PROP_UNDEFINED;
3012 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3013 
3014 	ASSERT(zplprops != NULL);
3015 
3016 	/*
3017 	 * Pull out creator prop choices, if any.
3018 	 */
3019 	if (createprops) {
3020 		(void) nvlist_lookup_uint64(createprops,
3021 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3022 		(void) nvlist_lookup_uint64(createprops,
3023 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3024 		(void) nvlist_remove_all(createprops,
3025 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3026 		(void) nvlist_lookup_uint64(createprops,
3027 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3028 		(void) nvlist_remove_all(createprops,
3029 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3030 		(void) nvlist_lookup_uint64(createprops,
3031 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3032 		(void) nvlist_remove_all(createprops,
3033 		    zfs_prop_to_name(ZFS_PROP_CASE));
3034 	}
3035 
3036 	/*
3037 	 * If the zpl version requested is whacky or the file system
3038 	 * or pool is version is too "young" to support normalization
3039 	 * and the creator tried to set a value for one of the props,
3040 	 * error out.
3041 	 */
3042 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3043 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3044 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3045 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3046 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3047 	    sense != ZFS_PROP_UNDEFINED)))
3048 		return (SET_ERROR(ENOTSUP));
3049 
3050 	/*
3051 	 * Put the version in the zplprops
3052 	 */
3053 	VERIFY(nvlist_add_uint64(zplprops,
3054 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3055 
3056 	if (norm == ZFS_PROP_UNDEFINED)
3057 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3058 	VERIFY(nvlist_add_uint64(zplprops,
3059 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3060 
3061 	/*
3062 	 * If we're normalizing, names must always be valid UTF-8 strings.
3063 	 */
3064 	if (norm)
3065 		u8 = 1;
3066 	if (u8 == ZFS_PROP_UNDEFINED)
3067 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3068 	VERIFY(nvlist_add_uint64(zplprops,
3069 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3070 
3071 	if (sense == ZFS_PROP_UNDEFINED)
3072 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3073 	VERIFY(nvlist_add_uint64(zplprops,
3074 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3075 
3076 	if (is_ci)
3077 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3078 
3079 	return (0);
3080 }
3081 
3082 static int
3083 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3084     nvlist_t *zplprops, boolean_t *is_ci)
3085 {
3086 	boolean_t fuids_ok, sa_ok;
3087 	uint64_t zplver = ZPL_VERSION;
3088 	objset_t *os = NULL;
3089 	char parentname[MAXNAMELEN];
3090 	char *cp;
3091 	spa_t *spa;
3092 	uint64_t spa_vers;
3093 	int error;
3094 
3095 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3096 	cp = strrchr(parentname, '/');
3097 	ASSERT(cp != NULL);
3098 	cp[0] = '\0';
3099 
3100 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3101 		return (error);
3102 
3103 	spa_vers = spa_version(spa);
3104 	spa_close(spa, FTAG);
3105 
3106 	zplver = zfs_zpl_version_map(spa_vers);
3107 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3108 	sa_ok = (zplver >= ZPL_VERSION_SA);
3109 
3110 	/*
3111 	 * Open parent object set so we can inherit zplprop values.
3112 	 */
3113 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3114 		return (error);
3115 
3116 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3117 	    zplprops, is_ci);
3118 	dmu_objset_rele(os, FTAG);
3119 	return (error);
3120 }
3121 
3122 static int
3123 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3124     nvlist_t *zplprops, boolean_t *is_ci)
3125 {
3126 	boolean_t fuids_ok;
3127 	boolean_t sa_ok;
3128 	uint64_t zplver = ZPL_VERSION;
3129 	int error;
3130 
3131 	zplver = zfs_zpl_version_map(spa_vers);
3132 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3133 	sa_ok = (zplver >= ZPL_VERSION_SA);
3134 
3135 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3136 	    createprops, zplprops, is_ci);
3137 	return (error);
3138 }
3139 
3140 /*
3141  * innvl: {
3142  *     "type" -> dmu_objset_type_t (int32)
3143  *     (optional) "props" -> { prop -> value }
3144  * }
3145  *
3146  * outnvl: propname -> error code (int32)
3147  */
3148 static int
3149 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3150 {
3151 	int error = 0;
3152 	zfs_creat_t zct = { 0 };
3153 	nvlist_t *nvprops = NULL;
3154 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3155 	int32_t type32;
3156 	dmu_objset_type_t type;
3157 	boolean_t is_insensitive = B_FALSE;
3158 
3159 	if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3160 		return (SET_ERROR(EINVAL));
3161 	type = type32;
3162 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3163 
3164 	switch (type) {
3165 	case DMU_OST_ZFS:
3166 		cbfunc = zfs_create_cb;
3167 		break;
3168 
3169 	case DMU_OST_ZVOL:
3170 		cbfunc = zvol_create_cb;
3171 		break;
3172 
3173 	default:
3174 		cbfunc = NULL;
3175 		break;
3176 	}
3177 	if (strchr(fsname, '@') ||
3178 	    strchr(fsname, '%'))
3179 		return (SET_ERROR(EINVAL));
3180 
3181 	zct.zct_props = nvprops;
3182 
3183 	if (cbfunc == NULL)
3184 		return (SET_ERROR(EINVAL));
3185 
3186 	if (type == DMU_OST_ZVOL) {
3187 		uint64_t volsize, volblocksize;
3188 
3189 		if (nvprops == NULL)
3190 			return (SET_ERROR(EINVAL));
3191 		if (nvlist_lookup_uint64(nvprops,
3192 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3193 			return (SET_ERROR(EINVAL));
3194 
3195 		if ((error = nvlist_lookup_uint64(nvprops,
3196 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3197 		    &volblocksize)) != 0 && error != ENOENT)
3198 			return (SET_ERROR(EINVAL));
3199 
3200 		if (error != 0)
3201 			volblocksize = zfs_prop_default_numeric(
3202 			    ZFS_PROP_VOLBLOCKSIZE);
3203 
3204 		if ((error = zvol_check_volblocksize(
3205 		    volblocksize)) != 0 ||
3206 		    (error = zvol_check_volsize(volsize,
3207 		    volblocksize)) != 0)
3208 			return (error);
3209 	} else if (type == DMU_OST_ZFS) {
3210 		int error;
3211 
3212 		/*
3213 		 * We have to have normalization and
3214 		 * case-folding flags correct when we do the
3215 		 * file system creation, so go figure them out
3216 		 * now.
3217 		 */
3218 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3219 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3220 		error = zfs_fill_zplprops(fsname, nvprops,
3221 		    zct.zct_zplprops, &is_insensitive);
3222 		if (error != 0) {
3223 			nvlist_free(zct.zct_zplprops);
3224 			return (error);
3225 		}
3226 	}
3227 
3228 	error = dmu_objset_create(fsname, type,
3229 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3230 	nvlist_free(zct.zct_zplprops);
3231 
3232 	/*
3233 	 * It would be nice to do this atomically.
3234 	 */
3235 	if (error == 0) {
3236 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3237 		    nvprops, outnvl);
3238 		if (error != 0)
3239 			(void) dsl_destroy_head(fsname);
3240 	}
3241 	return (error);
3242 }
3243 
3244 /*
3245  * innvl: {
3246  *     "origin" -> name of origin snapshot
3247  *     (optional) "props" -> { prop -> value }
3248  * }
3249  *
3250  * outnvl: propname -> error code (int32)
3251  */
3252 static int
3253 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3254 {
3255 	int error = 0;
3256 	nvlist_t *nvprops = NULL;
3257 	char *origin_name;
3258 
3259 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3260 		return (SET_ERROR(EINVAL));
3261 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3262 
3263 	if (strchr(fsname, '@') ||
3264 	    strchr(fsname, '%'))
3265 		return (SET_ERROR(EINVAL));
3266 
3267 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3268 		return (SET_ERROR(EINVAL));
3269 	error = dmu_objset_clone(fsname, origin_name);
3270 	if (error != 0)
3271 		return (error);
3272 
3273 	/*
3274 	 * It would be nice to do this atomically.
3275 	 */
3276 	if (error == 0) {
3277 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3278 		    nvprops, outnvl);
3279 		if (error != 0)
3280 			(void) dsl_destroy_head(fsname);
3281 	}
3282 	return (error);
3283 }
3284 
3285 /*
3286  * innvl: {
3287  *     "snaps" -> { snapshot1, snapshot2 }
3288  *     (optional) "props" -> { prop -> value (string) }
3289  * }
3290  *
3291  * outnvl: snapshot -> error code (int32)
3292  */
3293 static int
3294 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3295 {
3296 	nvlist_t *snaps;
3297 	nvlist_t *props = NULL;
3298 	int error, poollen;
3299 	nvpair_t *pair;
3300 
3301 	(void) nvlist_lookup_nvlist(innvl, "props", &props);
3302 	if ((error = zfs_check_userprops(poolname, props)) != 0)
3303 		return (error);
3304 
3305 	if (!nvlist_empty(props) &&
3306 	    zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3307 		return (SET_ERROR(ENOTSUP));
3308 
3309 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3310 		return (SET_ERROR(EINVAL));
3311 	poollen = strlen(poolname);
3312 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3313 	    pair = nvlist_next_nvpair(snaps, pair)) {
3314 		const char *name = nvpair_name(pair);
3315 		const char *cp = strchr(name, '@');
3316 
3317 		/*
3318 		 * The snap name must contain an @, and the part after it must
3319 		 * contain only valid characters.
3320 		 */
3321 		if (cp == NULL || snapshot_namecheck(cp + 1, NULL, NULL) != 0)
3322 			return (SET_ERROR(EINVAL));
3323 
3324 		/*
3325 		 * The snap must be in the specified pool.
3326 		 */
3327 		if (strncmp(name, poolname, poollen) != 0 ||
3328 		    (name[poollen] != '/' && name[poollen] != '@'))
3329 			return (SET_ERROR(EXDEV));
3330 
3331 		/* This must be the only snap of this fs. */
3332 		for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3333 		    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3334 			if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3335 			    == 0) {
3336 				return (SET_ERROR(EXDEV));
3337 			}
3338 		}
3339 	}
3340 
3341 	error = dsl_dataset_snapshot(snaps, props, outnvl);
3342 	return (error);
3343 }
3344 
3345 /*
3346  * innvl: "message" -> string
3347  */
3348 /* ARGSUSED */
3349 static int
3350 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3351 {
3352 	char *message;
3353 	spa_t *spa;
3354 	int error;
3355 	char *poolname;
3356 
3357 	/*
3358 	 * The poolname in the ioctl is not set, we get it from the TSD,
3359 	 * which was set at the end of the last successful ioctl that allows
3360 	 * logging.  The secpolicy func already checked that it is set.
3361 	 * Only one log ioctl is allowed after each successful ioctl, so
3362 	 * we clear the TSD here.
3363 	 */
3364 	poolname = tsd_get(zfs_allow_log_key);
3365 	(void) tsd_set(zfs_allow_log_key, NULL);
3366 	error = spa_open(poolname, &spa, FTAG);
3367 	strfree(poolname);
3368 	if (error != 0)
3369 		return (error);
3370 
3371 	if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3372 		spa_close(spa, FTAG);
3373 		return (SET_ERROR(EINVAL));
3374 	}
3375 
3376 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3377 		spa_close(spa, FTAG);
3378 		return (SET_ERROR(ENOTSUP));
3379 	}
3380 
3381 	error = spa_history_log(spa, message);
3382 	spa_close(spa, FTAG);
3383 	return (error);
3384 }
3385 
3386 /*
3387  * The dp_config_rwlock must not be held when calling this, because the
3388  * unmount may need to write out data.
3389  *
3390  * This function is best-effort.  Callers must deal gracefully if it
3391  * remains mounted (or is remounted after this call).
3392  *
3393  * Returns 0 if the argument is not a snapshot, or it is not currently a
3394  * filesystem, or we were able to unmount it.  Returns error code otherwise.
3395  */
3396 int
3397 zfs_unmount_snap(const char *snapname)
3398 {
3399 	vfs_t *vfsp;
3400 	zfsvfs_t *zfsvfs;
3401 	int err;
3402 
3403 	if (strchr(snapname, '@') == NULL)
3404 		return (0);
3405 
3406 	vfsp = zfs_get_vfs(snapname);
3407 	if (vfsp == NULL)
3408 		return (0);
3409 
3410 	zfsvfs = vfsp->vfs_data;
3411 	ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3412 
3413 	err = vn_vfswlock(vfsp->vfs_vnodecovered);
3414 	VFS_RELE(vfsp);
3415 	if (err != 0)
3416 		return (SET_ERROR(err));
3417 
3418 	/*
3419 	 * Always force the unmount for snapshots.
3420 	 */
3421 	(void) dounmount(vfsp, MS_FORCE, kcred);
3422 	return (0);
3423 }
3424 
3425 /* ARGSUSED */
3426 static int
3427 zfs_unmount_snap_cb(const char *snapname, void *arg)
3428 {
3429 	return (zfs_unmount_snap(snapname));
3430 }
3431 
3432 /*
3433  * When a clone is destroyed, its origin may also need to be destroyed,
3434  * in which case it must be unmounted.  This routine will do that unmount
3435  * if necessary.
3436  */
3437 void
3438 zfs_destroy_unmount_origin(const char *fsname)
3439 {
3440 	int error;
3441 	objset_t *os;
3442 	dsl_dataset_t *ds;
3443 
3444 	error = dmu_objset_hold(fsname, FTAG, &os);
3445 	if (error != 0)
3446 		return;
3447 	ds = dmu_objset_ds(os);
3448 	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3449 		char originname[MAXNAMELEN];
3450 		dsl_dataset_name(ds->ds_prev, originname);
3451 		dmu_objset_rele(os, FTAG);
3452 		(void) zfs_unmount_snap(originname);
3453 	} else {
3454 		dmu_objset_rele(os, FTAG);
3455 	}
3456 }
3457 
3458 /*
3459  * innvl: {
3460  *     "snaps" -> { snapshot1, snapshot2 }
3461  *     (optional boolean) "defer"
3462  * }
3463  *
3464  * outnvl: snapshot -> error code (int32)
3465  *
3466  */
3467 static int
3468 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3469 {
3470 	int error, poollen;
3471 	nvlist_t *snaps;
3472 	nvpair_t *pair;
3473 	boolean_t defer;
3474 
3475 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3476 		return (SET_ERROR(EINVAL));
3477 	defer = nvlist_exists(innvl, "defer");
3478 
3479 	poollen = strlen(poolname);
3480 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3481 	    pair = nvlist_next_nvpair(snaps, pair)) {
3482 		const char *name = nvpair_name(pair);
3483 
3484 		/*
3485 		 * The snap must be in the specified pool.
3486 		 */
3487 		if (strncmp(name, poolname, poollen) != 0 ||
3488 		    (name[poollen] != '/' && name[poollen] != '@'))
3489 			return (SET_ERROR(EXDEV));
3490 
3491 		error = zfs_unmount_snap(name);
3492 		if (error != 0)
3493 			return (error);
3494 	}
3495 
3496 	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3497 }
3498 
3499 /*
3500  * inputs:
3501  * zc_name		name of dataset to destroy
3502  * zc_objset_type	type of objset
3503  * zc_defer_destroy	mark for deferred destroy
3504  *
3505  * outputs:		none
3506  */
3507 static int
3508 zfs_ioc_destroy(zfs_cmd_t *zc)
3509 {
3510 	int err;
3511 
3512 	if (zc->zc_objset_type == DMU_OST_ZFS) {
3513 		err = zfs_unmount_snap(zc->zc_name);
3514 		if (err != 0)
3515 			return (err);
3516 	}
3517 
3518 	if (strchr(zc->zc_name, '@'))
3519 		err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3520 	else
3521 		err = dsl_destroy_head(zc->zc_name);
3522 	if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3523 		(void) zvol_remove_minor(zc->zc_name);
3524 	return (err);
3525 }
3526 
3527 /*
3528  * fsname is name of dataset to rollback (to most recent snapshot)
3529  *
3530  * innvl is not used.
3531  *
3532  * outnvl: "target" -> name of most recent snapshot
3533  * }
3534  */
3535 /* ARGSUSED */
3536 static int
3537 zfs_ioc_rollback(const char *fsname, nvlist_t *args, nvlist_t *outnvl)
3538 {
3539 	zfsvfs_t *zfsvfs;
3540 	int error;
3541 
3542 	if (getzfsvfs(fsname, &zfsvfs) == 0) {
3543 		error = zfs_suspend_fs(zfsvfs);
3544 		if (error == 0) {
3545 			int resume_err;
3546 
3547 			error = dsl_dataset_rollback(fsname, zfsvfs, outnvl);
3548 			resume_err = zfs_resume_fs(zfsvfs, fsname);
3549 			error = error ? error : resume_err;
3550 		}
3551 		VFS_RELE(zfsvfs->z_vfs);
3552 	} else {
3553 		error = dsl_dataset_rollback(fsname, NULL, outnvl);
3554 	}
3555 	return (error);
3556 }
3557 
3558 static int
3559 recursive_unmount(const char *fsname, void *arg)
3560 {
3561 	const char *snapname = arg;
3562 	char fullname[MAXNAMELEN];
3563 
3564 	(void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
3565 	return (zfs_unmount_snap(fullname));
3566 }
3567 
3568 /*
3569  * inputs:
3570  * zc_name	old name of dataset
3571  * zc_value	new name of dataset
3572  * zc_cookie	recursive flag (only valid for snapshots)
3573  *
3574  * outputs:	none
3575  */
3576 static int
3577 zfs_ioc_rename(zfs_cmd_t *zc)
3578 {
3579 	boolean_t recursive = zc->zc_cookie & 1;
3580 	char *at;
3581 
3582 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3583 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3584 	    strchr(zc->zc_value, '%'))
3585 		return (SET_ERROR(EINVAL));
3586 
3587 	at = strchr(zc->zc_name, '@');
3588 	if (at != NULL) {
3589 		/* snaps must be in same fs */
3590 		int error;
3591 
3592 		if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
3593 			return (SET_ERROR(EXDEV));
3594 		*at = '\0';
3595 		if (zc->zc_objset_type == DMU_OST_ZFS) {
3596 			error = dmu_objset_find(zc->zc_name,
3597 			    recursive_unmount, at + 1,
3598 			    recursive ? DS_FIND_CHILDREN : 0);
3599 			if (error != 0) {
3600 				*at = '@';
3601 				return (error);
3602 			}
3603 		}
3604 		error = dsl_dataset_rename_snapshot(zc->zc_name,
3605 		    at + 1, strchr(zc->zc_value, '@') + 1, recursive);
3606 		*at = '@';
3607 
3608 		return (error);
3609 	} else {
3610 		if (zc->zc_objset_type == DMU_OST_ZVOL)
3611 			(void) zvol_remove_minor(zc->zc_name);
3612 		return (dsl_dir_rename(zc->zc_name, zc->zc_value));
3613 	}
3614 }
3615 
3616 static int
3617 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3618 {
3619 	const char *propname = nvpair_name(pair);
3620 	boolean_t issnap = (strchr(dsname, '@') != NULL);
3621 	zfs_prop_t prop = zfs_name_to_prop(propname);
3622 	uint64_t intval;
3623 	int err;
3624 
3625 	if (prop == ZPROP_INVAL) {
3626 		if (zfs_prop_user(propname)) {
3627 			if (err = zfs_secpolicy_write_perms(dsname,
3628 			    ZFS_DELEG_PERM_USERPROP, cr))
3629 				return (err);
3630 			return (0);
3631 		}
3632 
3633 		if (!issnap && zfs_prop_userquota(propname)) {
3634 			const char *perm = NULL;
3635 			const char *uq_prefix =
3636 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3637 			const char *gq_prefix =
3638 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3639 
3640 			if (strncmp(propname, uq_prefix,
3641 			    strlen(uq_prefix)) == 0) {
3642 				perm = ZFS_DELEG_PERM_USERQUOTA;
3643 			} else if (strncmp(propname, gq_prefix,
3644 			    strlen(gq_prefix)) == 0) {
3645 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
3646 			} else {
3647 				/* USERUSED and GROUPUSED are read-only */
3648 				return (SET_ERROR(EINVAL));
3649 			}
3650 
3651 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3652 				return (err);
3653 			return (0);
3654 		}
3655 
3656 		return (SET_ERROR(EINVAL));
3657 	}
3658 
3659 	if (issnap)
3660 		return (SET_ERROR(EINVAL));
3661 
3662 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3663 		/*
3664 		 * dsl_prop_get_all_impl() returns properties in this
3665 		 * format.
3666 		 */
3667 		nvlist_t *attrs;
3668 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3669 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3670 		    &pair) == 0);
3671 	}
3672 
3673 	/*
3674 	 * Check that this value is valid for this pool version
3675 	 */
3676 	switch (prop) {
3677 	case ZFS_PROP_COMPRESSION:
3678 		/*
3679 		 * If the user specified gzip compression, make sure
3680 		 * the SPA supports it. We ignore any errors here since
3681 		 * we'll catch them later.
3682 		 */
3683 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3684 		    nvpair_value_uint64(pair, &intval) == 0) {
3685 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
3686 			    intval <= ZIO_COMPRESS_GZIP_9 &&
3687 			    zfs_earlier_version(dsname,
3688 			    SPA_VERSION_GZIP_COMPRESSION)) {
3689 				return (SET_ERROR(ENOTSUP));
3690 			}
3691 
3692 			if (intval == ZIO_COMPRESS_ZLE &&
3693 			    zfs_earlier_version(dsname,
3694 			    SPA_VERSION_ZLE_COMPRESSION))
3695 				return (SET_ERROR(ENOTSUP));
3696 
3697 			if (intval == ZIO_COMPRESS_LZ4) {
3698 				zfeature_info_t *feature =
3699 				    &spa_feature_table[
3700 				    SPA_FEATURE_LZ4_COMPRESS];
3701 				spa_t *spa;
3702 
3703 				if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3704 					return (err);
3705 
3706 				if (!spa_feature_is_enabled(spa, feature)) {
3707 					spa_close(spa, FTAG);
3708 					return (SET_ERROR(ENOTSUP));
3709 				}
3710 				spa_close(spa, FTAG);
3711 			}
3712 
3713 			/*
3714 			 * If this is a bootable dataset then
3715 			 * verify that the compression algorithm
3716 			 * is supported for booting. We must return
3717 			 * something other than ENOTSUP since it
3718 			 * implies a downrev pool version.
3719 			 */
3720 			if (zfs_is_bootfs(dsname) &&
3721 			    !BOOTFS_COMPRESS_VALID(intval)) {
3722 				return (SET_ERROR(ERANGE));
3723 			}
3724 		}
3725 		break;
3726 
3727 	case ZFS_PROP_COPIES:
3728 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3729 			return (SET_ERROR(ENOTSUP));
3730 		break;
3731 
3732 	case ZFS_PROP_DEDUP:
3733 		if (zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3734 			return (SET_ERROR(ENOTSUP));
3735 		break;
3736 
3737 	case ZFS_PROP_SHARESMB:
3738 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3739 			return (SET_ERROR(ENOTSUP));
3740 		break;
3741 
3742 	case ZFS_PROP_ACLINHERIT:
3743 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3744 		    nvpair_value_uint64(pair, &intval) == 0) {
3745 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
3746 			    zfs_earlier_version(dsname,
3747 			    SPA_VERSION_PASSTHROUGH_X))
3748 				return (SET_ERROR(ENOTSUP));
3749 		}
3750 		break;
3751 	}
3752 
3753 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3754 }
3755 
3756 /*
3757  * Checks for a race condition to make sure we don't increment a feature flag
3758  * multiple times.
3759  */
3760 static int
3761 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
3762 {
3763 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3764 	zfeature_info_t *feature = arg;
3765 
3766 	if (!spa_feature_is_active(spa, feature))
3767 		return (0);
3768 	else
3769 		return (SET_ERROR(EBUSY));
3770 }
3771 
3772 /*
3773  * The callback invoked on feature activation in the sync task caused by
3774  * zfs_prop_activate_feature.
3775  */
3776 static void
3777 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
3778 {
3779 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3780 	zfeature_info_t *feature = arg;
3781 
3782 	spa_feature_incr(spa, feature, tx);
3783 }
3784 
3785 /*
3786  * Activates a feature on a pool in response to a property setting. This
3787  * creates a new sync task which modifies the pool to reflect the feature
3788  * as being active.
3789  */
3790 static int
3791 zfs_prop_activate_feature(spa_t *spa, zfeature_info_t *feature)
3792 {
3793 	int err;
3794 
3795 	/* EBUSY here indicates that the feature is already active */
3796 	err = dsl_sync_task(spa_name(spa),
3797 	    zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
3798 	    feature, 2);
3799 
3800 	if (err != 0 && err != EBUSY)
3801 		return (err);
3802 	else
3803 		return (0);
3804 }
3805 
3806 /*
3807  * Removes properties from the given props list that fail permission checks
3808  * needed to clear them and to restore them in case of a receive error. For each
3809  * property, make sure we have both set and inherit permissions.
3810  *
3811  * Returns the first error encountered if any permission checks fail. If the
3812  * caller provides a non-NULL errlist, it also gives the complete list of names
3813  * of all the properties that failed a permission check along with the
3814  * corresponding error numbers. The caller is responsible for freeing the
3815  * returned errlist.
3816  *
3817  * If every property checks out successfully, zero is returned and the list
3818  * pointed at by errlist is NULL.
3819  */
3820 static int
3821 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
3822 {
3823 	zfs_cmd_t *zc;
3824 	nvpair_t *pair, *next_pair;
3825 	nvlist_t *errors;
3826 	int err, rv = 0;
3827 
3828 	if (props == NULL)
3829 		return (0);
3830 
3831 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3832 
3833 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
3834 	(void) strcpy(zc->zc_name, dataset);
3835 	pair = nvlist_next_nvpair(props, NULL);
3836 	while (pair != NULL) {
3837 		next_pair = nvlist_next_nvpair(props, pair);
3838 
3839 		(void) strcpy(zc->zc_value, nvpair_name(pair));
3840 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
3841 		    (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
3842 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
3843 			VERIFY(nvlist_add_int32(errors,
3844 			    zc->zc_value, err) == 0);
3845 		}
3846 		pair = next_pair;
3847 	}
3848 	kmem_free(zc, sizeof (zfs_cmd_t));
3849 
3850 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
3851 		nvlist_free(errors);
3852 		errors = NULL;
3853 	} else {
3854 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
3855 	}
3856 
3857 	if (errlist == NULL)
3858 		nvlist_free(errors);
3859 	else
3860 		*errlist = errors;
3861 
3862 	return (rv);
3863 }
3864 
3865 static boolean_t
3866 propval_equals(nvpair_t *p1, nvpair_t *p2)
3867 {
3868 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
3869 		/* dsl_prop_get_all_impl() format */
3870 		nvlist_t *attrs;
3871 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
3872 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3873 		    &p1) == 0);
3874 	}
3875 
3876 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
3877 		nvlist_t *attrs;
3878 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
3879 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3880 		    &p2) == 0);
3881 	}
3882 
3883 	if (nvpair_type(p1) != nvpair_type(p2))
3884 		return (B_FALSE);
3885 
3886 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
3887 		char *valstr1, *valstr2;
3888 
3889 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
3890 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
3891 		return (strcmp(valstr1, valstr2) == 0);
3892 	} else {
3893 		uint64_t intval1, intval2;
3894 
3895 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
3896 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
3897 		return (intval1 == intval2);
3898 	}
3899 }
3900 
3901 /*
3902  * Remove properties from props if they are not going to change (as determined
3903  * by comparison with origprops). Remove them from origprops as well, since we
3904  * do not need to clear or restore properties that won't change.
3905  */
3906 static void
3907 props_reduce(nvlist_t *props, nvlist_t *origprops)
3908 {
3909 	nvpair_t *pair, *next_pair;
3910 
3911 	if (origprops == NULL)
3912 		return; /* all props need to be received */
3913 
3914 	pair = nvlist_next_nvpair(props, NULL);
3915 	while (pair != NULL) {
3916 		const char *propname = nvpair_name(pair);
3917 		nvpair_t *match;
3918 
3919 		next_pair = nvlist_next_nvpair(props, pair);
3920 
3921 		if ((nvlist_lookup_nvpair(origprops, propname,
3922 		    &match) != 0) || !propval_equals(pair, match))
3923 			goto next; /* need to set received value */
3924 
3925 		/* don't clear the existing received value */
3926 		(void) nvlist_remove_nvpair(origprops, match);
3927 		/* don't bother receiving the property */
3928 		(void) nvlist_remove_nvpair(props, pair);
3929 next:
3930 		pair = next_pair;
3931 	}
3932 }
3933 
3934 #ifdef	DEBUG
3935 static boolean_t zfs_ioc_recv_inject_err;
3936 #endif
3937 
3938 /*
3939  * inputs:
3940  * zc_name		name of containing filesystem
3941  * zc_nvlist_src{_size}	nvlist of properties to apply
3942  * zc_value		name of snapshot to create
3943  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
3944  * zc_cookie		file descriptor to recv from
3945  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
3946  * zc_guid		force flag
3947  * zc_cleanup_fd	cleanup-on-exit file descriptor
3948  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
3949  *
3950  * outputs:
3951  * zc_cookie		number of bytes read
3952  * zc_nvlist_dst{_size} error for each unapplied received property
3953  * zc_obj		zprop_errflags_t
3954  * zc_action_handle	handle for this guid/ds mapping
3955  */
3956 static int
3957 zfs_ioc_recv(zfs_cmd_t *zc)
3958 {
3959 	file_t *fp;
3960 	dmu_recv_cookie_t drc;
3961 	boolean_t force = (boolean_t)zc->zc_guid;
3962 	int fd;
3963 	int error = 0;
3964 	int props_error = 0;
3965 	nvlist_t *errors;
3966 	offset_t off;
3967 	nvlist_t *props = NULL; /* sent properties */
3968 	nvlist_t *origprops = NULL; /* existing properties */
3969 	char *origin = NULL;
3970 	char *tosnap;
3971 	char tofs[ZFS_MAXNAMELEN];
3972 	boolean_t first_recvd_props = B_FALSE;
3973 
3974 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3975 	    strchr(zc->zc_value, '@') == NULL ||
3976 	    strchr(zc->zc_value, '%'))
3977 		return (SET_ERROR(EINVAL));
3978 
3979 	(void) strcpy(tofs, zc->zc_value);
3980 	tosnap = strchr(tofs, '@');
3981 	*tosnap++ = '\0';
3982 
3983 	if (zc->zc_nvlist_src != NULL &&
3984 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3985 	    zc->zc_iflags, &props)) != 0)
3986 		return (error);
3987 
3988 	fd = zc->zc_cookie;
3989 	fp = getf(fd);
3990 	if (fp == NULL) {
3991 		nvlist_free(props);
3992 		return (SET_ERROR(EBADF));
3993 	}
3994 
3995 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3996 
3997 	if (zc->zc_string[0])
3998 		origin = zc->zc_string;
3999 
4000 	error = dmu_recv_begin(tofs, tosnap,
4001 	    &zc->zc_begin_record, force, origin, &drc);
4002 	if (error != 0)
4003 		goto out;
4004 
4005 	/*
4006 	 * Set properties before we receive the stream so that they are applied
4007 	 * to the new data. Note that we must call dmu_recv_stream() if
4008 	 * dmu_recv_begin() succeeds.
4009 	 */
4010 	if (props != NULL && !drc.drc_newfs) {
4011 		if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
4012 		    SPA_VERSION_RECVD_PROPS &&
4013 		    !dsl_prop_get_hasrecvd(tofs))
4014 			first_recvd_props = B_TRUE;
4015 
4016 		/*
4017 		 * If new received properties are supplied, they are to
4018 		 * completely replace the existing received properties, so stash
4019 		 * away the existing ones.
4020 		 */
4021 		if (dsl_prop_get_received(tofs, &origprops) == 0) {
4022 			nvlist_t *errlist = NULL;
4023 			/*
4024 			 * Don't bother writing a property if its value won't
4025 			 * change (and avoid the unnecessary security checks).
4026 			 *
4027 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
4028 			 * special case where we blow away all local properties
4029 			 * regardless.
4030 			 */
4031 			if (!first_recvd_props)
4032 				props_reduce(props, origprops);
4033 			if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
4034 				(void) nvlist_merge(errors, errlist, 0);
4035 			nvlist_free(errlist);
4036 
4037 			if (clear_received_props(tofs, origprops,
4038 			    first_recvd_props ? NULL : props) != 0)
4039 				zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4040 		} else {
4041 			zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4042 		}
4043 	}
4044 
4045 	if (props != NULL) {
4046 		props_error = dsl_prop_set_hasrecvd(tofs);
4047 
4048 		if (props_error == 0) {
4049 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4050 			    props, errors);
4051 		}
4052 	}
4053 
4054 	if (zc->zc_nvlist_dst_size != 0 &&
4055 	    (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4056 	    put_nvlist(zc, errors) != 0)) {
4057 		/*
4058 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
4059 		 * size or supplied an invalid address.
4060 		 */
4061 		props_error = SET_ERROR(EINVAL);
4062 	}
4063 
4064 	off = fp->f_offset;
4065 	error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4066 	    &zc->zc_action_handle);
4067 
4068 	if (error == 0) {
4069 		zfsvfs_t *zfsvfs = NULL;
4070 
4071 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
4072 			/* online recv */
4073 			int end_err;
4074 
4075 			error = zfs_suspend_fs(zfsvfs);
4076 			/*
4077 			 * If the suspend fails, then the recv_end will
4078 			 * likely also fail, and clean up after itself.
4079 			 */
4080 			end_err = dmu_recv_end(&drc, zfsvfs);
4081 			if (error == 0)
4082 				error = zfs_resume_fs(zfsvfs, tofs);
4083 			error = error ? error : end_err;
4084 			VFS_RELE(zfsvfs->z_vfs);
4085 		} else {
4086 			error = dmu_recv_end(&drc, NULL);
4087 		}
4088 	}
4089 
4090 	zc->zc_cookie = off - fp->f_offset;
4091 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4092 		fp->f_offset = off;
4093 
4094 #ifdef	DEBUG
4095 	if (zfs_ioc_recv_inject_err) {
4096 		zfs_ioc_recv_inject_err = B_FALSE;
4097 		error = 1;
4098 	}
4099 #endif
4100 	/*
4101 	 * On error, restore the original props.
4102 	 */
4103 	if (error != 0 && props != NULL && !drc.drc_newfs) {
4104 		if (clear_received_props(tofs, props, NULL) != 0) {
4105 			/*
4106 			 * We failed to clear the received properties.
4107 			 * Since we may have left a $recvd value on the
4108 			 * system, we can't clear the $hasrecvd flag.
4109 			 */
4110 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4111 		} else if (first_recvd_props) {
4112 			dsl_prop_unset_hasrecvd(tofs);
4113 		}
4114 
4115 		if (origprops == NULL && !drc.drc_newfs) {
4116 			/* We failed to stash the original properties. */
4117 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4118 		}
4119 
4120 		/*
4121 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
4122 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4123 		 * explictly if we're restoring local properties cleared in the
4124 		 * first new-style receive.
4125 		 */
4126 		if (origprops != NULL &&
4127 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4128 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4129 		    origprops, NULL) != 0) {
4130 			/*
4131 			 * We stashed the original properties but failed to
4132 			 * restore them.
4133 			 */
4134 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4135 		}
4136 	}
4137 out:
4138 	nvlist_free(props);
4139 	nvlist_free(origprops);
4140 	nvlist_free(errors);
4141 	releasef(fd);
4142 
4143 	if (error == 0)
4144 		error = props_error;
4145 
4146 	return (error);
4147 }
4148 
4149 /*
4150  * inputs:
4151  * zc_name	name of snapshot to send
4152  * zc_cookie	file descriptor to send stream to
4153  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
4154  * zc_sendobj	objsetid of snapshot to send
4155  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
4156  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
4157  *		output size in zc_objset_type.
4158  *
4159  * outputs: none
4160  */
4161 static int
4162 zfs_ioc_send(zfs_cmd_t *zc)
4163 {
4164 	int error;
4165 	offset_t off;
4166 	boolean_t estimate = (zc->zc_guid != 0);
4167 
4168 	if (zc->zc_obj != 0) {
4169 		dsl_pool_t *dp;
4170 		dsl_dataset_t *tosnap;
4171 
4172 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4173 		if (error != 0)
4174 			return (error);
4175 
4176 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4177 		if (error != 0) {
4178 			dsl_pool_rele(dp, FTAG);
4179 			return (error);
4180 		}
4181 
4182 		if (dsl_dir_is_clone(tosnap->ds_dir))
4183 			zc->zc_fromobj = tosnap->ds_dir->dd_phys->dd_origin_obj;
4184 		dsl_dataset_rele(tosnap, FTAG);
4185 		dsl_pool_rele(dp, FTAG);
4186 	}
4187 
4188 	if (estimate) {
4189 		dsl_pool_t *dp;
4190 		dsl_dataset_t *tosnap;
4191 		dsl_dataset_t *fromsnap = NULL;
4192 
4193 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4194 		if (error != 0)
4195 			return (error);
4196 
4197 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4198 		if (error != 0) {
4199 			dsl_pool_rele(dp, FTAG);
4200 			return (error);
4201 		}
4202 
4203 		if (zc->zc_fromobj != 0) {
4204 			error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
4205 			    FTAG, &fromsnap);
4206 			if (error != 0) {
4207 				dsl_dataset_rele(tosnap, FTAG);
4208 				dsl_pool_rele(dp, FTAG);
4209 				return (error);
4210 			}
4211 		}
4212 
4213 		error = dmu_send_estimate(tosnap, fromsnap,
4214 		    &zc->zc_objset_type);
4215 
4216 		if (fromsnap != NULL)
4217 			dsl_dataset_rele(fromsnap, FTAG);
4218 		dsl_dataset_rele(tosnap, FTAG);
4219 		dsl_pool_rele(dp, FTAG);
4220 	} else {
4221 		file_t *fp = getf(zc->zc_cookie);
4222 		if (fp == NULL)
4223 			return (SET_ERROR(EBADF));
4224 
4225 		off = fp->f_offset;
4226 		error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
4227 		    zc->zc_fromobj, zc->zc_cookie, fp->f_vnode, &off);
4228 
4229 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4230 			fp->f_offset = off;
4231 		releasef(zc->zc_cookie);
4232 	}
4233 	return (error);
4234 }
4235 
4236 /*
4237  * inputs:
4238  * zc_name	name of snapshot on which to report progress
4239  * zc_cookie	file descriptor of send stream
4240  *
4241  * outputs:
4242  * zc_cookie	number of bytes written in send stream thus far
4243  */
4244 static int
4245 zfs_ioc_send_progress(zfs_cmd_t *zc)
4246 {
4247 	dsl_pool_t *dp;
4248 	dsl_dataset_t *ds;
4249 	dmu_sendarg_t *dsp = NULL;
4250 	int error;
4251 
4252 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4253 	if (error != 0)
4254 		return (error);
4255 
4256 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4257 	if (error != 0) {
4258 		dsl_pool_rele(dp, FTAG);
4259 		return (error);
4260 	}
4261 
4262 	mutex_enter(&ds->ds_sendstream_lock);
4263 
4264 	/*
4265 	 * Iterate over all the send streams currently active on this dataset.
4266 	 * If there's one which matches the specified file descriptor _and_ the
4267 	 * stream was started by the current process, return the progress of
4268 	 * that stream.
4269 	 */
4270 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4271 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
4272 		if (dsp->dsa_outfd == zc->zc_cookie &&
4273 		    dsp->dsa_proc == curproc)
4274 			break;
4275 	}
4276 
4277 	if (dsp != NULL)
4278 		zc->zc_cookie = *(dsp->dsa_off);
4279 	else
4280 		error = SET_ERROR(ENOENT);
4281 
4282 	mutex_exit(&ds->ds_sendstream_lock);
4283 	dsl_dataset_rele(ds, FTAG);
4284 	dsl_pool_rele(dp, FTAG);
4285 	return (error);
4286 }
4287 
4288 static int
4289 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4290 {
4291 	int id, error;
4292 
4293 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4294 	    &zc->zc_inject_record);
4295 
4296 	if (error == 0)
4297 		zc->zc_guid = (uint64_t)id;
4298 
4299 	return (error);
4300 }
4301 
4302 static int
4303 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4304 {
4305 	return (zio_clear_fault((int)zc->zc_guid));
4306 }
4307 
4308 static int
4309 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4310 {
4311 	int id = (int)zc->zc_guid;
4312 	int error;
4313 
4314 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4315 	    &zc->zc_inject_record);
4316 
4317 	zc->zc_guid = id;
4318 
4319 	return (error);
4320 }
4321 
4322 static int
4323 zfs_ioc_error_log(zfs_cmd_t *zc)
4324 {
4325 	spa_t *spa;
4326 	int error;
4327 	size_t count = (size_t)zc->zc_nvlist_dst_size;
4328 
4329 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4330 		return (error);
4331 
4332 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4333 	    &count);
4334 	if (error == 0)
4335 		zc->zc_nvlist_dst_size = count;
4336 	else
4337 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4338 
4339 	spa_close(spa, FTAG);
4340 
4341 	return (error);
4342 }
4343 
4344 static int
4345 zfs_ioc_clear(zfs_cmd_t *zc)
4346 {
4347 	spa_t *spa;
4348 	vdev_t *vd;
4349 	int error;
4350 
4351 	/*
4352 	 * On zpool clear we also fix up missing slogs
4353 	 */
4354 	mutex_enter(&spa_namespace_lock);
4355 	spa = spa_lookup(zc->zc_name);
4356 	if (spa == NULL) {
4357 		mutex_exit(&spa_namespace_lock);
4358 		return (SET_ERROR(EIO));
4359 	}
4360 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4361 		/* we need to let spa_open/spa_load clear the chains */
4362 		spa_set_log_state(spa, SPA_LOG_CLEAR);
4363 	}
4364 	spa->spa_last_open_failed = 0;
4365 	mutex_exit(&spa_namespace_lock);
4366 
4367 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4368 		error = spa_open(zc->zc_name, &spa, FTAG);
4369 	} else {
4370 		nvlist_t *policy;
4371 		nvlist_t *config = NULL;
4372 
4373 		if (zc->zc_nvlist_src == NULL)
4374 			return (SET_ERROR(EINVAL));
4375 
4376 		if ((error = get_nvlist(zc->zc_nvlist_src,
4377 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4378 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4379 			    policy, &config);
4380 			if (config != NULL) {
4381 				int err;
4382 
4383 				if ((err = put_nvlist(zc, config)) != 0)
4384 					error = err;
4385 				nvlist_free(config);
4386 			}
4387 			nvlist_free(policy);
4388 		}
4389 	}
4390 
4391 	if (error != 0)
4392 		return (error);
4393 
4394 	spa_vdev_state_enter(spa, SCL_NONE);
4395 
4396 	if (zc->zc_guid == 0) {
4397 		vd = NULL;
4398 	} else {
4399 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4400 		if (vd == NULL) {
4401 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
4402 			spa_close(spa, FTAG);
4403 			return (SET_ERROR(ENODEV));
4404 		}
4405 	}
4406 
4407 	vdev_clear(spa, vd);
4408 
4409 	(void) spa_vdev_state_exit(spa, NULL, 0);
4410 
4411 	/*
4412 	 * Resume any suspended I/Os.
4413 	 */
4414 	if (zio_resume(spa) != 0)
4415 		error = SET_ERROR(EIO);
4416 
4417 	spa_close(spa, FTAG);
4418 
4419 	return (error);
4420 }
4421 
4422 static int
4423 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4424 {
4425 	spa_t *spa;
4426 	int error;
4427 
4428 	error = spa_open(zc->zc_name, &spa, FTAG);
4429 	if (error != 0)
4430 		return (error);
4431 
4432 	spa_vdev_state_enter(spa, SCL_NONE);
4433 
4434 	/*
4435 	 * If a resilver is already in progress then set the
4436 	 * spa_scrub_reopen flag to B_TRUE so that we don't restart
4437 	 * the scan as a side effect of the reopen. Otherwise, let
4438 	 * vdev_open() decided if a resilver is required.
4439 	 */
4440 	spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4441 	vdev_reopen(spa->spa_root_vdev);
4442 	spa->spa_scrub_reopen = B_FALSE;
4443 
4444 	(void) spa_vdev_state_exit(spa, NULL, 0);
4445 	spa_close(spa, FTAG);
4446 	return (0);
4447 }
4448 /*
4449  * inputs:
4450  * zc_name	name of filesystem
4451  * zc_value	name of origin snapshot
4452  *
4453  * outputs:
4454  * zc_string	name of conflicting snapshot, if there is one
4455  */
4456 static int
4457 zfs_ioc_promote(zfs_cmd_t *zc)
4458 {
4459 	char *cp;
4460 
4461 	/*
4462 	 * We don't need to unmount *all* the origin fs's snapshots, but
4463 	 * it's easier.
4464 	 */
4465 	cp = strchr(zc->zc_value, '@');
4466 	if (cp)
4467 		*cp = '\0';
4468 	(void) dmu_objset_find(zc->zc_value,
4469 	    zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
4470 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4471 }
4472 
4473 /*
4474  * Retrieve a single {user|group}{used|quota}@... property.
4475  *
4476  * inputs:
4477  * zc_name	name of filesystem
4478  * zc_objset_type zfs_userquota_prop_t
4479  * zc_value	domain name (eg. "S-1-234-567-89")
4480  * zc_guid	RID/UID/GID
4481  *
4482  * outputs:
4483  * zc_cookie	property value
4484  */
4485 static int
4486 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4487 {
4488 	zfsvfs_t *zfsvfs;
4489 	int error;
4490 
4491 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4492 		return (SET_ERROR(EINVAL));
4493 
4494 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4495 	if (error != 0)
4496 		return (error);
4497 
4498 	error = zfs_userspace_one(zfsvfs,
4499 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4500 	zfsvfs_rele(zfsvfs, FTAG);
4501 
4502 	return (error);
4503 }
4504 
4505 /*
4506  * inputs:
4507  * zc_name		name of filesystem
4508  * zc_cookie		zap cursor
4509  * zc_objset_type	zfs_userquota_prop_t
4510  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4511  *
4512  * outputs:
4513  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
4514  * zc_cookie	zap cursor
4515  */
4516 static int
4517 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4518 {
4519 	zfsvfs_t *zfsvfs;
4520 	int bufsize = zc->zc_nvlist_dst_size;
4521 
4522 	if (bufsize <= 0)
4523 		return (SET_ERROR(ENOMEM));
4524 
4525 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4526 	if (error != 0)
4527 		return (error);
4528 
4529 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
4530 
4531 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4532 	    buf, &zc->zc_nvlist_dst_size);
4533 
4534 	if (error == 0) {
4535 		error = xcopyout(buf,
4536 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
4537 		    zc->zc_nvlist_dst_size);
4538 	}
4539 	kmem_free(buf, bufsize);
4540 	zfsvfs_rele(zfsvfs, FTAG);
4541 
4542 	return (error);
4543 }
4544 
4545 /*
4546  * inputs:
4547  * zc_name		name of filesystem
4548  *
4549  * outputs:
4550  * none
4551  */
4552 static int
4553 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4554 {
4555 	objset_t *os;
4556 	int error = 0;
4557 	zfsvfs_t *zfsvfs;
4558 
4559 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4560 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4561 			/*
4562 			 * If userused is not enabled, it may be because the
4563 			 * objset needs to be closed & reopened (to grow the
4564 			 * objset_phys_t).  Suspend/resume the fs will do that.
4565 			 */
4566 			error = zfs_suspend_fs(zfsvfs);
4567 			if (error == 0) {
4568 				dmu_objset_refresh_ownership(zfsvfs->z_os,
4569 				    zfsvfs);
4570 				error = zfs_resume_fs(zfsvfs, zc->zc_name);
4571 			}
4572 		}
4573 		if (error == 0)
4574 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4575 		VFS_RELE(zfsvfs->z_vfs);
4576 	} else {
4577 		/* XXX kind of reading contents without owning */
4578 		error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4579 		if (error != 0)
4580 			return (error);
4581 
4582 		error = dmu_objset_userspace_upgrade(os);
4583 		dmu_objset_rele(os, FTAG);
4584 	}
4585 
4586 	return (error);
4587 }
4588 
4589 /*
4590  * We don't want to have a hard dependency
4591  * against some special symbols in sharefs
4592  * nfs, and smbsrv.  Determine them if needed when
4593  * the first file system is shared.
4594  * Neither sharefs, nfs or smbsrv are unloadable modules.
4595  */
4596 int (*znfsexport_fs)(void *arg);
4597 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4598 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4599 
4600 int zfs_nfsshare_inited;
4601 int zfs_smbshare_inited;
4602 
4603 ddi_modhandle_t nfs_mod;
4604 ddi_modhandle_t sharefs_mod;
4605 ddi_modhandle_t smbsrv_mod;
4606 kmutex_t zfs_share_lock;
4607 
4608 static int
4609 zfs_init_sharefs()
4610 {
4611 	int error;
4612 
4613 	ASSERT(MUTEX_HELD(&zfs_share_lock));
4614 	/* Both NFS and SMB shares also require sharetab support. */
4615 	if (sharefs_mod == NULL && ((sharefs_mod =
4616 	    ddi_modopen("fs/sharefs",
4617 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
4618 		return (SET_ERROR(ENOSYS));
4619 	}
4620 	if (zshare_fs == NULL && ((zshare_fs =
4621 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4622 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4623 		return (SET_ERROR(ENOSYS));
4624 	}
4625 	return (0);
4626 }
4627 
4628 static int
4629 zfs_ioc_share(zfs_cmd_t *zc)
4630 {
4631 	int error;
4632 	int opcode;
4633 
4634 	switch (zc->zc_share.z_sharetype) {
4635 	case ZFS_SHARE_NFS:
4636 	case ZFS_UNSHARE_NFS:
4637 		if (zfs_nfsshare_inited == 0) {
4638 			mutex_enter(&zfs_share_lock);
4639 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4640 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4641 				mutex_exit(&zfs_share_lock);
4642 				return (SET_ERROR(ENOSYS));
4643 			}
4644 			if (znfsexport_fs == NULL &&
4645 			    ((znfsexport_fs = (int (*)(void *))
4646 			    ddi_modsym(nfs_mod,
4647 			    "nfs_export", &error)) == NULL)) {
4648 				mutex_exit(&zfs_share_lock);
4649 				return (SET_ERROR(ENOSYS));
4650 			}
4651 			error = zfs_init_sharefs();
4652 			if (error != 0) {
4653 				mutex_exit(&zfs_share_lock);
4654 				return (SET_ERROR(ENOSYS));
4655 			}
4656 			zfs_nfsshare_inited = 1;
4657 			mutex_exit(&zfs_share_lock);
4658 		}
4659 		break;
4660 	case ZFS_SHARE_SMB:
4661 	case ZFS_UNSHARE_SMB:
4662 		if (zfs_smbshare_inited == 0) {
4663 			mutex_enter(&zfs_share_lock);
4664 			if (smbsrv_mod == NULL && ((smbsrv_mod =
4665 			    ddi_modopen("drv/smbsrv",
4666 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4667 				mutex_exit(&zfs_share_lock);
4668 				return (SET_ERROR(ENOSYS));
4669 			}
4670 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4671 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4672 			    "smb_server_share", &error)) == NULL)) {
4673 				mutex_exit(&zfs_share_lock);
4674 				return (SET_ERROR(ENOSYS));
4675 			}
4676 			error = zfs_init_sharefs();
4677 			if (error != 0) {
4678 				mutex_exit(&zfs_share_lock);
4679 				return (SET_ERROR(ENOSYS));
4680 			}
4681 			zfs_smbshare_inited = 1;
4682 			mutex_exit(&zfs_share_lock);
4683 		}
4684 		break;
4685 	default:
4686 		return (SET_ERROR(EINVAL));
4687 	}
4688 
4689 	switch (zc->zc_share.z_sharetype) {
4690 	case ZFS_SHARE_NFS:
4691 	case ZFS_UNSHARE_NFS:
4692 		if (error =
4693 		    znfsexport_fs((void *)
4694 		    (uintptr_t)zc->zc_share.z_exportdata))
4695 			return (error);
4696 		break;
4697 	case ZFS_SHARE_SMB:
4698 	case ZFS_UNSHARE_SMB:
4699 		if (error = zsmbexport_fs((void *)
4700 		    (uintptr_t)zc->zc_share.z_exportdata,
4701 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
4702 		    B_TRUE: B_FALSE)) {
4703 			return (error);
4704 		}
4705 		break;
4706 	}
4707 
4708 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
4709 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
4710 	    SHAREFS_ADD : SHAREFS_REMOVE;
4711 
4712 	/*
4713 	 * Add or remove share from sharetab
4714 	 */
4715 	error = zshare_fs(opcode,
4716 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
4717 	    zc->zc_share.z_sharemax);
4718 
4719 	return (error);
4720 
4721 }
4722 
4723 ace_t full_access[] = {
4724 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
4725 };
4726 
4727 /*
4728  * inputs:
4729  * zc_name		name of containing filesystem
4730  * zc_obj		object # beyond which we want next in-use object #
4731  *
4732  * outputs:
4733  * zc_obj		next in-use object #
4734  */
4735 static int
4736 zfs_ioc_next_obj(zfs_cmd_t *zc)
4737 {
4738 	objset_t *os = NULL;
4739 	int error;
4740 
4741 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4742 	if (error != 0)
4743 		return (error);
4744 
4745 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
4746 	    os->os_dsl_dataset->ds_phys->ds_prev_snap_txg);
4747 
4748 	dmu_objset_rele(os, FTAG);
4749 	return (error);
4750 }
4751 
4752 /*
4753  * inputs:
4754  * zc_name		name of filesystem
4755  * zc_value		prefix name for snapshot
4756  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
4757  *
4758  * outputs:
4759  * zc_value		short name of new snapshot
4760  */
4761 static int
4762 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
4763 {
4764 	char *snap_name;
4765 	char *hold_name;
4766 	int error;
4767 	minor_t minor;
4768 
4769 	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
4770 	if (error != 0)
4771 		return (error);
4772 
4773 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
4774 	    (u_longlong_t)ddi_get_lbolt64());
4775 	hold_name = kmem_asprintf("%%%s", zc->zc_value);
4776 
4777 	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
4778 	    hold_name);
4779 	if (error == 0)
4780 		(void) strcpy(zc->zc_value, snap_name);
4781 	strfree(snap_name);
4782 	strfree(hold_name);
4783 	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
4784 	return (error);
4785 }
4786 
4787 /*
4788  * inputs:
4789  * zc_name		name of "to" snapshot
4790  * zc_value		name of "from" snapshot
4791  * zc_cookie		file descriptor to write diff data on
4792  *
4793  * outputs:
4794  * dmu_diff_record_t's to the file descriptor
4795  */
4796 static int
4797 zfs_ioc_diff(zfs_cmd_t *zc)
4798 {
4799 	file_t *fp;
4800 	offset_t off;
4801 	int error;
4802 
4803 	fp = getf(zc->zc_cookie);
4804 	if (fp == NULL)
4805 		return (SET_ERROR(EBADF));
4806 
4807 	off = fp->f_offset;
4808 
4809 	error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
4810 
4811 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4812 		fp->f_offset = off;
4813 	releasef(zc->zc_cookie);
4814 
4815 	return (error);
4816 }
4817 
4818 /*
4819  * Remove all ACL files in shares dir
4820  */
4821 static int
4822 zfs_smb_acl_purge(znode_t *dzp)
4823 {
4824 	zap_cursor_t	zc;
4825 	zap_attribute_t	zap;
4826 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
4827 	int error;
4828 
4829 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
4830 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
4831 	    zap_cursor_advance(&zc)) {
4832 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
4833 		    NULL, 0)) != 0)
4834 			break;
4835 	}
4836 	zap_cursor_fini(&zc);
4837 	return (error);
4838 }
4839 
4840 static int
4841 zfs_ioc_smb_acl(zfs_cmd_t *zc)
4842 {
4843 	vnode_t *vp;
4844 	znode_t *dzp;
4845 	vnode_t *resourcevp = NULL;
4846 	znode_t *sharedir;
4847 	zfsvfs_t *zfsvfs;
4848 	nvlist_t *nvlist;
4849 	char *src, *target;
4850 	vattr_t vattr;
4851 	vsecattr_t vsec;
4852 	int error = 0;
4853 
4854 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
4855 	    NO_FOLLOW, NULL, &vp)) != 0)
4856 		return (error);
4857 
4858 	/* Now make sure mntpnt and dataset are ZFS */
4859 
4860 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
4861 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
4862 	    zc->zc_name) != 0)) {
4863 		VN_RELE(vp);
4864 		return (SET_ERROR(EINVAL));
4865 	}
4866 
4867 	dzp = VTOZ(vp);
4868 	zfsvfs = dzp->z_zfsvfs;
4869 	ZFS_ENTER(zfsvfs);
4870 
4871 	/*
4872 	 * Create share dir if its missing.
4873 	 */
4874 	mutex_enter(&zfsvfs->z_lock);
4875 	if (zfsvfs->z_shares_dir == 0) {
4876 		dmu_tx_t *tx;
4877 
4878 		tx = dmu_tx_create(zfsvfs->z_os);
4879 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
4880 		    ZFS_SHARES_DIR);
4881 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
4882 		error = dmu_tx_assign(tx, TXG_WAIT);
4883 		if (error != 0) {
4884 			dmu_tx_abort(tx);
4885 		} else {
4886 			error = zfs_create_share_dir(zfsvfs, tx);
4887 			dmu_tx_commit(tx);
4888 		}
4889 		if (error != 0) {
4890 			mutex_exit(&zfsvfs->z_lock);
4891 			VN_RELE(vp);
4892 			ZFS_EXIT(zfsvfs);
4893 			return (error);
4894 		}
4895 	}
4896 	mutex_exit(&zfsvfs->z_lock);
4897 
4898 	ASSERT(zfsvfs->z_shares_dir);
4899 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
4900 		VN_RELE(vp);
4901 		ZFS_EXIT(zfsvfs);
4902 		return (error);
4903 	}
4904 
4905 	switch (zc->zc_cookie) {
4906 	case ZFS_SMB_ACL_ADD:
4907 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
4908 		vattr.va_type = VREG;
4909 		vattr.va_mode = S_IFREG|0777;
4910 		vattr.va_uid = 0;
4911 		vattr.va_gid = 0;
4912 
4913 		vsec.vsa_mask = VSA_ACE;
4914 		vsec.vsa_aclentp = &full_access;
4915 		vsec.vsa_aclentsz = sizeof (full_access);
4916 		vsec.vsa_aclcnt = 1;
4917 
4918 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
4919 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
4920 		if (resourcevp)
4921 			VN_RELE(resourcevp);
4922 		break;
4923 
4924 	case ZFS_SMB_ACL_REMOVE:
4925 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
4926 		    NULL, 0);
4927 		break;
4928 
4929 	case ZFS_SMB_ACL_RENAME:
4930 		if ((error = get_nvlist(zc->zc_nvlist_src,
4931 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
4932 			VN_RELE(vp);
4933 			ZFS_EXIT(zfsvfs);
4934 			return (error);
4935 		}
4936 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
4937 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
4938 		    &target)) {
4939 			VN_RELE(vp);
4940 			VN_RELE(ZTOV(sharedir));
4941 			ZFS_EXIT(zfsvfs);
4942 			nvlist_free(nvlist);
4943 			return (error);
4944 		}
4945 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
4946 		    kcred, NULL, 0);
4947 		nvlist_free(nvlist);
4948 		break;
4949 
4950 	case ZFS_SMB_ACL_PURGE:
4951 		error = zfs_smb_acl_purge(sharedir);
4952 		break;
4953 
4954 	default:
4955 		error = SET_ERROR(EINVAL);
4956 		break;
4957 	}
4958 
4959 	VN_RELE(vp);
4960 	VN_RELE(ZTOV(sharedir));
4961 
4962 	ZFS_EXIT(zfsvfs);
4963 
4964 	return (error);
4965 }
4966 
4967 /*
4968  * innvl: {
4969  *     "holds" -> { snapname -> holdname (string), ... }
4970  *     (optional) "cleanup_fd" -> fd (int32)
4971  * }
4972  *
4973  * outnvl: {
4974  *     snapname -> error value (int32)
4975  *     ...
4976  * }
4977  */
4978 /* ARGSUSED */
4979 static int
4980 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
4981 {
4982 	nvlist_t *holds;
4983 	int cleanup_fd = -1;
4984 	int error;
4985 	minor_t minor = 0;
4986 
4987 	error = nvlist_lookup_nvlist(args, "holds", &holds);
4988 	if (error != 0)
4989 		return (SET_ERROR(EINVAL));
4990 
4991 	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
4992 		error = zfs_onexit_fd_hold(cleanup_fd, &minor);
4993 		if (error != 0)
4994 			return (error);
4995 	}
4996 
4997 	error = dsl_dataset_user_hold(holds, minor, errlist);
4998 	if (minor != 0)
4999 		zfs_onexit_fd_rele(cleanup_fd);
5000 	return (error);
5001 }
5002 
5003 /*
5004  * innvl is not used.
5005  *
5006  * outnvl: {
5007  *    holdname -> time added (uint64 seconds since epoch)
5008  *    ...
5009  * }
5010  */
5011 /* ARGSUSED */
5012 static int
5013 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
5014 {
5015 	return (dsl_dataset_get_holds(snapname, outnvl));
5016 }
5017 
5018 /*
5019  * innvl: {
5020  *     snapname -> { holdname, ... }
5021  *     ...
5022  * }
5023  *
5024  * outnvl: {
5025  *     snapname -> error value (int32)
5026  *     ...
5027  * }
5028  */
5029 /* ARGSUSED */
5030 static int
5031 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
5032 {
5033 	return (dsl_dataset_user_release(holds, errlist));
5034 }
5035 
5036 /*
5037  * inputs:
5038  * zc_name		name of new filesystem or snapshot
5039  * zc_value		full name of old snapshot
5040  *
5041  * outputs:
5042  * zc_cookie		space in bytes
5043  * zc_objset_type	compressed space in bytes
5044  * zc_perm_action	uncompressed space in bytes
5045  */
5046 static int
5047 zfs_ioc_space_written(zfs_cmd_t *zc)
5048 {
5049 	int error;
5050 	dsl_pool_t *dp;
5051 	dsl_dataset_t *new, *old;
5052 
5053 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5054 	if (error != 0)
5055 		return (error);
5056 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
5057 	if (error != 0) {
5058 		dsl_pool_rele(dp, FTAG);
5059 		return (error);
5060 	}
5061 	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
5062 	if (error != 0) {
5063 		dsl_dataset_rele(new, FTAG);
5064 		dsl_pool_rele(dp, FTAG);
5065 		return (error);
5066 	}
5067 
5068 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5069 	    &zc->zc_objset_type, &zc->zc_perm_action);
5070 	dsl_dataset_rele(old, FTAG);
5071 	dsl_dataset_rele(new, FTAG);
5072 	dsl_pool_rele(dp, FTAG);
5073 	return (error);
5074 }
5075 
5076 /*
5077  * innvl: {
5078  *     "firstsnap" -> snapshot name
5079  * }
5080  *
5081  * outnvl: {
5082  *     "used" -> space in bytes
5083  *     "compressed" -> compressed space in bytes
5084  *     "uncompressed" -> uncompressed space in bytes
5085  * }
5086  */
5087 static int
5088 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5089 {
5090 	int error;
5091 	dsl_pool_t *dp;
5092 	dsl_dataset_t *new, *old;
5093 	char *firstsnap;
5094 	uint64_t used, comp, uncomp;
5095 
5096 	if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5097 		return (SET_ERROR(EINVAL));
5098 
5099 	error = dsl_pool_hold(lastsnap, FTAG, &dp);
5100 	if (error != 0)
5101 		return (error);
5102 
5103 	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
5104 	if (error != 0) {
5105 		dsl_pool_rele(dp, FTAG);
5106 		return (error);
5107 	}
5108 	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
5109 	if (error != 0) {
5110 		dsl_dataset_rele(new, FTAG);
5111 		dsl_pool_rele(dp, FTAG);
5112 		return (error);
5113 	}
5114 
5115 	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5116 	dsl_dataset_rele(old, FTAG);
5117 	dsl_dataset_rele(new, FTAG);
5118 	dsl_pool_rele(dp, FTAG);
5119 	fnvlist_add_uint64(outnvl, "used", used);
5120 	fnvlist_add_uint64(outnvl, "compressed", comp);
5121 	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5122 	return (error);
5123 }
5124 
5125 /*
5126  * innvl: {
5127  *     "fd" -> file descriptor to write stream to (int32)
5128  *     (optional) "fromsnap" -> full snap name to send an incremental from
5129  * }
5130  *
5131  * outnvl is unused
5132  */
5133 /* ARGSUSED */
5134 static int
5135 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5136 {
5137 	int error;
5138 	offset_t off;
5139 	char *fromname = NULL;
5140 	int fd;
5141 
5142 	error = nvlist_lookup_int32(innvl, "fd", &fd);
5143 	if (error != 0)
5144 		return (SET_ERROR(EINVAL));
5145 
5146 	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
5147 
5148 	file_t *fp = getf(fd);
5149 	if (fp == NULL)
5150 		return (SET_ERROR(EBADF));
5151 
5152 	off = fp->f_offset;
5153 	error = dmu_send(snapname, fromname, fd, fp->f_vnode, &off);
5154 
5155 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5156 		fp->f_offset = off;
5157 	releasef(fd);
5158 	return (error);
5159 }
5160 
5161 /*
5162  * Determine approximately how large a zfs send stream will be -- the number
5163  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5164  *
5165  * innvl: {
5166  *     (optional) "fromsnap" -> full snap name to send an incremental from
5167  * }
5168  *
5169  * outnvl: {
5170  *     "space" -> bytes of space (uint64)
5171  * }
5172  */
5173 static int
5174 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5175 {
5176 	dsl_pool_t *dp;
5177 	dsl_dataset_t *fromsnap = NULL;
5178 	dsl_dataset_t *tosnap;
5179 	int error;
5180 	char *fromname;
5181 	uint64_t space;
5182 
5183 	error = dsl_pool_hold(snapname, FTAG, &dp);
5184 	if (error != 0)
5185 		return (error);
5186 
5187 	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
5188 	if (error != 0) {
5189 		dsl_pool_rele(dp, FTAG);
5190 		return (error);
5191 	}
5192 
5193 	error = nvlist_lookup_string(innvl, "fromsnap", &fromname);
5194 	if (error == 0) {
5195 		error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
5196 		if (error != 0) {
5197 			dsl_dataset_rele(tosnap, FTAG);
5198 			dsl_pool_rele(dp, FTAG);
5199 			return (error);
5200 		}
5201 	}
5202 
5203 	error = dmu_send_estimate(tosnap, fromsnap, &space);
5204 	fnvlist_add_uint64(outnvl, "space", space);
5205 
5206 	if (fromsnap != NULL)
5207 		dsl_dataset_rele(fromsnap, FTAG);
5208 	dsl_dataset_rele(tosnap, FTAG);
5209 	dsl_pool_rele(dp, FTAG);
5210 	return (error);
5211 }
5212 
5213 static int
5214 zfs_ioc_set_zev_callbacks(const char *unused, nvlist_t *innvl,
5215     nvlist_t *outnvl)
5216 {
5217 	int error;
5218 	uint64_t cb_addr;
5219 	/*
5220 	 * Our secpolicy for this op makes sure it's called in
5221 	 * kernel context, and that no other callbacks have
5222 	 * been registered, yet.
5223 	 */
5224 	error = nvlist_lookup_uint64(innvl, "callbacks", &cb_addr);
5225 	if (error != 0) {
5226 		cmn_err(CE_WARN, "set_zev_callbacks nvlist lookup failed (%d)",
5227 		    error);
5228 		return (error);
5229 	}
5230 	/* cb_addr is always a kernel memory address */
5231 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5232 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
5233 		rw_exit(&rz_zev_rwlock);
5234 		return (EBUSY);
5235 	}
5236 	rz_zev_callbacks = (void *)(uintptr_t)cb_addr;
5237 	rw_exit(&rz_zev_rwlock);
5238 	return (0);
5239 }
5240 
5241 static int
5242 zfs_ioc_unset_zev_callbacks(const char *unused, nvlist_t *innvl,
5243     nvlist_t *outnvl)
5244 {
5245 	/*
5246 	 * Our secpolicy for this op makes sure it's called in
5247 	 * kernel context.
5248 	 */
5249 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5250 	rz_zev_callbacks = rz_zev_default_callbacks;
5251 	rw_exit(&rz_zev_rwlock);
5252 	/* after mutex release, no thread is using the old table anymore. */
5253 	return (0);
5254 }
5255 
5256 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5257 
5258 static void
5259 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5260     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5261     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5262 {
5263 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5264 
5265 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5266 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5267 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5268 	ASSERT3P(vec->zvec_func, ==, NULL);
5269 
5270 	vec->zvec_legacy_func = func;
5271 	vec->zvec_secpolicy = secpolicy;
5272 	vec->zvec_namecheck = namecheck;
5273 	vec->zvec_allow_log = log_history;
5274 	vec->zvec_pool_check = pool_check;
5275 }
5276 
5277 /*
5278  * See the block comment at the beginning of this file for details on
5279  * each argument to this function.
5280  */
5281 static void
5282 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5283     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5284     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5285     boolean_t allow_log)
5286 {
5287 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5288 
5289 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5290 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5291 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5292 	ASSERT3P(vec->zvec_func, ==, NULL);
5293 
5294 	/* if we are logging, the name must be valid */
5295 	ASSERT(!allow_log || namecheck != NO_NAME);
5296 
5297 	vec->zvec_name = name;
5298 	vec->zvec_func = func;
5299 	vec->zvec_secpolicy = secpolicy;
5300 	vec->zvec_namecheck = namecheck;
5301 	vec->zvec_pool_check = pool_check;
5302 	vec->zvec_smush_outnvlist = smush_outnvlist;
5303 	vec->zvec_allow_log = allow_log;
5304 }
5305 
5306 static void
5307 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5308     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5309     zfs_ioc_poolcheck_t pool_check)
5310 {
5311 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5312 	    POOL_NAME, log_history, pool_check);
5313 }
5314 
5315 static void
5316 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5317     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5318 {
5319 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5320 	    DATASET_NAME, B_FALSE, pool_check);
5321 }
5322 
5323 static void
5324 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5325 {
5326 	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5327 	    POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5328 }
5329 
5330 static void
5331 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5332     zfs_secpolicy_func_t *secpolicy)
5333 {
5334 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5335 	    NO_NAME, B_FALSE, POOL_CHECK_NONE);
5336 }
5337 
5338 static void
5339 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5340     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5341 {
5342 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5343 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5344 }
5345 
5346 static void
5347 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5348 {
5349 	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5350 	    zfs_secpolicy_read);
5351 }
5352 
5353 static void
5354 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5355 	zfs_secpolicy_func_t *secpolicy)
5356 {
5357 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5358 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5359 }
5360 
5361 static void
5362 zfs_ioctl_init(void)
5363 {
5364 	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5365 	    zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5366 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5367 
5368 	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5369 	    zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5370 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5371 
5372 	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5373 	    zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5374 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5375 
5376 	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5377 	    zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5378 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5379 
5380 	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5381 	    zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5382 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5383 
5384 	zfs_ioctl_register("create", ZFS_IOC_CREATE,
5385 	    zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5386 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5387 
5388 	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5389 	    zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5390 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5391 
5392 	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5393 	    zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5394 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5395 
5396 	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
5397 	    zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
5398 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5399 	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
5400 	    zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
5401 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5402 
5403 	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
5404 	    zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
5405 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5406 
5407 	zfs_ioctl_register("set_zev_callbacks", ZFS_IOC_SET_ZEV_CALLBACKS,
5408 	    zfs_ioc_set_zev_callbacks, zfs_secpolicy_set_zev_callbacks, NO_NAME,
5409 	    POOL_CHECK_NONE, B_TRUE, B_FALSE);
5410 
5411 	zfs_ioctl_register("unset_zev_callbacks", ZFS_IOC_UNSET_ZEV_CALLBACKS,
5412 	    zfs_ioc_unset_zev_callbacks, zfs_secpolicy_unset_zev_callbacks,
5413 	    NO_NAME, POOL_CHECK_NONE, B_TRUE, B_FALSE);
5414 	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
5415 	    zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
5416 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE);
5417 
5418 	/* IOCTLS that use the legacy function signature */
5419 
5420 	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5421 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5422 
5423 	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5424 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5425 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5426 	    zfs_ioc_pool_scan);
5427 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5428 	    zfs_ioc_pool_upgrade);
5429 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5430 	    zfs_ioc_vdev_add);
5431 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5432 	    zfs_ioc_vdev_remove);
5433 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5434 	    zfs_ioc_vdev_set_state);
5435 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5436 	    zfs_ioc_vdev_attach);
5437 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5438 	    zfs_ioc_vdev_detach);
5439 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5440 	    zfs_ioc_vdev_setpath);
5441 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5442 	    zfs_ioc_vdev_setfru);
5443 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5444 	    zfs_ioc_pool_set_props);
5445 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5446 	    zfs_ioc_vdev_split);
5447 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5448 	    zfs_ioc_pool_reguid);
5449 
5450 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5451 	    zfs_ioc_pool_configs, zfs_secpolicy_none);
5452 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5453 	    zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5454 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5455 	    zfs_ioc_inject_fault, zfs_secpolicy_inject);
5456 	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5457 	    zfs_ioc_clear_fault, zfs_secpolicy_inject);
5458 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5459 	    zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5460 
5461 	/*
5462 	 * pool destroy, and export don't log the history as part of
5463 	 * zfsdev_ioctl, but rather zfs_ioc_pool_export
5464 	 * does the logging of those commands.
5465 	 */
5466 	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5467 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5468 	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5469 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5470 
5471 	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5472 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5473 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5474 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5475 
5476 	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5477 	    zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5478 	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5479 	    zfs_ioc_dsobj_to_dsname,
5480 	    zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5481 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5482 	    zfs_ioc_pool_get_history,
5483 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5484 
5485 	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5486 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5487 
5488 	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5489 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5490 	zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5491 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5492 
5493 	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5494 	    zfs_ioc_space_written);
5495 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5496 	    zfs_ioc_objset_recvd_props);
5497 	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5498 	    zfs_ioc_next_obj);
5499 	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5500 	    zfs_ioc_get_fsacl);
5501 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5502 	    zfs_ioc_objset_stats);
5503 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5504 	    zfs_ioc_objset_zplprops);
5505 	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5506 	    zfs_ioc_dataset_list_next);
5507 	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5508 	    zfs_ioc_snapshot_list_next);
5509 	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5510 	    zfs_ioc_send_progress);
5511 
5512 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5513 	    zfs_ioc_diff, zfs_secpolicy_diff);
5514 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5515 	    zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5516 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5517 	    zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5518 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5519 	    zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5520 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5521 	    zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5522 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5523 	    zfs_ioc_send, zfs_secpolicy_send);
5524 
5525 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5526 	    zfs_secpolicy_none);
5527 	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5528 	    zfs_secpolicy_destroy);
5529 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5530 	    zfs_secpolicy_rename);
5531 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5532 	    zfs_secpolicy_recv);
5533 	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5534 	    zfs_secpolicy_promote);
5535 	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5536 	    zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5537 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5538 	    zfs_secpolicy_set_fsacl);
5539 
5540 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5541 	    zfs_secpolicy_share, POOL_CHECK_NONE);
5542 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5543 	    zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5544 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5545 	    zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5546 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5547 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5548 	    zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5549 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5550 }
5551 
5552 int
5553 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5554     zfs_ioc_poolcheck_t check)
5555 {
5556 	spa_t *spa;
5557 	int error;
5558 
5559 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
5560 
5561 	if (check & POOL_CHECK_NONE)
5562 		return (0);
5563 
5564 	error = spa_open(name, &spa, FTAG);
5565 	if (error == 0) {
5566 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5567 			error = SET_ERROR(EAGAIN);
5568 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5569 			error = SET_ERROR(EROFS);
5570 		spa_close(spa, FTAG);
5571 	}
5572 	return (error);
5573 }
5574 
5575 /*
5576  * Find a free minor number.
5577  */
5578 minor_t
5579 zfsdev_minor_alloc(void)
5580 {
5581 	static minor_t last_minor;
5582 	minor_t m;
5583 
5584 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5585 
5586 	for (m = last_minor + 1; m != last_minor; m++) {
5587 		if (m > ZFSDEV_MAX_MINOR)
5588 			m = 1;
5589 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5590 			last_minor = m;
5591 			return (m);
5592 		}
5593 	}
5594 
5595 	return (0);
5596 }
5597 
5598 static int
5599 zfs_ctldev_init(dev_t *devp)
5600 {
5601 	minor_t minor;
5602 	zfs_soft_state_t *zs;
5603 
5604 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5605 	ASSERT(getminor(*devp) == 0);
5606 
5607 	minor = zfsdev_minor_alloc();
5608 	if (minor == 0)
5609 		return (SET_ERROR(ENXIO));
5610 
5611 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5612 		return (SET_ERROR(EAGAIN));
5613 
5614 	*devp = makedevice(getemajor(*devp), minor);
5615 
5616 	zs = ddi_get_soft_state(zfsdev_state, minor);
5617 	zs->zss_type = ZSST_CTLDEV;
5618 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
5619 
5620 	return (0);
5621 }
5622 
5623 static void
5624 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
5625 {
5626 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5627 
5628 	zfs_onexit_destroy(zo);
5629 	ddi_soft_state_free(zfsdev_state, minor);
5630 }
5631 
5632 void *
5633 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
5634 {
5635 	zfs_soft_state_t *zp;
5636 
5637 	zp = ddi_get_soft_state(zfsdev_state, minor);
5638 	if (zp == NULL || zp->zss_type != which)
5639 		return (NULL);
5640 
5641 	return (zp->zss_data);
5642 }
5643 
5644 static int
5645 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
5646 {
5647 	int error = 0;
5648 
5649 	if (getminor(*devp) != 0)
5650 		return (zvol_open(devp, flag, otyp, cr));
5651 
5652 	/* This is the control device. Allocate a new minor if requested. */
5653 	if (flag & FEXCL) {
5654 		mutex_enter(&zfsdev_state_lock);
5655 		error = zfs_ctldev_init(devp);
5656 		mutex_exit(&zfsdev_state_lock);
5657 	}
5658 
5659 	return (error);
5660 }
5661 
5662 static int
5663 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
5664 {
5665 	zfs_onexit_t *zo;
5666 	minor_t minor = getminor(dev);
5667 
5668 	if (minor == 0)
5669 		return (0);
5670 
5671 	mutex_enter(&zfsdev_state_lock);
5672 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
5673 	if (zo == NULL) {
5674 		mutex_exit(&zfsdev_state_lock);
5675 		return (zvol_close(dev, flag, otyp, cr));
5676 	}
5677 	zfs_ctldev_destroy(zo, minor);
5678 	mutex_exit(&zfsdev_state_lock);
5679 
5680 	return (0);
5681 }
5682 
5683 static int
5684 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
5685 {
5686 	zfs_cmd_t *zc;
5687 	uint_t vecnum;
5688 	int error, rc, len;
5689 	minor_t minor = getminor(dev);
5690 	const zfs_ioc_vec_t *vec;
5691 	char *saved_poolname = NULL;
5692 	nvlist_t *innvl = NULL;
5693 
5694 	if (minor != 0 &&
5695 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
5696 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
5697 
5698 	vecnum = cmd - ZFS_IOC_FIRST;
5699 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
5700 
5701 	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
5702 		return (SET_ERROR(EINVAL));
5703 	vec = &zfs_ioc_vec[vecnum];
5704 
5705 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
5706 
5707 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
5708 	if (error != 0) {
5709 		error = SET_ERROR(EFAULT);
5710 		goto out;
5711 	}
5712 
5713 	zc->zc_iflags = flag & FKIOCTL;
5714 	if (zc->zc_nvlist_src_size != 0) {
5715 		error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
5716 		    zc->zc_iflags, &innvl);
5717 		if (error != 0)
5718 			goto out;
5719 	}
5720 
5721 	/*
5722 	 * Ensure that all pool/dataset names are valid before we pass down to
5723 	 * the lower layers.
5724 	 */
5725 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
5726 	switch (vec->zvec_namecheck) {
5727 	case POOL_NAME:
5728 		if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
5729 			error = SET_ERROR(EINVAL);
5730 		else
5731 			error = pool_status_check(zc->zc_name,
5732 			    vec->zvec_namecheck, vec->zvec_pool_check);
5733 		break;
5734 
5735 	case DATASET_NAME:
5736 		if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
5737 			error = SET_ERROR(EINVAL);
5738 		else
5739 			error = pool_status_check(zc->zc_name,
5740 			    vec->zvec_namecheck, vec->zvec_pool_check);
5741 		break;
5742 
5743 	case NO_NAME:
5744 		break;
5745 	}
5746 
5747 
5748 	if (error == 0 && !(flag & FKIOCTL))
5749 		error = vec->zvec_secpolicy(zc, innvl, cr);
5750 
5751 	if (error != 0)
5752 		goto out;
5753 
5754 	/* legacy ioctls can modify zc_name */
5755 	len = strcspn(zc->zc_name, "/@") + 1;
5756 	saved_poolname = kmem_alloc(len, KM_SLEEP);
5757 	(void) strlcpy(saved_poolname, zc->zc_name, len);
5758 
5759 	if (vec->zvec_func != NULL) {
5760 		nvlist_t *outnvl;
5761 		int puterror = 0;
5762 		spa_t *spa;
5763 		nvlist_t *lognv = NULL;
5764 
5765 		ASSERT(vec->zvec_legacy_func == NULL);
5766 
5767 		/*
5768 		 * Add the innvl to the lognv before calling the func,
5769 		 * in case the func changes the innvl.
5770 		 */
5771 		if (vec->zvec_allow_log) {
5772 			lognv = fnvlist_alloc();
5773 			fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
5774 			    vec->zvec_name);
5775 			if (!nvlist_empty(innvl)) {
5776 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
5777 				    innvl);
5778 			}
5779 		}
5780 
5781 		outnvl = fnvlist_alloc();
5782 		error = vec->zvec_func(zc->zc_name, innvl, outnvl);
5783 
5784 		if (error == 0 && vec->zvec_allow_log &&
5785 		    spa_open(zc->zc_name, &spa, FTAG) == 0) {
5786 			if (!nvlist_empty(outnvl)) {
5787 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
5788 				    outnvl);
5789 			}
5790 			(void) spa_history_log_nvl(spa, lognv);
5791 			spa_close(spa, FTAG);
5792 		}
5793 		fnvlist_free(lognv);
5794 
5795 		if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
5796 			int smusherror = 0;
5797 			if (vec->zvec_smush_outnvlist) {
5798 				smusherror = nvlist_smush(outnvl,
5799 				    zc->zc_nvlist_dst_size);
5800 			}
5801 			if (smusherror == 0)
5802 				puterror = put_nvlist(zc, outnvl);
5803 		}
5804 
5805 		if (puterror != 0)
5806 			error = puterror;
5807 
5808 		nvlist_free(outnvl);
5809 	} else {
5810 		error = vec->zvec_legacy_func(zc);
5811 	}
5812 
5813 out:
5814 	nvlist_free(innvl);
5815 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
5816 	if (error == 0 && rc != 0)
5817 		error = SET_ERROR(EFAULT);
5818 	if (error == 0 && vec->zvec_allow_log) {
5819 		char *s = tsd_get(zfs_allow_log_key);
5820 		if (s != NULL)
5821 			strfree(s);
5822 		(void) tsd_set(zfs_allow_log_key, saved_poolname);
5823 	} else {
5824 		if (saved_poolname != NULL)
5825 			strfree(saved_poolname);
5826 	}
5827 
5828 	kmem_free(zc, sizeof (zfs_cmd_t));
5829 	return (error);
5830 }
5831 
5832 static int
5833 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
5834 {
5835 	if (cmd != DDI_ATTACH)
5836 		return (DDI_FAILURE);
5837 
5838 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
5839 	    DDI_PSEUDO, 0) == DDI_FAILURE)
5840 		return (DDI_FAILURE);
5841 
5842 	zfs_dip = dip;
5843 
5844 	ddi_report_dev(dip);
5845 
5846 	return (DDI_SUCCESS);
5847 }
5848 
5849 static int
5850 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
5851 {
5852 	if (spa_busy() || zfs_busy() || zvol_busy())
5853 		return (DDI_FAILURE);
5854 
5855 	if (cmd != DDI_DETACH)
5856 		return (DDI_FAILURE);
5857 
5858 	zfs_dip = NULL;
5859 
5860 	ddi_prop_remove_all(dip);
5861 	ddi_remove_minor_node(dip, NULL);
5862 
5863 	return (DDI_SUCCESS);
5864 }
5865 
5866 /*ARGSUSED*/
5867 static int
5868 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
5869 {
5870 	switch (infocmd) {
5871 	case DDI_INFO_DEVT2DEVINFO:
5872 		*result = zfs_dip;
5873 		return (DDI_SUCCESS);
5874 
5875 	case DDI_INFO_DEVT2INSTANCE:
5876 		*result = (void *)0;
5877 		return (DDI_SUCCESS);
5878 	}
5879 
5880 	return (DDI_FAILURE);
5881 }
5882 
5883 /*
5884  * OK, so this is a little weird.
5885  *
5886  * /dev/zfs is the control node, i.e. minor 0.
5887  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
5888  *
5889  * /dev/zfs has basically nothing to do except serve up ioctls,
5890  * so most of the standard driver entry points are in zvol.c.
5891  */
5892 static struct cb_ops zfs_cb_ops = {
5893 	zfsdev_open,	/* open */
5894 	zfsdev_close,	/* close */
5895 	zvol_strategy,	/* strategy */
5896 	nodev,		/* print */
5897 	zvol_dump,	/* dump */
5898 	zvol_read,	/* read */
5899 	zvol_write,	/* write */
5900 	zfsdev_ioctl,	/* ioctl */
5901 	nodev,		/* devmap */
5902 	nodev,		/* mmap */
5903 	nodev,		/* segmap */
5904 	nochpoll,	/* poll */
5905 	ddi_prop_op,	/* prop_op */
5906 	NULL,		/* streamtab */
5907 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
5908 	CB_REV,		/* version */
5909 	nodev,		/* async read */
5910 	nodev,		/* async write */
5911 };
5912 
5913 static struct dev_ops zfs_dev_ops = {
5914 	DEVO_REV,	/* version */
5915 	0,		/* refcnt */
5916 	zfs_info,	/* info */
5917 	nulldev,	/* identify */
5918 	nulldev,	/* probe */
5919 	zfs_attach,	/* attach */
5920 	zfs_detach,	/* detach */
5921 	nodev,		/* reset */
5922 	&zfs_cb_ops,	/* driver operations */
5923 	NULL,		/* no bus operations */
5924 	NULL,		/* power */
5925 	ddi_quiesce_not_needed,	/* quiesce */
5926 };
5927 
5928 static struct modldrv zfs_modldrv = {
5929 	&mod_driverops,
5930 	"ZFS storage pool",
5931 	&zfs_dev_ops
5932 };
5933 
5934 static struct modlinkage modlinkage = {
5935 	MODREV_1,
5936 	(void *)&zfs_modlfs,
5937 	(void *)&zfs_modldrv,
5938 	NULL
5939 };
5940 
5941 static void
5942 zfs_allow_log_destroy(void *arg)
5943 {
5944 	char *poolname = arg;
5945 	strfree(poolname);
5946 }
5947 
5948 int
5949 _init(void)
5950 {
5951 	int error;
5952 
5953 	spa_init(FREAD | FWRITE);
5954 	zfs_init();
5955 	zvol_init();
5956 	zfs_ioctl_init();
5957 	rz_zev_init();
5958 
5959 	if ((error = mod_install(&modlinkage)) != 0) {
5960 		zvol_fini();
5961 		zfs_fini();
5962 		spa_fini();
5963 		return (error);
5964 	}
5965 
5966 	tsd_create(&zfs_fsyncer_key, NULL);
5967 	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
5968 	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
5969 
5970 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
5971 	ASSERT(error == 0);
5972 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
5973 
5974 	return (0);
5975 }
5976 
5977 int
5978 _fini(void)
5979 {
5980 	int error;
5981 
5982 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
5983 		return (SET_ERROR(EBUSY));
5984 
5985 	if ((error = mod_remove(&modlinkage)) != 0)
5986 		return (error);
5987 
5988 	rz_zev_fini();
5989 	zvol_fini();
5990 	zfs_fini();
5991 	spa_fini();
5992 	if (zfs_nfsshare_inited)
5993 		(void) ddi_modclose(nfs_mod);
5994 	if (zfs_smbshare_inited)
5995 		(void) ddi_modclose(smbsrv_mod);
5996 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
5997 		(void) ddi_modclose(sharefs_mod);
5998 
5999 	tsd_destroy(&zfs_fsyncer_key);
6000 	ldi_ident_release(zfs_li);
6001 	zfs_li = NULL;
6002 	mutex_destroy(&zfs_share_lock);
6003 
6004 	return (error);
6005 }
6006 
6007 int
6008 _info(struct modinfo *modinfop)
6009 {
6010 	return (mod_info(&modlinkage, modinfop));
6011 }
6012