xref: /titanic_44/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision 87308b749adb04ab3f564c765b089962af3edb4d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Portions Copyright 2011 Martin Matuska
25  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
26  * Copyright (c) 2014, Joyent, Inc. All rights reserved.
27  * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
28  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
29  * Copyright (c) 2013 Steven Hartland. All rights reserved.
30  */
31 
32 /*
33  * ZFS ioctls.
34  *
35  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
36  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
37  *
38  * There are two ways that we handle ioctls: the legacy way where almost
39  * all of the logic is in the ioctl callback, and the new way where most
40  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
41  *
42  * Non-legacy ioctls should be registered by calling
43  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
44  * from userland by lzc_ioctl().
45  *
46  * The registration arguments are as follows:
47  *
48  * const char *name
49  *   The name of the ioctl.  This is used for history logging.  If the
50  *   ioctl returns successfully (the callback returns 0), and allow_log
51  *   is true, then a history log entry will be recorded with the input &
52  *   output nvlists.  The log entry can be printed with "zpool history -i".
53  *
54  * zfs_ioc_t ioc
55  *   The ioctl request number, which userland will pass to ioctl(2).
56  *   The ioctl numbers can change from release to release, because
57  *   the caller (libzfs) must be matched to the kernel.
58  *
59  * zfs_secpolicy_func_t *secpolicy
60  *   This function will be called before the zfs_ioc_func_t, to
61  *   determine if this operation is permitted.  It should return EPERM
62  *   on failure, and 0 on success.  Checks include determining if the
63  *   dataset is visible in this zone, and if the user has either all
64  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
65  *   to do this operation on this dataset with "zfs allow".
66  *
67  * zfs_ioc_namecheck_t namecheck
68  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
69  *   name, a dataset name, or nothing.  If the name is not well-formed,
70  *   the ioctl will fail and the callback will not be called.
71  *   Therefore, the callback can assume that the name is well-formed
72  *   (e.g. is null-terminated, doesn't have more than one '@' character,
73  *   doesn't have invalid characters).
74  *
75  * zfs_ioc_poolcheck_t pool_check
76  *   This specifies requirements on the pool state.  If the pool does
77  *   not meet them (is suspended or is readonly), the ioctl will fail
78  *   and the callback will not be called.  If any checks are specified
79  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
80  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
81  *   POOL_CHECK_READONLY).
82  *
83  * boolean_t smush_outnvlist
84  *   If smush_outnvlist is true, then the output is presumed to be a
85  *   list of errors, and it will be "smushed" down to fit into the
86  *   caller's buffer, by removing some entries and replacing them with a
87  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
88  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
89  *   outnvlist does not fit into the userland-provided buffer, then the
90  *   ioctl will fail with ENOMEM.
91  *
92  * zfs_ioc_func_t *func
93  *   The callback function that will perform the operation.
94  *
95  *   The callback should return 0 on success, or an error number on
96  *   failure.  If the function fails, the userland ioctl will return -1,
97  *   and errno will be set to the callback's return value.  The callback
98  *   will be called with the following arguments:
99  *
100  *   const char *name
101  *     The name of the pool or dataset to operate on, from
102  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
103  *     expected type (pool, dataset, or none).
104  *
105  *   nvlist_t *innvl
106  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
107  *     NULL if no input nvlist was provided.  Changes to this nvlist are
108  *     ignored.  If the input nvlist could not be deserialized, the
109  *     ioctl will fail and the callback will not be called.
110  *
111  *   nvlist_t *outnvl
112  *     The output nvlist, initially empty.  The callback can fill it in,
113  *     and it will be returned to userland by serializing it into
114  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
115  *     fails (e.g. because the caller didn't supply a large enough
116  *     buffer), then the overall ioctl will fail.  See the
117  *     'smush_nvlist' argument above for additional behaviors.
118  *
119  *     There are two typical uses of the output nvlist:
120  *       - To return state, e.g. property values.  In this case,
121  *         smush_outnvlist should be false.  If the buffer was not large
122  *         enough, the caller will reallocate a larger buffer and try
123  *         the ioctl again.
124  *
125  *       - To return multiple errors from an ioctl which makes on-disk
126  *         changes.  In this case, smush_outnvlist should be true.
127  *         Ioctls which make on-disk modifications should generally not
128  *         use the outnvl if they succeed, because the caller can not
129  *         distinguish between the operation failing, and
130  *         deserialization failing.
131  */
132 
133 #include <sys/types.h>
134 #include <sys/param.h>
135 #include <sys/errno.h>
136 #include <sys/uio.h>
137 #include <sys/buf.h>
138 #include <sys/modctl.h>
139 #include <sys/open.h>
140 #include <sys/file.h>
141 #include <sys/kmem.h>
142 #include <sys/conf.h>
143 #include <sys/cmn_err.h>
144 #include <sys/stat.h>
145 #include <sys/zfs_ioctl.h>
146 #include <sys/zfs_vfsops.h>
147 #include <sys/zfs_znode.h>
148 #include <sys/zap.h>
149 #include <sys/spa.h>
150 #include <sys/spa_impl.h>
151 #include <sys/vdev.h>
152 #include <sys/priv_impl.h>
153 #include <sys/dmu.h>
154 #include <sys/dsl_dir.h>
155 #include <sys/dsl_dataset.h>
156 #include <sys/dsl_prop.h>
157 #include <sys/dsl_deleg.h>
158 #include <sys/dmu_objset.h>
159 #include <sys/dmu_impl.h>
160 #include <sys/dmu_tx.h>
161 #include <sys/ddi.h>
162 #include <sys/sunddi.h>
163 #include <sys/sunldi.h>
164 #include <sys/policy.h>
165 #include <sys/zone.h>
166 #include <sys/nvpair.h>
167 #include <sys/pathname.h>
168 #include <sys/mount.h>
169 #include <sys/sdt.h>
170 #include <sys/fs/zfs.h>
171 #include <sys/zfs_ctldir.h>
172 #include <sys/zfs_dir.h>
173 #include <sys/zfs_onexit.h>
174 #include <sys/zvol.h>
175 #include <sys/dsl_scan.h>
176 #include <sharefs/share.h>
177 #include <sys/dmu_objset.h>
178 #include <sys/dmu_send.h>
179 #include <sys/dsl_destroy.h>
180 #include <sys/dsl_bookmark.h>
181 #include <sys/dsl_userhold.h>
182 #include <sys/zfeature.h>
183 #include <sys/zfs_events.h>
184 
185 #include "zfs_namecheck.h"
186 #include "zfs_prop.h"
187 #include "zfs_deleg.h"
188 #include "zfs_comutil.h"
189 
190 extern struct modlfs zfs_modlfs;
191 
192 extern void zfs_init(void);
193 extern void zfs_fini(void);
194 
195 ldi_ident_t zfs_li = NULL;
196 dev_info_t *zfs_dip;
197 
198 uint_t zfs_fsyncer_key;
199 extern uint_t rrw_tsd_key;
200 static uint_t zfs_allow_log_key;
201 
202 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
203 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
204 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
205 
206 typedef enum {
207 	NO_NAME,
208 	POOL_NAME,
209 	DATASET_NAME
210 } zfs_ioc_namecheck_t;
211 
212 typedef enum {
213 	POOL_CHECK_NONE		= 1 << 0,
214 	POOL_CHECK_SUSPENDED	= 1 << 1,
215 	POOL_CHECK_READONLY	= 1 << 2,
216 } zfs_ioc_poolcheck_t;
217 
218 typedef struct zfs_ioc_vec {
219 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
220 	zfs_ioc_func_t		*zvec_func;
221 	zfs_secpolicy_func_t	*zvec_secpolicy;
222 	zfs_ioc_namecheck_t	zvec_namecheck;
223 	boolean_t		zvec_allow_log;
224 	zfs_ioc_poolcheck_t	zvec_pool_check;
225 	boolean_t		zvec_smush_outnvlist;
226 	const char		*zvec_name;
227 } zfs_ioc_vec_t;
228 
229 /* This array is indexed by zfs_userquota_prop_t */
230 static const char *userquota_perms[] = {
231 	ZFS_DELEG_PERM_USERUSED,
232 	ZFS_DELEG_PERM_USERQUOTA,
233 	ZFS_DELEG_PERM_GROUPUSED,
234 	ZFS_DELEG_PERM_GROUPQUOTA,
235 };
236 
237 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
238 static int zfs_check_settable(const char *name, nvpair_t *property,
239     cred_t *cr);
240 static int zfs_check_clearable(char *dataset, nvlist_t *props,
241     nvlist_t **errors);
242 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
243     boolean_t *);
244 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
245 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
246 
247 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
248 
249 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
250 void
251 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
252 {
253 	const char *newfile;
254 	char buf[512];
255 	va_list adx;
256 
257 	/*
258 	 * Get rid of annoying "../common/" prefix to filename.
259 	 */
260 	newfile = strrchr(file, '/');
261 	if (newfile != NULL) {
262 		newfile = newfile + 1; /* Get rid of leading / */
263 	} else {
264 		newfile = file;
265 	}
266 
267 	va_start(adx, fmt);
268 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
269 	va_end(adx);
270 
271 	/*
272 	 * To get this data, use the zfs-dprintf probe as so:
273 	 * dtrace -q -n 'zfs-dprintf \
274 	 *	/stringof(arg0) == "dbuf.c"/ \
275 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
276 	 * arg0 = file name
277 	 * arg1 = function name
278 	 * arg2 = line number
279 	 * arg3 = message
280 	 */
281 	DTRACE_PROBE4(zfs__dprintf,
282 	    char *, newfile, char *, func, int, line, char *, buf);
283 }
284 
285 static void
286 history_str_free(char *buf)
287 {
288 	kmem_free(buf, HIS_MAX_RECORD_LEN);
289 }
290 
291 static char *
292 history_str_get(zfs_cmd_t *zc)
293 {
294 	char *buf;
295 
296 	if (zc->zc_history == NULL)
297 		return (NULL);
298 
299 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
300 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
301 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
302 		history_str_free(buf);
303 		return (NULL);
304 	}
305 
306 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
307 
308 	return (buf);
309 }
310 
311 /*
312  * Check to see if the named dataset is currently defined as bootable
313  */
314 static boolean_t
315 zfs_is_bootfs(const char *name)
316 {
317 	objset_t *os;
318 
319 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
320 		boolean_t ret;
321 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
322 		dmu_objset_rele(os, FTAG);
323 		return (ret);
324 	}
325 	return (B_FALSE);
326 }
327 
328 /*
329  * Return non-zero if the spa version is less than requested version.
330  */
331 static int
332 zfs_earlier_version(const char *name, int version)
333 {
334 	spa_t *spa;
335 
336 	if (spa_open(name, &spa, FTAG) == 0) {
337 		if (spa_version(spa) < version) {
338 			spa_close(spa, FTAG);
339 			return (1);
340 		}
341 		spa_close(spa, FTAG);
342 	}
343 	return (0);
344 }
345 
346 /*
347  * Return TRUE if the ZPL version is less than requested version.
348  */
349 static boolean_t
350 zpl_earlier_version(const char *name, int version)
351 {
352 	objset_t *os;
353 	boolean_t rc = B_TRUE;
354 
355 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
356 		uint64_t zplversion;
357 
358 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
359 			dmu_objset_rele(os, FTAG);
360 			return (B_TRUE);
361 		}
362 		/* XXX reading from non-owned objset */
363 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
364 			rc = zplversion < version;
365 		dmu_objset_rele(os, FTAG);
366 	}
367 	return (rc);
368 }
369 
370 static void
371 zfs_log_history(zfs_cmd_t *zc)
372 {
373 	spa_t *spa;
374 	char *buf;
375 
376 	if ((buf = history_str_get(zc)) == NULL)
377 		return;
378 
379 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
380 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
381 			(void) spa_history_log(spa, buf);
382 		spa_close(spa, FTAG);
383 	}
384 	history_str_free(buf);
385 }
386 
387 /*
388  * Policy for top-level read operations (list pools).  Requires no privileges,
389  * and can be used in the local zone, as there is no associated dataset.
390  */
391 /* ARGSUSED */
392 static int
393 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
394 {
395 	return (0);
396 }
397 
398 /*
399  * Policy for dataset read operations (list children, get statistics).  Requires
400  * no privileges, but must be visible in the local zone.
401  */
402 /* ARGSUSED */
403 static int
404 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
405 {
406 	if (INGLOBALZONE(curproc) ||
407 	    zone_dataset_visible(zc->zc_name, NULL))
408 		return (0);
409 
410 	return (SET_ERROR(ENOENT));
411 }
412 
413 static int
414 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
415 {
416 	int writable = 1;
417 
418 	/*
419 	 * The dataset must be visible by this zone -- check this first
420 	 * so they don't see EPERM on something they shouldn't know about.
421 	 */
422 	if (!INGLOBALZONE(curproc) &&
423 	    !zone_dataset_visible(dataset, &writable))
424 		return (SET_ERROR(ENOENT));
425 
426 	if (INGLOBALZONE(curproc)) {
427 		/*
428 		 * If the fs is zoned, only root can access it from the
429 		 * global zone.
430 		 */
431 		if (secpolicy_zfs(cr) && zoned)
432 			return (SET_ERROR(EPERM));
433 	} else {
434 		/*
435 		 * If we are in a local zone, the 'zoned' property must be set.
436 		 */
437 		if (!zoned)
438 			return (SET_ERROR(EPERM));
439 
440 		/* must be writable by this zone */
441 		if (!writable)
442 			return (SET_ERROR(EPERM));
443 	}
444 	return (0);
445 }
446 
447 static int
448 zfs_dozonecheck(const char *dataset, cred_t *cr)
449 {
450 	uint64_t zoned;
451 
452 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
453 		return (SET_ERROR(ENOENT));
454 
455 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
456 }
457 
458 static int
459 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
460 {
461 	uint64_t zoned;
462 
463 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
464 		return (SET_ERROR(ENOENT));
465 
466 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
467 }
468 
469 static int
470 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
471     const char *perm, cred_t *cr)
472 {
473 	int error;
474 
475 	error = zfs_dozonecheck_ds(name, ds, cr);
476 	if (error == 0) {
477 		error = secpolicy_zfs(cr);
478 		if (error != 0)
479 			error = dsl_deleg_access_impl(ds, perm, cr);
480 	}
481 	return (error);
482 }
483 
484 static int
485 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
486 {
487 	int error;
488 	dsl_dataset_t *ds;
489 	dsl_pool_t *dp;
490 
491 	error = dsl_pool_hold(name, FTAG, &dp);
492 	if (error != 0)
493 		return (error);
494 
495 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
496 	if (error != 0) {
497 		dsl_pool_rele(dp, FTAG);
498 		return (error);
499 	}
500 
501 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
502 
503 	dsl_dataset_rele(ds, FTAG);
504 	dsl_pool_rele(dp, FTAG);
505 	return (error);
506 }
507 
508 /*
509  * Policy for setting the security label property.
510  *
511  * Returns 0 for success, non-zero for access and other errors.
512  */
513 static int
514 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
515 {
516 	char		ds_hexsl[MAXNAMELEN];
517 	bslabel_t	ds_sl, new_sl;
518 	boolean_t	new_default = FALSE;
519 	uint64_t	zoned;
520 	int		needed_priv = -1;
521 	int		error;
522 
523 	/* First get the existing dataset label. */
524 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
525 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
526 	if (error != 0)
527 		return (SET_ERROR(EPERM));
528 
529 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
530 		new_default = TRUE;
531 
532 	/* The label must be translatable */
533 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
534 		return (SET_ERROR(EINVAL));
535 
536 	/*
537 	 * In a non-global zone, disallow attempts to set a label that
538 	 * doesn't match that of the zone; otherwise no other checks
539 	 * are needed.
540 	 */
541 	if (!INGLOBALZONE(curproc)) {
542 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
543 			return (SET_ERROR(EPERM));
544 		return (0);
545 	}
546 
547 	/*
548 	 * For global-zone datasets (i.e., those whose zoned property is
549 	 * "off", verify that the specified new label is valid for the
550 	 * global zone.
551 	 */
552 	if (dsl_prop_get_integer(name,
553 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
554 		return (SET_ERROR(EPERM));
555 	if (!zoned) {
556 		if (zfs_check_global_label(name, strval) != 0)
557 			return (SET_ERROR(EPERM));
558 	}
559 
560 	/*
561 	 * If the existing dataset label is nondefault, check if the
562 	 * dataset is mounted (label cannot be changed while mounted).
563 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
564 	 * mounted (or isn't a dataset, doesn't exist, ...).
565 	 */
566 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
567 		objset_t *os;
568 		static char *setsl_tag = "setsl_tag";
569 
570 		/*
571 		 * Try to own the dataset; abort if there is any error,
572 		 * (e.g., already mounted, in use, or other error).
573 		 */
574 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
575 		    setsl_tag, &os);
576 		if (error != 0)
577 			return (SET_ERROR(EPERM));
578 
579 		dmu_objset_disown(os, setsl_tag);
580 
581 		if (new_default) {
582 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
583 			goto out_check;
584 		}
585 
586 		if (hexstr_to_label(strval, &new_sl) != 0)
587 			return (SET_ERROR(EPERM));
588 
589 		if (blstrictdom(&ds_sl, &new_sl))
590 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
591 		else if (blstrictdom(&new_sl, &ds_sl))
592 			needed_priv = PRIV_FILE_UPGRADE_SL;
593 	} else {
594 		/* dataset currently has a default label */
595 		if (!new_default)
596 			needed_priv = PRIV_FILE_UPGRADE_SL;
597 	}
598 
599 out_check:
600 	if (needed_priv != -1)
601 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
602 	return (0);
603 }
604 
605 static int
606 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
607     cred_t *cr)
608 {
609 	char *strval;
610 
611 	/*
612 	 * Check permissions for special properties.
613 	 */
614 	switch (prop) {
615 	case ZFS_PROP_ZONED:
616 		/*
617 		 * Disallow setting of 'zoned' from within a local zone.
618 		 */
619 		if (!INGLOBALZONE(curproc))
620 			return (SET_ERROR(EPERM));
621 		break;
622 
623 	case ZFS_PROP_QUOTA:
624 	case ZFS_PROP_FILESYSTEM_LIMIT:
625 	case ZFS_PROP_SNAPSHOT_LIMIT:
626 		if (!INGLOBALZONE(curproc)) {
627 			uint64_t zoned;
628 			char setpoint[ZFS_MAX_DATASET_NAME_LEN];
629 			/*
630 			 * Unprivileged users are allowed to modify the
631 			 * limit on things *under* (ie. contained by)
632 			 * the thing they own.
633 			 */
634 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
635 			    setpoint))
636 				return (SET_ERROR(EPERM));
637 			if (!zoned || strlen(dsname) <= strlen(setpoint))
638 				return (SET_ERROR(EPERM));
639 		}
640 		break;
641 
642 	case ZFS_PROP_MLSLABEL:
643 		if (!is_system_labeled())
644 			return (SET_ERROR(EPERM));
645 
646 		if (nvpair_value_string(propval, &strval) == 0) {
647 			int err;
648 
649 			err = zfs_set_slabel_policy(dsname, strval, CRED());
650 			if (err != 0)
651 				return (err);
652 		}
653 		break;
654 	}
655 
656 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
657 }
658 
659 /* ARGSUSED */
660 static int
661 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
662 {
663 	int error;
664 
665 	error = zfs_dozonecheck(zc->zc_name, cr);
666 	if (error != 0)
667 		return (error);
668 
669 	/*
670 	 * permission to set permissions will be evaluated later in
671 	 * dsl_deleg_can_allow()
672 	 */
673 	return (0);
674 }
675 
676 /* ARGSUSED */
677 static int
678 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
679 {
680 	return (zfs_secpolicy_write_perms(zc->zc_name,
681 	    ZFS_DELEG_PERM_ROLLBACK, cr));
682 }
683 
684 /* ARGSUSED */
685 static int
686 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
687 {
688 	dsl_pool_t *dp;
689 	dsl_dataset_t *ds;
690 	char *cp;
691 	int error;
692 
693 	/*
694 	 * Generate the current snapshot name from the given objsetid, then
695 	 * use that name for the secpolicy/zone checks.
696 	 */
697 	cp = strchr(zc->zc_name, '@');
698 	if (cp == NULL)
699 		return (SET_ERROR(EINVAL));
700 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
701 	if (error != 0)
702 		return (error);
703 
704 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
705 	if (error != 0) {
706 		dsl_pool_rele(dp, FTAG);
707 		return (error);
708 	}
709 
710 	dsl_dataset_name(ds, zc->zc_name);
711 
712 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
713 	    ZFS_DELEG_PERM_SEND, cr);
714 	dsl_dataset_rele(ds, FTAG);
715 	dsl_pool_rele(dp, FTAG);
716 
717 	return (error);
718 }
719 
720 /* ARGSUSED */
721 static int
722 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
723 {
724 	return (zfs_secpolicy_write_perms(zc->zc_name,
725 	    ZFS_DELEG_PERM_SEND, cr));
726 }
727 
728 /* ARGSUSED */
729 static int
730 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
731 {
732 	vnode_t *vp;
733 	int error;
734 
735 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
736 	    NO_FOLLOW, NULL, &vp)) != 0)
737 		return (error);
738 
739 	/* Now make sure mntpnt and dataset are ZFS */
740 
741 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
742 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
743 	    zc->zc_name) != 0)) {
744 		VN_RELE(vp);
745 		return (SET_ERROR(EPERM));
746 	}
747 
748 	VN_RELE(vp);
749 	return (dsl_deleg_access(zc->zc_name,
750 	    ZFS_DELEG_PERM_SHARE, cr));
751 }
752 
753 int
754 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
755 {
756 	if (!INGLOBALZONE(curproc))
757 		return (SET_ERROR(EPERM));
758 
759 	if (secpolicy_nfs(cr) == 0) {
760 		return (0);
761 	} else {
762 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
763 	}
764 }
765 
766 int
767 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
768 {
769 	if (!INGLOBALZONE(curproc))
770 		return (SET_ERROR(EPERM));
771 
772 	if (secpolicy_smb(cr) == 0) {
773 		return (0);
774 	} else {
775 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
776 	}
777 }
778 
779 static int
780 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
781 {
782 	char *cp;
783 
784 	/*
785 	 * Remove the @bla or /bla from the end of the name to get the parent.
786 	 */
787 	(void) strncpy(parent, datasetname, parentsize);
788 	cp = strrchr(parent, '@');
789 	if (cp != NULL) {
790 		cp[0] = '\0';
791 	} else {
792 		cp = strrchr(parent, '/');
793 		if (cp == NULL)
794 			return (SET_ERROR(ENOENT));
795 		cp[0] = '\0';
796 	}
797 
798 	return (0);
799 }
800 
801 int
802 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
803 {
804 	int error;
805 
806 	if ((error = zfs_secpolicy_write_perms(name,
807 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
808 		return (error);
809 
810 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
811 }
812 
813 /* ARGSUSED */
814 static int
815 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
816 {
817 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
818 }
819 
820 /*
821  * Destroying snapshots with delegated permissions requires
822  * descendant mount and destroy permissions.
823  */
824 /* ARGSUSED */
825 static int
826 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
827 {
828 	nvlist_t *snaps;
829 	nvpair_t *pair, *nextpair;
830 	int error = 0;
831 
832 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
833 		return (SET_ERROR(EINVAL));
834 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
835 	    pair = nextpair) {
836 		nextpair = nvlist_next_nvpair(snaps, pair);
837 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
838 		if (error == ENOENT) {
839 			/*
840 			 * Ignore any snapshots that don't exist (we consider
841 			 * them "already destroyed").  Remove the name from the
842 			 * nvl here in case the snapshot is created between
843 			 * now and when we try to destroy it (in which case
844 			 * we don't want to destroy it since we haven't
845 			 * checked for permission).
846 			 */
847 			fnvlist_remove_nvpair(snaps, pair);
848 			error = 0;
849 		}
850 		if (error != 0)
851 			break;
852 	}
853 
854 	return (error);
855 }
856 
857 int
858 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
859 {
860 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
861 	int	error;
862 
863 	if ((error = zfs_secpolicy_write_perms(from,
864 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
865 		return (error);
866 
867 	if ((error = zfs_secpolicy_write_perms(from,
868 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
869 		return (error);
870 
871 	if ((error = zfs_get_parent(to, parentname,
872 	    sizeof (parentname))) != 0)
873 		return (error);
874 
875 	if ((error = zfs_secpolicy_write_perms(parentname,
876 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
877 		return (error);
878 
879 	if ((error = zfs_secpolicy_write_perms(parentname,
880 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
881 		return (error);
882 
883 	return (error);
884 }
885 
886 /* ARGSUSED */
887 static int
888 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
889 {
890 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
891 }
892 
893 /* ARGSUSED */
894 static int
895 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
896 {
897 	dsl_pool_t *dp;
898 	dsl_dataset_t *clone;
899 	int error;
900 
901 	error = zfs_secpolicy_write_perms(zc->zc_name,
902 	    ZFS_DELEG_PERM_PROMOTE, cr);
903 	if (error != 0)
904 		return (error);
905 
906 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
907 	if (error != 0)
908 		return (error);
909 
910 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
911 
912 	if (error == 0) {
913 		char parentname[ZFS_MAX_DATASET_NAME_LEN];
914 		dsl_dataset_t *origin = NULL;
915 		dsl_dir_t *dd;
916 		dd = clone->ds_dir;
917 
918 		error = dsl_dataset_hold_obj(dd->dd_pool,
919 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
920 		if (error != 0) {
921 			dsl_dataset_rele(clone, FTAG);
922 			dsl_pool_rele(dp, FTAG);
923 			return (error);
924 		}
925 
926 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
927 		    ZFS_DELEG_PERM_MOUNT, cr);
928 
929 		dsl_dataset_name(origin, parentname);
930 		if (error == 0) {
931 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
932 			    ZFS_DELEG_PERM_PROMOTE, cr);
933 		}
934 		dsl_dataset_rele(clone, FTAG);
935 		dsl_dataset_rele(origin, FTAG);
936 	}
937 	dsl_pool_rele(dp, FTAG);
938 	return (error);
939 }
940 
941 /* ARGSUSED */
942 static int
943 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
944 {
945 	int error;
946 
947 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
948 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
949 		return (error);
950 
951 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
952 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
953 		return (error);
954 
955 	return (zfs_secpolicy_write_perms(zc->zc_name,
956 	    ZFS_DELEG_PERM_CREATE, cr));
957 }
958 
959 int
960 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
961 {
962 	return (zfs_secpolicy_write_perms(name,
963 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
964 }
965 
966 /*
967  * Check for permission to create each snapshot in the nvlist.
968  */
969 /* ARGSUSED */
970 static int
971 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
972 {
973 	nvlist_t *snaps;
974 	int error = 0;
975 	nvpair_t *pair;
976 
977 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
978 		return (SET_ERROR(EINVAL));
979 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
980 	    pair = nvlist_next_nvpair(snaps, pair)) {
981 		char *name = nvpair_name(pair);
982 		char *atp = strchr(name, '@');
983 
984 		if (atp == NULL) {
985 			error = SET_ERROR(EINVAL);
986 			break;
987 		}
988 		*atp = '\0';
989 		error = zfs_secpolicy_snapshot_perms(name, cr);
990 		*atp = '@';
991 		if (error != 0)
992 			break;
993 	}
994 	return (error);
995 }
996 
997 /*
998  * Check for permission to create each snapshot in the nvlist.
999  */
1000 /* ARGSUSED */
1001 static int
1002 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1003 {
1004 	int error = 0;
1005 
1006 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1007 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1008 		char *name = nvpair_name(pair);
1009 		char *hashp = strchr(name, '#');
1010 
1011 		if (hashp == NULL) {
1012 			error = SET_ERROR(EINVAL);
1013 			break;
1014 		}
1015 		*hashp = '\0';
1016 		error = zfs_secpolicy_write_perms(name,
1017 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1018 		*hashp = '#';
1019 		if (error != 0)
1020 			break;
1021 	}
1022 	return (error);
1023 }
1024 
1025 /* ARGSUSED */
1026 static int
1027 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1028 {
1029 	nvpair_t *pair, *nextpair;
1030 	int error = 0;
1031 
1032 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1033 	    pair = nextpair) {
1034 		char *name = nvpair_name(pair);
1035 		char *hashp = strchr(name, '#');
1036 		nextpair = nvlist_next_nvpair(innvl, pair);
1037 
1038 		if (hashp == NULL) {
1039 			error = SET_ERROR(EINVAL);
1040 			break;
1041 		}
1042 
1043 		*hashp = '\0';
1044 		error = zfs_secpolicy_write_perms(name,
1045 		    ZFS_DELEG_PERM_DESTROY, cr);
1046 		*hashp = '#';
1047 		if (error == ENOENT) {
1048 			/*
1049 			 * Ignore any filesystems that don't exist (we consider
1050 			 * their bookmarks "already destroyed").  Remove
1051 			 * the name from the nvl here in case the filesystem
1052 			 * is created between now and when we try to destroy
1053 			 * the bookmark (in which case we don't want to
1054 			 * destroy it since we haven't checked for permission).
1055 			 */
1056 			fnvlist_remove_nvpair(innvl, pair);
1057 			error = 0;
1058 		}
1059 		if (error != 0)
1060 			break;
1061 	}
1062 
1063 	return (error);
1064 }
1065 
1066 /* ARGSUSED */
1067 static int
1068 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1069 {
1070 	/*
1071 	 * Even root must have a proper TSD so that we know what pool
1072 	 * to log to.
1073 	 */
1074 	if (tsd_get(zfs_allow_log_key) == NULL)
1075 		return (SET_ERROR(EPERM));
1076 	return (0);
1077 }
1078 
1079 static int
1080 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1081 {
1082 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
1083 	int	error;
1084 	char	*origin;
1085 
1086 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1087 	    sizeof (parentname))) != 0)
1088 		return (error);
1089 
1090 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1091 	    (error = zfs_secpolicy_write_perms(origin,
1092 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1093 		return (error);
1094 
1095 	if ((error = zfs_secpolicy_write_perms(parentname,
1096 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1097 		return (error);
1098 
1099 	return (zfs_secpolicy_write_perms(parentname,
1100 	    ZFS_DELEG_PERM_MOUNT, cr));
1101 }
1102 
1103 /*
1104  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1105  * SYS_CONFIG privilege, which is not available in a local zone.
1106  */
1107 /* ARGSUSED */
1108 static int
1109 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1110 {
1111 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1112 		return (SET_ERROR(EPERM));
1113 
1114 	return (0);
1115 }
1116 
1117 /*
1118  * Policy for object to name lookups.
1119  */
1120 /* ARGSUSED */
1121 static int
1122 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1123 {
1124 	int error;
1125 
1126 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1127 		return (0);
1128 
1129 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1130 	return (error);
1131 }
1132 
1133 /*
1134  * Policy for fault injection.  Requires all privileges.
1135  */
1136 /* ARGSUSED */
1137 static int
1138 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1139 {
1140 	return (secpolicy_zinject(cr));
1141 }
1142 
1143 /* ARGSUSED */
1144 static int
1145 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1146 {
1147 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1148 
1149 	if (prop == ZPROP_INVAL) {
1150 		if (!zfs_prop_user(zc->zc_value))
1151 			return (SET_ERROR(EINVAL));
1152 		return (zfs_secpolicy_write_perms(zc->zc_name,
1153 		    ZFS_DELEG_PERM_USERPROP, cr));
1154 	} else {
1155 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1156 		    NULL, cr));
1157 	}
1158 }
1159 
1160 static int
1161 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1162 {
1163 	int err = zfs_secpolicy_read(zc, innvl, cr);
1164 	if (err)
1165 		return (err);
1166 
1167 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1168 		return (SET_ERROR(EINVAL));
1169 
1170 	if (zc->zc_value[0] == 0) {
1171 		/*
1172 		 * They are asking about a posix uid/gid.  If it's
1173 		 * themself, allow it.
1174 		 */
1175 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1176 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1177 			if (zc->zc_guid == crgetuid(cr))
1178 				return (0);
1179 		} else {
1180 			if (groupmember(zc->zc_guid, cr))
1181 				return (0);
1182 		}
1183 	}
1184 
1185 	return (zfs_secpolicy_write_perms(zc->zc_name,
1186 	    userquota_perms[zc->zc_objset_type], cr));
1187 }
1188 
1189 static int
1190 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1191 {
1192 	int err = zfs_secpolicy_read(zc, innvl, cr);
1193 	if (err)
1194 		return (err);
1195 
1196 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1197 		return (SET_ERROR(EINVAL));
1198 
1199 	return (zfs_secpolicy_write_perms(zc->zc_name,
1200 	    userquota_perms[zc->zc_objset_type], cr));
1201 }
1202 
1203 /* ARGSUSED */
1204 static int
1205 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1206 {
1207 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1208 	    NULL, cr));
1209 }
1210 
1211 /* ARGSUSED */
1212 static int
1213 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1214 {
1215 	nvpair_t *pair;
1216 	nvlist_t *holds;
1217 	int error;
1218 
1219 	error = nvlist_lookup_nvlist(innvl, "holds", &holds);
1220 	if (error != 0)
1221 		return (SET_ERROR(EINVAL));
1222 
1223 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1224 	    pair = nvlist_next_nvpair(holds, pair)) {
1225 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1226 		error = dmu_fsname(nvpair_name(pair), fsname);
1227 		if (error != 0)
1228 			return (error);
1229 		error = zfs_secpolicy_write_perms(fsname,
1230 		    ZFS_DELEG_PERM_HOLD, cr);
1231 		if (error != 0)
1232 			return (error);
1233 	}
1234 	return (0);
1235 }
1236 
1237 /* ARGSUSED */
1238 static int
1239 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1240 {
1241 	nvpair_t *pair;
1242 	int error;
1243 
1244 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1245 	    pair = nvlist_next_nvpair(innvl, pair)) {
1246 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1247 		error = dmu_fsname(nvpair_name(pair), fsname);
1248 		if (error != 0)
1249 			return (error);
1250 		error = zfs_secpolicy_write_perms(fsname,
1251 		    ZFS_DELEG_PERM_RELEASE, cr);
1252 		if (error != 0)
1253 			return (error);
1254 	}
1255 	return (0);
1256 }
1257 
1258 /*
1259  * Policy for allowing temporary snapshots to be taken or released
1260  */
1261 static int
1262 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1263 {
1264 	/*
1265 	 * A temporary snapshot is the same as a snapshot,
1266 	 * hold, destroy and release all rolled into one.
1267 	 * Delegated diff alone is sufficient that we allow this.
1268 	 */
1269 	int error;
1270 
1271 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1272 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1273 		return (0);
1274 
1275 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1276 	if (error == 0)
1277 		error = zfs_secpolicy_hold(zc, innvl, cr);
1278 	if (error == 0)
1279 		error = zfs_secpolicy_release(zc, innvl, cr);
1280 	if (error == 0)
1281 		error = zfs_secpolicy_destroy(zc, innvl, cr);
1282 	return (error);
1283 }
1284 
1285 /*
1286  * Policy for allowing setting the zev callback list.
1287  */
1288 static int
1289 zfs_secpolicy_set_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1290 {
1291 	/* must be called from kernel context */
1292 	if (!(zc->zc_iflags & FKIOCTL))
1293 		return (SET_ERROR(EPERM));
1294 	/* callback pointer must be unset (set to default value) */
1295 	rw_enter(&rz_zev_rwlock, RW_READER);
1296 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
1297 		rw_exit(&rz_zev_rwlock);
1298 		return (SET_ERROR(EBUSY));
1299 	}
1300 	rw_exit(&rz_zev_rwlock);
1301 	return (0);
1302 }
1303 
1304 /*
1305  * Policy for allowing unsetting/resetting the zev callback list.
1306  */
1307 static int
1308 zfs_secpolicy_unset_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1309 {
1310 	/* must be called from kernel context */
1311 	if (!(zc->zc_iflags & FKIOCTL))
1312 		return (SET_ERROR(EPERM));
1313 	return (0);
1314 }
1315 
1316 /*
1317  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1318  */
1319 static int
1320 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1321 {
1322 	char *packed;
1323 	int error;
1324 	nvlist_t *list = NULL;
1325 
1326 	/*
1327 	 * Read in and unpack the user-supplied nvlist.
1328 	 */
1329 	if (size == 0)
1330 		return (SET_ERROR(EINVAL));
1331 
1332 	packed = kmem_alloc(size, KM_SLEEP);
1333 
1334 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1335 	    iflag)) != 0) {
1336 		kmem_free(packed, size);
1337 		return (error);
1338 	}
1339 
1340 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1341 		kmem_free(packed, size);
1342 		return (error);
1343 	}
1344 
1345 	kmem_free(packed, size);
1346 
1347 	*nvp = list;
1348 	return (0);
1349 }
1350 
1351 /*
1352  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1353  * Entries will be removed from the end of the nvlist, and one int32 entry
1354  * named "N_MORE_ERRORS" will be added indicating how many entries were
1355  * removed.
1356  */
1357 static int
1358 nvlist_smush(nvlist_t *errors, size_t max)
1359 {
1360 	size_t size;
1361 
1362 	size = fnvlist_size(errors);
1363 
1364 	if (size > max) {
1365 		nvpair_t *more_errors;
1366 		int n = 0;
1367 
1368 		if (max < 1024)
1369 			return (SET_ERROR(ENOMEM));
1370 
1371 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1372 		more_errors = nvlist_prev_nvpair(errors, NULL);
1373 
1374 		do {
1375 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1376 			    more_errors);
1377 			fnvlist_remove_nvpair(errors, pair);
1378 			n++;
1379 			size = fnvlist_size(errors);
1380 		} while (size > max);
1381 
1382 		fnvlist_remove_nvpair(errors, more_errors);
1383 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1384 		ASSERT3U(fnvlist_size(errors), <=, max);
1385 	}
1386 
1387 	return (0);
1388 }
1389 
1390 static int
1391 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1392 {
1393 	char *packed = NULL;
1394 	int error = 0;
1395 	size_t size;
1396 
1397 	size = fnvlist_size(nvl);
1398 
1399 	if (size > zc->zc_nvlist_dst_size) {
1400 		error = SET_ERROR(ENOMEM);
1401 	} else {
1402 		packed = fnvlist_pack(nvl, &size);
1403 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1404 		    size, zc->zc_iflags) != 0)
1405 			error = SET_ERROR(EFAULT);
1406 		fnvlist_pack_free(packed, size);
1407 	}
1408 
1409 	zc->zc_nvlist_dst_size = size;
1410 	zc->zc_nvlist_dst_filled = B_TRUE;
1411 	return (error);
1412 }
1413 
1414 static int
1415 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1416 {
1417 	objset_t *os;
1418 	int error;
1419 
1420 	error = dmu_objset_hold(dsname, FTAG, &os);
1421 	if (error != 0)
1422 		return (error);
1423 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1424 		dmu_objset_rele(os, FTAG);
1425 		return (SET_ERROR(EINVAL));
1426 	}
1427 
1428 	mutex_enter(&os->os_user_ptr_lock);
1429 	*zfvp = dmu_objset_get_user(os);
1430 	if (*zfvp) {
1431 		VFS_HOLD((*zfvp)->z_vfs);
1432 	} else {
1433 		error = SET_ERROR(ESRCH);
1434 	}
1435 	mutex_exit(&os->os_user_ptr_lock);
1436 	dmu_objset_rele(os, FTAG);
1437 	return (error);
1438 }
1439 
1440 /*
1441  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1442  * case its z_vfs will be NULL, and it will be opened as the owner.
1443  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1444  * which prevents all vnode ops from running.
1445  */
1446 static int
1447 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1448 {
1449 	int error = 0;
1450 
1451 	if (getzfsvfs(name, zfvp) != 0)
1452 		error = zfsvfs_create(name, zfvp);
1453 	if (error == 0) {
1454 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1455 		    RW_READER, tag);
1456 		if ((*zfvp)->z_unmounted) {
1457 			/*
1458 			 * XXX we could probably try again, since the unmounting
1459 			 * thread should be just about to disassociate the
1460 			 * objset from the zfsvfs.
1461 			 */
1462 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1463 			return (SET_ERROR(EBUSY));
1464 		}
1465 	}
1466 	return (error);
1467 }
1468 
1469 static void
1470 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1471 {
1472 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1473 
1474 	if (zfsvfs->z_vfs) {
1475 		VFS_RELE(zfsvfs->z_vfs);
1476 	} else {
1477 		dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1478 		zfsvfs_free(zfsvfs);
1479 	}
1480 }
1481 
1482 static int
1483 zfs_ioc_pool_create(zfs_cmd_t *zc)
1484 {
1485 	int error;
1486 	nvlist_t *config, *props = NULL;
1487 	nvlist_t *rootprops = NULL;
1488 	nvlist_t *zplprops = NULL;
1489 
1490 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1491 	    zc->zc_iflags, &config))
1492 		return (error);
1493 
1494 	if (zc->zc_nvlist_src_size != 0 && (error =
1495 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1496 	    zc->zc_iflags, &props))) {
1497 		nvlist_free(config);
1498 		return (error);
1499 	}
1500 
1501 	if (props) {
1502 		nvlist_t *nvl = NULL;
1503 		uint64_t version = SPA_VERSION;
1504 
1505 		(void) nvlist_lookup_uint64(props,
1506 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1507 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1508 			error = SET_ERROR(EINVAL);
1509 			goto pool_props_bad;
1510 		}
1511 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1512 		if (nvl) {
1513 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1514 			if (error != 0) {
1515 				nvlist_free(config);
1516 				nvlist_free(props);
1517 				return (error);
1518 			}
1519 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1520 		}
1521 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1522 		error = zfs_fill_zplprops_root(version, rootprops,
1523 		    zplprops, NULL);
1524 		if (error != 0)
1525 			goto pool_props_bad;
1526 	}
1527 
1528 	error = spa_create(zc->zc_name, config, props, zplprops);
1529 
1530 	/*
1531 	 * Set the remaining root properties
1532 	 */
1533 	if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1534 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1535 		(void) spa_destroy(zc->zc_name);
1536 
1537 pool_props_bad:
1538 	nvlist_free(rootprops);
1539 	nvlist_free(zplprops);
1540 	nvlist_free(config);
1541 	nvlist_free(props);
1542 
1543 	return (error);
1544 }
1545 
1546 static int
1547 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1548 {
1549 	int error;
1550 	zfs_log_history(zc);
1551 	error = spa_destroy(zc->zc_name);
1552 	if (error == 0)
1553 		zvol_remove_minors(zc->zc_name);
1554 	return (error);
1555 }
1556 
1557 static int
1558 zfs_ioc_pool_import(zfs_cmd_t *zc)
1559 {
1560 	nvlist_t *config, *props = NULL;
1561 	uint64_t guid;
1562 	int error;
1563 
1564 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1565 	    zc->zc_iflags, &config)) != 0)
1566 		return (error);
1567 
1568 	if (zc->zc_nvlist_src_size != 0 && (error =
1569 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1570 	    zc->zc_iflags, &props))) {
1571 		nvlist_free(config);
1572 		return (error);
1573 	}
1574 
1575 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1576 	    guid != zc->zc_guid)
1577 		error = SET_ERROR(EINVAL);
1578 	else
1579 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1580 
1581 	if (zc->zc_nvlist_dst != 0) {
1582 		int err;
1583 
1584 		if ((err = put_nvlist(zc, config)) != 0)
1585 			error = err;
1586 	}
1587 
1588 	nvlist_free(config);
1589 
1590 	nvlist_free(props);
1591 
1592 	return (error);
1593 }
1594 
1595 static int
1596 zfs_ioc_pool_export(zfs_cmd_t *zc)
1597 {
1598 	int error;
1599 	boolean_t force = (boolean_t)zc->zc_cookie;
1600 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1601 
1602 	zfs_log_history(zc);
1603 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1604 	if (error == 0)
1605 		zvol_remove_minors(zc->zc_name);
1606 	return (error);
1607 }
1608 
1609 static int
1610 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1611 {
1612 	nvlist_t *configs;
1613 	int error;
1614 
1615 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1616 		return (SET_ERROR(EEXIST));
1617 
1618 	error = put_nvlist(zc, configs);
1619 
1620 	nvlist_free(configs);
1621 
1622 	return (error);
1623 }
1624 
1625 /*
1626  * inputs:
1627  * zc_name		name of the pool
1628  *
1629  * outputs:
1630  * zc_cookie		real errno
1631  * zc_nvlist_dst	config nvlist
1632  * zc_nvlist_dst_size	size of config nvlist
1633  */
1634 static int
1635 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1636 {
1637 	nvlist_t *config;
1638 	int error;
1639 	int ret = 0;
1640 
1641 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1642 	    sizeof (zc->zc_value));
1643 
1644 	if (config != NULL) {
1645 		ret = put_nvlist(zc, config);
1646 		nvlist_free(config);
1647 
1648 		/*
1649 		 * The config may be present even if 'error' is non-zero.
1650 		 * In this case we return success, and preserve the real errno
1651 		 * in 'zc_cookie'.
1652 		 */
1653 		zc->zc_cookie = error;
1654 	} else {
1655 		ret = error;
1656 	}
1657 
1658 	return (ret);
1659 }
1660 
1661 /*
1662  * Try to import the given pool, returning pool stats as appropriate so that
1663  * user land knows which devices are available and overall pool health.
1664  */
1665 static int
1666 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1667 {
1668 	nvlist_t *tryconfig, *config;
1669 	int error;
1670 
1671 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1672 	    zc->zc_iflags, &tryconfig)) != 0)
1673 		return (error);
1674 
1675 	config = spa_tryimport(tryconfig);
1676 
1677 	nvlist_free(tryconfig);
1678 
1679 	if (config == NULL)
1680 		return (SET_ERROR(EINVAL));
1681 
1682 	error = put_nvlist(zc, config);
1683 	nvlist_free(config);
1684 
1685 	return (error);
1686 }
1687 
1688 /*
1689  * inputs:
1690  * zc_name              name of the pool
1691  * zc_cookie            scan func (pool_scan_func_t)
1692  */
1693 static int
1694 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1695 {
1696 	spa_t *spa;
1697 	int error;
1698 
1699 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1700 		return (error);
1701 
1702 	if (zc->zc_cookie == POOL_SCAN_NONE)
1703 		error = spa_scan_stop(spa);
1704 	else
1705 		error = spa_scan(spa, zc->zc_cookie);
1706 
1707 	spa_close(spa, FTAG);
1708 
1709 	return (error);
1710 }
1711 
1712 static int
1713 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1714 {
1715 	spa_t *spa;
1716 	int error;
1717 
1718 	error = spa_open(zc->zc_name, &spa, FTAG);
1719 	if (error == 0) {
1720 		spa_freeze(spa);
1721 		spa_close(spa, FTAG);
1722 	}
1723 	return (error);
1724 }
1725 
1726 static int
1727 zfs_ioc_arc_info(zfs_cmd_t *zc)
1728 {
1729 	int ret;
1730 	void *buf;
1731 	size_t sz = zc->zc_nvlist_dst_size;
1732 	size_t returned_bytes;
1733 
1734 	if (zc->zc_nvlist_dst == 0)
1735 		return (SET_ERROR(EINVAL));
1736 
1737 	buf = kmem_alloc(sz, KM_NOSLEEP);
1738 	if (buf == NULL)
1739 		return (SET_ERROR(ENOMEM));
1740 
1741 	ret = arc_dump(zc->zc_obj, buf, sz, &returned_bytes);
1742 	if (ret != 0) {
1743 		kmem_free(buf, sz);
1744 		return (SET_ERROR(ret));
1745 	}
1746 
1747 	zc->zc_nvlist_dst_filled = 1;
1748 	ret = ddi_copyout(buf, (void *)(uintptr_t)zc->zc_nvlist_dst,
1749 	    returned_bytes, zc->zc_iflags);
1750 	kmem_free(buf, sz);
1751 	if (ret != 0)
1752 		ret = SET_ERROR(EFAULT);
1753 
1754 	return (ret);
1755 }
1756 
1757 static int
1758 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1759 {
1760 	spa_t *spa;
1761 	int error;
1762 
1763 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1764 		return (error);
1765 
1766 	if (zc->zc_cookie < spa_version(spa) ||
1767 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1768 		spa_close(spa, FTAG);
1769 		return (SET_ERROR(EINVAL));
1770 	}
1771 
1772 	spa_upgrade(spa, zc->zc_cookie);
1773 	spa_close(spa, FTAG);
1774 
1775 	return (error);
1776 }
1777 
1778 static int
1779 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1780 {
1781 	spa_t *spa;
1782 	char *hist_buf;
1783 	uint64_t size;
1784 	int error;
1785 
1786 	if ((size = zc->zc_history_len) == 0)
1787 		return (SET_ERROR(EINVAL));
1788 
1789 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1790 		return (error);
1791 
1792 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1793 		spa_close(spa, FTAG);
1794 		return (SET_ERROR(ENOTSUP));
1795 	}
1796 
1797 	hist_buf = kmem_alloc(size, KM_SLEEP);
1798 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1799 	    &zc->zc_history_len, hist_buf)) == 0) {
1800 		error = ddi_copyout(hist_buf,
1801 		    (void *)(uintptr_t)zc->zc_history,
1802 		    zc->zc_history_len, zc->zc_iflags);
1803 	}
1804 
1805 	spa_close(spa, FTAG);
1806 	kmem_free(hist_buf, size);
1807 	return (error);
1808 }
1809 
1810 static int
1811 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1812 {
1813 	spa_t *spa;
1814 	int error;
1815 
1816 	error = spa_open(zc->zc_name, &spa, FTAG);
1817 	if (error == 0) {
1818 		error = spa_change_guid(spa);
1819 		spa_close(spa, FTAG);
1820 	}
1821 	return (error);
1822 }
1823 
1824 static int
1825 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1826 {
1827 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1828 }
1829 
1830 /*
1831  * inputs:
1832  * zc_name		name of filesystem
1833  * zc_obj		object to find
1834  *
1835  * outputs:
1836  * zc_value		name of object
1837  */
1838 static int
1839 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1840 {
1841 	objset_t *os;
1842 	int error;
1843 
1844 	/* XXX reading from objset not owned */
1845 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1846 		return (error);
1847 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1848 		dmu_objset_rele(os, FTAG);
1849 		return (SET_ERROR(EINVAL));
1850 	}
1851 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1852 	    sizeof (zc->zc_value));
1853 	dmu_objset_rele(os, FTAG);
1854 
1855 	return (error);
1856 }
1857 
1858 /*
1859  * inputs:
1860  * zc_name		name of filesystem
1861  * zc_obj		object to find
1862  *
1863  * outputs:
1864  * zc_stat		stats on object
1865  * zc_value		path to object
1866  */
1867 static int
1868 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1869 {
1870 	objset_t *os;
1871 	int error;
1872 
1873 	/* XXX reading from objset not owned */
1874 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1875 		return (error);
1876 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1877 		dmu_objset_rele(os, FTAG);
1878 		return (SET_ERROR(EINVAL));
1879 	}
1880 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1881 	    sizeof (zc->zc_value));
1882 	dmu_objset_rele(os, FTAG);
1883 
1884 	return (error);
1885 }
1886 
1887 static int
1888 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1889 {
1890 	spa_t *spa;
1891 	int error;
1892 	nvlist_t *config, **l2cache, **spares;
1893 	uint_t nl2cache = 0, nspares = 0;
1894 
1895 	error = spa_open(zc->zc_name, &spa, FTAG);
1896 	if (error != 0)
1897 		return (error);
1898 
1899 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1900 	    zc->zc_iflags, &config);
1901 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1902 	    &l2cache, &nl2cache);
1903 
1904 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1905 	    &spares, &nspares);
1906 
1907 	/*
1908 	 * A root pool with concatenated devices is not supported.
1909 	 * Thus, can not add a device to a root pool.
1910 	 *
1911 	 * Intent log device can not be added to a rootpool because
1912 	 * during mountroot, zil is replayed, a seperated log device
1913 	 * can not be accessed during the mountroot time.
1914 	 *
1915 	 * l2cache and spare devices are ok to be added to a rootpool.
1916 	 */
1917 	if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1918 		nvlist_free(config);
1919 		spa_close(spa, FTAG);
1920 		return (SET_ERROR(EDOM));
1921 	}
1922 
1923 	if (error == 0) {
1924 		error = spa_vdev_add(spa, config);
1925 		nvlist_free(config);
1926 	}
1927 	spa_close(spa, FTAG);
1928 	return (error);
1929 }
1930 
1931 /*
1932  * inputs:
1933  * zc_name		name of the pool
1934  * zc_nvlist_conf	nvlist of devices to remove
1935  * zc_cookie		to stop the remove?
1936  */
1937 static int
1938 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1939 {
1940 	spa_t *spa;
1941 	int error;
1942 
1943 	error = spa_open(zc->zc_name, &spa, FTAG);
1944 	if (error != 0)
1945 		return (error);
1946 	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1947 	spa_close(spa, FTAG);
1948 	return (error);
1949 }
1950 
1951 static int
1952 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1953 {
1954 	spa_t *spa;
1955 	int error;
1956 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1957 
1958 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1959 		return (error);
1960 	switch (zc->zc_cookie) {
1961 	case VDEV_STATE_ONLINE:
1962 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1963 		break;
1964 
1965 	case VDEV_STATE_OFFLINE:
1966 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1967 		break;
1968 
1969 	case VDEV_STATE_FAULTED:
1970 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1971 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1972 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1973 
1974 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1975 		break;
1976 
1977 	case VDEV_STATE_DEGRADED:
1978 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1979 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1980 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1981 
1982 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1983 		break;
1984 
1985 	default:
1986 		error = SET_ERROR(EINVAL);
1987 	}
1988 	zc->zc_cookie = newstate;
1989 	spa_close(spa, FTAG);
1990 	return (error);
1991 }
1992 
1993 static int
1994 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1995 {
1996 	spa_t *spa;
1997 	int replacing = zc->zc_cookie;
1998 	nvlist_t *config;
1999 	int error;
2000 
2001 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2002 		return (error);
2003 
2004 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2005 	    zc->zc_iflags, &config)) == 0) {
2006 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
2007 		nvlist_free(config);
2008 	}
2009 
2010 	spa_close(spa, FTAG);
2011 	return (error);
2012 }
2013 
2014 static int
2015 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
2016 {
2017 	spa_t *spa;
2018 	int error;
2019 
2020 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2021 		return (error);
2022 
2023 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
2024 
2025 	spa_close(spa, FTAG);
2026 	return (error);
2027 }
2028 
2029 static int
2030 zfs_ioc_vdev_split(zfs_cmd_t *zc)
2031 {
2032 	spa_t *spa;
2033 	nvlist_t *config, *props = NULL;
2034 	int error;
2035 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
2036 
2037 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2038 		return (error);
2039 
2040 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2041 	    zc->zc_iflags, &config)) {
2042 		spa_close(spa, FTAG);
2043 		return (error);
2044 	}
2045 
2046 	if (zc->zc_nvlist_src_size != 0 && (error =
2047 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2048 	    zc->zc_iflags, &props))) {
2049 		spa_close(spa, FTAG);
2050 		nvlist_free(config);
2051 		return (error);
2052 	}
2053 
2054 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2055 
2056 	spa_close(spa, FTAG);
2057 
2058 	nvlist_free(config);
2059 	nvlist_free(props);
2060 
2061 	return (error);
2062 }
2063 
2064 static int
2065 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2066 {
2067 	spa_t *spa;
2068 	char *path = zc->zc_value;
2069 	uint64_t guid = zc->zc_guid;
2070 	int error;
2071 
2072 	error = spa_open(zc->zc_name, &spa, FTAG);
2073 	if (error != 0)
2074 		return (error);
2075 
2076 	error = spa_vdev_setpath(spa, guid, path);
2077 	spa_close(spa, FTAG);
2078 	return (error);
2079 }
2080 
2081 static int
2082 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2083 {
2084 	spa_t *spa;
2085 	char *fru = zc->zc_value;
2086 	uint64_t guid = zc->zc_guid;
2087 	int error;
2088 
2089 	error = spa_open(zc->zc_name, &spa, FTAG);
2090 	if (error != 0)
2091 		return (error);
2092 
2093 	error = spa_vdev_setfru(spa, guid, fru);
2094 	spa_close(spa, FTAG);
2095 	return (error);
2096 }
2097 
2098 static int
2099 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2100 {
2101 	int error = 0;
2102 	nvlist_t *nv;
2103 
2104 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2105 
2106 	if (zc->zc_nvlist_dst != 0 &&
2107 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2108 		dmu_objset_stats(os, nv);
2109 		/*
2110 		 * NB: zvol_get_stats() will read the objset contents,
2111 		 * which we aren't supposed to do with a
2112 		 * DS_MODE_USER hold, because it could be
2113 		 * inconsistent.  So this is a bit of a workaround...
2114 		 * XXX reading with out owning
2115 		 */
2116 		if (!zc->zc_objset_stats.dds_inconsistent &&
2117 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2118 			error = zvol_get_stats(os, nv);
2119 			if (error == EIO)
2120 				return (error);
2121 			VERIFY0(error);
2122 		}
2123 		error = put_nvlist(zc, nv);
2124 		nvlist_free(nv);
2125 	}
2126 
2127 	return (error);
2128 }
2129 
2130 /*
2131  * inputs:
2132  * zc_name		name of filesystem
2133  * zc_nvlist_dst_size	size of buffer for property nvlist
2134  *
2135  * outputs:
2136  * zc_objset_stats	stats
2137  * zc_nvlist_dst	property nvlist
2138  * zc_nvlist_dst_size	size of property nvlist
2139  */
2140 static int
2141 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2142 {
2143 	objset_t *os;
2144 	int error;
2145 
2146 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2147 	if (error == 0) {
2148 		error = zfs_ioc_objset_stats_impl(zc, os);
2149 		dmu_objset_rele(os, FTAG);
2150 	}
2151 
2152 	return (error);
2153 }
2154 
2155 /*
2156  * inputs:
2157  * zc_name		name of filesystem
2158  * zc_nvlist_dst_size	size of buffer for property nvlist
2159  *
2160  * outputs:
2161  * zc_nvlist_dst	received property nvlist
2162  * zc_nvlist_dst_size	size of received property nvlist
2163  *
2164  * Gets received properties (distinct from local properties on or after
2165  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2166  * local property values.
2167  */
2168 static int
2169 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2170 {
2171 	int error = 0;
2172 	nvlist_t *nv;
2173 
2174 	/*
2175 	 * Without this check, we would return local property values if the
2176 	 * caller has not already received properties on or after
2177 	 * SPA_VERSION_RECVD_PROPS.
2178 	 */
2179 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2180 		return (SET_ERROR(ENOTSUP));
2181 
2182 	if (zc->zc_nvlist_dst != 0 &&
2183 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2184 		error = put_nvlist(zc, nv);
2185 		nvlist_free(nv);
2186 	}
2187 
2188 	return (error);
2189 }
2190 
2191 static int
2192 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2193 {
2194 	uint64_t value;
2195 	int error;
2196 
2197 	/*
2198 	 * zfs_get_zplprop() will either find a value or give us
2199 	 * the default value (if there is one).
2200 	 */
2201 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2202 		return (error);
2203 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2204 	return (0);
2205 }
2206 
2207 /*
2208  * inputs:
2209  * zc_name		name of filesystem
2210  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2211  *
2212  * outputs:
2213  * zc_nvlist_dst	zpl property nvlist
2214  * zc_nvlist_dst_size	size of zpl property nvlist
2215  */
2216 static int
2217 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2218 {
2219 	objset_t *os;
2220 	int err;
2221 
2222 	/* XXX reading without owning */
2223 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2224 		return (err);
2225 
2226 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2227 
2228 	/*
2229 	 * NB: nvl_add_zplprop() will read the objset contents,
2230 	 * which we aren't supposed to do with a DS_MODE_USER
2231 	 * hold, because it could be inconsistent.
2232 	 */
2233 	if (zc->zc_nvlist_dst != NULL &&
2234 	    !zc->zc_objset_stats.dds_inconsistent &&
2235 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2236 		nvlist_t *nv;
2237 
2238 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2239 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2240 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2241 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2242 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2243 			err = put_nvlist(zc, nv);
2244 		nvlist_free(nv);
2245 	} else {
2246 		err = SET_ERROR(ENOENT);
2247 	}
2248 	dmu_objset_rele(os, FTAG);
2249 	return (err);
2250 }
2251 
2252 static boolean_t
2253 dataset_name_hidden(const char *name)
2254 {
2255 	/*
2256 	 * Skip over datasets that are not visible in this zone,
2257 	 * internal datasets (which have a $ in their name), and
2258 	 * temporary datasets (which have a % in their name).
2259 	 */
2260 	if (strchr(name, '$') != NULL)
2261 		return (B_TRUE);
2262 	if (strchr(name, '%') != NULL)
2263 		return (B_TRUE);
2264 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2265 		return (B_TRUE);
2266 	return (B_FALSE);
2267 }
2268 
2269 /*
2270  * inputs:
2271  * zc_name		name of filesystem
2272  * zc_cookie		zap cursor
2273  * zc_nvlist_dst_size	size of buffer for property nvlist
2274  *
2275  * outputs:
2276  * zc_name		name of next filesystem
2277  * zc_cookie		zap cursor
2278  * zc_objset_stats	stats
2279  * zc_nvlist_dst	property nvlist
2280  * zc_nvlist_dst_size	size of property nvlist
2281  */
2282 static int
2283 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2284 {
2285 	objset_t *os;
2286 	int error;
2287 	char *p;
2288 	size_t orig_len = strlen(zc->zc_name);
2289 
2290 top:
2291 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2292 		if (error == ENOENT)
2293 			error = SET_ERROR(ESRCH);
2294 		return (error);
2295 	}
2296 
2297 	p = strrchr(zc->zc_name, '/');
2298 	if (p == NULL || p[1] != '\0')
2299 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2300 	p = zc->zc_name + strlen(zc->zc_name);
2301 
2302 	do {
2303 		error = dmu_dir_list_next(os,
2304 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2305 		    NULL, &zc->zc_cookie);
2306 		if (error == ENOENT)
2307 			error = SET_ERROR(ESRCH);
2308 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2309 	dmu_objset_rele(os, FTAG);
2310 
2311 	/*
2312 	 * If it's an internal dataset (ie. with a '$' in its name),
2313 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2314 	 */
2315 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2316 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2317 		if (error == ENOENT) {
2318 			/* We lost a race with destroy, get the next one. */
2319 			zc->zc_name[orig_len] = '\0';
2320 			goto top;
2321 		}
2322 	}
2323 	return (error);
2324 }
2325 
2326 /*
2327  * inputs:
2328  * zc_name		name of filesystem
2329  * zc_cookie		zap cursor
2330  * zc_nvlist_dst_size	size of buffer for property nvlist
2331  *
2332  * outputs:
2333  * zc_name		name of next snapshot
2334  * zc_objset_stats	stats
2335  * zc_nvlist_dst	property nvlist
2336  * zc_nvlist_dst_size	size of property nvlist
2337  */
2338 static int
2339 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2340 {
2341 	objset_t *os;
2342 	int error;
2343 
2344 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2345 	if (error != 0) {
2346 		return (error == ENOENT ? ESRCH : error);
2347 	}
2348 
2349 	/*
2350 	 * A dataset name of maximum length cannot have any snapshots,
2351 	 * so exit immediately.
2352 	 */
2353 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >=
2354 	    ZFS_MAX_DATASET_NAME_LEN) {
2355 		dmu_objset_rele(os, FTAG);
2356 		return (SET_ERROR(ESRCH));
2357 	}
2358 
2359 	error = dmu_snapshot_list_next(os,
2360 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2361 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2362 	    NULL);
2363 
2364 	if (error == 0) {
2365 		dsl_dataset_t *ds;
2366 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2367 
2368 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2369 		if (error == 0) {
2370 			objset_t *ossnap;
2371 
2372 			error = dmu_objset_from_ds(ds, &ossnap);
2373 			if (error == 0)
2374 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2375 			dsl_dataset_rele(ds, FTAG);
2376 		}
2377 	} else if (error == ENOENT) {
2378 		error = SET_ERROR(ESRCH);
2379 	}
2380 
2381 	dmu_objset_rele(os, FTAG);
2382 	/* if we failed, undo the @ that we tacked on to zc_name */
2383 	if (error != 0)
2384 		*strchr(zc->zc_name, '@') = '\0';
2385 	return (error);
2386 }
2387 
2388 static int
2389 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2390 {
2391 	const char *propname = nvpair_name(pair);
2392 	uint64_t *valary;
2393 	unsigned int vallen;
2394 	const char *domain;
2395 	char *dash;
2396 	zfs_userquota_prop_t type;
2397 	uint64_t rid;
2398 	uint64_t quota;
2399 	zfsvfs_t *zfsvfs;
2400 	int err;
2401 
2402 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2403 		nvlist_t *attrs;
2404 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2405 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2406 		    &pair) != 0)
2407 			return (SET_ERROR(EINVAL));
2408 	}
2409 
2410 	/*
2411 	 * A correctly constructed propname is encoded as
2412 	 * userquota@<rid>-<domain>.
2413 	 */
2414 	if ((dash = strchr(propname, '-')) == NULL ||
2415 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2416 	    vallen != 3)
2417 		return (SET_ERROR(EINVAL));
2418 
2419 	domain = dash + 1;
2420 	type = valary[0];
2421 	rid = valary[1];
2422 	quota = valary[2];
2423 
2424 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2425 	if (err == 0) {
2426 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2427 		zfsvfs_rele(zfsvfs, FTAG);
2428 	}
2429 
2430 	return (err);
2431 }
2432 
2433 /*
2434  * If the named property is one that has a special function to set its value,
2435  * return 0 on success and a positive error code on failure; otherwise if it is
2436  * not one of the special properties handled by this function, return -1.
2437  *
2438  * XXX: It would be better for callers of the property interface if we handled
2439  * these special cases in dsl_prop.c (in the dsl layer).
2440  */
2441 static int
2442 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2443     nvpair_t *pair)
2444 {
2445 	const char *propname = nvpair_name(pair);
2446 	zfs_prop_t prop = zfs_name_to_prop(propname);
2447 	uint64_t intval;
2448 	int err = -1;
2449 
2450 	if (prop == ZPROP_INVAL) {
2451 		if (zfs_prop_userquota(propname))
2452 			return (zfs_prop_set_userquota(dsname, pair));
2453 		return (-1);
2454 	}
2455 
2456 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2457 		nvlist_t *attrs;
2458 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2459 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2460 		    &pair) == 0);
2461 	}
2462 
2463 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2464 		return (-1);
2465 
2466 	VERIFY(0 == nvpair_value_uint64(pair, &intval));
2467 
2468 	switch (prop) {
2469 	case ZFS_PROP_QUOTA:
2470 		err = dsl_dir_set_quota(dsname, source, intval);
2471 		break;
2472 	case ZFS_PROP_REFQUOTA:
2473 		err = dsl_dataset_set_refquota(dsname, source, intval);
2474 		break;
2475 	case ZFS_PROP_FILESYSTEM_LIMIT:
2476 	case ZFS_PROP_SNAPSHOT_LIMIT:
2477 		if (intval == UINT64_MAX) {
2478 			/* clearing the limit, just do it */
2479 			err = 0;
2480 		} else {
2481 			err = dsl_dir_activate_fs_ss_limit(dsname);
2482 		}
2483 		/*
2484 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2485 		 * default path to set the value in the nvlist.
2486 		 */
2487 		if (err == 0)
2488 			err = -1;
2489 		break;
2490 	case ZFS_PROP_RESERVATION:
2491 		err = dsl_dir_set_reservation(dsname, source, intval);
2492 		break;
2493 	case ZFS_PROP_REFRESERVATION:
2494 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2495 		break;
2496 	case ZFS_PROP_VOLSIZE:
2497 		err = zvol_set_volsize(dsname, intval);
2498 		break;
2499 	case ZFS_PROP_VERSION:
2500 	{
2501 		zfsvfs_t *zfsvfs;
2502 
2503 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2504 			break;
2505 
2506 		err = zfs_set_version(zfsvfs, intval);
2507 		zfsvfs_rele(zfsvfs, FTAG);
2508 
2509 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2510 			zfs_cmd_t *zc;
2511 
2512 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2513 			(void) strcpy(zc->zc_name, dsname);
2514 			(void) zfs_ioc_userspace_upgrade(zc);
2515 			kmem_free(zc, sizeof (zfs_cmd_t));
2516 		}
2517 		break;
2518 	}
2519 	default:
2520 		err = -1;
2521 	}
2522 
2523 	return (err);
2524 }
2525 
2526 /*
2527  * This function is best effort. If it fails to set any of the given properties,
2528  * it continues to set as many as it can and returns the last error
2529  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2530  * with the list of names of all the properties that failed along with the
2531  * corresponding error numbers.
2532  *
2533  * If every property is set successfully, zero is returned and errlist is not
2534  * modified.
2535  */
2536 int
2537 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2538     nvlist_t *errlist)
2539 {
2540 	nvpair_t *pair;
2541 	nvpair_t *propval;
2542 	int rv = 0;
2543 	uint64_t intval;
2544 	char *strval;
2545 	nvlist_t *genericnvl = fnvlist_alloc();
2546 	nvlist_t *retrynvl = fnvlist_alloc();
2547 
2548 retry:
2549 	pair = NULL;
2550 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2551 		const char *propname = nvpair_name(pair);
2552 		zfs_prop_t prop = zfs_name_to_prop(propname);
2553 		int err = 0;
2554 
2555 		/* decode the property value */
2556 		propval = pair;
2557 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2558 			nvlist_t *attrs;
2559 			attrs = fnvpair_value_nvlist(pair);
2560 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2561 			    &propval) != 0)
2562 				err = SET_ERROR(EINVAL);
2563 		}
2564 
2565 		/* Validate value type */
2566 		if (err == 0 && prop == ZPROP_INVAL) {
2567 			if (zfs_prop_user(propname)) {
2568 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2569 					err = SET_ERROR(EINVAL);
2570 			} else if (zfs_prop_userquota(propname)) {
2571 				if (nvpair_type(propval) !=
2572 				    DATA_TYPE_UINT64_ARRAY)
2573 					err = SET_ERROR(EINVAL);
2574 			} else {
2575 				err = SET_ERROR(EINVAL);
2576 			}
2577 		} else if (err == 0) {
2578 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2579 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2580 					err = SET_ERROR(EINVAL);
2581 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2582 				const char *unused;
2583 
2584 				intval = fnvpair_value_uint64(propval);
2585 
2586 				switch (zfs_prop_get_type(prop)) {
2587 				case PROP_TYPE_NUMBER:
2588 					break;
2589 				case PROP_TYPE_STRING:
2590 					err = SET_ERROR(EINVAL);
2591 					break;
2592 				case PROP_TYPE_INDEX:
2593 					if (zfs_prop_index_to_string(prop,
2594 					    intval, &unused) != 0)
2595 						err = SET_ERROR(EINVAL);
2596 					break;
2597 				default:
2598 					cmn_err(CE_PANIC,
2599 					    "unknown property type");
2600 				}
2601 			} else {
2602 				err = SET_ERROR(EINVAL);
2603 			}
2604 		}
2605 
2606 		/* Validate permissions */
2607 		if (err == 0)
2608 			err = zfs_check_settable(dsname, pair, CRED());
2609 
2610 		if (err == 0) {
2611 			err = zfs_prop_set_special(dsname, source, pair);
2612 			if (err == -1) {
2613 				/*
2614 				 * For better performance we build up a list of
2615 				 * properties to set in a single transaction.
2616 				 */
2617 				err = nvlist_add_nvpair(genericnvl, pair);
2618 			} else if (err != 0 && nvl != retrynvl) {
2619 				/*
2620 				 * This may be a spurious error caused by
2621 				 * receiving quota and reservation out of order.
2622 				 * Try again in a second pass.
2623 				 */
2624 				err = nvlist_add_nvpair(retrynvl, pair);
2625 			}
2626 		}
2627 
2628 		if (err != 0) {
2629 			if (errlist != NULL)
2630 				fnvlist_add_int32(errlist, propname, err);
2631 			rv = err;
2632 		}
2633 	}
2634 
2635 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2636 		nvl = retrynvl;
2637 		goto retry;
2638 	}
2639 
2640 	if (!nvlist_empty(genericnvl) &&
2641 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2642 		/*
2643 		 * If this fails, we still want to set as many properties as we
2644 		 * can, so try setting them individually.
2645 		 */
2646 		pair = NULL;
2647 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2648 			const char *propname = nvpair_name(pair);
2649 			int err = 0;
2650 
2651 			propval = pair;
2652 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2653 				nvlist_t *attrs;
2654 				attrs = fnvpair_value_nvlist(pair);
2655 				propval = fnvlist_lookup_nvpair(attrs,
2656 				    ZPROP_VALUE);
2657 			}
2658 
2659 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2660 				strval = fnvpair_value_string(propval);
2661 				err = dsl_prop_set_string(dsname, propname,
2662 				    source, strval);
2663 			} else {
2664 				intval = fnvpair_value_uint64(propval);
2665 				err = dsl_prop_set_int(dsname, propname, source,
2666 				    intval);
2667 			}
2668 
2669 			if (err != 0) {
2670 				if (errlist != NULL) {
2671 					fnvlist_add_int32(errlist, propname,
2672 					    err);
2673 				}
2674 				rv = err;
2675 			}
2676 		}
2677 	}
2678 	nvlist_free(genericnvl);
2679 	nvlist_free(retrynvl);
2680 
2681 	return (rv);
2682 }
2683 
2684 /*
2685  * Check that all the properties are valid user properties.
2686  */
2687 static int
2688 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2689 {
2690 	nvpair_t *pair = NULL;
2691 	int error = 0;
2692 
2693 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2694 		const char *propname = nvpair_name(pair);
2695 
2696 		if (!zfs_prop_user(propname) ||
2697 		    nvpair_type(pair) != DATA_TYPE_STRING)
2698 			return (SET_ERROR(EINVAL));
2699 
2700 		if (error = zfs_secpolicy_write_perms(fsname,
2701 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2702 			return (error);
2703 
2704 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2705 			return (SET_ERROR(ENAMETOOLONG));
2706 
2707 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2708 			return (E2BIG);
2709 	}
2710 	return (0);
2711 }
2712 
2713 static void
2714 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2715 {
2716 	nvpair_t *pair;
2717 
2718 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2719 
2720 	pair = NULL;
2721 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2722 		if (nvlist_exists(skipped, nvpair_name(pair)))
2723 			continue;
2724 
2725 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2726 	}
2727 }
2728 
2729 static int
2730 clear_received_props(const char *dsname, nvlist_t *props,
2731     nvlist_t *skipped)
2732 {
2733 	int err = 0;
2734 	nvlist_t *cleared_props = NULL;
2735 	props_skip(props, skipped, &cleared_props);
2736 	if (!nvlist_empty(cleared_props)) {
2737 		/*
2738 		 * Acts on local properties until the dataset has received
2739 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2740 		 */
2741 		zprop_source_t flags = (ZPROP_SRC_NONE |
2742 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2743 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2744 	}
2745 	nvlist_free(cleared_props);
2746 	return (err);
2747 }
2748 
2749 /*
2750  * inputs:
2751  * zc_name		name of filesystem
2752  * zc_value		name of property to set
2753  * zc_nvlist_src{_size}	nvlist of properties to apply
2754  * zc_cookie		received properties flag
2755  *
2756  * outputs:
2757  * zc_nvlist_dst{_size} error for each unapplied received property
2758  */
2759 static int
2760 zfs_ioc_set_prop(zfs_cmd_t *zc)
2761 {
2762 	nvlist_t *nvl;
2763 	boolean_t received = zc->zc_cookie;
2764 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2765 	    ZPROP_SRC_LOCAL);
2766 	nvlist_t *errors;
2767 	int error;
2768 
2769 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2770 	    zc->zc_iflags, &nvl)) != 0)
2771 		return (error);
2772 
2773 	if (received) {
2774 		nvlist_t *origprops;
2775 
2776 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2777 			(void) clear_received_props(zc->zc_name,
2778 			    origprops, nvl);
2779 			nvlist_free(origprops);
2780 		}
2781 
2782 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2783 	}
2784 
2785 	errors = fnvlist_alloc();
2786 	if (error == 0)
2787 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2788 
2789 	if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2790 		(void) put_nvlist(zc, errors);
2791 	}
2792 
2793 	nvlist_free(errors);
2794 	nvlist_free(nvl);
2795 	return (error);
2796 }
2797 
2798 /*
2799  * inputs:
2800  * zc_name		name of filesystem
2801  * zc_value		name of property to inherit
2802  * zc_cookie		revert to received value if TRUE
2803  *
2804  * outputs:		none
2805  */
2806 static int
2807 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2808 {
2809 	const char *propname = zc->zc_value;
2810 	zfs_prop_t prop = zfs_name_to_prop(propname);
2811 	boolean_t received = zc->zc_cookie;
2812 	zprop_source_t source = (received
2813 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2814 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2815 
2816 	if (received) {
2817 		nvlist_t *dummy;
2818 		nvpair_t *pair;
2819 		zprop_type_t type;
2820 		int err;
2821 
2822 		/*
2823 		 * zfs_prop_set_special() expects properties in the form of an
2824 		 * nvpair with type info.
2825 		 */
2826 		if (prop == ZPROP_INVAL) {
2827 			if (!zfs_prop_user(propname))
2828 				return (SET_ERROR(EINVAL));
2829 
2830 			type = PROP_TYPE_STRING;
2831 		} else if (prop == ZFS_PROP_VOLSIZE ||
2832 		    prop == ZFS_PROP_VERSION) {
2833 			return (SET_ERROR(EINVAL));
2834 		} else {
2835 			type = zfs_prop_get_type(prop);
2836 		}
2837 
2838 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2839 
2840 		switch (type) {
2841 		case PROP_TYPE_STRING:
2842 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2843 			break;
2844 		case PROP_TYPE_NUMBER:
2845 		case PROP_TYPE_INDEX:
2846 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2847 			break;
2848 		default:
2849 			nvlist_free(dummy);
2850 			return (SET_ERROR(EINVAL));
2851 		}
2852 
2853 		pair = nvlist_next_nvpair(dummy, NULL);
2854 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2855 		nvlist_free(dummy);
2856 		if (err != -1)
2857 			return (err); /* special property already handled */
2858 	} else {
2859 		/*
2860 		 * Only check this in the non-received case. We want to allow
2861 		 * 'inherit -S' to revert non-inheritable properties like quota
2862 		 * and reservation to the received or default values even though
2863 		 * they are not considered inheritable.
2864 		 */
2865 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2866 			return (SET_ERROR(EINVAL));
2867 	}
2868 
2869 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2870 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2871 }
2872 
2873 static int
2874 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2875 {
2876 	nvlist_t *props;
2877 	spa_t *spa;
2878 	int error;
2879 	nvpair_t *pair;
2880 
2881 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2882 	    zc->zc_iflags, &props))
2883 		return (error);
2884 
2885 	/*
2886 	 * If the only property is the configfile, then just do a spa_lookup()
2887 	 * to handle the faulted case.
2888 	 */
2889 	pair = nvlist_next_nvpair(props, NULL);
2890 	if (pair != NULL && strcmp(nvpair_name(pair),
2891 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2892 	    nvlist_next_nvpair(props, pair) == NULL) {
2893 		mutex_enter(&spa_namespace_lock);
2894 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2895 			spa_configfile_set(spa, props, B_FALSE);
2896 			spa_config_sync(spa, B_FALSE, B_TRUE);
2897 		}
2898 		mutex_exit(&spa_namespace_lock);
2899 		if (spa != NULL) {
2900 			nvlist_free(props);
2901 			return (0);
2902 		}
2903 	}
2904 
2905 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2906 		nvlist_free(props);
2907 		return (error);
2908 	}
2909 
2910 	error = spa_prop_set(spa, props);
2911 
2912 	nvlist_free(props);
2913 	spa_close(spa, FTAG);
2914 
2915 	return (error);
2916 }
2917 
2918 static int
2919 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2920 {
2921 	spa_t *spa;
2922 	int error;
2923 	nvlist_t *nvp = NULL;
2924 
2925 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2926 		/*
2927 		 * If the pool is faulted, there may be properties we can still
2928 		 * get (such as altroot and cachefile), so attempt to get them
2929 		 * anyway.
2930 		 */
2931 		mutex_enter(&spa_namespace_lock);
2932 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
2933 			error = spa_prop_get(spa, &nvp);
2934 		mutex_exit(&spa_namespace_lock);
2935 	} else {
2936 		error = spa_prop_get(spa, &nvp);
2937 		spa_close(spa, FTAG);
2938 	}
2939 
2940 	if (error == 0 && zc->zc_nvlist_dst != NULL)
2941 		error = put_nvlist(zc, nvp);
2942 	else
2943 		error = SET_ERROR(EFAULT);
2944 
2945 	nvlist_free(nvp);
2946 	return (error);
2947 }
2948 
2949 /*
2950  * inputs:
2951  * zc_name		name of filesystem
2952  * zc_nvlist_src{_size}	nvlist of delegated permissions
2953  * zc_perm_action	allow/unallow flag
2954  *
2955  * outputs:		none
2956  */
2957 static int
2958 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2959 {
2960 	int error;
2961 	nvlist_t *fsaclnv = NULL;
2962 
2963 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2964 	    zc->zc_iflags, &fsaclnv)) != 0)
2965 		return (error);
2966 
2967 	/*
2968 	 * Verify nvlist is constructed correctly
2969 	 */
2970 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2971 		nvlist_free(fsaclnv);
2972 		return (SET_ERROR(EINVAL));
2973 	}
2974 
2975 	/*
2976 	 * If we don't have PRIV_SYS_MOUNT, then validate
2977 	 * that user is allowed to hand out each permission in
2978 	 * the nvlist(s)
2979 	 */
2980 
2981 	error = secpolicy_zfs(CRED());
2982 	if (error != 0) {
2983 		if (zc->zc_perm_action == B_FALSE) {
2984 			error = dsl_deleg_can_allow(zc->zc_name,
2985 			    fsaclnv, CRED());
2986 		} else {
2987 			error = dsl_deleg_can_unallow(zc->zc_name,
2988 			    fsaclnv, CRED());
2989 		}
2990 	}
2991 
2992 	if (error == 0)
2993 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2994 
2995 	nvlist_free(fsaclnv);
2996 	return (error);
2997 }
2998 
2999 /*
3000  * inputs:
3001  * zc_name		name of filesystem
3002  *
3003  * outputs:
3004  * zc_nvlist_src{_size}	nvlist of delegated permissions
3005  */
3006 static int
3007 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
3008 {
3009 	nvlist_t *nvp;
3010 	int error;
3011 
3012 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
3013 		error = put_nvlist(zc, nvp);
3014 		nvlist_free(nvp);
3015 	}
3016 
3017 	return (error);
3018 }
3019 
3020 /*
3021  * Search the vfs list for a specified resource.  Returns a pointer to it
3022  * or NULL if no suitable entry is found. The caller of this routine
3023  * is responsible for releasing the returned vfs pointer.
3024  */
3025 static vfs_t *
3026 zfs_get_vfs(const char *resource)
3027 {
3028 	struct vfs *vfsp;
3029 	struct vfs *vfs_found = NULL;
3030 
3031 	vfs_list_read_lock();
3032 	vfsp = rootvfs;
3033 	do {
3034 		if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
3035 			VFS_HOLD(vfsp);
3036 			vfs_found = vfsp;
3037 			break;
3038 		}
3039 		vfsp = vfsp->vfs_next;
3040 	} while (vfsp != rootvfs);
3041 	vfs_list_unlock();
3042 	return (vfs_found);
3043 }
3044 
3045 /* ARGSUSED */
3046 static void
3047 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
3048 {
3049 	zfs_creat_t *zct = arg;
3050 
3051 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
3052 }
3053 
3054 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3055 
3056 /*
3057  * inputs:
3058  * os			parent objset pointer (NULL if root fs)
3059  * fuids_ok		fuids allowed in this version of the spa?
3060  * sa_ok		SAs allowed in this version of the spa?
3061  * createprops		list of properties requested by creator
3062  *
3063  * outputs:
3064  * zplprops	values for the zplprops we attach to the master node object
3065  * is_ci	true if requested file system will be purely case-insensitive
3066  *
3067  * Determine the settings for utf8only, normalization and
3068  * casesensitivity.  Specific values may have been requested by the
3069  * creator and/or we can inherit values from the parent dataset.  If
3070  * the file system is of too early a vintage, a creator can not
3071  * request settings for these properties, even if the requested
3072  * setting is the default value.  We don't actually want to create dsl
3073  * properties for these, so remove them from the source nvlist after
3074  * processing.
3075  */
3076 static int
3077 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3078     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3079     nvlist_t *zplprops, boolean_t *is_ci)
3080 {
3081 	uint64_t sense = ZFS_PROP_UNDEFINED;
3082 	uint64_t norm = ZFS_PROP_UNDEFINED;
3083 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3084 
3085 	ASSERT(zplprops != NULL);
3086 
3087 	/*
3088 	 * Pull out creator prop choices, if any.
3089 	 */
3090 	if (createprops) {
3091 		(void) nvlist_lookup_uint64(createprops,
3092 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3093 		(void) nvlist_lookup_uint64(createprops,
3094 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3095 		(void) nvlist_remove_all(createprops,
3096 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3097 		(void) nvlist_lookup_uint64(createprops,
3098 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3099 		(void) nvlist_remove_all(createprops,
3100 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3101 		(void) nvlist_lookup_uint64(createprops,
3102 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3103 		(void) nvlist_remove_all(createprops,
3104 		    zfs_prop_to_name(ZFS_PROP_CASE));
3105 	}
3106 
3107 	/*
3108 	 * If the zpl version requested is whacky or the file system
3109 	 * or pool is version is too "young" to support normalization
3110 	 * and the creator tried to set a value for one of the props,
3111 	 * error out.
3112 	 */
3113 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3114 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3115 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3116 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3117 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3118 	    sense != ZFS_PROP_UNDEFINED)))
3119 		return (SET_ERROR(ENOTSUP));
3120 
3121 	/*
3122 	 * Put the version in the zplprops
3123 	 */
3124 	VERIFY(nvlist_add_uint64(zplprops,
3125 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3126 
3127 	if (norm == ZFS_PROP_UNDEFINED)
3128 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3129 	VERIFY(nvlist_add_uint64(zplprops,
3130 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3131 
3132 	/*
3133 	 * If we're normalizing, names must always be valid UTF-8 strings.
3134 	 */
3135 	if (norm)
3136 		u8 = 1;
3137 	if (u8 == ZFS_PROP_UNDEFINED)
3138 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3139 	VERIFY(nvlist_add_uint64(zplprops,
3140 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3141 
3142 	if (sense == ZFS_PROP_UNDEFINED)
3143 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3144 	VERIFY(nvlist_add_uint64(zplprops,
3145 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3146 
3147 	if (is_ci)
3148 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3149 
3150 	return (0);
3151 }
3152 
3153 static int
3154 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3155     nvlist_t *zplprops, boolean_t *is_ci)
3156 {
3157 	boolean_t fuids_ok, sa_ok;
3158 	uint64_t zplver = ZPL_VERSION;
3159 	objset_t *os = NULL;
3160 	char parentname[ZFS_MAX_DATASET_NAME_LEN];
3161 	char *cp;
3162 	spa_t *spa;
3163 	uint64_t spa_vers;
3164 	int error;
3165 
3166 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3167 	cp = strrchr(parentname, '/');
3168 	ASSERT(cp != NULL);
3169 	cp[0] = '\0';
3170 
3171 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3172 		return (error);
3173 
3174 	spa_vers = spa_version(spa);
3175 	spa_close(spa, FTAG);
3176 
3177 	zplver = zfs_zpl_version_map(spa_vers);
3178 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3179 	sa_ok = (zplver >= ZPL_VERSION_SA);
3180 
3181 	/*
3182 	 * Open parent object set so we can inherit zplprop values.
3183 	 */
3184 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3185 		return (error);
3186 
3187 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3188 	    zplprops, is_ci);
3189 	dmu_objset_rele(os, FTAG);
3190 	return (error);
3191 }
3192 
3193 static int
3194 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3195     nvlist_t *zplprops, boolean_t *is_ci)
3196 {
3197 	boolean_t fuids_ok;
3198 	boolean_t sa_ok;
3199 	uint64_t zplver = ZPL_VERSION;
3200 	int error;
3201 
3202 	zplver = zfs_zpl_version_map(spa_vers);
3203 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3204 	sa_ok = (zplver >= ZPL_VERSION_SA);
3205 
3206 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3207 	    createprops, zplprops, is_ci);
3208 	return (error);
3209 }
3210 
3211 /*
3212  * innvl: {
3213  *     "type" -> dmu_objset_type_t (int32)
3214  *     (optional) "props" -> { prop -> value }
3215  * }
3216  *
3217  * outnvl: propname -> error code (int32)
3218  */
3219 static int
3220 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3221 {
3222 	int error = 0;
3223 	zfs_creat_t zct = { 0 };
3224 	nvlist_t *nvprops = NULL;
3225 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3226 	int32_t type32;
3227 	dmu_objset_type_t type;
3228 	boolean_t is_insensitive = B_FALSE;
3229 
3230 	if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3231 		return (SET_ERROR(EINVAL));
3232 	type = type32;
3233 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3234 
3235 	switch (type) {
3236 	case DMU_OST_ZFS:
3237 		cbfunc = zfs_create_cb;
3238 		break;
3239 
3240 	case DMU_OST_ZVOL:
3241 		cbfunc = zvol_create_cb;
3242 		break;
3243 
3244 	default:
3245 		cbfunc = NULL;
3246 		break;
3247 	}
3248 	if (strchr(fsname, '@') ||
3249 	    strchr(fsname, '%'))
3250 		return (SET_ERROR(EINVAL));
3251 
3252 	zct.zct_props = nvprops;
3253 
3254 	if (cbfunc == NULL)
3255 		return (SET_ERROR(EINVAL));
3256 
3257 	if (type == DMU_OST_ZVOL) {
3258 		uint64_t volsize, volblocksize;
3259 
3260 		if (nvprops == NULL)
3261 			return (SET_ERROR(EINVAL));
3262 		if (nvlist_lookup_uint64(nvprops,
3263 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3264 			return (SET_ERROR(EINVAL));
3265 
3266 		if ((error = nvlist_lookup_uint64(nvprops,
3267 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3268 		    &volblocksize)) != 0 && error != ENOENT)
3269 			return (SET_ERROR(EINVAL));
3270 
3271 		if (error != 0)
3272 			volblocksize = zfs_prop_default_numeric(
3273 			    ZFS_PROP_VOLBLOCKSIZE);
3274 
3275 		if ((error = zvol_check_volblocksize(
3276 		    volblocksize)) != 0 ||
3277 		    (error = zvol_check_volsize(volsize,
3278 		    volblocksize)) != 0)
3279 			return (error);
3280 	} else if (type == DMU_OST_ZFS) {
3281 		int error;
3282 
3283 		/*
3284 		 * We have to have normalization and
3285 		 * case-folding flags correct when we do the
3286 		 * file system creation, so go figure them out
3287 		 * now.
3288 		 */
3289 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3290 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3291 		error = zfs_fill_zplprops(fsname, nvprops,
3292 		    zct.zct_zplprops, &is_insensitive);
3293 		if (error != 0) {
3294 			nvlist_free(zct.zct_zplprops);
3295 			return (error);
3296 		}
3297 	}
3298 
3299 	error = dmu_objset_create(fsname, type,
3300 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3301 	nvlist_free(zct.zct_zplprops);
3302 
3303 	/*
3304 	 * It would be nice to do this atomically.
3305 	 */
3306 	if (error == 0) {
3307 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3308 		    nvprops, outnvl);
3309 		if (error != 0)
3310 			(void) dsl_destroy_head(fsname);
3311 	}
3312 	return (error);
3313 }
3314 
3315 /*
3316  * innvl: {
3317  *     "origin" -> name of origin snapshot
3318  *     (optional) "props" -> { prop -> value }
3319  * }
3320  *
3321  * outnvl: propname -> error code (int32)
3322  */
3323 static int
3324 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3325 {
3326 	int error = 0;
3327 	nvlist_t *nvprops = NULL;
3328 	char *origin_name;
3329 
3330 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3331 		return (SET_ERROR(EINVAL));
3332 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3333 
3334 	if (strchr(fsname, '@') ||
3335 	    strchr(fsname, '%'))
3336 		return (SET_ERROR(EINVAL));
3337 
3338 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3339 		return (SET_ERROR(EINVAL));
3340 	error = dmu_objset_clone(fsname, origin_name);
3341 	if (error != 0)
3342 		return (error);
3343 
3344 	/*
3345 	 * It would be nice to do this atomically.
3346 	 */
3347 	if (error == 0) {
3348 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3349 		    nvprops, outnvl);
3350 		if (error != 0)
3351 			(void) dsl_destroy_head(fsname);
3352 	}
3353 	return (error);
3354 }
3355 
3356 /*
3357  * innvl: {
3358  *     "snaps" -> { snapshot1, snapshot2 }
3359  *     (optional) "props" -> { prop -> value (string) }
3360  * }
3361  *
3362  * outnvl: snapshot -> error code (int32)
3363  */
3364 static int
3365 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3366 {
3367 	nvlist_t *snaps;
3368 	nvlist_t *props = NULL;
3369 	int error, poollen;
3370 	nvpair_t *pair;
3371 
3372 	(void) nvlist_lookup_nvlist(innvl, "props", &props);
3373 	if ((error = zfs_check_userprops(poolname, props)) != 0)
3374 		return (error);
3375 
3376 	if (!nvlist_empty(props) &&
3377 	    zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3378 		return (SET_ERROR(ENOTSUP));
3379 
3380 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3381 		return (SET_ERROR(EINVAL));
3382 	poollen = strlen(poolname);
3383 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3384 	    pair = nvlist_next_nvpair(snaps, pair)) {
3385 		const char *name = nvpair_name(pair);
3386 		const char *cp = strchr(name, '@');
3387 
3388 		/*
3389 		 * The snap name must contain an @, and the part after it must
3390 		 * contain only valid characters.
3391 		 */
3392 		if (cp == NULL ||
3393 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3394 			return (SET_ERROR(EINVAL));
3395 
3396 		/*
3397 		 * The snap must be in the specified pool.
3398 		 */
3399 		if (strncmp(name, poolname, poollen) != 0 ||
3400 		    (name[poollen] != '/' && name[poollen] != '@'))
3401 			return (SET_ERROR(EXDEV));
3402 
3403 		/* This must be the only snap of this fs. */
3404 		for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3405 		    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3406 			if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3407 			    == 0) {
3408 				return (SET_ERROR(EXDEV));
3409 			}
3410 		}
3411 	}
3412 
3413 	error = dsl_dataset_snapshot(snaps, props, outnvl);
3414 	return (error);
3415 }
3416 
3417 /*
3418  * innvl: "message" -> string
3419  */
3420 /* ARGSUSED */
3421 static int
3422 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3423 {
3424 	char *message;
3425 	spa_t *spa;
3426 	int error;
3427 	char *poolname;
3428 
3429 	/*
3430 	 * The poolname in the ioctl is not set, we get it from the TSD,
3431 	 * which was set at the end of the last successful ioctl that allows
3432 	 * logging.  The secpolicy func already checked that it is set.
3433 	 * Only one log ioctl is allowed after each successful ioctl, so
3434 	 * we clear the TSD here.
3435 	 */
3436 	poolname = tsd_get(zfs_allow_log_key);
3437 	(void) tsd_set(zfs_allow_log_key, NULL);
3438 	error = spa_open(poolname, &spa, FTAG);
3439 	strfree(poolname);
3440 	if (error != 0)
3441 		return (error);
3442 
3443 	if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3444 		spa_close(spa, FTAG);
3445 		return (SET_ERROR(EINVAL));
3446 	}
3447 
3448 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3449 		spa_close(spa, FTAG);
3450 		return (SET_ERROR(ENOTSUP));
3451 	}
3452 
3453 	error = spa_history_log(spa, message);
3454 	spa_close(spa, FTAG);
3455 	return (error);
3456 }
3457 
3458 /*
3459  * The dp_config_rwlock must not be held when calling this, because the
3460  * unmount may need to write out data.
3461  *
3462  * This function is best-effort.  Callers must deal gracefully if it
3463  * remains mounted (or is remounted after this call).
3464  *
3465  * Returns 0 if the argument is not a snapshot, or it is not currently a
3466  * filesystem, or we were able to unmount it.  Returns error code otherwise.
3467  */
3468 int
3469 zfs_unmount_snap(const char *snapname)
3470 {
3471 	vfs_t *vfsp;
3472 	zfsvfs_t *zfsvfs;
3473 	int err;
3474 
3475 	if (strchr(snapname, '@') == NULL)
3476 		return (0);
3477 
3478 	vfsp = zfs_get_vfs(snapname);
3479 	if (vfsp == NULL)
3480 		return (0);
3481 
3482 	zfsvfs = vfsp->vfs_data;
3483 	ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3484 
3485 	err = vn_vfswlock(vfsp->vfs_vnodecovered);
3486 	VFS_RELE(vfsp);
3487 	if (err != 0)
3488 		return (SET_ERROR(err));
3489 
3490 	/*
3491 	 * Always force the unmount for snapshots.
3492 	 */
3493 	(void) dounmount(vfsp, MS_FORCE, kcred);
3494 	return (0);
3495 }
3496 
3497 /* ARGSUSED */
3498 static int
3499 zfs_unmount_snap_cb(const char *snapname, void *arg)
3500 {
3501 	return (zfs_unmount_snap(snapname));
3502 }
3503 
3504 /*
3505  * When a clone is destroyed, its origin may also need to be destroyed,
3506  * in which case it must be unmounted.  This routine will do that unmount
3507  * if necessary.
3508  */
3509 void
3510 zfs_destroy_unmount_origin(const char *fsname)
3511 {
3512 	int error;
3513 	objset_t *os;
3514 	dsl_dataset_t *ds;
3515 
3516 	error = dmu_objset_hold(fsname, FTAG, &os);
3517 	if (error != 0)
3518 		return;
3519 	ds = dmu_objset_ds(os);
3520 	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3521 		char originname[ZFS_MAX_DATASET_NAME_LEN];
3522 		dsl_dataset_name(ds->ds_prev, originname);
3523 		dmu_objset_rele(os, FTAG);
3524 		(void) zfs_unmount_snap(originname);
3525 	} else {
3526 		dmu_objset_rele(os, FTAG);
3527 	}
3528 }
3529 
3530 /*
3531  * innvl: {
3532  *     "snaps" -> { snapshot1, snapshot2 }
3533  *     (optional boolean) "defer"
3534  * }
3535  *
3536  * outnvl: snapshot -> error code (int32)
3537  *
3538  */
3539 /* ARGSUSED */
3540 static int
3541 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3542 {
3543 	nvlist_t *snaps;
3544 	nvpair_t *pair;
3545 	boolean_t defer;
3546 
3547 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3548 		return (SET_ERROR(EINVAL));
3549 	defer = nvlist_exists(innvl, "defer");
3550 
3551 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3552 	    pair = nvlist_next_nvpair(snaps, pair)) {
3553 		(void) zfs_unmount_snap(nvpair_name(pair));
3554 	}
3555 
3556 	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3557 }
3558 
3559 /*
3560  * Create bookmarks.  Bookmark names are of the form <fs>#<bmark>.
3561  * All bookmarks must be in the same pool.
3562  *
3563  * innvl: {
3564  *     bookmark1 -> snapshot1, bookmark2 -> snapshot2
3565  * }
3566  *
3567  * outnvl: bookmark -> error code (int32)
3568  *
3569  */
3570 /* ARGSUSED */
3571 static int
3572 zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3573 {
3574 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3575 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3576 		char *snap_name;
3577 
3578 		/*
3579 		 * Verify the snapshot argument.
3580 		 */
3581 		if (nvpair_value_string(pair, &snap_name) != 0)
3582 			return (SET_ERROR(EINVAL));
3583 
3584 
3585 		/* Verify that the keys (bookmarks) are unique */
3586 		for (nvpair_t *pair2 = nvlist_next_nvpair(innvl, pair);
3587 		    pair2 != NULL; pair2 = nvlist_next_nvpair(innvl, pair2)) {
3588 			if (strcmp(nvpair_name(pair), nvpair_name(pair2)) == 0)
3589 				return (SET_ERROR(EINVAL));
3590 		}
3591 	}
3592 
3593 	return (dsl_bookmark_create(innvl, outnvl));
3594 }
3595 
3596 /*
3597  * innvl: {
3598  *     property 1, property 2, ...
3599  * }
3600  *
3601  * outnvl: {
3602  *     bookmark name 1 -> { property 1, property 2, ... },
3603  *     bookmark name 2 -> { property 1, property 2, ... }
3604  * }
3605  *
3606  */
3607 static int
3608 zfs_ioc_get_bookmarks(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3609 {
3610 	return (dsl_get_bookmarks(fsname, innvl, outnvl));
3611 }
3612 
3613 /*
3614  * innvl: {
3615  *     bookmark name 1, bookmark name 2
3616  * }
3617  *
3618  * outnvl: bookmark -> error code (int32)
3619  *
3620  */
3621 static int
3622 zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
3623     nvlist_t *outnvl)
3624 {
3625 	int error, poollen;
3626 
3627 	poollen = strlen(poolname);
3628 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3629 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3630 		const char *name = nvpair_name(pair);
3631 		const char *cp = strchr(name, '#');
3632 
3633 		/*
3634 		 * The bookmark name must contain an #, and the part after it
3635 		 * must contain only valid characters.
3636 		 */
3637 		if (cp == NULL ||
3638 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3639 			return (SET_ERROR(EINVAL));
3640 
3641 		/*
3642 		 * The bookmark must be in the specified pool.
3643 		 */
3644 		if (strncmp(name, poolname, poollen) != 0 ||
3645 		    (name[poollen] != '/' && name[poollen] != '#'))
3646 			return (SET_ERROR(EXDEV));
3647 	}
3648 
3649 	error = dsl_bookmark_destroy(innvl, outnvl);
3650 	return (error);
3651 }
3652 
3653 /*
3654  * inputs:
3655  * zc_name		name of dataset to destroy
3656  * zc_objset_type	type of objset
3657  * zc_defer_destroy	mark for deferred destroy
3658  *
3659  * outputs:		none
3660  */
3661 static int
3662 zfs_ioc_destroy(zfs_cmd_t *zc)
3663 {
3664 	int err;
3665 
3666 	if (zc->zc_objset_type == DMU_OST_ZFS) {
3667 		err = zfs_unmount_snap(zc->zc_name);
3668 		if (err != 0)
3669 			return (err);
3670 	}
3671 
3672 	if (strchr(zc->zc_name, '@'))
3673 		err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3674 	else
3675 		err = dsl_destroy_head(zc->zc_name);
3676 	if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3677 		(void) zvol_remove_minor(zc->zc_name);
3678 	return (err);
3679 }
3680 
3681 /*
3682  * fsname is name of dataset to rollback (to most recent snapshot)
3683  *
3684  * innvl is not used.
3685  *
3686  * outnvl: "target" -> name of most recent snapshot
3687  * }
3688  */
3689 /* ARGSUSED */
3690 static int
3691 zfs_ioc_rollback(const char *fsname, nvlist_t *args, nvlist_t *outnvl)
3692 {
3693 	zfsvfs_t *zfsvfs;
3694 	int error;
3695 
3696 	if (getzfsvfs(fsname, &zfsvfs) == 0) {
3697 		error = zfs_suspend_fs(zfsvfs);
3698 		if (error == 0) {
3699 			int resume_err;
3700 
3701 			error = dsl_dataset_rollback(fsname, zfsvfs, outnvl);
3702 			resume_err = zfs_resume_fs(zfsvfs, fsname);
3703 			error = error ? error : resume_err;
3704 		}
3705 		VFS_RELE(zfsvfs->z_vfs);
3706 	} else {
3707 		error = dsl_dataset_rollback(fsname, NULL, outnvl);
3708 	}
3709 	return (error);
3710 }
3711 
3712 static int
3713 recursive_unmount(const char *fsname, void *arg)
3714 {
3715 	const char *snapname = arg;
3716 	char fullname[ZFS_MAX_DATASET_NAME_LEN];
3717 
3718 	(void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
3719 	return (zfs_unmount_snap(fullname));
3720 }
3721 
3722 /*
3723  * inputs:
3724  * zc_name	old name of dataset
3725  * zc_value	new name of dataset
3726  * zc_cookie	recursive flag (only valid for snapshots)
3727  *
3728  * outputs:	none
3729  */
3730 static int
3731 zfs_ioc_rename(zfs_cmd_t *zc)
3732 {
3733 	boolean_t recursive = zc->zc_cookie & 1;
3734 	char *at;
3735 
3736 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3737 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3738 	    strchr(zc->zc_value, '%'))
3739 		return (SET_ERROR(EINVAL));
3740 
3741 	at = strchr(zc->zc_name, '@');
3742 	if (at != NULL) {
3743 		/* snaps must be in same fs */
3744 		int error;
3745 
3746 		if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
3747 			return (SET_ERROR(EXDEV));
3748 		*at = '\0';
3749 		if (zc->zc_objset_type == DMU_OST_ZFS) {
3750 			error = dmu_objset_find(zc->zc_name,
3751 			    recursive_unmount, at + 1,
3752 			    recursive ? DS_FIND_CHILDREN : 0);
3753 			if (error != 0) {
3754 				*at = '@';
3755 				return (error);
3756 			}
3757 		}
3758 		error = dsl_dataset_rename_snapshot(zc->zc_name,
3759 		    at + 1, strchr(zc->zc_value, '@') + 1, recursive);
3760 		*at = '@';
3761 
3762 		return (error);
3763 	} else {
3764 		if (zc->zc_objset_type == DMU_OST_ZVOL)
3765 			(void) zvol_remove_minor(zc->zc_name);
3766 		return (dsl_dir_rename(zc->zc_name, zc->zc_value));
3767 	}
3768 }
3769 
3770 static int
3771 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3772 {
3773 	const char *propname = nvpair_name(pair);
3774 	boolean_t issnap = (strchr(dsname, '@') != NULL);
3775 	zfs_prop_t prop = zfs_name_to_prop(propname);
3776 	uint64_t intval;
3777 	int err;
3778 
3779 	if (prop == ZPROP_INVAL) {
3780 		if (zfs_prop_user(propname)) {
3781 			if (err = zfs_secpolicy_write_perms(dsname,
3782 			    ZFS_DELEG_PERM_USERPROP, cr))
3783 				return (err);
3784 			return (0);
3785 		}
3786 
3787 		if (!issnap && zfs_prop_userquota(propname)) {
3788 			const char *perm = NULL;
3789 			const char *uq_prefix =
3790 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3791 			const char *gq_prefix =
3792 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3793 
3794 			if (strncmp(propname, uq_prefix,
3795 			    strlen(uq_prefix)) == 0) {
3796 				perm = ZFS_DELEG_PERM_USERQUOTA;
3797 			} else if (strncmp(propname, gq_prefix,
3798 			    strlen(gq_prefix)) == 0) {
3799 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
3800 			} else {
3801 				/* USERUSED and GROUPUSED are read-only */
3802 				return (SET_ERROR(EINVAL));
3803 			}
3804 
3805 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3806 				return (err);
3807 			return (0);
3808 		}
3809 
3810 		return (SET_ERROR(EINVAL));
3811 	}
3812 
3813 	if (issnap)
3814 		return (SET_ERROR(EINVAL));
3815 
3816 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3817 		/*
3818 		 * dsl_prop_get_all_impl() returns properties in this
3819 		 * format.
3820 		 */
3821 		nvlist_t *attrs;
3822 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3823 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3824 		    &pair) == 0);
3825 	}
3826 
3827 	/*
3828 	 * Check that this value is valid for this pool version
3829 	 */
3830 	switch (prop) {
3831 	case ZFS_PROP_COMPRESSION:
3832 		/*
3833 		 * If the user specified gzip compression, make sure
3834 		 * the SPA supports it. We ignore any errors here since
3835 		 * we'll catch them later.
3836 		 */
3837 		if (nvpair_value_uint64(pair, &intval) == 0) {
3838 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
3839 			    intval <= ZIO_COMPRESS_GZIP_9 &&
3840 			    zfs_earlier_version(dsname,
3841 			    SPA_VERSION_GZIP_COMPRESSION)) {
3842 				return (SET_ERROR(ENOTSUP));
3843 			}
3844 
3845 			if (intval == ZIO_COMPRESS_ZLE &&
3846 			    zfs_earlier_version(dsname,
3847 			    SPA_VERSION_ZLE_COMPRESSION))
3848 				return (SET_ERROR(ENOTSUP));
3849 
3850 			if (intval == ZIO_COMPRESS_LZ4) {
3851 				spa_t *spa;
3852 
3853 				if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3854 					return (err);
3855 
3856 				if (!spa_feature_is_enabled(spa,
3857 				    SPA_FEATURE_LZ4_COMPRESS)) {
3858 					spa_close(spa, FTAG);
3859 					return (SET_ERROR(ENOTSUP));
3860 				}
3861 				spa_close(spa, FTAG);
3862 			}
3863 
3864 			/*
3865 			 * If this is a bootable dataset then
3866 			 * verify that the compression algorithm
3867 			 * is supported for booting. We must return
3868 			 * something other than ENOTSUP since it
3869 			 * implies a downrev pool version.
3870 			 */
3871 			if (zfs_is_bootfs(dsname) &&
3872 			    !BOOTFS_COMPRESS_VALID(intval)) {
3873 				return (SET_ERROR(ERANGE));
3874 			}
3875 		}
3876 		break;
3877 
3878 	case ZFS_PROP_COPIES:
3879 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3880 			return (SET_ERROR(ENOTSUP));
3881 		break;
3882 
3883 	case ZFS_PROP_DEDUP:
3884 		if (zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3885 			return (SET_ERROR(ENOTSUP));
3886 		break;
3887 
3888 	case ZFS_PROP_RECORDSIZE:
3889 		/* Record sizes above 128k need the feature to be enabled */
3890 		if (nvpair_value_uint64(pair, &intval) == 0 &&
3891 		    intval > SPA_OLD_MAXBLOCKSIZE) {
3892 			spa_t *spa;
3893 
3894 			/*
3895 			 * If this is a bootable dataset then
3896 			 * the we don't allow large (>128K) blocks,
3897 			 * because GRUB doesn't support them.
3898 			 */
3899 			if (zfs_is_bootfs(dsname) &&
3900 			    intval > SPA_OLD_MAXBLOCKSIZE) {
3901 				return (SET_ERROR(EDOM));
3902 			}
3903 
3904 			/*
3905 			 * We don't allow setting the property above 1MB,
3906 			 * unless the tunable has been changed.
3907 			 */
3908 			if (intval > zfs_max_recordsize ||
3909 			    intval > SPA_MAXBLOCKSIZE)
3910 				return (SET_ERROR(EDOM));
3911 
3912 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3913 				return (err);
3914 
3915 			if (!spa_feature_is_enabled(spa,
3916 			    SPA_FEATURE_LARGE_BLOCKS)) {
3917 				spa_close(spa, FTAG);
3918 				return (SET_ERROR(ENOTSUP));
3919 			}
3920 			spa_close(spa, FTAG);
3921 		}
3922 		break;
3923 
3924 	case ZFS_PROP_SHARESMB:
3925 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3926 			return (SET_ERROR(ENOTSUP));
3927 		break;
3928 
3929 	case ZFS_PROP_ACLINHERIT:
3930 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3931 		    nvpair_value_uint64(pair, &intval) == 0) {
3932 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
3933 			    zfs_earlier_version(dsname,
3934 			    SPA_VERSION_PASSTHROUGH_X))
3935 				return (SET_ERROR(ENOTSUP));
3936 		}
3937 		break;
3938 	}
3939 
3940 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3941 }
3942 
3943 /*
3944  * Checks for a race condition to make sure we don't increment a feature flag
3945  * multiple times.
3946  */
3947 static int
3948 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
3949 {
3950 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3951 	spa_feature_t *featurep = arg;
3952 
3953 	if (!spa_feature_is_active(spa, *featurep))
3954 		return (0);
3955 	else
3956 		return (SET_ERROR(EBUSY));
3957 }
3958 
3959 /*
3960  * The callback invoked on feature activation in the sync task caused by
3961  * zfs_prop_activate_feature.
3962  */
3963 static void
3964 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
3965 {
3966 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3967 	spa_feature_t *featurep = arg;
3968 
3969 	spa_feature_incr(spa, *featurep, tx);
3970 }
3971 
3972 /*
3973  * Activates a feature on a pool in response to a property setting. This
3974  * creates a new sync task which modifies the pool to reflect the feature
3975  * as being active.
3976  */
3977 static int
3978 zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature)
3979 {
3980 	int err;
3981 
3982 	/* EBUSY here indicates that the feature is already active */
3983 	err = dsl_sync_task(spa_name(spa),
3984 	    zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
3985 	    &feature, 2, ZFS_SPACE_CHECK_RESERVED);
3986 
3987 	if (err != 0 && err != EBUSY)
3988 		return (err);
3989 	else
3990 		return (0);
3991 }
3992 
3993 /*
3994  * Removes properties from the given props list that fail permission checks
3995  * needed to clear them and to restore them in case of a receive error. For each
3996  * property, make sure we have both set and inherit permissions.
3997  *
3998  * Returns the first error encountered if any permission checks fail. If the
3999  * caller provides a non-NULL errlist, it also gives the complete list of names
4000  * of all the properties that failed a permission check along with the
4001  * corresponding error numbers. The caller is responsible for freeing the
4002  * returned errlist.
4003  *
4004  * If every property checks out successfully, zero is returned and the list
4005  * pointed at by errlist is NULL.
4006  */
4007 static int
4008 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
4009 {
4010 	zfs_cmd_t *zc;
4011 	nvpair_t *pair, *next_pair;
4012 	nvlist_t *errors;
4013 	int err, rv = 0;
4014 
4015 	if (props == NULL)
4016 		return (0);
4017 
4018 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4019 
4020 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
4021 	(void) strcpy(zc->zc_name, dataset);
4022 	pair = nvlist_next_nvpair(props, NULL);
4023 	while (pair != NULL) {
4024 		next_pair = nvlist_next_nvpair(props, pair);
4025 
4026 		(void) strcpy(zc->zc_value, nvpair_name(pair));
4027 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
4028 		    (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
4029 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
4030 			VERIFY(nvlist_add_int32(errors,
4031 			    zc->zc_value, err) == 0);
4032 		}
4033 		pair = next_pair;
4034 	}
4035 	kmem_free(zc, sizeof (zfs_cmd_t));
4036 
4037 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
4038 		nvlist_free(errors);
4039 		errors = NULL;
4040 	} else {
4041 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
4042 	}
4043 
4044 	if (errlist == NULL)
4045 		nvlist_free(errors);
4046 	else
4047 		*errlist = errors;
4048 
4049 	return (rv);
4050 }
4051 
4052 static boolean_t
4053 propval_equals(nvpair_t *p1, nvpair_t *p2)
4054 {
4055 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
4056 		/* dsl_prop_get_all_impl() format */
4057 		nvlist_t *attrs;
4058 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
4059 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4060 		    &p1) == 0);
4061 	}
4062 
4063 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
4064 		nvlist_t *attrs;
4065 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
4066 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4067 		    &p2) == 0);
4068 	}
4069 
4070 	if (nvpair_type(p1) != nvpair_type(p2))
4071 		return (B_FALSE);
4072 
4073 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
4074 		char *valstr1, *valstr2;
4075 
4076 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
4077 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
4078 		return (strcmp(valstr1, valstr2) == 0);
4079 	} else {
4080 		uint64_t intval1, intval2;
4081 
4082 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
4083 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
4084 		return (intval1 == intval2);
4085 	}
4086 }
4087 
4088 /*
4089  * Remove properties from props if they are not going to change (as determined
4090  * by comparison with origprops). Remove them from origprops as well, since we
4091  * do not need to clear or restore properties that won't change.
4092  */
4093 static void
4094 props_reduce(nvlist_t *props, nvlist_t *origprops)
4095 {
4096 	nvpair_t *pair, *next_pair;
4097 
4098 	if (origprops == NULL)
4099 		return; /* all props need to be received */
4100 
4101 	pair = nvlist_next_nvpair(props, NULL);
4102 	while (pair != NULL) {
4103 		const char *propname = nvpair_name(pair);
4104 		nvpair_t *match;
4105 
4106 		next_pair = nvlist_next_nvpair(props, pair);
4107 
4108 		if ((nvlist_lookup_nvpair(origprops, propname,
4109 		    &match) != 0) || !propval_equals(pair, match))
4110 			goto next; /* need to set received value */
4111 
4112 		/* don't clear the existing received value */
4113 		(void) nvlist_remove_nvpair(origprops, match);
4114 		/* don't bother receiving the property */
4115 		(void) nvlist_remove_nvpair(props, pair);
4116 next:
4117 		pair = next_pair;
4118 	}
4119 }
4120 
4121 #ifdef	DEBUG
4122 static boolean_t zfs_ioc_recv_inject_err;
4123 #endif
4124 
4125 /*
4126  * inputs:
4127  * zc_name		name of containing filesystem
4128  * zc_nvlist_src{_size}	nvlist of properties to apply
4129  * zc_value		name of snapshot to create
4130  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
4131  * zc_cookie		file descriptor to recv from
4132  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
4133  * zc_guid		force flag
4134  * zc_cleanup_fd	cleanup-on-exit file descriptor
4135  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
4136  * zc_resumable		if data is incomplete assume sender will resume
4137  *
4138  * outputs:
4139  * zc_cookie		number of bytes read
4140  * zc_nvlist_dst{_size} error for each unapplied received property
4141  * zc_obj		zprop_errflags_t
4142  * zc_action_handle	handle for this guid/ds mapping
4143  */
4144 static int
4145 zfs_ioc_recv(zfs_cmd_t *zc)
4146 {
4147 	file_t *fp;
4148 	dmu_recv_cookie_t drc;
4149 	boolean_t force = (boolean_t)zc->zc_guid;
4150 	int fd;
4151 	int error = 0;
4152 	int props_error = 0;
4153 	nvlist_t *errors;
4154 	offset_t off;
4155 	nvlist_t *props = NULL; /* sent properties */
4156 	nvlist_t *origprops = NULL; /* existing properties */
4157 	char *origin = NULL;
4158 	char *tosnap;
4159 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
4160 	boolean_t first_recvd_props = B_FALSE;
4161 
4162 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
4163 	    strchr(zc->zc_value, '@') == NULL ||
4164 	    strchr(zc->zc_value, '%'))
4165 		return (SET_ERROR(EINVAL));
4166 
4167 	(void) strcpy(tofs, zc->zc_value);
4168 	tosnap = strchr(tofs, '@');
4169 	*tosnap++ = '\0';
4170 
4171 	if (zc->zc_nvlist_src != NULL &&
4172 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
4173 	    zc->zc_iflags, &props)) != 0)
4174 		return (error);
4175 
4176 	fd = zc->zc_cookie;
4177 	fp = getf(fd);
4178 	if (fp == NULL) {
4179 		nvlist_free(props);
4180 		return (SET_ERROR(EBADF));
4181 	}
4182 
4183 	errors = fnvlist_alloc();
4184 
4185 	if (zc->zc_string[0])
4186 		origin = zc->zc_string;
4187 
4188 	error = dmu_recv_begin(tofs, tosnap,
4189 	    &zc->zc_begin_record, force, zc->zc_resumable, origin, &drc);
4190 	if (error != 0)
4191 		goto out;
4192 
4193 	/*
4194 	 * Set properties before we receive the stream so that they are applied
4195 	 * to the new data. Note that we must call dmu_recv_stream() if
4196 	 * dmu_recv_begin() succeeds.
4197 	 */
4198 	if (props != NULL && !drc.drc_newfs) {
4199 		if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
4200 		    SPA_VERSION_RECVD_PROPS &&
4201 		    !dsl_prop_get_hasrecvd(tofs))
4202 			first_recvd_props = B_TRUE;
4203 
4204 		/*
4205 		 * If new received properties are supplied, they are to
4206 		 * completely replace the existing received properties, so stash
4207 		 * away the existing ones.
4208 		 */
4209 		if (dsl_prop_get_received(tofs, &origprops) == 0) {
4210 			nvlist_t *errlist = NULL;
4211 			/*
4212 			 * Don't bother writing a property if its value won't
4213 			 * change (and avoid the unnecessary security checks).
4214 			 *
4215 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
4216 			 * special case where we blow away all local properties
4217 			 * regardless.
4218 			 */
4219 			if (!first_recvd_props)
4220 				props_reduce(props, origprops);
4221 			if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
4222 				(void) nvlist_merge(errors, errlist, 0);
4223 			nvlist_free(errlist);
4224 
4225 			if (clear_received_props(tofs, origprops,
4226 			    first_recvd_props ? NULL : props) != 0)
4227 				zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4228 		} else {
4229 			zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4230 		}
4231 	}
4232 
4233 	if (props != NULL) {
4234 		props_error = dsl_prop_set_hasrecvd(tofs);
4235 
4236 		if (props_error == 0) {
4237 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4238 			    props, errors);
4239 		}
4240 	}
4241 
4242 	if (zc->zc_nvlist_dst_size != 0 &&
4243 	    (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4244 	    put_nvlist(zc, errors) != 0)) {
4245 		/*
4246 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
4247 		 * size or supplied an invalid address.
4248 		 */
4249 		props_error = SET_ERROR(EINVAL);
4250 	}
4251 
4252 	off = fp->f_offset;
4253 	error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4254 	    &zc->zc_action_handle);
4255 
4256 	if (error == 0) {
4257 		zfsvfs_t *zfsvfs = NULL;
4258 
4259 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
4260 			/* online recv */
4261 			int end_err;
4262 
4263 			error = zfs_suspend_fs(zfsvfs);
4264 			/*
4265 			 * If the suspend fails, then the recv_end will
4266 			 * likely also fail, and clean up after itself.
4267 			 */
4268 			end_err = dmu_recv_end(&drc, zfsvfs);
4269 			if (error == 0)
4270 				error = zfs_resume_fs(zfsvfs, tofs);
4271 			error = error ? error : end_err;
4272 			VFS_RELE(zfsvfs->z_vfs);
4273 		} else {
4274 			error = dmu_recv_end(&drc, NULL);
4275 		}
4276 	}
4277 
4278 	zc->zc_cookie = off - fp->f_offset;
4279 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4280 		fp->f_offset = off;
4281 
4282 #ifdef	DEBUG
4283 	if (zfs_ioc_recv_inject_err) {
4284 		zfs_ioc_recv_inject_err = B_FALSE;
4285 		error = 1;
4286 	}
4287 #endif
4288 	/*
4289 	 * On error, restore the original props.
4290 	 */
4291 	if (error != 0 && props != NULL && !drc.drc_newfs) {
4292 		if (clear_received_props(tofs, props, NULL) != 0) {
4293 			/*
4294 			 * We failed to clear the received properties.
4295 			 * Since we may have left a $recvd value on the
4296 			 * system, we can't clear the $hasrecvd flag.
4297 			 */
4298 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4299 		} else if (first_recvd_props) {
4300 			dsl_prop_unset_hasrecvd(tofs);
4301 		}
4302 
4303 		if (origprops == NULL && !drc.drc_newfs) {
4304 			/* We failed to stash the original properties. */
4305 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4306 		}
4307 
4308 		/*
4309 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
4310 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4311 		 * explictly if we're restoring local properties cleared in the
4312 		 * first new-style receive.
4313 		 */
4314 		if (origprops != NULL &&
4315 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4316 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4317 		    origprops, NULL) != 0) {
4318 			/*
4319 			 * We stashed the original properties but failed to
4320 			 * restore them.
4321 			 */
4322 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4323 		}
4324 	}
4325 out:
4326 	nvlist_free(props);
4327 	nvlist_free(origprops);
4328 	nvlist_free(errors);
4329 	releasef(fd);
4330 
4331 	if (error == 0)
4332 		error = props_error;
4333 
4334 	return (error);
4335 }
4336 
4337 /*
4338  * inputs:
4339  * zc_name	name of snapshot to send
4340  * zc_cookie	file descriptor to send stream to
4341  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
4342  * zc_sendobj	objsetid of snapshot to send
4343  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
4344  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
4345  *		output size in zc_objset_type.
4346  * zc_flags	lzc_send_flags
4347  *
4348  * outputs:
4349  * zc_objset_type	estimated size, if zc_guid is set
4350  */
4351 static int
4352 zfs_ioc_send(zfs_cmd_t *zc)
4353 {
4354 	int error;
4355 	offset_t off;
4356 	boolean_t estimate = (zc->zc_guid != 0);
4357 	boolean_t embedok = (zc->zc_flags & 0x1);
4358 	boolean_t large_block_ok = (zc->zc_flags & 0x2);
4359 
4360 	if (zc->zc_obj != 0) {
4361 		dsl_pool_t *dp;
4362 		dsl_dataset_t *tosnap;
4363 
4364 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4365 		if (error != 0)
4366 			return (error);
4367 
4368 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4369 		if (error != 0) {
4370 			dsl_pool_rele(dp, FTAG);
4371 			return (error);
4372 		}
4373 
4374 		if (dsl_dir_is_clone(tosnap->ds_dir))
4375 			zc->zc_fromobj =
4376 			    dsl_dir_phys(tosnap->ds_dir)->dd_origin_obj;
4377 		dsl_dataset_rele(tosnap, FTAG);
4378 		dsl_pool_rele(dp, FTAG);
4379 	}
4380 
4381 	if (estimate) {
4382 		dsl_pool_t *dp;
4383 		dsl_dataset_t *tosnap;
4384 		dsl_dataset_t *fromsnap = NULL;
4385 
4386 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4387 		if (error != 0)
4388 			return (error);
4389 
4390 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4391 		if (error != 0) {
4392 			dsl_pool_rele(dp, FTAG);
4393 			return (error);
4394 		}
4395 
4396 		if (zc->zc_fromobj != 0) {
4397 			error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
4398 			    FTAG, &fromsnap);
4399 			if (error != 0) {
4400 				dsl_dataset_rele(tosnap, FTAG);
4401 				dsl_pool_rele(dp, FTAG);
4402 				return (error);
4403 			}
4404 		}
4405 
4406 		error = dmu_send_estimate(tosnap, fromsnap,
4407 		    &zc->zc_objset_type);
4408 
4409 		if (fromsnap != NULL)
4410 			dsl_dataset_rele(fromsnap, FTAG);
4411 		dsl_dataset_rele(tosnap, FTAG);
4412 		dsl_pool_rele(dp, FTAG);
4413 	} else {
4414 		file_t *fp = getf(zc->zc_cookie);
4415 		if (fp == NULL)
4416 			return (SET_ERROR(EBADF));
4417 
4418 		off = fp->f_offset;
4419 		error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
4420 		    zc->zc_fromobj, embedok, large_block_ok,
4421 		    zc->zc_cookie, fp->f_vnode, &off);
4422 
4423 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4424 			fp->f_offset = off;
4425 		releasef(zc->zc_cookie);
4426 	}
4427 	return (error);
4428 }
4429 
4430 /*
4431  * inputs:
4432  * zc_name	name of snapshot on which to report progress
4433  * zc_cookie	file descriptor of send stream
4434  *
4435  * outputs:
4436  * zc_cookie	number of bytes written in send stream thus far
4437  */
4438 static int
4439 zfs_ioc_send_progress(zfs_cmd_t *zc)
4440 {
4441 	dsl_pool_t *dp;
4442 	dsl_dataset_t *ds;
4443 	dmu_sendarg_t *dsp = NULL;
4444 	int error;
4445 
4446 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4447 	if (error != 0)
4448 		return (error);
4449 
4450 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4451 	if (error != 0) {
4452 		dsl_pool_rele(dp, FTAG);
4453 		return (error);
4454 	}
4455 
4456 	mutex_enter(&ds->ds_sendstream_lock);
4457 
4458 	/*
4459 	 * Iterate over all the send streams currently active on this dataset.
4460 	 * If there's one which matches the specified file descriptor _and_ the
4461 	 * stream was started by the current process, return the progress of
4462 	 * that stream.
4463 	 */
4464 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4465 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
4466 		if (dsp->dsa_outfd == zc->zc_cookie &&
4467 		    dsp->dsa_proc == curproc)
4468 			break;
4469 	}
4470 
4471 	if (dsp != NULL)
4472 		zc->zc_cookie = *(dsp->dsa_off);
4473 	else
4474 		error = SET_ERROR(ENOENT);
4475 
4476 	mutex_exit(&ds->ds_sendstream_lock);
4477 	dsl_dataset_rele(ds, FTAG);
4478 	dsl_pool_rele(dp, FTAG);
4479 	return (error);
4480 }
4481 
4482 static int
4483 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4484 {
4485 	int id, error;
4486 
4487 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4488 	    &zc->zc_inject_record);
4489 
4490 	if (error == 0)
4491 		zc->zc_guid = (uint64_t)id;
4492 
4493 	return (error);
4494 }
4495 
4496 static int
4497 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4498 {
4499 	return (zio_clear_fault((int)zc->zc_guid));
4500 }
4501 
4502 static int
4503 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4504 {
4505 	int id = (int)zc->zc_guid;
4506 	int error;
4507 
4508 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4509 	    &zc->zc_inject_record);
4510 
4511 	zc->zc_guid = id;
4512 
4513 	return (error);
4514 }
4515 
4516 static int
4517 zfs_ioc_error_log(zfs_cmd_t *zc)
4518 {
4519 	spa_t *spa;
4520 	int error;
4521 	size_t count = (size_t)zc->zc_nvlist_dst_size;
4522 
4523 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4524 		return (error);
4525 
4526 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4527 	    &count);
4528 	if (error == 0)
4529 		zc->zc_nvlist_dst_size = count;
4530 	else
4531 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4532 
4533 	spa_close(spa, FTAG);
4534 
4535 	return (error);
4536 }
4537 
4538 static int
4539 zfs_ioc_clear(zfs_cmd_t *zc)
4540 {
4541 	spa_t *spa;
4542 	vdev_t *vd;
4543 	int error;
4544 
4545 	/*
4546 	 * On zpool clear we also fix up missing slogs
4547 	 */
4548 	mutex_enter(&spa_namespace_lock);
4549 	spa = spa_lookup(zc->zc_name);
4550 	if (spa == NULL) {
4551 		mutex_exit(&spa_namespace_lock);
4552 		return (SET_ERROR(EIO));
4553 	}
4554 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4555 		/* we need to let spa_open/spa_load clear the chains */
4556 		spa_set_log_state(spa, SPA_LOG_CLEAR);
4557 	}
4558 	spa->spa_last_open_failed = 0;
4559 	mutex_exit(&spa_namespace_lock);
4560 
4561 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4562 		error = spa_open(zc->zc_name, &spa, FTAG);
4563 	} else {
4564 		nvlist_t *policy;
4565 		nvlist_t *config = NULL;
4566 
4567 		if (zc->zc_nvlist_src == NULL)
4568 			return (SET_ERROR(EINVAL));
4569 
4570 		if ((error = get_nvlist(zc->zc_nvlist_src,
4571 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4572 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4573 			    policy, &config);
4574 			if (config != NULL) {
4575 				int err;
4576 
4577 				if ((err = put_nvlist(zc, config)) != 0)
4578 					error = err;
4579 				nvlist_free(config);
4580 			}
4581 			nvlist_free(policy);
4582 		}
4583 	}
4584 
4585 	if (error != 0)
4586 		return (error);
4587 
4588 	spa_vdev_state_enter(spa, SCL_NONE);
4589 
4590 	if (zc->zc_guid == 0) {
4591 		vd = NULL;
4592 	} else {
4593 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4594 		if (vd == NULL) {
4595 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
4596 			spa_close(spa, FTAG);
4597 			return (SET_ERROR(ENODEV));
4598 		}
4599 	}
4600 
4601 	vdev_clear(spa, vd);
4602 
4603 	(void) spa_vdev_state_exit(spa, NULL, 0);
4604 
4605 	/*
4606 	 * Resume any suspended I/Os.
4607 	 */
4608 	if (zio_resume(spa) != 0)
4609 		error = SET_ERROR(EIO);
4610 
4611 	spa_close(spa, FTAG);
4612 
4613 	return (error);
4614 }
4615 
4616 static int
4617 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4618 {
4619 	spa_t *spa;
4620 	int error;
4621 
4622 	error = spa_open(zc->zc_name, &spa, FTAG);
4623 	if (error != 0)
4624 		return (error);
4625 
4626 	spa_vdev_state_enter(spa, SCL_NONE);
4627 
4628 	/*
4629 	 * If a resilver is already in progress then set the
4630 	 * spa_scrub_reopen flag to B_TRUE so that we don't restart
4631 	 * the scan as a side effect of the reopen. Otherwise, let
4632 	 * vdev_open() decided if a resilver is required.
4633 	 */
4634 	spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4635 	vdev_reopen(spa->spa_root_vdev);
4636 	spa->spa_scrub_reopen = B_FALSE;
4637 
4638 	(void) spa_vdev_state_exit(spa, NULL, 0);
4639 	spa_close(spa, FTAG);
4640 	return (0);
4641 }
4642 /*
4643  * inputs:
4644  * zc_name	name of filesystem
4645  * zc_value	name of origin snapshot
4646  *
4647  * outputs:
4648  * zc_string	name of conflicting snapshot, if there is one
4649  */
4650 static int
4651 zfs_ioc_promote(zfs_cmd_t *zc)
4652 {
4653 	char *cp;
4654 
4655 	/*
4656 	 * We don't need to unmount *all* the origin fs's snapshots, but
4657 	 * it's easier.
4658 	 */
4659 	cp = strchr(zc->zc_value, '@');
4660 	if (cp)
4661 		*cp = '\0';
4662 	(void) dmu_objset_find(zc->zc_value,
4663 	    zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
4664 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4665 }
4666 
4667 /*
4668  * Retrieve a single {user|group}{used|quota}@... property.
4669  *
4670  * inputs:
4671  * zc_name	name of filesystem
4672  * zc_objset_type zfs_userquota_prop_t
4673  * zc_value	domain name (eg. "S-1-234-567-89")
4674  * zc_guid	RID/UID/GID
4675  *
4676  * outputs:
4677  * zc_cookie	property value
4678  */
4679 static int
4680 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4681 {
4682 	zfsvfs_t *zfsvfs;
4683 	int error;
4684 
4685 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4686 		return (SET_ERROR(EINVAL));
4687 
4688 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4689 	if (error != 0)
4690 		return (error);
4691 
4692 	error = zfs_userspace_one(zfsvfs,
4693 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4694 	zfsvfs_rele(zfsvfs, FTAG);
4695 
4696 	return (error);
4697 }
4698 
4699 /*
4700  * inputs:
4701  * zc_name		name of filesystem
4702  * zc_cookie		zap cursor
4703  * zc_objset_type	zfs_userquota_prop_t
4704  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4705  *
4706  * outputs:
4707  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
4708  * zc_cookie	zap cursor
4709  */
4710 static int
4711 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4712 {
4713 	zfsvfs_t *zfsvfs;
4714 	int bufsize = zc->zc_nvlist_dst_size;
4715 
4716 	if (bufsize <= 0)
4717 		return (SET_ERROR(ENOMEM));
4718 
4719 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4720 	if (error != 0)
4721 		return (error);
4722 
4723 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
4724 
4725 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4726 	    buf, &zc->zc_nvlist_dst_size);
4727 
4728 	if (error == 0) {
4729 		error = xcopyout(buf,
4730 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
4731 		    zc->zc_nvlist_dst_size);
4732 	}
4733 	kmem_free(buf, bufsize);
4734 	zfsvfs_rele(zfsvfs, FTAG);
4735 
4736 	return (error);
4737 }
4738 
4739 /*
4740  * inputs:
4741  * zc_name		name of filesystem
4742  *
4743  * outputs:
4744  * none
4745  */
4746 static int
4747 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4748 {
4749 	objset_t *os;
4750 	int error = 0;
4751 	zfsvfs_t *zfsvfs;
4752 
4753 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4754 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4755 			/*
4756 			 * If userused is not enabled, it may be because the
4757 			 * objset needs to be closed & reopened (to grow the
4758 			 * objset_phys_t).  Suspend/resume the fs will do that.
4759 			 */
4760 			error = zfs_suspend_fs(zfsvfs);
4761 			if (error == 0) {
4762 				dmu_objset_refresh_ownership(zfsvfs->z_os,
4763 				    zfsvfs);
4764 				error = zfs_resume_fs(zfsvfs, zc->zc_name);
4765 			}
4766 		}
4767 		if (error == 0)
4768 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4769 		VFS_RELE(zfsvfs->z_vfs);
4770 	} else {
4771 		/* XXX kind of reading contents without owning */
4772 		error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4773 		if (error != 0)
4774 			return (error);
4775 
4776 		error = dmu_objset_userspace_upgrade(os);
4777 		dmu_objset_rele(os, FTAG);
4778 	}
4779 
4780 	return (error);
4781 }
4782 
4783 /*
4784  * We don't want to have a hard dependency
4785  * against some special symbols in sharefs
4786  * nfs, and smbsrv.  Determine them if needed when
4787  * the first file system is shared.
4788  * Neither sharefs, nfs or smbsrv are unloadable modules.
4789  */
4790 int (*znfsexport_fs)(void *arg);
4791 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4792 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4793 
4794 int zfs_nfsshare_inited;
4795 int zfs_smbshare_inited;
4796 
4797 ddi_modhandle_t nfs_mod;
4798 ddi_modhandle_t sharefs_mod;
4799 ddi_modhandle_t smbsrv_mod;
4800 kmutex_t zfs_share_lock;
4801 
4802 static int
4803 zfs_init_sharefs()
4804 {
4805 	int error;
4806 
4807 	ASSERT(MUTEX_HELD(&zfs_share_lock));
4808 	/* Both NFS and SMB shares also require sharetab support. */
4809 	if (sharefs_mod == NULL && ((sharefs_mod =
4810 	    ddi_modopen("fs/sharefs",
4811 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
4812 		return (SET_ERROR(ENOSYS));
4813 	}
4814 	if (zshare_fs == NULL && ((zshare_fs =
4815 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4816 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4817 		return (SET_ERROR(ENOSYS));
4818 	}
4819 	return (0);
4820 }
4821 
4822 static int
4823 zfs_ioc_share(zfs_cmd_t *zc)
4824 {
4825 	int error;
4826 	int opcode;
4827 
4828 	switch (zc->zc_share.z_sharetype) {
4829 	case ZFS_SHARE_NFS:
4830 	case ZFS_UNSHARE_NFS:
4831 		if (zfs_nfsshare_inited == 0) {
4832 			mutex_enter(&zfs_share_lock);
4833 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4834 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4835 				mutex_exit(&zfs_share_lock);
4836 				return (SET_ERROR(ENOSYS));
4837 			}
4838 			if (znfsexport_fs == NULL &&
4839 			    ((znfsexport_fs = (int (*)(void *))
4840 			    ddi_modsym(nfs_mod,
4841 			    "nfs_export", &error)) == NULL)) {
4842 				mutex_exit(&zfs_share_lock);
4843 				return (SET_ERROR(ENOSYS));
4844 			}
4845 			error = zfs_init_sharefs();
4846 			if (error != 0) {
4847 				mutex_exit(&zfs_share_lock);
4848 				return (SET_ERROR(ENOSYS));
4849 			}
4850 			zfs_nfsshare_inited = 1;
4851 			mutex_exit(&zfs_share_lock);
4852 		}
4853 		break;
4854 	case ZFS_SHARE_SMB:
4855 	case ZFS_UNSHARE_SMB:
4856 		if (zfs_smbshare_inited == 0) {
4857 			mutex_enter(&zfs_share_lock);
4858 			if (smbsrv_mod == NULL && ((smbsrv_mod =
4859 			    ddi_modopen("drv/smbsrv",
4860 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4861 				mutex_exit(&zfs_share_lock);
4862 				return (SET_ERROR(ENOSYS));
4863 			}
4864 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4865 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4866 			    "smb_server_share", &error)) == NULL)) {
4867 				mutex_exit(&zfs_share_lock);
4868 				return (SET_ERROR(ENOSYS));
4869 			}
4870 			error = zfs_init_sharefs();
4871 			if (error != 0) {
4872 				mutex_exit(&zfs_share_lock);
4873 				return (SET_ERROR(ENOSYS));
4874 			}
4875 			zfs_smbshare_inited = 1;
4876 			mutex_exit(&zfs_share_lock);
4877 		}
4878 		break;
4879 	default:
4880 		return (SET_ERROR(EINVAL));
4881 	}
4882 
4883 	switch (zc->zc_share.z_sharetype) {
4884 	case ZFS_SHARE_NFS:
4885 	case ZFS_UNSHARE_NFS:
4886 		if (error =
4887 		    znfsexport_fs((void *)
4888 		    (uintptr_t)zc->zc_share.z_exportdata))
4889 			return (error);
4890 		break;
4891 	case ZFS_SHARE_SMB:
4892 	case ZFS_UNSHARE_SMB:
4893 		if (error = zsmbexport_fs((void *)
4894 		    (uintptr_t)zc->zc_share.z_exportdata,
4895 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
4896 		    B_TRUE: B_FALSE)) {
4897 			return (error);
4898 		}
4899 		break;
4900 	}
4901 
4902 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
4903 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
4904 	    SHAREFS_ADD : SHAREFS_REMOVE;
4905 
4906 	/*
4907 	 * Add or remove share from sharetab
4908 	 */
4909 	error = zshare_fs(opcode,
4910 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
4911 	    zc->zc_share.z_sharemax);
4912 
4913 	return (error);
4914 
4915 }
4916 
4917 ace_t full_access[] = {
4918 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
4919 };
4920 
4921 /*
4922  * inputs:
4923  * zc_name		name of containing filesystem
4924  * zc_obj		object # beyond which we want next in-use object #
4925  *
4926  * outputs:
4927  * zc_obj		next in-use object #
4928  */
4929 static int
4930 zfs_ioc_next_obj(zfs_cmd_t *zc)
4931 {
4932 	objset_t *os = NULL;
4933 	int error;
4934 
4935 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4936 	if (error != 0)
4937 		return (error);
4938 
4939 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
4940 	    dsl_dataset_phys(os->os_dsl_dataset)->ds_prev_snap_txg);
4941 
4942 	dmu_objset_rele(os, FTAG);
4943 	return (error);
4944 }
4945 
4946 /*
4947  * inputs:
4948  * zc_name		name of filesystem
4949  * zc_value		prefix name for snapshot
4950  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
4951  *
4952  * outputs:
4953  * zc_value		short name of new snapshot
4954  */
4955 static int
4956 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
4957 {
4958 	char *snap_name;
4959 	char *hold_name;
4960 	int error;
4961 	minor_t minor;
4962 
4963 	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
4964 	if (error != 0)
4965 		return (error);
4966 
4967 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
4968 	    (u_longlong_t)ddi_get_lbolt64());
4969 	hold_name = kmem_asprintf("%%%s", zc->zc_value);
4970 
4971 	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
4972 	    hold_name);
4973 	if (error == 0)
4974 		(void) strcpy(zc->zc_value, snap_name);
4975 	strfree(snap_name);
4976 	strfree(hold_name);
4977 	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
4978 	return (error);
4979 }
4980 
4981 /*
4982  * inputs:
4983  * zc_name		name of "to" snapshot
4984  * zc_value		name of "from" snapshot
4985  * zc_cookie		file descriptor to write diff data on
4986  *
4987  * outputs:
4988  * dmu_diff_record_t's to the file descriptor
4989  */
4990 static int
4991 zfs_ioc_diff(zfs_cmd_t *zc)
4992 {
4993 	file_t *fp;
4994 	offset_t off;
4995 	int error;
4996 
4997 	fp = getf(zc->zc_cookie);
4998 	if (fp == NULL)
4999 		return (SET_ERROR(EBADF));
5000 
5001 	off = fp->f_offset;
5002 
5003 	error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
5004 
5005 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5006 		fp->f_offset = off;
5007 	releasef(zc->zc_cookie);
5008 
5009 	return (error);
5010 }
5011 
5012 /*
5013  * Remove all ACL files in shares dir
5014  */
5015 static int
5016 zfs_smb_acl_purge(znode_t *dzp)
5017 {
5018 	zap_cursor_t	zc;
5019 	zap_attribute_t	zap;
5020 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
5021 	int error;
5022 
5023 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
5024 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
5025 	    zap_cursor_advance(&zc)) {
5026 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
5027 		    NULL, 0)) != 0)
5028 			break;
5029 	}
5030 	zap_cursor_fini(&zc);
5031 	return (error);
5032 }
5033 
5034 static int
5035 zfs_ioc_smb_acl(zfs_cmd_t *zc)
5036 {
5037 	vnode_t *vp;
5038 	znode_t *dzp;
5039 	vnode_t *resourcevp = NULL;
5040 	znode_t *sharedir;
5041 	zfsvfs_t *zfsvfs;
5042 	nvlist_t *nvlist;
5043 	char *src, *target;
5044 	vattr_t vattr;
5045 	vsecattr_t vsec;
5046 	int error = 0;
5047 
5048 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
5049 	    NO_FOLLOW, NULL, &vp)) != 0)
5050 		return (error);
5051 
5052 	/* Now make sure mntpnt and dataset are ZFS */
5053 
5054 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
5055 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
5056 	    zc->zc_name) != 0)) {
5057 		VN_RELE(vp);
5058 		return (SET_ERROR(EINVAL));
5059 	}
5060 
5061 	dzp = VTOZ(vp);
5062 	zfsvfs = dzp->z_zfsvfs;
5063 	ZFS_ENTER(zfsvfs);
5064 
5065 	/*
5066 	 * Create share dir if its missing.
5067 	 */
5068 	mutex_enter(&zfsvfs->z_lock);
5069 	if (zfsvfs->z_shares_dir == 0) {
5070 		dmu_tx_t *tx;
5071 
5072 		tx = dmu_tx_create(zfsvfs->z_os);
5073 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
5074 		    ZFS_SHARES_DIR);
5075 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
5076 		error = dmu_tx_assign(tx, TXG_WAIT);
5077 		if (error != 0) {
5078 			dmu_tx_abort(tx);
5079 		} else {
5080 			error = zfs_create_share_dir(zfsvfs, tx);
5081 			dmu_tx_commit(tx);
5082 		}
5083 		if (error != 0) {
5084 			mutex_exit(&zfsvfs->z_lock);
5085 			VN_RELE(vp);
5086 			ZFS_EXIT(zfsvfs);
5087 			return (error);
5088 		}
5089 	}
5090 	mutex_exit(&zfsvfs->z_lock);
5091 
5092 	ASSERT(zfsvfs->z_shares_dir);
5093 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
5094 		VN_RELE(vp);
5095 		ZFS_EXIT(zfsvfs);
5096 		return (error);
5097 	}
5098 
5099 	switch (zc->zc_cookie) {
5100 	case ZFS_SMB_ACL_ADD:
5101 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
5102 		vattr.va_type = VREG;
5103 		vattr.va_mode = S_IFREG|0777;
5104 		vattr.va_uid = 0;
5105 		vattr.va_gid = 0;
5106 
5107 		vsec.vsa_mask = VSA_ACE;
5108 		vsec.vsa_aclentp = &full_access;
5109 		vsec.vsa_aclentsz = sizeof (full_access);
5110 		vsec.vsa_aclcnt = 1;
5111 
5112 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
5113 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
5114 		if (resourcevp)
5115 			VN_RELE(resourcevp);
5116 		break;
5117 
5118 	case ZFS_SMB_ACL_REMOVE:
5119 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
5120 		    NULL, 0);
5121 		break;
5122 
5123 	case ZFS_SMB_ACL_RENAME:
5124 		if ((error = get_nvlist(zc->zc_nvlist_src,
5125 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
5126 			VN_RELE(vp);
5127 			ZFS_EXIT(zfsvfs);
5128 			return (error);
5129 		}
5130 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
5131 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
5132 		    &target)) {
5133 			VN_RELE(vp);
5134 			VN_RELE(ZTOV(sharedir));
5135 			ZFS_EXIT(zfsvfs);
5136 			nvlist_free(nvlist);
5137 			return (error);
5138 		}
5139 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
5140 		    kcred, NULL, 0);
5141 		nvlist_free(nvlist);
5142 		break;
5143 
5144 	case ZFS_SMB_ACL_PURGE:
5145 		error = zfs_smb_acl_purge(sharedir);
5146 		break;
5147 
5148 	default:
5149 		error = SET_ERROR(EINVAL);
5150 		break;
5151 	}
5152 
5153 	VN_RELE(vp);
5154 	VN_RELE(ZTOV(sharedir));
5155 
5156 	ZFS_EXIT(zfsvfs);
5157 
5158 	return (error);
5159 }
5160 
5161 /*
5162  * innvl: {
5163  *     "holds" -> { snapname -> holdname (string), ... }
5164  *     (optional) "cleanup_fd" -> fd (int32)
5165  * }
5166  *
5167  * outnvl: {
5168  *     snapname -> error value (int32)
5169  *     ...
5170  * }
5171  */
5172 /* ARGSUSED */
5173 static int
5174 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
5175 {
5176 	nvpair_t *pair;
5177 	nvlist_t *holds;
5178 	int cleanup_fd = -1;
5179 	int error;
5180 	minor_t minor = 0;
5181 
5182 	error = nvlist_lookup_nvlist(args, "holds", &holds);
5183 	if (error != 0)
5184 		return (SET_ERROR(EINVAL));
5185 
5186 	/* make sure the user didn't pass us any invalid (empty) tags */
5187 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
5188 	    pair = nvlist_next_nvpair(holds, pair)) {
5189 		char *htag;
5190 
5191 		error = nvpair_value_string(pair, &htag);
5192 		if (error != 0)
5193 			return (SET_ERROR(error));
5194 
5195 		if (strlen(htag) == 0)
5196 			return (SET_ERROR(EINVAL));
5197 	}
5198 
5199 	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
5200 		error = zfs_onexit_fd_hold(cleanup_fd, &minor);
5201 		if (error != 0)
5202 			return (error);
5203 	}
5204 
5205 	error = dsl_dataset_user_hold(holds, minor, errlist);
5206 	if (minor != 0)
5207 		zfs_onexit_fd_rele(cleanup_fd);
5208 	return (error);
5209 }
5210 
5211 /*
5212  * innvl is not used.
5213  *
5214  * outnvl: {
5215  *    holdname -> time added (uint64 seconds since epoch)
5216  *    ...
5217  * }
5218  */
5219 /* ARGSUSED */
5220 static int
5221 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
5222 {
5223 	return (dsl_dataset_get_holds(snapname, outnvl));
5224 }
5225 
5226 /*
5227  * innvl: {
5228  *     snapname -> { holdname, ... }
5229  *     ...
5230  * }
5231  *
5232  * outnvl: {
5233  *     snapname -> error value (int32)
5234  *     ...
5235  * }
5236  */
5237 /* ARGSUSED */
5238 static int
5239 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
5240 {
5241 	return (dsl_dataset_user_release(holds, errlist));
5242 }
5243 
5244 /*
5245  * inputs:
5246  * zc_name		name of new filesystem or snapshot
5247  * zc_value		full name of old snapshot
5248  *
5249  * outputs:
5250  * zc_cookie		space in bytes
5251  * zc_objset_type	compressed space in bytes
5252  * zc_perm_action	uncompressed space in bytes
5253  */
5254 static int
5255 zfs_ioc_space_written(zfs_cmd_t *zc)
5256 {
5257 	int error;
5258 	dsl_pool_t *dp;
5259 	dsl_dataset_t *new, *old;
5260 
5261 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5262 	if (error != 0)
5263 		return (error);
5264 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
5265 	if (error != 0) {
5266 		dsl_pool_rele(dp, FTAG);
5267 		return (error);
5268 	}
5269 	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
5270 	if (error != 0) {
5271 		dsl_dataset_rele(new, FTAG);
5272 		dsl_pool_rele(dp, FTAG);
5273 		return (error);
5274 	}
5275 
5276 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5277 	    &zc->zc_objset_type, &zc->zc_perm_action);
5278 	dsl_dataset_rele(old, FTAG);
5279 	dsl_dataset_rele(new, FTAG);
5280 	dsl_pool_rele(dp, FTAG);
5281 	return (error);
5282 }
5283 
5284 /*
5285  * innvl: {
5286  *     "firstsnap" -> snapshot name
5287  * }
5288  *
5289  * outnvl: {
5290  *     "used" -> space in bytes
5291  *     "compressed" -> compressed space in bytes
5292  *     "uncompressed" -> uncompressed space in bytes
5293  * }
5294  */
5295 static int
5296 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5297 {
5298 	int error;
5299 	dsl_pool_t *dp;
5300 	dsl_dataset_t *new, *old;
5301 	char *firstsnap;
5302 	uint64_t used, comp, uncomp;
5303 
5304 	if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5305 		return (SET_ERROR(EINVAL));
5306 
5307 	error = dsl_pool_hold(lastsnap, FTAG, &dp);
5308 	if (error != 0)
5309 		return (error);
5310 
5311 	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
5312 	if (error == 0 && !new->ds_is_snapshot) {
5313 		dsl_dataset_rele(new, FTAG);
5314 		error = SET_ERROR(EINVAL);
5315 	}
5316 	if (error != 0) {
5317 		dsl_pool_rele(dp, FTAG);
5318 		return (error);
5319 	}
5320 	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
5321 	if (error == 0 && !old->ds_is_snapshot) {
5322 		dsl_dataset_rele(old, FTAG);
5323 		error = SET_ERROR(EINVAL);
5324 	}
5325 	if (error != 0) {
5326 		dsl_dataset_rele(new, FTAG);
5327 		dsl_pool_rele(dp, FTAG);
5328 		return (error);
5329 	}
5330 
5331 	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5332 	dsl_dataset_rele(old, FTAG);
5333 	dsl_dataset_rele(new, FTAG);
5334 	dsl_pool_rele(dp, FTAG);
5335 	fnvlist_add_uint64(outnvl, "used", used);
5336 	fnvlist_add_uint64(outnvl, "compressed", comp);
5337 	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5338 	return (error);
5339 }
5340 
5341 /*
5342  * innvl: {
5343  *     "fd" -> file descriptor to write stream to (int32)
5344  *     (optional) "fromsnap" -> full snap name to send an incremental from
5345  *     (optional) "largeblockok" -> (value ignored)
5346  *         indicates that blocks > 128KB are permitted
5347  *     (optional) "embedok" -> (value ignored)
5348  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
5349  *     (optional) "resume_object" and "resume_offset" -> (uint64)
5350  *         if present, resume send stream from specified object and offset.
5351  * }
5352  *
5353  * outnvl is unused
5354  */
5355 /* ARGSUSED */
5356 static int
5357 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5358 {
5359 	int error;
5360 	offset_t off;
5361 	char *fromname = NULL;
5362 	int fd;
5363 	boolean_t largeblockok;
5364 	boolean_t embedok;
5365 	uint64_t resumeobj = 0;
5366 	uint64_t resumeoff = 0;
5367 
5368 	error = nvlist_lookup_int32(innvl, "fd", &fd);
5369 	if (error != 0)
5370 		return (SET_ERROR(EINVAL));
5371 
5372 	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
5373 
5374 	largeblockok = nvlist_exists(innvl, "largeblockok");
5375 	embedok = nvlist_exists(innvl, "embedok");
5376 
5377 	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
5378 	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
5379 
5380 	file_t *fp = getf(fd);
5381 	if (fp == NULL)
5382 		return (SET_ERROR(EBADF));
5383 
5384 	off = fp->f_offset;
5385 	error = dmu_send(snapname, fromname, embedok, largeblockok, fd,
5386 	    resumeobj, resumeoff, fp->f_vnode, &off);
5387 
5388 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5389 		fp->f_offset = off;
5390 	releasef(fd);
5391 	return (error);
5392 }
5393 
5394 /*
5395  * Determine approximately how large a zfs send stream will be -- the number
5396  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5397  *
5398  * innvl: {
5399  *     (optional) "from" -> full snap or bookmark name to send an incremental
5400  *                          from
5401  * }
5402  *
5403  * outnvl: {
5404  *     "space" -> bytes of space (uint64)
5405  * }
5406  */
5407 static int
5408 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5409 {
5410 	dsl_pool_t *dp;
5411 	dsl_dataset_t *tosnap;
5412 	int error;
5413 	char *fromname;
5414 	uint64_t space;
5415 
5416 	error = dsl_pool_hold(snapname, FTAG, &dp);
5417 	if (error != 0)
5418 		return (error);
5419 
5420 	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
5421 	if (error != 0) {
5422 		dsl_pool_rele(dp, FTAG);
5423 		return (error);
5424 	}
5425 
5426 	error = nvlist_lookup_string(innvl, "from", &fromname);
5427 	if (error == 0) {
5428 		if (strchr(fromname, '@') != NULL) {
5429 			/*
5430 			 * If from is a snapshot, hold it and use the more
5431 			 * efficient dmu_send_estimate to estimate send space
5432 			 * size using deadlists.
5433 			 */
5434 			dsl_dataset_t *fromsnap;
5435 			error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
5436 			if (error != 0)
5437 				goto out;
5438 			error = dmu_send_estimate(tosnap, fromsnap, &space);
5439 			dsl_dataset_rele(fromsnap, FTAG);
5440 		} else if (strchr(fromname, '#') != NULL) {
5441 			/*
5442 			 * If from is a bookmark, fetch the creation TXG of the
5443 			 * snapshot it was created from and use that to find
5444 			 * blocks that were born after it.
5445 			 */
5446 			zfs_bookmark_phys_t frombm;
5447 
5448 			error = dsl_bookmark_lookup(dp, fromname, tosnap,
5449 			    &frombm);
5450 			if (error != 0)
5451 				goto out;
5452 			error = dmu_send_estimate_from_txg(tosnap,
5453 			    frombm.zbm_creation_txg, &space);
5454 		} else {
5455 			/*
5456 			 * from is not properly formatted as a snapshot or
5457 			 * bookmark
5458 			 */
5459 			error = SET_ERROR(EINVAL);
5460 			goto out;
5461 		}
5462 	} else {
5463 		// If estimating the size of a full send, use dmu_send_estimate
5464 		error = dmu_send_estimate(tosnap, NULL, &space);
5465 	}
5466 
5467 	fnvlist_add_uint64(outnvl, "space", space);
5468 
5469 out:
5470 	dsl_dataset_rele(tosnap, FTAG);
5471 	dsl_pool_rele(dp, FTAG);
5472 	return (error);
5473 }
5474 
5475 static int
5476 zfs_ioc_set_zev_callbacks(const char *unused, nvlist_t *innvl,
5477     nvlist_t *outnvl)
5478 {
5479 	int error;
5480 	uint64_t cb_addr;
5481 	/*
5482 	 * Our secpolicy for this op makes sure it's called in
5483 	 * kernel context, and that no other callbacks have
5484 	 * been registered, yet.
5485 	 */
5486 	error = nvlist_lookup_uint64(innvl, "callbacks", &cb_addr);
5487 	if (error != 0) {
5488 		cmn_err(CE_WARN, "set_zev_callbacks nvlist lookup failed (%d)",
5489 		    error);
5490 		return (error);
5491 	}
5492 	/* cb_addr is always a kernel memory address */
5493 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5494 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
5495 		rw_exit(&rz_zev_rwlock);
5496 		return (EBUSY);
5497 	}
5498 	rz_zev_callbacks = (void *)(uintptr_t)cb_addr;
5499 	rw_exit(&rz_zev_rwlock);
5500 	return (0);
5501 }
5502 
5503 static int
5504 zfs_ioc_unset_zev_callbacks(const char *unused, nvlist_t *innvl,
5505     nvlist_t *outnvl)
5506 {
5507 	/*
5508 	 * Our secpolicy for this op makes sure it's called in
5509 	 * kernel context.
5510 	 */
5511 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5512 	rz_zev_callbacks = rz_zev_default_callbacks;
5513 	rw_exit(&rz_zev_rwlock);
5514 	/* after mutex release, no thread is using the old table anymore. */
5515 	return (0);
5516 }
5517 
5518 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5519 
5520 static void
5521 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5522     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5523     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5524 {
5525 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5526 
5527 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5528 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5529 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5530 	ASSERT3P(vec->zvec_func, ==, NULL);
5531 
5532 	vec->zvec_legacy_func = func;
5533 	vec->zvec_secpolicy = secpolicy;
5534 	vec->zvec_namecheck = namecheck;
5535 	vec->zvec_allow_log = log_history;
5536 	vec->zvec_pool_check = pool_check;
5537 }
5538 
5539 /*
5540  * See the block comment at the beginning of this file for details on
5541  * each argument to this function.
5542  */
5543 static void
5544 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5545     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5546     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5547     boolean_t allow_log)
5548 {
5549 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5550 
5551 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5552 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5553 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5554 	ASSERT3P(vec->zvec_func, ==, NULL);
5555 
5556 	/* if we are logging, the name must be valid */
5557 	ASSERT(!allow_log || namecheck != NO_NAME);
5558 
5559 	vec->zvec_name = name;
5560 	vec->zvec_func = func;
5561 	vec->zvec_secpolicy = secpolicy;
5562 	vec->zvec_namecheck = namecheck;
5563 	vec->zvec_pool_check = pool_check;
5564 	vec->zvec_smush_outnvlist = smush_outnvlist;
5565 	vec->zvec_allow_log = allow_log;
5566 }
5567 
5568 static void
5569 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5570     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5571     zfs_ioc_poolcheck_t pool_check)
5572 {
5573 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5574 	    POOL_NAME, log_history, pool_check);
5575 }
5576 
5577 static void
5578 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5579     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5580 {
5581 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5582 	    DATASET_NAME, B_FALSE, pool_check);
5583 }
5584 
5585 static void
5586 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5587 {
5588 	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5589 	    POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5590 }
5591 
5592 static void
5593 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5594     zfs_secpolicy_func_t *secpolicy)
5595 {
5596 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5597 	    NO_NAME, B_FALSE, POOL_CHECK_NONE);
5598 }
5599 
5600 static void
5601 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5602     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5603 {
5604 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5605 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5606 }
5607 
5608 static void
5609 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5610 {
5611 	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5612 	    zfs_secpolicy_read);
5613 }
5614 
5615 static void
5616 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5617 	zfs_secpolicy_func_t *secpolicy)
5618 {
5619 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5620 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5621 }
5622 
5623 static void
5624 zfs_ioctl_init(void)
5625 {
5626 	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5627 	    zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5628 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5629 
5630 	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5631 	    zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5632 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5633 
5634 	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5635 	    zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5636 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5637 
5638 	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5639 	    zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5640 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5641 
5642 	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5643 	    zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5644 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5645 
5646 	zfs_ioctl_register("create", ZFS_IOC_CREATE,
5647 	    zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5648 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5649 
5650 	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5651 	    zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5652 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5653 
5654 	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5655 	    zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5656 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5657 
5658 	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
5659 	    zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
5660 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5661 	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
5662 	    zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
5663 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5664 
5665 	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
5666 	    zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
5667 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5668 
5669 	zfs_ioctl_register("set_zev_callbacks", ZFS_IOC_SET_ZEV_CALLBACKS,
5670 	    zfs_ioc_set_zev_callbacks, zfs_secpolicy_set_zev_callbacks, NO_NAME,
5671 	    POOL_CHECK_NONE, B_TRUE, B_FALSE);
5672 
5673 	zfs_ioctl_register("unset_zev_callbacks", ZFS_IOC_UNSET_ZEV_CALLBACKS,
5674 	    zfs_ioc_unset_zev_callbacks, zfs_secpolicy_unset_zev_callbacks,
5675 	    NO_NAME, POOL_CHECK_NONE, B_TRUE, B_FALSE);
5676 	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
5677 	    zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
5678 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE);
5679 
5680 	zfs_ioctl_register("bookmark", ZFS_IOC_BOOKMARK,
5681 	    zfs_ioc_bookmark, zfs_secpolicy_bookmark, POOL_NAME,
5682 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5683 
5684 	zfs_ioctl_register("get_bookmarks", ZFS_IOC_GET_BOOKMARKS,
5685 	    zfs_ioc_get_bookmarks, zfs_secpolicy_read, DATASET_NAME,
5686 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5687 
5688 	zfs_ioctl_register("destroy_bookmarks", ZFS_IOC_DESTROY_BOOKMARKS,
5689 	    zfs_ioc_destroy_bookmarks, zfs_secpolicy_destroy_bookmarks,
5690 	    POOL_NAME,
5691 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5692 
5693 	/* IOCTLS that use the legacy function signature */
5694 
5695 	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5696 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5697 
5698 	zfs_ioctl_register_legacy(ZFS_IOC_ARC_INFO, zfs_ioc_arc_info,
5699 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_NONE);
5700 
5701 	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5702 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5703 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5704 	    zfs_ioc_pool_scan);
5705 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5706 	    zfs_ioc_pool_upgrade);
5707 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5708 	    zfs_ioc_vdev_add);
5709 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5710 	    zfs_ioc_vdev_remove);
5711 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5712 	    zfs_ioc_vdev_set_state);
5713 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5714 	    zfs_ioc_vdev_attach);
5715 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5716 	    zfs_ioc_vdev_detach);
5717 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5718 	    zfs_ioc_vdev_setpath);
5719 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5720 	    zfs_ioc_vdev_setfru);
5721 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5722 	    zfs_ioc_pool_set_props);
5723 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5724 	    zfs_ioc_vdev_split);
5725 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5726 	    zfs_ioc_pool_reguid);
5727 
5728 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5729 	    zfs_ioc_pool_configs, zfs_secpolicy_none);
5730 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5731 	    zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5732 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5733 	    zfs_ioc_inject_fault, zfs_secpolicy_inject);
5734 	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5735 	    zfs_ioc_clear_fault, zfs_secpolicy_inject);
5736 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5737 	    zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5738 
5739 	/*
5740 	 * pool destroy, and export don't log the history as part of
5741 	 * zfsdev_ioctl, but rather zfs_ioc_pool_export
5742 	 * does the logging of those commands.
5743 	 */
5744 	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5745 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5746 	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5747 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5748 
5749 	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5750 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5751 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5752 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5753 
5754 	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5755 	    zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5756 	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5757 	    zfs_ioc_dsobj_to_dsname,
5758 	    zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5759 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5760 	    zfs_ioc_pool_get_history,
5761 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5762 
5763 	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5764 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5765 
5766 	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5767 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5768 	zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5769 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5770 
5771 	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5772 	    zfs_ioc_space_written);
5773 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5774 	    zfs_ioc_objset_recvd_props);
5775 	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5776 	    zfs_ioc_next_obj);
5777 	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5778 	    zfs_ioc_get_fsacl);
5779 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5780 	    zfs_ioc_objset_stats);
5781 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5782 	    zfs_ioc_objset_zplprops);
5783 	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5784 	    zfs_ioc_dataset_list_next);
5785 	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5786 	    zfs_ioc_snapshot_list_next);
5787 	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5788 	    zfs_ioc_send_progress);
5789 
5790 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5791 	    zfs_ioc_diff, zfs_secpolicy_diff);
5792 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5793 	    zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5794 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5795 	    zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5796 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5797 	    zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5798 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5799 	    zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5800 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5801 	    zfs_ioc_send, zfs_secpolicy_send);
5802 
5803 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5804 	    zfs_secpolicy_none);
5805 	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5806 	    zfs_secpolicy_destroy);
5807 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5808 	    zfs_secpolicy_rename);
5809 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5810 	    zfs_secpolicy_recv);
5811 	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5812 	    zfs_secpolicy_promote);
5813 	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5814 	    zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5815 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5816 	    zfs_secpolicy_set_fsacl);
5817 
5818 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5819 	    zfs_secpolicy_share, POOL_CHECK_NONE);
5820 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5821 	    zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5822 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5823 	    zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5824 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5825 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5826 	    zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5827 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5828 }
5829 
5830 int
5831 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5832     zfs_ioc_poolcheck_t check)
5833 {
5834 	spa_t *spa;
5835 	int error;
5836 
5837 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
5838 
5839 	if (check & POOL_CHECK_NONE)
5840 		return (0);
5841 
5842 	error = spa_open(name, &spa, FTAG);
5843 	if (error == 0) {
5844 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5845 			error = SET_ERROR(EAGAIN);
5846 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5847 			error = SET_ERROR(EROFS);
5848 		spa_close(spa, FTAG);
5849 	}
5850 	return (error);
5851 }
5852 
5853 /*
5854  * Find a free minor number.
5855  */
5856 minor_t
5857 zfsdev_minor_alloc(void)
5858 {
5859 	static minor_t last_minor;
5860 	minor_t m;
5861 
5862 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5863 
5864 	for (m = last_minor + 1; m != last_minor; m++) {
5865 		if (m > ZFSDEV_MAX_MINOR)
5866 			m = 1;
5867 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5868 			last_minor = m;
5869 			return (m);
5870 		}
5871 	}
5872 
5873 	return (0);
5874 }
5875 
5876 static int
5877 zfs_ctldev_init(dev_t *devp)
5878 {
5879 	minor_t minor;
5880 	zfs_soft_state_t *zs;
5881 
5882 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5883 	ASSERT(getminor(*devp) == 0);
5884 
5885 	minor = zfsdev_minor_alloc();
5886 	if (minor == 0)
5887 		return (SET_ERROR(ENXIO));
5888 
5889 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5890 		return (SET_ERROR(EAGAIN));
5891 
5892 	*devp = makedevice(getemajor(*devp), minor);
5893 
5894 	zs = ddi_get_soft_state(zfsdev_state, minor);
5895 	zs->zss_type = ZSST_CTLDEV;
5896 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
5897 
5898 	return (0);
5899 }
5900 
5901 static void
5902 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
5903 {
5904 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5905 
5906 	zfs_onexit_destroy(zo);
5907 	ddi_soft_state_free(zfsdev_state, minor);
5908 }
5909 
5910 void *
5911 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
5912 {
5913 	zfs_soft_state_t *zp;
5914 
5915 	zp = ddi_get_soft_state(zfsdev_state, minor);
5916 	if (zp == NULL || zp->zss_type != which)
5917 		return (NULL);
5918 
5919 	return (zp->zss_data);
5920 }
5921 
5922 static int
5923 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
5924 {
5925 	int error = 0;
5926 
5927 	if (getminor(*devp) != 0)
5928 		return (zvol_open(devp, flag, otyp, cr));
5929 
5930 	/* This is the control device. Allocate a new minor if requested. */
5931 	if (flag & FEXCL) {
5932 		mutex_enter(&zfsdev_state_lock);
5933 		error = zfs_ctldev_init(devp);
5934 		mutex_exit(&zfsdev_state_lock);
5935 	}
5936 
5937 	return (error);
5938 }
5939 
5940 static int
5941 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
5942 {
5943 	zfs_onexit_t *zo;
5944 	minor_t minor = getminor(dev);
5945 
5946 	if (minor == 0)
5947 		return (0);
5948 
5949 	mutex_enter(&zfsdev_state_lock);
5950 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
5951 	if (zo == NULL) {
5952 		mutex_exit(&zfsdev_state_lock);
5953 		return (zvol_close(dev, flag, otyp, cr));
5954 	}
5955 	zfs_ctldev_destroy(zo, minor);
5956 	mutex_exit(&zfsdev_state_lock);
5957 
5958 	return (0);
5959 }
5960 
5961 static int
5962 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
5963 {
5964 	zfs_cmd_t *zc;
5965 	uint_t vecnum;
5966 	int error, rc, len;
5967 	minor_t minor = getminor(dev);
5968 	const zfs_ioc_vec_t *vec;
5969 	char *saved_poolname = NULL;
5970 	nvlist_t *innvl = NULL;
5971 
5972 	if (minor != 0 &&
5973 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
5974 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
5975 
5976 	vecnum = cmd - ZFS_IOC_FIRST;
5977 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
5978 
5979 	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
5980 		return (SET_ERROR(EINVAL));
5981 	vec = &zfs_ioc_vec[vecnum];
5982 
5983 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
5984 
5985 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
5986 	if (error != 0) {
5987 		error = SET_ERROR(EFAULT);
5988 		goto out;
5989 	}
5990 
5991 	zc->zc_iflags = flag & FKIOCTL;
5992 	if (zc->zc_nvlist_src_size != 0) {
5993 		error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
5994 		    zc->zc_iflags, &innvl);
5995 		if (error != 0)
5996 			goto out;
5997 	}
5998 
5999 	/*
6000 	 * Ensure that all pool/dataset names are valid before we pass down to
6001 	 * the lower layers.
6002 	 */
6003 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
6004 	switch (vec->zvec_namecheck) {
6005 	case POOL_NAME:
6006 		if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
6007 			error = SET_ERROR(EINVAL);
6008 		else
6009 			error = pool_status_check(zc->zc_name,
6010 			    vec->zvec_namecheck, vec->zvec_pool_check);
6011 		break;
6012 
6013 	case DATASET_NAME:
6014 		if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
6015 			error = SET_ERROR(EINVAL);
6016 		else
6017 			error = pool_status_check(zc->zc_name,
6018 			    vec->zvec_namecheck, vec->zvec_pool_check);
6019 		break;
6020 
6021 	case NO_NAME:
6022 		break;
6023 	}
6024 
6025 
6026 	if (error == 0 && !(flag & FKIOCTL))
6027 		error = vec->zvec_secpolicy(zc, innvl, cr);
6028 
6029 	if (error != 0)
6030 		goto out;
6031 
6032 	/* legacy ioctls can modify zc_name */
6033 	len = strcspn(zc->zc_name, "/@#") + 1;
6034 	saved_poolname = kmem_alloc(len, KM_SLEEP);
6035 	(void) strlcpy(saved_poolname, zc->zc_name, len);
6036 
6037 	if (vec->zvec_func != NULL) {
6038 		nvlist_t *outnvl;
6039 		int puterror = 0;
6040 		spa_t *spa;
6041 		nvlist_t *lognv = NULL;
6042 
6043 		ASSERT(vec->zvec_legacy_func == NULL);
6044 
6045 		/*
6046 		 * Add the innvl to the lognv before calling the func,
6047 		 * in case the func changes the innvl.
6048 		 */
6049 		if (vec->zvec_allow_log) {
6050 			lognv = fnvlist_alloc();
6051 			fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
6052 			    vec->zvec_name);
6053 			if (!nvlist_empty(innvl)) {
6054 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
6055 				    innvl);
6056 			}
6057 		}
6058 
6059 		outnvl = fnvlist_alloc();
6060 		error = vec->zvec_func(zc->zc_name, innvl, outnvl);
6061 
6062 		if (error == 0 && vec->zvec_allow_log &&
6063 		    spa_open(zc->zc_name, &spa, FTAG) == 0) {
6064 			if (!nvlist_empty(outnvl)) {
6065 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
6066 				    outnvl);
6067 			}
6068 			(void) spa_history_log_nvl(spa, lognv);
6069 			spa_close(spa, FTAG);
6070 		}
6071 		fnvlist_free(lognv);
6072 
6073 		if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
6074 			int smusherror = 0;
6075 			if (vec->zvec_smush_outnvlist) {
6076 				smusherror = nvlist_smush(outnvl,
6077 				    zc->zc_nvlist_dst_size);
6078 			}
6079 			if (smusherror == 0)
6080 				puterror = put_nvlist(zc, outnvl);
6081 		}
6082 
6083 		if (puterror != 0)
6084 			error = puterror;
6085 
6086 		nvlist_free(outnvl);
6087 	} else {
6088 		error = vec->zvec_legacy_func(zc);
6089 	}
6090 
6091 out:
6092 	nvlist_free(innvl);
6093 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
6094 	if (error == 0 && rc != 0)
6095 		error = SET_ERROR(EFAULT);
6096 	if (error == 0 && vec->zvec_allow_log) {
6097 		char *s = tsd_get(zfs_allow_log_key);
6098 		if (s != NULL)
6099 			strfree(s);
6100 		(void) tsd_set(zfs_allow_log_key, saved_poolname);
6101 	} else {
6102 		if (saved_poolname != NULL)
6103 			strfree(saved_poolname);
6104 	}
6105 
6106 	kmem_free(zc, sizeof (zfs_cmd_t));
6107 	return (error);
6108 }
6109 
6110 static int
6111 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
6112 {
6113 	if (cmd != DDI_ATTACH)
6114 		return (DDI_FAILURE);
6115 
6116 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
6117 	    DDI_PSEUDO, 0) == DDI_FAILURE)
6118 		return (DDI_FAILURE);
6119 
6120 	zfs_dip = dip;
6121 
6122 	ddi_report_dev(dip);
6123 
6124 	return (DDI_SUCCESS);
6125 }
6126 
6127 static int
6128 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
6129 {
6130 	if (spa_busy() || zfs_busy() || zvol_busy())
6131 		return (DDI_FAILURE);
6132 
6133 	if (cmd != DDI_DETACH)
6134 		return (DDI_FAILURE);
6135 
6136 	zfs_dip = NULL;
6137 
6138 	ddi_prop_remove_all(dip);
6139 	ddi_remove_minor_node(dip, NULL);
6140 
6141 	return (DDI_SUCCESS);
6142 }
6143 
6144 /*ARGSUSED*/
6145 static int
6146 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
6147 {
6148 	switch (infocmd) {
6149 	case DDI_INFO_DEVT2DEVINFO:
6150 		*result = zfs_dip;
6151 		return (DDI_SUCCESS);
6152 
6153 	case DDI_INFO_DEVT2INSTANCE:
6154 		*result = (void *)0;
6155 		return (DDI_SUCCESS);
6156 	}
6157 
6158 	return (DDI_FAILURE);
6159 }
6160 
6161 /*
6162  * OK, so this is a little weird.
6163  *
6164  * /dev/zfs is the control node, i.e. minor 0.
6165  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
6166  *
6167  * /dev/zfs has basically nothing to do except serve up ioctls,
6168  * so most of the standard driver entry points are in zvol.c.
6169  */
6170 static struct cb_ops zfs_cb_ops = {
6171 	zfsdev_open,	/* open */
6172 	zfsdev_close,	/* close */
6173 	zvol_strategy,	/* strategy */
6174 	nodev,		/* print */
6175 	zvol_dump,	/* dump */
6176 	zvol_read,	/* read */
6177 	zvol_write,	/* write */
6178 	zfsdev_ioctl,	/* ioctl */
6179 	nodev,		/* devmap */
6180 	nodev,		/* mmap */
6181 	nodev,		/* segmap */
6182 	nochpoll,	/* poll */
6183 	ddi_prop_op,	/* prop_op */
6184 	NULL,		/* streamtab */
6185 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
6186 	CB_REV,		/* version */
6187 	nodev,		/* async read */
6188 	nodev,		/* async write */
6189 };
6190 
6191 static struct dev_ops zfs_dev_ops = {
6192 	DEVO_REV,	/* version */
6193 	0,		/* refcnt */
6194 	zfs_info,	/* info */
6195 	nulldev,	/* identify */
6196 	nulldev,	/* probe */
6197 	zfs_attach,	/* attach */
6198 	zfs_detach,	/* detach */
6199 	nodev,		/* reset */
6200 	&zfs_cb_ops,	/* driver operations */
6201 	NULL,		/* no bus operations */
6202 	NULL,		/* power */
6203 	ddi_quiesce_not_needed,	/* quiesce */
6204 };
6205 
6206 static struct modldrv zfs_modldrv = {
6207 	&mod_driverops,
6208 	"ZFS storage pool",
6209 	&zfs_dev_ops
6210 };
6211 
6212 static struct modlinkage modlinkage = {
6213 	MODREV_1,
6214 	(void *)&zfs_modlfs,
6215 	(void *)&zfs_modldrv,
6216 	NULL
6217 };
6218 
6219 static void
6220 zfs_allow_log_destroy(void *arg)
6221 {
6222 	char *poolname = arg;
6223 	strfree(poolname);
6224 }
6225 
6226 int
6227 _init(void)
6228 {
6229 	int error;
6230 
6231 	spa_init(FREAD | FWRITE);
6232 	zfs_init();
6233 	zvol_init();
6234 	zfs_ioctl_init();
6235 	rz_zev_init();
6236 
6237 	if ((error = mod_install(&modlinkage)) != 0) {
6238 		zvol_fini();
6239 		zfs_fini();
6240 		spa_fini();
6241 		return (error);
6242 	}
6243 
6244 	tsd_create(&zfs_fsyncer_key, NULL);
6245 	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
6246 	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
6247 
6248 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
6249 	ASSERT(error == 0);
6250 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
6251 
6252 	return (0);
6253 }
6254 
6255 int
6256 _fini(void)
6257 {
6258 	int error;
6259 
6260 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
6261 		return (SET_ERROR(EBUSY));
6262 
6263 	if ((error = mod_remove(&modlinkage)) != 0)
6264 		return (error);
6265 
6266 	rz_zev_fini();
6267 	zvol_fini();
6268 	zfs_fini();
6269 	spa_fini();
6270 	if (zfs_nfsshare_inited)
6271 		(void) ddi_modclose(nfs_mod);
6272 	if (zfs_smbshare_inited)
6273 		(void) ddi_modclose(smbsrv_mod);
6274 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
6275 		(void) ddi_modclose(sharefs_mod);
6276 
6277 	tsd_destroy(&zfs_fsyncer_key);
6278 	ldi_ident_release(zfs_li);
6279 	zfs_li = NULL;
6280 	mutex_destroy(&zfs_share_lock);
6281 
6282 	return (error);
6283 }
6284 
6285 int
6286 _info(struct modinfo *modinfop)
6287 {
6288 	return (mod_info(&modlinkage, modinfop));
6289 }
6290