xref: /titanic_50/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision d387ac4c164917d885cd84bd1b62647d989033ac)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Portions Copyright 2011 Martin Matuska
24  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
25  * Copyright (c) 2012 by Delphix. All rights reserved.
26  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
27  */
28 
29 #include <sys/types.h>
30 #include <sys/param.h>
31 #include <sys/errno.h>
32 #include <sys/uio.h>
33 #include <sys/buf.h>
34 #include <sys/modctl.h>
35 #include <sys/open.h>
36 #include <sys/file.h>
37 #include <sys/kmem.h>
38 #include <sys/conf.h>
39 #include <sys/cmn_err.h>
40 #include <sys/stat.h>
41 #include <sys/zfs_ioctl.h>
42 #include <sys/zfs_vfsops.h>
43 #include <sys/zfs_znode.h>
44 #include <sys/zap.h>
45 #include <sys/spa.h>
46 #include <sys/spa_impl.h>
47 #include <sys/vdev.h>
48 #include <sys/priv_impl.h>
49 #include <sys/dmu.h>
50 #include <sys/dsl_dir.h>
51 #include <sys/dsl_dataset.h>
52 #include <sys/dsl_prop.h>
53 #include <sys/dsl_deleg.h>
54 #include <sys/dmu_objset.h>
55 #include <sys/dmu_impl.h>
56 #include <sys/ddi.h>
57 #include <sys/sunddi.h>
58 #include <sys/sunldi.h>
59 #include <sys/policy.h>
60 #include <sys/zone.h>
61 #include <sys/nvpair.h>
62 #include <sys/pathname.h>
63 #include <sys/mount.h>
64 #include <sys/sdt.h>
65 #include <sys/fs/zfs.h>
66 #include <sys/zfs_ctldir.h>
67 #include <sys/zfs_dir.h>
68 #include <sys/zfs_onexit.h>
69 #include <sys/zvol.h>
70 #include <sys/dsl_scan.h>
71 #include <sharefs/share.h>
72 #include <sys/dmu_objset.h>
73 
74 #include "zfs_namecheck.h"
75 #include "zfs_prop.h"
76 #include "zfs_deleg.h"
77 #include "zfs_comutil.h"
78 
79 extern struct modlfs zfs_modlfs;
80 
81 extern void zfs_init(void);
82 extern void zfs_fini(void);
83 
84 ldi_ident_t zfs_li = NULL;
85 dev_info_t *zfs_dip;
86 
87 typedef int zfs_ioc_func_t(zfs_cmd_t *);
88 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, cred_t *);
89 
90 typedef enum {
91 	NO_NAME,
92 	POOL_NAME,
93 	DATASET_NAME
94 } zfs_ioc_namecheck_t;
95 
96 typedef enum {
97 	POOL_CHECK_NONE		= 1 << 0,
98 	POOL_CHECK_SUSPENDED	= 1 << 1,
99 	POOL_CHECK_READONLY	= 1 << 2
100 } zfs_ioc_poolcheck_t;
101 
102 typedef struct zfs_ioc_vec {
103 	zfs_ioc_func_t		*zvec_func;
104 	zfs_secpolicy_func_t	*zvec_secpolicy;
105 	zfs_ioc_namecheck_t	zvec_namecheck;
106 	boolean_t		zvec_his_log;
107 	zfs_ioc_poolcheck_t	zvec_pool_check;
108 } zfs_ioc_vec_t;
109 
110 /* This array is indexed by zfs_userquota_prop_t */
111 static const char *userquota_perms[] = {
112 	ZFS_DELEG_PERM_USERUSED,
113 	ZFS_DELEG_PERM_USERQUOTA,
114 	ZFS_DELEG_PERM_GROUPUSED,
115 	ZFS_DELEG_PERM_GROUPQUOTA,
116 };
117 
118 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
119 static int zfs_check_settable(const char *name, nvpair_t *property,
120     cred_t *cr);
121 static int zfs_check_clearable(char *dataset, nvlist_t *props,
122     nvlist_t **errors);
123 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
124     boolean_t *);
125 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t **);
126 
127 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
128 void
129 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
130 {
131 	const char *newfile;
132 	char buf[512];
133 	va_list adx;
134 
135 	/*
136 	 * Get rid of annoying "../common/" prefix to filename.
137 	 */
138 	newfile = strrchr(file, '/');
139 	if (newfile != NULL) {
140 		newfile = newfile + 1; /* Get rid of leading / */
141 	} else {
142 		newfile = file;
143 	}
144 
145 	va_start(adx, fmt);
146 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
147 	va_end(adx);
148 
149 	/*
150 	 * To get this data, use the zfs-dprintf probe as so:
151 	 * dtrace -q -n 'zfs-dprintf \
152 	 *	/stringof(arg0) == "dbuf.c"/ \
153 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
154 	 * arg0 = file name
155 	 * arg1 = function name
156 	 * arg2 = line number
157 	 * arg3 = message
158 	 */
159 	DTRACE_PROBE4(zfs__dprintf,
160 	    char *, newfile, char *, func, int, line, char *, buf);
161 }
162 
163 static void
164 history_str_free(char *buf)
165 {
166 	kmem_free(buf, HIS_MAX_RECORD_LEN);
167 }
168 
169 static char *
170 history_str_get(zfs_cmd_t *zc)
171 {
172 	char *buf;
173 
174 	if (zc->zc_history == NULL)
175 		return (NULL);
176 
177 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
178 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
179 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
180 		history_str_free(buf);
181 		return (NULL);
182 	}
183 
184 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
185 
186 	return (buf);
187 }
188 
189 /*
190  * Check to see if the named dataset is currently defined as bootable
191  */
192 static boolean_t
193 zfs_is_bootfs(const char *name)
194 {
195 	objset_t *os;
196 
197 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
198 		boolean_t ret;
199 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
200 		dmu_objset_rele(os, FTAG);
201 		return (ret);
202 	}
203 	return (B_FALSE);
204 }
205 
206 /*
207  * zfs_earlier_version
208  *
209  *	Return non-zero if the spa version is less than requested version.
210  */
211 static int
212 zfs_earlier_version(const char *name, int version)
213 {
214 	spa_t *spa;
215 
216 	if (spa_open(name, &spa, FTAG) == 0) {
217 		if (spa_version(spa) < version) {
218 			spa_close(spa, FTAG);
219 			return (1);
220 		}
221 		spa_close(spa, FTAG);
222 	}
223 	return (0);
224 }
225 
226 /*
227  * zpl_earlier_version
228  *
229  * Return TRUE if the ZPL version is less than requested version.
230  */
231 static boolean_t
232 zpl_earlier_version(const char *name, int version)
233 {
234 	objset_t *os;
235 	boolean_t rc = B_TRUE;
236 
237 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
238 		uint64_t zplversion;
239 
240 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
241 			dmu_objset_rele(os, FTAG);
242 			return (B_TRUE);
243 		}
244 		/* XXX reading from non-owned objset */
245 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
246 			rc = zplversion < version;
247 		dmu_objset_rele(os, FTAG);
248 	}
249 	return (rc);
250 }
251 
252 static void
253 zfs_log_history(zfs_cmd_t *zc)
254 {
255 	spa_t *spa;
256 	char *buf;
257 
258 	if ((buf = history_str_get(zc)) == NULL)
259 		return;
260 
261 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
262 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
263 			(void) spa_history_log(spa, buf, LOG_CMD_NORMAL);
264 		spa_close(spa, FTAG);
265 	}
266 	history_str_free(buf);
267 }
268 
269 /*
270  * Policy for top-level read operations (list pools).  Requires no privileges,
271  * and can be used in the local zone, as there is no associated dataset.
272  */
273 /* ARGSUSED */
274 static int
275 zfs_secpolicy_none(zfs_cmd_t *zc, cred_t *cr)
276 {
277 	return (0);
278 }
279 
280 /*
281  * Policy for dataset read operations (list children, get statistics).  Requires
282  * no privileges, but must be visible in the local zone.
283  */
284 /* ARGSUSED */
285 static int
286 zfs_secpolicy_read(zfs_cmd_t *zc, cred_t *cr)
287 {
288 	if (INGLOBALZONE(curproc) ||
289 	    zone_dataset_visible(zc->zc_name, NULL))
290 		return (0);
291 
292 	return (ENOENT);
293 }
294 
295 static int
296 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
297 {
298 	int writable = 1;
299 
300 	/*
301 	 * The dataset must be visible by this zone -- check this first
302 	 * so they don't see EPERM on something they shouldn't know about.
303 	 */
304 	if (!INGLOBALZONE(curproc) &&
305 	    !zone_dataset_visible(dataset, &writable))
306 		return (ENOENT);
307 
308 	if (INGLOBALZONE(curproc)) {
309 		/*
310 		 * If the fs is zoned, only root can access it from the
311 		 * global zone.
312 		 */
313 		if (secpolicy_zfs(cr) && zoned)
314 			return (EPERM);
315 	} else {
316 		/*
317 		 * If we are in a local zone, the 'zoned' property must be set.
318 		 */
319 		if (!zoned)
320 			return (EPERM);
321 
322 		/* must be writable by this zone */
323 		if (!writable)
324 			return (EPERM);
325 	}
326 	return (0);
327 }
328 
329 static int
330 zfs_dozonecheck(const char *dataset, cred_t *cr)
331 {
332 	uint64_t zoned;
333 
334 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
335 		return (ENOENT);
336 
337 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
338 }
339 
340 static int
341 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
342 {
343 	uint64_t zoned;
344 
345 	rw_enter(&ds->ds_dir->dd_pool->dp_config_rwlock, RW_READER);
346 	if (dsl_prop_get_ds(ds, "zoned", 8, 1, &zoned, NULL)) {
347 		rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);
348 		return (ENOENT);
349 	}
350 	rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);
351 
352 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
353 }
354 
355 /*
356  * If name ends in a '@', then require recursive permissions.
357  */
358 int
359 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
360 {
361 	int error;
362 	boolean_t descendent = B_FALSE;
363 	dsl_dataset_t *ds;
364 	char *at;
365 
366 	at = strchr(name, '@');
367 	if (at != NULL && at[1] == '\0') {
368 		*at = '\0';
369 		descendent = B_TRUE;
370 	}
371 
372 	error = dsl_dataset_hold(name, FTAG, &ds);
373 	if (at != NULL)
374 		*at = '@';
375 	if (error != 0)
376 		return (error);
377 
378 	error = zfs_dozonecheck_ds(name, ds, cr);
379 	if (error == 0) {
380 		error = secpolicy_zfs(cr);
381 		if (error)
382 			error = dsl_deleg_access_impl(ds, descendent, perm, cr);
383 	}
384 
385 	dsl_dataset_rele(ds, FTAG);
386 	return (error);
387 }
388 
389 int
390 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
391     const char *perm, cred_t *cr)
392 {
393 	int error;
394 
395 	error = zfs_dozonecheck_ds(name, ds, cr);
396 	if (error == 0) {
397 		error = secpolicy_zfs(cr);
398 		if (error)
399 			error = dsl_deleg_access_impl(ds, B_FALSE, perm, cr);
400 	}
401 	return (error);
402 }
403 
404 /*
405  * Policy for setting the security label property.
406  *
407  * Returns 0 for success, non-zero for access and other errors.
408  */
409 static int
410 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
411 {
412 	char		ds_hexsl[MAXNAMELEN];
413 	bslabel_t	ds_sl, new_sl;
414 	boolean_t	new_default = FALSE;
415 	uint64_t	zoned;
416 	int		needed_priv = -1;
417 	int		error;
418 
419 	/* First get the existing dataset label. */
420 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
421 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
422 	if (error)
423 		return (EPERM);
424 
425 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
426 		new_default = TRUE;
427 
428 	/* The label must be translatable */
429 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
430 		return (EINVAL);
431 
432 	/*
433 	 * In a non-global zone, disallow attempts to set a label that
434 	 * doesn't match that of the zone; otherwise no other checks
435 	 * are needed.
436 	 */
437 	if (!INGLOBALZONE(curproc)) {
438 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
439 			return (EPERM);
440 		return (0);
441 	}
442 
443 	/*
444 	 * For global-zone datasets (i.e., those whose zoned property is
445 	 * "off", verify that the specified new label is valid for the
446 	 * global zone.
447 	 */
448 	if (dsl_prop_get_integer(name,
449 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
450 		return (EPERM);
451 	if (!zoned) {
452 		if (zfs_check_global_label(name, strval) != 0)
453 			return (EPERM);
454 	}
455 
456 	/*
457 	 * If the existing dataset label is nondefault, check if the
458 	 * dataset is mounted (label cannot be changed while mounted).
459 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
460 	 * mounted (or isn't a dataset, doesn't exist, ...).
461 	 */
462 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
463 		objset_t *os;
464 		static char *setsl_tag = "setsl_tag";
465 
466 		/*
467 		 * Try to own the dataset; abort if there is any error,
468 		 * (e.g., already mounted, in use, or other error).
469 		 */
470 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
471 		    setsl_tag, &os);
472 		if (error)
473 			return (EPERM);
474 
475 		dmu_objset_disown(os, setsl_tag);
476 
477 		if (new_default) {
478 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
479 			goto out_check;
480 		}
481 
482 		if (hexstr_to_label(strval, &new_sl) != 0)
483 			return (EPERM);
484 
485 		if (blstrictdom(&ds_sl, &new_sl))
486 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
487 		else if (blstrictdom(&new_sl, &ds_sl))
488 			needed_priv = PRIV_FILE_UPGRADE_SL;
489 	} else {
490 		/* dataset currently has a default label */
491 		if (!new_default)
492 			needed_priv = PRIV_FILE_UPGRADE_SL;
493 	}
494 
495 out_check:
496 	if (needed_priv != -1)
497 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
498 	return (0);
499 }
500 
501 static int
502 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
503     cred_t *cr)
504 {
505 	char *strval;
506 
507 	/*
508 	 * Check permissions for special properties.
509 	 */
510 	switch (prop) {
511 	case ZFS_PROP_ZONED:
512 		/*
513 		 * Disallow setting of 'zoned' from within a local zone.
514 		 */
515 		if (!INGLOBALZONE(curproc))
516 			return (EPERM);
517 		break;
518 
519 	case ZFS_PROP_QUOTA:
520 		if (!INGLOBALZONE(curproc)) {
521 			uint64_t zoned;
522 			char setpoint[MAXNAMELEN];
523 			/*
524 			 * Unprivileged users are allowed to modify the
525 			 * quota on things *under* (ie. contained by)
526 			 * the thing they own.
527 			 */
528 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
529 			    setpoint))
530 				return (EPERM);
531 			if (!zoned || strlen(dsname) <= strlen(setpoint))
532 				return (EPERM);
533 		}
534 		break;
535 
536 	case ZFS_PROP_MLSLABEL:
537 		if (!is_system_labeled())
538 			return (EPERM);
539 
540 		if (nvpair_value_string(propval, &strval) == 0) {
541 			int err;
542 
543 			err = zfs_set_slabel_policy(dsname, strval, CRED());
544 			if (err != 0)
545 				return (err);
546 		}
547 		break;
548 	}
549 
550 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
551 }
552 
553 int
554 zfs_secpolicy_fsacl(zfs_cmd_t *zc, cred_t *cr)
555 {
556 	int error;
557 
558 	error = zfs_dozonecheck(zc->zc_name, cr);
559 	if (error)
560 		return (error);
561 
562 	/*
563 	 * permission to set permissions will be evaluated later in
564 	 * dsl_deleg_can_allow()
565 	 */
566 	return (0);
567 }
568 
569 int
570 zfs_secpolicy_rollback(zfs_cmd_t *zc, cred_t *cr)
571 {
572 	return (zfs_secpolicy_write_perms(zc->zc_name,
573 	    ZFS_DELEG_PERM_ROLLBACK, cr));
574 }
575 
576 int
577 zfs_secpolicy_send(zfs_cmd_t *zc, cred_t *cr)
578 {
579 	spa_t *spa;
580 	dsl_pool_t *dp;
581 	dsl_dataset_t *ds;
582 	char *cp;
583 	int error;
584 
585 	/*
586 	 * Generate the current snapshot name from the given objsetid, then
587 	 * use that name for the secpolicy/zone checks.
588 	 */
589 	cp = strchr(zc->zc_name, '@');
590 	if (cp == NULL)
591 		return (EINVAL);
592 	error = spa_open(zc->zc_name, &spa, FTAG);
593 	if (error)
594 		return (error);
595 
596 	dp = spa_get_dsl(spa);
597 	rw_enter(&dp->dp_config_rwlock, RW_READER);
598 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
599 	rw_exit(&dp->dp_config_rwlock);
600 	spa_close(spa, FTAG);
601 	if (error)
602 		return (error);
603 
604 	dsl_dataset_name(ds, zc->zc_name);
605 
606 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
607 	    ZFS_DELEG_PERM_SEND, cr);
608 	dsl_dataset_rele(ds, FTAG);
609 
610 	return (error);
611 }
612 
613 static int
614 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, cred_t *cr)
615 {
616 	vnode_t *vp;
617 	int error;
618 
619 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
620 	    NO_FOLLOW, NULL, &vp)) != 0)
621 		return (error);
622 
623 	/* Now make sure mntpnt and dataset are ZFS */
624 
625 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
626 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
627 	    zc->zc_name) != 0)) {
628 		VN_RELE(vp);
629 		return (EPERM);
630 	}
631 
632 	VN_RELE(vp);
633 	return (dsl_deleg_access(zc->zc_name,
634 	    ZFS_DELEG_PERM_SHARE, cr));
635 }
636 
637 int
638 zfs_secpolicy_share(zfs_cmd_t *zc, cred_t *cr)
639 {
640 	if (!INGLOBALZONE(curproc))
641 		return (EPERM);
642 
643 	if (secpolicy_nfs(cr) == 0) {
644 		return (0);
645 	} else {
646 		return (zfs_secpolicy_deleg_share(zc, cr));
647 	}
648 }
649 
650 int
651 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, cred_t *cr)
652 {
653 	if (!INGLOBALZONE(curproc))
654 		return (EPERM);
655 
656 	if (secpolicy_smb(cr) == 0) {
657 		return (0);
658 	} else {
659 		return (zfs_secpolicy_deleg_share(zc, cr));
660 	}
661 }
662 
663 static int
664 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
665 {
666 	char *cp;
667 
668 	/*
669 	 * Remove the @bla or /bla from the end of the name to get the parent.
670 	 */
671 	(void) strncpy(parent, datasetname, parentsize);
672 	cp = strrchr(parent, '@');
673 	if (cp != NULL) {
674 		cp[0] = '\0';
675 	} else {
676 		cp = strrchr(parent, '/');
677 		if (cp == NULL)
678 			return (ENOENT);
679 		cp[0] = '\0';
680 	}
681 
682 	return (0);
683 }
684 
685 int
686 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
687 {
688 	int error;
689 
690 	if ((error = zfs_secpolicy_write_perms(name,
691 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
692 		return (error);
693 
694 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
695 }
696 
697 static int
698 zfs_secpolicy_destroy(zfs_cmd_t *zc, cred_t *cr)
699 {
700 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
701 }
702 
703 /*
704  * Destroying snapshots with delegated permissions requires
705  * descendent mount and destroy permissions.
706  */
707 static int
708 zfs_secpolicy_destroy_recursive(zfs_cmd_t *zc, cred_t *cr)
709 {
710 	int error;
711 	char *dsname;
712 
713 	dsname = kmem_asprintf("%s@", zc->zc_name);
714 
715 	error = zfs_secpolicy_destroy_perms(dsname, cr);
716 
717 	strfree(dsname);
718 	return (error);
719 }
720 
721 int
722 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
723 {
724 	char	parentname[MAXNAMELEN];
725 	int	error;
726 
727 	if ((error = zfs_secpolicy_write_perms(from,
728 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
729 		return (error);
730 
731 	if ((error = zfs_secpolicy_write_perms(from,
732 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
733 		return (error);
734 
735 	if ((error = zfs_get_parent(to, parentname,
736 	    sizeof (parentname))) != 0)
737 		return (error);
738 
739 	if ((error = zfs_secpolicy_write_perms(parentname,
740 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
741 		return (error);
742 
743 	if ((error = zfs_secpolicy_write_perms(parentname,
744 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
745 		return (error);
746 
747 	return (error);
748 }
749 
750 static int
751 zfs_secpolicy_rename(zfs_cmd_t *zc, cred_t *cr)
752 {
753 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
754 }
755 
756 static int
757 zfs_secpolicy_promote(zfs_cmd_t *zc, cred_t *cr)
758 {
759 	char	parentname[MAXNAMELEN];
760 	objset_t *clone;
761 	int error;
762 
763 	error = zfs_secpolicy_write_perms(zc->zc_name,
764 	    ZFS_DELEG_PERM_PROMOTE, cr);
765 	if (error)
766 		return (error);
767 
768 	error = dmu_objset_hold(zc->zc_name, FTAG, &clone);
769 
770 	if (error == 0) {
771 		dsl_dataset_t *pclone = NULL;
772 		dsl_dir_t *dd;
773 		dd = clone->os_dsl_dataset->ds_dir;
774 
775 		rw_enter(&dd->dd_pool->dp_config_rwlock, RW_READER);
776 		error = dsl_dataset_hold_obj(dd->dd_pool,
777 		    dd->dd_phys->dd_origin_obj, FTAG, &pclone);
778 		rw_exit(&dd->dd_pool->dp_config_rwlock);
779 		if (error) {
780 			dmu_objset_rele(clone, FTAG);
781 			return (error);
782 		}
783 
784 		error = zfs_secpolicy_write_perms(zc->zc_name,
785 		    ZFS_DELEG_PERM_MOUNT, cr);
786 
787 		dsl_dataset_name(pclone, parentname);
788 		dmu_objset_rele(clone, FTAG);
789 		dsl_dataset_rele(pclone, FTAG);
790 		if (error == 0)
791 			error = zfs_secpolicy_write_perms(parentname,
792 			    ZFS_DELEG_PERM_PROMOTE, cr);
793 	}
794 	return (error);
795 }
796 
797 static int
798 zfs_secpolicy_receive(zfs_cmd_t *zc, cred_t *cr)
799 {
800 	int error;
801 
802 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
803 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
804 		return (error);
805 
806 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
807 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
808 		return (error);
809 
810 	return (zfs_secpolicy_write_perms(zc->zc_name,
811 	    ZFS_DELEG_PERM_CREATE, cr));
812 }
813 
814 int
815 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
816 {
817 	return (zfs_secpolicy_write_perms(name,
818 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
819 }
820 
821 static int
822 zfs_secpolicy_snapshot(zfs_cmd_t *zc, cred_t *cr)
823 {
824 
825 	return (zfs_secpolicy_snapshot_perms(zc->zc_name, cr));
826 }
827 
828 static int
829 zfs_secpolicy_create(zfs_cmd_t *zc, cred_t *cr)
830 {
831 	char	parentname[MAXNAMELEN];
832 	int	error;
833 
834 	if ((error = zfs_get_parent(zc->zc_name, parentname,
835 	    sizeof (parentname))) != 0)
836 		return (error);
837 
838 	if (zc->zc_value[0] != '\0') {
839 		if ((error = zfs_secpolicy_write_perms(zc->zc_value,
840 		    ZFS_DELEG_PERM_CLONE, cr)) != 0)
841 			return (error);
842 	}
843 
844 	if ((error = zfs_secpolicy_write_perms(parentname,
845 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
846 		return (error);
847 
848 	error = zfs_secpolicy_write_perms(parentname,
849 	    ZFS_DELEG_PERM_MOUNT, cr);
850 
851 	return (error);
852 }
853 
854 static int
855 zfs_secpolicy_umount(zfs_cmd_t *zc, cred_t *cr)
856 {
857 	int error;
858 
859 	error = secpolicy_fs_unmount(cr, NULL);
860 	if (error) {
861 		error = dsl_deleg_access(zc->zc_name, ZFS_DELEG_PERM_MOUNT, cr);
862 	}
863 	return (error);
864 }
865 
866 /*
867  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
868  * SYS_CONFIG privilege, which is not available in a local zone.
869  */
870 /* ARGSUSED */
871 static int
872 zfs_secpolicy_config(zfs_cmd_t *zc, cred_t *cr)
873 {
874 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
875 		return (EPERM);
876 
877 	return (0);
878 }
879 
880 /*
881  * Policy for object to name lookups.
882  */
883 /* ARGSUSED */
884 static int
885 zfs_secpolicy_diff(zfs_cmd_t *zc, cred_t *cr)
886 {
887 	int error;
888 
889 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
890 		return (0);
891 
892 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
893 	return (error);
894 }
895 
896 /*
897  * Policy for fault injection.  Requires all privileges.
898  */
899 /* ARGSUSED */
900 static int
901 zfs_secpolicy_inject(zfs_cmd_t *zc, cred_t *cr)
902 {
903 	return (secpolicy_zinject(cr));
904 }
905 
906 static int
907 zfs_secpolicy_inherit(zfs_cmd_t *zc, cred_t *cr)
908 {
909 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
910 
911 	if (prop == ZPROP_INVAL) {
912 		if (!zfs_prop_user(zc->zc_value))
913 			return (EINVAL);
914 		return (zfs_secpolicy_write_perms(zc->zc_name,
915 		    ZFS_DELEG_PERM_USERPROP, cr));
916 	} else {
917 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
918 		    NULL, cr));
919 	}
920 }
921 
922 static int
923 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, cred_t *cr)
924 {
925 	int err = zfs_secpolicy_read(zc, cr);
926 	if (err)
927 		return (err);
928 
929 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
930 		return (EINVAL);
931 
932 	if (zc->zc_value[0] == 0) {
933 		/*
934 		 * They are asking about a posix uid/gid.  If it's
935 		 * themself, allow it.
936 		 */
937 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
938 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
939 			if (zc->zc_guid == crgetuid(cr))
940 				return (0);
941 		} else {
942 			if (groupmember(zc->zc_guid, cr))
943 				return (0);
944 		}
945 	}
946 
947 	return (zfs_secpolicy_write_perms(zc->zc_name,
948 	    userquota_perms[zc->zc_objset_type], cr));
949 }
950 
951 static int
952 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, cred_t *cr)
953 {
954 	int err = zfs_secpolicy_read(zc, cr);
955 	if (err)
956 		return (err);
957 
958 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
959 		return (EINVAL);
960 
961 	return (zfs_secpolicy_write_perms(zc->zc_name,
962 	    userquota_perms[zc->zc_objset_type], cr));
963 }
964 
965 static int
966 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, cred_t *cr)
967 {
968 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
969 	    NULL, cr));
970 }
971 
972 static int
973 zfs_secpolicy_hold(zfs_cmd_t *zc, cred_t *cr)
974 {
975 	return (zfs_secpolicy_write_perms(zc->zc_name,
976 	    ZFS_DELEG_PERM_HOLD, cr));
977 }
978 
979 static int
980 zfs_secpolicy_release(zfs_cmd_t *zc, cred_t *cr)
981 {
982 	return (zfs_secpolicy_write_perms(zc->zc_name,
983 	    ZFS_DELEG_PERM_RELEASE, cr));
984 }
985 
986 /*
987  * Policy for allowing temporary snapshots to be taken or released
988  */
989 static int
990 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, cred_t *cr)
991 {
992 	/*
993 	 * A temporary snapshot is the same as a snapshot,
994 	 * hold, destroy and release all rolled into one.
995 	 * Delegated diff alone is sufficient that we allow this.
996 	 */
997 	int error;
998 
999 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1000 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1001 		return (0);
1002 
1003 	error = zfs_secpolicy_snapshot(zc, cr);
1004 	if (!error)
1005 		error = zfs_secpolicy_hold(zc, cr);
1006 	if (!error)
1007 		error = zfs_secpolicy_release(zc, cr);
1008 	if (!error)
1009 		error = zfs_secpolicy_destroy(zc, cr);
1010 	return (error);
1011 }
1012 
1013 /*
1014  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1015  */
1016 static int
1017 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1018 {
1019 	char *packed;
1020 	int error;
1021 	nvlist_t *list = NULL;
1022 
1023 	/*
1024 	 * Read in and unpack the user-supplied nvlist.
1025 	 */
1026 	if (size == 0)
1027 		return (EINVAL);
1028 
1029 	packed = kmem_alloc(size, KM_SLEEP);
1030 
1031 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1032 	    iflag)) != 0) {
1033 		kmem_free(packed, size);
1034 		return (error);
1035 	}
1036 
1037 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1038 		kmem_free(packed, size);
1039 		return (error);
1040 	}
1041 
1042 	kmem_free(packed, size);
1043 
1044 	*nvp = list;
1045 	return (0);
1046 }
1047 
1048 static int
1049 fit_error_list(zfs_cmd_t *zc, nvlist_t **errors)
1050 {
1051 	size_t size;
1052 
1053 	VERIFY(nvlist_size(*errors, &size, NV_ENCODE_NATIVE) == 0);
1054 
1055 	if (size > zc->zc_nvlist_dst_size) {
1056 		nvpair_t *more_errors;
1057 		int n = 0;
1058 
1059 		if (zc->zc_nvlist_dst_size < 1024)
1060 			return (ENOMEM);
1061 
1062 		VERIFY(nvlist_add_int32(*errors, ZPROP_N_MORE_ERRORS, 0) == 0);
1063 		more_errors = nvlist_prev_nvpair(*errors, NULL);
1064 
1065 		do {
1066 			nvpair_t *pair = nvlist_prev_nvpair(*errors,
1067 			    more_errors);
1068 			VERIFY(nvlist_remove_nvpair(*errors, pair) == 0);
1069 			n++;
1070 			VERIFY(nvlist_size(*errors, &size,
1071 			    NV_ENCODE_NATIVE) == 0);
1072 		} while (size > zc->zc_nvlist_dst_size);
1073 
1074 		VERIFY(nvlist_remove_nvpair(*errors, more_errors) == 0);
1075 		VERIFY(nvlist_add_int32(*errors, ZPROP_N_MORE_ERRORS, n) == 0);
1076 		ASSERT(nvlist_size(*errors, &size, NV_ENCODE_NATIVE) == 0);
1077 		ASSERT(size <= zc->zc_nvlist_dst_size);
1078 	}
1079 
1080 	return (0);
1081 }
1082 
1083 static int
1084 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1085 {
1086 	char *packed = NULL;
1087 	int error = 0;
1088 	size_t size;
1089 
1090 	VERIFY(nvlist_size(nvl, &size, NV_ENCODE_NATIVE) == 0);
1091 
1092 	if (size > zc->zc_nvlist_dst_size) {
1093 		error = ENOMEM;
1094 	} else {
1095 		packed = kmem_alloc(size, KM_SLEEP);
1096 		VERIFY(nvlist_pack(nvl, &packed, &size, NV_ENCODE_NATIVE,
1097 		    KM_SLEEP) == 0);
1098 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1099 		    size, zc->zc_iflags) != 0)
1100 			error = EFAULT;
1101 		kmem_free(packed, size);
1102 	}
1103 
1104 	zc->zc_nvlist_dst_size = size;
1105 	return (error);
1106 }
1107 
1108 static int
1109 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1110 {
1111 	objset_t *os;
1112 	int error;
1113 
1114 	error = dmu_objset_hold(dsname, FTAG, &os);
1115 	if (error)
1116 		return (error);
1117 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1118 		dmu_objset_rele(os, FTAG);
1119 		return (EINVAL);
1120 	}
1121 
1122 	mutex_enter(&os->os_user_ptr_lock);
1123 	*zfvp = dmu_objset_get_user(os);
1124 	if (*zfvp) {
1125 		VFS_HOLD((*zfvp)->z_vfs);
1126 	} else {
1127 		error = ESRCH;
1128 	}
1129 	mutex_exit(&os->os_user_ptr_lock);
1130 	dmu_objset_rele(os, FTAG);
1131 	return (error);
1132 }
1133 
1134 /*
1135  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1136  * case its z_vfs will be NULL, and it will be opened as the owner.
1137  */
1138 static int
1139 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1140 {
1141 	int error = 0;
1142 
1143 	if (getzfsvfs(name, zfvp) != 0)
1144 		error = zfsvfs_create(name, zfvp);
1145 	if (error == 0) {
1146 		rrw_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1147 		    RW_READER, tag);
1148 		if ((*zfvp)->z_unmounted) {
1149 			/*
1150 			 * XXX we could probably try again, since the unmounting
1151 			 * thread should be just about to disassociate the
1152 			 * objset from the zfsvfs.
1153 			 */
1154 			rrw_exit(&(*zfvp)->z_teardown_lock, tag);
1155 			return (EBUSY);
1156 		}
1157 	}
1158 	return (error);
1159 }
1160 
1161 static void
1162 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1163 {
1164 	rrw_exit(&zfsvfs->z_teardown_lock, tag);
1165 
1166 	if (zfsvfs->z_vfs) {
1167 		VFS_RELE(zfsvfs->z_vfs);
1168 	} else {
1169 		dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1170 		zfsvfs_free(zfsvfs);
1171 	}
1172 }
1173 
1174 static int
1175 zfs_ioc_pool_create(zfs_cmd_t *zc)
1176 {
1177 	int error;
1178 	nvlist_t *config, *props = NULL;
1179 	nvlist_t *rootprops = NULL;
1180 	nvlist_t *zplprops = NULL;
1181 	char *buf;
1182 
1183 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1184 	    zc->zc_iflags, &config))
1185 		return (error);
1186 
1187 	if (zc->zc_nvlist_src_size != 0 && (error =
1188 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1189 	    zc->zc_iflags, &props))) {
1190 		nvlist_free(config);
1191 		return (error);
1192 	}
1193 
1194 	if (props) {
1195 		nvlist_t *nvl = NULL;
1196 		uint64_t version = SPA_VERSION;
1197 
1198 		(void) nvlist_lookup_uint64(props,
1199 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1200 		if (version < SPA_VERSION_INITIAL || version > SPA_VERSION) {
1201 			error = EINVAL;
1202 			goto pool_props_bad;
1203 		}
1204 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1205 		if (nvl) {
1206 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1207 			if (error != 0) {
1208 				nvlist_free(config);
1209 				nvlist_free(props);
1210 				return (error);
1211 			}
1212 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1213 		}
1214 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1215 		error = zfs_fill_zplprops_root(version, rootprops,
1216 		    zplprops, NULL);
1217 		if (error)
1218 			goto pool_props_bad;
1219 	}
1220 
1221 	buf = history_str_get(zc);
1222 
1223 	error = spa_create(zc->zc_name, config, props, buf, zplprops);
1224 
1225 	/*
1226 	 * Set the remaining root properties
1227 	 */
1228 	if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1229 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1230 		(void) spa_destroy(zc->zc_name);
1231 
1232 	if (buf != NULL)
1233 		history_str_free(buf);
1234 
1235 pool_props_bad:
1236 	nvlist_free(rootprops);
1237 	nvlist_free(zplprops);
1238 	nvlist_free(config);
1239 	nvlist_free(props);
1240 
1241 	return (error);
1242 }
1243 
1244 static int
1245 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1246 {
1247 	int error;
1248 	zfs_log_history(zc);
1249 	error = spa_destroy(zc->zc_name);
1250 	if (error == 0)
1251 		zvol_remove_minors(zc->zc_name);
1252 	return (error);
1253 }
1254 
1255 static int
1256 zfs_ioc_pool_import(zfs_cmd_t *zc)
1257 {
1258 	nvlist_t *config, *props = NULL;
1259 	uint64_t guid;
1260 	int error;
1261 
1262 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1263 	    zc->zc_iflags, &config)) != 0)
1264 		return (error);
1265 
1266 	if (zc->zc_nvlist_src_size != 0 && (error =
1267 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1268 	    zc->zc_iflags, &props))) {
1269 		nvlist_free(config);
1270 		return (error);
1271 	}
1272 
1273 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1274 	    guid != zc->zc_guid)
1275 		error = EINVAL;
1276 	else
1277 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1278 
1279 	if (zc->zc_nvlist_dst != 0) {
1280 		int err;
1281 
1282 		if ((err = put_nvlist(zc, config)) != 0)
1283 			error = err;
1284 	}
1285 
1286 	nvlist_free(config);
1287 
1288 	if (props)
1289 		nvlist_free(props);
1290 
1291 	return (error);
1292 }
1293 
1294 static int
1295 zfs_ioc_pool_export(zfs_cmd_t *zc)
1296 {
1297 	int error;
1298 	boolean_t force = (boolean_t)zc->zc_cookie;
1299 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1300 
1301 	zfs_log_history(zc);
1302 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1303 	if (error == 0)
1304 		zvol_remove_minors(zc->zc_name);
1305 	return (error);
1306 }
1307 
1308 static int
1309 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1310 {
1311 	nvlist_t *configs;
1312 	int error;
1313 
1314 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1315 		return (EEXIST);
1316 
1317 	error = put_nvlist(zc, configs);
1318 
1319 	nvlist_free(configs);
1320 
1321 	return (error);
1322 }
1323 
1324 static int
1325 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1326 {
1327 	nvlist_t *config;
1328 	int error;
1329 	int ret = 0;
1330 
1331 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1332 	    sizeof (zc->zc_value));
1333 
1334 	if (config != NULL) {
1335 		ret = put_nvlist(zc, config);
1336 		nvlist_free(config);
1337 
1338 		/*
1339 		 * The config may be present even if 'error' is non-zero.
1340 		 * In this case we return success, and preserve the real errno
1341 		 * in 'zc_cookie'.
1342 		 */
1343 		zc->zc_cookie = error;
1344 	} else {
1345 		ret = error;
1346 	}
1347 
1348 	return (ret);
1349 }
1350 
1351 /*
1352  * Try to import the given pool, returning pool stats as appropriate so that
1353  * user land knows which devices are available and overall pool health.
1354  */
1355 static int
1356 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1357 {
1358 	nvlist_t *tryconfig, *config;
1359 	int error;
1360 
1361 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1362 	    zc->zc_iflags, &tryconfig)) != 0)
1363 		return (error);
1364 
1365 	config = spa_tryimport(tryconfig);
1366 
1367 	nvlist_free(tryconfig);
1368 
1369 	if (config == NULL)
1370 		return (EINVAL);
1371 
1372 	error = put_nvlist(zc, config);
1373 	nvlist_free(config);
1374 
1375 	return (error);
1376 }
1377 
1378 /*
1379  * inputs:
1380  * zc_name              name of the pool
1381  * zc_cookie            scan func (pool_scan_func_t)
1382  */
1383 static int
1384 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1385 {
1386 	spa_t *spa;
1387 	int error;
1388 
1389 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1390 		return (error);
1391 
1392 	if (zc->zc_cookie == POOL_SCAN_NONE)
1393 		error = spa_scan_stop(spa);
1394 	else
1395 		error = spa_scan(spa, zc->zc_cookie);
1396 
1397 	spa_close(spa, FTAG);
1398 
1399 	return (error);
1400 }
1401 
1402 static int
1403 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1404 {
1405 	spa_t *spa;
1406 	int error;
1407 
1408 	error = spa_open(zc->zc_name, &spa, FTAG);
1409 	if (error == 0) {
1410 		spa_freeze(spa);
1411 		spa_close(spa, FTAG);
1412 	}
1413 	return (error);
1414 }
1415 
1416 static int
1417 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1418 {
1419 	spa_t *spa;
1420 	int error;
1421 
1422 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1423 		return (error);
1424 
1425 	if (zc->zc_cookie < spa_version(spa) || zc->zc_cookie > SPA_VERSION) {
1426 		spa_close(spa, FTAG);
1427 		return (EINVAL);
1428 	}
1429 
1430 	spa_upgrade(spa, zc->zc_cookie);
1431 	spa_close(spa, FTAG);
1432 
1433 	return (error);
1434 }
1435 
1436 static int
1437 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1438 {
1439 	spa_t *spa;
1440 	char *hist_buf;
1441 	uint64_t size;
1442 	int error;
1443 
1444 	if ((size = zc->zc_history_len) == 0)
1445 		return (EINVAL);
1446 
1447 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1448 		return (error);
1449 
1450 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1451 		spa_close(spa, FTAG);
1452 		return (ENOTSUP);
1453 	}
1454 
1455 	hist_buf = kmem_alloc(size, KM_SLEEP);
1456 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1457 	    &zc->zc_history_len, hist_buf)) == 0) {
1458 		error = ddi_copyout(hist_buf,
1459 		    (void *)(uintptr_t)zc->zc_history,
1460 		    zc->zc_history_len, zc->zc_iflags);
1461 	}
1462 
1463 	spa_close(spa, FTAG);
1464 	kmem_free(hist_buf, size);
1465 	return (error);
1466 }
1467 
1468 static int
1469 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1470 {
1471 	spa_t *spa;
1472 	int error;
1473 
1474 	error = spa_open(zc->zc_name, &spa, FTAG);
1475 	if (error == 0) {
1476 		error = spa_change_guid(spa);
1477 		spa_close(spa, FTAG);
1478 	}
1479 	return (error);
1480 }
1481 
1482 static int
1483 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1484 {
1485 	int error;
1486 
1487 	if (error = dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value))
1488 		return (error);
1489 
1490 	return (0);
1491 }
1492 
1493 /*
1494  * inputs:
1495  * zc_name		name of filesystem
1496  * zc_obj		object to find
1497  *
1498  * outputs:
1499  * zc_value		name of object
1500  */
1501 static int
1502 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1503 {
1504 	objset_t *os;
1505 	int error;
1506 
1507 	/* XXX reading from objset not owned */
1508 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1509 		return (error);
1510 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1511 		dmu_objset_rele(os, FTAG);
1512 		return (EINVAL);
1513 	}
1514 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1515 	    sizeof (zc->zc_value));
1516 	dmu_objset_rele(os, FTAG);
1517 
1518 	return (error);
1519 }
1520 
1521 /*
1522  * inputs:
1523  * zc_name		name of filesystem
1524  * zc_obj		object to find
1525  *
1526  * outputs:
1527  * zc_stat		stats on object
1528  * zc_value		path to object
1529  */
1530 static int
1531 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1532 {
1533 	objset_t *os;
1534 	int error;
1535 
1536 	/* XXX reading from objset not owned */
1537 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1538 		return (error);
1539 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1540 		dmu_objset_rele(os, FTAG);
1541 		return (EINVAL);
1542 	}
1543 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1544 	    sizeof (zc->zc_value));
1545 	dmu_objset_rele(os, FTAG);
1546 
1547 	return (error);
1548 }
1549 
1550 static int
1551 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1552 {
1553 	spa_t *spa;
1554 	int error;
1555 	nvlist_t *config, **l2cache, **spares;
1556 	uint_t nl2cache = 0, nspares = 0;
1557 
1558 	error = spa_open(zc->zc_name, &spa, FTAG);
1559 	if (error != 0)
1560 		return (error);
1561 
1562 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1563 	    zc->zc_iflags, &config);
1564 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1565 	    &l2cache, &nl2cache);
1566 
1567 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1568 	    &spares, &nspares);
1569 
1570 	/*
1571 	 * A root pool with concatenated devices is not supported.
1572 	 * Thus, can not add a device to a root pool.
1573 	 *
1574 	 * Intent log device can not be added to a rootpool because
1575 	 * during mountroot, zil is replayed, a seperated log device
1576 	 * can not be accessed during the mountroot time.
1577 	 *
1578 	 * l2cache and spare devices are ok to be added to a rootpool.
1579 	 */
1580 	if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1581 		nvlist_free(config);
1582 		spa_close(spa, FTAG);
1583 		return (EDOM);
1584 	}
1585 
1586 	if (error == 0) {
1587 		error = spa_vdev_add(spa, config);
1588 		nvlist_free(config);
1589 	}
1590 	spa_close(spa, FTAG);
1591 	return (error);
1592 }
1593 
1594 /*
1595  * inputs:
1596  * zc_name		name of the pool
1597  * zc_nvlist_conf	nvlist of devices to remove
1598  * zc_cookie		to stop the remove?
1599  */
1600 static int
1601 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1602 {
1603 	spa_t *spa;
1604 	int error;
1605 
1606 	error = spa_open(zc->zc_name, &spa, FTAG);
1607 	if (error != 0)
1608 		return (error);
1609 	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1610 	spa_close(spa, FTAG);
1611 	return (error);
1612 }
1613 
1614 static int
1615 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1616 {
1617 	spa_t *spa;
1618 	int error;
1619 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1620 
1621 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1622 		return (error);
1623 	switch (zc->zc_cookie) {
1624 	case VDEV_STATE_ONLINE:
1625 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1626 		break;
1627 
1628 	case VDEV_STATE_OFFLINE:
1629 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1630 		break;
1631 
1632 	case VDEV_STATE_FAULTED:
1633 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1634 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1635 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1636 
1637 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1638 		break;
1639 
1640 	case VDEV_STATE_DEGRADED:
1641 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1642 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1643 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1644 
1645 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1646 		break;
1647 
1648 	default:
1649 		error = EINVAL;
1650 	}
1651 	zc->zc_cookie = newstate;
1652 	spa_close(spa, FTAG);
1653 	return (error);
1654 }
1655 
1656 static int
1657 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1658 {
1659 	spa_t *spa;
1660 	int replacing = zc->zc_cookie;
1661 	nvlist_t *config;
1662 	int error;
1663 
1664 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1665 		return (error);
1666 
1667 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1668 	    zc->zc_iflags, &config)) == 0) {
1669 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
1670 		nvlist_free(config);
1671 	}
1672 
1673 	spa_close(spa, FTAG);
1674 	return (error);
1675 }
1676 
1677 static int
1678 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
1679 {
1680 	spa_t *spa;
1681 	int error;
1682 
1683 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1684 		return (error);
1685 
1686 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
1687 
1688 	spa_close(spa, FTAG);
1689 	return (error);
1690 }
1691 
1692 static int
1693 zfs_ioc_vdev_split(zfs_cmd_t *zc)
1694 {
1695 	spa_t *spa;
1696 	nvlist_t *config, *props = NULL;
1697 	int error;
1698 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
1699 
1700 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1701 		return (error);
1702 
1703 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1704 	    zc->zc_iflags, &config)) {
1705 		spa_close(spa, FTAG);
1706 		return (error);
1707 	}
1708 
1709 	if (zc->zc_nvlist_src_size != 0 && (error =
1710 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1711 	    zc->zc_iflags, &props))) {
1712 		spa_close(spa, FTAG);
1713 		nvlist_free(config);
1714 		return (error);
1715 	}
1716 
1717 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
1718 
1719 	spa_close(spa, FTAG);
1720 
1721 	nvlist_free(config);
1722 	nvlist_free(props);
1723 
1724 	return (error);
1725 }
1726 
1727 static int
1728 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
1729 {
1730 	spa_t *spa;
1731 	char *path = zc->zc_value;
1732 	uint64_t guid = zc->zc_guid;
1733 	int error;
1734 
1735 	error = spa_open(zc->zc_name, &spa, FTAG);
1736 	if (error != 0)
1737 		return (error);
1738 
1739 	error = spa_vdev_setpath(spa, guid, path);
1740 	spa_close(spa, FTAG);
1741 	return (error);
1742 }
1743 
1744 static int
1745 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
1746 {
1747 	spa_t *spa;
1748 	char *fru = zc->zc_value;
1749 	uint64_t guid = zc->zc_guid;
1750 	int error;
1751 
1752 	error = spa_open(zc->zc_name, &spa, FTAG);
1753 	if (error != 0)
1754 		return (error);
1755 
1756 	error = spa_vdev_setfru(spa, guid, fru);
1757 	spa_close(spa, FTAG);
1758 	return (error);
1759 }
1760 
1761 static int
1762 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
1763 {
1764 	int error = 0;
1765 	nvlist_t *nv;
1766 
1767 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
1768 
1769 	if (zc->zc_nvlist_dst != 0 &&
1770 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
1771 		dmu_objset_stats(os, nv);
1772 		/*
1773 		 * NB: zvol_get_stats() will read the objset contents,
1774 		 * which we aren't supposed to do with a
1775 		 * DS_MODE_USER hold, because it could be
1776 		 * inconsistent.  So this is a bit of a workaround...
1777 		 * XXX reading with out owning
1778 		 */
1779 		if (!zc->zc_objset_stats.dds_inconsistent &&
1780 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
1781 			error = zvol_get_stats(os, nv);
1782 			if (error == EIO)
1783 				return (error);
1784 			VERIFY3S(error, ==, 0);
1785 		}
1786 		error = put_nvlist(zc, nv);
1787 		nvlist_free(nv);
1788 	}
1789 
1790 	return (error);
1791 }
1792 
1793 /*
1794  * inputs:
1795  * zc_name		name of filesystem
1796  * zc_nvlist_dst_size	size of buffer for property nvlist
1797  *
1798  * outputs:
1799  * zc_objset_stats	stats
1800  * zc_nvlist_dst	property nvlist
1801  * zc_nvlist_dst_size	size of property nvlist
1802  */
1803 static int
1804 zfs_ioc_objset_stats(zfs_cmd_t *zc)
1805 {
1806 	objset_t *os = NULL;
1807 	int error;
1808 
1809 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os))
1810 		return (error);
1811 
1812 	error = zfs_ioc_objset_stats_impl(zc, os);
1813 
1814 	dmu_objset_rele(os, FTAG);
1815 
1816 	return (error);
1817 }
1818 
1819 /*
1820  * inputs:
1821  * zc_name		name of filesystem
1822  * zc_nvlist_dst_size	size of buffer for property nvlist
1823  *
1824  * outputs:
1825  * zc_nvlist_dst	received property nvlist
1826  * zc_nvlist_dst_size	size of received property nvlist
1827  *
1828  * Gets received properties (distinct from local properties on or after
1829  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
1830  * local property values.
1831  */
1832 static int
1833 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
1834 {
1835 	objset_t *os = NULL;
1836 	int error;
1837 	nvlist_t *nv;
1838 
1839 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os))
1840 		return (error);
1841 
1842 	/*
1843 	 * Without this check, we would return local property values if the
1844 	 * caller has not already received properties on or after
1845 	 * SPA_VERSION_RECVD_PROPS.
1846 	 */
1847 	if (!dsl_prop_get_hasrecvd(os)) {
1848 		dmu_objset_rele(os, FTAG);
1849 		return (ENOTSUP);
1850 	}
1851 
1852 	if (zc->zc_nvlist_dst != 0 &&
1853 	    (error = dsl_prop_get_received(os, &nv)) == 0) {
1854 		error = put_nvlist(zc, nv);
1855 		nvlist_free(nv);
1856 	}
1857 
1858 	dmu_objset_rele(os, FTAG);
1859 	return (error);
1860 }
1861 
1862 static int
1863 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
1864 {
1865 	uint64_t value;
1866 	int error;
1867 
1868 	/*
1869 	 * zfs_get_zplprop() will either find a value or give us
1870 	 * the default value (if there is one).
1871 	 */
1872 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
1873 		return (error);
1874 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
1875 	return (0);
1876 }
1877 
1878 /*
1879  * inputs:
1880  * zc_name		name of filesystem
1881  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
1882  *
1883  * outputs:
1884  * zc_nvlist_dst	zpl property nvlist
1885  * zc_nvlist_dst_size	size of zpl property nvlist
1886  */
1887 static int
1888 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
1889 {
1890 	objset_t *os;
1891 	int err;
1892 
1893 	/* XXX reading without owning */
1894 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
1895 		return (err);
1896 
1897 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
1898 
1899 	/*
1900 	 * NB: nvl_add_zplprop() will read the objset contents,
1901 	 * which we aren't supposed to do with a DS_MODE_USER
1902 	 * hold, because it could be inconsistent.
1903 	 */
1904 	if (zc->zc_nvlist_dst != NULL &&
1905 	    !zc->zc_objset_stats.dds_inconsistent &&
1906 	    dmu_objset_type(os) == DMU_OST_ZFS) {
1907 		nvlist_t *nv;
1908 
1909 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1910 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
1911 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
1912 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
1913 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
1914 			err = put_nvlist(zc, nv);
1915 		nvlist_free(nv);
1916 	} else {
1917 		err = ENOENT;
1918 	}
1919 	dmu_objset_rele(os, FTAG);
1920 	return (err);
1921 }
1922 
1923 static boolean_t
1924 dataset_name_hidden(const char *name)
1925 {
1926 	/*
1927 	 * Skip over datasets that are not visible in this zone,
1928 	 * internal datasets (which have a $ in their name), and
1929 	 * temporary datasets (which have a % in their name).
1930 	 */
1931 	if (strchr(name, '$') != NULL)
1932 		return (B_TRUE);
1933 	if (strchr(name, '%') != NULL)
1934 		return (B_TRUE);
1935 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
1936 		return (B_TRUE);
1937 	return (B_FALSE);
1938 }
1939 
1940 /*
1941  * inputs:
1942  * zc_name		name of filesystem
1943  * zc_cookie		zap cursor
1944  * zc_nvlist_dst_size	size of buffer for property nvlist
1945  *
1946  * outputs:
1947  * zc_name		name of next filesystem
1948  * zc_cookie		zap cursor
1949  * zc_objset_stats	stats
1950  * zc_nvlist_dst	property nvlist
1951  * zc_nvlist_dst_size	size of property nvlist
1952  */
1953 static int
1954 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
1955 {
1956 	objset_t *os;
1957 	int error;
1958 	char *p;
1959 	size_t orig_len = strlen(zc->zc_name);
1960 
1961 top:
1962 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
1963 		if (error == ENOENT)
1964 			error = ESRCH;
1965 		return (error);
1966 	}
1967 
1968 	p = strrchr(zc->zc_name, '/');
1969 	if (p == NULL || p[1] != '\0')
1970 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
1971 	p = zc->zc_name + strlen(zc->zc_name);
1972 
1973 	/*
1974 	 * Pre-fetch the datasets.  dmu_objset_prefetch() always returns 0
1975 	 * but is not declared void because its called by dmu_objset_find().
1976 	 */
1977 	if (zc->zc_cookie == 0) {
1978 		uint64_t cookie = 0;
1979 		int len = sizeof (zc->zc_name) - (p - zc->zc_name);
1980 
1981 		while (dmu_dir_list_next(os, len, p, NULL, &cookie) == 0) {
1982 			if (!dataset_name_hidden(zc->zc_name))
1983 				(void) dmu_objset_prefetch(zc->zc_name, NULL);
1984 		}
1985 	}
1986 
1987 	do {
1988 		error = dmu_dir_list_next(os,
1989 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
1990 		    NULL, &zc->zc_cookie);
1991 		if (error == ENOENT)
1992 			error = ESRCH;
1993 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
1994 	dmu_objset_rele(os, FTAG);
1995 
1996 	/*
1997 	 * If it's an internal dataset (ie. with a '$' in its name),
1998 	 * don't try to get stats for it, otherwise we'll return ENOENT.
1999 	 */
2000 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2001 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2002 		if (error == ENOENT) {
2003 			/* We lost a race with destroy, get the next one. */
2004 			zc->zc_name[orig_len] = '\0';
2005 			goto top;
2006 		}
2007 	}
2008 	return (error);
2009 }
2010 
2011 /*
2012  * inputs:
2013  * zc_name		name of filesystem
2014  * zc_cookie		zap cursor
2015  * zc_nvlist_dst_size	size of buffer for property nvlist
2016  *
2017  * outputs:
2018  * zc_name		name of next snapshot
2019  * zc_objset_stats	stats
2020  * zc_nvlist_dst	property nvlist
2021  * zc_nvlist_dst_size	size of property nvlist
2022  */
2023 static int
2024 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2025 {
2026 	objset_t *os;
2027 	int error;
2028 
2029 top:
2030 	if (zc->zc_cookie == 0)
2031 		(void) dmu_objset_find(zc->zc_name, dmu_objset_prefetch,
2032 		    NULL, DS_FIND_SNAPSHOTS);
2033 
2034 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2035 	if (error)
2036 		return (error == ENOENT ? ESRCH : error);
2037 
2038 	/*
2039 	 * A dataset name of maximum length cannot have any snapshots,
2040 	 * so exit immediately.
2041 	 */
2042 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
2043 		dmu_objset_rele(os, FTAG);
2044 		return (ESRCH);
2045 	}
2046 
2047 	error = dmu_snapshot_list_next(os,
2048 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2049 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2050 	    NULL);
2051 
2052 	if (error == 0) {
2053 		dsl_dataset_t *ds;
2054 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2055 
2056 		/*
2057 		 * Since we probably don't have a hold on this snapshot,
2058 		 * it's possible that the objsetid could have been destroyed
2059 		 * and reused for a new objset. It's OK if this happens during
2060 		 * a zfs send operation, since the new createtxg will be
2061 		 * beyond the range we're interested in.
2062 		 */
2063 		rw_enter(&dp->dp_config_rwlock, RW_READER);
2064 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2065 		rw_exit(&dp->dp_config_rwlock);
2066 		if (error) {
2067 			if (error == ENOENT) {
2068 				/* Racing with destroy, get the next one. */
2069 				*strchr(zc->zc_name, '@') = '\0';
2070 				dmu_objset_rele(os, FTAG);
2071 				goto top;
2072 			}
2073 		} else {
2074 			objset_t *ossnap;
2075 
2076 			error = dmu_objset_from_ds(ds, &ossnap);
2077 			if (error == 0)
2078 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2079 			dsl_dataset_rele(ds, FTAG);
2080 		}
2081 	} else if (error == ENOENT) {
2082 		error = ESRCH;
2083 	}
2084 
2085 	dmu_objset_rele(os, FTAG);
2086 	/* if we failed, undo the @ that we tacked on to zc_name */
2087 	if (error)
2088 		*strchr(zc->zc_name, '@') = '\0';
2089 	return (error);
2090 }
2091 
2092 static int
2093 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2094 {
2095 	const char *propname = nvpair_name(pair);
2096 	uint64_t *valary;
2097 	unsigned int vallen;
2098 	const char *domain;
2099 	char *dash;
2100 	zfs_userquota_prop_t type;
2101 	uint64_t rid;
2102 	uint64_t quota;
2103 	zfsvfs_t *zfsvfs;
2104 	int err;
2105 
2106 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2107 		nvlist_t *attrs;
2108 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2109 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2110 		    &pair) != 0)
2111 			return (EINVAL);
2112 	}
2113 
2114 	/*
2115 	 * A correctly constructed propname is encoded as
2116 	 * userquota@<rid>-<domain>.
2117 	 */
2118 	if ((dash = strchr(propname, '-')) == NULL ||
2119 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2120 	    vallen != 3)
2121 		return (EINVAL);
2122 
2123 	domain = dash + 1;
2124 	type = valary[0];
2125 	rid = valary[1];
2126 	quota = valary[2];
2127 
2128 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2129 	if (err == 0) {
2130 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2131 		zfsvfs_rele(zfsvfs, FTAG);
2132 	}
2133 
2134 	return (err);
2135 }
2136 
2137 /*
2138  * If the named property is one that has a special function to set its value,
2139  * return 0 on success and a positive error code on failure; otherwise if it is
2140  * not one of the special properties handled by this function, return -1.
2141  *
2142  * XXX: It would be better for callers of the property interface if we handled
2143  * these special cases in dsl_prop.c (in the dsl layer).
2144  */
2145 static int
2146 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2147     nvpair_t *pair)
2148 {
2149 	const char *propname = nvpair_name(pair);
2150 	zfs_prop_t prop = zfs_name_to_prop(propname);
2151 	uint64_t intval;
2152 	int err;
2153 
2154 	if (prop == ZPROP_INVAL) {
2155 		if (zfs_prop_userquota(propname))
2156 			return (zfs_prop_set_userquota(dsname, pair));
2157 		return (-1);
2158 	}
2159 
2160 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2161 		nvlist_t *attrs;
2162 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2163 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2164 		    &pair) == 0);
2165 	}
2166 
2167 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2168 		return (-1);
2169 
2170 	VERIFY(0 == nvpair_value_uint64(pair, &intval));
2171 
2172 	switch (prop) {
2173 	case ZFS_PROP_QUOTA:
2174 		err = dsl_dir_set_quota(dsname, source, intval);
2175 		break;
2176 	case ZFS_PROP_REFQUOTA:
2177 		err = dsl_dataset_set_quota(dsname, source, intval);
2178 		break;
2179 	case ZFS_PROP_RESERVATION:
2180 		err = dsl_dir_set_reservation(dsname, source, intval);
2181 		break;
2182 	case ZFS_PROP_REFRESERVATION:
2183 		err = dsl_dataset_set_reservation(dsname, source, intval);
2184 		break;
2185 	case ZFS_PROP_VOLSIZE:
2186 		err = zvol_set_volsize(dsname, ddi_driver_major(zfs_dip),
2187 		    intval);
2188 		break;
2189 	case ZFS_PROP_VERSION:
2190 	{
2191 		zfsvfs_t *zfsvfs;
2192 
2193 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2194 			break;
2195 
2196 		err = zfs_set_version(zfsvfs, intval);
2197 		zfsvfs_rele(zfsvfs, FTAG);
2198 
2199 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2200 			zfs_cmd_t *zc;
2201 
2202 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2203 			(void) strcpy(zc->zc_name, dsname);
2204 			(void) zfs_ioc_userspace_upgrade(zc);
2205 			kmem_free(zc, sizeof (zfs_cmd_t));
2206 		}
2207 		break;
2208 	}
2209 
2210 	default:
2211 		err = -1;
2212 	}
2213 
2214 	return (err);
2215 }
2216 
2217 /*
2218  * This function is best effort. If it fails to set any of the given properties,
2219  * it continues to set as many as it can and returns the first error
2220  * encountered. If the caller provides a non-NULL errlist, it also gives the
2221  * complete list of names of all the properties it failed to set along with the
2222  * corresponding error numbers. The caller is responsible for freeing the
2223  * returned errlist.
2224  *
2225  * If every property is set successfully, zero is returned and the list pointed
2226  * at by errlist is NULL.
2227  */
2228 int
2229 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2230     nvlist_t **errlist)
2231 {
2232 	nvpair_t *pair;
2233 	nvpair_t *propval;
2234 	int rv = 0;
2235 	uint64_t intval;
2236 	char *strval;
2237 	nvlist_t *genericnvl;
2238 	nvlist_t *errors;
2239 	nvlist_t *retrynvl;
2240 
2241 	VERIFY(nvlist_alloc(&genericnvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2242 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2243 	VERIFY(nvlist_alloc(&retrynvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2244 
2245 retry:
2246 	pair = NULL;
2247 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2248 		const char *propname = nvpair_name(pair);
2249 		zfs_prop_t prop = zfs_name_to_prop(propname);
2250 		int err = 0;
2251 
2252 		/* decode the property value */
2253 		propval = pair;
2254 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2255 			nvlist_t *attrs;
2256 			VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2257 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2258 			    &propval) != 0)
2259 				err = EINVAL;
2260 		}
2261 
2262 		/* Validate value type */
2263 		if (err == 0 && prop == ZPROP_INVAL) {
2264 			if (zfs_prop_user(propname)) {
2265 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2266 					err = EINVAL;
2267 			} else if (zfs_prop_userquota(propname)) {
2268 				if (nvpair_type(propval) !=
2269 				    DATA_TYPE_UINT64_ARRAY)
2270 					err = EINVAL;
2271 			} else {
2272 				err = EINVAL;
2273 			}
2274 		} else if (err == 0) {
2275 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2276 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2277 					err = EINVAL;
2278 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2279 				const char *unused;
2280 
2281 				VERIFY(nvpair_value_uint64(propval,
2282 				    &intval) == 0);
2283 
2284 				switch (zfs_prop_get_type(prop)) {
2285 				case PROP_TYPE_NUMBER:
2286 					break;
2287 				case PROP_TYPE_STRING:
2288 					err = EINVAL;
2289 					break;
2290 				case PROP_TYPE_INDEX:
2291 					if (zfs_prop_index_to_string(prop,
2292 					    intval, &unused) != 0)
2293 						err = EINVAL;
2294 					break;
2295 				default:
2296 					cmn_err(CE_PANIC,
2297 					    "unknown property type");
2298 				}
2299 			} else {
2300 				err = EINVAL;
2301 			}
2302 		}
2303 
2304 		/* Validate permissions */
2305 		if (err == 0)
2306 			err = zfs_check_settable(dsname, pair, CRED());
2307 
2308 		if (err == 0) {
2309 			err = zfs_prop_set_special(dsname, source, pair);
2310 			if (err == -1) {
2311 				/*
2312 				 * For better performance we build up a list of
2313 				 * properties to set in a single transaction.
2314 				 */
2315 				err = nvlist_add_nvpair(genericnvl, pair);
2316 			} else if (err != 0 && nvl != retrynvl) {
2317 				/*
2318 				 * This may be a spurious error caused by
2319 				 * receiving quota and reservation out of order.
2320 				 * Try again in a second pass.
2321 				 */
2322 				err = nvlist_add_nvpair(retrynvl, pair);
2323 			}
2324 		}
2325 
2326 		if (err != 0)
2327 			VERIFY(nvlist_add_int32(errors, propname, err) == 0);
2328 	}
2329 
2330 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2331 		nvl = retrynvl;
2332 		goto retry;
2333 	}
2334 
2335 	if (!nvlist_empty(genericnvl) &&
2336 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2337 		/*
2338 		 * If this fails, we still want to set as many properties as we
2339 		 * can, so try setting them individually.
2340 		 */
2341 		pair = NULL;
2342 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2343 			const char *propname = nvpair_name(pair);
2344 			int err = 0;
2345 
2346 			propval = pair;
2347 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2348 				nvlist_t *attrs;
2349 				VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2350 				VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2351 				    &propval) == 0);
2352 			}
2353 
2354 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2355 				VERIFY(nvpair_value_string(propval,
2356 				    &strval) == 0);
2357 				err = dsl_prop_set(dsname, propname, source, 1,
2358 				    strlen(strval) + 1, strval);
2359 			} else {
2360 				VERIFY(nvpair_value_uint64(propval,
2361 				    &intval) == 0);
2362 				err = dsl_prop_set(dsname, propname, source, 8,
2363 				    1, &intval);
2364 			}
2365 
2366 			if (err != 0) {
2367 				VERIFY(nvlist_add_int32(errors, propname,
2368 				    err) == 0);
2369 			}
2370 		}
2371 	}
2372 	nvlist_free(genericnvl);
2373 	nvlist_free(retrynvl);
2374 
2375 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
2376 		nvlist_free(errors);
2377 		errors = NULL;
2378 	} else {
2379 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
2380 	}
2381 
2382 	if (errlist == NULL)
2383 		nvlist_free(errors);
2384 	else
2385 		*errlist = errors;
2386 
2387 	return (rv);
2388 }
2389 
2390 /*
2391  * Check that all the properties are valid user properties.
2392  */
2393 static int
2394 zfs_check_userprops(char *fsname, nvlist_t *nvl)
2395 {
2396 	nvpair_t *pair = NULL;
2397 	int error = 0;
2398 
2399 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2400 		const char *propname = nvpair_name(pair);
2401 		char *valstr;
2402 
2403 		if (!zfs_prop_user(propname) ||
2404 		    nvpair_type(pair) != DATA_TYPE_STRING)
2405 			return (EINVAL);
2406 
2407 		if (error = zfs_secpolicy_write_perms(fsname,
2408 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2409 			return (error);
2410 
2411 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2412 			return (ENAMETOOLONG);
2413 
2414 		VERIFY(nvpair_value_string(pair, &valstr) == 0);
2415 		if (strlen(valstr) >= ZAP_MAXVALUELEN)
2416 			return (E2BIG);
2417 	}
2418 	return (0);
2419 }
2420 
2421 static void
2422 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2423 {
2424 	nvpair_t *pair;
2425 
2426 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2427 
2428 	pair = NULL;
2429 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2430 		if (nvlist_exists(skipped, nvpair_name(pair)))
2431 			continue;
2432 
2433 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2434 	}
2435 }
2436 
2437 static int
2438 clear_received_props(objset_t *os, const char *fs, nvlist_t *props,
2439     nvlist_t *skipped)
2440 {
2441 	int err = 0;
2442 	nvlist_t *cleared_props = NULL;
2443 	props_skip(props, skipped, &cleared_props);
2444 	if (!nvlist_empty(cleared_props)) {
2445 		/*
2446 		 * Acts on local properties until the dataset has received
2447 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2448 		 */
2449 		zprop_source_t flags = (ZPROP_SRC_NONE |
2450 		    (dsl_prop_get_hasrecvd(os) ? ZPROP_SRC_RECEIVED : 0));
2451 		err = zfs_set_prop_nvlist(fs, flags, cleared_props, NULL);
2452 	}
2453 	nvlist_free(cleared_props);
2454 	return (err);
2455 }
2456 
2457 /*
2458  * inputs:
2459  * zc_name		name of filesystem
2460  * zc_value		name of property to set
2461  * zc_nvlist_src{_size}	nvlist of properties to apply
2462  * zc_cookie		received properties flag
2463  *
2464  * outputs:
2465  * zc_nvlist_dst{_size} error for each unapplied received property
2466  */
2467 static int
2468 zfs_ioc_set_prop(zfs_cmd_t *zc)
2469 {
2470 	nvlist_t *nvl;
2471 	boolean_t received = zc->zc_cookie;
2472 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2473 	    ZPROP_SRC_LOCAL);
2474 	nvlist_t *errors = NULL;
2475 	int error;
2476 
2477 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2478 	    zc->zc_iflags, &nvl)) != 0)
2479 		return (error);
2480 
2481 	if (received) {
2482 		nvlist_t *origprops;
2483 		objset_t *os;
2484 
2485 		if (dmu_objset_hold(zc->zc_name, FTAG, &os) == 0) {
2486 			if (dsl_prop_get_received(os, &origprops) == 0) {
2487 				(void) clear_received_props(os,
2488 				    zc->zc_name, origprops, nvl);
2489 				nvlist_free(origprops);
2490 			}
2491 
2492 			dsl_prop_set_hasrecvd(os);
2493 			dmu_objset_rele(os, FTAG);
2494 		}
2495 	}
2496 
2497 	error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, &errors);
2498 
2499 	if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2500 		(void) put_nvlist(zc, errors);
2501 	}
2502 
2503 	nvlist_free(errors);
2504 	nvlist_free(nvl);
2505 	return (error);
2506 }
2507 
2508 /*
2509  * inputs:
2510  * zc_name		name of filesystem
2511  * zc_value		name of property to inherit
2512  * zc_cookie		revert to received value if TRUE
2513  *
2514  * outputs:		none
2515  */
2516 static int
2517 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2518 {
2519 	const char *propname = zc->zc_value;
2520 	zfs_prop_t prop = zfs_name_to_prop(propname);
2521 	boolean_t received = zc->zc_cookie;
2522 	zprop_source_t source = (received
2523 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2524 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2525 
2526 	if (received) {
2527 		nvlist_t *dummy;
2528 		nvpair_t *pair;
2529 		zprop_type_t type;
2530 		int err;
2531 
2532 		/*
2533 		 * zfs_prop_set_special() expects properties in the form of an
2534 		 * nvpair with type info.
2535 		 */
2536 		if (prop == ZPROP_INVAL) {
2537 			if (!zfs_prop_user(propname))
2538 				return (EINVAL);
2539 
2540 			type = PROP_TYPE_STRING;
2541 		} else if (prop == ZFS_PROP_VOLSIZE ||
2542 		    prop == ZFS_PROP_VERSION) {
2543 			return (EINVAL);
2544 		} else {
2545 			type = zfs_prop_get_type(prop);
2546 		}
2547 
2548 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2549 
2550 		switch (type) {
2551 		case PROP_TYPE_STRING:
2552 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2553 			break;
2554 		case PROP_TYPE_NUMBER:
2555 		case PROP_TYPE_INDEX:
2556 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2557 			break;
2558 		default:
2559 			nvlist_free(dummy);
2560 			return (EINVAL);
2561 		}
2562 
2563 		pair = nvlist_next_nvpair(dummy, NULL);
2564 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2565 		nvlist_free(dummy);
2566 		if (err != -1)
2567 			return (err); /* special property already handled */
2568 	} else {
2569 		/*
2570 		 * Only check this in the non-received case. We want to allow
2571 		 * 'inherit -S' to revert non-inheritable properties like quota
2572 		 * and reservation to the received or default values even though
2573 		 * they are not considered inheritable.
2574 		 */
2575 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2576 			return (EINVAL);
2577 	}
2578 
2579 	/* the property name has been validated by zfs_secpolicy_inherit() */
2580 	return (dsl_prop_set(zc->zc_name, zc->zc_value, source, 0, 0, NULL));
2581 }
2582 
2583 static int
2584 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2585 {
2586 	nvlist_t *props;
2587 	spa_t *spa;
2588 	int error;
2589 	nvpair_t *pair;
2590 
2591 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2592 	    zc->zc_iflags, &props))
2593 		return (error);
2594 
2595 	/*
2596 	 * If the only property is the configfile, then just do a spa_lookup()
2597 	 * to handle the faulted case.
2598 	 */
2599 	pair = nvlist_next_nvpair(props, NULL);
2600 	if (pair != NULL && strcmp(nvpair_name(pair),
2601 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2602 	    nvlist_next_nvpair(props, pair) == NULL) {
2603 		mutex_enter(&spa_namespace_lock);
2604 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2605 			spa_configfile_set(spa, props, B_FALSE);
2606 			spa_config_sync(spa, B_FALSE, B_TRUE);
2607 		}
2608 		mutex_exit(&spa_namespace_lock);
2609 		if (spa != NULL) {
2610 			nvlist_free(props);
2611 			return (0);
2612 		}
2613 	}
2614 
2615 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2616 		nvlist_free(props);
2617 		return (error);
2618 	}
2619 
2620 	error = spa_prop_set(spa, props);
2621 
2622 	nvlist_free(props);
2623 	spa_close(spa, FTAG);
2624 
2625 	return (error);
2626 }
2627 
2628 static int
2629 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2630 {
2631 	spa_t *spa;
2632 	int error;
2633 	nvlist_t *nvp = NULL;
2634 
2635 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2636 		/*
2637 		 * If the pool is faulted, there may be properties we can still
2638 		 * get (such as altroot and cachefile), so attempt to get them
2639 		 * anyway.
2640 		 */
2641 		mutex_enter(&spa_namespace_lock);
2642 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
2643 			error = spa_prop_get(spa, &nvp);
2644 		mutex_exit(&spa_namespace_lock);
2645 	} else {
2646 		error = spa_prop_get(spa, &nvp);
2647 		spa_close(spa, FTAG);
2648 	}
2649 
2650 	if (error == 0 && zc->zc_nvlist_dst != NULL)
2651 		error = put_nvlist(zc, nvp);
2652 	else
2653 		error = EFAULT;
2654 
2655 	nvlist_free(nvp);
2656 	return (error);
2657 }
2658 
2659 /*
2660  * inputs:
2661  * zc_name		name of filesystem
2662  * zc_nvlist_src{_size}	nvlist of delegated permissions
2663  * zc_perm_action	allow/unallow flag
2664  *
2665  * outputs:		none
2666  */
2667 static int
2668 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2669 {
2670 	int error;
2671 	nvlist_t *fsaclnv = NULL;
2672 
2673 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2674 	    zc->zc_iflags, &fsaclnv)) != 0)
2675 		return (error);
2676 
2677 	/*
2678 	 * Verify nvlist is constructed correctly
2679 	 */
2680 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2681 		nvlist_free(fsaclnv);
2682 		return (EINVAL);
2683 	}
2684 
2685 	/*
2686 	 * If we don't have PRIV_SYS_MOUNT, then validate
2687 	 * that user is allowed to hand out each permission in
2688 	 * the nvlist(s)
2689 	 */
2690 
2691 	error = secpolicy_zfs(CRED());
2692 	if (error) {
2693 		if (zc->zc_perm_action == B_FALSE) {
2694 			error = dsl_deleg_can_allow(zc->zc_name,
2695 			    fsaclnv, CRED());
2696 		} else {
2697 			error = dsl_deleg_can_unallow(zc->zc_name,
2698 			    fsaclnv, CRED());
2699 		}
2700 	}
2701 
2702 	if (error == 0)
2703 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2704 
2705 	nvlist_free(fsaclnv);
2706 	return (error);
2707 }
2708 
2709 /*
2710  * inputs:
2711  * zc_name		name of filesystem
2712  *
2713  * outputs:
2714  * zc_nvlist_src{_size}	nvlist of delegated permissions
2715  */
2716 static int
2717 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
2718 {
2719 	nvlist_t *nvp;
2720 	int error;
2721 
2722 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
2723 		error = put_nvlist(zc, nvp);
2724 		nvlist_free(nvp);
2725 	}
2726 
2727 	return (error);
2728 }
2729 
2730 /*
2731  * Search the vfs list for a specified resource.  Returns a pointer to it
2732  * or NULL if no suitable entry is found. The caller of this routine
2733  * is responsible for releasing the returned vfs pointer.
2734  */
2735 static vfs_t *
2736 zfs_get_vfs(const char *resource)
2737 {
2738 	struct vfs *vfsp;
2739 	struct vfs *vfs_found = NULL;
2740 
2741 	vfs_list_read_lock();
2742 	vfsp = rootvfs;
2743 	do {
2744 		if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
2745 			VFS_HOLD(vfsp);
2746 			vfs_found = vfsp;
2747 			break;
2748 		}
2749 		vfsp = vfsp->vfs_next;
2750 	} while (vfsp != rootvfs);
2751 	vfs_list_unlock();
2752 	return (vfs_found);
2753 }
2754 
2755 /* ARGSUSED */
2756 static void
2757 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
2758 {
2759 	zfs_creat_t *zct = arg;
2760 
2761 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
2762 }
2763 
2764 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
2765 
2766 /*
2767  * inputs:
2768  * createprops		list of properties requested by creator
2769  * default_zplver	zpl version to use if unspecified in createprops
2770  * fuids_ok		fuids allowed in this version of the spa?
2771  * os			parent objset pointer (NULL if root fs)
2772  *
2773  * outputs:
2774  * zplprops	values for the zplprops we attach to the master node object
2775  * is_ci	true if requested file system will be purely case-insensitive
2776  *
2777  * Determine the settings for utf8only, normalization and
2778  * casesensitivity.  Specific values may have been requested by the
2779  * creator and/or we can inherit values from the parent dataset.  If
2780  * the file system is of too early a vintage, a creator can not
2781  * request settings for these properties, even if the requested
2782  * setting is the default value.  We don't actually want to create dsl
2783  * properties for these, so remove them from the source nvlist after
2784  * processing.
2785  */
2786 static int
2787 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
2788     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
2789     nvlist_t *zplprops, boolean_t *is_ci)
2790 {
2791 	uint64_t sense = ZFS_PROP_UNDEFINED;
2792 	uint64_t norm = ZFS_PROP_UNDEFINED;
2793 	uint64_t u8 = ZFS_PROP_UNDEFINED;
2794 
2795 	ASSERT(zplprops != NULL);
2796 
2797 	/*
2798 	 * Pull out creator prop choices, if any.
2799 	 */
2800 	if (createprops) {
2801 		(void) nvlist_lookup_uint64(createprops,
2802 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
2803 		(void) nvlist_lookup_uint64(createprops,
2804 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
2805 		(void) nvlist_remove_all(createprops,
2806 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
2807 		(void) nvlist_lookup_uint64(createprops,
2808 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
2809 		(void) nvlist_remove_all(createprops,
2810 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
2811 		(void) nvlist_lookup_uint64(createprops,
2812 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
2813 		(void) nvlist_remove_all(createprops,
2814 		    zfs_prop_to_name(ZFS_PROP_CASE));
2815 	}
2816 
2817 	/*
2818 	 * If the zpl version requested is whacky or the file system
2819 	 * or pool is version is too "young" to support normalization
2820 	 * and the creator tried to set a value for one of the props,
2821 	 * error out.
2822 	 */
2823 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
2824 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
2825 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
2826 	    (zplver < ZPL_VERSION_NORMALIZATION &&
2827 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
2828 	    sense != ZFS_PROP_UNDEFINED)))
2829 		return (ENOTSUP);
2830 
2831 	/*
2832 	 * Put the version in the zplprops
2833 	 */
2834 	VERIFY(nvlist_add_uint64(zplprops,
2835 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
2836 
2837 	if (norm == ZFS_PROP_UNDEFINED)
2838 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
2839 	VERIFY(nvlist_add_uint64(zplprops,
2840 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
2841 
2842 	/*
2843 	 * If we're normalizing, names must always be valid UTF-8 strings.
2844 	 */
2845 	if (norm)
2846 		u8 = 1;
2847 	if (u8 == ZFS_PROP_UNDEFINED)
2848 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
2849 	VERIFY(nvlist_add_uint64(zplprops,
2850 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
2851 
2852 	if (sense == ZFS_PROP_UNDEFINED)
2853 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
2854 	VERIFY(nvlist_add_uint64(zplprops,
2855 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
2856 
2857 	if (is_ci)
2858 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
2859 
2860 	return (0);
2861 }
2862 
2863 static int
2864 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
2865     nvlist_t *zplprops, boolean_t *is_ci)
2866 {
2867 	boolean_t fuids_ok, sa_ok;
2868 	uint64_t zplver = ZPL_VERSION;
2869 	objset_t *os = NULL;
2870 	char parentname[MAXNAMELEN];
2871 	char *cp;
2872 	spa_t *spa;
2873 	uint64_t spa_vers;
2874 	int error;
2875 
2876 	(void) strlcpy(parentname, dataset, sizeof (parentname));
2877 	cp = strrchr(parentname, '/');
2878 	ASSERT(cp != NULL);
2879 	cp[0] = '\0';
2880 
2881 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
2882 		return (error);
2883 
2884 	spa_vers = spa_version(spa);
2885 	spa_close(spa, FTAG);
2886 
2887 	zplver = zfs_zpl_version_map(spa_vers);
2888 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
2889 	sa_ok = (zplver >= ZPL_VERSION_SA);
2890 
2891 	/*
2892 	 * Open parent object set so we can inherit zplprop values.
2893 	 */
2894 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
2895 		return (error);
2896 
2897 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
2898 	    zplprops, is_ci);
2899 	dmu_objset_rele(os, FTAG);
2900 	return (error);
2901 }
2902 
2903 static int
2904 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
2905     nvlist_t *zplprops, boolean_t *is_ci)
2906 {
2907 	boolean_t fuids_ok;
2908 	boolean_t sa_ok;
2909 	uint64_t zplver = ZPL_VERSION;
2910 	int error;
2911 
2912 	zplver = zfs_zpl_version_map(spa_vers);
2913 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
2914 	sa_ok = (zplver >= ZPL_VERSION_SA);
2915 
2916 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
2917 	    createprops, zplprops, is_ci);
2918 	return (error);
2919 }
2920 
2921 /*
2922  * inputs:
2923  * zc_objset_type	type of objset to create (fs vs zvol)
2924  * zc_name		name of new objset
2925  * zc_value		name of snapshot to clone from (may be empty)
2926  * zc_nvlist_src{_size}	nvlist of properties to apply
2927  *
2928  * outputs: none
2929  */
2930 static int
2931 zfs_ioc_create(zfs_cmd_t *zc)
2932 {
2933 	objset_t *clone;
2934 	int error = 0;
2935 	zfs_creat_t zct;
2936 	nvlist_t *nvprops = NULL;
2937 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
2938 	dmu_objset_type_t type = zc->zc_objset_type;
2939 
2940 	switch (type) {
2941 
2942 	case DMU_OST_ZFS:
2943 		cbfunc = zfs_create_cb;
2944 		break;
2945 
2946 	case DMU_OST_ZVOL:
2947 		cbfunc = zvol_create_cb;
2948 		break;
2949 
2950 	default:
2951 		cbfunc = NULL;
2952 		break;
2953 	}
2954 	if (strchr(zc->zc_name, '@') ||
2955 	    strchr(zc->zc_name, '%'))
2956 		return (EINVAL);
2957 
2958 	if (zc->zc_nvlist_src != NULL &&
2959 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2960 	    zc->zc_iflags, &nvprops)) != 0)
2961 		return (error);
2962 
2963 	zct.zct_zplprops = NULL;
2964 	zct.zct_props = nvprops;
2965 
2966 	if (zc->zc_value[0] != '\0') {
2967 		/*
2968 		 * We're creating a clone of an existing snapshot.
2969 		 */
2970 		zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
2971 		if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0) {
2972 			nvlist_free(nvprops);
2973 			return (EINVAL);
2974 		}
2975 
2976 		error = dmu_objset_hold(zc->zc_value, FTAG, &clone);
2977 		if (error) {
2978 			nvlist_free(nvprops);
2979 			return (error);
2980 		}
2981 
2982 		error = dmu_objset_clone(zc->zc_name, dmu_objset_ds(clone), 0);
2983 		dmu_objset_rele(clone, FTAG);
2984 		if (error) {
2985 			nvlist_free(nvprops);
2986 			return (error);
2987 		}
2988 	} else {
2989 		boolean_t is_insensitive = B_FALSE;
2990 
2991 		if (cbfunc == NULL) {
2992 			nvlist_free(nvprops);
2993 			return (EINVAL);
2994 		}
2995 
2996 		if (type == DMU_OST_ZVOL) {
2997 			uint64_t volsize, volblocksize;
2998 
2999 			if (nvprops == NULL ||
3000 			    nvlist_lookup_uint64(nvprops,
3001 			    zfs_prop_to_name(ZFS_PROP_VOLSIZE),
3002 			    &volsize) != 0) {
3003 				nvlist_free(nvprops);
3004 				return (EINVAL);
3005 			}
3006 
3007 			if ((error = nvlist_lookup_uint64(nvprops,
3008 			    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3009 			    &volblocksize)) != 0 && error != ENOENT) {
3010 				nvlist_free(nvprops);
3011 				return (EINVAL);
3012 			}
3013 
3014 			if (error != 0)
3015 				volblocksize = zfs_prop_default_numeric(
3016 				    ZFS_PROP_VOLBLOCKSIZE);
3017 
3018 			if ((error = zvol_check_volblocksize(
3019 			    volblocksize)) != 0 ||
3020 			    (error = zvol_check_volsize(volsize,
3021 			    volblocksize)) != 0) {
3022 				nvlist_free(nvprops);
3023 				return (error);
3024 			}
3025 		} else if (type == DMU_OST_ZFS) {
3026 			int error;
3027 
3028 			/*
3029 			 * We have to have normalization and
3030 			 * case-folding flags correct when we do the
3031 			 * file system creation, so go figure them out
3032 			 * now.
3033 			 */
3034 			VERIFY(nvlist_alloc(&zct.zct_zplprops,
3035 			    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3036 			error = zfs_fill_zplprops(zc->zc_name, nvprops,
3037 			    zct.zct_zplprops, &is_insensitive);
3038 			if (error != 0) {
3039 				nvlist_free(nvprops);
3040 				nvlist_free(zct.zct_zplprops);
3041 				return (error);
3042 			}
3043 		}
3044 		error = dmu_objset_create(zc->zc_name, type,
3045 		    is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3046 		nvlist_free(zct.zct_zplprops);
3047 	}
3048 
3049 	/*
3050 	 * It would be nice to do this atomically.
3051 	 */
3052 	if (error == 0) {
3053 		error = zfs_set_prop_nvlist(zc->zc_name, ZPROP_SRC_LOCAL,
3054 		    nvprops, NULL);
3055 		if (error != 0)
3056 			(void) dmu_objset_destroy(zc->zc_name, B_FALSE);
3057 	}
3058 	nvlist_free(nvprops);
3059 	return (error);
3060 }
3061 
3062 /*
3063  * inputs:
3064  * zc_name	name of filesystem
3065  * zc_value	short name of snapshot
3066  * zc_cookie	recursive flag
3067  * zc_nvlist_src[_size] property list
3068  *
3069  * outputs:
3070  * zc_value	short snapname (i.e. part after the '@')
3071  */
3072 static int
3073 zfs_ioc_snapshot(zfs_cmd_t *zc)
3074 {
3075 	nvlist_t *nvprops = NULL;
3076 	int error;
3077 	boolean_t recursive = zc->zc_cookie;
3078 
3079 	if (snapshot_namecheck(zc->zc_value, NULL, NULL) != 0)
3080 		return (EINVAL);
3081 
3082 	if (zc->zc_nvlist_src != NULL &&
3083 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3084 	    zc->zc_iflags, &nvprops)) != 0)
3085 		return (error);
3086 
3087 	error = zfs_check_userprops(zc->zc_name, nvprops);
3088 	if (error)
3089 		goto out;
3090 
3091 	if (!nvlist_empty(nvprops) &&
3092 	    zfs_earlier_version(zc->zc_name, SPA_VERSION_SNAP_PROPS)) {
3093 		error = ENOTSUP;
3094 		goto out;
3095 	}
3096 
3097 	error = dmu_objset_snapshot(zc->zc_name, zc->zc_value, NULL,
3098 	    nvprops, recursive, B_FALSE, -1);
3099 
3100 out:
3101 	nvlist_free(nvprops);
3102 	return (error);
3103 }
3104 
3105 int
3106 zfs_unmount_snap(const char *name, void *arg)
3107 {
3108 	vfs_t *vfsp = NULL;
3109 
3110 	if (arg) {
3111 		char *snapname = arg;
3112 		char *fullname = kmem_asprintf("%s@%s", name, snapname);
3113 		vfsp = zfs_get_vfs(fullname);
3114 		strfree(fullname);
3115 	} else if (strchr(name, '@')) {
3116 		vfsp = zfs_get_vfs(name);
3117 	}
3118 
3119 	if (vfsp) {
3120 		/*
3121 		 * Always force the unmount for snapshots.
3122 		 */
3123 		int flag = MS_FORCE;
3124 		int err;
3125 
3126 		if ((err = vn_vfswlock(vfsp->vfs_vnodecovered)) != 0) {
3127 			VFS_RELE(vfsp);
3128 			return (err);
3129 		}
3130 		VFS_RELE(vfsp);
3131 		if ((err = dounmount(vfsp, flag, kcred)) != 0)
3132 			return (err);
3133 	}
3134 	return (0);
3135 }
3136 
3137 /*
3138  * inputs:
3139  * zc_name		name of filesystem, snaps must be under it
3140  * zc_nvlist_src[_size]	full names of snapshots to destroy
3141  * zc_defer_destroy	mark for deferred destroy
3142  *
3143  * outputs:
3144  * zc_name		on failure, name of failed snapshot
3145  */
3146 static int
3147 zfs_ioc_destroy_snaps_nvl(zfs_cmd_t *zc)
3148 {
3149 	int err, len;
3150 	nvlist_t *nvl;
3151 	nvpair_t *pair;
3152 
3153 	if ((err = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3154 	    zc->zc_iflags, &nvl)) != 0)
3155 		return (err);
3156 
3157 	len = strlen(zc->zc_name);
3158 	for (pair = nvlist_next_nvpair(nvl, NULL); pair != NULL;
3159 	    pair = nvlist_next_nvpair(nvl, pair)) {
3160 		const char *name = nvpair_name(pair);
3161 		/*
3162 		 * The snap name must be underneath the zc_name.  This ensures
3163 		 * that our permission checks were legitimate.
3164 		 */
3165 		if (strncmp(zc->zc_name, name, len) != 0 ||
3166 		    (name[len] != '@' && name[len] != '/')) {
3167 			nvlist_free(nvl);
3168 			return (EINVAL);
3169 		}
3170 
3171 		(void) zfs_unmount_snap(name, NULL);
3172 	}
3173 
3174 	err = dmu_snapshots_destroy_nvl(nvl, zc->zc_defer_destroy,
3175 	    zc->zc_name);
3176 	nvlist_free(nvl);
3177 	return (err);
3178 }
3179 
3180 /*
3181  * inputs:
3182  * zc_name		name of dataset to destroy
3183  * zc_objset_type	type of objset
3184  * zc_defer_destroy	mark for deferred destroy
3185  *
3186  * outputs:		none
3187  */
3188 static int
3189 zfs_ioc_destroy(zfs_cmd_t *zc)
3190 {
3191 	int err;
3192 	if (strchr(zc->zc_name, '@') && zc->zc_objset_type == DMU_OST_ZFS) {
3193 		err = zfs_unmount_snap(zc->zc_name, NULL);
3194 		if (err)
3195 			return (err);
3196 	}
3197 
3198 	err = dmu_objset_destroy(zc->zc_name, zc->zc_defer_destroy);
3199 	if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3200 		(void) zvol_remove_minor(zc->zc_name);
3201 	return (err);
3202 }
3203 
3204 /*
3205  * inputs:
3206  * zc_name	name of dataset to rollback (to most recent snapshot)
3207  *
3208  * outputs:	none
3209  */
3210 static int
3211 zfs_ioc_rollback(zfs_cmd_t *zc)
3212 {
3213 	dsl_dataset_t *ds, *clone;
3214 	int error;
3215 	zfsvfs_t *zfsvfs;
3216 	char *clone_name;
3217 
3218 	error = dsl_dataset_hold(zc->zc_name, FTAG, &ds);
3219 	if (error)
3220 		return (error);
3221 
3222 	/* must not be a snapshot */
3223 	if (dsl_dataset_is_snapshot(ds)) {
3224 		dsl_dataset_rele(ds, FTAG);
3225 		return (EINVAL);
3226 	}
3227 
3228 	/* must have a most recent snapshot */
3229 	if (ds->ds_phys->ds_prev_snap_txg < TXG_INITIAL) {
3230 		dsl_dataset_rele(ds, FTAG);
3231 		return (EINVAL);
3232 	}
3233 
3234 	/*
3235 	 * Create clone of most recent snapshot.
3236 	 */
3237 	clone_name = kmem_asprintf("%s/%%rollback", zc->zc_name);
3238 	error = dmu_objset_clone(clone_name, ds->ds_prev, DS_FLAG_INCONSISTENT);
3239 	if (error)
3240 		goto out;
3241 
3242 	error = dsl_dataset_own(clone_name, B_TRUE, FTAG, &clone);
3243 	if (error)
3244 		goto out;
3245 
3246 	/*
3247 	 * Do clone swap.
3248 	 */
3249 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
3250 		error = zfs_suspend_fs(zfsvfs);
3251 		if (error == 0) {
3252 			int resume_err;
3253 
3254 			if (dsl_dataset_tryown(ds, B_FALSE, FTAG)) {
3255 				error = dsl_dataset_clone_swap(clone, ds,
3256 				    B_TRUE);
3257 				dsl_dataset_disown(ds, FTAG);
3258 				ds = NULL;
3259 			} else {
3260 				error = EBUSY;
3261 			}
3262 			resume_err = zfs_resume_fs(zfsvfs, zc->zc_name);
3263 			error = error ? error : resume_err;
3264 		}
3265 		VFS_RELE(zfsvfs->z_vfs);
3266 	} else {
3267 		if (dsl_dataset_tryown(ds, B_FALSE, FTAG)) {
3268 			error = dsl_dataset_clone_swap(clone, ds, B_TRUE);
3269 			dsl_dataset_disown(ds, FTAG);
3270 			ds = NULL;
3271 		} else {
3272 			error = EBUSY;
3273 		}
3274 	}
3275 
3276 	/*
3277 	 * Destroy clone (which also closes it).
3278 	 */
3279 	(void) dsl_dataset_destroy(clone, FTAG, B_FALSE);
3280 
3281 out:
3282 	strfree(clone_name);
3283 	if (ds)
3284 		dsl_dataset_rele(ds, FTAG);
3285 	return (error);
3286 }
3287 
3288 /*
3289  * inputs:
3290  * zc_name	old name of dataset
3291  * zc_value	new name of dataset
3292  * zc_cookie	recursive flag (only valid for snapshots)
3293  *
3294  * outputs:	none
3295  */
3296 static int
3297 zfs_ioc_rename(zfs_cmd_t *zc)
3298 {
3299 	boolean_t recursive = zc->zc_cookie & 1;
3300 
3301 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3302 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3303 	    strchr(zc->zc_value, '%'))
3304 		return (EINVAL);
3305 
3306 	/*
3307 	 * Unmount snapshot unless we're doing a recursive rename,
3308 	 * in which case the dataset code figures out which snapshots
3309 	 * to unmount.
3310 	 */
3311 	if (!recursive && strchr(zc->zc_name, '@') != NULL &&
3312 	    zc->zc_objset_type == DMU_OST_ZFS) {
3313 		int err = zfs_unmount_snap(zc->zc_name, NULL);
3314 		if (err)
3315 			return (err);
3316 	}
3317 	if (zc->zc_objset_type == DMU_OST_ZVOL)
3318 		(void) zvol_remove_minor(zc->zc_name);
3319 	return (dmu_objset_rename(zc->zc_name, zc->zc_value, recursive));
3320 }
3321 
3322 static int
3323 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3324 {
3325 	const char *propname = nvpair_name(pair);
3326 	boolean_t issnap = (strchr(dsname, '@') != NULL);
3327 	zfs_prop_t prop = zfs_name_to_prop(propname);
3328 	uint64_t intval;
3329 	int err;
3330 
3331 	if (prop == ZPROP_INVAL) {
3332 		if (zfs_prop_user(propname)) {
3333 			if (err = zfs_secpolicy_write_perms(dsname,
3334 			    ZFS_DELEG_PERM_USERPROP, cr))
3335 				return (err);
3336 			return (0);
3337 		}
3338 
3339 		if (!issnap && zfs_prop_userquota(propname)) {
3340 			const char *perm = NULL;
3341 			const char *uq_prefix =
3342 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3343 			const char *gq_prefix =
3344 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3345 
3346 			if (strncmp(propname, uq_prefix,
3347 			    strlen(uq_prefix)) == 0) {
3348 				perm = ZFS_DELEG_PERM_USERQUOTA;
3349 			} else if (strncmp(propname, gq_prefix,
3350 			    strlen(gq_prefix)) == 0) {
3351 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
3352 			} else {
3353 				/* USERUSED and GROUPUSED are read-only */
3354 				return (EINVAL);
3355 			}
3356 
3357 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3358 				return (err);
3359 			return (0);
3360 		}
3361 
3362 		return (EINVAL);
3363 	}
3364 
3365 	if (issnap)
3366 		return (EINVAL);
3367 
3368 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3369 		/*
3370 		 * dsl_prop_get_all_impl() returns properties in this
3371 		 * format.
3372 		 */
3373 		nvlist_t *attrs;
3374 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3375 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3376 		    &pair) == 0);
3377 	}
3378 
3379 	/*
3380 	 * Check that this value is valid for this pool version
3381 	 */
3382 	switch (prop) {
3383 	case ZFS_PROP_COMPRESSION:
3384 		/*
3385 		 * If the user specified gzip compression, make sure
3386 		 * the SPA supports it. We ignore any errors here since
3387 		 * we'll catch them later.
3388 		 */
3389 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3390 		    nvpair_value_uint64(pair, &intval) == 0) {
3391 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
3392 			    intval <= ZIO_COMPRESS_GZIP_9 &&
3393 			    zfs_earlier_version(dsname,
3394 			    SPA_VERSION_GZIP_COMPRESSION)) {
3395 				return (ENOTSUP);
3396 			}
3397 
3398 			if (intval == ZIO_COMPRESS_ZLE &&
3399 			    zfs_earlier_version(dsname,
3400 			    SPA_VERSION_ZLE_COMPRESSION))
3401 				return (ENOTSUP);
3402 
3403 			/*
3404 			 * If this is a bootable dataset then
3405 			 * verify that the compression algorithm
3406 			 * is supported for booting. We must return
3407 			 * something other than ENOTSUP since it
3408 			 * implies a downrev pool version.
3409 			 */
3410 			if (zfs_is_bootfs(dsname) &&
3411 			    !BOOTFS_COMPRESS_VALID(intval)) {
3412 				return (ERANGE);
3413 			}
3414 		}
3415 		break;
3416 
3417 	case ZFS_PROP_COPIES:
3418 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3419 			return (ENOTSUP);
3420 		break;
3421 
3422 	case ZFS_PROP_DEDUP:
3423 		if (zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3424 			return (ENOTSUP);
3425 		break;
3426 
3427 	case ZFS_PROP_SHARESMB:
3428 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3429 			return (ENOTSUP);
3430 		break;
3431 
3432 	case ZFS_PROP_ACLINHERIT:
3433 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3434 		    nvpair_value_uint64(pair, &intval) == 0) {
3435 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
3436 			    zfs_earlier_version(dsname,
3437 			    SPA_VERSION_PASSTHROUGH_X))
3438 				return (ENOTSUP);
3439 		}
3440 		break;
3441 	}
3442 
3443 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3444 }
3445 
3446 /*
3447  * Removes properties from the given props list that fail permission checks
3448  * needed to clear them and to restore them in case of a receive error. For each
3449  * property, make sure we have both set and inherit permissions.
3450  *
3451  * Returns the first error encountered if any permission checks fail. If the
3452  * caller provides a non-NULL errlist, it also gives the complete list of names
3453  * of all the properties that failed a permission check along with the
3454  * corresponding error numbers. The caller is responsible for freeing the
3455  * returned errlist.
3456  *
3457  * If every property checks out successfully, zero is returned and the list
3458  * pointed at by errlist is NULL.
3459  */
3460 static int
3461 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
3462 {
3463 	zfs_cmd_t *zc;
3464 	nvpair_t *pair, *next_pair;
3465 	nvlist_t *errors;
3466 	int err, rv = 0;
3467 
3468 	if (props == NULL)
3469 		return (0);
3470 
3471 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3472 
3473 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
3474 	(void) strcpy(zc->zc_name, dataset);
3475 	pair = nvlist_next_nvpair(props, NULL);
3476 	while (pair != NULL) {
3477 		next_pair = nvlist_next_nvpair(props, pair);
3478 
3479 		(void) strcpy(zc->zc_value, nvpair_name(pair));
3480 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
3481 		    (err = zfs_secpolicy_inherit(zc, CRED())) != 0) {
3482 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
3483 			VERIFY(nvlist_add_int32(errors,
3484 			    zc->zc_value, err) == 0);
3485 		}
3486 		pair = next_pair;
3487 	}
3488 	kmem_free(zc, sizeof (zfs_cmd_t));
3489 
3490 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
3491 		nvlist_free(errors);
3492 		errors = NULL;
3493 	} else {
3494 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
3495 	}
3496 
3497 	if (errlist == NULL)
3498 		nvlist_free(errors);
3499 	else
3500 		*errlist = errors;
3501 
3502 	return (rv);
3503 }
3504 
3505 static boolean_t
3506 propval_equals(nvpair_t *p1, nvpair_t *p2)
3507 {
3508 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
3509 		/* dsl_prop_get_all_impl() format */
3510 		nvlist_t *attrs;
3511 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
3512 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3513 		    &p1) == 0);
3514 	}
3515 
3516 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
3517 		nvlist_t *attrs;
3518 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
3519 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3520 		    &p2) == 0);
3521 	}
3522 
3523 	if (nvpair_type(p1) != nvpair_type(p2))
3524 		return (B_FALSE);
3525 
3526 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
3527 		char *valstr1, *valstr2;
3528 
3529 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
3530 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
3531 		return (strcmp(valstr1, valstr2) == 0);
3532 	} else {
3533 		uint64_t intval1, intval2;
3534 
3535 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
3536 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
3537 		return (intval1 == intval2);
3538 	}
3539 }
3540 
3541 /*
3542  * Remove properties from props if they are not going to change (as determined
3543  * by comparison with origprops). Remove them from origprops as well, since we
3544  * do not need to clear or restore properties that won't change.
3545  */
3546 static void
3547 props_reduce(nvlist_t *props, nvlist_t *origprops)
3548 {
3549 	nvpair_t *pair, *next_pair;
3550 
3551 	if (origprops == NULL)
3552 		return; /* all props need to be received */
3553 
3554 	pair = nvlist_next_nvpair(props, NULL);
3555 	while (pair != NULL) {
3556 		const char *propname = nvpair_name(pair);
3557 		nvpair_t *match;
3558 
3559 		next_pair = nvlist_next_nvpair(props, pair);
3560 
3561 		if ((nvlist_lookup_nvpair(origprops, propname,
3562 		    &match) != 0) || !propval_equals(pair, match))
3563 			goto next; /* need to set received value */
3564 
3565 		/* don't clear the existing received value */
3566 		(void) nvlist_remove_nvpair(origprops, match);
3567 		/* don't bother receiving the property */
3568 		(void) nvlist_remove_nvpair(props, pair);
3569 next:
3570 		pair = next_pair;
3571 	}
3572 }
3573 
3574 #ifdef	DEBUG
3575 static boolean_t zfs_ioc_recv_inject_err;
3576 #endif
3577 
3578 /*
3579  * inputs:
3580  * zc_name		name of containing filesystem
3581  * zc_nvlist_src{_size}	nvlist of properties to apply
3582  * zc_value		name of snapshot to create
3583  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
3584  * zc_cookie		file descriptor to recv from
3585  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
3586  * zc_guid		force flag
3587  * zc_cleanup_fd	cleanup-on-exit file descriptor
3588  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
3589  *
3590  * outputs:
3591  * zc_cookie		number of bytes read
3592  * zc_nvlist_dst{_size} error for each unapplied received property
3593  * zc_obj		zprop_errflags_t
3594  * zc_action_handle	handle for this guid/ds mapping
3595  */
3596 static int
3597 zfs_ioc_recv(zfs_cmd_t *zc)
3598 {
3599 	file_t *fp;
3600 	objset_t *os;
3601 	dmu_recv_cookie_t drc;
3602 	boolean_t force = (boolean_t)zc->zc_guid;
3603 	int fd;
3604 	int error = 0;
3605 	int props_error = 0;
3606 	nvlist_t *errors;
3607 	offset_t off;
3608 	nvlist_t *props = NULL; /* sent properties */
3609 	nvlist_t *origprops = NULL; /* existing properties */
3610 	objset_t *origin = NULL;
3611 	char *tosnap;
3612 	char tofs[ZFS_MAXNAMELEN];
3613 	boolean_t first_recvd_props = B_FALSE;
3614 
3615 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3616 	    strchr(zc->zc_value, '@') == NULL ||
3617 	    strchr(zc->zc_value, '%'))
3618 		return (EINVAL);
3619 
3620 	(void) strcpy(tofs, zc->zc_value);
3621 	tosnap = strchr(tofs, '@');
3622 	*tosnap++ = '\0';
3623 
3624 	if (zc->zc_nvlist_src != NULL &&
3625 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3626 	    zc->zc_iflags, &props)) != 0)
3627 		return (error);
3628 
3629 	fd = zc->zc_cookie;
3630 	fp = getf(fd);
3631 	if (fp == NULL) {
3632 		nvlist_free(props);
3633 		return (EBADF);
3634 	}
3635 
3636 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3637 
3638 	if (props && dmu_objset_hold(tofs, FTAG, &os) == 0) {
3639 		if ((spa_version(os->os_spa) >= SPA_VERSION_RECVD_PROPS) &&
3640 		    !dsl_prop_get_hasrecvd(os)) {
3641 			first_recvd_props = B_TRUE;
3642 		}
3643 
3644 		/*
3645 		 * If new received properties are supplied, they are to
3646 		 * completely replace the existing received properties, so stash
3647 		 * away the existing ones.
3648 		 */
3649 		if (dsl_prop_get_received(os, &origprops) == 0) {
3650 			nvlist_t *errlist = NULL;
3651 			/*
3652 			 * Don't bother writing a property if its value won't
3653 			 * change (and avoid the unnecessary security checks).
3654 			 *
3655 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
3656 			 * special case where we blow away all local properties
3657 			 * regardless.
3658 			 */
3659 			if (!first_recvd_props)
3660 				props_reduce(props, origprops);
3661 			if (zfs_check_clearable(tofs, origprops,
3662 			    &errlist) != 0)
3663 				(void) nvlist_merge(errors, errlist, 0);
3664 			nvlist_free(errlist);
3665 		}
3666 
3667 		dmu_objset_rele(os, FTAG);
3668 	}
3669 
3670 	if (zc->zc_string[0]) {
3671 		error = dmu_objset_hold(zc->zc_string, FTAG, &origin);
3672 		if (error)
3673 			goto out;
3674 	}
3675 
3676 	error = dmu_recv_begin(tofs, tosnap, zc->zc_top_ds,
3677 	    &zc->zc_begin_record, force, origin, &drc);
3678 	if (origin)
3679 		dmu_objset_rele(origin, FTAG);
3680 	if (error)
3681 		goto out;
3682 
3683 	/*
3684 	 * Set properties before we receive the stream so that they are applied
3685 	 * to the new data. Note that we must call dmu_recv_stream() if
3686 	 * dmu_recv_begin() succeeds.
3687 	 */
3688 	if (props) {
3689 		nvlist_t *errlist;
3690 
3691 		if (dmu_objset_from_ds(drc.drc_logical_ds, &os) == 0) {
3692 			if (drc.drc_newfs) {
3693 				if (spa_version(os->os_spa) >=
3694 				    SPA_VERSION_RECVD_PROPS)
3695 					first_recvd_props = B_TRUE;
3696 			} else if (origprops != NULL) {
3697 				if (clear_received_props(os, tofs, origprops,
3698 				    first_recvd_props ? NULL : props) != 0)
3699 					zc->zc_obj |= ZPROP_ERR_NOCLEAR;
3700 			} else {
3701 				zc->zc_obj |= ZPROP_ERR_NOCLEAR;
3702 			}
3703 			dsl_prop_set_hasrecvd(os);
3704 		} else if (!drc.drc_newfs) {
3705 			zc->zc_obj |= ZPROP_ERR_NOCLEAR;
3706 		}
3707 
3708 		(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
3709 		    props, &errlist);
3710 		(void) nvlist_merge(errors, errlist, 0);
3711 		nvlist_free(errlist);
3712 	}
3713 
3714 	if (fit_error_list(zc, &errors) != 0 || put_nvlist(zc, errors) != 0) {
3715 		/*
3716 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
3717 		 * size or supplied an invalid address.
3718 		 */
3719 		props_error = EINVAL;
3720 	}
3721 
3722 	off = fp->f_offset;
3723 	error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
3724 	    &zc->zc_action_handle);
3725 
3726 	if (error == 0) {
3727 		zfsvfs_t *zfsvfs = NULL;
3728 
3729 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
3730 			/* online recv */
3731 			int end_err;
3732 
3733 			error = zfs_suspend_fs(zfsvfs);
3734 			/*
3735 			 * If the suspend fails, then the recv_end will
3736 			 * likely also fail, and clean up after itself.
3737 			 */
3738 			end_err = dmu_recv_end(&drc);
3739 			if (error == 0)
3740 				error = zfs_resume_fs(zfsvfs, tofs);
3741 			error = error ? error : end_err;
3742 			VFS_RELE(zfsvfs->z_vfs);
3743 		} else {
3744 			error = dmu_recv_end(&drc);
3745 		}
3746 	}
3747 
3748 	zc->zc_cookie = off - fp->f_offset;
3749 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
3750 		fp->f_offset = off;
3751 
3752 #ifdef	DEBUG
3753 	if (zfs_ioc_recv_inject_err) {
3754 		zfs_ioc_recv_inject_err = B_FALSE;
3755 		error = 1;
3756 	}
3757 #endif
3758 	/*
3759 	 * On error, restore the original props.
3760 	 */
3761 	if (error && props) {
3762 		if (dmu_objset_hold(tofs, FTAG, &os) == 0) {
3763 			if (clear_received_props(os, tofs, props, NULL) != 0) {
3764 				/*
3765 				 * We failed to clear the received properties.
3766 				 * Since we may have left a $recvd value on the
3767 				 * system, we can't clear the $hasrecvd flag.
3768 				 */
3769 				zc->zc_obj |= ZPROP_ERR_NORESTORE;
3770 			} else if (first_recvd_props) {
3771 				dsl_prop_unset_hasrecvd(os);
3772 			}
3773 			dmu_objset_rele(os, FTAG);
3774 		} else if (!drc.drc_newfs) {
3775 			/* We failed to clear the received properties. */
3776 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
3777 		}
3778 
3779 		if (origprops == NULL && !drc.drc_newfs) {
3780 			/* We failed to stash the original properties. */
3781 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
3782 		}
3783 
3784 		/*
3785 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
3786 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
3787 		 * explictly if we're restoring local properties cleared in the
3788 		 * first new-style receive.
3789 		 */
3790 		if (origprops != NULL &&
3791 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
3792 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
3793 		    origprops, NULL) != 0) {
3794 			/*
3795 			 * We stashed the original properties but failed to
3796 			 * restore them.
3797 			 */
3798 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
3799 		}
3800 	}
3801 out:
3802 	nvlist_free(props);
3803 	nvlist_free(origprops);
3804 	nvlist_free(errors);
3805 	releasef(fd);
3806 
3807 	if (error == 0)
3808 		error = props_error;
3809 
3810 	return (error);
3811 }
3812 
3813 /*
3814  * inputs:
3815  * zc_name	name of snapshot to send
3816  * zc_cookie	file descriptor to send stream to
3817  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
3818  * zc_sendobj	objsetid of snapshot to send
3819  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
3820  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
3821  *		output size in zc_objset_type.
3822  *
3823  * outputs: none
3824  */
3825 static int
3826 zfs_ioc_send(zfs_cmd_t *zc)
3827 {
3828 	objset_t *fromsnap = NULL;
3829 	objset_t *tosnap;
3830 	int error;
3831 	offset_t off;
3832 	dsl_dataset_t *ds;
3833 	dsl_dataset_t *dsfrom = NULL;
3834 	spa_t *spa;
3835 	dsl_pool_t *dp;
3836 	boolean_t estimate = (zc->zc_guid != 0);
3837 
3838 	error = spa_open(zc->zc_name, &spa, FTAG);
3839 	if (error)
3840 		return (error);
3841 
3842 	dp = spa_get_dsl(spa);
3843 	rw_enter(&dp->dp_config_rwlock, RW_READER);
3844 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
3845 	rw_exit(&dp->dp_config_rwlock);
3846 	if (error) {
3847 		spa_close(spa, FTAG);
3848 		return (error);
3849 	}
3850 
3851 	error = dmu_objset_from_ds(ds, &tosnap);
3852 	if (error) {
3853 		dsl_dataset_rele(ds, FTAG);
3854 		spa_close(spa, FTAG);
3855 		return (error);
3856 	}
3857 
3858 	if (zc->zc_fromobj != 0) {
3859 		rw_enter(&dp->dp_config_rwlock, RW_READER);
3860 		error = dsl_dataset_hold_obj(dp, zc->zc_fromobj, FTAG, &dsfrom);
3861 		rw_exit(&dp->dp_config_rwlock);
3862 		spa_close(spa, FTAG);
3863 		if (error) {
3864 			dsl_dataset_rele(ds, FTAG);
3865 			return (error);
3866 		}
3867 		error = dmu_objset_from_ds(dsfrom, &fromsnap);
3868 		if (error) {
3869 			dsl_dataset_rele(dsfrom, FTAG);
3870 			dsl_dataset_rele(ds, FTAG);
3871 			return (error);
3872 		}
3873 	} else {
3874 		spa_close(spa, FTAG);
3875 	}
3876 
3877 	if (estimate) {
3878 		error = dmu_send_estimate(tosnap, fromsnap, zc->zc_obj,
3879 		    &zc->zc_objset_type);
3880 	} else {
3881 		file_t *fp = getf(zc->zc_cookie);
3882 		if (fp == NULL) {
3883 			dsl_dataset_rele(ds, FTAG);
3884 			if (dsfrom)
3885 				dsl_dataset_rele(dsfrom, FTAG);
3886 			return (EBADF);
3887 		}
3888 
3889 		off = fp->f_offset;
3890 		error = dmu_send(tosnap, fromsnap, zc->zc_obj,
3891 		    zc->zc_cookie, fp->f_vnode, &off);
3892 
3893 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
3894 			fp->f_offset = off;
3895 		releasef(zc->zc_cookie);
3896 	}
3897 	if (dsfrom)
3898 		dsl_dataset_rele(dsfrom, FTAG);
3899 	dsl_dataset_rele(ds, FTAG);
3900 	return (error);
3901 }
3902 
3903 /*
3904  * inputs:
3905  * zc_name	name of snapshot on which to report progress
3906  * zc_cookie	file descriptor of send stream
3907  *
3908  * outputs:
3909  * zc_cookie	number of bytes written in send stream thus far
3910  */
3911 static int
3912 zfs_ioc_send_progress(zfs_cmd_t *zc)
3913 {
3914 	dsl_dataset_t *ds;
3915 	dmu_sendarg_t *dsp = NULL;
3916 	int error;
3917 
3918 	if ((error = dsl_dataset_hold(zc->zc_name, FTAG, &ds)) != 0)
3919 		return (error);
3920 
3921 	mutex_enter(&ds->ds_sendstream_lock);
3922 
3923 	/*
3924 	 * Iterate over all the send streams currently active on this dataset.
3925 	 * If there's one which matches the specified file descriptor _and_ the
3926 	 * stream was started by the current process, return the progress of
3927 	 * that stream.
3928 	 */
3929 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
3930 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
3931 		if (dsp->dsa_outfd == zc->zc_cookie &&
3932 		    dsp->dsa_proc == curproc)
3933 			break;
3934 	}
3935 
3936 	if (dsp != NULL)
3937 		zc->zc_cookie = *(dsp->dsa_off);
3938 	else
3939 		error = ENOENT;
3940 
3941 	mutex_exit(&ds->ds_sendstream_lock);
3942 	dsl_dataset_rele(ds, FTAG);
3943 	return (error);
3944 }
3945 
3946 static int
3947 zfs_ioc_inject_fault(zfs_cmd_t *zc)
3948 {
3949 	int id, error;
3950 
3951 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
3952 	    &zc->zc_inject_record);
3953 
3954 	if (error == 0)
3955 		zc->zc_guid = (uint64_t)id;
3956 
3957 	return (error);
3958 }
3959 
3960 static int
3961 zfs_ioc_clear_fault(zfs_cmd_t *zc)
3962 {
3963 	return (zio_clear_fault((int)zc->zc_guid));
3964 }
3965 
3966 static int
3967 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
3968 {
3969 	int id = (int)zc->zc_guid;
3970 	int error;
3971 
3972 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
3973 	    &zc->zc_inject_record);
3974 
3975 	zc->zc_guid = id;
3976 
3977 	return (error);
3978 }
3979 
3980 static int
3981 zfs_ioc_error_log(zfs_cmd_t *zc)
3982 {
3983 	spa_t *spa;
3984 	int error;
3985 	size_t count = (size_t)zc->zc_nvlist_dst_size;
3986 
3987 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
3988 		return (error);
3989 
3990 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
3991 	    &count);
3992 	if (error == 0)
3993 		zc->zc_nvlist_dst_size = count;
3994 	else
3995 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
3996 
3997 	spa_close(spa, FTAG);
3998 
3999 	return (error);
4000 }
4001 
4002 static int
4003 zfs_ioc_clear(zfs_cmd_t *zc)
4004 {
4005 	spa_t *spa;
4006 	vdev_t *vd;
4007 	int error;
4008 
4009 	/*
4010 	 * On zpool clear we also fix up missing slogs
4011 	 */
4012 	mutex_enter(&spa_namespace_lock);
4013 	spa = spa_lookup(zc->zc_name);
4014 	if (spa == NULL) {
4015 		mutex_exit(&spa_namespace_lock);
4016 		return (EIO);
4017 	}
4018 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4019 		/* we need to let spa_open/spa_load clear the chains */
4020 		spa_set_log_state(spa, SPA_LOG_CLEAR);
4021 	}
4022 	spa->spa_last_open_failed = 0;
4023 	mutex_exit(&spa_namespace_lock);
4024 
4025 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4026 		error = spa_open(zc->zc_name, &spa, FTAG);
4027 	} else {
4028 		nvlist_t *policy;
4029 		nvlist_t *config = NULL;
4030 
4031 		if (zc->zc_nvlist_src == NULL)
4032 			return (EINVAL);
4033 
4034 		if ((error = get_nvlist(zc->zc_nvlist_src,
4035 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4036 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4037 			    policy, &config);
4038 			if (config != NULL) {
4039 				int err;
4040 
4041 				if ((err = put_nvlist(zc, config)) != 0)
4042 					error = err;
4043 				nvlist_free(config);
4044 			}
4045 			nvlist_free(policy);
4046 		}
4047 	}
4048 
4049 	if (error)
4050 		return (error);
4051 
4052 	spa_vdev_state_enter(spa, SCL_NONE);
4053 
4054 	if (zc->zc_guid == 0) {
4055 		vd = NULL;
4056 	} else {
4057 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4058 		if (vd == NULL) {
4059 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
4060 			spa_close(spa, FTAG);
4061 			return (ENODEV);
4062 		}
4063 	}
4064 
4065 	vdev_clear(spa, vd);
4066 
4067 	(void) spa_vdev_state_exit(spa, NULL, 0);
4068 
4069 	/*
4070 	 * Resume any suspended I/Os.
4071 	 */
4072 	if (zio_resume(spa) != 0)
4073 		error = EIO;
4074 
4075 	spa_close(spa, FTAG);
4076 
4077 	return (error);
4078 }
4079 
4080 static int
4081 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4082 {
4083 	spa_t *spa;
4084 	int error;
4085 
4086 	error = spa_open(zc->zc_name, &spa, FTAG);
4087 	if (error)
4088 		return (error);
4089 
4090 	spa_vdev_state_enter(spa, SCL_NONE);
4091 	vdev_reopen(spa->spa_root_vdev);
4092 	(void) spa_vdev_state_exit(spa, NULL, 0);
4093 	spa_close(spa, FTAG);
4094 	return (0);
4095 }
4096 /*
4097  * inputs:
4098  * zc_name	name of filesystem
4099  * zc_value	name of origin snapshot
4100  *
4101  * outputs:
4102  * zc_string	name of conflicting snapshot, if there is one
4103  */
4104 static int
4105 zfs_ioc_promote(zfs_cmd_t *zc)
4106 {
4107 	char *cp;
4108 
4109 	/*
4110 	 * We don't need to unmount *all* the origin fs's snapshots, but
4111 	 * it's easier.
4112 	 */
4113 	cp = strchr(zc->zc_value, '@');
4114 	if (cp)
4115 		*cp = '\0';
4116 	(void) dmu_objset_find(zc->zc_value,
4117 	    zfs_unmount_snap, NULL, DS_FIND_SNAPSHOTS);
4118 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4119 }
4120 
4121 /*
4122  * Retrieve a single {user|group}{used|quota}@... property.
4123  *
4124  * inputs:
4125  * zc_name	name of filesystem
4126  * zc_objset_type zfs_userquota_prop_t
4127  * zc_value	domain name (eg. "S-1-234-567-89")
4128  * zc_guid	RID/UID/GID
4129  *
4130  * outputs:
4131  * zc_cookie	property value
4132  */
4133 static int
4134 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4135 {
4136 	zfsvfs_t *zfsvfs;
4137 	int error;
4138 
4139 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4140 		return (EINVAL);
4141 
4142 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4143 	if (error)
4144 		return (error);
4145 
4146 	error = zfs_userspace_one(zfsvfs,
4147 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4148 	zfsvfs_rele(zfsvfs, FTAG);
4149 
4150 	return (error);
4151 }
4152 
4153 /*
4154  * inputs:
4155  * zc_name		name of filesystem
4156  * zc_cookie		zap cursor
4157  * zc_objset_type	zfs_userquota_prop_t
4158  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4159  *
4160  * outputs:
4161  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
4162  * zc_cookie	zap cursor
4163  */
4164 static int
4165 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4166 {
4167 	zfsvfs_t *zfsvfs;
4168 	int bufsize = zc->zc_nvlist_dst_size;
4169 
4170 	if (bufsize <= 0)
4171 		return (ENOMEM);
4172 
4173 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4174 	if (error)
4175 		return (error);
4176 
4177 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
4178 
4179 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4180 	    buf, &zc->zc_nvlist_dst_size);
4181 
4182 	if (error == 0) {
4183 		error = xcopyout(buf,
4184 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
4185 		    zc->zc_nvlist_dst_size);
4186 	}
4187 	kmem_free(buf, bufsize);
4188 	zfsvfs_rele(zfsvfs, FTAG);
4189 
4190 	return (error);
4191 }
4192 
4193 /*
4194  * inputs:
4195  * zc_name		name of filesystem
4196  *
4197  * outputs:
4198  * none
4199  */
4200 static int
4201 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4202 {
4203 	objset_t *os;
4204 	int error = 0;
4205 	zfsvfs_t *zfsvfs;
4206 
4207 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4208 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4209 			/*
4210 			 * If userused is not enabled, it may be because the
4211 			 * objset needs to be closed & reopened (to grow the
4212 			 * objset_phys_t).  Suspend/resume the fs will do that.
4213 			 */
4214 			error = zfs_suspend_fs(zfsvfs);
4215 			if (error == 0)
4216 				error = zfs_resume_fs(zfsvfs, zc->zc_name);
4217 		}
4218 		if (error == 0)
4219 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4220 		VFS_RELE(zfsvfs->z_vfs);
4221 	} else {
4222 		/* XXX kind of reading contents without owning */
4223 		error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4224 		if (error)
4225 			return (error);
4226 
4227 		error = dmu_objset_userspace_upgrade(os);
4228 		dmu_objset_rele(os, FTAG);
4229 	}
4230 
4231 	return (error);
4232 }
4233 
4234 /*
4235  * We don't want to have a hard dependency
4236  * against some special symbols in sharefs
4237  * nfs, and smbsrv.  Determine them if needed when
4238  * the first file system is shared.
4239  * Neither sharefs, nfs or smbsrv are unloadable modules.
4240  */
4241 int (*znfsexport_fs)(void *arg);
4242 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4243 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4244 
4245 int zfs_nfsshare_inited;
4246 int zfs_smbshare_inited;
4247 
4248 ddi_modhandle_t nfs_mod;
4249 ddi_modhandle_t sharefs_mod;
4250 ddi_modhandle_t smbsrv_mod;
4251 kmutex_t zfs_share_lock;
4252 
4253 static int
4254 zfs_init_sharefs()
4255 {
4256 	int error;
4257 
4258 	ASSERT(MUTEX_HELD(&zfs_share_lock));
4259 	/* Both NFS and SMB shares also require sharetab support. */
4260 	if (sharefs_mod == NULL && ((sharefs_mod =
4261 	    ddi_modopen("fs/sharefs",
4262 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
4263 		return (ENOSYS);
4264 	}
4265 	if (zshare_fs == NULL && ((zshare_fs =
4266 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4267 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4268 		return (ENOSYS);
4269 	}
4270 	return (0);
4271 }
4272 
4273 static int
4274 zfs_ioc_share(zfs_cmd_t *zc)
4275 {
4276 	int error;
4277 	int opcode;
4278 
4279 	switch (zc->zc_share.z_sharetype) {
4280 	case ZFS_SHARE_NFS:
4281 	case ZFS_UNSHARE_NFS:
4282 		if (zfs_nfsshare_inited == 0) {
4283 			mutex_enter(&zfs_share_lock);
4284 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4285 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4286 				mutex_exit(&zfs_share_lock);
4287 				return (ENOSYS);
4288 			}
4289 			if (znfsexport_fs == NULL &&
4290 			    ((znfsexport_fs = (int (*)(void *))
4291 			    ddi_modsym(nfs_mod,
4292 			    "nfs_export", &error)) == NULL)) {
4293 				mutex_exit(&zfs_share_lock);
4294 				return (ENOSYS);
4295 			}
4296 			error = zfs_init_sharefs();
4297 			if (error) {
4298 				mutex_exit(&zfs_share_lock);
4299 				return (ENOSYS);
4300 			}
4301 			zfs_nfsshare_inited = 1;
4302 			mutex_exit(&zfs_share_lock);
4303 		}
4304 		break;
4305 	case ZFS_SHARE_SMB:
4306 	case ZFS_UNSHARE_SMB:
4307 		if (zfs_smbshare_inited == 0) {
4308 			mutex_enter(&zfs_share_lock);
4309 			if (smbsrv_mod == NULL && ((smbsrv_mod =
4310 			    ddi_modopen("drv/smbsrv",
4311 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4312 				mutex_exit(&zfs_share_lock);
4313 				return (ENOSYS);
4314 			}
4315 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4316 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4317 			    "smb_server_share", &error)) == NULL)) {
4318 				mutex_exit(&zfs_share_lock);
4319 				return (ENOSYS);
4320 			}
4321 			error = zfs_init_sharefs();
4322 			if (error) {
4323 				mutex_exit(&zfs_share_lock);
4324 				return (ENOSYS);
4325 			}
4326 			zfs_smbshare_inited = 1;
4327 			mutex_exit(&zfs_share_lock);
4328 		}
4329 		break;
4330 	default:
4331 		return (EINVAL);
4332 	}
4333 
4334 	switch (zc->zc_share.z_sharetype) {
4335 	case ZFS_SHARE_NFS:
4336 	case ZFS_UNSHARE_NFS:
4337 		if (error =
4338 		    znfsexport_fs((void *)
4339 		    (uintptr_t)zc->zc_share.z_exportdata))
4340 			return (error);
4341 		break;
4342 	case ZFS_SHARE_SMB:
4343 	case ZFS_UNSHARE_SMB:
4344 		if (error = zsmbexport_fs((void *)
4345 		    (uintptr_t)zc->zc_share.z_exportdata,
4346 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
4347 		    B_TRUE: B_FALSE)) {
4348 			return (error);
4349 		}
4350 		break;
4351 	}
4352 
4353 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
4354 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
4355 	    SHAREFS_ADD : SHAREFS_REMOVE;
4356 
4357 	/*
4358 	 * Add or remove share from sharetab
4359 	 */
4360 	error = zshare_fs(opcode,
4361 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
4362 	    zc->zc_share.z_sharemax);
4363 
4364 	return (error);
4365 
4366 }
4367 
4368 ace_t full_access[] = {
4369 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
4370 };
4371 
4372 /*
4373  * inputs:
4374  * zc_name		name of containing filesystem
4375  * zc_obj		object # beyond which we want next in-use object #
4376  *
4377  * outputs:
4378  * zc_obj		next in-use object #
4379  */
4380 static int
4381 zfs_ioc_next_obj(zfs_cmd_t *zc)
4382 {
4383 	objset_t *os = NULL;
4384 	int error;
4385 
4386 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4387 	if (error)
4388 		return (error);
4389 
4390 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
4391 	    os->os_dsl_dataset->ds_phys->ds_prev_snap_txg);
4392 
4393 	dmu_objset_rele(os, FTAG);
4394 	return (error);
4395 }
4396 
4397 /*
4398  * inputs:
4399  * zc_name		name of filesystem
4400  * zc_value		prefix name for snapshot
4401  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
4402  *
4403  * outputs:
4404  */
4405 static int
4406 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
4407 {
4408 	char *snap_name;
4409 	int error;
4410 
4411 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
4412 	    (u_longlong_t)ddi_get_lbolt64());
4413 
4414 	if (strlen(snap_name) >= MAXNAMELEN) {
4415 		strfree(snap_name);
4416 		return (E2BIG);
4417 	}
4418 
4419 	error = dmu_objset_snapshot(zc->zc_name, snap_name, snap_name,
4420 	    NULL, B_FALSE, B_TRUE, zc->zc_cleanup_fd);
4421 	if (error != 0) {
4422 		strfree(snap_name);
4423 		return (error);
4424 	}
4425 
4426 	(void) strcpy(zc->zc_value, snap_name);
4427 	strfree(snap_name);
4428 	return (0);
4429 }
4430 
4431 /*
4432  * inputs:
4433  * zc_name		name of "to" snapshot
4434  * zc_value		name of "from" snapshot
4435  * zc_cookie		file descriptor to write diff data on
4436  *
4437  * outputs:
4438  * dmu_diff_record_t's to the file descriptor
4439  */
4440 static int
4441 zfs_ioc_diff(zfs_cmd_t *zc)
4442 {
4443 	objset_t *fromsnap;
4444 	objset_t *tosnap;
4445 	file_t *fp;
4446 	offset_t off;
4447 	int error;
4448 
4449 	error = dmu_objset_hold(zc->zc_name, FTAG, &tosnap);
4450 	if (error)
4451 		return (error);
4452 
4453 	error = dmu_objset_hold(zc->zc_value, FTAG, &fromsnap);
4454 	if (error) {
4455 		dmu_objset_rele(tosnap, FTAG);
4456 		return (error);
4457 	}
4458 
4459 	fp = getf(zc->zc_cookie);
4460 	if (fp == NULL) {
4461 		dmu_objset_rele(fromsnap, FTAG);
4462 		dmu_objset_rele(tosnap, FTAG);
4463 		return (EBADF);
4464 	}
4465 
4466 	off = fp->f_offset;
4467 
4468 	error = dmu_diff(tosnap, fromsnap, fp->f_vnode, &off);
4469 
4470 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4471 		fp->f_offset = off;
4472 	releasef(zc->zc_cookie);
4473 
4474 	dmu_objset_rele(fromsnap, FTAG);
4475 	dmu_objset_rele(tosnap, FTAG);
4476 	return (error);
4477 }
4478 
4479 /*
4480  * Remove all ACL files in shares dir
4481  */
4482 static int
4483 zfs_smb_acl_purge(znode_t *dzp)
4484 {
4485 	zap_cursor_t	zc;
4486 	zap_attribute_t	zap;
4487 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
4488 	int error;
4489 
4490 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
4491 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
4492 	    zap_cursor_advance(&zc)) {
4493 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
4494 		    NULL, 0)) != 0)
4495 			break;
4496 	}
4497 	zap_cursor_fini(&zc);
4498 	return (error);
4499 }
4500 
4501 static int
4502 zfs_ioc_smb_acl(zfs_cmd_t *zc)
4503 {
4504 	vnode_t *vp;
4505 	znode_t *dzp;
4506 	vnode_t *resourcevp = NULL;
4507 	znode_t *sharedir;
4508 	zfsvfs_t *zfsvfs;
4509 	nvlist_t *nvlist;
4510 	char *src, *target;
4511 	vattr_t vattr;
4512 	vsecattr_t vsec;
4513 	int error = 0;
4514 
4515 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
4516 	    NO_FOLLOW, NULL, &vp)) != 0)
4517 		return (error);
4518 
4519 	/* Now make sure mntpnt and dataset are ZFS */
4520 
4521 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
4522 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
4523 	    zc->zc_name) != 0)) {
4524 		VN_RELE(vp);
4525 		return (EINVAL);
4526 	}
4527 
4528 	dzp = VTOZ(vp);
4529 	zfsvfs = dzp->z_zfsvfs;
4530 	ZFS_ENTER(zfsvfs);
4531 
4532 	/*
4533 	 * Create share dir if its missing.
4534 	 */
4535 	mutex_enter(&zfsvfs->z_lock);
4536 	if (zfsvfs->z_shares_dir == 0) {
4537 		dmu_tx_t *tx;
4538 
4539 		tx = dmu_tx_create(zfsvfs->z_os);
4540 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
4541 		    ZFS_SHARES_DIR);
4542 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
4543 		error = dmu_tx_assign(tx, TXG_WAIT);
4544 		if (error) {
4545 			dmu_tx_abort(tx);
4546 		} else {
4547 			error = zfs_create_share_dir(zfsvfs, tx);
4548 			dmu_tx_commit(tx);
4549 		}
4550 		if (error) {
4551 			mutex_exit(&zfsvfs->z_lock);
4552 			VN_RELE(vp);
4553 			ZFS_EXIT(zfsvfs);
4554 			return (error);
4555 		}
4556 	}
4557 	mutex_exit(&zfsvfs->z_lock);
4558 
4559 	ASSERT(zfsvfs->z_shares_dir);
4560 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
4561 		VN_RELE(vp);
4562 		ZFS_EXIT(zfsvfs);
4563 		return (error);
4564 	}
4565 
4566 	switch (zc->zc_cookie) {
4567 	case ZFS_SMB_ACL_ADD:
4568 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
4569 		vattr.va_type = VREG;
4570 		vattr.va_mode = S_IFREG|0777;
4571 		vattr.va_uid = 0;
4572 		vattr.va_gid = 0;
4573 
4574 		vsec.vsa_mask = VSA_ACE;
4575 		vsec.vsa_aclentp = &full_access;
4576 		vsec.vsa_aclentsz = sizeof (full_access);
4577 		vsec.vsa_aclcnt = 1;
4578 
4579 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
4580 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
4581 		if (resourcevp)
4582 			VN_RELE(resourcevp);
4583 		break;
4584 
4585 	case ZFS_SMB_ACL_REMOVE:
4586 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
4587 		    NULL, 0);
4588 		break;
4589 
4590 	case ZFS_SMB_ACL_RENAME:
4591 		if ((error = get_nvlist(zc->zc_nvlist_src,
4592 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
4593 			VN_RELE(vp);
4594 			ZFS_EXIT(zfsvfs);
4595 			return (error);
4596 		}
4597 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
4598 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
4599 		    &target)) {
4600 			VN_RELE(vp);
4601 			VN_RELE(ZTOV(sharedir));
4602 			ZFS_EXIT(zfsvfs);
4603 			nvlist_free(nvlist);
4604 			return (error);
4605 		}
4606 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
4607 		    kcred, NULL, 0);
4608 		nvlist_free(nvlist);
4609 		break;
4610 
4611 	case ZFS_SMB_ACL_PURGE:
4612 		error = zfs_smb_acl_purge(sharedir);
4613 		break;
4614 
4615 	default:
4616 		error = EINVAL;
4617 		break;
4618 	}
4619 
4620 	VN_RELE(vp);
4621 	VN_RELE(ZTOV(sharedir));
4622 
4623 	ZFS_EXIT(zfsvfs);
4624 
4625 	return (error);
4626 }
4627 
4628 /*
4629  * inputs:
4630  * zc_name		name of filesystem
4631  * zc_value		short name of snap
4632  * zc_string		user-supplied tag for this hold
4633  * zc_cookie		recursive flag
4634  * zc_temphold		set if hold is temporary
4635  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
4636  * zc_sendobj		if non-zero, the objid for zc_name@zc_value
4637  * zc_createtxg		if zc_sendobj is non-zero, snap must have zc_createtxg
4638  *
4639  * outputs:		none
4640  */
4641 static int
4642 zfs_ioc_hold(zfs_cmd_t *zc)
4643 {
4644 	boolean_t recursive = zc->zc_cookie;
4645 	spa_t *spa;
4646 	dsl_pool_t *dp;
4647 	dsl_dataset_t *ds;
4648 	int error;
4649 	minor_t minor = 0;
4650 
4651 	if (snapshot_namecheck(zc->zc_value, NULL, NULL) != 0)
4652 		return (EINVAL);
4653 
4654 	if (zc->zc_sendobj == 0) {
4655 		return (dsl_dataset_user_hold(zc->zc_name, zc->zc_value,
4656 		    zc->zc_string, recursive, zc->zc_temphold,
4657 		    zc->zc_cleanup_fd));
4658 	}
4659 
4660 	if (recursive)
4661 		return (EINVAL);
4662 
4663 	error = spa_open(zc->zc_name, &spa, FTAG);
4664 	if (error)
4665 		return (error);
4666 
4667 	dp = spa_get_dsl(spa);
4668 	rw_enter(&dp->dp_config_rwlock, RW_READER);
4669 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
4670 	rw_exit(&dp->dp_config_rwlock);
4671 	spa_close(spa, FTAG);
4672 	if (error)
4673 		return (error);
4674 
4675 	/*
4676 	 * Until we have a hold on this snapshot, it's possible that
4677 	 * zc_sendobj could've been destroyed and reused as part
4678 	 * of a later txg.  Make sure we're looking at the right object.
4679 	 */
4680 	if (zc->zc_createtxg != ds->ds_phys->ds_creation_txg) {
4681 		dsl_dataset_rele(ds, FTAG);
4682 		return (ENOENT);
4683 	}
4684 
4685 	if (zc->zc_cleanup_fd != -1 && zc->zc_temphold) {
4686 		error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
4687 		if (error) {
4688 			dsl_dataset_rele(ds, FTAG);
4689 			return (error);
4690 		}
4691 	}
4692 
4693 	error = dsl_dataset_user_hold_for_send(ds, zc->zc_string,
4694 	    zc->zc_temphold);
4695 	if (minor != 0) {
4696 		if (error == 0) {
4697 			dsl_register_onexit_hold_cleanup(ds, zc->zc_string,
4698 			    minor);
4699 		}
4700 		zfs_onexit_fd_rele(zc->zc_cleanup_fd);
4701 	}
4702 	dsl_dataset_rele(ds, FTAG);
4703 
4704 	return (error);
4705 }
4706 
4707 /*
4708  * inputs:
4709  * zc_name	name of dataset from which we're releasing a user hold
4710  * zc_value	short name of snap
4711  * zc_string	user-supplied tag for this hold
4712  * zc_cookie	recursive flag
4713  *
4714  * outputs:	none
4715  */
4716 static int
4717 zfs_ioc_release(zfs_cmd_t *zc)
4718 {
4719 	boolean_t recursive = zc->zc_cookie;
4720 
4721 	if (snapshot_namecheck(zc->zc_value, NULL, NULL) != 0)
4722 		return (EINVAL);
4723 
4724 	return (dsl_dataset_user_release(zc->zc_name, zc->zc_value,
4725 	    zc->zc_string, recursive));
4726 }
4727 
4728 /*
4729  * inputs:
4730  * zc_name		name of filesystem
4731  *
4732  * outputs:
4733  * zc_nvlist_src{_size}	nvlist of snapshot holds
4734  */
4735 static int
4736 zfs_ioc_get_holds(zfs_cmd_t *zc)
4737 {
4738 	nvlist_t *nvp;
4739 	int error;
4740 
4741 	if ((error = dsl_dataset_get_holds(zc->zc_name, &nvp)) == 0) {
4742 		error = put_nvlist(zc, nvp);
4743 		nvlist_free(nvp);
4744 	}
4745 
4746 	return (error);
4747 }
4748 
4749 /*
4750  * inputs:
4751  * zc_name		name of new filesystem or snapshot
4752  * zc_value		full name of old snapshot
4753  *
4754  * outputs:
4755  * zc_cookie		space in bytes
4756  * zc_objset_type	compressed space in bytes
4757  * zc_perm_action	uncompressed space in bytes
4758  */
4759 static int
4760 zfs_ioc_space_written(zfs_cmd_t *zc)
4761 {
4762 	int error;
4763 	dsl_dataset_t *new, *old;
4764 
4765 	error = dsl_dataset_hold(zc->zc_name, FTAG, &new);
4766 	if (error != 0)
4767 		return (error);
4768 	error = dsl_dataset_hold(zc->zc_value, FTAG, &old);
4769 	if (error != 0) {
4770 		dsl_dataset_rele(new, FTAG);
4771 		return (error);
4772 	}
4773 
4774 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
4775 	    &zc->zc_objset_type, &zc->zc_perm_action);
4776 	dsl_dataset_rele(old, FTAG);
4777 	dsl_dataset_rele(new, FTAG);
4778 	return (error);
4779 }
4780 
4781 /*
4782  * inputs:
4783  * zc_name		full name of last snapshot
4784  * zc_value		full name of first snapshot
4785  *
4786  * outputs:
4787  * zc_cookie		space in bytes
4788  * zc_objset_type	compressed space in bytes
4789  * zc_perm_action	uncompressed space in bytes
4790  */
4791 static int
4792 zfs_ioc_space_snaps(zfs_cmd_t *zc)
4793 {
4794 	int error;
4795 	dsl_dataset_t *new, *old;
4796 
4797 	error = dsl_dataset_hold(zc->zc_name, FTAG, &new);
4798 	if (error != 0)
4799 		return (error);
4800 	error = dsl_dataset_hold(zc->zc_value, FTAG, &old);
4801 	if (error != 0) {
4802 		dsl_dataset_rele(new, FTAG);
4803 		return (error);
4804 	}
4805 
4806 	error = dsl_dataset_space_wouldfree(old, new, &zc->zc_cookie,
4807 	    &zc->zc_objset_type, &zc->zc_perm_action);
4808 	dsl_dataset_rele(old, FTAG);
4809 	dsl_dataset_rele(new, FTAG);
4810 	return (error);
4811 }
4812 
4813 /*
4814  * pool create, destroy, and export don't log the history as part of
4815  * zfsdev_ioctl, but rather zfs_ioc_pool_create, and zfs_ioc_pool_export
4816  * do the logging of those commands.
4817  */
4818 static zfs_ioc_vec_t zfs_ioc_vec[] = {
4819 	{ zfs_ioc_pool_create, zfs_secpolicy_config, POOL_NAME, B_FALSE,
4820 	    POOL_CHECK_NONE },
4821 	{ zfs_ioc_pool_destroy,	zfs_secpolicy_config, POOL_NAME, B_FALSE,
4822 	    POOL_CHECK_NONE },
4823 	{ zfs_ioc_pool_import, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4824 	    POOL_CHECK_NONE },
4825 	{ zfs_ioc_pool_export, zfs_secpolicy_config, POOL_NAME, B_FALSE,
4826 	    POOL_CHECK_NONE },
4827 	{ zfs_ioc_pool_configs,	zfs_secpolicy_none, NO_NAME, B_FALSE,
4828 	    POOL_CHECK_NONE },
4829 	{ zfs_ioc_pool_stats, zfs_secpolicy_read, POOL_NAME, B_FALSE,
4830 	    POOL_CHECK_NONE },
4831 	{ zfs_ioc_pool_tryimport, zfs_secpolicy_config, NO_NAME, B_FALSE,
4832 	    POOL_CHECK_NONE },
4833 	{ zfs_ioc_pool_scan, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4834 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4835 	{ zfs_ioc_pool_freeze, zfs_secpolicy_config, NO_NAME, B_FALSE,
4836 	    POOL_CHECK_READONLY },
4837 	{ zfs_ioc_pool_upgrade,	zfs_secpolicy_config, POOL_NAME, B_TRUE,
4838 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4839 	{ zfs_ioc_pool_get_history, zfs_secpolicy_config, POOL_NAME, B_FALSE,
4840 	    POOL_CHECK_NONE },
4841 	{ zfs_ioc_vdev_add, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4842 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4843 	{ zfs_ioc_vdev_remove, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4844 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4845 	{ zfs_ioc_vdev_set_state, zfs_secpolicy_config,	POOL_NAME, B_TRUE,
4846 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4847 	{ zfs_ioc_vdev_attach, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4848 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4849 	{ zfs_ioc_vdev_detach, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4850 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4851 	{ zfs_ioc_vdev_setpath,	zfs_secpolicy_config, POOL_NAME, B_FALSE,
4852 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4853 	{ zfs_ioc_vdev_setfru,	zfs_secpolicy_config, POOL_NAME, B_FALSE,
4854 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4855 	{ zfs_ioc_objset_stats,	zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4856 	    POOL_CHECK_SUSPENDED },
4857 	{ zfs_ioc_objset_zplprops, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4858 	    POOL_CHECK_NONE },
4859 	{ zfs_ioc_dataset_list_next, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4860 	    POOL_CHECK_SUSPENDED },
4861 	{ zfs_ioc_snapshot_list_next, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4862 	    POOL_CHECK_SUSPENDED },
4863 	{ zfs_ioc_set_prop, zfs_secpolicy_none, DATASET_NAME, B_TRUE,
4864 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4865 	{ zfs_ioc_create, zfs_secpolicy_create, DATASET_NAME, B_TRUE,
4866 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4867 	{ zfs_ioc_destroy, zfs_secpolicy_destroy, DATASET_NAME, B_TRUE,
4868 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4869 	{ zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME, B_TRUE,
4870 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4871 	{ zfs_ioc_rename, zfs_secpolicy_rename,	DATASET_NAME, B_TRUE,
4872 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4873 	{ zfs_ioc_recv, zfs_secpolicy_receive, DATASET_NAME, B_TRUE,
4874 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4875 	{ zfs_ioc_send, zfs_secpolicy_send, DATASET_NAME, B_FALSE,
4876 	    POOL_CHECK_NONE },
4877 	{ zfs_ioc_inject_fault,	zfs_secpolicy_inject, NO_NAME, B_FALSE,
4878 	    POOL_CHECK_NONE },
4879 	{ zfs_ioc_clear_fault, zfs_secpolicy_inject, NO_NAME, B_FALSE,
4880 	    POOL_CHECK_NONE },
4881 	{ zfs_ioc_inject_list_next, zfs_secpolicy_inject, NO_NAME, B_FALSE,
4882 	    POOL_CHECK_NONE },
4883 	{ zfs_ioc_error_log, zfs_secpolicy_inject, POOL_NAME, B_FALSE,
4884 	    POOL_CHECK_NONE },
4885 	{ zfs_ioc_clear, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4886 	    POOL_CHECK_NONE },
4887 	{ zfs_ioc_promote, zfs_secpolicy_promote, DATASET_NAME, B_TRUE,
4888 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4889 	{ zfs_ioc_snapshot, zfs_secpolicy_snapshot, DATASET_NAME, B_TRUE,
4890 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4891 	{ zfs_ioc_dsobj_to_dsname, zfs_secpolicy_diff, POOL_NAME, B_FALSE,
4892 	    POOL_CHECK_NONE },
4893 	{ zfs_ioc_obj_to_path, zfs_secpolicy_diff, DATASET_NAME, B_FALSE,
4894 	    POOL_CHECK_SUSPENDED },
4895 	{ zfs_ioc_pool_set_props, zfs_secpolicy_config,	POOL_NAME, B_TRUE,
4896 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4897 	{ zfs_ioc_pool_get_props, zfs_secpolicy_read, POOL_NAME, B_FALSE,
4898 	    POOL_CHECK_NONE },
4899 	{ zfs_ioc_set_fsacl, zfs_secpolicy_fsacl, DATASET_NAME, B_TRUE,
4900 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4901 	{ zfs_ioc_get_fsacl, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4902 	    POOL_CHECK_NONE },
4903 	{ zfs_ioc_share, zfs_secpolicy_share, DATASET_NAME, B_FALSE,
4904 	    POOL_CHECK_NONE },
4905 	{ zfs_ioc_inherit_prop, zfs_secpolicy_inherit, DATASET_NAME, B_TRUE,
4906 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4907 	{ zfs_ioc_smb_acl, zfs_secpolicy_smb_acl, DATASET_NAME, B_FALSE,
4908 	    POOL_CHECK_NONE },
4909 	{ zfs_ioc_userspace_one, zfs_secpolicy_userspace_one, DATASET_NAME,
4910 	    B_FALSE, POOL_CHECK_NONE },
4911 	{ zfs_ioc_userspace_many, zfs_secpolicy_userspace_many, DATASET_NAME,
4912 	    B_FALSE, POOL_CHECK_NONE },
4913 	{ zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
4914 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4915 	{ zfs_ioc_hold, zfs_secpolicy_hold, DATASET_NAME, B_TRUE,
4916 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4917 	{ zfs_ioc_release, zfs_secpolicy_release, DATASET_NAME, B_TRUE,
4918 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4919 	{ zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4920 	    POOL_CHECK_SUSPENDED },
4921 	{ zfs_ioc_objset_recvd_props, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4922 	    POOL_CHECK_NONE },
4923 	{ zfs_ioc_vdev_split, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4924 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4925 	{ zfs_ioc_next_obj, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4926 	    POOL_CHECK_NONE },
4927 	{ zfs_ioc_diff, zfs_secpolicy_diff, DATASET_NAME, B_FALSE,
4928 	    POOL_CHECK_NONE },
4929 	{ zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot, DATASET_NAME,
4930 	    B_FALSE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4931 	{ zfs_ioc_obj_to_stats, zfs_secpolicy_diff, DATASET_NAME, B_FALSE,
4932 	    POOL_CHECK_SUSPENDED },
4933 	{ zfs_ioc_space_written, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4934 	    POOL_CHECK_SUSPENDED },
4935 	{ zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4936 	    POOL_CHECK_SUSPENDED },
4937 	{ zfs_ioc_destroy_snaps_nvl, zfs_secpolicy_destroy_recursive,
4938 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4939 	{ zfs_ioc_pool_reguid, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4940 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY },
4941 	{ zfs_ioc_pool_reopen, zfs_secpolicy_config, POOL_NAME, B_TRUE,
4942 	    POOL_CHECK_SUSPENDED },
4943 	{ zfs_ioc_send_progress, zfs_secpolicy_read, DATASET_NAME, B_FALSE,
4944 	    POOL_CHECK_NONE }
4945 };
4946 
4947 int
4948 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
4949     zfs_ioc_poolcheck_t check)
4950 {
4951 	spa_t *spa;
4952 	int error;
4953 
4954 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
4955 
4956 	if (check & POOL_CHECK_NONE)
4957 		return (0);
4958 
4959 	error = spa_open(name, &spa, FTAG);
4960 	if (error == 0) {
4961 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
4962 			error = EAGAIN;
4963 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
4964 			error = EROFS;
4965 		spa_close(spa, FTAG);
4966 	}
4967 	return (error);
4968 }
4969 
4970 /*
4971  * Find a free minor number.
4972  */
4973 minor_t
4974 zfsdev_minor_alloc(void)
4975 {
4976 	static minor_t last_minor;
4977 	minor_t m;
4978 
4979 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
4980 
4981 	for (m = last_minor + 1; m != last_minor; m++) {
4982 		if (m > ZFSDEV_MAX_MINOR)
4983 			m = 1;
4984 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
4985 			last_minor = m;
4986 			return (m);
4987 		}
4988 	}
4989 
4990 	return (0);
4991 }
4992 
4993 static int
4994 zfs_ctldev_init(dev_t *devp)
4995 {
4996 	minor_t minor;
4997 	zfs_soft_state_t *zs;
4998 
4999 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5000 	ASSERT(getminor(*devp) == 0);
5001 
5002 	minor = zfsdev_minor_alloc();
5003 	if (minor == 0)
5004 		return (ENXIO);
5005 
5006 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5007 		return (EAGAIN);
5008 
5009 	*devp = makedevice(getemajor(*devp), minor);
5010 
5011 	zs = ddi_get_soft_state(zfsdev_state, minor);
5012 	zs->zss_type = ZSST_CTLDEV;
5013 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
5014 
5015 	return (0);
5016 }
5017 
5018 static void
5019 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
5020 {
5021 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5022 
5023 	zfs_onexit_destroy(zo);
5024 	ddi_soft_state_free(zfsdev_state, minor);
5025 }
5026 
5027 void *
5028 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
5029 {
5030 	zfs_soft_state_t *zp;
5031 
5032 	zp = ddi_get_soft_state(zfsdev_state, minor);
5033 	if (zp == NULL || zp->zss_type != which)
5034 		return (NULL);
5035 
5036 	return (zp->zss_data);
5037 }
5038 
5039 static int
5040 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
5041 {
5042 	int error = 0;
5043 
5044 	if (getminor(*devp) != 0)
5045 		return (zvol_open(devp, flag, otyp, cr));
5046 
5047 	/* This is the control device. Allocate a new minor if requested. */
5048 	if (flag & FEXCL) {
5049 		mutex_enter(&zfsdev_state_lock);
5050 		error = zfs_ctldev_init(devp);
5051 		mutex_exit(&zfsdev_state_lock);
5052 	}
5053 
5054 	return (error);
5055 }
5056 
5057 static int
5058 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
5059 {
5060 	zfs_onexit_t *zo;
5061 	minor_t minor = getminor(dev);
5062 
5063 	if (minor == 0)
5064 		return (0);
5065 
5066 	mutex_enter(&zfsdev_state_lock);
5067 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
5068 	if (zo == NULL) {
5069 		mutex_exit(&zfsdev_state_lock);
5070 		return (zvol_close(dev, flag, otyp, cr));
5071 	}
5072 	zfs_ctldev_destroy(zo, minor);
5073 	mutex_exit(&zfsdev_state_lock);
5074 
5075 	return (0);
5076 }
5077 
5078 static int
5079 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
5080 {
5081 	zfs_cmd_t *zc;
5082 	uint_t vec;
5083 	int error, rc;
5084 	minor_t minor = getminor(dev);
5085 
5086 	if (minor != 0 &&
5087 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
5088 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
5089 
5090 	vec = cmd - ZFS_IOC;
5091 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
5092 
5093 	if (vec >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
5094 		return (EINVAL);
5095 
5096 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
5097 
5098 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
5099 	if (error != 0)
5100 		error = EFAULT;
5101 
5102 	if ((error == 0) && !(flag & FKIOCTL))
5103 		error = zfs_ioc_vec[vec].zvec_secpolicy(zc, cr);
5104 
5105 	/*
5106 	 * Ensure that all pool/dataset names are valid before we pass down to
5107 	 * the lower layers.
5108 	 */
5109 	if (error == 0) {
5110 		zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
5111 		zc->zc_iflags = flag & FKIOCTL;
5112 		switch (zfs_ioc_vec[vec].zvec_namecheck) {
5113 		case POOL_NAME:
5114 			if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
5115 				error = EINVAL;
5116 			error = pool_status_check(zc->zc_name,
5117 			    zfs_ioc_vec[vec].zvec_namecheck,
5118 			    zfs_ioc_vec[vec].zvec_pool_check);
5119 			break;
5120 
5121 		case DATASET_NAME:
5122 			if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
5123 				error = EINVAL;
5124 			error = pool_status_check(zc->zc_name,
5125 			    zfs_ioc_vec[vec].zvec_namecheck,
5126 			    zfs_ioc_vec[vec].zvec_pool_check);
5127 			break;
5128 
5129 		case NO_NAME:
5130 			break;
5131 		}
5132 	}
5133 
5134 	if (error == 0)
5135 		error = zfs_ioc_vec[vec].zvec_func(zc);
5136 
5137 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
5138 	if (error == 0) {
5139 		if (rc != 0)
5140 			error = EFAULT;
5141 		if (zfs_ioc_vec[vec].zvec_his_log)
5142 			zfs_log_history(zc);
5143 	}
5144 
5145 	kmem_free(zc, sizeof (zfs_cmd_t));
5146 	return (error);
5147 }
5148 
5149 static int
5150 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
5151 {
5152 	if (cmd != DDI_ATTACH)
5153 		return (DDI_FAILURE);
5154 
5155 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
5156 	    DDI_PSEUDO, 0) == DDI_FAILURE)
5157 		return (DDI_FAILURE);
5158 
5159 	zfs_dip = dip;
5160 
5161 	ddi_report_dev(dip);
5162 
5163 	return (DDI_SUCCESS);
5164 }
5165 
5166 static int
5167 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
5168 {
5169 	if (spa_busy() || zfs_busy() || zvol_busy())
5170 		return (DDI_FAILURE);
5171 
5172 	if (cmd != DDI_DETACH)
5173 		return (DDI_FAILURE);
5174 
5175 	zfs_dip = NULL;
5176 
5177 	ddi_prop_remove_all(dip);
5178 	ddi_remove_minor_node(dip, NULL);
5179 
5180 	return (DDI_SUCCESS);
5181 }
5182 
5183 /*ARGSUSED*/
5184 static int
5185 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
5186 {
5187 	switch (infocmd) {
5188 	case DDI_INFO_DEVT2DEVINFO:
5189 		*result = zfs_dip;
5190 		return (DDI_SUCCESS);
5191 
5192 	case DDI_INFO_DEVT2INSTANCE:
5193 		*result = (void *)0;
5194 		return (DDI_SUCCESS);
5195 	}
5196 
5197 	return (DDI_FAILURE);
5198 }
5199 
5200 /*
5201  * OK, so this is a little weird.
5202  *
5203  * /dev/zfs is the control node, i.e. minor 0.
5204  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
5205  *
5206  * /dev/zfs has basically nothing to do except serve up ioctls,
5207  * so most of the standard driver entry points are in zvol.c.
5208  */
5209 static struct cb_ops zfs_cb_ops = {
5210 	zfsdev_open,	/* open */
5211 	zfsdev_close,	/* close */
5212 	zvol_strategy,	/* strategy */
5213 	nodev,		/* print */
5214 	zvol_dump,	/* dump */
5215 	zvol_read,	/* read */
5216 	zvol_write,	/* write */
5217 	zfsdev_ioctl,	/* ioctl */
5218 	nodev,		/* devmap */
5219 	nodev,		/* mmap */
5220 	nodev,		/* segmap */
5221 	nochpoll,	/* poll */
5222 	ddi_prop_op,	/* prop_op */
5223 	NULL,		/* streamtab */
5224 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
5225 	CB_REV,		/* version */
5226 	nodev,		/* async read */
5227 	nodev,		/* async write */
5228 };
5229 
5230 static struct dev_ops zfs_dev_ops = {
5231 	DEVO_REV,	/* version */
5232 	0,		/* refcnt */
5233 	zfs_info,	/* info */
5234 	nulldev,	/* identify */
5235 	nulldev,	/* probe */
5236 	zfs_attach,	/* attach */
5237 	zfs_detach,	/* detach */
5238 	nodev,		/* reset */
5239 	&zfs_cb_ops,	/* driver operations */
5240 	NULL,		/* no bus operations */
5241 	NULL,		/* power */
5242 	ddi_quiesce_not_needed,	/* quiesce */
5243 };
5244 
5245 static struct modldrv zfs_modldrv = {
5246 	&mod_driverops,
5247 	"ZFS storage pool",
5248 	&zfs_dev_ops
5249 };
5250 
5251 static struct modlinkage modlinkage = {
5252 	MODREV_1,
5253 	(void *)&zfs_modlfs,
5254 	(void *)&zfs_modldrv,
5255 	NULL
5256 };
5257 
5258 
5259 uint_t zfs_fsyncer_key;
5260 extern uint_t rrw_tsd_key;
5261 
5262 int
5263 _init(void)
5264 {
5265 	int error;
5266 
5267 	spa_init(FREAD | FWRITE);
5268 	zfs_init();
5269 	zvol_init();
5270 
5271 	if ((error = mod_install(&modlinkage)) != 0) {
5272 		zvol_fini();
5273 		zfs_fini();
5274 		spa_fini();
5275 		return (error);
5276 	}
5277 
5278 	tsd_create(&zfs_fsyncer_key, NULL);
5279 	tsd_create(&rrw_tsd_key, NULL);
5280 
5281 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
5282 	ASSERT(error == 0);
5283 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
5284 
5285 	return (0);
5286 }
5287 
5288 int
5289 _fini(void)
5290 {
5291 	int error;
5292 
5293 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
5294 		return (EBUSY);
5295 
5296 	if ((error = mod_remove(&modlinkage)) != 0)
5297 		return (error);
5298 
5299 	zvol_fini();
5300 	zfs_fini();
5301 	spa_fini();
5302 	if (zfs_nfsshare_inited)
5303 		(void) ddi_modclose(nfs_mod);
5304 	if (zfs_smbshare_inited)
5305 		(void) ddi_modclose(smbsrv_mod);
5306 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
5307 		(void) ddi_modclose(sharefs_mod);
5308 
5309 	tsd_destroy(&zfs_fsyncer_key);
5310 	ldi_ident_release(zfs_li);
5311 	zfs_li = NULL;
5312 	mutex_destroy(&zfs_share_lock);
5313 
5314 	return (error);
5315 }
5316 
5317 int
5318 _info(struct modinfo *modinfop)
5319 {
5320 	return (mod_info(&modlinkage, modinfop));
5321 }
5322