xref: /titanic_50/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision fbd2e8e189c52419d4ad4d1ebec410789b38c84c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Portions Copyright 2011 Martin Matuska
25  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
26  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
27  * Copyright (c) 2014, Joyent, Inc. All rights reserved.
28  * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
29  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
30  * Copyright (c) 2013 Steven Hartland. All rights reserved.
31  * Copyright (c) 2014 Integros [integros.com]
32  */
33 
34 /*
35  * ZFS ioctls.
36  *
37  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
38  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
39  *
40  * There are two ways that we handle ioctls: the legacy way where almost
41  * all of the logic is in the ioctl callback, and the new way where most
42  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
43  *
44  * Non-legacy ioctls should be registered by calling
45  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
46  * from userland by lzc_ioctl().
47  *
48  * The registration arguments are as follows:
49  *
50  * const char *name
51  *   The name of the ioctl.  This is used for history logging.  If the
52  *   ioctl returns successfully (the callback returns 0), and allow_log
53  *   is true, then a history log entry will be recorded with the input &
54  *   output nvlists.  The log entry can be printed with "zpool history -i".
55  *
56  * zfs_ioc_t ioc
57  *   The ioctl request number, which userland will pass to ioctl(2).
58  *   The ioctl numbers can change from release to release, because
59  *   the caller (libzfs) must be matched to the kernel.
60  *
61  * zfs_secpolicy_func_t *secpolicy
62  *   This function will be called before the zfs_ioc_func_t, to
63  *   determine if this operation is permitted.  It should return EPERM
64  *   on failure, and 0 on success.  Checks include determining if the
65  *   dataset is visible in this zone, and if the user has either all
66  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
67  *   to do this operation on this dataset with "zfs allow".
68  *
69  * zfs_ioc_namecheck_t namecheck
70  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
71  *   name, a dataset name, or nothing.  If the name is not well-formed,
72  *   the ioctl will fail and the callback will not be called.
73  *   Therefore, the callback can assume that the name is well-formed
74  *   (e.g. is null-terminated, doesn't have more than one '@' character,
75  *   doesn't have invalid characters).
76  *
77  * zfs_ioc_poolcheck_t pool_check
78  *   This specifies requirements on the pool state.  If the pool does
79  *   not meet them (is suspended or is readonly), the ioctl will fail
80  *   and the callback will not be called.  If any checks are specified
81  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
82  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
83  *   POOL_CHECK_READONLY).
84  *
85  * boolean_t smush_outnvlist
86  *   If smush_outnvlist is true, then the output is presumed to be a
87  *   list of errors, and it will be "smushed" down to fit into the
88  *   caller's buffer, by removing some entries and replacing them with a
89  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
90  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
91  *   outnvlist does not fit into the userland-provided buffer, then the
92  *   ioctl will fail with ENOMEM.
93  *
94  * zfs_ioc_func_t *func
95  *   The callback function that will perform the operation.
96  *
97  *   The callback should return 0 on success, or an error number on
98  *   failure.  If the function fails, the userland ioctl will return -1,
99  *   and errno will be set to the callback's return value.  The callback
100  *   will be called with the following arguments:
101  *
102  *   const char *name
103  *     The name of the pool or dataset to operate on, from
104  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
105  *     expected type (pool, dataset, or none).
106  *
107  *   nvlist_t *innvl
108  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
109  *     NULL if no input nvlist was provided.  Changes to this nvlist are
110  *     ignored.  If the input nvlist could not be deserialized, the
111  *     ioctl will fail and the callback will not be called.
112  *
113  *   nvlist_t *outnvl
114  *     The output nvlist, initially empty.  The callback can fill it in,
115  *     and it will be returned to userland by serializing it into
116  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
117  *     fails (e.g. because the caller didn't supply a large enough
118  *     buffer), then the overall ioctl will fail.  See the
119  *     'smush_nvlist' argument above for additional behaviors.
120  *
121  *     There are two typical uses of the output nvlist:
122  *       - To return state, e.g. property values.  In this case,
123  *         smush_outnvlist should be false.  If the buffer was not large
124  *         enough, the caller will reallocate a larger buffer and try
125  *         the ioctl again.
126  *
127  *       - To return multiple errors from an ioctl which makes on-disk
128  *         changes.  In this case, smush_outnvlist should be true.
129  *         Ioctls which make on-disk modifications should generally not
130  *         use the outnvl if they succeed, because the caller can not
131  *         distinguish between the operation failing, and
132  *         deserialization failing.
133  */
134 
135 #include <sys/types.h>
136 #include <sys/param.h>
137 #include <sys/errno.h>
138 #include <sys/uio.h>
139 #include <sys/buf.h>
140 #include <sys/modctl.h>
141 #include <sys/open.h>
142 #include <sys/file.h>
143 #include <sys/kmem.h>
144 #include <sys/conf.h>
145 #include <sys/cmn_err.h>
146 #include <sys/stat.h>
147 #include <sys/zfs_ioctl.h>
148 #include <sys/zfs_vfsops.h>
149 #include <sys/zfs_znode.h>
150 #include <sys/zap.h>
151 #include <sys/spa.h>
152 #include <sys/spa_impl.h>
153 #include <sys/vdev.h>
154 #include <sys/priv_impl.h>
155 #include <sys/dmu.h>
156 #include <sys/dsl_dir.h>
157 #include <sys/dsl_dataset.h>
158 #include <sys/dsl_prop.h>
159 #include <sys/dsl_deleg.h>
160 #include <sys/dmu_objset.h>
161 #include <sys/dmu_impl.h>
162 #include <sys/dmu_tx.h>
163 #include <sys/ddi.h>
164 #include <sys/sunddi.h>
165 #include <sys/sunldi.h>
166 #include <sys/policy.h>
167 #include <sys/zone.h>
168 #include <sys/nvpair.h>
169 #include <sys/pathname.h>
170 #include <sys/mount.h>
171 #include <sys/sdt.h>
172 #include <sys/fs/zfs.h>
173 #include <sys/zfs_ctldir.h>
174 #include <sys/zfs_dir.h>
175 #include <sys/zfs_onexit.h>
176 #include <sys/zvol.h>
177 #include <sys/dsl_scan.h>
178 #include <sharefs/share.h>
179 #include <sys/dmu_objset.h>
180 #include <sys/dmu_send.h>
181 #include <sys/dsl_destroy.h>
182 #include <sys/dsl_bookmark.h>
183 #include <sys/dsl_userhold.h>
184 #include <sys/zfeature.h>
185 #include <sys/zio_checksum.h>
186 #include <sys/zfs_events.h>
187 
188 #include "zfs_namecheck.h"
189 #include "zfs_prop.h"
190 #include "zfs_deleg.h"
191 #include "zfs_comutil.h"
192 
193 extern struct modlfs zfs_modlfs;
194 
195 extern void zfs_init(void);
196 extern void zfs_fini(void);
197 
198 ldi_ident_t zfs_li = NULL;
199 dev_info_t *zfs_dip;
200 
201 uint_t zfs_fsyncer_key;
202 extern uint_t rrw_tsd_key;
203 static uint_t zfs_allow_log_key;
204 
205 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
206 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
207 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
208 
209 typedef enum {
210 	NO_NAME,
211 	POOL_NAME,
212 	DATASET_NAME
213 } zfs_ioc_namecheck_t;
214 
215 typedef enum {
216 	POOL_CHECK_NONE		= 1 << 0,
217 	POOL_CHECK_SUSPENDED	= 1 << 1,
218 	POOL_CHECK_READONLY	= 1 << 2,
219 } zfs_ioc_poolcheck_t;
220 
221 typedef struct zfs_ioc_vec {
222 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
223 	zfs_ioc_func_t		*zvec_func;
224 	zfs_secpolicy_func_t	*zvec_secpolicy;
225 	zfs_ioc_namecheck_t	zvec_namecheck;
226 	boolean_t		zvec_allow_log;
227 	zfs_ioc_poolcheck_t	zvec_pool_check;
228 	boolean_t		zvec_smush_outnvlist;
229 	const char		*zvec_name;
230 } zfs_ioc_vec_t;
231 
232 /* This array is indexed by zfs_userquota_prop_t */
233 static const char *userquota_perms[] = {
234 	ZFS_DELEG_PERM_USERUSED,
235 	ZFS_DELEG_PERM_USERQUOTA,
236 	ZFS_DELEG_PERM_GROUPUSED,
237 	ZFS_DELEG_PERM_GROUPQUOTA,
238 };
239 
240 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
241 static int zfs_check_settable(const char *name, nvpair_t *property,
242     cred_t *cr);
243 static int zfs_check_clearable(char *dataset, nvlist_t *props,
244     nvlist_t **errors);
245 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
246     boolean_t *);
247 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
248 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
249 
250 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
251 
252 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
253 void
254 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
255 {
256 	const char *newfile;
257 	char buf[512];
258 	va_list adx;
259 
260 	/*
261 	 * Get rid of annoying "../common/" prefix to filename.
262 	 */
263 	newfile = strrchr(file, '/');
264 	if (newfile != NULL) {
265 		newfile = newfile + 1; /* Get rid of leading / */
266 	} else {
267 		newfile = file;
268 	}
269 
270 	va_start(adx, fmt);
271 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
272 	va_end(adx);
273 
274 	/*
275 	 * To get this data, use the zfs-dprintf probe as so:
276 	 * dtrace -q -n 'zfs-dprintf \
277 	 *	/stringof(arg0) == "dbuf.c"/ \
278 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
279 	 * arg0 = file name
280 	 * arg1 = function name
281 	 * arg2 = line number
282 	 * arg3 = message
283 	 */
284 	DTRACE_PROBE4(zfs__dprintf,
285 	    char *, newfile, char *, func, int, line, char *, buf);
286 }
287 
288 static void
289 history_str_free(char *buf)
290 {
291 	kmem_free(buf, HIS_MAX_RECORD_LEN);
292 }
293 
294 static char *
295 history_str_get(zfs_cmd_t *zc)
296 {
297 	char *buf;
298 
299 	if (zc->zc_history == NULL)
300 		return (NULL);
301 
302 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
303 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
304 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
305 		history_str_free(buf);
306 		return (NULL);
307 	}
308 
309 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
310 
311 	return (buf);
312 }
313 
314 /*
315  * Check to see if the named dataset is currently defined as bootable
316  */
317 static boolean_t
318 zfs_is_bootfs(const char *name)
319 {
320 	objset_t *os;
321 
322 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
323 		boolean_t ret;
324 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
325 		dmu_objset_rele(os, FTAG);
326 		return (ret);
327 	}
328 	return (B_FALSE);
329 }
330 
331 /*
332  * Return non-zero if the spa version is less than requested version.
333  */
334 static int
335 zfs_earlier_version(const char *name, int version)
336 {
337 	spa_t *spa;
338 
339 	if (spa_open(name, &spa, FTAG) == 0) {
340 		if (spa_version(spa) < version) {
341 			spa_close(spa, FTAG);
342 			return (1);
343 		}
344 		spa_close(spa, FTAG);
345 	}
346 	return (0);
347 }
348 
349 /*
350  * Return TRUE if the ZPL version is less than requested version.
351  */
352 static boolean_t
353 zpl_earlier_version(const char *name, int version)
354 {
355 	objset_t *os;
356 	boolean_t rc = B_TRUE;
357 
358 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
359 		uint64_t zplversion;
360 
361 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
362 			dmu_objset_rele(os, FTAG);
363 			return (B_TRUE);
364 		}
365 		/* XXX reading from non-owned objset */
366 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
367 			rc = zplversion < version;
368 		dmu_objset_rele(os, FTAG);
369 	}
370 	return (rc);
371 }
372 
373 static void
374 zfs_log_history(zfs_cmd_t *zc)
375 {
376 	spa_t *spa;
377 	char *buf;
378 
379 	if ((buf = history_str_get(zc)) == NULL)
380 		return;
381 
382 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
383 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
384 			(void) spa_history_log(spa, buf);
385 		spa_close(spa, FTAG);
386 	}
387 	history_str_free(buf);
388 }
389 
390 /*
391  * Policy for top-level read operations (list pools).  Requires no privileges,
392  * and can be used in the local zone, as there is no associated dataset.
393  */
394 /* ARGSUSED */
395 static int
396 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
397 {
398 	return (0);
399 }
400 
401 /*
402  * Policy for dataset read operations (list children, get statistics).  Requires
403  * no privileges, but must be visible in the local zone.
404  */
405 /* ARGSUSED */
406 static int
407 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
408 {
409 	if (INGLOBALZONE(curproc) ||
410 	    zone_dataset_visible(zc->zc_name, NULL))
411 		return (0);
412 
413 	return (SET_ERROR(ENOENT));
414 }
415 
416 static int
417 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
418 {
419 	int writable = 1;
420 
421 	/*
422 	 * The dataset must be visible by this zone -- check this first
423 	 * so they don't see EPERM on something they shouldn't know about.
424 	 */
425 	if (!INGLOBALZONE(curproc) &&
426 	    !zone_dataset_visible(dataset, &writable))
427 		return (SET_ERROR(ENOENT));
428 
429 	if (INGLOBALZONE(curproc)) {
430 		/*
431 		 * If the fs is zoned, only root can access it from the
432 		 * global zone.
433 		 */
434 		if (secpolicy_zfs(cr) && zoned)
435 			return (SET_ERROR(EPERM));
436 	} else {
437 		/*
438 		 * If we are in a local zone, the 'zoned' property must be set.
439 		 */
440 		if (!zoned)
441 			return (SET_ERROR(EPERM));
442 
443 		/* must be writable by this zone */
444 		if (!writable)
445 			return (SET_ERROR(EPERM));
446 	}
447 	return (0);
448 }
449 
450 static int
451 zfs_dozonecheck(const char *dataset, cred_t *cr)
452 {
453 	uint64_t zoned;
454 
455 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
456 		return (SET_ERROR(ENOENT));
457 
458 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
459 }
460 
461 static int
462 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
463 {
464 	uint64_t zoned;
465 
466 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
467 		return (SET_ERROR(ENOENT));
468 
469 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
470 }
471 
472 static int
473 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
474     const char *perm, cred_t *cr)
475 {
476 	int error;
477 
478 	error = zfs_dozonecheck_ds(name, ds, cr);
479 	if (error == 0) {
480 		error = secpolicy_zfs(cr);
481 		if (error != 0)
482 			error = dsl_deleg_access_impl(ds, perm, cr);
483 	}
484 	return (error);
485 }
486 
487 static int
488 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
489 {
490 	int error;
491 	dsl_dataset_t *ds;
492 	dsl_pool_t *dp;
493 
494 	error = dsl_pool_hold(name, FTAG, &dp);
495 	if (error != 0)
496 		return (error);
497 
498 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
499 	if (error != 0) {
500 		dsl_pool_rele(dp, FTAG);
501 		return (error);
502 	}
503 
504 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
505 
506 	dsl_dataset_rele(ds, FTAG);
507 	dsl_pool_rele(dp, FTAG);
508 	return (error);
509 }
510 
511 /*
512  * Policy for setting the security label property.
513  *
514  * Returns 0 for success, non-zero for access and other errors.
515  */
516 static int
517 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
518 {
519 	char		ds_hexsl[MAXNAMELEN];
520 	bslabel_t	ds_sl, new_sl;
521 	boolean_t	new_default = FALSE;
522 	uint64_t	zoned;
523 	int		needed_priv = -1;
524 	int		error;
525 
526 	/* First get the existing dataset label. */
527 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
528 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
529 	if (error != 0)
530 		return (SET_ERROR(EPERM));
531 
532 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
533 		new_default = TRUE;
534 
535 	/* The label must be translatable */
536 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
537 		return (SET_ERROR(EINVAL));
538 
539 	/*
540 	 * In a non-global zone, disallow attempts to set a label that
541 	 * doesn't match that of the zone; otherwise no other checks
542 	 * are needed.
543 	 */
544 	if (!INGLOBALZONE(curproc)) {
545 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
546 			return (SET_ERROR(EPERM));
547 		return (0);
548 	}
549 
550 	/*
551 	 * For global-zone datasets (i.e., those whose zoned property is
552 	 * "off", verify that the specified new label is valid for the
553 	 * global zone.
554 	 */
555 	if (dsl_prop_get_integer(name,
556 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
557 		return (SET_ERROR(EPERM));
558 	if (!zoned) {
559 		if (zfs_check_global_label(name, strval) != 0)
560 			return (SET_ERROR(EPERM));
561 	}
562 
563 	/*
564 	 * If the existing dataset label is nondefault, check if the
565 	 * dataset is mounted (label cannot be changed while mounted).
566 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
567 	 * mounted (or isn't a dataset, doesn't exist, ...).
568 	 */
569 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
570 		objset_t *os;
571 		static char *setsl_tag = "setsl_tag";
572 
573 		/*
574 		 * Try to own the dataset; abort if there is any error,
575 		 * (e.g., already mounted, in use, or other error).
576 		 */
577 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
578 		    setsl_tag, &os);
579 		if (error != 0)
580 			return (SET_ERROR(EPERM));
581 
582 		dmu_objset_disown(os, setsl_tag);
583 
584 		if (new_default) {
585 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
586 			goto out_check;
587 		}
588 
589 		if (hexstr_to_label(strval, &new_sl) != 0)
590 			return (SET_ERROR(EPERM));
591 
592 		if (blstrictdom(&ds_sl, &new_sl))
593 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
594 		else if (blstrictdom(&new_sl, &ds_sl))
595 			needed_priv = PRIV_FILE_UPGRADE_SL;
596 	} else {
597 		/* dataset currently has a default label */
598 		if (!new_default)
599 			needed_priv = PRIV_FILE_UPGRADE_SL;
600 	}
601 
602 out_check:
603 	if (needed_priv != -1)
604 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
605 	return (0);
606 }
607 
608 static int
609 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
610     cred_t *cr)
611 {
612 	char *strval;
613 
614 	/*
615 	 * Check permissions for special properties.
616 	 */
617 	switch (prop) {
618 	case ZFS_PROP_ZONED:
619 		/*
620 		 * Disallow setting of 'zoned' from within a local zone.
621 		 */
622 		if (!INGLOBALZONE(curproc))
623 			return (SET_ERROR(EPERM));
624 		break;
625 
626 	case ZFS_PROP_QUOTA:
627 	case ZFS_PROP_FILESYSTEM_LIMIT:
628 	case ZFS_PROP_SNAPSHOT_LIMIT:
629 		if (!INGLOBALZONE(curproc)) {
630 			uint64_t zoned;
631 			char setpoint[MAXNAMELEN];
632 			/*
633 			 * Unprivileged users are allowed to modify the
634 			 * limit on things *under* (ie. contained by)
635 			 * the thing they own.
636 			 */
637 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
638 			    setpoint))
639 				return (SET_ERROR(EPERM));
640 			if (!zoned || strlen(dsname) <= strlen(setpoint))
641 				return (SET_ERROR(EPERM));
642 		}
643 		break;
644 
645 	case ZFS_PROP_MLSLABEL:
646 		if (!is_system_labeled())
647 			return (SET_ERROR(EPERM));
648 
649 		if (nvpair_value_string(propval, &strval) == 0) {
650 			int err;
651 
652 			err = zfs_set_slabel_policy(dsname, strval, CRED());
653 			if (err != 0)
654 				return (err);
655 		}
656 		break;
657 	}
658 
659 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
660 }
661 
662 /* ARGSUSED */
663 static int
664 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
665 {
666 	int error;
667 
668 	error = zfs_dozonecheck(zc->zc_name, cr);
669 	if (error != 0)
670 		return (error);
671 
672 	/*
673 	 * permission to set permissions will be evaluated later in
674 	 * dsl_deleg_can_allow()
675 	 */
676 	return (0);
677 }
678 
679 /* ARGSUSED */
680 static int
681 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
682 {
683 	return (zfs_secpolicy_write_perms(zc->zc_name,
684 	    ZFS_DELEG_PERM_ROLLBACK, cr));
685 }
686 
687 /* ARGSUSED */
688 static int
689 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
690 {
691 	dsl_pool_t *dp;
692 	dsl_dataset_t *ds;
693 	char *cp;
694 	int error;
695 
696 	/*
697 	 * Generate the current snapshot name from the given objsetid, then
698 	 * use that name for the secpolicy/zone checks.
699 	 */
700 	cp = strchr(zc->zc_name, '@');
701 	if (cp == NULL)
702 		return (SET_ERROR(EINVAL));
703 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
704 	if (error != 0)
705 		return (error);
706 
707 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
708 	if (error != 0) {
709 		dsl_pool_rele(dp, FTAG);
710 		return (error);
711 	}
712 
713 	dsl_dataset_name(ds, zc->zc_name);
714 
715 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
716 	    ZFS_DELEG_PERM_SEND, cr);
717 	dsl_dataset_rele(ds, FTAG);
718 	dsl_pool_rele(dp, FTAG);
719 
720 	return (error);
721 }
722 
723 /* ARGSUSED */
724 static int
725 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
726 {
727 	return (zfs_secpolicy_write_perms(zc->zc_name,
728 	    ZFS_DELEG_PERM_SEND, cr));
729 }
730 
731 /* ARGSUSED */
732 static int
733 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
734 {
735 	vnode_t *vp;
736 	int error;
737 
738 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
739 	    NO_FOLLOW, NULL, &vp)) != 0)
740 		return (error);
741 
742 	/* Now make sure mntpnt and dataset are ZFS */
743 
744 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
745 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
746 	    zc->zc_name) != 0)) {
747 		VN_RELE(vp);
748 		return (SET_ERROR(EPERM));
749 	}
750 
751 	VN_RELE(vp);
752 	return (dsl_deleg_access(zc->zc_name,
753 	    ZFS_DELEG_PERM_SHARE, cr));
754 }
755 
756 int
757 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
758 {
759 	if (!INGLOBALZONE(curproc))
760 		return (SET_ERROR(EPERM));
761 
762 	if (secpolicy_nfs(cr) == 0) {
763 		return (0);
764 	} else {
765 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
766 	}
767 }
768 
769 int
770 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
771 {
772 	if (!INGLOBALZONE(curproc))
773 		return (SET_ERROR(EPERM));
774 
775 	if (secpolicy_smb(cr) == 0) {
776 		return (0);
777 	} else {
778 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
779 	}
780 }
781 
782 static int
783 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
784 {
785 	char *cp;
786 
787 	/*
788 	 * Remove the @bla or /bla from the end of the name to get the parent.
789 	 */
790 	(void) strncpy(parent, datasetname, parentsize);
791 	cp = strrchr(parent, '@');
792 	if (cp != NULL) {
793 		cp[0] = '\0';
794 	} else {
795 		cp = strrchr(parent, '/');
796 		if (cp == NULL)
797 			return (SET_ERROR(ENOENT));
798 		cp[0] = '\0';
799 	}
800 
801 	return (0);
802 }
803 
804 int
805 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
806 {
807 	int error;
808 
809 	if ((error = zfs_secpolicy_write_perms(name,
810 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
811 		return (error);
812 
813 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
814 }
815 
816 /* ARGSUSED */
817 static int
818 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
819 {
820 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
821 }
822 
823 /*
824  * Destroying snapshots with delegated permissions requires
825  * descendant mount and destroy permissions.
826  */
827 /* ARGSUSED */
828 static int
829 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
830 {
831 	nvlist_t *snaps;
832 	nvpair_t *pair, *nextpair;
833 	int error = 0;
834 
835 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
836 		return (SET_ERROR(EINVAL));
837 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
838 	    pair = nextpair) {
839 		nextpair = nvlist_next_nvpair(snaps, pair);
840 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
841 		if (error == ENOENT) {
842 			/*
843 			 * Ignore any snapshots that don't exist (we consider
844 			 * them "already destroyed").  Remove the name from the
845 			 * nvl here in case the snapshot is created between
846 			 * now and when we try to destroy it (in which case
847 			 * we don't want to destroy it since we haven't
848 			 * checked for permission).
849 			 */
850 			fnvlist_remove_nvpair(snaps, pair);
851 			error = 0;
852 		}
853 		if (error != 0)
854 			break;
855 	}
856 
857 	return (error);
858 }
859 
860 int
861 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
862 {
863 	char	parentname[MAXNAMELEN];
864 	int	error;
865 
866 	if ((error = zfs_secpolicy_write_perms(from,
867 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
868 		return (error);
869 
870 	if ((error = zfs_secpolicy_write_perms(from,
871 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
872 		return (error);
873 
874 	if ((error = zfs_get_parent(to, parentname,
875 	    sizeof (parentname))) != 0)
876 		return (error);
877 
878 	if ((error = zfs_secpolicy_write_perms(parentname,
879 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
880 		return (error);
881 
882 	if ((error = zfs_secpolicy_write_perms(parentname,
883 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
884 		return (error);
885 
886 	return (error);
887 }
888 
889 /* ARGSUSED */
890 static int
891 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
892 {
893 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
894 }
895 
896 /* ARGSUSED */
897 static int
898 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
899 {
900 	dsl_pool_t *dp;
901 	dsl_dataset_t *clone;
902 	int error;
903 
904 	error = zfs_secpolicy_write_perms(zc->zc_name,
905 	    ZFS_DELEG_PERM_PROMOTE, cr);
906 	if (error != 0)
907 		return (error);
908 
909 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
910 	if (error != 0)
911 		return (error);
912 
913 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
914 
915 	if (error == 0) {
916 		char parentname[MAXNAMELEN];
917 		dsl_dataset_t *origin = NULL;
918 		dsl_dir_t *dd;
919 		dd = clone->ds_dir;
920 
921 		error = dsl_dataset_hold_obj(dd->dd_pool,
922 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
923 		if (error != 0) {
924 			dsl_dataset_rele(clone, FTAG);
925 			dsl_pool_rele(dp, FTAG);
926 			return (error);
927 		}
928 
929 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
930 		    ZFS_DELEG_PERM_MOUNT, cr);
931 
932 		dsl_dataset_name(origin, parentname);
933 		if (error == 0) {
934 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
935 			    ZFS_DELEG_PERM_PROMOTE, cr);
936 		}
937 		dsl_dataset_rele(clone, FTAG);
938 		dsl_dataset_rele(origin, FTAG);
939 	}
940 	dsl_pool_rele(dp, FTAG);
941 	return (error);
942 }
943 
944 /* ARGSUSED */
945 static int
946 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
947 {
948 	int error;
949 
950 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
951 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
952 		return (error);
953 
954 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
955 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
956 		return (error);
957 
958 	return (zfs_secpolicy_write_perms(zc->zc_name,
959 	    ZFS_DELEG_PERM_CREATE, cr));
960 }
961 
962 int
963 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
964 {
965 	return (zfs_secpolicy_write_perms(name,
966 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
967 }
968 
969 /*
970  * Check for permission to create each snapshot in the nvlist.
971  */
972 /* ARGSUSED */
973 static int
974 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
975 {
976 	nvlist_t *snaps;
977 	int error = 0;
978 	nvpair_t *pair;
979 
980 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
981 		return (SET_ERROR(EINVAL));
982 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
983 	    pair = nvlist_next_nvpair(snaps, pair)) {
984 		char *name = nvpair_name(pair);
985 		char *atp = strchr(name, '@');
986 
987 		if (atp == NULL) {
988 			error = SET_ERROR(EINVAL);
989 			break;
990 		}
991 		*atp = '\0';
992 		error = zfs_secpolicy_snapshot_perms(name, cr);
993 		*atp = '@';
994 		if (error != 0)
995 			break;
996 	}
997 	return (error);
998 }
999 
1000 /*
1001  * Check for permission to create each snapshot in the nvlist.
1002  */
1003 /* ARGSUSED */
1004 static int
1005 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1006 {
1007 	int error = 0;
1008 
1009 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1010 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1011 		char *name = nvpair_name(pair);
1012 		char *hashp = strchr(name, '#');
1013 
1014 		if (hashp == NULL) {
1015 			error = SET_ERROR(EINVAL);
1016 			break;
1017 		}
1018 		*hashp = '\0';
1019 		error = zfs_secpolicy_write_perms(name,
1020 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1021 		*hashp = '#';
1022 		if (error != 0)
1023 			break;
1024 	}
1025 	return (error);
1026 }
1027 
1028 /* ARGSUSED */
1029 static int
1030 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1031 {
1032 	nvpair_t *pair, *nextpair;
1033 	int error = 0;
1034 
1035 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1036 	    pair = nextpair) {
1037 		char *name = nvpair_name(pair);
1038 		char *hashp = strchr(name, '#');
1039 		nextpair = nvlist_next_nvpair(innvl, pair);
1040 
1041 		if (hashp == NULL) {
1042 			error = SET_ERROR(EINVAL);
1043 			break;
1044 		}
1045 
1046 		*hashp = '\0';
1047 		error = zfs_secpolicy_write_perms(name,
1048 		    ZFS_DELEG_PERM_DESTROY, cr);
1049 		*hashp = '#';
1050 		if (error == ENOENT) {
1051 			/*
1052 			 * Ignore any filesystems that don't exist (we consider
1053 			 * their bookmarks "already destroyed").  Remove
1054 			 * the name from the nvl here in case the filesystem
1055 			 * is created between now and when we try to destroy
1056 			 * the bookmark (in which case we don't want to
1057 			 * destroy it since we haven't checked for permission).
1058 			 */
1059 			fnvlist_remove_nvpair(innvl, pair);
1060 			error = 0;
1061 		}
1062 		if (error != 0)
1063 			break;
1064 	}
1065 
1066 	return (error);
1067 }
1068 
1069 /* ARGSUSED */
1070 static int
1071 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1072 {
1073 	/*
1074 	 * Even root must have a proper TSD so that we know what pool
1075 	 * to log to.
1076 	 */
1077 	if (tsd_get(zfs_allow_log_key) == NULL)
1078 		return (SET_ERROR(EPERM));
1079 	return (0);
1080 }
1081 
1082 static int
1083 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1084 {
1085 	char	parentname[MAXNAMELEN];
1086 	int	error;
1087 	char	*origin;
1088 
1089 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1090 	    sizeof (parentname))) != 0)
1091 		return (error);
1092 
1093 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1094 	    (error = zfs_secpolicy_write_perms(origin,
1095 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1096 		return (error);
1097 
1098 	if ((error = zfs_secpolicy_write_perms(parentname,
1099 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1100 		return (error);
1101 
1102 	return (zfs_secpolicy_write_perms(parentname,
1103 	    ZFS_DELEG_PERM_MOUNT, cr));
1104 }
1105 
1106 /*
1107  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1108  * SYS_CONFIG privilege, which is not available in a local zone.
1109  */
1110 /* ARGSUSED */
1111 static int
1112 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1113 {
1114 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1115 		return (SET_ERROR(EPERM));
1116 
1117 	return (0);
1118 }
1119 
1120 /*
1121  * Policy for object to name lookups.
1122  */
1123 /* ARGSUSED */
1124 static int
1125 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1126 {
1127 	int error;
1128 
1129 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1130 		return (0);
1131 
1132 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1133 	return (error);
1134 }
1135 
1136 /*
1137  * Policy for fault injection.  Requires all privileges.
1138  */
1139 /* ARGSUSED */
1140 static int
1141 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1142 {
1143 	return (secpolicy_zinject(cr));
1144 }
1145 
1146 /* ARGSUSED */
1147 static int
1148 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1149 {
1150 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1151 
1152 	if (prop == ZPROP_INVAL) {
1153 		if (!zfs_prop_user(zc->zc_value))
1154 			return (SET_ERROR(EINVAL));
1155 		return (zfs_secpolicy_write_perms(zc->zc_name,
1156 		    ZFS_DELEG_PERM_USERPROP, cr));
1157 	} else {
1158 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1159 		    NULL, cr));
1160 	}
1161 }
1162 
1163 static int
1164 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1165 {
1166 	int err = zfs_secpolicy_read(zc, innvl, cr);
1167 	if (err)
1168 		return (err);
1169 
1170 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1171 		return (SET_ERROR(EINVAL));
1172 
1173 	if (zc->zc_value[0] == 0) {
1174 		/*
1175 		 * They are asking about a posix uid/gid.  If it's
1176 		 * themself, allow it.
1177 		 */
1178 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1179 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1180 			if (zc->zc_guid == crgetuid(cr))
1181 				return (0);
1182 		} else {
1183 			if (groupmember(zc->zc_guid, cr))
1184 				return (0);
1185 		}
1186 	}
1187 
1188 	return (zfs_secpolicy_write_perms(zc->zc_name,
1189 	    userquota_perms[zc->zc_objset_type], cr));
1190 }
1191 
1192 static int
1193 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1194 {
1195 	int err = zfs_secpolicy_read(zc, innvl, cr);
1196 	if (err)
1197 		return (err);
1198 
1199 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1200 		return (SET_ERROR(EINVAL));
1201 
1202 	return (zfs_secpolicy_write_perms(zc->zc_name,
1203 	    userquota_perms[zc->zc_objset_type], cr));
1204 }
1205 
1206 /* ARGSUSED */
1207 static int
1208 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1209 {
1210 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1211 	    NULL, cr));
1212 }
1213 
1214 /* ARGSUSED */
1215 static int
1216 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1217 {
1218 	nvpair_t *pair;
1219 	nvlist_t *holds;
1220 	int error;
1221 
1222 	error = nvlist_lookup_nvlist(innvl, "holds", &holds);
1223 	if (error != 0)
1224 		return (SET_ERROR(EINVAL));
1225 
1226 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1227 	    pair = nvlist_next_nvpair(holds, pair)) {
1228 		char fsname[MAXNAMELEN];
1229 		error = dmu_fsname(nvpair_name(pair), fsname);
1230 		if (error != 0)
1231 			return (error);
1232 		error = zfs_secpolicy_write_perms(fsname,
1233 		    ZFS_DELEG_PERM_HOLD, cr);
1234 		if (error != 0)
1235 			return (error);
1236 	}
1237 	return (0);
1238 }
1239 
1240 /* ARGSUSED */
1241 static int
1242 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1243 {
1244 	nvpair_t *pair;
1245 	int error;
1246 
1247 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1248 	    pair = nvlist_next_nvpair(innvl, pair)) {
1249 		char fsname[MAXNAMELEN];
1250 		error = dmu_fsname(nvpair_name(pair), fsname);
1251 		if (error != 0)
1252 			return (error);
1253 		error = zfs_secpolicy_write_perms(fsname,
1254 		    ZFS_DELEG_PERM_RELEASE, cr);
1255 		if (error != 0)
1256 			return (error);
1257 	}
1258 	return (0);
1259 }
1260 
1261 /*
1262  * Policy for allowing temporary snapshots to be taken or released
1263  */
1264 static int
1265 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1266 {
1267 	/*
1268 	 * A temporary snapshot is the same as a snapshot,
1269 	 * hold, destroy and release all rolled into one.
1270 	 * Delegated diff alone is sufficient that we allow this.
1271 	 */
1272 	int error;
1273 
1274 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1275 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1276 		return (0);
1277 
1278 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1279 	if (error == 0)
1280 		error = zfs_secpolicy_hold(zc, innvl, cr);
1281 	if (error == 0)
1282 		error = zfs_secpolicy_release(zc, innvl, cr);
1283 	if (error == 0)
1284 		error = zfs_secpolicy_destroy(zc, innvl, cr);
1285 	return (error);
1286 }
1287 
1288 /*
1289  * Policy for allowing setting the zev callback list.
1290  */
1291 static int
1292 zfs_secpolicy_set_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1293 {
1294 	/* must be called from kernel context */
1295 	if (!(zc->zc_iflags & FKIOCTL))
1296 		return (SET_ERROR(EPERM));
1297 	/* callback pointer must be unset (set to default value) */
1298 	rw_enter(&rz_zev_rwlock, RW_READER);
1299 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
1300 		rw_exit(&rz_zev_rwlock);
1301 		return (SET_ERROR(EBUSY));
1302 	}
1303 	rw_exit(&rz_zev_rwlock);
1304 	return (0);
1305 }
1306 
1307 /*
1308  * Policy for allowing unsetting/resetting the zev callback list.
1309  */
1310 static int
1311 zfs_secpolicy_unset_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1312 {
1313 	/* must be called from kernel context */
1314 	if (!(zc->zc_iflags & FKIOCTL))
1315 		return (SET_ERROR(EPERM));
1316 	return (0);
1317 }
1318 
1319 /*
1320  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1321  */
1322 static int
1323 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1324 {
1325 	char *packed;
1326 	int error;
1327 	nvlist_t *list = NULL;
1328 
1329 	/*
1330 	 * Read in and unpack the user-supplied nvlist.
1331 	 */
1332 	if (size == 0)
1333 		return (SET_ERROR(EINVAL));
1334 
1335 	packed = kmem_alloc(size, KM_SLEEP);
1336 
1337 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1338 	    iflag)) != 0) {
1339 		kmem_free(packed, size);
1340 		return (SET_ERROR(EFAULT));
1341 	}
1342 
1343 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1344 		kmem_free(packed, size);
1345 		return (error);
1346 	}
1347 
1348 	kmem_free(packed, size);
1349 
1350 	*nvp = list;
1351 	return (0);
1352 }
1353 
1354 /*
1355  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1356  * Entries will be removed from the end of the nvlist, and one int32 entry
1357  * named "N_MORE_ERRORS" will be added indicating how many entries were
1358  * removed.
1359  */
1360 static int
1361 nvlist_smush(nvlist_t *errors, size_t max)
1362 {
1363 	size_t size;
1364 
1365 	size = fnvlist_size(errors);
1366 
1367 	if (size > max) {
1368 		nvpair_t *more_errors;
1369 		int n = 0;
1370 
1371 		if (max < 1024)
1372 			return (SET_ERROR(ENOMEM));
1373 
1374 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1375 		more_errors = nvlist_prev_nvpair(errors, NULL);
1376 
1377 		do {
1378 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1379 			    more_errors);
1380 			fnvlist_remove_nvpair(errors, pair);
1381 			n++;
1382 			size = fnvlist_size(errors);
1383 		} while (size > max);
1384 
1385 		fnvlist_remove_nvpair(errors, more_errors);
1386 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1387 		ASSERT3U(fnvlist_size(errors), <=, max);
1388 	}
1389 
1390 	return (0);
1391 }
1392 
1393 static int
1394 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1395 {
1396 	char *packed = NULL;
1397 	int error = 0;
1398 	size_t size;
1399 
1400 	size = fnvlist_size(nvl);
1401 
1402 	if (size > zc->zc_nvlist_dst_size) {
1403 		error = SET_ERROR(ENOMEM);
1404 	} else {
1405 		packed = fnvlist_pack(nvl, &size);
1406 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1407 		    size, zc->zc_iflags) != 0)
1408 			error = SET_ERROR(EFAULT);
1409 		fnvlist_pack_free(packed, size);
1410 	}
1411 
1412 	zc->zc_nvlist_dst_size = size;
1413 	zc->zc_nvlist_dst_filled = B_TRUE;
1414 	return (error);
1415 }
1416 
1417 static int
1418 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1419 {
1420 	objset_t *os;
1421 	int error;
1422 
1423 	error = dmu_objset_hold(dsname, FTAG, &os);
1424 	if (error != 0)
1425 		return (error);
1426 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1427 		dmu_objset_rele(os, FTAG);
1428 		return (SET_ERROR(EINVAL));
1429 	}
1430 
1431 	mutex_enter(&os->os_user_ptr_lock);
1432 	*zfvp = dmu_objset_get_user(os);
1433 	if (*zfvp) {
1434 		VFS_HOLD((*zfvp)->z_vfs);
1435 	} else {
1436 		error = SET_ERROR(ESRCH);
1437 	}
1438 	mutex_exit(&os->os_user_ptr_lock);
1439 	dmu_objset_rele(os, FTAG);
1440 	return (error);
1441 }
1442 
1443 /*
1444  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1445  * case its z_vfs will be NULL, and it will be opened as the owner.
1446  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1447  * which prevents all vnode ops from running.
1448  */
1449 static int
1450 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1451 {
1452 	int error = 0;
1453 
1454 	if (getzfsvfs(name, zfvp) != 0)
1455 		error = zfsvfs_create(name, zfvp);
1456 	if (error == 0) {
1457 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1458 		    RW_READER, tag);
1459 		if ((*zfvp)->z_unmounted) {
1460 			/*
1461 			 * XXX we could probably try again, since the unmounting
1462 			 * thread should be just about to disassociate the
1463 			 * objset from the zfsvfs.
1464 			 */
1465 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1466 			return (SET_ERROR(EBUSY));
1467 		}
1468 	}
1469 	return (error);
1470 }
1471 
1472 static void
1473 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1474 {
1475 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1476 
1477 	if (zfsvfs->z_vfs) {
1478 		VFS_RELE(zfsvfs->z_vfs);
1479 	} else {
1480 		dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1481 		zfsvfs_free(zfsvfs);
1482 	}
1483 }
1484 
1485 static int
1486 zfs_ioc_pool_create(zfs_cmd_t *zc)
1487 {
1488 	int error;
1489 	nvlist_t *config, *props = NULL;
1490 	nvlist_t *rootprops = NULL;
1491 	nvlist_t *zplprops = NULL;
1492 
1493 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1494 	    zc->zc_iflags, &config))
1495 		return (error);
1496 
1497 	if (zc->zc_nvlist_src_size != 0 && (error =
1498 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1499 	    zc->zc_iflags, &props))) {
1500 		nvlist_free(config);
1501 		return (error);
1502 	}
1503 
1504 	if (props) {
1505 		nvlist_t *nvl = NULL;
1506 		uint64_t version = SPA_VERSION;
1507 
1508 		(void) nvlist_lookup_uint64(props,
1509 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1510 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1511 			error = SET_ERROR(EINVAL);
1512 			goto pool_props_bad;
1513 		}
1514 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1515 		if (nvl) {
1516 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1517 			if (error != 0) {
1518 				nvlist_free(config);
1519 				nvlist_free(props);
1520 				return (error);
1521 			}
1522 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1523 		}
1524 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1525 		error = zfs_fill_zplprops_root(version, rootprops,
1526 		    zplprops, NULL);
1527 		if (error != 0)
1528 			goto pool_props_bad;
1529 	}
1530 
1531 	error = spa_create(zc->zc_name, config, props, zplprops);
1532 
1533 	/*
1534 	 * Set the remaining root properties
1535 	 */
1536 	if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1537 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1538 		(void) spa_destroy(zc->zc_name);
1539 
1540 pool_props_bad:
1541 	nvlist_free(rootprops);
1542 	nvlist_free(zplprops);
1543 	nvlist_free(config);
1544 	nvlist_free(props);
1545 
1546 	return (error);
1547 }
1548 
1549 static int
1550 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1551 {
1552 	int error;
1553 	zfs_log_history(zc);
1554 	error = spa_destroy(zc->zc_name);
1555 	if (error == 0)
1556 		zvol_remove_minors(zc->zc_name);
1557 	return (error);
1558 }
1559 
1560 static int
1561 zfs_ioc_pool_import(zfs_cmd_t *zc)
1562 {
1563 	nvlist_t *config, *props = NULL;
1564 	uint64_t guid;
1565 	int error;
1566 
1567 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1568 	    zc->zc_iflags, &config)) != 0)
1569 		return (error);
1570 
1571 	if (zc->zc_nvlist_src_size != 0 && (error =
1572 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1573 	    zc->zc_iflags, &props))) {
1574 		nvlist_free(config);
1575 		return (error);
1576 	}
1577 
1578 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1579 	    guid != zc->zc_guid)
1580 		error = SET_ERROR(EINVAL);
1581 	else
1582 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1583 
1584 	if (zc->zc_nvlist_dst != 0) {
1585 		int err;
1586 
1587 		if ((err = put_nvlist(zc, config)) != 0)
1588 			error = err;
1589 	}
1590 
1591 	nvlist_free(config);
1592 
1593 	nvlist_free(props);
1594 
1595 	return (error);
1596 }
1597 
1598 static int
1599 zfs_ioc_pool_export(zfs_cmd_t *zc)
1600 {
1601 	int error;
1602 	boolean_t force = (boolean_t)zc->zc_cookie;
1603 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1604 
1605 	zfs_log_history(zc);
1606 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1607 	if (error == 0)
1608 		zvol_remove_minors(zc->zc_name);
1609 	return (error);
1610 }
1611 
1612 static int
1613 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1614 {
1615 	nvlist_t *configs;
1616 	int error;
1617 
1618 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1619 		return (SET_ERROR(EEXIST));
1620 
1621 	error = put_nvlist(zc, configs);
1622 
1623 	nvlist_free(configs);
1624 
1625 	return (error);
1626 }
1627 
1628 /*
1629  * inputs:
1630  * zc_name		name of the pool
1631  *
1632  * outputs:
1633  * zc_cookie		real errno
1634  * zc_nvlist_dst	config nvlist
1635  * zc_nvlist_dst_size	size of config nvlist
1636  */
1637 static int
1638 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1639 {
1640 	nvlist_t *config;
1641 	int error;
1642 	int ret = 0;
1643 
1644 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1645 	    sizeof (zc->zc_value));
1646 
1647 	if (config != NULL) {
1648 		ret = put_nvlist(zc, config);
1649 		nvlist_free(config);
1650 
1651 		/*
1652 		 * The config may be present even if 'error' is non-zero.
1653 		 * In this case we return success, and preserve the real errno
1654 		 * in 'zc_cookie'.
1655 		 */
1656 		zc->zc_cookie = error;
1657 	} else {
1658 		ret = error;
1659 	}
1660 
1661 	return (ret);
1662 }
1663 
1664 /*
1665  * Try to import the given pool, returning pool stats as appropriate so that
1666  * user land knows which devices are available and overall pool health.
1667  */
1668 static int
1669 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1670 {
1671 	nvlist_t *tryconfig, *config;
1672 	int error;
1673 
1674 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1675 	    zc->zc_iflags, &tryconfig)) != 0)
1676 		return (error);
1677 
1678 	config = spa_tryimport(tryconfig);
1679 
1680 	nvlist_free(tryconfig);
1681 
1682 	if (config == NULL)
1683 		return (SET_ERROR(EINVAL));
1684 
1685 	error = put_nvlist(zc, config);
1686 	nvlist_free(config);
1687 
1688 	return (error);
1689 }
1690 
1691 /*
1692  * inputs:
1693  * zc_name              name of the pool
1694  * zc_cookie            scan func (pool_scan_func_t)
1695  */
1696 static int
1697 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1698 {
1699 	spa_t *spa;
1700 	int error;
1701 
1702 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1703 		return (error);
1704 
1705 	if (zc->zc_cookie == POOL_SCAN_NONE)
1706 		error = spa_scan_stop(spa);
1707 	else
1708 		error = spa_scan(spa, zc->zc_cookie);
1709 
1710 	spa_close(spa, FTAG);
1711 
1712 	return (error);
1713 }
1714 
1715 static int
1716 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1717 {
1718 	spa_t *spa;
1719 	int error;
1720 
1721 	error = spa_open(zc->zc_name, &spa, FTAG);
1722 	if (error == 0) {
1723 		spa_freeze(spa);
1724 		spa_close(spa, FTAG);
1725 	}
1726 	return (error);
1727 }
1728 
1729 static int
1730 zfs_ioc_arc_info(zfs_cmd_t *zc)
1731 {
1732 	int ret;
1733 	void *buf;
1734 	size_t sz = zc->zc_nvlist_dst_size;
1735 	size_t returned_bytes;
1736 
1737 	if (zc->zc_nvlist_dst == 0)
1738 		return (SET_ERROR(EINVAL));
1739 
1740 	buf = kmem_alloc(sz, KM_NOSLEEP);
1741 	if (buf == NULL)
1742 		return (SET_ERROR(ENOMEM));
1743 
1744 	ret = arc_dump(zc->zc_obj, buf, sz, &returned_bytes);
1745 	if (ret != 0) {
1746 		kmem_free(buf, sz);
1747 		return (SET_ERROR(ret));
1748 	}
1749 
1750 	zc->zc_nvlist_dst_filled = 1;
1751 	ret = ddi_copyout(buf, (void *)(uintptr_t)zc->zc_nvlist_dst,
1752 	    returned_bytes, zc->zc_iflags);
1753 	kmem_free(buf, sz);
1754 	if (ret != 0)
1755 		ret = SET_ERROR(EFAULT);
1756 
1757 	return (ret);
1758 }
1759 
1760 static int
1761 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1762 {
1763 	spa_t *spa;
1764 	int error;
1765 
1766 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1767 		return (error);
1768 
1769 	if (zc->zc_cookie < spa_version(spa) ||
1770 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1771 		spa_close(spa, FTAG);
1772 		return (SET_ERROR(EINVAL));
1773 	}
1774 
1775 	spa_upgrade(spa, zc->zc_cookie);
1776 	spa_close(spa, FTAG);
1777 
1778 	return (error);
1779 }
1780 
1781 static int
1782 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1783 {
1784 	spa_t *spa;
1785 	char *hist_buf;
1786 	uint64_t size;
1787 	int error;
1788 
1789 	if ((size = zc->zc_history_len) == 0)
1790 		return (SET_ERROR(EINVAL));
1791 
1792 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1793 		return (error);
1794 
1795 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1796 		spa_close(spa, FTAG);
1797 		return (SET_ERROR(ENOTSUP));
1798 	}
1799 
1800 	hist_buf = kmem_alloc(size, KM_SLEEP);
1801 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1802 	    &zc->zc_history_len, hist_buf)) == 0) {
1803 		error = ddi_copyout(hist_buf,
1804 		    (void *)(uintptr_t)zc->zc_history,
1805 		    zc->zc_history_len, zc->zc_iflags);
1806 	}
1807 
1808 	spa_close(spa, FTAG);
1809 	kmem_free(hist_buf, size);
1810 	return (error);
1811 }
1812 
1813 static int
1814 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1815 {
1816 	spa_t *spa;
1817 	int error;
1818 
1819 	error = spa_open(zc->zc_name, &spa, FTAG);
1820 	if (error == 0) {
1821 		error = spa_change_guid(spa);
1822 		spa_close(spa, FTAG);
1823 	}
1824 	return (error);
1825 }
1826 
1827 static int
1828 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1829 {
1830 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1831 }
1832 
1833 /*
1834  * inputs:
1835  * zc_name		name of filesystem
1836  * zc_obj		object to find
1837  *
1838  * outputs:
1839  * zc_value		name of object
1840  */
1841 static int
1842 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1843 {
1844 	objset_t *os;
1845 	int error;
1846 
1847 	/* XXX reading from objset not owned */
1848 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1849 		return (error);
1850 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1851 		dmu_objset_rele(os, FTAG);
1852 		return (SET_ERROR(EINVAL));
1853 	}
1854 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1855 	    sizeof (zc->zc_value));
1856 	dmu_objset_rele(os, FTAG);
1857 
1858 	return (error);
1859 }
1860 
1861 /*
1862  * inputs:
1863  * zc_name		name of filesystem
1864  * zc_obj		object to find
1865  *
1866  * outputs:
1867  * zc_stat		stats on object
1868  * zc_value		path to object
1869  */
1870 static int
1871 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1872 {
1873 	objset_t *os;
1874 	int error;
1875 
1876 	/* XXX reading from objset not owned */
1877 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1878 		return (error);
1879 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1880 		dmu_objset_rele(os, FTAG);
1881 		return (SET_ERROR(EINVAL));
1882 	}
1883 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1884 	    sizeof (zc->zc_value));
1885 	dmu_objset_rele(os, FTAG);
1886 
1887 	return (error);
1888 }
1889 
1890 static int
1891 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1892 {
1893 	spa_t *spa;
1894 	int error;
1895 	nvlist_t *config, **l2cache, **spares;
1896 	uint_t nl2cache = 0, nspares = 0;
1897 
1898 	error = spa_open(zc->zc_name, &spa, FTAG);
1899 	if (error != 0)
1900 		return (error);
1901 
1902 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1903 	    zc->zc_iflags, &config);
1904 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1905 	    &l2cache, &nl2cache);
1906 
1907 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1908 	    &spares, &nspares);
1909 
1910 	/*
1911 	 * A root pool with concatenated devices is not supported.
1912 	 * Thus, can not add a device to a root pool.
1913 	 *
1914 	 * Intent log device can not be added to a rootpool because
1915 	 * during mountroot, zil is replayed, a seperated log device
1916 	 * can not be accessed during the mountroot time.
1917 	 *
1918 	 * l2cache and spare devices are ok to be added to a rootpool.
1919 	 */
1920 	if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1921 		nvlist_free(config);
1922 		spa_close(spa, FTAG);
1923 		return (SET_ERROR(EDOM));
1924 	}
1925 
1926 	if (error == 0) {
1927 		error = spa_vdev_add(spa, config);
1928 		nvlist_free(config);
1929 	}
1930 	spa_close(spa, FTAG);
1931 	return (error);
1932 }
1933 
1934 /*
1935  * inputs:
1936  * zc_name		name of the pool
1937  * zc_nvlist_conf	nvlist of devices to remove
1938  * zc_cookie		to stop the remove?
1939  */
1940 static int
1941 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1942 {
1943 	spa_t *spa;
1944 	int error;
1945 
1946 	error = spa_open(zc->zc_name, &spa, FTAG);
1947 	if (error != 0)
1948 		return (error);
1949 	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1950 	spa_close(spa, FTAG);
1951 	return (error);
1952 }
1953 
1954 static int
1955 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1956 {
1957 	spa_t *spa;
1958 	int error;
1959 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1960 
1961 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1962 		return (error);
1963 	switch (zc->zc_cookie) {
1964 	case VDEV_STATE_ONLINE:
1965 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1966 		break;
1967 
1968 	case VDEV_STATE_OFFLINE:
1969 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1970 		break;
1971 
1972 	case VDEV_STATE_FAULTED:
1973 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1974 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1975 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1976 
1977 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1978 		break;
1979 
1980 	case VDEV_STATE_DEGRADED:
1981 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1982 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1983 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1984 
1985 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1986 		break;
1987 
1988 	default:
1989 		error = SET_ERROR(EINVAL);
1990 	}
1991 	zc->zc_cookie = newstate;
1992 	spa_close(spa, FTAG);
1993 	return (error);
1994 }
1995 
1996 static int
1997 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1998 {
1999 	spa_t *spa;
2000 	int replacing = zc->zc_cookie;
2001 	nvlist_t *config;
2002 	int error;
2003 
2004 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2005 		return (error);
2006 
2007 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2008 	    zc->zc_iflags, &config)) == 0) {
2009 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
2010 		nvlist_free(config);
2011 	}
2012 
2013 	spa_close(spa, FTAG);
2014 	return (error);
2015 }
2016 
2017 static int
2018 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
2019 {
2020 	spa_t *spa;
2021 	int error;
2022 
2023 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2024 		return (error);
2025 
2026 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
2027 
2028 	spa_close(spa, FTAG);
2029 	return (error);
2030 }
2031 
2032 static int
2033 zfs_ioc_vdev_split(zfs_cmd_t *zc)
2034 {
2035 	spa_t *spa;
2036 	nvlist_t *config, *props = NULL;
2037 	int error;
2038 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
2039 
2040 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2041 		return (error);
2042 
2043 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2044 	    zc->zc_iflags, &config)) {
2045 		spa_close(spa, FTAG);
2046 		return (error);
2047 	}
2048 
2049 	if (zc->zc_nvlist_src_size != 0 && (error =
2050 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2051 	    zc->zc_iflags, &props))) {
2052 		spa_close(spa, FTAG);
2053 		nvlist_free(config);
2054 		return (error);
2055 	}
2056 
2057 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2058 
2059 	spa_close(spa, FTAG);
2060 
2061 	nvlist_free(config);
2062 	nvlist_free(props);
2063 
2064 	return (error);
2065 }
2066 
2067 static int
2068 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2069 {
2070 	spa_t *spa;
2071 	char *path = zc->zc_value;
2072 	uint64_t guid = zc->zc_guid;
2073 	int error;
2074 
2075 	error = spa_open(zc->zc_name, &spa, FTAG);
2076 	if (error != 0)
2077 		return (error);
2078 
2079 	error = spa_vdev_setpath(spa, guid, path);
2080 	spa_close(spa, FTAG);
2081 	return (error);
2082 }
2083 
2084 static int
2085 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2086 {
2087 	spa_t *spa;
2088 	char *fru = zc->zc_value;
2089 	uint64_t guid = zc->zc_guid;
2090 	int error;
2091 
2092 	error = spa_open(zc->zc_name, &spa, FTAG);
2093 	if (error != 0)
2094 		return (error);
2095 
2096 	error = spa_vdev_setfru(spa, guid, fru);
2097 	spa_close(spa, FTAG);
2098 	return (error);
2099 }
2100 
2101 static int
2102 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2103 {
2104 	int error = 0;
2105 	nvlist_t *nv;
2106 
2107 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2108 
2109 	if (zc->zc_nvlist_dst != 0 &&
2110 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2111 		dmu_objset_stats(os, nv);
2112 		/*
2113 		 * NB: zvol_get_stats() will read the objset contents,
2114 		 * which we aren't supposed to do with a
2115 		 * DS_MODE_USER hold, because it could be
2116 		 * inconsistent.  So this is a bit of a workaround...
2117 		 * XXX reading with out owning
2118 		 */
2119 		if (!zc->zc_objset_stats.dds_inconsistent &&
2120 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2121 			error = zvol_get_stats(os, nv);
2122 			if (error == EIO)
2123 				return (error);
2124 			VERIFY0(error);
2125 		}
2126 		error = put_nvlist(zc, nv);
2127 		nvlist_free(nv);
2128 	}
2129 
2130 	return (error);
2131 }
2132 
2133 /*
2134  * inputs:
2135  * zc_name		name of filesystem
2136  * zc_nvlist_dst_size	size of buffer for property nvlist
2137  *
2138  * outputs:
2139  * zc_objset_stats	stats
2140  * zc_nvlist_dst	property nvlist
2141  * zc_nvlist_dst_size	size of property nvlist
2142  */
2143 static int
2144 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2145 {
2146 	objset_t *os;
2147 	int error;
2148 
2149 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2150 	if (error == 0) {
2151 		error = zfs_ioc_objset_stats_impl(zc, os);
2152 		dmu_objset_rele(os, FTAG);
2153 	}
2154 
2155 	return (error);
2156 }
2157 
2158 /*
2159  * inputs:
2160  * zc_name		name of filesystem
2161  * zc_nvlist_dst_size	size of buffer for property nvlist
2162  *
2163  * outputs:
2164  * zc_nvlist_dst	received property nvlist
2165  * zc_nvlist_dst_size	size of received property nvlist
2166  *
2167  * Gets received properties (distinct from local properties on or after
2168  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2169  * local property values.
2170  */
2171 static int
2172 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2173 {
2174 	int error = 0;
2175 	nvlist_t *nv;
2176 
2177 	/*
2178 	 * Without this check, we would return local property values if the
2179 	 * caller has not already received properties on or after
2180 	 * SPA_VERSION_RECVD_PROPS.
2181 	 */
2182 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2183 		return (SET_ERROR(ENOTSUP));
2184 
2185 	if (zc->zc_nvlist_dst != 0 &&
2186 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2187 		error = put_nvlist(zc, nv);
2188 		nvlist_free(nv);
2189 	}
2190 
2191 	return (error);
2192 }
2193 
2194 static int
2195 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2196 {
2197 	uint64_t value;
2198 	int error;
2199 
2200 	/*
2201 	 * zfs_get_zplprop() will either find a value or give us
2202 	 * the default value (if there is one).
2203 	 */
2204 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2205 		return (error);
2206 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2207 	return (0);
2208 }
2209 
2210 /*
2211  * inputs:
2212  * zc_name		name of filesystem
2213  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2214  *
2215  * outputs:
2216  * zc_nvlist_dst	zpl property nvlist
2217  * zc_nvlist_dst_size	size of zpl property nvlist
2218  */
2219 static int
2220 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2221 {
2222 	objset_t *os;
2223 	int err;
2224 
2225 	/* XXX reading without owning */
2226 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2227 		return (err);
2228 
2229 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2230 
2231 	/*
2232 	 * NB: nvl_add_zplprop() will read the objset contents,
2233 	 * which we aren't supposed to do with a DS_MODE_USER
2234 	 * hold, because it could be inconsistent.
2235 	 */
2236 	if (zc->zc_nvlist_dst != NULL &&
2237 	    !zc->zc_objset_stats.dds_inconsistent &&
2238 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2239 		nvlist_t *nv;
2240 
2241 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2242 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2243 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2244 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2245 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2246 			err = put_nvlist(zc, nv);
2247 		nvlist_free(nv);
2248 	} else {
2249 		err = SET_ERROR(ENOENT);
2250 	}
2251 	dmu_objset_rele(os, FTAG);
2252 	return (err);
2253 }
2254 
2255 static boolean_t
2256 dataset_name_hidden(const char *name)
2257 {
2258 	/*
2259 	 * Skip over datasets that are not visible in this zone,
2260 	 * internal datasets (which have a $ in their name), and
2261 	 * temporary datasets (which have a % in their name).
2262 	 */
2263 	if (strchr(name, '$') != NULL)
2264 		return (B_TRUE);
2265 	if (strchr(name, '%') != NULL)
2266 		return (B_TRUE);
2267 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2268 		return (B_TRUE);
2269 	return (B_FALSE);
2270 }
2271 
2272 /*
2273  * inputs:
2274  * zc_name		name of filesystem
2275  * zc_cookie		zap cursor
2276  * zc_nvlist_dst_size	size of buffer for property nvlist
2277  *
2278  * outputs:
2279  * zc_name		name of next filesystem
2280  * zc_cookie		zap cursor
2281  * zc_objset_stats	stats
2282  * zc_nvlist_dst	property nvlist
2283  * zc_nvlist_dst_size	size of property nvlist
2284  */
2285 static int
2286 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2287 {
2288 	objset_t *os;
2289 	int error;
2290 	char *p;
2291 	size_t orig_len = strlen(zc->zc_name);
2292 
2293 top:
2294 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2295 		if (error == ENOENT)
2296 			error = SET_ERROR(ESRCH);
2297 		return (error);
2298 	}
2299 
2300 	p = strrchr(zc->zc_name, '/');
2301 	if (p == NULL || p[1] != '\0')
2302 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2303 	p = zc->zc_name + strlen(zc->zc_name);
2304 
2305 	do {
2306 		error = dmu_dir_list_next(os,
2307 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2308 		    NULL, &zc->zc_cookie);
2309 		if (error == ENOENT)
2310 			error = SET_ERROR(ESRCH);
2311 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2312 	dmu_objset_rele(os, FTAG);
2313 
2314 	/*
2315 	 * If it's an internal dataset (ie. with a '$' in its name),
2316 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2317 	 */
2318 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2319 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2320 		if (error == ENOENT) {
2321 			/* We lost a race with destroy, get the next one. */
2322 			zc->zc_name[orig_len] = '\0';
2323 			goto top;
2324 		}
2325 	}
2326 	return (error);
2327 }
2328 
2329 /*
2330  * inputs:
2331  * zc_name		name of filesystem
2332  * zc_cookie		zap cursor
2333  * zc_nvlist_dst_size	size of buffer for property nvlist
2334  *
2335  * outputs:
2336  * zc_name		name of next snapshot
2337  * zc_objset_stats	stats
2338  * zc_nvlist_dst	property nvlist
2339  * zc_nvlist_dst_size	size of property nvlist
2340  */
2341 static int
2342 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2343 {
2344 	objset_t *os;
2345 	int error;
2346 
2347 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2348 	if (error != 0) {
2349 		return (error == ENOENT ? ESRCH : error);
2350 	}
2351 
2352 	/*
2353 	 * A dataset name of maximum length cannot have any snapshots,
2354 	 * so exit immediately.
2355 	 */
2356 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
2357 		dmu_objset_rele(os, FTAG);
2358 		return (SET_ERROR(ESRCH));
2359 	}
2360 
2361 	error = dmu_snapshot_list_next(os,
2362 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2363 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2364 	    NULL);
2365 
2366 	if (error == 0) {
2367 		dsl_dataset_t *ds;
2368 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2369 
2370 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2371 		if (error == 0) {
2372 			objset_t *ossnap;
2373 
2374 			error = dmu_objset_from_ds(ds, &ossnap);
2375 			if (error == 0)
2376 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2377 			dsl_dataset_rele(ds, FTAG);
2378 		}
2379 	} else if (error == ENOENT) {
2380 		error = SET_ERROR(ESRCH);
2381 	}
2382 
2383 	dmu_objset_rele(os, FTAG);
2384 	/* if we failed, undo the @ that we tacked on to zc_name */
2385 	if (error != 0)
2386 		*strchr(zc->zc_name, '@') = '\0';
2387 	return (error);
2388 }
2389 
2390 static int
2391 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2392 {
2393 	const char *propname = nvpair_name(pair);
2394 	uint64_t *valary;
2395 	unsigned int vallen;
2396 	const char *domain;
2397 	char *dash;
2398 	zfs_userquota_prop_t type;
2399 	uint64_t rid;
2400 	uint64_t quota;
2401 	zfsvfs_t *zfsvfs;
2402 	int err;
2403 
2404 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2405 		nvlist_t *attrs;
2406 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2407 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2408 		    &pair) != 0)
2409 			return (SET_ERROR(EINVAL));
2410 	}
2411 
2412 	/*
2413 	 * A correctly constructed propname is encoded as
2414 	 * userquota@<rid>-<domain>.
2415 	 */
2416 	if ((dash = strchr(propname, '-')) == NULL ||
2417 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2418 	    vallen != 3)
2419 		return (SET_ERROR(EINVAL));
2420 
2421 	domain = dash + 1;
2422 	type = valary[0];
2423 	rid = valary[1];
2424 	quota = valary[2];
2425 
2426 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2427 	if (err == 0) {
2428 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2429 		zfsvfs_rele(zfsvfs, FTAG);
2430 	}
2431 
2432 	return (err);
2433 }
2434 
2435 /*
2436  * If the named property is one that has a special function to set its value,
2437  * return 0 on success and a positive error code on failure; otherwise if it is
2438  * not one of the special properties handled by this function, return -1.
2439  *
2440  * XXX: It would be better for callers of the property interface if we handled
2441  * these special cases in dsl_prop.c (in the dsl layer).
2442  */
2443 static int
2444 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2445     nvpair_t *pair)
2446 {
2447 	const char *propname = nvpair_name(pair);
2448 	zfs_prop_t prop = zfs_name_to_prop(propname);
2449 	uint64_t intval;
2450 	int err = -1;
2451 
2452 	if (prop == ZPROP_INVAL) {
2453 		if (zfs_prop_userquota(propname))
2454 			return (zfs_prop_set_userquota(dsname, pair));
2455 		return (-1);
2456 	}
2457 
2458 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2459 		nvlist_t *attrs;
2460 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2461 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2462 		    &pair) == 0);
2463 	}
2464 
2465 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2466 		return (-1);
2467 
2468 	VERIFY(0 == nvpair_value_uint64(pair, &intval));
2469 
2470 	switch (prop) {
2471 	case ZFS_PROP_QUOTA:
2472 		err = dsl_dir_set_quota(dsname, source, intval);
2473 		break;
2474 	case ZFS_PROP_REFQUOTA:
2475 		err = dsl_dataset_set_refquota(dsname, source, intval);
2476 		break;
2477 	case ZFS_PROP_FILESYSTEM_LIMIT:
2478 	case ZFS_PROP_SNAPSHOT_LIMIT:
2479 		if (intval == UINT64_MAX) {
2480 			/* clearing the limit, just do it */
2481 			err = 0;
2482 		} else {
2483 			err = dsl_dir_activate_fs_ss_limit(dsname);
2484 		}
2485 		/*
2486 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2487 		 * default path to set the value in the nvlist.
2488 		 */
2489 		if (err == 0)
2490 			err = -1;
2491 		break;
2492 	case ZFS_PROP_RESERVATION:
2493 		err = dsl_dir_set_reservation(dsname, source, intval);
2494 		break;
2495 	case ZFS_PROP_REFRESERVATION:
2496 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2497 		break;
2498 	case ZFS_PROP_VOLSIZE:
2499 		err = zvol_set_volsize(dsname, intval);
2500 		break;
2501 	case ZFS_PROP_VERSION:
2502 	{
2503 		zfsvfs_t *zfsvfs;
2504 
2505 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2506 			break;
2507 
2508 		err = zfs_set_version(zfsvfs, intval);
2509 		zfsvfs_rele(zfsvfs, FTAG);
2510 
2511 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2512 			zfs_cmd_t *zc;
2513 
2514 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2515 			(void) strcpy(zc->zc_name, dsname);
2516 			(void) zfs_ioc_userspace_upgrade(zc);
2517 			kmem_free(zc, sizeof (zfs_cmd_t));
2518 		}
2519 		break;
2520 	}
2521 	default:
2522 		err = -1;
2523 	}
2524 
2525 	return (err);
2526 }
2527 
2528 /*
2529  * This function is best effort. If it fails to set any of the given properties,
2530  * it continues to set as many as it can and returns the last error
2531  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2532  * with the list of names of all the properties that failed along with the
2533  * corresponding error numbers.
2534  *
2535  * If every property is set successfully, zero is returned and errlist is not
2536  * modified.
2537  */
2538 int
2539 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2540     nvlist_t *errlist)
2541 {
2542 	nvpair_t *pair;
2543 	nvpair_t *propval;
2544 	int rv = 0;
2545 	uint64_t intval;
2546 	char *strval;
2547 	nvlist_t *genericnvl = fnvlist_alloc();
2548 	nvlist_t *retrynvl = fnvlist_alloc();
2549 
2550 retry:
2551 	pair = NULL;
2552 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2553 		const char *propname = nvpair_name(pair);
2554 		zfs_prop_t prop = zfs_name_to_prop(propname);
2555 		int err = 0;
2556 
2557 		/* decode the property value */
2558 		propval = pair;
2559 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2560 			nvlist_t *attrs;
2561 			attrs = fnvpair_value_nvlist(pair);
2562 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2563 			    &propval) != 0)
2564 				err = SET_ERROR(EINVAL);
2565 		}
2566 
2567 		/* Validate value type */
2568 		if (err == 0 && prop == ZPROP_INVAL) {
2569 			if (zfs_prop_user(propname)) {
2570 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2571 					err = SET_ERROR(EINVAL);
2572 			} else if (zfs_prop_userquota(propname)) {
2573 				if (nvpair_type(propval) !=
2574 				    DATA_TYPE_UINT64_ARRAY)
2575 					err = SET_ERROR(EINVAL);
2576 			} else {
2577 				err = SET_ERROR(EINVAL);
2578 			}
2579 		} else if (err == 0) {
2580 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2581 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2582 					err = SET_ERROR(EINVAL);
2583 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2584 				const char *unused;
2585 
2586 				intval = fnvpair_value_uint64(propval);
2587 
2588 				switch (zfs_prop_get_type(prop)) {
2589 				case PROP_TYPE_NUMBER:
2590 					break;
2591 				case PROP_TYPE_STRING:
2592 					err = SET_ERROR(EINVAL);
2593 					break;
2594 				case PROP_TYPE_INDEX:
2595 					if (zfs_prop_index_to_string(prop,
2596 					    intval, &unused) != 0)
2597 						err = SET_ERROR(EINVAL);
2598 					break;
2599 				default:
2600 					cmn_err(CE_PANIC,
2601 					    "unknown property type");
2602 				}
2603 			} else {
2604 				err = SET_ERROR(EINVAL);
2605 			}
2606 		}
2607 
2608 		/* Validate permissions */
2609 		if (err == 0)
2610 			err = zfs_check_settable(dsname, pair, CRED());
2611 
2612 		if (err == 0) {
2613 			err = zfs_prop_set_special(dsname, source, pair);
2614 			if (err == -1) {
2615 				/*
2616 				 * For better performance we build up a list of
2617 				 * properties to set in a single transaction.
2618 				 */
2619 				err = nvlist_add_nvpair(genericnvl, pair);
2620 			} else if (err != 0 && nvl != retrynvl) {
2621 				/*
2622 				 * This may be a spurious error caused by
2623 				 * receiving quota and reservation out of order.
2624 				 * Try again in a second pass.
2625 				 */
2626 				err = nvlist_add_nvpair(retrynvl, pair);
2627 			}
2628 		}
2629 
2630 		if (err != 0) {
2631 			if (errlist != NULL)
2632 				fnvlist_add_int32(errlist, propname, err);
2633 			rv = err;
2634 		}
2635 	}
2636 
2637 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2638 		nvl = retrynvl;
2639 		goto retry;
2640 	}
2641 
2642 	if (!nvlist_empty(genericnvl) &&
2643 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2644 		/*
2645 		 * If this fails, we still want to set as many properties as we
2646 		 * can, so try setting them individually.
2647 		 */
2648 		pair = NULL;
2649 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2650 			const char *propname = nvpair_name(pair);
2651 			int err = 0;
2652 
2653 			propval = pair;
2654 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2655 				nvlist_t *attrs;
2656 				attrs = fnvpair_value_nvlist(pair);
2657 				propval = fnvlist_lookup_nvpair(attrs,
2658 				    ZPROP_VALUE);
2659 			}
2660 
2661 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2662 				strval = fnvpair_value_string(propval);
2663 				err = dsl_prop_set_string(dsname, propname,
2664 				    source, strval);
2665 			} else {
2666 				intval = fnvpair_value_uint64(propval);
2667 				err = dsl_prop_set_int(dsname, propname, source,
2668 				    intval);
2669 			}
2670 
2671 			if (err != 0) {
2672 				if (errlist != NULL) {
2673 					fnvlist_add_int32(errlist, propname,
2674 					    err);
2675 				}
2676 				rv = err;
2677 			}
2678 		}
2679 	}
2680 	nvlist_free(genericnvl);
2681 	nvlist_free(retrynvl);
2682 
2683 	return (rv);
2684 }
2685 
2686 /*
2687  * Check that all the properties are valid user properties.
2688  */
2689 static int
2690 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2691 {
2692 	nvpair_t *pair = NULL;
2693 	int error = 0;
2694 
2695 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2696 		const char *propname = nvpair_name(pair);
2697 
2698 		if (!zfs_prop_user(propname) ||
2699 		    nvpair_type(pair) != DATA_TYPE_STRING)
2700 			return (SET_ERROR(EINVAL));
2701 
2702 		if (error = zfs_secpolicy_write_perms(fsname,
2703 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2704 			return (error);
2705 
2706 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2707 			return (SET_ERROR(ENAMETOOLONG));
2708 
2709 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2710 			return (E2BIG);
2711 	}
2712 	return (0);
2713 }
2714 
2715 static void
2716 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2717 {
2718 	nvpair_t *pair;
2719 
2720 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2721 
2722 	pair = NULL;
2723 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2724 		if (nvlist_exists(skipped, nvpair_name(pair)))
2725 			continue;
2726 
2727 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2728 	}
2729 }
2730 
2731 static int
2732 clear_received_props(const char *dsname, nvlist_t *props,
2733     nvlist_t *skipped)
2734 {
2735 	int err = 0;
2736 	nvlist_t *cleared_props = NULL;
2737 	props_skip(props, skipped, &cleared_props);
2738 	if (!nvlist_empty(cleared_props)) {
2739 		/*
2740 		 * Acts on local properties until the dataset has received
2741 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2742 		 */
2743 		zprop_source_t flags = (ZPROP_SRC_NONE |
2744 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2745 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2746 	}
2747 	nvlist_free(cleared_props);
2748 	return (err);
2749 }
2750 
2751 /*
2752  * inputs:
2753  * zc_name		name of filesystem
2754  * zc_value		name of property to set
2755  * zc_nvlist_src{_size}	nvlist of properties to apply
2756  * zc_cookie		received properties flag
2757  *
2758  * outputs:
2759  * zc_nvlist_dst{_size} error for each unapplied received property
2760  */
2761 static int
2762 zfs_ioc_set_prop(zfs_cmd_t *zc)
2763 {
2764 	nvlist_t *nvl;
2765 	boolean_t received = zc->zc_cookie;
2766 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2767 	    ZPROP_SRC_LOCAL);
2768 	nvlist_t *errors;
2769 	int error;
2770 
2771 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2772 	    zc->zc_iflags, &nvl)) != 0)
2773 		return (error);
2774 
2775 	if (received) {
2776 		nvlist_t *origprops;
2777 
2778 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2779 			(void) clear_received_props(zc->zc_name,
2780 			    origprops, nvl);
2781 			nvlist_free(origprops);
2782 		}
2783 
2784 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2785 	}
2786 
2787 	errors = fnvlist_alloc();
2788 	if (error == 0)
2789 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2790 
2791 	if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2792 		(void) put_nvlist(zc, errors);
2793 	}
2794 
2795 	nvlist_free(errors);
2796 	nvlist_free(nvl);
2797 	return (error);
2798 }
2799 
2800 /*
2801  * inputs:
2802  * zc_name		name of filesystem
2803  * zc_value		name of property to inherit
2804  * zc_cookie		revert to received value if TRUE
2805  *
2806  * outputs:		none
2807  */
2808 static int
2809 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2810 {
2811 	const char *propname = zc->zc_value;
2812 	zfs_prop_t prop = zfs_name_to_prop(propname);
2813 	boolean_t received = zc->zc_cookie;
2814 	zprop_source_t source = (received
2815 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2816 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2817 
2818 	if (received) {
2819 		nvlist_t *dummy;
2820 		nvpair_t *pair;
2821 		zprop_type_t type;
2822 		int err;
2823 
2824 		/*
2825 		 * zfs_prop_set_special() expects properties in the form of an
2826 		 * nvpair with type info.
2827 		 */
2828 		if (prop == ZPROP_INVAL) {
2829 			if (!zfs_prop_user(propname))
2830 				return (SET_ERROR(EINVAL));
2831 
2832 			type = PROP_TYPE_STRING;
2833 		} else if (prop == ZFS_PROP_VOLSIZE ||
2834 		    prop == ZFS_PROP_VERSION) {
2835 			return (SET_ERROR(EINVAL));
2836 		} else {
2837 			type = zfs_prop_get_type(prop);
2838 		}
2839 
2840 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2841 
2842 		switch (type) {
2843 		case PROP_TYPE_STRING:
2844 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2845 			break;
2846 		case PROP_TYPE_NUMBER:
2847 		case PROP_TYPE_INDEX:
2848 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2849 			break;
2850 		default:
2851 			nvlist_free(dummy);
2852 			return (SET_ERROR(EINVAL));
2853 		}
2854 
2855 		pair = nvlist_next_nvpair(dummy, NULL);
2856 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2857 		nvlist_free(dummy);
2858 		if (err != -1)
2859 			return (err); /* special property already handled */
2860 	} else {
2861 		/*
2862 		 * Only check this in the non-received case. We want to allow
2863 		 * 'inherit -S' to revert non-inheritable properties like quota
2864 		 * and reservation to the received or default values even though
2865 		 * they are not considered inheritable.
2866 		 */
2867 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2868 			return (SET_ERROR(EINVAL));
2869 	}
2870 
2871 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2872 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2873 }
2874 
2875 static int
2876 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2877 {
2878 	nvlist_t *props;
2879 	spa_t *spa;
2880 	int error;
2881 	nvpair_t *pair;
2882 
2883 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2884 	    zc->zc_iflags, &props))
2885 		return (error);
2886 
2887 	/*
2888 	 * If the only property is the configfile, then just do a spa_lookup()
2889 	 * to handle the faulted case.
2890 	 */
2891 	pair = nvlist_next_nvpair(props, NULL);
2892 	if (pair != NULL && strcmp(nvpair_name(pair),
2893 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2894 	    nvlist_next_nvpair(props, pair) == NULL) {
2895 		mutex_enter(&spa_namespace_lock);
2896 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2897 			spa_configfile_set(spa, props, B_FALSE);
2898 			spa_config_sync(spa, B_FALSE, B_TRUE);
2899 		}
2900 		mutex_exit(&spa_namespace_lock);
2901 		if (spa != NULL) {
2902 			nvlist_free(props);
2903 			return (0);
2904 		}
2905 	}
2906 
2907 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2908 		nvlist_free(props);
2909 		return (error);
2910 	}
2911 
2912 	error = spa_prop_set(spa, props);
2913 
2914 	nvlist_free(props);
2915 	spa_close(spa, FTAG);
2916 
2917 	return (error);
2918 }
2919 
2920 static int
2921 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2922 {
2923 	spa_t *spa;
2924 	int error;
2925 	nvlist_t *nvp = NULL;
2926 
2927 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2928 		/*
2929 		 * If the pool is faulted, there may be properties we can still
2930 		 * get (such as altroot and cachefile), so attempt to get them
2931 		 * anyway.
2932 		 */
2933 		mutex_enter(&spa_namespace_lock);
2934 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
2935 			error = spa_prop_get(spa, &nvp);
2936 		mutex_exit(&spa_namespace_lock);
2937 	} else {
2938 		error = spa_prop_get(spa, &nvp);
2939 		spa_close(spa, FTAG);
2940 	}
2941 
2942 	if (error == 0 && zc->zc_nvlist_dst != NULL)
2943 		error = put_nvlist(zc, nvp);
2944 	else
2945 		error = SET_ERROR(EFAULT);
2946 
2947 	nvlist_free(nvp);
2948 	return (error);
2949 }
2950 
2951 /*
2952  * inputs:
2953  * zc_name		name of filesystem
2954  * zc_nvlist_src{_size}	nvlist of delegated permissions
2955  * zc_perm_action	allow/unallow flag
2956  *
2957  * outputs:		none
2958  */
2959 static int
2960 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2961 {
2962 	int error;
2963 	nvlist_t *fsaclnv = NULL;
2964 
2965 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2966 	    zc->zc_iflags, &fsaclnv)) != 0)
2967 		return (error);
2968 
2969 	/*
2970 	 * Verify nvlist is constructed correctly
2971 	 */
2972 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2973 		nvlist_free(fsaclnv);
2974 		return (SET_ERROR(EINVAL));
2975 	}
2976 
2977 	/*
2978 	 * If we don't have PRIV_SYS_MOUNT, then validate
2979 	 * that user is allowed to hand out each permission in
2980 	 * the nvlist(s)
2981 	 */
2982 
2983 	error = secpolicy_zfs(CRED());
2984 	if (error != 0) {
2985 		if (zc->zc_perm_action == B_FALSE) {
2986 			error = dsl_deleg_can_allow(zc->zc_name,
2987 			    fsaclnv, CRED());
2988 		} else {
2989 			error = dsl_deleg_can_unallow(zc->zc_name,
2990 			    fsaclnv, CRED());
2991 		}
2992 	}
2993 
2994 	if (error == 0)
2995 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2996 
2997 	nvlist_free(fsaclnv);
2998 	return (error);
2999 }
3000 
3001 /*
3002  * inputs:
3003  * zc_name		name of filesystem
3004  *
3005  * outputs:
3006  * zc_nvlist_src{_size}	nvlist of delegated permissions
3007  */
3008 static int
3009 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
3010 {
3011 	nvlist_t *nvp;
3012 	int error;
3013 
3014 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
3015 		error = put_nvlist(zc, nvp);
3016 		nvlist_free(nvp);
3017 	}
3018 
3019 	return (error);
3020 }
3021 
3022 /*
3023  * Search the vfs list for a specified resource.  Returns a pointer to it
3024  * or NULL if no suitable entry is found. The caller of this routine
3025  * is responsible for releasing the returned vfs pointer.
3026  */
3027 static vfs_t *
3028 zfs_get_vfs(const char *resource)
3029 {
3030 	struct vfs *vfsp;
3031 	struct vfs *vfs_found = NULL;
3032 
3033 	vfs_list_read_lock();
3034 	vfsp = rootvfs;
3035 	do {
3036 		if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
3037 			VFS_HOLD(vfsp);
3038 			vfs_found = vfsp;
3039 			break;
3040 		}
3041 		vfsp = vfsp->vfs_next;
3042 	} while (vfsp != rootvfs);
3043 	vfs_list_unlock();
3044 	return (vfs_found);
3045 }
3046 
3047 /* ARGSUSED */
3048 static void
3049 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
3050 {
3051 	zfs_creat_t *zct = arg;
3052 
3053 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
3054 }
3055 
3056 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3057 
3058 /*
3059  * inputs:
3060  * os			parent objset pointer (NULL if root fs)
3061  * fuids_ok		fuids allowed in this version of the spa?
3062  * sa_ok		SAs allowed in this version of the spa?
3063  * createprops		list of properties requested by creator
3064  *
3065  * outputs:
3066  * zplprops	values for the zplprops we attach to the master node object
3067  * is_ci	true if requested file system will be purely case-insensitive
3068  *
3069  * Determine the settings for utf8only, normalization and
3070  * casesensitivity.  Specific values may have been requested by the
3071  * creator and/or we can inherit values from the parent dataset.  If
3072  * the file system is of too early a vintage, a creator can not
3073  * request settings for these properties, even if the requested
3074  * setting is the default value.  We don't actually want to create dsl
3075  * properties for these, so remove them from the source nvlist after
3076  * processing.
3077  */
3078 static int
3079 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3080     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3081     nvlist_t *zplprops, boolean_t *is_ci)
3082 {
3083 	uint64_t sense = ZFS_PROP_UNDEFINED;
3084 	uint64_t norm = ZFS_PROP_UNDEFINED;
3085 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3086 
3087 	ASSERT(zplprops != NULL);
3088 
3089 	/*
3090 	 * Pull out creator prop choices, if any.
3091 	 */
3092 	if (createprops) {
3093 		(void) nvlist_lookup_uint64(createprops,
3094 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3095 		(void) nvlist_lookup_uint64(createprops,
3096 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3097 		(void) nvlist_remove_all(createprops,
3098 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3099 		(void) nvlist_lookup_uint64(createprops,
3100 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3101 		(void) nvlist_remove_all(createprops,
3102 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3103 		(void) nvlist_lookup_uint64(createprops,
3104 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3105 		(void) nvlist_remove_all(createprops,
3106 		    zfs_prop_to_name(ZFS_PROP_CASE));
3107 	}
3108 
3109 	/*
3110 	 * If the zpl version requested is whacky or the file system
3111 	 * or pool is version is too "young" to support normalization
3112 	 * and the creator tried to set a value for one of the props,
3113 	 * error out.
3114 	 */
3115 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3116 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3117 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3118 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3119 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3120 	    sense != ZFS_PROP_UNDEFINED)))
3121 		return (SET_ERROR(ENOTSUP));
3122 
3123 	/*
3124 	 * Put the version in the zplprops
3125 	 */
3126 	VERIFY(nvlist_add_uint64(zplprops,
3127 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3128 
3129 	if (norm == ZFS_PROP_UNDEFINED)
3130 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3131 	VERIFY(nvlist_add_uint64(zplprops,
3132 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3133 
3134 	/*
3135 	 * If we're normalizing, names must always be valid UTF-8 strings.
3136 	 */
3137 	if (norm)
3138 		u8 = 1;
3139 	if (u8 == ZFS_PROP_UNDEFINED)
3140 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3141 	VERIFY(nvlist_add_uint64(zplprops,
3142 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3143 
3144 	if (sense == ZFS_PROP_UNDEFINED)
3145 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3146 	VERIFY(nvlist_add_uint64(zplprops,
3147 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3148 
3149 	if (is_ci)
3150 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3151 
3152 	return (0);
3153 }
3154 
3155 static int
3156 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3157     nvlist_t *zplprops, boolean_t *is_ci)
3158 {
3159 	boolean_t fuids_ok, sa_ok;
3160 	uint64_t zplver = ZPL_VERSION;
3161 	objset_t *os = NULL;
3162 	char parentname[MAXNAMELEN];
3163 	char *cp;
3164 	spa_t *spa;
3165 	uint64_t spa_vers;
3166 	int error;
3167 
3168 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3169 	cp = strrchr(parentname, '/');
3170 	ASSERT(cp != NULL);
3171 	cp[0] = '\0';
3172 
3173 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3174 		return (error);
3175 
3176 	spa_vers = spa_version(spa);
3177 	spa_close(spa, FTAG);
3178 
3179 	zplver = zfs_zpl_version_map(spa_vers);
3180 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3181 	sa_ok = (zplver >= ZPL_VERSION_SA);
3182 
3183 	/*
3184 	 * Open parent object set so we can inherit zplprop values.
3185 	 */
3186 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3187 		return (error);
3188 
3189 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3190 	    zplprops, is_ci);
3191 	dmu_objset_rele(os, FTAG);
3192 	return (error);
3193 }
3194 
3195 static int
3196 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3197     nvlist_t *zplprops, boolean_t *is_ci)
3198 {
3199 	boolean_t fuids_ok;
3200 	boolean_t sa_ok;
3201 	uint64_t zplver = ZPL_VERSION;
3202 	int error;
3203 
3204 	zplver = zfs_zpl_version_map(spa_vers);
3205 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3206 	sa_ok = (zplver >= ZPL_VERSION_SA);
3207 
3208 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3209 	    createprops, zplprops, is_ci);
3210 	return (error);
3211 }
3212 
3213 /*
3214  * innvl: {
3215  *     "type" -> dmu_objset_type_t (int32)
3216  *     (optional) "props" -> { prop -> value }
3217  * }
3218  *
3219  * outnvl: propname -> error code (int32)
3220  */
3221 static int
3222 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3223 {
3224 	int error = 0;
3225 	zfs_creat_t zct = { 0 };
3226 	nvlist_t *nvprops = NULL;
3227 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3228 	int32_t type32;
3229 	dmu_objset_type_t type;
3230 	boolean_t is_insensitive = B_FALSE;
3231 
3232 	if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3233 		return (SET_ERROR(EINVAL));
3234 	type = type32;
3235 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3236 
3237 	switch (type) {
3238 	case DMU_OST_ZFS:
3239 		cbfunc = zfs_create_cb;
3240 		break;
3241 
3242 	case DMU_OST_ZVOL:
3243 		cbfunc = zvol_create_cb;
3244 		break;
3245 
3246 	default:
3247 		cbfunc = NULL;
3248 		break;
3249 	}
3250 	if (strchr(fsname, '@') ||
3251 	    strchr(fsname, '%'))
3252 		return (SET_ERROR(EINVAL));
3253 
3254 	zct.zct_props = nvprops;
3255 
3256 	if (cbfunc == NULL)
3257 		return (SET_ERROR(EINVAL));
3258 
3259 	if (type == DMU_OST_ZVOL) {
3260 		uint64_t volsize, volblocksize;
3261 
3262 		if (nvprops == NULL)
3263 			return (SET_ERROR(EINVAL));
3264 		if (nvlist_lookup_uint64(nvprops,
3265 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3266 			return (SET_ERROR(EINVAL));
3267 
3268 		if ((error = nvlist_lookup_uint64(nvprops,
3269 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3270 		    &volblocksize)) != 0 && error != ENOENT)
3271 			return (SET_ERROR(EINVAL));
3272 
3273 		if (error != 0)
3274 			volblocksize = zfs_prop_default_numeric(
3275 			    ZFS_PROP_VOLBLOCKSIZE);
3276 
3277 		if ((error = zvol_check_volblocksize(
3278 		    volblocksize)) != 0 ||
3279 		    (error = zvol_check_volsize(volsize,
3280 		    volblocksize)) != 0)
3281 			return (error);
3282 	} else if (type == DMU_OST_ZFS) {
3283 		int error;
3284 
3285 		/*
3286 		 * We have to have normalization and
3287 		 * case-folding flags correct when we do the
3288 		 * file system creation, so go figure them out
3289 		 * now.
3290 		 */
3291 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3292 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3293 		error = zfs_fill_zplprops(fsname, nvprops,
3294 		    zct.zct_zplprops, &is_insensitive);
3295 		if (error != 0) {
3296 			nvlist_free(zct.zct_zplprops);
3297 			return (error);
3298 		}
3299 	}
3300 
3301 	error = dmu_objset_create(fsname, type,
3302 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3303 	nvlist_free(zct.zct_zplprops);
3304 
3305 	/*
3306 	 * It would be nice to do this atomically.
3307 	 */
3308 	if (error == 0) {
3309 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3310 		    nvprops, outnvl);
3311 		if (error != 0)
3312 			(void) dsl_destroy_head(fsname);
3313 	}
3314 	return (error);
3315 }
3316 
3317 /*
3318  * innvl: {
3319  *     "origin" -> name of origin snapshot
3320  *     (optional) "props" -> { prop -> value }
3321  * }
3322  *
3323  * outnvl: propname -> error code (int32)
3324  */
3325 static int
3326 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3327 {
3328 	int error = 0;
3329 	nvlist_t *nvprops = NULL;
3330 	char *origin_name;
3331 
3332 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3333 		return (SET_ERROR(EINVAL));
3334 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3335 
3336 	if (strchr(fsname, '@') ||
3337 	    strchr(fsname, '%'))
3338 		return (SET_ERROR(EINVAL));
3339 
3340 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3341 		return (SET_ERROR(EINVAL));
3342 	error = dmu_objset_clone(fsname, origin_name);
3343 	if (error != 0)
3344 		return (error);
3345 
3346 	/*
3347 	 * It would be nice to do this atomically.
3348 	 */
3349 	if (error == 0) {
3350 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3351 		    nvprops, outnvl);
3352 		if (error != 0)
3353 			(void) dsl_destroy_head(fsname);
3354 	}
3355 	return (error);
3356 }
3357 
3358 /*
3359  * innvl: {
3360  *     "snaps" -> { snapshot1, snapshot2 }
3361  *     (optional) "props" -> { prop -> value (string) }
3362  * }
3363  *
3364  * outnvl: snapshot -> error code (int32)
3365  */
3366 static int
3367 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3368 {
3369 	nvlist_t *snaps;
3370 	nvlist_t *props = NULL;
3371 	int error, poollen;
3372 	nvpair_t *pair;
3373 
3374 	(void) nvlist_lookup_nvlist(innvl, "props", &props);
3375 	if ((error = zfs_check_userprops(poolname, props)) != 0)
3376 		return (error);
3377 
3378 	if (!nvlist_empty(props) &&
3379 	    zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3380 		return (SET_ERROR(ENOTSUP));
3381 
3382 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3383 		return (SET_ERROR(EINVAL));
3384 	poollen = strlen(poolname);
3385 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3386 	    pair = nvlist_next_nvpair(snaps, pair)) {
3387 		const char *name = nvpair_name(pair);
3388 		const char *cp = strchr(name, '@');
3389 
3390 		/*
3391 		 * The snap name must contain an @, and the part after it must
3392 		 * contain only valid characters.
3393 		 */
3394 		if (cp == NULL ||
3395 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3396 			return (SET_ERROR(EINVAL));
3397 
3398 		/*
3399 		 * The snap must be in the specified pool.
3400 		 */
3401 		if (strncmp(name, poolname, poollen) != 0 ||
3402 		    (name[poollen] != '/' && name[poollen] != '@'))
3403 			return (SET_ERROR(EXDEV));
3404 
3405 		/* This must be the only snap of this fs. */
3406 		for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3407 		    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3408 			if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3409 			    == 0) {
3410 				return (SET_ERROR(EXDEV));
3411 			}
3412 		}
3413 	}
3414 
3415 	error = dsl_dataset_snapshot(snaps, props, outnvl);
3416 	return (error);
3417 }
3418 
3419 /*
3420  * innvl: "message" -> string
3421  */
3422 /* ARGSUSED */
3423 static int
3424 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3425 {
3426 	char *message;
3427 	spa_t *spa;
3428 	int error;
3429 	char *poolname;
3430 
3431 	/*
3432 	 * The poolname in the ioctl is not set, we get it from the TSD,
3433 	 * which was set at the end of the last successful ioctl that allows
3434 	 * logging.  The secpolicy func already checked that it is set.
3435 	 * Only one log ioctl is allowed after each successful ioctl, so
3436 	 * we clear the TSD here.
3437 	 */
3438 	poolname = tsd_get(zfs_allow_log_key);
3439 	(void) tsd_set(zfs_allow_log_key, NULL);
3440 	error = spa_open(poolname, &spa, FTAG);
3441 	strfree(poolname);
3442 	if (error != 0)
3443 		return (error);
3444 
3445 	if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3446 		spa_close(spa, FTAG);
3447 		return (SET_ERROR(EINVAL));
3448 	}
3449 
3450 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3451 		spa_close(spa, FTAG);
3452 		return (SET_ERROR(ENOTSUP));
3453 	}
3454 
3455 	error = spa_history_log(spa, message);
3456 	spa_close(spa, FTAG);
3457 	return (error);
3458 }
3459 
3460 /*
3461  * The dp_config_rwlock must not be held when calling this, because the
3462  * unmount may need to write out data.
3463  *
3464  * This function is best-effort.  Callers must deal gracefully if it
3465  * remains mounted (or is remounted after this call).
3466  *
3467  * Returns 0 if the argument is not a snapshot, or it is not currently a
3468  * filesystem, or we were able to unmount it.  Returns error code otherwise.
3469  */
3470 int
3471 zfs_unmount_snap(const char *snapname)
3472 {
3473 	vfs_t *vfsp;
3474 	zfsvfs_t *zfsvfs;
3475 	int err;
3476 
3477 	if (strchr(snapname, '@') == NULL)
3478 		return (0);
3479 
3480 	vfsp = zfs_get_vfs(snapname);
3481 	if (vfsp == NULL)
3482 		return (0);
3483 
3484 	zfsvfs = vfsp->vfs_data;
3485 	ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3486 
3487 	err = vn_vfswlock(vfsp->vfs_vnodecovered);
3488 	VFS_RELE(vfsp);
3489 	if (err != 0)
3490 		return (SET_ERROR(err));
3491 
3492 	/*
3493 	 * Always force the unmount for snapshots.
3494 	 */
3495 	(void) dounmount(vfsp, MS_FORCE, kcred);
3496 	return (0);
3497 }
3498 
3499 /* ARGSUSED */
3500 static int
3501 zfs_unmount_snap_cb(const char *snapname, void *arg)
3502 {
3503 	return (zfs_unmount_snap(snapname));
3504 }
3505 
3506 /*
3507  * When a clone is destroyed, its origin may also need to be destroyed,
3508  * in which case it must be unmounted.  This routine will do that unmount
3509  * if necessary.
3510  */
3511 void
3512 zfs_destroy_unmount_origin(const char *fsname)
3513 {
3514 	int error;
3515 	objset_t *os;
3516 	dsl_dataset_t *ds;
3517 
3518 	error = dmu_objset_hold(fsname, FTAG, &os);
3519 	if (error != 0)
3520 		return;
3521 	ds = dmu_objset_ds(os);
3522 	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3523 		char originname[MAXNAMELEN];
3524 		dsl_dataset_name(ds->ds_prev, originname);
3525 		dmu_objset_rele(os, FTAG);
3526 		(void) zfs_unmount_snap(originname);
3527 	} else {
3528 		dmu_objset_rele(os, FTAG);
3529 	}
3530 }
3531 
3532 /*
3533  * innvl: {
3534  *     "snaps" -> { snapshot1, snapshot2 }
3535  *     (optional boolean) "defer"
3536  * }
3537  *
3538  * outnvl: snapshot -> error code (int32)
3539  *
3540  */
3541 /* ARGSUSED */
3542 static int
3543 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3544 {
3545 	nvlist_t *snaps;
3546 	nvpair_t *pair;
3547 	boolean_t defer;
3548 
3549 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3550 		return (SET_ERROR(EINVAL));
3551 	defer = nvlist_exists(innvl, "defer");
3552 
3553 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3554 	    pair = nvlist_next_nvpair(snaps, pair)) {
3555 		(void) zfs_unmount_snap(nvpair_name(pair));
3556 	}
3557 
3558 	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3559 }
3560 
3561 /*
3562  * Create bookmarks.  Bookmark names are of the form <fs>#<bmark>.
3563  * All bookmarks must be in the same pool.
3564  *
3565  * innvl: {
3566  *     bookmark1 -> snapshot1, bookmark2 -> snapshot2
3567  * }
3568  *
3569  * outnvl: bookmark -> error code (int32)
3570  *
3571  */
3572 /* ARGSUSED */
3573 static int
3574 zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3575 {
3576 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3577 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3578 		char *snap_name;
3579 
3580 		/*
3581 		 * Verify the snapshot argument.
3582 		 */
3583 		if (nvpair_value_string(pair, &snap_name) != 0)
3584 			return (SET_ERROR(EINVAL));
3585 
3586 
3587 		/* Verify that the keys (bookmarks) are unique */
3588 		for (nvpair_t *pair2 = nvlist_next_nvpair(innvl, pair);
3589 		    pair2 != NULL; pair2 = nvlist_next_nvpair(innvl, pair2)) {
3590 			if (strcmp(nvpair_name(pair), nvpair_name(pair2)) == 0)
3591 				return (SET_ERROR(EINVAL));
3592 		}
3593 	}
3594 
3595 	return (dsl_bookmark_create(innvl, outnvl));
3596 }
3597 
3598 /*
3599  * innvl: {
3600  *     property 1, property 2, ...
3601  * }
3602  *
3603  * outnvl: {
3604  *     bookmark name 1 -> { property 1, property 2, ... },
3605  *     bookmark name 2 -> { property 1, property 2, ... }
3606  * }
3607  *
3608  */
3609 static int
3610 zfs_ioc_get_bookmarks(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3611 {
3612 	return (dsl_get_bookmarks(fsname, innvl, outnvl));
3613 }
3614 
3615 /*
3616  * innvl: {
3617  *     bookmark name 1, bookmark name 2
3618  * }
3619  *
3620  * outnvl: bookmark -> error code (int32)
3621  *
3622  */
3623 static int
3624 zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
3625     nvlist_t *outnvl)
3626 {
3627 	int error, poollen;
3628 
3629 	poollen = strlen(poolname);
3630 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3631 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3632 		const char *name = nvpair_name(pair);
3633 		const char *cp = strchr(name, '#');
3634 
3635 		/*
3636 		 * The bookmark name must contain an #, and the part after it
3637 		 * must contain only valid characters.
3638 		 */
3639 		if (cp == NULL ||
3640 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3641 			return (SET_ERROR(EINVAL));
3642 
3643 		/*
3644 		 * The bookmark must be in the specified pool.
3645 		 */
3646 		if (strncmp(name, poolname, poollen) != 0 ||
3647 		    (name[poollen] != '/' && name[poollen] != '#'))
3648 			return (SET_ERROR(EXDEV));
3649 	}
3650 
3651 	error = dsl_bookmark_destroy(innvl, outnvl);
3652 	return (error);
3653 }
3654 
3655 /*
3656  * inputs:
3657  * zc_name		name of dataset to destroy
3658  * zc_objset_type	type of objset
3659  * zc_defer_destroy	mark for deferred destroy
3660  *
3661  * outputs:		none
3662  */
3663 static int
3664 zfs_ioc_destroy(zfs_cmd_t *zc)
3665 {
3666 	int err;
3667 
3668 	if (zc->zc_objset_type == DMU_OST_ZFS) {
3669 		err = zfs_unmount_snap(zc->zc_name);
3670 		if (err != 0)
3671 			return (err);
3672 	}
3673 
3674 	if (strchr(zc->zc_name, '@'))
3675 		err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3676 	else
3677 		err = dsl_destroy_head(zc->zc_name);
3678 	if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3679 		(void) zvol_remove_minor(zc->zc_name);
3680 	return (err);
3681 }
3682 
3683 /*
3684  * fsname is name of dataset to rollback (to most recent snapshot)
3685  *
3686  * innvl is not used.
3687  *
3688  * outnvl: "target" -> name of most recent snapshot
3689  * }
3690  */
3691 /* ARGSUSED */
3692 static int
3693 zfs_ioc_rollback(const char *fsname, nvlist_t *args, nvlist_t *outnvl)
3694 {
3695 	zfsvfs_t *zfsvfs;
3696 	int error;
3697 
3698 	if (getzfsvfs(fsname, &zfsvfs) == 0) {
3699 		error = zfs_suspend_fs(zfsvfs);
3700 		if (error == 0) {
3701 			int resume_err;
3702 
3703 			error = dsl_dataset_rollback(fsname, zfsvfs, outnvl);
3704 			resume_err = zfs_resume_fs(zfsvfs, fsname);
3705 			error = error ? error : resume_err;
3706 		}
3707 		VFS_RELE(zfsvfs->z_vfs);
3708 	} else {
3709 		error = dsl_dataset_rollback(fsname, NULL, outnvl);
3710 	}
3711 	return (error);
3712 }
3713 
3714 static int
3715 recursive_unmount(const char *fsname, void *arg)
3716 {
3717 	const char *snapname = arg;
3718 	char fullname[MAXNAMELEN];
3719 
3720 	(void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
3721 	return (zfs_unmount_snap(fullname));
3722 }
3723 
3724 /*
3725  * inputs:
3726  * zc_name	old name of dataset
3727  * zc_value	new name of dataset
3728  * zc_cookie	recursive flag (only valid for snapshots)
3729  *
3730  * outputs:	none
3731  */
3732 static int
3733 zfs_ioc_rename(zfs_cmd_t *zc)
3734 {
3735 	boolean_t recursive = zc->zc_cookie & 1;
3736 	char *at;
3737 
3738 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3739 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3740 	    strchr(zc->zc_value, '%'))
3741 		return (SET_ERROR(EINVAL));
3742 
3743 	at = strchr(zc->zc_name, '@');
3744 	if (at != NULL) {
3745 		/* snaps must be in same fs */
3746 		int error;
3747 
3748 		if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
3749 			return (SET_ERROR(EXDEV));
3750 		*at = '\0';
3751 		if (zc->zc_objset_type == DMU_OST_ZFS) {
3752 			error = dmu_objset_find(zc->zc_name,
3753 			    recursive_unmount, at + 1,
3754 			    recursive ? DS_FIND_CHILDREN : 0);
3755 			if (error != 0) {
3756 				*at = '@';
3757 				return (error);
3758 			}
3759 		}
3760 		error = dsl_dataset_rename_snapshot(zc->zc_name,
3761 		    at + 1, strchr(zc->zc_value, '@') + 1, recursive);
3762 		*at = '@';
3763 
3764 		return (error);
3765 	} else {
3766 		if (zc->zc_objset_type == DMU_OST_ZVOL)
3767 			(void) zvol_remove_minor(zc->zc_name);
3768 		return (dsl_dir_rename(zc->zc_name, zc->zc_value));
3769 	}
3770 }
3771 
3772 static int
3773 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3774 {
3775 	const char *propname = nvpair_name(pair);
3776 	boolean_t issnap = (strchr(dsname, '@') != NULL);
3777 	zfs_prop_t prop = zfs_name_to_prop(propname);
3778 	uint64_t intval;
3779 	int err;
3780 
3781 	if (prop == ZPROP_INVAL) {
3782 		if (zfs_prop_user(propname)) {
3783 			if (err = zfs_secpolicy_write_perms(dsname,
3784 			    ZFS_DELEG_PERM_USERPROP, cr))
3785 				return (err);
3786 			return (0);
3787 		}
3788 
3789 		if (!issnap && zfs_prop_userquota(propname)) {
3790 			const char *perm = NULL;
3791 			const char *uq_prefix =
3792 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3793 			const char *gq_prefix =
3794 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3795 
3796 			if (strncmp(propname, uq_prefix,
3797 			    strlen(uq_prefix)) == 0) {
3798 				perm = ZFS_DELEG_PERM_USERQUOTA;
3799 			} else if (strncmp(propname, gq_prefix,
3800 			    strlen(gq_prefix)) == 0) {
3801 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
3802 			} else {
3803 				/* USERUSED and GROUPUSED are read-only */
3804 				return (SET_ERROR(EINVAL));
3805 			}
3806 
3807 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3808 				return (err);
3809 			return (0);
3810 		}
3811 
3812 		return (SET_ERROR(EINVAL));
3813 	}
3814 
3815 	if (issnap)
3816 		return (SET_ERROR(EINVAL));
3817 
3818 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3819 		/*
3820 		 * dsl_prop_get_all_impl() returns properties in this
3821 		 * format.
3822 		 */
3823 		nvlist_t *attrs;
3824 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3825 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3826 		    &pair) == 0);
3827 	}
3828 
3829 	/*
3830 	 * Check that this value is valid for this pool version
3831 	 */
3832 	switch (prop) {
3833 	case ZFS_PROP_COMPRESSION:
3834 		/*
3835 		 * If the user specified gzip compression, make sure
3836 		 * the SPA supports it. We ignore any errors here since
3837 		 * we'll catch them later.
3838 		 */
3839 		if (nvpair_value_uint64(pair, &intval) == 0) {
3840 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
3841 			    intval <= ZIO_COMPRESS_GZIP_9 &&
3842 			    zfs_earlier_version(dsname,
3843 			    SPA_VERSION_GZIP_COMPRESSION)) {
3844 				return (SET_ERROR(ENOTSUP));
3845 			}
3846 
3847 			if (intval == ZIO_COMPRESS_ZLE &&
3848 			    zfs_earlier_version(dsname,
3849 			    SPA_VERSION_ZLE_COMPRESSION))
3850 				return (SET_ERROR(ENOTSUP));
3851 
3852 			if (intval == ZIO_COMPRESS_LZ4) {
3853 				spa_t *spa;
3854 
3855 				if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3856 					return (err);
3857 
3858 				if (!spa_feature_is_enabled(spa,
3859 				    SPA_FEATURE_LZ4_COMPRESS)) {
3860 					spa_close(spa, FTAG);
3861 					return (SET_ERROR(ENOTSUP));
3862 				}
3863 				spa_close(spa, FTAG);
3864 			}
3865 
3866 			/*
3867 			 * If this is a bootable dataset then
3868 			 * verify that the compression algorithm
3869 			 * is supported for booting. We must return
3870 			 * something other than ENOTSUP since it
3871 			 * implies a downrev pool version.
3872 			 */
3873 			if (zfs_is_bootfs(dsname) &&
3874 			    !BOOTFS_COMPRESS_VALID(intval)) {
3875 				return (SET_ERROR(ERANGE));
3876 			}
3877 		}
3878 		break;
3879 
3880 	case ZFS_PROP_COPIES:
3881 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3882 			return (SET_ERROR(ENOTSUP));
3883 		break;
3884 
3885 	case ZFS_PROP_RECORDSIZE:
3886 		/* Record sizes above 128k need the feature to be enabled */
3887 		if (nvpair_value_uint64(pair, &intval) == 0 &&
3888 		    intval > SPA_OLD_MAXBLOCKSIZE) {
3889 			spa_t *spa;
3890 
3891 			/*
3892 			 * If this is a bootable dataset then
3893 			 * the we don't allow large (>128K) blocks,
3894 			 * because GRUB doesn't support them.
3895 			 */
3896 			if (zfs_is_bootfs(dsname) &&
3897 			    intval > SPA_OLD_MAXBLOCKSIZE) {
3898 				return (SET_ERROR(ERANGE));
3899 			}
3900 
3901 			/*
3902 			 * We don't allow setting the property above 1MB,
3903 			 * unless the tunable has been changed.
3904 			 */
3905 			if (intval > zfs_max_recordsize ||
3906 			    intval > SPA_MAXBLOCKSIZE)
3907 				return (SET_ERROR(ERANGE));
3908 
3909 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3910 				return (err);
3911 
3912 			if (!spa_feature_is_enabled(spa,
3913 			    SPA_FEATURE_LARGE_BLOCKS)) {
3914 				spa_close(spa, FTAG);
3915 				return (SET_ERROR(ENOTSUP));
3916 			}
3917 			spa_close(spa, FTAG);
3918 		}
3919 		break;
3920 
3921 	case ZFS_PROP_SHARESMB:
3922 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3923 			return (SET_ERROR(ENOTSUP));
3924 		break;
3925 
3926 	case ZFS_PROP_ACLINHERIT:
3927 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3928 		    nvpair_value_uint64(pair, &intval) == 0) {
3929 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
3930 			    zfs_earlier_version(dsname,
3931 			    SPA_VERSION_PASSTHROUGH_X))
3932 				return (SET_ERROR(ENOTSUP));
3933 		}
3934 		break;
3935 
3936 	case ZFS_PROP_CHECKSUM:
3937 	case ZFS_PROP_DEDUP:
3938 	{
3939 		spa_feature_t feature;
3940 		spa_t *spa;
3941 
3942 		/* dedup feature version checks */
3943 		if (prop == ZFS_PROP_DEDUP &&
3944 		    zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3945 			return (SET_ERROR(ENOTSUP));
3946 
3947 		if (nvpair_value_uint64(pair, &intval) != 0)
3948 			return (SET_ERROR(EINVAL));
3949 
3950 		/* check prop value is enabled in features */
3951 		feature = zio_checksum_to_feature(intval & ZIO_CHECKSUM_MASK);
3952 		if (feature == SPA_FEATURE_NONE)
3953 			break;
3954 
3955 		if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3956 			return (err);
3957 		/*
3958 		 * Salted checksums are not supported on root pools.
3959 		 */
3960 		if (spa_bootfs(spa) != 0 &&
3961 		    intval < ZIO_CHECKSUM_FUNCTIONS &&
3962 		    (zio_checksum_table[intval].ci_flags &
3963 		    ZCHECKSUM_FLAG_SALTED)) {
3964 			spa_close(spa, FTAG);
3965 			return (SET_ERROR(ERANGE));
3966 		}
3967 		if (!spa_feature_is_enabled(spa, feature)) {
3968 			spa_close(spa, FTAG);
3969 			return (SET_ERROR(ENOTSUP));
3970 		}
3971 		spa_close(spa, FTAG);
3972 		break;
3973 	}
3974 	}
3975 
3976 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3977 }
3978 
3979 /*
3980  * Checks for a race condition to make sure we don't increment a feature flag
3981  * multiple times.
3982  */
3983 static int
3984 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
3985 {
3986 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3987 	spa_feature_t *featurep = arg;
3988 
3989 	if (!spa_feature_is_active(spa, *featurep))
3990 		return (0);
3991 	else
3992 		return (SET_ERROR(EBUSY));
3993 }
3994 
3995 /*
3996  * The callback invoked on feature activation in the sync task caused by
3997  * zfs_prop_activate_feature.
3998  */
3999 static void
4000 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
4001 {
4002 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
4003 	spa_feature_t *featurep = arg;
4004 
4005 	spa_feature_incr(spa, *featurep, tx);
4006 }
4007 
4008 /*
4009  * Activates a feature on a pool in response to a property setting. This
4010  * creates a new sync task which modifies the pool to reflect the feature
4011  * as being active.
4012  */
4013 static int
4014 zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature)
4015 {
4016 	int err;
4017 
4018 	/* EBUSY here indicates that the feature is already active */
4019 	err = dsl_sync_task(spa_name(spa),
4020 	    zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
4021 	    &feature, 2, ZFS_SPACE_CHECK_RESERVED);
4022 
4023 	if (err != 0 && err != EBUSY)
4024 		return (err);
4025 	else
4026 		return (0);
4027 }
4028 
4029 /*
4030  * Removes properties from the given props list that fail permission checks
4031  * needed to clear them and to restore them in case of a receive error. For each
4032  * property, make sure we have both set and inherit permissions.
4033  *
4034  * Returns the first error encountered if any permission checks fail. If the
4035  * caller provides a non-NULL errlist, it also gives the complete list of names
4036  * of all the properties that failed a permission check along with the
4037  * corresponding error numbers. The caller is responsible for freeing the
4038  * returned errlist.
4039  *
4040  * If every property checks out successfully, zero is returned and the list
4041  * pointed at by errlist is NULL.
4042  */
4043 static int
4044 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
4045 {
4046 	zfs_cmd_t *zc;
4047 	nvpair_t *pair, *next_pair;
4048 	nvlist_t *errors;
4049 	int err, rv = 0;
4050 
4051 	if (props == NULL)
4052 		return (0);
4053 
4054 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4055 
4056 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
4057 	(void) strcpy(zc->zc_name, dataset);
4058 	pair = nvlist_next_nvpair(props, NULL);
4059 	while (pair != NULL) {
4060 		next_pair = nvlist_next_nvpair(props, pair);
4061 
4062 		(void) strcpy(zc->zc_value, nvpair_name(pair));
4063 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
4064 		    (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
4065 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
4066 			VERIFY(nvlist_add_int32(errors,
4067 			    zc->zc_value, err) == 0);
4068 		}
4069 		pair = next_pair;
4070 	}
4071 	kmem_free(zc, sizeof (zfs_cmd_t));
4072 
4073 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
4074 		nvlist_free(errors);
4075 		errors = NULL;
4076 	} else {
4077 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
4078 	}
4079 
4080 	if (errlist == NULL)
4081 		nvlist_free(errors);
4082 	else
4083 		*errlist = errors;
4084 
4085 	return (rv);
4086 }
4087 
4088 static boolean_t
4089 propval_equals(nvpair_t *p1, nvpair_t *p2)
4090 {
4091 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
4092 		/* dsl_prop_get_all_impl() format */
4093 		nvlist_t *attrs;
4094 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
4095 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4096 		    &p1) == 0);
4097 	}
4098 
4099 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
4100 		nvlist_t *attrs;
4101 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
4102 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4103 		    &p2) == 0);
4104 	}
4105 
4106 	if (nvpair_type(p1) != nvpair_type(p2))
4107 		return (B_FALSE);
4108 
4109 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
4110 		char *valstr1, *valstr2;
4111 
4112 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
4113 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
4114 		return (strcmp(valstr1, valstr2) == 0);
4115 	} else {
4116 		uint64_t intval1, intval2;
4117 
4118 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
4119 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
4120 		return (intval1 == intval2);
4121 	}
4122 }
4123 
4124 /*
4125  * Remove properties from props if they are not going to change (as determined
4126  * by comparison with origprops). Remove them from origprops as well, since we
4127  * do not need to clear or restore properties that won't change.
4128  */
4129 static void
4130 props_reduce(nvlist_t *props, nvlist_t *origprops)
4131 {
4132 	nvpair_t *pair, *next_pair;
4133 
4134 	if (origprops == NULL)
4135 		return; /* all props need to be received */
4136 
4137 	pair = nvlist_next_nvpair(props, NULL);
4138 	while (pair != NULL) {
4139 		const char *propname = nvpair_name(pair);
4140 		nvpair_t *match;
4141 
4142 		next_pair = nvlist_next_nvpair(props, pair);
4143 
4144 		if ((nvlist_lookup_nvpair(origprops, propname,
4145 		    &match) != 0) || !propval_equals(pair, match))
4146 			goto next; /* need to set received value */
4147 
4148 		/* don't clear the existing received value */
4149 		(void) nvlist_remove_nvpair(origprops, match);
4150 		/* don't bother receiving the property */
4151 		(void) nvlist_remove_nvpair(props, pair);
4152 next:
4153 		pair = next_pair;
4154 	}
4155 }
4156 
4157 /*
4158  * Extract properties that cannot be set PRIOR to the receipt of a dataset.
4159  * For example, refquota cannot be set until after the receipt of a dataset,
4160  * because in replication streams, an older/earlier snapshot may exceed the
4161  * refquota.  We want to receive the older/earlier snapshot, but setting
4162  * refquota pre-receipt will set the dsl's ACTUAL quota, which will prevent
4163  * the older/earlier snapshot from being received (with EDQUOT).
4164  *
4165  * The ZFS test "zfs_receive_011_pos" demonstrates such a scenario.
4166  *
4167  * libzfs will need to be judicious handling errors encountered by props
4168  * extracted by this function.
4169  */
4170 static nvlist_t *
4171 extract_delay_props(nvlist_t *props)
4172 {
4173 	nvlist_t *delayprops;
4174 	nvpair_t *nvp, *tmp;
4175 	static const zfs_prop_t delayable[] = { ZFS_PROP_REFQUOTA, 0 };
4176 	int i;
4177 
4178 	VERIFY(nvlist_alloc(&delayprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4179 
4180 	for (nvp = nvlist_next_nvpair(props, NULL); nvp != NULL;
4181 	    nvp = nvlist_next_nvpair(props, nvp)) {
4182 		/*
4183 		 * strcmp() is safe because zfs_prop_to_name() always returns
4184 		 * a bounded string.
4185 		 */
4186 		for (i = 0; delayable[i] != 0; i++) {
4187 			if (strcmp(zfs_prop_to_name(delayable[i]),
4188 			    nvpair_name(nvp)) == 0) {
4189 				break;
4190 			}
4191 		}
4192 		if (delayable[i] != 0) {
4193 			tmp = nvlist_prev_nvpair(props, nvp);
4194 			VERIFY(nvlist_add_nvpair(delayprops, nvp) == 0);
4195 			VERIFY(nvlist_remove_nvpair(props, nvp) == 0);
4196 			nvp = tmp;
4197 		}
4198 	}
4199 
4200 	if (nvlist_empty(delayprops)) {
4201 		nvlist_free(delayprops);
4202 		delayprops = NULL;
4203 	}
4204 	return (delayprops);
4205 }
4206 
4207 #ifdef	DEBUG
4208 static boolean_t zfs_ioc_recv_inject_err;
4209 #endif
4210 
4211 /*
4212  * inputs:
4213  * zc_name		name of containing filesystem
4214  * zc_nvlist_src{_size}	nvlist of properties to apply
4215  * zc_value		name of snapshot to create
4216  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
4217  * zc_cookie		file descriptor to recv from
4218  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
4219  * zc_guid		force flag
4220  * zc_cleanup_fd	cleanup-on-exit file descriptor
4221  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
4222  * zc_resumable		if data is incomplete assume sender will resume
4223  *
4224  * outputs:
4225  * zc_cookie		number of bytes read
4226  * zc_nvlist_dst{_size} error for each unapplied received property
4227  * zc_obj		zprop_errflags_t
4228  * zc_action_handle	handle for this guid/ds mapping
4229  */
4230 static int
4231 zfs_ioc_recv(zfs_cmd_t *zc)
4232 {
4233 	file_t *fp;
4234 	dmu_recv_cookie_t drc;
4235 	boolean_t force = (boolean_t)zc->zc_guid;
4236 	int fd;
4237 	int error = 0;
4238 	int props_error = 0;
4239 	nvlist_t *errors;
4240 	offset_t off;
4241 	nvlist_t *props = NULL; /* sent properties */
4242 	nvlist_t *origprops = NULL; /* existing properties */
4243 	nvlist_t *delayprops = NULL; /* sent properties applied post-receive */
4244 	char *origin = NULL;
4245 	char *tosnap;
4246 	char tofs[ZFS_MAXNAMELEN];
4247 	boolean_t first_recvd_props = B_FALSE;
4248 
4249 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
4250 	    strchr(zc->zc_value, '@') == NULL ||
4251 	    strchr(zc->zc_value, '%'))
4252 		return (SET_ERROR(EINVAL));
4253 
4254 	(void) strcpy(tofs, zc->zc_value);
4255 	tosnap = strchr(tofs, '@');
4256 	*tosnap++ = '\0';
4257 
4258 	if (zc->zc_nvlist_src != NULL &&
4259 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
4260 	    zc->zc_iflags, &props)) != 0)
4261 		return (error);
4262 
4263 	fd = zc->zc_cookie;
4264 	fp = getf(fd);
4265 	if (fp == NULL) {
4266 		nvlist_free(props);
4267 		return (SET_ERROR(EBADF));
4268 	}
4269 
4270 	errors = fnvlist_alloc();
4271 
4272 	if (zc->zc_string[0])
4273 		origin = zc->zc_string;
4274 
4275 	error = dmu_recv_begin(tofs, tosnap,
4276 	    &zc->zc_begin_record, force, zc->zc_resumable, origin, &drc);
4277 	if (error != 0)
4278 		goto out;
4279 
4280 	/*
4281 	 * Set properties before we receive the stream so that they are applied
4282 	 * to the new data. Note that we must call dmu_recv_stream() if
4283 	 * dmu_recv_begin() succeeds.
4284 	 */
4285 	if (props != NULL && !drc.drc_newfs) {
4286 		if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
4287 		    SPA_VERSION_RECVD_PROPS &&
4288 		    !dsl_prop_get_hasrecvd(tofs))
4289 			first_recvd_props = B_TRUE;
4290 
4291 		/*
4292 		 * If new received properties are supplied, they are to
4293 		 * completely replace the existing received properties, so stash
4294 		 * away the existing ones.
4295 		 */
4296 		if (dsl_prop_get_received(tofs, &origprops) == 0) {
4297 			nvlist_t *errlist = NULL;
4298 			/*
4299 			 * Don't bother writing a property if its value won't
4300 			 * change (and avoid the unnecessary security checks).
4301 			 *
4302 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
4303 			 * special case where we blow away all local properties
4304 			 * regardless.
4305 			 */
4306 			if (!first_recvd_props)
4307 				props_reduce(props, origprops);
4308 			if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
4309 				(void) nvlist_merge(errors, errlist, 0);
4310 			nvlist_free(errlist);
4311 
4312 			if (clear_received_props(tofs, origprops,
4313 			    first_recvd_props ? NULL : props) != 0)
4314 				zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4315 		} else {
4316 			zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4317 		}
4318 	}
4319 
4320 	if (props != NULL) {
4321 		props_error = dsl_prop_set_hasrecvd(tofs);
4322 
4323 		if (props_error == 0) {
4324 			delayprops = extract_delay_props(props);
4325 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4326 			    props, errors);
4327 		}
4328 	}
4329 
4330 	off = fp->f_offset;
4331 	error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4332 	    &zc->zc_action_handle);
4333 
4334 	if (error == 0) {
4335 		zfsvfs_t *zfsvfs = NULL;
4336 
4337 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
4338 			/* online recv */
4339 			int end_err;
4340 
4341 			error = zfs_suspend_fs(zfsvfs);
4342 			/*
4343 			 * If the suspend fails, then the recv_end will
4344 			 * likely also fail, and clean up after itself.
4345 			 */
4346 			end_err = dmu_recv_end(&drc, zfsvfs);
4347 			if (error == 0)
4348 				error = zfs_resume_fs(zfsvfs, tofs);
4349 			error = error ? error : end_err;
4350 			VFS_RELE(zfsvfs->z_vfs);
4351 		} else {
4352 			error = dmu_recv_end(&drc, NULL);
4353 		}
4354 
4355 		/* Set delayed properties now, after we're done receiving. */
4356 		if (delayprops != NULL && error == 0) {
4357 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4358 			    delayprops, errors);
4359 		}
4360 	}
4361 
4362 	if (delayprops != NULL) {
4363 		/*
4364 		 * Merge delayed props back in with initial props, in case
4365 		 * we're DEBUG and zfs_ioc_recv_inject_err is set (which means
4366 		 * we have to make sure clear_received_props() includes
4367 		 * the delayed properties).
4368 		 *
4369 		 * Since zfs_ioc_recv_inject_err is only in DEBUG kernels,
4370 		 * using ASSERT() will be just like a VERIFY.
4371 		 */
4372 		ASSERT(nvlist_merge(props, delayprops, 0) == 0);
4373 		nvlist_free(delayprops);
4374 	}
4375 
4376 	/*
4377 	 * Now that all props, initial and delayed, are set, report the prop
4378 	 * errors to the caller.
4379 	 */
4380 	if (zc->zc_nvlist_dst_size != 0 &&
4381 	    (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4382 	    put_nvlist(zc, errors) != 0)) {
4383 		/*
4384 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
4385 		 * size or supplied an invalid address.
4386 		 */
4387 		props_error = SET_ERROR(EINVAL);
4388 	}
4389 
4390 	zc->zc_cookie = off - fp->f_offset;
4391 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4392 		fp->f_offset = off;
4393 
4394 #ifdef	DEBUG
4395 	if (zfs_ioc_recv_inject_err) {
4396 		zfs_ioc_recv_inject_err = B_FALSE;
4397 		error = 1;
4398 	}
4399 #endif
4400 	/*
4401 	 * On error, restore the original props.
4402 	 */
4403 	if (error != 0 && props != NULL && !drc.drc_newfs) {
4404 		if (clear_received_props(tofs, props, NULL) != 0) {
4405 			/*
4406 			 * We failed to clear the received properties.
4407 			 * Since we may have left a $recvd value on the
4408 			 * system, we can't clear the $hasrecvd flag.
4409 			 */
4410 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4411 		} else if (first_recvd_props) {
4412 			dsl_prop_unset_hasrecvd(tofs);
4413 		}
4414 
4415 		if (origprops == NULL && !drc.drc_newfs) {
4416 			/* We failed to stash the original properties. */
4417 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4418 		}
4419 
4420 		/*
4421 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
4422 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4423 		 * explictly if we're restoring local properties cleared in the
4424 		 * first new-style receive.
4425 		 */
4426 		if (origprops != NULL &&
4427 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4428 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4429 		    origprops, NULL) != 0) {
4430 			/*
4431 			 * We stashed the original properties but failed to
4432 			 * restore them.
4433 			 */
4434 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4435 		}
4436 	}
4437 out:
4438 	nvlist_free(props);
4439 	nvlist_free(origprops);
4440 	nvlist_free(errors);
4441 	releasef(fd);
4442 
4443 	if (error == 0)
4444 		error = props_error;
4445 
4446 	return (error);
4447 }
4448 
4449 /*
4450  * inputs:
4451  * zc_name	name of snapshot to send
4452  * zc_cookie	file descriptor to send stream to
4453  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
4454  * zc_sendobj	objsetid of snapshot to send
4455  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
4456  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
4457  *		output size in zc_objset_type.
4458  * zc_flags	lzc_send_flags
4459  *
4460  * outputs:
4461  * zc_objset_type	estimated size, if zc_guid is set
4462  */
4463 static int
4464 zfs_ioc_send(zfs_cmd_t *zc)
4465 {
4466 	int error;
4467 	offset_t off;
4468 	boolean_t estimate = (zc->zc_guid != 0);
4469 	boolean_t embedok = (zc->zc_flags & 0x1);
4470 	boolean_t large_block_ok = (zc->zc_flags & 0x2);
4471 
4472 	if (zc->zc_obj != 0) {
4473 		dsl_pool_t *dp;
4474 		dsl_dataset_t *tosnap;
4475 
4476 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4477 		if (error != 0)
4478 			return (error);
4479 
4480 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4481 		if (error != 0) {
4482 			dsl_pool_rele(dp, FTAG);
4483 			return (error);
4484 		}
4485 
4486 		if (dsl_dir_is_clone(tosnap->ds_dir))
4487 			zc->zc_fromobj =
4488 			    dsl_dir_phys(tosnap->ds_dir)->dd_origin_obj;
4489 		dsl_dataset_rele(tosnap, FTAG);
4490 		dsl_pool_rele(dp, FTAG);
4491 	}
4492 
4493 	if (estimate) {
4494 		dsl_pool_t *dp;
4495 		dsl_dataset_t *tosnap;
4496 		dsl_dataset_t *fromsnap = NULL;
4497 
4498 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4499 		if (error != 0)
4500 			return (error);
4501 
4502 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4503 		if (error != 0) {
4504 			dsl_pool_rele(dp, FTAG);
4505 			return (error);
4506 		}
4507 
4508 		if (zc->zc_fromobj != 0) {
4509 			error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
4510 			    FTAG, &fromsnap);
4511 			if (error != 0) {
4512 				dsl_dataset_rele(tosnap, FTAG);
4513 				dsl_pool_rele(dp, FTAG);
4514 				return (error);
4515 			}
4516 		}
4517 
4518 		error = dmu_send_estimate(tosnap, fromsnap,
4519 		    &zc->zc_objset_type);
4520 
4521 		if (fromsnap != NULL)
4522 			dsl_dataset_rele(fromsnap, FTAG);
4523 		dsl_dataset_rele(tosnap, FTAG);
4524 		dsl_pool_rele(dp, FTAG);
4525 	} else {
4526 		file_t *fp = getf(zc->zc_cookie);
4527 		if (fp == NULL)
4528 			return (SET_ERROR(EBADF));
4529 
4530 		off = fp->f_offset;
4531 		error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
4532 		    zc->zc_fromobj, embedok, large_block_ok,
4533 		    zc->zc_cookie, fp->f_vnode, &off);
4534 
4535 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4536 			fp->f_offset = off;
4537 		releasef(zc->zc_cookie);
4538 	}
4539 	return (error);
4540 }
4541 
4542 /*
4543  * inputs:
4544  * zc_name	name of snapshot on which to report progress
4545  * zc_cookie	file descriptor of send stream
4546  *
4547  * outputs:
4548  * zc_cookie	number of bytes written in send stream thus far
4549  */
4550 static int
4551 zfs_ioc_send_progress(zfs_cmd_t *zc)
4552 {
4553 	dsl_pool_t *dp;
4554 	dsl_dataset_t *ds;
4555 	dmu_sendarg_t *dsp = NULL;
4556 	int error;
4557 
4558 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4559 	if (error != 0)
4560 		return (error);
4561 
4562 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4563 	if (error != 0) {
4564 		dsl_pool_rele(dp, FTAG);
4565 		return (error);
4566 	}
4567 
4568 	mutex_enter(&ds->ds_sendstream_lock);
4569 
4570 	/*
4571 	 * Iterate over all the send streams currently active on this dataset.
4572 	 * If there's one which matches the specified file descriptor _and_ the
4573 	 * stream was started by the current process, return the progress of
4574 	 * that stream.
4575 	 */
4576 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4577 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
4578 		if (dsp->dsa_outfd == zc->zc_cookie &&
4579 		    dsp->dsa_proc == curproc)
4580 			break;
4581 	}
4582 
4583 	if (dsp != NULL)
4584 		zc->zc_cookie = *(dsp->dsa_off);
4585 	else
4586 		error = SET_ERROR(ENOENT);
4587 
4588 	mutex_exit(&ds->ds_sendstream_lock);
4589 	dsl_dataset_rele(ds, FTAG);
4590 	dsl_pool_rele(dp, FTAG);
4591 	return (error);
4592 }
4593 
4594 static int
4595 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4596 {
4597 	int id, error;
4598 
4599 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4600 	    &zc->zc_inject_record);
4601 
4602 	if (error == 0)
4603 		zc->zc_guid = (uint64_t)id;
4604 
4605 	return (error);
4606 }
4607 
4608 static int
4609 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4610 {
4611 	return (zio_clear_fault((int)zc->zc_guid));
4612 }
4613 
4614 static int
4615 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4616 {
4617 	int id = (int)zc->zc_guid;
4618 	int error;
4619 
4620 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4621 	    &zc->zc_inject_record);
4622 
4623 	zc->zc_guid = id;
4624 
4625 	return (error);
4626 }
4627 
4628 static int
4629 zfs_ioc_error_log(zfs_cmd_t *zc)
4630 {
4631 	spa_t *spa;
4632 	int error;
4633 	size_t count = (size_t)zc->zc_nvlist_dst_size;
4634 
4635 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4636 		return (error);
4637 
4638 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4639 	    &count);
4640 	if (error == 0)
4641 		zc->zc_nvlist_dst_size = count;
4642 	else
4643 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4644 
4645 	spa_close(spa, FTAG);
4646 
4647 	return (error);
4648 }
4649 
4650 static int
4651 zfs_ioc_clear(zfs_cmd_t *zc)
4652 {
4653 	spa_t *spa;
4654 	vdev_t *vd;
4655 	int error;
4656 
4657 	/*
4658 	 * On zpool clear we also fix up missing slogs
4659 	 */
4660 	mutex_enter(&spa_namespace_lock);
4661 	spa = spa_lookup(zc->zc_name);
4662 	if (spa == NULL) {
4663 		mutex_exit(&spa_namespace_lock);
4664 		return (SET_ERROR(EIO));
4665 	}
4666 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4667 		/* we need to let spa_open/spa_load clear the chains */
4668 		spa_set_log_state(spa, SPA_LOG_CLEAR);
4669 	}
4670 	spa->spa_last_open_failed = 0;
4671 	mutex_exit(&spa_namespace_lock);
4672 
4673 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4674 		error = spa_open(zc->zc_name, &spa, FTAG);
4675 	} else {
4676 		nvlist_t *policy;
4677 		nvlist_t *config = NULL;
4678 
4679 		if (zc->zc_nvlist_src == NULL)
4680 			return (SET_ERROR(EINVAL));
4681 
4682 		if ((error = get_nvlist(zc->zc_nvlist_src,
4683 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4684 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4685 			    policy, &config);
4686 			if (config != NULL) {
4687 				int err;
4688 
4689 				if ((err = put_nvlist(zc, config)) != 0)
4690 					error = err;
4691 				nvlist_free(config);
4692 			}
4693 			nvlist_free(policy);
4694 		}
4695 	}
4696 
4697 	if (error != 0)
4698 		return (error);
4699 
4700 	spa_vdev_state_enter(spa, SCL_NONE);
4701 
4702 	if (zc->zc_guid == 0) {
4703 		vd = NULL;
4704 	} else {
4705 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4706 		if (vd == NULL) {
4707 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
4708 			spa_close(spa, FTAG);
4709 			return (SET_ERROR(ENODEV));
4710 		}
4711 	}
4712 
4713 	vdev_clear(spa, vd);
4714 
4715 	(void) spa_vdev_state_exit(spa, NULL, 0);
4716 
4717 	/*
4718 	 * Resume any suspended I/Os.
4719 	 */
4720 	if (zio_resume(spa) != 0)
4721 		error = SET_ERROR(EIO);
4722 
4723 	spa_close(spa, FTAG);
4724 
4725 	return (error);
4726 }
4727 
4728 static int
4729 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4730 {
4731 	spa_t *spa;
4732 	int error;
4733 
4734 	error = spa_open(zc->zc_name, &spa, FTAG);
4735 	if (error != 0)
4736 		return (error);
4737 
4738 	spa_vdev_state_enter(spa, SCL_NONE);
4739 
4740 	/*
4741 	 * If a resilver is already in progress then set the
4742 	 * spa_scrub_reopen flag to B_TRUE so that we don't restart
4743 	 * the scan as a side effect of the reopen. Otherwise, let
4744 	 * vdev_open() decided if a resilver is required.
4745 	 */
4746 	spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4747 	vdev_reopen(spa->spa_root_vdev);
4748 	spa->spa_scrub_reopen = B_FALSE;
4749 
4750 	(void) spa_vdev_state_exit(spa, NULL, 0);
4751 	spa_close(spa, FTAG);
4752 	return (0);
4753 }
4754 /*
4755  * inputs:
4756  * zc_name	name of filesystem
4757  * zc_value	name of origin snapshot
4758  *
4759  * outputs:
4760  * zc_string	name of conflicting snapshot, if there is one
4761  */
4762 static int
4763 zfs_ioc_promote(zfs_cmd_t *zc)
4764 {
4765 	char *cp;
4766 
4767 	/*
4768 	 * We don't need to unmount *all* the origin fs's snapshots, but
4769 	 * it's easier.
4770 	 */
4771 	cp = strchr(zc->zc_value, '@');
4772 	if (cp)
4773 		*cp = '\0';
4774 	(void) dmu_objset_find(zc->zc_value,
4775 	    zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
4776 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4777 }
4778 
4779 /*
4780  * Retrieve a single {user|group}{used|quota}@... property.
4781  *
4782  * inputs:
4783  * zc_name	name of filesystem
4784  * zc_objset_type zfs_userquota_prop_t
4785  * zc_value	domain name (eg. "S-1-234-567-89")
4786  * zc_guid	RID/UID/GID
4787  *
4788  * outputs:
4789  * zc_cookie	property value
4790  */
4791 static int
4792 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4793 {
4794 	zfsvfs_t *zfsvfs;
4795 	int error;
4796 
4797 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4798 		return (SET_ERROR(EINVAL));
4799 
4800 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4801 	if (error != 0)
4802 		return (error);
4803 
4804 	error = zfs_userspace_one(zfsvfs,
4805 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4806 	zfsvfs_rele(zfsvfs, FTAG);
4807 
4808 	return (error);
4809 }
4810 
4811 /*
4812  * inputs:
4813  * zc_name		name of filesystem
4814  * zc_cookie		zap cursor
4815  * zc_objset_type	zfs_userquota_prop_t
4816  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4817  *
4818  * outputs:
4819  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
4820  * zc_cookie	zap cursor
4821  */
4822 static int
4823 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4824 {
4825 	zfsvfs_t *zfsvfs;
4826 	int bufsize = zc->zc_nvlist_dst_size;
4827 
4828 	if (bufsize <= 0)
4829 		return (SET_ERROR(ENOMEM));
4830 
4831 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4832 	if (error != 0)
4833 		return (error);
4834 
4835 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
4836 
4837 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4838 	    buf, &zc->zc_nvlist_dst_size);
4839 
4840 	if (error == 0) {
4841 		error = xcopyout(buf,
4842 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
4843 		    zc->zc_nvlist_dst_size);
4844 	}
4845 	kmem_free(buf, bufsize);
4846 	zfsvfs_rele(zfsvfs, FTAG);
4847 
4848 	return (error);
4849 }
4850 
4851 /*
4852  * inputs:
4853  * zc_name		name of filesystem
4854  *
4855  * outputs:
4856  * none
4857  */
4858 static int
4859 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4860 {
4861 	objset_t *os;
4862 	int error = 0;
4863 	zfsvfs_t *zfsvfs;
4864 
4865 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4866 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4867 			/*
4868 			 * If userused is not enabled, it may be because the
4869 			 * objset needs to be closed & reopened (to grow the
4870 			 * objset_phys_t).  Suspend/resume the fs will do that.
4871 			 */
4872 			error = zfs_suspend_fs(zfsvfs);
4873 			if (error == 0) {
4874 				dmu_objset_refresh_ownership(zfsvfs->z_os,
4875 				    zfsvfs);
4876 				error = zfs_resume_fs(zfsvfs, zc->zc_name);
4877 			}
4878 		}
4879 		if (error == 0)
4880 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4881 		VFS_RELE(zfsvfs->z_vfs);
4882 	} else {
4883 		/* XXX kind of reading contents without owning */
4884 		error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4885 		if (error != 0)
4886 			return (error);
4887 
4888 		error = dmu_objset_userspace_upgrade(os);
4889 		dmu_objset_rele(os, FTAG);
4890 	}
4891 
4892 	return (error);
4893 }
4894 
4895 /*
4896  * We don't want to have a hard dependency
4897  * against some special symbols in sharefs
4898  * nfs, and smbsrv.  Determine them if needed when
4899  * the first file system is shared.
4900  * Neither sharefs, nfs or smbsrv are unloadable modules.
4901  */
4902 int (*znfsexport_fs)(void *arg);
4903 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4904 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4905 
4906 int zfs_nfsshare_inited;
4907 int zfs_smbshare_inited;
4908 
4909 ddi_modhandle_t nfs_mod;
4910 ddi_modhandle_t sharefs_mod;
4911 ddi_modhandle_t smbsrv_mod;
4912 kmutex_t zfs_share_lock;
4913 
4914 static int
4915 zfs_init_sharefs()
4916 {
4917 	int error;
4918 
4919 	ASSERT(MUTEX_HELD(&zfs_share_lock));
4920 	/* Both NFS and SMB shares also require sharetab support. */
4921 	if (sharefs_mod == NULL && ((sharefs_mod =
4922 	    ddi_modopen("fs/sharefs",
4923 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
4924 		return (SET_ERROR(ENOSYS));
4925 	}
4926 	if (zshare_fs == NULL && ((zshare_fs =
4927 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4928 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4929 		return (SET_ERROR(ENOSYS));
4930 	}
4931 	return (0);
4932 }
4933 
4934 static int
4935 zfs_ioc_share(zfs_cmd_t *zc)
4936 {
4937 	int error;
4938 	int opcode;
4939 
4940 	switch (zc->zc_share.z_sharetype) {
4941 	case ZFS_SHARE_NFS:
4942 	case ZFS_UNSHARE_NFS:
4943 		if (zfs_nfsshare_inited == 0) {
4944 			mutex_enter(&zfs_share_lock);
4945 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4946 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4947 				mutex_exit(&zfs_share_lock);
4948 				return (SET_ERROR(ENOSYS));
4949 			}
4950 			if (znfsexport_fs == NULL &&
4951 			    ((znfsexport_fs = (int (*)(void *))
4952 			    ddi_modsym(nfs_mod,
4953 			    "nfs_export", &error)) == NULL)) {
4954 				mutex_exit(&zfs_share_lock);
4955 				return (SET_ERROR(ENOSYS));
4956 			}
4957 			error = zfs_init_sharefs();
4958 			if (error != 0) {
4959 				mutex_exit(&zfs_share_lock);
4960 				return (SET_ERROR(ENOSYS));
4961 			}
4962 			zfs_nfsshare_inited = 1;
4963 			mutex_exit(&zfs_share_lock);
4964 		}
4965 		break;
4966 	case ZFS_SHARE_SMB:
4967 	case ZFS_UNSHARE_SMB:
4968 		if (zfs_smbshare_inited == 0) {
4969 			mutex_enter(&zfs_share_lock);
4970 			if (smbsrv_mod == NULL && ((smbsrv_mod =
4971 			    ddi_modopen("drv/smbsrv",
4972 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4973 				mutex_exit(&zfs_share_lock);
4974 				return (SET_ERROR(ENOSYS));
4975 			}
4976 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4977 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4978 			    "smb_server_share", &error)) == NULL)) {
4979 				mutex_exit(&zfs_share_lock);
4980 				return (SET_ERROR(ENOSYS));
4981 			}
4982 			error = zfs_init_sharefs();
4983 			if (error != 0) {
4984 				mutex_exit(&zfs_share_lock);
4985 				return (SET_ERROR(ENOSYS));
4986 			}
4987 			zfs_smbshare_inited = 1;
4988 			mutex_exit(&zfs_share_lock);
4989 		}
4990 		break;
4991 	default:
4992 		return (SET_ERROR(EINVAL));
4993 	}
4994 
4995 	switch (zc->zc_share.z_sharetype) {
4996 	case ZFS_SHARE_NFS:
4997 	case ZFS_UNSHARE_NFS:
4998 		if (error =
4999 		    znfsexport_fs((void *)
5000 		    (uintptr_t)zc->zc_share.z_exportdata))
5001 			return (error);
5002 		break;
5003 	case ZFS_SHARE_SMB:
5004 	case ZFS_UNSHARE_SMB:
5005 		if (error = zsmbexport_fs((void *)
5006 		    (uintptr_t)zc->zc_share.z_exportdata,
5007 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
5008 		    B_TRUE: B_FALSE)) {
5009 			return (error);
5010 		}
5011 		break;
5012 	}
5013 
5014 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
5015 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
5016 	    SHAREFS_ADD : SHAREFS_REMOVE;
5017 
5018 	/*
5019 	 * Add or remove share from sharetab
5020 	 */
5021 	error = zshare_fs(opcode,
5022 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
5023 	    zc->zc_share.z_sharemax);
5024 
5025 	return (error);
5026 
5027 }
5028 
5029 ace_t full_access[] = {
5030 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
5031 };
5032 
5033 /*
5034  * inputs:
5035  * zc_name		name of containing filesystem
5036  * zc_obj		object # beyond which we want next in-use object #
5037  *
5038  * outputs:
5039  * zc_obj		next in-use object #
5040  */
5041 static int
5042 zfs_ioc_next_obj(zfs_cmd_t *zc)
5043 {
5044 	objset_t *os = NULL;
5045 	int error;
5046 
5047 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
5048 	if (error != 0)
5049 		return (error);
5050 
5051 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
5052 	    dsl_dataset_phys(os->os_dsl_dataset)->ds_prev_snap_txg);
5053 
5054 	dmu_objset_rele(os, FTAG);
5055 	return (error);
5056 }
5057 
5058 /*
5059  * inputs:
5060  * zc_name		name of filesystem
5061  * zc_value		prefix name for snapshot
5062  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
5063  *
5064  * outputs:
5065  * zc_value		short name of new snapshot
5066  */
5067 static int
5068 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
5069 {
5070 	char *snap_name;
5071 	char *hold_name;
5072 	int error;
5073 	minor_t minor;
5074 
5075 	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
5076 	if (error != 0)
5077 		return (error);
5078 
5079 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
5080 	    (u_longlong_t)ddi_get_lbolt64());
5081 	hold_name = kmem_asprintf("%%%s", zc->zc_value);
5082 
5083 	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
5084 	    hold_name);
5085 	if (error == 0)
5086 		(void) strcpy(zc->zc_value, snap_name);
5087 	strfree(snap_name);
5088 	strfree(hold_name);
5089 	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
5090 	return (error);
5091 }
5092 
5093 /*
5094  * inputs:
5095  * zc_name		name of "to" snapshot
5096  * zc_value		name of "from" snapshot
5097  * zc_cookie		file descriptor to write diff data on
5098  *
5099  * outputs:
5100  * dmu_diff_record_t's to the file descriptor
5101  */
5102 static int
5103 zfs_ioc_diff(zfs_cmd_t *zc)
5104 {
5105 	file_t *fp;
5106 	offset_t off;
5107 	int error;
5108 
5109 	fp = getf(zc->zc_cookie);
5110 	if (fp == NULL)
5111 		return (SET_ERROR(EBADF));
5112 
5113 	off = fp->f_offset;
5114 
5115 	error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
5116 
5117 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5118 		fp->f_offset = off;
5119 	releasef(zc->zc_cookie);
5120 
5121 	return (error);
5122 }
5123 
5124 /*
5125  * Remove all ACL files in shares dir
5126  */
5127 static int
5128 zfs_smb_acl_purge(znode_t *dzp)
5129 {
5130 	zap_cursor_t	zc;
5131 	zap_attribute_t	zap;
5132 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
5133 	int error;
5134 
5135 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
5136 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
5137 	    zap_cursor_advance(&zc)) {
5138 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
5139 		    NULL, 0)) != 0)
5140 			break;
5141 	}
5142 	zap_cursor_fini(&zc);
5143 	return (error);
5144 }
5145 
5146 static int
5147 zfs_ioc_smb_acl(zfs_cmd_t *zc)
5148 {
5149 	vnode_t *vp;
5150 	znode_t *dzp;
5151 	vnode_t *resourcevp = NULL;
5152 	znode_t *sharedir;
5153 	zfsvfs_t *zfsvfs;
5154 	nvlist_t *nvlist;
5155 	char *src, *target;
5156 	vattr_t vattr;
5157 	vsecattr_t vsec;
5158 	int error = 0;
5159 
5160 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
5161 	    NO_FOLLOW, NULL, &vp)) != 0)
5162 		return (error);
5163 
5164 	/* Now make sure mntpnt and dataset are ZFS */
5165 
5166 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
5167 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
5168 	    zc->zc_name) != 0)) {
5169 		VN_RELE(vp);
5170 		return (SET_ERROR(EINVAL));
5171 	}
5172 
5173 	dzp = VTOZ(vp);
5174 	zfsvfs = dzp->z_zfsvfs;
5175 	ZFS_ENTER(zfsvfs);
5176 
5177 	/*
5178 	 * Create share dir if its missing.
5179 	 */
5180 	mutex_enter(&zfsvfs->z_lock);
5181 	if (zfsvfs->z_shares_dir == 0) {
5182 		dmu_tx_t *tx;
5183 
5184 		tx = dmu_tx_create(zfsvfs->z_os);
5185 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
5186 		    ZFS_SHARES_DIR);
5187 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
5188 		error = dmu_tx_assign(tx, TXG_WAIT);
5189 		if (error != 0) {
5190 			dmu_tx_abort(tx);
5191 		} else {
5192 			error = zfs_create_share_dir(zfsvfs, tx);
5193 			dmu_tx_commit(tx);
5194 		}
5195 		if (error != 0) {
5196 			mutex_exit(&zfsvfs->z_lock);
5197 			VN_RELE(vp);
5198 			ZFS_EXIT(zfsvfs);
5199 			return (error);
5200 		}
5201 	}
5202 	mutex_exit(&zfsvfs->z_lock);
5203 
5204 	ASSERT(zfsvfs->z_shares_dir);
5205 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
5206 		VN_RELE(vp);
5207 		ZFS_EXIT(zfsvfs);
5208 		return (error);
5209 	}
5210 
5211 	switch (zc->zc_cookie) {
5212 	case ZFS_SMB_ACL_ADD:
5213 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
5214 		vattr.va_type = VREG;
5215 		vattr.va_mode = S_IFREG|0777;
5216 		vattr.va_uid = 0;
5217 		vattr.va_gid = 0;
5218 
5219 		vsec.vsa_mask = VSA_ACE;
5220 		vsec.vsa_aclentp = &full_access;
5221 		vsec.vsa_aclentsz = sizeof (full_access);
5222 		vsec.vsa_aclcnt = 1;
5223 
5224 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
5225 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
5226 		if (resourcevp)
5227 			VN_RELE(resourcevp);
5228 		break;
5229 
5230 	case ZFS_SMB_ACL_REMOVE:
5231 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
5232 		    NULL, 0);
5233 		break;
5234 
5235 	case ZFS_SMB_ACL_RENAME:
5236 		if ((error = get_nvlist(zc->zc_nvlist_src,
5237 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
5238 			VN_RELE(vp);
5239 			VN_RELE(ZTOV(sharedir));
5240 			ZFS_EXIT(zfsvfs);
5241 			return (error);
5242 		}
5243 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
5244 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
5245 		    &target)) {
5246 			VN_RELE(vp);
5247 			VN_RELE(ZTOV(sharedir));
5248 			ZFS_EXIT(zfsvfs);
5249 			nvlist_free(nvlist);
5250 			return (error);
5251 		}
5252 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
5253 		    kcred, NULL, 0);
5254 		nvlist_free(nvlist);
5255 		break;
5256 
5257 	case ZFS_SMB_ACL_PURGE:
5258 		error = zfs_smb_acl_purge(sharedir);
5259 		break;
5260 
5261 	default:
5262 		error = SET_ERROR(EINVAL);
5263 		break;
5264 	}
5265 
5266 	VN_RELE(vp);
5267 	VN_RELE(ZTOV(sharedir));
5268 
5269 	ZFS_EXIT(zfsvfs);
5270 
5271 	return (error);
5272 }
5273 
5274 /*
5275  * innvl: {
5276  *     "holds" -> { snapname -> holdname (string), ... }
5277  *     (optional) "cleanup_fd" -> fd (int32)
5278  * }
5279  *
5280  * outnvl: {
5281  *     snapname -> error value (int32)
5282  *     ...
5283  * }
5284  */
5285 /* ARGSUSED */
5286 static int
5287 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
5288 {
5289 	nvpair_t *pair;
5290 	nvlist_t *holds;
5291 	int cleanup_fd = -1;
5292 	int error;
5293 	minor_t minor = 0;
5294 
5295 	error = nvlist_lookup_nvlist(args, "holds", &holds);
5296 	if (error != 0)
5297 		return (SET_ERROR(EINVAL));
5298 
5299 	/* make sure the user didn't pass us any invalid (empty) tags */
5300 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
5301 	    pair = nvlist_next_nvpair(holds, pair)) {
5302 		char *htag;
5303 
5304 		error = nvpair_value_string(pair, &htag);
5305 		if (error != 0)
5306 			return (SET_ERROR(error));
5307 
5308 		if (strlen(htag) == 0)
5309 			return (SET_ERROR(EINVAL));
5310 	}
5311 
5312 	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
5313 		error = zfs_onexit_fd_hold(cleanup_fd, &minor);
5314 		if (error != 0)
5315 			return (error);
5316 	}
5317 
5318 	error = dsl_dataset_user_hold(holds, minor, errlist);
5319 	if (minor != 0)
5320 		zfs_onexit_fd_rele(cleanup_fd);
5321 	return (error);
5322 }
5323 
5324 /*
5325  * innvl is not used.
5326  *
5327  * outnvl: {
5328  *    holdname -> time added (uint64 seconds since epoch)
5329  *    ...
5330  * }
5331  */
5332 /* ARGSUSED */
5333 static int
5334 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
5335 {
5336 	return (dsl_dataset_get_holds(snapname, outnvl));
5337 }
5338 
5339 /*
5340  * innvl: {
5341  *     snapname -> { holdname, ... }
5342  *     ...
5343  * }
5344  *
5345  * outnvl: {
5346  *     snapname -> error value (int32)
5347  *     ...
5348  * }
5349  */
5350 /* ARGSUSED */
5351 static int
5352 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
5353 {
5354 	return (dsl_dataset_user_release(holds, errlist));
5355 }
5356 
5357 /*
5358  * inputs:
5359  * zc_name		name of new filesystem or snapshot
5360  * zc_value		full name of old snapshot
5361  *
5362  * outputs:
5363  * zc_cookie		space in bytes
5364  * zc_objset_type	compressed space in bytes
5365  * zc_perm_action	uncompressed space in bytes
5366  */
5367 static int
5368 zfs_ioc_space_written(zfs_cmd_t *zc)
5369 {
5370 	int error;
5371 	dsl_pool_t *dp;
5372 	dsl_dataset_t *new, *old;
5373 
5374 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5375 	if (error != 0)
5376 		return (error);
5377 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
5378 	if (error != 0) {
5379 		dsl_pool_rele(dp, FTAG);
5380 		return (error);
5381 	}
5382 	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
5383 	if (error != 0) {
5384 		dsl_dataset_rele(new, FTAG);
5385 		dsl_pool_rele(dp, FTAG);
5386 		return (error);
5387 	}
5388 
5389 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5390 	    &zc->zc_objset_type, &zc->zc_perm_action);
5391 	dsl_dataset_rele(old, FTAG);
5392 	dsl_dataset_rele(new, FTAG);
5393 	dsl_pool_rele(dp, FTAG);
5394 	return (error);
5395 }
5396 
5397 /*
5398  * innvl: {
5399  *     "firstsnap" -> snapshot name
5400  * }
5401  *
5402  * outnvl: {
5403  *     "used" -> space in bytes
5404  *     "compressed" -> compressed space in bytes
5405  *     "uncompressed" -> uncompressed space in bytes
5406  * }
5407  */
5408 static int
5409 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5410 {
5411 	int error;
5412 	dsl_pool_t *dp;
5413 	dsl_dataset_t *new, *old;
5414 	char *firstsnap;
5415 	uint64_t used, comp, uncomp;
5416 
5417 	if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5418 		return (SET_ERROR(EINVAL));
5419 
5420 	error = dsl_pool_hold(lastsnap, FTAG, &dp);
5421 	if (error != 0)
5422 		return (error);
5423 
5424 	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
5425 	if (error == 0 && !new->ds_is_snapshot) {
5426 		dsl_dataset_rele(new, FTAG);
5427 		error = SET_ERROR(EINVAL);
5428 	}
5429 	if (error != 0) {
5430 		dsl_pool_rele(dp, FTAG);
5431 		return (error);
5432 	}
5433 	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
5434 	if (error == 0 && !old->ds_is_snapshot) {
5435 		dsl_dataset_rele(old, FTAG);
5436 		error = SET_ERROR(EINVAL);
5437 	}
5438 	if (error != 0) {
5439 		dsl_dataset_rele(new, FTAG);
5440 		dsl_pool_rele(dp, FTAG);
5441 		return (error);
5442 	}
5443 
5444 	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5445 	dsl_dataset_rele(old, FTAG);
5446 	dsl_dataset_rele(new, FTAG);
5447 	dsl_pool_rele(dp, FTAG);
5448 	fnvlist_add_uint64(outnvl, "used", used);
5449 	fnvlist_add_uint64(outnvl, "compressed", comp);
5450 	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5451 	return (error);
5452 }
5453 
5454 /*
5455  * innvl: {
5456  *     "fd" -> file descriptor to write stream to (int32)
5457  *     (optional) "fromsnap" -> full snap name to send an incremental from
5458  *     (optional) "largeblockok" -> (value ignored)
5459  *         indicates that blocks > 128KB are permitted
5460  *     (optional) "embedok" -> (value ignored)
5461  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
5462  *     (optional) "resume_object" and "resume_offset" -> (uint64)
5463  *         if present, resume send stream from specified object and offset.
5464  * }
5465  *
5466  * outnvl is unused
5467  */
5468 /* ARGSUSED */
5469 static int
5470 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5471 {
5472 	int error;
5473 	offset_t off;
5474 	char *fromname = NULL;
5475 	int fd;
5476 	boolean_t largeblockok;
5477 	boolean_t embedok;
5478 	uint64_t resumeobj = 0;
5479 	uint64_t resumeoff = 0;
5480 
5481 	error = nvlist_lookup_int32(innvl, "fd", &fd);
5482 	if (error != 0)
5483 		return (SET_ERROR(EINVAL));
5484 
5485 	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
5486 
5487 	largeblockok = nvlist_exists(innvl, "largeblockok");
5488 	embedok = nvlist_exists(innvl, "embedok");
5489 
5490 	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
5491 	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
5492 
5493 	file_t *fp = getf(fd);
5494 	if (fp == NULL)
5495 		return (SET_ERROR(EBADF));
5496 
5497 	off = fp->f_offset;
5498 	error = dmu_send(snapname, fromname, embedok, largeblockok, fd,
5499 	    resumeobj, resumeoff, fp->f_vnode, &off);
5500 
5501 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5502 		fp->f_offset = off;
5503 	releasef(fd);
5504 	return (error);
5505 }
5506 
5507 /*
5508  * Determine approximately how large a zfs send stream will be -- the number
5509  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5510  *
5511  * innvl: {
5512  *     (optional) "from" -> full snap or bookmark name to send an incremental
5513  *                          from
5514  * }
5515  *
5516  * outnvl: {
5517  *     "space" -> bytes of space (uint64)
5518  * }
5519  */
5520 static int
5521 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5522 {
5523 	dsl_pool_t *dp;
5524 	dsl_dataset_t *tosnap;
5525 	int error;
5526 	char *fromname;
5527 	uint64_t space;
5528 
5529 	error = dsl_pool_hold(snapname, FTAG, &dp);
5530 	if (error != 0)
5531 		return (error);
5532 
5533 	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
5534 	if (error != 0) {
5535 		dsl_pool_rele(dp, FTAG);
5536 		return (error);
5537 	}
5538 
5539 	error = nvlist_lookup_string(innvl, "from", &fromname);
5540 	if (error == 0) {
5541 		if (strchr(fromname, '@') != NULL) {
5542 			/*
5543 			 * If from is a snapshot, hold it and use the more
5544 			 * efficient dmu_send_estimate to estimate send space
5545 			 * size using deadlists.
5546 			 */
5547 			dsl_dataset_t *fromsnap;
5548 			error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
5549 			if (error != 0)
5550 				goto out;
5551 			error = dmu_send_estimate(tosnap, fromsnap, &space);
5552 			dsl_dataset_rele(fromsnap, FTAG);
5553 		} else if (strchr(fromname, '#') != NULL) {
5554 			/*
5555 			 * If from is a bookmark, fetch the creation TXG of the
5556 			 * snapshot it was created from and use that to find
5557 			 * blocks that were born after it.
5558 			 */
5559 			zfs_bookmark_phys_t frombm;
5560 
5561 			error = dsl_bookmark_lookup(dp, fromname, tosnap,
5562 			    &frombm);
5563 			if (error != 0)
5564 				goto out;
5565 			error = dmu_send_estimate_from_txg(tosnap,
5566 			    frombm.zbm_creation_txg, &space);
5567 		} else {
5568 			/*
5569 			 * from is not properly formatted as a snapshot or
5570 			 * bookmark
5571 			 */
5572 			error = SET_ERROR(EINVAL);
5573 			goto out;
5574 		}
5575 	} else {
5576 		// If estimating the size of a full send, use dmu_send_estimate
5577 		error = dmu_send_estimate(tosnap, NULL, &space);
5578 	}
5579 
5580 	fnvlist_add_uint64(outnvl, "space", space);
5581 
5582 out:
5583 	dsl_dataset_rele(tosnap, FTAG);
5584 	dsl_pool_rele(dp, FTAG);
5585 	return (error);
5586 }
5587 
5588 static int
5589 zfs_ioc_set_zev_callbacks(const char *unused, nvlist_t *innvl,
5590     nvlist_t *outnvl)
5591 {
5592 	int error;
5593 	uint64_t cb_addr;
5594 	/*
5595 	 * Our secpolicy for this op makes sure it's called in
5596 	 * kernel context, and that no other callbacks have
5597 	 * been registered, yet.
5598 	 */
5599 	error = nvlist_lookup_uint64(innvl, "callbacks", &cb_addr);
5600 	if (error != 0) {
5601 		cmn_err(CE_WARN, "set_zev_callbacks nvlist lookup failed (%d)",
5602 		    error);
5603 		return (error);
5604 	}
5605 	/* cb_addr is always a kernel memory address */
5606 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5607 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
5608 		rw_exit(&rz_zev_rwlock);
5609 		return (EBUSY);
5610 	}
5611 	rz_zev_callbacks = (void *)(uintptr_t)cb_addr;
5612 	rw_exit(&rz_zev_rwlock);
5613 	return (0);
5614 }
5615 
5616 static int
5617 zfs_ioc_unset_zev_callbacks(const char *unused, nvlist_t *innvl,
5618     nvlist_t *outnvl)
5619 {
5620 	/*
5621 	 * Our secpolicy for this op makes sure it's called in
5622 	 * kernel context.
5623 	 */
5624 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5625 	rz_zev_callbacks = rz_zev_default_callbacks;
5626 	rw_exit(&rz_zev_rwlock);
5627 	/* after mutex release, no thread is using the old table anymore. */
5628 	return (0);
5629 }
5630 
5631 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5632 
5633 static void
5634 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5635     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5636     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5637 {
5638 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5639 
5640 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5641 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5642 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5643 	ASSERT3P(vec->zvec_func, ==, NULL);
5644 
5645 	vec->zvec_legacy_func = func;
5646 	vec->zvec_secpolicy = secpolicy;
5647 	vec->zvec_namecheck = namecheck;
5648 	vec->zvec_allow_log = log_history;
5649 	vec->zvec_pool_check = pool_check;
5650 }
5651 
5652 /*
5653  * See the block comment at the beginning of this file for details on
5654  * each argument to this function.
5655  */
5656 static void
5657 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5658     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5659     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5660     boolean_t allow_log)
5661 {
5662 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5663 
5664 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5665 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5666 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5667 	ASSERT3P(vec->zvec_func, ==, NULL);
5668 
5669 	/* if we are logging, the name must be valid */
5670 	ASSERT(!allow_log || namecheck != NO_NAME);
5671 
5672 	vec->zvec_name = name;
5673 	vec->zvec_func = func;
5674 	vec->zvec_secpolicy = secpolicy;
5675 	vec->zvec_namecheck = namecheck;
5676 	vec->zvec_pool_check = pool_check;
5677 	vec->zvec_smush_outnvlist = smush_outnvlist;
5678 	vec->zvec_allow_log = allow_log;
5679 }
5680 
5681 static void
5682 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5683     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5684     zfs_ioc_poolcheck_t pool_check)
5685 {
5686 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5687 	    POOL_NAME, log_history, pool_check);
5688 }
5689 
5690 static void
5691 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5692     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5693 {
5694 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5695 	    DATASET_NAME, B_FALSE, pool_check);
5696 }
5697 
5698 static void
5699 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5700 {
5701 	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5702 	    POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5703 }
5704 
5705 static void
5706 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5707     zfs_secpolicy_func_t *secpolicy)
5708 {
5709 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5710 	    NO_NAME, B_FALSE, POOL_CHECK_NONE);
5711 }
5712 
5713 static void
5714 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5715     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5716 {
5717 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5718 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5719 }
5720 
5721 static void
5722 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5723 {
5724 	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5725 	    zfs_secpolicy_read);
5726 }
5727 
5728 static void
5729 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5730     zfs_secpolicy_func_t *secpolicy)
5731 {
5732 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5733 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5734 }
5735 
5736 static void
5737 zfs_ioctl_init(void)
5738 {
5739 	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5740 	    zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5741 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5742 
5743 	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5744 	    zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5745 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5746 
5747 	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5748 	    zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5749 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5750 
5751 	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5752 	    zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5753 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5754 
5755 	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5756 	    zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5757 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5758 
5759 	zfs_ioctl_register("create", ZFS_IOC_CREATE,
5760 	    zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5761 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5762 
5763 	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5764 	    zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5765 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5766 
5767 	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5768 	    zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5769 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5770 
5771 	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
5772 	    zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
5773 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5774 	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
5775 	    zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
5776 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5777 
5778 	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
5779 	    zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
5780 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5781 
5782 	zfs_ioctl_register("set_zev_callbacks", ZFS_IOC_SET_ZEV_CALLBACKS,
5783 	    zfs_ioc_set_zev_callbacks, zfs_secpolicy_set_zev_callbacks, NO_NAME,
5784 	    POOL_CHECK_NONE, B_TRUE, B_FALSE);
5785 
5786 	zfs_ioctl_register("unset_zev_callbacks", ZFS_IOC_UNSET_ZEV_CALLBACKS,
5787 	    zfs_ioc_unset_zev_callbacks, zfs_secpolicy_unset_zev_callbacks,
5788 	    NO_NAME, POOL_CHECK_NONE, B_TRUE, B_FALSE);
5789 	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
5790 	    zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
5791 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE);
5792 
5793 	zfs_ioctl_register("bookmark", ZFS_IOC_BOOKMARK,
5794 	    zfs_ioc_bookmark, zfs_secpolicy_bookmark, POOL_NAME,
5795 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5796 
5797 	zfs_ioctl_register("get_bookmarks", ZFS_IOC_GET_BOOKMARKS,
5798 	    zfs_ioc_get_bookmarks, zfs_secpolicy_read, DATASET_NAME,
5799 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5800 
5801 	zfs_ioctl_register("destroy_bookmarks", ZFS_IOC_DESTROY_BOOKMARKS,
5802 	    zfs_ioc_destroy_bookmarks, zfs_secpolicy_destroy_bookmarks,
5803 	    POOL_NAME,
5804 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5805 
5806 	/* IOCTLS that use the legacy function signature */
5807 
5808 	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5809 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5810 
5811 	zfs_ioctl_register_legacy(ZFS_IOC_ARC_INFO, zfs_ioc_arc_info,
5812 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_NONE);
5813 
5814 	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5815 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5816 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5817 	    zfs_ioc_pool_scan);
5818 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5819 	    zfs_ioc_pool_upgrade);
5820 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5821 	    zfs_ioc_vdev_add);
5822 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5823 	    zfs_ioc_vdev_remove);
5824 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5825 	    zfs_ioc_vdev_set_state);
5826 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5827 	    zfs_ioc_vdev_attach);
5828 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5829 	    zfs_ioc_vdev_detach);
5830 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5831 	    zfs_ioc_vdev_setpath);
5832 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5833 	    zfs_ioc_vdev_setfru);
5834 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5835 	    zfs_ioc_pool_set_props);
5836 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5837 	    zfs_ioc_vdev_split);
5838 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5839 	    zfs_ioc_pool_reguid);
5840 
5841 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5842 	    zfs_ioc_pool_configs, zfs_secpolicy_none);
5843 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5844 	    zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5845 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5846 	    zfs_ioc_inject_fault, zfs_secpolicy_inject);
5847 	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5848 	    zfs_ioc_clear_fault, zfs_secpolicy_inject);
5849 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5850 	    zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5851 
5852 	/*
5853 	 * pool destroy, and export don't log the history as part of
5854 	 * zfsdev_ioctl, but rather zfs_ioc_pool_export
5855 	 * does the logging of those commands.
5856 	 */
5857 	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5858 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5859 	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5860 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5861 
5862 	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5863 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5864 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5865 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5866 
5867 	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5868 	    zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5869 	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5870 	    zfs_ioc_dsobj_to_dsname,
5871 	    zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5872 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5873 	    zfs_ioc_pool_get_history,
5874 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5875 
5876 	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5877 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5878 
5879 	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5880 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5881 	zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5882 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5883 
5884 	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5885 	    zfs_ioc_space_written);
5886 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5887 	    zfs_ioc_objset_recvd_props);
5888 	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5889 	    zfs_ioc_next_obj);
5890 	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5891 	    zfs_ioc_get_fsacl);
5892 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5893 	    zfs_ioc_objset_stats);
5894 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5895 	    zfs_ioc_objset_zplprops);
5896 	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5897 	    zfs_ioc_dataset_list_next);
5898 	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5899 	    zfs_ioc_snapshot_list_next);
5900 	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5901 	    zfs_ioc_send_progress);
5902 
5903 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5904 	    zfs_ioc_diff, zfs_secpolicy_diff);
5905 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5906 	    zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5907 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5908 	    zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5909 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5910 	    zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5911 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5912 	    zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5913 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5914 	    zfs_ioc_send, zfs_secpolicy_send);
5915 
5916 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5917 	    zfs_secpolicy_none);
5918 	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5919 	    zfs_secpolicy_destroy);
5920 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5921 	    zfs_secpolicy_rename);
5922 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5923 	    zfs_secpolicy_recv);
5924 	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5925 	    zfs_secpolicy_promote);
5926 	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5927 	    zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5928 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5929 	    zfs_secpolicy_set_fsacl);
5930 
5931 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5932 	    zfs_secpolicy_share, POOL_CHECK_NONE);
5933 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5934 	    zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5935 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5936 	    zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5937 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5938 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5939 	    zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5940 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5941 }
5942 
5943 int
5944 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5945     zfs_ioc_poolcheck_t check)
5946 {
5947 	spa_t *spa;
5948 	int error;
5949 
5950 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
5951 
5952 	if (check & POOL_CHECK_NONE)
5953 		return (0);
5954 
5955 	error = spa_open(name, &spa, FTAG);
5956 	if (error == 0) {
5957 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5958 			error = SET_ERROR(EAGAIN);
5959 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5960 			error = SET_ERROR(EROFS);
5961 		spa_close(spa, FTAG);
5962 	}
5963 	return (error);
5964 }
5965 
5966 /*
5967  * Find a free minor number.
5968  */
5969 minor_t
5970 zfsdev_minor_alloc(void)
5971 {
5972 	static minor_t last_minor;
5973 	minor_t m;
5974 
5975 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5976 
5977 	for (m = last_minor + 1; m != last_minor; m++) {
5978 		if (m > ZFSDEV_MAX_MINOR)
5979 			m = 1;
5980 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5981 			last_minor = m;
5982 			return (m);
5983 		}
5984 	}
5985 
5986 	return (0);
5987 }
5988 
5989 static int
5990 zfs_ctldev_init(dev_t *devp)
5991 {
5992 	minor_t minor;
5993 	zfs_soft_state_t *zs;
5994 
5995 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5996 	ASSERT(getminor(*devp) == 0);
5997 
5998 	minor = zfsdev_minor_alloc();
5999 	if (minor == 0)
6000 		return (SET_ERROR(ENXIO));
6001 
6002 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
6003 		return (SET_ERROR(EAGAIN));
6004 
6005 	*devp = makedevice(getemajor(*devp), minor);
6006 
6007 	zs = ddi_get_soft_state(zfsdev_state, minor);
6008 	zs->zss_type = ZSST_CTLDEV;
6009 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
6010 
6011 	return (0);
6012 }
6013 
6014 static void
6015 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
6016 {
6017 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
6018 
6019 	zfs_onexit_destroy(zo);
6020 	ddi_soft_state_free(zfsdev_state, minor);
6021 }
6022 
6023 void *
6024 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
6025 {
6026 	zfs_soft_state_t *zp;
6027 
6028 	zp = ddi_get_soft_state(zfsdev_state, minor);
6029 	if (zp == NULL || zp->zss_type != which)
6030 		return (NULL);
6031 
6032 	return (zp->zss_data);
6033 }
6034 
6035 static int
6036 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
6037 {
6038 	int error = 0;
6039 
6040 	if (getminor(*devp) != 0)
6041 		return (zvol_open(devp, flag, otyp, cr));
6042 
6043 	/* This is the control device. Allocate a new minor if requested. */
6044 	if (flag & FEXCL) {
6045 		mutex_enter(&zfsdev_state_lock);
6046 		error = zfs_ctldev_init(devp);
6047 		mutex_exit(&zfsdev_state_lock);
6048 	}
6049 
6050 	return (error);
6051 }
6052 
6053 static int
6054 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
6055 {
6056 	zfs_onexit_t *zo;
6057 	minor_t minor = getminor(dev);
6058 
6059 	if (minor == 0)
6060 		return (0);
6061 
6062 	mutex_enter(&zfsdev_state_lock);
6063 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
6064 	if (zo == NULL) {
6065 		mutex_exit(&zfsdev_state_lock);
6066 		return (zvol_close(dev, flag, otyp, cr));
6067 	}
6068 	zfs_ctldev_destroy(zo, minor);
6069 	mutex_exit(&zfsdev_state_lock);
6070 
6071 	return (0);
6072 }
6073 
6074 static int
6075 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
6076 {
6077 	zfs_cmd_t *zc;
6078 	uint_t vecnum;
6079 	int error, rc, len;
6080 	minor_t minor = getminor(dev);
6081 	const zfs_ioc_vec_t *vec;
6082 	char *saved_poolname = NULL;
6083 	nvlist_t *innvl = NULL;
6084 
6085 	if (minor != 0 &&
6086 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
6087 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
6088 
6089 	vecnum = cmd - ZFS_IOC_FIRST;
6090 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
6091 
6092 	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
6093 		return (SET_ERROR(EINVAL));
6094 	vec = &zfs_ioc_vec[vecnum];
6095 
6096 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
6097 
6098 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
6099 	if (error != 0) {
6100 		error = SET_ERROR(EFAULT);
6101 		goto out;
6102 	}
6103 
6104 	zc->zc_iflags = flag & FKIOCTL;
6105 	if (zc->zc_nvlist_src_size != 0) {
6106 		error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
6107 		    zc->zc_iflags, &innvl);
6108 		if (error != 0)
6109 			goto out;
6110 	}
6111 
6112 	/*
6113 	 * Ensure that all pool/dataset names are valid before we pass down to
6114 	 * the lower layers.
6115 	 */
6116 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
6117 	switch (vec->zvec_namecheck) {
6118 	case POOL_NAME:
6119 		if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
6120 			error = SET_ERROR(EINVAL);
6121 		else
6122 			error = pool_status_check(zc->zc_name,
6123 			    vec->zvec_namecheck, vec->zvec_pool_check);
6124 		break;
6125 
6126 	case DATASET_NAME:
6127 		if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
6128 			error = SET_ERROR(EINVAL);
6129 		else
6130 			error = pool_status_check(zc->zc_name,
6131 			    vec->zvec_namecheck, vec->zvec_pool_check);
6132 		break;
6133 
6134 	case NO_NAME:
6135 		break;
6136 	}
6137 
6138 
6139 	if (error == 0 && !(flag & FKIOCTL))
6140 		error = vec->zvec_secpolicy(zc, innvl, cr);
6141 
6142 	if (error != 0)
6143 		goto out;
6144 
6145 	/* legacy ioctls can modify zc_name */
6146 	len = strcspn(zc->zc_name, "/@#") + 1;
6147 	saved_poolname = kmem_alloc(len, KM_SLEEP);
6148 	(void) strlcpy(saved_poolname, zc->zc_name, len);
6149 
6150 	if (vec->zvec_func != NULL) {
6151 		nvlist_t *outnvl;
6152 		int puterror = 0;
6153 		spa_t *spa;
6154 		nvlist_t *lognv = NULL;
6155 
6156 		ASSERT(vec->zvec_legacy_func == NULL);
6157 
6158 		/*
6159 		 * Add the innvl to the lognv before calling the func,
6160 		 * in case the func changes the innvl.
6161 		 */
6162 		if (vec->zvec_allow_log) {
6163 			lognv = fnvlist_alloc();
6164 			fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
6165 			    vec->zvec_name);
6166 			if (!nvlist_empty(innvl)) {
6167 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
6168 				    innvl);
6169 			}
6170 		}
6171 
6172 		outnvl = fnvlist_alloc();
6173 		error = vec->zvec_func(zc->zc_name, innvl, outnvl);
6174 
6175 		if (error == 0 && vec->zvec_allow_log &&
6176 		    spa_open(zc->zc_name, &spa, FTAG) == 0) {
6177 			if (!nvlist_empty(outnvl)) {
6178 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
6179 				    outnvl);
6180 			}
6181 			(void) spa_history_log_nvl(spa, lognv);
6182 			spa_close(spa, FTAG);
6183 		}
6184 		fnvlist_free(lognv);
6185 
6186 		if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
6187 			int smusherror = 0;
6188 			if (vec->zvec_smush_outnvlist) {
6189 				smusherror = nvlist_smush(outnvl,
6190 				    zc->zc_nvlist_dst_size);
6191 			}
6192 			if (smusherror == 0)
6193 				puterror = put_nvlist(zc, outnvl);
6194 		}
6195 
6196 		if (puterror != 0)
6197 			error = puterror;
6198 
6199 		nvlist_free(outnvl);
6200 	} else {
6201 		error = vec->zvec_legacy_func(zc);
6202 	}
6203 
6204 out:
6205 	nvlist_free(innvl);
6206 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
6207 	if (error == 0 && rc != 0)
6208 		error = SET_ERROR(EFAULT);
6209 	if (error == 0 && vec->zvec_allow_log) {
6210 		char *s = tsd_get(zfs_allow_log_key);
6211 		if (s != NULL)
6212 			strfree(s);
6213 		(void) tsd_set(zfs_allow_log_key, saved_poolname);
6214 	} else {
6215 		if (saved_poolname != NULL)
6216 			strfree(saved_poolname);
6217 	}
6218 
6219 	kmem_free(zc, sizeof (zfs_cmd_t));
6220 	return (error);
6221 }
6222 
6223 static int
6224 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
6225 {
6226 	if (cmd != DDI_ATTACH)
6227 		return (DDI_FAILURE);
6228 
6229 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
6230 	    DDI_PSEUDO, 0) == DDI_FAILURE)
6231 		return (DDI_FAILURE);
6232 
6233 	zfs_dip = dip;
6234 
6235 	ddi_report_dev(dip);
6236 
6237 	return (DDI_SUCCESS);
6238 }
6239 
6240 static int
6241 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
6242 {
6243 	if (spa_busy() || zfs_busy() || zvol_busy())
6244 		return (DDI_FAILURE);
6245 
6246 	if (cmd != DDI_DETACH)
6247 		return (DDI_FAILURE);
6248 
6249 	zfs_dip = NULL;
6250 
6251 	ddi_prop_remove_all(dip);
6252 	ddi_remove_minor_node(dip, NULL);
6253 
6254 	return (DDI_SUCCESS);
6255 }
6256 
6257 /*ARGSUSED*/
6258 static int
6259 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
6260 {
6261 	switch (infocmd) {
6262 	case DDI_INFO_DEVT2DEVINFO:
6263 		*result = zfs_dip;
6264 		return (DDI_SUCCESS);
6265 
6266 	case DDI_INFO_DEVT2INSTANCE:
6267 		*result = (void *)0;
6268 		return (DDI_SUCCESS);
6269 	}
6270 
6271 	return (DDI_FAILURE);
6272 }
6273 
6274 /*
6275  * OK, so this is a little weird.
6276  *
6277  * /dev/zfs is the control node, i.e. minor 0.
6278  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
6279  *
6280  * /dev/zfs has basically nothing to do except serve up ioctls,
6281  * so most of the standard driver entry points are in zvol.c.
6282  */
6283 static struct cb_ops zfs_cb_ops = {
6284 	zfsdev_open,	/* open */
6285 	zfsdev_close,	/* close */
6286 	zvol_strategy,	/* strategy */
6287 	nodev,		/* print */
6288 	zvol_dump,	/* dump */
6289 	zvol_read,	/* read */
6290 	zvol_write,	/* write */
6291 	zfsdev_ioctl,	/* ioctl */
6292 	nodev,		/* devmap */
6293 	nodev,		/* mmap */
6294 	nodev,		/* segmap */
6295 	nochpoll,	/* poll */
6296 	ddi_prop_op,	/* prop_op */
6297 	NULL,		/* streamtab */
6298 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
6299 	CB_REV,		/* version */
6300 	nodev,		/* async read */
6301 	nodev,		/* async write */
6302 };
6303 
6304 static struct dev_ops zfs_dev_ops = {
6305 	DEVO_REV,	/* version */
6306 	0,		/* refcnt */
6307 	zfs_info,	/* info */
6308 	nulldev,	/* identify */
6309 	nulldev,	/* probe */
6310 	zfs_attach,	/* attach */
6311 	zfs_detach,	/* detach */
6312 	nodev,		/* reset */
6313 	&zfs_cb_ops,	/* driver operations */
6314 	NULL,		/* no bus operations */
6315 	NULL,		/* power */
6316 	ddi_quiesce_not_needed,	/* quiesce */
6317 };
6318 
6319 static struct modldrv zfs_modldrv = {
6320 	&mod_driverops,
6321 	"ZFS storage pool",
6322 	&zfs_dev_ops
6323 };
6324 
6325 static struct modlinkage modlinkage = {
6326 	MODREV_1,
6327 	(void *)&zfs_modlfs,
6328 	(void *)&zfs_modldrv,
6329 	NULL
6330 };
6331 
6332 static void
6333 zfs_allow_log_destroy(void *arg)
6334 {
6335 	char *poolname = arg;
6336 	strfree(poolname);
6337 }
6338 
6339 int
6340 _init(void)
6341 {
6342 	int error;
6343 
6344 	spa_init(FREAD | FWRITE);
6345 	zfs_init();
6346 	zvol_init();
6347 	zfs_ioctl_init();
6348 	rz_zev_init();
6349 
6350 	if ((error = mod_install(&modlinkage)) != 0) {
6351 		zvol_fini();
6352 		zfs_fini();
6353 		spa_fini();
6354 		return (error);
6355 	}
6356 
6357 	tsd_create(&zfs_fsyncer_key, NULL);
6358 	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
6359 	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
6360 
6361 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
6362 	ASSERT(error == 0);
6363 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
6364 
6365 	return (0);
6366 }
6367 
6368 int
6369 _fini(void)
6370 {
6371 	int error;
6372 
6373 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
6374 		return (SET_ERROR(EBUSY));
6375 
6376 	if ((error = mod_remove(&modlinkage)) != 0)
6377 		return (error);
6378 
6379 	rz_zev_fini();
6380 	zvol_fini();
6381 	zfs_fini();
6382 	spa_fini();
6383 	if (zfs_nfsshare_inited)
6384 		(void) ddi_modclose(nfs_mod);
6385 	if (zfs_smbshare_inited)
6386 		(void) ddi_modclose(smbsrv_mod);
6387 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
6388 		(void) ddi_modclose(sharefs_mod);
6389 
6390 	tsd_destroy(&zfs_fsyncer_key);
6391 	ldi_ident_release(zfs_li);
6392 	zfs_li = NULL;
6393 	mutex_destroy(&zfs_share_lock);
6394 
6395 	return (error);
6396 }
6397 
6398 int
6399 _info(struct modinfo *modinfop)
6400 {
6401 	return (mod_info(&modlinkage, modinfop));
6402 }
6403