xref: /titanic_51/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision 372a60c34a6075464eaab2e7e079cbbc781f9215)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Portions Copyright 2011 Martin Matuska
25  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
26  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
27  * Copyright (c) 2014, Joyent, Inc. All rights reserved.
28  * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
29  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
30  * Copyright (c) 2013 Steven Hartland. All rights reserved.
31  * Copyright (c) 2014 Integros [integros.com]
32  */
33 
34 /*
35  * ZFS ioctls.
36  *
37  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
38  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
39  *
40  * There are two ways that we handle ioctls: the legacy way where almost
41  * all of the logic is in the ioctl callback, and the new way where most
42  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
43  *
44  * Non-legacy ioctls should be registered by calling
45  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
46  * from userland by lzc_ioctl().
47  *
48  * The registration arguments are as follows:
49  *
50  * const char *name
51  *   The name of the ioctl.  This is used for history logging.  If the
52  *   ioctl returns successfully (the callback returns 0), and allow_log
53  *   is true, then a history log entry will be recorded with the input &
54  *   output nvlists.  The log entry can be printed with "zpool history -i".
55  *
56  * zfs_ioc_t ioc
57  *   The ioctl request number, which userland will pass to ioctl(2).
58  *   The ioctl numbers can change from release to release, because
59  *   the caller (libzfs) must be matched to the kernel.
60  *
61  * zfs_secpolicy_func_t *secpolicy
62  *   This function will be called before the zfs_ioc_func_t, to
63  *   determine if this operation is permitted.  It should return EPERM
64  *   on failure, and 0 on success.  Checks include determining if the
65  *   dataset is visible in this zone, and if the user has either all
66  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
67  *   to do this operation on this dataset with "zfs allow".
68  *
69  * zfs_ioc_namecheck_t namecheck
70  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
71  *   name, a dataset name, or nothing.  If the name is not well-formed,
72  *   the ioctl will fail and the callback will not be called.
73  *   Therefore, the callback can assume that the name is well-formed
74  *   (e.g. is null-terminated, doesn't have more than one '@' character,
75  *   doesn't have invalid characters).
76  *
77  * zfs_ioc_poolcheck_t pool_check
78  *   This specifies requirements on the pool state.  If the pool does
79  *   not meet them (is suspended or is readonly), the ioctl will fail
80  *   and the callback will not be called.  If any checks are specified
81  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
82  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
83  *   POOL_CHECK_READONLY).
84  *
85  * boolean_t smush_outnvlist
86  *   If smush_outnvlist is true, then the output is presumed to be a
87  *   list of errors, and it will be "smushed" down to fit into the
88  *   caller's buffer, by removing some entries and replacing them with a
89  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
90  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
91  *   outnvlist does not fit into the userland-provided buffer, then the
92  *   ioctl will fail with ENOMEM.
93  *
94  * zfs_ioc_func_t *func
95  *   The callback function that will perform the operation.
96  *
97  *   The callback should return 0 on success, or an error number on
98  *   failure.  If the function fails, the userland ioctl will return -1,
99  *   and errno will be set to the callback's return value.  The callback
100  *   will be called with the following arguments:
101  *
102  *   const char *name
103  *     The name of the pool or dataset to operate on, from
104  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
105  *     expected type (pool, dataset, or none).
106  *
107  *   nvlist_t *innvl
108  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
109  *     NULL if no input nvlist was provided.  Changes to this nvlist are
110  *     ignored.  If the input nvlist could not be deserialized, the
111  *     ioctl will fail and the callback will not be called.
112  *
113  *   nvlist_t *outnvl
114  *     The output nvlist, initially empty.  The callback can fill it in,
115  *     and it will be returned to userland by serializing it into
116  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
117  *     fails (e.g. because the caller didn't supply a large enough
118  *     buffer), then the overall ioctl will fail.  See the
119  *     'smush_nvlist' argument above for additional behaviors.
120  *
121  *     There are two typical uses of the output nvlist:
122  *       - To return state, e.g. property values.  In this case,
123  *         smush_outnvlist should be false.  If the buffer was not large
124  *         enough, the caller will reallocate a larger buffer and try
125  *         the ioctl again.
126  *
127  *       - To return multiple errors from an ioctl which makes on-disk
128  *         changes.  In this case, smush_outnvlist should be true.
129  *         Ioctls which make on-disk modifications should generally not
130  *         use the outnvl if they succeed, because the caller can not
131  *         distinguish between the operation failing, and
132  *         deserialization failing.
133  */
134 
135 #include <sys/types.h>
136 #include <sys/param.h>
137 #include <sys/errno.h>
138 #include <sys/uio.h>
139 #include <sys/buf.h>
140 #include <sys/modctl.h>
141 #include <sys/open.h>
142 #include <sys/file.h>
143 #include <sys/kmem.h>
144 #include <sys/conf.h>
145 #include <sys/cmn_err.h>
146 #include <sys/stat.h>
147 #include <sys/zfs_ioctl.h>
148 #include <sys/zfs_vfsops.h>
149 #include <sys/zfs_znode.h>
150 #include <sys/zap.h>
151 #include <sys/spa.h>
152 #include <sys/spa_impl.h>
153 #include <sys/vdev.h>
154 #include <sys/priv_impl.h>
155 #include <sys/dmu.h>
156 #include <sys/dsl_dir.h>
157 #include <sys/dsl_dataset.h>
158 #include <sys/dsl_prop.h>
159 #include <sys/dsl_deleg.h>
160 #include <sys/dmu_objset.h>
161 #include <sys/dmu_impl.h>
162 #include <sys/dmu_tx.h>
163 #include <sys/ddi.h>
164 #include <sys/sunddi.h>
165 #include <sys/sunldi.h>
166 #include <sys/policy.h>
167 #include <sys/zone.h>
168 #include <sys/nvpair.h>
169 #include <sys/pathname.h>
170 #include <sys/mount.h>
171 #include <sys/sdt.h>
172 #include <sys/fs/zfs.h>
173 #include <sys/zfs_ctldir.h>
174 #include <sys/zfs_dir.h>
175 #include <sys/zfs_onexit.h>
176 #include <sys/zvol.h>
177 #include <sys/dsl_scan.h>
178 #include <sharefs/share.h>
179 #include <sys/dmu_objset.h>
180 #include <sys/dmu_send.h>
181 #include <sys/dsl_destroy.h>
182 #include <sys/dsl_bookmark.h>
183 #include <sys/dsl_userhold.h>
184 #include <sys/zfeature.h>
185 #include <sys/zio_checksum.h>
186 #include <sys/zfs_events.h>
187 
188 #include "zfs_namecheck.h"
189 #include "zfs_prop.h"
190 #include "zfs_deleg.h"
191 #include "zfs_comutil.h"
192 
193 extern struct modlfs zfs_modlfs;
194 
195 extern void zfs_init(void);
196 extern void zfs_fini(void);
197 
198 ldi_ident_t zfs_li = NULL;
199 dev_info_t *zfs_dip;
200 
201 uint_t zfs_fsyncer_key;
202 extern uint_t rrw_tsd_key;
203 static uint_t zfs_allow_log_key;
204 
205 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
206 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
207 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
208 
209 typedef enum {
210 	NO_NAME,
211 	POOL_NAME,
212 	DATASET_NAME
213 } zfs_ioc_namecheck_t;
214 
215 typedef enum {
216 	POOL_CHECK_NONE		= 1 << 0,
217 	POOL_CHECK_SUSPENDED	= 1 << 1,
218 	POOL_CHECK_READONLY	= 1 << 2,
219 } zfs_ioc_poolcheck_t;
220 
221 typedef struct zfs_ioc_vec {
222 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
223 	zfs_ioc_func_t		*zvec_func;
224 	zfs_secpolicy_func_t	*zvec_secpolicy;
225 	zfs_ioc_namecheck_t	zvec_namecheck;
226 	boolean_t		zvec_allow_log;
227 	zfs_ioc_poolcheck_t	zvec_pool_check;
228 	boolean_t		zvec_smush_outnvlist;
229 	const char		*zvec_name;
230 } zfs_ioc_vec_t;
231 
232 /* This array is indexed by zfs_userquota_prop_t */
233 static const char *userquota_perms[] = {
234 	ZFS_DELEG_PERM_USERUSED,
235 	ZFS_DELEG_PERM_USERQUOTA,
236 	ZFS_DELEG_PERM_GROUPUSED,
237 	ZFS_DELEG_PERM_GROUPQUOTA,
238 };
239 
240 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
241 static int zfs_check_settable(const char *name, nvpair_t *property,
242     cred_t *cr);
243 static int zfs_check_clearable(char *dataset, nvlist_t *props,
244     nvlist_t **errors);
245 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
246     boolean_t *);
247 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
248 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
249 
250 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
251 
252 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
253 void
254 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
255 {
256 	const char *newfile;
257 	char buf[512];
258 	va_list adx;
259 
260 	/*
261 	 * Get rid of annoying "../common/" prefix to filename.
262 	 */
263 	newfile = strrchr(file, '/');
264 	if (newfile != NULL) {
265 		newfile = newfile + 1; /* Get rid of leading / */
266 	} else {
267 		newfile = file;
268 	}
269 
270 	va_start(adx, fmt);
271 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
272 	va_end(adx);
273 
274 	/*
275 	 * To get this data, use the zfs-dprintf probe as so:
276 	 * dtrace -q -n 'zfs-dprintf \
277 	 *	/stringof(arg0) == "dbuf.c"/ \
278 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
279 	 * arg0 = file name
280 	 * arg1 = function name
281 	 * arg2 = line number
282 	 * arg3 = message
283 	 */
284 	DTRACE_PROBE4(zfs__dprintf,
285 	    char *, newfile, char *, func, int, line, char *, buf);
286 }
287 
288 static void
289 history_str_free(char *buf)
290 {
291 	kmem_free(buf, HIS_MAX_RECORD_LEN);
292 }
293 
294 static char *
295 history_str_get(zfs_cmd_t *zc)
296 {
297 	char *buf;
298 
299 	if (zc->zc_history == NULL)
300 		return (NULL);
301 
302 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
303 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
304 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
305 		history_str_free(buf);
306 		return (NULL);
307 	}
308 
309 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
310 
311 	return (buf);
312 }
313 
314 /*
315  * Check to see if the named dataset is currently defined as bootable
316  */
317 static boolean_t
318 zfs_is_bootfs(const char *name)
319 {
320 	objset_t *os;
321 
322 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
323 		boolean_t ret;
324 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
325 		dmu_objset_rele(os, FTAG);
326 		return (ret);
327 	}
328 	return (B_FALSE);
329 }
330 
331 /*
332  * Return non-zero if the spa version is less than requested version.
333  */
334 static int
335 zfs_earlier_version(const char *name, int version)
336 {
337 	spa_t *spa;
338 
339 	if (spa_open(name, &spa, FTAG) == 0) {
340 		if (spa_version(spa) < version) {
341 			spa_close(spa, FTAG);
342 			return (1);
343 		}
344 		spa_close(spa, FTAG);
345 	}
346 	return (0);
347 }
348 
349 /*
350  * Return TRUE if the ZPL version is less than requested version.
351  */
352 static boolean_t
353 zpl_earlier_version(const char *name, int version)
354 {
355 	objset_t *os;
356 	boolean_t rc = B_TRUE;
357 
358 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
359 		uint64_t zplversion;
360 
361 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
362 			dmu_objset_rele(os, FTAG);
363 			return (B_TRUE);
364 		}
365 		/* XXX reading from non-owned objset */
366 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
367 			rc = zplversion < version;
368 		dmu_objset_rele(os, FTAG);
369 	}
370 	return (rc);
371 }
372 
373 static void
374 zfs_log_history(zfs_cmd_t *zc)
375 {
376 	spa_t *spa;
377 	char *buf;
378 
379 	if ((buf = history_str_get(zc)) == NULL)
380 		return;
381 
382 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
383 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
384 			(void) spa_history_log(spa, buf);
385 		spa_close(spa, FTAG);
386 	}
387 	history_str_free(buf);
388 }
389 
390 /*
391  * Policy for top-level read operations (list pools).  Requires no privileges,
392  * and can be used in the local zone, as there is no associated dataset.
393  */
394 /* ARGSUSED */
395 static int
396 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
397 {
398 	return (0);
399 }
400 
401 /*
402  * Policy for dataset read operations (list children, get statistics).  Requires
403  * no privileges, but must be visible in the local zone.
404  */
405 /* ARGSUSED */
406 static int
407 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
408 {
409 	if (INGLOBALZONE(curproc) ||
410 	    zone_dataset_visible(zc->zc_name, NULL))
411 		return (0);
412 
413 	return (SET_ERROR(ENOENT));
414 }
415 
416 static int
417 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
418 {
419 	int writable = 1;
420 
421 	/*
422 	 * The dataset must be visible by this zone -- check this first
423 	 * so they don't see EPERM on something they shouldn't know about.
424 	 */
425 	if (!INGLOBALZONE(curproc) &&
426 	    !zone_dataset_visible(dataset, &writable))
427 		return (SET_ERROR(ENOENT));
428 
429 	if (INGLOBALZONE(curproc)) {
430 		/*
431 		 * If the fs is zoned, only root can access it from the
432 		 * global zone.
433 		 */
434 		if (secpolicy_zfs(cr) && zoned)
435 			return (SET_ERROR(EPERM));
436 	} else {
437 		/*
438 		 * If we are in a local zone, the 'zoned' property must be set.
439 		 */
440 		if (!zoned)
441 			return (SET_ERROR(EPERM));
442 
443 		/* must be writable by this zone */
444 		if (!writable)
445 			return (SET_ERROR(EPERM));
446 	}
447 	return (0);
448 }
449 
450 static int
451 zfs_dozonecheck(const char *dataset, cred_t *cr)
452 {
453 	uint64_t zoned;
454 
455 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
456 		return (SET_ERROR(ENOENT));
457 
458 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
459 }
460 
461 static int
462 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
463 {
464 	uint64_t zoned;
465 
466 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
467 		return (SET_ERROR(ENOENT));
468 
469 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
470 }
471 
472 static int
473 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
474     const char *perm, cred_t *cr)
475 {
476 	int error;
477 
478 	error = zfs_dozonecheck_ds(name, ds, cr);
479 	if (error == 0) {
480 		error = secpolicy_zfs(cr);
481 		if (error != 0)
482 			error = dsl_deleg_access_impl(ds, perm, cr);
483 	}
484 	return (error);
485 }
486 
487 static int
488 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
489 {
490 	int error;
491 	dsl_dataset_t *ds;
492 	dsl_pool_t *dp;
493 
494 	error = dsl_pool_hold(name, FTAG, &dp);
495 	if (error != 0)
496 		return (error);
497 
498 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
499 	if (error != 0) {
500 		dsl_pool_rele(dp, FTAG);
501 		return (error);
502 	}
503 
504 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
505 
506 	dsl_dataset_rele(ds, FTAG);
507 	dsl_pool_rele(dp, FTAG);
508 	return (error);
509 }
510 
511 /*
512  * Policy for setting the security label property.
513  *
514  * Returns 0 for success, non-zero for access and other errors.
515  */
516 static int
517 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
518 {
519 	char		ds_hexsl[MAXNAMELEN];
520 	bslabel_t	ds_sl, new_sl;
521 	boolean_t	new_default = FALSE;
522 	uint64_t	zoned;
523 	int		needed_priv = -1;
524 	int		error;
525 
526 	/* First get the existing dataset label. */
527 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
528 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
529 	if (error != 0)
530 		return (SET_ERROR(EPERM));
531 
532 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
533 		new_default = TRUE;
534 
535 	/* The label must be translatable */
536 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
537 		return (SET_ERROR(EINVAL));
538 
539 	/*
540 	 * In a non-global zone, disallow attempts to set a label that
541 	 * doesn't match that of the zone; otherwise no other checks
542 	 * are needed.
543 	 */
544 	if (!INGLOBALZONE(curproc)) {
545 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
546 			return (SET_ERROR(EPERM));
547 		return (0);
548 	}
549 
550 	/*
551 	 * For global-zone datasets (i.e., those whose zoned property is
552 	 * "off", verify that the specified new label is valid for the
553 	 * global zone.
554 	 */
555 	if (dsl_prop_get_integer(name,
556 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
557 		return (SET_ERROR(EPERM));
558 	if (!zoned) {
559 		if (zfs_check_global_label(name, strval) != 0)
560 			return (SET_ERROR(EPERM));
561 	}
562 
563 	/*
564 	 * If the existing dataset label is nondefault, check if the
565 	 * dataset is mounted (label cannot be changed while mounted).
566 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
567 	 * mounted (or isn't a dataset, doesn't exist, ...).
568 	 */
569 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
570 		objset_t *os;
571 		static char *setsl_tag = "setsl_tag";
572 
573 		/*
574 		 * Try to own the dataset; abort if there is any error,
575 		 * (e.g., already mounted, in use, or other error).
576 		 */
577 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
578 		    setsl_tag, &os);
579 		if (error != 0)
580 			return (SET_ERROR(EPERM));
581 
582 		dmu_objset_disown(os, setsl_tag);
583 
584 		if (new_default) {
585 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
586 			goto out_check;
587 		}
588 
589 		if (hexstr_to_label(strval, &new_sl) != 0)
590 			return (SET_ERROR(EPERM));
591 
592 		if (blstrictdom(&ds_sl, &new_sl))
593 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
594 		else if (blstrictdom(&new_sl, &ds_sl))
595 			needed_priv = PRIV_FILE_UPGRADE_SL;
596 	} else {
597 		/* dataset currently has a default label */
598 		if (!new_default)
599 			needed_priv = PRIV_FILE_UPGRADE_SL;
600 	}
601 
602 out_check:
603 	if (needed_priv != -1)
604 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
605 	return (0);
606 }
607 
608 static int
609 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
610     cred_t *cr)
611 {
612 	char *strval;
613 
614 	/*
615 	 * Check permissions for special properties.
616 	 */
617 	switch (prop) {
618 	case ZFS_PROP_ZONED:
619 		/*
620 		 * Disallow setting of 'zoned' from within a local zone.
621 		 */
622 		if (!INGLOBALZONE(curproc))
623 			return (SET_ERROR(EPERM));
624 		break;
625 
626 	case ZFS_PROP_QUOTA:
627 	case ZFS_PROP_FILESYSTEM_LIMIT:
628 	case ZFS_PROP_SNAPSHOT_LIMIT:
629 		if (!INGLOBALZONE(curproc)) {
630 			uint64_t zoned;
631 			char setpoint[MAXNAMELEN];
632 			/*
633 			 * Unprivileged users are allowed to modify the
634 			 * limit on things *under* (ie. contained by)
635 			 * the thing they own.
636 			 */
637 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
638 			    setpoint))
639 				return (SET_ERROR(EPERM));
640 			if (!zoned || strlen(dsname) <= strlen(setpoint))
641 				return (SET_ERROR(EPERM));
642 		}
643 		break;
644 
645 	case ZFS_PROP_MLSLABEL:
646 		if (!is_system_labeled())
647 			return (SET_ERROR(EPERM));
648 
649 		if (nvpair_value_string(propval, &strval) == 0) {
650 			int err;
651 
652 			err = zfs_set_slabel_policy(dsname, strval, CRED());
653 			if (err != 0)
654 				return (err);
655 		}
656 		break;
657 	}
658 
659 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
660 }
661 
662 /* ARGSUSED */
663 static int
664 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
665 {
666 	int error;
667 
668 	error = zfs_dozonecheck(zc->zc_name, cr);
669 	if (error != 0)
670 		return (error);
671 
672 	/*
673 	 * permission to set permissions will be evaluated later in
674 	 * dsl_deleg_can_allow()
675 	 */
676 	return (0);
677 }
678 
679 /* ARGSUSED */
680 static int
681 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
682 {
683 	return (zfs_secpolicy_write_perms(zc->zc_name,
684 	    ZFS_DELEG_PERM_ROLLBACK, cr));
685 }
686 
687 /* ARGSUSED */
688 static int
689 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
690 {
691 	dsl_pool_t *dp;
692 	dsl_dataset_t *ds;
693 	char *cp;
694 	int error;
695 
696 	/*
697 	 * Generate the current snapshot name from the given objsetid, then
698 	 * use that name for the secpolicy/zone checks.
699 	 */
700 	cp = strchr(zc->zc_name, '@');
701 	if (cp == NULL)
702 		return (SET_ERROR(EINVAL));
703 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
704 	if (error != 0)
705 		return (error);
706 
707 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
708 	if (error != 0) {
709 		dsl_pool_rele(dp, FTAG);
710 		return (error);
711 	}
712 
713 	dsl_dataset_name(ds, zc->zc_name);
714 
715 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
716 	    ZFS_DELEG_PERM_SEND, cr);
717 	dsl_dataset_rele(ds, FTAG);
718 	dsl_pool_rele(dp, FTAG);
719 
720 	return (error);
721 }
722 
723 /* ARGSUSED */
724 static int
725 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
726 {
727 	return (zfs_secpolicy_write_perms(zc->zc_name,
728 	    ZFS_DELEG_PERM_SEND, cr));
729 }
730 
731 /* ARGSUSED */
732 static int
733 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
734 {
735 	vnode_t *vp;
736 	int error;
737 
738 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
739 	    NO_FOLLOW, NULL, &vp)) != 0)
740 		return (error);
741 
742 	/* Now make sure mntpnt and dataset are ZFS */
743 
744 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
745 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
746 	    zc->zc_name) != 0)) {
747 		VN_RELE(vp);
748 		return (SET_ERROR(EPERM));
749 	}
750 
751 	VN_RELE(vp);
752 	return (dsl_deleg_access(zc->zc_name,
753 	    ZFS_DELEG_PERM_SHARE, cr));
754 }
755 
756 int
757 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
758 {
759 	if (!INGLOBALZONE(curproc))
760 		return (SET_ERROR(EPERM));
761 
762 	if (secpolicy_nfs(cr) == 0) {
763 		return (0);
764 	} else {
765 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
766 	}
767 }
768 
769 int
770 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
771 {
772 	if (!INGLOBALZONE(curproc))
773 		return (SET_ERROR(EPERM));
774 
775 	if (secpolicy_smb(cr) == 0) {
776 		return (0);
777 	} else {
778 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
779 	}
780 }
781 
782 static int
783 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
784 {
785 	char *cp;
786 
787 	/*
788 	 * Remove the @bla or /bla from the end of the name to get the parent.
789 	 */
790 	(void) strncpy(parent, datasetname, parentsize);
791 	cp = strrchr(parent, '@');
792 	if (cp != NULL) {
793 		cp[0] = '\0';
794 	} else {
795 		cp = strrchr(parent, '/');
796 		if (cp == NULL)
797 			return (SET_ERROR(ENOENT));
798 		cp[0] = '\0';
799 	}
800 
801 	return (0);
802 }
803 
804 int
805 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
806 {
807 	int error;
808 
809 	if ((error = zfs_secpolicy_write_perms(name,
810 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
811 		return (error);
812 
813 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
814 }
815 
816 /* ARGSUSED */
817 static int
818 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
819 {
820 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
821 }
822 
823 /*
824  * Destroying snapshots with delegated permissions requires
825  * descendant mount and destroy permissions.
826  */
827 /* ARGSUSED */
828 static int
829 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
830 {
831 	nvlist_t *snaps;
832 	nvpair_t *pair, *nextpair;
833 	int error = 0;
834 
835 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
836 		return (SET_ERROR(EINVAL));
837 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
838 	    pair = nextpair) {
839 		nextpair = nvlist_next_nvpair(snaps, pair);
840 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
841 		if (error == ENOENT) {
842 			/*
843 			 * Ignore any snapshots that don't exist (we consider
844 			 * them "already destroyed").  Remove the name from the
845 			 * nvl here in case the snapshot is created between
846 			 * now and when we try to destroy it (in which case
847 			 * we don't want to destroy it since we haven't
848 			 * checked for permission).
849 			 */
850 			fnvlist_remove_nvpair(snaps, pair);
851 			error = 0;
852 		}
853 		if (error != 0)
854 			break;
855 	}
856 
857 	return (error);
858 }
859 
860 int
861 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
862 {
863 	char	parentname[MAXNAMELEN];
864 	int	error;
865 
866 	if ((error = zfs_secpolicy_write_perms(from,
867 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
868 		return (error);
869 
870 	if ((error = zfs_secpolicy_write_perms(from,
871 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
872 		return (error);
873 
874 	if ((error = zfs_get_parent(to, parentname,
875 	    sizeof (parentname))) != 0)
876 		return (error);
877 
878 	if ((error = zfs_secpolicy_write_perms(parentname,
879 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
880 		return (error);
881 
882 	if ((error = zfs_secpolicy_write_perms(parentname,
883 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
884 		return (error);
885 
886 	return (error);
887 }
888 
889 /* ARGSUSED */
890 static int
891 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
892 {
893 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
894 }
895 
896 /* ARGSUSED */
897 static int
898 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
899 {
900 	dsl_pool_t *dp;
901 	dsl_dataset_t *clone;
902 	int error;
903 
904 	error = zfs_secpolicy_write_perms(zc->zc_name,
905 	    ZFS_DELEG_PERM_PROMOTE, cr);
906 	if (error != 0)
907 		return (error);
908 
909 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
910 	if (error != 0)
911 		return (error);
912 
913 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
914 
915 	if (error == 0) {
916 		char parentname[MAXNAMELEN];
917 		dsl_dataset_t *origin = NULL;
918 		dsl_dir_t *dd;
919 		dd = clone->ds_dir;
920 
921 		error = dsl_dataset_hold_obj(dd->dd_pool,
922 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
923 		if (error != 0) {
924 			dsl_dataset_rele(clone, FTAG);
925 			dsl_pool_rele(dp, FTAG);
926 			return (error);
927 		}
928 
929 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
930 		    ZFS_DELEG_PERM_MOUNT, cr);
931 
932 		dsl_dataset_name(origin, parentname);
933 		if (error == 0) {
934 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
935 			    ZFS_DELEG_PERM_PROMOTE, cr);
936 		}
937 		dsl_dataset_rele(clone, FTAG);
938 		dsl_dataset_rele(origin, FTAG);
939 	}
940 	dsl_pool_rele(dp, FTAG);
941 	return (error);
942 }
943 
944 /* ARGSUSED */
945 static int
946 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
947 {
948 	int error;
949 
950 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
951 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
952 		return (error);
953 
954 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
955 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
956 		return (error);
957 
958 	return (zfs_secpolicy_write_perms(zc->zc_name,
959 	    ZFS_DELEG_PERM_CREATE, cr));
960 }
961 
962 int
963 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
964 {
965 	return (zfs_secpolicy_write_perms(name,
966 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
967 }
968 
969 /*
970  * Check for permission to create each snapshot in the nvlist.
971  */
972 /* ARGSUSED */
973 static int
974 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
975 {
976 	nvlist_t *snaps;
977 	int error = 0;
978 	nvpair_t *pair;
979 
980 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
981 		return (SET_ERROR(EINVAL));
982 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
983 	    pair = nvlist_next_nvpair(snaps, pair)) {
984 		char *name = nvpair_name(pair);
985 		char *atp = strchr(name, '@');
986 
987 		if (atp == NULL) {
988 			error = SET_ERROR(EINVAL);
989 			break;
990 		}
991 		*atp = '\0';
992 		error = zfs_secpolicy_snapshot_perms(name, cr);
993 		*atp = '@';
994 		if (error != 0)
995 			break;
996 	}
997 	return (error);
998 }
999 
1000 /*
1001  * Check for permission to create each snapshot in the nvlist.
1002  */
1003 /* ARGSUSED */
1004 static int
1005 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1006 {
1007 	int error = 0;
1008 
1009 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1010 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1011 		char *name = nvpair_name(pair);
1012 		char *hashp = strchr(name, '#');
1013 
1014 		if (hashp == NULL) {
1015 			error = SET_ERROR(EINVAL);
1016 			break;
1017 		}
1018 		*hashp = '\0';
1019 		error = zfs_secpolicy_write_perms(name,
1020 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1021 		*hashp = '#';
1022 		if (error != 0)
1023 			break;
1024 	}
1025 	return (error);
1026 }
1027 
1028 /* ARGSUSED */
1029 static int
1030 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1031 {
1032 	nvpair_t *pair, *nextpair;
1033 	int error = 0;
1034 
1035 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1036 	    pair = nextpair) {
1037 		char *name = nvpair_name(pair);
1038 		char *hashp = strchr(name, '#');
1039 		nextpair = nvlist_next_nvpair(innvl, pair);
1040 
1041 		if (hashp == NULL) {
1042 			error = SET_ERROR(EINVAL);
1043 			break;
1044 		}
1045 
1046 		*hashp = '\0';
1047 		error = zfs_secpolicy_write_perms(name,
1048 		    ZFS_DELEG_PERM_DESTROY, cr);
1049 		*hashp = '#';
1050 		if (error == ENOENT) {
1051 			/*
1052 			 * Ignore any filesystems that don't exist (we consider
1053 			 * their bookmarks "already destroyed").  Remove
1054 			 * the name from the nvl here in case the filesystem
1055 			 * is created between now and when we try to destroy
1056 			 * the bookmark (in which case we don't want to
1057 			 * destroy it since we haven't checked for permission).
1058 			 */
1059 			fnvlist_remove_nvpair(innvl, pair);
1060 			error = 0;
1061 		}
1062 		if (error != 0)
1063 			break;
1064 	}
1065 
1066 	return (error);
1067 }
1068 
1069 /* ARGSUSED */
1070 static int
1071 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1072 {
1073 	/*
1074 	 * Even root must have a proper TSD so that we know what pool
1075 	 * to log to.
1076 	 */
1077 	if (tsd_get(zfs_allow_log_key) == NULL)
1078 		return (SET_ERROR(EPERM));
1079 	return (0);
1080 }
1081 
1082 static int
1083 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1084 {
1085 	char	parentname[MAXNAMELEN];
1086 	int	error;
1087 	char	*origin;
1088 
1089 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1090 	    sizeof (parentname))) != 0)
1091 		return (error);
1092 
1093 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1094 	    (error = zfs_secpolicy_write_perms(origin,
1095 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1096 		return (error);
1097 
1098 	if ((error = zfs_secpolicy_write_perms(parentname,
1099 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1100 		return (error);
1101 
1102 	return (zfs_secpolicy_write_perms(parentname,
1103 	    ZFS_DELEG_PERM_MOUNT, cr));
1104 }
1105 
1106 /*
1107  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1108  * SYS_CONFIG privilege, which is not available in a local zone.
1109  */
1110 /* ARGSUSED */
1111 static int
1112 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1113 {
1114 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1115 		return (SET_ERROR(EPERM));
1116 
1117 	return (0);
1118 }
1119 
1120 /*
1121  * Policy for object to name lookups.
1122  */
1123 /* ARGSUSED */
1124 static int
1125 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1126 {
1127 	int error;
1128 
1129 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1130 		return (0);
1131 
1132 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1133 	return (error);
1134 }
1135 
1136 /*
1137  * Policy for fault injection.  Requires all privileges.
1138  */
1139 /* ARGSUSED */
1140 static int
1141 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1142 {
1143 	return (secpolicy_zinject(cr));
1144 }
1145 
1146 /* ARGSUSED */
1147 static int
1148 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1149 {
1150 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1151 
1152 	if (prop == ZPROP_INVAL) {
1153 		if (!zfs_prop_user(zc->zc_value))
1154 			return (SET_ERROR(EINVAL));
1155 		return (zfs_secpolicy_write_perms(zc->zc_name,
1156 		    ZFS_DELEG_PERM_USERPROP, cr));
1157 	} else {
1158 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1159 		    NULL, cr));
1160 	}
1161 }
1162 
1163 static int
1164 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1165 {
1166 	int err = zfs_secpolicy_read(zc, innvl, cr);
1167 	if (err)
1168 		return (err);
1169 
1170 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1171 		return (SET_ERROR(EINVAL));
1172 
1173 	if (zc->zc_value[0] == 0) {
1174 		/*
1175 		 * They are asking about a posix uid/gid.  If it's
1176 		 * themself, allow it.
1177 		 */
1178 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1179 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1180 			if (zc->zc_guid == crgetuid(cr))
1181 				return (0);
1182 		} else {
1183 			if (groupmember(zc->zc_guid, cr))
1184 				return (0);
1185 		}
1186 	}
1187 
1188 	return (zfs_secpolicy_write_perms(zc->zc_name,
1189 	    userquota_perms[zc->zc_objset_type], cr));
1190 }
1191 
1192 static int
1193 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1194 {
1195 	int err = zfs_secpolicy_read(zc, innvl, cr);
1196 	if (err)
1197 		return (err);
1198 
1199 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1200 		return (SET_ERROR(EINVAL));
1201 
1202 	return (zfs_secpolicy_write_perms(zc->zc_name,
1203 	    userquota_perms[zc->zc_objset_type], cr));
1204 }
1205 
1206 /* ARGSUSED */
1207 static int
1208 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1209 {
1210 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1211 	    NULL, cr));
1212 }
1213 
1214 /* ARGSUSED */
1215 static int
1216 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1217 {
1218 	nvpair_t *pair;
1219 	nvlist_t *holds;
1220 	int error;
1221 
1222 	error = nvlist_lookup_nvlist(innvl, "holds", &holds);
1223 	if (error != 0)
1224 		return (SET_ERROR(EINVAL));
1225 
1226 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1227 	    pair = nvlist_next_nvpair(holds, pair)) {
1228 		char fsname[MAXNAMELEN];
1229 		error = dmu_fsname(nvpair_name(pair), fsname);
1230 		if (error != 0)
1231 			return (error);
1232 		error = zfs_secpolicy_write_perms(fsname,
1233 		    ZFS_DELEG_PERM_HOLD, cr);
1234 		if (error != 0)
1235 			return (error);
1236 	}
1237 	return (0);
1238 }
1239 
1240 /* ARGSUSED */
1241 static int
1242 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1243 {
1244 	nvpair_t *pair;
1245 	int error;
1246 
1247 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1248 	    pair = nvlist_next_nvpair(innvl, pair)) {
1249 		char fsname[MAXNAMELEN];
1250 		error = dmu_fsname(nvpair_name(pair), fsname);
1251 		if (error != 0)
1252 			return (error);
1253 		error = zfs_secpolicy_write_perms(fsname,
1254 		    ZFS_DELEG_PERM_RELEASE, cr);
1255 		if (error != 0)
1256 			return (error);
1257 	}
1258 	return (0);
1259 }
1260 
1261 /*
1262  * Policy for allowing temporary snapshots to be taken or released
1263  */
1264 static int
1265 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1266 {
1267 	/*
1268 	 * A temporary snapshot is the same as a snapshot,
1269 	 * hold, destroy and release all rolled into one.
1270 	 * Delegated diff alone is sufficient that we allow this.
1271 	 */
1272 	int error;
1273 
1274 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1275 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1276 		return (0);
1277 
1278 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1279 	if (error == 0)
1280 		error = zfs_secpolicy_hold(zc, innvl, cr);
1281 	if (error == 0)
1282 		error = zfs_secpolicy_release(zc, innvl, cr);
1283 	if (error == 0)
1284 		error = zfs_secpolicy_destroy(zc, innvl, cr);
1285 	return (error);
1286 }
1287 
1288 /*
1289  * Policy for allowing setting the zev callback list.
1290  */
1291 static int
1292 zfs_secpolicy_set_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1293 {
1294 	/* must be called from kernel context */
1295 	if (!(zc->zc_iflags & FKIOCTL))
1296 		return (SET_ERROR(EPERM));
1297 	/* callback pointer must be unset (set to default value) */
1298 	rw_enter(&rz_zev_rwlock, RW_READER);
1299 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
1300 		rw_exit(&rz_zev_rwlock);
1301 		return (SET_ERROR(EBUSY));
1302 	}
1303 	rw_exit(&rz_zev_rwlock);
1304 	return (0);
1305 }
1306 
1307 /*
1308  * Policy for allowing unsetting/resetting the zev callback list.
1309  */
1310 static int
1311 zfs_secpolicy_unset_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1312 {
1313 	/* must be called from kernel context */
1314 	if (!(zc->zc_iflags & FKIOCTL))
1315 		return (SET_ERROR(EPERM));
1316 	return (0);
1317 }
1318 
1319 /*
1320  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1321  */
1322 static int
1323 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1324 {
1325 	char *packed;
1326 	int error;
1327 	nvlist_t *list = NULL;
1328 
1329 	/*
1330 	 * Read in and unpack the user-supplied nvlist.
1331 	 */
1332 	if (size == 0)
1333 		return (SET_ERROR(EINVAL));
1334 
1335 	packed = kmem_alloc(size, KM_SLEEP);
1336 
1337 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1338 	    iflag)) != 0) {
1339 		kmem_free(packed, size);
1340 		return (SET_ERROR(EFAULT));
1341 	}
1342 
1343 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1344 		kmem_free(packed, size);
1345 		return (error);
1346 	}
1347 
1348 	kmem_free(packed, size);
1349 
1350 	*nvp = list;
1351 	return (0);
1352 }
1353 
1354 /*
1355  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1356  * Entries will be removed from the end of the nvlist, and one int32 entry
1357  * named "N_MORE_ERRORS" will be added indicating how many entries were
1358  * removed.
1359  */
1360 static int
1361 nvlist_smush(nvlist_t *errors, size_t max)
1362 {
1363 	size_t size;
1364 
1365 	size = fnvlist_size(errors);
1366 
1367 	if (size > max) {
1368 		nvpair_t *more_errors;
1369 		int n = 0;
1370 
1371 		if (max < 1024)
1372 			return (SET_ERROR(ENOMEM));
1373 
1374 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1375 		more_errors = nvlist_prev_nvpair(errors, NULL);
1376 
1377 		do {
1378 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1379 			    more_errors);
1380 			fnvlist_remove_nvpair(errors, pair);
1381 			n++;
1382 			size = fnvlist_size(errors);
1383 		} while (size > max);
1384 
1385 		fnvlist_remove_nvpair(errors, more_errors);
1386 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1387 		ASSERT3U(fnvlist_size(errors), <=, max);
1388 	}
1389 
1390 	return (0);
1391 }
1392 
1393 static int
1394 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1395 {
1396 	char *packed = NULL;
1397 	int error = 0;
1398 	size_t size;
1399 
1400 	size = fnvlist_size(nvl);
1401 
1402 	if (size > zc->zc_nvlist_dst_size) {
1403 		error = SET_ERROR(ENOMEM);
1404 	} else {
1405 		packed = fnvlist_pack(nvl, &size);
1406 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1407 		    size, zc->zc_iflags) != 0)
1408 			error = SET_ERROR(EFAULT);
1409 		fnvlist_pack_free(packed, size);
1410 	}
1411 
1412 	zc->zc_nvlist_dst_size = size;
1413 	zc->zc_nvlist_dst_filled = B_TRUE;
1414 	return (error);
1415 }
1416 
1417 static int
1418 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1419 {
1420 	objset_t *os;
1421 	int error;
1422 
1423 	error = dmu_objset_hold(dsname, FTAG, &os);
1424 	if (error != 0)
1425 		return (error);
1426 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1427 		dmu_objset_rele(os, FTAG);
1428 		return (SET_ERROR(EINVAL));
1429 	}
1430 
1431 	mutex_enter(&os->os_user_ptr_lock);
1432 	*zfvp = dmu_objset_get_user(os);
1433 	if (*zfvp) {
1434 		VFS_HOLD((*zfvp)->z_vfs);
1435 	} else {
1436 		error = SET_ERROR(ESRCH);
1437 	}
1438 	mutex_exit(&os->os_user_ptr_lock);
1439 	dmu_objset_rele(os, FTAG);
1440 	return (error);
1441 }
1442 
1443 /*
1444  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1445  * case its z_vfs will be NULL, and it will be opened as the owner.
1446  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1447  * which prevents all vnode ops from running.
1448  */
1449 static int
1450 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1451 {
1452 	int error = 0;
1453 
1454 	if (getzfsvfs(name, zfvp) != 0)
1455 		error = zfsvfs_create(name, zfvp);
1456 	if (error == 0) {
1457 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1458 		    RW_READER, tag);
1459 		if ((*zfvp)->z_unmounted) {
1460 			/*
1461 			 * XXX we could probably try again, since the unmounting
1462 			 * thread should be just about to disassociate the
1463 			 * objset from the zfsvfs.
1464 			 */
1465 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1466 			return (SET_ERROR(EBUSY));
1467 		}
1468 	}
1469 	return (error);
1470 }
1471 
1472 static void
1473 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1474 {
1475 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1476 
1477 	if (zfsvfs->z_vfs) {
1478 		VFS_RELE(zfsvfs->z_vfs);
1479 	} else {
1480 		dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1481 		zfsvfs_free(zfsvfs);
1482 	}
1483 }
1484 
1485 static int
1486 zfs_ioc_pool_create(zfs_cmd_t *zc)
1487 {
1488 	int error;
1489 	nvlist_t *config, *props = NULL;
1490 	nvlist_t *rootprops = NULL;
1491 	nvlist_t *zplprops = NULL;
1492 
1493 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1494 	    zc->zc_iflags, &config))
1495 		return (error);
1496 
1497 	if (zc->zc_nvlist_src_size != 0 && (error =
1498 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1499 	    zc->zc_iflags, &props))) {
1500 		nvlist_free(config);
1501 		return (error);
1502 	}
1503 
1504 	if (props) {
1505 		nvlist_t *nvl = NULL;
1506 		uint64_t version = SPA_VERSION;
1507 
1508 		(void) nvlist_lookup_uint64(props,
1509 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1510 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1511 			error = SET_ERROR(EINVAL);
1512 			goto pool_props_bad;
1513 		}
1514 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1515 		if (nvl) {
1516 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1517 			if (error != 0) {
1518 				nvlist_free(config);
1519 				nvlist_free(props);
1520 				return (error);
1521 			}
1522 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1523 		}
1524 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1525 		error = zfs_fill_zplprops_root(version, rootprops,
1526 		    zplprops, NULL);
1527 		if (error != 0)
1528 			goto pool_props_bad;
1529 	}
1530 
1531 	error = spa_create(zc->zc_name, config, props, zplprops);
1532 
1533 	/*
1534 	 * Set the remaining root properties
1535 	 */
1536 	if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1537 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1538 		(void) spa_destroy(zc->zc_name);
1539 
1540 pool_props_bad:
1541 	nvlist_free(rootprops);
1542 	nvlist_free(zplprops);
1543 	nvlist_free(config);
1544 	nvlist_free(props);
1545 
1546 	return (error);
1547 }
1548 
1549 static int
1550 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1551 {
1552 	int error;
1553 	zfs_log_history(zc);
1554 	error = spa_destroy(zc->zc_name);
1555 	if (error == 0)
1556 		zvol_remove_minors(zc->zc_name);
1557 	return (error);
1558 }
1559 
1560 static int
1561 zfs_ioc_pool_import(zfs_cmd_t *zc)
1562 {
1563 	nvlist_t *config, *props = NULL;
1564 	uint64_t guid;
1565 	int error;
1566 
1567 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1568 	    zc->zc_iflags, &config)) != 0)
1569 		return (error);
1570 
1571 	if (zc->zc_nvlist_src_size != 0 && (error =
1572 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1573 	    zc->zc_iflags, &props))) {
1574 		nvlist_free(config);
1575 		return (error);
1576 	}
1577 
1578 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1579 	    guid != zc->zc_guid)
1580 		error = SET_ERROR(EINVAL);
1581 	else
1582 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1583 
1584 	if (zc->zc_nvlist_dst != 0) {
1585 		int err;
1586 
1587 		if ((err = put_nvlist(zc, config)) != 0)
1588 			error = err;
1589 	}
1590 
1591 	nvlist_free(config);
1592 
1593 	nvlist_free(props);
1594 
1595 	return (error);
1596 }
1597 
1598 static int
1599 zfs_ioc_pool_export(zfs_cmd_t *zc)
1600 {
1601 	int error;
1602 	boolean_t force = (boolean_t)zc->zc_cookie;
1603 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1604 
1605 	zfs_log_history(zc);
1606 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1607 	if (error == 0)
1608 		zvol_remove_minors(zc->zc_name);
1609 	return (error);
1610 }
1611 
1612 static int
1613 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1614 {
1615 	nvlist_t *configs;
1616 	int error;
1617 
1618 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1619 		return (SET_ERROR(EEXIST));
1620 
1621 	error = put_nvlist(zc, configs);
1622 
1623 	nvlist_free(configs);
1624 
1625 	return (error);
1626 }
1627 
1628 /*
1629  * inputs:
1630  * zc_name		name of the pool
1631  *
1632  * outputs:
1633  * zc_cookie		real errno
1634  * zc_nvlist_dst	config nvlist
1635  * zc_nvlist_dst_size	size of config nvlist
1636  */
1637 static int
1638 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1639 {
1640 	nvlist_t *config;
1641 	int error;
1642 	int ret = 0;
1643 
1644 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1645 	    sizeof (zc->zc_value));
1646 
1647 	if (config != NULL) {
1648 		ret = put_nvlist(zc, config);
1649 		nvlist_free(config);
1650 
1651 		/*
1652 		 * The config may be present even if 'error' is non-zero.
1653 		 * In this case we return success, and preserve the real errno
1654 		 * in 'zc_cookie'.
1655 		 */
1656 		zc->zc_cookie = error;
1657 	} else {
1658 		ret = error;
1659 	}
1660 
1661 	return (ret);
1662 }
1663 
1664 /*
1665  * Try to import the given pool, returning pool stats as appropriate so that
1666  * user land knows which devices are available and overall pool health.
1667  */
1668 static int
1669 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1670 {
1671 	nvlist_t *tryconfig, *config;
1672 	int error;
1673 
1674 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1675 	    zc->zc_iflags, &tryconfig)) != 0)
1676 		return (error);
1677 
1678 	config = spa_tryimport(tryconfig);
1679 
1680 	nvlist_free(tryconfig);
1681 
1682 	if (config == NULL)
1683 		return (SET_ERROR(EINVAL));
1684 
1685 	error = put_nvlist(zc, config);
1686 	nvlist_free(config);
1687 
1688 	return (error);
1689 }
1690 
1691 /*
1692  * inputs:
1693  * zc_name              name of the pool
1694  * zc_cookie            scan func (pool_scan_func_t)
1695  */
1696 static int
1697 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1698 {
1699 	spa_t *spa;
1700 	int error;
1701 
1702 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1703 		return (error);
1704 
1705 	if (zc->zc_cookie == POOL_SCAN_NONE)
1706 		error = spa_scan_stop(spa);
1707 	else
1708 		error = spa_scan(spa, zc->zc_cookie);
1709 
1710 	spa_close(spa, FTAG);
1711 
1712 	return (error);
1713 }
1714 
1715 static int
1716 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1717 {
1718 	spa_t *spa;
1719 	int error;
1720 
1721 	error = spa_open(zc->zc_name, &spa, FTAG);
1722 	if (error == 0) {
1723 		spa_freeze(spa);
1724 		spa_close(spa, FTAG);
1725 	}
1726 	return (error);
1727 }
1728 
1729 static int
1730 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1731 {
1732 	spa_t *spa;
1733 	int error;
1734 
1735 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1736 		return (error);
1737 
1738 	if (zc->zc_cookie < spa_version(spa) ||
1739 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1740 		spa_close(spa, FTAG);
1741 		return (SET_ERROR(EINVAL));
1742 	}
1743 
1744 	spa_upgrade(spa, zc->zc_cookie);
1745 	spa_close(spa, FTAG);
1746 
1747 	return (error);
1748 }
1749 
1750 static int
1751 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1752 {
1753 	spa_t *spa;
1754 	char *hist_buf;
1755 	uint64_t size;
1756 	int error;
1757 
1758 	if ((size = zc->zc_history_len) == 0)
1759 		return (SET_ERROR(EINVAL));
1760 
1761 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1762 		return (error);
1763 
1764 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1765 		spa_close(spa, FTAG);
1766 		return (SET_ERROR(ENOTSUP));
1767 	}
1768 
1769 	hist_buf = kmem_alloc(size, KM_SLEEP);
1770 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1771 	    &zc->zc_history_len, hist_buf)) == 0) {
1772 		error = ddi_copyout(hist_buf,
1773 		    (void *)(uintptr_t)zc->zc_history,
1774 		    zc->zc_history_len, zc->zc_iflags);
1775 	}
1776 
1777 	spa_close(spa, FTAG);
1778 	kmem_free(hist_buf, size);
1779 	return (error);
1780 }
1781 
1782 static int
1783 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1784 {
1785 	spa_t *spa;
1786 	int error;
1787 
1788 	error = spa_open(zc->zc_name, &spa, FTAG);
1789 	if (error == 0) {
1790 		error = spa_change_guid(spa);
1791 		spa_close(spa, FTAG);
1792 	}
1793 	return (error);
1794 }
1795 
1796 static int
1797 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1798 {
1799 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1800 }
1801 
1802 /*
1803  * inputs:
1804  * zc_name		name of filesystem
1805  * zc_obj		object to find
1806  *
1807  * outputs:
1808  * zc_value		name of object
1809  */
1810 static int
1811 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1812 {
1813 	objset_t *os;
1814 	int error;
1815 
1816 	/* XXX reading from objset not owned */
1817 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1818 		return (error);
1819 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1820 		dmu_objset_rele(os, FTAG);
1821 		return (SET_ERROR(EINVAL));
1822 	}
1823 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1824 	    sizeof (zc->zc_value));
1825 	dmu_objset_rele(os, FTAG);
1826 
1827 	return (error);
1828 }
1829 
1830 /*
1831  * inputs:
1832  * zc_name		name of filesystem
1833  * zc_obj		object to find
1834  *
1835  * outputs:
1836  * zc_stat		stats on object
1837  * zc_value		path to object
1838  */
1839 static int
1840 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1841 {
1842 	objset_t *os;
1843 	int error;
1844 
1845 	/* XXX reading from objset not owned */
1846 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1847 		return (error);
1848 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1849 		dmu_objset_rele(os, FTAG);
1850 		return (SET_ERROR(EINVAL));
1851 	}
1852 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1853 	    sizeof (zc->zc_value));
1854 	dmu_objset_rele(os, FTAG);
1855 
1856 	return (error);
1857 }
1858 
1859 static int
1860 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1861 {
1862 	spa_t *spa;
1863 	int error;
1864 	nvlist_t *config, **l2cache, **spares;
1865 	uint_t nl2cache = 0, nspares = 0;
1866 
1867 	error = spa_open(zc->zc_name, &spa, FTAG);
1868 	if (error != 0)
1869 		return (error);
1870 
1871 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1872 	    zc->zc_iflags, &config);
1873 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1874 	    &l2cache, &nl2cache);
1875 
1876 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1877 	    &spares, &nspares);
1878 
1879 	/*
1880 	 * A root pool with concatenated devices is not supported.
1881 	 * Thus, can not add a device to a root pool.
1882 	 *
1883 	 * Intent log device can not be added to a rootpool because
1884 	 * during mountroot, zil is replayed, a seperated log device
1885 	 * can not be accessed during the mountroot time.
1886 	 *
1887 	 * l2cache and spare devices are ok to be added to a rootpool.
1888 	 */
1889 	if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1890 		nvlist_free(config);
1891 		spa_close(spa, FTAG);
1892 		return (SET_ERROR(EDOM));
1893 	}
1894 
1895 	if (error == 0) {
1896 		error = spa_vdev_add(spa, config);
1897 		nvlist_free(config);
1898 	}
1899 	spa_close(spa, FTAG);
1900 	return (error);
1901 }
1902 
1903 /*
1904  * inputs:
1905  * zc_name		name of the pool
1906  * zc_nvlist_conf	nvlist of devices to remove
1907  * zc_cookie		to stop the remove?
1908  */
1909 static int
1910 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1911 {
1912 	spa_t *spa;
1913 	int error;
1914 
1915 	error = spa_open(zc->zc_name, &spa, FTAG);
1916 	if (error != 0)
1917 		return (error);
1918 	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1919 	spa_close(spa, FTAG);
1920 	return (error);
1921 }
1922 
1923 static int
1924 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1925 {
1926 	spa_t *spa;
1927 	int error;
1928 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1929 
1930 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1931 		return (error);
1932 	switch (zc->zc_cookie) {
1933 	case VDEV_STATE_ONLINE:
1934 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1935 		break;
1936 
1937 	case VDEV_STATE_OFFLINE:
1938 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1939 		break;
1940 
1941 	case VDEV_STATE_FAULTED:
1942 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1943 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1944 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1945 
1946 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1947 		break;
1948 
1949 	case VDEV_STATE_DEGRADED:
1950 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1951 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1952 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1953 
1954 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1955 		break;
1956 
1957 	default:
1958 		error = SET_ERROR(EINVAL);
1959 	}
1960 	zc->zc_cookie = newstate;
1961 	spa_close(spa, FTAG);
1962 	return (error);
1963 }
1964 
1965 static int
1966 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1967 {
1968 	spa_t *spa;
1969 	int replacing = zc->zc_cookie;
1970 	nvlist_t *config;
1971 	int error;
1972 
1973 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1974 		return (error);
1975 
1976 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1977 	    zc->zc_iflags, &config)) == 0) {
1978 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
1979 		nvlist_free(config);
1980 	}
1981 
1982 	spa_close(spa, FTAG);
1983 	return (error);
1984 }
1985 
1986 static int
1987 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
1988 {
1989 	spa_t *spa;
1990 	int error;
1991 
1992 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1993 		return (error);
1994 
1995 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
1996 
1997 	spa_close(spa, FTAG);
1998 	return (error);
1999 }
2000 
2001 static int
2002 zfs_ioc_vdev_split(zfs_cmd_t *zc)
2003 {
2004 	spa_t *spa;
2005 	nvlist_t *config, *props = NULL;
2006 	int error;
2007 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
2008 
2009 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2010 		return (error);
2011 
2012 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2013 	    zc->zc_iflags, &config)) {
2014 		spa_close(spa, FTAG);
2015 		return (error);
2016 	}
2017 
2018 	if (zc->zc_nvlist_src_size != 0 && (error =
2019 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2020 	    zc->zc_iflags, &props))) {
2021 		spa_close(spa, FTAG);
2022 		nvlist_free(config);
2023 		return (error);
2024 	}
2025 
2026 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2027 
2028 	spa_close(spa, FTAG);
2029 
2030 	nvlist_free(config);
2031 	nvlist_free(props);
2032 
2033 	return (error);
2034 }
2035 
2036 static int
2037 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2038 {
2039 	spa_t *spa;
2040 	char *path = zc->zc_value;
2041 	uint64_t guid = zc->zc_guid;
2042 	int error;
2043 
2044 	error = spa_open(zc->zc_name, &spa, FTAG);
2045 	if (error != 0)
2046 		return (error);
2047 
2048 	error = spa_vdev_setpath(spa, guid, path);
2049 	spa_close(spa, FTAG);
2050 	return (error);
2051 }
2052 
2053 static int
2054 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2055 {
2056 	spa_t *spa;
2057 	char *fru = zc->zc_value;
2058 	uint64_t guid = zc->zc_guid;
2059 	int error;
2060 
2061 	error = spa_open(zc->zc_name, &spa, FTAG);
2062 	if (error != 0)
2063 		return (error);
2064 
2065 	error = spa_vdev_setfru(spa, guid, fru);
2066 	spa_close(spa, FTAG);
2067 	return (error);
2068 }
2069 
2070 static int
2071 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2072 {
2073 	int error = 0;
2074 	nvlist_t *nv;
2075 
2076 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2077 
2078 	if (zc->zc_nvlist_dst != 0 &&
2079 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2080 		dmu_objset_stats(os, nv);
2081 		/*
2082 		 * NB: zvol_get_stats() will read the objset contents,
2083 		 * which we aren't supposed to do with a
2084 		 * DS_MODE_USER hold, because it could be
2085 		 * inconsistent.  So this is a bit of a workaround...
2086 		 * XXX reading with out owning
2087 		 */
2088 		if (!zc->zc_objset_stats.dds_inconsistent &&
2089 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2090 			error = zvol_get_stats(os, nv);
2091 			if (error == EIO)
2092 				return (error);
2093 			VERIFY0(error);
2094 		}
2095 		error = put_nvlist(zc, nv);
2096 		nvlist_free(nv);
2097 	}
2098 
2099 	return (error);
2100 }
2101 
2102 /*
2103  * inputs:
2104  * zc_name		name of filesystem
2105  * zc_nvlist_dst_size	size of buffer for property nvlist
2106  *
2107  * outputs:
2108  * zc_objset_stats	stats
2109  * zc_nvlist_dst	property nvlist
2110  * zc_nvlist_dst_size	size of property nvlist
2111  */
2112 static int
2113 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2114 {
2115 	objset_t *os;
2116 	int error;
2117 
2118 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2119 	if (error == 0) {
2120 		error = zfs_ioc_objset_stats_impl(zc, os);
2121 		dmu_objset_rele(os, FTAG);
2122 	}
2123 
2124 	return (error);
2125 }
2126 
2127 /*
2128  * inputs:
2129  * zc_name		name of filesystem
2130  * zc_nvlist_dst_size	size of buffer for property nvlist
2131  *
2132  * outputs:
2133  * zc_nvlist_dst	received property nvlist
2134  * zc_nvlist_dst_size	size of received property nvlist
2135  *
2136  * Gets received properties (distinct from local properties on or after
2137  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2138  * local property values.
2139  */
2140 static int
2141 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2142 {
2143 	int error = 0;
2144 	nvlist_t *nv;
2145 
2146 	/*
2147 	 * Without this check, we would return local property values if the
2148 	 * caller has not already received properties on or after
2149 	 * SPA_VERSION_RECVD_PROPS.
2150 	 */
2151 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2152 		return (SET_ERROR(ENOTSUP));
2153 
2154 	if (zc->zc_nvlist_dst != 0 &&
2155 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2156 		error = put_nvlist(zc, nv);
2157 		nvlist_free(nv);
2158 	}
2159 
2160 	return (error);
2161 }
2162 
2163 static int
2164 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2165 {
2166 	uint64_t value;
2167 	int error;
2168 
2169 	/*
2170 	 * zfs_get_zplprop() will either find a value or give us
2171 	 * the default value (if there is one).
2172 	 */
2173 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2174 		return (error);
2175 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2176 	return (0);
2177 }
2178 
2179 /*
2180  * inputs:
2181  * zc_name		name of filesystem
2182  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2183  *
2184  * outputs:
2185  * zc_nvlist_dst	zpl property nvlist
2186  * zc_nvlist_dst_size	size of zpl property nvlist
2187  */
2188 static int
2189 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2190 {
2191 	objset_t *os;
2192 	int err;
2193 
2194 	/* XXX reading without owning */
2195 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2196 		return (err);
2197 
2198 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2199 
2200 	/*
2201 	 * NB: nvl_add_zplprop() will read the objset contents,
2202 	 * which we aren't supposed to do with a DS_MODE_USER
2203 	 * hold, because it could be inconsistent.
2204 	 */
2205 	if (zc->zc_nvlist_dst != NULL &&
2206 	    !zc->zc_objset_stats.dds_inconsistent &&
2207 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2208 		nvlist_t *nv;
2209 
2210 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2211 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2212 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2213 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2214 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2215 			err = put_nvlist(zc, nv);
2216 		nvlist_free(nv);
2217 	} else {
2218 		err = SET_ERROR(ENOENT);
2219 	}
2220 	dmu_objset_rele(os, FTAG);
2221 	return (err);
2222 }
2223 
2224 static boolean_t
2225 dataset_name_hidden(const char *name)
2226 {
2227 	/*
2228 	 * Skip over datasets that are not visible in this zone,
2229 	 * internal datasets (which have a $ in their name), and
2230 	 * temporary datasets (which have a % in their name).
2231 	 */
2232 	if (strchr(name, '$') != NULL)
2233 		return (B_TRUE);
2234 	if (strchr(name, '%') != NULL)
2235 		return (B_TRUE);
2236 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2237 		return (B_TRUE);
2238 	return (B_FALSE);
2239 }
2240 
2241 /*
2242  * inputs:
2243  * zc_name		name of filesystem
2244  * zc_cookie		zap cursor
2245  * zc_nvlist_dst_size	size of buffer for property nvlist
2246  *
2247  * outputs:
2248  * zc_name		name of next filesystem
2249  * zc_cookie		zap cursor
2250  * zc_objset_stats	stats
2251  * zc_nvlist_dst	property nvlist
2252  * zc_nvlist_dst_size	size of property nvlist
2253  */
2254 static int
2255 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2256 {
2257 	objset_t *os;
2258 	int error;
2259 	char *p;
2260 	size_t orig_len = strlen(zc->zc_name);
2261 
2262 top:
2263 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2264 		if (error == ENOENT)
2265 			error = SET_ERROR(ESRCH);
2266 		return (error);
2267 	}
2268 
2269 	p = strrchr(zc->zc_name, '/');
2270 	if (p == NULL || p[1] != '\0')
2271 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2272 	p = zc->zc_name + strlen(zc->zc_name);
2273 
2274 	do {
2275 		error = dmu_dir_list_next(os,
2276 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2277 		    NULL, &zc->zc_cookie);
2278 		if (error == ENOENT)
2279 			error = SET_ERROR(ESRCH);
2280 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2281 	dmu_objset_rele(os, FTAG);
2282 
2283 	/*
2284 	 * If it's an internal dataset (ie. with a '$' in its name),
2285 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2286 	 */
2287 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2288 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2289 		if (error == ENOENT) {
2290 			/* We lost a race with destroy, get the next one. */
2291 			zc->zc_name[orig_len] = '\0';
2292 			goto top;
2293 		}
2294 	}
2295 	return (error);
2296 }
2297 
2298 /*
2299  * inputs:
2300  * zc_name		name of filesystem
2301  * zc_cookie		zap cursor
2302  * zc_nvlist_dst_size	size of buffer for property nvlist
2303  *
2304  * outputs:
2305  * zc_name		name of next snapshot
2306  * zc_objset_stats	stats
2307  * zc_nvlist_dst	property nvlist
2308  * zc_nvlist_dst_size	size of property nvlist
2309  */
2310 static int
2311 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2312 {
2313 	objset_t *os;
2314 	int error;
2315 
2316 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2317 	if (error != 0) {
2318 		return (error == ENOENT ? ESRCH : error);
2319 	}
2320 
2321 	/*
2322 	 * A dataset name of maximum length cannot have any snapshots,
2323 	 * so exit immediately.
2324 	 */
2325 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
2326 		dmu_objset_rele(os, FTAG);
2327 		return (SET_ERROR(ESRCH));
2328 	}
2329 
2330 	error = dmu_snapshot_list_next(os,
2331 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2332 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2333 	    NULL);
2334 
2335 	if (error == 0) {
2336 		dsl_dataset_t *ds;
2337 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2338 
2339 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2340 		if (error == 0) {
2341 			objset_t *ossnap;
2342 
2343 			error = dmu_objset_from_ds(ds, &ossnap);
2344 			if (error == 0)
2345 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2346 			dsl_dataset_rele(ds, FTAG);
2347 		}
2348 	} else if (error == ENOENT) {
2349 		error = SET_ERROR(ESRCH);
2350 	}
2351 
2352 	dmu_objset_rele(os, FTAG);
2353 	/* if we failed, undo the @ that we tacked on to zc_name */
2354 	if (error != 0)
2355 		*strchr(zc->zc_name, '@') = '\0';
2356 	return (error);
2357 }
2358 
2359 static int
2360 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2361 {
2362 	const char *propname = nvpair_name(pair);
2363 	uint64_t *valary;
2364 	unsigned int vallen;
2365 	const char *domain;
2366 	char *dash;
2367 	zfs_userquota_prop_t type;
2368 	uint64_t rid;
2369 	uint64_t quota;
2370 	zfsvfs_t *zfsvfs;
2371 	int err;
2372 
2373 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2374 		nvlist_t *attrs;
2375 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2376 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2377 		    &pair) != 0)
2378 			return (SET_ERROR(EINVAL));
2379 	}
2380 
2381 	/*
2382 	 * A correctly constructed propname is encoded as
2383 	 * userquota@<rid>-<domain>.
2384 	 */
2385 	if ((dash = strchr(propname, '-')) == NULL ||
2386 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2387 	    vallen != 3)
2388 		return (SET_ERROR(EINVAL));
2389 
2390 	domain = dash + 1;
2391 	type = valary[0];
2392 	rid = valary[1];
2393 	quota = valary[2];
2394 
2395 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2396 	if (err == 0) {
2397 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2398 		zfsvfs_rele(zfsvfs, FTAG);
2399 	}
2400 
2401 	return (err);
2402 }
2403 
2404 /*
2405  * If the named property is one that has a special function to set its value,
2406  * return 0 on success and a positive error code on failure; otherwise if it is
2407  * not one of the special properties handled by this function, return -1.
2408  *
2409  * XXX: It would be better for callers of the property interface if we handled
2410  * these special cases in dsl_prop.c (in the dsl layer).
2411  */
2412 static int
2413 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2414     nvpair_t *pair)
2415 {
2416 	const char *propname = nvpair_name(pair);
2417 	zfs_prop_t prop = zfs_name_to_prop(propname);
2418 	uint64_t intval;
2419 	int err = -1;
2420 
2421 	if (prop == ZPROP_INVAL) {
2422 		if (zfs_prop_userquota(propname))
2423 			return (zfs_prop_set_userquota(dsname, pair));
2424 		return (-1);
2425 	}
2426 
2427 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2428 		nvlist_t *attrs;
2429 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2430 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2431 		    &pair) == 0);
2432 	}
2433 
2434 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2435 		return (-1);
2436 
2437 	VERIFY(0 == nvpair_value_uint64(pair, &intval));
2438 
2439 	switch (prop) {
2440 	case ZFS_PROP_QUOTA:
2441 		err = dsl_dir_set_quota(dsname, source, intval);
2442 		break;
2443 	case ZFS_PROP_REFQUOTA:
2444 		err = dsl_dataset_set_refquota(dsname, source, intval);
2445 		break;
2446 	case ZFS_PROP_FILESYSTEM_LIMIT:
2447 	case ZFS_PROP_SNAPSHOT_LIMIT:
2448 		if (intval == UINT64_MAX) {
2449 			/* clearing the limit, just do it */
2450 			err = 0;
2451 		} else {
2452 			err = dsl_dir_activate_fs_ss_limit(dsname);
2453 		}
2454 		/*
2455 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2456 		 * default path to set the value in the nvlist.
2457 		 */
2458 		if (err == 0)
2459 			err = -1;
2460 		break;
2461 	case ZFS_PROP_RESERVATION:
2462 		err = dsl_dir_set_reservation(dsname, source, intval);
2463 		break;
2464 	case ZFS_PROP_REFRESERVATION:
2465 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2466 		break;
2467 	case ZFS_PROP_VOLSIZE:
2468 		err = zvol_set_volsize(dsname, intval);
2469 		break;
2470 	case ZFS_PROP_VERSION:
2471 	{
2472 		zfsvfs_t *zfsvfs;
2473 
2474 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2475 			break;
2476 
2477 		err = zfs_set_version(zfsvfs, intval);
2478 		zfsvfs_rele(zfsvfs, FTAG);
2479 
2480 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2481 			zfs_cmd_t *zc;
2482 
2483 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2484 			(void) strcpy(zc->zc_name, dsname);
2485 			(void) zfs_ioc_userspace_upgrade(zc);
2486 			kmem_free(zc, sizeof (zfs_cmd_t));
2487 		}
2488 		break;
2489 	}
2490 	default:
2491 		err = -1;
2492 	}
2493 
2494 	return (err);
2495 }
2496 
2497 /*
2498  * This function is best effort. If it fails to set any of the given properties,
2499  * it continues to set as many as it can and returns the last error
2500  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2501  * with the list of names of all the properties that failed along with the
2502  * corresponding error numbers.
2503  *
2504  * If every property is set successfully, zero is returned and errlist is not
2505  * modified.
2506  */
2507 int
2508 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2509     nvlist_t *errlist)
2510 {
2511 	nvpair_t *pair;
2512 	nvpair_t *propval;
2513 	int rv = 0;
2514 	uint64_t intval;
2515 	char *strval;
2516 	nvlist_t *genericnvl = fnvlist_alloc();
2517 	nvlist_t *retrynvl = fnvlist_alloc();
2518 
2519 retry:
2520 	pair = NULL;
2521 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2522 		const char *propname = nvpair_name(pair);
2523 		zfs_prop_t prop = zfs_name_to_prop(propname);
2524 		int err = 0;
2525 
2526 		/* decode the property value */
2527 		propval = pair;
2528 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2529 			nvlist_t *attrs;
2530 			attrs = fnvpair_value_nvlist(pair);
2531 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2532 			    &propval) != 0)
2533 				err = SET_ERROR(EINVAL);
2534 		}
2535 
2536 		/* Validate value type */
2537 		if (err == 0 && prop == ZPROP_INVAL) {
2538 			if (zfs_prop_user(propname)) {
2539 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2540 					err = SET_ERROR(EINVAL);
2541 			} else if (zfs_prop_userquota(propname)) {
2542 				if (nvpair_type(propval) !=
2543 				    DATA_TYPE_UINT64_ARRAY)
2544 					err = SET_ERROR(EINVAL);
2545 			} else {
2546 				err = SET_ERROR(EINVAL);
2547 			}
2548 		} else if (err == 0) {
2549 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2550 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2551 					err = SET_ERROR(EINVAL);
2552 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2553 				const char *unused;
2554 
2555 				intval = fnvpair_value_uint64(propval);
2556 
2557 				switch (zfs_prop_get_type(prop)) {
2558 				case PROP_TYPE_NUMBER:
2559 					break;
2560 				case PROP_TYPE_STRING:
2561 					err = SET_ERROR(EINVAL);
2562 					break;
2563 				case PROP_TYPE_INDEX:
2564 					if (zfs_prop_index_to_string(prop,
2565 					    intval, &unused) != 0)
2566 						err = SET_ERROR(EINVAL);
2567 					break;
2568 				default:
2569 					cmn_err(CE_PANIC,
2570 					    "unknown property type");
2571 				}
2572 			} else {
2573 				err = SET_ERROR(EINVAL);
2574 			}
2575 		}
2576 
2577 		/* Validate permissions */
2578 		if (err == 0)
2579 			err = zfs_check_settable(dsname, pair, CRED());
2580 
2581 		if (err == 0) {
2582 			err = zfs_prop_set_special(dsname, source, pair);
2583 			if (err == -1) {
2584 				/*
2585 				 * For better performance we build up a list of
2586 				 * properties to set in a single transaction.
2587 				 */
2588 				err = nvlist_add_nvpair(genericnvl, pair);
2589 			} else if (err != 0 && nvl != retrynvl) {
2590 				/*
2591 				 * This may be a spurious error caused by
2592 				 * receiving quota and reservation out of order.
2593 				 * Try again in a second pass.
2594 				 */
2595 				err = nvlist_add_nvpair(retrynvl, pair);
2596 			}
2597 		}
2598 
2599 		if (err != 0) {
2600 			if (errlist != NULL)
2601 				fnvlist_add_int32(errlist, propname, err);
2602 			rv = err;
2603 		}
2604 	}
2605 
2606 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2607 		nvl = retrynvl;
2608 		goto retry;
2609 	}
2610 
2611 	if (!nvlist_empty(genericnvl) &&
2612 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2613 		/*
2614 		 * If this fails, we still want to set as many properties as we
2615 		 * can, so try setting them individually.
2616 		 */
2617 		pair = NULL;
2618 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2619 			const char *propname = nvpair_name(pair);
2620 			int err = 0;
2621 
2622 			propval = pair;
2623 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2624 				nvlist_t *attrs;
2625 				attrs = fnvpair_value_nvlist(pair);
2626 				propval = fnvlist_lookup_nvpair(attrs,
2627 				    ZPROP_VALUE);
2628 			}
2629 
2630 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2631 				strval = fnvpair_value_string(propval);
2632 				err = dsl_prop_set_string(dsname, propname,
2633 				    source, strval);
2634 			} else {
2635 				intval = fnvpair_value_uint64(propval);
2636 				err = dsl_prop_set_int(dsname, propname, source,
2637 				    intval);
2638 			}
2639 
2640 			if (err != 0) {
2641 				if (errlist != NULL) {
2642 					fnvlist_add_int32(errlist, propname,
2643 					    err);
2644 				}
2645 				rv = err;
2646 			}
2647 		}
2648 	}
2649 	nvlist_free(genericnvl);
2650 	nvlist_free(retrynvl);
2651 
2652 	return (rv);
2653 }
2654 
2655 /*
2656  * Check that all the properties are valid user properties.
2657  */
2658 static int
2659 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2660 {
2661 	nvpair_t *pair = NULL;
2662 	int error = 0;
2663 
2664 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2665 		const char *propname = nvpair_name(pair);
2666 
2667 		if (!zfs_prop_user(propname) ||
2668 		    nvpair_type(pair) != DATA_TYPE_STRING)
2669 			return (SET_ERROR(EINVAL));
2670 
2671 		if (error = zfs_secpolicy_write_perms(fsname,
2672 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2673 			return (error);
2674 
2675 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2676 			return (SET_ERROR(ENAMETOOLONG));
2677 
2678 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2679 			return (E2BIG);
2680 	}
2681 	return (0);
2682 }
2683 
2684 static void
2685 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2686 {
2687 	nvpair_t *pair;
2688 
2689 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2690 
2691 	pair = NULL;
2692 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2693 		if (nvlist_exists(skipped, nvpair_name(pair)))
2694 			continue;
2695 
2696 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2697 	}
2698 }
2699 
2700 static int
2701 clear_received_props(const char *dsname, nvlist_t *props,
2702     nvlist_t *skipped)
2703 {
2704 	int err = 0;
2705 	nvlist_t *cleared_props = NULL;
2706 	props_skip(props, skipped, &cleared_props);
2707 	if (!nvlist_empty(cleared_props)) {
2708 		/*
2709 		 * Acts on local properties until the dataset has received
2710 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2711 		 */
2712 		zprop_source_t flags = (ZPROP_SRC_NONE |
2713 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2714 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2715 	}
2716 	nvlist_free(cleared_props);
2717 	return (err);
2718 }
2719 
2720 /*
2721  * inputs:
2722  * zc_name		name of filesystem
2723  * zc_value		name of property to set
2724  * zc_nvlist_src{_size}	nvlist of properties to apply
2725  * zc_cookie		received properties flag
2726  *
2727  * outputs:
2728  * zc_nvlist_dst{_size} error for each unapplied received property
2729  */
2730 static int
2731 zfs_ioc_set_prop(zfs_cmd_t *zc)
2732 {
2733 	nvlist_t *nvl;
2734 	boolean_t received = zc->zc_cookie;
2735 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2736 	    ZPROP_SRC_LOCAL);
2737 	nvlist_t *errors;
2738 	int error;
2739 
2740 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2741 	    zc->zc_iflags, &nvl)) != 0)
2742 		return (error);
2743 
2744 	if (received) {
2745 		nvlist_t *origprops;
2746 
2747 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2748 			(void) clear_received_props(zc->zc_name,
2749 			    origprops, nvl);
2750 			nvlist_free(origprops);
2751 		}
2752 
2753 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2754 	}
2755 
2756 	errors = fnvlist_alloc();
2757 	if (error == 0)
2758 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2759 
2760 	if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2761 		(void) put_nvlist(zc, errors);
2762 	}
2763 
2764 	nvlist_free(errors);
2765 	nvlist_free(nvl);
2766 	return (error);
2767 }
2768 
2769 /*
2770  * inputs:
2771  * zc_name		name of filesystem
2772  * zc_value		name of property to inherit
2773  * zc_cookie		revert to received value if TRUE
2774  *
2775  * outputs:		none
2776  */
2777 static int
2778 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2779 {
2780 	const char *propname = zc->zc_value;
2781 	zfs_prop_t prop = zfs_name_to_prop(propname);
2782 	boolean_t received = zc->zc_cookie;
2783 	zprop_source_t source = (received
2784 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2785 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2786 
2787 	if (received) {
2788 		nvlist_t *dummy;
2789 		nvpair_t *pair;
2790 		zprop_type_t type;
2791 		int err;
2792 
2793 		/*
2794 		 * zfs_prop_set_special() expects properties in the form of an
2795 		 * nvpair with type info.
2796 		 */
2797 		if (prop == ZPROP_INVAL) {
2798 			if (!zfs_prop_user(propname))
2799 				return (SET_ERROR(EINVAL));
2800 
2801 			type = PROP_TYPE_STRING;
2802 		} else if (prop == ZFS_PROP_VOLSIZE ||
2803 		    prop == ZFS_PROP_VERSION) {
2804 			return (SET_ERROR(EINVAL));
2805 		} else {
2806 			type = zfs_prop_get_type(prop);
2807 		}
2808 
2809 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2810 
2811 		switch (type) {
2812 		case PROP_TYPE_STRING:
2813 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2814 			break;
2815 		case PROP_TYPE_NUMBER:
2816 		case PROP_TYPE_INDEX:
2817 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2818 			break;
2819 		default:
2820 			nvlist_free(dummy);
2821 			return (SET_ERROR(EINVAL));
2822 		}
2823 
2824 		pair = nvlist_next_nvpair(dummy, NULL);
2825 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2826 		nvlist_free(dummy);
2827 		if (err != -1)
2828 			return (err); /* special property already handled */
2829 	} else {
2830 		/*
2831 		 * Only check this in the non-received case. We want to allow
2832 		 * 'inherit -S' to revert non-inheritable properties like quota
2833 		 * and reservation to the received or default values even though
2834 		 * they are not considered inheritable.
2835 		 */
2836 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2837 			return (SET_ERROR(EINVAL));
2838 	}
2839 
2840 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2841 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2842 }
2843 
2844 static int
2845 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2846 {
2847 	nvlist_t *props;
2848 	spa_t *spa;
2849 	int error;
2850 	nvpair_t *pair;
2851 
2852 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2853 	    zc->zc_iflags, &props))
2854 		return (error);
2855 
2856 	/*
2857 	 * If the only property is the configfile, then just do a spa_lookup()
2858 	 * to handle the faulted case.
2859 	 */
2860 	pair = nvlist_next_nvpair(props, NULL);
2861 	if (pair != NULL && strcmp(nvpair_name(pair),
2862 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2863 	    nvlist_next_nvpair(props, pair) == NULL) {
2864 		mutex_enter(&spa_namespace_lock);
2865 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2866 			spa_configfile_set(spa, props, B_FALSE);
2867 			spa_config_sync(spa, B_FALSE, B_TRUE);
2868 		}
2869 		mutex_exit(&spa_namespace_lock);
2870 		if (spa != NULL) {
2871 			nvlist_free(props);
2872 			return (0);
2873 		}
2874 	}
2875 
2876 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2877 		nvlist_free(props);
2878 		return (error);
2879 	}
2880 
2881 	error = spa_prop_set(spa, props);
2882 
2883 	nvlist_free(props);
2884 	spa_close(spa, FTAG);
2885 
2886 	return (error);
2887 }
2888 
2889 static int
2890 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2891 {
2892 	spa_t *spa;
2893 	int error;
2894 	nvlist_t *nvp = NULL;
2895 
2896 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2897 		/*
2898 		 * If the pool is faulted, there may be properties we can still
2899 		 * get (such as altroot and cachefile), so attempt to get them
2900 		 * anyway.
2901 		 */
2902 		mutex_enter(&spa_namespace_lock);
2903 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
2904 			error = spa_prop_get(spa, &nvp);
2905 		mutex_exit(&spa_namespace_lock);
2906 	} else {
2907 		error = spa_prop_get(spa, &nvp);
2908 		spa_close(spa, FTAG);
2909 	}
2910 
2911 	if (error == 0 && zc->zc_nvlist_dst != NULL)
2912 		error = put_nvlist(zc, nvp);
2913 	else
2914 		error = SET_ERROR(EFAULT);
2915 
2916 	nvlist_free(nvp);
2917 	return (error);
2918 }
2919 
2920 /*
2921  * inputs:
2922  * zc_name		name of filesystem
2923  * zc_nvlist_src{_size}	nvlist of delegated permissions
2924  * zc_perm_action	allow/unallow flag
2925  *
2926  * outputs:		none
2927  */
2928 static int
2929 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2930 {
2931 	int error;
2932 	nvlist_t *fsaclnv = NULL;
2933 
2934 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2935 	    zc->zc_iflags, &fsaclnv)) != 0)
2936 		return (error);
2937 
2938 	/*
2939 	 * Verify nvlist is constructed correctly
2940 	 */
2941 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2942 		nvlist_free(fsaclnv);
2943 		return (SET_ERROR(EINVAL));
2944 	}
2945 
2946 	/*
2947 	 * If we don't have PRIV_SYS_MOUNT, then validate
2948 	 * that user is allowed to hand out each permission in
2949 	 * the nvlist(s)
2950 	 */
2951 
2952 	error = secpolicy_zfs(CRED());
2953 	if (error != 0) {
2954 		if (zc->zc_perm_action == B_FALSE) {
2955 			error = dsl_deleg_can_allow(zc->zc_name,
2956 			    fsaclnv, CRED());
2957 		} else {
2958 			error = dsl_deleg_can_unallow(zc->zc_name,
2959 			    fsaclnv, CRED());
2960 		}
2961 	}
2962 
2963 	if (error == 0)
2964 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2965 
2966 	nvlist_free(fsaclnv);
2967 	return (error);
2968 }
2969 
2970 /*
2971  * inputs:
2972  * zc_name		name of filesystem
2973  *
2974  * outputs:
2975  * zc_nvlist_src{_size}	nvlist of delegated permissions
2976  */
2977 static int
2978 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
2979 {
2980 	nvlist_t *nvp;
2981 	int error;
2982 
2983 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
2984 		error = put_nvlist(zc, nvp);
2985 		nvlist_free(nvp);
2986 	}
2987 
2988 	return (error);
2989 }
2990 
2991 /*
2992  * Search the vfs list for a specified resource.  Returns a pointer to it
2993  * or NULL if no suitable entry is found. The caller of this routine
2994  * is responsible for releasing the returned vfs pointer.
2995  */
2996 static vfs_t *
2997 zfs_get_vfs(const char *resource)
2998 {
2999 	struct vfs *vfsp;
3000 	struct vfs *vfs_found = NULL;
3001 
3002 	vfs_list_read_lock();
3003 	vfsp = rootvfs;
3004 	do {
3005 		if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
3006 			VFS_HOLD(vfsp);
3007 			vfs_found = vfsp;
3008 			break;
3009 		}
3010 		vfsp = vfsp->vfs_next;
3011 	} while (vfsp != rootvfs);
3012 	vfs_list_unlock();
3013 	return (vfs_found);
3014 }
3015 
3016 /* ARGSUSED */
3017 static void
3018 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
3019 {
3020 	zfs_creat_t *zct = arg;
3021 
3022 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
3023 }
3024 
3025 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3026 
3027 /*
3028  * inputs:
3029  * os			parent objset pointer (NULL if root fs)
3030  * fuids_ok		fuids allowed in this version of the spa?
3031  * sa_ok		SAs allowed in this version of the spa?
3032  * createprops		list of properties requested by creator
3033  *
3034  * outputs:
3035  * zplprops	values for the zplprops we attach to the master node object
3036  * is_ci	true if requested file system will be purely case-insensitive
3037  *
3038  * Determine the settings for utf8only, normalization and
3039  * casesensitivity.  Specific values may have been requested by the
3040  * creator and/or we can inherit values from the parent dataset.  If
3041  * the file system is of too early a vintage, a creator can not
3042  * request settings for these properties, even if the requested
3043  * setting is the default value.  We don't actually want to create dsl
3044  * properties for these, so remove them from the source nvlist after
3045  * processing.
3046  */
3047 static int
3048 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3049     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3050     nvlist_t *zplprops, boolean_t *is_ci)
3051 {
3052 	uint64_t sense = ZFS_PROP_UNDEFINED;
3053 	uint64_t norm = ZFS_PROP_UNDEFINED;
3054 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3055 
3056 	ASSERT(zplprops != NULL);
3057 
3058 	/*
3059 	 * Pull out creator prop choices, if any.
3060 	 */
3061 	if (createprops) {
3062 		(void) nvlist_lookup_uint64(createprops,
3063 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3064 		(void) nvlist_lookup_uint64(createprops,
3065 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3066 		(void) nvlist_remove_all(createprops,
3067 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3068 		(void) nvlist_lookup_uint64(createprops,
3069 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3070 		(void) nvlist_remove_all(createprops,
3071 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3072 		(void) nvlist_lookup_uint64(createprops,
3073 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3074 		(void) nvlist_remove_all(createprops,
3075 		    zfs_prop_to_name(ZFS_PROP_CASE));
3076 	}
3077 
3078 	/*
3079 	 * If the zpl version requested is whacky or the file system
3080 	 * or pool is version is too "young" to support normalization
3081 	 * and the creator tried to set a value for one of the props,
3082 	 * error out.
3083 	 */
3084 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3085 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3086 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3087 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3088 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3089 	    sense != ZFS_PROP_UNDEFINED)))
3090 		return (SET_ERROR(ENOTSUP));
3091 
3092 	/*
3093 	 * Put the version in the zplprops
3094 	 */
3095 	VERIFY(nvlist_add_uint64(zplprops,
3096 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3097 
3098 	if (norm == ZFS_PROP_UNDEFINED)
3099 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3100 	VERIFY(nvlist_add_uint64(zplprops,
3101 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3102 
3103 	/*
3104 	 * If we're normalizing, names must always be valid UTF-8 strings.
3105 	 */
3106 	if (norm)
3107 		u8 = 1;
3108 	if (u8 == ZFS_PROP_UNDEFINED)
3109 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3110 	VERIFY(nvlist_add_uint64(zplprops,
3111 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3112 
3113 	if (sense == ZFS_PROP_UNDEFINED)
3114 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3115 	VERIFY(nvlist_add_uint64(zplprops,
3116 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3117 
3118 	if (is_ci)
3119 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3120 
3121 	return (0);
3122 }
3123 
3124 static int
3125 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3126     nvlist_t *zplprops, boolean_t *is_ci)
3127 {
3128 	boolean_t fuids_ok, sa_ok;
3129 	uint64_t zplver = ZPL_VERSION;
3130 	objset_t *os = NULL;
3131 	char parentname[MAXNAMELEN];
3132 	char *cp;
3133 	spa_t *spa;
3134 	uint64_t spa_vers;
3135 	int error;
3136 
3137 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3138 	cp = strrchr(parentname, '/');
3139 	ASSERT(cp != NULL);
3140 	cp[0] = '\0';
3141 
3142 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3143 		return (error);
3144 
3145 	spa_vers = spa_version(spa);
3146 	spa_close(spa, FTAG);
3147 
3148 	zplver = zfs_zpl_version_map(spa_vers);
3149 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3150 	sa_ok = (zplver >= ZPL_VERSION_SA);
3151 
3152 	/*
3153 	 * Open parent object set so we can inherit zplprop values.
3154 	 */
3155 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3156 		return (error);
3157 
3158 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3159 	    zplprops, is_ci);
3160 	dmu_objset_rele(os, FTAG);
3161 	return (error);
3162 }
3163 
3164 static int
3165 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3166     nvlist_t *zplprops, boolean_t *is_ci)
3167 {
3168 	boolean_t fuids_ok;
3169 	boolean_t sa_ok;
3170 	uint64_t zplver = ZPL_VERSION;
3171 	int error;
3172 
3173 	zplver = zfs_zpl_version_map(spa_vers);
3174 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3175 	sa_ok = (zplver >= ZPL_VERSION_SA);
3176 
3177 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3178 	    createprops, zplprops, is_ci);
3179 	return (error);
3180 }
3181 
3182 /*
3183  * innvl: {
3184  *     "type" -> dmu_objset_type_t (int32)
3185  *     (optional) "props" -> { prop -> value }
3186  * }
3187  *
3188  * outnvl: propname -> error code (int32)
3189  */
3190 static int
3191 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3192 {
3193 	int error = 0;
3194 	zfs_creat_t zct = { 0 };
3195 	nvlist_t *nvprops = NULL;
3196 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3197 	int32_t type32;
3198 	dmu_objset_type_t type;
3199 	boolean_t is_insensitive = B_FALSE;
3200 
3201 	if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3202 		return (SET_ERROR(EINVAL));
3203 	type = type32;
3204 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3205 
3206 	switch (type) {
3207 	case DMU_OST_ZFS:
3208 		cbfunc = zfs_create_cb;
3209 		break;
3210 
3211 	case DMU_OST_ZVOL:
3212 		cbfunc = zvol_create_cb;
3213 		break;
3214 
3215 	default:
3216 		cbfunc = NULL;
3217 		break;
3218 	}
3219 	if (strchr(fsname, '@') ||
3220 	    strchr(fsname, '%'))
3221 		return (SET_ERROR(EINVAL));
3222 
3223 	zct.zct_props = nvprops;
3224 
3225 	if (cbfunc == NULL)
3226 		return (SET_ERROR(EINVAL));
3227 
3228 	if (type == DMU_OST_ZVOL) {
3229 		uint64_t volsize, volblocksize;
3230 
3231 		if (nvprops == NULL)
3232 			return (SET_ERROR(EINVAL));
3233 		if (nvlist_lookup_uint64(nvprops,
3234 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3235 			return (SET_ERROR(EINVAL));
3236 
3237 		if ((error = nvlist_lookup_uint64(nvprops,
3238 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3239 		    &volblocksize)) != 0 && error != ENOENT)
3240 			return (SET_ERROR(EINVAL));
3241 
3242 		if (error != 0)
3243 			volblocksize = zfs_prop_default_numeric(
3244 			    ZFS_PROP_VOLBLOCKSIZE);
3245 
3246 		if ((error = zvol_check_volblocksize(
3247 		    volblocksize)) != 0 ||
3248 		    (error = zvol_check_volsize(volsize,
3249 		    volblocksize)) != 0)
3250 			return (error);
3251 	} else if (type == DMU_OST_ZFS) {
3252 		int error;
3253 
3254 		/*
3255 		 * We have to have normalization and
3256 		 * case-folding flags correct when we do the
3257 		 * file system creation, so go figure them out
3258 		 * now.
3259 		 */
3260 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3261 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3262 		error = zfs_fill_zplprops(fsname, nvprops,
3263 		    zct.zct_zplprops, &is_insensitive);
3264 		if (error != 0) {
3265 			nvlist_free(zct.zct_zplprops);
3266 			return (error);
3267 		}
3268 	}
3269 
3270 	error = dmu_objset_create(fsname, type,
3271 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3272 	nvlist_free(zct.zct_zplprops);
3273 
3274 	/*
3275 	 * It would be nice to do this atomically.
3276 	 */
3277 	if (error == 0) {
3278 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3279 		    nvprops, outnvl);
3280 		if (error != 0)
3281 			(void) dsl_destroy_head(fsname);
3282 	}
3283 	return (error);
3284 }
3285 
3286 /*
3287  * innvl: {
3288  *     "origin" -> name of origin snapshot
3289  *     (optional) "props" -> { prop -> value }
3290  * }
3291  *
3292  * outnvl: propname -> error code (int32)
3293  */
3294 static int
3295 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3296 {
3297 	int error = 0;
3298 	nvlist_t *nvprops = NULL;
3299 	char *origin_name;
3300 
3301 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3302 		return (SET_ERROR(EINVAL));
3303 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3304 
3305 	if (strchr(fsname, '@') ||
3306 	    strchr(fsname, '%'))
3307 		return (SET_ERROR(EINVAL));
3308 
3309 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3310 		return (SET_ERROR(EINVAL));
3311 	error = dmu_objset_clone(fsname, origin_name);
3312 	if (error != 0)
3313 		return (error);
3314 
3315 	/*
3316 	 * It would be nice to do this atomically.
3317 	 */
3318 	if (error == 0) {
3319 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3320 		    nvprops, outnvl);
3321 		if (error != 0)
3322 			(void) dsl_destroy_head(fsname);
3323 	}
3324 	return (error);
3325 }
3326 
3327 /*
3328  * innvl: {
3329  *     "snaps" -> { snapshot1, snapshot2 }
3330  *     (optional) "props" -> { prop -> value (string) }
3331  * }
3332  *
3333  * outnvl: snapshot -> error code (int32)
3334  */
3335 static int
3336 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3337 {
3338 	nvlist_t *snaps;
3339 	nvlist_t *props = NULL;
3340 	int error, poollen;
3341 	nvpair_t *pair;
3342 
3343 	(void) nvlist_lookup_nvlist(innvl, "props", &props);
3344 	if ((error = zfs_check_userprops(poolname, props)) != 0)
3345 		return (error);
3346 
3347 	if (!nvlist_empty(props) &&
3348 	    zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3349 		return (SET_ERROR(ENOTSUP));
3350 
3351 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3352 		return (SET_ERROR(EINVAL));
3353 	poollen = strlen(poolname);
3354 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3355 	    pair = nvlist_next_nvpair(snaps, pair)) {
3356 		const char *name = nvpair_name(pair);
3357 		const char *cp = strchr(name, '@');
3358 
3359 		/*
3360 		 * The snap name must contain an @, and the part after it must
3361 		 * contain only valid characters.
3362 		 */
3363 		if (cp == NULL ||
3364 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3365 			return (SET_ERROR(EINVAL));
3366 
3367 		/*
3368 		 * The snap must be in the specified pool.
3369 		 */
3370 		if (strncmp(name, poolname, poollen) != 0 ||
3371 		    (name[poollen] != '/' && name[poollen] != '@'))
3372 			return (SET_ERROR(EXDEV));
3373 
3374 		/* This must be the only snap of this fs. */
3375 		for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3376 		    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3377 			if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3378 			    == 0) {
3379 				return (SET_ERROR(EXDEV));
3380 			}
3381 		}
3382 	}
3383 
3384 	error = dsl_dataset_snapshot(snaps, props, outnvl);
3385 	return (error);
3386 }
3387 
3388 /*
3389  * innvl: "message" -> string
3390  */
3391 /* ARGSUSED */
3392 static int
3393 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3394 {
3395 	char *message;
3396 	spa_t *spa;
3397 	int error;
3398 	char *poolname;
3399 
3400 	/*
3401 	 * The poolname in the ioctl is not set, we get it from the TSD,
3402 	 * which was set at the end of the last successful ioctl that allows
3403 	 * logging.  The secpolicy func already checked that it is set.
3404 	 * Only one log ioctl is allowed after each successful ioctl, so
3405 	 * we clear the TSD here.
3406 	 */
3407 	poolname = tsd_get(zfs_allow_log_key);
3408 	(void) tsd_set(zfs_allow_log_key, NULL);
3409 	error = spa_open(poolname, &spa, FTAG);
3410 	strfree(poolname);
3411 	if (error != 0)
3412 		return (error);
3413 
3414 	if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3415 		spa_close(spa, FTAG);
3416 		return (SET_ERROR(EINVAL));
3417 	}
3418 
3419 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3420 		spa_close(spa, FTAG);
3421 		return (SET_ERROR(ENOTSUP));
3422 	}
3423 
3424 	error = spa_history_log(spa, message);
3425 	spa_close(spa, FTAG);
3426 	return (error);
3427 }
3428 
3429 /*
3430  * The dp_config_rwlock must not be held when calling this, because the
3431  * unmount may need to write out data.
3432  *
3433  * This function is best-effort.  Callers must deal gracefully if it
3434  * remains mounted (or is remounted after this call).
3435  *
3436  * Returns 0 if the argument is not a snapshot, or it is not currently a
3437  * filesystem, or we were able to unmount it.  Returns error code otherwise.
3438  */
3439 int
3440 zfs_unmount_snap(const char *snapname)
3441 {
3442 	vfs_t *vfsp;
3443 	zfsvfs_t *zfsvfs;
3444 	int err;
3445 
3446 	if (strchr(snapname, '@') == NULL)
3447 		return (0);
3448 
3449 	vfsp = zfs_get_vfs(snapname);
3450 	if (vfsp == NULL)
3451 		return (0);
3452 
3453 	zfsvfs = vfsp->vfs_data;
3454 	ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3455 
3456 	err = vn_vfswlock(vfsp->vfs_vnodecovered);
3457 	VFS_RELE(vfsp);
3458 	if (err != 0)
3459 		return (SET_ERROR(err));
3460 
3461 	/*
3462 	 * Always force the unmount for snapshots.
3463 	 */
3464 	(void) dounmount(vfsp, MS_FORCE, kcred);
3465 	return (0);
3466 }
3467 
3468 /* ARGSUSED */
3469 static int
3470 zfs_unmount_snap_cb(const char *snapname, void *arg)
3471 {
3472 	return (zfs_unmount_snap(snapname));
3473 }
3474 
3475 /*
3476  * When a clone is destroyed, its origin may also need to be destroyed,
3477  * in which case it must be unmounted.  This routine will do that unmount
3478  * if necessary.
3479  */
3480 void
3481 zfs_destroy_unmount_origin(const char *fsname)
3482 {
3483 	int error;
3484 	objset_t *os;
3485 	dsl_dataset_t *ds;
3486 
3487 	error = dmu_objset_hold(fsname, FTAG, &os);
3488 	if (error != 0)
3489 		return;
3490 	ds = dmu_objset_ds(os);
3491 	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3492 		char originname[MAXNAMELEN];
3493 		dsl_dataset_name(ds->ds_prev, originname);
3494 		dmu_objset_rele(os, FTAG);
3495 		(void) zfs_unmount_snap(originname);
3496 	} else {
3497 		dmu_objset_rele(os, FTAG);
3498 	}
3499 }
3500 
3501 /*
3502  * innvl: {
3503  *     "snaps" -> { snapshot1, snapshot2 }
3504  *     (optional boolean) "defer"
3505  * }
3506  *
3507  * outnvl: snapshot -> error code (int32)
3508  *
3509  */
3510 /* ARGSUSED */
3511 static int
3512 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3513 {
3514 	nvlist_t *snaps;
3515 	nvpair_t *pair;
3516 	boolean_t defer;
3517 
3518 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3519 		return (SET_ERROR(EINVAL));
3520 	defer = nvlist_exists(innvl, "defer");
3521 
3522 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3523 	    pair = nvlist_next_nvpair(snaps, pair)) {
3524 		(void) zfs_unmount_snap(nvpair_name(pair));
3525 	}
3526 
3527 	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3528 }
3529 
3530 /*
3531  * Create bookmarks.  Bookmark names are of the form <fs>#<bmark>.
3532  * All bookmarks must be in the same pool.
3533  *
3534  * innvl: {
3535  *     bookmark1 -> snapshot1, bookmark2 -> snapshot2
3536  * }
3537  *
3538  * outnvl: bookmark -> error code (int32)
3539  *
3540  */
3541 /* ARGSUSED */
3542 static int
3543 zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3544 {
3545 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3546 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3547 		char *snap_name;
3548 
3549 		/*
3550 		 * Verify the snapshot argument.
3551 		 */
3552 		if (nvpair_value_string(pair, &snap_name) != 0)
3553 			return (SET_ERROR(EINVAL));
3554 
3555 
3556 		/* Verify that the keys (bookmarks) are unique */
3557 		for (nvpair_t *pair2 = nvlist_next_nvpair(innvl, pair);
3558 		    pair2 != NULL; pair2 = nvlist_next_nvpair(innvl, pair2)) {
3559 			if (strcmp(nvpair_name(pair), nvpair_name(pair2)) == 0)
3560 				return (SET_ERROR(EINVAL));
3561 		}
3562 	}
3563 
3564 	return (dsl_bookmark_create(innvl, outnvl));
3565 }
3566 
3567 /*
3568  * innvl: {
3569  *     property 1, property 2, ...
3570  * }
3571  *
3572  * outnvl: {
3573  *     bookmark name 1 -> { property 1, property 2, ... },
3574  *     bookmark name 2 -> { property 1, property 2, ... }
3575  * }
3576  *
3577  */
3578 static int
3579 zfs_ioc_get_bookmarks(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3580 {
3581 	return (dsl_get_bookmarks(fsname, innvl, outnvl));
3582 }
3583 
3584 /*
3585  * innvl: {
3586  *     bookmark name 1, bookmark name 2
3587  * }
3588  *
3589  * outnvl: bookmark -> error code (int32)
3590  *
3591  */
3592 static int
3593 zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
3594     nvlist_t *outnvl)
3595 {
3596 	int error, poollen;
3597 
3598 	poollen = strlen(poolname);
3599 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3600 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3601 		const char *name = nvpair_name(pair);
3602 		const char *cp = strchr(name, '#');
3603 
3604 		/*
3605 		 * The bookmark name must contain an #, and the part after it
3606 		 * must contain only valid characters.
3607 		 */
3608 		if (cp == NULL ||
3609 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3610 			return (SET_ERROR(EINVAL));
3611 
3612 		/*
3613 		 * The bookmark must be in the specified pool.
3614 		 */
3615 		if (strncmp(name, poolname, poollen) != 0 ||
3616 		    (name[poollen] != '/' && name[poollen] != '#'))
3617 			return (SET_ERROR(EXDEV));
3618 	}
3619 
3620 	error = dsl_bookmark_destroy(innvl, outnvl);
3621 	return (error);
3622 }
3623 
3624 /*
3625  * inputs:
3626  * zc_name		name of dataset to destroy
3627  * zc_objset_type	type of objset
3628  * zc_defer_destroy	mark for deferred destroy
3629  *
3630  * outputs:		none
3631  */
3632 static int
3633 zfs_ioc_destroy(zfs_cmd_t *zc)
3634 {
3635 	int err;
3636 
3637 	if (zc->zc_objset_type == DMU_OST_ZFS) {
3638 		err = zfs_unmount_snap(zc->zc_name);
3639 		if (err != 0)
3640 			return (err);
3641 	}
3642 
3643 	if (strchr(zc->zc_name, '@'))
3644 		err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3645 	else
3646 		err = dsl_destroy_head(zc->zc_name);
3647 	if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3648 		(void) zvol_remove_minor(zc->zc_name);
3649 	return (err);
3650 }
3651 
3652 /*
3653  * fsname is name of dataset to rollback (to most recent snapshot)
3654  *
3655  * innvl is not used.
3656  *
3657  * outnvl: "target" -> name of most recent snapshot
3658  * }
3659  */
3660 /* ARGSUSED */
3661 static int
3662 zfs_ioc_rollback(const char *fsname, nvlist_t *args, nvlist_t *outnvl)
3663 {
3664 	zfsvfs_t *zfsvfs;
3665 	int error;
3666 
3667 	if (getzfsvfs(fsname, &zfsvfs) == 0) {
3668 		error = zfs_suspend_fs(zfsvfs);
3669 		if (error == 0) {
3670 			int resume_err;
3671 
3672 			error = dsl_dataset_rollback(fsname, zfsvfs, outnvl);
3673 			resume_err = zfs_resume_fs(zfsvfs, fsname);
3674 			error = error ? error : resume_err;
3675 		}
3676 		VFS_RELE(zfsvfs->z_vfs);
3677 	} else {
3678 		error = dsl_dataset_rollback(fsname, NULL, outnvl);
3679 	}
3680 	return (error);
3681 }
3682 
3683 static int
3684 recursive_unmount(const char *fsname, void *arg)
3685 {
3686 	const char *snapname = arg;
3687 	char fullname[MAXNAMELEN];
3688 
3689 	(void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
3690 	return (zfs_unmount_snap(fullname));
3691 }
3692 
3693 /*
3694  * inputs:
3695  * zc_name	old name of dataset
3696  * zc_value	new name of dataset
3697  * zc_cookie	recursive flag (only valid for snapshots)
3698  *
3699  * outputs:	none
3700  */
3701 static int
3702 zfs_ioc_rename(zfs_cmd_t *zc)
3703 {
3704 	boolean_t recursive = zc->zc_cookie & 1;
3705 	char *at;
3706 
3707 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3708 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3709 	    strchr(zc->zc_value, '%'))
3710 		return (SET_ERROR(EINVAL));
3711 
3712 	at = strchr(zc->zc_name, '@');
3713 	if (at != NULL) {
3714 		/* snaps must be in same fs */
3715 		int error;
3716 
3717 		if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
3718 			return (SET_ERROR(EXDEV));
3719 		*at = '\0';
3720 		if (zc->zc_objset_type == DMU_OST_ZFS) {
3721 			error = dmu_objset_find(zc->zc_name,
3722 			    recursive_unmount, at + 1,
3723 			    recursive ? DS_FIND_CHILDREN : 0);
3724 			if (error != 0) {
3725 				*at = '@';
3726 				return (error);
3727 			}
3728 		}
3729 		error = dsl_dataset_rename_snapshot(zc->zc_name,
3730 		    at + 1, strchr(zc->zc_value, '@') + 1, recursive);
3731 		*at = '@';
3732 
3733 		return (error);
3734 	} else {
3735 		if (zc->zc_objset_type == DMU_OST_ZVOL)
3736 			(void) zvol_remove_minor(zc->zc_name);
3737 		return (dsl_dir_rename(zc->zc_name, zc->zc_value));
3738 	}
3739 }
3740 
3741 static int
3742 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3743 {
3744 	const char *propname = nvpair_name(pair);
3745 	boolean_t issnap = (strchr(dsname, '@') != NULL);
3746 	zfs_prop_t prop = zfs_name_to_prop(propname);
3747 	uint64_t intval;
3748 	int err;
3749 
3750 	if (prop == ZPROP_INVAL) {
3751 		if (zfs_prop_user(propname)) {
3752 			if (err = zfs_secpolicy_write_perms(dsname,
3753 			    ZFS_DELEG_PERM_USERPROP, cr))
3754 				return (err);
3755 			return (0);
3756 		}
3757 
3758 		if (!issnap && zfs_prop_userquota(propname)) {
3759 			const char *perm = NULL;
3760 			const char *uq_prefix =
3761 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3762 			const char *gq_prefix =
3763 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3764 
3765 			if (strncmp(propname, uq_prefix,
3766 			    strlen(uq_prefix)) == 0) {
3767 				perm = ZFS_DELEG_PERM_USERQUOTA;
3768 			} else if (strncmp(propname, gq_prefix,
3769 			    strlen(gq_prefix)) == 0) {
3770 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
3771 			} else {
3772 				/* USERUSED and GROUPUSED are read-only */
3773 				return (SET_ERROR(EINVAL));
3774 			}
3775 
3776 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3777 				return (err);
3778 			return (0);
3779 		}
3780 
3781 		return (SET_ERROR(EINVAL));
3782 	}
3783 
3784 	if (issnap)
3785 		return (SET_ERROR(EINVAL));
3786 
3787 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3788 		/*
3789 		 * dsl_prop_get_all_impl() returns properties in this
3790 		 * format.
3791 		 */
3792 		nvlist_t *attrs;
3793 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3794 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3795 		    &pair) == 0);
3796 	}
3797 
3798 	/*
3799 	 * Check that this value is valid for this pool version
3800 	 */
3801 	switch (prop) {
3802 	case ZFS_PROP_COMPRESSION:
3803 		/*
3804 		 * If the user specified gzip compression, make sure
3805 		 * the SPA supports it. We ignore any errors here since
3806 		 * we'll catch them later.
3807 		 */
3808 		if (nvpair_value_uint64(pair, &intval) == 0) {
3809 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
3810 			    intval <= ZIO_COMPRESS_GZIP_9 &&
3811 			    zfs_earlier_version(dsname,
3812 			    SPA_VERSION_GZIP_COMPRESSION)) {
3813 				return (SET_ERROR(ENOTSUP));
3814 			}
3815 
3816 			if (intval == ZIO_COMPRESS_ZLE &&
3817 			    zfs_earlier_version(dsname,
3818 			    SPA_VERSION_ZLE_COMPRESSION))
3819 				return (SET_ERROR(ENOTSUP));
3820 
3821 			if (intval == ZIO_COMPRESS_LZ4) {
3822 				spa_t *spa;
3823 
3824 				if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3825 					return (err);
3826 
3827 				if (!spa_feature_is_enabled(spa,
3828 				    SPA_FEATURE_LZ4_COMPRESS)) {
3829 					spa_close(spa, FTAG);
3830 					return (SET_ERROR(ENOTSUP));
3831 				}
3832 				spa_close(spa, FTAG);
3833 			}
3834 
3835 			/*
3836 			 * If this is a bootable dataset then
3837 			 * verify that the compression algorithm
3838 			 * is supported for booting. We must return
3839 			 * something other than ENOTSUP since it
3840 			 * implies a downrev pool version.
3841 			 */
3842 			if (zfs_is_bootfs(dsname) &&
3843 			    !BOOTFS_COMPRESS_VALID(intval)) {
3844 				return (SET_ERROR(ERANGE));
3845 			}
3846 		}
3847 		break;
3848 
3849 	case ZFS_PROP_COPIES:
3850 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3851 			return (SET_ERROR(ENOTSUP));
3852 		break;
3853 
3854 	case ZFS_PROP_RECORDSIZE:
3855 		/* Record sizes above 128k need the feature to be enabled */
3856 		if (nvpair_value_uint64(pair, &intval) == 0 &&
3857 		    intval > SPA_OLD_MAXBLOCKSIZE) {
3858 			spa_t *spa;
3859 
3860 			/*
3861 			 * If this is a bootable dataset then
3862 			 * the we don't allow large (>128K) blocks,
3863 			 * because GRUB doesn't support them.
3864 			 */
3865 			if (zfs_is_bootfs(dsname) &&
3866 			    intval > SPA_OLD_MAXBLOCKSIZE) {
3867 				return (SET_ERROR(ERANGE));
3868 			}
3869 
3870 			/*
3871 			 * We don't allow setting the property above 1MB,
3872 			 * unless the tunable has been changed.
3873 			 */
3874 			if (intval > zfs_max_recordsize ||
3875 			    intval > SPA_MAXBLOCKSIZE)
3876 				return (SET_ERROR(ERANGE));
3877 
3878 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3879 				return (err);
3880 
3881 			if (!spa_feature_is_enabled(spa,
3882 			    SPA_FEATURE_LARGE_BLOCKS)) {
3883 				spa_close(spa, FTAG);
3884 				return (SET_ERROR(ENOTSUP));
3885 			}
3886 			spa_close(spa, FTAG);
3887 		}
3888 		break;
3889 
3890 	case ZFS_PROP_SHARESMB:
3891 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3892 			return (SET_ERROR(ENOTSUP));
3893 		break;
3894 
3895 	case ZFS_PROP_ACLINHERIT:
3896 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3897 		    nvpair_value_uint64(pair, &intval) == 0) {
3898 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
3899 			    zfs_earlier_version(dsname,
3900 			    SPA_VERSION_PASSTHROUGH_X))
3901 				return (SET_ERROR(ENOTSUP));
3902 		}
3903 		break;
3904 
3905 	case ZFS_PROP_CHECKSUM:
3906 	case ZFS_PROP_DEDUP:
3907 	{
3908 		spa_feature_t feature;
3909 		spa_t *spa;
3910 
3911 		/* dedup feature version checks */
3912 		if (prop == ZFS_PROP_DEDUP &&
3913 		    zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3914 			return (SET_ERROR(ENOTSUP));
3915 
3916 		if (nvpair_value_uint64(pair, &intval) != 0)
3917 			return (SET_ERROR(EINVAL));
3918 
3919 		/* check prop value is enabled in features */
3920 		feature = zio_checksum_to_feature(intval & ZIO_CHECKSUM_MASK);
3921 		if (feature == SPA_FEATURE_NONE)
3922 			break;
3923 
3924 		if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3925 			return (err);
3926 		/*
3927 		 * Salted checksums are not supported on root pools.
3928 		 */
3929 		if (spa_bootfs(spa) != 0 &&
3930 		    intval < ZIO_CHECKSUM_FUNCTIONS &&
3931 		    (zio_checksum_table[intval].ci_flags &
3932 		    ZCHECKSUM_FLAG_SALTED)) {
3933 			spa_close(spa, FTAG);
3934 			return (SET_ERROR(ERANGE));
3935 		}
3936 		if (!spa_feature_is_enabled(spa, feature)) {
3937 			spa_close(spa, FTAG);
3938 			return (SET_ERROR(ENOTSUP));
3939 		}
3940 		spa_close(spa, FTAG);
3941 		break;
3942 	}
3943 	}
3944 
3945 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3946 }
3947 
3948 /*
3949  * Checks for a race condition to make sure we don't increment a feature flag
3950  * multiple times.
3951  */
3952 static int
3953 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
3954 {
3955 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3956 	spa_feature_t *featurep = arg;
3957 
3958 	if (!spa_feature_is_active(spa, *featurep))
3959 		return (0);
3960 	else
3961 		return (SET_ERROR(EBUSY));
3962 }
3963 
3964 /*
3965  * The callback invoked on feature activation in the sync task caused by
3966  * zfs_prop_activate_feature.
3967  */
3968 static void
3969 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
3970 {
3971 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3972 	spa_feature_t *featurep = arg;
3973 
3974 	spa_feature_incr(spa, *featurep, tx);
3975 }
3976 
3977 /*
3978  * Activates a feature on a pool in response to a property setting. This
3979  * creates a new sync task which modifies the pool to reflect the feature
3980  * as being active.
3981  */
3982 static int
3983 zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature)
3984 {
3985 	int err;
3986 
3987 	/* EBUSY here indicates that the feature is already active */
3988 	err = dsl_sync_task(spa_name(spa),
3989 	    zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
3990 	    &feature, 2, ZFS_SPACE_CHECK_RESERVED);
3991 
3992 	if (err != 0 && err != EBUSY)
3993 		return (err);
3994 	else
3995 		return (0);
3996 }
3997 
3998 /*
3999  * Removes properties from the given props list that fail permission checks
4000  * needed to clear them and to restore them in case of a receive error. For each
4001  * property, make sure we have both set and inherit permissions.
4002  *
4003  * Returns the first error encountered if any permission checks fail. If the
4004  * caller provides a non-NULL errlist, it also gives the complete list of names
4005  * of all the properties that failed a permission check along with the
4006  * corresponding error numbers. The caller is responsible for freeing the
4007  * returned errlist.
4008  *
4009  * If every property checks out successfully, zero is returned and the list
4010  * pointed at by errlist is NULL.
4011  */
4012 static int
4013 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
4014 {
4015 	zfs_cmd_t *zc;
4016 	nvpair_t *pair, *next_pair;
4017 	nvlist_t *errors;
4018 	int err, rv = 0;
4019 
4020 	if (props == NULL)
4021 		return (0);
4022 
4023 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4024 
4025 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
4026 	(void) strcpy(zc->zc_name, dataset);
4027 	pair = nvlist_next_nvpair(props, NULL);
4028 	while (pair != NULL) {
4029 		next_pair = nvlist_next_nvpair(props, pair);
4030 
4031 		(void) strcpy(zc->zc_value, nvpair_name(pair));
4032 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
4033 		    (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
4034 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
4035 			VERIFY(nvlist_add_int32(errors,
4036 			    zc->zc_value, err) == 0);
4037 		}
4038 		pair = next_pair;
4039 	}
4040 	kmem_free(zc, sizeof (zfs_cmd_t));
4041 
4042 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
4043 		nvlist_free(errors);
4044 		errors = NULL;
4045 	} else {
4046 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
4047 	}
4048 
4049 	if (errlist == NULL)
4050 		nvlist_free(errors);
4051 	else
4052 		*errlist = errors;
4053 
4054 	return (rv);
4055 }
4056 
4057 static boolean_t
4058 propval_equals(nvpair_t *p1, nvpair_t *p2)
4059 {
4060 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
4061 		/* dsl_prop_get_all_impl() format */
4062 		nvlist_t *attrs;
4063 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
4064 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4065 		    &p1) == 0);
4066 	}
4067 
4068 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
4069 		nvlist_t *attrs;
4070 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
4071 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4072 		    &p2) == 0);
4073 	}
4074 
4075 	if (nvpair_type(p1) != nvpair_type(p2))
4076 		return (B_FALSE);
4077 
4078 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
4079 		char *valstr1, *valstr2;
4080 
4081 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
4082 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
4083 		return (strcmp(valstr1, valstr2) == 0);
4084 	} else {
4085 		uint64_t intval1, intval2;
4086 
4087 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
4088 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
4089 		return (intval1 == intval2);
4090 	}
4091 }
4092 
4093 /*
4094  * Remove properties from props if they are not going to change (as determined
4095  * by comparison with origprops). Remove them from origprops as well, since we
4096  * do not need to clear or restore properties that won't change.
4097  */
4098 static void
4099 props_reduce(nvlist_t *props, nvlist_t *origprops)
4100 {
4101 	nvpair_t *pair, *next_pair;
4102 
4103 	if (origprops == NULL)
4104 		return; /* all props need to be received */
4105 
4106 	pair = nvlist_next_nvpair(props, NULL);
4107 	while (pair != NULL) {
4108 		const char *propname = nvpair_name(pair);
4109 		nvpair_t *match;
4110 
4111 		next_pair = nvlist_next_nvpair(props, pair);
4112 
4113 		if ((nvlist_lookup_nvpair(origprops, propname,
4114 		    &match) != 0) || !propval_equals(pair, match))
4115 			goto next; /* need to set received value */
4116 
4117 		/* don't clear the existing received value */
4118 		(void) nvlist_remove_nvpair(origprops, match);
4119 		/* don't bother receiving the property */
4120 		(void) nvlist_remove_nvpair(props, pair);
4121 next:
4122 		pair = next_pair;
4123 	}
4124 }
4125 
4126 /*
4127  * Extract properties that cannot be set PRIOR to the receipt of a dataset.
4128  * For example, refquota cannot be set until after the receipt of a dataset,
4129  * because in replication streams, an older/earlier snapshot may exceed the
4130  * refquota.  We want to receive the older/earlier snapshot, but setting
4131  * refquota pre-receipt will set the dsl's ACTUAL quota, which will prevent
4132  * the older/earlier snapshot from being received (with EDQUOT).
4133  *
4134  * The ZFS test "zfs_receive_011_pos" demonstrates such a scenario.
4135  *
4136  * libzfs will need to be judicious handling errors encountered by props
4137  * extracted by this function.
4138  */
4139 static nvlist_t *
4140 extract_delay_props(nvlist_t *props)
4141 {
4142 	nvlist_t *delayprops;
4143 	nvpair_t *nvp, *tmp;
4144 	static const zfs_prop_t delayable[] = { ZFS_PROP_REFQUOTA, 0 };
4145 	int i;
4146 
4147 	VERIFY(nvlist_alloc(&delayprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4148 
4149 	for (nvp = nvlist_next_nvpair(props, NULL); nvp != NULL;
4150 	    nvp = nvlist_next_nvpair(props, nvp)) {
4151 		/*
4152 		 * strcmp() is safe because zfs_prop_to_name() always returns
4153 		 * a bounded string.
4154 		 */
4155 		for (i = 0; delayable[i] != 0; i++) {
4156 			if (strcmp(zfs_prop_to_name(delayable[i]),
4157 			    nvpair_name(nvp)) == 0) {
4158 				break;
4159 			}
4160 		}
4161 		if (delayable[i] != 0) {
4162 			tmp = nvlist_prev_nvpair(props, nvp);
4163 			VERIFY(nvlist_add_nvpair(delayprops, nvp) == 0);
4164 			VERIFY(nvlist_remove_nvpair(props, nvp) == 0);
4165 			nvp = tmp;
4166 		}
4167 	}
4168 
4169 	if (nvlist_empty(delayprops)) {
4170 		nvlist_free(delayprops);
4171 		delayprops = NULL;
4172 	}
4173 	return (delayprops);
4174 }
4175 
4176 #ifdef	DEBUG
4177 static boolean_t zfs_ioc_recv_inject_err;
4178 #endif
4179 
4180 /*
4181  * inputs:
4182  * zc_name		name of containing filesystem
4183  * zc_nvlist_src{_size}	nvlist of properties to apply
4184  * zc_value		name of snapshot to create
4185  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
4186  * zc_cookie		file descriptor to recv from
4187  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
4188  * zc_guid		force flag
4189  * zc_cleanup_fd	cleanup-on-exit file descriptor
4190  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
4191  * zc_resumable		if data is incomplete assume sender will resume
4192  *
4193  * outputs:
4194  * zc_cookie		number of bytes read
4195  * zc_nvlist_dst{_size} error for each unapplied received property
4196  * zc_obj		zprop_errflags_t
4197  * zc_action_handle	handle for this guid/ds mapping
4198  */
4199 static int
4200 zfs_ioc_recv(zfs_cmd_t *zc)
4201 {
4202 	file_t *fp;
4203 	dmu_recv_cookie_t drc;
4204 	boolean_t force = (boolean_t)zc->zc_guid;
4205 	int fd;
4206 	int error = 0;
4207 	int props_error = 0;
4208 	nvlist_t *errors;
4209 	offset_t off;
4210 	nvlist_t *props = NULL; /* sent properties */
4211 	nvlist_t *origprops = NULL; /* existing properties */
4212 	nvlist_t *delayprops = NULL; /* sent properties applied post-receive */
4213 	char *origin = NULL;
4214 	char *tosnap;
4215 	char tofs[ZFS_MAXNAMELEN];
4216 	boolean_t first_recvd_props = B_FALSE;
4217 
4218 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
4219 	    strchr(zc->zc_value, '@') == NULL ||
4220 	    strchr(zc->zc_value, '%'))
4221 		return (SET_ERROR(EINVAL));
4222 
4223 	(void) strcpy(tofs, zc->zc_value);
4224 	tosnap = strchr(tofs, '@');
4225 	*tosnap++ = '\0';
4226 
4227 	if (zc->zc_nvlist_src != NULL &&
4228 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
4229 	    zc->zc_iflags, &props)) != 0)
4230 		return (error);
4231 
4232 	fd = zc->zc_cookie;
4233 	fp = getf(fd);
4234 	if (fp == NULL) {
4235 		nvlist_free(props);
4236 		return (SET_ERROR(EBADF));
4237 	}
4238 
4239 	errors = fnvlist_alloc();
4240 
4241 	if (zc->zc_string[0])
4242 		origin = zc->zc_string;
4243 
4244 	error = dmu_recv_begin(tofs, tosnap,
4245 	    &zc->zc_begin_record, force, zc->zc_resumable, origin, &drc);
4246 	if (error != 0)
4247 		goto out;
4248 
4249 	/*
4250 	 * Set properties before we receive the stream so that they are applied
4251 	 * to the new data. Note that we must call dmu_recv_stream() if
4252 	 * dmu_recv_begin() succeeds.
4253 	 */
4254 	if (props != NULL && !drc.drc_newfs) {
4255 		if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
4256 		    SPA_VERSION_RECVD_PROPS &&
4257 		    !dsl_prop_get_hasrecvd(tofs))
4258 			first_recvd_props = B_TRUE;
4259 
4260 		/*
4261 		 * If new received properties are supplied, they are to
4262 		 * completely replace the existing received properties, so stash
4263 		 * away the existing ones.
4264 		 */
4265 		if (dsl_prop_get_received(tofs, &origprops) == 0) {
4266 			nvlist_t *errlist = NULL;
4267 			/*
4268 			 * Don't bother writing a property if its value won't
4269 			 * change (and avoid the unnecessary security checks).
4270 			 *
4271 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
4272 			 * special case where we blow away all local properties
4273 			 * regardless.
4274 			 */
4275 			if (!first_recvd_props)
4276 				props_reduce(props, origprops);
4277 			if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
4278 				(void) nvlist_merge(errors, errlist, 0);
4279 			nvlist_free(errlist);
4280 
4281 			if (clear_received_props(tofs, origprops,
4282 			    first_recvd_props ? NULL : props) != 0)
4283 				zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4284 		} else {
4285 			zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4286 		}
4287 	}
4288 
4289 	if (props != NULL) {
4290 		props_error = dsl_prop_set_hasrecvd(tofs);
4291 
4292 		if (props_error == 0) {
4293 			delayprops = extract_delay_props(props);
4294 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4295 			    props, errors);
4296 		}
4297 	}
4298 
4299 	off = fp->f_offset;
4300 	error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4301 	    &zc->zc_action_handle);
4302 
4303 	if (error == 0) {
4304 		zfsvfs_t *zfsvfs = NULL;
4305 
4306 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
4307 			/* online recv */
4308 			int end_err;
4309 
4310 			error = zfs_suspend_fs(zfsvfs);
4311 			/*
4312 			 * If the suspend fails, then the recv_end will
4313 			 * likely also fail, and clean up after itself.
4314 			 */
4315 			end_err = dmu_recv_end(&drc, zfsvfs);
4316 			if (error == 0)
4317 				error = zfs_resume_fs(zfsvfs, tofs);
4318 			error = error ? error : end_err;
4319 			VFS_RELE(zfsvfs->z_vfs);
4320 		} else {
4321 			error = dmu_recv_end(&drc, NULL);
4322 		}
4323 
4324 		/* Set delayed properties now, after we're done receiving. */
4325 		if (delayprops != NULL && error == 0) {
4326 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4327 			    delayprops, errors);
4328 		}
4329 	}
4330 
4331 	if (delayprops != NULL) {
4332 		/*
4333 		 * Merge delayed props back in with initial props, in case
4334 		 * we're DEBUG and zfs_ioc_recv_inject_err is set (which means
4335 		 * we have to make sure clear_received_props() includes
4336 		 * the delayed properties).
4337 		 *
4338 		 * Since zfs_ioc_recv_inject_err is only in DEBUG kernels,
4339 		 * using ASSERT() will be just like a VERIFY.
4340 		 */
4341 		ASSERT(nvlist_merge(props, delayprops, 0) == 0);
4342 		nvlist_free(delayprops);
4343 	}
4344 
4345 	/*
4346 	 * Now that all props, initial and delayed, are set, report the prop
4347 	 * errors to the caller.
4348 	 */
4349 	if (zc->zc_nvlist_dst_size != 0 &&
4350 	    (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4351 	    put_nvlist(zc, errors) != 0)) {
4352 		/*
4353 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
4354 		 * size or supplied an invalid address.
4355 		 */
4356 		props_error = SET_ERROR(EINVAL);
4357 	}
4358 
4359 	zc->zc_cookie = off - fp->f_offset;
4360 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4361 		fp->f_offset = off;
4362 
4363 #ifdef	DEBUG
4364 	if (zfs_ioc_recv_inject_err) {
4365 		zfs_ioc_recv_inject_err = B_FALSE;
4366 		error = 1;
4367 	}
4368 #endif
4369 	/*
4370 	 * On error, restore the original props.
4371 	 */
4372 	if (error != 0 && props != NULL && !drc.drc_newfs) {
4373 		if (clear_received_props(tofs, props, NULL) != 0) {
4374 			/*
4375 			 * We failed to clear the received properties.
4376 			 * Since we may have left a $recvd value on the
4377 			 * system, we can't clear the $hasrecvd flag.
4378 			 */
4379 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4380 		} else if (first_recvd_props) {
4381 			dsl_prop_unset_hasrecvd(tofs);
4382 		}
4383 
4384 		if (origprops == NULL && !drc.drc_newfs) {
4385 			/* We failed to stash the original properties. */
4386 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4387 		}
4388 
4389 		/*
4390 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
4391 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4392 		 * explictly if we're restoring local properties cleared in the
4393 		 * first new-style receive.
4394 		 */
4395 		if (origprops != NULL &&
4396 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4397 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4398 		    origprops, NULL) != 0) {
4399 			/*
4400 			 * We stashed the original properties but failed to
4401 			 * restore them.
4402 			 */
4403 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4404 		}
4405 	}
4406 out:
4407 	nvlist_free(props);
4408 	nvlist_free(origprops);
4409 	nvlist_free(errors);
4410 	releasef(fd);
4411 
4412 	if (error == 0)
4413 		error = props_error;
4414 
4415 	return (error);
4416 }
4417 
4418 /*
4419  * inputs:
4420  * zc_name	name of snapshot to send
4421  * zc_cookie	file descriptor to send stream to
4422  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
4423  * zc_sendobj	objsetid of snapshot to send
4424  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
4425  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
4426  *		output size in zc_objset_type.
4427  * zc_flags	lzc_send_flags
4428  *
4429  * outputs:
4430  * zc_objset_type	estimated size, if zc_guid is set
4431  */
4432 static int
4433 zfs_ioc_send(zfs_cmd_t *zc)
4434 {
4435 	int error;
4436 	offset_t off;
4437 	boolean_t estimate = (zc->zc_guid != 0);
4438 	boolean_t embedok = (zc->zc_flags & 0x1);
4439 	boolean_t large_block_ok = (zc->zc_flags & 0x2);
4440 
4441 	if (zc->zc_obj != 0) {
4442 		dsl_pool_t *dp;
4443 		dsl_dataset_t *tosnap;
4444 
4445 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4446 		if (error != 0)
4447 			return (error);
4448 
4449 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4450 		if (error != 0) {
4451 			dsl_pool_rele(dp, FTAG);
4452 			return (error);
4453 		}
4454 
4455 		if (dsl_dir_is_clone(tosnap->ds_dir))
4456 			zc->zc_fromobj =
4457 			    dsl_dir_phys(tosnap->ds_dir)->dd_origin_obj;
4458 		dsl_dataset_rele(tosnap, FTAG);
4459 		dsl_pool_rele(dp, FTAG);
4460 	}
4461 
4462 	if (estimate) {
4463 		dsl_pool_t *dp;
4464 		dsl_dataset_t *tosnap;
4465 		dsl_dataset_t *fromsnap = NULL;
4466 
4467 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4468 		if (error != 0)
4469 			return (error);
4470 
4471 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4472 		if (error != 0) {
4473 			dsl_pool_rele(dp, FTAG);
4474 			return (error);
4475 		}
4476 
4477 		if (zc->zc_fromobj != 0) {
4478 			error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
4479 			    FTAG, &fromsnap);
4480 			if (error != 0) {
4481 				dsl_dataset_rele(tosnap, FTAG);
4482 				dsl_pool_rele(dp, FTAG);
4483 				return (error);
4484 			}
4485 		}
4486 
4487 		error = dmu_send_estimate(tosnap, fromsnap,
4488 		    &zc->zc_objset_type);
4489 
4490 		if (fromsnap != NULL)
4491 			dsl_dataset_rele(fromsnap, FTAG);
4492 		dsl_dataset_rele(tosnap, FTAG);
4493 		dsl_pool_rele(dp, FTAG);
4494 	} else {
4495 		file_t *fp = getf(zc->zc_cookie);
4496 		if (fp == NULL)
4497 			return (SET_ERROR(EBADF));
4498 
4499 		off = fp->f_offset;
4500 		error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
4501 		    zc->zc_fromobj, embedok, large_block_ok,
4502 		    zc->zc_cookie, fp->f_vnode, &off);
4503 
4504 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4505 			fp->f_offset = off;
4506 		releasef(zc->zc_cookie);
4507 	}
4508 	return (error);
4509 }
4510 
4511 /*
4512  * inputs:
4513  * zc_name	name of snapshot on which to report progress
4514  * zc_cookie	file descriptor of send stream
4515  *
4516  * outputs:
4517  * zc_cookie	number of bytes written in send stream thus far
4518  */
4519 static int
4520 zfs_ioc_send_progress(zfs_cmd_t *zc)
4521 {
4522 	dsl_pool_t *dp;
4523 	dsl_dataset_t *ds;
4524 	dmu_sendarg_t *dsp = NULL;
4525 	int error;
4526 
4527 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4528 	if (error != 0)
4529 		return (error);
4530 
4531 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4532 	if (error != 0) {
4533 		dsl_pool_rele(dp, FTAG);
4534 		return (error);
4535 	}
4536 
4537 	mutex_enter(&ds->ds_sendstream_lock);
4538 
4539 	/*
4540 	 * Iterate over all the send streams currently active on this dataset.
4541 	 * If there's one which matches the specified file descriptor _and_ the
4542 	 * stream was started by the current process, return the progress of
4543 	 * that stream.
4544 	 */
4545 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4546 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
4547 		if (dsp->dsa_outfd == zc->zc_cookie &&
4548 		    dsp->dsa_proc == curproc)
4549 			break;
4550 	}
4551 
4552 	if (dsp != NULL)
4553 		zc->zc_cookie = *(dsp->dsa_off);
4554 	else
4555 		error = SET_ERROR(ENOENT);
4556 
4557 	mutex_exit(&ds->ds_sendstream_lock);
4558 	dsl_dataset_rele(ds, FTAG);
4559 	dsl_pool_rele(dp, FTAG);
4560 	return (error);
4561 }
4562 
4563 static int
4564 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4565 {
4566 	int id, error;
4567 
4568 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4569 	    &zc->zc_inject_record);
4570 
4571 	if (error == 0)
4572 		zc->zc_guid = (uint64_t)id;
4573 
4574 	return (error);
4575 }
4576 
4577 static int
4578 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4579 {
4580 	return (zio_clear_fault((int)zc->zc_guid));
4581 }
4582 
4583 static int
4584 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4585 {
4586 	int id = (int)zc->zc_guid;
4587 	int error;
4588 
4589 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4590 	    &zc->zc_inject_record);
4591 
4592 	zc->zc_guid = id;
4593 
4594 	return (error);
4595 }
4596 
4597 static int
4598 zfs_ioc_error_log(zfs_cmd_t *zc)
4599 {
4600 	spa_t *spa;
4601 	int error;
4602 	size_t count = (size_t)zc->zc_nvlist_dst_size;
4603 
4604 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4605 		return (error);
4606 
4607 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4608 	    &count);
4609 	if (error == 0)
4610 		zc->zc_nvlist_dst_size = count;
4611 	else
4612 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4613 
4614 	spa_close(spa, FTAG);
4615 
4616 	return (error);
4617 }
4618 
4619 static int
4620 zfs_ioc_clear(zfs_cmd_t *zc)
4621 {
4622 	spa_t *spa;
4623 	vdev_t *vd;
4624 	int error;
4625 
4626 	/*
4627 	 * On zpool clear we also fix up missing slogs
4628 	 */
4629 	mutex_enter(&spa_namespace_lock);
4630 	spa = spa_lookup(zc->zc_name);
4631 	if (spa == NULL) {
4632 		mutex_exit(&spa_namespace_lock);
4633 		return (SET_ERROR(EIO));
4634 	}
4635 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4636 		/* we need to let spa_open/spa_load clear the chains */
4637 		spa_set_log_state(spa, SPA_LOG_CLEAR);
4638 	}
4639 	spa->spa_last_open_failed = 0;
4640 	mutex_exit(&spa_namespace_lock);
4641 
4642 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4643 		error = spa_open(zc->zc_name, &spa, FTAG);
4644 	} else {
4645 		nvlist_t *policy;
4646 		nvlist_t *config = NULL;
4647 
4648 		if (zc->zc_nvlist_src == NULL)
4649 			return (SET_ERROR(EINVAL));
4650 
4651 		if ((error = get_nvlist(zc->zc_nvlist_src,
4652 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4653 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4654 			    policy, &config);
4655 			if (config != NULL) {
4656 				int err;
4657 
4658 				if ((err = put_nvlist(zc, config)) != 0)
4659 					error = err;
4660 				nvlist_free(config);
4661 			}
4662 			nvlist_free(policy);
4663 		}
4664 	}
4665 
4666 	if (error != 0)
4667 		return (error);
4668 
4669 	spa_vdev_state_enter(spa, SCL_NONE);
4670 
4671 	if (zc->zc_guid == 0) {
4672 		vd = NULL;
4673 	} else {
4674 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4675 		if (vd == NULL) {
4676 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
4677 			spa_close(spa, FTAG);
4678 			return (SET_ERROR(ENODEV));
4679 		}
4680 	}
4681 
4682 	vdev_clear(spa, vd);
4683 
4684 	(void) spa_vdev_state_exit(spa, NULL, 0);
4685 
4686 	/*
4687 	 * Resume any suspended I/Os.
4688 	 */
4689 	if (zio_resume(spa) != 0)
4690 		error = SET_ERROR(EIO);
4691 
4692 	spa_close(spa, FTAG);
4693 
4694 	return (error);
4695 }
4696 
4697 static int
4698 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4699 {
4700 	spa_t *spa;
4701 	int error;
4702 
4703 	error = spa_open(zc->zc_name, &spa, FTAG);
4704 	if (error != 0)
4705 		return (error);
4706 
4707 	spa_vdev_state_enter(spa, SCL_NONE);
4708 
4709 	/*
4710 	 * If a resilver is already in progress then set the
4711 	 * spa_scrub_reopen flag to B_TRUE so that we don't restart
4712 	 * the scan as a side effect of the reopen. Otherwise, let
4713 	 * vdev_open() decided if a resilver is required.
4714 	 */
4715 	spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4716 	vdev_reopen(spa->spa_root_vdev);
4717 	spa->spa_scrub_reopen = B_FALSE;
4718 
4719 	(void) spa_vdev_state_exit(spa, NULL, 0);
4720 	spa_close(spa, FTAG);
4721 	return (0);
4722 }
4723 /*
4724  * inputs:
4725  * zc_name	name of filesystem
4726  * zc_value	name of origin snapshot
4727  *
4728  * outputs:
4729  * zc_string	name of conflicting snapshot, if there is one
4730  */
4731 static int
4732 zfs_ioc_promote(zfs_cmd_t *zc)
4733 {
4734 	char *cp;
4735 
4736 	/*
4737 	 * We don't need to unmount *all* the origin fs's snapshots, but
4738 	 * it's easier.
4739 	 */
4740 	cp = strchr(zc->zc_value, '@');
4741 	if (cp)
4742 		*cp = '\0';
4743 	(void) dmu_objset_find(zc->zc_value,
4744 	    zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
4745 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4746 }
4747 
4748 /*
4749  * Retrieve a single {user|group}{used|quota}@... property.
4750  *
4751  * inputs:
4752  * zc_name	name of filesystem
4753  * zc_objset_type zfs_userquota_prop_t
4754  * zc_value	domain name (eg. "S-1-234-567-89")
4755  * zc_guid	RID/UID/GID
4756  *
4757  * outputs:
4758  * zc_cookie	property value
4759  */
4760 static int
4761 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4762 {
4763 	zfsvfs_t *zfsvfs;
4764 	int error;
4765 
4766 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4767 		return (SET_ERROR(EINVAL));
4768 
4769 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4770 	if (error != 0)
4771 		return (error);
4772 
4773 	error = zfs_userspace_one(zfsvfs,
4774 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4775 	zfsvfs_rele(zfsvfs, FTAG);
4776 
4777 	return (error);
4778 }
4779 
4780 /*
4781  * inputs:
4782  * zc_name		name of filesystem
4783  * zc_cookie		zap cursor
4784  * zc_objset_type	zfs_userquota_prop_t
4785  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4786  *
4787  * outputs:
4788  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
4789  * zc_cookie	zap cursor
4790  */
4791 static int
4792 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4793 {
4794 	zfsvfs_t *zfsvfs;
4795 	int bufsize = zc->zc_nvlist_dst_size;
4796 
4797 	if (bufsize <= 0)
4798 		return (SET_ERROR(ENOMEM));
4799 
4800 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4801 	if (error != 0)
4802 		return (error);
4803 
4804 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
4805 
4806 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4807 	    buf, &zc->zc_nvlist_dst_size);
4808 
4809 	if (error == 0) {
4810 		error = xcopyout(buf,
4811 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
4812 		    zc->zc_nvlist_dst_size);
4813 	}
4814 	kmem_free(buf, bufsize);
4815 	zfsvfs_rele(zfsvfs, FTAG);
4816 
4817 	return (error);
4818 }
4819 
4820 /*
4821  * inputs:
4822  * zc_name		name of filesystem
4823  *
4824  * outputs:
4825  * none
4826  */
4827 static int
4828 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4829 {
4830 	objset_t *os;
4831 	int error = 0;
4832 	zfsvfs_t *zfsvfs;
4833 
4834 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4835 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4836 			/*
4837 			 * If userused is not enabled, it may be because the
4838 			 * objset needs to be closed & reopened (to grow the
4839 			 * objset_phys_t).  Suspend/resume the fs will do that.
4840 			 */
4841 			error = zfs_suspend_fs(zfsvfs);
4842 			if (error == 0) {
4843 				dmu_objset_refresh_ownership(zfsvfs->z_os,
4844 				    zfsvfs);
4845 				error = zfs_resume_fs(zfsvfs, zc->zc_name);
4846 			}
4847 		}
4848 		if (error == 0)
4849 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4850 		VFS_RELE(zfsvfs->z_vfs);
4851 	} else {
4852 		/* XXX kind of reading contents without owning */
4853 		error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4854 		if (error != 0)
4855 			return (error);
4856 
4857 		error = dmu_objset_userspace_upgrade(os);
4858 		dmu_objset_rele(os, FTAG);
4859 	}
4860 
4861 	return (error);
4862 }
4863 
4864 /*
4865  * We don't want to have a hard dependency
4866  * against some special symbols in sharefs
4867  * nfs, and smbsrv.  Determine them if needed when
4868  * the first file system is shared.
4869  * Neither sharefs, nfs or smbsrv are unloadable modules.
4870  */
4871 int (*znfsexport_fs)(void *arg);
4872 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4873 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4874 
4875 int zfs_nfsshare_inited;
4876 int zfs_smbshare_inited;
4877 
4878 ddi_modhandle_t nfs_mod;
4879 ddi_modhandle_t sharefs_mod;
4880 ddi_modhandle_t smbsrv_mod;
4881 kmutex_t zfs_share_lock;
4882 
4883 static int
4884 zfs_init_sharefs()
4885 {
4886 	int error;
4887 
4888 	ASSERT(MUTEX_HELD(&zfs_share_lock));
4889 	/* Both NFS and SMB shares also require sharetab support. */
4890 	if (sharefs_mod == NULL && ((sharefs_mod =
4891 	    ddi_modopen("fs/sharefs",
4892 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
4893 		return (SET_ERROR(ENOSYS));
4894 	}
4895 	if (zshare_fs == NULL && ((zshare_fs =
4896 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4897 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4898 		return (SET_ERROR(ENOSYS));
4899 	}
4900 	return (0);
4901 }
4902 
4903 static int
4904 zfs_ioc_share(zfs_cmd_t *zc)
4905 {
4906 	int error;
4907 	int opcode;
4908 
4909 	switch (zc->zc_share.z_sharetype) {
4910 	case ZFS_SHARE_NFS:
4911 	case ZFS_UNSHARE_NFS:
4912 		if (zfs_nfsshare_inited == 0) {
4913 			mutex_enter(&zfs_share_lock);
4914 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4915 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4916 				mutex_exit(&zfs_share_lock);
4917 				return (SET_ERROR(ENOSYS));
4918 			}
4919 			if (znfsexport_fs == NULL &&
4920 			    ((znfsexport_fs = (int (*)(void *))
4921 			    ddi_modsym(nfs_mod,
4922 			    "nfs_export", &error)) == NULL)) {
4923 				mutex_exit(&zfs_share_lock);
4924 				return (SET_ERROR(ENOSYS));
4925 			}
4926 			error = zfs_init_sharefs();
4927 			if (error != 0) {
4928 				mutex_exit(&zfs_share_lock);
4929 				return (SET_ERROR(ENOSYS));
4930 			}
4931 			zfs_nfsshare_inited = 1;
4932 			mutex_exit(&zfs_share_lock);
4933 		}
4934 		break;
4935 	case ZFS_SHARE_SMB:
4936 	case ZFS_UNSHARE_SMB:
4937 		if (zfs_smbshare_inited == 0) {
4938 			mutex_enter(&zfs_share_lock);
4939 			if (smbsrv_mod == NULL && ((smbsrv_mod =
4940 			    ddi_modopen("drv/smbsrv",
4941 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4942 				mutex_exit(&zfs_share_lock);
4943 				return (SET_ERROR(ENOSYS));
4944 			}
4945 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4946 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4947 			    "smb_server_share", &error)) == NULL)) {
4948 				mutex_exit(&zfs_share_lock);
4949 				return (SET_ERROR(ENOSYS));
4950 			}
4951 			error = zfs_init_sharefs();
4952 			if (error != 0) {
4953 				mutex_exit(&zfs_share_lock);
4954 				return (SET_ERROR(ENOSYS));
4955 			}
4956 			zfs_smbshare_inited = 1;
4957 			mutex_exit(&zfs_share_lock);
4958 		}
4959 		break;
4960 	default:
4961 		return (SET_ERROR(EINVAL));
4962 	}
4963 
4964 	switch (zc->zc_share.z_sharetype) {
4965 	case ZFS_SHARE_NFS:
4966 	case ZFS_UNSHARE_NFS:
4967 		if (error =
4968 		    znfsexport_fs((void *)
4969 		    (uintptr_t)zc->zc_share.z_exportdata))
4970 			return (error);
4971 		break;
4972 	case ZFS_SHARE_SMB:
4973 	case ZFS_UNSHARE_SMB:
4974 		if (error = zsmbexport_fs((void *)
4975 		    (uintptr_t)zc->zc_share.z_exportdata,
4976 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
4977 		    B_TRUE: B_FALSE)) {
4978 			return (error);
4979 		}
4980 		break;
4981 	}
4982 
4983 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
4984 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
4985 	    SHAREFS_ADD : SHAREFS_REMOVE;
4986 
4987 	/*
4988 	 * Add or remove share from sharetab
4989 	 */
4990 	error = zshare_fs(opcode,
4991 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
4992 	    zc->zc_share.z_sharemax);
4993 
4994 	return (error);
4995 
4996 }
4997 
4998 ace_t full_access[] = {
4999 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
5000 };
5001 
5002 /*
5003  * inputs:
5004  * zc_name		name of containing filesystem
5005  * zc_obj		object # beyond which we want next in-use object #
5006  *
5007  * outputs:
5008  * zc_obj		next in-use object #
5009  */
5010 static int
5011 zfs_ioc_next_obj(zfs_cmd_t *zc)
5012 {
5013 	objset_t *os = NULL;
5014 	int error;
5015 
5016 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
5017 	if (error != 0)
5018 		return (error);
5019 
5020 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
5021 	    dsl_dataset_phys(os->os_dsl_dataset)->ds_prev_snap_txg);
5022 
5023 	dmu_objset_rele(os, FTAG);
5024 	return (error);
5025 }
5026 
5027 /*
5028  * inputs:
5029  * zc_name		name of filesystem
5030  * zc_value		prefix name for snapshot
5031  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
5032  *
5033  * outputs:
5034  * zc_value		short name of new snapshot
5035  */
5036 static int
5037 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
5038 {
5039 	char *snap_name;
5040 	char *hold_name;
5041 	int error;
5042 	minor_t minor;
5043 
5044 	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
5045 	if (error != 0)
5046 		return (error);
5047 
5048 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
5049 	    (u_longlong_t)ddi_get_lbolt64());
5050 	hold_name = kmem_asprintf("%%%s", zc->zc_value);
5051 
5052 	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
5053 	    hold_name);
5054 	if (error == 0)
5055 		(void) strcpy(zc->zc_value, snap_name);
5056 	strfree(snap_name);
5057 	strfree(hold_name);
5058 	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
5059 	return (error);
5060 }
5061 
5062 /*
5063  * inputs:
5064  * zc_name		name of "to" snapshot
5065  * zc_value		name of "from" snapshot
5066  * zc_cookie		file descriptor to write diff data on
5067  *
5068  * outputs:
5069  * dmu_diff_record_t's to the file descriptor
5070  */
5071 static int
5072 zfs_ioc_diff(zfs_cmd_t *zc)
5073 {
5074 	file_t *fp;
5075 	offset_t off;
5076 	int error;
5077 
5078 	fp = getf(zc->zc_cookie);
5079 	if (fp == NULL)
5080 		return (SET_ERROR(EBADF));
5081 
5082 	off = fp->f_offset;
5083 
5084 	error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
5085 
5086 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5087 		fp->f_offset = off;
5088 	releasef(zc->zc_cookie);
5089 
5090 	return (error);
5091 }
5092 
5093 /*
5094  * Remove all ACL files in shares dir
5095  */
5096 static int
5097 zfs_smb_acl_purge(znode_t *dzp)
5098 {
5099 	zap_cursor_t	zc;
5100 	zap_attribute_t	zap;
5101 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
5102 	int error;
5103 
5104 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
5105 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
5106 	    zap_cursor_advance(&zc)) {
5107 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
5108 		    NULL, 0)) != 0)
5109 			break;
5110 	}
5111 	zap_cursor_fini(&zc);
5112 	return (error);
5113 }
5114 
5115 static int
5116 zfs_ioc_smb_acl(zfs_cmd_t *zc)
5117 {
5118 	vnode_t *vp;
5119 	znode_t *dzp;
5120 	vnode_t *resourcevp = NULL;
5121 	znode_t *sharedir;
5122 	zfsvfs_t *zfsvfs;
5123 	nvlist_t *nvlist;
5124 	char *src, *target;
5125 	vattr_t vattr;
5126 	vsecattr_t vsec;
5127 	int error = 0;
5128 
5129 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
5130 	    NO_FOLLOW, NULL, &vp)) != 0)
5131 		return (error);
5132 
5133 	/* Now make sure mntpnt and dataset are ZFS */
5134 
5135 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
5136 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
5137 	    zc->zc_name) != 0)) {
5138 		VN_RELE(vp);
5139 		return (SET_ERROR(EINVAL));
5140 	}
5141 
5142 	dzp = VTOZ(vp);
5143 	zfsvfs = dzp->z_zfsvfs;
5144 	ZFS_ENTER(zfsvfs);
5145 
5146 	/*
5147 	 * Create share dir if its missing.
5148 	 */
5149 	mutex_enter(&zfsvfs->z_lock);
5150 	if (zfsvfs->z_shares_dir == 0) {
5151 		dmu_tx_t *tx;
5152 
5153 		tx = dmu_tx_create(zfsvfs->z_os);
5154 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
5155 		    ZFS_SHARES_DIR);
5156 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
5157 		error = dmu_tx_assign(tx, TXG_WAIT);
5158 		if (error != 0) {
5159 			dmu_tx_abort(tx);
5160 		} else {
5161 			error = zfs_create_share_dir(zfsvfs, tx);
5162 			dmu_tx_commit(tx);
5163 		}
5164 		if (error != 0) {
5165 			mutex_exit(&zfsvfs->z_lock);
5166 			VN_RELE(vp);
5167 			ZFS_EXIT(zfsvfs);
5168 			return (error);
5169 		}
5170 	}
5171 	mutex_exit(&zfsvfs->z_lock);
5172 
5173 	ASSERT(zfsvfs->z_shares_dir);
5174 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
5175 		VN_RELE(vp);
5176 		ZFS_EXIT(zfsvfs);
5177 		return (error);
5178 	}
5179 
5180 	switch (zc->zc_cookie) {
5181 	case ZFS_SMB_ACL_ADD:
5182 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
5183 		vattr.va_type = VREG;
5184 		vattr.va_mode = S_IFREG|0777;
5185 		vattr.va_uid = 0;
5186 		vattr.va_gid = 0;
5187 
5188 		vsec.vsa_mask = VSA_ACE;
5189 		vsec.vsa_aclentp = &full_access;
5190 		vsec.vsa_aclentsz = sizeof (full_access);
5191 		vsec.vsa_aclcnt = 1;
5192 
5193 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
5194 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
5195 		if (resourcevp)
5196 			VN_RELE(resourcevp);
5197 		break;
5198 
5199 	case ZFS_SMB_ACL_REMOVE:
5200 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
5201 		    NULL, 0);
5202 		break;
5203 
5204 	case ZFS_SMB_ACL_RENAME:
5205 		if ((error = get_nvlist(zc->zc_nvlist_src,
5206 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
5207 			VN_RELE(vp);
5208 			VN_RELE(ZTOV(sharedir));
5209 			ZFS_EXIT(zfsvfs);
5210 			return (error);
5211 		}
5212 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
5213 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
5214 		    &target)) {
5215 			VN_RELE(vp);
5216 			VN_RELE(ZTOV(sharedir));
5217 			ZFS_EXIT(zfsvfs);
5218 			nvlist_free(nvlist);
5219 			return (error);
5220 		}
5221 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
5222 		    kcred, NULL, 0);
5223 		nvlist_free(nvlist);
5224 		break;
5225 
5226 	case ZFS_SMB_ACL_PURGE:
5227 		error = zfs_smb_acl_purge(sharedir);
5228 		break;
5229 
5230 	default:
5231 		error = SET_ERROR(EINVAL);
5232 		break;
5233 	}
5234 
5235 	VN_RELE(vp);
5236 	VN_RELE(ZTOV(sharedir));
5237 
5238 	ZFS_EXIT(zfsvfs);
5239 
5240 	return (error);
5241 }
5242 
5243 /*
5244  * innvl: {
5245  *     "holds" -> { snapname -> holdname (string), ... }
5246  *     (optional) "cleanup_fd" -> fd (int32)
5247  * }
5248  *
5249  * outnvl: {
5250  *     snapname -> error value (int32)
5251  *     ...
5252  * }
5253  */
5254 /* ARGSUSED */
5255 static int
5256 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
5257 {
5258 	nvpair_t *pair;
5259 	nvlist_t *holds;
5260 	int cleanup_fd = -1;
5261 	int error;
5262 	minor_t minor = 0;
5263 
5264 	error = nvlist_lookup_nvlist(args, "holds", &holds);
5265 	if (error != 0)
5266 		return (SET_ERROR(EINVAL));
5267 
5268 	/* make sure the user didn't pass us any invalid (empty) tags */
5269 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
5270 	    pair = nvlist_next_nvpair(holds, pair)) {
5271 		char *htag;
5272 
5273 		error = nvpair_value_string(pair, &htag);
5274 		if (error != 0)
5275 			return (SET_ERROR(error));
5276 
5277 		if (strlen(htag) == 0)
5278 			return (SET_ERROR(EINVAL));
5279 	}
5280 
5281 	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
5282 		error = zfs_onexit_fd_hold(cleanup_fd, &minor);
5283 		if (error != 0)
5284 			return (error);
5285 	}
5286 
5287 	error = dsl_dataset_user_hold(holds, minor, errlist);
5288 	if (minor != 0)
5289 		zfs_onexit_fd_rele(cleanup_fd);
5290 	return (error);
5291 }
5292 
5293 /*
5294  * innvl is not used.
5295  *
5296  * outnvl: {
5297  *    holdname -> time added (uint64 seconds since epoch)
5298  *    ...
5299  * }
5300  */
5301 /* ARGSUSED */
5302 static int
5303 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
5304 {
5305 	return (dsl_dataset_get_holds(snapname, outnvl));
5306 }
5307 
5308 /*
5309  * innvl: {
5310  *     snapname -> { holdname, ... }
5311  *     ...
5312  * }
5313  *
5314  * outnvl: {
5315  *     snapname -> error value (int32)
5316  *     ...
5317  * }
5318  */
5319 /* ARGSUSED */
5320 static int
5321 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
5322 {
5323 	return (dsl_dataset_user_release(holds, errlist));
5324 }
5325 
5326 /*
5327  * inputs:
5328  * zc_name		name of new filesystem or snapshot
5329  * zc_value		full name of old snapshot
5330  *
5331  * outputs:
5332  * zc_cookie		space in bytes
5333  * zc_objset_type	compressed space in bytes
5334  * zc_perm_action	uncompressed space in bytes
5335  */
5336 static int
5337 zfs_ioc_space_written(zfs_cmd_t *zc)
5338 {
5339 	int error;
5340 	dsl_pool_t *dp;
5341 	dsl_dataset_t *new, *old;
5342 
5343 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5344 	if (error != 0)
5345 		return (error);
5346 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
5347 	if (error != 0) {
5348 		dsl_pool_rele(dp, FTAG);
5349 		return (error);
5350 	}
5351 	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
5352 	if (error != 0) {
5353 		dsl_dataset_rele(new, FTAG);
5354 		dsl_pool_rele(dp, FTAG);
5355 		return (error);
5356 	}
5357 
5358 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5359 	    &zc->zc_objset_type, &zc->zc_perm_action);
5360 	dsl_dataset_rele(old, FTAG);
5361 	dsl_dataset_rele(new, FTAG);
5362 	dsl_pool_rele(dp, FTAG);
5363 	return (error);
5364 }
5365 
5366 /*
5367  * innvl: {
5368  *     "firstsnap" -> snapshot name
5369  * }
5370  *
5371  * outnvl: {
5372  *     "used" -> space in bytes
5373  *     "compressed" -> compressed space in bytes
5374  *     "uncompressed" -> uncompressed space in bytes
5375  * }
5376  */
5377 static int
5378 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5379 {
5380 	int error;
5381 	dsl_pool_t *dp;
5382 	dsl_dataset_t *new, *old;
5383 	char *firstsnap;
5384 	uint64_t used, comp, uncomp;
5385 
5386 	if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5387 		return (SET_ERROR(EINVAL));
5388 
5389 	error = dsl_pool_hold(lastsnap, FTAG, &dp);
5390 	if (error != 0)
5391 		return (error);
5392 
5393 	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
5394 	if (error == 0 && !new->ds_is_snapshot) {
5395 		dsl_dataset_rele(new, FTAG);
5396 		error = SET_ERROR(EINVAL);
5397 	}
5398 	if (error != 0) {
5399 		dsl_pool_rele(dp, FTAG);
5400 		return (error);
5401 	}
5402 	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
5403 	if (error == 0 && !old->ds_is_snapshot) {
5404 		dsl_dataset_rele(old, FTAG);
5405 		error = SET_ERROR(EINVAL);
5406 	}
5407 	if (error != 0) {
5408 		dsl_dataset_rele(new, FTAG);
5409 		dsl_pool_rele(dp, FTAG);
5410 		return (error);
5411 	}
5412 
5413 	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5414 	dsl_dataset_rele(old, FTAG);
5415 	dsl_dataset_rele(new, FTAG);
5416 	dsl_pool_rele(dp, FTAG);
5417 	fnvlist_add_uint64(outnvl, "used", used);
5418 	fnvlist_add_uint64(outnvl, "compressed", comp);
5419 	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5420 	return (error);
5421 }
5422 
5423 /*
5424  * innvl: {
5425  *     "fd" -> file descriptor to write stream to (int32)
5426  *     (optional) "fromsnap" -> full snap name to send an incremental from
5427  *     (optional) "largeblockok" -> (value ignored)
5428  *         indicates that blocks > 128KB are permitted
5429  *     (optional) "embedok" -> (value ignored)
5430  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
5431  *     (optional) "resume_object" and "resume_offset" -> (uint64)
5432  *         if present, resume send stream from specified object and offset.
5433  * }
5434  *
5435  * outnvl is unused
5436  */
5437 /* ARGSUSED */
5438 static int
5439 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5440 {
5441 	int error;
5442 	offset_t off;
5443 	char *fromname = NULL;
5444 	int fd;
5445 	boolean_t largeblockok;
5446 	boolean_t embedok;
5447 	uint64_t resumeobj = 0;
5448 	uint64_t resumeoff = 0;
5449 
5450 	error = nvlist_lookup_int32(innvl, "fd", &fd);
5451 	if (error != 0)
5452 		return (SET_ERROR(EINVAL));
5453 
5454 	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
5455 
5456 	largeblockok = nvlist_exists(innvl, "largeblockok");
5457 	embedok = nvlist_exists(innvl, "embedok");
5458 
5459 	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
5460 	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
5461 
5462 	file_t *fp = getf(fd);
5463 	if (fp == NULL)
5464 		return (SET_ERROR(EBADF));
5465 
5466 	off = fp->f_offset;
5467 	error = dmu_send(snapname, fromname, embedok, largeblockok, fd,
5468 	    resumeobj, resumeoff, fp->f_vnode, &off);
5469 
5470 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5471 		fp->f_offset = off;
5472 	releasef(fd);
5473 	return (error);
5474 }
5475 
5476 /*
5477  * Determine approximately how large a zfs send stream will be -- the number
5478  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5479  *
5480  * innvl: {
5481  *     (optional) "from" -> full snap or bookmark name to send an incremental
5482  *                          from
5483  * }
5484  *
5485  * outnvl: {
5486  *     "space" -> bytes of space (uint64)
5487  * }
5488  */
5489 static int
5490 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5491 {
5492 	dsl_pool_t *dp;
5493 	dsl_dataset_t *tosnap;
5494 	int error;
5495 	char *fromname;
5496 	uint64_t space;
5497 
5498 	error = dsl_pool_hold(snapname, FTAG, &dp);
5499 	if (error != 0)
5500 		return (error);
5501 
5502 	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
5503 	if (error != 0) {
5504 		dsl_pool_rele(dp, FTAG);
5505 		return (error);
5506 	}
5507 
5508 	error = nvlist_lookup_string(innvl, "from", &fromname);
5509 	if (error == 0) {
5510 		if (strchr(fromname, '@') != NULL) {
5511 			/*
5512 			 * If from is a snapshot, hold it and use the more
5513 			 * efficient dmu_send_estimate to estimate send space
5514 			 * size using deadlists.
5515 			 */
5516 			dsl_dataset_t *fromsnap;
5517 			error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
5518 			if (error != 0)
5519 				goto out;
5520 			error = dmu_send_estimate(tosnap, fromsnap, &space);
5521 			dsl_dataset_rele(fromsnap, FTAG);
5522 		} else if (strchr(fromname, '#') != NULL) {
5523 			/*
5524 			 * If from is a bookmark, fetch the creation TXG of the
5525 			 * snapshot it was created from and use that to find
5526 			 * blocks that were born after it.
5527 			 */
5528 			zfs_bookmark_phys_t frombm;
5529 
5530 			error = dsl_bookmark_lookup(dp, fromname, tosnap,
5531 			    &frombm);
5532 			if (error != 0)
5533 				goto out;
5534 			error = dmu_send_estimate_from_txg(tosnap,
5535 			    frombm.zbm_creation_txg, &space);
5536 		} else {
5537 			/*
5538 			 * from is not properly formatted as a snapshot or
5539 			 * bookmark
5540 			 */
5541 			error = SET_ERROR(EINVAL);
5542 			goto out;
5543 		}
5544 	} else {
5545 		// If estimating the size of a full send, use dmu_send_estimate
5546 		error = dmu_send_estimate(tosnap, NULL, &space);
5547 	}
5548 
5549 	fnvlist_add_uint64(outnvl, "space", space);
5550 
5551 out:
5552 	dsl_dataset_rele(tosnap, FTAG);
5553 	dsl_pool_rele(dp, FTAG);
5554 	return (error);
5555 }
5556 
5557 static int
5558 zfs_ioc_set_zev_callbacks(const char *unused, nvlist_t *innvl,
5559     nvlist_t *outnvl)
5560 {
5561 	int error;
5562 	uint64_t cb_addr;
5563 	/*
5564 	 * Our secpolicy for this op makes sure it's called in
5565 	 * kernel context, and that no other callbacks have
5566 	 * been registered, yet.
5567 	 */
5568 	error = nvlist_lookup_uint64(innvl, "callbacks", &cb_addr);
5569 	if (error != 0) {
5570 		cmn_err(CE_WARN, "set_zev_callbacks nvlist lookup failed (%d)",
5571 		    error);
5572 		return (error);
5573 	}
5574 	/* cb_addr is always a kernel memory address */
5575 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5576 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
5577 		rw_exit(&rz_zev_rwlock);
5578 		return (EBUSY);
5579 	}
5580 	rz_zev_callbacks = (void *)(uintptr_t)cb_addr;
5581 	rw_exit(&rz_zev_rwlock);
5582 	return (0);
5583 }
5584 
5585 static int
5586 zfs_ioc_unset_zev_callbacks(const char *unused, nvlist_t *innvl,
5587     nvlist_t *outnvl)
5588 {
5589 	/*
5590 	 * Our secpolicy for this op makes sure it's called in
5591 	 * kernel context.
5592 	 */
5593 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5594 	rz_zev_callbacks = rz_zev_default_callbacks;
5595 	rw_exit(&rz_zev_rwlock);
5596 	/* after mutex release, no thread is using the old table anymore. */
5597 	return (0);
5598 }
5599 
5600 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5601 
5602 static void
5603 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5604     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5605     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5606 {
5607 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5608 
5609 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5610 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5611 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5612 	ASSERT3P(vec->zvec_func, ==, NULL);
5613 
5614 	vec->zvec_legacy_func = func;
5615 	vec->zvec_secpolicy = secpolicy;
5616 	vec->zvec_namecheck = namecheck;
5617 	vec->zvec_allow_log = log_history;
5618 	vec->zvec_pool_check = pool_check;
5619 }
5620 
5621 /*
5622  * See the block comment at the beginning of this file for details on
5623  * each argument to this function.
5624  */
5625 static void
5626 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5627     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5628     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5629     boolean_t allow_log)
5630 {
5631 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5632 
5633 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5634 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5635 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5636 	ASSERT3P(vec->zvec_func, ==, NULL);
5637 
5638 	/* if we are logging, the name must be valid */
5639 	ASSERT(!allow_log || namecheck != NO_NAME);
5640 
5641 	vec->zvec_name = name;
5642 	vec->zvec_func = func;
5643 	vec->zvec_secpolicy = secpolicy;
5644 	vec->zvec_namecheck = namecheck;
5645 	vec->zvec_pool_check = pool_check;
5646 	vec->zvec_smush_outnvlist = smush_outnvlist;
5647 	vec->zvec_allow_log = allow_log;
5648 }
5649 
5650 static void
5651 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5652     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5653     zfs_ioc_poolcheck_t pool_check)
5654 {
5655 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5656 	    POOL_NAME, log_history, pool_check);
5657 }
5658 
5659 static void
5660 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5661     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5662 {
5663 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5664 	    DATASET_NAME, B_FALSE, pool_check);
5665 }
5666 
5667 static void
5668 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5669 {
5670 	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5671 	    POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5672 }
5673 
5674 static void
5675 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5676     zfs_secpolicy_func_t *secpolicy)
5677 {
5678 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5679 	    NO_NAME, B_FALSE, POOL_CHECK_NONE);
5680 }
5681 
5682 static void
5683 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5684     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5685 {
5686 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5687 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5688 }
5689 
5690 static void
5691 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5692 {
5693 	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5694 	    zfs_secpolicy_read);
5695 }
5696 
5697 static void
5698 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5699     zfs_secpolicy_func_t *secpolicy)
5700 {
5701 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5702 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5703 }
5704 
5705 static void
5706 zfs_ioctl_init(void)
5707 {
5708 	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5709 	    zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5710 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5711 
5712 	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5713 	    zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5714 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5715 
5716 	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5717 	    zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5718 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5719 
5720 	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5721 	    zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5722 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5723 
5724 	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5725 	    zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5726 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5727 
5728 	zfs_ioctl_register("create", ZFS_IOC_CREATE,
5729 	    zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5730 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5731 
5732 	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5733 	    zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5734 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5735 
5736 	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5737 	    zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5738 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5739 
5740 	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
5741 	    zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
5742 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5743 	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
5744 	    zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
5745 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5746 
5747 	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
5748 	    zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
5749 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5750 
5751 	zfs_ioctl_register("set_zev_callbacks", ZFS_IOC_SET_ZEV_CALLBACKS,
5752 	    zfs_ioc_set_zev_callbacks, zfs_secpolicy_set_zev_callbacks, NO_NAME,
5753 	    POOL_CHECK_NONE, B_TRUE, B_FALSE);
5754 
5755 	zfs_ioctl_register("unset_zev_callbacks", ZFS_IOC_UNSET_ZEV_CALLBACKS,
5756 	    zfs_ioc_unset_zev_callbacks, zfs_secpolicy_unset_zev_callbacks,
5757 	    NO_NAME, POOL_CHECK_NONE, B_TRUE, B_FALSE);
5758 	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
5759 	    zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
5760 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE);
5761 
5762 	zfs_ioctl_register("bookmark", ZFS_IOC_BOOKMARK,
5763 	    zfs_ioc_bookmark, zfs_secpolicy_bookmark, POOL_NAME,
5764 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5765 
5766 	zfs_ioctl_register("get_bookmarks", ZFS_IOC_GET_BOOKMARKS,
5767 	    zfs_ioc_get_bookmarks, zfs_secpolicy_read, DATASET_NAME,
5768 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5769 
5770 	zfs_ioctl_register("destroy_bookmarks", ZFS_IOC_DESTROY_BOOKMARKS,
5771 	    zfs_ioc_destroy_bookmarks, zfs_secpolicy_destroy_bookmarks,
5772 	    POOL_NAME,
5773 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5774 
5775 	/* IOCTLS that use the legacy function signature */
5776 
5777 	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5778 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5779 
5780 	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5781 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5782 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5783 	    zfs_ioc_pool_scan);
5784 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5785 	    zfs_ioc_pool_upgrade);
5786 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5787 	    zfs_ioc_vdev_add);
5788 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5789 	    zfs_ioc_vdev_remove);
5790 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5791 	    zfs_ioc_vdev_set_state);
5792 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5793 	    zfs_ioc_vdev_attach);
5794 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5795 	    zfs_ioc_vdev_detach);
5796 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5797 	    zfs_ioc_vdev_setpath);
5798 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5799 	    zfs_ioc_vdev_setfru);
5800 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5801 	    zfs_ioc_pool_set_props);
5802 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5803 	    zfs_ioc_vdev_split);
5804 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5805 	    zfs_ioc_pool_reguid);
5806 
5807 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5808 	    zfs_ioc_pool_configs, zfs_secpolicy_none);
5809 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5810 	    zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5811 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5812 	    zfs_ioc_inject_fault, zfs_secpolicy_inject);
5813 	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5814 	    zfs_ioc_clear_fault, zfs_secpolicy_inject);
5815 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5816 	    zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5817 
5818 	/*
5819 	 * pool destroy, and export don't log the history as part of
5820 	 * zfsdev_ioctl, but rather zfs_ioc_pool_export
5821 	 * does the logging of those commands.
5822 	 */
5823 	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5824 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5825 	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5826 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5827 
5828 	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5829 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5830 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5831 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5832 
5833 	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5834 	    zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5835 	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5836 	    zfs_ioc_dsobj_to_dsname,
5837 	    zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5838 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5839 	    zfs_ioc_pool_get_history,
5840 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5841 
5842 	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5843 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5844 
5845 	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5846 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5847 	zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5848 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5849 
5850 	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5851 	    zfs_ioc_space_written);
5852 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5853 	    zfs_ioc_objset_recvd_props);
5854 	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5855 	    zfs_ioc_next_obj);
5856 	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5857 	    zfs_ioc_get_fsacl);
5858 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5859 	    zfs_ioc_objset_stats);
5860 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5861 	    zfs_ioc_objset_zplprops);
5862 	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5863 	    zfs_ioc_dataset_list_next);
5864 	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5865 	    zfs_ioc_snapshot_list_next);
5866 	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5867 	    zfs_ioc_send_progress);
5868 
5869 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5870 	    zfs_ioc_diff, zfs_secpolicy_diff);
5871 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5872 	    zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5873 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5874 	    zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5875 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5876 	    zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5877 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5878 	    zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5879 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5880 	    zfs_ioc_send, zfs_secpolicy_send);
5881 
5882 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5883 	    zfs_secpolicy_none);
5884 	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5885 	    zfs_secpolicy_destroy);
5886 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5887 	    zfs_secpolicy_rename);
5888 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5889 	    zfs_secpolicy_recv);
5890 	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5891 	    zfs_secpolicy_promote);
5892 	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5893 	    zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5894 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5895 	    zfs_secpolicy_set_fsacl);
5896 
5897 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5898 	    zfs_secpolicy_share, POOL_CHECK_NONE);
5899 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5900 	    zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5901 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5902 	    zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5903 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5904 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5905 	    zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5906 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5907 }
5908 
5909 int
5910 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5911     zfs_ioc_poolcheck_t check)
5912 {
5913 	spa_t *spa;
5914 	int error;
5915 
5916 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
5917 
5918 	if (check & POOL_CHECK_NONE)
5919 		return (0);
5920 
5921 	error = spa_open(name, &spa, FTAG);
5922 	if (error == 0) {
5923 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5924 			error = SET_ERROR(EAGAIN);
5925 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5926 			error = SET_ERROR(EROFS);
5927 		spa_close(spa, FTAG);
5928 	}
5929 	return (error);
5930 }
5931 
5932 /*
5933  * Find a free minor number.
5934  */
5935 minor_t
5936 zfsdev_minor_alloc(void)
5937 {
5938 	static minor_t last_minor;
5939 	minor_t m;
5940 
5941 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5942 
5943 	for (m = last_minor + 1; m != last_minor; m++) {
5944 		if (m > ZFSDEV_MAX_MINOR)
5945 			m = 1;
5946 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5947 			last_minor = m;
5948 			return (m);
5949 		}
5950 	}
5951 
5952 	return (0);
5953 }
5954 
5955 static int
5956 zfs_ctldev_init(dev_t *devp)
5957 {
5958 	minor_t minor;
5959 	zfs_soft_state_t *zs;
5960 
5961 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5962 	ASSERT(getminor(*devp) == 0);
5963 
5964 	minor = zfsdev_minor_alloc();
5965 	if (minor == 0)
5966 		return (SET_ERROR(ENXIO));
5967 
5968 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5969 		return (SET_ERROR(EAGAIN));
5970 
5971 	*devp = makedevice(getemajor(*devp), minor);
5972 
5973 	zs = ddi_get_soft_state(zfsdev_state, minor);
5974 	zs->zss_type = ZSST_CTLDEV;
5975 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
5976 
5977 	return (0);
5978 }
5979 
5980 static void
5981 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
5982 {
5983 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5984 
5985 	zfs_onexit_destroy(zo);
5986 	ddi_soft_state_free(zfsdev_state, minor);
5987 }
5988 
5989 void *
5990 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
5991 {
5992 	zfs_soft_state_t *zp;
5993 
5994 	zp = ddi_get_soft_state(zfsdev_state, minor);
5995 	if (zp == NULL || zp->zss_type != which)
5996 		return (NULL);
5997 
5998 	return (zp->zss_data);
5999 }
6000 
6001 static int
6002 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
6003 {
6004 	int error = 0;
6005 
6006 	if (getminor(*devp) != 0)
6007 		return (zvol_open(devp, flag, otyp, cr));
6008 
6009 	/* This is the control device. Allocate a new minor if requested. */
6010 	if (flag & FEXCL) {
6011 		mutex_enter(&zfsdev_state_lock);
6012 		error = zfs_ctldev_init(devp);
6013 		mutex_exit(&zfsdev_state_lock);
6014 	}
6015 
6016 	return (error);
6017 }
6018 
6019 static int
6020 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
6021 {
6022 	zfs_onexit_t *zo;
6023 	minor_t minor = getminor(dev);
6024 
6025 	if (minor == 0)
6026 		return (0);
6027 
6028 	mutex_enter(&zfsdev_state_lock);
6029 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
6030 	if (zo == NULL) {
6031 		mutex_exit(&zfsdev_state_lock);
6032 		return (zvol_close(dev, flag, otyp, cr));
6033 	}
6034 	zfs_ctldev_destroy(zo, minor);
6035 	mutex_exit(&zfsdev_state_lock);
6036 
6037 	return (0);
6038 }
6039 
6040 static int
6041 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
6042 {
6043 	zfs_cmd_t *zc;
6044 	uint_t vecnum;
6045 	int error, rc, len;
6046 	minor_t minor = getminor(dev);
6047 	const zfs_ioc_vec_t *vec;
6048 	char *saved_poolname = NULL;
6049 	nvlist_t *innvl = NULL;
6050 
6051 	if (minor != 0 &&
6052 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
6053 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
6054 
6055 	vecnum = cmd - ZFS_IOC_FIRST;
6056 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
6057 
6058 	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
6059 		return (SET_ERROR(EINVAL));
6060 	vec = &zfs_ioc_vec[vecnum];
6061 
6062 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
6063 
6064 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
6065 	if (error != 0) {
6066 		error = SET_ERROR(EFAULT);
6067 		goto out;
6068 	}
6069 
6070 	zc->zc_iflags = flag & FKIOCTL;
6071 	if (zc->zc_nvlist_src_size != 0) {
6072 		error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
6073 		    zc->zc_iflags, &innvl);
6074 		if (error != 0)
6075 			goto out;
6076 	}
6077 
6078 	/*
6079 	 * Ensure that all pool/dataset names are valid before we pass down to
6080 	 * the lower layers.
6081 	 */
6082 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
6083 	switch (vec->zvec_namecheck) {
6084 	case POOL_NAME:
6085 		if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
6086 			error = SET_ERROR(EINVAL);
6087 		else
6088 			error = pool_status_check(zc->zc_name,
6089 			    vec->zvec_namecheck, vec->zvec_pool_check);
6090 		break;
6091 
6092 	case DATASET_NAME:
6093 		if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
6094 			error = SET_ERROR(EINVAL);
6095 		else
6096 			error = pool_status_check(zc->zc_name,
6097 			    vec->zvec_namecheck, vec->zvec_pool_check);
6098 		break;
6099 
6100 	case NO_NAME:
6101 		break;
6102 	}
6103 
6104 
6105 	if (error == 0 && !(flag & FKIOCTL))
6106 		error = vec->zvec_secpolicy(zc, innvl, cr);
6107 
6108 	if (error != 0)
6109 		goto out;
6110 
6111 	/* legacy ioctls can modify zc_name */
6112 	len = strcspn(zc->zc_name, "/@#") + 1;
6113 	saved_poolname = kmem_alloc(len, KM_SLEEP);
6114 	(void) strlcpy(saved_poolname, zc->zc_name, len);
6115 
6116 	if (vec->zvec_func != NULL) {
6117 		nvlist_t *outnvl;
6118 		int puterror = 0;
6119 		spa_t *spa;
6120 		nvlist_t *lognv = NULL;
6121 
6122 		ASSERT(vec->zvec_legacy_func == NULL);
6123 
6124 		/*
6125 		 * Add the innvl to the lognv before calling the func,
6126 		 * in case the func changes the innvl.
6127 		 */
6128 		if (vec->zvec_allow_log) {
6129 			lognv = fnvlist_alloc();
6130 			fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
6131 			    vec->zvec_name);
6132 			if (!nvlist_empty(innvl)) {
6133 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
6134 				    innvl);
6135 			}
6136 		}
6137 
6138 		outnvl = fnvlist_alloc();
6139 		error = vec->zvec_func(zc->zc_name, innvl, outnvl);
6140 
6141 		if (error == 0 && vec->zvec_allow_log &&
6142 		    spa_open(zc->zc_name, &spa, FTAG) == 0) {
6143 			if (!nvlist_empty(outnvl)) {
6144 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
6145 				    outnvl);
6146 			}
6147 			(void) spa_history_log_nvl(spa, lognv);
6148 			spa_close(spa, FTAG);
6149 		}
6150 		fnvlist_free(lognv);
6151 
6152 		if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
6153 			int smusherror = 0;
6154 			if (vec->zvec_smush_outnvlist) {
6155 				smusherror = nvlist_smush(outnvl,
6156 				    zc->zc_nvlist_dst_size);
6157 			}
6158 			if (smusherror == 0)
6159 				puterror = put_nvlist(zc, outnvl);
6160 		}
6161 
6162 		if (puterror != 0)
6163 			error = puterror;
6164 
6165 		nvlist_free(outnvl);
6166 	} else {
6167 		error = vec->zvec_legacy_func(zc);
6168 	}
6169 
6170 out:
6171 	nvlist_free(innvl);
6172 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
6173 	if (error == 0 && rc != 0)
6174 		error = SET_ERROR(EFAULT);
6175 	if (error == 0 && vec->zvec_allow_log) {
6176 		char *s = tsd_get(zfs_allow_log_key);
6177 		if (s != NULL)
6178 			strfree(s);
6179 		(void) tsd_set(zfs_allow_log_key, saved_poolname);
6180 	} else {
6181 		if (saved_poolname != NULL)
6182 			strfree(saved_poolname);
6183 	}
6184 
6185 	kmem_free(zc, sizeof (zfs_cmd_t));
6186 	return (error);
6187 }
6188 
6189 static int
6190 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
6191 {
6192 	if (cmd != DDI_ATTACH)
6193 		return (DDI_FAILURE);
6194 
6195 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
6196 	    DDI_PSEUDO, 0) == DDI_FAILURE)
6197 		return (DDI_FAILURE);
6198 
6199 	zfs_dip = dip;
6200 
6201 	ddi_report_dev(dip);
6202 
6203 	return (DDI_SUCCESS);
6204 }
6205 
6206 static int
6207 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
6208 {
6209 	if (spa_busy() || zfs_busy() || zvol_busy())
6210 		return (DDI_FAILURE);
6211 
6212 	if (cmd != DDI_DETACH)
6213 		return (DDI_FAILURE);
6214 
6215 	zfs_dip = NULL;
6216 
6217 	ddi_prop_remove_all(dip);
6218 	ddi_remove_minor_node(dip, NULL);
6219 
6220 	return (DDI_SUCCESS);
6221 }
6222 
6223 /*ARGSUSED*/
6224 static int
6225 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
6226 {
6227 	switch (infocmd) {
6228 	case DDI_INFO_DEVT2DEVINFO:
6229 		*result = zfs_dip;
6230 		return (DDI_SUCCESS);
6231 
6232 	case DDI_INFO_DEVT2INSTANCE:
6233 		*result = (void *)0;
6234 		return (DDI_SUCCESS);
6235 	}
6236 
6237 	return (DDI_FAILURE);
6238 }
6239 
6240 /*
6241  * OK, so this is a little weird.
6242  *
6243  * /dev/zfs is the control node, i.e. minor 0.
6244  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
6245  *
6246  * /dev/zfs has basically nothing to do except serve up ioctls,
6247  * so most of the standard driver entry points are in zvol.c.
6248  */
6249 static struct cb_ops zfs_cb_ops = {
6250 	zfsdev_open,	/* open */
6251 	zfsdev_close,	/* close */
6252 	zvol_strategy,	/* strategy */
6253 	nodev,		/* print */
6254 	zvol_dump,	/* dump */
6255 	zvol_read,	/* read */
6256 	zvol_write,	/* write */
6257 	zfsdev_ioctl,	/* ioctl */
6258 	nodev,		/* devmap */
6259 	nodev,		/* mmap */
6260 	nodev,		/* segmap */
6261 	nochpoll,	/* poll */
6262 	ddi_prop_op,	/* prop_op */
6263 	NULL,		/* streamtab */
6264 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
6265 	CB_REV,		/* version */
6266 	nodev,		/* async read */
6267 	nodev,		/* async write */
6268 };
6269 
6270 static struct dev_ops zfs_dev_ops = {
6271 	DEVO_REV,	/* version */
6272 	0,		/* refcnt */
6273 	zfs_info,	/* info */
6274 	nulldev,	/* identify */
6275 	nulldev,	/* probe */
6276 	zfs_attach,	/* attach */
6277 	zfs_detach,	/* detach */
6278 	nodev,		/* reset */
6279 	&zfs_cb_ops,	/* driver operations */
6280 	NULL,		/* no bus operations */
6281 	NULL,		/* power */
6282 	ddi_quiesce_not_needed,	/* quiesce */
6283 };
6284 
6285 static struct modldrv zfs_modldrv = {
6286 	&mod_driverops,
6287 	"ZFS storage pool",
6288 	&zfs_dev_ops
6289 };
6290 
6291 static struct modlinkage modlinkage = {
6292 	MODREV_1,
6293 	(void *)&zfs_modlfs,
6294 	(void *)&zfs_modldrv,
6295 	NULL
6296 };
6297 
6298 static void
6299 zfs_allow_log_destroy(void *arg)
6300 {
6301 	char *poolname = arg;
6302 	strfree(poolname);
6303 }
6304 
6305 int
6306 _init(void)
6307 {
6308 	int error;
6309 
6310 	spa_init(FREAD | FWRITE);
6311 	zfs_init();
6312 	zvol_init();
6313 	zfs_ioctl_init();
6314 	rz_zev_init();
6315 
6316 	if ((error = mod_install(&modlinkage)) != 0) {
6317 		zvol_fini();
6318 		zfs_fini();
6319 		spa_fini();
6320 		return (error);
6321 	}
6322 
6323 	tsd_create(&zfs_fsyncer_key, NULL);
6324 	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
6325 	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
6326 
6327 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
6328 	ASSERT(error == 0);
6329 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
6330 
6331 	return (0);
6332 }
6333 
6334 int
6335 _fini(void)
6336 {
6337 	int error;
6338 
6339 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
6340 		return (SET_ERROR(EBUSY));
6341 
6342 	if ((error = mod_remove(&modlinkage)) != 0)
6343 		return (error);
6344 
6345 	rz_zev_fini();
6346 	zvol_fini();
6347 	zfs_fini();
6348 	spa_fini();
6349 	if (zfs_nfsshare_inited)
6350 		(void) ddi_modclose(nfs_mod);
6351 	if (zfs_smbshare_inited)
6352 		(void) ddi_modclose(smbsrv_mod);
6353 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
6354 		(void) ddi_modclose(sharefs_mod);
6355 
6356 	tsd_destroy(&zfs_fsyncer_key);
6357 	ldi_ident_release(zfs_li);
6358 	zfs_li = NULL;
6359 	mutex_destroy(&zfs_share_lock);
6360 
6361 	return (error);
6362 }
6363 
6364 int
6365 _info(struct modinfo *modinfop)
6366 {
6367 	return (mod_info(&modlinkage, modinfop));
6368 }
6369