xref: /titanic_51/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision b8810c30edb33cc3c1ef40ffaea2f47c9371dd4f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Portions Copyright 2011 Martin Matuska
25  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
26  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
27  * Copyright (c) 2014, Joyent, Inc. All rights reserved.
28  * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
29  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
30  * Copyright (c) 2013 Steven Hartland. All rights reserved.
31  * Copyright (c) 2014 Integros [integros.com]
32  */
33 
34 /*
35  * ZFS ioctls.
36  *
37  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
38  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
39  *
40  * There are two ways that we handle ioctls: the legacy way where almost
41  * all of the logic is in the ioctl callback, and the new way where most
42  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
43  *
44  * Non-legacy ioctls should be registered by calling
45  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
46  * from userland by lzc_ioctl().
47  *
48  * The registration arguments are as follows:
49  *
50  * const char *name
51  *   The name of the ioctl.  This is used for history logging.  If the
52  *   ioctl returns successfully (the callback returns 0), and allow_log
53  *   is true, then a history log entry will be recorded with the input &
54  *   output nvlists.  The log entry can be printed with "zpool history -i".
55  *
56  * zfs_ioc_t ioc
57  *   The ioctl request number, which userland will pass to ioctl(2).
58  *   The ioctl numbers can change from release to release, because
59  *   the caller (libzfs) must be matched to the kernel.
60  *
61  * zfs_secpolicy_func_t *secpolicy
62  *   This function will be called before the zfs_ioc_func_t, to
63  *   determine if this operation is permitted.  It should return EPERM
64  *   on failure, and 0 on success.  Checks include determining if the
65  *   dataset is visible in this zone, and if the user has either all
66  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
67  *   to do this operation on this dataset with "zfs allow".
68  *
69  * zfs_ioc_namecheck_t namecheck
70  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
71  *   name, a dataset name, or nothing.  If the name is not well-formed,
72  *   the ioctl will fail and the callback will not be called.
73  *   Therefore, the callback can assume that the name is well-formed
74  *   (e.g. is null-terminated, doesn't have more than one '@' character,
75  *   doesn't have invalid characters).
76  *
77  * zfs_ioc_poolcheck_t pool_check
78  *   This specifies requirements on the pool state.  If the pool does
79  *   not meet them (is suspended or is readonly), the ioctl will fail
80  *   and the callback will not be called.  If any checks are specified
81  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
82  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
83  *   POOL_CHECK_READONLY).
84  *
85  * boolean_t smush_outnvlist
86  *   If smush_outnvlist is true, then the output is presumed to be a
87  *   list of errors, and it will be "smushed" down to fit into the
88  *   caller's buffer, by removing some entries and replacing them with a
89  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
90  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
91  *   outnvlist does not fit into the userland-provided buffer, then the
92  *   ioctl will fail with ENOMEM.
93  *
94  * zfs_ioc_func_t *func
95  *   The callback function that will perform the operation.
96  *
97  *   The callback should return 0 on success, or an error number on
98  *   failure.  If the function fails, the userland ioctl will return -1,
99  *   and errno will be set to the callback's return value.  The callback
100  *   will be called with the following arguments:
101  *
102  *   const char *name
103  *     The name of the pool or dataset to operate on, from
104  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
105  *     expected type (pool, dataset, or none).
106  *
107  *   nvlist_t *innvl
108  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
109  *     NULL if no input nvlist was provided.  Changes to this nvlist are
110  *     ignored.  If the input nvlist could not be deserialized, the
111  *     ioctl will fail and the callback will not be called.
112  *
113  *   nvlist_t *outnvl
114  *     The output nvlist, initially empty.  The callback can fill it in,
115  *     and it will be returned to userland by serializing it into
116  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
117  *     fails (e.g. because the caller didn't supply a large enough
118  *     buffer), then the overall ioctl will fail.  See the
119  *     'smush_nvlist' argument above for additional behaviors.
120  *
121  *     There are two typical uses of the output nvlist:
122  *       - To return state, e.g. property values.  In this case,
123  *         smush_outnvlist should be false.  If the buffer was not large
124  *         enough, the caller will reallocate a larger buffer and try
125  *         the ioctl again.
126  *
127  *       - To return multiple errors from an ioctl which makes on-disk
128  *         changes.  In this case, smush_outnvlist should be true.
129  *         Ioctls which make on-disk modifications should generally not
130  *         use the outnvl if they succeed, because the caller can not
131  *         distinguish between the operation failing, and
132  *         deserialization failing.
133  */
134 
135 #include <sys/types.h>
136 #include <sys/param.h>
137 #include <sys/errno.h>
138 #include <sys/uio.h>
139 #include <sys/buf.h>
140 #include <sys/modctl.h>
141 #include <sys/open.h>
142 #include <sys/file.h>
143 #include <sys/kmem.h>
144 #include <sys/conf.h>
145 #include <sys/cmn_err.h>
146 #include <sys/stat.h>
147 #include <sys/zfs_ioctl.h>
148 #include <sys/zfs_vfsops.h>
149 #include <sys/zfs_znode.h>
150 #include <sys/zap.h>
151 #include <sys/spa.h>
152 #include <sys/spa_impl.h>
153 #include <sys/vdev.h>
154 #include <sys/priv_impl.h>
155 #include <sys/dmu.h>
156 #include <sys/dsl_dir.h>
157 #include <sys/dsl_dataset.h>
158 #include <sys/dsl_prop.h>
159 #include <sys/dsl_deleg.h>
160 #include <sys/dmu_objset.h>
161 #include <sys/dmu_impl.h>
162 #include <sys/dmu_tx.h>
163 #include <sys/ddi.h>
164 #include <sys/sunddi.h>
165 #include <sys/sunldi.h>
166 #include <sys/policy.h>
167 #include <sys/zone.h>
168 #include <sys/nvpair.h>
169 #include <sys/pathname.h>
170 #include <sys/mount.h>
171 #include <sys/sdt.h>
172 #include <sys/fs/zfs.h>
173 #include <sys/zfs_ctldir.h>
174 #include <sys/zfs_dir.h>
175 #include <sys/zfs_onexit.h>
176 #include <sys/zvol.h>
177 #include <sys/dsl_scan.h>
178 #include <sharefs/share.h>
179 #include <sys/dmu_objset.h>
180 #include <sys/dmu_send.h>
181 #include <sys/dsl_destroy.h>
182 #include <sys/dsl_bookmark.h>
183 #include <sys/dsl_userhold.h>
184 #include <sys/zfeature.h>
185 #include <sys/zio_checksum.h>
186 #include <sys/zfs_events.h>
187 
188 #include "zfs_namecheck.h"
189 #include "zfs_prop.h"
190 #include "zfs_deleg.h"
191 #include "zfs_comutil.h"
192 
193 extern struct modlfs zfs_modlfs;
194 
195 extern void zfs_init(void);
196 extern void zfs_fini(void);
197 
198 ldi_ident_t zfs_li = NULL;
199 dev_info_t *zfs_dip;
200 
201 uint_t zfs_fsyncer_key;
202 extern uint_t rrw_tsd_key;
203 static uint_t zfs_allow_log_key;
204 
205 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
206 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
207 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
208 
209 typedef enum {
210 	NO_NAME,
211 	POOL_NAME,
212 	DATASET_NAME
213 } zfs_ioc_namecheck_t;
214 
215 typedef enum {
216 	POOL_CHECK_NONE		= 1 << 0,
217 	POOL_CHECK_SUSPENDED	= 1 << 1,
218 	POOL_CHECK_READONLY	= 1 << 2,
219 } zfs_ioc_poolcheck_t;
220 
221 typedef struct zfs_ioc_vec {
222 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
223 	zfs_ioc_func_t		*zvec_func;
224 	zfs_secpolicy_func_t	*zvec_secpolicy;
225 	zfs_ioc_namecheck_t	zvec_namecheck;
226 	boolean_t		zvec_allow_log;
227 	zfs_ioc_poolcheck_t	zvec_pool_check;
228 	boolean_t		zvec_smush_outnvlist;
229 	const char		*zvec_name;
230 } zfs_ioc_vec_t;
231 
232 /* This array is indexed by zfs_userquota_prop_t */
233 static const char *userquota_perms[] = {
234 	ZFS_DELEG_PERM_USERUSED,
235 	ZFS_DELEG_PERM_USERQUOTA,
236 	ZFS_DELEG_PERM_GROUPUSED,
237 	ZFS_DELEG_PERM_GROUPQUOTA,
238 };
239 
240 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
241 static int zfs_check_settable(const char *name, nvpair_t *property,
242     cred_t *cr);
243 static int zfs_check_clearable(char *dataset, nvlist_t *props,
244     nvlist_t **errors);
245 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
246     boolean_t *);
247 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
248 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
249 
250 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
251 
252 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
253 void
254 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
255 {
256 	const char *newfile;
257 	char buf[512];
258 	va_list adx;
259 
260 	/*
261 	 * Get rid of annoying "../common/" prefix to filename.
262 	 */
263 	newfile = strrchr(file, '/');
264 	if (newfile != NULL) {
265 		newfile = newfile + 1; /* Get rid of leading / */
266 	} else {
267 		newfile = file;
268 	}
269 
270 	va_start(adx, fmt);
271 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
272 	va_end(adx);
273 
274 	/*
275 	 * To get this data, use the zfs-dprintf probe as so:
276 	 * dtrace -q -n 'zfs-dprintf \
277 	 *	/stringof(arg0) == "dbuf.c"/ \
278 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
279 	 * arg0 = file name
280 	 * arg1 = function name
281 	 * arg2 = line number
282 	 * arg3 = message
283 	 */
284 	DTRACE_PROBE4(zfs__dprintf,
285 	    char *, newfile, char *, func, int, line, char *, buf);
286 }
287 
288 static void
289 history_str_free(char *buf)
290 {
291 	kmem_free(buf, HIS_MAX_RECORD_LEN);
292 }
293 
294 static char *
295 history_str_get(zfs_cmd_t *zc)
296 {
297 	char *buf;
298 
299 	if (zc->zc_history == NULL)
300 		return (NULL);
301 
302 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
303 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
304 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
305 		history_str_free(buf);
306 		return (NULL);
307 	}
308 
309 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
310 
311 	return (buf);
312 }
313 
314 /*
315  * Check to see if the named dataset is currently defined as bootable
316  */
317 static boolean_t
318 zfs_is_bootfs(const char *name)
319 {
320 	objset_t *os;
321 
322 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
323 		boolean_t ret;
324 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
325 		dmu_objset_rele(os, FTAG);
326 		return (ret);
327 	}
328 	return (B_FALSE);
329 }
330 
331 /*
332  * Return non-zero if the spa version is less than requested version.
333  */
334 static int
335 zfs_earlier_version(const char *name, int version)
336 {
337 	spa_t *spa;
338 
339 	if (spa_open(name, &spa, FTAG) == 0) {
340 		if (spa_version(spa) < version) {
341 			spa_close(spa, FTAG);
342 			return (1);
343 		}
344 		spa_close(spa, FTAG);
345 	}
346 	return (0);
347 }
348 
349 /*
350  * Return TRUE if the ZPL version is less than requested version.
351  */
352 static boolean_t
353 zpl_earlier_version(const char *name, int version)
354 {
355 	objset_t *os;
356 	boolean_t rc = B_TRUE;
357 
358 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
359 		uint64_t zplversion;
360 
361 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
362 			dmu_objset_rele(os, FTAG);
363 			return (B_TRUE);
364 		}
365 		/* XXX reading from non-owned objset */
366 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
367 			rc = zplversion < version;
368 		dmu_objset_rele(os, FTAG);
369 	}
370 	return (rc);
371 }
372 
373 static void
374 zfs_log_history(zfs_cmd_t *zc)
375 {
376 	spa_t *spa;
377 	char *buf;
378 
379 	if ((buf = history_str_get(zc)) == NULL)
380 		return;
381 
382 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
383 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
384 			(void) spa_history_log(spa, buf);
385 		spa_close(spa, FTAG);
386 	}
387 	history_str_free(buf);
388 }
389 
390 /*
391  * Policy for top-level read operations (list pools).  Requires no privileges,
392  * and can be used in the local zone, as there is no associated dataset.
393  */
394 /* ARGSUSED */
395 static int
396 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
397 {
398 	return (0);
399 }
400 
401 /*
402  * Policy for dataset read operations (list children, get statistics).  Requires
403  * no privileges, but must be visible in the local zone.
404  */
405 /* ARGSUSED */
406 static int
407 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
408 {
409 	if (INGLOBALZONE(curproc) ||
410 	    zone_dataset_visible(zc->zc_name, NULL))
411 		return (0);
412 
413 	return (SET_ERROR(ENOENT));
414 }
415 
416 static int
417 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
418 {
419 	int writable = 1;
420 
421 	/*
422 	 * The dataset must be visible by this zone -- check this first
423 	 * so they don't see EPERM on something they shouldn't know about.
424 	 */
425 	if (!INGLOBALZONE(curproc) &&
426 	    !zone_dataset_visible(dataset, &writable))
427 		return (SET_ERROR(ENOENT));
428 
429 	if (INGLOBALZONE(curproc)) {
430 		/*
431 		 * If the fs is zoned, only root can access it from the
432 		 * global zone.
433 		 */
434 		if (secpolicy_zfs(cr) && zoned)
435 			return (SET_ERROR(EPERM));
436 	} else {
437 		/*
438 		 * If we are in a local zone, the 'zoned' property must be set.
439 		 */
440 		if (!zoned)
441 			return (SET_ERROR(EPERM));
442 
443 		/* must be writable by this zone */
444 		if (!writable)
445 			return (SET_ERROR(EPERM));
446 	}
447 	return (0);
448 }
449 
450 static int
451 zfs_dozonecheck(const char *dataset, cred_t *cr)
452 {
453 	uint64_t zoned;
454 
455 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
456 		return (SET_ERROR(ENOENT));
457 
458 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
459 }
460 
461 static int
462 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
463 {
464 	uint64_t zoned;
465 
466 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
467 		return (SET_ERROR(ENOENT));
468 
469 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
470 }
471 
472 static int
473 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
474     const char *perm, cred_t *cr)
475 {
476 	int error;
477 
478 	error = zfs_dozonecheck_ds(name, ds, cr);
479 	if (error == 0) {
480 		error = secpolicy_zfs(cr);
481 		if (error != 0)
482 			error = dsl_deleg_access_impl(ds, perm, cr);
483 	}
484 	return (error);
485 }
486 
487 static int
488 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
489 {
490 	int error;
491 	dsl_dataset_t *ds;
492 	dsl_pool_t *dp;
493 
494 	error = dsl_pool_hold(name, FTAG, &dp);
495 	if (error != 0)
496 		return (error);
497 
498 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
499 	if (error != 0) {
500 		dsl_pool_rele(dp, FTAG);
501 		return (error);
502 	}
503 
504 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
505 
506 	dsl_dataset_rele(ds, FTAG);
507 	dsl_pool_rele(dp, FTAG);
508 	return (error);
509 }
510 
511 /*
512  * Policy for setting the security label property.
513  *
514  * Returns 0 for success, non-zero for access and other errors.
515  */
516 static int
517 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
518 {
519 	char		ds_hexsl[MAXNAMELEN];
520 	bslabel_t	ds_sl, new_sl;
521 	boolean_t	new_default = FALSE;
522 	uint64_t	zoned;
523 	int		needed_priv = -1;
524 	int		error;
525 
526 	/* First get the existing dataset label. */
527 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
528 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
529 	if (error != 0)
530 		return (SET_ERROR(EPERM));
531 
532 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
533 		new_default = TRUE;
534 
535 	/* The label must be translatable */
536 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
537 		return (SET_ERROR(EINVAL));
538 
539 	/*
540 	 * In a non-global zone, disallow attempts to set a label that
541 	 * doesn't match that of the zone; otherwise no other checks
542 	 * are needed.
543 	 */
544 	if (!INGLOBALZONE(curproc)) {
545 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
546 			return (SET_ERROR(EPERM));
547 		return (0);
548 	}
549 
550 	/*
551 	 * For global-zone datasets (i.e., those whose zoned property is
552 	 * "off", verify that the specified new label is valid for the
553 	 * global zone.
554 	 */
555 	if (dsl_prop_get_integer(name,
556 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
557 		return (SET_ERROR(EPERM));
558 	if (!zoned) {
559 		if (zfs_check_global_label(name, strval) != 0)
560 			return (SET_ERROR(EPERM));
561 	}
562 
563 	/*
564 	 * If the existing dataset label is nondefault, check if the
565 	 * dataset is mounted (label cannot be changed while mounted).
566 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
567 	 * mounted (or isn't a dataset, doesn't exist, ...).
568 	 */
569 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
570 		objset_t *os;
571 		static char *setsl_tag = "setsl_tag";
572 
573 		/*
574 		 * Try to own the dataset; abort if there is any error,
575 		 * (e.g., already mounted, in use, or other error).
576 		 */
577 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
578 		    setsl_tag, &os);
579 		if (error != 0)
580 			return (SET_ERROR(EPERM));
581 
582 		dmu_objset_disown(os, setsl_tag);
583 
584 		if (new_default) {
585 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
586 			goto out_check;
587 		}
588 
589 		if (hexstr_to_label(strval, &new_sl) != 0)
590 			return (SET_ERROR(EPERM));
591 
592 		if (blstrictdom(&ds_sl, &new_sl))
593 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
594 		else if (blstrictdom(&new_sl, &ds_sl))
595 			needed_priv = PRIV_FILE_UPGRADE_SL;
596 	} else {
597 		/* dataset currently has a default label */
598 		if (!new_default)
599 			needed_priv = PRIV_FILE_UPGRADE_SL;
600 	}
601 
602 out_check:
603 	if (needed_priv != -1)
604 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
605 	return (0);
606 }
607 
608 static int
609 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
610     cred_t *cr)
611 {
612 	char *strval;
613 
614 	/*
615 	 * Check permissions for special properties.
616 	 */
617 	switch (prop) {
618 	case ZFS_PROP_ZONED:
619 		/*
620 		 * Disallow setting of 'zoned' from within a local zone.
621 		 */
622 		if (!INGLOBALZONE(curproc))
623 			return (SET_ERROR(EPERM));
624 		break;
625 
626 	case ZFS_PROP_QUOTA:
627 	case ZFS_PROP_FILESYSTEM_LIMIT:
628 	case ZFS_PROP_SNAPSHOT_LIMIT:
629 		if (!INGLOBALZONE(curproc)) {
630 			uint64_t zoned;
631 			char setpoint[MAXNAMELEN];
632 			/*
633 			 * Unprivileged users are allowed to modify the
634 			 * limit on things *under* (ie. contained by)
635 			 * the thing they own.
636 			 */
637 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
638 			    setpoint))
639 				return (SET_ERROR(EPERM));
640 			if (!zoned || strlen(dsname) <= strlen(setpoint))
641 				return (SET_ERROR(EPERM));
642 		}
643 		break;
644 
645 	case ZFS_PROP_MLSLABEL:
646 		if (!is_system_labeled())
647 			return (SET_ERROR(EPERM));
648 
649 		if (nvpair_value_string(propval, &strval) == 0) {
650 			int err;
651 
652 			err = zfs_set_slabel_policy(dsname, strval, CRED());
653 			if (err != 0)
654 				return (err);
655 		}
656 		break;
657 	}
658 
659 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
660 }
661 
662 /* ARGSUSED */
663 static int
664 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
665 {
666 	int error;
667 
668 	error = zfs_dozonecheck(zc->zc_name, cr);
669 	if (error != 0)
670 		return (error);
671 
672 	/*
673 	 * permission to set permissions will be evaluated later in
674 	 * dsl_deleg_can_allow()
675 	 */
676 	return (0);
677 }
678 
679 /* ARGSUSED */
680 static int
681 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
682 {
683 	return (zfs_secpolicy_write_perms(zc->zc_name,
684 	    ZFS_DELEG_PERM_ROLLBACK, cr));
685 }
686 
687 /* ARGSUSED */
688 static int
689 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
690 {
691 	dsl_pool_t *dp;
692 	dsl_dataset_t *ds;
693 	char *cp;
694 	int error;
695 
696 	/*
697 	 * Generate the current snapshot name from the given objsetid, then
698 	 * use that name for the secpolicy/zone checks.
699 	 */
700 	cp = strchr(zc->zc_name, '@');
701 	if (cp == NULL)
702 		return (SET_ERROR(EINVAL));
703 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
704 	if (error != 0)
705 		return (error);
706 
707 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
708 	if (error != 0) {
709 		dsl_pool_rele(dp, FTAG);
710 		return (error);
711 	}
712 
713 	dsl_dataset_name(ds, zc->zc_name);
714 
715 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
716 	    ZFS_DELEG_PERM_SEND, cr);
717 	dsl_dataset_rele(ds, FTAG);
718 	dsl_pool_rele(dp, FTAG);
719 
720 	return (error);
721 }
722 
723 /* ARGSUSED */
724 static int
725 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
726 {
727 	return (zfs_secpolicy_write_perms(zc->zc_name,
728 	    ZFS_DELEG_PERM_SEND, cr));
729 }
730 
731 /* ARGSUSED */
732 static int
733 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
734 {
735 	vnode_t *vp;
736 	int error;
737 
738 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
739 	    NO_FOLLOW, NULL, &vp)) != 0)
740 		return (error);
741 
742 	/* Now make sure mntpnt and dataset are ZFS */
743 
744 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
745 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
746 	    zc->zc_name) != 0)) {
747 		VN_RELE(vp);
748 		return (SET_ERROR(EPERM));
749 	}
750 
751 	VN_RELE(vp);
752 	return (dsl_deleg_access(zc->zc_name,
753 	    ZFS_DELEG_PERM_SHARE, cr));
754 }
755 
756 int
757 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
758 {
759 	if (!INGLOBALZONE(curproc))
760 		return (SET_ERROR(EPERM));
761 
762 	if (secpolicy_nfs(cr) == 0) {
763 		return (0);
764 	} else {
765 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
766 	}
767 }
768 
769 int
770 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
771 {
772 	if (!INGLOBALZONE(curproc))
773 		return (SET_ERROR(EPERM));
774 
775 	if (secpolicy_smb(cr) == 0) {
776 		return (0);
777 	} else {
778 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
779 	}
780 }
781 
782 static int
783 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
784 {
785 	char *cp;
786 
787 	/*
788 	 * Remove the @bla or /bla from the end of the name to get the parent.
789 	 */
790 	(void) strncpy(parent, datasetname, parentsize);
791 	cp = strrchr(parent, '@');
792 	if (cp != NULL) {
793 		cp[0] = '\0';
794 	} else {
795 		cp = strrchr(parent, '/');
796 		if (cp == NULL)
797 			return (SET_ERROR(ENOENT));
798 		cp[0] = '\0';
799 	}
800 
801 	return (0);
802 }
803 
804 int
805 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
806 {
807 	int error;
808 
809 	if ((error = zfs_secpolicy_write_perms(name,
810 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
811 		return (error);
812 
813 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
814 }
815 
816 /* ARGSUSED */
817 static int
818 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
819 {
820 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
821 }
822 
823 /*
824  * Destroying snapshots with delegated permissions requires
825  * descendant mount and destroy permissions.
826  */
827 /* ARGSUSED */
828 static int
829 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
830 {
831 	nvlist_t *snaps;
832 	nvpair_t *pair, *nextpair;
833 	int error = 0;
834 
835 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
836 		return (SET_ERROR(EINVAL));
837 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
838 	    pair = nextpair) {
839 		nextpair = nvlist_next_nvpair(snaps, pair);
840 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
841 		if (error == ENOENT) {
842 			/*
843 			 * Ignore any snapshots that don't exist (we consider
844 			 * them "already destroyed").  Remove the name from the
845 			 * nvl here in case the snapshot is created between
846 			 * now and when we try to destroy it (in which case
847 			 * we don't want to destroy it since we haven't
848 			 * checked for permission).
849 			 */
850 			fnvlist_remove_nvpair(snaps, pair);
851 			error = 0;
852 		}
853 		if (error != 0)
854 			break;
855 	}
856 
857 	return (error);
858 }
859 
860 int
861 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
862 {
863 	char	parentname[MAXNAMELEN];
864 	int	error;
865 
866 	if ((error = zfs_secpolicy_write_perms(from,
867 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
868 		return (error);
869 
870 	if ((error = zfs_secpolicy_write_perms(from,
871 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
872 		return (error);
873 
874 	if ((error = zfs_get_parent(to, parentname,
875 	    sizeof (parentname))) != 0)
876 		return (error);
877 
878 	if ((error = zfs_secpolicy_write_perms(parentname,
879 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
880 		return (error);
881 
882 	if ((error = zfs_secpolicy_write_perms(parentname,
883 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
884 		return (error);
885 
886 	return (error);
887 }
888 
889 /* ARGSUSED */
890 static int
891 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
892 {
893 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
894 }
895 
896 /* ARGSUSED */
897 static int
898 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
899 {
900 	dsl_pool_t *dp;
901 	dsl_dataset_t *clone;
902 	int error;
903 
904 	error = zfs_secpolicy_write_perms(zc->zc_name,
905 	    ZFS_DELEG_PERM_PROMOTE, cr);
906 	if (error != 0)
907 		return (error);
908 
909 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
910 	if (error != 0)
911 		return (error);
912 
913 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
914 
915 	if (error == 0) {
916 		char parentname[MAXNAMELEN];
917 		dsl_dataset_t *origin = NULL;
918 		dsl_dir_t *dd;
919 		dd = clone->ds_dir;
920 
921 		error = dsl_dataset_hold_obj(dd->dd_pool,
922 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
923 		if (error != 0) {
924 			dsl_dataset_rele(clone, FTAG);
925 			dsl_pool_rele(dp, FTAG);
926 			return (error);
927 		}
928 
929 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
930 		    ZFS_DELEG_PERM_MOUNT, cr);
931 
932 		dsl_dataset_name(origin, parentname);
933 		if (error == 0) {
934 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
935 			    ZFS_DELEG_PERM_PROMOTE, cr);
936 		}
937 		dsl_dataset_rele(clone, FTAG);
938 		dsl_dataset_rele(origin, FTAG);
939 	}
940 	dsl_pool_rele(dp, FTAG);
941 	return (error);
942 }
943 
944 /* ARGSUSED */
945 static int
946 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
947 {
948 	int error;
949 
950 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
951 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
952 		return (error);
953 
954 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
955 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
956 		return (error);
957 
958 	return (zfs_secpolicy_write_perms(zc->zc_name,
959 	    ZFS_DELEG_PERM_CREATE, cr));
960 }
961 
962 int
963 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
964 {
965 	return (zfs_secpolicy_write_perms(name,
966 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
967 }
968 
969 /*
970  * Check for permission to create each snapshot in the nvlist.
971  */
972 /* ARGSUSED */
973 static int
974 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
975 {
976 	nvlist_t *snaps;
977 	int error = 0;
978 	nvpair_t *pair;
979 
980 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
981 		return (SET_ERROR(EINVAL));
982 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
983 	    pair = nvlist_next_nvpair(snaps, pair)) {
984 		char *name = nvpair_name(pair);
985 		char *atp = strchr(name, '@');
986 
987 		if (atp == NULL) {
988 			error = SET_ERROR(EINVAL);
989 			break;
990 		}
991 		*atp = '\0';
992 		error = zfs_secpolicy_snapshot_perms(name, cr);
993 		*atp = '@';
994 		if (error != 0)
995 			break;
996 	}
997 	return (error);
998 }
999 
1000 /*
1001  * Check for permission to create each snapshot in the nvlist.
1002  */
1003 /* ARGSUSED */
1004 static int
1005 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1006 {
1007 	int error = 0;
1008 
1009 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1010 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1011 		char *name = nvpair_name(pair);
1012 		char *hashp = strchr(name, '#');
1013 
1014 		if (hashp == NULL) {
1015 			error = SET_ERROR(EINVAL);
1016 			break;
1017 		}
1018 		*hashp = '\0';
1019 		error = zfs_secpolicy_write_perms(name,
1020 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1021 		*hashp = '#';
1022 		if (error != 0)
1023 			break;
1024 	}
1025 	return (error);
1026 }
1027 
1028 /* ARGSUSED */
1029 static int
1030 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1031 {
1032 	nvpair_t *pair, *nextpair;
1033 	int error = 0;
1034 
1035 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1036 	    pair = nextpair) {
1037 		char *name = nvpair_name(pair);
1038 		char *hashp = strchr(name, '#');
1039 		nextpair = nvlist_next_nvpair(innvl, pair);
1040 
1041 		if (hashp == NULL) {
1042 			error = SET_ERROR(EINVAL);
1043 			break;
1044 		}
1045 
1046 		*hashp = '\0';
1047 		error = zfs_secpolicy_write_perms(name,
1048 		    ZFS_DELEG_PERM_DESTROY, cr);
1049 		*hashp = '#';
1050 		if (error == ENOENT) {
1051 			/*
1052 			 * Ignore any filesystems that don't exist (we consider
1053 			 * their bookmarks "already destroyed").  Remove
1054 			 * the name from the nvl here in case the filesystem
1055 			 * is created between now and when we try to destroy
1056 			 * the bookmark (in which case we don't want to
1057 			 * destroy it since we haven't checked for permission).
1058 			 */
1059 			fnvlist_remove_nvpair(innvl, pair);
1060 			error = 0;
1061 		}
1062 		if (error != 0)
1063 			break;
1064 	}
1065 
1066 	return (error);
1067 }
1068 
1069 /* ARGSUSED */
1070 static int
1071 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1072 {
1073 	/*
1074 	 * Even root must have a proper TSD so that we know what pool
1075 	 * to log to.
1076 	 */
1077 	if (tsd_get(zfs_allow_log_key) == NULL)
1078 		return (SET_ERROR(EPERM));
1079 	return (0);
1080 }
1081 
1082 static int
1083 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1084 {
1085 	char	parentname[MAXNAMELEN];
1086 	int	error;
1087 	char	*origin;
1088 
1089 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1090 	    sizeof (parentname))) != 0)
1091 		return (error);
1092 
1093 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1094 	    (error = zfs_secpolicy_write_perms(origin,
1095 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1096 		return (error);
1097 
1098 	if ((error = zfs_secpolicy_write_perms(parentname,
1099 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1100 		return (error);
1101 
1102 	return (zfs_secpolicy_write_perms(parentname,
1103 	    ZFS_DELEG_PERM_MOUNT, cr));
1104 }
1105 
1106 /*
1107  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1108  * SYS_CONFIG privilege, which is not available in a local zone.
1109  */
1110 /* ARGSUSED */
1111 static int
1112 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1113 {
1114 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1115 		return (SET_ERROR(EPERM));
1116 
1117 	return (0);
1118 }
1119 
1120 /*
1121  * Policy for object to name lookups.
1122  */
1123 /* ARGSUSED */
1124 static int
1125 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1126 {
1127 	int error;
1128 
1129 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1130 		return (0);
1131 
1132 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1133 	return (error);
1134 }
1135 
1136 /*
1137  * Policy for fault injection.  Requires all privileges.
1138  */
1139 /* ARGSUSED */
1140 static int
1141 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1142 {
1143 	return (secpolicy_zinject(cr));
1144 }
1145 
1146 /* ARGSUSED */
1147 static int
1148 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1149 {
1150 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1151 
1152 	if (prop == ZPROP_INVAL) {
1153 		if (!zfs_prop_user(zc->zc_value))
1154 			return (SET_ERROR(EINVAL));
1155 		return (zfs_secpolicy_write_perms(zc->zc_name,
1156 		    ZFS_DELEG_PERM_USERPROP, cr));
1157 	} else {
1158 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1159 		    NULL, cr));
1160 	}
1161 }
1162 
1163 static int
1164 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1165 {
1166 	int err = zfs_secpolicy_read(zc, innvl, cr);
1167 	if (err)
1168 		return (err);
1169 
1170 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1171 		return (SET_ERROR(EINVAL));
1172 
1173 	if (zc->zc_value[0] == 0) {
1174 		/*
1175 		 * They are asking about a posix uid/gid.  If it's
1176 		 * themself, allow it.
1177 		 */
1178 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1179 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1180 			if (zc->zc_guid == crgetuid(cr))
1181 				return (0);
1182 		} else {
1183 			if (groupmember(zc->zc_guid, cr))
1184 				return (0);
1185 		}
1186 	}
1187 
1188 	return (zfs_secpolicy_write_perms(zc->zc_name,
1189 	    userquota_perms[zc->zc_objset_type], cr));
1190 }
1191 
1192 static int
1193 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1194 {
1195 	int err = zfs_secpolicy_read(zc, innvl, cr);
1196 	if (err)
1197 		return (err);
1198 
1199 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1200 		return (SET_ERROR(EINVAL));
1201 
1202 	return (zfs_secpolicy_write_perms(zc->zc_name,
1203 	    userquota_perms[zc->zc_objset_type], cr));
1204 }
1205 
1206 /* ARGSUSED */
1207 static int
1208 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1209 {
1210 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1211 	    NULL, cr));
1212 }
1213 
1214 /* ARGSUSED */
1215 static int
1216 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1217 {
1218 	nvpair_t *pair;
1219 	nvlist_t *holds;
1220 	int error;
1221 
1222 	error = nvlist_lookup_nvlist(innvl, "holds", &holds);
1223 	if (error != 0)
1224 		return (SET_ERROR(EINVAL));
1225 
1226 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1227 	    pair = nvlist_next_nvpair(holds, pair)) {
1228 		char fsname[MAXNAMELEN];
1229 		error = dmu_fsname(nvpair_name(pair), fsname);
1230 		if (error != 0)
1231 			return (error);
1232 		error = zfs_secpolicy_write_perms(fsname,
1233 		    ZFS_DELEG_PERM_HOLD, cr);
1234 		if (error != 0)
1235 			return (error);
1236 	}
1237 	return (0);
1238 }
1239 
1240 /* ARGSUSED */
1241 static int
1242 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1243 {
1244 	nvpair_t *pair;
1245 	int error;
1246 
1247 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1248 	    pair = nvlist_next_nvpair(innvl, pair)) {
1249 		char fsname[MAXNAMELEN];
1250 		error = dmu_fsname(nvpair_name(pair), fsname);
1251 		if (error != 0)
1252 			return (error);
1253 		error = zfs_secpolicy_write_perms(fsname,
1254 		    ZFS_DELEG_PERM_RELEASE, cr);
1255 		if (error != 0)
1256 			return (error);
1257 	}
1258 	return (0);
1259 }
1260 
1261 /*
1262  * Policy for allowing temporary snapshots to be taken or released
1263  */
1264 static int
1265 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1266 {
1267 	/*
1268 	 * A temporary snapshot is the same as a snapshot,
1269 	 * hold, destroy and release all rolled into one.
1270 	 * Delegated diff alone is sufficient that we allow this.
1271 	 */
1272 	int error;
1273 
1274 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1275 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1276 		return (0);
1277 
1278 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1279 	if (error == 0)
1280 		error = zfs_secpolicy_hold(zc, innvl, cr);
1281 	if (error == 0)
1282 		error = zfs_secpolicy_release(zc, innvl, cr);
1283 	if (error == 0)
1284 		error = zfs_secpolicy_destroy(zc, innvl, cr);
1285 	return (error);
1286 }
1287 
1288 /*
1289  * Policy for allowing setting the zev callback list.
1290  */
1291 static int
1292 zfs_secpolicy_set_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1293 {
1294 	/* must be called from kernel context */
1295 	if (!(zc->zc_iflags & FKIOCTL))
1296 		return (SET_ERROR(EPERM));
1297 	/* callback pointer must be unset (set to default value) */
1298 	rw_enter(&rz_zev_rwlock, RW_READER);
1299 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
1300 		rw_exit(&rz_zev_rwlock);
1301 		return (SET_ERROR(EBUSY));
1302 	}
1303 	rw_exit(&rz_zev_rwlock);
1304 	return (0);
1305 }
1306 
1307 /*
1308  * Policy for allowing unsetting/resetting the zev callback list.
1309  */
1310 static int
1311 zfs_secpolicy_unset_zev_callbacks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1312 {
1313 	/* must be called from kernel context */
1314 	if (!(zc->zc_iflags & FKIOCTL))
1315 		return (SET_ERROR(EPERM));
1316 	return (0);
1317 }
1318 
1319 /*
1320  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1321  */
1322 static int
1323 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1324 {
1325 	char *packed;
1326 	int error;
1327 	nvlist_t *list = NULL;
1328 
1329 	/*
1330 	 * Read in and unpack the user-supplied nvlist.
1331 	 */
1332 	if (size == 0)
1333 		return (SET_ERROR(EINVAL));
1334 
1335 	packed = kmem_alloc(size, KM_SLEEP);
1336 
1337 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1338 	    iflag)) != 0) {
1339 		kmem_free(packed, size);
1340 		return (SET_ERROR(EFAULT));
1341 	}
1342 
1343 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1344 		kmem_free(packed, size);
1345 		return (error);
1346 	}
1347 
1348 	kmem_free(packed, size);
1349 
1350 	*nvp = list;
1351 	return (0);
1352 }
1353 
1354 /*
1355  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1356  * Entries will be removed from the end of the nvlist, and one int32 entry
1357  * named "N_MORE_ERRORS" will be added indicating how many entries were
1358  * removed.
1359  */
1360 static int
1361 nvlist_smush(nvlist_t *errors, size_t max)
1362 {
1363 	size_t size;
1364 
1365 	size = fnvlist_size(errors);
1366 
1367 	if (size > max) {
1368 		nvpair_t *more_errors;
1369 		int n = 0;
1370 
1371 		if (max < 1024)
1372 			return (SET_ERROR(ENOMEM));
1373 
1374 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1375 		more_errors = nvlist_prev_nvpair(errors, NULL);
1376 
1377 		do {
1378 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1379 			    more_errors);
1380 			fnvlist_remove_nvpair(errors, pair);
1381 			n++;
1382 			size = fnvlist_size(errors);
1383 		} while (size > max);
1384 
1385 		fnvlist_remove_nvpair(errors, more_errors);
1386 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1387 		ASSERT3U(fnvlist_size(errors), <=, max);
1388 	}
1389 
1390 	return (0);
1391 }
1392 
1393 static int
1394 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1395 {
1396 	char *packed = NULL;
1397 	int error = 0;
1398 	size_t size;
1399 
1400 	size = fnvlist_size(nvl);
1401 
1402 	if (size > zc->zc_nvlist_dst_size) {
1403 		error = SET_ERROR(ENOMEM);
1404 	} else {
1405 		packed = fnvlist_pack(nvl, &size);
1406 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1407 		    size, zc->zc_iflags) != 0)
1408 			error = SET_ERROR(EFAULT);
1409 		fnvlist_pack_free(packed, size);
1410 	}
1411 
1412 	zc->zc_nvlist_dst_size = size;
1413 	zc->zc_nvlist_dst_filled = B_TRUE;
1414 	return (error);
1415 }
1416 
1417 static int
1418 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1419 {
1420 	objset_t *os;
1421 	int error;
1422 
1423 	error = dmu_objset_hold(dsname, FTAG, &os);
1424 	if (error != 0)
1425 		return (error);
1426 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1427 		dmu_objset_rele(os, FTAG);
1428 		return (SET_ERROR(EINVAL));
1429 	}
1430 
1431 	mutex_enter(&os->os_user_ptr_lock);
1432 	*zfvp = dmu_objset_get_user(os);
1433 	if (*zfvp) {
1434 		VFS_HOLD((*zfvp)->z_vfs);
1435 	} else {
1436 		error = SET_ERROR(ESRCH);
1437 	}
1438 	mutex_exit(&os->os_user_ptr_lock);
1439 	dmu_objset_rele(os, FTAG);
1440 	return (error);
1441 }
1442 
1443 /*
1444  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1445  * case its z_vfs will be NULL, and it will be opened as the owner.
1446  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1447  * which prevents all vnode ops from running.
1448  */
1449 static int
1450 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1451 {
1452 	int error = 0;
1453 
1454 	if (getzfsvfs(name, zfvp) != 0)
1455 		error = zfsvfs_create(name, zfvp);
1456 	if (error == 0) {
1457 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1458 		    RW_READER, tag);
1459 		if ((*zfvp)->z_unmounted) {
1460 			/*
1461 			 * XXX we could probably try again, since the unmounting
1462 			 * thread should be just about to disassociate the
1463 			 * objset from the zfsvfs.
1464 			 */
1465 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1466 			return (SET_ERROR(EBUSY));
1467 		}
1468 	}
1469 	return (error);
1470 }
1471 
1472 static void
1473 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1474 {
1475 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1476 
1477 	if (zfsvfs->z_vfs) {
1478 		VFS_RELE(zfsvfs->z_vfs);
1479 	} else {
1480 		dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1481 		zfsvfs_free(zfsvfs);
1482 	}
1483 }
1484 
1485 static int
1486 zfs_ioc_pool_create(zfs_cmd_t *zc)
1487 {
1488 	int error;
1489 	nvlist_t *config, *props = NULL;
1490 	nvlist_t *rootprops = NULL;
1491 	nvlist_t *zplprops = NULL;
1492 
1493 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1494 	    zc->zc_iflags, &config))
1495 		return (error);
1496 
1497 	if (zc->zc_nvlist_src_size != 0 && (error =
1498 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1499 	    zc->zc_iflags, &props))) {
1500 		nvlist_free(config);
1501 		return (error);
1502 	}
1503 
1504 	if (props) {
1505 		nvlist_t *nvl = NULL;
1506 		uint64_t version = SPA_VERSION;
1507 
1508 		(void) nvlist_lookup_uint64(props,
1509 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1510 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1511 			error = SET_ERROR(EINVAL);
1512 			goto pool_props_bad;
1513 		}
1514 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1515 		if (nvl) {
1516 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1517 			if (error != 0) {
1518 				nvlist_free(config);
1519 				nvlist_free(props);
1520 				return (error);
1521 			}
1522 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1523 		}
1524 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1525 		error = zfs_fill_zplprops_root(version, rootprops,
1526 		    zplprops, NULL);
1527 		if (error != 0)
1528 			goto pool_props_bad;
1529 	}
1530 
1531 	error = spa_create(zc->zc_name, config, props, zplprops);
1532 
1533 	/*
1534 	 * Set the remaining root properties
1535 	 */
1536 	if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1537 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1538 		(void) spa_destroy(zc->zc_name);
1539 
1540 pool_props_bad:
1541 	nvlist_free(rootprops);
1542 	nvlist_free(zplprops);
1543 	nvlist_free(config);
1544 	nvlist_free(props);
1545 
1546 	return (error);
1547 }
1548 
1549 static int
1550 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1551 {
1552 	int error;
1553 	zfs_log_history(zc);
1554 	error = spa_destroy(zc->zc_name);
1555 	if (error == 0)
1556 		zvol_remove_minors(zc->zc_name);
1557 	return (error);
1558 }
1559 
1560 static int
1561 zfs_ioc_pool_import(zfs_cmd_t *zc)
1562 {
1563 	nvlist_t *config, *props = NULL;
1564 	uint64_t guid;
1565 	int error;
1566 
1567 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1568 	    zc->zc_iflags, &config)) != 0)
1569 		return (error);
1570 
1571 	if (zc->zc_nvlist_src_size != 0 && (error =
1572 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1573 	    zc->zc_iflags, &props))) {
1574 		nvlist_free(config);
1575 		return (error);
1576 	}
1577 
1578 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1579 	    guid != zc->zc_guid)
1580 		error = SET_ERROR(EINVAL);
1581 	else
1582 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1583 
1584 	if (zc->zc_nvlist_dst != 0) {
1585 		int err;
1586 
1587 		if ((err = put_nvlist(zc, config)) != 0)
1588 			error = err;
1589 	}
1590 
1591 	nvlist_free(config);
1592 
1593 	nvlist_free(props);
1594 
1595 	return (error);
1596 }
1597 
1598 static int
1599 zfs_ioc_pool_export(zfs_cmd_t *zc)
1600 {
1601 	int error;
1602 	boolean_t force = (boolean_t)zc->zc_cookie;
1603 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1604 
1605 	zfs_log_history(zc);
1606 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1607 	if (error == 0)
1608 		zvol_remove_minors(zc->zc_name);
1609 	return (error);
1610 }
1611 
1612 static int
1613 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1614 {
1615 	nvlist_t *configs;
1616 	int error;
1617 
1618 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1619 		return (SET_ERROR(EEXIST));
1620 
1621 	error = put_nvlist(zc, configs);
1622 
1623 	nvlist_free(configs);
1624 
1625 	return (error);
1626 }
1627 
1628 /*
1629  * inputs:
1630  * zc_name		name of the pool
1631  *
1632  * outputs:
1633  * zc_cookie		real errno
1634  * zc_nvlist_dst	config nvlist
1635  * zc_nvlist_dst_size	size of config nvlist
1636  */
1637 static int
1638 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1639 {
1640 	nvlist_t *config;
1641 	int error;
1642 	int ret = 0;
1643 
1644 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1645 	    sizeof (zc->zc_value));
1646 
1647 	if (config != NULL) {
1648 		ret = put_nvlist(zc, config);
1649 		nvlist_free(config);
1650 
1651 		/*
1652 		 * The config may be present even if 'error' is non-zero.
1653 		 * In this case we return success, and preserve the real errno
1654 		 * in 'zc_cookie'.
1655 		 */
1656 		zc->zc_cookie = error;
1657 	} else {
1658 		ret = error;
1659 	}
1660 
1661 	return (ret);
1662 }
1663 
1664 /*
1665  * Try to import the given pool, returning pool stats as appropriate so that
1666  * user land knows which devices are available and overall pool health.
1667  */
1668 static int
1669 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1670 {
1671 	nvlist_t *tryconfig, *config;
1672 	int error;
1673 
1674 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1675 	    zc->zc_iflags, &tryconfig)) != 0)
1676 		return (error);
1677 
1678 	config = spa_tryimport(tryconfig);
1679 
1680 	nvlist_free(tryconfig);
1681 
1682 	if (config == NULL)
1683 		return (SET_ERROR(EINVAL));
1684 
1685 	error = put_nvlist(zc, config);
1686 	nvlist_free(config);
1687 
1688 	return (error);
1689 }
1690 
1691 /*
1692  * inputs:
1693  * zc_name              name of the pool
1694  * zc_cookie            scan func (pool_scan_func_t)
1695  */
1696 static int
1697 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1698 {
1699 	spa_t *spa;
1700 	int error;
1701 
1702 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1703 		return (error);
1704 
1705 	if (zc->zc_cookie == POOL_SCAN_NONE)
1706 		error = spa_scan_stop(spa);
1707 	else
1708 		error = spa_scan(spa, zc->zc_cookie);
1709 
1710 	spa_close(spa, FTAG);
1711 
1712 	return (error);
1713 }
1714 
1715 static int
1716 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1717 {
1718 	spa_t *spa;
1719 	int error;
1720 
1721 	error = spa_open(zc->zc_name, &spa, FTAG);
1722 	if (error == 0) {
1723 		spa_freeze(spa);
1724 		spa_close(spa, FTAG);
1725 	}
1726 	return (error);
1727 }
1728 
1729 static int
1730 zfs_ioc_arc_info(zfs_cmd_t *zc)
1731 {
1732 	int ret;
1733 	void *buf;
1734 	size_t sz = zc->zc_nvlist_dst_size;
1735 	size_t returned_bytes;
1736 
1737 	if (zc->zc_nvlist_dst == 0)
1738 		return (SET_ERROR(EINVAL));
1739 
1740 	buf = kmem_alloc(sz, KM_NOSLEEP);
1741 	if (buf == NULL)
1742 		return (SET_ERROR(ENOMEM));
1743 
1744 	ret = arc_dump(zc->zc_obj, buf, sz, &returned_bytes);
1745 	if (ret != 0) {
1746 		kmem_free(buf, sz);
1747 		return (SET_ERROR(ret));
1748 	}
1749 
1750 	zc->zc_nvlist_dst_filled = 1;
1751 	ret = ddi_copyout(buf, (void *)(uintptr_t)zc->zc_nvlist_dst,
1752 	    returned_bytes, zc->zc_iflags);
1753 	kmem_free(buf, sz);
1754 	if (ret != 0)
1755 		ret = SET_ERROR(EFAULT);
1756 
1757 	return (ret);
1758 }
1759 
1760 static int
1761 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1762 {
1763 	spa_t *spa;
1764 	int error;
1765 
1766 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1767 		return (error);
1768 
1769 	if (zc->zc_cookie < spa_version(spa) ||
1770 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1771 		spa_close(spa, FTAG);
1772 		return (SET_ERROR(EINVAL));
1773 	}
1774 
1775 	spa_upgrade(spa, zc->zc_cookie);
1776 	spa_close(spa, FTAG);
1777 
1778 	return (error);
1779 }
1780 
1781 static int
1782 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1783 {
1784 	spa_t *spa;
1785 	char *hist_buf;
1786 	uint64_t size;
1787 	int error;
1788 
1789 	if ((size = zc->zc_history_len) == 0)
1790 		return (SET_ERROR(EINVAL));
1791 
1792 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1793 		return (error);
1794 
1795 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1796 		spa_close(spa, FTAG);
1797 		return (SET_ERROR(ENOTSUP));
1798 	}
1799 
1800 	hist_buf = kmem_alloc(size, KM_SLEEP);
1801 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1802 	    &zc->zc_history_len, hist_buf)) == 0) {
1803 		error = ddi_copyout(hist_buf,
1804 		    (void *)(uintptr_t)zc->zc_history,
1805 		    zc->zc_history_len, zc->zc_iflags);
1806 	}
1807 
1808 	spa_close(spa, FTAG);
1809 	kmem_free(hist_buf, size);
1810 	return (error);
1811 }
1812 
1813 static int
1814 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1815 {
1816 	spa_t *spa;
1817 	int error;
1818 
1819 	error = spa_open(zc->zc_name, &spa, FTAG);
1820 	if (error == 0) {
1821 		error = spa_change_guid(spa);
1822 		spa_close(spa, FTAG);
1823 	}
1824 	return (error);
1825 }
1826 
1827 static int
1828 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1829 {
1830 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1831 }
1832 
1833 /*
1834  * inputs:
1835  * zc_name		name of filesystem
1836  * zc_obj		object to find
1837  *
1838  * outputs:
1839  * zc_value		name of object
1840  */
1841 static int
1842 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1843 {
1844 	objset_t *os;
1845 	int error;
1846 
1847 	/* XXX reading from objset not owned */
1848 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1849 		return (error);
1850 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1851 		dmu_objset_rele(os, FTAG);
1852 		return (SET_ERROR(EINVAL));
1853 	}
1854 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1855 	    sizeof (zc->zc_value));
1856 	dmu_objset_rele(os, FTAG);
1857 
1858 	return (error);
1859 }
1860 
1861 /*
1862  * inputs:
1863  * zc_name		name of filesystem
1864  * zc_obj		object to find
1865  *
1866  * outputs:
1867  * zc_stat		stats on object
1868  * zc_value		path to object
1869  */
1870 static int
1871 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1872 {
1873 	objset_t *os;
1874 	int error;
1875 
1876 	/* XXX reading from objset not owned */
1877 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1878 		return (error);
1879 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1880 		dmu_objset_rele(os, FTAG);
1881 		return (SET_ERROR(EINVAL));
1882 	}
1883 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1884 	    sizeof (zc->zc_value));
1885 	dmu_objset_rele(os, FTAG);
1886 
1887 	return (error);
1888 }
1889 
1890 static int
1891 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1892 {
1893 	spa_t *spa;
1894 	int error;
1895 	nvlist_t *config, **l2cache, **spares;
1896 	uint_t nl2cache = 0, nspares = 0;
1897 
1898 	error = spa_open(zc->zc_name, &spa, FTAG);
1899 	if (error != 0)
1900 		return (error);
1901 
1902 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1903 	    zc->zc_iflags, &config);
1904 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1905 	    &l2cache, &nl2cache);
1906 
1907 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1908 	    &spares, &nspares);
1909 
1910 	/*
1911 	 * A root pool with concatenated devices is not supported.
1912 	 * Thus, can not add a device to a root pool.
1913 	 *
1914 	 * Intent log device can not be added to a rootpool because
1915 	 * during mountroot, zil is replayed, a seperated log device
1916 	 * can not be accessed during the mountroot time.
1917 	 *
1918 	 * l2cache and spare devices are ok to be added to a rootpool.
1919 	 */
1920 	if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1921 		nvlist_free(config);
1922 		spa_close(spa, FTAG);
1923 		return (SET_ERROR(EDOM));
1924 	}
1925 
1926 	if (error == 0) {
1927 		error = spa_vdev_add(spa, config);
1928 		nvlist_free(config);
1929 	}
1930 	spa_close(spa, FTAG);
1931 	return (error);
1932 }
1933 
1934 /*
1935  * inputs:
1936  * zc_name		name of the pool
1937  * zc_nvlist_conf	nvlist of devices to remove
1938  * zc_cookie		to stop the remove?
1939  */
1940 static int
1941 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1942 {
1943 	spa_t *spa;
1944 	int error;
1945 
1946 	error = spa_open(zc->zc_name, &spa, FTAG);
1947 	if (error != 0)
1948 		return (error);
1949 	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1950 	spa_close(spa, FTAG);
1951 	return (error);
1952 }
1953 
1954 static int
1955 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1956 {
1957 	spa_t *spa;
1958 	int error;
1959 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1960 
1961 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1962 		return (error);
1963 	switch (zc->zc_cookie) {
1964 	case VDEV_STATE_ONLINE:
1965 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1966 		break;
1967 
1968 	case VDEV_STATE_OFFLINE:
1969 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1970 		break;
1971 
1972 	case VDEV_STATE_FAULTED:
1973 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1974 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1975 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1976 
1977 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1978 		break;
1979 
1980 	case VDEV_STATE_DEGRADED:
1981 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1982 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1983 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1984 
1985 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1986 		break;
1987 
1988 	default:
1989 		error = SET_ERROR(EINVAL);
1990 	}
1991 	zc->zc_cookie = newstate;
1992 	spa_close(spa, FTAG);
1993 	return (error);
1994 }
1995 
1996 static int
1997 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1998 {
1999 	spa_t *spa;
2000 	int replacing = zc->zc_cookie;
2001 	nvlist_t *config;
2002 	int error;
2003 
2004 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2005 		return (error);
2006 
2007 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2008 	    zc->zc_iflags, &config)) == 0) {
2009 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
2010 		nvlist_free(config);
2011 	}
2012 
2013 	spa_close(spa, FTAG);
2014 	return (error);
2015 }
2016 
2017 static int
2018 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
2019 {
2020 	spa_t *spa;
2021 	int error;
2022 
2023 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2024 		return (error);
2025 
2026 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
2027 
2028 	spa_close(spa, FTAG);
2029 	return (error);
2030 }
2031 
2032 static int
2033 zfs_ioc_vdev_split(zfs_cmd_t *zc)
2034 {
2035 	spa_t *spa;
2036 	nvlist_t *config, *props = NULL;
2037 	int error;
2038 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
2039 
2040 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2041 		return (error);
2042 
2043 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2044 	    zc->zc_iflags, &config)) {
2045 		spa_close(spa, FTAG);
2046 		return (error);
2047 	}
2048 
2049 	if (zc->zc_nvlist_src_size != 0 && (error =
2050 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2051 	    zc->zc_iflags, &props))) {
2052 		spa_close(spa, FTAG);
2053 		nvlist_free(config);
2054 		return (error);
2055 	}
2056 
2057 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2058 
2059 	spa_close(spa, FTAG);
2060 
2061 	nvlist_free(config);
2062 	nvlist_free(props);
2063 
2064 	return (error);
2065 }
2066 
2067 static int
2068 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2069 {
2070 	spa_t *spa;
2071 	char *path = zc->zc_value;
2072 	uint64_t guid = zc->zc_guid;
2073 	int error;
2074 
2075 	error = spa_open(zc->zc_name, &spa, FTAG);
2076 	if (error != 0)
2077 		return (error);
2078 
2079 	error = spa_vdev_setpath(spa, guid, path);
2080 	spa_close(spa, FTAG);
2081 	return (error);
2082 }
2083 
2084 static int
2085 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2086 {
2087 	spa_t *spa;
2088 	char *fru = zc->zc_value;
2089 	uint64_t guid = zc->zc_guid;
2090 	int error;
2091 
2092 	error = spa_open(zc->zc_name, &spa, FTAG);
2093 	if (error != 0)
2094 		return (error);
2095 
2096 	error = spa_vdev_setfru(spa, guid, fru);
2097 	spa_close(spa, FTAG);
2098 	return (error);
2099 }
2100 
2101 static int
2102 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2103 {
2104 	int error = 0;
2105 	nvlist_t *nv;
2106 
2107 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2108 
2109 	if (zc->zc_nvlist_dst != 0 &&
2110 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2111 		dmu_objset_stats(os, nv);
2112 		/*
2113 		 * NB: zvol_get_stats() will read the objset contents,
2114 		 * which we aren't supposed to do with a
2115 		 * DS_MODE_USER hold, because it could be
2116 		 * inconsistent.  So this is a bit of a workaround...
2117 		 * XXX reading with out owning
2118 		 */
2119 		if (!zc->zc_objset_stats.dds_inconsistent &&
2120 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2121 			error = zvol_get_stats(os, nv);
2122 			if (error == EIO)
2123 				return (error);
2124 			VERIFY0(error);
2125 		}
2126 		error = put_nvlist(zc, nv);
2127 		nvlist_free(nv);
2128 	}
2129 
2130 	return (error);
2131 }
2132 
2133 /*
2134  * inputs:
2135  * zc_name		name of filesystem
2136  * zc_nvlist_dst_size	size of buffer for property nvlist
2137  *
2138  * outputs:
2139  * zc_objset_stats	stats
2140  * zc_nvlist_dst	property nvlist
2141  * zc_nvlist_dst_size	size of property nvlist
2142  */
2143 static int
2144 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2145 {
2146 	objset_t *os;
2147 	int error;
2148 
2149 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2150 	if (error == 0) {
2151 		error = zfs_ioc_objset_stats_impl(zc, os);
2152 		dmu_objset_rele(os, FTAG);
2153 	}
2154 
2155 	return (error);
2156 }
2157 
2158 /*
2159  * inputs:
2160  * zc_name		name of filesystem
2161  * zc_nvlist_dst_size	size of buffer for property nvlist
2162  *
2163  * outputs:
2164  * zc_nvlist_dst	received property nvlist
2165  * zc_nvlist_dst_size	size of received property nvlist
2166  *
2167  * Gets received properties (distinct from local properties on or after
2168  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2169  * local property values.
2170  */
2171 static int
2172 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2173 {
2174 	int error = 0;
2175 	nvlist_t *nv;
2176 
2177 	/*
2178 	 * Without this check, we would return local property values if the
2179 	 * caller has not already received properties on or after
2180 	 * SPA_VERSION_RECVD_PROPS.
2181 	 */
2182 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2183 		return (SET_ERROR(ENOTSUP));
2184 
2185 	if (zc->zc_nvlist_dst != 0 &&
2186 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2187 		error = put_nvlist(zc, nv);
2188 		nvlist_free(nv);
2189 	}
2190 
2191 	return (error);
2192 }
2193 
2194 static int
2195 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2196 {
2197 	uint64_t value;
2198 	int error;
2199 
2200 	/*
2201 	 * zfs_get_zplprop() will either find a value or give us
2202 	 * the default value (if there is one).
2203 	 */
2204 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2205 		return (error);
2206 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2207 	return (0);
2208 }
2209 
2210 /*
2211  * inputs:
2212  * zc_name		name of filesystem
2213  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2214  *
2215  * outputs:
2216  * zc_nvlist_dst	zpl property nvlist
2217  * zc_nvlist_dst_size	size of zpl property nvlist
2218  */
2219 static int
2220 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2221 {
2222 	objset_t *os;
2223 	int err;
2224 
2225 	/* XXX reading without owning */
2226 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2227 		return (err);
2228 
2229 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2230 
2231 	/*
2232 	 * NB: nvl_add_zplprop() will read the objset contents,
2233 	 * which we aren't supposed to do with a DS_MODE_USER
2234 	 * hold, because it could be inconsistent.
2235 	 */
2236 	if (zc->zc_nvlist_dst != NULL &&
2237 	    !zc->zc_objset_stats.dds_inconsistent &&
2238 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2239 		nvlist_t *nv;
2240 
2241 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2242 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2243 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2244 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2245 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2246 			err = put_nvlist(zc, nv);
2247 		nvlist_free(nv);
2248 	} else {
2249 		err = SET_ERROR(ENOENT);
2250 	}
2251 	dmu_objset_rele(os, FTAG);
2252 	return (err);
2253 }
2254 
2255 static boolean_t
2256 dataset_name_hidden(const char *name)
2257 {
2258 	/*
2259 	 * Skip over datasets that are not visible in this zone,
2260 	 * internal datasets (which have a $ in their name), and
2261 	 * temporary datasets (which have a % in their name).
2262 	 */
2263 	if (strchr(name, '$') != NULL)
2264 		return (B_TRUE);
2265 	if (strchr(name, '%') != NULL)
2266 		return (B_TRUE);
2267 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2268 		return (B_TRUE);
2269 	return (B_FALSE);
2270 }
2271 
2272 /*
2273  * inputs:
2274  * zc_name		name of filesystem
2275  * zc_cookie		zap cursor
2276  * zc_nvlist_dst_size	size of buffer for property nvlist
2277  *
2278  * outputs:
2279  * zc_name		name of next filesystem
2280  * zc_cookie		zap cursor
2281  * zc_objset_stats	stats
2282  * zc_nvlist_dst	property nvlist
2283  * zc_nvlist_dst_size	size of property nvlist
2284  */
2285 static int
2286 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2287 {
2288 	objset_t *os;
2289 	int error;
2290 	char *p;
2291 	size_t orig_len = strlen(zc->zc_name);
2292 
2293 top:
2294 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2295 		if (error == ENOENT)
2296 			error = SET_ERROR(ESRCH);
2297 		return (error);
2298 	}
2299 
2300 	p = strrchr(zc->zc_name, '/');
2301 	if (p == NULL || p[1] != '\0')
2302 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2303 	p = zc->zc_name + strlen(zc->zc_name);
2304 
2305 	do {
2306 		error = dmu_dir_list_next(os,
2307 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2308 		    NULL, &zc->zc_cookie);
2309 		if (error == ENOENT)
2310 			error = SET_ERROR(ESRCH);
2311 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2312 	dmu_objset_rele(os, FTAG);
2313 
2314 	/*
2315 	 * If it's an internal dataset (ie. with a '$' in its name),
2316 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2317 	 */
2318 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2319 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2320 		if (error == ENOENT) {
2321 			/* We lost a race with destroy, get the next one. */
2322 			zc->zc_name[orig_len] = '\0';
2323 			goto top;
2324 		}
2325 	}
2326 	return (error);
2327 }
2328 
2329 /*
2330  * inputs:
2331  * zc_name		name of filesystem
2332  * zc_cookie		zap cursor
2333  * zc_nvlist_dst_size	size of buffer for property nvlist
2334  *
2335  * outputs:
2336  * zc_name		name of next snapshot
2337  * zc_objset_stats	stats
2338  * zc_nvlist_dst	property nvlist
2339  * zc_nvlist_dst_size	size of property nvlist
2340  */
2341 static int
2342 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2343 {
2344 	objset_t *os;
2345 	int error;
2346 
2347 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2348 	if (error != 0) {
2349 		return (error == ENOENT ? ESRCH : error);
2350 	}
2351 
2352 	/*
2353 	 * A dataset name of maximum length cannot have any snapshots,
2354 	 * so exit immediately.
2355 	 */
2356 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
2357 		dmu_objset_rele(os, FTAG);
2358 		return (SET_ERROR(ESRCH));
2359 	}
2360 
2361 	error = dmu_snapshot_list_next(os,
2362 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2363 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2364 	    NULL);
2365 
2366 	if (error == 0) {
2367 		dsl_dataset_t *ds;
2368 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2369 
2370 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2371 		if (error == 0) {
2372 			objset_t *ossnap;
2373 
2374 			error = dmu_objset_from_ds(ds, &ossnap);
2375 			if (error == 0)
2376 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2377 			dsl_dataset_rele(ds, FTAG);
2378 		}
2379 	} else if (error == ENOENT) {
2380 		error = SET_ERROR(ESRCH);
2381 	}
2382 
2383 	dmu_objset_rele(os, FTAG);
2384 	/* if we failed, undo the @ that we tacked on to zc_name */
2385 	if (error != 0)
2386 		*strchr(zc->zc_name, '@') = '\0';
2387 	return (error);
2388 }
2389 
2390 static int
2391 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2392 {
2393 	const char *propname = nvpair_name(pair);
2394 	uint64_t *valary;
2395 	unsigned int vallen;
2396 	const char *domain;
2397 	char *dash;
2398 	zfs_userquota_prop_t type;
2399 	uint64_t rid;
2400 	uint64_t quota;
2401 	zfsvfs_t *zfsvfs;
2402 	int err;
2403 
2404 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2405 		nvlist_t *attrs;
2406 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2407 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2408 		    &pair) != 0)
2409 			return (SET_ERROR(EINVAL));
2410 	}
2411 
2412 	/*
2413 	 * A correctly constructed propname is encoded as
2414 	 * userquota@<rid>-<domain>.
2415 	 */
2416 	if ((dash = strchr(propname, '-')) == NULL ||
2417 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2418 	    vallen != 3)
2419 		return (SET_ERROR(EINVAL));
2420 
2421 	domain = dash + 1;
2422 	type = valary[0];
2423 	rid = valary[1];
2424 	quota = valary[2];
2425 
2426 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2427 	if (err == 0) {
2428 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2429 		zfsvfs_rele(zfsvfs, FTAG);
2430 	}
2431 
2432 	return (err);
2433 }
2434 
2435 /*
2436  * If the named property is one that has a special function to set its value,
2437  * return 0 on success and a positive error code on failure; otherwise if it is
2438  * not one of the special properties handled by this function, return -1.
2439  *
2440  * XXX: It would be better for callers of the property interface if we handled
2441  * these special cases in dsl_prop.c (in the dsl layer).
2442  */
2443 static int
2444 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2445     nvpair_t *pair)
2446 {
2447 	const char *propname = nvpair_name(pair);
2448 	zfs_prop_t prop = zfs_name_to_prop(propname);
2449 	uint64_t intval;
2450 	int err = -1;
2451 
2452 	if (prop == ZPROP_INVAL) {
2453 		if (zfs_prop_userquota(propname))
2454 			return (zfs_prop_set_userquota(dsname, pair));
2455 		return (-1);
2456 	}
2457 
2458 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2459 		nvlist_t *attrs;
2460 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2461 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2462 		    &pair) == 0);
2463 	}
2464 
2465 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2466 		return (-1);
2467 
2468 	VERIFY(0 == nvpair_value_uint64(pair, &intval));
2469 
2470 	switch (prop) {
2471 	case ZFS_PROP_QUOTA:
2472 		err = dsl_dir_set_quota(dsname, source, intval);
2473 		break;
2474 	case ZFS_PROP_REFQUOTA:
2475 		err = dsl_dataset_set_refquota(dsname, source, intval);
2476 		break;
2477 	case ZFS_PROP_FILESYSTEM_LIMIT:
2478 	case ZFS_PROP_SNAPSHOT_LIMIT:
2479 		if (intval == UINT64_MAX) {
2480 			/* clearing the limit, just do it */
2481 			err = 0;
2482 		} else {
2483 			err = dsl_dir_activate_fs_ss_limit(dsname);
2484 		}
2485 		/*
2486 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2487 		 * default path to set the value in the nvlist.
2488 		 */
2489 		if (err == 0)
2490 			err = -1;
2491 		break;
2492 	case ZFS_PROP_RESERVATION:
2493 		err = dsl_dir_set_reservation(dsname, source, intval);
2494 		break;
2495 	case ZFS_PROP_REFRESERVATION:
2496 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2497 		break;
2498 	case ZFS_PROP_VOLSIZE:
2499 		err = zvol_set_volsize(dsname, intval);
2500 		break;
2501 	case ZFS_PROP_VERSION:
2502 	{
2503 		zfsvfs_t *zfsvfs;
2504 
2505 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2506 			break;
2507 
2508 		err = zfs_set_version(zfsvfs, intval);
2509 		zfsvfs_rele(zfsvfs, FTAG);
2510 
2511 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2512 			zfs_cmd_t *zc;
2513 
2514 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2515 			(void) strcpy(zc->zc_name, dsname);
2516 			(void) zfs_ioc_userspace_upgrade(zc);
2517 			kmem_free(zc, sizeof (zfs_cmd_t));
2518 		}
2519 		break;
2520 	}
2521 	default:
2522 		err = -1;
2523 	}
2524 
2525 	return (err);
2526 }
2527 
2528 /*
2529  * This function is best effort. If it fails to set any of the given properties,
2530  * it continues to set as many as it can and returns the last error
2531  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2532  * with the list of names of all the properties that failed along with the
2533  * corresponding error numbers.
2534  *
2535  * If every property is set successfully, zero is returned and errlist is not
2536  * modified.
2537  */
2538 int
2539 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2540     nvlist_t *errlist)
2541 {
2542 	nvpair_t *pair;
2543 	nvpair_t *propval;
2544 	int rv = 0;
2545 	uint64_t intval;
2546 	char *strval;
2547 	nvlist_t *genericnvl = fnvlist_alloc();
2548 	nvlist_t *retrynvl = fnvlist_alloc();
2549 
2550 retry:
2551 	pair = NULL;
2552 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2553 		const char *propname = nvpair_name(pair);
2554 		zfs_prop_t prop = zfs_name_to_prop(propname);
2555 		int err = 0;
2556 
2557 		/* decode the property value */
2558 		propval = pair;
2559 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2560 			nvlist_t *attrs;
2561 			attrs = fnvpair_value_nvlist(pair);
2562 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2563 			    &propval) != 0)
2564 				err = SET_ERROR(EINVAL);
2565 		}
2566 
2567 		/* Validate value type */
2568 		if (err == 0 && prop == ZPROP_INVAL) {
2569 			if (zfs_prop_user(propname)) {
2570 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2571 					err = SET_ERROR(EINVAL);
2572 			} else if (zfs_prop_userquota(propname)) {
2573 				if (nvpair_type(propval) !=
2574 				    DATA_TYPE_UINT64_ARRAY)
2575 					err = SET_ERROR(EINVAL);
2576 			} else {
2577 				err = SET_ERROR(EINVAL);
2578 			}
2579 		} else if (err == 0) {
2580 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2581 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2582 					err = SET_ERROR(EINVAL);
2583 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2584 				const char *unused;
2585 
2586 				intval = fnvpair_value_uint64(propval);
2587 
2588 				switch (zfs_prop_get_type(prop)) {
2589 				case PROP_TYPE_NUMBER:
2590 					break;
2591 				case PROP_TYPE_STRING:
2592 					err = SET_ERROR(EINVAL);
2593 					break;
2594 				case PROP_TYPE_INDEX:
2595 					if (zfs_prop_index_to_string(prop,
2596 					    intval, &unused) != 0)
2597 						err = SET_ERROR(EINVAL);
2598 					break;
2599 				default:
2600 					cmn_err(CE_PANIC,
2601 					    "unknown property type");
2602 				}
2603 			} else {
2604 				err = SET_ERROR(EINVAL);
2605 			}
2606 		}
2607 
2608 		/* Validate permissions */
2609 		if (err == 0)
2610 			err = zfs_check_settable(dsname, pair, CRED());
2611 
2612 		if (err == 0) {
2613 			err = zfs_prop_set_special(dsname, source, pair);
2614 			if (err == -1) {
2615 				/*
2616 				 * For better performance we build up a list of
2617 				 * properties to set in a single transaction.
2618 				 */
2619 				err = nvlist_add_nvpair(genericnvl, pair);
2620 			} else if (err != 0 && nvl != retrynvl) {
2621 				/*
2622 				 * This may be a spurious error caused by
2623 				 * receiving quota and reservation out of order.
2624 				 * Try again in a second pass.
2625 				 */
2626 				err = nvlist_add_nvpair(retrynvl, pair);
2627 			}
2628 		}
2629 
2630 		if (err != 0) {
2631 			if (errlist != NULL)
2632 				fnvlist_add_int32(errlist, propname, err);
2633 			rv = err;
2634 		}
2635 	}
2636 
2637 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2638 		nvl = retrynvl;
2639 		goto retry;
2640 	}
2641 
2642 	if (!nvlist_empty(genericnvl) &&
2643 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2644 		/*
2645 		 * If this fails, we still want to set as many properties as we
2646 		 * can, so try setting them individually.
2647 		 */
2648 		pair = NULL;
2649 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2650 			const char *propname = nvpair_name(pair);
2651 			int err = 0;
2652 
2653 			propval = pair;
2654 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2655 				nvlist_t *attrs;
2656 				attrs = fnvpair_value_nvlist(pair);
2657 				propval = fnvlist_lookup_nvpair(attrs,
2658 				    ZPROP_VALUE);
2659 			}
2660 
2661 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2662 				strval = fnvpair_value_string(propval);
2663 				err = dsl_prop_set_string(dsname, propname,
2664 				    source, strval);
2665 			} else {
2666 				intval = fnvpair_value_uint64(propval);
2667 				err = dsl_prop_set_int(dsname, propname, source,
2668 				    intval);
2669 			}
2670 
2671 			if (err != 0) {
2672 				if (errlist != NULL) {
2673 					fnvlist_add_int32(errlist, propname,
2674 					    err);
2675 				}
2676 				rv = err;
2677 			}
2678 		}
2679 	}
2680 	nvlist_free(genericnvl);
2681 	nvlist_free(retrynvl);
2682 
2683 	return (rv);
2684 }
2685 
2686 /*
2687  * Check that all the properties are valid user properties.
2688  */
2689 static int
2690 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2691 {
2692 	nvpair_t *pair = NULL;
2693 	int error = 0;
2694 
2695 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2696 		const char *propname = nvpair_name(pair);
2697 
2698 		if (!zfs_prop_user(propname) ||
2699 		    nvpair_type(pair) != DATA_TYPE_STRING)
2700 			return (SET_ERROR(EINVAL));
2701 
2702 		if (error = zfs_secpolicy_write_perms(fsname,
2703 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2704 			return (error);
2705 
2706 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2707 			return (SET_ERROR(ENAMETOOLONG));
2708 
2709 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2710 			return (E2BIG);
2711 	}
2712 	return (0);
2713 }
2714 
2715 static void
2716 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2717 {
2718 	nvpair_t *pair;
2719 
2720 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2721 
2722 	pair = NULL;
2723 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2724 		if (nvlist_exists(skipped, nvpair_name(pair)))
2725 			continue;
2726 
2727 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2728 	}
2729 }
2730 
2731 static int
2732 clear_received_props(const char *dsname, nvlist_t *props,
2733     nvlist_t *skipped)
2734 {
2735 	int err = 0;
2736 	nvlist_t *cleared_props = NULL;
2737 	props_skip(props, skipped, &cleared_props);
2738 	if (!nvlist_empty(cleared_props)) {
2739 		/*
2740 		 * Acts on local properties until the dataset has received
2741 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2742 		 */
2743 		zprop_source_t flags = (ZPROP_SRC_NONE |
2744 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2745 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2746 	}
2747 	nvlist_free(cleared_props);
2748 	return (err);
2749 }
2750 
2751 /*
2752  * inputs:
2753  * zc_name		name of filesystem
2754  * zc_value		name of property to set
2755  * zc_nvlist_src{_size}	nvlist of properties to apply
2756  * zc_cookie		received properties flag
2757  *
2758  * outputs:
2759  * zc_nvlist_dst{_size} error for each unapplied received property
2760  */
2761 static int
2762 zfs_ioc_set_prop(zfs_cmd_t *zc)
2763 {
2764 	nvlist_t *nvl;
2765 	boolean_t received = zc->zc_cookie;
2766 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2767 	    ZPROP_SRC_LOCAL);
2768 	nvlist_t *errors;
2769 	int error;
2770 
2771 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2772 	    zc->zc_iflags, &nvl)) != 0)
2773 		return (error);
2774 
2775 	if (received) {
2776 		nvlist_t *origprops;
2777 
2778 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2779 			(void) clear_received_props(zc->zc_name,
2780 			    origprops, nvl);
2781 			nvlist_free(origprops);
2782 		}
2783 
2784 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2785 	}
2786 
2787 	errors = fnvlist_alloc();
2788 	if (error == 0)
2789 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2790 
2791 	if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2792 		(void) put_nvlist(zc, errors);
2793 	}
2794 
2795 	nvlist_free(errors);
2796 	nvlist_free(nvl);
2797 	return (error);
2798 }
2799 
2800 /*
2801  * inputs:
2802  * zc_name		name of filesystem
2803  * zc_value		name of property to inherit
2804  * zc_cookie		revert to received value if TRUE
2805  *
2806  * outputs:		none
2807  */
2808 static int
2809 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2810 {
2811 	const char *propname = zc->zc_value;
2812 	zfs_prop_t prop = zfs_name_to_prop(propname);
2813 	boolean_t received = zc->zc_cookie;
2814 	zprop_source_t source = (received
2815 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2816 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2817 
2818 	if (received) {
2819 		nvlist_t *dummy;
2820 		nvpair_t *pair;
2821 		zprop_type_t type;
2822 		int err;
2823 
2824 		/*
2825 		 * zfs_prop_set_special() expects properties in the form of an
2826 		 * nvpair with type info.
2827 		 */
2828 		if (prop == ZPROP_INVAL) {
2829 			if (!zfs_prop_user(propname))
2830 				return (SET_ERROR(EINVAL));
2831 
2832 			type = PROP_TYPE_STRING;
2833 		} else if (prop == ZFS_PROP_VOLSIZE ||
2834 		    prop == ZFS_PROP_VERSION) {
2835 			return (SET_ERROR(EINVAL));
2836 		} else {
2837 			type = zfs_prop_get_type(prop);
2838 		}
2839 
2840 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2841 
2842 		switch (type) {
2843 		case PROP_TYPE_STRING:
2844 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2845 			break;
2846 		case PROP_TYPE_NUMBER:
2847 		case PROP_TYPE_INDEX:
2848 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2849 			break;
2850 		default:
2851 			nvlist_free(dummy);
2852 			return (SET_ERROR(EINVAL));
2853 		}
2854 
2855 		pair = nvlist_next_nvpair(dummy, NULL);
2856 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2857 		nvlist_free(dummy);
2858 		if (err != -1)
2859 			return (err); /* special property already handled */
2860 	} else {
2861 		/*
2862 		 * Only check this in the non-received case. We want to allow
2863 		 * 'inherit -S' to revert non-inheritable properties like quota
2864 		 * and reservation to the received or default values even though
2865 		 * they are not considered inheritable.
2866 		 */
2867 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2868 			return (SET_ERROR(EINVAL));
2869 	}
2870 
2871 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2872 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2873 }
2874 
2875 static int
2876 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2877 {
2878 	nvlist_t *props;
2879 	spa_t *spa;
2880 	int error;
2881 	nvpair_t *pair;
2882 
2883 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2884 	    zc->zc_iflags, &props))
2885 		return (error);
2886 
2887 	/*
2888 	 * If the only property is the configfile, then just do a spa_lookup()
2889 	 * to handle the faulted case.
2890 	 */
2891 	pair = nvlist_next_nvpair(props, NULL);
2892 	if (pair != NULL && strcmp(nvpair_name(pair),
2893 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2894 	    nvlist_next_nvpair(props, pair) == NULL) {
2895 		mutex_enter(&spa_namespace_lock);
2896 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2897 			spa_configfile_set(spa, props, B_FALSE);
2898 			spa_config_sync(spa, B_FALSE, B_TRUE);
2899 		}
2900 		mutex_exit(&spa_namespace_lock);
2901 		if (spa != NULL) {
2902 			nvlist_free(props);
2903 			return (0);
2904 		}
2905 	}
2906 
2907 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2908 		nvlist_free(props);
2909 		return (error);
2910 	}
2911 
2912 	error = spa_prop_set(spa, props);
2913 
2914 	nvlist_free(props);
2915 	spa_close(spa, FTAG);
2916 
2917 	return (error);
2918 }
2919 
2920 static int
2921 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2922 {
2923 	spa_t *spa;
2924 	int error;
2925 	nvlist_t *nvp = NULL;
2926 
2927 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2928 		/*
2929 		 * If the pool is faulted, there may be properties we can still
2930 		 * get (such as altroot and cachefile), so attempt to get them
2931 		 * anyway.
2932 		 */
2933 		mutex_enter(&spa_namespace_lock);
2934 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
2935 			error = spa_prop_get(spa, &nvp);
2936 		mutex_exit(&spa_namespace_lock);
2937 	} else {
2938 		error = spa_prop_get(spa, &nvp);
2939 		spa_close(spa, FTAG);
2940 	}
2941 
2942 	if (error == 0 && zc->zc_nvlist_dst != NULL)
2943 		error = put_nvlist(zc, nvp);
2944 	else
2945 		error = SET_ERROR(EFAULT);
2946 
2947 	nvlist_free(nvp);
2948 	return (error);
2949 }
2950 
2951 /*
2952  * inputs:
2953  * zc_name		name of filesystem
2954  * zc_nvlist_src{_size}	nvlist of delegated permissions
2955  * zc_perm_action	allow/unallow flag
2956  *
2957  * outputs:		none
2958  */
2959 static int
2960 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2961 {
2962 	int error;
2963 	nvlist_t *fsaclnv = NULL;
2964 
2965 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2966 	    zc->zc_iflags, &fsaclnv)) != 0)
2967 		return (error);
2968 
2969 	/*
2970 	 * Verify nvlist is constructed correctly
2971 	 */
2972 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2973 		nvlist_free(fsaclnv);
2974 		return (SET_ERROR(EINVAL));
2975 	}
2976 
2977 	/*
2978 	 * If we don't have PRIV_SYS_MOUNT, then validate
2979 	 * that user is allowed to hand out each permission in
2980 	 * the nvlist(s)
2981 	 */
2982 
2983 	error = secpolicy_zfs(CRED());
2984 	if (error != 0) {
2985 		if (zc->zc_perm_action == B_FALSE) {
2986 			error = dsl_deleg_can_allow(zc->zc_name,
2987 			    fsaclnv, CRED());
2988 		} else {
2989 			error = dsl_deleg_can_unallow(zc->zc_name,
2990 			    fsaclnv, CRED());
2991 		}
2992 	}
2993 
2994 	if (error == 0)
2995 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2996 
2997 	nvlist_free(fsaclnv);
2998 	return (error);
2999 }
3000 
3001 /*
3002  * inputs:
3003  * zc_name		name of filesystem
3004  *
3005  * outputs:
3006  * zc_nvlist_src{_size}	nvlist of delegated permissions
3007  */
3008 static int
3009 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
3010 {
3011 	nvlist_t *nvp;
3012 	int error;
3013 
3014 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
3015 		error = put_nvlist(zc, nvp);
3016 		nvlist_free(nvp);
3017 	}
3018 
3019 	return (error);
3020 }
3021 
3022 /*
3023  * Search the vfs list for a specified resource.  Returns a pointer to it
3024  * or NULL if no suitable entry is found. The caller of this routine
3025  * is responsible for releasing the returned vfs pointer.
3026  */
3027 static vfs_t *
3028 zfs_get_vfs(const char *resource)
3029 {
3030 	struct vfs *vfsp;
3031 	struct vfs *vfs_found = NULL;
3032 
3033 	vfs_list_read_lock();
3034 	vfsp = rootvfs;
3035 	do {
3036 		if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
3037 			VFS_HOLD(vfsp);
3038 			vfs_found = vfsp;
3039 			break;
3040 		}
3041 		vfsp = vfsp->vfs_next;
3042 	} while (vfsp != rootvfs);
3043 	vfs_list_unlock();
3044 	return (vfs_found);
3045 }
3046 
3047 /* ARGSUSED */
3048 static void
3049 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
3050 {
3051 	zfs_creat_t *zct = arg;
3052 
3053 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
3054 }
3055 
3056 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3057 
3058 /*
3059  * inputs:
3060  * os			parent objset pointer (NULL if root fs)
3061  * fuids_ok		fuids allowed in this version of the spa?
3062  * sa_ok		SAs allowed in this version of the spa?
3063  * createprops		list of properties requested by creator
3064  *
3065  * outputs:
3066  * zplprops	values for the zplprops we attach to the master node object
3067  * is_ci	true if requested file system will be purely case-insensitive
3068  *
3069  * Determine the settings for utf8only, normalization and
3070  * casesensitivity.  Specific values may have been requested by the
3071  * creator and/or we can inherit values from the parent dataset.  If
3072  * the file system is of too early a vintage, a creator can not
3073  * request settings for these properties, even if the requested
3074  * setting is the default value.  We don't actually want to create dsl
3075  * properties for these, so remove them from the source nvlist after
3076  * processing.
3077  */
3078 static int
3079 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3080     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3081     nvlist_t *zplprops, boolean_t *is_ci)
3082 {
3083 	uint64_t sense = ZFS_PROP_UNDEFINED;
3084 	uint64_t norm = ZFS_PROP_UNDEFINED;
3085 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3086 
3087 	ASSERT(zplprops != NULL);
3088 
3089 	/*
3090 	 * Pull out creator prop choices, if any.
3091 	 */
3092 	if (createprops) {
3093 		(void) nvlist_lookup_uint64(createprops,
3094 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3095 		(void) nvlist_lookup_uint64(createprops,
3096 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3097 		(void) nvlist_remove_all(createprops,
3098 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3099 		(void) nvlist_lookup_uint64(createprops,
3100 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3101 		(void) nvlist_remove_all(createprops,
3102 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3103 		(void) nvlist_lookup_uint64(createprops,
3104 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3105 		(void) nvlist_remove_all(createprops,
3106 		    zfs_prop_to_name(ZFS_PROP_CASE));
3107 	}
3108 
3109 	/*
3110 	 * If the zpl version requested is whacky or the file system
3111 	 * or pool is version is too "young" to support normalization
3112 	 * and the creator tried to set a value for one of the props,
3113 	 * error out.
3114 	 */
3115 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3116 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3117 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3118 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3119 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3120 	    sense != ZFS_PROP_UNDEFINED)))
3121 		return (SET_ERROR(ENOTSUP));
3122 
3123 	/*
3124 	 * Put the version in the zplprops
3125 	 */
3126 	VERIFY(nvlist_add_uint64(zplprops,
3127 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3128 
3129 	if (norm == ZFS_PROP_UNDEFINED)
3130 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3131 	VERIFY(nvlist_add_uint64(zplprops,
3132 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3133 
3134 	/*
3135 	 * If we're normalizing, names must always be valid UTF-8 strings.
3136 	 */
3137 	if (norm)
3138 		u8 = 1;
3139 	if (u8 == ZFS_PROP_UNDEFINED)
3140 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3141 	VERIFY(nvlist_add_uint64(zplprops,
3142 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3143 
3144 	if (sense == ZFS_PROP_UNDEFINED)
3145 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3146 	VERIFY(nvlist_add_uint64(zplprops,
3147 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3148 
3149 	if (is_ci)
3150 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3151 
3152 	return (0);
3153 }
3154 
3155 static int
3156 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3157     nvlist_t *zplprops, boolean_t *is_ci)
3158 {
3159 	boolean_t fuids_ok, sa_ok;
3160 	uint64_t zplver = ZPL_VERSION;
3161 	objset_t *os = NULL;
3162 	char parentname[MAXNAMELEN];
3163 	char *cp;
3164 	spa_t *spa;
3165 	uint64_t spa_vers;
3166 	int error;
3167 
3168 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3169 	cp = strrchr(parentname, '/');
3170 	ASSERT(cp != NULL);
3171 	cp[0] = '\0';
3172 
3173 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3174 		return (error);
3175 
3176 	spa_vers = spa_version(spa);
3177 	spa_close(spa, FTAG);
3178 
3179 	zplver = zfs_zpl_version_map(spa_vers);
3180 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3181 	sa_ok = (zplver >= ZPL_VERSION_SA);
3182 
3183 	/*
3184 	 * Open parent object set so we can inherit zplprop values.
3185 	 */
3186 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3187 		return (error);
3188 
3189 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3190 	    zplprops, is_ci);
3191 	dmu_objset_rele(os, FTAG);
3192 	return (error);
3193 }
3194 
3195 static int
3196 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3197     nvlist_t *zplprops, boolean_t *is_ci)
3198 {
3199 	boolean_t fuids_ok;
3200 	boolean_t sa_ok;
3201 	uint64_t zplver = ZPL_VERSION;
3202 	int error;
3203 
3204 	zplver = zfs_zpl_version_map(spa_vers);
3205 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3206 	sa_ok = (zplver >= ZPL_VERSION_SA);
3207 
3208 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3209 	    createprops, zplprops, is_ci);
3210 	return (error);
3211 }
3212 
3213 /*
3214  * innvl: {
3215  *     "type" -> dmu_objset_type_t (int32)
3216  *     (optional) "props" -> { prop -> value }
3217  * }
3218  *
3219  * outnvl: propname -> error code (int32)
3220  */
3221 static int
3222 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3223 {
3224 	int error = 0;
3225 	zfs_creat_t zct = { 0 };
3226 	nvlist_t *nvprops = NULL;
3227 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3228 	int32_t type32;
3229 	dmu_objset_type_t type;
3230 	boolean_t is_insensitive = B_FALSE;
3231 
3232 	if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3233 		return (SET_ERROR(EINVAL));
3234 	type = type32;
3235 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3236 
3237 	switch (type) {
3238 	case DMU_OST_ZFS:
3239 		cbfunc = zfs_create_cb;
3240 		break;
3241 
3242 	case DMU_OST_ZVOL:
3243 		cbfunc = zvol_create_cb;
3244 		break;
3245 
3246 	default:
3247 		cbfunc = NULL;
3248 		break;
3249 	}
3250 	if (strchr(fsname, '@') ||
3251 	    strchr(fsname, '%'))
3252 		return (SET_ERROR(EINVAL));
3253 
3254 	zct.zct_props = nvprops;
3255 
3256 	if (cbfunc == NULL)
3257 		return (SET_ERROR(EINVAL));
3258 
3259 	if (type == DMU_OST_ZVOL) {
3260 		uint64_t volsize, volblocksize;
3261 
3262 		if (nvprops == NULL)
3263 			return (SET_ERROR(EINVAL));
3264 		if (nvlist_lookup_uint64(nvprops,
3265 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3266 			return (SET_ERROR(EINVAL));
3267 
3268 		if ((error = nvlist_lookup_uint64(nvprops,
3269 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3270 		    &volblocksize)) != 0 && error != ENOENT)
3271 			return (SET_ERROR(EINVAL));
3272 
3273 		if (error != 0)
3274 			volblocksize = zfs_prop_default_numeric(
3275 			    ZFS_PROP_VOLBLOCKSIZE);
3276 
3277 		if ((error = zvol_check_volblocksize(
3278 		    volblocksize)) != 0 ||
3279 		    (error = zvol_check_volsize(volsize,
3280 		    volblocksize)) != 0)
3281 			return (error);
3282 	} else if (type == DMU_OST_ZFS) {
3283 		int error;
3284 
3285 		/*
3286 		 * We have to have normalization and
3287 		 * case-folding flags correct when we do the
3288 		 * file system creation, so go figure them out
3289 		 * now.
3290 		 */
3291 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3292 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3293 		error = zfs_fill_zplprops(fsname, nvprops,
3294 		    zct.zct_zplprops, &is_insensitive);
3295 		if (error != 0) {
3296 			nvlist_free(zct.zct_zplprops);
3297 			return (error);
3298 		}
3299 	}
3300 
3301 	error = dmu_objset_create(fsname, type,
3302 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3303 	nvlist_free(zct.zct_zplprops);
3304 
3305 	/*
3306 	 * It would be nice to do this atomically.
3307 	 */
3308 	if (error == 0) {
3309 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3310 		    nvprops, outnvl);
3311 		if (error != 0)
3312 			(void) dsl_destroy_head(fsname);
3313 	}
3314 	return (error);
3315 }
3316 
3317 /*
3318  * innvl: {
3319  *     "origin" -> name of origin snapshot
3320  *     (optional) "props" -> { prop -> value }
3321  * }
3322  *
3323  * outnvl: propname -> error code (int32)
3324  */
3325 static int
3326 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3327 {
3328 	int error = 0;
3329 	nvlist_t *nvprops = NULL;
3330 	char *origin_name;
3331 
3332 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3333 		return (SET_ERROR(EINVAL));
3334 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3335 
3336 	if (strchr(fsname, '@') ||
3337 	    strchr(fsname, '%'))
3338 		return (SET_ERROR(EINVAL));
3339 
3340 	if (dataset_namecheck(origin_name, NULL, NULL) != 0 ||
3341 	    strchr(origin_name, '#') != NULL)
3342 		return (SET_ERROR(EINVAL));
3343 	error = dmu_objset_clone(fsname, origin_name);
3344 	if (error != 0)
3345 		return (error);
3346 
3347 	/*
3348 	 * It would be nice to do this atomically.
3349 	 */
3350 	if (error == 0) {
3351 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3352 		    nvprops, outnvl);
3353 		if (error != 0)
3354 			(void) dsl_destroy_head(fsname);
3355 	}
3356 	return (error);
3357 }
3358 
3359 /*
3360  * innvl: {
3361  *     "snaps" -> { snapshot1, snapshot2 }
3362  *     (optional) "props" -> { prop -> value (string) }
3363  * }
3364  *
3365  * outnvl: snapshot -> error code (int32)
3366  */
3367 static int
3368 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3369 {
3370 	nvlist_t *snaps;
3371 	nvlist_t *props = NULL;
3372 	int error, poollen;
3373 	nvpair_t *pair;
3374 
3375 	(void) nvlist_lookup_nvlist(innvl, "props", &props);
3376 	if ((error = zfs_check_userprops(poolname, props)) != 0)
3377 		return (error);
3378 
3379 	if (!nvlist_empty(props) &&
3380 	    zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3381 		return (SET_ERROR(ENOTSUP));
3382 
3383 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3384 		return (SET_ERROR(EINVAL));
3385 	poollen = strlen(poolname);
3386 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3387 	    pair = nvlist_next_nvpair(snaps, pair)) {
3388 		const char *name = nvpair_name(pair);
3389 		const char *cp = strchr(name, '@');
3390 
3391 		/*
3392 		 * The snap name must contain an @, and the part after it must
3393 		 * contain only valid characters.
3394 		 */
3395 		if (cp == NULL ||
3396 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3397 			return (SET_ERROR(EINVAL));
3398 
3399 		/*
3400 		 * The snap must be in the specified pool.
3401 		 */
3402 		if (strncmp(name, poolname, poollen) != 0 ||
3403 		    (name[poollen] != '/' && name[poollen] != '@'))
3404 			return (SET_ERROR(EXDEV));
3405 
3406 		/* This must be the only snap of this fs. */
3407 		for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3408 		    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3409 			if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3410 			    == 0) {
3411 				return (SET_ERROR(EXDEV));
3412 			}
3413 		}
3414 	}
3415 
3416 	error = dsl_dataset_snapshot(snaps, props, outnvl);
3417 	return (error);
3418 }
3419 
3420 /*
3421  * innvl: "message" -> string
3422  */
3423 /* ARGSUSED */
3424 static int
3425 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3426 {
3427 	char *message;
3428 	spa_t *spa;
3429 	int error;
3430 	char *poolname;
3431 
3432 	/*
3433 	 * The poolname in the ioctl is not set, we get it from the TSD,
3434 	 * which was set at the end of the last successful ioctl that allows
3435 	 * logging.  The secpolicy func already checked that it is set.
3436 	 * Only one log ioctl is allowed after each successful ioctl, so
3437 	 * we clear the TSD here.
3438 	 */
3439 	poolname = tsd_get(zfs_allow_log_key);
3440 	(void) tsd_set(zfs_allow_log_key, NULL);
3441 	error = spa_open(poolname, &spa, FTAG);
3442 	strfree(poolname);
3443 	if (error != 0)
3444 		return (error);
3445 
3446 	if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3447 		spa_close(spa, FTAG);
3448 		return (SET_ERROR(EINVAL));
3449 	}
3450 
3451 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3452 		spa_close(spa, FTAG);
3453 		return (SET_ERROR(ENOTSUP));
3454 	}
3455 
3456 	error = spa_history_log(spa, message);
3457 	spa_close(spa, FTAG);
3458 	return (error);
3459 }
3460 
3461 /*
3462  * The dp_config_rwlock must not be held when calling this, because the
3463  * unmount may need to write out data.
3464  *
3465  * This function is best-effort.  Callers must deal gracefully if it
3466  * remains mounted (or is remounted after this call).
3467  *
3468  * Returns 0 if the argument is not a snapshot, or it is not currently a
3469  * filesystem, or we were able to unmount it.  Returns error code otherwise.
3470  */
3471 int
3472 zfs_unmount_snap(const char *snapname)
3473 {
3474 	vfs_t *vfsp;
3475 	zfsvfs_t *zfsvfs;
3476 	int err;
3477 
3478 	if (strchr(snapname, '@') == NULL)
3479 		return (0);
3480 
3481 	vfsp = zfs_get_vfs(snapname);
3482 	if (vfsp == NULL)
3483 		return (0);
3484 
3485 	zfsvfs = vfsp->vfs_data;
3486 	ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3487 
3488 	err = vn_vfswlock(vfsp->vfs_vnodecovered);
3489 	VFS_RELE(vfsp);
3490 	if (err != 0)
3491 		return (SET_ERROR(err));
3492 
3493 	/*
3494 	 * Always force the unmount for snapshots.
3495 	 */
3496 	(void) dounmount(vfsp, MS_FORCE, kcred);
3497 	return (0);
3498 }
3499 
3500 /* ARGSUSED */
3501 static int
3502 zfs_unmount_snap_cb(const char *snapname, void *arg)
3503 {
3504 	return (zfs_unmount_snap(snapname));
3505 }
3506 
3507 /*
3508  * When a clone is destroyed, its origin may also need to be destroyed,
3509  * in which case it must be unmounted.  This routine will do that unmount
3510  * if necessary.
3511  */
3512 void
3513 zfs_destroy_unmount_origin(const char *fsname)
3514 {
3515 	int error;
3516 	objset_t *os;
3517 	dsl_dataset_t *ds;
3518 
3519 	error = dmu_objset_hold(fsname, FTAG, &os);
3520 	if (error != 0)
3521 		return;
3522 	ds = dmu_objset_ds(os);
3523 	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3524 		char originname[MAXNAMELEN];
3525 		dsl_dataset_name(ds->ds_prev, originname);
3526 		dmu_objset_rele(os, FTAG);
3527 		(void) zfs_unmount_snap(originname);
3528 	} else {
3529 		dmu_objset_rele(os, FTAG);
3530 	}
3531 }
3532 
3533 /*
3534  * innvl: {
3535  *     "snaps" -> { snapshot1, snapshot2 }
3536  *     (optional boolean) "defer"
3537  * }
3538  *
3539  * outnvl: snapshot -> error code (int32)
3540  *
3541  */
3542 /* ARGSUSED */
3543 static int
3544 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3545 {
3546 	nvlist_t *snaps;
3547 	nvpair_t *pair;
3548 	boolean_t defer;
3549 
3550 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3551 		return (SET_ERROR(EINVAL));
3552 	defer = nvlist_exists(innvl, "defer");
3553 
3554 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3555 	    pair = nvlist_next_nvpair(snaps, pair)) {
3556 		(void) zfs_unmount_snap(nvpair_name(pair));
3557 	}
3558 
3559 	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3560 }
3561 
3562 /*
3563  * Create bookmarks.  Bookmark names are of the form <fs>#<bmark>.
3564  * All bookmarks must be in the same pool.
3565  *
3566  * innvl: {
3567  *     bookmark1 -> snapshot1, bookmark2 -> snapshot2
3568  * }
3569  *
3570  * outnvl: bookmark -> error code (int32)
3571  *
3572  */
3573 /* ARGSUSED */
3574 static int
3575 zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3576 {
3577 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3578 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3579 		char *snap_name;
3580 
3581 		/*
3582 		 * Verify the snapshot argument.
3583 		 */
3584 		if (nvpair_value_string(pair, &snap_name) != 0)
3585 			return (SET_ERROR(EINVAL));
3586 
3587 
3588 		/* Verify that the keys (bookmarks) are unique */
3589 		for (nvpair_t *pair2 = nvlist_next_nvpair(innvl, pair);
3590 		    pair2 != NULL; pair2 = nvlist_next_nvpair(innvl, pair2)) {
3591 			if (strcmp(nvpair_name(pair), nvpair_name(pair2)) == 0)
3592 				return (SET_ERROR(EINVAL));
3593 		}
3594 	}
3595 
3596 	return (dsl_bookmark_create(innvl, outnvl));
3597 }
3598 
3599 /*
3600  * innvl: {
3601  *     property 1, property 2, ...
3602  * }
3603  *
3604  * outnvl: {
3605  *     bookmark name 1 -> { property 1, property 2, ... },
3606  *     bookmark name 2 -> { property 1, property 2, ... }
3607  * }
3608  *
3609  */
3610 static int
3611 zfs_ioc_get_bookmarks(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3612 {
3613 	return (dsl_get_bookmarks(fsname, innvl, outnvl));
3614 }
3615 
3616 /*
3617  * innvl: {
3618  *     bookmark name 1, bookmark name 2
3619  * }
3620  *
3621  * outnvl: bookmark -> error code (int32)
3622  *
3623  */
3624 static int
3625 zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
3626     nvlist_t *outnvl)
3627 {
3628 	int error, poollen;
3629 
3630 	poollen = strlen(poolname);
3631 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3632 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3633 		const char *name = nvpair_name(pair);
3634 		const char *cp = strchr(name, '#');
3635 
3636 		/*
3637 		 * The bookmark name must contain an #, and the part after it
3638 		 * must contain only valid characters.
3639 		 */
3640 		if (cp == NULL ||
3641 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3642 			return (SET_ERROR(EINVAL));
3643 
3644 		/*
3645 		 * The bookmark must be in the specified pool.
3646 		 */
3647 		if (strncmp(name, poolname, poollen) != 0 ||
3648 		    (name[poollen] != '/' && name[poollen] != '#'))
3649 			return (SET_ERROR(EXDEV));
3650 	}
3651 
3652 	error = dsl_bookmark_destroy(innvl, outnvl);
3653 	return (error);
3654 }
3655 
3656 /*
3657  * inputs:
3658  * zc_name		name of dataset to destroy
3659  * zc_objset_type	type of objset
3660  * zc_defer_destroy	mark for deferred destroy
3661  *
3662  * outputs:		none
3663  */
3664 static int
3665 zfs_ioc_destroy(zfs_cmd_t *zc)
3666 {
3667 	int err;
3668 
3669 	if (zc->zc_objset_type == DMU_OST_ZFS) {
3670 		err = zfs_unmount_snap(zc->zc_name);
3671 		if (err != 0)
3672 			return (err);
3673 	}
3674 
3675 	if (strchr(zc->zc_name, '@'))
3676 		err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3677 	else
3678 		err = dsl_destroy_head(zc->zc_name);
3679 	if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3680 		(void) zvol_remove_minor(zc->zc_name);
3681 	return (err);
3682 }
3683 
3684 /*
3685  * fsname is name of dataset to rollback (to most recent snapshot)
3686  *
3687  * innvl is not used.
3688  *
3689  * outnvl: "target" -> name of most recent snapshot
3690  * }
3691  */
3692 /* ARGSUSED */
3693 static int
3694 zfs_ioc_rollback(const char *fsname, nvlist_t *args, nvlist_t *outnvl)
3695 {
3696 	zfsvfs_t *zfsvfs;
3697 	int error;
3698 
3699 	if (getzfsvfs(fsname, &zfsvfs) == 0) {
3700 		error = zfs_suspend_fs(zfsvfs);
3701 		if (error == 0) {
3702 			int resume_err;
3703 
3704 			error = dsl_dataset_rollback(fsname, zfsvfs, outnvl);
3705 			resume_err = zfs_resume_fs(zfsvfs, fsname);
3706 			error = error ? error : resume_err;
3707 		}
3708 		VFS_RELE(zfsvfs->z_vfs);
3709 	} else {
3710 		error = dsl_dataset_rollback(fsname, NULL, outnvl);
3711 	}
3712 	return (error);
3713 }
3714 
3715 static int
3716 recursive_unmount(const char *fsname, void *arg)
3717 {
3718 	const char *snapname = arg;
3719 	char fullname[MAXNAMELEN];
3720 
3721 	(void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
3722 	return (zfs_unmount_snap(fullname));
3723 }
3724 
3725 /*
3726  * inputs:
3727  * zc_name	old name of dataset
3728  * zc_value	new name of dataset
3729  * zc_cookie	recursive flag (only valid for snapshots)
3730  *
3731  * outputs:	none
3732  */
3733 static int
3734 zfs_ioc_rename(zfs_cmd_t *zc)
3735 {
3736 	boolean_t recursive = zc->zc_cookie & 1;
3737 	char *at;
3738 
3739 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3740 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3741 	    strchr(zc->zc_value, '#') != NULL ||
3742 	    strchr(zc->zc_value, '%') != NULL)
3743 		return (SET_ERROR(EINVAL));
3744 
3745 	at = strchr(zc->zc_name, '@');
3746 	if (at != NULL) {
3747 		/* snaps must be in same fs */
3748 		int error;
3749 
3750 		if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
3751 			return (SET_ERROR(EXDEV));
3752 		*at = '\0';
3753 		if (zc->zc_objset_type == DMU_OST_ZFS) {
3754 			error = dmu_objset_find(zc->zc_name,
3755 			    recursive_unmount, at + 1,
3756 			    recursive ? DS_FIND_CHILDREN : 0);
3757 			if (error != 0) {
3758 				*at = '@';
3759 				return (error);
3760 			}
3761 		}
3762 		error = dsl_dataset_rename_snapshot(zc->zc_name,
3763 		    at + 1, strchr(zc->zc_value, '@') + 1, recursive);
3764 		*at = '@';
3765 
3766 		return (error);
3767 	} else {
3768 		if (zc->zc_objset_type == DMU_OST_ZVOL)
3769 			(void) zvol_remove_minor(zc->zc_name);
3770 		return (dsl_dir_rename(zc->zc_name, zc->zc_value));
3771 	}
3772 }
3773 
3774 static int
3775 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3776 {
3777 	const char *propname = nvpair_name(pair);
3778 	boolean_t issnap = (strchr(dsname, '@') != NULL);
3779 	zfs_prop_t prop = zfs_name_to_prop(propname);
3780 	uint64_t intval;
3781 	int err;
3782 
3783 	if (prop == ZPROP_INVAL) {
3784 		if (zfs_prop_user(propname)) {
3785 			if (err = zfs_secpolicy_write_perms(dsname,
3786 			    ZFS_DELEG_PERM_USERPROP, cr))
3787 				return (err);
3788 			return (0);
3789 		}
3790 
3791 		if (!issnap && zfs_prop_userquota(propname)) {
3792 			const char *perm = NULL;
3793 			const char *uq_prefix =
3794 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3795 			const char *gq_prefix =
3796 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3797 
3798 			if (strncmp(propname, uq_prefix,
3799 			    strlen(uq_prefix)) == 0) {
3800 				perm = ZFS_DELEG_PERM_USERQUOTA;
3801 			} else if (strncmp(propname, gq_prefix,
3802 			    strlen(gq_prefix)) == 0) {
3803 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
3804 			} else {
3805 				/* USERUSED and GROUPUSED are read-only */
3806 				return (SET_ERROR(EINVAL));
3807 			}
3808 
3809 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3810 				return (err);
3811 			return (0);
3812 		}
3813 
3814 		return (SET_ERROR(EINVAL));
3815 	}
3816 
3817 	if (issnap)
3818 		return (SET_ERROR(EINVAL));
3819 
3820 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3821 		/*
3822 		 * dsl_prop_get_all_impl() returns properties in this
3823 		 * format.
3824 		 */
3825 		nvlist_t *attrs;
3826 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3827 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3828 		    &pair) == 0);
3829 	}
3830 
3831 	/*
3832 	 * Check that this value is valid for this pool version
3833 	 */
3834 	switch (prop) {
3835 	case ZFS_PROP_COMPRESSION:
3836 		/*
3837 		 * If the user specified gzip compression, make sure
3838 		 * the SPA supports it. We ignore any errors here since
3839 		 * we'll catch them later.
3840 		 */
3841 		if (nvpair_value_uint64(pair, &intval) == 0) {
3842 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
3843 			    intval <= ZIO_COMPRESS_GZIP_9 &&
3844 			    zfs_earlier_version(dsname,
3845 			    SPA_VERSION_GZIP_COMPRESSION)) {
3846 				return (SET_ERROR(ENOTSUP));
3847 			}
3848 
3849 			if (intval == ZIO_COMPRESS_ZLE &&
3850 			    zfs_earlier_version(dsname,
3851 			    SPA_VERSION_ZLE_COMPRESSION))
3852 				return (SET_ERROR(ENOTSUP));
3853 
3854 			if (intval == ZIO_COMPRESS_LZ4) {
3855 				spa_t *spa;
3856 
3857 				if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3858 					return (err);
3859 
3860 				if (!spa_feature_is_enabled(spa,
3861 				    SPA_FEATURE_LZ4_COMPRESS)) {
3862 					spa_close(spa, FTAG);
3863 					return (SET_ERROR(ENOTSUP));
3864 				}
3865 				spa_close(spa, FTAG);
3866 			}
3867 
3868 			/*
3869 			 * If this is a bootable dataset then
3870 			 * verify that the compression algorithm
3871 			 * is supported for booting. We must return
3872 			 * something other than ENOTSUP since it
3873 			 * implies a downrev pool version.
3874 			 */
3875 			if (zfs_is_bootfs(dsname) &&
3876 			    !BOOTFS_COMPRESS_VALID(intval)) {
3877 				return (SET_ERROR(ERANGE));
3878 			}
3879 		}
3880 		break;
3881 
3882 	case ZFS_PROP_COPIES:
3883 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3884 			return (SET_ERROR(ENOTSUP));
3885 		break;
3886 
3887 	case ZFS_PROP_RECORDSIZE:
3888 		/* Record sizes above 128k need the feature to be enabled */
3889 		if (nvpair_value_uint64(pair, &intval) == 0 &&
3890 		    intval > SPA_OLD_MAXBLOCKSIZE) {
3891 			spa_t *spa;
3892 
3893 			/*
3894 			 * If this is a bootable dataset then
3895 			 * the we don't allow large (>128K) blocks,
3896 			 * because GRUB doesn't support them.
3897 			 */
3898 			if (zfs_is_bootfs(dsname) &&
3899 			    intval > SPA_OLD_MAXBLOCKSIZE) {
3900 				return (SET_ERROR(ERANGE));
3901 			}
3902 
3903 			/*
3904 			 * We don't allow setting the property above 1MB,
3905 			 * unless the tunable has been changed.
3906 			 */
3907 			if (intval > zfs_max_recordsize ||
3908 			    intval > SPA_MAXBLOCKSIZE)
3909 				return (SET_ERROR(ERANGE));
3910 
3911 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3912 				return (err);
3913 
3914 			if (!spa_feature_is_enabled(spa,
3915 			    SPA_FEATURE_LARGE_BLOCKS)) {
3916 				spa_close(spa, FTAG);
3917 				return (SET_ERROR(ENOTSUP));
3918 			}
3919 			spa_close(spa, FTAG);
3920 		}
3921 		break;
3922 
3923 	case ZFS_PROP_SHARESMB:
3924 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3925 			return (SET_ERROR(ENOTSUP));
3926 		break;
3927 
3928 	case ZFS_PROP_ACLINHERIT:
3929 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3930 		    nvpair_value_uint64(pair, &intval) == 0) {
3931 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
3932 			    zfs_earlier_version(dsname,
3933 			    SPA_VERSION_PASSTHROUGH_X))
3934 				return (SET_ERROR(ENOTSUP));
3935 		}
3936 		break;
3937 
3938 	case ZFS_PROP_CHECKSUM:
3939 	case ZFS_PROP_DEDUP:
3940 	{
3941 		spa_feature_t feature;
3942 		spa_t *spa;
3943 
3944 		/* dedup feature version checks */
3945 		if (prop == ZFS_PROP_DEDUP &&
3946 		    zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3947 			return (SET_ERROR(ENOTSUP));
3948 
3949 		if (nvpair_value_uint64(pair, &intval) != 0)
3950 			return (SET_ERROR(EINVAL));
3951 
3952 		/* check prop value is enabled in features */
3953 		feature = zio_checksum_to_feature(intval & ZIO_CHECKSUM_MASK);
3954 		if (feature == SPA_FEATURE_NONE)
3955 			break;
3956 
3957 		if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3958 			return (err);
3959 		/*
3960 		 * Salted checksums are not supported on root pools.
3961 		 */
3962 		if (spa_bootfs(spa) != 0 &&
3963 		    intval < ZIO_CHECKSUM_FUNCTIONS &&
3964 		    (zio_checksum_table[intval].ci_flags &
3965 		    ZCHECKSUM_FLAG_SALTED)) {
3966 			spa_close(spa, FTAG);
3967 			return (SET_ERROR(ERANGE));
3968 		}
3969 		if (!spa_feature_is_enabled(spa, feature)) {
3970 			spa_close(spa, FTAG);
3971 			return (SET_ERROR(ENOTSUP));
3972 		}
3973 		spa_close(spa, FTAG);
3974 		break;
3975 	}
3976 	}
3977 
3978 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3979 }
3980 
3981 /*
3982  * Checks for a race condition to make sure we don't increment a feature flag
3983  * multiple times.
3984  */
3985 static int
3986 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
3987 {
3988 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3989 	spa_feature_t *featurep = arg;
3990 
3991 	if (!spa_feature_is_active(spa, *featurep))
3992 		return (0);
3993 	else
3994 		return (SET_ERROR(EBUSY));
3995 }
3996 
3997 /*
3998  * The callback invoked on feature activation in the sync task caused by
3999  * zfs_prop_activate_feature.
4000  */
4001 static void
4002 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
4003 {
4004 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
4005 	spa_feature_t *featurep = arg;
4006 
4007 	spa_feature_incr(spa, *featurep, tx);
4008 }
4009 
4010 /*
4011  * Activates a feature on a pool in response to a property setting. This
4012  * creates a new sync task which modifies the pool to reflect the feature
4013  * as being active.
4014  */
4015 static int
4016 zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature)
4017 {
4018 	int err;
4019 
4020 	/* EBUSY here indicates that the feature is already active */
4021 	err = dsl_sync_task(spa_name(spa),
4022 	    zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
4023 	    &feature, 2, ZFS_SPACE_CHECK_RESERVED);
4024 
4025 	if (err != 0 && err != EBUSY)
4026 		return (err);
4027 	else
4028 		return (0);
4029 }
4030 
4031 /*
4032  * Removes properties from the given props list that fail permission checks
4033  * needed to clear them and to restore them in case of a receive error. For each
4034  * property, make sure we have both set and inherit permissions.
4035  *
4036  * Returns the first error encountered if any permission checks fail. If the
4037  * caller provides a non-NULL errlist, it also gives the complete list of names
4038  * of all the properties that failed a permission check along with the
4039  * corresponding error numbers. The caller is responsible for freeing the
4040  * returned errlist.
4041  *
4042  * If every property checks out successfully, zero is returned and the list
4043  * pointed at by errlist is NULL.
4044  */
4045 static int
4046 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
4047 {
4048 	zfs_cmd_t *zc;
4049 	nvpair_t *pair, *next_pair;
4050 	nvlist_t *errors;
4051 	int err, rv = 0;
4052 
4053 	if (props == NULL)
4054 		return (0);
4055 
4056 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4057 
4058 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
4059 	(void) strcpy(zc->zc_name, dataset);
4060 	pair = nvlist_next_nvpair(props, NULL);
4061 	while (pair != NULL) {
4062 		next_pair = nvlist_next_nvpair(props, pair);
4063 
4064 		(void) strcpy(zc->zc_value, nvpair_name(pair));
4065 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
4066 		    (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
4067 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
4068 			VERIFY(nvlist_add_int32(errors,
4069 			    zc->zc_value, err) == 0);
4070 		}
4071 		pair = next_pair;
4072 	}
4073 	kmem_free(zc, sizeof (zfs_cmd_t));
4074 
4075 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
4076 		nvlist_free(errors);
4077 		errors = NULL;
4078 	} else {
4079 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
4080 	}
4081 
4082 	if (errlist == NULL)
4083 		nvlist_free(errors);
4084 	else
4085 		*errlist = errors;
4086 
4087 	return (rv);
4088 }
4089 
4090 static boolean_t
4091 propval_equals(nvpair_t *p1, nvpair_t *p2)
4092 {
4093 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
4094 		/* dsl_prop_get_all_impl() format */
4095 		nvlist_t *attrs;
4096 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
4097 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4098 		    &p1) == 0);
4099 	}
4100 
4101 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
4102 		nvlist_t *attrs;
4103 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
4104 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4105 		    &p2) == 0);
4106 	}
4107 
4108 	if (nvpair_type(p1) != nvpair_type(p2))
4109 		return (B_FALSE);
4110 
4111 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
4112 		char *valstr1, *valstr2;
4113 
4114 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
4115 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
4116 		return (strcmp(valstr1, valstr2) == 0);
4117 	} else {
4118 		uint64_t intval1, intval2;
4119 
4120 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
4121 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
4122 		return (intval1 == intval2);
4123 	}
4124 }
4125 
4126 /*
4127  * Remove properties from props if they are not going to change (as determined
4128  * by comparison with origprops). Remove them from origprops as well, since we
4129  * do not need to clear or restore properties that won't change.
4130  */
4131 static void
4132 props_reduce(nvlist_t *props, nvlist_t *origprops)
4133 {
4134 	nvpair_t *pair, *next_pair;
4135 
4136 	if (origprops == NULL)
4137 		return; /* all props need to be received */
4138 
4139 	pair = nvlist_next_nvpair(props, NULL);
4140 	while (pair != NULL) {
4141 		const char *propname = nvpair_name(pair);
4142 		nvpair_t *match;
4143 
4144 		next_pair = nvlist_next_nvpair(props, pair);
4145 
4146 		if ((nvlist_lookup_nvpair(origprops, propname,
4147 		    &match) != 0) || !propval_equals(pair, match))
4148 			goto next; /* need to set received value */
4149 
4150 		/* don't clear the existing received value */
4151 		(void) nvlist_remove_nvpair(origprops, match);
4152 		/* don't bother receiving the property */
4153 		(void) nvlist_remove_nvpair(props, pair);
4154 next:
4155 		pair = next_pair;
4156 	}
4157 }
4158 
4159 /*
4160  * Extract properties that cannot be set PRIOR to the receipt of a dataset.
4161  * For example, refquota cannot be set until after the receipt of a dataset,
4162  * because in replication streams, an older/earlier snapshot may exceed the
4163  * refquota.  We want to receive the older/earlier snapshot, but setting
4164  * refquota pre-receipt will set the dsl's ACTUAL quota, which will prevent
4165  * the older/earlier snapshot from being received (with EDQUOT).
4166  *
4167  * The ZFS test "zfs_receive_011_pos" demonstrates such a scenario.
4168  *
4169  * libzfs will need to be judicious handling errors encountered by props
4170  * extracted by this function.
4171  */
4172 static nvlist_t *
4173 extract_delay_props(nvlist_t *props)
4174 {
4175 	nvlist_t *delayprops;
4176 	nvpair_t *nvp, *tmp;
4177 	static const zfs_prop_t delayable[] = { ZFS_PROP_REFQUOTA, 0 };
4178 	int i;
4179 
4180 	VERIFY(nvlist_alloc(&delayprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4181 
4182 	for (nvp = nvlist_next_nvpair(props, NULL); nvp != NULL;
4183 	    nvp = nvlist_next_nvpair(props, nvp)) {
4184 		/*
4185 		 * strcmp() is safe because zfs_prop_to_name() always returns
4186 		 * a bounded string.
4187 		 */
4188 		for (i = 0; delayable[i] != 0; i++) {
4189 			if (strcmp(zfs_prop_to_name(delayable[i]),
4190 			    nvpair_name(nvp)) == 0) {
4191 				break;
4192 			}
4193 		}
4194 		if (delayable[i] != 0) {
4195 			tmp = nvlist_prev_nvpair(props, nvp);
4196 			VERIFY(nvlist_add_nvpair(delayprops, nvp) == 0);
4197 			VERIFY(nvlist_remove_nvpair(props, nvp) == 0);
4198 			nvp = tmp;
4199 		}
4200 	}
4201 
4202 	if (nvlist_empty(delayprops)) {
4203 		nvlist_free(delayprops);
4204 		delayprops = NULL;
4205 	}
4206 	return (delayprops);
4207 }
4208 
4209 #ifdef	DEBUG
4210 static boolean_t zfs_ioc_recv_inject_err;
4211 #endif
4212 
4213 /*
4214  * inputs:
4215  * zc_name		name of containing filesystem
4216  * zc_nvlist_src{_size}	nvlist of properties to apply
4217  * zc_value		name of snapshot to create
4218  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
4219  * zc_cookie		file descriptor to recv from
4220  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
4221  * zc_guid		force flag
4222  * zc_cleanup_fd	cleanup-on-exit file descriptor
4223  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
4224  * zc_resumable		if data is incomplete assume sender will resume
4225  *
4226  * outputs:
4227  * zc_cookie		number of bytes read
4228  * zc_nvlist_dst{_size} error for each unapplied received property
4229  * zc_obj		zprop_errflags_t
4230  * zc_action_handle	handle for this guid/ds mapping
4231  */
4232 static int
4233 zfs_ioc_recv(zfs_cmd_t *zc)
4234 {
4235 	file_t *fp;
4236 	dmu_recv_cookie_t drc;
4237 	boolean_t force = (boolean_t)zc->zc_guid;
4238 	int fd;
4239 	int error = 0;
4240 	int props_error = 0;
4241 	nvlist_t *errors;
4242 	offset_t off;
4243 	nvlist_t *props = NULL; /* sent properties */
4244 	nvlist_t *origprops = NULL; /* existing properties */
4245 	nvlist_t *delayprops = NULL; /* sent properties applied post-receive */
4246 	char *origin = NULL;
4247 	char *tosnap;
4248 	char tofs[ZFS_MAXNAMELEN];
4249 	boolean_t first_recvd_props = B_FALSE;
4250 
4251 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
4252 	    strchr(zc->zc_value, '@') == NULL ||
4253 	    strchr(zc->zc_value, '%'))
4254 		return (SET_ERROR(EINVAL));
4255 
4256 	(void) strcpy(tofs, zc->zc_value);
4257 	tosnap = strchr(tofs, '@');
4258 	*tosnap++ = '\0';
4259 
4260 	if (zc->zc_nvlist_src != NULL &&
4261 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
4262 	    zc->zc_iflags, &props)) != 0)
4263 		return (error);
4264 
4265 	fd = zc->zc_cookie;
4266 	fp = getf(fd);
4267 	if (fp == NULL) {
4268 		nvlist_free(props);
4269 		return (SET_ERROR(EBADF));
4270 	}
4271 
4272 	errors = fnvlist_alloc();
4273 
4274 	if (zc->zc_string[0])
4275 		origin = zc->zc_string;
4276 
4277 	error = dmu_recv_begin(tofs, tosnap,
4278 	    &zc->zc_begin_record, force, zc->zc_resumable, origin, &drc);
4279 	if (error != 0)
4280 		goto out;
4281 
4282 	/*
4283 	 * Set properties before we receive the stream so that they are applied
4284 	 * to the new data. Note that we must call dmu_recv_stream() if
4285 	 * dmu_recv_begin() succeeds.
4286 	 */
4287 	if (props != NULL && !drc.drc_newfs) {
4288 		if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
4289 		    SPA_VERSION_RECVD_PROPS &&
4290 		    !dsl_prop_get_hasrecvd(tofs))
4291 			first_recvd_props = B_TRUE;
4292 
4293 		/*
4294 		 * If new received properties are supplied, they are to
4295 		 * completely replace the existing received properties, so stash
4296 		 * away the existing ones.
4297 		 */
4298 		if (dsl_prop_get_received(tofs, &origprops) == 0) {
4299 			nvlist_t *errlist = NULL;
4300 			/*
4301 			 * Don't bother writing a property if its value won't
4302 			 * change (and avoid the unnecessary security checks).
4303 			 *
4304 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
4305 			 * special case where we blow away all local properties
4306 			 * regardless.
4307 			 */
4308 			if (!first_recvd_props)
4309 				props_reduce(props, origprops);
4310 			if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
4311 				(void) nvlist_merge(errors, errlist, 0);
4312 			nvlist_free(errlist);
4313 
4314 			if (clear_received_props(tofs, origprops,
4315 			    first_recvd_props ? NULL : props) != 0)
4316 				zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4317 		} else {
4318 			zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4319 		}
4320 	}
4321 
4322 	if (props != NULL) {
4323 		props_error = dsl_prop_set_hasrecvd(tofs);
4324 
4325 		if (props_error == 0) {
4326 			delayprops = extract_delay_props(props);
4327 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4328 			    props, errors);
4329 		}
4330 	}
4331 
4332 	off = fp->f_offset;
4333 	error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4334 	    &zc->zc_action_handle);
4335 
4336 	if (error == 0) {
4337 		zfsvfs_t *zfsvfs = NULL;
4338 
4339 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
4340 			/* online recv */
4341 			int end_err;
4342 
4343 			error = zfs_suspend_fs(zfsvfs);
4344 			/*
4345 			 * If the suspend fails, then the recv_end will
4346 			 * likely also fail, and clean up after itself.
4347 			 */
4348 			end_err = dmu_recv_end(&drc, zfsvfs);
4349 			if (error == 0)
4350 				error = zfs_resume_fs(zfsvfs, tofs);
4351 			error = error ? error : end_err;
4352 			VFS_RELE(zfsvfs->z_vfs);
4353 		} else {
4354 			error = dmu_recv_end(&drc, NULL);
4355 		}
4356 
4357 		/* Set delayed properties now, after we're done receiving. */
4358 		if (delayprops != NULL && error == 0) {
4359 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4360 			    delayprops, errors);
4361 		}
4362 	}
4363 
4364 	if (delayprops != NULL) {
4365 		/*
4366 		 * Merge delayed props back in with initial props, in case
4367 		 * we're DEBUG and zfs_ioc_recv_inject_err is set (which means
4368 		 * we have to make sure clear_received_props() includes
4369 		 * the delayed properties).
4370 		 *
4371 		 * Since zfs_ioc_recv_inject_err is only in DEBUG kernels,
4372 		 * using ASSERT() will be just like a VERIFY.
4373 		 */
4374 		ASSERT(nvlist_merge(props, delayprops, 0) == 0);
4375 		nvlist_free(delayprops);
4376 	}
4377 
4378 	/*
4379 	 * Now that all props, initial and delayed, are set, report the prop
4380 	 * errors to the caller.
4381 	 */
4382 	if (zc->zc_nvlist_dst_size != 0 &&
4383 	    (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4384 	    put_nvlist(zc, errors) != 0)) {
4385 		/*
4386 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
4387 		 * size or supplied an invalid address.
4388 		 */
4389 		props_error = SET_ERROR(EINVAL);
4390 	}
4391 
4392 	zc->zc_cookie = off - fp->f_offset;
4393 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4394 		fp->f_offset = off;
4395 
4396 #ifdef	DEBUG
4397 	if (zfs_ioc_recv_inject_err) {
4398 		zfs_ioc_recv_inject_err = B_FALSE;
4399 		error = 1;
4400 	}
4401 #endif
4402 	/*
4403 	 * On error, restore the original props.
4404 	 */
4405 	if (error != 0 && props != NULL && !drc.drc_newfs) {
4406 		if (clear_received_props(tofs, props, NULL) != 0) {
4407 			/*
4408 			 * We failed to clear the received properties.
4409 			 * Since we may have left a $recvd value on the
4410 			 * system, we can't clear the $hasrecvd flag.
4411 			 */
4412 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4413 		} else if (first_recvd_props) {
4414 			dsl_prop_unset_hasrecvd(tofs);
4415 		}
4416 
4417 		if (origprops == NULL && !drc.drc_newfs) {
4418 			/* We failed to stash the original properties. */
4419 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4420 		}
4421 
4422 		/*
4423 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
4424 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4425 		 * explictly if we're restoring local properties cleared in the
4426 		 * first new-style receive.
4427 		 */
4428 		if (origprops != NULL &&
4429 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4430 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4431 		    origprops, NULL) != 0) {
4432 			/*
4433 			 * We stashed the original properties but failed to
4434 			 * restore them.
4435 			 */
4436 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4437 		}
4438 	}
4439 out:
4440 	nvlist_free(props);
4441 	nvlist_free(origprops);
4442 	nvlist_free(errors);
4443 	releasef(fd);
4444 
4445 	if (error == 0)
4446 		error = props_error;
4447 
4448 	return (error);
4449 }
4450 
4451 /*
4452  * inputs:
4453  * zc_name	name of snapshot to send
4454  * zc_cookie	file descriptor to send stream to
4455  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
4456  * zc_sendobj	objsetid of snapshot to send
4457  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
4458  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
4459  *		output size in zc_objset_type.
4460  * zc_flags	lzc_send_flags
4461  *
4462  * outputs:
4463  * zc_objset_type	estimated size, if zc_guid is set
4464  */
4465 static int
4466 zfs_ioc_send(zfs_cmd_t *zc)
4467 {
4468 	int error;
4469 	offset_t off;
4470 	boolean_t estimate = (zc->zc_guid != 0);
4471 	boolean_t embedok = (zc->zc_flags & 0x1);
4472 	boolean_t large_block_ok = (zc->zc_flags & 0x2);
4473 
4474 	if (zc->zc_obj != 0) {
4475 		dsl_pool_t *dp;
4476 		dsl_dataset_t *tosnap;
4477 
4478 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4479 		if (error != 0)
4480 			return (error);
4481 
4482 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4483 		if (error != 0) {
4484 			dsl_pool_rele(dp, FTAG);
4485 			return (error);
4486 		}
4487 
4488 		if (dsl_dir_is_clone(tosnap->ds_dir))
4489 			zc->zc_fromobj =
4490 			    dsl_dir_phys(tosnap->ds_dir)->dd_origin_obj;
4491 		dsl_dataset_rele(tosnap, FTAG);
4492 		dsl_pool_rele(dp, FTAG);
4493 	}
4494 
4495 	if (estimate) {
4496 		dsl_pool_t *dp;
4497 		dsl_dataset_t *tosnap;
4498 		dsl_dataset_t *fromsnap = NULL;
4499 
4500 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4501 		if (error != 0)
4502 			return (error);
4503 
4504 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4505 		if (error != 0) {
4506 			dsl_pool_rele(dp, FTAG);
4507 			return (error);
4508 		}
4509 
4510 		if (zc->zc_fromobj != 0) {
4511 			error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
4512 			    FTAG, &fromsnap);
4513 			if (error != 0) {
4514 				dsl_dataset_rele(tosnap, FTAG);
4515 				dsl_pool_rele(dp, FTAG);
4516 				return (error);
4517 			}
4518 		}
4519 
4520 		error = dmu_send_estimate(tosnap, fromsnap,
4521 		    &zc->zc_objset_type);
4522 
4523 		if (fromsnap != NULL)
4524 			dsl_dataset_rele(fromsnap, FTAG);
4525 		dsl_dataset_rele(tosnap, FTAG);
4526 		dsl_pool_rele(dp, FTAG);
4527 	} else {
4528 		file_t *fp = getf(zc->zc_cookie);
4529 		if (fp == NULL)
4530 			return (SET_ERROR(EBADF));
4531 
4532 		off = fp->f_offset;
4533 		error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
4534 		    zc->zc_fromobj, embedok, large_block_ok,
4535 		    zc->zc_cookie, fp->f_vnode, &off);
4536 
4537 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4538 			fp->f_offset = off;
4539 		releasef(zc->zc_cookie);
4540 	}
4541 	return (error);
4542 }
4543 
4544 /*
4545  * inputs:
4546  * zc_name	name of snapshot on which to report progress
4547  * zc_cookie	file descriptor of send stream
4548  *
4549  * outputs:
4550  * zc_cookie	number of bytes written in send stream thus far
4551  */
4552 static int
4553 zfs_ioc_send_progress(zfs_cmd_t *zc)
4554 {
4555 	dsl_pool_t *dp;
4556 	dsl_dataset_t *ds;
4557 	dmu_sendarg_t *dsp = NULL;
4558 	int error;
4559 
4560 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4561 	if (error != 0)
4562 		return (error);
4563 
4564 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4565 	if (error != 0) {
4566 		dsl_pool_rele(dp, FTAG);
4567 		return (error);
4568 	}
4569 
4570 	mutex_enter(&ds->ds_sendstream_lock);
4571 
4572 	/*
4573 	 * Iterate over all the send streams currently active on this dataset.
4574 	 * If there's one which matches the specified file descriptor _and_ the
4575 	 * stream was started by the current process, return the progress of
4576 	 * that stream.
4577 	 */
4578 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4579 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
4580 		if (dsp->dsa_outfd == zc->zc_cookie &&
4581 		    dsp->dsa_proc == curproc)
4582 			break;
4583 	}
4584 
4585 	if (dsp != NULL)
4586 		zc->zc_cookie = *(dsp->dsa_off);
4587 	else
4588 		error = SET_ERROR(ENOENT);
4589 
4590 	mutex_exit(&ds->ds_sendstream_lock);
4591 	dsl_dataset_rele(ds, FTAG);
4592 	dsl_pool_rele(dp, FTAG);
4593 	return (error);
4594 }
4595 
4596 static int
4597 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4598 {
4599 	int id, error;
4600 
4601 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4602 	    &zc->zc_inject_record);
4603 
4604 	if (error == 0)
4605 		zc->zc_guid = (uint64_t)id;
4606 
4607 	return (error);
4608 }
4609 
4610 static int
4611 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4612 {
4613 	return (zio_clear_fault((int)zc->zc_guid));
4614 }
4615 
4616 static int
4617 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4618 {
4619 	int id = (int)zc->zc_guid;
4620 	int error;
4621 
4622 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4623 	    &zc->zc_inject_record);
4624 
4625 	zc->zc_guid = id;
4626 
4627 	return (error);
4628 }
4629 
4630 static int
4631 zfs_ioc_error_log(zfs_cmd_t *zc)
4632 {
4633 	spa_t *spa;
4634 	int error;
4635 	size_t count = (size_t)zc->zc_nvlist_dst_size;
4636 
4637 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4638 		return (error);
4639 
4640 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4641 	    &count);
4642 	if (error == 0)
4643 		zc->zc_nvlist_dst_size = count;
4644 	else
4645 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4646 
4647 	spa_close(spa, FTAG);
4648 
4649 	return (error);
4650 }
4651 
4652 static int
4653 zfs_ioc_clear(zfs_cmd_t *zc)
4654 {
4655 	spa_t *spa;
4656 	vdev_t *vd;
4657 	int error;
4658 
4659 	/*
4660 	 * On zpool clear we also fix up missing slogs
4661 	 */
4662 	mutex_enter(&spa_namespace_lock);
4663 	spa = spa_lookup(zc->zc_name);
4664 	if (spa == NULL) {
4665 		mutex_exit(&spa_namespace_lock);
4666 		return (SET_ERROR(EIO));
4667 	}
4668 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4669 		/* we need to let spa_open/spa_load clear the chains */
4670 		spa_set_log_state(spa, SPA_LOG_CLEAR);
4671 	}
4672 	spa->spa_last_open_failed = 0;
4673 	mutex_exit(&spa_namespace_lock);
4674 
4675 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4676 		error = spa_open(zc->zc_name, &spa, FTAG);
4677 	} else {
4678 		nvlist_t *policy;
4679 		nvlist_t *config = NULL;
4680 
4681 		if (zc->zc_nvlist_src == NULL)
4682 			return (SET_ERROR(EINVAL));
4683 
4684 		if ((error = get_nvlist(zc->zc_nvlist_src,
4685 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4686 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4687 			    policy, &config);
4688 			if (config != NULL) {
4689 				int err;
4690 
4691 				if ((err = put_nvlist(zc, config)) != 0)
4692 					error = err;
4693 				nvlist_free(config);
4694 			}
4695 			nvlist_free(policy);
4696 		}
4697 	}
4698 
4699 	if (error != 0)
4700 		return (error);
4701 
4702 	spa_vdev_state_enter(spa, SCL_NONE);
4703 
4704 	if (zc->zc_guid == 0) {
4705 		vd = NULL;
4706 	} else {
4707 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4708 		if (vd == NULL) {
4709 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
4710 			spa_close(spa, FTAG);
4711 			return (SET_ERROR(ENODEV));
4712 		}
4713 	}
4714 
4715 	vdev_clear(spa, vd);
4716 
4717 	(void) spa_vdev_state_exit(spa, NULL, 0);
4718 
4719 	/*
4720 	 * Resume any suspended I/Os.
4721 	 */
4722 	if (zio_resume(spa) != 0)
4723 		error = SET_ERROR(EIO);
4724 
4725 	spa_close(spa, FTAG);
4726 
4727 	return (error);
4728 }
4729 
4730 static int
4731 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4732 {
4733 	spa_t *spa;
4734 	int error;
4735 
4736 	error = spa_open(zc->zc_name, &spa, FTAG);
4737 	if (error != 0)
4738 		return (error);
4739 
4740 	spa_vdev_state_enter(spa, SCL_NONE);
4741 
4742 	/*
4743 	 * If a resilver is already in progress then set the
4744 	 * spa_scrub_reopen flag to B_TRUE so that we don't restart
4745 	 * the scan as a side effect of the reopen. Otherwise, let
4746 	 * vdev_open() decided if a resilver is required.
4747 	 */
4748 	spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4749 	vdev_reopen(spa->spa_root_vdev);
4750 	spa->spa_scrub_reopen = B_FALSE;
4751 
4752 	(void) spa_vdev_state_exit(spa, NULL, 0);
4753 	spa_close(spa, FTAG);
4754 	return (0);
4755 }
4756 /*
4757  * inputs:
4758  * zc_name	name of filesystem
4759  * zc_value	name of origin snapshot
4760  *
4761  * outputs:
4762  * zc_string	name of conflicting snapshot, if there is one
4763  */
4764 static int
4765 zfs_ioc_promote(zfs_cmd_t *zc)
4766 {
4767 	char *cp;
4768 
4769 	/*
4770 	 * We don't need to unmount *all* the origin fs's snapshots, but
4771 	 * it's easier.
4772 	 */
4773 	cp = strchr(zc->zc_value, '@');
4774 	if (cp)
4775 		*cp = '\0';
4776 	(void) dmu_objset_find(zc->zc_value,
4777 	    zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
4778 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4779 }
4780 
4781 /*
4782  * Retrieve a single {user|group}{used|quota}@... property.
4783  *
4784  * inputs:
4785  * zc_name	name of filesystem
4786  * zc_objset_type zfs_userquota_prop_t
4787  * zc_value	domain name (eg. "S-1-234-567-89")
4788  * zc_guid	RID/UID/GID
4789  *
4790  * outputs:
4791  * zc_cookie	property value
4792  */
4793 static int
4794 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4795 {
4796 	zfsvfs_t *zfsvfs;
4797 	int error;
4798 
4799 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4800 		return (SET_ERROR(EINVAL));
4801 
4802 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4803 	if (error != 0)
4804 		return (error);
4805 
4806 	error = zfs_userspace_one(zfsvfs,
4807 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4808 	zfsvfs_rele(zfsvfs, FTAG);
4809 
4810 	return (error);
4811 }
4812 
4813 /*
4814  * inputs:
4815  * zc_name		name of filesystem
4816  * zc_cookie		zap cursor
4817  * zc_objset_type	zfs_userquota_prop_t
4818  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4819  *
4820  * outputs:
4821  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
4822  * zc_cookie	zap cursor
4823  */
4824 static int
4825 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4826 {
4827 	zfsvfs_t *zfsvfs;
4828 	int bufsize = zc->zc_nvlist_dst_size;
4829 
4830 	if (bufsize <= 0)
4831 		return (SET_ERROR(ENOMEM));
4832 
4833 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4834 	if (error != 0)
4835 		return (error);
4836 
4837 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
4838 
4839 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4840 	    buf, &zc->zc_nvlist_dst_size);
4841 
4842 	if (error == 0) {
4843 		error = xcopyout(buf,
4844 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
4845 		    zc->zc_nvlist_dst_size);
4846 	}
4847 	kmem_free(buf, bufsize);
4848 	zfsvfs_rele(zfsvfs, FTAG);
4849 
4850 	return (error);
4851 }
4852 
4853 /*
4854  * inputs:
4855  * zc_name		name of filesystem
4856  *
4857  * outputs:
4858  * none
4859  */
4860 static int
4861 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4862 {
4863 	objset_t *os;
4864 	int error = 0;
4865 	zfsvfs_t *zfsvfs;
4866 
4867 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4868 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4869 			/*
4870 			 * If userused is not enabled, it may be because the
4871 			 * objset needs to be closed & reopened (to grow the
4872 			 * objset_phys_t).  Suspend/resume the fs will do that.
4873 			 */
4874 			error = zfs_suspend_fs(zfsvfs);
4875 			if (error == 0) {
4876 				dmu_objset_refresh_ownership(zfsvfs->z_os,
4877 				    zfsvfs);
4878 				error = zfs_resume_fs(zfsvfs, zc->zc_name);
4879 			}
4880 		}
4881 		if (error == 0)
4882 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4883 		VFS_RELE(zfsvfs->z_vfs);
4884 	} else {
4885 		/* XXX kind of reading contents without owning */
4886 		error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4887 		if (error != 0)
4888 			return (error);
4889 
4890 		error = dmu_objset_userspace_upgrade(os);
4891 		dmu_objset_rele(os, FTAG);
4892 	}
4893 
4894 	return (error);
4895 }
4896 
4897 /*
4898  * We don't want to have a hard dependency
4899  * against some special symbols in sharefs
4900  * nfs, and smbsrv.  Determine them if needed when
4901  * the first file system is shared.
4902  * Neither sharefs, nfs or smbsrv are unloadable modules.
4903  */
4904 int (*znfsexport_fs)(void *arg);
4905 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4906 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4907 
4908 int zfs_nfsshare_inited;
4909 int zfs_smbshare_inited;
4910 
4911 ddi_modhandle_t nfs_mod;
4912 ddi_modhandle_t sharefs_mod;
4913 ddi_modhandle_t smbsrv_mod;
4914 kmutex_t zfs_share_lock;
4915 
4916 static int
4917 zfs_init_sharefs()
4918 {
4919 	int error;
4920 
4921 	ASSERT(MUTEX_HELD(&zfs_share_lock));
4922 	/* Both NFS and SMB shares also require sharetab support. */
4923 	if (sharefs_mod == NULL && ((sharefs_mod =
4924 	    ddi_modopen("fs/sharefs",
4925 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
4926 		return (SET_ERROR(ENOSYS));
4927 	}
4928 	if (zshare_fs == NULL && ((zshare_fs =
4929 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4930 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4931 		return (SET_ERROR(ENOSYS));
4932 	}
4933 	return (0);
4934 }
4935 
4936 static int
4937 zfs_ioc_share(zfs_cmd_t *zc)
4938 {
4939 	int error;
4940 	int opcode;
4941 
4942 	switch (zc->zc_share.z_sharetype) {
4943 	case ZFS_SHARE_NFS:
4944 	case ZFS_UNSHARE_NFS:
4945 		if (zfs_nfsshare_inited == 0) {
4946 			mutex_enter(&zfs_share_lock);
4947 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4948 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4949 				mutex_exit(&zfs_share_lock);
4950 				return (SET_ERROR(ENOSYS));
4951 			}
4952 			if (znfsexport_fs == NULL &&
4953 			    ((znfsexport_fs = (int (*)(void *))
4954 			    ddi_modsym(nfs_mod,
4955 			    "nfs_export", &error)) == NULL)) {
4956 				mutex_exit(&zfs_share_lock);
4957 				return (SET_ERROR(ENOSYS));
4958 			}
4959 			error = zfs_init_sharefs();
4960 			if (error != 0) {
4961 				mutex_exit(&zfs_share_lock);
4962 				return (SET_ERROR(ENOSYS));
4963 			}
4964 			zfs_nfsshare_inited = 1;
4965 			mutex_exit(&zfs_share_lock);
4966 		}
4967 		break;
4968 	case ZFS_SHARE_SMB:
4969 	case ZFS_UNSHARE_SMB:
4970 		if (zfs_smbshare_inited == 0) {
4971 			mutex_enter(&zfs_share_lock);
4972 			if (smbsrv_mod == NULL && ((smbsrv_mod =
4973 			    ddi_modopen("drv/smbsrv",
4974 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4975 				mutex_exit(&zfs_share_lock);
4976 				return (SET_ERROR(ENOSYS));
4977 			}
4978 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4979 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4980 			    "smb_server_share", &error)) == NULL)) {
4981 				mutex_exit(&zfs_share_lock);
4982 				return (SET_ERROR(ENOSYS));
4983 			}
4984 			error = zfs_init_sharefs();
4985 			if (error != 0) {
4986 				mutex_exit(&zfs_share_lock);
4987 				return (SET_ERROR(ENOSYS));
4988 			}
4989 			zfs_smbshare_inited = 1;
4990 			mutex_exit(&zfs_share_lock);
4991 		}
4992 		break;
4993 	default:
4994 		return (SET_ERROR(EINVAL));
4995 	}
4996 
4997 	switch (zc->zc_share.z_sharetype) {
4998 	case ZFS_SHARE_NFS:
4999 	case ZFS_UNSHARE_NFS:
5000 		if (error =
5001 		    znfsexport_fs((void *)
5002 		    (uintptr_t)zc->zc_share.z_exportdata))
5003 			return (error);
5004 		break;
5005 	case ZFS_SHARE_SMB:
5006 	case ZFS_UNSHARE_SMB:
5007 		if (error = zsmbexport_fs((void *)
5008 		    (uintptr_t)zc->zc_share.z_exportdata,
5009 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
5010 		    B_TRUE: B_FALSE)) {
5011 			return (error);
5012 		}
5013 		break;
5014 	}
5015 
5016 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
5017 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
5018 	    SHAREFS_ADD : SHAREFS_REMOVE;
5019 
5020 	/*
5021 	 * Add or remove share from sharetab
5022 	 */
5023 	error = zshare_fs(opcode,
5024 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
5025 	    zc->zc_share.z_sharemax);
5026 
5027 	return (error);
5028 
5029 }
5030 
5031 ace_t full_access[] = {
5032 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
5033 };
5034 
5035 /*
5036  * inputs:
5037  * zc_name		name of containing filesystem
5038  * zc_obj		object # beyond which we want next in-use object #
5039  *
5040  * outputs:
5041  * zc_obj		next in-use object #
5042  */
5043 static int
5044 zfs_ioc_next_obj(zfs_cmd_t *zc)
5045 {
5046 	objset_t *os = NULL;
5047 	int error;
5048 
5049 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
5050 	if (error != 0)
5051 		return (error);
5052 
5053 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
5054 	    dsl_dataset_phys(os->os_dsl_dataset)->ds_prev_snap_txg);
5055 
5056 	dmu_objset_rele(os, FTAG);
5057 	return (error);
5058 }
5059 
5060 /*
5061  * inputs:
5062  * zc_name		name of filesystem
5063  * zc_value		prefix name for snapshot
5064  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
5065  *
5066  * outputs:
5067  * zc_value		short name of new snapshot
5068  */
5069 static int
5070 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
5071 {
5072 	char *snap_name;
5073 	char *hold_name;
5074 	int error;
5075 	minor_t minor;
5076 
5077 	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
5078 	if (error != 0)
5079 		return (error);
5080 
5081 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
5082 	    (u_longlong_t)ddi_get_lbolt64());
5083 	hold_name = kmem_asprintf("%%%s", zc->zc_value);
5084 
5085 	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
5086 	    hold_name);
5087 	if (error == 0)
5088 		(void) strcpy(zc->zc_value, snap_name);
5089 	strfree(snap_name);
5090 	strfree(hold_name);
5091 	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
5092 	return (error);
5093 }
5094 
5095 /*
5096  * inputs:
5097  * zc_name		name of "to" snapshot
5098  * zc_value		name of "from" snapshot
5099  * zc_cookie		file descriptor to write diff data on
5100  *
5101  * outputs:
5102  * dmu_diff_record_t's to the file descriptor
5103  */
5104 static int
5105 zfs_ioc_diff(zfs_cmd_t *zc)
5106 {
5107 	file_t *fp;
5108 	offset_t off;
5109 	int error;
5110 
5111 	fp = getf(zc->zc_cookie);
5112 	if (fp == NULL)
5113 		return (SET_ERROR(EBADF));
5114 
5115 	off = fp->f_offset;
5116 
5117 	error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
5118 
5119 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5120 		fp->f_offset = off;
5121 	releasef(zc->zc_cookie);
5122 
5123 	return (error);
5124 }
5125 
5126 /*
5127  * Remove all ACL files in shares dir
5128  */
5129 static int
5130 zfs_smb_acl_purge(znode_t *dzp)
5131 {
5132 	zap_cursor_t	zc;
5133 	zap_attribute_t	zap;
5134 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
5135 	int error;
5136 
5137 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
5138 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
5139 	    zap_cursor_advance(&zc)) {
5140 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
5141 		    NULL, 0)) != 0)
5142 			break;
5143 	}
5144 	zap_cursor_fini(&zc);
5145 	return (error);
5146 }
5147 
5148 static int
5149 zfs_ioc_smb_acl(zfs_cmd_t *zc)
5150 {
5151 	vnode_t *vp;
5152 	znode_t *dzp;
5153 	vnode_t *resourcevp = NULL;
5154 	znode_t *sharedir;
5155 	zfsvfs_t *zfsvfs;
5156 	nvlist_t *nvlist;
5157 	char *src, *target;
5158 	vattr_t vattr;
5159 	vsecattr_t vsec;
5160 	int error = 0;
5161 
5162 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
5163 	    NO_FOLLOW, NULL, &vp)) != 0)
5164 		return (error);
5165 
5166 	/* Now make sure mntpnt and dataset are ZFS */
5167 
5168 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
5169 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
5170 	    zc->zc_name) != 0)) {
5171 		VN_RELE(vp);
5172 		return (SET_ERROR(EINVAL));
5173 	}
5174 
5175 	dzp = VTOZ(vp);
5176 	zfsvfs = dzp->z_zfsvfs;
5177 	ZFS_ENTER(zfsvfs);
5178 
5179 	/*
5180 	 * Create share dir if its missing.
5181 	 */
5182 	mutex_enter(&zfsvfs->z_lock);
5183 	if (zfsvfs->z_shares_dir == 0) {
5184 		dmu_tx_t *tx;
5185 
5186 		tx = dmu_tx_create(zfsvfs->z_os);
5187 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
5188 		    ZFS_SHARES_DIR);
5189 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
5190 		error = dmu_tx_assign(tx, TXG_WAIT);
5191 		if (error != 0) {
5192 			dmu_tx_abort(tx);
5193 		} else {
5194 			error = zfs_create_share_dir(zfsvfs, tx);
5195 			dmu_tx_commit(tx);
5196 		}
5197 		if (error != 0) {
5198 			mutex_exit(&zfsvfs->z_lock);
5199 			VN_RELE(vp);
5200 			ZFS_EXIT(zfsvfs);
5201 			return (error);
5202 		}
5203 	}
5204 	mutex_exit(&zfsvfs->z_lock);
5205 
5206 	ASSERT(zfsvfs->z_shares_dir);
5207 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
5208 		VN_RELE(vp);
5209 		ZFS_EXIT(zfsvfs);
5210 		return (error);
5211 	}
5212 
5213 	switch (zc->zc_cookie) {
5214 	case ZFS_SMB_ACL_ADD:
5215 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
5216 		vattr.va_type = VREG;
5217 		vattr.va_mode = S_IFREG|0777;
5218 		vattr.va_uid = 0;
5219 		vattr.va_gid = 0;
5220 
5221 		vsec.vsa_mask = VSA_ACE;
5222 		vsec.vsa_aclentp = &full_access;
5223 		vsec.vsa_aclentsz = sizeof (full_access);
5224 		vsec.vsa_aclcnt = 1;
5225 
5226 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
5227 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
5228 		if (resourcevp)
5229 			VN_RELE(resourcevp);
5230 		break;
5231 
5232 	case ZFS_SMB_ACL_REMOVE:
5233 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
5234 		    NULL, 0);
5235 		break;
5236 
5237 	case ZFS_SMB_ACL_RENAME:
5238 		if ((error = get_nvlist(zc->zc_nvlist_src,
5239 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
5240 			VN_RELE(vp);
5241 			VN_RELE(ZTOV(sharedir));
5242 			ZFS_EXIT(zfsvfs);
5243 			return (error);
5244 		}
5245 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
5246 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
5247 		    &target)) {
5248 			VN_RELE(vp);
5249 			VN_RELE(ZTOV(sharedir));
5250 			ZFS_EXIT(zfsvfs);
5251 			nvlist_free(nvlist);
5252 			return (error);
5253 		}
5254 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
5255 		    kcred, NULL, 0);
5256 		nvlist_free(nvlist);
5257 		break;
5258 
5259 	case ZFS_SMB_ACL_PURGE:
5260 		error = zfs_smb_acl_purge(sharedir);
5261 		break;
5262 
5263 	default:
5264 		error = SET_ERROR(EINVAL);
5265 		break;
5266 	}
5267 
5268 	VN_RELE(vp);
5269 	VN_RELE(ZTOV(sharedir));
5270 
5271 	ZFS_EXIT(zfsvfs);
5272 
5273 	return (error);
5274 }
5275 
5276 /*
5277  * innvl: {
5278  *     "holds" -> { snapname -> holdname (string), ... }
5279  *     (optional) "cleanup_fd" -> fd (int32)
5280  * }
5281  *
5282  * outnvl: {
5283  *     snapname -> error value (int32)
5284  *     ...
5285  * }
5286  */
5287 /* ARGSUSED */
5288 static int
5289 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
5290 {
5291 	nvpair_t *pair;
5292 	nvlist_t *holds;
5293 	int cleanup_fd = -1;
5294 	int error;
5295 	minor_t minor = 0;
5296 
5297 	error = nvlist_lookup_nvlist(args, "holds", &holds);
5298 	if (error != 0)
5299 		return (SET_ERROR(EINVAL));
5300 
5301 	/* make sure the user didn't pass us any invalid (empty) tags */
5302 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
5303 	    pair = nvlist_next_nvpair(holds, pair)) {
5304 		char *htag;
5305 
5306 		error = nvpair_value_string(pair, &htag);
5307 		if (error != 0)
5308 			return (SET_ERROR(error));
5309 
5310 		if (strlen(htag) == 0)
5311 			return (SET_ERROR(EINVAL));
5312 	}
5313 
5314 	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
5315 		error = zfs_onexit_fd_hold(cleanup_fd, &minor);
5316 		if (error != 0)
5317 			return (error);
5318 	}
5319 
5320 	error = dsl_dataset_user_hold(holds, minor, errlist);
5321 	if (minor != 0)
5322 		zfs_onexit_fd_rele(cleanup_fd);
5323 	return (error);
5324 }
5325 
5326 /*
5327  * innvl is not used.
5328  *
5329  * outnvl: {
5330  *    holdname -> time added (uint64 seconds since epoch)
5331  *    ...
5332  * }
5333  */
5334 /* ARGSUSED */
5335 static int
5336 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
5337 {
5338 	return (dsl_dataset_get_holds(snapname, outnvl));
5339 }
5340 
5341 /*
5342  * innvl: {
5343  *     snapname -> { holdname, ... }
5344  *     ...
5345  * }
5346  *
5347  * outnvl: {
5348  *     snapname -> error value (int32)
5349  *     ...
5350  * }
5351  */
5352 /* ARGSUSED */
5353 static int
5354 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
5355 {
5356 	return (dsl_dataset_user_release(holds, errlist));
5357 }
5358 
5359 /*
5360  * inputs:
5361  * zc_name		name of new filesystem or snapshot
5362  * zc_value		full name of old snapshot
5363  *
5364  * outputs:
5365  * zc_cookie		space in bytes
5366  * zc_objset_type	compressed space in bytes
5367  * zc_perm_action	uncompressed space in bytes
5368  */
5369 static int
5370 zfs_ioc_space_written(zfs_cmd_t *zc)
5371 {
5372 	int error;
5373 	dsl_pool_t *dp;
5374 	dsl_dataset_t *new, *old;
5375 
5376 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5377 	if (error != 0)
5378 		return (error);
5379 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
5380 	if (error != 0) {
5381 		dsl_pool_rele(dp, FTAG);
5382 		return (error);
5383 	}
5384 	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
5385 	if (error != 0) {
5386 		dsl_dataset_rele(new, FTAG);
5387 		dsl_pool_rele(dp, FTAG);
5388 		return (error);
5389 	}
5390 
5391 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5392 	    &zc->zc_objset_type, &zc->zc_perm_action);
5393 	dsl_dataset_rele(old, FTAG);
5394 	dsl_dataset_rele(new, FTAG);
5395 	dsl_pool_rele(dp, FTAG);
5396 	return (error);
5397 }
5398 
5399 /*
5400  * innvl: {
5401  *     "firstsnap" -> snapshot name
5402  * }
5403  *
5404  * outnvl: {
5405  *     "used" -> space in bytes
5406  *     "compressed" -> compressed space in bytes
5407  *     "uncompressed" -> uncompressed space in bytes
5408  * }
5409  */
5410 static int
5411 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5412 {
5413 	int error;
5414 	dsl_pool_t *dp;
5415 	dsl_dataset_t *new, *old;
5416 	char *firstsnap;
5417 	uint64_t used, comp, uncomp;
5418 
5419 	if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5420 		return (SET_ERROR(EINVAL));
5421 
5422 	error = dsl_pool_hold(lastsnap, FTAG, &dp);
5423 	if (error != 0)
5424 		return (error);
5425 
5426 	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
5427 	if (error == 0 && !new->ds_is_snapshot) {
5428 		dsl_dataset_rele(new, FTAG);
5429 		error = SET_ERROR(EINVAL);
5430 	}
5431 	if (error != 0) {
5432 		dsl_pool_rele(dp, FTAG);
5433 		return (error);
5434 	}
5435 	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
5436 	if (error == 0 && !old->ds_is_snapshot) {
5437 		dsl_dataset_rele(old, FTAG);
5438 		error = SET_ERROR(EINVAL);
5439 	}
5440 	if (error != 0) {
5441 		dsl_dataset_rele(new, FTAG);
5442 		dsl_pool_rele(dp, FTAG);
5443 		return (error);
5444 	}
5445 
5446 	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5447 	dsl_dataset_rele(old, FTAG);
5448 	dsl_dataset_rele(new, FTAG);
5449 	dsl_pool_rele(dp, FTAG);
5450 	fnvlist_add_uint64(outnvl, "used", used);
5451 	fnvlist_add_uint64(outnvl, "compressed", comp);
5452 	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5453 	return (error);
5454 }
5455 
5456 /*
5457  * innvl: {
5458  *     "fd" -> file descriptor to write stream to (int32)
5459  *     (optional) "fromsnap" -> full snap name to send an incremental from
5460  *     (optional) "largeblockok" -> (value ignored)
5461  *         indicates that blocks > 128KB are permitted
5462  *     (optional) "embedok" -> (value ignored)
5463  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
5464  *     (optional) "resume_object" and "resume_offset" -> (uint64)
5465  *         if present, resume send stream from specified object and offset.
5466  * }
5467  *
5468  * outnvl is unused
5469  */
5470 /* ARGSUSED */
5471 static int
5472 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5473 {
5474 	int error;
5475 	offset_t off;
5476 	char *fromname = NULL;
5477 	int fd;
5478 	boolean_t largeblockok;
5479 	boolean_t embedok;
5480 	uint64_t resumeobj = 0;
5481 	uint64_t resumeoff = 0;
5482 
5483 	error = nvlist_lookup_int32(innvl, "fd", &fd);
5484 	if (error != 0)
5485 		return (SET_ERROR(EINVAL));
5486 
5487 	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
5488 
5489 	largeblockok = nvlist_exists(innvl, "largeblockok");
5490 	embedok = nvlist_exists(innvl, "embedok");
5491 
5492 	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
5493 	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
5494 
5495 	file_t *fp = getf(fd);
5496 	if (fp == NULL)
5497 		return (SET_ERROR(EBADF));
5498 
5499 	off = fp->f_offset;
5500 	error = dmu_send(snapname, fromname, embedok, largeblockok, fd,
5501 	    resumeobj, resumeoff, fp->f_vnode, &off);
5502 
5503 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5504 		fp->f_offset = off;
5505 	releasef(fd);
5506 	return (error);
5507 }
5508 
5509 /*
5510  * Determine approximately how large a zfs send stream will be -- the number
5511  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5512  *
5513  * innvl: {
5514  *     (optional) "from" -> full snap or bookmark name to send an incremental
5515  *                          from
5516  * }
5517  *
5518  * outnvl: {
5519  *     "space" -> bytes of space (uint64)
5520  * }
5521  */
5522 static int
5523 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5524 {
5525 	dsl_pool_t *dp;
5526 	dsl_dataset_t *tosnap;
5527 	int error;
5528 	char *fromname;
5529 	uint64_t space;
5530 
5531 	error = dsl_pool_hold(snapname, FTAG, &dp);
5532 	if (error != 0)
5533 		return (error);
5534 
5535 	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
5536 	if (error != 0) {
5537 		dsl_pool_rele(dp, FTAG);
5538 		return (error);
5539 	}
5540 
5541 	error = nvlist_lookup_string(innvl, "from", &fromname);
5542 	if (error == 0) {
5543 		if (strchr(fromname, '@') != NULL) {
5544 			/*
5545 			 * If from is a snapshot, hold it and use the more
5546 			 * efficient dmu_send_estimate to estimate send space
5547 			 * size using deadlists.
5548 			 */
5549 			dsl_dataset_t *fromsnap;
5550 			error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
5551 			if (error != 0)
5552 				goto out;
5553 			error = dmu_send_estimate(tosnap, fromsnap, &space);
5554 			dsl_dataset_rele(fromsnap, FTAG);
5555 		} else if (strchr(fromname, '#') != NULL) {
5556 			/*
5557 			 * If from is a bookmark, fetch the creation TXG of the
5558 			 * snapshot it was created from and use that to find
5559 			 * blocks that were born after it.
5560 			 */
5561 			zfs_bookmark_phys_t frombm;
5562 
5563 			error = dsl_bookmark_lookup(dp, fromname, tosnap,
5564 			    &frombm);
5565 			if (error != 0)
5566 				goto out;
5567 			error = dmu_send_estimate_from_txg(tosnap,
5568 			    frombm.zbm_creation_txg, &space);
5569 		} else {
5570 			/*
5571 			 * from is not properly formatted as a snapshot or
5572 			 * bookmark
5573 			 */
5574 			error = SET_ERROR(EINVAL);
5575 			goto out;
5576 		}
5577 	} else {
5578 		// If estimating the size of a full send, use dmu_send_estimate
5579 		error = dmu_send_estimate(tosnap, NULL, &space);
5580 	}
5581 
5582 	fnvlist_add_uint64(outnvl, "space", space);
5583 
5584 out:
5585 	dsl_dataset_rele(tosnap, FTAG);
5586 	dsl_pool_rele(dp, FTAG);
5587 	return (error);
5588 }
5589 
5590 static int
5591 zfs_ioc_set_zev_callbacks(const char *unused, nvlist_t *innvl,
5592     nvlist_t *outnvl)
5593 {
5594 	int error;
5595 	uint64_t cb_addr;
5596 	/*
5597 	 * Our secpolicy for this op makes sure it's called in
5598 	 * kernel context, and that no other callbacks have
5599 	 * been registered, yet.
5600 	 */
5601 	error = nvlist_lookup_uint64(innvl, "callbacks", &cb_addr);
5602 	if (error != 0) {
5603 		cmn_err(CE_WARN, "set_zev_callbacks nvlist lookup failed (%d)",
5604 		    error);
5605 		return (error);
5606 	}
5607 	/* cb_addr is always a kernel memory address */
5608 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5609 	if (rz_zev_callbacks != rz_zev_default_callbacks) {
5610 		rw_exit(&rz_zev_rwlock);
5611 		return (EBUSY);
5612 	}
5613 	rz_zev_callbacks = (void *)(uintptr_t)cb_addr;
5614 	rw_exit(&rz_zev_rwlock);
5615 	return (0);
5616 }
5617 
5618 static int
5619 zfs_ioc_unset_zev_callbacks(const char *unused, nvlist_t *innvl,
5620     nvlist_t *outnvl)
5621 {
5622 	/*
5623 	 * Our secpolicy for this op makes sure it's called in
5624 	 * kernel context.
5625 	 */
5626 	rw_enter(&rz_zev_rwlock, RW_WRITER);
5627 	rz_zev_callbacks = rz_zev_default_callbacks;
5628 	rw_exit(&rz_zev_rwlock);
5629 	/* after mutex release, no thread is using the old table anymore. */
5630 	return (0);
5631 }
5632 
5633 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5634 
5635 static void
5636 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5637     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5638     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5639 {
5640 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5641 
5642 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5643 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5644 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5645 	ASSERT3P(vec->zvec_func, ==, NULL);
5646 
5647 	vec->zvec_legacy_func = func;
5648 	vec->zvec_secpolicy = secpolicy;
5649 	vec->zvec_namecheck = namecheck;
5650 	vec->zvec_allow_log = log_history;
5651 	vec->zvec_pool_check = pool_check;
5652 }
5653 
5654 /*
5655  * See the block comment at the beginning of this file for details on
5656  * each argument to this function.
5657  */
5658 static void
5659 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5660     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5661     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5662     boolean_t allow_log)
5663 {
5664 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5665 
5666 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5667 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5668 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5669 	ASSERT3P(vec->zvec_func, ==, NULL);
5670 
5671 	/* if we are logging, the name must be valid */
5672 	ASSERT(!allow_log || namecheck != NO_NAME);
5673 
5674 	vec->zvec_name = name;
5675 	vec->zvec_func = func;
5676 	vec->zvec_secpolicy = secpolicy;
5677 	vec->zvec_namecheck = namecheck;
5678 	vec->zvec_pool_check = pool_check;
5679 	vec->zvec_smush_outnvlist = smush_outnvlist;
5680 	vec->zvec_allow_log = allow_log;
5681 }
5682 
5683 static void
5684 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5685     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5686     zfs_ioc_poolcheck_t pool_check)
5687 {
5688 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5689 	    POOL_NAME, log_history, pool_check);
5690 }
5691 
5692 static void
5693 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5694     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5695 {
5696 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5697 	    DATASET_NAME, B_FALSE, pool_check);
5698 }
5699 
5700 static void
5701 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5702 {
5703 	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5704 	    POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5705 }
5706 
5707 static void
5708 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5709     zfs_secpolicy_func_t *secpolicy)
5710 {
5711 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5712 	    NO_NAME, B_FALSE, POOL_CHECK_NONE);
5713 }
5714 
5715 static void
5716 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5717     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5718 {
5719 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5720 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5721 }
5722 
5723 static void
5724 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5725 {
5726 	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5727 	    zfs_secpolicy_read);
5728 }
5729 
5730 static void
5731 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5732     zfs_secpolicy_func_t *secpolicy)
5733 {
5734 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5735 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5736 }
5737 
5738 static void
5739 zfs_ioctl_init(void)
5740 {
5741 	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5742 	    zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5743 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5744 
5745 	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5746 	    zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5747 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5748 
5749 	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5750 	    zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5751 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5752 
5753 	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5754 	    zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5755 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5756 
5757 	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5758 	    zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5759 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5760 
5761 	zfs_ioctl_register("create", ZFS_IOC_CREATE,
5762 	    zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5763 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5764 
5765 	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5766 	    zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5767 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5768 
5769 	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5770 	    zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5771 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5772 
5773 	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
5774 	    zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
5775 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5776 	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
5777 	    zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
5778 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5779 
5780 	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
5781 	    zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
5782 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5783 
5784 	zfs_ioctl_register("set_zev_callbacks", ZFS_IOC_SET_ZEV_CALLBACKS,
5785 	    zfs_ioc_set_zev_callbacks, zfs_secpolicy_set_zev_callbacks, NO_NAME,
5786 	    POOL_CHECK_NONE, B_TRUE, B_FALSE);
5787 
5788 	zfs_ioctl_register("unset_zev_callbacks", ZFS_IOC_UNSET_ZEV_CALLBACKS,
5789 	    zfs_ioc_unset_zev_callbacks, zfs_secpolicy_unset_zev_callbacks,
5790 	    NO_NAME, POOL_CHECK_NONE, B_TRUE, B_FALSE);
5791 	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
5792 	    zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
5793 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE);
5794 
5795 	zfs_ioctl_register("bookmark", ZFS_IOC_BOOKMARK,
5796 	    zfs_ioc_bookmark, zfs_secpolicy_bookmark, POOL_NAME,
5797 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5798 
5799 	zfs_ioctl_register("get_bookmarks", ZFS_IOC_GET_BOOKMARKS,
5800 	    zfs_ioc_get_bookmarks, zfs_secpolicy_read, DATASET_NAME,
5801 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5802 
5803 	zfs_ioctl_register("destroy_bookmarks", ZFS_IOC_DESTROY_BOOKMARKS,
5804 	    zfs_ioc_destroy_bookmarks, zfs_secpolicy_destroy_bookmarks,
5805 	    POOL_NAME,
5806 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5807 
5808 	/* IOCTLS that use the legacy function signature */
5809 
5810 	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5811 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5812 
5813 	zfs_ioctl_register_legacy(ZFS_IOC_ARC_INFO, zfs_ioc_arc_info,
5814 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_NONE);
5815 
5816 	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5817 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5818 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5819 	    zfs_ioc_pool_scan);
5820 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5821 	    zfs_ioc_pool_upgrade);
5822 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5823 	    zfs_ioc_vdev_add);
5824 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5825 	    zfs_ioc_vdev_remove);
5826 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5827 	    zfs_ioc_vdev_set_state);
5828 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5829 	    zfs_ioc_vdev_attach);
5830 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5831 	    zfs_ioc_vdev_detach);
5832 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5833 	    zfs_ioc_vdev_setpath);
5834 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5835 	    zfs_ioc_vdev_setfru);
5836 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5837 	    zfs_ioc_pool_set_props);
5838 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5839 	    zfs_ioc_vdev_split);
5840 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5841 	    zfs_ioc_pool_reguid);
5842 
5843 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5844 	    zfs_ioc_pool_configs, zfs_secpolicy_none);
5845 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5846 	    zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5847 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5848 	    zfs_ioc_inject_fault, zfs_secpolicy_inject);
5849 	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5850 	    zfs_ioc_clear_fault, zfs_secpolicy_inject);
5851 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5852 	    zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5853 
5854 	/*
5855 	 * pool destroy, and export don't log the history as part of
5856 	 * zfsdev_ioctl, but rather zfs_ioc_pool_export
5857 	 * does the logging of those commands.
5858 	 */
5859 	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5860 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5861 	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5862 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5863 
5864 	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5865 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5866 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5867 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5868 
5869 	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5870 	    zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5871 	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5872 	    zfs_ioc_dsobj_to_dsname,
5873 	    zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5874 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5875 	    zfs_ioc_pool_get_history,
5876 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5877 
5878 	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5879 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5880 
5881 	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5882 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5883 	zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5884 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5885 
5886 	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5887 	    zfs_ioc_space_written);
5888 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5889 	    zfs_ioc_objset_recvd_props);
5890 	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5891 	    zfs_ioc_next_obj);
5892 	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5893 	    zfs_ioc_get_fsacl);
5894 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5895 	    zfs_ioc_objset_stats);
5896 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5897 	    zfs_ioc_objset_zplprops);
5898 	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5899 	    zfs_ioc_dataset_list_next);
5900 	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5901 	    zfs_ioc_snapshot_list_next);
5902 	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5903 	    zfs_ioc_send_progress);
5904 
5905 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5906 	    zfs_ioc_diff, zfs_secpolicy_diff);
5907 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5908 	    zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5909 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5910 	    zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5911 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5912 	    zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5913 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5914 	    zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5915 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5916 	    zfs_ioc_send, zfs_secpolicy_send);
5917 
5918 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5919 	    zfs_secpolicy_none);
5920 	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5921 	    zfs_secpolicy_destroy);
5922 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5923 	    zfs_secpolicy_rename);
5924 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5925 	    zfs_secpolicy_recv);
5926 	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5927 	    zfs_secpolicy_promote);
5928 	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5929 	    zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5930 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5931 	    zfs_secpolicy_set_fsacl);
5932 
5933 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5934 	    zfs_secpolicy_share, POOL_CHECK_NONE);
5935 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5936 	    zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5937 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5938 	    zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5939 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5940 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5941 	    zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5942 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5943 }
5944 
5945 int
5946 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5947     zfs_ioc_poolcheck_t check)
5948 {
5949 	spa_t *spa;
5950 	int error;
5951 
5952 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
5953 
5954 	if (check & POOL_CHECK_NONE)
5955 		return (0);
5956 
5957 	error = spa_open(name, &spa, FTAG);
5958 	if (error == 0) {
5959 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5960 			error = SET_ERROR(EAGAIN);
5961 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5962 			error = SET_ERROR(EROFS);
5963 		spa_close(spa, FTAG);
5964 	}
5965 	return (error);
5966 }
5967 
5968 /*
5969  * Find a free minor number.
5970  */
5971 minor_t
5972 zfsdev_minor_alloc(void)
5973 {
5974 	static minor_t last_minor;
5975 	minor_t m;
5976 
5977 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5978 
5979 	for (m = last_minor + 1; m != last_minor; m++) {
5980 		if (m > ZFSDEV_MAX_MINOR)
5981 			m = 1;
5982 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5983 			last_minor = m;
5984 			return (m);
5985 		}
5986 	}
5987 
5988 	return (0);
5989 }
5990 
5991 static int
5992 zfs_ctldev_init(dev_t *devp)
5993 {
5994 	minor_t minor;
5995 	zfs_soft_state_t *zs;
5996 
5997 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5998 	ASSERT(getminor(*devp) == 0);
5999 
6000 	minor = zfsdev_minor_alloc();
6001 	if (minor == 0)
6002 		return (SET_ERROR(ENXIO));
6003 
6004 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
6005 		return (SET_ERROR(EAGAIN));
6006 
6007 	*devp = makedevice(getemajor(*devp), minor);
6008 
6009 	zs = ddi_get_soft_state(zfsdev_state, minor);
6010 	zs->zss_type = ZSST_CTLDEV;
6011 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
6012 
6013 	return (0);
6014 }
6015 
6016 static void
6017 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
6018 {
6019 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
6020 
6021 	zfs_onexit_destroy(zo);
6022 	ddi_soft_state_free(zfsdev_state, minor);
6023 }
6024 
6025 void *
6026 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
6027 {
6028 	zfs_soft_state_t *zp;
6029 
6030 	zp = ddi_get_soft_state(zfsdev_state, minor);
6031 	if (zp == NULL || zp->zss_type != which)
6032 		return (NULL);
6033 
6034 	return (zp->zss_data);
6035 }
6036 
6037 static int
6038 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
6039 {
6040 	int error = 0;
6041 
6042 	if (getminor(*devp) != 0)
6043 		return (zvol_open(devp, flag, otyp, cr));
6044 
6045 	/* This is the control device. Allocate a new minor if requested. */
6046 	if (flag & FEXCL) {
6047 		mutex_enter(&zfsdev_state_lock);
6048 		error = zfs_ctldev_init(devp);
6049 		mutex_exit(&zfsdev_state_lock);
6050 	}
6051 
6052 	return (error);
6053 }
6054 
6055 static int
6056 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
6057 {
6058 	zfs_onexit_t *zo;
6059 	minor_t minor = getminor(dev);
6060 
6061 	if (minor == 0)
6062 		return (0);
6063 
6064 	mutex_enter(&zfsdev_state_lock);
6065 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
6066 	if (zo == NULL) {
6067 		mutex_exit(&zfsdev_state_lock);
6068 		return (zvol_close(dev, flag, otyp, cr));
6069 	}
6070 	zfs_ctldev_destroy(zo, minor);
6071 	mutex_exit(&zfsdev_state_lock);
6072 
6073 	return (0);
6074 }
6075 
6076 static int
6077 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
6078 {
6079 	zfs_cmd_t *zc;
6080 	uint_t vecnum;
6081 	int error, rc, len;
6082 	minor_t minor = getminor(dev);
6083 	const zfs_ioc_vec_t *vec;
6084 	char *saved_poolname = NULL;
6085 	nvlist_t *innvl = NULL;
6086 
6087 	if (minor != 0 &&
6088 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
6089 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
6090 
6091 	vecnum = cmd - ZFS_IOC_FIRST;
6092 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
6093 
6094 	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
6095 		return (SET_ERROR(EINVAL));
6096 	vec = &zfs_ioc_vec[vecnum];
6097 
6098 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
6099 
6100 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
6101 	if (error != 0) {
6102 		error = SET_ERROR(EFAULT);
6103 		goto out;
6104 	}
6105 
6106 	zc->zc_iflags = flag & FKIOCTL;
6107 	if (zc->zc_nvlist_src_size != 0) {
6108 		error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
6109 		    zc->zc_iflags, &innvl);
6110 		if (error != 0)
6111 			goto out;
6112 	}
6113 
6114 	/*
6115 	 * Ensure that all pool/dataset names are valid before we pass down to
6116 	 * the lower layers.
6117 	 */
6118 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
6119 	switch (vec->zvec_namecheck) {
6120 	case POOL_NAME:
6121 		if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
6122 			error = SET_ERROR(EINVAL);
6123 		else
6124 			error = pool_status_check(zc->zc_name,
6125 			    vec->zvec_namecheck, vec->zvec_pool_check);
6126 		break;
6127 
6128 	case DATASET_NAME:
6129 		if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0 ||
6130 		    strchr(zc->zc_name, '#') != NULL)
6131 			error = SET_ERROR(EINVAL);
6132 		else
6133 			error = pool_status_check(zc->zc_name,
6134 			    vec->zvec_namecheck, vec->zvec_pool_check);
6135 		break;
6136 
6137 	case NO_NAME:
6138 		break;
6139 	}
6140 
6141 
6142 	if (error == 0 && !(flag & FKIOCTL))
6143 		error = vec->zvec_secpolicy(zc, innvl, cr);
6144 
6145 	if (error != 0)
6146 		goto out;
6147 
6148 	/* legacy ioctls can modify zc_name */
6149 	len = strcspn(zc->zc_name, "/@#") + 1;
6150 	saved_poolname = kmem_alloc(len, KM_SLEEP);
6151 	(void) strlcpy(saved_poolname, zc->zc_name, len);
6152 
6153 	if (vec->zvec_func != NULL) {
6154 		nvlist_t *outnvl;
6155 		int puterror = 0;
6156 		spa_t *spa;
6157 		nvlist_t *lognv = NULL;
6158 
6159 		ASSERT(vec->zvec_legacy_func == NULL);
6160 
6161 		/*
6162 		 * Add the innvl to the lognv before calling the func,
6163 		 * in case the func changes the innvl.
6164 		 */
6165 		if (vec->zvec_allow_log) {
6166 			lognv = fnvlist_alloc();
6167 			fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
6168 			    vec->zvec_name);
6169 			if (!nvlist_empty(innvl)) {
6170 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
6171 				    innvl);
6172 			}
6173 		}
6174 
6175 		outnvl = fnvlist_alloc();
6176 		error = vec->zvec_func(zc->zc_name, innvl, outnvl);
6177 
6178 		if (error == 0 && vec->zvec_allow_log &&
6179 		    spa_open(zc->zc_name, &spa, FTAG) == 0) {
6180 			if (!nvlist_empty(outnvl)) {
6181 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
6182 				    outnvl);
6183 			}
6184 			(void) spa_history_log_nvl(spa, lognv);
6185 			spa_close(spa, FTAG);
6186 		}
6187 		fnvlist_free(lognv);
6188 
6189 		if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
6190 			int smusherror = 0;
6191 			if (vec->zvec_smush_outnvlist) {
6192 				smusherror = nvlist_smush(outnvl,
6193 				    zc->zc_nvlist_dst_size);
6194 			}
6195 			if (smusherror == 0)
6196 				puterror = put_nvlist(zc, outnvl);
6197 		}
6198 
6199 		if (puterror != 0)
6200 			error = puterror;
6201 
6202 		nvlist_free(outnvl);
6203 	} else {
6204 		error = vec->zvec_legacy_func(zc);
6205 	}
6206 
6207 out:
6208 	nvlist_free(innvl);
6209 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
6210 	if (error == 0 && rc != 0)
6211 		error = SET_ERROR(EFAULT);
6212 	if (error == 0 && vec->zvec_allow_log) {
6213 		char *s = tsd_get(zfs_allow_log_key);
6214 		if (s != NULL)
6215 			strfree(s);
6216 		(void) tsd_set(zfs_allow_log_key, saved_poolname);
6217 	} else {
6218 		if (saved_poolname != NULL)
6219 			strfree(saved_poolname);
6220 	}
6221 
6222 	kmem_free(zc, sizeof (zfs_cmd_t));
6223 	return (error);
6224 }
6225 
6226 static int
6227 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
6228 {
6229 	if (cmd != DDI_ATTACH)
6230 		return (DDI_FAILURE);
6231 
6232 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
6233 	    DDI_PSEUDO, 0) == DDI_FAILURE)
6234 		return (DDI_FAILURE);
6235 
6236 	zfs_dip = dip;
6237 
6238 	ddi_report_dev(dip);
6239 
6240 	return (DDI_SUCCESS);
6241 }
6242 
6243 static int
6244 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
6245 {
6246 	if (spa_busy() || zfs_busy() || zvol_busy())
6247 		return (DDI_FAILURE);
6248 
6249 	if (cmd != DDI_DETACH)
6250 		return (DDI_FAILURE);
6251 
6252 	zfs_dip = NULL;
6253 
6254 	ddi_prop_remove_all(dip);
6255 	ddi_remove_minor_node(dip, NULL);
6256 
6257 	return (DDI_SUCCESS);
6258 }
6259 
6260 /*ARGSUSED*/
6261 static int
6262 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
6263 {
6264 	switch (infocmd) {
6265 	case DDI_INFO_DEVT2DEVINFO:
6266 		*result = zfs_dip;
6267 		return (DDI_SUCCESS);
6268 
6269 	case DDI_INFO_DEVT2INSTANCE:
6270 		*result = (void *)0;
6271 		return (DDI_SUCCESS);
6272 	}
6273 
6274 	return (DDI_FAILURE);
6275 }
6276 
6277 /*
6278  * OK, so this is a little weird.
6279  *
6280  * /dev/zfs is the control node, i.e. minor 0.
6281  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
6282  *
6283  * /dev/zfs has basically nothing to do except serve up ioctls,
6284  * so most of the standard driver entry points are in zvol.c.
6285  */
6286 static struct cb_ops zfs_cb_ops = {
6287 	zfsdev_open,	/* open */
6288 	zfsdev_close,	/* close */
6289 	zvol_strategy,	/* strategy */
6290 	nodev,		/* print */
6291 	zvol_dump,	/* dump */
6292 	zvol_read,	/* read */
6293 	zvol_write,	/* write */
6294 	zfsdev_ioctl,	/* ioctl */
6295 	nodev,		/* devmap */
6296 	nodev,		/* mmap */
6297 	nodev,		/* segmap */
6298 	nochpoll,	/* poll */
6299 	ddi_prop_op,	/* prop_op */
6300 	NULL,		/* streamtab */
6301 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
6302 	CB_REV,		/* version */
6303 	nodev,		/* async read */
6304 	nodev,		/* async write */
6305 };
6306 
6307 static struct dev_ops zfs_dev_ops = {
6308 	DEVO_REV,	/* version */
6309 	0,		/* refcnt */
6310 	zfs_info,	/* info */
6311 	nulldev,	/* identify */
6312 	nulldev,	/* probe */
6313 	zfs_attach,	/* attach */
6314 	zfs_detach,	/* detach */
6315 	nodev,		/* reset */
6316 	&zfs_cb_ops,	/* driver operations */
6317 	NULL,		/* no bus operations */
6318 	NULL,		/* power */
6319 	ddi_quiesce_not_needed,	/* quiesce */
6320 };
6321 
6322 static struct modldrv zfs_modldrv = {
6323 	&mod_driverops,
6324 	"ZFS storage pool",
6325 	&zfs_dev_ops
6326 };
6327 
6328 static struct modlinkage modlinkage = {
6329 	MODREV_1,
6330 	(void *)&zfs_modlfs,
6331 	(void *)&zfs_modldrv,
6332 	NULL
6333 };
6334 
6335 static void
6336 zfs_allow_log_destroy(void *arg)
6337 {
6338 	char *poolname = arg;
6339 	strfree(poolname);
6340 }
6341 
6342 int
6343 _init(void)
6344 {
6345 	int error;
6346 
6347 	spa_init(FREAD | FWRITE);
6348 	zfs_init();
6349 	zvol_init();
6350 	zfs_ioctl_init();
6351 	rz_zev_init();
6352 
6353 	if ((error = mod_install(&modlinkage)) != 0) {
6354 		zvol_fini();
6355 		zfs_fini();
6356 		spa_fini();
6357 		return (error);
6358 	}
6359 
6360 	tsd_create(&zfs_fsyncer_key, NULL);
6361 	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
6362 	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
6363 
6364 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
6365 	ASSERT(error == 0);
6366 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
6367 
6368 	return (0);
6369 }
6370 
6371 int
6372 _fini(void)
6373 {
6374 	int error;
6375 
6376 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
6377 		return (SET_ERROR(EBUSY));
6378 
6379 	if ((error = mod_remove(&modlinkage)) != 0)
6380 		return (error);
6381 
6382 	rz_zev_fini();
6383 	zvol_fini();
6384 	zfs_fini();
6385 	spa_fini();
6386 	if (zfs_nfsshare_inited)
6387 		(void) ddi_modclose(nfs_mod);
6388 	if (zfs_smbshare_inited)
6389 		(void) ddi_modclose(smbsrv_mod);
6390 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
6391 		(void) ddi_modclose(sharefs_mod);
6392 
6393 	tsd_destroy(&zfs_fsyncer_key);
6394 	ldi_ident_release(zfs_li);
6395 	zfs_li = NULL;
6396 	mutex_destroy(&zfs_share_lock);
6397 
6398 	return (error);
6399 }
6400 
6401 int
6402 _info(struct modinfo *modinfop)
6403 {
6404 	return (mod_info(&modlinkage, modinfop));
6405 }
6406