xref: /illumos-gate/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision 5602294fda888d923d57a78bafdaf48ae6223dea)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2011-2012 Pawel Jakub Dawidek. All rights reserved.
25  * Portions Copyright 2011 Martin Matuska
26  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
27  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
28  * Copyright (c) 2014, 2016 Joyent, Inc. All rights reserved.
29  * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
30  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
31  * Copyright (c) 2013 Steven Hartland. All rights reserved.
32  * Copyright (c) 2014 Integros [integros.com]
33  * Copyright 2016 Toomas Soome <tsoome@me.com>
34  */
35 
36 /*
37  * ZFS ioctls.
38  *
39  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
40  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
41  *
42  * There are two ways that we handle ioctls: the legacy way where almost
43  * all of the logic is in the ioctl callback, and the new way where most
44  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
45  *
46  * Non-legacy ioctls should be registered by calling
47  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
48  * from userland by lzc_ioctl().
49  *
50  * The registration arguments are as follows:
51  *
52  * const char *name
53  *   The name of the ioctl.  This is used for history logging.  If the
54  *   ioctl returns successfully (the callback returns 0), and allow_log
55  *   is true, then a history log entry will be recorded with the input &
56  *   output nvlists.  The log entry can be printed with "zpool history -i".
57  *
58  * zfs_ioc_t ioc
59  *   The ioctl request number, which userland will pass to ioctl(2).
60  *   The ioctl numbers can change from release to release, because
61  *   the caller (libzfs) must be matched to the kernel.
62  *
63  * zfs_secpolicy_func_t *secpolicy
64  *   This function will be called before the zfs_ioc_func_t, to
65  *   determine if this operation is permitted.  It should return EPERM
66  *   on failure, and 0 on success.  Checks include determining if the
67  *   dataset is visible in this zone, and if the user has either all
68  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
69  *   to do this operation on this dataset with "zfs allow".
70  *
71  * zfs_ioc_namecheck_t namecheck
72  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
73  *   name, a dataset name, or nothing.  If the name is not well-formed,
74  *   the ioctl will fail and the callback will not be called.
75  *   Therefore, the callback can assume that the name is well-formed
76  *   (e.g. is null-terminated, doesn't have more than one '@' character,
77  *   doesn't have invalid characters).
78  *
79  * zfs_ioc_poolcheck_t pool_check
80  *   This specifies requirements on the pool state.  If the pool does
81  *   not meet them (is suspended or is readonly), the ioctl will fail
82  *   and the callback will not be called.  If any checks are specified
83  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
84  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
85  *   POOL_CHECK_READONLY).
86  *
87  * boolean_t smush_outnvlist
88  *   If smush_outnvlist is true, then the output is presumed to be a
89  *   list of errors, and it will be "smushed" down to fit into the
90  *   caller's buffer, by removing some entries and replacing them with a
91  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
92  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
93  *   outnvlist does not fit into the userland-provided buffer, then the
94  *   ioctl will fail with ENOMEM.
95  *
96  * zfs_ioc_func_t *func
97  *   The callback function that will perform the operation.
98  *
99  *   The callback should return 0 on success, or an error number on
100  *   failure.  If the function fails, the userland ioctl will return -1,
101  *   and errno will be set to the callback's return value.  The callback
102  *   will be called with the following arguments:
103  *
104  *   const char *name
105  *     The name of the pool or dataset to operate on, from
106  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
107  *     expected type (pool, dataset, or none).
108  *
109  *   nvlist_t *innvl
110  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
111  *     NULL if no input nvlist was provided.  Changes to this nvlist are
112  *     ignored.  If the input nvlist could not be deserialized, the
113  *     ioctl will fail and the callback will not be called.
114  *
115  *   nvlist_t *outnvl
116  *     The output nvlist, initially empty.  The callback can fill it in,
117  *     and it will be returned to userland by serializing it into
118  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
119  *     fails (e.g. because the caller didn't supply a large enough
120  *     buffer), then the overall ioctl will fail.  See the
121  *     'smush_nvlist' argument above for additional behaviors.
122  *
123  *     There are two typical uses of the output nvlist:
124  *       - To return state, e.g. property values.  In this case,
125  *         smush_outnvlist should be false.  If the buffer was not large
126  *         enough, the caller will reallocate a larger buffer and try
127  *         the ioctl again.
128  *
129  *       - To return multiple errors from an ioctl which makes on-disk
130  *         changes.  In this case, smush_outnvlist should be true.
131  *         Ioctls which make on-disk modifications should generally not
132  *         use the outnvl if they succeed, because the caller can not
133  *         distinguish between the operation failing, and
134  *         deserialization failing.
135  */
136 
137 #include <sys/types.h>
138 #include <sys/param.h>
139 #include <sys/errno.h>
140 #include <sys/uio.h>
141 #include <sys/buf.h>
142 #include <sys/modctl.h>
143 #include <sys/open.h>
144 #include <sys/file.h>
145 #include <sys/kmem.h>
146 #include <sys/conf.h>
147 #include <sys/cmn_err.h>
148 #include <sys/stat.h>
149 #include <sys/zfs_ioctl.h>
150 #include <sys/zfs_vfsops.h>
151 #include <sys/zfs_znode.h>
152 #include <sys/zap.h>
153 #include <sys/spa.h>
154 #include <sys/spa_impl.h>
155 #include <sys/vdev.h>
156 #include <sys/priv_impl.h>
157 #include <sys/dmu.h>
158 #include <sys/dsl_dir.h>
159 #include <sys/dsl_dataset.h>
160 #include <sys/dsl_prop.h>
161 #include <sys/dsl_deleg.h>
162 #include <sys/dmu_objset.h>
163 #include <sys/dmu_impl.h>
164 #include <sys/dmu_tx.h>
165 #include <sys/ddi.h>
166 #include <sys/sunddi.h>
167 #include <sys/sunldi.h>
168 #include <sys/policy.h>
169 #include <sys/zone.h>
170 #include <sys/nvpair.h>
171 #include <sys/pathname.h>
172 #include <sys/mount.h>
173 #include <sys/sdt.h>
174 #include <sys/fs/zfs.h>
175 #include <sys/zfs_ctldir.h>
176 #include <sys/zfs_dir.h>
177 #include <sys/zfs_onexit.h>
178 #include <sys/zvol.h>
179 #include <sys/dsl_scan.h>
180 #include <sharefs/share.h>
181 #include <sys/dmu_objset.h>
182 #include <sys/dmu_send.h>
183 #include <sys/dsl_destroy.h>
184 #include <sys/dsl_bookmark.h>
185 #include <sys/dsl_userhold.h>
186 #include <sys/zfeature.h>
187 #include <sys/zio_checksum.h>
188 
189 #include "zfs_namecheck.h"
190 #include "zfs_prop.h"
191 #include "zfs_deleg.h"
192 #include "zfs_comutil.h"
193 
194 extern struct modlfs zfs_modlfs;
195 
196 extern void zfs_init(void);
197 extern void zfs_fini(void);
198 
199 ldi_ident_t zfs_li = NULL;
200 dev_info_t *zfs_dip;
201 
202 uint_t zfs_fsyncer_key;
203 extern uint_t rrw_tsd_key;
204 static uint_t zfs_allow_log_key;
205 
206 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
207 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
208 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
209 
210 typedef enum {
211 	NO_NAME,
212 	POOL_NAME,
213 	DATASET_NAME
214 } zfs_ioc_namecheck_t;
215 
216 typedef enum {
217 	POOL_CHECK_NONE		= 1 << 0,
218 	POOL_CHECK_SUSPENDED	= 1 << 1,
219 	POOL_CHECK_READONLY	= 1 << 2,
220 } zfs_ioc_poolcheck_t;
221 
222 typedef struct zfs_ioc_vec {
223 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
224 	zfs_ioc_func_t		*zvec_func;
225 	zfs_secpolicy_func_t	*zvec_secpolicy;
226 	zfs_ioc_namecheck_t	zvec_namecheck;
227 	boolean_t		zvec_allow_log;
228 	zfs_ioc_poolcheck_t	zvec_pool_check;
229 	boolean_t		zvec_smush_outnvlist;
230 	const char		*zvec_name;
231 } zfs_ioc_vec_t;
232 
233 /* This array is indexed by zfs_userquota_prop_t */
234 static const char *userquota_perms[] = {
235 	ZFS_DELEG_PERM_USERUSED,
236 	ZFS_DELEG_PERM_USERQUOTA,
237 	ZFS_DELEG_PERM_GROUPUSED,
238 	ZFS_DELEG_PERM_GROUPQUOTA,
239 };
240 
241 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
242 static int zfs_check_settable(const char *name, nvpair_t *property,
243     cred_t *cr);
244 static int zfs_check_clearable(char *dataset, nvlist_t *props,
245     nvlist_t **errors);
246 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
247     boolean_t *);
248 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
249 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
250 
251 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
252 
253 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
254 void
255 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
256 {
257 	const char *newfile;
258 	char buf[512];
259 	va_list adx;
260 
261 	/*
262 	 * Get rid of annoying "../common/" prefix to filename.
263 	 */
264 	newfile = strrchr(file, '/');
265 	if (newfile != NULL) {
266 		newfile = newfile + 1; /* Get rid of leading / */
267 	} else {
268 		newfile = file;
269 	}
270 
271 	va_start(adx, fmt);
272 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
273 	va_end(adx);
274 
275 	/*
276 	 * To get this data, use the zfs-dprintf probe as so:
277 	 * dtrace -q -n 'zfs-dprintf \
278 	 *	/stringof(arg0) == "dbuf.c"/ \
279 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
280 	 * arg0 = file name
281 	 * arg1 = function name
282 	 * arg2 = line number
283 	 * arg3 = message
284 	 */
285 	DTRACE_PROBE4(zfs__dprintf,
286 	    char *, newfile, char *, func, int, line, char *, buf);
287 }
288 
289 static void
290 history_str_free(char *buf)
291 {
292 	kmem_free(buf, HIS_MAX_RECORD_LEN);
293 }
294 
295 static char *
296 history_str_get(zfs_cmd_t *zc)
297 {
298 	char *buf;
299 
300 	if (zc->zc_history == NULL)
301 		return (NULL);
302 
303 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
304 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
305 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
306 		history_str_free(buf);
307 		return (NULL);
308 	}
309 
310 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
311 
312 	return (buf);
313 }
314 
315 /*
316  * Check to see if the named dataset is currently defined as bootable
317  */
318 static boolean_t
319 zfs_is_bootfs(const char *name)
320 {
321 	objset_t *os;
322 
323 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
324 		boolean_t ret;
325 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
326 		dmu_objset_rele(os, FTAG);
327 		return (ret);
328 	}
329 	return (B_FALSE);
330 }
331 
332 /*
333  * Return non-zero if the spa version is less than requested version.
334  */
335 static int
336 zfs_earlier_version(const char *name, int version)
337 {
338 	spa_t *spa;
339 
340 	if (spa_open(name, &spa, FTAG) == 0) {
341 		if (spa_version(spa) < version) {
342 			spa_close(spa, FTAG);
343 			return (1);
344 		}
345 		spa_close(spa, FTAG);
346 	}
347 	return (0);
348 }
349 
350 /*
351  * Return TRUE if the ZPL version is less than requested version.
352  */
353 static boolean_t
354 zpl_earlier_version(const char *name, int version)
355 {
356 	objset_t *os;
357 	boolean_t rc = B_TRUE;
358 
359 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
360 		uint64_t zplversion;
361 
362 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
363 			dmu_objset_rele(os, FTAG);
364 			return (B_TRUE);
365 		}
366 		/* XXX reading from non-owned objset */
367 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
368 			rc = zplversion < version;
369 		dmu_objset_rele(os, FTAG);
370 	}
371 	return (rc);
372 }
373 
374 static void
375 zfs_log_history(zfs_cmd_t *zc)
376 {
377 	spa_t *spa;
378 	char *buf;
379 
380 	if ((buf = history_str_get(zc)) == NULL)
381 		return;
382 
383 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
384 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
385 			(void) spa_history_log(spa, buf);
386 		spa_close(spa, FTAG);
387 	}
388 	history_str_free(buf);
389 }
390 
391 /*
392  * Policy for top-level read operations (list pools).  Requires no privileges,
393  * and can be used in the local zone, as there is no associated dataset.
394  */
395 /* ARGSUSED */
396 static int
397 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
398 {
399 	return (0);
400 }
401 
402 /*
403  * Policy for dataset read operations (list children, get statistics).  Requires
404  * no privileges, but must be visible in the local zone.
405  */
406 /* ARGSUSED */
407 static int
408 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
409 {
410 	if (INGLOBALZONE(curproc) ||
411 	    zone_dataset_visible(zc->zc_name, NULL))
412 		return (0);
413 
414 	return (SET_ERROR(ENOENT));
415 }
416 
417 static int
418 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
419 {
420 	int writable = 1;
421 
422 	/*
423 	 * The dataset must be visible by this zone -- check this first
424 	 * so they don't see EPERM on something they shouldn't know about.
425 	 */
426 	if (!INGLOBALZONE(curproc) &&
427 	    !zone_dataset_visible(dataset, &writable))
428 		return (SET_ERROR(ENOENT));
429 
430 	if (INGLOBALZONE(curproc)) {
431 		/*
432 		 * If the fs is zoned, only root can access it from the
433 		 * global zone.
434 		 */
435 		if (secpolicy_zfs(cr) && zoned)
436 			return (SET_ERROR(EPERM));
437 	} else {
438 		/*
439 		 * If we are in a local zone, the 'zoned' property must be set.
440 		 */
441 		if (!zoned)
442 			return (SET_ERROR(EPERM));
443 
444 		/* must be writable by this zone */
445 		if (!writable)
446 			return (SET_ERROR(EPERM));
447 	}
448 	return (0);
449 }
450 
451 static int
452 zfs_dozonecheck(const char *dataset, cred_t *cr)
453 {
454 	uint64_t zoned;
455 
456 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
457 		return (SET_ERROR(ENOENT));
458 
459 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
460 }
461 
462 static int
463 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
464 {
465 	uint64_t zoned;
466 
467 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
468 		return (SET_ERROR(ENOENT));
469 
470 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
471 }
472 
473 static int
474 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
475     const char *perm, cred_t *cr)
476 {
477 	int error;
478 
479 	error = zfs_dozonecheck_ds(name, ds, cr);
480 	if (error == 0) {
481 		error = secpolicy_zfs(cr);
482 		if (error != 0)
483 			error = dsl_deleg_access_impl(ds, perm, cr);
484 	}
485 	return (error);
486 }
487 
488 static int
489 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
490 {
491 	int error;
492 	dsl_dataset_t *ds;
493 	dsl_pool_t *dp;
494 
495 	/*
496 	 * First do a quick check for root in the global zone, which
497 	 * is allowed to do all write_perms.  This ensures that zfs_ioc_*
498 	 * will get to handle nonexistent datasets.
499 	 */
500 	if (INGLOBALZONE(curproc) && secpolicy_zfs(cr) == 0)
501 		return (0);
502 
503 	error = dsl_pool_hold(name, FTAG, &dp);
504 	if (error != 0)
505 		return (error);
506 
507 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
508 	if (error != 0) {
509 		dsl_pool_rele(dp, FTAG);
510 		return (error);
511 	}
512 
513 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
514 
515 	dsl_dataset_rele(ds, FTAG);
516 	dsl_pool_rele(dp, FTAG);
517 	return (error);
518 }
519 
520 /*
521  * Policy for setting the security label property.
522  *
523  * Returns 0 for success, non-zero for access and other errors.
524  */
525 static int
526 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
527 {
528 	char		ds_hexsl[MAXNAMELEN];
529 	bslabel_t	ds_sl, new_sl;
530 	boolean_t	new_default = FALSE;
531 	uint64_t	zoned;
532 	int		needed_priv = -1;
533 	int		error;
534 
535 	/* First get the existing dataset label. */
536 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
537 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
538 	if (error != 0)
539 		return (SET_ERROR(EPERM));
540 
541 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
542 		new_default = TRUE;
543 
544 	/* The label must be translatable */
545 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
546 		return (SET_ERROR(EINVAL));
547 
548 	/*
549 	 * In a non-global zone, disallow attempts to set a label that
550 	 * doesn't match that of the zone; otherwise no other checks
551 	 * are needed.
552 	 */
553 	if (!INGLOBALZONE(curproc)) {
554 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
555 			return (SET_ERROR(EPERM));
556 		return (0);
557 	}
558 
559 	/*
560 	 * For global-zone datasets (i.e., those whose zoned property is
561 	 * "off", verify that the specified new label is valid for the
562 	 * global zone.
563 	 */
564 	if (dsl_prop_get_integer(name,
565 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
566 		return (SET_ERROR(EPERM));
567 	if (!zoned) {
568 		if (zfs_check_global_label(name, strval) != 0)
569 			return (SET_ERROR(EPERM));
570 	}
571 
572 	/*
573 	 * If the existing dataset label is nondefault, check if the
574 	 * dataset is mounted (label cannot be changed while mounted).
575 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
576 	 * mounted (or isn't a dataset, doesn't exist, ...).
577 	 */
578 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
579 		objset_t *os;
580 		static char *setsl_tag = "setsl_tag";
581 
582 		/*
583 		 * Try to own the dataset; abort if there is any error,
584 		 * (e.g., already mounted, in use, or other error).
585 		 */
586 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
587 		    setsl_tag, &os);
588 		if (error != 0)
589 			return (SET_ERROR(EPERM));
590 
591 		dmu_objset_disown(os, setsl_tag);
592 
593 		if (new_default) {
594 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
595 			goto out_check;
596 		}
597 
598 		if (hexstr_to_label(strval, &new_sl) != 0)
599 			return (SET_ERROR(EPERM));
600 
601 		if (blstrictdom(&ds_sl, &new_sl))
602 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
603 		else if (blstrictdom(&new_sl, &ds_sl))
604 			needed_priv = PRIV_FILE_UPGRADE_SL;
605 	} else {
606 		/* dataset currently has a default label */
607 		if (!new_default)
608 			needed_priv = PRIV_FILE_UPGRADE_SL;
609 	}
610 
611 out_check:
612 	if (needed_priv != -1)
613 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
614 	return (0);
615 }
616 
617 static int
618 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
619     cred_t *cr)
620 {
621 	char *strval;
622 
623 	/*
624 	 * Check permissions for special properties.
625 	 */
626 	switch (prop) {
627 	case ZFS_PROP_ZONED:
628 		/*
629 		 * Disallow setting of 'zoned' from within a local zone.
630 		 */
631 		if (!INGLOBALZONE(curproc))
632 			return (SET_ERROR(EPERM));
633 		break;
634 
635 	case ZFS_PROP_QUOTA:
636 	case ZFS_PROP_FILESYSTEM_LIMIT:
637 	case ZFS_PROP_SNAPSHOT_LIMIT:
638 		if (!INGLOBALZONE(curproc)) {
639 			uint64_t zoned;
640 			char setpoint[ZFS_MAX_DATASET_NAME_LEN];
641 			/*
642 			 * Unprivileged users are allowed to modify the
643 			 * limit on things *under* (ie. contained by)
644 			 * the thing they own.
645 			 */
646 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
647 			    setpoint))
648 				return (SET_ERROR(EPERM));
649 			if (!zoned || strlen(dsname) <= strlen(setpoint))
650 				return (SET_ERROR(EPERM));
651 		}
652 		break;
653 
654 	case ZFS_PROP_MLSLABEL:
655 		if (!is_system_labeled())
656 			return (SET_ERROR(EPERM));
657 
658 		if (nvpair_value_string(propval, &strval) == 0) {
659 			int err;
660 
661 			err = zfs_set_slabel_policy(dsname, strval, CRED());
662 			if (err != 0)
663 				return (err);
664 		}
665 		break;
666 	}
667 
668 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
669 }
670 
671 /* ARGSUSED */
672 static int
673 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
674 {
675 	int error;
676 
677 	error = zfs_dozonecheck(zc->zc_name, cr);
678 	if (error != 0)
679 		return (error);
680 
681 	/*
682 	 * permission to set permissions will be evaluated later in
683 	 * dsl_deleg_can_allow()
684 	 */
685 	return (0);
686 }
687 
688 /* ARGSUSED */
689 static int
690 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
691 {
692 	return (zfs_secpolicy_write_perms(zc->zc_name,
693 	    ZFS_DELEG_PERM_ROLLBACK, cr));
694 }
695 
696 /* ARGSUSED */
697 static int
698 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
699 {
700 	dsl_pool_t *dp;
701 	dsl_dataset_t *ds;
702 	char *cp;
703 	int error;
704 
705 	/*
706 	 * Generate the current snapshot name from the given objsetid, then
707 	 * use that name for the secpolicy/zone checks.
708 	 */
709 	cp = strchr(zc->zc_name, '@');
710 	if (cp == NULL)
711 		return (SET_ERROR(EINVAL));
712 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
713 	if (error != 0)
714 		return (error);
715 
716 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
717 	if (error != 0) {
718 		dsl_pool_rele(dp, FTAG);
719 		return (error);
720 	}
721 
722 	dsl_dataset_name(ds, zc->zc_name);
723 
724 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
725 	    ZFS_DELEG_PERM_SEND, cr);
726 	dsl_dataset_rele(ds, FTAG);
727 	dsl_pool_rele(dp, FTAG);
728 
729 	return (error);
730 }
731 
732 /* ARGSUSED */
733 static int
734 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
735 {
736 	return (zfs_secpolicy_write_perms(zc->zc_name,
737 	    ZFS_DELEG_PERM_SEND, cr));
738 }
739 
740 /* ARGSUSED */
741 static int
742 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
743 {
744 	vnode_t *vp;
745 	int error;
746 
747 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
748 	    NO_FOLLOW, NULL, &vp)) != 0)
749 		return (error);
750 
751 	/* Now make sure mntpnt and dataset are ZFS */
752 
753 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
754 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
755 	    zc->zc_name) != 0)) {
756 		VN_RELE(vp);
757 		return (SET_ERROR(EPERM));
758 	}
759 
760 	VN_RELE(vp);
761 	return (dsl_deleg_access(zc->zc_name,
762 	    ZFS_DELEG_PERM_SHARE, cr));
763 }
764 
765 int
766 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
767 {
768 	if (!INGLOBALZONE(curproc))
769 		return (SET_ERROR(EPERM));
770 
771 	if (secpolicy_nfs(cr) == 0) {
772 		return (0);
773 	} else {
774 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
775 	}
776 }
777 
778 int
779 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
780 {
781 	if (!INGLOBALZONE(curproc))
782 		return (SET_ERROR(EPERM));
783 
784 	if (secpolicy_smb(cr) == 0) {
785 		return (0);
786 	} else {
787 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
788 	}
789 }
790 
791 static int
792 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
793 {
794 	char *cp;
795 
796 	/*
797 	 * Remove the @bla or /bla from the end of the name to get the parent.
798 	 */
799 	(void) strncpy(parent, datasetname, parentsize);
800 	cp = strrchr(parent, '@');
801 	if (cp != NULL) {
802 		cp[0] = '\0';
803 	} else {
804 		cp = strrchr(parent, '/');
805 		if (cp == NULL)
806 			return (SET_ERROR(ENOENT));
807 		cp[0] = '\0';
808 	}
809 
810 	return (0);
811 }
812 
813 int
814 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
815 {
816 	int error;
817 
818 	if ((error = zfs_secpolicy_write_perms(name,
819 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
820 		return (error);
821 
822 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
823 }
824 
825 /* ARGSUSED */
826 static int
827 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
828 {
829 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
830 }
831 
832 /*
833  * Destroying snapshots with delegated permissions requires
834  * descendant mount and destroy permissions.
835  */
836 /* ARGSUSED */
837 static int
838 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
839 {
840 	nvlist_t *snaps;
841 	nvpair_t *pair, *nextpair;
842 	int error = 0;
843 
844 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
845 		return (SET_ERROR(EINVAL));
846 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
847 	    pair = nextpair) {
848 		nextpair = nvlist_next_nvpair(snaps, pair);
849 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
850 		if (error == ENOENT) {
851 			/*
852 			 * Ignore any snapshots that don't exist (we consider
853 			 * them "already destroyed").  Remove the name from the
854 			 * nvl here in case the snapshot is created between
855 			 * now and when we try to destroy it (in which case
856 			 * we don't want to destroy it since we haven't
857 			 * checked for permission).
858 			 */
859 			fnvlist_remove_nvpair(snaps, pair);
860 			error = 0;
861 		}
862 		if (error != 0)
863 			break;
864 	}
865 
866 	return (error);
867 }
868 
869 int
870 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
871 {
872 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
873 	int	error;
874 
875 	if ((error = zfs_secpolicy_write_perms(from,
876 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
877 		return (error);
878 
879 	if ((error = zfs_secpolicy_write_perms(from,
880 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
881 		return (error);
882 
883 	if ((error = zfs_get_parent(to, parentname,
884 	    sizeof (parentname))) != 0)
885 		return (error);
886 
887 	if ((error = zfs_secpolicy_write_perms(parentname,
888 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
889 		return (error);
890 
891 	if ((error = zfs_secpolicy_write_perms(parentname,
892 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
893 		return (error);
894 
895 	return (error);
896 }
897 
898 /* ARGSUSED */
899 static int
900 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
901 {
902 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
903 }
904 
905 /* ARGSUSED */
906 static int
907 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
908 {
909 	dsl_pool_t *dp;
910 	dsl_dataset_t *clone;
911 	int error;
912 
913 	error = zfs_secpolicy_write_perms(zc->zc_name,
914 	    ZFS_DELEG_PERM_PROMOTE, cr);
915 	if (error != 0)
916 		return (error);
917 
918 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
919 	if (error != 0)
920 		return (error);
921 
922 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
923 
924 	if (error == 0) {
925 		char parentname[ZFS_MAX_DATASET_NAME_LEN];
926 		dsl_dataset_t *origin = NULL;
927 		dsl_dir_t *dd;
928 		dd = clone->ds_dir;
929 
930 		error = dsl_dataset_hold_obj(dd->dd_pool,
931 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
932 		if (error != 0) {
933 			dsl_dataset_rele(clone, FTAG);
934 			dsl_pool_rele(dp, FTAG);
935 			return (error);
936 		}
937 
938 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
939 		    ZFS_DELEG_PERM_MOUNT, cr);
940 
941 		dsl_dataset_name(origin, parentname);
942 		if (error == 0) {
943 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
944 			    ZFS_DELEG_PERM_PROMOTE, cr);
945 		}
946 		dsl_dataset_rele(clone, FTAG);
947 		dsl_dataset_rele(origin, FTAG);
948 	}
949 	dsl_pool_rele(dp, FTAG);
950 	return (error);
951 }
952 
953 /* ARGSUSED */
954 static int
955 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
956 {
957 	int error;
958 
959 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
960 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
961 		return (error);
962 
963 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
964 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
965 		return (error);
966 
967 	return (zfs_secpolicy_write_perms(zc->zc_name,
968 	    ZFS_DELEG_PERM_CREATE, cr));
969 }
970 
971 int
972 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
973 {
974 	return (zfs_secpolicy_write_perms(name,
975 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
976 }
977 
978 /*
979  * Check for permission to create each snapshot in the nvlist.
980  */
981 /* ARGSUSED */
982 static int
983 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
984 {
985 	nvlist_t *snaps;
986 	int error = 0;
987 	nvpair_t *pair;
988 
989 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
990 		return (SET_ERROR(EINVAL));
991 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
992 	    pair = nvlist_next_nvpair(snaps, pair)) {
993 		char *name = nvpair_name(pair);
994 		char *atp = strchr(name, '@');
995 
996 		if (atp == NULL) {
997 			error = SET_ERROR(EINVAL);
998 			break;
999 		}
1000 		*atp = '\0';
1001 		error = zfs_secpolicy_snapshot_perms(name, cr);
1002 		*atp = '@';
1003 		if (error != 0)
1004 			break;
1005 	}
1006 	return (error);
1007 }
1008 
1009 /*
1010  * Check for permission to create each snapshot in the nvlist.
1011  */
1012 /* ARGSUSED */
1013 static int
1014 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1015 {
1016 	int error = 0;
1017 
1018 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1019 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1020 		char *name = nvpair_name(pair);
1021 		char *hashp = strchr(name, '#');
1022 
1023 		if (hashp == NULL) {
1024 			error = SET_ERROR(EINVAL);
1025 			break;
1026 		}
1027 		*hashp = '\0';
1028 		error = zfs_secpolicy_write_perms(name,
1029 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1030 		*hashp = '#';
1031 		if (error != 0)
1032 			break;
1033 	}
1034 	return (error);
1035 }
1036 
1037 /* ARGSUSED */
1038 static int
1039 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1040 {
1041 	nvpair_t *pair, *nextpair;
1042 	int error = 0;
1043 
1044 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1045 	    pair = nextpair) {
1046 		char *name = nvpair_name(pair);
1047 		char *hashp = strchr(name, '#');
1048 		nextpair = nvlist_next_nvpair(innvl, pair);
1049 
1050 		if (hashp == NULL) {
1051 			error = SET_ERROR(EINVAL);
1052 			break;
1053 		}
1054 
1055 		*hashp = '\0';
1056 		error = zfs_secpolicy_write_perms(name,
1057 		    ZFS_DELEG_PERM_DESTROY, cr);
1058 		*hashp = '#';
1059 		if (error == ENOENT) {
1060 			/*
1061 			 * Ignore any filesystems that don't exist (we consider
1062 			 * their bookmarks "already destroyed").  Remove
1063 			 * the name from the nvl here in case the filesystem
1064 			 * is created between now and when we try to destroy
1065 			 * the bookmark (in which case we don't want to
1066 			 * destroy it since we haven't checked for permission).
1067 			 */
1068 			fnvlist_remove_nvpair(innvl, pair);
1069 			error = 0;
1070 		}
1071 		if (error != 0)
1072 			break;
1073 	}
1074 
1075 	return (error);
1076 }
1077 
1078 /* ARGSUSED */
1079 static int
1080 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1081 {
1082 	/*
1083 	 * Even root must have a proper TSD so that we know what pool
1084 	 * to log to.
1085 	 */
1086 	if (tsd_get(zfs_allow_log_key) == NULL)
1087 		return (SET_ERROR(EPERM));
1088 	return (0);
1089 }
1090 
1091 static int
1092 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1093 {
1094 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
1095 	int	error;
1096 	char	*origin;
1097 
1098 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1099 	    sizeof (parentname))) != 0)
1100 		return (error);
1101 
1102 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1103 	    (error = zfs_secpolicy_write_perms(origin,
1104 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1105 		return (error);
1106 
1107 	if ((error = zfs_secpolicy_write_perms(parentname,
1108 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1109 		return (error);
1110 
1111 	return (zfs_secpolicy_write_perms(parentname,
1112 	    ZFS_DELEG_PERM_MOUNT, cr));
1113 }
1114 
1115 /*
1116  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1117  * SYS_CONFIG privilege, which is not available in a local zone.
1118  */
1119 /* ARGSUSED */
1120 static int
1121 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1122 {
1123 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1124 		return (SET_ERROR(EPERM));
1125 
1126 	return (0);
1127 }
1128 
1129 /*
1130  * Policy for object to name lookups.
1131  */
1132 /* ARGSUSED */
1133 static int
1134 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1135 {
1136 	int error;
1137 
1138 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1139 		return (0);
1140 
1141 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1142 	return (error);
1143 }
1144 
1145 /*
1146  * Policy for fault injection.  Requires all privileges.
1147  */
1148 /* ARGSUSED */
1149 static int
1150 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1151 {
1152 	return (secpolicy_zinject(cr));
1153 }
1154 
1155 /* ARGSUSED */
1156 static int
1157 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1158 {
1159 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1160 
1161 	if (prop == ZPROP_INVAL) {
1162 		if (!zfs_prop_user(zc->zc_value))
1163 			return (SET_ERROR(EINVAL));
1164 		return (zfs_secpolicy_write_perms(zc->zc_name,
1165 		    ZFS_DELEG_PERM_USERPROP, cr));
1166 	} else {
1167 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1168 		    NULL, cr));
1169 	}
1170 }
1171 
1172 static int
1173 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1174 {
1175 	int err = zfs_secpolicy_read(zc, innvl, cr);
1176 	if (err)
1177 		return (err);
1178 
1179 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1180 		return (SET_ERROR(EINVAL));
1181 
1182 	if (zc->zc_value[0] == 0) {
1183 		/*
1184 		 * They are asking about a posix uid/gid.  If it's
1185 		 * themself, allow it.
1186 		 */
1187 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1188 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1189 			if (zc->zc_guid == crgetuid(cr))
1190 				return (0);
1191 		} else {
1192 			if (groupmember(zc->zc_guid, cr))
1193 				return (0);
1194 		}
1195 	}
1196 
1197 	return (zfs_secpolicy_write_perms(zc->zc_name,
1198 	    userquota_perms[zc->zc_objset_type], cr));
1199 }
1200 
1201 static int
1202 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1203 {
1204 	int err = zfs_secpolicy_read(zc, innvl, cr);
1205 	if (err)
1206 		return (err);
1207 
1208 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1209 		return (SET_ERROR(EINVAL));
1210 
1211 	return (zfs_secpolicy_write_perms(zc->zc_name,
1212 	    userquota_perms[zc->zc_objset_type], cr));
1213 }
1214 
1215 /* ARGSUSED */
1216 static int
1217 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1218 {
1219 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1220 	    NULL, cr));
1221 }
1222 
1223 /* ARGSUSED */
1224 static int
1225 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1226 {
1227 	nvpair_t *pair;
1228 	nvlist_t *holds;
1229 	int error;
1230 
1231 	error = nvlist_lookup_nvlist(innvl, "holds", &holds);
1232 	if (error != 0)
1233 		return (SET_ERROR(EINVAL));
1234 
1235 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1236 	    pair = nvlist_next_nvpair(holds, pair)) {
1237 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1238 		error = dmu_fsname(nvpair_name(pair), fsname);
1239 		if (error != 0)
1240 			return (error);
1241 		error = zfs_secpolicy_write_perms(fsname,
1242 		    ZFS_DELEG_PERM_HOLD, cr);
1243 		if (error != 0)
1244 			return (error);
1245 	}
1246 	return (0);
1247 }
1248 
1249 /* ARGSUSED */
1250 static int
1251 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1252 {
1253 	nvpair_t *pair;
1254 	int error;
1255 
1256 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1257 	    pair = nvlist_next_nvpair(innvl, pair)) {
1258 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1259 		error = dmu_fsname(nvpair_name(pair), fsname);
1260 		if (error != 0)
1261 			return (error);
1262 		error = zfs_secpolicy_write_perms(fsname,
1263 		    ZFS_DELEG_PERM_RELEASE, cr);
1264 		if (error != 0)
1265 			return (error);
1266 	}
1267 	return (0);
1268 }
1269 
1270 /*
1271  * Policy for allowing temporary snapshots to be taken or released
1272  */
1273 static int
1274 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1275 {
1276 	/*
1277 	 * A temporary snapshot is the same as a snapshot,
1278 	 * hold, destroy and release all rolled into one.
1279 	 * Delegated diff alone is sufficient that we allow this.
1280 	 */
1281 	int error;
1282 
1283 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1284 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1285 		return (0);
1286 
1287 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1288 	if (error == 0)
1289 		error = zfs_secpolicy_hold(zc, innvl, cr);
1290 	if (error == 0)
1291 		error = zfs_secpolicy_release(zc, innvl, cr);
1292 	if (error == 0)
1293 		error = zfs_secpolicy_destroy(zc, innvl, cr);
1294 	return (error);
1295 }
1296 
1297 /*
1298  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1299  */
1300 static int
1301 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1302 {
1303 	char *packed;
1304 	int error;
1305 	nvlist_t *list = NULL;
1306 
1307 	/*
1308 	 * Read in and unpack the user-supplied nvlist.
1309 	 */
1310 	if (size == 0)
1311 		return (SET_ERROR(EINVAL));
1312 
1313 	packed = kmem_alloc(size, KM_SLEEP);
1314 
1315 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1316 	    iflag)) != 0) {
1317 		kmem_free(packed, size);
1318 		return (SET_ERROR(EFAULT));
1319 	}
1320 
1321 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1322 		kmem_free(packed, size);
1323 		return (error);
1324 	}
1325 
1326 	kmem_free(packed, size);
1327 
1328 	*nvp = list;
1329 	return (0);
1330 }
1331 
1332 /*
1333  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1334  * Entries will be removed from the end of the nvlist, and one int32 entry
1335  * named "N_MORE_ERRORS" will be added indicating how many entries were
1336  * removed.
1337  */
1338 static int
1339 nvlist_smush(nvlist_t *errors, size_t max)
1340 {
1341 	size_t size;
1342 
1343 	size = fnvlist_size(errors);
1344 
1345 	if (size > max) {
1346 		nvpair_t *more_errors;
1347 		int n = 0;
1348 
1349 		if (max < 1024)
1350 			return (SET_ERROR(ENOMEM));
1351 
1352 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1353 		more_errors = nvlist_prev_nvpair(errors, NULL);
1354 
1355 		do {
1356 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1357 			    more_errors);
1358 			fnvlist_remove_nvpair(errors, pair);
1359 			n++;
1360 			size = fnvlist_size(errors);
1361 		} while (size > max);
1362 
1363 		fnvlist_remove_nvpair(errors, more_errors);
1364 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1365 		ASSERT3U(fnvlist_size(errors), <=, max);
1366 	}
1367 
1368 	return (0);
1369 }
1370 
1371 static int
1372 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1373 {
1374 	char *packed = NULL;
1375 	int error = 0;
1376 	size_t size;
1377 
1378 	size = fnvlist_size(nvl);
1379 
1380 	if (size > zc->zc_nvlist_dst_size) {
1381 		error = SET_ERROR(ENOMEM);
1382 	} else {
1383 		packed = fnvlist_pack(nvl, &size);
1384 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1385 		    size, zc->zc_iflags) != 0)
1386 			error = SET_ERROR(EFAULT);
1387 		fnvlist_pack_free(packed, size);
1388 	}
1389 
1390 	zc->zc_nvlist_dst_size = size;
1391 	zc->zc_nvlist_dst_filled = B_TRUE;
1392 	return (error);
1393 }
1394 
1395 static int
1396 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1397 {
1398 	objset_t *os;
1399 	int error;
1400 
1401 	error = dmu_objset_hold(dsname, FTAG, &os);
1402 	if (error != 0)
1403 		return (error);
1404 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1405 		dmu_objset_rele(os, FTAG);
1406 		return (SET_ERROR(EINVAL));
1407 	}
1408 
1409 	mutex_enter(&os->os_user_ptr_lock);
1410 	*zfvp = dmu_objset_get_user(os);
1411 	if (*zfvp) {
1412 		VFS_HOLD((*zfvp)->z_vfs);
1413 	} else {
1414 		error = SET_ERROR(ESRCH);
1415 	}
1416 	mutex_exit(&os->os_user_ptr_lock);
1417 	dmu_objset_rele(os, FTAG);
1418 	return (error);
1419 }
1420 
1421 /*
1422  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1423  * case its z_vfs will be NULL, and it will be opened as the owner.
1424  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1425  * which prevents all vnode ops from running.
1426  */
1427 static int
1428 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1429 {
1430 	int error = 0;
1431 
1432 	if (getzfsvfs(name, zfvp) != 0)
1433 		error = zfsvfs_create(name, zfvp);
1434 	if (error == 0) {
1435 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1436 		    RW_READER, tag);
1437 		if ((*zfvp)->z_unmounted) {
1438 			/*
1439 			 * XXX we could probably try again, since the unmounting
1440 			 * thread should be just about to disassociate the
1441 			 * objset from the zfsvfs.
1442 			 */
1443 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1444 			return (SET_ERROR(EBUSY));
1445 		}
1446 	}
1447 	return (error);
1448 }
1449 
1450 static void
1451 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1452 {
1453 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1454 
1455 	if (zfsvfs->z_vfs) {
1456 		VFS_RELE(zfsvfs->z_vfs);
1457 	} else {
1458 		dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1459 		zfsvfs_free(zfsvfs);
1460 	}
1461 }
1462 
1463 static int
1464 zfs_ioc_pool_create(zfs_cmd_t *zc)
1465 {
1466 	int error;
1467 	nvlist_t *config, *props = NULL;
1468 	nvlist_t *rootprops = NULL;
1469 	nvlist_t *zplprops = NULL;
1470 
1471 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1472 	    zc->zc_iflags, &config))
1473 		return (error);
1474 
1475 	if (zc->zc_nvlist_src_size != 0 && (error =
1476 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1477 	    zc->zc_iflags, &props))) {
1478 		nvlist_free(config);
1479 		return (error);
1480 	}
1481 
1482 	if (props) {
1483 		nvlist_t *nvl = NULL;
1484 		uint64_t version = SPA_VERSION;
1485 
1486 		(void) nvlist_lookup_uint64(props,
1487 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1488 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1489 			error = SET_ERROR(EINVAL);
1490 			goto pool_props_bad;
1491 		}
1492 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1493 		if (nvl) {
1494 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1495 			if (error != 0) {
1496 				nvlist_free(config);
1497 				nvlist_free(props);
1498 				return (error);
1499 			}
1500 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1501 		}
1502 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1503 		error = zfs_fill_zplprops_root(version, rootprops,
1504 		    zplprops, NULL);
1505 		if (error != 0)
1506 			goto pool_props_bad;
1507 	}
1508 
1509 	error = spa_create(zc->zc_name, config, props, zplprops);
1510 
1511 	/*
1512 	 * Set the remaining root properties
1513 	 */
1514 	if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1515 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1516 		(void) spa_destroy(zc->zc_name);
1517 
1518 pool_props_bad:
1519 	nvlist_free(rootprops);
1520 	nvlist_free(zplprops);
1521 	nvlist_free(config);
1522 	nvlist_free(props);
1523 
1524 	return (error);
1525 }
1526 
1527 static int
1528 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1529 {
1530 	int error;
1531 	zfs_log_history(zc);
1532 	error = spa_destroy(zc->zc_name);
1533 	if (error == 0)
1534 		zvol_remove_minors(zc->zc_name);
1535 	return (error);
1536 }
1537 
1538 static int
1539 zfs_ioc_pool_import(zfs_cmd_t *zc)
1540 {
1541 	nvlist_t *config, *props = NULL;
1542 	uint64_t guid;
1543 	int error;
1544 
1545 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1546 	    zc->zc_iflags, &config)) != 0)
1547 		return (error);
1548 
1549 	if (zc->zc_nvlist_src_size != 0 && (error =
1550 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1551 	    zc->zc_iflags, &props))) {
1552 		nvlist_free(config);
1553 		return (error);
1554 	}
1555 
1556 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1557 	    guid != zc->zc_guid)
1558 		error = SET_ERROR(EINVAL);
1559 	else
1560 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1561 
1562 	if (zc->zc_nvlist_dst != 0) {
1563 		int err;
1564 
1565 		if ((err = put_nvlist(zc, config)) != 0)
1566 			error = err;
1567 	}
1568 
1569 	nvlist_free(config);
1570 
1571 	nvlist_free(props);
1572 
1573 	return (error);
1574 }
1575 
1576 static int
1577 zfs_ioc_pool_export(zfs_cmd_t *zc)
1578 {
1579 	int error;
1580 	boolean_t force = (boolean_t)zc->zc_cookie;
1581 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1582 
1583 	zfs_log_history(zc);
1584 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1585 	if (error == 0)
1586 		zvol_remove_minors(zc->zc_name);
1587 	return (error);
1588 }
1589 
1590 static int
1591 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1592 {
1593 	nvlist_t *configs;
1594 	int error;
1595 
1596 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1597 		return (SET_ERROR(EEXIST));
1598 
1599 	error = put_nvlist(zc, configs);
1600 
1601 	nvlist_free(configs);
1602 
1603 	return (error);
1604 }
1605 
1606 /*
1607  * inputs:
1608  * zc_name		name of the pool
1609  *
1610  * outputs:
1611  * zc_cookie		real errno
1612  * zc_nvlist_dst	config nvlist
1613  * zc_nvlist_dst_size	size of config nvlist
1614  */
1615 static int
1616 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1617 {
1618 	nvlist_t *config;
1619 	int error;
1620 	int ret = 0;
1621 
1622 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1623 	    sizeof (zc->zc_value));
1624 
1625 	if (config != NULL) {
1626 		ret = put_nvlist(zc, config);
1627 		nvlist_free(config);
1628 
1629 		/*
1630 		 * The config may be present even if 'error' is non-zero.
1631 		 * In this case we return success, and preserve the real errno
1632 		 * in 'zc_cookie'.
1633 		 */
1634 		zc->zc_cookie = error;
1635 	} else {
1636 		ret = error;
1637 	}
1638 
1639 	return (ret);
1640 }
1641 
1642 /*
1643  * Try to import the given pool, returning pool stats as appropriate so that
1644  * user land knows which devices are available and overall pool health.
1645  */
1646 static int
1647 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1648 {
1649 	nvlist_t *tryconfig, *config;
1650 	int error;
1651 
1652 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1653 	    zc->zc_iflags, &tryconfig)) != 0)
1654 		return (error);
1655 
1656 	config = spa_tryimport(tryconfig);
1657 
1658 	nvlist_free(tryconfig);
1659 
1660 	if (config == NULL)
1661 		return (SET_ERROR(EINVAL));
1662 
1663 	error = put_nvlist(zc, config);
1664 	nvlist_free(config);
1665 
1666 	return (error);
1667 }
1668 
1669 /*
1670  * inputs:
1671  * zc_name              name of the pool
1672  * zc_cookie            scan func (pool_scan_func_t)
1673  */
1674 static int
1675 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1676 {
1677 	spa_t *spa;
1678 	int error;
1679 
1680 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1681 		return (error);
1682 
1683 	if (zc->zc_cookie == POOL_SCAN_NONE)
1684 		error = spa_scan_stop(spa);
1685 	else
1686 		error = spa_scan(spa, zc->zc_cookie);
1687 
1688 	spa_close(spa, FTAG);
1689 
1690 	return (error);
1691 }
1692 
1693 static int
1694 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1695 {
1696 	spa_t *spa;
1697 	int error;
1698 
1699 	error = spa_open(zc->zc_name, &spa, FTAG);
1700 	if (error == 0) {
1701 		spa_freeze(spa);
1702 		spa_close(spa, FTAG);
1703 	}
1704 	return (error);
1705 }
1706 
1707 static int
1708 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1709 {
1710 	spa_t *spa;
1711 	int error;
1712 
1713 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1714 		return (error);
1715 
1716 	if (zc->zc_cookie < spa_version(spa) ||
1717 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1718 		spa_close(spa, FTAG);
1719 		return (SET_ERROR(EINVAL));
1720 	}
1721 
1722 	spa_upgrade(spa, zc->zc_cookie);
1723 	spa_close(spa, FTAG);
1724 
1725 	return (error);
1726 }
1727 
1728 static int
1729 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1730 {
1731 	spa_t *spa;
1732 	char *hist_buf;
1733 	uint64_t size;
1734 	int error;
1735 
1736 	if ((size = zc->zc_history_len) == 0)
1737 		return (SET_ERROR(EINVAL));
1738 
1739 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1740 		return (error);
1741 
1742 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1743 		spa_close(spa, FTAG);
1744 		return (SET_ERROR(ENOTSUP));
1745 	}
1746 
1747 	hist_buf = kmem_alloc(size, KM_SLEEP);
1748 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1749 	    &zc->zc_history_len, hist_buf)) == 0) {
1750 		error = ddi_copyout(hist_buf,
1751 		    (void *)(uintptr_t)zc->zc_history,
1752 		    zc->zc_history_len, zc->zc_iflags);
1753 	}
1754 
1755 	spa_close(spa, FTAG);
1756 	kmem_free(hist_buf, size);
1757 	return (error);
1758 }
1759 
1760 static int
1761 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1762 {
1763 	spa_t *spa;
1764 	int error;
1765 
1766 	error = spa_open(zc->zc_name, &spa, FTAG);
1767 	if (error == 0) {
1768 		error = spa_change_guid(spa);
1769 		spa_close(spa, FTAG);
1770 	}
1771 	return (error);
1772 }
1773 
1774 static int
1775 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1776 {
1777 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1778 }
1779 
1780 /*
1781  * inputs:
1782  * zc_name		name of filesystem
1783  * zc_obj		object to find
1784  *
1785  * outputs:
1786  * zc_value		name of object
1787  */
1788 static int
1789 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1790 {
1791 	objset_t *os;
1792 	int error;
1793 
1794 	/* XXX reading from objset not owned */
1795 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1796 		return (error);
1797 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1798 		dmu_objset_rele(os, FTAG);
1799 		return (SET_ERROR(EINVAL));
1800 	}
1801 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1802 	    sizeof (zc->zc_value));
1803 	dmu_objset_rele(os, FTAG);
1804 
1805 	return (error);
1806 }
1807 
1808 /*
1809  * inputs:
1810  * zc_name		name of filesystem
1811  * zc_obj		object to find
1812  *
1813  * outputs:
1814  * zc_stat		stats on object
1815  * zc_value		path to object
1816  */
1817 static int
1818 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1819 {
1820 	objset_t *os;
1821 	int error;
1822 
1823 	/* XXX reading from objset not owned */
1824 	if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1825 		return (error);
1826 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1827 		dmu_objset_rele(os, FTAG);
1828 		return (SET_ERROR(EINVAL));
1829 	}
1830 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1831 	    sizeof (zc->zc_value));
1832 	dmu_objset_rele(os, FTAG);
1833 
1834 	return (error);
1835 }
1836 
1837 static int
1838 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1839 {
1840 	spa_t *spa;
1841 	int error;
1842 	nvlist_t *config, **l2cache, **spares;
1843 	uint_t nl2cache = 0, nspares = 0;
1844 
1845 	error = spa_open(zc->zc_name, &spa, FTAG);
1846 	if (error != 0)
1847 		return (error);
1848 
1849 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1850 	    zc->zc_iflags, &config);
1851 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1852 	    &l2cache, &nl2cache);
1853 
1854 	(void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1855 	    &spares, &nspares);
1856 
1857 	/*
1858 	 * A root pool with concatenated devices is not supported.
1859 	 * Thus, can not add a device to a root pool.
1860 	 *
1861 	 * Intent log device can not be added to a rootpool because
1862 	 * during mountroot, zil is replayed, a seperated log device
1863 	 * can not be accessed during the mountroot time.
1864 	 *
1865 	 * l2cache and spare devices are ok to be added to a rootpool.
1866 	 */
1867 	if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1868 		nvlist_free(config);
1869 		spa_close(spa, FTAG);
1870 		return (SET_ERROR(EDOM));
1871 	}
1872 
1873 	if (error == 0) {
1874 		error = spa_vdev_add(spa, config);
1875 		nvlist_free(config);
1876 	}
1877 	spa_close(spa, FTAG);
1878 	return (error);
1879 }
1880 
1881 /*
1882  * inputs:
1883  * zc_name		name of the pool
1884  * zc_nvlist_conf	nvlist of devices to remove
1885  * zc_cookie		to stop the remove?
1886  */
1887 static int
1888 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1889 {
1890 	spa_t *spa;
1891 	int error;
1892 
1893 	error = spa_open(zc->zc_name, &spa, FTAG);
1894 	if (error != 0)
1895 		return (error);
1896 	error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1897 	spa_close(spa, FTAG);
1898 	return (error);
1899 }
1900 
1901 static int
1902 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1903 {
1904 	spa_t *spa;
1905 	int error;
1906 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1907 
1908 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1909 		return (error);
1910 	switch (zc->zc_cookie) {
1911 	case VDEV_STATE_ONLINE:
1912 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1913 		break;
1914 
1915 	case VDEV_STATE_OFFLINE:
1916 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1917 		break;
1918 
1919 	case VDEV_STATE_FAULTED:
1920 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1921 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1922 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1923 
1924 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1925 		break;
1926 
1927 	case VDEV_STATE_DEGRADED:
1928 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1929 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
1930 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1931 
1932 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1933 		break;
1934 
1935 	default:
1936 		error = SET_ERROR(EINVAL);
1937 	}
1938 	zc->zc_cookie = newstate;
1939 	spa_close(spa, FTAG);
1940 	return (error);
1941 }
1942 
1943 static int
1944 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1945 {
1946 	spa_t *spa;
1947 	int replacing = zc->zc_cookie;
1948 	nvlist_t *config;
1949 	int error;
1950 
1951 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1952 		return (error);
1953 
1954 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1955 	    zc->zc_iflags, &config)) == 0) {
1956 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
1957 		nvlist_free(config);
1958 	}
1959 
1960 	spa_close(spa, FTAG);
1961 	return (error);
1962 }
1963 
1964 static int
1965 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
1966 {
1967 	spa_t *spa;
1968 	int error;
1969 
1970 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1971 		return (error);
1972 
1973 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
1974 
1975 	spa_close(spa, FTAG);
1976 	return (error);
1977 }
1978 
1979 static int
1980 zfs_ioc_vdev_split(zfs_cmd_t *zc)
1981 {
1982 	spa_t *spa;
1983 	nvlist_t *config, *props = NULL;
1984 	int error;
1985 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
1986 
1987 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1988 		return (error);
1989 
1990 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1991 	    zc->zc_iflags, &config)) {
1992 		spa_close(spa, FTAG);
1993 		return (error);
1994 	}
1995 
1996 	if (zc->zc_nvlist_src_size != 0 && (error =
1997 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1998 	    zc->zc_iflags, &props))) {
1999 		spa_close(spa, FTAG);
2000 		nvlist_free(config);
2001 		return (error);
2002 	}
2003 
2004 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2005 
2006 	spa_close(spa, FTAG);
2007 
2008 	nvlist_free(config);
2009 	nvlist_free(props);
2010 
2011 	return (error);
2012 }
2013 
2014 static int
2015 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2016 {
2017 	spa_t *spa;
2018 	char *path = zc->zc_value;
2019 	uint64_t guid = zc->zc_guid;
2020 	int error;
2021 
2022 	error = spa_open(zc->zc_name, &spa, FTAG);
2023 	if (error != 0)
2024 		return (error);
2025 
2026 	error = spa_vdev_setpath(spa, guid, path);
2027 	spa_close(spa, FTAG);
2028 	return (error);
2029 }
2030 
2031 static int
2032 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2033 {
2034 	spa_t *spa;
2035 	char *fru = zc->zc_value;
2036 	uint64_t guid = zc->zc_guid;
2037 	int error;
2038 
2039 	error = spa_open(zc->zc_name, &spa, FTAG);
2040 	if (error != 0)
2041 		return (error);
2042 
2043 	error = spa_vdev_setfru(spa, guid, fru);
2044 	spa_close(spa, FTAG);
2045 	return (error);
2046 }
2047 
2048 static int
2049 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2050 {
2051 	int error = 0;
2052 	nvlist_t *nv;
2053 
2054 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2055 
2056 	if (zc->zc_nvlist_dst != 0 &&
2057 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2058 		dmu_objset_stats(os, nv);
2059 		/*
2060 		 * NB: zvol_get_stats() will read the objset contents,
2061 		 * which we aren't supposed to do with a
2062 		 * DS_MODE_USER hold, because it could be
2063 		 * inconsistent.  So this is a bit of a workaround...
2064 		 * XXX reading with out owning
2065 		 */
2066 		if (!zc->zc_objset_stats.dds_inconsistent &&
2067 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2068 			error = zvol_get_stats(os, nv);
2069 			if (error == EIO)
2070 				return (error);
2071 			VERIFY0(error);
2072 		}
2073 		error = put_nvlist(zc, nv);
2074 		nvlist_free(nv);
2075 	}
2076 
2077 	return (error);
2078 }
2079 
2080 /*
2081  * inputs:
2082  * zc_name		name of filesystem
2083  * zc_nvlist_dst_size	size of buffer for property nvlist
2084  *
2085  * outputs:
2086  * zc_objset_stats	stats
2087  * zc_nvlist_dst	property nvlist
2088  * zc_nvlist_dst_size	size of property nvlist
2089  */
2090 static int
2091 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2092 {
2093 	objset_t *os;
2094 	int error;
2095 
2096 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2097 	if (error == 0) {
2098 		error = zfs_ioc_objset_stats_impl(zc, os);
2099 		dmu_objset_rele(os, FTAG);
2100 	}
2101 
2102 	return (error);
2103 }
2104 
2105 /*
2106  * inputs:
2107  * zc_name		name of filesystem
2108  * zc_nvlist_dst_size	size of buffer for property nvlist
2109  *
2110  * outputs:
2111  * zc_nvlist_dst	received property nvlist
2112  * zc_nvlist_dst_size	size of received property nvlist
2113  *
2114  * Gets received properties (distinct from local properties on or after
2115  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2116  * local property values.
2117  */
2118 static int
2119 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2120 {
2121 	int error = 0;
2122 	nvlist_t *nv;
2123 
2124 	/*
2125 	 * Without this check, we would return local property values if the
2126 	 * caller has not already received properties on or after
2127 	 * SPA_VERSION_RECVD_PROPS.
2128 	 */
2129 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2130 		return (SET_ERROR(ENOTSUP));
2131 
2132 	if (zc->zc_nvlist_dst != 0 &&
2133 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2134 		error = put_nvlist(zc, nv);
2135 		nvlist_free(nv);
2136 	}
2137 
2138 	return (error);
2139 }
2140 
2141 static int
2142 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2143 {
2144 	uint64_t value;
2145 	int error;
2146 
2147 	/*
2148 	 * zfs_get_zplprop() will either find a value or give us
2149 	 * the default value (if there is one).
2150 	 */
2151 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2152 		return (error);
2153 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2154 	return (0);
2155 }
2156 
2157 /*
2158  * inputs:
2159  * zc_name		name of filesystem
2160  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2161  *
2162  * outputs:
2163  * zc_nvlist_dst	zpl property nvlist
2164  * zc_nvlist_dst_size	size of zpl property nvlist
2165  */
2166 static int
2167 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2168 {
2169 	objset_t *os;
2170 	int err;
2171 
2172 	/* XXX reading without owning */
2173 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2174 		return (err);
2175 
2176 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2177 
2178 	/*
2179 	 * NB: nvl_add_zplprop() will read the objset contents,
2180 	 * which we aren't supposed to do with a DS_MODE_USER
2181 	 * hold, because it could be inconsistent.
2182 	 */
2183 	if (zc->zc_nvlist_dst != NULL &&
2184 	    !zc->zc_objset_stats.dds_inconsistent &&
2185 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2186 		nvlist_t *nv;
2187 
2188 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2189 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2190 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2191 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2192 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2193 			err = put_nvlist(zc, nv);
2194 		nvlist_free(nv);
2195 	} else {
2196 		err = SET_ERROR(ENOENT);
2197 	}
2198 	dmu_objset_rele(os, FTAG);
2199 	return (err);
2200 }
2201 
2202 static boolean_t
2203 dataset_name_hidden(const char *name)
2204 {
2205 	/*
2206 	 * Skip over datasets that are not visible in this zone,
2207 	 * internal datasets (which have a $ in their name), and
2208 	 * temporary datasets (which have a % in their name).
2209 	 */
2210 	if (strchr(name, '$') != NULL)
2211 		return (B_TRUE);
2212 	if (strchr(name, '%') != NULL)
2213 		return (B_TRUE);
2214 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2215 		return (B_TRUE);
2216 	return (B_FALSE);
2217 }
2218 
2219 /*
2220  * inputs:
2221  * zc_name		name of filesystem
2222  * zc_cookie		zap cursor
2223  * zc_nvlist_dst_size	size of buffer for property nvlist
2224  *
2225  * outputs:
2226  * zc_name		name of next filesystem
2227  * zc_cookie		zap cursor
2228  * zc_objset_stats	stats
2229  * zc_nvlist_dst	property nvlist
2230  * zc_nvlist_dst_size	size of property nvlist
2231  */
2232 static int
2233 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2234 {
2235 	objset_t *os;
2236 	int error;
2237 	char *p;
2238 	size_t orig_len = strlen(zc->zc_name);
2239 
2240 top:
2241 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2242 		if (error == ENOENT)
2243 			error = SET_ERROR(ESRCH);
2244 		return (error);
2245 	}
2246 
2247 	p = strrchr(zc->zc_name, '/');
2248 	if (p == NULL || p[1] != '\0')
2249 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2250 	p = zc->zc_name + strlen(zc->zc_name);
2251 
2252 	do {
2253 		error = dmu_dir_list_next(os,
2254 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2255 		    NULL, &zc->zc_cookie);
2256 		if (error == ENOENT)
2257 			error = SET_ERROR(ESRCH);
2258 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2259 	dmu_objset_rele(os, FTAG);
2260 
2261 	/*
2262 	 * If it's an internal dataset (ie. with a '$' in its name),
2263 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2264 	 */
2265 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2266 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2267 		if (error == ENOENT) {
2268 			/* We lost a race with destroy, get the next one. */
2269 			zc->zc_name[orig_len] = '\0';
2270 			goto top;
2271 		}
2272 	}
2273 	return (error);
2274 }
2275 
2276 /*
2277  * inputs:
2278  * zc_name		name of filesystem
2279  * zc_cookie		zap cursor
2280  * zc_nvlist_dst_size	size of buffer for property nvlist
2281  * zc_simple		when set, only name is requested
2282  *
2283  * outputs:
2284  * zc_name		name of next snapshot
2285  * zc_objset_stats	stats
2286  * zc_nvlist_dst	property nvlist
2287  * zc_nvlist_dst_size	size of property nvlist
2288  */
2289 static int
2290 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2291 {
2292 	objset_t *os;
2293 	int error;
2294 
2295 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2296 	if (error != 0) {
2297 		return (error == ENOENT ? ESRCH : error);
2298 	}
2299 
2300 	/*
2301 	 * A dataset name of maximum length cannot have any snapshots,
2302 	 * so exit immediately.
2303 	 */
2304 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >=
2305 	    ZFS_MAX_DATASET_NAME_LEN) {
2306 		dmu_objset_rele(os, FTAG);
2307 		return (SET_ERROR(ESRCH));
2308 	}
2309 
2310 	error = dmu_snapshot_list_next(os,
2311 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2312 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2313 	    NULL);
2314 
2315 	if (error == 0 && !zc->zc_simple) {
2316 		dsl_dataset_t *ds;
2317 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2318 
2319 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2320 		if (error == 0) {
2321 			objset_t *ossnap;
2322 
2323 			error = dmu_objset_from_ds(ds, &ossnap);
2324 			if (error == 0)
2325 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2326 			dsl_dataset_rele(ds, FTAG);
2327 		}
2328 	} else if (error == ENOENT) {
2329 		error = SET_ERROR(ESRCH);
2330 	}
2331 
2332 	dmu_objset_rele(os, FTAG);
2333 	/* if we failed, undo the @ that we tacked on to zc_name */
2334 	if (error != 0)
2335 		*strchr(zc->zc_name, '@') = '\0';
2336 	return (error);
2337 }
2338 
2339 static int
2340 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2341 {
2342 	const char *propname = nvpair_name(pair);
2343 	uint64_t *valary;
2344 	unsigned int vallen;
2345 	const char *domain;
2346 	char *dash;
2347 	zfs_userquota_prop_t type;
2348 	uint64_t rid;
2349 	uint64_t quota;
2350 	zfsvfs_t *zfsvfs;
2351 	int err;
2352 
2353 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2354 		nvlist_t *attrs;
2355 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2356 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2357 		    &pair) != 0)
2358 			return (SET_ERROR(EINVAL));
2359 	}
2360 
2361 	/*
2362 	 * A correctly constructed propname is encoded as
2363 	 * userquota@<rid>-<domain>.
2364 	 */
2365 	if ((dash = strchr(propname, '-')) == NULL ||
2366 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2367 	    vallen != 3)
2368 		return (SET_ERROR(EINVAL));
2369 
2370 	domain = dash + 1;
2371 	type = valary[0];
2372 	rid = valary[1];
2373 	quota = valary[2];
2374 
2375 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2376 	if (err == 0) {
2377 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2378 		zfsvfs_rele(zfsvfs, FTAG);
2379 	}
2380 
2381 	return (err);
2382 }
2383 
2384 /*
2385  * If the named property is one that has a special function to set its value,
2386  * return 0 on success and a positive error code on failure; otherwise if it is
2387  * not one of the special properties handled by this function, return -1.
2388  *
2389  * XXX: It would be better for callers of the property interface if we handled
2390  * these special cases in dsl_prop.c (in the dsl layer).
2391  */
2392 static int
2393 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2394     nvpair_t *pair)
2395 {
2396 	const char *propname = nvpair_name(pair);
2397 	zfs_prop_t prop = zfs_name_to_prop(propname);
2398 	uint64_t intval;
2399 	int err = -1;
2400 
2401 	if (prop == ZPROP_INVAL) {
2402 		if (zfs_prop_userquota(propname))
2403 			return (zfs_prop_set_userquota(dsname, pair));
2404 		return (-1);
2405 	}
2406 
2407 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2408 		nvlist_t *attrs;
2409 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2410 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2411 		    &pair) == 0);
2412 	}
2413 
2414 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2415 		return (-1);
2416 
2417 	VERIFY(0 == nvpair_value_uint64(pair, &intval));
2418 
2419 	switch (prop) {
2420 	case ZFS_PROP_QUOTA:
2421 		err = dsl_dir_set_quota(dsname, source, intval);
2422 		break;
2423 	case ZFS_PROP_REFQUOTA:
2424 		err = dsl_dataset_set_refquota(dsname, source, intval);
2425 		break;
2426 	case ZFS_PROP_FILESYSTEM_LIMIT:
2427 	case ZFS_PROP_SNAPSHOT_LIMIT:
2428 		if (intval == UINT64_MAX) {
2429 			/* clearing the limit, just do it */
2430 			err = 0;
2431 		} else {
2432 			err = dsl_dir_activate_fs_ss_limit(dsname);
2433 		}
2434 		/*
2435 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2436 		 * default path to set the value in the nvlist.
2437 		 */
2438 		if (err == 0)
2439 			err = -1;
2440 		break;
2441 	case ZFS_PROP_RESERVATION:
2442 		err = dsl_dir_set_reservation(dsname, source, intval);
2443 		break;
2444 	case ZFS_PROP_REFRESERVATION:
2445 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2446 		break;
2447 	case ZFS_PROP_VOLSIZE:
2448 		err = zvol_set_volsize(dsname, intval);
2449 		break;
2450 	case ZFS_PROP_VERSION:
2451 	{
2452 		zfsvfs_t *zfsvfs;
2453 
2454 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2455 			break;
2456 
2457 		err = zfs_set_version(zfsvfs, intval);
2458 		zfsvfs_rele(zfsvfs, FTAG);
2459 
2460 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2461 			zfs_cmd_t *zc;
2462 
2463 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2464 			(void) strcpy(zc->zc_name, dsname);
2465 			(void) zfs_ioc_userspace_upgrade(zc);
2466 			kmem_free(zc, sizeof (zfs_cmd_t));
2467 		}
2468 		break;
2469 	}
2470 	default:
2471 		err = -1;
2472 	}
2473 
2474 	return (err);
2475 }
2476 
2477 /*
2478  * This function is best effort. If it fails to set any of the given properties,
2479  * it continues to set as many as it can and returns the last error
2480  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2481  * with the list of names of all the properties that failed along with the
2482  * corresponding error numbers.
2483  *
2484  * If every property is set successfully, zero is returned and errlist is not
2485  * modified.
2486  */
2487 int
2488 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2489     nvlist_t *errlist)
2490 {
2491 	nvpair_t *pair;
2492 	nvpair_t *propval;
2493 	int rv = 0;
2494 	uint64_t intval;
2495 	char *strval;
2496 	nvlist_t *genericnvl = fnvlist_alloc();
2497 	nvlist_t *retrynvl = fnvlist_alloc();
2498 
2499 retry:
2500 	pair = NULL;
2501 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2502 		const char *propname = nvpair_name(pair);
2503 		zfs_prop_t prop = zfs_name_to_prop(propname);
2504 		int err = 0;
2505 
2506 		/* decode the property value */
2507 		propval = pair;
2508 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2509 			nvlist_t *attrs;
2510 			attrs = fnvpair_value_nvlist(pair);
2511 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2512 			    &propval) != 0)
2513 				err = SET_ERROR(EINVAL);
2514 		}
2515 
2516 		/* Validate value type */
2517 		if (err == 0 && prop == ZPROP_INVAL) {
2518 			if (zfs_prop_user(propname)) {
2519 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2520 					err = SET_ERROR(EINVAL);
2521 			} else if (zfs_prop_userquota(propname)) {
2522 				if (nvpair_type(propval) !=
2523 				    DATA_TYPE_UINT64_ARRAY)
2524 					err = SET_ERROR(EINVAL);
2525 			} else {
2526 				err = SET_ERROR(EINVAL);
2527 			}
2528 		} else if (err == 0) {
2529 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2530 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2531 					err = SET_ERROR(EINVAL);
2532 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2533 				const char *unused;
2534 
2535 				intval = fnvpair_value_uint64(propval);
2536 
2537 				switch (zfs_prop_get_type(prop)) {
2538 				case PROP_TYPE_NUMBER:
2539 					break;
2540 				case PROP_TYPE_STRING:
2541 					err = SET_ERROR(EINVAL);
2542 					break;
2543 				case PROP_TYPE_INDEX:
2544 					if (zfs_prop_index_to_string(prop,
2545 					    intval, &unused) != 0)
2546 						err = SET_ERROR(EINVAL);
2547 					break;
2548 				default:
2549 					cmn_err(CE_PANIC,
2550 					    "unknown property type");
2551 				}
2552 			} else {
2553 				err = SET_ERROR(EINVAL);
2554 			}
2555 		}
2556 
2557 		/* Validate permissions */
2558 		if (err == 0)
2559 			err = zfs_check_settable(dsname, pair, CRED());
2560 
2561 		if (err == 0) {
2562 			err = zfs_prop_set_special(dsname, source, pair);
2563 			if (err == -1) {
2564 				/*
2565 				 * For better performance we build up a list of
2566 				 * properties to set in a single transaction.
2567 				 */
2568 				err = nvlist_add_nvpair(genericnvl, pair);
2569 			} else if (err != 0 && nvl != retrynvl) {
2570 				/*
2571 				 * This may be a spurious error caused by
2572 				 * receiving quota and reservation out of order.
2573 				 * Try again in a second pass.
2574 				 */
2575 				err = nvlist_add_nvpair(retrynvl, pair);
2576 			}
2577 		}
2578 
2579 		if (err != 0) {
2580 			if (errlist != NULL)
2581 				fnvlist_add_int32(errlist, propname, err);
2582 			rv = err;
2583 		}
2584 	}
2585 
2586 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2587 		nvl = retrynvl;
2588 		goto retry;
2589 	}
2590 
2591 	if (!nvlist_empty(genericnvl) &&
2592 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2593 		/*
2594 		 * If this fails, we still want to set as many properties as we
2595 		 * can, so try setting them individually.
2596 		 */
2597 		pair = NULL;
2598 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2599 			const char *propname = nvpair_name(pair);
2600 			int err = 0;
2601 
2602 			propval = pair;
2603 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2604 				nvlist_t *attrs;
2605 				attrs = fnvpair_value_nvlist(pair);
2606 				propval = fnvlist_lookup_nvpair(attrs,
2607 				    ZPROP_VALUE);
2608 			}
2609 
2610 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2611 				strval = fnvpair_value_string(propval);
2612 				err = dsl_prop_set_string(dsname, propname,
2613 				    source, strval);
2614 			} else {
2615 				intval = fnvpair_value_uint64(propval);
2616 				err = dsl_prop_set_int(dsname, propname, source,
2617 				    intval);
2618 			}
2619 
2620 			if (err != 0) {
2621 				if (errlist != NULL) {
2622 					fnvlist_add_int32(errlist, propname,
2623 					    err);
2624 				}
2625 				rv = err;
2626 			}
2627 		}
2628 	}
2629 	nvlist_free(genericnvl);
2630 	nvlist_free(retrynvl);
2631 
2632 	return (rv);
2633 }
2634 
2635 /*
2636  * Check that all the properties are valid user properties.
2637  */
2638 static int
2639 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2640 {
2641 	nvpair_t *pair = NULL;
2642 	int error = 0;
2643 
2644 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2645 		const char *propname = nvpair_name(pair);
2646 
2647 		if (!zfs_prop_user(propname) ||
2648 		    nvpair_type(pair) != DATA_TYPE_STRING)
2649 			return (SET_ERROR(EINVAL));
2650 
2651 		if (error = zfs_secpolicy_write_perms(fsname,
2652 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2653 			return (error);
2654 
2655 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2656 			return (SET_ERROR(ENAMETOOLONG));
2657 
2658 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2659 			return (E2BIG);
2660 	}
2661 	return (0);
2662 }
2663 
2664 static void
2665 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2666 {
2667 	nvpair_t *pair;
2668 
2669 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2670 
2671 	pair = NULL;
2672 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2673 		if (nvlist_exists(skipped, nvpair_name(pair)))
2674 			continue;
2675 
2676 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2677 	}
2678 }
2679 
2680 static int
2681 clear_received_props(const char *dsname, nvlist_t *props,
2682     nvlist_t *skipped)
2683 {
2684 	int err = 0;
2685 	nvlist_t *cleared_props = NULL;
2686 	props_skip(props, skipped, &cleared_props);
2687 	if (!nvlist_empty(cleared_props)) {
2688 		/*
2689 		 * Acts on local properties until the dataset has received
2690 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2691 		 */
2692 		zprop_source_t flags = (ZPROP_SRC_NONE |
2693 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2694 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2695 	}
2696 	nvlist_free(cleared_props);
2697 	return (err);
2698 }
2699 
2700 /*
2701  * inputs:
2702  * zc_name		name of filesystem
2703  * zc_value		name of property to set
2704  * zc_nvlist_src{_size}	nvlist of properties to apply
2705  * zc_cookie		received properties flag
2706  *
2707  * outputs:
2708  * zc_nvlist_dst{_size} error for each unapplied received property
2709  */
2710 static int
2711 zfs_ioc_set_prop(zfs_cmd_t *zc)
2712 {
2713 	nvlist_t *nvl;
2714 	boolean_t received = zc->zc_cookie;
2715 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2716 	    ZPROP_SRC_LOCAL);
2717 	nvlist_t *errors;
2718 	int error;
2719 
2720 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2721 	    zc->zc_iflags, &nvl)) != 0)
2722 		return (error);
2723 
2724 	if (received) {
2725 		nvlist_t *origprops;
2726 
2727 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2728 			(void) clear_received_props(zc->zc_name,
2729 			    origprops, nvl);
2730 			nvlist_free(origprops);
2731 		}
2732 
2733 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2734 	}
2735 
2736 	errors = fnvlist_alloc();
2737 	if (error == 0)
2738 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2739 
2740 	if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2741 		(void) put_nvlist(zc, errors);
2742 	}
2743 
2744 	nvlist_free(errors);
2745 	nvlist_free(nvl);
2746 	return (error);
2747 }
2748 
2749 /*
2750  * inputs:
2751  * zc_name		name of filesystem
2752  * zc_value		name of property to inherit
2753  * zc_cookie		revert to received value if TRUE
2754  *
2755  * outputs:		none
2756  */
2757 static int
2758 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2759 {
2760 	const char *propname = zc->zc_value;
2761 	zfs_prop_t prop = zfs_name_to_prop(propname);
2762 	boolean_t received = zc->zc_cookie;
2763 	zprop_source_t source = (received
2764 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2765 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2766 
2767 	if (received) {
2768 		nvlist_t *dummy;
2769 		nvpair_t *pair;
2770 		zprop_type_t type;
2771 		int err;
2772 
2773 		/*
2774 		 * zfs_prop_set_special() expects properties in the form of an
2775 		 * nvpair with type info.
2776 		 */
2777 		if (prop == ZPROP_INVAL) {
2778 			if (!zfs_prop_user(propname))
2779 				return (SET_ERROR(EINVAL));
2780 
2781 			type = PROP_TYPE_STRING;
2782 		} else if (prop == ZFS_PROP_VOLSIZE ||
2783 		    prop == ZFS_PROP_VERSION) {
2784 			return (SET_ERROR(EINVAL));
2785 		} else {
2786 			type = zfs_prop_get_type(prop);
2787 		}
2788 
2789 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2790 
2791 		switch (type) {
2792 		case PROP_TYPE_STRING:
2793 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2794 			break;
2795 		case PROP_TYPE_NUMBER:
2796 		case PROP_TYPE_INDEX:
2797 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2798 			break;
2799 		default:
2800 			nvlist_free(dummy);
2801 			return (SET_ERROR(EINVAL));
2802 		}
2803 
2804 		pair = nvlist_next_nvpair(dummy, NULL);
2805 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2806 		nvlist_free(dummy);
2807 		if (err != -1)
2808 			return (err); /* special property already handled */
2809 	} else {
2810 		/*
2811 		 * Only check this in the non-received case. We want to allow
2812 		 * 'inherit -S' to revert non-inheritable properties like quota
2813 		 * and reservation to the received or default values even though
2814 		 * they are not considered inheritable.
2815 		 */
2816 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2817 			return (SET_ERROR(EINVAL));
2818 	}
2819 
2820 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2821 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2822 }
2823 
2824 static int
2825 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2826 {
2827 	nvlist_t *props;
2828 	spa_t *spa;
2829 	int error;
2830 	nvpair_t *pair;
2831 
2832 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2833 	    zc->zc_iflags, &props))
2834 		return (error);
2835 
2836 	/*
2837 	 * If the only property is the configfile, then just do a spa_lookup()
2838 	 * to handle the faulted case.
2839 	 */
2840 	pair = nvlist_next_nvpair(props, NULL);
2841 	if (pair != NULL && strcmp(nvpair_name(pair),
2842 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2843 	    nvlist_next_nvpair(props, pair) == NULL) {
2844 		mutex_enter(&spa_namespace_lock);
2845 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2846 			spa_configfile_set(spa, props, B_FALSE);
2847 			spa_config_sync(spa, B_FALSE, B_TRUE);
2848 		}
2849 		mutex_exit(&spa_namespace_lock);
2850 		if (spa != NULL) {
2851 			nvlist_free(props);
2852 			return (0);
2853 		}
2854 	}
2855 
2856 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2857 		nvlist_free(props);
2858 		return (error);
2859 	}
2860 
2861 	error = spa_prop_set(spa, props);
2862 
2863 	nvlist_free(props);
2864 	spa_close(spa, FTAG);
2865 
2866 	return (error);
2867 }
2868 
2869 static int
2870 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2871 {
2872 	spa_t *spa;
2873 	int error;
2874 	nvlist_t *nvp = NULL;
2875 
2876 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2877 		/*
2878 		 * If the pool is faulted, there may be properties we can still
2879 		 * get (such as altroot and cachefile), so attempt to get them
2880 		 * anyway.
2881 		 */
2882 		mutex_enter(&spa_namespace_lock);
2883 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
2884 			error = spa_prop_get(spa, &nvp);
2885 		mutex_exit(&spa_namespace_lock);
2886 	} else {
2887 		error = spa_prop_get(spa, &nvp);
2888 		spa_close(spa, FTAG);
2889 	}
2890 
2891 	if (error == 0 && zc->zc_nvlist_dst != NULL)
2892 		error = put_nvlist(zc, nvp);
2893 	else
2894 		error = SET_ERROR(EFAULT);
2895 
2896 	nvlist_free(nvp);
2897 	return (error);
2898 }
2899 
2900 /*
2901  * inputs:
2902  * zc_name		name of filesystem
2903  * zc_nvlist_src{_size}	nvlist of delegated permissions
2904  * zc_perm_action	allow/unallow flag
2905  *
2906  * outputs:		none
2907  */
2908 static int
2909 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2910 {
2911 	int error;
2912 	nvlist_t *fsaclnv = NULL;
2913 
2914 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2915 	    zc->zc_iflags, &fsaclnv)) != 0)
2916 		return (error);
2917 
2918 	/*
2919 	 * Verify nvlist is constructed correctly
2920 	 */
2921 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2922 		nvlist_free(fsaclnv);
2923 		return (SET_ERROR(EINVAL));
2924 	}
2925 
2926 	/*
2927 	 * If we don't have PRIV_SYS_MOUNT, then validate
2928 	 * that user is allowed to hand out each permission in
2929 	 * the nvlist(s)
2930 	 */
2931 
2932 	error = secpolicy_zfs(CRED());
2933 	if (error != 0) {
2934 		if (zc->zc_perm_action == B_FALSE) {
2935 			error = dsl_deleg_can_allow(zc->zc_name,
2936 			    fsaclnv, CRED());
2937 		} else {
2938 			error = dsl_deleg_can_unallow(zc->zc_name,
2939 			    fsaclnv, CRED());
2940 		}
2941 	}
2942 
2943 	if (error == 0)
2944 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2945 
2946 	nvlist_free(fsaclnv);
2947 	return (error);
2948 }
2949 
2950 /*
2951  * inputs:
2952  * zc_name		name of filesystem
2953  *
2954  * outputs:
2955  * zc_nvlist_src{_size}	nvlist of delegated permissions
2956  */
2957 static int
2958 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
2959 {
2960 	nvlist_t *nvp;
2961 	int error;
2962 
2963 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
2964 		error = put_nvlist(zc, nvp);
2965 		nvlist_free(nvp);
2966 	}
2967 
2968 	return (error);
2969 }
2970 
2971 /*
2972  * Search the vfs list for a specified resource.  Returns a pointer to it
2973  * or NULL if no suitable entry is found. The caller of this routine
2974  * is responsible for releasing the returned vfs pointer.
2975  */
2976 static vfs_t *
2977 zfs_get_vfs(const char *resource)
2978 {
2979 	struct vfs *vfsp;
2980 	struct vfs *vfs_found = NULL;
2981 
2982 	vfs_list_read_lock();
2983 	vfsp = rootvfs;
2984 	do {
2985 		if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
2986 			VFS_HOLD(vfsp);
2987 			vfs_found = vfsp;
2988 			break;
2989 		}
2990 		vfsp = vfsp->vfs_next;
2991 	} while (vfsp != rootvfs);
2992 	vfs_list_unlock();
2993 	return (vfs_found);
2994 }
2995 
2996 /* ARGSUSED */
2997 static void
2998 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
2999 {
3000 	zfs_creat_t *zct = arg;
3001 
3002 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
3003 }
3004 
3005 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3006 
3007 /*
3008  * inputs:
3009  * os			parent objset pointer (NULL if root fs)
3010  * fuids_ok		fuids allowed in this version of the spa?
3011  * sa_ok		SAs allowed in this version of the spa?
3012  * createprops		list of properties requested by creator
3013  *
3014  * outputs:
3015  * zplprops	values for the zplprops we attach to the master node object
3016  * is_ci	true if requested file system will be purely case-insensitive
3017  *
3018  * Determine the settings for utf8only, normalization and
3019  * casesensitivity.  Specific values may have been requested by the
3020  * creator and/or we can inherit values from the parent dataset.  If
3021  * the file system is of too early a vintage, a creator can not
3022  * request settings for these properties, even if the requested
3023  * setting is the default value.  We don't actually want to create dsl
3024  * properties for these, so remove them from the source nvlist after
3025  * processing.
3026  */
3027 static int
3028 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3029     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3030     nvlist_t *zplprops, boolean_t *is_ci)
3031 {
3032 	uint64_t sense = ZFS_PROP_UNDEFINED;
3033 	uint64_t norm = ZFS_PROP_UNDEFINED;
3034 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3035 
3036 	ASSERT(zplprops != NULL);
3037 
3038 	/*
3039 	 * Pull out creator prop choices, if any.
3040 	 */
3041 	if (createprops) {
3042 		(void) nvlist_lookup_uint64(createprops,
3043 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3044 		(void) nvlist_lookup_uint64(createprops,
3045 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3046 		(void) nvlist_remove_all(createprops,
3047 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3048 		(void) nvlist_lookup_uint64(createprops,
3049 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3050 		(void) nvlist_remove_all(createprops,
3051 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3052 		(void) nvlist_lookup_uint64(createprops,
3053 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3054 		(void) nvlist_remove_all(createprops,
3055 		    zfs_prop_to_name(ZFS_PROP_CASE));
3056 	}
3057 
3058 	/*
3059 	 * If the zpl version requested is whacky or the file system
3060 	 * or pool is version is too "young" to support normalization
3061 	 * and the creator tried to set a value for one of the props,
3062 	 * error out.
3063 	 */
3064 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3065 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3066 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3067 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3068 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3069 	    sense != ZFS_PROP_UNDEFINED)))
3070 		return (SET_ERROR(ENOTSUP));
3071 
3072 	/*
3073 	 * Put the version in the zplprops
3074 	 */
3075 	VERIFY(nvlist_add_uint64(zplprops,
3076 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3077 
3078 	if (norm == ZFS_PROP_UNDEFINED)
3079 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3080 	VERIFY(nvlist_add_uint64(zplprops,
3081 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3082 
3083 	/*
3084 	 * If we're normalizing, names must always be valid UTF-8 strings.
3085 	 */
3086 	if (norm)
3087 		u8 = 1;
3088 	if (u8 == ZFS_PROP_UNDEFINED)
3089 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3090 	VERIFY(nvlist_add_uint64(zplprops,
3091 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3092 
3093 	if (sense == ZFS_PROP_UNDEFINED)
3094 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3095 	VERIFY(nvlist_add_uint64(zplprops,
3096 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3097 
3098 	if (is_ci)
3099 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3100 
3101 	return (0);
3102 }
3103 
3104 static int
3105 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3106     nvlist_t *zplprops, boolean_t *is_ci)
3107 {
3108 	boolean_t fuids_ok, sa_ok;
3109 	uint64_t zplver = ZPL_VERSION;
3110 	objset_t *os = NULL;
3111 	char parentname[ZFS_MAX_DATASET_NAME_LEN];
3112 	char *cp;
3113 	spa_t *spa;
3114 	uint64_t spa_vers;
3115 	int error;
3116 
3117 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3118 	cp = strrchr(parentname, '/');
3119 	ASSERT(cp != NULL);
3120 	cp[0] = '\0';
3121 
3122 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3123 		return (error);
3124 
3125 	spa_vers = spa_version(spa);
3126 	spa_close(spa, FTAG);
3127 
3128 	zplver = zfs_zpl_version_map(spa_vers);
3129 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3130 	sa_ok = (zplver >= ZPL_VERSION_SA);
3131 
3132 	/*
3133 	 * Open parent object set so we can inherit zplprop values.
3134 	 */
3135 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3136 		return (error);
3137 
3138 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3139 	    zplprops, is_ci);
3140 	dmu_objset_rele(os, FTAG);
3141 	return (error);
3142 }
3143 
3144 static int
3145 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3146     nvlist_t *zplprops, boolean_t *is_ci)
3147 {
3148 	boolean_t fuids_ok;
3149 	boolean_t sa_ok;
3150 	uint64_t zplver = ZPL_VERSION;
3151 	int error;
3152 
3153 	zplver = zfs_zpl_version_map(spa_vers);
3154 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3155 	sa_ok = (zplver >= ZPL_VERSION_SA);
3156 
3157 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3158 	    createprops, zplprops, is_ci);
3159 	return (error);
3160 }
3161 
3162 /*
3163  * innvl: {
3164  *     "type" -> dmu_objset_type_t (int32)
3165  *     (optional) "props" -> { prop -> value }
3166  * }
3167  *
3168  * outnvl: propname -> error code (int32)
3169  */
3170 static int
3171 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3172 {
3173 	int error = 0;
3174 	zfs_creat_t zct = { 0 };
3175 	nvlist_t *nvprops = NULL;
3176 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3177 	int32_t type32;
3178 	dmu_objset_type_t type;
3179 	boolean_t is_insensitive = B_FALSE;
3180 
3181 	if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3182 		return (SET_ERROR(EINVAL));
3183 	type = type32;
3184 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3185 
3186 	switch (type) {
3187 	case DMU_OST_ZFS:
3188 		cbfunc = zfs_create_cb;
3189 		break;
3190 
3191 	case DMU_OST_ZVOL:
3192 		cbfunc = zvol_create_cb;
3193 		break;
3194 
3195 	default:
3196 		cbfunc = NULL;
3197 		break;
3198 	}
3199 	if (strchr(fsname, '@') ||
3200 	    strchr(fsname, '%'))
3201 		return (SET_ERROR(EINVAL));
3202 
3203 	zct.zct_props = nvprops;
3204 
3205 	if (cbfunc == NULL)
3206 		return (SET_ERROR(EINVAL));
3207 
3208 	if (type == DMU_OST_ZVOL) {
3209 		uint64_t volsize, volblocksize;
3210 
3211 		if (nvprops == NULL)
3212 			return (SET_ERROR(EINVAL));
3213 		if (nvlist_lookup_uint64(nvprops,
3214 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3215 			return (SET_ERROR(EINVAL));
3216 
3217 		if ((error = nvlist_lookup_uint64(nvprops,
3218 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3219 		    &volblocksize)) != 0 && error != ENOENT)
3220 			return (SET_ERROR(EINVAL));
3221 
3222 		if (error != 0)
3223 			volblocksize = zfs_prop_default_numeric(
3224 			    ZFS_PROP_VOLBLOCKSIZE);
3225 
3226 		if ((error = zvol_check_volblocksize(
3227 		    volblocksize)) != 0 ||
3228 		    (error = zvol_check_volsize(volsize,
3229 		    volblocksize)) != 0)
3230 			return (error);
3231 	} else if (type == DMU_OST_ZFS) {
3232 		int error;
3233 
3234 		/*
3235 		 * We have to have normalization and
3236 		 * case-folding flags correct when we do the
3237 		 * file system creation, so go figure them out
3238 		 * now.
3239 		 */
3240 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3241 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3242 		error = zfs_fill_zplprops(fsname, nvprops,
3243 		    zct.zct_zplprops, &is_insensitive);
3244 		if (error != 0) {
3245 			nvlist_free(zct.zct_zplprops);
3246 			return (error);
3247 		}
3248 	}
3249 
3250 	error = dmu_objset_create(fsname, type,
3251 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3252 	nvlist_free(zct.zct_zplprops);
3253 
3254 	/*
3255 	 * It would be nice to do this atomically.
3256 	 */
3257 	if (error == 0) {
3258 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3259 		    nvprops, outnvl);
3260 		if (error != 0)
3261 			(void) dsl_destroy_head(fsname);
3262 	}
3263 	return (error);
3264 }
3265 
3266 /*
3267  * innvl: {
3268  *     "origin" -> name of origin snapshot
3269  *     (optional) "props" -> { prop -> value }
3270  * }
3271  *
3272  * outnvl: propname -> error code (int32)
3273  */
3274 static int
3275 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3276 {
3277 	int error = 0;
3278 	nvlist_t *nvprops = NULL;
3279 	char *origin_name;
3280 
3281 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3282 		return (SET_ERROR(EINVAL));
3283 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3284 
3285 	if (strchr(fsname, '@') ||
3286 	    strchr(fsname, '%'))
3287 		return (SET_ERROR(EINVAL));
3288 
3289 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3290 		return (SET_ERROR(EINVAL));
3291 	error = dmu_objset_clone(fsname, origin_name);
3292 	if (error != 0)
3293 		return (error);
3294 
3295 	/*
3296 	 * It would be nice to do this atomically.
3297 	 */
3298 	if (error == 0) {
3299 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3300 		    nvprops, outnvl);
3301 		if (error != 0)
3302 			(void) dsl_destroy_head(fsname);
3303 	}
3304 	return (error);
3305 }
3306 
3307 /*
3308  * innvl: {
3309  *     "snaps" -> { snapshot1, snapshot2 }
3310  *     (optional) "props" -> { prop -> value (string) }
3311  * }
3312  *
3313  * outnvl: snapshot -> error code (int32)
3314  */
3315 static int
3316 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3317 {
3318 	nvlist_t *snaps;
3319 	nvlist_t *props = NULL;
3320 	int error, poollen;
3321 	nvpair_t *pair;
3322 
3323 	(void) nvlist_lookup_nvlist(innvl, "props", &props);
3324 	if ((error = zfs_check_userprops(poolname, props)) != 0)
3325 		return (error);
3326 
3327 	if (!nvlist_empty(props) &&
3328 	    zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3329 		return (SET_ERROR(ENOTSUP));
3330 
3331 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3332 		return (SET_ERROR(EINVAL));
3333 	poollen = strlen(poolname);
3334 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3335 	    pair = nvlist_next_nvpair(snaps, pair)) {
3336 		const char *name = nvpair_name(pair);
3337 		const char *cp = strchr(name, '@');
3338 
3339 		/*
3340 		 * The snap name must contain an @, and the part after it must
3341 		 * contain only valid characters.
3342 		 */
3343 		if (cp == NULL ||
3344 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3345 			return (SET_ERROR(EINVAL));
3346 
3347 		/*
3348 		 * The snap must be in the specified pool.
3349 		 */
3350 		if (strncmp(name, poolname, poollen) != 0 ||
3351 		    (name[poollen] != '/' && name[poollen] != '@'))
3352 			return (SET_ERROR(EXDEV));
3353 
3354 		/* This must be the only snap of this fs. */
3355 		for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3356 		    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3357 			if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3358 			    == 0) {
3359 				return (SET_ERROR(EXDEV));
3360 			}
3361 		}
3362 	}
3363 
3364 	error = dsl_dataset_snapshot(snaps, props, outnvl);
3365 	return (error);
3366 }
3367 
3368 /*
3369  * innvl: "message" -> string
3370  */
3371 /* ARGSUSED */
3372 static int
3373 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3374 {
3375 	char *message;
3376 	spa_t *spa;
3377 	int error;
3378 	char *poolname;
3379 
3380 	/*
3381 	 * The poolname in the ioctl is not set, we get it from the TSD,
3382 	 * which was set at the end of the last successful ioctl that allows
3383 	 * logging.  The secpolicy func already checked that it is set.
3384 	 * Only one log ioctl is allowed after each successful ioctl, so
3385 	 * we clear the TSD here.
3386 	 */
3387 	poolname = tsd_get(zfs_allow_log_key);
3388 	(void) tsd_set(zfs_allow_log_key, NULL);
3389 	error = spa_open(poolname, &spa, FTAG);
3390 	strfree(poolname);
3391 	if (error != 0)
3392 		return (error);
3393 
3394 	if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3395 		spa_close(spa, FTAG);
3396 		return (SET_ERROR(EINVAL));
3397 	}
3398 
3399 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3400 		spa_close(spa, FTAG);
3401 		return (SET_ERROR(ENOTSUP));
3402 	}
3403 
3404 	error = spa_history_log(spa, message);
3405 	spa_close(spa, FTAG);
3406 	return (error);
3407 }
3408 
3409 /*
3410  * The dp_config_rwlock must not be held when calling this, because the
3411  * unmount may need to write out data.
3412  *
3413  * This function is best-effort.  Callers must deal gracefully if it
3414  * remains mounted (or is remounted after this call).
3415  *
3416  * Returns 0 if the argument is not a snapshot, or it is not currently a
3417  * filesystem, or we were able to unmount it.  Returns error code otherwise.
3418  */
3419 int
3420 zfs_unmount_snap(const char *snapname)
3421 {
3422 	vfs_t *vfsp;
3423 	zfsvfs_t *zfsvfs;
3424 	int err;
3425 
3426 	if (strchr(snapname, '@') == NULL)
3427 		return (0);
3428 
3429 	vfsp = zfs_get_vfs(snapname);
3430 	if (vfsp == NULL)
3431 		return (0);
3432 
3433 	zfsvfs = vfsp->vfs_data;
3434 	ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3435 
3436 	err = vn_vfswlock(vfsp->vfs_vnodecovered);
3437 	VFS_RELE(vfsp);
3438 	if (err != 0)
3439 		return (SET_ERROR(err));
3440 
3441 	/*
3442 	 * Always force the unmount for snapshots.
3443 	 */
3444 	(void) dounmount(vfsp, MS_FORCE, kcred);
3445 	return (0);
3446 }
3447 
3448 /* ARGSUSED */
3449 static int
3450 zfs_unmount_snap_cb(const char *snapname, void *arg)
3451 {
3452 	return (zfs_unmount_snap(snapname));
3453 }
3454 
3455 /*
3456  * When a clone is destroyed, its origin may also need to be destroyed,
3457  * in which case it must be unmounted.  This routine will do that unmount
3458  * if necessary.
3459  */
3460 void
3461 zfs_destroy_unmount_origin(const char *fsname)
3462 {
3463 	int error;
3464 	objset_t *os;
3465 	dsl_dataset_t *ds;
3466 
3467 	error = dmu_objset_hold(fsname, FTAG, &os);
3468 	if (error != 0)
3469 		return;
3470 	ds = dmu_objset_ds(os);
3471 	if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3472 		char originname[ZFS_MAX_DATASET_NAME_LEN];
3473 		dsl_dataset_name(ds->ds_prev, originname);
3474 		dmu_objset_rele(os, FTAG);
3475 		(void) zfs_unmount_snap(originname);
3476 	} else {
3477 		dmu_objset_rele(os, FTAG);
3478 	}
3479 }
3480 
3481 /*
3482  * innvl: {
3483  *     "snaps" -> { snapshot1, snapshot2 }
3484  *     (optional boolean) "defer"
3485  * }
3486  *
3487  * outnvl: snapshot -> error code (int32)
3488  *
3489  */
3490 /* ARGSUSED */
3491 static int
3492 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3493 {
3494 	nvlist_t *snaps;
3495 	nvpair_t *pair;
3496 	boolean_t defer;
3497 
3498 	if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3499 		return (SET_ERROR(EINVAL));
3500 	defer = nvlist_exists(innvl, "defer");
3501 
3502 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3503 	    pair = nvlist_next_nvpair(snaps, pair)) {
3504 		(void) zfs_unmount_snap(nvpair_name(pair));
3505 	}
3506 
3507 	return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3508 }
3509 
3510 /*
3511  * Create bookmarks.  Bookmark names are of the form <fs>#<bmark>.
3512  * All bookmarks must be in the same pool.
3513  *
3514  * innvl: {
3515  *     bookmark1 -> snapshot1, bookmark2 -> snapshot2
3516  * }
3517  *
3518  * outnvl: bookmark -> error code (int32)
3519  *
3520  */
3521 /* ARGSUSED */
3522 static int
3523 zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3524 {
3525 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3526 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3527 		char *snap_name;
3528 
3529 		/*
3530 		 * Verify the snapshot argument.
3531 		 */
3532 		if (nvpair_value_string(pair, &snap_name) != 0)
3533 			return (SET_ERROR(EINVAL));
3534 
3535 
3536 		/* Verify that the keys (bookmarks) are unique */
3537 		for (nvpair_t *pair2 = nvlist_next_nvpair(innvl, pair);
3538 		    pair2 != NULL; pair2 = nvlist_next_nvpair(innvl, pair2)) {
3539 			if (strcmp(nvpair_name(pair), nvpair_name(pair2)) == 0)
3540 				return (SET_ERROR(EINVAL));
3541 		}
3542 	}
3543 
3544 	return (dsl_bookmark_create(innvl, outnvl));
3545 }
3546 
3547 /*
3548  * innvl: {
3549  *     property 1, property 2, ...
3550  * }
3551  *
3552  * outnvl: {
3553  *     bookmark name 1 -> { property 1, property 2, ... },
3554  *     bookmark name 2 -> { property 1, property 2, ... }
3555  * }
3556  *
3557  */
3558 static int
3559 zfs_ioc_get_bookmarks(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3560 {
3561 	return (dsl_get_bookmarks(fsname, innvl, outnvl));
3562 }
3563 
3564 /*
3565  * innvl: {
3566  *     bookmark name 1, bookmark name 2
3567  * }
3568  *
3569  * outnvl: bookmark -> error code (int32)
3570  *
3571  */
3572 static int
3573 zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
3574     nvlist_t *outnvl)
3575 {
3576 	int error, poollen;
3577 
3578 	poollen = strlen(poolname);
3579 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
3580 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
3581 		const char *name = nvpair_name(pair);
3582 		const char *cp = strchr(name, '#');
3583 
3584 		/*
3585 		 * The bookmark name must contain an #, and the part after it
3586 		 * must contain only valid characters.
3587 		 */
3588 		if (cp == NULL ||
3589 		    zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
3590 			return (SET_ERROR(EINVAL));
3591 
3592 		/*
3593 		 * The bookmark must be in the specified pool.
3594 		 */
3595 		if (strncmp(name, poolname, poollen) != 0 ||
3596 		    (name[poollen] != '/' && name[poollen] != '#'))
3597 			return (SET_ERROR(EXDEV));
3598 	}
3599 
3600 	error = dsl_bookmark_destroy(innvl, outnvl);
3601 	return (error);
3602 }
3603 
3604 /*
3605  * inputs:
3606  * zc_name		name of dataset to destroy
3607  * zc_objset_type	type of objset
3608  * zc_defer_destroy	mark for deferred destroy
3609  *
3610  * outputs:		none
3611  */
3612 static int
3613 zfs_ioc_destroy(zfs_cmd_t *zc)
3614 {
3615 	int err;
3616 
3617 	if (zc->zc_objset_type == DMU_OST_ZFS) {
3618 		err = zfs_unmount_snap(zc->zc_name);
3619 		if (err != 0)
3620 			return (err);
3621 	}
3622 
3623 	if (strchr(zc->zc_name, '@'))
3624 		err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3625 	else
3626 		err = dsl_destroy_head(zc->zc_name);
3627 	if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3628 		(void) zvol_remove_minor(zc->zc_name);
3629 	return (err);
3630 }
3631 
3632 /*
3633  * fsname is name of dataset to rollback (to most recent snapshot)
3634  *
3635  * innvl is not used.
3636  *
3637  * outnvl: "target" -> name of most recent snapshot
3638  * }
3639  */
3640 /* ARGSUSED */
3641 static int
3642 zfs_ioc_rollback(const char *fsname, nvlist_t *args, nvlist_t *outnvl)
3643 {
3644 	zfsvfs_t *zfsvfs;
3645 	int error;
3646 
3647 	if (getzfsvfs(fsname, &zfsvfs) == 0) {
3648 		dsl_dataset_t *ds;
3649 
3650 		ds = dmu_objset_ds(zfsvfs->z_os);
3651 		error = zfs_suspend_fs(zfsvfs);
3652 		if (error == 0) {
3653 			int resume_err;
3654 
3655 			error = dsl_dataset_rollback(fsname, zfsvfs, outnvl);
3656 			resume_err = zfs_resume_fs(zfsvfs, ds);
3657 			error = error ? error : resume_err;
3658 		}
3659 		VFS_RELE(zfsvfs->z_vfs);
3660 	} else {
3661 		error = dsl_dataset_rollback(fsname, NULL, outnvl);
3662 	}
3663 	return (error);
3664 }
3665 
3666 static int
3667 recursive_unmount(const char *fsname, void *arg)
3668 {
3669 	const char *snapname = arg;
3670 	char fullname[ZFS_MAX_DATASET_NAME_LEN];
3671 
3672 	(void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
3673 	return (zfs_unmount_snap(fullname));
3674 }
3675 
3676 /*
3677  * inputs:
3678  * zc_name	old name of dataset
3679  * zc_value	new name of dataset
3680  * zc_cookie	recursive flag (only valid for snapshots)
3681  *
3682  * outputs:	none
3683  */
3684 static int
3685 zfs_ioc_rename(zfs_cmd_t *zc)
3686 {
3687 	boolean_t recursive = zc->zc_cookie & 1;
3688 	char *at;
3689 
3690 	zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3691 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3692 	    strchr(zc->zc_value, '%'))
3693 		return (SET_ERROR(EINVAL));
3694 
3695 	at = strchr(zc->zc_name, '@');
3696 	if (at != NULL) {
3697 		/* snaps must be in same fs */
3698 		int error;
3699 
3700 		if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
3701 			return (SET_ERROR(EXDEV));
3702 		*at = '\0';
3703 		if (zc->zc_objset_type == DMU_OST_ZFS) {
3704 			error = dmu_objset_find(zc->zc_name,
3705 			    recursive_unmount, at + 1,
3706 			    recursive ? DS_FIND_CHILDREN : 0);
3707 			if (error != 0) {
3708 				*at = '@';
3709 				return (error);
3710 			}
3711 		}
3712 		error = dsl_dataset_rename_snapshot(zc->zc_name,
3713 		    at + 1, strchr(zc->zc_value, '@') + 1, recursive);
3714 		*at = '@';
3715 
3716 		return (error);
3717 	} else {
3718 		if (zc->zc_objset_type == DMU_OST_ZVOL)
3719 			(void) zvol_remove_minor(zc->zc_name);
3720 		return (dsl_dir_rename(zc->zc_name, zc->zc_value));
3721 	}
3722 }
3723 
3724 static int
3725 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3726 {
3727 	const char *propname = nvpair_name(pair);
3728 	boolean_t issnap = (strchr(dsname, '@') != NULL);
3729 	zfs_prop_t prop = zfs_name_to_prop(propname);
3730 	uint64_t intval;
3731 	int err;
3732 
3733 	if (prop == ZPROP_INVAL) {
3734 		if (zfs_prop_user(propname)) {
3735 			if (err = zfs_secpolicy_write_perms(dsname,
3736 			    ZFS_DELEG_PERM_USERPROP, cr))
3737 				return (err);
3738 			return (0);
3739 		}
3740 
3741 		if (!issnap && zfs_prop_userquota(propname)) {
3742 			const char *perm = NULL;
3743 			const char *uq_prefix =
3744 			    zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3745 			const char *gq_prefix =
3746 			    zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3747 
3748 			if (strncmp(propname, uq_prefix,
3749 			    strlen(uq_prefix)) == 0) {
3750 				perm = ZFS_DELEG_PERM_USERQUOTA;
3751 			} else if (strncmp(propname, gq_prefix,
3752 			    strlen(gq_prefix)) == 0) {
3753 				perm = ZFS_DELEG_PERM_GROUPQUOTA;
3754 			} else {
3755 				/* USERUSED and GROUPUSED are read-only */
3756 				return (SET_ERROR(EINVAL));
3757 			}
3758 
3759 			if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3760 				return (err);
3761 			return (0);
3762 		}
3763 
3764 		return (SET_ERROR(EINVAL));
3765 	}
3766 
3767 	if (issnap)
3768 		return (SET_ERROR(EINVAL));
3769 
3770 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3771 		/*
3772 		 * dsl_prop_get_all_impl() returns properties in this
3773 		 * format.
3774 		 */
3775 		nvlist_t *attrs;
3776 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3777 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3778 		    &pair) == 0);
3779 	}
3780 
3781 	/*
3782 	 * Check that this value is valid for this pool version
3783 	 */
3784 	switch (prop) {
3785 	case ZFS_PROP_COMPRESSION:
3786 		/*
3787 		 * If the user specified gzip compression, make sure
3788 		 * the SPA supports it. We ignore any errors here since
3789 		 * we'll catch them later.
3790 		 */
3791 		if (nvpair_value_uint64(pair, &intval) == 0) {
3792 			if (intval >= ZIO_COMPRESS_GZIP_1 &&
3793 			    intval <= ZIO_COMPRESS_GZIP_9 &&
3794 			    zfs_earlier_version(dsname,
3795 			    SPA_VERSION_GZIP_COMPRESSION)) {
3796 				return (SET_ERROR(ENOTSUP));
3797 			}
3798 
3799 			if (intval == ZIO_COMPRESS_ZLE &&
3800 			    zfs_earlier_version(dsname,
3801 			    SPA_VERSION_ZLE_COMPRESSION))
3802 				return (SET_ERROR(ENOTSUP));
3803 
3804 			if (intval == ZIO_COMPRESS_LZ4) {
3805 				spa_t *spa;
3806 
3807 				if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3808 					return (err);
3809 
3810 				if (!spa_feature_is_enabled(spa,
3811 				    SPA_FEATURE_LZ4_COMPRESS)) {
3812 					spa_close(spa, FTAG);
3813 					return (SET_ERROR(ENOTSUP));
3814 				}
3815 				spa_close(spa, FTAG);
3816 			}
3817 
3818 			/*
3819 			 * If this is a bootable dataset then
3820 			 * verify that the compression algorithm
3821 			 * is supported for booting. We must return
3822 			 * something other than ENOTSUP since it
3823 			 * implies a downrev pool version.
3824 			 */
3825 			if (zfs_is_bootfs(dsname) &&
3826 			    !BOOTFS_COMPRESS_VALID(intval)) {
3827 				return (SET_ERROR(ERANGE));
3828 			}
3829 		}
3830 		break;
3831 
3832 	case ZFS_PROP_COPIES:
3833 		if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3834 			return (SET_ERROR(ENOTSUP));
3835 		break;
3836 
3837 	case ZFS_PROP_RECORDSIZE:
3838 		/* Record sizes above 128k need the feature to be enabled */
3839 		if (nvpair_value_uint64(pair, &intval) == 0 &&
3840 		    intval > SPA_OLD_MAXBLOCKSIZE) {
3841 			spa_t *spa;
3842 
3843 			/*
3844 			 * We don't allow setting the property above 1MB,
3845 			 * unless the tunable has been changed.
3846 			 */
3847 			if (intval > zfs_max_recordsize ||
3848 			    intval > SPA_MAXBLOCKSIZE)
3849 				return (SET_ERROR(ERANGE));
3850 
3851 			if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3852 				return (err);
3853 
3854 			if (!spa_feature_is_enabled(spa,
3855 			    SPA_FEATURE_LARGE_BLOCKS)) {
3856 				spa_close(spa, FTAG);
3857 				return (SET_ERROR(ENOTSUP));
3858 			}
3859 			spa_close(spa, FTAG);
3860 		}
3861 		break;
3862 
3863 	case ZFS_PROP_SHARESMB:
3864 		if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3865 			return (SET_ERROR(ENOTSUP));
3866 		break;
3867 
3868 	case ZFS_PROP_ACLINHERIT:
3869 		if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3870 		    nvpair_value_uint64(pair, &intval) == 0) {
3871 			if (intval == ZFS_ACL_PASSTHROUGH_X &&
3872 			    zfs_earlier_version(dsname,
3873 			    SPA_VERSION_PASSTHROUGH_X))
3874 				return (SET_ERROR(ENOTSUP));
3875 		}
3876 		break;
3877 
3878 	case ZFS_PROP_CHECKSUM:
3879 	case ZFS_PROP_DEDUP:
3880 	{
3881 		spa_feature_t feature;
3882 		spa_t *spa;
3883 
3884 		/* dedup feature version checks */
3885 		if (prop == ZFS_PROP_DEDUP &&
3886 		    zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3887 			return (SET_ERROR(ENOTSUP));
3888 
3889 		if (nvpair_value_uint64(pair, &intval) != 0)
3890 			return (SET_ERROR(EINVAL));
3891 
3892 		/* check prop value is enabled in features */
3893 		feature = zio_checksum_to_feature(intval & ZIO_CHECKSUM_MASK);
3894 		if (feature == SPA_FEATURE_NONE)
3895 			break;
3896 
3897 		if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3898 			return (err);
3899 		/*
3900 		 * Salted checksums are not supported on root pools.
3901 		 */
3902 		if (spa_bootfs(spa) != 0 &&
3903 		    intval < ZIO_CHECKSUM_FUNCTIONS &&
3904 		    (zio_checksum_table[intval].ci_flags &
3905 		    ZCHECKSUM_FLAG_SALTED)) {
3906 			spa_close(spa, FTAG);
3907 			return (SET_ERROR(ERANGE));
3908 		}
3909 		if (!spa_feature_is_enabled(spa, feature)) {
3910 			spa_close(spa, FTAG);
3911 			return (SET_ERROR(ENOTSUP));
3912 		}
3913 		spa_close(spa, FTAG);
3914 		break;
3915 	}
3916 	}
3917 
3918 	return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3919 }
3920 
3921 /*
3922  * Checks for a race condition to make sure we don't increment a feature flag
3923  * multiple times.
3924  */
3925 static int
3926 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
3927 {
3928 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3929 	spa_feature_t *featurep = arg;
3930 
3931 	if (!spa_feature_is_active(spa, *featurep))
3932 		return (0);
3933 	else
3934 		return (SET_ERROR(EBUSY));
3935 }
3936 
3937 /*
3938  * The callback invoked on feature activation in the sync task caused by
3939  * zfs_prop_activate_feature.
3940  */
3941 static void
3942 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
3943 {
3944 	spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3945 	spa_feature_t *featurep = arg;
3946 
3947 	spa_feature_incr(spa, *featurep, tx);
3948 }
3949 
3950 /*
3951  * Activates a feature on a pool in response to a property setting. This
3952  * creates a new sync task which modifies the pool to reflect the feature
3953  * as being active.
3954  */
3955 static int
3956 zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature)
3957 {
3958 	int err;
3959 
3960 	/* EBUSY here indicates that the feature is already active */
3961 	err = dsl_sync_task(spa_name(spa),
3962 	    zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
3963 	    &feature, 2, ZFS_SPACE_CHECK_RESERVED);
3964 
3965 	if (err != 0 && err != EBUSY)
3966 		return (err);
3967 	else
3968 		return (0);
3969 }
3970 
3971 /*
3972  * Removes properties from the given props list that fail permission checks
3973  * needed to clear them and to restore them in case of a receive error. For each
3974  * property, make sure we have both set and inherit permissions.
3975  *
3976  * Returns the first error encountered if any permission checks fail. If the
3977  * caller provides a non-NULL errlist, it also gives the complete list of names
3978  * of all the properties that failed a permission check along with the
3979  * corresponding error numbers. The caller is responsible for freeing the
3980  * returned errlist.
3981  *
3982  * If every property checks out successfully, zero is returned and the list
3983  * pointed at by errlist is NULL.
3984  */
3985 static int
3986 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
3987 {
3988 	zfs_cmd_t *zc;
3989 	nvpair_t *pair, *next_pair;
3990 	nvlist_t *errors;
3991 	int err, rv = 0;
3992 
3993 	if (props == NULL)
3994 		return (0);
3995 
3996 	VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3997 
3998 	zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
3999 	(void) strcpy(zc->zc_name, dataset);
4000 	pair = nvlist_next_nvpair(props, NULL);
4001 	while (pair != NULL) {
4002 		next_pair = nvlist_next_nvpair(props, pair);
4003 
4004 		(void) strcpy(zc->zc_value, nvpair_name(pair));
4005 		if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
4006 		    (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
4007 			VERIFY(nvlist_remove_nvpair(props, pair) == 0);
4008 			VERIFY(nvlist_add_int32(errors,
4009 			    zc->zc_value, err) == 0);
4010 		}
4011 		pair = next_pair;
4012 	}
4013 	kmem_free(zc, sizeof (zfs_cmd_t));
4014 
4015 	if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
4016 		nvlist_free(errors);
4017 		errors = NULL;
4018 	} else {
4019 		VERIFY(nvpair_value_int32(pair, &rv) == 0);
4020 	}
4021 
4022 	if (errlist == NULL)
4023 		nvlist_free(errors);
4024 	else
4025 		*errlist = errors;
4026 
4027 	return (rv);
4028 }
4029 
4030 static boolean_t
4031 propval_equals(nvpair_t *p1, nvpair_t *p2)
4032 {
4033 	if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
4034 		/* dsl_prop_get_all_impl() format */
4035 		nvlist_t *attrs;
4036 		VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
4037 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4038 		    &p1) == 0);
4039 	}
4040 
4041 	if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
4042 		nvlist_t *attrs;
4043 		VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
4044 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
4045 		    &p2) == 0);
4046 	}
4047 
4048 	if (nvpair_type(p1) != nvpair_type(p2))
4049 		return (B_FALSE);
4050 
4051 	if (nvpair_type(p1) == DATA_TYPE_STRING) {
4052 		char *valstr1, *valstr2;
4053 
4054 		VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
4055 		VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
4056 		return (strcmp(valstr1, valstr2) == 0);
4057 	} else {
4058 		uint64_t intval1, intval2;
4059 
4060 		VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
4061 		VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
4062 		return (intval1 == intval2);
4063 	}
4064 }
4065 
4066 /*
4067  * Remove properties from props if they are not going to change (as determined
4068  * by comparison with origprops). Remove them from origprops as well, since we
4069  * do not need to clear or restore properties that won't change.
4070  */
4071 static void
4072 props_reduce(nvlist_t *props, nvlist_t *origprops)
4073 {
4074 	nvpair_t *pair, *next_pair;
4075 
4076 	if (origprops == NULL)
4077 		return; /* all props need to be received */
4078 
4079 	pair = nvlist_next_nvpair(props, NULL);
4080 	while (pair != NULL) {
4081 		const char *propname = nvpair_name(pair);
4082 		nvpair_t *match;
4083 
4084 		next_pair = nvlist_next_nvpair(props, pair);
4085 
4086 		if ((nvlist_lookup_nvpair(origprops, propname,
4087 		    &match) != 0) || !propval_equals(pair, match))
4088 			goto next; /* need to set received value */
4089 
4090 		/* don't clear the existing received value */
4091 		(void) nvlist_remove_nvpair(origprops, match);
4092 		/* don't bother receiving the property */
4093 		(void) nvlist_remove_nvpair(props, pair);
4094 next:
4095 		pair = next_pair;
4096 	}
4097 }
4098 
4099 /*
4100  * Extract properties that cannot be set PRIOR to the receipt of a dataset.
4101  * For example, refquota cannot be set until after the receipt of a dataset,
4102  * because in replication streams, an older/earlier snapshot may exceed the
4103  * refquota.  We want to receive the older/earlier snapshot, but setting
4104  * refquota pre-receipt will set the dsl's ACTUAL quota, which will prevent
4105  * the older/earlier snapshot from being received (with EDQUOT).
4106  *
4107  * The ZFS test "zfs_receive_011_pos" demonstrates such a scenario.
4108  *
4109  * libzfs will need to be judicious handling errors encountered by props
4110  * extracted by this function.
4111  */
4112 static nvlist_t *
4113 extract_delay_props(nvlist_t *props)
4114 {
4115 	nvlist_t *delayprops;
4116 	nvpair_t *nvp, *tmp;
4117 	static const zfs_prop_t delayable[] = { ZFS_PROP_REFQUOTA, 0 };
4118 	int i;
4119 
4120 	VERIFY(nvlist_alloc(&delayprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
4121 
4122 	for (nvp = nvlist_next_nvpair(props, NULL); nvp != NULL;
4123 	    nvp = nvlist_next_nvpair(props, nvp)) {
4124 		/*
4125 		 * strcmp() is safe because zfs_prop_to_name() always returns
4126 		 * a bounded string.
4127 		 */
4128 		for (i = 0; delayable[i] != 0; i++) {
4129 			if (strcmp(zfs_prop_to_name(delayable[i]),
4130 			    nvpair_name(nvp)) == 0) {
4131 				break;
4132 			}
4133 		}
4134 		if (delayable[i] != 0) {
4135 			tmp = nvlist_prev_nvpair(props, nvp);
4136 			VERIFY(nvlist_add_nvpair(delayprops, nvp) == 0);
4137 			VERIFY(nvlist_remove_nvpair(props, nvp) == 0);
4138 			nvp = tmp;
4139 		}
4140 	}
4141 
4142 	if (nvlist_empty(delayprops)) {
4143 		nvlist_free(delayprops);
4144 		delayprops = NULL;
4145 	}
4146 	return (delayprops);
4147 }
4148 
4149 #ifdef	DEBUG
4150 static boolean_t zfs_ioc_recv_inject_err;
4151 #endif
4152 
4153 /*
4154  * inputs:
4155  * zc_name		name of containing filesystem
4156  * zc_nvlist_src{_size}	nvlist of properties to apply
4157  * zc_value		name of snapshot to create
4158  * zc_string		name of clone origin (if DRR_FLAG_CLONE)
4159  * zc_cookie		file descriptor to recv from
4160  * zc_begin_record	the BEGIN record of the stream (not byteswapped)
4161  * zc_guid		force flag
4162  * zc_cleanup_fd	cleanup-on-exit file descriptor
4163  * zc_action_handle	handle for this guid/ds mapping (or zero on first call)
4164  * zc_resumable		if data is incomplete assume sender will resume
4165  *
4166  * outputs:
4167  * zc_cookie		number of bytes read
4168  * zc_nvlist_dst{_size} error for each unapplied received property
4169  * zc_obj		zprop_errflags_t
4170  * zc_action_handle	handle for this guid/ds mapping
4171  */
4172 static int
4173 zfs_ioc_recv(zfs_cmd_t *zc)
4174 {
4175 	file_t *fp;
4176 	dmu_recv_cookie_t drc;
4177 	boolean_t force = (boolean_t)zc->zc_guid;
4178 	int fd;
4179 	int error = 0;
4180 	int props_error = 0;
4181 	nvlist_t *errors;
4182 	offset_t off;
4183 	nvlist_t *props = NULL; /* sent properties */
4184 	nvlist_t *origprops = NULL; /* existing properties */
4185 	nvlist_t *delayprops = NULL; /* sent properties applied post-receive */
4186 	char *origin = NULL;
4187 	char *tosnap;
4188 	char tofs[ZFS_MAX_DATASET_NAME_LEN];
4189 	boolean_t first_recvd_props = B_FALSE;
4190 
4191 	if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
4192 	    strchr(zc->zc_value, '@') == NULL ||
4193 	    strchr(zc->zc_value, '%'))
4194 		return (SET_ERROR(EINVAL));
4195 
4196 	(void) strcpy(tofs, zc->zc_value);
4197 	tosnap = strchr(tofs, '@');
4198 	*tosnap++ = '\0';
4199 
4200 	if (zc->zc_nvlist_src != NULL &&
4201 	    (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
4202 	    zc->zc_iflags, &props)) != 0)
4203 		return (error);
4204 
4205 	fd = zc->zc_cookie;
4206 	fp = getf(fd);
4207 	if (fp == NULL) {
4208 		nvlist_free(props);
4209 		return (SET_ERROR(EBADF));
4210 	}
4211 
4212 	errors = fnvlist_alloc();
4213 
4214 	if (zc->zc_string[0])
4215 		origin = zc->zc_string;
4216 
4217 	error = dmu_recv_begin(tofs, tosnap,
4218 	    &zc->zc_begin_record, force, zc->zc_resumable, origin, &drc);
4219 	if (error != 0)
4220 		goto out;
4221 
4222 	/*
4223 	 * Set properties before we receive the stream so that they are applied
4224 	 * to the new data. Note that we must call dmu_recv_stream() if
4225 	 * dmu_recv_begin() succeeds.
4226 	 */
4227 	if (props != NULL && !drc.drc_newfs) {
4228 		if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
4229 		    SPA_VERSION_RECVD_PROPS &&
4230 		    !dsl_prop_get_hasrecvd(tofs))
4231 			first_recvd_props = B_TRUE;
4232 
4233 		/*
4234 		 * If new received properties are supplied, they are to
4235 		 * completely replace the existing received properties, so stash
4236 		 * away the existing ones.
4237 		 */
4238 		if (dsl_prop_get_received(tofs, &origprops) == 0) {
4239 			nvlist_t *errlist = NULL;
4240 			/*
4241 			 * Don't bother writing a property if its value won't
4242 			 * change (and avoid the unnecessary security checks).
4243 			 *
4244 			 * The first receive after SPA_VERSION_RECVD_PROPS is a
4245 			 * special case where we blow away all local properties
4246 			 * regardless.
4247 			 */
4248 			if (!first_recvd_props)
4249 				props_reduce(props, origprops);
4250 			if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
4251 				(void) nvlist_merge(errors, errlist, 0);
4252 			nvlist_free(errlist);
4253 
4254 			if (clear_received_props(tofs, origprops,
4255 			    first_recvd_props ? NULL : props) != 0)
4256 				zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4257 		} else {
4258 			zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4259 		}
4260 	}
4261 
4262 	if (props != NULL) {
4263 		props_error = dsl_prop_set_hasrecvd(tofs);
4264 
4265 		if (props_error == 0) {
4266 			delayprops = extract_delay_props(props);
4267 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4268 			    props, errors);
4269 		}
4270 	}
4271 
4272 	off = fp->f_offset;
4273 	error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4274 	    &zc->zc_action_handle);
4275 
4276 	if (error == 0) {
4277 		zfsvfs_t *zfsvfs = NULL;
4278 
4279 		if (getzfsvfs(tofs, &zfsvfs) == 0) {
4280 			/* online recv */
4281 			dsl_dataset_t *ds;
4282 			int end_err;
4283 
4284 			ds = dmu_objset_ds(zfsvfs->z_os);
4285 			error = zfs_suspend_fs(zfsvfs);
4286 			/*
4287 			 * If the suspend fails, then the recv_end will
4288 			 * likely also fail, and clean up after itself.
4289 			 */
4290 			end_err = dmu_recv_end(&drc, zfsvfs);
4291 			if (error == 0)
4292 				error = zfs_resume_fs(zfsvfs, ds);
4293 			error = error ? error : end_err;
4294 			VFS_RELE(zfsvfs->z_vfs);
4295 		} else {
4296 			error = dmu_recv_end(&drc, NULL);
4297 		}
4298 
4299 		/* Set delayed properties now, after we're done receiving. */
4300 		if (delayprops != NULL && error == 0) {
4301 			(void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4302 			    delayprops, errors);
4303 		}
4304 	}
4305 
4306 	if (delayprops != NULL) {
4307 		/*
4308 		 * Merge delayed props back in with initial props, in case
4309 		 * we're DEBUG and zfs_ioc_recv_inject_err is set (which means
4310 		 * we have to make sure clear_received_props() includes
4311 		 * the delayed properties).
4312 		 *
4313 		 * Since zfs_ioc_recv_inject_err is only in DEBUG kernels,
4314 		 * using ASSERT() will be just like a VERIFY.
4315 		 */
4316 		ASSERT(nvlist_merge(props, delayprops, 0) == 0);
4317 		nvlist_free(delayprops);
4318 	}
4319 
4320 	/*
4321 	 * Now that all props, initial and delayed, are set, report the prop
4322 	 * errors to the caller.
4323 	 */
4324 	if (zc->zc_nvlist_dst_size != 0 &&
4325 	    (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4326 	    put_nvlist(zc, errors) != 0)) {
4327 		/*
4328 		 * Caller made zc->zc_nvlist_dst less than the minimum expected
4329 		 * size or supplied an invalid address.
4330 		 */
4331 		props_error = SET_ERROR(EINVAL);
4332 	}
4333 
4334 	zc->zc_cookie = off - fp->f_offset;
4335 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4336 		fp->f_offset = off;
4337 
4338 #ifdef	DEBUG
4339 	if (zfs_ioc_recv_inject_err) {
4340 		zfs_ioc_recv_inject_err = B_FALSE;
4341 		error = 1;
4342 	}
4343 #endif
4344 	/*
4345 	 * On error, restore the original props.
4346 	 */
4347 	if (error != 0 && props != NULL && !drc.drc_newfs) {
4348 		if (clear_received_props(tofs, props, NULL) != 0) {
4349 			/*
4350 			 * We failed to clear the received properties.
4351 			 * Since we may have left a $recvd value on the
4352 			 * system, we can't clear the $hasrecvd flag.
4353 			 */
4354 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4355 		} else if (first_recvd_props) {
4356 			dsl_prop_unset_hasrecvd(tofs);
4357 		}
4358 
4359 		if (origprops == NULL && !drc.drc_newfs) {
4360 			/* We failed to stash the original properties. */
4361 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4362 		}
4363 
4364 		/*
4365 		 * dsl_props_set() will not convert RECEIVED to LOCAL on or
4366 		 * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4367 		 * explictly if we're restoring local properties cleared in the
4368 		 * first new-style receive.
4369 		 */
4370 		if (origprops != NULL &&
4371 		    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4372 		    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4373 		    origprops, NULL) != 0) {
4374 			/*
4375 			 * We stashed the original properties but failed to
4376 			 * restore them.
4377 			 */
4378 			zc->zc_obj |= ZPROP_ERR_NORESTORE;
4379 		}
4380 	}
4381 out:
4382 	nvlist_free(props);
4383 	nvlist_free(origprops);
4384 	nvlist_free(errors);
4385 	releasef(fd);
4386 
4387 	if (error == 0)
4388 		error = props_error;
4389 
4390 	return (error);
4391 }
4392 
4393 /*
4394  * inputs:
4395  * zc_name	name of snapshot to send
4396  * zc_cookie	file descriptor to send stream to
4397  * zc_obj	fromorigin flag (mutually exclusive with zc_fromobj)
4398  * zc_sendobj	objsetid of snapshot to send
4399  * zc_fromobj	objsetid of incremental fromsnap (may be zero)
4400  * zc_guid	if set, estimate size of stream only.  zc_cookie is ignored.
4401  *		output size in zc_objset_type.
4402  * zc_flags	lzc_send_flags
4403  *
4404  * outputs:
4405  * zc_objset_type	estimated size, if zc_guid is set
4406  */
4407 static int
4408 zfs_ioc_send(zfs_cmd_t *zc)
4409 {
4410 	int error;
4411 	offset_t off;
4412 	boolean_t estimate = (zc->zc_guid != 0);
4413 	boolean_t embedok = (zc->zc_flags & 0x1);
4414 	boolean_t large_block_ok = (zc->zc_flags & 0x2);
4415 	boolean_t compressok = (zc->zc_flags & 0x4);
4416 
4417 	if (zc->zc_obj != 0) {
4418 		dsl_pool_t *dp;
4419 		dsl_dataset_t *tosnap;
4420 
4421 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4422 		if (error != 0)
4423 			return (error);
4424 
4425 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4426 		if (error != 0) {
4427 			dsl_pool_rele(dp, FTAG);
4428 			return (error);
4429 		}
4430 
4431 		if (dsl_dir_is_clone(tosnap->ds_dir))
4432 			zc->zc_fromobj =
4433 			    dsl_dir_phys(tosnap->ds_dir)->dd_origin_obj;
4434 		dsl_dataset_rele(tosnap, FTAG);
4435 		dsl_pool_rele(dp, FTAG);
4436 	}
4437 
4438 	if (estimate) {
4439 		dsl_pool_t *dp;
4440 		dsl_dataset_t *tosnap;
4441 		dsl_dataset_t *fromsnap = NULL;
4442 
4443 		error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4444 		if (error != 0)
4445 			return (error);
4446 
4447 		error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4448 		if (error != 0) {
4449 			dsl_pool_rele(dp, FTAG);
4450 			return (error);
4451 		}
4452 
4453 		if (zc->zc_fromobj != 0) {
4454 			error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
4455 			    FTAG, &fromsnap);
4456 			if (error != 0) {
4457 				dsl_dataset_rele(tosnap, FTAG);
4458 				dsl_pool_rele(dp, FTAG);
4459 				return (error);
4460 			}
4461 		}
4462 
4463 		error = dmu_send_estimate(tosnap, fromsnap, compressok,
4464 		    &zc->zc_objset_type);
4465 
4466 		if (fromsnap != NULL)
4467 			dsl_dataset_rele(fromsnap, FTAG);
4468 		dsl_dataset_rele(tosnap, FTAG);
4469 		dsl_pool_rele(dp, FTAG);
4470 	} else {
4471 		file_t *fp = getf(zc->zc_cookie);
4472 		if (fp == NULL)
4473 			return (SET_ERROR(EBADF));
4474 
4475 		off = fp->f_offset;
4476 		error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
4477 		    zc->zc_fromobj, embedok, large_block_ok, compressok,
4478 		    zc->zc_cookie, fp->f_vnode, &off);
4479 
4480 		if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4481 			fp->f_offset = off;
4482 		releasef(zc->zc_cookie);
4483 	}
4484 	return (error);
4485 }
4486 
4487 /*
4488  * inputs:
4489  * zc_name	name of snapshot on which to report progress
4490  * zc_cookie	file descriptor of send stream
4491  *
4492  * outputs:
4493  * zc_cookie	number of bytes written in send stream thus far
4494  */
4495 static int
4496 zfs_ioc_send_progress(zfs_cmd_t *zc)
4497 {
4498 	dsl_pool_t *dp;
4499 	dsl_dataset_t *ds;
4500 	dmu_sendarg_t *dsp = NULL;
4501 	int error;
4502 
4503 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4504 	if (error != 0)
4505 		return (error);
4506 
4507 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4508 	if (error != 0) {
4509 		dsl_pool_rele(dp, FTAG);
4510 		return (error);
4511 	}
4512 
4513 	mutex_enter(&ds->ds_sendstream_lock);
4514 
4515 	/*
4516 	 * Iterate over all the send streams currently active on this dataset.
4517 	 * If there's one which matches the specified file descriptor _and_ the
4518 	 * stream was started by the current process, return the progress of
4519 	 * that stream.
4520 	 */
4521 	for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4522 	    dsp = list_next(&ds->ds_sendstreams, dsp)) {
4523 		if (dsp->dsa_outfd == zc->zc_cookie &&
4524 		    dsp->dsa_proc == curproc)
4525 			break;
4526 	}
4527 
4528 	if (dsp != NULL)
4529 		zc->zc_cookie = *(dsp->dsa_off);
4530 	else
4531 		error = SET_ERROR(ENOENT);
4532 
4533 	mutex_exit(&ds->ds_sendstream_lock);
4534 	dsl_dataset_rele(ds, FTAG);
4535 	dsl_pool_rele(dp, FTAG);
4536 	return (error);
4537 }
4538 
4539 static int
4540 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4541 {
4542 	int id, error;
4543 
4544 	error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4545 	    &zc->zc_inject_record);
4546 
4547 	if (error == 0)
4548 		zc->zc_guid = (uint64_t)id;
4549 
4550 	return (error);
4551 }
4552 
4553 static int
4554 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4555 {
4556 	return (zio_clear_fault((int)zc->zc_guid));
4557 }
4558 
4559 static int
4560 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4561 {
4562 	int id = (int)zc->zc_guid;
4563 	int error;
4564 
4565 	error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4566 	    &zc->zc_inject_record);
4567 
4568 	zc->zc_guid = id;
4569 
4570 	return (error);
4571 }
4572 
4573 static int
4574 zfs_ioc_error_log(zfs_cmd_t *zc)
4575 {
4576 	spa_t *spa;
4577 	int error;
4578 	size_t count = (size_t)zc->zc_nvlist_dst_size;
4579 
4580 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4581 		return (error);
4582 
4583 	error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4584 	    &count);
4585 	if (error == 0)
4586 		zc->zc_nvlist_dst_size = count;
4587 	else
4588 		zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4589 
4590 	spa_close(spa, FTAG);
4591 
4592 	return (error);
4593 }
4594 
4595 static int
4596 zfs_ioc_clear(zfs_cmd_t *zc)
4597 {
4598 	spa_t *spa;
4599 	vdev_t *vd;
4600 	int error;
4601 
4602 	/*
4603 	 * On zpool clear we also fix up missing slogs
4604 	 */
4605 	mutex_enter(&spa_namespace_lock);
4606 	spa = spa_lookup(zc->zc_name);
4607 	if (spa == NULL) {
4608 		mutex_exit(&spa_namespace_lock);
4609 		return (SET_ERROR(EIO));
4610 	}
4611 	if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4612 		/* we need to let spa_open/spa_load clear the chains */
4613 		spa_set_log_state(spa, SPA_LOG_CLEAR);
4614 	}
4615 	spa->spa_last_open_failed = 0;
4616 	mutex_exit(&spa_namespace_lock);
4617 
4618 	if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4619 		error = spa_open(zc->zc_name, &spa, FTAG);
4620 	} else {
4621 		nvlist_t *policy;
4622 		nvlist_t *config = NULL;
4623 
4624 		if (zc->zc_nvlist_src == NULL)
4625 			return (SET_ERROR(EINVAL));
4626 
4627 		if ((error = get_nvlist(zc->zc_nvlist_src,
4628 		    zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4629 			error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4630 			    policy, &config);
4631 			if (config != NULL) {
4632 				int err;
4633 
4634 				if ((err = put_nvlist(zc, config)) != 0)
4635 					error = err;
4636 				nvlist_free(config);
4637 			}
4638 			nvlist_free(policy);
4639 		}
4640 	}
4641 
4642 	if (error != 0)
4643 		return (error);
4644 
4645 	spa_vdev_state_enter(spa, SCL_NONE);
4646 
4647 	if (zc->zc_guid == 0) {
4648 		vd = NULL;
4649 	} else {
4650 		vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4651 		if (vd == NULL) {
4652 			(void) spa_vdev_state_exit(spa, NULL, ENODEV);
4653 			spa_close(spa, FTAG);
4654 			return (SET_ERROR(ENODEV));
4655 		}
4656 	}
4657 
4658 	vdev_clear(spa, vd);
4659 
4660 	(void) spa_vdev_state_exit(spa, NULL, 0);
4661 
4662 	/*
4663 	 * Resume any suspended I/Os.
4664 	 */
4665 	if (zio_resume(spa) != 0)
4666 		error = SET_ERROR(EIO);
4667 
4668 	spa_close(spa, FTAG);
4669 
4670 	return (error);
4671 }
4672 
4673 static int
4674 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4675 {
4676 	spa_t *spa;
4677 	int error;
4678 
4679 	error = spa_open(zc->zc_name, &spa, FTAG);
4680 	if (error != 0)
4681 		return (error);
4682 
4683 	spa_vdev_state_enter(spa, SCL_NONE);
4684 
4685 	/*
4686 	 * If a resilver is already in progress then set the
4687 	 * spa_scrub_reopen flag to B_TRUE so that we don't restart
4688 	 * the scan as a side effect of the reopen. Otherwise, let
4689 	 * vdev_open() decided if a resilver is required.
4690 	 */
4691 	spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4692 	vdev_reopen(spa->spa_root_vdev);
4693 	spa->spa_scrub_reopen = B_FALSE;
4694 
4695 	(void) spa_vdev_state_exit(spa, NULL, 0);
4696 	spa_close(spa, FTAG);
4697 	return (0);
4698 }
4699 /*
4700  * inputs:
4701  * zc_name	name of filesystem
4702  * zc_value	name of origin snapshot
4703  *
4704  * outputs:
4705  * zc_string	name of conflicting snapshot, if there is one
4706  */
4707 static int
4708 zfs_ioc_promote(zfs_cmd_t *zc)
4709 {
4710 	char *cp;
4711 
4712 	/*
4713 	 * We don't need to unmount *all* the origin fs's snapshots, but
4714 	 * it's easier.
4715 	 */
4716 	cp = strchr(zc->zc_value, '@');
4717 	if (cp)
4718 		*cp = '\0';
4719 	(void) dmu_objset_find(zc->zc_value,
4720 	    zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
4721 	return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4722 }
4723 
4724 /*
4725  * Retrieve a single {user|group}{used|quota}@... property.
4726  *
4727  * inputs:
4728  * zc_name	name of filesystem
4729  * zc_objset_type zfs_userquota_prop_t
4730  * zc_value	domain name (eg. "S-1-234-567-89")
4731  * zc_guid	RID/UID/GID
4732  *
4733  * outputs:
4734  * zc_cookie	property value
4735  */
4736 static int
4737 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4738 {
4739 	zfsvfs_t *zfsvfs;
4740 	int error;
4741 
4742 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4743 		return (SET_ERROR(EINVAL));
4744 
4745 	error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4746 	if (error != 0)
4747 		return (error);
4748 
4749 	error = zfs_userspace_one(zfsvfs,
4750 	    zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4751 	zfsvfs_rele(zfsvfs, FTAG);
4752 
4753 	return (error);
4754 }
4755 
4756 /*
4757  * inputs:
4758  * zc_name		name of filesystem
4759  * zc_cookie		zap cursor
4760  * zc_objset_type	zfs_userquota_prop_t
4761  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4762  *
4763  * outputs:
4764  * zc_nvlist_dst[_size]	data buffer (array of zfs_useracct_t)
4765  * zc_cookie	zap cursor
4766  */
4767 static int
4768 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4769 {
4770 	zfsvfs_t *zfsvfs;
4771 	int bufsize = zc->zc_nvlist_dst_size;
4772 
4773 	if (bufsize <= 0)
4774 		return (SET_ERROR(ENOMEM));
4775 
4776 	int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4777 	if (error != 0)
4778 		return (error);
4779 
4780 	void *buf = kmem_alloc(bufsize, KM_SLEEP);
4781 
4782 	error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4783 	    buf, &zc->zc_nvlist_dst_size);
4784 
4785 	if (error == 0) {
4786 		error = xcopyout(buf,
4787 		    (void *)(uintptr_t)zc->zc_nvlist_dst,
4788 		    zc->zc_nvlist_dst_size);
4789 	}
4790 	kmem_free(buf, bufsize);
4791 	zfsvfs_rele(zfsvfs, FTAG);
4792 
4793 	return (error);
4794 }
4795 
4796 /*
4797  * inputs:
4798  * zc_name		name of filesystem
4799  *
4800  * outputs:
4801  * none
4802  */
4803 static int
4804 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4805 {
4806 	objset_t *os;
4807 	int error = 0;
4808 	zfsvfs_t *zfsvfs;
4809 
4810 	if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4811 		if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4812 			/*
4813 			 * If userused is not enabled, it may be because the
4814 			 * objset needs to be closed & reopened (to grow the
4815 			 * objset_phys_t).  Suspend/resume the fs will do that.
4816 			 */
4817 			dsl_dataset_t *ds;
4818 
4819 			ds = dmu_objset_ds(zfsvfs->z_os);
4820 			error = zfs_suspend_fs(zfsvfs);
4821 			if (error == 0) {
4822 				dmu_objset_refresh_ownership(zfsvfs->z_os,
4823 				    zfsvfs);
4824 				error = zfs_resume_fs(zfsvfs, ds);
4825 			}
4826 		}
4827 		if (error == 0)
4828 			error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4829 		VFS_RELE(zfsvfs->z_vfs);
4830 	} else {
4831 		/* XXX kind of reading contents without owning */
4832 		error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4833 		if (error != 0)
4834 			return (error);
4835 
4836 		error = dmu_objset_userspace_upgrade(os);
4837 		dmu_objset_rele(os, FTAG);
4838 	}
4839 
4840 	return (error);
4841 }
4842 
4843 /*
4844  * We don't want to have a hard dependency
4845  * against some special symbols in sharefs
4846  * nfs, and smbsrv.  Determine them if needed when
4847  * the first file system is shared.
4848  * Neither sharefs, nfs or smbsrv are unloadable modules.
4849  */
4850 int (*znfsexport_fs)(void *arg);
4851 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4852 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4853 
4854 int zfs_nfsshare_inited;
4855 int zfs_smbshare_inited;
4856 
4857 ddi_modhandle_t nfs_mod;
4858 ddi_modhandle_t sharefs_mod;
4859 ddi_modhandle_t smbsrv_mod;
4860 kmutex_t zfs_share_lock;
4861 
4862 static int
4863 zfs_init_sharefs()
4864 {
4865 	int error;
4866 
4867 	ASSERT(MUTEX_HELD(&zfs_share_lock));
4868 	/* Both NFS and SMB shares also require sharetab support. */
4869 	if (sharefs_mod == NULL && ((sharefs_mod =
4870 	    ddi_modopen("fs/sharefs",
4871 	    KRTLD_MODE_FIRST, &error)) == NULL)) {
4872 		return (SET_ERROR(ENOSYS));
4873 	}
4874 	if (zshare_fs == NULL && ((zshare_fs =
4875 	    (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4876 	    ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4877 		return (SET_ERROR(ENOSYS));
4878 	}
4879 	return (0);
4880 }
4881 
4882 static int
4883 zfs_ioc_share(zfs_cmd_t *zc)
4884 {
4885 	int error;
4886 	int opcode;
4887 
4888 	switch (zc->zc_share.z_sharetype) {
4889 	case ZFS_SHARE_NFS:
4890 	case ZFS_UNSHARE_NFS:
4891 		if (zfs_nfsshare_inited == 0) {
4892 			mutex_enter(&zfs_share_lock);
4893 			if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4894 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4895 				mutex_exit(&zfs_share_lock);
4896 				return (SET_ERROR(ENOSYS));
4897 			}
4898 			if (znfsexport_fs == NULL &&
4899 			    ((znfsexport_fs = (int (*)(void *))
4900 			    ddi_modsym(nfs_mod,
4901 			    "nfs_export", &error)) == NULL)) {
4902 				mutex_exit(&zfs_share_lock);
4903 				return (SET_ERROR(ENOSYS));
4904 			}
4905 			error = zfs_init_sharefs();
4906 			if (error != 0) {
4907 				mutex_exit(&zfs_share_lock);
4908 				return (SET_ERROR(ENOSYS));
4909 			}
4910 			zfs_nfsshare_inited = 1;
4911 			mutex_exit(&zfs_share_lock);
4912 		}
4913 		break;
4914 	case ZFS_SHARE_SMB:
4915 	case ZFS_UNSHARE_SMB:
4916 		if (zfs_smbshare_inited == 0) {
4917 			mutex_enter(&zfs_share_lock);
4918 			if (smbsrv_mod == NULL && ((smbsrv_mod =
4919 			    ddi_modopen("drv/smbsrv",
4920 			    KRTLD_MODE_FIRST, &error)) == NULL)) {
4921 				mutex_exit(&zfs_share_lock);
4922 				return (SET_ERROR(ENOSYS));
4923 			}
4924 			if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4925 			    (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4926 			    "smb_server_share", &error)) == NULL)) {
4927 				mutex_exit(&zfs_share_lock);
4928 				return (SET_ERROR(ENOSYS));
4929 			}
4930 			error = zfs_init_sharefs();
4931 			if (error != 0) {
4932 				mutex_exit(&zfs_share_lock);
4933 				return (SET_ERROR(ENOSYS));
4934 			}
4935 			zfs_smbshare_inited = 1;
4936 			mutex_exit(&zfs_share_lock);
4937 		}
4938 		break;
4939 	default:
4940 		return (SET_ERROR(EINVAL));
4941 	}
4942 
4943 	switch (zc->zc_share.z_sharetype) {
4944 	case ZFS_SHARE_NFS:
4945 	case ZFS_UNSHARE_NFS:
4946 		if (error =
4947 		    znfsexport_fs((void *)
4948 		    (uintptr_t)zc->zc_share.z_exportdata))
4949 			return (error);
4950 		break;
4951 	case ZFS_SHARE_SMB:
4952 	case ZFS_UNSHARE_SMB:
4953 		if (error = zsmbexport_fs((void *)
4954 		    (uintptr_t)zc->zc_share.z_exportdata,
4955 		    zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
4956 		    B_TRUE: B_FALSE)) {
4957 			return (error);
4958 		}
4959 		break;
4960 	}
4961 
4962 	opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
4963 	    zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
4964 	    SHAREFS_ADD : SHAREFS_REMOVE;
4965 
4966 	/*
4967 	 * Add or remove share from sharetab
4968 	 */
4969 	error = zshare_fs(opcode,
4970 	    (void *)(uintptr_t)zc->zc_share.z_sharedata,
4971 	    zc->zc_share.z_sharemax);
4972 
4973 	return (error);
4974 
4975 }
4976 
4977 ace_t full_access[] = {
4978 	{(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
4979 };
4980 
4981 /*
4982  * inputs:
4983  * zc_name		name of containing filesystem
4984  * zc_obj		object # beyond which we want next in-use object #
4985  *
4986  * outputs:
4987  * zc_obj		next in-use object #
4988  */
4989 static int
4990 zfs_ioc_next_obj(zfs_cmd_t *zc)
4991 {
4992 	objset_t *os = NULL;
4993 	int error;
4994 
4995 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4996 	if (error != 0)
4997 		return (error);
4998 
4999 	error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
5000 	    dsl_dataset_phys(os->os_dsl_dataset)->ds_prev_snap_txg);
5001 
5002 	dmu_objset_rele(os, FTAG);
5003 	return (error);
5004 }
5005 
5006 /*
5007  * inputs:
5008  * zc_name		name of filesystem
5009  * zc_value		prefix name for snapshot
5010  * zc_cleanup_fd	cleanup-on-exit file descriptor for calling process
5011  *
5012  * outputs:
5013  * zc_value		short name of new snapshot
5014  */
5015 static int
5016 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
5017 {
5018 	char *snap_name;
5019 	char *hold_name;
5020 	int error;
5021 	minor_t minor;
5022 
5023 	error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
5024 	if (error != 0)
5025 		return (error);
5026 
5027 	snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
5028 	    (u_longlong_t)ddi_get_lbolt64());
5029 	hold_name = kmem_asprintf("%%%s", zc->zc_value);
5030 
5031 	error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
5032 	    hold_name);
5033 	if (error == 0)
5034 		(void) strcpy(zc->zc_value, snap_name);
5035 	strfree(snap_name);
5036 	strfree(hold_name);
5037 	zfs_onexit_fd_rele(zc->zc_cleanup_fd);
5038 	return (error);
5039 }
5040 
5041 /*
5042  * inputs:
5043  * zc_name		name of "to" snapshot
5044  * zc_value		name of "from" snapshot
5045  * zc_cookie		file descriptor to write diff data on
5046  *
5047  * outputs:
5048  * dmu_diff_record_t's to the file descriptor
5049  */
5050 static int
5051 zfs_ioc_diff(zfs_cmd_t *zc)
5052 {
5053 	file_t *fp;
5054 	offset_t off;
5055 	int error;
5056 
5057 	fp = getf(zc->zc_cookie);
5058 	if (fp == NULL)
5059 		return (SET_ERROR(EBADF));
5060 
5061 	off = fp->f_offset;
5062 
5063 	error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
5064 
5065 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5066 		fp->f_offset = off;
5067 	releasef(zc->zc_cookie);
5068 
5069 	return (error);
5070 }
5071 
5072 /*
5073  * Remove all ACL files in shares dir
5074  */
5075 static int
5076 zfs_smb_acl_purge(znode_t *dzp)
5077 {
5078 	zap_cursor_t	zc;
5079 	zap_attribute_t	zap;
5080 	zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
5081 	int error;
5082 
5083 	for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
5084 	    (error = zap_cursor_retrieve(&zc, &zap)) == 0;
5085 	    zap_cursor_advance(&zc)) {
5086 		if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
5087 		    NULL, 0)) != 0)
5088 			break;
5089 	}
5090 	zap_cursor_fini(&zc);
5091 	return (error);
5092 }
5093 
5094 static int
5095 zfs_ioc_smb_acl(zfs_cmd_t *zc)
5096 {
5097 	vnode_t *vp;
5098 	znode_t *dzp;
5099 	vnode_t *resourcevp = NULL;
5100 	znode_t *sharedir;
5101 	zfsvfs_t *zfsvfs;
5102 	nvlist_t *nvlist;
5103 	char *src, *target;
5104 	vattr_t vattr;
5105 	vsecattr_t vsec;
5106 	int error = 0;
5107 
5108 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
5109 	    NO_FOLLOW, NULL, &vp)) != 0)
5110 		return (error);
5111 
5112 	/* Now make sure mntpnt and dataset are ZFS */
5113 
5114 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
5115 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
5116 	    zc->zc_name) != 0)) {
5117 		VN_RELE(vp);
5118 		return (SET_ERROR(EINVAL));
5119 	}
5120 
5121 	dzp = VTOZ(vp);
5122 	zfsvfs = dzp->z_zfsvfs;
5123 	ZFS_ENTER(zfsvfs);
5124 
5125 	/*
5126 	 * Create share dir if its missing.
5127 	 */
5128 	mutex_enter(&zfsvfs->z_lock);
5129 	if (zfsvfs->z_shares_dir == 0) {
5130 		dmu_tx_t *tx;
5131 
5132 		tx = dmu_tx_create(zfsvfs->z_os);
5133 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
5134 		    ZFS_SHARES_DIR);
5135 		dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
5136 		error = dmu_tx_assign(tx, TXG_WAIT);
5137 		if (error != 0) {
5138 			dmu_tx_abort(tx);
5139 		} else {
5140 			error = zfs_create_share_dir(zfsvfs, tx);
5141 			dmu_tx_commit(tx);
5142 		}
5143 		if (error != 0) {
5144 			mutex_exit(&zfsvfs->z_lock);
5145 			VN_RELE(vp);
5146 			ZFS_EXIT(zfsvfs);
5147 			return (error);
5148 		}
5149 	}
5150 	mutex_exit(&zfsvfs->z_lock);
5151 
5152 	ASSERT(zfsvfs->z_shares_dir);
5153 	if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
5154 		VN_RELE(vp);
5155 		ZFS_EXIT(zfsvfs);
5156 		return (error);
5157 	}
5158 
5159 	switch (zc->zc_cookie) {
5160 	case ZFS_SMB_ACL_ADD:
5161 		vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
5162 		vattr.va_type = VREG;
5163 		vattr.va_mode = S_IFREG|0777;
5164 		vattr.va_uid = 0;
5165 		vattr.va_gid = 0;
5166 
5167 		vsec.vsa_mask = VSA_ACE;
5168 		vsec.vsa_aclentp = &full_access;
5169 		vsec.vsa_aclentsz = sizeof (full_access);
5170 		vsec.vsa_aclcnt = 1;
5171 
5172 		error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
5173 		    &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
5174 		if (resourcevp)
5175 			VN_RELE(resourcevp);
5176 		break;
5177 
5178 	case ZFS_SMB_ACL_REMOVE:
5179 		error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
5180 		    NULL, 0);
5181 		break;
5182 
5183 	case ZFS_SMB_ACL_RENAME:
5184 		if ((error = get_nvlist(zc->zc_nvlist_src,
5185 		    zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
5186 			VN_RELE(vp);
5187 			VN_RELE(ZTOV(sharedir));
5188 			ZFS_EXIT(zfsvfs);
5189 			return (error);
5190 		}
5191 		if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
5192 		    nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
5193 		    &target)) {
5194 			VN_RELE(vp);
5195 			VN_RELE(ZTOV(sharedir));
5196 			ZFS_EXIT(zfsvfs);
5197 			nvlist_free(nvlist);
5198 			return (error);
5199 		}
5200 		error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
5201 		    kcred, NULL, 0);
5202 		nvlist_free(nvlist);
5203 		break;
5204 
5205 	case ZFS_SMB_ACL_PURGE:
5206 		error = zfs_smb_acl_purge(sharedir);
5207 		break;
5208 
5209 	default:
5210 		error = SET_ERROR(EINVAL);
5211 		break;
5212 	}
5213 
5214 	VN_RELE(vp);
5215 	VN_RELE(ZTOV(sharedir));
5216 
5217 	ZFS_EXIT(zfsvfs);
5218 
5219 	return (error);
5220 }
5221 
5222 /*
5223  * innvl: {
5224  *     "holds" -> { snapname -> holdname (string), ... }
5225  *     (optional) "cleanup_fd" -> fd (int32)
5226  * }
5227  *
5228  * outnvl: {
5229  *     snapname -> error value (int32)
5230  *     ...
5231  * }
5232  */
5233 /* ARGSUSED */
5234 static int
5235 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
5236 {
5237 	nvpair_t *pair;
5238 	nvlist_t *holds;
5239 	int cleanup_fd = -1;
5240 	int error;
5241 	minor_t minor = 0;
5242 
5243 	error = nvlist_lookup_nvlist(args, "holds", &holds);
5244 	if (error != 0)
5245 		return (SET_ERROR(EINVAL));
5246 
5247 	/* make sure the user didn't pass us any invalid (empty) tags */
5248 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
5249 	    pair = nvlist_next_nvpair(holds, pair)) {
5250 		char *htag;
5251 
5252 		error = nvpair_value_string(pair, &htag);
5253 		if (error != 0)
5254 			return (SET_ERROR(error));
5255 
5256 		if (strlen(htag) == 0)
5257 			return (SET_ERROR(EINVAL));
5258 	}
5259 
5260 	if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
5261 		error = zfs_onexit_fd_hold(cleanup_fd, &minor);
5262 		if (error != 0)
5263 			return (error);
5264 	}
5265 
5266 	error = dsl_dataset_user_hold(holds, minor, errlist);
5267 	if (minor != 0)
5268 		zfs_onexit_fd_rele(cleanup_fd);
5269 	return (error);
5270 }
5271 
5272 /*
5273  * innvl is not used.
5274  *
5275  * outnvl: {
5276  *    holdname -> time added (uint64 seconds since epoch)
5277  *    ...
5278  * }
5279  */
5280 /* ARGSUSED */
5281 static int
5282 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
5283 {
5284 	return (dsl_dataset_get_holds(snapname, outnvl));
5285 }
5286 
5287 /*
5288  * innvl: {
5289  *     snapname -> { holdname, ... }
5290  *     ...
5291  * }
5292  *
5293  * outnvl: {
5294  *     snapname -> error value (int32)
5295  *     ...
5296  * }
5297  */
5298 /* ARGSUSED */
5299 static int
5300 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
5301 {
5302 	return (dsl_dataset_user_release(holds, errlist));
5303 }
5304 
5305 /*
5306  * inputs:
5307  * zc_name		name of new filesystem or snapshot
5308  * zc_value		full name of old snapshot
5309  *
5310  * outputs:
5311  * zc_cookie		space in bytes
5312  * zc_objset_type	compressed space in bytes
5313  * zc_perm_action	uncompressed space in bytes
5314  */
5315 static int
5316 zfs_ioc_space_written(zfs_cmd_t *zc)
5317 {
5318 	int error;
5319 	dsl_pool_t *dp;
5320 	dsl_dataset_t *new, *old;
5321 
5322 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5323 	if (error != 0)
5324 		return (error);
5325 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
5326 	if (error != 0) {
5327 		dsl_pool_rele(dp, FTAG);
5328 		return (error);
5329 	}
5330 	error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
5331 	if (error != 0) {
5332 		dsl_dataset_rele(new, FTAG);
5333 		dsl_pool_rele(dp, FTAG);
5334 		return (error);
5335 	}
5336 
5337 	error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5338 	    &zc->zc_objset_type, &zc->zc_perm_action);
5339 	dsl_dataset_rele(old, FTAG);
5340 	dsl_dataset_rele(new, FTAG);
5341 	dsl_pool_rele(dp, FTAG);
5342 	return (error);
5343 }
5344 
5345 /*
5346  * innvl: {
5347  *     "firstsnap" -> snapshot name
5348  * }
5349  *
5350  * outnvl: {
5351  *     "used" -> space in bytes
5352  *     "compressed" -> compressed space in bytes
5353  *     "uncompressed" -> uncompressed space in bytes
5354  * }
5355  */
5356 static int
5357 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5358 {
5359 	int error;
5360 	dsl_pool_t *dp;
5361 	dsl_dataset_t *new, *old;
5362 	char *firstsnap;
5363 	uint64_t used, comp, uncomp;
5364 
5365 	if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5366 		return (SET_ERROR(EINVAL));
5367 
5368 	error = dsl_pool_hold(lastsnap, FTAG, &dp);
5369 	if (error != 0)
5370 		return (error);
5371 
5372 	error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
5373 	if (error == 0 && !new->ds_is_snapshot) {
5374 		dsl_dataset_rele(new, FTAG);
5375 		error = SET_ERROR(EINVAL);
5376 	}
5377 	if (error != 0) {
5378 		dsl_pool_rele(dp, FTAG);
5379 		return (error);
5380 	}
5381 	error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
5382 	if (error == 0 && !old->ds_is_snapshot) {
5383 		dsl_dataset_rele(old, FTAG);
5384 		error = SET_ERROR(EINVAL);
5385 	}
5386 	if (error != 0) {
5387 		dsl_dataset_rele(new, FTAG);
5388 		dsl_pool_rele(dp, FTAG);
5389 		return (error);
5390 	}
5391 
5392 	error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5393 	dsl_dataset_rele(old, FTAG);
5394 	dsl_dataset_rele(new, FTAG);
5395 	dsl_pool_rele(dp, FTAG);
5396 	fnvlist_add_uint64(outnvl, "used", used);
5397 	fnvlist_add_uint64(outnvl, "compressed", comp);
5398 	fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5399 	return (error);
5400 }
5401 
5402 /*
5403  * innvl: {
5404  *     "fd" -> file descriptor to write stream to (int32)
5405  *     (optional) "fromsnap" -> full snap name to send an incremental from
5406  *     (optional) "largeblockok" -> (value ignored)
5407  *         indicates that blocks > 128KB are permitted
5408  *     (optional) "embedok" -> (value ignored)
5409  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
5410  *     (optional) "compressok" -> (value ignored)
5411  *         presence indicates compressed DRR_WRITE records are permitted
5412  *     (optional) "resume_object" and "resume_offset" -> (uint64)
5413  *         if present, resume send stream from specified object and offset.
5414  * }
5415  *
5416  * outnvl is unused
5417  */
5418 /* ARGSUSED */
5419 static int
5420 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5421 {
5422 	int error;
5423 	offset_t off;
5424 	char *fromname = NULL;
5425 	int fd;
5426 	boolean_t largeblockok;
5427 	boolean_t embedok;
5428 	boolean_t compressok;
5429 	uint64_t resumeobj = 0;
5430 	uint64_t resumeoff = 0;
5431 
5432 	error = nvlist_lookup_int32(innvl, "fd", &fd);
5433 	if (error != 0)
5434 		return (SET_ERROR(EINVAL));
5435 
5436 	(void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
5437 
5438 	largeblockok = nvlist_exists(innvl, "largeblockok");
5439 	embedok = nvlist_exists(innvl, "embedok");
5440 	compressok = nvlist_exists(innvl, "compressok");
5441 
5442 	(void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
5443 	(void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
5444 
5445 	file_t *fp = getf(fd);
5446 	if (fp == NULL)
5447 		return (SET_ERROR(EBADF));
5448 
5449 	off = fp->f_offset;
5450 	error = dmu_send(snapname, fromname, embedok, largeblockok, compressok,
5451 	    fd, resumeobj, resumeoff, fp->f_vnode, &off);
5452 
5453 	if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5454 		fp->f_offset = off;
5455 	releasef(fd);
5456 	return (error);
5457 }
5458 
5459 /*
5460  * Determine approximately how large a zfs send stream will be -- the number
5461  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5462  *
5463  * innvl: {
5464  *     (optional) "from" -> full snap or bookmark name to send an incremental
5465  *                          from
5466  *     (optional) "largeblockok" -> (value ignored)
5467  *         indicates that blocks > 128KB are permitted
5468  *     (optional) "embedok" -> (value ignored)
5469  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
5470  *     (optional) "compressok" -> (value ignored)
5471  *         presence indicates compressed DRR_WRITE records are permitted
5472  * }
5473  *
5474  * outnvl: {
5475  *     "space" -> bytes of space (uint64)
5476  * }
5477  */
5478 static int
5479 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5480 {
5481 	dsl_pool_t *dp;
5482 	dsl_dataset_t *tosnap;
5483 	int error;
5484 	char *fromname;
5485 	/* LINTED E_FUNC_SET_NOT_USED */
5486 	boolean_t largeblockok;
5487 	/* LINTED E_FUNC_SET_NOT_USED */
5488 	boolean_t embedok;
5489 	boolean_t compressok;
5490 	uint64_t space;
5491 
5492 	error = dsl_pool_hold(snapname, FTAG, &dp);
5493 	if (error != 0)
5494 		return (error);
5495 
5496 	error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
5497 	if (error != 0) {
5498 		dsl_pool_rele(dp, FTAG);
5499 		return (error);
5500 	}
5501 
5502 	largeblockok = nvlist_exists(innvl, "largeblockok");
5503 	embedok = nvlist_exists(innvl, "embedok");
5504 	compressok = nvlist_exists(innvl, "compressok");
5505 
5506 	error = nvlist_lookup_string(innvl, "from", &fromname);
5507 	if (error == 0) {
5508 		if (strchr(fromname, '@') != NULL) {
5509 			/*
5510 			 * If from is a snapshot, hold it and use the more
5511 			 * efficient dmu_send_estimate to estimate send space
5512 			 * size using deadlists.
5513 			 */
5514 			dsl_dataset_t *fromsnap;
5515 			error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
5516 			if (error != 0)
5517 				goto out;
5518 			error = dmu_send_estimate(tosnap, fromsnap, compressok,
5519 			    &space);
5520 			dsl_dataset_rele(fromsnap, FTAG);
5521 		} else if (strchr(fromname, '#') != NULL) {
5522 			/*
5523 			 * If from is a bookmark, fetch the creation TXG of the
5524 			 * snapshot it was created from and use that to find
5525 			 * blocks that were born after it.
5526 			 */
5527 			zfs_bookmark_phys_t frombm;
5528 
5529 			error = dsl_bookmark_lookup(dp, fromname, tosnap,
5530 			    &frombm);
5531 			if (error != 0)
5532 				goto out;
5533 			error = dmu_send_estimate_from_txg(tosnap,
5534 			    frombm.zbm_creation_txg, compressok, &space);
5535 		} else {
5536 			/*
5537 			 * from is not properly formatted as a snapshot or
5538 			 * bookmark
5539 			 */
5540 			error = SET_ERROR(EINVAL);
5541 			goto out;
5542 		}
5543 	} else {
5544 		// If estimating the size of a full send, use dmu_send_estimate
5545 		error = dmu_send_estimate(tosnap, NULL, compressok, &space);
5546 	}
5547 
5548 	fnvlist_add_uint64(outnvl, "space", space);
5549 
5550 out:
5551 	dsl_dataset_rele(tosnap, FTAG);
5552 	dsl_pool_rele(dp, FTAG);
5553 	return (error);
5554 }
5555 
5556 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5557 
5558 static void
5559 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5560     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5561     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5562 {
5563 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5564 
5565 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5566 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5567 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5568 	ASSERT3P(vec->zvec_func, ==, NULL);
5569 
5570 	vec->zvec_legacy_func = func;
5571 	vec->zvec_secpolicy = secpolicy;
5572 	vec->zvec_namecheck = namecheck;
5573 	vec->zvec_allow_log = log_history;
5574 	vec->zvec_pool_check = pool_check;
5575 }
5576 
5577 /*
5578  * See the block comment at the beginning of this file for details on
5579  * each argument to this function.
5580  */
5581 static void
5582 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5583     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5584     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5585     boolean_t allow_log)
5586 {
5587 	zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5588 
5589 	ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5590 	ASSERT3U(ioc, <, ZFS_IOC_LAST);
5591 	ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5592 	ASSERT3P(vec->zvec_func, ==, NULL);
5593 
5594 	/* if we are logging, the name must be valid */
5595 	ASSERT(!allow_log || namecheck != NO_NAME);
5596 
5597 	vec->zvec_name = name;
5598 	vec->zvec_func = func;
5599 	vec->zvec_secpolicy = secpolicy;
5600 	vec->zvec_namecheck = namecheck;
5601 	vec->zvec_pool_check = pool_check;
5602 	vec->zvec_smush_outnvlist = smush_outnvlist;
5603 	vec->zvec_allow_log = allow_log;
5604 }
5605 
5606 static void
5607 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5608     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5609     zfs_ioc_poolcheck_t pool_check)
5610 {
5611 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5612 	    POOL_NAME, log_history, pool_check);
5613 }
5614 
5615 static void
5616 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5617     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5618 {
5619 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5620 	    DATASET_NAME, B_FALSE, pool_check);
5621 }
5622 
5623 static void
5624 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5625 {
5626 	zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5627 	    POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5628 }
5629 
5630 static void
5631 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5632     zfs_secpolicy_func_t *secpolicy)
5633 {
5634 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5635 	    NO_NAME, B_FALSE, POOL_CHECK_NONE);
5636 }
5637 
5638 static void
5639 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5640     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5641 {
5642 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5643 	    DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5644 }
5645 
5646 static void
5647 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5648 {
5649 	zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5650 	    zfs_secpolicy_read);
5651 }
5652 
5653 static void
5654 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5655     zfs_secpolicy_func_t *secpolicy)
5656 {
5657 	zfs_ioctl_register_legacy(ioc, func, secpolicy,
5658 	    DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5659 }
5660 
5661 static void
5662 zfs_ioctl_init(void)
5663 {
5664 	zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5665 	    zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5666 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5667 
5668 	zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5669 	    zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5670 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5671 
5672 	zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5673 	    zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5674 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5675 
5676 	zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5677 	    zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5678 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5679 
5680 	zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5681 	    zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5682 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5683 
5684 	zfs_ioctl_register("create", ZFS_IOC_CREATE,
5685 	    zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5686 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5687 
5688 	zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5689 	    zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5690 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5691 
5692 	zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5693 	    zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5694 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5695 
5696 	zfs_ioctl_register("hold", ZFS_IOC_HOLD,
5697 	    zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
5698 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5699 	zfs_ioctl_register("release", ZFS_IOC_RELEASE,
5700 	    zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
5701 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5702 
5703 	zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
5704 	    zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
5705 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5706 
5707 	zfs_ioctl_register("rollback", ZFS_IOC_ROLLBACK,
5708 	    zfs_ioc_rollback, zfs_secpolicy_rollback, DATASET_NAME,
5709 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE);
5710 
5711 	zfs_ioctl_register("bookmark", ZFS_IOC_BOOKMARK,
5712 	    zfs_ioc_bookmark, zfs_secpolicy_bookmark, POOL_NAME,
5713 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5714 
5715 	zfs_ioctl_register("get_bookmarks", ZFS_IOC_GET_BOOKMARKS,
5716 	    zfs_ioc_get_bookmarks, zfs_secpolicy_read, DATASET_NAME,
5717 	    POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5718 
5719 	zfs_ioctl_register("destroy_bookmarks", ZFS_IOC_DESTROY_BOOKMARKS,
5720 	    zfs_ioc_destroy_bookmarks, zfs_secpolicy_destroy_bookmarks,
5721 	    POOL_NAME,
5722 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5723 
5724 	/* IOCTLS that use the legacy function signature */
5725 
5726 	zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5727 	    zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5728 
5729 	zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5730 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5731 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5732 	    zfs_ioc_pool_scan);
5733 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5734 	    zfs_ioc_pool_upgrade);
5735 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5736 	    zfs_ioc_vdev_add);
5737 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5738 	    zfs_ioc_vdev_remove);
5739 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5740 	    zfs_ioc_vdev_set_state);
5741 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5742 	    zfs_ioc_vdev_attach);
5743 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5744 	    zfs_ioc_vdev_detach);
5745 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5746 	    zfs_ioc_vdev_setpath);
5747 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5748 	    zfs_ioc_vdev_setfru);
5749 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5750 	    zfs_ioc_pool_set_props);
5751 	zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5752 	    zfs_ioc_vdev_split);
5753 	zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5754 	    zfs_ioc_pool_reguid);
5755 
5756 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5757 	    zfs_ioc_pool_configs, zfs_secpolicy_none);
5758 	zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5759 	    zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5760 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5761 	    zfs_ioc_inject_fault, zfs_secpolicy_inject);
5762 	zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5763 	    zfs_ioc_clear_fault, zfs_secpolicy_inject);
5764 	zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5765 	    zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5766 
5767 	/*
5768 	 * pool destroy, and export don't log the history as part of
5769 	 * zfsdev_ioctl, but rather zfs_ioc_pool_export
5770 	 * does the logging of those commands.
5771 	 */
5772 	zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5773 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5774 	zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5775 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5776 
5777 	zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5778 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5779 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5780 	    zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5781 
5782 	zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5783 	    zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5784 	zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5785 	    zfs_ioc_dsobj_to_dsname,
5786 	    zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5787 	zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5788 	    zfs_ioc_pool_get_history,
5789 	    zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5790 
5791 	zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5792 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5793 
5794 	zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5795 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5796 	zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5797 	    zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5798 
5799 	zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5800 	    zfs_ioc_space_written);
5801 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5802 	    zfs_ioc_objset_recvd_props);
5803 	zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5804 	    zfs_ioc_next_obj);
5805 	zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5806 	    zfs_ioc_get_fsacl);
5807 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5808 	    zfs_ioc_objset_stats);
5809 	zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5810 	    zfs_ioc_objset_zplprops);
5811 	zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5812 	    zfs_ioc_dataset_list_next);
5813 	zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5814 	    zfs_ioc_snapshot_list_next);
5815 	zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5816 	    zfs_ioc_send_progress);
5817 
5818 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5819 	    zfs_ioc_diff, zfs_secpolicy_diff);
5820 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5821 	    zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5822 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5823 	    zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5824 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5825 	    zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5826 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5827 	    zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5828 	zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5829 	    zfs_ioc_send, zfs_secpolicy_send);
5830 
5831 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5832 	    zfs_secpolicy_none);
5833 	zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5834 	    zfs_secpolicy_destroy);
5835 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5836 	    zfs_secpolicy_rename);
5837 	zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5838 	    zfs_secpolicy_recv);
5839 	zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5840 	    zfs_secpolicy_promote);
5841 	zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5842 	    zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5843 	zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5844 	    zfs_secpolicy_set_fsacl);
5845 
5846 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5847 	    zfs_secpolicy_share, POOL_CHECK_NONE);
5848 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5849 	    zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5850 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5851 	    zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5852 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5853 	zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5854 	    zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5855 	    POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5856 }
5857 
5858 int
5859 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5860     zfs_ioc_poolcheck_t check)
5861 {
5862 	spa_t *spa;
5863 	int error;
5864 
5865 	ASSERT(type == POOL_NAME || type == DATASET_NAME);
5866 
5867 	if (check & POOL_CHECK_NONE)
5868 		return (0);
5869 
5870 	error = spa_open(name, &spa, FTAG);
5871 	if (error == 0) {
5872 		if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5873 			error = SET_ERROR(EAGAIN);
5874 		else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5875 			error = SET_ERROR(EROFS);
5876 		spa_close(spa, FTAG);
5877 	}
5878 	return (error);
5879 }
5880 
5881 /*
5882  * Find a free minor number.
5883  */
5884 minor_t
5885 zfsdev_minor_alloc(void)
5886 {
5887 	static minor_t last_minor;
5888 	minor_t m;
5889 
5890 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5891 
5892 	for (m = last_minor + 1; m != last_minor; m++) {
5893 		if (m > ZFSDEV_MAX_MINOR)
5894 			m = 1;
5895 		if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5896 			last_minor = m;
5897 			return (m);
5898 		}
5899 	}
5900 
5901 	return (0);
5902 }
5903 
5904 static int
5905 zfs_ctldev_init(dev_t *devp)
5906 {
5907 	minor_t minor;
5908 	zfs_soft_state_t *zs;
5909 
5910 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5911 	ASSERT(getminor(*devp) == 0);
5912 
5913 	minor = zfsdev_minor_alloc();
5914 	if (minor == 0)
5915 		return (SET_ERROR(ENXIO));
5916 
5917 	if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5918 		return (SET_ERROR(EAGAIN));
5919 
5920 	*devp = makedevice(getemajor(*devp), minor);
5921 
5922 	zs = ddi_get_soft_state(zfsdev_state, minor);
5923 	zs->zss_type = ZSST_CTLDEV;
5924 	zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
5925 
5926 	return (0);
5927 }
5928 
5929 static void
5930 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
5931 {
5932 	ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5933 
5934 	zfs_onexit_destroy(zo);
5935 	ddi_soft_state_free(zfsdev_state, minor);
5936 }
5937 
5938 void *
5939 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
5940 {
5941 	zfs_soft_state_t *zp;
5942 
5943 	zp = ddi_get_soft_state(zfsdev_state, minor);
5944 	if (zp == NULL || zp->zss_type != which)
5945 		return (NULL);
5946 
5947 	return (zp->zss_data);
5948 }
5949 
5950 static int
5951 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
5952 {
5953 	int error = 0;
5954 
5955 	if (getminor(*devp) != 0)
5956 		return (zvol_open(devp, flag, otyp, cr));
5957 
5958 	/* This is the control device. Allocate a new minor if requested. */
5959 	if (flag & FEXCL) {
5960 		mutex_enter(&zfsdev_state_lock);
5961 		error = zfs_ctldev_init(devp);
5962 		mutex_exit(&zfsdev_state_lock);
5963 	}
5964 
5965 	return (error);
5966 }
5967 
5968 static int
5969 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
5970 {
5971 	zfs_onexit_t *zo;
5972 	minor_t minor = getminor(dev);
5973 
5974 	if (minor == 0)
5975 		return (0);
5976 
5977 	mutex_enter(&zfsdev_state_lock);
5978 	zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
5979 	if (zo == NULL) {
5980 		mutex_exit(&zfsdev_state_lock);
5981 		return (zvol_close(dev, flag, otyp, cr));
5982 	}
5983 	zfs_ctldev_destroy(zo, minor);
5984 	mutex_exit(&zfsdev_state_lock);
5985 
5986 	return (0);
5987 }
5988 
5989 static int
5990 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
5991 {
5992 	zfs_cmd_t *zc;
5993 	uint_t vecnum;
5994 	int error, rc, len;
5995 	minor_t minor = getminor(dev);
5996 	const zfs_ioc_vec_t *vec;
5997 	char *saved_poolname = NULL;
5998 	nvlist_t *innvl = NULL;
5999 
6000 	if (minor != 0 &&
6001 	    zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
6002 		return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
6003 
6004 	vecnum = cmd - ZFS_IOC_FIRST;
6005 	ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
6006 
6007 	if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
6008 		return (SET_ERROR(EINVAL));
6009 	vec = &zfs_ioc_vec[vecnum];
6010 
6011 	zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
6012 
6013 	error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
6014 	if (error != 0) {
6015 		error = SET_ERROR(EFAULT);
6016 		goto out;
6017 	}
6018 
6019 	zc->zc_iflags = flag & FKIOCTL;
6020 	if (zc->zc_nvlist_src_size != 0) {
6021 		error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
6022 		    zc->zc_iflags, &innvl);
6023 		if (error != 0)
6024 			goto out;
6025 	}
6026 
6027 	/*
6028 	 * Ensure that all pool/dataset names are valid before we pass down to
6029 	 * the lower layers.
6030 	 */
6031 	zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
6032 	switch (vec->zvec_namecheck) {
6033 	case POOL_NAME:
6034 		if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
6035 			error = SET_ERROR(EINVAL);
6036 		else
6037 			error = pool_status_check(zc->zc_name,
6038 			    vec->zvec_namecheck, vec->zvec_pool_check);
6039 		break;
6040 
6041 	case DATASET_NAME:
6042 		if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
6043 			error = SET_ERROR(EINVAL);
6044 		else
6045 			error = pool_status_check(zc->zc_name,
6046 			    vec->zvec_namecheck, vec->zvec_pool_check);
6047 		break;
6048 
6049 	case NO_NAME:
6050 		break;
6051 	}
6052 
6053 
6054 	if (error == 0)
6055 		error = vec->zvec_secpolicy(zc, innvl, cr);
6056 
6057 	if (error != 0)
6058 		goto out;
6059 
6060 	/* legacy ioctls can modify zc_name */
6061 	len = strcspn(zc->zc_name, "/@#") + 1;
6062 	saved_poolname = kmem_alloc(len, KM_SLEEP);
6063 	(void) strlcpy(saved_poolname, zc->zc_name, len);
6064 
6065 	if (vec->zvec_func != NULL) {
6066 		nvlist_t *outnvl;
6067 		int puterror = 0;
6068 		spa_t *spa;
6069 		nvlist_t *lognv = NULL;
6070 
6071 		ASSERT(vec->zvec_legacy_func == NULL);
6072 
6073 		/*
6074 		 * Add the innvl to the lognv before calling the func,
6075 		 * in case the func changes the innvl.
6076 		 */
6077 		if (vec->zvec_allow_log) {
6078 			lognv = fnvlist_alloc();
6079 			fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
6080 			    vec->zvec_name);
6081 			if (!nvlist_empty(innvl)) {
6082 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
6083 				    innvl);
6084 			}
6085 		}
6086 
6087 		outnvl = fnvlist_alloc();
6088 		error = vec->zvec_func(zc->zc_name, innvl, outnvl);
6089 
6090 		if (error == 0 && vec->zvec_allow_log &&
6091 		    spa_open(zc->zc_name, &spa, FTAG) == 0) {
6092 			if (!nvlist_empty(outnvl)) {
6093 				fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
6094 				    outnvl);
6095 			}
6096 			(void) spa_history_log_nvl(spa, lognv);
6097 			spa_close(spa, FTAG);
6098 		}
6099 		fnvlist_free(lognv);
6100 
6101 		if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
6102 			int smusherror = 0;
6103 			if (vec->zvec_smush_outnvlist) {
6104 				smusherror = nvlist_smush(outnvl,
6105 				    zc->zc_nvlist_dst_size);
6106 			}
6107 			if (smusherror == 0)
6108 				puterror = put_nvlist(zc, outnvl);
6109 		}
6110 
6111 		if (puterror != 0)
6112 			error = puterror;
6113 
6114 		nvlist_free(outnvl);
6115 	} else {
6116 		error = vec->zvec_legacy_func(zc);
6117 	}
6118 
6119 out:
6120 	nvlist_free(innvl);
6121 	rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
6122 	if (error == 0 && rc != 0)
6123 		error = SET_ERROR(EFAULT);
6124 	if (error == 0 && vec->zvec_allow_log) {
6125 		char *s = tsd_get(zfs_allow_log_key);
6126 		if (s != NULL)
6127 			strfree(s);
6128 		(void) tsd_set(zfs_allow_log_key, saved_poolname);
6129 	} else {
6130 		if (saved_poolname != NULL)
6131 			strfree(saved_poolname);
6132 	}
6133 
6134 	kmem_free(zc, sizeof (zfs_cmd_t));
6135 	return (error);
6136 }
6137 
6138 static int
6139 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
6140 {
6141 	if (cmd != DDI_ATTACH)
6142 		return (DDI_FAILURE);
6143 
6144 	if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
6145 	    DDI_PSEUDO, 0) == DDI_FAILURE)
6146 		return (DDI_FAILURE);
6147 
6148 	zfs_dip = dip;
6149 
6150 	ddi_report_dev(dip);
6151 
6152 	return (DDI_SUCCESS);
6153 }
6154 
6155 static int
6156 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
6157 {
6158 	if (spa_busy() || zfs_busy() || zvol_busy())
6159 		return (DDI_FAILURE);
6160 
6161 	if (cmd != DDI_DETACH)
6162 		return (DDI_FAILURE);
6163 
6164 	zfs_dip = NULL;
6165 
6166 	ddi_prop_remove_all(dip);
6167 	ddi_remove_minor_node(dip, NULL);
6168 
6169 	return (DDI_SUCCESS);
6170 }
6171 
6172 /*ARGSUSED*/
6173 static int
6174 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
6175 {
6176 	switch (infocmd) {
6177 	case DDI_INFO_DEVT2DEVINFO:
6178 		*result = zfs_dip;
6179 		return (DDI_SUCCESS);
6180 
6181 	case DDI_INFO_DEVT2INSTANCE:
6182 		*result = (void *)0;
6183 		return (DDI_SUCCESS);
6184 	}
6185 
6186 	return (DDI_FAILURE);
6187 }
6188 
6189 /*
6190  * OK, so this is a little weird.
6191  *
6192  * /dev/zfs is the control node, i.e. minor 0.
6193  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
6194  *
6195  * /dev/zfs has basically nothing to do except serve up ioctls,
6196  * so most of the standard driver entry points are in zvol.c.
6197  */
6198 static struct cb_ops zfs_cb_ops = {
6199 	zfsdev_open,	/* open */
6200 	zfsdev_close,	/* close */
6201 	zvol_strategy,	/* strategy */
6202 	nodev,		/* print */
6203 	zvol_dump,	/* dump */
6204 	zvol_read,	/* read */
6205 	zvol_write,	/* write */
6206 	zfsdev_ioctl,	/* ioctl */
6207 	nodev,		/* devmap */
6208 	nodev,		/* mmap */
6209 	nodev,		/* segmap */
6210 	nochpoll,	/* poll */
6211 	ddi_prop_op,	/* prop_op */
6212 	NULL,		/* streamtab */
6213 	D_NEW | D_MP | D_64BIT,		/* Driver compatibility flag */
6214 	CB_REV,		/* version */
6215 	nodev,		/* async read */
6216 	nodev,		/* async write */
6217 };
6218 
6219 static struct dev_ops zfs_dev_ops = {
6220 	DEVO_REV,	/* version */
6221 	0,		/* refcnt */
6222 	zfs_info,	/* info */
6223 	nulldev,	/* identify */
6224 	nulldev,	/* probe */
6225 	zfs_attach,	/* attach */
6226 	zfs_detach,	/* detach */
6227 	nodev,		/* reset */
6228 	&zfs_cb_ops,	/* driver operations */
6229 	NULL,		/* no bus operations */
6230 	NULL,		/* power */
6231 	ddi_quiesce_not_needed,	/* quiesce */
6232 };
6233 
6234 static struct modldrv zfs_modldrv = {
6235 	&mod_driverops,
6236 	"ZFS storage pool",
6237 	&zfs_dev_ops
6238 };
6239 
6240 static struct modlinkage modlinkage = {
6241 	MODREV_1,
6242 	(void *)&zfs_modlfs,
6243 	(void *)&zfs_modldrv,
6244 	NULL
6245 };
6246 
6247 static void
6248 zfs_allow_log_destroy(void *arg)
6249 {
6250 	char *poolname = arg;
6251 	strfree(poolname);
6252 }
6253 
6254 int
6255 _init(void)
6256 {
6257 	int error;
6258 
6259 	spa_init(FREAD | FWRITE);
6260 	zfs_init();
6261 	zvol_init();
6262 	zfs_ioctl_init();
6263 
6264 	if ((error = mod_install(&modlinkage)) != 0) {
6265 		zvol_fini();
6266 		zfs_fini();
6267 		spa_fini();
6268 		return (error);
6269 	}
6270 
6271 	tsd_create(&zfs_fsyncer_key, NULL);
6272 	tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
6273 	tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
6274 
6275 	error = ldi_ident_from_mod(&modlinkage, &zfs_li);
6276 	ASSERT(error == 0);
6277 	mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
6278 
6279 	return (0);
6280 }
6281 
6282 int
6283 _fini(void)
6284 {
6285 	int error;
6286 
6287 	if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
6288 		return (SET_ERROR(EBUSY));
6289 
6290 	if ((error = mod_remove(&modlinkage)) != 0)
6291 		return (error);
6292 
6293 	zvol_fini();
6294 	zfs_fini();
6295 	spa_fini();
6296 	if (zfs_nfsshare_inited)
6297 		(void) ddi_modclose(nfs_mod);
6298 	if (zfs_smbshare_inited)
6299 		(void) ddi_modclose(smbsrv_mod);
6300 	if (zfs_nfsshare_inited || zfs_smbshare_inited)
6301 		(void) ddi_modclose(sharefs_mod);
6302 
6303 	tsd_destroy(&zfs_fsyncer_key);
6304 	ldi_ident_release(zfs_li);
6305 	zfs_li = NULL;
6306 	mutex_destroy(&zfs_share_lock);
6307 
6308 	return (error);
6309 }
6310 
6311 int
6312 _info(struct modinfo *modinfop)
6313 {
6314 	return (mod_info(&modlinkage, modinfop));
6315 }
6316