1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Portions Copyright 2011 Martin Matuska
  25  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  26  * Copyright (c) 2012 by Delphix. All rights reserved.
  27  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  28  */
  29 
  30 /*
  31  * ZFS ioctls.
  32  *
  33  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
  34  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
  35  *
  36  * There are two ways that we handle ioctls: the legacy way where almost
  37  * all of the logic is in the ioctl callback, and the new way where most
  38  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
  39  *
  40  * Non-legacy ioctls should be registered by calling
  41  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
  42  * from userland by lzc_ioctl().
  43  *
  44  * The registration arguments are as follows:
  45  *
  46  * const char *name
  47  *   The name of the ioctl.  This is used for history logging.  If the
  48  *   ioctl returns successfully (the callback returns 0), and allow_log
  49  *   is true, then a history log entry will be recorded with the input &
  50  *   output nvlists.  The log entry can be printed with "zpool history -i".
  51  *
  52  * zfs_ioc_t ioc
  53  *   The ioctl request number, which userland will pass to ioctl(2).
  54  *   The ioctl numbers can change from release to release, because
  55  *   the caller (libzfs) must be matched to the kernel.
  56  *
  57  * zfs_secpolicy_func_t *secpolicy
  58  *   This function will be called before the zfs_ioc_func_t, to
  59  *   determine if this operation is permitted.  It should return EPERM
  60  *   on failure, and 0 on success.  Checks include determining if the
  61  *   dataset is visible in this zone, and if the user has either all
  62  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
  63  *   to do this operation on this dataset with "zfs allow".
  64  *
  65  * zfs_ioc_namecheck_t namecheck
  66  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
  67  *   name, a dataset name, or nothing.  If the name is not well-formed,
  68  *   the ioctl will fail and the callback will not be called.
  69  *   Therefore, the callback can assume that the name is well-formed
  70  *   (e.g. is null-terminated, doesn't have more than one '@' character,
  71  *   doesn't have invalid characters).
  72  *
  73  * zfs_ioc_poolcheck_t pool_check
  74  *   This specifies requirements on the pool state.  If the pool does
  75  *   not meet them (is suspended or is readonly), the ioctl will fail
  76  *   and the callback will not be called.  If any checks are specified
  77  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
  78  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
  79  *   POOL_CHECK_READONLY).
  80  *
  81  * boolean_t smush_outnvlist
  82  *   If smush_outnvlist is true, then the output is presumed to be a
  83  *   list of errors, and it will be "smushed" down to fit into the
  84  *   caller's buffer, by removing some entries and replacing them with a
  85  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
  86  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
  87  *   outnvlist does not fit into the userland-provided buffer, then the
  88  *   ioctl will fail with ENOMEM.
  89  *
  90  * zfs_ioc_func_t *func
  91  *   The callback function that will perform the operation.
  92  *
  93  *   The callback should return 0 on success, or an error number on
  94  *   failure.  If the function fails, the userland ioctl will return -1,
  95  *   and errno will be set to the callback's return value.  The callback
  96  *   will be called with the following arguments:
  97  *
  98  *   const char *name
  99  *     The name of the pool or dataset to operate on, from
 100  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
 101  *     expected type (pool, dataset, or none).
 102  *
 103  *   nvlist_t *innvl
 104  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
 105  *     NULL if no input nvlist was provided.  Changes to this nvlist are
 106  *     ignored.  If the input nvlist could not be deserialized, the
 107  *     ioctl will fail and the callback will not be called.
 108  *
 109  *   nvlist_t *outnvl
 110  *     The output nvlist, initially empty.  The callback can fill it in,
 111  *     and it will be returned to userland by serializing it into
 112  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
 113  *     fails (e.g. because the caller didn't supply a large enough
 114  *     buffer), then the overall ioctl will fail.  See the
 115  *     'smush_nvlist' argument above for additional behaviors.
 116  *
 117  *     There are two typical uses of the output nvlist:
 118  *       - To return state, e.g. property values.  In this case,
 119  *         smush_outnvlist should be false.  If the buffer was not large
 120  *         enough, the caller will reallocate a larger buffer and try
 121  *         the ioctl again.
 122  *
 123  *       - To return multiple errors from an ioctl which makes on-disk
 124  *         changes.  In this case, smush_outnvlist should be true.
 125  *         Ioctls which make on-disk modifications should generally not
 126  *         use the outnvl if they succeed, because the caller can not
 127  *         distinguish between the operation failing, and
 128  *         deserialization failing.
 129  */
 130 
 131 #include <sys/types.h>
 132 #include <sys/param.h>
 133 #include <sys/errno.h>
 134 #include <sys/uio.h>
 135 #include <sys/buf.h>
 136 #include <sys/modctl.h>
 137 #include <sys/open.h>
 138 #include <sys/file.h>
 139 #include <sys/kmem.h>
 140 #include <sys/conf.h>
 141 #include <sys/cmn_err.h>
 142 #include <sys/stat.h>
 143 #include <sys/zfs_ioctl.h>
 144 #include <sys/zfs_vfsops.h>
 145 #include <sys/zfs_znode.h>
 146 #include <sys/zap.h>
 147 #include <sys/spa.h>
 148 #include <sys/spa_impl.h>
 149 #include <sys/vdev.h>
 150 #include <sys/priv_impl.h>
 151 #include <sys/dmu.h>
 152 #include <sys/dsl_dir.h>
 153 #include <sys/dsl_dataset.h>
 154 #include <sys/dsl_prop.h>
 155 #include <sys/dsl_deleg.h>
 156 #include <sys/dmu_objset.h>
 157 #include <sys/dmu_impl.h>
 158 #include <sys/ddi.h>
 159 #include <sys/sunddi.h>
 160 #include <sys/sunldi.h>
 161 #include <sys/policy.h>
 162 #include <sys/zone.h>
 163 #include <sys/nvpair.h>
 164 #include <sys/pathname.h>
 165 #include <sys/mount.h>
 166 #include <sys/sdt.h>
 167 #include <sys/fs/zfs.h>
 168 #include <sys/zfs_ctldir.h>
 169 #include <sys/zfs_dir.h>
 170 #include <sys/zfs_onexit.h>
 171 #include <sys/zvol.h>
 172 #include <sys/dsl_scan.h>
 173 #include <sharefs/share.h>
 174 #include <sys/dmu_objset.h>
 175 
 176 #include "zfs_namecheck.h"
 177 #include "zfs_prop.h"
 178 #include "zfs_deleg.h"
 179 #include "zfs_comutil.h"
 180 
 181 extern struct modlfs zfs_modlfs;
 182 
 183 extern void zfs_init(void);
 184 extern void zfs_fini(void);
 185 
 186 ldi_ident_t zfs_li = NULL;
 187 dev_info_t *zfs_dip;
 188 
 189 uint_t zfs_fsyncer_key;
 190 extern uint_t rrw_tsd_key;
 191 static uint_t zfs_allow_log_key;
 192 
 193 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
 194 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
 195 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
 196 
 197 typedef enum {
 198         NO_NAME,
 199         POOL_NAME,
 200         DATASET_NAME
 201 } zfs_ioc_namecheck_t;
 202 
 203 typedef enum {
 204         POOL_CHECK_NONE         = 1 << 0,
 205         POOL_CHECK_SUSPENDED    = 1 << 1,
 206         POOL_CHECK_READONLY     = 1 << 2,
 207 } zfs_ioc_poolcheck_t;
 208 
 209 typedef struct zfs_ioc_vec {
 210         zfs_ioc_legacy_func_t   *zvec_legacy_func;
 211         zfs_ioc_func_t          *zvec_func;
 212         zfs_secpolicy_func_t    *zvec_secpolicy;
 213         zfs_ioc_namecheck_t     zvec_namecheck;
 214         boolean_t               zvec_allow_log;
 215         zfs_ioc_poolcheck_t     zvec_pool_check;
 216         boolean_t               zvec_smush_outnvlist;
 217         const char              *zvec_name;
 218 } zfs_ioc_vec_t;
 219 
 220 /* This array is indexed by zfs_userquota_prop_t */
 221 static const char *userquota_perms[] = {
 222         ZFS_DELEG_PERM_USERUSED,
 223         ZFS_DELEG_PERM_USERQUOTA,
 224         ZFS_DELEG_PERM_GROUPUSED,
 225         ZFS_DELEG_PERM_GROUPQUOTA,
 226 };
 227 
 228 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
 229 static int zfs_check_settable(const char *name, nvpair_t *property,
 230     cred_t *cr);
 231 static int zfs_check_clearable(char *dataset, nvlist_t *props,
 232     nvlist_t **errors);
 233 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
 234     boolean_t *);
 235 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
 236 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
 237 
 238 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
 239 void
 240 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
 241 {
 242         const char *newfile;
 243         char buf[512];
 244         va_list adx;
 245 
 246         /*
 247          * Get rid of annoying "../common/" prefix to filename.
 248          */
 249         newfile = strrchr(file, '/');
 250         if (newfile != NULL) {
 251                 newfile = newfile + 1; /* Get rid of leading / */
 252         } else {
 253                 newfile = file;
 254         }
 255 
 256         va_start(adx, fmt);
 257         (void) vsnprintf(buf, sizeof (buf), fmt, adx);
 258         va_end(adx);
 259 
 260         /*
 261          * To get this data, use the zfs-dprintf probe as so:
 262          * dtrace -q -n 'zfs-dprintf \
 263          *      /stringof(arg0) == "dbuf.c"/ \
 264          *      {printf("%s: %s", stringof(arg1), stringof(arg3))}'
 265          * arg0 = file name
 266          * arg1 = function name
 267          * arg2 = line number
 268          * arg3 = message
 269          */
 270         DTRACE_PROBE4(zfs__dprintf,
 271             char *, newfile, char *, func, int, line, char *, buf);
 272 }
 273 
 274 static void
 275 history_str_free(char *buf)
 276 {
 277         kmem_free(buf, HIS_MAX_RECORD_LEN);
 278 }
 279 
 280 static char *
 281 history_str_get(zfs_cmd_t *zc)
 282 {
 283         char *buf;
 284 
 285         if (zc->zc_history == NULL)
 286                 return (NULL);
 287 
 288         buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
 289         if (copyinstr((void *)(uintptr_t)zc->zc_history,
 290             buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
 291                 history_str_free(buf);
 292                 return (NULL);
 293         }
 294 
 295         buf[HIS_MAX_RECORD_LEN -1] = '\0';
 296 
 297         return (buf);
 298 }
 299 
 300 /*
 301  * Check to see if the named dataset is currently defined as bootable
 302  */
 303 static boolean_t
 304 zfs_is_bootfs(const char *name)
 305 {
 306         objset_t *os;
 307 
 308         if (dmu_objset_hold(name, FTAG, &os) == 0) {
 309                 boolean_t ret;
 310                 ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
 311                 dmu_objset_rele(os, FTAG);
 312                 return (ret);
 313         }
 314         return (B_FALSE);
 315 }
 316 
 317 /*
 318  * zfs_earlier_version
 319  *
 320  *      Return non-zero if the spa version is less than requested version.
 321  */
 322 static int
 323 zfs_earlier_version(const char *name, int version)
 324 {
 325         spa_t *spa;
 326 
 327         if (spa_open(name, &spa, FTAG) == 0) {
 328                 if (spa_version(spa) < version) {
 329                         spa_close(spa, FTAG);
 330                         return (1);
 331                 }
 332                 spa_close(spa, FTAG);
 333         }
 334         return (0);
 335 }
 336 
 337 /*
 338  * zpl_earlier_version
 339  *
 340  * Return TRUE if the ZPL version is less than requested version.
 341  */
 342 static boolean_t
 343 zpl_earlier_version(const char *name, int version)
 344 {
 345         objset_t *os;
 346         boolean_t rc = B_TRUE;
 347 
 348         if (dmu_objset_hold(name, FTAG, &os) == 0) {
 349                 uint64_t zplversion;
 350 
 351                 if (dmu_objset_type(os) != DMU_OST_ZFS) {
 352                         dmu_objset_rele(os, FTAG);
 353                         return (B_TRUE);
 354                 }
 355                 /* XXX reading from non-owned objset */
 356                 if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
 357                         rc = zplversion < version;
 358                 dmu_objset_rele(os, FTAG);
 359         }
 360         return (rc);
 361 }
 362 
 363 static void
 364 zfs_log_history(zfs_cmd_t *zc)
 365 {
 366         spa_t *spa;
 367         char *buf;
 368 
 369         if ((buf = history_str_get(zc)) == NULL)
 370                 return;
 371 
 372         if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
 373                 if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
 374                         (void) spa_history_log(spa, buf);
 375                 spa_close(spa, FTAG);
 376         }
 377         history_str_free(buf);
 378 }
 379 
 380 /*
 381  * Policy for top-level read operations (list pools).  Requires no privileges,
 382  * and can be used in the local zone, as there is no associated dataset.
 383  */
 384 /* ARGSUSED */
 385 static int
 386 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 387 {
 388         return (0);
 389 }
 390 
 391 /*
 392  * Policy for dataset read operations (list children, get statistics).  Requires
 393  * no privileges, but must be visible in the local zone.
 394  */
 395 /* ARGSUSED */
 396 static int
 397 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 398 {
 399         if (INGLOBALZONE(curproc) ||
 400             zone_dataset_visible(zc->zc_name, NULL))
 401                 return (0);
 402 
 403         return (ENOENT);
 404 }
 405 
 406 static int
 407 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
 408 {
 409         int writable = 1;
 410 
 411         /*
 412          * The dataset must be visible by this zone -- check this first
 413          * so they don't see EPERM on something they shouldn't know about.
 414          */
 415         if (!INGLOBALZONE(curproc) &&
 416             !zone_dataset_visible(dataset, &writable))
 417                 return (ENOENT);
 418 
 419         if (INGLOBALZONE(curproc)) {
 420                 /*
 421                  * If the fs is zoned, only root can access it from the
 422                  * global zone.
 423                  */
 424                 if (secpolicy_zfs(cr) && zoned)
 425                         return (EPERM);
 426         } else {
 427                 /*
 428                  * If we are in a local zone, the 'zoned' property must be set.
 429                  */
 430                 if (!zoned)
 431                         return (EPERM);
 432 
 433                 /* must be writable by this zone */
 434                 if (!writable)
 435                         return (EPERM);
 436         }
 437         return (0);
 438 }
 439 
 440 static int
 441 zfs_dozonecheck(const char *dataset, cred_t *cr)
 442 {
 443         uint64_t zoned;
 444 
 445         if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
 446                 return (ENOENT);
 447 
 448         return (zfs_dozonecheck_impl(dataset, zoned, cr));
 449 }
 450 
 451 static int
 452 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
 453 {
 454         uint64_t zoned;
 455 
 456         rw_enter(&ds->ds_dir->dd_pool->dp_config_rwlock, RW_READER);
 457         if (dsl_prop_get_ds(ds, "zoned", 8, 1, &zoned, NULL)) {
 458                 rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);
 459                 return (ENOENT);
 460         }
 461         rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);
 462 
 463         return (zfs_dozonecheck_impl(dataset, zoned, cr));
 464 }
 465 
 466 static int
 467 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
 468 {
 469         int error;
 470         dsl_dataset_t *ds;
 471 
 472         error = dsl_dataset_hold(name, FTAG, &ds);
 473         if (error != 0)
 474                 return (error);
 475 
 476         error = zfs_dozonecheck_ds(name, ds, cr);
 477         if (error == 0) {
 478                 error = secpolicy_zfs(cr);
 479                 if (error)
 480                         error = dsl_deleg_access_impl(ds, perm, cr);
 481         }
 482 
 483         dsl_dataset_rele(ds, FTAG);
 484         return (error);
 485 }
 486 
 487 static int
 488 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
 489     const char *perm, cred_t *cr)
 490 {
 491         int error;
 492 
 493         error = zfs_dozonecheck_ds(name, ds, cr);
 494         if (error == 0) {
 495                 error = secpolicy_zfs(cr);
 496                 if (error)
 497                         error = dsl_deleg_access_impl(ds, perm, cr);
 498         }
 499         return (error);
 500 }
 501 
 502 /*
 503  * Policy for setting the security label property.
 504  *
 505  * Returns 0 for success, non-zero for access and other errors.
 506  */
 507 static int
 508 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
 509 {
 510         char            ds_hexsl[MAXNAMELEN];
 511         bslabel_t       ds_sl, new_sl;
 512         boolean_t       new_default = FALSE;
 513         uint64_t        zoned;
 514         int             needed_priv = -1;
 515         int             error;
 516 
 517         /* First get the existing dataset label. */
 518         error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
 519             1, sizeof (ds_hexsl), &ds_hexsl, NULL);
 520         if (error)
 521                 return (EPERM);
 522 
 523         if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
 524                 new_default = TRUE;
 525 
 526         /* The label must be translatable */
 527         if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
 528                 return (EINVAL);
 529 
 530         /*
 531          * In a non-global zone, disallow attempts to set a label that
 532          * doesn't match that of the zone; otherwise no other checks
 533          * are needed.
 534          */
 535         if (!INGLOBALZONE(curproc)) {
 536                 if (new_default || !blequal(&new_sl, CR_SL(CRED())))
 537                         return (EPERM);
 538                 return (0);
 539         }
 540 
 541         /*
 542          * For global-zone datasets (i.e., those whose zoned property is
 543          * "off", verify that the specified new label is valid for the
 544          * global zone.
 545          */
 546         if (dsl_prop_get_integer(name,
 547             zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
 548                 return (EPERM);
 549         if (!zoned) {
 550                 if (zfs_check_global_label(name, strval) != 0)
 551                         return (EPERM);
 552         }
 553 
 554         /*
 555          * If the existing dataset label is nondefault, check if the
 556          * dataset is mounted (label cannot be changed while mounted).
 557          * Get the zfsvfs; if there isn't one, then the dataset isn't
 558          * mounted (or isn't a dataset, doesn't exist, ...).
 559          */
 560         if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
 561                 objset_t *os;
 562                 static char *setsl_tag = "setsl_tag";
 563 
 564                 /*
 565                  * Try to own the dataset; abort if there is any error,
 566                  * (e.g., already mounted, in use, or other error).
 567                  */
 568                 error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
 569                     setsl_tag, &os);
 570                 if (error)
 571                         return (EPERM);
 572 
 573                 dmu_objset_disown(os, setsl_tag);
 574 
 575                 if (new_default) {
 576                         needed_priv = PRIV_FILE_DOWNGRADE_SL;
 577                         goto out_check;
 578                 }
 579 
 580                 if (hexstr_to_label(strval, &new_sl) != 0)
 581                         return (EPERM);
 582 
 583                 if (blstrictdom(&ds_sl, &new_sl))
 584                         needed_priv = PRIV_FILE_DOWNGRADE_SL;
 585                 else if (blstrictdom(&new_sl, &ds_sl))
 586                         needed_priv = PRIV_FILE_UPGRADE_SL;
 587         } else {
 588                 /* dataset currently has a default label */
 589                 if (!new_default)
 590                         needed_priv = PRIV_FILE_UPGRADE_SL;
 591         }
 592 
 593 out_check:
 594         if (needed_priv != -1)
 595                 return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
 596         return (0);
 597 }
 598 
 599 static int
 600 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
 601     cred_t *cr)
 602 {
 603         char *strval;
 604 
 605         /*
 606          * Check permissions for special properties.
 607          */
 608         switch (prop) {
 609         case ZFS_PROP_DEDUP:
 610         case ZFS_PROP_COMPRESSION:
 611         case ZFS_PROP_ZONED:
 612                 /*
 613                  * Disallow setting these properties from within a local zone.
 614                  */
 615                 if (!INGLOBALZONE(curproc))
 616                         return (EPERM);
 617                 break;
 618 
 619         case ZFS_PROP_QUOTA:
 620         case ZFS_PROP_FILESYSTEM_LIMIT:
 621         case ZFS_PROP_SNAPSHOT_LIMIT:
 622                 if (!INGLOBALZONE(curproc)) {
 623                         uint64_t zoned;
 624                         char setpoint[MAXNAMELEN];
 625                         /*
 626                          * Unprivileged users are allowed to modify the
 627                          * limit on things *under* (ie. contained by)
 628                          * the thing they own.
 629                          */
 630                         if (dsl_prop_get_integer(dsname, "zoned", &zoned,
 631                             setpoint))
 632                                 return (EPERM);
 633                         if (!zoned || strlen(dsname) <= strlen(setpoint))
 634                                 return (EPERM);
 635                 }
 636                 break;
 637 
 638         case ZFS_PROP_MLSLABEL:
 639                 if (!is_system_labeled())
 640                         return (EPERM);
 641 
 642                 if (nvpair_value_string(propval, &strval) == 0) {
 643                         int err;
 644 
 645                         err = zfs_set_slabel_policy(dsname, strval, CRED());
 646                         if (err != 0)
 647                                 return (err);
 648                 }
 649                 break;
 650         }
 651 
 652         return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
 653 }
 654 
 655 /* ARGSUSED */
 656 static int
 657 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 658 {
 659         int error;
 660 
 661         error = zfs_dozonecheck(zc->zc_name, cr);
 662         if (error)
 663                 return (error);
 664 
 665         /*
 666          * permission to set permissions will be evaluated later in
 667          * dsl_deleg_can_allow()
 668          */
 669         return (0);
 670 }
 671 
 672 /* ARGSUSED */
 673 static int
 674 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 675 {
 676         return (zfs_secpolicy_write_perms(zc->zc_name,
 677             ZFS_DELEG_PERM_ROLLBACK, cr));
 678 }
 679 
 680 /* ARGSUSED */
 681 static int
 682 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 683 {
 684         spa_t *spa;
 685         dsl_pool_t *dp;
 686         dsl_dataset_t *ds;
 687         char *cp;
 688         int error;
 689 
 690         /*
 691          * Generate the current snapshot name from the given objsetid, then
 692          * use that name for the secpolicy/zone checks.
 693          */
 694         cp = strchr(zc->zc_name, '@');
 695         if (cp == NULL)
 696                 return (EINVAL);
 697         error = spa_open(zc->zc_name, &spa, FTAG);
 698         if (error)
 699                 return (error);
 700 
 701         dp = spa_get_dsl(spa);
 702         rw_enter(&dp->dp_config_rwlock, RW_READER);
 703         error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
 704         rw_exit(&dp->dp_config_rwlock);
 705         spa_close(spa, FTAG);
 706         if (error)
 707                 return (error);
 708 
 709         dsl_dataset_name(ds, zc->zc_name);
 710 
 711         error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
 712             ZFS_DELEG_PERM_SEND, cr);
 713         dsl_dataset_rele(ds, FTAG);
 714 
 715         return (error);
 716 }
 717 
 718 /* ARGSUSED */
 719 static int
 720 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 721 {
 722         return (zfs_secpolicy_write_perms(zc->zc_name,
 723             ZFS_DELEG_PERM_SEND, cr));
 724 }
 725 
 726 /* ARGSUSED */
 727 static int
 728 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 729 {
 730         vnode_t *vp;
 731         int error;
 732 
 733         if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
 734             NO_FOLLOW, NULL, &vp)) != 0)
 735                 return (error);
 736 
 737         /* Now make sure mntpnt and dataset are ZFS */
 738 
 739         if (vp->v_vfsp->vfs_fstype != zfsfstype ||
 740             (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
 741             zc->zc_name) != 0)) {
 742                 VN_RELE(vp);
 743                 return (EPERM);
 744         }
 745 
 746         VN_RELE(vp);
 747         return (dsl_deleg_access(zc->zc_name,
 748             ZFS_DELEG_PERM_SHARE, cr));
 749 }
 750 
 751 int
 752 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 753 {
 754         if (!INGLOBALZONE(curproc))
 755                 return (EPERM);
 756 
 757         if (secpolicy_nfs(cr) == 0) {
 758                 return (0);
 759         } else {
 760                 return (zfs_secpolicy_deleg_share(zc, innvl, cr));
 761         }
 762 }
 763 
 764 int
 765 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 766 {
 767         if (!INGLOBALZONE(curproc))
 768                 return (EPERM);
 769 
 770         if (secpolicy_smb(cr) == 0) {
 771                 return (0);
 772         } else {
 773                 return (zfs_secpolicy_deleg_share(zc, innvl, cr));
 774         }
 775 }
 776 
 777 static int
 778 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
 779 {
 780         char *cp;
 781 
 782         /*
 783          * Remove the @bla or /bla from the end of the name to get the parent.
 784          */
 785         (void) strncpy(parent, datasetname, parentsize);
 786         cp = strrchr(parent, '@');
 787         if (cp != NULL) {
 788                 cp[0] = '\0';
 789         } else {
 790                 cp = strrchr(parent, '/');
 791                 if (cp == NULL)
 792                         return (ENOENT);
 793                 cp[0] = '\0';
 794         }
 795 
 796         return (0);
 797 }
 798 
 799 int
 800 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
 801 {
 802         int error;
 803 
 804         if ((error = zfs_secpolicy_write_perms(name,
 805             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 806                 return (error);
 807 
 808         return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
 809 }
 810 
 811 /* ARGSUSED */
 812 static int
 813 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 814 {
 815         return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
 816 }
 817 
 818 /*
 819  * Destroying snapshots with delegated permissions requires
 820  * descendant mount and destroy permissions.
 821  */
 822 /* ARGSUSED */
 823 static int
 824 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 825 {
 826         nvlist_t *snaps;
 827         nvpair_t *pair, *nextpair;
 828         int error = 0;
 829 
 830         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
 831                 return (EINVAL);
 832         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
 833             pair = nextpair) {
 834                 dsl_dataset_t *ds;
 835 
 836                 nextpair = nvlist_next_nvpair(snaps, pair);
 837                 error = dsl_dataset_hold(nvpair_name(pair), FTAG, &ds);
 838                 if (error == 0) {
 839                         dsl_dataset_rele(ds, FTAG);
 840                 } else if (error == ENOENT) {
 841                         /*
 842                          * Ignore any snapshots that don't exist (we consider
 843                          * them "already destroyed").  Remove the name from the
 844                          * nvl here in case the snapshot is created between
 845                          * now and when we try to destroy it (in which case
 846                          * we don't want to destroy it since we haven't
 847                          * checked for permission).
 848                          */
 849                         fnvlist_remove_nvpair(snaps, pair);
 850                         error = 0;
 851                         continue;
 852                 } else {
 853                         break;
 854                 }
 855                 error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
 856                 if (error != 0)
 857                         break;
 858         }
 859 
 860         return (error);
 861 }
 862 
 863 int
 864 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
 865 {
 866         char    parentname[MAXNAMELEN];
 867         int     error;
 868 
 869         if ((error = zfs_secpolicy_write_perms(from,
 870             ZFS_DELEG_PERM_RENAME, cr)) != 0)
 871                 return (error);
 872 
 873         if ((error = zfs_secpolicy_write_perms(from,
 874             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 875                 return (error);
 876 
 877         if ((error = zfs_get_parent(to, parentname,
 878             sizeof (parentname))) != 0)
 879                 return (error);
 880 
 881         if ((error = zfs_secpolicy_write_perms(parentname,
 882             ZFS_DELEG_PERM_CREATE, cr)) != 0)
 883                 return (error);
 884 
 885         if ((error = zfs_secpolicy_write_perms(parentname,
 886             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 887                 return (error);
 888 
 889         return (error);
 890 }
 891 
 892 /* ARGSUSED */
 893 static int
 894 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 895 {
 896         return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
 897 }
 898 
 899 /* ARGSUSED */
 900 static int
 901 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 902 {
 903         char    parentname[MAXNAMELEN];
 904         objset_t *clone;
 905         int error;
 906 
 907         error = zfs_secpolicy_write_perms(zc->zc_name,
 908             ZFS_DELEG_PERM_PROMOTE, cr);
 909         if (error)
 910                 return (error);
 911 
 912         error = dmu_objset_hold(zc->zc_name, FTAG, &clone);
 913 
 914         if (error == 0) {
 915                 dsl_dataset_t *pclone = NULL;
 916                 dsl_dir_t *dd;
 917                 dd = clone->os_dsl_dataset->ds_dir;
 918 
 919                 rw_enter(&dd->dd_pool->dp_config_rwlock, RW_READER);
 920                 error = dsl_dataset_hold_obj(dd->dd_pool,
 921                     dd->dd_phys->dd_origin_obj, FTAG, &pclone);
 922                 rw_exit(&dd->dd_pool->dp_config_rwlock);
 923                 if (error) {
 924                         dmu_objset_rele(clone, FTAG);
 925                         return (error);
 926                 }
 927 
 928                 error = zfs_secpolicy_write_perms(zc->zc_name,
 929                     ZFS_DELEG_PERM_MOUNT, cr);
 930 
 931                 dsl_dataset_name(pclone, parentname);
 932                 dmu_objset_rele(clone, FTAG);
 933                 dsl_dataset_rele(pclone, FTAG);
 934                 if (error == 0)
 935                         error = zfs_secpolicy_write_perms(parentname,
 936                             ZFS_DELEG_PERM_PROMOTE, cr);
 937         }
 938         return (error);
 939 }
 940 
 941 /* ARGSUSED */
 942 static int
 943 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 944 {
 945         int error;
 946 
 947         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
 948             ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
 949                 return (error);
 950 
 951         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
 952             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 953                 return (error);
 954 
 955         return (zfs_secpolicy_write_perms(zc->zc_name,
 956             ZFS_DELEG_PERM_CREATE, cr));
 957 }
 958 
 959 int
 960 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
 961 {
 962         return (zfs_secpolicy_write_perms(name,
 963             ZFS_DELEG_PERM_SNAPSHOT, cr));
 964 }
 965 
 966 /*
 967  * Check for permission to create each snapshot in the nvlist.
 968  */
 969 /* ARGSUSED */
 970 static int
 971 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 972 {
 973         nvlist_t *snaps;
 974         int error;
 975         nvpair_t *pair;
 976 
 977         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
 978                 return (EINVAL);
 979         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
 980             pair = nvlist_next_nvpair(snaps, pair)) {
 981                 char *name = nvpair_name(pair);
 982                 char *atp = strchr(name, '@');
 983 
 984                 if (atp == NULL) {
 985                         error = EINVAL;
 986                         break;
 987                 }
 988                 *atp = '\0';
 989                 error = zfs_secpolicy_snapshot_perms(name, cr);
 990                 *atp = '@';
 991                 if (error != 0)
 992                         break;
 993         }
 994         return (error);
 995 }
 996 
 997 /* ARGSUSED */
 998 static int
 999 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1000 {
1001         /*
1002          * Even root must have a proper TSD so that we know what pool
1003          * to log to.
1004          */
1005         if (tsd_get(zfs_allow_log_key) == NULL)
1006                 return (EPERM);
1007         return (0);
1008 }
1009 
1010 static int
1011 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1012 {
1013         char    parentname[MAXNAMELEN];
1014         int     error;
1015         char    *origin;
1016 
1017         if ((error = zfs_get_parent(zc->zc_name, parentname,
1018             sizeof (parentname))) != 0)
1019                 return (error);
1020 
1021         if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1022             (error = zfs_secpolicy_write_perms(origin,
1023             ZFS_DELEG_PERM_CLONE, cr)) != 0)
1024                 return (error);
1025 
1026         if ((error = zfs_secpolicy_write_perms(parentname,
1027             ZFS_DELEG_PERM_CREATE, cr)) != 0)
1028                 return (error);
1029 
1030         return (zfs_secpolicy_write_perms(parentname,
1031             ZFS_DELEG_PERM_MOUNT, cr));
1032 }
1033 
1034 /*
1035  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1036  * SYS_CONFIG privilege, which is not available in a local zone.
1037  */
1038 /* ARGSUSED */
1039 static int
1040 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1041 {
1042         if (secpolicy_sys_config(cr, B_FALSE) != 0)
1043                 return (EPERM);
1044 
1045         return (0);
1046 }
1047 
1048 /*
1049  * Policy for object to name lookups.
1050  */
1051 /* ARGSUSED */
1052 static int
1053 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1054 {
1055         int error;
1056 
1057         if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1058                 return (0);
1059 
1060         error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1061         return (error);
1062 }
1063 
1064 /*
1065  * Policy for fault injection.  Requires all privileges.
1066  */
1067 /* ARGSUSED */
1068 static int
1069 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1070 {
1071         return (secpolicy_zinject(cr));
1072 }
1073 
1074 /* ARGSUSED */
1075 static int
1076 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1077 {
1078         zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1079 
1080         if (prop == ZPROP_INVAL) {
1081                 if (!zfs_prop_user(zc->zc_value))
1082                         return (EINVAL);
1083                 return (zfs_secpolicy_write_perms(zc->zc_name,
1084                     ZFS_DELEG_PERM_USERPROP, cr));
1085         } else {
1086                 return (zfs_secpolicy_setprop(zc->zc_name, prop,
1087                     NULL, cr));
1088         }
1089 }
1090 
1091 static int
1092 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1093 {
1094         int err = zfs_secpolicy_read(zc, innvl, cr);
1095         if (err)
1096                 return (err);
1097 
1098         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1099                 return (EINVAL);
1100 
1101         if (zc->zc_value[0] == 0) {
1102                 /*
1103                  * They are asking about a posix uid/gid.  If it's
1104                  * themself, allow it.
1105                  */
1106                 if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1107                     zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1108                         if (zc->zc_guid == crgetuid(cr))
1109                                 return (0);
1110                 } else {
1111                         if (groupmember(zc->zc_guid, cr))
1112                                 return (0);
1113                 }
1114         }
1115 
1116         return (zfs_secpolicy_write_perms(zc->zc_name,
1117             userquota_perms[zc->zc_objset_type], cr));
1118 }
1119 
1120 static int
1121 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1122 {
1123         int err = zfs_secpolicy_read(zc, innvl, cr);
1124         if (err)
1125                 return (err);
1126 
1127         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1128                 return (EINVAL);
1129 
1130         return (zfs_secpolicy_write_perms(zc->zc_name,
1131             userquota_perms[zc->zc_objset_type], cr));
1132 }
1133 
1134 /* ARGSUSED */
1135 static int
1136 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1137 {
1138         return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1139             NULL, cr));
1140 }
1141 
1142 /* ARGSUSED */
1143 static int
1144 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1145 {
1146         return (zfs_secpolicy_write_perms(zc->zc_name,
1147             ZFS_DELEG_PERM_HOLD, cr));
1148 }
1149 
1150 /* ARGSUSED */
1151 static int
1152 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1153 {
1154         return (zfs_secpolicy_write_perms(zc->zc_name,
1155             ZFS_DELEG_PERM_RELEASE, cr));
1156 }
1157 
1158 /*
1159  * Policy for allowing temporary snapshots to be taken or released
1160  */
1161 static int
1162 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1163 {
1164         /*
1165          * A temporary snapshot is the same as a snapshot,
1166          * hold, destroy and release all rolled into one.
1167          * Delegated diff alone is sufficient that we allow this.
1168          */
1169         int error;
1170 
1171         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1172             ZFS_DELEG_PERM_DIFF, cr)) == 0)
1173                 return (0);
1174 
1175         error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1176         if (!error)
1177                 error = zfs_secpolicy_hold(zc, innvl, cr);
1178         if (!error)
1179                 error = zfs_secpolicy_release(zc, innvl, cr);
1180         if (!error)
1181                 error = zfs_secpolicy_destroy(zc, innvl, cr);
1182         return (error);
1183 }
1184 
1185 /*
1186  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1187  */
1188 static int
1189 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1190 {
1191         char *packed;
1192         int error;
1193         nvlist_t *list = NULL;
1194 
1195         /*
1196          * Read in and unpack the user-supplied nvlist.
1197          */
1198         if (size == 0)
1199                 return (EINVAL);
1200 
1201         packed = kmem_alloc(size, KM_SLEEP);
1202 
1203         if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1204             iflag)) != 0) {
1205                 kmem_free(packed, size);
1206                 return (error);
1207         }
1208 
1209         if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1210                 kmem_free(packed, size);
1211                 return (error);
1212         }
1213 
1214         kmem_free(packed, size);
1215 
1216         *nvp = list;
1217         return (0);
1218 }
1219 
1220 /*
1221  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1222  * Entries will be removed from the end of the nvlist, and one int32 entry
1223  * named "N_MORE_ERRORS" will be added indicating how many entries were
1224  * removed.
1225  */
1226 static int
1227 nvlist_smush(nvlist_t *errors, size_t max)
1228 {
1229         size_t size;
1230 
1231         size = fnvlist_size(errors);
1232 
1233         if (size > max) {
1234                 nvpair_t *more_errors;
1235                 int n = 0;
1236 
1237                 if (max < 1024)
1238                         return (ENOMEM);
1239 
1240                 fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1241                 more_errors = nvlist_prev_nvpair(errors, NULL);
1242 
1243                 do {
1244                         nvpair_t *pair = nvlist_prev_nvpair(errors,
1245                             more_errors);
1246                         fnvlist_remove_nvpair(errors, pair);
1247                         n++;
1248                         size = fnvlist_size(errors);
1249                 } while (size > max);
1250 
1251                 fnvlist_remove_nvpair(errors, more_errors);
1252                 fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1253                 ASSERT3U(fnvlist_size(errors), <=, max);
1254         }
1255 
1256         return (0);
1257 }
1258 
1259 static int
1260 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1261 {
1262         char *packed = NULL;
1263         int error = 0;
1264         size_t size;
1265 
1266         size = fnvlist_size(nvl);
1267 
1268         if (size > zc->zc_nvlist_dst_size) {
1269                 error = ENOMEM;
1270         } else {
1271                 packed = fnvlist_pack(nvl, &size);
1272                 if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1273                     size, zc->zc_iflags) != 0)
1274                         error = EFAULT;
1275                 fnvlist_pack_free(packed, size);
1276         }
1277 
1278         zc->zc_nvlist_dst_size = size;
1279         zc->zc_nvlist_dst_filled = B_TRUE;
1280         return (error);
1281 }
1282 
1283 static int
1284 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1285 {
1286         objset_t *os;
1287         int error;
1288 
1289         error = dmu_objset_hold(dsname, FTAG, &os);
1290         if (error)
1291                 return (error);
1292         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1293                 dmu_objset_rele(os, FTAG);
1294                 return (EINVAL);
1295         }
1296 
1297         mutex_enter(&os->os_user_ptr_lock);
1298         *zfvp = dmu_objset_get_user(os);
1299         if (*zfvp) {
1300                 VFS_HOLD((*zfvp)->z_vfs);
1301         } else {
1302                 error = ESRCH;
1303         }
1304         mutex_exit(&os->os_user_ptr_lock);
1305         dmu_objset_rele(os, FTAG);
1306         return (error);
1307 }
1308 
1309 /*
1310  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1311  * case its z_vfs will be NULL, and it will be opened as the owner.
1312  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1313  * which prevents all vnode ops from running.
1314  */
1315 static int
1316 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1317 {
1318         int error = 0;
1319 
1320         if (getzfsvfs(name, zfvp) != 0)
1321                 error = zfsvfs_create(name, zfvp);
1322         if (error == 0) {
1323                 rrw_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1324                     RW_READER, tag);
1325                 if ((*zfvp)->z_unmounted) {
1326                         /*
1327                          * XXX we could probably try again, since the unmounting
1328                          * thread should be just about to disassociate the
1329                          * objset from the zfsvfs.
1330                          */
1331                         rrw_exit(&(*zfvp)->z_teardown_lock, tag);
1332                         return (EBUSY);
1333                 }
1334         }
1335         return (error);
1336 }
1337 
1338 static void
1339 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1340 {
1341         rrw_exit(&zfsvfs->z_teardown_lock, tag);
1342 
1343         if (zfsvfs->z_vfs) {
1344                 VFS_RELE(zfsvfs->z_vfs);
1345         } else {
1346                 dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1347                 zfsvfs_free(zfsvfs);
1348         }
1349 }
1350 
1351 static int
1352 zfs_ioc_pool_create(zfs_cmd_t *zc)
1353 {
1354         int error;
1355         nvlist_t *config, *props = NULL;
1356         nvlist_t *rootprops = NULL;
1357         nvlist_t *zplprops = NULL;
1358 
1359         if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1360             zc->zc_iflags, &config))
1361                 return (error);
1362 
1363         if (zc->zc_nvlist_src_size != 0 && (error =
1364             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1365             zc->zc_iflags, &props))) {
1366                 nvlist_free(config);
1367                 return (error);
1368         }
1369 
1370         if (props) {
1371                 nvlist_t *nvl = NULL;
1372                 uint64_t version = SPA_VERSION;
1373 
1374                 (void) nvlist_lookup_uint64(props,
1375                     zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1376                 if (!SPA_VERSION_IS_SUPPORTED(version)) {
1377                         error = EINVAL;
1378                         goto pool_props_bad;
1379                 }
1380                 (void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1381                 if (nvl) {
1382                         error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1383                         if (error != 0) {
1384                                 nvlist_free(config);
1385                                 nvlist_free(props);
1386                                 return (error);
1387                         }
1388                         (void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1389                 }
1390                 VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1391                 error = zfs_fill_zplprops_root(version, rootprops,
1392                     zplprops, NULL);
1393                 if (error)
1394                         goto pool_props_bad;
1395         }
1396 
1397         error = spa_create(zc->zc_name, config, props, zplprops);
1398 
1399         /*
1400          * Set the remaining root properties
1401          */
1402         if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1403             ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1404                 (void) spa_destroy(zc->zc_name);
1405 
1406 pool_props_bad:
1407         nvlist_free(rootprops);
1408         nvlist_free(zplprops);
1409         nvlist_free(config);
1410         nvlist_free(props);
1411 
1412         return (error);
1413 }
1414 
1415 static int
1416 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1417 {
1418         int error;
1419         zfs_log_history(zc);
1420         error = spa_destroy(zc->zc_name);
1421         if (error == 0)
1422                 zvol_remove_minors(zc->zc_name);
1423         return (error);
1424 }
1425 
1426 static int
1427 zfs_ioc_pool_import(zfs_cmd_t *zc)
1428 {
1429         nvlist_t *config, *props = NULL;
1430         uint64_t guid;
1431         int error;
1432 
1433         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1434             zc->zc_iflags, &config)) != 0)
1435                 return (error);
1436 
1437         if (zc->zc_nvlist_src_size != 0 && (error =
1438             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1439             zc->zc_iflags, &props))) {
1440                 nvlist_free(config);
1441                 return (error);
1442         }
1443 
1444         if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1445             guid != zc->zc_guid)
1446                 error = EINVAL;
1447         else
1448                 error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1449 
1450         if (zc->zc_nvlist_dst != 0) {
1451                 int err;
1452 
1453                 if ((err = put_nvlist(zc, config)) != 0)
1454                         error = err;
1455         }
1456 
1457         nvlist_free(config);
1458 
1459         if (props)
1460                 nvlist_free(props);
1461 
1462         return (error);
1463 }
1464 
1465 static int
1466 zfs_ioc_pool_export(zfs_cmd_t *zc)
1467 {
1468         int error;
1469         boolean_t force = (boolean_t)zc->zc_cookie;
1470         boolean_t hardforce = (boolean_t)zc->zc_guid;
1471 
1472         zfs_log_history(zc);
1473         error = spa_export(zc->zc_name, NULL, force, hardforce);
1474         if (error == 0)
1475                 zvol_remove_minors(zc->zc_name);
1476         return (error);
1477 }
1478 
1479 static int
1480 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1481 {
1482         nvlist_t *configs;
1483         int error;
1484 
1485         if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1486                 return (EEXIST);
1487 
1488         error = put_nvlist(zc, configs);
1489 
1490         nvlist_free(configs);
1491 
1492         return (error);
1493 }
1494 
1495 /*
1496  * inputs:
1497  * zc_name              name of the pool
1498  *
1499  * outputs:
1500  * zc_cookie            real errno
1501  * zc_nvlist_dst        config nvlist
1502  * zc_nvlist_dst_size   size of config nvlist
1503  */
1504 static int
1505 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1506 {
1507         nvlist_t *config;
1508         int error;
1509         int ret = 0;
1510 
1511         error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1512             sizeof (zc->zc_value));
1513 
1514         if (config != NULL) {
1515                 ret = put_nvlist(zc, config);
1516                 nvlist_free(config);
1517 
1518                 /*
1519                  * The config may be present even if 'error' is non-zero.
1520                  * In this case we return success, and preserve the real errno
1521                  * in 'zc_cookie'.
1522                  */
1523                 zc->zc_cookie = error;
1524         } else {
1525                 ret = error;
1526         }
1527 
1528         return (ret);
1529 }
1530 
1531 /*
1532  * Try to import the given pool, returning pool stats as appropriate so that
1533  * user land knows which devices are available and overall pool health.
1534  */
1535 static int
1536 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1537 {
1538         nvlist_t *tryconfig, *config;
1539         int error;
1540 
1541         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1542             zc->zc_iflags, &tryconfig)) != 0)
1543                 return (error);
1544 
1545         config = spa_tryimport(tryconfig);
1546 
1547         nvlist_free(tryconfig);
1548 
1549         if (config == NULL)
1550                 return (EINVAL);
1551 
1552         error = put_nvlist(zc, config);
1553         nvlist_free(config);
1554 
1555         return (error);
1556 }
1557 
1558 /*
1559  * inputs:
1560  * zc_name              name of the pool
1561  * zc_cookie            scan func (pool_scan_func_t)
1562  */
1563 static int
1564 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1565 {
1566         spa_t *spa;
1567         int error;
1568 
1569         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1570                 return (error);
1571 
1572         if (zc->zc_cookie == POOL_SCAN_NONE)
1573                 error = spa_scan_stop(spa);
1574         else
1575                 error = spa_scan(spa, zc->zc_cookie);
1576 
1577         spa_close(spa, FTAG);
1578 
1579         return (error);
1580 }
1581 
1582 static int
1583 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1584 {
1585         spa_t *spa;
1586         int error;
1587 
1588         error = spa_open(zc->zc_name, &spa, FTAG);
1589         if (error == 0) {
1590                 spa_freeze(spa);
1591                 spa_close(spa, FTAG);
1592         }
1593         return (error);
1594 }
1595 
1596 static int
1597 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1598 {
1599         spa_t *spa;
1600         int error;
1601 
1602         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1603                 return (error);
1604 
1605         if (zc->zc_cookie < spa_version(spa) ||
1606             !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1607                 spa_close(spa, FTAG);
1608                 return (EINVAL);
1609         }
1610 
1611         spa_upgrade(spa, zc->zc_cookie);
1612         spa_close(spa, FTAG);
1613 
1614         return (error);
1615 }
1616 
1617 static int
1618 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1619 {
1620         spa_t *spa;
1621         char *hist_buf;
1622         uint64_t size;
1623         int error;
1624 
1625         if ((size = zc->zc_history_len) == 0)
1626                 return (EINVAL);
1627 
1628         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1629                 return (error);
1630 
1631         if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1632                 spa_close(spa, FTAG);
1633                 return (ENOTSUP);
1634         }
1635 
1636         hist_buf = kmem_alloc(size, KM_SLEEP);
1637         if ((error = spa_history_get(spa, &zc->zc_history_offset,
1638             &zc->zc_history_len, hist_buf)) == 0) {
1639                 error = ddi_copyout(hist_buf,
1640                     (void *)(uintptr_t)zc->zc_history,
1641                     zc->zc_history_len, zc->zc_iflags);
1642         }
1643 
1644         spa_close(spa, FTAG);
1645         kmem_free(hist_buf, size);
1646         return (error);
1647 }
1648 
1649 static int
1650 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1651 {
1652         spa_t *spa;
1653         int error;
1654 
1655         error = spa_open(zc->zc_name, &spa, FTAG);
1656         if (error == 0) {
1657                 error = spa_change_guid(spa);
1658                 spa_close(spa, FTAG);
1659         }
1660         return (error);
1661 }
1662 
1663 static int
1664 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1665 {
1666         int error;
1667 
1668         if (error = dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value))
1669                 return (error);
1670 
1671         return (0);
1672 }
1673 
1674 /*
1675  * inputs:
1676  * zc_name              name of filesystem
1677  * zc_obj               object to find
1678  *
1679  * outputs:
1680  * zc_value             name of object
1681  */
1682 static int
1683 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1684 {
1685         objset_t *os;
1686         int error;
1687 
1688         /* XXX reading from objset not owned */
1689         if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1690                 return (error);
1691         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1692                 dmu_objset_rele(os, FTAG);
1693                 return (EINVAL);
1694         }
1695         error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1696             sizeof (zc->zc_value));
1697         dmu_objset_rele(os, FTAG);
1698 
1699         return (error);
1700 }
1701 
1702 /*
1703  * inputs:
1704  * zc_name              name of filesystem
1705  * zc_obj               object to find
1706  *
1707  * outputs:
1708  * zc_stat              stats on object
1709  * zc_value             path to object
1710  */
1711 static int
1712 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1713 {
1714         objset_t *os;
1715         int error;
1716 
1717         /* XXX reading from objset not owned */
1718         if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1719                 return (error);
1720         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1721                 dmu_objset_rele(os, FTAG);
1722                 return (EINVAL);
1723         }
1724         error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1725             sizeof (zc->zc_value));
1726         dmu_objset_rele(os, FTAG);
1727 
1728         return (error);
1729 }
1730 
1731 static int
1732 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1733 {
1734         spa_t *spa;
1735         int error;
1736         nvlist_t *config, **l2cache, **spares;
1737         uint_t nl2cache = 0, nspares = 0;
1738 
1739         error = spa_open(zc->zc_name, &spa, FTAG);
1740         if (error != 0)
1741                 return (error);
1742 
1743         error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1744             zc->zc_iflags, &config);
1745         (void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1746             &l2cache, &nl2cache);
1747 
1748         (void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1749             &spares, &nspares);
1750 
1751         /*
1752          * A root pool with concatenated devices is not supported.
1753          * Thus, can not add a device to a root pool.
1754          *
1755          * Intent log device can not be added to a rootpool because
1756          * during mountroot, zil is replayed, a seperated log device
1757          * can not be accessed during the mountroot time.
1758          *
1759          * l2cache and spare devices are ok to be added to a rootpool.
1760          */
1761         if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1762                 nvlist_free(config);
1763                 spa_close(spa, FTAG);
1764                 return (EDOM);
1765         }
1766 
1767         if (error == 0) {
1768                 error = spa_vdev_add(spa, config);
1769                 nvlist_free(config);
1770         }
1771         spa_close(spa, FTAG);
1772         return (error);
1773 }
1774 
1775 /*
1776  * inputs:
1777  * zc_name              name of the pool
1778  * zc_nvlist_conf       nvlist of devices to remove
1779  * zc_cookie            to stop the remove?
1780  */
1781 static int
1782 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1783 {
1784         spa_t *spa;
1785         int error;
1786 
1787         error = spa_open(zc->zc_name, &spa, FTAG);
1788         if (error != 0)
1789                 return (error);
1790         error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1791         spa_close(spa, FTAG);
1792         return (error);
1793 }
1794 
1795 static int
1796 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1797 {
1798         spa_t *spa;
1799         int error;
1800         vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1801 
1802         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1803                 return (error);
1804         switch (zc->zc_cookie) {
1805         case VDEV_STATE_ONLINE:
1806                 error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1807                 break;
1808 
1809         case VDEV_STATE_OFFLINE:
1810                 error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1811                 break;
1812 
1813         case VDEV_STATE_FAULTED:
1814                 if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1815                     zc->zc_obj != VDEV_AUX_EXTERNAL)
1816                         zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1817 
1818                 error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1819                 break;
1820 
1821         case VDEV_STATE_DEGRADED:
1822                 if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1823                     zc->zc_obj != VDEV_AUX_EXTERNAL)
1824                         zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1825 
1826                 error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1827                 break;
1828 
1829         default:
1830                 error = EINVAL;
1831         }
1832         zc->zc_cookie = newstate;
1833         spa_close(spa, FTAG);
1834         return (error);
1835 }
1836 
1837 static int
1838 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1839 {
1840         spa_t *spa;
1841         int replacing = zc->zc_cookie;
1842         nvlist_t *config;
1843         int error;
1844 
1845         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1846                 return (error);
1847 
1848         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1849             zc->zc_iflags, &config)) == 0) {
1850                 error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
1851                 nvlist_free(config);
1852         }
1853 
1854         spa_close(spa, FTAG);
1855         return (error);
1856 }
1857 
1858 static int
1859 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
1860 {
1861         spa_t *spa;
1862         int error;
1863 
1864         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1865                 return (error);
1866 
1867         error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
1868 
1869         spa_close(spa, FTAG);
1870         return (error);
1871 }
1872 
1873 static int
1874 zfs_ioc_vdev_split(zfs_cmd_t *zc)
1875 {
1876         spa_t *spa;
1877         nvlist_t *config, *props = NULL;
1878         int error;
1879         boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
1880 
1881         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1882                 return (error);
1883 
1884         if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1885             zc->zc_iflags, &config)) {
1886                 spa_close(spa, FTAG);
1887                 return (error);
1888         }
1889 
1890         if (zc->zc_nvlist_src_size != 0 && (error =
1891             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1892             zc->zc_iflags, &props))) {
1893                 spa_close(spa, FTAG);
1894                 nvlist_free(config);
1895                 return (error);
1896         }
1897 
1898         error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
1899 
1900         spa_close(spa, FTAG);
1901 
1902         nvlist_free(config);
1903         nvlist_free(props);
1904 
1905         return (error);
1906 }
1907 
1908 static int
1909 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
1910 {
1911         spa_t *spa;
1912         char *path = zc->zc_value;
1913         uint64_t guid = zc->zc_guid;
1914         int error;
1915 
1916         error = spa_open(zc->zc_name, &spa, FTAG);
1917         if (error != 0)
1918                 return (error);
1919 
1920         error = spa_vdev_setpath(spa, guid, path);
1921         spa_close(spa, FTAG);
1922         return (error);
1923 }
1924 
1925 static int
1926 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
1927 {
1928         spa_t *spa;
1929         char *fru = zc->zc_value;
1930         uint64_t guid = zc->zc_guid;
1931         int error;
1932 
1933         error = spa_open(zc->zc_name, &spa, FTAG);
1934         if (error != 0)
1935                 return (error);
1936 
1937         error = spa_vdev_setfru(spa, guid, fru);
1938         spa_close(spa, FTAG);
1939         return (error);
1940 }
1941 
1942 static int
1943 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os,
1944     boolean_t cachedpropsonly)
1945 {
1946         int error = 0;
1947         nvlist_t *nv;
1948 
1949         dmu_objset_fast_stat(os, &zc->zc_objset_stats);
1950 
1951         if (zc->zc_nvlist_dst != 0 &&
1952             (error = dsl_prop_get_all(os, &nv)) == 0) {
1953                 dmu_objset_stats(os, nv);
1954                 /*
1955                  * NB: zvol_get_stats() will read the objset contents,
1956                  * which we aren't supposed to do with a
1957                  * DS_MODE_USER hold, because it could be
1958                  * inconsistent.  So this is a bit of a workaround...
1959                  * XXX reading with out owning
1960                  */
1961                 if (!zc->zc_objset_stats.dds_inconsistent &&
1962                     dmu_objset_type(os) == DMU_OST_ZVOL &&
1963                     !cachedpropsonly) {
1964                         error = zvol_get_stats(os, nv);
1965                         if (error == EIO)
1966                                 return (error);
1967                         VERIFY0(error);
1968                 }
1969                 error = put_nvlist(zc, nv);
1970                 nvlist_free(nv);
1971         }
1972 
1973         return (error);
1974 }
1975 
1976 /*
1977  * inputs:
1978  * zc_name              name of filesystem
1979  * zc_nvlist_dst_size   size of buffer for property nvlist
1980  *
1981  * outputs:
1982  * zc_objset_stats      stats
1983  * zc_nvlist_dst        property nvlist
1984  * zc_nvlist_dst_size   size of property nvlist
1985  */
1986 static int
1987 zfs_ioc_objset_stats(zfs_cmd_t *zc)
1988 {
1989         objset_t *os = NULL;
1990         nvlist_t *nvl = NULL;
1991         boolean_t cachedpropsonly = B_FALSE;
1992         int error;
1993 
1994         if (zc->zc_nvlist_src != NULL &&
1995             (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1996             zc->zc_iflags, &nvl) != 0))
1997                 return (error);
1998 
1999         if (nvl != NULL) {
2000                 (void) nvlist_lookup_boolean_value(nvl, "cachedpropsonly",
2001                     &cachedpropsonly);
2002                 nvlist_free(nvl);
2003         }
2004 
2005         if (error = dmu_objset_hold(zc->zc_name, FTAG, &os))
2006                 return (error);
2007 
2008         error = zfs_ioc_objset_stats_impl(zc, os, cachedpropsonly);
2009         dmu_objset_rele(os, FTAG);
2010 
2011         return (error);
2012 }
2013 
2014 /*
2015  * inputs:
2016  * zc_name              name of filesystem
2017  * zc_nvlist_dst_size   size of buffer for property nvlist
2018  *
2019  * outputs:
2020  * zc_nvlist_dst        received property nvlist
2021  * zc_nvlist_dst_size   size of received property nvlist
2022  *
2023  * Gets received properties (distinct from local properties on or after
2024  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2025  * local property values.
2026  */
2027 static int
2028 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2029 {
2030         objset_t *os = NULL;
2031         int error;
2032         nvlist_t *nv;
2033 
2034         if (error = dmu_objset_hold(zc->zc_name, FTAG, &os))
2035                 return (error);
2036 
2037         /*
2038          * Without this check, we would return local property values if the
2039          * caller has not already received properties on or after
2040          * SPA_VERSION_RECVD_PROPS.
2041          */
2042         if (!dsl_prop_get_hasrecvd(os)) {
2043                 dmu_objset_rele(os, FTAG);
2044                 return (ENOTSUP);
2045         }
2046 
2047         if (zc->zc_nvlist_dst != 0 &&
2048             (error = dsl_prop_get_received(os, &nv)) == 0) {
2049                 error = put_nvlist(zc, nv);
2050                 nvlist_free(nv);
2051         }
2052 
2053         dmu_objset_rele(os, FTAG);
2054         return (error);
2055 }
2056 
2057 static int
2058 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2059 {
2060         uint64_t value;
2061         int error;
2062 
2063         /*
2064          * zfs_get_zplprop() will either find a value or give us
2065          * the default value (if there is one).
2066          */
2067         if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2068                 return (error);
2069         VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2070         return (0);
2071 }
2072 
2073 /*
2074  * inputs:
2075  * zc_name              name of filesystem
2076  * zc_nvlist_dst_size   size of buffer for zpl property nvlist
2077  *
2078  * outputs:
2079  * zc_nvlist_dst        zpl property nvlist
2080  * zc_nvlist_dst_size   size of zpl property nvlist
2081  */
2082 static int
2083 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2084 {
2085         objset_t *os;
2086         int err;
2087 
2088         /* XXX reading without owning */
2089         if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2090                 return (err);
2091 
2092         dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2093 
2094         /*
2095          * NB: nvl_add_zplprop() will read the objset contents,
2096          * which we aren't supposed to do with a DS_MODE_USER
2097          * hold, because it could be inconsistent.
2098          */
2099         if (zc->zc_nvlist_dst != NULL &&
2100             !zc->zc_objset_stats.dds_inconsistent &&
2101             dmu_objset_type(os) == DMU_OST_ZFS) {
2102                 nvlist_t *nv;
2103 
2104                 VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2105                 if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2106                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2107                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2108                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2109                         err = put_nvlist(zc, nv);
2110                 nvlist_free(nv);
2111         } else {
2112                 err = ENOENT;
2113         }
2114         dmu_objset_rele(os, FTAG);
2115         return (err);
2116 }
2117 
2118 static boolean_t
2119 dataset_name_hidden(const char *name)
2120 {
2121         /*
2122          * Skip over datasets that are not visible in this zone,
2123          * internal datasets (which have a $ in their name), and
2124          * temporary datasets (which have a % in their name).
2125          */
2126         if (strchr(name, '$') != NULL)
2127                 return (B_TRUE);
2128         if (strchr(name, '%') != NULL)
2129                 return (B_TRUE);
2130         if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2131                 return (B_TRUE);
2132         return (B_FALSE);
2133 }
2134 
2135 /*
2136  * inputs:
2137  * zc_name              name of filesystem
2138  * zc_cookie            zap cursor
2139  * zc_nvlist_dst_size   size of buffer for property nvlist
2140  *
2141  * outputs:
2142  * zc_name              name of next filesystem
2143  * zc_cookie            zap cursor
2144  * zc_objset_stats      stats
2145  * zc_nvlist_dst        property nvlist
2146  * zc_nvlist_dst_size   size of property nvlist
2147  */
2148 static int
2149 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2150 {
2151         objset_t *os;
2152         int error;
2153         char *p;
2154         size_t orig_len = strlen(zc->zc_name);
2155 
2156 top:
2157         if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2158                 if (error == ENOENT)
2159                         error = ESRCH;
2160                 return (error);
2161         }
2162 
2163         p = strrchr(zc->zc_name, '/');
2164         if (p == NULL || p[1] != '\0')
2165                 (void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2166         p = zc->zc_name + strlen(zc->zc_name);
2167 
2168         /*
2169          * Pre-fetch the datasets.  dmu_objset_prefetch() always returns 0
2170          * but is not declared void because its called by dmu_objset_find().
2171          */
2172         if (zc->zc_cookie == 0) {
2173                 uint64_t cookie = 0;
2174                 int len = sizeof (zc->zc_name) - (p - zc->zc_name);
2175 
2176                 while (dmu_dir_list_next(os, len, p, NULL, &cookie) == 0) {
2177                         if (!dataset_name_hidden(zc->zc_name))
2178                                 (void) dmu_objset_prefetch(zc->zc_name, NULL);
2179                 }
2180         }
2181 
2182         do {
2183                 error = dmu_dir_list_next(os,
2184                     sizeof (zc->zc_name) - (p - zc->zc_name), p,
2185                     NULL, &zc->zc_cookie);
2186                 if (error == ENOENT)
2187                         error = ESRCH;
2188         } while (error == 0 && dataset_name_hidden(zc->zc_name));
2189         dmu_objset_rele(os, FTAG);
2190 
2191         /*
2192          * If it's an internal dataset (ie. with a '$' in its name),
2193          * don't try to get stats for it, otherwise we'll return ENOENT.
2194          */
2195         if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2196                 error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2197                 if (error == ENOENT) {
2198                         /* We lost a race with destroy, get the next one. */
2199                         zc->zc_name[orig_len] = '\0';
2200                         goto top;
2201                 }
2202         }
2203         return (error);
2204 }
2205 
2206 /*
2207  * inputs:
2208  * zc_name              name of filesystem
2209  * zc_cookie            zap cursor
2210  * zc_nvlist_dst_size   size of buffer for property nvlist
2211  *
2212  * outputs:
2213  * zc_name              name of next snapshot
2214  * zc_objset_stats      stats
2215  * zc_nvlist_dst        property nvlist
2216  * zc_nvlist_dst_size   size of property nvlist
2217  */
2218 static int
2219 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2220 {
2221         objset_t *os;
2222         nvlist_t *nvl = NULL;
2223         boolean_t cachedpropsonly = B_FALSE;
2224         int error;
2225 
2226         if (zc->zc_nvlist_src != NULL &&
2227             (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2228             zc->zc_iflags, &nvl) != 0))
2229                 return (error);
2230 
2231         if (nvl != NULL) {
2232                 (void) nvlist_lookup_boolean_value(nvl, "cachedpropsonly",
2233                     &cachedpropsonly);
2234                 nvlist_free(nvl);
2235         }
2236 
2237 top:
2238         if (zc->zc_cookie == 0)
2239                 (void) dmu_objset_find(zc->zc_name, dmu_objset_prefetch,
2240                     NULL, DS_FIND_SNAPSHOTS);
2241 
2242         error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2243         if (error)
2244                 return (error == ENOENT ? ESRCH : error);
2245 
2246         /*
2247          * A dataset name of maximum length cannot have any snapshots,
2248          * so exit immediately.
2249          */
2250         if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
2251                 dmu_objset_rele(os, FTAG);
2252                 return (ESRCH);
2253         }
2254 
2255         error = dmu_snapshot_list_next(os,
2256             sizeof (zc->zc_name) - strlen(zc->zc_name),
2257             zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2258             NULL);
2259 
2260         if (error == 0) {
2261                 dsl_dataset_t *ds;
2262                 dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2263 
2264                 /*
2265                  * Since we probably don't have a hold on this snapshot,
2266                  * it's possible that the objsetid could have been destroyed
2267                  * and reused for a new objset. It's OK if this happens during
2268                  * a zfs send operation, since the new createtxg will be
2269                  * beyond the range we're interested in.
2270                  */
2271                 rw_enter(&dp->dp_config_rwlock, RW_READER);
2272                 error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2273                 rw_exit(&dp->dp_config_rwlock);
2274                 if (error) {
2275                         if (error == ENOENT) {
2276                                 /* Racing with destroy, get the next one. */
2277                                 *strchr(zc->zc_name, '@') = '\0';
2278                                 dmu_objset_rele(os, FTAG);
2279                                 goto top;
2280                         }
2281                 } else {
2282                         objset_t *ossnap;
2283 
2284                         error = dmu_objset_from_ds(ds, &ossnap);
2285                         if (error == 0) {
2286                                 error = zfs_ioc_objset_stats_impl(zc,
2287                                     ossnap, cachedpropsonly);
2288                         }
2289                         dsl_dataset_rele(ds, FTAG);
2290                 }
2291         } else if (error == ENOENT) {
2292                 error = ESRCH;
2293         }
2294 
2295         dmu_objset_rele(os, FTAG);
2296         /* if we failed, undo the @ that we tacked on to zc_name */
2297         if (error)
2298                 *strchr(zc->zc_name, '@') = '\0';
2299         return (error);
2300 }
2301 
2302 static int
2303 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2304 {
2305         const char *propname = nvpair_name(pair);
2306         uint64_t *valary;
2307         unsigned int vallen;
2308         const char *domain;
2309         char *dash;
2310         zfs_userquota_prop_t type;
2311         uint64_t rid;
2312         uint64_t quota;
2313         zfsvfs_t *zfsvfs;
2314         int err;
2315 
2316         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2317                 nvlist_t *attrs;
2318                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2319                 if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2320                     &pair) != 0)
2321                         return (EINVAL);
2322         }
2323 
2324         /*
2325          * A correctly constructed propname is encoded as
2326          * userquota@<rid>-<domain>.
2327          */
2328         if ((dash = strchr(propname, '-')) == NULL ||
2329             nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2330             vallen != 3)
2331                 return (EINVAL);
2332 
2333         domain = dash + 1;
2334         type = valary[0];
2335         rid = valary[1];
2336         quota = valary[2];
2337 
2338         err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2339         if (err == 0) {
2340                 err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2341                 zfsvfs_rele(zfsvfs, FTAG);
2342         }
2343 
2344         return (err);
2345 }
2346 
2347 /*
2348  * If the named property is one that has a special function to set its value,
2349  * return 0 on success and a positive error code on failure; otherwise if it is
2350  * not one of the special properties handled by this function, return -1.
2351  *
2352  * XXX: It would be better for callers of the property interface if we handled
2353  * these special cases in dsl_prop.c (in the dsl layer).
2354  */
2355 static int
2356 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2357     nvpair_t *pair)
2358 {
2359         const char *propname = nvpair_name(pair);
2360         zfs_prop_t prop = zfs_name_to_prop(propname);
2361         uint64_t intval;
2362         int err;
2363 
2364         if (prop == ZPROP_INVAL) {
2365                 if (zfs_prop_userquota(propname))
2366                         return (zfs_prop_set_userquota(dsname, pair));
2367                 return (-1);
2368         }
2369 
2370         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2371                 nvlist_t *attrs;
2372                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2373                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2374                     &pair) == 0);
2375         }
2376 
2377         if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2378                 return (-1);
2379 
2380         VERIFY(0 == nvpair_value_uint64(pair, &intval));
2381 
2382         switch (prop) {
2383         case ZFS_PROP_QUOTA:
2384                 err = dsl_dir_set_quota(dsname, source, intval);
2385                 break;
2386         case ZFS_PROP_REFQUOTA:
2387                 err = dsl_dataset_set_quota(dsname, source, intval);
2388                 break;
2389         case ZFS_PROP_FILESYSTEM_LIMIT:
2390                 err = dsl_dir_validate_fs_ss_limit(dsname, intval,
2391                     ZFS_PROP_FILESYSTEM_LIMIT);
2392                 break;
2393         case ZFS_PROP_SNAPSHOT_LIMIT:
2394                 err = dsl_dir_validate_fs_ss_limit(dsname, intval,
2395                     ZFS_PROP_SNAPSHOT_LIMIT);
2396                 break;
2397         case ZFS_PROP_RESERVATION:
2398                 err = dsl_dir_set_reservation(dsname, source, intval);
2399                 break;
2400         case ZFS_PROP_REFRESERVATION:
2401                 err = dsl_dataset_set_reservation(dsname, source, intval);
2402                 break;
2403         case ZFS_PROP_VOLSIZE:
2404                 err = zvol_set_volsize(dsname, ddi_driver_major(zfs_dip),
2405                     intval);
2406                 break;
2407         case ZFS_PROP_VERSION:
2408         {
2409                 zfsvfs_t *zfsvfs;
2410 
2411                 if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2412                         break;
2413 
2414                 err = zfs_set_version(zfsvfs, intval);
2415                 zfsvfs_rele(zfsvfs, FTAG);
2416 
2417                 if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2418                         zfs_cmd_t *zc;
2419 
2420                         zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2421                         (void) strcpy(zc->zc_name, dsname);
2422                         (void) zfs_ioc_userspace_upgrade(zc);
2423                         kmem_free(zc, sizeof (zfs_cmd_t));
2424                 }
2425                 break;
2426         }
2427 
2428         default:
2429                 err = -1;
2430         }
2431 
2432         return (err);
2433 }
2434 
2435 /*
2436  * This function is best effort. If it fails to set any of the given properties,
2437  * it continues to set as many as it can and returns the last error
2438  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2439  * with the list of names of all the properties that failed along with the
2440  * corresponding error numbers.
2441  *
2442  * If every property is set successfully, zero is returned and errlist is not
2443  * modified.
2444  */
2445 int
2446 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2447     nvlist_t *errlist)
2448 {
2449         nvpair_t *pair;
2450         nvpair_t *propval;
2451         int rv = 0;
2452         uint64_t intval;
2453         char *strval;
2454         nvlist_t *genericnvl = fnvlist_alloc();
2455         nvlist_t *retrynvl = fnvlist_alloc();
2456 
2457 retry:
2458         pair = NULL;
2459         while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2460                 const char *propname = nvpair_name(pair);
2461                 zfs_prop_t prop = zfs_name_to_prop(propname);
2462                 int err = 0;
2463 
2464                 /* decode the property value */
2465                 propval = pair;
2466                 if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2467                         nvlist_t *attrs;
2468                         attrs = fnvpair_value_nvlist(pair);
2469                         if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2470                             &propval) != 0)
2471                                 err = EINVAL;
2472                 }
2473 
2474                 /* Validate value type */
2475                 if (err == 0 && prop == ZPROP_INVAL) {
2476                         if (zfs_prop_user(propname)) {
2477                                 if (nvpair_type(propval) != DATA_TYPE_STRING)
2478                                         err = EINVAL;
2479                         } else if (zfs_prop_userquota(propname)) {
2480                                 if (nvpair_type(propval) !=
2481                                     DATA_TYPE_UINT64_ARRAY)
2482                                         err = EINVAL;
2483                         } else {
2484                                 err = EINVAL;
2485                         }
2486                 } else if (err == 0) {
2487                         if (nvpair_type(propval) == DATA_TYPE_STRING) {
2488                                 if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2489                                         err = EINVAL;
2490                         } else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2491                                 const char *unused;
2492 
2493                                 intval = fnvpair_value_uint64(propval);
2494 
2495                                 switch (zfs_prop_get_type(prop)) {
2496                                 case PROP_TYPE_NUMBER:
2497                                         break;
2498                                 case PROP_TYPE_STRING:
2499                                         err = EINVAL;
2500                                         break;
2501                                 case PROP_TYPE_INDEX:
2502                                         if (zfs_prop_index_to_string(prop,
2503                                             intval, &unused) != 0)
2504                                                 err = EINVAL;
2505                                         break;
2506                                 default:
2507                                         cmn_err(CE_PANIC,
2508                                             "unknown property type");
2509                                 }
2510                         } else {
2511                                 err = EINVAL;
2512                         }
2513                 }
2514 
2515                 /* Validate permissions */
2516                 if (err == 0)
2517                         err = zfs_check_settable(dsname, pair, CRED());
2518 
2519                 if (err == 0) {
2520                         err = zfs_prop_set_special(dsname, source, pair);
2521                         if (err == -1) {
2522                                 /*
2523                                  * For better performance we build up a list of
2524                                  * properties to set in a single transaction.
2525                                  */
2526                                 err = nvlist_add_nvpair(genericnvl, pair);
2527                         } else if (err != 0 && nvl != retrynvl) {
2528                                 /*
2529                                  * This may be a spurious error caused by
2530                                  * receiving quota and reservation out of order.
2531                                  * Try again in a second pass.
2532                                  */
2533                                 err = nvlist_add_nvpair(retrynvl, pair);
2534                         }
2535                 }
2536 
2537                 if (err != 0) {
2538                         if (errlist != NULL)
2539                                 fnvlist_add_int32(errlist, propname, err);
2540                         rv = err;
2541                 }
2542         }
2543 
2544         if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2545                 nvl = retrynvl;
2546                 goto retry;
2547         }
2548 
2549         if (!nvlist_empty(genericnvl) &&
2550             dsl_props_set(dsname, source, genericnvl) != 0) {
2551                 /*
2552                  * If this fails, we still want to set as many properties as we
2553                  * can, so try setting them individually.
2554                  */
2555                 pair = NULL;
2556                 while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2557                         const char *propname = nvpair_name(pair);
2558                         int err = 0;
2559 
2560                         propval = pair;
2561                         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2562                                 nvlist_t *attrs;
2563                                 attrs = fnvpair_value_nvlist(pair);
2564                                 propval = fnvlist_lookup_nvpair(attrs,
2565                                     ZPROP_VALUE);
2566                         }
2567 
2568                         if (nvpair_type(propval) == DATA_TYPE_STRING) {
2569                                 strval = fnvpair_value_string(propval);
2570                                 err = dsl_prop_set(dsname, propname, source, 1,
2571                                     strlen(strval) + 1, strval);
2572                         } else {
2573                                 intval = fnvpair_value_uint64(propval);
2574                                 err = dsl_prop_set(dsname, propname, source, 8,
2575                                     1, &intval);
2576                         }
2577 
2578                         if (err != 0) {
2579                                 if (errlist != NULL) {
2580                                         fnvlist_add_int32(errlist, propname,
2581                                             err);
2582                                 }
2583                                 rv = err;
2584                         }
2585                 }
2586         }
2587         nvlist_free(genericnvl);
2588         nvlist_free(retrynvl);
2589 
2590         return (rv);
2591 }
2592 
2593 /*
2594  * Check that all the properties are valid user properties.
2595  */
2596 static int
2597 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2598 {
2599         nvpair_t *pair = NULL;
2600         int error = 0;
2601 
2602         while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2603                 const char *propname = nvpair_name(pair);
2604                 char *valstr;
2605 
2606                 if (!zfs_prop_user(propname) ||
2607                     nvpair_type(pair) != DATA_TYPE_STRING)
2608                         return (EINVAL);
2609 
2610                 if (error = zfs_secpolicy_write_perms(fsname,
2611                     ZFS_DELEG_PERM_USERPROP, CRED()))
2612                         return (error);
2613 
2614                 if (strlen(propname) >= ZAP_MAXNAMELEN)
2615                         return (ENAMETOOLONG);
2616 
2617                 VERIFY(nvpair_value_string(pair, &valstr) == 0);
2618                 if (strlen(valstr) >= ZAP_MAXVALUELEN)
2619                         return (E2BIG);
2620         }
2621         return (0);
2622 }
2623 
2624 static void
2625 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2626 {
2627         nvpair_t *pair;
2628 
2629         VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2630 
2631         pair = NULL;
2632         while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2633                 if (nvlist_exists(skipped, nvpair_name(pair)))
2634                         continue;
2635 
2636                 VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2637         }
2638 }
2639 
2640 static int
2641 clear_received_props(objset_t *os, const char *fs, nvlist_t *props,
2642     nvlist_t *skipped)
2643 {
2644         int err = 0;
2645         nvlist_t *cleared_props = NULL;
2646         props_skip(props, skipped, &cleared_props);
2647         if (!nvlist_empty(cleared_props)) {
2648                 /*
2649                  * Acts on local properties until the dataset has received
2650                  * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2651                  */
2652                 zprop_source_t flags = (ZPROP_SRC_NONE |
2653                     (dsl_prop_get_hasrecvd(os) ? ZPROP_SRC_RECEIVED : 0));
2654                 err = zfs_set_prop_nvlist(fs, flags, cleared_props, NULL);
2655         }
2656         nvlist_free(cleared_props);
2657         return (err);
2658 }
2659 
2660 /*
2661  * inputs:
2662  * zc_name              name of filesystem
2663  * zc_value             name of property to set
2664  * zc_nvlist_src{_size} nvlist of properties to apply
2665  * zc_cookie            received properties flag
2666  *
2667  * outputs:
2668  * zc_nvlist_dst{_size} error for each unapplied received property
2669  */
2670 static int
2671 zfs_ioc_set_prop(zfs_cmd_t *zc)
2672 {
2673         nvlist_t *nvl;
2674         boolean_t received = zc->zc_cookie;
2675         zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2676             ZPROP_SRC_LOCAL);
2677         nvlist_t *errors;
2678         int error;
2679 
2680         if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2681             zc->zc_iflags, &nvl)) != 0)
2682                 return (error);
2683 
2684         if (received) {
2685                 nvlist_t *origprops;
2686                 objset_t *os;
2687 
2688                 if (dmu_objset_hold(zc->zc_name, FTAG, &os) == 0) {
2689                         if (dsl_prop_get_received(os, &origprops) == 0) {
2690                                 (void) clear_received_props(os,
2691                                     zc->zc_name, origprops, nvl);
2692                                 nvlist_free(origprops);
2693                         }
2694 
2695                         dsl_prop_set_hasrecvd(os);
2696                         dmu_objset_rele(os, FTAG);
2697                 }
2698         }
2699 
2700         errors = fnvlist_alloc();
2701         error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2702 
2703         if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2704                 (void) put_nvlist(zc, errors);
2705         }
2706 
2707         nvlist_free(errors);
2708         nvlist_free(nvl);
2709         return (error);
2710 }
2711 
2712 /*
2713  * inputs:
2714  * zc_name              name of filesystem
2715  * zc_value             name of property to inherit
2716  * zc_cookie            revert to received value if TRUE
2717  *
2718  * outputs:             none
2719  */
2720 static int
2721 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2722 {
2723         const char *propname = zc->zc_value;
2724         zfs_prop_t prop = zfs_name_to_prop(propname);
2725         boolean_t received = zc->zc_cookie;
2726         zprop_source_t source = (received
2727             ? ZPROP_SRC_NONE            /* revert to received value, if any */
2728             : ZPROP_SRC_INHERITED);     /* explicitly inherit */
2729 
2730         if (received) {
2731                 nvlist_t *dummy;
2732                 nvpair_t *pair;
2733                 zprop_type_t type;
2734                 int err;
2735 
2736                 /*
2737                  * zfs_prop_set_special() expects properties in the form of an
2738                  * nvpair with type info.
2739                  */
2740                 if (prop == ZPROP_INVAL) {
2741                         if (!zfs_prop_user(propname))
2742                                 return (EINVAL);
2743 
2744                         type = PROP_TYPE_STRING;
2745                 } else if (prop == ZFS_PROP_VOLSIZE ||
2746                     prop == ZFS_PROP_VERSION) {
2747                         return (EINVAL);
2748                 } else {
2749                         type = zfs_prop_get_type(prop);
2750                 }
2751 
2752                 VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2753 
2754                 switch (type) {
2755                 case PROP_TYPE_STRING:
2756                         VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2757                         break;
2758                 case PROP_TYPE_NUMBER:
2759                 case PROP_TYPE_INDEX:
2760                         VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2761                         break;
2762                 default:
2763                         nvlist_free(dummy);
2764                         return (EINVAL);
2765                 }
2766 
2767                 pair = nvlist_next_nvpair(dummy, NULL);
2768                 err = zfs_prop_set_special(zc->zc_name, source, pair);
2769                 nvlist_free(dummy);
2770                 if (err != -1)
2771                         return (err); /* special property already handled */
2772         } else {
2773                 /*
2774                  * Only check this in the non-received case. We want to allow
2775                  * 'inherit -S' to revert non-inheritable properties like quota
2776                  * and reservation to the received or default values even though
2777                  * they are not considered inheritable.
2778                  */
2779                 if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2780                         return (EINVAL);
2781         }
2782 
2783         /* property name has been validated by zfs_secpolicy_inherit_prop() */
2784         return (dsl_prop_set(zc->zc_name, zc->zc_value, source, 0, 0, NULL));
2785 }
2786 
2787 static int
2788 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2789 {
2790         nvlist_t *props;
2791         spa_t *spa;
2792         int error;
2793         nvpair_t *pair;
2794 
2795         if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2796             zc->zc_iflags, &props))
2797                 return (error);
2798 
2799         /*
2800          * If the only property is the configfile, then just do a spa_lookup()
2801          * to handle the faulted case.
2802          */
2803         pair = nvlist_next_nvpair(props, NULL);
2804         if (pair != NULL && strcmp(nvpair_name(pair),
2805             zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2806             nvlist_next_nvpair(props, pair) == NULL) {
2807                 mutex_enter(&spa_namespace_lock);
2808                 if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2809                         spa_configfile_set(spa, props, B_FALSE);
2810                         spa_config_sync(spa, B_FALSE, B_TRUE);
2811                 }
2812                 mutex_exit(&spa_namespace_lock);
2813                 if (spa != NULL) {
2814                         nvlist_free(props);
2815                         return (0);
2816                 }
2817         }
2818 
2819         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2820                 nvlist_free(props);
2821                 return (error);
2822         }
2823 
2824         error = spa_prop_set(spa, props);
2825 
2826         nvlist_free(props);
2827         spa_close(spa, FTAG);
2828 
2829         return (error);
2830 }
2831 
2832 static int
2833 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2834 {
2835         spa_t *spa;
2836         int error;
2837         nvlist_t *nvp = NULL;
2838 
2839         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2840                 /*
2841                  * If the pool is faulted, there may be properties we can still
2842                  * get (such as altroot and cachefile), so attempt to get them
2843                  * anyway.
2844                  */
2845                 mutex_enter(&spa_namespace_lock);
2846                 if ((spa = spa_lookup(zc->zc_name)) != NULL)
2847                         error = spa_prop_get(spa, &nvp);
2848                 mutex_exit(&spa_namespace_lock);
2849         } else {
2850                 error = spa_prop_get(spa, &nvp);
2851                 spa_close(spa, FTAG);
2852         }
2853 
2854         if (error == 0 && zc->zc_nvlist_dst != NULL)
2855                 error = put_nvlist(zc, nvp);
2856         else
2857                 error = EFAULT;
2858 
2859         nvlist_free(nvp);
2860         return (error);
2861 }
2862 
2863 /*
2864  * inputs:
2865  * zc_name              name of filesystem
2866  * zc_nvlist_src{_size} nvlist of delegated permissions
2867  * zc_perm_action       allow/unallow flag
2868  *
2869  * outputs:             none
2870  */
2871 static int
2872 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2873 {
2874         int error;
2875         nvlist_t *fsaclnv = NULL;
2876 
2877         if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2878             zc->zc_iflags, &fsaclnv)) != 0)
2879                 return (error);
2880 
2881         /*
2882          * Verify nvlist is constructed correctly
2883          */
2884         if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2885                 nvlist_free(fsaclnv);
2886                 return (EINVAL);
2887         }
2888 
2889         /*
2890          * If we don't have PRIV_SYS_MOUNT, then validate
2891          * that user is allowed to hand out each permission in
2892          * the nvlist(s)
2893          */
2894 
2895         error = secpolicy_zfs(CRED());
2896         if (error) {
2897                 if (zc->zc_perm_action == B_FALSE) {
2898                         error = dsl_deleg_can_allow(zc->zc_name,
2899                             fsaclnv, CRED());
2900                 } else {
2901                         error = dsl_deleg_can_unallow(zc->zc_name,
2902                             fsaclnv, CRED());
2903                 }
2904         }
2905 
2906         if (error == 0)
2907                 error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2908 
2909         nvlist_free(fsaclnv);
2910         return (error);
2911 }
2912 
2913 /*
2914  * inputs:
2915  * zc_name              name of filesystem
2916  *
2917  * outputs:
2918  * zc_nvlist_src{_size} nvlist of delegated permissions
2919  */
2920 static int
2921 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
2922 {
2923         nvlist_t *nvp;
2924         int error;
2925 
2926         if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
2927                 error = put_nvlist(zc, nvp);
2928                 nvlist_free(nvp);
2929         }
2930 
2931         return (error);
2932 }
2933 
2934 /*
2935  * Search the vfs list for a specified resource.  Returns a pointer to it
2936  * or NULL if no suitable entry is found. The caller of this routine
2937  * is responsible for releasing the returned vfs pointer.
2938  */
2939 static vfs_t *
2940 zfs_get_vfs(const char *resource)
2941 {
2942         struct vfs *vfsp;
2943         struct vfs *vfs_found = NULL;
2944 
2945         vfs_list_read_lock();
2946         vfsp = rootvfs;
2947         do {
2948                 if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
2949                         VFS_HOLD(vfsp);
2950                         vfs_found = vfsp;
2951                         break;
2952                 }
2953                 vfsp = vfsp->vfs_next;
2954         } while (vfsp != rootvfs);
2955         vfs_list_unlock();
2956         return (vfs_found);
2957 }
2958 
2959 /* ARGSUSED */
2960 static void
2961 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
2962 {
2963         zfs_creat_t *zct = arg;
2964 
2965         zfs_create_fs(os, cr, zct->zct_zplprops, tx);
2966 }
2967 
2968 #define ZFS_PROP_UNDEFINED      ((uint64_t)-1)
2969 
2970 /*
2971  * inputs:
2972  * createprops          list of properties requested by creator
2973  * default_zplver       zpl version to use if unspecified in createprops
2974  * fuids_ok             fuids allowed in this version of the spa?
2975  * os                   parent objset pointer (NULL if root fs)
2976  *
2977  * outputs:
2978  * zplprops     values for the zplprops we attach to the master node object
2979  * is_ci        true if requested file system will be purely case-insensitive
2980  *
2981  * Determine the settings for utf8only, normalization and
2982  * casesensitivity.  Specific values may have been requested by the
2983  * creator and/or we can inherit values from the parent dataset.  If
2984  * the file system is of too early a vintage, a creator can not
2985  * request settings for these properties, even if the requested
2986  * setting is the default value.  We don't actually want to create dsl
2987  * properties for these, so remove them from the source nvlist after
2988  * processing.
2989  */
2990 static int
2991 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
2992     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
2993     nvlist_t *zplprops, boolean_t *is_ci)
2994 {
2995         uint64_t sense = ZFS_PROP_UNDEFINED;
2996         uint64_t norm = ZFS_PROP_UNDEFINED;
2997         uint64_t u8 = ZFS_PROP_UNDEFINED;
2998         int error;
2999 
3000         ASSERT(zplprops != NULL);
3001 
3002         /*
3003          * Pull out creator prop choices, if any.
3004          */
3005         if (createprops) {
3006                 (void) nvlist_lookup_uint64(createprops,
3007                     zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3008                 (void) nvlist_lookup_uint64(createprops,
3009                     zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3010                 (void) nvlist_remove_all(createprops,
3011                     zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3012                 (void) nvlist_lookup_uint64(createprops,
3013                     zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3014                 (void) nvlist_remove_all(createprops,
3015                     zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3016                 (void) nvlist_lookup_uint64(createprops,
3017                     zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3018                 (void) nvlist_remove_all(createprops,
3019                     zfs_prop_to_name(ZFS_PROP_CASE));
3020         }
3021 
3022         /*
3023          * If the zpl version requested is whacky or the file system
3024          * or pool is version is too "young" to support normalization
3025          * and the creator tried to set a value for one of the props,
3026          * error out.
3027          */
3028         if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3029             (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3030             (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3031             (zplver < ZPL_VERSION_NORMALIZATION &&
3032             (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3033             sense != ZFS_PROP_UNDEFINED)))
3034                 return (ENOTSUP);
3035 
3036         /*
3037          * Put the version in the zplprops
3038          */
3039         VERIFY(nvlist_add_uint64(zplprops,
3040             zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3041 
3042         if (norm == ZFS_PROP_UNDEFINED &&
3043             (error = zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm)) != 0)
3044                 return (error);
3045         VERIFY(nvlist_add_uint64(zplprops,
3046             zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3047 
3048         /*
3049          * If we're normalizing, names must always be valid UTF-8 strings.
3050          */
3051         if (norm)
3052                 u8 = 1;
3053         if (u8 == ZFS_PROP_UNDEFINED &&
3054             (error = zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8)) != 0)
3055                 return (error);
3056         VERIFY(nvlist_add_uint64(zplprops,
3057             zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3058 
3059         if (sense == ZFS_PROP_UNDEFINED &&
3060             (error = zfs_get_zplprop(os, ZFS_PROP_CASE, &sense)) != 0)
3061                 return (error);
3062         VERIFY(nvlist_add_uint64(zplprops,
3063             zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3064 
3065         if (is_ci)
3066                 *is_ci = (sense == ZFS_CASE_INSENSITIVE);
3067 
3068         return (0);
3069 }
3070 
3071 static int
3072 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3073     nvlist_t *zplprops, boolean_t *is_ci)
3074 {
3075         boolean_t fuids_ok, sa_ok;
3076         uint64_t zplver = ZPL_VERSION;
3077         objset_t *os = NULL;
3078         char parentname[MAXNAMELEN];
3079         char *cp;
3080         spa_t *spa;
3081         uint64_t spa_vers;
3082         int error;
3083 
3084         (void) strlcpy(parentname, dataset, sizeof (parentname));
3085         cp = strrchr(parentname, '/');
3086         ASSERT(cp != NULL);
3087         cp[0] = '\0';
3088 
3089         if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3090                 return (error);
3091 
3092         spa_vers = spa_version(spa);
3093         spa_close(spa, FTAG);
3094 
3095         zplver = zfs_zpl_version_map(spa_vers);
3096         fuids_ok = (zplver >= ZPL_VERSION_FUID);
3097         sa_ok = (zplver >= ZPL_VERSION_SA);
3098 
3099         /*
3100          * Open parent object set so we can inherit zplprop values.
3101          */
3102         if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3103                 return (error);
3104 
3105         error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3106             zplprops, is_ci);
3107         dmu_objset_rele(os, FTAG);
3108         return (error);
3109 }
3110 
3111 static int
3112 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3113     nvlist_t *zplprops, boolean_t *is_ci)
3114 {
3115         boolean_t fuids_ok;
3116         boolean_t sa_ok;
3117         uint64_t zplver = ZPL_VERSION;
3118         int error;
3119 
3120         zplver = zfs_zpl_version_map(spa_vers);
3121         fuids_ok = (zplver >= ZPL_VERSION_FUID);
3122         sa_ok = (zplver >= ZPL_VERSION_SA);
3123 
3124         error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3125             createprops, zplprops, is_ci);
3126         return (error);
3127 }
3128 
3129 /*
3130  * innvl: {
3131  *     "type" -> dmu_objset_type_t (int32)
3132  *     (optional) "props" -> { prop -> value }
3133  * }
3134  *
3135  * outnvl: propname -> error code (int32)
3136  */
3137 static int
3138 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3139 {
3140         int error = 0;
3141         zfs_creat_t zct = { 0 };
3142         nvlist_t *nvprops = NULL;
3143         void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3144         int32_t type32;
3145         dmu_objset_type_t type;
3146         boolean_t is_insensitive = B_FALSE;
3147 
3148         if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3149                 return (EINVAL);
3150         type = type32;
3151         (void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3152 
3153         switch (type) {
3154         case DMU_OST_ZFS:
3155                 cbfunc = zfs_create_cb;
3156                 break;
3157 
3158         case DMU_OST_ZVOL:
3159                 cbfunc = zvol_create_cb;
3160                 break;
3161 
3162         default:
3163                 cbfunc = NULL;
3164                 break;
3165         }
3166         if (strchr(fsname, '@') ||
3167             strchr(fsname, '%'))
3168                 return (EINVAL);
3169 
3170         zct.zct_props = nvprops;
3171 
3172         if (cbfunc == NULL)
3173                 return (EINVAL);
3174 
3175         if (type == DMU_OST_ZVOL) {
3176                 uint64_t volsize, volblocksize;
3177 
3178                 if (nvprops == NULL)
3179                         return (EINVAL);
3180                 if (nvlist_lookup_uint64(nvprops,
3181                     zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3182                         return (EINVAL);
3183 
3184                 if ((error = nvlist_lookup_uint64(nvprops,
3185                     zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3186                     &volblocksize)) != 0 && error != ENOENT)
3187                         return (EINVAL);
3188 
3189                 if (error != 0)
3190                         volblocksize = zfs_prop_default_numeric(
3191                             ZFS_PROP_VOLBLOCKSIZE);
3192 
3193                 if ((error = zvol_check_volblocksize(
3194                     volblocksize)) != 0 ||
3195                     (error = zvol_check_volsize(volsize,
3196                     volblocksize)) != 0)
3197                         return (error);
3198         } else if (type == DMU_OST_ZFS) {
3199                 int error;
3200 
3201                 /*
3202                  * We have to have normalization and
3203                  * case-folding flags correct when we do the
3204                  * file system creation, so go figure them out
3205                  * now.
3206                  */
3207                 VERIFY(nvlist_alloc(&zct.zct_zplprops,
3208                     NV_UNIQUE_NAME, KM_SLEEP) == 0);
3209                 error = zfs_fill_zplprops(fsname, nvprops,
3210                     zct.zct_zplprops, &is_insensitive);
3211                 if (error != 0) {
3212                         nvlist_free(zct.zct_zplprops);
3213                         return (error);
3214                 }
3215         }
3216 
3217         error = dmu_objset_create(fsname, type,
3218             is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3219         nvlist_free(zct.zct_zplprops);
3220 
3221         /*
3222          * It would be nice to do this atomically.
3223          */
3224         if (error == 0) {
3225                 error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3226                     nvprops, outnvl);
3227                 if (error != 0)
3228                         (void) dmu_objset_destroy(fsname, B_FALSE);
3229         }
3230         return (error);
3231 }
3232 
3233 /*
3234  * innvl: {
3235  *     "origin" -> name of origin snapshot
3236  *     (optional) "props" -> { prop -> value }
3237  * }
3238  *
3239  * outnvl: propname -> error code (int32)
3240  */
3241 static int
3242 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3243 {
3244         int error = 0;
3245         nvlist_t *nvprops = NULL;
3246         char *origin_name;
3247         dsl_dataset_t *origin;
3248 
3249         if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3250                 return (EINVAL);
3251         (void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3252 
3253         if (strchr(fsname, '@') ||
3254             strchr(fsname, '%'))
3255                 return (EINVAL);
3256 
3257         if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3258                 return (EINVAL);
3259 
3260         error = dsl_dataset_hold(origin_name, FTAG, &origin);
3261         if (error)
3262                 return (error);
3263 
3264         error = dmu_objset_clone(fsname, origin, 0);
3265         dsl_dataset_rele(origin, FTAG);
3266         if (error)
3267                 return (error);
3268 
3269         /*
3270          * It would be nice to do this atomically.
3271          */
3272         if (error == 0) {
3273                 error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3274                     nvprops, outnvl);
3275                 if (error != 0)
3276                         (void) dmu_objset_destroy(fsname, B_FALSE);
3277         }
3278         return (error);
3279 }
3280 
3281 /*
3282  * innvl: {
3283  *     "snaps" -> { snapshot1, snapshot2 }
3284  *     (optional) "props" -> { prop -> value (string) }
3285  * }
3286  *
3287  * outnvl: snapshot -> error code (int32)
3288  *
3289  */
3290 static int
3291 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3292 {
3293         nvlist_t *snaps;
3294         nvlist_t *props = NULL;
3295         int error, poollen;
3296         nvpair_t *pair;
3297 
3298         (void) nvlist_lookup_nvlist(innvl, "props", &props);
3299         if ((error = zfs_check_userprops(poolname, props)) != 0)
3300                 return (error);
3301 
3302         if (!nvlist_empty(props) &&
3303             zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3304                 return (ENOTSUP);
3305 
3306         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3307                 return (EINVAL);
3308         poollen = strlen(poolname);
3309         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3310             pair = nvlist_next_nvpair(snaps, pair)) {
3311                 const char *name = nvpair_name(pair);
3312                 const char *cp = strchr(name, '@');
3313 
3314                 /*
3315                  * The snap name must contain an @, and the part after it must
3316                  * contain only valid characters.
3317                  */
3318                 if (cp == NULL || snapshot_namecheck(cp + 1, NULL, NULL) != 0)
3319                         return (EINVAL);
3320 
3321                 /*
3322                  * The snap must be in the specified pool.
3323                  */
3324                 if (strncmp(name, poolname, poollen) != 0 ||
3325                     (name[poollen] != '/' && name[poollen] != '@'))
3326                         return (EXDEV);
3327 
3328                 /* This must be the only snap of this fs. */
3329                 for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3330                     pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3331                         if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3332                             == 0) {
3333                                 return (EXDEV);
3334                         }
3335                 }
3336         }
3337 
3338         error = dmu_objset_snapshot(snaps, props, outnvl);
3339         return (error);
3340 }
3341 
3342 /*
3343  * innvl: "message" -> string
3344  */
3345 /* ARGSUSED */
3346 static int
3347 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3348 {
3349         char *message;
3350         spa_t *spa;
3351         int error;
3352         char *poolname;
3353 
3354         /*
3355          * The poolname in the ioctl is not set, we get it from the TSD,
3356          * which was set at the end of the last successful ioctl that allows
3357          * logging.  The secpolicy func already checked that it is set.
3358          * Only one log ioctl is allowed after each successful ioctl, so
3359          * we clear the TSD here.
3360          */
3361         poolname = tsd_get(zfs_allow_log_key);
3362         (void) tsd_set(zfs_allow_log_key, NULL);
3363         error = spa_open(poolname, &spa, FTAG);
3364         strfree(poolname);
3365         if (error != 0)
3366                 return (error);
3367 
3368         if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3369                 spa_close(spa, FTAG);
3370                 return (EINVAL);
3371         }
3372 
3373         if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3374                 spa_close(spa, FTAG);
3375                 return (ENOTSUP);
3376         }
3377 
3378         error = spa_history_log(spa, message);
3379         spa_close(spa, FTAG);
3380         return (error);
3381 }
3382 
3383 /* ARGSUSED */
3384 int
3385 zfs_unmount_snap(const char *name, void *arg)
3386 {
3387         vfs_t *vfsp;
3388         int err;
3389 
3390         if (strchr(name, '@') == NULL)
3391                 return (0);
3392 
3393         vfsp = zfs_get_vfs(name);
3394         if (vfsp == NULL)
3395                 return (0);
3396 
3397         if ((err = vn_vfswlock(vfsp->vfs_vnodecovered)) != 0) {
3398                 VFS_RELE(vfsp);
3399                 return (err);
3400         }
3401         VFS_RELE(vfsp);
3402 
3403         /*
3404          * Always force the unmount for snapshots.
3405          */
3406         return (dounmount(vfsp, MS_FORCE, kcred));
3407 }
3408 
3409 /*
3410  * innvl: {
3411  *     "snaps" -> { snapshot1, snapshot2 }
3412  *     (optional boolean) "defer"
3413  * }
3414  *
3415  * outnvl: snapshot -> error code (int32)
3416  *
3417  */
3418 static int
3419 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3420 {
3421         int poollen;
3422         nvlist_t *snaps;
3423         nvpair_t *pair;
3424         boolean_t defer;
3425 
3426         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3427                 return (EINVAL);
3428         defer = nvlist_exists(innvl, "defer");
3429 
3430         poollen = strlen(poolname);
3431         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3432             pair = nvlist_next_nvpair(snaps, pair)) {
3433                 const char *name = nvpair_name(pair);
3434 
3435                 /*
3436                  * The snap must be in the specified pool.
3437                  */
3438                 if (strncmp(name, poolname, poollen) != 0 ||
3439                     (name[poollen] != '/' && name[poollen] != '@'))
3440                         return (EXDEV);
3441 
3442                 /*
3443                  * Ignore failures to unmount; dmu_snapshots_destroy_nvl()
3444                  * will deal with this gracefully (by filling in outnvl).
3445                  */
3446                 (void) zfs_unmount_snap(name, NULL);
3447         }
3448 
3449         return (dmu_snapshots_destroy_nvl(snaps, defer, outnvl));
3450 }
3451 
3452 /*
3453  * inputs:
3454  * zc_name              name of dataset to destroy
3455  * zc_objset_type       type of objset
3456  * zc_defer_destroy     mark for deferred destroy
3457  *
3458  * outputs:             none
3459  */
3460 static int
3461 zfs_ioc_destroy(zfs_cmd_t *zc)
3462 {
3463         int err;
3464         if (strchr(zc->zc_name, '@') && zc->zc_objset_type == DMU_OST_ZFS) {
3465                 err = zfs_unmount_snap(zc->zc_name, NULL);
3466                 if (err)
3467                         return (err);
3468         }
3469 
3470         err = dmu_objset_destroy(zc->zc_name, zc->zc_defer_destroy);
3471         if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3472                 (void) zvol_remove_minor(zc->zc_name);
3473         return (err);
3474 }
3475 
3476 /*
3477  * inputs:
3478  * zc_name      name of dataset to rollback (to most recent snapshot)
3479  *
3480  * outputs:     none
3481  */
3482 static int
3483 zfs_ioc_rollback(zfs_cmd_t *zc)
3484 {
3485         dsl_dataset_t *ds, *clone;
3486         int error;
3487         zfsvfs_t *zfsvfs;
3488         char *clone_name;
3489 
3490         error = dsl_dataset_hold(zc->zc_name, FTAG, &ds);
3491         if (error)
3492                 return (error);
3493 
3494         /* must not be a snapshot */
3495         if (dsl_dataset_is_snapshot(ds)) {
3496                 dsl_dataset_rele(ds, FTAG);
3497                 return (EINVAL);
3498         }
3499 
3500         /* must have a most recent snapshot */
3501         if (ds->ds_phys->ds_prev_snap_txg < TXG_INITIAL) {
3502                 dsl_dataset_rele(ds, FTAG);
3503                 return (EINVAL);
3504         }
3505 
3506         /*
3507          * Create clone of most recent snapshot.
3508          */
3509         clone_name = kmem_asprintf("%s/%%rollback", zc->zc_name);
3510         error = dmu_objset_clone(clone_name, ds->ds_prev, DS_FLAG_INCONSISTENT);
3511         if (error)
3512                 goto out;
3513 
3514         error = dsl_dataset_own(clone_name, B_TRUE, FTAG, &clone);
3515         if (error)
3516                 goto out;
3517 
3518         /*
3519          * Do clone swap.
3520          */
3521         if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
3522                 error = zfs_suspend_fs(zfsvfs);
3523                 if (error == 0) {
3524                         int resume_err;
3525 
3526                         if (dsl_dataset_tryown(ds, B_FALSE, FTAG)) {
3527                                 error = dsl_dataset_clone_swap(clone, ds,
3528                                     B_TRUE);
3529                                 dsl_dataset_disown(ds, FTAG);
3530                                 ds = NULL;
3531                         } else {
3532                                 error = EBUSY;
3533                         }
3534                         resume_err = zfs_resume_fs(zfsvfs, zc->zc_name);
3535                         error = error ? error : resume_err;
3536                 }
3537                 VFS_RELE(zfsvfs->z_vfs);
3538         } else {
3539                 if (dsl_dataset_tryown(ds, B_FALSE, FTAG)) {
3540                         error = dsl_dataset_clone_swap(clone, ds, B_TRUE);
3541                         dsl_dataset_disown(ds, FTAG);
3542                         ds = NULL;
3543                 } else {
3544                         error = EBUSY;
3545                 }
3546         }
3547 
3548         /*
3549          * Destroy clone (which also closes it).
3550          */
3551         (void) dsl_dataset_destroy(clone, FTAG, B_FALSE);
3552 
3553 out:
3554         strfree(clone_name);
3555         if (ds)
3556                 dsl_dataset_rele(ds, FTAG);
3557         return (error);
3558 }
3559 
3560 /*
3561  * inputs:
3562  * zc_name      old name of dataset
3563  * zc_value     new name of dataset
3564  * zc_cookie    recursive flag (only valid for snapshots)
3565  *
3566  * outputs:     none
3567  */
3568 static int
3569 zfs_ioc_rename(zfs_cmd_t *zc)
3570 {
3571         boolean_t recursive = zc->zc_cookie & 1;
3572 
3573         zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3574         if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3575             strchr(zc->zc_value, '%'))
3576                 return (EINVAL);
3577 
3578         /*
3579          * Unmount snapshot unless we're doing a recursive rename,
3580          * in which case the dataset code figures out which snapshots
3581          * to unmount.
3582          */
3583         if (!recursive && strchr(zc->zc_name, '@') != NULL &&
3584             zc->zc_objset_type == DMU_OST_ZFS) {
3585                 int err = zfs_unmount_snap(zc->zc_name, NULL);
3586                 if (err)
3587                         return (err);
3588         }
3589         if (zc->zc_objset_type == DMU_OST_ZVOL)
3590                 (void) zvol_remove_minor(zc->zc_name);
3591         return (dmu_objset_rename(zc->zc_name, zc->zc_value, recursive));
3592 }
3593 
3594 static int
3595 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3596 {
3597         const char *propname = nvpair_name(pair);
3598         boolean_t issnap = (strchr(dsname, '@') != NULL);
3599         zfs_prop_t prop = zfs_name_to_prop(propname);
3600         uint64_t intval;
3601         int err;
3602 
3603         if (prop == ZPROP_INVAL) {
3604                 if (zfs_prop_user(propname)) {
3605                         if (err = zfs_secpolicy_write_perms(dsname,
3606                             ZFS_DELEG_PERM_USERPROP, cr))
3607                                 return (err);
3608                         return (0);
3609                 }
3610 
3611                 if (!issnap && zfs_prop_userquota(propname)) {
3612                         const char *perm = NULL;
3613                         const char *uq_prefix =
3614                             zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3615                         const char *gq_prefix =
3616                             zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3617 
3618                         if (strncmp(propname, uq_prefix,
3619                             strlen(uq_prefix)) == 0) {
3620                                 perm = ZFS_DELEG_PERM_USERQUOTA;
3621                         } else if (strncmp(propname, gq_prefix,
3622                             strlen(gq_prefix)) == 0) {
3623                                 perm = ZFS_DELEG_PERM_GROUPQUOTA;
3624                         } else {
3625                                 /* USERUSED and GROUPUSED are read-only */
3626                                 return (EINVAL);
3627                         }
3628 
3629                         if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3630                                 return (err);
3631                         return (0);
3632                 }
3633 
3634                 return (EINVAL);
3635         }
3636 
3637         if (issnap)
3638                 return (EINVAL);
3639 
3640         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3641                 /*
3642                  * dsl_prop_get_all_impl() returns properties in this
3643                  * format.
3644                  */
3645                 nvlist_t *attrs;
3646                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3647                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3648                     &pair) == 0);
3649         }
3650 
3651         /*
3652          * Check that this value is valid for this pool version
3653          */
3654         switch (prop) {
3655         case ZFS_PROP_COMPRESSION:
3656                 /*
3657                  * If the user specified gzip compression, make sure
3658                  * the SPA supports it. We ignore any errors here since
3659                  * we'll catch them later.
3660                  */
3661                 if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3662                     nvpair_value_uint64(pair, &intval) == 0) {
3663                         if (intval >= ZIO_COMPRESS_GZIP_1 &&
3664                             intval <= ZIO_COMPRESS_GZIP_9 &&
3665                             zfs_earlier_version(dsname,
3666                             SPA_VERSION_GZIP_COMPRESSION)) {
3667                                 return (ENOTSUP);
3668                         }
3669 
3670                         if (intval == ZIO_COMPRESS_ZLE &&
3671                             zfs_earlier_version(dsname,
3672                             SPA_VERSION_ZLE_COMPRESSION))
3673                                 return (ENOTSUP);
3674 
3675                         /*
3676                          * If this is a bootable dataset then
3677                          * verify that the compression algorithm
3678                          * is supported for booting. We must return
3679                          * something other than ENOTSUP since it
3680                          * implies a downrev pool version.
3681                          */
3682                         if (zfs_is_bootfs(dsname) &&
3683                             !BOOTFS_COMPRESS_VALID(intval)) {
3684                                 return (ERANGE);
3685                         }
3686                 }
3687                 break;
3688 
3689         case ZFS_PROP_COPIES:
3690                 if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3691                         return (ENOTSUP);
3692                 break;
3693 
3694         case ZFS_PROP_DEDUP:
3695                 if (zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3696                         return (ENOTSUP);
3697                 break;
3698 
3699         case ZFS_PROP_SHARESMB:
3700                 if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3701                         return (ENOTSUP);
3702                 break;
3703 
3704         case ZFS_PROP_ACLINHERIT:
3705                 if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3706                     nvpair_value_uint64(pair, &intval) == 0) {
3707                         if (intval == ZFS_ACL_PASSTHROUGH_X &&
3708                             zfs_earlier_version(dsname,
3709                             SPA_VERSION_PASSTHROUGH_X))
3710                                 return (ENOTSUP);
3711                 }
3712                 break;
3713         }
3714 
3715         return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3716 }
3717 
3718 /*
3719  * Removes properties from the given props list that fail permission checks
3720  * needed to clear them and to restore them in case of a receive error. For each
3721  * property, make sure we have both set and inherit permissions.
3722  *
3723  * Returns the first error encountered if any permission checks fail. If the
3724  * caller provides a non-NULL errlist, it also gives the complete list of names
3725  * of all the properties that failed a permission check along with the
3726  * corresponding error numbers. The caller is responsible for freeing the
3727  * returned errlist.
3728  *
3729  * If every property checks out successfully, zero is returned and the list
3730  * pointed at by errlist is NULL.
3731  */
3732 static int
3733 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
3734 {
3735         zfs_cmd_t *zc;
3736         nvpair_t *pair, *next_pair;
3737         nvlist_t *errors;
3738         int err, rv = 0;
3739 
3740         if (props == NULL)
3741                 return (0);
3742 
3743         VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3744 
3745         zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
3746         (void) strcpy(zc->zc_name, dataset);
3747         pair = nvlist_next_nvpair(props, NULL);
3748         while (pair != NULL) {
3749                 next_pair = nvlist_next_nvpair(props, pair);
3750 
3751                 (void) strcpy(zc->zc_value, nvpair_name(pair));
3752                 if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
3753                     (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
3754                         VERIFY(nvlist_remove_nvpair(props, pair) == 0);
3755                         VERIFY(nvlist_add_int32(errors,
3756                             zc->zc_value, err) == 0);
3757                 }
3758                 pair = next_pair;
3759         }
3760         kmem_free(zc, sizeof (zfs_cmd_t));
3761 
3762         if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
3763                 nvlist_free(errors);
3764                 errors = NULL;
3765         } else {
3766                 VERIFY(nvpair_value_int32(pair, &rv) == 0);
3767         }
3768 
3769         if (errlist == NULL)
3770                 nvlist_free(errors);
3771         else
3772                 *errlist = errors;
3773 
3774         return (rv);
3775 }
3776 
3777 static boolean_t
3778 propval_equals(nvpair_t *p1, nvpair_t *p2)
3779 {
3780         if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
3781                 /* dsl_prop_get_all_impl() format */
3782                 nvlist_t *attrs;
3783                 VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
3784                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3785                     &p1) == 0);
3786         }
3787 
3788         if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
3789                 nvlist_t *attrs;
3790                 VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
3791                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3792                     &p2) == 0);
3793         }
3794 
3795         if (nvpair_type(p1) != nvpair_type(p2))
3796                 return (B_FALSE);
3797 
3798         if (nvpair_type(p1) == DATA_TYPE_STRING) {
3799                 char *valstr1, *valstr2;
3800 
3801                 VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
3802                 VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
3803                 return (strcmp(valstr1, valstr2) == 0);
3804         } else {
3805                 uint64_t intval1, intval2;
3806 
3807                 VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
3808                 VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
3809                 return (intval1 == intval2);
3810         }
3811 }
3812 
3813 /*
3814  * Remove properties from props if they are not going to change (as determined
3815  * by comparison with origprops). Remove them from origprops as well, since we
3816  * do not need to clear or restore properties that won't change.
3817  */
3818 static void
3819 props_reduce(nvlist_t *props, nvlist_t *origprops)
3820 {
3821         nvpair_t *pair, *next_pair;
3822 
3823         if (origprops == NULL)
3824                 return; /* all props need to be received */
3825 
3826         pair = nvlist_next_nvpair(props, NULL);
3827         while (pair != NULL) {
3828                 const char *propname = nvpair_name(pair);
3829                 nvpair_t *match;
3830 
3831                 next_pair = nvlist_next_nvpair(props, pair);
3832 
3833                 if ((nvlist_lookup_nvpair(origprops, propname,
3834                     &match) != 0) || !propval_equals(pair, match))
3835                         goto next; /* need to set received value */
3836 
3837                 /* don't clear the existing received value */
3838                 (void) nvlist_remove_nvpair(origprops, match);
3839                 /* don't bother receiving the property */
3840                 (void) nvlist_remove_nvpair(props, pair);
3841 next:
3842                 pair = next_pair;
3843         }
3844 }
3845 
3846 #ifdef  DEBUG
3847 static boolean_t zfs_ioc_recv_inject_err;
3848 #endif
3849 
3850 /*
3851  * inputs:
3852  * zc_name              name of containing filesystem
3853  * zc_nvlist_src{_size} nvlist of properties to apply
3854  * zc_value             name of snapshot to create
3855  * zc_string            name of clone origin (if DRR_FLAG_CLONE)
3856  * zc_cookie            file descriptor to recv from
3857  * zc_begin_record      the BEGIN record of the stream (not byteswapped)
3858  * zc_guid              force flag
3859  * zc_cleanup_fd        cleanup-on-exit file descriptor
3860  * zc_action_handle     handle for this guid/ds mapping (or zero on first call)
3861  *
3862  * outputs:
3863  * zc_cookie            number of bytes read
3864  * zc_nvlist_dst{_size} error for each unapplied received property
3865  * zc_obj               zprop_errflags_t
3866  * zc_action_handle     handle for this guid/ds mapping
3867  */
3868 static int
3869 zfs_ioc_recv(zfs_cmd_t *zc)
3870 {
3871         file_t *fp;
3872         objset_t *os;
3873         dmu_recv_cookie_t drc;
3874         boolean_t force = (boolean_t)zc->zc_guid;
3875         int fd;
3876         int error = 0;
3877         int props_error = 0;
3878         nvlist_t *errors;
3879         offset_t off;
3880         nvlist_t *props = NULL; /* sent properties */
3881         nvlist_t *origprops = NULL; /* existing properties */
3882         objset_t *origin = NULL;
3883         char *tosnap;
3884         char tofs[ZFS_MAXNAMELEN];
3885         boolean_t first_recvd_props = B_FALSE;
3886 
3887         if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3888             strchr(zc->zc_value, '@') == NULL ||
3889             strchr(zc->zc_value, '%'))
3890                 return (EINVAL);
3891 
3892         (void) strcpy(tofs, zc->zc_value);
3893         tosnap = strchr(tofs, '@');
3894         *tosnap++ = '\0';
3895 
3896         if (zc->zc_nvlist_src != NULL &&
3897             (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3898             zc->zc_iflags, &props)) != 0)
3899                 return (error);
3900 
3901         fd = zc->zc_cookie;
3902         fp = getf(fd);
3903         if (fp == NULL) {
3904                 nvlist_free(props);
3905                 return (EBADF);
3906         }
3907 
3908         VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3909 
3910         if (props && dmu_objset_hold(tofs, FTAG, &os) == 0) {
3911                 if ((spa_version(os->os_spa) >= SPA_VERSION_RECVD_PROPS) &&
3912                     !dsl_prop_get_hasrecvd(os)) {
3913                         first_recvd_props = B_TRUE;
3914                 }
3915 
3916                 /*
3917                  * If new received properties are supplied, they are to
3918                  * completely replace the existing received properties, so stash
3919                  * away the existing ones.
3920                  */
3921                 if (dsl_prop_get_received(os, &origprops) == 0) {
3922                         nvlist_t *errlist = NULL;
3923                         /*
3924                          * Don't bother writing a property if its value won't
3925                          * change (and avoid the unnecessary security checks).
3926                          *
3927                          * The first receive after SPA_VERSION_RECVD_PROPS is a
3928                          * special case where we blow away all local properties
3929                          * regardless.
3930                          */
3931                         if (!first_recvd_props)
3932                                 props_reduce(props, origprops);
3933                         if (zfs_check_clearable(tofs, origprops,
3934                             &errlist) != 0)
3935                                 (void) nvlist_merge(errors, errlist, 0);
3936                         nvlist_free(errlist);
3937                 }
3938 
3939                 dmu_objset_rele(os, FTAG);
3940         }
3941 
3942         if (zc->zc_string[0]) {
3943                 error = dmu_objset_hold(zc->zc_string, FTAG, &origin);
3944                 if (error)
3945                         goto out;
3946         }
3947 
3948         error = dmu_recv_begin(tofs, tosnap, zc->zc_top_ds,
3949             &zc->zc_begin_record, force, origin, &drc);
3950         if (origin)
3951                 dmu_objset_rele(origin, FTAG);
3952         if (error)
3953                 goto out;
3954 
3955         /*
3956          * Set properties before we receive the stream so that they are applied
3957          * to the new data. Note that we must call dmu_recv_stream() if
3958          * dmu_recv_begin() succeeds.
3959          */
3960         if (props) {
3961                 if (dmu_objset_from_ds(drc.drc_logical_ds, &os) == 0) {
3962                         if (drc.drc_newfs) {
3963                                 if (spa_version(os->os_spa) >=
3964                                     SPA_VERSION_RECVD_PROPS)
3965                                         first_recvd_props = B_TRUE;
3966                         } else if (origprops != NULL) {
3967                                 if (clear_received_props(os, tofs, origprops,
3968                                     first_recvd_props ? NULL : props) != 0)
3969                                         zc->zc_obj |= ZPROP_ERR_NOCLEAR;
3970                         } else {
3971                                 zc->zc_obj |= ZPROP_ERR_NOCLEAR;
3972                         }
3973                         dsl_prop_set_hasrecvd(os);
3974                 } else if (!drc.drc_newfs) {
3975                         zc->zc_obj |= ZPROP_ERR_NOCLEAR;
3976                 }
3977 
3978                 (void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
3979                     props, errors);
3980         }
3981 
3982         if (zc->zc_nvlist_dst_size != 0 &&
3983             (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
3984             put_nvlist(zc, errors) != 0)) {
3985                 /*
3986                  * Caller made zc->zc_nvlist_dst less than the minimum expected
3987                  * size or supplied an invalid address.
3988                  */
3989                 props_error = EINVAL;
3990         }
3991 
3992         off = fp->f_offset;
3993         error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
3994             &zc->zc_action_handle);
3995 
3996         if (error == 0) {
3997                 zfsvfs_t *zfsvfs = NULL;
3998 
3999                 if (getzfsvfs(tofs, &zfsvfs) == 0) {
4000                         /* online recv */
4001                         int end_err;
4002 
4003                         error = zfs_suspend_fs(zfsvfs);
4004                         /*
4005                          * If the suspend fails, then the recv_end will
4006                          * likely also fail, and clean up after itself.
4007                          */
4008                         end_err = dmu_recv_end(&drc);
4009                         if (error == 0)
4010                                 error = zfs_resume_fs(zfsvfs, tofs);
4011                         error = error ? error : end_err;
4012                         VFS_RELE(zfsvfs->z_vfs);
4013                 } else {
4014                         error = dmu_recv_end(&drc);
4015                 }
4016         }
4017 
4018         zc->zc_cookie = off - fp->f_offset;
4019         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4020                 fp->f_offset = off;
4021 
4022 #ifdef  DEBUG
4023         if (zfs_ioc_recv_inject_err) {
4024                 zfs_ioc_recv_inject_err = B_FALSE;
4025                 error = 1;
4026         }
4027 #endif
4028         /*
4029          * On error, restore the original props.
4030          */
4031         if (error && props) {
4032                 if (dmu_objset_hold(tofs, FTAG, &os) == 0) {
4033                         if (clear_received_props(os, tofs, props, NULL) != 0) {
4034                                 /*
4035                                  * We failed to clear the received properties.
4036                                  * Since we may have left a $recvd value on the
4037                                  * system, we can't clear the $hasrecvd flag.
4038                                  */
4039                                 zc->zc_obj |= ZPROP_ERR_NORESTORE;
4040                         } else if (first_recvd_props) {
4041                                 dsl_prop_unset_hasrecvd(os);
4042                         }
4043                         dmu_objset_rele(os, FTAG);
4044                 } else if (!drc.drc_newfs) {
4045                         /* We failed to clear the received properties. */
4046                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4047                 }
4048 
4049                 if (origprops == NULL && !drc.drc_newfs) {
4050                         /* We failed to stash the original properties. */
4051                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4052                 }
4053 
4054                 /*
4055                  * dsl_props_set() will not convert RECEIVED to LOCAL on or
4056                  * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4057                  * explictly if we're restoring local properties cleared in the
4058                  * first new-style receive.
4059                  */
4060                 if (origprops != NULL &&
4061                     zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4062                     ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4063                     origprops, NULL) != 0) {
4064                         /*
4065                          * We stashed the original properties but failed to
4066                          * restore them.
4067                          */
4068                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4069                 }
4070         }
4071 out:
4072         nvlist_free(props);
4073         nvlist_free(origprops);
4074         nvlist_free(errors);
4075         releasef(fd);
4076 
4077         if (error == 0)
4078                 error = props_error;
4079 
4080         return (error);
4081 }
4082 
4083 /*
4084  * inputs:
4085  * zc_name      name of snapshot to send
4086  * zc_cookie    file descriptor to send stream to
4087  * zc_obj       fromorigin flag (mutually exclusive with zc_fromobj)
4088  * zc_sendobj   objsetid of snapshot to send
4089  * zc_fromobj   objsetid of incremental fromsnap (may be zero)
4090  * zc_guid      if set, estimate size of stream only.  zc_cookie is ignored.
4091  *              output size in zc_objset_type.
4092  *
4093  * outputs: none
4094  */
4095 static int
4096 zfs_ioc_send(zfs_cmd_t *zc)
4097 {
4098         objset_t *fromsnap = NULL;
4099         objset_t *tosnap;
4100         int error;
4101         offset_t off;
4102         dsl_dataset_t *ds;
4103         dsl_dataset_t *dsfrom = NULL;
4104         spa_t *spa;
4105         dsl_pool_t *dp;
4106         boolean_t estimate = (zc->zc_guid != 0);
4107 
4108         error = spa_open(zc->zc_name, &spa, FTAG);
4109         if (error)
4110                 return (error);
4111 
4112         dp = spa_get_dsl(spa);
4113         rw_enter(&dp->dp_config_rwlock, RW_READER);
4114         error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
4115         rw_exit(&dp->dp_config_rwlock);
4116         spa_close(spa, FTAG);
4117         if (error)
4118                 return (error);
4119 
4120         error = dmu_objset_from_ds(ds, &tosnap);
4121         if (error) {
4122                 dsl_dataset_rele(ds, FTAG);
4123                 return (error);
4124         }
4125 
4126         if (zc->zc_fromobj != 0) {
4127                 rw_enter(&dp->dp_config_rwlock, RW_READER);
4128                 error = dsl_dataset_hold_obj(dp, zc->zc_fromobj, FTAG, &dsfrom);
4129                 rw_exit(&dp->dp_config_rwlock);
4130                 if (error) {
4131                         dsl_dataset_rele(ds, FTAG);
4132                         return (error);
4133                 }
4134                 error = dmu_objset_from_ds(dsfrom, &fromsnap);
4135                 if (error) {
4136                         dsl_dataset_rele(dsfrom, FTAG);
4137                         dsl_dataset_rele(ds, FTAG);
4138                         return (error);
4139                 }
4140         }
4141 
4142         if (zc->zc_obj) {
4143                 dsl_pool_t *dp = ds->ds_dir->dd_pool;
4144 
4145                 if (fromsnap != NULL) {
4146                         dsl_dataset_rele(dsfrom, FTAG);
4147                         dsl_dataset_rele(ds, FTAG);
4148                         return (EINVAL);
4149                 }
4150 
4151                 if (dsl_dir_is_clone(ds->ds_dir)) {
4152                         rw_enter(&dp->dp_config_rwlock, RW_READER);
4153                         error = dsl_dataset_hold_obj(dp,
4154                             ds->ds_dir->dd_phys->dd_origin_obj, FTAG, &dsfrom);
4155                         rw_exit(&dp->dp_config_rwlock);
4156                         if (error) {
4157                                 dsl_dataset_rele(ds, FTAG);
4158                                 return (error);
4159                         }
4160                         error = dmu_objset_from_ds(dsfrom, &fromsnap);
4161                         if (error) {
4162                                 dsl_dataset_rele(dsfrom, FTAG);
4163                                 dsl_dataset_rele(ds, FTAG);
4164                                 return (error);
4165                         }
4166                 }
4167         }
4168 
4169         if (estimate) {
4170                 error = dmu_send_estimate(tosnap, fromsnap,
4171                     &zc->zc_objset_type);
4172         } else {
4173                 file_t *fp = getf(zc->zc_cookie);
4174                 if (fp == NULL) {
4175                         dsl_dataset_rele(ds, FTAG);
4176                         if (dsfrom)
4177                                 dsl_dataset_rele(dsfrom, FTAG);
4178                         return (EBADF);
4179                 }
4180 
4181                 off = fp->f_offset;
4182                 error = dmu_send(tosnap, fromsnap,
4183                     zc->zc_cookie, fp->f_vnode, &off);
4184 
4185                 if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4186                         fp->f_offset = off;
4187                 releasef(zc->zc_cookie);
4188         }
4189         if (dsfrom)
4190                 dsl_dataset_rele(dsfrom, FTAG);
4191         dsl_dataset_rele(ds, FTAG);
4192         return (error);
4193 }
4194 
4195 /*
4196  * inputs:
4197  * zc_name      name of snapshot on which to report progress
4198  * zc_cookie    file descriptor of send stream
4199  *
4200  * outputs:
4201  * zc_cookie    number of bytes written in send stream thus far
4202  */
4203 static int
4204 zfs_ioc_send_progress(zfs_cmd_t *zc)
4205 {
4206         dsl_dataset_t *ds;
4207         dmu_sendarg_t *dsp = NULL;
4208         int error;
4209 
4210         if ((error = dsl_dataset_hold(zc->zc_name, FTAG, &ds)) != 0)
4211                 return (error);
4212 
4213         mutex_enter(&ds->ds_sendstream_lock);
4214 
4215         /*
4216          * Iterate over all the send streams currently active on this dataset.
4217          * If there's one which matches the specified file descriptor _and_ the
4218          * stream was started by the current process, return the progress of
4219          * that stream.
4220          */
4221         for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4222             dsp = list_next(&ds->ds_sendstreams, dsp)) {
4223                 if (dsp->dsa_outfd == zc->zc_cookie &&
4224                     dsp->dsa_proc == curproc)
4225                         break;
4226         }
4227 
4228         if (dsp != NULL)
4229                 zc->zc_cookie = *(dsp->dsa_off);
4230         else
4231                 error = ENOENT;
4232 
4233         mutex_exit(&ds->ds_sendstream_lock);
4234         dsl_dataset_rele(ds, FTAG);
4235         return (error);
4236 }
4237 
4238 static int
4239 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4240 {
4241         int id, error;
4242 
4243         error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4244             &zc->zc_inject_record);
4245 
4246         if (error == 0)
4247                 zc->zc_guid = (uint64_t)id;
4248 
4249         return (error);
4250 }
4251 
4252 static int
4253 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4254 {
4255         return (zio_clear_fault((int)zc->zc_guid));
4256 }
4257 
4258 static int
4259 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4260 {
4261         int id = (int)zc->zc_guid;
4262         int error;
4263 
4264         error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4265             &zc->zc_inject_record);
4266 
4267         zc->zc_guid = id;
4268 
4269         return (error);
4270 }
4271 
4272 static int
4273 zfs_ioc_error_log(zfs_cmd_t *zc)
4274 {
4275         spa_t *spa;
4276         int error;
4277         size_t count = (size_t)zc->zc_nvlist_dst_size;
4278 
4279         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4280                 return (error);
4281 
4282         error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4283             &count);
4284         if (error == 0)
4285                 zc->zc_nvlist_dst_size = count;
4286         else
4287                 zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4288 
4289         spa_close(spa, FTAG);
4290 
4291         return (error);
4292 }
4293 
4294 static int
4295 zfs_ioc_clear(zfs_cmd_t *zc)
4296 {
4297         spa_t *spa;
4298         vdev_t *vd;
4299         int error;
4300 
4301         /*
4302          * On zpool clear we also fix up missing slogs
4303          */
4304         mutex_enter(&spa_namespace_lock);
4305         spa = spa_lookup(zc->zc_name);
4306         if (spa == NULL) {
4307                 mutex_exit(&spa_namespace_lock);
4308                 return (EIO);
4309         }
4310         if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4311                 /* we need to let spa_open/spa_load clear the chains */
4312                 spa_set_log_state(spa, SPA_LOG_CLEAR);
4313         }
4314         spa->spa_last_open_failed = 0;
4315         mutex_exit(&spa_namespace_lock);
4316 
4317         if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4318                 error = spa_open(zc->zc_name, &spa, FTAG);
4319         } else {
4320                 nvlist_t *policy;
4321                 nvlist_t *config = NULL;
4322 
4323                 if (zc->zc_nvlist_src == NULL)
4324                         return (EINVAL);
4325 
4326                 if ((error = get_nvlist(zc->zc_nvlist_src,
4327                     zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4328                         error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4329                             policy, &config);
4330                         if (config != NULL) {
4331                                 int err;
4332 
4333                                 if ((err = put_nvlist(zc, config)) != 0)
4334                                         error = err;
4335                                 nvlist_free(config);
4336                         }
4337                         nvlist_free(policy);
4338                 }
4339         }
4340 
4341         if (error)
4342                 return (error);
4343 
4344         spa_vdev_state_enter(spa, SCL_NONE);
4345 
4346         if (zc->zc_guid == 0) {
4347                 vd = NULL;
4348         } else {
4349                 vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4350                 if (vd == NULL) {
4351                         (void) spa_vdev_state_exit(spa, NULL, ENODEV);
4352                         spa_close(spa, FTAG);
4353                         return (ENODEV);
4354                 }
4355         }
4356 
4357         vdev_clear(spa, vd);
4358 
4359         (void) spa_vdev_state_exit(spa, NULL, 0);
4360 
4361         /*
4362          * Resume any suspended I/Os.
4363          */
4364         if (zio_resume(spa) != 0)
4365                 error = EIO;
4366 
4367         spa_close(spa, FTAG);
4368 
4369         return (error);
4370 }
4371 
4372 static int
4373 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4374 {
4375         spa_t *spa;
4376         int error;
4377 
4378         error = spa_open(zc->zc_name, &spa, FTAG);
4379         if (error)
4380                 return (error);
4381 
4382         spa_vdev_state_enter(spa, SCL_NONE);
4383 
4384         /*
4385          * If a resilver is already in progress then set the
4386          * spa_scrub_reopen flag to B_TRUE so that we don't restart
4387          * the scan as a side effect of the reopen. Otherwise, let
4388          * vdev_open() decided if a resilver is required.
4389          */
4390         spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4391         vdev_reopen(spa->spa_root_vdev);
4392         spa->spa_scrub_reopen = B_FALSE;
4393 
4394         (void) spa_vdev_state_exit(spa, NULL, 0);
4395         spa_close(spa, FTAG);
4396         return (0);
4397 }
4398 /*
4399  * inputs:
4400  * zc_name      name of filesystem
4401  * zc_value     name of origin snapshot
4402  *
4403  * outputs:
4404  * zc_string    name of conflicting snapshot, if there is one
4405  */
4406 static int
4407 zfs_ioc_promote(zfs_cmd_t *zc)
4408 {
4409         char *cp;
4410 
4411         /*
4412          * We don't need to unmount *all* the origin fs's snapshots, but
4413          * it's easier.
4414          */
4415         cp = strchr(zc->zc_value, '@');
4416         if (cp)
4417                 *cp = '\0';
4418         (void) dmu_objset_find(zc->zc_value,
4419             zfs_unmount_snap, NULL, DS_FIND_SNAPSHOTS);
4420         return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4421 }
4422 
4423 /*
4424  * Retrieve a single {user|group}{used|quota}@... property.
4425  *
4426  * inputs:
4427  * zc_name      name of filesystem
4428  * zc_objset_type zfs_userquota_prop_t
4429  * zc_value     domain name (eg. "S-1-234-567-89")
4430  * zc_guid      RID/UID/GID
4431  *
4432  * outputs:
4433  * zc_cookie    property value
4434  */
4435 static int
4436 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4437 {
4438         zfsvfs_t *zfsvfs;
4439         int error;
4440 
4441         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4442                 return (EINVAL);
4443 
4444         error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4445         if (error)
4446                 return (error);
4447 
4448         error = zfs_userspace_one(zfsvfs,
4449             zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4450         zfsvfs_rele(zfsvfs, FTAG);
4451 
4452         return (error);
4453 }
4454 
4455 /*
4456  * inputs:
4457  * zc_name              name of filesystem
4458  * zc_cookie            zap cursor
4459  * zc_objset_type       zfs_userquota_prop_t
4460  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4461  *
4462  * outputs:
4463  * zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t)
4464  * zc_cookie    zap cursor
4465  */
4466 static int
4467 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4468 {
4469         zfsvfs_t *zfsvfs;
4470         int bufsize = zc->zc_nvlist_dst_size;
4471 
4472         if (bufsize <= 0)
4473                 return (ENOMEM);
4474 
4475         int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4476         if (error)
4477                 return (error);
4478 
4479         void *buf = kmem_alloc(bufsize, KM_SLEEP);
4480 
4481         error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4482             buf, &zc->zc_nvlist_dst_size);
4483 
4484         if (error == 0) {
4485                 error = xcopyout(buf,
4486                     (void *)(uintptr_t)zc->zc_nvlist_dst,
4487                     zc->zc_nvlist_dst_size);
4488         }
4489         kmem_free(buf, bufsize);
4490         zfsvfs_rele(zfsvfs, FTAG);
4491 
4492         return (error);
4493 }
4494 
4495 /*
4496  * inputs:
4497  * zc_name              name of filesystem
4498  *
4499  * outputs:
4500  * none
4501  */
4502 static int
4503 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4504 {
4505         objset_t *os;
4506         int error = 0;
4507         zfsvfs_t *zfsvfs;
4508 
4509         if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4510                 if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4511                         /*
4512                          * If userused is not enabled, it may be because the
4513                          * objset needs to be closed & reopened (to grow the
4514                          * objset_phys_t).  Suspend/resume the fs will do that.
4515                          */
4516                         error = zfs_suspend_fs(zfsvfs);
4517                         if (error == 0)
4518                                 error = zfs_resume_fs(zfsvfs, zc->zc_name);
4519                 }
4520                 if (error == 0)
4521                         error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4522                 VFS_RELE(zfsvfs->z_vfs);
4523         } else {
4524                 /* XXX kind of reading contents without owning */
4525                 error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4526                 if (error)
4527                         return (error);
4528 
4529                 error = dmu_objset_userspace_upgrade(os);
4530                 dmu_objset_rele(os, FTAG);
4531         }
4532 
4533         return (error);
4534 }
4535 
4536 /*
4537  * We don't want to have a hard dependency
4538  * against some special symbols in sharefs
4539  * nfs, and smbsrv.  Determine them if needed when
4540  * the first file system is shared.
4541  * Neither sharefs, nfs or smbsrv are unloadable modules.
4542  */
4543 int (*znfsexport_fs)(void *arg);
4544 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4545 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4546 
4547 int zfs_nfsshare_inited;
4548 int zfs_smbshare_inited;
4549 
4550 ddi_modhandle_t nfs_mod;
4551 ddi_modhandle_t sharefs_mod;
4552 ddi_modhandle_t smbsrv_mod;
4553 kmutex_t zfs_share_lock;
4554 
4555 static int
4556 zfs_init_sharefs()
4557 {
4558         int error;
4559 
4560         ASSERT(MUTEX_HELD(&zfs_share_lock));
4561         /* Both NFS and SMB shares also require sharetab support. */
4562         if (sharefs_mod == NULL && ((sharefs_mod =
4563             ddi_modopen("fs/sharefs",
4564             KRTLD_MODE_FIRST, &error)) == NULL)) {
4565                 return (ENOSYS);
4566         }
4567         if (zshare_fs == NULL && ((zshare_fs =
4568             (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4569             ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4570                 return (ENOSYS);
4571         }
4572         return (0);
4573 }
4574 
4575 static int
4576 zfs_ioc_share(zfs_cmd_t *zc)
4577 {
4578         int error;
4579         int opcode;
4580 
4581         switch (zc->zc_share.z_sharetype) {
4582         case ZFS_SHARE_NFS:
4583         case ZFS_UNSHARE_NFS:
4584                 if (zfs_nfsshare_inited == 0) {
4585                         mutex_enter(&zfs_share_lock);
4586                         if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4587                             KRTLD_MODE_FIRST, &error)) == NULL)) {
4588                                 mutex_exit(&zfs_share_lock);
4589                                 return (ENOSYS);
4590                         }
4591                         if (znfsexport_fs == NULL &&
4592                             ((znfsexport_fs = (int (*)(void *))
4593                             ddi_modsym(nfs_mod,
4594                             "nfs_export", &error)) == NULL)) {
4595                                 mutex_exit(&zfs_share_lock);
4596                                 return (ENOSYS);
4597                         }
4598                         error = zfs_init_sharefs();
4599                         if (error) {
4600                                 mutex_exit(&zfs_share_lock);
4601                                 return (ENOSYS);
4602                         }
4603                         zfs_nfsshare_inited = 1;
4604                         mutex_exit(&zfs_share_lock);
4605                 }
4606                 break;
4607         case ZFS_SHARE_SMB:
4608         case ZFS_UNSHARE_SMB:
4609                 if (zfs_smbshare_inited == 0) {
4610                         mutex_enter(&zfs_share_lock);
4611                         if (smbsrv_mod == NULL && ((smbsrv_mod =
4612                             ddi_modopen("drv/smbsrv",
4613                             KRTLD_MODE_FIRST, &error)) == NULL)) {
4614                                 mutex_exit(&zfs_share_lock);
4615                                 return (ENOSYS);
4616                         }
4617                         if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4618                             (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4619                             "smb_server_share", &error)) == NULL)) {
4620                                 mutex_exit(&zfs_share_lock);
4621                                 return (ENOSYS);
4622                         }
4623                         error = zfs_init_sharefs();
4624                         if (error) {
4625                                 mutex_exit(&zfs_share_lock);
4626                                 return (ENOSYS);
4627                         }
4628                         zfs_smbshare_inited = 1;
4629                         mutex_exit(&zfs_share_lock);
4630                 }
4631                 break;
4632         default:
4633                 return (EINVAL);
4634         }
4635 
4636         switch (zc->zc_share.z_sharetype) {
4637         case ZFS_SHARE_NFS:
4638         case ZFS_UNSHARE_NFS:
4639                 if (error =
4640                     znfsexport_fs((void *)
4641                     (uintptr_t)zc->zc_share.z_exportdata))
4642                         return (error);
4643                 break;
4644         case ZFS_SHARE_SMB:
4645         case ZFS_UNSHARE_SMB:
4646                 if (error = zsmbexport_fs((void *)
4647                     (uintptr_t)zc->zc_share.z_exportdata,
4648                     zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
4649                     B_TRUE: B_FALSE)) {
4650                         return (error);
4651                 }
4652                 break;
4653         }
4654 
4655         opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
4656             zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
4657             SHAREFS_ADD : SHAREFS_REMOVE;
4658 
4659         /*
4660          * Add or remove share from sharetab
4661          */
4662         error = zshare_fs(opcode,
4663             (void *)(uintptr_t)zc->zc_share.z_sharedata,
4664             zc->zc_share.z_sharemax);
4665 
4666         return (error);
4667 
4668 }
4669 
4670 ace_t full_access[] = {
4671         {(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
4672 };
4673 
4674 /*
4675  * inputs:
4676  * zc_name              name of containing filesystem
4677  * zc_obj               object # beyond which we want next in-use object #
4678  *
4679  * outputs:
4680  * zc_obj               next in-use object #
4681  */
4682 static int
4683 zfs_ioc_next_obj(zfs_cmd_t *zc)
4684 {
4685         objset_t *os = NULL;
4686         int error;
4687 
4688         error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4689         if (error)
4690                 return (error);
4691 
4692         error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
4693             os->os_dsl_dataset->ds_phys->ds_prev_snap_txg);
4694 
4695         dmu_objset_rele(os, FTAG);
4696         return (error);
4697 }
4698 
4699 /*
4700  * inputs:
4701  * zc_name              name of filesystem
4702  * zc_value             prefix name for snapshot
4703  * zc_cleanup_fd        cleanup-on-exit file descriptor for calling process
4704  *
4705  * outputs:
4706  * zc_value             short name of new snapshot
4707  */
4708 static int
4709 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
4710 {
4711         char *snap_name;
4712         int error;
4713 
4714         snap_name = kmem_asprintf("%s@%s-%016llx", zc->zc_name, zc->zc_value,
4715             (u_longlong_t)ddi_get_lbolt64());
4716 
4717         if (strlen(snap_name) >= MAXPATHLEN) {
4718                 strfree(snap_name);
4719                 return (E2BIG);
4720         }
4721 
4722         error = dmu_objset_snapshot_tmp(snap_name, "%temp", zc->zc_cleanup_fd);
4723         if (error != 0) {
4724                 strfree(snap_name);
4725                 return (error);
4726         }
4727 
4728         (void) strcpy(zc->zc_value, strchr(snap_name, '@') + 1);
4729         strfree(snap_name);
4730         return (0);
4731 }
4732 
4733 /*
4734  * inputs:
4735  * zc_name              name of "to" snapshot
4736  * zc_value             name of "from" snapshot
4737  * zc_cookie            file descriptor to write diff data on
4738  *
4739  * outputs:
4740  * dmu_diff_record_t's to the file descriptor
4741  */
4742 static int
4743 zfs_ioc_diff(zfs_cmd_t *zc)
4744 {
4745         objset_t *fromsnap;
4746         objset_t *tosnap;
4747         file_t *fp;
4748         offset_t off;
4749         int error;
4750 
4751         error = dmu_objset_hold(zc->zc_name, FTAG, &tosnap);
4752         if (error)
4753                 return (error);
4754 
4755         error = dmu_objset_hold(zc->zc_value, FTAG, &fromsnap);
4756         if (error) {
4757                 dmu_objset_rele(tosnap, FTAG);
4758                 return (error);
4759         }
4760 
4761         fp = getf(zc->zc_cookie);
4762         if (fp == NULL) {
4763                 dmu_objset_rele(fromsnap, FTAG);
4764                 dmu_objset_rele(tosnap, FTAG);
4765                 return (EBADF);
4766         }
4767 
4768         off = fp->f_offset;
4769 
4770         error = dmu_diff(tosnap, fromsnap, fp->f_vnode, &off);
4771 
4772         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4773                 fp->f_offset = off;
4774         releasef(zc->zc_cookie);
4775 
4776         dmu_objset_rele(fromsnap, FTAG);
4777         dmu_objset_rele(tosnap, FTAG);
4778         return (error);
4779 }
4780 
4781 /*
4782  * Remove all ACL files in shares dir
4783  */
4784 static int
4785 zfs_smb_acl_purge(znode_t *dzp)
4786 {
4787         zap_cursor_t    zc;
4788         zap_attribute_t zap;
4789         zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
4790         int error;
4791 
4792         for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
4793             (error = zap_cursor_retrieve(&zc, &zap)) == 0;
4794             zap_cursor_advance(&zc)) {
4795                 if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
4796                     NULL, 0)) != 0)
4797                         break;
4798         }
4799         zap_cursor_fini(&zc);
4800         return (error);
4801 }
4802 
4803 static int
4804 zfs_ioc_smb_acl(zfs_cmd_t *zc)
4805 {
4806         vnode_t *vp;
4807         znode_t *dzp;
4808         vnode_t *resourcevp = NULL;
4809         znode_t *sharedir;
4810         zfsvfs_t *zfsvfs;
4811         nvlist_t *nvlist;
4812         char *src, *target;
4813         vattr_t vattr;
4814         vsecattr_t vsec;
4815         int error = 0;
4816 
4817         if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
4818             NO_FOLLOW, NULL, &vp)) != 0)
4819                 return (error);
4820 
4821         /* Now make sure mntpnt and dataset are ZFS */
4822 
4823         if (vp->v_vfsp->vfs_fstype != zfsfstype ||
4824             (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
4825             zc->zc_name) != 0)) {
4826                 VN_RELE(vp);
4827                 return (EINVAL);
4828         }
4829 
4830         dzp = VTOZ(vp);
4831         zfsvfs = dzp->z_zfsvfs;
4832         ZFS_ENTER(zfsvfs);
4833 
4834         /*
4835          * Create share dir if its missing.
4836          */
4837         mutex_enter(&zfsvfs->z_lock);
4838         if (zfsvfs->z_shares_dir == 0) {
4839                 dmu_tx_t *tx;
4840 
4841                 tx = dmu_tx_create(zfsvfs->z_os);
4842                 dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
4843                     ZFS_SHARES_DIR);
4844                 dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
4845                 error = dmu_tx_assign(tx, TXG_WAIT);
4846                 if (error) {
4847                         dmu_tx_abort(tx);
4848                 } else {
4849                         error = zfs_create_share_dir(zfsvfs, tx);
4850                         dmu_tx_commit(tx);
4851                 }
4852                 if (error) {
4853                         mutex_exit(&zfsvfs->z_lock);
4854                         VN_RELE(vp);
4855                         ZFS_EXIT(zfsvfs);
4856                         return (error);
4857                 }
4858         }
4859         mutex_exit(&zfsvfs->z_lock);
4860 
4861         ASSERT(zfsvfs->z_shares_dir);
4862         if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
4863                 VN_RELE(vp);
4864                 ZFS_EXIT(zfsvfs);
4865                 return (error);
4866         }
4867 
4868         switch (zc->zc_cookie) {
4869         case ZFS_SMB_ACL_ADD:
4870                 vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
4871                 vattr.va_type = VREG;
4872                 vattr.va_mode = S_IFREG|0777;
4873                 vattr.va_uid = 0;
4874                 vattr.va_gid = 0;
4875 
4876                 vsec.vsa_mask = VSA_ACE;
4877                 vsec.vsa_aclentp = &full_access;
4878                 vsec.vsa_aclentsz = sizeof (full_access);
4879                 vsec.vsa_aclcnt = 1;
4880 
4881                 error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
4882                     &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
4883                 if (resourcevp)
4884                         VN_RELE(resourcevp);
4885                 break;
4886 
4887         case ZFS_SMB_ACL_REMOVE:
4888                 error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
4889                     NULL, 0);
4890                 break;
4891 
4892         case ZFS_SMB_ACL_RENAME:
4893                 if ((error = get_nvlist(zc->zc_nvlist_src,
4894                     zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
4895                         VN_RELE(vp);
4896                         ZFS_EXIT(zfsvfs);
4897                         return (error);
4898                 }
4899                 if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
4900                     nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
4901                     &target)) {
4902                         VN_RELE(vp);
4903                         VN_RELE(ZTOV(sharedir));
4904                         ZFS_EXIT(zfsvfs);
4905                         nvlist_free(nvlist);
4906                         return (error);
4907                 }
4908                 error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
4909                     kcred, NULL, 0);
4910                 nvlist_free(nvlist);
4911                 break;
4912 
4913         case ZFS_SMB_ACL_PURGE:
4914                 error = zfs_smb_acl_purge(sharedir);
4915                 break;
4916 
4917         default:
4918                 error = EINVAL;
4919                 break;
4920         }
4921 
4922         VN_RELE(vp);
4923         VN_RELE(ZTOV(sharedir));
4924 
4925         ZFS_EXIT(zfsvfs);
4926 
4927         return (error);
4928 }
4929 
4930 /*
4931  * inputs:
4932  * zc_name              name of filesystem
4933  * zc_value             short name of snap
4934  * zc_string            user-supplied tag for this hold
4935  * zc_cookie            recursive flag
4936  * zc_temphold          set if hold is temporary
4937  * zc_cleanup_fd        cleanup-on-exit file descriptor for calling process
4938  * zc_sendobj           if non-zero, the objid for zc_name@zc_value
4939  * zc_createtxg         if zc_sendobj is non-zero, snap must have zc_createtxg
4940  *
4941  * outputs:             none
4942  */
4943 static int
4944 zfs_ioc_hold(zfs_cmd_t *zc)
4945 {
4946         boolean_t recursive = zc->zc_cookie;
4947         spa_t *spa;
4948         dsl_pool_t *dp;
4949         dsl_dataset_t *ds;
4950         int error;
4951         minor_t minor = 0;
4952 
4953         if (snapshot_namecheck(zc->zc_value, NULL, NULL) != 0)
4954                 return (EINVAL);
4955 
4956         if (zc->zc_sendobj == 0) {
4957                 return (dsl_dataset_user_hold(zc->zc_name, zc->zc_value,
4958                     zc->zc_string, recursive, zc->zc_temphold,
4959                     zc->zc_cleanup_fd));
4960         }
4961 
4962         if (recursive)
4963                 return (EINVAL);
4964 
4965         error = spa_open(zc->zc_name, &spa, FTAG);
4966         if (error)
4967                 return (error);
4968 
4969         dp = spa_get_dsl(spa);
4970         rw_enter(&dp->dp_config_rwlock, RW_READER);
4971         error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
4972         rw_exit(&dp->dp_config_rwlock);
4973         spa_close(spa, FTAG);
4974         if (error)
4975                 return (error);
4976 
4977         /*
4978          * Until we have a hold on this snapshot, it's possible that
4979          * zc_sendobj could've been destroyed and reused as part
4980          * of a later txg.  Make sure we're looking at the right object.
4981          */
4982         if (zc->zc_createtxg != ds->ds_phys->ds_creation_txg) {
4983                 dsl_dataset_rele(ds, FTAG);
4984                 return (ENOENT);
4985         }
4986 
4987         if (zc->zc_cleanup_fd != -1 && zc->zc_temphold) {
4988                 error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
4989                 if (error) {
4990                         dsl_dataset_rele(ds, FTAG);
4991                         return (error);
4992                 }
4993         }
4994 
4995         error = dsl_dataset_user_hold_for_send(ds, zc->zc_string,
4996             zc->zc_temphold);
4997         if (minor != 0) {
4998                 if (error == 0) {
4999                         dsl_register_onexit_hold_cleanup(ds, zc->zc_string,
5000                             minor);
5001                 }
5002                 zfs_onexit_fd_rele(zc->zc_cleanup_fd);
5003         }
5004         dsl_dataset_rele(ds, FTAG);
5005 
5006         return (error);
5007 }
5008 
5009 /*
5010  * inputs:
5011  * zc_name      name of dataset from which we're releasing a user hold
5012  * zc_value     short name of snap
5013  * zc_string    user-supplied tag for this hold
5014  * zc_cookie    recursive flag
5015  *
5016  * outputs:     none
5017  */
5018 static int
5019 zfs_ioc_release(zfs_cmd_t *zc)
5020 {
5021         boolean_t recursive = zc->zc_cookie;
5022 
5023         if (snapshot_namecheck(zc->zc_value, NULL, NULL) != 0)
5024                 return (EINVAL);
5025 
5026         return (dsl_dataset_user_release(zc->zc_name, zc->zc_value,
5027             zc->zc_string, recursive));
5028 }
5029 
5030 /*
5031  * inputs:
5032  * zc_name              name of filesystem
5033  *
5034  * outputs:
5035  * zc_nvlist_src{_size} nvlist of snapshot holds
5036  */
5037 static int
5038 zfs_ioc_get_holds(zfs_cmd_t *zc)
5039 {
5040         nvlist_t *nvp;
5041         int error;
5042 
5043         if ((error = dsl_dataset_get_holds(zc->zc_name, &nvp)) == 0) {
5044                 error = put_nvlist(zc, nvp);
5045                 nvlist_free(nvp);
5046         }
5047 
5048         return (error);
5049 }
5050 
5051 /*
5052  * inputs:
5053  * zc_name              name of new filesystem or snapshot
5054  * zc_value             full name of old snapshot
5055  *
5056  * outputs:
5057  * zc_cookie            space in bytes
5058  * zc_objset_type       compressed space in bytes
5059  * zc_perm_action       uncompressed space in bytes
5060  */
5061 static int
5062 zfs_ioc_space_written(zfs_cmd_t *zc)
5063 {
5064         int error;
5065         dsl_dataset_t *new, *old;
5066 
5067         error = dsl_dataset_hold(zc->zc_name, FTAG, &new);
5068         if (error != 0)
5069                 return (error);
5070         error = dsl_dataset_hold(zc->zc_value, FTAG, &old);
5071         if (error != 0) {
5072                 dsl_dataset_rele(new, FTAG);
5073                 return (error);
5074         }
5075 
5076         error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5077             &zc->zc_objset_type, &zc->zc_perm_action);
5078         dsl_dataset_rele(old, FTAG);
5079         dsl_dataset_rele(new, FTAG);
5080         return (error);
5081 }
5082 /*
5083  * innvl: {
5084  *     "firstsnap" -> snapshot name
5085  * }
5086  *
5087  * outnvl: {
5088  *     "used" -> space in bytes
5089  *     "compressed" -> compressed space in bytes
5090  *     "uncompressed" -> uncompressed space in bytes
5091  * }
5092  */
5093 static int
5094 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5095 {
5096         int error;
5097         dsl_dataset_t *new, *old;
5098         char *firstsnap;
5099         uint64_t used, comp, uncomp;
5100 
5101         if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5102                 return (EINVAL);
5103 
5104         error = dsl_dataset_hold(lastsnap, FTAG, &new);
5105         if (error != 0)
5106                 return (error);
5107         error = dsl_dataset_hold(firstsnap, FTAG, &old);
5108         if (error != 0) {
5109                 dsl_dataset_rele(new, FTAG);
5110                 return (error);
5111         }
5112 
5113         error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5114         dsl_dataset_rele(old, FTAG);
5115         dsl_dataset_rele(new, FTAG);
5116         fnvlist_add_uint64(outnvl, "used", used);
5117         fnvlist_add_uint64(outnvl, "compressed", comp);
5118         fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5119         return (error);
5120 }
5121 
5122 /*
5123  * innvl: {
5124  *     "fd" -> file descriptor to write stream to (int32)
5125  *     (optional) "fromsnap" -> full snap name to send an incremental from
5126  * }
5127  *
5128  * outnvl is unused
5129  */
5130 /* ARGSUSED */
5131 static int
5132 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5133 {
5134         objset_t *fromsnap = NULL;
5135         objset_t *tosnap;
5136         int error;
5137         offset_t off;
5138         char *fromname;
5139         int fd;
5140 
5141         error = nvlist_lookup_int32(innvl, "fd", &fd);
5142         if (error != 0)
5143                 return (EINVAL);
5144 
5145         error = dmu_objset_hold(snapname, FTAG, &tosnap);
5146         if (error)
5147                 return (error);
5148 
5149         error = nvlist_lookup_string(innvl, "fromsnap", &fromname);
5150         if (error == 0) {
5151                 error = dmu_objset_hold(fromname, FTAG, &fromsnap);
5152                 if (error) {
5153                         dmu_objset_rele(tosnap, FTAG);
5154                         return (error);
5155                 }
5156         }
5157 
5158         file_t *fp = getf(fd);
5159         if (fp == NULL) {
5160                 dmu_objset_rele(tosnap, FTAG);
5161                 if (fromsnap != NULL)
5162                         dmu_objset_rele(fromsnap, FTAG);
5163                 return (EBADF);
5164         }
5165 
5166         off = fp->f_offset;
5167         error = dmu_send(tosnap, fromsnap, fd, fp->f_vnode, &off);
5168 
5169         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5170                 fp->f_offset = off;
5171         releasef(fd);
5172         if (fromsnap != NULL)
5173                 dmu_objset_rele(fromsnap, FTAG);
5174         dmu_objset_rele(tosnap, FTAG);
5175         return (error);
5176 }
5177 
5178 /*
5179  * Determine approximately how large a zfs send stream will be -- the number
5180  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5181  *
5182  * innvl: {
5183  *     (optional) "fromsnap" -> full snap name to send an incremental from
5184  * }
5185  *
5186  * outnvl: {
5187  *     "space" -> bytes of space (uint64)
5188  * }
5189  */
5190 static int
5191 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5192 {
5193         objset_t *fromsnap = NULL;
5194         objset_t *tosnap;
5195         int error;
5196         char *fromname;
5197         uint64_t space;
5198 
5199         error = dmu_objset_hold(snapname, FTAG, &tosnap);
5200         if (error)
5201                 return (error);
5202 
5203         error = nvlist_lookup_string(innvl, "fromsnap", &fromname);
5204         if (error == 0) {
5205                 error = dmu_objset_hold(fromname, FTAG, &fromsnap);
5206                 if (error) {
5207                         dmu_objset_rele(tosnap, FTAG);
5208                         return (error);
5209                 }
5210         }
5211 
5212         error = dmu_send_estimate(tosnap, fromsnap, &space);
5213         fnvlist_add_uint64(outnvl, "space", space);
5214 
5215         if (fromsnap != NULL)
5216                 dmu_objset_rele(fromsnap, FTAG);
5217         dmu_objset_rele(tosnap, FTAG);
5218         return (error);
5219 }
5220 
5221 
5222 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5223 
5224 static void
5225 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5226     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5227     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5228 {
5229         zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5230 
5231         ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5232         ASSERT3U(ioc, <, ZFS_IOC_LAST);
5233         ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5234         ASSERT3P(vec->zvec_func, ==, NULL);
5235 
5236         vec->zvec_legacy_func = func;
5237         vec->zvec_secpolicy = secpolicy;
5238         vec->zvec_namecheck = namecheck;
5239         vec->zvec_allow_log = log_history;
5240         vec->zvec_pool_check = pool_check;
5241 }
5242 
5243 /*
5244  * See the block comment at the beginning of this file for details on
5245  * each argument to this function.
5246  */
5247 static void
5248 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5249     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5250     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5251     boolean_t allow_log)
5252 {
5253         zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5254 
5255         ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5256         ASSERT3U(ioc, <, ZFS_IOC_LAST);
5257         ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5258         ASSERT3P(vec->zvec_func, ==, NULL);
5259 
5260         /* if we are logging, the name must be valid */
5261         ASSERT(!allow_log || namecheck != NO_NAME);
5262 
5263         vec->zvec_name = name;
5264         vec->zvec_func = func;
5265         vec->zvec_secpolicy = secpolicy;
5266         vec->zvec_namecheck = namecheck;
5267         vec->zvec_pool_check = pool_check;
5268         vec->zvec_smush_outnvlist = smush_outnvlist;
5269         vec->zvec_allow_log = allow_log;
5270 }
5271 
5272 static void
5273 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5274     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5275     zfs_ioc_poolcheck_t pool_check)
5276 {
5277         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5278             POOL_NAME, log_history, pool_check);
5279 }
5280 
5281 static void
5282 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5283     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5284 {
5285         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5286             DATASET_NAME, B_FALSE, pool_check);
5287 }
5288 
5289 static void
5290 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5291 {
5292         zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5293             POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5294 }
5295 
5296 static void
5297 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5298     zfs_secpolicy_func_t *secpolicy)
5299 {
5300         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5301             NO_NAME, B_FALSE, POOL_CHECK_NONE);
5302 }
5303 
5304 static void
5305 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5306     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5307 {
5308         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5309             DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5310 }
5311 
5312 static void
5313 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5314 {
5315         zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5316             zfs_secpolicy_read);
5317 }
5318 
5319 static void
5320 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5321         zfs_secpolicy_func_t *secpolicy)
5322 {
5323         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5324             DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5325 }
5326 
5327 static void
5328 zfs_ioctl_init(void)
5329 {
5330         zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5331             zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5332             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5333 
5334         zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5335             zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5336             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5337 
5338         zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5339             zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5340             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5341 
5342         zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5343             zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5344             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5345 
5346         zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5347             zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5348             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5349 
5350         zfs_ioctl_register("create", ZFS_IOC_CREATE,
5351             zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5352             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5353 
5354         zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5355             zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5356             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5357 
5358         zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5359             zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5360             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5361 
5362         /* IOCTLS that use the legacy function signature */
5363 
5364         zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5365             zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5366 
5367         zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5368             zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5369         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5370             zfs_ioc_pool_scan);
5371         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5372             zfs_ioc_pool_upgrade);
5373         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5374             zfs_ioc_vdev_add);
5375         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5376             zfs_ioc_vdev_remove);
5377         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5378             zfs_ioc_vdev_set_state);
5379         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5380             zfs_ioc_vdev_attach);
5381         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5382             zfs_ioc_vdev_detach);
5383         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5384             zfs_ioc_vdev_setpath);
5385         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5386             zfs_ioc_vdev_setfru);
5387         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5388             zfs_ioc_pool_set_props);
5389         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5390             zfs_ioc_vdev_split);
5391         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5392             zfs_ioc_pool_reguid);
5393 
5394         zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5395             zfs_ioc_pool_configs, zfs_secpolicy_none);
5396         zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5397             zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5398         zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5399             zfs_ioc_inject_fault, zfs_secpolicy_inject);
5400         zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5401             zfs_ioc_clear_fault, zfs_secpolicy_inject);
5402         zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5403             zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5404 
5405         /*
5406          * pool destroy, and export don't log the history as part of
5407          * zfsdev_ioctl, but rather zfs_ioc_pool_export
5408          * does the logging of those commands.
5409          */
5410         zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5411             zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5412         zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5413             zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5414 
5415         zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5416             zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5417         zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5418             zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5419 
5420         zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5421             zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5422         zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5423             zfs_ioc_dsobj_to_dsname,
5424             zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5425         zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5426             zfs_ioc_pool_get_history,
5427             zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5428 
5429         zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5430             zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5431 
5432         zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5433             zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5434         zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5435             zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5436 
5437         zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5438             zfs_ioc_space_written);
5439         zfs_ioctl_register_dataset_read(ZFS_IOC_GET_HOLDS,
5440             zfs_ioc_get_holds);
5441         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5442             zfs_ioc_objset_recvd_props);
5443         zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5444             zfs_ioc_next_obj);
5445         zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5446             zfs_ioc_get_fsacl);
5447         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5448             zfs_ioc_objset_stats);
5449         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5450             zfs_ioc_objset_zplprops);
5451         zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5452             zfs_ioc_dataset_list_next);
5453         zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5454             zfs_ioc_snapshot_list_next);
5455         zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5456             zfs_ioc_send_progress);
5457 
5458         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5459             zfs_ioc_diff, zfs_secpolicy_diff);
5460         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5461             zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5462         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5463             zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5464         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5465             zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5466         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5467             zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5468         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5469             zfs_ioc_send, zfs_secpolicy_send);
5470 
5471         zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5472             zfs_secpolicy_none);
5473         zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5474             zfs_secpolicy_destroy);
5475         zfs_ioctl_register_dataset_modify(ZFS_IOC_ROLLBACK, zfs_ioc_rollback,
5476             zfs_secpolicy_rollback);
5477         zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5478             zfs_secpolicy_rename);
5479         zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5480             zfs_secpolicy_recv);
5481         zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5482             zfs_secpolicy_promote);
5483         zfs_ioctl_register_dataset_modify(ZFS_IOC_HOLD, zfs_ioc_hold,
5484             zfs_secpolicy_hold);
5485         zfs_ioctl_register_dataset_modify(ZFS_IOC_RELEASE, zfs_ioc_release,
5486             zfs_secpolicy_release);
5487         zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5488             zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5489         zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5490             zfs_secpolicy_set_fsacl);
5491 
5492         zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5493             zfs_secpolicy_share, POOL_CHECK_NONE);
5494         zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5495             zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5496         zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5497             zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5498             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5499         zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5500             zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5501             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5502 }
5503 
5504 int
5505 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5506     zfs_ioc_poolcheck_t check)
5507 {
5508         spa_t *spa;
5509         int error;
5510 
5511         ASSERT(type == POOL_NAME || type == DATASET_NAME);
5512 
5513         if (check & POOL_CHECK_NONE)
5514                 return (0);
5515 
5516         error = spa_open(name, &spa, FTAG);
5517         if (error == 0) {
5518                 if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5519                         error = EAGAIN;
5520                 else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5521                         error = EROFS;
5522                 spa_close(spa, FTAG);
5523         }
5524         return (error);
5525 }
5526 
5527 /*
5528  * Find a free minor number.
5529  */
5530 minor_t
5531 zfsdev_minor_alloc(void)
5532 {
5533         static minor_t last_minor;
5534         minor_t m;
5535 
5536         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5537 
5538         for (m = last_minor + 1; m != last_minor; m++) {
5539                 if (m > ZFSDEV_MAX_MINOR)
5540                         m = 1;
5541                 if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5542                         last_minor = m;
5543                         return (m);
5544                 }
5545         }
5546 
5547         return (0);
5548 }
5549 
5550 static int
5551 zfs_ctldev_init(dev_t *devp)
5552 {
5553         minor_t minor;
5554         zfs_soft_state_t *zs;
5555 
5556         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5557         ASSERT(getminor(*devp) == 0);
5558 
5559         minor = zfsdev_minor_alloc();
5560         if (minor == 0)
5561                 return (ENXIO);
5562 
5563         if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5564                 return (EAGAIN);
5565 
5566         *devp = makedevice(getemajor(*devp), minor);
5567 
5568         zs = ddi_get_soft_state(zfsdev_state, minor);
5569         zs->zss_type = ZSST_CTLDEV;
5570         zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
5571 
5572         return (0);
5573 }
5574 
5575 static void
5576 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
5577 {
5578         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5579 
5580         zfs_onexit_destroy(zo);
5581         ddi_soft_state_free(zfsdev_state, minor);
5582 }
5583 
5584 void *
5585 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
5586 {
5587         zfs_soft_state_t *zp;
5588 
5589         zp = ddi_get_soft_state(zfsdev_state, minor);
5590         if (zp == NULL || zp->zss_type != which)
5591                 return (NULL);
5592 
5593         return (zp->zss_data);
5594 }
5595 
5596 static int
5597 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
5598 {
5599         int error = 0;
5600 
5601         if (getminor(*devp) != 0)
5602                 return (zvol_open(devp, flag, otyp, cr));
5603 
5604         /* This is the control device. Allocate a new minor if requested. */
5605         if (flag & FEXCL) {
5606                 mutex_enter(&zfsdev_state_lock);
5607                 error = zfs_ctldev_init(devp);
5608                 mutex_exit(&zfsdev_state_lock);
5609         }
5610 
5611         return (error);
5612 }
5613 
5614 static int
5615 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
5616 {
5617         zfs_onexit_t *zo;
5618         minor_t minor = getminor(dev);
5619 
5620         if (minor == 0)
5621                 return (0);
5622 
5623         mutex_enter(&zfsdev_state_lock);
5624         zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
5625         if (zo == NULL) {
5626                 mutex_exit(&zfsdev_state_lock);
5627                 return (zvol_close(dev, flag, otyp, cr));
5628         }
5629         zfs_ctldev_destroy(zo, minor);
5630         mutex_exit(&zfsdev_state_lock);
5631 
5632         return (0);
5633 }
5634 
5635 static int
5636 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
5637 {
5638         zfs_cmd_t *zc;
5639         uint_t vecnum;
5640         int error, rc, len;
5641         minor_t minor = getminor(dev);
5642         const zfs_ioc_vec_t *vec;
5643         char *saved_poolname = NULL;
5644         nvlist_t *innvl = NULL;
5645 
5646         if (minor != 0 &&
5647             zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
5648                 return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
5649 
5650         vecnum = cmd - ZFS_IOC_FIRST;
5651         ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
5652 
5653         if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
5654                 return (EINVAL);
5655         vec = &zfs_ioc_vec[vecnum];
5656 
5657         zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
5658 
5659         error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
5660         if (error != 0) {
5661                 error = EFAULT;
5662                 goto out;
5663         }
5664 
5665         zc->zc_iflags = flag & FKIOCTL;
5666         if (zc->zc_nvlist_src_size != 0) {
5667                 error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
5668                     zc->zc_iflags, &innvl);
5669                 if (error != 0)
5670                         goto out;
5671         }
5672 
5673         /*
5674          * Ensure that all pool/dataset names are valid before we pass down to
5675          * the lower layers.
5676          */
5677         zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
5678         switch (vec->zvec_namecheck) {
5679         case POOL_NAME:
5680                 if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
5681                         error = EINVAL;
5682                 else
5683                         error = pool_status_check(zc->zc_name,
5684                             vec->zvec_namecheck, vec->zvec_pool_check);
5685                 break;
5686 
5687         case DATASET_NAME:
5688                 if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
5689                         error = EINVAL;
5690                 else
5691                         error = pool_status_check(zc->zc_name,
5692                             vec->zvec_namecheck, vec->zvec_pool_check);
5693                 break;
5694 
5695         case NO_NAME:
5696                 break;
5697         }
5698 
5699 
5700         if (error == 0 && !(flag & FKIOCTL))
5701                 error = vec->zvec_secpolicy(zc, innvl, cr);
5702 
5703         if (error != 0)
5704                 goto out;
5705 
5706         /* legacy ioctls can modify zc_name */
5707         len = strcspn(zc->zc_name, "/@") + 1;
5708         saved_poolname = kmem_alloc(len, KM_SLEEP);
5709         (void) strlcpy(saved_poolname, zc->zc_name, len);
5710 
5711         if (vec->zvec_func != NULL) {
5712                 nvlist_t *outnvl;
5713                 int puterror = 0;
5714                 spa_t *spa;
5715                 nvlist_t *lognv = NULL;
5716 
5717                 ASSERT(vec->zvec_legacy_func == NULL);
5718 
5719                 /*
5720                  * Add the innvl to the lognv before calling the func,
5721                  * in case the func changes the innvl.
5722                  */
5723                 if (vec->zvec_allow_log) {
5724                         lognv = fnvlist_alloc();
5725                         fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
5726                             vec->zvec_name);
5727                         if (!nvlist_empty(innvl)) {
5728                                 fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
5729                                     innvl);
5730                         }
5731                 }
5732 
5733                 outnvl = fnvlist_alloc();
5734                 error = vec->zvec_func(zc->zc_name, innvl, outnvl);
5735 
5736                 if (error == 0 && vec->zvec_allow_log &&
5737                     spa_open(zc->zc_name, &spa, FTAG) == 0) {
5738                         if (!nvlist_empty(outnvl)) {
5739                                 fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
5740                                     outnvl);
5741                         }
5742                         (void) spa_history_log_nvl(spa, lognv);
5743                         spa_close(spa, FTAG);
5744                 }
5745                 fnvlist_free(lognv);
5746 
5747                 if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
5748                         int smusherror = 0;
5749                         if (vec->zvec_smush_outnvlist) {
5750                                 smusherror = nvlist_smush(outnvl,
5751                                     zc->zc_nvlist_dst_size);
5752                         }
5753                         if (smusherror == 0)
5754                                 puterror = put_nvlist(zc, outnvl);
5755                 }
5756 
5757                 if (puterror != 0)
5758                         error = puterror;
5759 
5760                 nvlist_free(outnvl);
5761         } else {
5762                 error = vec->zvec_legacy_func(zc);
5763         }
5764 
5765 out:
5766         nvlist_free(innvl);
5767         rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
5768         if (error == 0 && rc != 0)
5769                 error = EFAULT;
5770         if (error == 0 && vec->zvec_allow_log) {
5771                 char *s = tsd_get(zfs_allow_log_key);
5772                 if (s != NULL)
5773                         strfree(s);
5774                 (void) tsd_set(zfs_allow_log_key, saved_poolname);
5775         } else {
5776                 if (saved_poolname != NULL)
5777                         strfree(saved_poolname);
5778         }
5779 
5780         kmem_free(zc, sizeof (zfs_cmd_t));
5781         return (error);
5782 }
5783 
5784 static int
5785 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
5786 {
5787         if (cmd != DDI_ATTACH)
5788                 return (DDI_FAILURE);
5789 
5790         if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
5791             DDI_PSEUDO, 0) == DDI_FAILURE)
5792                 return (DDI_FAILURE);
5793 
5794         zfs_dip = dip;
5795 
5796         ddi_report_dev(dip);
5797 
5798         return (DDI_SUCCESS);
5799 }
5800 
5801 static int
5802 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
5803 {
5804         if (spa_busy() || zfs_busy() || zvol_busy())
5805                 return (DDI_FAILURE);
5806 
5807         if (cmd != DDI_DETACH)
5808                 return (DDI_FAILURE);
5809 
5810         zfs_dip = NULL;
5811 
5812         ddi_prop_remove_all(dip);
5813         ddi_remove_minor_node(dip, NULL);
5814 
5815         return (DDI_SUCCESS);
5816 }
5817 
5818 /*ARGSUSED*/
5819 static int
5820 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
5821 {
5822         switch (infocmd) {
5823         case DDI_INFO_DEVT2DEVINFO:
5824                 *result = zfs_dip;
5825                 return (DDI_SUCCESS);
5826 
5827         case DDI_INFO_DEVT2INSTANCE:
5828                 *result = (void *)0;
5829                 return (DDI_SUCCESS);
5830         }
5831 
5832         return (DDI_FAILURE);
5833 }
5834 
5835 /*
5836  * OK, so this is a little weird.
5837  *
5838  * /dev/zfs is the control node, i.e. minor 0.
5839  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
5840  *
5841  * /dev/zfs has basically nothing to do except serve up ioctls,
5842  * so most of the standard driver entry points are in zvol.c.
5843  */
5844 static struct cb_ops zfs_cb_ops = {
5845         zfsdev_open,    /* open */
5846         zfsdev_close,   /* close */
5847         zvol_strategy,  /* strategy */
5848         nodev,          /* print */
5849         zvol_dump,      /* dump */
5850         zvol_read,      /* read */
5851         zvol_write,     /* write */
5852         zfsdev_ioctl,   /* ioctl */
5853         nodev,          /* devmap */
5854         nodev,          /* mmap */
5855         nodev,          /* segmap */
5856         nochpoll,       /* poll */
5857         ddi_prop_op,    /* prop_op */
5858         NULL,           /* streamtab */
5859         D_NEW | D_MP | D_64BIT,         /* Driver compatibility flag */
5860         CB_REV,         /* version */
5861         nodev,          /* async read */
5862         nodev,          /* async write */
5863 };
5864 
5865 static struct dev_ops zfs_dev_ops = {
5866         DEVO_REV,       /* version */
5867         0,              /* refcnt */
5868         zfs_info,       /* info */
5869         nulldev,        /* identify */
5870         nulldev,        /* probe */
5871         zfs_attach,     /* attach */
5872         zfs_detach,     /* detach */
5873         nodev,          /* reset */
5874         &zfs_cb_ops,        /* driver operations */
5875         NULL,           /* no bus operations */
5876         NULL,           /* power */
5877         ddi_quiesce_not_needed, /* quiesce */
5878 };
5879 
5880 static struct modldrv zfs_modldrv = {
5881         &mod_driverops,
5882         "ZFS storage pool",
5883         &zfs_dev_ops
5884 };
5885 
5886 static struct modlinkage modlinkage = {
5887         MODREV_1,
5888         (void *)&zfs_modlfs,
5889         (void *)&zfs_modldrv,
5890         NULL
5891 };
5892 
5893 static void
5894 zfs_allow_log_destroy(void *arg)
5895 {
5896         char *poolname = arg;
5897         strfree(poolname);
5898 }
5899 
5900 int
5901 _init(void)
5902 {
5903         int error;
5904 
5905         spa_init(FREAD | FWRITE);
5906         zfs_init();
5907         zvol_init();
5908         zfs_ioctl_init();
5909 
5910         if ((error = mod_install(&modlinkage)) != 0) {
5911                 zvol_fini();
5912                 zfs_fini();
5913                 spa_fini();
5914                 return (error);
5915         }
5916 
5917         tsd_create(&zfs_fsyncer_key, NULL);
5918         tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
5919         tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
5920 
5921         error = ldi_ident_from_mod(&modlinkage, &zfs_li);
5922         ASSERT(error == 0);
5923         mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
5924 
5925         return (0);
5926 }
5927 
5928 int
5929 _fini(void)
5930 {
5931         int error;
5932 
5933         if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
5934                 return (EBUSY);
5935 
5936         if ((error = mod_remove(&modlinkage)) != 0)
5937                 return (error);
5938 
5939         zvol_fini();
5940         zfs_fini();
5941         spa_fini();
5942         if (zfs_nfsshare_inited)
5943                 (void) ddi_modclose(nfs_mod);
5944         if (zfs_smbshare_inited)
5945                 (void) ddi_modclose(smbsrv_mod);
5946         if (zfs_nfsshare_inited || zfs_smbshare_inited)
5947                 (void) ddi_modclose(sharefs_mod);
5948 
5949         tsd_destroy(&zfs_fsyncer_key);
5950         ldi_ident_release(zfs_li);
5951         zfs_li = NULL;
5952         mutex_destroy(&zfs_share_lock);
5953 
5954         return (error);
5955 }
5956 
5957 int
5958 _info(struct modinfo *modinfop)
5959 {
5960         return (mod_info(&modlinkage, modinfop));
5961 }