1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Portions Copyright 2011 Martin Matuska
  25  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  26  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  27  * Copyright (c) 2012 by Delphix. All rights reserved.
  28  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
  29  */
  30 
  31 /*
  32  * ZFS ioctls.
  33  *
  34  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
  35  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
  36  *
  37  * There are two ways that we handle ioctls: the legacy way where almost
  38  * all of the logic is in the ioctl callback, and the new way where most
  39  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
  40  *
  41  * Non-legacy ioctls should be registered by calling
  42  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
  43  * from userland by lzc_ioctl().
  44  *
  45  * The registration arguments are as follows:
  46  *
  47  * const char *name
  48  *   The name of the ioctl.  This is used for history logging.  If the
  49  *   ioctl returns successfully (the callback returns 0), and allow_log
  50  *   is true, then a history log entry will be recorded with the input &
  51  *   output nvlists.  The log entry can be printed with "zpool history -i".
  52  *
  53  * zfs_ioc_t ioc
  54  *   The ioctl request number, which userland will pass to ioctl(2).
  55  *   The ioctl numbers can change from release to release, because
  56  *   the caller (libzfs) must be matched to the kernel.
  57  *
  58  * zfs_secpolicy_func_t *secpolicy
  59  *   This function will be called before the zfs_ioc_func_t, to
  60  *   determine if this operation is permitted.  It should return EPERM
  61  *   on failure, and 0 on success.  Checks include determining if the
  62  *   dataset is visible in this zone, and if the user has either all
  63  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
  64  *   to do this operation on this dataset with "zfs allow".
  65  *
  66  * zfs_ioc_namecheck_t namecheck
  67  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
  68  *   name, a dataset name, or nothing.  If the name is not well-formed,
  69  *   the ioctl will fail and the callback will not be called.
  70  *   Therefore, the callback can assume that the name is well-formed
  71  *   (e.g. is null-terminated, doesn't have more than one '@' character,
  72  *   doesn't have invalid characters).
  73  *
  74  * zfs_ioc_poolcheck_t pool_check
  75  *   This specifies requirements on the pool state.  If the pool does
  76  *   not meet them (is suspended or is readonly), the ioctl will fail
  77  *   and the callback will not be called.  If any checks are specified
  78  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
  79  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
  80  *   POOL_CHECK_READONLY).
  81  *
  82  * boolean_t smush_outnvlist
  83  *   If smush_outnvlist is true, then the output is presumed to be a
  84  *   list of errors, and it will be "smushed" down to fit into the
  85  *   caller's buffer, by removing some entries and replacing them with a
  86  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
  87  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
  88  *   outnvlist does not fit into the userland-provided buffer, then the
  89  *   ioctl will fail with ENOMEM.
  90  *
  91  * zfs_ioc_func_t *func
  92  *   The callback function that will perform the operation.
  93  *
  94  *   The callback should return 0 on success, or an error number on
  95  *   failure.  If the function fails, the userland ioctl will return -1,
  96  *   and errno will be set to the callback's return value.  The callback
  97  *   will be called with the following arguments:
  98  *
  99  *   const char *name
 100  *     The name of the pool or dataset to operate on, from
 101  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
 102  *     expected type (pool, dataset, or none).
 103  *
 104  *   nvlist_t *innvl
 105  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
 106  *     NULL if no input nvlist was provided.  Changes to this nvlist are
 107  *     ignored.  If the input nvlist could not be deserialized, the
 108  *     ioctl will fail and the callback will not be called.
 109  *
 110  *   nvlist_t *outnvl
 111  *     The output nvlist, initially empty.  The callback can fill it in,
 112  *     and it will be returned to userland by serializing it into
 113  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
 114  *     fails (e.g. because the caller didn't supply a large enough
 115  *     buffer), then the overall ioctl will fail.  See the
 116  *     'smush_nvlist' argument above for additional behaviors.
 117  *
 118  *     There are two typical uses of the output nvlist:
 119  *       - To return state, e.g. property values.  In this case,
 120  *         smush_outnvlist should be false.  If the buffer was not large
 121  *         enough, the caller will reallocate a larger buffer and try
 122  *         the ioctl again.
 123  *
 124  *       - To return multiple errors from an ioctl which makes on-disk
 125  *         changes.  In this case, smush_outnvlist should be true.
 126  *         Ioctls which make on-disk modifications should generally not
 127  *         use the outnvl if they succeed, because the caller can not
 128  *         distinguish between the operation failing, and
 129  *         deserialization failing.
 130  */
 131 
 132 #include <sys/types.h>
 133 #include <sys/param.h>
 134 #include <sys/errno.h>
 135 #include <sys/uio.h>
 136 #include <sys/buf.h>
 137 #include <sys/modctl.h>
 138 #include <sys/open.h>
 139 #include <sys/file.h>
 140 #include <sys/kmem.h>
 141 #include <sys/conf.h>
 142 #include <sys/cmn_err.h>
 143 #include <sys/stat.h>
 144 #include <sys/zfs_ioctl.h>
 145 #include <sys/zfs_vfsops.h>
 146 #include <sys/zfs_znode.h>
 147 #include <sys/zap.h>
 148 #include <sys/spa.h>
 149 #include <sys/spa_impl.h>
 150 #include <sys/vdev.h>
 151 #include <sys/priv_impl.h>
 152 #include <sys/dmu.h>
 153 #include <sys/dsl_dir.h>
 154 #include <sys/dsl_dataset.h>
 155 #include <sys/dsl_prop.h>
 156 #include <sys/dsl_deleg.h>
 157 #include <sys/dmu_objset.h>
 158 #include <sys/dmu_impl.h>
 159 #include <sys/ddi.h>
 160 #include <sys/sunddi.h>
 161 #include <sys/sunldi.h>
 162 #include <sys/policy.h>
 163 #include <sys/zone.h>
 164 #include <sys/nvpair.h>
 165 #include <sys/pathname.h>
 166 #include <sys/mount.h>
 167 #include <sys/sdt.h>
 168 #include <sys/fs/zfs.h>
 169 #include <sys/zfs_ctldir.h>
 170 #include <sys/zfs_dir.h>
 171 #include <sys/zfs_onexit.h>
 172 #include <sys/zvol.h>
 173 #include <sys/dsl_scan.h>
 174 #include <sharefs/share.h>
 175 #include <sys/dmu_objset.h>
 176 #include <sys/zfeature.h>
 177 
 178 #include "zfs_namecheck.h"
 179 #include "zfs_prop.h"
 180 #include "zfs_deleg.h"
 181 #include "zfs_comutil.h"
 182 
 183 extern struct modlfs zfs_modlfs;
 184 
 185 extern void zfs_init(void);
 186 extern void zfs_fini(void);
 187 
 188 ldi_ident_t zfs_li = NULL;
 189 dev_info_t *zfs_dip;
 190 
 191 uint_t zfs_fsyncer_key;
 192 extern uint_t rrw_tsd_key;
 193 static uint_t zfs_allow_log_key;
 194 
 195 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
 196 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
 197 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
 198 
 199 typedef enum {
 200         NO_NAME,
 201         POOL_NAME,
 202         DATASET_NAME
 203 } zfs_ioc_namecheck_t;
 204 
 205 typedef enum {
 206         POOL_CHECK_NONE         = 1 << 0,
 207         POOL_CHECK_SUSPENDED    = 1 << 1,
 208         POOL_CHECK_READONLY     = 1 << 2,
 209 } zfs_ioc_poolcheck_t;
 210 
 211 typedef struct zfs_ioc_vec {
 212         zfs_ioc_legacy_func_t   *zvec_legacy_func;
 213         zfs_ioc_func_t          *zvec_func;
 214         zfs_secpolicy_func_t    *zvec_secpolicy;
 215         zfs_ioc_namecheck_t     zvec_namecheck;
 216         boolean_t               zvec_allow_log;
 217         zfs_ioc_poolcheck_t     zvec_pool_check;
 218         boolean_t               zvec_smush_outnvlist;
 219         const char              *zvec_name;
 220 } zfs_ioc_vec_t;
 221 
 222 /* This array is indexed by zfs_userquota_prop_t */
 223 static const char *userquota_perms[] = {
 224         ZFS_DELEG_PERM_USERUSED,
 225         ZFS_DELEG_PERM_USERQUOTA,
 226         ZFS_DELEG_PERM_GROUPUSED,
 227         ZFS_DELEG_PERM_GROUPQUOTA,
 228 };
 229 
 230 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
 231 static int zfs_check_settable(const char *name, nvpair_t *property,
 232     cred_t *cr);
 233 static int zfs_check_clearable(char *dataset, nvlist_t *props,
 234     nvlist_t **errors);
 235 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
 236     boolean_t *);
 237 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
 238 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
 239 
 240 static int zfs_prop_activate_feature(dsl_pool_t *dp, zfeature_info_t *feature);
 241 static int zfs_prop_activate_feature_check(void *arg1, void *arg2,
 242     dmu_tx_t *tx);
 243 static void zfs_prop_activate_feature_sync(void *arg1, void *arg2,
 244     dmu_tx_t *tx);
 245 
 246 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
 247 void
 248 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
 249 {
 250         const char *newfile;
 251         char buf[512];
 252         va_list adx;
 253 
 254         /*
 255          * Get rid of annoying "../common/" prefix to filename.
 256          */
 257         newfile = strrchr(file, '/');
 258         if (newfile != NULL) {
 259                 newfile = newfile + 1; /* Get rid of leading / */
 260         } else {
 261                 newfile = file;
 262         }
 263 
 264         va_start(adx, fmt);
 265         (void) vsnprintf(buf, sizeof (buf), fmt, adx);
 266         va_end(adx);
 267 
 268         /*
 269          * To get this data, use the zfs-dprintf probe as so:
 270          * dtrace -q -n 'zfs-dprintf \
 271          *      /stringof(arg0) == "dbuf.c"/ \
 272          *      {printf("%s: %s", stringof(arg1), stringof(arg3))}'
 273          * arg0 = file name
 274          * arg1 = function name
 275          * arg2 = line number
 276          * arg3 = message
 277          */
 278         DTRACE_PROBE4(zfs__dprintf,
 279             char *, newfile, char *, func, int, line, char *, buf);
 280 }
 281 
 282 static void
 283 history_str_free(char *buf)
 284 {
 285         kmem_free(buf, HIS_MAX_RECORD_LEN);
 286 }
 287 
 288 static char *
 289 history_str_get(zfs_cmd_t *zc)
 290 {
 291         char *buf;
 292 
 293         if (zc->zc_history == NULL)
 294                 return (NULL);
 295 
 296         buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
 297         if (copyinstr((void *)(uintptr_t)zc->zc_history,
 298             buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
 299                 history_str_free(buf);
 300                 return (NULL);
 301         }
 302 
 303         buf[HIS_MAX_RECORD_LEN -1] = '\0';
 304 
 305         return (buf);
 306 }
 307 
 308 /*
 309  * Check to see if the named dataset is currently defined as bootable
 310  */
 311 static boolean_t
 312 zfs_is_bootfs(const char *name)
 313 {
 314         objset_t *os;
 315 
 316         if (dmu_objset_hold(name, FTAG, &os) == 0) {
 317                 boolean_t ret;
 318                 ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
 319                 dmu_objset_rele(os, FTAG);
 320                 return (ret);
 321         }
 322         return (B_FALSE);
 323 }
 324 
 325 /*
 326  * zfs_earlier_version
 327  *
 328  *      Return non-zero if the spa version is less than requested version.
 329  */
 330 static int
 331 zfs_earlier_version(const char *name, int version)
 332 {
 333         spa_t *spa;
 334 
 335         if (spa_open(name, &spa, FTAG) == 0) {
 336                 if (spa_version(spa) < version) {
 337                         spa_close(spa, FTAG);
 338                         return (1);
 339                 }
 340                 spa_close(spa, FTAG);
 341         }
 342         return (0);
 343 }
 344 
 345 /*
 346  * zpl_earlier_version
 347  *
 348  * Return TRUE if the ZPL version is less than requested version.
 349  */
 350 static boolean_t
 351 zpl_earlier_version(const char *name, int version)
 352 {
 353         objset_t *os;
 354         boolean_t rc = B_TRUE;
 355 
 356         if (dmu_objset_hold(name, FTAG, &os) == 0) {
 357                 uint64_t zplversion;
 358 
 359                 if (dmu_objset_type(os) != DMU_OST_ZFS) {
 360                         dmu_objset_rele(os, FTAG);
 361                         return (B_TRUE);
 362                 }
 363                 /* XXX reading from non-owned objset */
 364                 if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
 365                         rc = zplversion < version;
 366                 dmu_objset_rele(os, FTAG);
 367         }
 368         return (rc);
 369 }
 370 
 371 static void
 372 zfs_log_history(zfs_cmd_t *zc)
 373 {
 374         spa_t *spa;
 375         char *buf;
 376 
 377         if ((buf = history_str_get(zc)) == NULL)
 378                 return;
 379 
 380         if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
 381                 if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
 382                         (void) spa_history_log(spa, buf);
 383                 spa_close(spa, FTAG);
 384         }
 385         history_str_free(buf);
 386 }
 387 
 388 /*
 389  * Policy for top-level read operations (list pools).  Requires no privileges,
 390  * and can be used in the local zone, as there is no associated dataset.
 391  */
 392 /* ARGSUSED */
 393 static int
 394 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 395 {
 396         return (0);
 397 }
 398 
 399 /*
 400  * Policy for dataset read operations (list children, get statistics).  Requires
 401  * no privileges, but must be visible in the local zone.
 402  */
 403 /* ARGSUSED */
 404 static int
 405 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 406 {
 407         if (INGLOBALZONE(curproc) ||
 408             zone_dataset_visible(zc->zc_name, NULL))
 409                 return (0);
 410 
 411         return (ENOENT);
 412 }
 413 
 414 static int
 415 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
 416 {
 417         int writable = 1;
 418 
 419         /*
 420          * The dataset must be visible by this zone -- check this first
 421          * so they don't see EPERM on something they shouldn't know about.
 422          */
 423         if (!INGLOBALZONE(curproc) &&
 424             !zone_dataset_visible(dataset, &writable))
 425                 return (ENOENT);
 426 
 427         if (INGLOBALZONE(curproc)) {
 428                 /*
 429                  * If the fs is zoned, only root can access it from the
 430                  * global zone.
 431                  */
 432                 if (secpolicy_zfs(cr) && zoned)
 433                         return (EPERM);
 434         } else {
 435                 /*
 436                  * If we are in a local zone, the 'zoned' property must be set.
 437                  */
 438                 if (!zoned)
 439                         return (EPERM);
 440 
 441                 /* must be writable by this zone */
 442                 if (!writable)
 443                         return (EPERM);
 444         }
 445         return (0);
 446 }
 447 
 448 static int
 449 zfs_dozonecheck(const char *dataset, cred_t *cr)
 450 {
 451         uint64_t zoned;
 452 
 453         if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
 454                 return (ENOENT);
 455 
 456         return (zfs_dozonecheck_impl(dataset, zoned, cr));
 457 }
 458 
 459 static int
 460 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
 461 {
 462         uint64_t zoned;
 463 
 464         rw_enter(&ds->ds_dir->dd_pool->dp_config_rwlock, RW_READER);
 465         if (dsl_prop_get_ds(ds, "zoned", 8, 1, &zoned, NULL)) {
 466                 rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);
 467                 return (ENOENT);
 468         }
 469         rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);
 470 
 471         return (zfs_dozonecheck_impl(dataset, zoned, cr));
 472 }
 473 
 474 static int
 475 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
 476 {
 477         int error;
 478         dsl_dataset_t *ds;
 479 
 480         error = dsl_dataset_hold(name, FTAG, &ds);
 481         if (error != 0)
 482                 return (error);
 483 
 484         error = zfs_dozonecheck_ds(name, ds, cr);
 485         if (error == 0) {
 486                 error = secpolicy_zfs(cr);
 487                 if (error)
 488                         error = dsl_deleg_access_impl(ds, perm, cr);
 489         }
 490 
 491         dsl_dataset_rele(ds, FTAG);
 492         return (error);
 493 }
 494 
 495 static int
 496 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
 497     const char *perm, cred_t *cr)
 498 {
 499         int error;
 500 
 501         error = zfs_dozonecheck_ds(name, ds, cr);
 502         if (error == 0) {
 503                 error = secpolicy_zfs(cr);
 504                 if (error)
 505                         error = dsl_deleg_access_impl(ds, perm, cr);
 506         }
 507         return (error);
 508 }
 509 
 510 /*
 511  * Policy for setting the security label property.
 512  *
 513  * Returns 0 for success, non-zero for access and other errors.
 514  */
 515 static int
 516 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
 517 {
 518         char            ds_hexsl[MAXNAMELEN];
 519         bslabel_t       ds_sl, new_sl;
 520         boolean_t       new_default = FALSE;
 521         uint64_t        zoned;
 522         int             needed_priv = -1;
 523         int             error;
 524 
 525         /* First get the existing dataset label. */
 526         error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
 527             1, sizeof (ds_hexsl), &ds_hexsl, NULL);
 528         if (error)
 529                 return (EPERM);
 530 
 531         if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
 532                 new_default = TRUE;
 533 
 534         /* The label must be translatable */
 535         if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
 536                 return (EINVAL);
 537 
 538         /*
 539          * In a non-global zone, disallow attempts to set a label that
 540          * doesn't match that of the zone; otherwise no other checks
 541          * are needed.
 542          */
 543         if (!INGLOBALZONE(curproc)) {
 544                 if (new_default || !blequal(&new_sl, CR_SL(CRED())))
 545                         return (EPERM);
 546                 return (0);
 547         }
 548 
 549         /*
 550          * For global-zone datasets (i.e., those whose zoned property is
 551          * "off", verify that the specified new label is valid for the
 552          * global zone.
 553          */
 554         if (dsl_prop_get_integer(name,
 555             zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
 556                 return (EPERM);
 557         if (!zoned) {
 558                 if (zfs_check_global_label(name, strval) != 0)
 559                         return (EPERM);
 560         }
 561 
 562         /*
 563          * If the existing dataset label is nondefault, check if the
 564          * dataset is mounted (label cannot be changed while mounted).
 565          * Get the zfsvfs; if there isn't one, then the dataset isn't
 566          * mounted (or isn't a dataset, doesn't exist, ...).
 567          */
 568         if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
 569                 objset_t *os;
 570                 static char *setsl_tag = "setsl_tag";
 571 
 572                 /*
 573                  * Try to own the dataset; abort if there is any error,
 574                  * (e.g., already mounted, in use, or other error).
 575                  */
 576                 error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
 577                     setsl_tag, &os);
 578                 if (error)
 579                         return (EPERM);
 580 
 581                 dmu_objset_disown(os, setsl_tag);
 582 
 583                 if (new_default) {
 584                         needed_priv = PRIV_FILE_DOWNGRADE_SL;
 585                         goto out_check;
 586                 }
 587 
 588                 if (hexstr_to_label(strval, &new_sl) != 0)
 589                         return (EPERM);
 590 
 591                 if (blstrictdom(&ds_sl, &new_sl))
 592                         needed_priv = PRIV_FILE_DOWNGRADE_SL;
 593                 else if (blstrictdom(&new_sl, &ds_sl))
 594                         needed_priv = PRIV_FILE_UPGRADE_SL;
 595         } else {
 596                 /* dataset currently has a default label */
 597                 if (!new_default)
 598                         needed_priv = PRIV_FILE_UPGRADE_SL;
 599         }
 600 
 601 out_check:
 602         if (needed_priv != -1)
 603                 return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
 604         return (0);
 605 }
 606 
 607 static int
 608 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
 609     cred_t *cr)
 610 {
 611         char *strval;
 612 
 613         /*
 614          * Check permissions for special properties.
 615          */
 616         switch (prop) {
 617         case ZFS_PROP_ZONED:
 618                 /*
 619                  * Disallow setting of 'zoned' from within a local zone.
 620                  */
 621                 if (!INGLOBALZONE(curproc))
 622                         return (EPERM);
 623                 break;
 624 
 625         case ZFS_PROP_QUOTA:
 626                 if (!INGLOBALZONE(curproc)) {
 627                         uint64_t zoned;
 628                         char setpoint[MAXNAMELEN];
 629                         /*
 630                          * Unprivileged users are allowed to modify the
 631                          * quota on things *under* (ie. contained by)
 632                          * the thing they own.
 633                          */
 634                         if (dsl_prop_get_integer(dsname, "zoned", &zoned,
 635                             setpoint))
 636                                 return (EPERM);
 637                         if (!zoned || strlen(dsname) <= strlen(setpoint))
 638                                 return (EPERM);
 639                 }
 640                 break;
 641 
 642         case ZFS_PROP_MLSLABEL:
 643                 if (!is_system_labeled())
 644                         return (EPERM);
 645 
 646                 if (nvpair_value_string(propval, &strval) == 0) {
 647                         int err;
 648 
 649                         err = zfs_set_slabel_policy(dsname, strval, CRED());
 650                         if (err != 0)
 651                                 return (err);
 652                 }
 653                 break;
 654         }
 655 
 656         return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
 657 }
 658 
 659 /* ARGSUSED */
 660 static int
 661 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 662 {
 663         int error;
 664 
 665         error = zfs_dozonecheck(zc->zc_name, cr);
 666         if (error)
 667                 return (error);
 668 
 669         /*
 670          * permission to set permissions will be evaluated later in
 671          * dsl_deleg_can_allow()
 672          */
 673         return (0);
 674 }
 675 
 676 /* ARGSUSED */
 677 static int
 678 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 679 {
 680         return (zfs_secpolicy_write_perms(zc->zc_name,
 681             ZFS_DELEG_PERM_ROLLBACK, cr));
 682 }
 683 
 684 /* ARGSUSED */
 685 static int
 686 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 687 {
 688         spa_t *spa;
 689         dsl_pool_t *dp;
 690         dsl_dataset_t *ds;
 691         char *cp;
 692         int error;
 693 
 694         /*
 695          * Generate the current snapshot name from the given objsetid, then
 696          * use that name for the secpolicy/zone checks.
 697          */
 698         cp = strchr(zc->zc_name, '@');
 699         if (cp == NULL)
 700                 return (EINVAL);
 701         error = spa_open(zc->zc_name, &spa, FTAG);
 702         if (error)
 703                 return (error);
 704 
 705         dp = spa_get_dsl(spa);
 706         rw_enter(&dp->dp_config_rwlock, RW_READER);
 707         error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
 708         rw_exit(&dp->dp_config_rwlock);
 709         spa_close(spa, FTAG);
 710         if (error)
 711                 return (error);
 712 
 713         dsl_dataset_name(ds, zc->zc_name);
 714 
 715         error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
 716             ZFS_DELEG_PERM_SEND, cr);
 717         dsl_dataset_rele(ds, FTAG);
 718 
 719         return (error);
 720 }
 721 
 722 /* ARGSUSED */
 723 static int
 724 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 725 {
 726         return (zfs_secpolicy_write_perms(zc->zc_name,
 727             ZFS_DELEG_PERM_SEND, cr));
 728 }
 729 
 730 /* ARGSUSED */
 731 static int
 732 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 733 {
 734         vnode_t *vp;
 735         int error;
 736 
 737         if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
 738             NO_FOLLOW, NULL, &vp)) != 0)
 739                 return (error);
 740 
 741         /* Now make sure mntpnt and dataset are ZFS */
 742 
 743         if (vp->v_vfsp->vfs_fstype != zfsfstype ||
 744             (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
 745             zc->zc_name) != 0)) {
 746                 VN_RELE(vp);
 747                 return (EPERM);
 748         }
 749 
 750         VN_RELE(vp);
 751         return (dsl_deleg_access(zc->zc_name,
 752             ZFS_DELEG_PERM_SHARE, cr));
 753 }
 754 
 755 int
 756 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 757 {
 758         if (!INGLOBALZONE(curproc))
 759                 return (EPERM);
 760 
 761         if (secpolicy_nfs(cr) == 0) {
 762                 return (0);
 763         } else {
 764                 return (zfs_secpolicy_deleg_share(zc, innvl, cr));
 765         }
 766 }
 767 
 768 int
 769 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 770 {
 771         if (!INGLOBALZONE(curproc))
 772                 return (EPERM);
 773 
 774         if (secpolicy_smb(cr) == 0) {
 775                 return (0);
 776         } else {
 777                 return (zfs_secpolicy_deleg_share(zc, innvl, cr));
 778         }
 779 }
 780 
 781 static int
 782 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
 783 {
 784         char *cp;
 785 
 786         /*
 787          * Remove the @bla or /bla from the end of the name to get the parent.
 788          */
 789         (void) strncpy(parent, datasetname, parentsize);
 790         cp = strrchr(parent, '@');
 791         if (cp != NULL) {
 792                 cp[0] = '\0';
 793         } else {
 794                 cp = strrchr(parent, '/');
 795                 if (cp == NULL)
 796                         return (ENOENT);
 797                 cp[0] = '\0';
 798         }
 799 
 800         return (0);
 801 }
 802 
 803 int
 804 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
 805 {
 806         int error;
 807 
 808         if ((error = zfs_secpolicy_write_perms(name,
 809             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 810                 return (error);
 811 
 812         return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
 813 }
 814 
 815 /* ARGSUSED */
 816 static int
 817 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 818 {
 819         return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
 820 }
 821 
 822 /*
 823  * Destroying snapshots with delegated permissions requires
 824  * descendant mount and destroy permissions.
 825  */
 826 /* ARGSUSED */
 827 static int
 828 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 829 {
 830         nvlist_t *snaps;
 831         nvpair_t *pair, *nextpair;
 832         int error = 0;
 833 
 834         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
 835                 return (EINVAL);
 836         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
 837             pair = nextpair) {
 838                 dsl_dataset_t *ds;
 839 
 840                 nextpair = nvlist_next_nvpair(snaps, pair);
 841                 error = dsl_dataset_hold(nvpair_name(pair), FTAG, &ds);
 842                 if (error == 0) {
 843                         dsl_dataset_rele(ds, FTAG);
 844                 } else if (error == ENOENT) {
 845                         /*
 846                          * Ignore any snapshots that don't exist (we consider
 847                          * them "already destroyed").  Remove the name from the
 848                          * nvl here in case the snapshot is created between
 849                          * now and when we try to destroy it (in which case
 850                          * we don't want to destroy it since we haven't
 851                          * checked for permission).
 852                          */
 853                         fnvlist_remove_nvpair(snaps, pair);
 854                         error = 0;
 855                         continue;
 856                 } else {
 857                         break;
 858                 }
 859                 error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
 860                 if (error != 0)
 861                         break;
 862         }
 863 
 864         return (error);
 865 }
 866 
 867 int
 868 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
 869 {
 870         char    parentname[MAXNAMELEN];
 871         int     error;
 872 
 873         if ((error = zfs_secpolicy_write_perms(from,
 874             ZFS_DELEG_PERM_RENAME, cr)) != 0)
 875                 return (error);
 876 
 877         if ((error = zfs_secpolicy_write_perms(from,
 878             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 879                 return (error);
 880 
 881         if ((error = zfs_get_parent(to, parentname,
 882             sizeof (parentname))) != 0)
 883                 return (error);
 884 
 885         if ((error = zfs_secpolicy_write_perms(parentname,
 886             ZFS_DELEG_PERM_CREATE, cr)) != 0)
 887                 return (error);
 888 
 889         if ((error = zfs_secpolicy_write_perms(parentname,
 890             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 891                 return (error);
 892 
 893         return (error);
 894 }
 895 
 896 /* ARGSUSED */
 897 static int
 898 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 899 {
 900         return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
 901 }
 902 
 903 /* ARGSUSED */
 904 static int
 905 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 906 {
 907         char    parentname[MAXNAMELEN];
 908         objset_t *clone;
 909         int error;
 910 
 911         error = zfs_secpolicy_write_perms(zc->zc_name,
 912             ZFS_DELEG_PERM_PROMOTE, cr);
 913         if (error)
 914                 return (error);
 915 
 916         error = dmu_objset_hold(zc->zc_name, FTAG, &clone);
 917 
 918         if (error == 0) {
 919                 dsl_dataset_t *pclone = NULL;
 920                 dsl_dir_t *dd;
 921                 dd = clone->os_dsl_dataset->ds_dir;
 922 
 923                 rw_enter(&dd->dd_pool->dp_config_rwlock, RW_READER);
 924                 error = dsl_dataset_hold_obj(dd->dd_pool,
 925                     dd->dd_phys->dd_origin_obj, FTAG, &pclone);
 926                 rw_exit(&dd->dd_pool->dp_config_rwlock);
 927                 if (error) {
 928                         dmu_objset_rele(clone, FTAG);
 929                         return (error);
 930                 }
 931 
 932                 error = zfs_secpolicy_write_perms(zc->zc_name,
 933                     ZFS_DELEG_PERM_MOUNT, cr);
 934 
 935                 dsl_dataset_name(pclone, parentname);
 936                 dmu_objset_rele(clone, FTAG);
 937                 dsl_dataset_rele(pclone, FTAG);
 938                 if (error == 0)
 939                         error = zfs_secpolicy_write_perms(parentname,
 940                             ZFS_DELEG_PERM_PROMOTE, cr);
 941         }
 942         return (error);
 943 }
 944 
 945 /* ARGSUSED */
 946 static int
 947 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 948 {
 949         int error;
 950 
 951         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
 952             ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
 953                 return (error);
 954 
 955         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
 956             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 957                 return (error);
 958 
 959         return (zfs_secpolicy_write_perms(zc->zc_name,
 960             ZFS_DELEG_PERM_CREATE, cr));
 961 }
 962 
 963 int
 964 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
 965 {
 966         return (zfs_secpolicy_write_perms(name,
 967             ZFS_DELEG_PERM_SNAPSHOT, cr));
 968 }
 969 
 970 /*
 971  * Check for permission to create each snapshot in the nvlist.
 972  */
 973 /* ARGSUSED */
 974 static int
 975 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 976 {
 977         nvlist_t *snaps;
 978         int error;
 979         nvpair_t *pair;
 980 
 981         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
 982                 return (EINVAL);
 983         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
 984             pair = nvlist_next_nvpair(snaps, pair)) {
 985                 char *name = nvpair_name(pair);
 986                 char *atp = strchr(name, '@');
 987 
 988                 if (atp == NULL) {
 989                         error = EINVAL;
 990                         break;
 991                 }
 992                 *atp = '\0';
 993                 error = zfs_secpolicy_snapshot_perms(name, cr);
 994                 *atp = '@';
 995                 if (error != 0)
 996                         break;
 997         }
 998         return (error);
 999 }
1000 
1001 /* ARGSUSED */
1002 static int
1003 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1004 {
1005         /*
1006          * Even root must have a proper TSD so that we know what pool
1007          * to log to.
1008          */
1009         if (tsd_get(zfs_allow_log_key) == NULL)
1010                 return (EPERM);
1011         return (0);
1012 }
1013 
1014 static int
1015 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1016 {
1017         char    parentname[MAXNAMELEN];
1018         int     error;
1019         char    *origin;
1020 
1021         if ((error = zfs_get_parent(zc->zc_name, parentname,
1022             sizeof (parentname))) != 0)
1023                 return (error);
1024 
1025         if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1026             (error = zfs_secpolicy_write_perms(origin,
1027             ZFS_DELEG_PERM_CLONE, cr)) != 0)
1028                 return (error);
1029 
1030         if ((error = zfs_secpolicy_write_perms(parentname,
1031             ZFS_DELEG_PERM_CREATE, cr)) != 0)
1032                 return (error);
1033 
1034         return (zfs_secpolicy_write_perms(parentname,
1035             ZFS_DELEG_PERM_MOUNT, cr));
1036 }
1037 
1038 /*
1039  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1040  * SYS_CONFIG privilege, which is not available in a local zone.
1041  */
1042 /* ARGSUSED */
1043 static int
1044 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1045 {
1046         if (secpolicy_sys_config(cr, B_FALSE) != 0)
1047                 return (EPERM);
1048 
1049         return (0);
1050 }
1051 
1052 /*
1053  * Policy for object to name lookups.
1054  */
1055 /* ARGSUSED */
1056 static int
1057 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1058 {
1059         int error;
1060 
1061         if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1062                 return (0);
1063 
1064         error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1065         return (error);
1066 }
1067 
1068 /*
1069  * Policy for fault injection.  Requires all privileges.
1070  */
1071 /* ARGSUSED */
1072 static int
1073 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1074 {
1075         return (secpolicy_zinject(cr));
1076 }
1077 
1078 /* ARGSUSED */
1079 static int
1080 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1081 {
1082         zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1083 
1084         if (prop == ZPROP_INVAL) {
1085                 if (!zfs_prop_user(zc->zc_value))
1086                         return (EINVAL);
1087                 return (zfs_secpolicy_write_perms(zc->zc_name,
1088                     ZFS_DELEG_PERM_USERPROP, cr));
1089         } else {
1090                 return (zfs_secpolicy_setprop(zc->zc_name, prop,
1091                     NULL, cr));
1092         }
1093 }
1094 
1095 static int
1096 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1097 {
1098         int err = zfs_secpolicy_read(zc, innvl, cr);
1099         if (err)
1100                 return (err);
1101 
1102         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1103                 return (EINVAL);
1104 
1105         if (zc->zc_value[0] == 0) {
1106                 /*
1107                  * They are asking about a posix uid/gid.  If it's
1108                  * themself, allow it.
1109                  */
1110                 if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1111                     zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1112                         if (zc->zc_guid == crgetuid(cr))
1113                                 return (0);
1114                 } else {
1115                         if (groupmember(zc->zc_guid, cr))
1116                                 return (0);
1117                 }
1118         }
1119 
1120         return (zfs_secpolicy_write_perms(zc->zc_name,
1121             userquota_perms[zc->zc_objset_type], cr));
1122 }
1123 
1124 static int
1125 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1126 {
1127         int err = zfs_secpolicy_read(zc, innvl, cr);
1128         if (err)
1129                 return (err);
1130 
1131         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1132                 return (EINVAL);
1133 
1134         return (zfs_secpolicy_write_perms(zc->zc_name,
1135             userquota_perms[zc->zc_objset_type], cr));
1136 }
1137 
1138 /* ARGSUSED */
1139 static int
1140 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1141 {
1142         return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1143             NULL, cr));
1144 }
1145 
1146 /* ARGSUSED */
1147 static int
1148 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1149 {
1150         return (zfs_secpolicy_write_perms(zc->zc_name,
1151             ZFS_DELEG_PERM_HOLD, cr));
1152 }
1153 
1154 /* ARGSUSED */
1155 static int
1156 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1157 {
1158         return (zfs_secpolicy_write_perms(zc->zc_name,
1159             ZFS_DELEG_PERM_RELEASE, cr));
1160 }
1161 
1162 /*
1163  * Policy for allowing temporary snapshots to be taken or released
1164  */
1165 static int
1166 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1167 {
1168         /*
1169          * A temporary snapshot is the same as a snapshot,
1170          * hold, destroy and release all rolled into one.
1171          * Delegated diff alone is sufficient that we allow this.
1172          */
1173         int error;
1174 
1175         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1176             ZFS_DELEG_PERM_DIFF, cr)) == 0)
1177                 return (0);
1178 
1179         error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1180         if (!error)
1181                 error = zfs_secpolicy_hold(zc, innvl, cr);
1182         if (!error)
1183                 error = zfs_secpolicy_release(zc, innvl, cr);
1184         if (!error)
1185                 error = zfs_secpolicy_destroy(zc, innvl, cr);
1186         return (error);
1187 }
1188 
1189 /*
1190  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1191  */
1192 static int
1193 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1194 {
1195         char *packed;
1196         int error;
1197         nvlist_t *list = NULL;
1198 
1199         /*
1200          * Read in and unpack the user-supplied nvlist.
1201          */
1202         if (size == 0)
1203                 return (EINVAL);
1204 
1205         packed = kmem_alloc(size, KM_SLEEP);
1206 
1207         if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1208             iflag)) != 0) {
1209                 kmem_free(packed, size);
1210                 return (error);
1211         }
1212 
1213         if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1214                 kmem_free(packed, size);
1215                 return (error);
1216         }
1217 
1218         kmem_free(packed, size);
1219 
1220         *nvp = list;
1221         return (0);
1222 }
1223 
1224 /*
1225  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1226  * Entries will be removed from the end of the nvlist, and one int32 entry
1227  * named "N_MORE_ERRORS" will be added indicating how many entries were
1228  * removed.
1229  */
1230 static int
1231 nvlist_smush(nvlist_t *errors, size_t max)
1232 {
1233         size_t size;
1234 
1235         size = fnvlist_size(errors);
1236 
1237         if (size > max) {
1238                 nvpair_t *more_errors;
1239                 int n = 0;
1240 
1241                 if (max < 1024)
1242                         return (ENOMEM);
1243 
1244                 fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1245                 more_errors = nvlist_prev_nvpair(errors, NULL);
1246 
1247                 do {
1248                         nvpair_t *pair = nvlist_prev_nvpair(errors,
1249                             more_errors);
1250                         fnvlist_remove_nvpair(errors, pair);
1251                         n++;
1252                         size = fnvlist_size(errors);
1253                 } while (size > max);
1254 
1255                 fnvlist_remove_nvpair(errors, more_errors);
1256                 fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1257                 ASSERT3U(fnvlist_size(errors), <=, max);
1258         }
1259 
1260         return (0);
1261 }
1262 
1263 static int
1264 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1265 {
1266         char *packed = NULL;
1267         int error = 0;
1268         size_t size;
1269 
1270         size = fnvlist_size(nvl);
1271 
1272         if (size > zc->zc_nvlist_dst_size) {
1273                 error = ENOMEM;
1274         } else {
1275                 packed = fnvlist_pack(nvl, &size);
1276                 if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1277                     size, zc->zc_iflags) != 0)
1278                         error = EFAULT;
1279                 fnvlist_pack_free(packed, size);
1280         }
1281 
1282         zc->zc_nvlist_dst_size = size;
1283         zc->zc_nvlist_dst_filled = B_TRUE;
1284         return (error);
1285 }
1286 
1287 static int
1288 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1289 {
1290         objset_t *os;
1291         int error;
1292 
1293         error = dmu_objset_hold(dsname, FTAG, &os);
1294         if (error)
1295                 return (error);
1296         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1297                 dmu_objset_rele(os, FTAG);
1298                 return (EINVAL);
1299         }
1300 
1301         mutex_enter(&os->os_user_ptr_lock);
1302         *zfvp = dmu_objset_get_user(os);
1303         if (*zfvp) {
1304                 VFS_HOLD((*zfvp)->z_vfs);
1305         } else {
1306                 error = ESRCH;
1307         }
1308         mutex_exit(&os->os_user_ptr_lock);
1309         dmu_objset_rele(os, FTAG);
1310         return (error);
1311 }
1312 
1313 /*
1314  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1315  * case its z_vfs will be NULL, and it will be opened as the owner.
1316  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1317  * which prevents all vnode ops from running.
1318  */
1319 static int
1320 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1321 {
1322         int error = 0;
1323 
1324         if (getzfsvfs(name, zfvp) != 0)
1325                 error = zfsvfs_create(name, zfvp);
1326         if (error == 0) {
1327                 rrw_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1328                     RW_READER, tag);
1329                 if ((*zfvp)->z_unmounted) {
1330                         /*
1331                          * XXX we could probably try again, since the unmounting
1332                          * thread should be just about to disassociate the
1333                          * objset from the zfsvfs.
1334                          */
1335                         rrw_exit(&(*zfvp)->z_teardown_lock, tag);
1336                         return (EBUSY);
1337                 }
1338         }
1339         return (error);
1340 }
1341 
1342 static void
1343 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1344 {
1345         rrw_exit(&zfsvfs->z_teardown_lock, tag);
1346 
1347         if (zfsvfs->z_vfs) {
1348                 VFS_RELE(zfsvfs->z_vfs);
1349         } else {
1350                 dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1351                 zfsvfs_free(zfsvfs);
1352         }
1353 }
1354 
1355 static int
1356 zfs_ioc_pool_create(zfs_cmd_t *zc)
1357 {
1358         int error;
1359         nvlist_t *config, *props = NULL;
1360         nvlist_t *rootprops = NULL;
1361         nvlist_t *zplprops = NULL;
1362 
1363         if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1364             zc->zc_iflags, &config))
1365                 return (error);
1366 
1367         if (zc->zc_nvlist_src_size != 0 && (error =
1368             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1369             zc->zc_iflags, &props))) {
1370                 nvlist_free(config);
1371                 return (error);
1372         }
1373 
1374         if (props) {
1375                 nvlist_t *nvl = NULL;
1376                 uint64_t version = SPA_VERSION;
1377 
1378                 (void) nvlist_lookup_uint64(props,
1379                     zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1380                 if (!SPA_VERSION_IS_SUPPORTED(version)) {
1381                         error = EINVAL;
1382                         goto pool_props_bad;
1383                 }
1384                 (void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1385                 if (nvl) {
1386                         error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1387                         if (error != 0) {
1388                                 nvlist_free(config);
1389                                 nvlist_free(props);
1390                                 return (error);
1391                         }
1392                         (void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1393                 }
1394                 VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1395                 error = zfs_fill_zplprops_root(version, rootprops,
1396                     zplprops, NULL);
1397                 if (error)
1398                         goto pool_props_bad;
1399         }
1400 
1401         error = spa_create(zc->zc_name, config, props, zplprops);
1402 
1403         /*
1404          * Set the remaining root properties
1405          */
1406         if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1407             ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1408                 (void) spa_destroy(zc->zc_name);
1409 
1410 pool_props_bad:
1411         nvlist_free(rootprops);
1412         nvlist_free(zplprops);
1413         nvlist_free(config);
1414         nvlist_free(props);
1415 
1416         return (error);
1417 }
1418 
1419 static int
1420 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1421 {
1422         int error;
1423         zfs_log_history(zc);
1424         error = spa_destroy(zc->zc_name);
1425         if (error == 0)
1426                 zvol_remove_minors(zc->zc_name);
1427         return (error);
1428 }
1429 
1430 static int
1431 zfs_ioc_pool_import(zfs_cmd_t *zc)
1432 {
1433         nvlist_t *config, *props = NULL;
1434         uint64_t guid;
1435         int error;
1436 
1437         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1438             zc->zc_iflags, &config)) != 0)
1439                 return (error);
1440 
1441         if (zc->zc_nvlist_src_size != 0 && (error =
1442             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1443             zc->zc_iflags, &props))) {
1444                 nvlist_free(config);
1445                 return (error);
1446         }
1447 
1448         if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1449             guid != zc->zc_guid)
1450                 error = EINVAL;
1451         else
1452                 error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1453 
1454         if (zc->zc_nvlist_dst != 0) {
1455                 int err;
1456 
1457                 if ((err = put_nvlist(zc, config)) != 0)
1458                         error = err;
1459         }
1460 
1461         nvlist_free(config);
1462 
1463         if (props)
1464                 nvlist_free(props);
1465 
1466         return (error);
1467 }
1468 
1469 static int
1470 zfs_ioc_pool_export(zfs_cmd_t *zc)
1471 {
1472         int error;
1473         boolean_t force = (boolean_t)zc->zc_cookie;
1474         boolean_t hardforce = (boolean_t)zc->zc_guid;
1475 
1476         zfs_log_history(zc);
1477         error = spa_export(zc->zc_name, NULL, force, hardforce);
1478         if (error == 0)
1479                 zvol_remove_minors(zc->zc_name);
1480         return (error);
1481 }
1482 
1483 static int
1484 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1485 {
1486         nvlist_t *configs;
1487         int error;
1488 
1489         if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1490                 return (EEXIST);
1491 
1492         error = put_nvlist(zc, configs);
1493 
1494         nvlist_free(configs);
1495 
1496         return (error);
1497 }
1498 
1499 /*
1500  * inputs:
1501  * zc_name              name of the pool
1502  *
1503  * outputs:
1504  * zc_cookie            real errno
1505  * zc_nvlist_dst        config nvlist
1506  * zc_nvlist_dst_size   size of config nvlist
1507  */
1508 static int
1509 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1510 {
1511         nvlist_t *config;
1512         int error;
1513         int ret = 0;
1514 
1515         error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1516             sizeof (zc->zc_value));
1517 
1518         if (config != NULL) {
1519                 ret = put_nvlist(zc, config);
1520                 nvlist_free(config);
1521 
1522                 /*
1523                  * The config may be present even if 'error' is non-zero.
1524                  * In this case we return success, and preserve the real errno
1525                  * in 'zc_cookie'.
1526                  */
1527                 zc->zc_cookie = error;
1528         } else {
1529                 ret = error;
1530         }
1531 
1532         return (ret);
1533 }
1534 
1535 /*
1536  * Try to import the given pool, returning pool stats as appropriate so that
1537  * user land knows which devices are available and overall pool health.
1538  */
1539 static int
1540 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1541 {
1542         nvlist_t *tryconfig, *config;
1543         int error;
1544 
1545         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1546             zc->zc_iflags, &tryconfig)) != 0)
1547                 return (error);
1548 
1549         config = spa_tryimport(tryconfig);
1550 
1551         nvlist_free(tryconfig);
1552 
1553         if (config == NULL)
1554                 return (EINVAL);
1555 
1556         error = put_nvlist(zc, config);
1557         nvlist_free(config);
1558 
1559         return (error);
1560 }
1561 
1562 /*
1563  * inputs:
1564  * zc_name              name of the pool
1565  * zc_cookie            scan func (pool_scan_func_t)
1566  */
1567 static int
1568 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1569 {
1570         spa_t *spa;
1571         int error;
1572 
1573         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1574                 return (error);
1575 
1576         if (zc->zc_cookie == POOL_SCAN_NONE)
1577                 error = spa_scan_stop(spa);
1578         else
1579                 error = spa_scan(spa, zc->zc_cookie);
1580 
1581         spa_close(spa, FTAG);
1582 
1583         return (error);
1584 }
1585 
1586 static int
1587 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1588 {
1589         spa_t *spa;
1590         int error;
1591 
1592         error = spa_open(zc->zc_name, &spa, FTAG);
1593         if (error == 0) {
1594                 spa_freeze(spa);
1595                 spa_close(spa, FTAG);
1596         }
1597         return (error);
1598 }
1599 
1600 static int
1601 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1602 {
1603         spa_t *spa;
1604         int error;
1605 
1606         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1607                 return (error);
1608 
1609         if (zc->zc_cookie < spa_version(spa) ||
1610             !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1611                 spa_close(spa, FTAG);
1612                 return (EINVAL);
1613         }
1614 
1615         spa_upgrade(spa, zc->zc_cookie);
1616         spa_close(spa, FTAG);
1617 
1618         return (error);
1619 }
1620 
1621 static int
1622 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1623 {
1624         spa_t *spa;
1625         char *hist_buf;
1626         uint64_t size;
1627         int error;
1628 
1629         if ((size = zc->zc_history_len) == 0)
1630                 return (EINVAL);
1631 
1632         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1633                 return (error);
1634 
1635         if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1636                 spa_close(spa, FTAG);
1637                 return (ENOTSUP);
1638         }
1639 
1640         hist_buf = kmem_alloc(size, KM_SLEEP);
1641         if ((error = spa_history_get(spa, &zc->zc_history_offset,
1642             &zc->zc_history_len, hist_buf)) == 0) {
1643                 error = ddi_copyout(hist_buf,
1644                     (void *)(uintptr_t)zc->zc_history,
1645                     zc->zc_history_len, zc->zc_iflags);
1646         }
1647 
1648         spa_close(spa, FTAG);
1649         kmem_free(hist_buf, size);
1650         return (error);
1651 }
1652 
1653 static int
1654 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1655 {
1656         spa_t *spa;
1657         int error;
1658 
1659         error = spa_open(zc->zc_name, &spa, FTAG);
1660         if (error == 0) {
1661                 error = spa_change_guid(spa);
1662                 spa_close(spa, FTAG);
1663         }
1664         return (error);
1665 }
1666 
1667 static int
1668 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1669 {
1670         int error;
1671 
1672         if (error = dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value))
1673                 return (error);
1674 
1675         return (0);
1676 }
1677 
1678 /*
1679  * inputs:
1680  * zc_name              name of filesystem
1681  * zc_obj               object to find
1682  *
1683  * outputs:
1684  * zc_value             name of object
1685  */
1686 static int
1687 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1688 {
1689         objset_t *os;
1690         int error;
1691 
1692         /* XXX reading from objset not owned */
1693         if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1694                 return (error);
1695         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1696                 dmu_objset_rele(os, FTAG);
1697                 return (EINVAL);
1698         }
1699         error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1700             sizeof (zc->zc_value));
1701         dmu_objset_rele(os, FTAG);
1702 
1703         return (error);
1704 }
1705 
1706 /*
1707  * inputs:
1708  * zc_name              name of filesystem
1709  * zc_obj               object to find
1710  *
1711  * outputs:
1712  * zc_stat              stats on object
1713  * zc_value             path to object
1714  */
1715 static int
1716 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1717 {
1718         objset_t *os;
1719         int error;
1720 
1721         /* XXX reading from objset not owned */
1722         if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1723                 return (error);
1724         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1725                 dmu_objset_rele(os, FTAG);
1726                 return (EINVAL);
1727         }
1728         error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1729             sizeof (zc->zc_value));
1730         dmu_objset_rele(os, FTAG);
1731 
1732         return (error);
1733 }
1734 
1735 static int
1736 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1737 {
1738         spa_t *spa;
1739         int error;
1740         nvlist_t *config, **l2cache, **spares;
1741         uint_t nl2cache = 0, nspares = 0;
1742 
1743         error = spa_open(zc->zc_name, &spa, FTAG);
1744         if (error != 0)
1745                 return (error);
1746 
1747         error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1748             zc->zc_iflags, &config);
1749         (void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1750             &l2cache, &nl2cache);
1751 
1752         (void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1753             &spares, &nspares);
1754 
1755         /*
1756          * A root pool with concatenated devices is not supported.
1757          * Thus, can not add a device to a root pool.
1758          *
1759          * Intent log device can not be added to a rootpool because
1760          * during mountroot, zil is replayed, a seperated log device
1761          * can not be accessed during the mountroot time.
1762          *
1763          * l2cache and spare devices are ok to be added to a rootpool.
1764          */
1765         if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1766                 nvlist_free(config);
1767                 spa_close(spa, FTAG);
1768                 return (EDOM);
1769         }
1770 
1771         if (error == 0) {
1772                 error = spa_vdev_add(spa, config);
1773                 nvlist_free(config);
1774         }
1775         spa_close(spa, FTAG);
1776         return (error);
1777 }
1778 
1779 /*
1780  * inputs:
1781  * zc_name              name of the pool
1782  * zc_nvlist_conf       nvlist of devices to remove
1783  * zc_cookie            to stop the remove?
1784  */
1785 static int
1786 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1787 {
1788         spa_t *spa;
1789         int error;
1790 
1791         error = spa_open(zc->zc_name, &spa, FTAG);
1792         if (error != 0)
1793                 return (error);
1794         error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1795         spa_close(spa, FTAG);
1796         return (error);
1797 }
1798 
1799 static int
1800 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1801 {
1802         spa_t *spa;
1803         int error;
1804         vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1805 
1806         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1807                 return (error);
1808         switch (zc->zc_cookie) {
1809         case VDEV_STATE_ONLINE:
1810                 error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1811                 break;
1812 
1813         case VDEV_STATE_OFFLINE:
1814                 error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1815                 break;
1816 
1817         case VDEV_STATE_FAULTED:
1818                 if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1819                     zc->zc_obj != VDEV_AUX_EXTERNAL)
1820                         zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1821 
1822                 error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1823                 break;
1824 
1825         case VDEV_STATE_DEGRADED:
1826                 if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1827                     zc->zc_obj != VDEV_AUX_EXTERNAL)
1828                         zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1829 
1830                 error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1831                 break;
1832 
1833         default:
1834                 error = EINVAL;
1835         }
1836         zc->zc_cookie = newstate;
1837         spa_close(spa, FTAG);
1838         return (error);
1839 }
1840 
1841 static int
1842 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1843 {
1844         spa_t *spa;
1845         int replacing = zc->zc_cookie;
1846         nvlist_t *config;
1847         int error;
1848 
1849         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1850                 return (error);
1851 
1852         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1853             zc->zc_iflags, &config)) == 0) {
1854                 error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
1855                 nvlist_free(config);
1856         }
1857 
1858         spa_close(spa, FTAG);
1859         return (error);
1860 }
1861 
1862 static int
1863 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
1864 {
1865         spa_t *spa;
1866         int error;
1867 
1868         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1869                 return (error);
1870 
1871         error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
1872 
1873         spa_close(spa, FTAG);
1874         return (error);
1875 }
1876 
1877 static int
1878 zfs_ioc_vdev_split(zfs_cmd_t *zc)
1879 {
1880         spa_t *spa;
1881         nvlist_t *config, *props = NULL;
1882         int error;
1883         boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
1884 
1885         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1886                 return (error);
1887 
1888         if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1889             zc->zc_iflags, &config)) {
1890                 spa_close(spa, FTAG);
1891                 return (error);
1892         }
1893 
1894         if (zc->zc_nvlist_src_size != 0 && (error =
1895             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1896             zc->zc_iflags, &props))) {
1897                 spa_close(spa, FTAG);
1898                 nvlist_free(config);
1899                 return (error);
1900         }
1901 
1902         error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
1903 
1904         spa_close(spa, FTAG);
1905 
1906         nvlist_free(config);
1907         nvlist_free(props);
1908 
1909         return (error);
1910 }
1911 
1912 static int
1913 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
1914 {
1915         spa_t *spa;
1916         char *path = zc->zc_value;
1917         uint64_t guid = zc->zc_guid;
1918         int error;
1919 
1920         error = spa_open(zc->zc_name, &spa, FTAG);
1921         if (error != 0)
1922                 return (error);
1923 
1924         error = spa_vdev_setpath(spa, guid, path);
1925         spa_close(spa, FTAG);
1926         return (error);
1927 }
1928 
1929 static int
1930 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
1931 {
1932         spa_t *spa;
1933         char *fru = zc->zc_value;
1934         uint64_t guid = zc->zc_guid;
1935         int error;
1936 
1937         error = spa_open(zc->zc_name, &spa, FTAG);
1938         if (error != 0)
1939                 return (error);
1940 
1941         error = spa_vdev_setfru(spa, guid, fru);
1942         spa_close(spa, FTAG);
1943         return (error);
1944 }
1945 
1946 static int
1947 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
1948 {
1949         int error = 0;
1950         nvlist_t *nv;
1951 
1952         dmu_objset_fast_stat(os, &zc->zc_objset_stats);
1953 
1954         if (zc->zc_nvlist_dst != 0 &&
1955             (error = dsl_prop_get_all(os, &nv)) == 0) {
1956                 dmu_objset_stats(os, nv);
1957                 /*
1958                  * NB: zvol_get_stats() will read the objset contents,
1959                  * which we aren't supposed to do with a
1960                  * DS_MODE_USER hold, because it could be
1961                  * inconsistent.  So this is a bit of a workaround...
1962                  * XXX reading with out owning
1963                  */
1964                 if (!zc->zc_objset_stats.dds_inconsistent &&
1965                     dmu_objset_type(os) == DMU_OST_ZVOL) {
1966                         error = zvol_get_stats(os, nv);
1967                         if (error == EIO)
1968                                 return (error);
1969                         VERIFY0(error);
1970                 }
1971                 error = put_nvlist(zc, nv);
1972                 nvlist_free(nv);
1973         }
1974 
1975         return (error);
1976 }
1977 
1978 /*
1979  * inputs:
1980  * zc_name              name of filesystem
1981  * zc_nvlist_dst_size   size of buffer for property nvlist
1982  *
1983  * outputs:
1984  * zc_objset_stats      stats
1985  * zc_nvlist_dst        property nvlist
1986  * zc_nvlist_dst_size   size of property nvlist
1987  */
1988 static int
1989 zfs_ioc_objset_stats(zfs_cmd_t *zc)
1990 {
1991         objset_t *os = NULL;
1992         int error;
1993 
1994         if (error = dmu_objset_hold(zc->zc_name, FTAG, &os))
1995                 return (error);
1996 
1997         error = zfs_ioc_objset_stats_impl(zc, os);
1998 
1999         dmu_objset_rele(os, FTAG);
2000 
2001         return (error);
2002 }
2003 
2004 /*
2005  * inputs:
2006  * zc_name              name of filesystem
2007  * zc_nvlist_dst_size   size of buffer for property nvlist
2008  *
2009  * outputs:
2010  * zc_nvlist_dst        received property nvlist
2011  * zc_nvlist_dst_size   size of received property nvlist
2012  *
2013  * Gets received properties (distinct from local properties on or after
2014  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2015  * local property values.
2016  */
2017 static int
2018 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2019 {
2020         objset_t *os = NULL;
2021         int error;
2022         nvlist_t *nv;
2023 
2024         if (error = dmu_objset_hold(zc->zc_name, FTAG, &os))
2025                 return (error);
2026 
2027         /*
2028          * Without this check, we would return local property values if the
2029          * caller has not already received properties on or after
2030          * SPA_VERSION_RECVD_PROPS.
2031          */
2032         if (!dsl_prop_get_hasrecvd(os)) {
2033                 dmu_objset_rele(os, FTAG);
2034                 return (ENOTSUP);
2035         }
2036 
2037         if (zc->zc_nvlist_dst != 0 &&
2038             (error = dsl_prop_get_received(os, &nv)) == 0) {
2039                 error = put_nvlist(zc, nv);
2040                 nvlist_free(nv);
2041         }
2042 
2043         dmu_objset_rele(os, FTAG);
2044         return (error);
2045 }
2046 
2047 static int
2048 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2049 {
2050         uint64_t value;
2051         int error;
2052 
2053         /*
2054          * zfs_get_zplprop() will either find a value or give us
2055          * the default value (if there is one).
2056          */
2057         if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2058                 return (error);
2059         VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2060         return (0);
2061 }
2062 
2063 /*
2064  * inputs:
2065  * zc_name              name of filesystem
2066  * zc_nvlist_dst_size   size of buffer for zpl property nvlist
2067  *
2068  * outputs:
2069  * zc_nvlist_dst        zpl property nvlist
2070  * zc_nvlist_dst_size   size of zpl property nvlist
2071  */
2072 static int
2073 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2074 {
2075         objset_t *os;
2076         int err;
2077 
2078         /* XXX reading without owning */
2079         if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2080                 return (err);
2081 
2082         dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2083 
2084         /*
2085          * NB: nvl_add_zplprop() will read the objset contents,
2086          * which we aren't supposed to do with a DS_MODE_USER
2087          * hold, because it could be inconsistent.
2088          */
2089         if (zc->zc_nvlist_dst != NULL &&
2090             !zc->zc_objset_stats.dds_inconsistent &&
2091             dmu_objset_type(os) == DMU_OST_ZFS) {
2092                 nvlist_t *nv;
2093 
2094                 VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2095                 if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2096                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2097                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2098                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2099                         err = put_nvlist(zc, nv);
2100                 nvlist_free(nv);
2101         } else {
2102                 err = ENOENT;
2103         }
2104         dmu_objset_rele(os, FTAG);
2105         return (err);
2106 }
2107 
2108 static boolean_t
2109 dataset_name_hidden(const char *name)
2110 {
2111         /*
2112          * Skip over datasets that are not visible in this zone,
2113          * internal datasets (which have a $ in their name), and
2114          * temporary datasets (which have a % in their name).
2115          */
2116         if (strchr(name, '$') != NULL)
2117                 return (B_TRUE);
2118         if (strchr(name, '%') != NULL)
2119                 return (B_TRUE);
2120         if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2121                 return (B_TRUE);
2122         return (B_FALSE);
2123 }
2124 
2125 /*
2126  * inputs:
2127  * zc_name              name of filesystem
2128  * zc_cookie            zap cursor
2129  * zc_nvlist_dst_size   size of buffer for property nvlist
2130  *
2131  * outputs:
2132  * zc_name              name of next filesystem
2133  * zc_cookie            zap cursor
2134  * zc_objset_stats      stats
2135  * zc_nvlist_dst        property nvlist
2136  * zc_nvlist_dst_size   size of property nvlist
2137  */
2138 static int
2139 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2140 {
2141         objset_t *os;
2142         int error;
2143         char *p;
2144         size_t orig_len = strlen(zc->zc_name);
2145 
2146 top:
2147         if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2148                 if (error == ENOENT)
2149                         error = ESRCH;
2150                 return (error);
2151         }
2152 
2153         p = strrchr(zc->zc_name, '/');
2154         if (p == NULL || p[1] != '\0')
2155                 (void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2156         p = zc->zc_name + strlen(zc->zc_name);
2157 
2158         /*
2159          * Pre-fetch the datasets.  dmu_objset_prefetch() always returns 0
2160          * but is not declared void because its called by dmu_objset_find().
2161          */
2162         if (zc->zc_cookie == 0) {
2163                 uint64_t cookie = 0;
2164                 int len = sizeof (zc->zc_name) - (p - zc->zc_name);
2165 
2166                 while (dmu_dir_list_next(os, len, p, NULL, &cookie) == 0) {
2167                         if (!dataset_name_hidden(zc->zc_name))
2168                                 (void) dmu_objset_prefetch(zc->zc_name, NULL);
2169                 }
2170         }
2171 
2172         do {
2173                 error = dmu_dir_list_next(os,
2174                     sizeof (zc->zc_name) - (p - zc->zc_name), p,
2175                     NULL, &zc->zc_cookie);
2176                 if (error == ENOENT)
2177                         error = ESRCH;
2178         } while (error == 0 && dataset_name_hidden(zc->zc_name));
2179         dmu_objset_rele(os, FTAG);
2180 
2181         /*
2182          * If it's an internal dataset (ie. with a '$' in its name),
2183          * don't try to get stats for it, otherwise we'll return ENOENT.
2184          */
2185         if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2186                 error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2187                 if (error == ENOENT) {
2188                         /* We lost a race with destroy, get the next one. */
2189                         zc->zc_name[orig_len] = '\0';
2190                         goto top;
2191                 }
2192         }
2193         return (error);
2194 }
2195 
2196 /*
2197  * inputs:
2198  * zc_name              name of filesystem
2199  * zc_cookie            zap cursor
2200  * zc_nvlist_dst_size   size of buffer for property nvlist
2201  *
2202  * outputs:
2203  * zc_name              name of next snapshot
2204  * zc_objset_stats      stats
2205  * zc_nvlist_dst        property nvlist
2206  * zc_nvlist_dst_size   size of property nvlist
2207  */
2208 static int
2209 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2210 {
2211         objset_t *os;
2212         int error;
2213 
2214 top:
2215         if (zc->zc_cookie == 0)
2216                 (void) dmu_objset_find(zc->zc_name, dmu_objset_prefetch,
2217                     NULL, DS_FIND_SNAPSHOTS);
2218 
2219         error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2220         if (error)
2221                 return (error == ENOENT ? ESRCH : error);
2222 
2223         /*
2224          * A dataset name of maximum length cannot have any snapshots,
2225          * so exit immediately.
2226          */
2227         if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
2228                 dmu_objset_rele(os, FTAG);
2229                 return (ESRCH);
2230         }
2231 
2232         error = dmu_snapshot_list_next(os,
2233             sizeof (zc->zc_name) - strlen(zc->zc_name),
2234             zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2235             NULL);
2236 
2237         if (error == 0) {
2238                 dsl_dataset_t *ds;
2239                 dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2240 
2241                 /*
2242                  * Since we probably don't have a hold on this snapshot,
2243                  * it's possible that the objsetid could have been destroyed
2244                  * and reused for a new objset. It's OK if this happens during
2245                  * a zfs send operation, since the new createtxg will be
2246                  * beyond the range we're interested in.
2247                  */
2248                 rw_enter(&dp->dp_config_rwlock, RW_READER);
2249                 error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2250                 rw_exit(&dp->dp_config_rwlock);
2251                 if (error) {
2252                         if (error == ENOENT) {
2253                                 /* Racing with destroy, get the next one. */
2254                                 *strchr(zc->zc_name, '@') = '\0';
2255                                 dmu_objset_rele(os, FTAG);
2256                                 goto top;
2257                         }
2258                 } else {
2259                         objset_t *ossnap;
2260 
2261                         error = dmu_objset_from_ds(ds, &ossnap);
2262                         if (error == 0)
2263                                 error = zfs_ioc_objset_stats_impl(zc, ossnap);
2264                         dsl_dataset_rele(ds, FTAG);
2265                 }
2266         } else if (error == ENOENT) {
2267                 error = ESRCH;
2268         }
2269 
2270         dmu_objset_rele(os, FTAG);
2271         /* if we failed, undo the @ that we tacked on to zc_name */
2272         if (error)
2273                 *strchr(zc->zc_name, '@') = '\0';
2274         return (error);
2275 }
2276 
2277 static int
2278 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2279 {
2280         const char *propname = nvpair_name(pair);
2281         uint64_t *valary;
2282         unsigned int vallen;
2283         const char *domain;
2284         char *dash;
2285         zfs_userquota_prop_t type;
2286         uint64_t rid;
2287         uint64_t quota;
2288         zfsvfs_t *zfsvfs;
2289         int err;
2290 
2291         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2292                 nvlist_t *attrs;
2293                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2294                 if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2295                     &pair) != 0)
2296                         return (EINVAL);
2297         }
2298 
2299         /*
2300          * A correctly constructed propname is encoded as
2301          * userquota@<rid>-<domain>.
2302          */
2303         if ((dash = strchr(propname, '-')) == NULL ||
2304             nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2305             vallen != 3)
2306                 return (EINVAL);
2307 
2308         domain = dash + 1;
2309         type = valary[0];
2310         rid = valary[1];
2311         quota = valary[2];
2312 
2313         err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2314         if (err == 0) {
2315                 err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2316                 zfsvfs_rele(zfsvfs, FTAG);
2317         }
2318 
2319         return (err);
2320 }
2321 
2322 /*
2323  * If the named property is one that has a special function to set its value,
2324  * return 0 on success and a positive error code on failure; otherwise if it is
2325  * not one of the special properties handled by this function, return -1.
2326  *
2327  * XXX: It would be better for callers of the property interface if we handled
2328  * these special cases in dsl_prop.c (in the dsl layer).
2329  */
2330 static int
2331 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2332     nvpair_t *pair)
2333 {
2334         const char *propname = nvpair_name(pair);
2335         zfs_prop_t prop = zfs_name_to_prop(propname);
2336         uint64_t intval;
2337         int err;
2338 
2339         if (prop == ZPROP_INVAL) {
2340                 if (zfs_prop_userquota(propname))
2341                         return (zfs_prop_set_userquota(dsname, pair));
2342                 return (-1);
2343         }
2344 
2345         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2346                 nvlist_t *attrs;
2347                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2348                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2349                     &pair) == 0);
2350         }
2351 
2352         if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2353                 return (-1);
2354 
2355         VERIFY(0 == nvpair_value_uint64(pair, &intval));
2356 
2357         switch (prop) {
2358         case ZFS_PROP_QUOTA:
2359                 err = dsl_dir_set_quota(dsname, source, intval);
2360                 break;
2361         case ZFS_PROP_REFQUOTA:
2362                 err = dsl_dataset_set_quota(dsname, source, intval);
2363                 break;
2364         case ZFS_PROP_RESERVATION:
2365                 err = dsl_dir_set_reservation(dsname, source, intval);
2366                 break;
2367         case ZFS_PROP_REFRESERVATION:
2368                 err = dsl_dataset_set_reservation(dsname, source, intval);
2369                 break;
2370         case ZFS_PROP_VOLSIZE:
2371                 err = zvol_set_volsize(dsname, ddi_driver_major(zfs_dip),
2372                     intval);
2373                 break;
2374         case ZFS_PROP_VERSION:
2375         {
2376                 zfsvfs_t *zfsvfs;
2377 
2378                 if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2379                         break;
2380 
2381                 err = zfs_set_version(zfsvfs, intval);
2382                 zfsvfs_rele(zfsvfs, FTAG);
2383 
2384                 if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2385                         zfs_cmd_t *zc;
2386 
2387                         zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2388                         (void) strcpy(zc->zc_name, dsname);
2389                         (void) zfs_ioc_userspace_upgrade(zc);
2390                         kmem_free(zc, sizeof (zfs_cmd_t));
2391                 }
2392                 break;
2393         }
2394         case ZFS_PROP_COMPRESSION:
2395         {
2396                 if (intval == ZIO_COMPRESS_LZ4 ||
2397                     intval == ZIO_COMPRESS_LZ4HC) {
2398                         zfeature_info_t *feature =
2399                             &spa_feature_table[SPA_FEATURE_LZ4_COMPRESS];
2400                         spa_t *spa;
2401                         dsl_pool_t *dp;
2402 
2403                         if ((err = spa_open(dsname, &spa, FTAG)) != 0)
2404                                 return (err);
2405 
2406                         dp = spa->spa_dsl_pool;
2407 
2408                         /*
2409                          * Setting the LZ4 compression algorithm activates
2410                          * the feature.
2411                          */
2412                         if (!spa_feature_is_active(spa, feature)) {
2413                                 if ((err = zfs_prop_activate_feature(dp,
2414                                     feature)) != 0) {
2415                                         spa_close(spa, FTAG);
2416                                         return (err);
2417                                 }
2418                         }
2419 
2420                         spa_close(spa, FTAG);
2421                 }
2422                 /*
2423                  * We still want the default set action to be performed in the
2424                  * caller, we only performed zfeature settings here.
2425                  */
2426                 err = -1;
2427                 break;
2428         }
2429 
2430         default:
2431                 err = -1;
2432         }
2433 
2434         return (err);
2435 }
2436 
2437 /*
2438  * This function is best effort. If it fails to set any of the given properties,
2439  * it continues to set as many as it can and returns the last error
2440  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2441  * with the list of names of all the properties that failed along with the
2442  * corresponding error numbers.
2443  *
2444  * If every property is set successfully, zero is returned and errlist is not
2445  * modified.
2446  */
2447 int
2448 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2449     nvlist_t *errlist)
2450 {
2451         nvpair_t *pair;
2452         nvpair_t *propval;
2453         int rv = 0;
2454         uint64_t intval;
2455         char *strval;
2456         nvlist_t *genericnvl = fnvlist_alloc();
2457         nvlist_t *retrynvl = fnvlist_alloc();
2458 
2459 retry:
2460         pair = NULL;
2461         while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2462                 const char *propname = nvpair_name(pair);
2463                 zfs_prop_t prop = zfs_name_to_prop(propname);
2464                 int err = 0;
2465 
2466                 /* decode the property value */
2467                 propval = pair;
2468                 if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2469                         nvlist_t *attrs;
2470                         attrs = fnvpair_value_nvlist(pair);
2471                         if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2472                             &propval) != 0)
2473                                 err = EINVAL;
2474                 }
2475 
2476                 /* Validate value type */
2477                 if (err == 0 && prop == ZPROP_INVAL) {
2478                         if (zfs_prop_user(propname)) {
2479                                 if (nvpair_type(propval) != DATA_TYPE_STRING)
2480                                         err = EINVAL;
2481                         } else if (zfs_prop_userquota(propname)) {
2482                                 if (nvpair_type(propval) !=
2483                                     DATA_TYPE_UINT64_ARRAY)
2484                                         err = EINVAL;
2485                         } else {
2486                                 err = EINVAL;
2487                         }
2488                 } else if (err == 0) {
2489                         if (nvpair_type(propval) == DATA_TYPE_STRING) {
2490                                 if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2491                                         err = EINVAL;
2492                         } else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2493                                 const char *unused;
2494 
2495                                 intval = fnvpair_value_uint64(propval);
2496 
2497                                 switch (zfs_prop_get_type(prop)) {
2498                                 case PROP_TYPE_NUMBER:
2499                                         break;
2500                                 case PROP_TYPE_STRING:
2501                                         err = EINVAL;
2502                                         break;
2503                                 case PROP_TYPE_INDEX:
2504                                         if (zfs_prop_index_to_string(prop,
2505                                             intval, &unused) != 0)
2506                                                 err = EINVAL;
2507                                         break;
2508                                 default:
2509                                         cmn_err(CE_PANIC,
2510                                             "unknown property type");
2511                                 }
2512                         } else {
2513                                 err = EINVAL;
2514                         }
2515                 }
2516 
2517                 /* Validate permissions */
2518                 if (err == 0)
2519                         err = zfs_check_settable(dsname, pair, CRED());
2520 
2521                 if (err == 0) {
2522                         err = zfs_prop_set_special(dsname, source, pair);
2523                         if (err == -1) {
2524                                 /*
2525                                  * For better performance we build up a list of
2526                                  * properties to set in a single transaction.
2527                                  */
2528                                 err = nvlist_add_nvpair(genericnvl, pair);
2529                         } else if (err != 0 && nvl != retrynvl) {
2530                                 /*
2531                                  * This may be a spurious error caused by
2532                                  * receiving quota and reservation out of order.
2533                                  * Try again in a second pass.
2534                                  */
2535                                 err = nvlist_add_nvpair(retrynvl, pair);
2536                         }
2537                 }
2538 
2539                 if (err != 0) {
2540                         if (errlist != NULL)
2541                                 fnvlist_add_int32(errlist, propname, err);
2542                         rv = err;
2543                 }
2544         }
2545 
2546         if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2547                 nvl = retrynvl;
2548                 goto retry;
2549         }
2550 
2551         if (!nvlist_empty(genericnvl) &&
2552             dsl_props_set(dsname, source, genericnvl) != 0) {
2553                 /*
2554                  * If this fails, we still want to set as many properties as we
2555                  * can, so try setting them individually.
2556                  */
2557                 pair = NULL;
2558                 while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2559                         const char *propname = nvpair_name(pair);
2560                         int err = 0;
2561 
2562                         propval = pair;
2563                         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2564                                 nvlist_t *attrs;
2565                                 attrs = fnvpair_value_nvlist(pair);
2566                                 propval = fnvlist_lookup_nvpair(attrs,
2567                                     ZPROP_VALUE);
2568                         }
2569 
2570                         if (nvpair_type(propval) == DATA_TYPE_STRING) {
2571                                 strval = fnvpair_value_string(propval);
2572                                 err = dsl_prop_set(dsname, propname, source, 1,
2573                                     strlen(strval) + 1, strval);
2574                         } else {
2575                                 intval = fnvpair_value_uint64(propval);
2576                                 err = dsl_prop_set(dsname, propname, source, 8,
2577                                     1, &intval);
2578                         }
2579 
2580                         if (err != 0) {
2581                                 if (errlist != NULL) {
2582                                         fnvlist_add_int32(errlist, propname,
2583                                             err);
2584                                 }
2585                                 rv = err;
2586                         }
2587                 }
2588         }
2589         nvlist_free(genericnvl);
2590         nvlist_free(retrynvl);
2591 
2592         return (rv);
2593 }
2594 
2595 /*
2596  * Check that all the properties are valid user properties.
2597  */
2598 static int
2599 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2600 {
2601         nvpair_t *pair = NULL;
2602         int error = 0;
2603 
2604         while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2605                 const char *propname = nvpair_name(pair);
2606                 char *valstr;
2607 
2608                 if (!zfs_prop_user(propname) ||
2609                     nvpair_type(pair) != DATA_TYPE_STRING)
2610                         return (EINVAL);
2611 
2612                 if (error = zfs_secpolicy_write_perms(fsname,
2613                     ZFS_DELEG_PERM_USERPROP, CRED()))
2614                         return (error);
2615 
2616                 if (strlen(propname) >= ZAP_MAXNAMELEN)
2617                         return (ENAMETOOLONG);
2618 
2619                 VERIFY(nvpair_value_string(pair, &valstr) == 0);
2620                 if (strlen(valstr) >= ZAP_MAXVALUELEN)
2621                         return (E2BIG);
2622         }
2623         return (0);
2624 }
2625 
2626 static void
2627 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2628 {
2629         nvpair_t *pair;
2630 
2631         VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2632 
2633         pair = NULL;
2634         while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2635                 if (nvlist_exists(skipped, nvpair_name(pair)))
2636                         continue;
2637 
2638                 VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2639         }
2640 }
2641 
2642 static int
2643 clear_received_props(objset_t *os, const char *fs, nvlist_t *props,
2644     nvlist_t *skipped)
2645 {
2646         int err = 0;
2647         nvlist_t *cleared_props = NULL;
2648         props_skip(props, skipped, &cleared_props);
2649         if (!nvlist_empty(cleared_props)) {
2650                 /*
2651                  * Acts on local properties until the dataset has received
2652                  * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2653                  */
2654                 zprop_source_t flags = (ZPROP_SRC_NONE |
2655                     (dsl_prop_get_hasrecvd(os) ? ZPROP_SRC_RECEIVED : 0));
2656                 err = zfs_set_prop_nvlist(fs, flags, cleared_props, NULL);
2657         }
2658         nvlist_free(cleared_props);
2659         return (err);
2660 }
2661 
2662 /*
2663  * inputs:
2664  * zc_name              name of filesystem
2665  * zc_value             name of property to set
2666  * zc_nvlist_src{_size} nvlist of properties to apply
2667  * zc_cookie            received properties flag
2668  *
2669  * outputs:
2670  * zc_nvlist_dst{_size} error for each unapplied received property
2671  */
2672 static int
2673 zfs_ioc_set_prop(zfs_cmd_t *zc)
2674 {
2675         nvlist_t *nvl;
2676         boolean_t received = zc->zc_cookie;
2677         zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2678             ZPROP_SRC_LOCAL);
2679         nvlist_t *errors;
2680         int error;
2681 
2682         if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2683             zc->zc_iflags, &nvl)) != 0)
2684                 return (error);
2685 
2686         if (received) {
2687                 nvlist_t *origprops;
2688                 objset_t *os;
2689 
2690                 if (dmu_objset_hold(zc->zc_name, FTAG, &os) == 0) {
2691                         if (dsl_prop_get_received(os, &origprops) == 0) {
2692                                 (void) clear_received_props(os,
2693                                     zc->zc_name, origprops, nvl);
2694                                 nvlist_free(origprops);
2695                         }
2696 
2697                         dsl_prop_set_hasrecvd(os);
2698                         dmu_objset_rele(os, FTAG);
2699                 }
2700         }
2701 
2702         errors = fnvlist_alloc();
2703         error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2704 
2705         if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2706                 (void) put_nvlist(zc, errors);
2707         }
2708 
2709         nvlist_free(errors);
2710         nvlist_free(nvl);
2711         return (error);
2712 }
2713 
2714 /*
2715  * inputs:
2716  * zc_name              name of filesystem
2717  * zc_value             name of property to inherit
2718  * zc_cookie            revert to received value if TRUE
2719  *
2720  * outputs:             none
2721  */
2722 static int
2723 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2724 {
2725         const char *propname = zc->zc_value;
2726         zfs_prop_t prop = zfs_name_to_prop(propname);
2727         boolean_t received = zc->zc_cookie;
2728         zprop_source_t source = (received
2729             ? ZPROP_SRC_NONE            /* revert to received value, if any */
2730             : ZPROP_SRC_INHERITED);     /* explicitly inherit */
2731 
2732         if (received) {
2733                 nvlist_t *dummy;
2734                 nvpair_t *pair;
2735                 zprop_type_t type;
2736                 int err;
2737 
2738                 /*
2739                  * zfs_prop_set_special() expects properties in the form of an
2740                  * nvpair with type info.
2741                  */
2742                 if (prop == ZPROP_INVAL) {
2743                         if (!zfs_prop_user(propname))
2744                                 return (EINVAL);
2745 
2746                         type = PROP_TYPE_STRING;
2747                 } else if (prop == ZFS_PROP_VOLSIZE ||
2748                     prop == ZFS_PROP_VERSION) {
2749                         return (EINVAL);
2750                 } else {
2751                         type = zfs_prop_get_type(prop);
2752                 }
2753 
2754                 VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2755 
2756                 switch (type) {
2757                 case PROP_TYPE_STRING:
2758                         VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2759                         break;
2760                 case PROP_TYPE_NUMBER:
2761                 case PROP_TYPE_INDEX:
2762                         VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2763                         break;
2764                 default:
2765                         nvlist_free(dummy);
2766                         return (EINVAL);
2767                 }
2768 
2769                 pair = nvlist_next_nvpair(dummy, NULL);
2770                 err = zfs_prop_set_special(zc->zc_name, source, pair);
2771                 nvlist_free(dummy);
2772                 if (err != -1)
2773                         return (err); /* special property already handled */
2774         } else {
2775                 /*
2776                  * Only check this in the non-received case. We want to allow
2777                  * 'inherit -S' to revert non-inheritable properties like quota
2778                  * and reservation to the received or default values even though
2779                  * they are not considered inheritable.
2780                  */
2781                 if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2782                         return (EINVAL);
2783         }
2784 
2785         /* property name has been validated by zfs_secpolicy_inherit_prop() */
2786         return (dsl_prop_set(zc->zc_name, zc->zc_value, source, 0, 0, NULL));
2787 }
2788 
2789 static int
2790 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2791 {
2792         nvlist_t *props;
2793         spa_t *spa;
2794         int error;
2795         nvpair_t *pair;
2796 
2797         if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2798             zc->zc_iflags, &props))
2799                 return (error);
2800 
2801         /*
2802          * If the only property is the configfile, then just do a spa_lookup()
2803          * to handle the faulted case.
2804          */
2805         pair = nvlist_next_nvpair(props, NULL);
2806         if (pair != NULL && strcmp(nvpair_name(pair),
2807             zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2808             nvlist_next_nvpair(props, pair) == NULL) {
2809                 mutex_enter(&spa_namespace_lock);
2810                 if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2811                         spa_configfile_set(spa, props, B_FALSE);
2812                         spa_config_sync(spa, B_FALSE, B_TRUE);
2813                 }
2814                 mutex_exit(&spa_namespace_lock);
2815                 if (spa != NULL) {
2816                         nvlist_free(props);
2817                         return (0);
2818                 }
2819         }
2820 
2821         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2822                 nvlist_free(props);
2823                 return (error);
2824         }
2825 
2826         error = spa_prop_set(spa, props);
2827 
2828         nvlist_free(props);
2829         spa_close(spa, FTAG);
2830 
2831         return (error);
2832 }
2833 
2834 static int
2835 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2836 {
2837         spa_t *spa;
2838         int error;
2839         nvlist_t *nvp = NULL;
2840 
2841         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2842                 /*
2843                  * If the pool is faulted, there may be properties we can still
2844                  * get (such as altroot and cachefile), so attempt to get them
2845                  * anyway.
2846                  */
2847                 mutex_enter(&spa_namespace_lock);
2848                 if ((spa = spa_lookup(zc->zc_name)) != NULL)
2849                         error = spa_prop_get(spa, &nvp);
2850                 mutex_exit(&spa_namespace_lock);
2851         } else {
2852                 error = spa_prop_get(spa, &nvp);
2853                 spa_close(spa, FTAG);
2854         }
2855 
2856         if (error == 0 && zc->zc_nvlist_dst != NULL)
2857                 error = put_nvlist(zc, nvp);
2858         else
2859                 error = EFAULT;
2860 
2861         nvlist_free(nvp);
2862         return (error);
2863 }
2864 
2865 /*
2866  * inputs:
2867  * zc_name              name of filesystem
2868  * zc_nvlist_src{_size} nvlist of delegated permissions
2869  * zc_perm_action       allow/unallow flag
2870  *
2871  * outputs:             none
2872  */
2873 static int
2874 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2875 {
2876         int error;
2877         nvlist_t *fsaclnv = NULL;
2878 
2879         if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2880             zc->zc_iflags, &fsaclnv)) != 0)
2881                 return (error);
2882 
2883         /*
2884          * Verify nvlist is constructed correctly
2885          */
2886         if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2887                 nvlist_free(fsaclnv);
2888                 return (EINVAL);
2889         }
2890 
2891         /*
2892          * If we don't have PRIV_SYS_MOUNT, then validate
2893          * that user is allowed to hand out each permission in
2894          * the nvlist(s)
2895          */
2896 
2897         error = secpolicy_zfs(CRED());
2898         if (error) {
2899                 if (zc->zc_perm_action == B_FALSE) {
2900                         error = dsl_deleg_can_allow(zc->zc_name,
2901                             fsaclnv, CRED());
2902                 } else {
2903                         error = dsl_deleg_can_unallow(zc->zc_name,
2904                             fsaclnv, CRED());
2905                 }
2906         }
2907 
2908         if (error == 0)
2909                 error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2910 
2911         nvlist_free(fsaclnv);
2912         return (error);
2913 }
2914 
2915 /*
2916  * inputs:
2917  * zc_name              name of filesystem
2918  *
2919  * outputs:
2920  * zc_nvlist_src{_size} nvlist of delegated permissions
2921  */
2922 static int
2923 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
2924 {
2925         nvlist_t *nvp;
2926         int error;
2927 
2928         if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
2929                 error = put_nvlist(zc, nvp);
2930                 nvlist_free(nvp);
2931         }
2932 
2933         return (error);
2934 }
2935 
2936 /*
2937  * Search the vfs list for a specified resource.  Returns a pointer to it
2938  * or NULL if no suitable entry is found. The caller of this routine
2939  * is responsible for releasing the returned vfs pointer.
2940  */
2941 static vfs_t *
2942 zfs_get_vfs(const char *resource)
2943 {
2944         struct vfs *vfsp;
2945         struct vfs *vfs_found = NULL;
2946 
2947         vfs_list_read_lock();
2948         vfsp = rootvfs;
2949         do {
2950                 if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
2951                         VFS_HOLD(vfsp);
2952                         vfs_found = vfsp;
2953                         break;
2954                 }
2955                 vfsp = vfsp->vfs_next;
2956         } while (vfsp != rootvfs);
2957         vfs_list_unlock();
2958         return (vfs_found);
2959 }
2960 
2961 /* ARGSUSED */
2962 static void
2963 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
2964 {
2965         zfs_creat_t *zct = arg;
2966 
2967         zfs_create_fs(os, cr, zct->zct_zplprops, tx);
2968 }
2969 
2970 #define ZFS_PROP_UNDEFINED      ((uint64_t)-1)
2971 
2972 /*
2973  * inputs:
2974  * createprops          list of properties requested by creator
2975  * default_zplver       zpl version to use if unspecified in createprops
2976  * fuids_ok             fuids allowed in this version of the spa?
2977  * os                   parent objset pointer (NULL if root fs)
2978  *
2979  * outputs:
2980  * zplprops     values for the zplprops we attach to the master node object
2981  * is_ci        true if requested file system will be purely case-insensitive
2982  *
2983  * Determine the settings for utf8only, normalization and
2984  * casesensitivity.  Specific values may have been requested by the
2985  * creator and/or we can inherit values from the parent dataset.  If
2986  * the file system is of too early a vintage, a creator can not
2987  * request settings for these properties, even if the requested
2988  * setting is the default value.  We don't actually want to create dsl
2989  * properties for these, so remove them from the source nvlist after
2990  * processing.
2991  */
2992 static int
2993 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
2994     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
2995     nvlist_t *zplprops, boolean_t *is_ci)
2996 {
2997         uint64_t sense = ZFS_PROP_UNDEFINED;
2998         uint64_t norm = ZFS_PROP_UNDEFINED;
2999         uint64_t u8 = ZFS_PROP_UNDEFINED;
3000 
3001         ASSERT(zplprops != NULL);
3002 
3003         /*
3004          * Pull out creator prop choices, if any.
3005          */
3006         if (createprops) {
3007                 (void) nvlist_lookup_uint64(createprops,
3008                     zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3009                 (void) nvlist_lookup_uint64(createprops,
3010                     zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3011                 (void) nvlist_remove_all(createprops,
3012                     zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3013                 (void) nvlist_lookup_uint64(createprops,
3014                     zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3015                 (void) nvlist_remove_all(createprops,
3016                     zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3017                 (void) nvlist_lookup_uint64(createprops,
3018                     zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3019                 (void) nvlist_remove_all(createprops,
3020                     zfs_prop_to_name(ZFS_PROP_CASE));
3021         }
3022 
3023         /*
3024          * If the zpl version requested is whacky or the file system
3025          * or pool is version is too "young" to support normalization
3026          * and the creator tried to set a value for one of the props,
3027          * error out.
3028          */
3029         if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3030             (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3031             (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3032             (zplver < ZPL_VERSION_NORMALIZATION &&
3033             (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3034             sense != ZFS_PROP_UNDEFINED)))
3035                 return (ENOTSUP);
3036 
3037         /*
3038          * Put the version in the zplprops
3039          */
3040         VERIFY(nvlist_add_uint64(zplprops,
3041             zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3042 
3043         if (norm == ZFS_PROP_UNDEFINED)
3044                 VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3045         VERIFY(nvlist_add_uint64(zplprops,
3046             zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3047 
3048         /*
3049          * If we're normalizing, names must always be valid UTF-8 strings.
3050          */
3051         if (norm)
3052                 u8 = 1;
3053         if (u8 == ZFS_PROP_UNDEFINED)
3054                 VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3055         VERIFY(nvlist_add_uint64(zplprops,
3056             zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3057 
3058         if (sense == ZFS_PROP_UNDEFINED)
3059                 VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3060         VERIFY(nvlist_add_uint64(zplprops,
3061             zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3062 
3063         if (is_ci)
3064                 *is_ci = (sense == ZFS_CASE_INSENSITIVE);
3065 
3066         return (0);
3067 }
3068 
3069 static int
3070 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3071     nvlist_t *zplprops, boolean_t *is_ci)
3072 {
3073         boolean_t fuids_ok, sa_ok;
3074         uint64_t zplver = ZPL_VERSION;
3075         objset_t *os = NULL;
3076         char parentname[MAXNAMELEN];
3077         char *cp;
3078         spa_t *spa;
3079         uint64_t spa_vers;
3080         int error;
3081 
3082         (void) strlcpy(parentname, dataset, sizeof (parentname));
3083         cp = strrchr(parentname, '/');
3084         ASSERT(cp != NULL);
3085         cp[0] = '\0';
3086 
3087         if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3088                 return (error);
3089 
3090         spa_vers = spa_version(spa);
3091         spa_close(spa, FTAG);
3092 
3093         zplver = zfs_zpl_version_map(spa_vers);
3094         fuids_ok = (zplver >= ZPL_VERSION_FUID);
3095         sa_ok = (zplver >= ZPL_VERSION_SA);
3096 
3097         /*
3098          * Open parent object set so we can inherit zplprop values.
3099          */
3100         if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3101                 return (error);
3102 
3103         error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3104             zplprops, is_ci);
3105         dmu_objset_rele(os, FTAG);
3106         return (error);
3107 }
3108 
3109 static int
3110 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3111     nvlist_t *zplprops, boolean_t *is_ci)
3112 {
3113         boolean_t fuids_ok;
3114         boolean_t sa_ok;
3115         uint64_t zplver = ZPL_VERSION;
3116         int error;
3117 
3118         zplver = zfs_zpl_version_map(spa_vers);
3119         fuids_ok = (zplver >= ZPL_VERSION_FUID);
3120         sa_ok = (zplver >= ZPL_VERSION_SA);
3121 
3122         error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3123             createprops, zplprops, is_ci);
3124         return (error);
3125 }
3126 
3127 /*
3128  * innvl: {
3129  *     "type" -> dmu_objset_type_t (int32)
3130  *     (optional) "props" -> { prop -> value }
3131  * }
3132  *
3133  * outnvl: propname -> error code (int32)
3134  */
3135 static int
3136 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3137 {
3138         int error = 0;
3139         zfs_creat_t zct = { 0 };
3140         nvlist_t *nvprops = NULL;
3141         void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3142         int32_t type32;
3143         dmu_objset_type_t type;
3144         boolean_t is_insensitive = B_FALSE;
3145 
3146         if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3147                 return (EINVAL);
3148         type = type32;
3149         (void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3150 
3151         switch (type) {
3152         case DMU_OST_ZFS:
3153                 cbfunc = zfs_create_cb;
3154                 break;
3155 
3156         case DMU_OST_ZVOL:
3157                 cbfunc = zvol_create_cb;
3158                 break;
3159 
3160         default:
3161                 cbfunc = NULL;
3162                 break;
3163         }
3164         if (strchr(fsname, '@') ||
3165             strchr(fsname, '%'))
3166                 return (EINVAL);
3167 
3168         zct.zct_props = nvprops;
3169 
3170         if (cbfunc == NULL)
3171                 return (EINVAL);
3172 
3173         if (type == DMU_OST_ZVOL) {
3174                 uint64_t volsize, volblocksize;
3175 
3176                 if (nvprops == NULL)
3177                         return (EINVAL);
3178                 if (nvlist_lookup_uint64(nvprops,
3179                     zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3180                         return (EINVAL);
3181 
3182                 if ((error = nvlist_lookup_uint64(nvprops,
3183                     zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3184                     &volblocksize)) != 0 && error != ENOENT)
3185                         return (EINVAL);
3186 
3187                 if (error != 0)
3188                         volblocksize = zfs_prop_default_numeric(
3189                             ZFS_PROP_VOLBLOCKSIZE);
3190 
3191                 if ((error = zvol_check_volblocksize(
3192                     volblocksize)) != 0 ||
3193                     (error = zvol_check_volsize(volsize,
3194                     volblocksize)) != 0)
3195                         return (error);
3196         } else if (type == DMU_OST_ZFS) {
3197                 int error;
3198 
3199                 /*
3200                  * We have to have normalization and
3201                  * case-folding flags correct when we do the
3202                  * file system creation, so go figure them out
3203                  * now.
3204                  */
3205                 VERIFY(nvlist_alloc(&zct.zct_zplprops,
3206                     NV_UNIQUE_NAME, KM_SLEEP) == 0);
3207                 error = zfs_fill_zplprops(fsname, nvprops,
3208                     zct.zct_zplprops, &is_insensitive);
3209                 if (error != 0) {
3210                         nvlist_free(zct.zct_zplprops);
3211                         return (error);
3212                 }
3213         }
3214 
3215         error = dmu_objset_create(fsname, type,
3216             is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3217         nvlist_free(zct.zct_zplprops);
3218 
3219         /*
3220          * It would be nice to do this atomically.
3221          */
3222         if (error == 0) {
3223                 error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3224                     nvprops, outnvl);
3225                 if (error != 0)
3226                         (void) dmu_objset_destroy(fsname, B_FALSE);
3227         }
3228         return (error);
3229 }
3230 
3231 /*
3232  * innvl: {
3233  *     "origin" -> name of origin snapshot
3234  *     (optional) "props" -> { prop -> value }
3235  * }
3236  *
3237  * outnvl: propname -> error code (int32)
3238  */
3239 static int
3240 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3241 {
3242         int error = 0;
3243         nvlist_t *nvprops = NULL;
3244         char *origin_name;
3245         dsl_dataset_t *origin;
3246 
3247         if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3248                 return (EINVAL);
3249         (void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3250 
3251         if (strchr(fsname, '@') ||
3252             strchr(fsname, '%'))
3253                 return (EINVAL);
3254 
3255         if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3256                 return (EINVAL);
3257 
3258         error = dsl_dataset_hold(origin_name, FTAG, &origin);
3259         if (error)
3260                 return (error);
3261 
3262         error = dmu_objset_clone(fsname, origin, 0);
3263         dsl_dataset_rele(origin, FTAG);
3264         if (error)
3265                 return (error);
3266 
3267         /*
3268          * It would be nice to do this atomically.
3269          */
3270         if (error == 0) {
3271                 error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3272                     nvprops, outnvl);
3273                 if (error != 0)
3274                         (void) dmu_objset_destroy(fsname, B_FALSE);
3275         }
3276         return (error);
3277 }
3278 
3279 /*
3280  * innvl: {
3281  *     "snaps" -> { snapshot1, snapshot2 }
3282  *     (optional) "props" -> { prop -> value (string) }
3283  * }
3284  *
3285  * outnvl: snapshot -> error code (int32)
3286  *
3287  */
3288 static int
3289 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3290 {
3291         nvlist_t *snaps;
3292         nvlist_t *props = NULL;
3293         int error, poollen;
3294         nvpair_t *pair;
3295 
3296         (void) nvlist_lookup_nvlist(innvl, "props", &props);
3297         if ((error = zfs_check_userprops(poolname, props)) != 0)
3298                 return (error);
3299 
3300         if (!nvlist_empty(props) &&
3301             zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3302                 return (ENOTSUP);
3303 
3304         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3305                 return (EINVAL);
3306         poollen = strlen(poolname);
3307         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3308             pair = nvlist_next_nvpair(snaps, pair)) {
3309                 const char *name = nvpair_name(pair);
3310                 const char *cp = strchr(name, '@');
3311 
3312                 /*
3313                  * The snap name must contain an @, and the part after it must
3314                  * contain only valid characters.
3315                  */
3316                 if (cp == NULL || snapshot_namecheck(cp + 1, NULL, NULL) != 0)
3317                         return (EINVAL);
3318 
3319                 /*
3320                  * The snap must be in the specified pool.
3321                  */
3322                 if (strncmp(name, poolname, poollen) != 0 ||
3323                     (name[poollen] != '/' && name[poollen] != '@'))
3324                         return (EXDEV);
3325 
3326                 /* This must be the only snap of this fs. */
3327                 for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3328                     pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3329                         if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3330                             == 0) {
3331                                 return (EXDEV);
3332                         }
3333                 }
3334         }
3335 
3336         error = dmu_objset_snapshot(snaps, props, outnvl);
3337         return (error);
3338 }
3339 
3340 /*
3341  * innvl: "message" -> string
3342  */
3343 /* ARGSUSED */
3344 static int
3345 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3346 {
3347         char *message;
3348         spa_t *spa;
3349         int error;
3350         char *poolname;
3351 
3352         /*
3353          * The poolname in the ioctl is not set, we get it from the TSD,
3354          * which was set at the end of the last successful ioctl that allows
3355          * logging.  The secpolicy func already checked that it is set.
3356          * Only one log ioctl is allowed after each successful ioctl, so
3357          * we clear the TSD here.
3358          */
3359         poolname = tsd_get(zfs_allow_log_key);
3360         (void) tsd_set(zfs_allow_log_key, NULL);
3361         error = spa_open(poolname, &spa, FTAG);
3362         strfree(poolname);
3363         if (error != 0)
3364                 return (error);
3365 
3366         if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3367                 spa_close(spa, FTAG);
3368                 return (EINVAL);
3369         }
3370 
3371         if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3372                 spa_close(spa, FTAG);
3373                 return (ENOTSUP);
3374         }
3375 
3376         error = spa_history_log(spa, message);
3377         spa_close(spa, FTAG);
3378         return (error);
3379 }
3380 
3381 /* ARGSUSED */
3382 int
3383 zfs_unmount_snap(const char *name, void *arg)
3384 {
3385         vfs_t *vfsp;
3386         int err;
3387 
3388         if (strchr(name, '@') == NULL)
3389                 return (0);
3390 
3391         vfsp = zfs_get_vfs(name);
3392         if (vfsp == NULL)
3393                 return (0);
3394 
3395         if ((err = vn_vfswlock(vfsp->vfs_vnodecovered)) != 0) {
3396                 VFS_RELE(vfsp);
3397                 return (err);
3398         }
3399         VFS_RELE(vfsp);
3400 
3401         /*
3402          * Always force the unmount for snapshots.
3403          */
3404         return (dounmount(vfsp, MS_FORCE, kcred));
3405 }
3406 
3407 /*
3408  * innvl: {
3409  *     "snaps" -> { snapshot1, snapshot2 }
3410  *     (optional boolean) "defer"
3411  * }
3412  *
3413  * outnvl: snapshot -> error code (int32)
3414  *
3415  */
3416 static int
3417 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3418 {
3419         int poollen;
3420         nvlist_t *snaps;
3421         nvpair_t *pair;
3422         boolean_t defer;
3423 
3424         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3425                 return (EINVAL);
3426         defer = nvlist_exists(innvl, "defer");
3427 
3428         poollen = strlen(poolname);
3429         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3430             pair = nvlist_next_nvpair(snaps, pair)) {
3431                 const char *name = nvpair_name(pair);
3432 
3433                 /*
3434                  * The snap must be in the specified pool.
3435                  */
3436                 if (strncmp(name, poolname, poollen) != 0 ||
3437                     (name[poollen] != '/' && name[poollen] != '@'))
3438                         return (EXDEV);
3439 
3440                 /*
3441                  * Ignore failures to unmount; dmu_snapshots_destroy_nvl()
3442                  * will deal with this gracefully (by filling in outnvl).
3443                  */
3444                 (void) zfs_unmount_snap(name, NULL);
3445         }
3446 
3447         return (dmu_snapshots_destroy_nvl(snaps, defer, outnvl));
3448 }
3449 
3450 /*
3451  * inputs:
3452  * zc_name              name of dataset to destroy
3453  * zc_objset_type       type of objset
3454  * zc_defer_destroy     mark for deferred destroy
3455  *
3456  * outputs:             none
3457  */
3458 static int
3459 zfs_ioc_destroy(zfs_cmd_t *zc)
3460 {
3461         int err;
3462         if (strchr(zc->zc_name, '@') && zc->zc_objset_type == DMU_OST_ZFS) {
3463                 err = zfs_unmount_snap(zc->zc_name, NULL);
3464                 if (err)
3465                         return (err);
3466         }
3467 
3468         err = dmu_objset_destroy(zc->zc_name, zc->zc_defer_destroy);
3469         if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3470                 (void) zvol_remove_minor(zc->zc_name);
3471         return (err);
3472 }
3473 
3474 /*
3475  * inputs:
3476  * zc_name      name of dataset to rollback (to most recent snapshot)
3477  *
3478  * outputs:     none
3479  */
3480 static int
3481 zfs_ioc_rollback(zfs_cmd_t *zc)
3482 {
3483         dsl_dataset_t *ds, *clone;
3484         int error;
3485         zfsvfs_t *zfsvfs;
3486         char *clone_name;
3487 
3488         error = dsl_dataset_hold(zc->zc_name, FTAG, &ds);
3489         if (error)
3490                 return (error);
3491 
3492         /* must not be a snapshot */
3493         if (dsl_dataset_is_snapshot(ds)) {
3494                 dsl_dataset_rele(ds, FTAG);
3495                 return (EINVAL);
3496         }
3497 
3498         /* must have a most recent snapshot */
3499         if (ds->ds_phys->ds_prev_snap_txg < TXG_INITIAL) {
3500                 dsl_dataset_rele(ds, FTAG);
3501                 return (EINVAL);
3502         }
3503 
3504         /*
3505          * Create clone of most recent snapshot.
3506          */
3507         clone_name = kmem_asprintf("%s/%%rollback", zc->zc_name);
3508         error = dmu_objset_clone(clone_name, ds->ds_prev, DS_FLAG_INCONSISTENT);
3509         if (error)
3510                 goto out;
3511 
3512         error = dsl_dataset_own(clone_name, B_TRUE, FTAG, &clone);
3513         if (error)
3514                 goto out;
3515 
3516         /*
3517          * Do clone swap.
3518          */
3519         if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
3520                 error = zfs_suspend_fs(zfsvfs);
3521                 if (error == 0) {
3522                         int resume_err;
3523 
3524                         if (dsl_dataset_tryown(ds, B_FALSE, FTAG)) {
3525                                 error = dsl_dataset_clone_swap(clone, ds,
3526                                     B_TRUE);
3527                                 dsl_dataset_disown(ds, FTAG);
3528                                 ds = NULL;
3529                         } else {
3530                                 error = EBUSY;
3531                         }
3532                         resume_err = zfs_resume_fs(zfsvfs, zc->zc_name);
3533                         error = error ? error : resume_err;
3534                 }
3535                 VFS_RELE(zfsvfs->z_vfs);
3536         } else {
3537                 if (dsl_dataset_tryown(ds, B_FALSE, FTAG)) {
3538                         error = dsl_dataset_clone_swap(clone, ds, B_TRUE);
3539                         dsl_dataset_disown(ds, FTAG);
3540                         ds = NULL;
3541                 } else {
3542                         error = EBUSY;
3543                 }
3544         }
3545 
3546         /*
3547          * Destroy clone (which also closes it).
3548          */
3549         (void) dsl_dataset_destroy(clone, FTAG, B_FALSE);
3550 
3551 out:
3552         strfree(clone_name);
3553         if (ds)
3554                 dsl_dataset_rele(ds, FTAG);
3555         return (error);
3556 }
3557 
3558 /*
3559  * inputs:
3560  * zc_name      old name of dataset
3561  * zc_value     new name of dataset
3562  * zc_cookie    recursive flag (only valid for snapshots)
3563  *
3564  * outputs:     none
3565  */
3566 static int
3567 zfs_ioc_rename(zfs_cmd_t *zc)
3568 {
3569         boolean_t recursive = zc->zc_cookie & 1;
3570 
3571         zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3572         if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3573             strchr(zc->zc_value, '%'))
3574                 return (EINVAL);
3575 
3576         /*
3577          * Unmount snapshot unless we're doing a recursive rename,
3578          * in which case the dataset code figures out which snapshots
3579          * to unmount.
3580          */
3581         if (!recursive && strchr(zc->zc_name, '@') != NULL &&
3582             zc->zc_objset_type == DMU_OST_ZFS) {
3583                 int err = zfs_unmount_snap(zc->zc_name, NULL);
3584                 if (err)
3585                         return (err);
3586         }
3587         if (zc->zc_objset_type == DMU_OST_ZVOL)
3588                 (void) zvol_remove_minor(zc->zc_name);
3589         return (dmu_objset_rename(zc->zc_name, zc->zc_value, recursive));
3590 }
3591 
3592 static int
3593 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3594 {
3595         const char *propname = nvpair_name(pair);
3596         boolean_t issnap = (strchr(dsname, '@') != NULL);
3597         zfs_prop_t prop = zfs_name_to_prop(propname);
3598         uint64_t intval;
3599         int err;
3600 
3601         if (prop == ZPROP_INVAL) {
3602                 if (zfs_prop_user(propname)) {
3603                         if (err = zfs_secpolicy_write_perms(dsname,
3604                             ZFS_DELEG_PERM_USERPROP, cr))
3605                                 return (err);
3606                         return (0);
3607                 }
3608 
3609                 if (!issnap && zfs_prop_userquota(propname)) {
3610                         const char *perm = NULL;
3611                         const char *uq_prefix =
3612                             zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3613                         const char *gq_prefix =
3614                             zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3615 
3616                         if (strncmp(propname, uq_prefix,
3617                             strlen(uq_prefix)) == 0) {
3618                                 perm = ZFS_DELEG_PERM_USERQUOTA;
3619                         } else if (strncmp(propname, gq_prefix,
3620                             strlen(gq_prefix)) == 0) {
3621                                 perm = ZFS_DELEG_PERM_GROUPQUOTA;
3622                         } else {
3623                                 /* USERUSED and GROUPUSED are read-only */
3624                                 return (EINVAL);
3625                         }
3626 
3627                         if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3628                                 return (err);
3629                         return (0);
3630                 }
3631 
3632                 return (EINVAL);
3633         }
3634 
3635         if (issnap)
3636                 return (EINVAL);
3637 
3638         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3639                 /*
3640                  * dsl_prop_get_all_impl() returns properties in this
3641                  * format.
3642                  */
3643                 nvlist_t *attrs;
3644                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3645                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3646                     &pair) == 0);
3647         }
3648 
3649         /*
3650          * Check that this value is valid for this pool version
3651          */
3652         switch (prop) {
3653         case ZFS_PROP_COMPRESSION:
3654                 /*
3655                  * If the user specified gzip compression, make sure
3656                  * the SPA supports it. We ignore any errors here since
3657                  * we'll catch them later.
3658                  */
3659                 if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3660                     nvpair_value_uint64(pair, &intval) == 0) {
3661                         if (intval >= ZIO_COMPRESS_GZIP_1 &&
3662                             intval <= ZIO_COMPRESS_GZIP_9 &&
3663                             zfs_earlier_version(dsname,
3664                             SPA_VERSION_GZIP_COMPRESSION)) {
3665                                 return (ENOTSUP);
3666                         }
3667 
3668                         if (intval == ZIO_COMPRESS_ZLE &&
3669                             zfs_earlier_version(dsname,
3670                             SPA_VERSION_ZLE_COMPRESSION))
3671                                 return (ENOTSUP);
3672 
3673                         if (intval == ZIO_COMPRESS_LZ4 ||
3674                             intval == ZIO_COMPRESS_LZ4HC) {
3675                                 zfeature_info_t *feature =
3676                                     &spa_feature_table[
3677                                     SPA_FEATURE_LZ4_COMPRESS];
3678                                 spa_t *spa;
3679 
3680                                 if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3681                                         return (err);
3682 
3683                                 if (!spa_feature_is_enabled(spa, feature)) {
3684                                         spa_close(spa, FTAG);
3685                                         return (ENOTSUP);
3686                                 }
3687                                 spa_close(spa, FTAG);
3688                         }
3689 
3690                         /*
3691                          * If this is a bootable dataset then
3692                          * verify that the compression algorithm
3693                          * is supported for booting. We must return
3694                          * something other than ENOTSUP since it
3695                          * implies a downrev pool version.
3696                          */
3697                         if (zfs_is_bootfs(dsname) &&
3698                             !BOOTFS_COMPRESS_VALID(intval)) {
3699                                 return (ERANGE);
3700                         }
3701                 }
3702                 break;
3703 
3704         case ZFS_PROP_COPIES:
3705                 if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3706                         return (ENOTSUP);
3707                 break;
3708 
3709         case ZFS_PROP_DEDUP:
3710                 if (zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3711                         return (ENOTSUP);
3712                 break;
3713 
3714         case ZFS_PROP_SHARESMB:
3715                 if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3716                         return (ENOTSUP);
3717                 break;
3718 
3719         case ZFS_PROP_ACLINHERIT:
3720                 if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3721                     nvpair_value_uint64(pair, &intval) == 0) {
3722                         if (intval == ZFS_ACL_PASSTHROUGH_X &&
3723                             zfs_earlier_version(dsname,
3724                             SPA_VERSION_PASSTHROUGH_X))
3725                                 return (ENOTSUP);
3726                 }
3727                 break;
3728         }
3729 
3730         return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3731 }
3732 
3733 /*
3734  * Activates a feature on a pool in response to a property setting. This
3735  * creates a new sync task which modifies the pool to reflect the feature
3736  * as being active.
3737  */
3738 static int
3739 zfs_prop_activate_feature(dsl_pool_t *dp, zfeature_info_t *feature)
3740 {
3741         int err;
3742 
3743         /* EBUSY here indicates that the feature is already active */
3744         err = dsl_sync_task_do(dp, zfs_prop_activate_feature_check,
3745             zfs_prop_activate_feature_sync, dp->dp_spa, feature, 2);
3746 
3747         if (err != 0 && err != EBUSY)
3748                 return (err);
3749         else
3750                 return (0);
3751 }
3752 
3753 /*
3754  * Checks for a race condition to make sure we don't increment a feature flag
3755  * multiple times.
3756  */
3757 /*ARGSUSED*/
3758 static int
3759 zfs_prop_activate_feature_check(void *arg1, void *arg2, dmu_tx_t *tx)
3760 {
3761         spa_t *spa = arg1;
3762         zfeature_info_t *feature = arg2;
3763 
3764         if (!spa_feature_is_active(spa, feature))
3765                 return (0);
3766         else
3767                 return (EBUSY);
3768 }
3769 
3770 /*
3771  * The callback invoked on feature activation in the sync task caused by
3772  * zfs_prop_activate_feature.
3773  */
3774 static void
3775 zfs_prop_activate_feature_sync(void *arg1, void *arg2, dmu_tx_t *tx)
3776 {
3777         spa_t *spa = arg1;
3778         zfeature_info_t *feature = arg2;
3779 
3780         spa_feature_incr(spa, feature, tx);
3781 }
3782 
3783 /*
3784  * Removes properties from the given props list that fail permission checks
3785  * needed to clear them and to restore them in case of a receive error. For each
3786  * property, make sure we have both set and inherit permissions.
3787  *
3788  * Returns the first error encountered if any permission checks fail. If the
3789  * caller provides a non-NULL errlist, it also gives the complete list of names
3790  * of all the properties that failed a permission check along with the
3791  * corresponding error numbers. The caller is responsible for freeing the
3792  * returned errlist.
3793  *
3794  * If every property checks out successfully, zero is returned and the list
3795  * pointed at by errlist is NULL.
3796  */
3797 static int
3798 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
3799 {
3800         zfs_cmd_t *zc;
3801         nvpair_t *pair, *next_pair;
3802         nvlist_t *errors;
3803         int err, rv = 0;
3804 
3805         if (props == NULL)
3806                 return (0);
3807 
3808         VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3809 
3810         zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
3811         (void) strcpy(zc->zc_name, dataset);
3812         pair = nvlist_next_nvpair(props, NULL);
3813         while (pair != NULL) {
3814                 next_pair = nvlist_next_nvpair(props, pair);
3815 
3816                 (void) strcpy(zc->zc_value, nvpair_name(pair));
3817                 if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
3818                     (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
3819                         VERIFY(nvlist_remove_nvpair(props, pair) == 0);
3820                         VERIFY(nvlist_add_int32(errors,
3821                             zc->zc_value, err) == 0);
3822                 }
3823                 pair = next_pair;
3824         }
3825         kmem_free(zc, sizeof (zfs_cmd_t));
3826 
3827         if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
3828                 nvlist_free(errors);
3829                 errors = NULL;
3830         } else {
3831                 VERIFY(nvpair_value_int32(pair, &rv) == 0);
3832         }
3833 
3834         if (errlist == NULL)
3835                 nvlist_free(errors);
3836         else
3837                 *errlist = errors;
3838 
3839         return (rv);
3840 }
3841 
3842 static boolean_t
3843 propval_equals(nvpair_t *p1, nvpair_t *p2)
3844 {
3845         if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
3846                 /* dsl_prop_get_all_impl() format */
3847                 nvlist_t *attrs;
3848                 VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
3849                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3850                     &p1) == 0);
3851         }
3852 
3853         if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
3854                 nvlist_t *attrs;
3855                 VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
3856                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3857                     &p2) == 0);
3858         }
3859 
3860         if (nvpair_type(p1) != nvpair_type(p2))
3861                 return (B_FALSE);
3862 
3863         if (nvpair_type(p1) == DATA_TYPE_STRING) {
3864                 char *valstr1, *valstr2;
3865 
3866                 VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
3867                 VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
3868                 return (strcmp(valstr1, valstr2) == 0);
3869         } else {
3870                 uint64_t intval1, intval2;
3871 
3872                 VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
3873                 VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
3874                 return (intval1 == intval2);
3875         }
3876 }
3877 
3878 /*
3879  * Remove properties from props if they are not going to change (as determined
3880  * by comparison with origprops). Remove them from origprops as well, since we
3881  * do not need to clear or restore properties that won't change.
3882  */
3883 static void
3884 props_reduce(nvlist_t *props, nvlist_t *origprops)
3885 {
3886         nvpair_t *pair, *next_pair;
3887 
3888         if (origprops == NULL)
3889                 return; /* all props need to be received */
3890 
3891         pair = nvlist_next_nvpair(props, NULL);
3892         while (pair != NULL) {
3893                 const char *propname = nvpair_name(pair);
3894                 nvpair_t *match;
3895 
3896                 next_pair = nvlist_next_nvpair(props, pair);
3897 
3898                 if ((nvlist_lookup_nvpair(origprops, propname,
3899                     &match) != 0) || !propval_equals(pair, match))
3900                         goto next; /* need to set received value */
3901 
3902                 /* don't clear the existing received value */
3903                 (void) nvlist_remove_nvpair(origprops, match);
3904                 /* don't bother receiving the property */
3905                 (void) nvlist_remove_nvpair(props, pair);
3906 next:
3907                 pair = next_pair;
3908         }
3909 }
3910 
3911 #ifdef  DEBUG
3912 static boolean_t zfs_ioc_recv_inject_err;
3913 #endif
3914 
3915 /*
3916  * inputs:
3917  * zc_name              name of containing filesystem
3918  * zc_nvlist_src{_size} nvlist of properties to apply
3919  * zc_value             name of snapshot to create
3920  * zc_string            name of clone origin (if DRR_FLAG_CLONE)
3921  * zc_cookie            file descriptor to recv from
3922  * zc_begin_record      the BEGIN record of the stream (not byteswapped)
3923  * zc_guid              force flag
3924  * zc_cleanup_fd        cleanup-on-exit file descriptor
3925  * zc_action_handle     handle for this guid/ds mapping (or zero on first call)
3926  *
3927  * outputs:
3928  * zc_cookie            number of bytes read
3929  * zc_nvlist_dst{_size} error for each unapplied received property
3930  * zc_obj               zprop_errflags_t
3931  * zc_action_handle     handle for this guid/ds mapping
3932  */
3933 static int
3934 zfs_ioc_recv(zfs_cmd_t *zc)
3935 {
3936         file_t *fp;
3937         objset_t *os;
3938         dmu_recv_cookie_t drc;
3939         boolean_t force = (boolean_t)zc->zc_guid;
3940         int fd;
3941         int error = 0;
3942         int props_error = 0;
3943         nvlist_t *errors;
3944         offset_t off;
3945         nvlist_t *props = NULL; /* sent properties */
3946         nvlist_t *origprops = NULL; /* existing properties */
3947         objset_t *origin = NULL;
3948         char *tosnap;
3949         char tofs[ZFS_MAXNAMELEN];
3950         boolean_t first_recvd_props = B_FALSE;
3951 
3952         if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3953             strchr(zc->zc_value, '@') == NULL ||
3954             strchr(zc->zc_value, '%'))
3955                 return (EINVAL);
3956 
3957         (void) strcpy(tofs, zc->zc_value);
3958         tosnap = strchr(tofs, '@');
3959         *tosnap++ = '\0';
3960 
3961         if (zc->zc_nvlist_src != NULL &&
3962             (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3963             zc->zc_iflags, &props)) != 0)
3964                 return (error);
3965 
3966         fd = zc->zc_cookie;
3967         fp = getf(fd);
3968         if (fp == NULL) {
3969                 nvlist_free(props);
3970                 return (EBADF);
3971         }
3972 
3973         VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3974 
3975         if (props && dmu_objset_hold(tofs, FTAG, &os) == 0) {
3976                 if ((spa_version(os->os_spa) >= SPA_VERSION_RECVD_PROPS) &&
3977                     !dsl_prop_get_hasrecvd(os)) {
3978                         first_recvd_props = B_TRUE;
3979                 }
3980 
3981                 /*
3982                  * If new received properties are supplied, they are to
3983                  * completely replace the existing received properties, so stash
3984                  * away the existing ones.
3985                  */
3986                 if (dsl_prop_get_received(os, &origprops) == 0) {
3987                         nvlist_t *errlist = NULL;
3988                         /*
3989                          * Don't bother writing a property if its value won't
3990                          * change (and avoid the unnecessary security checks).
3991                          *
3992                          * The first receive after SPA_VERSION_RECVD_PROPS is a
3993                          * special case where we blow away all local properties
3994                          * regardless.
3995                          */
3996                         if (!first_recvd_props)
3997                                 props_reduce(props, origprops);
3998                         if (zfs_check_clearable(tofs, origprops,
3999                             &errlist) != 0)
4000                                 (void) nvlist_merge(errors, errlist, 0);
4001                         nvlist_free(errlist);
4002                 }
4003 
4004                 dmu_objset_rele(os, FTAG);
4005         }
4006 
4007         if (zc->zc_string[0]) {
4008                 error = dmu_objset_hold(zc->zc_string, FTAG, &origin);
4009                 if (error)
4010                         goto out;
4011         }
4012 
4013         error = dmu_recv_begin(tofs, tosnap, zc->zc_top_ds,
4014             &zc->zc_begin_record, force, origin, &drc);
4015         if (origin)
4016                 dmu_objset_rele(origin, FTAG);
4017         if (error)
4018                 goto out;
4019 
4020         /*
4021          * Set properties before we receive the stream so that they are applied
4022          * to the new data. Note that we must call dmu_recv_stream() if
4023          * dmu_recv_begin() succeeds.
4024          */
4025         if (props) {
4026                 if (dmu_objset_from_ds(drc.drc_logical_ds, &os) == 0) {
4027                         if (drc.drc_newfs) {
4028                                 if (spa_version(os->os_spa) >=
4029                                     SPA_VERSION_RECVD_PROPS)
4030                                         first_recvd_props = B_TRUE;
4031                         } else if (origprops != NULL) {
4032                                 if (clear_received_props(os, tofs, origprops,
4033                                     first_recvd_props ? NULL : props) != 0)
4034                                         zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4035                         } else {
4036                                 zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4037                         }
4038                         dsl_prop_set_hasrecvd(os);
4039                 } else if (!drc.drc_newfs) {
4040                         zc->zc_obj |= ZPROP_ERR_NOCLEAR;
4041                 }
4042 
4043                 (void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4044                     props, errors);
4045         }
4046 
4047         if (zc->zc_nvlist_dst_size != 0 &&
4048             (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4049             put_nvlist(zc, errors) != 0)) {
4050                 /*
4051                  * Caller made zc->zc_nvlist_dst less than the minimum expected
4052                  * size or supplied an invalid address.
4053                  */
4054                 props_error = EINVAL;
4055         }
4056 
4057         off = fp->f_offset;
4058         error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4059             &zc->zc_action_handle);
4060 
4061         if (error == 0) {
4062                 zfsvfs_t *zfsvfs = NULL;
4063 
4064                 if (getzfsvfs(tofs, &zfsvfs) == 0) {
4065                         /* online recv */
4066                         int end_err;
4067 
4068                         error = zfs_suspend_fs(zfsvfs);
4069                         /*
4070                          * If the suspend fails, then the recv_end will
4071                          * likely also fail, and clean up after itself.
4072                          */
4073                         end_err = dmu_recv_end(&drc);
4074                         if (error == 0)
4075                                 error = zfs_resume_fs(zfsvfs, tofs);
4076                         error = error ? error : end_err;
4077                         VFS_RELE(zfsvfs->z_vfs);
4078                 } else {
4079                         error = dmu_recv_end(&drc);
4080                 }
4081         }
4082 
4083         zc->zc_cookie = off - fp->f_offset;
4084         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4085                 fp->f_offset = off;
4086 
4087 #ifdef  DEBUG
4088         if (zfs_ioc_recv_inject_err) {
4089                 zfs_ioc_recv_inject_err = B_FALSE;
4090                 error = 1;
4091         }
4092 #endif
4093         /*
4094          * On error, restore the original props.
4095          */
4096         if (error && props) {
4097                 if (dmu_objset_hold(tofs, FTAG, &os) == 0) {
4098                         if (clear_received_props(os, tofs, props, NULL) != 0) {
4099                                 /*
4100                                  * We failed to clear the received properties.
4101                                  * Since we may have left a $recvd value on the
4102                                  * system, we can't clear the $hasrecvd flag.
4103                                  */
4104                                 zc->zc_obj |= ZPROP_ERR_NORESTORE;
4105                         } else if (first_recvd_props) {
4106                                 dsl_prop_unset_hasrecvd(os);
4107                         }
4108                         dmu_objset_rele(os, FTAG);
4109                 } else if (!drc.drc_newfs) {
4110                         /* We failed to clear the received properties. */
4111                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4112                 }
4113 
4114                 if (origprops == NULL && !drc.drc_newfs) {
4115                         /* We failed to stash the original properties. */
4116                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4117                 }
4118 
4119                 /*
4120                  * dsl_props_set() will not convert RECEIVED to LOCAL on or
4121                  * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4122                  * explictly if we're restoring local properties cleared in the
4123                  * first new-style receive.
4124                  */
4125                 if (origprops != NULL &&
4126                     zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4127                     ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4128                     origprops, NULL) != 0) {
4129                         /*
4130                          * We stashed the original properties but failed to
4131                          * restore them.
4132                          */
4133                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4134                 }
4135         }
4136 out:
4137         nvlist_free(props);
4138         nvlist_free(origprops);
4139         nvlist_free(errors);
4140         releasef(fd);
4141 
4142         if (error == 0)
4143                 error = props_error;
4144 
4145         return (error);
4146 }
4147 
4148 /*
4149  * inputs:
4150  * zc_name      name of snapshot to send
4151  * zc_cookie    file descriptor to send stream to
4152  * zc_obj       fromorigin flag (mutually exclusive with zc_fromobj)
4153  * zc_sendobj   objsetid of snapshot to send
4154  * zc_fromobj   objsetid of incremental fromsnap (may be zero)
4155  * zc_guid      if set, estimate size of stream only.  zc_cookie is ignored.
4156  *              output size in zc_objset_type.
4157  *
4158  * outputs: none
4159  */
4160 static int
4161 zfs_ioc_send(zfs_cmd_t *zc)
4162 {
4163         objset_t *fromsnap = NULL;
4164         objset_t *tosnap;
4165         int error;
4166         offset_t off;
4167         dsl_dataset_t *ds;
4168         dsl_dataset_t *dsfrom = NULL;
4169         spa_t *spa;
4170         dsl_pool_t *dp;
4171         boolean_t estimate = (zc->zc_guid != 0);
4172 
4173         error = spa_open(zc->zc_name, &spa, FTAG);
4174         if (error)
4175                 return (error);
4176 
4177         dp = spa_get_dsl(spa);
4178         rw_enter(&dp->dp_config_rwlock, RW_READER);
4179         error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
4180         rw_exit(&dp->dp_config_rwlock);
4181         spa_close(spa, FTAG);
4182         if (error)
4183                 return (error);
4184 
4185         error = dmu_objset_from_ds(ds, &tosnap);
4186         if (error) {
4187                 dsl_dataset_rele(ds, FTAG);
4188                 return (error);
4189         }
4190 
4191         if (zc->zc_fromobj != 0) {
4192                 rw_enter(&dp->dp_config_rwlock, RW_READER);
4193                 error = dsl_dataset_hold_obj(dp, zc->zc_fromobj, FTAG, &dsfrom);
4194                 rw_exit(&dp->dp_config_rwlock);
4195                 if (error) {
4196                         dsl_dataset_rele(ds, FTAG);
4197                         return (error);
4198                 }
4199                 error = dmu_objset_from_ds(dsfrom, &fromsnap);
4200                 if (error) {
4201                         dsl_dataset_rele(dsfrom, FTAG);
4202                         dsl_dataset_rele(ds, FTAG);
4203                         return (error);
4204                 }
4205         }
4206 
4207         if (zc->zc_obj) {
4208                 dsl_pool_t *dp = ds->ds_dir->dd_pool;
4209 
4210                 if (fromsnap != NULL) {
4211                         dsl_dataset_rele(dsfrom, FTAG);
4212                         dsl_dataset_rele(ds, FTAG);
4213                         return (EINVAL);
4214                 }
4215 
4216                 if (dsl_dir_is_clone(ds->ds_dir)) {
4217                         rw_enter(&dp->dp_config_rwlock, RW_READER);
4218                         error = dsl_dataset_hold_obj(dp,
4219                             ds->ds_dir->dd_phys->dd_origin_obj, FTAG, &dsfrom);
4220                         rw_exit(&dp->dp_config_rwlock);
4221                         if (error) {
4222                                 dsl_dataset_rele(ds, FTAG);
4223                                 return (error);
4224                         }
4225                         error = dmu_objset_from_ds(dsfrom, &fromsnap);
4226                         if (error) {
4227                                 dsl_dataset_rele(dsfrom, FTAG);
4228                                 dsl_dataset_rele(ds, FTAG);
4229                                 return (error);
4230                         }
4231                 }
4232         }
4233 
4234         if (estimate) {
4235                 error = dmu_send_estimate(tosnap, fromsnap,
4236                     &zc->zc_objset_type);
4237         } else {
4238                 file_t *fp = getf(zc->zc_cookie);
4239                 if (fp == NULL) {
4240                         dsl_dataset_rele(ds, FTAG);
4241                         if (dsfrom)
4242                                 dsl_dataset_rele(dsfrom, FTAG);
4243                         return (EBADF);
4244                 }
4245 
4246                 off = fp->f_offset;
4247                 error = dmu_send(tosnap, fromsnap,
4248                     zc->zc_cookie, fp->f_vnode, &off);
4249 
4250                 if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4251                         fp->f_offset = off;
4252                 releasef(zc->zc_cookie);
4253         }
4254         if (dsfrom)
4255                 dsl_dataset_rele(dsfrom, FTAG);
4256         dsl_dataset_rele(ds, FTAG);
4257         return (error);
4258 }
4259 
4260 /*
4261  * inputs:
4262  * zc_name      name of snapshot on which to report progress
4263  * zc_cookie    file descriptor of send stream
4264  *
4265  * outputs:
4266  * zc_cookie    number of bytes written in send stream thus far
4267  */
4268 static int
4269 zfs_ioc_send_progress(zfs_cmd_t *zc)
4270 {
4271         dsl_dataset_t *ds;
4272         dmu_sendarg_t *dsp = NULL;
4273         int error;
4274 
4275         if ((error = dsl_dataset_hold(zc->zc_name, FTAG, &ds)) != 0)
4276                 return (error);
4277 
4278         mutex_enter(&ds->ds_sendstream_lock);
4279 
4280         /*
4281          * Iterate over all the send streams currently active on this dataset.
4282          * If there's one which matches the specified file descriptor _and_ the
4283          * stream was started by the current process, return the progress of
4284          * that stream.
4285          */
4286         for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4287             dsp = list_next(&ds->ds_sendstreams, dsp)) {
4288                 if (dsp->dsa_outfd == zc->zc_cookie &&
4289                     dsp->dsa_proc == curproc)
4290                         break;
4291         }
4292 
4293         if (dsp != NULL)
4294                 zc->zc_cookie = *(dsp->dsa_off);
4295         else
4296                 error = ENOENT;
4297 
4298         mutex_exit(&ds->ds_sendstream_lock);
4299         dsl_dataset_rele(ds, FTAG);
4300         return (error);
4301 }
4302 
4303 static int
4304 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4305 {
4306         int id, error;
4307 
4308         error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4309             &zc->zc_inject_record);
4310 
4311         if (error == 0)
4312                 zc->zc_guid = (uint64_t)id;
4313 
4314         return (error);
4315 }
4316 
4317 static int
4318 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4319 {
4320         return (zio_clear_fault((int)zc->zc_guid));
4321 }
4322 
4323 static int
4324 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4325 {
4326         int id = (int)zc->zc_guid;
4327         int error;
4328 
4329         error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4330             &zc->zc_inject_record);
4331 
4332         zc->zc_guid = id;
4333 
4334         return (error);
4335 }
4336 
4337 static int
4338 zfs_ioc_error_log(zfs_cmd_t *zc)
4339 {
4340         spa_t *spa;
4341         int error;
4342         size_t count = (size_t)zc->zc_nvlist_dst_size;
4343 
4344         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4345                 return (error);
4346 
4347         error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4348             &count);
4349         if (error == 0)
4350                 zc->zc_nvlist_dst_size = count;
4351         else
4352                 zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4353 
4354         spa_close(spa, FTAG);
4355 
4356         return (error);
4357 }
4358 
4359 static int
4360 zfs_ioc_clear(zfs_cmd_t *zc)
4361 {
4362         spa_t *spa;
4363         vdev_t *vd;
4364         int error;
4365 
4366         /*
4367          * On zpool clear we also fix up missing slogs
4368          */
4369         mutex_enter(&spa_namespace_lock);
4370         spa = spa_lookup(zc->zc_name);
4371         if (spa == NULL) {
4372                 mutex_exit(&spa_namespace_lock);
4373                 return (EIO);
4374         }
4375         if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4376                 /* we need to let spa_open/spa_load clear the chains */
4377                 spa_set_log_state(spa, SPA_LOG_CLEAR);
4378         }
4379         spa->spa_last_open_failed = 0;
4380         mutex_exit(&spa_namespace_lock);
4381 
4382         if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4383                 error = spa_open(zc->zc_name, &spa, FTAG);
4384         } else {
4385                 nvlist_t *policy;
4386                 nvlist_t *config = NULL;
4387 
4388                 if (zc->zc_nvlist_src == NULL)
4389                         return (EINVAL);
4390 
4391                 if ((error = get_nvlist(zc->zc_nvlist_src,
4392                     zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4393                         error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4394                             policy, &config);
4395                         if (config != NULL) {
4396                                 int err;
4397 
4398                                 if ((err = put_nvlist(zc, config)) != 0)
4399                                         error = err;
4400                                 nvlist_free(config);
4401                         }
4402                         nvlist_free(policy);
4403                 }
4404         }
4405 
4406         if (error)
4407                 return (error);
4408 
4409         spa_vdev_state_enter(spa, SCL_NONE);
4410 
4411         if (zc->zc_guid == 0) {
4412                 vd = NULL;
4413         } else {
4414                 vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4415                 if (vd == NULL) {
4416                         (void) spa_vdev_state_exit(spa, NULL, ENODEV);
4417                         spa_close(spa, FTAG);
4418                         return (ENODEV);
4419                 }
4420         }
4421 
4422         vdev_clear(spa, vd);
4423 
4424         (void) spa_vdev_state_exit(spa, NULL, 0);
4425 
4426         /*
4427          * Resume any suspended I/Os.
4428          */
4429         if (zio_resume(spa) != 0)
4430                 error = EIO;
4431 
4432         spa_close(spa, FTAG);
4433 
4434         return (error);
4435 }
4436 
4437 static int
4438 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4439 {
4440         spa_t *spa;
4441         int error;
4442 
4443         error = spa_open(zc->zc_name, &spa, FTAG);
4444         if (error)
4445                 return (error);
4446 
4447         spa_vdev_state_enter(spa, SCL_NONE);
4448 
4449         /*
4450          * If a resilver is already in progress then set the
4451          * spa_scrub_reopen flag to B_TRUE so that we don't restart
4452          * the scan as a side effect of the reopen. Otherwise, let
4453          * vdev_open() decided if a resilver is required.
4454          */
4455         spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4456         vdev_reopen(spa->spa_root_vdev);
4457         spa->spa_scrub_reopen = B_FALSE;
4458 
4459         (void) spa_vdev_state_exit(spa, NULL, 0);
4460         spa_close(spa, FTAG);
4461         return (0);
4462 }
4463 /*
4464  * inputs:
4465  * zc_name      name of filesystem
4466  * zc_value     name of origin snapshot
4467  *
4468  * outputs:
4469  * zc_string    name of conflicting snapshot, if there is one
4470  */
4471 static int
4472 zfs_ioc_promote(zfs_cmd_t *zc)
4473 {
4474         char *cp;
4475 
4476         /*
4477          * We don't need to unmount *all* the origin fs's snapshots, but
4478          * it's easier.
4479          */
4480         cp = strchr(zc->zc_value, '@');
4481         if (cp)
4482                 *cp = '\0';
4483         (void) dmu_objset_find(zc->zc_value,
4484             zfs_unmount_snap, NULL, DS_FIND_SNAPSHOTS);
4485         return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4486 }
4487 
4488 /*
4489  * Retrieve a single {user|group}{used|quota}@... property.
4490  *
4491  * inputs:
4492  * zc_name      name of filesystem
4493  * zc_objset_type zfs_userquota_prop_t
4494  * zc_value     domain name (eg. "S-1-234-567-89")
4495  * zc_guid      RID/UID/GID
4496  *
4497  * outputs:
4498  * zc_cookie    property value
4499  */
4500 static int
4501 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4502 {
4503         zfsvfs_t *zfsvfs;
4504         int error;
4505 
4506         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4507                 return (EINVAL);
4508 
4509         error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4510         if (error)
4511                 return (error);
4512 
4513         error = zfs_userspace_one(zfsvfs,
4514             zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4515         zfsvfs_rele(zfsvfs, FTAG);
4516 
4517         return (error);
4518 }
4519 
4520 /*
4521  * inputs:
4522  * zc_name              name of filesystem
4523  * zc_cookie            zap cursor
4524  * zc_objset_type       zfs_userquota_prop_t
4525  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4526  *
4527  * outputs:
4528  * zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t)
4529  * zc_cookie    zap cursor
4530  */
4531 static int
4532 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4533 {
4534         zfsvfs_t *zfsvfs;
4535         int bufsize = zc->zc_nvlist_dst_size;
4536 
4537         if (bufsize <= 0)
4538                 return (ENOMEM);
4539 
4540         int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4541         if (error)
4542                 return (error);
4543 
4544         void *buf = kmem_alloc(bufsize, KM_SLEEP);
4545 
4546         error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4547             buf, &zc->zc_nvlist_dst_size);
4548 
4549         if (error == 0) {
4550                 error = xcopyout(buf,
4551                     (void *)(uintptr_t)zc->zc_nvlist_dst,
4552                     zc->zc_nvlist_dst_size);
4553         }
4554         kmem_free(buf, bufsize);
4555         zfsvfs_rele(zfsvfs, FTAG);
4556 
4557         return (error);
4558 }
4559 
4560 /*
4561  * inputs:
4562  * zc_name              name of filesystem
4563  *
4564  * outputs:
4565  * none
4566  */
4567 static int
4568 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4569 {
4570         objset_t *os;
4571         int error = 0;
4572         zfsvfs_t *zfsvfs;
4573 
4574         if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4575                 if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4576                         /*
4577                          * If userused is not enabled, it may be because the
4578                          * objset needs to be closed & reopened (to grow the
4579                          * objset_phys_t).  Suspend/resume the fs will do that.
4580                          */
4581                         error = zfs_suspend_fs(zfsvfs);
4582                         if (error == 0)
4583                                 error = zfs_resume_fs(zfsvfs, zc->zc_name);
4584                 }
4585                 if (error == 0)
4586                         error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4587                 VFS_RELE(zfsvfs->z_vfs);
4588         } else {
4589                 /* XXX kind of reading contents without owning */
4590                 error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4591                 if (error)
4592                         return (error);
4593 
4594                 error = dmu_objset_userspace_upgrade(os);
4595                 dmu_objset_rele(os, FTAG);
4596         }
4597 
4598         return (error);
4599 }
4600 
4601 /*
4602  * We don't want to have a hard dependency
4603  * against some special symbols in sharefs
4604  * nfs, and smbsrv.  Determine them if needed when
4605  * the first file system is shared.
4606  * Neither sharefs, nfs or smbsrv are unloadable modules.
4607  */
4608 int (*znfsexport_fs)(void *arg);
4609 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4610 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4611 
4612 int zfs_nfsshare_inited;
4613 int zfs_smbshare_inited;
4614 
4615 ddi_modhandle_t nfs_mod;
4616 ddi_modhandle_t sharefs_mod;
4617 ddi_modhandle_t smbsrv_mod;
4618 kmutex_t zfs_share_lock;
4619 
4620 static int
4621 zfs_init_sharefs()
4622 {
4623         int error;
4624 
4625         ASSERT(MUTEX_HELD(&zfs_share_lock));
4626         /* Both NFS and SMB shares also require sharetab support. */
4627         if (sharefs_mod == NULL && ((sharefs_mod =
4628             ddi_modopen("fs/sharefs",
4629             KRTLD_MODE_FIRST, &error)) == NULL)) {
4630                 return (ENOSYS);
4631         }
4632         if (zshare_fs == NULL && ((zshare_fs =
4633             (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4634             ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4635                 return (ENOSYS);
4636         }
4637         return (0);
4638 }
4639 
4640 static int
4641 zfs_ioc_share(zfs_cmd_t *zc)
4642 {
4643         int error;
4644         int opcode;
4645 
4646         switch (zc->zc_share.z_sharetype) {
4647         case ZFS_SHARE_NFS:
4648         case ZFS_UNSHARE_NFS:
4649                 if (zfs_nfsshare_inited == 0) {
4650                         mutex_enter(&zfs_share_lock);
4651                         if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4652                             KRTLD_MODE_FIRST, &error)) == NULL)) {
4653                                 mutex_exit(&zfs_share_lock);
4654                                 return (ENOSYS);
4655                         }
4656                         if (znfsexport_fs == NULL &&
4657                             ((znfsexport_fs = (int (*)(void *))
4658                             ddi_modsym(nfs_mod,
4659                             "nfs_export", &error)) == NULL)) {
4660                                 mutex_exit(&zfs_share_lock);
4661                                 return (ENOSYS);
4662                         }
4663                         error = zfs_init_sharefs();
4664                         if (error) {
4665                                 mutex_exit(&zfs_share_lock);
4666                                 return (ENOSYS);
4667                         }
4668                         zfs_nfsshare_inited = 1;
4669                         mutex_exit(&zfs_share_lock);
4670                 }
4671                 break;
4672         case ZFS_SHARE_SMB:
4673         case ZFS_UNSHARE_SMB:
4674                 if (zfs_smbshare_inited == 0) {
4675                         mutex_enter(&zfs_share_lock);
4676                         if (smbsrv_mod == NULL && ((smbsrv_mod =
4677                             ddi_modopen("drv/smbsrv",
4678                             KRTLD_MODE_FIRST, &error)) == NULL)) {
4679                                 mutex_exit(&zfs_share_lock);
4680                                 return (ENOSYS);
4681                         }
4682                         if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4683                             (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4684                             "smb_server_share", &error)) == NULL)) {
4685                                 mutex_exit(&zfs_share_lock);
4686                                 return (ENOSYS);
4687                         }
4688                         error = zfs_init_sharefs();
4689                         if (error) {
4690                                 mutex_exit(&zfs_share_lock);
4691                                 return (ENOSYS);
4692                         }
4693                         zfs_smbshare_inited = 1;
4694                         mutex_exit(&zfs_share_lock);
4695                 }
4696                 break;
4697         default:
4698                 return (EINVAL);
4699         }
4700 
4701         switch (zc->zc_share.z_sharetype) {
4702         case ZFS_SHARE_NFS:
4703         case ZFS_UNSHARE_NFS:
4704                 if (error =
4705                     znfsexport_fs((void *)
4706                     (uintptr_t)zc->zc_share.z_exportdata))
4707                         return (error);
4708                 break;
4709         case ZFS_SHARE_SMB:
4710         case ZFS_UNSHARE_SMB:
4711                 if (error = zsmbexport_fs((void *)
4712                     (uintptr_t)zc->zc_share.z_exportdata,
4713                     zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
4714                     B_TRUE: B_FALSE)) {
4715                         return (error);
4716                 }
4717                 break;
4718         }
4719 
4720         opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
4721             zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
4722             SHAREFS_ADD : SHAREFS_REMOVE;
4723 
4724         /*
4725          * Add or remove share from sharetab
4726          */
4727         error = zshare_fs(opcode,
4728             (void *)(uintptr_t)zc->zc_share.z_sharedata,
4729             zc->zc_share.z_sharemax);
4730 
4731         return (error);
4732 
4733 }
4734 
4735 ace_t full_access[] = {
4736         {(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
4737 };
4738 
4739 /*
4740  * inputs:
4741  * zc_name              name of containing filesystem
4742  * zc_obj               object # beyond which we want next in-use object #
4743  *
4744  * outputs:
4745  * zc_obj               next in-use object #
4746  */
4747 static int
4748 zfs_ioc_next_obj(zfs_cmd_t *zc)
4749 {
4750         objset_t *os = NULL;
4751         int error;
4752 
4753         error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4754         if (error)
4755                 return (error);
4756 
4757         error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
4758             os->os_dsl_dataset->ds_phys->ds_prev_snap_txg);
4759 
4760         dmu_objset_rele(os, FTAG);
4761         return (error);
4762 }
4763 
4764 /*
4765  * inputs:
4766  * zc_name              name of filesystem
4767  * zc_value             prefix name for snapshot
4768  * zc_cleanup_fd        cleanup-on-exit file descriptor for calling process
4769  *
4770  * outputs:
4771  * zc_value             short name of new snapshot
4772  */
4773 static int
4774 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
4775 {
4776         char *snap_name;
4777         int error;
4778 
4779         snap_name = kmem_asprintf("%s@%s-%016llx", zc->zc_name, zc->zc_value,
4780             (u_longlong_t)ddi_get_lbolt64());
4781 
4782         if (strlen(snap_name) >= MAXPATHLEN) {
4783                 strfree(snap_name);
4784                 return (E2BIG);
4785         }
4786 
4787         error = dmu_objset_snapshot_tmp(snap_name, "%temp", zc->zc_cleanup_fd);
4788         if (error != 0) {
4789                 strfree(snap_name);
4790                 return (error);
4791         }
4792 
4793         (void) strcpy(zc->zc_value, strchr(snap_name, '@') + 1);
4794         strfree(snap_name);
4795         return (0);
4796 }
4797 
4798 /*
4799  * inputs:
4800  * zc_name              name of "to" snapshot
4801  * zc_value             name of "from" snapshot
4802  * zc_cookie            file descriptor to write diff data on
4803  *
4804  * outputs:
4805  * dmu_diff_record_t's to the file descriptor
4806  */
4807 static int
4808 zfs_ioc_diff(zfs_cmd_t *zc)
4809 {
4810         objset_t *fromsnap;
4811         objset_t *tosnap;
4812         file_t *fp;
4813         offset_t off;
4814         int error;
4815 
4816         error = dmu_objset_hold(zc->zc_name, FTAG, &tosnap);
4817         if (error)
4818                 return (error);
4819 
4820         error = dmu_objset_hold(zc->zc_value, FTAG, &fromsnap);
4821         if (error) {
4822                 dmu_objset_rele(tosnap, FTAG);
4823                 return (error);
4824         }
4825 
4826         fp = getf(zc->zc_cookie);
4827         if (fp == NULL) {
4828                 dmu_objset_rele(fromsnap, FTAG);
4829                 dmu_objset_rele(tosnap, FTAG);
4830                 return (EBADF);
4831         }
4832 
4833         off = fp->f_offset;
4834 
4835         error = dmu_diff(tosnap, fromsnap, fp->f_vnode, &off);
4836 
4837         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4838                 fp->f_offset = off;
4839         releasef(zc->zc_cookie);
4840 
4841         dmu_objset_rele(fromsnap, FTAG);
4842         dmu_objset_rele(tosnap, FTAG);
4843         return (error);
4844 }
4845 
4846 /*
4847  * Remove all ACL files in shares dir
4848  */
4849 static int
4850 zfs_smb_acl_purge(znode_t *dzp)
4851 {
4852         zap_cursor_t    zc;
4853         zap_attribute_t zap;
4854         zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
4855         int error;
4856 
4857         for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
4858             (error = zap_cursor_retrieve(&zc, &zap)) == 0;
4859             zap_cursor_advance(&zc)) {
4860                 if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
4861                     NULL, 0)) != 0)
4862                         break;
4863         }
4864         zap_cursor_fini(&zc);
4865         return (error);
4866 }
4867 
4868 static int
4869 zfs_ioc_smb_acl(zfs_cmd_t *zc)
4870 {
4871         vnode_t *vp;
4872         znode_t *dzp;
4873         vnode_t *resourcevp = NULL;
4874         znode_t *sharedir;
4875         zfsvfs_t *zfsvfs;
4876         nvlist_t *nvlist;
4877         char *src, *target;
4878         vattr_t vattr;
4879         vsecattr_t vsec;
4880         int error = 0;
4881 
4882         if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
4883             NO_FOLLOW, NULL, &vp)) != 0)
4884                 return (error);
4885 
4886         /* Now make sure mntpnt and dataset are ZFS */
4887 
4888         if (vp->v_vfsp->vfs_fstype != zfsfstype ||
4889             (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
4890             zc->zc_name) != 0)) {
4891                 VN_RELE(vp);
4892                 return (EINVAL);
4893         }
4894 
4895         dzp = VTOZ(vp);
4896         zfsvfs = dzp->z_zfsvfs;
4897         ZFS_ENTER(zfsvfs);
4898 
4899         /*
4900          * Create share dir if its missing.
4901          */
4902         mutex_enter(&zfsvfs->z_lock);
4903         if (zfsvfs->z_shares_dir == 0) {
4904                 dmu_tx_t *tx;
4905 
4906                 tx = dmu_tx_create(zfsvfs->z_os);
4907                 dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
4908                     ZFS_SHARES_DIR);
4909                 dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
4910                 error = dmu_tx_assign(tx, TXG_WAIT);
4911                 if (error) {
4912                         dmu_tx_abort(tx);
4913                 } else {
4914                         error = zfs_create_share_dir(zfsvfs, tx);
4915                         dmu_tx_commit(tx);
4916                 }
4917                 if (error) {
4918                         mutex_exit(&zfsvfs->z_lock);
4919                         VN_RELE(vp);
4920                         ZFS_EXIT(zfsvfs);
4921                         return (error);
4922                 }
4923         }
4924         mutex_exit(&zfsvfs->z_lock);
4925 
4926         ASSERT(zfsvfs->z_shares_dir);
4927         if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
4928                 VN_RELE(vp);
4929                 ZFS_EXIT(zfsvfs);
4930                 return (error);
4931         }
4932 
4933         switch (zc->zc_cookie) {
4934         case ZFS_SMB_ACL_ADD:
4935                 vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
4936                 vattr.va_type = VREG;
4937                 vattr.va_mode = S_IFREG|0777;
4938                 vattr.va_uid = 0;
4939                 vattr.va_gid = 0;
4940 
4941                 vsec.vsa_mask = VSA_ACE;
4942                 vsec.vsa_aclentp = &full_access;
4943                 vsec.vsa_aclentsz = sizeof (full_access);
4944                 vsec.vsa_aclcnt = 1;
4945 
4946                 error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
4947                     &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
4948                 if (resourcevp)
4949                         VN_RELE(resourcevp);
4950                 break;
4951 
4952         case ZFS_SMB_ACL_REMOVE:
4953                 error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
4954                     NULL, 0);
4955                 break;
4956 
4957         case ZFS_SMB_ACL_RENAME:
4958                 if ((error = get_nvlist(zc->zc_nvlist_src,
4959                     zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
4960                         VN_RELE(vp);
4961                         ZFS_EXIT(zfsvfs);
4962                         return (error);
4963                 }
4964                 if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
4965                     nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
4966                     &target)) {
4967                         VN_RELE(vp);
4968                         VN_RELE(ZTOV(sharedir));
4969                         ZFS_EXIT(zfsvfs);
4970                         nvlist_free(nvlist);
4971                         return (error);
4972                 }
4973                 error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
4974                     kcred, NULL, 0);
4975                 nvlist_free(nvlist);
4976                 break;
4977 
4978         case ZFS_SMB_ACL_PURGE:
4979                 error = zfs_smb_acl_purge(sharedir);
4980                 break;
4981 
4982         default:
4983                 error = EINVAL;
4984                 break;
4985         }
4986 
4987         VN_RELE(vp);
4988         VN_RELE(ZTOV(sharedir));
4989 
4990         ZFS_EXIT(zfsvfs);
4991 
4992         return (error);
4993 }
4994 
4995 /*
4996  * inputs:
4997  * zc_name              name of filesystem
4998  * zc_value             short name of snap
4999  * zc_string            user-supplied tag for this hold
5000  * zc_cookie            recursive flag
5001  * zc_temphold          set if hold is temporary
5002  * zc_cleanup_fd        cleanup-on-exit file descriptor for calling process
5003  * zc_sendobj           if non-zero, the objid for zc_name@zc_value
5004  * zc_createtxg         if zc_sendobj is non-zero, snap must have zc_createtxg
5005  *
5006  * outputs:             none
5007  */
5008 static int
5009 zfs_ioc_hold(zfs_cmd_t *zc)
5010 {
5011         boolean_t recursive = zc->zc_cookie;
5012         spa_t *spa;
5013         dsl_pool_t *dp;
5014         dsl_dataset_t *ds;
5015         int error;
5016         minor_t minor = 0;
5017 
5018         if (snapshot_namecheck(zc->zc_value, NULL, NULL) != 0)
5019                 return (EINVAL);
5020 
5021         if (zc->zc_sendobj == 0) {
5022                 return (dsl_dataset_user_hold(zc->zc_name, zc->zc_value,
5023                     zc->zc_string, recursive, zc->zc_temphold,
5024                     zc->zc_cleanup_fd));
5025         }
5026 
5027         if (recursive)
5028                 return (EINVAL);
5029 
5030         error = spa_open(zc->zc_name, &spa, FTAG);
5031         if (error)
5032                 return (error);
5033 
5034         dp = spa_get_dsl(spa);
5035         rw_enter(&dp->dp_config_rwlock, RW_READER);
5036         error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
5037         rw_exit(&dp->dp_config_rwlock);
5038         spa_close(spa, FTAG);
5039         if (error)
5040                 return (error);
5041 
5042         /*
5043          * Until we have a hold on this snapshot, it's possible that
5044          * zc_sendobj could've been destroyed and reused as part
5045          * of a later txg.  Make sure we're looking at the right object.
5046          */
5047         if (zc->zc_createtxg != ds->ds_phys->ds_creation_txg) {
5048                 dsl_dataset_rele(ds, FTAG);
5049                 return (ENOENT);
5050         }
5051 
5052         if (zc->zc_cleanup_fd != -1 && zc->zc_temphold) {
5053                 error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
5054                 if (error) {
5055                         dsl_dataset_rele(ds, FTAG);
5056                         return (error);
5057                 }
5058         }
5059 
5060         error = dsl_dataset_user_hold_for_send(ds, zc->zc_string,
5061             zc->zc_temphold);
5062         if (minor != 0) {
5063                 if (error == 0) {
5064                         dsl_register_onexit_hold_cleanup(ds, zc->zc_string,
5065                             minor);
5066                 }
5067                 zfs_onexit_fd_rele(zc->zc_cleanup_fd);
5068         }
5069         dsl_dataset_rele(ds, FTAG);
5070 
5071         return (error);
5072 }
5073 
5074 /*
5075  * inputs:
5076  * zc_name      name of dataset from which we're releasing a user hold
5077  * zc_value     short name of snap
5078  * zc_string    user-supplied tag for this hold
5079  * zc_cookie    recursive flag
5080  *
5081  * outputs:     none
5082  */
5083 static int
5084 zfs_ioc_release(zfs_cmd_t *zc)
5085 {
5086         boolean_t recursive = zc->zc_cookie;
5087 
5088         if (snapshot_namecheck(zc->zc_value, NULL, NULL) != 0)
5089                 return (EINVAL);
5090 
5091         return (dsl_dataset_user_release(zc->zc_name, zc->zc_value,
5092             zc->zc_string, recursive));
5093 }
5094 
5095 /*
5096  * inputs:
5097  * zc_name              name of filesystem
5098  *
5099  * outputs:
5100  * zc_nvlist_src{_size} nvlist of snapshot holds
5101  */
5102 static int
5103 zfs_ioc_get_holds(zfs_cmd_t *zc)
5104 {
5105         nvlist_t *nvp;
5106         int error;
5107 
5108         if ((error = dsl_dataset_get_holds(zc->zc_name, &nvp)) == 0) {
5109                 error = put_nvlist(zc, nvp);
5110                 nvlist_free(nvp);
5111         }
5112 
5113         return (error);
5114 }
5115 
5116 /*
5117  * inputs:
5118  * zc_name              name of new filesystem or snapshot
5119  * zc_value             full name of old snapshot
5120  *
5121  * outputs:
5122  * zc_cookie            space in bytes
5123  * zc_objset_type       compressed space in bytes
5124  * zc_perm_action       uncompressed space in bytes
5125  */
5126 static int
5127 zfs_ioc_space_written(zfs_cmd_t *zc)
5128 {
5129         int error;
5130         dsl_dataset_t *new, *old;
5131 
5132         error = dsl_dataset_hold(zc->zc_name, FTAG, &new);
5133         if (error != 0)
5134                 return (error);
5135         error = dsl_dataset_hold(zc->zc_value, FTAG, &old);
5136         if (error != 0) {
5137                 dsl_dataset_rele(new, FTAG);
5138                 return (error);
5139         }
5140 
5141         error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5142             &zc->zc_objset_type, &zc->zc_perm_action);
5143         dsl_dataset_rele(old, FTAG);
5144         dsl_dataset_rele(new, FTAG);
5145         return (error);
5146 }
5147 /*
5148  * innvl: {
5149  *     "firstsnap" -> snapshot name
5150  * }
5151  *
5152  * outnvl: {
5153  *     "used" -> space in bytes
5154  *     "compressed" -> compressed space in bytes
5155  *     "uncompressed" -> uncompressed space in bytes
5156  * }
5157  */
5158 static int
5159 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5160 {
5161         int error;
5162         dsl_dataset_t *new, *old;
5163         char *firstsnap;
5164         uint64_t used, comp, uncomp;
5165 
5166         if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5167                 return (EINVAL);
5168 
5169         error = dsl_dataset_hold(lastsnap, FTAG, &new);
5170         if (error != 0)
5171                 return (error);
5172         error = dsl_dataset_hold(firstsnap, FTAG, &old);
5173         if (error != 0) {
5174                 dsl_dataset_rele(new, FTAG);
5175                 return (error);
5176         }
5177 
5178         error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5179         dsl_dataset_rele(old, FTAG);
5180         dsl_dataset_rele(new, FTAG);
5181         fnvlist_add_uint64(outnvl, "used", used);
5182         fnvlist_add_uint64(outnvl, "compressed", comp);
5183         fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5184         return (error);
5185 }
5186 
5187 /*
5188  * innvl: {
5189  *     "fd" -> file descriptor to write stream to (int32)
5190  *     (optional) "fromsnap" -> full snap name to send an incremental from
5191  * }
5192  *
5193  * outnvl is unused
5194  */
5195 /* ARGSUSED */
5196 static int
5197 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5198 {
5199         objset_t *fromsnap = NULL;
5200         objset_t *tosnap;
5201         int error;
5202         offset_t off;
5203         char *fromname;
5204         int fd;
5205 
5206         error = nvlist_lookup_int32(innvl, "fd", &fd);
5207         if (error != 0)
5208                 return (EINVAL);
5209 
5210         error = dmu_objset_hold(snapname, FTAG, &tosnap);
5211         if (error)
5212                 return (error);
5213 
5214         error = nvlist_lookup_string(innvl, "fromsnap", &fromname);
5215         if (error == 0) {
5216                 error = dmu_objset_hold(fromname, FTAG, &fromsnap);
5217                 if (error) {
5218                         dmu_objset_rele(tosnap, FTAG);
5219                         return (error);
5220                 }
5221         }
5222 
5223         file_t *fp = getf(fd);
5224         if (fp == NULL) {
5225                 dmu_objset_rele(tosnap, FTAG);
5226                 if (fromsnap != NULL)
5227                         dmu_objset_rele(fromsnap, FTAG);
5228                 return (EBADF);
5229         }
5230 
5231         off = fp->f_offset;
5232         error = dmu_send(tosnap, fromsnap, fd, fp->f_vnode, &off);
5233 
5234         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5235                 fp->f_offset = off;
5236         releasef(fd);
5237         if (fromsnap != NULL)
5238                 dmu_objset_rele(fromsnap, FTAG);
5239         dmu_objset_rele(tosnap, FTAG);
5240         return (error);
5241 }
5242 
5243 /*
5244  * Determine approximately how large a zfs send stream will be -- the number
5245  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5246  *
5247  * innvl: {
5248  *     (optional) "fromsnap" -> full snap name to send an incremental from
5249  * }
5250  *
5251  * outnvl: {
5252  *     "space" -> bytes of space (uint64)
5253  * }
5254  */
5255 static int
5256 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5257 {
5258         objset_t *fromsnap = NULL;
5259         objset_t *tosnap;
5260         int error;
5261         char *fromname;
5262         uint64_t space;
5263 
5264         error = dmu_objset_hold(snapname, FTAG, &tosnap);
5265         if (error)
5266                 return (error);
5267 
5268         error = nvlist_lookup_string(innvl, "fromsnap", &fromname);
5269         if (error == 0) {
5270                 error = dmu_objset_hold(fromname, FTAG, &fromsnap);
5271                 if (error) {
5272                         dmu_objset_rele(tosnap, FTAG);
5273                         return (error);
5274                 }
5275         }
5276 
5277         error = dmu_send_estimate(tosnap, fromsnap, &space);
5278         fnvlist_add_uint64(outnvl, "space", space);
5279 
5280         if (fromsnap != NULL)
5281                 dmu_objset_rele(fromsnap, FTAG);
5282         dmu_objset_rele(tosnap, FTAG);
5283         return (error);
5284 }
5285 
5286 
5287 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5288 
5289 static void
5290 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5291     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5292     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5293 {
5294         zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5295 
5296         ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5297         ASSERT3U(ioc, <, ZFS_IOC_LAST);
5298         ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5299         ASSERT3P(vec->zvec_func, ==, NULL);
5300 
5301         vec->zvec_legacy_func = func;
5302         vec->zvec_secpolicy = secpolicy;
5303         vec->zvec_namecheck = namecheck;
5304         vec->zvec_allow_log = log_history;
5305         vec->zvec_pool_check = pool_check;
5306 }
5307 
5308 /*
5309  * See the block comment at the beginning of this file for details on
5310  * each argument to this function.
5311  */
5312 static void
5313 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5314     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5315     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5316     boolean_t allow_log)
5317 {
5318         zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5319 
5320         ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5321         ASSERT3U(ioc, <, ZFS_IOC_LAST);
5322         ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5323         ASSERT3P(vec->zvec_func, ==, NULL);
5324 
5325         /* if we are logging, the name must be valid */
5326         ASSERT(!allow_log || namecheck != NO_NAME);
5327 
5328         vec->zvec_name = name;
5329         vec->zvec_func = func;
5330         vec->zvec_secpolicy = secpolicy;
5331         vec->zvec_namecheck = namecheck;
5332         vec->zvec_pool_check = pool_check;
5333         vec->zvec_smush_outnvlist = smush_outnvlist;
5334         vec->zvec_allow_log = allow_log;
5335 }
5336 
5337 static void
5338 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5339     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5340     zfs_ioc_poolcheck_t pool_check)
5341 {
5342         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5343             POOL_NAME, log_history, pool_check);
5344 }
5345 
5346 static void
5347 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5348     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5349 {
5350         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5351             DATASET_NAME, B_FALSE, pool_check);
5352 }
5353 
5354 static void
5355 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5356 {
5357         zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5358             POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5359 }
5360 
5361 static void
5362 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5363     zfs_secpolicy_func_t *secpolicy)
5364 {
5365         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5366             NO_NAME, B_FALSE, POOL_CHECK_NONE);
5367 }
5368 
5369 static void
5370 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5371     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5372 {
5373         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5374             DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5375 }
5376 
5377 static void
5378 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5379 {
5380         zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5381             zfs_secpolicy_read);
5382 }
5383 
5384 static void
5385 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5386         zfs_secpolicy_func_t *secpolicy)
5387 {
5388         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5389             DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5390 }
5391 
5392 static void
5393 zfs_ioctl_init(void)
5394 {
5395         zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5396             zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5397             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5398 
5399         zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5400             zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5401             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5402 
5403         zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5404             zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5405             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5406 
5407         zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5408             zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5409             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5410 
5411         zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5412             zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5413             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5414 
5415         zfs_ioctl_register("create", ZFS_IOC_CREATE,
5416             zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5417             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5418 
5419         zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5420             zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5421             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5422 
5423         zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5424             zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5425             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5426 
5427         /* IOCTLS that use the legacy function signature */
5428 
5429         zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5430             zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5431 
5432         zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5433             zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5434         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5435             zfs_ioc_pool_scan);
5436         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5437             zfs_ioc_pool_upgrade);
5438         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5439             zfs_ioc_vdev_add);
5440         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5441             zfs_ioc_vdev_remove);
5442         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5443             zfs_ioc_vdev_set_state);
5444         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5445             zfs_ioc_vdev_attach);
5446         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5447             zfs_ioc_vdev_detach);
5448         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5449             zfs_ioc_vdev_setpath);
5450         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5451             zfs_ioc_vdev_setfru);
5452         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5453             zfs_ioc_pool_set_props);
5454         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5455             zfs_ioc_vdev_split);
5456         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5457             zfs_ioc_pool_reguid);
5458 
5459         zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5460             zfs_ioc_pool_configs, zfs_secpolicy_none);
5461         zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5462             zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5463         zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5464             zfs_ioc_inject_fault, zfs_secpolicy_inject);
5465         zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5466             zfs_ioc_clear_fault, zfs_secpolicy_inject);
5467         zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5468             zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5469 
5470         /*
5471          * pool destroy, and export don't log the history as part of
5472          * zfsdev_ioctl, but rather zfs_ioc_pool_export
5473          * does the logging of those commands.
5474          */
5475         zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5476             zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5477         zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5478             zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5479 
5480         zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5481             zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5482         zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5483             zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5484 
5485         zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5486             zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5487         zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5488             zfs_ioc_dsobj_to_dsname,
5489             zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5490         zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5491             zfs_ioc_pool_get_history,
5492             zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5493 
5494         zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5495             zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5496 
5497         zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5498             zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5499         zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5500             zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5501 
5502         zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5503             zfs_ioc_space_written);
5504         zfs_ioctl_register_dataset_read(ZFS_IOC_GET_HOLDS,
5505             zfs_ioc_get_holds);
5506         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5507             zfs_ioc_objset_recvd_props);
5508         zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5509             zfs_ioc_next_obj);
5510         zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5511             zfs_ioc_get_fsacl);
5512         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5513             zfs_ioc_objset_stats);
5514         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5515             zfs_ioc_objset_zplprops);
5516         zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5517             zfs_ioc_dataset_list_next);
5518         zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5519             zfs_ioc_snapshot_list_next);
5520         zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5521             zfs_ioc_send_progress);
5522 
5523         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5524             zfs_ioc_diff, zfs_secpolicy_diff);
5525         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5526             zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5527         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5528             zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5529         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5530             zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5531         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5532             zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5533         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5534             zfs_ioc_send, zfs_secpolicy_send);
5535 
5536         zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5537             zfs_secpolicy_none);
5538         zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5539             zfs_secpolicy_destroy);
5540         zfs_ioctl_register_dataset_modify(ZFS_IOC_ROLLBACK, zfs_ioc_rollback,
5541             zfs_secpolicy_rollback);
5542         zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5543             zfs_secpolicy_rename);
5544         zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5545             zfs_secpolicy_recv);
5546         zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5547             zfs_secpolicy_promote);
5548         zfs_ioctl_register_dataset_modify(ZFS_IOC_HOLD, zfs_ioc_hold,
5549             zfs_secpolicy_hold);
5550         zfs_ioctl_register_dataset_modify(ZFS_IOC_RELEASE, zfs_ioc_release,
5551             zfs_secpolicy_release);
5552         zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5553             zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5554         zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5555             zfs_secpolicy_set_fsacl);
5556 
5557         zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5558             zfs_secpolicy_share, POOL_CHECK_NONE);
5559         zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5560             zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5561         zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5562             zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5563             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5564         zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5565             zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5566             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5567 }
5568 
5569 int
5570 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5571     zfs_ioc_poolcheck_t check)
5572 {
5573         spa_t *spa;
5574         int error;
5575 
5576         ASSERT(type == POOL_NAME || type == DATASET_NAME);
5577 
5578         if (check & POOL_CHECK_NONE)
5579                 return (0);
5580 
5581         error = spa_open(name, &spa, FTAG);
5582         if (error == 0) {
5583                 if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5584                         error = EAGAIN;
5585                 else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5586                         error = EROFS;
5587                 spa_close(spa, FTAG);
5588         }
5589         return (error);
5590 }
5591 
5592 /*
5593  * Find a free minor number.
5594  */
5595 minor_t
5596 zfsdev_minor_alloc(void)
5597 {
5598         static minor_t last_minor;
5599         minor_t m;
5600 
5601         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5602 
5603         for (m = last_minor + 1; m != last_minor; m++) {
5604                 if (m > ZFSDEV_MAX_MINOR)
5605                         m = 1;
5606                 if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5607                         last_minor = m;
5608                         return (m);
5609                 }
5610         }
5611 
5612         return (0);
5613 }
5614 
5615 static int
5616 zfs_ctldev_init(dev_t *devp)
5617 {
5618         minor_t minor;
5619         zfs_soft_state_t *zs;
5620 
5621         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5622         ASSERT(getminor(*devp) == 0);
5623 
5624         minor = zfsdev_minor_alloc();
5625         if (minor == 0)
5626                 return (ENXIO);
5627 
5628         if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5629                 return (EAGAIN);
5630 
5631         *devp = makedevice(getemajor(*devp), minor);
5632 
5633         zs = ddi_get_soft_state(zfsdev_state, minor);
5634         zs->zss_type = ZSST_CTLDEV;
5635         zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
5636 
5637         return (0);
5638 }
5639 
5640 static void
5641 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
5642 {
5643         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5644 
5645         zfs_onexit_destroy(zo);
5646         ddi_soft_state_free(zfsdev_state, minor);
5647 }
5648 
5649 void *
5650 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
5651 {
5652         zfs_soft_state_t *zp;
5653 
5654         zp = ddi_get_soft_state(zfsdev_state, minor);
5655         if (zp == NULL || zp->zss_type != which)
5656                 return (NULL);
5657 
5658         return (zp->zss_data);
5659 }
5660 
5661 static int
5662 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
5663 {
5664         int error = 0;
5665 
5666         if (getminor(*devp) != 0)
5667                 return (zvol_open(devp, flag, otyp, cr));
5668 
5669         /* This is the control device. Allocate a new minor if requested. */
5670         if (flag & FEXCL) {
5671                 mutex_enter(&zfsdev_state_lock);
5672                 error = zfs_ctldev_init(devp);
5673                 mutex_exit(&zfsdev_state_lock);
5674         }
5675 
5676         return (error);
5677 }
5678 
5679 static int
5680 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
5681 {
5682         zfs_onexit_t *zo;
5683         minor_t minor = getminor(dev);
5684 
5685         if (minor == 0)
5686                 return (0);
5687 
5688         mutex_enter(&zfsdev_state_lock);
5689         zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
5690         if (zo == NULL) {
5691                 mutex_exit(&zfsdev_state_lock);
5692                 return (zvol_close(dev, flag, otyp, cr));
5693         }
5694         zfs_ctldev_destroy(zo, minor);
5695         mutex_exit(&zfsdev_state_lock);
5696 
5697         return (0);
5698 }
5699 
5700 static int
5701 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
5702 {
5703         zfs_cmd_t *zc;
5704         uint_t vecnum;
5705         int error, rc, len;
5706         minor_t minor = getminor(dev);
5707         const zfs_ioc_vec_t *vec;
5708         char *saved_poolname = NULL;
5709         nvlist_t *innvl = NULL;
5710 
5711         if (minor != 0 &&
5712             zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
5713                 return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
5714 
5715         vecnum = cmd - ZFS_IOC_FIRST;
5716         ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
5717 
5718         if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
5719                 return (EINVAL);
5720         vec = &zfs_ioc_vec[vecnum];
5721 
5722         zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
5723 
5724         error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
5725         if (error != 0) {
5726                 error = EFAULT;
5727                 goto out;
5728         }
5729 
5730         zc->zc_iflags = flag & FKIOCTL;
5731         if (zc->zc_nvlist_src_size != 0) {
5732                 error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
5733                     zc->zc_iflags, &innvl);
5734                 if (error != 0)
5735                         goto out;
5736         }
5737 
5738         /*
5739          * Ensure that all pool/dataset names are valid before we pass down to
5740          * the lower layers.
5741          */
5742         zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
5743         switch (vec->zvec_namecheck) {
5744         case POOL_NAME:
5745                 if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
5746                         error = EINVAL;
5747                 else
5748                         error = pool_status_check(zc->zc_name,
5749                             vec->zvec_namecheck, vec->zvec_pool_check);
5750                 break;
5751 
5752         case DATASET_NAME:
5753                 if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
5754                         error = EINVAL;
5755                 else
5756                         error = pool_status_check(zc->zc_name,
5757                             vec->zvec_namecheck, vec->zvec_pool_check);
5758                 break;
5759 
5760         case NO_NAME:
5761                 break;
5762         }
5763 
5764 
5765         if (error == 0 && !(flag & FKIOCTL))
5766                 error = vec->zvec_secpolicy(zc, innvl, cr);
5767 
5768         if (error != 0)
5769                 goto out;
5770 
5771         /* legacy ioctls can modify zc_name */
5772         len = strcspn(zc->zc_name, "/@") + 1;
5773         saved_poolname = kmem_alloc(len, KM_SLEEP);
5774         (void) strlcpy(saved_poolname, zc->zc_name, len);
5775 
5776         if (vec->zvec_func != NULL) {
5777                 nvlist_t *outnvl;
5778                 int puterror = 0;
5779                 spa_t *spa;
5780                 nvlist_t *lognv = NULL;
5781 
5782                 ASSERT(vec->zvec_legacy_func == NULL);
5783 
5784                 /*
5785                  * Add the innvl to the lognv before calling the func,
5786                  * in case the func changes the innvl.
5787                  */
5788                 if (vec->zvec_allow_log) {
5789                         lognv = fnvlist_alloc();
5790                         fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
5791                             vec->zvec_name);
5792                         if (!nvlist_empty(innvl)) {
5793                                 fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
5794                                     innvl);
5795                         }
5796                 }
5797 
5798                 outnvl = fnvlist_alloc();
5799                 error = vec->zvec_func(zc->zc_name, innvl, outnvl);
5800 
5801                 if (error == 0 && vec->zvec_allow_log &&
5802                     spa_open(zc->zc_name, &spa, FTAG) == 0) {
5803                         if (!nvlist_empty(outnvl)) {
5804                                 fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
5805                                     outnvl);
5806                         }
5807                         (void) spa_history_log_nvl(spa, lognv);
5808                         spa_close(spa, FTAG);
5809                 }
5810                 fnvlist_free(lognv);
5811 
5812                 if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
5813                         int smusherror = 0;
5814                         if (vec->zvec_smush_outnvlist) {
5815                                 smusherror = nvlist_smush(outnvl,
5816                                     zc->zc_nvlist_dst_size);
5817                         }
5818                         if (smusherror == 0)
5819                                 puterror = put_nvlist(zc, outnvl);
5820                 }
5821 
5822                 if (puterror != 0)
5823                         error = puterror;
5824 
5825                 nvlist_free(outnvl);
5826         } else {
5827                 error = vec->zvec_legacy_func(zc);
5828         }
5829 
5830 out:
5831         nvlist_free(innvl);
5832         rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
5833         if (error == 0 && rc != 0)
5834                 error = EFAULT;
5835         if (error == 0 && vec->zvec_allow_log) {
5836                 char *s = tsd_get(zfs_allow_log_key);
5837                 if (s != NULL)
5838                         strfree(s);
5839                 (void) tsd_set(zfs_allow_log_key, saved_poolname);
5840         } else {
5841                 if (saved_poolname != NULL)
5842                         strfree(saved_poolname);
5843         }
5844 
5845         kmem_free(zc, sizeof (zfs_cmd_t));
5846         return (error);
5847 }
5848 
5849 static int
5850 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
5851 {
5852         if (cmd != DDI_ATTACH)
5853                 return (DDI_FAILURE);
5854 
5855         if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
5856             DDI_PSEUDO, 0) == DDI_FAILURE)
5857                 return (DDI_FAILURE);
5858 
5859         zfs_dip = dip;
5860 
5861         ddi_report_dev(dip);
5862 
5863         return (DDI_SUCCESS);
5864 }
5865 
5866 static int
5867 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
5868 {
5869         if (spa_busy() || zfs_busy() || zvol_busy())
5870                 return (DDI_FAILURE);
5871 
5872         if (cmd != DDI_DETACH)
5873                 return (DDI_FAILURE);
5874 
5875         zfs_dip = NULL;
5876 
5877         ddi_prop_remove_all(dip);
5878         ddi_remove_minor_node(dip, NULL);
5879 
5880         return (DDI_SUCCESS);
5881 }
5882 
5883 /*ARGSUSED*/
5884 static int
5885 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
5886 {
5887         switch (infocmd) {
5888         case DDI_INFO_DEVT2DEVINFO:
5889                 *result = zfs_dip;
5890                 return (DDI_SUCCESS);
5891 
5892         case DDI_INFO_DEVT2INSTANCE:
5893                 *result = (void *)0;
5894                 return (DDI_SUCCESS);
5895         }
5896 
5897         return (DDI_FAILURE);
5898 }
5899 
5900 /*
5901  * OK, so this is a little weird.
5902  *
5903  * /dev/zfs is the control node, i.e. minor 0.
5904  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
5905  *
5906  * /dev/zfs has basically nothing to do except serve up ioctls,
5907  * so most of the standard driver entry points are in zvol.c.
5908  */
5909 static struct cb_ops zfs_cb_ops = {
5910         zfsdev_open,    /* open */
5911         zfsdev_close,   /* close */
5912         zvol_strategy,  /* strategy */
5913         nodev,          /* print */
5914         zvol_dump,      /* dump */
5915         zvol_read,      /* read */
5916         zvol_write,     /* write */
5917         zfsdev_ioctl,   /* ioctl */
5918         nodev,          /* devmap */
5919         nodev,          /* mmap */
5920         nodev,          /* segmap */
5921         nochpoll,       /* poll */
5922         ddi_prop_op,    /* prop_op */
5923         NULL,           /* streamtab */
5924         D_NEW | D_MP | D_64BIT,         /* Driver compatibility flag */
5925         CB_REV,         /* version */
5926         nodev,          /* async read */
5927         nodev,          /* async write */
5928 };
5929 
5930 static struct dev_ops zfs_dev_ops = {
5931         DEVO_REV,       /* version */
5932         0,              /* refcnt */
5933         zfs_info,       /* info */
5934         nulldev,        /* identify */
5935         nulldev,        /* probe */
5936         zfs_attach,     /* attach */
5937         zfs_detach,     /* detach */
5938         nodev,          /* reset */
5939         &zfs_cb_ops,        /* driver operations */
5940         NULL,           /* no bus operations */
5941         NULL,           /* power */
5942         ddi_quiesce_not_needed, /* quiesce */
5943 };
5944 
5945 static struct modldrv zfs_modldrv = {
5946         &mod_driverops,
5947         "ZFS storage pool",
5948         &zfs_dev_ops
5949 };
5950 
5951 static struct modlinkage modlinkage = {
5952         MODREV_1,
5953         (void *)&zfs_modlfs,
5954         (void *)&zfs_modldrv,
5955         NULL
5956 };
5957 
5958 static void
5959 zfs_allow_log_destroy(void *arg)
5960 {
5961         char *poolname = arg;
5962         strfree(poolname);
5963 }
5964 
5965 int
5966 _init(void)
5967 {
5968         int error;
5969 
5970         spa_init(FREAD | FWRITE);
5971         zfs_init();
5972         zvol_init();
5973         zfs_ioctl_init();
5974 
5975         if ((error = mod_install(&modlinkage)) != 0) {
5976                 zvol_fini();
5977                 zfs_fini();
5978                 spa_fini();
5979                 return (error);
5980         }
5981 
5982         tsd_create(&zfs_fsyncer_key, NULL);
5983         tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
5984         tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
5985 
5986         error = ldi_ident_from_mod(&modlinkage, &zfs_li);
5987         ASSERT(error == 0);
5988         mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
5989 
5990         return (0);
5991 }
5992 
5993 int
5994 _fini(void)
5995 {
5996         int error;
5997 
5998         if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
5999                 return (EBUSY);
6000 
6001         if ((error = mod_remove(&modlinkage)) != 0)
6002                 return (error);
6003 
6004         zvol_fini();
6005         zfs_fini();
6006         spa_fini();
6007         if (zfs_nfsshare_inited)
6008                 (void) ddi_modclose(nfs_mod);
6009         if (zfs_smbshare_inited)
6010                 (void) ddi_modclose(smbsrv_mod);
6011         if (zfs_nfsshare_inited || zfs_smbshare_inited)
6012                 (void) ddi_modclose(sharefs_mod);
6013 
6014         tsd_destroy(&zfs_fsyncer_key);
6015         ldi_ident_release(zfs_li);
6016         zfs_li = NULL;
6017         mutex_destroy(&zfs_share_lock);
6018 
6019         return (error);
6020 }
6021 
6022 int
6023 _info(struct modinfo *modinfop)
6024 {
6025         return (mod_info(&modlinkage, modinfop));
6026 }