1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Portions Copyright 2011 Martin Matuska
  25  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  26  * Copyright (c) 2012, Joyent, Inc. All rights reserved.
  27  * Copyright (c) 2013 by Delphix. All rights reserved.
  28  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
  29  * Copyright (c) 2013 Steven Hartland. All rights reserved.
  30  */
  31 
  32 /*
  33  * ZFS ioctls.
  34  *
  35  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
  36  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
  37  *
  38  * There are two ways that we handle ioctls: the legacy way where almost
  39  * all of the logic is in the ioctl callback, and the new way where most
  40  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
  41  *
  42  * Non-legacy ioctls should be registered by calling
  43  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
  44  * from userland by lzc_ioctl().
  45  *
  46  * The registration arguments are as follows:
  47  *
  48  * const char *name
  49  *   The name of the ioctl.  This is used for history logging.  If the
  50  *   ioctl returns successfully (the callback returns 0), and allow_log
  51  *   is true, then a history log entry will be recorded with the input &
  52  *   output nvlists.  The log entry can be printed with "zpool history -i".
  53  *
  54  * zfs_ioc_t ioc
  55  *   The ioctl request number, which userland will pass to ioctl(2).
  56  *   The ioctl numbers can change from release to release, because
  57  *   the caller (libzfs) must be matched to the kernel.
  58  *
  59  * zfs_secpolicy_func_t *secpolicy
  60  *   This function will be called before the zfs_ioc_func_t, to
  61  *   determine if this operation is permitted.  It should return EPERM
  62  *   on failure, and 0 on success.  Checks include determining if the
  63  *   dataset is visible in this zone, and if the user has either all
  64  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
  65  *   to do this operation on this dataset with "zfs allow".
  66  *
  67  * zfs_ioc_namecheck_t namecheck
  68  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
  69  *   name, a dataset name, or nothing.  If the name is not well-formed,
  70  *   the ioctl will fail and the callback will not be called.
  71  *   Therefore, the callback can assume that the name is well-formed
  72  *   (e.g. is null-terminated, doesn't have more than one '@' character,
  73  *   doesn't have invalid characters).
  74  *
  75  * zfs_ioc_poolcheck_t pool_check
  76  *   This specifies requirements on the pool state.  If the pool does
  77  *   not meet them (is suspended or is readonly), the ioctl will fail
  78  *   and the callback will not be called.  If any checks are specified
  79  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
  80  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
  81  *   POOL_CHECK_READONLY).
  82  *
  83  * boolean_t smush_outnvlist
  84  *   If smush_outnvlist is true, then the output is presumed to be a
  85  *   list of errors, and it will be "smushed" down to fit into the
  86  *   caller's buffer, by removing some entries and replacing them with a
  87  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
  88  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
  89  *   outnvlist does not fit into the userland-provided buffer, then the
  90  *   ioctl will fail with ENOMEM.
  91  *
  92  * zfs_ioc_func_t *func
  93  *   The callback function that will perform the operation.
  94  *
  95  *   The callback should return 0 on success, or an error number on
  96  *   failure.  If the function fails, the userland ioctl will return -1,
  97  *   and errno will be set to the callback's return value.  The callback
  98  *   will be called with the following arguments:
  99  *
 100  *   const char *name
 101  *     The name of the pool or dataset to operate on, from
 102  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
 103  *     expected type (pool, dataset, or none).
 104  *
 105  *   nvlist_t *innvl
 106  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
 107  *     NULL if no input nvlist was provided.  Changes to this nvlist are
 108  *     ignored.  If the input nvlist could not be deserialized, the
 109  *     ioctl will fail and the callback will not be called.
 110  *
 111  *   nvlist_t *outnvl
 112  *     The output nvlist, initially empty.  The callback can fill it in,
 113  *     and it will be returned to userland by serializing it into
 114  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
 115  *     fails (e.g. because the caller didn't supply a large enough
 116  *     buffer), then the overall ioctl will fail.  See the
 117  *     'smush_nvlist' argument above for additional behaviors.
 118  *
 119  *     There are two typical uses of the output nvlist:
 120  *       - To return state, e.g. property values.  In this case,
 121  *         smush_outnvlist should be false.  If the buffer was not large
 122  *         enough, the caller will reallocate a larger buffer and try
 123  *         the ioctl again.
 124  *
 125  *       - To return multiple errors from an ioctl which makes on-disk
 126  *         changes.  In this case, smush_outnvlist should be true.
 127  *         Ioctls which make on-disk modifications should generally not
 128  *         use the outnvl if they succeed, because the caller can not
 129  *         distinguish between the operation failing, and
 130  *         deserialization failing.
 131  */
 132 
 133 #include <sys/types.h>
 134 #include <sys/param.h>
 135 #include <sys/errno.h>
 136 #include <sys/uio.h>
 137 #include <sys/buf.h>
 138 #include <sys/modctl.h>
 139 #include <sys/open.h>
 140 #include <sys/file.h>
 141 #include <sys/kmem.h>
 142 #include <sys/conf.h>
 143 #include <sys/cmn_err.h>
 144 #include <sys/stat.h>
 145 #include <sys/zfs_ioctl.h>
 146 #include <sys/zfs_vfsops.h>
 147 #include <sys/zfs_znode.h>
 148 #include <sys/zap.h>
 149 #include <sys/spa.h>
 150 #include <sys/spa_impl.h>
 151 #include <sys/vdev.h>
 152 #include <sys/priv_impl.h>
 153 #include <sys/dmu.h>
 154 #include <sys/dsl_dir.h>
 155 #include <sys/dsl_dataset.h>
 156 #include <sys/dsl_prop.h>
 157 #include <sys/dsl_deleg.h>
 158 #include <sys/dmu_objset.h>
 159 #include <sys/dmu_impl.h>
 160 #include <sys/dmu_tx.h>
 161 #include <sys/ddi.h>
 162 #include <sys/sunddi.h>
 163 #include <sys/sunldi.h>
 164 #include <sys/policy.h>
 165 #include <sys/zone.h>
 166 #include <sys/nvpair.h>
 167 #include <sys/pathname.h>
 168 #include <sys/mount.h>
 169 #include <sys/sdt.h>
 170 #include <sys/fs/zfs.h>
 171 #include <sys/zfs_ctldir.h>
 172 #include <sys/zfs_dir.h>
 173 #include <sys/zfs_onexit.h>
 174 #include <sys/zvol.h>
 175 #include <sys/dsl_scan.h>
 176 #include <sharefs/share.h>
 177 #include <sys/dmu_objset.h>
 178 #include <sys/dmu_send.h>
 179 #include <sys/dsl_destroy.h>
 180 #include <sys/dsl_userhold.h>
 181 #include <sys/zfeature.h>
 182 
 183 #include "zfs_namecheck.h"
 184 #include "zfs_prop.h"
 185 #include "zfs_deleg.h"
 186 #include "zfs_comutil.h"
 187 
 188 extern struct modlfs zfs_modlfs;
 189 
 190 extern void zfs_init(void);
 191 extern void zfs_fini(void);
 192 
 193 ldi_ident_t zfs_li = NULL;
 194 dev_info_t *zfs_dip;
 195 
 196 uint_t zfs_fsyncer_key;
 197 extern uint_t rrw_tsd_key;
 198 static uint_t zfs_allow_log_key;
 199 
 200 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
 201 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
 202 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
 203 
 204 typedef enum {
 205         NO_NAME,
 206         POOL_NAME,
 207         DATASET_NAME
 208 } zfs_ioc_namecheck_t;
 209 
 210 typedef enum {
 211         POOL_CHECK_NONE         = 1 << 0,
 212         POOL_CHECK_SUSPENDED    = 1 << 1,
 213         POOL_CHECK_READONLY     = 1 << 2,
 214 } zfs_ioc_poolcheck_t;
 215 
 216 typedef struct zfs_ioc_vec {
 217         zfs_ioc_legacy_func_t   *zvec_legacy_func;
 218         zfs_ioc_func_t          *zvec_func;
 219         zfs_secpolicy_func_t    *zvec_secpolicy;
 220         zfs_ioc_namecheck_t     zvec_namecheck;
 221         boolean_t               zvec_allow_log;
 222         zfs_ioc_poolcheck_t     zvec_pool_check;
 223         boolean_t               zvec_smush_outnvlist;
 224         const char              *zvec_name;
 225 } zfs_ioc_vec_t;
 226 
 227 /* This array is indexed by zfs_userquota_prop_t */
 228 static const char *userquota_perms[] = {
 229         ZFS_DELEG_PERM_USERUSED,
 230         ZFS_DELEG_PERM_USERQUOTA,
 231         ZFS_DELEG_PERM_GROUPUSED,
 232         ZFS_DELEG_PERM_GROUPQUOTA,
 233 };
 234 
 235 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
 236 static int zfs_check_settable(const char *name, nvpair_t *property,
 237     cred_t *cr);
 238 static int zfs_check_clearable(char *dataset, nvlist_t *props,
 239     nvlist_t **errors);
 240 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
 241     boolean_t *);
 242 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
 243 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
 244 
 245 static int zfs_prop_activate_feature(spa_t *spa, zfeature_info_t *feature);
 246 
 247 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
 248 void
 249 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
 250 {
 251         const char *newfile;
 252         char buf[512];
 253         va_list adx;
 254 
 255         /*
 256          * Get rid of annoying "../common/" prefix to filename.
 257          */
 258         newfile = strrchr(file, '/');
 259         if (newfile != NULL) {
 260                 newfile = newfile + 1; /* Get rid of leading / */
 261         } else {
 262                 newfile = file;
 263         }
 264 
 265         va_start(adx, fmt);
 266         (void) vsnprintf(buf, sizeof (buf), fmt, adx);
 267         va_end(adx);
 268 
 269         /*
 270          * To get this data, use the zfs-dprintf probe as so:
 271          * dtrace -q -n 'zfs-dprintf \
 272          *      /stringof(arg0) == "dbuf.c"/ \
 273          *      {printf("%s: %s", stringof(arg1), stringof(arg3))}'
 274          * arg0 = file name
 275          * arg1 = function name
 276          * arg2 = line number
 277          * arg3 = message
 278          */
 279         DTRACE_PROBE4(zfs__dprintf,
 280             char *, newfile, char *, func, int, line, char *, buf);
 281 }
 282 
 283 static void
 284 history_str_free(char *buf)
 285 {
 286         kmem_free(buf, HIS_MAX_RECORD_LEN);
 287 }
 288 
 289 static char *
 290 history_str_get(zfs_cmd_t *zc)
 291 {
 292         char *buf;
 293 
 294         if (zc->zc_history == NULL)
 295                 return (NULL);
 296 
 297         buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
 298         if (copyinstr((void *)(uintptr_t)zc->zc_history,
 299             buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
 300                 history_str_free(buf);
 301                 return (NULL);
 302         }
 303 
 304         buf[HIS_MAX_RECORD_LEN -1] = '\0';
 305 
 306         return (buf);
 307 }
 308 
 309 /*
 310  * Check to see if the named dataset is currently defined as bootable
 311  */
 312 static boolean_t
 313 zfs_is_bootfs(const char *name)
 314 {
 315         objset_t *os;
 316 
 317         if (dmu_objset_hold(name, FTAG, &os) == 0) {
 318                 boolean_t ret;
 319                 ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
 320                 dmu_objset_rele(os, FTAG);
 321                 return (ret);
 322         }
 323         return (B_FALSE);
 324 }
 325 
 326 /*
 327  * zfs_earlier_version
 328  *
 329  *      Return non-zero if the spa version is less than requested version.
 330  */
 331 static int
 332 zfs_earlier_version(const char *name, int version)
 333 {
 334         spa_t *spa;
 335 
 336         if (spa_open(name, &spa, FTAG) == 0) {
 337                 if (spa_version(spa) < version) {
 338                         spa_close(spa, FTAG);
 339                         return (1);
 340                 }
 341                 spa_close(spa, FTAG);
 342         }
 343         return (0);
 344 }
 345 
 346 /*
 347  * zpl_earlier_version
 348  *
 349  * Return TRUE if the ZPL version is less than requested version.
 350  */
 351 static boolean_t
 352 zpl_earlier_version(const char *name, int version)
 353 {
 354         objset_t *os;
 355         boolean_t rc = B_TRUE;
 356 
 357         if (dmu_objset_hold(name, FTAG, &os) == 0) {
 358                 uint64_t zplversion;
 359 
 360                 if (dmu_objset_type(os) != DMU_OST_ZFS) {
 361                         dmu_objset_rele(os, FTAG);
 362                         return (B_TRUE);
 363                 }
 364                 /* XXX reading from non-owned objset */
 365                 if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
 366                         rc = zplversion < version;
 367                 dmu_objset_rele(os, FTAG);
 368         }
 369         return (rc);
 370 }
 371 
 372 static void
 373 zfs_log_history(zfs_cmd_t *zc)
 374 {
 375         spa_t *spa;
 376         char *buf;
 377 
 378         if ((buf = history_str_get(zc)) == NULL)
 379                 return;
 380 
 381         if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
 382                 if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
 383                         (void) spa_history_log(spa, buf);
 384                 spa_close(spa, FTAG);
 385         }
 386         history_str_free(buf);
 387 }
 388 
 389 /*
 390  * Policy for top-level read operations (list pools).  Requires no privileges,
 391  * and can be used in the local zone, as there is no associated dataset.
 392  */
 393 /* ARGSUSED */
 394 static int
 395 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 396 {
 397         return (0);
 398 }
 399 
 400 /*
 401  * Policy for dataset read operations (list children, get statistics).  Requires
 402  * no privileges, but must be visible in the local zone.
 403  */
 404 /* ARGSUSED */
 405 static int
 406 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 407 {
 408         if (INGLOBALZONE(curproc) ||
 409             zone_dataset_visible(zc->zc_name, NULL))
 410                 return (0);
 411 
 412         return (SET_ERROR(ENOENT));
 413 }
 414 
 415 static int
 416 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
 417 {
 418         int writable = 1;
 419 
 420         /*
 421          * The dataset must be visible by this zone -- check this first
 422          * so they don't see EPERM on something they shouldn't know about.
 423          */
 424         if (!INGLOBALZONE(curproc) &&
 425             !zone_dataset_visible(dataset, &writable))
 426                 return (SET_ERROR(ENOENT));
 427 
 428         if (INGLOBALZONE(curproc)) {
 429                 /*
 430                  * If the fs is zoned, only root can access it from the
 431                  * global zone.
 432                  */
 433                 if (secpolicy_zfs(cr) && zoned)
 434                         return (SET_ERROR(EPERM));
 435         } else {
 436                 /*
 437                  * If we are in a local zone, the 'zoned' property must be set.
 438                  */
 439                 if (!zoned)
 440                         return (SET_ERROR(EPERM));
 441 
 442                 /* must be writable by this zone */
 443                 if (!writable)
 444                         return (SET_ERROR(EPERM));
 445         }
 446         return (0);
 447 }
 448 
 449 static int
 450 zfs_dozonecheck(const char *dataset, cred_t *cr)
 451 {
 452         uint64_t zoned;
 453 
 454         if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
 455                 return (SET_ERROR(ENOENT));
 456 
 457         return (zfs_dozonecheck_impl(dataset, zoned, cr));
 458 }
 459 
 460 static int
 461 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
 462 {
 463         uint64_t zoned;
 464 
 465         if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
 466                 return (SET_ERROR(ENOENT));
 467 
 468         return (zfs_dozonecheck_impl(dataset, zoned, cr));
 469 }
 470 
 471 static int
 472 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
 473     const char *perm, cred_t *cr)
 474 {
 475         int error;
 476 
 477         error = zfs_dozonecheck_ds(name, ds, cr);
 478         if (error == 0) {
 479                 error = secpolicy_zfs(cr);
 480                 if (error != 0)
 481                         error = dsl_deleg_access_impl(ds, perm, cr);
 482         }
 483         return (error);
 484 }
 485 
 486 static int
 487 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
 488 {
 489         int error;
 490         dsl_dataset_t *ds;
 491         dsl_pool_t *dp;
 492 
 493         error = dsl_pool_hold(name, FTAG, &dp);
 494         if (error != 0)
 495                 return (error);
 496 
 497         error = dsl_dataset_hold(dp, name, FTAG, &ds);
 498         if (error != 0) {
 499                 dsl_pool_rele(dp, FTAG);
 500                 return (error);
 501         }
 502 
 503         error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
 504 
 505         dsl_dataset_rele(ds, FTAG);
 506         dsl_pool_rele(dp, FTAG);
 507         return (error);
 508 }
 509 
 510 /*
 511  * Policy for setting the security label property.
 512  *
 513  * Returns 0 for success, non-zero for access and other errors.
 514  */
 515 static int
 516 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
 517 {
 518         char            ds_hexsl[MAXNAMELEN];
 519         bslabel_t       ds_sl, new_sl;
 520         boolean_t       new_default = FALSE;
 521         uint64_t        zoned;
 522         int             needed_priv = -1;
 523         int             error;
 524 
 525         /* First get the existing dataset label. */
 526         error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
 527             1, sizeof (ds_hexsl), &ds_hexsl, NULL);
 528         if (error != 0)
 529                 return (SET_ERROR(EPERM));
 530 
 531         if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
 532                 new_default = TRUE;
 533 
 534         /* The label must be translatable */
 535         if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
 536                 return (SET_ERROR(EINVAL));
 537 
 538         /*
 539          * In a non-global zone, disallow attempts to set a label that
 540          * doesn't match that of the zone; otherwise no other checks
 541          * are needed.
 542          */
 543         if (!INGLOBALZONE(curproc)) {
 544                 if (new_default || !blequal(&new_sl, CR_SL(CRED())))
 545                         return (SET_ERROR(EPERM));
 546                 return (0);
 547         }
 548 
 549         /*
 550          * For global-zone datasets (i.e., those whose zoned property is
 551          * "off", verify that the specified new label is valid for the
 552          * global zone.
 553          */
 554         if (dsl_prop_get_integer(name,
 555             zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
 556                 return (SET_ERROR(EPERM));
 557         if (!zoned) {
 558                 if (zfs_check_global_label(name, strval) != 0)
 559                         return (SET_ERROR(EPERM));
 560         }
 561 
 562         /*
 563          * If the existing dataset label is nondefault, check if the
 564          * dataset is mounted (label cannot be changed while mounted).
 565          * Get the zfsvfs; if there isn't one, then the dataset isn't
 566          * mounted (or isn't a dataset, doesn't exist, ...).
 567          */
 568         if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
 569                 objset_t *os;
 570                 static char *setsl_tag = "setsl_tag";
 571 
 572                 /*
 573                  * Try to own the dataset; abort if there is any error,
 574                  * (e.g., already mounted, in use, or other error).
 575                  */
 576                 error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
 577                     setsl_tag, &os);
 578                 if (error != 0)
 579                         return (SET_ERROR(EPERM));
 580 
 581                 dmu_objset_disown(os, setsl_tag);
 582 
 583                 if (new_default) {
 584                         needed_priv = PRIV_FILE_DOWNGRADE_SL;
 585                         goto out_check;
 586                 }
 587 
 588                 if (hexstr_to_label(strval, &new_sl) != 0)
 589                         return (SET_ERROR(EPERM));
 590 
 591                 if (blstrictdom(&ds_sl, &new_sl))
 592                         needed_priv = PRIV_FILE_DOWNGRADE_SL;
 593                 else if (blstrictdom(&new_sl, &ds_sl))
 594                         needed_priv = PRIV_FILE_UPGRADE_SL;
 595         } else {
 596                 /* dataset currently has a default label */
 597                 if (!new_default)
 598                         needed_priv = PRIV_FILE_UPGRADE_SL;
 599         }
 600 
 601 out_check:
 602         if (needed_priv != -1)
 603                 return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
 604         return (0);
 605 }
 606 
 607 static int
 608 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
 609     cred_t *cr)
 610 {
 611         char *strval;
 612 
 613         /*
 614          * Check permissions for special properties.
 615          */
 616         switch (prop) {
 617         case ZFS_PROP_ZONED:
 618                 /*
 619                  * Disallow setting of 'zoned' from within a local zone.
 620                  */
 621                 if (!INGLOBALZONE(curproc))
 622                         return (SET_ERROR(EPERM));
 623                 break;
 624 
 625         case ZFS_PROP_QUOTA:
 626                 if (!INGLOBALZONE(curproc)) {
 627                         uint64_t zoned;
 628                         char setpoint[MAXNAMELEN];
 629                         /*
 630                          * Unprivileged users are allowed to modify the
 631                          * quota on things *under* (ie. contained by)
 632                          * the thing they own.
 633                          */
 634                         if (dsl_prop_get_integer(dsname, "zoned", &zoned,
 635                             setpoint))
 636                                 return (SET_ERROR(EPERM));
 637                         if (!zoned || strlen(dsname) <= strlen(setpoint))
 638                                 return (SET_ERROR(EPERM));
 639                 }
 640                 break;
 641 
 642         case ZFS_PROP_MLSLABEL:
 643                 if (!is_system_labeled())
 644                         return (SET_ERROR(EPERM));
 645 
 646                 if (nvpair_value_string(propval, &strval) == 0) {
 647                         int err;
 648 
 649                         err = zfs_set_slabel_policy(dsname, strval, CRED());
 650                         if (err != 0)
 651                                 return (err);
 652                 }
 653                 break;
 654         }
 655 
 656         return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
 657 }
 658 
 659 /* ARGSUSED */
 660 static int
 661 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 662 {
 663         int error;
 664 
 665         error = zfs_dozonecheck(zc->zc_name, cr);
 666         if (error != 0)
 667                 return (error);
 668 
 669         /*
 670          * permission to set permissions will be evaluated later in
 671          * dsl_deleg_can_allow()
 672          */
 673         return (0);
 674 }
 675 
 676 /* ARGSUSED */
 677 static int
 678 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 679 {
 680         return (zfs_secpolicy_write_perms(zc->zc_name,
 681             ZFS_DELEG_PERM_ROLLBACK, cr));
 682 }
 683 
 684 /* ARGSUSED */
 685 static int
 686 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 687 {
 688         dsl_pool_t *dp;
 689         dsl_dataset_t *ds;
 690         char *cp;
 691         int error;
 692 
 693         /*
 694          * Generate the current snapshot name from the given objsetid, then
 695          * use that name for the secpolicy/zone checks.
 696          */
 697         cp = strchr(zc->zc_name, '@');
 698         if (cp == NULL)
 699                 return (SET_ERROR(EINVAL));
 700         error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
 701         if (error != 0)
 702                 return (error);
 703 
 704         error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
 705         if (error != 0) {
 706                 dsl_pool_rele(dp, FTAG);
 707                 return (error);
 708         }
 709 
 710         dsl_dataset_name(ds, zc->zc_name);
 711 
 712         error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
 713             ZFS_DELEG_PERM_SEND, cr);
 714         dsl_dataset_rele(ds, FTAG);
 715         dsl_pool_rele(dp, FTAG);
 716 
 717         return (error);
 718 }
 719 
 720 /* ARGSUSED */
 721 static int
 722 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 723 {
 724         return (zfs_secpolicy_write_perms(zc->zc_name,
 725             ZFS_DELEG_PERM_SEND, cr));
 726 }
 727 
 728 /* ARGSUSED */
 729 static int
 730 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 731 {
 732         vnode_t *vp;
 733         int error;
 734 
 735         if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
 736             NO_FOLLOW, NULL, &vp)) != 0)
 737                 return (error);
 738 
 739         /* Now make sure mntpnt and dataset are ZFS */
 740 
 741         if (vp->v_vfsp->vfs_fstype != zfsfstype ||
 742             (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
 743             zc->zc_name) != 0)) {
 744                 VN_RELE(vp);
 745                 return (SET_ERROR(EPERM));
 746         }
 747 
 748         VN_RELE(vp);
 749         return (dsl_deleg_access(zc->zc_name,
 750             ZFS_DELEG_PERM_SHARE, cr));
 751 }
 752 
 753 int
 754 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 755 {
 756         if (!INGLOBALZONE(curproc))
 757                 return (SET_ERROR(EPERM));
 758 
 759         if (secpolicy_nfs(cr) == 0) {
 760                 return (0);
 761         } else {
 762                 return (zfs_secpolicy_deleg_share(zc, innvl, cr));
 763         }
 764 }
 765 
 766 int
 767 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 768 {
 769         if (!INGLOBALZONE(curproc))
 770                 return (SET_ERROR(EPERM));
 771 
 772         if (secpolicy_smb(cr) == 0) {
 773                 return (0);
 774         } else {
 775                 return (zfs_secpolicy_deleg_share(zc, innvl, cr));
 776         }
 777 }
 778 
 779 static int
 780 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
 781 {
 782         char *cp;
 783 
 784         /*
 785          * Remove the @bla or /bla from the end of the name to get the parent.
 786          */
 787         (void) strncpy(parent, datasetname, parentsize);
 788         cp = strrchr(parent, '@');
 789         if (cp != NULL) {
 790                 cp[0] = '\0';
 791         } else {
 792                 cp = strrchr(parent, '/');
 793                 if (cp == NULL)
 794                         return (SET_ERROR(ENOENT));
 795                 cp[0] = '\0';
 796         }
 797 
 798         return (0);
 799 }
 800 
 801 int
 802 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
 803 {
 804         int error;
 805 
 806         if ((error = zfs_secpolicy_write_perms(name,
 807             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 808                 return (error);
 809 
 810         return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
 811 }
 812 
 813 /* ARGSUSED */
 814 static int
 815 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 816 {
 817         return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
 818 }
 819 
 820 /*
 821  * Destroying snapshots with delegated permissions requires
 822  * descendant mount and destroy permissions.
 823  */
 824 /* ARGSUSED */
 825 static int
 826 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 827 {
 828         nvlist_t *snaps;
 829         nvpair_t *pair, *nextpair;
 830         int error = 0;
 831 
 832         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
 833                 return (SET_ERROR(EINVAL));
 834         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
 835             pair = nextpair) {
 836                 dsl_pool_t *dp;
 837                 dsl_dataset_t *ds;
 838 
 839                 error = dsl_pool_hold(nvpair_name(pair), FTAG, &dp);
 840                 if (error != 0)
 841                         break;
 842                 nextpair = nvlist_next_nvpair(snaps, pair);
 843                 error = dsl_dataset_hold(dp, nvpair_name(pair), FTAG, &ds);
 844                 if (error == 0)
 845                         dsl_dataset_rele(ds, FTAG);
 846                 dsl_pool_rele(dp, FTAG);
 847 
 848                 if (error == 0) {
 849                         error = zfs_secpolicy_destroy_perms(nvpair_name(pair),
 850                             cr);
 851                 } else if (error == ENOENT) {
 852                         /*
 853                          * Ignore any snapshots that don't exist (we consider
 854                          * them "already destroyed").  Remove the name from the
 855                          * nvl here in case the snapshot is created between
 856                          * now and when we try to destroy it (in which case
 857                          * we don't want to destroy it since we haven't
 858                          * checked for permission).
 859                          */
 860                         fnvlist_remove_nvpair(snaps, pair);
 861                         error = 0;
 862                 }
 863                 if (error != 0)
 864                         break;
 865         }
 866 
 867         return (error);
 868 }
 869 
 870 int
 871 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
 872 {
 873         char    parentname[MAXNAMELEN];
 874         int     error;
 875 
 876         if ((error = zfs_secpolicy_write_perms(from,
 877             ZFS_DELEG_PERM_RENAME, cr)) != 0)
 878                 return (error);
 879 
 880         if ((error = zfs_secpolicy_write_perms(from,
 881             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 882                 return (error);
 883 
 884         if ((error = zfs_get_parent(to, parentname,
 885             sizeof (parentname))) != 0)
 886                 return (error);
 887 
 888         if ((error = zfs_secpolicy_write_perms(parentname,
 889             ZFS_DELEG_PERM_CREATE, cr)) != 0)
 890                 return (error);
 891 
 892         if ((error = zfs_secpolicy_write_perms(parentname,
 893             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 894                 return (error);
 895 
 896         return (error);
 897 }
 898 
 899 /* ARGSUSED */
 900 static int
 901 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 902 {
 903         return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
 904 }
 905 
 906 /* ARGSUSED */
 907 static int
 908 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 909 {
 910         dsl_pool_t *dp;
 911         dsl_dataset_t *clone;
 912         int error;
 913 
 914         error = zfs_secpolicy_write_perms(zc->zc_name,
 915             ZFS_DELEG_PERM_PROMOTE, cr);
 916         if (error != 0)
 917                 return (error);
 918 
 919         error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
 920         if (error != 0)
 921                 return (error);
 922 
 923         error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
 924 
 925         if (error == 0) {
 926                 char parentname[MAXNAMELEN];
 927                 dsl_dataset_t *origin = NULL;
 928                 dsl_dir_t *dd;
 929                 dd = clone->ds_dir;
 930 
 931                 error = dsl_dataset_hold_obj(dd->dd_pool,
 932                     dd->dd_phys->dd_origin_obj, FTAG, &origin);
 933                 if (error != 0) {
 934                         dsl_dataset_rele(clone, FTAG);
 935                         dsl_pool_rele(dp, FTAG);
 936                         return (error);
 937                 }
 938 
 939                 error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
 940                     ZFS_DELEG_PERM_MOUNT, cr);
 941 
 942                 dsl_dataset_name(origin, parentname);
 943                 if (error == 0) {
 944                         error = zfs_secpolicy_write_perms_ds(parentname, origin,
 945                             ZFS_DELEG_PERM_PROMOTE, cr);
 946                 }
 947                 dsl_dataset_rele(clone, FTAG);
 948                 dsl_dataset_rele(origin, FTAG);
 949         }
 950         dsl_pool_rele(dp, FTAG);
 951         return (error);
 952 }
 953 
 954 /* ARGSUSED */
 955 static int
 956 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 957 {
 958         int error;
 959 
 960         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
 961             ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
 962                 return (error);
 963 
 964         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
 965             ZFS_DELEG_PERM_MOUNT, cr)) != 0)
 966                 return (error);
 967 
 968         return (zfs_secpolicy_write_perms(zc->zc_name,
 969             ZFS_DELEG_PERM_CREATE, cr));
 970 }
 971 
 972 int
 973 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
 974 {
 975         return (zfs_secpolicy_write_perms(name,
 976             ZFS_DELEG_PERM_SNAPSHOT, cr));
 977 }
 978 
 979 /*
 980  * Check for permission to create each snapshot in the nvlist.
 981  */
 982 /* ARGSUSED */
 983 static int
 984 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 985 {
 986         nvlist_t *snaps;
 987         int error = 0;
 988         nvpair_t *pair;
 989 
 990         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
 991                 return (SET_ERROR(EINVAL));
 992         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
 993             pair = nvlist_next_nvpair(snaps, pair)) {
 994                 char *name = nvpair_name(pair);
 995                 char *atp = strchr(name, '@');
 996 
 997                 if (atp == NULL) {
 998                         error = SET_ERROR(EINVAL);
 999                         break;
1000                 }
1001                 *atp = '\0';
1002                 error = zfs_secpolicy_snapshot_perms(name, cr);
1003                 *atp = '@';
1004                 if (error != 0)
1005                         break;
1006         }
1007         return (error);
1008 }
1009 
1010 /* ARGSUSED */
1011 static int
1012 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1013 {
1014         /*
1015          * Even root must have a proper TSD so that we know what pool
1016          * to log to.
1017          */
1018         if (tsd_get(zfs_allow_log_key) == NULL)
1019                 return (SET_ERROR(EPERM));
1020         return (0);
1021 }
1022 
1023 static int
1024 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1025 {
1026         char    parentname[MAXNAMELEN];
1027         int     error;
1028         char    *origin;
1029 
1030         if ((error = zfs_get_parent(zc->zc_name, parentname,
1031             sizeof (parentname))) != 0)
1032                 return (error);
1033 
1034         if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1035             (error = zfs_secpolicy_write_perms(origin,
1036             ZFS_DELEG_PERM_CLONE, cr)) != 0)
1037                 return (error);
1038 
1039         if ((error = zfs_secpolicy_write_perms(parentname,
1040             ZFS_DELEG_PERM_CREATE, cr)) != 0)
1041                 return (error);
1042 
1043         return (zfs_secpolicy_write_perms(parentname,
1044             ZFS_DELEG_PERM_MOUNT, cr));
1045 }
1046 
1047 /*
1048  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1049  * SYS_CONFIG privilege, which is not available in a local zone.
1050  */
1051 /* ARGSUSED */
1052 static int
1053 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1054 {
1055         if (secpolicy_sys_config(cr, B_FALSE) != 0)
1056                 return (SET_ERROR(EPERM));
1057 
1058         return (0);
1059 }
1060 
1061 /*
1062  * Policy for object to name lookups.
1063  */
1064 /* ARGSUSED */
1065 static int
1066 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1067 {
1068         int error;
1069 
1070         if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1071                 return (0);
1072 
1073         error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1074         return (error);
1075 }
1076 
1077 /*
1078  * Policy for fault injection.  Requires all privileges.
1079  */
1080 /* ARGSUSED */
1081 static int
1082 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1083 {
1084         return (secpolicy_zinject(cr));
1085 }
1086 
1087 /* ARGSUSED */
1088 static int
1089 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1090 {
1091         zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1092 
1093         if (prop == ZPROP_INVAL) {
1094                 if (!zfs_prop_user(zc->zc_value))
1095                         return (SET_ERROR(EINVAL));
1096                 return (zfs_secpolicy_write_perms(zc->zc_name,
1097                     ZFS_DELEG_PERM_USERPROP, cr));
1098         } else {
1099                 return (zfs_secpolicy_setprop(zc->zc_name, prop,
1100                     NULL, cr));
1101         }
1102 }
1103 
1104 static int
1105 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1106 {
1107         int err = zfs_secpolicy_read(zc, innvl, cr);
1108         if (err)
1109                 return (err);
1110 
1111         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1112                 return (SET_ERROR(EINVAL));
1113 
1114         if (zc->zc_value[0] == 0) {
1115                 /*
1116                  * They are asking about a posix uid/gid.  If it's
1117                  * themself, allow it.
1118                  */
1119                 if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1120                     zc->zc_objset_type == ZFS_PROP_USERQUOTA) {
1121                         if (zc->zc_guid == crgetuid(cr))
1122                                 return (0);
1123                 } else {
1124                         if (groupmember(zc->zc_guid, cr))
1125                                 return (0);
1126                 }
1127         }
1128 
1129         return (zfs_secpolicy_write_perms(zc->zc_name,
1130             userquota_perms[zc->zc_objset_type], cr));
1131 }
1132 
1133 static int
1134 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1135 {
1136         int err = zfs_secpolicy_read(zc, innvl, cr);
1137         if (err)
1138                 return (err);
1139 
1140         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1141                 return (SET_ERROR(EINVAL));
1142 
1143         return (zfs_secpolicy_write_perms(zc->zc_name,
1144             userquota_perms[zc->zc_objset_type], cr));
1145 }
1146 
1147 /* ARGSUSED */
1148 static int
1149 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1150 {
1151         return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1152             NULL, cr));
1153 }
1154 
1155 /* ARGSUSED */
1156 static int
1157 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1158 {
1159         nvpair_t *pair;
1160         nvlist_t *holds;
1161         int error;
1162 
1163         error = nvlist_lookup_nvlist(innvl, "holds", &holds);
1164         if (error != 0)
1165                 return (SET_ERROR(EINVAL));
1166 
1167         for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1168             pair = nvlist_next_nvpair(holds, pair)) {
1169                 char fsname[MAXNAMELEN];
1170                 error = dmu_fsname(nvpair_name(pair), fsname);
1171                 if (error != 0)
1172                         return (error);
1173                 error = zfs_secpolicy_write_perms(fsname,
1174                     ZFS_DELEG_PERM_HOLD, cr);
1175                 if (error != 0)
1176                         return (error);
1177         }
1178         return (0);
1179 }
1180 
1181 /* ARGSUSED */
1182 static int
1183 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1184 {
1185         nvpair_t *pair;
1186         int error;
1187 
1188         for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1189             pair = nvlist_next_nvpair(innvl, pair)) {
1190                 char fsname[MAXNAMELEN];
1191                 error = dmu_fsname(nvpair_name(pair), fsname);
1192                 if (error != 0)
1193                         return (error);
1194                 error = zfs_secpolicy_write_perms(fsname,
1195                     ZFS_DELEG_PERM_RELEASE, cr);
1196                 if (error != 0)
1197                         return (error);
1198         }
1199         return (0);
1200 }
1201 
1202 /*
1203  * Policy for allowing temporary snapshots to be taken or released
1204  */
1205 static int
1206 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1207 {
1208         /*
1209          * A temporary snapshot is the same as a snapshot,
1210          * hold, destroy and release all rolled into one.
1211          * Delegated diff alone is sufficient that we allow this.
1212          */
1213         int error;
1214 
1215         if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1216             ZFS_DELEG_PERM_DIFF, cr)) == 0)
1217                 return (0);
1218 
1219         error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1220         if (error == 0)
1221                 error = zfs_secpolicy_hold(zc, innvl, cr);
1222         if (error == 0)
1223                 error = zfs_secpolicy_release(zc, innvl, cr);
1224         if (error == 0)
1225                 error = zfs_secpolicy_destroy(zc, innvl, cr);
1226         return (error);
1227 }
1228 
1229 /*
1230  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1231  */
1232 static int
1233 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1234 {
1235         char *packed;
1236         int error;
1237         nvlist_t *list = NULL;
1238 
1239         /*
1240          * Read in and unpack the user-supplied nvlist.
1241          */
1242         if (size == 0)
1243                 return (SET_ERROR(EINVAL));
1244 
1245         packed = kmem_alloc(size, KM_SLEEP);
1246 
1247         if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1248             iflag)) != 0) {
1249                 kmem_free(packed, size);
1250                 return (error);
1251         }
1252 
1253         if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1254                 kmem_free(packed, size);
1255                 return (error);
1256         }
1257 
1258         kmem_free(packed, size);
1259 
1260         *nvp = list;
1261         return (0);
1262 }
1263 
1264 /*
1265  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1266  * Entries will be removed from the end of the nvlist, and one int32 entry
1267  * named "N_MORE_ERRORS" will be added indicating how many entries were
1268  * removed.
1269  */
1270 static int
1271 nvlist_smush(nvlist_t *errors, size_t max)
1272 {
1273         size_t size;
1274 
1275         size = fnvlist_size(errors);
1276 
1277         if (size > max) {
1278                 nvpair_t *more_errors;
1279                 int n = 0;
1280 
1281                 if (max < 1024)
1282                         return (SET_ERROR(ENOMEM));
1283 
1284                 fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1285                 more_errors = nvlist_prev_nvpair(errors, NULL);
1286 
1287                 do {
1288                         nvpair_t *pair = nvlist_prev_nvpair(errors,
1289                             more_errors);
1290                         fnvlist_remove_nvpair(errors, pair);
1291                         n++;
1292                         size = fnvlist_size(errors);
1293                 } while (size > max);
1294 
1295                 fnvlist_remove_nvpair(errors, more_errors);
1296                 fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1297                 ASSERT3U(fnvlist_size(errors), <=, max);
1298         }
1299 
1300         return (0);
1301 }
1302 
1303 static int
1304 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1305 {
1306         char *packed = NULL;
1307         int error = 0;
1308         size_t size;
1309 
1310         size = fnvlist_size(nvl);
1311 
1312         if (size > zc->zc_nvlist_dst_size) {
1313                 error = SET_ERROR(ENOMEM);
1314         } else {
1315                 packed = fnvlist_pack(nvl, &size);
1316                 if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1317                     size, zc->zc_iflags) != 0)
1318                         error = SET_ERROR(EFAULT);
1319                 fnvlist_pack_free(packed, size);
1320         }
1321 
1322         zc->zc_nvlist_dst_size = size;
1323         zc->zc_nvlist_dst_filled = B_TRUE;
1324         return (error);
1325 }
1326 
1327 static int
1328 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1329 {
1330         objset_t *os;
1331         int error;
1332 
1333         error = dmu_objset_hold(dsname, FTAG, &os);
1334         if (error != 0)
1335                 return (error);
1336         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1337                 dmu_objset_rele(os, FTAG);
1338                 return (SET_ERROR(EINVAL));
1339         }
1340 
1341         mutex_enter(&os->os_user_ptr_lock);
1342         *zfvp = dmu_objset_get_user(os);
1343         if (*zfvp) {
1344                 VFS_HOLD((*zfvp)->z_vfs);
1345         } else {
1346                 error = SET_ERROR(ESRCH);
1347         }
1348         mutex_exit(&os->os_user_ptr_lock);
1349         dmu_objset_rele(os, FTAG);
1350         return (error);
1351 }
1352 
1353 /*
1354  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1355  * case its z_vfs will be NULL, and it will be opened as the owner.
1356  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1357  * which prevents all vnode ops from running.
1358  */
1359 static int
1360 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1361 {
1362         int error = 0;
1363 
1364         if (getzfsvfs(name, zfvp) != 0)
1365                 error = zfsvfs_create(name, zfvp);
1366         if (error == 0) {
1367                 rrw_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1368                     RW_READER, tag);
1369                 if ((*zfvp)->z_unmounted) {
1370                         /*
1371                          * XXX we could probably try again, since the unmounting
1372                          * thread should be just about to disassociate the
1373                          * objset from the zfsvfs.
1374                          */
1375                         rrw_exit(&(*zfvp)->z_teardown_lock, tag);
1376                         return (SET_ERROR(EBUSY));
1377                 }
1378         }
1379         return (error);
1380 }
1381 
1382 static void
1383 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1384 {
1385         rrw_exit(&zfsvfs->z_teardown_lock, tag);
1386 
1387         if (zfsvfs->z_vfs) {
1388                 VFS_RELE(zfsvfs->z_vfs);
1389         } else {
1390                 dmu_objset_disown(zfsvfs->z_os, zfsvfs);
1391                 zfsvfs_free(zfsvfs);
1392         }
1393 }
1394 
1395 static int
1396 zfs_ioc_pool_create(zfs_cmd_t *zc)
1397 {
1398         int error;
1399         nvlist_t *config, *props = NULL;
1400         nvlist_t *rootprops = NULL;
1401         nvlist_t *zplprops = NULL;
1402 
1403         if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1404             zc->zc_iflags, &config))
1405                 return (error);
1406 
1407         if (zc->zc_nvlist_src_size != 0 && (error =
1408             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1409             zc->zc_iflags, &props))) {
1410                 nvlist_free(config);
1411                 return (error);
1412         }
1413 
1414         if (props) {
1415                 nvlist_t *nvl = NULL;
1416                 uint64_t version = SPA_VERSION;
1417 
1418                 (void) nvlist_lookup_uint64(props,
1419                     zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1420                 if (!SPA_VERSION_IS_SUPPORTED(version)) {
1421                         error = SET_ERROR(EINVAL);
1422                         goto pool_props_bad;
1423                 }
1424                 (void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1425                 if (nvl) {
1426                         error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1427                         if (error != 0) {
1428                                 nvlist_free(config);
1429                                 nvlist_free(props);
1430                                 return (error);
1431                         }
1432                         (void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1433                 }
1434                 VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1435                 error = zfs_fill_zplprops_root(version, rootprops,
1436                     zplprops, NULL);
1437                 if (error != 0)
1438                         goto pool_props_bad;
1439         }
1440 
1441         error = spa_create(zc->zc_name, config, props, zplprops);
1442 
1443         /*
1444          * Set the remaining root properties
1445          */
1446         if (!error && (error = zfs_set_prop_nvlist(zc->zc_name,
1447             ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1448                 (void) spa_destroy(zc->zc_name);
1449 
1450 pool_props_bad:
1451         nvlist_free(rootprops);
1452         nvlist_free(zplprops);
1453         nvlist_free(config);
1454         nvlist_free(props);
1455 
1456         return (error);
1457 }
1458 
1459 static int
1460 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1461 {
1462         int error;
1463         zfs_log_history(zc);
1464         error = spa_destroy(zc->zc_name);
1465         if (error == 0)
1466                 zvol_remove_minors(zc->zc_name);
1467         return (error);
1468 }
1469 
1470 static int
1471 zfs_ioc_pool_import(zfs_cmd_t *zc)
1472 {
1473         nvlist_t *config, *props = NULL;
1474         uint64_t guid;
1475         int error;
1476 
1477         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1478             zc->zc_iflags, &config)) != 0)
1479                 return (error);
1480 
1481         if (zc->zc_nvlist_src_size != 0 && (error =
1482             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1483             zc->zc_iflags, &props))) {
1484                 nvlist_free(config);
1485                 return (error);
1486         }
1487 
1488         if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1489             guid != zc->zc_guid)
1490                 error = SET_ERROR(EINVAL);
1491         else
1492                 error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1493 
1494         if (zc->zc_nvlist_dst != 0) {
1495                 int err;
1496 
1497                 if ((err = put_nvlist(zc, config)) != 0)
1498                         error = err;
1499         }
1500 
1501         nvlist_free(config);
1502 
1503         if (props)
1504                 nvlist_free(props);
1505 
1506         return (error);
1507 }
1508 
1509 static int
1510 zfs_ioc_pool_export(zfs_cmd_t *zc)
1511 {
1512         int error;
1513         boolean_t force = (boolean_t)zc->zc_cookie;
1514         boolean_t hardforce = (boolean_t)zc->zc_guid;
1515 
1516         zfs_log_history(zc);
1517         error = spa_export(zc->zc_name, NULL, force, hardforce);
1518         if (error == 0)
1519                 zvol_remove_minors(zc->zc_name);
1520         return (error);
1521 }
1522 
1523 static int
1524 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1525 {
1526         nvlist_t *configs;
1527         int error;
1528 
1529         if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1530                 return (SET_ERROR(EEXIST));
1531 
1532         error = put_nvlist(zc, configs);
1533 
1534         nvlist_free(configs);
1535 
1536         return (error);
1537 }
1538 
1539 /*
1540  * inputs:
1541  * zc_name              name of the pool
1542  *
1543  * outputs:
1544  * zc_cookie            real errno
1545  * zc_nvlist_dst        config nvlist
1546  * zc_nvlist_dst_size   size of config nvlist
1547  */
1548 static int
1549 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1550 {
1551         nvlist_t *config;
1552         int error;
1553         int ret = 0;
1554 
1555         error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1556             sizeof (zc->zc_value));
1557 
1558         if (config != NULL) {
1559                 ret = put_nvlist(zc, config);
1560                 nvlist_free(config);
1561 
1562                 /*
1563                  * The config may be present even if 'error' is non-zero.
1564                  * In this case we return success, and preserve the real errno
1565                  * in 'zc_cookie'.
1566                  */
1567                 zc->zc_cookie = error;
1568         } else {
1569                 ret = error;
1570         }
1571 
1572         return (ret);
1573 }
1574 
1575 /*
1576  * Try to import the given pool, returning pool stats as appropriate so that
1577  * user land knows which devices are available and overall pool health.
1578  */
1579 static int
1580 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1581 {
1582         nvlist_t *tryconfig, *config;
1583         int error;
1584 
1585         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1586             zc->zc_iflags, &tryconfig)) != 0)
1587                 return (error);
1588 
1589         config = spa_tryimport(tryconfig);
1590 
1591         nvlist_free(tryconfig);
1592 
1593         if (config == NULL)
1594                 return (SET_ERROR(EINVAL));
1595 
1596         error = put_nvlist(zc, config);
1597         nvlist_free(config);
1598 
1599         return (error);
1600 }
1601 
1602 /*
1603  * inputs:
1604  * zc_name              name of the pool
1605  * zc_cookie            scan func (pool_scan_func_t)
1606  */
1607 static int
1608 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1609 {
1610         spa_t *spa;
1611         int error;
1612 
1613         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1614                 return (error);
1615 
1616         if (zc->zc_cookie == POOL_SCAN_NONE)
1617                 error = spa_scan_stop(spa);
1618         else
1619                 error = spa_scan(spa, zc->zc_cookie);
1620 
1621         spa_close(spa, FTAG);
1622 
1623         return (error);
1624 }
1625 
1626 static int
1627 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1628 {
1629         spa_t *spa;
1630         int error;
1631 
1632         error = spa_open(zc->zc_name, &spa, FTAG);
1633         if (error == 0) {
1634                 spa_freeze(spa);
1635                 spa_close(spa, FTAG);
1636         }
1637         return (error);
1638 }
1639 
1640 static int
1641 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1642 {
1643         spa_t *spa;
1644         int error;
1645 
1646         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1647                 return (error);
1648 
1649         if (zc->zc_cookie < spa_version(spa) ||
1650             !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1651                 spa_close(spa, FTAG);
1652                 return (SET_ERROR(EINVAL));
1653         }
1654 
1655         spa_upgrade(spa, zc->zc_cookie);
1656         spa_close(spa, FTAG);
1657 
1658         return (error);
1659 }
1660 
1661 static int
1662 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1663 {
1664         spa_t *spa;
1665         char *hist_buf;
1666         uint64_t size;
1667         int error;
1668 
1669         if ((size = zc->zc_history_len) == 0)
1670                 return (SET_ERROR(EINVAL));
1671 
1672         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1673                 return (error);
1674 
1675         if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1676                 spa_close(spa, FTAG);
1677                 return (SET_ERROR(ENOTSUP));
1678         }
1679 
1680         hist_buf = kmem_alloc(size, KM_SLEEP);
1681         if ((error = spa_history_get(spa, &zc->zc_history_offset,
1682             &zc->zc_history_len, hist_buf)) == 0) {
1683                 error = ddi_copyout(hist_buf,
1684                     (void *)(uintptr_t)zc->zc_history,
1685                     zc->zc_history_len, zc->zc_iflags);
1686         }
1687 
1688         spa_close(spa, FTAG);
1689         kmem_free(hist_buf, size);
1690         return (error);
1691 }
1692 
1693 static int
1694 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1695 {
1696         spa_t *spa;
1697         int error;
1698 
1699         error = spa_open(zc->zc_name, &spa, FTAG);
1700         if (error == 0) {
1701                 error = spa_change_guid(spa);
1702                 spa_close(spa, FTAG);
1703         }
1704         return (error);
1705 }
1706 
1707 static int
1708 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1709 {
1710         return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1711 }
1712 
1713 /*
1714  * inputs:
1715  * zc_name              name of filesystem
1716  * zc_obj               object to find
1717  *
1718  * outputs:
1719  * zc_value             name of object
1720  */
1721 static int
1722 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1723 {
1724         objset_t *os;
1725         int error;
1726 
1727         /* XXX reading from objset not owned */
1728         if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1729                 return (error);
1730         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1731                 dmu_objset_rele(os, FTAG);
1732                 return (SET_ERROR(EINVAL));
1733         }
1734         error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1735             sizeof (zc->zc_value));
1736         dmu_objset_rele(os, FTAG);
1737 
1738         return (error);
1739 }
1740 
1741 /*
1742  * inputs:
1743  * zc_name              name of filesystem
1744  * zc_obj               object to find
1745  *
1746  * outputs:
1747  * zc_stat              stats on object
1748  * zc_value             path to object
1749  */
1750 static int
1751 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1752 {
1753         objset_t *os;
1754         int error;
1755 
1756         /* XXX reading from objset not owned */
1757         if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
1758                 return (error);
1759         if (dmu_objset_type(os) != DMU_OST_ZFS) {
1760                 dmu_objset_rele(os, FTAG);
1761                 return (SET_ERROR(EINVAL));
1762         }
1763         error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1764             sizeof (zc->zc_value));
1765         dmu_objset_rele(os, FTAG);
1766 
1767         return (error);
1768 }
1769 
1770 static int
1771 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1772 {
1773         spa_t *spa;
1774         int error;
1775         nvlist_t *config, **l2cache, **spares;
1776         uint_t nl2cache = 0, nspares = 0;
1777 
1778         error = spa_open(zc->zc_name, &spa, FTAG);
1779         if (error != 0)
1780                 return (error);
1781 
1782         error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1783             zc->zc_iflags, &config);
1784         (void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_L2CACHE,
1785             &l2cache, &nl2cache);
1786 
1787         (void) nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_SPARES,
1788             &spares, &nspares);
1789 
1790         /*
1791          * A root pool with concatenated devices is not supported.
1792          * Thus, can not add a device to a root pool.
1793          *
1794          * Intent log device can not be added to a rootpool because
1795          * during mountroot, zil is replayed, a seperated log device
1796          * can not be accessed during the mountroot time.
1797          *
1798          * l2cache and spare devices are ok to be added to a rootpool.
1799          */
1800         if (spa_bootfs(spa) != 0 && nl2cache == 0 && nspares == 0) {
1801                 nvlist_free(config);
1802                 spa_close(spa, FTAG);
1803                 return (SET_ERROR(EDOM));
1804         }
1805 
1806         if (error == 0) {
1807                 error = spa_vdev_add(spa, config);
1808                 nvlist_free(config);
1809         }
1810         spa_close(spa, FTAG);
1811         return (error);
1812 }
1813 
1814 /*
1815  * inputs:
1816  * zc_name              name of the pool
1817  * zc_nvlist_conf       nvlist of devices to remove
1818  * zc_cookie            to stop the remove?
1819  */
1820 static int
1821 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
1822 {
1823         spa_t *spa;
1824         int error;
1825 
1826         error = spa_open(zc->zc_name, &spa, FTAG);
1827         if (error != 0)
1828                 return (error);
1829         error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
1830         spa_close(spa, FTAG);
1831         return (error);
1832 }
1833 
1834 static int
1835 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
1836 {
1837         spa_t *spa;
1838         int error;
1839         vdev_state_t newstate = VDEV_STATE_UNKNOWN;
1840 
1841         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1842                 return (error);
1843         switch (zc->zc_cookie) {
1844         case VDEV_STATE_ONLINE:
1845                 error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
1846                 break;
1847 
1848         case VDEV_STATE_OFFLINE:
1849                 error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
1850                 break;
1851 
1852         case VDEV_STATE_FAULTED:
1853                 if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1854                     zc->zc_obj != VDEV_AUX_EXTERNAL)
1855                         zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1856 
1857                 error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
1858                 break;
1859 
1860         case VDEV_STATE_DEGRADED:
1861                 if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
1862                     zc->zc_obj != VDEV_AUX_EXTERNAL)
1863                         zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
1864 
1865                 error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
1866                 break;
1867 
1868         default:
1869                 error = SET_ERROR(EINVAL);
1870         }
1871         zc->zc_cookie = newstate;
1872         spa_close(spa, FTAG);
1873         return (error);
1874 }
1875 
1876 static int
1877 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
1878 {
1879         spa_t *spa;
1880         int replacing = zc->zc_cookie;
1881         nvlist_t *config;
1882         int error;
1883 
1884         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1885                 return (error);
1886 
1887         if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1888             zc->zc_iflags, &config)) == 0) {
1889                 error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
1890                 nvlist_free(config);
1891         }
1892 
1893         spa_close(spa, FTAG);
1894         return (error);
1895 }
1896 
1897 static int
1898 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
1899 {
1900         spa_t *spa;
1901         int error;
1902 
1903         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1904                 return (error);
1905 
1906         error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
1907 
1908         spa_close(spa, FTAG);
1909         return (error);
1910 }
1911 
1912 static int
1913 zfs_ioc_vdev_split(zfs_cmd_t *zc)
1914 {
1915         spa_t *spa;
1916         nvlist_t *config, *props = NULL;
1917         int error;
1918         boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
1919 
1920         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1921                 return (error);
1922 
1923         if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1924             zc->zc_iflags, &config)) {
1925                 spa_close(spa, FTAG);
1926                 return (error);
1927         }
1928 
1929         if (zc->zc_nvlist_src_size != 0 && (error =
1930             get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1931             zc->zc_iflags, &props))) {
1932                 spa_close(spa, FTAG);
1933                 nvlist_free(config);
1934                 return (error);
1935         }
1936 
1937         error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
1938 
1939         spa_close(spa, FTAG);
1940 
1941         nvlist_free(config);
1942         nvlist_free(props);
1943 
1944         return (error);
1945 }
1946 
1947 static int
1948 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
1949 {
1950         spa_t *spa;
1951         char *path = zc->zc_value;
1952         uint64_t guid = zc->zc_guid;
1953         int error;
1954 
1955         error = spa_open(zc->zc_name, &spa, FTAG);
1956         if (error != 0)
1957                 return (error);
1958 
1959         error = spa_vdev_setpath(spa, guid, path);
1960         spa_close(spa, FTAG);
1961         return (error);
1962 }
1963 
1964 static int
1965 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
1966 {
1967         spa_t *spa;
1968         char *fru = zc->zc_value;
1969         uint64_t guid = zc->zc_guid;
1970         int error;
1971 
1972         error = spa_open(zc->zc_name, &spa, FTAG);
1973         if (error != 0)
1974                 return (error);
1975 
1976         error = spa_vdev_setfru(spa, guid, fru);
1977         spa_close(spa, FTAG);
1978         return (error);
1979 }
1980 
1981 static int
1982 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
1983 {
1984         int error = 0;
1985         nvlist_t *nv;
1986 
1987         dmu_objset_fast_stat(os, &zc->zc_objset_stats);
1988 
1989         if (zc->zc_nvlist_dst != 0 &&
1990             (error = dsl_prop_get_all(os, &nv)) == 0) {
1991                 dmu_objset_stats(os, nv);
1992                 /*
1993                  * NB: zvol_get_stats() will read the objset contents,
1994                  * which we aren't supposed to do with a
1995                  * DS_MODE_USER hold, because it could be
1996                  * inconsistent.  So this is a bit of a workaround...
1997                  * XXX reading with out owning
1998                  */
1999                 if (!zc->zc_objset_stats.dds_inconsistent &&
2000                     dmu_objset_type(os) == DMU_OST_ZVOL) {
2001                         error = zvol_get_stats(os, nv);
2002                         if (error == EIO)
2003                                 return (error);
2004                         VERIFY0(error);
2005                 }
2006                 error = put_nvlist(zc, nv);
2007                 nvlist_free(nv);
2008         }
2009 
2010         return (error);
2011 }
2012 
2013 /*
2014  * inputs:
2015  * zc_name              name of filesystem
2016  * zc_nvlist_dst_size   size of buffer for property nvlist
2017  *
2018  * outputs:
2019  * zc_objset_stats      stats
2020  * zc_nvlist_dst        property nvlist
2021  * zc_nvlist_dst_size   size of property nvlist
2022  */
2023 static int
2024 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2025 {
2026         objset_t *os;
2027         int error;
2028 
2029         error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2030         if (error == 0) {
2031                 error = zfs_ioc_objset_stats_impl(zc, os);
2032                 dmu_objset_rele(os, FTAG);
2033         }
2034 
2035         return (error);
2036 }
2037 
2038 /*
2039  * inputs:
2040  * zc_name              name of filesystem
2041  * zc_nvlist_dst_size   size of buffer for property nvlist
2042  *
2043  * outputs:
2044  * zc_nvlist_dst        received property nvlist
2045  * zc_nvlist_dst_size   size of received property nvlist
2046  *
2047  * Gets received properties (distinct from local properties on or after
2048  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2049  * local property values.
2050  */
2051 static int
2052 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2053 {
2054         int error = 0;
2055         nvlist_t *nv;
2056 
2057         /*
2058          * Without this check, we would return local property values if the
2059          * caller has not already received properties on or after
2060          * SPA_VERSION_RECVD_PROPS.
2061          */
2062         if (!dsl_prop_get_hasrecvd(zc->zc_name))
2063                 return (SET_ERROR(ENOTSUP));
2064 
2065         if (zc->zc_nvlist_dst != 0 &&
2066             (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2067                 error = put_nvlist(zc, nv);
2068                 nvlist_free(nv);
2069         }
2070 
2071         return (error);
2072 }
2073 
2074 static int
2075 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2076 {
2077         uint64_t value;
2078         int error;
2079 
2080         /*
2081          * zfs_get_zplprop() will either find a value or give us
2082          * the default value (if there is one).
2083          */
2084         if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2085                 return (error);
2086         VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2087         return (0);
2088 }
2089 
2090 /*
2091  * inputs:
2092  * zc_name              name of filesystem
2093  * zc_nvlist_dst_size   size of buffer for zpl property nvlist
2094  *
2095  * outputs:
2096  * zc_nvlist_dst        zpl property nvlist
2097  * zc_nvlist_dst_size   size of zpl property nvlist
2098  */
2099 static int
2100 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2101 {
2102         objset_t *os;
2103         int err;
2104 
2105         /* XXX reading without owning */
2106         if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2107                 return (err);
2108 
2109         dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2110 
2111         /*
2112          * NB: nvl_add_zplprop() will read the objset contents,
2113          * which we aren't supposed to do with a DS_MODE_USER
2114          * hold, because it could be inconsistent.
2115          */
2116         if (zc->zc_nvlist_dst != NULL &&
2117             !zc->zc_objset_stats.dds_inconsistent &&
2118             dmu_objset_type(os) == DMU_OST_ZFS) {
2119                 nvlist_t *nv;
2120 
2121                 VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2122                 if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2123                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2124                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2125                     (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2126                         err = put_nvlist(zc, nv);
2127                 nvlist_free(nv);
2128         } else {
2129                 err = SET_ERROR(ENOENT);
2130         }
2131         dmu_objset_rele(os, FTAG);
2132         return (err);
2133 }
2134 
2135 static boolean_t
2136 dataset_name_hidden(const char *name)
2137 {
2138         /*
2139          * Skip over datasets that are not visible in this zone,
2140          * internal datasets (which have a $ in their name), and
2141          * temporary datasets (which have a % in their name).
2142          */
2143         if (strchr(name, '$') != NULL)
2144                 return (B_TRUE);
2145         if (strchr(name, '%') != NULL)
2146                 return (B_TRUE);
2147         if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2148                 return (B_TRUE);
2149         return (B_FALSE);
2150 }
2151 
2152 /*
2153  * inputs:
2154  * zc_name              name of filesystem
2155  * zc_cookie            zap cursor
2156  * zc_nvlist_dst_size   size of buffer for property nvlist
2157  *
2158  * outputs:
2159  * zc_name              name of next filesystem
2160  * zc_cookie            zap cursor
2161  * zc_objset_stats      stats
2162  * zc_nvlist_dst        property nvlist
2163  * zc_nvlist_dst_size   size of property nvlist
2164  */
2165 static int
2166 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2167 {
2168         objset_t *os;
2169         int error;
2170         char *p;
2171         size_t orig_len = strlen(zc->zc_name);
2172 
2173 top:
2174         if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2175                 if (error == ENOENT)
2176                         error = SET_ERROR(ESRCH);
2177                 return (error);
2178         }
2179 
2180         p = strrchr(zc->zc_name, '/');
2181         if (p == NULL || p[1] != '\0')
2182                 (void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2183         p = zc->zc_name + strlen(zc->zc_name);
2184 
2185         do {
2186                 error = dmu_dir_list_next(os,
2187                     sizeof (zc->zc_name) - (p - zc->zc_name), p,
2188                     NULL, &zc->zc_cookie);
2189                 if (error == ENOENT)
2190                         error = SET_ERROR(ESRCH);
2191         } while (error == 0 && dataset_name_hidden(zc->zc_name));
2192         dmu_objset_rele(os, FTAG);
2193 
2194         /*
2195          * If it's an internal dataset (ie. with a '$' in its name),
2196          * don't try to get stats for it, otherwise we'll return ENOENT.
2197          */
2198         if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2199                 error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2200                 if (error == ENOENT) {
2201                         /* We lost a race with destroy, get the next one. */
2202                         zc->zc_name[orig_len] = '\0';
2203                         goto top;
2204                 }
2205         }
2206         return (error);
2207 }
2208 
2209 /*
2210  * inputs:
2211  * zc_name              name of filesystem
2212  * zc_cookie            zap cursor
2213  * zc_nvlist_dst_size   size of buffer for property nvlist
2214  *
2215  * outputs:
2216  * zc_name              name of next snapshot
2217  * zc_objset_stats      stats
2218  * zc_nvlist_dst        property nvlist
2219  * zc_nvlist_dst_size   size of property nvlist
2220  */
2221 static int
2222 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2223 {
2224         objset_t *os;
2225         int error;
2226 
2227         error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2228         if (error != 0) {
2229                 return (error == ENOENT ? ESRCH : error);
2230         }
2231 
2232         /*
2233          * A dataset name of maximum length cannot have any snapshots,
2234          * so exit immediately.
2235          */
2236         if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >= MAXNAMELEN) {
2237                 dmu_objset_rele(os, FTAG);
2238                 return (SET_ERROR(ESRCH));
2239         }
2240 
2241         error = dmu_snapshot_list_next(os,
2242             sizeof (zc->zc_name) - strlen(zc->zc_name),
2243             zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2244             NULL);
2245 
2246         if (error == 0) {
2247                 dsl_dataset_t *ds;
2248                 dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2249 
2250                 error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2251                 if (error == 0) {
2252                         objset_t *ossnap;
2253 
2254                         error = dmu_objset_from_ds(ds, &ossnap);
2255                         if (error == 0)
2256                                 error = zfs_ioc_objset_stats_impl(zc, ossnap);
2257                         dsl_dataset_rele(ds, FTAG);
2258                 }
2259         } else if (error == ENOENT) {
2260                 error = SET_ERROR(ESRCH);
2261         }
2262 
2263         dmu_objset_rele(os, FTAG);
2264         /* if we failed, undo the @ that we tacked on to zc_name */
2265         if (error != 0)
2266                 *strchr(zc->zc_name, '@') = '\0';
2267         return (error);
2268 }
2269 
2270 static int
2271 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2272 {
2273         const char *propname = nvpair_name(pair);
2274         uint64_t *valary;
2275         unsigned int vallen;
2276         const char *domain;
2277         char *dash;
2278         zfs_userquota_prop_t type;
2279         uint64_t rid;
2280         uint64_t quota;
2281         zfsvfs_t *zfsvfs;
2282         int err;
2283 
2284         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2285                 nvlist_t *attrs;
2286                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2287                 if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2288                     &pair) != 0)
2289                         return (SET_ERROR(EINVAL));
2290         }
2291 
2292         /*
2293          * A correctly constructed propname is encoded as
2294          * userquota@<rid>-<domain>.
2295          */
2296         if ((dash = strchr(propname, '-')) == NULL ||
2297             nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2298             vallen != 3)
2299                 return (SET_ERROR(EINVAL));
2300 
2301         domain = dash + 1;
2302         type = valary[0];
2303         rid = valary[1];
2304         quota = valary[2];
2305 
2306         err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2307         if (err == 0) {
2308                 err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2309                 zfsvfs_rele(zfsvfs, FTAG);
2310         }
2311 
2312         return (err);
2313 }
2314 
2315 /*
2316  * If the named property is one that has a special function to set its value,
2317  * return 0 on success and a positive error code on failure; otherwise if it is
2318  * not one of the special properties handled by this function, return -1.
2319  *
2320  * XXX: It would be better for callers of the property interface if we handled
2321  * these special cases in dsl_prop.c (in the dsl layer).
2322  */
2323 static int
2324 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2325     nvpair_t *pair)
2326 {
2327         const char *propname = nvpair_name(pair);
2328         zfs_prop_t prop = zfs_name_to_prop(propname);
2329         uint64_t intval;
2330         int err;
2331 
2332         if (prop == ZPROP_INVAL) {
2333                 if (zfs_prop_userquota(propname))
2334                         return (zfs_prop_set_userquota(dsname, pair));
2335                 return (-1);
2336         }
2337 
2338         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2339                 nvlist_t *attrs;
2340                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2341                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2342                     &pair) == 0);
2343         }
2344 
2345         if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
2346                 return (-1);
2347 
2348         VERIFY(0 == nvpair_value_uint64(pair, &intval));
2349 
2350         switch (prop) {
2351         case ZFS_PROP_QUOTA:
2352                 err = dsl_dir_set_quota(dsname, source, intval);
2353                 break;
2354         case ZFS_PROP_REFQUOTA:
2355                 err = dsl_dataset_set_refquota(dsname, source, intval);
2356                 break;
2357         case ZFS_PROP_RESERVATION:
2358                 err = dsl_dir_set_reservation(dsname, source, intval);
2359                 break;
2360         case ZFS_PROP_REFRESERVATION:
2361                 err = dsl_dataset_set_refreservation(dsname, source, intval);
2362                 break;
2363         case ZFS_PROP_VOLSIZE:
2364                 err = zvol_set_volsize(dsname, intval);
2365                 break;
2366         case ZFS_PROP_VERSION:
2367         {
2368                 zfsvfs_t *zfsvfs;
2369 
2370                 if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2371                         break;
2372 
2373                 err = zfs_set_version(zfsvfs, intval);
2374                 zfsvfs_rele(zfsvfs, FTAG);
2375 
2376                 if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2377                         zfs_cmd_t *zc;
2378 
2379                         zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2380                         (void) strcpy(zc->zc_name, dsname);
2381                         (void) zfs_ioc_userspace_upgrade(zc);
2382                         kmem_free(zc, sizeof (zfs_cmd_t));
2383                 }
2384                 break;
2385         }
2386         case ZFS_PROP_COMPRESSION:
2387         {
2388                 if (intval == ZIO_COMPRESS_LZ4) {
2389                         zfeature_info_t *feature =
2390                             &spa_feature_table[SPA_FEATURE_LZ4_COMPRESS];
2391                         spa_t *spa;
2392 
2393                         if ((err = spa_open(dsname, &spa, FTAG)) != 0)
2394                                 return (err);
2395 
2396                         /*
2397                          * Setting the LZ4 compression algorithm activates
2398                          * the feature.
2399                          */
2400                         if (!spa_feature_is_active(spa, feature)) {
2401                                 if ((err = zfs_prop_activate_feature(spa,
2402                                     feature)) != 0) {
2403                                         spa_close(spa, FTAG);
2404                                         return (err);
2405                                 }
2406                         }
2407 
2408                         spa_close(spa, FTAG);
2409                 }
2410                 /*
2411                  * We still want the default set action to be performed in the
2412                  * caller, we only performed zfeature settings here.
2413                  */
2414                 err = -1;
2415                 break;
2416         }
2417 
2418         default:
2419                 err = -1;
2420         }
2421 
2422         return (err);
2423 }
2424 
2425 /*
2426  * This function is best effort. If it fails to set any of the given properties,
2427  * it continues to set as many as it can and returns the last error
2428  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2429  * with the list of names of all the properties that failed along with the
2430  * corresponding error numbers.
2431  *
2432  * If every property is set successfully, zero is returned and errlist is not
2433  * modified.
2434  */
2435 int
2436 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2437     nvlist_t *errlist)
2438 {
2439         nvpair_t *pair;
2440         nvpair_t *propval;
2441         int rv = 0;
2442         uint64_t intval;
2443         char *strval;
2444         nvlist_t *genericnvl = fnvlist_alloc();
2445         nvlist_t *retrynvl = fnvlist_alloc();
2446 
2447 retry:
2448         pair = NULL;
2449         while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2450                 const char *propname = nvpair_name(pair);
2451                 zfs_prop_t prop = zfs_name_to_prop(propname);
2452                 int err = 0;
2453 
2454                 /* decode the property value */
2455                 propval = pair;
2456                 if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2457                         nvlist_t *attrs;
2458                         attrs = fnvpair_value_nvlist(pair);
2459                         if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2460                             &propval) != 0)
2461                                 err = SET_ERROR(EINVAL);
2462                 }
2463 
2464                 /* Validate value type */
2465                 if (err == 0 && prop == ZPROP_INVAL) {
2466                         if (zfs_prop_user(propname)) {
2467                                 if (nvpair_type(propval) != DATA_TYPE_STRING)
2468                                         err = SET_ERROR(EINVAL);
2469                         } else if (zfs_prop_userquota(propname)) {
2470                                 if (nvpair_type(propval) !=
2471                                     DATA_TYPE_UINT64_ARRAY)
2472                                         err = SET_ERROR(EINVAL);
2473                         } else {
2474                                 err = SET_ERROR(EINVAL);
2475                         }
2476                 } else if (err == 0) {
2477                         if (nvpair_type(propval) == DATA_TYPE_STRING) {
2478                                 if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2479                                         err = SET_ERROR(EINVAL);
2480                         } else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2481                                 const char *unused;
2482 
2483                                 intval = fnvpair_value_uint64(propval);
2484 
2485                                 switch (zfs_prop_get_type(prop)) {
2486                                 case PROP_TYPE_NUMBER:
2487                                         break;
2488                                 case PROP_TYPE_STRING:
2489                                         err = SET_ERROR(EINVAL);
2490                                         break;
2491                                 case PROP_TYPE_INDEX:
2492                                         if (zfs_prop_index_to_string(prop,
2493                                             intval, &unused) != 0)
2494                                                 err = SET_ERROR(EINVAL);
2495                                         break;
2496                                 default:
2497                                         cmn_err(CE_PANIC,
2498                                             "unknown property type");
2499                                 }
2500                         } else {
2501                                 err = SET_ERROR(EINVAL);
2502                         }
2503                 }
2504 
2505                 /* Validate permissions */
2506                 if (err == 0)
2507                         err = zfs_check_settable(dsname, pair, CRED());
2508 
2509                 if (err == 0) {
2510                         err = zfs_prop_set_special(dsname, source, pair);
2511                         if (err == -1) {
2512                                 /*
2513                                  * For better performance we build up a list of
2514                                  * properties to set in a single transaction.
2515                                  */
2516                                 err = nvlist_add_nvpair(genericnvl, pair);
2517                         } else if (err != 0 && nvl != retrynvl) {
2518                                 /*
2519                                  * This may be a spurious error caused by
2520                                  * receiving quota and reservation out of order.
2521                                  * Try again in a second pass.
2522                                  */
2523                                 err = nvlist_add_nvpair(retrynvl, pair);
2524                         }
2525                 }
2526 
2527                 if (err != 0) {
2528                         if (errlist != NULL)
2529                                 fnvlist_add_int32(errlist, propname, err);
2530                         rv = err;
2531                 }
2532         }
2533 
2534         if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2535                 nvl = retrynvl;
2536                 goto retry;
2537         }
2538 
2539         if (!nvlist_empty(genericnvl) &&
2540             dsl_props_set(dsname, source, genericnvl) != 0) {
2541                 /*
2542                  * If this fails, we still want to set as many properties as we
2543                  * can, so try setting them individually.
2544                  */
2545                 pair = NULL;
2546                 while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2547                         const char *propname = nvpair_name(pair);
2548                         int err = 0;
2549 
2550                         propval = pair;
2551                         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2552                                 nvlist_t *attrs;
2553                                 attrs = fnvpair_value_nvlist(pair);
2554                                 propval = fnvlist_lookup_nvpair(attrs,
2555                                     ZPROP_VALUE);
2556                         }
2557 
2558                         if (nvpair_type(propval) == DATA_TYPE_STRING) {
2559                                 strval = fnvpair_value_string(propval);
2560                                 err = dsl_prop_set_string(dsname, propname,
2561                                     source, strval);
2562                         } else {
2563                                 intval = fnvpair_value_uint64(propval);
2564                                 err = dsl_prop_set_int(dsname, propname, source,
2565                                     intval);
2566                         }
2567 
2568                         if (err != 0) {
2569                                 if (errlist != NULL) {
2570                                         fnvlist_add_int32(errlist, propname,
2571                                             err);
2572                                 }
2573                                 rv = err;
2574                         }
2575                 }
2576         }
2577         nvlist_free(genericnvl);
2578         nvlist_free(retrynvl);
2579 
2580         return (rv);
2581 }
2582 
2583 /*
2584  * Check that all the properties are valid user properties.
2585  */
2586 static int
2587 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2588 {
2589         nvpair_t *pair = NULL;
2590         int error = 0;
2591 
2592         while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2593                 const char *propname = nvpair_name(pair);
2594                 char *valstr;
2595 
2596                 if (!zfs_prop_user(propname) ||
2597                     nvpair_type(pair) != DATA_TYPE_STRING)
2598                         return (SET_ERROR(EINVAL));
2599 
2600                 if (error = zfs_secpolicy_write_perms(fsname,
2601                     ZFS_DELEG_PERM_USERPROP, CRED()))
2602                         return (error);
2603 
2604                 if (strlen(propname) >= ZAP_MAXNAMELEN)
2605                         return (SET_ERROR(ENAMETOOLONG));
2606 
2607                 VERIFY(nvpair_value_string(pair, &valstr) == 0);
2608                 if (strlen(valstr) >= ZAP_MAXVALUELEN)
2609                         return (E2BIG);
2610         }
2611         return (0);
2612 }
2613 
2614 static void
2615 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2616 {
2617         nvpair_t *pair;
2618 
2619         VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2620 
2621         pair = NULL;
2622         while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2623                 if (nvlist_exists(skipped, nvpair_name(pair)))
2624                         continue;
2625 
2626                 VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2627         }
2628 }
2629 
2630 static int
2631 clear_received_props(const char *dsname, nvlist_t *props,
2632     nvlist_t *skipped)
2633 {
2634         int err = 0;
2635         nvlist_t *cleared_props = NULL;
2636         props_skip(props, skipped, &cleared_props);
2637         if (!nvlist_empty(cleared_props)) {
2638                 /*
2639                  * Acts on local properties until the dataset has received
2640                  * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2641                  */
2642                 zprop_source_t flags = (ZPROP_SRC_NONE |
2643                     (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2644                 err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2645         }
2646         nvlist_free(cleared_props);
2647         return (err);
2648 }
2649 
2650 /*
2651  * inputs:
2652  * zc_name              name of filesystem
2653  * zc_value             name of property to set
2654  * zc_nvlist_src{_size} nvlist of properties to apply
2655  * zc_cookie            received properties flag
2656  *
2657  * outputs:
2658  * zc_nvlist_dst{_size} error for each unapplied received property
2659  */
2660 static int
2661 zfs_ioc_set_prop(zfs_cmd_t *zc)
2662 {
2663         nvlist_t *nvl;
2664         boolean_t received = zc->zc_cookie;
2665         zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2666             ZPROP_SRC_LOCAL);
2667         nvlist_t *errors;
2668         int error;
2669 
2670         if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2671             zc->zc_iflags, &nvl)) != 0)
2672                 return (error);
2673 
2674         if (received) {
2675                 nvlist_t *origprops;
2676 
2677                 if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2678                         (void) clear_received_props(zc->zc_name,
2679                             origprops, nvl);
2680                         nvlist_free(origprops);
2681                 }
2682 
2683                 error = dsl_prop_set_hasrecvd(zc->zc_name);
2684         }
2685 
2686         errors = fnvlist_alloc();
2687         if (error == 0)
2688                 error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2689 
2690         if (zc->zc_nvlist_dst != NULL && errors != NULL) {
2691                 (void) put_nvlist(zc, errors);
2692         }
2693 
2694         nvlist_free(errors);
2695         nvlist_free(nvl);
2696         return (error);
2697 }
2698 
2699 /*
2700  * inputs:
2701  * zc_name              name of filesystem
2702  * zc_value             name of property to inherit
2703  * zc_cookie            revert to received value if TRUE
2704  *
2705  * outputs:             none
2706  */
2707 static int
2708 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2709 {
2710         const char *propname = zc->zc_value;
2711         zfs_prop_t prop = zfs_name_to_prop(propname);
2712         boolean_t received = zc->zc_cookie;
2713         zprop_source_t source = (received
2714             ? ZPROP_SRC_NONE            /* revert to received value, if any */
2715             : ZPROP_SRC_INHERITED);     /* explicitly inherit */
2716 
2717         if (received) {
2718                 nvlist_t *dummy;
2719                 nvpair_t *pair;
2720                 zprop_type_t type;
2721                 int err;
2722 
2723                 /*
2724                  * zfs_prop_set_special() expects properties in the form of an
2725                  * nvpair with type info.
2726                  */
2727                 if (prop == ZPROP_INVAL) {
2728                         if (!zfs_prop_user(propname))
2729                                 return (SET_ERROR(EINVAL));
2730 
2731                         type = PROP_TYPE_STRING;
2732                 } else if (prop == ZFS_PROP_VOLSIZE ||
2733                     prop == ZFS_PROP_VERSION) {
2734                         return (SET_ERROR(EINVAL));
2735                 } else {
2736                         type = zfs_prop_get_type(prop);
2737                 }
2738 
2739                 VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2740 
2741                 switch (type) {
2742                 case PROP_TYPE_STRING:
2743                         VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2744                         break;
2745                 case PROP_TYPE_NUMBER:
2746                 case PROP_TYPE_INDEX:
2747                         VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2748                         break;
2749                 default:
2750                         nvlist_free(dummy);
2751                         return (SET_ERROR(EINVAL));
2752                 }
2753 
2754                 pair = nvlist_next_nvpair(dummy, NULL);
2755                 err = zfs_prop_set_special(zc->zc_name, source, pair);
2756                 nvlist_free(dummy);
2757                 if (err != -1)
2758                         return (err); /* special property already handled */
2759         } else {
2760                 /*
2761                  * Only check this in the non-received case. We want to allow
2762                  * 'inherit -S' to revert non-inheritable properties like quota
2763                  * and reservation to the received or default values even though
2764                  * they are not considered inheritable.
2765                  */
2766                 if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2767                         return (SET_ERROR(EINVAL));
2768         }
2769 
2770         /* property name has been validated by zfs_secpolicy_inherit_prop() */
2771         return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2772 }
2773 
2774 static int
2775 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2776 {
2777         nvlist_t *props;
2778         spa_t *spa;
2779         int error;
2780         nvpair_t *pair;
2781 
2782         if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2783             zc->zc_iflags, &props))
2784                 return (error);
2785 
2786         /*
2787          * If the only property is the configfile, then just do a spa_lookup()
2788          * to handle the faulted case.
2789          */
2790         pair = nvlist_next_nvpair(props, NULL);
2791         if (pair != NULL && strcmp(nvpair_name(pair),
2792             zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2793             nvlist_next_nvpair(props, pair) == NULL) {
2794                 mutex_enter(&spa_namespace_lock);
2795                 if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2796                         spa_configfile_set(spa, props, B_FALSE);
2797                         spa_config_sync(spa, B_FALSE, B_TRUE);
2798                 }
2799                 mutex_exit(&spa_namespace_lock);
2800                 if (spa != NULL) {
2801                         nvlist_free(props);
2802                         return (0);
2803                 }
2804         }
2805 
2806         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2807                 nvlist_free(props);
2808                 return (error);
2809         }
2810 
2811         error = spa_prop_set(spa, props);
2812 
2813         nvlist_free(props);
2814         spa_close(spa, FTAG);
2815 
2816         return (error);
2817 }
2818 
2819 static int
2820 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
2821 {
2822         spa_t *spa;
2823         int error;
2824         nvlist_t *nvp = NULL;
2825 
2826         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2827                 /*
2828                  * If the pool is faulted, there may be properties we can still
2829                  * get (such as altroot and cachefile), so attempt to get them
2830                  * anyway.
2831                  */
2832                 mutex_enter(&spa_namespace_lock);
2833                 if ((spa = spa_lookup(zc->zc_name)) != NULL)
2834                         error = spa_prop_get(spa, &nvp);
2835                 mutex_exit(&spa_namespace_lock);
2836         } else {
2837                 error = spa_prop_get(spa, &nvp);
2838                 spa_close(spa, FTAG);
2839         }
2840 
2841         if (error == 0 && zc->zc_nvlist_dst != NULL)
2842                 error = put_nvlist(zc, nvp);
2843         else
2844                 error = SET_ERROR(EFAULT);
2845 
2846         nvlist_free(nvp);
2847         return (error);
2848 }
2849 
2850 /*
2851  * inputs:
2852  * zc_name              name of filesystem
2853  * zc_nvlist_src{_size} nvlist of delegated permissions
2854  * zc_perm_action       allow/unallow flag
2855  *
2856  * outputs:             none
2857  */
2858 static int
2859 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
2860 {
2861         int error;
2862         nvlist_t *fsaclnv = NULL;
2863 
2864         if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2865             zc->zc_iflags, &fsaclnv)) != 0)
2866                 return (error);
2867 
2868         /*
2869          * Verify nvlist is constructed correctly
2870          */
2871         if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
2872                 nvlist_free(fsaclnv);
2873                 return (SET_ERROR(EINVAL));
2874         }
2875 
2876         /*
2877          * If we don't have PRIV_SYS_MOUNT, then validate
2878          * that user is allowed to hand out each permission in
2879          * the nvlist(s)
2880          */
2881 
2882         error = secpolicy_zfs(CRED());
2883         if (error != 0) {
2884                 if (zc->zc_perm_action == B_FALSE) {
2885                         error = dsl_deleg_can_allow(zc->zc_name,
2886                             fsaclnv, CRED());
2887                 } else {
2888                         error = dsl_deleg_can_unallow(zc->zc_name,
2889                             fsaclnv, CRED());
2890                 }
2891         }
2892 
2893         if (error == 0)
2894                 error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
2895 
2896         nvlist_free(fsaclnv);
2897         return (error);
2898 }
2899 
2900 /*
2901  * inputs:
2902  * zc_name              name of filesystem
2903  *
2904  * outputs:
2905  * zc_nvlist_src{_size} nvlist of delegated permissions
2906  */
2907 static int
2908 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
2909 {
2910         nvlist_t *nvp;
2911         int error;
2912 
2913         if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
2914                 error = put_nvlist(zc, nvp);
2915                 nvlist_free(nvp);
2916         }
2917 
2918         return (error);
2919 }
2920 
2921 /*
2922  * Search the vfs list for a specified resource.  Returns a pointer to it
2923  * or NULL if no suitable entry is found. The caller of this routine
2924  * is responsible for releasing the returned vfs pointer.
2925  */
2926 static vfs_t *
2927 zfs_get_vfs(const char *resource)
2928 {
2929         struct vfs *vfsp;
2930         struct vfs *vfs_found = NULL;
2931 
2932         vfs_list_read_lock();
2933         vfsp = rootvfs;
2934         do {
2935                 if (strcmp(refstr_value(vfsp->vfs_resource), resource) == 0) {
2936                         VFS_HOLD(vfsp);
2937                         vfs_found = vfsp;
2938                         break;
2939                 }
2940                 vfsp = vfsp->vfs_next;
2941         } while (vfsp != rootvfs);
2942         vfs_list_unlock();
2943         return (vfs_found);
2944 }
2945 
2946 /* ARGSUSED */
2947 static void
2948 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
2949 {
2950         zfs_creat_t *zct = arg;
2951 
2952         zfs_create_fs(os, cr, zct->zct_zplprops, tx);
2953 }
2954 
2955 #define ZFS_PROP_UNDEFINED      ((uint64_t)-1)
2956 
2957 /*
2958  * inputs:
2959  * createprops          list of properties requested by creator
2960  * default_zplver       zpl version to use if unspecified in createprops
2961  * fuids_ok             fuids allowed in this version of the spa?
2962  * os                   parent objset pointer (NULL if root fs)
2963  *
2964  * outputs:
2965  * zplprops     values for the zplprops we attach to the master node object
2966  * is_ci        true if requested file system will be purely case-insensitive
2967  *
2968  * Determine the settings for utf8only, normalization and
2969  * casesensitivity.  Specific values may have been requested by the
2970  * creator and/or we can inherit values from the parent dataset.  If
2971  * the file system is of too early a vintage, a creator can not
2972  * request settings for these properties, even if the requested
2973  * setting is the default value.  We don't actually want to create dsl
2974  * properties for these, so remove them from the source nvlist after
2975  * processing.
2976  */
2977 static int
2978 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
2979     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
2980     nvlist_t *zplprops, boolean_t *is_ci)
2981 {
2982         uint64_t sense = ZFS_PROP_UNDEFINED;
2983         uint64_t norm = ZFS_PROP_UNDEFINED;
2984         uint64_t u8 = ZFS_PROP_UNDEFINED;
2985 
2986         ASSERT(zplprops != NULL);
2987 
2988         /*
2989          * Pull out creator prop choices, if any.
2990          */
2991         if (createprops) {
2992                 (void) nvlist_lookup_uint64(createprops,
2993                     zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
2994                 (void) nvlist_lookup_uint64(createprops,
2995                     zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
2996                 (void) nvlist_remove_all(createprops,
2997                     zfs_prop_to_name(ZFS_PROP_NORMALIZE));
2998                 (void) nvlist_lookup_uint64(createprops,
2999                     zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3000                 (void) nvlist_remove_all(createprops,
3001                     zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3002                 (void) nvlist_lookup_uint64(createprops,
3003                     zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3004                 (void) nvlist_remove_all(createprops,
3005                     zfs_prop_to_name(ZFS_PROP_CASE));
3006         }
3007 
3008         /*
3009          * If the zpl version requested is whacky or the file system
3010          * or pool is version is too "young" to support normalization
3011          * and the creator tried to set a value for one of the props,
3012          * error out.
3013          */
3014         if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3015             (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3016             (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3017             (zplver < ZPL_VERSION_NORMALIZATION &&
3018             (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3019             sense != ZFS_PROP_UNDEFINED)))
3020                 return (SET_ERROR(ENOTSUP));
3021 
3022         /*
3023          * Put the version in the zplprops
3024          */
3025         VERIFY(nvlist_add_uint64(zplprops,
3026             zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3027 
3028         if (norm == ZFS_PROP_UNDEFINED)
3029                 VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3030         VERIFY(nvlist_add_uint64(zplprops,
3031             zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3032 
3033         /*
3034          * If we're normalizing, names must always be valid UTF-8 strings.
3035          */
3036         if (norm)
3037                 u8 = 1;
3038         if (u8 == ZFS_PROP_UNDEFINED)
3039                 VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3040         VERIFY(nvlist_add_uint64(zplprops,
3041             zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3042 
3043         if (sense == ZFS_PROP_UNDEFINED)
3044                 VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3045         VERIFY(nvlist_add_uint64(zplprops,
3046             zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3047 
3048         if (is_ci)
3049                 *is_ci = (sense == ZFS_CASE_INSENSITIVE);
3050 
3051         return (0);
3052 }
3053 
3054 static int
3055 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3056     nvlist_t *zplprops, boolean_t *is_ci)
3057 {
3058         boolean_t fuids_ok, sa_ok;
3059         uint64_t zplver = ZPL_VERSION;
3060         objset_t *os = NULL;
3061         char parentname[MAXNAMELEN];
3062         char *cp;
3063         spa_t *spa;
3064         uint64_t spa_vers;
3065         int error;
3066 
3067         (void) strlcpy(parentname, dataset, sizeof (parentname));
3068         cp = strrchr(parentname, '/');
3069         ASSERT(cp != NULL);
3070         cp[0] = '\0';
3071 
3072         if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3073                 return (error);
3074 
3075         spa_vers = spa_version(spa);
3076         spa_close(spa, FTAG);
3077 
3078         zplver = zfs_zpl_version_map(spa_vers);
3079         fuids_ok = (zplver >= ZPL_VERSION_FUID);
3080         sa_ok = (zplver >= ZPL_VERSION_SA);
3081 
3082         /*
3083          * Open parent object set so we can inherit zplprop values.
3084          */
3085         if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3086                 return (error);
3087 
3088         error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3089             zplprops, is_ci);
3090         dmu_objset_rele(os, FTAG);
3091         return (error);
3092 }
3093 
3094 static int
3095 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3096     nvlist_t *zplprops, boolean_t *is_ci)
3097 {
3098         boolean_t fuids_ok;
3099         boolean_t sa_ok;
3100         uint64_t zplver = ZPL_VERSION;
3101         int error;
3102 
3103         zplver = zfs_zpl_version_map(spa_vers);
3104         fuids_ok = (zplver >= ZPL_VERSION_FUID);
3105         sa_ok = (zplver >= ZPL_VERSION_SA);
3106 
3107         error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3108             createprops, zplprops, is_ci);
3109         return (error);
3110 }
3111 
3112 /*
3113  * innvl: {
3114  *     "type" -> dmu_objset_type_t (int32)
3115  *     (optional) "props" -> { prop -> value }
3116  * }
3117  *
3118  * outnvl: propname -> error code (int32)
3119  */
3120 static int
3121 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3122 {
3123         int error = 0;
3124         zfs_creat_t zct = { 0 };
3125         nvlist_t *nvprops = NULL;
3126         void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3127         int32_t type32;
3128         dmu_objset_type_t type;
3129         boolean_t is_insensitive = B_FALSE;
3130 
3131         if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
3132                 return (SET_ERROR(EINVAL));
3133         type = type32;
3134         (void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3135 
3136         switch (type) {
3137         case DMU_OST_ZFS:
3138                 cbfunc = zfs_create_cb;
3139                 break;
3140 
3141         case DMU_OST_ZVOL:
3142                 cbfunc = zvol_create_cb;
3143                 break;
3144 
3145         default:
3146                 cbfunc = NULL;
3147                 break;
3148         }
3149         if (strchr(fsname, '@') ||
3150             strchr(fsname, '%'))
3151                 return (SET_ERROR(EINVAL));
3152 
3153         zct.zct_props = nvprops;
3154 
3155         if (cbfunc == NULL)
3156                 return (SET_ERROR(EINVAL));
3157 
3158         if (type == DMU_OST_ZVOL) {
3159                 uint64_t volsize, volblocksize;
3160 
3161                 if (nvprops == NULL)
3162                         return (SET_ERROR(EINVAL));
3163                 if (nvlist_lookup_uint64(nvprops,
3164                     zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3165                         return (SET_ERROR(EINVAL));
3166 
3167                 if ((error = nvlist_lookup_uint64(nvprops,
3168                     zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3169                     &volblocksize)) != 0 && error != ENOENT)
3170                         return (SET_ERROR(EINVAL));
3171 
3172                 if (error != 0)
3173                         volblocksize = zfs_prop_default_numeric(
3174                             ZFS_PROP_VOLBLOCKSIZE);
3175 
3176                 if ((error = zvol_check_volblocksize(
3177                     volblocksize)) != 0 ||
3178                     (error = zvol_check_volsize(volsize,
3179                     volblocksize)) != 0)
3180                         return (error);
3181         } else if (type == DMU_OST_ZFS) {
3182                 int error;
3183 
3184                 /*
3185                  * We have to have normalization and
3186                  * case-folding flags correct when we do the
3187                  * file system creation, so go figure them out
3188                  * now.
3189                  */
3190                 VERIFY(nvlist_alloc(&zct.zct_zplprops,
3191                     NV_UNIQUE_NAME, KM_SLEEP) == 0);
3192                 error = zfs_fill_zplprops(fsname, nvprops,
3193                     zct.zct_zplprops, &is_insensitive);
3194                 if (error != 0) {
3195                         nvlist_free(zct.zct_zplprops);
3196                         return (error);
3197                 }
3198         }
3199 
3200         error = dmu_objset_create(fsname, type,
3201             is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
3202         nvlist_free(zct.zct_zplprops);
3203 
3204         /*
3205          * It would be nice to do this atomically.
3206          */
3207         if (error == 0) {
3208                 error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3209                     nvprops, outnvl);
3210                 if (error != 0)
3211                         (void) dsl_destroy_head(fsname);
3212         }
3213         return (error);
3214 }
3215 
3216 /*
3217  * innvl: {
3218  *     "origin" -> name of origin snapshot
3219  *     (optional) "props" -> { prop -> value }
3220  * }
3221  *
3222  * outnvl: propname -> error code (int32)
3223  */
3224 static int
3225 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3226 {
3227         int error = 0;
3228         nvlist_t *nvprops = NULL;
3229         char *origin_name;
3230 
3231         if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3232                 return (SET_ERROR(EINVAL));
3233         (void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3234 
3235         if (strchr(fsname, '@') ||
3236             strchr(fsname, '%'))
3237                 return (SET_ERROR(EINVAL));
3238 
3239         if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3240                 return (SET_ERROR(EINVAL));
3241         error = dmu_objset_clone(fsname, origin_name);
3242         if (error != 0)
3243                 return (error);
3244 
3245         /*
3246          * It would be nice to do this atomically.
3247          */
3248         if (error == 0) {
3249                 error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3250                     nvprops, outnvl);
3251                 if (error != 0)
3252                         (void) dsl_destroy_head(fsname);
3253         }
3254         return (error);
3255 }
3256 
3257 /*
3258  * innvl: {
3259  *     "snaps" -> { snapshot1, snapshot2 }
3260  *     (optional) "props" -> { prop -> value (string) }
3261  * }
3262  *
3263  * outnvl: snapshot -> error code (int32)
3264  */
3265 static int
3266 zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3267 {
3268         nvlist_t *snaps;
3269         nvlist_t *props = NULL;
3270         int error, poollen;
3271         nvpair_t *pair;
3272 
3273         (void) nvlist_lookup_nvlist(innvl, "props", &props);
3274         if ((error = zfs_check_userprops(poolname, props)) != 0)
3275                 return (error);
3276 
3277         if (!nvlist_empty(props) &&
3278             zfs_earlier_version(poolname, SPA_VERSION_SNAP_PROPS))
3279                 return (SET_ERROR(ENOTSUP));
3280 
3281         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3282                 return (SET_ERROR(EINVAL));
3283         poollen = strlen(poolname);
3284         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3285             pair = nvlist_next_nvpair(snaps, pair)) {
3286                 const char *name = nvpair_name(pair);
3287                 const char *cp = strchr(name, '@');
3288 
3289                 /*
3290                  * The snap name must contain an @, and the part after it must
3291                  * contain only valid characters.
3292                  */
3293                 if (cp == NULL || snapshot_namecheck(cp + 1, NULL, NULL) != 0)
3294                         return (SET_ERROR(EINVAL));
3295 
3296                 /*
3297                  * The snap must be in the specified pool.
3298                  */
3299                 if (strncmp(name, poolname, poollen) != 0 ||
3300                     (name[poollen] != '/' && name[poollen] != '@'))
3301                         return (SET_ERROR(EXDEV));
3302 
3303                 /* This must be the only snap of this fs. */
3304                 for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
3305                     pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
3306                         if (strncmp(name, nvpair_name(pair2), cp - name + 1)
3307                             == 0) {
3308                                 return (SET_ERROR(EXDEV));
3309                         }
3310                 }
3311         }
3312 
3313         error = dsl_dataset_snapshot(snaps, props, outnvl);
3314         return (error);
3315 }
3316 
3317 /*
3318  * innvl: "message" -> string
3319  */
3320 /* ARGSUSED */
3321 static int
3322 zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
3323 {
3324         char *message;
3325         spa_t *spa;
3326         int error;
3327         char *poolname;
3328 
3329         /*
3330          * The poolname in the ioctl is not set, we get it from the TSD,
3331          * which was set at the end of the last successful ioctl that allows
3332          * logging.  The secpolicy func already checked that it is set.
3333          * Only one log ioctl is allowed after each successful ioctl, so
3334          * we clear the TSD here.
3335          */
3336         poolname = tsd_get(zfs_allow_log_key);
3337         (void) tsd_set(zfs_allow_log_key, NULL);
3338         error = spa_open(poolname, &spa, FTAG);
3339         strfree(poolname);
3340         if (error != 0)
3341                 return (error);
3342 
3343         if (nvlist_lookup_string(innvl, "message", &message) != 0)  {
3344                 spa_close(spa, FTAG);
3345                 return (SET_ERROR(EINVAL));
3346         }
3347 
3348         if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
3349                 spa_close(spa, FTAG);
3350                 return (SET_ERROR(ENOTSUP));
3351         }
3352 
3353         error = spa_history_log(spa, message);
3354         spa_close(spa, FTAG);
3355         return (error);
3356 }
3357 
3358 /*
3359  * The dp_config_rwlock must not be held when calling this, because the
3360  * unmount may need to write out data.
3361  *
3362  * This function is best-effort.  Callers must deal gracefully if it
3363  * remains mounted (or is remounted after this call).
3364  */
3365 void
3366 zfs_unmount_snap(const char *snapname)
3367 {
3368         vfs_t *vfsp;
3369         zfsvfs_t *zfsvfs;
3370 
3371         if (strchr(snapname, '@') == NULL)
3372                 return;
3373 
3374         vfsp = zfs_get_vfs(snapname);
3375         if (vfsp == NULL)
3376                 return;
3377 
3378         zfsvfs = vfsp->vfs_data;
3379         ASSERT(!dsl_pool_config_held(dmu_objset_pool(zfsvfs->z_os)));
3380 
3381         if (vn_vfswlock(vfsp->vfs_vnodecovered) != 0) {
3382                 VFS_RELE(vfsp);
3383                 return;
3384         }
3385         VFS_RELE(vfsp);
3386 
3387         /*
3388          * Always force the unmount for snapshots.
3389          */
3390         (void) dounmount(vfsp, MS_FORCE, kcred);
3391 }
3392 
3393 /* ARGSUSED */
3394 static int
3395 zfs_unmount_snap_cb(const char *snapname, void *arg)
3396 {
3397         zfs_unmount_snap(snapname);
3398         return (0);
3399 }
3400 
3401 /*
3402  * When a clone is destroyed, its origin may also need to be destroyed,
3403  * in which case it must be unmounted.  This routine will do that unmount
3404  * if necessary.
3405  */
3406 void
3407 zfs_destroy_unmount_origin(const char *fsname)
3408 {
3409         int error;
3410         objset_t *os;
3411         dsl_dataset_t *ds;
3412 
3413         error = dmu_objset_hold(fsname, FTAG, &os);
3414         if (error != 0)
3415                 return;
3416         ds = dmu_objset_ds(os);
3417         if (dsl_dir_is_clone(ds->ds_dir) && DS_IS_DEFER_DESTROY(ds->ds_prev)) {
3418                 char originname[MAXNAMELEN];
3419                 dsl_dataset_name(ds->ds_prev, originname);
3420                 dmu_objset_rele(os, FTAG);
3421                 zfs_unmount_snap(originname);
3422         } else {
3423                 dmu_objset_rele(os, FTAG);
3424         }
3425 }
3426 
3427 /*
3428  * innvl: {
3429  *     "snaps" -> { snapshot1, snapshot2 }
3430  *     (optional boolean) "defer"
3431  * }
3432  *
3433  * outnvl: snapshot -> error code (int32)
3434  *
3435  */
3436 static int
3437 zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
3438 {
3439         int poollen;
3440         nvlist_t *snaps;
3441         nvpair_t *pair;
3442         boolean_t defer;
3443 
3444         if (nvlist_lookup_nvlist(innvl, "snaps", &snaps) != 0)
3445                 return (SET_ERROR(EINVAL));
3446         defer = nvlist_exists(innvl, "defer");
3447 
3448         poollen = strlen(poolname);
3449         for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
3450             pair = nvlist_next_nvpair(snaps, pair)) {
3451                 const char *name = nvpair_name(pair);
3452 
3453                 /*
3454                  * The snap must be in the specified pool.
3455                  */
3456                 if (strncmp(name, poolname, poollen) != 0 ||
3457                     (name[poollen] != '/' && name[poollen] != '@'))
3458                         return (SET_ERROR(EXDEV));
3459 
3460                 zfs_unmount_snap(name);
3461         }
3462 
3463         return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
3464 }
3465 
3466 /*
3467  * inputs:
3468  * zc_name              name of dataset to destroy
3469  * zc_objset_type       type of objset
3470  * zc_defer_destroy     mark for deferred destroy
3471  *
3472  * outputs:             none
3473  */
3474 static int
3475 zfs_ioc_destroy(zfs_cmd_t *zc)
3476 {
3477         int err;
3478         if (strchr(zc->zc_name, '@') && zc->zc_objset_type == DMU_OST_ZFS)
3479                 zfs_unmount_snap(zc->zc_name);
3480 
3481         if (strchr(zc->zc_name, '@'))
3482                 err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
3483         else
3484                 err = dsl_destroy_head(zc->zc_name);
3485         if (zc->zc_objset_type == DMU_OST_ZVOL && err == 0)
3486                 (void) zvol_remove_minor(zc->zc_name);
3487         return (err);
3488 }
3489 
3490 /*
3491  * inputs:
3492  * zc_name      name of dataset to rollback (to most recent snapshot)
3493  *
3494  * outputs:     none
3495  */
3496 static int
3497 zfs_ioc_rollback(zfs_cmd_t *zc)
3498 {
3499         zfsvfs_t *zfsvfs;
3500         int error;
3501 
3502         if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
3503                 error = zfs_suspend_fs(zfsvfs);
3504                 if (error == 0) {
3505                         int resume_err;
3506 
3507                         error = dsl_dataset_rollback(zc->zc_name);
3508                         resume_err = zfs_resume_fs(zfsvfs, zc->zc_name);
3509                         error = error ? error : resume_err;
3510                 }
3511                 VFS_RELE(zfsvfs->z_vfs);
3512         } else {
3513                 error = dsl_dataset_rollback(zc->zc_name);
3514         }
3515         return (error);
3516 }
3517 
3518 static int
3519 recursive_unmount(const char *fsname, void *arg)
3520 {
3521         const char *snapname = arg;
3522         char fullname[MAXNAMELEN];
3523 
3524         (void) snprintf(fullname, sizeof (fullname), "%s@%s", fsname, snapname);
3525         zfs_unmount_snap(fullname);
3526         return (0);
3527 }
3528 
3529 /*
3530  * inputs:
3531  * zc_name      old name of dataset
3532  * zc_value     new name of dataset
3533  * zc_cookie    recursive flag (only valid for snapshots)
3534  *
3535  * outputs:     none
3536  */
3537 static int
3538 zfs_ioc_rename(zfs_cmd_t *zc)
3539 {
3540         boolean_t recursive = zc->zc_cookie & 1;
3541         char *at;
3542 
3543         zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
3544         if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3545             strchr(zc->zc_value, '%'))
3546                 return (SET_ERROR(EINVAL));
3547 
3548         at = strchr(zc->zc_name, '@');
3549         if (at != NULL) {
3550                 /* snaps must be in same fs */
3551                 if (strncmp(zc->zc_name, zc->zc_value, at - zc->zc_name + 1))
3552                         return (SET_ERROR(EXDEV));
3553                 *at = '\0';
3554                 if (zc->zc_objset_type == DMU_OST_ZFS) {
3555                         int error = dmu_objset_find(zc->zc_name,
3556                             recursive_unmount, at + 1,
3557                             recursive ? DS_FIND_CHILDREN : 0);
3558                         if (error != 0)
3559                                 return (error);
3560                 }
3561                 return (dsl_dataset_rename_snapshot(zc->zc_name,
3562                     at + 1, strchr(zc->zc_value, '@') + 1, recursive));
3563         } else {
3564                 if (zc->zc_objset_type == DMU_OST_ZVOL)
3565                         (void) zvol_remove_minor(zc->zc_name);
3566                 return (dsl_dir_rename(zc->zc_name, zc->zc_value));
3567         }
3568 }
3569 
3570 static int
3571 zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
3572 {
3573         const char *propname = nvpair_name(pair);
3574         boolean_t issnap = (strchr(dsname, '@') != NULL);
3575         zfs_prop_t prop = zfs_name_to_prop(propname);
3576         uint64_t intval;
3577         int err;
3578 
3579         if (prop == ZPROP_INVAL) {
3580                 if (zfs_prop_user(propname)) {
3581                         if (err = zfs_secpolicy_write_perms(dsname,
3582                             ZFS_DELEG_PERM_USERPROP, cr))
3583                                 return (err);
3584                         return (0);
3585                 }
3586 
3587                 if (!issnap && zfs_prop_userquota(propname)) {
3588                         const char *perm = NULL;
3589                         const char *uq_prefix =
3590                             zfs_userquota_prop_prefixes[ZFS_PROP_USERQUOTA];
3591                         const char *gq_prefix =
3592                             zfs_userquota_prop_prefixes[ZFS_PROP_GROUPQUOTA];
3593 
3594                         if (strncmp(propname, uq_prefix,
3595                             strlen(uq_prefix)) == 0) {
3596                                 perm = ZFS_DELEG_PERM_USERQUOTA;
3597                         } else if (strncmp(propname, gq_prefix,
3598                             strlen(gq_prefix)) == 0) {
3599                                 perm = ZFS_DELEG_PERM_GROUPQUOTA;
3600                         } else {
3601                                 /* USERUSED and GROUPUSED are read-only */
3602                                 return (SET_ERROR(EINVAL));
3603                         }
3604 
3605                         if (err = zfs_secpolicy_write_perms(dsname, perm, cr))
3606                                 return (err);
3607                         return (0);
3608                 }
3609 
3610                 return (SET_ERROR(EINVAL));
3611         }
3612 
3613         if (issnap)
3614                 return (SET_ERROR(EINVAL));
3615 
3616         if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
3617                 /*
3618                  * dsl_prop_get_all_impl() returns properties in this
3619                  * format.
3620                  */
3621                 nvlist_t *attrs;
3622                 VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
3623                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3624                     &pair) == 0);
3625         }
3626 
3627         /*
3628          * Check that this value is valid for this pool version
3629          */
3630         switch (prop) {
3631         case ZFS_PROP_COMPRESSION:
3632                 /*
3633                  * If the user specified gzip compression, make sure
3634                  * the SPA supports it. We ignore any errors here since
3635                  * we'll catch them later.
3636                  */
3637                 if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3638                     nvpair_value_uint64(pair, &intval) == 0) {
3639                         if (intval >= ZIO_COMPRESS_GZIP_1 &&
3640                             intval <= ZIO_COMPRESS_GZIP_9 &&
3641                             zfs_earlier_version(dsname,
3642                             SPA_VERSION_GZIP_COMPRESSION)) {
3643                                 return (SET_ERROR(ENOTSUP));
3644                         }
3645 
3646                         if (intval == ZIO_COMPRESS_ZLE &&
3647                             zfs_earlier_version(dsname,
3648                             SPA_VERSION_ZLE_COMPRESSION))
3649                                 return (SET_ERROR(ENOTSUP));
3650 
3651                         if (intval == ZIO_COMPRESS_LZ4) {
3652                                 zfeature_info_t *feature =
3653                                     &spa_feature_table[
3654                                     SPA_FEATURE_LZ4_COMPRESS];
3655                                 spa_t *spa;
3656 
3657                                 if ((err = spa_open(dsname, &spa, FTAG)) != 0)
3658                                         return (err);
3659 
3660                                 if (!spa_feature_is_enabled(spa, feature)) {
3661                                         spa_close(spa, FTAG);
3662                                         return (SET_ERROR(ENOTSUP));
3663                                 }
3664                                 spa_close(spa, FTAG);
3665                         }
3666 
3667                         /*
3668                          * If this is a bootable dataset then
3669                          * verify that the compression algorithm
3670                          * is supported for booting. We must return
3671                          * something other than ENOTSUP since it
3672                          * implies a downrev pool version.
3673                          */
3674                         if (zfs_is_bootfs(dsname) &&
3675                             !BOOTFS_COMPRESS_VALID(intval)) {
3676                                 return (SET_ERROR(ERANGE));
3677                         }
3678                 }
3679                 break;
3680 
3681         case ZFS_PROP_COPIES:
3682                 if (zfs_earlier_version(dsname, SPA_VERSION_DITTO_BLOCKS))
3683                         return (SET_ERROR(ENOTSUP));
3684                 break;
3685 
3686         case ZFS_PROP_DEDUP:
3687                 if (zfs_earlier_version(dsname, SPA_VERSION_DEDUP))
3688                         return (SET_ERROR(ENOTSUP));
3689                 break;
3690 
3691         case ZFS_PROP_SHARESMB:
3692                 if (zpl_earlier_version(dsname, ZPL_VERSION_FUID))
3693                         return (SET_ERROR(ENOTSUP));
3694                 break;
3695 
3696         case ZFS_PROP_ACLINHERIT:
3697                 if (nvpair_type(pair) == DATA_TYPE_UINT64 &&
3698                     nvpair_value_uint64(pair, &intval) == 0) {
3699                         if (intval == ZFS_ACL_PASSTHROUGH_X &&
3700                             zfs_earlier_version(dsname,
3701                             SPA_VERSION_PASSTHROUGH_X))
3702                                 return (SET_ERROR(ENOTSUP));
3703                 }
3704                 break;
3705         }
3706 
3707         return (zfs_secpolicy_setprop(dsname, prop, pair, CRED()));
3708 }
3709 
3710 /*
3711  * Checks for a race condition to make sure we don't increment a feature flag
3712  * multiple times.
3713  */
3714 static int
3715 zfs_prop_activate_feature_check(void *arg, dmu_tx_t *tx)
3716 {
3717         spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3718         zfeature_info_t *feature = arg;
3719 
3720         if (!spa_feature_is_active(spa, feature))
3721                 return (0);
3722         else
3723                 return (SET_ERROR(EBUSY));
3724 }
3725 
3726 /*
3727  * The callback invoked on feature activation in the sync task caused by
3728  * zfs_prop_activate_feature.
3729  */
3730 static void
3731 zfs_prop_activate_feature_sync(void *arg, dmu_tx_t *tx)
3732 {
3733         spa_t *spa = dmu_tx_pool(tx)->dp_spa;
3734         zfeature_info_t *feature = arg;
3735 
3736         spa_feature_incr(spa, feature, tx);
3737 }
3738 
3739 /*
3740  * Activates a feature on a pool in response to a property setting. This
3741  * creates a new sync task which modifies the pool to reflect the feature
3742  * as being active.
3743  */
3744 static int
3745 zfs_prop_activate_feature(spa_t *spa, zfeature_info_t *feature)
3746 {
3747         int err;
3748 
3749         /* EBUSY here indicates that the feature is already active */
3750         err = dsl_sync_task(spa_name(spa),
3751             zfs_prop_activate_feature_check, zfs_prop_activate_feature_sync,
3752             feature, 2);
3753 
3754         if (err != 0 && err != EBUSY)
3755                 return (err);
3756         else
3757                 return (0);
3758 }
3759 
3760 /*
3761  * Removes properties from the given props list that fail permission checks
3762  * needed to clear them and to restore them in case of a receive error. For each
3763  * property, make sure we have both set and inherit permissions.
3764  *
3765  * Returns the first error encountered if any permission checks fail. If the
3766  * caller provides a non-NULL errlist, it also gives the complete list of names
3767  * of all the properties that failed a permission check along with the
3768  * corresponding error numbers. The caller is responsible for freeing the
3769  * returned errlist.
3770  *
3771  * If every property checks out successfully, zero is returned and the list
3772  * pointed at by errlist is NULL.
3773  */
3774 static int
3775 zfs_check_clearable(char *dataset, nvlist_t *props, nvlist_t **errlist)
3776 {
3777         zfs_cmd_t *zc;
3778         nvpair_t *pair, *next_pair;
3779         nvlist_t *errors;
3780         int err, rv = 0;
3781 
3782         if (props == NULL)
3783                 return (0);
3784 
3785         VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3786 
3787         zc = kmem_alloc(sizeof (zfs_cmd_t), KM_SLEEP);
3788         (void) strcpy(zc->zc_name, dataset);
3789         pair = nvlist_next_nvpair(props, NULL);
3790         while (pair != NULL) {
3791                 next_pair = nvlist_next_nvpair(props, pair);
3792 
3793                 (void) strcpy(zc->zc_value, nvpair_name(pair));
3794                 if ((err = zfs_check_settable(dataset, pair, CRED())) != 0 ||
3795                     (err = zfs_secpolicy_inherit_prop(zc, NULL, CRED())) != 0) {
3796                         VERIFY(nvlist_remove_nvpair(props, pair) == 0);
3797                         VERIFY(nvlist_add_int32(errors,
3798                             zc->zc_value, err) == 0);
3799                 }
3800                 pair = next_pair;
3801         }
3802         kmem_free(zc, sizeof (zfs_cmd_t));
3803 
3804         if ((pair = nvlist_next_nvpair(errors, NULL)) == NULL) {
3805                 nvlist_free(errors);
3806                 errors = NULL;
3807         } else {
3808                 VERIFY(nvpair_value_int32(pair, &rv) == 0);
3809         }
3810 
3811         if (errlist == NULL)
3812                 nvlist_free(errors);
3813         else
3814                 *errlist = errors;
3815 
3816         return (rv);
3817 }
3818 
3819 static boolean_t
3820 propval_equals(nvpair_t *p1, nvpair_t *p2)
3821 {
3822         if (nvpair_type(p1) == DATA_TYPE_NVLIST) {
3823                 /* dsl_prop_get_all_impl() format */
3824                 nvlist_t *attrs;
3825                 VERIFY(nvpair_value_nvlist(p1, &attrs) == 0);
3826                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3827                     &p1) == 0);
3828         }
3829 
3830         if (nvpair_type(p2) == DATA_TYPE_NVLIST) {
3831                 nvlist_t *attrs;
3832                 VERIFY(nvpair_value_nvlist(p2, &attrs) == 0);
3833                 VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
3834                     &p2) == 0);
3835         }
3836 
3837         if (nvpair_type(p1) != nvpair_type(p2))
3838                 return (B_FALSE);
3839 
3840         if (nvpair_type(p1) == DATA_TYPE_STRING) {
3841                 char *valstr1, *valstr2;
3842 
3843                 VERIFY(nvpair_value_string(p1, (char **)&valstr1) == 0);
3844                 VERIFY(nvpair_value_string(p2, (char **)&valstr2) == 0);
3845                 return (strcmp(valstr1, valstr2) == 0);
3846         } else {
3847                 uint64_t intval1, intval2;
3848 
3849                 VERIFY(nvpair_value_uint64(p1, &intval1) == 0);
3850                 VERIFY(nvpair_value_uint64(p2, &intval2) == 0);
3851                 return (intval1 == intval2);
3852         }
3853 }
3854 
3855 /*
3856  * Remove properties from props if they are not going to change (as determined
3857  * by comparison with origprops). Remove them from origprops as well, since we
3858  * do not need to clear or restore properties that won't change.
3859  */
3860 static void
3861 props_reduce(nvlist_t *props, nvlist_t *origprops)
3862 {
3863         nvpair_t *pair, *next_pair;
3864 
3865         if (origprops == NULL)
3866                 return; /* all props need to be received */
3867 
3868         pair = nvlist_next_nvpair(props, NULL);
3869         while (pair != NULL) {
3870                 const char *propname = nvpair_name(pair);
3871                 nvpair_t *match;
3872 
3873                 next_pair = nvlist_next_nvpair(props, pair);
3874 
3875                 if ((nvlist_lookup_nvpair(origprops, propname,
3876                     &match) != 0) || !propval_equals(pair, match))
3877                         goto next; /* need to set received value */
3878 
3879                 /* don't clear the existing received value */
3880                 (void) nvlist_remove_nvpair(origprops, match);
3881                 /* don't bother receiving the property */
3882                 (void) nvlist_remove_nvpair(props, pair);
3883 next:
3884                 pair = next_pair;
3885         }
3886 }
3887 
3888 #ifdef  DEBUG
3889 static boolean_t zfs_ioc_recv_inject_err;
3890 #endif
3891 
3892 /*
3893  * inputs:
3894  * zc_name              name of containing filesystem
3895  * zc_nvlist_src{_size} nvlist of properties to apply
3896  * zc_value             name of snapshot to create
3897  * zc_string            name of clone origin (if DRR_FLAG_CLONE)
3898  * zc_cookie            file descriptor to recv from
3899  * zc_begin_record      the BEGIN record of the stream (not byteswapped)
3900  * zc_guid              force flag
3901  * zc_cleanup_fd        cleanup-on-exit file descriptor
3902  * zc_action_handle     handle for this guid/ds mapping (or zero on first call)
3903  *
3904  * outputs:
3905  * zc_cookie            number of bytes read
3906  * zc_nvlist_dst{_size} error for each unapplied received property
3907  * zc_obj               zprop_errflags_t
3908  * zc_action_handle     handle for this guid/ds mapping
3909  */
3910 static int
3911 zfs_ioc_recv(zfs_cmd_t *zc)
3912 {
3913         file_t *fp;
3914         dmu_recv_cookie_t drc;
3915         boolean_t force = (boolean_t)zc->zc_guid;
3916         int fd;
3917         int error = 0;
3918         int props_error = 0;
3919         nvlist_t *errors;
3920         offset_t off;
3921         nvlist_t *props = NULL; /* sent properties */
3922         nvlist_t *origprops = NULL; /* existing properties */
3923         char *origin = NULL;
3924         char *tosnap;
3925         char tofs[ZFS_MAXNAMELEN];
3926         boolean_t first_recvd_props = B_FALSE;
3927 
3928         if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
3929             strchr(zc->zc_value, '@') == NULL ||
3930             strchr(zc->zc_value, '%'))
3931                 return (SET_ERROR(EINVAL));
3932 
3933         (void) strcpy(tofs, zc->zc_value);
3934         tosnap = strchr(tofs, '@');
3935         *tosnap++ = '\0';
3936 
3937         if (zc->zc_nvlist_src != NULL &&
3938             (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3939             zc->zc_iflags, &props)) != 0)
3940                 return (error);
3941 
3942         fd = zc->zc_cookie;
3943         fp = getf(fd);
3944         if (fp == NULL) {
3945                 nvlist_free(props);
3946                 return (SET_ERROR(EBADF));
3947         }
3948 
3949         VERIFY(nvlist_alloc(&errors, NV_UNIQUE_NAME, KM_SLEEP) == 0);
3950 
3951         if (zc->zc_string[0])
3952                 origin = zc->zc_string;
3953 
3954         error = dmu_recv_begin(tofs, tosnap,
3955             &zc->zc_begin_record, force, origin, &drc);
3956         if (error != 0)
3957                 goto out;
3958 
3959         /*
3960          * Set properties before we receive the stream so that they are applied
3961          * to the new data. Note that we must call dmu_recv_stream() if
3962          * dmu_recv_begin() succeeds.
3963          */
3964         if (props != NULL && !drc.drc_newfs) {
3965                 if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
3966                     SPA_VERSION_RECVD_PROPS &&
3967                     !dsl_prop_get_hasrecvd(tofs))
3968                         first_recvd_props = B_TRUE;
3969 
3970                 /*
3971                  * If new received properties are supplied, they are to
3972                  * completely replace the existing received properties, so stash
3973                  * away the existing ones.
3974                  */
3975                 if (dsl_prop_get_received(tofs, &origprops) == 0) {
3976                         nvlist_t *errlist = NULL;
3977                         /*
3978                          * Don't bother writing a property if its value won't
3979                          * change (and avoid the unnecessary security checks).
3980                          *
3981                          * The first receive after SPA_VERSION_RECVD_PROPS is a
3982                          * special case where we blow away all local properties
3983                          * regardless.
3984                          */
3985                         if (!first_recvd_props)
3986                                 props_reduce(props, origprops);
3987                         if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
3988                                 (void) nvlist_merge(errors, errlist, 0);
3989                         nvlist_free(errlist);
3990 
3991                         if (clear_received_props(tofs, origprops,
3992                             first_recvd_props ? NULL : props) != 0)
3993                                 zc->zc_obj |= ZPROP_ERR_NOCLEAR;
3994                 } else {
3995                         zc->zc_obj |= ZPROP_ERR_NOCLEAR;
3996                 }
3997         }
3998 
3999         if (props != NULL) {
4000                 props_error = dsl_prop_set_hasrecvd(tofs);
4001 
4002                 if (props_error == 0) {
4003                         (void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
4004                             props, errors);
4005                 }
4006         }
4007 
4008         if (zc->zc_nvlist_dst_size != 0 &&
4009             (nvlist_smush(errors, zc->zc_nvlist_dst_size) != 0 ||
4010             put_nvlist(zc, errors) != 0)) {
4011                 /*
4012                  * Caller made zc->zc_nvlist_dst less than the minimum expected
4013                  * size or supplied an invalid address.
4014                  */
4015                 props_error = SET_ERROR(EINVAL);
4016         }
4017 
4018         off = fp->f_offset;
4019         error = dmu_recv_stream(&drc, fp->f_vnode, &off, zc->zc_cleanup_fd,
4020             &zc->zc_action_handle);
4021 
4022         if (error == 0) {
4023                 zfsvfs_t *zfsvfs = NULL;
4024 
4025                 if (getzfsvfs(tofs, &zfsvfs) == 0) {
4026                         /* online recv */
4027                         int end_err;
4028 
4029                         error = zfs_suspend_fs(zfsvfs);
4030                         /*
4031                          * If the suspend fails, then the recv_end will
4032                          * likely also fail, and clean up after itself.
4033                          */
4034                         end_err = dmu_recv_end(&drc);
4035                         if (error == 0)
4036                                 error = zfs_resume_fs(zfsvfs, tofs);
4037                         error = error ? error : end_err;
4038                         VFS_RELE(zfsvfs->z_vfs);
4039                 } else {
4040                         error = dmu_recv_end(&drc);
4041                 }
4042         }
4043 
4044         zc->zc_cookie = off - fp->f_offset;
4045         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4046                 fp->f_offset = off;
4047 
4048 #ifdef  DEBUG
4049         if (zfs_ioc_recv_inject_err) {
4050                 zfs_ioc_recv_inject_err = B_FALSE;
4051                 error = 1;
4052         }
4053 #endif
4054         /*
4055          * On error, restore the original props.
4056          */
4057         if (error != 0 && props != NULL && !drc.drc_newfs) {
4058                 if (clear_received_props(tofs, props, NULL) != 0) {
4059                         /*
4060                          * We failed to clear the received properties.
4061                          * Since we may have left a $recvd value on the
4062                          * system, we can't clear the $hasrecvd flag.
4063                          */
4064                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4065                 } else if (first_recvd_props) {
4066                         dsl_prop_unset_hasrecvd(tofs);
4067                 }
4068 
4069                 if (origprops == NULL && !drc.drc_newfs) {
4070                         /* We failed to stash the original properties. */
4071                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4072                 }
4073 
4074                 /*
4075                  * dsl_props_set() will not convert RECEIVED to LOCAL on or
4076                  * after SPA_VERSION_RECVD_PROPS, so we need to specify LOCAL
4077                  * explictly if we're restoring local properties cleared in the
4078                  * first new-style receive.
4079                  */
4080                 if (origprops != NULL &&
4081                     zfs_set_prop_nvlist(tofs, (first_recvd_props ?
4082                     ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
4083                     origprops, NULL) != 0) {
4084                         /*
4085                          * We stashed the original properties but failed to
4086                          * restore them.
4087                          */
4088                         zc->zc_obj |= ZPROP_ERR_NORESTORE;
4089                 }
4090         }
4091 out:
4092         nvlist_free(props);
4093         nvlist_free(origprops);
4094         nvlist_free(errors);
4095         releasef(fd);
4096 
4097         if (error == 0)
4098                 error = props_error;
4099 
4100         return (error);
4101 }
4102 
4103 /*
4104  * inputs:
4105  * zc_name      name of snapshot to send
4106  * zc_cookie    file descriptor to send stream to
4107  * zc_obj       fromorigin flag (mutually exclusive with zc_fromobj)
4108  * zc_sendobj   objsetid of snapshot to send
4109  * zc_fromobj   objsetid of incremental fromsnap (may be zero)
4110  * zc_guid      if set, estimate size of stream only.  zc_cookie is ignored.
4111  *              output size in zc_objset_type.
4112  *
4113  * outputs: none
4114  */
4115 static int
4116 zfs_ioc_send(zfs_cmd_t *zc)
4117 {
4118         int error;
4119         offset_t off;
4120         boolean_t estimate = (zc->zc_guid != 0);
4121 
4122         if (zc->zc_obj != 0) {
4123                 dsl_pool_t *dp;
4124                 dsl_dataset_t *tosnap;
4125 
4126                 error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4127                 if (error != 0)
4128                         return (error);
4129 
4130                 error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4131                 if (error != 0) {
4132                         dsl_pool_rele(dp, FTAG);
4133                         return (error);
4134                 }
4135 
4136                 if (dsl_dir_is_clone(tosnap->ds_dir))
4137                         zc->zc_fromobj = tosnap->ds_dir->dd_phys->dd_origin_obj;
4138                 dsl_dataset_rele(tosnap, FTAG);
4139                 dsl_pool_rele(dp, FTAG);
4140         }
4141 
4142         if (estimate) {
4143                 dsl_pool_t *dp;
4144                 dsl_dataset_t *tosnap;
4145                 dsl_dataset_t *fromsnap = NULL;
4146 
4147                 error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4148                 if (error != 0)
4149                         return (error);
4150 
4151                 error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
4152                 if (error != 0) {
4153                         dsl_pool_rele(dp, FTAG);
4154                         return (error);
4155                 }
4156 
4157                 if (zc->zc_fromobj != 0) {
4158                         error = dsl_dataset_hold_obj(dp, zc->zc_fromobj,
4159                             FTAG, &fromsnap);
4160                         if (error != 0) {
4161                                 dsl_dataset_rele(tosnap, FTAG);
4162                                 dsl_pool_rele(dp, FTAG);
4163                                 return (error);
4164                         }
4165                 }
4166 
4167                 error = dmu_send_estimate(tosnap, fromsnap,
4168                     &zc->zc_objset_type);
4169 
4170                 if (fromsnap != NULL)
4171                         dsl_dataset_rele(fromsnap, FTAG);
4172                 dsl_dataset_rele(tosnap, FTAG);
4173                 dsl_pool_rele(dp, FTAG);
4174         } else {
4175                 file_t *fp = getf(zc->zc_cookie);
4176                 if (fp == NULL)
4177                         return (SET_ERROR(EBADF));
4178 
4179                 off = fp->f_offset;
4180                 error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
4181                     zc->zc_fromobj, zc->zc_cookie, fp->f_vnode, &off);
4182 
4183                 if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4184                         fp->f_offset = off;
4185                 releasef(zc->zc_cookie);
4186         }
4187         return (error);
4188 }
4189 
4190 /*
4191  * inputs:
4192  * zc_name      name of snapshot on which to report progress
4193  * zc_cookie    file descriptor of send stream
4194  *
4195  * outputs:
4196  * zc_cookie    number of bytes written in send stream thus far
4197  */
4198 static int
4199 zfs_ioc_send_progress(zfs_cmd_t *zc)
4200 {
4201         dsl_pool_t *dp;
4202         dsl_dataset_t *ds;
4203         dmu_sendarg_t *dsp = NULL;
4204         int error;
4205 
4206         error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
4207         if (error != 0)
4208                 return (error);
4209 
4210         error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
4211         if (error != 0) {
4212                 dsl_pool_rele(dp, FTAG);
4213                 return (error);
4214         }
4215 
4216         mutex_enter(&ds->ds_sendstream_lock);
4217 
4218         /*
4219          * Iterate over all the send streams currently active on this dataset.
4220          * If there's one which matches the specified file descriptor _and_ the
4221          * stream was started by the current process, return the progress of
4222          * that stream.
4223          */
4224         for (dsp = list_head(&ds->ds_sendstreams); dsp != NULL;
4225             dsp = list_next(&ds->ds_sendstreams, dsp)) {
4226                 if (dsp->dsa_outfd == zc->zc_cookie &&
4227                     dsp->dsa_proc == curproc)
4228                         break;
4229         }
4230 
4231         if (dsp != NULL)
4232                 zc->zc_cookie = *(dsp->dsa_off);
4233         else
4234                 error = SET_ERROR(ENOENT);
4235 
4236         mutex_exit(&ds->ds_sendstream_lock);
4237         dsl_dataset_rele(ds, FTAG);
4238         dsl_pool_rele(dp, FTAG);
4239         return (error);
4240 }
4241 
4242 static int
4243 zfs_ioc_inject_fault(zfs_cmd_t *zc)
4244 {
4245         int id, error;
4246 
4247         error = zio_inject_fault(zc->zc_name, (int)zc->zc_guid, &id,
4248             &zc->zc_inject_record);
4249 
4250         if (error == 0)
4251                 zc->zc_guid = (uint64_t)id;
4252 
4253         return (error);
4254 }
4255 
4256 static int
4257 zfs_ioc_clear_fault(zfs_cmd_t *zc)
4258 {
4259         return (zio_clear_fault((int)zc->zc_guid));
4260 }
4261 
4262 static int
4263 zfs_ioc_inject_list_next(zfs_cmd_t *zc)
4264 {
4265         int id = (int)zc->zc_guid;
4266         int error;
4267 
4268         error = zio_inject_list_next(&id, zc->zc_name, sizeof (zc->zc_name),
4269             &zc->zc_inject_record);
4270 
4271         zc->zc_guid = id;
4272 
4273         return (error);
4274 }
4275 
4276 static int
4277 zfs_ioc_error_log(zfs_cmd_t *zc)
4278 {
4279         spa_t *spa;
4280         int error;
4281         size_t count = (size_t)zc->zc_nvlist_dst_size;
4282 
4283         if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
4284                 return (error);
4285 
4286         error = spa_get_errlog(spa, (void *)(uintptr_t)zc->zc_nvlist_dst,
4287             &count);
4288         if (error == 0)
4289                 zc->zc_nvlist_dst_size = count;
4290         else
4291                 zc->zc_nvlist_dst_size = spa_get_errlog_size(spa);
4292 
4293         spa_close(spa, FTAG);
4294 
4295         return (error);
4296 }
4297 
4298 static int
4299 zfs_ioc_clear(zfs_cmd_t *zc)
4300 {
4301         spa_t *spa;
4302         vdev_t *vd;
4303         int error;
4304 
4305         /*
4306          * On zpool clear we also fix up missing slogs
4307          */
4308         mutex_enter(&spa_namespace_lock);
4309         spa = spa_lookup(zc->zc_name);
4310         if (spa == NULL) {
4311                 mutex_exit(&spa_namespace_lock);
4312                 return (SET_ERROR(EIO));
4313         }
4314         if (spa_get_log_state(spa) == SPA_LOG_MISSING) {
4315                 /* we need to let spa_open/spa_load clear the chains */
4316                 spa_set_log_state(spa, SPA_LOG_CLEAR);
4317         }
4318         spa->spa_last_open_failed = 0;
4319         mutex_exit(&spa_namespace_lock);
4320 
4321         if (zc->zc_cookie & ZPOOL_NO_REWIND) {
4322                 error = spa_open(zc->zc_name, &spa, FTAG);
4323         } else {
4324                 nvlist_t *policy;
4325                 nvlist_t *config = NULL;
4326 
4327                 if (zc->zc_nvlist_src == NULL)
4328                         return (SET_ERROR(EINVAL));
4329 
4330                 if ((error = get_nvlist(zc->zc_nvlist_src,
4331                     zc->zc_nvlist_src_size, zc->zc_iflags, &policy)) == 0) {
4332                         error = spa_open_rewind(zc->zc_name, &spa, FTAG,
4333                             policy, &config);
4334                         if (config != NULL) {
4335                                 int err;
4336 
4337                                 if ((err = put_nvlist(zc, config)) != 0)
4338                                         error = err;
4339                                 nvlist_free(config);
4340                         }
4341                         nvlist_free(policy);
4342                 }
4343         }
4344 
4345         if (error != 0)
4346                 return (error);
4347 
4348         spa_vdev_state_enter(spa, SCL_NONE);
4349 
4350         if (zc->zc_guid == 0) {
4351                 vd = NULL;
4352         } else {
4353                 vd = spa_lookup_by_guid(spa, zc->zc_guid, B_TRUE);
4354                 if (vd == NULL) {
4355                         (void) spa_vdev_state_exit(spa, NULL, ENODEV);
4356                         spa_close(spa, FTAG);
4357                         return (SET_ERROR(ENODEV));
4358                 }
4359         }
4360 
4361         vdev_clear(spa, vd);
4362 
4363         (void) spa_vdev_state_exit(spa, NULL, 0);
4364 
4365         /*
4366          * Resume any suspended I/Os.
4367          */
4368         if (zio_resume(spa) != 0)
4369                 error = SET_ERROR(EIO);
4370 
4371         spa_close(spa, FTAG);
4372 
4373         return (error);
4374 }
4375 
4376 static int
4377 zfs_ioc_pool_reopen(zfs_cmd_t *zc)
4378 {
4379         spa_t *spa;
4380         int error;
4381 
4382         error = spa_open(zc->zc_name, &spa, FTAG);
4383         if (error != 0)
4384                 return (error);
4385 
4386         spa_vdev_state_enter(spa, SCL_NONE);
4387 
4388         /*
4389          * If a resilver is already in progress then set the
4390          * spa_scrub_reopen flag to B_TRUE so that we don't restart
4391          * the scan as a side effect of the reopen. Otherwise, let
4392          * vdev_open() decided if a resilver is required.
4393          */
4394         spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
4395         vdev_reopen(spa->spa_root_vdev);
4396         spa->spa_scrub_reopen = B_FALSE;
4397 
4398         (void) spa_vdev_state_exit(spa, NULL, 0);
4399         spa_close(spa, FTAG);
4400         return (0);
4401 }
4402 /*
4403  * inputs:
4404  * zc_name      name of filesystem
4405  * zc_value     name of origin snapshot
4406  *
4407  * outputs:
4408  * zc_string    name of conflicting snapshot, if there is one
4409  */
4410 static int
4411 zfs_ioc_promote(zfs_cmd_t *zc)
4412 {
4413         char *cp;
4414 
4415         /*
4416          * We don't need to unmount *all* the origin fs's snapshots, but
4417          * it's easier.
4418          */
4419         cp = strchr(zc->zc_value, '@');
4420         if (cp)
4421                 *cp = '\0';
4422         (void) dmu_objset_find(zc->zc_value,
4423             zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
4424         return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
4425 }
4426 
4427 /*
4428  * Retrieve a single {user|group}{used|quota}@... property.
4429  *
4430  * inputs:
4431  * zc_name      name of filesystem
4432  * zc_objset_type zfs_userquota_prop_t
4433  * zc_value     domain name (eg. "S-1-234-567-89")
4434  * zc_guid      RID/UID/GID
4435  *
4436  * outputs:
4437  * zc_cookie    property value
4438  */
4439 static int
4440 zfs_ioc_userspace_one(zfs_cmd_t *zc)
4441 {
4442         zfsvfs_t *zfsvfs;
4443         int error;
4444 
4445         if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
4446                 return (SET_ERROR(EINVAL));
4447 
4448         error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4449         if (error != 0)
4450                 return (error);
4451 
4452         error = zfs_userspace_one(zfsvfs,
4453             zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
4454         zfsvfs_rele(zfsvfs, FTAG);
4455 
4456         return (error);
4457 }
4458 
4459 /*
4460  * inputs:
4461  * zc_name              name of filesystem
4462  * zc_cookie            zap cursor
4463  * zc_objset_type       zfs_userquota_prop_t
4464  * zc_nvlist_dst[_size] buffer to fill (not really an nvlist)
4465  *
4466  * outputs:
4467  * zc_nvlist_dst[_size] data buffer (array of zfs_useracct_t)
4468  * zc_cookie    zap cursor
4469  */
4470 static int
4471 zfs_ioc_userspace_many(zfs_cmd_t *zc)
4472 {
4473         zfsvfs_t *zfsvfs;
4474         int bufsize = zc->zc_nvlist_dst_size;
4475 
4476         if (bufsize <= 0)
4477                 return (SET_ERROR(ENOMEM));
4478 
4479         int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
4480         if (error != 0)
4481                 return (error);
4482 
4483         void *buf = kmem_alloc(bufsize, KM_SLEEP);
4484 
4485         error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
4486             buf, &zc->zc_nvlist_dst_size);
4487 
4488         if (error == 0) {
4489                 error = xcopyout(buf,
4490                     (void *)(uintptr_t)zc->zc_nvlist_dst,
4491                     zc->zc_nvlist_dst_size);
4492         }
4493         kmem_free(buf, bufsize);
4494         zfsvfs_rele(zfsvfs, FTAG);
4495 
4496         return (error);
4497 }
4498 
4499 /*
4500  * inputs:
4501  * zc_name              name of filesystem
4502  *
4503  * outputs:
4504  * none
4505  */
4506 static int
4507 zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
4508 {
4509         objset_t *os;
4510         int error = 0;
4511         zfsvfs_t *zfsvfs;
4512 
4513         if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
4514                 if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
4515                         /*
4516                          * If userused is not enabled, it may be because the
4517                          * objset needs to be closed & reopened (to grow the
4518                          * objset_phys_t).  Suspend/resume the fs will do that.
4519                          */
4520                         error = zfs_suspend_fs(zfsvfs);
4521                         if (error == 0)
4522                                 error = zfs_resume_fs(zfsvfs, zc->zc_name);
4523                 }
4524                 if (error == 0)
4525                         error = dmu_objset_userspace_upgrade(zfsvfs->z_os);
4526                 VFS_RELE(zfsvfs->z_vfs);
4527         } else {
4528                 /* XXX kind of reading contents without owning */
4529                 error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4530                 if (error != 0)
4531                         return (error);
4532 
4533                 error = dmu_objset_userspace_upgrade(os);
4534                 dmu_objset_rele(os, FTAG);
4535         }
4536 
4537         return (error);
4538 }
4539 
4540 /*
4541  * We don't want to have a hard dependency
4542  * against some special symbols in sharefs
4543  * nfs, and smbsrv.  Determine them if needed when
4544  * the first file system is shared.
4545  * Neither sharefs, nfs or smbsrv are unloadable modules.
4546  */
4547 int (*znfsexport_fs)(void *arg);
4548 int (*zshare_fs)(enum sharefs_sys_op, share_t *, uint32_t);
4549 int (*zsmbexport_fs)(void *arg, boolean_t add_share);
4550 
4551 int zfs_nfsshare_inited;
4552 int zfs_smbshare_inited;
4553 
4554 ddi_modhandle_t nfs_mod;
4555 ddi_modhandle_t sharefs_mod;
4556 ddi_modhandle_t smbsrv_mod;
4557 kmutex_t zfs_share_lock;
4558 
4559 static int
4560 zfs_init_sharefs()
4561 {
4562         int error;
4563 
4564         ASSERT(MUTEX_HELD(&zfs_share_lock));
4565         /* Both NFS and SMB shares also require sharetab support. */
4566         if (sharefs_mod == NULL && ((sharefs_mod =
4567             ddi_modopen("fs/sharefs",
4568             KRTLD_MODE_FIRST, &error)) == NULL)) {
4569                 return (SET_ERROR(ENOSYS));
4570         }
4571         if (zshare_fs == NULL && ((zshare_fs =
4572             (int (*)(enum sharefs_sys_op, share_t *, uint32_t))
4573             ddi_modsym(sharefs_mod, "sharefs_impl", &error)) == NULL)) {
4574                 return (SET_ERROR(ENOSYS));
4575         }
4576         return (0);
4577 }
4578 
4579 static int
4580 zfs_ioc_share(zfs_cmd_t *zc)
4581 {
4582         int error;
4583         int opcode;
4584 
4585         switch (zc->zc_share.z_sharetype) {
4586         case ZFS_SHARE_NFS:
4587         case ZFS_UNSHARE_NFS:
4588                 if (zfs_nfsshare_inited == 0) {
4589                         mutex_enter(&zfs_share_lock);
4590                         if (nfs_mod == NULL && ((nfs_mod = ddi_modopen("fs/nfs",
4591                             KRTLD_MODE_FIRST, &error)) == NULL)) {
4592                                 mutex_exit(&zfs_share_lock);
4593                                 return (SET_ERROR(ENOSYS));
4594                         }
4595                         if (znfsexport_fs == NULL &&
4596                             ((znfsexport_fs = (int (*)(void *))
4597                             ddi_modsym(nfs_mod,
4598                             "nfs_export", &error)) == NULL)) {
4599                                 mutex_exit(&zfs_share_lock);
4600                                 return (SET_ERROR(ENOSYS));
4601                         }
4602                         error = zfs_init_sharefs();
4603                         if (error != 0) {
4604                                 mutex_exit(&zfs_share_lock);
4605                                 return (SET_ERROR(ENOSYS));
4606                         }
4607                         zfs_nfsshare_inited = 1;
4608                         mutex_exit(&zfs_share_lock);
4609                 }
4610                 break;
4611         case ZFS_SHARE_SMB:
4612         case ZFS_UNSHARE_SMB:
4613                 if (zfs_smbshare_inited == 0) {
4614                         mutex_enter(&zfs_share_lock);
4615                         if (smbsrv_mod == NULL && ((smbsrv_mod =
4616                             ddi_modopen("drv/smbsrv",
4617                             KRTLD_MODE_FIRST, &error)) == NULL)) {
4618                                 mutex_exit(&zfs_share_lock);
4619                                 return (SET_ERROR(ENOSYS));
4620                         }
4621                         if (zsmbexport_fs == NULL && ((zsmbexport_fs =
4622                             (int (*)(void *, boolean_t))ddi_modsym(smbsrv_mod,
4623                             "smb_server_share", &error)) == NULL)) {
4624                                 mutex_exit(&zfs_share_lock);
4625                                 return (SET_ERROR(ENOSYS));
4626                         }
4627                         error = zfs_init_sharefs();
4628                         if (error != 0) {
4629                                 mutex_exit(&zfs_share_lock);
4630                                 return (SET_ERROR(ENOSYS));
4631                         }
4632                         zfs_smbshare_inited = 1;
4633                         mutex_exit(&zfs_share_lock);
4634                 }
4635                 break;
4636         default:
4637                 return (SET_ERROR(EINVAL));
4638         }
4639 
4640         switch (zc->zc_share.z_sharetype) {
4641         case ZFS_SHARE_NFS:
4642         case ZFS_UNSHARE_NFS:
4643                 if (error =
4644                     znfsexport_fs((void *)
4645                     (uintptr_t)zc->zc_share.z_exportdata))
4646                         return (error);
4647                 break;
4648         case ZFS_SHARE_SMB:
4649         case ZFS_UNSHARE_SMB:
4650                 if (error = zsmbexport_fs((void *)
4651                     (uintptr_t)zc->zc_share.z_exportdata,
4652                     zc->zc_share.z_sharetype == ZFS_SHARE_SMB ?
4653                     B_TRUE: B_FALSE)) {
4654                         return (error);
4655                 }
4656                 break;
4657         }
4658 
4659         opcode = (zc->zc_share.z_sharetype == ZFS_SHARE_NFS ||
4660             zc->zc_share.z_sharetype == ZFS_SHARE_SMB) ?
4661             SHAREFS_ADD : SHAREFS_REMOVE;
4662 
4663         /*
4664          * Add or remove share from sharetab
4665          */
4666         error = zshare_fs(opcode,
4667             (void *)(uintptr_t)zc->zc_share.z_sharedata,
4668             zc->zc_share.z_sharemax);
4669 
4670         return (error);
4671 
4672 }
4673 
4674 ace_t full_access[] = {
4675         {(uid_t)-1, ACE_ALL_PERMS, ACE_EVERYONE, 0}
4676 };
4677 
4678 /*
4679  * inputs:
4680  * zc_name              name of containing filesystem
4681  * zc_obj               object # beyond which we want next in-use object #
4682  *
4683  * outputs:
4684  * zc_obj               next in-use object #
4685  */
4686 static int
4687 zfs_ioc_next_obj(zfs_cmd_t *zc)
4688 {
4689         objset_t *os = NULL;
4690         int error;
4691 
4692         error = dmu_objset_hold(zc->zc_name, FTAG, &os);
4693         if (error != 0)
4694                 return (error);
4695 
4696         error = dmu_object_next(os, &zc->zc_obj, B_FALSE,
4697             os->os_dsl_dataset->ds_phys->ds_prev_snap_txg);
4698 
4699         dmu_objset_rele(os, FTAG);
4700         return (error);
4701 }
4702 
4703 /*
4704  * inputs:
4705  * zc_name              name of filesystem
4706  * zc_value             prefix name for snapshot
4707  * zc_cleanup_fd        cleanup-on-exit file descriptor for calling process
4708  *
4709  * outputs:
4710  * zc_value             short name of new snapshot
4711  */
4712 static int
4713 zfs_ioc_tmp_snapshot(zfs_cmd_t *zc)
4714 {
4715         char *snap_name;
4716         char *hold_name;
4717         int error;
4718         minor_t minor;
4719 
4720         error = zfs_onexit_fd_hold(zc->zc_cleanup_fd, &minor);
4721         if (error != 0)
4722                 return (error);
4723 
4724         snap_name = kmem_asprintf("%s-%016llx", zc->zc_value,
4725             (u_longlong_t)ddi_get_lbolt64());
4726         hold_name = kmem_asprintf("%%%s", zc->zc_value);
4727 
4728         error = dsl_dataset_snapshot_tmp(zc->zc_name, snap_name, minor,
4729             hold_name);
4730         if (error == 0)
4731                 (void) strcpy(zc->zc_value, snap_name);
4732         strfree(snap_name);
4733         strfree(hold_name);
4734         zfs_onexit_fd_rele(zc->zc_cleanup_fd);
4735         return (error);
4736 }
4737 
4738 /*
4739  * inputs:
4740  * zc_name              name of "to" snapshot
4741  * zc_value             name of "from" snapshot
4742  * zc_cookie            file descriptor to write diff data on
4743  *
4744  * outputs:
4745  * dmu_diff_record_t's to the file descriptor
4746  */
4747 static int
4748 zfs_ioc_diff(zfs_cmd_t *zc)
4749 {
4750         file_t *fp;
4751         offset_t off;
4752         int error;
4753 
4754         fp = getf(zc->zc_cookie);
4755         if (fp == NULL)
4756                 return (SET_ERROR(EBADF));
4757 
4758         off = fp->f_offset;
4759 
4760         error = dmu_diff(zc->zc_name, zc->zc_value, fp->f_vnode, &off);
4761 
4762         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
4763                 fp->f_offset = off;
4764         releasef(zc->zc_cookie);
4765 
4766         return (error);
4767 }
4768 
4769 /*
4770  * Remove all ACL files in shares dir
4771  */
4772 static int
4773 zfs_smb_acl_purge(znode_t *dzp)
4774 {
4775         zap_cursor_t    zc;
4776         zap_attribute_t zap;
4777         zfsvfs_t *zfsvfs = dzp->z_zfsvfs;
4778         int error;
4779 
4780         for (zap_cursor_init(&zc, zfsvfs->z_os, dzp->z_id);
4781             (error = zap_cursor_retrieve(&zc, &zap)) == 0;
4782             zap_cursor_advance(&zc)) {
4783                 if ((error = VOP_REMOVE(ZTOV(dzp), zap.za_name, kcred,
4784                     NULL, 0)) != 0)
4785                         break;
4786         }
4787         zap_cursor_fini(&zc);
4788         return (error);
4789 }
4790 
4791 static int
4792 zfs_ioc_smb_acl(zfs_cmd_t *zc)
4793 {
4794         vnode_t *vp;
4795         znode_t *dzp;
4796         vnode_t *resourcevp = NULL;
4797         znode_t *sharedir;
4798         zfsvfs_t *zfsvfs;
4799         nvlist_t *nvlist;
4800         char *src, *target;
4801         vattr_t vattr;
4802         vsecattr_t vsec;
4803         int error = 0;
4804 
4805         if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
4806             NO_FOLLOW, NULL, &vp)) != 0)
4807                 return (error);
4808 
4809         /* Now make sure mntpnt and dataset are ZFS */
4810 
4811         if (vp->v_vfsp->vfs_fstype != zfsfstype ||
4812             (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
4813             zc->zc_name) != 0)) {
4814                 VN_RELE(vp);
4815                 return (SET_ERROR(EINVAL));
4816         }
4817 
4818         dzp = VTOZ(vp);
4819         zfsvfs = dzp->z_zfsvfs;
4820         ZFS_ENTER(zfsvfs);
4821 
4822         /*
4823          * Create share dir if its missing.
4824          */
4825         mutex_enter(&zfsvfs->z_lock);
4826         if (zfsvfs->z_shares_dir == 0) {
4827                 dmu_tx_t *tx;
4828 
4829                 tx = dmu_tx_create(zfsvfs->z_os);
4830                 dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, TRUE,
4831                     ZFS_SHARES_DIR);
4832                 dmu_tx_hold_zap(tx, DMU_NEW_OBJECT, FALSE, NULL);
4833                 error = dmu_tx_assign(tx, TXG_WAIT);
4834                 if (error != 0) {
4835                         dmu_tx_abort(tx);
4836                 } else {
4837                         error = zfs_create_share_dir(zfsvfs, tx);
4838                         dmu_tx_commit(tx);
4839                 }
4840                 if (error != 0) {
4841                         mutex_exit(&zfsvfs->z_lock);
4842                         VN_RELE(vp);
4843                         ZFS_EXIT(zfsvfs);
4844                         return (error);
4845                 }
4846         }
4847         mutex_exit(&zfsvfs->z_lock);
4848 
4849         ASSERT(zfsvfs->z_shares_dir);
4850         if ((error = zfs_zget(zfsvfs, zfsvfs->z_shares_dir, &sharedir)) != 0) {
4851                 VN_RELE(vp);
4852                 ZFS_EXIT(zfsvfs);
4853                 return (error);
4854         }
4855 
4856         switch (zc->zc_cookie) {
4857         case ZFS_SMB_ACL_ADD:
4858                 vattr.va_mask = AT_MODE|AT_UID|AT_GID|AT_TYPE;
4859                 vattr.va_type = VREG;
4860                 vattr.va_mode = S_IFREG|0777;
4861                 vattr.va_uid = 0;
4862                 vattr.va_gid = 0;
4863 
4864                 vsec.vsa_mask = VSA_ACE;
4865                 vsec.vsa_aclentp = &full_access;
4866                 vsec.vsa_aclentsz = sizeof (full_access);
4867                 vsec.vsa_aclcnt = 1;
4868 
4869                 error = VOP_CREATE(ZTOV(sharedir), zc->zc_string,
4870                     &vattr, EXCL, 0, &resourcevp, kcred, 0, NULL, &vsec);
4871                 if (resourcevp)
4872                         VN_RELE(resourcevp);
4873                 break;
4874 
4875         case ZFS_SMB_ACL_REMOVE:
4876                 error = VOP_REMOVE(ZTOV(sharedir), zc->zc_string, kcred,
4877                     NULL, 0);
4878                 break;
4879 
4880         case ZFS_SMB_ACL_RENAME:
4881                 if ((error = get_nvlist(zc->zc_nvlist_src,
4882                     zc->zc_nvlist_src_size, zc->zc_iflags, &nvlist)) != 0) {
4883                         VN_RELE(vp);
4884                         ZFS_EXIT(zfsvfs);
4885                         return (error);
4886                 }
4887                 if (nvlist_lookup_string(nvlist, ZFS_SMB_ACL_SRC, &src) ||
4888                     nvlist_lookup_string(nvlist, ZFS_SMB_ACL_TARGET,
4889                     &target)) {
4890                         VN_RELE(vp);
4891                         VN_RELE(ZTOV(sharedir));
4892                         ZFS_EXIT(zfsvfs);
4893                         nvlist_free(nvlist);
4894                         return (error);
4895                 }
4896                 error = VOP_RENAME(ZTOV(sharedir), src, ZTOV(sharedir), target,
4897                     kcred, NULL, 0);
4898                 nvlist_free(nvlist);
4899                 break;
4900 
4901         case ZFS_SMB_ACL_PURGE:
4902                 error = zfs_smb_acl_purge(sharedir);
4903                 break;
4904 
4905         default:
4906                 error = SET_ERROR(EINVAL);
4907                 break;
4908         }
4909 
4910         VN_RELE(vp);
4911         VN_RELE(ZTOV(sharedir));
4912 
4913         ZFS_EXIT(zfsvfs);
4914 
4915         return (error);
4916 }
4917 
4918 /*
4919  * innvl: {
4920  *     "holds" -> { snapname -> holdname (string), ... }
4921  *     (optional) "cleanup_fd" -> fd (int32)
4922  * }
4923  *
4924  * outnvl: {
4925  *     snapname -> error value (int32)
4926  *     ...
4927  * }
4928  */
4929 /* ARGSUSED */
4930 static int
4931 zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
4932 {
4933         nvlist_t *holds;
4934         int cleanup_fd = -1;
4935         int error;
4936         minor_t minor = 0;
4937 
4938         error = nvlist_lookup_nvlist(args, "holds", &holds);
4939         if (error != 0)
4940                 return (SET_ERROR(EINVAL));
4941 
4942         if (nvlist_lookup_int32(args, "cleanup_fd", &cleanup_fd) == 0) {
4943                 error = zfs_onexit_fd_hold(cleanup_fd, &minor);
4944                 if (error != 0)
4945                         return (error);
4946         }
4947 
4948         error = dsl_dataset_user_hold(holds, minor, errlist);
4949         if (minor != 0)
4950                 zfs_onexit_fd_rele(cleanup_fd);
4951         return (error);
4952 }
4953 
4954 /*
4955  * innvl is not used.
4956  *
4957  * outnvl: {
4958  *    holdname -> time added (uint64 seconds since epoch)
4959  *    ...
4960  * }
4961  */
4962 /* ARGSUSED */
4963 static int
4964 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
4965 {
4966         return (dsl_dataset_get_holds(snapname, outnvl));
4967 }
4968 
4969 /*
4970  * innvl: {
4971  *     snapname -> { holdname, ... }
4972  *     ...
4973  * }
4974  *
4975  * outnvl: {
4976  *     snapname -> error value (int32)
4977  *     ...
4978  * }
4979  */
4980 /* ARGSUSED */
4981 static int
4982 zfs_ioc_release(const char *pool, nvlist_t *holds, nvlist_t *errlist)
4983 {
4984         return (dsl_dataset_user_release(holds, errlist));
4985 }
4986 
4987 /*
4988  * inputs:
4989  * zc_name              name of new filesystem or snapshot
4990  * zc_value             full name of old snapshot
4991  *
4992  * outputs:
4993  * zc_cookie            space in bytes
4994  * zc_objset_type       compressed space in bytes
4995  * zc_perm_action       uncompressed space in bytes
4996  */
4997 static int
4998 zfs_ioc_space_written(zfs_cmd_t *zc)
4999 {
5000         int error;
5001         dsl_pool_t *dp;
5002         dsl_dataset_t *new, *old;
5003 
5004         error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
5005         if (error != 0)
5006                 return (error);
5007         error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &new);
5008         if (error != 0) {
5009                 dsl_pool_rele(dp, FTAG);
5010                 return (error);
5011         }
5012         error = dsl_dataset_hold(dp, zc->zc_value, FTAG, &old);
5013         if (error != 0) {
5014                 dsl_dataset_rele(new, FTAG);
5015                 dsl_pool_rele(dp, FTAG);
5016                 return (error);
5017         }
5018 
5019         error = dsl_dataset_space_written(old, new, &zc->zc_cookie,
5020             &zc->zc_objset_type, &zc->zc_perm_action);
5021         dsl_dataset_rele(old, FTAG);
5022         dsl_dataset_rele(new, FTAG);
5023         dsl_pool_rele(dp, FTAG);
5024         return (error);
5025 }
5026 
5027 /*
5028  * innvl: {
5029  *     "firstsnap" -> snapshot name
5030  * }
5031  *
5032  * outnvl: {
5033  *     "used" -> space in bytes
5034  *     "compressed" -> compressed space in bytes
5035  *     "uncompressed" -> uncompressed space in bytes
5036  * }
5037  */
5038 static int
5039 zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
5040 {
5041         int error;
5042         dsl_pool_t *dp;
5043         dsl_dataset_t *new, *old;
5044         char *firstsnap;
5045         uint64_t used, comp, uncomp;
5046 
5047         if (nvlist_lookup_string(innvl, "firstsnap", &firstsnap) != 0)
5048                 return (SET_ERROR(EINVAL));
5049 
5050         error = dsl_pool_hold(lastsnap, FTAG, &dp);
5051         if (error != 0)
5052                 return (error);
5053 
5054         error = dsl_dataset_hold(dp, lastsnap, FTAG, &new);
5055         if (error != 0) {
5056                 dsl_pool_rele(dp, FTAG);
5057                 return (error);
5058         }
5059         error = dsl_dataset_hold(dp, firstsnap, FTAG, &old);
5060         if (error != 0) {
5061                 dsl_dataset_rele(new, FTAG);
5062                 dsl_pool_rele(dp, FTAG);
5063                 return (error);
5064         }
5065 
5066         error = dsl_dataset_space_wouldfree(old, new, &used, &comp, &uncomp);
5067         dsl_dataset_rele(old, FTAG);
5068         dsl_dataset_rele(new, FTAG);
5069         dsl_pool_rele(dp, FTAG);
5070         fnvlist_add_uint64(outnvl, "used", used);
5071         fnvlist_add_uint64(outnvl, "compressed", comp);
5072         fnvlist_add_uint64(outnvl, "uncompressed", uncomp);
5073         return (error);
5074 }
5075 
5076 /*
5077  * innvl: {
5078  *     "fd" -> file descriptor to write stream to (int32)
5079  *     (optional) "fromsnap" -> full snap name to send an incremental from
5080  * }
5081  *
5082  * outnvl is unused
5083  */
5084 /* ARGSUSED */
5085 static int
5086 zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5087 {
5088         int error;
5089         offset_t off;
5090         char *fromname = NULL;
5091         int fd;
5092 
5093         error = nvlist_lookup_int32(innvl, "fd", &fd);
5094         if (error != 0)
5095                 return (SET_ERROR(EINVAL));
5096 
5097         (void) nvlist_lookup_string(innvl, "fromsnap", &fromname);
5098 
5099         file_t *fp = getf(fd);
5100         if (fp == NULL)
5101                 return (SET_ERROR(EBADF));
5102 
5103         off = fp->f_offset;
5104         error = dmu_send(snapname, fromname, fd, fp->f_vnode, &off);
5105 
5106         if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
5107                 fp->f_offset = off;
5108         releasef(fd);
5109         return (error);
5110 }
5111 
5112 /*
5113  * Determine approximately how large a zfs send stream will be -- the number
5114  * of bytes that will be written to the fd supplied to zfs_ioc_send_new().
5115  *
5116  * innvl: {
5117  *     (optional) "fromsnap" -> full snap name to send an incremental from
5118  * }
5119  *
5120  * outnvl: {
5121  *     "space" -> bytes of space (uint64)
5122  * }
5123  */
5124 static int
5125 zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
5126 {
5127         dsl_pool_t *dp;
5128         dsl_dataset_t *fromsnap = NULL;
5129         dsl_dataset_t *tosnap;
5130         int error;
5131         char *fromname;
5132         uint64_t space;
5133 
5134         error = dsl_pool_hold(snapname, FTAG, &dp);
5135         if (error != 0)
5136                 return (error);
5137 
5138         error = dsl_dataset_hold(dp, snapname, FTAG, &tosnap);
5139         if (error != 0) {
5140                 dsl_pool_rele(dp, FTAG);
5141                 return (error);
5142         }
5143 
5144         error = nvlist_lookup_string(innvl, "fromsnap", &fromname);
5145         if (error == 0) {
5146                 error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
5147                 if (error != 0) {
5148                         dsl_dataset_rele(tosnap, FTAG);
5149                         dsl_pool_rele(dp, FTAG);
5150                         return (error);
5151                 }
5152         }
5153 
5154         error = dmu_send_estimate(tosnap, fromsnap, &space);
5155         fnvlist_add_uint64(outnvl, "space", space);
5156 
5157         if (fromsnap != NULL)
5158                 dsl_dataset_rele(fromsnap, FTAG);
5159         dsl_dataset_rele(tosnap, FTAG);
5160         dsl_pool_rele(dp, FTAG);
5161         return (error);
5162 }
5163 
5164 
5165 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
5166 
5167 static void
5168 zfs_ioctl_register_legacy(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5169     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5170     boolean_t log_history, zfs_ioc_poolcheck_t pool_check)
5171 {
5172         zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5173 
5174         ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5175         ASSERT3U(ioc, <, ZFS_IOC_LAST);
5176         ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5177         ASSERT3P(vec->zvec_func, ==, NULL);
5178 
5179         vec->zvec_legacy_func = func;
5180         vec->zvec_secpolicy = secpolicy;
5181         vec->zvec_namecheck = namecheck;
5182         vec->zvec_allow_log = log_history;
5183         vec->zvec_pool_check = pool_check;
5184 }
5185 
5186 /*
5187  * See the block comment at the beginning of this file for details on
5188  * each argument to this function.
5189  */
5190 static void
5191 zfs_ioctl_register(const char *name, zfs_ioc_t ioc, zfs_ioc_func_t *func,
5192     zfs_secpolicy_func_t *secpolicy, zfs_ioc_namecheck_t namecheck,
5193     zfs_ioc_poolcheck_t pool_check, boolean_t smush_outnvlist,
5194     boolean_t allow_log)
5195 {
5196         zfs_ioc_vec_t *vec = &zfs_ioc_vec[ioc - ZFS_IOC_FIRST];
5197 
5198         ASSERT3U(ioc, >=, ZFS_IOC_FIRST);
5199         ASSERT3U(ioc, <, ZFS_IOC_LAST);
5200         ASSERT3P(vec->zvec_legacy_func, ==, NULL);
5201         ASSERT3P(vec->zvec_func, ==, NULL);
5202 
5203         /* if we are logging, the name must be valid */
5204         ASSERT(!allow_log || namecheck != NO_NAME);
5205 
5206         vec->zvec_name = name;
5207         vec->zvec_func = func;
5208         vec->zvec_secpolicy = secpolicy;
5209         vec->zvec_namecheck = namecheck;
5210         vec->zvec_pool_check = pool_check;
5211         vec->zvec_smush_outnvlist = smush_outnvlist;
5212         vec->zvec_allow_log = allow_log;
5213 }
5214 
5215 static void
5216 zfs_ioctl_register_pool(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5217     zfs_secpolicy_func_t *secpolicy, boolean_t log_history,
5218     zfs_ioc_poolcheck_t pool_check)
5219 {
5220         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5221             POOL_NAME, log_history, pool_check);
5222 }
5223 
5224 static void
5225 zfs_ioctl_register_dataset_nolog(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5226     zfs_secpolicy_func_t *secpolicy, zfs_ioc_poolcheck_t pool_check)
5227 {
5228         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5229             DATASET_NAME, B_FALSE, pool_check);
5230 }
5231 
5232 static void
5233 zfs_ioctl_register_pool_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5234 {
5235         zfs_ioctl_register_legacy(ioc, func, zfs_secpolicy_config,
5236             POOL_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5237 }
5238 
5239 static void
5240 zfs_ioctl_register_pool_meta(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5241     zfs_secpolicy_func_t *secpolicy)
5242 {
5243         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5244             NO_NAME, B_FALSE, POOL_CHECK_NONE);
5245 }
5246 
5247 static void
5248 zfs_ioctl_register_dataset_read_secpolicy(zfs_ioc_t ioc,
5249     zfs_ioc_legacy_func_t *func, zfs_secpolicy_func_t *secpolicy)
5250 {
5251         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5252             DATASET_NAME, B_FALSE, POOL_CHECK_SUSPENDED);
5253 }
5254 
5255 static void
5256 zfs_ioctl_register_dataset_read(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func)
5257 {
5258         zfs_ioctl_register_dataset_read_secpolicy(ioc, func,
5259             zfs_secpolicy_read);
5260 }
5261 
5262 static void
5263 zfs_ioctl_register_dataset_modify(zfs_ioc_t ioc, zfs_ioc_legacy_func_t *func,
5264         zfs_secpolicy_func_t *secpolicy)
5265 {
5266         zfs_ioctl_register_legacy(ioc, func, secpolicy,
5267             DATASET_NAME, B_TRUE, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5268 }
5269 
5270 static void
5271 zfs_ioctl_init(void)
5272 {
5273         zfs_ioctl_register("snapshot", ZFS_IOC_SNAPSHOT,
5274             zfs_ioc_snapshot, zfs_secpolicy_snapshot, POOL_NAME,
5275             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5276 
5277         zfs_ioctl_register("log_history", ZFS_IOC_LOG_HISTORY,
5278             zfs_ioc_log_history, zfs_secpolicy_log_history, NO_NAME,
5279             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
5280 
5281         zfs_ioctl_register("space_snaps", ZFS_IOC_SPACE_SNAPS,
5282             zfs_ioc_space_snaps, zfs_secpolicy_read, DATASET_NAME,
5283             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5284 
5285         zfs_ioctl_register("send", ZFS_IOC_SEND_NEW,
5286             zfs_ioc_send_new, zfs_secpolicy_send_new, DATASET_NAME,
5287             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5288 
5289         zfs_ioctl_register("send_space", ZFS_IOC_SEND_SPACE,
5290             zfs_ioc_send_space, zfs_secpolicy_read, DATASET_NAME,
5291             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5292 
5293         zfs_ioctl_register("create", ZFS_IOC_CREATE,
5294             zfs_ioc_create, zfs_secpolicy_create_clone, DATASET_NAME,
5295             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5296 
5297         zfs_ioctl_register("clone", ZFS_IOC_CLONE,
5298             zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
5299             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5300 
5301         zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
5302             zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
5303             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5304 
5305         zfs_ioctl_register("hold", ZFS_IOC_HOLD,
5306             zfs_ioc_hold, zfs_secpolicy_hold, POOL_NAME,
5307             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5308         zfs_ioctl_register("release", ZFS_IOC_RELEASE,
5309             zfs_ioc_release, zfs_secpolicy_release, POOL_NAME,
5310             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
5311 
5312         zfs_ioctl_register("get_holds", ZFS_IOC_GET_HOLDS,
5313             zfs_ioc_get_holds, zfs_secpolicy_read, DATASET_NAME,
5314             POOL_CHECK_SUSPENDED, B_FALSE, B_FALSE);
5315 
5316         /* IOCTLS that use the legacy function signature */
5317 
5318         zfs_ioctl_register_legacy(ZFS_IOC_POOL_FREEZE, zfs_ioc_pool_freeze,
5319             zfs_secpolicy_config, NO_NAME, B_FALSE, POOL_CHECK_READONLY);
5320 
5321         zfs_ioctl_register_pool(ZFS_IOC_POOL_CREATE, zfs_ioc_pool_create,
5322             zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5323         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SCAN,
5324             zfs_ioc_pool_scan);
5325         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_UPGRADE,
5326             zfs_ioc_pool_upgrade);
5327         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ADD,
5328             zfs_ioc_vdev_add);
5329         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_REMOVE,
5330             zfs_ioc_vdev_remove);
5331         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SET_STATE,
5332             zfs_ioc_vdev_set_state);
5333         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_ATTACH,
5334             zfs_ioc_vdev_attach);
5335         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_DETACH,
5336             zfs_ioc_vdev_detach);
5337         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETPATH,
5338             zfs_ioc_vdev_setpath);
5339         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SETFRU,
5340             zfs_ioc_vdev_setfru);
5341         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_SET_PROPS,
5342             zfs_ioc_pool_set_props);
5343         zfs_ioctl_register_pool_modify(ZFS_IOC_VDEV_SPLIT,
5344             zfs_ioc_vdev_split);
5345         zfs_ioctl_register_pool_modify(ZFS_IOC_POOL_REGUID,
5346             zfs_ioc_pool_reguid);
5347 
5348         zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_CONFIGS,
5349             zfs_ioc_pool_configs, zfs_secpolicy_none);
5350         zfs_ioctl_register_pool_meta(ZFS_IOC_POOL_TRYIMPORT,
5351             zfs_ioc_pool_tryimport, zfs_secpolicy_config);
5352         zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_FAULT,
5353             zfs_ioc_inject_fault, zfs_secpolicy_inject);
5354         zfs_ioctl_register_pool_meta(ZFS_IOC_CLEAR_FAULT,
5355             zfs_ioc_clear_fault, zfs_secpolicy_inject);
5356         zfs_ioctl_register_pool_meta(ZFS_IOC_INJECT_LIST_NEXT,
5357             zfs_ioc_inject_list_next, zfs_secpolicy_inject);
5358 
5359         /*
5360          * pool destroy, and export don't log the history as part of
5361          * zfsdev_ioctl, but rather zfs_ioc_pool_export
5362          * does the logging of those commands.
5363          */
5364         zfs_ioctl_register_pool(ZFS_IOC_POOL_DESTROY, zfs_ioc_pool_destroy,
5365             zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5366         zfs_ioctl_register_pool(ZFS_IOC_POOL_EXPORT, zfs_ioc_pool_export,
5367             zfs_secpolicy_config, B_FALSE, POOL_CHECK_NONE);
5368 
5369         zfs_ioctl_register_pool(ZFS_IOC_POOL_STATS, zfs_ioc_pool_stats,
5370             zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5371         zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_PROPS, zfs_ioc_pool_get_props,
5372             zfs_secpolicy_read, B_FALSE, POOL_CHECK_NONE);
5373 
5374         zfs_ioctl_register_pool(ZFS_IOC_ERROR_LOG, zfs_ioc_error_log,
5375             zfs_secpolicy_inject, B_FALSE, POOL_CHECK_SUSPENDED);
5376         zfs_ioctl_register_pool(ZFS_IOC_DSOBJ_TO_DSNAME,
5377             zfs_ioc_dsobj_to_dsname,
5378             zfs_secpolicy_diff, B_FALSE, POOL_CHECK_SUSPENDED);
5379         zfs_ioctl_register_pool(ZFS_IOC_POOL_GET_HISTORY,
5380             zfs_ioc_pool_get_history,
5381             zfs_secpolicy_config, B_FALSE, POOL_CHECK_SUSPENDED);
5382 
5383         zfs_ioctl_register_pool(ZFS_IOC_POOL_IMPORT, zfs_ioc_pool_import,
5384             zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
5385 
5386         zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
5387             zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5388         zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
5389             zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
5390 
5391         zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
5392             zfs_ioc_space_written);
5393         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_RECVD_PROPS,
5394             zfs_ioc_objset_recvd_props);
5395         zfs_ioctl_register_dataset_read(ZFS_IOC_NEXT_OBJ,
5396             zfs_ioc_next_obj);
5397         zfs_ioctl_register_dataset_read(ZFS_IOC_GET_FSACL,
5398             zfs_ioc_get_fsacl);
5399         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_STATS,
5400             zfs_ioc_objset_stats);
5401         zfs_ioctl_register_dataset_read(ZFS_IOC_OBJSET_ZPLPROPS,
5402             zfs_ioc_objset_zplprops);
5403         zfs_ioctl_register_dataset_read(ZFS_IOC_DATASET_LIST_NEXT,
5404             zfs_ioc_dataset_list_next);
5405         zfs_ioctl_register_dataset_read(ZFS_IOC_SNAPSHOT_LIST_NEXT,
5406             zfs_ioc_snapshot_list_next);
5407         zfs_ioctl_register_dataset_read(ZFS_IOC_SEND_PROGRESS,
5408             zfs_ioc_send_progress);
5409 
5410         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_DIFF,
5411             zfs_ioc_diff, zfs_secpolicy_diff);
5412         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_STATS,
5413             zfs_ioc_obj_to_stats, zfs_secpolicy_diff);
5414         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_OBJ_TO_PATH,
5415             zfs_ioc_obj_to_path, zfs_secpolicy_diff);
5416         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_ONE,
5417             zfs_ioc_userspace_one, zfs_secpolicy_userspace_one);
5418         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_USERSPACE_MANY,
5419             zfs_ioc_userspace_many, zfs_secpolicy_userspace_many);
5420         zfs_ioctl_register_dataset_read_secpolicy(ZFS_IOC_SEND,
5421             zfs_ioc_send, zfs_secpolicy_send);
5422 
5423         zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_PROP, zfs_ioc_set_prop,
5424             zfs_secpolicy_none);
5425         zfs_ioctl_register_dataset_modify(ZFS_IOC_DESTROY, zfs_ioc_destroy,
5426             zfs_secpolicy_destroy);
5427         zfs_ioctl_register_dataset_modify(ZFS_IOC_ROLLBACK, zfs_ioc_rollback,
5428             zfs_secpolicy_rollback);
5429         zfs_ioctl_register_dataset_modify(ZFS_IOC_RENAME, zfs_ioc_rename,
5430             zfs_secpolicy_rename);
5431         zfs_ioctl_register_dataset_modify(ZFS_IOC_RECV, zfs_ioc_recv,
5432             zfs_secpolicy_recv);
5433         zfs_ioctl_register_dataset_modify(ZFS_IOC_PROMOTE, zfs_ioc_promote,
5434             zfs_secpolicy_promote);
5435         zfs_ioctl_register_dataset_modify(ZFS_IOC_INHERIT_PROP,
5436             zfs_ioc_inherit_prop, zfs_secpolicy_inherit_prop);
5437         zfs_ioctl_register_dataset_modify(ZFS_IOC_SET_FSACL, zfs_ioc_set_fsacl,
5438             zfs_secpolicy_set_fsacl);
5439 
5440         zfs_ioctl_register_dataset_nolog(ZFS_IOC_SHARE, zfs_ioc_share,
5441             zfs_secpolicy_share, POOL_CHECK_NONE);
5442         zfs_ioctl_register_dataset_nolog(ZFS_IOC_SMB_ACL, zfs_ioc_smb_acl,
5443             zfs_secpolicy_smb_acl, POOL_CHECK_NONE);
5444         zfs_ioctl_register_dataset_nolog(ZFS_IOC_USERSPACE_UPGRADE,
5445             zfs_ioc_userspace_upgrade, zfs_secpolicy_userspace_upgrade,
5446             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5447         zfs_ioctl_register_dataset_nolog(ZFS_IOC_TMP_SNAPSHOT,
5448             zfs_ioc_tmp_snapshot, zfs_secpolicy_tmp_snapshot,
5449             POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY);
5450 }
5451 
5452 int
5453 pool_status_check(const char *name, zfs_ioc_namecheck_t type,
5454     zfs_ioc_poolcheck_t check)
5455 {
5456         spa_t *spa;
5457         int error;
5458 
5459         ASSERT(type == POOL_NAME || type == DATASET_NAME);
5460 
5461         if (check & POOL_CHECK_NONE)
5462                 return (0);
5463 
5464         error = spa_open(name, &spa, FTAG);
5465         if (error == 0) {
5466                 if ((check & POOL_CHECK_SUSPENDED) && spa_suspended(spa))
5467                         error = SET_ERROR(EAGAIN);
5468                 else if ((check & POOL_CHECK_READONLY) && !spa_writeable(spa))
5469                         error = SET_ERROR(EROFS);
5470                 spa_close(spa, FTAG);
5471         }
5472         return (error);
5473 }
5474 
5475 /*
5476  * Find a free minor number.
5477  */
5478 minor_t
5479 zfsdev_minor_alloc(void)
5480 {
5481         static minor_t last_minor;
5482         minor_t m;
5483 
5484         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5485 
5486         for (m = last_minor + 1; m != last_minor; m++) {
5487                 if (m > ZFSDEV_MAX_MINOR)
5488                         m = 1;
5489                 if (ddi_get_soft_state(zfsdev_state, m) == NULL) {
5490                         last_minor = m;
5491                         return (m);
5492                 }
5493         }
5494 
5495         return (0);
5496 }
5497 
5498 static int
5499 zfs_ctldev_init(dev_t *devp)
5500 {
5501         minor_t minor;
5502         zfs_soft_state_t *zs;
5503 
5504         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5505         ASSERT(getminor(*devp) == 0);
5506 
5507         minor = zfsdev_minor_alloc();
5508         if (minor == 0)
5509                 return (SET_ERROR(ENXIO));
5510 
5511         if (ddi_soft_state_zalloc(zfsdev_state, minor) != DDI_SUCCESS)
5512                 return (SET_ERROR(EAGAIN));
5513 
5514         *devp = makedevice(getemajor(*devp), minor);
5515 
5516         zs = ddi_get_soft_state(zfsdev_state, minor);
5517         zs->zss_type = ZSST_CTLDEV;
5518         zfs_onexit_init((zfs_onexit_t **)&zs->zss_data);
5519 
5520         return (0);
5521 }
5522 
5523 static void
5524 zfs_ctldev_destroy(zfs_onexit_t *zo, minor_t minor)
5525 {
5526         ASSERT(MUTEX_HELD(&zfsdev_state_lock));
5527 
5528         zfs_onexit_destroy(zo);
5529         ddi_soft_state_free(zfsdev_state, minor);
5530 }
5531 
5532 void *
5533 zfsdev_get_soft_state(minor_t minor, enum zfs_soft_state_type which)
5534 {
5535         zfs_soft_state_t *zp;
5536 
5537         zp = ddi_get_soft_state(zfsdev_state, minor);
5538         if (zp == NULL || zp->zss_type != which)
5539                 return (NULL);
5540 
5541         return (zp->zss_data);
5542 }
5543 
5544 static int
5545 zfsdev_open(dev_t *devp, int flag, int otyp, cred_t *cr)
5546 {
5547         int error = 0;
5548 
5549         if (getminor(*devp) != 0)
5550                 return (zvol_open(devp, flag, otyp, cr));
5551 
5552         /* This is the control device. Allocate a new minor if requested. */
5553         if (flag & FEXCL) {
5554                 mutex_enter(&zfsdev_state_lock);
5555                 error = zfs_ctldev_init(devp);
5556                 mutex_exit(&zfsdev_state_lock);
5557         }
5558 
5559         return (error);
5560 }
5561 
5562 static int
5563 zfsdev_close(dev_t dev, int flag, int otyp, cred_t *cr)
5564 {
5565         zfs_onexit_t *zo;
5566         minor_t minor = getminor(dev);
5567 
5568         if (minor == 0)
5569                 return (0);
5570 
5571         mutex_enter(&zfsdev_state_lock);
5572         zo = zfsdev_get_soft_state(minor, ZSST_CTLDEV);
5573         if (zo == NULL) {
5574                 mutex_exit(&zfsdev_state_lock);
5575                 return (zvol_close(dev, flag, otyp, cr));
5576         }
5577         zfs_ctldev_destroy(zo, minor);
5578         mutex_exit(&zfsdev_state_lock);
5579 
5580         return (0);
5581 }
5582 
5583 static int
5584 zfsdev_ioctl(dev_t dev, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
5585 {
5586         zfs_cmd_t *zc;
5587         uint_t vecnum;
5588         int error, rc, len;
5589         minor_t minor = getminor(dev);
5590         const zfs_ioc_vec_t *vec;
5591         char *saved_poolname = NULL;
5592         nvlist_t *innvl = NULL;
5593 
5594         if (minor != 0 &&
5595             zfsdev_get_soft_state(minor, ZSST_CTLDEV) == NULL)
5596                 return (zvol_ioctl(dev, cmd, arg, flag, cr, rvalp));
5597 
5598         vecnum = cmd - ZFS_IOC_FIRST;
5599         ASSERT3U(getmajor(dev), ==, ddi_driver_major(zfs_dip));
5600 
5601         if (vecnum >= sizeof (zfs_ioc_vec) / sizeof (zfs_ioc_vec[0]))
5602                 return (SET_ERROR(EINVAL));
5603         vec = &zfs_ioc_vec[vecnum];
5604 
5605         zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
5606 
5607         error = ddi_copyin((void *)arg, zc, sizeof (zfs_cmd_t), flag);
5608         if (error != 0) {
5609                 error = SET_ERROR(EFAULT);
5610                 goto out;
5611         }
5612 
5613         zc->zc_iflags = flag & FKIOCTL;
5614         if (zc->zc_nvlist_src_size != 0) {
5615                 error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
5616                     zc->zc_iflags, &innvl);
5617                 if (error != 0)
5618                         goto out;
5619         }
5620 
5621         /*
5622          * Ensure that all pool/dataset names are valid before we pass down to
5623          * the lower layers.
5624          */
5625         zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
5626         switch (vec->zvec_namecheck) {
5627         case POOL_NAME:
5628                 if (pool_namecheck(zc->zc_name, NULL, NULL) != 0)
5629                         error = SET_ERROR(EINVAL);
5630                 else
5631                         error = pool_status_check(zc->zc_name,
5632                             vec->zvec_namecheck, vec->zvec_pool_check);
5633                 break;
5634 
5635         case DATASET_NAME:
5636                 if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0)
5637                         error = SET_ERROR(EINVAL);
5638                 else
5639                         error = pool_status_check(zc->zc_name,
5640                             vec->zvec_namecheck, vec->zvec_pool_check);
5641                 break;
5642 
5643         case NO_NAME:
5644                 break;
5645         }
5646 
5647 
5648         if (error == 0 && !(flag & FKIOCTL))
5649                 error = vec->zvec_secpolicy(zc, innvl, cr);
5650 
5651         if (error != 0)
5652                 goto out;
5653 
5654         /* legacy ioctls can modify zc_name */
5655         len = strcspn(zc->zc_name, "/@") + 1;
5656         saved_poolname = kmem_alloc(len, KM_SLEEP);
5657         (void) strlcpy(saved_poolname, zc->zc_name, len);
5658 
5659         if (vec->zvec_func != NULL) {
5660                 nvlist_t *outnvl;
5661                 int puterror = 0;
5662                 spa_t *spa;
5663                 nvlist_t *lognv = NULL;
5664 
5665                 ASSERT(vec->zvec_legacy_func == NULL);
5666 
5667                 /*
5668                  * Add the innvl to the lognv before calling the func,
5669                  * in case the func changes the innvl.
5670                  */
5671                 if (vec->zvec_allow_log) {
5672                         lognv = fnvlist_alloc();
5673                         fnvlist_add_string(lognv, ZPOOL_HIST_IOCTL,
5674                             vec->zvec_name);
5675                         if (!nvlist_empty(innvl)) {
5676                                 fnvlist_add_nvlist(lognv, ZPOOL_HIST_INPUT_NVL,
5677                                     innvl);
5678                         }
5679                 }
5680 
5681                 outnvl = fnvlist_alloc();
5682                 error = vec->zvec_func(zc->zc_name, innvl, outnvl);
5683 
5684                 if (error == 0 && vec->zvec_allow_log &&
5685                     spa_open(zc->zc_name, &spa, FTAG) == 0) {
5686                         if (!nvlist_empty(outnvl)) {
5687                                 fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
5688                                     outnvl);
5689                         }
5690                         (void) spa_history_log_nvl(spa, lognv);
5691                         spa_close(spa, FTAG);
5692                 }
5693                 fnvlist_free(lognv);
5694 
5695                 if (!nvlist_empty(outnvl) || zc->zc_nvlist_dst_size != 0) {
5696                         int smusherror = 0;
5697                         if (vec->zvec_smush_outnvlist) {
5698                                 smusherror = nvlist_smush(outnvl,
5699                                     zc->zc_nvlist_dst_size);
5700                         }
5701                         if (smusherror == 0)
5702                                 puterror = put_nvlist(zc, outnvl);
5703                 }
5704 
5705                 if (puterror != 0)
5706                         error = puterror;
5707 
5708                 nvlist_free(outnvl);
5709         } else {
5710                 error = vec->zvec_legacy_func(zc);
5711         }
5712 
5713 out:
5714         nvlist_free(innvl);
5715         rc = ddi_copyout(zc, (void *)arg, sizeof (zfs_cmd_t), flag);
5716         if (error == 0 && rc != 0)
5717                 error = SET_ERROR(EFAULT);
5718         if (error == 0 && vec->zvec_allow_log) {
5719                 char *s = tsd_get(zfs_allow_log_key);
5720                 if (s != NULL)
5721                         strfree(s);
5722                 (void) tsd_set(zfs_allow_log_key, saved_poolname);
5723         } else {
5724                 if (saved_poolname != NULL)
5725                         strfree(saved_poolname);
5726         }
5727 
5728         kmem_free(zc, sizeof (zfs_cmd_t));
5729         return (error);
5730 }
5731 
5732 static int
5733 zfs_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
5734 {
5735         if (cmd != DDI_ATTACH)
5736                 return (DDI_FAILURE);
5737 
5738         if (ddi_create_minor_node(dip, "zfs", S_IFCHR, 0,
5739             DDI_PSEUDO, 0) == DDI_FAILURE)
5740                 return (DDI_FAILURE);
5741 
5742         zfs_dip = dip;
5743 
5744         ddi_report_dev(dip);
5745 
5746         return (DDI_SUCCESS);
5747 }
5748 
5749 static int
5750 zfs_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
5751 {
5752         if (spa_busy() || zfs_busy() || zvol_busy())
5753                 return (DDI_FAILURE);
5754 
5755         if (cmd != DDI_DETACH)
5756                 return (DDI_FAILURE);
5757 
5758         zfs_dip = NULL;
5759 
5760         ddi_prop_remove_all(dip);
5761         ddi_remove_minor_node(dip, NULL);
5762 
5763         return (DDI_SUCCESS);
5764 }
5765 
5766 /*ARGSUSED*/
5767 static int
5768 zfs_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
5769 {
5770         switch (infocmd) {
5771         case DDI_INFO_DEVT2DEVINFO:
5772                 *result = zfs_dip;
5773                 return (DDI_SUCCESS);
5774 
5775         case DDI_INFO_DEVT2INSTANCE:
5776                 *result = (void *)0;
5777                 return (DDI_SUCCESS);
5778         }
5779 
5780         return (DDI_FAILURE);
5781 }
5782 
5783 /*
5784  * OK, so this is a little weird.
5785  *
5786  * /dev/zfs is the control node, i.e. minor 0.
5787  * /dev/zvol/[r]dsk/pool/dataset are the zvols, minor > 0.
5788  *
5789  * /dev/zfs has basically nothing to do except serve up ioctls,
5790  * so most of the standard driver entry points are in zvol.c.
5791  */
5792 static struct cb_ops zfs_cb_ops = {
5793         zfsdev_open,    /* open */
5794         zfsdev_close,   /* close */
5795         zvol_strategy,  /* strategy */
5796         nodev,          /* print */
5797         zvol_dump,      /* dump */
5798         zvol_read,      /* read */
5799         zvol_write,     /* write */
5800         zfsdev_ioctl,   /* ioctl */
5801         nodev,          /* devmap */
5802         nodev,          /* mmap */
5803         nodev,          /* segmap */
5804         nochpoll,       /* poll */
5805         ddi_prop_op,    /* prop_op */
5806         NULL,           /* streamtab */
5807         D_NEW | D_MP | D_64BIT,         /* Driver compatibility flag */
5808         CB_REV,         /* version */
5809         nodev,          /* async read */
5810         nodev,          /* async write */
5811 };
5812 
5813 static struct dev_ops zfs_dev_ops = {
5814         DEVO_REV,       /* version */
5815         0,              /* refcnt */
5816         zfs_info,       /* info */
5817         nulldev,        /* identify */
5818         nulldev,        /* probe */
5819         zfs_attach,     /* attach */
5820         zfs_detach,     /* detach */
5821         nodev,          /* reset */
5822         &zfs_cb_ops,        /* driver operations */
5823         NULL,           /* no bus operations */
5824         NULL,           /* power */
5825         ddi_quiesce_not_needed, /* quiesce */
5826 };
5827 
5828 static struct modldrv zfs_modldrv = {
5829         &mod_driverops,
5830         "ZFS storage pool",
5831         &zfs_dev_ops
5832 };
5833 
5834 static struct modlinkage modlinkage = {
5835         MODREV_1,
5836         (void *)&zfs_modlfs,
5837         (void *)&zfs_modldrv,
5838         NULL
5839 };
5840 
5841 static void
5842 zfs_allow_log_destroy(void *arg)
5843 {
5844         char *poolname = arg;
5845         strfree(poolname);
5846 }
5847 
5848 int
5849 _init(void)
5850 {
5851         int error;
5852 
5853         spa_init(FREAD | FWRITE);
5854         zfs_init();
5855         zvol_init();
5856         zfs_ioctl_init();
5857 
5858         if ((error = mod_install(&modlinkage)) != 0) {
5859                 zvol_fini();
5860                 zfs_fini();
5861                 spa_fini();
5862                 return (error);
5863         }
5864 
5865         tsd_create(&zfs_fsyncer_key, NULL);
5866         tsd_create(&rrw_tsd_key, rrw_tsd_destroy);
5867         tsd_create(&zfs_allow_log_key, zfs_allow_log_destroy);
5868 
5869         error = ldi_ident_from_mod(&modlinkage, &zfs_li);
5870         ASSERT(error == 0);
5871         mutex_init(&zfs_share_lock, NULL, MUTEX_DEFAULT, NULL);
5872 
5873         return (0);
5874 }
5875 
5876 int
5877 _fini(void)
5878 {
5879         int error;
5880 
5881         if (spa_busy() || zfs_busy() || zvol_busy() || zio_injection_enabled)
5882                 return (SET_ERROR(EBUSY));
5883 
5884         if ((error = mod_remove(&modlinkage)) != 0)
5885                 return (error);
5886 
5887         zvol_fini();
5888         zfs_fini();
5889         spa_fini();
5890         if (zfs_nfsshare_inited)
5891                 (void) ddi_modclose(nfs_mod);
5892         if (zfs_smbshare_inited)
5893                 (void) ddi_modclose(smbsrv_mod);
5894         if (zfs_nfsshare_inited || zfs_smbshare_inited)
5895                 (void) ddi_modclose(sharefs_mod);
5896 
5897         tsd_destroy(&zfs_fsyncer_key);
5898         ldi_ident_release(zfs_li);
5899         zfs_li = NULL;
5900         mutex_destroy(&zfs_share_lock);
5901 
5902         return (error);
5903 }
5904 
5905 int
5906 _info(struct modinfo *modinfop)
5907 {
5908         return (mod_info(&modlinkage, modinfop));
5909 }