similar to: 885 dataset creation panics if pool keystatus not ''available''.

Here''s my comments for the preliminary ZFS Crypto review. - Dan Webrev: http://cr.opensolaris.org/~darrenm/zfs-crypto-gate/webrev/ General comments: DEA-1 - SCCS keywords need to be removed DEA-2 - Copyright updated ------------------------------------------------------------------ usr/src/lib/libcryptoutil/common/keyfile.c pkcs11_read_data() This code in pkcs11_read_data() scares

Author: Anthony Scarpino <Anthony.Scarpino at Sun.COM> Repository: /hg/zfs-crypto/gate Latest revision: 04f168232992beb7ebec3b25a69735bb3e2ab678 Total changesets: 1 Log message: zpool create now loads/prompts for key. Use random salt instead of guid. Fix 654 Files: update: usr/src/cmd/zfs/zfs_main.c update: usr/src/cmd/zoneadm/zfs.c update: usr/src/cmd/zpool/zpool_main.c update:

Author: Darren Moffat <darrenm at opensolaris.org> Repository: /hg/zfs-crypto/gate Latest revision: b44ed1cdde88c002bba91ae1bac55f456adcc95d Total changesets: 1 Log message: 293 AES_CBC_PAD keywrap Fix key load once and for all by using xcopyin & uint64_t everywhere Files: update: usr/src/cmd/zfs/zfs_main.c update: usr/src/lib/libzfs/common/libzfs.h update:

Author: Darren Moffat <darrenm at opensolaris.org> Repository: /hg/zfs-crypto/gate Latest revision: 6dded109490e79f82f24b9ba0b3465cb1e6a96e6 Total changesets: 1 Log message: Some of AES_CBC_PAD team missed the last bus home pam_zfs_key module not in this phase fs-local failure if ''zfs mount -a'' fails isn''t our call zoneadm/zfs.c 1866 libzfs_jni needs updated or

http://defect.opensolaris.org/bz/show_bug.cgi?id=782 Summary: zfs keysource=raw fails with keyscope=dataset when file doesn''t exist Classification: Development Product: zfs-crypto Version: unspecified Platform: Other OS/Version: Solaris Status: NEW Severity: minor Priority: P4

http://defect.opensolaris.org/bz/show_bug.cgi?id=871 Summary: ''zpool key -l'' core dumped with keysource=hex,prompt and unmatched entered in Classification: Development Product: zfs-crypto Version: unspecified Platform: Other OS/Version: Windows Status: NEW Severity: minor

http://defect.opensolaris.org/bz/show_bug.cgi?id=2033 Summary: ''zfs create'' causes panic if key file doesn''t exist Classification: Development Product: zfs-crypto Version: unspecified Platform: Other OS/Version: Solaris Status: NEW Severity: minor Priority: P2 Component:

Author: eschrock Repository: /hg/zfs-crypto/gate Revision: 975fad4fa05753c23a18254797cce42bb33b4375 Log message: 6433264 crash when adding spare: nvlist_lookup_string(cnv, "path", &path) == 0 6433406 zfs_open() can leak memory on failure 6433408 namespace_reload() can leak memory on allocation failure 6433679 zpool_refresh_stats() has poor error semantics 6433680 changelist_gather()

Author: Anthony Scarpino <Anthony.Scarpino at Sun.COM> Repository: /hg/zfs-crypto/zfs-crypto-gate Latest revision: 9a17248d7cc3087d39ca752bff184ae5a7831cf6 Total changesets: 1 Log message: passphrase & keymgr load/unload Files: update: usr/src/cmd/zfs/zfs_main.c update: usr/src/cmd/zpool/zpool_main.c update: usr/src/common/zfs/zfs_prop.c update:

Author: lling Repository: /hg/zfs-crypto/gate Revision: 2e20e3394572a9bd1392520e3dc0fff83f57b611 Log message: 6364129 need to unmount any child datasets before doing the rollback 6364126 cannot rollback when a child filesystem is created after a snapshot is taken 6350233 Cannot rename filesystem|volume while it has dependent clones Files: update: usr/src/cmd/zfs/zfs_main.c update:

For the curious, the following is a list of ZFS-related bugs and RFEs integrated in build 29: 6343625 ZFS RBAC integration is incomplete 6343938 ::spa -v tried to read NULL vdev 6344502 placeholder bug for the remaining Makefile cleanup work for ZFS 6345206 zpool iostat doesn''t always line up 6345547 assertion failed: tempreserve < arc.c/4 from zfs_rename 6348792 incorrect error

http://defect.opensolaris.org/bz/show_bug.cgi?id=971 Summary: zfs key -l fails after unloading (keyscope=dataset) Classification: Development Product: zfs-crypto Version: unspecified Platform: Other OS/Version: Solaris Status: NEW Severity: major Priority: P2 Component: other AssignedTo:

Author: Anthony Scarpino <Anthony.Scarpino at Sun.COM> Repository: /hg/zfs-crypto/gate Latest revision: a2a39602f5d2629c170434c6b35e4b6512d33744 Total changesets: 1 Log message: fix pam module to use zpool_load_key property. Add some better error reporting Files: update: usr/src/lib/libzfs/common/libzfs_crypto.c update: usr/src/lib/pam_modules/zfs_key/zfs_key.c

Author: maybee Repository: /hg/zfs-crypto/gate Revision: fc2b4ea43f2c90b103d940d192c1e7f2306f9939 Log message: 6355162 ''zfs restore -d'' should not succeed upon a volume 6368561 zfs panic at zfs:zfsctl_snapdir_inactive() 6374110 ZFS Panic in zfs_lookup() during snapshot creation Files: update: usr/src/lib/libzfs/common/libzfs_dataset.c update:

Author: ahrens Repository: /hg/zfs-crypto/gate Revision: 2515f06e22b3263851614e08b37dd2736737f102 Log message: 6407444 unhandled i/o error from dnode_next_offset_level() 6411780 unhandled i/o error from dnode_sync_free() due to faulty pre-read logic Files: update: usr/src/lib/libzfs/common/libzfs_dataset.c update: usr/src/uts/common/fs/zfs/dmu_tx.c update: usr/src/uts/common/fs/zfs/dnode.c

I''ve noticed that the dsl_dataset_t that points to a given dataset changes during the life time of a ''zfs create'' command. We start out with one dsl_dataset_t* during dmu_objset_create_sync() but by the time we are later mounting the dataset we have a different in memory dsl_dataset_t* referring to the same dataset. This causes me a big issue with per dataset

Author: Darren Moffat <Darren.Moffat at Sun.COM> Repository: /hg/zfs-crypto/gate Latest revision: 5eb1c91e55b41ddcb2da4c9ecb74d0fbdfa07833 Total changesets: 1 Log message: 6766659 zfscrypto: assertion failed: iovcnt != 0, file: ../../common/fs/zfs/zio_crypt.c, line: 1890 Files: update: usr/src/uts/common/fs/zfs/zio.c update: usr/src/uts/common/fs/zfs/zvol.c

Author: Darren Moffat <darrenm at opensolaris.org> Repository: /hg/zfs-crypto/gate Latest revision: 09d6ac706d1fcce8c5e20487fd47af73c4684b98 Total changesets: 1 Log message: 6729887 zio_encrypt_data/zio_decrypt_data should use crypto ctx templates Files: update: usr/src/uts/common/fs/zfs/dmu.c update: usr/src/uts/common/fs/zfs/sys/zio_crypt.h update: usr/src/uts/common/fs/zfs/zio_crypt.c

Author: Darren Moffat <darrenm at opensolaris.org> Repository: /hg/zfs-crypto/gate Latest revision: 9bb308a0778101fcef9ff65336bcec8e68a7bd06 Total changesets: 40 Log message: resynv onnv-gate Files: .hgtags deleted_files/usr/src/cmd/fps/Makefile.inc deleted_files/usr/src/cmd/fps/Makefile.subdirs deleted_files/usr/src/common/crypto/aes/aes_cbc_crypt.c

Anthony Scarpino wrote (elsewhere): > While writing up the man page.. I thought of a few things that I was > wondering if you considered.. > > Can an encrypted dataset (keytype=dataset) reside in a non-encrypted (no > kek defined) pool? I can see a case for and against allowing this when considering it purely at the feature level as users/admins see things. The admin can