]> git.proxmox.com Git - mirror_zfs.git/blobdiff - module/zfs/zfs_ioctl.c
OpenZFS 7614, 9064 - zfs device evacuation/removal
[mirror_zfs.git] / module / zfs / zfs_ioctl.c
index 42889ee037f5c777dea6e1232f81e0cf13384c47..b1ac149b38af200071f6e9663fc6c31921cf76ec 100644 (file)
  * Copyright (c) 2014, 2016 Joyent, Inc. All rights reserved.
  * Copyright 2016 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2014, Joyent, Inc. All rights reserved.
- * Copyright (c) 2011, 2015 by Delphix. All rights reserved.
+ * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
  * Copyright (c) 2013 Steven Hartland. All rights reserved.
+ * Copyright (c) 2014 Integros [integros.com]
+ * Copyright 2016 Toomas Soome <tsoome@me.com>
  * Copyright (c) 2016 Actifio, Inc. All rights reserved.
+ * Copyright (c) 2017, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
+ * Copyright (c) 2017 Datto Inc. All rights reserved.
+ * Copyright 2017 RackTop Systems.
+ * Copyright (c) 2017 Open-E, Inc. All Rights Reserved.
  */
 
 /*
 #include <sys/spa.h>
 #include <sys/spa_impl.h>
 #include <sys/vdev.h>
+#include <sys/vdev_impl.h>
 #include <sys/priv_impl.h>
 #include <sys/dmu.h>
 #include <sys/dsl_dir.h>
 #include <sys/dsl_scan.h>
 #include <sharefs/share.h>
 #include <sys/fm/util.h>
+#include <sys/dsl_crypt.h>
 
 #include <sys/dmu_send.h>
 #include <sys/dsl_destroy.h>
 #include <sys/dsl_bookmark.h>
 #include <sys/dsl_userhold.h>
 #include <sys/zfeature.h>
+#include <sys/zcp.h>
 #include <sys/zio_checksum.h>
+#include <sys/vdev_removal.h>
 
 #include <linux/miscdevice.h>
 #include <linux/slab.h>
 #include "zfs_deleg.h"
 #include "zfs_comutil.h"
 
+#include <sys/lua/lua.h>
+#include <sys/lua/lauxlib.h>
+
 /*
  * Limit maximum nvlist size.  We don't want users passing in insane values
  * for zc->zc_nvlist_src_size, since we will need to allocate that much memory.
@@ -248,10 +261,14 @@ static const char *userquota_perms[] = {
        ZFS_DELEG_PERM_USEROBJQUOTA,
        ZFS_DELEG_PERM_GROUPOBJUSED,
        ZFS_DELEG_PERM_GROUPOBJQUOTA,
+       ZFS_DELEG_PERM_PROJECTUSED,
+       ZFS_DELEG_PERM_PROJECTQUOTA,
+       ZFS_DELEG_PERM_PROJECTOBJUSED,
+       ZFS_DELEG_PERM_PROJECTOBJQUOTA,
 };
 
 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
-static int zfs_ioc_userobjspace_upgrade(zfs_cmd_t *zc);
+static int zfs_ioc_id_quota_upgrade(zfs_cmd_t *zc);
 static int zfs_check_settable(const char *name, nvpair_t *property,
     cred_t *cr);
 static int zfs_check_clearable(char *dataset, nvlist_t *props,
@@ -559,12 +576,12 @@ zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
                 * Try to own the dataset; abort if there is any error,
                 * (e.g., already mounted, in use, or other error).
                 */
-               error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,
+               error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE, B_TRUE,
                    setsl_tag, &os);
                if (error != 0)
                        return (SET_ERROR(EPERM));
 
-               dmu_objset_disown(os, setsl_tag);
+               dmu_objset_disown(os, B_TRUE, setsl_tag);
 
                if (new_default) {
                        needed_priv = PRIV_FILE_DOWNGRADE_SL;
@@ -589,7 +606,7 @@ out_check:
                return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
        return (0);
 #else
-       return (ENOTSUP);
+       return (SET_ERROR(ENOTSUP));
 #endif /* HAVE_MLSLABEL */
 }
 
@@ -1012,9 +1029,8 @@ static int
 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
 {
        int error = 0;
-       nvpair_t *pair;
 
-       for (pair = nvlist_next_nvpair(innvl, NULL);
+       for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
            pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
                char *name = nvpair_name(pair);
                char *hashp = strchr(name, '#');
@@ -1033,6 +1049,14 @@ zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
        return (error);
 }
 
+/* ARGSUSED */
+static int
+zfs_secpolicy_remap(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
+{
+       return (zfs_secpolicy_write_perms(zc->zc_name,
+           ZFS_DELEG_PERM_REMAP, cr));
+}
+
 /* ARGSUSED */
 static int
 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
@@ -1189,10 +1213,14 @@ zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
                    zc->zc_objset_type == ZFS_PROP_USEROBJQUOTA) {
                        if (zc->zc_guid == crgetuid(cr))
                                return (0);
-               } else {
+               } else if (zc->zc_objset_type == ZFS_PROP_GROUPUSED ||
+                   zc->zc_objset_type == ZFS_PROP_GROUPQUOTA ||
+                   zc->zc_objset_type == ZFS_PROP_GROUPOBJUSED ||
+                   zc->zc_objset_type == ZFS_PROP_GROUPOBJQUOTA) {
                        if (groupmember(zc->zc_guid, cr))
                                return (0);
                }
+               /* else is for project quota/used */
        }
 
        return (zfs_secpolicy_write_perms(zc->zc_name,
@@ -1295,6 +1323,20 @@ zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
        return (error);
 }
 
+static int
+zfs_secpolicy_load_key(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
+{
+       return (zfs_secpolicy_write_perms(zc->zc_name,
+           ZFS_DELEG_PERM_LOAD_KEY, cr));
+}
+
+static int
+zfs_secpolicy_change_key(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
+{
+       return (zfs_secpolicy_write_perms(zc->zc_name,
+           ZFS_DELEG_PERM_CHANGE_KEY, cr));
+}
+
 /*
  * Returns the nvlist as specified by the user in the zfs_cmd_t.
  */
@@ -1393,17 +1435,11 @@ put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
        return (error);
 }
 
-static int
-get_zfs_sb(const char *dsname, zfsvfs_t **zfvp)
+int
+getzfsvfs_impl(objset_t *os, zfsvfs_t **zfvp)
 {
-       objset_t *os;
-       int error;
-
-       error = dmu_objset_hold(dsname, FTAG, &os);
-       if (error != 0)
-               return (error);
+       int error = 0;
        if (dmu_objset_type(os) != DMU_OST_ZFS) {
-               dmu_objset_rele(os, FTAG);
                return (SET_ERROR(EINVAL));
        }
 
@@ -1415,6 +1451,20 @@ get_zfs_sb(const char *dsname, zfsvfs_t **zfvp)
                error = SET_ERROR(ESRCH);
        }
        mutex_exit(&os->os_user_ptr_lock);
+       return (error);
+}
+
+int
+getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
+{
+       objset_t *os;
+       int error;
+
+       error = dmu_objset_hold(dsname, FTAG, &os);
+       if (error != 0)
+               return (error);
+
+       error = getzfsvfs_impl(os, zfvp);
        dmu_objset_rele(os, FTAG);
        return (error);
 }
@@ -1426,12 +1476,12 @@ get_zfs_sb(const char *dsname, zfsvfs_t **zfvp)
  * which prevents all inode ops from running.
  */
 static int
-zfs_sb_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
+zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
 {
        int error = 0;
 
-       if (get_zfs_sb(name, zfvp) != 0)
-               error = zfs_sb_create(name, NULL, zfvp);
+       if (getzfsvfs(name, zfvp) != 0)
+               error = zfsvfs_create(name, B_FALSE, zfvp);
        if (error == 0) {
                rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
                    RW_READER, tag);
@@ -1449,15 +1499,15 @@ zfs_sb_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
 }
 
 static void
-zfs_sb_rele(zfsvfs_t *zfsvfs, void *tag)
+zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
 {
        rrm_exit(&zfsvfs->z_teardown_lock, tag);
 
        if (zfsvfs->z_sb) {
                deactivate_super(zfsvfs->z_sb);
        } else {
-               dmu_objset_disown(zfsvfs->z_os, zfsvfs);
-               zfs_sb_free(zfsvfs);
+               dmu_objset_disown(zfsvfs->z_os, B_TRUE, zfsvfs);
+               zfsvfs_free(zfsvfs);
        }
 }
 
@@ -1468,6 +1518,7 @@ zfs_ioc_pool_create(zfs_cmd_t *zc)
        nvlist_t *config, *props = NULL;
        nvlist_t *rootprops = NULL;
        nvlist_t *zplprops = NULL;
+       dsl_crypto_params_t *dcp = NULL;
 
        if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
            zc->zc_iflags, &config)))
@@ -1482,6 +1533,7 @@ zfs_ioc_pool_create(zfs_cmd_t *zc)
 
        if (props) {
                nvlist_t *nvl = NULL;
+               nvlist_t *hidden_args = NULL;
                uint64_t version = SPA_VERSION;
 
                (void) nvlist_lookup_uint64(props,
@@ -1500,6 +1552,18 @@ zfs_ioc_pool_create(zfs_cmd_t *zc)
                        }
                        (void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
                }
+
+               (void) nvlist_lookup_nvlist(props, ZPOOL_HIDDEN_ARGS,
+                   &hidden_args);
+               error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE,
+                   rootprops, hidden_args, &dcp);
+               if (error != 0) {
+                       nvlist_free(config);
+                       nvlist_free(props);
+                       return (error);
+               }
+               (void) nvlist_remove_all(props, ZPOOL_HIDDEN_ARGS);
+
                VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
                error = zfs_fill_zplprops_root(version, rootprops,
                    zplprops, NULL);
@@ -1507,7 +1571,7 @@ zfs_ioc_pool_create(zfs_cmd_t *zc)
                        goto pool_props_bad;
        }
 
-       error = spa_create(zc->zc_name, config, props, zplprops);
+       error = spa_create(zc->zc_name, config, props, zplprops, dcp);
 
        /*
         * Set the remaining root properties
@@ -1521,6 +1585,7 @@ pool_props_bad:
        nvlist_free(zplprops);
        nvlist_free(config);
        nvlist_free(props);
+       dsl_crypto_params_free(dcp, !!error);
 
        return (error);
 }
@@ -1644,7 +1709,7 @@ zfs_ioc_pool_stats(zfs_cmd_t *zc)
 static int
 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
 {
-       nvlist_t *tryconfig, *config;
+       nvlist_t *tryconfig, *config = NULL;
        int error;
 
        if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
@@ -1668,6 +1733,7 @@ zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
  * inputs:
  * zc_name              name of the pool
  * zc_cookie            scan func (pool_scan_func_t)
+ * zc_flags             scrub pause/resume flag (pool_scrub_cmd_t)
  */
 static int
 zfs_ioc_pool_scan(zfs_cmd_t *zc)
@@ -1675,10 +1741,15 @@ zfs_ioc_pool_scan(zfs_cmd_t *zc)
        spa_t *spa;
        int error;
 
+       if (zc->zc_flags >= POOL_SCRUB_FLAGS_END)
+               return (SET_ERROR(EINVAL));
+
        if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
                return (error);
 
-       if (zc->zc_cookie == POOL_SCAN_NONE)
+       if (zc->zc_flags == POOL_SCRUB_PAUSE)
+               error = spa_scrub_pause_resume(spa, POOL_SCRUB_PAUSE);
+       else if (zc->zc_cookie == POOL_SCAN_NONE)
                error = spa_scan_stop(spa);
        else
                error = spa_scan(spa, zc->zc_cookie);
@@ -1790,15 +1861,16 @@ zfs_ioc_obj_to_path(zfs_cmd_t *zc)
        int error;
 
        /* XXX reading from objset not owned */
-       if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
+       if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
+           FTAG, &os)) != 0)
                return (error);
        if (dmu_objset_type(os) != DMU_OST_ZFS) {
-               dmu_objset_rele(os, FTAG);
+               dmu_objset_rele_flags(os, B_TRUE, FTAG);
                return (SET_ERROR(EINVAL));
        }
        error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
            sizeof (zc->zc_value));
-       dmu_objset_rele(os, FTAG);
+       dmu_objset_rele_flags(os, B_TRUE, FTAG);
 
        return (error);
 }
@@ -1819,15 +1891,16 @@ zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
        int error;
 
        /* XXX reading from objset not owned */
-       if ((error = dmu_objset_hold(zc->zc_name, FTAG, &os)) != 0)
+       if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
+           FTAG, &os)) != 0)
                return (error);
        if (dmu_objset_type(os) != DMU_OST_ZFS) {
-               dmu_objset_rele(os, FTAG);
+               dmu_objset_rele_flags(os, B_TRUE, FTAG);
                return (SET_ERROR(EINVAL));
        }
        error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
            sizeof (zc->zc_value));
-       dmu_objset_rele(os, FTAG);
+       dmu_objset_rele_flags(os, B_TRUE, FTAG);
 
        return (error);
 }
@@ -1856,8 +1929,8 @@ zfs_ioc_vdev_add(zfs_cmd_t *zc)
 /*
  * inputs:
  * zc_name             name of the pool
- * zc_nvlist_conf      nvlist of devices to remove
- * zc_cookie           to stop the remove?
+ * zc_guid             guid of vdev to remove
+ * zc_cookie           cancel removal
  */
 static int
 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
@@ -1868,7 +1941,11 @@ zfs_ioc_vdev_remove(zfs_cmd_t *zc)
        error = spa_open(zc->zc_name, &spa, FTAG);
        if (error != 0)
                return (error);
-       error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
+       if (zc->zc_cookie != 0) {
+               error = spa_vdev_remove_cancel(spa);
+       } else {
+               error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
+       }
        spa_close(spa, FTAG);
        return (error);
 }
@@ -1893,7 +1970,8 @@ zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
 
        case VDEV_STATE_FAULTED:
                if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
-                   zc->zc_obj != VDEV_AUX_EXTERNAL)
+                   zc->zc_obj != VDEV_AUX_EXTERNAL &&
+                   zc->zc_obj != VDEV_AUX_EXTERNAL_PERSIST)
                        zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
 
                error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
@@ -2349,10 +2427,10 @@ zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
        rid = valary[1];
        quota = valary[2];
 
-       err = zfs_sb_hold(dsname, FTAG, &zfsvfs, B_FALSE);
+       err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
        if (err == 0) {
                err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
-               zfs_sb_rele(zfsvfs, FTAG);
+               zfsvfs_rele(zfsvfs, FTAG);
        }
 
        return (err);
@@ -2372,7 +2450,8 @@ zfs_prop_set_special(const char *dsname, zprop_source_t source,
 {
        const char *propname = nvpair_name(pair);
        zfs_prop_t prop = zfs_name_to_prop(propname);
-       uint64_t intval;
+       uint64_t intval = 0;
+       char *strval = NULL;
        int err = -1;
 
        if (prop == ZPROP_INVAL) {
@@ -2388,10 +2467,12 @@ zfs_prop_set_special(const char *dsname, zprop_source_t source,
                    &pair) == 0);
        }
 
-       if (zfs_prop_get_type(prop) == PROP_TYPE_STRING)
-               return (-1);
-
-       VERIFY(0 == nvpair_value_uint64(pair, &intval));
+       /* all special properties are numeric except for keylocation */
+       if (zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
+               strval = fnvpair_value_string(pair);
+       } else {
+               intval = fnvpair_value_uint64(pair);
+       }
 
        switch (prop) {
        case ZFS_PROP_QUOTA:
@@ -2408,6 +2489,16 @@ zfs_prop_set_special(const char *dsname, zprop_source_t source,
                } else {
                        err = dsl_dir_activate_fs_ss_limit(dsname);
                }
+               /*
+                * Set err to -1 to force the zfs_set_prop_nvlist code down the
+                * default path to set the value in the nvlist.
+                */
+               if (err == 0)
+                       err = -1;
+               break;
+       case ZFS_PROP_KEYLOCATION:
+               err = dsl_crypto_can_set_keylocation(dsname, strval);
+
                /*
                 * Set err to -1 to force the zfs_set_prop_nvlist code down the
                 * default path to set the value in the nvlist.
@@ -2427,15 +2518,18 @@ zfs_prop_set_special(const char *dsname, zprop_source_t source,
        case ZFS_PROP_SNAPDEV:
                err = zvol_set_snapdev(dsname, source, intval);
                break;
+       case ZFS_PROP_VOLMODE:
+               err = zvol_set_volmode(dsname, source, intval);
+               break;
        case ZFS_PROP_VERSION:
        {
                zfsvfs_t *zfsvfs;
 
-               if ((err = zfs_sb_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
+               if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
                        break;
 
                err = zfs_set_version(zfsvfs, intval);
-               zfs_sb_rele(zfsvfs, FTAG);
+               zfsvfs_rele(zfsvfs, FTAG);
 
                if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
                        zfs_cmd_t *zc;
@@ -2443,7 +2537,7 @@ zfs_prop_set_special(const char *dsname, zprop_source_t source,
                        zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
                        (void) strcpy(zc->zc_name, dsname);
                        (void) zfs_ioc_userspace_upgrade(zc);
-                       (void) zfs_ioc_userobjspace_upgrade(zc);
+                       (void) zfs_ioc_id_quota_upgrade(zc);
                        kmem_free(zc, sizeof (zfs_cmd_t));
                }
                break;
@@ -2495,7 +2589,11 @@ retry:
                }
 
                /* Validate value type */
-               if (err == 0 && prop == ZPROP_INVAL) {
+               if (err == 0 && source == ZPROP_SRC_INHERITED) {
+                       /* inherited properties are expected to be booleans */
+                       if (nvpair_type(propval) != DATA_TYPE_BOOLEAN)
+                               err = SET_ERROR(EINVAL);
+               } else if (err == 0 && prop == ZPROP_INVAL) {
                        if (zfs_prop_user(propname)) {
                                if (nvpair_type(propval) != DATA_TYPE_STRING)
                                        err = SET_ERROR(EINVAL);
@@ -2540,7 +2638,11 @@ retry:
                        err = zfs_check_settable(dsname, pair, CRED());
 
                if (err == 0) {
-                       err = zfs_prop_set_special(dsname, source, pair);
+                       if (source == ZPROP_SRC_INHERITED)
+                               err = -1; /* does not need special handling */
+                       else
+                               err = zfs_prop_set_special(dsname, source,
+                                   pair);
                        if (err == -1) {
                                /*
                                 * For better performance we build up a list of
@@ -2592,6 +2694,9 @@ retry:
                                strval = fnvpair_value_string(propval);
                                err = dsl_prop_set_string(dsname, propname,
                                    source, strval);
+                       } else if (nvpair_type(propval) == DATA_TYPE_BOOLEAN) {
+                               err = dsl_prop_inherit(dsname, propname,
+                                   source);
                        } else {
                                intval = fnvpair_value_uint64(propval);
                                err = dsl_prop_set_int(dsname, propname, source,
@@ -2744,54 +2849,12 @@ zfs_ioc_inherit_prop(zfs_cmd_t *zc)
        zprop_source_t source = (received
            ? ZPROP_SRC_NONE            /* revert to received value, if any */
            : ZPROP_SRC_INHERITED);     /* explicitly inherit */
+       nvlist_t *dummy;
+       nvpair_t *pair;
+       zprop_type_t type;
+       int err;
 
-       if (received) {
-               nvlist_t *dummy;
-               nvpair_t *pair;
-               zprop_type_t type;
-               int err;
-
-               /*
-                * zfs_prop_set_special() expects properties in the form of an
-                * nvpair with type info.
-                */
-               if (prop == ZPROP_INVAL) {
-                       if (!zfs_prop_user(propname))
-                               return (SET_ERROR(EINVAL));
-
-                       type = PROP_TYPE_STRING;
-               } else if (prop == ZFS_PROP_VOLSIZE ||
-                   prop == ZFS_PROP_VERSION) {
-                       return (SET_ERROR(EINVAL));
-               } else {
-                       type = zfs_prop_get_type(prop);
-               }
-
-               VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
-
-               switch (type) {
-               case PROP_TYPE_STRING:
-                       VERIFY(0 == nvlist_add_string(dummy, propname, ""));
-                       break;
-               case PROP_TYPE_NUMBER:
-               case PROP_TYPE_INDEX:
-                       VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
-                       break;
-               default:
-                       nvlist_free(dummy);
-                       return (SET_ERROR(EINVAL));
-               }
-
-               pair = nvlist_next_nvpair(dummy, NULL);
-               if (pair == NULL) {
-                       nvlist_free(dummy);
-                       return (SET_ERROR(EINVAL));
-               }
-               err = zfs_prop_set_special(zc->zc_name, source, pair);
-               nvlist_free(dummy);
-               if (err != -1)
-                       return (err); /* special property already handled */
-       } else {
+       if (!received) {
                /*
                 * Only check this in the non-received case. We want to allow
                 * 'inherit -S' to revert non-inheritable properties like quota
@@ -2802,8 +2865,49 @@ zfs_ioc_inherit_prop(zfs_cmd_t *zc)
                        return (SET_ERROR(EINVAL));
        }
 
-       /* property name has been validated by zfs_secpolicy_inherit_prop() */
-       return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
+       if (prop == ZPROP_INVAL) {
+               if (!zfs_prop_user(propname))
+                       return (SET_ERROR(EINVAL));
+
+               type = PROP_TYPE_STRING;
+       } else if (prop == ZFS_PROP_VOLSIZE || prop == ZFS_PROP_VERSION) {
+               return (SET_ERROR(EINVAL));
+       } else {
+               type = zfs_prop_get_type(prop);
+       }
+
+       /*
+        * zfs_prop_set_special() expects properties in the form of an
+        * nvpair with type info.
+        */
+       dummy = fnvlist_alloc();
+
+       switch (type) {
+       case PROP_TYPE_STRING:
+               VERIFY(0 == nvlist_add_string(dummy, propname, ""));
+               break;
+       case PROP_TYPE_NUMBER:
+       case PROP_TYPE_INDEX:
+               VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
+               break;
+       default:
+               err = SET_ERROR(EINVAL);
+               goto errout;
+       }
+
+       pair = nvlist_next_nvpair(dummy, NULL);
+       if (pair == NULL) {
+               err = SET_ERROR(EINVAL);
+       } else {
+               err = zfs_prop_set_special(zc->zc_name, source, pair);
+               if (err == -1) /* property is not "special", needs handling */
+                       err = dsl_prop_inherit(zc->zc_name, zc->zc_value,
+                           source);
+       }
+
+errout:
+       nvlist_free(dummy);
+       return (err);
 }
 
 static int
@@ -2829,7 +2933,7 @@ zfs_ioc_pool_set_props(zfs_cmd_t *zc)
                mutex_enter(&spa_namespace_lock);
                if ((spa = spa_lookup(zc->zc_name)) != NULL) {
                        spa_configfile_set(spa, props, B_FALSE);
-                       spa_config_sync(spa, B_FALSE, B_TRUE);
+                       spa_write_cachefile(spa, B_FALSE, B_TRUE);
                }
                mutex_exit(&spa_namespace_lock);
                if (spa != NULL) {
@@ -2996,6 +3100,9 @@ zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
 
        ASSERT(zplprops != NULL);
 
+       if (os != NULL && os->os_phys->os_type != DMU_OST_ZFS)
+               return (SET_ERROR(EINVAL));
+
        /*
         * Pull out creator prop choices, if any.
         */
@@ -3127,6 +3234,8 @@ zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
  * innvl: {
  *     "type" -> dmu_objset_type_t (int32)
  *     (optional) "props" -> { prop -> value }
+ *     (optional) "hidden_args" -> { "wkeydata" -> value }
+ *         raw uint8_t array of encryption wrapping key data (32 bytes)
  * }
  *
  * outnvl: propname -> error code (int32)
@@ -3137,15 +3246,18 @@ zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
        int error = 0;
        zfs_creat_t zct = { 0 };
        nvlist_t *nvprops = NULL;
+       nvlist_t *hidden_args = NULL;
        void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
        int32_t type32;
        dmu_objset_type_t type;
        boolean_t is_insensitive = B_FALSE;
+       dsl_crypto_params_t *dcp = NULL;
 
        if (nvlist_lookup_int32(innvl, "type", &type32) != 0)
                return (SET_ERROR(EINVAL));
        type = type32;
        (void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
+       (void) nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);
 
        switch (type) {
        case DMU_OST_ZFS:
@@ -3211,9 +3323,18 @@ zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
                }
        }
 
+       error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE, nvprops,
+           hidden_args, &dcp);
+       if (error != 0) {
+               nvlist_free(zct.zct_zplprops);
+               return (error);
+       }
+
        error = dmu_objset_create(fsname, type,
-           is_insensitive ? DS_FLAG_CI_DATASET : 0, cbfunc, &zct);
+           is_insensitive ? DS_FLAG_CI_DATASET : 0, dcp, cbfunc, &zct);
+
        nvlist_free(zct.zct_zplprops);
+       dsl_crypto_params_free(dcp, !!error);
 
        /*
         * It would be nice to do this atomically.
@@ -3248,6 +3369,8 @@ zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
  * innvl: {
  *     "origin" -> name of origin snapshot
  *     (optional) "props" -> { prop -> value }
+ *     (optional) "hidden_args" -> { "wkeydata" -> value }
+ *         raw uint8_t array of encryption wrapping key data (32 bytes)
  * }
  *
  * outputs:
@@ -3270,9 +3393,8 @@ zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
 
        if (dataset_namecheck(origin_name, NULL, NULL) != 0)
                return (SET_ERROR(EINVAL));
+
        error = dmu_objset_clone(fsname, origin_name);
-       if (error != 0)
-               return (error);
 
        /*
         * It would be nice to do this atomically.
@@ -3286,6 +3408,17 @@ zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
        return (error);
 }
 
+/* ARGSUSED */
+static int
+zfs_ioc_remap(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
+{
+       if (strchr(fsname, '@') ||
+           strchr(fsname, '%'))
+               return (SET_ERROR(EINVAL));
+
+       return (dmu_objset_remap_indirects(fsname));
+}
+
 /*
  * innvl: {
  *     "snaps" -> { snapshot1, snapshot2 }
@@ -3300,7 +3433,7 @@ zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
        nvlist_t *snaps;
        nvlist_t *props = NULL;
        int error, poollen;
-       nvpair_t *pair, *pair2;
+       nvpair_t *pair;
 
        (void) nvlist_lookup_nvlist(innvl, "props", &props);
        if ((error = zfs_check_userprops(poolname, props)) != 0)
@@ -3334,7 +3467,7 @@ zfs_ioc_snapshot(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
                        return (SET_ERROR(EXDEV));
 
                /* This must be the only snap of this fs. */
-               for (pair2 = nvlist_next_nvpair(snaps, pair);
+               for (nvpair_t *pair2 = nvlist_next_nvpair(snaps, pair);
                    pair2 != NULL; pair2 = nvlist_next_nvpair(snaps, pair2)) {
                        if (strncmp(name, nvpair_name(pair2), cp - name + 1)
                            == 0) {
@@ -3401,26 +3534,21 @@ zfs_ioc_log_history(const char *unused, nvlist_t *innvl, nvlist_t *outnvl)
  * Returns 0 if the argument is not a snapshot, or it is not currently a
  * filesystem, or we were able to unmount it.  Returns error code otherwise.
  */
-int
+void
 zfs_unmount_snap(const char *snapname)
 {
-       int err;
-
        if (strchr(snapname, '@') == NULL)
-               return (0);
-
-       err = zfsctl_snapshot_unmount((char *)snapname, MNT_FORCE);
-       if (err != 0 && err != ENOENT)
-               return (SET_ERROR(err));
+               return;
 
-       return (0);
+       (void) zfsctl_snapshot_unmount((char *)snapname, MNT_FORCE);
 }
 
 /* ARGSUSED */
 static int
 zfs_unmount_snap_cb(const char *snapname, void *arg)
 {
-       return (zfs_unmount_snap(snapname));
+       zfs_unmount_snap(snapname);
+       return (0);
 }
 
 /*
@@ -3443,7 +3571,7 @@ zfs_destroy_unmount_origin(const char *fsname)
                char originname[ZFS_MAX_DATASET_NAME_LEN];
                dsl_dataset_name(ds->ds_prev, originname);
                dmu_objset_rele(os, FTAG);
-               (void) zfs_unmount_snap(originname);
+               zfs_unmount_snap(originname);
        } else {
                dmu_objset_rele(os, FTAG);
        }
@@ -3471,7 +3599,7 @@ zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
 
        for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
            pair = nvlist_next_nvpair(snaps, pair)) {
-               (void) zfs_unmount_snap(nvpair_name(pair));
+               zfs_unmount_snap(nvpair_name(pair));
        }
 
        return (dsl_destroy_snapshots_nvl(snaps, defer, outnvl));
@@ -3492,9 +3620,7 @@ zfs_ioc_destroy_snaps(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
 static int
 zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
 {
-       nvpair_t *pair, *pair2;
-
-       for (pair = nvlist_next_nvpair(innvl, NULL);
+       for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
            pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
                char *snap_name;
 
@@ -3506,7 +3632,7 @@ zfs_ioc_bookmark(const char *poolname, nvlist_t *innvl, nvlist_t *outnvl)
 
 
                /* Verify that the keys (bookmarks) are unique */
-               for (pair2 = nvlist_next_nvpair(innvl, pair);
+               for (nvpair_t *pair2 = nvlist_next_nvpair(innvl, pair);
                    pair2 != NULL; pair2 = nvlist_next_nvpair(innvl, pair2)) {
                        if (strcmp(nvpair_name(pair), nvpair_name(pair2)) == 0)
                                return (SET_ERROR(EINVAL));
@@ -3546,10 +3672,9 @@ zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
     nvlist_t *outnvl)
 {
        int error, poollen;
-       nvpair_t *pair;
 
        poollen = strlen(poolname);
-       for (pair = nvlist_next_nvpair(innvl, NULL);
+       for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
            pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
                const char *name = nvpair_name(pair);
                const char *cp = strchr(name, '#');
@@ -3574,6 +3699,40 @@ zfs_ioc_destroy_bookmarks(const char *poolname, nvlist_t *innvl,
        return (error);
 }
 
+static int
+zfs_ioc_channel_program(const char *poolname, nvlist_t *innvl,
+    nvlist_t *outnvl)
+{
+       char *program;
+       uint64_t instrlimit, memlimit;
+       boolean_t sync_flag;
+       nvpair_t *nvarg = NULL;
+
+       if (0 != nvlist_lookup_string(innvl, ZCP_ARG_PROGRAM, &program)) {
+               return (EINVAL);
+       }
+       if (0 != nvlist_lookup_boolean_value(innvl, ZCP_ARG_SYNC, &sync_flag)) {
+               sync_flag = B_TRUE;
+       }
+       if (0 != nvlist_lookup_uint64(innvl, ZCP_ARG_INSTRLIMIT, &instrlimit)) {
+               instrlimit = ZCP_DEFAULT_INSTRLIMIT;
+       }
+       if (0 != nvlist_lookup_uint64(innvl, ZCP_ARG_MEMLIMIT, &memlimit)) {
+               memlimit = ZCP_DEFAULT_MEMLIMIT;
+       }
+       if (0 != nvlist_lookup_nvpair(innvl, ZCP_ARG_ARGLIST, &nvarg)) {
+               return (EINVAL);
+       }
+
+       if (instrlimit == 0 || instrlimit > zfs_lua_max_instrlimit)
+               return (EINVAL);
+       if (memlimit == 0 || memlimit > zfs_lua_max_memlimit)
+               return (EINVAL);
+
+       return (zcp_eval(poolname, program, sync_flag, instrlimit, memlimit,
+           nvarg, outnvl));
+}
+
 /*
  * inputs:
  * zc_name             name of dataset to destroy
@@ -3587,11 +3746,8 @@ zfs_ioc_destroy(zfs_cmd_t *zc)
 {
        int err;
 
-       if (zc->zc_objset_type == DMU_OST_ZFS) {
-               err = zfs_unmount_snap(zc->zc_name);
-               if (err != 0)
-                       return (err);
-       }
+       if (zc->zc_objset_type == DMU_OST_ZFS)
+               zfs_unmount_snap(zc->zc_name);
 
        if (strchr(zc->zc_name, '@')) {
                err = dsl_destroy_snapshot(zc->zc_name, zc->zc_defer_destroy);
@@ -3608,8 +3764,10 @@ zfs_ioc_destroy(zfs_cmd_t *zc)
                         */
                        char namebuf[ZFS_MAX_DATASET_NAME_LEN + 6];
 
-                       (void) snprintf(namebuf, sizeof (namebuf),
-                           "%s/%s", zc->zc_name, recv_clone_name);
+                       if (snprintf(namebuf, sizeof (namebuf), "%s/%s",
+                           zc->zc_name, recv_clone_name) >=
+                           sizeof (namebuf))
+                               return (SET_ERROR(EINVAL));
 
                        /*
                         * Try to remove the hidden child (%recv) and after
@@ -3621,7 +3779,7 @@ zfs_ioc_destroy(zfs_cmd_t *zc)
                        if (err == 0)
                                err = dsl_destroy_head(zc->zc_name);
                        else if (err == ENOENT)
-                               err = EEXIST;
+                               err = SET_ERROR(EEXIST);
                }
        }
 
@@ -3631,20 +3789,34 @@ zfs_ioc_destroy(zfs_cmd_t *zc)
 /*
  * fsname is name of dataset to rollback (to most recent snapshot)
  *
- * innvl is not used.
+ * innvl may contain name of expected target snapshot
  *
  * outnvl: "target" -> name of most recent snapshot
  * }
  */
 /* ARGSUSED */
 static int
-zfs_ioc_rollback(const char *fsname, nvlist_t *args, nvlist_t *outnvl)
+zfs_ioc_rollback(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
 {
        zfsvfs_t *zfsvfs;
        zvol_state_t *zv;
+       char *target = NULL;
        int error;
 
-       if (get_zfs_sb(fsname, &zfsvfs) == 0) {
+       (void) nvlist_lookup_string(innvl, "target", &target);
+       if (target != NULL) {
+               const char *cp = strchr(target, '@');
+
+               /*
+                * The snap name must contain an @, and the part after it must
+                * contain only valid characters.
+                */
+               if (cp == NULL ||
+                   zfs_component_namecheck(cp + 1, NULL, NULL) != 0)
+                       return (SET_ERROR(EINVAL));
+       }
+
+       if (getzfsvfs(fsname, &zfsvfs) == 0) {
                dsl_dataset_t *ds;
 
                ds = dmu_objset_ds(zfsvfs->z_os);
@@ -3652,16 +3824,18 @@ zfs_ioc_rollback(const char *fsname, nvlist_t *args, nvlist_t *outnvl)
                if (error == 0) {
                        int resume_err;
 
-                       error = dsl_dataset_rollback(fsname, zfsvfs, outnvl);
+                       error = dsl_dataset_rollback(fsname, target, zfsvfs,
+                           outnvl);
                        resume_err = zfs_resume_fs(zfsvfs, ds);
                        error = error ? error : resume_err;
                }
                deactivate_super(zfsvfs->z_sb);
        } else if ((zv = zvol_suspend(fsname)) != NULL) {
-               error = dsl_dataset_rollback(fsname, zvol_tag(zv), outnvl);
+               error = dsl_dataset_rollback(fsname, target, zvol_tag(zv),
+                   outnvl);
                zvol_resume(zv);
        } else {
-               error = dsl_dataset_rollback(fsname, NULL, outnvl);
+               error = dsl_dataset_rollback(fsname, target, NULL, outnvl);
        }
        return (error);
 }
@@ -3671,13 +3845,12 @@ recursive_unmount(const char *fsname, void *arg)
 {
        const char *snapname = arg;
        char *fullname;
-       int error;
 
        fullname = kmem_asprintf("%s@%s", fsname, snapname);
-       error = zfs_unmount_snap(fullname);
+       zfs_unmount_snap(fullname);
        strfree(fullname);
 
-       return (error);
+       return (0);
 }
 
 /*
@@ -3694,9 +3867,12 @@ zfs_ioc_rename(zfs_cmd_t *zc)
        boolean_t recursive = zc->zc_cookie & 1;
        char *at;
 
+       /* "zfs rename" from and to ...%recv datasets should both fail */
+       zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
        zc->zc_value[sizeof (zc->zc_value) - 1] = '\0';
-       if (dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
-           strchr(zc->zc_value, '%'))
+       if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0 ||
+           dataset_namecheck(zc->zc_value, NULL, NULL) != 0 ||
+           strchr(zc->zc_name, '%') || strchr(zc->zc_value, '%'))
                return (SET_ERROR(EINVAL));
 
        at = strchr(zc->zc_name, '@');
@@ -3753,6 +3929,10 @@ zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
                            zfs_userquota_prop_prefixes[ZFS_PROP_USEROBJQUOTA];
                        const char *giq_prefix =
                            zfs_userquota_prop_prefixes[ZFS_PROP_GROUPOBJQUOTA];
+                       const char *pq_prefix =
+                           zfs_userquota_prop_prefixes[ZFS_PROP_PROJECTQUOTA];
+                       const char *piq_prefix = zfs_userquota_prop_prefixes[\
+                           ZFS_PROP_PROJECTOBJQUOTA];
 
                        if (strncmp(propname, uq_prefix,
                            strlen(uq_prefix)) == 0) {
@@ -3766,8 +3946,14 @@ zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
                        } else if (strncmp(propname, giq_prefix,
                            strlen(giq_prefix)) == 0) {
                                perm = ZFS_DELEG_PERM_GROUPOBJQUOTA;
+                       } else if (strncmp(propname, pq_prefix,
+                           strlen(pq_prefix)) == 0) {
+                               perm = ZFS_DELEG_PERM_PROJECTQUOTA;
+                       } else if (strncmp(propname, piq_prefix,
+                           strlen(piq_prefix)) == 0) {
+                               perm = ZFS_DELEG_PERM_PROJECTOBJQUOTA;
                        } else {
-                               /* USERUSED and GROUPUSED are read-only */
+                               /* {USER|GROUP|PROJECT}USED are read-only */
                                return (SET_ERROR(EINVAL));
                        }
 
@@ -3856,16 +4042,6 @@ zfs_check_settable(const char *dsname, nvpair_t *pair, cred_t *cr)
                    intval > SPA_OLD_MAXBLOCKSIZE) {
                        spa_t *spa;
 
-                       /*
-                        * If this is a bootable dataset then
-                        * we don't allow large (>128K) blocks,
-                        * because GRUB doesn't support them.
-                        */
-                       if (zfs_is_bootfs(dsname) &&
-                           intval > SPA_OLD_MAXBLOCKSIZE) {
-                               return (SET_ERROR(ERANGE));
-                       }
-
                        /*
                         * We don't allow setting the property above 1MB,
                         * unless the tunable has been changed.
@@ -4123,7 +4299,11 @@ extract_delay_props(nvlist_t *props)
 {
        nvlist_t *delayprops;
        nvpair_t *nvp, *tmp;
-       static const zfs_prop_t delayable[] = { ZFS_PROP_REFQUOTA, 0 };
+       static const zfs_prop_t delayable[] = {
+               ZFS_PROP_REFQUOTA,
+               ZFS_PROP_KEYLOCATION,
+               0
+       };
        int i;
 
        VERIFY(nvlist_alloc(&delayprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
@@ -4164,8 +4344,8 @@ static boolean_t zfs_ioc_recv_inject_err;
  * encountered errors, if any. It's the callers responsibility to free.
  */
 static int
-zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
-    nvlist_t *props, boolean_t force, boolean_t resumable, int input_fd,
+zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin, nvlist_t *recvprops,
+    nvlist_t *localprops, boolean_t force, boolean_t resumable, int input_fd,
     dmu_replay_record_t *begin_record, int cleanup_fd, uint64_t *read_bytes,
     uint64_t *errflags, uint64_t *action_handle, nvlist_t **errors)
 {
@@ -4175,6 +4355,7 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
        offset_t off;
        nvlist_t *delayprops = NULL; /* sent properties applied post-receive */
        nvlist_t *origprops = NULL; /* existing properties */
+       nvlist_t *origrecvd = NULL; /* existing received properties */
        boolean_t first_recvd_props = B_FALSE;
        file_t *input_fp;
 
@@ -4196,7 +4377,7 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
         * to the new data. Note that we must call dmu_recv_stream() if
         * dmu_recv_begin() succeeds.
         */
-       if (props != NULL && !drc.drc_newfs) {
+       if (recvprops != NULL && !drc.drc_newfs) {
                if (spa_version(dsl_dataset_get_spa(drc.drc_ds)) >=
                    SPA_VERSION_RECVD_PROPS &&
                    !dsl_prop_get_hasrecvd(tofs))
@@ -4207,7 +4388,7 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
                 * completely replace the existing received properties, so stash
                 * away the existing ones.
                 */
-               if (dsl_prop_get_received(tofs, &origprops) == 0) {
+               if (dsl_prop_get_received(tofs, &origrecvd) == 0) {
                        nvlist_t *errlist = NULL;
                        /*
                         * Don't bother writing a property if its value won't
@@ -4218,27 +4399,74 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
                         * regardless.
                         */
                        if (!first_recvd_props)
-                               props_reduce(props, origprops);
-                       if (zfs_check_clearable(tofs, origprops, &errlist) != 0)
+                               props_reduce(recvprops, origrecvd);
+                       if (zfs_check_clearable(tofs, origrecvd, &errlist) != 0)
                                (void) nvlist_merge(*errors, errlist, 0);
                        nvlist_free(errlist);
 
-                       if (clear_received_props(tofs, origprops,
-                           first_recvd_props ? NULL : props) != 0)
+                       if (clear_received_props(tofs, origrecvd,
+                           first_recvd_props ? NULL : recvprops) != 0)
                                *errflags |= ZPROP_ERR_NOCLEAR;
                } else {
                        *errflags |= ZPROP_ERR_NOCLEAR;
                }
        }
 
-       if (props != NULL) {
+       /*
+        * Stash away existing properties so we can restore them on error unless
+        * we're doing the first receive after SPA_VERSION_RECVD_PROPS, in which
+        * case "origrecvd" will take care of that.
+        */
+       if (localprops != NULL && !drc.drc_newfs && !first_recvd_props) {
+               objset_t *os;
+               if (dmu_objset_hold(tofs, FTAG, &os) == 0) {
+                       if (dsl_prop_get_all(os, &origprops) != 0) {
+                               *errflags |= ZPROP_ERR_NOCLEAR;
+                       }
+                       dmu_objset_rele(os, FTAG);
+               } else {
+                       *errflags |= ZPROP_ERR_NOCLEAR;
+               }
+       }
+
+       if (recvprops != NULL) {
                props_error = dsl_prop_set_hasrecvd(tofs);
 
                if (props_error == 0) {
-                       delayprops = extract_delay_props(props);
+                       delayprops = extract_delay_props(recvprops);
                        (void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_RECEIVED,
-                           props, *errors);
+                           recvprops, *errors);
+               }
+       }
+
+       if (localprops != NULL) {
+               nvlist_t *oprops = fnvlist_alloc();
+               nvlist_t *xprops = fnvlist_alloc();
+               nvpair_t *nvp = NULL;
+
+               while ((nvp = nvlist_next_nvpair(localprops, nvp)) != NULL) {
+                       if (nvpair_type(nvp) == DATA_TYPE_BOOLEAN) {
+                               /* -x property */
+                               const char *name = nvpair_name(nvp);
+                               zfs_prop_t prop = zfs_name_to_prop(name);
+                               if (prop != ZPROP_INVAL) {
+                                       if (!zfs_prop_inheritable(prop))
+                                               continue;
+                               } else if (!zfs_prop_user(name))
+                                       continue;
+                               fnvlist_add_boolean(xprops, name);
+                       } else {
+                               /* -o property=value */
+                               fnvlist_add_nvpair(oprops, nvp);
+                       }
                }
+               (void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_LOCAL,
+                   oprops, *errors);
+               (void) zfs_set_prop_nvlist(tofs, ZPROP_SRC_INHERITED,
+                   xprops, *errors);
+
+               nvlist_free(oprops);
+               nvlist_free(xprops);
        }
 
        off = input_fp->f_offset;
@@ -4249,7 +4477,7 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
                zfsvfs_t *zfsvfs = NULL;
                zvol_state_t *zv = NULL;
 
-               if (get_zfs_sb(tofs, &zfsvfs) == 0) {
+               if (getzfsvfs(tofs, &zfsvfs) == 0) {
                        /* online recv */
                        dsl_dataset_t *ds;
                        int end_err;
@@ -4289,7 +4517,7 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
                 * Since zfs_ioc_recv_inject_err is only in DEBUG kernels,
                 * using ASSERT() will be just like a VERIFY.
                 */
-               ASSERT(nvlist_merge(props, delayprops, 0) == 0);
+               ASSERT(nvlist_merge(recvprops, delayprops, 0) == 0);
                nvlist_free(delayprops);
        }
 
@@ -4308,8 +4536,8 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
        /*
         * On error, restore the original props.
         */
-       if (error != 0 && props != NULL && !drc.drc_newfs) {
-               if (clear_received_props(tofs, props, NULL) != 0) {
+       if (error != 0 && recvprops != NULL && !drc.drc_newfs) {
+               if (clear_received_props(tofs, recvprops, NULL) != 0) {
                        /*
                         * We failed to clear the received properties.
                         * Since we may have left a $recvd value on the
@@ -4320,7 +4548,7 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
                        dsl_prop_unset_hasrecvd(tofs);
                }
 
-               if (origprops == NULL && !drc.drc_newfs) {
+               if (origrecvd == NULL && !drc.drc_newfs) {
                        /* We failed to stash the original properties. */
                        *errflags |= ZPROP_ERR_NORESTORE;
                }
@@ -4331,10 +4559,10 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
                 * explicitly if we're restoring local properties cleared in the
                 * first new-style receive.
                 */
-               if (origprops != NULL &&
+               if (origrecvd != NULL &&
                    zfs_set_prop_nvlist(tofs, (first_recvd_props ?
                    ZPROP_SRC_LOCAL : ZPROP_SRC_RECEIVED),
-                   origprops, NULL) != 0) {
+                   origrecvd, NULL) != 0) {
                        /*
                         * We stashed the original properties but failed to
                         * restore them.
@@ -4342,8 +4570,64 @@ zfs_ioc_recv_impl(char *tofs, char *tosnap, char *origin,
                        *errflags |= ZPROP_ERR_NORESTORE;
                }
        }
+       if (error != 0 && localprops != NULL && !drc.drc_newfs &&
+           !first_recvd_props) {
+               nvlist_t *setprops;
+               nvlist_t *inheritprops;
+               nvpair_t *nvp;
+
+               if (origprops == NULL) {
+                       /* We failed to stash the original properties. */
+                       *errflags |= ZPROP_ERR_NORESTORE;
+                       goto out;
+               }
+
+               /* Restore original props */
+               setprops = fnvlist_alloc();
+               inheritprops = fnvlist_alloc();
+               nvp = NULL;
+               while ((nvp = nvlist_next_nvpair(localprops, nvp)) != NULL) {
+                       const char *name = nvpair_name(nvp);
+                       const char *source;
+                       nvlist_t *attrs;
+
+                       if (!nvlist_exists(origprops, name)) {
+                               /*
+                                * Property was not present or was explicitly
+                                * inherited before the receive, restore this.
+                                */
+                               fnvlist_add_boolean(inheritprops, name);
+                               continue;
+                       }
+                       attrs = fnvlist_lookup_nvlist(origprops, name);
+                       source = fnvlist_lookup_string(attrs, ZPROP_SOURCE);
+
+                       /* Skip received properties */
+                       if (strcmp(source, ZPROP_SOURCE_VAL_RECVD) == 0)
+                               continue;
+
+                       if (strcmp(source, tofs) == 0) {
+                               /* Property was locally set */
+                               fnvlist_add_nvlist(setprops, name, attrs);
+                       } else {
+                               /* Property was implicitly inherited */
+                               fnvlist_add_boolean(inheritprops, name);
+                       }
+               }
+
+               if (zfs_set_prop_nvlist(tofs, ZPROP_SRC_LOCAL, setprops,
+                   NULL) != 0)
+                       *errflags |= ZPROP_ERR_NORESTORE;
+               if (zfs_set_prop_nvlist(tofs, ZPROP_SRC_INHERITED, inheritprops,
+                   NULL) != 0)
+                       *errflags |= ZPROP_ERR_NORESTORE;
+
+               nvlist_free(setprops);
+               nvlist_free(inheritprops);
+       }
 out:
        releasef(input_fd);
+       nvlist_free(origrecvd);
        nvlist_free(origprops);
 
        if (error == 0)
@@ -4356,6 +4640,8 @@ out:
  * inputs:
  * zc_name             name of containing filesystem (unused)
  * zc_nvlist_src{_size}        nvlist of properties to apply
+ * zc_nvlist_conf{_size}       nvlist of properties to exclude
+ *                     (DATA_TYPE_BOOLEAN) and override (everything else)
  * zc_value            name of snapshot to create
  * zc_string           name of clone origin (if DRR_FLAG_CLONE)
  * zc_cookie           file descriptor to recv from
@@ -4375,7 +4661,8 @@ zfs_ioc_recv(zfs_cmd_t *zc)
 {
        dmu_replay_record_t begin_record;
        nvlist_t *errors = NULL;
-       nvlist_t *props = NULL;
+       nvlist_t *recvdprops = NULL;
+       nvlist_t *localprops = NULL;
        char *origin = NULL;
        char *tosnap;
        char tofs[ZFS_MAX_DATASET_NAME_LEN];
@@ -4392,7 +4679,12 @@ zfs_ioc_recv(zfs_cmd_t *zc)
 
        if (zc->zc_nvlist_src != 0 &&
            (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
-           zc->zc_iflags, &props)) != 0)
+           zc->zc_iflags, &recvdprops)) != 0)
+               return (error);
+
+       if (zc->zc_nvlist_conf != 0 &&
+           (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
+           zc->zc_iflags, &localprops)) != 0)
                return (error);
 
        if (zc->zc_string[0])
@@ -4402,10 +4694,12 @@ zfs_ioc_recv(zfs_cmd_t *zc)
        begin_record.drr_payloadlen = 0;
        begin_record.drr_u.drr_begin = zc->zc_begin_record;
 
-       error = zfs_ioc_recv_impl(tofs, tosnap, origin, props, zc->zc_guid,
-           B_FALSE, zc->zc_cookie, &begin_record, zc->zc_cleanup_fd,
-           &zc->zc_cookie, &zc->zc_obj, &zc->zc_action_handle, &errors);
-       nvlist_free(props);
+       error = zfs_ioc_recv_impl(tofs, tosnap, origin, recvdprops, localprops,
+           zc->zc_guid, B_FALSE, zc->zc_cookie, &begin_record,
+           zc->zc_cleanup_fd, &zc->zc_cookie, &zc->zc_obj,
+           &zc->zc_action_handle, &errors);
+       nvlist_free(recvdprops);
+       nvlist_free(localprops);
 
        /*
         * Now that all props, initial and delayed, are set, report the prop
@@ -4429,7 +4723,8 @@ zfs_ioc_recv(zfs_cmd_t *zc)
 /*
  * innvl: {
  *     "snapname" -> full name of the snapshot to create
- *     (optional) "props" -> properties to set (nvlist)
+ *     (optional) "props" -> received properties to set (nvlist)
+ *     (optional) "localprops" -> override and exclude properties (nvlist)
  *     (optional) "origin" -> name of clone origin (DRR_FLAG_CLONE)
  *     "begin_record" -> non-byteswapped dmu_replay_record_t
  *     "input_fd" -> file descriptor to read stream from (int32)
@@ -4452,7 +4747,8 @@ zfs_ioc_recv_new(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
        dmu_replay_record_t *begin_record;
        uint_t begin_record_size;
        nvlist_t *errors = NULL;
-       nvlist_t *props = NULL;
+       nvlist_t *recvprops = NULL;
+       nvlist_t *localprops = NULL;
        char *snapname = NULL;
        char *origin = NULL;
        char *tosnap;
@@ -4503,12 +4799,17 @@ zfs_ioc_recv_new(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
        if (error && error != ENOENT)
                return (error);
 
-       error = nvlist_lookup_nvlist(innvl, "props", &props);
+       /* we still use "props" here for backwards compatibility */
+       error = nvlist_lookup_nvlist(innvl, "props", &recvprops);
        if (error && error != ENOENT)
                return (error);
 
-       error = zfs_ioc_recv_impl(tofs, tosnap, origin, props, force,
-           resumable, input_fd, begin_record, cleanup_fd, &read_bytes,
+       error = nvlist_lookup_nvlist(innvl, "localprops", &localprops);
+       if (error && error != ENOENT)
+               return (error);
+
+       error = zfs_ioc_recv_impl(tofs, tosnap, origin, recvprops, localprops,
+           force, resumable, input_fd, begin_record, cleanup_fd, &read_bytes,
            &errflags, &action_handle, &errors);
 
        fnvlist_add_uint64(outnvl, "read_bytes", read_bytes);
@@ -4517,7 +4818,8 @@ zfs_ioc_recv_new(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
        fnvlist_add_nvlist(outnvl, "errors", errors);
 
        nvlist_free(errors);
-       nvlist_free(props);
+       nvlist_free(recvprops);
+       nvlist_free(localprops);
 
        return (error);
 }
@@ -4535,6 +4837,9 @@ zfs_ioc_recv_new(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
  *
  * outputs:
  * zc_objset_type      estimated size, if zc_guid is set
+ *
+ * NOTE: This is no longer the preferred interface, any new functionality
+ *       should be added to zfs_ioc_send_new() instead.
  */
 static int
 zfs_ioc_send(zfs_cmd_t *zc)
@@ -4545,6 +4850,7 @@ zfs_ioc_send(zfs_cmd_t *zc)
        boolean_t embedok = (zc->zc_flags & 0x1);
        boolean_t large_block_ok = (zc->zc_flags & 0x2);
        boolean_t compressok = (zc->zc_flags & 0x4);
+       boolean_t rawok = (zc->zc_flags & 0x8);
 
        if (zc->zc_obj != 0) {
                dsl_pool_t *dp;
@@ -4576,7 +4882,8 @@ zfs_ioc_send(zfs_cmd_t *zc)
                if (error != 0)
                        return (error);
 
-               error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &tosnap);
+               error = dsl_dataset_hold_obj(dp, zc->zc_sendobj,
+                   FTAG, &tosnap);
                if (error != 0) {
                        dsl_pool_rele(dp, FTAG);
                        return (error);
@@ -4592,7 +4899,7 @@ zfs_ioc_send(zfs_cmd_t *zc)
                        }
                }
 
-               error = dmu_send_estimate(tosnap, fromsnap, compressok,
+               error = dmu_send_estimate(tosnap, fromsnap, compressok || rawok,
                    &zc->zc_objset_type);
 
                if (fromsnap != NULL)
@@ -4606,7 +4913,7 @@ zfs_ioc_send(zfs_cmd_t *zc)
 
                off = fp->f_offset;
                error = dmu_send_obj(zc->zc_name, zc->zc_sendobj,
-                   zc->zc_fromobj, embedok, large_block_ok, compressok,
+                   zc->zc_fromobj, embedok, large_block_ok, compressok, rawok,
                    zc->zc_cookie, fp->f_vnode, &off);
 
                if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
@@ -4790,7 +5097,8 @@ zfs_ioc_clear(zfs_cmd_t *zc)
 
        vdev_clear(spa, vd);
 
-       (void) spa_vdev_state_exit(spa, NULL, 0);
+       (void) spa_vdev_state_exit(spa, spa_suspended(spa) ?
+           NULL : spa->spa_root_vdev, 0);
 
        /*
         * Resume any suspended I/Os.
@@ -4803,25 +5111,46 @@ zfs_ioc_clear(zfs_cmd_t *zc)
        return (error);
 }
 
+/*
+ * Reopen all the vdevs associated with the pool.
+ *
+ * innvl: {
+ *  "scrub_restart" -> when true and scrub is running, allow to restart
+ *              scrub as the side effect of the reopen (boolean).
+ * }
+ *
+ * outnvl is unused
+ */
+/* ARGSUSED */
 static int
-zfs_ioc_pool_reopen(zfs_cmd_t *zc)
+zfs_ioc_pool_reopen(const char *pool, nvlist_t *innvl, nvlist_t *outnvl)
 {
        spa_t *spa;
        int error;
+       boolean_t scrub_restart = B_TRUE;
 
-       error = spa_open(zc->zc_name, &spa, FTAG);
+       if (innvl) {
+               if (nvlist_lookup_boolean_value(innvl, "scrub_restart",
+                   &scrub_restart) != 0) {
+                       return (SET_ERROR(EINVAL));
+               }
+       }
+
+       error = spa_open(pool, &spa, FTAG);
        if (error != 0)
                return (error);
 
        spa_vdev_state_enter(spa, SCL_NONE);
 
        /*
-        * If a resilver is already in progress then set the
-        * spa_scrub_reopen flag to B_TRUE so that we don't restart
-        * the scan as a side effect of the reopen. Otherwise, let
-        * vdev_open() decided if a resilver is required.
+        * If the scrub_restart flag is B_FALSE and a scrub is already
+        * in progress then set spa_scrub_reopen flag to B_TRUE so that
+        * we don't restart the scrub as a side effect of the reopen.
+        * Otherwise, let vdev_open() decided if a resilver is required.
         */
-       spa->spa_scrub_reopen = dsl_scan_resilvering(spa->spa_dsl_pool);
+
+       spa->spa_scrub_reopen = (!scrub_restart &&
+           dsl_scan_scrubbing(spa->spa_dsl_pool));
        vdev_reopen(spa->spa_root_vdev);
        spa->spa_scrub_reopen = B_FALSE;
 
@@ -4829,10 +5158,10 @@ zfs_ioc_pool_reopen(zfs_cmd_t *zc)
        spa_close(spa, FTAG);
        return (0);
 }
+
 /*
  * inputs:
  * zc_name     name of filesystem
- * zc_value    name of origin snapshot
  *
  * outputs:
  * zc_string   name of conflicting snapshot, if there is one
@@ -4840,22 +5169,60 @@ zfs_ioc_pool_reopen(zfs_cmd_t *zc)
 static int
 zfs_ioc_promote(zfs_cmd_t *zc)
 {
+       dsl_pool_t *dp;
+       dsl_dataset_t *ds, *ods;
+       char origin[ZFS_MAX_DATASET_NAME_LEN];
        char *cp;
+       int error;
+
+       zc->zc_name[sizeof (zc->zc_name) - 1] = '\0';
+       if (dataset_namecheck(zc->zc_name, NULL, NULL) != 0 ||
+           strchr(zc->zc_name, '%'))
+               return (SET_ERROR(EINVAL));
+
+       error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
+       if (error != 0)
+               return (error);
+
+       error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &ds);
+       if (error != 0) {
+               dsl_pool_rele(dp, FTAG);
+               return (error);
+       }
+
+       if (!dsl_dir_is_clone(ds->ds_dir)) {
+               dsl_dataset_rele(ds, FTAG);
+               dsl_pool_rele(dp, FTAG);
+               return (SET_ERROR(EINVAL));
+       }
+
+       error = dsl_dataset_hold_obj(dp,
+           dsl_dir_phys(ds->ds_dir)->dd_origin_obj, FTAG, &ods);
+       if (error != 0) {
+               dsl_dataset_rele(ds, FTAG);
+               dsl_pool_rele(dp, FTAG);
+               return (error);
+       }
+
+       dsl_dataset_name(ods, origin);
+       dsl_dataset_rele(ods, FTAG);
+       dsl_dataset_rele(ds, FTAG);
+       dsl_pool_rele(dp, FTAG);
 
        /*
         * We don't need to unmount *all* the origin fs's snapshots, but
         * it's easier.
         */
-       cp = strchr(zc->zc_value, '@');
+       cp = strchr(origin, '@');
        if (cp)
                *cp = '\0';
-       (void) dmu_objset_find(zc->zc_value,
+       (void) dmu_objset_find(origin,
            zfs_unmount_snap_cb, NULL, DS_FIND_SNAPSHOTS);
        return (dsl_dataset_promote(zc->zc_name, zc->zc_string));
 }
 
 /*
- * Retrieve a single {user|group}{used|quota}@... property.
+ * Retrieve a single {user|group|project}{used|quota}@... property.
  *
  * inputs:
  * zc_name     name of filesystem
@@ -4875,13 +5242,13 @@ zfs_ioc_userspace_one(zfs_cmd_t *zc)
        if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
                return (SET_ERROR(EINVAL));
 
-       error = zfs_sb_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
+       error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
        if (error != 0)
                return (error);
 
        error = zfs_userspace_one(zfsvfs,
            zc->zc_objset_type, zc->zc_value, zc->zc_guid, &zc->zc_cookie);
-       zfs_sb_rele(zfsvfs, FTAG);
+       zfsvfs_rele(zfsvfs, FTAG);
 
        return (error);
 }
@@ -4902,17 +5269,15 @@ zfs_ioc_userspace_many(zfs_cmd_t *zc)
 {
        zfsvfs_t *zfsvfs;
        int bufsize = zc->zc_nvlist_dst_size;
-       int error;
-       void *buf;
 
        if (bufsize <= 0)
                return (SET_ERROR(ENOMEM));
 
-       error = zfs_sb_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
+       int error = zfsvfs_hold(zc->zc_name, FTAG, &zfsvfs, B_FALSE);
        if (error != 0)
                return (error);
 
-       buf = vmem_alloc(bufsize, KM_SLEEP);
+       void *buf = vmem_alloc(bufsize, KM_SLEEP);
 
        error = zfs_userspace_many(zfsvfs, zc->zc_objset_type, &zc->zc_cookie,
            buf, &zc->zc_nvlist_dst_size);
@@ -4923,7 +5288,7 @@ zfs_ioc_userspace_many(zfs_cmd_t *zc)
                    zc->zc_nvlist_dst_size);
        }
        vmem_free(buf, bufsize);
-       zfs_sb_rele(zfsvfs, FTAG);
+       zfsvfs_rele(zfsvfs, FTAG);
 
        return (error);
 }
@@ -4942,21 +5307,21 @@ zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
        int error = 0;
        zfsvfs_t *zfsvfs;
 
-       if (get_zfs_sb(zc->zc_name, &zfsvfs) == 0) {
+       if (getzfsvfs(zc->zc_name, &zfsvfs) == 0) {
                if (!dmu_objset_userused_enabled(zfsvfs->z_os)) {
                        /*
                         * If userused is not enabled, it may be because the
                         * objset needs to be closed & reopened (to grow the
                         * objset_phys_t).  Suspend/resume the fs will do that.
                         */
-                       dsl_dataset_t *ds;
+                       dsl_dataset_t *ds, *newds;
 
                        ds = dmu_objset_ds(zfsvfs->z_os);
                        error = zfs_suspend_fs(zfsvfs);
                        if (error == 0) {
-                               dmu_objset_refresh_ownership(zfsvfs->z_os,
-                                   zfsvfs);
-                               error = zfs_resume_fs(zfsvfs, ds);
+                               dmu_objset_refresh_ownership(ds, &newds,
+                                   B_TRUE, zfsvfs);
+                               error = zfs_resume_fs(zfsvfs, newds);
                        }
                }
                if (error == 0)
@@ -4964,12 +5329,12 @@ zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
                deactivate_super(zfsvfs->z_sb);
        } else {
                /* XXX kind of reading contents without owning */
-               error = dmu_objset_hold(zc->zc_name, FTAG, &os);
+               error = dmu_objset_hold_flags(zc->zc_name, B_TRUE, FTAG, &os);
                if (error != 0)
                        return (error);
 
                error = dmu_objset_userspace_upgrade(os);
-               dmu_objset_rele(os, FTAG);
+               dmu_objset_rele_flags(os, B_TRUE, FTAG);
        }
 
        return (error);
@@ -4983,36 +5348,37 @@ zfs_ioc_userspace_upgrade(zfs_cmd_t *zc)
  * none
  */
 static int
-zfs_ioc_userobjspace_upgrade(zfs_cmd_t *zc)
+zfs_ioc_id_quota_upgrade(zfs_cmd_t *zc)
 {
        objset_t *os;
        int error;
 
-       error = dmu_objset_hold(zc->zc_name, FTAG, &os);
+       error = dmu_objset_hold_flags(zc->zc_name, B_TRUE, FTAG, &os);
        if (error != 0)
                return (error);
 
-       dsl_dataset_long_hold(dmu_objset_ds(os), FTAG);
-       dsl_pool_rele(dmu_objset_pool(os), FTAG);
-
-       if (dmu_objset_userobjspace_upgradable(os)) {
+       if (dmu_objset_userobjspace_upgradable(os) ||
+           dmu_objset_projectquota_upgradable(os)) {
                mutex_enter(&os->os_upgrade_lock);
                if (os->os_upgrade_id == 0) {
                        /* clear potential error code and retry */
                        os->os_upgrade_status = 0;
                        mutex_exit(&os->os_upgrade_lock);
 
-                       dmu_objset_userobjspace_upgrade(os);
+                       dmu_objset_id_quota_upgrade(os);
                } else {
                        mutex_exit(&os->os_upgrade_lock);
                }
 
+               dsl_pool_rele(dmu_objset_pool(os), FTAG);
+
                taskq_wait_id(os->os_spa->spa_upgrade_taskq, os->os_upgrade_id);
                error = os->os_upgrade_status;
+       } else {
+               dsl_pool_rele(dmu_objset_pool(os), FTAG);
        }
 
-       dsl_dataset_long_rele(dmu_objset_ds(os), FTAG);
-       dsl_dataset_rele(dmu_objset_ds(os), FTAG);
+       dsl_dataset_rele_flags(dmu_objset_ds(os), DS_HOLD_FLAG_DECRYPT, FTAG);
 
        return (error);
 }
@@ -5335,6 +5701,7 @@ zfs_ioc_hold(const char *pool, nvlist_t *args, nvlist_t *errlist)
 static int
 zfs_ioc_get_holds(const char *snapname, nvlist_t *args, nvlist_t *outnvl)
 {
+       ASSERT3P(args, ==, NULL);
        return (dsl_dataset_get_holds(snapname, outnvl));
 }
 
@@ -5547,6 +5914,8 @@ zfs_ioc_space_snaps(const char *lastsnap, nvlist_t *innvl, nvlist_t *outnvl)
  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
  *     (optional) "compressok" -> (value ignored)
  *         presence indicates compressed DRR_WRITE records are permitted
+ *     (optional) "rawok" -> (value ignored)
+ *         presence indicates raw encrypted records should be used.
  *     (optional) "resume_object" and "resume_offset" -> (uint64)
  *         if present, resume send stream from specified object and offset.
  * }
@@ -5565,6 +5934,7 @@ zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
        boolean_t largeblockok;
        boolean_t embedok;
        boolean_t compressok;
+       boolean_t rawok;
        uint64_t resumeobj = 0;
        uint64_t resumeoff = 0;
 
@@ -5577,6 +5947,7 @@ zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
        largeblockok = nvlist_exists(innvl, "largeblockok");
        embedok = nvlist_exists(innvl, "embedok");
        compressok = nvlist_exists(innvl, "compressok");
+       rawok = nvlist_exists(innvl, "rawok");
 
        (void) nvlist_lookup_uint64(innvl, "resume_object", &resumeobj);
        (void) nvlist_lookup_uint64(innvl, "resume_offset", &resumeoff);
@@ -5586,7 +5957,7 @@ zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
 
        off = fp->f_offset;
        error = dmu_send(snapname, fromname, embedok, largeblockok, compressok,
-           fd, resumeobj, resumeoff, fp->f_vnode, &off);
+           rawok, fd, resumeobj, resumeoff, fp->f_vnode, &off);
 
        if (VOP_SEEK(fp->f_vnode, fp->f_offset, &off, NULL) == 0)
                fp->f_offset = off;
@@ -5608,6 +5979,8 @@ zfs_ioc_send_new(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
  *         presence indicates DRR_WRITE_EMBEDDED records are permitted
  *     (optional) "compressok" -> (value ignored)
  *         presence indicates compressed DRR_WRITE records are permitted
+ *     (optional) "rawok" -> (value ignored)
+ *         presence indicates raw encrypted records should be used.
  * }
  *
  * outnvl: {
@@ -5621,11 +5994,8 @@ zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
        dsl_dataset_t *tosnap;
        int error;
        char *fromname;
-       /* LINTED E_FUNC_SET_NOT_USED */
-       boolean_t largeblockok;
-       /* LINTED E_FUNC_SET_NOT_USED */
-       boolean_t embedok;
        boolean_t compressok;
+       boolean_t rawok;
        uint64_t space;
 
        error = dsl_pool_hold(snapname, FTAG, &dp);
@@ -5638,9 +6008,8 @@ zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
                return (error);
        }
 
-       largeblockok = nvlist_exists(innvl, "largeblockok");
-       embedok = nvlist_exists(innvl, "embedok");
        compressok = nvlist_exists(innvl, "compressok");
+       rawok = nvlist_exists(innvl, "rawok");
 
        error = nvlist_lookup_string(innvl, "from", &fromname);
        if (error == 0) {
@@ -5654,8 +6023,8 @@ zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
                        error = dsl_dataset_hold(dp, fromname, FTAG, &fromsnap);
                        if (error != 0)
                                goto out;
-                       error = dmu_send_estimate(tosnap, fromsnap, compressok,
-                           &space);
+                       error = dmu_send_estimate(tosnap, fromsnap,
+                           compressok || rawok, &space);
                        dsl_dataset_rele(fromsnap, FTAG);
                } else if (strchr(fromname, '#') != NULL) {
                        /*
@@ -5670,7 +6039,8 @@ zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
                        if (error != 0)
                                goto out;
                        error = dmu_send_estimate_from_txg(tosnap,
-                           frombm.zbm_creation_txg, compressok, &space);
+                           frombm.zbm_creation_txg, compressok || rawok,
+                           &space);
                } else {
                        /*
                         * from is not properly formatted as a snapshot or
@@ -5680,8 +6050,11 @@ zfs_ioc_send_space(const char *snapname, nvlist_t *innvl, nvlist_t *outnvl)
                        goto out;
                }
        } else {
-               // If estimating the size of a full send, use dmu_send_estimate
-               error = dmu_send_estimate(tosnap, NULL, compressok, &space);
+               /*
+                * If estimating the size of a full send, use dmu_send_estimate.
+                */
+               error = dmu_send_estimate(tosnap, NULL, compressok || rawok,
+                   &space);
        }
 
        fnvlist_add_uint64(outnvl, "space", space);
@@ -5692,6 +6065,168 @@ out:
        return (error);
 }
 
+/*
+ * Sync the currently open TXG to disk for the specified pool.
+ * This is somewhat similar to 'zfs_sync()'.
+ * For cases that do not result in error this ioctl will wait for
+ * the currently open TXG to commit before returning back to the caller.
+ *
+ * innvl: {
+ *  "force" -> when true, force uberblock update even if there is no dirty data.
+ *             In addition this will cause the vdev configuration to be written
+ *             out including updating the zpool cache file. (boolean_t)
+ * }
+ *
+ * onvl is unused
+ */
+/* ARGSUSED */
+static int
+zfs_ioc_pool_sync(const char *pool, nvlist_t *innvl, nvlist_t *onvl)
+{
+       int err;
+       boolean_t force = B_FALSE;
+       spa_t *spa;
+
+       if ((err = spa_open(pool, &spa, FTAG)) != 0)
+               return (err);
+
+       if (innvl) {
+               if (nvlist_lookup_boolean_value(innvl, "force", &force) != 0) {
+                       err = SET_ERROR(EINVAL);
+                       goto out;
+               }
+       }
+
+       if (force) {
+               spa_config_enter(spa, SCL_CONFIG, FTAG, RW_WRITER);
+               vdev_config_dirty(spa->spa_root_vdev);
+               spa_config_exit(spa, SCL_CONFIG, FTAG);
+       }
+       txg_wait_synced(spa_get_dsl(spa), 0);
+out:
+       spa_close(spa, FTAG);
+
+       return (err);
+}
+
+/*
+ * Load a user's wrapping key into the kernel.
+ * innvl: {
+ *     "hidden_args" -> { "wkeydata" -> value }
+ *         raw uint8_t array of encryption wrapping key data (32 bytes)
+ *     (optional) "noop" -> (value ignored)
+ *         presence indicated key should only be verified, not loaded
+ * }
+ */
+/* ARGSUSED */
+static int
+zfs_ioc_load_key(const char *dsname, nvlist_t *innvl, nvlist_t *outnvl)
+{
+       int ret;
+       dsl_crypto_params_t *dcp = NULL;
+       nvlist_t *hidden_args;
+       boolean_t noop = nvlist_exists(innvl, "noop");
+
+       if (strchr(dsname, '@') != NULL || strchr(dsname, '%') != NULL) {
+               ret = SET_ERROR(EINVAL);
+               goto error;
+       }
+
+       ret = nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);
+       if (ret != 0) {
+               ret = SET_ERROR(EINVAL);
+               goto error;
+       }
+
+       ret = dsl_crypto_params_create_nvlist(DCP_CMD_NONE, NULL,
+           hidden_args, &dcp);
+       if (ret != 0)
+               goto error;
+
+       ret = spa_keystore_load_wkey(dsname, dcp, noop);
+       if (ret != 0)
+               goto error;
+
+       dsl_crypto_params_free(dcp, noop);
+
+       return (0);
+
+error:
+       dsl_crypto_params_free(dcp, B_TRUE);
+       return (ret);
+}
+
+/*
+ * Unload a user's wrapping key from the kernel.
+ * Both innvl and outnvl are unused.
+ */
+/* ARGSUSED */
+static int
+zfs_ioc_unload_key(const char *dsname, nvlist_t *innvl, nvlist_t *outnvl)
+{
+       int ret = 0;
+
+       if (strchr(dsname, '@') != NULL || strchr(dsname, '%') != NULL) {
+               ret = (SET_ERROR(EINVAL));
+               goto out;
+       }
+
+       ret = spa_keystore_unload_wkey(dsname);
+       if (ret != 0)
+               goto out;
+
+out:
+       return (ret);
+}
+
+/*
+ * Changes a user's wrapping key used to decrypt a dataset. The keyformat,
+ * keylocation, pbkdf2salt, and  pbkdf2iters properties can also be specified
+ * here to change how the key is derived in userspace.
+ *
+ * innvl: {
+ *    "hidden_args" (optional) -> { "wkeydata" -> value }
+ *         raw uint8_t array of new encryption wrapping key data (32 bytes)
+ *    "props" (optional) -> { prop -> value }
+ * }
+ *
+ * outnvl is unused
+ */
+/* ARGSUSED */
+static int
+zfs_ioc_change_key(const char *dsname, nvlist_t *innvl, nvlist_t *outnvl)
+{
+       int ret;
+       uint64_t cmd = DCP_CMD_NONE;
+       dsl_crypto_params_t *dcp = NULL;
+       nvlist_t *args = NULL, *hidden_args = NULL;
+
+       if (strchr(dsname, '@') != NULL || strchr(dsname, '%') != NULL) {
+               ret = (SET_ERROR(EINVAL));
+               goto error;
+       }
+
+       (void) nvlist_lookup_uint64(innvl, "crypt_cmd", &cmd);
+       (void) nvlist_lookup_nvlist(innvl, "props", &args);
+       (void) nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);
+
+       ret = dsl_crypto_params_create_nvlist(cmd, args, hidden_args, &dcp);
+       if (ret != 0)
+               goto error;
+
+       ret = spa_keystore_change_key(dsname, dcp);
+       if (ret != 0)
+               goto error;
+
+       dsl_crypto_params_free(dcp, B_FALSE);
+
+       return (0);
+
+error:
+       dsl_crypto_params_free(dcp, B_TRUE);
+       return (ret);
+}
+
 static zfs_ioc_vec_t zfs_ioc_vec[ZFS_IOC_LAST - ZFS_IOC_FIRST];
 
 static void
@@ -5828,6 +6363,10 @@ zfs_ioctl_init(void)
            zfs_ioc_clone, zfs_secpolicy_create_clone, DATASET_NAME,
            POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
 
+       zfs_ioctl_register("remap", ZFS_IOC_REMAP,
+           zfs_ioc_remap, zfs_secpolicy_remap, DATASET_NAME,
+           POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_TRUE);
+
        zfs_ioctl_register("destroy_snaps", ZFS_IOC_DESTROY_SNAPS,
            zfs_ioc_destroy_snaps, zfs_secpolicy_destroy_snaps, POOL_NAME,
            POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
@@ -5863,6 +6402,28 @@ zfs_ioctl_init(void)
        zfs_ioctl_register("receive", ZFS_IOC_RECV_NEW,
            zfs_ioc_recv_new, zfs_secpolicy_recv_new, DATASET_NAME,
            POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE, B_TRUE);
+       zfs_ioctl_register("load-key", ZFS_IOC_LOAD_KEY,
+           zfs_ioc_load_key, zfs_secpolicy_load_key,
+           DATASET_NAME, POOL_CHECK_SUSPENDED, B_TRUE, B_TRUE);
+       zfs_ioctl_register("unload-key", ZFS_IOC_UNLOAD_KEY,
+           zfs_ioc_unload_key, zfs_secpolicy_load_key,
+           DATASET_NAME, POOL_CHECK_SUSPENDED, B_TRUE, B_TRUE);
+       zfs_ioctl_register("change-key", ZFS_IOC_CHANGE_KEY,
+           zfs_ioc_change_key, zfs_secpolicy_change_key,
+           DATASET_NAME, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY,
+           B_TRUE, B_TRUE);
+
+       zfs_ioctl_register("sync", ZFS_IOC_POOL_SYNC,
+           zfs_ioc_pool_sync, zfs_secpolicy_none, POOL_NAME,
+           POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_FALSE, B_FALSE);
+       zfs_ioctl_register("reopen", ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
+           zfs_secpolicy_config, POOL_NAME, POOL_CHECK_SUSPENDED, B_TRUE,
+           B_TRUE);
+
+       zfs_ioctl_register("channel_program", ZFS_IOC_CHANNEL_PROGRAM,
+           zfs_ioc_channel_program, zfs_secpolicy_config,
+           POOL_NAME, POOL_CHECK_SUSPENDED | POOL_CHECK_READONLY, B_TRUE,
+           B_TRUE);
 
        /* IOCTLS that use the legacy function signature */
 
@@ -5935,9 +6496,7 @@ zfs_ioctl_init(void)
            zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
 
        zfs_ioctl_register_pool(ZFS_IOC_CLEAR, zfs_ioc_clear,
-           zfs_secpolicy_config, B_TRUE, POOL_CHECK_NONE);
-       zfs_ioctl_register_pool(ZFS_IOC_POOL_REOPEN, zfs_ioc_pool_reopen,
-           zfs_secpolicy_config, B_TRUE, POOL_CHECK_SUSPENDED);
+           zfs_secpolicy_config, B_TRUE, POOL_CHECK_READONLY);
 
        zfs_ioctl_register_dataset_read(ZFS_IOC_SPACE_WRITTEN,
            zfs_ioc_space_written);
@@ -6073,7 +6632,7 @@ zfsdev_getminor(struct file *filp, minor_t *minorp)
 
        fpd = filp->private_data;
        if (fpd == NULL)
-               return (EBADF);
+               return (SET_ERROR(EBADF));
 
        mutex_enter(&zfsdev_state_lock);
 
@@ -6091,7 +6650,7 @@ zfsdev_getminor(struct file *filp, minor_t *minorp)
 
        mutex_exit(&zfsdev_state_lock);
 
-       return (EBADF);
+       return (SET_ERROR(EBADF));
 }
 
 /*
@@ -6336,12 +6895,23 @@ zfsdev_ioctl(struct file *filp, unsigned cmd, unsigned long arg)
                error = vec->zvec_func(zc->zc_name, innvl, outnvl);
                spl_fstrans_unmark(cookie);
 
-               if (error == 0 && vec->zvec_allow_log &&
+               /*
+                * Some commands can partially execute, modify state, and still
+                * return an error.  In these cases, attempt to record what
+                * was modified.
+                */
+               if ((error == 0 ||
+                   (cmd == ZFS_IOC_CHANNEL_PROGRAM && error != EINVAL)) &&
+                   vec->zvec_allow_log &&
                    spa_open(zc->zc_name, &spa, FTAG) == 0) {
                        if (!nvlist_empty(outnvl)) {
                                fnvlist_add_nvlist(lognv, ZPOOL_HIST_OUTPUT_NVL,
                                    outnvl);
                        }
+                       if (error != 0) {
+                               fnvlist_add_int64(lognv, ZPOOL_HIST_ERRNO,
+                                   error);
+                       }
                        (void) spa_history_log_nvl(spa, lognv);
                        spa_close(spa, FTAG);
                }
@@ -6405,11 +6975,14 @@ static const struct file_operations zfsdev_fops = {
 };
 
 static struct miscdevice zfs_misc = {
-       .minor          = MISC_DYNAMIC_MINOR,
+       .minor          = ZFS_MINOR,
        .name           = ZFS_DRIVER,
        .fops           = &zfsdev_fops,
 };
 
+MODULE_ALIAS_MISCDEV(ZFS_MINOR);
+MODULE_ALIAS("devname:zfs");
+
 static int
 zfs_attach(void)
 {
@@ -6420,12 +6993,24 @@ zfs_attach(void)
        zfsdev_state_list->zs_minor = -1;
 
        error = misc_register(&zfs_misc);
-       if (error != 0) {
-               printk(KERN_INFO "ZFS: misc_register() failed %d\n", error);
-               return (error);
+       if (error == -EBUSY) {
+               /*
+                * Fallback to dynamic minor allocation in the event of a
+                * collision with a reserved minor in linux/miscdevice.h.
+                * In this case the kernel modules must be manually loaded.
+                */
+               printk(KERN_INFO "ZFS: misc_register() with static minor %d "
+                   "failed %d, retrying with MISC_DYNAMIC_MINOR\n",
+                   ZFS_MINOR, error);
+
+               zfs_misc.minor = MISC_DYNAMIC_MINOR;
+               error = misc_register(&zfs_misc);
        }
 
-       return (0);
+       if (error)
+               printk(KERN_INFO "ZFS: misc_register() failed %d\n", error);
+
+       return (error);
 }
 
 static void