xref: /freebsd/lib/libbe/be.c (revision 9e5787d2284e187abb5b654d924394a65772e004)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2017 Kyle J. Kneitinger <kyle@kneit.in>
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30 
31 #include <sys/param.h>
32 #include <sys/mount.h>
33 #include <sys/stat.h>
34 #include <sys/ucred.h>
35 #include <sys/queue.h>
36 #include <sys/zfs_context.h>
37 #include <sys/mntent.h>
38 #include <sys/zfs_ioctl.h>
39 
40 #include <libzutil.h>
41 #include <ctype.h>
42 #include <libgen.h>
43 #include <libzfs_core.h>
44 #include <libzfs_impl.h>
45 #include <stdio.h>
46 #include <stdlib.h>
47 #include <time.h>
48 #include <unistd.h>
49 
50 #include "be.h"
51 #include "be_impl.h"
52 
53 struct promote_entry {
54 	char				name[BE_MAXPATHLEN];
55 	SLIST_ENTRY(promote_entry)	link;
56 };
57 
58 struct be_destroy_data {
59 	libbe_handle_t			*lbh;
60 	char				target_name[BE_MAXPATHLEN];
61 	char				*snapname;
62 	SLIST_HEAD(, promote_entry)	promotelist;
63 };
64 
65 #if SOON
66 static int be_create_child_noent(libbe_handle_t *lbh, const char *active,
67     const char *child_path);
68 static int be_create_child_cloned(libbe_handle_t *lbh, const char *active);
69 #endif
70 
71 /* Arbitrary... should tune */
72 #define	BE_SNAP_SERIAL_MAX	1024
73 
74 /*
75  * Iterator function for locating the rootfs amongst the children of the
76  * zfs_be_root set by loader(8).  data is expected to be a libbe_handle_t *.
77  */
78 static int
79 be_locate_rootfs(libbe_handle_t *lbh)
80 {
81 	struct statfs sfs;
82 	struct mnttab entry;
83 	zfs_handle_t *zfs;
84 
85 	/*
86 	 * Check first if root is ZFS; if not, we'll bail on rootfs capture.
87 	 * Unfortunately needed because zfs_path_to_zhandle will emit to
88 	 * stderr if / isn't actually a ZFS filesystem, which we'd like
89 	 * to avoid.
90 	 */
91 	if (statfs("/", &sfs) == 0) {
92 		statfs2mnttab(&sfs, &entry);
93 		if (strcmp(entry.mnt_fstype, MNTTYPE_ZFS) != 0)
94 			return (1);
95 	} else
96 		return (1);
97 	zfs = zfs_path_to_zhandle(lbh->lzh, "/", ZFS_TYPE_FILESYSTEM);
98 	if (zfs == NULL)
99 		return (1);
100 
101 	strlcpy(lbh->rootfs, zfs_get_name(zfs), sizeof(lbh->rootfs));
102 	zfs_close(zfs);
103 	return (0);
104 }
105 
106 /*
107  * Initializes the libbe context to operate in the root boot environment
108  * dataset, for example, zroot/ROOT.
109  */
110 libbe_handle_t *
111 libbe_init(const char *root)
112 {
113 	char altroot[MAXPATHLEN];
114 	libbe_handle_t *lbh;
115 	char *poolname, *pos;
116 	int pnamelen;
117 
118 	lbh = NULL;
119 	poolname = pos = NULL;
120 
121 	if ((lbh = calloc(1, sizeof(libbe_handle_t))) == NULL)
122 		goto err;
123 
124 	if ((lbh->lzh = libzfs_init()) == NULL)
125 		goto err;
126 
127 	/*
128 	 * Grab rootfs, we'll work backwards from there if an optional BE root
129 	 * has not been passed in.
130 	 */
131 	if (be_locate_rootfs(lbh) != 0) {
132 		if (root == NULL)
133 			goto err;
134 		*lbh->rootfs = '\0';
135 	}
136 	if (root == NULL) {
137 		/* Strip off the final slash from rootfs to get the be root */
138 		strlcpy(lbh->root, lbh->rootfs, sizeof(lbh->root));
139 		pos = strrchr(lbh->root, '/');
140 		if (pos == NULL)
141 			goto err;
142 		*pos = '\0';
143 	} else
144 		strlcpy(lbh->root, root, sizeof(lbh->root));
145 
146 	if ((pos = strchr(lbh->root, '/')) == NULL)
147 		goto err;
148 
149 	pnamelen = pos - lbh->root;
150 	poolname = malloc(pnamelen + 1);
151 	if (poolname == NULL)
152 		goto err;
153 
154 	strlcpy(poolname, lbh->root, pnamelen + 1);
155 	if ((lbh->active_phandle = zpool_open(lbh->lzh, poolname)) == NULL)
156 		goto err;
157 	free(poolname);
158 	poolname = NULL;
159 
160 	if (zpool_get_prop(lbh->active_phandle, ZPOOL_PROP_BOOTFS, lbh->bootfs,
161 	    sizeof(lbh->bootfs), NULL, true) != 0)
162 		goto err;
163 
164 	if (zpool_get_prop(lbh->active_phandle, ZPOOL_PROP_ALTROOT,
165 	    altroot, sizeof(altroot), NULL, true) == 0 &&
166 	    strcmp(altroot, "-") != 0)
167 		lbh->altroot_len = strlen(altroot);
168 
169 	return (lbh);
170 err:
171 	if (lbh != NULL) {
172 		if (lbh->active_phandle != NULL)
173 			zpool_close(lbh->active_phandle);
174 		if (lbh->lzh != NULL)
175 			libzfs_fini(lbh->lzh);
176 		free(lbh);
177 	}
178 	free(poolname);
179 	return (NULL);
180 }
181 
182 
183 /*
184  * Free memory allocated by libbe_init()
185  */
186 void
187 libbe_close(libbe_handle_t *lbh)
188 {
189 
190 	if (lbh->active_phandle != NULL)
191 		zpool_close(lbh->active_phandle);
192 	libzfs_fini(lbh->lzh);
193 	free(lbh);
194 }
195 
196 /*
197  * Proxy through to libzfs for the moment.
198  */
199 void
200 be_nicenum(uint64_t num, char *buf, size_t buflen)
201 {
202 
203 	zfs_nicenum(num, buf, buflen);
204 }
205 
206 static bool
207 be_should_promote_clones(zfs_handle_t *zfs_hdl, struct be_destroy_data *bdd)
208 {
209 	char *atpos;
210 
211 	if (zfs_get_type(zfs_hdl) != ZFS_TYPE_SNAPSHOT)
212 		return (false);
213 
214 	/*
215 	 * If we're deleting a snapshot, we need to make sure we only promote
216 	 * clones that are derived from one of the snapshots we're deleting,
217 	 * rather than that of a snapshot we're not touching.  This keeps stuff
218 	 * in a consistent state, making sure that we don't error out unless
219 	 * we really need to.
220 	 */
221 	if (bdd->snapname == NULL)
222 		return (true);
223 
224 	atpos = strchr(zfs_get_name(zfs_hdl), '@');
225 	return (strcmp(atpos + 1, bdd->snapname) == 0);
226 }
227 
228 /*
229  * This is executed from be_promote_dependent_clones via zfs_iter_dependents,
230  * It checks if the dependent type is a snapshot then attempts to find any
231  * clones associated with it. Any clones not related to the destroy target are
232  * added to the promote list.
233  */
234 static int
235 be_dependent_clone_cb(zfs_handle_t *zfs_hdl, void *data)
236 {
237 	int err;
238 	bool found;
239 	char *name;
240 	struct nvlist *nvl;
241 	struct nvpair *nvp;
242 	struct be_destroy_data *bdd;
243 	struct promote_entry *entry, *newentry;
244 
245 	nvp = NULL;
246 	err = 0;
247 	bdd = (struct be_destroy_data *)data;
248 
249 	if (be_should_promote_clones(zfs_hdl, bdd) &&
250 	    (nvl = zfs_get_clones_nvl(zfs_hdl)) != NULL) {
251 		while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
252 			name = nvpair_name(nvp);
253 
254 			/*
255 			 * Skip if the clone is equal to, or a child of, the
256 			 * destroy target.
257 			 */
258 			if (strncmp(name, bdd->target_name,
259 			    strlen(bdd->target_name)) == 0 ||
260 			    strstr(name, bdd->target_name) == name) {
261 				continue;
262 			}
263 
264 			found = false;
265 			SLIST_FOREACH(entry, &bdd->promotelist, link) {
266 				if (strcmp(entry->name, name) == 0) {
267 					found = true;
268 					break;
269 				}
270 			}
271 
272 			if (found)
273 				continue;
274 
275 			newentry = malloc(sizeof(struct promote_entry));
276 			if (newentry == NULL) {
277 				err = ENOMEM;
278 				break;
279 			}
280 
281 #define	BE_COPY_NAME(entry, src)	\
282 	strlcpy((entry)->name, (src), sizeof((entry)->name))
283 			if (BE_COPY_NAME(newentry, name) >=
284 			    sizeof(newentry->name)) {
285 				/* Shouldn't happen. */
286 				free(newentry);
287 				err = ENAMETOOLONG;
288 				break;
289 			}
290 #undef BE_COPY_NAME
291 
292 			/*
293 			 * We're building up a SLIST here to make sure both that
294 			 * we get the order right and so that we don't
295 			 * inadvertently observe the wrong state by promoting
296 			 * datasets while we're still walking the tree.  The
297 			 * latter can lead to situations where we promote a BE
298 			 * then effectively demote it again.
299 			 */
300 			SLIST_INSERT_HEAD(&bdd->promotelist, newentry, link);
301 		}
302 		nvlist_free(nvl);
303 	}
304 	zfs_close(zfs_hdl);
305 	return (err);
306 }
307 
308 /*
309  * This is called before a destroy, so that any datasets(environments) that are
310  * dependent on this one get promoted before destroying the target.
311  */
312 static int
313 be_promote_dependent_clones(zfs_handle_t *zfs_hdl, struct be_destroy_data *bdd)
314 {
315 	int err;
316 	zfs_handle_t *clone;
317 	struct promote_entry *entry;
318 
319 	snprintf(bdd->target_name, BE_MAXPATHLEN, "%s/", zfs_get_name(zfs_hdl));
320 	err = zfs_iter_dependents(zfs_hdl, true, be_dependent_clone_cb, bdd);
321 
322 	/*
323 	 * Drain the list and walk away from it if we're only deleting a
324 	 * snapshot.
325 	 */
326 	if (bdd->snapname != NULL && !SLIST_EMPTY(&bdd->promotelist))
327 		err = BE_ERR_HASCLONES;
328 	while (!SLIST_EMPTY(&bdd->promotelist)) {
329 		entry = SLIST_FIRST(&bdd->promotelist);
330 		SLIST_REMOVE_HEAD(&bdd->promotelist, link);
331 
332 #define	ZFS_GRAB_CLONE()	\
333 	zfs_open(bdd->lbh->lzh, entry->name, ZFS_TYPE_FILESYSTEM)
334 		/*
335 		 * Just skip this part on error, we still want to clean up the
336 		 * promotion list after the first error.  We'll then preserve it
337 		 * all the way back.
338 		 */
339 		if (err == 0 && (clone = ZFS_GRAB_CLONE()) != NULL) {
340 			err = zfs_promote(clone);
341 			if (err != 0)
342 				err = BE_ERR_DESTROYMNT;
343 			zfs_close(clone);
344 		}
345 #undef ZFS_GRAB_CLONE
346 		free(entry);
347 	}
348 
349 	return (err);
350 }
351 
352 static int
353 be_destroy_cb(zfs_handle_t *zfs_hdl, void *data)
354 {
355 	char path[BE_MAXPATHLEN];
356 	struct be_destroy_data *bdd;
357 	zfs_handle_t *snap;
358 	int err;
359 
360 	bdd = (struct be_destroy_data *)data;
361 	if (bdd->snapname == NULL) {
362 		err = zfs_iter_children(zfs_hdl, be_destroy_cb, data);
363 		if (err != 0)
364 			return (err);
365 		return (zfs_destroy(zfs_hdl, false));
366 	}
367 	/* If we're dealing with snapshots instead, delete that one alone */
368 	err = zfs_iter_filesystems(zfs_hdl, be_destroy_cb, data);
369 	if (err != 0)
370 		return (err);
371 	/*
372 	 * This part is intentionally glossing over any potential errors,
373 	 * because there's a lot less potential for errors when we're cleaning
374 	 * up snapshots rather than a full deep BE.  The primary error case
375 	 * here being if the snapshot doesn't exist in the first place, which
376 	 * the caller will likely deem insignificant as long as it doesn't
377 	 * exist after the call.  Thus, such a missing snapshot shouldn't jam
378 	 * up the destruction.
379 	 */
380 	snprintf(path, sizeof(path), "%s@%s", zfs_get_name(zfs_hdl),
381 	    bdd->snapname);
382 	if (!zfs_dataset_exists(bdd->lbh->lzh, path, ZFS_TYPE_SNAPSHOT))
383 		return (0);
384 	snap = zfs_open(bdd->lbh->lzh, path, ZFS_TYPE_SNAPSHOT);
385 	if (snap != NULL)
386 		zfs_destroy(snap, false);
387 	return (0);
388 }
389 
390 #define	BE_DESTROY_WANTORIGIN	(BE_DESTROY_ORIGIN | BE_DESTROY_AUTOORIGIN)
391 /*
392  * Destroy the boot environment or snapshot specified by the name
393  * parameter. Options are or'd together with the possible values:
394  * BE_DESTROY_FORCE : forces operation on mounted datasets
395  * BE_DESTROY_ORIGIN: destroy the origin snapshot as well
396  */
397 static int
398 be_destroy_internal(libbe_handle_t *lbh, const char *name, int options,
399     bool odestroyer)
400 {
401 	struct be_destroy_data bdd;
402 	char origin[BE_MAXPATHLEN], path[BE_MAXPATHLEN];
403 	zfs_handle_t *fs;
404 	char *snapdelim;
405 	int err, force, mounted;
406 	size_t rootlen;
407 
408 	bdd.lbh = lbh;
409 	bdd.snapname = NULL;
410 	SLIST_INIT(&bdd.promotelist);
411 	force = options & BE_DESTROY_FORCE;
412 	*origin = '\0';
413 
414 	be_root_concat(lbh, name, path);
415 
416 	if ((snapdelim = strchr(path, '@')) == NULL) {
417 		if (!zfs_dataset_exists(lbh->lzh, path, ZFS_TYPE_FILESYSTEM))
418 			return (set_error(lbh, BE_ERR_NOENT));
419 
420 		if (strcmp(path, lbh->rootfs) == 0 ||
421 		    strcmp(path, lbh->bootfs) == 0)
422 			return (set_error(lbh, BE_ERR_DESTROYACT));
423 
424 		fs = zfs_open(lbh->lzh, path, ZFS_TYPE_FILESYSTEM);
425 		if (fs == NULL)
426 			return (set_error(lbh, BE_ERR_ZFSOPEN));
427 
428 		/* Don't destroy a mounted dataset unless force is specified */
429 		if ((mounted = zfs_is_mounted(fs, NULL)) != 0) {
430 			if (force) {
431 				zfs_unmount(fs, NULL, 0);
432 			} else {
433 				free(bdd.snapname);
434 				return (set_error(lbh, BE_ERR_DESTROYMNT));
435 			}
436 		}
437 	} else {
438 		/*
439 		 * If we're initially destroying a snapshot, origin options do
440 		 * not make sense.  If we're destroying the origin snapshot of
441 		 * a BE, we want to maintain the options in case we need to
442 		 * fake success after failing to promote.
443 		 */
444 		if (!odestroyer)
445 			options &= ~BE_DESTROY_WANTORIGIN;
446 		if (!zfs_dataset_exists(lbh->lzh, path, ZFS_TYPE_SNAPSHOT))
447 			return (set_error(lbh, BE_ERR_NOENT));
448 
449 		bdd.snapname = strdup(snapdelim + 1);
450 		if (bdd.snapname == NULL)
451 			return (set_error(lbh, BE_ERR_NOMEM));
452 		*snapdelim = '\0';
453 		fs = zfs_open(lbh->lzh, path, ZFS_TYPE_DATASET);
454 		if (fs == NULL) {
455 			free(bdd.snapname);
456 			return (set_error(lbh, BE_ERR_ZFSOPEN));
457 		}
458 	}
459 
460 	/*
461 	 * Whether we're destroying a BE or a single snapshot, we need to walk
462 	 * the tree of what we're going to destroy and promote everything in our
463 	 * path so that we can make it happen.
464 	 */
465 	if ((err = be_promote_dependent_clones(fs, &bdd)) != 0) {
466 		free(bdd.snapname);
467 
468 		/*
469 		 * If we're just destroying the origin of some other dataset
470 		 * we were invoked to destroy, then we just ignore
471 		 * BE_ERR_HASCLONES and return success unless the caller wanted
472 		 * to force the issue.
473 		 */
474 		if (odestroyer && err == BE_ERR_HASCLONES &&
475 		    (options & BE_DESTROY_AUTOORIGIN) != 0)
476 			return (0);
477 		return (set_error(lbh, err));
478 	}
479 
480 	/*
481 	 * This was deferred until after we promote all of the derivatives so
482 	 * that we grab the new origin after everything's settled down.
483 	 */
484 	if ((options & BE_DESTROY_WANTORIGIN) != 0 &&
485 	    zfs_prop_get(fs, ZFS_PROP_ORIGIN, origin, sizeof(origin),
486 	    NULL, NULL, 0, 1) != 0 &&
487 	    (options & BE_DESTROY_ORIGIN) != 0)
488 		return (set_error(lbh, BE_ERR_NOORIGIN));
489 
490 	/*
491 	 * If the caller wants auto-origin destruction and the origin
492 	 * name matches one of our automatically created snapshot names
493 	 * (i.e. strftime("%F-%T") with a serial at the end), then
494 	 * we'll set the DESTROY_ORIGIN flag and nuke it
495 	 * be_is_auto_snapshot_name is exported from libbe(3) so that
496 	 * the caller can determine if it needs to warn about the origin
497 	 * not being destroyed or not.
498 	 */
499 	if ((options & BE_DESTROY_AUTOORIGIN) != 0 && *origin != '\0' &&
500 	    be_is_auto_snapshot_name(lbh, origin))
501 		options |= BE_DESTROY_ORIGIN;
502 
503 	err = be_destroy_cb(fs, &bdd);
504 	zfs_close(fs);
505 	free(bdd.snapname);
506 	if (err != 0) {
507 		/* Children are still present or the mount is referenced */
508 		if (err == EBUSY)
509 			return (set_error(lbh, BE_ERR_DESTROYMNT));
510 		return (set_error(lbh, BE_ERR_UNKNOWN));
511 	}
512 
513 	if ((options & BE_DESTROY_ORIGIN) == 0)
514 		return (0);
515 
516 	/* The origin can't possibly be shorter than the BE root */
517 	rootlen = strlen(lbh->root);
518 	if (*origin == '\0' || strlen(origin) <= rootlen + 1)
519 		return (set_error(lbh, BE_ERR_INVORIGIN));
520 
521 	/*
522 	 * We'll be chopping off the BE root and running this back through
523 	 * be_destroy, so that we properly handle the origin snapshot whether
524 	 * it be that of a deep BE or not.
525 	 */
526 	if (strncmp(origin, lbh->root, rootlen) != 0 || origin[rootlen] != '/')
527 		return (0);
528 
529 	return (be_destroy_internal(lbh, origin + rootlen + 1,
530 	    options & ~BE_DESTROY_ORIGIN, true));
531 }
532 
533 int
534 be_destroy(libbe_handle_t *lbh, const char *name, int options)
535 {
536 
537 	/*
538 	 * The consumer must not set both BE_DESTROY_AUTOORIGIN and
539 	 * BE_DESTROY_ORIGIN.  Internally, we'll set the latter from the former.
540 	 * The latter should imply that we must succeed at destroying the
541 	 * origin, or complain otherwise.
542 	 */
543 	if ((options & BE_DESTROY_WANTORIGIN) == BE_DESTROY_WANTORIGIN)
544 		return (set_error(lbh, BE_ERR_UNKNOWN));
545 	return (be_destroy_internal(lbh, name, options, false));
546 }
547 
548 static void
549 be_setup_snapshot_name(libbe_handle_t *lbh, char *buf, size_t buflen)
550 {
551 	time_t rawtime;
552 	int len, serial;
553 
554 	time(&rawtime);
555 	len = strlen(buf);
556 	len += strftime(buf + len, buflen - len, "@%F-%T", localtime(&rawtime));
557 	/* No room for serial... caller will do its best */
558 	if (buflen - len < 2)
559 		return;
560 
561 	for (serial = 0; serial < BE_SNAP_SERIAL_MAX; ++serial) {
562 		snprintf(buf + len, buflen - len, "-%d", serial);
563 		if (!zfs_dataset_exists(lbh->lzh, buf, ZFS_TYPE_SNAPSHOT))
564 			return;
565 	}
566 }
567 
568 bool
569 be_is_auto_snapshot_name(libbe_handle_t *lbh __unused, const char *name)
570 {
571 	const char *snap;
572 	int day, hour, minute, month, second, serial, year;
573 
574 	if ((snap = strchr(name, '@')) == NULL)
575 		return (false);
576 	++snap;
577 	/* We'll grab the individual components and do some light validation. */
578 	if (sscanf(snap, "%d-%d-%d-%d:%d:%d-%d", &year, &month, &day, &hour,
579 	    &minute, &second, &serial) != 7)
580 		return (false);
581 	return (year >= 1970) && (month >= 1 && month <= 12) &&
582 	    (day >= 1 && day <= 31) && (hour >= 0 && hour <= 23) &&
583 	    (minute >= 0 && minute <= 59) && (second >= 0 && second <= 60) &&
584 	    serial >= 0;
585 }
586 
587 int
588 be_snapshot(libbe_handle_t *lbh, const char *source, const char *snap_name,
589     bool recursive, char *result)
590 {
591 	char buf[BE_MAXPATHLEN];
592 	int err;
593 
594 	be_root_concat(lbh, source, buf);
595 
596 	if ((err = be_exists(lbh, buf)) != 0)
597 		return (set_error(lbh, err));
598 
599 	if (snap_name != NULL) {
600 		if (strlcat(buf, "@", sizeof(buf)) >= sizeof(buf))
601 			return (set_error(lbh, BE_ERR_INVALIDNAME));
602 
603 		if (strlcat(buf, snap_name, sizeof(buf)) >= sizeof(buf))
604 			return (set_error(lbh, BE_ERR_INVALIDNAME));
605 
606 		if (result != NULL)
607 			snprintf(result, BE_MAXPATHLEN, "%s@%s", source,
608 			    snap_name);
609 	} else {
610 		be_setup_snapshot_name(lbh, buf, sizeof(buf));
611 
612 		if (result != NULL && strlcpy(result, strrchr(buf, '/') + 1,
613 		    sizeof(buf)) >= sizeof(buf))
614 			return (set_error(lbh, BE_ERR_INVALIDNAME));
615 	}
616 	if ((err = zfs_snapshot(lbh->lzh, buf, recursive, NULL)) != 0) {
617 		switch (err) {
618 		case EZFS_INVALIDNAME:
619 			return (set_error(lbh, BE_ERR_INVALIDNAME));
620 
621 		default:
622 			/*
623 			 * The other errors that zfs_ioc_snapshot might return
624 			 * shouldn't happen if we've set things up properly, so
625 			 * we'll gloss over them and call it UNKNOWN as it will
626 			 * require further triage.
627 			 */
628 			if (errno == ENOTSUP)
629 				return (set_error(lbh, BE_ERR_NOPOOL));
630 			return (set_error(lbh, BE_ERR_UNKNOWN));
631 		}
632 	}
633 
634 	return (BE_ERR_SUCCESS);
635 }
636 
637 
638 /*
639  * Create the boot environment specified by the name parameter
640  */
641 int
642 be_create(libbe_handle_t *lbh, const char *name)
643 {
644 	int err;
645 
646 	err = be_create_from_existing(lbh, name, be_active_path(lbh));
647 
648 	return (set_error(lbh, err));
649 }
650 
651 static int
652 be_deep_clone_prop(int prop, void *cb)
653 {
654 	int err;
655         struct libbe_dccb *dccb;
656 	zprop_source_t src;
657 	char pval[BE_MAXPATHLEN];
658 	char source[BE_MAXPATHLEN];
659 	char *val;
660 
661 	dccb = cb;
662 	/* Skip some properties we don't want to touch */
663 	if (prop == ZFS_PROP_CANMOUNT)
664 		return (ZPROP_CONT);
665 
666 	/* Don't copy readonly properties */
667 	if (zfs_prop_readonly(prop))
668 		return (ZPROP_CONT);
669 
670 	if ((err = zfs_prop_get(dccb->zhp, prop, (char *)&pval,
671 	    sizeof(pval), &src, (char *)&source, sizeof(source), false)))
672 		/* Just continue if we fail to read a property */
673 		return (ZPROP_CONT);
674 
675 	/*
676 	 * Only copy locally defined or received properties.  This continues
677 	 * to avoid temporary/default/local properties intentionally without
678 	 * breaking received datasets.
679 	 */
680 	if (src != ZPROP_SRC_LOCAL && src != ZPROP_SRC_RECEIVED)
681 		return (ZPROP_CONT);
682 
683 	/* Augment mountpoint with altroot, if needed */
684 	val = pval;
685 	if (prop == ZFS_PROP_MOUNTPOINT)
686 		val = be_mountpoint_augmented(dccb->lbh, val);
687 
688 	nvlist_add_string(dccb->props, zfs_prop_to_name(prop), val);
689 
690 	return (ZPROP_CONT);
691 }
692 
693 /*
694  * Return the corresponding boot environment path for a given
695  * dataset path, the constructed path is placed in 'result'.
696  *
697  * example: say our new boot environment name is 'bootenv' and
698  *          the dataset path is 'zroot/ROOT/default/data/set'.
699  *
700  * result should produce: 'zroot/ROOT/bootenv/data/set'
701  */
702 static int
703 be_get_path(struct libbe_deep_clone *ldc, const char *dspath, char *result, int result_size)
704 {
705 	char *pos;
706 	char *child_dataset;
707 
708 	/* match the root path for the boot environments */
709 	pos = strstr(dspath, ldc->lbh->root);
710 
711 	/* no match, different pools? */
712 	if (pos == NULL)
713 		return (BE_ERR_BADPATH);
714 
715 	/* root path of the new boot environment */
716 	snprintf(result, result_size, "%s/%s", ldc->lbh->root, ldc->bename);
717 
718         /* gets us to the parent dataset, the +1 consumes a trailing slash */
719 	pos += strlen(ldc->lbh->root) + 1;
720 
721 	/* skip the parent dataset */
722 	if ((child_dataset = strchr(pos, '/')) != NULL)
723 		strlcat(result, child_dataset, result_size);
724 
725 	return (BE_ERR_SUCCESS);
726 }
727 
728 static int
729 be_clone_cb(zfs_handle_t *ds, void *data)
730 {
731 	int err;
732 	char be_path[BE_MAXPATHLEN];
733 	char snap_path[BE_MAXPATHLEN];
734 	const char *dspath;
735 	zfs_handle_t *snap_hdl;
736 	nvlist_t *props;
737 	struct libbe_deep_clone *ldc;
738 	struct libbe_dccb dccb;
739 
740 	ldc = (struct libbe_deep_clone *)data;
741 	dspath = zfs_get_name(ds);
742 
743 	snprintf(snap_path, sizeof(snap_path), "%s@%s", dspath, ldc->snapname);
744 
745 	/* construct the boot environment path from the dataset we're cloning */
746 	if (be_get_path(ldc, dspath, be_path, sizeof(be_path)) != BE_ERR_SUCCESS)
747 		return (set_error(ldc->lbh, BE_ERR_UNKNOWN));
748 
749 	/* the dataset to be created (i.e. the boot environment) already exists */
750 	if (zfs_dataset_exists(ldc->lbh->lzh, be_path, ZFS_TYPE_DATASET))
751 		return (set_error(ldc->lbh, BE_ERR_EXISTS));
752 
753 	/* no snapshot found for this dataset, silently skip it */
754 	if (!zfs_dataset_exists(ldc->lbh->lzh, snap_path, ZFS_TYPE_SNAPSHOT))
755 		return (0);
756 
757 	if ((snap_hdl =
758 	    zfs_open(ldc->lbh->lzh, snap_path, ZFS_TYPE_SNAPSHOT)) == NULL)
759 		return (set_error(ldc->lbh, BE_ERR_ZFSOPEN));
760 
761 	nvlist_alloc(&props, NV_UNIQUE_NAME, KM_SLEEP);
762 	nvlist_add_string(props, "canmount", "noauto");
763 
764 	dccb.lbh = ldc->lbh;
765 	dccb.zhp = ds;
766 	dccb.props = props;
767 	if (zprop_iter(be_deep_clone_prop, &dccb, B_FALSE, B_FALSE,
768 	    ZFS_TYPE_FILESYSTEM) == ZPROP_INVAL)
769 		return (-1);
770 
771 	if ((err = zfs_clone(snap_hdl, be_path, props)) != 0)
772 		return (set_error(ldc->lbh, BE_ERR_ZFSCLONE));
773 
774 	nvlist_free(props);
775 	zfs_close(snap_hdl);
776 
777 	if (ldc->depth_limit == -1 || ldc->depth < ldc->depth_limit) {
778 		ldc->depth++;
779 		err = zfs_iter_filesystems(ds, be_clone_cb, ldc);
780 		ldc->depth--;
781 	}
782 
783 	return (set_error(ldc->lbh, err));
784 }
785 
786 /*
787  * Create a boot environment with a given name from a given snapshot.
788  * Snapshots can be in the format 'zroot/ROOT/default@snapshot' or
789  * 'default@snapshot'. In the latter case, 'default@snapshot' will be prepended
790  * with the root path that libbe was initailized with.
791 */
792 static int
793 be_clone(libbe_handle_t *lbh, const char *bename, const char *snapshot, int depth)
794 {
795 	int err;
796 	char snap_path[BE_MAXPATHLEN];
797 	char *parentname, *snapname;
798 	zfs_handle_t *parent_hdl;
799 	struct libbe_deep_clone ldc;
800 
801         /* ensure the boot environment name is valid */
802 	if ((err = be_validate_name(lbh, bename)) != 0)
803 		return (set_error(lbh, err));
804 
805 	/*
806 	 * prepend the boot environment root path if we're
807 	 * given a partial snapshot name.
808 	 */
809 	if ((err = be_root_concat(lbh, snapshot, snap_path)) != 0)
810 		return (set_error(lbh, err));
811 
812 	/* ensure the snapshot exists */
813 	if ((err = be_validate_snap(lbh, snap_path)) != 0)
814 		return (set_error(lbh, err));
815 
816         /* get a copy of the snapshot path so we can disect it */
817 	if ((parentname = strdup(snap_path)) == NULL)
818 		return (set_error(lbh, BE_ERR_UNKNOWN));
819 
820         /* split dataset name from snapshot name */
821 	snapname = strchr(parentname, '@');
822 	if (snapname == NULL) {
823 		free(parentname);
824 		return (set_error(lbh, BE_ERR_UNKNOWN));
825 	}
826 	*snapname = '\0';
827 	snapname++;
828 
829         /* set-up the boot environment */
830         ldc.lbh = lbh;
831         ldc.bename = bename;
832         ldc.snapname = snapname;
833 	ldc.depth = 0;
834 	ldc.depth_limit = depth;
835 
836         /* the boot environment will be cloned from this dataset */
837 	parent_hdl = zfs_open(lbh->lzh, parentname, ZFS_TYPE_DATASET);
838 
839         /* create the boot environment */
840 	err = be_clone_cb(parent_hdl, &ldc);
841 
842 	free(parentname);
843 	return (set_error(lbh, err));
844 }
845 
846 /*
847  * Create a boot environment from pre-existing snapshot, specifying a depth.
848  */
849 int be_create_depth(libbe_handle_t *lbh, const char *bename,
850 		    const char *snap, int depth)
851 {
852 	return (be_clone(lbh, bename, snap, depth));
853 }
854 
855 /*
856  * Create the boot environment from pre-existing snapshot
857  */
858 int
859 be_create_from_existing_snap(libbe_handle_t *lbh, const char *bename,
860     const char *snap)
861 {
862 	return (be_clone(lbh, bename, snap, -1));
863 }
864 
865 
866 /*
867  * Create a boot environment from an existing boot environment
868  */
869 int
870 be_create_from_existing(libbe_handle_t *lbh, const char *bename, const char *old)
871 {
872 	int err;
873 	char snap[BE_MAXPATHLEN];
874 
875 	if ((err = be_snapshot(lbh, old, NULL, true, snap)) != 0)
876 		return (set_error(lbh, err));
877 
878         err = be_clone(lbh, bename, snap, -1);
879 
880 	return (set_error(lbh, err));
881 }
882 
883 
884 /*
885  * Verifies that a snapshot has a valid name, exists, and has a mountpoint of
886  * '/'. Returns BE_ERR_SUCCESS (0), upon success, or the relevant BE_ERR_* upon
887  * failure. Does not set the internal library error state.
888  */
889 int
890 be_validate_snap(libbe_handle_t *lbh, const char *snap_name)
891 {
892 
893 	if (strlen(snap_name) >= BE_MAXPATHLEN)
894 		return (BE_ERR_PATHLEN);
895 
896 	if (!zfs_name_valid(snap_name, ZFS_TYPE_SNAPSHOT))
897 		return (BE_ERR_INVALIDNAME);
898 
899 	if (!zfs_dataset_exists(lbh->lzh, snap_name,
900 	    ZFS_TYPE_SNAPSHOT))
901 		return (BE_ERR_NOENT);
902 
903 	return (BE_ERR_SUCCESS);
904 }
905 
906 
907 /*
908  * Idempotently appends the name argument to the root boot environment path
909  * and copies the resulting string into the result buffer (which is assumed
910  * to be at least BE_MAXPATHLEN characters long. Returns BE_ERR_SUCCESS upon
911  * success, BE_ERR_PATHLEN if the resulting path is longer than BE_MAXPATHLEN,
912  * or BE_ERR_INVALIDNAME if the name is a path that does not begin with
913  * zfs_be_root. Does not set internal library error state.
914  */
915 int
916 be_root_concat(libbe_handle_t *lbh, const char *name, char *result)
917 {
918 	size_t name_len, root_len;
919 
920 	name_len = strlen(name);
921 	root_len = strlen(lbh->root);
922 
923 	/* Act idempotently; return be name if it is already a full path */
924 	if (strrchr(name, '/') != NULL) {
925 		if (strstr(name, lbh->root) != name)
926 			return (BE_ERR_INVALIDNAME);
927 
928 		if (name_len >= BE_MAXPATHLEN)
929 			return (BE_ERR_PATHLEN);
930 
931 		strlcpy(result, name, BE_MAXPATHLEN);
932 		return (BE_ERR_SUCCESS);
933 	} else if (name_len + root_len + 1 < BE_MAXPATHLEN) {
934 		snprintf(result, BE_MAXPATHLEN, "%s/%s", lbh->root,
935 		    name);
936 		return (BE_ERR_SUCCESS);
937 	}
938 
939 	return (BE_ERR_PATHLEN);
940 }
941 
942 
943 /*
944  * Verifies the validity of a boot environment name (A-Za-z0-9-_.). Returns
945  * BE_ERR_SUCCESS (0) if name is valid, otherwise returns BE_ERR_INVALIDNAME
946  * or BE_ERR_PATHLEN.
947  * Does not set internal library error state.
948  */
949 int
950 be_validate_name(libbe_handle_t *lbh, const char *name)
951 {
952 
953 	/*
954 	 * Impose the additional restriction that the entire dataset name must
955 	 * not exceed the maximum length of a dataset, i.e. MAXNAMELEN.
956 	 */
957 	if (strlen(lbh->root) + 1 + strlen(name) > MAXNAMELEN)
958 		return (BE_ERR_PATHLEN);
959 
960 	if (!zfs_name_valid(name, ZFS_TYPE_DATASET))
961 		return (BE_ERR_INVALIDNAME);
962 
963 	return (BE_ERR_SUCCESS);
964 }
965 
966 
967 /*
968  * usage
969  */
970 int
971 be_rename(libbe_handle_t *lbh, const char *old, const char *new)
972 {
973 	char full_old[BE_MAXPATHLEN];
974 	char full_new[BE_MAXPATHLEN];
975 	zfs_handle_t *zfs_hdl;
976 	int err;
977 
978 	/*
979 	 * be_validate_name is documented not to set error state, so we should
980 	 * do so here.
981 	 */
982 	if ((err = be_validate_name(lbh, new)) != 0)
983 		return (set_error(lbh, err));
984 	if ((err = be_root_concat(lbh, old, full_old)) != 0)
985 		return (set_error(lbh, err));
986 	if ((err = be_root_concat(lbh, new, full_new)) != 0)
987 		return (set_error(lbh, err));
988 
989 	if (!zfs_dataset_exists(lbh->lzh, full_old, ZFS_TYPE_DATASET))
990 		return (set_error(lbh, BE_ERR_NOENT));
991 
992 	if (zfs_dataset_exists(lbh->lzh, full_new, ZFS_TYPE_DATASET))
993 		return (set_error(lbh, BE_ERR_EXISTS));
994 
995 	if ((zfs_hdl = zfs_open(lbh->lzh, full_old,
996 	    ZFS_TYPE_FILESYSTEM)) == NULL)
997 		return (set_error(lbh, BE_ERR_ZFSOPEN));
998 
999 
1000 	err = zfs_rename(zfs_hdl,full_new, B_FALSE, B_FALSE);
1001 
1002 	zfs_close(zfs_hdl);
1003 	if (err != 0)
1004 		return (set_error(lbh, BE_ERR_UNKNOWN));
1005 	return (0);
1006 }
1007 
1008 
1009 int
1010 be_export(libbe_handle_t *lbh, const char *bootenv, int fd)
1011 {
1012 	char snap_name[BE_MAXPATHLEN];
1013 	char buf[BE_MAXPATHLEN];
1014 	zfs_handle_t *zfs;
1015 	sendflags_t flags = { 0 };
1016 	int err;
1017 
1018 	if ((err = be_snapshot(lbh, bootenv, NULL, true, snap_name)) != 0)
1019 		/* Use the error set by be_snapshot */
1020 		return (err);
1021 
1022 	be_root_concat(lbh, snap_name, buf);
1023 
1024 	if ((zfs = zfs_open(lbh->lzh, buf, ZFS_TYPE_DATASET)) == NULL)
1025 		return (set_error(lbh, BE_ERR_ZFSOPEN));
1026 
1027 	err = zfs_send_one(zfs, NULL, fd, &flags, /* redactbook */ NULL);
1028 	zfs_close(zfs);
1029 
1030 	return (err);
1031 }
1032 
1033 
1034 int
1035 be_import(libbe_handle_t *lbh, const char *bootenv, int fd)
1036 {
1037 	char buf[BE_MAXPATHLEN];
1038 	nvlist_t *props;
1039 	zfs_handle_t *zfs;
1040 	recvflags_t flags = { .nomount = 1 };
1041 	int err;
1042 
1043 	be_root_concat(lbh, bootenv, buf);
1044 
1045 	if ((err = zfs_receive(lbh->lzh, buf, NULL, &flags, fd, NULL)) != 0) {
1046 		switch (err) {
1047 		case EINVAL:
1048 			return (set_error(lbh, BE_ERR_NOORIGIN));
1049 		case ENOENT:
1050 			return (set_error(lbh, BE_ERR_NOENT));
1051 		case EIO:
1052 			return (set_error(lbh, BE_ERR_IO));
1053 		default:
1054 			return (set_error(lbh, BE_ERR_UNKNOWN));
1055 		}
1056 	}
1057 
1058 	if ((zfs = zfs_open(lbh->lzh, buf, ZFS_TYPE_FILESYSTEM)) == NULL)
1059 		return (set_error(lbh, BE_ERR_ZFSOPEN));
1060 
1061 	nvlist_alloc(&props, NV_UNIQUE_NAME, KM_SLEEP);
1062 	nvlist_add_string(props, "canmount", "noauto");
1063 	nvlist_add_string(props, "mountpoint", "none");
1064 
1065 	err = zfs_prop_set_list(zfs, props);
1066 	nvlist_free(props);
1067 
1068 	zfs_close(zfs);
1069 
1070 	if (err != 0)
1071 		return (set_error(lbh, BE_ERR_UNKNOWN));
1072 
1073 	return (0);
1074 }
1075 
1076 #if SOON
1077 static int
1078 be_create_child_noent(libbe_handle_t *lbh, const char *active,
1079     const char *child_path)
1080 {
1081 	nvlist_t *props;
1082 	zfs_handle_t *zfs;
1083 	int err;
1084 
1085 	nvlist_alloc(&props, NV_UNIQUE_NAME, KM_SLEEP);
1086 	nvlist_add_string(props, "canmount", "noauto");
1087 	nvlist_add_string(props, "mountpoint", child_path);
1088 
1089 	/* Create */
1090 	if ((err = zfs_create(lbh->lzh, active, ZFS_TYPE_DATASET,
1091 	    props)) != 0) {
1092 		switch (err) {
1093 		case EZFS_EXISTS:
1094 			return (set_error(lbh, BE_ERR_EXISTS));
1095 		case EZFS_NOENT:
1096 			return (set_error(lbh, BE_ERR_NOENT));
1097 		case EZFS_BADTYPE:
1098 		case EZFS_BADVERSION:
1099 			return (set_error(lbh, BE_ERR_NOPOOL));
1100 		case EZFS_BADPROP:
1101 		default:
1102 			/* We set something up wrong, probably... */
1103 			return (set_error(lbh, BE_ERR_UNKNOWN));
1104 		}
1105 	}
1106 	nvlist_free(props);
1107 
1108 	if ((zfs = zfs_open(lbh->lzh, active, ZFS_TYPE_DATASET)) == NULL)
1109 		return (set_error(lbh, BE_ERR_ZFSOPEN));
1110 
1111 	/* Set props */
1112 	if ((err = zfs_prop_set(zfs, "canmount", "noauto")) != 0) {
1113 		zfs_close(zfs);
1114 		/*
1115 		 * Similar to other cases, this shouldn't fail unless we've
1116 		 * done something wrong.  This is a new dataset that shouldn't
1117 		 * have been mounted anywhere between creation and now.
1118 		 */
1119 		if (err == EZFS_NOMEM)
1120 			return (set_error(lbh, BE_ERR_NOMEM));
1121 		return (set_error(lbh, BE_ERR_UNKNOWN));
1122 	}
1123 	zfs_close(zfs);
1124 	return (BE_ERR_SUCCESS);
1125 }
1126 
1127 static int
1128 be_create_child_cloned(libbe_handle_t *lbh, const char *active)
1129 {
1130 	char buf[BE_MAXPATHLEN], tmp[BE_MAXPATHLEN];;
1131 	zfs_handle_t *zfs;
1132 	int err;
1133 
1134 	/* XXX TODO ? */
1135 
1136 	/*
1137 	 * Establish if the existing path is a zfs dataset or just
1138 	 * the subdirectory of one
1139 	 */
1140 	strlcpy(tmp, "tmp/be_snap.XXXXX", sizeof(tmp));
1141 	if (mktemp(tmp) == NULL)
1142 		return (set_error(lbh, BE_ERR_UNKNOWN));
1143 
1144 	be_root_concat(lbh, tmp, buf);
1145 	printf("Here %s?\n", buf);
1146 	if ((err = zfs_snapshot(lbh->lzh, buf, false, NULL)) != 0) {
1147 		switch (err) {
1148 		case EZFS_INVALIDNAME:
1149 			return (set_error(lbh, BE_ERR_INVALIDNAME));
1150 
1151 		default:
1152 			/*
1153 			 * The other errors that zfs_ioc_snapshot might return
1154 			 * shouldn't happen if we've set things up properly, so
1155 			 * we'll gloss over them and call it UNKNOWN as it will
1156 			 * require further triage.
1157 			 */
1158 			if (errno == ENOTSUP)
1159 				return (set_error(lbh, BE_ERR_NOPOOL));
1160 			return (set_error(lbh, BE_ERR_UNKNOWN));
1161 		}
1162 	}
1163 
1164 	/* Clone */
1165 	if ((zfs = zfs_open(lbh->lzh, buf, ZFS_TYPE_SNAPSHOT)) == NULL)
1166 		return (BE_ERR_ZFSOPEN);
1167 
1168 	if ((err = zfs_clone(zfs, active, NULL)) != 0)
1169 		/* XXX TODO correct error */
1170 		return (set_error(lbh, BE_ERR_UNKNOWN));
1171 
1172 	/* set props */
1173 	zfs_close(zfs);
1174 	return (BE_ERR_SUCCESS);
1175 }
1176 
1177 int
1178 be_add_child(libbe_handle_t *lbh, const char *child_path, bool cp_if_exists)
1179 {
1180 	struct stat sb;
1181 	char active[BE_MAXPATHLEN], buf[BE_MAXPATHLEN];
1182 	nvlist_t *props;
1183 	const char *s;
1184 
1185 	/* Require absolute paths */
1186 	if (*child_path != '/')
1187 		return (set_error(lbh, BE_ERR_BADPATH));
1188 
1189 	strlcpy(active, be_active_path(lbh), BE_MAXPATHLEN);
1190 	strcpy(buf, active);
1191 
1192 	/* Create non-mountable parent dataset(s) */
1193 	s = child_path;
1194 	for (char *p; (p = strchr(s+1, '/')) != NULL; s = p) {
1195 		size_t len = p - s;
1196 		strncat(buf, s, len);
1197 
1198 		nvlist_alloc(&props, NV_UNIQUE_NAME, KM_SLEEP);
1199 		nvlist_add_string(props, "canmount", "off");
1200 		nvlist_add_string(props, "mountpoint", "none");
1201 		zfs_create(lbh->lzh, buf, ZFS_TYPE_DATASET, props);
1202 		nvlist_free(props);
1203 	}
1204 
1205 	/* Path does not exist as a descendent of / yet */
1206 	if (strlcat(active, child_path, BE_MAXPATHLEN) >= BE_MAXPATHLEN)
1207 		return (set_error(lbh, BE_ERR_PATHLEN));
1208 
1209 	if (stat(child_path, &sb) != 0) {
1210 		/* Verify that error is ENOENT */
1211 		if (errno != ENOENT)
1212 			return (set_error(lbh, BE_ERR_UNKNOWN));
1213 		return (be_create_child_noent(lbh, active, child_path));
1214 	} else if (cp_if_exists)
1215 		/* Path is already a descendent of / and should be copied */
1216 		return (be_create_child_cloned(lbh, active));
1217 	return (set_error(lbh, BE_ERR_EXISTS));
1218 }
1219 #endif	/* SOON */
1220 
1221 static int
1222 be_set_nextboot(libbe_handle_t *lbh, nvlist_t *config, uint64_t pool_guid,
1223     const char *zfsdev)
1224 {
1225 	nvlist_t **child;
1226 	uint64_t vdev_guid;
1227 	int c, children;
1228 
1229 	if (nvlist_lookup_nvlist_array(config, ZPOOL_CONFIG_CHILDREN, &child,
1230 	    &children) == 0) {
1231 		for (c = 0; c < children; ++c)
1232 			if (be_set_nextboot(lbh, child[c], pool_guid, zfsdev) != 0)
1233 				return (1);
1234 		return (0);
1235 	}
1236 
1237 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_GUID,
1238 	    &vdev_guid) != 0) {
1239 		return (1);
1240 	}
1241 
1242 	if (zpool_nextboot(lbh->lzh, pool_guid, vdev_guid, zfsdev) != 0) {
1243 		perror("ZFS_IOC_NEXTBOOT failed");
1244 		return (1);
1245 	}
1246 
1247 	return (0);
1248 }
1249 
1250 /*
1251  * Deactivate old BE dataset; currently just sets canmount=noauto
1252  */
1253 static int
1254 be_deactivate(libbe_handle_t *lbh, const char *ds)
1255 {
1256 	zfs_handle_t *zfs;
1257 
1258 	if ((zfs = zfs_open(lbh->lzh, ds, ZFS_TYPE_DATASET)) == NULL)
1259 		return (1);
1260 	if (zfs_prop_set(zfs, "canmount", "noauto") != 0)
1261 		return (1);
1262 	zfs_close(zfs);
1263 	return (0);
1264 }
1265 
1266 int
1267 be_activate(libbe_handle_t *lbh, const char *bootenv, bool temporary)
1268 {
1269 	char be_path[BE_MAXPATHLEN];
1270 	char buf[BE_MAXPATHLEN];
1271 	nvlist_t *config, *dsprops, *vdevs;
1272 	char *origin;
1273 	uint64_t pool_guid;
1274 	zfs_handle_t *zhp;
1275 	int err;
1276 
1277 	be_root_concat(lbh, bootenv, be_path);
1278 
1279 	/* Note: be_exists fails if mountpoint is not / */
1280 	if ((err = be_exists(lbh, be_path)) != 0)
1281 		return (set_error(lbh, err));
1282 
1283 	if (temporary) {
1284 		config = zpool_get_config(lbh->active_phandle, NULL);
1285 		if (config == NULL)
1286 			/* config should be fetchable... */
1287 			return (set_error(lbh, BE_ERR_UNKNOWN));
1288 
1289 		if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID,
1290 		    &pool_guid) != 0)
1291 			/* Similarly, it shouldn't be possible */
1292 			return (set_error(lbh, BE_ERR_UNKNOWN));
1293 
1294 		/* Expected format according to zfsbootcfg(8) man */
1295 		snprintf(buf, sizeof(buf), "zfs:%s:", be_path);
1296 
1297 		/* We have no config tree */
1298 		if (nvlist_lookup_nvlist(config, ZPOOL_CONFIG_VDEV_TREE,
1299 		    &vdevs) != 0)
1300 			return (set_error(lbh, BE_ERR_NOPOOL));
1301 
1302 		return (be_set_nextboot(lbh, vdevs, pool_guid, buf));
1303 	} else {
1304 		if (be_deactivate(lbh, lbh->bootfs) != 0)
1305 			return (-1);
1306 
1307 		/* Obtain bootenv zpool */
1308 		err = zpool_set_prop(lbh->active_phandle, "bootfs", be_path);
1309 		if (err)
1310 			return (-1);
1311 
1312 		zhp = zfs_open(lbh->lzh, be_path, ZFS_TYPE_FILESYSTEM);
1313 		if (zhp == NULL)
1314 			return (-1);
1315 
1316 		if (be_prop_list_alloc(&dsprops) != 0)
1317 			return (-1);
1318 
1319 		if (be_get_dataset_props(lbh, be_path, dsprops) != 0) {
1320 			nvlist_free(dsprops);
1321 			return (-1);
1322 		}
1323 
1324 		if (nvlist_lookup_string(dsprops, "origin", &origin) == 0)
1325 			err = zfs_promote(zhp);
1326 		nvlist_free(dsprops);
1327 
1328 		zfs_close(zhp);
1329 
1330 		if (err)
1331 			return (-1);
1332 	}
1333 
1334 	return (BE_ERR_SUCCESS);
1335 }
1336