--- old/usr/src/cmd/lofiadm/main.c	2016-01-17 00:44:07.556105688 +0300
+++ new/usr/src/cmd/lofiadm/main.c	2016-01-17 00:44:07.575856533 +0300
@@ -25,6 +25,7 @@
  *
  * Copyright 2013 Nexenta Systems, Inc. All rights reserved.
  * Copyright (c) 2014 Gary Mills
+ * Copyright (c) 2016 Andrey Sokolov
  */
 
 /*
@@ -68,7 +69,7 @@
 
 static const char USAGE[] =
 	"Usage: %s [-r] -a file [ device ]\n"
-	"       %s [-r] -c crypto_algorithm -a file [device]\n"
+	"       %s [-r] [-o] -c crypto_algorithm -a file [device]\n"
 	"       %s [-r] -c crypto_algorithm -k raw_key_file -a file [device]\n"
 	"       %s [-r] -c crypto_algorithm -T [token]:[manuf]:[serial]:key "
 	"-a file [device]\n"
@@ -215,7 +216,7 @@
 /*ARGSUSED*/
 static int
 lzma_compress(void *src, size_t srclen, void *dst,
-	size_t *dstlen, int level)
+    size_t *dstlen, int level)
 {
 	CLzmaEncProps props;
 	size_t outsize2;
@@ -835,7 +836,8 @@
  * PBE the passphrase into a raw key
  */
 static void
-getkeyfromuser(mech_alias_t *cipher, char **raw_key, size_t *raw_key_sz)
+getkeyfromuser(mech_alias_t *cipher, char **raw_key, size_t *raw_key_sz,
+    boolean_t with_confirmation)
 {
 	CK_SESSION_HANDLE sess;
 	CK_RV	rv;
@@ -866,7 +868,8 @@
 		goto cleanup;
 
 	/* get user passphrase with 8 byte minimum */
-	if (pkcs11_get_pass(NULL, &pass, &passlen, MIN_PASSLEN, B_TRUE) < 0) {
+	if (pkcs11_get_pass(NULL, &pass, &passlen, MIN_PASSLEN,
+	    with_confirmation) < 0) {
 		die(gettext("passphrases do not match\n"));
 	}
 
@@ -1820,6 +1823,7 @@
 	/* the next two work together for -c, -k, -T, -e options only */
 	boolean_t need_crypto = B_FALSE;	/* if any -c, -k, -T, -e */
 	boolean_t cipher_only = B_TRUE;		/* if -c only */
+	boolean_t with_confirmation = B_TRUE;
 	const char *keyfile = NULL;
 	mech_alias_t *cipher = NULL;
 	token_spec_t *token = NULL;
@@ -1832,7 +1836,7 @@
 	(void) setlocale(LC_ALL, "");
 	(void) textdomain(TEXT_DOMAIN);
 
-	while ((c = getopt(argc, argv, "a:c:Cd:efk:o:rs:T:U")) != EOF) {
+	while ((c = getopt(argc, argv, "a:c:Cd:efk:ors:T:U")) != EOF) {
 		switch (c) {
 		case 'a':
 			addflag = B_TRUE;
@@ -1910,6 +1914,9 @@
 		case 'U':
 			uncompressflag = B_TRUE;
 			break;
+		case 'o':
+			with_confirmation = B_FALSE;
+			break;
 		case '?':
 		default:
 			errflag = B_TRUE;
@@ -1922,6 +1929,7 @@
 	    (addflag && deleteflag) ||
 	    (rdflag && !addflag) ||
 	    (!addflag && need_crypto) ||
+	    (!with_confirmation && (!cipher_only || !need_crypto)) ||
 	    ((compressflag || uncompressflag) && (addflag || deleteflag)))
 		usage(pname);
 
@@ -2021,7 +2029,7 @@
 		init_crypto(token, cipher, &sess);
 
 		if (cipher_only) {
-			getkeyfromuser(cipher, &rkey, &rksz);
+			getkeyfromuser(cipher, &rkey, &rksz, with_confirmation);
 		} else if (token != NULL) {
 			getkeyfromtoken(sess, token, keyfile, cipher,
 			    &rkey, &rksz);
--- old/usr/src/man/man1m/lofiadm.1m	2016-01-17 00:44:08.283924328 +0300
+++ new/usr/src/man/man1m/lofiadm.1m	2016-01-17 00:44:08.303463806 +0300
@@ -1,4 +1,5 @@
 '\" te
+.\" Copyright (c) 2016 Andrey Sokolov
 .\" Copyright 2013 Nexenta Systems, Inc. All rights reserved.
 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
@@ -15,7 +16,7 @@
 
 .LP
 .nf
-\fBlofiadm\fR [\fB-r\fR] \fB-c\fR \fIcrypto_algorithm\fR \fB-a\fR \fIfile\fR [\fIdevice\fR]
+\fBlofiadm\fR [\fB-r\fR] [\fB-o\fR] \fB-c\fR \fIcrypto_algorithm\fR \fB-a\fR \fIfile\fR [\fIdevice\fR]
 .fi
 
 .LP
@@ -60,7 +61,6 @@
 .fi
 
 .SH DESCRIPTION
-.sp
 .LP
 \fBlofiadm\fR administers \fBlofi\fR, the loopback file driver. \fBlofi\fR
 allows a file to be associated with a block device. That file can then be
@@ -82,7 +82,6 @@
 zone devices and all devices owned by other non-global zones on the system.
 .sp
 .SH OPTIONS
-.sp
 .LP
 The following options are supported:
 .sp
@@ -137,6 +136,16 @@
 .sp
 .ne 2
 .na
+\fB\fB-o\fR
+.ad
+.sp .6
+.RS 4n
+If the \fB-o\fR option is specified lofiadm will prompt for a passphrase once.
+.RE
+
+.sp
+.ne 2
+.na
 \fB\fB-r\fR
 .ad
 .sp .6
@@ -221,7 +230,6 @@
 .RE
 
 .SH OPERANDS
-.sp
 .LP
 The following operands are supported:
 .sp
@@ -720,13 +728,11 @@
 .sp
 
 .SH ENVIRONMENT VARIABLES
-.sp
 .LP
 See \fBenviron\fR(5) for descriptions of the following environment variables
 that affect the execution of \fBlofiadm\fR: \fBLC_CTYPE\fR, \fBLC_MESSAGES\fR
 and \fBNLSPATH\fR.
 .SH EXIT STATUS
-.sp
 .LP
 The following exit values are returned:
 .sp
@@ -750,12 +756,10 @@
 .RE
 
 .SH SEE ALSO
-.sp
 .LP
 \fBfsck\fR(1M), \fBmount\fR(1M), \fBmount_ufs\fR(1M), \fBnewfs\fR(1M),
 \fBattributes\fR(5), \fBlofi\fR(7D), \fBlofs\fR(7FS)
 .SH NOTES
-.sp
 .LP
 Just as you would not directly access a disk device that has mounted file
 systems, you should not access a file associated with a block device except
