1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright 2015, Joyent Inc. All rights reserved.
  25  */
  26 
  27 /*
  28  * Zones
  29  *
  30  *   A zone is a named collection of processes, namespace constraints,
  31  *   and other system resources which comprise a secure and manageable
  32  *   application containment facility.
  33  *
  34  *   Zones (represented by the reference counted zone_t) are tracked in
  35  *   the kernel in the zonehash.  Elsewhere in the kernel, Zone IDs
  36  *   (zoneid_t) are used to track zone association.  Zone IDs are
  37  *   dynamically generated when the zone is created; if a persistent
  38  *   identifier is needed (core files, accounting logs, audit trail,
  39  *   etc.), the zone name should be used.
  40  *
  41  *
  42  *   Global Zone:
  43  *
  44  *   The global zone (zoneid 0) is automatically associated with all
  45  *   system resources that have not been bound to a user-created zone.
  46  *   This means that even systems where zones are not in active use
  47  *   have a global zone, and all processes, mounts, etc. are
  48  *   associated with that zone.  The global zone is generally
  49  *   unconstrained in terms of privileges and access, though the usual
  50  *   credential and privilege based restrictions apply.
  51  *
  52  *
  53  *   Zone States:
  54  *
  55  *   The states in which a zone may be in and the transitions are as
  56  *   follows:
  57  *
  58  *   ZONE_IS_UNINITIALIZED: primordial state for a zone. The partially
  59  *   initialized zone is added to the list of active zones on the system but
  60  *   isn't accessible.
  61  *
  62  *   ZONE_IS_INITIALIZED: Initialization complete except the ZSD callbacks are
  63  *   not yet completed. Not possible to enter the zone, but attributes can
  64  *   be retrieved.
  65  *
  66  *   ZONE_IS_READY: zsched (the kernel dummy process for a zone) is
  67  *   ready.  The zone is made visible after the ZSD constructor callbacks are
  68  *   executed.  A zone remains in this state until it transitions into
  69  *   the ZONE_IS_BOOTING state as a result of a call to zone_boot().
  70  *
  71  *   ZONE_IS_BOOTING: in this shortlived-state, zsched attempts to start
  72  *   init.  Should that fail, the zone proceeds to the ZONE_IS_SHUTTING_DOWN
  73  *   state.
  74  *
  75  *   ZONE_IS_RUNNING: The zone is open for business: zsched has
  76  *   successfully started init.   A zone remains in this state until
  77  *   zone_shutdown() is called.
  78  *
  79  *   ZONE_IS_SHUTTING_DOWN: zone_shutdown() has been called, the system is
  80  *   killing all processes running in the zone. The zone remains
  81  *   in this state until there are no more user processes running in the zone.
  82  *   zone_create(), zone_enter(), and zone_destroy() on this zone will fail.
  83  *   Since zone_shutdown() is restartable, it may be called successfully
  84  *   multiple times for the same zone_t.  Setting of the zone's state to
  85  *   ZONE_IS_SHUTTING_DOWN is synchronized with mounts, so VOP_MOUNT() may check
  86  *   the zone's status without worrying about it being a moving target.
  87  *
  88  *   ZONE_IS_EMPTY: zone_shutdown() has been called, and there
  89  *   are no more user processes in the zone.  The zone remains in this
  90  *   state until there are no more kernel threads associated with the
  91  *   zone.  zone_create(), zone_enter(), and zone_destroy() on this zone will
  92  *   fail.
  93  *
  94  *   ZONE_IS_DOWN: All kernel threads doing work on behalf of the zone
  95  *   have exited.  zone_shutdown() returns.  Henceforth it is not possible to
  96  *   join the zone or create kernel threads therein.
  97  *
  98  *   ZONE_IS_DYING: zone_destroy() has been called on the zone; zone
  99  *   remains in this state until zsched exits.  Calls to zone_find_by_*()
 100  *   return NULL from now on.
 101  *
 102  *   ZONE_IS_DEAD: zsched has exited (zone_ntasks == 0).  There are no
 103  *   processes or threads doing work on behalf of the zone.  The zone is
 104  *   removed from the list of active zones.  zone_destroy() returns, and
 105  *   the zone can be recreated.
 106  *
 107  *   ZONE_IS_FREE (internal state): zone_ref goes to 0, ZSD destructor
 108  *   callbacks are executed, and all memory associated with the zone is
 109  *   freed.
 110  *
 111  *   Threads can wait for the zone to enter a requested state by using
 112  *   zone_status_wait() or zone_status_timedwait() with the desired
 113  *   state passed in as an argument.  Zone state transitions are
 114  *   uni-directional; it is not possible to move back to an earlier state.
 115  *
 116  *
 117  *   Zone-Specific Data:
 118  *
 119  *   Subsystems needing to maintain zone-specific data can store that
 120  *   data using the ZSD mechanism.  This provides a zone-specific data
 121  *   store, similar to thread-specific data (see pthread_getspecific(3C)
 122  *   or the TSD code in uts/common/disp/thread.c.  Also, ZSD can be used
 123  *   to register callbacks to be invoked when a zone is created, shut
 124  *   down, or destroyed.  This can be used to initialize zone-specific
 125  *   data for new zones and to clean up when zones go away.
 126  *
 127  *
 128  *   Data Structures:
 129  *
 130  *   The per-zone structure (zone_t) is reference counted, and freed
 131  *   when all references are released.  zone_hold and zone_rele can be
 132  *   used to adjust the reference count.  In addition, reference counts
 133  *   associated with the cred_t structure are tracked separately using
 134  *   zone_cred_hold and zone_cred_rele.
 135  *
 136  *   Pointers to active zone_t's are stored in two hash tables; one
 137  *   for searching by id, the other for searching by name.  Lookups
 138  *   can be performed on either basis, using zone_find_by_id and
 139  *   zone_find_by_name.  Both return zone_t pointers with the zone
 140  *   held, so zone_rele should be called when the pointer is no longer
 141  *   needed.  Zones can also be searched by path; zone_find_by_path
 142  *   returns the zone with which a path name is associated (global
 143  *   zone if the path is not within some other zone's file system
 144  *   hierarchy).  This currently requires iterating through each zone,
 145  *   so it is slower than an id or name search via a hash table.
 146  *
 147  *
 148  *   Locking:
 149  *
 150  *   zonehash_lock: This is a top-level global lock used to protect the
 151  *       zone hash tables and lists.  Zones cannot be created or destroyed
 152  *       while this lock is held.
 153  *   zone_status_lock: This is a global lock protecting zone state.
 154  *       Zones cannot change state while this lock is held.  It also
 155  *       protects the list of kernel threads associated with a zone.
 156  *   zone_lock: This is a per-zone lock used to protect several fields of
 157  *       the zone_t (see <sys/zone.h> for details).  In addition, holding
 158  *       this lock means that the zone cannot go away.
 159  *   zone_nlwps_lock: This is a per-zone lock used to protect the fields
 160  *       related to the zone.max-lwps rctl.
 161  *   zone_mem_lock: This is a per-zone lock used to protect the fields
 162  *       related to the zone.max-locked-memory and zone.max-swap rctls.
 163  *   zone_rctl_lock: This is a per-zone lock used to protect other rctls,
 164  *       currently just max_lofi
 165  *   zsd_key_lock: This is a global lock protecting the key state for ZSD.
 166  *   zone_deathrow_lock: This is a global lock protecting the "deathrow"
 167  *       list (a list of zones in the ZONE_IS_DEAD state).
 168  *
 169  *   Ordering requirements:
 170  *       pool_lock --> cpu_lock --> zonehash_lock --> zone_status_lock -->
 171  *              zone_lock --> zsd_key_lock --> pidlock --> p_lock
 172  *
 173  *   When taking zone_mem_lock or zone_nlwps_lock, the lock ordering is:
 174  *      zonehash_lock --> a_lock --> pidlock --> p_lock --> zone_mem_lock
 175  *      zonehash_lock --> a_lock --> pidlock --> p_lock --> zone_nlwps_lock
 176  *
 177  *   Blocking memory allocations are permitted while holding any of the
 178  *   zone locks.
 179  *
 180  *
 181  *   System Call Interface:
 182  *
 183  *   The zone subsystem can be managed and queried from user level with
 184  *   the following system calls (all subcodes of the primary "zone"
 185  *   system call):
 186  *   - zone_create: creates a zone with selected attributes (name,
 187  *     root path, privileges, resource controls, ZFS datasets)
 188  *   - zone_enter: allows the current process to enter a zone
 189  *   - zone_getattr: reports attributes of a zone
 190  *   - zone_setattr: set attributes of a zone
 191  *   - zone_boot: set 'init' running for the zone
 192  *   - zone_list: lists all zones active in the system
 193  *   - zone_lookup: looks up zone id based on name
 194  *   - zone_shutdown: initiates shutdown process (see states above)
 195  *   - zone_destroy: completes shutdown process (see states above)
 196  *
 197  */
 198 
 199 #include <sys/priv_impl.h>
 200 #include <sys/cred.h>
 201 #include <c2/audit.h>
 202 #include <sys/debug.h>
 203 #include <sys/file.h>
 204 #include <sys/kmem.h>
 205 #include <sys/kstat.h>
 206 #include <sys/mutex.h>
 207 #include <sys/note.h>
 208 #include <sys/pathname.h>
 209 #include <sys/proc.h>
 210 #include <sys/project.h>
 211 #include <sys/sysevent.h>
 212 #include <sys/task.h>
 213 #include <sys/systm.h>
 214 #include <sys/types.h>
 215 #include <sys/utsname.h>
 216 #include <sys/vnode.h>
 217 #include <sys/vfs.h>
 218 #include <sys/systeminfo.h>
 219 #include <sys/policy.h>
 220 #include <sys/cred_impl.h>
 221 #include <sys/contract_impl.h>
 222 #include <sys/contract/process_impl.h>
 223 #include <sys/class.h>
 224 #include <sys/pool.h>
 225 #include <sys/pool_pset.h>
 226 #include <sys/pset.h>
 227 #include <sys/strlog.h>
 228 #include <sys/sysmacros.h>
 229 #include <sys/callb.h>
 230 #include <sys/vmparam.h>
 231 #include <sys/corectl.h>
 232 #include <sys/ipc_impl.h>
 233 #include <sys/klpd.h>
 234 
 235 #include <sys/door.h>
 236 #include <sys/cpuvar.h>
 237 #include <sys/sdt.h>
 238 
 239 #include <sys/uadmin.h>
 240 #include <sys/session.h>
 241 #include <sys/cmn_err.h>
 242 #include <sys/modhash.h>
 243 #include <sys/sunddi.h>
 244 #include <sys/nvpair.h>
 245 #include <sys/rctl.h>
 246 #include <sys/fss.h>
 247 #include <sys/brand.h>
 248 #include <sys/zone.h>
 249 #include <net/if.h>
 250 #include <sys/cpucaps.h>
 251 #include <vm/seg.h>
 252 #include <sys/mac.h>
 253 
 254 /*
 255  * This constant specifies the number of seconds that threads waiting for
 256  * subsystems to release a zone's general-purpose references will wait before
 257  * they log the zone's reference counts.  The constant's value shouldn't
 258  * be so small that reference counts are unnecessarily reported for zones
 259  * whose references are slowly released.  On the other hand, it shouldn't be so
 260  * large that users reboot their systems out of frustration over hung zones
 261  * before the system logs the zones' reference counts.
 262  */
 263 #define ZONE_DESTROY_TIMEOUT_SECS       60
 264 
 265 /* List of data link IDs which are accessible from the zone */
 266 typedef struct zone_dl {
 267         datalink_id_t   zdl_id;
 268         nvlist_t        *zdl_net;
 269         list_node_t     zdl_linkage;
 270 } zone_dl_t;
 271 
 272 /*
 273  * cv used to signal that all references to the zone have been released.  This
 274  * needs to be global since there may be multiple waiters, and the first to
 275  * wake up will free the zone_t, hence we cannot use zone->zone_cv.
 276  */
 277 static kcondvar_t zone_destroy_cv;
 278 /*
 279  * Lock used to serialize access to zone_cv.  This could have been per-zone,
 280  * but then we'd need another lock for zone_destroy_cv, and why bother?
 281  */
 282 static kmutex_t zone_status_lock;
 283 
 284 /*
 285  * ZSD-related global variables.
 286  */
 287 static kmutex_t zsd_key_lock;   /* protects the following two */
 288 /*
 289  * The next caller of zone_key_create() will be assigned a key of ++zsd_keyval.
 290  */
 291 static zone_key_t zsd_keyval = 0;
 292 /*
 293  * Global list of registered keys.  We use this when a new zone is created.
 294  */
 295 static list_t zsd_registered_keys;
 296 
 297 int zone_hash_size = 256;
 298 static mod_hash_t *zonehashbyname, *zonehashbyid, *zonehashbylabel;
 299 static kmutex_t zonehash_lock;
 300 static uint_t zonecount;
 301 static id_space_t *zoneid_space;
 302 
 303 /*
 304  * The global zone (aka zone0) is the all-seeing, all-knowing zone in which the
 305  * kernel proper runs, and which manages all other zones.
 306  *
 307  * Although not declared as static, the variable "zone0" should not be used
 308  * except for by code that needs to reference the global zone early on in boot,
 309  * before it is fully initialized.  All other consumers should use
 310  * 'global_zone'.
 311  */
 312 zone_t zone0;
 313 zone_t *global_zone = NULL;     /* Set when the global zone is initialized */
 314 
 315 /*
 316  * List of active zones, protected by zonehash_lock.
 317  */
 318 static list_t zone_active;
 319 
 320 /*
 321  * List of destroyed zones that still have outstanding cred references.
 322  * Used for debugging.  Uses a separate lock to avoid lock ordering
 323  * problems in zone_free.
 324  */
 325 static list_t zone_deathrow;
 326 static kmutex_t zone_deathrow_lock;
 327 
 328 /* number of zones is limited by virtual interface limit in IP */
 329 uint_t maxzones = 8192;
 330 
 331 /* Event channel to sent zone state change notifications */
 332 evchan_t *zone_event_chan;
 333 
 334 /*
 335  * This table holds the mapping from kernel zone states to
 336  * states visible in the state notification API.
 337  * The idea is that we only expose "obvious" states and
 338  * do not expose states which are just implementation details.
 339  */
 340 const char  *zone_status_table[] = {
 341         ZONE_EVENT_UNINITIALIZED,       /* uninitialized */
 342         ZONE_EVENT_INITIALIZED,         /* initialized */
 343         ZONE_EVENT_READY,               /* ready */
 344         ZONE_EVENT_READY,               /* booting */
 345         ZONE_EVENT_RUNNING,             /* running */
 346         ZONE_EVENT_SHUTTING_DOWN,       /* shutting_down */
 347         ZONE_EVENT_SHUTTING_DOWN,       /* empty */
 348         ZONE_EVENT_SHUTTING_DOWN,       /* down */
 349         ZONE_EVENT_SHUTTING_DOWN,       /* dying */
 350         ZONE_EVENT_UNINITIALIZED,       /* dead */
 351 };
 352 
 353 /*
 354  * This array contains the names of the subsystems listed in zone_ref_subsys_t
 355  * (see sys/zone.h).
 356  */
 357 static char *zone_ref_subsys_names[] = {
 358         "NFS",          /* ZONE_REF_NFS */
 359         "NFSv4",        /* ZONE_REF_NFSV4 */
 360         "SMBFS",        /* ZONE_REF_SMBFS */
 361         "MNTFS",        /* ZONE_REF_MNTFS */
 362         "LOFI",         /* ZONE_REF_LOFI */
 363         "VFS",          /* ZONE_REF_VFS */
 364         "IPC"           /* ZONE_REF_IPC */
 365 };
 366 
 367 /*
 368  * This isn't static so lint doesn't complain.
 369  */
 370 rctl_hndl_t rc_zone_cpu_shares;
 371 rctl_hndl_t rc_zone_locked_mem;
 372 rctl_hndl_t rc_zone_max_swap;
 373 rctl_hndl_t rc_zone_max_lofi;
 374 rctl_hndl_t rc_zone_cpu_cap;
 375 rctl_hndl_t rc_zone_nlwps;
 376 rctl_hndl_t rc_zone_nprocs;
 377 rctl_hndl_t rc_zone_shmmax;
 378 rctl_hndl_t rc_zone_shmmni;
 379 rctl_hndl_t rc_zone_semmni;
 380 rctl_hndl_t rc_zone_msgmni;
 381 
 382 const char * const zone_default_initname = "/sbin/init";
 383 static char * const zone_prefix = "/zone/";
 384 static int zone_shutdown(zoneid_t zoneid);
 385 static int zone_add_datalink(zoneid_t, datalink_id_t);
 386 static int zone_remove_datalink(zoneid_t, datalink_id_t);
 387 static int zone_list_datalink(zoneid_t, int *, datalink_id_t *);
 388 static int zone_set_network(zoneid_t, zone_net_data_t *);
 389 static int zone_get_network(zoneid_t, zone_net_data_t *);
 390 
 391 typedef boolean_t zsd_applyfn_t(kmutex_t *, boolean_t, zone_t *, zone_key_t);
 392 
 393 static void zsd_apply_all_zones(zsd_applyfn_t *, zone_key_t);
 394 static void zsd_apply_all_keys(zsd_applyfn_t *, zone_t *);
 395 static boolean_t zsd_apply_create(kmutex_t *, boolean_t, zone_t *, zone_key_t);
 396 static boolean_t zsd_apply_shutdown(kmutex_t *, boolean_t, zone_t *,
 397     zone_key_t);
 398 static boolean_t zsd_apply_destroy(kmutex_t *, boolean_t, zone_t *, zone_key_t);
 399 static boolean_t zsd_wait_for_creator(zone_t *, struct zsd_entry *,
 400     kmutex_t *);
 401 static boolean_t zsd_wait_for_inprogress(zone_t *, struct zsd_entry *,
 402     kmutex_t *);
 403 
 404 /*
 405  * Bump this number when you alter the zone syscall interfaces; this is
 406  * because we need to have support for previous API versions in libc
 407  * to support patching; libc calls into the kernel to determine this number.
 408  *
 409  * Version 1 of the API is the version originally shipped with Solaris 10
 410  * Version 2 alters the zone_create system call in order to support more
 411  *     arguments by moving the args into a structure; and to do better
 412  *     error reporting when zone_create() fails.
 413  * Version 3 alters the zone_create system call in order to support the
 414  *     import of ZFS datasets to zones.
 415  * Version 4 alters the zone_create system call in order to support
 416  *     Trusted Extensions.
 417  * Version 5 alters the zone_boot system call, and converts its old
 418  *     bootargs parameter to be set by the zone_setattr API instead.
 419  * Version 6 adds the flag argument to zone_create.
 420  */
 421 static const int ZONE_SYSCALL_API_VERSION = 6;
 422 
 423 /*
 424  * Certain filesystems (such as NFS and autofs) need to know which zone
 425  * the mount is being placed in.  Because of this, we need to be able to
 426  * ensure that a zone isn't in the process of being created/destroyed such
 427  * that nfs_mount() thinks it is in the global/NGZ zone, while by the time
 428  * it gets added the list of mounted zones, it ends up on the wrong zone's
 429  * mount list. Since a zone can't reside on an NFS file system, we don't
 430  * have to worry about the zonepath itself.
 431  *
 432  * The following functions: block_mounts()/resume_mounts() and
 433  * mount_in_progress()/mount_completed() are used by zones and the VFS
 434  * layer (respectively) to synchronize zone state transitions and new
 435  * mounts within a zone. This syncronization is on a per-zone basis, so
 436  * activity for one zone will not interfere with activity for another zone.
 437  *
 438  * The semantics are like a reader-reader lock such that there may
 439  * either be multiple mounts (or zone state transitions, if that weren't
 440  * serialized by zonehash_lock) in progress at the same time, but not
 441  * both.
 442  *
 443  * We use cv's so the user can ctrl-C out of the operation if it's
 444  * taking too long.
 445  *
 446  * The semantics are such that there is unfair bias towards the
 447  * "current" operation.  This means that zone halt may starve if
 448  * there is a rapid succession of new mounts coming in to the zone.
 449  */
 450 /*
 451  * Prevent new mounts from progressing to the point of calling
 452  * VFS_MOUNT().  If there are already mounts in this "region", wait for
 453  * them to complete.
 454  */
 455 static int
 456 block_mounts(zone_t *zp)
 457 {
 458         int retval = 0;
 459 
 460         /*
 461          * Since it may block for a long time, block_mounts() shouldn't be
 462          * called with zonehash_lock held.
 463          */
 464         ASSERT(MUTEX_NOT_HELD(&zonehash_lock));
 465         mutex_enter(&zp->zone_mount_lock);
 466         while (zp->zone_mounts_in_progress > 0) {
 467                 if (cv_wait_sig(&zp->zone_mount_cv, &zp->zone_mount_lock) == 0)
 468                         goto signaled;
 469         }
 470         /*
 471          * A negative value of mounts_in_progress indicates that mounts
 472          * have been blocked by (-mounts_in_progress) different callers
 473          * (remotely possible if two threads enter zone_shutdown at the same
 474          * time).
 475          */
 476         zp->zone_mounts_in_progress--;
 477         retval = 1;
 478 signaled:
 479         mutex_exit(&zp->zone_mount_lock);
 480         return (retval);
 481 }
 482 
 483 /*
 484  * The VFS layer may progress with new mounts as far as we're concerned.
 485  * Allow them to progress if we were the last obstacle.
 486  */
 487 static void
 488 resume_mounts(zone_t *zp)
 489 {
 490         mutex_enter(&zp->zone_mount_lock);
 491         if (++zp->zone_mounts_in_progress == 0)
 492                 cv_broadcast(&zp->zone_mount_cv);
 493         mutex_exit(&zp->zone_mount_lock);
 494 }
 495 
 496 /*
 497  * The VFS layer is busy with a mount; this zone should wait until all
 498  * of its mounts are completed to progress.
 499  */
 500 void
 501 mount_in_progress(zone_t *zp)
 502 {
 503         mutex_enter(&zp->zone_mount_lock);
 504         while (zp->zone_mounts_in_progress < 0)
 505                 cv_wait(&zp->zone_mount_cv, &zp->zone_mount_lock);
 506         zp->zone_mounts_in_progress++;
 507         mutex_exit(&zp->zone_mount_lock);
 508 }
 509 
 510 /*
 511  * VFS is done with one mount; wake up any waiting block_mounts()
 512  * callers if this is the last mount.
 513  */
 514 void
 515 mount_completed(zone_t *zp)
 516 {
 517         mutex_enter(&zp->zone_mount_lock);
 518         if (--zp->zone_mounts_in_progress == 0)
 519                 cv_broadcast(&zp->zone_mount_cv);
 520         mutex_exit(&zp->zone_mount_lock);
 521 }
 522 
 523 /*
 524  * ZSD routines.
 525  *
 526  * Zone Specific Data (ZSD) is modeled after Thread Specific Data as
 527  * defined by the pthread_key_create() and related interfaces.
 528  *
 529  * Kernel subsystems may register one or more data items and/or
 530  * callbacks to be executed when a zone is created, shutdown, or
 531  * destroyed.
 532  *
 533  * Unlike the thread counterpart, destructor callbacks will be executed
 534  * even if the data pointer is NULL and/or there are no constructor
 535  * callbacks, so it is the responsibility of such callbacks to check for
 536  * NULL data values if necessary.
 537  *
 538  * The locking strategy and overall picture is as follows:
 539  *
 540  * When someone calls zone_key_create(), a template ZSD entry is added to the
 541  * global list "zsd_registered_keys", protected by zsd_key_lock.  While
 542  * holding that lock all the existing zones are marked as
 543  * ZSD_CREATE_NEEDED and a copy of the ZSD entry added to the per-zone
 544  * zone_zsd list (protected by zone_lock). The global list is updated first
 545  * (under zone_key_lock) to make sure that newly created zones use the
 546  * most recent list of keys. Then under zonehash_lock we walk the zones
 547  * and mark them.  Similar locking is used in zone_key_delete().
 548  *
 549  * The actual create, shutdown, and destroy callbacks are done without
 550  * holding any lock. And zsd_flags are used to ensure that the operations
 551  * completed so that when zone_key_create (and zone_create) is done, as well as
 552  * zone_key_delete (and zone_destroy) is done, all the necessary callbacks
 553  * are completed.
 554  *
 555  * When new zones are created constructor callbacks for all registered ZSD
 556  * entries will be called. That also uses the above two phases of marking
 557  * what needs to be done, and then running the callbacks without holding
 558  * any locks.
 559  *
 560  * The framework does not provide any locking around zone_getspecific() and
 561  * zone_setspecific() apart from that needed for internal consistency, so
 562  * callers interested in atomic "test-and-set" semantics will need to provide
 563  * their own locking.
 564  */
 565 
 566 /*
 567  * Helper function to find the zsd_entry associated with the key in the
 568  * given list.
 569  */
 570 static struct zsd_entry *
 571 zsd_find(list_t *l, zone_key_t key)
 572 {
 573         struct zsd_entry *zsd;
 574 
 575         for (zsd = list_head(l); zsd != NULL; zsd = list_next(l, zsd)) {
 576                 if (zsd->zsd_key == key) {
 577                         return (zsd);
 578                 }
 579         }
 580         return (NULL);
 581 }
 582 
 583 /*
 584  * Helper function to find the zsd_entry associated with the key in the
 585  * given list. Move it to the front of the list.
 586  */
 587 static struct zsd_entry *
 588 zsd_find_mru(list_t *l, zone_key_t key)
 589 {
 590         struct zsd_entry *zsd;
 591 
 592         for (zsd = list_head(l); zsd != NULL; zsd = list_next(l, zsd)) {
 593                 if (zsd->zsd_key == key) {
 594                         /*
 595                          * Move to head of list to keep list in MRU order.
 596                          */
 597                         if (zsd != list_head(l)) {
 598                                 list_remove(l, zsd);
 599                                 list_insert_head(l, zsd);
 600                         }
 601                         return (zsd);
 602                 }
 603         }
 604         return (NULL);
 605 }
 606 
 607 void
 608 zone_key_create(zone_key_t *keyp, void *(*create)(zoneid_t),
 609     void (*shutdown)(zoneid_t, void *), void (*destroy)(zoneid_t, void *))
 610 {
 611         struct zsd_entry *zsdp;
 612         struct zsd_entry *t;
 613         struct zone *zone;
 614         zone_key_t  key;
 615 
 616         zsdp = kmem_zalloc(sizeof (*zsdp), KM_SLEEP);
 617         zsdp->zsd_data = NULL;
 618         zsdp->zsd_create = create;
 619         zsdp->zsd_shutdown = shutdown;
 620         zsdp->zsd_destroy = destroy;
 621 
 622         /*
 623          * Insert in global list of callbacks. Makes future zone creations
 624          * see it.
 625          */
 626         mutex_enter(&zsd_key_lock);
 627         key = zsdp->zsd_key = ++zsd_keyval;
 628         ASSERT(zsd_keyval != 0);
 629         list_insert_tail(&zsd_registered_keys, zsdp);
 630         mutex_exit(&zsd_key_lock);
 631 
 632         /*
 633          * Insert for all existing zones and mark them as needing
 634          * a create callback.
 635          */
 636         mutex_enter(&zonehash_lock);        /* stop the world */
 637         for (zone = list_head(&zone_active); zone != NULL;
 638             zone = list_next(&zone_active, zone)) {
 639                 zone_status_t status;
 640 
 641                 mutex_enter(&zone->zone_lock);
 642 
 643                 /* Skip zones that are on the way down or not yet up */
 644                 status = zone_status_get(zone);
 645                 if (status >= ZONE_IS_DOWN ||
 646                     status == ZONE_IS_UNINITIALIZED) {
 647                         mutex_exit(&zone->zone_lock);
 648                         continue;
 649                 }
 650 
 651                 t = zsd_find_mru(&zone->zone_zsd, key);
 652                 if (t != NULL) {
 653                         /*
 654                          * A zsd_configure already inserted it after
 655                          * we dropped zsd_key_lock above.
 656                          */
 657                         mutex_exit(&zone->zone_lock);
 658                         continue;
 659                 }
 660                 t = kmem_zalloc(sizeof (*t), KM_SLEEP);
 661                 t->zsd_key = key;
 662                 t->zsd_create = create;
 663                 t->zsd_shutdown = shutdown;
 664                 t->zsd_destroy = destroy;
 665                 if (create != NULL) {
 666                         t->zsd_flags = ZSD_CREATE_NEEDED;
 667                         DTRACE_PROBE2(zsd__create__needed,
 668                             zone_t *, zone, zone_key_t, key);
 669                 }
 670                 list_insert_tail(&zone->zone_zsd, t);
 671                 mutex_exit(&zone->zone_lock);
 672         }
 673         mutex_exit(&zonehash_lock);
 674 
 675         if (create != NULL) {
 676                 /* Now call the create callback for this key */
 677                 zsd_apply_all_zones(zsd_apply_create, key);
 678         }
 679         /*
 680          * It is safe for consumers to use the key now, make it
 681          * globally visible. Specifically zone_getspecific() will
 682          * always successfully return the zone specific data associated
 683          * with the key.
 684          */
 685         *keyp = key;
 686 
 687 }
 688 
 689 /*
 690  * Function called when a module is being unloaded, or otherwise wishes
 691  * to unregister its ZSD key and callbacks.
 692  *
 693  * Remove from the global list and determine the functions that need to
 694  * be called under a global lock. Then call the functions without
 695  * holding any locks. Finally free up the zone_zsd entries. (The apply
 696  * functions need to access the zone_zsd entries to find zsd_data etc.)
 697  */
 698 int
 699 zone_key_delete(zone_key_t key)
 700 {
 701         struct zsd_entry *zsdp = NULL;
 702         zone_t *zone;
 703 
 704         mutex_enter(&zsd_key_lock);
 705         zsdp = zsd_find_mru(&zsd_registered_keys, key);
 706         if (zsdp == NULL) {
 707                 mutex_exit(&zsd_key_lock);
 708                 return (-1);
 709         }
 710         list_remove(&zsd_registered_keys, zsdp);
 711         mutex_exit(&zsd_key_lock);
 712 
 713         mutex_enter(&zonehash_lock);
 714         for (zone = list_head(&zone_active); zone != NULL;
 715             zone = list_next(&zone_active, zone)) {
 716                 struct zsd_entry *del;
 717 
 718                 mutex_enter(&zone->zone_lock);
 719                 del = zsd_find_mru(&zone->zone_zsd, key);
 720                 if (del == NULL) {
 721                         /*
 722                          * Somebody else got here first e.g the zone going
 723                          * away.
 724                          */
 725                         mutex_exit(&zone->zone_lock);
 726                         continue;
 727                 }
 728                 ASSERT(del->zsd_shutdown == zsdp->zsd_shutdown);
 729                 ASSERT(del->zsd_destroy == zsdp->zsd_destroy);
 730                 if (del->zsd_shutdown != NULL &&
 731                     (del->zsd_flags & ZSD_SHUTDOWN_ALL) == 0) {
 732                         del->zsd_flags |= ZSD_SHUTDOWN_NEEDED;
 733                         DTRACE_PROBE2(zsd__shutdown__needed,
 734                             zone_t *, zone, zone_key_t, key);
 735                 }
 736                 if (del->zsd_destroy != NULL &&
 737                     (del->zsd_flags & ZSD_DESTROY_ALL) == 0) {
 738                         del->zsd_flags |= ZSD_DESTROY_NEEDED;
 739                         DTRACE_PROBE2(zsd__destroy__needed,
 740                             zone_t *, zone, zone_key_t, key);
 741                 }
 742                 mutex_exit(&zone->zone_lock);
 743         }
 744         mutex_exit(&zonehash_lock);
 745         kmem_free(zsdp, sizeof (*zsdp));
 746 
 747         /* Now call the shutdown and destroy callback for this key */
 748         zsd_apply_all_zones(zsd_apply_shutdown, key);
 749         zsd_apply_all_zones(zsd_apply_destroy, key);
 750 
 751         /* Now we can free up the zsdp structures in each zone */
 752         mutex_enter(&zonehash_lock);
 753         for (zone = list_head(&zone_active); zone != NULL;
 754             zone = list_next(&zone_active, zone)) {
 755                 struct zsd_entry *del;
 756 
 757                 mutex_enter(&zone->zone_lock);
 758                 del = zsd_find(&zone->zone_zsd, key);
 759                 if (del != NULL) {
 760                         list_remove(&zone->zone_zsd, del);
 761                         ASSERT(!(del->zsd_flags & ZSD_ALL_INPROGRESS));
 762                         kmem_free(del, sizeof (*del));
 763                 }
 764                 mutex_exit(&zone->zone_lock);
 765         }
 766         mutex_exit(&zonehash_lock);
 767 
 768         return (0);
 769 }
 770 
 771 /*
 772  * ZSD counterpart of pthread_setspecific().
 773  *
 774  * Since all zsd callbacks, including those with no create function,
 775  * have an entry in zone_zsd, if the key is registered it is part of
 776  * the zone_zsd list.
 777  * Return an error if the key wasn't registerd.
 778  */
 779 int
 780 zone_setspecific(zone_key_t key, zone_t *zone, const void *data)
 781 {
 782         struct zsd_entry *t;
 783 
 784         mutex_enter(&zone->zone_lock);
 785         t = zsd_find_mru(&zone->zone_zsd, key);
 786         if (t != NULL) {
 787                 /*
 788                  * Replace old value with new
 789                  */
 790                 t->zsd_data = (void *)data;
 791                 mutex_exit(&zone->zone_lock);
 792                 return (0);
 793         }
 794         mutex_exit(&zone->zone_lock);
 795         return (-1);
 796 }
 797 
 798 /*
 799  * ZSD counterpart of pthread_getspecific().
 800  */
 801 void *
 802 zone_getspecific(zone_key_t key, zone_t *zone)
 803 {
 804         struct zsd_entry *t;
 805         void *data;
 806 
 807         mutex_enter(&zone->zone_lock);
 808         t = zsd_find_mru(&zone->zone_zsd, key);
 809         data = (t == NULL ? NULL : t->zsd_data);
 810         mutex_exit(&zone->zone_lock);
 811         return (data);
 812 }
 813 
 814 /*
 815  * Function used to initialize a zone's list of ZSD callbacks and data
 816  * when the zone is being created.  The callbacks are initialized from
 817  * the template list (zsd_registered_keys). The constructor callback is
 818  * executed later (once the zone exists and with locks dropped).
 819  */
 820 static void
 821 zone_zsd_configure(zone_t *zone)
 822 {
 823         struct zsd_entry *zsdp;
 824         struct zsd_entry *t;
 825 
 826         ASSERT(MUTEX_HELD(&zonehash_lock));
 827         ASSERT(list_head(&zone->zone_zsd) == NULL);
 828         mutex_enter(&zone->zone_lock);
 829         mutex_enter(&zsd_key_lock);
 830         for (zsdp = list_head(&zsd_registered_keys); zsdp != NULL;
 831             zsdp = list_next(&zsd_registered_keys, zsdp)) {
 832                 /*
 833                  * Since this zone is ZONE_IS_UNCONFIGURED, zone_key_create
 834                  * should not have added anything to it.
 835                  */
 836                 ASSERT(zsd_find(&zone->zone_zsd, zsdp->zsd_key) == NULL);
 837 
 838                 t = kmem_zalloc(sizeof (*t), KM_SLEEP);
 839                 t->zsd_key = zsdp->zsd_key;
 840                 t->zsd_create = zsdp->zsd_create;
 841                 t->zsd_shutdown = zsdp->zsd_shutdown;
 842                 t->zsd_destroy = zsdp->zsd_destroy;
 843                 if (zsdp->zsd_create != NULL) {
 844                         t->zsd_flags = ZSD_CREATE_NEEDED;
 845                         DTRACE_PROBE2(zsd__create__needed,
 846                             zone_t *, zone, zone_key_t, zsdp->zsd_key);
 847                 }
 848                 list_insert_tail(&zone->zone_zsd, t);
 849         }
 850         mutex_exit(&zsd_key_lock);
 851         mutex_exit(&zone->zone_lock);
 852 }
 853 
 854 enum zsd_callback_type { ZSD_CREATE, ZSD_SHUTDOWN, ZSD_DESTROY };
 855 
 856 /*
 857  * Helper function to execute shutdown or destructor callbacks.
 858  */
 859 static void
 860 zone_zsd_callbacks(zone_t *zone, enum zsd_callback_type ct)
 861 {
 862         struct zsd_entry *t;
 863 
 864         ASSERT(ct == ZSD_SHUTDOWN || ct == ZSD_DESTROY);
 865         ASSERT(ct != ZSD_SHUTDOWN || zone_status_get(zone) >= ZONE_IS_EMPTY);
 866         ASSERT(ct != ZSD_DESTROY || zone_status_get(zone) >= ZONE_IS_DOWN);
 867 
 868         /*
 869          * Run the callback solely based on what is registered for the zone
 870          * in zone_zsd. The global list can change independently of this
 871          * as keys are registered and unregistered and we don't register new
 872          * callbacks for a zone that is in the process of going away.
 873          */
 874         mutex_enter(&zone->zone_lock);
 875         for (t = list_head(&zone->zone_zsd); t != NULL;
 876             t = list_next(&zone->zone_zsd, t)) {
 877                 zone_key_t key = t->zsd_key;
 878 
 879                 /* Skip if no callbacks registered */
 880 
 881                 if (ct == ZSD_SHUTDOWN) {
 882                         if (t->zsd_shutdown != NULL &&
 883                             (t->zsd_flags & ZSD_SHUTDOWN_ALL) == 0) {
 884                                 t->zsd_flags |= ZSD_SHUTDOWN_NEEDED;
 885                                 DTRACE_PROBE2(zsd__shutdown__needed,
 886                                     zone_t *, zone, zone_key_t, key);
 887                         }
 888                 } else {
 889                         if (t->zsd_destroy != NULL &&
 890                             (t->zsd_flags & ZSD_DESTROY_ALL) == 0) {
 891                                 t->zsd_flags |= ZSD_DESTROY_NEEDED;
 892                                 DTRACE_PROBE2(zsd__destroy__needed,
 893                                     zone_t *, zone, zone_key_t, key);
 894                         }
 895                 }
 896         }
 897         mutex_exit(&zone->zone_lock);
 898 
 899         /* Now call the shutdown and destroy callback for this key */
 900         zsd_apply_all_keys(zsd_apply_shutdown, zone);
 901         zsd_apply_all_keys(zsd_apply_destroy, zone);
 902 
 903 }
 904 
 905 /*
 906  * Called when the zone is going away; free ZSD-related memory, and
 907  * destroy the zone_zsd list.
 908  */
 909 static void
 910 zone_free_zsd(zone_t *zone)
 911 {
 912         struct zsd_entry *t, *next;
 913 
 914         /*
 915          * Free all the zsd_entry's we had on this zone.
 916          */
 917         mutex_enter(&zone->zone_lock);
 918         for (t = list_head(&zone->zone_zsd); t != NULL; t = next) {
 919                 next = list_next(&zone->zone_zsd, t);
 920                 list_remove(&zone->zone_zsd, t);
 921                 ASSERT(!(t->zsd_flags & ZSD_ALL_INPROGRESS));
 922                 kmem_free(t, sizeof (*t));
 923         }
 924         list_destroy(&zone->zone_zsd);
 925         mutex_exit(&zone->zone_lock);
 926 
 927 }
 928 
 929 /*
 930  * Apply a function to all zones for particular key value.
 931  *
 932  * The applyfn has to drop zonehash_lock if it does some work, and
 933  * then reacquire it before it returns.
 934  * When the lock is dropped we don't follow list_next even
 935  * if it is possible to do so without any hazards. This is
 936  * because we want the design to allow for the list of zones
 937  * to change in any arbitrary way during the time the
 938  * lock was dropped.
 939  *
 940  * It is safe to restart the loop at list_head since the applyfn
 941  * changes the zsd_flags as it does work, so a subsequent
 942  * pass through will have no effect in applyfn, hence the loop will terminate
 943  * in at worst O(N^2).
 944  */
 945 static void
 946 zsd_apply_all_zones(zsd_applyfn_t *applyfn, zone_key_t key)
 947 {
 948         zone_t *zone;
 949 
 950         mutex_enter(&zonehash_lock);
 951         zone = list_head(&zone_active);
 952         while (zone != NULL) {
 953                 if ((applyfn)(&zonehash_lock, B_FALSE, zone, key)) {
 954                         /* Lock dropped - restart at head */
 955                         zone = list_head(&zone_active);
 956                 } else {
 957                         zone = list_next(&zone_active, zone);
 958                 }
 959         }
 960         mutex_exit(&zonehash_lock);
 961 }
 962 
 963 /*
 964  * Apply a function to all keys for a particular zone.
 965  *
 966  * The applyfn has to drop zonehash_lock if it does some work, and
 967  * then reacquire it before it returns.
 968  * When the lock is dropped we don't follow list_next even
 969  * if it is possible to do so without any hazards. This is
 970  * because we want the design to allow for the list of zsd callbacks
 971  * to change in any arbitrary way during the time the
 972  * lock was dropped.
 973  *
 974  * It is safe to restart the loop at list_head since the applyfn
 975  * changes the zsd_flags as it does work, so a subsequent
 976  * pass through will have no effect in applyfn, hence the loop will terminate
 977  * in at worst O(N^2).
 978  */
 979 static void
 980 zsd_apply_all_keys(zsd_applyfn_t *applyfn, zone_t *zone)
 981 {
 982         struct zsd_entry *t;
 983 
 984         mutex_enter(&zone->zone_lock);
 985         t = list_head(&zone->zone_zsd);
 986         while (t != NULL) {
 987                 if ((applyfn)(NULL, B_TRUE, zone, t->zsd_key)) {
 988                         /* Lock dropped - restart at head */
 989                         t = list_head(&zone->zone_zsd);
 990                 } else {
 991                         t = list_next(&zone->zone_zsd, t);
 992                 }
 993         }
 994         mutex_exit(&zone->zone_lock);
 995 }
 996 
 997 /*
 998  * Call the create function for the zone and key if CREATE_NEEDED
 999  * is set.
1000  * If some other thread gets here first and sets CREATE_INPROGRESS, then
1001  * we wait for that thread to complete so that we can ensure that
1002  * all the callbacks are done when we've looped over all zones/keys.
1003  *
1004  * When we call the create function, we drop the global held by the
1005  * caller, and return true to tell the caller it needs to re-evalute the
1006  * state.
1007  * If the caller holds zone_lock then zone_lock_held is set, and zone_lock
1008  * remains held on exit.
1009  */
1010 static boolean_t
1011 zsd_apply_create(kmutex_t *lockp, boolean_t zone_lock_held,
1012     zone_t *zone, zone_key_t key)
1013 {
1014         void *result;
1015         struct zsd_entry *t;
1016         boolean_t dropped;
1017 
1018         if (lockp != NULL) {
1019                 ASSERT(MUTEX_HELD(lockp));
1020         }
1021         if (zone_lock_held) {
1022                 ASSERT(MUTEX_HELD(&zone->zone_lock));
1023         } else {
1024                 mutex_enter(&zone->zone_lock);
1025         }
1026 
1027         t = zsd_find(&zone->zone_zsd, key);
1028         if (t == NULL) {
1029                 /*
1030                  * Somebody else got here first e.g the zone going
1031                  * away.
1032                  */
1033                 if (!zone_lock_held)
1034                         mutex_exit(&zone->zone_lock);
1035                 return (B_FALSE);
1036         }
1037         dropped = B_FALSE;
1038         if (zsd_wait_for_inprogress(zone, t, lockp))
1039                 dropped = B_TRUE;
1040 
1041         if (t->zsd_flags & ZSD_CREATE_NEEDED) {
1042                 t->zsd_flags &= ~ZSD_CREATE_NEEDED;
1043                 t->zsd_flags |= ZSD_CREATE_INPROGRESS;
1044                 DTRACE_PROBE2(zsd__create__inprogress,
1045                     zone_t *, zone, zone_key_t, key);
1046                 mutex_exit(&zone->zone_lock);
1047                 if (lockp != NULL)
1048                         mutex_exit(lockp);
1049 
1050                 dropped = B_TRUE;
1051                 ASSERT(t->zsd_create != NULL);
1052                 DTRACE_PROBE2(zsd__create__start,
1053                     zone_t *, zone, zone_key_t, key);
1054 
1055                 result = (*t->zsd_create)(zone->zone_id);
1056 
1057                 DTRACE_PROBE2(zsd__create__end,
1058                     zone_t *, zone, voidn *, result);
1059 
1060                 ASSERT(result != NULL);
1061                 if (lockp != NULL)
1062                         mutex_enter(lockp);
1063                 mutex_enter(&zone->zone_lock);
1064                 t->zsd_data = result;
1065                 t->zsd_flags &= ~ZSD_CREATE_INPROGRESS;
1066                 t->zsd_flags |= ZSD_CREATE_COMPLETED;
1067                 cv_broadcast(&t->zsd_cv);
1068                 DTRACE_PROBE2(zsd__create__completed,
1069                     zone_t *, zone, zone_key_t, key);
1070         }
1071         if (!zone_lock_held)
1072                 mutex_exit(&zone->zone_lock);
1073         return (dropped);
1074 }
1075 
1076 /*
1077  * Call the shutdown function for the zone and key if SHUTDOWN_NEEDED
1078  * is set.
1079  * If some other thread gets here first and sets *_INPROGRESS, then
1080  * we wait for that thread to complete so that we can ensure that
1081  * all the callbacks are done when we've looped over all zones/keys.
1082  *
1083  * When we call the shutdown function, we drop the global held by the
1084  * caller, and return true to tell the caller it needs to re-evalute the
1085  * state.
1086  * If the caller holds zone_lock then zone_lock_held is set, and zone_lock
1087  * remains held on exit.
1088  */
1089 static boolean_t
1090 zsd_apply_shutdown(kmutex_t *lockp, boolean_t zone_lock_held,
1091     zone_t *zone, zone_key_t key)
1092 {
1093         struct zsd_entry *t;
1094         void *data;
1095         boolean_t dropped;
1096 
1097         if (lockp != NULL) {
1098                 ASSERT(MUTEX_HELD(lockp));
1099         }
1100         if (zone_lock_held) {
1101                 ASSERT(MUTEX_HELD(&zone->zone_lock));
1102         } else {
1103                 mutex_enter(&zone->zone_lock);
1104         }
1105 
1106         t = zsd_find(&zone->zone_zsd, key);
1107         if (t == NULL) {
1108                 /*
1109                  * Somebody else got here first e.g the zone going
1110                  * away.
1111                  */
1112                 if (!zone_lock_held)
1113                         mutex_exit(&zone->zone_lock);
1114                 return (B_FALSE);
1115         }
1116         dropped = B_FALSE;
1117         if (zsd_wait_for_creator(zone, t, lockp))
1118                 dropped = B_TRUE;
1119 
1120         if (zsd_wait_for_inprogress(zone, t, lockp))
1121                 dropped = B_TRUE;
1122 
1123         if (t->zsd_flags & ZSD_SHUTDOWN_NEEDED) {
1124                 t->zsd_flags &= ~ZSD_SHUTDOWN_NEEDED;
1125                 t->zsd_flags |= ZSD_SHUTDOWN_INPROGRESS;
1126                 DTRACE_PROBE2(zsd__shutdown__inprogress,
1127                     zone_t *, zone, zone_key_t, key);
1128                 mutex_exit(&zone->zone_lock);
1129                 if (lockp != NULL)
1130                         mutex_exit(lockp);
1131                 dropped = B_TRUE;
1132 
1133                 ASSERT(t->zsd_shutdown != NULL);
1134                 data = t->zsd_data;
1135 
1136                 DTRACE_PROBE2(zsd__shutdown__start,
1137                     zone_t *, zone, zone_key_t, key);
1138 
1139                 (t->zsd_shutdown)(zone->zone_id, data);
1140                 DTRACE_PROBE2(zsd__shutdown__end,
1141                     zone_t *, zone, zone_key_t, key);
1142 
1143                 if (lockp != NULL)
1144                         mutex_enter(lockp);
1145                 mutex_enter(&zone->zone_lock);
1146                 t->zsd_flags &= ~ZSD_SHUTDOWN_INPROGRESS;
1147                 t->zsd_flags |= ZSD_SHUTDOWN_COMPLETED;
1148                 cv_broadcast(&t->zsd_cv);
1149                 DTRACE_PROBE2(zsd__shutdown__completed,
1150                     zone_t *, zone, zone_key_t, key);
1151         }
1152         if (!zone_lock_held)
1153                 mutex_exit(&zone->zone_lock);
1154         return (dropped);
1155 }
1156 
1157 /*
1158  * Call the destroy function for the zone and key if DESTROY_NEEDED
1159  * is set.
1160  * If some other thread gets here first and sets *_INPROGRESS, then
1161  * we wait for that thread to complete so that we can ensure that
1162  * all the callbacks are done when we've looped over all zones/keys.
1163  *
1164  * When we call the destroy function, we drop the global held by the
1165  * caller, and return true to tell the caller it needs to re-evalute the
1166  * state.
1167  * If the caller holds zone_lock then zone_lock_held is set, and zone_lock
1168  * remains held on exit.
1169  */
1170 static boolean_t
1171 zsd_apply_destroy(kmutex_t *lockp, boolean_t zone_lock_held,
1172     zone_t *zone, zone_key_t key)
1173 {
1174         struct zsd_entry *t;
1175         void *data;
1176         boolean_t dropped;
1177 
1178         if (lockp != NULL) {
1179                 ASSERT(MUTEX_HELD(lockp));
1180         }
1181         if (zone_lock_held) {
1182                 ASSERT(MUTEX_HELD(&zone->zone_lock));
1183         } else {
1184                 mutex_enter(&zone->zone_lock);
1185         }
1186 
1187         t = zsd_find(&zone->zone_zsd, key);
1188         if (t == NULL) {
1189                 /*
1190                  * Somebody else got here first e.g the zone going
1191                  * away.
1192                  */
1193                 if (!zone_lock_held)
1194                         mutex_exit(&zone->zone_lock);
1195                 return (B_FALSE);
1196         }
1197         dropped = B_FALSE;
1198         if (zsd_wait_for_creator(zone, t, lockp))
1199                 dropped = B_TRUE;
1200 
1201         if (zsd_wait_for_inprogress(zone, t, lockp))
1202                 dropped = B_TRUE;
1203 
1204         if (t->zsd_flags & ZSD_DESTROY_NEEDED) {
1205                 t->zsd_flags &= ~ZSD_DESTROY_NEEDED;
1206                 t->zsd_flags |= ZSD_DESTROY_INPROGRESS;
1207                 DTRACE_PROBE2(zsd__destroy__inprogress,
1208                     zone_t *, zone, zone_key_t, key);
1209                 mutex_exit(&zone->zone_lock);
1210                 if (lockp != NULL)
1211                         mutex_exit(lockp);
1212                 dropped = B_TRUE;
1213 
1214                 ASSERT(t->zsd_destroy != NULL);
1215                 data = t->zsd_data;
1216                 DTRACE_PROBE2(zsd__destroy__start,
1217                     zone_t *, zone, zone_key_t, key);
1218 
1219                 (t->zsd_destroy)(zone->zone_id, data);
1220                 DTRACE_PROBE2(zsd__destroy__end,
1221                     zone_t *, zone, zone_key_t, key);
1222 
1223                 if (lockp != NULL)
1224                         mutex_enter(lockp);
1225                 mutex_enter(&zone->zone_lock);
1226                 t->zsd_data = NULL;
1227                 t->zsd_flags &= ~ZSD_DESTROY_INPROGRESS;
1228                 t->zsd_flags |= ZSD_DESTROY_COMPLETED;
1229                 cv_broadcast(&t->zsd_cv);
1230                 DTRACE_PROBE2(zsd__destroy__completed,
1231                     zone_t *, zone, zone_key_t, key);
1232         }
1233         if (!zone_lock_held)
1234                 mutex_exit(&zone->zone_lock);
1235         return (dropped);
1236 }
1237 
1238 /*
1239  * Wait for any CREATE_NEEDED flag to be cleared.
1240  * Returns true if lockp was temporarily dropped while waiting.
1241  */
1242 static boolean_t
1243 zsd_wait_for_creator(zone_t *zone, struct zsd_entry *t, kmutex_t *lockp)
1244 {
1245         boolean_t dropped = B_FALSE;
1246 
1247         while (t->zsd_flags & ZSD_CREATE_NEEDED) {
1248                 DTRACE_PROBE2(zsd__wait__for__creator,
1249                     zone_t *, zone, struct zsd_entry *, t);
1250                 if (lockp != NULL) {
1251                         dropped = B_TRUE;
1252                         mutex_exit(lockp);
1253                 }
1254                 cv_wait(&t->zsd_cv, &zone->zone_lock);
1255                 if (lockp != NULL) {
1256                         /* First drop zone_lock to preserve order */
1257                         mutex_exit(&zone->zone_lock);
1258                         mutex_enter(lockp);
1259                         mutex_enter(&zone->zone_lock);
1260                 }
1261         }
1262         return (dropped);
1263 }
1264 
1265 /*
1266  * Wait for any INPROGRESS flag to be cleared.
1267  * Returns true if lockp was temporarily dropped while waiting.
1268  */
1269 static boolean_t
1270 zsd_wait_for_inprogress(zone_t *zone, struct zsd_entry *t, kmutex_t *lockp)
1271 {
1272         boolean_t dropped = B_FALSE;
1273 
1274         while (t->zsd_flags & ZSD_ALL_INPROGRESS) {
1275                 DTRACE_PROBE2(zsd__wait__for__inprogress,
1276                     zone_t *, zone, struct zsd_entry *, t);
1277                 if (lockp != NULL) {
1278                         dropped = B_TRUE;
1279                         mutex_exit(lockp);
1280                 }
1281                 cv_wait(&t->zsd_cv, &zone->zone_lock);
1282                 if (lockp != NULL) {
1283                         /* First drop zone_lock to preserve order */
1284                         mutex_exit(&zone->zone_lock);
1285                         mutex_enter(lockp);
1286                         mutex_enter(&zone->zone_lock);
1287                 }
1288         }
1289         return (dropped);
1290 }
1291 
1292 /*
1293  * Frees memory associated with the zone dataset list.
1294  */
1295 static void
1296 zone_free_datasets(zone_t *zone)
1297 {
1298         zone_dataset_t *t, *next;
1299 
1300         for (t = list_head(&zone->zone_datasets); t != NULL; t = next) {
1301                 next = list_next(&zone->zone_datasets, t);
1302                 list_remove(&zone->zone_datasets, t);
1303                 kmem_free(t->zd_dataset, strlen(t->zd_dataset) + 1);
1304                 kmem_free(t, sizeof (*t));
1305         }
1306         list_destroy(&zone->zone_datasets);
1307 }
1308 
1309 /*
1310  * zone.cpu-shares resource control support.
1311  */
1312 /*ARGSUSED*/
1313 static rctl_qty_t
1314 zone_cpu_shares_usage(rctl_t *rctl, struct proc *p)
1315 {
1316         ASSERT(MUTEX_HELD(&p->p_lock));
1317         return (p->p_zone->zone_shares);
1318 }
1319 
1320 /*ARGSUSED*/
1321 static int
1322 zone_cpu_shares_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1323     rctl_qty_t nv)
1324 {
1325         ASSERT(MUTEX_HELD(&p->p_lock));
1326         ASSERT(e->rcep_t == RCENTITY_ZONE);
1327         if (e->rcep_p.zone == NULL)
1328                 return (0);
1329 
1330         e->rcep_p.zone->zone_shares = nv;
1331         return (0);
1332 }
1333 
1334 static rctl_ops_t zone_cpu_shares_ops = {
1335         rcop_no_action,
1336         zone_cpu_shares_usage,
1337         zone_cpu_shares_set,
1338         rcop_no_test
1339 };
1340 
1341 /*
1342  * zone.cpu-cap resource control support.
1343  */
1344 /*ARGSUSED*/
1345 static rctl_qty_t
1346 zone_cpu_cap_get(rctl_t *rctl, struct proc *p)
1347 {
1348         ASSERT(MUTEX_HELD(&p->p_lock));
1349         return (cpucaps_zone_get(p->p_zone));
1350 }
1351 
1352 /*ARGSUSED*/
1353 static int
1354 zone_cpu_cap_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1355     rctl_qty_t nv)
1356 {
1357         zone_t *zone = e->rcep_p.zone;
1358 
1359         ASSERT(MUTEX_HELD(&p->p_lock));
1360         ASSERT(e->rcep_t == RCENTITY_ZONE);
1361 
1362         if (zone == NULL)
1363                 return (0);
1364 
1365         /*
1366          * set cap to the new value.
1367          */
1368         return (cpucaps_zone_set(zone, nv));
1369 }
1370 
1371 static rctl_ops_t zone_cpu_cap_ops = {
1372         rcop_no_action,
1373         zone_cpu_cap_get,
1374         zone_cpu_cap_set,
1375         rcop_no_test
1376 };
1377 
1378 /*ARGSUSED*/
1379 static rctl_qty_t
1380 zone_lwps_usage(rctl_t *r, proc_t *p)
1381 {
1382         rctl_qty_t nlwps;
1383         zone_t *zone = p->p_zone;
1384 
1385         ASSERT(MUTEX_HELD(&p->p_lock));
1386 
1387         mutex_enter(&zone->zone_nlwps_lock);
1388         nlwps = zone->zone_nlwps;
1389         mutex_exit(&zone->zone_nlwps_lock);
1390 
1391         return (nlwps);
1392 }
1393 
1394 /*ARGSUSED*/
1395 static int
1396 zone_lwps_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rcntl,
1397     rctl_qty_t incr, uint_t flags)
1398 {
1399         rctl_qty_t nlwps;
1400 
1401         ASSERT(MUTEX_HELD(&p->p_lock));
1402         ASSERT(e->rcep_t == RCENTITY_ZONE);
1403         if (e->rcep_p.zone == NULL)
1404                 return (0);
1405         ASSERT(MUTEX_HELD(&(e->rcep_p.zone->zone_nlwps_lock)));
1406         nlwps = e->rcep_p.zone->zone_nlwps;
1407 
1408         if (nlwps + incr > rcntl->rcv_value)
1409                 return (1);
1410 
1411         return (0);
1412 }
1413 
1414 /*ARGSUSED*/
1415 static int
1416 zone_lwps_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e, rctl_qty_t nv)
1417 {
1418         ASSERT(MUTEX_HELD(&p->p_lock));
1419         ASSERT(e->rcep_t == RCENTITY_ZONE);
1420         if (e->rcep_p.zone == NULL)
1421                 return (0);
1422         e->rcep_p.zone->zone_nlwps_ctl = nv;
1423         return (0);
1424 }
1425 
1426 static rctl_ops_t zone_lwps_ops = {
1427         rcop_no_action,
1428         zone_lwps_usage,
1429         zone_lwps_set,
1430         zone_lwps_test,
1431 };
1432 
1433 /*ARGSUSED*/
1434 static rctl_qty_t
1435 zone_procs_usage(rctl_t *r, proc_t *p)
1436 {
1437         rctl_qty_t nprocs;
1438         zone_t *zone = p->p_zone;
1439 
1440         ASSERT(MUTEX_HELD(&p->p_lock));
1441 
1442         mutex_enter(&zone->zone_nlwps_lock);
1443         nprocs = zone->zone_nprocs;
1444         mutex_exit(&zone->zone_nlwps_lock);
1445 
1446         return (nprocs);
1447 }
1448 
1449 /*ARGSUSED*/
1450 static int
1451 zone_procs_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rcntl,
1452     rctl_qty_t incr, uint_t flags)
1453 {
1454         rctl_qty_t nprocs;
1455 
1456         ASSERT(MUTEX_HELD(&p->p_lock));
1457         ASSERT(e->rcep_t == RCENTITY_ZONE);
1458         if (e->rcep_p.zone == NULL)
1459                 return (0);
1460         ASSERT(MUTEX_HELD(&(e->rcep_p.zone->zone_nlwps_lock)));
1461         nprocs = e->rcep_p.zone->zone_nprocs;
1462 
1463         if (nprocs + incr > rcntl->rcv_value)
1464                 return (1);
1465 
1466         return (0);
1467 }
1468 
1469 /*ARGSUSED*/
1470 static int
1471 zone_procs_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e, rctl_qty_t nv)
1472 {
1473         ASSERT(MUTEX_HELD(&p->p_lock));
1474         ASSERT(e->rcep_t == RCENTITY_ZONE);
1475         if (e->rcep_p.zone == NULL)
1476                 return (0);
1477         e->rcep_p.zone->zone_nprocs_ctl = nv;
1478         return (0);
1479 }
1480 
1481 static rctl_ops_t zone_procs_ops = {
1482         rcop_no_action,
1483         zone_procs_usage,
1484         zone_procs_set,
1485         zone_procs_test,
1486 };
1487 
1488 /*ARGSUSED*/
1489 static rctl_qty_t
1490 zone_shmmax_usage(rctl_t *rctl, struct proc *p)
1491 {
1492         ASSERT(MUTEX_HELD(&p->p_lock));
1493         return (p->p_zone->zone_shmmax);
1494 }
1495 
1496 /*ARGSUSED*/
1497 static int
1498 zone_shmmax_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rval,
1499     rctl_qty_t incr, uint_t flags)
1500 {
1501         rctl_qty_t v;
1502         ASSERT(MUTEX_HELD(&p->p_lock));
1503         ASSERT(e->rcep_t == RCENTITY_ZONE);
1504         v = e->rcep_p.zone->zone_shmmax + incr;
1505         if (v > rval->rcv_value)
1506                 return (1);
1507         return (0);
1508 }
1509 
1510 static rctl_ops_t zone_shmmax_ops = {
1511         rcop_no_action,
1512         zone_shmmax_usage,
1513         rcop_no_set,
1514         zone_shmmax_test
1515 };
1516 
1517 /*ARGSUSED*/
1518 static rctl_qty_t
1519 zone_shmmni_usage(rctl_t *rctl, struct proc *p)
1520 {
1521         ASSERT(MUTEX_HELD(&p->p_lock));
1522         return (p->p_zone->zone_ipc.ipcq_shmmni);
1523 }
1524 
1525 /*ARGSUSED*/
1526 static int
1527 zone_shmmni_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rval,
1528     rctl_qty_t incr, uint_t flags)
1529 {
1530         rctl_qty_t v;
1531         ASSERT(MUTEX_HELD(&p->p_lock));
1532         ASSERT(e->rcep_t == RCENTITY_ZONE);
1533         v = e->rcep_p.zone->zone_ipc.ipcq_shmmni + incr;
1534         if (v > rval->rcv_value)
1535                 return (1);
1536         return (0);
1537 }
1538 
1539 static rctl_ops_t zone_shmmni_ops = {
1540         rcop_no_action,
1541         zone_shmmni_usage,
1542         rcop_no_set,
1543         zone_shmmni_test
1544 };
1545 
1546 /*ARGSUSED*/
1547 static rctl_qty_t
1548 zone_semmni_usage(rctl_t *rctl, struct proc *p)
1549 {
1550         ASSERT(MUTEX_HELD(&p->p_lock));
1551         return (p->p_zone->zone_ipc.ipcq_semmni);
1552 }
1553 
1554 /*ARGSUSED*/
1555 static int
1556 zone_semmni_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rval,
1557     rctl_qty_t incr, uint_t flags)
1558 {
1559         rctl_qty_t v;
1560         ASSERT(MUTEX_HELD(&p->p_lock));
1561         ASSERT(e->rcep_t == RCENTITY_ZONE);
1562         v = e->rcep_p.zone->zone_ipc.ipcq_semmni + incr;
1563         if (v > rval->rcv_value)
1564                 return (1);
1565         return (0);
1566 }
1567 
1568 static rctl_ops_t zone_semmni_ops = {
1569         rcop_no_action,
1570         zone_semmni_usage,
1571         rcop_no_set,
1572         zone_semmni_test
1573 };
1574 
1575 /*ARGSUSED*/
1576 static rctl_qty_t
1577 zone_msgmni_usage(rctl_t *rctl, struct proc *p)
1578 {
1579         ASSERT(MUTEX_HELD(&p->p_lock));
1580         return (p->p_zone->zone_ipc.ipcq_msgmni);
1581 }
1582 
1583 /*ARGSUSED*/
1584 static int
1585 zone_msgmni_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rval,
1586     rctl_qty_t incr, uint_t flags)
1587 {
1588         rctl_qty_t v;
1589         ASSERT(MUTEX_HELD(&p->p_lock));
1590         ASSERT(e->rcep_t == RCENTITY_ZONE);
1591         v = e->rcep_p.zone->zone_ipc.ipcq_msgmni + incr;
1592         if (v > rval->rcv_value)
1593                 return (1);
1594         return (0);
1595 }
1596 
1597 static rctl_ops_t zone_msgmni_ops = {
1598         rcop_no_action,
1599         zone_msgmni_usage,
1600         rcop_no_set,
1601         zone_msgmni_test
1602 };
1603 
1604 /*ARGSUSED*/
1605 static rctl_qty_t
1606 zone_locked_mem_usage(rctl_t *rctl, struct proc *p)
1607 {
1608         rctl_qty_t q;
1609         ASSERT(MUTEX_HELD(&p->p_lock));
1610         mutex_enter(&p->p_zone->zone_mem_lock);
1611         q = p->p_zone->zone_locked_mem;
1612         mutex_exit(&p->p_zone->zone_mem_lock);
1613         return (q);
1614 }
1615 
1616 /*ARGSUSED*/
1617 static int
1618 zone_locked_mem_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e,
1619     rctl_val_t *rcntl, rctl_qty_t incr, uint_t flags)
1620 {
1621         rctl_qty_t q;
1622         zone_t *z;
1623 
1624         z = e->rcep_p.zone;
1625         ASSERT(MUTEX_HELD(&p->p_lock));
1626         ASSERT(MUTEX_HELD(&z->zone_mem_lock));
1627         q = z->zone_locked_mem;
1628         if (q + incr > rcntl->rcv_value)
1629                 return (1);
1630         return (0);
1631 }
1632 
1633 /*ARGSUSED*/
1634 static int
1635 zone_locked_mem_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1636     rctl_qty_t nv)
1637 {
1638         ASSERT(MUTEX_HELD(&p->p_lock));
1639         ASSERT(e->rcep_t == RCENTITY_ZONE);
1640         if (e->rcep_p.zone == NULL)
1641                 return (0);
1642         e->rcep_p.zone->zone_locked_mem_ctl = nv;
1643         return (0);
1644 }
1645 
1646 static rctl_ops_t zone_locked_mem_ops = {
1647         rcop_no_action,
1648         zone_locked_mem_usage,
1649         zone_locked_mem_set,
1650         zone_locked_mem_test
1651 };
1652 
1653 /*ARGSUSED*/
1654 static rctl_qty_t
1655 zone_max_swap_usage(rctl_t *rctl, struct proc *p)
1656 {
1657         rctl_qty_t q;
1658         zone_t *z = p->p_zone;
1659 
1660         ASSERT(MUTEX_HELD(&p->p_lock));
1661         mutex_enter(&z->zone_mem_lock);
1662         q = z->zone_max_swap;
1663         mutex_exit(&z->zone_mem_lock);
1664         return (q);
1665 }
1666 
1667 /*ARGSUSED*/
1668 static int
1669 zone_max_swap_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e,
1670     rctl_val_t *rcntl, rctl_qty_t incr, uint_t flags)
1671 {
1672         rctl_qty_t q;
1673         zone_t *z;
1674 
1675         z = e->rcep_p.zone;
1676         ASSERT(MUTEX_HELD(&p->p_lock));
1677         ASSERT(MUTEX_HELD(&z->zone_mem_lock));
1678         q = z->zone_max_swap;
1679         if (q + incr > rcntl->rcv_value)
1680                 return (1);
1681         return (0);
1682 }
1683 
1684 /*ARGSUSED*/
1685 static int
1686 zone_max_swap_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1687     rctl_qty_t nv)
1688 {
1689         ASSERT(MUTEX_HELD(&p->p_lock));
1690         ASSERT(e->rcep_t == RCENTITY_ZONE);
1691         if (e->rcep_p.zone == NULL)
1692                 return (0);
1693         e->rcep_p.zone->zone_max_swap_ctl = nv;
1694         return (0);
1695 }
1696 
1697 static rctl_ops_t zone_max_swap_ops = {
1698         rcop_no_action,
1699         zone_max_swap_usage,
1700         zone_max_swap_set,
1701         zone_max_swap_test
1702 };
1703 
1704 /*ARGSUSED*/
1705 static rctl_qty_t
1706 zone_max_lofi_usage(rctl_t *rctl, struct proc *p)
1707 {
1708         rctl_qty_t q;
1709         zone_t *z = p->p_zone;
1710 
1711         ASSERT(MUTEX_HELD(&p->p_lock));
1712         mutex_enter(&z->zone_rctl_lock);
1713         q = z->zone_max_lofi;
1714         mutex_exit(&z->zone_rctl_lock);
1715         return (q);
1716 }
1717 
1718 /*ARGSUSED*/
1719 static int
1720 zone_max_lofi_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e,
1721     rctl_val_t *rcntl, rctl_qty_t incr, uint_t flags)
1722 {
1723         rctl_qty_t q;
1724         zone_t *z;
1725 
1726         z = e->rcep_p.zone;
1727         ASSERT(MUTEX_HELD(&p->p_lock));
1728         ASSERT(MUTEX_HELD(&z->zone_rctl_lock));
1729         q = z->zone_max_lofi;
1730         if (q + incr > rcntl->rcv_value)
1731                 return (1);
1732         return (0);
1733 }
1734 
1735 /*ARGSUSED*/
1736 static int
1737 zone_max_lofi_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1738     rctl_qty_t nv)
1739 {
1740         ASSERT(MUTEX_HELD(&p->p_lock));
1741         ASSERT(e->rcep_t == RCENTITY_ZONE);
1742         if (e->rcep_p.zone == NULL)
1743                 return (0);
1744         e->rcep_p.zone->zone_max_lofi_ctl = nv;
1745         return (0);
1746 }
1747 
1748 static rctl_ops_t zone_max_lofi_ops = {
1749         rcop_no_action,
1750         zone_max_lofi_usage,
1751         zone_max_lofi_set,
1752         zone_max_lofi_test
1753 };
1754 
1755 /*
1756  * Helper function to brand the zone with a unique ID.
1757  */
1758 static void
1759 zone_uniqid(zone_t *zone)
1760 {
1761         static uint64_t uniqid = 0;
1762 
1763         ASSERT(MUTEX_HELD(&zonehash_lock));
1764         zone->zone_uniqid = uniqid++;
1765 }
1766 
1767 /*
1768  * Returns a held pointer to the "kcred" for the specified zone.
1769  */
1770 struct cred *
1771 zone_get_kcred(zoneid_t zoneid)
1772 {
1773         zone_t *zone;
1774         cred_t *cr;
1775 
1776         if ((zone = zone_find_by_id(zoneid)) == NULL)
1777                 return (NULL);
1778         cr = zone->zone_kcred;
1779         crhold(cr);
1780         zone_rele(zone);
1781         return (cr);
1782 }
1783 
1784 static int
1785 zone_lockedmem_kstat_update(kstat_t *ksp, int rw)
1786 {
1787         zone_t *zone = ksp->ks_private;
1788         zone_kstat_t *zk = ksp->ks_data;
1789 
1790         if (rw == KSTAT_WRITE)
1791                 return (EACCES);
1792 
1793         zk->zk_usage.value.ui64 = zone->zone_locked_mem;
1794         zk->zk_value.value.ui64 = zone->zone_locked_mem_ctl;
1795         return (0);
1796 }
1797 
1798 static int
1799 zone_nprocs_kstat_update(kstat_t *ksp, int rw)
1800 {
1801         zone_t *zone = ksp->ks_private;
1802         zone_kstat_t *zk = ksp->ks_data;
1803 
1804         if (rw == KSTAT_WRITE)
1805                 return (EACCES);
1806 
1807         zk->zk_usage.value.ui64 = zone->zone_nprocs;
1808         zk->zk_value.value.ui64 = zone->zone_nprocs_ctl;
1809         return (0);
1810 }
1811 
1812 static int
1813 zone_swapresv_kstat_update(kstat_t *ksp, int rw)
1814 {
1815         zone_t *zone = ksp->ks_private;
1816         zone_kstat_t *zk = ksp->ks_data;
1817 
1818         if (rw == KSTAT_WRITE)
1819                 return (EACCES);
1820 
1821         zk->zk_usage.value.ui64 = zone->zone_max_swap;
1822         zk->zk_value.value.ui64 = zone->zone_max_swap_ctl;
1823         return (0);
1824 }
1825 
1826 static kstat_t *
1827 zone_kstat_create_common(zone_t *zone, char *name,
1828     int (*updatefunc) (kstat_t *, int))
1829 {
1830         kstat_t *ksp;
1831         zone_kstat_t *zk;
1832 
1833         ksp = rctl_kstat_create_zone(zone, name, KSTAT_TYPE_NAMED,
1834             sizeof (zone_kstat_t) / sizeof (kstat_named_t),
1835             KSTAT_FLAG_VIRTUAL);
1836 
1837         if (ksp == NULL)
1838                 return (NULL);
1839 
1840         zk = ksp->ks_data = kmem_alloc(sizeof (zone_kstat_t), KM_SLEEP);
1841         ksp->ks_data_size += strlen(zone->zone_name) + 1;
1842         kstat_named_init(&zk->zk_zonename, "zonename", KSTAT_DATA_STRING);
1843         kstat_named_setstr(&zk->zk_zonename, zone->zone_name);
1844         kstat_named_init(&zk->zk_usage, "usage", KSTAT_DATA_UINT64);
1845         kstat_named_init(&zk->zk_value, "value", KSTAT_DATA_UINT64);
1846         ksp->ks_update = updatefunc;
1847         ksp->ks_private = zone;
1848         kstat_install(ksp);
1849         return (ksp);
1850 }
1851 
1852 
1853 static int
1854 zone_mcap_kstat_update(kstat_t *ksp, int rw)
1855 {
1856         zone_t *zone = ksp->ks_private;
1857         zone_mcap_kstat_t *zmp = ksp->ks_data;
1858 
1859         if (rw == KSTAT_WRITE)
1860                 return (EACCES);
1861 
1862         zmp->zm_pgpgin.value.ui64 = zone->zone_pgpgin;
1863         zmp->zm_anonpgin.value.ui64 = zone->zone_anonpgin;
1864         zmp->zm_execpgin.value.ui64 = zone->zone_execpgin;
1865         zmp->zm_fspgin.value.ui64 = zone->zone_fspgin;
1866         zmp->zm_anon_alloc_fail.value.ui64 = zone->zone_anon_alloc_fail;
1867 
1868         return (0);
1869 }
1870 
1871 static kstat_t *
1872 zone_mcap_kstat_create(zone_t *zone)
1873 {
1874         kstat_t *ksp;
1875         zone_mcap_kstat_t *zmp;
1876 
1877         if ((ksp = kstat_create_zone("memory_cap", zone->zone_id,
1878             zone->zone_name, "zone_memory_cap", KSTAT_TYPE_NAMED,
1879             sizeof (zone_mcap_kstat_t) / sizeof (kstat_named_t),
1880             KSTAT_FLAG_VIRTUAL, zone->zone_id)) == NULL)
1881                 return (NULL);
1882 
1883         if (zone->zone_id != GLOBAL_ZONEID)
1884                 kstat_zone_add(ksp, GLOBAL_ZONEID);
1885 
1886         zmp = ksp->ks_data = kmem_zalloc(sizeof (zone_mcap_kstat_t), KM_SLEEP);
1887         ksp->ks_data_size += strlen(zone->zone_name) + 1;
1888         ksp->ks_lock = &zone->zone_mcap_lock;
1889         zone->zone_mcap_stats = zmp;
1890 
1891         /* The kstat "name" field is not large enough for a full zonename */
1892         kstat_named_init(&zmp->zm_zonename, "zonename", KSTAT_DATA_STRING);
1893         kstat_named_setstr(&zmp->zm_zonename, zone->zone_name);
1894         kstat_named_init(&zmp->zm_pgpgin, "pgpgin", KSTAT_DATA_UINT64);
1895         kstat_named_init(&zmp->zm_anonpgin, "anonpgin", KSTAT_DATA_UINT64);
1896         kstat_named_init(&zmp->zm_execpgin, "execpgin", KSTAT_DATA_UINT64);
1897         kstat_named_init(&zmp->zm_fspgin, "fspgin", KSTAT_DATA_UINT64);
1898         kstat_named_init(&zmp->zm_anon_alloc_fail, "anon_alloc_fail",
1899             KSTAT_DATA_UINT64);
1900 
1901         ksp->ks_update = zone_mcap_kstat_update;
1902         ksp->ks_private = zone;
1903 
1904         kstat_install(ksp);
1905         return (ksp);
1906 }
1907 
1908 static int
1909 zone_misc_kstat_update(kstat_t *ksp, int rw)
1910 {
1911         zone_t *zone = ksp->ks_private;
1912         zone_misc_kstat_t *zmp = ksp->ks_data;
1913         hrtime_t tmp;
1914 
1915         if (rw == KSTAT_WRITE)
1916                 return (EACCES);
1917 
1918         tmp = zone->zone_utime;
1919         scalehrtime(&tmp);
1920         zmp->zm_utime.value.ui64 = tmp;
1921         tmp = zone->zone_stime;
1922         scalehrtime(&tmp);
1923         zmp->zm_stime.value.ui64 = tmp;
1924         tmp = zone->zone_wtime;
1925         scalehrtime(&tmp);
1926         zmp->zm_wtime.value.ui64 = tmp;
1927 
1928         zmp->zm_avenrun1.value.ui32 = zone->zone_avenrun[0];
1929         zmp->zm_avenrun5.value.ui32 = zone->zone_avenrun[1];
1930         zmp->zm_avenrun15.value.ui32 = zone->zone_avenrun[2];
1931 
1932         zmp->zm_ffcap.value.ui32 = zone->zone_ffcap;
1933         zmp->zm_ffnoproc.value.ui32 = zone->zone_ffnoproc;
1934         zmp->zm_ffnomem.value.ui32 = zone->zone_ffnomem;
1935         zmp->zm_ffmisc.value.ui32 = zone->zone_ffmisc;
1936 
1937         zmp->zm_nested_intp.value.ui32 = zone->zone_nested_intp;
1938 
1939         zmp->zm_init_pid.value.ui32 = zone->zone_proc_initpid;
1940         zmp->zm_boot_time.value.ui64 = (uint64_t)zone->zone_boot_time;
1941 
1942         return (0);
1943 }
1944 
1945 static kstat_t *
1946 zone_misc_kstat_create(zone_t *zone)
1947 {
1948         kstat_t *ksp;
1949         zone_misc_kstat_t *zmp;
1950 
1951         if ((ksp = kstat_create_zone("zones", zone->zone_id,
1952             zone->zone_name, "zone_misc", KSTAT_TYPE_NAMED,
1953             sizeof (zone_misc_kstat_t) / sizeof (kstat_named_t),
1954             KSTAT_FLAG_VIRTUAL, zone->zone_id)) == NULL)
1955                 return (NULL);
1956 
1957         if (zone->zone_id != GLOBAL_ZONEID)
1958                 kstat_zone_add(ksp, GLOBAL_ZONEID);
1959 
1960         zmp = ksp->ks_data = kmem_zalloc(sizeof (zone_misc_kstat_t), KM_SLEEP);
1961         ksp->ks_data_size += strlen(zone->zone_name) + 1;
1962         ksp->ks_lock = &zone->zone_misc_lock;
1963         zone->zone_misc_stats = zmp;
1964 
1965         /* The kstat "name" field is not large enough for a full zonename */
1966         kstat_named_init(&zmp->zm_zonename, "zonename", KSTAT_DATA_STRING);
1967         kstat_named_setstr(&zmp->zm_zonename, zone->zone_name);
1968         kstat_named_init(&zmp->zm_utime, "nsec_user", KSTAT_DATA_UINT64);
1969         kstat_named_init(&zmp->zm_stime, "nsec_sys", KSTAT_DATA_UINT64);
1970         kstat_named_init(&zmp->zm_wtime, "nsec_waitrq", KSTAT_DATA_UINT64);
1971         kstat_named_init(&zmp->zm_avenrun1, "avenrun_1min", KSTAT_DATA_UINT32);
1972         kstat_named_init(&zmp->zm_avenrun5, "avenrun_5min", KSTAT_DATA_UINT32);
1973         kstat_named_init(&zmp->zm_avenrun15, "avenrun_15min",
1974             KSTAT_DATA_UINT32);
1975         kstat_named_init(&zmp->zm_ffcap, "forkfail_cap", KSTAT_DATA_UINT32);
1976         kstat_named_init(&zmp->zm_ffnoproc, "forkfail_noproc",
1977             KSTAT_DATA_UINT32);
1978         kstat_named_init(&zmp->zm_ffnomem, "forkfail_nomem", KSTAT_DATA_UINT32);
1979         kstat_named_init(&zmp->zm_ffmisc, "forkfail_misc", KSTAT_DATA_UINT32);
1980         kstat_named_init(&zmp->zm_nested_intp, "nested_interp",
1981             KSTAT_DATA_UINT32);
1982         kstat_named_init(&zmp->zm_init_pid, "init_pid", KSTAT_DATA_UINT32);
1983         kstat_named_init(&zmp->zm_boot_time, "boot_time", KSTAT_DATA_UINT64);
1984 
1985         ksp->ks_update = zone_misc_kstat_update;
1986         ksp->ks_private = zone;
1987 
1988         kstat_install(ksp);
1989         return (ksp);
1990 }
1991 
1992 static void
1993 zone_kstat_create(zone_t *zone)
1994 {
1995         zone->zone_lockedmem_kstat = zone_kstat_create_common(zone,
1996             "lockedmem", zone_lockedmem_kstat_update);
1997         zone->zone_swapresv_kstat = zone_kstat_create_common(zone,
1998             "swapresv", zone_swapresv_kstat_update);
1999         zone->zone_nprocs_kstat = zone_kstat_create_common(zone,
2000             "nprocs", zone_nprocs_kstat_update);
2001 
2002         if ((zone->zone_mcap_ksp = zone_mcap_kstat_create(zone)) == NULL) {
2003                 zone->zone_mcap_stats = kmem_zalloc(
2004                     sizeof (zone_mcap_kstat_t), KM_SLEEP);
2005         }
2006 
2007         if ((zone->zone_misc_ksp = zone_misc_kstat_create(zone)) == NULL) {
2008                 zone->zone_misc_stats = kmem_zalloc(
2009                     sizeof (zone_misc_kstat_t), KM_SLEEP);
2010         }
2011 }
2012 
2013 static void
2014 zone_kstat_delete_common(kstat_t **pkstat, size_t datasz)
2015 {
2016         void *data;
2017 
2018         if (*pkstat != NULL) {
2019                 data = (*pkstat)->ks_data;
2020                 kstat_delete(*pkstat);
2021                 kmem_free(data, datasz);
2022                 *pkstat = NULL;
2023         }
2024 }
2025 
2026 static void
2027 zone_kstat_delete(zone_t *zone)
2028 {
2029         zone_kstat_delete_common(&zone->zone_lockedmem_kstat,
2030             sizeof (zone_kstat_t));
2031         zone_kstat_delete_common(&zone->zone_swapresv_kstat,
2032             sizeof (zone_kstat_t));
2033         zone_kstat_delete_common(&zone->zone_nprocs_kstat,
2034             sizeof (zone_kstat_t));
2035         zone_kstat_delete_common(&zone->zone_mcap_ksp,
2036             sizeof (zone_mcap_kstat_t));
2037         zone_kstat_delete_common(&zone->zone_misc_ksp,
2038             sizeof (zone_misc_kstat_t));
2039 }
2040 
2041 /*
2042  * Called very early on in boot to initialize the ZSD list so that
2043  * zone_key_create() can be called before zone_init().  It also initializes
2044  * portions of zone0 which may be used before zone_init() is called.  The
2045  * variable "global_zone" will be set when zone0 is fully initialized by
2046  * zone_init().
2047  */
2048 void
2049 zone_zsd_init(void)
2050 {
2051         mutex_init(&zonehash_lock, NULL, MUTEX_DEFAULT, NULL);
2052         mutex_init(&zsd_key_lock, NULL, MUTEX_DEFAULT, NULL);
2053         list_create(&zsd_registered_keys, sizeof (struct zsd_entry),
2054             offsetof(struct zsd_entry, zsd_linkage));
2055         list_create(&zone_active, sizeof (zone_t),
2056             offsetof(zone_t, zone_linkage));
2057         list_create(&zone_deathrow, sizeof (zone_t),
2058             offsetof(zone_t, zone_linkage));
2059 
2060         mutex_init(&zone0.zone_lock, NULL, MUTEX_DEFAULT, NULL);
2061         mutex_init(&zone0.zone_nlwps_lock, NULL, MUTEX_DEFAULT, NULL);
2062         mutex_init(&zone0.zone_mem_lock, NULL, MUTEX_DEFAULT, NULL);
2063         zone0.zone_shares = 1;
2064         zone0.zone_nlwps = 0;
2065         zone0.zone_nlwps_ctl = INT_MAX;
2066         zone0.zone_nprocs = 0;
2067         zone0.zone_nprocs_ctl = INT_MAX;
2068         zone0.zone_locked_mem = 0;
2069         zone0.zone_locked_mem_ctl = UINT64_MAX;
2070         ASSERT(zone0.zone_max_swap == 0);
2071         zone0.zone_max_swap_ctl = UINT64_MAX;
2072         zone0.zone_max_lofi = 0;
2073         zone0.zone_max_lofi_ctl = UINT64_MAX;
2074         zone0.zone_shmmax = 0;
2075         zone0.zone_ipc.ipcq_shmmni = 0;
2076         zone0.zone_ipc.ipcq_semmni = 0;
2077         zone0.zone_ipc.ipcq_msgmni = 0;
2078         zone0.zone_name = GLOBAL_ZONENAME;
2079         zone0.zone_nodename = utsname.nodename;
2080         zone0.zone_domain = srpc_domain;
2081         zone0.zone_hostid = HW_INVALID_HOSTID;
2082         zone0.zone_fs_allowed = NULL;
2083         zone0.zone_ref = 1;
2084         zone0.zone_id = GLOBAL_ZONEID;
2085         zone0.zone_status = ZONE_IS_RUNNING;
2086         zone0.zone_rootpath = "/";
2087         zone0.zone_rootpathlen = 2;
2088         zone0.zone_psetid = ZONE_PS_INVAL;
2089         zone0.zone_ncpus = 0;
2090         zone0.zone_ncpus_online = 0;
2091         zone0.zone_proc_initpid = 1;
2092         zone0.zone_initname = initname;
2093         zone0.zone_lockedmem_kstat = NULL;
2094         zone0.zone_swapresv_kstat = NULL;
2095         zone0.zone_nprocs_kstat = NULL;
2096 
2097         zone0.zone_stime = 0;
2098         zone0.zone_utime = 0;
2099         zone0.zone_wtime = 0;
2100 
2101         list_create(&zone0.zone_ref_list, sizeof (zone_ref_t),
2102             offsetof(zone_ref_t, zref_linkage));
2103         list_create(&zone0.zone_zsd, sizeof (struct zsd_entry),
2104             offsetof(struct zsd_entry, zsd_linkage));
2105         list_insert_head(&zone_active, &zone0);
2106 
2107         /*
2108          * The root filesystem is not mounted yet, so zone_rootvp cannot be set
2109          * to anything meaningful.  It is assigned to be 'rootdir' in
2110          * vfs_mountroot().
2111          */
2112         zone0.zone_rootvp = NULL;
2113         zone0.zone_vfslist = NULL;
2114         zone0.zone_bootargs = initargs;
2115         zone0.zone_privset = kmem_alloc(sizeof (priv_set_t), KM_SLEEP);
2116         /*
2117          * The global zone has all privileges
2118          */
2119         priv_fillset(zone0.zone_privset);
2120         /*
2121          * Add p0 to the global zone
2122          */
2123         zone0.zone_zsched = &p0;
2124         p0.p_zone = &zone0;
2125 }
2126 
2127 /*
2128  * Compute a hash value based on the contents of the label and the DOI.  The
2129  * hash algorithm is somewhat arbitrary, but is based on the observation that
2130  * humans will likely pick labels that differ by amounts that work out to be
2131  * multiples of the number of hash chains, and thus stirring in some primes
2132  * should help.
2133  */
2134 static uint_t
2135 hash_bylabel(void *hdata, mod_hash_key_t key)
2136 {
2137         const ts_label_t *lab = (ts_label_t *)key;
2138         const uint32_t *up, *ue;
2139         uint_t hash;
2140         int i;
2141 
2142         _NOTE(ARGUNUSED(hdata));
2143 
2144         hash = lab->tsl_doi + (lab->tsl_doi << 1);
2145         /* we depend on alignment of label, but not representation */
2146         up = (const uint32_t *)&lab->tsl_label;
2147         ue = up + sizeof (lab->tsl_label) / sizeof (*up);
2148         i = 1;
2149         while (up < ue) {
2150                 /* using 2^n + 1, 1 <= n <= 16 as source of many primes */
2151                 hash += *up + (*up << ((i % 16) + 1));
2152                 up++;
2153                 i++;
2154         }
2155         return (hash);
2156 }
2157 
2158 /*
2159  * All that mod_hash cares about here is zero (equal) versus non-zero (not
2160  * equal).  This may need to be changed if less than / greater than is ever
2161  * needed.
2162  */
2163 static int
2164 hash_labelkey_cmp(mod_hash_key_t key1, mod_hash_key_t key2)
2165 {
2166         ts_label_t *lab1 = (ts_label_t *)key1;
2167         ts_label_t *lab2 = (ts_label_t *)key2;
2168 
2169         return (label_equal(lab1, lab2) ? 0 : 1);
2170 }
2171 
2172 /*
2173  * Called by main() to initialize the zones framework.
2174  */
2175 void
2176 zone_init(void)
2177 {
2178         rctl_dict_entry_t *rde;
2179         rctl_val_t *dval;
2180         rctl_set_t *set;
2181         rctl_alloc_gp_t *gp;
2182         rctl_entity_p_t e;
2183         int res;
2184 
2185         ASSERT(curproc == &p0);
2186 
2187         /*
2188          * Create ID space for zone IDs.  ID 0 is reserved for the
2189          * global zone.
2190          */
2191         zoneid_space = id_space_create("zoneid_space", 1, MAX_ZONEID);
2192 
2193         /*
2194          * Initialize generic zone resource controls, if any.
2195          */
2196         rc_zone_cpu_shares = rctl_register("zone.cpu-shares",
2197             RCENTITY_ZONE, RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_DENY_NEVER |
2198             RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT | RCTL_GLOBAL_SYSLOG_NEVER,
2199             FSS_MAXSHARES, FSS_MAXSHARES, &zone_cpu_shares_ops);
2200 
2201         rc_zone_cpu_cap = rctl_register("zone.cpu-cap",
2202             RCENTITY_ZONE, RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_DENY_ALWAYS |
2203             RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT |RCTL_GLOBAL_SYSLOG_NEVER |
2204             RCTL_GLOBAL_INFINITE,
2205             MAXCAP, MAXCAP, &zone_cpu_cap_ops);
2206 
2207         rc_zone_nlwps = rctl_register("zone.max-lwps", RCENTITY_ZONE,
2208             RCTL_GLOBAL_NOACTION | RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT,
2209             INT_MAX, INT_MAX, &zone_lwps_ops);
2210 
2211         rc_zone_nprocs = rctl_register("zone.max-processes", RCENTITY_ZONE,
2212             RCTL_GLOBAL_NOACTION | RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT,
2213             INT_MAX, INT_MAX, &zone_procs_ops);
2214 
2215         /*
2216          * System V IPC resource controls
2217          */
2218         rc_zone_msgmni = rctl_register("zone.max-msg-ids",
2219             RCENTITY_ZONE, RCTL_GLOBAL_DENY_ALWAYS | RCTL_GLOBAL_NOBASIC |
2220             RCTL_GLOBAL_COUNT, IPC_IDS_MAX, IPC_IDS_MAX, &zone_msgmni_ops);
2221 
2222         rc_zone_semmni = rctl_register("zone.max-sem-ids",
2223             RCENTITY_ZONE, RCTL_GLOBAL_DENY_ALWAYS | RCTL_GLOBAL_NOBASIC |
2224             RCTL_GLOBAL_COUNT, IPC_IDS_MAX, IPC_IDS_MAX, &zone_semmni_ops);
2225 
2226         rc_zone_shmmni = rctl_register("zone.max-shm-ids",
2227             RCENTITY_ZONE, RCTL_GLOBAL_DENY_ALWAYS | RCTL_GLOBAL_NOBASIC |
2228             RCTL_GLOBAL_COUNT, IPC_IDS_MAX, IPC_IDS_MAX, &zone_shmmni_ops);
2229 
2230         rc_zone_shmmax = rctl_register("zone.max-shm-memory",
2231             RCENTITY_ZONE, RCTL_GLOBAL_DENY_ALWAYS | RCTL_GLOBAL_NOBASIC |
2232             RCTL_GLOBAL_BYTES, UINT64_MAX, UINT64_MAX, &zone_shmmax_ops);
2233 
2234         /*
2235          * Create a rctl_val with PRIVILEGED, NOACTION, value = 1.  Then attach
2236          * this at the head of the rctl_dict_entry for ``zone.cpu-shares''.
2237          */
2238         dval = kmem_cache_alloc(rctl_val_cache, KM_SLEEP);
2239         bzero(dval, sizeof (rctl_val_t));
2240         dval->rcv_value = 1;
2241         dval->rcv_privilege = RCPRIV_PRIVILEGED;
2242         dval->rcv_flagaction = RCTL_LOCAL_NOACTION;
2243         dval->rcv_action_recip_pid = -1;
2244 
2245         rde = rctl_dict_lookup("zone.cpu-shares");
2246         (void) rctl_val_list_insert(&rde->rcd_default_value, dval);
2247 
2248         rc_zone_locked_mem = rctl_register("zone.max-locked-memory",
2249             RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_BYTES |
2250             RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
2251             &zone_locked_mem_ops);
2252 
2253         rc_zone_max_swap = rctl_register("zone.max-swap",
2254             RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_BYTES |
2255             RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
2256             &zone_max_swap_ops);
2257 
2258         rc_zone_max_lofi = rctl_register("zone.max-lofi",
2259             RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT |
2260             RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
2261             &zone_max_lofi_ops);
2262 
2263         /*
2264          * Initialize the ``global zone''.
2265          */
2266         set = rctl_set_create();
2267         gp = rctl_set_init_prealloc(RCENTITY_ZONE);
2268         mutex_enter(&p0.p_lock);
2269         e.rcep_p.zone = &zone0;
2270         e.rcep_t = RCENTITY_ZONE;
2271         zone0.zone_rctls = rctl_set_init(RCENTITY_ZONE, &p0, &e, set,
2272             gp);
2273 
2274         zone0.zone_nlwps = p0.p_lwpcnt;
2275         zone0.zone_nprocs = 1;
2276         zone0.zone_ntasks = 1;
2277         mutex_exit(&p0.p_lock);
2278         zone0.zone_restart_init = B_TRUE;
2279         zone0.zone_brand = &native_brand;
2280         rctl_prealloc_destroy(gp);
2281         /*
2282          * pool_default hasn't been initialized yet, so we let pool_init()
2283          * take care of making sure the global zone is in the default pool.
2284          */
2285 
2286         /*
2287          * Initialize global zone kstats
2288          */
2289         zone_kstat_create(&zone0);
2290 
2291         /*
2292          * Initialize zone label.
2293          * mlp are initialized when tnzonecfg is loaded.
2294          */
2295         zone0.zone_slabel = l_admin_low;
2296         rw_init(&zone0.zone_mlps.mlpl_rwlock, NULL, RW_DEFAULT, NULL);
2297         label_hold(l_admin_low);
2298 
2299         /*
2300          * Initialise the lock for the database structure used by mntfs.
2301          */
2302         rw_init(&zone0.zone_mntfs_db_lock, NULL, RW_DEFAULT, NULL);
2303 
2304         mutex_enter(&zonehash_lock);
2305         zone_uniqid(&zone0);
2306         ASSERT(zone0.zone_uniqid == GLOBAL_ZONEUNIQID);
2307 
2308         zonehashbyid = mod_hash_create_idhash("zone_by_id", zone_hash_size,
2309             mod_hash_null_valdtor);
2310         zonehashbyname = mod_hash_create_strhash("zone_by_name",
2311             zone_hash_size, mod_hash_null_valdtor);
2312         /*
2313          * maintain zonehashbylabel only for labeled systems
2314          */
2315         if (is_system_labeled())
2316                 zonehashbylabel = mod_hash_create_extended("zone_by_label",
2317                     zone_hash_size, mod_hash_null_keydtor,
2318                     mod_hash_null_valdtor, hash_bylabel, NULL,
2319                     hash_labelkey_cmp, KM_SLEEP);
2320         zonecount = 1;
2321 
2322         (void) mod_hash_insert(zonehashbyid, (mod_hash_key_t)GLOBAL_ZONEID,
2323             (mod_hash_val_t)&zone0);
2324         (void) mod_hash_insert(zonehashbyname, (mod_hash_key_t)zone0.zone_name,
2325             (mod_hash_val_t)&zone0);
2326         if (is_system_labeled()) {
2327                 zone0.zone_flags |= ZF_HASHED_LABEL;
2328                 (void) mod_hash_insert(zonehashbylabel,
2329                     (mod_hash_key_t)zone0.zone_slabel, (mod_hash_val_t)&zone0);
2330         }
2331         mutex_exit(&zonehash_lock);
2332 
2333         /*
2334          * We avoid setting zone_kcred until now, since kcred is initialized
2335          * sometime after zone_zsd_init() and before zone_init().
2336          */
2337         zone0.zone_kcred = kcred;
2338         /*
2339          * The global zone is fully initialized (except for zone_rootvp which
2340          * will be set when the root filesystem is mounted).
2341          */
2342         global_zone = &zone0;
2343 
2344         /*
2345          * Setup an event channel to send zone status change notifications on
2346          */
2347         res = sysevent_evc_bind(ZONE_EVENT_CHANNEL, &zone_event_chan,
2348             EVCH_CREAT);
2349 
2350         if (res)
2351                 panic("Sysevent_evc_bind failed during zone setup.\n");
2352 
2353 }
2354 
2355 static void
2356 zone_free(zone_t *zone)
2357 {
2358         ASSERT(zone != global_zone);
2359         ASSERT(zone->zone_ntasks == 0);
2360         ASSERT(zone->zone_nlwps == 0);
2361         ASSERT(zone->zone_nprocs == 0);
2362         ASSERT(zone->zone_cred_ref == 0);
2363         ASSERT(zone->zone_kcred == NULL);
2364         ASSERT(zone_status_get(zone) == ZONE_IS_DEAD ||
2365             zone_status_get(zone) == ZONE_IS_UNINITIALIZED);
2366         ASSERT(list_is_empty(&zone->zone_ref_list));
2367 
2368         /*
2369          * Remove any zone caps.
2370          */
2371         cpucaps_zone_remove(zone);
2372 
2373         ASSERT(zone->zone_cpucap == NULL);
2374 
2375         /* remove from deathrow list */
2376         if (zone_status_get(zone) == ZONE_IS_DEAD) {
2377                 ASSERT(zone->zone_ref == 0);
2378                 mutex_enter(&zone_deathrow_lock);
2379                 list_remove(&zone_deathrow, zone);
2380                 mutex_exit(&zone_deathrow_lock);
2381         }
2382 
2383         list_destroy(&zone->zone_ref_list);
2384         zone_free_zsd(zone);
2385         zone_free_datasets(zone);
2386         list_destroy(&zone->zone_dl_list);
2387 
2388         if (zone->zone_rootvp != NULL)
2389                 VN_RELE(zone->zone_rootvp);
2390         if (zone->zone_rootpath)
2391                 kmem_free(zone->zone_rootpath, zone->zone_rootpathlen);
2392         if (zone->zone_name != NULL)
2393                 kmem_free(zone->zone_name, ZONENAME_MAX);
2394         if (zone->zone_slabel != NULL)
2395                 label_rele(zone->zone_slabel);
2396         if (zone->zone_nodename != NULL)
2397                 kmem_free(zone->zone_nodename, _SYS_NMLN);
2398         if (zone->zone_domain != NULL)
2399                 kmem_free(zone->zone_domain, _SYS_NMLN);
2400         if (zone->zone_privset != NULL)
2401                 kmem_free(zone->zone_privset, sizeof (priv_set_t));
2402         if (zone->zone_rctls != NULL)
2403                 rctl_set_free(zone->zone_rctls);
2404         if (zone->zone_bootargs != NULL)
2405                 strfree(zone->zone_bootargs);
2406         if (zone->zone_initname != NULL)
2407                 strfree(zone->zone_initname);
2408         if (zone->zone_fs_allowed != NULL)
2409                 strfree(zone->zone_fs_allowed);
2410         if (zone->zone_pfexecd != NULL)
2411                 klpd_freelist(&zone->zone_pfexecd);
2412         id_free(zoneid_space, zone->zone_id);
2413         mutex_destroy(&zone->zone_lock);
2414         cv_destroy(&zone->zone_cv);
2415         rw_destroy(&zone->zone_mlps.mlpl_rwlock);
2416         rw_destroy(&zone->zone_mntfs_db_lock);
2417         kmem_free(zone, sizeof (zone_t));
2418 }
2419 
2420 /*
2421  * See block comment at the top of this file for information about zone
2422  * status values.
2423  */
2424 /*
2425  * Convenience function for setting zone status.
2426  */
2427 static void
2428 zone_status_set(zone_t *zone, zone_status_t status)
2429 {
2430 
2431         nvlist_t *nvl = NULL;
2432         ASSERT(MUTEX_HELD(&zone_status_lock));
2433         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE &&
2434             status >= zone_status_get(zone));
2435 
2436         if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) ||
2437             nvlist_add_string(nvl, ZONE_CB_NAME, zone->zone_name) ||
2438             nvlist_add_string(nvl, ZONE_CB_NEWSTATE,
2439             zone_status_table[status]) ||
2440             nvlist_add_string(nvl, ZONE_CB_OLDSTATE,
2441             zone_status_table[zone->zone_status]) ||
2442             nvlist_add_int32(nvl, ZONE_CB_ZONEID, zone->zone_id) ||
2443             nvlist_add_uint64(nvl, ZONE_CB_TIMESTAMP, (uint64_t)gethrtime()) ||
2444             sysevent_evc_publish(zone_event_chan, ZONE_EVENT_STATUS_CLASS,
2445             ZONE_EVENT_STATUS_SUBCLASS, "sun.com", "kernel", nvl, EVCH_SLEEP)) {
2446 #ifdef DEBUG
2447                 (void) printf(
2448                     "Failed to allocate and send zone state change event.\n");
2449 #endif
2450         }
2451         nvlist_free(nvl);
2452 
2453         zone->zone_status = status;
2454 
2455         cv_broadcast(&zone->zone_cv);
2456 }
2457 
2458 /*
2459  * Public function to retrieve the zone status.  The zone status may
2460  * change after it is retrieved.
2461  */
2462 zone_status_t
2463 zone_status_get(zone_t *zone)
2464 {
2465         return (zone->zone_status);
2466 }
2467 
2468 static int
2469 zone_set_bootargs(zone_t *zone, const char *zone_bootargs)
2470 {
2471         char *buf = kmem_zalloc(BOOTARGS_MAX, KM_SLEEP);
2472         int err = 0;
2473 
2474         ASSERT(zone != global_zone);
2475         if ((err = copyinstr(zone_bootargs, buf, BOOTARGS_MAX, NULL)) != 0)
2476                 goto done;      /* EFAULT or ENAMETOOLONG */
2477 
2478         if (zone->zone_bootargs != NULL)
2479                 strfree(zone->zone_bootargs);
2480 
2481         zone->zone_bootargs = strdup(buf);
2482 
2483 done:
2484         kmem_free(buf, BOOTARGS_MAX);
2485         return (err);
2486 }
2487 
2488 static int
2489 zone_set_brand(zone_t *zone, const char *brand)
2490 {
2491         struct brand_attr *attrp;
2492         brand_t *bp;
2493 
2494         attrp = kmem_alloc(sizeof (struct brand_attr), KM_SLEEP);
2495         if (copyin(brand, attrp, sizeof (struct brand_attr)) != 0) {
2496                 kmem_free(attrp, sizeof (struct brand_attr));
2497                 return (EFAULT);
2498         }
2499 
2500         bp = brand_register_zone(attrp);
2501         kmem_free(attrp, sizeof (struct brand_attr));
2502         if (bp == NULL)
2503                 return (EINVAL);
2504 
2505         /*
2506          * This is the only place where a zone can change it's brand.
2507          * We already need to hold zone_status_lock to check the zone
2508          * status, so we'll just use that lock to serialize zone
2509          * branding requests as well.
2510          */
2511         mutex_enter(&zone_status_lock);
2512 
2513         /* Re-Branding is not allowed and the zone can't be booted yet */
2514         if ((ZONE_IS_BRANDED(zone)) ||
2515             (zone_status_get(zone) >= ZONE_IS_BOOTING)) {
2516                 mutex_exit(&zone_status_lock);
2517                 brand_unregister_zone(bp);
2518                 return (EINVAL);
2519         }
2520 
2521         /* set up the brand specific data */
2522         zone->zone_brand = bp;
2523         ZBROP(zone)->b_init_brand_data(zone);
2524 
2525         mutex_exit(&zone_status_lock);
2526         return (0);
2527 }
2528 
2529 static int
2530 zone_set_fs_allowed(zone_t *zone, const char *zone_fs_allowed)
2531 {
2532         char *buf = kmem_zalloc(ZONE_FS_ALLOWED_MAX, KM_SLEEP);
2533         int err = 0;
2534 
2535         ASSERT(zone != global_zone);
2536         if ((err = copyinstr(zone_fs_allowed, buf,
2537             ZONE_FS_ALLOWED_MAX, NULL)) != 0)
2538                 goto done;
2539 
2540         if (zone->zone_fs_allowed != NULL)
2541                 strfree(zone->zone_fs_allowed);
2542 
2543         zone->zone_fs_allowed = strdup(buf);
2544 
2545 done:
2546         kmem_free(buf, ZONE_FS_ALLOWED_MAX);
2547         return (err);
2548 }
2549 
2550 static int
2551 zone_set_initname(zone_t *zone, const char *zone_initname)
2552 {
2553         char initname[INITNAME_SZ];
2554         size_t len;
2555         int err = 0;
2556 
2557         ASSERT(zone != global_zone);
2558         if ((err = copyinstr(zone_initname, initname, INITNAME_SZ, &len)) != 0)
2559                 return (err);   /* EFAULT or ENAMETOOLONG */
2560 
2561         if (zone->zone_initname != NULL)
2562                 strfree(zone->zone_initname);
2563 
2564         zone->zone_initname = kmem_alloc(strlen(initname) + 1, KM_SLEEP);
2565         (void) strcpy(zone->zone_initname, initname);
2566         return (0);
2567 }
2568 
2569 static int
2570 zone_set_phys_mcap(zone_t *zone, const uint64_t *zone_mcap)
2571 {
2572         uint64_t mcap;
2573         int err = 0;
2574 
2575         if ((err = copyin(zone_mcap, &mcap, sizeof (uint64_t))) == 0)
2576                 zone->zone_phys_mcap = mcap;
2577 
2578         return (err);
2579 }
2580 
2581 static int
2582 zone_set_sched_class(zone_t *zone, const char *new_class)
2583 {
2584         char sched_class[PC_CLNMSZ];
2585         id_t classid;
2586         int err;
2587 
2588         ASSERT(zone != global_zone);
2589         if ((err = copyinstr(new_class, sched_class, PC_CLNMSZ, NULL)) != 0)
2590                 return (err);   /* EFAULT or ENAMETOOLONG */
2591 
2592         if (getcid(sched_class, &classid) != 0 || CLASS_KERNEL(classid))
2593                 return (set_errno(EINVAL));
2594         zone->zone_defaultcid = classid;
2595         ASSERT(zone->zone_defaultcid > 0 &&
2596             zone->zone_defaultcid < loaded_classes);
2597 
2598         return (0);
2599 }
2600 
2601 /*
2602  * Block indefinitely waiting for (zone_status >= status)
2603  */
2604 void
2605 zone_status_wait(zone_t *zone, zone_status_t status)
2606 {
2607         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2608 
2609         mutex_enter(&zone_status_lock);
2610         while (zone->zone_status < status) {
2611                 cv_wait(&zone->zone_cv, &zone_status_lock);
2612         }
2613         mutex_exit(&zone_status_lock);
2614 }
2615 
2616 /*
2617  * Private CPR-safe version of zone_status_wait().
2618  */
2619 static void
2620 zone_status_wait_cpr(zone_t *zone, zone_status_t status, char *str)
2621 {
2622         callb_cpr_t cprinfo;
2623 
2624         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2625 
2626         CALLB_CPR_INIT(&cprinfo, &zone_status_lock, callb_generic_cpr,
2627             str);
2628         mutex_enter(&zone_status_lock);
2629         while (zone->zone_status < status) {
2630                 CALLB_CPR_SAFE_BEGIN(&cprinfo);
2631                 cv_wait(&zone->zone_cv, &zone_status_lock);
2632                 CALLB_CPR_SAFE_END(&cprinfo, &zone_status_lock);
2633         }
2634         /*
2635          * zone_status_lock is implicitly released by the following.
2636          */
2637         CALLB_CPR_EXIT(&cprinfo);
2638 }
2639 
2640 /*
2641  * Block until zone enters requested state or signal is received.  Return (0)
2642  * if signaled, non-zero otherwise.
2643  */
2644 int
2645 zone_status_wait_sig(zone_t *zone, zone_status_t status)
2646 {
2647         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2648 
2649         mutex_enter(&zone_status_lock);
2650         while (zone->zone_status < status) {
2651                 if (!cv_wait_sig(&zone->zone_cv, &zone_status_lock)) {
2652                         mutex_exit(&zone_status_lock);
2653                         return (0);
2654                 }
2655         }
2656         mutex_exit(&zone_status_lock);
2657         return (1);
2658 }
2659 
2660 /*
2661  * Block until the zone enters the requested state or the timeout expires,
2662  * whichever happens first.  Return (-1) if operation timed out, time remaining
2663  * otherwise.
2664  */
2665 clock_t
2666 zone_status_timedwait(zone_t *zone, clock_t tim, zone_status_t status)
2667 {
2668         clock_t timeleft = 0;
2669 
2670         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2671 
2672         mutex_enter(&zone_status_lock);
2673         while (zone->zone_status < status && timeleft != -1) {
2674                 timeleft = cv_timedwait(&zone->zone_cv, &zone_status_lock, tim);
2675         }
2676         mutex_exit(&zone_status_lock);
2677         return (timeleft);
2678 }
2679 
2680 /*
2681  * Block until the zone enters the requested state, the current process is
2682  * signaled,  or the timeout expires, whichever happens first.  Return (-1) if
2683  * operation timed out, 0 if signaled, time remaining otherwise.
2684  */
2685 clock_t
2686 zone_status_timedwait_sig(zone_t *zone, clock_t tim, zone_status_t status)
2687 {
2688         clock_t timeleft = tim - ddi_get_lbolt();
2689 
2690         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2691 
2692         mutex_enter(&zone_status_lock);
2693         while (zone->zone_status < status) {
2694                 timeleft = cv_timedwait_sig(&zone->zone_cv, &zone_status_lock,
2695                     tim);
2696                 if (timeleft <= 0)
2697                         break;
2698         }
2699         mutex_exit(&zone_status_lock);
2700         return (timeleft);
2701 }
2702 
2703 /*
2704  * Zones have two reference counts: one for references from credential
2705  * structures (zone_cred_ref), and one (zone_ref) for everything else.
2706  * This is so we can allow a zone to be rebooted while there are still
2707  * outstanding cred references, since certain drivers cache dblks (which
2708  * implicitly results in cached creds).  We wait for zone_ref to drop to
2709  * 0 (actually 1), but not zone_cred_ref.  The zone structure itself is
2710  * later freed when the zone_cred_ref drops to 0, though nothing other
2711  * than the zone id and privilege set should be accessed once the zone
2712  * is "dead".
2713  *
2714  * A debugging flag, zone_wait_for_cred, can be set to a non-zero value
2715  * to force halt/reboot to block waiting for the zone_cred_ref to drop
2716  * to 0.  This can be useful to flush out other sources of cached creds
2717  * that may be less innocuous than the driver case.
2718  *
2719  * Zones also provide a tracked reference counting mechanism in which zone
2720  * references are represented by "crumbs" (zone_ref structures).  Crumbs help
2721  * debuggers determine the sources of leaked zone references.  See
2722  * zone_hold_ref() and zone_rele_ref() below for more information.
2723  */
2724 
2725 int zone_wait_for_cred = 0;
2726 
2727 static void
2728 zone_hold_locked(zone_t *z)
2729 {
2730         ASSERT(MUTEX_HELD(&z->zone_lock));
2731         z->zone_ref++;
2732         ASSERT(z->zone_ref != 0);
2733 }
2734 
2735 /*
2736  * Increment the specified zone's reference count.  The zone's zone_t structure
2737  * will not be freed as long as the zone's reference count is nonzero.
2738  * Decrement the zone's reference count via zone_rele().
2739  *
2740  * NOTE: This function should only be used to hold zones for short periods of
2741  * time.  Use zone_hold_ref() if the zone must be held for a long time.
2742  */
2743 void
2744 zone_hold(zone_t *z)
2745 {
2746         mutex_enter(&z->zone_lock);
2747         zone_hold_locked(z);
2748         mutex_exit(&z->zone_lock);
2749 }
2750 
2751 /*
2752  * If the non-cred ref count drops to 1 and either the cred ref count
2753  * is 0 or we aren't waiting for cred references, the zone is ready to
2754  * be destroyed.
2755  */
2756 #define ZONE_IS_UNREF(zone)     ((zone)->zone_ref == 1 && \
2757             (!zone_wait_for_cred || (zone)->zone_cred_ref == 0))
2758 
2759 /*
2760  * Common zone reference release function invoked by zone_rele() and
2761  * zone_rele_ref().  If subsys is ZONE_REF_NUM_SUBSYS, then the specified
2762  * zone's subsystem-specific reference counters are not affected by the
2763  * release.  If ref is not NULL, then the zone_ref_t to which it refers is
2764  * removed from the specified zone's reference list.  ref must be non-NULL iff
2765  * subsys is not ZONE_REF_NUM_SUBSYS.
2766  */
2767 static void
2768 zone_rele_common(zone_t *z, zone_ref_t *ref, zone_ref_subsys_t subsys)
2769 {
2770         boolean_t wakeup;
2771 
2772         mutex_enter(&z->zone_lock);
2773         ASSERT(z->zone_ref != 0);
2774         z->zone_ref--;
2775         if (subsys != ZONE_REF_NUM_SUBSYS) {
2776                 ASSERT(z->zone_subsys_ref[subsys] != 0);
2777                 z->zone_subsys_ref[subsys]--;
2778                 list_remove(&z->zone_ref_list, ref);
2779         }
2780         if (z->zone_ref == 0 && z->zone_cred_ref == 0) {
2781                 /* no more refs, free the structure */
2782                 mutex_exit(&z->zone_lock);
2783                 zone_free(z);
2784                 return;
2785         }
2786         /* signal zone_destroy so the zone can finish halting */
2787         wakeup = (ZONE_IS_UNREF(z) && zone_status_get(z) >= ZONE_IS_DEAD);
2788         mutex_exit(&z->zone_lock);
2789 
2790         if (wakeup) {
2791                 /*
2792                  * Grabbing zonehash_lock here effectively synchronizes with
2793                  * zone_destroy() to avoid missed signals.
2794                  */
2795                 mutex_enter(&zonehash_lock);
2796                 cv_broadcast(&zone_destroy_cv);
2797                 mutex_exit(&zonehash_lock);
2798         }
2799 }
2800 
2801 /*
2802  * Decrement the specified zone's reference count.  The specified zone will
2803  * cease to exist after this function returns if the reference count drops to
2804  * zero.  This function should be paired with zone_hold().
2805  */
2806 void
2807 zone_rele(zone_t *z)
2808 {
2809         zone_rele_common(z, NULL, ZONE_REF_NUM_SUBSYS);
2810 }
2811 
2812 /*
2813  * Initialize a zone reference structure.  This function must be invoked for
2814  * a reference structure before the structure is passed to zone_hold_ref().
2815  */
2816 void
2817 zone_init_ref(zone_ref_t *ref)
2818 {
2819         ref->zref_zone = NULL;
2820         list_link_init(&ref->zref_linkage);
2821 }
2822 
2823 /*
2824  * Acquire a reference to zone z.  The caller must specify the
2825  * zone_ref_subsys_t constant associated with its subsystem.  The specified
2826  * zone_ref_t structure will represent a reference to the specified zone.  Use
2827  * zone_rele_ref() to release the reference.
2828  *
2829  * The referenced zone_t structure will not be freed as long as the zone_t's
2830  * zone_status field is not ZONE_IS_DEAD and the zone has outstanding
2831  * references.
2832  *
2833  * NOTE: The zone_ref_t structure must be initialized before it is used.
2834  * See zone_init_ref() above.
2835  */
2836 void
2837 zone_hold_ref(zone_t *z, zone_ref_t *ref, zone_ref_subsys_t subsys)
2838 {
2839         ASSERT(subsys >= 0 && subsys < ZONE_REF_NUM_SUBSYS);
2840 
2841         /*
2842          * Prevent consumers from reusing a reference structure before
2843          * releasing it.
2844          */
2845         VERIFY(ref->zref_zone == NULL);
2846 
2847         ref->zref_zone = z;
2848         mutex_enter(&z->zone_lock);
2849         zone_hold_locked(z);
2850         z->zone_subsys_ref[subsys]++;
2851         ASSERT(z->zone_subsys_ref[subsys] != 0);
2852         list_insert_head(&z->zone_ref_list, ref);
2853         mutex_exit(&z->zone_lock);
2854 }
2855 
2856 /*
2857  * Release the zone reference represented by the specified zone_ref_t.
2858  * The reference is invalid after it's released; however, the zone_ref_t
2859  * structure can be reused without having to invoke zone_init_ref().
2860  * subsys should be the same value that was passed to zone_hold_ref()
2861  * when the reference was acquired.
2862  */
2863 void
2864 zone_rele_ref(zone_ref_t *ref, zone_ref_subsys_t subsys)
2865 {
2866         zone_rele_common(ref->zref_zone, ref, subsys);
2867 
2868         /*
2869          * Set the zone_ref_t's zref_zone field to NULL to generate panics
2870          * when consumers dereference the reference.  This helps us catch
2871          * consumers who use released references.  Furthermore, this lets
2872          * consumers reuse the zone_ref_t structure without having to
2873          * invoke zone_init_ref().
2874          */
2875         ref->zref_zone = NULL;
2876 }
2877 
2878 void
2879 zone_cred_hold(zone_t *z)
2880 {
2881         mutex_enter(&z->zone_lock);
2882         z->zone_cred_ref++;
2883         ASSERT(z->zone_cred_ref != 0);
2884         mutex_exit(&z->zone_lock);
2885 }
2886 
2887 void
2888 zone_cred_rele(zone_t *z)
2889 {
2890         boolean_t wakeup;
2891 
2892         mutex_enter(&z->zone_lock);
2893         ASSERT(z->zone_cred_ref != 0);
2894         z->zone_cred_ref--;
2895         if (z->zone_ref == 0 && z->zone_cred_ref == 0) {
2896                 /* no more refs, free the structure */
2897                 mutex_exit(&z->zone_lock);
2898                 zone_free(z);
2899                 return;
2900         }
2901         /*
2902          * If zone_destroy is waiting for the cred references to drain
2903          * out, and they have, signal it.
2904          */
2905         wakeup = (zone_wait_for_cred && ZONE_IS_UNREF(z) &&
2906             zone_status_get(z) >= ZONE_IS_DEAD);
2907         mutex_exit(&z->zone_lock);
2908 
2909         if (wakeup) {
2910                 /*
2911                  * Grabbing zonehash_lock here effectively synchronizes with
2912                  * zone_destroy() to avoid missed signals.
2913                  */
2914                 mutex_enter(&zonehash_lock);
2915                 cv_broadcast(&zone_destroy_cv);
2916                 mutex_exit(&zonehash_lock);
2917         }
2918 }
2919 
2920 void
2921 zone_task_hold(zone_t *z)
2922 {
2923         mutex_enter(&z->zone_lock);
2924         z->zone_ntasks++;
2925         ASSERT(z->zone_ntasks != 0);
2926         mutex_exit(&z->zone_lock);
2927 }
2928 
2929 void
2930 zone_task_rele(zone_t *zone)
2931 {
2932         uint_t refcnt;
2933 
2934         mutex_enter(&zone->zone_lock);
2935         ASSERT(zone->zone_ntasks != 0);
2936         refcnt = --zone->zone_ntasks;
2937         if (refcnt > 1)      {       /* Common case */
2938                 mutex_exit(&zone->zone_lock);
2939                 return;
2940         }
2941         zone_hold_locked(zone); /* so we can use the zone_t later */
2942         mutex_exit(&zone->zone_lock);
2943         if (refcnt == 1) {
2944                 /*
2945                  * See if the zone is shutting down.
2946                  */
2947                 mutex_enter(&zone_status_lock);
2948                 if (zone_status_get(zone) != ZONE_IS_SHUTTING_DOWN) {
2949                         goto out;
2950                 }
2951 
2952                 /*
2953                  * Make sure the ntasks didn't change since we
2954                  * dropped zone_lock.
2955                  */
2956                 mutex_enter(&zone->zone_lock);
2957                 if (refcnt != zone->zone_ntasks) {
2958                         mutex_exit(&zone->zone_lock);
2959                         goto out;
2960                 }
2961                 mutex_exit(&zone->zone_lock);
2962 
2963                 /*
2964                  * No more user processes in the zone.  The zone is empty.
2965                  */
2966                 zone_status_set(zone, ZONE_IS_EMPTY);
2967                 goto out;
2968         }
2969 
2970         ASSERT(refcnt == 0);
2971         /*
2972          * zsched has exited; the zone is dead.
2973          */
2974         zone->zone_zsched = NULL;            /* paranoia */
2975         mutex_enter(&zone_status_lock);
2976         zone_status_set(zone, ZONE_IS_DEAD);
2977 out:
2978         mutex_exit(&zone_status_lock);
2979         zone_rele(zone);
2980 }
2981 
2982 zoneid_t
2983 getzoneid(void)
2984 {
2985         return (curproc->p_zone->zone_id);
2986 }
2987 
2988 /*
2989  * Internal versions of zone_find_by_*().  These don't zone_hold() or
2990  * check the validity of a zone's state.
2991  */
2992 static zone_t *
2993 zone_find_all_by_id(zoneid_t zoneid)
2994 {
2995         mod_hash_val_t hv;
2996         zone_t *zone = NULL;
2997 
2998         ASSERT(MUTEX_HELD(&zonehash_lock));
2999 
3000         if (mod_hash_find(zonehashbyid,
3001             (mod_hash_key_t)(uintptr_t)zoneid, &hv) == 0)
3002                 zone = (zone_t *)hv;
3003         return (zone);
3004 }
3005 
3006 static zone_t *
3007 zone_find_all_by_label(const ts_label_t *label)
3008 {
3009         mod_hash_val_t hv;
3010         zone_t *zone = NULL;
3011 
3012         ASSERT(MUTEX_HELD(&zonehash_lock));
3013 
3014         /*
3015          * zonehashbylabel is not maintained for unlabeled systems
3016          */
3017         if (!is_system_labeled())
3018                 return (NULL);
3019         if (mod_hash_find(zonehashbylabel, (mod_hash_key_t)label, &hv) == 0)
3020                 zone = (zone_t *)hv;
3021         return (zone);
3022 }
3023 
3024 static zone_t *
3025 zone_find_all_by_name(char *name)
3026 {
3027         mod_hash_val_t hv;
3028         zone_t *zone = NULL;
3029 
3030         ASSERT(MUTEX_HELD(&zonehash_lock));
3031 
3032         if (mod_hash_find(zonehashbyname, (mod_hash_key_t)name, &hv) == 0)
3033                 zone = (zone_t *)hv;
3034         return (zone);
3035 }
3036 
3037 /*
3038  * Public interface for looking up a zone by zoneid.  Only returns the zone if
3039  * it is fully initialized, and has not yet begun the zone_destroy() sequence.
3040  * Caller must call zone_rele() once it is done with the zone.
3041  *
3042  * The zone may begin the zone_destroy() sequence immediately after this
3043  * function returns, but may be safely used until zone_rele() is called.
3044  */
3045 zone_t *
3046 zone_find_by_id(zoneid_t zoneid)
3047 {
3048         zone_t *zone;
3049         zone_status_t status;
3050 
3051         mutex_enter(&zonehash_lock);
3052         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
3053                 mutex_exit(&zonehash_lock);
3054                 return (NULL);
3055         }
3056         status = zone_status_get(zone);
3057         if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
3058                 /*
3059                  * For all practical purposes the zone doesn't exist.
3060                  */
3061                 mutex_exit(&zonehash_lock);
3062                 return (NULL);
3063         }
3064         zone_hold(zone);
3065         mutex_exit(&zonehash_lock);
3066         return (zone);
3067 }
3068 
3069 /*
3070  * Similar to zone_find_by_id, but using zone label as the key.
3071  */
3072 zone_t *
3073 zone_find_by_label(const ts_label_t *label)
3074 {
3075         zone_t *zone;
3076         zone_status_t status;
3077 
3078         mutex_enter(&zonehash_lock);
3079         if ((zone = zone_find_all_by_label(label)) == NULL) {
3080                 mutex_exit(&zonehash_lock);
3081                 return (NULL);
3082         }
3083 
3084         status = zone_status_get(zone);
3085         if (status > ZONE_IS_DOWN) {
3086                 /*
3087                  * For all practical purposes the zone doesn't exist.
3088                  */
3089                 mutex_exit(&zonehash_lock);
3090                 return (NULL);
3091         }
3092         zone_hold(zone);
3093         mutex_exit(&zonehash_lock);
3094         return (zone);
3095 }
3096 
3097 /*
3098  * Similar to zone_find_by_id, but using zone name as the key.
3099  */
3100 zone_t *
3101 zone_find_by_name(char *name)
3102 {
3103         zone_t *zone;
3104         zone_status_t status;
3105 
3106         mutex_enter(&zonehash_lock);
3107         if ((zone = zone_find_all_by_name(name)) == NULL) {
3108                 mutex_exit(&zonehash_lock);
3109                 return (NULL);
3110         }
3111         status = zone_status_get(zone);
3112         if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
3113                 /*
3114                  * For all practical purposes the zone doesn't exist.
3115                  */
3116                 mutex_exit(&zonehash_lock);
3117                 return (NULL);
3118         }
3119         zone_hold(zone);
3120         mutex_exit(&zonehash_lock);
3121         return (zone);
3122 }
3123 
3124 /*
3125  * Similar to zone_find_by_id(), using the path as a key.  For instance,
3126  * if there is a zone "foo" rooted at /foo/root, and the path argument
3127  * is "/foo/root/proc", it will return the held zone_t corresponding to
3128  * zone "foo".
3129  *
3130  * zone_find_by_path() always returns a non-NULL value, since at the
3131  * very least every path will be contained in the global zone.
3132  *
3133  * As with the other zone_find_by_*() functions, the caller is
3134  * responsible for zone_rele()ing the return value of this function.
3135  */
3136 zone_t *
3137 zone_find_by_path(const char *path)
3138 {
3139         zone_t *zone;
3140         zone_t *zret = NULL;
3141         zone_status_t status;
3142 
3143         if (path == NULL) {
3144                 /*
3145                  * Call from rootconf().
3146                  */
3147                 zone_hold(global_zone);
3148                 return (global_zone);
3149         }
3150         ASSERT(*path == '/');
3151         mutex_enter(&zonehash_lock);
3152         for (zone = list_head(&zone_active); zone != NULL;
3153             zone = list_next(&zone_active, zone)) {
3154                 if (ZONE_PATH_VISIBLE(path, zone))
3155                         zret = zone;
3156         }
3157         ASSERT(zret != NULL);
3158         status = zone_status_get(zret);
3159         if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
3160                 /*
3161                  * Zone practically doesn't exist.
3162                  */
3163                 zret = global_zone;
3164         }
3165         zone_hold(zret);
3166         mutex_exit(&zonehash_lock);
3167         return (zret);
3168 }
3169 
3170 /*
3171  * Public interface for updating per-zone load averages.  Called once per
3172  * second.
3173  *
3174  * Based on loadavg_update(), genloadavg() and calcloadavg() from clock.c.
3175  */
3176 void
3177 zone_loadavg_update()
3178 {
3179         zone_t *zp;
3180         zone_status_t status;
3181         struct loadavg_s *lavg;
3182         hrtime_t zone_total;
3183         int i;
3184         hrtime_t hr_avg;
3185         int nrun;
3186         static int64_t f[3] = { 135, 27, 9 };
3187         int64_t q, r;
3188 
3189         mutex_enter(&zonehash_lock);
3190         for (zp = list_head(&zone_active); zp != NULL;
3191             zp = list_next(&zone_active, zp)) {
3192                 mutex_enter(&zp->zone_lock);
3193 
3194                 /* Skip zones that are on the way down or not yet up */
3195                 status = zone_status_get(zp);
3196                 if (status < ZONE_IS_READY || status >= ZONE_IS_DOWN) {
3197                         /* For all practical purposes the zone doesn't exist. */
3198                         mutex_exit(&zp->zone_lock);
3199                         continue;
3200                 }
3201 
3202                 /*
3203                  * Update the 10 second moving average data in zone_loadavg.
3204                  */
3205                 lavg = &zp->zone_loadavg;
3206 
3207                 zone_total = zp->zone_utime + zp->zone_stime + zp->zone_wtime;
3208                 scalehrtime(&zone_total);
3209 
3210                 /* The zone_total should always be increasing. */
3211                 lavg->lg_loads[lavg->lg_cur] = (zone_total > lavg->lg_total) ?
3212                     zone_total - lavg->lg_total : 0;
3213                 lavg->lg_cur = (lavg->lg_cur + 1) % S_LOADAVG_SZ;
3214                 /* lg_total holds the prev. 1 sec. total */
3215                 lavg->lg_total = zone_total;
3216 
3217                 /*
3218                  * To simplify the calculation, we don't calculate the load avg.
3219                  * until the zone has been up for at least 10 seconds and our
3220                  * moving average is thus full.
3221                  */
3222                 if ((lavg->lg_len + 1) < S_LOADAVG_SZ) {
3223                         lavg->lg_len++;
3224                         mutex_exit(&zp->zone_lock);
3225                         continue;
3226                 }
3227 
3228                 /* Now calculate the 1min, 5min, 15 min load avg. */
3229                 hr_avg = 0;
3230                 for (i = 0; i < S_LOADAVG_SZ; i++)
3231                         hr_avg += lavg->lg_loads[i];
3232                 hr_avg = hr_avg / S_LOADAVG_SZ;
3233                 nrun = hr_avg / (NANOSEC / LGRP_LOADAVG_IN_THREAD_MAX);
3234 
3235                 /* Compute load avg. See comment in calcloadavg() */
3236                 for (i = 0; i < 3; i++) {
3237                         q = (zp->zone_hp_avenrun[i] >> 16) << 7;
3238                         r = (zp->zone_hp_avenrun[i] & 0xffff) << 7;
3239                         zp->zone_hp_avenrun[i] +=
3240                             ((nrun - q) * f[i] - ((r * f[i]) >> 16)) >> 4;
3241 
3242                         /* avenrun[] can only hold 31 bits of load avg. */
3243                         if (zp->zone_hp_avenrun[i] <
3244                             ((uint64_t)1<<(31+16-FSHIFT)))
3245                                 zp->zone_avenrun[i] = (int32_t)
3246                                     (zp->zone_hp_avenrun[i] >> (16 - FSHIFT));
3247                         else
3248                                 zp->zone_avenrun[i] = 0x7fffffff;
3249                 }
3250 
3251                 mutex_exit(&zp->zone_lock);
3252         }
3253         mutex_exit(&zonehash_lock);
3254 }
3255 
3256 /*
3257  * Get the number of cpus visible to this zone.  The system-wide global
3258  * 'ncpus' is returned if pools are disabled, the caller is in the
3259  * global zone, or a NULL zone argument is passed in.
3260  */
3261 int
3262 zone_ncpus_get(zone_t *zone)
3263 {
3264         int myncpus = zone == NULL ? 0 : zone->zone_ncpus;
3265 
3266         return (myncpus != 0 ? myncpus : ncpus);
3267 }
3268 
3269 /*
3270  * Get the number of online cpus visible to this zone.  The system-wide
3271  * global 'ncpus_online' is returned if pools are disabled, the caller
3272  * is in the global zone, or a NULL zone argument is passed in.
3273  */
3274 int
3275 zone_ncpus_online_get(zone_t *zone)
3276 {
3277         int myncpus_online = zone == NULL ? 0 : zone->zone_ncpus_online;
3278 
3279         return (myncpus_online != 0 ? myncpus_online : ncpus_online);
3280 }
3281 
3282 /*
3283  * Return the pool to which the zone is currently bound.
3284  */
3285 pool_t *
3286 zone_pool_get(zone_t *zone)
3287 {
3288         ASSERT(pool_lock_held());
3289 
3290         return (zone->zone_pool);
3291 }
3292 
3293 /*
3294  * Set the zone's pool pointer and update the zone's visibility to match
3295  * the resources in the new pool.
3296  */
3297 void
3298 zone_pool_set(zone_t *zone, pool_t *pool)
3299 {
3300         ASSERT(pool_lock_held());
3301         ASSERT(MUTEX_HELD(&cpu_lock));
3302 
3303         zone->zone_pool = pool;
3304         zone_pset_set(zone, pool->pool_pset->pset_id);
3305 }
3306 
3307 /*
3308  * Return the cached value of the id of the processor set to which the
3309  * zone is currently bound.  The value will be ZONE_PS_INVAL if the pools
3310  * facility is disabled.
3311  */
3312 psetid_t
3313 zone_pset_get(zone_t *zone)
3314 {
3315         ASSERT(MUTEX_HELD(&cpu_lock));
3316 
3317         return (zone->zone_psetid);
3318 }
3319 
3320 /*
3321  * Set the cached value of the id of the processor set to which the zone
3322  * is currently bound.  Also update the zone's visibility to match the
3323  * resources in the new processor set.
3324  */
3325 void
3326 zone_pset_set(zone_t *zone, psetid_t newpsetid)
3327 {
3328         psetid_t oldpsetid;
3329 
3330         ASSERT(MUTEX_HELD(&cpu_lock));
3331         oldpsetid = zone_pset_get(zone);
3332 
3333         if (oldpsetid == newpsetid)
3334                 return;
3335         /*
3336          * Global zone sees all.
3337          */
3338         if (zone != global_zone) {
3339                 zone->zone_psetid = newpsetid;
3340                 if (newpsetid != ZONE_PS_INVAL)
3341                         pool_pset_visibility_add(newpsetid, zone);
3342                 if (oldpsetid != ZONE_PS_INVAL)
3343                         pool_pset_visibility_remove(oldpsetid, zone);
3344         }
3345         /*
3346          * Disabling pools, so we should start using the global values
3347          * for ncpus and ncpus_online.
3348          */
3349         if (newpsetid == ZONE_PS_INVAL) {
3350                 zone->zone_ncpus = 0;
3351                 zone->zone_ncpus_online = 0;
3352         }
3353 }
3354 
3355 /*
3356  * Walk the list of active zones and issue the provided callback for
3357  * each of them.
3358  *
3359  * Caller must not be holding any locks that may be acquired under
3360  * zonehash_lock.  See comment at the beginning of the file for a list of
3361  * common locks and their interactions with zones.
3362  */
3363 int
3364 zone_walk(int (*cb)(zone_t *, void *), void *data)
3365 {
3366         zone_t *zone;
3367         int ret = 0;
3368         zone_status_t status;
3369 
3370         mutex_enter(&zonehash_lock);
3371         for (zone = list_head(&zone_active); zone != NULL;
3372             zone = list_next(&zone_active, zone)) {
3373                 /*
3374                  * Skip zones that shouldn't be externally visible.
3375                  */
3376                 status = zone_status_get(zone);
3377                 if (status < ZONE_IS_READY || status > ZONE_IS_DOWN)
3378                         continue;
3379                 /*
3380                  * Bail immediately if any callback invocation returns a
3381                  * non-zero value.
3382                  */
3383                 ret = (*cb)(zone, data);
3384                 if (ret != 0)
3385                         break;
3386         }
3387         mutex_exit(&zonehash_lock);
3388         return (ret);
3389 }
3390 
3391 static int
3392 zone_set_root(zone_t *zone, const char *upath)
3393 {
3394         vnode_t *vp;
3395         int trycount;
3396         int error = 0;
3397         char *path;
3398         struct pathname upn, pn;
3399         size_t pathlen;
3400 
3401         if ((error = pn_get((char *)upath, UIO_USERSPACE, &upn)) != 0)
3402                 return (error);
3403 
3404         pn_alloc(&pn);
3405 
3406         /* prevent infinite loop */
3407         trycount = 10;
3408         for (;;) {
3409                 if (--trycount <= 0) {
3410                         error = ESTALE;
3411                         goto out;
3412                 }
3413 
3414                 if ((error = lookuppn(&upn, &pn, FOLLOW, NULLVPP, &vp)) == 0) {
3415                         /*
3416                          * VOP_ACCESS() may cover 'vp' with a new
3417                          * filesystem, if 'vp' is an autoFS vnode.
3418                          * Get the new 'vp' if so.
3419                          */
3420                         if ((error =
3421                             VOP_ACCESS(vp, VEXEC, 0, CRED(), NULL)) == 0 &&
3422                             (!vn_ismntpt(vp) ||
3423                             (error = traverse(&vp)) == 0)) {
3424                                 pathlen = pn.pn_pathlen + 2;
3425                                 path = kmem_alloc(pathlen, KM_SLEEP);
3426                                 (void) strncpy(path, pn.pn_path,
3427                                     pn.pn_pathlen + 1);
3428                                 path[pathlen - 2] = '/';
3429                                 path[pathlen - 1] = '\0';
3430                                 pn_free(&pn);
3431                                 pn_free(&upn);
3432 
3433                                 /* Success! */
3434                                 break;
3435                         }
3436                         VN_RELE(vp);
3437                 }
3438                 if (error != ESTALE)
3439                         goto out;
3440         }
3441 
3442         ASSERT(error == 0);
3443         zone->zone_rootvp = vp;              /* we hold a reference to vp */
3444         zone->zone_rootpath = path;
3445         zone->zone_rootpathlen = pathlen;
3446         if (pathlen > 5 && strcmp(path + pathlen - 5, "/lu/") == 0)
3447                 zone->zone_flags |= ZF_IS_SCRATCH;
3448         return (0);
3449 
3450 out:
3451         pn_free(&pn);
3452         pn_free(&upn);
3453         return (error);
3454 }
3455 
3456 #define isalnum(c)      (((c) >= '0' && (c) <= '9') || \
3457                         ((c) >= 'a' && (c) <= 'z') || \
3458                         ((c) >= 'A' && (c) <= 'Z'))
3459 
3460 static int
3461 zone_set_name(zone_t *zone, const char *uname)
3462 {
3463         char *kname = kmem_zalloc(ZONENAME_MAX, KM_SLEEP);
3464         size_t len;
3465         int i, err;
3466 
3467         if ((err = copyinstr(uname, kname, ZONENAME_MAX, &len)) != 0) {
3468                 kmem_free(kname, ZONENAME_MAX);
3469                 return (err);   /* EFAULT or ENAMETOOLONG */
3470         }
3471 
3472         /* must be less than ZONENAME_MAX */
3473         if (len == ZONENAME_MAX && kname[ZONENAME_MAX - 1] != '\0') {
3474                 kmem_free(kname, ZONENAME_MAX);
3475                 return (EINVAL);
3476         }
3477 
3478         /*
3479          * Name must start with an alphanumeric and must contain only
3480          * alphanumerics, '-', '_' and '.'.
3481          */
3482         if (!isalnum(kname[0])) {
3483                 kmem_free(kname, ZONENAME_MAX);
3484                 return (EINVAL);
3485         }
3486         for (i = 1; i < len - 1; i++) {
3487                 if (!isalnum(kname[i]) && kname[i] != '-' && kname[i] != '_' &&
3488                     kname[i] != '.') {
3489                         kmem_free(kname, ZONENAME_MAX);
3490                         return (EINVAL);
3491                 }
3492         }
3493 
3494         zone->zone_name = kname;
3495         return (0);
3496 }
3497 
3498 /*
3499  * Gets the 32-bit hostid of the specified zone as an unsigned int.  If 'zonep'
3500  * is NULL or it points to a zone with no hostid emulation, then the machine's
3501  * hostid (i.e., the global zone's hostid) is returned.  This function returns
3502  * zero if neither the zone nor the host machine (global zone) have hostids.  It
3503  * returns HW_INVALID_HOSTID if the function attempts to return the machine's
3504  * hostid and the machine's hostid is invalid.
3505  */
3506 uint32_t
3507 zone_get_hostid(zone_t *zonep)
3508 {
3509         unsigned long machine_hostid;
3510 
3511         if (zonep == NULL || zonep->zone_hostid == HW_INVALID_HOSTID) {
3512                 if (ddi_strtoul(hw_serial, NULL, 10, &machine_hostid) != 0)
3513                         return (HW_INVALID_HOSTID);
3514                 return ((uint32_t)machine_hostid);
3515         }
3516         return (zonep->zone_hostid);
3517 }
3518 
3519 /*
3520  * Similar to thread_create(), but makes sure the thread is in the appropriate
3521  * zone's zsched process (curproc->p_zone->zone_zsched) before returning.
3522  */
3523 /*ARGSUSED*/
3524 kthread_t *
3525 zthread_create(
3526     caddr_t stk,
3527     size_t stksize,
3528     void (*proc)(),
3529     void *arg,
3530     size_t len,
3531     pri_t pri)
3532 {
3533         kthread_t *t;
3534         zone_t *zone = curproc->p_zone;
3535         proc_t *pp = zone->zone_zsched;
3536 
3537         zone_hold(zone);        /* Reference to be dropped when thread exits */
3538 
3539         /*
3540          * No-one should be trying to create threads if the zone is shutting
3541          * down and there aren't any kernel threads around.  See comment
3542          * in zthread_exit().
3543          */
3544         ASSERT(!(zone->zone_kthreads == NULL &&
3545             zone_status_get(zone) >= ZONE_IS_EMPTY));
3546         /*
3547          * Create a thread, but don't let it run until we've finished setting
3548          * things up.
3549          */
3550         t = thread_create(stk, stksize, proc, arg, len, pp, TS_STOPPED, pri);
3551         ASSERT(t->t_forw == NULL);
3552         mutex_enter(&zone_status_lock);
3553         if (zone->zone_kthreads == NULL) {
3554                 t->t_forw = t->t_back = t;
3555         } else {
3556                 kthread_t *tx = zone->zone_kthreads;
3557 
3558                 t->t_forw = tx;
3559                 t->t_back = tx->t_back;
3560                 tx->t_back->t_forw = t;
3561                 tx->t_back = t;
3562         }
3563         zone->zone_kthreads = t;
3564         mutex_exit(&zone_status_lock);
3565 
3566         mutex_enter(&pp->p_lock);
3567         t->t_proc_flag |= TP_ZTHREAD;
3568         project_rele(t->t_proj);
3569         t->t_proj = project_hold(pp->p_task->tk_proj);
3570 
3571         /*
3572          * Setup complete, let it run.
3573          */
3574         thread_lock(t);
3575         t->t_schedflag |= TS_ALLSTART;
3576         setrun_locked(t);
3577         thread_unlock(t);
3578 
3579         mutex_exit(&pp->p_lock);
3580 
3581         return (t);
3582 }
3583 
3584 /*
3585  * Similar to thread_exit().  Must be called by threads created via
3586  * zthread_exit().
3587  */
3588 void
3589 zthread_exit(void)
3590 {
3591         kthread_t *t = curthread;
3592         proc_t *pp = curproc;
3593         zone_t *zone = pp->p_zone;
3594 
3595         mutex_enter(&zone_status_lock);
3596 
3597         /*
3598          * Reparent to p0
3599          */
3600         kpreempt_disable();
3601         mutex_enter(&pp->p_lock);
3602         t->t_proc_flag &= ~TP_ZTHREAD;
3603         t->t_procp = &p0;
3604         hat_thread_exit(t);
3605         mutex_exit(&pp->p_lock);
3606         kpreempt_enable();
3607 
3608         if (t->t_back == t) {
3609                 ASSERT(t->t_forw == t);
3610                 /*
3611                  * If the zone is empty, once the thread count
3612                  * goes to zero no further kernel threads can be
3613                  * created.  This is because if the creator is a process
3614                  * in the zone, then it must have exited before the zone
3615                  * state could be set to ZONE_IS_EMPTY.
3616                  * Otherwise, if the creator is a kernel thread in the
3617                  * zone, the thread count is non-zero.
3618                  *
3619                  * This really means that non-zone kernel threads should
3620                  * not create zone kernel threads.
3621                  */
3622                 zone->zone_kthreads = NULL;
3623                 if (zone_status_get(zone) == ZONE_IS_EMPTY) {
3624                         zone_status_set(zone, ZONE_IS_DOWN);
3625                         /*
3626                          * Remove any CPU caps on this zone.
3627                          */
3628                         cpucaps_zone_remove(zone);
3629                 }
3630         } else {
3631                 t->t_forw->t_back = t->t_back;
3632                 t->t_back->t_forw = t->t_forw;
3633                 if (zone->zone_kthreads == t)
3634                         zone->zone_kthreads = t->t_forw;
3635         }
3636         mutex_exit(&zone_status_lock);
3637         zone_rele(zone);
3638         thread_exit();
3639         /* NOTREACHED */
3640 }
3641 
3642 static void
3643 zone_chdir(vnode_t *vp, vnode_t **vpp, proc_t *pp)
3644 {
3645         vnode_t *oldvp;
3646 
3647         /* we're going to hold a reference here to the directory */
3648         VN_HOLD(vp);
3649 
3650         /* update abs cwd/root path see c2/audit.c */
3651         if (AU_AUDITING())
3652                 audit_chdirec(vp, vpp);
3653 
3654         mutex_enter(&pp->p_lock);
3655         oldvp = *vpp;
3656         *vpp = vp;
3657         mutex_exit(&pp->p_lock);
3658         if (oldvp != NULL)
3659                 VN_RELE(oldvp);
3660 }
3661 
3662 /*
3663  * Convert an rctl value represented by an nvlist_t into an rctl_val_t.
3664  */
3665 static int
3666 nvlist2rctlval(nvlist_t *nvl, rctl_val_t *rv)
3667 {
3668         nvpair_t *nvp = NULL;
3669         boolean_t priv_set = B_FALSE;
3670         boolean_t limit_set = B_FALSE;
3671         boolean_t action_set = B_FALSE;
3672 
3673         while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
3674                 const char *name;
3675                 uint64_t ui64;
3676 
3677                 name = nvpair_name(nvp);
3678                 if (nvpair_type(nvp) != DATA_TYPE_UINT64)
3679                         return (EINVAL);
3680                 (void) nvpair_value_uint64(nvp, &ui64);
3681                 if (strcmp(name, "privilege") == 0) {
3682                         /*
3683                          * Currently only privileged values are allowed, but
3684                          * this may change in the future.
3685                          */
3686                         if (ui64 != RCPRIV_PRIVILEGED)
3687                                 return (EINVAL);
3688                         rv->rcv_privilege = ui64;
3689                         priv_set = B_TRUE;
3690                 } else if (strcmp(name, "limit") == 0) {
3691                         rv->rcv_value = ui64;
3692                         limit_set = B_TRUE;
3693                 } else if (strcmp(name, "action") == 0) {
3694                         if (ui64 != RCTL_LOCAL_NOACTION &&
3695                             ui64 != RCTL_LOCAL_DENY)
3696                                 return (EINVAL);
3697                         rv->rcv_flagaction = ui64;
3698                         action_set = B_TRUE;
3699                 } else {
3700                         return (EINVAL);
3701                 }
3702         }
3703 
3704         if (!(priv_set && limit_set && action_set))
3705                 return (EINVAL);
3706         rv->rcv_action_signal = 0;
3707         rv->rcv_action_recipient = NULL;
3708         rv->rcv_action_recip_pid = -1;
3709         rv->rcv_firing_time = 0;
3710 
3711         return (0);
3712 }
3713 
3714 /*
3715  * Non-global zone version of start_init.
3716  */
3717 void
3718 zone_start_init(void)
3719 {
3720         proc_t *p = ttoproc(curthread);
3721         zone_t *z = p->p_zone;
3722 
3723         ASSERT(!INGLOBALZONE(curproc));
3724 
3725         /*
3726          * For all purposes (ZONE_ATTR_INITPID and restart_init),
3727          * storing just the pid of init is sufficient.
3728          */
3729         z->zone_proc_initpid = p->p_pid;
3730 
3731         /*
3732          * We maintain zone_boot_err so that we can return the cause of the
3733          * failure back to the caller of the zone_boot syscall.
3734          */
3735         p->p_zone->zone_boot_err = start_init_common();
3736 
3737         /*
3738          * We will prevent booting zones from becoming running zones if the
3739          * global zone is shutting down.
3740          */
3741         mutex_enter(&zone_status_lock);
3742         if (z->zone_boot_err != 0 || zone_status_get(global_zone) >=
3743             ZONE_IS_SHUTTING_DOWN) {
3744                 /*
3745                  * Make sure we are still in the booting state-- we could have
3746                  * raced and already be shutting down, or even further along.
3747                  */
3748                 if (zone_status_get(z) == ZONE_IS_BOOTING) {
3749                         zone_status_set(z, ZONE_IS_SHUTTING_DOWN);
3750                 }
3751                 mutex_exit(&zone_status_lock);
3752                 /* It's gone bad, dispose of the process */
3753                 if (proc_exit(CLD_EXITED, z->zone_boot_err) != 0) {
3754                         mutex_enter(&p->p_lock);
3755                         ASSERT(p->p_flag & SEXITLWPS);
3756                         lwp_exit();
3757                 }
3758         } else {
3759                 if (zone_status_get(z) == ZONE_IS_BOOTING)
3760                         zone_status_set(z, ZONE_IS_RUNNING);
3761                 mutex_exit(&zone_status_lock);
3762                 /* cause the process to return to userland. */
3763                 lwp_rtt();
3764         }
3765 }
3766 
3767 struct zsched_arg {
3768         zone_t *zone;
3769         nvlist_t *nvlist;
3770 };
3771 
3772 /*
3773  * Per-zone "sched" workalike.  The similarity to "sched" doesn't have
3774  * anything to do with scheduling, but rather with the fact that
3775  * per-zone kernel threads are parented to zsched, just like regular
3776  * kernel threads are parented to sched (p0).
3777  *
3778  * zsched is also responsible for launching init for the zone.
3779  */
3780 static void
3781 zsched(void *arg)
3782 {
3783         struct zsched_arg *za = arg;
3784         proc_t *pp = curproc;
3785         proc_t *initp = proc_init;
3786         zone_t *zone = za->zone;
3787         cred_t *cr, *oldcred;
3788         rctl_set_t *set;
3789         rctl_alloc_gp_t *gp;
3790         contract_t *ct = NULL;
3791         task_t *tk, *oldtk;
3792         rctl_entity_p_t e;
3793         kproject_t *pj;
3794 
3795         nvlist_t *nvl = za->nvlist;
3796         nvpair_t *nvp = NULL;
3797 
3798         bcopy("zsched", PTOU(pp)->u_psargs, sizeof ("zsched"));
3799         bcopy("zsched", PTOU(pp)->u_comm, sizeof ("zsched"));
3800         PTOU(pp)->u_argc = 0;
3801         PTOU(pp)->u_argv = NULL;
3802         PTOU(pp)->u_envp = NULL;
3803         closeall(P_FINFO(pp));
3804 
3805         /*
3806          * We are this zone's "zsched" process.  As the zone isn't generally
3807          * visible yet we don't need to grab any locks before initializing its
3808          * zone_proc pointer.
3809          */
3810         zone_hold(zone);  /* this hold is released by zone_destroy() */
3811         zone->zone_zsched = pp;
3812         mutex_enter(&pp->p_lock);
3813         pp->p_zone = zone;
3814         mutex_exit(&pp->p_lock);
3815 
3816         /*
3817          * Disassociate process from its 'parent'; parent ourselves to init
3818          * (pid 1) and change other values as needed.
3819          */
3820         sess_create();
3821 
3822         mutex_enter(&pidlock);
3823         proc_detach(pp);
3824         pp->p_ppid = 1;
3825         pp->p_flag |= SZONETOP;
3826         pp->p_ancpid = 1;
3827         pp->p_parent = initp;
3828         pp->p_psibling = NULL;
3829         if (initp->p_child)
3830                 initp->p_child->p_psibling = pp;
3831         pp->p_sibling = initp->p_child;
3832         initp->p_child = pp;
3833 
3834         /* Decrement what newproc() incremented. */
3835         upcount_dec(crgetruid(CRED()), GLOBAL_ZONEID);
3836         /*
3837          * Our credentials are about to become kcred-like, so we don't care
3838          * about the caller's ruid.
3839          */
3840         upcount_inc(crgetruid(kcred), zone->zone_id);
3841         mutex_exit(&pidlock);
3842 
3843         /*
3844          * getting out of global zone, so decrement lwp and process counts
3845          */
3846         pj = pp->p_task->tk_proj;
3847         mutex_enter(&global_zone->zone_nlwps_lock);
3848         pj->kpj_nlwps -= pp->p_lwpcnt;
3849         global_zone->zone_nlwps -= pp->p_lwpcnt;
3850         pj->kpj_nprocs--;
3851         global_zone->zone_nprocs--;
3852         mutex_exit(&global_zone->zone_nlwps_lock);
3853 
3854         /*
3855          * Decrement locked memory counts on old zone and project.
3856          */
3857         mutex_enter(&global_zone->zone_mem_lock);
3858         global_zone->zone_locked_mem -= pp->p_locked_mem;
3859         pj->kpj_data.kpd_locked_mem -= pp->p_locked_mem;
3860         mutex_exit(&global_zone->zone_mem_lock);
3861 
3862         /*
3863          * Create and join a new task in project '0' of this zone.
3864          *
3865          * We don't need to call holdlwps() since we know we're the only lwp in
3866          * this process.
3867          *
3868          * task_join() returns with p_lock held.
3869          */
3870         tk = task_create(0, zone);
3871         mutex_enter(&cpu_lock);
3872         oldtk = task_join(tk, 0);
3873 
3874         pj = pp->p_task->tk_proj;
3875 
3876         mutex_enter(&zone->zone_mem_lock);
3877         zone->zone_locked_mem += pp->p_locked_mem;
3878         pj->kpj_data.kpd_locked_mem += pp->p_locked_mem;
3879         mutex_exit(&zone->zone_mem_lock);
3880 
3881         /*
3882          * add lwp and process counts to zsched's zone, and increment
3883          * project's task and process count due to the task created in
3884          * the above task_create.
3885          */
3886         mutex_enter(&zone->zone_nlwps_lock);
3887         pj->kpj_nlwps += pp->p_lwpcnt;
3888         pj->kpj_ntasks += 1;
3889         zone->zone_nlwps += pp->p_lwpcnt;
3890         pj->kpj_nprocs++;
3891         zone->zone_nprocs++;
3892         mutex_exit(&zone->zone_nlwps_lock);
3893 
3894         mutex_exit(&curproc->p_lock);
3895         mutex_exit(&cpu_lock);
3896         task_rele(oldtk);
3897 
3898         /*
3899          * The process was created by a process in the global zone, hence the
3900          * credentials are wrong.  We might as well have kcred-ish credentials.
3901          */
3902         cr = zone->zone_kcred;
3903         crhold(cr);
3904         mutex_enter(&pp->p_crlock);
3905         oldcred = pp->p_cred;
3906         pp->p_cred = cr;
3907         mutex_exit(&pp->p_crlock);
3908         crfree(oldcred);
3909 
3910         /*
3911          * Hold credentials again (for thread)
3912          */
3913         crhold(cr);
3914 
3915         /*
3916          * p_lwpcnt can't change since this is a kernel process.
3917          */
3918         crset(pp, cr);
3919 
3920         /*
3921          * Chroot
3922          */
3923         zone_chdir(zone->zone_rootvp, &PTOU(pp)->u_cdir, pp);
3924         zone_chdir(zone->zone_rootvp, &PTOU(pp)->u_rdir, pp);
3925 
3926         /*
3927          * Initialize zone's rctl set.
3928          */
3929         set = rctl_set_create();
3930         gp = rctl_set_init_prealloc(RCENTITY_ZONE);
3931         mutex_enter(&pp->p_lock);
3932         e.rcep_p.zone = zone;
3933         e.rcep_t = RCENTITY_ZONE;
3934         zone->zone_rctls = rctl_set_init(RCENTITY_ZONE, pp, &e, set, gp);
3935         mutex_exit(&pp->p_lock);
3936         rctl_prealloc_destroy(gp);
3937 
3938         /*
3939          * Apply the rctls passed in to zone_create().  This is basically a list
3940          * assignment: all of the old values are removed and the new ones
3941          * inserted.  That is, if an empty list is passed in, all values are
3942          * removed.
3943          */
3944         while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
3945                 rctl_dict_entry_t *rde;
3946                 rctl_hndl_t hndl;
3947                 char *name;
3948                 nvlist_t **nvlarray;
3949                 uint_t i, nelem;
3950                 int error;      /* For ASSERT()s */
3951 
3952                 name = nvpair_name(nvp);
3953                 hndl = rctl_hndl_lookup(name);
3954                 ASSERT(hndl != -1);
3955                 rde = rctl_dict_lookup_hndl(hndl);
3956                 ASSERT(rde != NULL);
3957 
3958                 for (; /* ever */; ) {
3959                         rctl_val_t oval;
3960 
3961                         mutex_enter(&pp->p_lock);
3962                         error = rctl_local_get(hndl, NULL, &oval, pp);
3963                         mutex_exit(&pp->p_lock);
3964                         ASSERT(error == 0);     /* Can't fail for RCTL_FIRST */
3965                         ASSERT(oval.rcv_privilege != RCPRIV_BASIC);
3966                         if (oval.rcv_privilege == RCPRIV_SYSTEM)
3967                                 break;
3968                         mutex_enter(&pp->p_lock);
3969                         error = rctl_local_delete(hndl, &oval, pp);
3970                         mutex_exit(&pp->p_lock);
3971                         ASSERT(error == 0);
3972                 }
3973                 error = nvpair_value_nvlist_array(nvp, &nvlarray, &nelem);
3974                 ASSERT(error == 0);
3975                 for (i = 0; i < nelem; i++) {
3976                         rctl_val_t *nvalp;
3977 
3978                         nvalp = kmem_cache_alloc(rctl_val_cache, KM_SLEEP);
3979                         error = nvlist2rctlval(nvlarray[i], nvalp);
3980                         ASSERT(error == 0);
3981                         /*
3982                          * rctl_local_insert can fail if the value being
3983                          * inserted is a duplicate; this is OK.
3984                          */
3985                         mutex_enter(&pp->p_lock);
3986                         if (rctl_local_insert(hndl, nvalp, pp) != 0)
3987                                 kmem_cache_free(rctl_val_cache, nvalp);
3988                         mutex_exit(&pp->p_lock);
3989                 }
3990         }
3991         /*
3992          * Tell the world that we're done setting up.
3993          *
3994          * At this point we want to set the zone status to ZONE_IS_INITIALIZED
3995          * and atomically set the zone's processor set visibility.  Once
3996          * we drop pool_lock() this zone will automatically get updated
3997          * to reflect any future changes to the pools configuration.
3998          *
3999          * Note that after we drop the locks below (zonehash_lock in
4000          * particular) other operations such as a zone_getattr call can
4001          * now proceed and observe the zone. That is the reason for doing a
4002          * state transition to the INITIALIZED state.
4003          */
4004         pool_lock();
4005         mutex_enter(&cpu_lock);
4006         mutex_enter(&zonehash_lock);
4007         zone_uniqid(zone);
4008         zone_zsd_configure(zone);
4009         if (pool_state == POOL_ENABLED)
4010                 zone_pset_set(zone, pool_default->pool_pset->pset_id);
4011         mutex_enter(&zone_status_lock);
4012         ASSERT(zone_status_get(zone) == ZONE_IS_UNINITIALIZED);
4013         zone_status_set(zone, ZONE_IS_INITIALIZED);
4014         mutex_exit(&zone_status_lock);
4015         mutex_exit(&zonehash_lock);
4016         mutex_exit(&cpu_lock);
4017         pool_unlock();
4018 
4019         /* Now call the create callback for this key */
4020         zsd_apply_all_keys(zsd_apply_create, zone);
4021 
4022         /* The callbacks are complete. Mark ZONE_IS_READY */
4023         mutex_enter(&zone_status_lock);
4024         ASSERT(zone_status_get(zone) == ZONE_IS_INITIALIZED);
4025         zone_status_set(zone, ZONE_IS_READY);
4026         mutex_exit(&zone_status_lock);
4027 
4028         /*
4029          * Once we see the zone transition to the ZONE_IS_BOOTING state,
4030          * we launch init, and set the state to running.
4031          */
4032         zone_status_wait_cpr(zone, ZONE_IS_BOOTING, "zsched");
4033 
4034         if (zone_status_get(zone) == ZONE_IS_BOOTING) {
4035                 id_t cid;
4036 
4037                 /*
4038                  * Ok, this is a little complicated.  We need to grab the
4039                  * zone's pool's scheduling class ID; note that by now, we
4040                  * are already bound to a pool if we need to be (zoneadmd
4041                  * will have done that to us while we're in the READY
4042                  * state).  *But* the scheduling class for the zone's 'init'
4043                  * must be explicitly passed to newproc, which doesn't
4044                  * respect pool bindings.
4045                  *
4046                  * We hold the pool_lock across the call to newproc() to
4047                  * close the obvious race: the pool's scheduling class
4048                  * could change before we manage to create the LWP with
4049                  * classid 'cid'.
4050                  */
4051                 pool_lock();
4052                 if (zone->zone_defaultcid > 0)
4053                         cid = zone->zone_defaultcid;
4054                 else
4055                         cid = pool_get_class(zone->zone_pool);
4056                 if (cid == -1)
4057                         cid = defaultcid;
4058 
4059                 /*
4060                  * If this fails, zone_boot will ultimately fail.  The
4061                  * state of the zone will be set to SHUTTING_DOWN-- userland
4062                  * will have to tear down the zone, and fail, or try again.
4063                  */
4064                 if ((zone->zone_boot_err = newproc(zone_start_init, NULL, cid,
4065                     minclsyspri - 1, &ct, 0)) != 0) {
4066                         mutex_enter(&zone_status_lock);
4067                         zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
4068                         mutex_exit(&zone_status_lock);
4069                 } else {
4070                         zone->zone_boot_time = gethrestime_sec();
4071                 }
4072 
4073                 pool_unlock();
4074         }
4075 
4076         /*
4077          * Wait for zone_destroy() to be called.  This is what we spend
4078          * most of our life doing.
4079          */
4080         zone_status_wait_cpr(zone, ZONE_IS_DYING, "zsched");
4081 
4082         if (ct)
4083                 /*
4084                  * At this point the process contract should be empty.
4085                  * (Though if it isn't, it's not the end of the world.)
4086                  */
4087                 VERIFY(contract_abandon(ct, curproc, B_TRUE) == 0);
4088 
4089         /*
4090          * Allow kcred to be freed when all referring processes
4091          * (including this one) go away.  We can't just do this in
4092          * zone_free because we need to wait for the zone_cred_ref to
4093          * drop to 0 before calling zone_free, and the existence of
4094          * zone_kcred will prevent that.  Thus, we call crfree here to
4095          * balance the crdup in zone_create.  The crhold calls earlier
4096          * in zsched will be dropped when the thread and process exit.
4097          */
4098         crfree(zone->zone_kcred);
4099         zone->zone_kcred = NULL;
4100 
4101         exit(CLD_EXITED, 0);
4102 }
4103 
4104 /*
4105  * Helper function to determine if there are any submounts of the
4106  * provided path.  Used to make sure the zone doesn't "inherit" any
4107  * mounts from before it is created.
4108  */
4109 static uint_t
4110 zone_mount_count(const char *rootpath)
4111 {
4112         vfs_t *vfsp;
4113         uint_t count = 0;
4114         size_t rootpathlen = strlen(rootpath);
4115 
4116         /*
4117          * Holding zonehash_lock prevents race conditions with
4118          * vfs_list_add()/vfs_list_remove() since we serialize with
4119          * zone_find_by_path().
4120          */
4121         ASSERT(MUTEX_HELD(&zonehash_lock));
4122         /*
4123          * The rootpath must end with a '/'
4124          */
4125         ASSERT(rootpath[rootpathlen - 1] == '/');
4126 
4127         /*
4128          * This intentionally does not count the rootpath itself if that
4129          * happens to be a mount point.
4130          */
4131         vfs_list_read_lock();
4132         vfsp = rootvfs;
4133         do {
4134                 if (strncmp(rootpath, refstr_value(vfsp->vfs_mntpt),
4135                     rootpathlen) == 0)
4136                         count++;
4137                 vfsp = vfsp->vfs_next;
4138         } while (vfsp != rootvfs);
4139         vfs_list_unlock();
4140         return (count);
4141 }
4142 
4143 /*
4144  * Helper function to make sure that a zone created on 'rootpath'
4145  * wouldn't end up containing other zones' rootpaths.
4146  */
4147 static boolean_t
4148 zone_is_nested(const char *rootpath)
4149 {
4150         zone_t *zone;
4151         size_t rootpathlen = strlen(rootpath);
4152         size_t len;
4153 
4154         ASSERT(MUTEX_HELD(&zonehash_lock));
4155 
4156         /*
4157          * zone_set_root() appended '/' and '\0' at the end of rootpath
4158          */
4159         if ((rootpathlen <= 3) && (rootpath[0] == '/') &&
4160             (rootpath[1] == '/') && (rootpath[2] == '\0'))
4161                 return (B_TRUE);
4162 
4163         for (zone = list_head(&zone_active); zone != NULL;
4164             zone = list_next(&zone_active, zone)) {
4165                 if (zone == global_zone)
4166                         continue;
4167                 len = strlen(zone->zone_rootpath);
4168                 if (strncmp(rootpath, zone->zone_rootpath,
4169                     MIN(rootpathlen, len)) == 0)
4170                         return (B_TRUE);
4171         }
4172         return (B_FALSE);
4173 }
4174 
4175 static int
4176 zone_set_privset(zone_t *zone, const priv_set_t *zone_privs,
4177     size_t zone_privssz)
4178 {
4179         priv_set_t *privs;
4180 
4181         if (zone_privssz < sizeof (priv_set_t))
4182                 return (ENOMEM);
4183 
4184         privs = kmem_alloc(sizeof (priv_set_t), KM_SLEEP);
4185 
4186         if (copyin(zone_privs, privs, sizeof (priv_set_t))) {
4187                 kmem_free(privs, sizeof (priv_set_t));
4188                 return (EFAULT);
4189         }
4190 
4191         zone->zone_privset = privs;
4192         return (0);
4193 }
4194 
4195 /*
4196  * We make creative use of nvlists to pass in rctls from userland.  The list is
4197  * a list of the following structures:
4198  *
4199  * (name = rctl_name, value = nvpair_list_array)
4200  *
4201  * Where each element of the nvpair_list_array is of the form:
4202  *
4203  * [(name = "privilege", value = RCPRIV_PRIVILEGED),
4204  *      (name = "limit", value = uint64_t),
4205  *      (name = "action", value = (RCTL_LOCAL_NOACTION || RCTL_LOCAL_DENY))]
4206  */
4207 static int
4208 parse_rctls(caddr_t ubuf, size_t buflen, nvlist_t **nvlp)
4209 {
4210         nvpair_t *nvp = NULL;
4211         nvlist_t *nvl = NULL;
4212         char *kbuf;
4213         int error;
4214         rctl_val_t rv;
4215 
4216         *nvlp = NULL;
4217 
4218         if (buflen == 0)
4219                 return (0);
4220 
4221         if ((kbuf = kmem_alloc(buflen, KM_NOSLEEP)) == NULL)
4222                 return (ENOMEM);
4223         if (copyin(ubuf, kbuf, buflen)) {
4224                 error = EFAULT;
4225                 goto out;
4226         }
4227         if (nvlist_unpack(kbuf, buflen, &nvl, KM_SLEEP) != 0) {
4228                 /*
4229                  * nvl may have been allocated/free'd, but the value set to
4230                  * non-NULL, so we reset it here.
4231                  */
4232                 nvl = NULL;
4233                 error = EINVAL;
4234                 goto out;
4235         }
4236         while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
4237                 rctl_dict_entry_t *rde;
4238                 rctl_hndl_t hndl;
4239                 nvlist_t **nvlarray;
4240                 uint_t i, nelem;
4241                 char *name;
4242 
4243                 error = EINVAL;
4244                 name = nvpair_name(nvp);
4245                 if (strncmp(nvpair_name(nvp), "zone.", sizeof ("zone.") - 1)
4246                     != 0 || nvpair_type(nvp) != DATA_TYPE_NVLIST_ARRAY) {
4247                         goto out;
4248                 }
4249                 if ((hndl = rctl_hndl_lookup(name)) == -1) {
4250                         goto out;
4251                 }
4252                 rde = rctl_dict_lookup_hndl(hndl);
4253                 error = nvpair_value_nvlist_array(nvp, &nvlarray, &nelem);
4254                 ASSERT(error == 0);
4255                 for (i = 0; i < nelem; i++) {
4256                         if (error = nvlist2rctlval(nvlarray[i], &rv))
4257                                 goto out;
4258                 }
4259                 if (rctl_invalid_value(rde, &rv)) {
4260                         error = EINVAL;
4261                         goto out;
4262                 }
4263         }
4264         error = 0;
4265         *nvlp = nvl;
4266 out:
4267         kmem_free(kbuf, buflen);
4268         if (error && nvl != NULL)
4269                 nvlist_free(nvl);
4270         return (error);
4271 }
4272 
4273 int
4274 zone_create_error(int er_error, int er_ext, int *er_out) {
4275         if (er_out != NULL) {
4276                 if (copyout(&er_ext, er_out, sizeof (int))) {
4277                         return (set_errno(EFAULT));
4278                 }
4279         }
4280         return (set_errno(er_error));
4281 }
4282 
4283 static int
4284 zone_set_label(zone_t *zone, const bslabel_t *lab, uint32_t doi)
4285 {
4286         ts_label_t *tsl;
4287         bslabel_t blab;
4288 
4289         /* Get label from user */
4290         if (copyin(lab, &blab, sizeof (blab)) != 0)
4291                 return (EFAULT);
4292         tsl = labelalloc(&blab, doi, KM_NOSLEEP);
4293         if (tsl == NULL)
4294                 return (ENOMEM);
4295 
4296         zone->zone_slabel = tsl;
4297         return (0);
4298 }
4299 
4300 /*
4301  * Parses a comma-separated list of ZFS datasets into a per-zone dictionary.
4302  */
4303 static int
4304 parse_zfs(zone_t *zone, caddr_t ubuf, size_t buflen)
4305 {
4306         char *kbuf;
4307         char *dataset, *next;
4308         zone_dataset_t *zd;
4309         size_t len;
4310 
4311         if (ubuf == NULL || buflen == 0)
4312                 return (0);
4313 
4314         if ((kbuf = kmem_alloc(buflen, KM_NOSLEEP)) == NULL)
4315                 return (ENOMEM);
4316 
4317         if (copyin(ubuf, kbuf, buflen) != 0) {
4318                 kmem_free(kbuf, buflen);
4319                 return (EFAULT);
4320         }
4321 
4322         dataset = next = kbuf;
4323         for (;;) {
4324                 zd = kmem_alloc(sizeof (zone_dataset_t), KM_SLEEP);
4325 
4326                 next = strchr(dataset, ',');
4327 
4328                 if (next == NULL)
4329                         len = strlen(dataset);
4330                 else
4331                         len = next - dataset;
4332 
4333                 zd->zd_dataset = kmem_alloc(len + 1, KM_SLEEP);
4334                 bcopy(dataset, zd->zd_dataset, len);
4335                 zd->zd_dataset[len] = '\0';
4336 
4337                 list_insert_head(&zone->zone_datasets, zd);
4338 
4339                 if (next == NULL)
4340                         break;
4341 
4342                 dataset = next + 1;
4343         }
4344 
4345         kmem_free(kbuf, buflen);
4346         return (0);
4347 }
4348 
4349 /*
4350  * System call to create/initialize a new zone named 'zone_name', rooted
4351  * at 'zone_root', with a zone-wide privilege limit set of 'zone_privs',
4352  * and initialized with the zone-wide rctls described in 'rctlbuf', and
4353  * with labeling set by 'match', 'doi', and 'label'.
4354  *
4355  * If extended error is non-null, we may use it to return more detailed
4356  * error information.
4357  */
4358 static zoneid_t
4359 zone_create(const char *zone_name, const char *zone_root,
4360     const priv_set_t *zone_privs, size_t zone_privssz,
4361     caddr_t rctlbuf, size_t rctlbufsz,
4362     caddr_t zfsbuf, size_t zfsbufsz, int *extended_error,
4363     int match, uint32_t doi, const bslabel_t *label,
4364     int flags)
4365 {
4366         struct zsched_arg zarg;
4367         nvlist_t *rctls = NULL;
4368         proc_t *pp = curproc;
4369         zone_t *zone, *ztmp;
4370         zoneid_t zoneid;
4371         int error;
4372         int error2 = 0;
4373         char *str;
4374         cred_t *zkcr;
4375         boolean_t insert_label_hash;
4376 
4377         if (secpolicy_zone_config(CRED()) != 0)
4378                 return (set_errno(EPERM));
4379 
4380         /* can't boot zone from within chroot environment */
4381         if (PTOU(pp)->u_rdir != NULL && PTOU(pp)->u_rdir != rootdir)
4382                 return (zone_create_error(ENOTSUP, ZE_CHROOTED,
4383                     extended_error));
4384 
4385         zone = kmem_zalloc(sizeof (zone_t), KM_SLEEP);
4386         zoneid = zone->zone_id = id_alloc(zoneid_space);
4387         zone->zone_status = ZONE_IS_UNINITIALIZED;
4388         zone->zone_pool = pool_default;
4389         zone->zone_pool_mod = gethrtime();
4390         zone->zone_psetid = ZONE_PS_INVAL;
4391         zone->zone_ncpus = 0;
4392         zone->zone_ncpus_online = 0;
4393         zone->zone_restart_init = B_TRUE;
4394         zone->zone_brand = &native_brand;
4395         zone->zone_initname = NULL;
4396         mutex_init(&zone->zone_lock, NULL, MUTEX_DEFAULT, NULL);
4397         mutex_init(&zone->zone_nlwps_lock, NULL, MUTEX_DEFAULT, NULL);
4398         mutex_init(&zone->zone_mem_lock, NULL, MUTEX_DEFAULT, NULL);
4399         cv_init(&zone->zone_cv, NULL, CV_DEFAULT, NULL);
4400         list_create(&zone->zone_ref_list, sizeof (zone_ref_t),
4401             offsetof(zone_ref_t, zref_linkage));
4402         list_create(&zone->zone_zsd, sizeof (struct zsd_entry),
4403             offsetof(struct zsd_entry, zsd_linkage));
4404         list_create(&zone->zone_datasets, sizeof (zone_dataset_t),
4405             offsetof(zone_dataset_t, zd_linkage));
4406         list_create(&zone->zone_dl_list, sizeof (zone_dl_t),
4407             offsetof(zone_dl_t, zdl_linkage));
4408         rw_init(&zone->zone_mlps.mlpl_rwlock, NULL, RW_DEFAULT, NULL);
4409         rw_init(&zone->zone_mntfs_db_lock, NULL, RW_DEFAULT, NULL);
4410 
4411         if (flags & ZCF_NET_EXCL) {
4412                 zone->zone_flags |= ZF_NET_EXCL;
4413         }
4414 
4415         if ((error = zone_set_name(zone, zone_name)) != 0) {
4416                 zone_free(zone);
4417                 return (zone_create_error(error, 0, extended_error));
4418         }
4419 
4420         if ((error = zone_set_root(zone, zone_root)) != 0) {
4421                 zone_free(zone);
4422                 return (zone_create_error(error, 0, extended_error));
4423         }
4424         if ((error = zone_set_privset(zone, zone_privs, zone_privssz)) != 0) {
4425                 zone_free(zone);
4426                 return (zone_create_error(error, 0, extended_error));
4427         }
4428 
4429         /* initialize node name to be the same as zone name */
4430         zone->zone_nodename = kmem_alloc(_SYS_NMLN, KM_SLEEP);
4431         (void) strncpy(zone->zone_nodename, zone->zone_name, _SYS_NMLN);
4432         zone->zone_nodename[_SYS_NMLN - 1] = '\0';
4433 
4434         zone->zone_domain = kmem_alloc(_SYS_NMLN, KM_SLEEP);
4435         zone->zone_domain[0] = '\0';
4436         zone->zone_hostid = HW_INVALID_HOSTID;
4437         zone->zone_shares = 1;
4438         zone->zone_shmmax = 0;
4439         zone->zone_ipc.ipcq_shmmni = 0;
4440         zone->zone_ipc.ipcq_semmni = 0;
4441         zone->zone_ipc.ipcq_msgmni = 0;
4442         zone->zone_bootargs = NULL;
4443         zone->zone_fs_allowed = NULL;
4444         zone->zone_initname =
4445             kmem_alloc(strlen(zone_default_initname) + 1, KM_SLEEP);
4446         (void) strcpy(zone->zone_initname, zone_default_initname);
4447         zone->zone_nlwps = 0;
4448         zone->zone_nlwps_ctl = INT_MAX;
4449         zone->zone_nprocs = 0;
4450         zone->zone_nprocs_ctl = INT_MAX;
4451         zone->zone_locked_mem = 0;
4452         zone->zone_locked_mem_ctl = UINT64_MAX;
4453         zone->zone_max_swap = 0;
4454         zone->zone_max_swap_ctl = UINT64_MAX;
4455         zone->zone_max_lofi = 0;
4456         zone->zone_max_lofi_ctl = UINT64_MAX;
4457         zone0.zone_lockedmem_kstat = NULL;
4458         zone0.zone_swapresv_kstat = NULL;
4459 
4460         /*
4461          * Zsched initializes the rctls.
4462          */
4463         zone->zone_rctls = NULL;
4464 
4465         if ((error = parse_rctls(rctlbuf, rctlbufsz, &rctls)) != 0) {
4466                 zone_free(zone);
4467                 return (zone_create_error(error, 0, extended_error));
4468         }
4469 
4470         if ((error = parse_zfs(zone, zfsbuf, zfsbufsz)) != 0) {
4471                 zone_free(zone);
4472                 return (set_errno(error));
4473         }
4474 
4475         /*
4476          * Read in the trusted system parameters:
4477          * match flag and sensitivity label.
4478          */
4479         zone->zone_match = match;
4480         if (is_system_labeled() && !(zone->zone_flags & ZF_IS_SCRATCH)) {
4481                 /* Fail if requested to set doi to anything but system's doi */
4482                 if (doi != 0 && doi != default_doi) {
4483                         zone_free(zone);
4484                         return (set_errno(EINVAL));
4485                 }
4486                 /* Always apply system's doi to the zone */
4487                 error = zone_set_label(zone, label, default_doi);
4488                 if (error != 0) {
4489                         zone_free(zone);
4490                         return (set_errno(error));
4491                 }
4492                 insert_label_hash = B_TRUE;
4493         } else {
4494                 /* all zones get an admin_low label if system is not labeled */
4495                 zone->zone_slabel = l_admin_low;
4496                 label_hold(l_admin_low);
4497                 insert_label_hash = B_FALSE;
4498         }
4499 
4500         /*
4501          * Stop all lwps since that's what normally happens as part of fork().
4502          * This needs to happen before we grab any locks to avoid deadlock
4503          * (another lwp in the process could be waiting for the held lock).
4504          */
4505         if (curthread != pp->p_agenttp && !holdlwps(SHOLDFORK)) {
4506                 zone_free(zone);
4507                 nvlist_free(rctls);
4508                 return (zone_create_error(error, 0, extended_error));
4509         }
4510 
4511         if (block_mounts(zone) == 0) {
4512                 mutex_enter(&pp->p_lock);
4513                 if (curthread != pp->p_agenttp)
4514                         continuelwps(pp);
4515                 mutex_exit(&pp->p_lock);
4516                 zone_free(zone);
4517                 nvlist_free(rctls);
4518                 return (zone_create_error(error, 0, extended_error));
4519         }
4520 
4521         /*
4522          * Set up credential for kernel access.  After this, any errors
4523          * should go through the dance in errout rather than calling
4524          * zone_free directly.
4525          */
4526         zone->zone_kcred = crdup(kcred);
4527         crsetzone(zone->zone_kcred, zone);
4528         priv_intersect(zone->zone_privset, &CR_PPRIV(zone->zone_kcred));
4529         priv_intersect(zone->zone_privset, &CR_EPRIV(zone->zone_kcred));
4530         priv_intersect(zone->zone_privset, &CR_IPRIV(zone->zone_kcred));
4531         priv_intersect(zone->zone_privset, &CR_LPRIV(zone->zone_kcred));
4532 
4533         mutex_enter(&zonehash_lock);
4534         /*
4535          * Make sure zone doesn't already exist.
4536          *
4537          * If the system and zone are labeled,
4538          * make sure no other zone exists that has the same label.
4539          */
4540         if ((ztmp = zone_find_all_by_name(zone->zone_name)) != NULL ||
4541             (insert_label_hash &&
4542             (ztmp = zone_find_all_by_label(zone->zone_slabel)) != NULL)) {
4543                 zone_status_t status;
4544 
4545                 status = zone_status_get(ztmp);
4546                 if (status == ZONE_IS_READY || status == ZONE_IS_RUNNING)
4547                         error = EEXIST;
4548                 else
4549                         error = EBUSY;
4550 
4551                 if (insert_label_hash)
4552                         error2 = ZE_LABELINUSE;
4553 
4554                 goto errout;
4555         }
4556 
4557         /*
4558          * Don't allow zone creations which would cause one zone's rootpath to
4559          * be accessible from that of another (non-global) zone.
4560          */
4561         if (zone_is_nested(zone->zone_rootpath)) {
4562                 error = EBUSY;
4563                 goto errout;
4564         }
4565 
4566         ASSERT(zonecount != 0);         /* check for leaks */
4567         if (zonecount + 1 > maxzones) {
4568                 error = ENOMEM;
4569                 goto errout;
4570         }
4571 
4572         if (zone_mount_count(zone->zone_rootpath) != 0) {
4573                 error = EBUSY;
4574                 error2 = ZE_AREMOUNTS;
4575                 goto errout;
4576         }
4577 
4578         /*
4579          * Zone is still incomplete, but we need to drop all locks while
4580          * zsched() initializes this zone's kernel process.  We
4581          * optimistically add the zone to the hashtable and associated
4582          * lists so a parallel zone_create() doesn't try to create the
4583          * same zone.
4584          */
4585         zonecount++;
4586         (void) mod_hash_insert(zonehashbyid,
4587             (mod_hash_key_t)(uintptr_t)zone->zone_id,
4588             (mod_hash_val_t)(uintptr_t)zone);
4589         str = kmem_alloc(strlen(zone->zone_name) + 1, KM_SLEEP);
4590         (void) strcpy(str, zone->zone_name);
4591         (void) mod_hash_insert(zonehashbyname, (mod_hash_key_t)str,
4592             (mod_hash_val_t)(uintptr_t)zone);
4593         if (insert_label_hash) {
4594                 (void) mod_hash_insert(zonehashbylabel,
4595                     (mod_hash_key_t)zone->zone_slabel, (mod_hash_val_t)zone);
4596                 zone->zone_flags |= ZF_HASHED_LABEL;
4597         }
4598 
4599         /*
4600          * Insert into active list.  At this point there are no 'hold's
4601          * on the zone, but everyone else knows not to use it, so we can
4602          * continue to use it.  zsched() will do a zone_hold() if the
4603          * newproc() is successful.
4604          */
4605         list_insert_tail(&zone_active, zone);
4606         mutex_exit(&zonehash_lock);
4607 
4608         zarg.zone = zone;
4609         zarg.nvlist = rctls;
4610         /*
4611          * The process, task, and project rctls are probably wrong;
4612          * we need an interface to get the default values of all rctls,
4613          * and initialize zsched appropriately.  I'm not sure that that
4614          * makes much of a difference, though.
4615          */
4616         error = newproc(zsched, (void *)&zarg, syscid, minclsyspri, NULL, 0);
4617         if (error != 0) {
4618                 /*
4619                  * We need to undo all globally visible state.
4620                  */
4621                 mutex_enter(&zonehash_lock);
4622                 list_remove(&zone_active, zone);
4623                 if (zone->zone_flags & ZF_HASHED_LABEL) {
4624                         ASSERT(zone->zone_slabel != NULL);
4625                         (void) mod_hash_destroy(zonehashbylabel,
4626                             (mod_hash_key_t)zone->zone_slabel);
4627                 }
4628                 (void) mod_hash_destroy(zonehashbyname,
4629                     (mod_hash_key_t)(uintptr_t)zone->zone_name);
4630                 (void) mod_hash_destroy(zonehashbyid,
4631                     (mod_hash_key_t)(uintptr_t)zone->zone_id);
4632                 ASSERT(zonecount > 1);
4633                 zonecount--;
4634                 goto errout;
4635         }
4636 
4637         /*
4638          * Zone creation can't fail from now on.
4639          */
4640 
4641         /*
4642          * Create zone kstats
4643          */
4644         zone_kstat_create(zone);
4645 
4646         /*
4647          * Let the other lwps continue.
4648          */
4649         mutex_enter(&pp->p_lock);
4650         if (curthread != pp->p_agenttp)
4651                 continuelwps(pp);
4652         mutex_exit(&pp->p_lock);
4653 
4654         /*
4655          * Wait for zsched to finish initializing the zone.
4656          */
4657         zone_status_wait(zone, ZONE_IS_READY);
4658         /*
4659          * The zone is fully visible, so we can let mounts progress.
4660          */
4661         resume_mounts(zone);
4662         nvlist_free(rctls);
4663 
4664         return (zoneid);
4665 
4666 errout:
4667         mutex_exit(&zonehash_lock);
4668         /*
4669          * Let the other lwps continue.
4670          */
4671         mutex_enter(&pp->p_lock);
4672         if (curthread != pp->p_agenttp)
4673                 continuelwps(pp);
4674         mutex_exit(&pp->p_lock);
4675 
4676         resume_mounts(zone);
4677         nvlist_free(rctls);
4678         /*
4679          * There is currently one reference to the zone, a cred_ref from
4680          * zone_kcred.  To free the zone, we call crfree, which will call
4681          * zone_cred_rele, which will call zone_free.
4682          */
4683         ASSERT(zone->zone_cred_ref == 1);
4684         ASSERT(zone->zone_kcred->cr_ref == 1);
4685         ASSERT(zone->zone_ref == 0);
4686         zkcr = zone->zone_kcred;
4687         zone->zone_kcred = NULL;
4688         crfree(zkcr);                           /* triggers call to zone_free */
4689         return (zone_create_error(error, error2, extended_error));
4690 }
4691 
4692 /*
4693  * Cause the zone to boot.  This is pretty simple, since we let zoneadmd do
4694  * the heavy lifting.  initname is the path to the program to launch
4695  * at the "top" of the zone; if this is NULL, we use the system default,
4696  * which is stored at zone_default_initname.
4697  */
4698 static int
4699 zone_boot(zoneid_t zoneid)
4700 {
4701         int err;
4702         zone_t *zone;
4703 
4704         if (secpolicy_zone_config(CRED()) != 0)
4705                 return (set_errno(EPERM));
4706         if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
4707                 return (set_errno(EINVAL));
4708 
4709         mutex_enter(&zonehash_lock);
4710         /*
4711          * Look for zone under hash lock to prevent races with calls to
4712          * zone_shutdown, zone_destroy, etc.
4713          */
4714         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
4715                 mutex_exit(&zonehash_lock);
4716                 return (set_errno(EINVAL));
4717         }
4718 
4719         mutex_enter(&zone_status_lock);
4720         if (zone_status_get(zone) != ZONE_IS_READY) {
4721                 mutex_exit(&zone_status_lock);
4722                 mutex_exit(&zonehash_lock);
4723                 return (set_errno(EINVAL));
4724         }
4725         zone_status_set(zone, ZONE_IS_BOOTING);
4726         mutex_exit(&zone_status_lock);
4727 
4728         zone_hold(zone);        /* so we can use the zone_t later */
4729         mutex_exit(&zonehash_lock);
4730 
4731         if (zone_status_wait_sig(zone, ZONE_IS_RUNNING) == 0) {
4732                 zone_rele(zone);
4733                 return (set_errno(EINTR));
4734         }
4735 
4736         /*
4737          * Boot (starting init) might have failed, in which case the zone
4738          * will go to the SHUTTING_DOWN state; an appropriate errno will
4739          * be placed in zone->zone_boot_err, and so we return that.
4740          */
4741         err = zone->zone_boot_err;
4742         zone_rele(zone);
4743         return (err ? set_errno(err) : 0);
4744 }
4745 
4746 /*
4747  * Kills all user processes in the zone, waiting for them all to exit
4748  * before returning.
4749  */
4750 static int
4751 zone_empty(zone_t *zone)
4752 {
4753         int waitstatus;
4754 
4755         /*
4756          * We need to drop zonehash_lock before killing all
4757          * processes, otherwise we'll deadlock with zone_find_*
4758          * which can be called from the exit path.
4759          */
4760         ASSERT(MUTEX_NOT_HELD(&zonehash_lock));
4761         while ((waitstatus = zone_status_timedwait_sig(zone,
4762             ddi_get_lbolt() + hz, ZONE_IS_EMPTY)) == -1) {
4763                 killall(zone->zone_id);
4764         }
4765         /*
4766          * return EINTR if we were signaled
4767          */
4768         if (waitstatus == 0)
4769                 return (EINTR);
4770         return (0);
4771 }
4772 
4773 /*
4774  * This function implements the policy for zone visibility.
4775  *
4776  * In standard Solaris, a non-global zone can only see itself.
4777  *
4778  * In Trusted Extensions, a labeled zone can lookup any zone whose label
4779  * it dominates. For this test, the label of the global zone is treated as
4780  * admin_high so it is special-cased instead of being checked for dominance.
4781  *
4782  * Returns true if zone attributes are viewable, false otherwise.
4783  */
4784 static boolean_t
4785 zone_list_access(zone_t *zone)
4786 {
4787 
4788         if (curproc->p_zone == global_zone ||
4789             curproc->p_zone == zone) {
4790                 return (B_TRUE);
4791         } else if (is_system_labeled() && !(zone->zone_flags & ZF_IS_SCRATCH)) {
4792                 bslabel_t *curproc_label;
4793                 bslabel_t *zone_label;
4794 
4795                 curproc_label = label2bslabel(curproc->p_zone->zone_slabel);
4796                 zone_label = label2bslabel(zone->zone_slabel);
4797 
4798                 if (zone->zone_id != GLOBAL_ZONEID &&
4799                     bldominates(curproc_label, zone_label)) {
4800                         return (B_TRUE);
4801                 } else {
4802                         return (B_FALSE);
4803                 }
4804         } else {
4805                 return (B_FALSE);
4806         }
4807 }
4808 
4809 /*
4810  * Systemcall to start the zone's halt sequence.  By the time this
4811  * function successfully returns, all user processes and kernel threads
4812  * executing in it will have exited, ZSD shutdown callbacks executed,
4813  * and the zone status set to ZONE_IS_DOWN.
4814  *
4815  * It is possible that the call will interrupt itself if the caller is the
4816  * parent of any process running in the zone, and doesn't have SIGCHLD blocked.
4817  */
4818 static int
4819 zone_shutdown(zoneid_t zoneid)
4820 {
4821         int error;
4822         zone_t *zone;
4823         zone_status_t status;
4824 
4825         if (secpolicy_zone_config(CRED()) != 0)
4826                 return (set_errno(EPERM));
4827         if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
4828                 return (set_errno(EINVAL));
4829 
4830         mutex_enter(&zonehash_lock);
4831         /*
4832          * Look for zone under hash lock to prevent races with other
4833          * calls to zone_shutdown and zone_destroy.
4834          */
4835         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
4836                 mutex_exit(&zonehash_lock);
4837                 return (set_errno(EINVAL));
4838         }
4839 
4840         /*
4841          * We have to drop zonehash_lock before calling block_mounts.
4842          * Hold the zone so we can continue to use the zone_t.
4843          */
4844         zone_hold(zone);
4845         mutex_exit(&zonehash_lock);
4846 
4847         /*
4848          * Block mounts so that VFS_MOUNT() can get an accurate view of
4849          * the zone's status with regards to ZONE_IS_SHUTTING down.
4850          *
4851          * e.g. NFS can fail the mount if it determines that the zone
4852          * has already begun the shutdown sequence.
4853          *
4854          */
4855         if (block_mounts(zone) == 0) {
4856                 zone_rele(zone);
4857                 return (set_errno(EINTR));
4858         }
4859 
4860         mutex_enter(&zonehash_lock);
4861         mutex_enter(&zone_status_lock);
4862         status = zone_status_get(zone);
4863         /*
4864          * Fail if the zone isn't fully initialized yet.
4865          */
4866         if (status < ZONE_IS_READY) {
4867                 mutex_exit(&zone_status_lock);
4868                 mutex_exit(&zonehash_lock);
4869                 resume_mounts(zone);
4870                 zone_rele(zone);
4871                 return (set_errno(EINVAL));
4872         }
4873         /*
4874          * If conditions required for zone_shutdown() to return have been met,
4875          * return success.
4876          */
4877         if (status >= ZONE_IS_DOWN) {
4878                 mutex_exit(&zone_status_lock);
4879                 mutex_exit(&zonehash_lock);
4880                 resume_mounts(zone);
4881                 zone_rele(zone);
4882                 return (0);
4883         }
4884         /*
4885          * If zone_shutdown() hasn't been called before, go through the motions.
4886          * If it has, there's nothing to do but wait for the kernel threads to
4887          * drain.
4888          */
4889         if (status < ZONE_IS_EMPTY) {
4890                 uint_t ntasks;
4891 
4892                 mutex_enter(&zone->zone_lock);
4893                 if ((ntasks = zone->zone_ntasks) != 1) {
4894                         /*
4895                          * There's still stuff running.
4896                          */
4897                         zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
4898                 }
4899                 mutex_exit(&zone->zone_lock);
4900                 if (ntasks == 1) {
4901                         /*
4902                          * The only way to create another task is through
4903                          * zone_enter(), which will block until we drop
4904                          * zonehash_lock.  The zone is empty.
4905                          */
4906                         if (zone->zone_kthreads == NULL) {
4907                                 /*
4908                                  * Skip ahead to ZONE_IS_DOWN
4909                                  */
4910                                 zone_status_set(zone, ZONE_IS_DOWN);
4911                         } else {
4912                                 zone_status_set(zone, ZONE_IS_EMPTY);
4913                         }
4914                 }
4915         }
4916         mutex_exit(&zone_status_lock);
4917         mutex_exit(&zonehash_lock);
4918         resume_mounts(zone);
4919 
4920         if (error = zone_empty(zone)) {
4921                 zone_rele(zone);
4922                 return (set_errno(error));
4923         }
4924         /*
4925          * After the zone status goes to ZONE_IS_DOWN this zone will no
4926          * longer be notified of changes to the pools configuration, so
4927          * in order to not end up with a stale pool pointer, we point
4928          * ourselves at the default pool and remove all resource
4929          * visibility.  This is especially important as the zone_t may
4930          * languish on the deathrow for a very long time waiting for
4931          * cred's to drain out.
4932          *
4933          * This rebinding of the zone can happen multiple times
4934          * (presumably due to interrupted or parallel systemcalls)
4935          * without any adverse effects.
4936          */
4937         if (pool_lock_intr() != 0) {
4938                 zone_rele(zone);
4939                 return (set_errno(EINTR));
4940         }
4941         if (pool_state == POOL_ENABLED) {
4942                 mutex_enter(&cpu_lock);
4943                 zone_pool_set(zone, pool_default);
4944                 /*
4945                  * The zone no longer needs to be able to see any cpus.
4946                  */
4947                 zone_pset_set(zone, ZONE_PS_INVAL);
4948                 mutex_exit(&cpu_lock);
4949         }
4950         pool_unlock();
4951 
4952         /*
4953          * ZSD shutdown callbacks can be executed multiple times, hence
4954          * it is safe to not be holding any locks across this call.
4955          */
4956         zone_zsd_callbacks(zone, ZSD_SHUTDOWN);
4957 
4958         mutex_enter(&zone_status_lock);
4959         if (zone->zone_kthreads == NULL && zone_status_get(zone) < ZONE_IS_DOWN)
4960                 zone_status_set(zone, ZONE_IS_DOWN);
4961         mutex_exit(&zone_status_lock);
4962 
4963         /*
4964          * Wait for kernel threads to drain.
4965          */
4966         if (!zone_status_wait_sig(zone, ZONE_IS_DOWN)) {
4967                 zone_rele(zone);
4968                 return (set_errno(EINTR));
4969         }
4970 
4971         /*
4972          * Zone can be become down/destroyable even if the above wait
4973          * returns EINTR, so any code added here may never execute.
4974          * (i.e. don't add code here)
4975          */
4976 
4977         zone_rele(zone);
4978         return (0);
4979 }
4980 
4981 /*
4982  * Log the specified zone's reference counts.  The caller should not be
4983  * holding the zone's zone_lock.
4984  */
4985 static void
4986 zone_log_refcounts(zone_t *zone)
4987 {
4988         char *buffer;
4989         char *buffer_position;
4990         uint32_t buffer_size;
4991         uint32_t index;
4992         uint_t ref;
4993         uint_t cred_ref;
4994 
4995         /*
4996          * Construct a string representing the subsystem-specific reference
4997          * counts.  The counts are printed in ascending order by index into the
4998          * zone_t::zone_subsys_ref array.  The list will be surrounded by
4999          * square brackets [] and will only contain nonzero reference counts.
5000          *
5001          * The buffer will hold two square bracket characters plus ten digits,
5002          * one colon, one space, one comma, and some characters for a
5003          * subsystem name per subsystem-specific reference count.  (Unsigned 32-
5004          * bit integers have at most ten decimal digits.)  The last
5005          * reference count's comma is replaced by the closing square
5006          * bracket and a NULL character to terminate the string.
5007          *
5008          * NOTE: We have to grab the zone's zone_lock to create a consistent
5009          * snapshot of the zone's reference counters.
5010          *
5011          * First, figure out how much space the string buffer will need.
5012          * The buffer's size is stored in buffer_size.
5013          */
5014         buffer_size = 2;                        /* for the square brackets */
5015         mutex_enter(&zone->zone_lock);
5016         zone->zone_flags |= ZF_REFCOUNTS_LOGGED;
5017         ref = zone->zone_ref;
5018         cred_ref = zone->zone_cred_ref;
5019         for (index = 0; index < ZONE_REF_NUM_SUBSYS; ++index)
5020                 if (zone->zone_subsys_ref[index] != 0)
5021                         buffer_size += strlen(zone_ref_subsys_names[index]) +
5022                             13;
5023         if (buffer_size == 2) {
5024                 /*
5025                  * No subsystems had nonzero reference counts.  Don't bother
5026                  * with allocating a buffer; just log the general-purpose and
5027                  * credential reference counts.
5028                  */
5029                 mutex_exit(&zone->zone_lock);
5030                 (void) strlog(0, 0, 1, SL_CONSOLE | SL_NOTE,
5031                     "Zone '%s' (ID: %d) is shutting down, but %u zone "
5032                     "references and %u credential references are still extant",
5033                     zone->zone_name, zone->zone_id, ref, cred_ref);
5034                 return;
5035         }
5036 
5037         /*
5038          * buffer_size contains the exact number of characters that the
5039          * buffer will need.  Allocate the buffer and fill it with nonzero
5040          * subsystem-specific reference counts.  Surround the results with
5041          * square brackets afterwards.
5042          */
5043         buffer = kmem_alloc(buffer_size, KM_SLEEP);
5044         buffer_position = &buffer[1];
5045         for (index = 0; index < ZONE_REF_NUM_SUBSYS; ++index) {
5046                 /*
5047                  * NOTE: The DDI's version of sprintf() returns a pointer to
5048                  * the modified buffer rather than the number of bytes written
5049                  * (as in snprintf(3C)).  This is unfortunate and annoying.
5050                  * Therefore, we'll use snprintf() with INT_MAX to get the
5051                  * number of bytes written.  Using INT_MAX is safe because
5052                  * the buffer is perfectly sized for the data: we'll never
5053                  * overrun the buffer.
5054                  */
5055                 if (zone->zone_subsys_ref[index] != 0)
5056                         buffer_position += snprintf(buffer_position, INT_MAX,
5057                             "%s: %u,", zone_ref_subsys_names[index],
5058                             zone->zone_subsys_ref[index]);
5059         }
5060         mutex_exit(&zone->zone_lock);
5061         buffer[0] = '[';
5062         ASSERT((uintptr_t)(buffer_position - buffer) < buffer_size);
5063         ASSERT(buffer_position[0] == '\0' && buffer_position[-1] == ',');
5064         buffer_position[-1] = ']';
5065 
5066         /*
5067          * Log the reference counts and free the message buffer.
5068          */
5069         (void) strlog(0, 0, 1, SL_CONSOLE | SL_NOTE,
5070             "Zone '%s' (ID: %d) is shutting down, but %u zone references and "
5071             "%u credential references are still extant %s", zone->zone_name,
5072             zone->zone_id, ref, cred_ref, buffer);
5073         kmem_free(buffer, buffer_size);
5074 }
5075 
5076 /*
5077  * Systemcall entry point to finalize the zone halt process.  The caller
5078  * must have already successfully called zone_shutdown().
5079  *
5080  * Upon successful completion, the zone will have been fully destroyed:
5081  * zsched will have exited, destructor callbacks executed, and the zone
5082  * removed from the list of active zones.
5083  */
5084 static int
5085 zone_destroy(zoneid_t zoneid)
5086 {
5087         uint64_t uniqid;
5088         zone_t *zone;
5089         zone_status_t status;
5090         clock_t wait_time;
5091         boolean_t log_refcounts;
5092 
5093         if (secpolicy_zone_config(CRED()) != 0)
5094                 return (set_errno(EPERM));
5095         if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
5096                 return (set_errno(EINVAL));
5097 
5098         mutex_enter(&zonehash_lock);
5099         /*
5100          * Look for zone under hash lock to prevent races with other
5101          * calls to zone_destroy.
5102          */
5103         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
5104                 mutex_exit(&zonehash_lock);
5105                 return (set_errno(EINVAL));
5106         }
5107 
5108         if (zone_mount_count(zone->zone_rootpath) != 0) {
5109                 mutex_exit(&zonehash_lock);
5110                 return (set_errno(EBUSY));
5111         }
5112         mutex_enter(&zone_status_lock);
5113         status = zone_status_get(zone);
5114         if (status < ZONE_IS_DOWN) {
5115                 mutex_exit(&zone_status_lock);
5116                 mutex_exit(&zonehash_lock);
5117                 return (set_errno(EBUSY));
5118         } else if (status == ZONE_IS_DOWN) {
5119                 zone_status_set(zone, ZONE_IS_DYING); /* Tell zsched to exit */
5120         }
5121         mutex_exit(&zone_status_lock);
5122         zone_hold(zone);
5123         mutex_exit(&zonehash_lock);
5124 
5125         /*
5126          * wait for zsched to exit
5127          */
5128         zone_status_wait(zone, ZONE_IS_DEAD);
5129         zone_zsd_callbacks(zone, ZSD_DESTROY);
5130         zone->zone_netstack = NULL;
5131         uniqid = zone->zone_uniqid;
5132         zone_rele(zone);
5133         zone = NULL;    /* potentially free'd */
5134 
5135         log_refcounts = B_FALSE;
5136         wait_time = SEC_TO_TICK(ZONE_DESTROY_TIMEOUT_SECS);
5137         mutex_enter(&zonehash_lock);
5138         for (; /* ever */; ) {
5139                 boolean_t unref;
5140                 boolean_t refs_have_been_logged;
5141 
5142                 if ((zone = zone_find_all_by_id(zoneid)) == NULL ||
5143                     zone->zone_uniqid != uniqid) {
5144                         /*
5145                          * The zone has gone away.  Necessary conditions
5146                          * are met, so we return success.
5147                          */
5148                         mutex_exit(&zonehash_lock);
5149                         return (0);
5150                 }
5151                 mutex_enter(&zone->zone_lock);
5152                 unref = ZONE_IS_UNREF(zone);
5153                 refs_have_been_logged = (zone->zone_flags &
5154                     ZF_REFCOUNTS_LOGGED);
5155                 mutex_exit(&zone->zone_lock);
5156                 if (unref) {
5157                         /*
5158                          * There is only one reference to the zone -- that
5159                          * added when the zone was added to the hashtables --
5160                          * and things will remain this way until we drop
5161                          * zonehash_lock... we can go ahead and cleanup the
5162                          * zone.
5163                          */
5164                         break;
5165                 }
5166 
5167                 /*
5168                  * Wait for zone_rele_common() or zone_cred_rele() to signal
5169                  * zone_destroy_cv.  zone_destroy_cv is signaled only when
5170                  * some zone's general-purpose reference count reaches one.
5171                  * If ZONE_DESTROY_TIMEOUT_SECS seconds elapse while waiting
5172                  * on zone_destroy_cv, then log the zone's reference counts and
5173                  * continue to wait for zone_rele() and zone_cred_rele().
5174                  */
5175                 if (!refs_have_been_logged) {
5176                         if (!log_refcounts) {
5177                                 /*
5178                                  * This thread hasn't timed out waiting on
5179                                  * zone_destroy_cv yet.  Wait wait_time clock
5180                                  * ticks (initially ZONE_DESTROY_TIMEOUT_SECS
5181                                  * seconds) for the zone's references to clear.
5182                                  */
5183                                 ASSERT(wait_time > 0);
5184                                 wait_time = cv_reltimedwait_sig(
5185                                     &zone_destroy_cv, &zonehash_lock, wait_time,
5186                                     TR_SEC);
5187                                 if (wait_time > 0) {
5188                                         /*
5189                                          * A thread in zone_rele() or
5190                                          * zone_cred_rele() signaled
5191                                          * zone_destroy_cv before this thread's
5192                                          * wait timed out.  The zone might have
5193                                          * only one reference left; find out!
5194                                          */
5195                                         continue;
5196                                 } else if (wait_time == 0) {
5197                                         /* The thread's process was signaled. */
5198                                         mutex_exit(&zonehash_lock);
5199                                         return (set_errno(EINTR));
5200                                 }
5201 
5202                                 /*
5203                                  * The thread timed out while waiting on
5204                                  * zone_destroy_cv.  Even though the thread
5205                                  * timed out, it has to check whether another
5206                                  * thread woke up from zone_destroy_cv and
5207                                  * destroyed the zone.
5208                                  *
5209                                  * If the zone still exists and has more than
5210                                  * one unreleased general-purpose reference,
5211                                  * then log the zone's reference counts.
5212                                  */
5213                                 log_refcounts = B_TRUE;
5214                                 continue;
5215                         }
5216 
5217                         /*
5218                          * The thread already timed out on zone_destroy_cv while
5219                          * waiting for subsystems to release the zone's last
5220                          * general-purpose references.  Log the zone's reference
5221                          * counts and wait indefinitely on zone_destroy_cv.
5222                          */
5223                         zone_log_refcounts(zone);
5224                 }
5225                 if (cv_wait_sig(&zone_destroy_cv, &zonehash_lock) == 0) {
5226                         /* The thread's process was signaled. */
5227                         mutex_exit(&zonehash_lock);
5228                         return (set_errno(EINTR));
5229                 }
5230         }
5231 
5232         /*
5233          * Remove CPU cap for this zone now since we're not going to
5234          * fail below this point.
5235          */
5236         cpucaps_zone_remove(zone);
5237 
5238         /* Get rid of the zone's kstats */
5239         zone_kstat_delete(zone);
5240 
5241         /* remove the pfexecd doors */
5242         if (zone->zone_pfexecd != NULL) {
5243                 klpd_freelist(&zone->zone_pfexecd);
5244                 zone->zone_pfexecd = NULL;
5245         }
5246 
5247         /* free brand specific data */
5248         if (ZONE_IS_BRANDED(zone))
5249                 ZBROP(zone)->b_free_brand_data(zone);
5250 
5251         /* Say goodbye to brand framework. */
5252         brand_unregister_zone(zone->zone_brand);
5253 
5254         /*
5255          * It is now safe to let the zone be recreated; remove it from the
5256          * lists.  The memory will not be freed until the last cred
5257          * reference goes away.
5258          */
5259         ASSERT(zonecount > 1);       /* must be > 1; can't destroy global zone */
5260         zonecount--;
5261         /* remove from active list and hash tables */
5262         list_remove(&zone_active, zone);
5263         (void) mod_hash_destroy(zonehashbyname,
5264             (mod_hash_key_t)zone->zone_name);
5265         (void) mod_hash_destroy(zonehashbyid,
5266             (mod_hash_key_t)(uintptr_t)zone->zone_id);
5267         if (zone->zone_flags & ZF_HASHED_LABEL)
5268                 (void) mod_hash_destroy(zonehashbylabel,
5269                     (mod_hash_key_t)zone->zone_slabel);
5270         mutex_exit(&zonehash_lock);
5271 
5272         /*
5273          * Release the root vnode; we're not using it anymore.  Nor should any
5274          * other thread that might access it exist.
5275          */
5276         if (zone->zone_rootvp != NULL) {
5277                 VN_RELE(zone->zone_rootvp);
5278                 zone->zone_rootvp = NULL;
5279         }
5280 
5281         /* add to deathrow list */
5282         mutex_enter(&zone_deathrow_lock);
5283         list_insert_tail(&zone_deathrow, zone);
5284         mutex_exit(&zone_deathrow_lock);
5285 
5286         /*
5287          * Drop last reference (which was added by zsched()), this will
5288          * free the zone unless there are outstanding cred references.
5289          */
5290         zone_rele(zone);
5291         return (0);
5292 }
5293 
5294 /*
5295  * Systemcall entry point for zone_getattr(2).
5296  */
5297 static ssize_t
5298 zone_getattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
5299 {
5300         size_t size;
5301         int error = 0, err;
5302         zone_t *zone;
5303         char *zonepath;
5304         char *outstr;
5305         zone_status_t zone_status;
5306         pid_t initpid;
5307         boolean_t global = (curzone == global_zone);
5308         boolean_t inzone = (curzone->zone_id == zoneid);
5309         ushort_t flags;
5310         zone_net_data_t *zbuf;
5311 
5312         mutex_enter(&zonehash_lock);
5313         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
5314                 mutex_exit(&zonehash_lock);
5315                 return (set_errno(EINVAL));
5316         }
5317         zone_status = zone_status_get(zone);
5318         if (zone_status < ZONE_IS_INITIALIZED) {
5319                 mutex_exit(&zonehash_lock);
5320                 return (set_errno(EINVAL));
5321         }
5322         zone_hold(zone);
5323         mutex_exit(&zonehash_lock);
5324 
5325         /*
5326          * If not in the global zone, don't show information about other zones,
5327          * unless the system is labeled and the local zone's label dominates
5328          * the other zone.
5329          */
5330         if (!zone_list_access(zone)) {
5331                 zone_rele(zone);
5332                 return (set_errno(EINVAL));
5333         }
5334 
5335         switch (attr) {
5336         case ZONE_ATTR_ROOT:
5337                 if (global) {
5338                         /*
5339                          * Copy the path to trim the trailing "/" (except for
5340                          * the global zone).
5341                          */
5342                         if (zone != global_zone)
5343                                 size = zone->zone_rootpathlen - 1;
5344                         else
5345                                 size = zone->zone_rootpathlen;
5346                         zonepath = kmem_alloc(size, KM_SLEEP);
5347                         bcopy(zone->zone_rootpath, zonepath, size);
5348                         zonepath[size - 1] = '\0';
5349                 } else {
5350                         if (inzone || !is_system_labeled()) {
5351                                 /*
5352                                  * Caller is not in the global zone.
5353                                  * if the query is on the current zone
5354                                  * or the system is not labeled,
5355                                  * just return faked-up path for current zone.
5356                                  */
5357                                 zonepath = "/";
5358                                 size = 2;
5359                         } else {
5360                                 /*
5361                                  * Return related path for current zone.
5362                                  */
5363                                 int prefix_len = strlen(zone_prefix);
5364                                 int zname_len = strlen(zone->zone_name);
5365 
5366                                 size = prefix_len + zname_len + 1;
5367                                 zonepath = kmem_alloc(size, KM_SLEEP);
5368                                 bcopy(zone_prefix, zonepath, prefix_len);
5369                                 bcopy(zone->zone_name, zonepath +
5370                                     prefix_len, zname_len);
5371                                 zonepath[size - 1] = '\0';
5372                         }
5373                 }
5374                 if (bufsize > size)
5375                         bufsize = size;
5376                 if (buf != NULL) {
5377                         err = copyoutstr(zonepath, buf, bufsize, NULL);
5378                         if (err != 0 && err != ENAMETOOLONG)
5379                                 error = EFAULT;
5380                 }
5381                 if (global || (is_system_labeled() && !inzone))
5382                         kmem_free(zonepath, size);
5383                 break;
5384 
5385         case ZONE_ATTR_NAME:
5386                 size = strlen(zone->zone_name) + 1;
5387                 if (bufsize > size)
5388                         bufsize = size;
5389                 if (buf != NULL) {
5390                         err = copyoutstr(zone->zone_name, buf, bufsize, NULL);
5391                         if (err != 0 && err != ENAMETOOLONG)
5392                                 error = EFAULT;
5393                 }
5394                 break;
5395 
5396         case ZONE_ATTR_STATUS:
5397                 /*
5398                  * Since we're not holding zonehash_lock, the zone status
5399                  * may be anything; leave it up to userland to sort it out.
5400                  */
5401                 size = sizeof (zone_status);
5402                 if (bufsize > size)
5403                         bufsize = size;
5404                 zone_status = zone_status_get(zone);
5405                 if (buf != NULL &&
5406                     copyout(&zone_status, buf, bufsize) != 0)
5407                         error = EFAULT;
5408                 break;
5409         case ZONE_ATTR_FLAGS:
5410                 size = sizeof (zone->zone_flags);
5411                 if (bufsize > size)
5412                         bufsize = size;
5413                 flags = zone->zone_flags;
5414                 if (buf != NULL &&
5415                     copyout(&flags, buf, bufsize) != 0)
5416                         error = EFAULT;
5417                 break;
5418         case ZONE_ATTR_PRIVSET:
5419                 size = sizeof (priv_set_t);
5420                 if (bufsize > size)
5421                         bufsize = size;
5422                 if (buf != NULL &&
5423                     copyout(zone->zone_privset, buf, bufsize) != 0)
5424                         error = EFAULT;
5425                 break;
5426         case ZONE_ATTR_UNIQID:
5427                 size = sizeof (zone->zone_uniqid);
5428                 if (bufsize > size)
5429                         bufsize = size;
5430                 if (buf != NULL &&
5431                     copyout(&zone->zone_uniqid, buf, bufsize) != 0)
5432                         error = EFAULT;
5433                 break;
5434         case ZONE_ATTR_POOLID:
5435                 {
5436                         pool_t *pool;
5437                         poolid_t poolid;
5438 
5439                         if (pool_lock_intr() != 0) {
5440                                 error = EINTR;
5441                                 break;
5442                         }
5443                         pool = zone_pool_get(zone);
5444                         poolid = pool->pool_id;
5445                         pool_unlock();
5446                         size = sizeof (poolid);
5447                         if (bufsize > size)
5448                                 bufsize = size;
5449                         if (buf != NULL && copyout(&poolid, buf, size) != 0)
5450                                 error = EFAULT;
5451                 }
5452                 break;
5453         case ZONE_ATTR_SLBL:
5454                 size = sizeof (bslabel_t);
5455                 if (bufsize > size)
5456                         bufsize = size;
5457                 if (zone->zone_slabel == NULL)
5458                         error = EINVAL;
5459                 else if (buf != NULL &&
5460                     copyout(label2bslabel(zone->zone_slabel), buf,
5461                     bufsize) != 0)
5462                         error = EFAULT;
5463                 break;
5464         case ZONE_ATTR_INITPID:
5465                 size = sizeof (initpid);
5466                 if (bufsize > size)
5467                         bufsize = size;
5468                 initpid = zone->zone_proc_initpid;
5469                 if (initpid == -1) {
5470                         error = ESRCH;
5471                         break;
5472                 }
5473                 if (buf != NULL &&
5474                     copyout(&initpid, buf, bufsize) != 0)
5475                         error = EFAULT;
5476                 break;
5477         case ZONE_ATTR_BRAND:
5478                 size = strlen(zone->zone_brand->b_name) + 1;
5479 
5480                 if (bufsize > size)
5481                         bufsize = size;
5482                 if (buf != NULL) {
5483                         err = copyoutstr(zone->zone_brand->b_name, buf,
5484                             bufsize, NULL);
5485                         if (err != 0 && err != ENAMETOOLONG)
5486                                 error = EFAULT;
5487                 }
5488                 break;
5489         case ZONE_ATTR_INITNAME:
5490                 size = strlen(zone->zone_initname) + 1;
5491                 if (bufsize > size)
5492                         bufsize = size;
5493                 if (buf != NULL) {
5494                         err = copyoutstr(zone->zone_initname, buf, bufsize,
5495                             NULL);
5496                         if (err != 0 && err != ENAMETOOLONG)
5497                                 error = EFAULT;
5498                 }
5499                 break;
5500         case ZONE_ATTR_BOOTARGS:
5501                 if (zone->zone_bootargs == NULL)
5502                         outstr = "";
5503                 else
5504                         outstr = zone->zone_bootargs;
5505                 size = strlen(outstr) + 1;
5506                 if (bufsize > size)
5507                         bufsize = size;
5508                 if (buf != NULL) {
5509                         err = copyoutstr(outstr, buf, bufsize, NULL);
5510                         if (err != 0 && err != ENAMETOOLONG)
5511                                 error = EFAULT;
5512                 }
5513                 break;
5514         case ZONE_ATTR_PHYS_MCAP:
5515                 size = sizeof (zone->zone_phys_mcap);
5516                 if (bufsize > size)
5517                         bufsize = size;
5518                 if (buf != NULL &&
5519                     copyout(&zone->zone_phys_mcap, buf, bufsize) != 0)
5520                         error = EFAULT;
5521                 break;
5522         case ZONE_ATTR_SCHED_CLASS:
5523                 mutex_enter(&class_lock);
5524 
5525                 if (zone->zone_defaultcid >= loaded_classes)
5526                         outstr = "";
5527                 else
5528                         outstr = sclass[zone->zone_defaultcid].cl_name;
5529                 size = strlen(outstr) + 1;
5530                 if (bufsize > size)
5531                         bufsize = size;
5532                 if (buf != NULL) {
5533                         err = copyoutstr(outstr, buf, bufsize, NULL);
5534                         if (err != 0 && err != ENAMETOOLONG)
5535                                 error = EFAULT;
5536                 }
5537 
5538                 mutex_exit(&class_lock);
5539                 break;
5540         case ZONE_ATTR_HOSTID:
5541                 if (zone->zone_hostid != HW_INVALID_HOSTID &&
5542                     bufsize == sizeof (zone->zone_hostid)) {
5543                         size = sizeof (zone->zone_hostid);
5544                         if (buf != NULL && copyout(&zone->zone_hostid, buf,
5545                             bufsize) != 0)
5546                                 error = EFAULT;
5547                 } else {
5548                         error = EINVAL;
5549                 }
5550                 break;
5551         case ZONE_ATTR_FS_ALLOWED:
5552                 if (zone->zone_fs_allowed == NULL)
5553                         outstr = "";
5554                 else
5555                         outstr = zone->zone_fs_allowed;
5556                 size = strlen(outstr) + 1;
5557                 if (bufsize > size)
5558                         bufsize = size;
5559                 if (buf != NULL) {
5560                         err = copyoutstr(outstr, buf, bufsize, NULL);
5561                         if (err != 0 && err != ENAMETOOLONG)
5562                                 error = EFAULT;
5563                 }
5564                 break;
5565         case ZONE_ATTR_NETWORK:
5566                 zbuf = kmem_alloc(bufsize, KM_SLEEP);
5567                 if (copyin(buf, zbuf, bufsize) != 0) {
5568                         error = EFAULT;
5569                 } else {
5570                         error = zone_get_network(zoneid, zbuf);
5571                         if (error == 0 && copyout(zbuf, buf, bufsize) != 0)
5572                                 error = EFAULT;
5573                 }
5574                 kmem_free(zbuf, bufsize);
5575                 break;
5576         default:
5577                 if ((attr >= ZONE_ATTR_BRAND_ATTRS) && ZONE_IS_BRANDED(zone)) {
5578                         size = bufsize;
5579                         error = ZBROP(zone)->b_getattr(zone, attr, buf, &size);
5580                 } else {
5581                         error = EINVAL;
5582                 }
5583         }
5584         zone_rele(zone);
5585 
5586         if (error)
5587                 return (set_errno(error));
5588         return ((ssize_t)size);
5589 }
5590 
5591 /*
5592  * Systemcall entry point for zone_setattr(2).
5593  */
5594 /*ARGSUSED*/
5595 static int
5596 zone_setattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
5597 {
5598         zone_t *zone;
5599         zone_status_t zone_status;
5600         int err = -1;
5601         zone_net_data_t *zbuf;
5602 
5603         if (secpolicy_zone_config(CRED()) != 0)
5604                 return (set_errno(EPERM));
5605 
5606         /*
5607          * Only the ZONE_ATTR_PHYS_MCAP attribute can be set on the
5608          * global zone.
5609          */
5610         if (zoneid == GLOBAL_ZONEID && attr != ZONE_ATTR_PHYS_MCAP) {
5611                 return (set_errno(EINVAL));
5612         }
5613 
5614         mutex_enter(&zonehash_lock);
5615         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
5616                 mutex_exit(&zonehash_lock);
5617                 return (set_errno(EINVAL));
5618         }
5619         zone_hold(zone);
5620         mutex_exit(&zonehash_lock);
5621 
5622         /*
5623          * At present most attributes can only be set on non-running,
5624          * non-global zones.
5625          */
5626         zone_status = zone_status_get(zone);
5627         if (attr != ZONE_ATTR_PHYS_MCAP && zone_status > ZONE_IS_READY) {
5628                 err = EINVAL;
5629                 goto done;
5630         }
5631 
5632         switch (attr) {
5633         case ZONE_ATTR_INITNAME:
5634                 err = zone_set_initname(zone, (const char *)buf);
5635                 break;
5636         case ZONE_ATTR_INITNORESTART:
5637                 zone->zone_restart_init = B_FALSE;
5638                 err = 0;
5639                 break;
5640         case ZONE_ATTR_BOOTARGS:
5641                 err = zone_set_bootargs(zone, (const char *)buf);
5642                 break;
5643         case ZONE_ATTR_BRAND:
5644                 err = zone_set_brand(zone, (const char *)buf);
5645                 break;
5646         case ZONE_ATTR_FS_ALLOWED:
5647                 err = zone_set_fs_allowed(zone, (const char *)buf);
5648                 break;
5649         case ZONE_ATTR_PHYS_MCAP:
5650                 err = zone_set_phys_mcap(zone, (const uint64_t *)buf);
5651                 break;
5652         case ZONE_ATTR_SCHED_CLASS:
5653                 err = zone_set_sched_class(zone, (const char *)buf);
5654                 break;
5655         case ZONE_ATTR_HOSTID:
5656                 if (bufsize == sizeof (zone->zone_hostid)) {
5657                         if (copyin(buf, &zone->zone_hostid, bufsize) == 0)
5658                                 err = 0;
5659                         else
5660                                 err = EFAULT;
5661                 } else {
5662                         err = EINVAL;
5663                 }
5664                 break;
5665         case ZONE_ATTR_NETWORK:
5666                 if (bufsize > (PIPE_BUF + sizeof (zone_net_data_t))) {
5667                         err = EINVAL;
5668                         break;
5669                 }
5670                 zbuf = kmem_alloc(bufsize, KM_SLEEP);
5671                 if (copyin(buf, zbuf, bufsize) != 0) {
5672                         kmem_free(zbuf, bufsize);
5673                         err = EFAULT;
5674                         break;
5675                 }
5676                 err = zone_set_network(zoneid, zbuf);
5677                 kmem_free(zbuf, bufsize);
5678                 break;
5679         default:
5680                 if ((attr >= ZONE_ATTR_BRAND_ATTRS) && ZONE_IS_BRANDED(zone))
5681                         err = ZBROP(zone)->b_setattr(zone, attr, buf, bufsize);
5682                 else
5683                         err = EINVAL;
5684         }
5685 
5686 done:
5687         zone_rele(zone);
5688         ASSERT(err != -1);
5689         return (err != 0 ? set_errno(err) : 0);
5690 }
5691 
5692 /*
5693  * Return zero if the process has at least one vnode mapped in to its
5694  * address space which shouldn't be allowed to change zones.
5695  *
5696  * Also return zero if the process has any shared mappings which reserve
5697  * swap.  This is because the counting for zone.max-swap does not allow swap
5698  * reservation to be shared between zones.  zone swap reservation is counted
5699  * on zone->zone_max_swap.
5700  */
5701 static int
5702 as_can_change_zones(void)
5703 {
5704         proc_t *pp = curproc;
5705         struct seg *seg;
5706         struct as *as = pp->p_as;
5707         vnode_t *vp;
5708         int allow = 1;
5709 
5710         ASSERT(pp->p_as != &kas);
5711         AS_LOCK_ENTER(as, RW_READER);
5712         for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
5713 
5714                 /*
5715                  * Cannot enter zone with shared anon memory which
5716                  * reserves swap.  See comment above.
5717                  */
5718                 if (seg_can_change_zones(seg) == B_FALSE) {
5719                         allow = 0;
5720                         break;
5721                 }
5722                 /*
5723                  * if we can't get a backing vnode for this segment then skip
5724                  * it.
5725                  */
5726                 vp = NULL;
5727                 if (SEGOP_GETVP(seg, seg->s_base, &vp) != 0 || vp == NULL)
5728                         continue;
5729                 if (!vn_can_change_zones(vp)) { /* bail on first match */
5730                         allow = 0;
5731                         break;
5732                 }
5733         }
5734         AS_LOCK_EXIT(as);
5735         return (allow);
5736 }
5737 
5738 /*
5739  * Count swap reserved by curproc's address space
5740  */
5741 static size_t
5742 as_swresv(void)
5743 {
5744         proc_t *pp = curproc;
5745         struct seg *seg;
5746         struct as *as = pp->p_as;
5747         size_t swap = 0;
5748 
5749         ASSERT(pp->p_as != &kas);
5750         ASSERT(AS_WRITE_HELD(as));
5751         for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg))
5752                 swap += seg_swresv(seg);
5753 
5754         return (swap);
5755 }
5756 
5757 /*
5758  * Systemcall entry point for zone_enter().
5759  *
5760  * The current process is injected into said zone.  In the process
5761  * it will change its project membership, privileges, rootdir/cwd,
5762  * zone-wide rctls, and pool association to match those of the zone.
5763  *
5764  * The first zone_enter() called while the zone is in the ZONE_IS_READY
5765  * state will transition it to ZONE_IS_RUNNING.  Processes may only
5766  * enter a zone that is "ready" or "running".
5767  */
5768 static int
5769 zone_enter(zoneid_t zoneid)
5770 {
5771         zone_t *zone;
5772         vnode_t *vp;
5773         proc_t *pp = curproc;
5774         contract_t *ct;
5775         cont_process_t *ctp;
5776         task_t *tk, *oldtk;
5777         kproject_t *zone_proj0;
5778         cred_t *cr, *newcr;
5779         pool_t *oldpool, *newpool;
5780         sess_t *sp;
5781         uid_t uid;
5782         zone_status_t status;
5783         int err = 0;
5784         rctl_entity_p_t e;
5785         size_t swap;
5786         kthread_id_t t;
5787 
5788         if (secpolicy_zone_config(CRED()) != 0)
5789                 return (set_errno(EPERM));
5790         if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
5791                 return (set_errno(EINVAL));
5792 
5793         /*
5794          * Stop all lwps so we don't need to hold a lock to look at
5795          * curproc->p_zone.  This needs to happen before we grab any
5796          * locks to avoid deadlock (another lwp in the process could
5797          * be waiting for the held lock).
5798          */
5799         if (curthread != pp->p_agenttp && !holdlwps(SHOLDFORK))
5800                 return (set_errno(EINTR));
5801 
5802         /*
5803          * Make sure we're not changing zones with files open or mapped in
5804          * to our address space which shouldn't be changing zones.
5805          */
5806         if (!files_can_change_zones()) {
5807                 err = EBADF;
5808                 goto out;
5809         }
5810         if (!as_can_change_zones()) {
5811                 err = EFAULT;
5812                 goto out;
5813         }
5814 
5815         mutex_enter(&zonehash_lock);
5816         if (pp->p_zone != global_zone) {
5817                 mutex_exit(&zonehash_lock);
5818                 err = EINVAL;
5819                 goto out;
5820         }
5821 
5822         zone = zone_find_all_by_id(zoneid);
5823         if (zone == NULL) {
5824                 mutex_exit(&zonehash_lock);
5825                 err = EINVAL;
5826                 goto out;
5827         }
5828 
5829         /*
5830          * To prevent processes in a zone from holding contracts on
5831          * extrazonal resources, and to avoid process contract
5832          * memberships which span zones, contract holders and processes
5833          * which aren't the sole members of their encapsulating process
5834          * contracts are not allowed to zone_enter.
5835          */
5836         ctp = pp->p_ct_process;
5837         ct = &ctp->conp_contract;
5838         mutex_enter(&ct->ct_lock);
5839         mutex_enter(&pp->p_lock);
5840         if ((avl_numnodes(&pp->p_ct_held) != 0) || (ctp->conp_nmembers != 1)) {
5841                 mutex_exit(&pp->p_lock);
5842                 mutex_exit(&ct->ct_lock);
5843                 mutex_exit(&zonehash_lock);
5844                 err = EINVAL;
5845                 goto out;
5846         }
5847 
5848         /*
5849          * Moreover, we don't allow processes whose encapsulating
5850          * process contracts have inherited extrazonal contracts.
5851          * While it would be easier to eliminate all process contracts
5852          * with inherited contracts, we need to be able to give a
5853          * restarted init (or other zone-penetrating process) its
5854          * predecessor's contracts.
5855          */
5856         if (ctp->conp_ninherited != 0) {
5857                 contract_t *next;
5858                 for (next = list_head(&ctp->conp_inherited); next;
5859                     next = list_next(&ctp->conp_inherited, next)) {
5860                         if (contract_getzuniqid(next) != zone->zone_uniqid) {
5861                                 mutex_exit(&pp->p_lock);
5862                                 mutex_exit(&ct->ct_lock);
5863                                 mutex_exit(&zonehash_lock);
5864                                 err = EINVAL;
5865                                 goto out;
5866                         }
5867                 }
5868         }
5869 
5870         mutex_exit(&pp->p_lock);
5871         mutex_exit(&ct->ct_lock);
5872 
5873         status = zone_status_get(zone);
5874         if (status < ZONE_IS_READY || status >= ZONE_IS_SHUTTING_DOWN) {
5875                 /*
5876                  * Can't join
5877                  */
5878                 mutex_exit(&zonehash_lock);
5879                 err = EINVAL;
5880                 goto out;
5881         }
5882 
5883         /*
5884          * Make sure new priv set is within the permitted set for caller
5885          */
5886         if (!priv_issubset(zone->zone_privset, &CR_OPPRIV(CRED()))) {
5887                 mutex_exit(&zonehash_lock);
5888                 err = EPERM;
5889                 goto out;
5890         }
5891         /*
5892          * We want to momentarily drop zonehash_lock while we optimistically
5893          * bind curproc to the pool it should be running in.  This is safe
5894          * since the zone can't disappear (we have a hold on it).
5895          */
5896         zone_hold(zone);
5897         mutex_exit(&zonehash_lock);
5898 
5899         /*
5900          * Grab pool_lock to keep the pools configuration from changing
5901          * and to stop ourselves from getting rebound to another pool
5902          * until we join the zone.
5903          */
5904         if (pool_lock_intr() != 0) {
5905                 zone_rele(zone);
5906                 err = EINTR;
5907                 goto out;
5908         }
5909         ASSERT(secpolicy_pool(CRED()) == 0);
5910         /*
5911          * Bind ourselves to the pool currently associated with the zone.
5912          */
5913         oldpool = curproc->p_pool;
5914         newpool = zone_pool_get(zone);
5915         if (pool_state == POOL_ENABLED && newpool != oldpool &&
5916             (err = pool_do_bind(newpool, P_PID, P_MYID,
5917             POOL_BIND_ALL)) != 0) {
5918                 pool_unlock();
5919                 zone_rele(zone);
5920                 goto out;
5921         }
5922 
5923         /*
5924          * Grab cpu_lock now; we'll need it later when we call
5925          * task_join().
5926          */
5927         mutex_enter(&cpu_lock);
5928         mutex_enter(&zonehash_lock);
5929         /*
5930          * Make sure the zone hasn't moved on since we dropped zonehash_lock.
5931          */
5932         if (zone_status_get(zone) >= ZONE_IS_SHUTTING_DOWN) {
5933                 /*
5934                  * Can't join anymore.
5935                  */
5936                 mutex_exit(&zonehash_lock);
5937                 mutex_exit(&cpu_lock);
5938                 if (pool_state == POOL_ENABLED &&
5939                     newpool != oldpool)
5940                         (void) pool_do_bind(oldpool, P_PID, P_MYID,
5941                             POOL_BIND_ALL);
5942                 pool_unlock();
5943                 zone_rele(zone);
5944                 err = EINVAL;
5945                 goto out;
5946         }
5947 
5948         /*
5949          * a_lock must be held while transfering locked memory and swap
5950          * reservation from the global zone to the non global zone because
5951          * asynchronous faults on the processes' address space can lock
5952          * memory and reserve swap via MCL_FUTURE and MAP_NORESERVE
5953          * segments respectively.
5954          */
5955         AS_LOCK_ENTER(pp->p_as, RW_WRITER);
5956         swap = as_swresv();
5957         mutex_enter(&pp->p_lock);
5958         zone_proj0 = zone->zone_zsched->p_task->tk_proj;
5959         /* verify that we do not exceed and task or lwp limits */
5960         mutex_enter(&zone->zone_nlwps_lock);
5961         /* add new lwps to zone and zone's proj0 */
5962         zone_proj0->kpj_nlwps += pp->p_lwpcnt;
5963         zone->zone_nlwps += pp->p_lwpcnt;
5964         /* add 1 task to zone's proj0 */
5965         zone_proj0->kpj_ntasks += 1;
5966 
5967         zone_proj0->kpj_nprocs++;
5968         zone->zone_nprocs++;
5969         mutex_exit(&zone->zone_nlwps_lock);
5970 
5971         mutex_enter(&zone->zone_mem_lock);
5972         zone->zone_locked_mem += pp->p_locked_mem;
5973         zone_proj0->kpj_data.kpd_locked_mem += pp->p_locked_mem;
5974         zone->zone_max_swap += swap;
5975         mutex_exit(&zone->zone_mem_lock);
5976 
5977         mutex_enter(&(zone_proj0->kpj_data.kpd_crypto_lock));
5978         zone_proj0->kpj_data.kpd_crypto_mem += pp->p_crypto_mem;
5979         mutex_exit(&(zone_proj0->kpj_data.kpd_crypto_lock));
5980 
5981         /* remove lwps and process from proc's old zone and old project */
5982         mutex_enter(&pp->p_zone->zone_nlwps_lock);
5983         pp->p_zone->zone_nlwps -= pp->p_lwpcnt;
5984         pp->p_task->tk_proj->kpj_nlwps -= pp->p_lwpcnt;
5985         pp->p_task->tk_proj->kpj_nprocs--;
5986         pp->p_zone->zone_nprocs--;
5987         mutex_exit(&pp->p_zone->zone_nlwps_lock);
5988 
5989         mutex_enter(&pp->p_zone->zone_mem_lock);
5990         pp->p_zone->zone_locked_mem -= pp->p_locked_mem;
5991         pp->p_task->tk_proj->kpj_data.kpd_locked_mem -= pp->p_locked_mem;
5992         pp->p_zone->zone_max_swap -= swap;
5993         mutex_exit(&pp->p_zone->zone_mem_lock);
5994 
5995         mutex_enter(&(pp->p_task->tk_proj->kpj_data.kpd_crypto_lock));
5996         pp->p_task->tk_proj->kpj_data.kpd_crypto_mem -= pp->p_crypto_mem;
5997         mutex_exit(&(pp->p_task->tk_proj->kpj_data.kpd_crypto_lock));
5998 
5999         pp->p_flag |= SZONETOP;
6000         pp->p_zone = zone;
6001         mutex_exit(&pp->p_lock);
6002         AS_LOCK_EXIT(pp->p_as);
6003 
6004         /*
6005          * Joining the zone cannot fail from now on.
6006          *
6007          * This means that a lot of the following code can be commonized and
6008          * shared with zsched().
6009          */
6010 
6011         /*
6012          * If the process contract fmri was inherited, we need to
6013          * flag this so that any contract status will not leak
6014          * extra zone information, svc_fmri in this case
6015          */
6016         if (ctp->conp_svc_ctid != ct->ct_id) {
6017                 mutex_enter(&ct->ct_lock);
6018                 ctp->conp_svc_zone_enter = ct->ct_id;
6019                 mutex_exit(&ct->ct_lock);
6020         }
6021 
6022         /*
6023          * Reset the encapsulating process contract's zone.
6024          */
6025         ASSERT(ct->ct_mzuniqid == GLOBAL_ZONEUNIQID);
6026         contract_setzuniqid(ct, zone->zone_uniqid);
6027 
6028         /*
6029          * Create a new task and associate the process with the project keyed
6030          * by (projid,zoneid).
6031          *
6032          * We might as well be in project 0; the global zone's projid doesn't
6033          * make much sense in a zone anyhow.
6034          *
6035          * This also increments zone_ntasks, and returns with p_lock held.
6036          */
6037         tk = task_create(0, zone);
6038         oldtk = task_join(tk, 0);
6039         mutex_exit(&cpu_lock);
6040 
6041         /*
6042          * call RCTLOP_SET functions on this proc
6043          */
6044         e.rcep_p.zone = zone;
6045         e.rcep_t = RCENTITY_ZONE;
6046         (void) rctl_set_dup(NULL, NULL, pp, &e, zone->zone_rctls, NULL,
6047             RCD_CALLBACK);
6048         mutex_exit(&pp->p_lock);
6049 
6050         /*
6051          * We don't need to hold any of zsched's locks here; not only do we know
6052          * the process and zone aren't going away, we know its session isn't
6053          * changing either.
6054          *
6055          * By joining zsched's session here, we mimic the behavior in the
6056          * global zone of init's sid being the pid of sched.  We extend this
6057          * to all zlogin-like zone_enter()'ing processes as well.
6058          */
6059         mutex_enter(&pidlock);
6060         sp = zone->zone_zsched->p_sessp;
6061         sess_hold(zone->zone_zsched);
6062         mutex_enter(&pp->p_lock);
6063         pgexit(pp);
6064         sess_rele(pp->p_sessp, B_TRUE);
6065         pp->p_sessp = sp;
6066         pgjoin(pp, zone->zone_zsched->p_pidp);
6067 
6068         /*
6069          * If any threads are scheduled to be placed on zone wait queue they
6070          * should abandon the idea since the wait queue is changing.
6071          * We need to be holding pidlock & p_lock to do this.
6072          */
6073         if ((t = pp->p_tlist) != NULL) {
6074                 do {
6075                         thread_lock(t);
6076                         /*
6077                          * Kick this thread so that he doesn't sit
6078                          * on a wrong wait queue.
6079                          */
6080                         if (ISWAITING(t))
6081                                 setrun_locked(t);
6082 
6083                         if (t->t_schedflag & TS_ANYWAITQ)
6084                                 t->t_schedflag &= ~ TS_ANYWAITQ;
6085 
6086                         thread_unlock(t);
6087                 } while ((t = t->t_forw) != pp->p_tlist);
6088         }
6089 
6090         /*
6091          * If there is a default scheduling class for the zone and it is not
6092          * the class we are currently in, change all of the threads in the
6093          * process to the new class.  We need to be holding pidlock & p_lock
6094          * when we call parmsset so this is a good place to do it.
6095          */
6096         if (zone->zone_defaultcid > 0 &&
6097             zone->zone_defaultcid != curthread->t_cid) {
6098                 pcparms_t pcparms;
6099 
6100                 pcparms.pc_cid = zone->zone_defaultcid;
6101                 pcparms.pc_clparms[0] = 0;
6102 
6103                 /*
6104                  * If setting the class fails, we still want to enter the zone.
6105                  */
6106                 if ((t = pp->p_tlist) != NULL) {
6107                         do {
6108                                 (void) parmsset(&pcparms, t);
6109                         } while ((t = t->t_forw) != pp->p_tlist);
6110                 }
6111         }
6112 
6113         mutex_exit(&pp->p_lock);
6114         mutex_exit(&pidlock);
6115 
6116         mutex_exit(&zonehash_lock);
6117         /*
6118          * We're firmly in the zone; let pools progress.
6119          */
6120         pool_unlock();
6121         task_rele(oldtk);
6122         /*
6123          * We don't need to retain a hold on the zone since we already
6124          * incremented zone_ntasks, so the zone isn't going anywhere.
6125          */
6126         zone_rele(zone);
6127 
6128         /*
6129          * Chroot
6130          */
6131         vp = zone->zone_rootvp;
6132         zone_chdir(vp, &PTOU(pp)->u_cdir, pp);
6133         zone_chdir(vp, &PTOU(pp)->u_rdir, pp);
6134 
6135         /*
6136          * Change process credentials
6137          */
6138         newcr = cralloc();
6139         mutex_enter(&pp->p_crlock);
6140         cr = pp->p_cred;
6141         crcopy_to(cr, newcr);
6142         crsetzone(newcr, zone);
6143         pp->p_cred = newcr;
6144 
6145         /*
6146          * Restrict all process privilege sets to zone limit
6147          */
6148         priv_intersect(zone->zone_privset, &CR_PPRIV(newcr));
6149         priv_intersect(zone->zone_privset, &CR_EPRIV(newcr));
6150         priv_intersect(zone->zone_privset, &CR_IPRIV(newcr));
6151         priv_intersect(zone->zone_privset, &CR_LPRIV(newcr));
6152         mutex_exit(&pp->p_crlock);
6153         crset(pp, newcr);
6154 
6155         /*
6156          * Adjust upcount to reflect zone entry.
6157          */
6158         uid = crgetruid(newcr);
6159         mutex_enter(&pidlock);
6160         upcount_dec(uid, GLOBAL_ZONEID);
6161         upcount_inc(uid, zoneid);
6162         mutex_exit(&pidlock);
6163 
6164         /*
6165          * Set up core file path and content.
6166          */
6167         set_core_defaults();
6168 
6169 out:
6170         /*
6171          * Let the other lwps continue.
6172          */
6173         mutex_enter(&pp->p_lock);
6174         if (curthread != pp->p_agenttp)
6175                 continuelwps(pp);
6176         mutex_exit(&pp->p_lock);
6177 
6178         return (err != 0 ? set_errno(err) : 0);
6179 }
6180 
6181 /*
6182  * Systemcall entry point for zone_list(2).
6183  *
6184  * Processes running in a (non-global) zone only see themselves.
6185  * On labeled systems, they see all zones whose label they dominate.
6186  */
6187 static int
6188 zone_list(zoneid_t *zoneidlist, uint_t *numzones)
6189 {
6190         zoneid_t *zoneids;
6191         zone_t *zone, *myzone;
6192         uint_t user_nzones, real_nzones;
6193         uint_t domi_nzones;
6194         int error;
6195 
6196         if (copyin(numzones, &user_nzones, sizeof (uint_t)) != 0)
6197                 return (set_errno(EFAULT));
6198 
6199         myzone = curproc->p_zone;
6200         if (myzone != global_zone) {
6201                 bslabel_t *mybslab;
6202 
6203                 if (!is_system_labeled()) {
6204                         /* just return current zone */
6205                         real_nzones = domi_nzones = 1;
6206                         zoneids = kmem_alloc(sizeof (zoneid_t), KM_SLEEP);
6207                         zoneids[0] = myzone->zone_id;
6208                 } else {
6209                         /* return all zones that are dominated */
6210                         mutex_enter(&zonehash_lock);
6211                         real_nzones = zonecount;
6212                         domi_nzones = 0;
6213                         if (real_nzones > 0) {
6214                                 zoneids = kmem_alloc(real_nzones *
6215                                     sizeof (zoneid_t), KM_SLEEP);
6216                                 mybslab = label2bslabel(myzone->zone_slabel);
6217                                 for (zone = list_head(&zone_active);
6218                                     zone != NULL;
6219                                     zone = list_next(&zone_active, zone)) {
6220                                         if (zone->zone_id == GLOBAL_ZONEID)
6221                                                 continue;
6222                                         if (zone != myzone &&
6223                                             (zone->zone_flags & ZF_IS_SCRATCH))
6224                                                 continue;
6225                                         /*
6226                                          * Note that a label always dominates
6227                                          * itself, so myzone is always included
6228                                          * in the list.
6229                                          */
6230                                         if (bldominates(mybslab,
6231                                             label2bslabel(zone->zone_slabel))) {
6232                                                 zoneids[domi_nzones++] =
6233                                                     zone->zone_id;
6234                                         }
6235                                 }
6236                         }
6237                         mutex_exit(&zonehash_lock);
6238                 }
6239         } else {
6240                 mutex_enter(&zonehash_lock);
6241                 real_nzones = zonecount;
6242                 domi_nzones = 0;
6243                 if (real_nzones > 0) {
6244                         zoneids = kmem_alloc(real_nzones * sizeof (zoneid_t),
6245                             KM_SLEEP);
6246                         for (zone = list_head(&zone_active); zone != NULL;
6247                             zone = list_next(&zone_active, zone))
6248                                 zoneids[domi_nzones++] = zone->zone_id;
6249                         ASSERT(domi_nzones == real_nzones);
6250                 }
6251                 mutex_exit(&zonehash_lock);
6252         }
6253 
6254         /*
6255          * If user has allocated space for fewer entries than we found, then
6256          * return only up to his limit.  Either way, tell him exactly how many
6257          * we found.
6258          */
6259         if (domi_nzones < user_nzones)
6260                 user_nzones = domi_nzones;
6261         error = 0;
6262         if (copyout(&domi_nzones, numzones, sizeof (uint_t)) != 0) {
6263                 error = EFAULT;
6264         } else if (zoneidlist != NULL && user_nzones != 0) {
6265                 if (copyout(zoneids, zoneidlist,
6266                     user_nzones * sizeof (zoneid_t)) != 0)
6267                         error = EFAULT;
6268         }
6269 
6270         if (real_nzones > 0)
6271                 kmem_free(zoneids, real_nzones * sizeof (zoneid_t));
6272 
6273         if (error != 0)
6274                 return (set_errno(error));
6275         else
6276                 return (0);
6277 }
6278 
6279 /*
6280  * Systemcall entry point for zone_lookup(2).
6281  *
6282  * Non-global zones are only able to see themselves and (on labeled systems)
6283  * the zones they dominate.
6284  */
6285 static zoneid_t
6286 zone_lookup(const char *zone_name)
6287 {
6288         char *kname;
6289         zone_t *zone;
6290         zoneid_t zoneid;
6291         int err;
6292 
6293         if (zone_name == NULL) {
6294                 /* return caller's zone id */
6295                 return (getzoneid());
6296         }
6297 
6298         kname = kmem_zalloc(ZONENAME_MAX, KM_SLEEP);
6299         if ((err = copyinstr(zone_name, kname, ZONENAME_MAX, NULL)) != 0) {
6300                 kmem_free(kname, ZONENAME_MAX);
6301                 return (set_errno(err));
6302         }
6303 
6304         mutex_enter(&zonehash_lock);
6305         zone = zone_find_all_by_name(kname);
6306         kmem_free(kname, ZONENAME_MAX);
6307         /*
6308          * In a non-global zone, can only lookup global and own name.
6309          * In Trusted Extensions zone label dominance rules apply.
6310          */
6311         if (zone == NULL ||
6312             zone_status_get(zone) < ZONE_IS_READY ||
6313             !zone_list_access(zone)) {
6314                 mutex_exit(&zonehash_lock);
6315                 return (set_errno(EINVAL));
6316         } else {
6317                 zoneid = zone->zone_id;
6318                 mutex_exit(&zonehash_lock);
6319                 return (zoneid);
6320         }
6321 }
6322 
6323 static int
6324 zone_version(int *version_arg)
6325 {
6326         int version = ZONE_SYSCALL_API_VERSION;
6327 
6328         if (copyout(&version, version_arg, sizeof (int)) != 0)
6329                 return (set_errno(EFAULT));
6330         return (0);
6331 }
6332 
6333 /* ARGSUSED */
6334 long
6335 zone(int cmd, void *arg1, void *arg2, void *arg3, void *arg4)
6336 {
6337         zone_def zs;
6338         int err;
6339 
6340         switch (cmd) {
6341         case ZONE_CREATE:
6342                 if (get_udatamodel() == DATAMODEL_NATIVE) {
6343                         if (copyin(arg1, &zs, sizeof (zone_def))) {
6344                                 return (set_errno(EFAULT));
6345                         }
6346                 } else {
6347 #ifdef _SYSCALL32_IMPL
6348                         zone_def32 zs32;
6349 
6350                         if (copyin(arg1, &zs32, sizeof (zone_def32))) {
6351                                 return (set_errno(EFAULT));
6352                         }
6353                         zs.zone_name =
6354                             (const char *)(unsigned long)zs32.zone_name;
6355                         zs.zone_root =
6356                             (const char *)(unsigned long)zs32.zone_root;
6357                         zs.zone_privs =
6358                             (const struct priv_set *)
6359                             (unsigned long)zs32.zone_privs;
6360                         zs.zone_privssz = zs32.zone_privssz;
6361                         zs.rctlbuf = (caddr_t)(unsigned long)zs32.rctlbuf;
6362                         zs.rctlbufsz = zs32.rctlbufsz;
6363                         zs.zfsbuf = (caddr_t)(unsigned long)zs32.zfsbuf;
6364                         zs.zfsbufsz = zs32.zfsbufsz;
6365                         zs.extended_error =
6366                             (int *)(unsigned long)zs32.extended_error;
6367                         zs.match = zs32.match;
6368                         zs.doi = zs32.doi;
6369                         zs.label = (const bslabel_t *)(uintptr_t)zs32.label;
6370                         zs.flags = zs32.flags;
6371 #else
6372                         panic("get_udatamodel() returned bogus result\n");
6373 #endif
6374                 }
6375 
6376                 return (zone_create(zs.zone_name, zs.zone_root,
6377                     zs.zone_privs, zs.zone_privssz,
6378                     (caddr_t)zs.rctlbuf, zs.rctlbufsz,
6379                     (caddr_t)zs.zfsbuf, zs.zfsbufsz,
6380                     zs.extended_error, zs.match, zs.doi,
6381                     zs.label, zs.flags));
6382         case ZONE_BOOT:
6383                 return (zone_boot((zoneid_t)(uintptr_t)arg1));
6384         case ZONE_DESTROY:
6385                 return (zone_destroy((zoneid_t)(uintptr_t)arg1));
6386         case ZONE_GETATTR:
6387                 return (zone_getattr((zoneid_t)(uintptr_t)arg1,
6388                     (int)(uintptr_t)arg2, arg3, (size_t)arg4));
6389         case ZONE_SETATTR:
6390                 return (zone_setattr((zoneid_t)(uintptr_t)arg1,
6391                     (int)(uintptr_t)arg2, arg3, (size_t)arg4));
6392         case ZONE_ENTER:
6393                 return (zone_enter((zoneid_t)(uintptr_t)arg1));
6394         case ZONE_LIST:
6395                 return (zone_list((zoneid_t *)arg1, (uint_t *)arg2));
6396         case ZONE_SHUTDOWN:
6397                 return (zone_shutdown((zoneid_t)(uintptr_t)arg1));
6398         case ZONE_LOOKUP:
6399                 return (zone_lookup((const char *)arg1));
6400         case ZONE_VERSION:
6401                 return (zone_version((int *)arg1));
6402         case ZONE_ADD_DATALINK:
6403                 return (zone_add_datalink((zoneid_t)(uintptr_t)arg1,
6404                     (datalink_id_t)(uintptr_t)arg2));
6405         case ZONE_DEL_DATALINK:
6406                 return (zone_remove_datalink((zoneid_t)(uintptr_t)arg1,
6407                     (datalink_id_t)(uintptr_t)arg2));
6408         case ZONE_CHECK_DATALINK: {
6409                 zoneid_t        zoneid;
6410                 boolean_t       need_copyout;
6411 
6412                 if (copyin(arg1, &zoneid, sizeof (zoneid)) != 0)
6413                         return (EFAULT);
6414                 need_copyout = (zoneid == ALL_ZONES);
6415                 err = zone_check_datalink(&zoneid,
6416                     (datalink_id_t)(uintptr_t)arg2);
6417                 if (err == 0 && need_copyout) {
6418                         if (copyout(&zoneid, arg1, sizeof (zoneid)) != 0)
6419                                 err = EFAULT;
6420                 }
6421                 return (err == 0 ? 0 : set_errno(err));
6422         }
6423         case ZONE_LIST_DATALINK:
6424                 return (zone_list_datalink((zoneid_t)(uintptr_t)arg1,
6425                     (int *)arg2, (datalink_id_t *)(uintptr_t)arg3));
6426         default:
6427                 return (set_errno(EINVAL));
6428         }
6429 }
6430 
6431 struct zarg {
6432         zone_t *zone;
6433         zone_cmd_arg_t arg;
6434 };
6435 
6436 static int
6437 zone_lookup_door(const char *zone_name, door_handle_t *doorp)
6438 {
6439         char *buf;
6440         size_t buflen;
6441         int error;
6442 
6443         buflen = sizeof (ZONE_DOOR_PATH) + strlen(zone_name);
6444         buf = kmem_alloc(buflen, KM_SLEEP);
6445         (void) snprintf(buf, buflen, ZONE_DOOR_PATH, zone_name);
6446         error = door_ki_open(buf, doorp);
6447         kmem_free(buf, buflen);
6448         return (error);
6449 }
6450 
6451 static void
6452 zone_release_door(door_handle_t *doorp)
6453 {
6454         door_ki_rele(*doorp);
6455         *doorp = NULL;
6456 }
6457 
6458 static void
6459 zone_ki_call_zoneadmd(struct zarg *zargp)
6460 {
6461         door_handle_t door = NULL;
6462         door_arg_t darg, save_arg;
6463         char *zone_name;
6464         size_t zone_namelen;
6465         zoneid_t zoneid;
6466         zone_t *zone;
6467         zone_cmd_arg_t arg;
6468         uint64_t uniqid;
6469         size_t size;
6470         int error;
6471         int retry;
6472 
6473         zone = zargp->zone;
6474         arg = zargp->arg;
6475         kmem_free(zargp, sizeof (*zargp));
6476 
6477         zone_namelen = strlen(zone->zone_name) + 1;
6478         zone_name = kmem_alloc(zone_namelen, KM_SLEEP);
6479         bcopy(zone->zone_name, zone_name, zone_namelen);
6480         zoneid = zone->zone_id;
6481         uniqid = zone->zone_uniqid;
6482         /*
6483          * zoneadmd may be down, but at least we can empty out the zone.
6484          * We can ignore the return value of zone_empty() since we're called
6485          * from a kernel thread and know we won't be delivered any signals.
6486          */
6487         ASSERT(curproc == &p0);
6488         (void) zone_empty(zone);
6489         ASSERT(zone_status_get(zone) >= ZONE_IS_EMPTY);
6490         zone_rele(zone);
6491 
6492         size = sizeof (arg);
6493         darg.rbuf = (char *)&arg;
6494         darg.data_ptr = (char *)&arg;
6495         darg.rsize = size;
6496         darg.data_size = size;
6497         darg.desc_ptr = NULL;
6498         darg.desc_num = 0;
6499 
6500         save_arg = darg;
6501         /*
6502          * Since we're not holding a reference to the zone, any number of
6503          * things can go wrong, including the zone disappearing before we get a
6504          * chance to talk to zoneadmd.
6505          */
6506         for (retry = 0; /* forever */; retry++) {
6507                 if (door == NULL &&
6508                     (error = zone_lookup_door(zone_name, &door)) != 0) {
6509                         goto next;
6510                 }
6511                 ASSERT(door != NULL);
6512 
6513                 if ((error = door_ki_upcall_limited(door, &darg, NULL,
6514                     SIZE_MAX, 0)) == 0) {
6515                         break;
6516                 }
6517                 switch (error) {
6518                 case EINTR:
6519                         /* FALLTHROUGH */
6520                 case EAGAIN:    /* process may be forking */
6521                         /*
6522                          * Back off for a bit
6523                          */
6524                         break;
6525                 case EBADF:
6526                         zone_release_door(&door);
6527                         if (zone_lookup_door(zone_name, &door) != 0) {
6528                                 /*
6529                                  * zoneadmd may be dead, but it may come back to
6530                                  * life later.
6531                                  */
6532                                 break;
6533                         }
6534                         break;
6535                 default:
6536                         cmn_err(CE_WARN,
6537                             "zone_ki_call_zoneadmd: door_ki_upcall error %d\n",
6538                             error);
6539                         goto out;
6540                 }
6541 next:
6542                 /*
6543                  * If this isn't the same zone_t that we originally had in mind,
6544                  * then this is the same as if two kadmin requests come in at
6545                  * the same time: the first one wins.  This means we lose, so we
6546                  * bail.
6547                  */
6548                 if ((zone = zone_find_by_id(zoneid)) == NULL) {
6549                         /*
6550                          * Problem is solved.
6551                          */
6552                         break;
6553                 }
6554                 if (zone->zone_uniqid != uniqid) {
6555                         /*
6556                          * zoneid recycled
6557                          */
6558                         zone_rele(zone);
6559                         break;
6560                 }
6561                 /*
6562                  * We could zone_status_timedwait(), but there doesn't seem to
6563                  * be much point in doing that (plus, it would mean that
6564                  * zone_free() isn't called until this thread exits).
6565                  */
6566                 zone_rele(zone);
6567                 delay(hz);
6568                 darg = save_arg;
6569         }
6570 out:
6571         if (door != NULL) {
6572                 zone_release_door(&door);
6573         }
6574         kmem_free(zone_name, zone_namelen);
6575         thread_exit();
6576 }
6577 
6578 /*
6579  * Entry point for uadmin() to tell the zone to go away or reboot.  Analog to
6580  * kadmin().  The caller is a process in the zone.
6581  *
6582  * In order to shutdown the zone, we will hand off control to zoneadmd
6583  * (running in the global zone) via a door.  We do a half-hearted job at
6584  * killing all processes in the zone, create a kernel thread to contact
6585  * zoneadmd, and make note of the "uniqid" of the zone.  The uniqid is
6586  * a form of generation number used to let zoneadmd (as well as
6587  * zone_destroy()) know exactly which zone they're re talking about.
6588  */
6589 int
6590 zone_kadmin(int cmd, int fcn, const char *mdep, cred_t *credp)
6591 {
6592         struct zarg *zargp;
6593         zone_cmd_t zcmd;
6594         zone_t *zone;
6595 
6596         zone = curproc->p_zone;
6597         ASSERT(getzoneid() != GLOBAL_ZONEID);
6598 
6599         switch (cmd) {
6600         case A_SHUTDOWN:
6601                 switch (fcn) {
6602                 case AD_HALT:
6603                 case AD_POWEROFF:
6604                         zcmd = Z_HALT;
6605                         break;
6606                 case AD_BOOT:
6607                         zcmd = Z_REBOOT;
6608                         break;
6609                 case AD_IBOOT:
6610                 case AD_SBOOT:
6611                 case AD_SIBOOT:
6612                 case AD_NOSYNC:
6613                         return (ENOTSUP);
6614                 default:
6615                         return (EINVAL);
6616                 }
6617                 break;
6618         case A_REBOOT:
6619                 zcmd = Z_REBOOT;
6620                 break;
6621         case A_FTRACE:
6622         case A_REMOUNT:
6623         case A_FREEZE:
6624         case A_DUMP:
6625         case A_CONFIG:
6626                 return (ENOTSUP);
6627         default:
6628                 ASSERT(cmd != A_SWAPCTL);       /* handled by uadmin() */
6629                 return (EINVAL);
6630         }
6631 
6632         if (secpolicy_zone_admin(credp, B_FALSE))
6633                 return (EPERM);
6634         mutex_enter(&zone_status_lock);
6635 
6636         /*
6637          * zone_status can't be ZONE_IS_EMPTY or higher since curproc
6638          * is in the zone.
6639          */
6640         ASSERT(zone_status_get(zone) < ZONE_IS_EMPTY);
6641         if (zone_status_get(zone) > ZONE_IS_RUNNING) {
6642                 /*
6643                  * This zone is already on its way down.
6644                  */
6645                 mutex_exit(&zone_status_lock);
6646                 return (0);
6647         }
6648         /*
6649          * Prevent future zone_enter()s
6650          */
6651         zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
6652         mutex_exit(&zone_status_lock);
6653 
6654         /*
6655          * Kill everyone now and call zoneadmd later.
6656          * zone_ki_call_zoneadmd() will do a more thorough job of this
6657          * later.
6658          */
6659         killall(zone->zone_id);
6660         /*
6661          * Now, create the thread to contact zoneadmd and do the rest of the
6662          * work.  This thread can't be created in our zone otherwise
6663          * zone_destroy() would deadlock.
6664          */
6665         zargp = kmem_zalloc(sizeof (*zargp), KM_SLEEP);
6666         zargp->arg.cmd = zcmd;
6667         zargp->arg.uniqid = zone->zone_uniqid;
6668         zargp->zone = zone;
6669         (void) strcpy(zargp->arg.locale, "C");
6670         /* mdep was already copied in for us by uadmin */
6671         if (mdep != NULL)
6672                 (void) strlcpy(zargp->arg.bootbuf, mdep,
6673                     sizeof (zargp->arg.bootbuf));
6674         zone_hold(zone);
6675 
6676         (void) thread_create(NULL, 0, zone_ki_call_zoneadmd, zargp, 0, &p0,
6677             TS_RUN, minclsyspri);
6678         exit(CLD_EXITED, 0);
6679 
6680         return (EINVAL);
6681 }
6682 
6683 /*
6684  * Entry point so kadmin(A_SHUTDOWN, ...) can set the global zone's
6685  * status to ZONE_IS_SHUTTING_DOWN.
6686  *
6687  * This function also shuts down all running zones to ensure that they won't
6688  * fork new processes.
6689  */
6690 void
6691 zone_shutdown_global(void)
6692 {
6693         zone_t *current_zonep;
6694 
6695         ASSERT(INGLOBALZONE(curproc));
6696         mutex_enter(&zonehash_lock);
6697         mutex_enter(&zone_status_lock);
6698 
6699         /* Modify the global zone's status first. */
6700         ASSERT(zone_status_get(global_zone) == ZONE_IS_RUNNING);
6701         zone_status_set(global_zone, ZONE_IS_SHUTTING_DOWN);
6702 
6703         /*
6704          * Now change the states of all running zones to ZONE_IS_SHUTTING_DOWN.
6705          * We don't mark all zones with ZONE_IS_SHUTTING_DOWN because doing so
6706          * could cause assertions to fail (e.g., assertions about a zone's
6707          * state during initialization, readying, or booting) or produce races.
6708          * We'll let threads continue to initialize and ready new zones: they'll
6709          * fail to boot the new zones when they see that the global zone is
6710          * shutting down.
6711          */
6712         for (current_zonep = list_head(&zone_active); current_zonep != NULL;
6713             current_zonep = list_next(&zone_active, current_zonep)) {
6714                 if (zone_status_get(current_zonep) == ZONE_IS_RUNNING)
6715                         zone_status_set(current_zonep, ZONE_IS_SHUTTING_DOWN);
6716         }
6717         mutex_exit(&zone_status_lock);
6718         mutex_exit(&zonehash_lock);
6719 }
6720 
6721 /*
6722  * Returns true if the named dataset is visible in the current zone.
6723  * The 'write' parameter is set to 1 if the dataset is also writable.
6724  */
6725 int
6726 zone_dataset_visible(const char *dataset, int *write)
6727 {
6728         static int zfstype = -1;
6729         zone_dataset_t *zd;
6730         size_t len;
6731         zone_t *zone = curproc->p_zone;
6732         const char *name = NULL;
6733         vfs_t *vfsp = NULL;
6734 
6735         if (dataset[0] == '\0')
6736                 return (0);
6737 
6738         /*
6739          * Walk the list once, looking for datasets which match exactly, or
6740          * specify a dataset underneath an exported dataset.  If found, return
6741          * true and note that it is writable.
6742          */
6743         for (zd = list_head(&zone->zone_datasets); zd != NULL;
6744             zd = list_next(&zone->zone_datasets, zd)) {
6745 
6746                 len = strlen(zd->zd_dataset);
6747                 if (strlen(dataset) >= len &&
6748                     bcmp(dataset, zd->zd_dataset, len) == 0 &&
6749                     (dataset[len] == '\0' || dataset[len] == '/' ||
6750                     dataset[len] == '@')) {
6751                         if (write)
6752                                 *write = 1;
6753                         return (1);
6754                 }
6755         }
6756 
6757         /*
6758          * Walk the list a second time, searching for datasets which are parents
6759          * of exported datasets.  These should be visible, but read-only.
6760          *
6761          * Note that we also have to support forms such as 'pool/dataset/', with
6762          * a trailing slash.
6763          */
6764         for (zd = list_head(&zone->zone_datasets); zd != NULL;
6765             zd = list_next(&zone->zone_datasets, zd)) {
6766 
6767                 len = strlen(dataset);
6768                 if (dataset[len - 1] == '/')
6769                         len--;  /* Ignore trailing slash */
6770                 if (len < strlen(zd->zd_dataset) &&
6771                     bcmp(dataset, zd->zd_dataset, len) == 0 &&
6772                     zd->zd_dataset[len] == '/') {
6773                         if (write)
6774                                 *write = 0;
6775                         return (1);
6776                 }
6777         }
6778 
6779         /*
6780          * We reach here if the given dataset is not found in the zone_dataset
6781          * list. Check if this dataset was added as a filesystem (ie. "add fs")
6782          * instead of delegation. For this we search for the dataset in the
6783          * zone_vfslist of this zone. If found, return true and note that it is
6784          * not writable.
6785          */
6786 
6787         /*
6788          * Initialize zfstype if it is not initialized yet.
6789          */
6790         if (zfstype == -1) {
6791                 struct vfssw *vswp = vfs_getvfssw("zfs");
6792                 zfstype = vswp - vfssw;
6793                 vfs_unrefvfssw(vswp);
6794         }
6795 
6796         vfs_list_read_lock();
6797         vfsp = zone->zone_vfslist;
6798         do {
6799                 ASSERT(vfsp);
6800                 if (vfsp->vfs_fstype == zfstype) {
6801                         name = refstr_value(vfsp->vfs_resource);
6802 
6803                         /*
6804                          * Check if we have an exact match.
6805                          */
6806                         if (strcmp(dataset, name) == 0) {
6807                                 vfs_list_unlock();
6808                                 if (write)
6809                                         *write = 0;
6810                                 return (1);
6811                         }
6812                         /*
6813                          * We need to check if we are looking for parents of
6814                          * a dataset. These should be visible, but read-only.
6815                          */
6816                         len = strlen(dataset);
6817                         if (dataset[len - 1] == '/')
6818                                 len--;
6819 
6820                         if (len < strlen(name) &&
6821                             bcmp(dataset, name, len) == 0 && name[len] == '/') {
6822                                 vfs_list_unlock();
6823                                 if (write)
6824                                         *write = 0;
6825                                 return (1);
6826                         }
6827                 }
6828                 vfsp = vfsp->vfs_zone_next;
6829         } while (vfsp != zone->zone_vfslist);
6830 
6831         vfs_list_unlock();
6832         return (0);
6833 }
6834 
6835 /*
6836  * zone_find_by_any_path() -
6837  *
6838  * kernel-private routine similar to zone_find_by_path(), but which
6839  * effectively compares against zone paths rather than zonerootpath
6840  * (i.e., the last component of zonerootpaths, which should be "root/",
6841  * are not compared.)  This is done in order to accurately identify all
6842  * paths, whether zone-visible or not, including those which are parallel
6843  * to /root/, such as /dev/, /home/, etc...
6844  *
6845  * If the specified path does not fall under any zone path then global
6846  * zone is returned.
6847  *
6848  * The treat_abs parameter indicates whether the path should be treated as
6849  * an absolute path although it does not begin with "/".  (This supports
6850  * nfs mount syntax such as host:any/path.)
6851  *
6852  * The caller is responsible for zone_rele of the returned zone.
6853  */
6854 zone_t *
6855 zone_find_by_any_path(const char *path, boolean_t treat_abs)
6856 {
6857         zone_t *zone;
6858         int path_offset = 0;
6859 
6860         if (path == NULL) {
6861                 zone_hold(global_zone);
6862                 return (global_zone);
6863         }
6864 
6865         if (*path != '/') {
6866                 ASSERT(treat_abs);
6867                 path_offset = 1;
6868         }
6869 
6870         mutex_enter(&zonehash_lock);
6871         for (zone = list_head(&zone_active); zone != NULL;
6872             zone = list_next(&zone_active, zone)) {
6873                 char    *c;
6874                 size_t  pathlen;
6875                 char *rootpath_start;
6876 
6877                 if (zone == global_zone)        /* skip global zone */
6878                         continue;
6879 
6880                 /* scan backwards to find start of last component */
6881                 c = zone->zone_rootpath + zone->zone_rootpathlen - 2;
6882                 do {
6883                         c--;
6884                 } while (*c != '/');
6885 
6886                 pathlen = c - zone->zone_rootpath + 1 - path_offset;
6887                 rootpath_start = (zone->zone_rootpath + path_offset);
6888                 if (strncmp(path, rootpath_start, pathlen) == 0)
6889                         break;
6890         }
6891         if (zone == NULL)
6892                 zone = global_zone;
6893         zone_hold(zone);
6894         mutex_exit(&zonehash_lock);
6895         return (zone);
6896 }
6897 
6898 /*
6899  * Finds a zone_dl_t with the given linkid in the given zone.  Returns the
6900  * zone_dl_t pointer if found, and NULL otherwise.
6901  */
6902 static zone_dl_t *
6903 zone_find_dl(zone_t *zone, datalink_id_t linkid)
6904 {
6905         zone_dl_t *zdl;
6906 
6907         ASSERT(mutex_owned(&zone->zone_lock));
6908         for (zdl = list_head(&zone->zone_dl_list); zdl != NULL;
6909             zdl = list_next(&zone->zone_dl_list, zdl)) {
6910                 if (zdl->zdl_id == linkid)
6911                         break;
6912         }
6913         return (zdl);
6914 }
6915 
6916 static boolean_t
6917 zone_dl_exists(zone_t *zone, datalink_id_t linkid)
6918 {
6919         boolean_t exists;
6920 
6921         mutex_enter(&zone->zone_lock);
6922         exists = (zone_find_dl(zone, linkid) != NULL);
6923         mutex_exit(&zone->zone_lock);
6924         return (exists);
6925 }
6926 
6927 /*
6928  * Add an data link name for the zone.
6929  */
6930 static int
6931 zone_add_datalink(zoneid_t zoneid, datalink_id_t linkid)
6932 {
6933         zone_dl_t *zdl;
6934         zone_t *zone;
6935         zone_t *thiszone;
6936 
6937         if ((thiszone = zone_find_by_id(zoneid)) == NULL)
6938                 return (set_errno(ENXIO));
6939 
6940         /* Verify that the datalink ID doesn't already belong to a zone. */
6941         mutex_enter(&zonehash_lock);
6942         for (zone = list_head(&zone_active); zone != NULL;
6943             zone = list_next(&zone_active, zone)) {
6944                 if (zone_dl_exists(zone, linkid)) {
6945                         mutex_exit(&zonehash_lock);
6946                         zone_rele(thiszone);
6947                         return (set_errno((zone == thiszone) ? EEXIST : EPERM));
6948                 }
6949         }
6950 
6951         zdl = kmem_zalloc(sizeof (*zdl), KM_SLEEP);
6952         zdl->zdl_id = linkid;
6953         zdl->zdl_net = NULL;
6954         mutex_enter(&thiszone->zone_lock);
6955         list_insert_head(&thiszone->zone_dl_list, zdl);
6956         mutex_exit(&thiszone->zone_lock);
6957         mutex_exit(&zonehash_lock);
6958         zone_rele(thiszone);
6959         return (0);
6960 }
6961 
6962 static int
6963 zone_remove_datalink(zoneid_t zoneid, datalink_id_t linkid)
6964 {
6965         zone_dl_t *zdl;
6966         zone_t *zone;
6967         int err = 0;
6968 
6969         if ((zone = zone_find_by_id(zoneid)) == NULL)
6970                 return (set_errno(EINVAL));
6971 
6972         mutex_enter(&zone->zone_lock);
6973         if ((zdl = zone_find_dl(zone, linkid)) == NULL) {
6974                 err = ENXIO;
6975         } else {
6976                 list_remove(&zone->zone_dl_list, zdl);
6977                 nvlist_free(zdl->zdl_net);
6978                 kmem_free(zdl, sizeof (zone_dl_t));
6979         }
6980         mutex_exit(&zone->zone_lock);
6981         zone_rele(zone);
6982         return (err == 0 ? 0 : set_errno(err));
6983 }
6984 
6985 /*
6986  * Using the zoneidp as ALL_ZONES, we can lookup which zone has been assigned
6987  * the linkid.  Otherwise we just check if the specified zoneidp has been
6988  * assigned the supplied linkid.
6989  */
6990 int
6991 zone_check_datalink(zoneid_t *zoneidp, datalink_id_t linkid)
6992 {
6993         zone_t *zone;
6994         int err = ENXIO;
6995 
6996         if (*zoneidp != ALL_ZONES) {
6997                 if ((zone = zone_find_by_id(*zoneidp)) != NULL) {
6998                         if (zone_dl_exists(zone, linkid))
6999                                 err = 0;
7000                         zone_rele(zone);
7001                 }
7002                 return (err);
7003         }
7004 
7005         mutex_enter(&zonehash_lock);
7006         for (zone = list_head(&zone_active); zone != NULL;
7007             zone = list_next(&zone_active, zone)) {
7008                 if (zone_dl_exists(zone, linkid)) {
7009                         *zoneidp = zone->zone_id;
7010                         err = 0;
7011                         break;
7012                 }
7013         }
7014         mutex_exit(&zonehash_lock);
7015         return (err);
7016 }
7017 
7018 /*
7019  * Get the list of datalink IDs assigned to a zone.
7020  *
7021  * On input, *nump is the number of datalink IDs that can fit in the supplied
7022  * idarray.  Upon return, *nump is either set to the number of datalink IDs
7023  * that were placed in the array if the array was large enough, or to the
7024  * number of datalink IDs that the function needs to place in the array if the
7025  * array is too small.
7026  */
7027 static int
7028 zone_list_datalink(zoneid_t zoneid, int *nump, datalink_id_t *idarray)
7029 {
7030         uint_t num, dlcount;
7031         zone_t *zone;
7032         zone_dl_t *zdl;
7033         datalink_id_t *idptr = idarray;
7034 
7035         if (copyin(nump, &dlcount, sizeof (dlcount)) != 0)
7036                 return (set_errno(EFAULT));
7037         if ((zone = zone_find_by_id(zoneid)) == NULL)
7038                 return (set_errno(ENXIO));
7039 
7040         num = 0;
7041         mutex_enter(&zone->zone_lock);
7042         for (zdl = list_head(&zone->zone_dl_list); zdl != NULL;
7043             zdl = list_next(&zone->zone_dl_list, zdl)) {
7044                 /*
7045                  * If the list is bigger than what the caller supplied, just
7046                  * count, don't do copyout.
7047                  */
7048                 if (++num > dlcount)
7049                         continue;
7050                 if (copyout(&zdl->zdl_id, idptr, sizeof (*idptr)) != 0) {
7051                         mutex_exit(&zone->zone_lock);
7052                         zone_rele(zone);
7053                         return (set_errno(EFAULT));
7054                 }
7055                 idptr++;
7056         }
7057         mutex_exit(&zone->zone_lock);
7058         zone_rele(zone);
7059 
7060         /* Increased or decreased, caller should be notified. */
7061         if (num != dlcount) {
7062                 if (copyout(&num, nump, sizeof (num)) != 0)
7063                         return (set_errno(EFAULT));
7064         }
7065         return (0);
7066 }
7067 
7068 /*
7069  * Public interface for looking up a zone by zoneid. It's a customized version
7070  * for netstack_zone_create(). It can only be called from the zsd create
7071  * callbacks, since it doesn't have reference on the zone structure hence if
7072  * it is called elsewhere the zone could disappear after the zonehash_lock
7073  * is dropped.
7074  *
7075  * Furthermore it
7076  * 1. Doesn't check the status of the zone.
7077  * 2. It will be called even before zone_init is called, in that case the
7078  *    address of zone0 is returned directly, and netstack_zone_create()
7079  *    will only assign a value to zone0.zone_netstack, won't break anything.
7080  * 3. Returns without the zone being held.
7081  */
7082 zone_t *
7083 zone_find_by_id_nolock(zoneid_t zoneid)
7084 {
7085         zone_t *zone;
7086 
7087         mutex_enter(&zonehash_lock);
7088         if (zonehashbyid == NULL)
7089                 zone = &zone0;
7090         else
7091                 zone = zone_find_all_by_id(zoneid);
7092         mutex_exit(&zonehash_lock);
7093         return (zone);
7094 }
7095 
7096 /*
7097  * Walk the datalinks for a given zone
7098  */
7099 int
7100 zone_datalink_walk(zoneid_t zoneid, int (*cb)(datalink_id_t, void *),
7101     void *data)
7102 {
7103         zone_t          *zone;
7104         zone_dl_t       *zdl;
7105         datalink_id_t   *idarray;
7106         uint_t          idcount = 0;
7107         int             i, ret = 0;
7108 
7109         if ((zone = zone_find_by_id(zoneid)) == NULL)
7110                 return (ENOENT);
7111 
7112         /*
7113          * We first build an array of linkid's so that we can walk these and
7114          * execute the callback with the zone_lock dropped.
7115          */
7116         mutex_enter(&zone->zone_lock);
7117         for (zdl = list_head(&zone->zone_dl_list); zdl != NULL;
7118             zdl = list_next(&zone->zone_dl_list, zdl)) {
7119                 idcount++;
7120         }
7121 
7122         if (idcount == 0) {
7123                 mutex_exit(&zone->zone_lock);
7124                 zone_rele(zone);
7125                 return (0);
7126         }
7127 
7128         idarray = kmem_alloc(sizeof (datalink_id_t) * idcount, KM_NOSLEEP);
7129         if (idarray == NULL) {
7130                 mutex_exit(&zone->zone_lock);
7131                 zone_rele(zone);
7132                 return (ENOMEM);
7133         }
7134 
7135         for (i = 0, zdl = list_head(&zone->zone_dl_list); zdl != NULL;
7136             i++, zdl = list_next(&zone->zone_dl_list, zdl)) {
7137                 idarray[i] = zdl->zdl_id;
7138         }
7139 
7140         mutex_exit(&zone->zone_lock);
7141 
7142         for (i = 0; i < idcount && ret == 0; i++) {
7143                 if ((ret = (*cb)(idarray[i], data)) != 0)
7144                         break;
7145         }
7146 
7147         zone_rele(zone);
7148         kmem_free(idarray, sizeof (datalink_id_t) * idcount);
7149         return (ret);
7150 }
7151 
7152 static char *
7153 zone_net_type2name(int type)
7154 {
7155         switch (type) {
7156         case ZONE_NETWORK_ADDRESS:
7157                 return (ZONE_NET_ADDRNAME);
7158         case ZONE_NETWORK_DEFROUTER:
7159                 return (ZONE_NET_RTRNAME);
7160         default:
7161                 return (NULL);
7162         }
7163 }
7164 
7165 static int
7166 zone_set_network(zoneid_t zoneid, zone_net_data_t *znbuf)
7167 {
7168         zone_t *zone;
7169         zone_dl_t *zdl;
7170         nvlist_t *nvl;
7171         int err = 0;
7172         uint8_t *new = NULL;
7173         char *nvname;
7174         int bufsize;
7175         datalink_id_t linkid = znbuf->zn_linkid;
7176 
7177         if (secpolicy_zone_config(CRED()) != 0)
7178                 return (set_errno(EPERM));
7179 
7180         if (zoneid == GLOBAL_ZONEID)
7181                 return (set_errno(EINVAL));
7182 
7183         nvname = zone_net_type2name(znbuf->zn_type);
7184         bufsize = znbuf->zn_len;
7185         new = znbuf->zn_val;
7186         if (nvname == NULL)
7187                 return (set_errno(EINVAL));
7188 
7189         if ((zone = zone_find_by_id(zoneid)) == NULL) {
7190                 return (set_errno(EINVAL));
7191         }
7192 
7193         mutex_enter(&zone->zone_lock);
7194         if ((zdl = zone_find_dl(zone, linkid)) == NULL) {
7195                 err = ENXIO;
7196                 goto done;
7197         }
7198         if ((nvl = zdl->zdl_net) == NULL) {
7199                 if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP)) {
7200                         err = ENOMEM;
7201                         goto done;
7202                 } else {
7203                         zdl->zdl_net = nvl;
7204                 }
7205         }
7206         if (nvlist_exists(nvl, nvname)) {
7207                 err = EINVAL;
7208                 goto done;
7209         }
7210         err = nvlist_add_uint8_array(nvl, nvname, new, bufsize);
7211         ASSERT(err == 0);
7212 done:
7213         mutex_exit(&zone->zone_lock);
7214         zone_rele(zone);
7215         if (err != 0)
7216                 return (set_errno(err));
7217         else
7218                 return (0);
7219 }
7220 
7221 static int
7222 zone_get_network(zoneid_t zoneid, zone_net_data_t *znbuf)
7223 {
7224         zone_t *zone;
7225         zone_dl_t *zdl;
7226         nvlist_t *nvl;
7227         uint8_t *ptr;
7228         uint_t psize;
7229         int err = 0;
7230         char *nvname;
7231         int bufsize;
7232         void *buf;
7233         datalink_id_t linkid = znbuf->zn_linkid;
7234 
7235         if (zoneid == GLOBAL_ZONEID)
7236                 return (set_errno(EINVAL));
7237 
7238         nvname = zone_net_type2name(znbuf->zn_type);
7239         bufsize = znbuf->zn_len;
7240         buf = znbuf->zn_val;
7241 
7242         if (nvname == NULL)
7243                 return (set_errno(EINVAL));
7244         if ((zone = zone_find_by_id(zoneid)) == NULL)
7245                 return (set_errno(EINVAL));
7246 
7247         mutex_enter(&zone->zone_lock);
7248         if ((zdl = zone_find_dl(zone, linkid)) == NULL) {
7249                 err = ENXIO;
7250                 goto done;
7251         }
7252         if ((nvl = zdl->zdl_net) == NULL || !nvlist_exists(nvl, nvname)) {
7253                 err = ENOENT;
7254                 goto done;
7255         }
7256         err = nvlist_lookup_uint8_array(nvl, nvname, &ptr, &psize);
7257         ASSERT(err == 0);
7258 
7259         if (psize > bufsize) {
7260                 err = ENOBUFS;
7261                 goto done;
7262         }
7263         znbuf->zn_len = psize;
7264         bcopy(ptr, buf, psize);
7265 done:
7266         mutex_exit(&zone->zone_lock);
7267         zone_rele(zone);
7268         if (err != 0)
7269                 return (set_errno(err));
7270         else
7271                 return (0);
7272 }