1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright 2013, Joyent Inc. All rights reserved.
  25  */
  26 
  27 /*
  28  * Zones
  29  *
  30  *   A zone is a named collection of processes, namespace constraints,
  31  *   and other system resources which comprise a secure and manageable
  32  *   application containment facility.
  33  *
  34  *   Zones (represented by the reference counted zone_t) are tracked in
  35  *   the kernel in the zonehash.  Elsewhere in the kernel, Zone IDs
  36  *   (zoneid_t) are used to track zone association.  Zone IDs are
  37  *   dynamically generated when the zone is created; if a persistent
  38  *   identifier is needed (core files, accounting logs, audit trail,
  39  *   etc.), the zone name should be used.
  40  *
  41  *
  42  *   Global Zone:
  43  *
  44  *   The global zone (zoneid 0) is automatically associated with all
  45  *   system resources that have not been bound to a user-created zone.
  46  *   This means that even systems where zones are not in active use
  47  *   have a global zone, and all processes, mounts, etc. are
  48  *   associated with that zone.  The global zone is generally
  49  *   unconstrained in terms of privileges and access, though the usual
  50  *   credential and privilege based restrictions apply.
  51  *
  52  *
  53  *   Zone States:
  54  *
  55  *   The states in which a zone may be in and the transitions are as
  56  *   follows:
  57  *
  58  *   ZONE_IS_UNINITIALIZED: primordial state for a zone. The partially
  59  *   initialized zone is added to the list of active zones on the system but
  60  *   isn't accessible.
  61  *
  62  *   ZONE_IS_INITIALIZED: Initialization complete except the ZSD callbacks are
  63  *   not yet completed. Not possible to enter the zone, but attributes can
  64  *   be retrieved.
  65  *
  66  *   ZONE_IS_READY: zsched (the kernel dummy process for a zone) is
  67  *   ready.  The zone is made visible after the ZSD constructor callbacks are
  68  *   executed.  A zone remains in this state until it transitions into
  69  *   the ZONE_IS_BOOTING state as a result of a call to zone_boot().
  70  *
  71  *   ZONE_IS_BOOTING: in this shortlived-state, zsched attempts to start
  72  *   init.  Should that fail, the zone proceeds to the ZONE_IS_SHUTTING_DOWN
  73  *   state.
  74  *
  75  *   ZONE_IS_RUNNING: The zone is open for business: zsched has
  76  *   successfully started init.   A zone remains in this state until
  77  *   zone_shutdown() is called.
  78  *
  79  *   ZONE_IS_SHUTTING_DOWN: zone_shutdown() has been called, the system is
  80  *   killing all processes running in the zone. The zone remains
  81  *   in this state until there are no more user processes running in the zone.
  82  *   zone_create(), zone_enter(), and zone_destroy() on this zone will fail.
  83  *   Since zone_shutdown() is restartable, it may be called successfully
  84  *   multiple times for the same zone_t.  Setting of the zone's state to
  85  *   ZONE_IS_SHUTTING_DOWN is synchronized with mounts, so VOP_MOUNT() may check
  86  *   the zone's status without worrying about it being a moving target.
  87  *
  88  *   ZONE_IS_EMPTY: zone_shutdown() has been called, and there
  89  *   are no more user processes in the zone.  The zone remains in this
  90  *   state until there are no more kernel threads associated with the
  91  *   zone.  zone_create(), zone_enter(), and zone_destroy() on this zone will
  92  *   fail.
  93  *
  94  *   ZONE_IS_DOWN: All kernel threads doing work on behalf of the zone
  95  *   have exited.  zone_shutdown() returns.  Henceforth it is not possible to
  96  *   join the zone or create kernel threads therein.
  97  *
  98  *   ZONE_IS_DYING: zone_destroy() has been called on the zone; zone
  99  *   remains in this state until zsched exits.  Calls to zone_find_by_*()
 100  *   return NULL from now on.
 101  *
 102  *   ZONE_IS_DEAD: zsched has exited (zone_ntasks == 0).  There are no
 103  *   processes or threads doing work on behalf of the zone.  The zone is
 104  *   removed from the list of active zones.  zone_destroy() returns, and
 105  *   the zone can be recreated.
 106  *
 107  *   ZONE_IS_FREE (internal state): zone_ref goes to 0, ZSD destructor
 108  *   callbacks are executed, and all memory associated with the zone is
 109  *   freed.
 110  *
 111  *   Threads can wait for the zone to enter a requested state by using
 112  *   zone_status_wait() or zone_status_timedwait() with the desired
 113  *   state passed in as an argument.  Zone state transitions are
 114  *   uni-directional; it is not possible to move back to an earlier state.
 115  *
 116  *
 117  *   Zone-Specific Data:
 118  *
 119  *   Subsystems needing to maintain zone-specific data can store that
 120  *   data using the ZSD mechanism.  This provides a zone-specific data
 121  *   store, similar to thread-specific data (see pthread_getspecific(3C)
 122  *   or the TSD code in uts/common/disp/thread.c.  Also, ZSD can be used
 123  *   to register callbacks to be invoked when a zone is created, shut
 124  *   down, or destroyed.  This can be used to initialize zone-specific
 125  *   data for new zones and to clean up when zones go away.
 126  *
 127  *
 128  *   Data Structures:
 129  *
 130  *   The per-zone structure (zone_t) is reference counted, and freed
 131  *   when all references are released.  zone_hold and zone_rele can be
 132  *   used to adjust the reference count.  In addition, reference counts
 133  *   associated with the cred_t structure are tracked separately using
 134  *   zone_cred_hold and zone_cred_rele.
 135  *
 136  *   Pointers to active zone_t's are stored in two hash tables; one
 137  *   for searching by id, the other for searching by name.  Lookups
 138  *   can be performed on either basis, using zone_find_by_id and
 139  *   zone_find_by_name.  Both return zone_t pointers with the zone
 140  *   held, so zone_rele should be called when the pointer is no longer
 141  *   needed.  Zones can also be searched by path; zone_find_by_path
 142  *   returns the zone with which a path name is associated (global
 143  *   zone if the path is not within some other zone's file system
 144  *   hierarchy).  This currently requires iterating through each zone,
 145  *   so it is slower than an id or name search via a hash table.
 146  *
 147  *
 148  *   Locking:
 149  *
 150  *   zonehash_lock: This is a top-level global lock used to protect the
 151  *       zone hash tables and lists.  Zones cannot be created or destroyed
 152  *       while this lock is held.
 153  *   zone_status_lock: This is a global lock protecting zone state.
 154  *       Zones cannot change state while this lock is held.  It also
 155  *       protects the list of kernel threads associated with a zone.
 156  *   zone_lock: This is a per-zone lock used to protect several fields of
 157  *       the zone_t (see <sys/zone.h> for details).  In addition, holding
 158  *       this lock means that the zone cannot go away.
 159  *   zone_nlwps_lock: This is a per-zone lock used to protect the fields
 160  *       related to the zone.max-lwps rctl.
 161  *   zone_mem_lock: This is a per-zone lock used to protect the fields
 162  *       related to the zone.max-locked-memory and zone.max-swap rctls.
 163  *   zone_rctl_lock: This is a per-zone lock used to protect other rctls,
 164  *       currently just max_lofi
 165  *   zsd_key_lock: This is a global lock protecting the key state for ZSD.
 166  *   zone_deathrow_lock: This is a global lock protecting the "deathrow"
 167  *       list (a list of zones in the ZONE_IS_DEAD state).
 168  *
 169  *   Ordering requirements:
 170  *       pool_lock --> cpu_lock --> zonehash_lock --> zone_status_lock -->
 171  *              zone_lock --> zsd_key_lock --> pidlock --> p_lock
 172  *
 173  *   When taking zone_mem_lock or zone_nlwps_lock, the lock ordering is:
 174  *      zonehash_lock --> a_lock --> pidlock --> p_lock --> zone_mem_lock
 175  *      zonehash_lock --> a_lock --> pidlock --> p_lock --> zone_nlwps_lock
 176  *
 177  *   Blocking memory allocations are permitted while holding any of the
 178  *   zone locks.
 179  *
 180  *
 181  *   System Call Interface:
 182  *
 183  *   The zone subsystem can be managed and queried from user level with
 184  *   the following system calls (all subcodes of the primary "zone"
 185  *   system call):
 186  *   - zone_create: creates a zone with selected attributes (name,
 187  *     root path, privileges, resource controls, ZFS datasets)
 188  *   - zone_enter: allows the current process to enter a zone
 189  *   - zone_getattr: reports attributes of a zone
 190  *   - zone_setattr: set attributes of a zone
 191  *   - zone_boot: set 'init' running for the zone
 192  *   - zone_list: lists all zones active in the system
 193  *   - zone_lookup: looks up zone id based on name
 194  *   - zone_shutdown: initiates shutdown process (see states above)
 195  *   - zone_destroy: completes shutdown process (see states above)
 196  *
 197  */
 198 
 199 #include <sys/priv_impl.h>
 200 #include <sys/cred.h>
 201 #include <c2/audit.h>
 202 #include <sys/debug.h>
 203 #include <sys/file.h>
 204 #include <sys/kmem.h>
 205 #include <sys/kstat.h>
 206 #include <sys/mutex.h>
 207 #include <sys/note.h>
 208 #include <sys/pathname.h>
 209 #include <sys/proc.h>
 210 #include <sys/project.h>
 211 #include <sys/sysevent.h>
 212 #include <sys/task.h>
 213 #include <sys/systm.h>
 214 #include <sys/types.h>
 215 #include <sys/utsname.h>
 216 #include <sys/vnode.h>
 217 #include <sys/vfs.h>
 218 #include <sys/systeminfo.h>
 219 #include <sys/policy.h>
 220 #include <sys/cred_impl.h>
 221 #include <sys/contract_impl.h>
 222 #include <sys/contract/process_impl.h>
 223 #include <sys/class.h>
 224 #include <sys/pool.h>
 225 #include <sys/pool_pset.h>
 226 #include <sys/pset.h>
 227 #include <sys/strlog.h>
 228 #include <sys/sysmacros.h>
 229 #include <sys/callb.h>
 230 #include <sys/vmparam.h>
 231 #include <sys/corectl.h>
 232 #include <sys/ipc_impl.h>
 233 #include <sys/klpd.h>
 234 
 235 #include <sys/door.h>
 236 #include <sys/cpuvar.h>
 237 #include <sys/sdt.h>
 238 
 239 #include <sys/uadmin.h>
 240 #include <sys/session.h>
 241 #include <sys/cmn_err.h>
 242 #include <sys/modhash.h>
 243 #include <sys/sunddi.h>
 244 #include <sys/nvpair.h>
 245 #include <sys/rctl.h>
 246 #include <sys/fss.h>
 247 #include <sys/brand.h>
 248 #include <sys/zone.h>
 249 #include <net/if.h>
 250 #include <sys/cpucaps.h>
 251 #include <vm/seg.h>
 252 #include <sys/mac.h>
 253 
 254 /*
 255  * This constant specifies the number of seconds that threads waiting for
 256  * subsystems to release a zone's general-purpose references will wait before
 257  * they log the zone's reference counts.  The constant's value shouldn't
 258  * be so small that reference counts are unnecessarily reported for zones
 259  * whose references are slowly released.  On the other hand, it shouldn't be so
 260  * large that users reboot their systems out of frustration over hung zones
 261  * before the system logs the zones' reference counts.
 262  */
 263 #define ZONE_DESTROY_TIMEOUT_SECS       60
 264 
 265 /* List of data link IDs which are accessible from the zone */
 266 typedef struct zone_dl {
 267         datalink_id_t   zdl_id;
 268         nvlist_t        *zdl_net;
 269         list_node_t     zdl_linkage;
 270 } zone_dl_t;
 271 
 272 /*
 273  * cv used to signal that all references to the zone have been released.  This
 274  * needs to be global since there may be multiple waiters, and the first to
 275  * wake up will free the zone_t, hence we cannot use zone->zone_cv.
 276  */
 277 static kcondvar_t zone_destroy_cv;
 278 /*
 279  * Lock used to serialize access to zone_cv.  This could have been per-zone,
 280  * but then we'd need another lock for zone_destroy_cv, and why bother?
 281  */
 282 static kmutex_t zone_status_lock;
 283 
 284 /*
 285  * ZSD-related global variables.
 286  */
 287 static kmutex_t zsd_key_lock;   /* protects the following two */
 288 /*
 289  * The next caller of zone_key_create() will be assigned a key of ++zsd_keyval.
 290  */
 291 static zone_key_t zsd_keyval = 0;
 292 /*
 293  * Global list of registered keys.  We use this when a new zone is created.
 294  */
 295 static list_t zsd_registered_keys;
 296 
 297 int zone_hash_size = 256;
 298 static mod_hash_t *zonehashbyname, *zonehashbyid, *zonehashbylabel;
 299 static kmutex_t zonehash_lock;
 300 static uint_t zonecount;
 301 static id_space_t *zoneid_space;
 302 
 303 /*
 304  * The global zone (aka zone0) is the all-seeing, all-knowing zone in which the
 305  * kernel proper runs, and which manages all other zones.
 306  *
 307  * Although not declared as static, the variable "zone0" should not be used
 308  * except for by code that needs to reference the global zone early on in boot,
 309  * before it is fully initialized.  All other consumers should use
 310  * 'global_zone'.
 311  */
 312 zone_t zone0;
 313 zone_t *global_zone = NULL;     /* Set when the global zone is initialized */
 314 
 315 /*
 316  * List of active zones, protected by zonehash_lock.
 317  */
 318 static list_t zone_active;
 319 
 320 /*
 321  * List of destroyed zones that still have outstanding cred references.
 322  * Used for debugging.  Uses a separate lock to avoid lock ordering
 323  * problems in zone_free.
 324  */
 325 static list_t zone_deathrow;
 326 static kmutex_t zone_deathrow_lock;
 327 
 328 /* number of zones is limited by virtual interface limit in IP */
 329 uint_t maxzones = 8192;
 330 
 331 /* Event channel to sent zone state change notifications */
 332 evchan_t *zone_event_chan;
 333 
 334 /*
 335  * This table holds the mapping from kernel zone states to
 336  * states visible in the state notification API.
 337  * The idea is that we only expose "obvious" states and
 338  * do not expose states which are just implementation details.
 339  */
 340 const char  *zone_status_table[] = {
 341         ZONE_EVENT_UNINITIALIZED,       /* uninitialized */
 342         ZONE_EVENT_INITIALIZED,         /* initialized */
 343         ZONE_EVENT_READY,               /* ready */
 344         ZONE_EVENT_READY,               /* booting */
 345         ZONE_EVENT_RUNNING,             /* running */
 346         ZONE_EVENT_SHUTTING_DOWN,       /* shutting_down */
 347         ZONE_EVENT_SHUTTING_DOWN,       /* empty */
 348         ZONE_EVENT_SHUTTING_DOWN,       /* down */
 349         ZONE_EVENT_SHUTTING_DOWN,       /* dying */
 350         ZONE_EVENT_UNINITIALIZED,       /* dead */
 351 };
 352 
 353 /*
 354  * This array contains the names of the subsystems listed in zone_ref_subsys_t
 355  * (see sys/zone.h).
 356  */
 357 static char *zone_ref_subsys_names[] = {
 358         "NFS",          /* ZONE_REF_NFS */
 359         "NFSv4",        /* ZONE_REF_NFSV4 */
 360         "SMBFS",        /* ZONE_REF_SMBFS */
 361         "MNTFS",        /* ZONE_REF_MNTFS */
 362         "LOFI",         /* ZONE_REF_LOFI */
 363         "VFS",          /* ZONE_REF_VFS */
 364         "IPC"           /* ZONE_REF_IPC */
 365 };
 366 
 367 /*
 368  * This isn't static so lint doesn't complain.
 369  */
 370 rctl_hndl_t rc_zone_cpu_shares;
 371 rctl_hndl_t rc_zone_locked_mem;
 372 rctl_hndl_t rc_zone_max_swap;
 373 rctl_hndl_t rc_zone_max_lofi;
 374 rctl_hndl_t rc_zone_cpu_cap;
 375 rctl_hndl_t rc_zone_nlwps;
 376 rctl_hndl_t rc_zone_nprocs;
 377 rctl_hndl_t rc_zone_shmmax;
 378 rctl_hndl_t rc_zone_shmmni;
 379 rctl_hndl_t rc_zone_semmni;
 380 rctl_hndl_t rc_zone_msgmni;
 381 /*
 382  * Synchronization primitives used to synchronize between mounts and zone
 383  * creation/destruction.
 384  */
 385 static int mounts_in_progress;
 386 static kcondvar_t mount_cv;
 387 static kmutex_t mount_lock;
 388 
 389 const char * const zone_default_initname = "/sbin/init";
 390 static char * const zone_prefix = "/zone/";
 391 static int zone_shutdown(zoneid_t zoneid);
 392 static int zone_add_datalink(zoneid_t, datalink_id_t);
 393 static int zone_remove_datalink(zoneid_t, datalink_id_t);
 394 static int zone_list_datalink(zoneid_t, int *, datalink_id_t *);
 395 static int zone_set_network(zoneid_t, zone_net_data_t *);
 396 static int zone_get_network(zoneid_t, zone_net_data_t *);
 397 
 398 typedef boolean_t zsd_applyfn_t(kmutex_t *, boolean_t, zone_t *, zone_key_t);
 399 
 400 static void zsd_apply_all_zones(zsd_applyfn_t *, zone_key_t);
 401 static void zsd_apply_all_keys(zsd_applyfn_t *, zone_t *);
 402 static boolean_t zsd_apply_create(kmutex_t *, boolean_t, zone_t *, zone_key_t);
 403 static boolean_t zsd_apply_shutdown(kmutex_t *, boolean_t, zone_t *,
 404     zone_key_t);
 405 static boolean_t zsd_apply_destroy(kmutex_t *, boolean_t, zone_t *, zone_key_t);
 406 static boolean_t zsd_wait_for_creator(zone_t *, struct zsd_entry *,
 407     kmutex_t *);
 408 static boolean_t zsd_wait_for_inprogress(zone_t *, struct zsd_entry *,
 409     kmutex_t *);
 410 
 411 /*
 412  * Bump this number when you alter the zone syscall interfaces; this is
 413  * because we need to have support for previous API versions in libc
 414  * to support patching; libc calls into the kernel to determine this number.
 415  *
 416  * Version 1 of the API is the version originally shipped with Solaris 10
 417  * Version 2 alters the zone_create system call in order to support more
 418  *     arguments by moving the args into a structure; and to do better
 419  *     error reporting when zone_create() fails.
 420  * Version 3 alters the zone_create system call in order to support the
 421  *     import of ZFS datasets to zones.
 422  * Version 4 alters the zone_create system call in order to support
 423  *     Trusted Extensions.
 424  * Version 5 alters the zone_boot system call, and converts its old
 425  *     bootargs parameter to be set by the zone_setattr API instead.
 426  * Version 6 adds the flag argument to zone_create.
 427  */
 428 static const int ZONE_SYSCALL_API_VERSION = 6;
 429 
 430 /*
 431  * Certain filesystems (such as NFS and autofs) need to know which zone
 432  * the mount is being placed in.  Because of this, we need to be able to
 433  * ensure that a zone isn't in the process of being created such that
 434  * nfs_mount() thinks it is in the global zone, while by the time it
 435  * gets added the list of mounted zones, it ends up on zoneA's mount
 436  * list.
 437  *
 438  * The following functions: block_mounts()/resume_mounts() and
 439  * mount_in_progress()/mount_completed() are used by zones and the VFS
 440  * layer (respectively) to synchronize zone creation and new mounts.
 441  *
 442  * The semantics are like a reader-reader lock such that there may
 443  * either be multiple mounts (or zone creations, if that weren't
 444  * serialized by zonehash_lock) in progress at the same time, but not
 445  * both.
 446  *
 447  * We use cv's so the user can ctrl-C out of the operation if it's
 448  * taking too long.
 449  *
 450  * The semantics are such that there is unfair bias towards the
 451  * "current" operation.  This means that zone creations may starve if
 452  * there is a rapid succession of new mounts coming in to the system, or
 453  * there is a remote possibility that zones will be created at such a
 454  * rate that new mounts will not be able to proceed.
 455  */
 456 /*
 457  * Prevent new mounts from progressing to the point of calling
 458  * VFS_MOUNT().  If there are already mounts in this "region", wait for
 459  * them to complete.
 460  */
 461 static int
 462 block_mounts(void)
 463 {
 464         int retval = 0;
 465 
 466         /*
 467          * Since it may block for a long time, block_mounts() shouldn't be
 468          * called with zonehash_lock held.
 469          */
 470         ASSERT(MUTEX_NOT_HELD(&zonehash_lock));
 471         mutex_enter(&mount_lock);
 472         while (mounts_in_progress > 0) {
 473                 if (cv_wait_sig(&mount_cv, &mount_lock) == 0)
 474                         goto signaled;
 475         }
 476         /*
 477          * A negative value of mounts_in_progress indicates that mounts
 478          * have been blocked by (-mounts_in_progress) different callers.
 479          */
 480         mounts_in_progress--;
 481         retval = 1;
 482 signaled:
 483         mutex_exit(&mount_lock);
 484         return (retval);
 485 }
 486 
 487 /*
 488  * The VFS layer may progress with new mounts as far as we're concerned.
 489  * Allow them to progress if we were the last obstacle.
 490  */
 491 static void
 492 resume_mounts(void)
 493 {
 494         mutex_enter(&mount_lock);
 495         if (++mounts_in_progress == 0)
 496                 cv_broadcast(&mount_cv);
 497         mutex_exit(&mount_lock);
 498 }
 499 
 500 /*
 501  * The VFS layer is busy with a mount; zones should wait until all
 502  * mounts are completed to progress.
 503  */
 504 void
 505 mount_in_progress(void)
 506 {
 507         mutex_enter(&mount_lock);
 508         while (mounts_in_progress < 0)
 509                 cv_wait(&mount_cv, &mount_lock);
 510         mounts_in_progress++;
 511         mutex_exit(&mount_lock);
 512 }
 513 
 514 /*
 515  * VFS is done with one mount; wake up any waiting block_mounts()
 516  * callers if this is the last mount.
 517  */
 518 void
 519 mount_completed(void)
 520 {
 521         mutex_enter(&mount_lock);
 522         if (--mounts_in_progress == 0)
 523                 cv_broadcast(&mount_cv);
 524         mutex_exit(&mount_lock);
 525 }
 526 
 527 /*
 528  * ZSD routines.
 529  *
 530  * Zone Specific Data (ZSD) is modeled after Thread Specific Data as
 531  * defined by the pthread_key_create() and related interfaces.
 532  *
 533  * Kernel subsystems may register one or more data items and/or
 534  * callbacks to be executed when a zone is created, shutdown, or
 535  * destroyed.
 536  *
 537  * Unlike the thread counterpart, destructor callbacks will be executed
 538  * even if the data pointer is NULL and/or there are no constructor
 539  * callbacks, so it is the responsibility of such callbacks to check for
 540  * NULL data values if necessary.
 541  *
 542  * The locking strategy and overall picture is as follows:
 543  *
 544  * When someone calls zone_key_create(), a template ZSD entry is added to the
 545  * global list "zsd_registered_keys", protected by zsd_key_lock.  While
 546  * holding that lock all the existing zones are marked as
 547  * ZSD_CREATE_NEEDED and a copy of the ZSD entry added to the per-zone
 548  * zone_zsd list (protected by zone_lock). The global list is updated first
 549  * (under zone_key_lock) to make sure that newly created zones use the
 550  * most recent list of keys. Then under zonehash_lock we walk the zones
 551  * and mark them.  Similar locking is used in zone_key_delete().
 552  *
 553  * The actual create, shutdown, and destroy callbacks are done without
 554  * holding any lock. And zsd_flags are used to ensure that the operations
 555  * completed so that when zone_key_create (and zone_create) is done, as well as
 556  * zone_key_delete (and zone_destroy) is done, all the necessary callbacks
 557  * are completed.
 558  *
 559  * When new zones are created constructor callbacks for all registered ZSD
 560  * entries will be called. That also uses the above two phases of marking
 561  * what needs to be done, and then running the callbacks without holding
 562  * any locks.
 563  *
 564  * The framework does not provide any locking around zone_getspecific() and
 565  * zone_setspecific() apart from that needed for internal consistency, so
 566  * callers interested in atomic "test-and-set" semantics will need to provide
 567  * their own locking.
 568  */
 569 
 570 /*
 571  * Helper function to find the zsd_entry associated with the key in the
 572  * given list.
 573  */
 574 static struct zsd_entry *
 575 zsd_find(list_t *l, zone_key_t key)
 576 {
 577         struct zsd_entry *zsd;
 578 
 579         for (zsd = list_head(l); zsd != NULL; zsd = list_next(l, zsd)) {
 580                 if (zsd->zsd_key == key) {
 581                         return (zsd);
 582                 }
 583         }
 584         return (NULL);
 585 }
 586 
 587 /*
 588  * Helper function to find the zsd_entry associated with the key in the
 589  * given list. Move it to the front of the list.
 590  */
 591 static struct zsd_entry *
 592 zsd_find_mru(list_t *l, zone_key_t key)
 593 {
 594         struct zsd_entry *zsd;
 595 
 596         for (zsd = list_head(l); zsd != NULL; zsd = list_next(l, zsd)) {
 597                 if (zsd->zsd_key == key) {
 598                         /*
 599                          * Move to head of list to keep list in MRU order.
 600                          */
 601                         if (zsd != list_head(l)) {
 602                                 list_remove(l, zsd);
 603                                 list_insert_head(l, zsd);
 604                         }
 605                         return (zsd);
 606                 }
 607         }
 608         return (NULL);
 609 }
 610 
 611 void
 612 zone_key_create(zone_key_t *keyp, void *(*create)(zoneid_t),
 613     void (*shutdown)(zoneid_t, void *), void (*destroy)(zoneid_t, void *))
 614 {
 615         struct zsd_entry *zsdp;
 616         struct zsd_entry *t;
 617         struct zone *zone;
 618         zone_key_t  key;
 619 
 620         zsdp = kmem_zalloc(sizeof (*zsdp), KM_SLEEP);
 621         zsdp->zsd_data = NULL;
 622         zsdp->zsd_create = create;
 623         zsdp->zsd_shutdown = shutdown;
 624         zsdp->zsd_destroy = destroy;
 625 
 626         /*
 627          * Insert in global list of callbacks. Makes future zone creations
 628          * see it.
 629          */
 630         mutex_enter(&zsd_key_lock);
 631         key = zsdp->zsd_key = ++zsd_keyval;
 632         ASSERT(zsd_keyval != 0);
 633         list_insert_tail(&zsd_registered_keys, zsdp);
 634         mutex_exit(&zsd_key_lock);
 635 
 636         /*
 637          * Insert for all existing zones and mark them as needing
 638          * a create callback.
 639          */
 640         mutex_enter(&zonehash_lock);        /* stop the world */
 641         for (zone = list_head(&zone_active); zone != NULL;
 642             zone = list_next(&zone_active, zone)) {
 643                 zone_status_t status;
 644 
 645                 mutex_enter(&zone->zone_lock);
 646 
 647                 /* Skip zones that are on the way down or not yet up */
 648                 status = zone_status_get(zone);
 649                 if (status >= ZONE_IS_DOWN ||
 650                     status == ZONE_IS_UNINITIALIZED) {
 651                         mutex_exit(&zone->zone_lock);
 652                         continue;
 653                 }
 654 
 655                 t = zsd_find_mru(&zone->zone_zsd, key);
 656                 if (t != NULL) {
 657                         /*
 658                          * A zsd_configure already inserted it after
 659                          * we dropped zsd_key_lock above.
 660                          */
 661                         mutex_exit(&zone->zone_lock);
 662                         continue;
 663                 }
 664                 t = kmem_zalloc(sizeof (*t), KM_SLEEP);
 665                 t->zsd_key = key;
 666                 t->zsd_create = create;
 667                 t->zsd_shutdown = shutdown;
 668                 t->zsd_destroy = destroy;
 669                 if (create != NULL) {
 670                         t->zsd_flags = ZSD_CREATE_NEEDED;
 671                         DTRACE_PROBE2(zsd__create__needed,
 672                             zone_t *, zone, zone_key_t, key);
 673                 }
 674                 list_insert_tail(&zone->zone_zsd, t);
 675                 mutex_exit(&zone->zone_lock);
 676         }
 677         mutex_exit(&zonehash_lock);
 678 
 679         if (create != NULL) {
 680                 /* Now call the create callback for this key */
 681                 zsd_apply_all_zones(zsd_apply_create, key);
 682         }
 683         /*
 684          * It is safe for consumers to use the key now, make it
 685          * globally visible. Specifically zone_getspecific() will
 686          * always successfully return the zone specific data associated
 687          * with the key.
 688          */
 689         *keyp = key;
 690 
 691 }
 692 
 693 /*
 694  * Function called when a module is being unloaded, or otherwise wishes
 695  * to unregister its ZSD key and callbacks.
 696  *
 697  * Remove from the global list and determine the functions that need to
 698  * be called under a global lock. Then call the functions without
 699  * holding any locks. Finally free up the zone_zsd entries. (The apply
 700  * functions need to access the zone_zsd entries to find zsd_data etc.)
 701  */
 702 int
 703 zone_key_delete(zone_key_t key)
 704 {
 705         struct zsd_entry *zsdp = NULL;
 706         zone_t *zone;
 707 
 708         mutex_enter(&zsd_key_lock);
 709         zsdp = zsd_find_mru(&zsd_registered_keys, key);
 710         if (zsdp == NULL) {
 711                 mutex_exit(&zsd_key_lock);
 712                 return (-1);
 713         }
 714         list_remove(&zsd_registered_keys, zsdp);
 715         mutex_exit(&zsd_key_lock);
 716 
 717         mutex_enter(&zonehash_lock);
 718         for (zone = list_head(&zone_active); zone != NULL;
 719             zone = list_next(&zone_active, zone)) {
 720                 struct zsd_entry *del;
 721 
 722                 mutex_enter(&zone->zone_lock);
 723                 del = zsd_find_mru(&zone->zone_zsd, key);
 724                 if (del == NULL) {
 725                         /*
 726                          * Somebody else got here first e.g the zone going
 727                          * away.
 728                          */
 729                         mutex_exit(&zone->zone_lock);
 730                         continue;
 731                 }
 732                 ASSERT(del->zsd_shutdown == zsdp->zsd_shutdown);
 733                 ASSERT(del->zsd_destroy == zsdp->zsd_destroy);
 734                 if (del->zsd_shutdown != NULL &&
 735                     (del->zsd_flags & ZSD_SHUTDOWN_ALL) == 0) {
 736                         del->zsd_flags |= ZSD_SHUTDOWN_NEEDED;
 737                         DTRACE_PROBE2(zsd__shutdown__needed,
 738                             zone_t *, zone, zone_key_t, key);
 739                 }
 740                 if (del->zsd_destroy != NULL &&
 741                     (del->zsd_flags & ZSD_DESTROY_ALL) == 0) {
 742                         del->zsd_flags |= ZSD_DESTROY_NEEDED;
 743                         DTRACE_PROBE2(zsd__destroy__needed,
 744                             zone_t *, zone, zone_key_t, key);
 745                 }
 746                 mutex_exit(&zone->zone_lock);
 747         }
 748         mutex_exit(&zonehash_lock);
 749         kmem_free(zsdp, sizeof (*zsdp));
 750 
 751         /* Now call the shutdown and destroy callback for this key */
 752         zsd_apply_all_zones(zsd_apply_shutdown, key);
 753         zsd_apply_all_zones(zsd_apply_destroy, key);
 754 
 755         /* Now we can free up the zsdp structures in each zone */
 756         mutex_enter(&zonehash_lock);
 757         for (zone = list_head(&zone_active); zone != NULL;
 758             zone = list_next(&zone_active, zone)) {
 759                 struct zsd_entry *del;
 760 
 761                 mutex_enter(&zone->zone_lock);
 762                 del = zsd_find(&zone->zone_zsd, key);
 763                 if (del != NULL) {
 764                         list_remove(&zone->zone_zsd, del);
 765                         ASSERT(!(del->zsd_flags & ZSD_ALL_INPROGRESS));
 766                         kmem_free(del, sizeof (*del));
 767                 }
 768                 mutex_exit(&zone->zone_lock);
 769         }
 770         mutex_exit(&zonehash_lock);
 771 
 772         return (0);
 773 }
 774 
 775 /*
 776  * ZSD counterpart of pthread_setspecific().
 777  *
 778  * Since all zsd callbacks, including those with no create function,
 779  * have an entry in zone_zsd, if the key is registered it is part of
 780  * the zone_zsd list.
 781  * Return an error if the key wasn't registerd.
 782  */
 783 int
 784 zone_setspecific(zone_key_t key, zone_t *zone, const void *data)
 785 {
 786         struct zsd_entry *t;
 787 
 788         mutex_enter(&zone->zone_lock);
 789         t = zsd_find_mru(&zone->zone_zsd, key);
 790         if (t != NULL) {
 791                 /*
 792                  * Replace old value with new
 793                  */
 794                 t->zsd_data = (void *)data;
 795                 mutex_exit(&zone->zone_lock);
 796                 return (0);
 797         }
 798         mutex_exit(&zone->zone_lock);
 799         return (-1);
 800 }
 801 
 802 /*
 803  * ZSD counterpart of pthread_getspecific().
 804  */
 805 void *
 806 zone_getspecific(zone_key_t key, zone_t *zone)
 807 {
 808         struct zsd_entry *t;
 809         void *data;
 810 
 811         mutex_enter(&zone->zone_lock);
 812         t = zsd_find_mru(&zone->zone_zsd, key);
 813         data = (t == NULL ? NULL : t->zsd_data);
 814         mutex_exit(&zone->zone_lock);
 815         return (data);
 816 }
 817 
 818 /*
 819  * Function used to initialize a zone's list of ZSD callbacks and data
 820  * when the zone is being created.  The callbacks are initialized from
 821  * the template list (zsd_registered_keys). The constructor callback is
 822  * executed later (once the zone exists and with locks dropped).
 823  */
 824 static void
 825 zone_zsd_configure(zone_t *zone)
 826 {
 827         struct zsd_entry *zsdp;
 828         struct zsd_entry *t;
 829 
 830         ASSERT(MUTEX_HELD(&zonehash_lock));
 831         ASSERT(list_head(&zone->zone_zsd) == NULL);
 832         mutex_enter(&zone->zone_lock);
 833         mutex_enter(&zsd_key_lock);
 834         for (zsdp = list_head(&zsd_registered_keys); zsdp != NULL;
 835             zsdp = list_next(&zsd_registered_keys, zsdp)) {
 836                 /*
 837                  * Since this zone is ZONE_IS_UNCONFIGURED, zone_key_create
 838                  * should not have added anything to it.
 839                  */
 840                 ASSERT(zsd_find(&zone->zone_zsd, zsdp->zsd_key) == NULL);
 841 
 842                 t = kmem_zalloc(sizeof (*t), KM_SLEEP);
 843                 t->zsd_key = zsdp->zsd_key;
 844                 t->zsd_create = zsdp->zsd_create;
 845                 t->zsd_shutdown = zsdp->zsd_shutdown;
 846                 t->zsd_destroy = zsdp->zsd_destroy;
 847                 if (zsdp->zsd_create != NULL) {
 848                         t->zsd_flags = ZSD_CREATE_NEEDED;
 849                         DTRACE_PROBE2(zsd__create__needed,
 850                             zone_t *, zone, zone_key_t, zsdp->zsd_key);
 851                 }
 852                 list_insert_tail(&zone->zone_zsd, t);
 853         }
 854         mutex_exit(&zsd_key_lock);
 855         mutex_exit(&zone->zone_lock);
 856 }
 857 
 858 enum zsd_callback_type { ZSD_CREATE, ZSD_SHUTDOWN, ZSD_DESTROY };
 859 
 860 /*
 861  * Helper function to execute shutdown or destructor callbacks.
 862  */
 863 static void
 864 zone_zsd_callbacks(zone_t *zone, enum zsd_callback_type ct)
 865 {
 866         struct zsd_entry *t;
 867 
 868         ASSERT(ct == ZSD_SHUTDOWN || ct == ZSD_DESTROY);
 869         ASSERT(ct != ZSD_SHUTDOWN || zone_status_get(zone) >= ZONE_IS_EMPTY);
 870         ASSERT(ct != ZSD_DESTROY || zone_status_get(zone) >= ZONE_IS_DOWN);
 871 
 872         /*
 873          * Run the callback solely based on what is registered for the zone
 874          * in zone_zsd. The global list can change independently of this
 875          * as keys are registered and unregistered and we don't register new
 876          * callbacks for a zone that is in the process of going away.
 877          */
 878         mutex_enter(&zone->zone_lock);
 879         for (t = list_head(&zone->zone_zsd); t != NULL;
 880             t = list_next(&zone->zone_zsd, t)) {
 881                 zone_key_t key = t->zsd_key;
 882 
 883                 /* Skip if no callbacks registered */
 884 
 885                 if (ct == ZSD_SHUTDOWN) {
 886                         if (t->zsd_shutdown != NULL &&
 887                             (t->zsd_flags & ZSD_SHUTDOWN_ALL) == 0) {
 888                                 t->zsd_flags |= ZSD_SHUTDOWN_NEEDED;
 889                                 DTRACE_PROBE2(zsd__shutdown__needed,
 890                                     zone_t *, zone, zone_key_t, key);
 891                         }
 892                 } else {
 893                         if (t->zsd_destroy != NULL &&
 894                             (t->zsd_flags & ZSD_DESTROY_ALL) == 0) {
 895                                 t->zsd_flags |= ZSD_DESTROY_NEEDED;
 896                                 DTRACE_PROBE2(zsd__destroy__needed,
 897                                     zone_t *, zone, zone_key_t, key);
 898                         }
 899                 }
 900         }
 901         mutex_exit(&zone->zone_lock);
 902 
 903         /* Now call the shutdown and destroy callback for this key */
 904         zsd_apply_all_keys(zsd_apply_shutdown, zone);
 905         zsd_apply_all_keys(zsd_apply_destroy, zone);
 906 
 907 }
 908 
 909 /*
 910  * Called when the zone is going away; free ZSD-related memory, and
 911  * destroy the zone_zsd list.
 912  */
 913 static void
 914 zone_free_zsd(zone_t *zone)
 915 {
 916         struct zsd_entry *t, *next;
 917 
 918         /*
 919          * Free all the zsd_entry's we had on this zone.
 920          */
 921         mutex_enter(&zone->zone_lock);
 922         for (t = list_head(&zone->zone_zsd); t != NULL; t = next) {
 923                 next = list_next(&zone->zone_zsd, t);
 924                 list_remove(&zone->zone_zsd, t);
 925                 ASSERT(!(t->zsd_flags & ZSD_ALL_INPROGRESS));
 926                 kmem_free(t, sizeof (*t));
 927         }
 928         list_destroy(&zone->zone_zsd);
 929         mutex_exit(&zone->zone_lock);
 930 
 931 }
 932 
 933 /*
 934  * Apply a function to all zones for particular key value.
 935  *
 936  * The applyfn has to drop zonehash_lock if it does some work, and
 937  * then reacquire it before it returns.
 938  * When the lock is dropped we don't follow list_next even
 939  * if it is possible to do so without any hazards. This is
 940  * because we want the design to allow for the list of zones
 941  * to change in any arbitrary way during the time the
 942  * lock was dropped.
 943  *
 944  * It is safe to restart the loop at list_head since the applyfn
 945  * changes the zsd_flags as it does work, so a subsequent
 946  * pass through will have no effect in applyfn, hence the loop will terminate
 947  * in at worst O(N^2).
 948  */
 949 static void
 950 zsd_apply_all_zones(zsd_applyfn_t *applyfn, zone_key_t key)
 951 {
 952         zone_t *zone;
 953 
 954         mutex_enter(&zonehash_lock);
 955         zone = list_head(&zone_active);
 956         while (zone != NULL) {
 957                 if ((applyfn)(&zonehash_lock, B_FALSE, zone, key)) {
 958                         /* Lock dropped - restart at head */
 959                         zone = list_head(&zone_active);
 960                 } else {
 961                         zone = list_next(&zone_active, zone);
 962                 }
 963         }
 964         mutex_exit(&zonehash_lock);
 965 }
 966 
 967 /*
 968  * Apply a function to all keys for a particular zone.
 969  *
 970  * The applyfn has to drop zonehash_lock if it does some work, and
 971  * then reacquire it before it returns.
 972  * When the lock is dropped we don't follow list_next even
 973  * if it is possible to do so without any hazards. This is
 974  * because we want the design to allow for the list of zsd callbacks
 975  * to change in any arbitrary way during the time the
 976  * lock was dropped.
 977  *
 978  * It is safe to restart the loop at list_head since the applyfn
 979  * changes the zsd_flags as it does work, so a subsequent
 980  * pass through will have no effect in applyfn, hence the loop will terminate
 981  * in at worst O(N^2).
 982  */
 983 static void
 984 zsd_apply_all_keys(zsd_applyfn_t *applyfn, zone_t *zone)
 985 {
 986         struct zsd_entry *t;
 987 
 988         mutex_enter(&zone->zone_lock);
 989         t = list_head(&zone->zone_zsd);
 990         while (t != NULL) {
 991                 if ((applyfn)(NULL, B_TRUE, zone, t->zsd_key)) {
 992                         /* Lock dropped - restart at head */
 993                         t = list_head(&zone->zone_zsd);
 994                 } else {
 995                         t = list_next(&zone->zone_zsd, t);
 996                 }
 997         }
 998         mutex_exit(&zone->zone_lock);
 999 }
1000 
1001 /*
1002  * Call the create function for the zone and key if CREATE_NEEDED
1003  * is set.
1004  * If some other thread gets here first and sets CREATE_INPROGRESS, then
1005  * we wait for that thread to complete so that we can ensure that
1006  * all the callbacks are done when we've looped over all zones/keys.
1007  *
1008  * When we call the create function, we drop the global held by the
1009  * caller, and return true to tell the caller it needs to re-evalute the
1010  * state.
1011  * If the caller holds zone_lock then zone_lock_held is set, and zone_lock
1012  * remains held on exit.
1013  */
1014 static boolean_t
1015 zsd_apply_create(kmutex_t *lockp, boolean_t zone_lock_held,
1016     zone_t *zone, zone_key_t key)
1017 {
1018         void *result;
1019         struct zsd_entry *t;
1020         boolean_t dropped;
1021 
1022         if (lockp != NULL) {
1023                 ASSERT(MUTEX_HELD(lockp));
1024         }
1025         if (zone_lock_held) {
1026                 ASSERT(MUTEX_HELD(&zone->zone_lock));
1027         } else {
1028                 mutex_enter(&zone->zone_lock);
1029         }
1030 
1031         t = zsd_find(&zone->zone_zsd, key);
1032         if (t == NULL) {
1033                 /*
1034                  * Somebody else got here first e.g the zone going
1035                  * away.
1036                  */
1037                 if (!zone_lock_held)
1038                         mutex_exit(&zone->zone_lock);
1039                 return (B_FALSE);
1040         }
1041         dropped = B_FALSE;
1042         if (zsd_wait_for_inprogress(zone, t, lockp))
1043                 dropped = B_TRUE;
1044 
1045         if (t->zsd_flags & ZSD_CREATE_NEEDED) {
1046                 t->zsd_flags &= ~ZSD_CREATE_NEEDED;
1047                 t->zsd_flags |= ZSD_CREATE_INPROGRESS;
1048                 DTRACE_PROBE2(zsd__create__inprogress,
1049                     zone_t *, zone, zone_key_t, key);
1050                 mutex_exit(&zone->zone_lock);
1051                 if (lockp != NULL)
1052                         mutex_exit(lockp);
1053 
1054                 dropped = B_TRUE;
1055                 ASSERT(t->zsd_create != NULL);
1056                 DTRACE_PROBE2(zsd__create__start,
1057                     zone_t *, zone, zone_key_t, key);
1058 
1059                 result = (*t->zsd_create)(zone->zone_id);
1060 
1061                 DTRACE_PROBE2(zsd__create__end,
1062                     zone_t *, zone, voidn *, result);
1063 
1064                 ASSERT(result != NULL);
1065                 if (lockp != NULL)
1066                         mutex_enter(lockp);
1067                 mutex_enter(&zone->zone_lock);
1068                 t->zsd_data = result;
1069                 t->zsd_flags &= ~ZSD_CREATE_INPROGRESS;
1070                 t->zsd_flags |= ZSD_CREATE_COMPLETED;
1071                 cv_broadcast(&t->zsd_cv);
1072                 DTRACE_PROBE2(zsd__create__completed,
1073                     zone_t *, zone, zone_key_t, key);
1074         }
1075         if (!zone_lock_held)
1076                 mutex_exit(&zone->zone_lock);
1077         return (dropped);
1078 }
1079 
1080 /*
1081  * Call the shutdown function for the zone and key if SHUTDOWN_NEEDED
1082  * is set.
1083  * If some other thread gets here first and sets *_INPROGRESS, then
1084  * we wait for that thread to complete so that we can ensure that
1085  * all the callbacks are done when we've looped over all zones/keys.
1086  *
1087  * When we call the shutdown function, we drop the global held by the
1088  * caller, and return true to tell the caller it needs to re-evalute the
1089  * state.
1090  * If the caller holds zone_lock then zone_lock_held is set, and zone_lock
1091  * remains held on exit.
1092  */
1093 static boolean_t
1094 zsd_apply_shutdown(kmutex_t *lockp, boolean_t zone_lock_held,
1095     zone_t *zone, zone_key_t key)
1096 {
1097         struct zsd_entry *t;
1098         void *data;
1099         boolean_t dropped;
1100 
1101         if (lockp != NULL) {
1102                 ASSERT(MUTEX_HELD(lockp));
1103         }
1104         if (zone_lock_held) {
1105                 ASSERT(MUTEX_HELD(&zone->zone_lock));
1106         } else {
1107                 mutex_enter(&zone->zone_lock);
1108         }
1109 
1110         t = zsd_find(&zone->zone_zsd, key);
1111         if (t == NULL) {
1112                 /*
1113                  * Somebody else got here first e.g the zone going
1114                  * away.
1115                  */
1116                 if (!zone_lock_held)
1117                         mutex_exit(&zone->zone_lock);
1118                 return (B_FALSE);
1119         }
1120         dropped = B_FALSE;
1121         if (zsd_wait_for_creator(zone, t, lockp))
1122                 dropped = B_TRUE;
1123 
1124         if (zsd_wait_for_inprogress(zone, t, lockp))
1125                 dropped = B_TRUE;
1126 
1127         if (t->zsd_flags & ZSD_SHUTDOWN_NEEDED) {
1128                 t->zsd_flags &= ~ZSD_SHUTDOWN_NEEDED;
1129                 t->zsd_flags |= ZSD_SHUTDOWN_INPROGRESS;
1130                 DTRACE_PROBE2(zsd__shutdown__inprogress,
1131                     zone_t *, zone, zone_key_t, key);
1132                 mutex_exit(&zone->zone_lock);
1133                 if (lockp != NULL)
1134                         mutex_exit(lockp);
1135                 dropped = B_TRUE;
1136 
1137                 ASSERT(t->zsd_shutdown != NULL);
1138                 data = t->zsd_data;
1139 
1140                 DTRACE_PROBE2(zsd__shutdown__start,
1141                     zone_t *, zone, zone_key_t, key);
1142 
1143                 (t->zsd_shutdown)(zone->zone_id, data);
1144                 DTRACE_PROBE2(zsd__shutdown__end,
1145                     zone_t *, zone, zone_key_t, key);
1146 
1147                 if (lockp != NULL)
1148                         mutex_enter(lockp);
1149                 mutex_enter(&zone->zone_lock);
1150                 t->zsd_flags &= ~ZSD_SHUTDOWN_INPROGRESS;
1151                 t->zsd_flags |= ZSD_SHUTDOWN_COMPLETED;
1152                 cv_broadcast(&t->zsd_cv);
1153                 DTRACE_PROBE2(zsd__shutdown__completed,
1154                     zone_t *, zone, zone_key_t, key);
1155         }
1156         if (!zone_lock_held)
1157                 mutex_exit(&zone->zone_lock);
1158         return (dropped);
1159 }
1160 
1161 /*
1162  * Call the destroy function for the zone and key if DESTROY_NEEDED
1163  * is set.
1164  * If some other thread gets here first and sets *_INPROGRESS, then
1165  * we wait for that thread to complete so that we can ensure that
1166  * all the callbacks are done when we've looped over all zones/keys.
1167  *
1168  * When we call the destroy function, we drop the global held by the
1169  * caller, and return true to tell the caller it needs to re-evalute the
1170  * state.
1171  * If the caller holds zone_lock then zone_lock_held is set, and zone_lock
1172  * remains held on exit.
1173  */
1174 static boolean_t
1175 zsd_apply_destroy(kmutex_t *lockp, boolean_t zone_lock_held,
1176     zone_t *zone, zone_key_t key)
1177 {
1178         struct zsd_entry *t;
1179         void *data;
1180         boolean_t dropped;
1181 
1182         if (lockp != NULL) {
1183                 ASSERT(MUTEX_HELD(lockp));
1184         }
1185         if (zone_lock_held) {
1186                 ASSERT(MUTEX_HELD(&zone->zone_lock));
1187         } else {
1188                 mutex_enter(&zone->zone_lock);
1189         }
1190 
1191         t = zsd_find(&zone->zone_zsd, key);
1192         if (t == NULL) {
1193                 /*
1194                  * Somebody else got here first e.g the zone going
1195                  * away.
1196                  */
1197                 if (!zone_lock_held)
1198                         mutex_exit(&zone->zone_lock);
1199                 return (B_FALSE);
1200         }
1201         dropped = B_FALSE;
1202         if (zsd_wait_for_creator(zone, t, lockp))
1203                 dropped = B_TRUE;
1204 
1205         if (zsd_wait_for_inprogress(zone, t, lockp))
1206                 dropped = B_TRUE;
1207 
1208         if (t->zsd_flags & ZSD_DESTROY_NEEDED) {
1209                 t->zsd_flags &= ~ZSD_DESTROY_NEEDED;
1210                 t->zsd_flags |= ZSD_DESTROY_INPROGRESS;
1211                 DTRACE_PROBE2(zsd__destroy__inprogress,
1212                     zone_t *, zone, zone_key_t, key);
1213                 mutex_exit(&zone->zone_lock);
1214                 if (lockp != NULL)
1215                         mutex_exit(lockp);
1216                 dropped = B_TRUE;
1217 
1218                 ASSERT(t->zsd_destroy != NULL);
1219                 data = t->zsd_data;
1220                 DTRACE_PROBE2(zsd__destroy__start,
1221                     zone_t *, zone, zone_key_t, key);
1222 
1223                 (t->zsd_destroy)(zone->zone_id, data);
1224                 DTRACE_PROBE2(zsd__destroy__end,
1225                     zone_t *, zone, zone_key_t, key);
1226 
1227                 if (lockp != NULL)
1228                         mutex_enter(lockp);
1229                 mutex_enter(&zone->zone_lock);
1230                 t->zsd_data = NULL;
1231                 t->zsd_flags &= ~ZSD_DESTROY_INPROGRESS;
1232                 t->zsd_flags |= ZSD_DESTROY_COMPLETED;
1233                 cv_broadcast(&t->zsd_cv);
1234                 DTRACE_PROBE2(zsd__destroy__completed,
1235                     zone_t *, zone, zone_key_t, key);
1236         }
1237         if (!zone_lock_held)
1238                 mutex_exit(&zone->zone_lock);
1239         return (dropped);
1240 }
1241 
1242 /*
1243  * Wait for any CREATE_NEEDED flag to be cleared.
1244  * Returns true if lockp was temporarily dropped while waiting.
1245  */
1246 static boolean_t
1247 zsd_wait_for_creator(zone_t *zone, struct zsd_entry *t, kmutex_t *lockp)
1248 {
1249         boolean_t dropped = B_FALSE;
1250 
1251         while (t->zsd_flags & ZSD_CREATE_NEEDED) {
1252                 DTRACE_PROBE2(zsd__wait__for__creator,
1253                     zone_t *, zone, struct zsd_entry *, t);
1254                 if (lockp != NULL) {
1255                         dropped = B_TRUE;
1256                         mutex_exit(lockp);
1257                 }
1258                 cv_wait(&t->zsd_cv, &zone->zone_lock);
1259                 if (lockp != NULL) {
1260                         /* First drop zone_lock to preserve order */
1261                         mutex_exit(&zone->zone_lock);
1262                         mutex_enter(lockp);
1263                         mutex_enter(&zone->zone_lock);
1264                 }
1265         }
1266         return (dropped);
1267 }
1268 
1269 /*
1270  * Wait for any INPROGRESS flag to be cleared.
1271  * Returns true if lockp was temporarily dropped while waiting.
1272  */
1273 static boolean_t
1274 zsd_wait_for_inprogress(zone_t *zone, struct zsd_entry *t, kmutex_t *lockp)
1275 {
1276         boolean_t dropped = B_FALSE;
1277 
1278         while (t->zsd_flags & ZSD_ALL_INPROGRESS) {
1279                 DTRACE_PROBE2(zsd__wait__for__inprogress,
1280                     zone_t *, zone, struct zsd_entry *, t);
1281                 if (lockp != NULL) {
1282                         dropped = B_TRUE;
1283                         mutex_exit(lockp);
1284                 }
1285                 cv_wait(&t->zsd_cv, &zone->zone_lock);
1286                 if (lockp != NULL) {
1287                         /* First drop zone_lock to preserve order */
1288                         mutex_exit(&zone->zone_lock);
1289                         mutex_enter(lockp);
1290                         mutex_enter(&zone->zone_lock);
1291                 }
1292         }
1293         return (dropped);
1294 }
1295 
1296 /*
1297  * Frees memory associated with the zone dataset list.
1298  */
1299 static void
1300 zone_free_datasets(zone_t *zone)
1301 {
1302         zone_dataset_t *t, *next;
1303 
1304         for (t = list_head(&zone->zone_datasets); t != NULL; t = next) {
1305                 next = list_next(&zone->zone_datasets, t);
1306                 list_remove(&zone->zone_datasets, t);
1307                 kmem_free(t->zd_dataset, strlen(t->zd_dataset) + 1);
1308                 kmem_free(t, sizeof (*t));
1309         }
1310         list_destroy(&zone->zone_datasets);
1311 }
1312 
1313 /*
1314  * zone.cpu-shares resource control support.
1315  */
1316 /*ARGSUSED*/
1317 static rctl_qty_t
1318 zone_cpu_shares_usage(rctl_t *rctl, struct proc *p)
1319 {
1320         ASSERT(MUTEX_HELD(&p->p_lock));
1321         return (p->p_zone->zone_shares);
1322 }
1323 
1324 /*ARGSUSED*/
1325 static int
1326 zone_cpu_shares_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1327     rctl_qty_t nv)
1328 {
1329         ASSERT(MUTEX_HELD(&p->p_lock));
1330         ASSERT(e->rcep_t == RCENTITY_ZONE);
1331         if (e->rcep_p.zone == NULL)
1332                 return (0);
1333 
1334         e->rcep_p.zone->zone_shares = nv;
1335         return (0);
1336 }
1337 
1338 static rctl_ops_t zone_cpu_shares_ops = {
1339         rcop_no_action,
1340         zone_cpu_shares_usage,
1341         zone_cpu_shares_set,
1342         rcop_no_test
1343 };
1344 
1345 /*
1346  * zone.cpu-cap resource control support.
1347  */
1348 /*ARGSUSED*/
1349 static rctl_qty_t
1350 zone_cpu_cap_get(rctl_t *rctl, struct proc *p)
1351 {
1352         ASSERT(MUTEX_HELD(&p->p_lock));
1353         return (cpucaps_zone_get(p->p_zone));
1354 }
1355 
1356 /*ARGSUSED*/
1357 static int
1358 zone_cpu_cap_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1359     rctl_qty_t nv)
1360 {
1361         zone_t *zone = e->rcep_p.zone;
1362 
1363         ASSERT(MUTEX_HELD(&p->p_lock));
1364         ASSERT(e->rcep_t == RCENTITY_ZONE);
1365 
1366         if (zone == NULL)
1367                 return (0);
1368 
1369         /*
1370          * set cap to the new value.
1371          */
1372         return (cpucaps_zone_set(zone, nv));
1373 }
1374 
1375 static rctl_ops_t zone_cpu_cap_ops = {
1376         rcop_no_action,
1377         zone_cpu_cap_get,
1378         zone_cpu_cap_set,
1379         rcop_no_test
1380 };
1381 
1382 /*ARGSUSED*/
1383 static rctl_qty_t
1384 zone_lwps_usage(rctl_t *r, proc_t *p)
1385 {
1386         rctl_qty_t nlwps;
1387         zone_t *zone = p->p_zone;
1388 
1389         ASSERT(MUTEX_HELD(&p->p_lock));
1390 
1391         mutex_enter(&zone->zone_nlwps_lock);
1392         nlwps = zone->zone_nlwps;
1393         mutex_exit(&zone->zone_nlwps_lock);
1394 
1395         return (nlwps);
1396 }
1397 
1398 /*ARGSUSED*/
1399 static int
1400 zone_lwps_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rcntl,
1401     rctl_qty_t incr, uint_t flags)
1402 {
1403         rctl_qty_t nlwps;
1404 
1405         ASSERT(MUTEX_HELD(&p->p_lock));
1406         ASSERT(e->rcep_t == RCENTITY_ZONE);
1407         if (e->rcep_p.zone == NULL)
1408                 return (0);
1409         ASSERT(MUTEX_HELD(&(e->rcep_p.zone->zone_nlwps_lock)));
1410         nlwps = e->rcep_p.zone->zone_nlwps;
1411 
1412         if (nlwps + incr > rcntl->rcv_value)
1413                 return (1);
1414 
1415         return (0);
1416 }
1417 
1418 /*ARGSUSED*/
1419 static int
1420 zone_lwps_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e, rctl_qty_t nv)
1421 {
1422         ASSERT(MUTEX_HELD(&p->p_lock));
1423         ASSERT(e->rcep_t == RCENTITY_ZONE);
1424         if (e->rcep_p.zone == NULL)
1425                 return (0);
1426         e->rcep_p.zone->zone_nlwps_ctl = nv;
1427         return (0);
1428 }
1429 
1430 static rctl_ops_t zone_lwps_ops = {
1431         rcop_no_action,
1432         zone_lwps_usage,
1433         zone_lwps_set,
1434         zone_lwps_test,
1435 };
1436 
1437 /*ARGSUSED*/
1438 static rctl_qty_t
1439 zone_procs_usage(rctl_t *r, proc_t *p)
1440 {
1441         rctl_qty_t nprocs;
1442         zone_t *zone = p->p_zone;
1443 
1444         ASSERT(MUTEX_HELD(&p->p_lock));
1445 
1446         mutex_enter(&zone->zone_nlwps_lock);
1447         nprocs = zone->zone_nprocs;
1448         mutex_exit(&zone->zone_nlwps_lock);
1449 
1450         return (nprocs);
1451 }
1452 
1453 /*ARGSUSED*/
1454 static int
1455 zone_procs_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rcntl,
1456     rctl_qty_t incr, uint_t flags)
1457 {
1458         rctl_qty_t nprocs;
1459 
1460         ASSERT(MUTEX_HELD(&p->p_lock));
1461         ASSERT(e->rcep_t == RCENTITY_ZONE);
1462         if (e->rcep_p.zone == NULL)
1463                 return (0);
1464         ASSERT(MUTEX_HELD(&(e->rcep_p.zone->zone_nlwps_lock)));
1465         nprocs = e->rcep_p.zone->zone_nprocs;
1466 
1467         if (nprocs + incr > rcntl->rcv_value)
1468                 return (1);
1469 
1470         return (0);
1471 }
1472 
1473 /*ARGSUSED*/
1474 static int
1475 zone_procs_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e, rctl_qty_t nv)
1476 {
1477         ASSERT(MUTEX_HELD(&p->p_lock));
1478         ASSERT(e->rcep_t == RCENTITY_ZONE);
1479         if (e->rcep_p.zone == NULL)
1480                 return (0);
1481         e->rcep_p.zone->zone_nprocs_ctl = nv;
1482         return (0);
1483 }
1484 
1485 static rctl_ops_t zone_procs_ops = {
1486         rcop_no_action,
1487         zone_procs_usage,
1488         zone_procs_set,
1489         zone_procs_test,
1490 };
1491 
1492 /*ARGSUSED*/
1493 static int
1494 zone_shmmax_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rval,
1495     rctl_qty_t incr, uint_t flags)
1496 {
1497         rctl_qty_t v;
1498         ASSERT(MUTEX_HELD(&p->p_lock));
1499         ASSERT(e->rcep_t == RCENTITY_ZONE);
1500         v = e->rcep_p.zone->zone_shmmax + incr;
1501         if (v > rval->rcv_value)
1502                 return (1);
1503         return (0);
1504 }
1505 
1506 static rctl_ops_t zone_shmmax_ops = {
1507         rcop_no_action,
1508         rcop_no_usage,
1509         rcop_no_set,
1510         zone_shmmax_test
1511 };
1512 
1513 /*ARGSUSED*/
1514 static int
1515 zone_shmmni_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rval,
1516     rctl_qty_t incr, uint_t flags)
1517 {
1518         rctl_qty_t v;
1519         ASSERT(MUTEX_HELD(&p->p_lock));
1520         ASSERT(e->rcep_t == RCENTITY_ZONE);
1521         v = e->rcep_p.zone->zone_ipc.ipcq_shmmni + incr;
1522         if (v > rval->rcv_value)
1523                 return (1);
1524         return (0);
1525 }
1526 
1527 static rctl_ops_t zone_shmmni_ops = {
1528         rcop_no_action,
1529         rcop_no_usage,
1530         rcop_no_set,
1531         zone_shmmni_test
1532 };
1533 
1534 /*ARGSUSED*/
1535 static int
1536 zone_semmni_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rval,
1537     rctl_qty_t incr, uint_t flags)
1538 {
1539         rctl_qty_t v;
1540         ASSERT(MUTEX_HELD(&p->p_lock));
1541         ASSERT(e->rcep_t == RCENTITY_ZONE);
1542         v = e->rcep_p.zone->zone_ipc.ipcq_semmni + incr;
1543         if (v > rval->rcv_value)
1544                 return (1);
1545         return (0);
1546 }
1547 
1548 static rctl_ops_t zone_semmni_ops = {
1549         rcop_no_action,
1550         rcop_no_usage,
1551         rcop_no_set,
1552         zone_semmni_test
1553 };
1554 
1555 /*ARGSUSED*/
1556 static int
1557 zone_msgmni_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rval,
1558     rctl_qty_t incr, uint_t flags)
1559 {
1560         rctl_qty_t v;
1561         ASSERT(MUTEX_HELD(&p->p_lock));
1562         ASSERT(e->rcep_t == RCENTITY_ZONE);
1563         v = e->rcep_p.zone->zone_ipc.ipcq_msgmni + incr;
1564         if (v > rval->rcv_value)
1565                 return (1);
1566         return (0);
1567 }
1568 
1569 static rctl_ops_t zone_msgmni_ops = {
1570         rcop_no_action,
1571         rcop_no_usage,
1572         rcop_no_set,
1573         zone_msgmni_test
1574 };
1575 
1576 /*ARGSUSED*/
1577 static rctl_qty_t
1578 zone_locked_mem_usage(rctl_t *rctl, struct proc *p)
1579 {
1580         rctl_qty_t q;
1581         ASSERT(MUTEX_HELD(&p->p_lock));
1582         mutex_enter(&p->p_zone->zone_mem_lock);
1583         q = p->p_zone->zone_locked_mem;
1584         mutex_exit(&p->p_zone->zone_mem_lock);
1585         return (q);
1586 }
1587 
1588 /*ARGSUSED*/
1589 static int
1590 zone_locked_mem_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e,
1591     rctl_val_t *rcntl, rctl_qty_t incr, uint_t flags)
1592 {
1593         rctl_qty_t q;
1594         zone_t *z;
1595 
1596         z = e->rcep_p.zone;
1597         ASSERT(MUTEX_HELD(&p->p_lock));
1598         ASSERT(MUTEX_HELD(&z->zone_mem_lock));
1599         q = z->zone_locked_mem;
1600         if (q + incr > rcntl->rcv_value)
1601                 return (1);
1602         return (0);
1603 }
1604 
1605 /*ARGSUSED*/
1606 static int
1607 zone_locked_mem_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1608     rctl_qty_t nv)
1609 {
1610         ASSERT(MUTEX_HELD(&p->p_lock));
1611         ASSERT(e->rcep_t == RCENTITY_ZONE);
1612         if (e->rcep_p.zone == NULL)
1613                 return (0);
1614         e->rcep_p.zone->zone_locked_mem_ctl = nv;
1615         return (0);
1616 }
1617 
1618 static rctl_ops_t zone_locked_mem_ops = {
1619         rcop_no_action,
1620         zone_locked_mem_usage,
1621         zone_locked_mem_set,
1622         zone_locked_mem_test
1623 };
1624 
1625 /*ARGSUSED*/
1626 static rctl_qty_t
1627 zone_max_swap_usage(rctl_t *rctl, struct proc *p)
1628 {
1629         rctl_qty_t q;
1630         zone_t *z = p->p_zone;
1631 
1632         ASSERT(MUTEX_HELD(&p->p_lock));
1633         mutex_enter(&z->zone_mem_lock);
1634         q = z->zone_max_swap;
1635         mutex_exit(&z->zone_mem_lock);
1636         return (q);
1637 }
1638 
1639 /*ARGSUSED*/
1640 static int
1641 zone_max_swap_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e,
1642     rctl_val_t *rcntl, rctl_qty_t incr, uint_t flags)
1643 {
1644         rctl_qty_t q;
1645         zone_t *z;
1646 
1647         z = e->rcep_p.zone;
1648         ASSERT(MUTEX_HELD(&p->p_lock));
1649         ASSERT(MUTEX_HELD(&z->zone_mem_lock));
1650         q = z->zone_max_swap;
1651         if (q + incr > rcntl->rcv_value)
1652                 return (1);
1653         return (0);
1654 }
1655 
1656 /*ARGSUSED*/
1657 static int
1658 zone_max_swap_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1659     rctl_qty_t nv)
1660 {
1661         ASSERT(MUTEX_HELD(&p->p_lock));
1662         ASSERT(e->rcep_t == RCENTITY_ZONE);
1663         if (e->rcep_p.zone == NULL)
1664                 return (0);
1665         e->rcep_p.zone->zone_max_swap_ctl = nv;
1666         return (0);
1667 }
1668 
1669 static rctl_ops_t zone_max_swap_ops = {
1670         rcop_no_action,
1671         zone_max_swap_usage,
1672         zone_max_swap_set,
1673         zone_max_swap_test
1674 };
1675 
1676 /*ARGSUSED*/
1677 static rctl_qty_t
1678 zone_max_lofi_usage(rctl_t *rctl, struct proc *p)
1679 {
1680         rctl_qty_t q;
1681         zone_t *z = p->p_zone;
1682 
1683         ASSERT(MUTEX_HELD(&p->p_lock));
1684         mutex_enter(&z->zone_rctl_lock);
1685         q = z->zone_max_lofi;
1686         mutex_exit(&z->zone_rctl_lock);
1687         return (q);
1688 }
1689 
1690 /*ARGSUSED*/
1691 static int
1692 zone_max_lofi_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e,
1693     rctl_val_t *rcntl, rctl_qty_t incr, uint_t flags)
1694 {
1695         rctl_qty_t q;
1696         zone_t *z;
1697 
1698         z = e->rcep_p.zone;
1699         ASSERT(MUTEX_HELD(&p->p_lock));
1700         ASSERT(MUTEX_HELD(&z->zone_rctl_lock));
1701         q = z->zone_max_lofi;
1702         if (q + incr > rcntl->rcv_value)
1703                 return (1);
1704         return (0);
1705 }
1706 
1707 /*ARGSUSED*/
1708 static int
1709 zone_max_lofi_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
1710     rctl_qty_t nv)
1711 {
1712         ASSERT(MUTEX_HELD(&p->p_lock));
1713         ASSERT(e->rcep_t == RCENTITY_ZONE);
1714         if (e->rcep_p.zone == NULL)
1715                 return (0);
1716         e->rcep_p.zone->zone_max_lofi_ctl = nv;
1717         return (0);
1718 }
1719 
1720 static rctl_ops_t zone_max_lofi_ops = {
1721         rcop_no_action,
1722         zone_max_lofi_usage,
1723         zone_max_lofi_set,
1724         zone_max_lofi_test
1725 };
1726 
1727 /*
1728  * Helper function to brand the zone with a unique ID.
1729  */
1730 static void
1731 zone_uniqid(zone_t *zone)
1732 {
1733         static uint64_t uniqid = 0;
1734 
1735         ASSERT(MUTEX_HELD(&zonehash_lock));
1736         zone->zone_uniqid = uniqid++;
1737 }
1738 
1739 /*
1740  * Returns a held pointer to the "kcred" for the specified zone.
1741  */
1742 struct cred *
1743 zone_get_kcred(zoneid_t zoneid)
1744 {
1745         zone_t *zone;
1746         cred_t *cr;
1747 
1748         if ((zone = zone_find_by_id(zoneid)) == NULL)
1749                 return (NULL);
1750         cr = zone->zone_kcred;
1751         crhold(cr);
1752         zone_rele(zone);
1753         return (cr);
1754 }
1755 
1756 static int
1757 zone_lockedmem_kstat_update(kstat_t *ksp, int rw)
1758 {
1759         zone_t *zone = ksp->ks_private;
1760         zone_kstat_t *zk = ksp->ks_data;
1761 
1762         if (rw == KSTAT_WRITE)
1763                 return (EACCES);
1764 
1765         zk->zk_usage.value.ui64 = zone->zone_locked_mem;
1766         zk->zk_value.value.ui64 = zone->zone_locked_mem_ctl;
1767         return (0);
1768 }
1769 
1770 static int
1771 zone_nprocs_kstat_update(kstat_t *ksp, int rw)
1772 {
1773         zone_t *zone = ksp->ks_private;
1774         zone_kstat_t *zk = ksp->ks_data;
1775 
1776         if (rw == KSTAT_WRITE)
1777                 return (EACCES);
1778 
1779         zk->zk_usage.value.ui64 = zone->zone_nprocs;
1780         zk->zk_value.value.ui64 = zone->zone_nprocs_ctl;
1781         return (0);
1782 }
1783 
1784 static int
1785 zone_swapresv_kstat_update(kstat_t *ksp, int rw)
1786 {
1787         zone_t *zone = ksp->ks_private;
1788         zone_kstat_t *zk = ksp->ks_data;
1789 
1790         if (rw == KSTAT_WRITE)
1791                 return (EACCES);
1792 
1793         zk->zk_usage.value.ui64 = zone->zone_max_swap;
1794         zk->zk_value.value.ui64 = zone->zone_max_swap_ctl;
1795         return (0);
1796 }
1797 
1798 static kstat_t *
1799 zone_kstat_create_common(zone_t *zone, char *name,
1800     int (*updatefunc) (kstat_t *, int))
1801 {
1802         kstat_t *ksp;
1803         zone_kstat_t *zk;
1804 
1805         ksp = rctl_kstat_create_zone(zone, name, KSTAT_TYPE_NAMED,
1806             sizeof (zone_kstat_t) / sizeof (kstat_named_t),
1807             KSTAT_FLAG_VIRTUAL);
1808 
1809         if (ksp == NULL)
1810                 return (NULL);
1811 
1812         zk = ksp->ks_data = kmem_alloc(sizeof (zone_kstat_t), KM_SLEEP);
1813         ksp->ks_data_size += strlen(zone->zone_name) + 1;
1814         kstat_named_init(&zk->zk_zonename, "zonename", KSTAT_DATA_STRING);
1815         kstat_named_setstr(&zk->zk_zonename, zone->zone_name);
1816         kstat_named_init(&zk->zk_usage, "usage", KSTAT_DATA_UINT64);
1817         kstat_named_init(&zk->zk_value, "value", KSTAT_DATA_UINT64);
1818         ksp->ks_update = updatefunc;
1819         ksp->ks_private = zone;
1820         kstat_install(ksp);
1821         return (ksp);
1822 }
1823 
1824 static int
1825 zone_misc_kstat_update(kstat_t *ksp, int rw)
1826 {
1827         zone_t *zone = ksp->ks_private;
1828         zone_misc_kstat_t *zmp = ksp->ks_data;
1829         hrtime_t tmp;
1830 
1831         if (rw == KSTAT_WRITE)
1832                 return (EACCES);
1833 
1834         tmp = zone->zone_utime;
1835         scalehrtime(&tmp);
1836         zmp->zm_utime.value.ui64 = tmp;
1837         tmp = zone->zone_stime;
1838         scalehrtime(&tmp);
1839         zmp->zm_stime.value.ui64 = tmp;
1840         tmp = zone->zone_wtime;
1841         scalehrtime(&tmp);
1842         zmp->zm_wtime.value.ui64 = tmp;
1843 
1844         zmp->zm_avenrun1.value.ui32 = zone->zone_avenrun[0];
1845         zmp->zm_avenrun5.value.ui32 = zone->zone_avenrun[1];
1846         zmp->zm_avenrun15.value.ui32 = zone->zone_avenrun[2];
1847 
1848         return (0);
1849 }
1850 
1851 static kstat_t *
1852 zone_misc_kstat_create(zone_t *zone)
1853 {
1854         kstat_t *ksp;
1855         zone_misc_kstat_t *zmp;
1856 
1857         if ((ksp = kstat_create_zone("zones", zone->zone_id,
1858             zone->zone_name, "zone_misc", KSTAT_TYPE_NAMED,
1859             sizeof (zone_misc_kstat_t) / sizeof (kstat_named_t),
1860             KSTAT_FLAG_VIRTUAL, zone->zone_id)) == NULL)
1861                 return (NULL);
1862 
1863         if (zone->zone_id != GLOBAL_ZONEID)
1864                 kstat_zone_add(ksp, GLOBAL_ZONEID);
1865 
1866         zmp = ksp->ks_data = kmem_zalloc(sizeof (zone_misc_kstat_t), KM_SLEEP);
1867         ksp->ks_data_size += strlen(zone->zone_name) + 1;
1868         ksp->ks_lock = &zone->zone_misc_lock;
1869         zone->zone_misc_stats = zmp;
1870 
1871         /* The kstat "name" field is not large enough for a full zonename */
1872         kstat_named_init(&zmp->zm_zonename, "zonename", KSTAT_DATA_STRING);
1873         kstat_named_setstr(&zmp->zm_zonename, zone->zone_name);
1874         kstat_named_init(&zmp->zm_utime, "nsec_user", KSTAT_DATA_UINT64);
1875         kstat_named_init(&zmp->zm_stime, "nsec_sys", KSTAT_DATA_UINT64);
1876         kstat_named_init(&zmp->zm_wtime, "nsec_waitrq", KSTAT_DATA_UINT64);
1877         kstat_named_init(&zmp->zm_avenrun1, "avenrun_1min", KSTAT_DATA_UINT32);
1878         kstat_named_init(&zmp->zm_avenrun5, "avenrun_5min", KSTAT_DATA_UINT32);
1879         kstat_named_init(&zmp->zm_avenrun15, "avenrun_15min",
1880             KSTAT_DATA_UINT32);
1881 
1882         ksp->ks_update = zone_misc_kstat_update;
1883         ksp->ks_private = zone;
1884 
1885         kstat_install(ksp);
1886         return (ksp);
1887 }
1888 
1889 static void
1890 zone_kstat_create(zone_t *zone)
1891 {
1892         zone->zone_lockedmem_kstat = zone_kstat_create_common(zone,
1893             "lockedmem", zone_lockedmem_kstat_update);
1894         zone->zone_swapresv_kstat = zone_kstat_create_common(zone,
1895             "swapresv", zone_swapresv_kstat_update);
1896         zone->zone_nprocs_kstat = zone_kstat_create_common(zone,
1897             "nprocs", zone_nprocs_kstat_update);
1898 
1899         if ((zone->zone_misc_ksp = zone_misc_kstat_create(zone)) == NULL) {
1900                 zone->zone_misc_stats = kmem_zalloc(
1901                     sizeof (zone_misc_kstat_t), KM_SLEEP);
1902         }
1903 }
1904 
1905 static void
1906 zone_kstat_delete_common(kstat_t **pkstat, size_t datasz)
1907 {
1908         void *data;
1909 
1910         if (*pkstat != NULL) {
1911                 data = (*pkstat)->ks_data;
1912                 kstat_delete(*pkstat);
1913                 kmem_free(data, datasz);
1914                 *pkstat = NULL;
1915         }
1916 }
1917 
1918 static void
1919 zone_kstat_delete(zone_t *zone)
1920 {
1921         zone_kstat_delete_common(&zone->zone_lockedmem_kstat,
1922             sizeof (zone_kstat_t));
1923         zone_kstat_delete_common(&zone->zone_swapresv_kstat,
1924             sizeof (zone_kstat_t));
1925         zone_kstat_delete_common(&zone->zone_nprocs_kstat,
1926             sizeof (zone_kstat_t));
1927         zone_kstat_delete_common(&zone->zone_misc_ksp,
1928             sizeof (zone_misc_kstat_t));
1929 }
1930 
1931 /*
1932  * Called very early on in boot to initialize the ZSD list so that
1933  * zone_key_create() can be called before zone_init().  It also initializes
1934  * portions of zone0 which may be used before zone_init() is called.  The
1935  * variable "global_zone" will be set when zone0 is fully initialized by
1936  * zone_init().
1937  */
1938 void
1939 zone_zsd_init(void)
1940 {
1941         mutex_init(&zonehash_lock, NULL, MUTEX_DEFAULT, NULL);
1942         mutex_init(&zsd_key_lock, NULL, MUTEX_DEFAULT, NULL);
1943         list_create(&zsd_registered_keys, sizeof (struct zsd_entry),
1944             offsetof(struct zsd_entry, zsd_linkage));
1945         list_create(&zone_active, sizeof (zone_t),
1946             offsetof(zone_t, zone_linkage));
1947         list_create(&zone_deathrow, sizeof (zone_t),
1948             offsetof(zone_t, zone_linkage));
1949 
1950         mutex_init(&zone0.zone_lock, NULL, MUTEX_DEFAULT, NULL);
1951         mutex_init(&zone0.zone_nlwps_lock, NULL, MUTEX_DEFAULT, NULL);
1952         mutex_init(&zone0.zone_mem_lock, NULL, MUTEX_DEFAULT, NULL);
1953         zone0.zone_shares = 1;
1954         zone0.zone_nlwps = 0;
1955         zone0.zone_nlwps_ctl = INT_MAX;
1956         zone0.zone_nprocs = 0;
1957         zone0.zone_nprocs_ctl = INT_MAX;
1958         zone0.zone_locked_mem = 0;
1959         zone0.zone_locked_mem_ctl = UINT64_MAX;
1960         ASSERT(zone0.zone_max_swap == 0);
1961         zone0.zone_max_swap_ctl = UINT64_MAX;
1962         zone0.zone_max_lofi = 0;
1963         zone0.zone_max_lofi_ctl = UINT64_MAX;
1964         zone0.zone_shmmax = 0;
1965         zone0.zone_ipc.ipcq_shmmni = 0;
1966         zone0.zone_ipc.ipcq_semmni = 0;
1967         zone0.zone_ipc.ipcq_msgmni = 0;
1968         zone0.zone_name = GLOBAL_ZONENAME;
1969         zone0.zone_nodename = utsname.nodename;
1970         zone0.zone_domain = srpc_domain;
1971         zone0.zone_hostid = HW_INVALID_HOSTID;
1972         zone0.zone_fs_allowed = NULL;
1973         zone0.zone_ref = 1;
1974         zone0.zone_id = GLOBAL_ZONEID;
1975         zone0.zone_status = ZONE_IS_RUNNING;
1976         zone0.zone_rootpath = "/";
1977         zone0.zone_rootpathlen = 2;
1978         zone0.zone_psetid = ZONE_PS_INVAL;
1979         zone0.zone_ncpus = 0;
1980         zone0.zone_ncpus_online = 0;
1981         zone0.zone_proc_initpid = 1;
1982         zone0.zone_initname = initname;
1983         zone0.zone_lockedmem_kstat = NULL;
1984         zone0.zone_swapresv_kstat = NULL;
1985         zone0.zone_nprocs_kstat = NULL;
1986 
1987         zone0.zone_stime = 0;
1988         zone0.zone_utime = 0;
1989         zone0.zone_wtime = 0;
1990 
1991         list_create(&zone0.zone_ref_list, sizeof (zone_ref_t),
1992             offsetof(zone_ref_t, zref_linkage));
1993         list_create(&zone0.zone_zsd, sizeof (struct zsd_entry),
1994             offsetof(struct zsd_entry, zsd_linkage));
1995         list_insert_head(&zone_active, &zone0);
1996 
1997         /*
1998          * The root filesystem is not mounted yet, so zone_rootvp cannot be set
1999          * to anything meaningful.  It is assigned to be 'rootdir' in
2000          * vfs_mountroot().
2001          */
2002         zone0.zone_rootvp = NULL;
2003         zone0.zone_vfslist = NULL;
2004         zone0.zone_bootargs = initargs;
2005         zone0.zone_privset = kmem_alloc(sizeof (priv_set_t), KM_SLEEP);
2006         /*
2007          * The global zone has all privileges
2008          */
2009         priv_fillset(zone0.zone_privset);
2010         /*
2011          * Add p0 to the global zone
2012          */
2013         zone0.zone_zsched = &p0;
2014         p0.p_zone = &zone0;
2015 }
2016 
2017 /*
2018  * Compute a hash value based on the contents of the label and the DOI.  The
2019  * hash algorithm is somewhat arbitrary, but is based on the observation that
2020  * humans will likely pick labels that differ by amounts that work out to be
2021  * multiples of the number of hash chains, and thus stirring in some primes
2022  * should help.
2023  */
2024 static uint_t
2025 hash_bylabel(void *hdata, mod_hash_key_t key)
2026 {
2027         const ts_label_t *lab = (ts_label_t *)key;
2028         const uint32_t *up, *ue;
2029         uint_t hash;
2030         int i;
2031 
2032         _NOTE(ARGUNUSED(hdata));
2033 
2034         hash = lab->tsl_doi + (lab->tsl_doi << 1);
2035         /* we depend on alignment of label, but not representation */
2036         up = (const uint32_t *)&lab->tsl_label;
2037         ue = up + sizeof (lab->tsl_label) / sizeof (*up);
2038         i = 1;
2039         while (up < ue) {
2040                 /* using 2^n + 1, 1 <= n <= 16 as source of many primes */
2041                 hash += *up + (*up << ((i % 16) + 1));
2042                 up++;
2043                 i++;
2044         }
2045         return (hash);
2046 }
2047 
2048 /*
2049  * All that mod_hash cares about here is zero (equal) versus non-zero (not
2050  * equal).  This may need to be changed if less than / greater than is ever
2051  * needed.
2052  */
2053 static int
2054 hash_labelkey_cmp(mod_hash_key_t key1, mod_hash_key_t key2)
2055 {
2056         ts_label_t *lab1 = (ts_label_t *)key1;
2057         ts_label_t *lab2 = (ts_label_t *)key2;
2058 
2059         return (label_equal(lab1, lab2) ? 0 : 1);
2060 }
2061 
2062 /*
2063  * Called by main() to initialize the zones framework.
2064  */
2065 void
2066 zone_init(void)
2067 {
2068         rctl_dict_entry_t *rde;
2069         rctl_val_t *dval;
2070         rctl_set_t *set;
2071         rctl_alloc_gp_t *gp;
2072         rctl_entity_p_t e;
2073         int res;
2074 
2075         ASSERT(curproc == &p0);
2076 
2077         /*
2078          * Create ID space for zone IDs.  ID 0 is reserved for the
2079          * global zone.
2080          */
2081         zoneid_space = id_space_create("zoneid_space", 1, MAX_ZONEID);
2082 
2083         /*
2084          * Initialize generic zone resource controls, if any.
2085          */
2086         rc_zone_cpu_shares = rctl_register("zone.cpu-shares",
2087             RCENTITY_ZONE, RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_DENY_NEVER |
2088             RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT | RCTL_GLOBAL_SYSLOG_NEVER,
2089             FSS_MAXSHARES, FSS_MAXSHARES, &zone_cpu_shares_ops);
2090 
2091         rc_zone_cpu_cap = rctl_register("zone.cpu-cap",
2092             RCENTITY_ZONE, RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_DENY_ALWAYS |
2093             RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT |RCTL_GLOBAL_SYSLOG_NEVER |
2094             RCTL_GLOBAL_INFINITE,
2095             MAXCAP, MAXCAP, &zone_cpu_cap_ops);
2096 
2097         rc_zone_nlwps = rctl_register("zone.max-lwps", RCENTITY_ZONE,
2098             RCTL_GLOBAL_NOACTION | RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT,
2099             INT_MAX, INT_MAX, &zone_lwps_ops);
2100 
2101         rc_zone_nprocs = rctl_register("zone.max-processes", RCENTITY_ZONE,
2102             RCTL_GLOBAL_NOACTION | RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT,
2103             INT_MAX, INT_MAX, &zone_procs_ops);
2104 
2105         /*
2106          * System V IPC resource controls
2107          */
2108         rc_zone_msgmni = rctl_register("zone.max-msg-ids",
2109             RCENTITY_ZONE, RCTL_GLOBAL_DENY_ALWAYS | RCTL_GLOBAL_NOBASIC |
2110             RCTL_GLOBAL_COUNT, IPC_IDS_MAX, IPC_IDS_MAX, &zone_msgmni_ops);
2111 
2112         rc_zone_semmni = rctl_register("zone.max-sem-ids",
2113             RCENTITY_ZONE, RCTL_GLOBAL_DENY_ALWAYS | RCTL_GLOBAL_NOBASIC |
2114             RCTL_GLOBAL_COUNT, IPC_IDS_MAX, IPC_IDS_MAX, &zone_semmni_ops);
2115 
2116         rc_zone_shmmni = rctl_register("zone.max-shm-ids",
2117             RCENTITY_ZONE, RCTL_GLOBAL_DENY_ALWAYS | RCTL_GLOBAL_NOBASIC |
2118             RCTL_GLOBAL_COUNT, IPC_IDS_MAX, IPC_IDS_MAX, &zone_shmmni_ops);
2119 
2120         rc_zone_shmmax = rctl_register("zone.max-shm-memory",
2121             RCENTITY_ZONE, RCTL_GLOBAL_DENY_ALWAYS | RCTL_GLOBAL_NOBASIC |
2122             RCTL_GLOBAL_BYTES, UINT64_MAX, UINT64_MAX, &zone_shmmax_ops);
2123 
2124         /*
2125          * Create a rctl_val with PRIVILEGED, NOACTION, value = 1.  Then attach
2126          * this at the head of the rctl_dict_entry for ``zone.cpu-shares''.
2127          */
2128         dval = kmem_cache_alloc(rctl_val_cache, KM_SLEEP);
2129         bzero(dval, sizeof (rctl_val_t));
2130         dval->rcv_value = 1;
2131         dval->rcv_privilege = RCPRIV_PRIVILEGED;
2132         dval->rcv_flagaction = RCTL_LOCAL_NOACTION;
2133         dval->rcv_action_recip_pid = -1;
2134 
2135         rde = rctl_dict_lookup("zone.cpu-shares");
2136         (void) rctl_val_list_insert(&rde->rcd_default_value, dval);
2137 
2138         rc_zone_locked_mem = rctl_register("zone.max-locked-memory",
2139             RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_BYTES |
2140             RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
2141             &zone_locked_mem_ops);
2142 
2143         rc_zone_max_swap = rctl_register("zone.max-swap",
2144             RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_BYTES |
2145             RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
2146             &zone_max_swap_ops);
2147 
2148         rc_zone_max_lofi = rctl_register("zone.max-lofi",
2149             RCENTITY_ZONE, RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT |
2150             RCTL_GLOBAL_DENY_ALWAYS, UINT64_MAX, UINT64_MAX,
2151             &zone_max_lofi_ops);
2152 
2153         /*
2154          * Initialize the ``global zone''.
2155          */
2156         set = rctl_set_create();
2157         gp = rctl_set_init_prealloc(RCENTITY_ZONE);
2158         mutex_enter(&p0.p_lock);
2159         e.rcep_p.zone = &zone0;
2160         e.rcep_t = RCENTITY_ZONE;
2161         zone0.zone_rctls = rctl_set_init(RCENTITY_ZONE, &p0, &e, set,
2162             gp);
2163 
2164         zone0.zone_nlwps = p0.p_lwpcnt;
2165         zone0.zone_nprocs = 1;
2166         zone0.zone_ntasks = 1;
2167         mutex_exit(&p0.p_lock);
2168         zone0.zone_restart_init = B_TRUE;
2169         zone0.zone_brand = &native_brand;
2170         rctl_prealloc_destroy(gp);
2171         /*
2172          * pool_default hasn't been initialized yet, so we let pool_init()
2173          * take care of making sure the global zone is in the default pool.
2174          */
2175 
2176         /*
2177          * Initialize global zone kstats
2178          */
2179         zone_kstat_create(&zone0);
2180 
2181         /*
2182          * Initialize zone label.
2183          * mlp are initialized when tnzonecfg is loaded.
2184          */
2185         zone0.zone_slabel = l_admin_low;
2186         rw_init(&zone0.zone_mlps.mlpl_rwlock, NULL, RW_DEFAULT, NULL);
2187         label_hold(l_admin_low);
2188 
2189         /*
2190          * Initialise the lock for the database structure used by mntfs.
2191          */
2192         rw_init(&zone0.zone_mntfs_db_lock, NULL, RW_DEFAULT, NULL);
2193 
2194         mutex_enter(&zonehash_lock);
2195         zone_uniqid(&zone0);
2196         ASSERT(zone0.zone_uniqid == GLOBAL_ZONEUNIQID);
2197 
2198         zonehashbyid = mod_hash_create_idhash("zone_by_id", zone_hash_size,
2199             mod_hash_null_valdtor);
2200         zonehashbyname = mod_hash_create_strhash("zone_by_name",
2201             zone_hash_size, mod_hash_null_valdtor);
2202         /*
2203          * maintain zonehashbylabel only for labeled systems
2204          */
2205         if (is_system_labeled())
2206                 zonehashbylabel = mod_hash_create_extended("zone_by_label",
2207                     zone_hash_size, mod_hash_null_keydtor,
2208                     mod_hash_null_valdtor, hash_bylabel, NULL,
2209                     hash_labelkey_cmp, KM_SLEEP);
2210         zonecount = 1;
2211 
2212         (void) mod_hash_insert(zonehashbyid, (mod_hash_key_t)GLOBAL_ZONEID,
2213             (mod_hash_val_t)&zone0);
2214         (void) mod_hash_insert(zonehashbyname, (mod_hash_key_t)zone0.zone_name,
2215             (mod_hash_val_t)&zone0);
2216         if (is_system_labeled()) {
2217                 zone0.zone_flags |= ZF_HASHED_LABEL;
2218                 (void) mod_hash_insert(zonehashbylabel,
2219                     (mod_hash_key_t)zone0.zone_slabel, (mod_hash_val_t)&zone0);
2220         }
2221         mutex_exit(&zonehash_lock);
2222 
2223         /*
2224          * We avoid setting zone_kcred until now, since kcred is initialized
2225          * sometime after zone_zsd_init() and before zone_init().
2226          */
2227         zone0.zone_kcred = kcred;
2228         /*
2229          * The global zone is fully initialized (except for zone_rootvp which
2230          * will be set when the root filesystem is mounted).
2231          */
2232         global_zone = &zone0;
2233 
2234         /*
2235          * Setup an event channel to send zone status change notifications on
2236          */
2237         res = sysevent_evc_bind(ZONE_EVENT_CHANNEL, &zone_event_chan,
2238             EVCH_CREAT);
2239 
2240         if (res)
2241                 panic("Sysevent_evc_bind failed during zone setup.\n");
2242 
2243 }
2244 
2245 static void
2246 zone_free(zone_t *zone)
2247 {
2248         ASSERT(zone != global_zone);
2249         ASSERT(zone->zone_ntasks == 0);
2250         ASSERT(zone->zone_nlwps == 0);
2251         ASSERT(zone->zone_nprocs == 0);
2252         ASSERT(zone->zone_cred_ref == 0);
2253         ASSERT(zone->zone_kcred == NULL);
2254         ASSERT(zone_status_get(zone) == ZONE_IS_DEAD ||
2255             zone_status_get(zone) == ZONE_IS_UNINITIALIZED);
2256         ASSERT(list_is_empty(&zone->zone_ref_list));
2257 
2258         /*
2259          * Remove any zone caps.
2260          */
2261         cpucaps_zone_remove(zone);
2262 
2263         ASSERT(zone->zone_cpucap == NULL);
2264 
2265         /* remove from deathrow list */
2266         if (zone_status_get(zone) == ZONE_IS_DEAD) {
2267                 ASSERT(zone->zone_ref == 0);
2268                 mutex_enter(&zone_deathrow_lock);
2269                 list_remove(&zone_deathrow, zone);
2270                 mutex_exit(&zone_deathrow_lock);
2271         }
2272 
2273         list_destroy(&zone->zone_ref_list);
2274         zone_free_zsd(zone);
2275         zone_free_datasets(zone);
2276         list_destroy(&zone->zone_dl_list);
2277 
2278         if (zone->zone_rootvp != NULL)
2279                 VN_RELE(zone->zone_rootvp);
2280         if (zone->zone_rootpath)
2281                 kmem_free(zone->zone_rootpath, zone->zone_rootpathlen);
2282         if (zone->zone_name != NULL)
2283                 kmem_free(zone->zone_name, ZONENAME_MAX);
2284         if (zone->zone_slabel != NULL)
2285                 label_rele(zone->zone_slabel);
2286         if (zone->zone_nodename != NULL)
2287                 kmem_free(zone->zone_nodename, _SYS_NMLN);
2288         if (zone->zone_domain != NULL)
2289                 kmem_free(zone->zone_domain, _SYS_NMLN);
2290         if (zone->zone_privset != NULL)
2291                 kmem_free(zone->zone_privset, sizeof (priv_set_t));
2292         if (zone->zone_rctls != NULL)
2293                 rctl_set_free(zone->zone_rctls);
2294         if (zone->zone_bootargs != NULL)
2295                 strfree(zone->zone_bootargs);
2296         if (zone->zone_initname != NULL)
2297                 strfree(zone->zone_initname);
2298         if (zone->zone_fs_allowed != NULL)
2299                 strfree(zone->zone_fs_allowed);
2300         if (zone->zone_pfexecd != NULL)
2301                 klpd_freelist(&zone->zone_pfexecd);
2302         id_free(zoneid_space, zone->zone_id);
2303         mutex_destroy(&zone->zone_lock);
2304         cv_destroy(&zone->zone_cv);
2305         rw_destroy(&zone->zone_mlps.mlpl_rwlock);
2306         rw_destroy(&zone->zone_mntfs_db_lock);
2307         kmem_free(zone, sizeof (zone_t));
2308 }
2309 
2310 /*
2311  * See block comment at the top of this file for information about zone
2312  * status values.
2313  */
2314 /*
2315  * Convenience function for setting zone status.
2316  */
2317 static void
2318 zone_status_set(zone_t *zone, zone_status_t status)
2319 {
2320 
2321         nvlist_t *nvl = NULL;
2322         ASSERT(MUTEX_HELD(&zone_status_lock));
2323         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE &&
2324             status >= zone_status_get(zone));
2325 
2326         if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) ||
2327             nvlist_add_string(nvl, ZONE_CB_NAME, zone->zone_name) ||
2328             nvlist_add_string(nvl, ZONE_CB_NEWSTATE,
2329             zone_status_table[status]) ||
2330             nvlist_add_string(nvl, ZONE_CB_OLDSTATE,
2331             zone_status_table[zone->zone_status]) ||
2332             nvlist_add_int32(nvl, ZONE_CB_ZONEID, zone->zone_id) ||
2333             nvlist_add_uint64(nvl, ZONE_CB_TIMESTAMP, (uint64_t)gethrtime()) ||
2334             sysevent_evc_publish(zone_event_chan, ZONE_EVENT_STATUS_CLASS,
2335             ZONE_EVENT_STATUS_SUBCLASS, "sun.com", "kernel", nvl, EVCH_SLEEP)) {
2336 #ifdef DEBUG
2337                 (void) printf(
2338                     "Failed to allocate and send zone state change event.\n");
2339 #endif
2340         }
2341         nvlist_free(nvl);
2342 
2343         zone->zone_status = status;
2344 
2345         cv_broadcast(&zone->zone_cv);
2346 }
2347 
2348 /*
2349  * Public function to retrieve the zone status.  The zone status may
2350  * change after it is retrieved.
2351  */
2352 zone_status_t
2353 zone_status_get(zone_t *zone)
2354 {
2355         return (zone->zone_status);
2356 }
2357 
2358 static int
2359 zone_set_bootargs(zone_t *zone, const char *zone_bootargs)
2360 {
2361         char *buf = kmem_zalloc(BOOTARGS_MAX, KM_SLEEP);
2362         int err = 0;
2363 
2364         ASSERT(zone != global_zone);
2365         if ((err = copyinstr(zone_bootargs, buf, BOOTARGS_MAX, NULL)) != 0)
2366                 goto done;      /* EFAULT or ENAMETOOLONG */
2367 
2368         if (zone->zone_bootargs != NULL)
2369                 strfree(zone->zone_bootargs);
2370 
2371         zone->zone_bootargs = strdup(buf);
2372 
2373 done:
2374         kmem_free(buf, BOOTARGS_MAX);
2375         return (err);
2376 }
2377 
2378 static int
2379 zone_set_brand(zone_t *zone, const char *brand)
2380 {
2381         struct brand_attr *attrp;
2382         brand_t *bp;
2383 
2384         attrp = kmem_alloc(sizeof (struct brand_attr), KM_SLEEP);
2385         if (copyin(brand, attrp, sizeof (struct brand_attr)) != 0) {
2386                 kmem_free(attrp, sizeof (struct brand_attr));
2387                 return (EFAULT);
2388         }
2389 
2390         bp = brand_register_zone(attrp);
2391         kmem_free(attrp, sizeof (struct brand_attr));
2392         if (bp == NULL)
2393                 return (EINVAL);
2394 
2395         /*
2396          * This is the only place where a zone can change it's brand.
2397          * We already need to hold zone_status_lock to check the zone
2398          * status, so we'll just use that lock to serialize zone
2399          * branding requests as well.
2400          */
2401         mutex_enter(&zone_status_lock);
2402 
2403         /* Re-Branding is not allowed and the zone can't be booted yet */
2404         if ((ZONE_IS_BRANDED(zone)) ||
2405             (zone_status_get(zone) >= ZONE_IS_BOOTING)) {
2406                 mutex_exit(&zone_status_lock);
2407                 brand_unregister_zone(bp);
2408                 return (EINVAL);
2409         }
2410 
2411         /* set up the brand specific data */
2412         zone->zone_brand = bp;
2413         ZBROP(zone)->b_init_brand_data(zone);
2414 
2415         mutex_exit(&zone_status_lock);
2416         return (0);
2417 }
2418 
2419 static int
2420 zone_set_fs_allowed(zone_t *zone, const char *zone_fs_allowed)
2421 {
2422         char *buf = kmem_zalloc(ZONE_FS_ALLOWED_MAX, KM_SLEEP);
2423         int err = 0;
2424 
2425         ASSERT(zone != global_zone);
2426         if ((err = copyinstr(zone_fs_allowed, buf,
2427             ZONE_FS_ALLOWED_MAX, NULL)) != 0)
2428                 goto done;
2429 
2430         if (zone->zone_fs_allowed != NULL)
2431                 strfree(zone->zone_fs_allowed);
2432 
2433         zone->zone_fs_allowed = strdup(buf);
2434 
2435 done:
2436         kmem_free(buf, ZONE_FS_ALLOWED_MAX);
2437         return (err);
2438 }
2439 
2440 static int
2441 zone_set_initname(zone_t *zone, const char *zone_initname)
2442 {
2443         char initname[INITNAME_SZ];
2444         size_t len;
2445         int err = 0;
2446 
2447         ASSERT(zone != global_zone);
2448         if ((err = copyinstr(zone_initname, initname, INITNAME_SZ, &len)) != 0)
2449                 return (err);   /* EFAULT or ENAMETOOLONG */
2450 
2451         if (zone->zone_initname != NULL)
2452                 strfree(zone->zone_initname);
2453 
2454         zone->zone_initname = kmem_alloc(strlen(initname) + 1, KM_SLEEP);
2455         (void) strcpy(zone->zone_initname, initname);
2456         return (0);
2457 }
2458 
2459 static int
2460 zone_set_phys_mcap(zone_t *zone, const uint64_t *zone_mcap)
2461 {
2462         uint64_t mcap;
2463         int err = 0;
2464 
2465         if ((err = copyin(zone_mcap, &mcap, sizeof (uint64_t))) == 0)
2466                 zone->zone_phys_mcap = mcap;
2467 
2468         return (err);
2469 }
2470 
2471 static int
2472 zone_set_sched_class(zone_t *zone, const char *new_class)
2473 {
2474         char sched_class[PC_CLNMSZ];
2475         id_t classid;
2476         int err;
2477 
2478         ASSERT(zone != global_zone);
2479         if ((err = copyinstr(new_class, sched_class, PC_CLNMSZ, NULL)) != 0)
2480                 return (err);   /* EFAULT or ENAMETOOLONG */
2481 
2482         if (getcid(sched_class, &classid) != 0 || CLASS_KERNEL(classid))
2483                 return (set_errno(EINVAL));
2484         zone->zone_defaultcid = classid;
2485         ASSERT(zone->zone_defaultcid > 0 &&
2486             zone->zone_defaultcid < loaded_classes);
2487 
2488         return (0);
2489 }
2490 
2491 /*
2492  * Block indefinitely waiting for (zone_status >= status)
2493  */
2494 void
2495 zone_status_wait(zone_t *zone, zone_status_t status)
2496 {
2497         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2498 
2499         mutex_enter(&zone_status_lock);
2500         while (zone->zone_status < status) {
2501                 cv_wait(&zone->zone_cv, &zone_status_lock);
2502         }
2503         mutex_exit(&zone_status_lock);
2504 }
2505 
2506 /*
2507  * Private CPR-safe version of zone_status_wait().
2508  */
2509 static void
2510 zone_status_wait_cpr(zone_t *zone, zone_status_t status, char *str)
2511 {
2512         callb_cpr_t cprinfo;
2513 
2514         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2515 
2516         CALLB_CPR_INIT(&cprinfo, &zone_status_lock, callb_generic_cpr,
2517             str);
2518         mutex_enter(&zone_status_lock);
2519         while (zone->zone_status < status) {
2520                 CALLB_CPR_SAFE_BEGIN(&cprinfo);
2521                 cv_wait(&zone->zone_cv, &zone_status_lock);
2522                 CALLB_CPR_SAFE_END(&cprinfo, &zone_status_lock);
2523         }
2524         /*
2525          * zone_status_lock is implicitly released by the following.
2526          */
2527         CALLB_CPR_EXIT(&cprinfo);
2528 }
2529 
2530 /*
2531  * Block until zone enters requested state or signal is received.  Return (0)
2532  * if signaled, non-zero otherwise.
2533  */
2534 int
2535 zone_status_wait_sig(zone_t *zone, zone_status_t status)
2536 {
2537         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2538 
2539         mutex_enter(&zone_status_lock);
2540         while (zone->zone_status < status) {
2541                 if (!cv_wait_sig(&zone->zone_cv, &zone_status_lock)) {
2542                         mutex_exit(&zone_status_lock);
2543                         return (0);
2544                 }
2545         }
2546         mutex_exit(&zone_status_lock);
2547         return (1);
2548 }
2549 
2550 /*
2551  * Block until the zone enters the requested state or the timeout expires,
2552  * whichever happens first.  Return (-1) if operation timed out, time remaining
2553  * otherwise.
2554  */
2555 clock_t
2556 zone_status_timedwait(zone_t *zone, clock_t tim, zone_status_t status)
2557 {
2558         clock_t timeleft = 0;
2559 
2560         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2561 
2562         mutex_enter(&zone_status_lock);
2563         while (zone->zone_status < status && timeleft != -1) {
2564                 timeleft = cv_timedwait(&zone->zone_cv, &zone_status_lock, tim);
2565         }
2566         mutex_exit(&zone_status_lock);
2567         return (timeleft);
2568 }
2569 
2570 /*
2571  * Block until the zone enters the requested state, the current process is
2572  * signaled,  or the timeout expires, whichever happens first.  Return (-1) if
2573  * operation timed out, 0 if signaled, time remaining otherwise.
2574  */
2575 clock_t
2576 zone_status_timedwait_sig(zone_t *zone, clock_t tim, zone_status_t status)
2577 {
2578         clock_t timeleft = tim - ddi_get_lbolt();
2579 
2580         ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
2581 
2582         mutex_enter(&zone_status_lock);
2583         while (zone->zone_status < status) {
2584                 timeleft = cv_timedwait_sig(&zone->zone_cv, &zone_status_lock,
2585                     tim);
2586                 if (timeleft <= 0)
2587                         break;
2588         }
2589         mutex_exit(&zone_status_lock);
2590         return (timeleft);
2591 }
2592 
2593 /*
2594  * Zones have two reference counts: one for references from credential
2595  * structures (zone_cred_ref), and one (zone_ref) for everything else.
2596  * This is so we can allow a zone to be rebooted while there are still
2597  * outstanding cred references, since certain drivers cache dblks (which
2598  * implicitly results in cached creds).  We wait for zone_ref to drop to
2599  * 0 (actually 1), but not zone_cred_ref.  The zone structure itself is
2600  * later freed when the zone_cred_ref drops to 0, though nothing other
2601  * than the zone id and privilege set should be accessed once the zone
2602  * is "dead".
2603  *
2604  * A debugging flag, zone_wait_for_cred, can be set to a non-zero value
2605  * to force halt/reboot to block waiting for the zone_cred_ref to drop
2606  * to 0.  This can be useful to flush out other sources of cached creds
2607  * that may be less innocuous than the driver case.
2608  *
2609  * Zones also provide a tracked reference counting mechanism in which zone
2610  * references are represented by "crumbs" (zone_ref structures).  Crumbs help
2611  * debuggers determine the sources of leaked zone references.  See
2612  * zone_hold_ref() and zone_rele_ref() below for more information.
2613  */
2614 
2615 int zone_wait_for_cred = 0;
2616 
2617 static void
2618 zone_hold_locked(zone_t *z)
2619 {
2620         ASSERT(MUTEX_HELD(&z->zone_lock));
2621         z->zone_ref++;
2622         ASSERT(z->zone_ref != 0);
2623 }
2624 
2625 /*
2626  * Increment the specified zone's reference count.  The zone's zone_t structure
2627  * will not be freed as long as the zone's reference count is nonzero.
2628  * Decrement the zone's reference count via zone_rele().
2629  *
2630  * NOTE: This function should only be used to hold zones for short periods of
2631  * time.  Use zone_hold_ref() if the zone must be held for a long time.
2632  */
2633 void
2634 zone_hold(zone_t *z)
2635 {
2636         mutex_enter(&z->zone_lock);
2637         zone_hold_locked(z);
2638         mutex_exit(&z->zone_lock);
2639 }
2640 
2641 /*
2642  * If the non-cred ref count drops to 1 and either the cred ref count
2643  * is 0 or we aren't waiting for cred references, the zone is ready to
2644  * be destroyed.
2645  */
2646 #define ZONE_IS_UNREF(zone)     ((zone)->zone_ref == 1 && \
2647             (!zone_wait_for_cred || (zone)->zone_cred_ref == 0))
2648 
2649 /*
2650  * Common zone reference release function invoked by zone_rele() and
2651  * zone_rele_ref().  If subsys is ZONE_REF_NUM_SUBSYS, then the specified
2652  * zone's subsystem-specific reference counters are not affected by the
2653  * release.  If ref is not NULL, then the zone_ref_t to which it refers is
2654  * removed from the specified zone's reference list.  ref must be non-NULL iff
2655  * subsys is not ZONE_REF_NUM_SUBSYS.
2656  */
2657 static void
2658 zone_rele_common(zone_t *z, zone_ref_t *ref, zone_ref_subsys_t subsys)
2659 {
2660         boolean_t wakeup;
2661 
2662         mutex_enter(&z->zone_lock);
2663         ASSERT(z->zone_ref != 0);
2664         z->zone_ref--;
2665         if (subsys != ZONE_REF_NUM_SUBSYS) {
2666                 ASSERT(z->zone_subsys_ref[subsys] != 0);
2667                 z->zone_subsys_ref[subsys]--;
2668                 list_remove(&z->zone_ref_list, ref);
2669         }
2670         if (z->zone_ref == 0 && z->zone_cred_ref == 0) {
2671                 /* no more refs, free the structure */
2672                 mutex_exit(&z->zone_lock);
2673                 zone_free(z);
2674                 return;
2675         }
2676         /* signal zone_destroy so the zone can finish halting */
2677         wakeup = (ZONE_IS_UNREF(z) && zone_status_get(z) >= ZONE_IS_DEAD);
2678         mutex_exit(&z->zone_lock);
2679 
2680         if (wakeup) {
2681                 /*
2682                  * Grabbing zonehash_lock here effectively synchronizes with
2683                  * zone_destroy() to avoid missed signals.
2684                  */
2685                 mutex_enter(&zonehash_lock);
2686                 cv_broadcast(&zone_destroy_cv);
2687                 mutex_exit(&zonehash_lock);
2688         }
2689 }
2690 
2691 /*
2692  * Decrement the specified zone's reference count.  The specified zone will
2693  * cease to exist after this function returns if the reference count drops to
2694  * zero.  This function should be paired with zone_hold().
2695  */
2696 void
2697 zone_rele(zone_t *z)
2698 {
2699         zone_rele_common(z, NULL, ZONE_REF_NUM_SUBSYS);
2700 }
2701 
2702 /*
2703  * Initialize a zone reference structure.  This function must be invoked for
2704  * a reference structure before the structure is passed to zone_hold_ref().
2705  */
2706 void
2707 zone_init_ref(zone_ref_t *ref)
2708 {
2709         ref->zref_zone = NULL;
2710         list_link_init(&ref->zref_linkage);
2711 }
2712 
2713 /*
2714  * Acquire a reference to zone z.  The caller must specify the
2715  * zone_ref_subsys_t constant associated with its subsystem.  The specified
2716  * zone_ref_t structure will represent a reference to the specified zone.  Use
2717  * zone_rele_ref() to release the reference.
2718  *
2719  * The referenced zone_t structure will not be freed as long as the zone_t's
2720  * zone_status field is not ZONE_IS_DEAD and the zone has outstanding
2721  * references.
2722  *
2723  * NOTE: The zone_ref_t structure must be initialized before it is used.
2724  * See zone_init_ref() above.
2725  */
2726 void
2727 zone_hold_ref(zone_t *z, zone_ref_t *ref, zone_ref_subsys_t subsys)
2728 {
2729         ASSERT(subsys >= 0 && subsys < ZONE_REF_NUM_SUBSYS);
2730 
2731         /*
2732          * Prevent consumers from reusing a reference structure before
2733          * releasing it.
2734          */
2735         VERIFY(ref->zref_zone == NULL);
2736 
2737         ref->zref_zone = z;
2738         mutex_enter(&z->zone_lock);
2739         zone_hold_locked(z);
2740         z->zone_subsys_ref[subsys]++;
2741         ASSERT(z->zone_subsys_ref[subsys] != 0);
2742         list_insert_head(&z->zone_ref_list, ref);
2743         mutex_exit(&z->zone_lock);
2744 }
2745 
2746 /*
2747  * Release the zone reference represented by the specified zone_ref_t.
2748  * The reference is invalid after it's released; however, the zone_ref_t
2749  * structure can be reused without having to invoke zone_init_ref().
2750  * subsys should be the same value that was passed to zone_hold_ref()
2751  * when the reference was acquired.
2752  */
2753 void
2754 zone_rele_ref(zone_ref_t *ref, zone_ref_subsys_t subsys)
2755 {
2756         zone_rele_common(ref->zref_zone, ref, subsys);
2757 
2758         /*
2759          * Set the zone_ref_t's zref_zone field to NULL to generate panics
2760          * when consumers dereference the reference.  This helps us catch
2761          * consumers who use released references.  Furthermore, this lets
2762          * consumers reuse the zone_ref_t structure without having to
2763          * invoke zone_init_ref().
2764          */
2765         ref->zref_zone = NULL;
2766 }
2767 
2768 void
2769 zone_cred_hold(zone_t *z)
2770 {
2771         mutex_enter(&z->zone_lock);
2772         z->zone_cred_ref++;
2773         ASSERT(z->zone_cred_ref != 0);
2774         mutex_exit(&z->zone_lock);
2775 }
2776 
2777 void
2778 zone_cred_rele(zone_t *z)
2779 {
2780         boolean_t wakeup;
2781 
2782         mutex_enter(&z->zone_lock);
2783         ASSERT(z->zone_cred_ref != 0);
2784         z->zone_cred_ref--;
2785         if (z->zone_ref == 0 && z->zone_cred_ref == 0) {
2786                 /* no more refs, free the structure */
2787                 mutex_exit(&z->zone_lock);
2788                 zone_free(z);
2789                 return;
2790         }
2791         /*
2792          * If zone_destroy is waiting for the cred references to drain
2793          * out, and they have, signal it.
2794          */
2795         wakeup = (zone_wait_for_cred && ZONE_IS_UNREF(z) &&
2796             zone_status_get(z) >= ZONE_IS_DEAD);
2797         mutex_exit(&z->zone_lock);
2798 
2799         if (wakeup) {
2800                 /*
2801                  * Grabbing zonehash_lock here effectively synchronizes with
2802                  * zone_destroy() to avoid missed signals.
2803                  */
2804                 mutex_enter(&zonehash_lock);
2805                 cv_broadcast(&zone_destroy_cv);
2806                 mutex_exit(&zonehash_lock);
2807         }
2808 }
2809 
2810 void
2811 zone_task_hold(zone_t *z)
2812 {
2813         mutex_enter(&z->zone_lock);
2814         z->zone_ntasks++;
2815         ASSERT(z->zone_ntasks != 0);
2816         mutex_exit(&z->zone_lock);
2817 }
2818 
2819 void
2820 zone_task_rele(zone_t *zone)
2821 {
2822         uint_t refcnt;
2823 
2824         mutex_enter(&zone->zone_lock);
2825         ASSERT(zone->zone_ntasks != 0);
2826         refcnt = --zone->zone_ntasks;
2827         if (refcnt > 1)      {       /* Common case */
2828                 mutex_exit(&zone->zone_lock);
2829                 return;
2830         }
2831         zone_hold_locked(zone); /* so we can use the zone_t later */
2832         mutex_exit(&zone->zone_lock);
2833         if (refcnt == 1) {
2834                 /*
2835                  * See if the zone is shutting down.
2836                  */
2837                 mutex_enter(&zone_status_lock);
2838                 if (zone_status_get(zone) != ZONE_IS_SHUTTING_DOWN) {
2839                         goto out;
2840                 }
2841 
2842                 /*
2843                  * Make sure the ntasks didn't change since we
2844                  * dropped zone_lock.
2845                  */
2846                 mutex_enter(&zone->zone_lock);
2847                 if (refcnt != zone->zone_ntasks) {
2848                         mutex_exit(&zone->zone_lock);
2849                         goto out;
2850                 }
2851                 mutex_exit(&zone->zone_lock);
2852 
2853                 /*
2854                  * No more user processes in the zone.  The zone is empty.
2855                  */
2856                 zone_status_set(zone, ZONE_IS_EMPTY);
2857                 goto out;
2858         }
2859 
2860         ASSERT(refcnt == 0);
2861         /*
2862          * zsched has exited; the zone is dead.
2863          */
2864         zone->zone_zsched = NULL;            /* paranoia */
2865         mutex_enter(&zone_status_lock);
2866         zone_status_set(zone, ZONE_IS_DEAD);
2867 out:
2868         mutex_exit(&zone_status_lock);
2869         zone_rele(zone);
2870 }
2871 
2872 zoneid_t
2873 getzoneid(void)
2874 {
2875         return (curproc->p_zone->zone_id);
2876 }
2877 
2878 /*
2879  * Internal versions of zone_find_by_*().  These don't zone_hold() or
2880  * check the validity of a zone's state.
2881  */
2882 static zone_t *
2883 zone_find_all_by_id(zoneid_t zoneid)
2884 {
2885         mod_hash_val_t hv;
2886         zone_t *zone = NULL;
2887 
2888         ASSERT(MUTEX_HELD(&zonehash_lock));
2889 
2890         if (mod_hash_find(zonehashbyid,
2891             (mod_hash_key_t)(uintptr_t)zoneid, &hv) == 0)
2892                 zone = (zone_t *)hv;
2893         return (zone);
2894 }
2895 
2896 static zone_t *
2897 zone_find_all_by_label(const ts_label_t *label)
2898 {
2899         mod_hash_val_t hv;
2900         zone_t *zone = NULL;
2901 
2902         ASSERT(MUTEX_HELD(&zonehash_lock));
2903 
2904         /*
2905          * zonehashbylabel is not maintained for unlabeled systems
2906          */
2907         if (!is_system_labeled())
2908                 return (NULL);
2909         if (mod_hash_find(zonehashbylabel, (mod_hash_key_t)label, &hv) == 0)
2910                 zone = (zone_t *)hv;
2911         return (zone);
2912 }
2913 
2914 static zone_t *
2915 zone_find_all_by_name(char *name)
2916 {
2917         mod_hash_val_t hv;
2918         zone_t *zone = NULL;
2919 
2920         ASSERT(MUTEX_HELD(&zonehash_lock));
2921 
2922         if (mod_hash_find(zonehashbyname, (mod_hash_key_t)name, &hv) == 0)
2923                 zone = (zone_t *)hv;
2924         return (zone);
2925 }
2926 
2927 /*
2928  * Public interface for looking up a zone by zoneid.  Only returns the zone if
2929  * it is fully initialized, and has not yet begun the zone_destroy() sequence.
2930  * Caller must call zone_rele() once it is done with the zone.
2931  *
2932  * The zone may begin the zone_destroy() sequence immediately after this
2933  * function returns, but may be safely used until zone_rele() is called.
2934  */
2935 zone_t *
2936 zone_find_by_id(zoneid_t zoneid)
2937 {
2938         zone_t *zone;
2939         zone_status_t status;
2940 
2941         mutex_enter(&zonehash_lock);
2942         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
2943                 mutex_exit(&zonehash_lock);
2944                 return (NULL);
2945         }
2946         status = zone_status_get(zone);
2947         if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
2948                 /*
2949                  * For all practical purposes the zone doesn't exist.
2950                  */
2951                 mutex_exit(&zonehash_lock);
2952                 return (NULL);
2953         }
2954         zone_hold(zone);
2955         mutex_exit(&zonehash_lock);
2956         return (zone);
2957 }
2958 
2959 /*
2960  * Similar to zone_find_by_id, but using zone label as the key.
2961  */
2962 zone_t *
2963 zone_find_by_label(const ts_label_t *label)
2964 {
2965         zone_t *zone;
2966         zone_status_t status;
2967 
2968         mutex_enter(&zonehash_lock);
2969         if ((zone = zone_find_all_by_label(label)) == NULL) {
2970                 mutex_exit(&zonehash_lock);
2971                 return (NULL);
2972         }
2973 
2974         status = zone_status_get(zone);
2975         if (status > ZONE_IS_DOWN) {
2976                 /*
2977                  * For all practical purposes the zone doesn't exist.
2978                  */
2979                 mutex_exit(&zonehash_lock);
2980                 return (NULL);
2981         }
2982         zone_hold(zone);
2983         mutex_exit(&zonehash_lock);
2984         return (zone);
2985 }
2986 
2987 /*
2988  * Similar to zone_find_by_id, but using zone name as the key.
2989  */
2990 zone_t *
2991 zone_find_by_name(char *name)
2992 {
2993         zone_t *zone;
2994         zone_status_t status;
2995 
2996         mutex_enter(&zonehash_lock);
2997         if ((zone = zone_find_all_by_name(name)) == NULL) {
2998                 mutex_exit(&zonehash_lock);
2999                 return (NULL);
3000         }
3001         status = zone_status_get(zone);
3002         if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
3003                 /*
3004                  * For all practical purposes the zone doesn't exist.
3005                  */
3006                 mutex_exit(&zonehash_lock);
3007                 return (NULL);
3008         }
3009         zone_hold(zone);
3010         mutex_exit(&zonehash_lock);
3011         return (zone);
3012 }
3013 
3014 /*
3015  * Similar to zone_find_by_id(), using the path as a key.  For instance,
3016  * if there is a zone "foo" rooted at /foo/root, and the path argument
3017  * is "/foo/root/proc", it will return the held zone_t corresponding to
3018  * zone "foo".
3019  *
3020  * zone_find_by_path() always returns a non-NULL value, since at the
3021  * very least every path will be contained in the global zone.
3022  *
3023  * As with the other zone_find_by_*() functions, the caller is
3024  * responsible for zone_rele()ing the return value of this function.
3025  */
3026 zone_t *
3027 zone_find_by_path(const char *path)
3028 {
3029         zone_t *zone;
3030         zone_t *zret = NULL;
3031         zone_status_t status;
3032 
3033         if (path == NULL) {
3034                 /*
3035                  * Call from rootconf().
3036                  */
3037                 zone_hold(global_zone);
3038                 return (global_zone);
3039         }
3040         ASSERT(*path == '/');
3041         mutex_enter(&zonehash_lock);
3042         for (zone = list_head(&zone_active); zone != NULL;
3043             zone = list_next(&zone_active, zone)) {
3044                 if (ZONE_PATH_VISIBLE(path, zone))
3045                         zret = zone;
3046         }
3047         ASSERT(zret != NULL);
3048         status = zone_status_get(zret);
3049         if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
3050                 /*
3051                  * Zone practically doesn't exist.
3052                  */
3053                 zret = global_zone;
3054         }
3055         zone_hold(zret);
3056         mutex_exit(&zonehash_lock);
3057         return (zret);
3058 }
3059 
3060 /*
3061  * Public interface for updating per-zone load averages.  Called once per
3062  * second.
3063  *
3064  * Based on loadavg_update(), genloadavg() and calcloadavg() from clock.c.
3065  */
3066 void
3067 zone_loadavg_update()
3068 {
3069         zone_t *zp;
3070         zone_status_t status;
3071         struct loadavg_s *lavg;
3072         hrtime_t zone_total;
3073         int i;
3074         hrtime_t hr_avg;
3075         int nrun;
3076         static int64_t f[3] = { 135, 27, 9 };
3077         int64_t q, r;
3078 
3079         mutex_enter(&zonehash_lock);
3080         for (zp = list_head(&zone_active); zp != NULL;
3081             zp = list_next(&zone_active, zp)) {
3082                 mutex_enter(&zp->zone_lock);
3083 
3084                 /* Skip zones that are on the way down or not yet up */
3085                 status = zone_status_get(zp);
3086                 if (status < ZONE_IS_READY || status >= ZONE_IS_DOWN) {
3087                         /* For all practical purposes the zone doesn't exist. */
3088                         mutex_exit(&zp->zone_lock);
3089                         continue;
3090                 }
3091 
3092                 /*
3093                  * Update the 10 second moving average data in zone_loadavg.
3094                  */
3095                 lavg = &zp->zone_loadavg;
3096 
3097                 zone_total = zp->zone_utime + zp->zone_stime + zp->zone_wtime;
3098                 scalehrtime(&zone_total);
3099 
3100                 /* The zone_total should always be increasing. */
3101                 lavg->lg_loads[lavg->lg_cur] = (zone_total > lavg->lg_total) ?
3102                     zone_total - lavg->lg_total : 0;
3103                 lavg->lg_cur = (lavg->lg_cur + 1) % S_LOADAVG_SZ;
3104                 /* lg_total holds the prev. 1 sec. total */
3105                 lavg->lg_total = zone_total;
3106 
3107                 /*
3108                  * To simplify the calculation, we don't calculate the load avg.
3109                  * until the zone has been up for at least 10 seconds and our
3110                  * moving average is thus full.
3111                  */
3112                 if ((lavg->lg_len + 1) < S_LOADAVG_SZ) {
3113                         lavg->lg_len++;
3114                         mutex_exit(&zp->zone_lock);
3115                         continue;
3116                 }
3117 
3118                 /* Now calculate the 1min, 5min, 15 min load avg. */
3119                 hr_avg = 0;
3120                 for (i = 0; i < S_LOADAVG_SZ; i++)
3121                         hr_avg += lavg->lg_loads[i];
3122                 hr_avg = hr_avg / S_LOADAVG_SZ;
3123                 nrun = hr_avg / (NANOSEC / LGRP_LOADAVG_IN_THREAD_MAX);
3124 
3125                 /* Compute load avg. See comment in calcloadavg() */
3126                 for (i = 0; i < 3; i++) {
3127                         q = (zp->zone_hp_avenrun[i] >> 16) << 7;
3128                         r = (zp->zone_hp_avenrun[i] & 0xffff) << 7;
3129                         zp->zone_hp_avenrun[i] +=
3130                             ((nrun - q) * f[i] - ((r * f[i]) >> 16)) >> 4;
3131 
3132                         /* avenrun[] can only hold 31 bits of load avg. */
3133                         if (zp->zone_hp_avenrun[i] <
3134                             ((uint64_t)1<<(31+16-FSHIFT)))
3135                                 zp->zone_avenrun[i] = (int32_t)
3136                                     (zp->zone_hp_avenrun[i] >> (16 - FSHIFT));
3137                         else
3138                                 zp->zone_avenrun[i] = 0x7fffffff;
3139                 }
3140 
3141                 mutex_exit(&zp->zone_lock);
3142         }
3143         mutex_exit(&zonehash_lock);
3144 }
3145 
3146 /*
3147  * Get the number of cpus visible to this zone.  The system-wide global
3148  * 'ncpus' is returned if pools are disabled, the caller is in the
3149  * global zone, or a NULL zone argument is passed in.
3150  */
3151 int
3152 zone_ncpus_get(zone_t *zone)
3153 {
3154         int myncpus = zone == NULL ? 0 : zone->zone_ncpus;
3155 
3156         return (myncpus != 0 ? myncpus : ncpus);
3157 }
3158 
3159 /*
3160  * Get the number of online cpus visible to this zone.  The system-wide
3161  * global 'ncpus_online' is returned if pools are disabled, the caller
3162  * is in the global zone, or a NULL zone argument is passed in.
3163  */
3164 int
3165 zone_ncpus_online_get(zone_t *zone)
3166 {
3167         int myncpus_online = zone == NULL ? 0 : zone->zone_ncpus_online;
3168 
3169         return (myncpus_online != 0 ? myncpus_online : ncpus_online);
3170 }
3171 
3172 /*
3173  * Return the pool to which the zone is currently bound.
3174  */
3175 pool_t *
3176 zone_pool_get(zone_t *zone)
3177 {
3178         ASSERT(pool_lock_held());
3179 
3180         return (zone->zone_pool);
3181 }
3182 
3183 /*
3184  * Set the zone's pool pointer and update the zone's visibility to match
3185  * the resources in the new pool.
3186  */
3187 void
3188 zone_pool_set(zone_t *zone, pool_t *pool)
3189 {
3190         ASSERT(pool_lock_held());
3191         ASSERT(MUTEX_HELD(&cpu_lock));
3192 
3193         zone->zone_pool = pool;
3194         zone_pset_set(zone, pool->pool_pset->pset_id);
3195 }
3196 
3197 /*
3198  * Return the cached value of the id of the processor set to which the
3199  * zone is currently bound.  The value will be ZONE_PS_INVAL if the pools
3200  * facility is disabled.
3201  */
3202 psetid_t
3203 zone_pset_get(zone_t *zone)
3204 {
3205         ASSERT(MUTEX_HELD(&cpu_lock));
3206 
3207         return (zone->zone_psetid);
3208 }
3209 
3210 /*
3211  * Set the cached value of the id of the processor set to which the zone
3212  * is currently bound.  Also update the zone's visibility to match the
3213  * resources in the new processor set.
3214  */
3215 void
3216 zone_pset_set(zone_t *zone, psetid_t newpsetid)
3217 {
3218         psetid_t oldpsetid;
3219 
3220         ASSERT(MUTEX_HELD(&cpu_lock));
3221         oldpsetid = zone_pset_get(zone);
3222 
3223         if (oldpsetid == newpsetid)
3224                 return;
3225         /*
3226          * Global zone sees all.
3227          */
3228         if (zone != global_zone) {
3229                 zone->zone_psetid = newpsetid;
3230                 if (newpsetid != ZONE_PS_INVAL)
3231                         pool_pset_visibility_add(newpsetid, zone);
3232                 if (oldpsetid != ZONE_PS_INVAL)
3233                         pool_pset_visibility_remove(oldpsetid, zone);
3234         }
3235         /*
3236          * Disabling pools, so we should start using the global values
3237          * for ncpus and ncpus_online.
3238          */
3239         if (newpsetid == ZONE_PS_INVAL) {
3240                 zone->zone_ncpus = 0;
3241                 zone->zone_ncpus_online = 0;
3242         }
3243 }
3244 
3245 /*
3246  * Walk the list of active zones and issue the provided callback for
3247  * each of them.
3248  *
3249  * Caller must not be holding any locks that may be acquired under
3250  * zonehash_lock.  See comment at the beginning of the file for a list of
3251  * common locks and their interactions with zones.
3252  */
3253 int
3254 zone_walk(int (*cb)(zone_t *, void *), void *data)
3255 {
3256         zone_t *zone;
3257         int ret = 0;
3258         zone_status_t status;
3259 
3260         mutex_enter(&zonehash_lock);
3261         for (zone = list_head(&zone_active); zone != NULL;
3262             zone = list_next(&zone_active, zone)) {
3263                 /*
3264                  * Skip zones that shouldn't be externally visible.
3265                  */
3266                 status = zone_status_get(zone);
3267                 if (status < ZONE_IS_READY || status > ZONE_IS_DOWN)
3268                         continue;
3269                 /*
3270                  * Bail immediately if any callback invocation returns a
3271                  * non-zero value.
3272                  */
3273                 ret = (*cb)(zone, data);
3274                 if (ret != 0)
3275                         break;
3276         }
3277         mutex_exit(&zonehash_lock);
3278         return (ret);
3279 }
3280 
3281 static int
3282 zone_set_root(zone_t *zone, const char *upath)
3283 {
3284         vnode_t *vp;
3285         int trycount;
3286         int error = 0;
3287         char *path;
3288         struct pathname upn, pn;
3289         size_t pathlen;
3290 
3291         if ((error = pn_get((char *)upath, UIO_USERSPACE, &upn)) != 0)
3292                 return (error);
3293 
3294         pn_alloc(&pn);
3295 
3296         /* prevent infinite loop */
3297         trycount = 10;
3298         for (;;) {
3299                 if (--trycount <= 0) {
3300                         error = ESTALE;
3301                         goto out;
3302                 }
3303 
3304                 if ((error = lookuppn(&upn, &pn, FOLLOW, NULLVPP, &vp)) == 0) {
3305                         /*
3306                          * VOP_ACCESS() may cover 'vp' with a new
3307                          * filesystem, if 'vp' is an autoFS vnode.
3308                          * Get the new 'vp' if so.
3309                          */
3310                         if ((error =
3311                             VOP_ACCESS(vp, VEXEC, 0, CRED(), NULL)) == 0 &&
3312                             (!vn_ismntpt(vp) ||
3313                             (error = traverse(&vp)) == 0)) {
3314                                 pathlen = pn.pn_pathlen + 2;
3315                                 path = kmem_alloc(pathlen, KM_SLEEP);
3316                                 (void) strncpy(path, pn.pn_path,
3317                                     pn.pn_pathlen + 1);
3318                                 path[pathlen - 2] = '/';
3319                                 path[pathlen - 1] = '\0';
3320                                 pn_free(&pn);
3321                                 pn_free(&upn);
3322 
3323                                 /* Success! */
3324                                 break;
3325                         }
3326                         VN_RELE(vp);
3327                 }
3328                 if (error != ESTALE)
3329                         goto out;
3330         }
3331 
3332         ASSERT(error == 0);
3333         zone->zone_rootvp = vp;              /* we hold a reference to vp */
3334         zone->zone_rootpath = path;
3335         zone->zone_rootpathlen = pathlen;
3336         if (pathlen > 5 && strcmp(path + pathlen - 5, "/lu/") == 0)
3337                 zone->zone_flags |= ZF_IS_SCRATCH;
3338         return (0);
3339 
3340 out:
3341         pn_free(&pn);
3342         pn_free(&upn);
3343         return (error);
3344 }
3345 
3346 #define isalnum(c)      (((c) >= '0' && (c) <= '9') || \
3347                         ((c) >= 'a' && (c) <= 'z') || \
3348                         ((c) >= 'A' && (c) <= 'Z'))
3349 
3350 static int
3351 zone_set_name(zone_t *zone, const char *uname)
3352 {
3353         char *kname = kmem_zalloc(ZONENAME_MAX, KM_SLEEP);
3354         size_t len;
3355         int i, err;
3356 
3357         if ((err = copyinstr(uname, kname, ZONENAME_MAX, &len)) != 0) {
3358                 kmem_free(kname, ZONENAME_MAX);
3359                 return (err);   /* EFAULT or ENAMETOOLONG */
3360         }
3361 
3362         /* must be less than ZONENAME_MAX */
3363         if (len == ZONENAME_MAX && kname[ZONENAME_MAX - 1] != '\0') {
3364                 kmem_free(kname, ZONENAME_MAX);
3365                 return (EINVAL);
3366         }
3367 
3368         /*
3369          * Name must start with an alphanumeric and must contain only
3370          * alphanumerics, '-', '_' and '.'.
3371          */
3372         if (!isalnum(kname[0])) {
3373                 kmem_free(kname, ZONENAME_MAX);
3374                 return (EINVAL);
3375         }
3376         for (i = 1; i < len - 1; i++) {
3377                 if (!isalnum(kname[i]) && kname[i] != '-' && kname[i] != '_' &&
3378                     kname[i] != '.') {
3379                         kmem_free(kname, ZONENAME_MAX);
3380                         return (EINVAL);
3381                 }
3382         }
3383 
3384         zone->zone_name = kname;
3385         return (0);
3386 }
3387 
3388 /*
3389  * Gets the 32-bit hostid of the specified zone as an unsigned int.  If 'zonep'
3390  * is NULL or it points to a zone with no hostid emulation, then the machine's
3391  * hostid (i.e., the global zone's hostid) is returned.  This function returns
3392  * zero if neither the zone nor the host machine (global zone) have hostids.  It
3393  * returns HW_INVALID_HOSTID if the function attempts to return the machine's
3394  * hostid and the machine's hostid is invalid.
3395  */
3396 uint32_t
3397 zone_get_hostid(zone_t *zonep)
3398 {
3399         unsigned long machine_hostid;
3400 
3401         if (zonep == NULL || zonep->zone_hostid == HW_INVALID_HOSTID) {
3402                 if (ddi_strtoul(hw_serial, NULL, 10, &machine_hostid) != 0)
3403                         return (HW_INVALID_HOSTID);
3404                 return ((uint32_t)machine_hostid);
3405         }
3406         return (zonep->zone_hostid);
3407 }
3408 
3409 /*
3410  * Similar to thread_create(), but makes sure the thread is in the appropriate
3411  * zone's zsched process (curproc->p_zone->zone_zsched) before returning.
3412  */
3413 /*ARGSUSED*/
3414 kthread_t *
3415 zthread_create(
3416     caddr_t stk,
3417     size_t stksize,
3418     void (*proc)(),
3419     void *arg,
3420     size_t len,
3421     pri_t pri)
3422 {
3423         kthread_t *t;
3424         zone_t *zone = curproc->p_zone;
3425         proc_t *pp = zone->zone_zsched;
3426 
3427         zone_hold(zone);        /* Reference to be dropped when thread exits */
3428 
3429         /*
3430          * No-one should be trying to create threads if the zone is shutting
3431          * down and there aren't any kernel threads around.  See comment
3432          * in zthread_exit().
3433          */
3434         ASSERT(!(zone->zone_kthreads == NULL &&
3435             zone_status_get(zone) >= ZONE_IS_EMPTY));
3436         /*
3437          * Create a thread, but don't let it run until we've finished setting
3438          * things up.
3439          */
3440         t = thread_create(stk, stksize, proc, arg, len, pp, TS_STOPPED, pri);
3441         ASSERT(t->t_forw == NULL);
3442         mutex_enter(&zone_status_lock);
3443         if (zone->zone_kthreads == NULL) {
3444                 t->t_forw = t->t_back = t;
3445         } else {
3446                 kthread_t *tx = zone->zone_kthreads;
3447 
3448                 t->t_forw = tx;
3449                 t->t_back = tx->t_back;
3450                 tx->t_back->t_forw = t;
3451                 tx->t_back = t;
3452         }
3453         zone->zone_kthreads = t;
3454         mutex_exit(&zone_status_lock);
3455 
3456         mutex_enter(&pp->p_lock);
3457         t->t_proc_flag |= TP_ZTHREAD;
3458         project_rele(t->t_proj);
3459         t->t_proj = project_hold(pp->p_task->tk_proj);
3460 
3461         /*
3462          * Setup complete, let it run.
3463          */
3464         thread_lock(t);
3465         t->t_schedflag |= TS_ALLSTART;
3466         setrun_locked(t);
3467         thread_unlock(t);
3468 
3469         mutex_exit(&pp->p_lock);
3470 
3471         return (t);
3472 }
3473 
3474 /*
3475  * Similar to thread_exit().  Must be called by threads created via
3476  * zthread_exit().
3477  */
3478 void
3479 zthread_exit(void)
3480 {
3481         kthread_t *t = curthread;
3482         proc_t *pp = curproc;
3483         zone_t *zone = pp->p_zone;
3484 
3485         mutex_enter(&zone_status_lock);
3486 
3487         /*
3488          * Reparent to p0
3489          */
3490         kpreempt_disable();
3491         mutex_enter(&pp->p_lock);
3492         t->t_proc_flag &= ~TP_ZTHREAD;
3493         t->t_procp = &p0;
3494         hat_thread_exit(t);
3495         mutex_exit(&pp->p_lock);
3496         kpreempt_enable();
3497 
3498         if (t->t_back == t) {
3499                 ASSERT(t->t_forw == t);
3500                 /*
3501                  * If the zone is empty, once the thread count
3502                  * goes to zero no further kernel threads can be
3503                  * created.  This is because if the creator is a process
3504                  * in the zone, then it must have exited before the zone
3505                  * state could be set to ZONE_IS_EMPTY.
3506                  * Otherwise, if the creator is a kernel thread in the
3507                  * zone, the thread count is non-zero.
3508                  *
3509                  * This really means that non-zone kernel threads should
3510                  * not create zone kernel threads.
3511                  */
3512                 zone->zone_kthreads = NULL;
3513                 if (zone_status_get(zone) == ZONE_IS_EMPTY) {
3514                         zone_status_set(zone, ZONE_IS_DOWN);
3515                         /*
3516                          * Remove any CPU caps on this zone.
3517                          */
3518                         cpucaps_zone_remove(zone);
3519                 }
3520         } else {
3521                 t->t_forw->t_back = t->t_back;
3522                 t->t_back->t_forw = t->t_forw;
3523                 if (zone->zone_kthreads == t)
3524                         zone->zone_kthreads = t->t_forw;
3525         }
3526         mutex_exit(&zone_status_lock);
3527         zone_rele(zone);
3528         thread_exit();
3529         /* NOTREACHED */
3530 }
3531 
3532 static void
3533 zone_chdir(vnode_t *vp, vnode_t **vpp, proc_t *pp)
3534 {
3535         vnode_t *oldvp;
3536 
3537         /* we're going to hold a reference here to the directory */
3538         VN_HOLD(vp);
3539 
3540         /* update abs cwd/root path see c2/audit.c */
3541         if (AU_AUDITING())
3542                 audit_chdirec(vp, vpp);
3543 
3544         mutex_enter(&pp->p_lock);
3545         oldvp = *vpp;
3546         *vpp = vp;
3547         mutex_exit(&pp->p_lock);
3548         if (oldvp != NULL)
3549                 VN_RELE(oldvp);
3550 }
3551 
3552 /*
3553  * Convert an rctl value represented by an nvlist_t into an rctl_val_t.
3554  */
3555 static int
3556 nvlist2rctlval(nvlist_t *nvl, rctl_val_t *rv)
3557 {
3558         nvpair_t *nvp = NULL;
3559         boolean_t priv_set = B_FALSE;
3560         boolean_t limit_set = B_FALSE;
3561         boolean_t action_set = B_FALSE;
3562 
3563         while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
3564                 const char *name;
3565                 uint64_t ui64;
3566 
3567                 name = nvpair_name(nvp);
3568                 if (nvpair_type(nvp) != DATA_TYPE_UINT64)
3569                         return (EINVAL);
3570                 (void) nvpair_value_uint64(nvp, &ui64);
3571                 if (strcmp(name, "privilege") == 0) {
3572                         /*
3573                          * Currently only privileged values are allowed, but
3574                          * this may change in the future.
3575                          */
3576                         if (ui64 != RCPRIV_PRIVILEGED)
3577                                 return (EINVAL);
3578                         rv->rcv_privilege = ui64;
3579                         priv_set = B_TRUE;
3580                 } else if (strcmp(name, "limit") == 0) {
3581                         rv->rcv_value = ui64;
3582                         limit_set = B_TRUE;
3583                 } else if (strcmp(name, "action") == 0) {
3584                         if (ui64 != RCTL_LOCAL_NOACTION &&
3585                             ui64 != RCTL_LOCAL_DENY)
3586                                 return (EINVAL);
3587                         rv->rcv_flagaction = ui64;
3588                         action_set = B_TRUE;
3589                 } else {
3590                         return (EINVAL);
3591                 }
3592         }
3593 
3594         if (!(priv_set && limit_set && action_set))
3595                 return (EINVAL);
3596         rv->rcv_action_signal = 0;
3597         rv->rcv_action_recipient = NULL;
3598         rv->rcv_action_recip_pid = -1;
3599         rv->rcv_firing_time = 0;
3600 
3601         return (0);
3602 }
3603 
3604 /*
3605  * Non-global zone version of start_init.
3606  */
3607 void
3608 zone_start_init(void)
3609 {
3610         proc_t *p = ttoproc(curthread);
3611         zone_t *z = p->p_zone;
3612 
3613         ASSERT(!INGLOBALZONE(curproc));
3614 
3615         /*
3616          * For all purposes (ZONE_ATTR_INITPID and restart_init),
3617          * storing just the pid of init is sufficient.
3618          */
3619         z->zone_proc_initpid = p->p_pid;
3620 
3621         /*
3622          * We maintain zone_boot_err so that we can return the cause of the
3623          * failure back to the caller of the zone_boot syscall.
3624          */
3625         p->p_zone->zone_boot_err = start_init_common();
3626 
3627         /*
3628          * We will prevent booting zones from becoming running zones if the
3629          * global zone is shutting down.
3630          */
3631         mutex_enter(&zone_status_lock);
3632         if (z->zone_boot_err != 0 || zone_status_get(global_zone) >=
3633             ZONE_IS_SHUTTING_DOWN) {
3634                 /*
3635                  * Make sure we are still in the booting state-- we could have
3636                  * raced and already be shutting down, or even further along.
3637                  */
3638                 if (zone_status_get(z) == ZONE_IS_BOOTING) {
3639                         zone_status_set(z, ZONE_IS_SHUTTING_DOWN);
3640                 }
3641                 mutex_exit(&zone_status_lock);
3642                 /* It's gone bad, dispose of the process */
3643                 if (proc_exit(CLD_EXITED, z->zone_boot_err) != 0) {
3644                         mutex_enter(&p->p_lock);
3645                         ASSERT(p->p_flag & SEXITLWPS);
3646                         lwp_exit();
3647                 }
3648         } else {
3649                 if (zone_status_get(z) == ZONE_IS_BOOTING)
3650                         zone_status_set(z, ZONE_IS_RUNNING);
3651                 mutex_exit(&zone_status_lock);
3652                 /* cause the process to return to userland. */
3653                 lwp_rtt();
3654         }
3655 }
3656 
3657 struct zsched_arg {
3658         zone_t *zone;
3659         nvlist_t *nvlist;
3660 };
3661 
3662 /*
3663  * Per-zone "sched" workalike.  The similarity to "sched" doesn't have
3664  * anything to do with scheduling, but rather with the fact that
3665  * per-zone kernel threads are parented to zsched, just like regular
3666  * kernel threads are parented to sched (p0).
3667  *
3668  * zsched is also responsible for launching init for the zone.
3669  */
3670 static void
3671 zsched(void *arg)
3672 {
3673         struct zsched_arg *za = arg;
3674         proc_t *pp = curproc;
3675         proc_t *initp = proc_init;
3676         zone_t *zone = za->zone;
3677         cred_t *cr, *oldcred;
3678         rctl_set_t *set;
3679         rctl_alloc_gp_t *gp;
3680         contract_t *ct = NULL;
3681         task_t *tk, *oldtk;
3682         rctl_entity_p_t e;
3683         kproject_t *pj;
3684 
3685         nvlist_t *nvl = za->nvlist;
3686         nvpair_t *nvp = NULL;
3687 
3688         bcopy("zsched", PTOU(pp)->u_psargs, sizeof ("zsched"));
3689         bcopy("zsched", PTOU(pp)->u_comm, sizeof ("zsched"));
3690         PTOU(pp)->u_argc = 0;
3691         PTOU(pp)->u_argv = NULL;
3692         PTOU(pp)->u_envp = NULL;
3693         closeall(P_FINFO(pp));
3694 
3695         /*
3696          * We are this zone's "zsched" process.  As the zone isn't generally
3697          * visible yet we don't need to grab any locks before initializing its
3698          * zone_proc pointer.
3699          */
3700         zone_hold(zone);  /* this hold is released by zone_destroy() */
3701         zone->zone_zsched = pp;
3702         mutex_enter(&pp->p_lock);
3703         pp->p_zone = zone;
3704         mutex_exit(&pp->p_lock);
3705 
3706         /*
3707          * Disassociate process from its 'parent'; parent ourselves to init
3708          * (pid 1) and change other values as needed.
3709          */
3710         sess_create();
3711 
3712         mutex_enter(&pidlock);
3713         proc_detach(pp);
3714         pp->p_ppid = 1;
3715         pp->p_flag |= SZONETOP;
3716         pp->p_ancpid = 1;
3717         pp->p_parent = initp;
3718         pp->p_psibling = NULL;
3719         if (initp->p_child)
3720                 initp->p_child->p_psibling = pp;
3721         pp->p_sibling = initp->p_child;
3722         initp->p_child = pp;
3723 
3724         /* Decrement what newproc() incremented. */
3725         upcount_dec(crgetruid(CRED()), GLOBAL_ZONEID);
3726         /*
3727          * Our credentials are about to become kcred-like, so we don't care
3728          * about the caller's ruid.
3729          */
3730         upcount_inc(crgetruid(kcred), zone->zone_id);
3731         mutex_exit(&pidlock);
3732 
3733         /*
3734          * getting out of global zone, so decrement lwp and process counts
3735          */
3736         pj = pp->p_task->tk_proj;
3737         mutex_enter(&global_zone->zone_nlwps_lock);
3738         pj->kpj_nlwps -= pp->p_lwpcnt;
3739         global_zone->zone_nlwps -= pp->p_lwpcnt;
3740         pj->kpj_nprocs--;
3741         global_zone->zone_nprocs--;
3742         mutex_exit(&global_zone->zone_nlwps_lock);
3743 
3744         /*
3745          * Decrement locked memory counts on old zone and project.
3746          */
3747         mutex_enter(&global_zone->zone_mem_lock);
3748         global_zone->zone_locked_mem -= pp->p_locked_mem;
3749         pj->kpj_data.kpd_locked_mem -= pp->p_locked_mem;
3750         mutex_exit(&global_zone->zone_mem_lock);
3751 
3752         /*
3753          * Create and join a new task in project '0' of this zone.
3754          *
3755          * We don't need to call holdlwps() since we know we're the only lwp in
3756          * this process.
3757          *
3758          * task_join() returns with p_lock held.
3759          */
3760         tk = task_create(0, zone);
3761         mutex_enter(&cpu_lock);
3762         oldtk = task_join(tk, 0);
3763 
3764         pj = pp->p_task->tk_proj;
3765 
3766         mutex_enter(&zone->zone_mem_lock);
3767         zone->zone_locked_mem += pp->p_locked_mem;
3768         pj->kpj_data.kpd_locked_mem += pp->p_locked_mem;
3769         mutex_exit(&zone->zone_mem_lock);
3770 
3771         /*
3772          * add lwp and process counts to zsched's zone, and increment
3773          * project's task and process count due to the task created in
3774          * the above task_create.
3775          */
3776         mutex_enter(&zone->zone_nlwps_lock);
3777         pj->kpj_nlwps += pp->p_lwpcnt;
3778         pj->kpj_ntasks += 1;
3779         zone->zone_nlwps += pp->p_lwpcnt;
3780         pj->kpj_nprocs++;
3781         zone->zone_nprocs++;
3782         mutex_exit(&zone->zone_nlwps_lock);
3783 
3784         mutex_exit(&curproc->p_lock);
3785         mutex_exit(&cpu_lock);
3786         task_rele(oldtk);
3787 
3788         /*
3789          * The process was created by a process in the global zone, hence the
3790          * credentials are wrong.  We might as well have kcred-ish credentials.
3791          */
3792         cr = zone->zone_kcred;
3793         crhold(cr);
3794         mutex_enter(&pp->p_crlock);
3795         oldcred = pp->p_cred;
3796         pp->p_cred = cr;
3797         mutex_exit(&pp->p_crlock);
3798         crfree(oldcred);
3799 
3800         /*
3801          * Hold credentials again (for thread)
3802          */
3803         crhold(cr);
3804 
3805         /*
3806          * p_lwpcnt can't change since this is a kernel process.
3807          */
3808         crset(pp, cr);
3809 
3810         /*
3811          * Chroot
3812          */
3813         zone_chdir(zone->zone_rootvp, &PTOU(pp)->u_cdir, pp);
3814         zone_chdir(zone->zone_rootvp, &PTOU(pp)->u_rdir, pp);
3815 
3816         /*
3817          * Initialize zone's rctl set.
3818          */
3819         set = rctl_set_create();
3820         gp = rctl_set_init_prealloc(RCENTITY_ZONE);
3821         mutex_enter(&pp->p_lock);
3822         e.rcep_p.zone = zone;
3823         e.rcep_t = RCENTITY_ZONE;
3824         zone->zone_rctls = rctl_set_init(RCENTITY_ZONE, pp, &e, set, gp);
3825         mutex_exit(&pp->p_lock);
3826         rctl_prealloc_destroy(gp);
3827 
3828         /*
3829          * Apply the rctls passed in to zone_create().  This is basically a list
3830          * assignment: all of the old values are removed and the new ones
3831          * inserted.  That is, if an empty list is passed in, all values are
3832          * removed.
3833          */
3834         while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
3835                 rctl_dict_entry_t *rde;
3836                 rctl_hndl_t hndl;
3837                 char *name;
3838                 nvlist_t **nvlarray;
3839                 uint_t i, nelem;
3840                 int error;      /* For ASSERT()s */
3841 
3842                 name = nvpair_name(nvp);
3843                 hndl = rctl_hndl_lookup(name);
3844                 ASSERT(hndl != -1);
3845                 rde = rctl_dict_lookup_hndl(hndl);
3846                 ASSERT(rde != NULL);
3847 
3848                 for (; /* ever */; ) {
3849                         rctl_val_t oval;
3850 
3851                         mutex_enter(&pp->p_lock);
3852                         error = rctl_local_get(hndl, NULL, &oval, pp);
3853                         mutex_exit(&pp->p_lock);
3854                         ASSERT(error == 0);     /* Can't fail for RCTL_FIRST */
3855                         ASSERT(oval.rcv_privilege != RCPRIV_BASIC);
3856                         if (oval.rcv_privilege == RCPRIV_SYSTEM)
3857                                 break;
3858                         mutex_enter(&pp->p_lock);
3859                         error = rctl_local_delete(hndl, &oval, pp);
3860                         mutex_exit(&pp->p_lock);
3861                         ASSERT(error == 0);
3862                 }
3863                 error = nvpair_value_nvlist_array(nvp, &nvlarray, &nelem);
3864                 ASSERT(error == 0);
3865                 for (i = 0; i < nelem; i++) {
3866                         rctl_val_t *nvalp;
3867 
3868                         nvalp = kmem_cache_alloc(rctl_val_cache, KM_SLEEP);
3869                         error = nvlist2rctlval(nvlarray[i], nvalp);
3870                         ASSERT(error == 0);
3871                         /*
3872                          * rctl_local_insert can fail if the value being
3873                          * inserted is a duplicate; this is OK.
3874                          */
3875                         mutex_enter(&pp->p_lock);
3876                         if (rctl_local_insert(hndl, nvalp, pp) != 0)
3877                                 kmem_cache_free(rctl_val_cache, nvalp);
3878                         mutex_exit(&pp->p_lock);
3879                 }
3880         }
3881         /*
3882          * Tell the world that we're done setting up.
3883          *
3884          * At this point we want to set the zone status to ZONE_IS_INITIALIZED
3885          * and atomically set the zone's processor set visibility.  Once
3886          * we drop pool_lock() this zone will automatically get updated
3887          * to reflect any future changes to the pools configuration.
3888          *
3889          * Note that after we drop the locks below (zonehash_lock in
3890          * particular) other operations such as a zone_getattr call can
3891          * now proceed and observe the zone. That is the reason for doing a
3892          * state transition to the INITIALIZED state.
3893          */
3894         pool_lock();
3895         mutex_enter(&cpu_lock);
3896         mutex_enter(&zonehash_lock);
3897         zone_uniqid(zone);
3898         zone_zsd_configure(zone);
3899         if (pool_state == POOL_ENABLED)
3900                 zone_pset_set(zone, pool_default->pool_pset->pset_id);
3901         mutex_enter(&zone_status_lock);
3902         ASSERT(zone_status_get(zone) == ZONE_IS_UNINITIALIZED);
3903         zone_status_set(zone, ZONE_IS_INITIALIZED);
3904         mutex_exit(&zone_status_lock);
3905         mutex_exit(&zonehash_lock);
3906         mutex_exit(&cpu_lock);
3907         pool_unlock();
3908 
3909         /* Now call the create callback for this key */
3910         zsd_apply_all_keys(zsd_apply_create, zone);
3911 
3912         /* The callbacks are complete. Mark ZONE_IS_READY */
3913         mutex_enter(&zone_status_lock);
3914         ASSERT(zone_status_get(zone) == ZONE_IS_INITIALIZED);
3915         zone_status_set(zone, ZONE_IS_READY);
3916         mutex_exit(&zone_status_lock);
3917 
3918         /*
3919          * Once we see the zone transition to the ZONE_IS_BOOTING state,
3920          * we launch init, and set the state to running.
3921          */
3922         zone_status_wait_cpr(zone, ZONE_IS_BOOTING, "zsched");
3923 
3924         if (zone_status_get(zone) == ZONE_IS_BOOTING) {
3925                 id_t cid;
3926 
3927                 /*
3928                  * Ok, this is a little complicated.  We need to grab the
3929                  * zone's pool's scheduling class ID; note that by now, we
3930                  * are already bound to a pool if we need to be (zoneadmd
3931                  * will have done that to us while we're in the READY
3932                  * state).  *But* the scheduling class for the zone's 'init'
3933                  * must be explicitly passed to newproc, which doesn't
3934                  * respect pool bindings.
3935                  *
3936                  * We hold the pool_lock across the call to newproc() to
3937                  * close the obvious race: the pool's scheduling class
3938                  * could change before we manage to create the LWP with
3939                  * classid 'cid'.
3940                  */
3941                 pool_lock();
3942                 if (zone->zone_defaultcid > 0)
3943                         cid = zone->zone_defaultcid;
3944                 else
3945                         cid = pool_get_class(zone->zone_pool);
3946                 if (cid == -1)
3947                         cid = defaultcid;
3948 
3949                 /*
3950                  * If this fails, zone_boot will ultimately fail.  The
3951                  * state of the zone will be set to SHUTTING_DOWN-- userland
3952                  * will have to tear down the zone, and fail, or try again.
3953                  */
3954                 if ((zone->zone_boot_err = newproc(zone_start_init, NULL, cid,
3955                     minclsyspri - 1, &ct, 0)) != 0) {
3956                         mutex_enter(&zone_status_lock);
3957                         zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
3958                         mutex_exit(&zone_status_lock);
3959                 } else {
3960                         zone->zone_boot_time = gethrestime_sec();
3961                 }
3962 
3963                 pool_unlock();
3964         }
3965 
3966         /*
3967          * Wait for zone_destroy() to be called.  This is what we spend
3968          * most of our life doing.
3969          */
3970         zone_status_wait_cpr(zone, ZONE_IS_DYING, "zsched");
3971 
3972         if (ct)
3973                 /*
3974                  * At this point the process contract should be empty.
3975                  * (Though if it isn't, it's not the end of the world.)
3976                  */
3977                 VERIFY(contract_abandon(ct, curproc, B_TRUE) == 0);
3978 
3979         /*
3980          * Allow kcred to be freed when all referring processes
3981          * (including this one) go away.  We can't just do this in
3982          * zone_free because we need to wait for the zone_cred_ref to
3983          * drop to 0 before calling zone_free, and the existence of
3984          * zone_kcred will prevent that.  Thus, we call crfree here to
3985          * balance the crdup in zone_create.  The crhold calls earlier
3986          * in zsched will be dropped when the thread and process exit.
3987          */
3988         crfree(zone->zone_kcred);
3989         zone->zone_kcred = NULL;
3990 
3991         exit(CLD_EXITED, 0);
3992 }
3993 
3994 /*
3995  * Helper function to determine if there are any submounts of the
3996  * provided path.  Used to make sure the zone doesn't "inherit" any
3997  * mounts from before it is created.
3998  */
3999 static uint_t
4000 zone_mount_count(const char *rootpath)
4001 {
4002         vfs_t *vfsp;
4003         uint_t count = 0;
4004         size_t rootpathlen = strlen(rootpath);
4005 
4006         /*
4007          * Holding zonehash_lock prevents race conditions with
4008          * vfs_list_add()/vfs_list_remove() since we serialize with
4009          * zone_find_by_path().
4010          */
4011         ASSERT(MUTEX_HELD(&zonehash_lock));
4012         /*
4013          * The rootpath must end with a '/'
4014          */
4015         ASSERT(rootpath[rootpathlen - 1] == '/');
4016 
4017         /*
4018          * This intentionally does not count the rootpath itself if that
4019          * happens to be a mount point.
4020          */
4021         vfs_list_read_lock();
4022         vfsp = rootvfs;
4023         do {
4024                 if (strncmp(rootpath, refstr_value(vfsp->vfs_mntpt),
4025                     rootpathlen) == 0)
4026                         count++;
4027                 vfsp = vfsp->vfs_next;
4028         } while (vfsp != rootvfs);
4029         vfs_list_unlock();
4030         return (count);
4031 }
4032 
4033 /*
4034  * Helper function to make sure that a zone created on 'rootpath'
4035  * wouldn't end up containing other zones' rootpaths.
4036  */
4037 static boolean_t
4038 zone_is_nested(const char *rootpath)
4039 {
4040         zone_t *zone;
4041         size_t rootpathlen = strlen(rootpath);
4042         size_t len;
4043 
4044         ASSERT(MUTEX_HELD(&zonehash_lock));
4045 
4046         /*
4047          * zone_set_root() appended '/' and '\0' at the end of rootpath
4048          */
4049         if ((rootpathlen <= 3) && (rootpath[0] == '/') &&
4050             (rootpath[1] == '/') && (rootpath[2] == '\0'))
4051                 return (B_TRUE);
4052 
4053         for (zone = list_head(&zone_active); zone != NULL;
4054             zone = list_next(&zone_active, zone)) {
4055                 if (zone == global_zone)
4056                         continue;
4057                 len = strlen(zone->zone_rootpath);
4058                 if (strncmp(rootpath, zone->zone_rootpath,
4059                     MIN(rootpathlen, len)) == 0)
4060                         return (B_TRUE);
4061         }
4062         return (B_FALSE);
4063 }
4064 
4065 static int
4066 zone_set_privset(zone_t *zone, const priv_set_t *zone_privs,
4067     size_t zone_privssz)
4068 {
4069         priv_set_t *privs;
4070 
4071         if (zone_privssz < sizeof (priv_set_t))
4072                 return (ENOMEM);
4073 
4074         privs = kmem_alloc(sizeof (priv_set_t), KM_SLEEP);
4075 
4076         if (copyin(zone_privs, privs, sizeof (priv_set_t))) {
4077                 kmem_free(privs, sizeof (priv_set_t));
4078                 return (EFAULT);
4079         }
4080 
4081         zone->zone_privset = privs;
4082         return (0);
4083 }
4084 
4085 /*
4086  * We make creative use of nvlists to pass in rctls from userland.  The list is
4087  * a list of the following structures:
4088  *
4089  * (name = rctl_name, value = nvpair_list_array)
4090  *
4091  * Where each element of the nvpair_list_array is of the form:
4092  *
4093  * [(name = "privilege", value = RCPRIV_PRIVILEGED),
4094  *      (name = "limit", value = uint64_t),
4095  *      (name = "action", value = (RCTL_LOCAL_NOACTION || RCTL_LOCAL_DENY))]
4096  */
4097 static int
4098 parse_rctls(caddr_t ubuf, size_t buflen, nvlist_t **nvlp)
4099 {
4100         nvpair_t *nvp = NULL;
4101         nvlist_t *nvl = NULL;
4102         char *kbuf;
4103         int error;
4104         rctl_val_t rv;
4105 
4106         *nvlp = NULL;
4107 
4108         if (buflen == 0)
4109                 return (0);
4110 
4111         if ((kbuf = kmem_alloc(buflen, KM_NOSLEEP)) == NULL)
4112                 return (ENOMEM);
4113         if (copyin(ubuf, kbuf, buflen)) {
4114                 error = EFAULT;
4115                 goto out;
4116         }
4117         if (nvlist_unpack(kbuf, buflen, &nvl, KM_SLEEP) != 0) {
4118                 /*
4119                  * nvl may have been allocated/free'd, but the value set to
4120                  * non-NULL, so we reset it here.
4121                  */
4122                 nvl = NULL;
4123                 error = EINVAL;
4124                 goto out;
4125         }
4126         while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
4127                 rctl_dict_entry_t *rde;
4128                 rctl_hndl_t hndl;
4129                 nvlist_t **nvlarray;
4130                 uint_t i, nelem;
4131                 char *name;
4132 
4133                 error = EINVAL;
4134                 name = nvpair_name(nvp);
4135                 if (strncmp(nvpair_name(nvp), "zone.", sizeof ("zone.") - 1)
4136                     != 0 || nvpair_type(nvp) != DATA_TYPE_NVLIST_ARRAY) {
4137                         goto out;
4138                 }
4139                 if ((hndl = rctl_hndl_lookup(name)) == -1) {
4140                         goto out;
4141                 }
4142                 rde = rctl_dict_lookup_hndl(hndl);
4143                 error = nvpair_value_nvlist_array(nvp, &nvlarray, &nelem);
4144                 ASSERT(error == 0);
4145                 for (i = 0; i < nelem; i++) {
4146                         if (error = nvlist2rctlval(nvlarray[i], &rv))
4147                                 goto out;
4148                 }
4149                 if (rctl_invalid_value(rde, &rv)) {
4150                         error = EINVAL;
4151                         goto out;
4152                 }
4153         }
4154         error = 0;
4155         *nvlp = nvl;
4156 out:
4157         kmem_free(kbuf, buflen);
4158         if (error && nvl != NULL)
4159                 nvlist_free(nvl);
4160         return (error);
4161 }
4162 
4163 int
4164 zone_create_error(int er_error, int er_ext, int *er_out) {
4165         if (er_out != NULL) {
4166                 if (copyout(&er_ext, er_out, sizeof (int))) {
4167                         return (set_errno(EFAULT));
4168                 }
4169         }
4170         return (set_errno(er_error));
4171 }
4172 
4173 static int
4174 zone_set_label(zone_t *zone, const bslabel_t *lab, uint32_t doi)
4175 {
4176         ts_label_t *tsl;
4177         bslabel_t blab;
4178 
4179         /* Get label from user */
4180         if (copyin(lab, &blab, sizeof (blab)) != 0)
4181                 return (EFAULT);
4182         tsl = labelalloc(&blab, doi, KM_NOSLEEP);
4183         if (tsl == NULL)
4184                 return (ENOMEM);
4185 
4186         zone->zone_slabel = tsl;
4187         return (0);
4188 }
4189 
4190 /*
4191  * Parses a comma-separated list of ZFS datasets into a per-zone dictionary.
4192  */
4193 static int
4194 parse_zfs(zone_t *zone, caddr_t ubuf, size_t buflen)
4195 {
4196         char *kbuf;
4197         char *dataset, *next;
4198         zone_dataset_t *zd;
4199         size_t len;
4200 
4201         if (ubuf == NULL || buflen == 0)
4202                 return (0);
4203 
4204         if ((kbuf = kmem_alloc(buflen, KM_NOSLEEP)) == NULL)
4205                 return (ENOMEM);
4206 
4207         if (copyin(ubuf, kbuf, buflen) != 0) {
4208                 kmem_free(kbuf, buflen);
4209                 return (EFAULT);
4210         }
4211 
4212         dataset = next = kbuf;
4213         for (;;) {
4214                 zd = kmem_alloc(sizeof (zone_dataset_t), KM_SLEEP);
4215 
4216                 next = strchr(dataset, ',');
4217 
4218                 if (next == NULL)
4219                         len = strlen(dataset);
4220                 else
4221                         len = next - dataset;
4222 
4223                 zd->zd_dataset = kmem_alloc(len + 1, KM_SLEEP);
4224                 bcopy(dataset, zd->zd_dataset, len);
4225                 zd->zd_dataset[len] = '\0';
4226 
4227                 list_insert_head(&zone->zone_datasets, zd);
4228 
4229                 if (next == NULL)
4230                         break;
4231 
4232                 dataset = next + 1;
4233         }
4234 
4235         kmem_free(kbuf, buflen);
4236         return (0);
4237 }
4238 
4239 /*
4240  * System call to create/initialize a new zone named 'zone_name', rooted
4241  * at 'zone_root', with a zone-wide privilege limit set of 'zone_privs',
4242  * and initialized with the zone-wide rctls described in 'rctlbuf', and
4243  * with labeling set by 'match', 'doi', and 'label'.
4244  *
4245  * If extended error is non-null, we may use it to return more detailed
4246  * error information.
4247  */
4248 static zoneid_t
4249 zone_create(const char *zone_name, const char *zone_root,
4250     const priv_set_t *zone_privs, size_t zone_privssz,
4251     caddr_t rctlbuf, size_t rctlbufsz,
4252     caddr_t zfsbuf, size_t zfsbufsz, int *extended_error,
4253     int match, uint32_t doi, const bslabel_t *label,
4254     int flags)
4255 {
4256         struct zsched_arg zarg;
4257         nvlist_t *rctls = NULL;
4258         proc_t *pp = curproc;
4259         zone_t *zone, *ztmp;
4260         zoneid_t zoneid;
4261         int error;
4262         int error2 = 0;
4263         char *str;
4264         cred_t *zkcr;
4265         boolean_t insert_label_hash;
4266 
4267         if (secpolicy_zone_config(CRED()) != 0)
4268                 return (set_errno(EPERM));
4269 
4270         /* can't boot zone from within chroot environment */
4271         if (PTOU(pp)->u_rdir != NULL && PTOU(pp)->u_rdir != rootdir)
4272                 return (zone_create_error(ENOTSUP, ZE_CHROOTED,
4273                     extended_error));
4274 
4275         zone = kmem_zalloc(sizeof (zone_t), KM_SLEEP);
4276         zoneid = zone->zone_id = id_alloc(zoneid_space);
4277         zone->zone_status = ZONE_IS_UNINITIALIZED;
4278         zone->zone_pool = pool_default;
4279         zone->zone_pool_mod = gethrtime();
4280         zone->zone_psetid = ZONE_PS_INVAL;
4281         zone->zone_ncpus = 0;
4282         zone->zone_ncpus_online = 0;
4283         zone->zone_restart_init = B_TRUE;
4284         zone->zone_brand = &native_brand;
4285         zone->zone_initname = NULL;
4286         mutex_init(&zone->zone_lock, NULL, MUTEX_DEFAULT, NULL);
4287         mutex_init(&zone->zone_nlwps_lock, NULL, MUTEX_DEFAULT, NULL);
4288         mutex_init(&zone->zone_mem_lock, NULL, MUTEX_DEFAULT, NULL);
4289         cv_init(&zone->zone_cv, NULL, CV_DEFAULT, NULL);
4290         list_create(&zone->zone_ref_list, sizeof (zone_ref_t),
4291             offsetof(zone_ref_t, zref_linkage));
4292         list_create(&zone->zone_zsd, sizeof (struct zsd_entry),
4293             offsetof(struct zsd_entry, zsd_linkage));
4294         list_create(&zone->zone_datasets, sizeof (zone_dataset_t),
4295             offsetof(zone_dataset_t, zd_linkage));
4296         list_create(&zone->zone_dl_list, sizeof (zone_dl_t),
4297             offsetof(zone_dl_t, zdl_linkage));
4298         rw_init(&zone->zone_mlps.mlpl_rwlock, NULL, RW_DEFAULT, NULL);
4299         rw_init(&zone->zone_mntfs_db_lock, NULL, RW_DEFAULT, NULL);
4300 
4301         if (flags & ZCF_NET_EXCL) {
4302                 zone->zone_flags |= ZF_NET_EXCL;
4303         }
4304 
4305         if ((error = zone_set_name(zone, zone_name)) != 0) {
4306                 zone_free(zone);
4307                 return (zone_create_error(error, 0, extended_error));
4308         }
4309 
4310         if ((error = zone_set_root(zone, zone_root)) != 0) {
4311                 zone_free(zone);
4312                 return (zone_create_error(error, 0, extended_error));
4313         }
4314         if ((error = zone_set_privset(zone, zone_privs, zone_privssz)) != 0) {
4315                 zone_free(zone);
4316                 return (zone_create_error(error, 0, extended_error));
4317         }
4318 
4319         /* initialize node name to be the same as zone name */
4320         zone->zone_nodename = kmem_alloc(_SYS_NMLN, KM_SLEEP);
4321         (void) strncpy(zone->zone_nodename, zone->zone_name, _SYS_NMLN);
4322         zone->zone_nodename[_SYS_NMLN - 1] = '\0';
4323 
4324         zone->zone_domain = kmem_alloc(_SYS_NMLN, KM_SLEEP);
4325         zone->zone_domain[0] = '\0';
4326         zone->zone_hostid = HW_INVALID_HOSTID;
4327         zone->zone_shares = 1;
4328         zone->zone_shmmax = 0;
4329         zone->zone_ipc.ipcq_shmmni = 0;
4330         zone->zone_ipc.ipcq_semmni = 0;
4331         zone->zone_ipc.ipcq_msgmni = 0;
4332         zone->zone_bootargs = NULL;
4333         zone->zone_fs_allowed = NULL;
4334         zone->zone_initname =
4335             kmem_alloc(strlen(zone_default_initname) + 1, KM_SLEEP);
4336         (void) strcpy(zone->zone_initname, zone_default_initname);
4337         zone->zone_nlwps = 0;
4338         zone->zone_nlwps_ctl = INT_MAX;
4339         zone->zone_nprocs = 0;
4340         zone->zone_nprocs_ctl = INT_MAX;
4341         zone->zone_locked_mem = 0;
4342         zone->zone_locked_mem_ctl = UINT64_MAX;
4343         zone->zone_max_swap = 0;
4344         zone->zone_max_swap_ctl = UINT64_MAX;
4345         zone->zone_max_lofi = 0;
4346         zone->zone_max_lofi_ctl = UINT64_MAX;
4347         zone0.zone_lockedmem_kstat = NULL;
4348         zone0.zone_swapresv_kstat = NULL;
4349 
4350         /*
4351          * Zsched initializes the rctls.
4352          */
4353         zone->zone_rctls = NULL;
4354 
4355         if ((error = parse_rctls(rctlbuf, rctlbufsz, &rctls)) != 0) {
4356                 zone_free(zone);
4357                 return (zone_create_error(error, 0, extended_error));
4358         }
4359 
4360         if ((error = parse_zfs(zone, zfsbuf, zfsbufsz)) != 0) {
4361                 zone_free(zone);
4362                 return (set_errno(error));
4363         }
4364 
4365         /*
4366          * Read in the trusted system parameters:
4367          * match flag and sensitivity label.
4368          */
4369         zone->zone_match = match;
4370         if (is_system_labeled() && !(zone->zone_flags & ZF_IS_SCRATCH)) {
4371                 /* Fail if requested to set doi to anything but system's doi */
4372                 if (doi != 0 && doi != default_doi) {
4373                         zone_free(zone);
4374                         return (set_errno(EINVAL));
4375                 }
4376                 /* Always apply system's doi to the zone */
4377                 error = zone_set_label(zone, label, default_doi);
4378                 if (error != 0) {
4379                         zone_free(zone);
4380                         return (set_errno(error));
4381                 }
4382                 insert_label_hash = B_TRUE;
4383         } else {
4384                 /* all zones get an admin_low label if system is not labeled */
4385                 zone->zone_slabel = l_admin_low;
4386                 label_hold(l_admin_low);
4387                 insert_label_hash = B_FALSE;
4388         }
4389 
4390         /*
4391          * Stop all lwps since that's what normally happens as part of fork().
4392          * This needs to happen before we grab any locks to avoid deadlock
4393          * (another lwp in the process could be waiting for the held lock).
4394          */
4395         if (curthread != pp->p_agenttp && !holdlwps(SHOLDFORK)) {
4396                 zone_free(zone);
4397                 if (rctls)
4398                         nvlist_free(rctls);
4399                 return (zone_create_error(error, 0, extended_error));
4400         }
4401 
4402         if (block_mounts() == 0) {
4403                 mutex_enter(&pp->p_lock);
4404                 if (curthread != pp->p_agenttp)
4405                         continuelwps(pp);
4406                 mutex_exit(&pp->p_lock);
4407                 zone_free(zone);
4408                 if (rctls)
4409                         nvlist_free(rctls);
4410                 return (zone_create_error(error, 0, extended_error));
4411         }
4412 
4413         /*
4414          * Set up credential for kernel access.  After this, any errors
4415          * should go through the dance in errout rather than calling
4416          * zone_free directly.
4417          */
4418         zone->zone_kcred = crdup(kcred);
4419         crsetzone(zone->zone_kcred, zone);
4420         priv_intersect(zone->zone_privset, &CR_PPRIV(zone->zone_kcred));
4421         priv_intersect(zone->zone_privset, &CR_EPRIV(zone->zone_kcred));
4422         priv_intersect(zone->zone_privset, &CR_IPRIV(zone->zone_kcred));
4423         priv_intersect(zone->zone_privset, &CR_LPRIV(zone->zone_kcred));
4424 
4425         mutex_enter(&zonehash_lock);
4426         /*
4427          * Make sure zone doesn't already exist.
4428          *
4429          * If the system and zone are labeled,
4430          * make sure no other zone exists that has the same label.
4431          */
4432         if ((ztmp = zone_find_all_by_name(zone->zone_name)) != NULL ||
4433             (insert_label_hash &&
4434             (ztmp = zone_find_all_by_label(zone->zone_slabel)) != NULL)) {
4435                 zone_status_t status;
4436 
4437                 status = zone_status_get(ztmp);
4438                 if (status == ZONE_IS_READY || status == ZONE_IS_RUNNING)
4439                         error = EEXIST;
4440                 else
4441                         error = EBUSY;
4442 
4443                 if (insert_label_hash)
4444                         error2 = ZE_LABELINUSE;
4445 
4446                 goto errout;
4447         }
4448 
4449         /*
4450          * Don't allow zone creations which would cause one zone's rootpath to
4451          * be accessible from that of another (non-global) zone.
4452          */
4453         if (zone_is_nested(zone->zone_rootpath)) {
4454                 error = EBUSY;
4455                 goto errout;
4456         }
4457 
4458         ASSERT(zonecount != 0);         /* check for leaks */
4459         if (zonecount + 1 > maxzones) {
4460                 error = ENOMEM;
4461                 goto errout;
4462         }
4463 
4464         if (zone_mount_count(zone->zone_rootpath) != 0) {
4465                 error = EBUSY;
4466                 error2 = ZE_AREMOUNTS;
4467                 goto errout;
4468         }
4469 
4470         /*
4471          * Zone is still incomplete, but we need to drop all locks while
4472          * zsched() initializes this zone's kernel process.  We
4473          * optimistically add the zone to the hashtable and associated
4474          * lists so a parallel zone_create() doesn't try to create the
4475          * same zone.
4476          */
4477         zonecount++;
4478         (void) mod_hash_insert(zonehashbyid,
4479             (mod_hash_key_t)(uintptr_t)zone->zone_id,
4480             (mod_hash_val_t)(uintptr_t)zone);
4481         str = kmem_alloc(strlen(zone->zone_name) + 1, KM_SLEEP);
4482         (void) strcpy(str, zone->zone_name);
4483         (void) mod_hash_insert(zonehashbyname, (mod_hash_key_t)str,
4484             (mod_hash_val_t)(uintptr_t)zone);
4485         if (insert_label_hash) {
4486                 (void) mod_hash_insert(zonehashbylabel,
4487                     (mod_hash_key_t)zone->zone_slabel, (mod_hash_val_t)zone);
4488                 zone->zone_flags |= ZF_HASHED_LABEL;
4489         }
4490 
4491         /*
4492          * Insert into active list.  At this point there are no 'hold's
4493          * on the zone, but everyone else knows not to use it, so we can
4494          * continue to use it.  zsched() will do a zone_hold() if the
4495          * newproc() is successful.
4496          */
4497         list_insert_tail(&zone_active, zone);
4498         mutex_exit(&zonehash_lock);
4499 
4500         zarg.zone = zone;
4501         zarg.nvlist = rctls;
4502         /*
4503          * The process, task, and project rctls are probably wrong;
4504          * we need an interface to get the default values of all rctls,
4505          * and initialize zsched appropriately.  I'm not sure that that
4506          * makes much of a difference, though.
4507          */
4508         error = newproc(zsched, (void *)&zarg, syscid, minclsyspri, NULL, 0);
4509         if (error != 0) {
4510                 /*
4511                  * We need to undo all globally visible state.
4512                  */
4513                 mutex_enter(&zonehash_lock);
4514                 list_remove(&zone_active, zone);
4515                 if (zone->zone_flags & ZF_HASHED_LABEL) {
4516                         ASSERT(zone->zone_slabel != NULL);
4517                         (void) mod_hash_destroy(zonehashbylabel,
4518                             (mod_hash_key_t)zone->zone_slabel);
4519                 }
4520                 (void) mod_hash_destroy(zonehashbyname,
4521                     (mod_hash_key_t)(uintptr_t)zone->zone_name);
4522                 (void) mod_hash_destroy(zonehashbyid,
4523                     (mod_hash_key_t)(uintptr_t)zone->zone_id);
4524                 ASSERT(zonecount > 1);
4525                 zonecount--;
4526                 goto errout;
4527         }
4528 
4529         /*
4530          * Zone creation can't fail from now on.
4531          */
4532 
4533         /*
4534          * Create zone kstats
4535          */
4536         zone_kstat_create(zone);
4537 
4538         /*
4539          * Let the other lwps continue.
4540          */
4541         mutex_enter(&pp->p_lock);
4542         if (curthread != pp->p_agenttp)
4543                 continuelwps(pp);
4544         mutex_exit(&pp->p_lock);
4545 
4546         /*
4547          * Wait for zsched to finish initializing the zone.
4548          */
4549         zone_status_wait(zone, ZONE_IS_READY);
4550         /*
4551          * The zone is fully visible, so we can let mounts progress.
4552          */
4553         resume_mounts();
4554         if (rctls)
4555                 nvlist_free(rctls);
4556 
4557         return (zoneid);
4558 
4559 errout:
4560         mutex_exit(&zonehash_lock);
4561         /*
4562          * Let the other lwps continue.
4563          */
4564         mutex_enter(&pp->p_lock);
4565         if (curthread != pp->p_agenttp)
4566                 continuelwps(pp);
4567         mutex_exit(&pp->p_lock);
4568 
4569         resume_mounts();
4570         if (rctls)
4571                 nvlist_free(rctls);
4572         /*
4573          * There is currently one reference to the zone, a cred_ref from
4574          * zone_kcred.  To free the zone, we call crfree, which will call
4575          * zone_cred_rele, which will call zone_free.
4576          */
4577         ASSERT(zone->zone_cred_ref == 1);
4578         ASSERT(zone->zone_kcred->cr_ref == 1);
4579         ASSERT(zone->zone_ref == 0);
4580         zkcr = zone->zone_kcred;
4581         zone->zone_kcred = NULL;
4582         crfree(zkcr);                           /* triggers call to zone_free */
4583         return (zone_create_error(error, error2, extended_error));
4584 }
4585 
4586 /*
4587  * Cause the zone to boot.  This is pretty simple, since we let zoneadmd do
4588  * the heavy lifting.  initname is the path to the program to launch
4589  * at the "top" of the zone; if this is NULL, we use the system default,
4590  * which is stored at zone_default_initname.
4591  */
4592 static int
4593 zone_boot(zoneid_t zoneid)
4594 {
4595         int err;
4596         zone_t *zone;
4597 
4598         if (secpolicy_zone_config(CRED()) != 0)
4599                 return (set_errno(EPERM));
4600         if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
4601                 return (set_errno(EINVAL));
4602 
4603         mutex_enter(&zonehash_lock);
4604         /*
4605          * Look for zone under hash lock to prevent races with calls to
4606          * zone_shutdown, zone_destroy, etc.
4607          */
4608         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
4609                 mutex_exit(&zonehash_lock);
4610                 return (set_errno(EINVAL));
4611         }
4612 
4613         mutex_enter(&zone_status_lock);
4614         if (zone_status_get(zone) != ZONE_IS_READY) {
4615                 mutex_exit(&zone_status_lock);
4616                 mutex_exit(&zonehash_lock);
4617                 return (set_errno(EINVAL));
4618         }
4619         zone_status_set(zone, ZONE_IS_BOOTING);
4620         mutex_exit(&zone_status_lock);
4621 
4622         zone_hold(zone);        /* so we can use the zone_t later */
4623         mutex_exit(&zonehash_lock);
4624 
4625         if (zone_status_wait_sig(zone, ZONE_IS_RUNNING) == 0) {
4626                 zone_rele(zone);
4627                 return (set_errno(EINTR));
4628         }
4629 
4630         /*
4631          * Boot (starting init) might have failed, in which case the zone
4632          * will go to the SHUTTING_DOWN state; an appropriate errno will
4633          * be placed in zone->zone_boot_err, and so we return that.
4634          */
4635         err = zone->zone_boot_err;
4636         zone_rele(zone);
4637         return (err ? set_errno(err) : 0);
4638 }
4639 
4640 /*
4641  * Kills all user processes in the zone, waiting for them all to exit
4642  * before returning.
4643  */
4644 static int
4645 zone_empty(zone_t *zone)
4646 {
4647         int waitstatus;
4648 
4649         /*
4650          * We need to drop zonehash_lock before killing all
4651          * processes, otherwise we'll deadlock with zone_find_*
4652          * which can be called from the exit path.
4653          */
4654         ASSERT(MUTEX_NOT_HELD(&zonehash_lock));
4655         while ((waitstatus = zone_status_timedwait_sig(zone,
4656             ddi_get_lbolt() + hz, ZONE_IS_EMPTY)) == -1) {
4657                 killall(zone->zone_id);
4658         }
4659         /*
4660          * return EINTR if we were signaled
4661          */
4662         if (waitstatus == 0)
4663                 return (EINTR);
4664         return (0);
4665 }
4666 
4667 /*
4668  * This function implements the policy for zone visibility.
4669  *
4670  * In standard Solaris, a non-global zone can only see itself.
4671  *
4672  * In Trusted Extensions, a labeled zone can lookup any zone whose label
4673  * it dominates. For this test, the label of the global zone is treated as
4674  * admin_high so it is special-cased instead of being checked for dominance.
4675  *
4676  * Returns true if zone attributes are viewable, false otherwise.
4677  */
4678 static boolean_t
4679 zone_list_access(zone_t *zone)
4680 {
4681 
4682         if (curproc->p_zone == global_zone ||
4683             curproc->p_zone == zone) {
4684                 return (B_TRUE);
4685         } else if (is_system_labeled() && !(zone->zone_flags & ZF_IS_SCRATCH)) {
4686                 bslabel_t *curproc_label;
4687                 bslabel_t *zone_label;
4688 
4689                 curproc_label = label2bslabel(curproc->p_zone->zone_slabel);
4690                 zone_label = label2bslabel(zone->zone_slabel);
4691 
4692                 if (zone->zone_id != GLOBAL_ZONEID &&
4693                     bldominates(curproc_label, zone_label)) {
4694                         return (B_TRUE);
4695                 } else {
4696                         return (B_FALSE);
4697                 }
4698         } else {
4699                 return (B_FALSE);
4700         }
4701 }
4702 
4703 /*
4704  * Systemcall to start the zone's halt sequence.  By the time this
4705  * function successfully returns, all user processes and kernel threads
4706  * executing in it will have exited, ZSD shutdown callbacks executed,
4707  * and the zone status set to ZONE_IS_DOWN.
4708  *
4709  * It is possible that the call will interrupt itself if the caller is the
4710  * parent of any process running in the zone, and doesn't have SIGCHLD blocked.
4711  */
4712 static int
4713 zone_shutdown(zoneid_t zoneid)
4714 {
4715         int error;
4716         zone_t *zone;
4717         zone_status_t status;
4718 
4719         if (secpolicy_zone_config(CRED()) != 0)
4720                 return (set_errno(EPERM));
4721         if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
4722                 return (set_errno(EINVAL));
4723 
4724         /*
4725          * Block mounts so that VFS_MOUNT() can get an accurate view of
4726          * the zone's status with regards to ZONE_IS_SHUTTING down.
4727          *
4728          * e.g. NFS can fail the mount if it determines that the zone
4729          * has already begun the shutdown sequence.
4730          */
4731         if (block_mounts() == 0)
4732                 return (set_errno(EINTR));
4733         mutex_enter(&zonehash_lock);
4734         /*
4735          * Look for zone under hash lock to prevent races with other
4736          * calls to zone_shutdown and zone_destroy.
4737          */
4738         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
4739                 mutex_exit(&zonehash_lock);
4740                 resume_mounts();
4741                 return (set_errno(EINVAL));
4742         }
4743         mutex_enter(&zone_status_lock);
4744         status = zone_status_get(zone);
4745         /*
4746          * Fail if the zone isn't fully initialized yet.
4747          */
4748         if (status < ZONE_IS_READY) {
4749                 mutex_exit(&zone_status_lock);
4750                 mutex_exit(&zonehash_lock);
4751                 resume_mounts();
4752                 return (set_errno(EINVAL));
4753         }
4754         /*
4755          * If conditions required for zone_shutdown() to return have been met,
4756          * return success.
4757          */
4758         if (status >= ZONE_IS_DOWN) {
4759                 mutex_exit(&zone_status_lock);
4760                 mutex_exit(&zonehash_lock);
4761                 resume_mounts();
4762                 return (0);
4763         }
4764         /*
4765          * If zone_shutdown() hasn't been called before, go through the motions.
4766          * If it has, there's nothing to do but wait for the kernel threads to
4767          * drain.
4768          */
4769         if (status < ZONE_IS_EMPTY) {
4770                 uint_t ntasks;
4771 
4772                 mutex_enter(&zone->zone_lock);
4773                 if ((ntasks = zone->zone_ntasks) != 1) {
4774                         /*
4775                          * There's still stuff running.
4776                          */
4777                         zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
4778                 }
4779                 mutex_exit(&zone->zone_lock);
4780                 if (ntasks == 1) {
4781                         /*
4782                          * The only way to create another task is through
4783                          * zone_enter(), which will block until we drop
4784                          * zonehash_lock.  The zone is empty.
4785                          */
4786                         if (zone->zone_kthreads == NULL) {
4787                                 /*
4788                                  * Skip ahead to ZONE_IS_DOWN
4789                                  */
4790                                 zone_status_set(zone, ZONE_IS_DOWN);
4791                         } else {
4792                                 zone_status_set(zone, ZONE_IS_EMPTY);
4793                         }
4794                 }
4795         }
4796         zone_hold(zone);        /* so we can use the zone_t later */
4797         mutex_exit(&zone_status_lock);
4798         mutex_exit(&zonehash_lock);
4799         resume_mounts();
4800 
4801         if (error = zone_empty(zone)) {
4802                 zone_rele(zone);
4803                 return (set_errno(error));
4804         }
4805         /*
4806          * After the zone status goes to ZONE_IS_DOWN this zone will no
4807          * longer be notified of changes to the pools configuration, so
4808          * in order to not end up with a stale pool pointer, we point
4809          * ourselves at the default pool and remove all resource
4810          * visibility.  This is especially important as the zone_t may
4811          * languish on the deathrow for a very long time waiting for
4812          * cred's to drain out.
4813          *
4814          * This rebinding of the zone can happen multiple times
4815          * (presumably due to interrupted or parallel systemcalls)
4816          * without any adverse effects.
4817          */
4818         if (pool_lock_intr() != 0) {
4819                 zone_rele(zone);
4820                 return (set_errno(EINTR));
4821         }
4822         if (pool_state == POOL_ENABLED) {
4823                 mutex_enter(&cpu_lock);
4824                 zone_pool_set(zone, pool_default);
4825                 /*
4826                  * The zone no longer needs to be able to see any cpus.
4827                  */
4828                 zone_pset_set(zone, ZONE_PS_INVAL);
4829                 mutex_exit(&cpu_lock);
4830         }
4831         pool_unlock();
4832 
4833         /*
4834          * ZSD shutdown callbacks can be executed multiple times, hence
4835          * it is safe to not be holding any locks across this call.
4836          */
4837         zone_zsd_callbacks(zone, ZSD_SHUTDOWN);
4838 
4839         mutex_enter(&zone_status_lock);
4840         if (zone->zone_kthreads == NULL && zone_status_get(zone) < ZONE_IS_DOWN)
4841                 zone_status_set(zone, ZONE_IS_DOWN);
4842         mutex_exit(&zone_status_lock);
4843 
4844         /*
4845          * Wait for kernel threads to drain.
4846          */
4847         if (!zone_status_wait_sig(zone, ZONE_IS_DOWN)) {
4848                 zone_rele(zone);
4849                 return (set_errno(EINTR));
4850         }
4851 
4852         /*
4853          * Zone can be become down/destroyable even if the above wait
4854          * returns EINTR, so any code added here may never execute.
4855          * (i.e. don't add code here)
4856          */
4857 
4858         zone_rele(zone);
4859         return (0);
4860 }
4861 
4862 /*
4863  * Log the specified zone's reference counts.  The caller should not be
4864  * holding the zone's zone_lock.
4865  */
4866 static void
4867 zone_log_refcounts(zone_t *zone)
4868 {
4869         char *buffer;
4870         char *buffer_position;
4871         uint32_t buffer_size;
4872         uint32_t index;
4873         uint_t ref;
4874         uint_t cred_ref;
4875 
4876         /*
4877          * Construct a string representing the subsystem-specific reference
4878          * counts.  The counts are printed in ascending order by index into the
4879          * zone_t::zone_subsys_ref array.  The list will be surrounded by
4880          * square brackets [] and will only contain nonzero reference counts.
4881          *
4882          * The buffer will hold two square bracket characters plus ten digits,
4883          * one colon, one space, one comma, and some characters for a
4884          * subsystem name per subsystem-specific reference count.  (Unsigned 32-
4885          * bit integers have at most ten decimal digits.)  The last
4886          * reference count's comma is replaced by the closing square
4887          * bracket and a NULL character to terminate the string.
4888          *
4889          * NOTE: We have to grab the zone's zone_lock to create a consistent
4890          * snapshot of the zone's reference counters.
4891          *
4892          * First, figure out how much space the string buffer will need.
4893          * The buffer's size is stored in buffer_size.
4894          */
4895         buffer_size = 2;                        /* for the square brackets */
4896         mutex_enter(&zone->zone_lock);
4897         zone->zone_flags |= ZF_REFCOUNTS_LOGGED;
4898         ref = zone->zone_ref;
4899         cred_ref = zone->zone_cred_ref;
4900         for (index = 0; index < ZONE_REF_NUM_SUBSYS; ++index)
4901                 if (zone->zone_subsys_ref[index] != 0)
4902                         buffer_size += strlen(zone_ref_subsys_names[index]) +
4903                             13;
4904         if (buffer_size == 2) {
4905                 /*
4906                  * No subsystems had nonzero reference counts.  Don't bother
4907                  * with allocating a buffer; just log the general-purpose and
4908                  * credential reference counts.
4909                  */
4910                 mutex_exit(&zone->zone_lock);
4911                 (void) strlog(0, 0, 1, SL_CONSOLE | SL_NOTE,
4912                     "Zone '%s' (ID: %d) is shutting down, but %u zone "
4913                     "references and %u credential references are still extant",
4914                     zone->zone_name, zone->zone_id, ref, cred_ref);
4915                 return;
4916         }
4917 
4918         /*
4919          * buffer_size contains the exact number of characters that the
4920          * buffer will need.  Allocate the buffer and fill it with nonzero
4921          * subsystem-specific reference counts.  Surround the results with
4922          * square brackets afterwards.
4923          */
4924         buffer = kmem_alloc(buffer_size, KM_SLEEP);
4925         buffer_position = &buffer[1];
4926         for (index = 0; index < ZONE_REF_NUM_SUBSYS; ++index) {
4927                 /*
4928                  * NOTE: The DDI's version of sprintf() returns a pointer to
4929                  * the modified buffer rather than the number of bytes written
4930                  * (as in snprintf(3C)).  This is unfortunate and annoying.
4931                  * Therefore, we'll use snprintf() with INT_MAX to get the
4932                  * number of bytes written.  Using INT_MAX is safe because
4933                  * the buffer is perfectly sized for the data: we'll never
4934                  * overrun the buffer.
4935                  */
4936                 if (zone->zone_subsys_ref[index] != 0)
4937                         buffer_position += snprintf(buffer_position, INT_MAX,
4938                             "%s: %u,", zone_ref_subsys_names[index],
4939                             zone->zone_subsys_ref[index]);
4940         }
4941         mutex_exit(&zone->zone_lock);
4942         buffer[0] = '[';
4943         ASSERT((uintptr_t)(buffer_position - buffer) < buffer_size);
4944         ASSERT(buffer_position[0] == '\0' && buffer_position[-1] == ',');
4945         buffer_position[-1] = ']';
4946 
4947         /*
4948          * Log the reference counts and free the message buffer.
4949          */
4950         (void) strlog(0, 0, 1, SL_CONSOLE | SL_NOTE,
4951             "Zone '%s' (ID: %d) is shutting down, but %u zone references and "
4952             "%u credential references are still extant %s", zone->zone_name,
4953             zone->zone_id, ref, cred_ref, buffer);
4954         kmem_free(buffer, buffer_size);
4955 }
4956 
4957 /*
4958  * Systemcall entry point to finalize the zone halt process.  The caller
4959  * must have already successfully called zone_shutdown().
4960  *
4961  * Upon successful completion, the zone will have been fully destroyed:
4962  * zsched will have exited, destructor callbacks executed, and the zone
4963  * removed from the list of active zones.
4964  */
4965 static int
4966 zone_destroy(zoneid_t zoneid)
4967 {
4968         uint64_t uniqid;
4969         zone_t *zone;
4970         zone_status_t status;
4971         clock_t wait_time;
4972         boolean_t log_refcounts;
4973 
4974         if (secpolicy_zone_config(CRED()) != 0)
4975                 return (set_errno(EPERM));
4976         if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
4977                 return (set_errno(EINVAL));
4978 
4979         mutex_enter(&zonehash_lock);
4980         /*
4981          * Look for zone under hash lock to prevent races with other
4982          * calls to zone_destroy.
4983          */
4984         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
4985                 mutex_exit(&zonehash_lock);
4986                 return (set_errno(EINVAL));
4987         }
4988 
4989         if (zone_mount_count(zone->zone_rootpath) != 0) {
4990                 mutex_exit(&zonehash_lock);
4991                 return (set_errno(EBUSY));
4992         }
4993         mutex_enter(&zone_status_lock);
4994         status = zone_status_get(zone);
4995         if (status < ZONE_IS_DOWN) {
4996                 mutex_exit(&zone_status_lock);
4997                 mutex_exit(&zonehash_lock);
4998                 return (set_errno(EBUSY));
4999         } else if (status == ZONE_IS_DOWN) {
5000                 zone_status_set(zone, ZONE_IS_DYING); /* Tell zsched to exit */
5001         }
5002         mutex_exit(&zone_status_lock);
5003         zone_hold(zone);
5004         mutex_exit(&zonehash_lock);
5005 
5006         /*
5007          * wait for zsched to exit
5008          */
5009         zone_status_wait(zone, ZONE_IS_DEAD);
5010         zone_zsd_callbacks(zone, ZSD_DESTROY);
5011         zone->zone_netstack = NULL;
5012         uniqid = zone->zone_uniqid;
5013         zone_rele(zone);
5014         zone = NULL;    /* potentially free'd */
5015 
5016         log_refcounts = B_FALSE;
5017         wait_time = SEC_TO_TICK(ZONE_DESTROY_TIMEOUT_SECS);
5018         mutex_enter(&zonehash_lock);
5019         for (; /* ever */; ) {
5020                 boolean_t unref;
5021                 boolean_t refs_have_been_logged;
5022 
5023                 if ((zone = zone_find_all_by_id(zoneid)) == NULL ||
5024                     zone->zone_uniqid != uniqid) {
5025                         /*
5026                          * The zone has gone away.  Necessary conditions
5027                          * are met, so we return success.
5028                          */
5029                         mutex_exit(&zonehash_lock);
5030                         return (0);
5031                 }
5032                 mutex_enter(&zone->zone_lock);
5033                 unref = ZONE_IS_UNREF(zone);
5034                 refs_have_been_logged = (zone->zone_flags &
5035                     ZF_REFCOUNTS_LOGGED);
5036                 mutex_exit(&zone->zone_lock);
5037                 if (unref) {
5038                         /*
5039                          * There is only one reference to the zone -- that
5040                          * added when the zone was added to the hashtables --
5041                          * and things will remain this way until we drop
5042                          * zonehash_lock... we can go ahead and cleanup the
5043                          * zone.
5044                          */
5045                         break;
5046                 }
5047 
5048                 /*
5049                  * Wait for zone_rele_common() or zone_cred_rele() to signal
5050                  * zone_destroy_cv.  zone_destroy_cv is signaled only when
5051                  * some zone's general-purpose reference count reaches one.
5052                  * If ZONE_DESTROY_TIMEOUT_SECS seconds elapse while waiting
5053                  * on zone_destroy_cv, then log the zone's reference counts and
5054                  * continue to wait for zone_rele() and zone_cred_rele().
5055                  */
5056                 if (!refs_have_been_logged) {
5057                         if (!log_refcounts) {
5058                                 /*
5059                                  * This thread hasn't timed out waiting on
5060                                  * zone_destroy_cv yet.  Wait wait_time clock
5061                                  * ticks (initially ZONE_DESTROY_TIMEOUT_SECS
5062                                  * seconds) for the zone's references to clear.
5063                                  */
5064                                 ASSERT(wait_time > 0);
5065                                 wait_time = cv_reltimedwait_sig(
5066                                     &zone_destroy_cv, &zonehash_lock, wait_time,
5067                                     TR_SEC);
5068                                 if (wait_time > 0) {
5069                                         /*
5070                                          * A thread in zone_rele() or
5071                                          * zone_cred_rele() signaled
5072                                          * zone_destroy_cv before this thread's
5073                                          * wait timed out.  The zone might have
5074                                          * only one reference left; find out!
5075                                          */
5076                                         continue;
5077                                 } else if (wait_time == 0) {
5078                                         /* The thread's process was signaled. */
5079                                         mutex_exit(&zonehash_lock);
5080                                         return (set_errno(EINTR));
5081                                 }
5082 
5083                                 /*
5084                                  * The thread timed out while waiting on
5085                                  * zone_destroy_cv.  Even though the thread
5086                                  * timed out, it has to check whether another
5087                                  * thread woke up from zone_destroy_cv and
5088                                  * destroyed the zone.
5089                                  *
5090                                  * If the zone still exists and has more than
5091                                  * one unreleased general-purpose reference,
5092                                  * then log the zone's reference counts.
5093                                  */
5094                                 log_refcounts = B_TRUE;
5095                                 continue;
5096                         }
5097 
5098                         /*
5099                          * The thread already timed out on zone_destroy_cv while
5100                          * waiting for subsystems to release the zone's last
5101                          * general-purpose references.  Log the zone's reference
5102                          * counts and wait indefinitely on zone_destroy_cv.
5103                          */
5104                         zone_log_refcounts(zone);
5105                 }
5106                 if (cv_wait_sig(&zone_destroy_cv, &zonehash_lock) == 0) {
5107                         /* The thread's process was signaled. */
5108                         mutex_exit(&zonehash_lock);
5109                         return (set_errno(EINTR));
5110                 }
5111         }
5112 
5113         /*
5114          * Remove CPU cap for this zone now since we're not going to
5115          * fail below this point.
5116          */
5117         cpucaps_zone_remove(zone);
5118 
5119         /* Get rid of the zone's kstats */
5120         zone_kstat_delete(zone);
5121 
5122         /* remove the pfexecd doors */
5123         if (zone->zone_pfexecd != NULL) {
5124                 klpd_freelist(&zone->zone_pfexecd);
5125                 zone->zone_pfexecd = NULL;
5126         }
5127 
5128         /* free brand specific data */
5129         if (ZONE_IS_BRANDED(zone))
5130                 ZBROP(zone)->b_free_brand_data(zone);
5131 
5132         /* Say goodbye to brand framework. */
5133         brand_unregister_zone(zone->zone_brand);
5134 
5135         /*
5136          * It is now safe to let the zone be recreated; remove it from the
5137          * lists.  The memory will not be freed until the last cred
5138          * reference goes away.
5139          */
5140         ASSERT(zonecount > 1);       /* must be > 1; can't destroy global zone */
5141         zonecount--;
5142         /* remove from active list and hash tables */
5143         list_remove(&zone_active, zone);
5144         (void) mod_hash_destroy(zonehashbyname,
5145             (mod_hash_key_t)zone->zone_name);
5146         (void) mod_hash_destroy(zonehashbyid,
5147             (mod_hash_key_t)(uintptr_t)zone->zone_id);
5148         if (zone->zone_flags & ZF_HASHED_LABEL)
5149                 (void) mod_hash_destroy(zonehashbylabel,
5150                     (mod_hash_key_t)zone->zone_slabel);
5151         mutex_exit(&zonehash_lock);
5152 
5153         /*
5154          * Release the root vnode; we're not using it anymore.  Nor should any
5155          * other thread that might access it exist.
5156          */
5157         if (zone->zone_rootvp != NULL) {
5158                 VN_RELE(zone->zone_rootvp);
5159                 zone->zone_rootvp = NULL;
5160         }
5161 
5162         /* add to deathrow list */
5163         mutex_enter(&zone_deathrow_lock);
5164         list_insert_tail(&zone_deathrow, zone);
5165         mutex_exit(&zone_deathrow_lock);
5166 
5167         /*
5168          * Drop last reference (which was added by zsched()), this will
5169          * free the zone unless there are outstanding cred references.
5170          */
5171         zone_rele(zone);
5172         return (0);
5173 }
5174 
5175 /*
5176  * Systemcall entry point for zone_getattr(2).
5177  */
5178 static ssize_t
5179 zone_getattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
5180 {
5181         size_t size;
5182         int error = 0, err;
5183         zone_t *zone;
5184         char *zonepath;
5185         char *outstr;
5186         zone_status_t zone_status;
5187         pid_t initpid;
5188         boolean_t global = (curzone == global_zone);
5189         boolean_t inzone = (curzone->zone_id == zoneid);
5190         ushort_t flags;
5191         zone_net_data_t *zbuf;
5192 
5193         mutex_enter(&zonehash_lock);
5194         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
5195                 mutex_exit(&zonehash_lock);
5196                 return (set_errno(EINVAL));
5197         }
5198         zone_status = zone_status_get(zone);
5199         if (zone_status < ZONE_IS_INITIALIZED) {
5200                 mutex_exit(&zonehash_lock);
5201                 return (set_errno(EINVAL));
5202         }
5203         zone_hold(zone);
5204         mutex_exit(&zonehash_lock);
5205 
5206         /*
5207          * If not in the global zone, don't show information about other zones,
5208          * unless the system is labeled and the local zone's label dominates
5209          * the other zone.
5210          */
5211         if (!zone_list_access(zone)) {
5212                 zone_rele(zone);
5213                 return (set_errno(EINVAL));
5214         }
5215 
5216         switch (attr) {
5217         case ZONE_ATTR_ROOT:
5218                 if (global) {
5219                         /*
5220                          * Copy the path to trim the trailing "/" (except for
5221                          * the global zone).
5222                          */
5223                         if (zone != global_zone)
5224                                 size = zone->zone_rootpathlen - 1;
5225                         else
5226                                 size = zone->zone_rootpathlen;
5227                         zonepath = kmem_alloc(size, KM_SLEEP);
5228                         bcopy(zone->zone_rootpath, zonepath, size);
5229                         zonepath[size - 1] = '\0';
5230                 } else {
5231                         if (inzone || !is_system_labeled()) {
5232                                 /*
5233                                  * Caller is not in the global zone.
5234                                  * if the query is on the current zone
5235                                  * or the system is not labeled,
5236                                  * just return faked-up path for current zone.
5237                                  */
5238                                 zonepath = "/";
5239                                 size = 2;
5240                         } else {
5241                                 /*
5242                                  * Return related path for current zone.
5243                                  */
5244                                 int prefix_len = strlen(zone_prefix);
5245                                 int zname_len = strlen(zone->zone_name);
5246 
5247                                 size = prefix_len + zname_len + 1;
5248                                 zonepath = kmem_alloc(size, KM_SLEEP);
5249                                 bcopy(zone_prefix, zonepath, prefix_len);
5250                                 bcopy(zone->zone_name, zonepath +
5251                                     prefix_len, zname_len);
5252                                 zonepath[size - 1] = '\0';
5253                         }
5254                 }
5255                 if (bufsize > size)
5256                         bufsize = size;
5257                 if (buf != NULL) {
5258                         err = copyoutstr(zonepath, buf, bufsize, NULL);
5259                         if (err != 0 && err != ENAMETOOLONG)
5260                                 error = EFAULT;
5261                 }
5262                 if (global || (is_system_labeled() && !inzone))
5263                         kmem_free(zonepath, size);
5264                 break;
5265 
5266         case ZONE_ATTR_NAME:
5267                 size = strlen(zone->zone_name) + 1;
5268                 if (bufsize > size)
5269                         bufsize = size;
5270                 if (buf != NULL) {
5271                         err = copyoutstr(zone->zone_name, buf, bufsize, NULL);
5272                         if (err != 0 && err != ENAMETOOLONG)
5273                                 error = EFAULT;
5274                 }
5275                 break;
5276 
5277         case ZONE_ATTR_STATUS:
5278                 /*
5279                  * Since we're not holding zonehash_lock, the zone status
5280                  * may be anything; leave it up to userland to sort it out.
5281                  */
5282                 size = sizeof (zone_status);
5283                 if (bufsize > size)
5284                         bufsize = size;
5285                 zone_status = zone_status_get(zone);
5286                 if (buf != NULL &&
5287                     copyout(&zone_status, buf, bufsize) != 0)
5288                         error = EFAULT;
5289                 break;
5290         case ZONE_ATTR_FLAGS:
5291                 size = sizeof (zone->zone_flags);
5292                 if (bufsize > size)
5293                         bufsize = size;
5294                 flags = zone->zone_flags;
5295                 if (buf != NULL &&
5296                     copyout(&flags, buf, bufsize) != 0)
5297                         error = EFAULT;
5298                 break;
5299         case ZONE_ATTR_PRIVSET:
5300                 size = sizeof (priv_set_t);
5301                 if (bufsize > size)
5302                         bufsize = size;
5303                 if (buf != NULL &&
5304                     copyout(zone->zone_privset, buf, bufsize) != 0)
5305                         error = EFAULT;
5306                 break;
5307         case ZONE_ATTR_UNIQID:
5308                 size = sizeof (zone->zone_uniqid);
5309                 if (bufsize > size)
5310                         bufsize = size;
5311                 if (buf != NULL &&
5312                     copyout(&zone->zone_uniqid, buf, bufsize) != 0)
5313                         error = EFAULT;
5314                 break;
5315         case ZONE_ATTR_POOLID:
5316                 {
5317                         pool_t *pool;
5318                         poolid_t poolid;
5319 
5320                         if (pool_lock_intr() != 0) {
5321                                 error = EINTR;
5322                                 break;
5323                         }
5324                         pool = zone_pool_get(zone);
5325                         poolid = pool->pool_id;
5326                         pool_unlock();
5327                         size = sizeof (poolid);
5328                         if (bufsize > size)
5329                                 bufsize = size;
5330                         if (buf != NULL && copyout(&poolid, buf, size) != 0)
5331                                 error = EFAULT;
5332                 }
5333                 break;
5334         case ZONE_ATTR_SLBL:
5335                 size = sizeof (bslabel_t);
5336                 if (bufsize > size)
5337                         bufsize = size;
5338                 if (zone->zone_slabel == NULL)
5339                         error = EINVAL;
5340                 else if (buf != NULL &&
5341                     copyout(label2bslabel(zone->zone_slabel), buf,
5342                     bufsize) != 0)
5343                         error = EFAULT;
5344                 break;
5345         case ZONE_ATTR_INITPID:
5346                 size = sizeof (initpid);
5347                 if (bufsize > size)
5348                         bufsize = size;
5349                 initpid = zone->zone_proc_initpid;
5350                 if (initpid == -1) {
5351                         error = ESRCH;
5352                         break;
5353                 }
5354                 if (buf != NULL &&
5355                     copyout(&initpid, buf, bufsize) != 0)
5356                         error = EFAULT;
5357                 break;
5358         case ZONE_ATTR_BRAND:
5359                 size = strlen(zone->zone_brand->b_name) + 1;
5360 
5361                 if (bufsize > size)
5362                         bufsize = size;
5363                 if (buf != NULL) {
5364                         err = copyoutstr(zone->zone_brand->b_name, buf,
5365                             bufsize, NULL);
5366                         if (err != 0 && err != ENAMETOOLONG)
5367                                 error = EFAULT;
5368                 }
5369                 break;
5370         case ZONE_ATTR_INITNAME:
5371                 size = strlen(zone->zone_initname) + 1;
5372                 if (bufsize > size)
5373                         bufsize = size;
5374                 if (buf != NULL) {
5375                         err = copyoutstr(zone->zone_initname, buf, bufsize,
5376                             NULL);
5377                         if (err != 0 && err != ENAMETOOLONG)
5378                                 error = EFAULT;
5379                 }
5380                 break;
5381         case ZONE_ATTR_BOOTARGS:
5382                 if (zone->zone_bootargs == NULL)
5383                         outstr = "";
5384                 else
5385                         outstr = zone->zone_bootargs;
5386                 size = strlen(outstr) + 1;
5387                 if (bufsize > size)
5388                         bufsize = size;
5389                 if (buf != NULL) {
5390                         err = copyoutstr(outstr, buf, bufsize, NULL);
5391                         if (err != 0 && err != ENAMETOOLONG)
5392                                 error = EFAULT;
5393                 }
5394                 break;
5395         case ZONE_ATTR_PHYS_MCAP:
5396                 size = sizeof (zone->zone_phys_mcap);
5397                 if (bufsize > size)
5398                         bufsize = size;
5399                 if (buf != NULL &&
5400                     copyout(&zone->zone_phys_mcap, buf, bufsize) != 0)
5401                         error = EFAULT;
5402                 break;
5403         case ZONE_ATTR_SCHED_CLASS:
5404                 mutex_enter(&class_lock);
5405 
5406                 if (zone->zone_defaultcid >= loaded_classes)
5407                         outstr = "";
5408                 else
5409                         outstr = sclass[zone->zone_defaultcid].cl_name;
5410                 size = strlen(outstr) + 1;
5411                 if (bufsize > size)
5412                         bufsize = size;
5413                 if (buf != NULL) {
5414                         err = copyoutstr(outstr, buf, bufsize, NULL);
5415                         if (err != 0 && err != ENAMETOOLONG)
5416                                 error = EFAULT;
5417                 }
5418 
5419                 mutex_exit(&class_lock);
5420                 break;
5421         case ZONE_ATTR_HOSTID:
5422                 if (zone->zone_hostid != HW_INVALID_HOSTID &&
5423                     bufsize == sizeof (zone->zone_hostid)) {
5424                         size = sizeof (zone->zone_hostid);
5425                         if (buf != NULL && copyout(&zone->zone_hostid, buf,
5426                             bufsize) != 0)
5427                                 error = EFAULT;
5428                 } else {
5429                         error = EINVAL;
5430                 }
5431                 break;
5432         case ZONE_ATTR_FS_ALLOWED:
5433                 if (zone->zone_fs_allowed == NULL)
5434                         outstr = "";
5435                 else
5436                         outstr = zone->zone_fs_allowed;
5437                 size = strlen(outstr) + 1;
5438                 if (bufsize > size)
5439                         bufsize = size;
5440                 if (buf != NULL) {
5441                         err = copyoutstr(outstr, buf, bufsize, NULL);
5442                         if (err != 0 && err != ENAMETOOLONG)
5443                                 error = EFAULT;
5444                 }
5445                 break;
5446         case ZONE_ATTR_NETWORK:
5447                 zbuf = kmem_alloc(bufsize, KM_SLEEP);
5448                 if (copyin(buf, zbuf, bufsize) != 0) {
5449                         error = EFAULT;
5450                 } else {
5451                         error = zone_get_network(zoneid, zbuf);
5452                         if (error == 0 && copyout(zbuf, buf, bufsize) != 0)
5453                                 error = EFAULT;
5454                 }
5455                 kmem_free(zbuf, bufsize);
5456                 break;
5457         default:
5458                 if ((attr >= ZONE_ATTR_BRAND_ATTRS) && ZONE_IS_BRANDED(zone)) {
5459                         size = bufsize;
5460                         error = ZBROP(zone)->b_getattr(zone, attr, buf, &size);
5461                 } else {
5462                         error = EINVAL;
5463                 }
5464         }
5465         zone_rele(zone);
5466 
5467         if (error)
5468                 return (set_errno(error));
5469         return ((ssize_t)size);
5470 }
5471 
5472 /*
5473  * Systemcall entry point for zone_setattr(2).
5474  */
5475 /*ARGSUSED*/
5476 static int
5477 zone_setattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
5478 {
5479         zone_t *zone;
5480         zone_status_t zone_status;
5481         int err = -1;
5482         zone_net_data_t *zbuf;
5483 
5484         if (secpolicy_zone_config(CRED()) != 0)
5485                 return (set_errno(EPERM));
5486 
5487         /*
5488          * Only the ZONE_ATTR_PHYS_MCAP attribute can be set on the
5489          * global zone.
5490          */
5491         if (zoneid == GLOBAL_ZONEID && attr != ZONE_ATTR_PHYS_MCAP) {
5492                 return (set_errno(EINVAL));
5493         }
5494 
5495         mutex_enter(&zonehash_lock);
5496         if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
5497                 mutex_exit(&zonehash_lock);
5498                 return (set_errno(EINVAL));
5499         }
5500         zone_hold(zone);
5501         mutex_exit(&zonehash_lock);
5502 
5503         /*
5504          * At present most attributes can only be set on non-running,
5505          * non-global zones.
5506          */
5507         zone_status = zone_status_get(zone);
5508         if (attr != ZONE_ATTR_PHYS_MCAP && zone_status > ZONE_IS_READY) {
5509                 err = EINVAL;
5510                 goto done;
5511         }
5512 
5513         switch (attr) {
5514         case ZONE_ATTR_INITNAME:
5515                 err = zone_set_initname(zone, (const char *)buf);
5516                 break;
5517         case ZONE_ATTR_BOOTARGS:
5518                 err = zone_set_bootargs(zone, (const char *)buf);
5519                 break;
5520         case ZONE_ATTR_BRAND:
5521                 err = zone_set_brand(zone, (const char *)buf);
5522                 break;
5523         case ZONE_ATTR_FS_ALLOWED:
5524                 err = zone_set_fs_allowed(zone, (const char *)buf);
5525                 break;
5526         case ZONE_ATTR_PHYS_MCAP:
5527                 err = zone_set_phys_mcap(zone, (const uint64_t *)buf);
5528                 break;
5529         case ZONE_ATTR_SCHED_CLASS:
5530                 err = zone_set_sched_class(zone, (const char *)buf);
5531                 break;
5532         case ZONE_ATTR_HOSTID:
5533                 if (bufsize == sizeof (zone->zone_hostid)) {
5534                         if (copyin(buf, &zone->zone_hostid, bufsize) == 0)
5535                                 err = 0;
5536                         else
5537                                 err = EFAULT;
5538                 } else {
5539                         err = EINVAL;
5540                 }
5541                 break;
5542         case ZONE_ATTR_NETWORK:
5543                 if (bufsize > (PIPE_BUF + sizeof (zone_net_data_t))) {
5544                         err = EINVAL;
5545                         break;
5546                 }
5547                 zbuf = kmem_alloc(bufsize, KM_SLEEP);
5548                 if (copyin(buf, zbuf, bufsize) != 0) {
5549                         kmem_free(zbuf, bufsize);
5550                         err = EFAULT;
5551                         break;
5552                 }
5553                 err = zone_set_network(zoneid, zbuf);
5554                 kmem_free(zbuf, bufsize);
5555                 break;
5556         default:
5557                 if ((attr >= ZONE_ATTR_BRAND_ATTRS) && ZONE_IS_BRANDED(zone))
5558                         err = ZBROP(zone)->b_setattr(zone, attr, buf, bufsize);
5559                 else
5560                         err = EINVAL;
5561         }
5562 
5563 done:
5564         zone_rele(zone);
5565         ASSERT(err != -1);
5566         return (err != 0 ? set_errno(err) : 0);
5567 }
5568 
5569 /*
5570  * Return zero if the process has at least one vnode mapped in to its
5571  * address space which shouldn't be allowed to change zones.
5572  *
5573  * Also return zero if the process has any shared mappings which reserve
5574  * swap.  This is because the counting for zone.max-swap does not allow swap
5575  * reservation to be shared between zones.  zone swap reservation is counted
5576  * on zone->zone_max_swap.
5577  */
5578 static int
5579 as_can_change_zones(void)
5580 {
5581         proc_t *pp = curproc;
5582         struct seg *seg;
5583         struct as *as = pp->p_as;
5584         vnode_t *vp;
5585         int allow = 1;
5586 
5587         ASSERT(pp->p_as != &kas);
5588         AS_LOCK_ENTER(as, &as->a_lock, RW_READER);
5589         for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
5590 
5591                 /*
5592                  * Cannot enter zone with shared anon memory which
5593                  * reserves swap.  See comment above.
5594                  */
5595                 if (seg_can_change_zones(seg) == B_FALSE) {
5596                         allow = 0;
5597                         break;
5598                 }
5599                 /*
5600                  * if we can't get a backing vnode for this segment then skip
5601                  * it.
5602                  */
5603                 vp = NULL;
5604                 if (SEGOP_GETVP(seg, seg->s_base, &vp) != 0 || vp == NULL)
5605                         continue;
5606                 if (!vn_can_change_zones(vp)) { /* bail on first match */
5607                         allow = 0;
5608                         break;
5609                 }
5610         }
5611         AS_LOCK_EXIT(as, &as->a_lock);
5612         return (allow);
5613 }
5614 
5615 /*
5616  * Count swap reserved by curproc's address space
5617  */
5618 static size_t
5619 as_swresv(void)
5620 {
5621         proc_t *pp = curproc;
5622         struct seg *seg;
5623         struct as *as = pp->p_as;
5624         size_t swap = 0;
5625 
5626         ASSERT(pp->p_as != &kas);
5627         ASSERT(AS_WRITE_HELD(as, &as->a_lock));
5628         for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg))
5629                 swap += seg_swresv(seg);
5630 
5631         return (swap);
5632 }
5633 
5634 /*
5635  * Systemcall entry point for zone_enter().
5636  *
5637  * The current process is injected into said zone.  In the process
5638  * it will change its project membership, privileges, rootdir/cwd,
5639  * zone-wide rctls, and pool association to match those of the zone.
5640  *
5641  * The first zone_enter() called while the zone is in the ZONE_IS_READY
5642  * state will transition it to ZONE_IS_RUNNING.  Processes may only
5643  * enter a zone that is "ready" or "running".
5644  */
5645 static int
5646 zone_enter(zoneid_t zoneid)
5647 {
5648         zone_t *zone;
5649         vnode_t *vp;
5650         proc_t *pp = curproc;
5651         contract_t *ct;
5652         cont_process_t *ctp;
5653         task_t *tk, *oldtk;
5654         kproject_t *zone_proj0;
5655         cred_t *cr, *newcr;
5656         pool_t *oldpool, *newpool;
5657         sess_t *sp;
5658         uid_t uid;
5659         zone_status_t status;
5660         int err = 0;
5661         rctl_entity_p_t e;
5662         size_t swap;
5663         kthread_id_t t;
5664 
5665         if (secpolicy_zone_config(CRED()) != 0)
5666                 return (set_errno(EPERM));
5667         if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
5668                 return (set_errno(EINVAL));
5669 
5670         /*
5671          * Stop all lwps so we don't need to hold a lock to look at
5672          * curproc->p_zone.  This needs to happen before we grab any
5673          * locks to avoid deadlock (another lwp in the process could
5674          * be waiting for the held lock).
5675          */
5676         if (curthread != pp->p_agenttp && !holdlwps(SHOLDFORK))
5677                 return (set_errno(EINTR));
5678 
5679         /*
5680          * Make sure we're not changing zones with files open or mapped in
5681          * to our address space which shouldn't be changing zones.
5682          */
5683         if (!files_can_change_zones()) {
5684                 err = EBADF;
5685                 goto out;
5686         }
5687         if (!as_can_change_zones()) {
5688                 err = EFAULT;
5689                 goto out;
5690         }
5691 
5692         mutex_enter(&zonehash_lock);
5693         if (pp->p_zone != global_zone) {
5694                 mutex_exit(&zonehash_lock);
5695                 err = EINVAL;
5696                 goto out;
5697         }
5698 
5699         zone = zone_find_all_by_id(zoneid);
5700         if (zone == NULL) {
5701                 mutex_exit(&zonehash_lock);
5702                 err = EINVAL;
5703                 goto out;
5704         }
5705 
5706         /*
5707          * To prevent processes in a zone from holding contracts on
5708          * extrazonal resources, and to avoid process contract
5709          * memberships which span zones, contract holders and processes
5710          * which aren't the sole members of their encapsulating process
5711          * contracts are not allowed to zone_enter.
5712          */
5713         ctp = pp->p_ct_process;
5714         ct = &ctp->conp_contract;
5715         mutex_enter(&ct->ct_lock);
5716         mutex_enter(&pp->p_lock);
5717         if ((avl_numnodes(&pp->p_ct_held) != 0) || (ctp->conp_nmembers != 1)) {
5718                 mutex_exit(&pp->p_lock);
5719                 mutex_exit(&ct->ct_lock);
5720                 mutex_exit(&zonehash_lock);
5721                 err = EINVAL;
5722                 goto out;
5723         }
5724 
5725         /*
5726          * Moreover, we don't allow processes whose encapsulating
5727          * process contracts have inherited extrazonal contracts.
5728          * While it would be easier to eliminate all process contracts
5729          * with inherited contracts, we need to be able to give a
5730          * restarted init (or other zone-penetrating process) its
5731          * predecessor's contracts.
5732          */
5733         if (ctp->conp_ninherited != 0) {
5734                 contract_t *next;
5735                 for (next = list_head(&ctp->conp_inherited); next;
5736                     next = list_next(&ctp->conp_inherited, next)) {
5737                         if (contract_getzuniqid(next) != zone->zone_uniqid) {
5738                                 mutex_exit(&pp->p_lock);
5739                                 mutex_exit(&ct->ct_lock);
5740                                 mutex_exit(&zonehash_lock);
5741                                 err = EINVAL;
5742                                 goto out;
5743                         }
5744                 }
5745         }
5746 
5747         mutex_exit(&pp->p_lock);
5748         mutex_exit(&ct->ct_lock);
5749 
5750         status = zone_status_get(zone);
5751         if (status < ZONE_IS_READY || status >= ZONE_IS_SHUTTING_DOWN) {
5752                 /*
5753                  * Can't join
5754                  */
5755                 mutex_exit(&zonehash_lock);
5756                 err = EINVAL;
5757                 goto out;
5758         }
5759 
5760         /*
5761          * Make sure new priv set is within the permitted set for caller
5762          */
5763         if (!priv_issubset(zone->zone_privset, &CR_OPPRIV(CRED()))) {
5764                 mutex_exit(&zonehash_lock);
5765                 err = EPERM;
5766                 goto out;
5767         }
5768         /*
5769          * We want to momentarily drop zonehash_lock while we optimistically
5770          * bind curproc to the pool it should be running in.  This is safe
5771          * since the zone can't disappear (we have a hold on it).
5772          */
5773         zone_hold(zone);
5774         mutex_exit(&zonehash_lock);
5775 
5776         /*
5777          * Grab pool_lock to keep the pools configuration from changing
5778          * and to stop ourselves from getting rebound to another pool
5779          * until we join the zone.
5780          */
5781         if (pool_lock_intr() != 0) {
5782                 zone_rele(zone);
5783                 err = EINTR;
5784                 goto out;
5785         }
5786         ASSERT(secpolicy_pool(CRED()) == 0);
5787         /*
5788          * Bind ourselves to the pool currently associated with the zone.
5789          */
5790         oldpool = curproc->p_pool;
5791         newpool = zone_pool_get(zone);
5792         if (pool_state == POOL_ENABLED && newpool != oldpool &&
5793             (err = pool_do_bind(newpool, P_PID, P_MYID,
5794             POOL_BIND_ALL)) != 0) {
5795                 pool_unlock();
5796                 zone_rele(zone);
5797                 goto out;
5798         }
5799 
5800         /*
5801          * Grab cpu_lock now; we'll need it later when we call
5802          * task_join().
5803          */
5804         mutex_enter(&cpu_lock);
5805         mutex_enter(&zonehash_lock);
5806         /*
5807          * Make sure the zone hasn't moved on since we dropped zonehash_lock.
5808          */
5809         if (zone_status_get(zone) >= ZONE_IS_SHUTTING_DOWN) {
5810                 /*
5811                  * Can't join anymore.
5812                  */
5813                 mutex_exit(&zonehash_lock);
5814                 mutex_exit(&cpu_lock);
5815                 if (pool_state == POOL_ENABLED &&
5816                     newpool != oldpool)
5817                         (void) pool_do_bind(oldpool, P_PID, P_MYID,
5818                             POOL_BIND_ALL);
5819                 pool_unlock();
5820                 zone_rele(zone);
5821                 err = EINVAL;
5822                 goto out;
5823         }
5824 
5825         /*
5826          * a_lock must be held while transfering locked memory and swap
5827          * reservation from the global zone to the non global zone because
5828          * asynchronous faults on the processes' address space can lock
5829          * memory and reserve swap via MCL_FUTURE and MAP_NORESERVE
5830          * segments respectively.
5831          */
5832         AS_LOCK_ENTER(pp->as, &pp->p_as->a_lock, RW_WRITER);
5833         swap = as_swresv();
5834         mutex_enter(&pp->p_lock);
5835         zone_proj0 = zone->zone_zsched->p_task->tk_proj;
5836         /* verify that we do not exceed and task or lwp limits */
5837         mutex_enter(&zone->zone_nlwps_lock);
5838         /* add new lwps to zone and zone's proj0 */
5839         zone_proj0->kpj_nlwps += pp->p_lwpcnt;
5840         zone->zone_nlwps += pp->p_lwpcnt;
5841         /* add 1 task to zone's proj0 */
5842         zone_proj0->kpj_ntasks += 1;
5843 
5844         zone_proj0->kpj_nprocs++;
5845         zone->zone_nprocs++;
5846         mutex_exit(&zone->zone_nlwps_lock);
5847 
5848         mutex_enter(&zone->zone_mem_lock);
5849         zone->zone_locked_mem += pp->p_locked_mem;
5850         zone_proj0->kpj_data.kpd_locked_mem += pp->p_locked_mem;
5851         zone->zone_max_swap += swap;
5852         mutex_exit(&zone->zone_mem_lock);
5853 
5854         mutex_enter(&(zone_proj0->kpj_data.kpd_crypto_lock));
5855         zone_proj0->kpj_data.kpd_crypto_mem += pp->p_crypto_mem;
5856         mutex_exit(&(zone_proj0->kpj_data.kpd_crypto_lock));
5857 
5858         /* remove lwps and process from proc's old zone and old project */
5859         mutex_enter(&pp->p_zone->zone_nlwps_lock);
5860         pp->p_zone->zone_nlwps -= pp->p_lwpcnt;
5861         pp->p_task->tk_proj->kpj_nlwps -= pp->p_lwpcnt;
5862         pp->p_task->tk_proj->kpj_nprocs--;
5863         pp->p_zone->zone_nprocs--;
5864         mutex_exit(&pp->p_zone->zone_nlwps_lock);
5865 
5866         mutex_enter(&pp->p_zone->zone_mem_lock);
5867         pp->p_zone->zone_locked_mem -= pp->p_locked_mem;
5868         pp->p_task->tk_proj->kpj_data.kpd_locked_mem -= pp->p_locked_mem;
5869         pp->p_zone->zone_max_swap -= swap;
5870         mutex_exit(&pp->p_zone->zone_mem_lock);
5871 
5872         mutex_enter(&(pp->p_task->tk_proj->kpj_data.kpd_crypto_lock));
5873         pp->p_task->tk_proj->kpj_data.kpd_crypto_mem -= pp->p_crypto_mem;
5874         mutex_exit(&(pp->p_task->tk_proj->kpj_data.kpd_crypto_lock));
5875 
5876         pp->p_flag |= SZONETOP;
5877         pp->p_zone = zone;
5878         mutex_exit(&pp->p_lock);
5879         AS_LOCK_EXIT(pp->p_as, &pp->p_as->a_lock);
5880 
5881         /*
5882          * Joining the zone cannot fail from now on.
5883          *
5884          * This means that a lot of the following code can be commonized and
5885          * shared with zsched().
5886          */
5887 
5888         /*
5889          * If the process contract fmri was inherited, we need to
5890          * flag this so that any contract status will not leak
5891          * extra zone information, svc_fmri in this case
5892          */
5893         if (ctp->conp_svc_ctid != ct->ct_id) {
5894                 mutex_enter(&ct->ct_lock);
5895                 ctp->conp_svc_zone_enter = ct->ct_id;
5896                 mutex_exit(&ct->ct_lock);
5897         }
5898 
5899         /*
5900          * Reset the encapsulating process contract's zone.
5901          */
5902         ASSERT(ct->ct_mzuniqid == GLOBAL_ZONEUNIQID);
5903         contract_setzuniqid(ct, zone->zone_uniqid);
5904 
5905         /*
5906          * Create a new task and associate the process with the project keyed
5907          * by (projid,zoneid).
5908          *
5909          * We might as well be in project 0; the global zone's projid doesn't
5910          * make much sense in a zone anyhow.
5911          *
5912          * This also increments zone_ntasks, and returns with p_lock held.
5913          */
5914         tk = task_create(0, zone);
5915         oldtk = task_join(tk, 0);
5916         mutex_exit(&cpu_lock);
5917 
5918         /*
5919          * call RCTLOP_SET functions on this proc
5920          */
5921         e.rcep_p.zone = zone;
5922         e.rcep_t = RCENTITY_ZONE;
5923         (void) rctl_set_dup(NULL, NULL, pp, &e, zone->zone_rctls, NULL,
5924             RCD_CALLBACK);
5925         mutex_exit(&pp->p_lock);
5926 
5927         /*
5928          * We don't need to hold any of zsched's locks here; not only do we know
5929          * the process and zone aren't going away, we know its session isn't
5930          * changing either.
5931          *
5932          * By joining zsched's session here, we mimic the behavior in the
5933          * global zone of init's sid being the pid of sched.  We extend this
5934          * to all zlogin-like zone_enter()'ing processes as well.
5935          */
5936         mutex_enter(&pidlock);
5937         sp = zone->zone_zsched->p_sessp;
5938         sess_hold(zone->zone_zsched);
5939         mutex_enter(&pp->p_lock);
5940         pgexit(pp);
5941         sess_rele(pp->p_sessp, B_TRUE);
5942         pp->p_sessp = sp;
5943         pgjoin(pp, zone->zone_zsched->p_pidp);
5944 
5945         /*
5946          * If any threads are scheduled to be placed on zone wait queue they
5947          * should abandon the idea since the wait queue is changing.
5948          * We need to be holding pidlock & p_lock to do this.
5949          */
5950         if ((t = pp->p_tlist) != NULL) {
5951                 do {
5952                         thread_lock(t);
5953                         /*
5954                          * Kick this thread so that he doesn't sit
5955                          * on a wrong wait queue.
5956                          */
5957                         if (ISWAITING(t))
5958                                 setrun_locked(t);
5959 
5960                         if (t->t_schedflag & TS_ANYWAITQ)
5961                                 t->t_schedflag &= ~ TS_ANYWAITQ;
5962 
5963                         thread_unlock(t);
5964                 } while ((t = t->t_forw) != pp->p_tlist);
5965         }
5966 
5967         /*
5968          * If there is a default scheduling class for the zone and it is not
5969          * the class we are currently in, change all of the threads in the
5970          * process to the new class.  We need to be holding pidlock & p_lock
5971          * when we call parmsset so this is a good place to do it.
5972          */
5973         if (zone->zone_defaultcid > 0 &&
5974             zone->zone_defaultcid != curthread->t_cid) {
5975                 pcparms_t pcparms;
5976 
5977                 pcparms.pc_cid = zone->zone_defaultcid;
5978                 pcparms.pc_clparms[0] = 0;
5979 
5980                 /*
5981                  * If setting the class fails, we still want to enter the zone.
5982                  */
5983                 if ((t = pp->p_tlist) != NULL) {
5984                         do {
5985                                 (void) parmsset(&pcparms, t);
5986                         } while ((t = t->t_forw) != pp->p_tlist);
5987                 }
5988         }
5989 
5990         mutex_exit(&pp->p_lock);
5991         mutex_exit(&pidlock);
5992 
5993         mutex_exit(&zonehash_lock);
5994         /*
5995          * We're firmly in the zone; let pools progress.
5996          */
5997         pool_unlock();
5998         task_rele(oldtk);
5999         /*
6000          * We don't need to retain a hold on the zone since we already
6001          * incremented zone_ntasks, so the zone isn't going anywhere.
6002          */
6003         zone_rele(zone);
6004 
6005         /*
6006          * Chroot
6007          */
6008         vp = zone->zone_rootvp;
6009         zone_chdir(vp, &PTOU(pp)->u_cdir, pp);
6010         zone_chdir(vp, &PTOU(pp)->u_rdir, pp);
6011 
6012         /*
6013          * Change process credentials
6014          */
6015         newcr = cralloc();
6016         mutex_enter(&pp->p_crlock);
6017         cr = pp->p_cred;
6018         crcopy_to(cr, newcr);
6019         crsetzone(newcr, zone);
6020         pp->p_cred = newcr;
6021 
6022         /*
6023          * Restrict all process privilege sets to zone limit
6024          */
6025         priv_intersect(zone->zone_privset, &CR_PPRIV(newcr));
6026         priv_intersect(zone->zone_privset, &CR_EPRIV(newcr));
6027         priv_intersect(zone->zone_privset, &CR_IPRIV(newcr));
6028         priv_intersect(zone->zone_privset, &CR_LPRIV(newcr));
6029         mutex_exit(&pp->p_crlock);
6030         crset(pp, newcr);
6031 
6032         /*
6033          * Adjust upcount to reflect zone entry.
6034          */
6035         uid = crgetruid(newcr);
6036         mutex_enter(&pidlock);
6037         upcount_dec(uid, GLOBAL_ZONEID);
6038         upcount_inc(uid, zoneid);
6039         mutex_exit(&pidlock);
6040 
6041         /*
6042          * Set up core file path and content.
6043          */
6044         set_core_defaults();
6045 
6046 out:
6047         /*
6048          * Let the other lwps continue.
6049          */
6050         mutex_enter(&pp->p_lock);
6051         if (curthread != pp->p_agenttp)
6052                 continuelwps(pp);
6053         mutex_exit(&pp->p_lock);
6054 
6055         return (err != 0 ? set_errno(err) : 0);
6056 }
6057 
6058 /*
6059  * Systemcall entry point for zone_list(2).
6060  *
6061  * Processes running in a (non-global) zone only see themselves.
6062  * On labeled systems, they see all zones whose label they dominate.
6063  */
6064 static int
6065 zone_list(zoneid_t *zoneidlist, uint_t *numzones)
6066 {
6067         zoneid_t *zoneids;
6068         zone_t *zone, *myzone;
6069         uint_t user_nzones, real_nzones;
6070         uint_t domi_nzones;
6071         int error;
6072 
6073         if (copyin(numzones, &user_nzones, sizeof (uint_t)) != 0)
6074                 return (set_errno(EFAULT));
6075 
6076         myzone = curproc->p_zone;
6077         if (myzone != global_zone) {
6078                 bslabel_t *mybslab;
6079 
6080                 if (!is_system_labeled()) {
6081                         /* just return current zone */
6082                         real_nzones = domi_nzones = 1;
6083                         zoneids = kmem_alloc(sizeof (zoneid_t), KM_SLEEP);
6084                         zoneids[0] = myzone->zone_id;
6085                 } else {
6086                         /* return all zones that are dominated */
6087                         mutex_enter(&zonehash_lock);
6088                         real_nzones = zonecount;
6089                         domi_nzones = 0;
6090                         if (real_nzones > 0) {
6091                                 zoneids = kmem_alloc(real_nzones *
6092                                     sizeof (zoneid_t), KM_SLEEP);
6093                                 mybslab = label2bslabel(myzone->zone_slabel);
6094                                 for (zone = list_head(&zone_active);
6095                                     zone != NULL;
6096                                     zone = list_next(&zone_active, zone)) {
6097                                         if (zone->zone_id == GLOBAL_ZONEID)
6098                                                 continue;
6099                                         if (zone != myzone &&
6100                                             (zone->zone_flags & ZF_IS_SCRATCH))
6101                                                 continue;
6102                                         /*
6103                                          * Note that a label always dominates
6104                                          * itself, so myzone is always included
6105                                          * in the list.
6106                                          */
6107                                         if (bldominates(mybslab,
6108                                             label2bslabel(zone->zone_slabel))) {
6109                                                 zoneids[domi_nzones++] =
6110                                                     zone->zone_id;
6111                                         }
6112                                 }
6113                         }
6114                         mutex_exit(&zonehash_lock);
6115                 }
6116         } else {
6117                 mutex_enter(&zonehash_lock);
6118                 real_nzones = zonecount;
6119                 domi_nzones = 0;
6120                 if (real_nzones > 0) {
6121                         zoneids = kmem_alloc(real_nzones * sizeof (zoneid_t),
6122                             KM_SLEEP);
6123                         for (zone = list_head(&zone_active); zone != NULL;
6124                             zone = list_next(&zone_active, zone))
6125                                 zoneids[domi_nzones++] = zone->zone_id;
6126                         ASSERT(domi_nzones == real_nzones);
6127                 }
6128                 mutex_exit(&zonehash_lock);
6129         }
6130 
6131         /*
6132          * If user has allocated space for fewer entries than we found, then
6133          * return only up to his limit.  Either way, tell him exactly how many
6134          * we found.
6135          */
6136         if (domi_nzones < user_nzones)
6137                 user_nzones = domi_nzones;
6138         error = 0;
6139         if (copyout(&domi_nzones, numzones, sizeof (uint_t)) != 0) {
6140                 error = EFAULT;
6141         } else if (zoneidlist != NULL && user_nzones != 0) {
6142                 if (copyout(zoneids, zoneidlist,
6143                     user_nzones * sizeof (zoneid_t)) != 0)
6144                         error = EFAULT;
6145         }
6146 
6147         if (real_nzones > 0)
6148                 kmem_free(zoneids, real_nzones * sizeof (zoneid_t));
6149 
6150         if (error != 0)
6151                 return (set_errno(error));
6152         else
6153                 return (0);
6154 }
6155 
6156 /*
6157  * Systemcall entry point for zone_lookup(2).
6158  *
6159  * Non-global zones are only able to see themselves and (on labeled systems)
6160  * the zones they dominate.
6161  */
6162 static zoneid_t
6163 zone_lookup(const char *zone_name)
6164 {
6165         char *kname;
6166         zone_t *zone;
6167         zoneid_t zoneid;
6168         int err;
6169 
6170         if (zone_name == NULL) {
6171                 /* return caller's zone id */
6172                 return (getzoneid());
6173         }
6174 
6175         kname = kmem_zalloc(ZONENAME_MAX, KM_SLEEP);
6176         if ((err = copyinstr(zone_name, kname, ZONENAME_MAX, NULL)) != 0) {
6177                 kmem_free(kname, ZONENAME_MAX);
6178                 return (set_errno(err));
6179         }
6180 
6181         mutex_enter(&zonehash_lock);
6182         zone = zone_find_all_by_name(kname);
6183         kmem_free(kname, ZONENAME_MAX);
6184         /*
6185          * In a non-global zone, can only lookup global and own name.
6186          * In Trusted Extensions zone label dominance rules apply.
6187          */
6188         if (zone == NULL ||
6189             zone_status_get(zone) < ZONE_IS_READY ||
6190             !zone_list_access(zone)) {
6191                 mutex_exit(&zonehash_lock);
6192                 return (set_errno(EINVAL));
6193         } else {
6194                 zoneid = zone->zone_id;
6195                 mutex_exit(&zonehash_lock);
6196                 return (zoneid);
6197         }
6198 }
6199 
6200 static int
6201 zone_version(int *version_arg)
6202 {
6203         int version = ZONE_SYSCALL_API_VERSION;
6204 
6205         if (copyout(&version, version_arg, sizeof (int)) != 0)
6206                 return (set_errno(EFAULT));
6207         return (0);
6208 }
6209 
6210 /* ARGSUSED */
6211 long
6212 zone(int cmd, void *arg1, void *arg2, void *arg3, void *arg4)
6213 {
6214         zone_def zs;
6215         int err;
6216 
6217         switch (cmd) {
6218         case ZONE_CREATE:
6219                 if (get_udatamodel() == DATAMODEL_NATIVE) {
6220                         if (copyin(arg1, &zs, sizeof (zone_def))) {
6221                                 return (set_errno(EFAULT));
6222                         }
6223                 } else {
6224 #ifdef _SYSCALL32_IMPL
6225                         zone_def32 zs32;
6226 
6227                         if (copyin(arg1, &zs32, sizeof (zone_def32))) {
6228                                 return (set_errno(EFAULT));
6229                         }
6230                         zs.zone_name =
6231                             (const char *)(unsigned long)zs32.zone_name;
6232                         zs.zone_root =
6233                             (const char *)(unsigned long)zs32.zone_root;
6234                         zs.zone_privs =
6235                             (const struct priv_set *)
6236                             (unsigned long)zs32.zone_privs;
6237                         zs.zone_privssz = zs32.zone_privssz;
6238                         zs.rctlbuf = (caddr_t)(unsigned long)zs32.rctlbuf;
6239                         zs.rctlbufsz = zs32.rctlbufsz;
6240                         zs.zfsbuf = (caddr_t)(unsigned long)zs32.zfsbuf;
6241                         zs.zfsbufsz = zs32.zfsbufsz;
6242                         zs.extended_error =
6243                             (int *)(unsigned long)zs32.extended_error;
6244                         zs.match = zs32.match;
6245                         zs.doi = zs32.doi;
6246                         zs.label = (const bslabel_t *)(uintptr_t)zs32.label;
6247                         zs.flags = zs32.flags;
6248 #else
6249                         panic("get_udatamodel() returned bogus result\n");
6250 #endif
6251                 }
6252 
6253                 return (zone_create(zs.zone_name, zs.zone_root,
6254                     zs.zone_privs, zs.zone_privssz,
6255                     (caddr_t)zs.rctlbuf, zs.rctlbufsz,
6256                     (caddr_t)zs.zfsbuf, zs.zfsbufsz,
6257                     zs.extended_error, zs.match, zs.doi,
6258                     zs.label, zs.flags));
6259         case ZONE_BOOT:
6260                 return (zone_boot((zoneid_t)(uintptr_t)arg1));
6261         case ZONE_DESTROY:
6262                 return (zone_destroy((zoneid_t)(uintptr_t)arg1));
6263         case ZONE_GETATTR:
6264                 return (zone_getattr((zoneid_t)(uintptr_t)arg1,
6265                     (int)(uintptr_t)arg2, arg3, (size_t)arg4));
6266         case ZONE_SETATTR:
6267                 return (zone_setattr((zoneid_t)(uintptr_t)arg1,
6268                     (int)(uintptr_t)arg2, arg3, (size_t)arg4));
6269         case ZONE_ENTER:
6270                 return (zone_enter((zoneid_t)(uintptr_t)arg1));
6271         case ZONE_LIST:
6272                 return (zone_list((zoneid_t *)arg1, (uint_t *)arg2));
6273         case ZONE_SHUTDOWN:
6274                 return (zone_shutdown((zoneid_t)(uintptr_t)arg1));
6275         case ZONE_LOOKUP:
6276                 return (zone_lookup((const char *)arg1));
6277         case ZONE_VERSION:
6278                 return (zone_version((int *)arg1));
6279         case ZONE_ADD_DATALINK:
6280                 return (zone_add_datalink((zoneid_t)(uintptr_t)arg1,
6281                     (datalink_id_t)(uintptr_t)arg2));
6282         case ZONE_DEL_DATALINK:
6283                 return (zone_remove_datalink((zoneid_t)(uintptr_t)arg1,
6284                     (datalink_id_t)(uintptr_t)arg2));
6285         case ZONE_CHECK_DATALINK: {
6286                 zoneid_t        zoneid;
6287                 boolean_t       need_copyout;
6288 
6289                 if (copyin(arg1, &zoneid, sizeof (zoneid)) != 0)
6290                         return (EFAULT);
6291                 need_copyout = (zoneid == ALL_ZONES);
6292                 err = zone_check_datalink(&zoneid,
6293                     (datalink_id_t)(uintptr_t)arg2);
6294                 if (err == 0 && need_copyout) {
6295                         if (copyout(&zoneid, arg1, sizeof (zoneid)) != 0)
6296                                 err = EFAULT;
6297                 }
6298                 return (err == 0 ? 0 : set_errno(err));
6299         }
6300         case ZONE_LIST_DATALINK:
6301                 return (zone_list_datalink((zoneid_t)(uintptr_t)arg1,
6302                     (int *)arg2, (datalink_id_t *)(uintptr_t)arg3));
6303         default:
6304                 return (set_errno(EINVAL));
6305         }
6306 }
6307 
6308 struct zarg {
6309         zone_t *zone;
6310         zone_cmd_arg_t arg;
6311 };
6312 
6313 static int
6314 zone_lookup_door(const char *zone_name, door_handle_t *doorp)
6315 {
6316         char *buf;
6317         size_t buflen;
6318         int error;
6319 
6320         buflen = sizeof (ZONE_DOOR_PATH) + strlen(zone_name);
6321         buf = kmem_alloc(buflen, KM_SLEEP);
6322         (void) snprintf(buf, buflen, ZONE_DOOR_PATH, zone_name);
6323         error = door_ki_open(buf, doorp);
6324         kmem_free(buf, buflen);
6325         return (error);
6326 }
6327 
6328 static void
6329 zone_release_door(door_handle_t *doorp)
6330 {
6331         door_ki_rele(*doorp);
6332         *doorp = NULL;
6333 }
6334 
6335 static void
6336 zone_ki_call_zoneadmd(struct zarg *zargp)
6337 {
6338         door_handle_t door = NULL;
6339         door_arg_t darg, save_arg;
6340         char *zone_name;
6341         size_t zone_namelen;
6342         zoneid_t zoneid;
6343         zone_t *zone;
6344         zone_cmd_arg_t arg;
6345         uint64_t uniqid;
6346         size_t size;
6347         int error;
6348         int retry;
6349 
6350         zone = zargp->zone;
6351         arg = zargp->arg;
6352         kmem_free(zargp, sizeof (*zargp));
6353 
6354         zone_namelen = strlen(zone->zone_name) + 1;
6355         zone_name = kmem_alloc(zone_namelen, KM_SLEEP);
6356         bcopy(zone->zone_name, zone_name, zone_namelen);
6357         zoneid = zone->zone_id;
6358         uniqid = zone->zone_uniqid;
6359         /*
6360          * zoneadmd may be down, but at least we can empty out the zone.
6361          * We can ignore the return value of zone_empty() since we're called
6362          * from a kernel thread and know we won't be delivered any signals.
6363          */
6364         ASSERT(curproc == &p0);
6365         (void) zone_empty(zone);
6366         ASSERT(zone_status_get(zone) >= ZONE_IS_EMPTY);
6367         zone_rele(zone);
6368 
6369         size = sizeof (arg);
6370         darg.rbuf = (char *)&arg;
6371         darg.data_ptr = (char *)&arg;
6372         darg.rsize = size;
6373         darg.data_size = size;
6374         darg.desc_ptr = NULL;
6375         darg.desc_num = 0;
6376 
6377         save_arg = darg;
6378         /*
6379          * Since we're not holding a reference to the zone, any number of
6380          * things can go wrong, including the zone disappearing before we get a
6381          * chance to talk to zoneadmd.
6382          */
6383         for (retry = 0; /* forever */; retry++) {
6384                 if (door == NULL &&
6385                     (error = zone_lookup_door(zone_name, &door)) != 0) {
6386                         goto next;
6387                 }
6388                 ASSERT(door != NULL);
6389 
6390                 if ((error = door_ki_upcall_limited(door, &darg, NULL,
6391                     SIZE_MAX, 0)) == 0) {
6392                         break;
6393                 }
6394                 switch (error) {
6395                 case EINTR:
6396                         /* FALLTHROUGH */
6397                 case EAGAIN:    /* process may be forking */
6398                         /*
6399                          * Back off for a bit
6400                          */
6401                         break;
6402                 case EBADF:
6403                         zone_release_door(&door);
6404                         if (zone_lookup_door(zone_name, &door) != 0) {
6405                                 /*
6406                                  * zoneadmd may be dead, but it may come back to
6407                                  * life later.
6408                                  */
6409                                 break;
6410                         }
6411                         break;
6412                 default:
6413                         cmn_err(CE_WARN,
6414                             "zone_ki_call_zoneadmd: door_ki_upcall error %d\n",
6415                             error);
6416                         goto out;
6417                 }
6418 next:
6419                 /*
6420                  * If this isn't the same zone_t that we originally had in mind,
6421                  * then this is the same as if two kadmin requests come in at
6422                  * the same time: the first one wins.  This means we lose, so we
6423                  * bail.
6424                  */
6425                 if ((zone = zone_find_by_id(zoneid)) == NULL) {
6426                         /*
6427                          * Problem is solved.
6428                          */
6429                         break;
6430                 }
6431                 if (zone->zone_uniqid != uniqid) {
6432                         /*
6433                          * zoneid recycled
6434                          */
6435                         zone_rele(zone);
6436                         break;
6437                 }
6438                 /*
6439                  * We could zone_status_timedwait(), but there doesn't seem to
6440                  * be much point in doing that (plus, it would mean that
6441                  * zone_free() isn't called until this thread exits).
6442                  */
6443                 zone_rele(zone);
6444                 delay(hz);
6445                 darg = save_arg;
6446         }
6447 out:
6448         if (door != NULL) {
6449                 zone_release_door(&door);
6450         }
6451         kmem_free(zone_name, zone_namelen);
6452         thread_exit();
6453 }
6454 
6455 /*
6456  * Entry point for uadmin() to tell the zone to go away or reboot.  Analog to
6457  * kadmin().  The caller is a process in the zone.
6458  *
6459  * In order to shutdown the zone, we will hand off control to zoneadmd
6460  * (running in the global zone) via a door.  We do a half-hearted job at
6461  * killing all processes in the zone, create a kernel thread to contact
6462  * zoneadmd, and make note of the "uniqid" of the zone.  The uniqid is
6463  * a form of generation number used to let zoneadmd (as well as
6464  * zone_destroy()) know exactly which zone they're re talking about.
6465  */
6466 int
6467 zone_kadmin(int cmd, int fcn, const char *mdep, cred_t *credp)
6468 {
6469         struct zarg *zargp;
6470         zone_cmd_t zcmd;
6471         zone_t *zone;
6472 
6473         zone = curproc->p_zone;
6474         ASSERT(getzoneid() != GLOBAL_ZONEID);
6475 
6476         switch (cmd) {
6477         case A_SHUTDOWN:
6478                 switch (fcn) {
6479                 case AD_HALT:
6480                 case AD_POWEROFF:
6481                         zcmd = Z_HALT;
6482                         break;
6483                 case AD_BOOT:
6484                         zcmd = Z_REBOOT;
6485                         break;
6486                 case AD_IBOOT:
6487                 case AD_SBOOT:
6488                 case AD_SIBOOT:
6489                 case AD_NOSYNC:
6490                         return (ENOTSUP);
6491                 default:
6492                         return (EINVAL);
6493                 }
6494                 break;
6495         case A_REBOOT:
6496                 zcmd = Z_REBOOT;
6497                 break;
6498         case A_FTRACE:
6499         case A_REMOUNT:
6500         case A_FREEZE:
6501         case A_DUMP:
6502         case A_CONFIG:
6503                 return (ENOTSUP);
6504         default:
6505                 ASSERT(cmd != A_SWAPCTL);       /* handled by uadmin() */
6506                 return (EINVAL);
6507         }
6508 
6509         if (secpolicy_zone_admin(credp, B_FALSE))
6510                 return (EPERM);
6511         mutex_enter(&zone_status_lock);
6512 
6513         /*
6514          * zone_status can't be ZONE_IS_EMPTY or higher since curproc
6515          * is in the zone.
6516          */
6517         ASSERT(zone_status_get(zone) < ZONE_IS_EMPTY);
6518         if (zone_status_get(zone) > ZONE_IS_RUNNING) {
6519                 /*
6520                  * This zone is already on its way down.
6521                  */
6522                 mutex_exit(&zone_status_lock);
6523                 return (0);
6524         }
6525         /*
6526          * Prevent future zone_enter()s
6527          */
6528         zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
6529         mutex_exit(&zone_status_lock);
6530 
6531         /*
6532          * Kill everyone now and call zoneadmd later.
6533          * zone_ki_call_zoneadmd() will do a more thorough job of this
6534          * later.
6535          */
6536         killall(zone->zone_id);
6537         /*
6538          * Now, create the thread to contact zoneadmd and do the rest of the
6539          * work.  This thread can't be created in our zone otherwise
6540          * zone_destroy() would deadlock.
6541          */
6542         zargp = kmem_zalloc(sizeof (*zargp), KM_SLEEP);
6543         zargp->arg.cmd = zcmd;
6544         zargp->arg.uniqid = zone->zone_uniqid;
6545         zargp->zone = zone;
6546         (void) strcpy(zargp->arg.locale, "C");
6547         /* mdep was already copied in for us by uadmin */
6548         if (mdep != NULL)
6549                 (void) strlcpy(zargp->arg.bootbuf, mdep,
6550                     sizeof (zargp->arg.bootbuf));
6551         zone_hold(zone);
6552 
6553         (void) thread_create(NULL, 0, zone_ki_call_zoneadmd, zargp, 0, &p0,
6554             TS_RUN, minclsyspri);
6555         exit(CLD_EXITED, 0);
6556 
6557         return (EINVAL);
6558 }
6559 
6560 /*
6561  * Entry point so kadmin(A_SHUTDOWN, ...) can set the global zone's
6562  * status to ZONE_IS_SHUTTING_DOWN.
6563  *
6564  * This function also shuts down all running zones to ensure that they won't
6565  * fork new processes.
6566  */
6567 void
6568 zone_shutdown_global(void)
6569 {
6570         zone_t *current_zonep;
6571 
6572         ASSERT(INGLOBALZONE(curproc));
6573         mutex_enter(&zonehash_lock);
6574         mutex_enter(&zone_status_lock);
6575 
6576         /* Modify the global zone's status first. */
6577         ASSERT(zone_status_get(global_zone) == ZONE_IS_RUNNING);
6578         zone_status_set(global_zone, ZONE_IS_SHUTTING_DOWN);
6579 
6580         /*
6581          * Now change the states of all running zones to ZONE_IS_SHUTTING_DOWN.
6582          * We don't mark all zones with ZONE_IS_SHUTTING_DOWN because doing so
6583          * could cause assertions to fail (e.g., assertions about a zone's
6584          * state during initialization, readying, or booting) or produce races.
6585          * We'll let threads continue to initialize and ready new zones: they'll
6586          * fail to boot the new zones when they see that the global zone is
6587          * shutting down.
6588          */
6589         for (current_zonep = list_head(&zone_active); current_zonep != NULL;
6590             current_zonep = list_next(&zone_active, current_zonep)) {
6591                 if (zone_status_get(current_zonep) == ZONE_IS_RUNNING)
6592                         zone_status_set(current_zonep, ZONE_IS_SHUTTING_DOWN);
6593         }
6594         mutex_exit(&zone_status_lock);
6595         mutex_exit(&zonehash_lock);
6596 }
6597 
6598 /*
6599  * Returns true if the named dataset is visible in the current zone.
6600  * The 'write' parameter is set to 1 if the dataset is also writable.
6601  */
6602 int
6603 zone_dataset_visible(const char *dataset, int *write)
6604 {
6605         static int zfstype = -1;
6606         zone_dataset_t *zd;
6607         size_t len;
6608         zone_t *zone = curproc->p_zone;
6609         const char *name = NULL;
6610         vfs_t *vfsp = NULL;
6611 
6612         if (dataset[0] == '\0')
6613                 return (0);
6614 
6615         /*
6616          * Walk the list once, looking for datasets which match exactly, or
6617          * specify a dataset underneath an exported dataset.  If found, return
6618          * true and note that it is writable.
6619          */
6620         for (zd = list_head(&zone->zone_datasets); zd != NULL;
6621             zd = list_next(&zone->zone_datasets, zd)) {
6622 
6623                 len = strlen(zd->zd_dataset);
6624                 if (strlen(dataset) >= len &&
6625                     bcmp(dataset, zd->zd_dataset, len) == 0 &&
6626                     (dataset[len] == '\0' || dataset[len] == '/' ||
6627                     dataset[len] == '@')) {
6628                         if (write)
6629                                 *write = 1;
6630                         return (1);
6631                 }
6632         }
6633 
6634         /*
6635          * Walk the list a second time, searching for datasets which are parents
6636          * of exported datasets.  These should be visible, but read-only.
6637          *
6638          * Note that we also have to support forms such as 'pool/dataset/', with
6639          * a trailing slash.
6640          */
6641         for (zd = list_head(&zone->zone_datasets); zd != NULL;
6642             zd = list_next(&zone->zone_datasets, zd)) {
6643 
6644                 len = strlen(dataset);
6645                 if (dataset[len - 1] == '/')
6646                         len--;  /* Ignore trailing slash */
6647                 if (len < strlen(zd->zd_dataset) &&
6648                     bcmp(dataset, zd->zd_dataset, len) == 0 &&
6649                     zd->zd_dataset[len] == '/') {
6650                         if (write)
6651                                 *write = 0;
6652                         return (1);
6653                 }
6654         }
6655 
6656         /*
6657          * We reach here if the given dataset is not found in the zone_dataset
6658          * list. Check if this dataset was added as a filesystem (ie. "add fs")
6659          * instead of delegation. For this we search for the dataset in the
6660          * zone_vfslist of this zone. If found, return true and note that it is
6661          * not writable.
6662          */
6663 
6664         /*
6665          * Initialize zfstype if it is not initialized yet.
6666          */
6667         if (zfstype == -1) {
6668                 struct vfssw *vswp = vfs_getvfssw("zfs");
6669                 zfstype = vswp - vfssw;
6670                 vfs_unrefvfssw(vswp);
6671         }
6672 
6673         vfs_list_read_lock();
6674         vfsp = zone->zone_vfslist;
6675         do {
6676                 ASSERT(vfsp);
6677                 if (vfsp->vfs_fstype == zfstype) {
6678                         name = refstr_value(vfsp->vfs_resource);
6679 
6680                         /*
6681                          * Check if we have an exact match.
6682                          */
6683                         if (strcmp(dataset, name) == 0) {
6684                                 vfs_list_unlock();
6685                                 if (write)
6686                                         *write = 0;
6687                                 return (1);
6688                         }
6689                         /*
6690                          * We need to check if we are looking for parents of
6691                          * a dataset. These should be visible, but read-only.
6692                          */
6693                         len = strlen(dataset);
6694                         if (dataset[len - 1] == '/')
6695                                 len--;
6696 
6697                         if (len < strlen(name) &&
6698                             bcmp(dataset, name, len) == 0 && name[len] == '/') {
6699                                 vfs_list_unlock();
6700                                 if (write)
6701                                         *write = 0;
6702                                 return (1);
6703                         }
6704                 }
6705                 vfsp = vfsp->vfs_zone_next;
6706         } while (vfsp != zone->zone_vfslist);
6707 
6708         vfs_list_unlock();
6709         return (0);
6710 }
6711 
6712 /*
6713  * zone_find_by_any_path() -
6714  *
6715  * kernel-private routine similar to zone_find_by_path(), but which
6716  * effectively compares against zone paths rather than zonerootpath
6717  * (i.e., the last component of zonerootpaths, which should be "root/",
6718  * are not compared.)  This is done in order to accurately identify all
6719  * paths, whether zone-visible or not, including those which are parallel
6720  * to /root/, such as /dev/, /home/, etc...
6721  *
6722  * If the specified path does not fall under any zone path then global
6723  * zone is returned.
6724  *
6725  * The treat_abs parameter indicates whether the path should be treated as
6726  * an absolute path although it does not begin with "/".  (This supports
6727  * nfs mount syntax such as host:any/path.)
6728  *
6729  * The caller is responsible for zone_rele of the returned zone.
6730  */
6731 zone_t *
6732 zone_find_by_any_path(const char *path, boolean_t treat_abs)
6733 {
6734         zone_t *zone;
6735         int path_offset = 0;
6736 
6737         if (path == NULL) {
6738                 zone_hold(global_zone);
6739                 return (global_zone);
6740         }
6741 
6742         if (*path != '/') {
6743                 ASSERT(treat_abs);
6744                 path_offset = 1;
6745         }
6746 
6747         mutex_enter(&zonehash_lock);
6748         for (zone = list_head(&zone_active); zone != NULL;
6749             zone = list_next(&zone_active, zone)) {
6750                 char    *c;
6751                 size_t  pathlen;
6752                 char *rootpath_start;
6753 
6754                 if (zone == global_zone)        /* skip global zone */
6755                         continue;
6756 
6757                 /* scan backwards to find start of last component */
6758                 c = zone->zone_rootpath + zone->zone_rootpathlen - 2;
6759                 do {
6760                         c--;
6761                 } while (*c != '/');
6762 
6763                 pathlen = c - zone->zone_rootpath + 1 - path_offset;
6764                 rootpath_start = (zone->zone_rootpath + path_offset);
6765                 if (strncmp(path, rootpath_start, pathlen) == 0)
6766                         break;
6767         }
6768         if (zone == NULL)
6769                 zone = global_zone;
6770         zone_hold(zone);
6771         mutex_exit(&zonehash_lock);
6772         return (zone);
6773 }
6774 
6775 /*
6776  * Finds a zone_dl_t with the given linkid in the given zone.  Returns the
6777  * zone_dl_t pointer if found, and NULL otherwise.
6778  */
6779 static zone_dl_t *
6780 zone_find_dl(zone_t *zone, datalink_id_t linkid)
6781 {
6782         zone_dl_t *zdl;
6783 
6784         ASSERT(mutex_owned(&zone->zone_lock));
6785         for (zdl = list_head(&zone->zone_dl_list); zdl != NULL;
6786             zdl = list_next(&zone->zone_dl_list, zdl)) {
6787                 if (zdl->zdl_id == linkid)
6788                         break;
6789         }
6790         return (zdl);
6791 }
6792 
6793 static boolean_t
6794 zone_dl_exists(zone_t *zone, datalink_id_t linkid)
6795 {
6796         boolean_t exists;
6797 
6798         mutex_enter(&zone->zone_lock);
6799         exists = (zone_find_dl(zone, linkid) != NULL);
6800         mutex_exit(&zone->zone_lock);
6801         return (exists);
6802 }
6803 
6804 /*
6805  * Add an data link name for the zone.
6806  */
6807 static int
6808 zone_add_datalink(zoneid_t zoneid, datalink_id_t linkid)
6809 {
6810         zone_dl_t *zdl;
6811         zone_t *zone;
6812         zone_t *thiszone;
6813 
6814         if ((thiszone = zone_find_by_id(zoneid)) == NULL)
6815                 return (set_errno(ENXIO));
6816 
6817         /* Verify that the datalink ID doesn't already belong to a zone. */
6818         mutex_enter(&zonehash_lock);
6819         for (zone = list_head(&zone_active); zone != NULL;
6820             zone = list_next(&zone_active, zone)) {
6821                 if (zone_dl_exists(zone, linkid)) {
6822                         mutex_exit(&zonehash_lock);
6823                         zone_rele(thiszone);
6824                         return (set_errno((zone == thiszone) ? EEXIST : EPERM));
6825                 }
6826         }
6827 
6828         zdl = kmem_zalloc(sizeof (*zdl), KM_SLEEP);
6829         zdl->zdl_id = linkid;
6830         zdl->zdl_net = NULL;
6831         mutex_enter(&thiszone->zone_lock);
6832         list_insert_head(&thiszone->zone_dl_list, zdl);
6833         mutex_exit(&thiszone->zone_lock);
6834         mutex_exit(&zonehash_lock);
6835         zone_rele(thiszone);
6836         return (0);
6837 }
6838 
6839 static int
6840 zone_remove_datalink(zoneid_t zoneid, datalink_id_t linkid)
6841 {
6842         zone_dl_t *zdl;
6843         zone_t *zone;
6844         int err = 0;
6845 
6846         if ((zone = zone_find_by_id(zoneid)) == NULL)
6847                 return (set_errno(EINVAL));
6848 
6849         mutex_enter(&zone->zone_lock);
6850         if ((zdl = zone_find_dl(zone, linkid)) == NULL) {
6851                 err = ENXIO;
6852         } else {
6853                 list_remove(&zone->zone_dl_list, zdl);
6854                 if (zdl->zdl_net != NULL)
6855                         nvlist_free(zdl->zdl_net);
6856                 kmem_free(zdl, sizeof (zone_dl_t));
6857         }
6858         mutex_exit(&zone->zone_lock);
6859         zone_rele(zone);
6860         return (err == 0 ? 0 : set_errno(err));
6861 }
6862 
6863 /*
6864  * Using the zoneidp as ALL_ZONES, we can lookup which zone has been assigned
6865  * the linkid.  Otherwise we just check if the specified zoneidp has been
6866  * assigned the supplied linkid.
6867  */
6868 int
6869 zone_check_datalink(zoneid_t *zoneidp, datalink_id_t linkid)
6870 {
6871         zone_t *zone;
6872         int err = ENXIO;
6873 
6874         if (*zoneidp != ALL_ZONES) {
6875                 if ((zone = zone_find_by_id(*zoneidp)) != NULL) {
6876                         if (zone_dl_exists(zone, linkid))
6877                                 err = 0;
6878                         zone_rele(zone);
6879                 }
6880                 return (err);
6881         }
6882 
6883         mutex_enter(&zonehash_lock);
6884         for (zone = list_head(&zone_active); zone != NULL;
6885             zone = list_next(&zone_active, zone)) {
6886                 if (zone_dl_exists(zone, linkid)) {
6887                         *zoneidp = zone->zone_id;
6888                         err = 0;
6889                         break;
6890                 }
6891         }
6892         mutex_exit(&zonehash_lock);
6893         return (err);
6894 }
6895 
6896 /*
6897  * Get the list of datalink IDs assigned to a zone.
6898  *
6899  * On input, *nump is the number of datalink IDs that can fit in the supplied
6900  * idarray.  Upon return, *nump is either set to the number of datalink IDs
6901  * that were placed in the array if the array was large enough, or to the
6902  * number of datalink IDs that the function needs to place in the array if the
6903  * array is too small.
6904  */
6905 static int
6906 zone_list_datalink(zoneid_t zoneid, int *nump, datalink_id_t *idarray)
6907 {
6908         uint_t num, dlcount;
6909         zone_t *zone;
6910         zone_dl_t *zdl;
6911         datalink_id_t *idptr = idarray;
6912 
6913         if (copyin(nump, &dlcount, sizeof (dlcount)) != 0)
6914                 return (set_errno(EFAULT));
6915         if ((zone = zone_find_by_id(zoneid)) == NULL)
6916                 return (set_errno(ENXIO));
6917 
6918         num = 0;
6919         mutex_enter(&zone->zone_lock);
6920         for (zdl = list_head(&zone->zone_dl_list); zdl != NULL;
6921             zdl = list_next(&zone->zone_dl_list, zdl)) {
6922                 /*
6923                  * If the list is bigger than what the caller supplied, just
6924                  * count, don't do copyout.
6925                  */
6926                 if (++num > dlcount)
6927                         continue;
6928                 if (copyout(&zdl->zdl_id, idptr, sizeof (*idptr)) != 0) {
6929                         mutex_exit(&zone->zone_lock);
6930                         zone_rele(zone);
6931                         return (set_errno(EFAULT));
6932                 }
6933                 idptr++;
6934         }
6935         mutex_exit(&zone->zone_lock);
6936         zone_rele(zone);
6937 
6938         /* Increased or decreased, caller should be notified. */
6939         if (num != dlcount) {
6940                 if (copyout(&num, nump, sizeof (num)) != 0)
6941                         return (set_errno(EFAULT));
6942         }
6943         return (0);
6944 }
6945 
6946 /*
6947  * Public interface for looking up a zone by zoneid. It's a customized version
6948  * for netstack_zone_create(). It can only be called from the zsd create
6949  * callbacks, since it doesn't have reference on the zone structure hence if
6950  * it is called elsewhere the zone could disappear after the zonehash_lock
6951  * is dropped.
6952  *
6953  * Furthermore it
6954  * 1. Doesn't check the status of the zone.
6955  * 2. It will be called even before zone_init is called, in that case the
6956  *    address of zone0 is returned directly, and netstack_zone_create()
6957  *    will only assign a value to zone0.zone_netstack, won't break anything.
6958  * 3. Returns without the zone being held.
6959  */
6960 zone_t *
6961 zone_find_by_id_nolock(zoneid_t zoneid)
6962 {
6963         zone_t *zone;
6964 
6965         mutex_enter(&zonehash_lock);
6966         if (zonehashbyid == NULL)
6967                 zone = &zone0;
6968         else
6969                 zone = zone_find_all_by_id(zoneid);
6970         mutex_exit(&zonehash_lock);
6971         return (zone);
6972 }
6973 
6974 /*
6975  * Walk the datalinks for a given zone
6976  */
6977 int
6978 zone_datalink_walk(zoneid_t zoneid, int (*cb)(datalink_id_t, void *),
6979     void *data)
6980 {
6981         zone_t          *zone;
6982         zone_dl_t       *zdl;
6983         datalink_id_t   *idarray;
6984         uint_t          idcount = 0;
6985         int             i, ret = 0;
6986 
6987         if ((zone = zone_find_by_id(zoneid)) == NULL)
6988                 return (ENOENT);
6989 
6990         /*
6991          * We first build an array of linkid's so that we can walk these and
6992          * execute the callback with the zone_lock dropped.
6993          */
6994         mutex_enter(&zone->zone_lock);
6995         for (zdl = list_head(&zone->zone_dl_list); zdl != NULL;
6996             zdl = list_next(&zone->zone_dl_list, zdl)) {
6997                 idcount++;
6998         }
6999 
7000         if (idcount == 0) {
7001                 mutex_exit(&zone->zone_lock);
7002                 zone_rele(zone);
7003                 return (0);
7004         }
7005 
7006         idarray = kmem_alloc(sizeof (datalink_id_t) * idcount, KM_NOSLEEP);
7007         if (idarray == NULL) {
7008                 mutex_exit(&zone->zone_lock);
7009                 zone_rele(zone);
7010                 return (ENOMEM);
7011         }
7012 
7013         for (i = 0, zdl = list_head(&zone->zone_dl_list); zdl != NULL;
7014             i++, zdl = list_next(&zone->zone_dl_list, zdl)) {
7015                 idarray[i] = zdl->zdl_id;
7016         }
7017 
7018         mutex_exit(&zone->zone_lock);
7019 
7020         for (i = 0; i < idcount && ret == 0; i++) {
7021                 if ((ret = (*cb)(idarray[i], data)) != 0)
7022                         break;
7023         }
7024 
7025         zone_rele(zone);
7026         kmem_free(idarray, sizeof (datalink_id_t) * idcount);
7027         return (ret);
7028 }
7029 
7030 static char *
7031 zone_net_type2name(int type)
7032 {
7033         switch (type) {
7034         case ZONE_NETWORK_ADDRESS:
7035                 return (ZONE_NET_ADDRNAME);
7036         case ZONE_NETWORK_DEFROUTER:
7037                 return (ZONE_NET_RTRNAME);
7038         default:
7039                 return (NULL);
7040         }
7041 }
7042 
7043 static int
7044 zone_set_network(zoneid_t zoneid, zone_net_data_t *znbuf)
7045 {
7046         zone_t *zone;
7047         zone_dl_t *zdl;
7048         nvlist_t *nvl;
7049         int err = 0;
7050         uint8_t *new = NULL;
7051         char *nvname;
7052         int bufsize;
7053         datalink_id_t linkid = znbuf->zn_linkid;
7054 
7055         if (secpolicy_zone_config(CRED()) != 0)
7056                 return (set_errno(EPERM));
7057 
7058         if (zoneid == GLOBAL_ZONEID)
7059                 return (set_errno(EINVAL));
7060 
7061         nvname = zone_net_type2name(znbuf->zn_type);
7062         bufsize = znbuf->zn_len;
7063         new = znbuf->zn_val;
7064         if (nvname == NULL)
7065                 return (set_errno(EINVAL));
7066 
7067         if ((zone = zone_find_by_id(zoneid)) == NULL) {
7068                 return (set_errno(EINVAL));
7069         }
7070 
7071         mutex_enter(&zone->zone_lock);
7072         if ((zdl = zone_find_dl(zone, linkid)) == NULL) {
7073                 err = ENXIO;
7074                 goto done;
7075         }
7076         if ((nvl = zdl->zdl_net) == NULL) {
7077                 if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP)) {
7078                         err = ENOMEM;
7079                         goto done;
7080                 } else {
7081                         zdl->zdl_net = nvl;
7082                 }
7083         }
7084         if (nvlist_exists(nvl, nvname)) {
7085                 err = EINVAL;
7086                 goto done;
7087         }
7088         err = nvlist_add_uint8_array(nvl, nvname, new, bufsize);
7089         ASSERT(err == 0);
7090 done:
7091         mutex_exit(&zone->zone_lock);
7092         zone_rele(zone);
7093         if (err != 0)
7094                 return (set_errno(err));
7095         else
7096                 return (0);
7097 }
7098 
7099 static int
7100 zone_get_network(zoneid_t zoneid, zone_net_data_t *znbuf)
7101 {
7102         zone_t *zone;
7103         zone_dl_t *zdl;
7104         nvlist_t *nvl;
7105         uint8_t *ptr;
7106         uint_t psize;
7107         int err = 0;
7108         char *nvname;
7109         int bufsize;
7110         void *buf;
7111         datalink_id_t linkid = znbuf->zn_linkid;
7112 
7113         if (zoneid == GLOBAL_ZONEID)
7114                 return (set_errno(EINVAL));
7115 
7116         nvname = zone_net_type2name(znbuf->zn_type);
7117         bufsize = znbuf->zn_len;
7118         buf = znbuf->zn_val;
7119 
7120         if (nvname == NULL)
7121                 return (set_errno(EINVAL));
7122         if ((zone = zone_find_by_id(zoneid)) == NULL)
7123                 return (set_errno(EINVAL));
7124 
7125         mutex_enter(&zone->zone_lock);
7126         if ((zdl = zone_find_dl(zone, linkid)) == NULL) {
7127                 err = ENXIO;
7128                 goto done;
7129         }
7130         if ((nvl = zdl->zdl_net) == NULL || !nvlist_exists(nvl, nvname)) {
7131                 err = ENOENT;
7132                 goto done;
7133         }
7134         err = nvlist_lookup_uint8_array(nvl, nvname, &ptr, &psize);
7135         ASSERT(err == 0);
7136 
7137         if (psize > bufsize) {
7138                 err = ENOBUFS;
7139                 goto done;
7140         }
7141         znbuf->zn_len = psize;
7142         bcopy(ptr, buf, psize);
7143 done:
7144         mutex_exit(&zone->zone_lock);
7145         zone_rele(zone);
7146         if (err != 0)
7147                 return (set_errno(err));
7148         else
7149                 return (0);
7150 }