xref: /illumos-gate/usr/src/cmd/zoneadmd/zcons.c (revision b31b5de1357c915fe7dab4d9646d9d84f9fe69bc)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * Console support for zones requires a significant infrastructure.  The
29  * core pieces are contained in this file, but other portions of note
30  * are in the zlogin(1M) command, the zcons(7D) driver, and in the
31  * devfsadm(1M) misc_link generator.
32  *
33  * Care is taken to make the console behave in an "intuitive" fashion for
34  * administrators.  Essentially, we try as much as possible to mimic the
35  * experience of using a system via a tip line and system controller.
36  *
37  * The zone console architecture looks like this:
38  *
39  *                                      Global Zone | Non-Global Zone
40  *                        .--------------.          |
41  *        .-----------.   | zoneadmd -z  |          | .--------. .---------.
42  *        | zlogin -C |   |     myzone   |          | | ttymon | | syslogd |
43  *        `-----------'   `--------------'          | `--------' `---------'
44  *                  |       |       | |             |      |       |
45  *  User            |       |       | |             |      V       V
46  * - - - - - - - - -|- - - -|- - - -|-|- - - - - - -|- - /dev/zconsole - - -
47  *  Kernel          V       V       | |                        |
48  *               [AF_UNIX Socket]   | `--------. .-------------'
49  *                                  |          | |
50  *                                  |          V V
51  *                                  |     +-----------+
52  *                                  |     |  ldterm,  |
53  *                                  |     |   etc.    |
54  *                                  |     +-----------+
55  *                                  |     +-[Anchor]--+
56  *                                  |     |   ptem    |
57  *                                  V     +-----------+
58  *                           +---master---+---slave---+
59  *                           |                        |
60  *                           |      zcons driver      |
61  *                           |    zonename="myzone"   |
62  *                           +------------------------+
63  *
64  * There are basically two major tasks which the console subsystem in
65  * zoneadmd accomplishes:
66  *
67  * - Setup and teardown of zcons driver instances.  One zcons instance
68  *   is maintained per zone; we take advantage of the libdevice APIs
69  *   to online new instances of zcons as needed.  Care is taken to
70  *   prune and manage these appropriately; see init_console_dev() and
71  *   destroy_console_dev().  The end result is the creation of the
72  *   zcons(7D) instance and an open file descriptor to the master side.
73  *   zcons instances are associated with zones via their zonename device
74  *   property.  This the console instance to persist across reboots,
75  *   and while the zone is halted.
76  *
77  * - Acting as a server for 'zlogin -C' instances.  When zlogin -C is
78  *   run, zlogin connects to zoneadmd via unix domain socket.  zoneadmd
79  *   functions as a two-way proxy for console I/O, relaying user input
80  *   to the master side of the console, and relaying output from the
81  *   zone to the user.
82  */
83 
84 #include <sys/types.h>
85 #include <sys/socket.h>
86 #include <sys/stat.h>
87 #include <sys/termios.h>
88 #include <sys/zcons.h>
89 #include <sys/mkdev.h>
90 
91 #include <assert.h>
92 #include <ctype.h>
93 #include <errno.h>
94 #include <fcntl.h>
95 #include <stdarg.h>
96 #include <stdio.h>
97 #include <stdlib.h>
98 #include <strings.h>
99 #include <stropts.h>
100 #include <thread.h>
101 #include <ucred.h>
102 #include <unistd.h>
103 #include <zone.h>
104 
105 #include <libdevinfo.h>
106 #include <libdevice.h>
107 #include <libzonecfg.h>
108 
109 #include <syslog.h>
110 #include <sys/modctl.h>
111 #include <sys/fs/sdev_node.h>
112 
113 #include "zoneadmd.h"
114 
115 #define	ZCONSNEX_DEVTREEPATH	"/pseudo/zconsnex@1"
116 #define	ZCONSNEX_FILEPATH	"/devices/pseudo/zconsnex@1"
117 
118 #define	CONSOLE_SOCKPATH	ZONES_TMPDIR "/%s.console_sock"
119 
120 static int	serverfd = -1;	/* console server unix domain socket fd */
121 char boot_args[BOOTARGS_MAX];
122 char bad_boot_arg[BOOTARGS_MAX];
123 
124 /*
125  * The eventstream is a simple one-directional flow of messages from the
126  * door server to the console subsystem, implemented with a pipe.
127  * It is used to wake up the console poller when it needs to take action,
128  * message the user, die off, etc.
129  */
130 static int eventstream[2];
131 
132 
133 
134 int
135 eventstream_init()
136 {
137 	if (pipe(eventstream) == -1)
138 		return (-1);
139 	return (0);
140 }
141 
142 void
143 eventstream_write(zone_evt_t evt)
144 {
145 	(void) write(eventstream[0], &evt, sizeof (evt));
146 }
147 
148 static zone_evt_t
149 eventstream_read(void)
150 {
151 	zone_evt_t evt = Z_EVT_NULL;
152 
153 	(void) read(eventstream[1], &evt, sizeof (evt));
154 	return (evt);
155 }
156 
157 /*
158  * count_console_devs() and its helper count_cb() do a walk of the
159  * subtree of the device tree where zone console nodes are represented.
160  * The goal is to count zone console instances already setup for a zone
161  * with the given name.  More than 1 is anomolous, and our caller will
162  * have to deal with that if we find that's the case.
163  *
164  * Note: this algorithm is a linear search of nodes in the zconsnex subtree
165  * of the device tree, and could be a scalability problem, but I don't see
166  * how to avoid it.
167  */
168 
169 /*
170  * cb_data is shared by count_cb and destroy_cb for simplicity.
171  */
172 struct cb_data {
173 	zlog_t *zlogp;
174 	int found;
175 	int killed;
176 };
177 
178 static int
179 count_cb(di_node_t node, void *arg)
180 {
181 	struct cb_data *cb = (struct cb_data *)arg;
182 	char *prop_data;
183 
184 	if (di_prop_lookup_strings(DDI_DEV_T_ANY, node, "zonename",
185 	    &prop_data) != -1) {
186 		assert(prop_data != NULL);
187 		if (strcmp(prop_data, zone_name) == 0) {
188 			cb->found++;
189 			return (DI_WALK_CONTINUE);
190 		}
191 	}
192 	return (DI_WALK_CONTINUE);
193 }
194 
195 static int
196 count_console_devs(zlog_t *zlogp)
197 {
198 	di_node_t root;
199 	struct cb_data cb;
200 
201 	bzero(&cb, sizeof (cb));
202 	cb.zlogp = zlogp;
203 
204 	if ((root = di_init(ZCONSNEX_DEVTREEPATH, DINFOCPYALL)) ==
205 	    DI_NODE_NIL) {
206 		zerror(zlogp, B_TRUE, "%s failed", "di_init");
207 		return (-1);
208 	}
209 
210 	(void) di_walk_node(root, DI_WALK_CLDFIRST, (void *)&cb, count_cb);
211 	di_fini(root);
212 	return (cb.found);
213 }
214 
215 /*
216  * destroy_console_devs() and its helper destroy_cb() tears down any console
217  * instances associated with this zone.  If things went very wrong, we
218  * might have more than one console instance hanging around.  This routine
219  * hunts down and tries to remove all of them.  Of course, if the console
220  * is open, the instance will not detach, which is a potential issue.
221  */
222 static int
223 destroy_cb(di_node_t node, void *arg)
224 {
225 	struct cb_data *cb = (struct cb_data *)arg;
226 	char *prop_data;
227 	char *tmp;
228 	char devpath[MAXPATHLEN];
229 	devctl_hdl_t hdl;
230 
231 	if (di_prop_lookup_strings(DDI_DEV_T_ANY, node, "zonename",
232 	    &prop_data) == -1)
233 		return (DI_WALK_CONTINUE);
234 
235 	assert(prop_data != NULL);
236 	if (strcmp(prop_data, zone_name) != 0) {
237 		/* this is the console for a different zone */
238 		return (DI_WALK_CONTINUE);
239 	}
240 
241 	cb->found++;
242 	tmp = di_devfs_path(node);
243 	(void) snprintf(devpath, sizeof (devpath), "/devices/%s", tmp);
244 	di_devfs_path_free(tmp);
245 
246 	if ((hdl = devctl_device_acquire(devpath, 0)) == NULL) {
247 		zerror(cb->zlogp, B_TRUE, "WARNING: console %s found, "
248 		    "but it could not be controlled.", devpath);
249 		return (DI_WALK_CONTINUE);
250 	}
251 	if (devctl_device_remove(hdl) == 0) {
252 		cb->killed++;
253 	} else {
254 		zerror(cb->zlogp, B_TRUE, "WARNING: console %s found, "
255 		    "but it could not be removed.", devpath);
256 	}
257 	devctl_release(hdl);
258 	return (DI_WALK_CONTINUE);
259 }
260 
261 static int
262 destroy_console_devs(zlog_t *zlogp)
263 {
264 	char conspath[MAXPATHLEN];
265 	di_node_t root;
266 	struct cb_data cb;
267 	int masterfd;
268 	int slavefd;
269 
270 	/*
271 	 * Signal the master side to release its handle on the slave side by
272 	 * issuing a ZC_RELEASESLAVE ioctl.
273 	 */
274 	(void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
275 	    zone_name, ZCONS_MASTER_NAME);
276 	if ((masterfd = open(conspath, O_RDWR | O_NOCTTY)) != -1) {
277 		(void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
278 		    zone_name, ZCONS_SLAVE_NAME);
279 		if ((slavefd = open(conspath, O_RDWR | O_NOCTTY)) != -1) {
280 			if (ioctl(masterfd, ZC_RELEASESLAVE,
281 			    (caddr_t)(intptr_t)slavefd) != 0)
282 				zerror(zlogp, B_TRUE, "WARNING: error while "
283 				    "releasing slave handle of zone console for"
284 				    " %s", zone_name);
285 			(void) close(slavefd);
286 		} else {
287 			zerror(zlogp, B_TRUE, "WARNING: could not open slave "
288 			    "side of zone console for %s to release slave "
289 			    "handle", zone_name);
290 		}
291 		(void) close(masterfd);
292 	} else {
293 		zerror(zlogp, B_TRUE, "WARNING: could not open master side of "
294 		    "zone console for %s to release slave handle", zone_name);
295 	}
296 
297 	bzero(&cb, sizeof (cb));
298 	cb.zlogp = zlogp;
299 
300 	if ((root = di_init(ZCONSNEX_DEVTREEPATH, DINFOCPYALL)) ==
301 	    DI_NODE_NIL) {
302 		zerror(zlogp, B_TRUE, "%s failed", "di_init");
303 		return (-1);
304 	}
305 
306 	(void) di_walk_node(root, DI_WALK_CLDFIRST, (void *)&cb, destroy_cb);
307 	if (cb.found > 1) {
308 		zerror(zlogp, B_FALSE, "WARNING: multiple zone console "
309 		    "instances detected for zone '%s'; %d of %d "
310 		    "successfully removed.",
311 		    zone_name, cb.killed, cb.found);
312 	}
313 
314 	di_fini(root);
315 	return (0);
316 }
317 
318 /*
319  * init_console_dev() drives the device-tree configuration of the zone
320  * console device.  The general strategy is to use the libdevice (devctl)
321  * interfaces to instantiate a new zone console node.  We do a lot of
322  * sanity checking, and are careful to reuse a console if one exists.
323  *
324  * Once the device is in the device tree, we kick devfsadm via di_init_devs()
325  * to ensure that the appropriate symlinks (to the master and slave console
326  * devices) are placed in /dev in the global zone.
327  */
328 static int
329 init_console_dev(zlog_t *zlogp)
330 {
331 	char conspath[MAXPATHLEN];
332 	devctl_hdl_t bus_hdl = NULL;
333 	devctl_hdl_t dev_hdl = NULL;
334 	devctl_ddef_t ddef_hdl = NULL;
335 	di_devlink_handle_t dl = NULL;
336 	int rv = -1;
337 	int ndevs;
338 	int masterfd;
339 	int slavefd;
340 
341 	/*
342 	 * Don't re-setup console if it is working and ready already; just
343 	 * skip ahead to making devlinks, which we do for sanity's sake.
344 	 */
345 	ndevs = count_console_devs(zlogp);
346 	if (ndevs == 1) {
347 		goto devlinks;
348 	} else if (ndevs > 1 || ndevs == -1) {
349 		/*
350 		 * For now, this seems like a reasonable but harsh punishment.
351 		 * If needed, we could try to get clever and delete all but
352 		 * the console which is pointed at by the current symlink.
353 		 */
354 		if (destroy_console_devs(zlogp) == -1) {
355 			goto error;
356 		}
357 	}
358 
359 	/*
360 	 * Time to make the consoles!
361 	 */
362 	if ((bus_hdl = devctl_bus_acquire(ZCONSNEX_FILEPATH, 0)) == NULL) {
363 		zerror(zlogp, B_TRUE, "%s failed", "devctl_bus_acquire");
364 		goto error;
365 	}
366 	if ((ddef_hdl = devctl_ddef_alloc("zcons", 0)) == NULL) {
367 		zerror(zlogp, B_TRUE, "failed to allocate ddef handle");
368 		goto error;
369 	}
370 	/*
371 	 * Set three properties on this node; the first is the name of the
372 	 * zone; the second is a flag which lets pseudo know that it is
373 	 * OK to automatically allocate an instance # for this device;
374 	 * the third tells the device framework not to auto-detach this
375 	 * node-- we need the node to still be there when we ask devfsadmd
376 	 * to make links, and when we need to open it.
377 	 */
378 	if (devctl_ddef_string(ddef_hdl, "zonename", zone_name) == -1) {
379 		zerror(zlogp, B_TRUE, "failed to create zonename property");
380 		goto error;
381 	}
382 	if (devctl_ddef_int(ddef_hdl, "auto-assign-instance", 1) == -1) {
383 		zerror(zlogp, B_TRUE, "failed to create auto-assign-instance "
384 		    "property");
385 		goto error;
386 	}
387 	if (devctl_ddef_int(ddef_hdl, "ddi-no-autodetach", 1) == -1) {
388 		zerror(zlogp, B_TRUE, "failed to create ddi-no-auto-detach "
389 		    "property");
390 		goto error;
391 	}
392 	if (devctl_bus_dev_create(bus_hdl, ddef_hdl, 0, &dev_hdl) == -1) {
393 		zerror(zlogp, B_TRUE, "failed to create console node");
394 		goto error;
395 	}
396 
397 devlinks:
398 	if ((dl = di_devlink_init("zcons", DI_MAKE_LINK)) != NULL) {
399 		(void) di_devlink_fini(&dl);
400 	} else {
401 		zerror(zlogp, B_TRUE, "failed to create devlinks");
402 		goto error;
403 	}
404 
405 	/*
406 	 * Open the master side of the console and issue the ZC_HOLDSLAVE ioctl,
407 	 * which will cause the master to retain a reference to the slave.
408 	 * This prevents ttymon from blowing through the slave's STREAMS anchor.
409 	 */
410 	(void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
411 	    zone_name, ZCONS_MASTER_NAME);
412 	if ((masterfd = open(conspath, O_RDWR | O_NOCTTY)) == -1) {
413 		zerror(zlogp, B_TRUE, "ERROR: could not open master side of "
414 		    "zone console for %s to acquire slave handle", zone_name);
415 		goto error;
416 	}
417 	(void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
418 	    zone_name, ZCONS_SLAVE_NAME);
419 	if ((slavefd = open(conspath, O_RDWR | O_NOCTTY)) == -1) {
420 		zerror(zlogp, B_TRUE, "ERROR: could not open slave side of zone"
421 		    " console for %s to acquire slave handle", zone_name);
422 		(void) close(masterfd);
423 		goto error;
424 	}
425 	if (ioctl(masterfd, ZC_HOLDSLAVE, (caddr_t)(intptr_t)slavefd) == 0)
426 		rv = 0;
427 	else
428 		zerror(zlogp, B_TRUE, "ERROR: error while acquiring slave "
429 		    "handle of zone console for %s", zone_name);
430 	(void) close(slavefd);
431 	(void) close(masterfd);
432 
433 error:
434 	if (ddef_hdl)
435 		devctl_ddef_free(ddef_hdl);
436 	if (bus_hdl)
437 		devctl_release(bus_hdl);
438 	if (dev_hdl)
439 		devctl_release(dev_hdl);
440 	return (rv);
441 }
442 
443 static int
444 init_console_sock(zlog_t *zlogp)
445 {
446 	int servfd;
447 	struct sockaddr_un servaddr;
448 
449 	bzero(&servaddr, sizeof (servaddr));
450 	servaddr.sun_family = AF_UNIX;
451 	(void) snprintf(servaddr.sun_path, sizeof (servaddr.sun_path),
452 	    CONSOLE_SOCKPATH, zone_name);
453 
454 	if ((servfd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
455 		zerror(zlogp, B_TRUE, "console setup: could not create socket");
456 		return (-1);
457 	}
458 	(void) unlink(servaddr.sun_path);
459 
460 	if (bind(servfd, (struct sockaddr *)&servaddr,
461 	    sizeof (servaddr)) == -1) {
462 		zerror(zlogp, B_TRUE,
463 		    "console setup: could not bind to socket");
464 		goto out;
465 	}
466 
467 	if (listen(servfd, 4) == -1) {
468 		zerror(zlogp, B_TRUE,
469 		    "console setup: could not listen on socket");
470 		goto out;
471 	}
472 	return (servfd);
473 
474 out:
475 	(void) unlink(servaddr.sun_path);
476 	(void) close(servfd);
477 	return (-1);
478 }
479 
480 static void
481 destroy_console_sock(int servfd)
482 {
483 	char path[MAXPATHLEN];
484 
485 	(void) snprintf(path, sizeof (path), CONSOLE_SOCKPATH, zone_name);
486 	(void) unlink(path);
487 	(void) shutdown(servfd, SHUT_RDWR);
488 	(void) close(servfd);
489 }
490 
491 /*
492  * Read the "ident" string from the client's descriptor; this routine also
493  * tolerates being called with pid=NULL, for times when you want to "eat"
494  * the ident string from a client without saving it.
495  */
496 static int
497 get_client_ident(int clifd, pid_t *pid, char *locale, size_t locale_len)
498 {
499 	char buf[BUFSIZ], *bufp;
500 	size_t buflen = sizeof (buf);
501 	char c = '\0';
502 	int i = 0, r;
503 
504 	/* "eat up the ident string" case, for simplicity */
505 	if (pid == NULL) {
506 		assert(locale == NULL && locale_len == 0);
507 		while (read(clifd, &c, 1) == 1) {
508 			if (c == '\n')
509 				return (0);
510 		}
511 	}
512 
513 	bzero(buf, sizeof (buf));
514 	while ((buflen > 1) && (r = read(clifd, &c, 1)) == 1) {
515 		buflen--;
516 		if (c == '\n')
517 			break;
518 
519 		buf[i] = c;
520 		i++;
521 	}
522 	if (r == -1)
523 		return (-1);
524 
525 	/*
526 	 * We've filled the buffer, but still haven't seen \n.  Keep eating
527 	 * until we find it; we don't expect this to happen, but this is
528 	 * defensive.
529 	 */
530 	if (c != '\n') {
531 		while ((r = read(clifd, &c, sizeof (c))) > 0)
532 			if (c == '\n')
533 				break;
534 	}
535 
536 	/*
537 	 * Parse buffer for message of the form: IDENT <pid> <locale>
538 	 */
539 	bufp = buf;
540 	if (strncmp(bufp, "IDENT ", 6) != 0)
541 		return (-1);
542 	bufp += 6;
543 	errno = 0;
544 	*pid = strtoll(bufp, &bufp, 10);
545 	if (errno != 0)
546 		return (-1);
547 
548 	while (*bufp != '\0' && isspace(*bufp))
549 		bufp++;
550 	(void) strlcpy(locale, bufp, locale_len);
551 
552 	return (0);
553 }
554 
555 static int
556 accept_client(int servfd, pid_t *pid, char *locale, size_t locale_len)
557 {
558 	int connfd;
559 	struct sockaddr_un cliaddr;
560 	socklen_t clilen;
561 
562 	clilen = sizeof (cliaddr);
563 	connfd = accept(servfd, (struct sockaddr *)&cliaddr, &clilen);
564 	if (connfd == -1)
565 		return (-1);
566 	if (get_client_ident(connfd, pid, locale, locale_len) == -1) {
567 		(void) shutdown(connfd, SHUT_RDWR);
568 		(void) close(connfd);
569 		return (-1);
570 	}
571 	(void) write(connfd, "OK\n", 3);
572 	return (connfd);
573 }
574 
575 static void
576 reject_client(int servfd, pid_t clientpid)
577 {
578 	int connfd;
579 	struct sockaddr_un cliaddr;
580 	socklen_t clilen;
581 	char nak[MAXPATHLEN];
582 
583 	clilen = sizeof (cliaddr);
584 	connfd = accept(servfd, (struct sockaddr *)&cliaddr, &clilen);
585 
586 	/*
587 	 * After hear its ident string, tell client to get lost.
588 	 */
589 	if (get_client_ident(connfd, NULL, NULL, 0) == 0) {
590 		(void) snprintf(nak, sizeof (nak), "%lu\n",
591 		    clientpid);
592 		(void) write(connfd, nak, strlen(nak));
593 	}
594 	(void) shutdown(connfd, SHUT_RDWR);
595 	(void) close(connfd);
596 }
597 
598 static void
599 event_message(int clifd, char *clilocale, zone_evt_t evt)
600 {
601 	char *str, *lstr = NULL;
602 	char lmsg[BUFSIZ];
603 	char outbuf[BUFSIZ];
604 
605 	if (clifd == -1)
606 		return;
607 
608 	switch (evt) {
609 	case Z_EVT_ZONE_BOOTING:
610 		if (*boot_args == '\0') {
611 			str = "NOTICE: Zone booting up";
612 			break;
613 		}
614 		/*LINTED*/
615 		(void) snprintf(lmsg, sizeof (lmsg), localize_msg(clilocale,
616 		    "NOTICE: Zone booting up with arguments: %s"), boot_args);
617 		lstr = lmsg;
618 		break;
619 	case Z_EVT_ZONE_READIED:
620 		str = "NOTICE: Zone readied";
621 		break;
622 	case Z_EVT_ZONE_HALTED:
623 		str = "NOTICE: Zone halted";
624 		break;
625 	case Z_EVT_ZONE_REBOOTING:
626 		if (*boot_args == '\0') {
627 			str = "NOTICE: Zone rebooting";
628 			break;
629 		}
630 		/*LINTED*/
631 		(void) snprintf(lmsg, sizeof (lmsg), localize_msg(clilocale,
632 		    "NOTICE: Zone rebooting with arguments: %s"), boot_args);
633 		lstr = lmsg;
634 		break;
635 	case Z_EVT_ZONE_UNINSTALLING:
636 		str = "NOTICE: Zone is being uninstalled.  Disconnecting...";
637 		break;
638 	case Z_EVT_ZONE_BOOTFAILED:
639 		str = "NOTICE: Zone boot failed";
640 		break;
641 	case Z_EVT_ZONE_BADARGS:
642 		/*LINTED*/
643 		(void) snprintf(lmsg, sizeof (lmsg),
644 		    localize_msg(clilocale,
645 		    "WARNING: Ignoring invalid boot arguments: %s"),
646 		    bad_boot_arg);
647 		lstr = lmsg;
648 		break;
649 	default:
650 		return;
651 	}
652 
653 	if (lstr == NULL)
654 		lstr = localize_msg(clilocale, str);
655 	(void) snprintf(outbuf, sizeof (outbuf), "\r\n[%s]\r\n", lstr);
656 	(void) write(clifd, outbuf, strlen(outbuf));
657 }
658 
659 /*
660  * Check to see if the client at the other end of the socket is still
661  * alive; we know it is not if it throws EPIPE at us when we try to write
662  * an otherwise harmless 0-length message to it.
663  */
664 static int
665 test_client(int clifd)
666 {
667 	if ((write(clifd, "", 0) == -1) && errno == EPIPE)
668 		return (-1);
669 	return (0);
670 }
671 
672 /*
673  * This routine drives the console I/O loop.  It polls for input from the
674  * master side of the console (output to the console), and from the client
675  * (input from the console user).  Additionally, it polls on the server fd,
676  * and disconnects any clients that might try to hook up with the zone while
677  * the console is in use.
678  *
679  * When the client first calls us up, it is expected to send a line giving
680  * its "identity"; this consists of the string 'IDENT <pid> <locale>'.
681  * This is so that we can report that the console is busy along with
682  * some diagnostics about who has it busy; the locale is used so that
683  * asynchronous messages about zone state (like the NOTICE: zone halted
684  * messages) can be output in the user's locale.
685  */
686 static void
687 do_console_io(zlog_t *zlogp, int consfd, int servfd)
688 {
689 	struct pollfd pollfds[4];
690 	char ibuf[BUFSIZ];
691 	int cc, ret;
692 	int clifd = -1;
693 	int pollerr = 0;
694 	char clilocale[MAXPATHLEN];
695 	pid_t clipid = 0;
696 
697 	/* console side, watch for read events */
698 	pollfds[0].fd = consfd;
699 	pollfds[0].events = POLLIN | POLLRDNORM | POLLRDBAND |
700 	    POLLPRI | POLLERR | POLLHUP | POLLNVAL;
701 
702 	/* client side, watch for read events */
703 	pollfds[1].fd = clifd;
704 	pollfds[1].events = pollfds[0].events;
705 
706 	/* the server socket; watch for events (new connections) */
707 	pollfds[2].fd = servfd;
708 	pollfds[2].events = pollfds[0].events;
709 
710 	/* the eventstram; watch for events (e.g.: zone halted) */
711 	pollfds[3].fd = eventstream[1];
712 	pollfds[3].events = pollfds[0].events;
713 
714 	for (;;) {
715 		pollfds[0].revents = pollfds[1].revents = 0;
716 		pollfds[2].revents = pollfds[3].revents = 0;
717 
718 		ret = poll(pollfds,
719 		    sizeof (pollfds) / sizeof (struct pollfd), -1);
720 		if (ret == -1 && errno != EINTR) {
721 			zerror(zlogp, B_TRUE, "poll failed");
722 			/* we are hosed, close connection */
723 			break;
724 		}
725 
726 		/* event from console side */
727 		if (pollfds[0].revents) {
728 			if (pollfds[0].revents &
729 			    (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
730 				errno = 0;
731 				cc = read(consfd, ibuf, BUFSIZ);
732 				if (cc <= 0 && (errno != EINTR) &&
733 				    (errno != EAGAIN))
734 					break;
735 				/*
736 				 * Lose I/O if no one is listening
737 				 */
738 				if (clifd != -1 && cc > 0)
739 					(void) write(clifd, ibuf, cc);
740 			} else {
741 				pollerr = pollfds[0].revents;
742 				zerror(zlogp, B_FALSE,
743 				    "closing connection with (console) "
744 				    "pollerr %d\n", pollerr);
745 				break;
746 			}
747 		}
748 
749 		/* event from client side */
750 		if (pollfds[1].revents) {
751 			if (pollfds[1].revents &
752 			    (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
753 				errno = 0;
754 				cc = read(clifd, ibuf, BUFSIZ);
755 				if (cc <= 0 && (errno != EINTR) &&
756 				    (errno != EAGAIN))
757 					break;
758 				(void) write(consfd, ibuf, cc);
759 			} else {
760 				pollerr = pollfds[1].revents;
761 				zerror(zlogp, B_FALSE,
762 				    "closing connection with (client) "
763 				    "pollerr %d\n", pollerr);
764 				break;
765 			}
766 		}
767 
768 		/* event from server socket */
769 		if (pollfds[2].revents &&
770 		    (pollfds[2].revents & (POLLIN | POLLRDNORM))) {
771 			if (clifd != -1) {
772 				/*
773 				 * Test the client to see if it is really
774 				 * still alive.  If it has died but we
775 				 * haven't yet detected that, we might
776 				 * deny a legitimate connect attempt.  If it
777 				 * is dead, we break out; once we tear down
778 				 * the old connection, the new connection
779 				 * will happen.
780 				 */
781 				if (test_client(clifd) == -1) {
782 					break;
783 				}
784 				/* we're already handling a client */
785 				reject_client(servfd, clipid);
786 
787 
788 			} else if ((clifd = accept_client(servfd, &clipid,
789 			    clilocale, sizeof (clilocale))) != -1) {
790 				pollfds[1].fd = clifd;
791 
792 			} else {
793 				break;
794 			}
795 		}
796 
797 		/*
798 		 * Watch for events on the eventstream.  This is how we get
799 		 * notified of the zone halting, etc.  It provides us a
800 		 * "wakeup" from poll when important things happen, which
801 		 * is good.
802 		 */
803 		if (pollfds[3].revents) {
804 			int evt = eventstream_read();
805 			/*
806 			 * After we drain out the event, if we aren't servicing
807 			 * a console client, we hop back out to our caller,
808 			 * which will check to see if it is time to shutdown
809 			 * the daemon, or if we should take another console
810 			 * service lap.
811 			 */
812 			if (clifd == -1) {
813 				break;
814 			}
815 			event_message(clifd, clilocale, evt);
816 			/*
817 			 * Special handling for the message that the zone is
818 			 * uninstalling; we boot the client, then break out
819 			 * of this function.  When we return to the
820 			 * serve_console loop, we will see that the zone is
821 			 * in a state < READY, and so zoneadmd will shutdown.
822 			 */
823 			if (evt == Z_EVT_ZONE_UNINSTALLING) {
824 				break;
825 			}
826 		}
827 
828 	}
829 
830 	if (clifd != -1) {
831 		(void) shutdown(clifd, SHUT_RDWR);
832 		(void) close(clifd);
833 	}
834 }
835 
836 int
837 init_console(zlog_t *zlogp)
838 {
839 	if (init_console_dev(zlogp) == -1) {
840 		zerror(zlogp, B_FALSE,
841 		    "console setup: device initialization failed");
842 		return (-1);
843 	}
844 
845 	if ((serverfd = init_console_sock(zlogp)) == -1) {
846 		zerror(zlogp, B_FALSE,
847 		    "console setup: socket initialization failed");
848 		return (-1);
849 	}
850 	return (0);
851 }
852 
853 /*
854  * serve_console() is the master loop for driving console I/O.  It is also the
855  * routine which is ultimately responsible for "pulling the plug" on zoneadmd
856  * when it realizes that the daemon should shut down.
857  *
858  * The rules for shutdown are: there must be no console client, and the zone
859  * state must be < ready.  However, we need to give things a chance to actually
860  * get going when the daemon starts up-- otherwise the daemon would immediately
861  * exit on startup if the zone was in the installed state, so we first drop
862  * into the do_console_io() loop in order to give *something* a chance to
863  * happen.
864  */
865 void
866 serve_console(zlog_t *zlogp)
867 {
868 	int masterfd;
869 	zone_state_t zstate;
870 	char conspath[MAXPATHLEN];
871 
872 	(void) snprintf(conspath, sizeof (conspath),
873 	    "/dev/zcons/%s/%s", zone_name, ZCONS_MASTER_NAME);
874 
875 	for (;;) {
876 		masterfd = open(conspath, O_RDWR|O_NONBLOCK|O_NOCTTY);
877 		if (masterfd == -1) {
878 			zerror(zlogp, B_TRUE, "failed to open console master");
879 			(void) mutex_lock(&lock);
880 			goto death;
881 		}
882 
883 		/*
884 		 * Setting RPROTDIS on the stream means that the control
885 		 * portion of messages received (which we don't care about)
886 		 * will be discarded by the stream head.  If we allowed such
887 		 * messages, we wouldn't be able to use read(2), as it fails
888 		 * (EBADMSG) when a message with a control element is received.
889 		 */
890 		if (ioctl(masterfd, I_SRDOPT, RNORM|RPROTDIS) == -1) {
891 			zerror(zlogp, B_TRUE, "failed to set options on "
892 			    "console master");
893 			(void) mutex_lock(&lock);
894 			goto death;
895 		}
896 
897 		do_console_io(zlogp, masterfd, serverfd);
898 
899 		/*
900 		 * We would prefer not to do this, but hostile zone processes
901 		 * can cause the stream to become tainted, and reads will
902 		 * fail.  So, in case something has gone seriously ill,
903 		 * we dismantle the stream and reopen the console when we
904 		 * take another lap.
905 		 */
906 		(void) close(masterfd);
907 
908 		(void) mutex_lock(&lock);
909 		/*
910 		 * We need to set death_throes (see below) atomically with
911 		 * respect to noticing that (a) we have no console client and
912 		 * (b) the zone is not installed.  Otherwise we could get a
913 		 * request to boot during this time.  Once we set death_throes,
914 		 * any incoming door stuff will be turned away.
915 		 */
916 		if (zone_get_state(zone_name, &zstate) == Z_OK) {
917 			if (zstate < ZONE_STATE_READY)
918 				goto death;
919 		} else {
920 			zerror(zlogp, B_FALSE,
921 			    "unable to determine state of zone");
922 			goto death;
923 		}
924 		/*
925 		 * Even if zone_get_state() fails, stay conservative, and
926 		 * take another lap.
927 		 */
928 		(void) mutex_unlock(&lock);
929 	}
930 
931 death:
932 	assert(MUTEX_HELD(&lock));
933 	in_death_throes = B_TRUE;
934 	(void) mutex_unlock(&lock);
935 
936 	destroy_console_sock(serverfd);
937 	(void) destroy_console_devs(zlogp);
938 }
939