xref: /titanic_44/usr/src/uts/common/os/zone.c (revision 921e7e07108d1e3f09fecb1805fa2c79bb584fed)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * Zones
31  *
32  *   A zone is a named collection of processes, namespace constraints,
33  *   and other system resources which comprise a secure and manageable
34  *   application containment facility.
35  *
36  *   Zones (represented by the reference counted zone_t) are tracked in
37  *   the kernel in the zonehash.  Elsewhere in the kernel, Zone IDs
38  *   (zoneid_t) are used to track zone association.  Zone IDs are
39  *   dynamically generated when the zone is created; if a persistent
40  *   identifier is needed (core files, accounting logs, audit trail,
41  *   etc.), the zone name should be used.
42  *
43  *
44  *   Global Zone:
45  *
46  *   The global zone (zoneid 0) is automatically associated with all
47  *   system resources that have not been bound to a user-created zone.
48  *   This means that even systems where zones are not in active use
49  *   have a global zone, and all processes, mounts, etc. are
50  *   associated with that zone.  The global zone is generally
51  *   unconstrained in terms of privileges and access, though the usual
52  *   credential and privilege based restrictions apply.
53  *
54  *
55  *   Zone States:
56  *
57  *   The states in which a zone may be in and the transitions are as
58  *   follows:
59  *
60  *   ZONE_IS_UNINITIALIZED: primordial state for a zone. The partially
61  *   initialized zone is added to the list of active zones on the system but
62  *   isn't accessible.
63  *
64  *   ZONE_IS_READY: zsched (the kernel dummy process for a zone) is
65  *   ready.  The zone is made visible after the ZSD constructor callbacks are
66  *   executed.  A zone remains in this state until it transitions into
67  *   the ZONE_IS_BOOTING state as a result of a call to zone_boot().
68  *
69  *   ZONE_IS_BOOTING: in this shortlived-state, zsched attempts to start
70  *   init.  Should that fail, the zone proceeds to the ZONE_IS_SHUTTING_DOWN
71  *   state.
72  *
73  *   ZONE_IS_RUNNING: The zone is open for business: zsched has
74  *   successfully started init.   A zone remains in this state until
75  *   zone_shutdown() is called.
76  *
77  *   ZONE_IS_SHUTTING_DOWN: zone_shutdown() has been called, the system is
78  *   killing all processes running in the zone. The zone remains
79  *   in this state until there are no more user processes running in the zone.
80  *   zone_create(), zone_enter(), and zone_destroy() on this zone will fail.
81  *   Since zone_shutdown() is restartable, it may be called successfully
82  *   multiple times for the same zone_t.  Setting of the zone's state to
83  *   ZONE_IS_SHUTTING_DOWN is synchronized with mounts, so VOP_MOUNT() may check
84  *   the zone's status without worrying about it being a moving target.
85  *
86  *   ZONE_IS_EMPTY: zone_shutdown() has been called, and there
87  *   are no more user processes in the zone.  The zone remains in this
88  *   state until there are no more kernel threads associated with the
89  *   zone.  zone_create(), zone_enter(), and zone_destroy() on this zone will
90  *   fail.
91  *
92  *   ZONE_IS_DOWN: All kernel threads doing work on behalf of the zone
93  *   have exited.  zone_shutdown() returns.  Henceforth it is not possible to
94  *   join the zone or create kernel threads therein.
95  *
96  *   ZONE_IS_DYING: zone_destroy() has been called on the zone; zone
97  *   remains in this state until zsched exits.  Calls to zone_find_by_*()
98  *   return NULL from now on.
99  *
100  *   ZONE_IS_DEAD: zsched has exited (zone_ntasks == 0).  There are no
101  *   processes or threads doing work on behalf of the zone.  The zone is
102  *   removed from the list of active zones.  zone_destroy() returns, and
103  *   the zone can be recreated.
104  *
105  *   ZONE_IS_FREE (internal state): zone_ref goes to 0, ZSD destructor
106  *   callbacks are executed, and all memory associated with the zone is
107  *   freed.
108  *
109  *   Threads can wait for the zone to enter a requested state by using
110  *   zone_status_wait() or zone_status_timedwait() with the desired
111  *   state passed in as an argument.  Zone state transitions are
112  *   uni-directional; it is not possible to move back to an earlier state.
113  *
114  *
115  *   Zone-Specific Data:
116  *
117  *   Subsystems needing to maintain zone-specific data can store that
118  *   data using the ZSD mechanism.  This provides a zone-specific data
119  *   store, similar to thread-specific data (see pthread_getspecific(3C)
120  *   or the TSD code in uts/common/disp/thread.c.  Also, ZSD can be used
121  *   to register callbacks to be invoked when a zone is created, shut
122  *   down, or destroyed.  This can be used to initialize zone-specific
123  *   data for new zones and to clean up when zones go away.
124  *
125  *
126  *   Data Structures:
127  *
128  *   The per-zone structure (zone_t) is reference counted, and freed
129  *   when all references are released.  zone_hold and zone_rele can be
130  *   used to adjust the reference count.  In addition, reference counts
131  *   associated with the cred_t structure are tracked separately using
132  *   zone_cred_hold and zone_cred_rele.
133  *
134  *   Pointers to active zone_t's are stored in two hash tables; one
135  *   for searching by id, the other for searching by name.  Lookups
136  *   can be performed on either basis, using zone_find_by_id and
137  *   zone_find_by_name.  Both return zone_t pointers with the zone
138  *   held, so zone_rele should be called when the pointer is no longer
139  *   needed.  Zones can also be searched by path; zone_find_by_path
140  *   returns the zone with which a path name is associated (global
141  *   zone if the path is not within some other zone's file system
142  *   hierarchy).  This currently requires iterating through each zone,
143  *   so it is slower than an id or name search via a hash table.
144  *
145  *
146  *   Locking:
147  *
148  *   zonehash_lock: This is a top-level global lock used to protect the
149  *       zone hash tables and lists.  Zones cannot be created or destroyed
150  *       while this lock is held.
151  *   zone_status_lock: This is a global lock protecting zone state.
152  *       Zones cannot change state while this lock is held.  It also
153  *       protects the list of kernel threads associated with a zone.
154  *   zone_lock: This is a per-zone lock used to protect several fields of
155  *       the zone_t (see <sys/zone.h> for details).  In addition, holding
156  *       this lock means that the zone cannot go away.
157  *   zsd_key_lock: This is a global lock protecting the key state for ZSD.
158  *   zone_deathrow_lock: This is a global lock protecting the "deathrow"
159  *       list (a list of zones in the ZONE_IS_DEAD state).
160  *
161  *   Ordering requirements:
162  *       pool_lock --> cpu_lock --> zonehash_lock --> zone_status_lock -->
163  *       	zone_lock --> zsd_key_lock --> pidlock --> p_lock
164  *
165  *   Blocking memory allocations are permitted while holding any of the
166  *   zone locks.
167  *
168  *
169  *   System Call Interface:
170  *
171  *   The zone subsystem can be managed and queried from user level with
172  *   the following system calls (all subcodes of the primary "zone"
173  *   system call):
174  *   - zone_create: creates a zone with selected attributes (name,
175  *     root path, privileges, resource controls, ZFS datasets)
176  *   - zone_enter: allows the current process to enter a zone
177  *   - zone_getattr: reports attributes of a zone
178  *   - zone_list: lists all zones active in the system
179  *   - zone_lookup: looks up zone id based on name
180  *   - zone_shutdown: initiates shutdown process (see states above)
181  *   - zone_destroy: completes shutdown process (see states above)
182  *
183  */
184 
185 #include <sys/priv_impl.h>
186 #include <sys/cred.h>
187 #include <c2/audit.h>
188 #include <sys/debug.h>
189 #include <sys/file.h>
190 #include <sys/kmem.h>
191 #include <sys/mutex.h>
192 #include <sys/note.h>
193 #include <sys/pathname.h>
194 #include <sys/proc.h>
195 #include <sys/project.h>
196 #include <sys/sysevent.h>
197 #include <sys/task.h>
198 #include <sys/systm.h>
199 #include <sys/types.h>
200 #include <sys/utsname.h>
201 #include <sys/vnode.h>
202 #include <sys/vfs.h>
203 #include <sys/systeminfo.h>
204 #include <sys/policy.h>
205 #include <sys/cred_impl.h>
206 #include <sys/contract_impl.h>
207 #include <sys/contract/process_impl.h>
208 #include <sys/class.h>
209 #include <sys/pool.h>
210 #include <sys/pool_pset.h>
211 #include <sys/pset.h>
212 #include <sys/sysmacros.h>
213 #include <sys/callb.h>
214 #include <sys/vmparam.h>
215 #include <sys/corectl.h>
216 
217 #include <sys/door.h>
218 #include <sys/cpuvar.h>
219 
220 #include <sys/uadmin.h>
221 #include <sys/session.h>
222 #include <sys/cmn_err.h>
223 #include <sys/modhash.h>
224 #include <sys/nvpair.h>
225 #include <sys/rctl.h>
226 #include <sys/fss.h>
227 #include <sys/zone.h>
228 #include <sys/tsol/label.h>
229 
230 /*
231  * cv used to signal that all references to the zone have been released.  This
232  * needs to be global since there may be multiple waiters, and the first to
233  * wake up will free the zone_t, hence we cannot use zone->zone_cv.
234  */
235 static kcondvar_t zone_destroy_cv;
236 /*
237  * Lock used to serialize access to zone_cv.  This could have been per-zone,
238  * but then we'd need another lock for zone_destroy_cv, and why bother?
239  */
240 static kmutex_t zone_status_lock;
241 
242 /*
243  * ZSD-related global variables.
244  */
245 static kmutex_t zsd_key_lock;	/* protects the following two */
246 /*
247  * The next caller of zone_key_create() will be assigned a key of ++zsd_keyval.
248  */
249 static zone_key_t zsd_keyval = 0;
250 /*
251  * Global list of registered keys.  We use this when a new zone is created.
252  */
253 static list_t zsd_registered_keys;
254 
255 int zone_hash_size = 256;
256 static mod_hash_t *zonehashbyname, *zonehashbyid, *zonehashbylabel;
257 static kmutex_t zonehash_lock;
258 static uint_t zonecount;
259 static id_space_t *zoneid_space;
260 
261 /*
262  * The global zone (aka zone0) is the all-seeing, all-knowing zone in which the
263  * kernel proper runs, and which manages all other zones.
264  *
265  * Although not declared as static, the variable "zone0" should not be used
266  * except for by code that needs to reference the global zone early on in boot,
267  * before it is fully initialized.  All other consumers should use
268  * 'global_zone'.
269  */
270 zone_t zone0;
271 zone_t *global_zone = NULL;	/* Set when the global zone is initialized */
272 
273 /*
274  * List of active zones, protected by zonehash_lock.
275  */
276 static list_t zone_active;
277 
278 /*
279  * List of destroyed zones that still have outstanding cred references.
280  * Used for debugging.  Uses a separate lock to avoid lock ordering
281  * problems in zone_free.
282  */
283 static list_t zone_deathrow;
284 static kmutex_t zone_deathrow_lock;
285 
286 /* number of zones is limited by virtual interface limit in IP */
287 uint_t maxzones = 8192;
288 
289 /* Event channel to sent zone state change notifications */
290 evchan_t *zone_event_chan;
291 
292 /*
293  * This table holds the mapping from kernel zone states to
294  * states visible in the state notification API.
295  * The idea is that we only expose "obvious" states and
296  * do not expose states which are just implementation details.
297  */
298 const char  *zone_status_table[] = {
299 	ZONE_EVENT_UNINITIALIZED,	/* uninitialized */
300 	ZONE_EVENT_READY,		/* ready */
301 	ZONE_EVENT_READY,		/* booting */
302 	ZONE_EVENT_RUNNING,		/* running */
303 	ZONE_EVENT_SHUTTING_DOWN,	/* shutting_down */
304 	ZONE_EVENT_SHUTTING_DOWN,	/* empty */
305 	ZONE_EVENT_SHUTTING_DOWN,	/* down */
306 	ZONE_EVENT_SHUTTING_DOWN,	/* dying */
307 	ZONE_EVENT_UNINITIALIZED,	/* dead */
308 };
309 
310 /*
311  * This isn't static so lint doesn't complain.
312  */
313 rctl_hndl_t rc_zone_cpu_shares;
314 rctl_hndl_t rc_zone_nlwps;
315 /*
316  * Synchronization primitives used to synchronize between mounts and zone
317  * creation/destruction.
318  */
319 static int mounts_in_progress;
320 static kcondvar_t mount_cv;
321 static kmutex_t mount_lock;
322 
323 const char * const zone_initname = "/sbin/init";
324 static char * const zone_prefix = "/zone/";
325 
326 static int zone_shutdown(zoneid_t zoneid);
327 
328 /*
329  * Bump this number when you alter the zone syscall interfaces; this is
330  * because we need to have support for previous API versions in libc
331  * to support patching; libc calls into the kernel to determine this number.
332  *
333  * Version 1 of the API is the version originally shipped with Solaris 10
334  * Version 2 alters the zone_create system call in order to support more
335  *     arguments by moving the args into a structure; and to do better
336  *     error reporting when zone_create() fails.
337  * Version 3 alters the zone_create system call in order to support the
338  *     import of ZFS datasets to zones.
339  * Version 4 alters the zone_create system call in order to support
340  *     Trusted Extensions.
341  */
342 static const int ZONE_SYSCALL_API_VERSION = 4;
343 
344 /*
345  * Certain filesystems (such as NFS and autofs) need to know which zone
346  * the mount is being placed in.  Because of this, we need to be able to
347  * ensure that a zone isn't in the process of being created such that
348  * nfs_mount() thinks it is in the global zone, while by the time it
349  * gets added the list of mounted zones, it ends up on zoneA's mount
350  * list.
351  *
352  * The following functions: block_mounts()/resume_mounts() and
353  * mount_in_progress()/mount_completed() are used by zones and the VFS
354  * layer (respectively) to synchronize zone creation and new mounts.
355  *
356  * The semantics are like a reader-reader lock such that there may
357  * either be multiple mounts (or zone creations, if that weren't
358  * serialized by zonehash_lock) in progress at the same time, but not
359  * both.
360  *
361  * We use cv's so the user can ctrl-C out of the operation if it's
362  * taking too long.
363  *
364  * The semantics are such that there is unfair bias towards the
365  * "current" operation.  This means that zone creations may starve if
366  * there is a rapid succession of new mounts coming in to the system, or
367  * there is a remote possibility that zones will be created at such a
368  * rate that new mounts will not be able to proceed.
369  */
370 /*
371  * Prevent new mounts from progressing to the point of calling
372  * VFS_MOUNT().  If there are already mounts in this "region", wait for
373  * them to complete.
374  */
375 static int
376 block_mounts(void)
377 {
378 	int retval = 0;
379 
380 	/*
381 	 * Since it may block for a long time, block_mounts() shouldn't be
382 	 * called with zonehash_lock held.
383 	 */
384 	ASSERT(MUTEX_NOT_HELD(&zonehash_lock));
385 	mutex_enter(&mount_lock);
386 	while (mounts_in_progress > 0) {
387 		if (cv_wait_sig(&mount_cv, &mount_lock) == 0)
388 			goto signaled;
389 	}
390 	/*
391 	 * A negative value of mounts_in_progress indicates that mounts
392 	 * have been blocked by (-mounts_in_progress) different callers.
393 	 */
394 	mounts_in_progress--;
395 	retval = 1;
396 signaled:
397 	mutex_exit(&mount_lock);
398 	return (retval);
399 }
400 
401 /*
402  * The VFS layer may progress with new mounts as far as we're concerned.
403  * Allow them to progress if we were the last obstacle.
404  */
405 static void
406 resume_mounts(void)
407 {
408 	mutex_enter(&mount_lock);
409 	if (++mounts_in_progress == 0)
410 		cv_broadcast(&mount_cv);
411 	mutex_exit(&mount_lock);
412 }
413 
414 /*
415  * The VFS layer is busy with a mount; zones should wait until all
416  * mounts are completed to progress.
417  */
418 void
419 mount_in_progress(void)
420 {
421 	mutex_enter(&mount_lock);
422 	while (mounts_in_progress < 0)
423 		cv_wait(&mount_cv, &mount_lock);
424 	mounts_in_progress++;
425 	mutex_exit(&mount_lock);
426 }
427 
428 /*
429  * VFS is done with one mount; wake up any waiting block_mounts()
430  * callers if this is the last mount.
431  */
432 void
433 mount_completed(void)
434 {
435 	mutex_enter(&mount_lock);
436 	if (--mounts_in_progress == 0)
437 		cv_broadcast(&mount_cv);
438 	mutex_exit(&mount_lock);
439 }
440 
441 /*
442  * ZSD routines.
443  *
444  * Zone Specific Data (ZSD) is modeled after Thread Specific Data as
445  * defined by the pthread_key_create() and related interfaces.
446  *
447  * Kernel subsystems may register one or more data items and/or
448  * callbacks to be executed when a zone is created, shutdown, or
449  * destroyed.
450  *
451  * Unlike the thread counterpart, destructor callbacks will be executed
452  * even if the data pointer is NULL and/or there are no constructor
453  * callbacks, so it is the responsibility of such callbacks to check for
454  * NULL data values if necessary.
455  *
456  * The locking strategy and overall picture is as follows:
457  *
458  * When someone calls zone_key_create(), a template ZSD entry is added to the
459  * global list "zsd_registered_keys", protected by zsd_key_lock.  The
460  * constructor callback is called immediately on all existing zones, and a
461  * copy of the ZSD entry added to the per-zone zone_zsd list (protected by
462  * zone_lock).  As this operation requires the list of zones, the list of
463  * registered keys, and the per-zone list of ZSD entries to remain constant
464  * throughout the entire operation, it must grab zonehash_lock, zone_lock for
465  * all existing zones, and zsd_key_lock, in that order.  Similar locking is
466  * needed when zone_key_delete() is called.  It is thus sufficient to hold
467  * zsd_key_lock *or* zone_lock to prevent additions to or removals from the
468  * per-zone zone_zsd list.
469  *
470  * Note that this implementation does not make a copy of the ZSD entry if a
471  * constructor callback is not provided.  A zone_getspecific() on such an
472  * uninitialized ZSD entry will return NULL.
473  *
474  * When new zones are created constructor callbacks for all registered ZSD
475  * entries will be called.
476  *
477  * The framework does not provide any locking around zone_getspecific() and
478  * zone_setspecific() apart from that needed for internal consistency, so
479  * callers interested in atomic "test-and-set" semantics will need to provide
480  * their own locking.
481  */
482 void
483 zone_key_create(zone_key_t *keyp, void *(*create)(zoneid_t),
484     void (*shutdown)(zoneid_t, void *), void (*destroy)(zoneid_t, void *))
485 {
486 	struct zsd_entry *zsdp;
487 	struct zsd_entry *t;
488 	struct zone *zone;
489 
490 	zsdp = kmem_alloc(sizeof (*zsdp), KM_SLEEP);
491 	zsdp->zsd_data = NULL;
492 	zsdp->zsd_create = create;
493 	zsdp->zsd_shutdown = shutdown;
494 	zsdp->zsd_destroy = destroy;
495 
496 	mutex_enter(&zonehash_lock);	/* stop the world */
497 	for (zone = list_head(&zone_active); zone != NULL;
498 	    zone = list_next(&zone_active, zone))
499 		mutex_enter(&zone->zone_lock);	/* lock all zones */
500 
501 	mutex_enter(&zsd_key_lock);
502 	*keyp = zsdp->zsd_key = ++zsd_keyval;
503 	ASSERT(zsd_keyval != 0);
504 	list_insert_tail(&zsd_registered_keys, zsdp);
505 	mutex_exit(&zsd_key_lock);
506 
507 	if (create != NULL) {
508 		for (zone = list_head(&zone_active); zone != NULL;
509 		    zone = list_next(&zone_active, zone)) {
510 			t = kmem_alloc(sizeof (*t), KM_SLEEP);
511 			t->zsd_key = *keyp;
512 			t->zsd_data = (*create)(zone->zone_id);
513 			t->zsd_create = create;
514 			t->zsd_shutdown = shutdown;
515 			t->zsd_destroy = destroy;
516 			list_insert_tail(&zone->zone_zsd, t);
517 		}
518 	}
519 	for (zone = list_head(&zone_active); zone != NULL;
520 	    zone = list_next(&zone_active, zone))
521 		mutex_exit(&zone->zone_lock);
522 	mutex_exit(&zonehash_lock);
523 }
524 
525 /*
526  * Helper function to find the zsd_entry associated with the key in the
527  * given list.
528  */
529 static struct zsd_entry *
530 zsd_find(list_t *l, zone_key_t key)
531 {
532 	struct zsd_entry *zsd;
533 
534 	for (zsd = list_head(l); zsd != NULL; zsd = list_next(l, zsd)) {
535 		if (zsd->zsd_key == key) {
536 			/*
537 			 * Move to head of list to keep list in MRU order.
538 			 */
539 			if (zsd != list_head(l)) {
540 				list_remove(l, zsd);
541 				list_insert_head(l, zsd);
542 			}
543 			return (zsd);
544 		}
545 	}
546 	return (NULL);
547 }
548 
549 /*
550  * Function called when a module is being unloaded, or otherwise wishes
551  * to unregister its ZSD key and callbacks.
552  */
553 int
554 zone_key_delete(zone_key_t key)
555 {
556 	struct zsd_entry *zsdp = NULL;
557 	zone_t *zone;
558 
559 	mutex_enter(&zonehash_lock);	/* Zone create/delete waits for us */
560 	for (zone = list_head(&zone_active); zone != NULL;
561 	    zone = list_next(&zone_active, zone))
562 		mutex_enter(&zone->zone_lock);	/* lock all zones */
563 
564 	mutex_enter(&zsd_key_lock);
565 	zsdp = zsd_find(&zsd_registered_keys, key);
566 	if (zsdp == NULL)
567 		goto notfound;
568 	list_remove(&zsd_registered_keys, zsdp);
569 	mutex_exit(&zsd_key_lock);
570 
571 	for (zone = list_head(&zone_active); zone != NULL;
572 	    zone = list_next(&zone_active, zone)) {
573 		struct zsd_entry *del;
574 		void *data;
575 
576 		if (!(zone->zone_flags & ZF_DESTROYED)) {
577 			del = zsd_find(&zone->zone_zsd, key);
578 			if (del != NULL) {
579 				data = del->zsd_data;
580 				ASSERT(del->zsd_shutdown == zsdp->zsd_shutdown);
581 				ASSERT(del->zsd_destroy == zsdp->zsd_destroy);
582 				list_remove(&zone->zone_zsd, del);
583 				kmem_free(del, sizeof (*del));
584 			} else {
585 				data = NULL;
586 			}
587 			if (zsdp->zsd_shutdown)
588 				zsdp->zsd_shutdown(zone->zone_id, data);
589 			if (zsdp->zsd_destroy)
590 				zsdp->zsd_destroy(zone->zone_id, data);
591 		}
592 		mutex_exit(&zone->zone_lock);
593 	}
594 	mutex_exit(&zonehash_lock);
595 	kmem_free(zsdp, sizeof (*zsdp));
596 	return (0);
597 
598 notfound:
599 	mutex_exit(&zsd_key_lock);
600 	for (zone = list_head(&zone_active); zone != NULL;
601 	    zone = list_next(&zone_active, zone))
602 		mutex_exit(&zone->zone_lock);
603 	mutex_exit(&zonehash_lock);
604 	return (-1);
605 }
606 
607 /*
608  * ZSD counterpart of pthread_setspecific().
609  */
610 int
611 zone_setspecific(zone_key_t key, zone_t *zone, const void *data)
612 {
613 	struct zsd_entry *t;
614 	struct zsd_entry *zsdp = NULL;
615 
616 	mutex_enter(&zone->zone_lock);
617 	t = zsd_find(&zone->zone_zsd, key);
618 	if (t != NULL) {
619 		/*
620 		 * Replace old value with new
621 		 */
622 		t->zsd_data = (void *)data;
623 		mutex_exit(&zone->zone_lock);
624 		return (0);
625 	}
626 	/*
627 	 * If there was no previous value, go through the list of registered
628 	 * keys.
629 	 *
630 	 * We avoid grabbing zsd_key_lock until we are sure we need it; this is
631 	 * necessary for shutdown callbacks to be able to execute without fear
632 	 * of deadlock.
633 	 */
634 	mutex_enter(&zsd_key_lock);
635 	zsdp = zsd_find(&zsd_registered_keys, key);
636 	if (zsdp == NULL) { 	/* Key was not registered */
637 		mutex_exit(&zsd_key_lock);
638 		mutex_exit(&zone->zone_lock);
639 		return (-1);
640 	}
641 
642 	/*
643 	 * Add a zsd_entry to this zone, using the template we just retrieved
644 	 * to initialize the constructor and destructor(s).
645 	 */
646 	t = kmem_alloc(sizeof (*t), KM_SLEEP);
647 	t->zsd_key = key;
648 	t->zsd_data = (void *)data;
649 	t->zsd_create = zsdp->zsd_create;
650 	t->zsd_shutdown = zsdp->zsd_shutdown;
651 	t->zsd_destroy = zsdp->zsd_destroy;
652 	list_insert_tail(&zone->zone_zsd, t);
653 	mutex_exit(&zsd_key_lock);
654 	mutex_exit(&zone->zone_lock);
655 	return (0);
656 }
657 
658 /*
659  * ZSD counterpart of pthread_getspecific().
660  */
661 void *
662 zone_getspecific(zone_key_t key, zone_t *zone)
663 {
664 	struct zsd_entry *t;
665 	void *data;
666 
667 	mutex_enter(&zone->zone_lock);
668 	t = zsd_find(&zone->zone_zsd, key);
669 	data = (t == NULL ? NULL : t->zsd_data);
670 	mutex_exit(&zone->zone_lock);
671 	return (data);
672 }
673 
674 /*
675  * Function used to initialize a zone's list of ZSD callbacks and data
676  * when the zone is being created.  The callbacks are initialized from
677  * the template list (zsd_registered_keys), and the constructor
678  * callback executed (if one exists).
679  *
680  * This is called before the zone is made publicly available, hence no
681  * need to grab zone_lock.
682  *
683  * Although we grab and release zsd_key_lock, new entries cannot be
684  * added to or removed from the zsd_registered_keys list until we
685  * release zonehash_lock, so there isn't a window for a
686  * zone_key_create() to come in after we've dropped zsd_key_lock but
687  * before the zone is added to the zone list, such that the constructor
688  * callbacks aren't executed for the new zone.
689  */
690 static void
691 zone_zsd_configure(zone_t *zone)
692 {
693 	struct zsd_entry *zsdp;
694 	struct zsd_entry *t;
695 	zoneid_t zoneid = zone->zone_id;
696 
697 	ASSERT(MUTEX_HELD(&zonehash_lock));
698 	ASSERT(list_head(&zone->zone_zsd) == NULL);
699 	mutex_enter(&zsd_key_lock);
700 	for (zsdp = list_head(&zsd_registered_keys); zsdp != NULL;
701 	    zsdp = list_next(&zsd_registered_keys, zsdp)) {
702 		if (zsdp->zsd_create != NULL) {
703 			t = kmem_alloc(sizeof (*t), KM_SLEEP);
704 			t->zsd_key = zsdp->zsd_key;
705 			t->zsd_create = zsdp->zsd_create;
706 			t->zsd_data = (*t->zsd_create)(zoneid);
707 			t->zsd_shutdown = zsdp->zsd_shutdown;
708 			t->zsd_destroy = zsdp->zsd_destroy;
709 			list_insert_tail(&zone->zone_zsd, t);
710 		}
711 	}
712 	mutex_exit(&zsd_key_lock);
713 }
714 
715 enum zsd_callback_type { ZSD_CREATE, ZSD_SHUTDOWN, ZSD_DESTROY };
716 
717 /*
718  * Helper function to execute shutdown or destructor callbacks.
719  */
720 static void
721 zone_zsd_callbacks(zone_t *zone, enum zsd_callback_type ct)
722 {
723 	struct zsd_entry *zsdp;
724 	struct zsd_entry *t;
725 	zoneid_t zoneid = zone->zone_id;
726 
727 	ASSERT(ct == ZSD_SHUTDOWN || ct == ZSD_DESTROY);
728 	ASSERT(ct != ZSD_SHUTDOWN || zone_status_get(zone) >= ZONE_IS_EMPTY);
729 	ASSERT(ct != ZSD_DESTROY || zone_status_get(zone) >= ZONE_IS_DOWN);
730 
731 	mutex_enter(&zone->zone_lock);
732 	if (ct == ZSD_DESTROY) {
733 		if (zone->zone_flags & ZF_DESTROYED) {
734 			/*
735 			 * Make sure destructors are only called once.
736 			 */
737 			mutex_exit(&zone->zone_lock);
738 			return;
739 		}
740 		zone->zone_flags |= ZF_DESTROYED;
741 	}
742 	mutex_exit(&zone->zone_lock);
743 
744 	/*
745 	 * Both zsd_key_lock and zone_lock need to be held in order to add or
746 	 * remove a ZSD key, (either globally as part of
747 	 * zone_key_create()/zone_key_delete(), or on a per-zone basis, as is
748 	 * possible through zone_setspecific()), so it's sufficient to hold
749 	 * zsd_key_lock here.
750 	 *
751 	 * This is a good thing, since we don't want to recursively try to grab
752 	 * zone_lock if a callback attempts to do something like a crfree() or
753 	 * zone_rele().
754 	 */
755 	mutex_enter(&zsd_key_lock);
756 	for (zsdp = list_head(&zsd_registered_keys); zsdp != NULL;
757 	    zsdp = list_next(&zsd_registered_keys, zsdp)) {
758 		zone_key_t key = zsdp->zsd_key;
759 
760 		/* Skip if no callbacks registered */
761 		if (ct == ZSD_SHUTDOWN && zsdp->zsd_shutdown == NULL)
762 			continue;
763 		if (ct == ZSD_DESTROY && zsdp->zsd_destroy == NULL)
764 			continue;
765 		/*
766 		 * Call the callback with the zone-specific data if we can find
767 		 * any, otherwise with NULL.
768 		 */
769 		t = zsd_find(&zone->zone_zsd, key);
770 		if (t != NULL) {
771 			if (ct == ZSD_SHUTDOWN) {
772 				t->zsd_shutdown(zoneid, t->zsd_data);
773 			} else {
774 				ASSERT(ct == ZSD_DESTROY);
775 				t->zsd_destroy(zoneid, t->zsd_data);
776 			}
777 		} else {
778 			if (ct == ZSD_SHUTDOWN) {
779 				zsdp->zsd_shutdown(zoneid, NULL);
780 			} else {
781 				ASSERT(ct == ZSD_DESTROY);
782 				zsdp->zsd_destroy(zoneid, NULL);
783 			}
784 		}
785 	}
786 	mutex_exit(&zsd_key_lock);
787 }
788 
789 /*
790  * Called when the zone is going away; free ZSD-related memory, and
791  * destroy the zone_zsd list.
792  */
793 static void
794 zone_free_zsd(zone_t *zone)
795 {
796 	struct zsd_entry *t, *next;
797 
798 	/*
799 	 * Free all the zsd_entry's we had on this zone.
800 	 */
801 	for (t = list_head(&zone->zone_zsd); t != NULL; t = next) {
802 		next = list_next(&zone->zone_zsd, t);
803 		list_remove(&zone->zone_zsd, t);
804 		kmem_free(t, sizeof (*t));
805 	}
806 	list_destroy(&zone->zone_zsd);
807 }
808 
809 /*
810  * Frees memory associated with the zone dataset list.
811  */
812 static void
813 zone_free_datasets(zone_t *zone)
814 {
815 	zone_dataset_t *t, *next;
816 
817 	for (t = list_head(&zone->zone_datasets); t != NULL; t = next) {
818 		next = list_next(&zone->zone_datasets, t);
819 		list_remove(&zone->zone_datasets, t);
820 		kmem_free(t->zd_dataset, strlen(t->zd_dataset) + 1);
821 		kmem_free(t, sizeof (*t));
822 	}
823 	list_destroy(&zone->zone_datasets);
824 }
825 
826 /*
827  * zone.cpu-shares resource control support.
828  */
829 /*ARGSUSED*/
830 static rctl_qty_t
831 zone_cpu_shares_usage(rctl_t *rctl, struct proc *p)
832 {
833 	ASSERT(MUTEX_HELD(&p->p_lock));
834 	return (p->p_zone->zone_shares);
835 }
836 
837 /*ARGSUSED*/
838 static int
839 zone_cpu_shares_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e,
840     rctl_qty_t nv)
841 {
842 	ASSERT(MUTEX_HELD(&p->p_lock));
843 	ASSERT(e->rcep_t == RCENTITY_ZONE);
844 	if (e->rcep_p.zone == NULL)
845 		return (0);
846 
847 	e->rcep_p.zone->zone_shares = nv;
848 	return (0);
849 }
850 
851 static rctl_ops_t zone_cpu_shares_ops = {
852 	rcop_no_action,
853 	zone_cpu_shares_usage,
854 	zone_cpu_shares_set,
855 	rcop_no_test
856 };
857 
858 /*ARGSUSED*/
859 static rctl_qty_t
860 zone_lwps_usage(rctl_t *r, proc_t *p)
861 {
862 	rctl_qty_t nlwps;
863 	zone_t *zone = p->p_zone;
864 
865 	ASSERT(MUTEX_HELD(&p->p_lock));
866 
867 	mutex_enter(&zone->zone_nlwps_lock);
868 	nlwps = zone->zone_nlwps;
869 	mutex_exit(&zone->zone_nlwps_lock);
870 
871 	return (nlwps);
872 }
873 
874 /*ARGSUSED*/
875 static int
876 zone_lwps_test(rctl_t *r, proc_t *p, rctl_entity_p_t *e, rctl_val_t *rcntl,
877     rctl_qty_t incr, uint_t flags)
878 {
879 	rctl_qty_t nlwps;
880 
881 	ASSERT(MUTEX_HELD(&p->p_lock));
882 	ASSERT(e->rcep_t == RCENTITY_ZONE);
883 	if (e->rcep_p.zone == NULL)
884 		return (0);
885 	ASSERT(MUTEX_HELD(&(e->rcep_p.zone->zone_nlwps_lock)));
886 	nlwps = e->rcep_p.zone->zone_nlwps;
887 
888 	if (nlwps + incr > rcntl->rcv_value)
889 		return (1);
890 
891 	return (0);
892 }
893 
894 /*ARGSUSED*/
895 static int
896 zone_lwps_set(rctl_t *rctl, struct proc *p, rctl_entity_p_t *e, rctl_qty_t nv) {
897 
898 	ASSERT(MUTEX_HELD(&p->p_lock));
899 	ASSERT(e->rcep_t == RCENTITY_ZONE);
900 	if (e->rcep_p.zone == NULL)
901 		return (0);
902 	e->rcep_p.zone->zone_nlwps_ctl = nv;
903 	return (0);
904 }
905 
906 static rctl_ops_t zone_lwps_ops = {
907 	rcop_no_action,
908 	zone_lwps_usage,
909 	zone_lwps_set,
910 	zone_lwps_test,
911 };
912 
913 /*
914  * Helper function to brand the zone with a unique ID.
915  */
916 static void
917 zone_uniqid(zone_t *zone)
918 {
919 	static uint64_t uniqid = 0;
920 
921 	ASSERT(MUTEX_HELD(&zonehash_lock));
922 	zone->zone_uniqid = uniqid++;
923 }
924 
925 /*
926  * Returns a held pointer to the "kcred" for the specified zone.
927  */
928 struct cred *
929 zone_get_kcred(zoneid_t zoneid)
930 {
931 	zone_t *zone;
932 	cred_t *cr;
933 
934 	if ((zone = zone_find_by_id(zoneid)) == NULL)
935 		return (NULL);
936 	cr = zone->zone_kcred;
937 	crhold(cr);
938 	zone_rele(zone);
939 	return (cr);
940 }
941 
942 /*
943  * Called very early on in boot to initialize the ZSD list so that
944  * zone_key_create() can be called before zone_init().  It also initializes
945  * portions of zone0 which may be used before zone_init() is called.  The
946  * variable "global_zone" will be set when zone0 is fully initialized by
947  * zone_init().
948  */
949 void
950 zone_zsd_init(void)
951 {
952 	mutex_init(&zonehash_lock, NULL, MUTEX_DEFAULT, NULL);
953 	mutex_init(&zsd_key_lock, NULL, MUTEX_DEFAULT, NULL);
954 	list_create(&zsd_registered_keys, sizeof (struct zsd_entry),
955 	    offsetof(struct zsd_entry, zsd_linkage));
956 	list_create(&zone_active, sizeof (zone_t),
957 	    offsetof(zone_t, zone_linkage));
958 	list_create(&zone_deathrow, sizeof (zone_t),
959 	    offsetof(zone_t, zone_linkage));
960 
961 	mutex_init(&zone0.zone_lock, NULL, MUTEX_DEFAULT, NULL);
962 	mutex_init(&zone0.zone_nlwps_lock, NULL, MUTEX_DEFAULT, NULL);
963 	zone0.zone_shares = 1;
964 	zone0.zone_nlwps_ctl = INT_MAX;
965 	zone0.zone_name = GLOBAL_ZONENAME;
966 	zone0.zone_nodename = utsname.nodename;
967 	zone0.zone_domain = srpc_domain;
968 	zone0.zone_ref = 1;
969 	zone0.zone_id = GLOBAL_ZONEID;
970 	zone0.zone_status = ZONE_IS_RUNNING;
971 	zone0.zone_rootpath = "/";
972 	zone0.zone_rootpathlen = 2;
973 	zone0.zone_psetid = ZONE_PS_INVAL;
974 	zone0.zone_ncpus = 0;
975 	zone0.zone_ncpus_online = 0;
976 	zone0.zone_proc_initpid = 1;
977 	list_create(&zone0.zone_zsd, sizeof (struct zsd_entry),
978 	    offsetof(struct zsd_entry, zsd_linkage));
979 	list_insert_head(&zone_active, &zone0);
980 
981 	/*
982 	 * The root filesystem is not mounted yet, so zone_rootvp cannot be set
983 	 * to anything meaningful.  It is assigned to be 'rootdir' in
984 	 * vfs_mountroot().
985 	 */
986 	zone0.zone_rootvp = NULL;
987 	zone0.zone_vfslist = NULL;
988 	zone0.zone_bootargs = NULL;
989 	zone0.zone_privset = kmem_alloc(sizeof (priv_set_t), KM_SLEEP);
990 	/*
991 	 * The global zone has all privileges
992 	 */
993 	priv_fillset(zone0.zone_privset);
994 	/*
995 	 * Add p0 to the global zone
996 	 */
997 	zone0.zone_zsched = &p0;
998 	p0.p_zone = &zone0;
999 }
1000 
1001 /*
1002  * Compute a hash value based on the contents of the label and the DOI.  The
1003  * hash algorithm is somewhat arbitrary, but is based on the observation that
1004  * humans will likely pick labels that differ by amounts that work out to be
1005  * multiples of the number of hash chains, and thus stirring in some primes
1006  * should help.
1007  */
1008 static uint_t
1009 hash_bylabel(void *hdata, mod_hash_key_t key)
1010 {
1011 	const ts_label_t *lab = (ts_label_t *)key;
1012 	const uint32_t *up, *ue;
1013 	uint_t hash;
1014 	int i;
1015 
1016 	_NOTE(ARGUNUSED(hdata));
1017 
1018 	hash = lab->tsl_doi + (lab->tsl_doi << 1);
1019 	/* we depend on alignment of label, but not representation */
1020 	up = (const uint32_t *)&lab->tsl_label;
1021 	ue = up + sizeof (lab->tsl_label) / sizeof (*up);
1022 	i = 1;
1023 	while (up < ue) {
1024 		/* using 2^n + 1, 1 <= n <= 16 as source of many primes */
1025 		hash += *up + (*up << ((i % 16) + 1));
1026 		up++;
1027 		i++;
1028 	}
1029 	return (hash);
1030 }
1031 
1032 /*
1033  * All that mod_hash cares about here is zero (equal) versus non-zero (not
1034  * equal).  This may need to be changed if less than / greater than is ever
1035  * needed.
1036  */
1037 static int
1038 hash_labelkey_cmp(mod_hash_key_t key1, mod_hash_key_t key2)
1039 {
1040 	ts_label_t *lab1 = (ts_label_t *)key1;
1041 	ts_label_t *lab2 = (ts_label_t *)key2;
1042 
1043 	return (label_equal(lab1, lab2) ? 0 : 1);
1044 }
1045 
1046 /*
1047  * Called by main() to initialize the zones framework.
1048  */
1049 void
1050 zone_init(void)
1051 {
1052 	rctl_dict_entry_t *rde;
1053 	rctl_val_t *dval;
1054 	rctl_set_t *set;
1055 	rctl_alloc_gp_t *gp;
1056 	rctl_entity_p_t e;
1057 	int res;
1058 
1059 	ASSERT(curproc == &p0);
1060 
1061 	/*
1062 	 * Create ID space for zone IDs.  ID 0 is reserved for the
1063 	 * global zone.
1064 	 */
1065 	zoneid_space = id_space_create("zoneid_space", 1, MAX_ZONEID);
1066 
1067 	/*
1068 	 * Initialize generic zone resource controls, if any.
1069 	 */
1070 	rc_zone_cpu_shares = rctl_register("zone.cpu-shares",
1071 	    RCENTITY_ZONE, RCTL_GLOBAL_SIGNAL_NEVER | RCTL_GLOBAL_DENY_NEVER |
1072 	    RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT | RCTL_GLOBAL_SYSLOG_NEVER,
1073 	    FSS_MAXSHARES, FSS_MAXSHARES,
1074 	    &zone_cpu_shares_ops);
1075 
1076 	rc_zone_nlwps = rctl_register("zone.max-lwps", RCENTITY_ZONE,
1077 	    RCTL_GLOBAL_NOACTION | RCTL_GLOBAL_NOBASIC | RCTL_GLOBAL_COUNT,
1078 	    INT_MAX, INT_MAX, &zone_lwps_ops);
1079 	/*
1080 	 * Create a rctl_val with PRIVILEGED, NOACTION, value = 1.  Then attach
1081 	 * this at the head of the rctl_dict_entry for ``zone.cpu-shares''.
1082 	 */
1083 	dval = kmem_cache_alloc(rctl_val_cache, KM_SLEEP);
1084 	bzero(dval, sizeof (rctl_val_t));
1085 	dval->rcv_value = 1;
1086 	dval->rcv_privilege = RCPRIV_PRIVILEGED;
1087 	dval->rcv_flagaction = RCTL_LOCAL_NOACTION;
1088 	dval->rcv_action_recip_pid = -1;
1089 
1090 	rde = rctl_dict_lookup("zone.cpu-shares");
1091 	(void) rctl_val_list_insert(&rde->rcd_default_value, dval);
1092 
1093 	/*
1094 	 * Initialize the ``global zone''.
1095 	 */
1096 	set = rctl_set_create();
1097 	gp = rctl_set_init_prealloc(RCENTITY_ZONE);
1098 	mutex_enter(&p0.p_lock);
1099 	e.rcep_p.zone = &zone0;
1100 	e.rcep_t = RCENTITY_ZONE;
1101 	zone0.zone_rctls = rctl_set_init(RCENTITY_ZONE, &p0, &e, set,
1102 	    gp);
1103 
1104 	zone0.zone_nlwps = p0.p_lwpcnt;
1105 	zone0.zone_ntasks = 1;
1106 	mutex_exit(&p0.p_lock);
1107 	rctl_prealloc_destroy(gp);
1108 	/*
1109 	 * pool_default hasn't been initialized yet, so we let pool_init() take
1110 	 * care of making the global zone is in the default pool.
1111 	 */
1112 
1113 	/*
1114 	 * Initialize zone label.
1115 	 * mlp are initialized when tnzonecfg is loaded.
1116 	 */
1117 	zone0.zone_slabel = l_admin_low;
1118 	rw_init(&zone0.zone_mlps.mlpl_rwlock, NULL, RW_DEFAULT, NULL);
1119 	label_hold(l_admin_low);
1120 
1121 	mutex_enter(&zonehash_lock);
1122 	zone_uniqid(&zone0);
1123 	ASSERT(zone0.zone_uniqid == GLOBAL_ZONEUNIQID);
1124 
1125 	zonehashbyid = mod_hash_create_idhash("zone_by_id", zone_hash_size,
1126 	    mod_hash_null_valdtor);
1127 	zonehashbyname = mod_hash_create_strhash("zone_by_name",
1128 	    zone_hash_size, mod_hash_null_valdtor);
1129 	/*
1130 	 * maintain zonehashbylabel only for labeled systems
1131 	 */
1132 	if (is_system_labeled())
1133 		zonehashbylabel = mod_hash_create_extended("zone_by_label",
1134 		    zone_hash_size, mod_hash_null_keydtor,
1135 		    mod_hash_null_valdtor, hash_bylabel, NULL,
1136 		    hash_labelkey_cmp, KM_SLEEP);
1137 	zonecount = 1;
1138 
1139 	(void) mod_hash_insert(zonehashbyid, (mod_hash_key_t)GLOBAL_ZONEID,
1140 	    (mod_hash_val_t)&zone0);
1141 	(void) mod_hash_insert(zonehashbyname, (mod_hash_key_t)zone0.zone_name,
1142 	    (mod_hash_val_t)&zone0);
1143 	if (is_system_labeled()) {
1144 		zone0.zone_flags |= ZF_HASHED_LABEL;
1145 		(void) mod_hash_insert(zonehashbylabel,
1146 		    (mod_hash_key_t)zone0.zone_slabel, (mod_hash_val_t)&zone0);
1147 	}
1148 	mutex_exit(&zonehash_lock);
1149 
1150 	/*
1151 	 * We avoid setting zone_kcred until now, since kcred is initialized
1152 	 * sometime after zone_zsd_init() and before zone_init().
1153 	 */
1154 	zone0.zone_kcred = kcred;
1155 	/*
1156 	 * The global zone is fully initialized (except for zone_rootvp which
1157 	 * will be set when the root filesystem is mounted).
1158 	 */
1159 	global_zone = &zone0;
1160 
1161 	/*
1162 	 * Setup an event channel to send zone status change notifications on
1163 	 */
1164 	res = sysevent_evc_bind(ZONE_EVENT_CHANNEL, &zone_event_chan,
1165 	    EVCH_CREAT);
1166 
1167 	if (res)
1168 		panic("Sysevent_evc_bind failed during zone setup.\n");
1169 }
1170 
1171 static void
1172 zone_free(zone_t *zone)
1173 {
1174 	ASSERT(zone != global_zone);
1175 	ASSERT(zone->zone_ntasks == 0);
1176 	ASSERT(zone->zone_nlwps == 0);
1177 	ASSERT(zone->zone_cred_ref == 0);
1178 	ASSERT(zone->zone_kcred == NULL);
1179 	ASSERT(zone_status_get(zone) == ZONE_IS_DEAD ||
1180 	    zone_status_get(zone) == ZONE_IS_UNINITIALIZED);
1181 
1182 	/* remove from deathrow list */
1183 	if (zone_status_get(zone) == ZONE_IS_DEAD) {
1184 		ASSERT(zone->zone_ref == 0);
1185 		mutex_enter(&zone_deathrow_lock);
1186 		list_remove(&zone_deathrow, zone);
1187 		mutex_exit(&zone_deathrow_lock);
1188 	}
1189 
1190 	zone_free_zsd(zone);
1191 	zone_free_datasets(zone);
1192 
1193 	if (zone->zone_rootvp != NULL)
1194 		VN_RELE(zone->zone_rootvp);
1195 	if (zone->zone_rootpath)
1196 		kmem_free(zone->zone_rootpath, zone->zone_rootpathlen);
1197 	if (zone->zone_name != NULL)
1198 		kmem_free(zone->zone_name, ZONENAME_MAX);
1199 	if (zone->zone_slabel != NULL)
1200 		label_rele(zone->zone_slabel);
1201 	if (zone->zone_nodename != NULL)
1202 		kmem_free(zone->zone_nodename, _SYS_NMLN);
1203 	if (zone->zone_domain != NULL)
1204 		kmem_free(zone->zone_domain, _SYS_NMLN);
1205 	if (zone->zone_privset != NULL)
1206 		kmem_free(zone->zone_privset, sizeof (priv_set_t));
1207 	if (zone->zone_rctls != NULL)
1208 		rctl_set_free(zone->zone_rctls);
1209 	if (zone->zone_bootargs != NULL)
1210 		kmem_free(zone->zone_bootargs, ZONEBOOTARGS_MAX);
1211 	id_free(zoneid_space, zone->zone_id);
1212 	mutex_destroy(&zone->zone_lock);
1213 	cv_destroy(&zone->zone_cv);
1214 	rw_destroy(&zone->zone_mlps.mlpl_rwlock);
1215 	kmem_free(zone, sizeof (zone_t));
1216 }
1217 
1218 /*
1219  * See block comment at the top of this file for information about zone
1220  * status values.
1221  */
1222 /*
1223  * Convenience function for setting zone status.
1224  */
1225 static void
1226 zone_status_set(zone_t *zone, zone_status_t status)
1227 {
1228 
1229 	nvlist_t *nvl = NULL;
1230 	ASSERT(MUTEX_HELD(&zone_status_lock));
1231 	ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE &&
1232 	    status >= zone_status_get(zone));
1233 
1234 	if (nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) ||
1235 	    nvlist_add_string(nvl, ZONE_CB_NAME, zone->zone_name) ||
1236 	    nvlist_add_string(nvl, ZONE_CB_NEWSTATE,
1237 		zone_status_table[status]) ||
1238 	    nvlist_add_string(nvl, ZONE_CB_OLDSTATE,
1239 		zone_status_table[zone->zone_status]) ||
1240 	    nvlist_add_int32(nvl, ZONE_CB_ZONEID, zone->zone_id) ||
1241 	    nvlist_add_uint64(nvl, ZONE_CB_TIMESTAMP, (uint64_t)gethrtime()) ||
1242 	    sysevent_evc_publish(zone_event_chan, ZONE_EVENT_STATUS_CLASS,
1243 		ZONE_EVENT_STATUS_SUBCLASS,
1244 		"sun.com", "kernel", nvl, EVCH_SLEEP)) {
1245 #ifdef DEBUG
1246 		(void) printf(
1247 		    "Failed to allocate and send zone state change event.\n");
1248 #endif
1249 	}
1250 	nvlist_free(nvl);
1251 
1252 	zone->zone_status = status;
1253 
1254 	cv_broadcast(&zone->zone_cv);
1255 }
1256 
1257 /*
1258  * Public function to retrieve the zone status.  The zone status may
1259  * change after it is retrieved.
1260  */
1261 zone_status_t
1262 zone_status_get(zone_t *zone)
1263 {
1264 	return (zone->zone_status);
1265 }
1266 
1267 static int
1268 zone_set_bootargs(zone_t *zone, const char *zone_bootargs)
1269 {
1270 	char *bootargs = kmem_zalloc(ZONEBOOTARGS_MAX, KM_SLEEP);
1271 	size_t len;
1272 	int err;
1273 
1274 	err = copyinstr(zone_bootargs, bootargs, ZONEBOOTARGS_MAX - 1, &len);
1275 	if (err != 0) {
1276 		kmem_free(bootargs, ZONEBOOTARGS_MAX);
1277 		return (err);	/* EFAULT or ENAMETOOLONG */
1278 	}
1279 	bootargs[len] = '\0';
1280 
1281 	ASSERT(zone->zone_bootargs == NULL);
1282 	zone->zone_bootargs = bootargs;
1283 	return (0);
1284 }
1285 
1286 /*
1287  * Block indefinitely waiting for (zone_status >= status)
1288  */
1289 void
1290 zone_status_wait(zone_t *zone, zone_status_t status)
1291 {
1292 	ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
1293 
1294 	mutex_enter(&zone_status_lock);
1295 	while (zone->zone_status < status) {
1296 		cv_wait(&zone->zone_cv, &zone_status_lock);
1297 	}
1298 	mutex_exit(&zone_status_lock);
1299 }
1300 
1301 /*
1302  * Private CPR-safe version of zone_status_wait().
1303  */
1304 static void
1305 zone_status_wait_cpr(zone_t *zone, zone_status_t status, char *str)
1306 {
1307 	callb_cpr_t cprinfo;
1308 
1309 	ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
1310 
1311 	CALLB_CPR_INIT(&cprinfo, &zone_status_lock, callb_generic_cpr,
1312 	    str);
1313 	mutex_enter(&zone_status_lock);
1314 	while (zone->zone_status < status) {
1315 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
1316 		cv_wait(&zone->zone_cv, &zone_status_lock);
1317 		CALLB_CPR_SAFE_END(&cprinfo, &zone_status_lock);
1318 	}
1319 	/*
1320 	 * zone_status_lock is implicitly released by the following.
1321 	 */
1322 	CALLB_CPR_EXIT(&cprinfo);
1323 }
1324 
1325 /*
1326  * Block until zone enters requested state or signal is received.  Return (0)
1327  * if signaled, non-zero otherwise.
1328  */
1329 int
1330 zone_status_wait_sig(zone_t *zone, zone_status_t status)
1331 {
1332 	ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
1333 
1334 	mutex_enter(&zone_status_lock);
1335 	while (zone->zone_status < status) {
1336 		if (!cv_wait_sig(&zone->zone_cv, &zone_status_lock)) {
1337 			mutex_exit(&zone_status_lock);
1338 			return (0);
1339 		}
1340 	}
1341 	mutex_exit(&zone_status_lock);
1342 	return (1);
1343 }
1344 
1345 /*
1346  * Block until the zone enters the requested state or the timeout expires,
1347  * whichever happens first.  Return (-1) if operation timed out, time remaining
1348  * otherwise.
1349  */
1350 clock_t
1351 zone_status_timedwait(zone_t *zone, clock_t tim, zone_status_t status)
1352 {
1353 	clock_t timeleft = 0;
1354 
1355 	ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
1356 
1357 	mutex_enter(&zone_status_lock);
1358 	while (zone->zone_status < status && timeleft != -1) {
1359 		timeleft = cv_timedwait(&zone->zone_cv, &zone_status_lock, tim);
1360 	}
1361 	mutex_exit(&zone_status_lock);
1362 	return (timeleft);
1363 }
1364 
1365 /*
1366  * Block until the zone enters the requested state, the current process is
1367  * signaled,  or the timeout expires, whichever happens first.  Return (-1) if
1368  * operation timed out, 0 if signaled, time remaining otherwise.
1369  */
1370 clock_t
1371 zone_status_timedwait_sig(zone_t *zone, clock_t tim, zone_status_t status)
1372 {
1373 	clock_t timeleft = tim - lbolt;
1374 
1375 	ASSERT(status > ZONE_MIN_STATE && status <= ZONE_MAX_STATE);
1376 
1377 	mutex_enter(&zone_status_lock);
1378 	while (zone->zone_status < status) {
1379 		timeleft = cv_timedwait_sig(&zone->zone_cv, &zone_status_lock,
1380 		    tim);
1381 		if (timeleft <= 0)
1382 			break;
1383 	}
1384 	mutex_exit(&zone_status_lock);
1385 	return (timeleft);
1386 }
1387 
1388 /*
1389  * Zones have two reference counts: one for references from credential
1390  * structures (zone_cred_ref), and one (zone_ref) for everything else.
1391  * This is so we can allow a zone to be rebooted while there are still
1392  * outstanding cred references, since certain drivers cache dblks (which
1393  * implicitly results in cached creds).  We wait for zone_ref to drop to
1394  * 0 (actually 1), but not zone_cred_ref.  The zone structure itself is
1395  * later freed when the zone_cred_ref drops to 0, though nothing other
1396  * than the zone id and privilege set should be accessed once the zone
1397  * is "dead".
1398  *
1399  * A debugging flag, zone_wait_for_cred, can be set to a non-zero value
1400  * to force halt/reboot to block waiting for the zone_cred_ref to drop
1401  * to 0.  This can be useful to flush out other sources of cached creds
1402  * that may be less innocuous than the driver case.
1403  */
1404 
1405 int zone_wait_for_cred = 0;
1406 
1407 static void
1408 zone_hold_locked(zone_t *z)
1409 {
1410 	ASSERT(MUTEX_HELD(&z->zone_lock));
1411 	z->zone_ref++;
1412 	ASSERT(z->zone_ref != 0);
1413 }
1414 
1415 void
1416 zone_hold(zone_t *z)
1417 {
1418 	mutex_enter(&z->zone_lock);
1419 	zone_hold_locked(z);
1420 	mutex_exit(&z->zone_lock);
1421 }
1422 
1423 /*
1424  * If the non-cred ref count drops to 1 and either the cred ref count
1425  * is 0 or we aren't waiting for cred references, the zone is ready to
1426  * be destroyed.
1427  */
1428 #define	ZONE_IS_UNREF(zone)	((zone)->zone_ref == 1 && \
1429 	    (!zone_wait_for_cred || (zone)->zone_cred_ref == 0))
1430 
1431 void
1432 zone_rele(zone_t *z)
1433 {
1434 	boolean_t wakeup;
1435 
1436 	mutex_enter(&z->zone_lock);
1437 	ASSERT(z->zone_ref != 0);
1438 	z->zone_ref--;
1439 	if (z->zone_ref == 0 && z->zone_cred_ref == 0) {
1440 		/* no more refs, free the structure */
1441 		mutex_exit(&z->zone_lock);
1442 		zone_free(z);
1443 		return;
1444 	}
1445 	/* signal zone_destroy so the zone can finish halting */
1446 	wakeup = (ZONE_IS_UNREF(z) && zone_status_get(z) >= ZONE_IS_DEAD);
1447 	mutex_exit(&z->zone_lock);
1448 
1449 	if (wakeup) {
1450 		/*
1451 		 * Grabbing zonehash_lock here effectively synchronizes with
1452 		 * zone_destroy() to avoid missed signals.
1453 		 */
1454 		mutex_enter(&zonehash_lock);
1455 		cv_broadcast(&zone_destroy_cv);
1456 		mutex_exit(&zonehash_lock);
1457 	}
1458 }
1459 
1460 void
1461 zone_cred_hold(zone_t *z)
1462 {
1463 	mutex_enter(&z->zone_lock);
1464 	z->zone_cred_ref++;
1465 	ASSERT(z->zone_cred_ref != 0);
1466 	mutex_exit(&z->zone_lock);
1467 }
1468 
1469 void
1470 zone_cred_rele(zone_t *z)
1471 {
1472 	boolean_t wakeup;
1473 
1474 	mutex_enter(&z->zone_lock);
1475 	ASSERT(z->zone_cred_ref != 0);
1476 	z->zone_cred_ref--;
1477 	if (z->zone_ref == 0 && z->zone_cred_ref == 0) {
1478 		/* no more refs, free the structure */
1479 		mutex_exit(&z->zone_lock);
1480 		zone_free(z);
1481 		return;
1482 	}
1483 	/*
1484 	 * If zone_destroy is waiting for the cred references to drain
1485 	 * out, and they have, signal it.
1486 	 */
1487 	wakeup = (zone_wait_for_cred && ZONE_IS_UNREF(z) &&
1488 	    zone_status_get(z) >= ZONE_IS_DEAD);
1489 	mutex_exit(&z->zone_lock);
1490 
1491 	if (wakeup) {
1492 		/*
1493 		 * Grabbing zonehash_lock here effectively synchronizes with
1494 		 * zone_destroy() to avoid missed signals.
1495 		 */
1496 		mutex_enter(&zonehash_lock);
1497 		cv_broadcast(&zone_destroy_cv);
1498 		mutex_exit(&zonehash_lock);
1499 	}
1500 }
1501 
1502 void
1503 zone_task_hold(zone_t *z)
1504 {
1505 	mutex_enter(&z->zone_lock);
1506 	z->zone_ntasks++;
1507 	ASSERT(z->zone_ntasks != 0);
1508 	mutex_exit(&z->zone_lock);
1509 }
1510 
1511 void
1512 zone_task_rele(zone_t *zone)
1513 {
1514 	uint_t refcnt;
1515 
1516 	mutex_enter(&zone->zone_lock);
1517 	ASSERT(zone->zone_ntasks != 0);
1518 	refcnt = --zone->zone_ntasks;
1519 	if (refcnt > 1)	{	/* Common case */
1520 		mutex_exit(&zone->zone_lock);
1521 		return;
1522 	}
1523 	zone_hold_locked(zone);	/* so we can use the zone_t later */
1524 	mutex_exit(&zone->zone_lock);
1525 	if (refcnt == 1) {
1526 		/*
1527 		 * See if the zone is shutting down.
1528 		 */
1529 		mutex_enter(&zone_status_lock);
1530 		if (zone_status_get(zone) != ZONE_IS_SHUTTING_DOWN) {
1531 			goto out;
1532 		}
1533 
1534 		/*
1535 		 * Make sure the ntasks didn't change since we
1536 		 * dropped zone_lock.
1537 		 */
1538 		mutex_enter(&zone->zone_lock);
1539 		if (refcnt != zone->zone_ntasks) {
1540 			mutex_exit(&zone->zone_lock);
1541 			goto out;
1542 		}
1543 		mutex_exit(&zone->zone_lock);
1544 
1545 		/*
1546 		 * No more user processes in the zone.  The zone is empty.
1547 		 */
1548 		zone_status_set(zone, ZONE_IS_EMPTY);
1549 		goto out;
1550 	}
1551 
1552 	ASSERT(refcnt == 0);
1553 	/*
1554 	 * zsched has exited; the zone is dead.
1555 	 */
1556 	zone->zone_zsched = NULL;		/* paranoia */
1557 	mutex_enter(&zone_status_lock);
1558 	zone_status_set(zone, ZONE_IS_DEAD);
1559 out:
1560 	mutex_exit(&zone_status_lock);
1561 	zone_rele(zone);
1562 }
1563 
1564 zoneid_t
1565 getzoneid(void)
1566 {
1567 	return (curproc->p_zone->zone_id);
1568 }
1569 
1570 /*
1571  * Internal versions of zone_find_by_*().  These don't zone_hold() or
1572  * check the validity of a zone's state.
1573  */
1574 static zone_t *
1575 zone_find_all_by_id(zoneid_t zoneid)
1576 {
1577 	mod_hash_val_t hv;
1578 	zone_t *zone = NULL;
1579 
1580 	ASSERT(MUTEX_HELD(&zonehash_lock));
1581 
1582 	if (mod_hash_find(zonehashbyid,
1583 	    (mod_hash_key_t)(uintptr_t)zoneid, &hv) == 0)
1584 		zone = (zone_t *)hv;
1585 	return (zone);
1586 }
1587 
1588 static zone_t *
1589 zone_find_all_by_label(const ts_label_t *label)
1590 {
1591 	mod_hash_val_t hv;
1592 	zone_t *zone = NULL;
1593 
1594 	ASSERT(MUTEX_HELD(&zonehash_lock));
1595 
1596 	/*
1597 	 * zonehashbylabel is not maintained for unlabeled systems
1598 	 */
1599 	if (!is_system_labeled())
1600 		return (NULL);
1601 	if (mod_hash_find(zonehashbylabel, (mod_hash_key_t)label, &hv) == 0)
1602 		zone = (zone_t *)hv;
1603 	return (zone);
1604 }
1605 
1606 static zone_t *
1607 zone_find_all_by_name(char *name)
1608 {
1609 	mod_hash_val_t hv;
1610 	zone_t *zone = NULL;
1611 
1612 	ASSERT(MUTEX_HELD(&zonehash_lock));
1613 
1614 	if (mod_hash_find(zonehashbyname, (mod_hash_key_t)name, &hv) == 0)
1615 		zone = (zone_t *)hv;
1616 	return (zone);
1617 }
1618 
1619 /*
1620  * Public interface for looking up a zone by zoneid.  Only returns the zone if
1621  * it is fully initialized, and has not yet begun the zone_destroy() sequence.
1622  * Caller must call zone_rele() once it is done with the zone.
1623  *
1624  * The zone may begin the zone_destroy() sequence immediately after this
1625  * function returns, but may be safely used until zone_rele() is called.
1626  */
1627 zone_t *
1628 zone_find_by_id(zoneid_t zoneid)
1629 {
1630 	zone_t *zone;
1631 	zone_status_t status;
1632 
1633 	mutex_enter(&zonehash_lock);
1634 	if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
1635 		mutex_exit(&zonehash_lock);
1636 		return (NULL);
1637 	}
1638 	status = zone_status_get(zone);
1639 	if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
1640 		/*
1641 		 * For all practical purposes the zone doesn't exist.
1642 		 */
1643 		mutex_exit(&zonehash_lock);
1644 		return (NULL);
1645 	}
1646 	zone_hold(zone);
1647 	mutex_exit(&zonehash_lock);
1648 	return (zone);
1649 }
1650 
1651 /*
1652  * Similar to zone_find_by_id, but using zone label as the key.
1653  */
1654 zone_t *
1655 zone_find_by_label(const ts_label_t *label)
1656 {
1657 	zone_t *zone;
1658 
1659 	mutex_enter(&zonehash_lock);
1660 	if ((zone = zone_find_all_by_label(label)) == NULL) {
1661 		mutex_exit(&zonehash_lock);
1662 		return (NULL);
1663 	}
1664 	mutex_enter(&zone_status_lock);
1665 	if (zone_status_get(zone) > ZONE_IS_DOWN) {
1666 		/*
1667 		 * For all practical purposes the zone doesn't exist.
1668 		 */
1669 		mutex_exit(&zone_status_lock);
1670 		zone = NULL;
1671 	} else {
1672 		mutex_exit(&zone_status_lock);
1673 		zone_hold(zone);
1674 	}
1675 	mutex_exit(&zonehash_lock);
1676 	return (zone);
1677 }
1678 
1679 /*
1680  * Similar to zone_find_by_id, but using zone name as the key.
1681  */
1682 zone_t *
1683 zone_find_by_name(char *name)
1684 {
1685 	zone_t *zone;
1686 	zone_status_t status;
1687 
1688 	mutex_enter(&zonehash_lock);
1689 	if ((zone = zone_find_all_by_name(name)) == NULL) {
1690 		mutex_exit(&zonehash_lock);
1691 		return (NULL);
1692 	}
1693 	status = zone_status_get(zone);
1694 	if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
1695 		/*
1696 		 * For all practical purposes the zone doesn't exist.
1697 		 */
1698 		mutex_exit(&zonehash_lock);
1699 		return (NULL);
1700 	}
1701 	zone_hold(zone);
1702 	mutex_exit(&zonehash_lock);
1703 	return (zone);
1704 }
1705 
1706 /*
1707  * Similar to zone_find_by_id(), using the path as a key.  For instance,
1708  * if there is a zone "foo" rooted at /foo/root, and the path argument
1709  * is "/foo/root/proc", it will return the held zone_t corresponding to
1710  * zone "foo".
1711  *
1712  * zone_find_by_path() always returns a non-NULL value, since at the
1713  * very least every path will be contained in the global zone.
1714  *
1715  * As with the other zone_find_by_*() functions, the caller is
1716  * responsible for zone_rele()ing the return value of this function.
1717  */
1718 zone_t *
1719 zone_find_by_path(const char *path)
1720 {
1721 	zone_t *zone;
1722 	zone_t *zret = NULL;
1723 	zone_status_t status;
1724 
1725 	if (path == NULL) {
1726 		/*
1727 		 * Call from rootconf().
1728 		 */
1729 		zone_hold(global_zone);
1730 		return (global_zone);
1731 	}
1732 	ASSERT(*path == '/');
1733 	mutex_enter(&zonehash_lock);
1734 	for (zone = list_head(&zone_active); zone != NULL;
1735 	    zone = list_next(&zone_active, zone)) {
1736 		if (ZONE_PATH_VISIBLE(path, zone))
1737 			zret = zone;
1738 	}
1739 	ASSERT(zret != NULL);
1740 	status = zone_status_get(zret);
1741 	if (status < ZONE_IS_READY || status > ZONE_IS_DOWN) {
1742 		/*
1743 		 * Zone practically doesn't exist.
1744 		 */
1745 		zret = global_zone;
1746 	}
1747 	zone_hold(zret);
1748 	mutex_exit(&zonehash_lock);
1749 	return (zret);
1750 }
1751 
1752 /*
1753  * Get the number of cpus visible to this zone.  The system-wide global
1754  * 'ncpus' is returned if pools are disabled, the caller is in the
1755  * global zone, or a NULL zone argument is passed in.
1756  */
1757 int
1758 zone_ncpus_get(zone_t *zone)
1759 {
1760 	int myncpus = zone == NULL ? 0 : zone->zone_ncpus;
1761 
1762 	return (myncpus != 0 ? myncpus : ncpus);
1763 }
1764 
1765 /*
1766  * Get the number of online cpus visible to this zone.  The system-wide
1767  * global 'ncpus_online' is returned if pools are disabled, the caller
1768  * is in the global zone, or a NULL zone argument is passed in.
1769  */
1770 int
1771 zone_ncpus_online_get(zone_t *zone)
1772 {
1773 	int myncpus_online = zone == NULL ? 0 : zone->zone_ncpus_online;
1774 
1775 	return (myncpus_online != 0 ? myncpus_online : ncpus_online);
1776 }
1777 
1778 /*
1779  * Return the pool to which the zone is currently bound.
1780  */
1781 pool_t *
1782 zone_pool_get(zone_t *zone)
1783 {
1784 	ASSERT(pool_lock_held());
1785 
1786 	return (zone->zone_pool);
1787 }
1788 
1789 /*
1790  * Set the zone's pool pointer and update the zone's visibility to match
1791  * the resources in the new pool.
1792  */
1793 void
1794 zone_pool_set(zone_t *zone, pool_t *pool)
1795 {
1796 	ASSERT(pool_lock_held());
1797 	ASSERT(MUTEX_HELD(&cpu_lock));
1798 
1799 	zone->zone_pool = pool;
1800 	zone_pset_set(zone, pool->pool_pset->pset_id);
1801 }
1802 
1803 /*
1804  * Return the cached value of the id of the processor set to which the
1805  * zone is currently bound.  The value will be ZONE_PS_INVAL if the pools
1806  * facility is disabled.
1807  */
1808 psetid_t
1809 zone_pset_get(zone_t *zone)
1810 {
1811 	ASSERT(MUTEX_HELD(&cpu_lock));
1812 
1813 	return (zone->zone_psetid);
1814 }
1815 
1816 /*
1817  * Set the cached value of the id of the processor set to which the zone
1818  * is currently bound.  Also update the zone's visibility to match the
1819  * resources in the new processor set.
1820  */
1821 void
1822 zone_pset_set(zone_t *zone, psetid_t newpsetid)
1823 {
1824 	psetid_t oldpsetid;
1825 
1826 	ASSERT(MUTEX_HELD(&cpu_lock));
1827 	oldpsetid = zone_pset_get(zone);
1828 
1829 	if (oldpsetid == newpsetid)
1830 		return;
1831 	/*
1832 	 * Global zone sees all.
1833 	 */
1834 	if (zone != global_zone) {
1835 		zone->zone_psetid = newpsetid;
1836 		if (newpsetid != ZONE_PS_INVAL)
1837 			pool_pset_visibility_add(newpsetid, zone);
1838 		if (oldpsetid != ZONE_PS_INVAL)
1839 			pool_pset_visibility_remove(oldpsetid, zone);
1840 	}
1841 	/*
1842 	 * Disabling pools, so we should start using the global values
1843 	 * for ncpus and ncpus_online.
1844 	 */
1845 	if (newpsetid == ZONE_PS_INVAL) {
1846 		zone->zone_ncpus = 0;
1847 		zone->zone_ncpus_online = 0;
1848 	}
1849 }
1850 
1851 /*
1852  * Walk the list of active zones and issue the provided callback for
1853  * each of them.
1854  *
1855  * Caller must not be holding any locks that may be acquired under
1856  * zonehash_lock.  See comment at the beginning of the file for a list of
1857  * common locks and their interactions with zones.
1858  */
1859 int
1860 zone_walk(int (*cb)(zone_t *, void *), void *data)
1861 {
1862 	zone_t *zone;
1863 	int ret = 0;
1864 	zone_status_t status;
1865 
1866 	mutex_enter(&zonehash_lock);
1867 	for (zone = list_head(&zone_active); zone != NULL;
1868 	    zone = list_next(&zone_active, zone)) {
1869 		/*
1870 		 * Skip zones that shouldn't be externally visible.
1871 		 */
1872 		status = zone_status_get(zone);
1873 		if (status < ZONE_IS_READY || status > ZONE_IS_DOWN)
1874 			continue;
1875 		/*
1876 		 * Bail immediately if any callback invocation returns a
1877 		 * non-zero value.
1878 		 */
1879 		ret = (*cb)(zone, data);
1880 		if (ret != 0)
1881 			break;
1882 	}
1883 	mutex_exit(&zonehash_lock);
1884 	return (ret);
1885 }
1886 
1887 static int
1888 zone_set_root(zone_t *zone, const char *upath)
1889 {
1890 	vnode_t *vp;
1891 	int trycount;
1892 	int error = 0;
1893 	char *path;
1894 	struct pathname upn, pn;
1895 	size_t pathlen;
1896 
1897 	if ((error = pn_get((char *)upath, UIO_USERSPACE, &upn)) != 0)
1898 		return (error);
1899 
1900 	pn_alloc(&pn);
1901 
1902 	/* prevent infinite loop */
1903 	trycount = 10;
1904 	for (;;) {
1905 		if (--trycount <= 0) {
1906 			error = ESTALE;
1907 			goto out;
1908 		}
1909 
1910 		if ((error = lookuppn(&upn, &pn, FOLLOW, NULLVPP, &vp)) == 0) {
1911 			/*
1912 			 * VOP_ACCESS() may cover 'vp' with a new
1913 			 * filesystem, if 'vp' is an autoFS vnode.
1914 			 * Get the new 'vp' if so.
1915 			 */
1916 			if ((error = VOP_ACCESS(vp, VEXEC, 0, CRED())) == 0 &&
1917 			    (vp->v_vfsmountedhere == NULL ||
1918 			    (error = traverse(&vp)) == 0)) {
1919 				pathlen = pn.pn_pathlen + 2;
1920 				path = kmem_alloc(pathlen, KM_SLEEP);
1921 				(void) strncpy(path, pn.pn_path,
1922 				    pn.pn_pathlen + 1);
1923 				path[pathlen - 2] = '/';
1924 				path[pathlen - 1] = '\0';
1925 				pn_free(&pn);
1926 				pn_free(&upn);
1927 
1928 				/* Success! */
1929 				break;
1930 			}
1931 			VN_RELE(vp);
1932 		}
1933 		if (error != ESTALE)
1934 			goto out;
1935 	}
1936 
1937 	ASSERT(error == 0);
1938 	zone->zone_rootvp = vp;		/* we hold a reference to vp */
1939 	zone->zone_rootpath = path;
1940 	zone->zone_rootpathlen = pathlen;
1941 	if (pathlen > 5 && strcmp(path + pathlen - 5, "/lu/") == 0)
1942 		zone->zone_flags |= ZF_IS_SCRATCH;
1943 	return (0);
1944 
1945 out:
1946 	pn_free(&pn);
1947 	pn_free(&upn);
1948 	return (error);
1949 }
1950 
1951 #define	isalnum(c)	(((c) >= '0' && (c) <= '9') || \
1952 			((c) >= 'a' && (c) <= 'z') || \
1953 			((c) >= 'A' && (c) <= 'Z'))
1954 
1955 static int
1956 zone_set_name(zone_t *zone, const char *uname)
1957 {
1958 	char *kname = kmem_zalloc(ZONENAME_MAX, KM_SLEEP);
1959 	size_t len;
1960 	int i, err;
1961 
1962 	if ((err = copyinstr(uname, kname, ZONENAME_MAX, &len)) != 0) {
1963 		kmem_free(kname, ZONENAME_MAX);
1964 		return (err);	/* EFAULT or ENAMETOOLONG */
1965 	}
1966 
1967 	/* must be less than ZONENAME_MAX */
1968 	if (len == ZONENAME_MAX && kname[ZONENAME_MAX - 1] != '\0') {
1969 		kmem_free(kname, ZONENAME_MAX);
1970 		return (EINVAL);
1971 	}
1972 
1973 	/*
1974 	 * Name must start with an alphanumeric and must contain only
1975 	 * alphanumerics, '-', '_' and '.'.
1976 	 */
1977 	if (!isalnum(kname[0])) {
1978 		kmem_free(kname, ZONENAME_MAX);
1979 		return (EINVAL);
1980 	}
1981 	for (i = 1; i < len - 1; i++) {
1982 		if (!isalnum(kname[i]) && kname[i] != '-' && kname[i] != '_' &&
1983 		    kname[i] != '.') {
1984 			kmem_free(kname, ZONENAME_MAX);
1985 			return (EINVAL);
1986 		}
1987 	}
1988 
1989 	zone->zone_name = kname;
1990 	return (0);
1991 }
1992 
1993 /*
1994  * Similar to thread_create(), but makes sure the thread is in the appropriate
1995  * zone's zsched process (curproc->p_zone->zone_zsched) before returning.
1996  */
1997 /*ARGSUSED*/
1998 kthread_t *
1999 zthread_create(
2000     caddr_t stk,
2001     size_t stksize,
2002     void (*proc)(),
2003     void *arg,
2004     size_t len,
2005     pri_t pri)
2006 {
2007 	kthread_t *t;
2008 	zone_t *zone = curproc->p_zone;
2009 	proc_t *pp = zone->zone_zsched;
2010 
2011 	zone_hold(zone);	/* Reference to be dropped when thread exits */
2012 
2013 	/*
2014 	 * No-one should be trying to create threads if the zone is shutting
2015 	 * down and there aren't any kernel threads around.  See comment
2016 	 * in zthread_exit().
2017 	 */
2018 	ASSERT(!(zone->zone_kthreads == NULL &&
2019 	    zone_status_get(zone) >= ZONE_IS_EMPTY));
2020 	/*
2021 	 * Create a thread, but don't let it run until we've finished setting
2022 	 * things up.
2023 	 */
2024 	t = thread_create(stk, stksize, proc, arg, len, pp, TS_STOPPED, pri);
2025 	ASSERT(t->t_forw == NULL);
2026 	mutex_enter(&zone_status_lock);
2027 	if (zone->zone_kthreads == NULL) {
2028 		t->t_forw = t->t_back = t;
2029 	} else {
2030 		kthread_t *tx = zone->zone_kthreads;
2031 
2032 		t->t_forw = tx;
2033 		t->t_back = tx->t_back;
2034 		tx->t_back->t_forw = t;
2035 		tx->t_back = t;
2036 	}
2037 	zone->zone_kthreads = t;
2038 	mutex_exit(&zone_status_lock);
2039 
2040 	mutex_enter(&pp->p_lock);
2041 	t->t_proc_flag |= TP_ZTHREAD;
2042 	project_rele(t->t_proj);
2043 	t->t_proj = project_hold(pp->p_task->tk_proj);
2044 
2045 	/*
2046 	 * Setup complete, let it run.
2047 	 */
2048 	thread_lock(t);
2049 	t->t_schedflag |= TS_ALLSTART;
2050 	setrun_locked(t);
2051 	thread_unlock(t);
2052 
2053 	mutex_exit(&pp->p_lock);
2054 
2055 	return (t);
2056 }
2057 
2058 /*
2059  * Similar to thread_exit().  Must be called by threads created via
2060  * zthread_exit().
2061  */
2062 void
2063 zthread_exit(void)
2064 {
2065 	kthread_t *t = curthread;
2066 	proc_t *pp = curproc;
2067 	zone_t *zone = pp->p_zone;
2068 
2069 	mutex_enter(&zone_status_lock);
2070 
2071 	/*
2072 	 * Reparent to p0
2073 	 */
2074 	kpreempt_disable();
2075 	mutex_enter(&pp->p_lock);
2076 	t->t_proc_flag &= ~TP_ZTHREAD;
2077 	t->t_procp = &p0;
2078 	hat_thread_exit(t);
2079 	mutex_exit(&pp->p_lock);
2080 	kpreempt_enable();
2081 
2082 	if (t->t_back == t) {
2083 		ASSERT(t->t_forw == t);
2084 		/*
2085 		 * If the zone is empty, once the thread count
2086 		 * goes to zero no further kernel threads can be
2087 		 * created.  This is because if the creator is a process
2088 		 * in the zone, then it must have exited before the zone
2089 		 * state could be set to ZONE_IS_EMPTY.
2090 		 * Otherwise, if the creator is a kernel thread in the
2091 		 * zone, the thread count is non-zero.
2092 		 *
2093 		 * This really means that non-zone kernel threads should
2094 		 * not create zone kernel threads.
2095 		 */
2096 		zone->zone_kthreads = NULL;
2097 		if (zone_status_get(zone) == ZONE_IS_EMPTY) {
2098 			zone_status_set(zone, ZONE_IS_DOWN);
2099 		}
2100 	} else {
2101 		t->t_forw->t_back = t->t_back;
2102 		t->t_back->t_forw = t->t_forw;
2103 		if (zone->zone_kthreads == t)
2104 			zone->zone_kthreads = t->t_forw;
2105 	}
2106 	mutex_exit(&zone_status_lock);
2107 	zone_rele(zone);
2108 	thread_exit();
2109 	/* NOTREACHED */
2110 }
2111 
2112 static void
2113 zone_chdir(vnode_t *vp, vnode_t **vpp, proc_t *pp)
2114 {
2115 	vnode_t *oldvp;
2116 
2117 	/* we're going to hold a reference here to the directory */
2118 	VN_HOLD(vp);
2119 
2120 #ifdef C2_AUDIT
2121 	if (audit_active)	/* update abs cwd/root path see c2audit.c */
2122 		audit_chdirec(vp, vpp);
2123 #endif
2124 
2125 	mutex_enter(&pp->p_lock);
2126 	oldvp = *vpp;
2127 	*vpp = vp;
2128 	mutex_exit(&pp->p_lock);
2129 	if (oldvp != NULL)
2130 		VN_RELE(oldvp);
2131 }
2132 
2133 /*
2134  * Convert an rctl value represented by an nvlist_t into an rctl_val_t.
2135  */
2136 static int
2137 nvlist2rctlval(nvlist_t *nvl, rctl_val_t *rv)
2138 {
2139 	nvpair_t *nvp = NULL;
2140 	boolean_t priv_set = B_FALSE;
2141 	boolean_t limit_set = B_FALSE;
2142 	boolean_t action_set = B_FALSE;
2143 
2144 	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
2145 		const char *name;
2146 		uint64_t ui64;
2147 
2148 		name = nvpair_name(nvp);
2149 		if (nvpair_type(nvp) != DATA_TYPE_UINT64)
2150 			return (EINVAL);
2151 		(void) nvpair_value_uint64(nvp, &ui64);
2152 		if (strcmp(name, "privilege") == 0) {
2153 			/*
2154 			 * Currently only privileged values are allowed, but
2155 			 * this may change in the future.
2156 			 */
2157 			if (ui64 != RCPRIV_PRIVILEGED)
2158 				return (EINVAL);
2159 			rv->rcv_privilege = ui64;
2160 			priv_set = B_TRUE;
2161 		} else if (strcmp(name, "limit") == 0) {
2162 			rv->rcv_value = ui64;
2163 			limit_set = B_TRUE;
2164 		} else if (strcmp(name, "action") == 0) {
2165 			if (ui64 != RCTL_LOCAL_NOACTION &&
2166 			    ui64 != RCTL_LOCAL_DENY)
2167 				return (EINVAL);
2168 			rv->rcv_flagaction = ui64;
2169 			action_set = B_TRUE;
2170 		} else {
2171 			return (EINVAL);
2172 		}
2173 	}
2174 
2175 	if (!(priv_set && limit_set && action_set))
2176 		return (EINVAL);
2177 	rv->rcv_action_signal = 0;
2178 	rv->rcv_action_recipient = NULL;
2179 	rv->rcv_action_recip_pid = -1;
2180 	rv->rcv_firing_time = 0;
2181 
2182 	return (0);
2183 }
2184 
2185 void
2186 zone_icode(void)
2187 {
2188 	proc_t *p = ttoproc(curthread);
2189 	struct core_globals	*cg;
2190 
2191 	/*
2192 	 * For all purposes (ZONE_ATTR_INITPID and restart_init),
2193 	 * storing just the pid of init is sufficient.
2194 	 */
2195 	p->p_zone->zone_proc_initpid = p->p_pid;
2196 
2197 	/*
2198 	 * Allocate user address space and stack segment
2199 	 */
2200 
2201 	p->p_cstime = p->p_stime = p->p_cutime = p->p_utime = 0;
2202 	p->p_usrstack = (caddr_t)USRSTACK32;
2203 	p->p_model = DATAMODEL_ILP32;
2204 	p->p_stkprot = PROT_ZFOD & ~PROT_EXEC;
2205 	p->p_datprot = PROT_ZFOD & ~PROT_EXEC;
2206 	p->p_stk_ctl = INT32_MAX;
2207 
2208 	p->p_as = as_alloc();
2209 	p->p_as->a_userlimit = (caddr_t)USERLIMIT32;
2210 	(void) hat_setup(p->p_as->a_hat, HAT_INIT);
2211 
2212 	cg = zone_getspecific(core_zone_key, p->p_zone);
2213 	ASSERT(cg != NULL);
2214 	corectl_path_hold(cg->core_default_path);
2215 	corectl_content_hold(cg->core_default_content);
2216 	p->p_corefile = cg->core_default_path;
2217 	p->p_content = cg->core_default_content;
2218 
2219 	init_mstate(curthread, LMS_SYSTEM);
2220 
2221 	p->p_zone->zone_boot_err = exec_init(zone_initname, 0,
2222 	    p->p_zone->zone_bootargs);
2223 
2224 	mutex_enter(&zone_status_lock);
2225 	if (p->p_zone->zone_boot_err != 0) {
2226 		/*
2227 		 * Make sure we are still in the booting state-- we could have
2228 		 * raced and already be shutting down, or even further along.
2229 		 */
2230 		if (zone_status_get(p->p_zone) == ZONE_IS_BOOTING)
2231 			zone_status_set(p->p_zone, ZONE_IS_SHUTTING_DOWN);
2232 		mutex_exit(&zone_status_lock);
2233 		/* It's gone bad, dispose of the process */
2234 		if (proc_exit(CLD_EXITED, p->p_zone->zone_boot_err) != 0) {
2235 			mutex_enter(&p->p_lock);
2236 			ASSERT(p->p_flag & SEXITLWPS);
2237 			lwp_exit();
2238 		}
2239 	} else {
2240 		if (zone_status_get(p->p_zone) == ZONE_IS_BOOTING)
2241 			zone_status_set(p->p_zone, ZONE_IS_RUNNING);
2242 		mutex_exit(&zone_status_lock);
2243 		/* cause the process to return to userland. */
2244 		lwp_rtt();
2245 	}
2246 }
2247 
2248 struct zsched_arg {
2249 	zone_t *zone;
2250 	nvlist_t *nvlist;
2251 };
2252 
2253 /*
2254  * Per-zone "sched" workalike.  The similarity to "sched" doesn't have
2255  * anything to do with scheduling, but rather with the fact that
2256  * per-zone kernel threads are parented to zsched, just like regular
2257  * kernel threads are parented to sched (p0).
2258  *
2259  * zsched is also responsible for launching init for the zone.
2260  */
2261 static void
2262 zsched(void *arg)
2263 {
2264 	struct zsched_arg *za = arg;
2265 	proc_t *pp = curproc;
2266 	proc_t *initp = proc_init;
2267 	zone_t *zone = za->zone;
2268 	cred_t *cr, *oldcred;
2269 	rctl_set_t *set;
2270 	rctl_alloc_gp_t *gp;
2271 	contract_t *ct = NULL;
2272 	task_t *tk, *oldtk;
2273 	rctl_entity_p_t e;
2274 	kproject_t *pj;
2275 
2276 	nvlist_t *nvl = za->nvlist;
2277 	nvpair_t *nvp = NULL;
2278 
2279 	bcopy("zsched", u.u_psargs, sizeof ("zsched"));
2280 	bcopy("zsched", u.u_comm, sizeof ("zsched"));
2281 	u.u_argc = 0;
2282 	u.u_argv = NULL;
2283 	u.u_envp = NULL;
2284 	closeall(P_FINFO(pp));
2285 
2286 	/*
2287 	 * We are this zone's "zsched" process.  As the zone isn't generally
2288 	 * visible yet we don't need to grab any locks before initializing its
2289 	 * zone_proc pointer.
2290 	 */
2291 	zone_hold(zone);  /* this hold is released by zone_destroy() */
2292 	zone->zone_zsched = pp;
2293 	mutex_enter(&pp->p_lock);
2294 	pp->p_zone = zone;
2295 	mutex_exit(&pp->p_lock);
2296 
2297 	/*
2298 	 * Disassociate process from its 'parent'; parent ourselves to init
2299 	 * (pid 1) and change other values as needed.
2300 	 */
2301 	sess_create();
2302 
2303 	mutex_enter(&pidlock);
2304 	proc_detach(pp);
2305 	pp->p_ppid = 1;
2306 	pp->p_flag |= SZONETOP;
2307 	pp->p_ancpid = 1;
2308 	pp->p_parent = initp;
2309 	pp->p_psibling = NULL;
2310 	if (initp->p_child)
2311 		initp->p_child->p_psibling = pp;
2312 	pp->p_sibling = initp->p_child;
2313 	initp->p_child = pp;
2314 
2315 	/* Decrement what newproc() incremented. */
2316 	upcount_dec(crgetruid(CRED()), GLOBAL_ZONEID);
2317 	/*
2318 	 * Our credentials are about to become kcred-like, so we don't care
2319 	 * about the caller's ruid.
2320 	 */
2321 	upcount_inc(crgetruid(kcred), zone->zone_id);
2322 	mutex_exit(&pidlock);
2323 
2324 	/*
2325 	 * getting out of global zone, so decrement lwp counts
2326 	 */
2327 	pj = pp->p_task->tk_proj;
2328 	mutex_enter(&global_zone->zone_nlwps_lock);
2329 	pj->kpj_nlwps -= pp->p_lwpcnt;
2330 	global_zone->zone_nlwps -= pp->p_lwpcnt;
2331 	mutex_exit(&global_zone->zone_nlwps_lock);
2332 
2333 	/*
2334 	 * Create and join a new task in project '0' of this zone.
2335 	 *
2336 	 * We don't need to call holdlwps() since we know we're the only lwp in
2337 	 * this process.
2338 	 *
2339 	 * task_join() returns with p_lock held.
2340 	 */
2341 	tk = task_create(0, zone);
2342 	mutex_enter(&cpu_lock);
2343 	oldtk = task_join(tk, 0);
2344 	mutex_exit(&curproc->p_lock);
2345 	mutex_exit(&cpu_lock);
2346 	task_rele(oldtk);
2347 
2348 	/*
2349 	 * add lwp counts to zsched's zone, and increment project's task count
2350 	 * due to the task created in the above tasksys_settaskid
2351 	 */
2352 	pj = pp->p_task->tk_proj;
2353 	mutex_enter(&zone->zone_nlwps_lock);
2354 	pj->kpj_nlwps += pp->p_lwpcnt;
2355 	pj->kpj_ntasks += 1;
2356 	zone->zone_nlwps += pp->p_lwpcnt;
2357 	mutex_exit(&zone->zone_nlwps_lock);
2358 
2359 	/*
2360 	 * The process was created by a process in the global zone, hence the
2361 	 * credentials are wrong.  We might as well have kcred-ish credentials.
2362 	 */
2363 	cr = zone->zone_kcred;
2364 	crhold(cr);
2365 	mutex_enter(&pp->p_crlock);
2366 	oldcred = pp->p_cred;
2367 	pp->p_cred = cr;
2368 	mutex_exit(&pp->p_crlock);
2369 	crfree(oldcred);
2370 
2371 	/*
2372 	 * Hold credentials again (for thread)
2373 	 */
2374 	crhold(cr);
2375 
2376 	/*
2377 	 * p_lwpcnt can't change since this is a kernel process.
2378 	 */
2379 	crset(pp, cr);
2380 
2381 	/*
2382 	 * Chroot
2383 	 */
2384 	zone_chdir(zone->zone_rootvp, &PTOU(pp)->u_cdir, pp);
2385 	zone_chdir(zone->zone_rootvp, &PTOU(pp)->u_rdir, pp);
2386 
2387 	/*
2388 	 * Initialize zone's rctl set.
2389 	 */
2390 	set = rctl_set_create();
2391 	gp = rctl_set_init_prealloc(RCENTITY_ZONE);
2392 	mutex_enter(&pp->p_lock);
2393 	e.rcep_p.zone = zone;
2394 	e.rcep_t = RCENTITY_ZONE;
2395 	zone->zone_rctls = rctl_set_init(RCENTITY_ZONE, pp, &e, set, gp);
2396 	mutex_exit(&pp->p_lock);
2397 	rctl_prealloc_destroy(gp);
2398 
2399 	/*
2400 	 * Apply the rctls passed in to zone_create().  This is basically a list
2401 	 * assignment: all of the old values are removed and the new ones
2402 	 * inserted.  That is, if an empty list is passed in, all values are
2403 	 * removed.
2404 	 */
2405 	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
2406 		rctl_dict_entry_t *rde;
2407 		rctl_hndl_t hndl;
2408 		char *name;
2409 		nvlist_t **nvlarray;
2410 		uint_t i, nelem;
2411 		int error;	/* For ASSERT()s */
2412 
2413 		name = nvpair_name(nvp);
2414 		hndl = rctl_hndl_lookup(name);
2415 		ASSERT(hndl != -1);
2416 		rde = rctl_dict_lookup_hndl(hndl);
2417 		ASSERT(rde != NULL);
2418 
2419 		for (; /* ever */; ) {
2420 			rctl_val_t oval;
2421 
2422 			mutex_enter(&pp->p_lock);
2423 			error = rctl_local_get(hndl, NULL, &oval, pp);
2424 			mutex_exit(&pp->p_lock);
2425 			ASSERT(error == 0);	/* Can't fail for RCTL_FIRST */
2426 			ASSERT(oval.rcv_privilege != RCPRIV_BASIC);
2427 			if (oval.rcv_privilege == RCPRIV_SYSTEM)
2428 				break;
2429 			mutex_enter(&pp->p_lock);
2430 			error = rctl_local_delete(hndl, &oval, pp);
2431 			mutex_exit(&pp->p_lock);
2432 			ASSERT(error == 0);
2433 		}
2434 		error = nvpair_value_nvlist_array(nvp, &nvlarray, &nelem);
2435 		ASSERT(error == 0);
2436 		for (i = 0; i < nelem; i++) {
2437 			rctl_val_t *nvalp;
2438 
2439 			nvalp = kmem_cache_alloc(rctl_val_cache, KM_SLEEP);
2440 			error = nvlist2rctlval(nvlarray[i], nvalp);
2441 			ASSERT(error == 0);
2442 			/*
2443 			 * rctl_local_insert can fail if the value being
2444 			 * inserted is a duplicate; this is OK.
2445 			 */
2446 			mutex_enter(&pp->p_lock);
2447 			if (rctl_local_insert(hndl, nvalp, pp) != 0)
2448 				kmem_cache_free(rctl_val_cache, nvalp);
2449 			mutex_exit(&pp->p_lock);
2450 		}
2451 	}
2452 	/*
2453 	 * Tell the world that we're done setting up.
2454 	 *
2455 	 * At this point we want to set the zone status to ZONE_IS_READY
2456 	 * and atomically set the zone's processor set visibility.  Once
2457 	 * we drop pool_lock() this zone will automatically get updated
2458 	 * to reflect any future changes to the pools configuration.
2459 	 */
2460 	pool_lock();
2461 	mutex_enter(&cpu_lock);
2462 	mutex_enter(&zonehash_lock);
2463 	zone_uniqid(zone);
2464 	zone_zsd_configure(zone);
2465 	if (pool_state == POOL_ENABLED)
2466 		zone_pset_set(zone, pool_default->pool_pset->pset_id);
2467 	mutex_enter(&zone_status_lock);
2468 	ASSERT(zone_status_get(zone) == ZONE_IS_UNINITIALIZED);
2469 	zone_status_set(zone, ZONE_IS_READY);
2470 	mutex_exit(&zone_status_lock);
2471 	mutex_exit(&zonehash_lock);
2472 	mutex_exit(&cpu_lock);
2473 	pool_unlock();
2474 
2475 	/*
2476 	 * Once we see the zone transition to the ZONE_IS_BOOTING state,
2477 	 * we launch init, and set the state to running.
2478 	 */
2479 	zone_status_wait_cpr(zone, ZONE_IS_BOOTING, "zsched");
2480 
2481 	if (zone_status_get(zone) == ZONE_IS_BOOTING) {
2482 		id_t cid;
2483 
2484 		/*
2485 		 * Ok, this is a little complicated.  We need to grab the
2486 		 * zone's pool's scheduling class ID; note that by now, we
2487 		 * are already bound to a pool if we need to be (zoneadmd
2488 		 * will have done that to us while we're in the READY
2489 		 * state).  *But* the scheduling class for the zone's 'init'
2490 		 * must be explicitly passed to newproc, which doesn't
2491 		 * respect pool bindings.
2492 		 *
2493 		 * We hold the pool_lock across the call to newproc() to
2494 		 * close the obvious race: the pool's scheduling class
2495 		 * could change before we manage to create the LWP with
2496 		 * classid 'cid'.
2497 		 */
2498 		pool_lock();
2499 		cid = pool_get_class(zone->zone_pool);
2500 		if (cid == -1)
2501 			cid = defaultcid;
2502 
2503 		/*
2504 		 * If this fails, zone_boot will ultimately fail.  The
2505 		 * state of the zone will be set to SHUTTING_DOWN-- userland
2506 		 * will have to tear down the zone, and fail, or try again.
2507 		 */
2508 		if ((zone->zone_boot_err = newproc(zone_icode, NULL, cid,
2509 		    minclsyspri - 1, &ct)) != 0) {
2510 			mutex_enter(&zone_status_lock);
2511 			zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
2512 			mutex_exit(&zone_status_lock);
2513 		}
2514 		pool_unlock();
2515 	}
2516 
2517 	/*
2518 	 * Wait for zone_destroy() to be called.  This is what we spend
2519 	 * most of our life doing.
2520 	 */
2521 	zone_status_wait_cpr(zone, ZONE_IS_DYING, "zsched");
2522 
2523 	if (ct)
2524 		/*
2525 		 * At this point the process contract should be empty.
2526 		 * (Though if it isn't, it's not the end of the world.)
2527 		 */
2528 		VERIFY(contract_abandon(ct, curproc, B_TRUE) == 0);
2529 
2530 	/*
2531 	 * Allow kcred to be freed when all referring processes
2532 	 * (including this one) go away.  We can't just do this in
2533 	 * zone_free because we need to wait for the zone_cred_ref to
2534 	 * drop to 0 before calling zone_free, and the existence of
2535 	 * zone_kcred will prevent that.  Thus, we call crfree here to
2536 	 * balance the crdup in zone_create.  The crhold calls earlier
2537 	 * in zsched will be dropped when the thread and process exit.
2538 	 */
2539 	crfree(zone->zone_kcred);
2540 	zone->zone_kcred = NULL;
2541 
2542 	exit(CLD_EXITED, 0);
2543 }
2544 
2545 /*
2546  * Helper function to determine if there are any submounts of the
2547  * provided path.  Used to make sure the zone doesn't "inherit" any
2548  * mounts from before it is created.
2549  */
2550 static uint_t
2551 zone_mount_count(const char *rootpath)
2552 {
2553 	vfs_t *vfsp;
2554 	uint_t count = 0;
2555 	size_t rootpathlen = strlen(rootpath);
2556 
2557 	/*
2558 	 * Holding zonehash_lock prevents race conditions with
2559 	 * vfs_list_add()/vfs_list_remove() since we serialize with
2560 	 * zone_find_by_path().
2561 	 */
2562 	ASSERT(MUTEX_HELD(&zonehash_lock));
2563 	/*
2564 	 * The rootpath must end with a '/'
2565 	 */
2566 	ASSERT(rootpath[rootpathlen - 1] == '/');
2567 
2568 	/*
2569 	 * This intentionally does not count the rootpath itself if that
2570 	 * happens to be a mount point.
2571 	 */
2572 	vfs_list_read_lock();
2573 	vfsp = rootvfs;
2574 	do {
2575 		if (strncmp(rootpath, refstr_value(vfsp->vfs_mntpt),
2576 		    rootpathlen) == 0)
2577 			count++;
2578 		vfsp = vfsp->vfs_next;
2579 	} while (vfsp != rootvfs);
2580 	vfs_list_unlock();
2581 	return (count);
2582 }
2583 
2584 /*
2585  * Helper function to make sure that a zone created on 'rootpath'
2586  * wouldn't end up containing other zones' rootpaths.
2587  */
2588 static boolean_t
2589 zone_is_nested(const char *rootpath)
2590 {
2591 	zone_t *zone;
2592 	size_t rootpathlen = strlen(rootpath);
2593 	size_t len;
2594 
2595 	ASSERT(MUTEX_HELD(&zonehash_lock));
2596 
2597 	for (zone = list_head(&zone_active); zone != NULL;
2598 	    zone = list_next(&zone_active, zone)) {
2599 		if (zone == global_zone)
2600 			continue;
2601 		len = strlen(zone->zone_rootpath);
2602 		if (strncmp(rootpath, zone->zone_rootpath,
2603 		    MIN(rootpathlen, len)) == 0)
2604 			return (B_TRUE);
2605 	}
2606 	return (B_FALSE);
2607 }
2608 
2609 static int
2610 zone_set_privset(zone_t *zone, const priv_set_t *zone_privs,
2611     size_t zone_privssz)
2612 {
2613 	priv_set_t *privs = kmem_alloc(sizeof (priv_set_t), KM_SLEEP);
2614 
2615 	if (zone_privssz < sizeof (priv_set_t))
2616 		return (set_errno(ENOMEM));
2617 
2618 	if (copyin(zone_privs, privs, sizeof (priv_set_t))) {
2619 		kmem_free(privs, sizeof (priv_set_t));
2620 		return (EFAULT);
2621 	}
2622 
2623 	zone->zone_privset = privs;
2624 	return (0);
2625 }
2626 
2627 /*
2628  * We make creative use of nvlists to pass in rctls from userland.  The list is
2629  * a list of the following structures:
2630  *
2631  * (name = rctl_name, value = nvpair_list_array)
2632  *
2633  * Where each element of the nvpair_list_array is of the form:
2634  *
2635  * [(name = "privilege", value = RCPRIV_PRIVILEGED),
2636  * 	(name = "limit", value = uint64_t),
2637  * 	(name = "action", value = (RCTL_LOCAL_NOACTION || RCTL_LOCAL_DENY))]
2638  */
2639 static int
2640 parse_rctls(caddr_t ubuf, size_t buflen, nvlist_t **nvlp)
2641 {
2642 	nvpair_t *nvp = NULL;
2643 	nvlist_t *nvl = NULL;
2644 	char *kbuf;
2645 	int error;
2646 	rctl_val_t rv;
2647 
2648 	*nvlp = NULL;
2649 
2650 	if (buflen == 0)
2651 		return (0);
2652 
2653 	if ((kbuf = kmem_alloc(buflen, KM_NOSLEEP)) == NULL)
2654 		return (ENOMEM);
2655 	if (copyin(ubuf, kbuf, buflen)) {
2656 		error = EFAULT;
2657 		goto out;
2658 	}
2659 	if (nvlist_unpack(kbuf, buflen, &nvl, KM_SLEEP) != 0) {
2660 		/*
2661 		 * nvl may have been allocated/free'd, but the value set to
2662 		 * non-NULL, so we reset it here.
2663 		 */
2664 		nvl = NULL;
2665 		error = EINVAL;
2666 		goto out;
2667 	}
2668 	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
2669 		rctl_dict_entry_t *rde;
2670 		rctl_hndl_t hndl;
2671 		nvlist_t **nvlarray;
2672 		uint_t i, nelem;
2673 		char *name;
2674 
2675 		error = EINVAL;
2676 		name = nvpair_name(nvp);
2677 		if (strncmp(nvpair_name(nvp), "zone.", sizeof ("zone.") - 1)
2678 		    != 0 || nvpair_type(nvp) != DATA_TYPE_NVLIST_ARRAY) {
2679 			goto out;
2680 		}
2681 		if ((hndl = rctl_hndl_lookup(name)) == -1) {
2682 			goto out;
2683 		}
2684 		rde = rctl_dict_lookup_hndl(hndl);
2685 		error = nvpair_value_nvlist_array(nvp, &nvlarray, &nelem);
2686 		ASSERT(error == 0);
2687 		for (i = 0; i < nelem; i++) {
2688 			if (error = nvlist2rctlval(nvlarray[i], &rv))
2689 				goto out;
2690 		}
2691 		if (rctl_invalid_value(rde, &rv)) {
2692 			error = EINVAL;
2693 			goto out;
2694 		}
2695 	}
2696 	error = 0;
2697 	*nvlp = nvl;
2698 out:
2699 	kmem_free(kbuf, buflen);
2700 	if (error && nvl != NULL)
2701 		nvlist_free(nvl);
2702 	return (error);
2703 }
2704 
2705 int
2706 zone_create_error(int er_error, int er_ext, int *er_out) {
2707 	if (er_out != NULL) {
2708 		if (copyout(&er_ext, er_out, sizeof (int))) {
2709 			return (set_errno(EFAULT));
2710 		}
2711 	}
2712 	return (set_errno(er_error));
2713 }
2714 
2715 static int
2716 zone_set_label(zone_t *zone, const bslabel_t *lab, uint32_t doi)
2717 {
2718 	ts_label_t *tsl;
2719 	bslabel_t blab;
2720 
2721 	/* Get label from user */
2722 	if (copyin(lab, &blab, sizeof (blab)) != 0)
2723 		return (EFAULT);
2724 	tsl = labelalloc(&blab, doi, KM_NOSLEEP);
2725 	if (tsl == NULL)
2726 		return (ENOMEM);
2727 
2728 	zone->zone_slabel = tsl;
2729 	return (0);
2730 }
2731 
2732 /*
2733  * Parses a comma-separated list of ZFS datasets into a per-zone dictionary.
2734  */
2735 static int
2736 parse_zfs(zone_t *zone, caddr_t ubuf, size_t buflen)
2737 {
2738 	char *kbuf;
2739 	char *dataset, *next;
2740 	zone_dataset_t *zd;
2741 	size_t len;
2742 
2743 	if (ubuf == NULL || buflen == 0)
2744 		return (0);
2745 
2746 	if ((kbuf = kmem_alloc(buflen, KM_NOSLEEP)) == NULL)
2747 		return (ENOMEM);
2748 
2749 	if (copyin(ubuf, kbuf, buflen) != 0) {
2750 		kmem_free(kbuf, buflen);
2751 		return (EFAULT);
2752 	}
2753 
2754 	dataset = next = kbuf;
2755 	for (;;) {
2756 		zd = kmem_alloc(sizeof (zone_dataset_t), KM_SLEEP);
2757 
2758 		next = strchr(dataset, ',');
2759 
2760 		if (next == NULL)
2761 			len = strlen(dataset);
2762 		else
2763 			len = next - dataset;
2764 
2765 		zd->zd_dataset = kmem_alloc(len + 1, KM_SLEEP);
2766 		bcopy(dataset, zd->zd_dataset, len);
2767 		zd->zd_dataset[len] = '\0';
2768 
2769 		list_insert_head(&zone->zone_datasets, zd);
2770 
2771 		if (next == NULL)
2772 			break;
2773 
2774 		dataset = next + 1;
2775 	}
2776 
2777 	kmem_free(kbuf, buflen);
2778 	return (0);
2779 }
2780 
2781 /*
2782  * System call to create/initialize a new zone named 'zone_name', rooted
2783  * at 'zone_root', with a zone-wide privilege limit set of 'zone_privs',
2784  * and initialized with the zone-wide rctls described in 'rctlbuf', and
2785  * with labeling set by 'match', 'doi', and 'label'.
2786  *
2787  * If extended error is non-null, we may use it to return more detailed
2788  * error information.
2789  */
2790 static zoneid_t
2791 zone_create(const char *zone_name, const char *zone_root,
2792     const priv_set_t *zone_privs, size_t zone_privssz,
2793     caddr_t rctlbuf, size_t rctlbufsz,
2794     caddr_t zfsbuf, size_t zfsbufsz, int *extended_error,
2795     int match, uint32_t doi, const bslabel_t *label)
2796 {
2797 	struct zsched_arg zarg;
2798 	nvlist_t *rctls = NULL;
2799 	proc_t *pp = curproc;
2800 	zone_t *zone, *ztmp;
2801 	zoneid_t zoneid;
2802 	int error;
2803 	int error2 = 0;
2804 	char *str;
2805 	cred_t *zkcr;
2806 	boolean_t insert_label_hash;
2807 
2808 	if (secpolicy_zone_config(CRED()) != 0)
2809 		return (set_errno(EPERM));
2810 
2811 	/* can't boot zone from within chroot environment */
2812 	if (PTOU(pp)->u_rdir != NULL && PTOU(pp)->u_rdir != rootdir)
2813 		return (zone_create_error(ENOTSUP, ZE_CHROOTED,
2814 		    extended_error));
2815 
2816 	zone = kmem_zalloc(sizeof (zone_t), KM_SLEEP);
2817 	zoneid = zone->zone_id = id_alloc(zoneid_space);
2818 	zone->zone_status = ZONE_IS_UNINITIALIZED;
2819 	zone->zone_pool = pool_default;
2820 	zone->zone_pool_mod = gethrtime();
2821 	zone->zone_psetid = ZONE_PS_INVAL;
2822 	zone->zone_ncpus = 0;
2823 	zone->zone_ncpus_online = 0;
2824 	mutex_init(&zone->zone_lock, NULL, MUTEX_DEFAULT, NULL);
2825 	mutex_init(&zone->zone_nlwps_lock, NULL, MUTEX_DEFAULT, NULL);
2826 	cv_init(&zone->zone_cv, NULL, CV_DEFAULT, NULL);
2827 	list_create(&zone->zone_zsd, sizeof (struct zsd_entry),
2828 	    offsetof(struct zsd_entry, zsd_linkage));
2829 	list_create(&zone->zone_datasets, sizeof (zone_dataset_t),
2830 	    offsetof(zone_dataset_t, zd_linkage));
2831 	rw_init(&zone->zone_mlps.mlpl_rwlock, NULL, RW_DEFAULT, NULL);
2832 
2833 	if ((error = zone_set_name(zone, zone_name)) != 0) {
2834 		zone_free(zone);
2835 		return (zone_create_error(error, 0, extended_error));
2836 	}
2837 
2838 	if ((error = zone_set_root(zone, zone_root)) != 0) {
2839 		zone_free(zone);
2840 		return (zone_create_error(error, 0, extended_error));
2841 	}
2842 	if ((error = zone_set_privset(zone, zone_privs, zone_privssz)) != 0) {
2843 		zone_free(zone);
2844 		return (zone_create_error(error, 0, extended_error));
2845 	}
2846 
2847 	/* initialize node name to be the same as zone name */
2848 	zone->zone_nodename = kmem_alloc(_SYS_NMLN, KM_SLEEP);
2849 	(void) strncpy(zone->zone_nodename, zone->zone_name, _SYS_NMLN);
2850 	zone->zone_nodename[_SYS_NMLN - 1] = '\0';
2851 
2852 	zone->zone_domain = kmem_alloc(_SYS_NMLN, KM_SLEEP);
2853 	zone->zone_domain[0] = '\0';
2854 	zone->zone_shares = 1;
2855 	zone->zone_bootargs = NULL;
2856 
2857 	/*
2858 	 * Zsched initializes the rctls.
2859 	 */
2860 	zone->zone_rctls = NULL;
2861 
2862 	if ((error = parse_rctls(rctlbuf, rctlbufsz, &rctls)) != 0) {
2863 		zone_free(zone);
2864 		return (zone_create_error(error, 0, extended_error));
2865 	}
2866 
2867 	if ((error = parse_zfs(zone, zfsbuf, zfsbufsz)) != 0) {
2868 		zone_free(zone);
2869 		return (set_errno(error));
2870 	}
2871 
2872 	/*
2873 	 * Read in the trusted system parameters:
2874 	 * match flag and sensitivity label.
2875 	 */
2876 	zone->zone_match = match;
2877 	if (is_system_labeled() && !(zone->zone_flags & ZF_IS_SCRATCH)) {
2878 		error = zone_set_label(zone, label, doi);
2879 		if (error != 0) {
2880 			zone_free(zone);
2881 			return (set_errno(error));
2882 		}
2883 		insert_label_hash = B_TRUE;
2884 	} else {
2885 		/* all zones get an admin_low label if system is not labeled */
2886 		zone->zone_slabel = l_admin_low;
2887 		label_hold(l_admin_low);
2888 		insert_label_hash = B_FALSE;
2889 	}
2890 
2891 	/*
2892 	 * Stop all lwps since that's what normally happens as part of fork().
2893 	 * This needs to happen before we grab any locks to avoid deadlock
2894 	 * (another lwp in the process could be waiting for the held lock).
2895 	 */
2896 	if (curthread != pp->p_agenttp && !holdlwps(SHOLDFORK)) {
2897 		zone_free(zone);
2898 		if (rctls)
2899 			nvlist_free(rctls);
2900 		return (zone_create_error(error, 0, extended_error));
2901 	}
2902 
2903 	if (block_mounts() == 0) {
2904 		mutex_enter(&pp->p_lock);
2905 		if (curthread != pp->p_agenttp)
2906 			continuelwps(pp);
2907 		mutex_exit(&pp->p_lock);
2908 		zone_free(zone);
2909 		if (rctls)
2910 			nvlist_free(rctls);
2911 		return (zone_create_error(error, 0, extended_error));
2912 	}
2913 
2914 	/*
2915 	 * Set up credential for kernel access.  After this, any errors
2916 	 * should go through the dance in errout rather than calling
2917 	 * zone_free directly.
2918 	 */
2919 	zone->zone_kcred = crdup(kcred);
2920 	crsetzone(zone->zone_kcred, zone);
2921 	priv_intersect(zone->zone_privset, &CR_PPRIV(zone->zone_kcred));
2922 	priv_intersect(zone->zone_privset, &CR_EPRIV(zone->zone_kcred));
2923 	priv_intersect(zone->zone_privset, &CR_IPRIV(zone->zone_kcred));
2924 	priv_intersect(zone->zone_privset, &CR_LPRIV(zone->zone_kcred));
2925 
2926 	mutex_enter(&zonehash_lock);
2927 	/*
2928 	 * Make sure zone doesn't already exist.
2929 	 *
2930 	 * If the system and zone are labeled,
2931 	 * make sure no other zone exists that has the same label.
2932 	 */
2933 	if ((ztmp = zone_find_all_by_name(zone->zone_name)) != NULL ||
2934 	    (insert_label_hash &&
2935 	    (ztmp = zone_find_all_by_label(zone->zone_slabel)) != NULL)) {
2936 		zone_status_t status;
2937 
2938 		status = zone_status_get(ztmp);
2939 		if (status == ZONE_IS_READY || status == ZONE_IS_RUNNING)
2940 			error = EEXIST;
2941 		else
2942 			error = EBUSY;
2943 		goto errout;
2944 	}
2945 
2946 	/*
2947 	 * Don't allow zone creations which would cause one zone's rootpath to
2948 	 * be accessible from that of another (non-global) zone.
2949 	 */
2950 	if (zone_is_nested(zone->zone_rootpath)) {
2951 		error = EBUSY;
2952 		goto errout;
2953 	}
2954 
2955 	ASSERT(zonecount != 0);		/* check for leaks */
2956 	if (zonecount + 1 > maxzones) {
2957 		error = ENOMEM;
2958 		goto errout;
2959 	}
2960 
2961 	if (zone_mount_count(zone->zone_rootpath) != 0) {
2962 		error = EBUSY;
2963 		error2 = ZE_AREMOUNTS;
2964 		goto errout;
2965 	}
2966 
2967 	/*
2968 	 * Zone is still incomplete, but we need to drop all locks while
2969 	 * zsched() initializes this zone's kernel process.  We
2970 	 * optimistically add the zone to the hashtable and associated
2971 	 * lists so a parallel zone_create() doesn't try to create the
2972 	 * same zone.
2973 	 */
2974 	zonecount++;
2975 	(void) mod_hash_insert(zonehashbyid,
2976 	    (mod_hash_key_t)(uintptr_t)zone->zone_id,
2977 	    (mod_hash_val_t)(uintptr_t)zone);
2978 	str = kmem_alloc(strlen(zone->zone_name) + 1, KM_SLEEP);
2979 	(void) strcpy(str, zone->zone_name);
2980 	(void) mod_hash_insert(zonehashbyname, (mod_hash_key_t)str,
2981 	    (mod_hash_val_t)(uintptr_t)zone);
2982 	if (insert_label_hash) {
2983 		(void) mod_hash_insert(zonehashbylabel,
2984 		    (mod_hash_key_t)zone->zone_slabel, (mod_hash_val_t)zone);
2985 		zone->zone_flags |= ZF_HASHED_LABEL;
2986 	}
2987 
2988 	/*
2989 	 * Insert into active list.  At this point there are no 'hold's
2990 	 * on the zone, but everyone else knows not to use it, so we can
2991 	 * continue to use it.  zsched() will do a zone_hold() if the
2992 	 * newproc() is successful.
2993 	 */
2994 	list_insert_tail(&zone_active, zone);
2995 	mutex_exit(&zonehash_lock);
2996 
2997 	zarg.zone = zone;
2998 	zarg.nvlist = rctls;
2999 	/*
3000 	 * The process, task, and project rctls are probably wrong;
3001 	 * we need an interface to get the default values of all rctls,
3002 	 * and initialize zsched appropriately.  I'm not sure that that
3003 	 * makes much of a difference, though.
3004 	 */
3005 	if (error = newproc(zsched, (void *)&zarg, syscid, minclsyspri, NULL)) {
3006 		/*
3007 		 * We need to undo all globally visible state.
3008 		 */
3009 		mutex_enter(&zonehash_lock);
3010 		list_remove(&zone_active, zone);
3011 		if (zone->zone_flags & ZF_HASHED_LABEL) {
3012 			ASSERT(zone->zone_slabel != NULL);
3013 			(void) mod_hash_destroy(zonehashbylabel,
3014 			    (mod_hash_key_t)zone->zone_slabel);
3015 		}
3016 		(void) mod_hash_destroy(zonehashbyname,
3017 		    (mod_hash_key_t)(uintptr_t)zone->zone_name);
3018 		(void) mod_hash_destroy(zonehashbyid,
3019 		    (mod_hash_key_t)(uintptr_t)zone->zone_id);
3020 		ASSERT(zonecount > 1);
3021 		zonecount--;
3022 		goto errout;
3023 	}
3024 
3025 	/*
3026 	 * Zone creation can't fail from now on.
3027 	 */
3028 
3029 	/*
3030 	 * Let the other lwps continue.
3031 	 */
3032 	mutex_enter(&pp->p_lock);
3033 	if (curthread != pp->p_agenttp)
3034 		continuelwps(pp);
3035 	mutex_exit(&pp->p_lock);
3036 
3037 	/*
3038 	 * Wait for zsched to finish initializing the zone.
3039 	 */
3040 	zone_status_wait(zone, ZONE_IS_READY);
3041 	/*
3042 	 * The zone is fully visible, so we can let mounts progress.
3043 	 */
3044 	resume_mounts();
3045 	if (rctls)
3046 		nvlist_free(rctls);
3047 
3048 	return (zoneid);
3049 
3050 errout:
3051 	mutex_exit(&zonehash_lock);
3052 	/*
3053 	 * Let the other lwps continue.
3054 	 */
3055 	mutex_enter(&pp->p_lock);
3056 	if (curthread != pp->p_agenttp)
3057 		continuelwps(pp);
3058 	mutex_exit(&pp->p_lock);
3059 
3060 	resume_mounts();
3061 	if (rctls)
3062 		nvlist_free(rctls);
3063 	/*
3064 	 * There is currently one reference to the zone, a cred_ref from
3065 	 * zone_kcred.  To free the zone, we call crfree, which will call
3066 	 * zone_cred_rele, which will call zone_free.
3067 	 */
3068 	ASSERT(zone->zone_cred_ref == 1);	/* for zone_kcred */
3069 	ASSERT(zone->zone_kcred->cr_ref == 1);
3070 	ASSERT(zone->zone_ref == 0);
3071 	zkcr = zone->zone_kcred;
3072 	zone->zone_kcred = NULL;
3073 	crfree(zkcr);				/* triggers call to zone_free */
3074 	return (zone_create_error(error, error2, extended_error));
3075 }
3076 
3077 /*
3078  * Cause the zone to boot.  This is pretty simple, since we let zoneadmd do
3079  * the heavy lifting.
3080  */
3081 static int
3082 zone_boot(zoneid_t zoneid, const char *bootargs)
3083 {
3084 	int err;
3085 	zone_t *zone;
3086 
3087 	if (secpolicy_zone_config(CRED()) != 0)
3088 		return (set_errno(EPERM));
3089 	if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
3090 		return (set_errno(EINVAL));
3091 
3092 	mutex_enter(&zonehash_lock);
3093 	/*
3094 	 * Look for zone under hash lock to prevent races with calls to
3095 	 * zone_shutdown, zone_destroy, etc.
3096 	 */
3097 	if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
3098 		mutex_exit(&zonehash_lock);
3099 		return (set_errno(EINVAL));
3100 	}
3101 
3102 	if ((err = zone_set_bootargs(zone, bootargs)) != 0) {
3103 		mutex_exit(&zonehash_lock);
3104 		return (set_errno(err));
3105 	}
3106 
3107 	mutex_enter(&zone_status_lock);
3108 	if (zone_status_get(zone) != ZONE_IS_READY) {
3109 		mutex_exit(&zone_status_lock);
3110 		mutex_exit(&zonehash_lock);
3111 		return (set_errno(EINVAL));
3112 	}
3113 	zone_status_set(zone, ZONE_IS_BOOTING);
3114 	mutex_exit(&zone_status_lock);
3115 
3116 	zone_hold(zone);	/* so we can use the zone_t later */
3117 	mutex_exit(&zonehash_lock);
3118 
3119 	if (zone_status_wait_sig(zone, ZONE_IS_RUNNING) == 0) {
3120 		zone_rele(zone);
3121 		return (set_errno(EINTR));
3122 	}
3123 
3124 	/*
3125 	 * Boot (starting init) might have failed, in which case the zone
3126 	 * will go to the SHUTTING_DOWN state; an appropriate errno will
3127 	 * be placed in zone->zone_boot_err, and so we return that.
3128 	 */
3129 	err = zone->zone_boot_err;
3130 	zone_rele(zone);
3131 	return (err ? set_errno(err) : 0);
3132 }
3133 
3134 /*
3135  * Kills all user processes in the zone, waiting for them all to exit
3136  * before returning.
3137  */
3138 static int
3139 zone_empty(zone_t *zone)
3140 {
3141 	int waitstatus;
3142 
3143 	/*
3144 	 * We need to drop zonehash_lock before killing all
3145 	 * processes, otherwise we'll deadlock with zone_find_*
3146 	 * which can be called from the exit path.
3147 	 */
3148 	ASSERT(MUTEX_NOT_HELD(&zonehash_lock));
3149 	while ((waitstatus = zone_status_timedwait_sig(zone, lbolt + hz,
3150 	    ZONE_IS_EMPTY)) == -1) {
3151 		killall(zone->zone_id);
3152 	}
3153 	/*
3154 	 * return EINTR if we were signaled
3155 	 */
3156 	if (waitstatus == 0)
3157 		return (EINTR);
3158 	return (0);
3159 }
3160 
3161 /*
3162  * This function implements the policy for zone visibility.
3163  *
3164  * In standard Solaris, a non-global zone can only see itself.
3165  *
3166  * In Trusted Extensions, a labeled zone can lookup any zone whose label
3167  * it dominates. For this test, the label of the global zone is treated as
3168  * admin_high so it is special-cased instead of being checked for dominance.
3169  *
3170  * Returns true if zone attributes are viewable, false otherwise.
3171  */
3172 static boolean_t
3173 zone_list_access(zone_t *zone)
3174 {
3175 
3176 	if (curproc->p_zone == global_zone ||
3177 	    curproc->p_zone == zone) {
3178 		return (B_TRUE);
3179 	} else if (is_system_labeled() && !(zone->zone_flags & ZF_IS_SCRATCH)) {
3180 		bslabel_t *curproc_label;
3181 		bslabel_t *zone_label;
3182 
3183 		curproc_label = label2bslabel(curproc->p_zone->zone_slabel);
3184 		zone_label = label2bslabel(zone->zone_slabel);
3185 
3186 		if (zone->zone_id != GLOBAL_ZONEID &&
3187 		    bldominates(curproc_label, zone_label)) {
3188 			return (B_TRUE);
3189 		} else {
3190 			return (B_FALSE);
3191 		}
3192 	} else {
3193 		return (B_FALSE);
3194 	}
3195 }
3196 
3197 /*
3198  * Systemcall to start the zone's halt sequence.  By the time this
3199  * function successfully returns, all user processes and kernel threads
3200  * executing in it will have exited, ZSD shutdown callbacks executed,
3201  * and the zone status set to ZONE_IS_DOWN.
3202  *
3203  * It is possible that the call will interrupt itself if the caller is the
3204  * parent of any process running in the zone, and doesn't have SIGCHLD blocked.
3205  */
3206 static int
3207 zone_shutdown(zoneid_t zoneid)
3208 {
3209 	int error;
3210 	zone_t *zone;
3211 	zone_status_t status;
3212 
3213 	if (secpolicy_zone_config(CRED()) != 0)
3214 		return (set_errno(EPERM));
3215 	if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
3216 		return (set_errno(EINVAL));
3217 
3218 	/*
3219 	 * Block mounts so that VFS_MOUNT() can get an accurate view of
3220 	 * the zone's status with regards to ZONE_IS_SHUTTING down.
3221 	 *
3222 	 * e.g. NFS can fail the mount if it determines that the zone
3223 	 * has already begun the shutdown sequence.
3224 	 */
3225 	if (block_mounts() == 0)
3226 		return (set_errno(EINTR));
3227 	mutex_enter(&zonehash_lock);
3228 	/*
3229 	 * Look for zone under hash lock to prevent races with other
3230 	 * calls to zone_shutdown and zone_destroy.
3231 	 */
3232 	if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
3233 		mutex_exit(&zonehash_lock);
3234 		resume_mounts();
3235 		return (set_errno(EINVAL));
3236 	}
3237 	mutex_enter(&zone_status_lock);
3238 	status = zone_status_get(zone);
3239 	/*
3240 	 * Fail if the zone isn't fully initialized yet.
3241 	 */
3242 	if (status < ZONE_IS_READY) {
3243 		mutex_exit(&zone_status_lock);
3244 		mutex_exit(&zonehash_lock);
3245 		resume_mounts();
3246 		return (set_errno(EINVAL));
3247 	}
3248 	/*
3249 	 * If conditions required for zone_shutdown() to return have been met,
3250 	 * return success.
3251 	 */
3252 	if (status >= ZONE_IS_DOWN) {
3253 		mutex_exit(&zone_status_lock);
3254 		mutex_exit(&zonehash_lock);
3255 		resume_mounts();
3256 		return (0);
3257 	}
3258 	/*
3259 	 * If zone_shutdown() hasn't been called before, go through the motions.
3260 	 * If it has, there's nothing to do but wait for the kernel threads to
3261 	 * drain.
3262 	 */
3263 	if (status < ZONE_IS_EMPTY) {
3264 		uint_t ntasks;
3265 
3266 		mutex_enter(&zone->zone_lock);
3267 		if ((ntasks = zone->zone_ntasks) != 1) {
3268 			/*
3269 			 * There's still stuff running.
3270 			 */
3271 			zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
3272 		}
3273 		mutex_exit(&zone->zone_lock);
3274 		if (ntasks == 1) {
3275 			/*
3276 			 * The only way to create another task is through
3277 			 * zone_enter(), which will block until we drop
3278 			 * zonehash_lock.  The zone is empty.
3279 			 */
3280 			if (zone->zone_kthreads == NULL) {
3281 				/*
3282 				 * Skip ahead to ZONE_IS_DOWN
3283 				 */
3284 				zone_status_set(zone, ZONE_IS_DOWN);
3285 			} else {
3286 				zone_status_set(zone, ZONE_IS_EMPTY);
3287 			}
3288 		}
3289 	}
3290 	zone_hold(zone);	/* so we can use the zone_t later */
3291 	mutex_exit(&zone_status_lock);
3292 	mutex_exit(&zonehash_lock);
3293 	resume_mounts();
3294 
3295 	if (error = zone_empty(zone)) {
3296 		zone_rele(zone);
3297 		return (set_errno(error));
3298 	}
3299 	/*
3300 	 * After the zone status goes to ZONE_IS_DOWN this zone will no
3301 	 * longer be notified of changes to the pools configuration, so
3302 	 * in order to not end up with a stale pool pointer, we point
3303 	 * ourselves at the default pool and remove all resource
3304 	 * visibility.  This is especially important as the zone_t may
3305 	 * languish on the deathrow for a very long time waiting for
3306 	 * cred's to drain out.
3307 	 *
3308 	 * This rebinding of the zone can happen multiple times
3309 	 * (presumably due to interrupted or parallel systemcalls)
3310 	 * without any adverse effects.
3311 	 */
3312 	if (pool_lock_intr() != 0) {
3313 		zone_rele(zone);
3314 		return (set_errno(EINTR));
3315 	}
3316 	if (pool_state == POOL_ENABLED) {
3317 		mutex_enter(&cpu_lock);
3318 		zone_pool_set(zone, pool_default);
3319 		/*
3320 		 * The zone no longer needs to be able to see any cpus.
3321 		 */
3322 		zone_pset_set(zone, ZONE_PS_INVAL);
3323 		mutex_exit(&cpu_lock);
3324 	}
3325 	pool_unlock();
3326 
3327 	/*
3328 	 * ZSD shutdown callbacks can be executed multiple times, hence
3329 	 * it is safe to not be holding any locks across this call.
3330 	 */
3331 	zone_zsd_callbacks(zone, ZSD_SHUTDOWN);
3332 
3333 	mutex_enter(&zone_status_lock);
3334 	if (zone->zone_kthreads == NULL && zone_status_get(zone) < ZONE_IS_DOWN)
3335 		zone_status_set(zone, ZONE_IS_DOWN);
3336 	mutex_exit(&zone_status_lock);
3337 
3338 	/*
3339 	 * Wait for kernel threads to drain.
3340 	 */
3341 	if (!zone_status_wait_sig(zone, ZONE_IS_DOWN)) {
3342 		zone_rele(zone);
3343 		return (set_errno(EINTR));
3344 	}
3345 	zone_rele(zone);
3346 	return (0);
3347 }
3348 
3349 /*
3350  * Systemcall entry point to finalize the zone halt process.  The caller
3351  * must have already successfully callefd zone_shutdown().
3352  *
3353  * Upon successful completion, the zone will have been fully destroyed:
3354  * zsched will have exited, destructor callbacks executed, and the zone
3355  * removed from the list of active zones.
3356  */
3357 static int
3358 zone_destroy(zoneid_t zoneid)
3359 {
3360 	uint64_t uniqid;
3361 	zone_t *zone;
3362 	zone_status_t status;
3363 
3364 	if (secpolicy_zone_config(CRED()) != 0)
3365 		return (set_errno(EPERM));
3366 	if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
3367 		return (set_errno(EINVAL));
3368 
3369 	mutex_enter(&zonehash_lock);
3370 	/*
3371 	 * Look for zone under hash lock to prevent races with other
3372 	 * calls to zone_destroy.
3373 	 */
3374 	if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
3375 		mutex_exit(&zonehash_lock);
3376 		return (set_errno(EINVAL));
3377 	}
3378 
3379 	if (zone_mount_count(zone->zone_rootpath) != 0) {
3380 		mutex_exit(&zonehash_lock);
3381 		return (set_errno(EBUSY));
3382 	}
3383 	mutex_enter(&zone_status_lock);
3384 	status = zone_status_get(zone);
3385 	if (status < ZONE_IS_DOWN) {
3386 		mutex_exit(&zone_status_lock);
3387 		mutex_exit(&zonehash_lock);
3388 		return (set_errno(EBUSY));
3389 	} else if (status == ZONE_IS_DOWN) {
3390 		zone_status_set(zone, ZONE_IS_DYING); /* Tell zsched to exit */
3391 	}
3392 	mutex_exit(&zone_status_lock);
3393 	zone_hold(zone);
3394 	mutex_exit(&zonehash_lock);
3395 
3396 	/*
3397 	 * wait for zsched to exit
3398 	 */
3399 	zone_status_wait(zone, ZONE_IS_DEAD);
3400 	zone_zsd_callbacks(zone, ZSD_DESTROY);
3401 	uniqid = zone->zone_uniqid;
3402 	zone_rele(zone);
3403 	zone = NULL;	/* potentially free'd */
3404 
3405 	mutex_enter(&zonehash_lock);
3406 	for (; /* ever */; ) {
3407 		boolean_t unref;
3408 
3409 		if ((zone = zone_find_all_by_id(zoneid)) == NULL ||
3410 		    zone->zone_uniqid != uniqid) {
3411 			/*
3412 			 * The zone has gone away.  Necessary conditions
3413 			 * are met, so we return success.
3414 			 */
3415 			mutex_exit(&zonehash_lock);
3416 			return (0);
3417 		}
3418 		mutex_enter(&zone->zone_lock);
3419 		unref = ZONE_IS_UNREF(zone);
3420 		mutex_exit(&zone->zone_lock);
3421 		if (unref) {
3422 			/*
3423 			 * There is only one reference to the zone -- that
3424 			 * added when the zone was added to the hashtables --
3425 			 * and things will remain this way until we drop
3426 			 * zonehash_lock... we can go ahead and cleanup the
3427 			 * zone.
3428 			 */
3429 			break;
3430 		}
3431 
3432 		if (cv_wait_sig(&zone_destroy_cv, &zonehash_lock) == 0) {
3433 			/* Signaled */
3434 			mutex_exit(&zonehash_lock);
3435 			return (set_errno(EINTR));
3436 		}
3437 
3438 	}
3439 
3440 	/*
3441 	 * It is now safe to let the zone be recreated; remove it from the
3442 	 * lists.  The memory will not be freed until the last cred
3443 	 * reference goes away.
3444 	 */
3445 	ASSERT(zonecount > 1);	/* must be > 1; can't destroy global zone */
3446 	zonecount--;
3447 	/* remove from active list and hash tables */
3448 	list_remove(&zone_active, zone);
3449 	(void) mod_hash_destroy(zonehashbyname,
3450 	    (mod_hash_key_t)zone->zone_name);
3451 	(void) mod_hash_destroy(zonehashbyid,
3452 	    (mod_hash_key_t)(uintptr_t)zone->zone_id);
3453 	if (zone->zone_flags & ZF_HASHED_LABEL)
3454 		(void) mod_hash_destroy(zonehashbylabel,
3455 		    (mod_hash_key_t)zone->zone_slabel);
3456 	mutex_exit(&zonehash_lock);
3457 
3458 	/*
3459 	 * Release the root vnode; we're not using it anymore.  Nor should any
3460 	 * other thread that might access it exist.
3461 	 */
3462 	if (zone->zone_rootvp != NULL) {
3463 		VN_RELE(zone->zone_rootvp);
3464 		zone->zone_rootvp = NULL;
3465 	}
3466 
3467 	/* add to deathrow list */
3468 	mutex_enter(&zone_deathrow_lock);
3469 	list_insert_tail(&zone_deathrow, zone);
3470 	mutex_exit(&zone_deathrow_lock);
3471 
3472 	/*
3473 	 * Drop last reference (which was added by zsched()), this will
3474 	 * free the zone unless there are outstanding cred references.
3475 	 */
3476 	zone_rele(zone);
3477 	return (0);
3478 }
3479 
3480 /*
3481  * Systemcall entry point for zone_getattr(2).
3482  */
3483 static ssize_t
3484 zone_getattr(zoneid_t zoneid, int attr, void *buf, size_t bufsize)
3485 {
3486 	size_t size;
3487 	int error = 0, err;
3488 	zone_t *zone;
3489 	char *zonepath;
3490 	zone_status_t zone_status;
3491 	pid_t initpid;
3492 	boolean_t global = (curproc->p_zone == global_zone);
3493 	boolean_t curzone = (curproc->p_zone->zone_id == zoneid);
3494 
3495 	mutex_enter(&zonehash_lock);
3496 	if ((zone = zone_find_all_by_id(zoneid)) == NULL) {
3497 		mutex_exit(&zonehash_lock);
3498 		return (set_errno(EINVAL));
3499 	}
3500 	zone_status = zone_status_get(zone);
3501 	if (zone_status < ZONE_IS_READY) {
3502 		mutex_exit(&zonehash_lock);
3503 		return (set_errno(EINVAL));
3504 	}
3505 	zone_hold(zone);
3506 	mutex_exit(&zonehash_lock);
3507 
3508 	/*
3509 	 * If not in the global zone, don't show information about other zones,
3510 	 * unless the system is labeled and the local zone's label dominates
3511 	 * the other zone.
3512 	 */
3513 	if (!zone_list_access(zone)) {
3514 		zone_rele(zone);
3515 		return (set_errno(EINVAL));
3516 	}
3517 
3518 	switch (attr) {
3519 	case ZONE_ATTR_ROOT:
3520 		if (global) {
3521 			/*
3522 			 * Copy the path to trim the trailing "/" (except for
3523 			 * the global zone).
3524 			 */
3525 			if (zone != global_zone)
3526 				size = zone->zone_rootpathlen - 1;
3527 			else
3528 				size = zone->zone_rootpathlen;
3529 			zonepath = kmem_alloc(size, KM_SLEEP);
3530 			bcopy(zone->zone_rootpath, zonepath, size);
3531 			zonepath[size - 1] = '\0';
3532 		} else {
3533 			if (curzone || !is_system_labeled()) {
3534 				/*
3535 				 * Caller is not in the global zone.
3536 				 * if the query is on the current zone
3537 				 * or the system is not labeled,
3538 				 * just return faked-up path for current zone.
3539 				 */
3540 				zonepath = "/";
3541 				size = 2;
3542 			} else {
3543 				/*
3544 				 * Return related path for current zone.
3545 				 */
3546 				int prefix_len = strlen(zone_prefix);
3547 				int zname_len = strlen(zone->zone_name);
3548 
3549 				size = prefix_len + zname_len + 1;
3550 				zonepath = kmem_alloc(size, KM_SLEEP);
3551 				bcopy(zone_prefix, zonepath, prefix_len);
3552 				bcopy(zone->zone_name, zonepath +
3553 					prefix_len, zname_len);
3554 				zonepath[size - 1] = '\0';
3555 			}
3556 		}
3557 		if (bufsize > size)
3558 			bufsize = size;
3559 		if (buf != NULL) {
3560 			err = copyoutstr(zonepath, buf, bufsize, NULL);
3561 			if (err != 0 && err != ENAMETOOLONG)
3562 				error = EFAULT;
3563 		}
3564 		if (global || (is_system_labeled() && !curzone))
3565 			kmem_free(zonepath, size);
3566 		break;
3567 
3568 	case ZONE_ATTR_NAME:
3569 		size = strlen(zone->zone_name) + 1;
3570 		if (bufsize > size)
3571 			bufsize = size;
3572 		if (buf != NULL) {
3573 			err = copyoutstr(zone->zone_name, buf, bufsize, NULL);
3574 			if (err != 0 && err != ENAMETOOLONG)
3575 				error = EFAULT;
3576 		}
3577 		break;
3578 
3579 	case ZONE_ATTR_STATUS:
3580 		/*
3581 		 * Since we're not holding zonehash_lock, the zone status
3582 		 * may be anything; leave it up to userland to sort it out.
3583 		 */
3584 		size = sizeof (zone_status);
3585 		if (bufsize > size)
3586 			bufsize = size;
3587 		zone_status = zone_status_get(zone);
3588 		if (buf != NULL &&
3589 		    copyout(&zone_status, buf, bufsize) != 0)
3590 			error = EFAULT;
3591 		break;
3592 	case ZONE_ATTR_PRIVSET:
3593 		size = sizeof (priv_set_t);
3594 		if (bufsize > size)
3595 			bufsize = size;
3596 		if (buf != NULL &&
3597 		    copyout(zone->zone_privset, buf, bufsize) != 0)
3598 			error = EFAULT;
3599 		break;
3600 	case ZONE_ATTR_UNIQID:
3601 		size = sizeof (zone->zone_uniqid);
3602 		if (bufsize > size)
3603 			bufsize = size;
3604 		if (buf != NULL &&
3605 		    copyout(&zone->zone_uniqid, buf, bufsize) != 0)
3606 			error = EFAULT;
3607 		break;
3608 	case ZONE_ATTR_POOLID:
3609 		{
3610 			pool_t *pool;
3611 			poolid_t poolid;
3612 
3613 			if (pool_lock_intr() != 0) {
3614 				error = EINTR;
3615 				break;
3616 			}
3617 			pool = zone_pool_get(zone);
3618 			poolid = pool->pool_id;
3619 			pool_unlock();
3620 			size = sizeof (poolid);
3621 			if (bufsize > size)
3622 				bufsize = size;
3623 			if (buf != NULL && copyout(&poolid, buf, size) != 0)
3624 				error = EFAULT;
3625 		}
3626 		break;
3627 	case ZONE_ATTR_SLBL:
3628 		size = sizeof (bslabel_t);
3629 		if (bufsize > size)
3630 			bufsize = size;
3631 		if (zone->zone_slabel == NULL)
3632 			error = EINVAL;
3633 		else if (buf != NULL &&
3634 		    copyout(label2bslabel(zone->zone_slabel), buf,
3635 		    bufsize) != 0)
3636 			error = EFAULT;
3637 		break;
3638 	case ZONE_ATTR_INITPID:
3639 		size = sizeof (initpid);
3640 		if (bufsize > size)
3641 			bufsize = size;
3642 		initpid = zone->zone_proc_initpid;
3643 		if (initpid == -1) {
3644 			error = ESRCH;
3645 			break;
3646 		}
3647 		if (buf != NULL &&
3648 		    copyout(&initpid, buf, bufsize) != 0)
3649 			error = EFAULT;
3650 		break;
3651 	default:
3652 		error = EINVAL;
3653 	}
3654 	zone_rele(zone);
3655 
3656 	if (error)
3657 		return (set_errno(error));
3658 	return ((ssize_t)size);
3659 }
3660 
3661 /*
3662  * Return zero if the process has at least one vnode mapped in to its
3663  * address space which shouldn't be allowed to change zones.
3664  */
3665 static int
3666 as_can_change_zones(void)
3667 {
3668 	proc_t *pp = curproc;
3669 	struct seg *seg;
3670 	struct as *as = pp->p_as;
3671 	vnode_t *vp;
3672 	int allow = 1;
3673 
3674 	ASSERT(pp->p_as != &kas);
3675 	AS_LOCK_ENTER(&as, &as->a_lock, RW_READER);
3676 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
3677 		/*
3678 		 * if we can't get a backing vnode for this segment then skip
3679 		 * it.
3680 		 */
3681 		vp = NULL;
3682 		if (SEGOP_GETVP(seg, seg->s_base, &vp) != 0 || vp == NULL)
3683 			continue;
3684 		if (!vn_can_change_zones(vp)) { /* bail on first match */
3685 			allow = 0;
3686 			break;
3687 		}
3688 	}
3689 	AS_LOCK_EXIT(&as, &as->a_lock);
3690 	return (allow);
3691 }
3692 
3693 /*
3694  * Systemcall entry point for zone_enter().
3695  *
3696  * The current process is injected into said zone.  In the process
3697  * it will change its project membership, privileges, rootdir/cwd,
3698  * zone-wide rctls, and pool association to match those of the zone.
3699  *
3700  * The first zone_enter() called while the zone is in the ZONE_IS_READY
3701  * state will transition it to ZONE_IS_RUNNING.  Processes may only
3702  * enter a zone that is "ready" or "running".
3703  */
3704 static int
3705 zone_enter(zoneid_t zoneid)
3706 {
3707 	zone_t *zone;
3708 	vnode_t *vp;
3709 	proc_t *pp = curproc;
3710 	contract_t *ct;
3711 	cont_process_t *ctp;
3712 	task_t *tk, *oldtk;
3713 	kproject_t *zone_proj0;
3714 	cred_t *cr, *newcr;
3715 	pool_t *oldpool, *newpool;
3716 	sess_t *sp;
3717 	uid_t uid;
3718 	zone_status_t status;
3719 	int err = 0;
3720 	rctl_entity_p_t e;
3721 
3722 	if (secpolicy_zone_config(CRED()) != 0)
3723 		return (set_errno(EPERM));
3724 	if (zoneid < MIN_USERZONEID || zoneid > MAX_ZONEID)
3725 		return (set_errno(EINVAL));
3726 
3727 	/*
3728 	 * Stop all lwps so we don't need to hold a lock to look at
3729 	 * curproc->p_zone.  This needs to happen before we grab any
3730 	 * locks to avoid deadlock (another lwp in the process could
3731 	 * be waiting for the held lock).
3732 	 */
3733 	if (curthread != pp->p_agenttp && !holdlwps(SHOLDFORK))
3734 		return (set_errno(EINTR));
3735 
3736 	/*
3737 	 * Make sure we're not changing zones with files open or mapped in
3738 	 * to our address space which shouldn't be changing zones.
3739 	 */
3740 	if (!files_can_change_zones()) {
3741 		err = EBADF;
3742 		goto out;
3743 	}
3744 	if (!as_can_change_zones()) {
3745 		err = EFAULT;
3746 		goto out;
3747 	}
3748 
3749 	mutex_enter(&zonehash_lock);
3750 	if (pp->p_zone != global_zone) {
3751 		mutex_exit(&zonehash_lock);
3752 		err = EINVAL;
3753 		goto out;
3754 	}
3755 
3756 	zone = zone_find_all_by_id(zoneid);
3757 	if (zone == NULL) {
3758 		mutex_exit(&zonehash_lock);
3759 		err = EINVAL;
3760 		goto out;
3761 	}
3762 
3763 	/*
3764 	 * To prevent processes in a zone from holding contracts on
3765 	 * extrazonal resources, and to avoid process contract
3766 	 * memberships which span zones, contract holders and processes
3767 	 * which aren't the sole members of their encapsulating process
3768 	 * contracts are not allowed to zone_enter.
3769 	 */
3770 	ctp = pp->p_ct_process;
3771 	ct = &ctp->conp_contract;
3772 	mutex_enter(&ct->ct_lock);
3773 	mutex_enter(&pp->p_lock);
3774 	if ((avl_numnodes(&pp->p_ct_held) != 0) || (ctp->conp_nmembers != 1)) {
3775 		mutex_exit(&pp->p_lock);
3776 		mutex_exit(&ct->ct_lock);
3777 		mutex_exit(&zonehash_lock);
3778 		pool_unlock();
3779 		err = EINVAL;
3780 		goto out;
3781 	}
3782 
3783 	/*
3784 	 * Moreover, we don't allow processes whose encapsulating
3785 	 * process contracts have inherited extrazonal contracts.
3786 	 * While it would be easier to eliminate all process contracts
3787 	 * with inherited contracts, we need to be able to give a
3788 	 * restarted init (or other zone-penetrating process) its
3789 	 * predecessor's contracts.
3790 	 */
3791 	if (ctp->conp_ninherited != 0) {
3792 		contract_t *next;
3793 		for (next = list_head(&ctp->conp_inherited); next;
3794 		    next = list_next(&ctp->conp_inherited, next)) {
3795 			if (contract_getzuniqid(next) != zone->zone_uniqid) {
3796 				mutex_exit(&pp->p_lock);
3797 				mutex_exit(&ct->ct_lock);
3798 				mutex_exit(&zonehash_lock);
3799 				pool_unlock();
3800 				err = EINVAL;
3801 				goto out;
3802 			}
3803 		}
3804 	}
3805 	mutex_exit(&pp->p_lock);
3806 	mutex_exit(&ct->ct_lock);
3807 
3808 	status = zone_status_get(zone);
3809 	if (status < ZONE_IS_READY || status >= ZONE_IS_SHUTTING_DOWN) {
3810 		/*
3811 		 * Can't join
3812 		 */
3813 		mutex_exit(&zonehash_lock);
3814 		err = EINVAL;
3815 		goto out;
3816 	}
3817 
3818 	/*
3819 	 * Make sure new priv set is within the permitted set for caller
3820 	 */
3821 	if (!priv_issubset(zone->zone_privset, &CR_OPPRIV(CRED()))) {
3822 		mutex_exit(&zonehash_lock);
3823 		err = EPERM;
3824 		goto out;
3825 	}
3826 	/*
3827 	 * We want to momentarily drop zonehash_lock while we optimistically
3828 	 * bind curproc to the pool it should be running in.  This is safe
3829 	 * since the zone can't disappear (we have a hold on it).
3830 	 */
3831 	zone_hold(zone);
3832 	mutex_exit(&zonehash_lock);
3833 
3834 	/*
3835 	 * Grab pool_lock to keep the pools configuration from changing
3836 	 * and to stop ourselves from getting rebound to another pool
3837 	 * until we join the zone.
3838 	 */
3839 	if (pool_lock_intr() != 0) {
3840 		zone_rele(zone);
3841 		err = EINTR;
3842 		goto out;
3843 	}
3844 	ASSERT(secpolicy_pool(CRED()) == 0);
3845 	/*
3846 	 * Bind ourselves to the pool currently associated with the zone.
3847 	 */
3848 	oldpool = curproc->p_pool;
3849 	newpool = zone_pool_get(zone);
3850 	if (pool_state == POOL_ENABLED && newpool != oldpool &&
3851 	    (err = pool_do_bind(newpool, P_PID, P_MYID,
3852 	    POOL_BIND_ALL)) != 0) {
3853 		pool_unlock();
3854 		zone_rele(zone);
3855 		goto out;
3856 	}
3857 
3858 	/*
3859 	 * Grab cpu_lock now; we'll need it later when we call
3860 	 * task_join().
3861 	 */
3862 	mutex_enter(&cpu_lock);
3863 	mutex_enter(&zonehash_lock);
3864 	/*
3865 	 * Make sure the zone hasn't moved on since we dropped zonehash_lock.
3866 	 */
3867 	if (zone_status_get(zone) >= ZONE_IS_SHUTTING_DOWN) {
3868 		/*
3869 		 * Can't join anymore.
3870 		 */
3871 		mutex_exit(&zonehash_lock);
3872 		mutex_exit(&cpu_lock);
3873 		if (pool_state == POOL_ENABLED &&
3874 		    newpool != oldpool)
3875 			(void) pool_do_bind(oldpool, P_PID, P_MYID,
3876 			    POOL_BIND_ALL);
3877 		pool_unlock();
3878 		zone_rele(zone);
3879 		err = EINVAL;
3880 		goto out;
3881 	}
3882 
3883 	mutex_enter(&pp->p_lock);
3884 	zone_proj0 = zone->zone_zsched->p_task->tk_proj;
3885 	/* verify that we do not exceed and task or lwp limits */
3886 	mutex_enter(&zone->zone_nlwps_lock);
3887 	/* add new lwps to zone and zone's proj0 */
3888 	zone_proj0->kpj_nlwps += pp->p_lwpcnt;
3889 	zone->zone_nlwps += pp->p_lwpcnt;
3890 	/* add 1 task to zone's proj0 */
3891 	zone_proj0->kpj_ntasks += 1;
3892 	mutex_exit(&pp->p_lock);
3893 	mutex_exit(&zone->zone_nlwps_lock);
3894 
3895 	/* remove lwps from proc's old zone and old project */
3896 	mutex_enter(&pp->p_zone->zone_nlwps_lock);
3897 	pp->p_zone->zone_nlwps -= pp->p_lwpcnt;
3898 	pp->p_task->tk_proj->kpj_nlwps -= pp->p_lwpcnt;
3899 	mutex_exit(&pp->p_zone->zone_nlwps_lock);
3900 
3901 	/*
3902 	 * Joining the zone cannot fail from now on.
3903 	 *
3904 	 * This means that a lot of the following code can be commonized and
3905 	 * shared with zsched().
3906 	 */
3907 
3908 	/*
3909 	 * Reset the encapsulating process contract's zone.
3910 	 */
3911 	ASSERT(ct->ct_mzuniqid == GLOBAL_ZONEUNIQID);
3912 	contract_setzuniqid(ct, zone->zone_uniqid);
3913 
3914 	/*
3915 	 * Create a new task and associate the process with the project keyed
3916 	 * by (projid,zoneid).
3917 	 *
3918 	 * We might as well be in project 0; the global zone's projid doesn't
3919 	 * make much sense in a zone anyhow.
3920 	 *
3921 	 * This also increments zone_ntasks, and returns with p_lock held.
3922 	 */
3923 	tk = task_create(0, zone);
3924 	oldtk = task_join(tk, 0);
3925 	mutex_exit(&cpu_lock);
3926 
3927 	pp->p_flag |= SZONETOP;
3928 	pp->p_zone = zone;
3929 
3930 	/*
3931 	 * call RCTLOP_SET functions on this proc
3932 	 */
3933 	e.rcep_p.zone = zone;
3934 	e.rcep_t = RCENTITY_ZONE;
3935 	(void) rctl_set_dup(NULL, NULL, pp, &e, zone->zone_rctls, NULL,
3936 	    RCD_CALLBACK);
3937 	mutex_exit(&pp->p_lock);
3938 
3939 	/*
3940 	 * We don't need to hold any of zsched's locks here; not only do we know
3941 	 * the process and zone aren't going away, we know its session isn't
3942 	 * changing either.
3943 	 *
3944 	 * By joining zsched's session here, we mimic the behavior in the
3945 	 * global zone of init's sid being the pid of sched.  We extend this
3946 	 * to all zlogin-like zone_enter()'ing processes as well.
3947 	 */
3948 	mutex_enter(&pidlock);
3949 	sp = zone->zone_zsched->p_sessp;
3950 	SESS_HOLD(sp);
3951 	mutex_enter(&pp->p_lock);
3952 	pgexit(pp);
3953 	SESS_RELE(pp->p_sessp);
3954 	pp->p_sessp = sp;
3955 	pgjoin(pp, zone->zone_zsched->p_pidp);
3956 	mutex_exit(&pp->p_lock);
3957 	mutex_exit(&pidlock);
3958 
3959 	mutex_exit(&zonehash_lock);
3960 	/*
3961 	 * We're firmly in the zone; let pools progress.
3962 	 */
3963 	pool_unlock();
3964 	task_rele(oldtk);
3965 	/*
3966 	 * We don't need to retain a hold on the zone since we already
3967 	 * incremented zone_ntasks, so the zone isn't going anywhere.
3968 	 */
3969 	zone_rele(zone);
3970 
3971 	/*
3972 	 * Chroot
3973 	 */
3974 	vp = zone->zone_rootvp;
3975 	zone_chdir(vp, &PTOU(pp)->u_cdir, pp);
3976 	zone_chdir(vp, &PTOU(pp)->u_rdir, pp);
3977 
3978 	/*
3979 	 * Change process credentials
3980 	 */
3981 	newcr = cralloc();
3982 	mutex_enter(&pp->p_crlock);
3983 	cr = pp->p_cred;
3984 	crcopy_to(cr, newcr);
3985 	crsetzone(newcr, zone);
3986 	pp->p_cred = newcr;
3987 
3988 	/*
3989 	 * Restrict all process privilege sets to zone limit
3990 	 */
3991 	priv_intersect(zone->zone_privset, &CR_PPRIV(newcr));
3992 	priv_intersect(zone->zone_privset, &CR_EPRIV(newcr));
3993 	priv_intersect(zone->zone_privset, &CR_IPRIV(newcr));
3994 	priv_intersect(zone->zone_privset, &CR_LPRIV(newcr));
3995 	mutex_exit(&pp->p_crlock);
3996 	crset(pp, newcr);
3997 
3998 	/*
3999 	 * Adjust upcount to reflect zone entry.
4000 	 */
4001 	uid = crgetruid(newcr);
4002 	mutex_enter(&pidlock);
4003 	upcount_dec(uid, GLOBAL_ZONEID);
4004 	upcount_inc(uid, zoneid);
4005 	mutex_exit(&pidlock);
4006 
4007 	/*
4008 	 * Set up core file path and content.
4009 	 */
4010 	set_core_defaults();
4011 
4012 out:
4013 	/*
4014 	 * Let the other lwps continue.
4015 	 */
4016 	mutex_enter(&pp->p_lock);
4017 	if (curthread != pp->p_agenttp)
4018 		continuelwps(pp);
4019 	mutex_exit(&pp->p_lock);
4020 
4021 	return (err != 0 ? set_errno(err) : 0);
4022 }
4023 
4024 /*
4025  * Systemcall entry point for zone_list(2).
4026  *
4027  * Processes running in a (non-global) zone only see themselves.
4028  * On labeled systems, they see all zones whose label they dominate.
4029  */
4030 static int
4031 zone_list(zoneid_t *zoneidlist, uint_t *numzones)
4032 {
4033 	zoneid_t *zoneids;
4034 	zone_t *zone, *myzone;
4035 	uint_t user_nzones, real_nzones;
4036 	uint_t domi_nzones;
4037 	int error;
4038 
4039 	if (copyin(numzones, &user_nzones, sizeof (uint_t)) != 0)
4040 		return (set_errno(EFAULT));
4041 
4042 	myzone = curproc->p_zone;
4043 	if (myzone != global_zone) {
4044 		bslabel_t *mybslab;
4045 
4046 		if (!is_system_labeled()) {
4047 			/* just return current zone */
4048 			real_nzones = domi_nzones = 1;
4049 			zoneids = kmem_alloc(sizeof (zoneid_t), KM_SLEEP);
4050 			zoneids[0] = myzone->zone_id;
4051 		} else {
4052 			/* return all zones that are dominated */
4053 			mutex_enter(&zonehash_lock);
4054 			real_nzones = zonecount;
4055 			domi_nzones = 0;
4056 			if (real_nzones > 0) {
4057 				zoneids = kmem_alloc(real_nzones *
4058 				    sizeof (zoneid_t), KM_SLEEP);
4059 				mybslab = label2bslabel(myzone->zone_slabel);
4060 				for (zone = list_head(&zone_active);
4061 				    zone != NULL;
4062 				    zone = list_next(&zone_active, zone)) {
4063 					if (zone->zone_id == GLOBAL_ZONEID)
4064 						continue;
4065 					if (zone != myzone &&
4066 					    (zone->zone_flags & ZF_IS_SCRATCH))
4067 						continue;
4068 					/*
4069 					 * Note that a label always dominates
4070 					 * itself, so myzone is always included
4071 					 * in the list.
4072 					 */
4073 					if (bldominates(mybslab,
4074 					    label2bslabel(zone->zone_slabel))) {
4075 						zoneids[domi_nzones++] =
4076 						    zone->zone_id;
4077 					}
4078 				}
4079 			}
4080 			mutex_exit(&zonehash_lock);
4081 		}
4082 	} else {
4083 		mutex_enter(&zonehash_lock);
4084 		real_nzones = zonecount;
4085 		domi_nzones = 0;
4086 		if (real_nzones > 0) {
4087 			zoneids = kmem_alloc(real_nzones * sizeof (zoneid_t),
4088 			    KM_SLEEP);
4089 			for (zone = list_head(&zone_active); zone != NULL;
4090 			    zone = list_next(&zone_active, zone))
4091 				zoneids[domi_nzones++] = zone->zone_id;
4092 			ASSERT(domi_nzones == real_nzones);
4093 		}
4094 		mutex_exit(&zonehash_lock);
4095 	}
4096 
4097 	/*
4098 	 * If user has allocated space for fewer entries than we found, then
4099 	 * return only up to his limit.  Either way, tell him exactly how many
4100 	 * we found.
4101 	 */
4102 	if (domi_nzones < user_nzones)
4103 		user_nzones = domi_nzones;
4104 	error = 0;
4105 	if (copyout(&domi_nzones, numzones, sizeof (uint_t)) != 0) {
4106 		error = EFAULT;
4107 	} else if (zoneidlist != NULL && user_nzones != 0) {
4108 		if (copyout(zoneids, zoneidlist,
4109 		    user_nzones * sizeof (zoneid_t)) != 0)
4110 			error = EFAULT;
4111 	}
4112 
4113 	if (real_nzones > 0)
4114 		kmem_free(zoneids, real_nzones * sizeof (zoneid_t));
4115 
4116 	if (error != 0)
4117 		return (set_errno(error));
4118 	else
4119 		return (0);
4120 }
4121 
4122 /*
4123  * Systemcall entry point for zone_lookup(2).
4124  *
4125  * Non-global zones are only able to see themselves and (on labeled systems)
4126  * the zones they dominate.
4127  */
4128 static zoneid_t
4129 zone_lookup(const char *zone_name)
4130 {
4131 	char *kname;
4132 	zone_t *zone;
4133 	zoneid_t zoneid;
4134 	int err;
4135 
4136 	if (zone_name == NULL) {
4137 		/* return caller's zone id */
4138 		return (getzoneid());
4139 	}
4140 
4141 	kname = kmem_zalloc(ZONENAME_MAX, KM_SLEEP);
4142 	if ((err = copyinstr(zone_name, kname, ZONENAME_MAX, NULL)) != 0) {
4143 		kmem_free(kname, ZONENAME_MAX);
4144 		return (set_errno(err));
4145 	}
4146 
4147 	mutex_enter(&zonehash_lock);
4148 	zone = zone_find_all_by_name(kname);
4149 	kmem_free(kname, ZONENAME_MAX);
4150 	/*
4151 	 * In a non-global zone, can only lookup global and own name.
4152 	 * In Trusted Extensions zone label dominance rules apply.
4153 	 */
4154 	if (zone == NULL ||
4155 	    zone_status_get(zone) < ZONE_IS_READY ||
4156 	    !zone_list_access(zone)) {
4157 		mutex_exit(&zonehash_lock);
4158 		return (set_errno(EINVAL));
4159 	} else {
4160 		zoneid = zone->zone_id;
4161 		mutex_exit(&zonehash_lock);
4162 		return (zoneid);
4163 	}
4164 }
4165 
4166 static int
4167 zone_version(int *version_arg)
4168 {
4169 	int version = ZONE_SYSCALL_API_VERSION;
4170 
4171 	if (copyout(&version, version_arg, sizeof (int)) != 0)
4172 		return (set_errno(EFAULT));
4173 	return (0);
4174 }
4175 
4176 /* ARGSUSED */
4177 long
4178 zone(int cmd, void *arg1, void *arg2, void *arg3, void *arg4)
4179 {
4180 	zone_def zs;
4181 
4182 	switch (cmd) {
4183 	case ZONE_CREATE:
4184 		if (get_udatamodel() == DATAMODEL_NATIVE) {
4185 			if (copyin(arg1, &zs, sizeof (zone_def))) {
4186 				return (set_errno(EFAULT));
4187 			}
4188 		} else {
4189 #ifdef _SYSCALL32_IMPL
4190 			zone_def32 zs32;
4191 
4192 			if (copyin(arg1, &zs32, sizeof (zone_def32))) {
4193 				return (set_errno(EFAULT));
4194 			}
4195 			zs.zone_name =
4196 			    (const char *)(unsigned long)zs32.zone_name;
4197 			zs.zone_root =
4198 			    (const char *)(unsigned long)zs32.zone_root;
4199 			zs.zone_privs =
4200 			    (const struct priv_set *)
4201 			    (unsigned long)zs32.zone_privs;
4202 			zs.zone_privssz = zs32.zone_privssz;
4203 			zs.rctlbuf = (caddr_t)(unsigned long)zs32.rctlbuf;
4204 			zs.rctlbufsz = zs32.rctlbufsz;
4205 			zs.zfsbuf = (caddr_t)(unsigned long)zs32.zfsbuf;
4206 			zs.zfsbufsz = zs32.zfsbufsz;
4207 			zs.extended_error =
4208 			    (int *)(unsigned long)zs32.extended_error;
4209 			zs.match = zs32.match;
4210 			zs.doi = zs32.doi;
4211 			zs.label = (const bslabel_t *)(uintptr_t)zs32.label;
4212 #else
4213 			panic("get_udatamodel() returned bogus result\n");
4214 #endif
4215 		}
4216 
4217 		return (zone_create(zs.zone_name, zs.zone_root,
4218 		    zs.zone_privs, zs.zone_privssz,
4219 		    (caddr_t)zs.rctlbuf, zs.rctlbufsz,
4220 		    (caddr_t)zs.zfsbuf, zs.zfsbufsz,
4221 		    zs.extended_error, zs.match, zs.doi,
4222 		    zs.label));
4223 	case ZONE_BOOT:
4224 		return (zone_boot((zoneid_t)(uintptr_t)arg1,
4225 		    (const char *)arg2));
4226 	case ZONE_DESTROY:
4227 		return (zone_destroy((zoneid_t)(uintptr_t)arg1));
4228 	case ZONE_GETATTR:
4229 		return (zone_getattr((zoneid_t)(uintptr_t)arg1,
4230 		    (int)(uintptr_t)arg2, arg3, (size_t)arg4));
4231 	case ZONE_ENTER:
4232 		return (zone_enter((zoneid_t)(uintptr_t)arg1));
4233 	case ZONE_LIST:
4234 		return (zone_list((zoneid_t *)arg1, (uint_t *)arg2));
4235 	case ZONE_SHUTDOWN:
4236 		return (zone_shutdown((zoneid_t)(uintptr_t)arg1));
4237 	case ZONE_LOOKUP:
4238 		return (zone_lookup((const char *)arg1));
4239 	case ZONE_VERSION:
4240 		return (zone_version((int *)arg1));
4241 	default:
4242 		return (set_errno(EINVAL));
4243 	}
4244 }
4245 
4246 struct zarg {
4247 	zone_t *zone;
4248 	zone_cmd_arg_t arg;
4249 };
4250 
4251 static int
4252 zone_lookup_door(const char *zone_name, door_handle_t *doorp)
4253 {
4254 	char *buf;
4255 	size_t buflen;
4256 	int error;
4257 
4258 	buflen = sizeof (ZONE_DOOR_PATH) + strlen(zone_name);
4259 	buf = kmem_alloc(buflen, KM_SLEEP);
4260 	(void) snprintf(buf, buflen, ZONE_DOOR_PATH, zone_name);
4261 	error = door_ki_open(buf, doorp);
4262 	kmem_free(buf, buflen);
4263 	return (error);
4264 }
4265 
4266 static void
4267 zone_release_door(door_handle_t *doorp)
4268 {
4269 	door_ki_rele(*doorp);
4270 	*doorp = NULL;
4271 }
4272 
4273 static void
4274 zone_ki_call_zoneadmd(struct zarg *zargp)
4275 {
4276 	door_handle_t door = NULL;
4277 	door_arg_t darg, save_arg;
4278 	char *zone_name;
4279 	size_t zone_namelen;
4280 	zoneid_t zoneid;
4281 	zone_t *zone;
4282 	zone_cmd_arg_t arg;
4283 	uint64_t uniqid;
4284 	size_t size;
4285 	int error;
4286 	int retry;
4287 
4288 	zone = zargp->zone;
4289 	arg = zargp->arg;
4290 	kmem_free(zargp, sizeof (*zargp));
4291 
4292 	zone_namelen = strlen(zone->zone_name) + 1;
4293 	zone_name = kmem_alloc(zone_namelen, KM_SLEEP);
4294 	bcopy(zone->zone_name, zone_name, zone_namelen);
4295 	zoneid = zone->zone_id;
4296 	uniqid = zone->zone_uniqid;
4297 	/*
4298 	 * zoneadmd may be down, but at least we can empty out the zone.
4299 	 * We can ignore the return value of zone_empty() since we're called
4300 	 * from a kernel thread and know we won't be delivered any signals.
4301 	 */
4302 	ASSERT(curproc == &p0);
4303 	(void) zone_empty(zone);
4304 	ASSERT(zone_status_get(zone) >= ZONE_IS_EMPTY);
4305 	zone_rele(zone);
4306 
4307 	size = sizeof (arg);
4308 	darg.rbuf = (char *)&arg;
4309 	darg.data_ptr = (char *)&arg;
4310 	darg.rsize = size;
4311 	darg.data_size = size;
4312 	darg.desc_ptr = NULL;
4313 	darg.desc_num = 0;
4314 
4315 	save_arg = darg;
4316 	/*
4317 	 * Since we're not holding a reference to the zone, any number of
4318 	 * things can go wrong, including the zone disappearing before we get a
4319 	 * chance to talk to zoneadmd.
4320 	 */
4321 	for (retry = 0; /* forever */; retry++) {
4322 		if (door == NULL &&
4323 		    (error = zone_lookup_door(zone_name, &door)) != 0) {
4324 			goto next;
4325 		}
4326 		ASSERT(door != NULL);
4327 
4328 		if ((error = door_ki_upcall(door, &darg)) == 0) {
4329 			break;
4330 		}
4331 		switch (error) {
4332 		case EINTR:
4333 			/* FALLTHROUGH */
4334 		case EAGAIN:	/* process may be forking */
4335 			/*
4336 			 * Back off for a bit
4337 			 */
4338 			break;
4339 		case EBADF:
4340 			zone_release_door(&door);
4341 			if (zone_lookup_door(zone_name, &door) != 0) {
4342 				/*
4343 				 * zoneadmd may be dead, but it may come back to
4344 				 * life later.
4345 				 */
4346 				break;
4347 			}
4348 			break;
4349 		default:
4350 			cmn_err(CE_WARN,
4351 			    "zone_ki_call_zoneadmd: door_ki_upcall error %d\n",
4352 			    error);
4353 			goto out;
4354 		}
4355 next:
4356 		/*
4357 		 * If this isn't the same zone_t that we originally had in mind,
4358 		 * then this is the same as if two kadmin requests come in at
4359 		 * the same time: the first one wins.  This means we lose, so we
4360 		 * bail.
4361 		 */
4362 		if ((zone = zone_find_by_id(zoneid)) == NULL) {
4363 			/*
4364 			 * Problem is solved.
4365 			 */
4366 			break;
4367 		}
4368 		if (zone->zone_uniqid != uniqid) {
4369 			/*
4370 			 * zoneid recycled
4371 			 */
4372 			zone_rele(zone);
4373 			break;
4374 		}
4375 		/*
4376 		 * We could zone_status_timedwait(), but there doesn't seem to
4377 		 * be much point in doing that (plus, it would mean that
4378 		 * zone_free() isn't called until this thread exits).
4379 		 */
4380 		zone_rele(zone);
4381 		delay(hz);
4382 		darg = save_arg;
4383 	}
4384 out:
4385 	if (door != NULL) {
4386 		zone_release_door(&door);
4387 	}
4388 	kmem_free(zone_name, zone_namelen);
4389 	thread_exit();
4390 }
4391 
4392 /*
4393  * Entry point for uadmin() to tell the zone to go away or reboot.  The caller
4394  * is a process in the zone to be modified.
4395  *
4396  * In order to shutdown the zone, we will hand off control to zoneadmd
4397  * (running in the global zone) via a door.  We do a half-hearted job at
4398  * killing all processes in the zone, create a kernel thread to contact
4399  * zoneadmd, and make note of the "uniqid" of the zone.  The uniqid is
4400  * a form of generation number used to let zoneadmd (as well as
4401  * zone_destroy()) know exactly which zone they're re talking about.
4402  */
4403 int
4404 zone_uadmin(int cmd, int fcn, cred_t *credp)
4405 {
4406 	struct zarg *zargp;
4407 	zone_cmd_t zcmd;
4408 	zone_t *zone;
4409 
4410 	zone = curproc->p_zone;
4411 	ASSERT(getzoneid() != GLOBAL_ZONEID);
4412 
4413 	switch (cmd) {
4414 	case A_SHUTDOWN:
4415 		switch (fcn) {
4416 		case AD_HALT:
4417 		case AD_POWEROFF:
4418 			zcmd = Z_HALT;
4419 			break;
4420 		case AD_BOOT:
4421 			zcmd = Z_REBOOT;
4422 			break;
4423 		case AD_IBOOT:
4424 		case AD_SBOOT:
4425 		case AD_SIBOOT:
4426 		case AD_NOSYNC:
4427 			return (ENOTSUP);
4428 		default:
4429 			return (EINVAL);
4430 		}
4431 		break;
4432 	case A_REBOOT:
4433 		zcmd = Z_REBOOT;
4434 		break;
4435 	case A_FTRACE:
4436 	case A_REMOUNT:
4437 	case A_FREEZE:
4438 	case A_DUMP:
4439 		return (ENOTSUP);
4440 	default:
4441 		ASSERT(cmd != A_SWAPCTL);	/* handled by uadmin() */
4442 		return (EINVAL);
4443 	}
4444 
4445 	if (secpolicy_zone_admin(credp, B_FALSE))
4446 		return (EPERM);
4447 	mutex_enter(&zone_status_lock);
4448 	/*
4449 	 * zone_status can't be ZONE_IS_EMPTY or higher since curproc
4450 	 * is in the zone.
4451 	 */
4452 	ASSERT(zone_status_get(zone) < ZONE_IS_EMPTY);
4453 	if (zone_status_get(zone) > ZONE_IS_RUNNING) {
4454 		/*
4455 		 * This zone is already on its way down.
4456 		 */
4457 		mutex_exit(&zone_status_lock);
4458 		return (0);
4459 	}
4460 	/*
4461 	 * Prevent future zone_enter()s
4462 	 */
4463 	zone_status_set(zone, ZONE_IS_SHUTTING_DOWN);
4464 	mutex_exit(&zone_status_lock);
4465 
4466 	/*
4467 	 * Kill everyone now and call zoneadmd later.
4468 	 * zone_ki_call_zoneadmd() will do a more thorough job of this
4469 	 * later.
4470 	 */
4471 	killall(zone->zone_id);
4472 	/*
4473 	 * Now, create the thread to contact zoneadmd and do the rest of the
4474 	 * work.  This thread can't be created in our zone otherwise
4475 	 * zone_destroy() would deadlock.
4476 	 */
4477 	zargp = kmem_alloc(sizeof (*zargp), KM_SLEEP);
4478 	zargp->arg.cmd = zcmd;
4479 	zargp->arg.uniqid = zone->zone_uniqid;
4480 	(void) strcpy(zargp->arg.locale, "C");
4481 	zone_hold(zargp->zone = zone);
4482 
4483 	(void) thread_create(NULL, 0, zone_ki_call_zoneadmd, zargp, 0, &p0,
4484 	    TS_RUN, minclsyspri);
4485 	exit(CLD_EXITED, 0);
4486 
4487 	return (EINVAL);
4488 }
4489 
4490 /*
4491  * Entry point so kadmin(A_SHUTDOWN, ...) can set the global zone's
4492  * status to ZONE_IS_SHUTTING_DOWN.
4493  */
4494 void
4495 zone_shutdown_global(void)
4496 {
4497 	ASSERT(curproc->p_zone == global_zone);
4498 
4499 	mutex_enter(&zone_status_lock);
4500 	ASSERT(zone_status_get(global_zone) == ZONE_IS_RUNNING);
4501 	zone_status_set(global_zone, ZONE_IS_SHUTTING_DOWN);
4502 	mutex_exit(&zone_status_lock);
4503 }
4504 
4505 /*
4506  * Returns true if the named dataset is visible in the current zone.
4507  * The 'write' parameter is set to 1 if the dataset is also writable.
4508  */
4509 int
4510 zone_dataset_visible(const char *dataset, int *write)
4511 {
4512 	zone_dataset_t *zd;
4513 	size_t len;
4514 	zone_t *zone = curproc->p_zone;
4515 
4516 	if (dataset[0] == '\0')
4517 		return (0);
4518 
4519 	/*
4520 	 * Walk the list once, looking for datasets which match exactly, or
4521 	 * specify a dataset underneath an exported dataset.  If found, return
4522 	 * true and note that it is writable.
4523 	 */
4524 	for (zd = list_head(&zone->zone_datasets); zd != NULL;
4525 	    zd = list_next(&zone->zone_datasets, zd)) {
4526 
4527 		len = strlen(zd->zd_dataset);
4528 		if (strlen(dataset) >= len &&
4529 		    bcmp(dataset, zd->zd_dataset, len) == 0 &&
4530 		    (dataset[len] == '\0' || dataset[len] == '/' ||
4531 		    dataset[len] == '@')) {
4532 			if (write)
4533 				*write = 1;
4534 			return (1);
4535 		}
4536 	}
4537 
4538 	/*
4539 	 * Walk the list a second time, searching for datasets which are parents
4540 	 * of exported datasets.  These should be visible, but read-only.
4541 	 *
4542 	 * Note that we also have to support forms such as 'pool/dataset/', with
4543 	 * a trailing slash.
4544 	 */
4545 	for (zd = list_head(&zone->zone_datasets); zd != NULL;
4546 	    zd = list_next(&zone->zone_datasets, zd)) {
4547 
4548 		len = strlen(dataset);
4549 		if (dataset[len - 1] == '/')
4550 			len--;	/* Ignore trailing slash */
4551 		if (len < strlen(zd->zd_dataset) &&
4552 		    bcmp(dataset, zd->zd_dataset, len) == 0 &&
4553 		    zd->zd_dataset[len] == '/') {
4554 			if (write)
4555 				*write = 0;
4556 			return (1);
4557 		}
4558 	}
4559 
4560 	return (0);
4561 }
4562 
4563 /*
4564  * zone_find_by_any_path() -
4565  *
4566  * kernel-private routine similar to zone_find_by_path(), but which
4567  * effectively compares against zone paths rather than zonerootpath
4568  * (i.e., the last component of zonerootpaths, which should be "root/",
4569  * are not compared.)  This is done in order to accurately identify all
4570  * paths, whether zone-visible or not, including those which are parallel
4571  * to /root/, such as /dev/, /home/, etc...
4572  *
4573  * If the specified path does not fall under any zone path then global
4574  * zone is returned.
4575  *
4576  * The treat_abs parameter indicates whether the path should be treated as
4577  * an absolute path although it does not begin with "/".  (This supports
4578  * nfs mount syntax such as host:any/path.)
4579  *
4580  * The caller is responsible for zone_rele of the returned zone.
4581  */
4582 zone_t *
4583 zone_find_by_any_path(const char *path, boolean_t treat_abs)
4584 {
4585 	zone_t *zone;
4586 	int path_offset = 0;
4587 
4588 	if (path == NULL) {
4589 		zone_hold(global_zone);
4590 		return (global_zone);
4591 	}
4592 
4593 	if (*path != '/') {
4594 		ASSERT(treat_abs);
4595 		path_offset = 1;
4596 	}
4597 
4598 	mutex_enter(&zonehash_lock);
4599 	for (zone = list_head(&zone_active); zone != NULL;
4600 	    zone = list_next(&zone_active, zone)) {
4601 		char	*c;
4602 		size_t	pathlen;
4603 		char *rootpath_start;
4604 
4605 		if (zone == global_zone)	/* skip global zone */
4606 			continue;
4607 
4608 		/* scan backwards to find start of last component */
4609 		c = zone->zone_rootpath + zone->zone_rootpathlen - 2;
4610 		do {
4611 			c--;
4612 		} while (*c != '/');
4613 
4614 		pathlen = c - zone->zone_rootpath + 1 - path_offset;
4615 		rootpath_start = (zone->zone_rootpath + path_offset);
4616 		if (strncmp(path, rootpath_start, pathlen) == 0)
4617 			break;
4618 	}
4619 	if (zone == NULL)
4620 		zone = global_zone;
4621 	zone_hold(zone);
4622 	mutex_exit(&zonehash_lock);
4623 	return (zone);
4624 }
4625