/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 */

/*

 * Zones

 *

 *   A zone is a named collection of processes, namespace constraints,

 *   and other system resources which comprise a secure and manageable

 *   application containment facility.

 *

 *   Zones (represented by the reference counted zone_t) are tracked in

 *   the kernel in the zonehash.  Elsewhere in the kernel, Zone IDs

 *   (zoneid_t) are used to track zone association.  Zone IDs are

 *   dynamically generated when the zone is created; if a persistent

 *   identifier is needed (core files, accounting logs, audit trail,

 *   etc.), the zone name should be used.

 *

 *

 *   Global Zone:

 *

 *   The global zone (zoneid 0) is automatically associated with all

 *   system resources that have not been bound to a user-created zone.

 *   This means that even systems where zones are not in active use

 *   have a global zone, and all processes, mounts, etc. are

 *   associated with that zone.  The global zone is generally

 *   unconstrained in terms of privileges and access, though the usual

 *   credential and privilege based restrictions apply.

 *

 *

 *   Zone States:

 *

 *   The states in which a zone may be in and the transitions are as

 *   follows:

 *

 *   ZONE_IS_UNINITIALIZED: primordial state for a zone. The partially

 *   initialized zone is added to the list of active zones on the system but

 *   isn't accessible.

 *

 *   ZONE_IS_INITIALIZED: Initialization complete except the ZSD callbacks are

 *   not yet completed. Not possible to enter the zone, but attributes can

 *   be retrieved.

 *

 *   ZONE_IS_READY: zsched (the kernel dummy process for a zone) is

 *   ready.  The zone is made visible after the ZSD constructor callbacks are

 *   executed.  A zone remains in this state until it transitions into

 *   the ZONE_IS_BOOTING state as a result of a call to zone_boot().

 *

 *   ZONE_IS_BOOTING: in this shortlived-state, zsched attempts to start

 *   init.  Should that fail, the zone proceeds to the ZONE_IS_SHUTTING_DOWN

 *   state.

 *

 *   ZONE_IS_RUNNING: The zone is open for business: zsched has

 *   successfully started init.   A zone remains in this state until

 *   zone_shutdown() is called.

 *

 *   ZONE_IS_SHUTTING_DOWN: zone_shutdown() has been called, the system is

 *   killing all processes running in the zone. The zone remains

 *   in this state until there are no more user processes running in the zone.

 *   zone_create(), zone_enter(), and zone_destroy() on this zone will fail.

 *   Since zone_shutdown() is restartable, it may be called successfully

 *   multiple times for the same zone_t.  Setting of the zone's state to

 *   ZONE_IS_SHUTTING_DOWN is synchronized with mounts, so VOP_MOUNT() may check

 *   the zone's status without worrying about it being a moving target.

 *

 *   ZONE_IS_EMPTY: zone_shutdown() has been called, and there

 *   are no more user processes in the zone.  The zone remains in this

 *   state until there are no more kernel threads associated with the

 *   zone.  zone_create(), zone_enter(), and zone_destroy() on this zone will

 *   fail.

 *

 *   ZONE_IS_DOWN: All kernel threads doing work on behalf of the zone

 *   have exited.  zone_shutdown() returns.  Henceforth it is not possible to

 *   join the zone or create kernel threads therein.

 *

 *   ZONE_IS_DYING: zone_destroy() has been called on the zone; zone

 *   remains in this state until zsched exits.  Calls to zone_find_by_*()

 *   return NULL from now on.

 *

 *   ZONE_IS_DEAD: zsched has exited (zone_ntasks == 0).  There are no

 *   processes or threads doing work on behalf of the zone.  The zone is

 *   removed from the list of active zones.  zone_destroy() returns, and

 *   the zone can be recreated.

 *

 *   ZONE_IS_FREE (internal state): zone_ref goes to 0, ZSD destructor

 *   callbacks are executed, and all memory associated with the zone is

 *   freed.

 *

 *   Threads can wait for the zone to enter a requested state by using

 *   zone_status_wait() or zone_status_timedwait() with the desired

 *   state passed in as an argument.  Zone state transitions are

 *   uni-directional; it is not possible to move back to an earlier state.

 *

 *

 *   Zone-Specific Data:

 *

 *   Subsystems needing to maintain zone-specific data can store that

 *   data using the ZSD mechanism.  This provides a zone-specific data

 *   store, similar to thread-specific data (see pthread_getspecific(3C)

 *   or the TSD code in uts/common/disp/thread.c.  Also, ZSD can be used

 *   to register callbacks to be invoked when a zone is created, shut

 *   down, or destroyed.  This can be used to initialize zone-specific

 *   data for new zones and to clean up when zones go away.

 *

 *

 *   Data Structures:

 *

 *   The per-zone structure (zone_t) is reference counted, and freed

 *   when all references are released.  zone_hold and zone_rele can be

 *   used to adjust the reference count.  In addition, reference counts

 *   associated with the cred_t structure are tracked separately using

 *   zone_cred_hold and zone_cred_rele.

 *

 *   Pointers to active zone_t's are stored in two hash tables; one

 *   for searching by id, the other for searching by name.  Lookups

 *   can be performed on either basis, using zone_find_by_id and

 *   zone_find_by_name.  Both return zone_t pointers with the zone

 *   held, so zone_rele should be called when the pointer is no longer

 *   needed.  Zones can also be searched by path; zone_find_by_path

 *   returns the zone with which a path name is associated (global

 *   zone if the path is not within some other zone's file system

 *   hierarchy).  This currently requires iterating through each zone,

 *   so it is slower than an id or name search via a hash table.

 *

 *

 *   Locking:

 *

 *   zonehash_lock: This is a top-level global lock used to protect the

 *       zone hash tables and lists.  Zones cannot be created or destroyed

 *       while this lock is held.

 *   zone_status_lock: This is a global lock protecting zone state.

 *       Zones cannot change state while this lock is held.  It also

 *       protects the list of kernel threads associated with a zone.

 *   zone_lock: This is a per-zone lock used to protect several fields of

 *       the zone_t (see <sys/zone.h> for details).  In addition, holding

 *       this lock means that the zone cannot go away.

 *   zone_nlwps_lock: This is a per-zone lock used to protect the fields

 *	 related to the zone.max-lwps rctl.

 *   zone_mem_lock: This is a per-zone lock used to protect the fields

 *	 related to the zone.max-locked-memory and zone.max-swap rctls.

 *   zsd_key_lock: This is a global lock protecting the key state for ZSD.

 *   zone_deathrow_lock: This is a global lock protecting the "deathrow"

 *       list (a list of zones in the ZONE_IS_DEAD state).

 *

 *   Ordering requirements:

 *       pool_lock --> cpu_lock --> zonehash_lock --> zone_status_lock -->

 *       	zone_lock --> zsd_key_lock --> pidlock --> p_lock

 *

 *   When taking zone_mem_lock or zone_nlwps_lock, the lock ordering is:

 *	zonehash_lock --> a_lock --> pidlock --> p_lock --> zone_mem_lock

 *	zonehash_lock --> a_lock --> pidlock --> p_lock --> zone_mem_lock

 *

 *   Blocking memory allocations are permitted while holding any of the

 *   zone locks.

 *

 *

 *   System Call Interface:

 *

 *   The zone subsystem can be managed and queried from user level with

 *   the following system calls (all subcodes of the primary "zone"

 *   system call):

 *   - zone_create: creates a zone with selected attributes (name,

 *     root path, privileges, resource controls, ZFS datasets)

 *   - zone_enter: allows the current process to enter a zone

 *   - zone_getattr: reports attributes of a zone

 *   - zone_setattr: set attributes of a zone

 *   - zone_boot: set 'init' running for the zone

 *   - zone_list: lists all zones active in the system

 *   - zone_lookup: looks up zone id based on name

 *   - zone_shutdown: initiates shutdown process (see states above)

 *   - zone_destroy: completes shutdown process (see states above)

 *

 */

#include <sys/priv_impl.h>

#include <sys/cred.h>

#include <c2/audit.h>

#include <sys/debug.h>

#include <sys/file.h>

#include <sys/kmem.h>

#include <sys/kstat.h>

#include <sys/mutex.h>

#include <sys/note.h>

#include <sys/pathname.h>

#include <sys/proc.h>

#include <sys/project.h>

#include <sys/sysevent.h>

#include <sys/task.h>

#include <sys/systm.h>

#include <sys/types.h>

#include <sys/utsname.h>

#include <sys/vnode.h>

#include <sys/vfs.h>

#include <sys/systeminfo.h>

#include <sys/policy.h>

#include <sys/cred_impl.h>

#include <sys/contract_impl.h>

#include <sys/contract/process_impl.h>

#include <sys/class.h>

#include <sys/pool.h>

#include <sys/pool_pset.h>

#include <sys/pset.h>

#include <sys/sysmacros.h>

#include <sys/callb.h>

#include <sys/vmparam.h>

#include <sys/corectl.h>

#include <sys/ipc_impl.h>

#include <sys/door.h>

#include <sys/cpuvar.h>

#include <sys/sdt.h>

#include <sys/uadmin.h>

#include <sys/session.h>

#include <sys/cmn_err.h>

#include <sys/modhash.h>

#include <sys/sunddi.h>

#include <sys/nvpair.h>

#include <sys/rctl.h>

#include <sys/fss.h>

#include <sys/brand.h>

#include <sys/zone.h>

#include <net/if.h>

#include <sys/cpucaps.h>

#include <vm/seg.h>

#include <sys/mac.h>

/* List of data link IDs which are accessible from the zone */

typedef struct zone_dl {

	datalink_id_t	zdl_id;

	list_node_t	zdl_linkage;

} zone_dl_t;

/*

 * cv used to signal that all references to the zone have been released.  This

 * needs to be global since there may be multiple waiters, and the first to

 * wake up will free the zone_t, hence we cannot use zone->zone_cv.

 */

static kcondvar_t zone_destroy_cv;

/*

 * Lock used to serialize access to zone_cv.  This could have been per-zone,

 * but then we'd need another lock for zone_destroy_cv, and why bother?

 */

static kmutex_t zone_status_lock;

/*

 * ZSD-related global variables.

 */

static kmutex_t zsd_key_lock;	/* protects the following two */

/*

 * The next caller of zone_key_create() will be assigned a key of ++zsd_keyval.

 */

static zone_key_t zsd_keyval = 0;

/*

 * Global list of registered keys.  We use this when a new zone is created.

 */

static list_t zsd_registered_keys;

int zone_hash_size = 256;

static mod_hash_t *zonehashbyname, *zonehashbyid, *zonehashbylabel;

static kmutex_t zonehash_lock;

static uint_t zonecount;

static id_space_t *zoneid_space;

/*

 * The global zone (aka zone0) is the all-seeing, all-knowing zone in which the

 * kernel proper runs, and which manages all other zones.

 *

 * Although not declared as static, the variable "zone0" should not be used

 * except for by code that needs to reference the global zone early on in boot,

 * before it is fully initialized.  All other consumers should use

 * 'global_zone'.

 */

zone_t zone0;

zone_t *global_zone = NULL;	/* Set when the global zone is initialized */

/*

 * List of active zones, protected by zonehash_lock.

 */

static list_t zone_active;

/*

 * List of destroyed zones that still have outstanding cred references.

 * Used for debugging.  Uses a separate lock to avoid lock ordering

 * problems in zone_free.

 */

static list_t zone_deathrow;

static kmutex_t zone_deathrow_lock;

/* number of zones is limited by virtual interface limit in IP */

uint_t maxzones = 8192;

/* Event channel to sent zone state change notifications */

evchan_t *zone_event_chan;

/*

 * This table holds the mapping from kernel zone states to

 * states visible in the state notification API.

 * The idea is that we only expose "obvious" states and

 * do not expose states which are just implementation details.

 */

const char  *zone_status_table[] = {

	ZONE_EVENT_UNINITIALIZED,	/* uninitialized */

	ZONE_EVENT_INITIALIZED,		/* initialized */

	ZONE_EVENT_READY,		/* ready */

	ZONE_EVENT_READY,		/* booting */

	ZONE_EVENT_RUNNING,		/* running */

	ZONE_EVENT_SHUTTING_DOWN,	/* shutting_down */

	ZONE_EVENT_SHUTTING_DOWN,	/* empty */

	ZONE_EVENT_SHUTTING_DOWN,	/* down */

	ZONE_EVENT_SHUTTING_DOWN,	/* dying */

	ZONE_EVENT_UNINITIALIZED,	/* dead */

};

/*

 * This isn't static so lint doesn't complain.

 */

rctl_hndl_t rc_zone_cpu_shares;

rctl_hndl_t rc_zone_locked_mem;

rctl_hndl_t rc_zone_max_swap;

rctl_hndl_t rc_zone_cpu_cap;

rctl_hndl_t rc_zone_nlwps;

rctl_hndl_t rc_zone_shmmax;

rctl_hndl_t rc_zone_shmmni;

rctl_hndl_t rc_zone_semmni;

rctl_hndl_t rc_zone_msgmni;

/*

 * Synchronization primitives used to synchronize between mounts and zone

 * creation/destruction.

 */

static int mounts_in_progress;

static kcondvar_t mount_cv;

static kmutex_t mount_lock;

const char * const zone_default_initname = "/sbin/init";

static char * const zone_prefix = "/zone/";

static int zone_shutdown(zoneid_t zoneid);

static int zone_add_datalink(zoneid_t, datalink_id_t);

static int zone_remove_datalink(zoneid_t, datalink_id_t);

static int zone_list_datalink(zoneid_t, int *, datalink_id_t *);

typedef boolean_t zsd_applyfn_t(kmutex_t *, boolean_t, zone_t *, zone_key_t);

static void zsd_apply_all_zones(zsd_applyfn_t *, zone_key_t);

static void zsd_apply_all_keys(zsd_applyfn_t *, zone_t *);

static boolean_t zsd_apply_create(kmutex_t *, boolean_t, zone_t *, zone_key_t);

static boolean_t zsd_apply_shutdown(kmutex_t *, boolean_t, zone_t *,

    zone_key_t);

static boolean_t zsd_apply_destroy(kmutex_t *, boolean_t, zone_t *, zone_key_t);

static boolean_t zsd_wait_for_creator(zone_t *, struct zsd_entry *,

    kmutex_t *);

static boolean_t zsd_wait_for_inprogress(zone_t *, struct zsd_entry *,

    kmutex_t *);

/*

 * Bump this number when you alter the zone syscall interfaces; this is

 * because we need to have support for previous API versions in libc

 * to support patching; libc calls into the kernel to determine this number.

 *

 * Version 1 of the API is the version originally shipped with Solaris 10

 * Version 2 alters the zone_create system call in order to support more

 *     arguments by moving the args into a structure; and to do better

 *     error reporting when zone_create() fails.

 * Version 3 alters the zone_create system call in order to support the

 *     import of ZFS datasets to zones.

 * Version 4 alters the zone_create system call in order to support

 *     Trusted Extensions.

 * Version 5 alters the zone_boot system call, and converts its old

 *     bootargs parameter to be set by the zone_setattr API instead.

 * Version 6 adds the flag argument to zone_create.

 */

static const int ZONE_SYSCALL_API_VERSION = 6;

/*

 * Certain filesystems (such as NFS and autofs) need to know which zone

 * the mount is being placed in.  Because of this, we need to be able to

 * ensure that a zone isn't in the process of being created such that

 * nfs_mount() thinks it is in the global zone, while by the time it

 * gets added the list of mounted zones, it ends up on zoneA's mount

 * list.

 *

 * The following functions: block_mounts()/resume_mounts() and

 * mount_in_progress()/mount_completed() are used by zones and the VFS

 * layer (respectively) to synchronize zone creation and new mounts.

 *

 * The semantics are like a reader-reader lock such that there may

 * either be multiple mounts (or zone creations, if that weren't

 * serialized by zonehash_lock) in progress at the same time, but not

 * both.

 *

 * We use cv's so the user can ctrl-C out of the operation if it's

 * taking too long.

 *

 * The semantics are such that there is unfair bias towards the

 * "current" operation.  This means that zone creations may starve if

 * there is a rapid succession of new mounts coming in to the system, or

 * there is a remote possibility that zones will be created at such a

 * rate that new mounts will not be able to proceed.

 */

/*

 * Prevent new mounts from progressing to the point of calling

 * VFS_MOUNT().  If there are already mounts in this "region", wait for

 * them to complete.

 */

static int

block_mounts(void)

{

	int retval = 0;

	/*

	 * Since it may block for a long time, block_mounts() shouldn't be

	 * called with zonehash_lock held.

	 */

	ASSERT(MUTEX_NOT_HELD(&zonehash_lock));

	mutex_enter(&mount_lock);

	while (mounts_in_progress > 0) {

		if (cv_wait_sig(&mount_cv, &mount_lock) == 0)

			goto signaled;

	}

	/*

	 * A negative value of mounts_in_progress indicates that mounts

	 * have been blocked by (-mounts_in_progress) different callers.

	 */

	mounts_in_progress--;

	retval = 1;

signaled:

	mutex_exit(&mount_lock);

	return (retval);

}

/*

 * The VFS layer may progress with new mounts as far as we're concerned.

 * Allow them to progress if we were the last obstacle.

 */

static void

resume_mounts(void)

{

	mutex_enter(&mount_lock);

	if (++mounts_in_progress == 0)

		cv_broadcast(&mount_cv);

	mutex_exit(&mount_lock);

}

/*

 * The VFS layer is busy with a mount; zones should wait until all

 * mounts are completed to progress.

 */

void

mount_in_progress(void)

{

	mutex_enter(&mount_lock);

	while (mounts_in_progress < 0)

		cv_wait(&mount_cv, &mount_lock);

	mounts_in_progress++;

	mutex_exit(&mount_lock);

}

/*

 * VFS is done with one mount; wake up any waiting block_mounts()

 * callers if this is the last mount.

 */

void

mount_completed(void)

{

	mutex_enter(&mount_lock);

	if (--mounts_in_progress == 0)

		cv_broadcast(&mount_cv);

	mutex_exit(&mount_lock);

}

/*

 * ZSD routines.

 *

 * Zone Specific Data (ZSD) is modeled after Thread Specific Data as

 * defined by the pthread_key_create() and related interfaces.

 *

 * Kernel subsystems may register one or more data items and/or

 * callbacks to be executed when a zone is created, shutdown, or

 * destroyed.

 *

 * Unlike the thread counterpart, destructor callbacks will be executed

 * even if the data pointer is NULL and/or there are no constructor

 * callbacks, so it is the responsibility of such callbacks to check for

 * NULL data values if necessary.

 *

 * The locking strategy and overall picture is as follows:

 *

 * When someone calls zone_key_create(), a template ZSD entry is added to the

 * global list "zsd_registered_keys", protected by zsd_key_lock.  While

 * holding that lock all the existing zones are marked as

 * ZSD_CREATE_NEEDED and a copy of the ZSD entry added to the per-zone

 * zone_zsd list (protected by zone_lock). The global list is updated first

 * (under zone_key_lock) to make sure that newly created zones use the

 * most recent list of keys. Then under zonehash_lock we walk the zones

 * and mark them.  Similar locking is used in zone_key_delete().