1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  * Copyright 2015 Joyent, Inc.
  26  * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
  27  */
  28 
  29 /*
  30  * Console support for zones requires a significant infrastructure.  The
  31  * core pieces are contained in this file, but other portions of note
  32  * are in the zlogin(1M) command, the zcons(7D) driver, and in the
  33  * devfsadm(1M) misc_link generator.
  34  *
  35  * Care is taken to make the console behave in an "intuitive" fashion for
  36  * administrators.  Essentially, we try as much as possible to mimic the
  37  * experience of using a system via a tip line and system controller.
  38  *
  39  * The zone console architecture looks like this:
  40  *
  41  *                                      Global Zone | Non-Global Zone
  42  *                        .--------------.          |
  43  *        .-----------.   | zoneadmd -z  |          | .--------. .---------.
  44  *        | zlogin -C |   |     myzone   |          | | ttymon | | syslogd |
  45  *        `-----------'   `--------------'          | `--------' `---------'
  46  *                  |       |       | |             |      |       |
  47  *  User            |       |       | |             |      V       V
  48  * - - - - - - - - -|- - - -|- - - -|-|- - - - - - -|- - /dev/zconsole - - -
  49  *  Kernel          V       V       | |                        |
  50  *               [AF_UNIX Socket]   | `--------. .-------------'
  51  *                                  |          | |
  52  *                                  |          V V
  53  *                                  |     +-----------+
  54  *                                  |     |  ldterm,  |
  55  *                                  |     |   etc.    |
  56  *                                  |     +-----------+
  57  *                                  |     +-[Anchor]--+
  58  *                                  |     |   ptem    |
  59  *                                  V     +-----------+
  60  *                           +---master---+---slave---+
  61  *                           |                        |
  62  *                           |      zcons driver      |
  63  *                           |    zonename="myzone"   |
  64  *                           +------------------------+
  65  *
  66  * There are basically two major tasks which the console subsystem in
  67  * zoneadmd accomplishes:
  68  *
  69  * - Setup and teardown of zcons driver instances.  One zcons instance
  70  *   is maintained per zone; we take advantage of the libdevice APIs
  71  *   to online new instances of zcons as needed.  Care is taken to
  72  *   prune and manage these appropriately; see init_console_dev() and
  73  *   destroy_console_dev().  The end result is the creation of the
  74  *   zcons(7D) instance and an open file descriptor to the master side.
  75  *   zcons instances are associated with zones via their zonename device
  76  *   property.  This the console instance to persist across reboots,
  77  *   and while the zone is halted.
  78  *
  79  * - Acting as a server for 'zlogin -C' instances.  When zlogin -C is
  80  *   run, zlogin connects to zoneadmd via unix domain socket.  zoneadmd
  81  *   functions as a two-way proxy for console I/O, relaying user input
  82  *   to the master side of the console, and relaying output from the
  83  *   zone to the user.
  84  */
  85 
  86 #include <sys/types.h>
  87 #include <sys/socket.h>
  88 #include <sys/stat.h>
  89 #include <sys/termios.h>
  90 #include <sys/zcons.h>
  91 #include <sys/mkdev.h>
  92 
  93 #include <assert.h>
  94 #include <ctype.h>
  95 #include <errno.h>
  96 #include <fcntl.h>
  97 #include <stdarg.h>
  98 #include <stdio.h>
  99 #include <stdlib.h>
 100 #include <strings.h>
 101 #include <stropts.h>
 102 #include <thread.h>
 103 #include <ucred.h>
 104 #include <unistd.h>
 105 #include <zone.h>
 106 
 107 #include <libdevinfo.h>
 108 #include <libdevice.h>
 109 #include <libzonecfg.h>
 110 
 111 #include <syslog.h>
 112 #include <sys/modctl.h>
 113 
 114 #include "zoneadmd.h"
 115 
 116 #define ZCONSNEX_DEVTREEPATH    "/pseudo/zconsnex@1"
 117 #define ZCONSNEX_FILEPATH       "/devices/pseudo/zconsnex@1"
 118 
 119 #define CONSOLE_SOCKPATH        ZONES_TMPDIR "/%s.console_sock"
 120 
 121 static int      serverfd = -1;  /* console server unix domain socket fd */
 122 char boot_args[BOOTARGS_MAX];
 123 
 124 /*
 125  * The eventstream is a simple one-directional flow of messages from the
 126  * door server to the console subsystem, implemented with a pipe.
 127  * It is used to wake up the console poller when it needs to take action,
 128  * message the user, die off, etc.
 129  */
 130 static int eventstream[2];
 131 
 132 
 133 
 134 int
 135 eventstream_init()
 136 {
 137         if (pipe(eventstream) == -1)
 138                 return (-1);
 139         return (0);
 140 }
 141 
 142 void
 143 eventstream_write(zone_evt_t evt)
 144 {
 145         (void) write(eventstream[0], &evt, sizeof (evt));
 146 }
 147 
 148 static zone_evt_t
 149 eventstream_read(void)
 150 {
 151         zone_evt_t evt = Z_EVT_NULL;
 152 
 153         (void) read(eventstream[1], &evt, sizeof (evt));
 154         return (evt);
 155 }
 156 
 157 /*
 158  * count_console_devs() and its helper count_cb() do a walk of the
 159  * subtree of the device tree where zone console nodes are represented.
 160  * The goal is to count zone console instances already setup for a zone
 161  * with the given name.  More than 1 is anomolous, and our caller will
 162  * have to deal with that if we find that's the case.
 163  *
 164  * Note: this algorithm is a linear search of nodes in the zconsnex subtree
 165  * of the device tree, and could be a scalability problem, but I don't see
 166  * how to avoid it.
 167  */
 168 
 169 /*
 170  * cb_data is shared by count_cb and destroy_cb for simplicity.
 171  */
 172 struct cb_data {
 173         zlog_t *zlogp;
 174         int found;
 175         int killed;
 176 };
 177 
 178 static int
 179 count_cb(di_node_t node, void *arg)
 180 {
 181         struct cb_data *cb = (struct cb_data *)arg;
 182         char *prop_data;
 183 
 184         if (di_prop_lookup_strings(DDI_DEV_T_ANY, node, "zonename",
 185             &prop_data) != -1) {
 186                 assert(prop_data != NULL);
 187                 if (strcmp(prop_data, zone_name) == 0) {
 188                         cb->found++;
 189                         return (DI_WALK_CONTINUE);
 190                 }
 191         }
 192         return (DI_WALK_CONTINUE);
 193 }
 194 
 195 static int
 196 count_console_devs(zlog_t *zlogp)
 197 {
 198         di_node_t root;
 199         struct cb_data cb;
 200 
 201         bzero(&cb, sizeof (cb));
 202         cb.zlogp = zlogp;
 203 
 204         if ((root = di_init(ZCONSNEX_DEVTREEPATH, DINFOCPYALL)) ==
 205             DI_NODE_NIL) {
 206                 zerror(zlogp, B_TRUE, "%s failed", "di_init");
 207                 return (-1);
 208         }
 209 
 210         (void) di_walk_node(root, DI_WALK_CLDFIRST, (void *)&cb, count_cb);
 211         di_fini(root);
 212         return (cb.found);
 213 }
 214 
 215 /*
 216  * destroy_console_devs() and its helper destroy_cb() tears down any console
 217  * instances associated with this zone.  If things went very wrong, we
 218  * might have more than one console instance hanging around.  This routine
 219  * hunts down and tries to remove all of them.  Of course, if the console
 220  * is open, the instance will not detach, which is a potential issue.
 221  */
 222 static int
 223 destroy_cb(di_node_t node, void *arg)
 224 {
 225         struct cb_data *cb = (struct cb_data *)arg;
 226         char *prop_data;
 227         char *tmp;
 228         char devpath[MAXPATHLEN];
 229         devctl_hdl_t hdl;
 230 
 231         if (di_prop_lookup_strings(DDI_DEV_T_ANY, node, "zonename",
 232             &prop_data) == -1)
 233                 return (DI_WALK_CONTINUE);
 234 
 235         assert(prop_data != NULL);
 236         if (strcmp(prop_data, zone_name) != 0) {
 237                 /* this is the console for a different zone */
 238                 return (DI_WALK_CONTINUE);
 239         }
 240 
 241         cb->found++;
 242         tmp = di_devfs_path(node);
 243         (void) snprintf(devpath, sizeof (devpath), "/devices/%s", tmp);
 244         di_devfs_path_free(tmp);
 245 
 246         if ((hdl = devctl_device_acquire(devpath, 0)) == NULL) {
 247                 zerror(cb->zlogp, B_TRUE, "WARNING: console %s found, "
 248                     "but it could not be controlled.", devpath);
 249                 return (DI_WALK_CONTINUE);
 250         }
 251         if (devctl_device_remove(hdl) == 0) {
 252                 cb->killed++;
 253         } else {
 254                 zerror(cb->zlogp, B_TRUE, "WARNING: console %s found, "
 255                     "but it could not be removed.", devpath);
 256         }
 257         devctl_release(hdl);
 258         return (DI_WALK_CONTINUE);
 259 }
 260 
 261 static int
 262 destroy_console_devs(zlog_t *zlogp)
 263 {
 264         char conspath[MAXPATHLEN];
 265         di_node_t root;
 266         struct cb_data cb;
 267         int masterfd;
 268         int slavefd;
 269 
 270         /*
 271          * Signal the master side to release its handle on the slave side by
 272          * issuing a ZC_RELEASESLAVE ioctl.
 273          */
 274         (void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
 275             zone_name, ZCONS_MASTER_NAME);
 276         if ((masterfd = open(conspath, O_RDWR | O_NOCTTY)) != -1) {
 277                 (void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
 278                     zone_name, ZCONS_SLAVE_NAME);
 279                 if ((slavefd = open(conspath, O_RDWR | O_NOCTTY)) != -1) {
 280                         if (ioctl(masterfd, ZC_RELEASESLAVE,
 281                             (caddr_t)(intptr_t)slavefd) != 0)
 282                                 zerror(zlogp, B_TRUE, "WARNING: error while "
 283                                     "releasing slave handle of zone console for"
 284                                     " %s", zone_name);
 285                         (void) close(slavefd);
 286                 } else {
 287                         zerror(zlogp, B_TRUE, "WARNING: could not open slave "
 288                             "side of zone console for %s to release slave "
 289                             "handle", zone_name);
 290                 }
 291                 (void) close(masterfd);
 292         } else {
 293                 zerror(zlogp, B_TRUE, "WARNING: could not open master side of "
 294                     "zone console for %s to release slave handle", zone_name);
 295         }
 296 
 297         bzero(&cb, sizeof (cb));
 298         cb.zlogp = zlogp;
 299 
 300         if ((root = di_init(ZCONSNEX_DEVTREEPATH, DINFOCPYALL)) ==
 301             DI_NODE_NIL) {
 302                 zerror(zlogp, B_TRUE, "%s failed", "di_init");
 303                 return (-1);
 304         }
 305 
 306         (void) di_walk_node(root, DI_WALK_CLDFIRST, (void *)&cb, destroy_cb);
 307         if (cb.found > 1) {
 308                 zerror(zlogp, B_FALSE, "WARNING: multiple zone console "
 309                     "instances detected for zone '%s'; %d of %d "
 310                     "successfully removed.",
 311                     zone_name, cb.killed, cb.found);
 312         }
 313 
 314         di_fini(root);
 315         return (0);
 316 }
 317 
 318 /*
 319  * init_console_dev() drives the device-tree configuration of the zone
 320  * console device.  The general strategy is to use the libdevice (devctl)
 321  * interfaces to instantiate a new zone console node.  We do a lot of
 322  * sanity checking, and are careful to reuse a console if one exists.
 323  *
 324  * Once the device is in the device tree, we kick devfsadm via di_init_devs()
 325  * to ensure that the appropriate symlinks (to the master and slave console
 326  * devices) are placed in /dev in the global zone.
 327  */
 328 static int
 329 init_console_dev(zlog_t *zlogp)
 330 {
 331         char conspath[MAXPATHLEN];
 332         devctl_hdl_t bus_hdl = NULL;
 333         devctl_hdl_t dev_hdl = NULL;
 334         devctl_ddef_t ddef_hdl = NULL;
 335         di_devlink_handle_t dl = NULL;
 336         int rv = -1;
 337         int ndevs;
 338         int masterfd;
 339         int slavefd;
 340         int i;
 341 
 342         /*
 343          * Don't re-setup console if it is working and ready already; just
 344          * skip ahead to making devlinks, which we do for sanity's sake.
 345          */
 346         ndevs = count_console_devs(zlogp);
 347         if (ndevs == 1) {
 348                 goto devlinks;
 349         } else if (ndevs > 1 || ndevs == -1) {
 350                 /*
 351                  * For now, this seems like a reasonable but harsh punishment.
 352                  * If needed, we could try to get clever and delete all but
 353                  * the console which is pointed at by the current symlink.
 354                  */
 355                 if (destroy_console_devs(zlogp) == -1) {
 356                         goto error;
 357                 }
 358         }
 359 
 360         /*
 361          * Time to make the consoles!
 362          */
 363         if ((bus_hdl = devctl_bus_acquire(ZCONSNEX_FILEPATH, 0)) == NULL) {
 364                 zerror(zlogp, B_TRUE, "%s failed", "devctl_bus_acquire");
 365                 goto error;
 366         }
 367         if ((ddef_hdl = devctl_ddef_alloc("zcons", 0)) == NULL) {
 368                 zerror(zlogp, B_TRUE, "failed to allocate ddef handle");
 369                 goto error;
 370         }
 371         /*
 372          * Set three properties on this node; the first is the name of the
 373          * zone; the second is a flag which lets pseudo know that it is
 374          * OK to automatically allocate an instance # for this device;
 375          * the third tells the device framework not to auto-detach this
 376          * node-- we need the node to still be there when we ask devfsadmd
 377          * to make links, and when we need to open it.
 378          */
 379         if (devctl_ddef_string(ddef_hdl, "zonename", zone_name) == -1) {
 380                 zerror(zlogp, B_TRUE, "failed to create zonename property");
 381                 goto error;
 382         }
 383         if (devctl_ddef_int(ddef_hdl, "auto-assign-instance", 1) == -1) {
 384                 zerror(zlogp, B_TRUE, "failed to create auto-assign-instance "
 385                     "property");
 386                 goto error;
 387         }
 388         if (devctl_ddef_int(ddef_hdl, "ddi-no-autodetach", 1) == -1) {
 389                 zerror(zlogp, B_TRUE, "failed to create ddi-no-auto-detach "
 390                     "property");
 391                 goto error;
 392         }
 393         if (devctl_bus_dev_create(bus_hdl, ddef_hdl, 0, &dev_hdl) == -1) {
 394                 zerror(zlogp, B_TRUE, "failed to create console node");
 395                 goto error;
 396         }
 397 
 398 devlinks:
 399         if ((dl = di_devlink_init("zcons", DI_MAKE_LINK)) != NULL) {
 400                 (void) di_devlink_fini(&dl);
 401         } else {
 402                 zerror(zlogp, B_TRUE, "failed to create devlinks");
 403                 goto error;
 404         }
 405 
 406         /*
 407          * Open the master side of the console and issue the ZC_HOLDSLAVE ioctl,
 408          * which will cause the master to retain a reference to the slave.
 409          * This prevents ttymon from blowing through the slave's STREAMS anchor.
 410          */
 411         (void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
 412             zone_name, ZCONS_MASTER_NAME);
 413         if ((masterfd = open(conspath, O_RDWR | O_NOCTTY)) == -1) {
 414                 zerror(zlogp, B_TRUE, "ERROR: could not open master side of "
 415                     "zone console for %s to acquire slave handle", zone_name);
 416                 goto error;
 417         }
 418         (void) snprintf(conspath, sizeof (conspath), "/dev/zcons/%s/%s",
 419             zone_name, ZCONS_SLAVE_NAME);
 420         if ((slavefd = open(conspath, O_RDWR | O_NOCTTY)) == -1) {
 421                 zerror(zlogp, B_TRUE, "ERROR: could not open slave side of zone"
 422                     " console for %s to acquire slave handle", zone_name);
 423                 (void) close(masterfd);
 424                 goto error;
 425         }
 426         /*
 427          * This ioctl can occasionally return ENXIO if devfs doesn't have
 428          * everything plumbed up yet due to heavy zone startup load. Wait for
 429          * 1 sec. and retry a few times before we fail to boot the zone.
 430          */
 431         for (i = 0; i < 5; i++) {
 432                 if (ioctl(masterfd, ZC_HOLDSLAVE, (caddr_t)(intptr_t)slavefd)
 433                     == 0) {
 434                         rv = 0;
 435                         break;
 436                 } else if (errno != ENXIO) {
 437                         break;
 438                 }
 439                 (void) sleep(1);
 440         }
 441         if (rv != 0)
 442                 zerror(zlogp, B_TRUE, "ERROR: error while acquiring slave "
 443                     "handle of zone console for %s", zone_name);
 444 
 445         (void) close(slavefd);
 446         (void) close(masterfd);
 447 
 448 error:
 449         if (ddef_hdl)
 450                 devctl_ddef_free(ddef_hdl);
 451         if (bus_hdl)
 452                 devctl_release(bus_hdl);
 453         if (dev_hdl)
 454                 devctl_release(dev_hdl);
 455         return (rv);
 456 }
 457 
 458 static int
 459 init_console_sock(zlog_t *zlogp)
 460 {
 461         int servfd;
 462         struct sockaddr_un servaddr;
 463 
 464         bzero(&servaddr, sizeof (servaddr));
 465         servaddr.sun_family = AF_UNIX;
 466         (void) snprintf(servaddr.sun_path, sizeof (servaddr.sun_path),
 467             CONSOLE_SOCKPATH, zone_name);
 468 
 469         if ((servfd = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
 470                 zerror(zlogp, B_TRUE, "console setup: could not create socket");
 471                 return (-1);
 472         }
 473         (void) unlink(servaddr.sun_path);
 474 
 475         if (bind(servfd, (struct sockaddr *)&servaddr,
 476             sizeof (servaddr)) == -1) {
 477                 zerror(zlogp, B_TRUE,
 478                     "console setup: could not bind to socket");
 479                 goto out;
 480         }
 481 
 482         if (listen(servfd, 4) == -1) {
 483                 zerror(zlogp, B_TRUE,
 484                     "console setup: could not listen on socket");
 485                 goto out;
 486         }
 487         return (servfd);
 488 
 489 out:
 490         (void) unlink(servaddr.sun_path);
 491         (void) close(servfd);
 492         return (-1);
 493 }
 494 
 495 static void
 496 destroy_console_sock(int servfd)
 497 {
 498         char path[MAXPATHLEN];
 499 
 500         (void) snprintf(path, sizeof (path), CONSOLE_SOCKPATH, zone_name);
 501         (void) unlink(path);
 502         (void) shutdown(servfd, SHUT_RDWR);
 503         (void) close(servfd);
 504 }
 505 
 506 /*
 507  * Read the "ident" string from the client's descriptor; this routine also
 508  * tolerates being called with pid=NULL, for times when you want to "eat"
 509  * the ident string from a client without saving it.
 510  */
 511 static int
 512 get_client_ident(int clifd, pid_t *pid, char *locale, size_t locale_len,
 513     int *disconnect)
 514 {
 515         char buf[BUFSIZ], *bufp;
 516         size_t buflen = sizeof (buf);
 517         char c = '\0';
 518         int i = 0, r;
 519         ucred_t *cred = NULL;
 520 
 521         /* "eat up the ident string" case, for simplicity */
 522         if (pid == NULL) {
 523                 assert(locale == NULL && locale_len == 0);
 524                 while (read(clifd, &c, 1) == 1) {
 525                         if (c == '\n')
 526                                 return (0);
 527                 }
 528         }
 529 
 530         bzero(buf, sizeof (buf));
 531         while ((buflen > 1) && (r = read(clifd, &c, 1)) == 1) {
 532                 buflen--;
 533                 if (c == '\n')
 534                         break;
 535 
 536                 buf[i] = c;
 537                 i++;
 538         }
 539         if (r == -1)
 540                 return (-1);
 541 
 542         /*
 543          * We've filled the buffer, but still haven't seen \n.  Keep eating
 544          * until we find it; we don't expect this to happen, but this is
 545          * defensive.
 546          */
 547         if (c != '\n') {
 548                 while ((r = read(clifd, &c, sizeof (c))) > 0)
 549                         if (c == '\n')
 550                                 break;
 551         }
 552 
 553         if (getpeerucred(clifd, &cred) == 0) {
 554                 *pid = ucred_getpid((const ucred_t *)cred);
 555                 ucred_free(cred);
 556         } else {
 557                 return (-1);
 558         }
 559 
 560         /*
 561          * Parse buffer for message of the form:
 562          * IDENT <locale> <disconnect flag>
 563          */
 564         bufp = buf;
 565         if (strncmp(bufp, "IDENT ", 6) != 0)
 566                 return (-1);
 567         bufp += 6;
 568         errno = 0;
 569 
 570         while (*bufp != '\0' && isspace(*bufp))
 571                 bufp++;
 572         buflen = strlen(bufp) - 1;
 573         *disconnect = atoi(&bufp[buflen]);
 574         bufp[buflen - 1] = '\0';
 575         (void) strlcpy(locale, bufp, locale_len);
 576 
 577         return (0);
 578 }
 579 
 580 static int
 581 accept_client(int servfd, pid_t *pid, char *locale, size_t locale_len,
 582     int *disconnect)
 583 {
 584         int connfd;
 585         struct sockaddr_un cliaddr;
 586         socklen_t clilen;
 587 
 588         clilen = sizeof (cliaddr);
 589         connfd = accept(servfd, (struct sockaddr *)&cliaddr, &clilen);
 590         if (connfd == -1)
 591                 return (-1);
 592         if (get_client_ident(connfd, pid, locale, locale_len,
 593             disconnect) == -1) {
 594                 (void) shutdown(connfd, SHUT_RDWR);
 595                 (void) close(connfd);
 596                 return (-1);
 597         }
 598         (void) write(connfd, "OK\n", 3);
 599         return (connfd);
 600 }
 601 
 602 static void
 603 reject_client(int servfd, pid_t clientpid)
 604 {
 605         int connfd;
 606         struct sockaddr_un cliaddr;
 607         socklen_t clilen;
 608         char nak[MAXPATHLEN];
 609 
 610         clilen = sizeof (cliaddr);
 611         connfd = accept(servfd, (struct sockaddr *)&cliaddr, &clilen);
 612 
 613         /*
 614          * After hear its ident string, tell client to get lost.
 615          */
 616         if (get_client_ident(connfd, NULL, NULL, 0, NULL) == 0) {
 617                 (void) snprintf(nak, sizeof (nak), "%lu\n",
 618                     clientpid);
 619                 (void) write(connfd, nak, strlen(nak));
 620         }
 621         (void) shutdown(connfd, SHUT_RDWR);
 622         (void) close(connfd);
 623 }
 624 
 625 static void
 626 event_message(int clifd, char *clilocale, zone_evt_t evt, int dflag)
 627 {
 628         char *str, *lstr = NULL;
 629         char lmsg[BUFSIZ];
 630         char outbuf[BUFSIZ];
 631 
 632         if (clifd == -1)
 633                 return;
 634 
 635         switch (evt) {
 636         case Z_EVT_ZONE_BOOTING:
 637                 if (*boot_args == '\0') {
 638                         str = "NOTICE: Zone booting up";
 639                         break;
 640                 }
 641                 /*LINTED*/
 642                 (void) snprintf(lmsg, sizeof (lmsg), localize_msg(clilocale,
 643                     "NOTICE: Zone booting up with arguments: %s"), boot_args);
 644                 lstr = lmsg;
 645                 break;
 646         case Z_EVT_ZONE_READIED:
 647                 str = "NOTICE: Zone readied";
 648                 break;
 649         case Z_EVT_ZONE_HALTED:
 650                 if (dflag)
 651                         str = "NOTICE: Zone halted.  Disconnecting...";
 652                 else
 653                         str = "NOTICE: Zone halted";
 654                 break;
 655         case Z_EVT_ZONE_REBOOTING:
 656                 if (*boot_args == '\0') {
 657                         str = "NOTICE: Zone rebooting";
 658                         break;
 659                 }
 660                 /*LINTED*/
 661                 (void) snprintf(lmsg, sizeof (lmsg), localize_msg(clilocale,
 662                     "NOTICE: Zone rebooting with arguments: %s"), boot_args);
 663                 lstr = lmsg;
 664                 break;
 665         case Z_EVT_ZONE_UNINSTALLING:
 666                 str = "NOTICE: Zone is being uninstalled.  Disconnecting...";
 667                 break;
 668         case Z_EVT_ZONE_BOOTFAILED:
 669                 if (dflag)
 670                         str = "NOTICE: Zone boot failed.  Disconnecting...";
 671                 else
 672                         str = "NOTICE: Zone boot failed";
 673                 break;
 674         default:
 675                 return;
 676         }
 677 
 678         if (lstr == NULL)
 679                 lstr = localize_msg(clilocale, str);
 680         (void) snprintf(outbuf, sizeof (outbuf), "\r\n[%s]\r\n", lstr);
 681         (void) write(clifd, outbuf, strlen(outbuf));
 682 }
 683 
 684 /*
 685  * Check to see if the client at the other end of the socket is still
 686  * alive; we know it is not if it throws EPIPE at us when we try to write
 687  * an otherwise harmless 0-length message to it.
 688  */
 689 static int
 690 test_client(int clifd)
 691 {
 692         if ((write(clifd, "", 0) == -1) && errno == EPIPE)
 693                 return (-1);
 694         return (0);
 695 }
 696 
 697 /*
 698  * This routine drives the console I/O loop.  It polls for input from the
 699  * master side of the console (output to the console), and from the client
 700  * (input from the console user).  Additionally, it polls on the server fd,
 701  * and disconnects any clients that might try to hook up with the zone while
 702  * the console is in use.
 703  *
 704  * When the client first calls us up, it is expected to send a line giving
 705  * its "identity"; this consists of the string 'IDENT <pid> <locale>'.
 706  * This is so that we can report that the console is busy along with
 707  * some diagnostics about who has it busy; the locale is used so that
 708  * asynchronous messages about zone state (like the NOTICE: zone halted
 709  * messages) can be output in the user's locale.
 710  */
 711 static void
 712 do_console_io(zlog_t *zlogp, int consfd, int servfd)
 713 {
 714         struct pollfd pollfds[4];
 715         char ibuf[BUFSIZ];
 716         int cc, ret;
 717         int clifd = -1;
 718         int pollerr = 0;
 719         char clilocale[MAXPATHLEN];
 720         pid_t clipid = 0;
 721         int disconnect = 0;
 722 
 723         /* console side, watch for read events */
 724         pollfds[0].fd = consfd;
 725         pollfds[0].events = POLLIN | POLLRDNORM | POLLRDBAND |
 726             POLLPRI | POLLERR | POLLHUP | POLLNVAL;
 727 
 728         /* client side, watch for read events */
 729         pollfds[1].fd = clifd;
 730         pollfds[1].events = pollfds[0].events;
 731 
 732         /* the server socket; watch for events (new connections) */
 733         pollfds[2].fd = servfd;
 734         pollfds[2].events = pollfds[0].events;
 735 
 736         /* the eventstram; watch for events (e.g.: zone halted) */
 737         pollfds[3].fd = eventstream[1];
 738         pollfds[3].events = pollfds[0].events;
 739 
 740         for (;;) {
 741                 pollfds[0].revents = pollfds[1].revents = 0;
 742                 pollfds[2].revents = pollfds[3].revents = 0;
 743 
 744                 ret = poll(pollfds,
 745                     sizeof (pollfds) / sizeof (struct pollfd), -1);
 746                 if (ret == -1 && errno != EINTR) {
 747                         zerror(zlogp, B_TRUE, "poll failed");
 748                         /* we are hosed, close connection */
 749                         break;
 750                 }
 751 
 752                 /* event from console side */
 753                 if (pollfds[0].revents) {
 754                         if (pollfds[0].revents &
 755                             (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
 756                                 errno = 0;
 757                                 cc = read(consfd, ibuf, BUFSIZ);
 758                                 if (cc <= 0 && (errno != EINTR) &&
 759                                     (errno != EAGAIN))
 760                                         break;
 761                                 /*
 762                                  * Lose I/O if no one is listening
 763                                  */
 764                                 if (clifd != -1 && cc > 0)
 765                                         (void) write(clifd, ibuf, cc);
 766                         } else {
 767                                 pollerr = pollfds[0].revents;
 768                                 zerror(zlogp, B_FALSE,
 769                                     "closing connection with (console) "
 770                                     "pollerr %d\n", pollerr);
 771                                 break;
 772                         }
 773                 }
 774 
 775                 /* event from client side */
 776                 if (pollfds[1].revents) {
 777                         if (pollfds[1].revents &
 778                             (POLLIN | POLLRDNORM | POLLRDBAND | POLLPRI)) {
 779                                 errno = 0;
 780                                 cc = read(clifd, ibuf, BUFSIZ);
 781                                 if (cc <= 0 && (errno != EINTR) &&
 782                                     (errno != EAGAIN))
 783                                         break;
 784                                 (void) write(consfd, ibuf, cc);
 785                         } else {
 786                                 pollerr = pollfds[1].revents;
 787                                 zerror(zlogp, B_FALSE,
 788                                     "closing connection with (client) "
 789                                     "pollerr %d\n", pollerr);
 790                                 break;
 791                         }
 792                 }
 793 
 794                 /* event from server socket */
 795                 if (pollfds[2].revents &&
 796                     (pollfds[2].revents & (POLLIN | POLLRDNORM))) {
 797                         if (clifd != -1) {
 798                                 /*
 799                                  * Test the client to see if it is really
 800                                  * still alive.  If it has died but we
 801                                  * haven't yet detected that, we might
 802                                  * deny a legitimate connect attempt.  If it
 803                                  * is dead, we break out; once we tear down
 804                                  * the old connection, the new connection
 805                                  * will happen.
 806                                  */
 807                                 if (test_client(clifd) == -1) {
 808                                         break;
 809                                 }
 810                                 /* we're already handling a client */
 811                                 reject_client(servfd, clipid);
 812 
 813 
 814                         } else if ((clifd = accept_client(servfd, &clipid,
 815                             clilocale, sizeof (clilocale),
 816                             &disconnect)) != -1) {
 817                                 pollfds[1].fd = clifd;
 818 
 819                         } else {
 820                                 break;
 821                         }
 822                 }
 823 
 824                 /*
 825                  * Watch for events on the eventstream.  This is how we get
 826                  * notified of the zone halting, etc.  It provides us a
 827                  * "wakeup" from poll when important things happen, which
 828                  * is good.
 829                  */
 830                 if (pollfds[3].revents) {
 831                         int evt = eventstream_read();
 832                         /*
 833                          * After we drain out the event, if we aren't servicing
 834                          * a console client, we hop back out to our caller,
 835                          * which will check to see if it is time to shutdown
 836                          * the daemon, or if we should take another console
 837                          * service lap.
 838                          */
 839                         if (clifd == -1) {
 840                                 break;
 841                         }
 842                         event_message(clifd, clilocale, evt, disconnect);
 843                         /*
 844                          * Special handling for the message that the zone is
 845                          * uninstalling; we boot the client, then break out
 846                          * of this function.  When we return to the
 847                          * serve_console loop, we will see that the zone is
 848                          * in a state < READY, and so zoneadmd will shutdown.
 849                          */
 850                         if (evt == Z_EVT_ZONE_UNINSTALLING) {
 851                                 break;
 852                         }
 853                         /*
 854                          * Diconnect if -C and -d options were specified and
 855                          * zone was halted or failed to boot.
 856                          */
 857                         if ((evt == Z_EVT_ZONE_HALTED ||
 858                             evt == Z_EVT_ZONE_BOOTFAILED) && disconnect) {
 859                                 break;
 860                         }
 861                 }
 862 
 863         }
 864 
 865         if (clifd != -1) {
 866                 (void) shutdown(clifd, SHUT_RDWR);
 867                 (void) close(clifd);
 868         }
 869 }
 870 
 871 int
 872 init_console(zlog_t *zlogp)
 873 {
 874         if (init_console_dev(zlogp) == -1) {
 875                 zerror(zlogp, B_FALSE,
 876                     "console setup: device initialization failed");
 877                 return (-1);
 878         }
 879 
 880         if ((serverfd = init_console_sock(zlogp)) == -1) {
 881                 zerror(zlogp, B_FALSE,
 882                     "console setup: socket initialization failed");
 883                 return (-1);
 884         }
 885         return (0);
 886 }
 887 
 888 /*
 889  * serve_console() is the master loop for driving console I/O.  It is also the
 890  * routine which is ultimately responsible for "pulling the plug" on zoneadmd
 891  * when it realizes that the daemon should shut down.
 892  *
 893  * The rules for shutdown are: there must be no console client, and the zone
 894  * state must be < ready.  However, we need to give things a chance to actually
 895  * get going when the daemon starts up-- otherwise the daemon would immediately
 896  * exit on startup if the zone was in the installed state, so we first drop
 897  * into the do_console_io() loop in order to give *something* a chance to
 898  * happen.
 899  */
 900 void
 901 serve_console(zlog_t *zlogp)
 902 {
 903         int masterfd;
 904         zone_state_t zstate;
 905         char conspath[MAXPATHLEN];
 906 
 907         (void) snprintf(conspath, sizeof (conspath),
 908             "/dev/zcons/%s/%s", zone_name, ZCONS_MASTER_NAME);
 909 
 910         for (;;) {
 911                 masterfd = open(conspath, O_RDWR|O_NONBLOCK|O_NOCTTY);
 912                 if (masterfd == -1) {
 913                         zerror(zlogp, B_TRUE, "failed to open console master");
 914                         (void) mutex_lock(&lock);
 915                         goto death;
 916                 }
 917 
 918                 /*
 919                  * Setting RPROTDIS on the stream means that the control
 920                  * portion of messages received (which we don't care about)
 921                  * will be discarded by the stream head.  If we allowed such
 922                  * messages, we wouldn't be able to use read(2), as it fails
 923                  * (EBADMSG) when a message with a control element is received.
 924                  */
 925                 if (ioctl(masterfd, I_SRDOPT, RNORM|RPROTDIS) == -1) {
 926                         zerror(zlogp, B_TRUE, "failed to set options on "
 927                             "console master");
 928                         (void) mutex_lock(&lock);
 929                         goto death;
 930                 }
 931 
 932                 do_console_io(zlogp, masterfd, serverfd);
 933 
 934                 /*
 935                  * We would prefer not to do this, but hostile zone processes
 936                  * can cause the stream to become tainted, and reads will
 937                  * fail.  So, in case something has gone seriously ill,
 938                  * we dismantle the stream and reopen the console when we
 939                  * take another lap.
 940                  */
 941                 (void) close(masterfd);
 942 
 943                 (void) mutex_lock(&lock);
 944                 /*
 945                  * We need to set death_throes (see below) atomically with
 946                  * respect to noticing that (a) we have no console client and
 947                  * (b) the zone is not installed.  Otherwise we could get a
 948                  * request to boot during this time.  Once we set death_throes,
 949                  * any incoming door stuff will be turned away.
 950                  */
 951                 if (zone_get_state(zone_name, &zstate) == Z_OK) {
 952                         if (zstate < ZONE_STATE_READY)
 953                                 goto death;
 954                 } else {
 955                         zerror(zlogp, B_FALSE,
 956                             "unable to determine state of zone");
 957                         goto death;
 958                 }
 959                 /*
 960                  * Even if zone_get_state() fails, stay conservative, and
 961                  * take another lap.
 962                  */
 963                 (void) mutex_unlock(&lock);
 964         }
 965 
 966 death:
 967         assert(MUTEX_HELD(&lock));
 968         in_death_throes = B_TRUE;
 969         (void) mutex_unlock(&lock);
 970 
 971         destroy_console_sock(serverfd);
 972         (void) destroy_console_devs(zlogp);
 973 }