xref: /netvirt/usr/src/uts/common/os/contract.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#pragma ident	"@(#)contract.c	1.4	07/08/09 SMI"

/*
 * Contracts
 * ---------
 *
 * Contracts are a primitive which enrich the relationships between
 * processes and system resources.  The primary purpose of contracts is
 * to provide a means for the system to negotiate the departure from a
 * binding relationship (e.g. pages locked in memory or a thread bound
 * to processor), but they can also be used as a purely asynchronous
 * error reporting mechanism as they are with process contracts.
 *
 * More information on how one interfaces with contracts and what
 * contracts can do for you can be found in:
 *   PSARC 2003/193 Solaris Contracts
 *   PSARC 2004/460 Contracts addendum
 *
 * This file contains the core contracts framework.  By itself it is
 * useless: it depends the contracts filesystem (ctfs) to provide an
 * interface to user processes and individual contract types to
 * implement the process/resource relationships.
 *
 * Data structure overview
 * -----------------------
 *
 * A contract is represented by a contract_t, which itself points to an
 * encapsulating contract-type specific contract object.  A contract_t
 * contains the contract's static identity (including its terms), its
 * linkage to various bookkeeping structures, the contract-specific
 * event queue, and a reference count.
 *
 * A contract template is represented by a ct_template_t, which, like a
 * contract, points to an encapsulating contract-type specific template
 * object.  A ct_template_t contains the template's terms.
 *
 * An event queue is represented by a ct_equeue_t, and consists of a
 * list of events, a list of listeners, and a list of listeners who are
 * waiting for new events (affectionately referred to as "tail
 * listeners").  There are three queue types, defined by ct_listnum_t
 * (an enum).  An event may be on one of each type of queue
 * simultaneously; the list linkage used by a queue is determined by
 * its type.
 *
 * An event is represented by a ct_kevent_t, which contains mostly
 * static event data (e.g. id, payload).  It also has an array of
 * ct_member_t structures, each of which contains a list_node_t and
 * represent the event's linkage in a specific event queue.
 *
 * Each open of an event endpoint results in the creation of a new
 * listener, represented by a ct_listener_t.  In addition to linkage
 * into the aforementioned lists in the event_queue, a ct_listener_t
 * contains a pointer to the ct_kevent_t it is currently positioned at
 * as well as a set of status flags and other administrative data.
 *
 * Each process has a list of contracts it owns, p_ct_held; a pointer
 * to the process contract it is a member of, p_ct_process; the linkage
 * for that membership, p_ct_member; and an array of event queue
 * structures representing the process bundle queues.
 *
 * Each LWP has an array of its active templates, lwp_ct_active; and
 * the most recently created contracts, lwp_ct_latest.
 *
 * A process contract has a list of member processes and a list of
 * inherited contracts.
 *
 * There is a system-wide list of all contracts, as well as per-type
 * lists of contracts.
 *
 * Lock ordering overview
 * ----------------------
 *
 * Locks at the top are taken first:
 *
 *                   ct_evtlock
 *                   regent ct_lock
 *                   member ct_lock
 *                   pidlock
 *                   p_lock
 *    contract ctq_lock         contract_lock
 *    pbundle ctq_lock
 *    cte_lock
 *                   ct_reflock
 *
 * contract_lock and ctq_lock/cte_lock are not currently taken at the
 * same time.
 *
 * Reference counting and locking
 * ------------------------------
 *
 * A contract has a reference count, protected by ct_reflock.
 * (ct_reflock is also used in a couple other places where atomic
 * access to a variable is needed in an innermost context).  A process
 * maintains a hold on each contract it owns.  A process contract has a
 * hold on each contract is has inherited.  Each event has a hold on
 * the contract which generated it.  Process contract templates have
 * holds on the contracts referred to by their transfer terms.  CTFS
 * contract directory nodes have holds on contracts.  Lastly, various
 * code paths may temporarily take holds on contracts to prevent them
 * from disappearing while other processing is going on.  It is
 * important to note that the global contract lists do not hold
 * references on contracts; a contract is removed from these structures
 * atomically with the release of its last reference.
 *
 * At a given point in time, a contract can either be owned by a
 * process, inherited by a regent process contract, or orphaned.  A
 * contract_t's  owner and regent pointers, ct_owner and ct_regent, are
 * protected by its ct_lock.  The linkage in the holder's (holder =
 * owner or regent) list of contracts, ct_ctlist, is protected by
 * whatever lock protects the holder's data structure.  In order for
 * these two directions to remain consistent, changing the holder of a
 * contract requires that both locks be held.
 *
 * Events also have reference counts.  There is one hold on an event
 * per queue it is present on, in addition to those needed for the
 * usual sundry reasons.  Individual listeners are associated with
 * specific queues, and increase a queue-specific reference count
 * stored in the ct_member_t structure.
 *
 * The dynamic contents of an event (reference count and flags) are
 * protected by its cte_lock, while the contents of the embedded
 * ct_member_t structures are protected by the locks of the queues they
 * are linked into.  A ct_listener_t's contents are also protected by
 * its event queue's ctq_lock.
 *
 * Resource controls
 * -----------------
 *
 * Control:      project.max-contracts (rc_project_contract)
 * Description:  Maximum number of contracts allowed a project.
 *
 *   When a contract is created, the project's allocation is tested and
 *   (assuming success) increased.  When the last reference to a
 *   contract is released, the creating project's allocation is
 *   decreased.
 */

#include <sys/mutex.h>
#include <sys/debug.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/kmem.h>
#include <sys/thread.h>
#include <sys/id_space.h>
#include <sys/avl.h>
#include <sys/list.h>
#include <sys/sysmacros.h>
#include <sys/proc.h>
#include <sys/contract_impl.h>
#include <sys/contract/process_impl.h>
#include <sys/dditypes.h>
#include <sys/contract/device_impl.h>
#include <sys/systm.h>
#include <sys/atomic.h>
#include <sys/cmn_err.h>
#include <sys/model.h>
#include <sys/policy.h>
#include <sys/zone.h>
#include <sys/task.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>

extern rctl_hndl_t rc_project_contract;

static id_space_t	*contract_ids;
static avl_tree_t	contract_avl;
static kmutex_t		contract_lock;

int			ct_ntypes = CTT_MAXTYPE;
static ct_type_t	*ct_types_static[CTT_MAXTYPE];
ct_type_t		**ct_types = ct_types_static;
int			ct_debug;

static void cte_queue_create(ct_equeue_t *, ct_listnum_t, int, int);
static void cte_queue_destroy(ct_equeue_t *);
static void cte_queue_drain(ct_equeue_t *, int);
static void cte_trim(ct_equeue_t *, contract_t *);
static void cte_copy(ct_equeue_t *, ct_equeue_t *);

/*
 * contract_compar
 *
 * A contract comparator which sorts on contract ID.
 */
int
contract_compar(const void *x, const void *y)
{
	const contract_t *ct1 = x;
	const contract_t *ct2 = y;

	if (ct1->ct_id < ct2->ct_id)
		return (-1);
	if (ct1->ct_id > ct2->ct_id)
		return (1);
	return (0);
}

/*
 * contract_init
 *
 * Initializes the contract subsystem, the specific contract types, and
 * process 0.
 */
void
contract_init(void)
{
	/*
	 * Initialize contract subsystem.
	 */
	contract_ids = id_space_create("contracts", 1, INT_MAX);
	avl_create(&contract_avl, contract_compar, sizeof (contract_t),
	    offsetof(contract_t, ct_ctavl));
	mutex_init(&contract_lock, NULL, MUTEX_DEFAULT, NULL);

	/*
	 * Initialize contract types.
	 */
	contract_process_init();
	contract_device_init();

	/*
	 * Initialize p0/lwp0 contract state.
	 */
	avl_create(&p0.p_ct_held, contract_compar, sizeof (contract_t),
	    offsetof(contract_t, ct_ctlist));
}

/*
 * contract_dtor
 *
 * Performs basic destruction of the common portions of a contract.
 * Called from the failure path of contract_ctor and from
 * contract_rele.
 */
static void
contract_dtor(contract_t *ct)
{
	cte_queue_destroy(&ct->ct_events);
	list_destroy(&ct->ct_vnodes);
	mutex_destroy(&ct->ct_reflock);
	mutex_destroy(&ct->ct_lock);
	mutex_destroy(&ct->ct_evtlock);
}

/*
 * contract_ctor
 *
 * Called by a contract type to initialize a contract.  Fails if the
 * max-contract resource control would have been exceeded.  After a
 * successful call to contract_ctor, the contract is unlocked and
 * visible in all namespaces; any type-specific initialization should
 * be completed before calling contract_ctor.  Returns 0 on success.
 *
 * Because not all callers can tolerate failure, a 0 value for canfail
 * instructs contract_ctor to ignore the project.max-contracts resource
 * control.  Obviously, this "out" should only be employed by callers
 * who are sufficiently constrained in other ways (e.g. newproc).
 */
int
contract_ctor(contract_t *ct, ct_type_t *type, ct_template_t *tmpl, void *data,
    ctflags_t flags, proc_t *author, int canfail)
{
	avl_index_t where;
	klwp_t *curlwp = ttolwp(curthread);

	ASSERT(author == curproc);

	mutex_init(&ct->ct_lock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&ct->ct_reflock, NULL, MUTEX_DEFAULT, NULL);
	mutex_init(&ct->ct_evtlock, NULL, MUTEX_DEFAULT, NULL);
	ct->ct_id = id_alloc(contract_ids);

	cte_queue_create(&ct->ct_events, CTEL_CONTRACT, 20, 0);
	list_create(&ct->ct_vnodes, sizeof (contract_vnode_t),
	    offsetof(contract_vnode_t, ctv_node));

	/*
	 * Instance data
	 */
	ct->ct_ref = 2;		/* one for the holder, one for "latest" */
	ct->ct_cuid = crgetuid(CRED());
	ct->ct_type = type;
	ct->ct_data = data;
	gethrestime(&ct->ct_ctime);
	ct->ct_state = CTS_OWNED;
	ct->ct_flags = flags;
	ct->ct_regent = author->p_ct_process ?
	    &author->p_ct_process->conp_contract : NULL;
	ct->ct_ev_info = tmpl->ctmpl_ev_info;
	ct->ct_ev_crit = tmpl->ctmpl_ev_crit;
	ct->ct_cookie = tmpl->ctmpl_cookie;
	ct->ct_owner = author;
	ct->ct_ntime.ctm_total = -1;
	ct->ct_qtime.ctm_total = -1;
	ct->ct_nevent = NULL;

	/*
	 * Test project.max-contracts.
	 */
	mutex_enter(&author->p_lock);
	mutex_enter(&contract_lock);
	if (canfail && rctl_test(rc_project_contract,
	    author->p_task->tk_proj->kpj_rctls, author, 1,
	    RCA_SAFE) & RCT_DENY) {
		id_free(contract_ids, ct->ct_id);
		mutex_exit(&contract_lock);
		mutex_exit(&author->p_lock);
		ct->ct_events.ctq_flags |= CTQ_DEAD;
		contract_dtor(ct);
		return (1);
	}
	ct->ct_proj = author->p_task->tk_proj;
	ct->ct_proj->kpj_data.kpd_contract++;
	(void) project_hold(ct->ct_proj);
	mutex_exit(&contract_lock);

	/*
	 * Insert into holder's avl of contracts.
	 * We use an avl not because order is important, but because
	 * readdir of /proc/contracts requires we be able to use a
	 * scalar as an index into the process's list of contracts
	 */
	ct->ct_zoneid = author->p_zone->zone_id;
	ct->ct_czuniqid = ct->ct_mzuniqid = author->p_zone->zone_uniqid;
	VERIFY(avl_find(&author->p_ct_held, ct, &where) == NULL);
	avl_insert(&author->p_ct_held, ct, where);
	mutex_exit(&author->p_lock);

	/*
	 * Insert into global contract AVL
	 */
	mutex_enter(&contract_lock);
	VERIFY(avl_find(&contract_avl, ct, &where) == NULL);
	avl_insert(&contract_avl, ct, where);
	mutex_exit(&contract_lock);

	/*
	 * Insert into type AVL
	 */
	mutex_enter(&type->ct_type_lock);
	VERIFY(avl_find(&type->ct_type_avl, ct, &where) == NULL);
	avl_insert(&type->ct_type_avl, ct, where);
	type->ct_type_timestruc = ct->ct_ctime;
	mutex_exit(&type->ct_type_lock);

	if (curlwp->lwp_ct_latest[type->ct_type_index])
		contract_rele(curlwp->lwp_ct_latest[type->ct_type_index]);
	curlwp->lwp_ct_latest[type->ct_type_index] = ct;

	return (0);
}

/*
 * contract_rele
 *
 * Releases a reference to a contract.  If the caller had the last
 * reference, the contract is removed from all namespaces, its
 * allocation against the max-contracts resource control is released,
 * and the contract type's free entry point is invoked for any
 * type-specific deconstruction and to (presumably) free the object.
 */
void
contract_rele(contract_t *ct)
{
	uint64_t nref;

	mutex_enter(&ct->ct_reflock);
	ASSERT(ct->ct_ref > 0);
	nref = --ct->ct_ref;
	mutex_exit(&ct->ct_reflock);
	if (nref == 0) {
		/*
		 * ct_owner is cleared when it drops its reference.
		 */
		ASSERT(ct->ct_owner == NULL);
		ASSERT(ct->ct_evcnt == 0);

		/*
		 * Remove from global contract AVL
		 */
		mutex_enter(&contract_lock);
		avl_remove(&contract_avl, ct);
		mutex_exit(&contract_lock);

		/*
		 * Remove from type AVL
		 */
		mutex_enter(&ct->ct_type->ct_type_lock);
		avl_remove(&ct->ct_type->ct_type_avl, ct);
		mutex_exit(&ct->ct_type->ct_type_lock);

		/*
		 * Release the contract's ID
		 */
		id_free(contract_ids, ct->ct_id);

		/*
		 * Release project hold
		 */
		mutex_enter(&contract_lock);
		ct->ct_proj->kpj_data.kpd_contract--;
		project_rele(ct->ct_proj);
		mutex_exit(&contract_lock);

		/*
		 * Free the contract
		 */
		contract_dtor(ct);
		ct->ct_type->ct_type_ops->contop_free(ct);
	}
}

/*
 * contract_hold
 *
 * Adds a reference to a contract
 */
void
contract_hold(contract_t *ct)
{
	mutex_enter(&ct->ct_reflock);
	ASSERT(ct->ct_ref < UINT64_MAX);
	ct->ct_ref++;
	mutex_exit(&ct->ct_reflock);
}

/*
 * contract_getzuniqid
 *
 * Get a contract's zone unique ID.  Needed because 64-bit reads and
 * writes aren't atomic on x86.  Since there are contexts where we are
 * unable to take ct_lock, we instead use ct_reflock; in actuality any
 * lock would do.
 */
uint64_t
contract_getzuniqid(contract_t *ct)
{
	uint64_t zuniqid;

	mutex_enter(&ct->ct_reflock);
	zuniqid = ct->ct_mzuniqid;
	mutex_exit(&ct->ct_reflock);

	return (zuniqid);
}

/*
 * contract_setzuniqid
 *
 * Sets a contract's zone unique ID.   See contract_getzuniqid.
 */
void
contract_setzuniqid(contract_t *ct, uint64_t zuniqid)
{
	mutex_enter(&ct->ct_reflock);
	ct->ct_mzuniqid = zuniqid;
	mutex_exit(&ct->ct_reflock);
}

/*
 * contract_abandon
 *
 * Abandons the specified contract.  If "explicit" is clear, the
 * contract was implicitly abandoned (by process exit) and should be
 * inherited if its terms allow it and its owner was a member of a
 * regent contract.  Otherwise, the contract type's abandon entry point
 * is invoked to either destroy or orphan the contract.
 */
int
contract_abandon(contract_t *ct, proc_t *p, int explicit)
{
	ct_equeue_t *q = NULL;
	contract_t *parent = &p->p_ct_process->conp_contract;
	int inherit = 0;

	ASSERT(p == curproc);

	mutex_enter(&ct->ct_lock);

	/*
	 * Multiple contract locks are taken contract -> subcontract.
	 * Check if the contract will be inherited so we can acquire
	 * all the necessary locks before making sensitive changes.
	 */
	if (!explicit && (ct->ct_flags & CTF_INHERIT) &&
	    contract_process_accept(parent)) {
		mutex_exit(&ct->ct_lock);
		mutex_enter(&parent->ct_lock);
		mutex_enter(&ct->ct_lock);
		inherit = 1;
	}

	if (ct->ct_owner != p) {
		mutex_exit(&ct->ct_lock);
		if (inherit)
			mutex_exit(&parent->ct_lock);
		return (EINVAL);
	}

	mutex_enter(&p->p_lock);
	if (explicit)
		avl_remove(&p->p_ct_held, ct);
	ct->ct_owner = NULL;
	mutex_exit(&p->p_lock);

	/*
	 * Since we can't call cte_trim with the contract lock held,
	 * we grab the queue pointer here.
	 */
	if (p->p_ct_equeue)
		q = p->p_ct_equeue[ct->ct_type->ct_type_index];

	/*
	 * contop_abandon may destroy the contract so we rely on it to
	 * drop ct_lock.  We retain a reference on the contract so that
	 * the cte_trim which follows functions properly.  Even though
	 * cte_trim doesn't dereference the contract pointer, it is
	 * still necessary to retain a reference to the contract so
	 * that we don't trim events which are sent by a subsequently
	 * allocated contract infortuitously located at the same address.
	 */
	contract_hold(ct);

	if (inherit) {
		ct->ct_state = CTS_INHERITED;
		ASSERT(ct->ct_regent == parent);
		contract_process_take(parent, ct);

		/*
		 * We are handing off the process's reference to the
		 * parent contract.  For this reason, the order in
		 * which we drop the contract locks is also important.
		 */
		mutex_exit(&ct->ct_lock);
		mutex_exit(&parent->ct_lock);
	} else {
		ct->ct_regent = NULL;
		ct->ct_type->ct_type_ops->contop_abandon(ct);
	}

	/*
	 * ct_lock has been dropped; we can safely trim the event
	 * queue now.
	 */
	if (q) {
		mutex_enter(&q->ctq_lock);
		cte_trim(q, ct);
		mutex_exit(&q->ctq_lock);
	}

	contract_rele(ct);

	return (0);
}

int
contract_newct(contract_t *ct)
{
	return (ct->ct_type->ct_type_ops->contop_newct(ct));
}

/*
 * contract_adopt
 *
 * Adopts a contract.  After a successful call to this routine, the
 * previously inherited contract will belong to the calling process,
 * and its events will have been appended to its new owner's process
 * bundle queue.
 */
int
contract_adopt(contract_t *ct, proc_t *p)
{
	avl_index_t where;
	ct_equeue_t *q;
	contract_t *parent;

	ASSERT(p == curproc);

	/*
	 * Ensure the process has an event queue.  Checked by ASSERTs
	 * below.
	 */
	(void) contract_type_pbundle(ct->ct_type, p);

	mutex_enter(&ct->ct_lock);
	parent = ct->ct_regent;
	if (ct->ct_state != CTS_INHERITED ||
	    &p->p_ct_process->conp_contract != parent ||
	    p->p_zone->zone_uniqid != ct->ct_czuniqid) {
		mutex_exit(&ct->ct_lock);
		return (EINVAL);
	}

	/*
	 * Multiple contract locks are taken contract -> subcontract.
	 */
	mutex_exit(&ct->ct_lock);
	mutex_enter(&parent->ct_lock);
	mutex_enter(&ct->ct_lock);

	/*
	 * It is possible that the contract was adopted by someone else
	 * while its lock was dropped.  It isn't possible for the
	 * contract to have been inherited by a different regent
	 * contract.
	 */
	if (ct->ct_state != CTS_INHERITED) {
		mutex_exit(&parent->ct_lock);
		mutex_exit(&ct->ct_lock);
		return (EBUSY);
	}
	ASSERT(ct->ct_regent == parent);

	ct->ct_state = CTS_OWNED;

	contract_process_adopt(ct, p);

	mutex_enter(&p->p_lock);
	ct->ct_owner = p;
	VERIFY(avl_find(&p->p_ct_held, ct, &where) == NULL);
	avl_insert(&p->p_ct_held, ct, where);
	mutex_exit(&p->p_lock);

	ASSERT(ct->ct_owner->p_ct_equeue);
	ASSERT(ct->ct_owner->p_ct_equeue[ct->ct_type->ct_type_index]);
	q = ct->ct_owner->p_ct_equeue[ct->ct_type->ct_type_index];
	cte_copy(&ct->ct_events, q);
	mutex_exit(&ct->ct_lock);

	return (0);
}

/*
 * contract_ack
 *
 * Acknowledges receipt of a critical event.
 */
int
contract_ack(contract_t *ct, uint64_t evid, int ack)
{
	ct_kevent_t *ev;
	list_t *queue = &ct->ct_events.ctq_events;
	int error = ESRCH;
	int nego = 0;
	uint_t evtype;

	ASSERT(ack == CT_ACK || ack == CT_NACK);

	mutex_enter(&ct->ct_lock);
	mutex_enter(&ct->ct_events.ctq_lock);
	/*
	 * We are probably ACKing something near the head of the queue.
	 */
	for (ev = list_head(queue); ev; ev = list_next(queue, ev)) {
		if (ev->cte_id == evid) {
			if (ev->cte_flags & CTE_NEG)
				nego = 1;
			else if (ack == CT_NACK)
				break;
			if ((ev->cte_flags & (CTE_INFO | CTE_ACK)) == 0) {
				ev->cte_flags |= CTE_ACK;
				ct->ct_evcnt--;
				evtype = ev->cte_type;
				error = 0;
			}
			break;
		}
	}
	mutex_exit(&ct->ct_events.ctq_lock);
	mutex_exit(&ct->ct_lock);

	/*
	 * Not all critical events are negotiation events, however
	 * every negotiation event is a critical event. NEGEND events
	 * are critical events but are not negotiation events
	 */
	if (error || !nego)
		return (error);

	if (ack == CT_ACK)
		error = ct->ct_type->ct_type_ops->contop_ack(ct, evtype, evid);
	else
		error = ct->ct_type->ct_type_ops->contop_nack(ct, evtype, evid);

	return (error);
}

/*ARGSUSED*/
int
contract_ack_inval(contract_t *ct, uint_t evtype, uint64_t evid)
{
	cmn_err(CE_PANIC, "contract_ack_inval: unsupported call: ctid: %u",
	    ct->ct_id);
	return (ENOSYS);
}

/*ARGSUSED*/
int
contract_qack_inval(contract_t *ct, uint_t evtype, uint64_t evid)
{
	cmn_err(CE_PANIC, "contract_ack_inval: unsupported call: ctid: %u",
	    ct->ct_id);
	return (ENOSYS);
}

/*ARGSUSED*/
int
contract_qack_notsup(contract_t *ct, uint_t evtype, uint64_t evid)
{
	return (ERANGE);
}

/*
 * contract_qack
 *
 * Asks that negotiations be extended by another time quantum
 */
int
contract_qack(contract_t *ct, uint64_t evid)
{
	ct_kevent_t *ev;
	list_t *queue = &ct->ct_events.ctq_events;
	int nego = 0;
	uint_t evtype;

	mutex_enter(&ct->ct_lock);
	mutex_enter(&ct->ct_events.ctq_lock);

	for (ev = list_head(queue); ev; ev = list_next(queue, ev)) {
		if (ev->cte_id == evid) {
			if ((ev->cte_flags & (CTE_NEG | CTE_ACK)) == CTE_NEG) {
				evtype = ev->cte_type;
				nego = 1;
			}
			break;
		}
	}
	mutex_exit(&ct->ct_events.ctq_lock);
	mutex_exit(&ct->ct_lock);

	/*
	 * Only a negotiated event (which is by definition also a critical
	 * event) which has not yet been acknowledged can provide
	 * time quanta to a negotiating owner process.
	 */
	if (!nego)
		return (ESRCH);

	return (ct->ct_type->ct_type_ops->contop_qack(ct, evtype, evid));
}

/*
 * contract_orphan
 *
 * Icky-poo.  This is a process-contract special, used to ACK all
 * critical messages when a contract is orphaned.
 */
void
contract_orphan(contract_t *ct)
{
	ct_kevent_t *ev;
	list_t *queue = &ct->ct_events.ctq_events;

	ASSERT(MUTEX_HELD(&ct->ct_lock));
	ASSERT(ct->ct_state != CTS_ORPHAN);

	mutex_enter(&ct->ct_events.ctq_lock);
	ct->ct_state = CTS_ORPHAN;
	for (ev = list_head(queue); ev; ev = list_next(queue, ev)) {
		if ((ev->cte_flags & (CTE_INFO | CTE_ACK)) == 0) {
			ev->cte_flags |= CTE_ACK;
			ct->ct_evcnt--;
		}
	}
	mutex_exit(&ct->ct_events.ctq_lock);

	ASSERT(ct->ct_evcnt == 0);
}

/*
 * contract_destroy
 *
 * Explicit contract destruction.  Called when contract is empty.
 * The contract will actually stick around until all of its events are
 * removed from the bundle and and process bundle queues, and all fds
 * which refer to it are closed.  See contract_dtor if you are looking
 * for what destroys the contract structure.
 */
void
contract_destroy(contract_t *ct)
{
	ASSERT(MUTEX_HELD(&ct->ct_lock));
	ASSERT(ct->ct_state != CTS_DEAD);
	ASSERT(ct->ct_owner == NULL);

	ct->ct_state = CTS_DEAD;
	cte_queue_drain(&ct->ct_events, 1);
	mutex_exit(&ct->ct_lock);
	mutex_enter(&ct->ct_type->ct_type_events.ctq_lock);
	cte_trim(&ct->ct_type->ct_type_events, ct);
	mutex_exit(&ct->ct_type->ct_type_events.ctq_lock);
	mutex_enter(&ct->ct_lock);
	ct->ct_type->ct_type_ops->contop_destroy(ct);
	mutex_exit(&ct->ct_lock);
	contract_rele(ct);
}

/*
 * contract_vnode_get
 *
 * Obtains the contract directory vnode for this contract, if there is
 * one.  The caller must VN_RELE the vnode when they are through using
 * it.
 */
vnode_t *
contract_vnode_get(contract_t *ct, vfs_t *vfsp)
{
	contract_vnode_t *ctv;
	vnode_t *vp = NULL;

	mutex_enter(&ct->ct_lock);
	for (ctv = list_head(&ct->ct_vnodes); ctv != NULL;
	    ctv = list_next(&ct->ct_vnodes, ctv))
		if (ctv->ctv_vnode->v_vfsp == vfsp) {
			vp = ctv->ctv_vnode;
			VN_HOLD(vp);
			break;
		}
	mutex_exit(&ct->ct_lock);
	return (vp);
}

/*
 * contract_vnode_set
 *
 * Sets the contract directory vnode for this contract.  We don't hold
 * a reference on the vnode because we don't want to prevent it from
 * being freed.  The vnode's inactive entry point will take care of
 * notifying us when it should be removed.
 */
void
contract_vnode_set(contract_t *ct, contract_vnode_t *ctv, vnode_t *vnode)
{
	mutex_enter(&ct->ct_lock);
	ctv->ctv_vnode = vnode;
	list_insert_head(&ct->ct_vnodes, ctv);
	mutex_exit(&ct->ct_lock);
}

/*
 * contract_vnode_clear
 *
 * Removes this vnode as the contract directory vnode for this
 * contract.  Called from a contract directory's inactive entry point,
 * this may return 0 indicating that the vnode gained another reference
 * because of a simultaneous call to contract_vnode_get.
 */
int
contract_vnode_clear(contract_t *ct, contract_vnode_t *ctv)
{
	vnode_t *vp = ctv->ctv_vnode;
	int result;

	mutex_enter(&ct->ct_lock);
	mutex_enter(&vp->v_lock);
	if (vp->v_count == 1) {
		list_remove(&ct->ct_vnodes, ctv);
		result = 1;
	} else {
		vp->v_count--;
		result = 0;
	}
	mutex_exit(&vp->v_lock);
	mutex_exit(&ct->ct_lock);

	return (result);
}

/*
 * contract_exit
 *
 * Abandons all contracts held by process p, and drains process p's
 * bundle queues.  Called on process exit.
 */
void
contract_exit(proc_t *p)
{
	contract_t *ct;
	void *cookie = NULL;
	int i;

	ASSERT(p == curproc);

	/*
	 * Abandon held contracts.  contract_abandon knows enough not
	 * to remove the contract from the list a second time.  We are
	 * exiting, so no locks are needed here.  But because
	 * contract_abandon will take p_lock, we need to make sure we
	 * aren't holding it.
	 */
	ASSERT(MUTEX_NOT_HELD(&p->p_lock));
	while ((ct = avl_destroy_nodes(&p->p_ct_held, &cookie)) != NULL)
		VERIFY(contract_abandon(ct, p, 0) == 0);

	/*
	 * Drain pbundles.  Because a process bundle queue could have
	 * been passed to another process, they may not be freed right
	 * away.
	 */
	if (p->p_ct_equeue) {
		for (i = 0; i < CTT_MAXTYPE; i++)
			if (p->p_ct_equeue[i])
				cte_queue_drain(p->p_ct_equeue[i], 0);
		kmem_free(p->p_ct_equeue, CTT_MAXTYPE * sizeof (ct_equeue_t *));
	}
}

static int
get_time_left(struct ct_time *t)
{
	clock_t ticks_elapsed;
	int secs_elapsed;

	if (t->ctm_total == -1)
		return (-1);

	ticks_elapsed = ddi_get_lbolt() - t->ctm_start;
	secs_elapsed = t->ctm_total - (drv_hztousec(ticks_elapsed)/MICROSEC);
	return (secs_elapsed > 0 ? secs_elapsed : 0);
}

/*
 * contract_status_common
 *
 * Populates a ct_status structure.  Used by contract types in their
 * status entry points and ctfs when only common information is
 * requested.
 */
void
contract_status_common(contract_t *ct, zone_t *zone, void *status,
    model_t model)
{
	STRUCT_HANDLE(ct_status, lstatus);

	STRUCT_SET_HANDLE(lstatus, model, status);
	ASSERT(MUTEX_HELD(&ct->ct_lock));
	if (zone->zone_uniqid == GLOBAL_ZONEUNIQID ||
	    zone->zone_uniqid == ct->ct_czuniqid) {
		zone_t *czone;
		zoneid_t zoneid = -1;

		/*
		 * Contracts don't have holds on the zones they were
		 * created by.  If the contract's zone no longer
		 * exists, we say its zoneid is -1.
		 */
		if (zone->zone_uniqid == ct->ct_czuniqid ||
		    ct->ct_czuniqid == GLOBAL_ZONEUNIQID) {
			zoneid = ct->ct_zoneid;
		} else if ((czone = zone_find_by_id(ct->ct_zoneid)) != NULL) {
			if (czone->zone_uniqid == ct->ct_mzuniqid)
				zoneid = ct->ct_zoneid;
			zone_rele(czone);
		}

		STRUCT_FSET(lstatus, ctst_zoneid, zoneid);
		STRUCT_FSET(lstatus, ctst_holder,
		    (ct->ct_state == CTS_OWNED) ? ct->ct_owner->p_pid :
		    (ct->ct_state == CTS_INHERITED) ? ct->ct_regent->ct_id : 0);
		STRUCT_FSET(lstatus, ctst_state, ct->ct_state);
	} else {
		/*
		 * We are looking at a contract which was created by a
		 * process outside of our zone.  We provide fake zone,
		 * holder, and state information.
		 */

		STRUCT_FSET(lstatus, ctst_zoneid, zone->zone_id);
		/*
		 * Since "zone" can't disappear until the calling ctfs
		 * is unmounted, zone_zsched must be valid.
		 */
		STRUCT_FSET(lstatus, ctst_holder, (ct->ct_state < CTS_ORPHAN) ?
		    zone->zone_zsched->p_pid : 0);
		STRUCT_FSET(lstatus, ctst_state, (ct->ct_state < CTS_ORPHAN) ?
		    CTS_OWNED : ct->ct_state);
	}
	STRUCT_FSET(lstatus, ctst_nevents, ct->ct_evcnt);
	STRUCT_FSET(lstatus, ctst_ntime, get_time_left(&ct->ct_ntime));
	STRUCT_FSET(lstatus, ctst_qtime, get_time_left(&ct->ct_qtime));
	STRUCT_FSET(lstatus, ctst_nevid,
	    ct->ct_nevent ? ct->ct_nevent->cte_id : 0);
	STRUCT_FSET(lstatus, ctst_critical, ct->ct_ev_crit);
	STRUCT_FSET(lstatus, ctst_informative, ct->ct_ev_info);
	STRUCT_FSET(lstatus, ctst_cookie, ct->ct_cookie);
	STRUCT_FSET(lstatus, ctst_type, ct->ct_type->ct_type_index);
	STRUCT_FSET(lstatus, ctst_id, ct->ct_id);
}

/*
 * contract_checkcred
 *
 * Determines if the specified contract is owned by a process with the
 * same effective uid as the specified credential.  The caller must
 * ensure that the uid spaces are the same.  Returns 1 on success.
 */
static int
contract_checkcred(contract_t *ct, const cred_t *cr)
{
	proc_t *p;
	int fail = 1;

	mutex_enter(&ct->ct_lock);
	if ((p = ct->ct_owner) != NULL) {
		mutex_enter(&p->p_crlock);
		fail = crgetuid(cr) != crgetuid(p->p_cred);
		mutex_exit(&p->p_crlock);
	}
	mutex_exit(&ct->ct_lock);

	return (!fail);
}

/*
 * contract_owned
 *
 * Determines if the specified credential can view an event generated
 * by the specified contract.  If locked is set, the contract's ct_lock
 * is held and the caller will need to do additional work to determine
 * if they truly can see the event.  Returns 1 on success.
 */
int
contract_owned(contract_t *ct, const cred_t *cr, int locked)
{
	int owner, cmatch, zmatch;
	uint64_t zuniqid, mzuniqid;
	uid_t euid;

	ASSERT(locked || MUTEX_NOT_HELD(&ct->ct_lock));

	zuniqid = curproc->p_zone->zone_uniqid;
	mzuniqid = contract_getzuniqid(ct);
	euid = crgetuid(cr);

	/*
	 * owner: we own the contract
	 * cmatch: we are in the creator's (and holder's) zone and our
	 *   uid matches the creator's or holder's
	 * zmatch: we are in the effective zone of a contract created
	 *   in the global zone, and our uid matches that of the
	 *   virtualized holder's (zsched/kcred)
	 */
	owner = (ct->ct_owner == curproc);
	cmatch = (zuniqid == ct->ct_czuniqid) &&
	    ((ct->ct_cuid == euid) || (!locked && contract_checkcred(ct, cr)));
	zmatch = (ct->ct_czuniqid != mzuniqid) && (zuniqid == mzuniqid) &&
	    (crgetuid(kcred) == euid);

	return (owner || cmatch || zmatch);
}


/*
 * contract_type_init
 *
 * Called by contract types to register themselves with the contracts
 * framework.
 */
ct_type_t *
contract_type_init(ct_typeid_t type, const char *name, contops_t *ops,
    ct_f_default_t *dfault)
{
	ct_type_t *result;

	ASSERT(type < CTT_MAXTYPE);

	result = kmem_alloc(sizeof (ct_type_t), KM_SLEEP);

	mutex_init(&result->ct_type_lock, NULL, MUTEX_DEFAULT, NULL);
	avl_create(&result->ct_type_avl, contract_compar, sizeof (contract_t),
	    offsetof(contract_t, ct_cttavl));
	cte_queue_create(&result->ct_type_events, CTEL_BUNDLE, 20, 0);
	result->ct