1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 
  26 #pragma ident   "%Z%%M% %I%     %E% SMI"
  27 
  28 /*
  29  * method.c - method execution functions
  30  *
  31  * This file contains the routines needed to run a method:  a fork(2)-exec(2)
  32  * invocation monitored using either the contract filesystem or waitpid(2).
  33  * (Plain fork1(2) support is provided in fork.c.)
  34  *
  35  * Contract Transfer
  36  *   When we restart a service, we want to transfer any contracts that the old
  37  *   service's contract inherited.  This means that (a) we must not abandon the
  38  *   old contract when the service dies and (b) we must write the id of the old
  39  *   contract into the terms of the new contract.  There should be limits to
  40  *   (a), though, since we don't want to keep the contract around forever.  To
  41  *   this end we'll say that services in the offline state may have a contract
  42  *   to be transfered and services in the disabled or maintenance states cannot.
  43  *   This means that when a service transitions from online (or degraded) to
  44  *   offline, the contract should be preserved, and when the service transitions
  45  *   from offline to online (i.e., the start method), we'll transfer inherited
  46  *   contracts.
  47  */
  48 
  49 #include <sys/contract/process.h>
  50 #include <sys/ctfs.h>
  51 #include <sys/stat.h>
  52 #include <sys/time.h>
  53 #include <sys/types.h>
  54 #include <sys/uio.h>
  55 #include <sys/wait.h>
  56 #include <alloca.h>
  57 #include <assert.h>
  58 #include <errno.h>
  59 #include <fcntl.h>
  60 #include <libcontract.h>
  61 #include <libcontract_priv.h>
  62 #include <libgen.h>
  63 #include <librestart.h>
  64 #include <libscf.h>
  65 #include <limits.h>
  66 #include <port.h>
  67 #include <sac.h>
  68 #include <signal.h>
  69 #include <stdlib.h>
  70 #include <string.h>
  71 #include <strings.h>
  72 #include <unistd.h>
  73 #include <atomic.h>
  74 #include <poll.h>
  75 
  76 #include "startd.h"
  77 
  78 #define SBIN_SH         "/sbin/sh"
  79 
  80 /*
  81  * Used to tell if contracts are in the process of being
  82  * stored into the svc.startd internal hash table.
  83  */
  84 volatile uint16_t       storing_contract = 0;
  85 
  86 /*
  87  * Mapping from restart_on method-type to contract events.  Must correspond to
  88  * enum method_restart_t.
  89  */
  90 static uint_t method_events[] = {
  91         /* METHOD_RESTART_ALL */
  92         CT_PR_EV_HWERR | CT_PR_EV_SIGNAL | CT_PR_EV_CORE | CT_PR_EV_EMPTY,
  93         /* METHOD_RESTART_EXTERNAL_FAULT */
  94         CT_PR_EV_HWERR | CT_PR_EV_SIGNAL,
  95         /* METHOD_RESTART_ANY_FAULT */
  96         CT_PR_EV_HWERR | CT_PR_EV_SIGNAL | CT_PR_EV_CORE
  97 };
  98 
  99 /*
 100  * method_record_start(restarter_inst_t *)
 101  *   Record a service start for rate limiting.  Place the current time
 102  *   in the circular array of instance starts.
 103  */
 104 static void
 105 method_record_start(restarter_inst_t *inst)
 106 {
 107         int index = inst->ri_start_index++ % RINST_START_TIMES;
 108 
 109         inst->ri_start_time[index] = gethrtime();
 110 }
 111 
 112 /*
 113  * method_rate_critical(restarter_inst_t *)
 114  *    Return true if the average start interval is less than the permitted
 115  *    interval.  Implicit success if insufficient measurements for an
 116  *    average exist.
 117  */
 118 static int
 119 method_rate_critical(restarter_inst_t *inst)
 120 {
 121         uint_t n = inst->ri_start_index;
 122         hrtime_t avg_ns = 0;
 123 
 124         if (inst->ri_start_index < RINST_START_TIMES)
 125                 return (0);
 126 
 127         avg_ns =
 128             (inst->ri_start_time[(n - 1) % RINST_START_TIMES] -
 129             inst->ri_start_time[n % RINST_START_TIMES]) /
 130             (RINST_START_TIMES - 1);
 131 
 132         return (avg_ns < RINST_FAILURE_RATE_NS);
 133 }
 134 
 135 /*
 136  * int method_is_transient()
 137  *   Determine if the method for the given instance is transient,
 138  *   from a contract perspective. Return 1 if it is, and 0 if it isn't.
 139  */
 140 static int
 141 method_is_transient(restarter_inst_t *inst, int type)
 142 {
 143         if (instance_is_transient_style(inst) || type != METHOD_START)
 144                 return (1);
 145         else
 146                 return (0);
 147 }
 148 
 149 /*
 150  * void method_store_contract()
 151  *   Store the newly created contract id into local structures and
 152  *   the repository.  If the repository connection is broken it is rebound.
 153  */
 154 static void
 155 method_store_contract(restarter_inst_t *inst, int type, ctid_t *cid)
 156 {
 157         int r;
 158         boolean_t primary;
 159 
 160         if (errno = contract_latest(cid))
 161                 uu_die("%s: Couldn't get new contract's id", inst->ri_i.i_fmri);
 162 
 163         primary = !method_is_transient(inst, type);
 164 
 165         if (!primary) {
 166                 if (inst->ri_i.i_transient_ctid != 0) {
 167                         log_framework(LOG_INFO,
 168                             "%s: transient ctid expected to be 0 but "
 169                             "was set to %ld\n", inst->ri_i.i_fmri,
 170                             inst->ri_i.i_transient_ctid);
 171                 }
 172 
 173                 inst->ri_i.i_transient_ctid = *cid;
 174         } else {
 175                 if (inst->ri_i.i_primary_ctid != 0) {
 176                         /*
 177                          * There was an old contract that we transferred.
 178                          * Remove it.
 179                          */
 180                         method_remove_contract(inst, B_TRUE, B_FALSE);
 181                 }
 182 
 183                 if (inst->ri_i.i_primary_ctid != 0) {
 184                         log_framework(LOG_INFO,
 185                             "%s: primary ctid expected to be 0 but "
 186                             "was set to %ld\n", inst->ri_i.i_fmri,
 187                             inst->ri_i.i_primary_ctid);
 188                 }
 189 
 190                 inst->ri_i.i_primary_ctid = *cid;
 191                 inst->ri_i.i_primary_ctid_stopped = 0;
 192 
 193                 log_framework(LOG_DEBUG, "Storing primary contract %ld for "
 194                     "%s.\n", *cid, inst->ri_i.i_fmri);
 195 
 196                 contract_hash_store(*cid, inst->ri_id);
 197         }
 198 
 199 again:
 200         if (inst->ri_mi_deleted)
 201                 return;
 202 
 203         r = restarter_store_contract(inst->ri_m_inst, *cid, primary ?
 204             RESTARTER_CONTRACT_PRIMARY : RESTARTER_CONTRACT_TRANSIENT);
 205         switch (r) {
 206         case 0:
 207                 break;
 208 
 209         case ECANCELED:
 210                 inst->ri_mi_deleted = B_TRUE;
 211                 break;
 212 
 213         case ECONNABORTED:
 214                 libscf_handle_rebind(scf_instance_handle(inst->ri_m_inst));
 215                 /* FALLTHROUGH */
 216 
 217         case EBADF:
 218                 libscf_reget_instance(inst);
 219                 goto again;
 220 
 221         case ENOMEM:
 222         case EPERM:
 223         case EACCES:
 224         case EROFS:
 225                 uu_die("%s: Couldn't store contract id %ld",
 226                     inst->ri_i.i_fmri, *cid);
 227                 /* NOTREACHED */
 228 
 229         case EINVAL:
 230         default:
 231                 bad_error("restarter_store_contract", r);
 232         }
 233 }
 234 
 235 /*
 236  * void method_remove_contract()
 237  *   Remove any non-permanent contracts from internal structures and
 238  *   the repository, then abandon them.
 239  *   Returns
 240  *     0 - success
 241  *     ECANCELED - inst was deleted from the repository
 242  *
 243  *   If the repository connection was broken, it is rebound.
 244  */
 245 void
 246 method_remove_contract(restarter_inst_t *inst, boolean_t primary,
 247     boolean_t abandon)
 248 {
 249         ctid_t * const ctidp = primary ? &inst->ri_i.i_primary_ctid :
 250             &inst->ri_i.i_transient_ctid;
 251 
 252         int r;
 253 
 254         assert(*ctidp != 0);
 255 
 256         log_framework(LOG_DEBUG, "Removing %s contract %lu for %s.\n",
 257             primary ? "primary" : "transient", *ctidp, inst->ri_i.i_fmri);
 258 
 259         if (abandon)
 260                 contract_abandon(*ctidp);
 261 
 262 again:
 263         if (inst->ri_mi_deleted) {
 264                 r = ECANCELED;
 265                 goto out;
 266         }
 267 
 268         r = restarter_remove_contract(inst->ri_m_inst, *ctidp, primary ?
 269             RESTARTER_CONTRACT_PRIMARY : RESTARTER_CONTRACT_TRANSIENT);
 270         switch (r) {
 271         case 0:
 272                 break;
 273 
 274         case ECANCELED:
 275                 inst->ri_mi_deleted = B_TRUE;
 276                 break;
 277 
 278         case ECONNABORTED:
 279                 libscf_handle_rebind(scf_instance_handle(inst->ri_m_inst));
 280                 /* FALLTHROUGH */
 281 
 282         case EBADF:
 283                 libscf_reget_instance(inst);
 284                 goto again;
 285 
 286         case ENOMEM:
 287         case EPERM:
 288         case EACCES:
 289         case EROFS:
 290                 log_error(LOG_INFO, "%s: Couldn't remove contract id %ld: "
 291                     "%s.\n", inst->ri_i.i_fmri, *ctidp, strerror(r));
 292                 break;
 293 
 294         case EINVAL:
 295         default:
 296                 bad_error("restarter_remove_contract", r);
 297         }
 298 
 299 out:
 300         if (primary)
 301                 contract_hash_remove(*ctidp);
 302 
 303         *ctidp = 0;
 304 }
 305 
 306 static const char *method_names[] = { "start", "stop", "refresh" };
 307 
 308 /*
 309  * int method_ready_contract(restarter_inst_t *, int, method_restart_t, int)
 310  *
 311  *   Activate a contract template for the type method of inst.  type,
 312  *   restart_on, and cte_mask dictate the critical events term of the contract.
 313  *   Returns
 314  *     0 - success
 315  *     ECANCELED - inst has been deleted from the repository
 316  */
 317 static int
 318 method_ready_contract(restarter_inst_t *inst, int type,
 319     method_restart_t restart_on, uint_t cte_mask)
 320 {
 321         int tmpl, err, istrans, iswait, ret;
 322         uint_t cevents, fevents;
 323 
 324         /*
 325          * Correctly supporting wait-style services is tricky without
 326          * rearchitecting startd to cope with multiple event sources
 327          * simultaneously trying to stop an instance.  Until a better
 328          * solution is implemented, we avoid this problem for
 329          * wait-style services by making contract events fatal and
 330          * letting the wait code alone handle stopping the service.
 331          */
 332         iswait = instance_is_wait_style(inst);
 333         istrans = method_is_transient(inst, type);
 334 
 335         tmpl = open64(CTFS_ROOT "/process/template", O_RDWR);
 336         if (tmpl == -1)
 337                 uu_die("Could not create contract template");
 338 
 339         /*
 340          * We assume non-login processes are unlikely to create
 341          * multiple process groups, and set CT_PR_PGRPONLY for all
 342          * wait-style services' contracts.
 343          */
 344         err = ct_pr_tmpl_set_param(tmpl, CT_PR_INHERIT | CT_PR_REGENT |
 345             (iswait ? CT_PR_PGRPONLY : 0));
 346         assert(err == 0);
 347 
 348         if (istrans) {
 349                 cevents = 0;
 350                 fevents = 0;
 351         } else {
 352                 assert(restart_on >= 0);
 353                 assert(restart_on <= METHOD_RESTART_ANY_FAULT);
 354                 cevents = method_events[restart_on] & ~cte_mask;
 355                 fevents = iswait ?
 356                     (method_events[restart_on] & ~cte_mask & CT_PR_ALLFATAL) :
 357                     0;
 358         }
 359 
 360         err = ct_tmpl_set_critical(tmpl, cevents);
 361         assert(err == 0);
 362 
 363         err = ct_tmpl_set_informative(tmpl, 0);
 364         assert(err == 0);
 365         err = ct_pr_tmpl_set_fatal(tmpl, fevents);
 366         assert(err == 0);
 367 
 368         err = ct_tmpl_set_cookie(tmpl, istrans ?  METHOD_OTHER_COOKIE :
 369             METHOD_START_COOKIE);
 370         assert(err == 0);
 371 
 372         if (type == METHOD_START && inst->ri_i.i_primary_ctid != 0) {
 373                 ret = ct_pr_tmpl_set_transfer(tmpl, inst->ri_i.i_primary_ctid);
 374                 switch (ret) {
 375                 case 0:
 376                         break;
 377 
 378                 case ENOTEMPTY:
 379                         /* No contracts for you! */
 380                         method_remove_contract(inst, B_TRUE, B_TRUE);
 381                         if (inst->ri_mi_deleted) {
 382                                 ret = ECANCELED;
 383                                 goto out;
 384                         }
 385                         break;
 386 
 387                 case EINVAL:
 388                 case ESRCH:
 389                 case EACCES:
 390                 default:
 391                         bad_error("ct_pr_tmpl_set_transfer", ret);
 392                 }
 393         }
 394 
 395         err = ct_pr_tmpl_set_svc_fmri(tmpl, inst->ri_i.i_fmri);
 396         assert(err == 0);
 397         err = ct_pr_tmpl_set_svc_aux(tmpl, method_names[type]);
 398         assert(err == 0);
 399 
 400         err = ct_tmpl_activate(tmpl);
 401         assert(err == 0);
 402 
 403         ret = 0;
 404 
 405 out:
 406         err = close(tmpl);
 407         assert(err == 0);
 408 
 409         return (ret);
 410 }
 411 
 412 static void
 413 exec_method(const restarter_inst_t *inst, int type, const char *method,
 414     struct method_context *mcp, uint8_t need_session)
 415 {
 416         char *cmd;
 417         const char *errf;
 418         char **nenv;
 419         int rsmc_errno = 0;
 420 
 421         cmd = uu_msprintf("exec %s", method);
 422 
 423         if (inst->ri_utmpx_prefix[0] != '\0' && inst->ri_utmpx_prefix != NULL)
 424                 (void) utmpx_mark_init(getpid(), inst->ri_utmpx_prefix);
 425 
 426         setlog(inst->ri_logstem);
 427         log_instance(inst, B_FALSE, "Executing %s method (\"%s\").",
 428             method_names[type], method);
 429 
 430         if (need_session)
 431                 (void) setpgrp();
 432 
 433         /* Set credentials. */
 434         rsmc_errno = restarter_set_method_context(mcp, &errf);
 435         if (rsmc_errno != 0) {
 436                 (void) fputs("svc.startd could not set context for method: ",
 437                     stderr);
 438 
 439                 if (rsmc_errno == -1) {
 440                         if (strcmp(errf, "core_set_process_path") == 0) {
 441                                 (void) fputs("Could not set corefile path.\n",
 442                                     stderr);
 443                         } else if (strcmp(errf, "setproject") == 0) {
 444                                 (void) fprintf(stderr, "%s: a resource control "
 445                                     "assignment failed\n", errf);
 446                         } else if (strcmp(errf, "pool_set_binding") == 0) {
 447                                 (void) fprintf(stderr, "%s: a system error "
 448                                     "occurred\n", errf);
 449                         } else {
 450 #ifndef NDEBUG
 451                                 uu_warn("%s:%d: Bad function name \"%s\" for "
 452                                     "error %d from "
 453                                     "restarter_set_method_context().\n",
 454                                     __FILE__, __LINE__, errf, rsmc_errno);
 455 #endif
 456                                 abort();
 457                         }
 458 
 459                         exit(1);
 460                 }
 461 
 462                 if (errf != NULL && strcmp(errf, "pool_set_binding") == 0) {
 463                         switch (rsmc_errno) {
 464                         case ENOENT:
 465                                 (void) fprintf(stderr, "%s: the pool could not "
 466                                     "be found\n", errf);
 467                                 break;
 468 
 469                         case EBADF:
 470                                 (void) fprintf(stderr, "%s: the configuration "
 471                                     "is invalid\n", errf);
 472                                 break;
 473 
 474                         case EINVAL:
 475                                 (void) fprintf(stderr, "%s: pool name \"%s\" "
 476                                     "is invalid\n", errf, mcp->resource_pool);
 477                                 break;
 478 
 479                         default:
 480 #ifndef NDEBUG
 481                                 uu_warn("%s:%d: Bad error %d for function %s "
 482                                     "in restarter_set_method_context().\n",
 483                                     __FILE__, __LINE__, rsmc_errno, errf);
 484 #endif
 485                                 abort();
 486                         }
 487 
 488                         exit(SMF_EXIT_ERR_CONFIG);
 489                 }
 490 
 491                 if (errf != NULL) {
 492                         errno = rsmc_errno;
 493                         perror(errf);
 494 
 495                         switch (rsmc_errno) {
 496                         case EINVAL:
 497                         case EPERM:
 498                         case ENOENT:
 499                         case ENAMETOOLONG:
 500                         case ERANGE:
 501                         case ESRCH:
 502                                 exit(SMF_EXIT_ERR_CONFIG);
 503                                 /* NOTREACHED */
 504 
 505                         default:
 506                                 exit(1);
 507                         }
 508                 }
 509 
 510                 switch (rsmc_errno) {
 511                 case ENOMEM:
 512                         (void) fputs("Out of memory.\n", stderr);
 513                         exit(1);
 514                         /* NOTREACHED */
 515 
 516                 case ENOENT:
 517                         (void) fputs("Missing passwd entry for user.\n",
 518                             stderr);
 519                         exit(SMF_EXIT_ERR_CONFIG);
 520                         /* NOTREACHED */
 521 
 522                 default:
 523 #ifndef NDEBUG
 524                         uu_warn("%s:%d: Bad miscellaneous error %d from "
 525                             "restarter_set_method_context().\n", __FILE__,
 526                             __LINE__, rsmc_errno);
 527 #endif
 528                         abort();
 529                 }
 530         }
 531 
 532         nenv = set_smf_env(mcp->env, mcp->env_sz, NULL, inst,
 533             method_names[type]);
 534 
 535         log_preexec();
 536 
 537         (void) execle(SBIN_SH, SBIN_SH, "-c", cmd, NULL, nenv);
 538 
 539         exit(10);
 540 }
 541 
 542 static void
 543 write_status(restarter_inst_t *inst, const char *mname, int stat)
 544 {
 545         int r;
 546 
 547 again:
 548         if (inst->ri_mi_deleted)
 549                 return;
 550 
 551         r = libscf_write_method_status(inst->ri_m_inst, mname, stat);
 552         switch (r) {
 553         case 0:
 554                 break;
 555 
 556         case ECONNABORTED:
 557                 libscf_reget_instance(inst);
 558                 goto again;
 559 
 560         case ECANCELED:
 561                 inst->ri_mi_deleted = 1;
 562                 break;
 563 
 564         case EPERM:
 565         case EACCES:
 566         case EROFS:
 567                 log_framework(LOG_INFO, "Could not write exit status "
 568                     "for %s method of %s: %s.\n", mname,
 569                     inst->ri_i.i_fmri, strerror(r));
 570                 break;
 571 
 572         case ENAMETOOLONG:
 573         default:
 574                 bad_error("libscf_write_method_status", r);
 575         }
 576 }
 577 
 578 /*
 579  * int method_run()
 580  *   Execute the type method of instp.  If it requires a fork(), wait for it
 581  *   to return and return its exit code in *exit_code.  Otherwise set
 582  *   *exit_code to 0 if the method succeeds & -1 if it fails.  If the
 583  *   repository connection is broken, it is rebound, but inst may not be
 584  *   reset.
 585  *   Returns
 586  *     0 - success
 587  *     EINVAL - A correct method or method context couldn't be retrieved.
 588  *     EIO - Contract kill failed.
 589  *     EFAULT - Method couldn't be executed successfully.
 590  *     ELOOP - Retry threshold exceeded.
 591  *     ECANCELED - inst was deleted from the repository before method was run
 592  *     ERANGE - Timeout retry threshold exceeded.
 593  *     EAGAIN - Failed due to external cause, retry.
 594  */
 595 int
 596 method_run(restarter_inst_t **instp, int type, int *exit_code)
 597 {
 598         char *method;
 599         int ret_status;
 600         pid_t pid;
 601         method_restart_t restart_on;
 602         uint_t cte_mask;
 603         uint8_t need_session;
 604         scf_handle_t *h;
 605         scf_snapshot_t *snap;
 606         const char *mname;
 607         const char *errstr;
 608         struct method_context *mcp;
 609         int result = 0, timeout_fired = 0;
 610         int sig, r;
 611         boolean_t transient;
 612         uint64_t timeout;
 613         uint8_t timeout_retry;
 614         ctid_t ctid;
 615         int ctfd = -1;
 616         restarter_inst_t *inst = *instp;
 617         int id = inst->ri_id;
 618         int forkerr;
 619 
 620         assert(PTHREAD_MUTEX_HELD(&inst->ri_lock));
 621         assert(instance_in_transition(inst));
 622 
 623         if (inst->ri_mi_deleted)
 624                 return (ECANCELED);
 625 
 626         *exit_code = 0;
 627 
 628         assert(0 <= type && type <= 2);
 629         mname = method_names[type];
 630 
 631         if (type == METHOD_START)
 632                 inst->ri_pre_online_hook();
 633 
 634         h = scf_instance_handle(inst->ri_m_inst);
 635 
 636         snap = scf_snapshot_create(h);
 637         if (snap == NULL ||
 638             scf_instance_get_snapshot(inst->ri_m_inst, "running", snap) != 0) {
 639                 log_framework(LOG_DEBUG,
 640                     "Could not get running snapshot for %s.  "
 641                     "Using editing version to run method %s.\n",
 642                     inst->ri_i.i_fmri, mname);
 643                 scf_snapshot_destroy(snap);
 644                 snap = NULL;
 645         }
 646 
 647         /*
 648          * After this point, we may be logging to the instance log.
 649          * Make sure we've noted where that log is as a property of
 650          * the instance.
 651          */
 652         r = libscf_note_method_log(inst->ri_m_inst, st->st_log_prefix,
 653             inst->ri_logstem);
 654         if (r != 0) {
 655                 log_framework(LOG_WARNING,
 656                     "%s: couldn't note log location: %s\n",
 657                     inst->ri_i.i_fmri, strerror(r));
 658         }
 659 
 660         if ((method = libscf_get_method(h, type, inst, snap, &restart_on,
 661             &cte_mask, &need_session, &timeout, &timeout_retry)) == NULL) {
 662                 if (errno == LIBSCF_PGROUP_ABSENT)  {
 663                         log_framework(LOG_DEBUG,
 664                             "%s: instance has no method property group '%s'.\n",
 665                             inst->ri_i.i_fmri, mname);
 666                         if (type == METHOD_REFRESH)
 667                                 log_instance(inst, B_TRUE, "No '%s' method "
 668                                     "defined.  Treating as :true.", mname);
 669                         else
 670                                 log_instance(inst, B_TRUE, "Method property "
 671                                     "group '%s' is not present.", mname);
 672                         scf_snapshot_destroy(snap);
 673                         return (0);
 674                 } else if (errno == LIBSCF_PROPERTY_ABSENT)  {
 675                         log_framework(LOG_DEBUG,
 676                             "%s: instance has no '%s/exec' method property.\n",
 677                             inst->ri_i.i_fmri, mname);
 678                         log_instance(inst, B_TRUE, "Method property '%s/exec "
 679                             "is not present.", mname);
 680                         scf_snapshot_destroy(snap);
 681                         return (0);
 682                 } else {
 683                         log_error(LOG_WARNING,
 684                             "%s: instance libscf_get_method failed\n",
 685                             inst->ri_i.i_fmri);
 686                         scf_snapshot_destroy(snap);
 687                         return (EINVAL);
 688                 }
 689         }
 690 
 691         /* open service contract if stopping a non-transient service */
 692         if (type == METHOD_STOP && (!instance_is_transient_style(inst))) {
 693                 if (inst->ri_i.i_primary_ctid == 0) {
 694                         /* service is not running, nothing to stop */
 695                         log_framework(LOG_DEBUG, "%s: instance has no primary "
 696                             "contract, no service to stop.\n",
 697                             inst->ri_i.i_fmri);
 698                         scf_snapshot_destroy(snap);
 699                         return (0);
 700                 }
 701                 if ((ctfd = contract_open(inst->ri_i.i_primary_ctid, "process",
 702                     "events", O_RDONLY)) < 0) {
 703                         result = EFAULT;
 704                         log_instance(inst, B_TRUE, "Could not open service "
 705                             "contract %ld.  Stop method not run.",
 706                             inst->ri_i.i_primary_ctid);
 707                         goto out;
 708                 }
 709         }
 710 
 711         if (restarter_is_null_method(method)) {
 712                 log_framework(LOG_DEBUG, "%s: null method succeeds\n",
 713                     inst->ri_i.i_fmri);
 714 
 715                 log_instance(inst, B_TRUE, "Executing %s method (null).",
 716                     mname);
 717 
 718                 if (type == METHOD_START)
 719                         write_status(inst, mname, 0);
 720                 goto out;
 721         }
 722 
 723         sig = restarter_is_kill_method(method);
 724         if (sig >= 0) {
 725 
 726                 if (inst->ri_i.i_primary_ctid == 0) {
 727                         log_error(LOG_ERR, "%s: :kill with no contract\n",
 728                             inst->ri_i.i_fmri);
 729                         log_instance(inst, B_TRUE, "Invalid use of \":kill\" "
 730                             "as stop method for transient service.");
 731                         result = EINVAL;
 732                         goto out;
 733                 }
 734 
 735                 log_framework(LOG_DEBUG,
 736                     "%s: :killing contract with signal %d\n",
 737                     inst->ri_i.i_fmri, sig);
 738 
 739                 log_instance(inst, B_TRUE, "Executing %s method (:kill).",
 740                     mname);
 741 
 742                 if (contract_kill(inst->ri_i.i_primary_ctid, sig,
 743                     inst->ri_i.i_fmri) != 0) {
 744                         result = EIO;
 745                         goto out;
 746                 } else
 747                         goto assured_kill;
 748         }
 749 
 750         log_framework(LOG_DEBUG, "%s: forking to run method %s\n",
 751             inst->ri_i.i_fmri, method);
 752 
 753         errstr = restarter_get_method_context(RESTARTER_METHOD_CONTEXT_VERSION,
 754             inst->ri_m_inst, snap, mname, method, &mcp);
 755 
 756         if (errstr != NULL) {
 757                 log_error(LOG_WARNING, "%s: %s\n", inst->ri_i.i_fmri, errstr);
 758                 result = EINVAL;
 759                 goto out;
 760         }
 761 
 762         r = method_ready_contract(inst, type, restart_on, cte_mask);
 763         if (r != 0) {
 764                 assert(r == ECANCELED);
 765                 assert(inst->ri_mi_deleted);
 766                 restarter_free_method_context(mcp);
 767                 result = ECANCELED;
 768                 goto out;
 769         }
 770 
 771         /*
 772          * Validate safety of method contexts, to save children work.
 773          */
 774         if (!restarter_rm_libs_loadable())
 775                 log_framework(LOG_DEBUG, "%s: method contexts limited "
 776                     "to root-accessible libraries\n", inst->ri_i.i_fmri);
 777 
 778         /*
 779          * If the service is restarting too quickly, send it to
 780          * maintenance.
 781          */
 782         if (type == METHOD_START) {
 783                 method_record_start(inst);
 784                 if (method_rate_critical(inst)) {
 785                         log_instance(inst, B_TRUE, "Restarting too quickly, "
 786                             "changing state to maintenance.");
 787                         result = ELOOP;
 788                         restarter_free_method_context(mcp);
 789                         goto out;
 790                 }
 791         }
 792 
 793         atomic_add_16(&storing_contract, 1);
 794         pid = startd_fork1(&forkerr);
 795         if (pid == 0)
 796                 exec_method(inst, type, method, mcp, need_session);
 797 
 798         if (pid == -1) {
 799                 atomic_add_16(&storing_contract, -1);
 800                 if (forkerr == EAGAIN)
 801                         result = EAGAIN;
 802                 else
 803                         result = EFAULT;
 804 
 805                 log_error(LOG_WARNING,
 806                     "%s: Couldn't fork to execute method %s: %s\n",
 807                     inst->ri_i.i_fmri, method, strerror(forkerr));
 808 
 809                 restarter_free_method_context(mcp);
 810                 goto out;
 811         }
 812 
 813 
 814         /*
 815          * Get the contract id, decide whether it is primary or transient, and
 816          * stash it in inst & the repository.
 817          */
 818         method_store_contract(inst, type, &ctid);
 819         atomic_add_16(&storing_contract, -1);
 820 
 821         restarter_free_method_context(mcp);
 822 
 823         /*
 824          * Similarly for the start method PID.
 825          */
 826         if (type == METHOD_START && !inst->ri_mi_deleted)
 827                 (void) libscf_write_start_pid(inst->ri_m_inst, pid);
 828 
 829         if (instance_is_wait_style(inst) && type == METHOD_START) {
 830                 /* Wait style instances don't get timeouts on start methods. */
 831                 if (wait_register(pid, inst->ri_i.i_fmri, 1, 0)) {
 832                         log_error(LOG_WARNING,
 833                             "%s: couldn't register %ld for wait\n",
 834                             inst->ri_i.i_fmri, pid);
 835                         result = EFAULT;
 836                         goto contract_out;
 837                 }
 838                 write_status(inst, mname, 0);
 839 
 840         } else {
 841                 int r, err;
 842                 time_t start_time;
 843                 time_t end_time;
 844 
 845                 /*
 846                  * Because on upgrade/live-upgrade we may have no chance
 847                  * to override faulty timeout values on the way to
 848                  * manifest import, all services on the path to manifest
 849                  * import are treated the same as INFINITE timeout services.
 850                  */
 851 
 852                 start_time = time(NULL);
 853                 if (timeout != METHOD_TIMEOUT_INFINITE && !is_timeout_ovr(inst))
 854                         timeout_insert(inst, ctid, timeout);
 855                 else
 856                         timeout = METHOD_TIMEOUT_INFINITE;
 857 
 858                 /* Unlock the instance while waiting for the method. */
 859                 MUTEX_UNLOCK(&inst->ri_lock);
 860 
 861                 do {
 862                         r = waitpid(pid, &ret_status, NULL);
 863                 } while (r == -1 && errno == EINTR);
 864                 if (r == -1)
 865                         err = errno;
 866 
 867                 /* Re-grab the lock. */
 868                 inst = inst_lookup_by_id(id);
 869 
 870                 /*
 871                  * inst can't be removed, as the removal thread waits
 872                  * for completion of this one.
 873                  */
 874                 assert(inst != NULL);
 875                 *instp = inst;
 876 
 877                 if (inst->ri_timeout != NULL && inst->ri_timeout->te_fired)
 878                         timeout_fired = 1;
 879 
 880                 timeout_remove(inst, ctid);
 881 
 882                 log_framework(LOG_DEBUG,
 883                     "%s method for %s exited with status %d.\n", mname,
 884                     inst->ri_i.i_fmri, WEXITSTATUS(ret_status));
 885 
 886                 if (r == -1) {
 887                         log_error(LOG_WARNING,
 888                             "Couldn't waitpid() for %s method of %s (%s).\n",
 889                             mname, inst->ri_i.i_fmri, strerror(err));
 890                         result = EFAULT;
 891                         goto contract_out;
 892                 }
 893 
 894                 if (type == METHOD_START)
 895                         write_status(inst, mname, ret_status);
 896 
 897                 /* return ERANGE if this service doesn't retry on timeout */
 898                 if (timeout_fired == 1 && timeout_retry == 0) {
 899                         result = ERANGE;
 900                         goto contract_out;
 901                 }
 902 
 903                 if (!WIFEXITED(ret_status)) {
 904                         /*
 905                          * If method didn't exit itself (it was killed by an
 906                          * external entity, etc.), consider the entire
 907                          * method_run as failed.
 908                          */
 909                         if (WIFSIGNALED(ret_status)) {
 910                                 char buf[SIG2STR_MAX];
 911                                 (void) sig2str(WTERMSIG(ret_status), buf);
 912 
 913                                 log_error(LOG_WARNING, "%s: Method \"%s\" "
 914                                     "failed due to signal %s.\n",
 915                                     inst->ri_i.i_fmri, method, buf);
 916                                 log_instance(inst, B_TRUE, "Method \"%s\" "
 917                                     "failed due to signal %s.", mname, buf);
 918                         } else {
 919                                 log_error(LOG_WARNING, "%s: Method \"%s\" "
 920                                     "failed with exit status %d.\n",
 921                                     inst->ri_i.i_fmri, method,
 922                                     WEXITSTATUS(ret_status));
 923                                 log_instance(inst, B_TRUE, "Method \"%s\" "
 924                                     "failed with exit status %d.", mname,
 925                                     WEXITSTATUS(ret_status));
 926                         }
 927                         result = EAGAIN;
 928                         goto contract_out;
 929                 }
 930 
 931                 *exit_code = WEXITSTATUS(ret_status);
 932                 if (*exit_code != 0) {
 933                         log_error(LOG_WARNING,
 934                             "%s: Method \"%s\" failed with exit status %d.\n",
 935                             inst->ri_i.i_fmri, method, WEXITSTATUS(ret_status));
 936                 }
 937 
 938                 log_instance(inst, B_TRUE, "Method \"%s\" exited with status "
 939                     "%d.", mname, *exit_code);
 940 
 941                 if (*exit_code != 0)
 942                         goto contract_out;
 943 
 944                 end_time = time(NULL);
 945 
 946                 /* Give service contract remaining seconds to empty */
 947                 if (timeout != METHOD_TIMEOUT_INFINITE)
 948                         timeout -= (end_time - start_time);
 949         }
 950 
 951 assured_kill:
 952         /*
 953          * For stop methods, assure that the service contract has emptied
 954          * before returning.
 955          */
 956         if (type == METHOD_STOP && (!instance_is_transient_style(inst)) &&
 957             !(contract_is_empty(inst->ri_i.i_primary_ctid))) {
 958 
 959                 if (timeout != METHOD_TIMEOUT_INFINITE)
 960                         timeout_insert(inst, inst->ri_i.i_primary_ctid,
 961                             timeout);
 962 
 963                 for (;;) {
 964                         (void) poll(NULL, 0, 100);
 965                         if (contract_is_empty(inst->ri_i.i_primary_ctid))
 966                                 break;
 967                 }
 968 
 969                 if (timeout != METHOD_TIMEOUT_INFINITE)
 970                         if (inst->ri_timeout->te_fired)
 971                                 result = EFAULT;
 972 
 973                 timeout_remove(inst, inst->ri_i.i_primary_ctid);
 974         }
 975 
 976 contract_out:
 977         /* Abandon contracts for transient methods & methods that fail. */
 978         transient = method_is_transient(inst, type);
 979         if ((transient || *exit_code != 0 || result != 0) &&
 980             (restarter_is_kill_method(method) < 0))
 981                 method_remove_contract(inst, !transient, B_TRUE);
 982 
 983 out:
 984         if (ctfd >= 0)
 985                 (void) close(ctfd);
 986         scf_snapshot_destroy(snap);
 987         free(method);
 988         return (result);
 989 }
 990 
 991 /*
 992  * The method thread executes a service method to effect a state transition.
 993  * The next_state of info->sf_id should be non-_NONE on entrance, and it will
 994  * be _NONE on exit (state will either be what next_state was (on success), or
 995  * it will be _MAINT (on error)).
 996  *
 997  * There are six classes of methods to consider: start & other (stop, refresh)
 998  * for each of "normal" services, wait services, and transient services.  For
 999  * each, the method must be fetched from the repository & executed.  fork()ed
1000  * methods must be waited on, except for the start method of wait services
1001  * (which must be registered with the wait subsystem via wait_register()).  If
1002  * the method succeeded (returned 0), then for start methods its contract
1003  * should be recorded as the primary contract for the service.  For other
1004  * methods, it should be abandoned.  If the method fails, then depending on
1005  * the failure, either the method should be reexecuted or the service should
1006  * be put into maintenance.  Either way the contract should be abandoned.
1007  */
1008 void *
1009 method_thread(void *arg)
1010 {
1011         fork_info_t *info = arg;
1012         restarter_inst_t *inst;
1013         scf_handle_t    *local_handle;
1014         scf_instance_t  *s_inst = NULL;
1015         int r, exit_code;
1016         boolean_t retryable;
1017         const char *aux;
1018 
1019         assert(0 <= info->sf_method_type && info->sf_method_type <= 2);
1020 
1021         /* Get (and lock) the restarter_inst_t. */
1022         inst = inst_lookup_by_id(info->sf_id);
1023 
1024         assert(inst->ri_method_thread != 0);
1025         assert(instance_in_transition(inst) == 1);
1026 
1027         /*
1028          * We cannot leave this function with inst in transition, because
1029          * protocol.c withholds messages for inst otherwise.
1030          */
1031 
1032         log_framework(LOG_DEBUG, "method_thread() running %s method for %s.\n",
1033             method_names[info->sf_method_type], inst->ri_i.i_fmri);
1034 
1035         local_handle = libscf_handle_create_bound_loop();
1036 
1037 rebind_retry:
1038         /* get scf_instance_t */
1039         switch (r = libscf_fmri_get_instance(local_handle, inst->ri_i.i_fmri,
1040             &s_inst)) {
1041         case 0:
1042                 break;
1043 
1044         case ECONNABORTED:
1045                 libscf_handle_rebind(local_handle);
1046                 goto rebind_retry;
1047 
1048         case ENOENT:
1049                 /*
1050                  * It's not there, but we need to call this so protocol.c
1051                  * doesn't think it's in transition anymore.
1052                  */
1053                 (void) restarter_instance_update_states(local_handle, inst,
1054                     inst->ri_i.i_state, RESTARTER_STATE_NONE, RERR_NONE,
1055                     NULL);
1056                 goto out;
1057 
1058         case EINVAL:
1059         case ENOTSUP:
1060         default:
1061                 bad_error("libscf_fmri_get_instance", r);
1062         }
1063 
1064         inst->ri_m_inst = s_inst;
1065         inst->ri_mi_deleted = B_FALSE;
1066 
1067 retry:
1068         if (info->sf_method_type == METHOD_START)
1069                 log_transition(inst, START_REQUESTED);
1070 
1071         r = method_run(&inst, info->sf_method_type, &exit_code);
1072 
1073         if (r == 0 && exit_code == 0) {
1074                 /* Success! */
1075                 assert(inst->ri_i.i_next_state != RESTARTER_STATE_NONE);
1076 
1077                 /*
1078                  * When a stop method succeeds, remove the primary contract of
1079                  * the service, unless we're going to offline, in which case
1080                  * retain the contract so we can transfer inherited contracts to
1081                  * the replacement service.
1082                  */
1083 
1084                 if (info->sf_method_type == METHOD_STOP &&
1085                     inst->ri_i.i_primary_ctid != 0) {
1086                         if (inst->ri_i.i_next_state == RESTARTER_STATE_OFFLINE)
1087                                 inst->ri_i.i_primary_ctid_stopped = 1;
1088                         else
1089                                 method_remove_contract(inst, B_TRUE, B_TRUE);
1090                 }
1091                 /*
1092                  * We don't care whether the handle was rebound because this is
1093                  * the last thing we do with it.
1094                  */
1095                 (void) restarter_instance_update_states(local_handle, inst,
1096                     inst->ri_i.i_next_state, RESTARTER_STATE_NONE,
1097                     info->sf_event_type, NULL);
1098 
1099                 (void) update_fault_count(inst, FAULT_COUNT_RESET);
1100 
1101                 goto out;
1102         }
1103 
1104         /* Failure.  Retry or go to maintenance. */
1105 
1106         if (r != 0 && r != EAGAIN) {
1107                 retryable = B_FALSE;
1108         } else {
1109                 switch (exit_code) {
1110                 case SMF_EXIT_ERR_CONFIG:
1111                 case SMF_EXIT_ERR_NOSMF:
1112                 case SMF_EXIT_ERR_PERM:
1113                 case SMF_EXIT_ERR_FATAL:
1114                         retryable = B_FALSE;
1115                         break;
1116 
1117                 default:
1118                         retryable = B_TRUE;
1119                 }
1120         }
1121 
1122         if (retryable && update_fault_count(inst, FAULT_COUNT_INCR) != 1)
1123                 goto retry;
1124 
1125         /* maintenance */
1126         if (r == ELOOP)
1127                 log_transition(inst, START_FAILED_REPEATEDLY);
1128         else if (r == ERANGE)
1129                 log_transition(inst, START_FAILED_TIMEOUT_FATAL);
1130         else if (exit_code == SMF_EXIT_ERR_CONFIG)
1131                 log_transition(inst, START_FAILED_CONFIGURATION);
1132         else if (exit_code == SMF_EXIT_ERR_FATAL)
1133                 log_transition(inst, START_FAILED_FATAL);
1134         else
1135                 log_transition(inst, START_FAILED_OTHER);
1136 
1137         if (r == ELOOP)
1138                 aux = "restarting_too_quickly";
1139         else if (retryable)
1140                 aux = "fault_threshold_reached";
1141         else
1142                 aux = "method_failed";
1143 
1144         (void) restarter_instance_update_states(local_handle, inst,
1145             RESTARTER_STATE_MAINT, RESTARTER_STATE_NONE, RERR_FAULT,
1146             (char *)aux);
1147 
1148         if (!method_is_transient(inst, info->sf_method_type) &&
1149             inst->ri_i.i_primary_ctid != 0)
1150                 method_remove_contract(inst, B_TRUE, B_TRUE);
1151 
1152 out:
1153         inst->ri_method_thread = 0;
1154 
1155         /*
1156          * Unlock the mutex after broadcasting to avoid a race condition
1157          * with restarter_delete_inst() when the 'inst' structure is freed.
1158          */
1159         (void) pthread_cond_broadcast(&inst->ri_method_cv);
1160         MUTEX_UNLOCK(&inst->ri_lock);
1161 
1162         scf_instance_destroy(s_inst);
1163         scf_handle_destroy(local_handle);
1164         startd_free(info, sizeof (fork_info_t));
1165         return (NULL);
1166 }