1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25
26 #pragma ident "%Z%%M% %I% %E% SMI"
27
28 /*
29 * method.c - method execution functions
30 *
31 * This file contains the routines needed to run a method: a fork(2)-exec(2)
32 * invocation monitored using either the contract filesystem or waitpid(2).
33 * (Plain fork1(2) support is provided in fork.c.)
34 *
35 * Contract Transfer
36 * When we restart a service, we want to transfer any contracts that the old
37 * service's contract inherited. This means that (a) we must not abandon the
38 * old contract when the service dies and (b) we must write the id of the old
39 * contract into the terms of the new contract. There should be limits to
40 * (a), though, since we don't want to keep the contract around forever. To
41 * this end we'll say that services in the offline state may have a contract
42 * to be transfered and services in the disabled or maintenance states cannot.
43 * This means that when a service transitions from online (or degraded) to
44 * offline, the contract should be preserved, and when the service transitions
45 * from offline to online (i.e., the start method), we'll transfer inherited
46 * contracts.
47 */
48
49 #include <sys/contract/process.h>
50 #include <sys/ctfs.h>
51 #include <sys/stat.h>
52 #include <sys/time.h>
53 #include <sys/types.h>
54 #include <sys/uio.h>
55 #include <sys/wait.h>
56 #include <alloca.h>
57 #include <assert.h>
58 #include <errno.h>
59 #include <fcntl.h>
60 #include <libcontract.h>
61 #include <libcontract_priv.h>
62 #include <libgen.h>
63 #include <librestart.h>
64 #include <libscf.h>
65 #include <limits.h>
66 #include <port.h>
67 #include <sac.h>
68 #include <signal.h>
69 #include <stdlib.h>
70 #include <string.h>
71 #include <strings.h>
72 #include <unistd.h>
73 #include <atomic.h>
74 #include <poll.h>
75
76 #include "startd.h"
77
78 #define SBIN_SH "/sbin/sh"
79
80 /*
81 * Used to tell if contracts are in the process of being
82 * stored into the svc.startd internal hash table.
83 */
84 volatile uint16_t storing_contract = 0;
85
86 /*
87 * Mapping from restart_on method-type to contract events. Must correspond to
88 * enum method_restart_t.
89 */
90 static uint_t method_events[] = {
91 /* METHOD_RESTART_ALL */
92 CT_PR_EV_HWERR | CT_PR_EV_SIGNAL | CT_PR_EV_CORE | CT_PR_EV_EMPTY,
93 /* METHOD_RESTART_EXTERNAL_FAULT */
94 CT_PR_EV_HWERR | CT_PR_EV_SIGNAL,
95 /* METHOD_RESTART_ANY_FAULT */
96 CT_PR_EV_HWERR | CT_PR_EV_SIGNAL | CT_PR_EV_CORE
97 };
98
99 /*
100 * method_record_start(restarter_inst_t *)
101 * Record a service start for rate limiting. Place the current time
102 * in the circular array of instance starts.
103 */
104 static void
105 method_record_start(restarter_inst_t *inst)
106 {
107 int index = inst->ri_start_index++ % RINST_START_TIMES;
108
109 inst->ri_start_time[index] = gethrtime();
110 }
111
112 /*
113 * method_rate_critical(restarter_inst_t *)
114 * Return true if the average start interval is less than the permitted
115 * interval. Implicit success if insufficient measurements for an
116 * average exist.
117 */
118 static int
119 method_rate_critical(restarter_inst_t *inst)
120 {
121 uint_t n = inst->ri_start_index;
122 hrtime_t avg_ns = 0;
123
124 if (inst->ri_start_index < RINST_START_TIMES)
125 return (0);
126
127 avg_ns =
128 (inst->ri_start_time[(n - 1) % RINST_START_TIMES] -
129 inst->ri_start_time[n % RINST_START_TIMES]) /
130 (RINST_START_TIMES - 1);
131
132 return (avg_ns < RINST_FAILURE_RATE_NS);
133 }
134
135 /*
136 * int method_is_transient()
137 * Determine if the method for the given instance is transient,
138 * from a contract perspective. Return 1 if it is, and 0 if it isn't.
139 */
140 static int
141 method_is_transient(restarter_inst_t *inst, int type)
142 {
143 if (instance_is_transient_style(inst) || type != METHOD_START)
144 return (1);
145 else
146 return (0);
147 }
148
149 /*
150 * void method_store_contract()
151 * Store the newly created contract id into local structures and
152 * the repository. If the repository connection is broken it is rebound.
153 */
154 static void
155 method_store_contract(restarter_inst_t *inst, int type, ctid_t *cid)
156 {
157 int r;
158 boolean_t primary;
159
160 if (errno = contract_latest(cid))
161 uu_die("%s: Couldn't get new contract's id", inst->ri_i.i_fmri);
162
163 primary = !method_is_transient(inst, type);
164
165 if (!primary) {
166 if (inst->ri_i.i_transient_ctid != 0) {
167 log_framework(LOG_INFO,
168 "%s: transient ctid expected to be 0 but "
169 "was set to %ld\n", inst->ri_i.i_fmri,
170 inst->ri_i.i_transient_ctid);
171 }
172
173 inst->ri_i.i_transient_ctid = *cid;
174 } else {
175 if (inst->ri_i.i_primary_ctid != 0) {
176 /*
177 * There was an old contract that we transferred.
178 * Remove it.
179 */
180 method_remove_contract(inst, B_TRUE, B_FALSE);
181 }
182
183 if (inst->ri_i.i_primary_ctid != 0) {
184 log_framework(LOG_INFO,
185 "%s: primary ctid expected to be 0 but "
186 "was set to %ld\n", inst->ri_i.i_fmri,
187 inst->ri_i.i_primary_ctid);
188 }
189
190 inst->ri_i.i_primary_ctid = *cid;
191 inst->ri_i.i_primary_ctid_stopped = 0;
192
193 log_framework(LOG_DEBUG, "Storing primary contract %ld for "
194 "%s.\n", *cid, inst->ri_i.i_fmri);
195
196 contract_hash_store(*cid, inst->ri_id);
197 }
198
199 again:
200 if (inst->ri_mi_deleted)
201 return;
202
203 r = restarter_store_contract(inst->ri_m_inst, *cid, primary ?
204 RESTARTER_CONTRACT_PRIMARY : RESTARTER_CONTRACT_TRANSIENT);
205 switch (r) {
206 case 0:
207 break;
208
209 case ECANCELED:
210 inst->ri_mi_deleted = B_TRUE;
211 break;
212
213 case ECONNABORTED:
214 libscf_handle_rebind(scf_instance_handle(inst->ri_m_inst));
215 /* FALLTHROUGH */
216
217 case EBADF:
218 libscf_reget_instance(inst);
219 goto again;
220
221 case ENOMEM:
222 case EPERM:
223 case EACCES:
224 case EROFS:
225 uu_die("%s: Couldn't store contract id %ld",
226 inst->ri_i.i_fmri, *cid);
227 /* NOTREACHED */
228
229 case EINVAL:
230 default:
231 bad_error("restarter_store_contract", r);
232 }
233 }
234
235 /*
236 * void method_remove_contract()
237 * Remove any non-permanent contracts from internal structures and
238 * the repository, then abandon them.
239 * Returns
240 * 0 - success
241 * ECANCELED - inst was deleted from the repository
242 *
243 * If the repository connection was broken, it is rebound.
244 */
245 void
246 method_remove_contract(restarter_inst_t *inst, boolean_t primary,
247 boolean_t abandon)
248 {
249 ctid_t * const ctidp = primary ? &inst->ri_i.i_primary_ctid :
250 &inst->ri_i.i_transient_ctid;
251
252 int r;
253
254 assert(*ctidp != 0);
255
256 log_framework(LOG_DEBUG, "Removing %s contract %lu for %s.\n",
257 primary ? "primary" : "transient", *ctidp, inst->ri_i.i_fmri);
258
259 if (abandon)
260 contract_abandon(*ctidp);
261
262 again:
263 if (inst->ri_mi_deleted) {
264 r = ECANCELED;
265 goto out;
266 }
267
268 r = restarter_remove_contract(inst->ri_m_inst, *ctidp, primary ?
269 RESTARTER_CONTRACT_PRIMARY : RESTARTER_CONTRACT_TRANSIENT);
270 switch (r) {
271 case 0:
272 break;
273
274 case ECANCELED:
275 inst->ri_mi_deleted = B_TRUE;
276 break;
277
278 case ECONNABORTED:
279 libscf_handle_rebind(scf_instance_handle(inst->ri_m_inst));
280 /* FALLTHROUGH */
281
282 case EBADF:
283 libscf_reget_instance(inst);
284 goto again;
285
286 case ENOMEM:
287 case EPERM:
288 case EACCES:
289 case EROFS:
290 log_error(LOG_INFO, "%s: Couldn't remove contract id %ld: "
291 "%s.\n", inst->ri_i.i_fmri, *ctidp, strerror(r));
292 break;
293
294 case EINVAL:
295 default:
296 bad_error("restarter_remove_contract", r);
297 }
298
299 out:
300 if (primary)
301 contract_hash_remove(*ctidp);
302
303 *ctidp = 0;
304 }
305
306 static const char *method_names[] = { "start", "stop", "refresh" };
307
308 /*
309 * int method_ready_contract(restarter_inst_t *, int, method_restart_t, int)
310 *
311 * Activate a contract template for the type method of inst. type,
312 * restart_on, and cte_mask dictate the critical events term of the contract.
313 * Returns
314 * 0 - success
315 * ECANCELED - inst has been deleted from the repository
316 */
317 static int
318 method_ready_contract(restarter_inst_t *inst, int type,
319 method_restart_t restart_on, uint_t cte_mask)
320 {
321 int tmpl, err, istrans, iswait, ret;
322 uint_t cevents, fevents;
323
324 /*
325 * Correctly supporting wait-style services is tricky without
326 * rearchitecting startd to cope with multiple event sources
327 * simultaneously trying to stop an instance. Until a better
328 * solution is implemented, we avoid this problem for
329 * wait-style services by making contract events fatal and
330 * letting the wait code alone handle stopping the service.
331 */
332 iswait = instance_is_wait_style(inst);
333 istrans = method_is_transient(inst, type);
334
335 tmpl = open64(CTFS_ROOT "/process/template", O_RDWR);
336 if (tmpl == -1)
337 uu_die("Could not create contract template");
338
339 /*
340 * We assume non-login processes are unlikely to create
341 * multiple process groups, and set CT_PR_PGRPONLY for all
342 * wait-style services' contracts.
343 */
344 err = ct_pr_tmpl_set_param(tmpl, CT_PR_INHERIT | CT_PR_REGENT |
345 (iswait ? CT_PR_PGRPONLY : 0));
346 assert(err == 0);
347
348 if (istrans) {
349 cevents = 0;
350 fevents = 0;
351 } else {
352 assert(restart_on >= 0);
353 assert(restart_on <= METHOD_RESTART_ANY_FAULT);
354 cevents = method_events[restart_on] & ~cte_mask;
355 fevents = iswait ?
356 (method_events[restart_on] & ~cte_mask & CT_PR_ALLFATAL) :
357 0;
358 }
359
360 err = ct_tmpl_set_critical(tmpl, cevents);
361 assert(err == 0);
362
363 err = ct_tmpl_set_informative(tmpl, 0);
364 assert(err == 0);
365 err = ct_pr_tmpl_set_fatal(tmpl, fevents);
366 assert(err == 0);
367
368 err = ct_tmpl_set_cookie(tmpl, istrans ? METHOD_OTHER_COOKIE :
369 METHOD_START_COOKIE);
370 assert(err == 0);
371
372 if (type == METHOD_START && inst->ri_i.i_primary_ctid != 0) {
373 ret = ct_pr_tmpl_set_transfer(tmpl, inst->ri_i.i_primary_ctid);
374 switch (ret) {
375 case 0:
376 break;
377
378 case ENOTEMPTY:
379 /* No contracts for you! */
380 method_remove_contract(inst, B_TRUE, B_TRUE);
381 if (inst->ri_mi_deleted) {
382 ret = ECANCELED;
383 goto out;
384 }
385 break;
386
387 case EINVAL:
388 case ESRCH:
389 case EACCES:
390 default:
391 bad_error("ct_pr_tmpl_set_transfer", ret);
392 }
393 }
394
395 err = ct_pr_tmpl_set_svc_fmri(tmpl, inst->ri_i.i_fmri);
396 assert(err == 0);
397 err = ct_pr_tmpl_set_svc_aux(tmpl, method_names[type]);
398 assert(err == 0);
399
400 err = ct_tmpl_activate(tmpl);
401 assert(err == 0);
402
403 ret = 0;
404
405 out:
406 err = close(tmpl);
407 assert(err == 0);
408
409 return (ret);
410 }
411
412 static void
413 exec_method(const restarter_inst_t *inst, int type, const char *method,
414 struct method_context *mcp, uint8_t need_session)
415 {
416 char *cmd;
417 const char *errf;
418 char **nenv;
419 int rsmc_errno = 0;
420
421 cmd = uu_msprintf("exec %s", method);
422
423 if (inst->ri_utmpx_prefix[0] != '\0' && inst->ri_utmpx_prefix != NULL)
424 (void) utmpx_mark_init(getpid(), inst->ri_utmpx_prefix);
425
426 setlog(inst->ri_logstem);
427 log_instance(inst, B_FALSE, "Executing %s method (\"%s\").",
428 method_names[type], method);
429
430 if (need_session)
431 (void) setpgrp();
432
433 /* Set credentials. */
434 rsmc_errno = restarter_set_method_context(mcp, &errf);
435 if (rsmc_errno != 0) {
436 (void) fputs("svc.startd could not set context for method: ",
437 stderr);
438
439 if (rsmc_errno == -1) {
440 if (strcmp(errf, "core_set_process_path") == 0) {
441 (void) fputs("Could not set corefile path.\n",
442 stderr);
443 } else if (strcmp(errf, "setproject") == 0) {
444 (void) fprintf(stderr, "%s: a resource control "
445 "assignment failed\n", errf);
446 } else if (strcmp(errf, "pool_set_binding") == 0) {
447 (void) fprintf(stderr, "%s: a system error "
448 "occurred\n", errf);
449 } else {
450 #ifndef NDEBUG
451 uu_warn("%s:%d: Bad function name \"%s\" for "
452 "error %d from "
453 "restarter_set_method_context().\n",
454 __FILE__, __LINE__, errf, rsmc_errno);
455 #endif
456 abort();
457 }
458
459 exit(1);
460 }
461
462 if (errf != NULL && strcmp(errf, "pool_set_binding") == 0) {
463 switch (rsmc_errno) {
464 case ENOENT:
465 (void) fprintf(stderr, "%s: the pool could not "
466 "be found\n", errf);
467 break;
468
469 case EBADF:
470 (void) fprintf(stderr, "%s: the configuration "
471 "is invalid\n", errf);
472 break;
473
474 case EINVAL:
475 (void) fprintf(stderr, "%s: pool name \"%s\" "
476 "is invalid\n", errf, mcp->resource_pool);
477 break;
478
479 default:
480 #ifndef NDEBUG
481 uu_warn("%s:%d: Bad error %d for function %s "
482 "in restarter_set_method_context().\n",
483 __FILE__, __LINE__, rsmc_errno, errf);
484 #endif
485 abort();
486 }
487
488 exit(SMF_EXIT_ERR_CONFIG);
489 }
490
491 if (errf != NULL) {
492 errno = rsmc_errno;
493 perror(errf);
494
495 switch (rsmc_errno) {
496 case EINVAL:
497 case EPERM:
498 case ENOENT:
499 case ENAMETOOLONG:
500 case ERANGE:
501 case ESRCH:
502 exit(SMF_EXIT_ERR_CONFIG);
503 /* NOTREACHED */
504
505 default:
506 exit(1);
507 }
508 }
509
510 switch (rsmc_errno) {
511 case ENOMEM:
512 (void) fputs("Out of memory.\n", stderr);
513 exit(1);
514 /* NOTREACHED */
515
516 case ENOENT:
517 (void) fputs("Missing passwd entry for user.\n",
518 stderr);
519 exit(SMF_EXIT_ERR_CONFIG);
520 /* NOTREACHED */
521
522 default:
523 #ifndef NDEBUG
524 uu_warn("%s:%d: Bad miscellaneous error %d from "
525 "restarter_set_method_context().\n", __FILE__,
526 __LINE__, rsmc_errno);
527 #endif
528 abort();
529 }
530 }
531
532 nenv = set_smf_env(mcp->env, mcp->env_sz, NULL, inst,
533 method_names[type]);
534
535 log_preexec();
536
537 (void) execle(SBIN_SH, SBIN_SH, "-c", cmd, NULL, nenv);
538
539 exit(10);
540 }
541
542 static void
543 write_status(restarter_inst_t *inst, const char *mname, int stat)
544 {
545 int r;
546
547 again:
548 if (inst->ri_mi_deleted)
549 return;
550
551 r = libscf_write_method_status(inst->ri_m_inst, mname, stat);
552 switch (r) {
553 case 0:
554 break;
555
556 case ECONNABORTED:
557 libscf_reget_instance(inst);
558 goto again;
559
560 case ECANCELED:
561 inst->ri_mi_deleted = 1;
562 break;
563
564 case EPERM:
565 case EACCES:
566 case EROFS:
567 log_framework(LOG_INFO, "Could not write exit status "
568 "for %s method of %s: %s.\n", mname,
569 inst->ri_i.i_fmri, strerror(r));
570 break;
571
572 case ENAMETOOLONG:
573 default:
574 bad_error("libscf_write_method_status", r);
575 }
576 }
577
578 /*
579 * int method_run()
580 * Execute the type method of instp. If it requires a fork(), wait for it
581 * to return and return its exit code in *exit_code. Otherwise set
582 * *exit_code to 0 if the method succeeds & -1 if it fails. If the
583 * repository connection is broken, it is rebound, but inst may not be
584 * reset.
585 * Returns
586 * 0 - success
587 * EINVAL - A correct method or method context couldn't be retrieved.
588 * EIO - Contract kill failed.
589 * EFAULT - Method couldn't be executed successfully.
590 * ELOOP - Retry threshold exceeded.
591 * ECANCELED - inst was deleted from the repository before method was run
592 * ERANGE - Timeout retry threshold exceeded.
593 * EAGAIN - Failed due to external cause, retry.
594 */
595 int
596 method_run(restarter_inst_t **instp, int type, int *exit_code)
597 {
598 char *method;
599 int ret_status;
600 pid_t pid;
601 method_restart_t restart_on;
602 uint_t cte_mask;
603 uint8_t need_session;
604 scf_handle_t *h;
605 scf_snapshot_t *snap;
606 const char *mname;
607 const char *errstr;
608 struct method_context *mcp;
609 int result = 0, timeout_fired = 0;
610 int sig, r;
611 boolean_t transient;
612 uint64_t timeout;
613 uint8_t timeout_retry;
614 ctid_t ctid;
615 int ctfd = -1;
616 restarter_inst_t *inst = *instp;
617 int id = inst->ri_id;
618 int forkerr;
619
620 assert(PTHREAD_MUTEX_HELD(&inst->ri_lock));
621 assert(instance_in_transition(inst));
622
623 if (inst->ri_mi_deleted)
624 return (ECANCELED);
625
626 *exit_code = 0;
627
628 assert(0 <= type && type <= 2);
629 mname = method_names[type];
630
631 if (type == METHOD_START)
632 inst->ri_pre_online_hook();
633
634 h = scf_instance_handle(inst->ri_m_inst);
635
636 snap = scf_snapshot_create(h);
637 if (snap == NULL ||
638 scf_instance_get_snapshot(inst->ri_m_inst, "running", snap) != 0) {
639 log_framework(LOG_DEBUG,
640 "Could not get running snapshot for %s. "
641 "Using editing version to run method %s.\n",
642 inst->ri_i.i_fmri, mname);
643 scf_snapshot_destroy(snap);
644 snap = NULL;
645 }
646
647 /*
648 * After this point, we may be logging to the instance log.
649 * Make sure we've noted where that log is as a property of
650 * the instance.
651 */
652 r = libscf_note_method_log(inst->ri_m_inst, st->st_log_prefix,
653 inst->ri_logstem);
654 if (r != 0) {
655 log_framework(LOG_WARNING,
656 "%s: couldn't note log location: %s\n",
657 inst->ri_i.i_fmri, strerror(r));
658 }
659
660 if ((method = libscf_get_method(h, type, inst, snap, &restart_on,
661 &cte_mask, &need_session, &timeout, &timeout_retry)) == NULL) {
662 if (errno == LIBSCF_PGROUP_ABSENT) {
663 log_framework(LOG_DEBUG,
664 "%s: instance has no method property group '%s'.\n",
665 inst->ri_i.i_fmri, mname);
666 if (type == METHOD_REFRESH)
667 log_instance(inst, B_TRUE, "No '%s' method "
668 "defined. Treating as :true.", mname);
669 else
670 log_instance(inst, B_TRUE, "Method property "
671 "group '%s' is not present.", mname);
672 scf_snapshot_destroy(snap);
673 return (0);
674 } else if (errno == LIBSCF_PROPERTY_ABSENT) {
675 log_framework(LOG_DEBUG,
676 "%s: instance has no '%s/exec' method property.\n",
677 inst->ri_i.i_fmri, mname);
678 log_instance(inst, B_TRUE, "Method property '%s/exec "
679 "is not present.", mname);
680 scf_snapshot_destroy(snap);
681 return (0);
682 } else {
683 log_error(LOG_WARNING,
684 "%s: instance libscf_get_method failed\n",
685 inst->ri_i.i_fmri);
686 scf_snapshot_destroy(snap);
687 return (EINVAL);
688 }
689 }
690
691 /* open service contract if stopping a non-transient service */
692 if (type == METHOD_STOP && (!instance_is_transient_style(inst))) {
693 if (inst->ri_i.i_primary_ctid == 0) {
694 /* service is not running, nothing to stop */
695 log_framework(LOG_DEBUG, "%s: instance has no primary "
696 "contract, no service to stop.\n",
697 inst->ri_i.i_fmri);
698 scf_snapshot_destroy(snap);
699 return (0);
700 }
701 if ((ctfd = contract_open(inst->ri_i.i_primary_ctid, "process",
702 "events", O_RDONLY)) < 0) {
703 result = EFAULT;
704 log_instance(inst, B_TRUE, "Could not open service "
705 "contract %ld. Stop method not run.",
706 inst->ri_i.i_primary_ctid);
707 goto out;
708 }
709 }
710
711 if (restarter_is_null_method(method)) {
712 log_framework(LOG_DEBUG, "%s: null method succeeds\n",
713 inst->ri_i.i_fmri);
714
715 log_instance(inst, B_TRUE, "Executing %s method (null).",
716 mname);
717
718 if (type == METHOD_START)
719 write_status(inst, mname, 0);
720 goto out;
721 }
722
723 sig = restarter_is_kill_method(method);
724 if (sig >= 0) {
725
726 if (inst->ri_i.i_primary_ctid == 0) {
727 log_error(LOG_ERR, "%s: :kill with no contract\n",
728 inst->ri_i.i_fmri);
729 log_instance(inst, B_TRUE, "Invalid use of \":kill\" "
730 "as stop method for transient service.");
731 result = EINVAL;
732 goto out;
733 }
734
735 log_framework(LOG_DEBUG,
736 "%s: :killing contract with signal %d\n",
737 inst->ri_i.i_fmri, sig);
738
739 log_instance(inst, B_TRUE, "Executing %s method (:kill).",
740 mname);
741
742 if (contract_kill(inst->ri_i.i_primary_ctid, sig,
743 inst->ri_i.i_fmri) != 0) {
744 result = EIO;
745 goto out;
746 } else
747 goto assured_kill;
748 }
749
750 log_framework(LOG_DEBUG, "%s: forking to run method %s\n",
751 inst->ri_i.i_fmri, method);
752
753 errstr = restarter_get_method_context(RESTARTER_METHOD_CONTEXT_VERSION,
754 inst->ri_m_inst, snap, mname, method, &mcp);
755
756 if (errstr != NULL) {
757 log_error(LOG_WARNING, "%s: %s\n", inst->ri_i.i_fmri, errstr);
758 result = EINVAL;
759 goto out;
760 }
761
762 r = method_ready_contract(inst, type, restart_on, cte_mask);
763 if (r != 0) {
764 assert(r == ECANCELED);
765 assert(inst->ri_mi_deleted);
766 restarter_free_method_context(mcp);
767 result = ECANCELED;
768 goto out;
769 }
770
771 /*
772 * Validate safety of method contexts, to save children work.
773 */
774 if (!restarter_rm_libs_loadable())
775 log_framework(LOG_DEBUG, "%s: method contexts limited "
776 "to root-accessible libraries\n", inst->ri_i.i_fmri);
777
778 /*
779 * If the service is restarting too quickly, send it to
780 * maintenance.
781 */
782 if (type == METHOD_START) {
783 method_record_start(inst);
784 if (method_rate_critical(inst)) {
785 log_instance(inst, B_TRUE, "Restarting too quickly, "
786 "changing state to maintenance.");
787 result = ELOOP;
788 restarter_free_method_context(mcp);
789 goto out;
790 }
791 }
792
793 atomic_add_16(&storing_contract, 1);
794 pid = startd_fork1(&forkerr);
795 if (pid == 0)
796 exec_method(inst, type, method, mcp, need_session);
797
798 if (pid == -1) {
799 atomic_add_16(&storing_contract, -1);
800 if (forkerr == EAGAIN)
801 result = EAGAIN;
802 else
803 result = EFAULT;
804
805 log_error(LOG_WARNING,
806 "%s: Couldn't fork to execute method %s: %s\n",
807 inst->ri_i.i_fmri, method, strerror(forkerr));
808
809 restarter_free_method_context(mcp);
810 goto out;
811 }
812
813
814 /*
815 * Get the contract id, decide whether it is primary or transient, and
816 * stash it in inst & the repository.
817 */
818 method_store_contract(inst, type, &ctid);
819 atomic_add_16(&storing_contract, -1);
820
821 restarter_free_method_context(mcp);
822
823 /*
824 * Similarly for the start method PID.
825 */
826 if (type == METHOD_START && !inst->ri_mi_deleted)
827 (void) libscf_write_start_pid(inst->ri_m_inst, pid);
828
829 if (instance_is_wait_style(inst) && type == METHOD_START) {
830 /* Wait style instances don't get timeouts on start methods. */
831 if (wait_register(pid, inst->ri_i.i_fmri, 1, 0)) {
832 log_error(LOG_WARNING,
833 "%s: couldn't register %ld for wait\n",
834 inst->ri_i.i_fmri, pid);
835 result = EFAULT;
836 goto contract_out;
837 }
838 write_status(inst, mname, 0);
839
840 } else {
841 int r, err;
842 time_t start_time;
843 time_t end_time;
844
845 /*
846 * Because on upgrade/live-upgrade we may have no chance
847 * to override faulty timeout values on the way to
848 * manifest import, all services on the path to manifest
849 * import are treated the same as INFINITE timeout services.
850 */
851
852 start_time = time(NULL);
853 if (timeout != METHOD_TIMEOUT_INFINITE && !is_timeout_ovr(inst))
854 timeout_insert(inst, ctid, timeout);
855 else
856 timeout = METHOD_TIMEOUT_INFINITE;
857
858 /* Unlock the instance while waiting for the method. */
859 MUTEX_UNLOCK(&inst->ri_lock);
860
861 do {
862 r = waitpid(pid, &ret_status, NULL);
863 } while (r == -1 && errno == EINTR);
864 if (r == -1)
865 err = errno;
866
867 /* Re-grab the lock. */
868 inst = inst_lookup_by_id(id);
869
870 /*
871 * inst can't be removed, as the removal thread waits
872 * for completion of this one.
873 */
874 assert(inst != NULL);
875 *instp = inst;
876
877 if (inst->ri_timeout != NULL && inst->ri_timeout->te_fired)
878 timeout_fired = 1;
879
880 timeout_remove(inst, ctid);
881
882 log_framework(LOG_DEBUG,
883 "%s method for %s exited with status %d.\n", mname,
884 inst->ri_i.i_fmri, WEXITSTATUS(ret_status));
885
886 if (r == -1) {
887 log_error(LOG_WARNING,
888 "Couldn't waitpid() for %s method of %s (%s).\n",
889 mname, inst->ri_i.i_fmri, strerror(err));
890 result = EFAULT;
891 goto contract_out;
892 }
893
894 if (type == METHOD_START)
895 write_status(inst, mname, ret_status);
896
897 /* return ERANGE if this service doesn't retry on timeout */
898 if (timeout_fired == 1 && timeout_retry == 0) {
899 result = ERANGE;
900 goto contract_out;
901 }
902
903 if (!WIFEXITED(ret_status)) {
904 /*
905 * If method didn't exit itself (it was killed by an
906 * external entity, etc.), consider the entire
907 * method_run as failed.
908 */
909 if (WIFSIGNALED(ret_status)) {
910 char buf[SIG2STR_MAX];
911 (void) sig2str(WTERMSIG(ret_status), buf);
912
913 log_error(LOG_WARNING, "%s: Method \"%s\" "
914 "failed due to signal %s.\n",
915 inst->ri_i.i_fmri, method, buf);
916 log_instance(inst, B_TRUE, "Method \"%s\" "
917 "failed due to signal %s.", mname, buf);
918 } else {
919 log_error(LOG_WARNING, "%s: Method \"%s\" "
920 "failed with exit status %d.\n",
921 inst->ri_i.i_fmri, method,
922 WEXITSTATUS(ret_status));
923 log_instance(inst, B_TRUE, "Method \"%s\" "
924 "failed with exit status %d.", mname,
925 WEXITSTATUS(ret_status));
926 }
927 result = EAGAIN;
928 goto contract_out;
929 }
930
931 *exit_code = WEXITSTATUS(ret_status);
932 if (*exit_code != 0) {
933 log_error(LOG_WARNING,
934 "%s: Method \"%s\" failed with exit status %d.\n",
935 inst->ri_i.i_fmri, method, WEXITSTATUS(ret_status));
936 }
937
938 log_instance(inst, B_TRUE, "Method \"%s\" exited with status "
939 "%d.", mname, *exit_code);
940
941 if (*exit_code != 0)
942 goto contract_out;
943
944 end_time = time(NULL);
945
946 /* Give service contract remaining seconds to empty */
947 if (timeout != METHOD_TIMEOUT_INFINITE)
948 timeout -= (end_time - start_time);
949 }
950
951 assured_kill:
952 /*
953 * For stop methods, assure that the service contract has emptied
954 * before returning.
955 */
956 if (type == METHOD_STOP && (!instance_is_transient_style(inst)) &&
957 !(contract_is_empty(inst->ri_i.i_primary_ctid))) {
958
959 if (timeout != METHOD_TIMEOUT_INFINITE)
960 timeout_insert(inst, inst->ri_i.i_primary_ctid,
961 timeout);
962
963 for (;;) {
964 (void) poll(NULL, 0, 100);
965 if (contract_is_empty(inst->ri_i.i_primary_ctid))
966 break;
967 }
968
969 if (timeout != METHOD_TIMEOUT_INFINITE)
970 if (inst->ri_timeout->te_fired)
971 result = EFAULT;
972
973 timeout_remove(inst, inst->ri_i.i_primary_ctid);
974 }
975
976 contract_out:
977 /* Abandon contracts for transient methods & methods that fail. */
978 transient = method_is_transient(inst, type);
979 if ((transient || *exit_code != 0 || result != 0) &&
980 (restarter_is_kill_method(method) < 0))
981 method_remove_contract(inst, !transient, B_TRUE);
982
983 out:
984 if (ctfd >= 0)
985 (void) close(ctfd);
986 scf_snapshot_destroy(snap);
987 free(method);
988 return (result);
989 }
990
991 /*
992 * The method thread executes a service method to effect a state transition.
993 * The next_state of info->sf_id should be non-_NONE on entrance, and it will
994 * be _NONE on exit (state will either be what next_state was (on success), or
995 * it will be _MAINT (on error)).
996 *
997 * There are six classes of methods to consider: start & other (stop, refresh)
998 * for each of "normal" services, wait services, and transient services. For
999 * each, the method must be fetched from the repository & executed. fork()ed
1000 * methods must be waited on, except for the start method of wait services
1001 * (which must be registered with the wait subsystem via wait_register()). If
1002 * the method succeeded (returned 0), then for start methods its contract
1003 * should be recorded as the primary contract for the service. For other
1004 * methods, it should be abandoned. If the method fails, then depending on
1005 * the failure, either the method should be reexecuted or the service should
1006 * be put into maintenance. Either way the contract should be abandoned.
1007 */
1008 void *
1009 method_thread(void *arg)
1010 {
1011 fork_info_t *info = arg;
1012 restarter_inst_t *inst;
1013 scf_handle_t *local_handle;
1014 scf_instance_t *s_inst = NULL;
1015 int r, exit_code;
1016 boolean_t retryable;
1017 const char *aux;
1018
1019 assert(0 <= info->sf_method_type && info->sf_method_type <= 2);
1020
1021 /* Get (and lock) the restarter_inst_t. */
1022 inst = inst_lookup_by_id(info->sf_id);
1023
1024 assert(inst->ri_method_thread != 0);
1025 assert(instance_in_transition(inst) == 1);
1026
1027 /*
1028 * We cannot leave this function with inst in transition, because
1029 * protocol.c withholds messages for inst otherwise.
1030 */
1031
1032 log_framework(LOG_DEBUG, "method_thread() running %s method for %s.\n",
1033 method_names[info->sf_method_type], inst->ri_i.i_fmri);
1034
1035 local_handle = libscf_handle_create_bound_loop();
1036
1037 rebind_retry:
1038 /* get scf_instance_t */
1039 switch (r = libscf_fmri_get_instance(local_handle, inst->ri_i.i_fmri,
1040 &s_inst)) {
1041 case 0:
1042 break;
1043
1044 case ECONNABORTED:
1045 libscf_handle_rebind(local_handle);
1046 goto rebind_retry;
1047
1048 case ENOENT:
1049 /*
1050 * It's not there, but we need to call this so protocol.c
1051 * doesn't think it's in transition anymore.
1052 */
1053 (void) restarter_instance_update_states(local_handle, inst,
1054 inst->ri_i.i_state, RESTARTER_STATE_NONE, RERR_NONE,
1055 NULL);
1056 goto out;
1057
1058 case EINVAL:
1059 case ENOTSUP:
1060 default:
1061 bad_error("libscf_fmri_get_instance", r);
1062 }
1063
1064 inst->ri_m_inst = s_inst;
1065 inst->ri_mi_deleted = B_FALSE;
1066
1067 retry:
1068 if (info->sf_method_type == METHOD_START)
1069 log_transition(inst, START_REQUESTED);
1070
1071 r = method_run(&inst, info->sf_method_type, &exit_code);
1072
1073 if (r == 0 && exit_code == 0) {
1074 /* Success! */
1075 assert(inst->ri_i.i_next_state != RESTARTER_STATE_NONE);
1076
1077 /*
1078 * When a stop method succeeds, remove the primary contract of
1079 * the service, unless we're going to offline, in which case
1080 * retain the contract so we can transfer inherited contracts to
1081 * the replacement service.
1082 */
1083
1084 if (info->sf_method_type == METHOD_STOP &&
1085 inst->ri_i.i_primary_ctid != 0) {
1086 if (inst->ri_i.i_next_state == RESTARTER_STATE_OFFLINE)
1087 inst->ri_i.i_primary_ctid_stopped = 1;
1088 else
1089 method_remove_contract(inst, B_TRUE, B_TRUE);
1090 }
1091 /*
1092 * We don't care whether the handle was rebound because this is
1093 * the last thing we do with it.
1094 */
1095 (void) restarter_instance_update_states(local_handle, inst,
1096 inst->ri_i.i_next_state, RESTARTER_STATE_NONE,
1097 info->sf_event_type, NULL);
1098
1099 (void) update_fault_count(inst, FAULT_COUNT_RESET);
1100
1101 goto out;
1102 }
1103
1104 /* Failure. Retry or go to maintenance. */
1105
1106 if (r != 0 && r != EAGAIN) {
1107 retryable = B_FALSE;
1108 } else {
1109 switch (exit_code) {
1110 case SMF_EXIT_ERR_CONFIG:
1111 case SMF_EXIT_ERR_NOSMF:
1112 case SMF_EXIT_ERR_PERM:
1113 case SMF_EXIT_ERR_FATAL:
1114 retryable = B_FALSE;
1115 break;
1116
1117 default:
1118 retryable = B_TRUE;
1119 }
1120 }
1121
1122 if (retryable && update_fault_count(inst, FAULT_COUNT_INCR) != 1)
1123 goto retry;
1124
1125 /* maintenance */
1126 if (r == ELOOP)
1127 log_transition(inst, START_FAILED_REPEATEDLY);
1128 else if (r == ERANGE)
1129 log_transition(inst, START_FAILED_TIMEOUT_FATAL);
1130 else if (exit_code == SMF_EXIT_ERR_CONFIG)
1131 log_transition(inst, START_FAILED_CONFIGURATION);
1132 else if (exit_code == SMF_EXIT_ERR_FATAL)
1133 log_transition(inst, START_FAILED_FATAL);
1134 else
1135 log_transition(inst, START_FAILED_OTHER);
1136
1137 if (r == ELOOP)
1138 aux = "restarting_too_quickly";
1139 else if (retryable)
1140 aux = "fault_threshold_reached";
1141 else
1142 aux = "method_failed";
1143
1144 (void) restarter_instance_update_states(local_handle, inst,
1145 RESTARTER_STATE_MAINT, RESTARTER_STATE_NONE, RERR_FAULT,
1146 (char *)aux);
1147
1148 if (!method_is_transient(inst, info->sf_method_type) &&
1149 inst->ri_i.i_primary_ctid != 0)
1150 method_remove_contract(inst, B_TRUE, B_TRUE);
1151
1152 out:
1153 inst->ri_method_thread = 0;
1154
1155 /*
1156 * Unlock the mutex after broadcasting to avoid a race condition
1157 * with restarter_delete_inst() when the 'inst' structure is freed.
1158 */
1159 (void) pthread_cond_broadcast(&inst->ri_method_cv);
1160 MUTEX_UNLOCK(&inst->ri_lock);
1161
1162 scf_instance_destroy(s_inst);
1163 scf_handle_destroy(local_handle);
1164 startd_free(info, sizeof (fork_info_t));
1165 return (NULL);
1166 }