/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*

 * method.c - method execution functions

 *

 * This file contains the routines needed to run a method:  a fork(2)-exec(2)

 * invocation monitored using either the contract filesystem or waitpid(2).

 * (Plain fork1(2) support is provided in fork.c.)

 *

 * Contract Transfer

 *   When we restart a service, we want to transfer any contracts that the old

 *   service's contract inherited.  This means that (a) we must not abandon the

 *   old contract when the service dies and (b) we must write the id of the old

 *   contract into the terms of the new contract.  There should be limits to

 *   (a), though, since we don't want to keep the contract around forever.  To

 *   this end we'll say that services in the offline state may have a contract

 *   to be transfered and services in the disabled or maintenance states cannot.

 *   This means that when a service transitions from online (or degraded) to

 *   offline, the contract should be preserved, and when the service transitions

 *   from offline to online (i.e., the start method), we'll transfer inherited

 *   contracts.

 */

#include <sys/contract/process.h>

#include <sys/ctfs.h>

#include <sys/stat.h>

#include <sys/time.h>

#include <sys/types.h>

#include <sys/uio.h>

#include <sys/wait.h>

#include <alloca.h>

#include <assert.h>

#include <errno.h>

#include <fcntl.h>

#include <libcontract.h>

#include <libcontract_priv.h>

#include <libgen.h>

#include <librestart.h>

#include <libscf.h>

#include <limits.h>

#include <port.h>

#include <sac.h>

#include <signal.h>

#include <stdlib.h>

#include <string.h>

#include <strings.h>

#include <unistd.h>

#include <atomic.h>

#include <poll.h>

#include "startd.h"

#define	SBIN_SH		"/sbin/sh"

/*

 * Used to tell if contracts are in the process of being

 * stored into the svc.startd internal hash table.

 */

volatile uint16_t	storing_contract = 0;

/*

 * Mapping from restart_on method-type to contract events.  Must correspond to

 * enum method_restart_t.

 */

static uint_t method_events[] = {

	/* METHOD_RESTART_ALL */

	CT_PR_EV_HWERR | CT_PR_EV_SIGNAL | CT_PR_EV_CORE | CT_PR_EV_EMPTY,

	/* METHOD_RESTART_EXTERNAL_FAULT */

	CT_PR_EV_HWERR | CT_PR_EV_SIGNAL,

	/* METHOD_RESTART_ANY_FAULT */

	CT_PR_EV_HWERR | CT_PR_EV_SIGNAL | CT_PR_EV_CORE

};

/*

 * method_record_start(restarter_inst_t *)

 *   Record a service start for rate limiting.  Place the current time

 *   in the circular array of instance starts.

 */

static void

method_record_start(restarter_inst_t *inst)

{

	int index = inst->ri_start_index++ % RINST_START_TIMES;

	inst->ri_start_time[index] = gethrtime();

}

/*

 * method_rate_critical(restarter_inst_t *)

 *    Return true if the average start interval is less than the permitted

 *    interval.  Implicit success if insufficient measurements for an

 *    average exist.

 */

static int

method_rate_critical(restarter_inst_t *inst)

{

	uint_t n = inst->ri_start_index;

	hrtime_t avg_ns = 0;

	if (inst->ri_start_index < RINST_START_TIMES)

		return (0);

	avg_ns =

	    (inst->ri_start_time[(n - 1) % RINST_START_TIMES] -

	    inst->ri_start_time[n % RINST_START_TIMES]) /

	    (RINST_START_TIMES - 1);

	return (avg_ns < RINST_FAILURE_RATE_NS);

}

/*

 * int method_is_transient()

 *   Determine if the method for the given instance is transient,

 *   from a contract perspective. Return 1 if it is, and 0 if it isn't.

 */

static int

method_is_transient(restarter_inst_t *inst, int type)

{

	if (instance_is_transient_style(inst) || type != METHOD_START)

		return (1);

	else

		return (0);

}

/*

 * void method_store_contract()

 *   Store the newly created contract id into local structures and

 *   the repository.  If the repository connection is broken it is rebound.

 */

static void

method_store_contract(restarter_inst_t *inst, int type, ctid_t *cid)

{

	int r;

	boolean_t primary;

	if (errno = contract_latest(cid))

		uu_die("%s: Couldn't get new contract's id", inst->ri_i.i_fmri);

	primary = !method_is_transient(inst, type);

	if (!primary) {

		if (inst->ri_i.i_transient_ctid != 0) {

			log_framework(LOG_INFO,

			    "%s: transient ctid expected to be 0 but "

			    "was set to %ld\n", inst->ri_i.i_fmri,

			    inst->ri_i.i_transient_ctid);

		}

		inst->ri_i.i_transient_ctid = *cid;

	} else {

		if (inst->ri_i.i_primary_ctid != 0) {

			/*

			 * There was an old contract that we transferred.

			 * Remove it.

			 */

			method_remove_contract(inst, B_TRUE, B_FALSE);

		}

		if (inst->ri_i.i_primary_ctid != 0) {

			log_framework(LOG_INFO,

			    "%s: primary ctid expected to be 0 but "

			    "was set to %ld\n", inst->ri_i.i_fmri,

			    inst->ri_i.i_primary_ctid);

		}

		inst->ri_i.i_primary_ctid = *cid;

		inst->ri_i.i_primary_ctid_stopped = 0;

		log_framework(LOG_DEBUG, "Storing primary contract %ld for "

		    "%s.\n", *cid, inst->ri_i.i_fmri);

		contract_hash_store(*cid, inst->ri_id);

	}

again:

	if (inst->ri_mi_deleted)

		return;

	r = restarter_store_contract(inst->ri_m_inst, *cid, primary ?

	    RESTARTER_CONTRACT_PRIMARY : RESTARTER_CONTRACT_TRANSIENT);

	switch (r) {

	case 0:

		break;

	case ECANCELED:

		inst->ri_mi_deleted = B_TRUE;

		break;

	case ECONNABORTED:

		libscf_handle_rebind(scf_instance_handle(inst->ri_m_inst));

		/* FALLTHROUGH */

	case EBADF:

		libscf_reget_instance(inst);

		goto again;

	case ENOMEM:

	case EPERM:

	case EACCES:

	case EROFS:

		uu_die("%s: Couldn't store contract id %ld",

		    inst->ri_i.i_fmri, *cid);

		/* NOTREACHED */

	case EINVAL:

	default:

		bad_error("restarter_store_contract", r);

	}

}

/*

 * void method_remove_contract()

 *   Remove any non-permanent contracts from internal structures and

 *   the repository, then abandon them.

 *   Returns

 *     0 - success

 *     ECANCELED - inst was deleted from the repository

 *

 *   If the repository connection was broken, it is rebound.

 */

void

method_remove_contract(restarter_inst_t *inst, boolean_t primary,

    boolean_t abandon)

{

	ctid_t * const ctidp = primary ? &inst->ri_i.i_primary_ctid :

	    &inst->ri_i.i_transient_ctid;

	int r;

	assert(*ctidp != 0);

	log_framework(LOG_DEBUG, "Removing %s contract %lu for %s.\n",

	    primary ? "primary" : "transient", *ctidp, inst->ri_i.i_fmri);

	if (abandon)

		contract_abandon(*ctidp);

again:

	if (inst->ri_mi_deleted) {

		r = ECANCELED;

		goto out;

	}

	r = restarter_remove_contract(inst->ri_m_inst, *ctidp, primary ?

	    RESTARTER_CONTRACT_PRIMARY : RESTARTER_CONTRACT_TRANSIENT);

	switch (r) {

	case 0:

		break;

	case ECANCELED:

		inst->ri_mi_deleted = B_TRUE;

		break;

	case ECONNABORTED:

		libscf_handle_rebind(scf_instance_handle(inst->ri_m_inst));

		/* FALLTHROUGH */

	case EBADF:

		libscf_reget_instance(inst);

		goto again;

	case ENOMEM:

	case EPERM:

	case EACCES:

	case EROFS:

		log_error(LOG_INFO, "%s: Couldn't remove contract id %ld: "

		    "%s.\n", inst->ri_i.i_fmri, *ctidp, strerror(r));

		break;

	case EINVAL:

	default:

		bad_error("restarter_remove_contract", r);

	}

out:

	if (primary)

		contract_hash_remove(*ctidp);

	*ctidp = 0;

}

/*

 * int method_ready_contract(restarter_inst_t *, int, method_restart_t, int)

 *

 *   Activate a contract template for the type method of inst.  type,

 *   restart_on, and cte_mask dictate the critical events term of the contract.

 *   Returns

 *     0 - success

 *     ECANCELED - inst has been deleted from the repository

 */

static int

method_ready_contract(restarter_inst_t *inst, int type,

    method_restart_t restart_on, uint_t cte_mask)

{

	int tmpl, err, istrans, iswait, ret;

	uint_t cevents, fevents;

	/*

	 * Correctly supporting wait-style services is tricky without

	 * rearchitecting startd to cope with multiple event sources

	 * simultaneously trying to stop an instance.  Until a better

	 * solution is implemented, we avoid this problem for

	 * wait-style services by making contract events fatal and

	 * letting the wait code alone handle stopping the service.

	 */

	iswait = instance_is_wait_style(inst);

	istrans = method_is_transient(inst, type);

	tmpl = open64(CTFS_ROOT "/process/template", O_RDWR);

	if (tmpl == -1)

		uu_die("Could not create contract template");

	/*

	 * We assume non-login processes are unlikely to create

	 * multiple process groups, and set CT_PR_PGRPONLY for all

	 * wait-style services' contracts.

	 */

	err = ct_pr_tmpl_set_param(tmpl, CT_PR_INHERIT | CT_PR_REGENT |

	    (iswait ? CT_PR_PGRPONLY : 0));

	assert(err == 0);

	if (istrans) {

		cevents = 0;

		fevents = 0;

	} else {

		assert(restart_on >= 0);

		assert(restart_on <= METHOD_RESTART_ANY_FAULT);

		cevents = method_events[restart_on] & ~cte_mask;

		fevents = iswait ?

		    (method_events[restart_on] & ~cte_mask & CT_PR_ALLFATAL) :

		    0;

	}

	err = ct_tmpl_set_critical(tmpl, cevents);

	assert(err == 0);

	err = ct_tmpl_set_informative(tmpl, 0);

	assert(err == 0);

	err = ct_pr_tmpl_set_fatal(tmpl, fevents);

	assert(err == 0);

	err = ct_tmpl_set_cookie(tmpl, istrans ?  METHOD_OTHER_COOKIE :

	    METHOD_START_COOKIE);

	assert(err == 0);

	if (type == METHOD_START && inst->ri_i.i_primary_ctid != 0) {

		ret = ct_pr_tmpl_set_transfer(tmpl, inst->ri_i.i_primary_ctid);

		switch (ret) {

		case 0:

			break;

		case ENOTEMPTY:

			/* No contracts for you! */

			method_remove_contract(inst, B_TRUE, B_TRUE);

			if (inst->ri_mi_deleted) {

				ret = ECANCELED;

				goto out;

			}

			break;

		case EINVAL:

		case ESRCH:

		case EACCES:

		default:

			bad_error("ct_pr_tmpl_set_transfer", ret);

		}

	}

	err = ct_tmpl_activate(tmpl);

	assert(err == 0);

	ret = 0;

out:

	err = close(tmpl);

	assert(err == 0);

	return (ret);

}

static const char *method_names[] = { "start", "stop", "refresh" };

static void

exec_method(const restarter_inst_t *inst, int type, const char *method,

    struct method_context *mcp, uint8_t need_session)

{

	char *cmd;

	const char *errf;

	char **nenv;

	int rsmc_errno = 0;

	cmd = uu_msprintf("exec %s", method);

	if (inst->ri_utmpx_prefix[0] != '\0' && inst->ri_utmpx_prefix != NULL)

		(void) utmpx_mark_init(getpid(), inst->ri_utmpx_prefix);

	setlog(inst->ri_logstem);

	log_instance(inst, B_FALSE, "Executing %s method (\"%s\").",

	    method_names[type], method);

	if (need_session)

		(void) setpgrp();

	/* Set credentials. */

	rsmc_errno = restarter_set_method_context(mcp, &errf);

	if (rsmc_errno != 0) {

		(void) fputs("svc.startd could not set context for method: ",

		    stderr);

		if (rsmc_errno == -1) {

			if (strcmp(errf, "core_set_process_path") == 0) {

				(void) fputs("Could not set corefile path.\n",

				    stderr);

			} else if (strcmp(errf, "setproject") == 0) {

				(void) fprintf(stderr, "%s: a resource control "

				    "assignment failed\n", errf);

			} else if (strcmp(errf, "pool_set_binding") == 0) {

				(void) fprintf(stderr, "%s: a system error "

				    "occurred\n", errf);

			} else {

#ifndef NDEBUG

				uu_warn("%s:%d: Bad function name \"%s\" for "

				    "error %d from "

				    "restarter_set_method_context().\n",

				    __FILE__, __LINE__, errf, rsmc_errno);

#endif

				abort();

			}

			exit(1);

		}

		if (errf != NULL && strcmp(errf, "pool_set_binding") == 0) {

			switch (rsmc_errno) {

			case ENOENT:

				(void) fprintf(stderr, "%s: the pool could not "

				    "be found\n", errf);

				break;

			case EBADF:

				(void) fprintf(stderr, "%s: the configuration "

				    "is invalid\n", errf);

				break;

			case EINVAL:

				(void) fprintf(stderr, "%s: pool name \"%s\" "

				    "is invalid\n", errf, mcp->resource_pool);

				break;

			default:

#ifndef NDEBUG

				uu_warn("%s:%d: Bad error %d for function %s "

				    "in restarter_set_method_context().\n",

				    __FILE__, __LINE__, rsmc_errno, errf);

#endif

				abort();

			}

			exit(SMF_EXIT_ERR_CONFIG);

		}

		if (errf != NULL) {

			errno = rsmc_errno;

			perror(errf);

			switch (rsmc_errno) {

			case EINVAL:

			case EPERM:

			case ENOENT:

			case ENAMETOOLONG:

			case ERANGE:

			case ESRCH:

				exit(SMF_EXIT_ERR_CONFIG);

				/* NOTREACHED */

			default:

				exit(1);

			}

		}

		switch (rsmc_errno) {

		case ENOMEM:

			(void) fputs("Out of memory.\n", stderr);

			exit(1);

			/* NOTREACHED */

		case ENOENT:

			(void) fputs("Missing passwd entry for user.\n",

			    stderr);

			exit(SMF_EXIT_ERR_CONFIG);

			/* NOTREACHED */

		default:

#ifndef NDEBUG

			uu_warn("%s:%d: Bad miscellaneous error %d from "

			    "restarter_set_method_context().\n", __FILE__,

			    __LINE__, rsmc_errno);

#endif

			abort();

		}