graph

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
  24  */
  25 
  26 /*
  27  * graph.c - master restarter graph engine
  28  *
  29  *   The graph engine keeps a dependency graph of all service instances on the
  30  *   system, as recorded in the repository.  It decides when services should
  31  *   be brought up or down based on service states and dependencies and sends
  32  *   commands to restarters to effect any changes.  It also executes
  33  *   administrator commands sent by svcadm via the repository.
  34  *
  35  *   The graph is stored in uu_list_t *dgraph and its vertices are
  36  *   graph_vertex_t's, each of which has a name and an integer id unique to
  37  *   its name (see dict.c).  A vertex's type attribute designates the type
  38  *   of object it represents: GVT_INST for service instances, GVT_SVC for
  39  *   service objects (since service instances may depend on another service,
  40  *   rather than service instance), GVT_FILE for files (which services may
  41  *   depend on), and GVT_GROUP for dependencies on multiple objects.  GVT_GROUP
  42  *   vertices are necessary because dependency lists may have particular
  43  *   grouping types (require any, require all, optional, or exclude) and
  44  *   event-propagation characteristics.
  45  *
  46  *   The initial graph is built by libscf_populate_graph() invoking
  47  *   dgraph_add_instance() for each instance in the repository.  The function
  48  *   adds a GVT_SVC vertex for the service if one does not already exist, adds
  49  *   a GVT_INST vertex named by the FMRI of the instance, and sets up the edges.
  50  *   The resulting web of vertices & edges associated with an instance's vertex
  51  *   includes
  52  *
  53  *     - an edge from the GVT_SVC vertex for the instance's service
  54  *
  55  *     - an edge to the GVT_INST vertex of the instance's resarter, if its
  56  *       restarter is not svc.startd
  57  *
  58  *     - edges from other GVT_INST vertices if the instance is a restarter
  59  *
  60  *     - for each dependency property group in the instance's "running"
  61  *       snapshot, an edge to a GVT_GROUP vertex named by the FMRI of the
  62  *       instance and the name of the property group
  63  *
  64  *     - for each value of the "entities" property in each dependency property
  65  *       group, an edge from the corresponding GVT_GROUP vertex to a
  66  *       GVT_INST, GVT_SVC, or GVT_FILE vertex
  67  *
  68  *     - edges from GVT_GROUP vertices for each dependent instance
  69  *
  70  *   After the edges are set up the vertex's GV_CONFIGURED flag is set.  If
  71  *   there are problems, or if a service is mentioned in a dependency but does
  72  *   not exist in the repository, the GV_CONFIGURED flag will be clear.
  73  *
  74  *   The graph and all of its vertices are protected by the dgraph_lock mutex.
  75  *   See restarter.c for more information.
  76  *
  77  *   The properties of an instance fall into two classes: immediate and
  78  *   snapshotted.  Immediate properties should have an immediate effect when
  79  *   changed.  Snapshotted properties should be read from a snapshot, so they
  80  *   only change when the snapshot changes.  The immediate properties used by
  81  *   the graph engine are general/enabled, general/restarter, and the properties
  82  *   in the restarter_actions property group.  Since they are immediate, they
  83  *   are not read out of a snapshot.  The snapshotted properties used by the
  84  *   graph engine are those in the property groups with type "dependency" and
  85  *   are read out of the "running" snapshot.  The "running" snapshot is created
  86  *   by the the graph engine as soon as possible, and it is updated, along with
  87  *   in-core copies of the data (dependency information for the graph engine) on
  88  *   receipt of the refresh command from svcadm.  In addition, the graph engine
  89  *   updates the "start" snapshot from the "running" snapshot whenever a service
  90  *   comes online.
  91  *
  92  *   When a DISABLE event is requested by the administrator, svc.startd shutdown
  93  *   the dependents first before shutting down the requested service.
  94  *   In graph_enable_by_vertex, we create a subtree that contains the dependent
  95  *   vertices by marking those vertices with the GV_TOOFFLINE flag. And we mark
  96  *   the vertex to disable with the GV_TODISABLE flag. Once the tree is created,
  97  *   we send the _ADMIN_DISABLE event to the leaves. The leaves will then
  98  *   transition from STATE_ONLINE/STATE_DEGRADED to STATE_OFFLINE/STATE_MAINT.
  99  *   In gt_enter_offline and gt_enter_maint if the vertex was in a subtree then
 100  *   we clear the GV_TOOFFLINE flag and walk the dependencies to offline the new
 101  *   exposed leaves. We do the same until we reach the last leaf (the one with
 102  *   the GV_TODISABLE flag). If the vertex to disable is also part of a larger
 103  *   subtree (eg. multiple DISABLE events on vertices in the same subtree) then
 104  *   once the first vertex is disabled (GV_TODISABLE flag is removed), we
 105  *   continue to propagate the offline event to the vertex's dependencies.
 106  *
 107  *
 108  * SMF state transition notifications
 109  *
 110  *   When an instance of a service managed by SMF changes state, svc.startd may
 111  *   publish a GPEC sysevent. All transitions to or from maintenance, a
 112  *   transition cause by a hardware error will generate an event.
 113  *   Other transitions will generate an event if there exist notification
 114  *   parameter for that transition. Notification parameters are stored in the
 115  *   SMF repository for the service/instance they refer to. System-wide
 116  *   notification parameters are stored in the global instance.
 117  *   svc.startd can be told to send events for all SMF state transitions despite
 118  *   of notification parameters by setting options/info_events_all to true in
 119  *   restarter:default
 120  *
 121  *   The set of transitions that generate events is cached in the
 122  *   dgraph_vertex_t gv_stn_tset for service/instance and in the global
 123  *   stn_global for the system-wide set. They are re-read when instances are
 124  *   refreshed.
 125  *
 126  *   The GPEC events published by svc.startd are consumed by fmd(1M). After
 127  *   processing these events, fmd(1M) publishes the processed events to
 128  *   notification agents. The notification agents read the notification
 129  *   parameters from the SMF repository through libscf(3LIB) interfaces and send
 130  *   the notification, or not, based on those parameters.
 131  *
 132  *   Subscription and publishing to the GPEC channels is done with the
 133  *   libfmevent(3LIB) wrappers fmev_[r]publish_*() and
 134  *   fmev_shdl_(un)subscribe().
 135  *
 136  */
 137 
 138 #include <sys/uadmin.h>
 139 #include <sys/wait.h>
 140 
 141 #include <assert.h>
 142 #include <errno.h>
 143 #include <fcntl.h>
 144 #include <fm/libfmevent.h>
 145 #include <libscf.h>
 146 #include <libscf_priv.h>
 147 #include <librestart.h>
 148 #include <libuutil.h>
 149 #include <locale.h>
 150 #include <poll.h>
 151 #include <pthread.h>
 152 #include <signal.h>
 153 #include <stddef.h>
 154 #include <stdio.h>
 155 #include <stdlib.h>
 156 #include <string.h>
 157 #include <strings.h>
 158 #include <sys/statvfs.h>
 159 #include <sys/uadmin.h>
 160 #include <zone.h>
 161 #if defined(__i386)
 162 #include <libgrubmgmt.h>
 163 #endif  /* __i386 */
 164 
 165 #include "startd.h"
 166 #include "protocol.h"
 167 
 168 
 169 #define MILESTONE_NONE  ((graph_vertex_t *)1)
 170 
 171 #define CONSOLE_LOGIN_FMRI      "svc:/system/console-login:default"
 172 #define FS_MINIMAL_FMRI         "svc:/system/filesystem/minimal:default"
 173 
 174 #define VERTEX_REMOVED  0       /* vertex has been freed  */
 175 #define VERTEX_INUSE    1       /* vertex is still in use */
 176 
 177 #define IS_ENABLED(v) ((v)->gv_flags & (GV_ENABLED | GV_ENBLD_NOOVR))
 178 
 179 /*
 180  * stn_global holds the tset for the system wide notification parameters.
 181  * It is updated on refresh of svc:/system/svc/global:default
 182  *
 183  * There are two assumptions that relax the need for a mutex:
 184  *     1. 32-bit value assignments are atomic
 185  *     2. Its value is consumed only in one point at
 186  *     dgraph_state_transition_notify(). There are no test and set races.
 187  *
 188  *     If either assumption is broken, we'll need a mutex to synchronize
 189  *     access to stn_global
 190  */
 191 int32_t stn_global;
 192 /*
 193  * info_events_all holds a flag to override notification parameters and send
 194  * Information events for all state transitions.
 195  * same about the need of a mutex here.
 196  */
 197 int info_events_all;
 198 
 199 /*
 200  * Services in these states are not considered 'down' by the
 201  * milestone/shutdown code.
 202  */
 203 #define up_state(state) ((state) == RESTARTER_STATE_ONLINE || \
 204         (state) == RESTARTER_STATE_DEGRADED || \
 205         (state) == RESTARTER_STATE_OFFLINE)
 206 
 207 #define is_depgrp_bypassed(v) ((v->gv_type == GVT_GROUP) && \
 208         ((v->gv_depgroup == DEPGRP_EXCLUDE_ALL) || \
 209         (v->gv_depgroup == DEPGRP_OPTIONAL_ALL) || \
 210         (v->gv_restart < RERR_RESTART)))
 211 
 212 static uu_list_pool_t *graph_edge_pool, *graph_vertex_pool;
 213 static uu_list_t *dgraph;
 214 static pthread_mutex_t dgraph_lock;
 215 
 216 /*
 217  * milestone indicates the current subgraph.  When NULL, it is the entire
 218  * graph.  When MILESTONE_NONE, it is the empty graph.  Otherwise, it is all
 219  * services on which the target vertex depends.
 220  */
 221 static graph_vertex_t *milestone = NULL;
 222 static boolean_t initial_milestone_set = B_FALSE;
 223 static pthread_cond_t initial_milestone_cv = PTHREAD_COND_INITIALIZER;
 224 
 225 /* protected by dgraph_lock */
 226 static boolean_t sulogin_thread_running = B_FALSE;
 227 static boolean_t sulogin_running = B_FALSE;
 228 static boolean_t console_login_ready = B_FALSE;
 229 
 230 /* Number of services to come down to complete milestone transition. */
 231 static uint_t non_subgraph_svcs;
 232 
 233 /*
 234  * These variables indicate what should be done when we reach the milestone
 235  * target milestone, i.e., when non_subgraph_svcs == 0.  They are acted upon in
 236  * dgraph_set_instance_state().
 237  */
 238 static int halting = -1;
 239 static boolean_t go_single_user_mode = B_FALSE;
 240 static boolean_t go_to_level1 = B_FALSE;
 241 
 242 /*
 243  * Tracks when we started halting.
 244  */
 245 static time_t halting_time = 0;
 246 
 247 /*
 248  * This tracks the legacy runlevel to ensure we signal init and manage
 249  * utmpx entries correctly.
 250  */
 251 static char current_runlevel = '\0';
 252 
 253 /* Number of single user threads currently running */
 254 static pthread_mutex_t single_user_thread_lock;
 255 static int single_user_thread_count = 0;
 256 
 257 /* Statistics for dependency cycle-checking */
 258 static u_longlong_t dep_inserts = 0;
 259 static u_longlong_t dep_cycle_ns = 0;
 260 static u_longlong_t dep_insert_ns = 0;
 261 
 262 
 263 static const char * const emsg_invalid_restarter =
 264         "Transitioning %s to maintenance, restarter FMRI %s is invalid "
 265         "(see 'svcs -xv' for details).\n";
 266 static const char * const console_login_fmri = CONSOLE_LOGIN_FMRI;
 267 static const char * const single_user_fmri = SCF_MILESTONE_SINGLE_USER;
 268 static const char * const multi_user_fmri = SCF_MILESTONE_MULTI_USER;
 269 static const char * const multi_user_svr_fmri = SCF_MILESTONE_MULTI_USER_SERVER;
 270 
 271 
 272 /*
 273  * These services define the system being "up".  If none of them can come
 274  * online, then we will run sulogin on the console.  Note that the install ones
 275  * are for the miniroot and when installing CDs after the first.  can_come_up()
 276  * does the decision making, and an sulogin_thread() runs sulogin, which can be
 277  * started by dgraph_set_instance_state() or single_user_thread().
 278  *
 279  * NOTE: can_come_up() relies on SCF_MILESTONE_SINGLE_USER being the first
 280  * entry, which is only used when booting_to_single_user (boot -s) is set.
 281  * This is because when doing a "boot -s", sulogin is started from specials.c
 282  * after milestone/single-user comes online, for backwards compatibility.
 283  * In this case, SCF_MILESTONE_SINGLE_USER needs to be part of up_svcs
 284  * to ensure sulogin will be spawned if milestone/single-user cannot be reached.
 285  */
 286 static const char * const up_svcs[] = {
 287         SCF_MILESTONE_SINGLE_USER,
 288         CONSOLE_LOGIN_FMRI,
 289         "svc:/system/install-setup:default",
 290         "svc:/system/install:default",
 291         NULL
 292 };
 293 
 294 /* This array must have an element for each non-NULL element of up_svcs[]. */
 295 static graph_vertex_t *up_svcs_p[] = { NULL, NULL, NULL, NULL };
 296 
 297 /* These are for seed repository magic.  See can_come_up(). */
 298 static const char * const manifest_import = SCF_INSTANCE_MI;
 299 static graph_vertex_t *manifest_import_p = NULL;
 300 
 301 
 302 static char target_milestone_as_runlevel(void);
 303 static void graph_runlevel_changed(char rl, int online);
 304 static int dgraph_set_milestone(const char *, scf_handle_t *, boolean_t);
 305 static boolean_t should_be_in_subgraph(graph_vertex_t *v);
 306 static int mark_subtree(graph_edge_t *, void *);
 307 static boolean_t insubtree_dependents_down(graph_vertex_t *);
 308 
 309 /*
 310  * graph_vertex_compare()
 311  *      This function can compare either int *id or * graph_vertex_t *gv
 312  *      values, as the vertex id is always the first element of a
 313  *      graph_vertex structure.
 314  */
 315 /* ARGSUSED */
 316 static int
 317 graph_vertex_compare(const void *lc_arg, const void *rc_arg, void *private)
 318 {
 319         int lc_id = ((const graph_vertex_t *)lc_arg)->gv_id;
 320         int rc_id = *(int *)rc_arg;
 321 
 322         if (lc_id > rc_id)
 323                 return (1);
 324         if (lc_id < rc_id)
 325                 return (-1);
 326         return (0);
 327 }
 328 
 329 void
 330 graph_init()
 331 {
 332         graph_edge_pool = startd_list_pool_create("graph_edges",
 333             sizeof (graph_edge_t), offsetof(graph_edge_t, ge_link), NULL,
 334             UU_LIST_POOL_DEBUG);
 335         assert(graph_edge_pool != NULL);
 336 
 337         graph_vertex_pool = startd_list_pool_create("graph_vertices",
 338             sizeof (graph_vertex_t), offsetof(graph_vertex_t, gv_link),
 339             graph_vertex_compare, UU_LIST_POOL_DEBUG);
 340         assert(graph_vertex_pool != NULL);
 341 
 342         (void) pthread_mutex_init(&dgraph_lock, &mutex_attrs);
 343         (void) pthread_mutex_init(&single_user_thread_lock, &mutex_attrs);
 344         dgraph = startd_list_create(graph_vertex_pool, NULL, UU_LIST_SORTED);
 345         assert(dgraph != NULL);
 346 
 347         if (!st->st_initial)
 348                 current_runlevel = utmpx_get_runlevel();
 349 
 350         log_framework(LOG_DEBUG, "Initialized graph\n");
 351 }
 352 
 353 static graph_vertex_t *
 354 vertex_get_by_name(const char *name)
 355 {
 356         int id;
 357 
 358         assert(MUTEX_HELD(&dgraph_lock));
 359 
 360         id = dict_lookup_byname(name);
 361         if (id == -1)
 362                 return (NULL);
 363 
 364         return (uu_list_find(dgraph, &id, NULL, NULL));
 365 }
 366 
 367 static graph_vertex_t *
 368 vertex_get_by_id(int id)
 369 {
 370         assert(MUTEX_HELD(&dgraph_lock));
 371 
 372         if (id == -1)
 373                 return (NULL);
 374 
 375         return (uu_list_find(dgraph, &id, NULL, NULL));
 376 }
 377 
 378 /*
 379  * Creates a new vertex with the given name, adds it to the graph, and returns
 380  * a pointer to it.  The graph lock must be held by this thread on entry.
 381  */
 382 static graph_vertex_t *
 383 graph_add_vertex(const char *name)
 384 {
 385         int id;
 386         graph_vertex_t *v;
 387         void *p;
 388         uu_list_index_t idx;
 389 
 390         assert(MUTEX_HELD(&dgraph_lock));
 391 
 392         id = dict_insert(name);
 393 
 394         v = startd_zalloc(sizeof (*v));
 395 
 396         v->gv_id = id;
 397 
 398         v->gv_name = startd_alloc(strlen(name) + 1);
 399         (void) strcpy(v->gv_name, name);
 400 
 401         v->gv_dependencies = startd_list_create(graph_edge_pool, v, 0);
 402         v->gv_dependents = startd_list_create(graph_edge_pool, v, 0);
 403 
 404         p = uu_list_find(dgraph, &id, NULL, &idx);
 405         assert(p == NULL);
 406 
 407         uu_list_node_init(v, &v->gv_link, graph_vertex_pool);
 408         uu_list_insert(dgraph, v, idx);
 409 
 410         return (v);
 411 }
 412 
 413 /*
 414  * Removes v from the graph and frees it.  The graph should be locked by this
 415  * thread, and v should have no edges associated with it.
 416  */
 417 static void
 418 graph_remove_vertex(graph_vertex_t *v)
 419 {
 420         assert(MUTEX_HELD(&dgraph_lock));
 421 
 422         assert(uu_list_numnodes(v->gv_dependencies) == 0);
 423         assert(uu_list_numnodes(v->gv_dependents) == 0);
 424         assert(v->gv_refs == 0);
 425 
 426         startd_free(v->gv_name, strlen(v->gv_name) + 1);
 427         uu_list_destroy(v->gv_dependencies);
 428         uu_list_destroy(v->gv_dependents);
 429         uu_list_remove(dgraph, v);
 430 
 431         startd_free(v, sizeof (graph_vertex_t));
 432 }
 433 
 434 static void
 435 graph_add_edge(graph_vertex_t *fv, graph_vertex_t *tv)
 436 {
 437         graph_edge_t *e, *re;
 438         int r;
 439 
 440         assert(MUTEX_HELD(&dgraph_lock));
 441 
 442         e = startd_alloc(sizeof (graph_edge_t));
 443         re = startd_alloc(sizeof (graph_edge_t));
 444 
 445         e->ge_parent = fv;
 446         e->ge_vertex = tv;
 447 
 448         re->ge_parent = tv;
 449         re->ge_vertex = fv;
 450 
 451         uu_list_node_init(e, &e->ge_link, graph_edge_pool);
 452         r = uu_list_insert_before(fv->gv_dependencies, NULL, e);
 453         assert(r == 0);
 454 
 455         uu_list_node_init(re, &re->ge_link, graph_edge_pool);
 456         r = uu_list_insert_before(tv->gv_dependents, NULL, re);
 457         assert(r == 0);
 458 }
 459 
 460 static void
 461 graph_remove_edge(graph_vertex_t *v, graph_vertex_t *dv)
 462 {
 463         graph_edge_t *e;
 464 
 465         for (e = uu_list_first(v->gv_dependencies);
 466             e != NULL;
 467             e = uu_list_next(v->gv_dependencies, e)) {
 468                 if (e->ge_vertex == dv) {
 469                         uu_list_remove(v->gv_dependencies, e);
 470                         startd_free(e, sizeof (graph_edge_t));
 471                         break;
 472                 }
 473         }
 474 
 475         for (e = uu_list_first(dv->gv_dependents);
 476             e != NULL;
 477             e = uu_list_next(dv->gv_dependents, e)) {
 478                 if (e->ge_vertex == v) {
 479                         uu_list_remove(dv->gv_dependents, e);
 480                         startd_free(e, sizeof (graph_edge_t));
 481                         break;
 482                 }
 483         }
 484 }
 485 
 486 static void
 487 remove_inst_vertex(graph_vertex_t *v)
 488 {
 489         graph_edge_t *e;
 490         graph_vertex_t *sv;
 491         int i;
 492 
 493         assert(MUTEX_HELD(&dgraph_lock));
 494         assert(uu_list_numnodes(v->gv_dependents) == 1);
 495         assert(uu_list_numnodes(v->gv_dependencies) == 0);
 496         assert(v->gv_refs == 0);
 497         assert((v->gv_flags & GV_CONFIGURED) == 0);
 498 
 499         e = uu_list_first(v->gv_dependents);
 500         sv = e->ge_vertex;
 501         graph_remove_edge(sv, v);
 502 
 503         for (i = 0; up_svcs[i] != NULL; ++i) {
 504                 if (up_svcs_p[i] == v)
 505                         up_svcs_p[i] = NULL;
 506         }
 507 
 508         if (manifest_import_p == v)
 509                 manifest_import_p = NULL;
 510 
 511         graph_remove_vertex(v);
 512 
 513         if (uu_list_numnodes(sv->gv_dependencies) == 0 &&
 514             uu_list_numnodes(sv->gv_dependents) == 0 &&
 515             sv->gv_refs == 0)
 516                 graph_remove_vertex(sv);
 517 }
 518 
 519 static void
 520 graph_walk_dependents(graph_vertex_t *v, void (*func)(graph_vertex_t *, void *),
 521     void *arg)
 522 {
 523         graph_edge_t *e;
 524 
 525         for (e = uu_list_first(v->gv_dependents);
 526             e != NULL;
 527             e = uu_list_next(v->gv_dependents, e))
 528                 func(e->ge_vertex, arg);
 529 }
 530 
 531 static void
 532 graph_walk_dependencies(graph_vertex_t *v, void (*func)(graph_vertex_t *,
 533         void *), void *arg)
 534 {
 535         graph_edge_t *e;
 536 
 537         assert(MUTEX_HELD(&dgraph_lock));
 538 
 539         for (e = uu_list_first(v->gv_dependencies);
 540             e != NULL;
 541             e = uu_list_next(v->gv_dependencies, e)) {
 542 
 543                 func(e->ge_vertex, arg);
 544         }
 545 }
 546 
 547 /*
 548  * Generic graph walking function.
 549  *
 550  * Given a vertex, this function will walk either dependencies
 551  * (WALK_DEPENDENCIES) or dependents (WALK_DEPENDENTS) of a vertex recursively
 552  * for the entire graph.  It will avoid cycles and never visit the same vertex
 553  * twice.
 554  *
 555  * We avoid traversing exclusion dependencies, because they are allowed to
 556  * create cycles in the graph.  When propagating satisfiability, there is no
 557  * need to walk exclusion dependencies because exclude_all_satisfied() doesn't
 558  * test for satisfiability.
 559  *
 560  * The walker takes two callbacks.  The first is called before examining the
 561  * dependents of each vertex.  The second is called on each vertex after
 562  * examining its dependents.  This allows is_path_to() to construct a path only
 563  * after the target vertex has been found.
 564  */
 565 typedef enum {
 566         WALK_DEPENDENTS,
 567         WALK_DEPENDENCIES
 568 } graph_walk_dir_t;
 569 
 570 typedef int (*graph_walk_cb_t)(graph_vertex_t *, void *);
 571 
 572 typedef struct graph_walk_info {
 573         graph_walk_dir_t        gi_dir;
 574         uchar_t                 *gi_visited;    /* vertex bitmap */
 575         int                     (*gi_pre)(graph_vertex_t *, void *);
 576         void                    (*gi_post)(graph_vertex_t *, void *);
 577         void                    *gi_arg;        /* callback arg */
 578         int                     gi_ret;         /* return value */
 579 } graph_walk_info_t;
 580 
 581 static int
 582 graph_walk_recurse(graph_edge_t *e, graph_walk_info_t *gip)
 583 {
 584         uu_list_t *list;
 585         int r;
 586         graph_vertex_t *v = e->ge_vertex;
 587         int i;
 588         uint_t b;
 589 
 590         i = v->gv_id / 8;
 591         b = 1 << (v->gv_id % 8);
 592 
 593         /*
 594          * Check to see if we've visited this vertex already.
 595          */
 596         if (gip->gi_visited[i] & b)
 597                 return (UU_WALK_NEXT);
 598 
 599         gip->gi_visited[i] |= b;
 600 
 601         /*
 602          * Don't follow exclusions.
 603          */
 604         if (v->gv_type == GVT_GROUP && v->gv_depgroup == DEPGRP_EXCLUDE_ALL)
 605                 return (UU_WALK_NEXT);
 606 
 607         /*
 608          * Call pre-visit callback.  If this doesn't terminate the walk,
 609          * continue search.
 610          */
 611         if ((gip->gi_ret = gip->gi_pre(v, gip->gi_arg)) == UU_WALK_NEXT) {
 612                 /*
 613                  * Recurse using appropriate list.
 614                  */
 615                 if (gip->gi_dir == WALK_DEPENDENTS)
 616                         list = v->gv_dependents;
 617                 else
 618                         list = v->gv_dependencies;
 619 
 620                 r = uu_list_walk(list, (uu_walk_fn_t *)graph_walk_recurse,
 621                     gip, 0);
 622                 assert(r == 0);
 623         }
 624 
 625         /*
 626          * Callbacks must return either UU_WALK_NEXT or UU_WALK_DONE.
 627          */
 628         assert(gip->gi_ret == UU_WALK_NEXT || gip->gi_ret == UU_WALK_DONE);
 629 
 630         /*
 631          * If given a post-callback, call the function for every vertex.
 632          */
 633         if (gip->gi_post != NULL)
 634                 (void) gip->gi_post(v, gip->gi_arg);
 635 
 636         /*
 637          * Preserve the callback's return value.  If the callback returns
 638          * UU_WALK_DONE, then we propagate that to the caller in order to
 639          * terminate the walk.
 640          */
 641         return (gip->gi_ret);
 642 }
 643 
 644 static void
 645 graph_walk(graph_vertex_t *v, graph_walk_dir_t dir,
 646     int (*pre)(graph_vertex_t *, void *),
 647     void (*post)(graph_vertex_t *, void *), void *arg)
 648 {
 649         graph_walk_info_t gi;
 650         graph_edge_t fake;
 651         size_t sz = dictionary->dict_new_id / 8 + 1;
 652 
 653         gi.gi_visited = startd_zalloc(sz);
 654         gi.gi_pre = pre;
 655         gi.gi_post = post;
 656         gi.gi_arg = arg;
 657         gi.gi_dir = dir;
 658         gi.gi_ret = 0;
 659 
 660         /*
 661          * Fake up an edge for the first iteration
 662          */
 663         fake.ge_vertex = v;
 664         (void) graph_walk_recurse(&fake, &gi);
 665 
 666         startd_free(gi.gi_visited, sz);
 667 }
 668 
 669 typedef struct child_search {
 670         int     id;             /* id of vertex to look for */
 671         uint_t  depth;          /* recursion depth */
 672         /*
 673          * While the vertex is not found, path is NULL.  After the search, if
 674          * the vertex was found then path should point to a -1-terminated
 675          * array of vertex id's which constitute the path to the vertex.
 676          */
 677         int     *path;
 678 } child_search_t;
 679 
 680 static int
 681 child_pre(graph_vertex_t *v, void *arg)
 682 {
 683         child_search_t *cs = arg;
 684 
 685         cs->depth++;
 686 
 687         if (v->gv_id == cs->id) {
 688                 cs->path = startd_alloc((cs->depth + 1) * sizeof (int));
 689                 cs->path[cs->depth] = -1;
 690                 return (UU_WALK_DONE);
 691         }
 692 
 693         return (UU_WALK_NEXT);
 694 }
 695 
 696 static void
 697 child_post(graph_vertex_t *v, void *arg)
 698 {
 699         child_search_t *cs = arg;
 700 
 701         cs->depth--;
 702 
 703         if (cs->path != NULL)
 704                 cs->path[cs->depth] = v->gv_id;
 705 }
 706 
 707 /*
 708  * Look for a path from from to to.  If one exists, returns a pointer to
 709  * a NULL-terminated array of pointers to the vertices along the path.  If
 710  * there is no path, returns NULL.
 711  */
 712 static int *
 713 is_path_to(graph_vertex_t *from, graph_vertex_t *to)
 714 {
 715         child_search_t cs;
 716 
 717         cs.id = to->gv_id;
 718         cs.depth = 0;
 719         cs.path = NULL;
 720 
 721         graph_walk(from, WALK_DEPENDENCIES, child_pre, child_post, &cs);
 722 
 723         return (cs.path);
 724 }
 725 
 726 /*
 727  * Given an array of int's as returned by is_path_to, allocates a string of
 728  * their names joined by newlines.  Returns the size of the allocated buffer
 729  * in *sz and frees path.
 730  */
 731 static void
 732 path_to_str(int *path, char **cpp, size_t *sz)
 733 {
 734         int i;
 735         graph_vertex_t *v;
 736         size_t allocd, new_allocd;
 737         char *new, *name;
 738 
 739         assert(MUTEX_HELD(&dgraph_lock));
 740         assert(path[0] != -1);
 741 
 742         allocd = 1;
 743         *cpp = startd_alloc(1);
 744         (*cpp)[0] = '\0';
 745 
 746         for (i = 0; path[i] != -1; ++i) {
 747                 name = NULL;
 748 
 749                 v = vertex_get_by_id(path[i]);
 750 
 751                 if (v == NULL)
 752                         name = "<deleted>";
 753                 else if (v->gv_type == GVT_INST || v->gv_type == GVT_SVC)
 754                         name = v->gv_name;
 755 
 756                 if (name != NULL) {
 757                         new_allocd = allocd + strlen(name) + 1;
 758                         new = startd_alloc(new_allocd);
 759                         (void) strcpy(new, *cpp);
 760                         (void) strcat(new, name);
 761                         (void) strcat(new, "\n");
 762 
 763                         startd_free(*cpp, allocd);
 764 
 765                         *cpp = new;
 766                         allocd = new_allocd;
 767                 }
 768         }
 769 
 770         startd_free(path, sizeof (int) * (i + 1));
 771 
 772         *sz = allocd;
 773 }
 774 
 775 
 776 /*
 777  * This function along with run_sulogin() implements an exclusion relationship
 778  * between system/console-login and sulogin.  run_sulogin() will fail if
 779  * system/console-login is online, and the graph engine should call
 780  * graph_clogin_start() to bring system/console-login online, which defers the
 781  * start if sulogin is running.
 782  */
 783 static void
 784 graph_clogin_start(graph_vertex_t *v)
 785 {
 786         assert(MUTEX_HELD(&dgraph_lock));
 787 
 788         if (sulogin_running)
 789                 console_login_ready = B_TRUE;
 790         else
 791                 vertex_send_event(v, RESTARTER_EVENT_TYPE_START);
 792 }
 793 
 794 static void
 795 graph_su_start(graph_vertex_t *v)
 796 {
 797         /*
 798          * /etc/inittab used to have the initial /sbin/rcS as a 'sysinit'
 799          * entry with a runlevel of 'S', before jumping to the final
 800          * target runlevel (as set in initdefault).  We mimic that legacy
 801          * behavior here.
 802          */
 803         utmpx_set_runlevel('S', '0', B_FALSE);
 804         vertex_send_event(v, RESTARTER_EVENT_TYPE_START);
 805 }
 806 
 807 static void
 808 graph_post_su_online(void)
 809 {
 810         graph_runlevel_changed('S', 1);
 811 }
 812 
 813 static void
 814 graph_post_su_disable(void)
 815 {
 816         graph_runlevel_changed('S', 0);
 817 }
 818 
 819 static void
 820 graph_post_mu_online(void)
 821 {
 822         graph_runlevel_changed('2', 1);
 823 }
 824 
 825 static void
 826 graph_post_mu_disable(void)
 827 {
 828         graph_runlevel_changed('2', 0);
 829 }
 830 
 831 static void
 832 graph_post_mus_online(void)
 833 {
 834         graph_runlevel_changed('3', 1);
 835 }
 836 
 837 static void
 838 graph_post_mus_disable(void)
 839 {
 840         graph_runlevel_changed('3', 0);
 841 }
 842 
 843 static struct special_vertex_info {
 844         const char      *name;
 845         void            (*start_f)(graph_vertex_t *);
 846         void            (*post_online_f)(void);
 847         void            (*post_disable_f)(void);
 848 } special_vertices[] = {
 849         { CONSOLE_LOGIN_FMRI, graph_clogin_start, NULL, NULL },
 850         { SCF_MILESTONE_SINGLE_USER, graph_su_start,
 851             graph_post_su_online, graph_post_su_disable },
 852         { SCF_MILESTONE_MULTI_USER, NULL,
 853             graph_post_mu_online, graph_post_mu_disable },
 854         { SCF_MILESTONE_MULTI_USER_SERVER, NULL,
 855             graph_post_mus_online, graph_post_mus_disable },
 856         { NULL },
 857 };
 858 
 859 
 860 void
 861 vertex_send_event(graph_vertex_t *v, restarter_event_type_t e)
 862 {
 863         switch (e) {
 864         case RESTARTER_EVENT_TYPE_ADD_INSTANCE:
 865                 assert(v->gv_state == RESTARTER_STATE_UNINIT);
 866 
 867                 MUTEX_LOCK(&st->st_load_lock);
 868                 st->st_load_instances++;
 869                 MUTEX_UNLOCK(&st->st_load_lock);
 870                 break;
 871 
 872         case RESTARTER_EVENT_TYPE_ENABLE:
 873                 log_framework(LOG_DEBUG, "Enabling %s.\n", v->gv_name);
 874                 assert(v->gv_state == RESTARTER_STATE_UNINIT ||
 875                     v->gv_state == RESTARTER_STATE_DISABLED ||
 876                     v->gv_state == RESTARTER_STATE_MAINT);
 877                 break;
 878 
 879         case RESTARTER_EVENT_TYPE_DISABLE:
 880         case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
 881                 log_framework(LOG_DEBUG, "Disabling %s.\n", v->gv_name);
 882                 assert(v->gv_state != RESTARTER_STATE_DISABLED);
 883                 break;
 884 
 885         case RESTARTER_EVENT_TYPE_STOP_RESET:
 886         case RESTARTER_EVENT_TYPE_STOP:
 887                 log_framework(LOG_DEBUG, "Stopping %s.\n", v->gv_name);
 888                 assert(v->gv_state == RESTARTER_STATE_DEGRADED ||
 889                     v->gv_state == RESTARTER_STATE_ONLINE);
 890                 break;
 891 
 892         case RESTARTER_EVENT_TYPE_START:
 893                 log_framework(LOG_DEBUG, "Starting %s.\n", v->gv_name);
 894                 assert(v->gv_state == RESTARTER_STATE_OFFLINE);
 895                 break;
 896 
 897         case RESTARTER_EVENT_TYPE_REMOVE_INSTANCE:
 898         case RESTARTER_EVENT_TYPE_ADMIN_DEGRADED:
 899         case RESTARTER_EVENT_TYPE_ADMIN_REFRESH:
 900         case RESTARTER_EVENT_TYPE_ADMIN_RESTART:
 901         case RESTARTER_EVENT_TYPE_ADMIN_MAINT_OFF:
 902         case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
 903         case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON_IMMEDIATE:
 904         case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
 905         case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
 906                 break;
 907 
 908         default:
 909 #ifndef NDEBUG
 910                 uu_warn("%s:%d: Bad event %d.\n", __FILE__, __LINE__, e);
 911 #endif
 912                 abort();
 913         }
 914 
 915         restarter_protocol_send_event(v->gv_name, v->gv_restarter_channel, e,
 916             v->gv_reason);
 917 }
 918 
 919 static void
 920 graph_unset_restarter(graph_vertex_t *v)
 921 {
 922         assert(MUTEX_HELD(&dgraph_lock));
 923         assert(v->gv_flags & GV_CONFIGURED);
 924 
 925         vertex_send_event(v, RESTARTER_EVENT_TYPE_REMOVE_INSTANCE);
 926 
 927         if (v->gv_restarter_id != -1) {
 928                 graph_vertex_t *rv;
 929 
 930                 rv = vertex_get_by_id(v->gv_restarter_id);
 931                 graph_remove_edge(v, rv);
 932         }
 933 
 934         v->gv_restarter_id = -1;
 935         v->gv_restarter_channel = NULL;
 936 }
 937 
 938 /*
 939  * Return VERTEX_REMOVED when the vertex passed in argument is deleted from the
 940  * dgraph otherwise return VERTEX_INUSE.
 941  */
 942 static int
 943 free_if_unrefed(graph_vertex_t *v)
 944 {
 945         assert(MUTEX_HELD(&dgraph_lock));
 946 
 947         if (v->gv_refs > 0)
 948                 return (VERTEX_INUSE);
 949 
 950         if (v->gv_type == GVT_SVC &&
 951             uu_list_numnodes(v->gv_dependents) == 0 &&
 952             uu_list_numnodes(v->gv_dependencies) == 0) {
 953                 graph_remove_vertex(v);
 954                 return (VERTEX_REMOVED);
 955         } else if (v->gv_type == GVT_INST &&
 956             (v->gv_flags & GV_CONFIGURED) == 0 &&
 957             uu_list_numnodes(v->gv_dependents) == 1 &&
 958             uu_list_numnodes(v->gv_dependencies) == 0) {
 959                 remove_inst_vertex(v);
 960                 return (VERTEX_REMOVED);
 961         }
 962 
 963         return (VERTEX_INUSE);
 964 }
 965 
 966 static void
 967 delete_depgroup(graph_vertex_t *v)
 968 {
 969         graph_edge_t *e;
 970         graph_vertex_t *dv;
 971 
 972         assert(MUTEX_HELD(&dgraph_lock));
 973         assert(v->gv_type == GVT_GROUP);
 974         assert(uu_list_numnodes(v->gv_dependents) == 0);
 975 
 976         while ((e = uu_list_first(v->gv_dependencies)) != NULL) {
 977                 dv = e->ge_vertex;
 978 
 979                 graph_remove_edge(v, dv);
 980 
 981                 switch (dv->gv_type) {
 982                 case GVT_INST:          /* instance dependency */
 983                 case GVT_SVC:           /* service dependency */
 984                         (void) free_if_unrefed(dv);
 985                         break;
 986 
 987                 case GVT_FILE:          /* file dependency */
 988                         assert(uu_list_numnodes(dv->gv_dependencies) == 0);
 989                         if (uu_list_numnodes(dv->gv_dependents) == 0)
 990                                 graph_remove_vertex(dv);
 991                         break;
 992 
 993                 default:
 994 #ifndef NDEBUG
 995                         uu_warn("%s:%d: Unexpected node type %d", __FILE__,
 996                             __LINE__, dv->gv_type);
 997 #endif
 998                         abort();
 999                 }
1000         }
1001 
1002         graph_remove_vertex(v);
1003 }
1004 
1005 static int
1006 delete_instance_deps_cb(graph_edge_t *e, void **ptrs)
1007 {
1008         graph_vertex_t *v = ptrs[0];
1009         boolean_t delete_restarter_dep = (boolean_t)ptrs[1];
1010         graph_vertex_t *dv;
1011 
1012         dv = e->ge_vertex;
1013 
1014         /*
1015          * We have four possibilities here:
1016          *   - GVT_INST: restarter
1017          *   - GVT_GROUP - GVT_INST: instance dependency
1018          *   - GVT_GROUP - GVT_SVC - GV_INST: service dependency
1019          *   - GVT_GROUP - GVT_FILE: file dependency
1020          */
1021         switch (dv->gv_type) {
1022         case GVT_INST:  /* restarter */
1023                 assert(dv->gv_id == v->gv_restarter_id);
1024                 if (delete_restarter_dep)
1025                         graph_remove_edge(v, dv);
1026                 break;
1027 
1028         case GVT_GROUP: /* pg dependency */
1029                 graph_remove_edge(v, dv);
1030                 delete_depgroup(dv);
1031                 break;
1032 
1033         case GVT_FILE:
1034                 /* These are currently not direct dependencies */
1035 
1036         default:
1037 #ifndef NDEBUG
1038                 uu_warn("%s:%d: Bad vertex type %d.\n", __FILE__, __LINE__,
1039                     dv->gv_type);
1040 #endif
1041                 abort();
1042         }
1043 
1044         return (UU_WALK_NEXT);
1045 }
1046 
1047 static void
1048 delete_instance_dependencies(graph_vertex_t *v, boolean_t delete_restarter_dep)
1049 {
1050         void *ptrs[2];
1051         int r;
1052 
1053         assert(MUTEX_HELD(&dgraph_lock));
1054         assert(v->gv_type == GVT_INST);
1055 
1056         ptrs[0] = v;
1057         ptrs[1] = (void *)delete_restarter_dep;
1058 
1059         r = uu_list_walk(v->gv_dependencies,
1060             (uu_walk_fn_t *)delete_instance_deps_cb, &ptrs, UU_WALK_ROBUST);
1061         assert(r == 0);
1062 }
1063 
1064 /*
1065  * int graph_insert_vertex_unconfigured()
1066  *   Insert a vertex without sending any restarter events. If the vertex
1067  *   already exists or creation is successful, return a pointer to it in *vp.
1068  *
1069  *   If type is not GVT_GROUP, dt can remain unset.
1070  *
1071  *   Returns 0, EEXIST, or EINVAL if the arguments are invalid (i.e., fmri
1072  *   doesn't agree with type, or type doesn't agree with dt).
1073  */
1074 static int
1075 graph_insert_vertex_unconfigured(const char *fmri, gv_type_t type,
1076     depgroup_type_t dt, restarter_error_t rt, graph_vertex_t **vp)
1077 {
1078         int r;
1079         int i;
1080 
1081         assert(MUTEX_HELD(&dgraph_lock));
1082 
1083         switch (type) {
1084         case GVT_SVC:
1085         case GVT_INST:
1086                 if (strncmp(fmri, "svc:", sizeof ("svc:") - 1) != 0)
1087                         return (EINVAL);
1088                 break;
1089 
1090         case GVT_FILE:
1091                 if (strncmp(fmri, "file:", sizeof ("file:") - 1) != 0)
1092                         return (EINVAL);
1093                 break;
1094 
1095         case GVT_GROUP:
1096                 if (dt <= 0 || rt < 0)
1097                         return (EINVAL);
1098                 break;
1099 
1100         default:
1101 #ifndef NDEBUG
1102                 uu_warn("%s:%d: Unknown type %d.\n", __FILE__, __LINE__, type);
1103 #endif
1104                 abort();
1105         }
1106 
1107         *vp = vertex_get_by_name(fmri);
1108         if (*vp != NULL)
1109                 return (EEXIST);
1110 
1111         *vp = graph_add_vertex(fmri);
1112 
1113         (*vp)->gv_type = type;
1114         (*vp)->gv_depgroup = dt;
1115         (*vp)->gv_restart = rt;
1116 
1117         (*vp)->gv_flags = 0;
1118         (*vp)->gv_state = RESTARTER_STATE_NONE;
1119 
1120         for (i = 0; special_vertices[i].name != NULL; ++i) {
1121                 if (strcmp(fmri, special_vertices[i].name) == 0) {
1122                         (*vp)->gv_start_f = special_vertices[i].start_f;
1123                         (*vp)->gv_post_online_f =
1124                             special_vertices[i].post_online_f;
1125                         (*vp)->gv_post_disable_f =
1126                             special_vertices[i].post_disable_f;
1127                         break;
1128                 }
1129         }
1130 
1131         (*vp)->gv_restarter_id = -1;
1132         (*vp)->gv_restarter_channel = 0;
1133 
1134         if (type == GVT_INST) {
1135                 char *sfmri;
1136                 graph_vertex_t *sv;
1137 
1138                 sfmri = inst_fmri_to_svc_fmri(fmri);
1139                 sv = vertex_get_by_name(sfmri);
1140                 if (sv == NULL) {
1141                         r = graph_insert_vertex_unconfigured(sfmri, GVT_SVC, 0,
1142                             0, &sv);
1143                         assert(r == 0);
1144                 }
1145                 startd_free(sfmri, max_scf_fmri_size);
1146 
1147                 graph_add_edge(sv, *vp);
1148         }
1149 
1150         /*
1151          * If this vertex is in the subgraph, mark it as so, for both
1152          * GVT_INST and GVT_SERVICE verteces.
1153          * A GVT_SERVICE vertex can only be in the subgraph if another instance
1154          * depends on it, in which case it's already been added to the graph
1155          * and marked as in the subgraph (by refresh_vertex()).  If a
1156          * GVT_SERVICE vertex was freshly added (by the code above), it means
1157          * that it has no dependents, and cannot be in the subgraph.
1158          * Regardless of this, we still check that gv_flags includes
1159          * GV_INSUBGRAPH in the event that future behavior causes the above
1160          * code to add a GVT_SERVICE vertex which should be in the subgraph.
1161          */
1162 
1163         (*vp)->gv_flags |= (should_be_in_subgraph(*vp)? GV_INSUBGRAPH : 0);
1164 
1165         return (0);
1166 }
1167 
1168 /*
1169  * Returns 0 on success or ELOOP if the dependency would create a cycle.
1170  */
1171 static int
1172 graph_insert_dependency(graph_vertex_t *fv, graph_vertex_t *tv, int **pathp)
1173 {
1174         hrtime_t now;
1175 
1176         assert(MUTEX_HELD(&dgraph_lock));
1177 
1178         /* cycle detection */
1179         now = gethrtime();
1180 
1181         /* Don't follow exclusions. */
1182         if (!(fv->gv_type == GVT_GROUP &&
1183             fv->gv_depgroup == DEPGRP_EXCLUDE_ALL)) {
1184                 *pathp = is_path_to(tv, fv);
1185                 if (*pathp)
1186                         return (ELOOP);
1187         }
1188 
1189         dep_cycle_ns += gethrtime() - now;
1190         ++dep_inserts;
1191         now = gethrtime();
1192 
1193         graph_add_edge(fv, tv);
1194 
1195         dep_insert_ns += gethrtime() - now;
1196 
1197         /* Check if the dependency adds the "to" vertex to the subgraph */
1198         tv->gv_flags |= (should_be_in_subgraph(tv) ? GV_INSUBGRAPH : 0);
1199 
1200         return (0);
1201 }
1202 
1203 static int
1204 inst_running(graph_vertex_t *v)
1205 {
1206         assert(v->gv_type == GVT_INST);
1207 
1208         if (v->gv_state == RESTARTER_STATE_ONLINE ||
1209             v->gv_state == RESTARTER_STATE_DEGRADED)
1210                 return (1);
1211 
1212         return (0);
1213 }
1214 
1215 /*
1216  * The dependency evaluation functions return
1217  *   1 - dependency satisfied
1218  *   0 - dependency unsatisfied
1219  *   -1 - dependency unsatisfiable (without administrator intervention)
1220  *
1221  * The functions also take a boolean satbility argument.  When true, the
1222  * functions may recurse in order to determine satisfiability.
1223  */
1224 static int require_any_satisfied(graph_vertex_t *, boolean_t);
1225 static int dependency_satisfied(graph_vertex_t *, boolean_t);
1226 
1227 /*
1228  * A require_all dependency is unsatisfied if any elements are unsatisfied.  It
1229  * is unsatisfiable if any elements are unsatisfiable.
1230  */
1231 static int
1232 require_all_satisfied(graph_vertex_t *groupv, boolean_t satbility)
1233 {
1234         graph_edge_t *edge;
1235         int i;
1236         boolean_t any_unsatisfied;
1237 
1238         if (uu_list_numnodes(groupv->gv_dependencies) == 0)
1239                 return (1);
1240 
1241         any_unsatisfied = B_FALSE;
1242 
1243         for (edge = uu_list_first(groupv->gv_dependencies);
1244             edge != NULL;
1245             edge = uu_list_next(groupv->gv_dependencies, edge)) {
1246                 i = dependency_satisfied(edge->ge_vertex, satbility);
1247                 if (i == 1)
1248                         continue;
1249 
1250                 log_framework2(LOG_DEBUG, DEBUG_DEPENDENCIES,
1251                     "require_all(%s): %s is unsatisfi%s.\n", groupv->gv_name,
1252                     edge->ge_vertex->gv_name, i == 0 ? "ed" : "able");
1253 
1254                 if (!satbility)
1255                         return (0);
1256 
1257                 if (i == -1)
1258                         return (-1);
1259 
1260                 any_unsatisfied = B_TRUE;
1261         }
1262 
1263         return (any_unsatisfied ? 0 : 1);
1264 }
1265 
1266 /*
1267  * A require_any dependency is satisfied if any element is satisfied.  It is
1268  * satisfiable if any element is satisfiable.
1269  */
1270 static int
1271 require_any_satisfied(graph_vertex_t *groupv, boolean_t satbility)
1272 {
1273         graph_edge_t *edge;
1274         int s;
1275         boolean_t satisfiable;
1276 
1277         if (uu_list_numnodes(groupv->gv_dependencies) == 0)
1278                 return (1);
1279 
1280         satisfiable = B_FALSE;
1281 
1282         for (edge = uu_list_first(groupv->gv_dependencies);
1283             edge != NULL;
1284             edge = uu_list_next(groupv->gv_dependencies, edge)) {
1285                 s = dependency_satisfied(edge->ge_vertex, satbility);
1286 
1287                 if (s == 1)
1288                         return (1);
1289 
1290                 log_framework2(LOG_DEBUG, DEBUG_DEPENDENCIES,
1291                     "require_any(%s): %s is unsatisfi%s.\n",
1292                     groupv->gv_name, edge->ge_vertex->gv_name,
1293                     s == 0 ? "ed" : "able");
1294 
1295                 if (satbility && s == 0)
1296                         satisfiable = B_TRUE;
1297         }
1298 
1299         return (!satbility || satisfiable ? 0 : -1);
1300 }
1301 
1302 /*
1303  * An optional_all dependency only considers elements which are configured,
1304  * enabled, and not in maintenance.  If any are unsatisfied, then the dependency
1305  * is unsatisfied.
1306  *
1307  * Offline dependencies which are waiting for a dependency to come online are
1308  * unsatisfied.  Offline dependences which cannot possibly come online
1309  * (unsatisfiable) are always considered satisfied.
1310  */
1311 static int
1312 optional_all_satisfied(graph_vertex_t *groupv, boolean_t satbility)
1313 {
1314         graph_edge_t *edge;
1315         graph_vertex_t *v;
1316         boolean_t any_qualified;
1317         boolean_t any_unsatisfied;
1318         int i;
1319 
1320         any_qualified = B_FALSE;
1321         any_unsatisfied = B_FALSE;
1322 
1323         for (edge = uu_list_first(groupv->gv_dependencies);
1324             edge != NULL;
1325             edge = uu_list_next(groupv->gv_dependencies, edge)) {
1326                 v = edge->ge_vertex;
1327 
1328                 switch (v->gv_type) {
1329                 case GVT_INST:
1330                         /* Skip missing or disabled instances */
1331                         if ((v->gv_flags & (GV_CONFIGURED | GV_ENABLED)) !=
1332                             (GV_CONFIGURED | GV_ENABLED))
1333                                 continue;
1334 
1335                         if (v->gv_state == RESTARTER_STATE_MAINT)
1336                                 continue;
1337 
1338                         if (v->gv_flags & GV_TOOFFLINE)
1339                                 continue;
1340 
1341                         any_qualified = B_TRUE;
1342                         if (v->gv_state == RESTARTER_STATE_OFFLINE) {
1343                                 /*
1344                                  * For offline dependencies, treat unsatisfiable
1345                                  * as satisfied.
1346                                  */
1347                                 i = dependency_satisfied(v, B_TRUE);
1348                                 if (i == -1)
1349                                         i = 1;
1350                         } else if (v->gv_state == RESTARTER_STATE_DISABLED) {
1351                                 /*
1352                                  * The service is enabled, but hasn't
1353                                  * transitioned out of disabled yet.  Treat it
1354                                  * as unsatisfied (not unsatisfiable).
1355                                  */
1356                                 i = 0;
1357                         } else {
1358                                 i = dependency_satisfied(v, satbility);
1359                         }
1360                         break;
1361 
1362                 case GVT_FILE:
1363                         any_qualified = B_TRUE;
1364                         i = dependency_satisfied(v, satbility);
1365 
1366                         break;
1367 
1368                 case GVT_SVC: {
1369                         boolean_t svc_any_qualified;
1370                         boolean_t svc_satisfied;
1371                         boolean_t svc_satisfiable;
1372                         graph_vertex_t *v2;
1373                         graph_edge_t *e2;
1374 
1375                         svc_any_qualified = B_FALSE;
1376                         svc_satisfied = B_FALSE;
1377                         svc_satisfiable = B_FALSE;
1378 
1379                         for (e2 = uu_list_first(v->gv_dependencies);
1380                             e2 != NULL;
1381                             e2 = uu_list_next(v->gv_dependencies, e2)) {
1382                                 v2 = e2->ge_vertex;
1383                                 assert(v2->gv_type == GVT_INST);
1384 
1385                                 if ((v2->gv_flags &
1386                                     (GV_CONFIGURED | GV_ENABLED)) !=
1387                                     (GV_CONFIGURED | GV_ENABLED))
1388                                         continue;
1389 
1390                                 if (v2->gv_state == RESTARTER_STATE_MAINT)
1391                                         continue;
1392 
1393                                 if (v2->gv_flags & GV_TOOFFLINE)
1394                                         continue;
1395 
1396                                 svc_any_qualified = B_TRUE;
1397 
1398                                 if (v2->gv_state == RESTARTER_STATE_OFFLINE) {
1399                                         /*
1400                                          * For offline dependencies, treat
1401                                          * unsatisfiable as satisfied.
1402                                          */
1403                                         i = dependency_satisfied(v2, B_TRUE);
1404                                         if (i == -1)
1405                                                 i = 1;
1406                                 } else if (v2->gv_state ==
1407                                     RESTARTER_STATE_DISABLED) {
1408                                         i = 0;
1409                                 } else {
1410                                         i = dependency_satisfied(v2, satbility);
1411                                 }
1412 
1413                                 if (i == 1) {
1414                                         svc_satisfied = B_TRUE;
1415                                         break;
1416                                 }
1417                                 if (i == 0)
1418                                         svc_satisfiable = B_TRUE;
1419                         }
1420 
1421                         if (!svc_any_qualified)
1422                                 continue;
1423                         any_qualified = B_TRUE;
1424                         if (svc_satisfied) {
1425                                 i = 1;
1426                         } else if (svc_satisfiable) {
1427                                 i = 0;
1428                         } else {
1429                                 i = -1;
1430                         }
1431                         break;
1432                 }
1433 
1434                 case GVT_GROUP:
1435                 default:
1436 #ifndef NDEBUG
1437                         uu_warn("%s:%d: Unexpected vertex type %d.\n", __FILE__,
1438                             __LINE__, v->gv_type);
1439 #endif
1440                         abort();
1441                 }
1442 
1443                 if (i == 1)
1444                         continue;
1445 
1446                 log_framework2(LOG_DEBUG, DEBUG_DEPENDENCIES,
1447                     "optional_all(%s): %s is unsatisfi%s.\n", groupv->gv_name,
1448                     v->gv_name, i == 0 ? "ed" : "able");
1449 
1450                 if (!satbility)
1451                         return (0);
1452                 if (i == -1)
1453                         return (-1);
1454                 any_unsatisfied = B_TRUE;
1455         }
1456 
1457         if (!any_qualified)
1458                 return (1);
1459 
1460         return (any_unsatisfied ? 0 : 1);
1461 }
1462 
1463 /*
1464  * An exclude_all dependency is unsatisfied if any non-service element is
1465  * satisfied or any service instance which is configured, enabled, and not in
1466  * maintenance is satisfied.  Usually when unsatisfied, it is also
1467  * unsatisfiable.
1468  */
1469 #define LOG_EXCLUDE(u, v)                                               \
1470         log_framework2(LOG_DEBUG, DEBUG_DEPENDENCIES,                   \
1471             "exclude_all(%s): %s is satisfied.\n",                      \
1472             (u)->gv_name, (v)->gv_name)
1473 
1474 /* ARGSUSED */
1475 static int
1476 exclude_all_satisfied(graph_vertex_t *groupv, boolean_t satbility)
1477 {
1478         graph_edge_t *edge, *e2;
1479         graph_vertex_t *v, *v2;
1480 
1481         for (edge = uu_list_first(groupv->gv_dependencies);
1482             edge != NULL;
1483             edge = uu_list_next(groupv->gv_dependencies, edge)) {
1484                 v = edge->ge_vertex;
1485 
1486                 switch (v->gv_type) {
1487                 case GVT_INST:
1488                         if ((v->gv_flags & GV_CONFIGURED) == 0)
1489                                 continue;
1490 
1491                         switch (v->gv_state) {
1492                         case RESTARTER_STATE_ONLINE:
1493                         case RESTARTER_STATE_DEGRADED:
1494                                 LOG_EXCLUDE(groupv, v);
1495                                 return (v->gv_flags & GV_ENABLED ? -1 : 0);
1496 
1497                         case RESTARTER_STATE_OFFLINE:
1498                         case RESTARTER_STATE_UNINIT:
1499                                 LOG_EXCLUDE(groupv, v);
1500                                 return (0);
1501 
1502                         case RESTARTER_STATE_DISABLED:
1503                         case RESTARTER_STATE_MAINT:
1504                                 continue;
1505 
1506                         default:
1507 #ifndef NDEBUG
1508                                 uu_warn("%s:%d: Unexpected vertex state %d.\n",
1509                                     __FILE__, __LINE__, v->gv_state);
1510 #endif
1511                                 abort();
1512                         }
1513                         /* NOTREACHED */
1514 
1515                 case GVT_SVC:
1516                         break;
1517 
1518                 case GVT_FILE:
1519                         if (!file_ready(v))
1520                                 continue;
1521                         LOG_EXCLUDE(groupv, v);
1522                         return (-1);
1523 
1524                 case GVT_GROUP:
1525                 default:
1526 #ifndef NDEBUG
1527                         uu_warn("%s:%d: Unexpected vertex type %d.\n", __FILE__,
1528                             __LINE__, v->gv_type);
1529 #endif
1530                         abort();
1531                 }
1532 
1533                 /* v represents a service */
1534                 if (uu_list_numnodes(v->gv_dependencies) == 0)
1535                         continue;
1536 
1537                 for (e2 = uu_list_first(v->gv_dependencies);
1538                     e2 != NULL;
1539                     e2 = uu_list_next(v->gv_dependencies, e2)) {
1540                         v2 = e2->ge_vertex;
1541                         assert(v2->gv_type == GVT_INST);
1542 
1543                         if ((v2->gv_flags & GV_CONFIGURED) == 0)
1544                                 continue;
1545 
1546                         switch (v2->gv_state) {
1547                         case RESTARTER_STATE_ONLINE:
1548                         case RESTARTER_STATE_DEGRADED:
1549                                 LOG_EXCLUDE(groupv, v2);
1550                                 return (v2->gv_flags & GV_ENABLED ? -1 : 0);
1551 
1552                         case RESTARTER_STATE_OFFLINE:
1553                         case RESTARTER_STATE_UNINIT:
1554                                 LOG_EXCLUDE(groupv, v2);
1555                                 return (0);
1556 
1557                         case RESTARTER_STATE_DISABLED:
1558                         case RESTARTER_STATE_MAINT:
1559                                 continue;
1560 
1561                         default:
1562 #ifndef NDEBUG
1563                                 uu_warn("%s:%d: Unexpected vertex type %d.\n",
1564                                     __FILE__, __LINE__, v2->gv_type);
1565 #endif
1566                                 abort();
1567                         }
1568                 }
1569         }
1570 
1571         return (1);
1572 }
1573 
1574 /*
1575  * int instance_satisfied()
1576  *   Determine if all the dependencies are satisfied for the supplied instance
1577  *   vertex. Return 1 if they are, 0 if they aren't, and -1 if they won't be
1578  *   without administrator intervention.
1579  */
1580 static int
1581 instance_satisfied(graph_vertex_t *v, boolean_t satbility)
1582 {
1583         assert(v->gv_type == GVT_INST);
1584         assert(!inst_running(v));
1585 
1586         return (require_all_satisfied(v, satbility));
1587 }
1588 
1589 /*
1590  * Decide whether v can satisfy a dependency.  v can either be a child of
1591  * a group vertex, or of an instance vertex.
1592  */
1593 static int
1594 dependency_satisfied(graph_vertex_t *v, boolean_t satbility)
1595 {
1596         switch (v->gv_type) {
1597         case GVT_INST:
1598                 if ((v->gv_flags & GV_CONFIGURED) == 0) {
1599                         if (v->gv_flags & GV_DEATHROW) {
1600                                 /*
1601                                  * A dependency on an instance with GV_DEATHROW
1602                                  * flag is always considered as satisfied.
1603                                  */
1604                                 return (1);
1605                         }
1606                         return (-1);
1607                 }
1608 
1609                 /*
1610                  * Any vertex with the GV_TOOFFLINE flag set is guaranteed
1611                  * to have its dependencies unsatisfiable.
1612                  */
1613                 if (v->gv_flags & GV_TOOFFLINE)
1614                         return (-1);
1615 
1616                 switch (v->gv_state) {
1617                 case RESTARTER_STATE_ONLINE:
1618                 case RESTARTER_STATE_DEGRADED:
1619                         return (1);
1620 
1621                 case RESTARTER_STATE_OFFLINE:
1622                         if (!satbility)
1623                                 return (0);
1624                         return (instance_satisfied(v, satbility) != -1 ?
1625                             0 : -1);
1626 
1627                 case RESTARTER_STATE_DISABLED:
1628                 case RESTARTER_STATE_MAINT:
1629                         return (-1);
1630 
1631                 case RESTARTER_STATE_UNINIT:
1632                         return (0);
1633 
1634                 default:
1635 #ifndef NDEBUG
1636                         uu_warn("%s:%d: Unexpected vertex state %d.\n",
1637                             __FILE__, __LINE__, v->gv_state);
1638 #endif
1639                         abort();
1640                         /* NOTREACHED */
1641                 }
1642 
1643         case GVT_SVC:
1644                 if (uu_list_numnodes(v->gv_dependencies) == 0)
1645                         return (-1);
1646                 return (require_any_satisfied(v, satbility));
1647 
1648         case GVT_FILE:
1649                 /* i.e., we assume files will not be automatically generated */
1650                 return (file_ready(v) ? 1 : -1);
1651 
1652         case GVT_GROUP:
1653                 break;
1654 
1655         default:
1656 #ifndef NDEBUG
1657                 uu_warn("%s:%d: Unexpected node type %d.\n", __FILE__, __LINE__,
1658                     v->gv_type);
1659 #endif
1660                 abort();
1661                 /* NOTREACHED */
1662         }
1663 
1664         switch (v->gv_depgroup) {
1665         case DEPGRP_REQUIRE_ANY:
1666                 return (require_any_satisfied(v, satbility));
1667 
1668         case DEPGRP_REQUIRE_ALL:
1669                 return (require_all_satisfied(v, satbility));
1670 
1671         case DEPGRP_OPTIONAL_ALL:
1672                 return (optional_all_satisfied(v, satbility));
1673 
1674         case DEPGRP_EXCLUDE_ALL:
1675                 return (exclude_all_satisfied(v, satbility));
1676 
1677         default:
1678 #ifndef NDEBUG
1679                 uu_warn("%s:%d: Unknown dependency grouping %d.\n", __FILE__,
1680                     __LINE__, v->gv_depgroup);
1681 #endif
1682                 abort();
1683         }
1684 }
1685 
1686 void
1687 graph_start_if_satisfied(graph_vertex_t *v)
1688 {
1689         if (v->gv_state == RESTARTER_STATE_OFFLINE &&
1690             instance_satisfied(v, B_FALSE) == 1) {
1691                 if (v->gv_start_f == NULL)
1692                         vertex_send_event(v, RESTARTER_EVENT_TYPE_START);
1693                 else
1694                         v->gv_start_f(v);
1695         }
1696 }
1697 
1698 /*
1699  * propagate_satbility()
1700  *
1701  * This function is used when the given vertex changes state in such a way that
1702  * one of its dependents may become unsatisfiable.  This happens when an
1703  * instance transitions between offline -> online, or from !running ->
1704  * maintenance, as well as when an instance is removed from the graph.
1705  *
1706  * We have to walk all the dependents, since optional_all dependencies several
1707  * levels up could become (un)satisfied, instead of unsatisfiable.  For example,
1708  *
1709  *      +-----+  optional_all  +-----+  require_all  +-----+
1710  *      |  A  |--------------->|  B  |-------------->|  C  |
1711  *      +-----+                +-----+               +-----+
1712  *
1713  *                                              offline -> maintenance
1714  *
1715  * If C goes into maintenance, it's not enough simply to check B.  Because A has
1716  * an optional dependency, what was previously an unsatisfiable situation is now
1717  * satisfied (B will never come online, even though its state hasn't changed).
1718  *
1719  * Note that it's not necessary to continue examining dependents after reaching
1720  * an optional_all dependency.  It's not possible for an optional_all dependency
1721  * to change satisfiability without also coming online, in which case we get a
1722  * start event and propagation continues naturally.  However, it does no harm to
1723  * continue propagating satisfiability (as it is a relatively rare event), and
1724  * keeps the walker code simple and generic.
1725  */
1726 /*ARGSUSED*/
1727 static int
1728 satbility_cb(graph_vertex_t *v, void *arg)
1729 {
1730         if (v->gv_type == GVT_INST)
1731                 graph_start_if_satisfied(v);
1732 
1733         return (UU_WALK_NEXT);
1734 }
1735 
1736 static void
1737 propagate_satbility(graph_vertex_t *v)
1738 {
1739         graph_walk(v, WALK_DEPENDENTS, satbility_cb, NULL, NULL);
1740 }
1741 
1742 static void propagate_stop(graph_vertex_t *, void *);
1743 
1744 /* ARGSUSED */
1745 static void
1746 propagate_start(graph_vertex_t *v, void *arg)
1747 {
1748         switch (v->gv_type) {
1749         case GVT_INST:
1750                 graph_start_if_satisfied(v);
1751                 break;
1752 
1753         case GVT_GROUP:
1754                 if (v->gv_depgroup == DEPGRP_EXCLUDE_ALL) {
1755                         graph_walk_dependents(v, propagate_stop,
1756                             (void *)RERR_RESTART);
1757                         break;
1758                 }
1759                 /* FALLTHROUGH */
1760 
1761         case GVT_SVC:
1762                 graph_walk_dependents(v, propagate_start, NULL);
1763                 break;
1764 
1765         case GVT_FILE:
1766 #ifndef NDEBUG
1767                 uu_warn("%s:%d: propagate_start() encountered GVT_FILE.\n",
1768                     __FILE__, __LINE__);
1769 #endif
1770                 abort();
1771                 /* NOTREACHED */
1772 
1773         default:
1774 #ifndef NDEBUG
1775                 uu_warn("%s:%d: Unknown vertex type %d.\n", __FILE__, __LINE__,
1776                     v->gv_type);
1777 #endif
1778                 abort();
1779         }
1780 }
1781 
1782 static void
1783 propagate_stop(graph_vertex_t *v, void *arg)
1784 {
1785         graph_edge_t *e;
1786         graph_vertex_t *svc;
1787         restarter_error_t err = (restarter_error_t)arg;
1788 
1789         switch (v->gv_type) {
1790         case GVT_INST:
1791                 /* Restarter */
1792                 if (err > RERR_NONE && inst_running(v)) {
1793                         if (err == RERR_RESTART || err == RERR_REFRESH) {
1794                                 vertex_send_event(v,
1795                                     RESTARTER_EVENT_TYPE_STOP_RESET);
1796                         } else {
1797                                 vertex_send_event(v, RESTARTER_EVENT_TYPE_STOP);
1798                         }
1799                 }
1800                 break;
1801 
1802         case GVT_SVC:
1803                 graph_walk_dependents(v, propagate_stop, arg);
1804                 break;
1805 
1806         case GVT_FILE:
1807 #ifndef NDEBUG
1808                 uu_warn("%s:%d: propagate_stop() encountered GVT_FILE.\n",
1809                     __FILE__, __LINE__);
1810 #endif
1811                 abort();
1812                 /* NOTREACHED */
1813 
1814         case GVT_GROUP:
1815                 if (v->gv_depgroup == DEPGRP_EXCLUDE_ALL) {
1816                         graph_walk_dependents(v, propagate_start, NULL);
1817                         break;
1818                 }
1819 
1820                 if (err == RERR_NONE || err > v->gv_restart)
1821                         break;
1822 
1823                 assert(uu_list_numnodes(v->gv_dependents) == 1);
1824                 e = uu_list_first(v->gv_dependents);
1825                 svc = e->ge_vertex;
1826 
1827                 if (inst_running(svc)) {
1828                         if (err == RERR_RESTART || err == RERR_REFRESH) {
1829                                 vertex_send_event(svc,
1830                                     RESTARTER_EVENT_TYPE_STOP_RESET);
1831                         } else {
1832                                 vertex_send_event(svc,
1833                                     RESTARTER_EVENT_TYPE_STOP);
1834                         }
1835                 }
1836                 break;
1837 
1838         default:
1839 #ifndef NDEBUG
1840                 uu_warn("%s:%d: Unknown vertex type %d.\n", __FILE__, __LINE__,
1841                     v->gv_type);
1842 #endif
1843                 abort();
1844         }
1845 }
1846 
1847 void
1848 offline_vertex(graph_vertex_t *v)
1849 {
1850         scf_handle_t *h = libscf_handle_create_bound_loop();
1851         scf_instance_t *scf_inst = safe_scf_instance_create(h);
1852         scf_propertygroup_t *pg = safe_scf_pg_create(h);
1853         restarter_instance_state_t state, next_state;
1854         int r;
1855 
1856         assert(v->gv_type == GVT_INST);
1857 
1858         if (scf_inst == NULL)
1859                 bad_error("safe_scf_instance_create", scf_error());
1860         if (pg == NULL)
1861                 bad_error("safe_scf_pg_create", scf_error());
1862 
1863         /* if the vertex is already going offline, return */
1864 rep_retry:
1865         if (scf_handle_decode_fmri(h, v->gv_name, NULL, NULL, scf_inst, NULL,
1866             NULL, SCF_DECODE_FMRI_EXACT) != 0) {
1867                 switch (scf_error()) {
1868                 case SCF_ERROR_CONNECTION_BROKEN:
1869                         libscf_handle_rebind(h);
1870                         goto rep_retry;
1871 
1872                 case SCF_ERROR_NOT_FOUND:
1873                         scf_pg_destroy(pg);
1874                         scf_instance_destroy(scf_inst);
1875                         (void) scf_handle_unbind(h);
1876                         scf_handle_destroy(h);
1877                         return;
1878                 }
1879                 uu_die("Can't decode FMRI %s: %s\n", v->gv_name,
1880                     scf_strerror(scf_error()));
1881         }
1882 
1883         r = scf_instance_get_pg(scf_inst, SCF_PG_RESTARTER, pg);
1884         if (r != 0) {
1885                 switch (scf_error()) {
1886                 case SCF_ERROR_CONNECTION_BROKEN:
1887                         libscf_handle_rebind(h);
1888                         goto rep_retry;
1889 
1890                 case SCF_ERROR_NOT_SET:
1891                 case SCF_ERROR_NOT_FOUND:
1892                         scf_pg_destroy(pg);
1893                         scf_instance_destroy(scf_inst);
1894                         (void) scf_handle_unbind(h);
1895                         scf_handle_destroy(h);
1896                         return;
1897 
1898                 default:
1899                         bad_error("scf_instance_get_pg", scf_error());
1900                 }
1901         } else {
1902                 r = libscf_read_states(pg, &state, &next_state);
1903                 if (r == 0 && (next_state == RESTARTER_STATE_OFFLINE ||
1904                     next_state == RESTARTER_STATE_DISABLED)) {
1905                         log_framework(LOG_DEBUG,
1906                             "%s: instance is already going down.\n",
1907                             v->gv_name);
1908                         scf_pg_destroy(pg);
1909                         scf_instance_destroy(scf_inst);
1910                         (void) scf_handle_unbind(h);
1911                         scf_handle_destroy(h);
1912                         return;
1913                 }
1914         }
1915 
1916         scf_pg_destroy(pg);
1917         scf_instance_destroy(scf_inst);
1918         (void) scf_handle_unbind(h);
1919         scf_handle_destroy(h);
1920 
1921         vertex_send_event(v, RESTARTER_EVENT_TYPE_STOP_RESET);
1922 }
1923 
1924 /*
1925  * void graph_enable_by_vertex()
1926  *   If admin is non-zero, this is an administrative request for change
1927  *   of the enabled property.  Thus, send the ADMIN_DISABLE rather than
1928  *   a plain DISABLE restarter event.
1929  */
1930 void
1931 graph_enable_by_vertex(graph_vertex_t *vertex, int enable, int admin)
1932 {
1933         graph_vertex_t *v;
1934         int r;
1935 
1936         assert(MUTEX_HELD(&dgraph_lock));
1937         assert((vertex->gv_flags & GV_CONFIGURED));
1938 
1939         vertex->gv_flags = (vertex->gv_flags & ~GV_ENABLED) |
1940             (enable ? GV_ENABLED : 0);
1941 
1942         if (enable) {
1943                 if (vertex->gv_state != RESTARTER_STATE_OFFLINE &&
1944                     vertex->gv_state != RESTARTER_STATE_DEGRADED &&
1945                     vertex->gv_state != RESTARTER_STATE_ONLINE) {
1946                         /*
1947                          * In case the vertex was notified to go down,
1948                          * but now can return online, clear the _TOOFFLINE
1949                          * and _TODISABLE flags.
1950                          */
1951                         vertex->gv_flags &= ~GV_TOOFFLINE;
1952                         vertex->gv_flags &= ~GV_TODISABLE;
1953 
1954                         vertex_send_event(vertex, RESTARTER_EVENT_TYPE_ENABLE);
1955                 }
1956 
1957                 /*
1958                  * Wait for state update from restarter before sending _START or
1959                  * _STOP.
1960                  */
1961 
1962                 return;
1963         }
1964 
1965         if (vertex->gv_state == RESTARTER_STATE_DISABLED)
1966                 return;
1967 
1968         if (!admin) {
1969                 vertex_send_event(vertex, RESTARTER_EVENT_TYPE_DISABLE);
1970 
1971                 /*
1972                  * Wait for state update from restarter before sending _START or
1973                  * _STOP.
1974                  */
1975 
1976                 return;
1977         }
1978 
1979         /*
1980          * If it is a DISABLE event requested by the administrator then we are
1981          * offlining the dependents first.
1982          */
1983 
1984         /*
1985          * Set GV_TOOFFLINE for the services we are offlining. We cannot
1986          * clear the GV_TOOFFLINE bits from all the services because
1987          * other DISABLE events might be handled at the same time.
1988          */
1989         vertex->gv_flags |= GV_TOOFFLINE;
1990 
1991         /* remember which vertex to disable... */
1992         vertex->gv_flags |= GV_TODISABLE;
1993 
1994         log_framework(LOG_DEBUG, "Marking in-subtree vertices before "
1995             "disabling %s.\n", vertex->gv_name);
1996 
1997         /* set GV_TOOFFLINE for its dependents */
1998         r = uu_list_walk(vertex->gv_dependents, (uu_walk_fn_t *)mark_subtree,
1999             NULL, 0);
2000         assert(r == 0);
2001 
2002         /* disable the instance now if there is nothing else to offline */
2003         if (insubtree_dependents_down(vertex) == B_TRUE) {
2004                 vertex_send_event(vertex, RESTARTER_EVENT_TYPE_ADMIN_DISABLE);
2005                 return;
2006         }
2007 
2008         /*
2009          * This loop is similar to the one used for the graph reversal shutdown
2010          * and could be improved in term of performance for the subtree reversal
2011          * disable case.
2012          */
2013         for (v = uu_list_first(dgraph); v != NULL;
2014             v = uu_list_next(dgraph, v)) {
2015                 /* skip the vertex we are disabling for now */
2016                 if (v == vertex)
2017                         continue;
2018 
2019                 if (v->gv_type != GVT_INST ||
2020                     (v->gv_flags & GV_CONFIGURED) == 0 ||
2021                     (v->gv_flags & GV_ENABLED) == 0 ||
2022                     (v->gv_flags & GV_TOOFFLINE) == 0)
2023                         continue;
2024 
2025                 if ((v->gv_state != RESTARTER_STATE_ONLINE) &&
2026                     (v->gv_state != RESTARTER_STATE_DEGRADED)) {
2027                         /* continue if there is nothing to offline */
2028                         continue;
2029                 }
2030 
2031                 /*
2032                  * Instances which are up need to come down before we're
2033                  * done, but we can only offline the leaves here. An
2034                  * instance is a leaf when all its dependents are down.
2035                  */
2036                 if (insubtree_dependents_down(v) == B_TRUE) {
2037                         log_framework(LOG_DEBUG, "Offlining in-subtree "
2038                             "instance %s for %s.\n",
2039                             v->gv_name, vertex->gv_name);
2040                         offline_vertex(v);
2041                 }
2042         }
2043 }
2044 
2045 static int configure_vertex(graph_vertex_t *, scf_instance_t *);
2046 
2047 /*
2048  * Set the restarter for v to fmri_arg.  That is, make sure a vertex for
2049  * fmri_arg exists, make v depend on it, and send _ADD_INSTANCE for v.  If
2050  * v is already configured and fmri_arg indicates the current restarter, do
2051  * nothing.  If v is configured and fmri_arg is a new restarter, delete v's
2052  * dependency on the restarter, send _REMOVE_INSTANCE for v, and set the new
2053  * restarter.  Returns 0 on success, EINVAL if the FMRI is invalid,
2054  * ECONNABORTED if the repository connection is broken, and ELOOP
2055  * if the dependency would create a cycle.  In the last case, *pathp will
2056  * point to a -1-terminated array of ids which compose the path from v to
2057  * restarter_fmri.
2058  */
2059 int
2060 graph_change_restarter(graph_vertex_t *v, const char *fmri_arg, scf_handle_t *h,
2061     int **pathp)
2062 {
2063         char *restarter_fmri = NULL;
2064         graph_vertex_t *rv;
2065         int err;
2066         int id;
2067 
2068         assert(MUTEX_HELD(&dgraph_lock));
2069 
2070         if (fmri_arg[0] != '\0') {
2071                 err = fmri_canonify(fmri_arg, &restarter_fmri, B_TRUE);
2072                 if (err != 0) {
2073                         assert(err == EINVAL);
2074                         return (err);
2075                 }
2076         }
2077 
2078         if (restarter_fmri == NULL ||
2079             strcmp(restarter_fmri, SCF_SERVICE_STARTD) == 0) {
2080                 if (v->gv_flags & GV_CONFIGURED) {
2081                         if (v->gv_restarter_id == -1) {
2082                                 if (restarter_fmri != NULL)
2083                                         startd_free(restarter_fmri,
2084                                             max_scf_fmri_size);
2085                                 return (0);
2086                         }
2087 
2088                         graph_unset_restarter(v);
2089                 }
2090 
2091                 /* Master restarter, nothing to do. */
2092                 v->gv_restarter_id = -1;
2093                 v->gv_restarter_channel = NULL;
2094                 vertex_send_event(v, RESTARTER_EVENT_TYPE_ADD_INSTANCE);
2095                 return (0);
2096         }
2097 
2098         if (v->gv_flags & GV_CONFIGURED) {
2099                 id = dict_lookup_byname(restarter_fmri);
2100                 if (id != -1 && v->gv_restarter_id == id) {
2101                         startd_free(restarter_fmri, max_scf_fmri_size);
2102                         return (0);
2103                 }
2104 
2105                 graph_unset_restarter(v);
2106         }
2107 
2108         err = graph_insert_vertex_unconfigured(restarter_fmri, GVT_INST, 0,
2109             RERR_NONE, &rv);
2110         startd_free(restarter_fmri, max_scf_fmri_size);
2111         assert(err == 0 || err == EEXIST);
2112 
2113         if (rv->gv_delegate_initialized == 0) {
2114                 if ((rv->gv_delegate_channel = restarter_protocol_init_delegate(
2115                     rv->gv_name)) == NULL)
2116                         return (EINVAL);
2117                 rv->gv_delegate_initialized = 1;
2118         }
2119         v->gv_restarter_id = rv->gv_id;
2120         v->gv_restarter_channel = rv->gv_delegate_channel;
2121 
2122         err = graph_insert_dependency(v, rv, pathp);
2123         if (err != 0) {
2124                 assert(err == ELOOP);
2125                 return (ELOOP);
2126         }
2127 
2128         vertex_send_event(v, RESTARTER_EVENT_TYPE_ADD_INSTANCE);
2129 
2130         if (!(rv->gv_flags & GV_CONFIGURED)) {
2131                 scf_instance_t *inst;
2132 
2133                 err = libscf_fmri_get_instance(h, rv->gv_name, &inst);
2134                 switch (err) {
2135                 case 0:
2136                         err = configure_vertex(rv, inst);
2137                         scf_instance_destroy(inst);
2138                         switch (err) {
2139                         case 0:
2140                         case ECANCELED:
2141                                 break;
2142 
2143                         case ECONNABORTED:
2144                                 return (ECONNABORTED);
2145 
2146                         default:
2147                                 bad_error("configure_vertex", err);
2148                         }
2149                         break;
2150 
2151                 case ECONNABORTED:
2152                         return (ECONNABORTED);
2153 
2154                 case ENOENT:
2155                         break;
2156 
2157                 case ENOTSUP:
2158                         /*
2159                          * The fmri doesn't specify an instance - translate
2160                          * to EINVAL.
2161                          */
2162                         return (EINVAL);
2163 
2164                 case EINVAL:
2165                 default:
2166                         bad_error("libscf_fmri_get_instance", err);
2167                 }
2168         }
2169 
2170         return (0);
2171 }
2172 
2173 
2174 /*
2175  * Add all of the instances of the service named by fmri to the graph.
2176  * Returns
2177  *   0 - success
2178  *   ENOENT - service indicated by fmri does not exist
2179  *
2180  * In both cases *reboundp will be B_TRUE if the handle was rebound, or B_FALSE
2181  * otherwise.
2182  */
2183 static int
2184 add_service(const char *fmri, scf_handle_t *h, boolean_t *reboundp)
2185 {
2186         scf_service_t *svc;
2187         scf_instance_t *inst;
2188         scf_iter_t *iter;
2189         char *inst_fmri;
2190         int ret, r;
2191 
2192         *reboundp = B_FALSE;
2193 
2194         svc = safe_scf_service_create(h);
2195         inst = safe_scf_instance_create(h);
2196         iter = safe_scf_iter_create(h);
2197         inst_fmri = startd_alloc(max_scf_fmri_size);
2198 
2199 rebound:
2200         if (scf_handle_decode_fmri(h, fmri, NULL, svc, NULL, NULL, NULL,
2201             SCF_DECODE_FMRI_EXACT) != 0) {
2202                 switch (scf_error()) {
2203                 case SCF_ERROR_CONNECTION_BROKEN:
2204                 default:
2205                         libscf_handle_rebind(h);
2206                         *reboundp = B_TRUE;
2207                         goto rebound;
2208 
2209                 case SCF_ERROR_NOT_FOUND:
2210                         ret = ENOENT;
2211                         goto out;
2212 
2213                 case SCF_ERROR_INVALID_ARGUMENT:
2214                 case SCF_ERROR_CONSTRAINT_VIOLATED:
2215                 case SCF_ERROR_NOT_BOUND:
2216                 case SCF_ERROR_HANDLE_MISMATCH:
2217                         bad_error("scf_handle_decode_fmri", scf_error());
2218                 }
2219         }
2220 
2221         if (scf_iter_service_instances(iter, svc) != 0) {
2222                 switch (scf_error()) {
2223                 case SCF_ERROR_CONNECTION_BROKEN:
2224                 default:
2225                         libscf_handle_rebind(h);
2226                         *reboundp = B_TRUE;
2227                         goto rebound;
2228 
2229                 case SCF_ERROR_DELETED:
2230                         ret = ENOENT;
2231                         goto out;
2232 
2233                 case SCF_ERROR_HANDLE_MISMATCH:
2234                 case SCF_ERROR_NOT_BOUND:
2235                 case SCF_ERROR_NOT_SET:
2236                         bad_error("scf_iter_service_instances", scf_error());
2237                 }
2238         }
2239 
2240         for (;;) {
2241                 r = scf_iter_next_instance(iter, inst);
2242                 if (r == 0)
2243                         break;
2244                 if (r != 1) {
2245                         switch (scf_error()) {
2246                         case SCF_ERROR_CONNECTION_BROKEN:
2247                         default:
2248                                 libscf_handle_rebind(h);
2249                                 *reboundp = B_TRUE;
2250                                 goto rebound;
2251 
2252                         case SCF_ERROR_DELETED:
2253                                 ret = ENOENT;
2254                                 goto out;
2255 
2256                         case SCF_ERROR_HANDLE_MISMATCH:
2257                         case SCF_ERROR_NOT_BOUND:
2258                         case SCF_ERROR_NOT_SET:
2259                         case SCF_ERROR_INVALID_ARGUMENT:
2260                                 bad_error("scf_iter_next_instance",
2261                                     scf_error());
2262                         }
2263                 }
2264 
2265                 if (scf_instance_to_fmri(inst, inst_fmri, max_scf_fmri_size) <
2266                     0) {
2267                         switch (scf_error()) {
2268                         case SCF_ERROR_CONNECTION_BROKEN:
2269                                 libscf_handle_rebind(h);
2270                                 *reboundp = B_TRUE;
2271                                 goto rebound;
2272 
2273                         case SCF_ERROR_DELETED:
2274                                 continue;
2275 
2276                         case SCF_ERROR_NOT_BOUND:
2277                         case SCF_ERROR_NOT_SET:
2278                                 bad_error("scf_instance_to_fmri", scf_error());
2279                         }
2280                 }
2281 
2282                 r = dgraph_add_instance(inst_fmri, inst, B_FALSE);
2283                 switch (r) {
2284                 case 0:
2285                 case ECANCELED:
2286                         break;
2287 
2288                 case EEXIST:
2289                         continue;
2290 
2291                 case ECONNABORTED:
2292                         libscf_handle_rebind(h);
2293                         *reboundp = B_TRUE;
2294                         goto rebound;
2295 
2296                 case EINVAL:
2297                 default:
2298                         bad_error("dgraph_add_instance", r);
2299                 }
2300         }
2301 
2302         ret = 0;
2303 
2304 out:
2305         startd_free(inst_fmri, max_scf_fmri_size);
2306         scf_iter_destroy(iter);
2307         scf_instance_destroy(inst);
2308         scf_service_destroy(svc);
2309         return (ret);
2310 }
2311 
2312 struct depfmri_info {
2313         graph_vertex_t  *v;             /* GVT_GROUP vertex */
2314         gv_type_t       type;           /* type of dependency */
2315         const char      *inst_fmri;     /* FMRI of parental GVT_INST vert. */
2316         const char      *pg_name;       /* Name of dependency pg */
2317         scf_handle_t    *h;
2318         int             err;            /* return error code */
2319         int             **pathp;        /* return circular dependency path */
2320 };
2321 
2322 /*
2323  * Find or create a vertex for fmri and make info->v depend on it.
2324  * Returns
2325  *   0 - success
2326  *   nonzero - failure
2327  *
2328  * On failure, sets info->err to
2329  *   EINVAL - fmri is invalid
2330  *            fmri does not match info->type
2331  *   ELOOP - Adding the dependency creates a circular dependency.  *info->pathp
2332  *           will point to an array of the ids of the members of the cycle.
2333  *   ECONNABORTED - repository connection was broken
2334  *   ECONNRESET - succeeded, but repository connection was reset
2335  */
2336 static int
2337 process_dependency_fmri(const char *fmri, struct depfmri_info *info)
2338 {
2339         int err;
2340         graph_vertex_t *depgroup_v, *v;
2341         char *fmri_copy, *cfmri;
2342         size_t fmri_copy_sz;
2343         const char *scope, *service, *instance, *pg;
2344         scf_instance_t *inst;
2345         boolean_t rebound;
2346 
2347         assert(MUTEX_HELD(&dgraph_lock));
2348 
2349         /* Get or create vertex for FMRI */
2350         depgroup_v = info->v;
2351 
2352         if (strncmp(fmri, "file:", sizeof ("file:") - 1) == 0) {
2353                 if (info->type != GVT_FILE) {
2354                         log_framework(LOG_NOTICE,
2355                             "FMRI \"%s\" is not allowed for the \"%s\" "
2356                             "dependency's type of instance %s.\n", fmri,
2357                             info->pg_name, info->inst_fmri);
2358                         return (info->err = EINVAL);
2359                 }
2360 
2361                 err = graph_insert_vertex_unconfigured(fmri, info->type, 0,
2362                     RERR_NONE, &v);
2363                 switch (err) {
2364                 case 0:
2365                         break;
2366 
2367                 case EEXIST:
2368                         assert(v->gv_type == GVT_FILE);
2369                         break;
2370 
2371                 case EINVAL:            /* prevented above */
2372                 default:
2373                         bad_error("graph_insert_vertex_unconfigured", err);
2374                 }
2375         } else {
2376                 if (info->type != GVT_INST) {
2377                         log_framework(LOG_NOTICE,
2378                             "FMRI \"%s\" is not allowed for the \"%s\" "
2379                             "dependency's type of instance %s.\n", fmri,
2380                             info->pg_name, info->inst_fmri);
2381                         return (info->err = EINVAL);
2382                 }
2383 
2384                 /*
2385                  * We must canonify fmri & add a vertex for it.
2386                  */
2387                 fmri_copy_sz = strlen(fmri) + 1;
2388                 fmri_copy = startd_alloc(fmri_copy_sz);
2389                 (void) strcpy(fmri_copy, fmri);
2390 
2391                 /* Determine if the FMRI is a property group or instance */
2392                 if (scf_parse_svc_fmri(fmri_copy, &scope, &service,
2393                     &instance, &pg, NULL) != 0) {
2394                         startd_free(fmri_copy, fmri_copy_sz);
2395                         log_framework(LOG_NOTICE,
2396                             "Dependency \"%s\" of %s has invalid FMRI "
2397                             "\"%s\".\n", info->pg_name, info->inst_fmri,
2398                             fmri);
2399                         return (info->err = EINVAL);
2400                 }
2401 
2402                 if (service == NULL || pg != NULL) {
2403                         startd_free(fmri_copy, fmri_copy_sz);
2404                         log_framework(LOG_NOTICE,
2405                             "Dependency \"%s\" of %s does not designate a "
2406                             "service or instance.\n", info->pg_name,
2407                             info->inst_fmri);
2408                         return (info->err = EINVAL);
2409                 }
2410 
2411                 if (scope == NULL || strcmp(scope, SCF_SCOPE_LOCAL) == 0) {
2412                         cfmri = uu_msprintf("svc:/%s%s%s",
2413                             service, instance ? ":" : "", instance ? instance :
2414                             "");
2415                 } else {
2416                         cfmri = uu_msprintf("svc://%s/%s%s%s",
2417                             scope, service, instance ? ":" : "", instance ?
2418                             instance : "");
2419                 }
2420 
2421                 startd_free(fmri_copy, fmri_copy_sz);
2422 
2423                 err = graph_insert_vertex_unconfigured(cfmri, instance ?
2424                     GVT_INST : GVT_SVC, instance ? 0 : DEPGRP_REQUIRE_ANY,
2425                     RERR_NONE, &v);
2426                 uu_free(cfmri);
2427                 switch (err) {
2428                 case 0:
2429                         break;
2430 
2431                 case EEXIST:
2432                         /* Verify v. */
2433                         if (instance != NULL)
2434                                 assert(v->gv_type == GVT_INST);
2435                         else
2436                                 assert(v->gv_type == GVT_SVC);
2437                         break;
2438 
2439                 default:
2440                         bad_error("graph_insert_vertex_unconfigured", err);
2441                 }
2442         }
2443 
2444         /* Add dependency from depgroup_v to new vertex */
2445         info->err = graph_insert_dependency(depgroup_v, v, info->pathp);
2446         switch (info->err) {
2447         case 0:
2448                 break;
2449 
2450         case ELOOP:
2451                 return (ELOOP);
2452 
2453         default:
2454                 bad_error("graph_insert_dependency", info->err);
2455         }
2456 
2457         /* This must be after we insert the dependency, to avoid looping. */
2458         switch (v->gv_type) {
2459         case GVT_INST:
2460                 if ((v->gv_flags & GV_CONFIGURED) != 0)
2461                         break;
2462 
2463                 inst = safe_scf_instance_create(info->h);
2464 
2465                 rebound = B_FALSE;
2466 
2467 rebound:
2468                 err = libscf_lookup_instance(v->gv_name, inst);
2469                 switch (err) {
2470                 case 0:
2471                         err = configure_vertex(v, inst);
2472                         switch (err) {
2473                         case 0:
2474                         case ECANCELED:
2475                                 break;
2476 
2477                         case ECONNABORTED:
2478                                 libscf_handle_rebind(info->h);
2479                                 rebound = B_TRUE;
2480                                 goto rebound;
2481 
2482                         default:
2483                                 bad_error("configure_vertex", err);
2484                         }
2485                         break;
2486 
2487                 case ENOENT:
2488                         break;
2489 
2490                 case ECONNABORTED:
2491                         libscf_handle_rebind(info->h);
2492                         rebound = B_TRUE;
2493                         goto rebound;
2494 
2495                 case EINVAL:
2496                 case ENOTSUP:
2497                 default:
2498                         bad_error("libscf_fmri_get_instance", err);
2499                 }
2500 
2501                 scf_instance_destroy(inst);
2502 
2503                 if (rebound)
2504                         return (info->err = ECONNRESET);
2505                 break;
2506 
2507         case GVT_SVC:
2508                 (void) add_service(v->gv_name, info->h, &rebound);
2509                 if (rebound)
2510                         return (info->err = ECONNRESET);
2511         }
2512 
2513         return (0);
2514 }
2515 
2516 struct deppg_info {
2517         graph_vertex_t  *v;             /* GVT_INST vertex */
2518         int             err;            /* return error */
2519         int             **pathp;        /* return circular dependency path */
2520 };
2521 
2522 /*
2523  * Make info->v depend on a new GVT_GROUP node for this property group,
2524  * and then call process_dependency_fmri() for the values of the entity
2525  * property.  Return 0 on success, or if something goes wrong return nonzero
2526  * and set info->err to ECONNABORTED, EINVAL, or the error code returned by
2527  * process_dependency_fmri().
2528  */
2529 static int
2530 process_dependency_pg(scf_propertygroup_t *pg, struct deppg_info *info)
2531 {
2532         scf_handle_t *h;
2533         depgroup_type_t deptype;
2534         restarter_error_t rerr;
2535         struct depfmri_info linfo;
2536         char *fmri, *pg_name;
2537         size_t fmri_sz;
2538         graph_vertex_t *depgrp;
2539         scf_property_t *prop;
2540         int err;
2541         int empty;
2542         scf_error_t scferr;
2543         ssize_t len;
2544 
2545         assert(MUTEX_HELD(&dgraph_lock));
2546 
2547         h = scf_pg_handle(pg);
2548 
2549         pg_name = startd_alloc(max_scf_name_size);
2550 
2551         len = scf_pg_get_name(pg, pg_name, max_scf_name_size);
2552         if (len < 0) {
2553                 startd_free(pg_name, max_scf_name_size);
2554                 switch (scf_error()) {
2555                 case SCF_ERROR_CONNECTION_BROKEN:
2556                 default:
2557                         return (info->err = ECONNABORTED);
2558 
2559                 case SCF_ERROR_DELETED:
2560                         return (info->err = 0);
2561 
2562                 case SCF_ERROR_NOT_SET:
2563                         bad_error("scf_pg_get_name", scf_error());
2564                 }
2565         }
2566 
2567         /*
2568          * Skip over empty dependency groups.  Since dependency property
2569          * groups are updated atomically, they are either empty or
2570          * fully populated.
2571          */
2572         empty = depgroup_empty(h, pg);
2573         if (empty < 0) {
2574                 log_error(LOG_INFO,
2575                     "Error reading dependency group \"%s\" of %s: %s\n",
2576                     pg_name, info->v->gv_name, scf_strerror(scf_error()));
2577                 startd_free(pg_name, max_scf_name_size);
2578                 return (info->err = EINVAL);
2579 
2580         } else if (empty == 1) {
2581                 log_framework(LOG_DEBUG,
2582                     "Ignoring empty dependency group \"%s\" of %s\n",
2583                     pg_name, info->v->gv_name);
2584                 startd_free(pg_name, max_scf_name_size);
2585                 return (info->err = 0);
2586         }
2587 
2588         fmri_sz = strlen(info->v->gv_name) + 1 + len + 1;
2589         fmri = startd_alloc(fmri_sz);
2590 
2591         (void) snprintf(fmri, max_scf_name_size, "%s>%s", info->v->gv_name,
2592             pg_name);
2593 
2594         /* Validate the pg before modifying the graph */
2595         deptype = depgroup_read_grouping(h, pg);
2596         if (deptype == DEPGRP_UNSUPPORTED) {
2597                 log_error(LOG_INFO,
2598                     "Dependency \"%s\" of %s has an unknown grouping value.\n",
2599                     pg_name, info->v->gv_name);
2600                 startd_free(fmri, fmri_sz);
2601                 startd_free(pg_name, max_scf_name_size);
2602                 return (info->err = EINVAL);
2603         }
2604 
2605         rerr = depgroup_read_restart(h, pg);
2606         if (rerr == RERR_UNSUPPORTED) {
2607                 log_error(LOG_INFO,
2608                     "Dependency \"%s\" of %s has an unknown restart_on value."
2609                     "\n", pg_name, info->v->gv_name);
2610                 startd_free(fmri, fmri_sz);
2611                 startd_free(pg_name, max_scf_name_size);
2612                 return (info->err = EINVAL);
2613         }
2614 
2615         prop = safe_scf_property_create(h);
2616 
2617         if (scf_pg_get_property(pg, SCF_PROPERTY_ENTITIES, prop) != 0) {
2618                 scferr = scf_error();
2619                 scf_property_destroy(prop);
2620                 if (scferr == SCF_ERROR_DELETED) {
2621                         startd_free(fmri, fmri_sz);
2622                         startd_free(pg_name, max_scf_name_size);
2623                         return (info->err = 0);
2624                 } else if (scferr != SCF_ERROR_NOT_FOUND) {
2625                         startd_free(fmri, fmri_sz);
2626                         startd_free(pg_name, max_scf_name_size);
2627                         return (info->err = ECONNABORTED);
2628                 }
2629 
2630                 log_error(LOG_INFO,
2631                     "Dependency \"%s\" of %s is missing a \"%s\" property.\n",
2632                     pg_name, info->v->gv_name, SCF_PROPERTY_ENTITIES);
2633 
2634                 startd_free(fmri, fmri_sz);
2635                 startd_free(pg_name, max_scf_name_size);
2636 
2637                 return (info->err = EINVAL);
2638         }
2639 
2640         /* Create depgroup vertex for pg */
2641         err = graph_insert_vertex_unconfigured(fmri, GVT_GROUP, deptype,
2642             rerr, &depgrp);
2643         assert(err == 0);
2644         startd_free(fmri, fmri_sz);
2645 
2646         /* Add dependency from inst vertex to new vertex */
2647         err = graph_insert_dependency(info->v, depgrp, info->pathp);
2648         /* ELOOP can't happen because this should be a new vertex */
2649         assert(err == 0);
2650 
2651         linfo.v = depgrp;
2652         linfo.type = depgroup_read_scheme(h, pg);
2653         linfo.inst_fmri = info->v->gv_name;
2654         linfo.pg_name = pg_name;
2655         linfo.h = h;
2656         linfo.err = 0;
2657         linfo.pathp = info->pathp;
2658         err = walk_property_astrings(prop, (callback_t)process_dependency_fmri,
2659             &linfo);
2660 
2661         scf_property_destroy(prop);
2662         startd_free(pg_name, max_scf_name_size);
2663 
2664         switch (err) {
2665         case 0:
2666         case EINTR:
2667                 return (info->err = linfo.err);
2668 
2669         case ECONNABORTED:
2670         case EINVAL:
2671                 return (info->err = err);
2672 
2673         case ECANCELED:
2674                 return (info->err = 0);
2675 
2676         case ECONNRESET:
2677                 return (info->err = ECONNABORTED);
2678 
2679         default:
2680                 bad_error("walk_property_astrings", err);
2681                 /* NOTREACHED */
2682         }
2683 }
2684 
2685 /*
2686  * Build the dependency info for v from the repository.  Returns 0 on success,
2687  * ECONNABORTED on repository disconnection, EINVAL if the repository
2688  * configuration is invalid, and ELOOP if a dependency would cause a cycle.
2689  * In the last case, *pathp will point to a -1-terminated array of ids which
2690  * constitute the rest of the dependency cycle.
2691  */
2692 static int
2693 set_dependencies(graph_vertex_t *v, scf_instance_t *inst, int **pathp)
2694 {
2695         struct deppg_info info;
2696         int err;
2697         uint_t old_configured;
2698 
2699         assert(MUTEX_HELD(&dgraph_lock));
2700 
2701         /*
2702          * Mark the vertex as configured during dependency insertion to avoid
2703          * dependency cycles (which can appear in the graph if one of the
2704          * vertices is an exclusion-group).
2705          */
2706         old_configured = v->gv_flags & GV_CONFIGURED;
2707         v->gv_flags |= GV_CONFIGURED;
2708 
2709         info.err = 0;
2710         info.v = v;
2711         info.pathp = pathp;
2712 
2713         err = walk_dependency_pgs(inst, (callback_t)process_dependency_pg,
2714             &info);
2715 
2716         if (!old_configured)
2717                 v->gv_flags &= ~GV_CONFIGURED;
2718 
2719         switch (err) {
2720         case 0:
2721         case EINTR:
2722                 return (info.err);
2723 
2724         case ECONNABORTED:
2725                 return (ECONNABORTED);
2726 
2727         case ECANCELED:
2728                 /* Should get delete event, so return 0. */
2729                 return (0);
2730 
2731         default:
2732                 bad_error("walk_dependency_pgs", err);
2733                 /* NOTREACHED */
2734         }
2735 }
2736 
2737 
2738 static void
2739 handle_cycle(const char *fmri, int *path)
2740 {
2741         const char *cp;
2742         size_t sz;
2743 
2744         assert(MUTEX_HELD(&dgraph_lock));
2745 
2746         path_to_str(path, (char **)&cp, &sz);
2747 
2748         log_error(LOG_ERR, "Transitioning %s to maintenance "
2749             "because it completes a dependency cycle (see svcs -xv for "
2750             "details):\n%s", fmri ? fmri : "?", cp);
2751 
2752         startd_free((void *)cp, sz);
2753 }
2754 
2755 /*
2756  * Increment the vertex's reference count to prevent the vertex removal
2757  * from the dgraph.
2758  */
2759 static void
2760 vertex_ref(graph_vertex_t *v)
2761 {
2762         assert(MUTEX_HELD(&dgraph_lock));
2763 
2764         v->gv_refs++;
2765 }
2766 
2767 /*
2768  * Decrement the vertex's reference count and remove the vertex from
2769  * the dgraph when possible.
2770  *
2771  * Return VERTEX_REMOVED when the vertex has been removed otherwise
2772  * return VERTEX_INUSE.
2773  */
2774 static int
2775 vertex_unref(graph_vertex_t *v)
2776 {
2777         assert(MUTEX_HELD(&dgraph_lock));
2778         assert(v->gv_refs > 0);
2779 
2780         v->gv_refs--;
2781 
2782         return (free_if_unrefed(v));
2783 }
2784 
2785 /*
2786  * When run on the dependencies of a vertex, populates list with
2787  * graph_edge_t's which point to the service vertices or the instance
2788  * vertices (no GVT_GROUP nodes) on which the vertex depends.
2789  *
2790  * Increment the vertex's reference count once the vertex is inserted
2791  * in the list. The vertex won't be able to be deleted from the dgraph
2792  * while it is referenced.
2793  */
2794 static int
2795 append_svcs_or_insts(graph_edge_t *e, uu_list_t *list)
2796 {
2797         graph_vertex_t *v = e->ge_vertex;
2798         graph_edge_t *new;
2799         int r;
2800 
2801         switch (v->gv_type) {
2802         case GVT_INST:
2803         case GVT_SVC:
2804                 break;
2805 
2806         case GVT_GROUP:
2807                 r = uu_list_walk(v->gv_dependencies,
2808                     (uu_walk_fn_t *)append_svcs_or_insts, list, 0);
2809                 assert(r == 0);
2810                 return (UU_WALK_NEXT);
2811 
2812         case GVT_FILE:
2813                 return (UU_WALK_NEXT);
2814 
2815         default:
2816 #ifndef NDEBUG
2817                 uu_warn("%s:%d: Unexpected vertex type %d.\n", __FILE__,
2818                     __LINE__, v->gv_type);
2819 #endif
2820                 abort();
2821         }
2822 
2823         new = startd_alloc(sizeof (*new));
2824         new->ge_vertex = v;
2825         uu_list_node_init(new, &new->ge_link, graph_edge_pool);
2826         r = uu_list_insert_before(list, NULL, new);
2827         assert(r == 0);
2828 
2829         /*
2830          * Because we are inserting the vertex in a list, we don't want
2831          * the vertex to be freed while the list is in use. In order to
2832          * achieve that, increment the vertex's reference count.
2833          */
2834         vertex_ref(v);
2835 
2836         return (UU_WALK_NEXT);
2837 }
2838 
2839 static boolean_t
2840 should_be_in_subgraph(graph_vertex_t *v)
2841 {
2842         graph_edge_t *e;
2843 
2844         if (v == milestone)
2845                 return (B_TRUE);
2846 
2847         /*
2848          * v is in the subgraph if any of its dependents are in the subgraph.
2849          * Except for EXCLUDE_ALL dependents.  And OPTIONAL dependents only
2850          * count if we're enabled.
2851          */
2852         for (e = uu_list_first(v->gv_dependents);
2853             e != NULL;
2854             e = uu_list_next(v->gv_dependents, e)) {
2855                 graph_vertex_t *dv = e->ge_vertex;
2856 
2857                 if (!(dv->gv_flags & GV_INSUBGRAPH))
2858                         continue;
2859 
2860                 /*
2861                  * Don't include instances that are optional and disabled.
2862                  */
2863                 if (v->gv_type == GVT_INST && dv->gv_type == GVT_SVC) {
2864 
2865                         int in = 0;
2866                         graph_edge_t *ee;
2867 
2868                         for (ee = uu_list_first(dv->gv_dependents);
2869                             ee != NULL;
2870                             ee = uu_list_next(dv->gv_dependents, ee)) {
2871 
2872                                 graph_vertex_t *ddv = e->ge_vertex;
2873 
2874                                 if (ddv->gv_type == GVT_GROUP &&
2875                                     ddv->gv_depgroup == DEPGRP_EXCLUDE_ALL)
2876                                         continue;
2877 
2878                                 if (ddv->gv_type == GVT_GROUP &&
2879                                     ddv->gv_depgroup == DEPGRP_OPTIONAL_ALL &&
2880                                     !(v->gv_flags & GV_ENBLD_NOOVR))
2881                                         continue;
2882 
2883                                 in = 1;
2884                         }
2885                         if (!in)
2886                                 continue;
2887                 }
2888                 if (v->gv_type == GVT_INST &&
2889                     dv->gv_type == GVT_GROUP &&
2890                     dv->gv_depgroup == DEPGRP_OPTIONAL_ALL &&
2891                     !(v->gv_flags & GV_ENBLD_NOOVR))
2892                         continue;
2893 
2894                 /* Don't include excluded services and instances */
2895                 if (dv->gv_type == GVT_GROUP &&
2896                     dv->gv_depgroup == DEPGRP_EXCLUDE_ALL)
2897                         continue;
2898 
2899                 return (B_TRUE);
2900         }
2901 
2902         return (B_FALSE);
2903 }
2904 
2905 /*
2906  * Ensures that GV_INSUBGRAPH is set properly for v and its descendents.  If
2907  * any bits change, manipulate the repository appropriately.  Returns 0 or
2908  * ECONNABORTED.
2909  */
2910 static int
2911 eval_subgraph(graph_vertex_t *v, scf_handle_t *h)
2912 {
2913         boolean_t old = (v->gv_flags & GV_INSUBGRAPH) != 0;
2914         boolean_t new;
2915         graph_edge_t *e;
2916         scf_instance_t *inst;
2917         int ret = 0, r;
2918 
2919         assert(milestone != NULL && milestone != MILESTONE_NONE);
2920 
2921         new = should_be_in_subgraph(v);
2922 
2923         if (new == old)
2924                 return (0);
2925 
2926         log_framework(LOG_DEBUG, new ? "Adding %s to the subgraph.\n" :
2927             "Removing %s from the subgraph.\n", v->gv_name);
2928 
2929         v->gv_flags = (v->gv_flags & ~GV_INSUBGRAPH) |
2930             (new ? GV_INSUBGRAPH : 0);
2931 
2932         if (v->gv_type == GVT_INST && (v->gv_flags & GV_CONFIGURED)) {
2933                 int err;
2934 
2935 get_inst:
2936                 err = libscf_fmri_get_instance(h, v->gv_name, &inst);
2937                 if (err != 0) {
2938                         switch (err) {
2939                         case ECONNABORTED:
2940                                 libscf_handle_rebind(h);
2941                                 ret = ECONNABORTED;
2942                                 goto get_inst;
2943 
2944                         case ENOENT:
2945                                 break;
2946 
2947                         case EINVAL:
2948                         case ENOTSUP:
2949                         default:
2950                                 bad_error("libscf_fmri_get_instance", err);
2951                         }
2952                 } else {
2953                         const char *f;
2954 
2955                         if (new) {
2956                                 err = libscf_delete_enable_ovr(inst);
2957                                 f = "libscf_delete_enable_ovr";
2958                         } else {
2959                                 err = libscf_set_enable_ovr(inst, 0);
2960                                 f = "libscf_set_enable_ovr";
2961                         }
2962                         scf_instance_destroy(inst);
2963                         switch (err) {
2964                         case 0:
2965                         case ECANCELED:
2966                                 break;
2967 
2968                         case ECONNABORTED:
2969                                 libscf_handle_rebind(h);
2970                                 /*
2971                                  * We must continue so the graph is updated,
2972                                  * but we must return ECONNABORTED so any
2973                                  * libscf state held by any callers is reset.
2974                                  */
2975                                 ret = ECONNABORTED;
2976                                 goto get_inst;
2977 
2978                         case EROFS:
2979                         case EPERM:
2980                                 log_error(LOG_WARNING,
2981                                     "Could not set %s/%s for %s: %s.\n",
2982                                     SCF_PG_GENERAL_OVR, SCF_PROPERTY_ENABLED,
2983                                     v->gv_name, strerror(err));
2984                                 break;
2985 
2986                         default:
2987                                 bad_error(f, err);
2988                         }
2989                 }
2990         }
2991 
2992         for (e = uu_list_first(v->gv_dependencies);
2993             e != NULL;
2994             e = uu_list_next(v->gv_dependencies, e)) {
2995                 r = eval_subgraph(e->ge_vertex, h);
2996                 if (r != 0) {
2997                         assert(r == ECONNABORTED);
2998                         ret = ECONNABORTED;
2999                 }
3000         }
3001 
3002         return (ret);
3003 }
3004 
3005 /*
3006  * Delete the (property group) dependencies of v & create new ones based on
3007  * inst.  If doing so would create a cycle, log a message and put the instance
3008  * into maintenance.  Update GV_INSUBGRAPH flags as necessary.  Returns 0 or
3009  * ECONNABORTED.
3010  */
3011 int
3012 refresh_vertex(graph_vertex_t *v, scf_instance_t *inst)
3013 {
3014         int err;
3015         int *path;
3016         char *fmri;
3017         int r;
3018         scf_handle_t *h = scf_instance_handle(inst);
3019         uu_list_t *old_deps;
3020         int ret = 0;
3021         graph_edge_t *e;
3022         graph_vertex_t *vv;
3023 
3024         assert(MUTEX_HELD(&dgraph_lock));
3025         assert(v->gv_type == GVT_INST);
3026 
3027         log_framework(LOG_DEBUG, "Graph engine: Refreshing %s.\n", v->gv_name);
3028 
3029         if (milestone > MILESTONE_NONE) {
3030                 /*
3031                  * In case some of v's dependencies are being deleted we must
3032                  * make a list of them now for GV_INSUBGRAPH-flag evaluation
3033                  * after the new dependencies are in place.
3034                  */
3035                 old_deps = startd_list_create(graph_edge_pool, NULL, 0);
3036 
3037                 err = uu_list_walk(v->gv_dependencies,
3038                     (uu_walk_fn_t *)append_svcs_or_insts, old_deps, 0);
3039                 assert(err == 0);
3040         }
3041 
3042         delete_instance_dependencies(v, B_FALSE);
3043 
3044         err = set_dependencies(v, inst, &path);
3045         switch (err) {
3046         case 0:
3047                 break;
3048 
3049         case ECONNABORTED:
3050                 ret = err;
3051                 goto out;
3052 
3053         case EINVAL:
3054         case ELOOP:
3055                 r = libscf_instance_get_fmri(inst, &fmri);
3056                 switch (r) {
3057                 case 0:
3058                         break;
3059 
3060                 case ECONNABORTED:
3061                         ret = ECONNABORTED;
3062                         goto out;
3063 
3064                 case ECANCELED:
3065                         ret = 0;
3066                         goto out;
3067 
3068                 default:
3069                         bad_error("libscf_instance_get_fmri", r);
3070                 }
3071 
3072                 if (err == EINVAL) {
3073                         log_error(LOG_ERR, "Transitioning %s "
3074                             "to maintenance due to misconfiguration.\n",
3075                             fmri ? fmri : "?");
3076                         vertex_send_event(v,
3077                             RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY);
3078                 } else {
3079                         handle_cycle(fmri, path);
3080                         vertex_send_event(v,
3081                             RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE);
3082                 }
3083                 startd_free(fmri, max_scf_fmri_size);
3084                 ret = 0;
3085                 goto out;
3086 
3087         default:
3088                 bad_error("set_dependencies", err);
3089         }
3090 
3091         if (milestone > MILESTONE_NONE) {
3092                 boolean_t aborted = B_FALSE;
3093 
3094                 for (e = uu_list_first(old_deps);
3095                     e != NULL;
3096                     e = uu_list_next(old_deps, e)) {
3097                         vv = e->ge_vertex;
3098 
3099                         if (vertex_unref(vv) == VERTEX_INUSE &&
3100                             eval_subgraph(vv, h) == ECONNABORTED)
3101                                 aborted = B_TRUE;
3102                 }
3103 
3104                 for (e = uu_list_first(v->gv_dependencies);
3105                     e != NULL;
3106                     e = uu_list_next(v->gv_dependencies, e)) {
3107                         if (eval_subgraph(e->ge_vertex, h) ==
3108                             ECONNABORTED)
3109                                 aborted = B_TRUE;
3110                 }
3111 
3112                 if (aborted) {
3113                         ret = ECONNABORTED;
3114                         goto out;
3115                 }
3116         }
3117 
3118         graph_start_if_satisfied(v);
3119 
3120         ret = 0;
3121 
3122 out:
3123         if (milestone > MILESTONE_NONE) {
3124                 void *cookie = NULL;
3125 
3126                 while ((e = uu_list_teardown(old_deps, &cookie)) != NULL)
3127                         startd_free(e, sizeof (*e));
3128 
3129                 uu_list_destroy(old_deps);
3130         }
3131 
3132         return (ret);
3133 }
3134 
3135 /*
3136  * Set up v according to inst.  That is, make sure it depends on its
3137  * restarter and set up its dependencies.  Send the ADD_INSTANCE command to
3138  * the restarter, and send ENABLE or DISABLE as appropriate.
3139  *
3140  * Returns 0 on success, ECONNABORTED on repository disconnection, or
3141  * ECANCELED if inst is deleted.
3142  */
3143 static int
3144 configure_vertex(graph_vertex_t *v, scf_instance_t *inst)
3145 {
3146         scf_handle_t *h;
3147         scf_propertygroup_t *pg;
3148         scf_snapshot_t *snap;
3149         char *restarter_fmri = startd_alloc(max_scf_value_size);
3150         int enabled, enabled_ovr;
3151         int err;
3152         int *path;
3153         int deathrow;
3154         int32_t tset;
3155 
3156         restarter_fmri[0] = '\0';
3157 
3158         assert(MUTEX_HELD(&dgraph_lock));
3159         assert(v->gv_type == GVT_INST);
3160         assert((v->gv_flags & GV_CONFIGURED) == 0);
3161 
3162         /* GV_INSUBGRAPH should already be set properly. */
3163         assert(should_be_in_subgraph(v) ==
3164             ((v->gv_flags & GV_INSUBGRAPH) != 0));
3165 
3166         /*
3167          * If the instance fmri is in the deathrow list then set the
3168          * GV_DEATHROW flag on the vertex and create and set to true the
3169          * SCF_PROPERTY_DEATHROW boolean property in the non-persistent
3170          * repository for this instance fmri.
3171          */
3172         if ((v->gv_flags & GV_DEATHROW) ||
3173             (is_fmri_in_deathrow(v->gv_name) == B_TRUE)) {
3174                 if ((v->gv_flags & GV_DEATHROW) == 0) {
3175                         /*
3176                          * Set flag GV_DEATHROW, create and set to true
3177                          * the SCF_PROPERTY_DEATHROW property in the
3178                          * non-persistent repository for this instance fmri.
3179                          */
3180                         v->gv_flags |= GV_DEATHROW;
3181 
3182                         switch (err = libscf_set_deathrow(inst, 1)) {
3183                         case 0:
3184                                 break;
3185 
3186                         case ECONNABORTED:
3187                         case ECANCELED:
3188                                 startd_free(restarter_fmri, max_scf_value_size);
3189                                 return (err);
3190 
3191                         case EROFS:
3192                                 log_error(LOG_WARNING, "Could not set %s/%s "
3193                                     "for deathrow %s: %s.\n",
3194                                     SCF_PG_DEATHROW, SCF_PROPERTY_DEATHROW,
3195                                     v->gv_name, strerror(err));
3196                                 break;
3197 
3198                         case EPERM:
3199                                 uu_die("Permission denied.\n");
3200                                 /* NOTREACHED */
3201 
3202                         default:
3203                                 bad_error("libscf_set_deathrow", err);
3204                         }
3205                         log_framework(LOG_DEBUG, "Deathrow, graph set %s.\n",
3206                             v->gv_name);
3207                 }
3208                 startd_free(restarter_fmri, max_scf_value_size);
3209                 return (0);
3210         }
3211 
3212         h = scf_instance_handle(inst);
3213 
3214         /*
3215          * Using a temporary deathrow boolean property, set through
3216          * libscf_set_deathrow(), only for fmris on deathrow, is necessary
3217          * because deathrow_fini() may already have been called, and in case
3218          * of a refresh, GV_DEATHROW may need to be set again.
3219          * libscf_get_deathrow() sets deathrow to 1 only if this instance
3220          * has a temporary boolean property named 'deathrow' valued true
3221          * in a property group 'deathrow', -1 or 0 in all other cases.
3222          */
3223         err = libscf_get_deathrow(h, inst, &deathrow);
3224         switch (err) {
3225         case 0:
3226                 break;
3227 
3228         case ECONNABORTED:
3229         case ECANCELED:
3230                 startd_free(restarter_fmri, max_scf_value_size);
3231                 return (err);
3232 
3233         default:
3234                 bad_error("libscf_get_deathrow", err);
3235         }
3236 
3237         if (deathrow == 1) {
3238                 v->gv_flags |= GV_DEATHROW;
3239                 startd_free(restarter_fmri, max_scf_value_size);
3240                 return (0);
3241         }
3242 
3243         log_framework(LOG_DEBUG, "Graph adding %s.\n", v->gv_name);
3244 
3245         /*
3246          * If the instance does not have a restarter property group,
3247          * initialize its state to uninitialized/none, in case the restarter
3248          * is not enabled.
3249          */
3250         pg = safe_scf_pg_create(h);
3251 
3252         if (scf_instance_get_pg(inst, SCF_PG_RESTARTER, pg) != 0) {
3253                 instance_data_t idata;
3254                 uint_t count = 0, msecs = ALLOC_DELAY;
3255 
3256                 switch (scf_error()) {
3257                 case SCF_ERROR_NOT_FOUND:
3258                         break;
3259 
3260                 case SCF_ERROR_CONNECTION_BROKEN:
3261                 default:
3262                         scf_pg_destroy(pg);
3263                         startd_free(restarter_fmri, max_scf_value_size);
3264                         return (ECONNABORTED);
3265 
3266                 case SCF_ERROR_DELETED:
3267                         scf_pg_destroy(pg);
3268                         startd_free(restarter_fmri, max_scf_value_size);
3269                         return (ECANCELED);
3270 
3271                 case SCF_ERROR_NOT_SET:
3272                         bad_error("scf_instance_get_pg", scf_error());
3273                 }
3274 
3275                 switch (err = libscf_instance_get_fmri(inst,
3276                     (char **)&idata.i_fmri)) {
3277                 case 0:
3278                         break;
3279 
3280                 case ECONNABORTED:
3281                 case ECANCELED:
3282                         scf_pg_destroy(pg);
3283                         startd_free(restarter_fmri, max_scf_value_size);
3284                         return (err);
3285 
3286                 default:
3287                         bad_error("libscf_instance_get_fmri", err);
3288                 }
3289 
3290                 idata.i_state = RESTARTER_STATE_NONE;
3291                 idata.i_next_state = RESTARTER_STATE_NONE;
3292 
3293 init_state:
3294                 switch (err = _restarter_commit_states(h, &idata,
3295                     RESTARTER_STATE_UNINIT, RESTARTER_STATE_NONE,
3296                     restarter_get_str_short(restarter_str_insert_in_graph))) {
3297                 case 0:
3298                         break;
3299 
3300                 case ENOMEM:
3301                         ++count;
3302                         if (count < ALLOC_RETRY) {
3303                                 (void) poll(NULL, 0, msecs);
3304                                 msecs *= ALLOC_DELAY_MULT;
3305                                 goto init_state;
3306                         }
3307 
3308                         uu_die("Insufficient memory.\n");
3309                         /* NOTREACHED */
3310 
3311                 case ECONNABORTED:
3312                         startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3313                         scf_pg_destroy(pg);
3314                         startd_free(restarter_fmri, max_scf_value_size);
3315                         return (ECONNABORTED);
3316 
3317                 case ENOENT:
3318                         startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3319                         scf_pg_destroy(pg);
3320                         startd_free(restarter_fmri, max_scf_value_size);
3321                         return (ECANCELED);
3322 
3323                 case EPERM:
3324                 case EACCES:
3325                 case EROFS:
3326                         log_error(LOG_NOTICE, "Could not initialize state for "
3327                             "%s: %s.\n", idata.i_fmri, strerror(err));
3328                         break;
3329 
3330                 case EINVAL:
3331                 default:
3332                         bad_error("_restarter_commit_states", err);
3333                 }
3334 
3335                 startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3336         }
3337 
3338         scf_pg_destroy(pg);
3339 
3340         if (milestone != NULL) {
3341                 /*
3342                  * Make sure the enable-override is set properly before we
3343                  * read whether we should be enabled.
3344                  */
3345                 if (milestone == MILESTONE_NONE ||
3346                     !(v->gv_flags & GV_INSUBGRAPH)) {
3347                         /*
3348                          * This might seem unjustified after the milestone
3349                          * transition has completed (non_subgraph_svcs == 0),
3350                          * but it's important because when we boot to
3351                          * a milestone, we set the milestone before populating
3352                          * the graph, and all of the new non-subgraph services
3353                          * need to be disabled here.
3354                          */
3355                         switch (err = libscf_set_enable_ovr(inst, 0)) {
3356                         case 0:
3357                                 break;
3358 
3359                         case ECONNABORTED:
3360                         case ECANCELED:
3361                                 startd_free(restarter_fmri, max_scf_value_size);
3362                                 return (err);
3363 
3364                         case EROFS:
3365                                 log_error(LOG_WARNING,
3366                                     "Could not set %s/%s for %s: %s.\n",
3367                                     SCF_PG_GENERAL_OVR, SCF_PROPERTY_ENABLED,
3368                                     v->gv_name, strerror(err));
3369                                 break;
3370 
3371                         case EPERM:
3372                                 uu_die("Permission denied.\n");
3373                                 /* NOTREACHED */
3374 
3375                         default:
3376                                 bad_error("libscf_set_enable_ovr", err);
3377                         }
3378                 } else {
3379                         assert(v->gv_flags & GV_INSUBGRAPH);
3380                         switch (err = libscf_delete_enable_ovr(inst)) {
3381                         case 0:
3382                                 break;
3383 
3384                         case ECONNABORTED:
3385                         case ECANCELED:
3386                                 startd_free(restarter_fmri, max_scf_value_size);
3387                                 return (err);
3388 
3389                         case EPERM:
3390                                 uu_die("Permission denied.\n");
3391                                 /* NOTREACHED */
3392 
3393                         default:
3394                                 bad_error("libscf_delete_enable_ovr", err);
3395                         }
3396                 }
3397         }
3398 
3399         err = libscf_get_basic_instance_data(h, inst, v->gv_name, &enabled,
3400             &enabled_ovr, &restarter_fmri);
3401         switch (err) {
3402         case 0:
3403                 break;
3404 
3405         case ECONNABORTED:
3406         case ECANCELED:
3407                 startd_free(restarter_fmri, max_scf_value_size);
3408                 return (err);
3409 
3410         case ENOENT:
3411                 log_framework(LOG_DEBUG,
3412                     "Ignoring %s because it has no general property group.\n",
3413                     v->gv_name);
3414                 startd_free(restarter_fmri, max_scf_value_size);
3415                 return (0);
3416 
3417         default:
3418                 bad_error("libscf_get_basic_instance_data", err);
3419         }
3420 
3421         if ((tset = libscf_get_stn_tset(inst)) == -1) {
3422                 log_framework(LOG_WARNING,
3423                     "Failed to get notification parameters for %s: %s\n",
3424                     v->gv_name, scf_strerror(scf_error()));
3425                 v->gv_stn_tset = 0;
3426         } else {
3427                 v->gv_stn_tset = tset;
3428         }
3429         if (strcmp(v->gv_name, SCF_INSTANCE_GLOBAL) == 0)
3430                 stn_global = v->gv_stn_tset;
3431 
3432         if (enabled == -1) {
3433                 startd_free(restarter_fmri, max_scf_value_size);
3434                 return (0);
3435         }
3436 
3437         v->gv_flags = (v->gv_flags & ~GV_ENBLD_NOOVR) |
3438             (enabled ? GV_ENBLD_NOOVR : 0);
3439 
3440         if (enabled_ovr != -1)
3441                 enabled = enabled_ovr;
3442 
3443         v->gv_state = RESTARTER_STATE_UNINIT;
3444 
3445         snap = libscf_get_or_make_running_snapshot(inst, v->gv_name, B_TRUE);
3446         scf_snapshot_destroy(snap);
3447 
3448         /* Set up the restarter. (Sends _ADD_INSTANCE on success.) */
3449         err = graph_change_restarter(v, restarter_fmri, h, &path);
3450         if (err != 0) {
3451                 instance_data_t idata;
3452                 uint_t count = 0, msecs = ALLOC_DELAY;
3453                 restarter_str_t reason;
3454 
3455                 if (err == ECONNABORTED) {
3456                         startd_free(restarter_fmri, max_scf_value_size);
3457                         return (err);
3458                 }
3459 
3460                 assert(err == EINVAL || err == ELOOP);
3461 
3462                 if (err == EINVAL) {
3463                         log_framework(LOG_ERR, emsg_invalid_restarter,
3464                             v->gv_name, restarter_fmri);
3465                         reason = restarter_str_invalid_restarter;
3466                 } else {
3467                         handle_cycle(v->gv_name, path);
3468                         reason = restarter_str_dependency_cycle;
3469                 }
3470 
3471                 startd_free(restarter_fmri, max_scf_value_size);
3472 
3473                 /*
3474                  * We didn't register the instance with the restarter, so we
3475                  * must set maintenance mode ourselves.
3476                  */
3477                 err = libscf_instance_get_fmri(inst, (char **)&idata.i_fmri);
3478                 if (err != 0) {
3479                         assert(err == ECONNABORTED || err == ECANCELED);
3480                         return (err);
3481                 }
3482 
3483                 idata.i_state = RESTARTER_STATE_NONE;
3484                 idata.i_next_state = RESTARTER_STATE_NONE;
3485 
3486 set_maint:
3487                 switch (err = _restarter_commit_states(h, &idata,
3488                     RESTARTER_STATE_MAINT, RESTARTER_STATE_NONE,
3489                     restarter_get_str_short(reason))) {
3490                 case 0:
3491                         break;
3492 
3493                 case ENOMEM:
3494                         ++count;
3495                         if (count < ALLOC_RETRY) {
3496                                 (void) poll(NULL, 0, msecs);
3497                                 msecs *= ALLOC_DELAY_MULT;
3498                                 goto set_maint;
3499                         }
3500 
3501                         uu_die("Insufficient memory.\n");
3502                         /* NOTREACHED */
3503 
3504                 case ECONNABORTED:
3505                         startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3506                         return (ECONNABORTED);
3507 
3508                 case ENOENT:
3509                         startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3510                         return (ECANCELED);
3511 
3512                 case EPERM:
3513                 case EACCES:
3514                 case EROFS:
3515                         log_error(LOG_NOTICE, "Could not initialize state for "
3516                             "%s: %s.\n", idata.i_fmri, strerror(err));
3517                         break;
3518 
3519                 case EINVAL:
3520                 default:
3521                         bad_error("_restarter_commit_states", err);
3522                 }
3523 
3524                 startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3525 
3526                 v->gv_state = RESTARTER_STATE_MAINT;
3527 
3528                 goto out;
3529         }
3530         startd_free(restarter_fmri, max_scf_value_size);
3531 
3532         /* Add all the other dependencies. */
3533         err = refresh_vertex(v, inst);
3534         if (err != 0) {
3535                 assert(err == ECONNABORTED);
3536                 return (err);
3537         }
3538 
3539 out:
3540         v->gv_flags |= GV_CONFIGURED;
3541 
3542         graph_enable_by_vertex(v, enabled, 0);
3543 
3544         return (0);
3545 }
3546 
3547 
3548 static void
3549 kill_user_procs(void)
3550 {
3551         (void) fputs("svc.startd: Killing user processes.\n", stdout);
3552 
3553         /*
3554          * Despite its name, killall's role is to get select user processes--
3555          * basically those representing terminal-based logins-- to die.  Victims
3556          * are located by killall in the utmp database.  Since these are most
3557          * often shell based logins, and many shells mask SIGTERM (but are
3558          * responsive to SIGHUP) we first HUP and then shortly thereafter
3559          * kill -9.
3560          */
3561         (void) fork_with_timeout("/usr/sbin/killall HUP", 1, 5);
3562         (void) fork_with_timeout("/usr/sbin/killall KILL", 1, 5);
3563 
3564         /*
3565          * Note the selection of user id's 0, 1 and 15, subsequently
3566          * inverted by -v.  15 is reserved for dladmd.  Yes, this is a
3567          * kludge-- a better policy is needed.
3568          *
3569          * Note that fork_with_timeout will only wait out the 1 second
3570          * "grace time" if pkill actually returns 0.  So if there are
3571          * no matches, this will run to completion much more quickly.
3572          */
3573         (void) fork_with_timeout("/usr/bin/pkill -TERM -v -u 0,1,15", 1, 5);
3574         (void) fork_with_timeout("/usr/bin/pkill -KILL -v -u 0,1,15", 1, 5);
3575 }
3576 
3577 static int
3578 exec_cmd(char * invoke, char * output)
3579 {
3580         FILE * cmd = popen(invoke, "r");
3581         if (! cmd) 
3582                 return 0;
3583         fgets(output, 512, cmd);
3584         if (! *output) {
3585                 pclose(cmd);
3586                 return 0;
3587         }
3588         output[strlen(output) - 2] = '\0';
3589         pclose(cmd);
3590         return 1;
3591 }
3592 
3593 static void
3594 do_uadmin(void)
3595 {
3596         const char * const resetting = "/etc/svc/volatile/resetting";
3597         int fd;
3598         struct statvfs vfs;
3599         time_t now;
3600         struct tm nowtm;
3601         char down_buf[256], time_buf[256];
3602         uintptr_t mdep;
3603 #if defined(__i386)
3604         grub_boot_args_t fbarg;
3605 #endif  /* __i386 */
3606 
3607         mdep = NULL;
3608         fd = creat(resetting, 0777);
3609         if (fd >= 0)
3610                 startd_close(fd);
3611         else
3612                 uu_warn("Could not create \"%s\"", resetting);
3613 
3614         /* Kill dhcpagent if we're not using nfs for root */
3615         if ((statvfs("/", &vfs) == 0) &&
3616             (strncmp(vfs.f_basetype, "nfs", sizeof ("nfs") - 1) != 0))
3617                 fork_with_timeout("/usr/bin/pkill -x -u 0 dhcpagent", 0, 5);
3618 
3619         /*
3620          * Call sync(2) now, before we kill off user processes.  This takes
3621          * advantage of the several seconds of pause we have before the
3622          * killalls are done.  Time we can make good use of to get pages
3623          * moving out to disk.
3624          *
3625          * Inside non-global zones, we don't bother, and it's better not to
3626          * anyway, since sync(2) can have system-wide impact.
3627          */
3628         if (getzoneid() == 0)
3629                 sync();
3630 
3631         kill_user_procs();
3632 
3633         /*
3634          * Note that this must come after the killing of user procs, since
3635          * killall relies on utmpx, and this command affects the contents of
3636          * said file.
3637          */
3638         if (access("/usr/lib/acct/closewtmp", X_OK) == 0)
3639                 fork_with_timeout("/usr/lib/acct/closewtmp", 0, 5);
3640 
3641         /*
3642          * For patches which may be installed as the system is shutting
3643          * down, we need to ensure, one more time, that the boot archive
3644          * really is up to date.
3645          */
3646         if (getzoneid() == 0 && access("/usr/sbin/bootadm", X_OK) == 0)
3647                 fork_with_timeout("/usr/sbin/bootadm -ea update_all", 0, 3600);
3648 
3649         /*
3650          * Right now, fast reboot is supported only on i386.
3651          * scf_is_fastboot_default() should take care of it.
3652          * If somehow we got there on unsupported platform -
3653          * print warning and fall back to regular reboot.
3654          */
3655         if (halting == AD_FASTREBOOT) {
3656 #if defined(__i386)
3657                 int rc;
3658 
3659                 if ((rc = exec_cmd("/sbin/grubadm --number -1 --get-opts", 
3660                         fbarg.gba_bootargs)) == 0) {
3661                         mdep = (uintptr_t)&fbarg.gba_bootargs;
3662                 } else {
3663                         /*
3664                          * Failed to read GRUB menu, fall back to normal reboot
3665                          */
3666                         halting = AD_BOOT;
3667                         uu_warn("Failed to process GRUB menu entry "
3668                             "for fast reboot.\n\t%s\n"
3669                             "Falling back to regular reboot.\n",
3670                             grub_strerror(rc));
3671                 }
3672 #else   /* __i386 */
3673                 halting = AD_BOOT;
3674                 uu_warn("Fast reboot configured, but not supported by "
3675                     "this ISA\n");
3676 #endif  /* __i386 */
3677         }
3678 
3679         fork_with_timeout("/sbin/umountall -l", 0, 5);
3680         fork_with_timeout("/sbin/umount /tmp /var/adm /var/run /var "
3681             ">/dev/null 2>&1", 0, 5);
3682 
3683         /*
3684          * Try to get to consistency for whatever UFS filesystems are left.
3685          * This is pretty expensive, so we save it for the end in the hopes of
3686          * minimizing what it must do.  The other option would be to start in
3687          * parallel with the killall's, but lockfs tends to throw out much more
3688          * than is needed, and so subsequent commands (like umountall) take a
3689          * long time to get going again.
3690          *
3691          * Inside of zones, we don't bother, since we're not about to terminate
3692          * the whole OS instance.
3693          *
3694          * On systems using only ZFS, this call to lockfs -fa is a no-op.
3695          */
3696         if (getzoneid() == 0) {
3697                 if (access("/usr/sbin/lockfs", X_OK) == 0)
3698                         fork_with_timeout("/usr/sbin/lockfs -fa", 0, 30);
3699 
3700                 sync(); /* once more, with feeling */
3701         }
3702 
3703         fork_with_timeout("/sbin/umount /usr >/dev/null 2>&1", 0, 5);
3704 
3705         /*
3706          * Construct and emit the last words from userland:
3707          * "<timestamp> The system is down.  Shutdown took <N> seconds."
3708          *
3709          * Normally we'd use syslog, but with /var and other things
3710          * potentially gone, try to minimize the external dependencies.
3711          */
3712         now = time(NULL);
3713         (void) localtime_r(&now, &nowtm);
3714 
3715         if (strftime(down_buf, sizeof (down_buf),
3716             "%b %e %T The system is down.", &nowtm) == 0) {
3717                 (void) strlcpy(down_buf, "The system is down.",
3718                     sizeof (down_buf));
3719         }
3720 
3721         if (halting_time != 0 && halting_time <= now) {
3722                 (void) snprintf(time_buf, sizeof (time_buf),
3723                     "  Shutdown took %lu seconds.", now - halting_time);
3724         } else {
3725                 time_buf[0] = '\0';
3726         }
3727         (void) printf("%s%s\n", down_buf, time_buf);
3728 
3729         (void) uadmin(A_SHUTDOWN, halting, mdep);
3730         uu_warn("uadmin() failed");
3731 
3732 #if defined(__i386)
3733         /* uadmin fail, cleanup grub_boot_args */
3734         if (halting == AD_FASTREBOOT)
3735                 grub_cleanup_boot_args(&fbarg);
3736 #endif  /* __i386 */
3737 
3738         if (remove(resetting) != 0 && errno != ENOENT)
3739                 uu_warn("Could not remove \"%s\"", resetting);
3740 }
3741 
3742 /*
3743  * If any of the up_svcs[] are online or satisfiable, return true.  If they are
3744  * all missing, disabled, in maintenance, or unsatisfiable, return false.
3745  */
3746 boolean_t
3747 can_come_up(void)
3748 {
3749         int i;
3750 
3751         assert(MUTEX_HELD(&dgraph_lock));
3752 
3753         /*
3754          * If we are booting to single user (boot -s),
3755          * SCF_MILESTONE_SINGLE_USER is needed to come up because startd
3756          * spawns sulogin after single-user is online (see specials.c).
3757          */
3758         i = (booting_to_single_user ? 0 : 1);
3759 
3760         for (; up_svcs[i] != NULL; ++i) {
3761                 if (up_svcs_p[i] == NULL) {
3762                         up_svcs_p[i] = vertex_get_by_name(up_svcs[i]);
3763 
3764                         if (up_svcs_p[i] == NULL)
3765                                 continue;
3766                 }
3767 
3768                 /*
3769                  * Ignore unconfigured services (the ones that have been
3770                  * mentioned in a dependency from other services, but do
3771                  * not exist in the repository).  Services which exist
3772                  * in the repository but don't have general/enabled
3773                  * property will be also ignored.
3774                  */
3775                 if (!(up_svcs_p[i]->gv_flags & GV_CONFIGURED))
3776                         continue;
3777 
3778                 switch (up_svcs_p[i]->gv_state) {
3779                 case RESTARTER_STATE_ONLINE:
3780                 case RESTARTER_STATE_DEGRADED:
3781                         /*
3782                          * Deactivate verbose boot once a login service has been
3783                          * reached.
3784                          */
3785                         st->st_log_login_reached = 1;
3786                         /*FALLTHROUGH*/
3787                 case RESTARTER_STATE_UNINIT:
3788                         return (B_TRUE);
3789 
3790                 case RESTARTER_STATE_OFFLINE:
3791                         if (instance_satisfied(up_svcs_p[i], B_TRUE) != -1)
3792                                 return (B_TRUE);
3793                         log_framework(LOG_DEBUG,
3794                             "can_come_up(): %s is unsatisfiable.\n",
3795                             up_svcs_p[i]->gv_name);
3796                         continue;
3797 
3798                 case RESTARTER_STATE_DISABLED:
3799                 case RESTARTER_STATE_MAINT:
3800                         log_framework(LOG_DEBUG,
3801                             "can_come_up(): %s is in state %s.\n",
3802                             up_svcs_p[i]->gv_name,
3803                             instance_state_str[up_svcs_p[i]->gv_state]);
3804                         continue;
3805 
3806                 default:
3807 #ifndef NDEBUG
3808                         uu_warn("%s:%d: Unexpected vertex state %d.\n",
3809                             __FILE__, __LINE__, up_svcs_p[i]->gv_state);
3810 #endif
3811                         abort();
3812                 }
3813         }
3814 
3815         /*
3816          * In the seed repository, console-login is unsatisfiable because
3817          * services are missing.  To behave correctly in that case we don't want
3818          * to return false until manifest-import is online.
3819          */
3820 
3821         if (manifest_import_p == NULL) {
3822                 manifest_import_p = vertex_get_by_name(manifest_import);
3823 
3824                 if (manifest_import_p == NULL)
3825                         return (B_FALSE);
3826         }
3827 
3828         switch (manifest_import_p->gv_state) {
3829         case RESTARTER_STATE_ONLINE:
3830         case RESTARTER_STATE_DEGRADED:
3831         case RESTARTER_STATE_DISABLED:
3832         case RESTARTER_STATE_MAINT:
3833                 break;
3834 
3835         case RESTARTER_STATE_OFFLINE:
3836                 if (instance_satisfied(manifest_import_p, B_TRUE) == -1)
3837                         break;
3838                 /* FALLTHROUGH */
3839 
3840         case RESTARTER_STATE_UNINIT:
3841                 return (B_TRUE);
3842         }
3843 
3844         return (B_FALSE);
3845 }
3846 
3847 /*
3848  * Runs sulogin.  Returns
3849  *   0 - success
3850  *   EALREADY - sulogin is already running
3851  *   EBUSY - console-login is running
3852  */
3853 static int
3854 run_sulogin(const char *msg)
3855 {
3856         graph_vertex_t *v;
3857 
3858         assert(MUTEX_HELD(&dgraph_lock));
3859 
3860         if (sulogin_running)
3861                 return (EALREADY);
3862 
3863         v = vertex_get_by_name(console_login_fmri);
3864         if (v != NULL && inst_running(v))
3865                 return (EBUSY);
3866 
3867         sulogin_running = B_TRUE;
3868 
3869         MUTEX_UNLOCK(&dgraph_lock);
3870 
3871         fork_sulogin(B_FALSE, msg);
3872 
3873         MUTEX_LOCK(&dgraph_lock);
3874 
3875         sulogin_running = B_FALSE;
3876 
3877         if (console_login_ready) {
3878                 v = vertex_get_by_name(console_login_fmri);
3879 
3880                 if (v != NULL && v->gv_state == RESTARTER_STATE_OFFLINE) {
3881                         if (v->gv_start_f == NULL)
3882                                 vertex_send_event(v,
3883                                     RESTARTER_EVENT_TYPE_START);
3884                         else
3885                                 v->gv_start_f(v);
3886                 }
3887 
3888                 console_login_ready = B_FALSE;
3889         }
3890 
3891         return (0);
3892 }
3893 
3894 /*
3895  * The sulogin thread runs sulogin while can_come_up() is false.  run_sulogin()
3896  * keeps sulogin from stepping on console-login's toes.
3897  */
3898 /* ARGSUSED */
3899 static void *
3900 sulogin_thread(void *unused)
3901 {
3902         MUTEX_LOCK(&dgraph_lock);
3903 
3904         assert(sulogin_thread_running);
3905 
3906         do {
3907                 (void) run_sulogin("Console login service(s) cannot run\n");
3908         } while (!can_come_up());
3909 
3910         sulogin_thread_running = B_FALSE;
3911         MUTEX_UNLOCK(&dgraph_lock);
3912 
3913         return (NULL);
3914 }
3915 
3916 /* ARGSUSED */
3917 void *
3918 single_user_thread(void *unused)
3919 {
3920         uint_t left;
3921         scf_handle_t *h;
3922         scf_instance_t *inst;
3923         scf_property_t *prop;
3924         scf_value_t *val;
3925         const char *msg;
3926         char *buf;
3927         int r;
3928 
3929         MUTEX_LOCK(&single_user_thread_lock);
3930         single_user_thread_count++;
3931 
3932         if (!booting_to_single_user)
3933                 kill_user_procs();
3934 
3935         if (go_single_user_mode || booting_to_single_user) {
3936                 msg = "SINGLE USER MODE\n";
3937         } else {
3938                 assert(go_to_level1);
3939 
3940                 fork_rc_script('1', "start", B_TRUE);
3941 
3942                 uu_warn("The system is ready for administration.\n");
3943 
3944                 msg = "";
3945         }
3946 
3947         MUTEX_UNLOCK(&single_user_thread_lock);
3948 
3949         for (;;) {
3950                 MUTEX_LOCK(&dgraph_lock);
3951                 r = run_sulogin(msg);
3952                 MUTEX_UNLOCK(&dgraph_lock);
3953                 if (r == 0)
3954                         break;
3955 
3956                 assert(r == EALREADY || r == EBUSY);
3957 
3958                 left = 3;
3959                 while (left > 0)
3960                         left = sleep(left);
3961         }
3962 
3963         MUTEX_LOCK(&single_user_thread_lock);
3964 
3965         /*
3966          * If another single user thread has started, let it finish changing
3967          * the run level.
3968          */
3969         if (single_user_thread_count > 1) {
3970                 single_user_thread_count--;
3971                 MUTEX_UNLOCK(&single_user_thread_lock);
3972                 return (NULL);
3973         }
3974 
3975         h = libscf_handle_create_bound_loop();
3976         inst = scf_instance_create(h);
3977         prop = safe_scf_property_create(h);
3978         val = safe_scf_value_create(h);
3979         buf = startd_alloc(max_scf_fmri_size);
3980 
3981 lookup:
3982         if (scf_handle_decode_fmri(h, SCF_SERVICE_STARTD, NULL, NULL, inst,
3983             NULL, NULL, SCF_DECODE_FMRI_EXACT) != 0) {
3984                 switch (scf_error()) {
3985                 case SCF_ERROR_NOT_FOUND:
3986                         r = libscf_create_self(h);
3987                         if (r == 0)
3988                                 goto lookup;
3989                         assert(r == ECONNABORTED);
3990                         /* FALLTHROUGH */
3991 
3992                 case SCF_ERROR_CONNECTION_BROKEN:
3993                         libscf_handle_rebind(h);
3994                         goto lookup;
3995 
3996                 case SCF_ERROR_INVALID_ARGUMENT:
3997                 case SCF_ERROR_CONSTRAINT_VIOLATED:
3998                 case SCF_ERROR_NOT_BOUND:
3999                 case SCF_ERROR_HANDLE_MISMATCH:
4000                 default:
4001                         bad_error("scf_handle_decode_fmri", scf_error());
4002                 }
4003         }
4004 
4005         MUTEX_LOCK(&dgraph_lock);
4006 
4007         r = scf_instance_delete_prop(inst, SCF_PG_OPTIONS_OVR,
4008             SCF_PROPERTY_MILESTONE);
4009         switch (r) {
4010         case 0:
4011         case ECANCELED:
4012                 break;
4013 
4014         case ECONNABORTED:
4015                 MUTEX_UNLOCK(&dgraph_lock);
4016                 libscf_handle_rebind(h);
4017                 goto lookup;
4018 
4019         case EPERM:
4020         case EACCES:
4021         case EROFS:
4022                 log_error(LOG_WARNING, "Could not clear temporary milestone: "
4023                     "%s.\n", strerror(r));
4024                 break;
4025 
4026         default:
4027                 bad_error("scf_instance_delete_prop", r);
4028         }
4029 
4030         MUTEX_UNLOCK(&dgraph_lock);
4031 
4032         r = libscf_get_milestone(inst, prop, val, buf, max_scf_fmri_size);
4033         switch (r) {
4034         case ECANCELED:
4035         case ENOENT:
4036         case EINVAL:
4037                 (void) strcpy(buf, "all");
4038                 /* FALLTHROUGH */
4039 
4040         case 0:
4041                 uu_warn("Returning to milestone %s.\n", buf);
4042                 break;
4043 
4044         case ECONNABORTED:
4045                 libscf_handle_rebind(h);
4046                 goto lookup;
4047 
4048         default:
4049                 bad_error("libscf_get_milestone", r);
4050         }
4051 
4052         r = dgraph_set_milestone(buf, h, B_FALSE);
4053         switch (r) {
4054         case 0:
4055         case ECONNRESET:
4056         case EALREADY:
4057         case EINVAL:
4058         case ENOENT:
4059                 break;
4060 
4061         default:
4062                 bad_error("dgraph_set_milestone", r);
4063         }
4064 
4065         /*
4066          * See graph_runlevel_changed().
4067          */
4068         MUTEX_LOCK(&dgraph_lock);
4069         utmpx_set_runlevel(target_milestone_as_runlevel(), 'S', B_TRUE);
4070         MUTEX_UNLOCK(&dgraph_lock);
4071 
4072         startd_free(buf, max_scf_fmri_size);
4073         scf_value_destroy(val);
4074         scf_property_destroy(prop);
4075         scf_instance_destroy(inst);
4076         scf_handle_destroy(h);
4077 
4078         /*
4079          * We'll give ourselves 3 seconds to respond to all of the enablings
4080          * that setting the milestone should have created before checking
4081          * whether to run sulogin.
4082          */
4083         left = 3;
4084         while (left > 0)
4085                 left = sleep(left);
4086 
4087         MUTEX_LOCK(&dgraph_lock);
4088         /*
4089          * Clearing these variables will allow the sulogin thread to run.  We
4090          * check here in case there aren't any more state updates anytime soon.
4091          */
4092         go_to_level1 = go_single_user_mode = booting_to_single_user = B_FALSE;
4093         if (!sulogin_thread_running && !can_come_up()) {
4094                 (void) startd_thread_create(sulogin_thread, NULL);
4095                 sulogin_thread_running = B_TRUE;
4096         }
4097         MUTEX_UNLOCK(&dgraph_lock);
4098         single_user_thread_count--;
4099         MUTEX_UNLOCK(&single_user_thread_lock);
4100         return (NULL);
4101 }
4102 
4103 
4104 /*
4105  * Dependency graph operations API.  These are handle-independent thread-safe
4106  * graph manipulation functions which are the entry points for the event
4107  * threads below.
4108  */
4109 
4110 /*
4111  * If a configured vertex exists for inst_fmri, return EEXIST.  If no vertex
4112  * exists for inst_fmri, add one.  Then fetch the restarter from inst, make
4113  * this vertex dependent on it, and send _ADD_INSTANCE to the restarter.
4114  * Fetch whether the instance should be enabled from inst and send _ENABLE or
4115  * _DISABLE as appropriate.  Finally rummage through inst's dependency
4116  * property groups and add vertices and edges as appropriate.  If anything
4117  * goes wrong after sending _ADD_INSTANCE, send _ADMIN_MAINT_ON to put the
4118  * instance in maintenance.  Don't send _START or _STOP until we get a state
4119  * update in case we're being restarted and the service is already running.
4120  *
4121  * To support booting to a milestone, we must also make sure all dependencies
4122  * encountered are configured, if they exist in the repository.
4123  *
4124  * Returns 0 on success, ECONNABORTED on repository disconnection, EINVAL if
4125  * inst_fmri is an invalid (or not canonical) FMRI, ECANCELED if inst is
4126  * deleted, or EEXIST if a configured vertex for inst_fmri already exists.
4127  */
4128 int
4129 dgraph_add_instance(const char *inst_fmri, scf_instance_t *inst,
4130     boolean_t lock_graph)
4131 {
4132         graph_vertex_t *v;
4133         int err;
4134 
4135         if (strcmp(inst_fmri, SCF_SERVICE_STARTD) == 0)
4136                 return (0);
4137 
4138         /* Check for a vertex for inst_fmri. */
4139         if (lock_graph) {
4140                 MUTEX_LOCK(&dgraph_lock);
4141         } else {
4142                 assert(MUTEX_HELD(&dgraph_lock));
4143         }
4144 
4145         v = vertex_get_by_name(inst_fmri);
4146 
4147         if (v != NULL) {
4148                 assert(v->gv_type == GVT_INST);
4149 
4150                 if (v->gv_flags & GV_CONFIGURED) {
4151                         if (lock_graph)
4152                                 MUTEX_UNLOCK(&dgraph_lock);
4153                         return (EEXIST);
4154                 }
4155         } else {
4156                 /* Add the vertex. */
4157                 err = graph_insert_vertex_unconfigured(inst_fmri, GVT_INST, 0,
4158                     RERR_NONE, &v);
4159                 if (err != 0) {
4160                         assert(err == EINVAL);
4161                         if (lock_graph)
4162                                 MUTEX_UNLOCK(&dgraph_lock);
4163                         return (EINVAL);
4164                 }
4165         }
4166 
4167         err = configure_vertex(v, inst);
4168 
4169         if (lock_graph)
4170                 MUTEX_UNLOCK(&dgraph_lock);
4171 
4172         return (err);
4173 }
4174 
4175 /*
4176  * Locate the vertex for this property group's instance.  If it doesn't exist
4177  * or is unconfigured, call dgraph_add_instance() & return.  Otherwise fetch
4178  * the restarter for the instance, and if it has changed, send
4179  * _REMOVE_INSTANCE to the old restarter, remove the dependency, make sure the
4180  * new restarter has a vertex, add a new dependency, and send _ADD_INSTANCE to
4181  * the new restarter.  Then fetch whether the instance should be enabled, and
4182  * if it is different from what we had, or if we changed the restarter, send
4183  * the appropriate _ENABLE or _DISABLE command.
4184  *
4185  * Returns 0 on success, ENOTSUP if the pg's parent is not an instance,
4186  * ECONNABORTED on repository disconnection, ECANCELED if the instance is
4187  * deleted, or -1 if the instance's general property group is deleted or if
4188  * its enabled property is misconfigured.
4189  */
4190 static int
4191 dgraph_update_general(scf_propertygroup_t *pg)
4192 {
4193         scf_handle_t *h;
4194         scf_instance_t *inst;
4195         char *fmri;
4196         char *restarter_fmri;
4197         graph_vertex_t *v;
4198         int err;
4199         int enabled, enabled_ovr;
4200         int oldflags;
4201 
4202         /* Find the vertex for this service */
4203         h = scf_pg_handle(pg);
4204 
4205         inst = safe_scf_instance_create(h);
4206 
4207         if (scf_pg_get_parent_instance(pg, inst) != 0) {
4208                 switch (scf_error()) {
4209                 case SCF_ERROR_CONSTRAINT_VIOLATED:
4210                         return (ENOTSUP);
4211 
4212                 case SCF_ERROR_CONNECTION_BROKEN:
4213                 default:
4214                         return (ECONNABORTED);
4215 
4216                 case SCF_ERROR_DELETED:
4217                         return (0);
4218 
4219                 case SCF_ERROR_NOT_SET:
4220                         bad_error("scf_pg_get_parent_instance", scf_error());
4221                 }
4222         }
4223 
4224         err = libscf_instance_get_fmri(inst, &fmri);
4225         switch (err) {
4226         case 0:
4227                 break;
4228 
4229         case ECONNABORTED:
4230                 scf_instance_destroy(inst);
4231                 return (ECONNABORTED);
4232 
4233         case ECANCELED:
4234                 scf_instance_destroy(inst);
4235                 return (0);
4236 
4237         default:
4238                 bad_error("libscf_instance_get_fmri", err);
4239         }
4240 
4241         log_framework(LOG_DEBUG,
4242             "Graph engine: Reloading general properties for %s.\n", fmri);
4243 
4244         MUTEX_LOCK(&dgraph_lock);
4245 
4246         v = vertex_get_by_name(fmri);
4247         if (v == NULL || !(v->gv_flags & GV_CONFIGURED)) {
4248                 /* Will get the up-to-date properties. */
4249                 MUTEX_UNLOCK(&dgraph_lock);
4250                 err = dgraph_add_instance(fmri, inst, B_TRUE);
4251                 startd_free(fmri, max_scf_fmri_size);
4252                 scf_instance_destroy(inst);
4253                 return (err == ECANCELED ? 0 : err);
4254         }
4255 
4256         /* Read enabled & restarter from repository. */
4257         restarter_fmri = startd_alloc(max_scf_value_size);
4258         err = libscf_get_basic_instance_data(h, inst, v->gv_name, &enabled,
4259             &enabled_ovr, &restarter_fmri);
4260         if (err != 0 || enabled == -1) {
4261                 MUTEX_UNLOCK(&dgraph_lock);
4262                 scf_instance_destroy(inst);
4263                 startd_free(fmri, max_scf_fmri_size);
4264 
4265                 switch (err) {
4266                 case ENOENT:
4267                 case 0:
4268                         startd_free(restarter_fmri, max_scf_value_size);
4269                         return (-1);
4270 
4271                 case ECONNABORTED:
4272                 case ECANCELED:
4273                         startd_free(restarter_fmri, max_scf_value_size);
4274                         return (err);
4275 
4276                 default:
4277                         bad_error("libscf_get_basic_instance_data", err);
4278                 }
4279         }
4280 
4281         oldflags = v->gv_flags;
4282         v->gv_flags = (v->gv_flags & ~GV_ENBLD_NOOVR) |
4283             (enabled ? GV_ENBLD_NOOVR : 0);
4284 
4285         if (enabled_ovr != -1)
4286                 enabled = enabled_ovr;
4287 
4288         /*
4289          * If GV_ENBLD_NOOVR has changed, then we need to re-evaluate the
4290          * subgraph.
4291          */
4292         if (milestone > MILESTONE_NONE && v->gv_flags != oldflags)
4293                 (void) eval_subgraph(v, h);
4294 
4295         scf_instance_destroy(inst);
4296 
4297         /* Ignore restarter change for now. */
4298 
4299         startd_free(restarter_fmri, max_scf_value_size);
4300         startd_free(fmri, max_scf_fmri_size);
4301 
4302         /*
4303          * Always send _ENABLE or _DISABLE.  We could avoid this if the
4304          * restarter didn't change and the enabled value didn't change, but
4305          * that's not easy to check and improbable anyway, so we'll just do
4306          * this.
4307          */
4308         graph_enable_by_vertex(v, enabled, 1);
4309 
4310         MUTEX_UNLOCK(&dgraph_lock);
4311 
4312         return (0);
4313 }
4314 
4315 /*
4316  * Delete all of the property group dependencies of v, update inst's running
4317  * snapshot, and add the dependencies in the new snapshot.  If any of the new
4318  * dependencies would create a cycle, send _ADMIN_MAINT_ON.  Otherwise
4319  * reevaluate v's dependencies, send _START or _STOP as appropriate, and do
4320  * the same for v's dependents.
4321  *
4322  * Returns
4323  *   0 - success
4324  *   ECONNABORTED - repository connection broken
4325  *   ECANCELED - inst was deleted
4326  *   EINVAL - inst is invalid (e.g., missing general/enabled)
4327  *   -1 - libscf_snapshots_refresh() failed
4328  */
4329 static int
4330 dgraph_refresh_instance(graph_vertex_t *v, scf_instance_t *inst)
4331 {
4332         int r;
4333         int enabled;
4334         int32_t tset;
4335 
4336         assert(MUTEX_HELD(&dgraph_lock));
4337         assert(v->gv_type == GVT_INST);
4338 
4339         /* Only refresh services with valid general/enabled properties. */
4340         r = libscf_get_basic_instance_data(scf_instance_handle(inst), inst,
4341             v->gv_name, &enabled, NULL, NULL);
4342         switch (r) {
4343         case 0:
4344                 break;
4345 
4346         case ECONNABORTED:
4347         case ECANCELED:
4348                 return (r);
4349 
4350         case ENOENT:
4351                 log_framework(LOG_DEBUG,
4352                     "Ignoring %s because it has no general property group.\n",
4353                     v->gv_name);
4354                 return (EINVAL);
4355 
4356         default:
4357                 bad_error("libscf_get_basic_instance_data", r);
4358         }
4359 
4360         if ((tset = libscf_get_stn_tset(inst)) == -1) {
4361                 log_framework(LOG_WARNING,
4362                     "Failed to get notification parameters for %s: %s\n",
4363                     v->gv_name, scf_strerror(scf_error()));
4364                 tset = 0;
4365         }
4366         v->gv_stn_tset = tset;
4367         if (strcmp(v->gv_name, SCF_INSTANCE_GLOBAL) == 0)
4368                 stn_global = tset;
4369 
4370         if (enabled == -1)
4371                 return (EINVAL);
4372 
4373         r = libscf_snapshots_refresh(inst, v->gv_name);
4374         if (r != 0) {
4375                 if (r != -1)
4376                         bad_error("libscf_snapshots_refresh", r);
4377 
4378                 /* error logged */
4379                 return (r);
4380         }
4381 
4382         r = refresh_vertex(v, inst);
4383         if (r != 0 && r != ECONNABORTED)
4384                 bad_error("refresh_vertex", r);
4385         return (r);
4386 }
4387 
4388 /*
4389  * Returns true only if none of this service's dependents are 'up' -- online
4390  * or degraded (offline is considered down in this situation). This function
4391  * is somehow similar to is_nonsubgraph_leaf() but works on subtrees.
4392  */
4393 static boolean_t
4394 insubtree_dependents_down(graph_vertex_t *v)
4395 {
4396         graph_vertex_t *vv;
4397         graph_edge_t *e;
4398 
4399         assert(MUTEX_HELD(&dgraph_lock));
4400 
4401         for (e = uu_list_first(v->gv_dependents); e != NULL;
4402             e = uu_list_next(v->gv_dependents, e)) {
4403                 vv = e->ge_vertex;
4404                 if (vv->gv_type == GVT_INST) {
4405                         if ((vv->gv_flags & GV_CONFIGURED) == 0)
4406                                 continue;
4407 
4408                         if ((vv->gv_flags & GV_TOOFFLINE) == 0)
4409                                 continue;
4410 
4411                         if ((vv->gv_state == RESTARTER_STATE_ONLINE) ||
4412                             (vv->gv_state == RESTARTER_STATE_DEGRADED))
4413                                 return (B_FALSE);
4414                 } else {
4415                         /*
4416                          * Skip all excluded and optional_all dependencies
4417                          * and decide whether to offline the service based
4418                          * on restart_on attribute.
4419                          */
4420                         if (is_depgrp_bypassed(vv))
4421                                 continue;
4422 
4423                         /*
4424                          * For dependency groups or service vertices, keep
4425                          * traversing to see if instances are running.
4426                          */
4427                         if (insubtree_dependents_down(vv) == B_FALSE)
4428                                 return (B_FALSE);
4429                 }
4430         }
4431 
4432         return (B_TRUE);
4433 }
4434 
4435 /*
4436  * Returns true only if none of this service's dependents are 'up' -- online,
4437  * degraded, or offline.
4438  */
4439 static int
4440 is_nonsubgraph_leaf(graph_vertex_t *v)
4441 {
4442         graph_vertex_t *vv;
4443         graph_edge_t *e;
4444 
4445         assert(MUTEX_HELD(&dgraph_lock));
4446 
4447         for (e = uu_list_first(v->gv_dependents);
4448             e != NULL;
4449             e = uu_list_next(v->gv_dependents, e)) {
4450 
4451                 vv = e->ge_vertex;
4452                 if (vv->gv_type == GVT_INST) {
4453                         if ((vv->gv_flags & GV_CONFIGURED) == 0)
4454                                 continue;
4455 
4456                         if (vv->gv_flags & GV_INSUBGRAPH)
4457                                 continue;
4458 
4459                         if (up_state(vv->gv_state))
4460                                 return (0);
4461                 } else {
4462                         /*
4463                          * For dependency group or service vertices, keep
4464                          * traversing to see if instances are running.
4465                          *
4466                          * We should skip exclude_all dependencies otherwise
4467                          * the vertex will never be considered as a leaf
4468                          * if the dependent is offline. The main reason for
4469                          * this is that disable_nonsubgraph_leaves() skips
4470                          * exclusion dependencies.
4471                          */
4472                         if (vv->gv_type == GVT_GROUP &&
4473                             vv->gv_depgroup == DEPGRP_EXCLUDE_ALL)
4474                                 continue;
4475 
4476                         if (!is_nonsubgraph_leaf(vv))
4477                                 return (0);
4478                 }
4479         }
4480 
4481         return (1);
4482 }
4483 
4484 /*
4485  * Disable v temporarily.  Attempt to do this by setting its enabled override
4486  * property in the repository.  If that fails, send a _DISABLE command.
4487  * Returns 0 on success and ECONNABORTED if the repository connection is
4488  * broken.
4489  */
4490 static int
4491 disable_service_temporarily(graph_vertex_t *v, scf_handle_t *h)
4492 {
4493         const char * const emsg = "Could not temporarily disable %s because "
4494             "%s.  Will stop service anyways.  Repository status for the "
4495             "service may be inaccurate.\n";
4496         const char * const emsg_cbroken =
4497             "the repository connection was broken";
4498 
4499         scf_instance_t *inst;
4500         int r;
4501 
4502         inst = scf_instance_create(h);
4503         if (inst == NULL) {
4504                 char buf[100];
4505 
4506                 (void) snprintf(buf, sizeof (buf),
4507                     "scf_instance_create() failed (%s)",
4508                     scf_strerror(scf_error()));
4509                 log_error(LOG_WARNING, emsg, v->gv_name, buf);
4510 
4511                 graph_enable_by_vertex(v, 0, 0);
4512                 return (0);
4513         }
4514 
4515         r = scf_handle_decode_fmri(h, v->gv_name, NULL, NULL, inst,
4516             NULL, NULL, SCF_DECODE_FMRI_EXACT);
4517         if (r != 0) {
4518                 switch (scf_error()) {
4519                 case SCF_ERROR_CONNECTION_BROKEN:
4520                         log_error(LOG_WARNING, emsg, v->gv_name, emsg_cbroken);
4521                         graph_enable_by_vertex(v, 0, 0);
4522                         return (ECONNABORTED);
4523 
4524                 case SCF_ERROR_NOT_FOUND:
4525                         return (0);
4526 
4527                 case SCF_ERROR_HANDLE_MISMATCH:
4528                 case SCF_ERROR_INVALID_ARGUMENT:
4529                 case SCF_ERROR_CONSTRAINT_VIOLATED:
4530                 case SCF_ERROR_NOT_BOUND:
4531                 default:
4532                         bad_error("scf_handle_decode_fmri",
4533                             scf_error());
4534                 }
4535         }
4536 
4537         r = libscf_set_enable_ovr(inst, 0);
4538         switch (r) {
4539         case 0:
4540                 scf_instance_destroy(inst);
4541                 return (0);
4542 
4543         case ECANCELED:
4544                 scf_instance_destroy(inst);
4545                 return (0);
4546 
4547         case ECONNABORTED:
4548                 log_error(LOG_WARNING, emsg, v->gv_name, emsg_cbroken);
4549                 graph_enable_by_vertex(v, 0, 0);
4550                 return (ECONNABORTED);
4551 
4552         case EPERM:
4553                 log_error(LOG_WARNING, emsg, v->gv_name,
4554                     "the repository denied permission");
4555                 graph_enable_by_vertex(v, 0, 0);
4556                 return (0);
4557 
4558         case EROFS:
4559                 log_error(LOG_WARNING, emsg, v->gv_name,
4560                     "the repository is read-only");
4561                 graph_enable_by_vertex(v, 0, 0);
4562                 return (0);
4563 
4564         default:
4565                 bad_error("libscf_set_enable_ovr", r);
4566                 /* NOTREACHED */
4567         }
4568 }
4569 
4570 /*
4571  * Of the transitive instance dependencies of v, offline those which are
4572  * in the subtree and which are leaves (i.e., have no dependents which are
4573  * "up").
4574  */
4575 void
4576 offline_subtree_leaves(graph_vertex_t *v, void *arg)
4577 {
4578         assert(MUTEX_HELD(&dgraph_lock));
4579 
4580         /* If v isn't an instance, recurse on its dependencies. */
4581         if (v->gv_type != GVT_INST) {
4582                 graph_walk_dependencies(v, offline_subtree_leaves, arg);
4583                 return;
4584         }
4585 
4586         /*
4587          * If v is not in the subtree, so should all of its dependencies,
4588          * so do nothing.
4589          */
4590         if ((v->gv_flags & GV_TOOFFLINE) == 0)
4591                 return;
4592 
4593         /* If v isn't a leaf because it's already down, recurse. */
4594         if (!up_state(v->gv_state)) {
4595                 graph_walk_dependencies(v, offline_subtree_leaves, arg);
4596                 return;
4597         }
4598 
4599         /* if v is a leaf, offline it or disable it if it's the last one */
4600         if (insubtree_dependents_down(v) == B_TRUE) {
4601                 if (v->gv_flags & GV_TODISABLE)
4602                         vertex_send_event(v,
4603                             RESTARTER_EVENT_TYPE_ADMIN_DISABLE);
4604                 else
4605                         offline_vertex(v);
4606         }
4607 }
4608 
4609 void
4610 graph_offline_subtree_leaves(graph_vertex_t *v, void *h)
4611 {
4612         graph_walk_dependencies(v, offline_subtree_leaves, (void *)h);
4613 }
4614 
4615 
4616 /*
4617  * Of the transitive instance dependencies of v, disable those which are not
4618  * in the subgraph and which are leaves (i.e., have no dependents which are
4619  * "up").
4620  */
4621 static void
4622 disable_nonsubgraph_leaves(graph_vertex_t *v, void *arg)
4623 {
4624         assert(MUTEX_HELD(&dgraph_lock));
4625 
4626         /*
4627          * We must skip exclusion dependencies because they are allowed to
4628          * complete dependency cycles.  This is correct because A's exclusion
4629          * dependency on B doesn't bear on the order in which they should be
4630          * stopped.  Indeed, the exclusion dependency should guarantee that
4631          * they are never online at the same time.
4632          */
4633         if (v->gv_type == GVT_GROUP && v->gv_depgroup == DEPGRP_EXCLUDE_ALL)
4634                 return;
4635 
4636         /* If v isn't an instance, recurse on its dependencies. */
4637         if (v->gv_type != GVT_INST)
4638                 goto recurse;
4639 
4640         if ((v->gv_flags & GV_CONFIGURED) == 0)
4641                 /*
4642                  * Unconfigured instances should have no dependencies, but in
4643                  * case they ever get them,
4644                  */
4645                 goto recurse;
4646 
4647         /*
4648          * If v is in the subgraph, so should all of its dependencies, so do
4649          * nothing.
4650          */
4651         if (v->gv_flags & GV_INSUBGRAPH)
4652                 return;
4653 
4654         /* If v isn't a leaf because it's already down, recurse. */
4655         if (!up_state(v->gv_state))
4656                 goto recurse;
4657 
4658         /* If v is disabled but not down yet, be patient. */
4659         if ((v->gv_flags & GV_ENABLED) == 0)
4660                 return;
4661 
4662         /* If v is a leaf, disable it. */
4663         if (is_nonsubgraph_leaf(v))
4664                 (void) disable_service_temporarily(v, (scf_handle_t *)arg);
4665 
4666         return;
4667 
4668 recurse:
4669         graph_walk_dependencies(v, disable_nonsubgraph_leaves, arg);
4670 }
4671 
4672 static int
4673 stn_restarter_state(restarter_instance_state_t rstate)
4674 {
4675         static const struct statemap {
4676                 restarter_instance_state_t restarter_state;
4677                 int scf_state;
4678         } map[] = {
4679                 { RESTARTER_STATE_UNINIT, SCF_STATE_UNINIT },
4680                 { RESTARTER_STATE_MAINT, SCF_STATE_MAINT },
4681                 { RESTARTER_STATE_OFFLINE, SCF_STATE_OFFLINE },
4682                 { RESTARTER_STATE_DISABLED, SCF_STATE_DISABLED },
4683                 { RESTARTER_STATE_ONLINE, SCF_STATE_ONLINE },
4684                 { RESTARTER_STATE_DEGRADED, SCF_STATE_DEGRADED }
4685         };
4686 
4687         int i;
4688 
4689         for (i = 0; i < sizeof (map) / sizeof (map[0]); i++) {
4690                 if (rstate == map[i].restarter_state)
4691                         return (map[i].scf_state);
4692         }
4693 
4694         return (-1);
4695 }
4696 
4697 /*
4698  * State transition counters
4699  * Not incremented atomically - indicative only
4700  */
4701 static uint64_t stev_ct_maint;
4702 static uint64_t stev_ct_hwerr;
4703 static uint64_t stev_ct_service;
4704 static uint64_t stev_ct_global;
4705 static uint64_t stev_ct_noprefs;
4706 static uint64_t stev_ct_from_uninit;
4707 static uint64_t stev_ct_bad_state;
4708 static uint64_t stev_ct_ovr_prefs;
4709 
4710 static void
4711 dgraph_state_transition_notify(graph_vertex_t *v,
4712     restarter_instance_state_t old_state, restarter_str_t reason)
4713 {
4714         restarter_instance_state_t new_state = v->gv_state;
4715         int stn_transition, maint;
4716         int from, to;
4717         nvlist_t *attr;
4718         fmev_pri_t pri = FMEV_LOPRI;
4719         int raise = 0;
4720 
4721         if ((from = stn_restarter_state(old_state)) == -1 ||
4722             (to = stn_restarter_state(new_state)) == -1) {
4723                 stev_ct_bad_state++;
4724                 return;
4725         }
4726 
4727         stn_transition = from << 16 | to;
4728 
4729         maint = (to == SCF_STATE_MAINT || from == SCF_STATE_MAINT);
4730 
4731         if (maint) {
4732                 /*
4733                  * All transitions to/from maintenance state must raise
4734                  * an event.
4735                  */
4736                 raise++;
4737                 pri = FMEV_HIPRI;
4738                 stev_ct_maint++;
4739         } else if (reason == restarter_str_ct_ev_hwerr) {
4740                 /*
4741                  * All transitions caused by hardware fault must raise
4742                  * an event
4743                  */
4744                 raise++;
4745                 pri = FMEV_HIPRI;
4746                 stev_ct_hwerr++;
4747         } else if (stn_transition & v->gv_stn_tset) {
4748                 /*
4749                  * Specifically enabled event.
4750                  */
4751                 raise++;
4752                 stev_ct_service++;
4753         } else if (from == SCF_STATE_UNINIT) {
4754                 /*
4755                  * Only raise these if specifically selected above.
4756                  */
4757                 stev_ct_from_uninit++;
4758         } else if (stn_transition & stn_global &&
4759             (IS_ENABLED(v) == 1 || to == SCF_STATE_DISABLED)) {
4760                 raise++;
4761                 stev_ct_global++;
4762         } else {
4763                 stev_ct_noprefs++;
4764         }
4765 
4766         if (info_events_all) {
4767                 stev_ct_ovr_prefs++;
4768                 raise++;
4769         }
4770         if (!raise)
4771                 return;
4772 
4773         if (nvlist_alloc(&attr, NV_UNIQUE_NAME, 0) != 0 ||
4774             nvlist_add_string(attr, "fmri", v->gv_name) != 0 ||
4775             nvlist_add_uint32(attr, "reason-version",
4776             restarter_str_version()) || nvlist_add_string(attr, "reason-short",
4777             restarter_get_str_short(reason)) != 0 ||
4778             nvlist_add_string(attr, "reason-long",
4779             restarter_get_str_long(reason)) != 0 ||
4780             nvlist_add_int32(attr, "transition", stn_transition) != 0) {
4781                 log_framework(LOG_WARNING,
4782                     "FMEV: %s could not create nvlist for transition "
4783                     "event: %s\n", v->gv_name, strerror(errno));
4784                 nvlist_free(attr);
4785                 return;
4786         }
4787 
4788         if (fmev_rspublish_nvl(FMEV_RULESET_SMF, "state-transition",
4789             instance_state_str[new_state], pri, attr) != FMEV_SUCCESS) {
4790                 log_framework(LOG_DEBUG,
4791                     "FMEV: %s failed to publish transition event: %s\n",
4792                     v->gv_name, fmev_strerror(fmev_errno));
4793                 nvlist_free(attr);
4794         }
4795 }
4796 
4797 /*
4798  * Find the vertex for inst_name.  If it doesn't exist, return ENOENT.
4799  * Otherwise set its state to state.  If the instance has entered a state
4800  * which requires automatic action, take it (Uninitialized: do
4801  * dgraph_refresh_instance() without the snapshot update.  Disabled: if the
4802  * instance should be enabled, send _ENABLE.  Offline: if the instance should
4803  * be disabled, send _DISABLE, and if its dependencies are satisfied, send
4804  * _START.  Online, Degraded: if the instance wasn't running, update its start
4805  * snapshot.  Maintenance: no action.)
4806  *
4807  * Also fails with ECONNABORTED, or EINVAL if state is invalid.
4808  */
4809 static int
4810 dgraph_set_instance_state(scf_handle_t *h, const char *inst_name,
4811     protocol_states_t *states)
4812 {
4813         graph_vertex_t *v;
4814         int err = 0;
4815         restarter_instance_state_t old_state;
4816         restarter_instance_state_t state = states->ps_state;
4817         restarter_error_t serr = states->ps_err;
4818 
4819         MUTEX_LOCK(&dgraph_lock);
4820 
4821         v = vertex_get_by_name(inst_name);
4822         if (v == NULL) {
4823                 MUTEX_UNLOCK(&dgraph_lock);
4824                 return (ENOENT);
4825         }
4826 
4827         assert(v->gv_type == GVT_INST);
4828 
4829         switch (state) {
4830         case RESTARTER_STATE_UNINIT:
4831         case RESTARTER_STATE_DISABLED:
4832         case RESTARTER_STATE_OFFLINE:
4833         case RESTARTER_STATE_ONLINE:
4834         case RESTARTER_STATE_DEGRADED:
4835         case RESTARTER_STATE_MAINT:
4836                 break;
4837 
4838         default:
4839                 MUTEX_UNLOCK(&dgraph_lock);
4840                 return (EINVAL);
4841         }
4842 
4843         log_framework(LOG_DEBUG, "Graph noting %s %s -> %s.\n", v->gv_name,
4844             instance_state_str[v->gv_state], instance_state_str[state]);
4845 
4846         old_state = v->gv_state;
4847         v->gv_state = state;
4848 
4849         v->gv_reason = states->ps_reason;
4850         err = gt_transition(h, v, serr, old_state);
4851         if (err == 0 && v->gv_state != old_state) {
4852                 dgraph_state_transition_notify(v, old_state, states->ps_reason);
4853         }
4854 
4855         MUTEX_UNLOCK(&dgraph_lock);
4856         return (err);
4857 }
4858 
4859 /*
4860  * Handle state changes during milestone shutdown.  See
4861  * dgraph_set_milestone().  If the repository connection is broken,
4862  * ECONNABORTED will be returned, though a _DISABLE command will be sent for
4863  * the vertex anyway.
4864  */
4865 int
4866 vertex_subgraph_dependencies_shutdown(scf_handle_t *h, graph_vertex_t *v,
4867     restarter_instance_state_t old_state)
4868 {
4869         int was_up, now_up;
4870         int ret = 0;
4871 
4872         assert(v->gv_type == GVT_INST);
4873 
4874         /* Don't care if we're not going to a milestone. */
4875         if (milestone == NULL)
4876                 return (0);
4877 
4878         /* Don't care if we already finished coming down. */
4879         if (non_subgraph_svcs == 0)
4880                 return (0);
4881 
4882         /* Don't care if the service is in the subgraph. */
4883         if (v->gv_flags & GV_INSUBGRAPH)
4884                 return (0);
4885 
4886         /*
4887          * Update non_subgraph_svcs.  It is the number of non-subgraph
4888          * services which are in online, degraded, or offline.
4889          */
4890 
4891         was_up = up_state(old_state);
4892         now_up = up_state(v->gv_state);
4893 
4894         if (!was_up && now_up) {
4895                 ++non_subgraph_svcs;
4896         } else if (was_up && !now_up) {
4897                 --non_subgraph_svcs;
4898 
4899                 if (non_subgraph_svcs == 0) {
4900                         if (halting != -1) {
4901                                 do_uadmin();
4902                         } else if (go_single_user_mode || go_to_level1) {
4903                                 (void) startd_thread_create(single_user_thread,
4904                                     NULL);
4905                         }
4906                         return (0);
4907                 }
4908         }
4909 
4910         /* If this service is a leaf, it should be disabled. */
4911         if ((v->gv_flags & GV_ENABLED) && is_nonsubgraph_leaf(v)) {
4912                 int r;
4913 
4914                 r = disable_service_temporarily(v, h);
4915                 switch (r) {
4916                 case 0:
4917                         break;
4918 
4919                 case ECONNABORTED:
4920                         ret = ECONNABORTED;
4921                         break;
4922 
4923                 default:
4924                         bad_error("disable_service_temporarily", r);
4925                 }
4926         }
4927 
4928         /*
4929          * If the service just came down, propagate the disable to the newly
4930          * exposed leaves.
4931          */
4932         if (was_up && !now_up)
4933                 graph_walk_dependencies(v, disable_nonsubgraph_leaves,
4934                     (void *)h);
4935 
4936         return (ret);
4937 }
4938 
4939 /*
4940  * Decide whether to start up an sulogin thread after a service is
4941  * finished changing state.  Only need to do the full can_come_up()
4942  * evaluation if an instance is changing state, we're not halfway through
4943  * loading the thread, and we aren't shutting down or going to the single
4944  * user milestone.
4945  */
4946 void
4947 graph_transition_sulogin(restarter_instance_state_t state,
4948     restarter_instance_state_t old_state)
4949 {
4950         assert(MUTEX_HELD(&dgraph_lock));
4951 
4952         if (state != old_state && st->st_load_complete &&
4953             !go_single_user_mode && !go_to_level1 &&
4954             halting == -1) {
4955                 if (!sulogin_thread_running && !can_come_up()) {
4956                         (void) startd_thread_create(sulogin_thread, NULL);
4957                         sulogin_thread_running = B_TRUE;
4958                 }
4959         }
4960 }
4961 
4962 /*
4963  * Propagate a start, stop event, or a satisfiability event.
4964  *
4965  * PROPAGATE_START and PROPAGATE_STOP simply propagate the transition event
4966  * to direct dependents.  PROPAGATE_SAT propagates a start then walks the
4967  * full dependent graph to check for newly satisfied nodes.  This is
4968  * necessary for cases when non-direct dependents may be effected but direct
4969  * dependents may not (e.g. for optional_all evaluations, see the
4970  * propagate_satbility() comments).
4971  *
4972  * PROPAGATE_SAT should be used whenever a non-running service moves into
4973  * a state which can satisfy optional dependencies, like disabled or
4974  * maintenance.
4975  */
4976 void
4977 graph_transition_propagate(graph_vertex_t *v, propagate_event_t type,
4978     restarter_error_t rerr)
4979 {
4980         if (type == PROPAGATE_STOP) {
4981                 graph_walk_dependents(v, propagate_stop, (void *)rerr);
4982         } else if (type == PROPAGATE_START || type == PROPAGATE_SAT) {
4983                 graph_walk_dependents(v, propagate_start, NULL);
4984 
4985                 if (type == PROPAGATE_SAT)
4986                         propagate_satbility(v);
4987         } else {
4988 #ifndef NDEBUG
4989                 uu_warn("%s:%d: Unexpected type value %d.\n",  __FILE__,
4990                     __LINE__, type);
4991 #endif
4992                 abort();
4993         }
4994 }
4995 
4996 /*
4997  * If a vertex for fmri exists and it is enabled, send _DISABLE to the
4998  * restarter.  If it is running, send _STOP.  Send _REMOVE_INSTANCE.  Delete
4999  * all property group dependencies, and the dependency on the restarter,
5000  * disposing of vertices as appropriate.  If other vertices depend on this
5001  * one, mark it unconfigured and return.  Otherwise remove the vertex.  Always
5002  * returns 0.
5003  */
5004 static int
5005 dgraph_remove_instance(const char *fmri, scf_handle_t *h)
5006 {
5007         graph_vertex_t *v;
5008         graph_edge_t *e;
5009         uu_list_t *old_deps;
5010         int err;
5011 
5012         log_framework(LOG_DEBUG, "Graph engine: Removing %s.\n", fmri);
5013 
5014         MUTEX_LOCK(&dgraph_lock);
5015 
5016         v = vertex_get_by_name(fmri);
5017         if (v == NULL) {
5018                 MUTEX_UNLOCK(&dgraph_lock);
5019                 return (0);
5020         }
5021 
5022         /* Send restarter delete event. */
5023         if (v->gv_flags & GV_CONFIGURED)
5024                 graph_unset_restarter(v);
5025 
5026         if (milestone > MILESTONE_NONE) {
5027                 /*
5028                  * Make a list of v's current dependencies so we can
5029                  * reevaluate their GV_INSUBGRAPH flags after the dependencies
5030                  * are removed.
5031                  */
5032                 old_deps = startd_list_create(graph_edge_pool, NULL, 0);
5033 
5034                 err = uu_list_walk(v->gv_dependencies,
5035                     (uu_walk_fn_t *)append_svcs_or_insts, old_deps, 0);
5036                 assert(err == 0);
5037         }
5038 
5039         delete_instance_dependencies(v, B_TRUE);
5040 
5041         /*
5042          * Deleting an instance can both satisfy and unsatisfy dependencies,
5043          * depending on their type.  First propagate the stop as a RERR_RESTART
5044          * event -- deletion isn't a fault, just a normal stop.  This gives
5045          * dependent services the chance to do a clean shutdown.  Then, mark
5046          * the service as unconfigured and propagate the start event for the
5047          * optional_all dependencies that might have become satisfied.
5048          */
5049         graph_walk_dependents(v, propagate_stop, (void *)RERR_RESTART);
5050 
5051         v->gv_flags &= ~GV_CONFIGURED;
5052         v->gv_flags &= ~GV_DEATHROW;
5053 
5054         graph_walk_dependents(v, propagate_start, NULL);
5055         propagate_satbility(v);
5056 
5057         /*
5058          * If there are no (non-service) dependents, the vertex can be
5059          * completely removed.
5060          */
5061         if (v != milestone && v->gv_refs == 0 &&
5062             uu_list_numnodes(v->gv_dependents) == 1)
5063                 remove_inst_vertex(v);
5064 
5065         if (milestone > MILESTONE_NONE) {
5066                 void *cookie = NULL;
5067 
5068                 while ((e = uu_list_teardown(old_deps, &cookie)) != NULL) {
5069                         v = e->ge_vertex;
5070 
5071                         if (vertex_unref(v) == VERTEX_INUSE)
5072                                 while (eval_subgraph(v, h) == ECONNABORTED)
5073                                         libscf_handle_rebind(h);
5074 
5075                         startd_free(e, sizeof (*e));
5076                 }
5077 
5078                 uu_list_destroy(old_deps);
5079         }
5080 
5081         MUTEX_UNLOCK(&dgraph_lock);
5082 
5083         return (0);
5084 }
5085 
5086 /*
5087  * Return the eventual (maybe current) milestone in the form of a
5088  * legacy runlevel.
5089  */
5090 static char
5091 target_milestone_as_runlevel()
5092 {
5093         assert(MUTEX_HELD(&dgraph_lock));
5094 
5095         if (milestone == NULL)
5096                 return ('3');
5097         else if (milestone == MILESTONE_NONE)
5098                 return ('0');
5099 
5100         if (strcmp(milestone->gv_name, multi_user_fmri) == 0)
5101                 return ('2');
5102         else if (strcmp(milestone->gv_name, single_user_fmri) == 0)
5103                 return ('S');
5104         else if (strcmp(milestone->gv_name, multi_user_svr_fmri) == 0)
5105                 return ('3');
5106 
5107 #ifndef NDEBUG
5108         (void) fprintf(stderr, "%s:%d: Unknown milestone name \"%s\".\n",
5109             __FILE__, __LINE__, milestone->gv_name);
5110 #endif
5111         abort();
5112         /* NOTREACHED */
5113 }
5114 
5115 static struct {
5116         char    rl;
5117         int     sig;
5118 } init_sigs[] = {
5119         { 'S', SIGBUS },
5120         { '0', SIGINT },
5121         { '1', SIGQUIT },
5122         { '2', SIGILL },
5123         { '3', SIGTRAP },
5124         { '4', SIGIOT },
5125         { '5', SIGEMT },
5126         { '6', SIGFPE },
5127         { 0, 0 }
5128 };
5129 
5130 static void
5131 signal_init(char rl)
5132 {
5133         pid_t init_pid;
5134         int i;
5135 
5136         assert(MUTEX_HELD(&dgraph_lock));
5137 
5138         if (zone_getattr(getzoneid(), ZONE_ATTR_INITPID, &init_pid,
5139             sizeof (init_pid)) != sizeof (init_pid)) {
5140                 log_error(LOG_NOTICE, "Could not get pid to signal init.\n");
5141                 return;
5142         }
5143 
5144         for (i = 0; init_sigs[i].rl != 0; ++i)
5145                 if (init_sigs[i].rl == rl)
5146                         break;
5147 
5148         if (init_sigs[i].rl != 0) {
5149                 if (kill(init_pid, init_sigs[i].sig) != 0) {
5150                         switch (errno) {
5151                         case EPERM:
5152                         case ESRCH:
5153                                 log_error(LOG_NOTICE, "Could not signal init: "
5154                                     "%s.\n", strerror(errno));
5155                                 break;
5156 
5157                         case EINVAL:
5158                         default:
5159                                 bad_error("kill", errno);
5160                         }
5161                 }
5162         }
5163 }
5164 
5165 /*
5166  * This is called when one of the major milestones changes state, or when
5167  * init is signalled and tells us it was told to change runlevel.  We wait
5168  * to reach the milestone because this allows /etc/inittab entries to retain
5169  * some boot ordering: historically, entries could place themselves before/after
5170  * the running of /sbin/rcX scripts but we can no longer make the
5171  * distinction because the /sbin/rcX scripts no longer exist as punctuation
5172  * marks in /etc/inittab.
5173  *
5174  * Also, we only trigger an update when we reach the eventual target
5175  * milestone: without this, an /etc/inittab entry marked only for
5176  * runlevel 2 would be executed for runlevel 3, which is not how
5177  * /etc/inittab entries work.
5178  *
5179  * If we're single user coming online, then we set utmpx to the target
5180  * runlevel so that legacy scripts can work as expected.
5181  */
5182 static void
5183 graph_runlevel_changed(char rl, int online)
5184 {
5185         char trl;
5186 
5187         assert(MUTEX_HELD(&dgraph_lock));
5188 
5189         trl = target_milestone_as_runlevel();
5190 
5191         if (online) {
5192                 if (rl == trl) {
5193                         current_runlevel = trl;
5194                         signal_init(trl);
5195                 } else if (rl == 'S') {
5196                         /*
5197                          * At boot, set the entry early for the benefit of the
5198                          * legacy init scripts.
5199                          */
5200                         utmpx_set_runlevel(trl, 'S', B_FALSE);
5201                 }
5202         } else {
5203                 if (rl == '3' && trl == '2') {
5204                         current_runlevel = trl;
5205                         signal_init(trl);
5206                 } else if (rl == '2' && trl == 'S') {
5207                         current_runlevel = trl;
5208                         signal_init(trl);
5209                 }
5210         }
5211 }
5212 
5213 /*
5214  * Move to a backwards-compatible runlevel by executing the appropriate
5215  * /etc/rc?.d/K* scripts and/or setting the milestone.
5216  *
5217  * Returns
5218  *   0 - success
5219  *   ECONNRESET - success, but handle was reset
5220  *   ECONNABORTED - repository connection broken
5221  *   ECANCELED - pg was deleted
5222  */
5223 static int
5224 dgraph_set_runlevel(scf_propertygroup_t *pg, scf_property_t *prop)
5225 {
5226         char rl;
5227         scf_handle_t *h;
5228         int r;
5229         const char *ms = NULL;  /* what to commit as options/milestone */
5230         boolean_t rebound = B_FALSE;
5231         int mark_rl = 0;
5232 
5233         const char * const stop = "stop";
5234 
5235         r = libscf_extract_runlevel(prop, &rl);
5236         switch (r) {
5237         case 0:
5238                 break;
5239 
5240         case ECONNABORTED:
5241         case ECANCELED:
5242                 return (r);
5243 
5244         case EINVAL:
5245         case ENOENT:
5246                 log_error(LOG_WARNING, "runlevel property is misconfigured; "
5247                     "ignoring.\n");
5248                 /* delete the bad property */
5249                 goto nolock_out;
5250 
5251         default:
5252                 bad_error("libscf_extract_runlevel", r);
5253         }
5254 
5255         switch (rl) {
5256         case 's':
5257                 rl = 'S';
5258                 /* FALLTHROUGH */
5259 
5260         case 'S':
5261         case '2':
5262         case '3':
5263                 /*
5264                  * These cases cause a milestone change, so
5265                  * graph_runlevel_changed() will eventually deal with
5266                  * signalling init.
5267                  */
5268                 break;
5269 
5270         case '0':
5271         case '1':
5272         case '4':
5273         case '5':
5274         case '6':
5275                 mark_rl = 1;
5276                 break;
5277 
5278         default:
5279                 log_framework(LOG_NOTICE, "Unknown runlevel '%c'.\n", rl);
5280                 ms = NULL;
5281                 goto nolock_out;
5282         }
5283 
5284         h = scf_pg_handle(pg);
5285 
5286         MUTEX_LOCK(&dgraph_lock);
5287 
5288         /*
5289          * Since this triggers no milestone changes, force it by hand.
5290          */
5291         if (current_runlevel == '4' && rl == '3')
5292                 mark_rl = 1;
5293 
5294         /*
5295          * 1. If we are here after an "init X":
5296          *
5297          * init X
5298          *      init/lscf_set_runlevel()
5299          *              process_pg_event()
5300          *              dgraph_set_runlevel()
5301          *
5302          * then we haven't passed through graph_runlevel_changed() yet,
5303          * therefore 'current_runlevel' has not changed for sure but 'rl' has.
5304          * In consequence, if 'rl' is lower than 'current_runlevel', we change
5305          * the system runlevel and execute the appropriate /etc/rc?.d/K* scripts
5306          * past this test.
5307          *
5308          * 2. On the other hand, if we are here after a "svcadm milestone":
5309          *
5310          * svcadm milestone X
5311          *      dgraph_set_milestone()
5312          *              handle_graph_update_event()
5313          *              dgraph_set_instance_state()
5314          *              graph_post_X_[online|offline]()
5315          *              graph_runlevel_changed()
5316          *              signal_init()
5317          *                      init/lscf_set_runlevel()
5318          *                              process_pg_event()
5319          *                              dgraph_set_runlevel()
5320          *
5321          * then we already passed through graph_runlevel_changed() (by the way
5322          * of dgraph_set_milestone()) and 'current_runlevel' may have changed
5323          * and already be equal to 'rl' so we are going to return immediately
5324          * from dgraph_set_runlevel() without changing the system runlevel and
5325          * without executing the /etc/rc?.d/K* scripts.
5326          */
5327         if (rl == current_runlevel) {
5328                 ms = NULL;
5329                 goto out;
5330         }
5331 
5332         log_framework(LOG_DEBUG, "Changing to runlevel '%c'.\n", rl);
5333 
5334         /*
5335          * Make sure stop rc scripts see the new settings via who -r.
5336          */
5337         utmpx_set_runlevel(rl, current_runlevel, B_TRUE);
5338 
5339         /*
5340          * Some run levels don't have a direct correspondence to any
5341          * milestones, so we have to signal init directly.
5342          */
5343         if (mark_rl) {
5344                 current_runlevel = rl;
5345                 signal_init(rl);
5346         }
5347 
5348         switch (rl) {
5349         case 'S':
5350                 uu_warn("The system is coming down for administration.  "
5351                     "Please wait.\n");
5352                 fork_rc_script(rl, stop, B_FALSE);
5353                 ms = single_user_fmri;
5354                 go_single_user_mode = B_TRUE;
5355                 break;
5356 
5357         case '0':
5358                 halting_time = time(NULL);
5359                 fork_rc_script(rl, stop, B_TRUE);
5360                 halting = AD_HALT;
5361                 goto uadmin;
5362 
5363         case '5':
5364                 halting_time = time(NULL);
5365                 fork_rc_script(rl, stop, B_TRUE);
5366                 halting = AD_POWEROFF;
5367                 goto uadmin;
5368 
5369         case '6':
5370                 halting_time = time(NULL);
5371                 fork_rc_script(rl, stop, B_TRUE);
5372                 if (scf_is_fastboot_default() && getzoneid() == GLOBAL_ZONEID)
5373                         halting = AD_FASTREBOOT;
5374                 else
5375                         halting = AD_BOOT;
5376 
5377 uadmin:
5378                 uu_warn("The system is coming down.  Please wait.\n");
5379                 ms = "none";
5380 
5381                 /*
5382                  * We can't wait until all services are offline since this
5383                  * thread is responsible for taking them offline.  Instead we
5384                  * set halting to the second argument for uadmin() and call
5385                  * do_uadmin() from dgraph_set_instance_state() when
5386                  * appropriate.
5387                  */
5388                 break;
5389 
5390         case '1':
5391                 if (current_runlevel != 'S') {
5392                         uu_warn("Changing to state 1.\n");
5393                         fork_rc_script(rl, stop, B_FALSE);
5394                 } else {
5395                         uu_warn("The system is coming up for administration.  "
5396                             "Please wait.\n");
5397                 }
5398                 ms = single_user_fmri;
5399                 go_to_level1 = B_TRUE;
5400                 break;
5401 
5402         case '2':
5403                 if (current_runlevel == '3' || current_runlevel == '4')
5404                         fork_rc_script(rl, stop, B_FALSE);
5405                 ms = multi_user_fmri;
5406                 break;
5407 
5408         case '3':
5409         case '4':
5410                 ms = "all";
5411                 break;
5412 
5413         default:
5414 #ifndef NDEBUG
5415                 (void) fprintf(stderr, "%s:%d: Uncaught case %d ('%c').\n",
5416                     __FILE__, __LINE__, rl, rl);
5417 #endif
5418                 abort();
5419         }
5420 
5421 out:
5422         MUTEX_UNLOCK(&dgraph_lock);
5423 
5424 nolock_out:
5425         switch (r = libscf_clear_runlevel(pg, ms)) {
5426         case 0:
5427                 break;
5428 
5429         case ECONNABORTED:
5430                 libscf_handle_rebind(h);
5431                 rebound = B_TRUE;
5432                 goto nolock_out;
5433 
5434         case ECANCELED:
5435                 break;
5436 
5437         case EPERM:
5438         case EACCES:
5439         case EROFS:
5440                 log_error(LOG_NOTICE, "Could not delete \"%s/%s\" property: "
5441                     "%s.\n", SCF_PG_OPTIONS, "runlevel", strerror(r));
5442                 break;
5443 
5444         default:
5445                 bad_error("libscf_clear_runlevel", r);
5446         }
5447 
5448         return (rebound ? ECONNRESET : 0);
5449 }
5450 
5451 /*
5452  * mark_subtree walks the dependents and add the GV_TOOFFLINE flag
5453  * to the instances that are supposed to go offline during an
5454  * administrative disable operation.
5455  */
5456 static int
5457 mark_subtree(graph_edge_t *e, void *arg)
5458 {
5459         graph_vertex_t *v;
5460         int r;
5461 
5462         v = e->ge_vertex;
5463 
5464         /* If it's already in the subgraph, skip. */
5465         if (v->gv_flags & GV_TOOFFLINE)
5466                 return (UU_WALK_NEXT);
5467 
5468         switch (v->gv_type) {
5469         case GVT_INST:
5470                 /* If the instance is already disabled, skip it. */
5471                 if (!(v->gv_flags & GV_ENABLED))
5472                         return (UU_WALK_NEXT);
5473 
5474                 v->gv_flags |= GV_TOOFFLINE;
5475                 log_framework(LOG_DEBUG, "%s added to subtree\n", v->gv_name);
5476                 break;
5477         case GVT_GROUP:
5478                 /*
5479                  * Skip all excluded and optional_all dependencies and decide
5480                  * whether to offline the service based on restart_on attribute.
5481                  */
5482                 if (is_depgrp_bypassed(v))
5483                         return (UU_WALK_NEXT);
5484                 break;
5485         }
5486 
5487         r = uu_list_walk(v->gv_dependents, (uu_walk_fn_t *)mark_subtree, arg,
5488             0);
5489         assert(r == 0);
5490         return (UU_WALK_NEXT);
5491 }
5492 
5493 static int
5494 mark_subgraph(graph_edge_t *e, void *arg)
5495 {
5496         graph_vertex_t *v;
5497         int r;
5498         int optional = (int)arg;
5499 
5500         v = e->ge_vertex;
5501 
5502         /* If it's already in the subgraph, skip. */
5503         if (v->gv_flags & GV_INSUBGRAPH)
5504                 return (UU_WALK_NEXT);
5505 
5506         /*
5507          * Keep track if walk has entered an optional dependency group
5508          */
5509         if (v->gv_type == GVT_GROUP && v->gv_depgroup == DEPGRP_OPTIONAL_ALL) {
5510                 optional = 1;
5511         }
5512         /*
5513          * Quit if we are in an optional dependency group and the instance
5514          * is disabled
5515          */
5516         if (optional && (v->gv_type == GVT_INST) &&
5517             (!(v->gv_flags & GV_ENBLD_NOOVR)))
5518                 return (UU_WALK_NEXT);
5519 
5520         v->gv_flags |= GV_INSUBGRAPH;
5521 
5522         /* Skip all excluded dependencies. */
5523         if (v->gv_type == GVT_GROUP && v->gv_depgroup == DEPGRP_EXCLUDE_ALL)
5524                 return (UU_WALK_NEXT);
5525 
5526         r = uu_list_walk(v->gv_dependencies, (uu_walk_fn_t *)mark_subgraph,
5527             (void *)optional, 0);
5528         assert(r == 0);
5529         return (UU_WALK_NEXT);
5530 }
5531 
5532 /*
5533  * Bring down all services which are not dependencies of fmri.  The
5534  * dependencies of fmri (direct & indirect) will constitute the "subgraph",
5535  * and will have the GV_INSUBGRAPH flag set.  The rest must be brought down,
5536  * which means the state is "disabled", "maintenance", or "uninitialized".  We
5537  * could consider "offline" to be down, and refrain from sending start
5538  * commands for such services, but that's not strictly necessary, so we'll
5539  * decline to intrude on the state machine.  It would probably confuse users
5540  * anyway.
5541  *
5542  * The services should be brought down in reverse-dependency order, so we
5543  * can't do it all at once here.  We initiate by override-disabling the leaves
5544  * of the dependency tree -- those services which are up but have no
5545  * dependents which are up.  When they come down,
5546  * vertex_subgraph_dependencies_shutdown() will override-disable the newly
5547  * exposed leaves.  Perseverance will ensure completion.
5548  *
5549  * Sometimes we need to take action when the transition is complete, like
5550  * start sulogin or halt the system.  To tell when we're done, we initialize
5551  * non_subgraph_svcs here to be the number of services which need to come
5552  * down.  As each does, we decrement the counter.  When it hits zero, we take
5553  * the appropriate action.  See vertex_subgraph_dependencies_shutdown().
5554  *
5555  * In case we're coming up, we also remove any enable-overrides for the
5556  * services which are dependencies of fmri.
5557  *
5558  * If norepository is true, the function will not change the repository.
5559  *
5560  * The decision to change the system run level in accordance with the milestone
5561  * is taken in dgraph_set_runlevel().
5562  *
5563  * Returns
5564  *   0 - success
5565  *   ECONNRESET - success, but handle was rebound
5566  *   EINVAL - fmri is invalid (error is logged)
5567  *   EALREADY - the milestone is already set to fmri
5568  *   ENOENT - a configured vertex does not exist for fmri (an error is logged)
5569  */
5570 static int
5571 dgraph_set_milestone(const char *fmri, scf_handle_t *h, boolean_t norepository)
5572 {
5573         const char *cfmri, *fs;
5574         graph_vertex_t *nm, *v;
5575         int ret = 0, r;
5576         scf_instance_t *inst;
5577         boolean_t isall, isnone, rebound = B_FALSE;
5578 
5579         /* Validate fmri */
5580         isall = (strcmp(fmri, "all") == 0);
5581         isnone = (strcmp(fmri, "none") == 0);
5582 
5583         if (!isall && !isnone) {
5584                 if (fmri_canonify(fmri, (char **)&cfmri, B_FALSE) == EINVAL)
5585                         goto reject;
5586 
5587                 if (strcmp(cfmri, single_user_fmri) != 0 &&
5588                     strcmp(cfmri, multi_user_fmri) != 0 &&
5589                     strcmp(cfmri, multi_user_svr_fmri) != 0) {
5590                         startd_free((void *)cfmri, max_scf_fmri_size);
5591 reject:
5592                         log_framework(LOG_WARNING,
5593                             "Rejecting request for invalid milestone \"%s\".\n",
5594                             fmri);
5595                         return (EINVAL);
5596                 }
5597         }
5598 
5599         inst = safe_scf_instance_create(h);
5600 
5601         MUTEX_LOCK(&dgraph_lock);
5602 
5603         if (milestone == NULL) {
5604                 if (isall) {
5605                         log_framework(LOG_DEBUG,
5606                             "Milestone already set to all.\n");
5607                         ret = EALREADY;
5608                         goto out;
5609                 }
5610         } else if (milestone == MILESTONE_NONE) {
5611                 if (isnone) {
5612                         log_framework(LOG_DEBUG,
5613                             "Milestone already set to none.\n");
5614                         ret = EALREADY;
5615                         goto out;
5616                 }
5617         } else {
5618                 if (!isall && !isnone &&
5619                     strcmp(cfmri, milestone->gv_name) == 0) {
5620                         log_framework(LOG_DEBUG,
5621                             "Milestone already set to %s.\n", cfmri);
5622                         ret = EALREADY;
5623                         goto out;
5624                 }
5625         }
5626 
5627         if (!isall && !isnone) {
5628                 nm = vertex_get_by_name(cfmri);
5629                 if (nm == NULL || !(nm->gv_flags & GV_CONFIGURED)) {
5630                         log_framework(LOG_WARNING, "Cannot set milestone to %s "
5631                             "because no such service exists.\n", cfmri);
5632                         ret = ENOENT;
5633                         goto out;
5634                 }
5635         }
5636 
5637         log_framework(LOG_DEBUG, "Changing milestone to %s.\n", fmri);
5638 
5639         /*
5640          * Set milestone, removing the old one if this was the last reference.
5641          */
5642         if (milestone > MILESTONE_NONE)
5643                 (void) vertex_unref(milestone);
5644 
5645         if (isall)
5646                 milestone = NULL;
5647         else if (isnone)
5648                 milestone = MILESTONE_NONE;
5649         else {
5650                 milestone = nm;
5651                 /* milestone should count as a reference */
5652                 vertex_ref(milestone);
5653         }
5654 
5655         /* Clear all GV_INSUBGRAPH bits. */
5656         for (v = uu_list_first(dgraph); v != NULL; v = uu_list_next(dgraph, v))
5657                 v->gv_flags &= ~GV_INSUBGRAPH;
5658 
5659         if (!isall && !isnone) {
5660                 /* Set GV_INSUBGRAPH for milestone & descendents. */
5661                 milestone->gv_flags |= GV_INSUBGRAPH;
5662 
5663                 r = uu_list_walk(milestone->gv_dependencies,
5664                     (uu_walk_fn_t *)mark_subgraph, NULL, 0);
5665                 assert(r == 0);
5666         }
5667 
5668         /* Un-override services in the subgraph & override-disable the rest. */
5669         if (norepository)
5670                 goto out;
5671 
5672         non_subgraph_svcs = 0;
5673         for (v = uu_list_first(dgraph);
5674             v != NULL;
5675             v = uu_list_next(dgraph, v)) {
5676                 if (v->gv_type != GVT_INST ||
5677                     (v->gv_flags & GV_CONFIGURED) == 0)
5678                         continue;
5679 
5680 again:
5681                 r = scf_handle_decode_fmri(h, v->gv_name, NULL, NULL, inst,
5682                     NULL, NULL, SCF_DECODE_FMRI_EXACT);
5683                 if (r != 0) {
5684                         switch (scf_error()) {
5685                         case SCF_ERROR_CONNECTION_BROKEN:
5686                         default:
5687                                 libscf_handle_rebind(h);
5688                                 rebound = B_TRUE;
5689                                 goto again;
5690 
5691                         case SCF_ERROR_NOT_FOUND:
5692                                 continue;
5693 
5694                         case SCF_ERROR_HANDLE_MISMATCH:
5695                         case SCF_ERROR_INVALID_ARGUMENT:
5696                         case SCF_ERROR_CONSTRAINT_VIOLATED:
5697                         case SCF_ERROR_NOT_BOUND:
5698                                 bad_error("scf_handle_decode_fmri",
5699                                     scf_error());
5700                         }
5701                 }
5702 
5703                 if (isall || (v->gv_flags & GV_INSUBGRAPH)) {
5704                         r = libscf_delete_enable_ovr(inst);
5705                         fs = "libscf_delete_enable_ovr";
5706                 } else {
5707                         assert(isnone || (v->gv_flags & GV_INSUBGRAPH) == 0);
5708 
5709                         /*
5710                          * Services which are up need to come down before
5711                          * we're done, but we can only disable the leaves
5712                          * here.
5713                          */
5714 
5715                         if (up_state(v->gv_state))
5716                                 ++non_subgraph_svcs;
5717 
5718                         /* If it's already disabled, don't bother. */
5719                         if ((v->gv_flags & GV_ENABLED) == 0)
5720                                 continue;
5721 
5722                         if (!is_nonsubgraph_leaf(v))
5723                                 continue;
5724 
5725                         r = libscf_set_enable_ovr(inst, 0);
5726                         fs = "libscf_set_enable_ovr";
5727                 }
5728                 switch (r) {
5729                 case 0:
5730                 case ECANCELED:
5731                         break;
5732 
5733                 case ECONNABORTED:
5734                         libscf_handle_rebind(h);
5735                         rebound = B_TRUE;
5736                         goto again;
5737 
5738                 case EPERM:
5739                 case EROFS:
5740                         log_error(LOG_WARNING,
5741                             "Could not set %s/%s for %s: %s.\n",
5742                             SCF_PG_GENERAL_OVR, SCF_PROPERTY_ENABLED,
5743                             v->gv_name, strerror(r));
5744                         break;
5745 
5746                 default:
5747                         bad_error(fs, r);
5748                 }
5749         }
5750 
5751         if (halting != -1) {
5752                 if (non_subgraph_svcs > 1)
5753                         uu_warn("%d system services are now being stopped.\n",
5754                             non_subgraph_svcs);
5755                 else if (non_subgraph_svcs == 1)
5756                         uu_warn("One system service is now being stopped.\n");
5757                 else if (non_subgraph_svcs == 0)
5758                         do_uadmin();
5759         }
5760 
5761         ret = rebound ? ECONNRESET : 0;
5762 
5763 out:
5764         MUTEX_UNLOCK(&dgraph_lock);
5765         if (!isall && !isnone)
5766                 startd_free((void *)cfmri, max_scf_fmri_size);
5767         scf_instance_destroy(inst);
5768         return (ret);
5769 }
5770 
5771 
5772 /*
5773  * Returns 0, ECONNABORTED, or EINVAL.
5774  */
5775 static int
5776 handle_graph_update_event(scf_handle_t *h, graph_protocol_event_t *e)
5777 {
5778         int r;
5779 
5780         switch (e->gpe_type) {
5781         case GRAPH_UPDATE_RELOAD_GRAPH:
5782                 log_error(LOG_WARNING,
5783                     "graph_event: reload graph unimplemented\n");
5784                 break;
5785 
5786         case GRAPH_UPDATE_STATE_CHANGE: {
5787                 protocol_states_t *states = e->gpe_data;
5788 
5789                 switch (r = dgraph_set_instance_state(h, e->gpe_inst, states)) {
5790                 case 0:
5791                 case ENOENT:
5792                         break;
5793 
5794                 case ECONNABORTED:
5795                         return (ECONNABORTED);
5796 
5797                 case EINVAL:
5798                 default:
5799 #ifndef NDEBUG
5800                         (void) fprintf(stderr, "dgraph_set_instance_state() "
5801                             "failed with unexpected error %d at %s:%d.\n", r,
5802                             __FILE__, __LINE__);
5803 #endif
5804                         abort();
5805                 }
5806 
5807                 startd_free(states, sizeof (protocol_states_t));
5808                 break;
5809         }
5810 
5811         default:
5812                 log_error(LOG_WARNING,
5813                     "graph_event_loop received an unknown event: %d\n",
5814                     e->gpe_type);
5815                 break;
5816         }
5817 
5818         return (0);
5819 }
5820 
5821 /*
5822  * graph_event_thread()
5823  *    Wait for state changes from the restarters.
5824  */
5825 /*ARGSUSED*/
5826 void *
5827 graph_event_thread(void *unused)
5828 {
5829         scf_handle_t *h;
5830         int err;
5831 
5832         h = libscf_handle_create_bound_loop();
5833 
5834         /*CONSTCOND*/
5835         while (1) {
5836                 graph_protocol_event_t *e;
5837 
5838                 MUTEX_LOCK(&gu->gu_lock);
5839 
5840                 while (gu->gu_wakeup == 0)
5841                         (void) pthread_cond_wait(&gu->gu_cv, &gu->gu_lock);
5842 
5843                 gu->gu_wakeup = 0;
5844 
5845                 while ((e = graph_event_dequeue()) != NULL) {
5846                         MUTEX_LOCK(&e->gpe_lock);
5847                         MUTEX_UNLOCK(&gu->gu_lock);
5848 
5849                         while ((err = handle_graph_update_event(h, e)) ==
5850                             ECONNABORTED)
5851                                 libscf_handle_rebind(h);
5852 
5853                         if (err == 0)
5854                                 graph_event_release(e);
5855                         else
5856                                 graph_event_requeue(e);
5857 
5858                         MUTEX_LOCK(&gu->gu_lock);
5859                 }
5860 
5861                 MUTEX_UNLOCK(&gu->gu_lock);
5862         }
5863 
5864         /*
5865          * Unreachable for now -- there's currently no graceful cleanup
5866          * called on exit().
5867          */
5868         MUTEX_UNLOCK(&gu->gu_lock);
5869         scf_handle_destroy(h);
5870         return (NULL);
5871 }
5872 
5873 static void
5874 set_initial_milestone(scf_handle_t *h)
5875 {
5876         scf_instance_t *inst;
5877         char *fmri, *cfmri;
5878         size_t sz;
5879         int r;
5880 
5881         inst = safe_scf_instance_create(h);
5882         fmri = startd_alloc(max_scf_fmri_size);
5883 
5884         /*
5885          * If -m milestone= was specified, we want to set options_ovr/milestone
5886          * to it.  Otherwise we want to read what the milestone should be set
5887          * to.  Either way we need our inst.
5888          */
5889 get_self:
5890         if (scf_handle_decode_fmri(h, SCF_SERVICE_STARTD, NULL, NULL, inst,
5891             NULL, NULL, SCF_DECODE_FMRI_EXACT) != 0) {
5892                 switch (scf_error()) {
5893                 case SCF_ERROR_CONNECTION_BROKEN:
5894                         libscf_handle_rebind(h);
5895                         goto get_self;
5896 
5897                 case SCF_ERROR_NOT_FOUND:
5898                         if (st->st_subgraph != NULL &&
5899                             st->st_subgraph[0] != '\0') {
5900                                 sz = strlcpy(fmri, st->st_subgraph,
5901                                     max_scf_fmri_size);
5902                                 assert(sz < max_scf_fmri_size);
5903                         } else {
5904                                 fmri[0] = '\0';
5905                         }
5906                         break;
5907 
5908                 case SCF_ERROR_INVALID_ARGUMENT:
5909                 case SCF_ERROR_CONSTRAINT_VIOLATED:
5910                 case SCF_ERROR_HANDLE_MISMATCH:
5911                 default:
5912                         bad_error("scf_handle_decode_fmri", scf_error());
5913                 }
5914         } else {
5915                 if (st->st_subgraph != NULL && st->st_subgraph[0] != '\0') {
5916                         scf_propertygroup_t *pg;
5917 
5918                         pg = safe_scf_pg_create(h);
5919 
5920                         sz = strlcpy(fmri, st->st_subgraph, max_scf_fmri_size);
5921                         assert(sz < max_scf_fmri_size);
5922 
5923                         r = libscf_inst_get_or_add_pg(inst, SCF_PG_OPTIONS_OVR,
5924                             SCF_PG_OPTIONS_OVR_TYPE, SCF_PG_OPTIONS_OVR_FLAGS,
5925                             pg);
5926                         switch (r) {
5927                         case 0:
5928                                 break;
5929 
5930                         case ECONNABORTED:
5931                                 libscf_handle_rebind(h);
5932                                 goto get_self;
5933 
5934                         case EPERM:
5935                         case EACCES:
5936                         case EROFS:
5937                                 log_error(LOG_WARNING, "Could not set %s/%s: "
5938                                     "%s.\n", SCF_PG_OPTIONS_OVR,
5939                                     SCF_PROPERTY_MILESTONE, strerror(r));
5940                                 /* FALLTHROUGH */
5941 
5942                         case ECANCELED:
5943                                 sz = strlcpy(fmri, st->st_subgraph,
5944                                     max_scf_fmri_size);
5945                                 assert(sz < max_scf_fmri_size);
5946                                 break;
5947 
5948                         default:
5949                                 bad_error("libscf_inst_get_or_add_pg", r);
5950                         }
5951 
5952                         r = libscf_clear_runlevel(pg, fmri);
5953                         switch (r) {
5954                         case 0:
5955                                 break;
5956 
5957                         case ECONNABORTED:
5958                                 libscf_handle_rebind(h);
5959                                 goto get_self;
5960 
5961                         case EPERM:
5962                         case EACCES:
5963                         case EROFS:
5964                                 log_error(LOG_WARNING, "Could not set %s/%s: "
5965                                     "%s.\n", SCF_PG_OPTIONS_OVR,
5966                                     SCF_PROPERTY_MILESTONE, strerror(r));
5967                                 /* FALLTHROUGH */
5968 
5969                         case ECANCELED:
5970                                 sz = strlcpy(fmri, st->st_subgraph,
5971                                     max_scf_fmri_size);
5972                                 assert(sz < max_scf_fmri_size);
5973                                 break;
5974 
5975                         default:
5976                                 bad_error("libscf_clear_runlevel", r);
5977                         }
5978 
5979                         scf_pg_destroy(pg);
5980                 } else {
5981                         scf_property_t *prop;
5982                         scf_value_t *val;
5983 
5984                         prop = safe_scf_property_create(h);
5985                         val = safe_scf_value_create(h);
5986 
5987                         r = libscf_get_milestone(inst, prop, val, fmri,
5988                             max_scf_fmri_size);
5989                         switch (r) {
5990                         case 0:
5991                                 break;
5992 
5993                         case ECONNABORTED:
5994                                 libscf_handle_rebind(h);
5995                                 goto get_self;
5996 
5997                         case EINVAL:
5998                                 log_error(LOG_WARNING, "Milestone property is "
5999                                     "misconfigured.  Defaulting to \"all\".\n");
6000                                 /* FALLTHROUGH */
6001 
6002                         case ECANCELED:
6003                         case ENOENT:
6004                                 fmri[0] = '\0';
6005                                 break;
6006 
6007                         default:
6008                                 bad_error("libscf_get_milestone", r);
6009                         }
6010 
6011                         scf_value_destroy(val);
6012                         scf_property_destroy(prop);
6013                 }
6014         }
6015 
6016         if (fmri[0] == '\0' || strcmp(fmri, "all") == 0)
6017                 goto out;
6018 
6019         if (strcmp(fmri, "none") != 0) {
6020 retry:
6021                 if (scf_handle_decode_fmri(h, fmri, NULL, NULL, inst, NULL,
6022                     NULL, SCF_DECODE_FMRI_EXACT) != 0) {
6023                         switch (scf_error()) {
6024                         case SCF_ERROR_INVALID_ARGUMENT:
6025                                 log_error(LOG_WARNING,
6026                                     "Requested milestone \"%s\" is invalid.  "
6027                                     "Reverting to \"all\".\n", fmri);
6028                                 goto out;
6029 
6030                         case SCF_ERROR_CONSTRAINT_VIOLATED:
6031                                 log_error(LOG_WARNING, "Requested milestone "
6032                                     "\"%s\" does not specify an instance.  "
6033                                     "Reverting to \"all\".\n", fmri);
6034                                 goto out;
6035 
6036                         case SCF_ERROR_CONNECTION_BROKEN:
6037                                 libscf_handle_rebind(h);
6038                                 goto retry;
6039 
6040                         case SCF_ERROR_NOT_FOUND:
6041                                 log_error(LOG_WARNING, "Requested milestone "
6042                                     "\"%s\" not in repository.  Reverting to "
6043                                     "\"all\".\n", fmri);
6044                                 goto out;
6045 
6046                         case SCF_ERROR_HANDLE_MISMATCH:
6047                         default:
6048                                 bad_error("scf_handle_decode_fmri",
6049                                     scf_error());
6050                         }
6051                 }
6052 
6053                 r = fmri_canonify(fmri, &cfmri, B_FALSE);
6054                 assert(r == 0);
6055 
6056                 r = dgraph_add_instance(cfmri, inst, B_TRUE);
6057                 startd_free(cfmri, max_scf_fmri_size);
6058                 switch (r) {
6059                 case 0:
6060                         break;
6061 
6062                 case ECONNABORTED:
6063                         goto retry;
6064 
6065                 case EINVAL:
6066                         log_error(LOG_WARNING,
6067                             "Requested milestone \"%s\" is invalid.  "
6068                             "Reverting to \"all\".\n", fmri);
6069                         goto out;
6070 
6071                 case ECANCELED:
6072                         log_error(LOG_WARNING,
6073                             "Requested milestone \"%s\" not "
6074                             "in repository.  Reverting to \"all\".\n",
6075                             fmri);
6076                         goto out;
6077 
6078                 case EEXIST:
6079                 default:
6080                         bad_error("dgraph_add_instance", r);
6081                 }
6082         }
6083 
6084         log_console(LOG_INFO, "Booting to milestone \"%s\".\n", fmri);
6085 
6086         r = dgraph_set_milestone(fmri, h, B_FALSE);
6087         switch (r) {
6088         case 0:
6089         case ECONNRESET:
6090         case EALREADY:
6091                 break;
6092 
6093         case EINVAL:
6094         case ENOENT:
6095         default:
6096                 bad_error("dgraph_set_milestone", r);
6097         }
6098 
6099 out:
6100         startd_free(fmri, max_scf_fmri_size);
6101         scf_instance_destroy(inst);
6102 }
6103 
6104 void
6105 set_restart_milestone(scf_handle_t *h)
6106 {
6107         scf_instance_t *inst;
6108         scf_property_t *prop;
6109         scf_value_t *val;
6110         char *fmri;
6111         int r;
6112 
6113         inst = safe_scf_instance_create(h);
6114 
6115 get_self:
6116         if (scf_handle_decode_fmri(h, SCF_SERVICE_STARTD, NULL, NULL,
6117             inst, NULL, NULL, SCF_DECODE_FMRI_EXACT) != 0) {
6118                 switch (scf_error()) {
6119                 case SCF_ERROR_CONNECTION_BROKEN:
6120                         libscf_handle_rebind(h);
6121                         goto get_self;
6122 
6123                 case SCF_ERROR_NOT_FOUND:
6124                         break;
6125 
6126                 case SCF_ERROR_INVALID_ARGUMENT:
6127                 case SCF_ERROR_CONSTRAINT_VIOLATED:
6128                 case SCF_ERROR_HANDLE_MISMATCH:
6129                 default:
6130                         bad_error("scf_handle_decode_fmri", scf_error());
6131                 }
6132 
6133                 scf_instance_destroy(inst);
6134                 return;
6135         }
6136 
6137         prop = safe_scf_property_create(h);
6138         val = safe_scf_value_create(h);
6139         fmri = startd_alloc(max_scf_fmri_size);
6140 
6141         r = libscf_get_milestone(inst, prop, val, fmri, max_scf_fmri_size);
6142         switch (r) {
6143         case 0:
6144                 break;
6145 
6146         case ECONNABORTED:
6147                 libscf_handle_rebind(h);
6148                 goto get_self;
6149 
6150         case ECANCELED:
6151         case ENOENT:
6152         case EINVAL:
6153                 goto out;
6154 
6155         default:
6156                 bad_error("libscf_get_milestone", r);
6157         }
6158 
6159         r = dgraph_set_milestone(fmri, h, B_TRUE);
6160         switch (r) {
6161         case 0:
6162         case ECONNRESET:
6163         case EALREADY:
6164         case EINVAL:
6165         case ENOENT:
6166                 break;
6167 
6168         default:
6169                 bad_error("dgraph_set_milestone", r);
6170         }
6171 
6172 out:
6173         startd_free(fmri, max_scf_fmri_size);
6174         scf_value_destroy(val);
6175         scf_property_destroy(prop);
6176         scf_instance_destroy(inst);
6177 }
6178 
6179 /*
6180  * void *graph_thread(void *)
6181  *
6182  * Graph management thread.
6183  */
6184 /*ARGSUSED*/
6185 void *
6186 graph_thread(void *arg)
6187 {
6188         scf_handle_t *h;
6189         int err;
6190 
6191         h = libscf_handle_create_bound_loop();
6192 
6193         if (st->st_initial)
6194                 set_initial_milestone(h);
6195 
6196         MUTEX_LOCK(&dgraph_lock);
6197         initial_milestone_set = B_TRUE;
6198         err = pthread_cond_broadcast(&initial_milestone_cv);
6199         assert(err == 0);
6200         MUTEX_UNLOCK(&dgraph_lock);
6201 
6202         libscf_populate_graph(h);
6203 
6204         if (!st->st_initial)
6205                 set_restart_milestone(h);
6206 
6207         MUTEX_LOCK(&st->st_load_lock);
6208         st->st_load_complete = 1;
6209         (void) pthread_cond_broadcast(&st->st_load_cv);
6210         MUTEX_UNLOCK(&st->st_load_lock);
6211 
6212         MUTEX_LOCK(&dgraph_lock);
6213         /*
6214          * Now that we've set st_load_complete we need to check can_come_up()
6215          * since if we booted to a milestone, then there won't be any more
6216          * state updates.
6217          */
6218         if (!go_single_user_mode && !go_to_level1 &&
6219             halting == -1) {
6220                 if (!sulogin_thread_running && !can_come_up()) {
6221                         (void) startd_thread_create(sulogin_thread, NULL);
6222                         sulogin_thread_running = B_TRUE;
6223                 }
6224         }
6225         MUTEX_UNLOCK(&dgraph_lock);
6226 
6227         (void) pthread_mutex_lock(&gu->gu_freeze_lock);
6228 
6229         /*CONSTCOND*/
6230         while (1) {
6231                 (void) pthread_cond_wait(&gu->gu_freeze_cv,
6232                     &gu->gu_freeze_lock);
6233         }
6234 
6235         /*
6236          * Unreachable for now -- there's currently no graceful cleanup
6237          * called on exit().
6238          */
6239         (void) pthread_mutex_unlock(&gu->gu_freeze_lock);
6240         scf_handle_destroy(h);
6241 
6242         return (NULL);
6243 }
6244 
6245 
6246 /*
6247  * int next_action()
6248  *   Given an array of timestamps 'a' with 'num' elements, find the
6249  *   lowest non-zero timestamp and return its index. If there are no
6250  *   non-zero elements, return -1.
6251  */
6252 static int
6253 next_action(hrtime_t *a, int num)
6254 {
6255         hrtime_t t = 0;
6256         int i = 0, smallest = -1;
6257 
6258         for (i = 0; i < num; i++) {
6259                 if (t == 0) {
6260                         t = a[i];
6261                         smallest = i;
6262                 } else if (a[i] != 0 && a[i] < t) {
6263                         t = a[i];
6264                         smallest = i;
6265                 }
6266         }
6267 
6268         if (t == 0)
6269                 return (-1);
6270         else
6271                 return (smallest);
6272 }
6273 
6274 /*
6275  * void process_actions()
6276  *   Process actions requested by the administrator. Possibilities include:
6277  *   refresh, restart, maintenance mode off, maintenance mode on,
6278  *   maintenance mode immediate, and degraded.
6279  *
6280  *   The set of pending actions is represented in the repository as a
6281  *   per-instance property group, with each action being a single property
6282  *   in that group.  This property group is converted to an array, with each
6283  *   action type having an array slot.  The actions in the array at the
6284  *   time process_actions() is called are acted on in the order of the
6285  *   timestamp (which is the value stored in the slot).  A value of zero
6286  *   indicates that there is no pending action of the type associated with
6287  *   a particular slot.
6288  *
6289  *   Sending an action event multiple times before the restarter has a
6290  *   chance to process that action will force it to be run at the last
6291  *   timestamp where it appears in the ordering.
6292  *
6293  *   Turning maintenance mode on trumps all other actions.
6294  *
6295  *   Returns 0 or ECONNABORTED.
6296  */
6297 static int
6298 process_actions(scf_handle_t *h, scf_propertygroup_t *pg, scf_instance_t *inst)
6299 {
6300         scf_property_t *prop = NULL;
6301         scf_value_t *val = NULL;
6302         scf_type_t type;
6303         graph_vertex_t *vertex;
6304         admin_action_t a;
6305         int i, ret = 0, r;
6306         hrtime_t action_ts[NACTIONS];
6307         char *inst_name;
6308 
6309         r = libscf_instance_get_fmri(inst, &inst_name);
6310         switch (r) {
6311         case 0:
6312                 break;
6313 
6314         case ECONNABORTED:
6315                 return (ECONNABORTED);
6316 
6317         case ECANCELED:
6318                 return (0);
6319 
6320         default:
6321                 bad_error("libscf_instance_get_fmri", r);
6322         }
6323 
6324         MUTEX_LOCK(&dgraph_lock);
6325 
6326         vertex = vertex_get_by_name(inst_name);
6327         if (vertex == NULL) {
6328                 MUTEX_UNLOCK(&dgraph_lock);
6329                 log_framework(LOG_DEBUG, "%s: Can't find graph vertex. "
6330                     "The instance must have been removed.\n", inst_name);
6331                 startd_free(inst_name, max_scf_fmri_size);
6332                 return (0);
6333         }
6334 
6335         prop = safe_scf_property_create(h);
6336         val = safe_scf_value_create(h);
6337 
6338         for (i = 0; i < NACTIONS; i++) {
6339                 if (scf_pg_get_property(pg, admin_actions[i], prop) != 0) {
6340                         switch (scf_error()) {
6341                         case SCF_ERROR_CONNECTION_BROKEN:
6342                         default:
6343                                 ret = ECONNABORTED;
6344                                 goto out;
6345 
6346                         case SCF_ERROR_DELETED:
6347                                 goto out;
6348 
6349                         case SCF_ERROR_NOT_FOUND:
6350                                 action_ts[i] = 0;
6351                                 continue;
6352 
6353                         case SCF_ERROR_HANDLE_MISMATCH:
6354                         case SCF_ERROR_INVALID_ARGUMENT:
6355                         case SCF_ERROR_NOT_SET:
6356                                 bad_error("scf_pg_get_property", scf_error());
6357                         }
6358                 }
6359 
6360                 if (scf_property_type(prop, &type) != 0) {
6361                         switch (scf_error()) {
6362                         case SCF_ERROR_CONNECTION_BROKEN:
6363                         default:
6364                                 ret = ECONNABORTED;
6365                                 goto out;
6366 
6367                         case SCF_ERROR_DELETED:
6368                                 action_ts[i] = 0;
6369                                 continue;
6370 
6371                         case SCF_ERROR_NOT_SET:
6372                                 bad_error("scf_property_type", scf_error());
6373                         }
6374                 }
6375 
6376                 if (type != SCF_TYPE_INTEGER) {
6377                         action_ts[i] = 0;
6378                         continue;
6379                 }
6380 
6381                 if (scf_property_get_value(prop, val) != 0) {
6382                         switch (scf_error()) {
6383                         case SCF_ERROR_CONNECTION_BROKEN:
6384                         default:
6385                                 ret = ECONNABORTED;
6386                                 goto out;
6387 
6388                         case SCF_ERROR_DELETED:
6389                                 goto out;
6390 
6391                         case SCF_ERROR_NOT_FOUND:
6392                         case SCF_ERROR_CONSTRAINT_VIOLATED:
6393                                 action_ts[i] = 0;
6394                                 continue;
6395 
6396                         case SCF_ERROR_NOT_SET:
6397                         case SCF_ERROR_PERMISSION_DENIED:
6398                                 bad_error("scf_property_get_value",
6399                                     scf_error());
6400                         }
6401                 }
6402 
6403                 r = scf_value_get_integer(val, &action_ts[i]);
6404                 assert(r == 0);
6405         }
6406 
6407         a = ADMIN_EVENT_MAINT_ON_IMMEDIATE;
6408         if (action_ts[ADMIN_EVENT_MAINT_ON_IMMEDIATE] ||
6409             action_ts[ADMIN_EVENT_MAINT_ON]) {
6410                 a = action_ts[ADMIN_EVENT_MAINT_ON_IMMEDIATE] ?
6411                     ADMIN_EVENT_MAINT_ON_IMMEDIATE : ADMIN_EVENT_MAINT_ON;
6412 
6413                 vertex_send_event(vertex, admin_events[a]);
6414                 r = libscf_unset_action(h, pg, a, action_ts[a]);
6415                 switch (r) {
6416                 case 0:
6417                 case EACCES:
6418                         break;
6419 
6420                 case ECONNABORTED:
6421                         ret = ECONNABORTED;
6422                         goto out;
6423 
6424                 case EPERM:
6425                         uu_die("Insufficient privilege.\n");
6426                         /* NOTREACHED */
6427 
6428                 default:
6429                         bad_error("libscf_unset_action", r);
6430                 }
6431         }
6432 
6433         while ((a = next_action(action_ts, NACTIONS)) != -1) {
6434                 log_framework(LOG_DEBUG,
6435                     "Graph: processing %s action for %s.\n", admin_actions[a],
6436                     inst_name);
6437 
6438                 if (a == ADMIN_EVENT_REFRESH) {
6439                         r = dgraph_refresh_instance(vertex, inst);
6440                         switch (r) {
6441                         case 0:
6442                         case ECANCELED:
6443                         case EINVAL:
6444                         case -1:
6445                                 break;
6446 
6447                         case ECONNABORTED:
6448                                 /* pg & inst are reset now, so just return. */
6449                                 ret = ECONNABORTED;
6450                                 goto out;
6451 
6452                         default:
6453                                 bad_error("dgraph_refresh_instance", r);
6454                         }
6455                 }
6456 
6457                 vertex_send_event(vertex, admin_events[a]);
6458 
6459                 r = libscf_unset_action(h, pg, a, action_ts[a]);
6460                 switch (r) {
6461                 case 0:
6462                 case EACCES:
6463                         break;
6464 
6465                 case ECONNABORTED:
6466                         ret = ECONNABORTED;
6467                         goto out;
6468 
6469                 case EPERM:
6470                         uu_die("Insufficient privilege.\n");
6471                         /* NOTREACHED */
6472 
6473                 default:
6474                         bad_error("libscf_unset_action", r);
6475                 }
6476 
6477                 action_ts[a] = 0;
6478         }
6479 
6480 out:
6481         MUTEX_UNLOCK(&dgraph_lock);
6482 
6483         scf_property_destroy(prop);
6484         scf_value_destroy(val);
6485         startd_free(inst_name, max_scf_fmri_size);
6486         return (ret);
6487 }
6488 
6489 /*
6490  * inst and pg_name are scratch space, and are unset on entry.
6491  * Returns
6492  *   0 - success
6493  *   ECONNRESET - success, but repository handle rebound
6494  *   ECONNABORTED - repository connection broken
6495  */
6496 static int
6497 process_pg_event(scf_handle_t *h, scf_propertygroup_t *pg, scf_instance_t *inst,
6498     char *pg_name)
6499 {
6500         int r;
6501         scf_property_t *prop;
6502         scf_value_t *val;
6503         char *fmri;
6504         boolean_t rebound = B_FALSE, rebind_inst = B_FALSE;
6505 
6506         if (scf_pg_get_name(pg, pg_name, max_scf_value_size) < 0) {
6507                 switch (scf_error()) {
6508                 case SCF_ERROR_CONNECTION_BROKEN:
6509                 default:
6510                         return (ECONNABORTED);
6511 
6512                 case SCF_ERROR_DELETED:
6513                         return (0);
6514 
6515                 case SCF_ERROR_NOT_SET:
6516                         bad_error("scf_pg_get_name", scf_error());
6517                 }
6518         }
6519 
6520         if (strcmp(pg_name, SCF_PG_GENERAL) == 0 ||
6521             strcmp(pg_name, SCF_PG_GENERAL_OVR) == 0) {
6522                 r = dgraph_update_general(pg);
6523                 switch (r) {
6524                 case 0:
6525                 case ENOTSUP:
6526                 case ECANCELED:
6527                         return (0);
6528 
6529                 case ECONNABORTED:
6530                         return (ECONNABORTED);
6531 
6532                 case -1:
6533                         /* Error should have been logged. */
6534                         return (0);
6535 
6536                 default:
6537                         bad_error("dgraph_update_general", r);
6538                 }
6539         } else if (strcmp(pg_name, SCF_PG_RESTARTER_ACTIONS) == 0) {
6540                 if (scf_pg_get_parent_instance(pg, inst) != 0) {
6541                         switch (scf_error()) {
6542                         case SCF_ERROR_CONNECTION_BROKEN:
6543                                 return (ECONNABORTED);
6544 
6545                         case SCF_ERROR_DELETED:
6546                         case SCF_ERROR_CONSTRAINT_VIOLATED:
6547                                 /* Ignore commands on services. */
6548                                 return (0);
6549 
6550                         case SCF_ERROR_NOT_BOUND:
6551                         case SCF_ERROR_HANDLE_MISMATCH:
6552                         case SCF_ERROR_NOT_SET:
6553                         default:
6554                                 bad_error("scf_pg_get_parent_instance",
6555                                     scf_error());
6556                         }
6557                 }
6558 
6559                 return (process_actions(h, pg, inst));
6560         }
6561 
6562         if (strcmp(pg_name, SCF_PG_OPTIONS) != 0 &&
6563             strcmp(pg_name, SCF_PG_OPTIONS_OVR) != 0)
6564                 return (0);
6565 
6566         /*
6567          * We only care about the options[_ovr] property groups of our own
6568          * instance, so get the fmri and compare.  Plus, once we know it's
6569          * correct, if the repository connection is broken we know exactly what
6570          * property group we were operating on, and can look it up again.
6571          */
6572         if (scf_pg_get_parent_instance(pg, inst) != 0) {
6573                 switch (scf_error()) {
6574                 case SCF_ERROR_CONNECTION_BROKEN:
6575                         return (ECONNABORTED);
6576 
6577                 case SCF_ERROR_DELETED:
6578                 case SCF_ERROR_CONSTRAINT_VIOLATED:
6579                         return (0);
6580 
6581                 case SCF_ERROR_HANDLE_MISMATCH:
6582                 case SCF_ERROR_NOT_BOUND:
6583                 case SCF_ERROR_NOT_SET:
6584                 default:
6585                         bad_error("scf_pg_get_parent_instance",
6586                             scf_error());
6587                 }
6588         }
6589 
6590         switch (r = libscf_instance_get_fmri(inst, &fmri)) {
6591         case 0:
6592                 break;
6593 
6594         case ECONNABORTED:
6595                 return (ECONNABORTED);
6596 
6597         case ECANCELED:
6598                 return (0);
6599 
6600         default:
6601                 bad_error("libscf_instance_get_fmri", r);
6602         }
6603 
6604         if (strcmp(fmri, SCF_SERVICE_STARTD) != 0) {
6605                 startd_free(fmri, max_scf_fmri_size);
6606                 return (0);
6607         }
6608 
6609         /*
6610          * update the information events flag
6611          */
6612         if (strcmp(pg_name, SCF_PG_OPTIONS) == 0)
6613                 info_events_all = libscf_get_info_events_all(pg);
6614 
6615         prop = safe_scf_property_create(h);
6616         val = safe_scf_value_create(h);
6617 
6618         if (strcmp(pg_name, SCF_PG_OPTIONS_OVR) == 0) {
6619                 /* See if we need to set the runlevel. */
6620                 /* CONSTCOND */
6621                 if (0) {
6622 rebind_pg:
6623                         libscf_handle_rebind(h);
6624                         rebound = B_TRUE;
6625 
6626                         r = libscf_lookup_instance(SCF_SERVICE_STARTD, inst);
6627                         switch (r) {
6628                         case 0:
6629                                 break;
6630 
6631                         case ECONNABORTED:
6632                                 goto rebind_pg;
6633 
6634                         case ENOENT:
6635                                 goto out;
6636 
6637                         case EINVAL:
6638                         case ENOTSUP:
6639                                 bad_error("libscf_lookup_instance", r);
6640                         }
6641 
6642                         if (scf_instance_get_pg(inst, pg_name, pg) != 0) {
6643                                 switch (scf_error()) {
6644                                 case SCF_ERROR_DELETED:
6645                                 case SCF_ERROR_NOT_FOUND:
6646                                         goto out;
6647 
6648                                 case SCF_ERROR_CONNECTION_BROKEN:
6649                                         goto rebind_pg;
6650 
6651                                 case SCF_ERROR_HANDLE_MISMATCH:
6652                                 case SCF_ERROR_NOT_BOUND:
6653                                 case SCF_ERROR_NOT_SET:
6654                                 case SCF_ERROR_INVALID_ARGUMENT:
6655                                 default:
6656                                         bad_error("scf_instance_get_pg",
6657                                             scf_error());
6658                                 }
6659                         }
6660                 }
6661 
6662                 if (scf_pg_get_property(pg, "runlevel", prop) == 0) {
6663                         r = dgraph_set_runlevel(pg, prop);
6664                         switch (r) {
6665                         case ECONNRESET:
6666                                 rebound = B_TRUE;
6667                                 rebind_inst = B_TRUE;
6668                                 /* FALLTHROUGH */
6669 
6670                         case 0:
6671                                 break;
6672 
6673                         case ECONNABORTED:
6674                                 goto rebind_pg;
6675 
6676                         case ECANCELED:
6677                                 goto out;
6678 
6679                         default:
6680                                 bad_error("dgraph_set_runlevel", r);
6681                         }
6682                 } else {
6683                         switch (scf_error()) {
6684                         case SCF_ERROR_CONNECTION_BROKEN:
6685                         default:
6686                                 goto rebind_pg;
6687 
6688                         case SCF_ERROR_DELETED:
6689                                 goto out;
6690 
6691                         case SCF_ERROR_NOT_FOUND:
6692                                 break;
6693 
6694                         case SCF_ERROR_INVALID_ARGUMENT:
6695                         case SCF_ERROR_HANDLE_MISMATCH:
6696                         case SCF_ERROR_NOT_BOUND:
6697                         case SCF_ERROR_NOT_SET:
6698                                 bad_error("scf_pg_get_property", scf_error());
6699                         }
6700                 }
6701         }
6702 
6703         if (rebind_inst) {
6704 lookup_inst:
6705                 r = libscf_lookup_instance(SCF_SERVICE_STARTD, inst);
6706                 switch (r) {
6707                 case 0:
6708                         break;
6709 
6710                 case ECONNABORTED:
6711                         libscf_handle_rebind(h);
6712                         rebound = B_TRUE;
6713                         goto lookup_inst;
6714 
6715                 case ENOENT:
6716                         goto out;
6717 
6718                 case EINVAL:
6719                 case ENOTSUP:
6720                         bad_error("libscf_lookup_instance", r);
6721                 }
6722         }
6723 
6724         r = libscf_get_milestone(inst, prop, val, fmri, max_scf_fmri_size);
6725         switch (r) {
6726         case 0:
6727                 break;
6728 
6729         case ECONNABORTED:
6730                 libscf_handle_rebind(h);
6731                 rebound = B_TRUE;
6732                 goto lookup_inst;
6733 
6734         case EINVAL:
6735                 log_error(LOG_NOTICE,
6736                     "%s/%s property of %s is misconfigured.\n", pg_name,
6737                     SCF_PROPERTY_MILESTONE, SCF_SERVICE_STARTD);
6738                 /* FALLTHROUGH */
6739 
6740         case ECANCELED:
6741         case ENOENT:
6742                 (void) strcpy(fmri, "all");
6743                 break;
6744 
6745         default:
6746                 bad_error("libscf_get_milestone", r);
6747         }
6748 
6749         r = dgraph_set_milestone(fmri, h, B_FALSE);
6750         switch (r) {
6751         case 0:
6752         case ECONNRESET:
6753         case EALREADY:
6754                 break;
6755 
6756         case EINVAL:
6757                 log_error(LOG_WARNING, "Milestone %s is invalid.\n", fmri);
6758                 break;
6759 
6760         case ENOENT:
6761                 log_error(LOG_WARNING, "Milestone %s does not exist.\n", fmri);
6762                 break;
6763 
6764         default:
6765                 bad_error("dgraph_set_milestone", r);
6766         }
6767 
6768 out:
6769         startd_free(fmri, max_scf_fmri_size);
6770         scf_value_destroy(val);
6771         scf_property_destroy(prop);
6772 
6773         return (rebound ? ECONNRESET : 0);
6774 }
6775 
6776 /*
6777  * process_delete() deletes an instance from the dgraph if 'fmri' is an
6778  * instance fmri or if 'fmri' matches the 'general' property group of an
6779  * instance (or the 'general/enabled' property).
6780  *
6781  * 'fmri' may be overwritten and cannot be trusted on return by the caller.
6782  */
6783 static void
6784 process_delete(char *fmri, scf_handle_t *h)
6785 {
6786         char *lfmri, *end_inst_fmri;
6787         const char *inst_name = NULL;
6788         const char *pg_name = NULL;
6789         const char *prop_name = NULL;
6790 
6791         lfmri = safe_strdup(fmri);
6792 
6793         /* Determine if the FMRI is a property group or instance */
6794         if (scf_parse_svc_fmri(lfmri, NULL, NULL, &inst_name, &pg_name,
6795             &prop_name) != SCF_SUCCESS) {
6796                 log_error(LOG_WARNING,
6797                     "Received invalid FMRI \"%s\" from repository server.\n",
6798                     fmri);
6799         } else if (inst_name != NULL && pg_name == NULL) {
6800                 (void) dgraph_remove_instance(fmri, h);
6801         } else if (inst_name != NULL && pg_name != NULL) {
6802                 /*
6803                  * If we're deleting the 'general' property group or
6804                  * 'general/enabled' property then the whole instance
6805                  * must be removed from the dgraph.
6806                  */
6807                 if (strcmp(pg_name, SCF_PG_GENERAL) != 0) {
6808                         free(lfmri);
6809                         return;
6810                 }
6811 
6812                 if (prop_name != NULL &&
6813                     strcmp(prop_name, SCF_PROPERTY_ENABLED) != 0) {
6814                         free(lfmri);
6815                         return;
6816                 }
6817 
6818                 /*
6819                  * Because the instance has already been deleted from the
6820                  * repository, we cannot use any scf_ functions to retrieve
6821                  * the instance FMRI however we can easily reconstruct it
6822                  * manually.
6823                  */
6824                 end_inst_fmri = strstr(fmri, SCF_FMRI_PROPERTYGRP_PREFIX);
6825                 if (end_inst_fmri == NULL)
6826                         bad_error("process_delete", 0);
6827 
6828                 end_inst_fmri[0] = '\0';
6829 
6830                 (void) dgraph_remove_instance(fmri, h);
6831         }
6832 
6833         free(lfmri);
6834 }
6835 
6836 /*ARGSUSED*/
6837 void *
6838 repository_event_thread(void *unused)
6839 {
6840         scf_handle_t *h;
6841         scf_propertygroup_t *pg;
6842         scf_instance_t *inst;
6843         char *fmri = startd_alloc(max_scf_fmri_size);
6844         char *pg_name = startd_alloc(max_scf_value_size);
6845         int r;
6846 
6847         h = libscf_handle_create_bound_loop();
6848 
6849         pg = safe_scf_pg_create(h);
6850         inst = safe_scf_instance_create(h);
6851 
6852 retry:
6853         if (_scf_notify_add_pgtype(h, SCF_GROUP_FRAMEWORK) != SCF_SUCCESS) {
6854                 if (scf_error() == SCF_ERROR_CONNECTION_BROKEN) {
6855                         libscf_handle_rebind(h);
6856                 } else {
6857                         log_error(LOG_WARNING,
6858                             "Couldn't set up repository notification "
6859                             "for property group type %s: %s\n",
6860                             SCF_GROUP_FRAMEWORK, scf_strerror(scf_error()));
6861 
6862                         (void) sleep(1);
6863                 }
6864 
6865                 goto retry;
6866         }
6867 
6868         /*CONSTCOND*/
6869         while (1) {
6870                 ssize_t res;
6871 
6872                 /* Note: fmri is only set on delete events. */
6873                 res = _scf_notify_wait(pg, fmri, max_scf_fmri_size);
6874                 if (res < 0) {
6875                         libscf_handle_rebind(h);
6876                         goto retry;
6877                 } else if (res == 0) {
6878                         /*
6879                          * property group modified.  inst and pg_name are
6880                          * pre-allocated scratch space.
6881                          */
6882                         if (scf_pg_update(pg) < 0) {
6883                                 switch (scf_error()) {
6884                                 case SCF_ERROR_DELETED:
6885                                         continue;
6886 
6887                                 case SCF_ERROR_CONNECTION_BROKEN:
6888                                         log_error(LOG_WARNING,
6889                                             "Lost repository event due to "
6890                                             "disconnection.\n");
6891                                         libscf_handle_rebind(h);
6892                                         goto retry;
6893 
6894                                 case SCF_ERROR_NOT_BOUND:
6895                                 case SCF_ERROR_NOT_SET:
6896                                 default:
6897                                         bad_error("scf_pg_update", scf_error());
6898                                 }
6899                         }
6900 
6901                         r = process_pg_event(h, pg, inst, pg_name);
6902                         switch (r) {
6903                         case 0:
6904                                 break;
6905 
6906                         case ECONNABORTED:
6907                                 log_error(LOG_WARNING, "Lost repository event "
6908                                     "due to disconnection.\n");
6909                                 libscf_handle_rebind(h);
6910                                 /* FALLTHROUGH */
6911 
6912                         case ECONNRESET:
6913                                 goto retry;
6914 
6915                         default:
6916                                 bad_error("process_pg_event", r);
6917                         }
6918                 } else {
6919                         /*
6920                          * Service, instance, or pg deleted.
6921                          * Don't trust fmri on return.
6922                          */
6923                         process_delete(fmri, h);
6924                 }
6925         }
6926 
6927         /*NOTREACHED*/
6928         return (NULL);
6929 }
6930 
6931 void
6932 graph_engine_start()
6933 {
6934         int err;
6935 
6936         (void) startd_thread_create(graph_thread, NULL);
6937 
6938         MUTEX_LOCK(&dgraph_lock);
6939         while (!initial_milestone_set) {
6940                 err = pthread_cond_wait(&initial_milestone_cv, &dgraph_lock);
6941                 assert(err == 0);
6942         }
6943         MUTEX_UNLOCK(&dgraph_lock);
6944 
6945         (void) startd_thread_create(repository_event_thread, NULL);
6946         (void) startd_thread_create(graph_event_thread, NULL);
6947 }
--- EOF ---