1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2019 Joyent, Inc.
24 */
25
26 #include <sys/mutex.h>
27 #include <sys/debug.h>
28 #include <sys/types.h>
29 #include <sys/param.h>
30 #include <sys/kmem.h>
31 #include <sys/thread.h>
32 #include <sys/id_space.h>
33 #include <sys/avl.h>
34 #include <sys/list.h>
35 #include <sys/sysmacros.h>
36 #include <sys/proc.h>
37 #include <sys/contract.h>
38 #include <sys/contract_impl.h>
39 #include <sys/contract/device.h>
40 #include <sys/contract/device_impl.h>
41 #include <sys/cmn_err.h>
42 #include <sys/nvpair.h>
43 #include <sys/policy.h>
44 #include <sys/ddi_impldefs.h>
45 #include <sys/ddi_implfuncs.h>
46 #include <sys/systm.h>
47 #include <sys/stat.h>
48 #include <sys/sunddi.h>
49 #include <sys/esunddi.h>
50 #include <sys/ddi.h>
51 #include <sys/fs/dv_node.h>
52 #include <sys/sunndi.h>
53 #undef ct_lock /* needed because clnt.h defines ct_lock as a macro */
54
55 /*
56 * Device Contracts
57 * -----------------
58 * This file contains the core code for the device contracts framework.
59 * A device contract is an agreement or a contract between a process and
60 * the kernel regarding the state of the device. A device contract may be
61 * created when a relationship is formed between a device and a process
62 * i.e. at open(2) time, or it may be created at some point after the device
63 * has been opened. A device contract once formed may be broken by either party.
64 * A device contract can be broken by the process by an explicit abandon of the
65 * contract or by an implicit abandon when the process exits. A device contract
66 * can be broken by the kernel either asynchronously (without negotiation) or
67 * synchronously (with negotiation). Exactly which happens depends on the device
68 * state transition. The following state diagram shows the transitions between
69 * device states. Only device state transitions currently supported by device
70 * contracts is shown.
71 *
72 * <-- A -->
73 * /-----------------> DEGRADED
74 * | |
75 * | |
76 * | | S
77 * | | |
78 * | | v
79 * v S --> v
80 * ONLINE ------------> OFFLINE
81 *
82 *
83 * In the figure above, the arrows indicate the direction of transition. The
84 * letter S refers to transitions which are inherently synchronous i.e.
85 * require negotiation and the letter A indicates transitions which are
86 * asynchronous i.e. are done without contract negotiations. A good example
87 * of a synchronous transition is the ONLINE -> OFFLINE transition. This
88 * transition cannot happen as long as there are consumers which have the
89 * device open. Thus some form of negotiation needs to happen between the
90 * consumers and the kernel to ensure that consumers either close devices
91 * or disallow the move to OFFLINE. Certain other transitions such as
92 * ONLINE --> DEGRADED for example, are inherently asynchronous i.e.
93 * non-negotiable. A device that suffers a fault that degrades its
94 * capabilities will become degraded irrespective of what consumers it has,
95 * so a negotiation in this case is pointless.
96 *
97 * The following device states are currently defined for device contracts:
98 *
99 * CT_DEV_EV_ONLINE
100 * The device is online and functioning normally
101 * CT_DEV_EV_DEGRADED
102 * The device is online but is functioning in a degraded capacity
103 * CT_DEV_EV_OFFLINE
104 * The device is offline and is no longer configured
105 *
106 * A typical consumer of device contracts starts out with a contract
107 * template and adds terms to that template. These include the
108 * "acceptable set" (A-set) term, which is a bitset of device states which
109 * are guaranteed by the contract. If the device moves out of a state in
110 * the A-set, the contract is broken. The breaking of the contract can
111 * be asynchronous in which case a critical contract event is sent to the
112 * contract holder but no negotiations take place. If the breaking of the
113 * contract is synchronous, negotations are opened between the affected
114 * consumer and the kernel. The kernel does this by sending a critical
115 * event to the consumer with the CTE_NEG flag set indicating that this
116 * is a negotiation event. The consumer can accept this change by sending
117 * a ACK message to the kernel. Alternatively, if it has the necessary
118 * privileges, it can send a NACK message to the kernel which will block
119 * the device state change. To NACK a negotiable event, a process must
120 * have the {PRIV_SYS_DEVICES} privilege asserted in its effective set.
121 *
122 * Other terms include the "minor path" term, specified explicitly if the
123 * contract is not being created at open(2) time or specified implicitly
124 * if the contract is being created at open time via an activated template.
125 *
126 * A contract event is sent on any state change to which the contract
127 * owner has subscribed via the informative or critical event sets. Only
128 * critical events are guaranteed to be delivered. Since all device state
129 * changes are controlled by the kernel and cannot be arbitrarily generated
130 * by a non-privileged user, the {PRIV_CONTRACT_EVENT} privilege does not
131 * need to be asserted in a process's effective set to designate an event as
132 * critical. To ensure privacy, a process must either have the same effective
133 * userid as the contract holder or have the {PRIV_CONTRACT_OBSERVER} privilege
134 * asserted in its effective set in order to observe device contract events
135 * off the device contract type specific endpoint.
136 *
137 * Yet another term available with device contracts is the "non-negotiable"
138 * term. This term is used to pre-specify a NACK to any contract negotiation.
139 * This term is ignored for asynchronous state changes. For example, a
140 * provcess may have the A-set {ONLINE|DEGRADED} and make the contract
141 * non-negotiable. In this case, the device contract framework assumes a
142 * NACK for any transition to OFFLINE and blocks the offline. If the A-set
143 * is {ONLINE} and the non-negotiable term is set, transitions to OFFLINE
144 * are NACKed but transitions to DEGRADE succeed.
145 *
146 * The OFFLINE negotiation (if OFFLINE state is not in the A-set for a contract)
147 * happens just before the I/O framework attempts to offline a device
148 * (i.e. detach a device and set the offline flag so that it cannot be
149 * reattached). A device contract holder is expected to either NACK the offline
150 * (if privileged) or release the device and allow the offline to proceed.
151 *
152 * The DEGRADE contract event (if DEGRADE is not in the A-set for a contract)
153 * is generated just before the I/O framework transitions the device state
154 * to "degraded" (i.e. DEVI_DEVICE_DEGRADED in I/O framework terminology).
155 *
156 * The contract holder is expected to ACK or NACK a negotiation event
157 * within a certain period of time. If the ACK/NACK is not received
158 * within the timeout period, the device contract framework will behave
159 * as if the contract does not exist and will proceed with the event.
160 *
161 * Unlike a process contract a device contract does not need to exist
162 * once it is abandoned, since it does not define a fault boundary. It
163 * merely represents an agreement between a process and the kernel
164 * regarding the state of the device. Once the process has abandoned
165 * the contract (either implicitly via a process exit or explicitly)
166 * the kernel has no reason to retain the contract. As a result
167 * device contracts are neither inheritable nor need to exist in an
168 * orphan state.
169 *
170 * A device unlike a process may exist in multiple contracts and has
171 * a "life" outside a device contract. A device unlike a process
172 * may exist without an associated contract. Unlike a process contract
173 * a device contract may be formed after a binding relationship is
174 * formed between a process and a device.
175 *
176 * IMPLEMENTATION NOTES
177 * ====================
178 * DATA STRUCTURES
179 * ----------------
180 * The heart of the device contracts implementation is the device contract
181 * private cont_device_t (or ctd for short) data structure. It encapsulates
182 * the generic contract_t data structure and has a number of private
183 * fields.
184 * These include:
185 * cond_minor: The minor device that is the subject of the contract
186 * cond_aset: The bitset of states which are guaranteed by the
187 * contract
188 * cond_noneg: If set, indicates that the result of negotiation has
189 * been predefined to be a NACK
190 * In addition, there are other device identifiers such the devinfo node,
191 * dev_t and spec_type of the minor node. There are also a few fields that
192 * are used during negotiation to maintain state. See
193 * uts/common/sys/contract/device_impl.h
194 * for details.
195 * The ctd structure represents the device private part of a contract of
196 * type "device"
197 *
198 * Another data structure used by device contracts is ctmpl_device. It is
199 * the device contracts private part of the contract template structure. It
200 * encapsulates the generic template structure "ct_template_t" and includes
201 * the following device contract specific fields
202 * ctd_aset: The bitset of states that should be guaranteed by a
203 * contract
204 * ctd_noneg: If set, indicates that contract should NACK a
205 * negotiation
206 * ctd_minor: The devfs_path (without the /devices prefix) of the
207 * minor node that is the subject of the contract.
208 *
209 * ALGORITHMS
210 * ---------
211 * There are three sets of routines in this file
212 * Template related routines
213 * -------------------------
214 * These routines provide support for template related operations initated
215 * via the generic template operations. These include routines that dup
216 * a template, free it, and set various terms in the template
217 * (such as the minor node path, the acceptable state set (or A-set)
218 * and the non-negotiable term) as well as a routine to query the
219 * device specific portion of the template for the abovementioned terms.
220 * There is also a routine to create (ctmpl_device_create) that is used to
221 * create a contract from a template. This routine calls (after initial
222 * setup) the common function used to create a device contract
223 * (contract_device_create).
224 *
225 * core device contract implementation
226 * ----------------------------------
227 * These routines support the generic contract framework to provide
228 * functionality that allows contracts to be created, managed and
229 * destroyed. The contract_device_create() routine is a routine used
230 * to create a contract from a template (either via an explicit create
231 * operation on a template or implicitly via an open with an
232 * activated template.). The contract_device_free() routine assists
233 * in freeing the device contract specific parts. There are routines
234 * used to abandon (contract_device_abandon) a device contract as well
235 * as a routine to destroy (which despite its name does not destroy,
236 * it only moves a contract to a dead state) a contract.
237 * There is also a routine to return status information about a
238 * contract - the level of detail depends on what is requested by the
239 * user. A value of CTD_FIXED only returns fixed length fields such
240 * as the A-set, state of device and value of the "noneg" term. If
241 * CTD_ALL is specified, the minor node path is returned as well.
242 *
243 * In addition there are interfaces (contract_device_ack/nack) which
244 * are used to support negotiation between userland processes and
245 * device contracts. These interfaces record the acknowledgement
246 * or lack thereof for negotiation events and help determine if the
247 * negotiated event should occur.
248 *
249 * "backend routines"
250 * -----------------
251 * The backend routines form the interface between the I/O framework
252 * and the device contract subsystem. These routines, allow the I/O
253 * framework to call into the device contract subsystem to notify it of
254 * impending changes to a device state as well as to inform of the
255 * final disposition of such attempted state changes. Routines in this
256 * class include contract_device_offline() that indicates an attempt to
257 * offline a device, contract_device_degrade() that indicates that
258 * a device is moving to the degraded state and contract_device_negend()
259 * that is used by the I/O framework to inform the contracts subsystem of
260 * the final disposition of an attempted operation.
261 *
262 * SUMMARY
263 * -------
264 * A contract starts its life as a template. A process allocates a device
265 * contract template and sets various terms:
266 * The A-set
267 * The device minor node
268 * Critical and informative events
269 * The noneg i.e. no negotition term
270 * Setting of these terms in the template is done via the
271 * ctmpl_device_set() entry point in this file. A process can query a
272 * template to determine the terms already set in the template - this is
273 * facilitated by the ctmpl_device_get() routine.
274 *
275 * Once all the appropriate terms are set, the contract is instantiated via
276 * one of two methods
277 * - via an explicit create operation - this is facilitated by the
278 * ctmpl_device_create() entry point
279 * - synchronously with the open(2) system call - this is achieved via the
280 * contract_device_open() routine.
281 * The core work for both these above functions is done by
282 * contract_device_create()
283 *
284 * A contract once created can be queried for its status. Support for
285 * status info is provided by both the common contracts framework and by
286 * the "device" contract type. If the level of detail requested is
287 * CTD_COMMON, only the common contract framework data is used. Higher
288 * levels of detail result in calls to contract_device_status() to supply
289 * device contract type specific status information.
290 *
291 * A contract once created may be abandoned either explicitly or implictly.
292 * In either case, the contract_device_abandon() function is invoked. This
293 * function merely calls contract_destroy() which moves the contract to
294 * the DEAD state. The device contract portion of destroy processing is
295 * provided by contract_device_destroy() which merely disassociates the
296 * contract from its device devinfo node. A contract in the DEAD state is
297 * not freed. It hanbgs around until all references to the contract are
298 * gone. When that happens, the contract is finally deallocated. The
299 * device contract specific portion of the free is done by
300 * contract_device_free() which finally frees the device contract specific
301 * data structure (cont_device_t).
302 *
303 * When a device undergoes a state change, the I/O framework calls the
304 * corresponding device contract entry point. For example, when a device
305 * is about to go OFFLINE, the routine contract_device_offline() is
306 * invoked. Similarly if a device moves to DEGRADED state, the routine
307 * contract_device_degrade() function is called. These functions call the
308 * core routine contract_device_publish(). This function determines via
309 * the function is_sync_neg() whether an event is a synchronous (i.e.
310 * negotiable) event or not. In the former case contract_device_publish()
311 * publishes a CTE_NEG event and then waits in wait_for_acks() for ACKs
312 * and/or NACKs from contract holders. In the latter case, it simply
313 * publishes the event and does not wait. In the negotiation case, ACKs or
314 * NACKs from userland consumers results in contract_device_ack_nack()
315 * being called where the result of the negotiation is recorded in the
316 * contract data structure. Once all outstanding contract owners have
317 * responded, the device contract code in wait_for_acks() determines the
318 * final result of the negotiation. A single NACK overrides all other ACKs
319 * If there is no NACK, then a single ACK will result in an overall ACK
320 * result. If there are no ACKs or NACKs, then the result CT_NONE is
321 * returned back to the I/O framework. Once the event is permitted or
322 * blocked, the I/O framework proceeds or aborts the state change. The
323 * I/O framework then calls contract_device_negend() with a result code
324 * indicating final disposition of the event. This call releases the
325 * barrier and other state associated with the previous negotiation,
326 * which permits the next event (if any) to come into the device contract
327 * framework.
328 *
329 * Finally, a device that has outstanding contracts may be removed from
330 * the system which results in its devinfo node being freed. The devinfo
331 * free routine in the I/O framework, calls into the device contract
332 * function - contract_device_remove_dip(). This routine, disassociates
333 * the dip from all contracts associated with the contract being freed,
334 * allowing the devinfo node to be freed.
335 *
336 * LOCKING
337 * ---------
338 * There are four sets of data that need to be protected by locks
339 *
340 * i) device contract specific portion of the contract template - This data
341 * is protected by the template lock ctmpl_lock.
342 *
343 * ii) device contract specific portion of the contract - This data is
344 * protected by the contract lock ct_lock
345 *
346 * iii) The linked list of contracts hanging off a devinfo node - This
347 * list is protected by the per-devinfo node lock devi_ct_lock
348 *
349 * iv) Finally there is a barrier, controlled by devi_ct_lock, devi_ct_cv
350 * and devi_ct_count that controls state changes to a dip
351 *
352 * The template lock is independent in that none of the other locks in this
353 * file may be taken while holding the template lock (and vice versa).
354 *
355 * The remaining three locks have the following lock order
356 *
357 * devi_ct_lock -> ct_count barrier -> ct_lock
358 *
359 */
360
361 static cont_device_t *contract_device_create(ctmpl_device_t *dtmpl, dev_t dev,
362 int spec_type, proc_t *owner, int *errorp);
363
364 /* barrier routines */
365 static void ct_barrier_acquire(dev_info_t *dip);
366 static void ct_barrier_release(dev_info_t *dip);
367 static int ct_barrier_held(dev_info_t *dip);
368 static int ct_barrier_empty(dev_info_t *dip);
369 static void ct_barrier_wait_for_release(dev_info_t *dip);
370 static int ct_barrier_wait_for_empty(dev_info_t *dip, int secs);
371 static void ct_barrier_decr(dev_info_t *dip);
372 static void ct_barrier_incr(dev_info_t *dip);
373
374 ct_type_t *device_type;
375
376 /*
377 * Macro predicates for determining when events should be sent and how.
378 */
379 #define EVSENDP(ctd, flag) \
380 ((ctd->cond_contract.ct_ev_info | ctd->cond_contract.ct_ev_crit) & flag)
381
382 #define EVINFOP(ctd, flag) \
383 ((ctd->cond_contract.ct_ev_crit & flag) == 0)
384
385 /*
386 * State transition table showing which transitions are synchronous and which
387 * are not.
388 */
389 struct ct_dev_negtable {
390 uint_t st_old;
391 uint_t st_new;
392 uint_t st_neg;
393 } ct_dev_negtable[] = {
394 {CT_DEV_EV_ONLINE, CT_DEV_EV_OFFLINE, 1},
395 {CT_DEV_EV_ONLINE, CT_DEV_EV_DEGRADED, 0},
396 {CT_DEV_EV_DEGRADED, CT_DEV_EV_ONLINE, 0},
397 {CT_DEV_EV_DEGRADED, CT_DEV_EV_OFFLINE, 1},
398 {0}
399 };
400
401 /*
402 * Device contract template implementation
403 */
404
405 /*
406 * ctmpl_device_dup
407 *
408 * The device contract template dup entry point.
409 * This simply copies all the fields (generic as well as device contract
410 * specific) fields of the original.
411 */
412 static struct ct_template *
413 ctmpl_device_dup(struct ct_template *template)
414 {
415 ctmpl_device_t *new;
416 ctmpl_device_t *old = template->ctmpl_data;
417 char *buf;
418 char *minor;
419
420 new = kmem_zalloc(sizeof (ctmpl_device_t), KM_SLEEP);
421 buf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
422
423 /*
424 * copy generic fields.
425 * ctmpl_copy returns with old template lock held
426 */
427 ctmpl_copy(&new->ctd_ctmpl, template);
428
429 new->ctd_ctmpl.ctmpl_data = new;
430 new->ctd_aset = old->ctd_aset;
431 new->ctd_minor = NULL;
432 new->ctd_noneg = old->ctd_noneg;
433
434 if (old->ctd_minor) {
435 ASSERT(strlen(old->ctd_minor) + 1 <= MAXPATHLEN);
436 bcopy(old->ctd_minor, buf, strlen(old->ctd_minor) + 1);
437 } else {
438 kmem_free(buf, MAXPATHLEN);
439 buf = NULL;
440 }
441
442 mutex_exit(&template->ctmpl_lock);
443 if (buf) {
444 minor = i_ddi_strdup(buf, KM_SLEEP);
445 kmem_free(buf, MAXPATHLEN);
446 buf = NULL;
447 } else {
448 minor = NULL;
449 }
450 mutex_enter(&template->ctmpl_lock);
451
452 if (minor) {
453 new->ctd_minor = minor;
454 }
455
456 ASSERT(buf == NULL);
457 return (&new->ctd_ctmpl);
458 }
459
460 /*
461 * ctmpl_device_free
462 *
463 * The device contract template free entry point. Just
464 * frees the template.
465 */
466 static void
467 ctmpl_device_free(struct ct_template *template)
468 {
469 ctmpl_device_t *dtmpl = template->ctmpl_data;
470
471 if (dtmpl->ctd_minor)
472 kmem_free(dtmpl->ctd_minor, strlen(dtmpl->ctd_minor) + 1);
473
474 kmem_free(dtmpl, sizeof (ctmpl_device_t));
475 }
476
477 /*
478 * SAFE_EV is the set of events which a non-privileged process is
479 * allowed to make critical. An unprivileged device contract owner has
480 * no control over when a device changes state, so all device events
481 * can be in the critical set.
482 *
483 * EXCESS tells us if "value", a critical event set, requires
484 * additional privilege. For device contracts EXCESS currently
485 * evaluates to 0.
486 */
487 #define SAFE_EV (CT_DEV_ALLEVENT)
488 #define EXCESS(value) ((value) & ~SAFE_EV)
489
490
491 /*
492 * ctmpl_device_set
493 *
494 * The device contract template set entry point. Sets various terms in the
495 * template. The non-negotiable term can only be set if the process has
496 * the {PRIV_SYS_DEVICES} privilege asserted in its effective set.
497 */
498 static int
499 ctmpl_device_set(struct ct_template *tmpl, ct_kparam_t *kparam,
500 const cred_t *cr)
501 {
502 ctmpl_device_t *dtmpl = tmpl->ctmpl_data;
503 ct_param_t *param = &kparam->param;
504 int error;
505 dev_info_t *dip;
506 int spec_type;
507 uint64_t param_value;
508 char *str_value;
509
510 ASSERT(MUTEX_HELD(&tmpl->ctmpl_lock));
511
512 if (param->ctpm_id == CTDP_MINOR) {
513 str_value = (char *)kparam->ctpm_kbuf;
514 str_value[param->ctpm_size - 1] = '\0';
515 } else {
516 if (param->ctpm_size < sizeof (uint64_t))
517 return (EINVAL);
518 param_value = *(uint64_t *)kparam->ctpm_kbuf;
519 }
520
521 switch (param->ctpm_id) {
522 case CTDP_ACCEPT:
523 if (param_value & ~CT_DEV_ALLEVENT)
524 return (EINVAL);
525 if (param_value == 0)
526 return (EINVAL);
527 if (param_value == CT_DEV_ALLEVENT)
528 return (EINVAL);
529
530 dtmpl->ctd_aset = param_value;
531 break;
532 case CTDP_NONEG:
533 if (param_value != CTDP_NONEG_SET &&
534 param_value != CTDP_NONEG_CLEAR)
535 return (EINVAL);
536
537 /*
538 * only privileged processes can designate a contract
539 * non-negotiatble.
540 */
541 if (param_value == CTDP_NONEG_SET &&
542 (error = secpolicy_sys_devices(cr)) != 0) {
543 return (error);
544 }
545
546 dtmpl->ctd_noneg = param_value;
547 break;
548
549 case CTDP_MINOR:
550 if (*str_value != '/' ||
551 strncmp(str_value, "/devices/",
552 strlen("/devices/")) == 0 ||
553 strstr(str_value, "../devices/") != NULL ||
554 strchr(str_value, ':') == NULL) {
555 return (EINVAL);
556 }
557
558 spec_type = 0;
559 dip = NULL;
560 if (resolve_pathname(str_value, &dip, NULL, &spec_type) != 0) {
561 return (ERANGE);
562 }
563 ddi_release_devi(dip);
564
565 if (spec_type != S_IFCHR && spec_type != S_IFBLK) {
566 return (EINVAL);
567 }
568
569 if (dtmpl->ctd_minor != NULL) {
570 kmem_free(dtmpl->ctd_minor,
571 strlen(dtmpl->ctd_minor) + 1);
572 }
573 dtmpl->ctd_minor = i_ddi_strdup(str_value, KM_SLEEP);
574 break;
575 case CTP_EV_CRITICAL:
576 /*
577 * Currently for device contracts, any event
578 * may be added to the critical set. We retain the
579 * following code however for future enhancements.
580 */
581 if (EXCESS(param_value) &&
582 (error = secpolicy_contract_event(cr)) != 0)
583 return (error);
584 tmpl->ctmpl_ev_crit = param_value;
585 break;
586 default:
587 return (EINVAL);
588 }
589
590 return (0);
591 }
592
593 /*
594 * ctmpl_device_get
595 *
596 * The device contract template get entry point. Simply fetches and
597 * returns the value of the requested term.
598 */
599 static int
600 ctmpl_device_get(struct ct_template *template, ct_kparam_t *kparam)
601 {
602 ctmpl_device_t *dtmpl = template->ctmpl_data;
603 ct_param_t *param = &kparam->param;
604 uint64_t *param_value = kparam->ctpm_kbuf;
605
606 ASSERT(MUTEX_HELD(&template->ctmpl_lock));
607
608 if (param->ctpm_id == CTDP_ACCEPT ||
609 param->ctpm_id == CTDP_NONEG) {
610 if (param->ctpm_size < sizeof (uint64_t))
611 return (EINVAL);
612 kparam->ret_size = sizeof (uint64_t);
613 }
614
615 switch (param->ctpm_id) {
616 case CTDP_ACCEPT:
617 *param_value = dtmpl->ctd_aset;
618 break;
619 case CTDP_NONEG:
620 *param_value = dtmpl->ctd_noneg;
621 break;
622 case CTDP_MINOR:
623 if (dtmpl->ctd_minor) {
624 kparam->ret_size = strlcpy((char *)kparam->ctpm_kbuf,
625 dtmpl->ctd_minor, param->ctpm_size);
626 kparam->ret_size++;
627 } else {
628 return (ENOENT);
629 }
630 break;
631 default:
632 return (EINVAL);
633 }
634
635 return (0);
636 }
637
638 /*
639 * Device contract type specific portion of creating a contract using
640 * a specified template
641 */
642 /*ARGSUSED*/
643 int
644 ctmpl_device_create(ct_template_t *template, ctid_t *ctidp)
645 {
646 ctmpl_device_t *dtmpl;
647 char *buf;
648 dev_t dev;
649 int spec_type;
650 int error;
651 cont_device_t *ctd;
652
653 if (ctidp == NULL)
654 return (EINVAL);
655
656 buf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
657
658 dtmpl = template->ctmpl_data;
659
660 mutex_enter(&template->ctmpl_lock);
661 if (dtmpl->ctd_minor == NULL) {
662 /* incomplete template */
663 mutex_exit(&template->ctmpl_lock);
664 kmem_free(buf, MAXPATHLEN);
665 return (EINVAL);
666 } else {
667 ASSERT(strlen(dtmpl->ctd_minor) < MAXPATHLEN);
668 bcopy(dtmpl->ctd_minor, buf, strlen(dtmpl->ctd_minor) + 1);
669 }
670 mutex_exit(&template->ctmpl_lock);
671
672 spec_type = 0;
673 dev = NODEV;
674 if (resolve_pathname(buf, NULL, &dev, &spec_type) != 0 ||
675 dev == NODEV || dev == DDI_DEV_T_ANY || dev == DDI_DEV_T_NONE ||
676 (spec_type != S_IFCHR && spec_type != S_IFBLK)) {
677 CT_DEBUG((CE_WARN,
678 "tmpl_create: failed to find device: %s", buf));
679 kmem_free(buf, MAXPATHLEN);
680 return (ERANGE);
681 }
682 kmem_free(buf, MAXPATHLEN);
683
684 ctd = contract_device_create(template->ctmpl_data,
685 dev, spec_type, curproc, &error);
686
687 if (ctd == NULL) {
688 CT_DEBUG((CE_WARN, "Failed to create device contract for "
689 "process (%d) with device (devt = %lu, spec_type = %s)",
690 curproc->p_pid, dev,
691 spec_type == S_IFCHR ? "S_IFCHR" : "S_IFBLK"));
692 return (error);
693 }
694
695 mutex_enter(&ctd->cond_contract.ct_lock);
696 *ctidp = ctd->cond_contract.ct_id;
697 mutex_exit(&ctd->cond_contract.ct_lock);
698
699 return (0);
700 }
701
702 /*
703 * Device contract specific template entry points
704 */
705 static ctmplops_t ctmpl_device_ops = {
706 ctmpl_device_dup, /* ctop_dup */
707 ctmpl_device_free, /* ctop_free */
708 ctmpl_device_set, /* ctop_set */
709 ctmpl_device_get, /* ctop_get */
710 ctmpl_device_create, /* ctop_create */
711 CT_DEV_ALLEVENT /* all device events bitmask */
712 };
713
714
715 /*
716 * Device contract implementation
717 */
718
719 /*
720 * contract_device_default
721 *
722 * The device contract default template entry point. Creates a
723 * device contract template with a default A-set and no "noneg" ,
724 * with informative degrade events and critical offline events.
725 * There is no default minor path.
726 */
727 static ct_template_t *
728 contract_device_default(void)
729 {
730 ctmpl_device_t *new;
731
732 new = kmem_zalloc(sizeof (ctmpl_device_t), KM_SLEEP);
733 ctmpl_init(&new->ctd_ctmpl, &ctmpl_device_ops, device_type, new);
734
735 new->ctd_aset = CT_DEV_EV_ONLINE | CT_DEV_EV_DEGRADED;
736 new->ctd_noneg = 0;
737 new->ctd_ctmpl.ctmpl_ev_info = CT_DEV_EV_DEGRADED;
738 new->ctd_ctmpl.ctmpl_ev_crit = CT_DEV_EV_OFFLINE;
739
740 return (&new->ctd_ctmpl);
741 }
742
743 /*
744 * contract_device_free
745 *
746 * Destroys the device contract specific portion of a contract and
747 * frees the contract.
748 */
749 static void
750 contract_device_free(contract_t *ct)
751 {
752 cont_device_t *ctd = ct->ct_data;
753
754 ASSERT(ctd->cond_minor);
755 ASSERT(strlen(ctd->cond_minor) < MAXPATHLEN);
756 kmem_free(ctd->cond_minor, strlen(ctd->cond_minor) + 1);
757
758 ASSERT(ctd->cond_devt != DDI_DEV_T_ANY &&
759 ctd->cond_devt != DDI_DEV_T_NONE && ctd->cond_devt != NODEV);
760
761 ASSERT(ctd->cond_spec == S_IFBLK || ctd->cond_spec == S_IFCHR);
762
763 ASSERT(!(ctd->cond_aset & ~CT_DEV_ALLEVENT));
764 ASSERT(ctd->cond_noneg == 0 || ctd->cond_noneg == 1);
765
766 ASSERT(!(ctd->cond_currev_type & ~CT_DEV_ALLEVENT));
767 ASSERT(!(ctd->cond_currev_ack & ~(CT_ACK | CT_NACK)));
768
769 ASSERT((ctd->cond_currev_id > 0) ^ (ctd->cond_currev_type == 0));
770 ASSERT((ctd->cond_currev_id > 0) || (ctd->cond_currev_ack == 0));
771
772 ASSERT(!list_link_active(&ctd->cond_next));
773
774 kmem_free(ctd, sizeof (cont_device_t));
775 }
776
777 /*
778 * contract_device_abandon
779 *
780 * The device contract abandon entry point.
781 */
782 static void
783 contract_device_abandon(contract_t *ct)
784 {
785 ASSERT(MUTEX_HELD(&ct->ct_lock));
786
787 /*
788 * device contracts cannot be inherited or orphaned.
789 * Move the contract to the DEAD_STATE. It will be freed
790 * once all references to it are gone.
791 */
792 contract_destroy(ct);
793 }
794
795 /*
796 * contract_device_destroy
797 *
798 * The device contract destroy entry point.
799 * Called from contract_destroy() to do any type specific destroy. Note
800 * that destroy is a misnomer - this does not free the contract, it only
801 * moves it to the dead state. A contract is actually freed via
802 * contract_rele() -> contract_dtor(), contop_free()
803 */
804 static void
805 contract_device_destroy(contract_t *ct)
806 {
807 cont_device_t *ctd;
808 dev_info_t *dip;
809
810 ASSERT(MUTEX_HELD(&ct->ct_lock));
811
812 for (;;) {
813 ctd = ct->ct_data;
814 dip = ctd->cond_dip;
815 if (dip == NULL) {
816 /*
817 * The dip has been removed, this is a dangling contract
818 * Check that dip linkages are NULL
819 */
820 ASSERT(!list_link_active(&ctd->cond_next));
821 CT_DEBUG((CE_NOTE, "contract_device_destroy:"
822 " contract has no devinfo node. contract ctid : %d",
823 ct->ct_id));
824 return;
825 }
826
827 /*
828 * The intended lock order is : devi_ct_lock -> ct_count
829 * barrier -> ct_lock.
830 * However we can't do this here as dropping the ct_lock allows
831 * a race condition with i_ddi_free_node()/
832 * contract_device_remove_dip() which may free off dip before
833 * we can take devi_ct_lock. So use mutex_tryenter to avoid
834 * dropping ct_lock until we have acquired devi_ct_lock.
835 */
836 if (mutex_tryenter(&(DEVI(dip)->devi_ct_lock)) != 0)
837 break;
838 mutex_exit(&ct->ct_lock);
839 delay(drv_usectohz(1000));
840 mutex_enter(&ct->ct_lock);
841 }
842 mutex_exit(&ct->ct_lock);
843
844 /*
845 * Waiting for the barrier to be released is strictly speaking not
846 * necessary. But it simplifies the implementation of
847 * contract_device_publish() by establishing the invariant that
848 * device contracts cannot go away during negotiation.
849 */
850 ct_barrier_wait_for_release(dip);
851 mutex_enter(&ct->ct_lock);
852
853 list_remove(&(DEVI(dip)->devi_ct), ctd);
854 ctd->cond_dip = NULL; /* no longer linked to dip */
855 contract_rele(ct); /* remove hold for dip linkage */
856
857 mutex_exit(&ct->ct_lock);
858 mutex_exit(&(DEVI(dip)->devi_ct_lock));
859 mutex_enter(&ct->ct_lock);
860 }
861
862 /*
863 * contract_device_status
864 *
865 * The device contract status entry point. Called when level of "detail"
866 * is either CTD_FIXED or CTD_ALL
867 *
868 */
869 static void
870 contract_device_status(contract_t *ct, zone_t *zone, int detail, nvlist_t *nvl,
871 void *status, model_t model)
872 {
873 cont_device_t *ctd = ct->ct_data;
874
875 ASSERT(detail == CTD_FIXED || detail == CTD_ALL);
876
877 mutex_enter(&ct->ct_lock);
878 contract_status_common(ct, zone, status, model);
879
880 /*
881 * There's no need to hold the contract lock while accessing static
882 * data like aset or noneg. But since we need the lock to access other
883 * data like state, we hold it anyway.
884 */
885 VERIFY(nvlist_add_uint32(nvl, CTDS_STATE, ctd->cond_state) == 0);
886 VERIFY(nvlist_add_uint32(nvl, CTDS_ASET, ctd->cond_aset) == 0);
887 VERIFY(nvlist_add_uint32(nvl, CTDS_NONEG, ctd->cond_noneg) == 0);
888
889 if (detail == CTD_FIXED) {
890 mutex_exit(&ct->ct_lock);
891 return;
892 }
893
894 ASSERT(ctd->cond_minor);
895 VERIFY(nvlist_add_string(nvl, CTDS_MINOR, ctd->cond_minor) == 0);
896
897 mutex_exit(&ct->ct_lock);
898 }
899
900 /*
901 * Converts a result integer into the corresponding string. Used for printing
902 * messages
903 */
904 static char *
905 result_str(uint_t result)
906 {
907 switch (result) {
908 case CT_ACK:
909 return ("CT_ACK");
910 case CT_NACK:
911 return ("CT_NACK");
912 case CT_NONE:
913 return ("CT_NONE");
914 default:
915 return ("UNKNOWN");
916 }
917 }
918
919 /*
920 * Converts a device state integer constant into the corresponding string.
921 * Used to print messages.
922 */
923 static char *
924 state_str(uint_t state)
925 {
926 switch (state) {
927 case CT_DEV_EV_ONLINE:
928 return ("ONLINE");
929 case CT_DEV_EV_DEGRADED:
930 return ("DEGRADED");
931 case CT_DEV_EV_OFFLINE:
932 return ("OFFLINE");
933 default:
934 return ("UNKNOWN");
935 }
936 }
937
938 /*
939 * Routine that determines if a particular CT_DEV_EV_? event corresponds to a
940 * synchronous state change or not.
941 */
942 static int
943 is_sync_neg(uint_t old, uint_t new)
944 {
945 int i;
946
947 ASSERT(old & CT_DEV_ALLEVENT);
948 ASSERT(new & CT_DEV_ALLEVENT);
949
950 if (old == new) {
951 CT_DEBUG((CE_WARN, "is_sync_neg: transition to same state: %s",
952 state_str(new)));
953 return (-2);
954 }
955
956 for (i = 0; ct_dev_negtable[i].st_new != 0; i++) {
957 if (old == ct_dev_negtable[i].st_old &&
958 new == ct_dev_negtable[i].st_new) {
959 return (ct_dev_negtable[i].st_neg);
960 }
961 }
962
963 CT_DEBUG((CE_WARN, "is_sync_neg: Unsupported state transition: "
964 "old = %s -> new = %s", state_str(old), state_str(new)));
965
966 return (-1);
967 }
968
969 /*
970 * Used to cleanup cached dv_nodes so that when a device is released by
971 * a contract holder, its devinfo node can be successfully detached.
972 */
973 static int
974 contract_device_dvclean(dev_info_t *dip)
975 {
976 char *devnm;
977 dev_info_t *pdip;
978
979 ASSERT(dip);
980
981 /* pdip can be NULL if we have contracts against the root dip */
982 pdip = ddi_get_parent(dip);
983
984 if (pdip && DEVI_BUSY_OWNED(pdip) || !pdip && DEVI_BUSY_OWNED(dip)) {
985 char *path;
986
987 path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
988 (void) ddi_pathname(dip, path);
989 CT_DEBUG((CE_WARN, "ct_dv_clean: Parent node is busy owned, "
990 "device=%s", path));
991 kmem_free(path, MAXPATHLEN);
992 return (EDEADLOCK);
993 }
994
995 if (pdip) {
996 devnm = kmem_alloc(MAXNAMELEN + 1, KM_SLEEP);
997 (void) ddi_deviname(dip, devnm);
998 (void) devfs_clean(pdip, devnm + 1, DV_CLEAN_FORCE);
999 kmem_free(devnm, MAXNAMELEN + 1);
1000 } else {
1001 (void) devfs_clean(dip, NULL, DV_CLEAN_FORCE);
1002 }
1003
1004 return (0);
1005 }
1006
1007 /*
1008 * Endpoint of a ct_ctl_ack() or ct_ctl_nack() call from userland.
1009 * Results in the ACK or NACK being recorded on the dip for one particular
1010 * contract. The device contracts framework evaluates the ACK/NACKs for all
1011 * contracts against a device to determine if a particular device state change
1012 * should be allowed.
1013 */
1014 static int
1015 contract_device_ack_nack(contract_t *ct, uint_t evtype, uint64_t evid,
1016 uint_t cmd)
1017 {
1018 cont_device_t *ctd = ct->ct_data;
1019 dev_info_t *dip;
1020 ctid_t ctid;
1021 int error;
1022
1023 ctid = ct->ct_id;
1024
1025 CT_DEBUG((CE_NOTE, "ack_nack: entered: ctid %d", ctid));
1026
1027 mutex_enter(&ct->ct_lock);
1028 CT_DEBUG((CE_NOTE, "ack_nack: contract lock acquired: %d", ctid));
1029
1030 dip = ctd->cond_dip;
1031
1032 ASSERT(ctd->cond_minor);
1033 ASSERT(strlen(ctd->cond_minor) < MAXPATHLEN);
1034
1035 /*
1036 * Negotiation only if new state is not in A-set
1037 */
1038 ASSERT(!(ctd->cond_aset & evtype));
1039
1040 /*
1041 * Negotiation only if transition is synchronous
1042 */
1043 ASSERT(is_sync_neg(ctd->cond_state, evtype));
1044
1045 /*
1046 * We shouldn't be negotiating if the "noneg" flag is set
1047 */
1048 ASSERT(!ctd->cond_noneg);
1049
1050 if (dip)
1051 ndi_hold_devi(dip);
1052
1053 mutex_exit(&ct->ct_lock);
1054
1055 /*
1056 * dv_clean only if !NACK and offline state change
1057 */
1058 if (cmd != CT_NACK && evtype == CT_DEV_EV_OFFLINE && dip) {
1059 CT_DEBUG((CE_NOTE, "ack_nack: dv_clean: %d", ctid));
1060 error = contract_device_dvclean(dip);
1061 if (error != 0) {
1062 CT_DEBUG((CE_NOTE, "ack_nack: dv_clean: failed: %d",
1063 ctid));
1064 ddi_release_devi(dip);
1065 }
1066 }
1067
1068 mutex_enter(&ct->ct_lock);
1069
1070 if (dip)
1071 ddi_release_devi(dip);
1072
1073 if (dip == NULL) {
1074 if (ctd->cond_currev_id != evid) {
1075 CT_DEBUG((CE_WARN, "%sACK for non-current event "
1076 "(type=%s, id=%llu) on removed device",
1077 cmd == CT_NACK ? "N" : "",
1078 state_str(evtype), (unsigned long long)evid));
1079 CT_DEBUG((CE_NOTE, "ack_nack: error: ESRCH, ctid: %d",
1080 ctid));
1081 } else {
1082 ASSERT(ctd->cond_currev_type == evtype);
1083 CT_DEBUG((CE_WARN, "contract_ack: no such device: "
1084 "ctid: %d", ctid));
1085 }
1086 error = (ct->ct_state == CTS_DEAD) ? ESRCH :
1087 ((cmd == CT_NACK) ? ETIMEDOUT : 0);
1088 mutex_exit(&ct->ct_lock);
1089 return (error);
1090 }
1091
1092 /*
1093 * Must follow lock order: devi_ct_lock -> ct_count barrier - >ct_lock
1094 */
1095 mutex_exit(&ct->ct_lock);
1096
1097 mutex_enter(&DEVI(dip)->devi_ct_lock);
1098 mutex_enter(&ct->ct_lock);
1099 if (ctd->cond_currev_id != evid) {
1100 char *buf;
1101 mutex_exit(&ct->ct_lock);
1102 mutex_exit(&DEVI(dip)->devi_ct_lock);
1103 ndi_hold_devi(dip);
1104 buf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1105 (void) ddi_pathname(dip, buf);
1106 ddi_release_devi(dip);
1107 CT_DEBUG((CE_WARN, "%sACK for non-current event"
1108 "(type=%s, id=%llu) on device %s",
1109 cmd == CT_NACK ? "N" : "",
1110 state_str(evtype), (unsigned long long)evid, buf));
1111 kmem_free(buf, MAXPATHLEN);
1112 CT_DEBUG((CE_NOTE, "ack_nack: error: %d, ctid: %d",
1113 cmd == CT_NACK ? ETIMEDOUT : 0, ctid));
1114 return (cmd == CT_ACK ? 0 : ETIMEDOUT);
1115 }
1116
1117 ASSERT(ctd->cond_currev_type == evtype);
1118 ASSERT(cmd == CT_ACK || cmd == CT_NACK);
1119
1120 CT_DEBUG((CE_NOTE, "ack_nack: setting %sACK for ctid: %d",
1121 cmd == CT_NACK ? "N" : "", ctid));
1122
1123 ctd->cond_currev_ack = cmd;
1124 mutex_exit(&ct->ct_lock);
1125
1126 ct_barrier_decr(dip);
1127 mutex_exit(&DEVI(dip)->devi_ct_lock);
1128
1129 CT_DEBUG((CE_NOTE, "ack_nack: normal exit: ctid: %d", ctid));
1130
1131 return (0);
1132 }
1133
1134 /*
1135 * Invoked when a userland contract holder approves (i.e. ACKs) a state change
1136 */
1137 static int
1138 contract_device_ack(contract_t *ct, uint_t evtype, uint64_t evid)
1139 {
1140 return (contract_device_ack_nack(ct, evtype, evid, CT_ACK));
1141 }
1142
1143 /*
1144 * Invoked when a userland contract holder blocks (i.e. NACKs) a state change
1145 */
1146 static int
1147 contract_device_nack(contract_t *ct, uint_t evtype, uint64_t evid)
1148 {
1149 return (contract_device_ack_nack(ct, evtype, evid, CT_NACK));
1150 }
1151
1152 /*
1153 * Creates a new contract synchronously with the breaking of an existing
1154 * contract. Currently not supported.
1155 */
1156 /*ARGSUSED*/
1157 static int
1158 contract_device_newct(contract_t *ct)
1159 {
1160 return (ENOTSUP);
1161 }
1162
1163 /*
1164 * Core device contract implementation entry points
1165 */
1166 static contops_t contract_device_ops = {
1167 contract_device_free, /* contop_free */
1168 contract_device_abandon, /* contop_abandon */
1169 contract_device_destroy, /* contop_destroy */
1170 contract_device_status, /* contop_status */
1171 contract_device_ack, /* contop_ack */
1172 contract_device_nack, /* contop_nack */
1173 contract_qack_notsup, /* contop_qack */
1174 contract_device_newct /* contop_newct */
1175 };
1176
1177 /*
1178 * contract_device_init
1179 *
1180 * Initializes the device contract type.
1181 */
1182 void
1183 contract_device_init(void)
1184 {
1185 device_type = contract_type_init(CTT_DEVICE, "device",
1186 &contract_device_ops, contract_device_default);
1187 }
1188
1189 /*
1190 * contract_device_create
1191 *
1192 * create a device contract given template "tmpl" and the "owner" process.
1193 * May fail and return NULL if project.max-contracts would have been exceeded.
1194 *
1195 * Common device contract creation routine called for both open-time and
1196 * non-open time device contract creation
1197 */
1198 static cont_device_t *
1199 contract_device_create(ctmpl_device_t *dtmpl, dev_t dev, int spec_type,
1200 proc_t *owner, int *errorp)
1201 {
1202 cont_device_t *ctd;
1203 char *minor;
1204 char *path;
1205 dev_info_t *dip;
1206
1207 ASSERT(dtmpl != NULL);
1208 ASSERT(dev != NODEV && dev != DDI_DEV_T_ANY && dev != DDI_DEV_T_NONE);
1209 ASSERT(spec_type == S_IFCHR || spec_type == S_IFBLK);
1210 ASSERT(errorp);
1211
1212 *errorp = 0;
1213
1214 path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1215
1216 mutex_enter(&dtmpl->ctd_ctmpl.ctmpl_lock);
1217 ASSERT(strlen(dtmpl->ctd_minor) < MAXPATHLEN);
1218 bcopy(dtmpl->ctd_minor, path, strlen(dtmpl->ctd_minor) + 1);
1219 mutex_exit(&dtmpl->ctd_ctmpl.ctmpl_lock);
1220
1221 dip = e_ddi_hold_devi_by_path(path, 0);
1222 if (dip == NULL) {
1223 cmn_err(CE_WARN, "contract_create: Cannot find devinfo node "
1224 "for device path (%s)", path);
1225 kmem_free(path, MAXPATHLEN);
1226 *errorp = ERANGE;
1227 return (NULL);
1228 }
1229
1230 /*
1231 * Lock out any parallel contract negotiations
1232 */
1233 mutex_enter(&(DEVI(dip)->devi_ct_lock));
1234 ct_barrier_acquire(dip);
1235 mutex_exit(&(DEVI(dip)->devi_ct_lock));
1236
1237 minor = i_ddi_strdup(path, KM_SLEEP);
1238 kmem_free(path, MAXPATHLEN);
1239
1240 (void) contract_type_pbundle(device_type, owner);
1241
1242 ctd = kmem_zalloc(sizeof (cont_device_t), KM_SLEEP);
1243
1244 /*
1245 * Only we hold a refernce to this contract. Safe to access
1246 * the fields without a ct_lock
1247 */
1248 ctd->cond_minor = minor;
1249 /*
1250 * It is safe to set the dip pointer in the contract
1251 * as the contract will always be destroyed before the dip
1252 * is released
1253 */
1254 ctd->cond_dip = dip;
1255 ctd->cond_devt = dev;
1256 ctd->cond_spec = spec_type;
1257
1258 /*
1259 * Since we are able to lookup the device, it is either
1260 * online or degraded
1261 */
1262 ctd->cond_state = DEVI_IS_DEVICE_DEGRADED(dip) ?
1263 CT_DEV_EV_DEGRADED : CT_DEV_EV_ONLINE;
1264
1265 mutex_enter(&dtmpl->ctd_ctmpl.ctmpl_lock);
1266 ctd->cond_aset = dtmpl->ctd_aset;
1267 ctd->cond_noneg = dtmpl->ctd_noneg;
1268
1269 /*
1270 * contract_ctor() initailizes the common portion of a contract
1271 * contract_dtor() destroys the common portion of a contract
1272 */
1273 if (contract_ctor(&ctd->cond_contract, device_type, &dtmpl->ctd_ctmpl,
1274 ctd, 0, owner, B_TRUE)) {
1275 mutex_exit(&dtmpl->ctd_ctmpl.ctmpl_lock);
1276 /*
1277 * contract_device_free() destroys the type specific
1278 * portion of a contract and frees the contract.
1279 * The "minor" path and "cred" is a part of the type specific
1280 * portion of the contract and will be freed by
1281 * contract_device_free()
1282 */
1283 contract_device_free(&ctd->cond_contract);
1284
1285 /* release barrier */
1286 mutex_enter(&(DEVI(dip)->devi_ct_lock));
1287 ct_barrier_release(dip);
1288 mutex_exit(&(DEVI(dip)->devi_ct_lock));
1289
1290 ddi_release_devi(dip);
1291 *errorp = EAGAIN;
1292 return (NULL);
1293 }
1294 mutex_exit(&dtmpl->ctd_ctmpl.ctmpl_lock);
1295
1296 mutex_enter(&ctd->cond_contract.ct_lock);
1297 ctd->cond_contract.ct_ntime.ctm_total = CT_DEV_ACKTIME;
1298 ctd->cond_contract.ct_qtime.ctm_total = CT_DEV_ACKTIME;
1299 ctd->cond_contract.ct_ntime.ctm_start = -1;
1300 ctd->cond_contract.ct_qtime.ctm_start = -1;
1301 mutex_exit(&ctd->cond_contract.ct_lock);
1302
1303 /*
1304 * Insert device contract into list hanging off the dip
1305 * Bump up the ref-count on the contract to reflect this
1306 */
1307 contract_hold(&ctd->cond_contract);
1308 mutex_enter(&(DEVI(dip)->devi_ct_lock));
1309 list_insert_tail(&(DEVI(dip)->devi_ct), ctd);
1310
1311 /* release barrier */
1312 ct_barrier_release(dip);
1313 mutex_exit(&(DEVI(dip)->devi_ct_lock));
1314
1315 ddi_release_devi(dip);
1316
1317 return (ctd);
1318 }
1319
1320 /*
1321 * Called when a device is successfully opened to create an open-time contract
1322 * i.e. synchronously with a device open.
1323 */
1324 int
1325 contract_device_open(dev_t dev, int spec_type, contract_t **ctpp)
1326 {
1327 ctmpl_device_t *dtmpl;
1328 ct_template_t *tmpl;
1329 cont_device_t *ctd;
1330 char *path;
1331 klwp_t *lwp;
1332 int error;
1333
1334 if (ctpp)
1335 *ctpp = NULL;
1336
1337 /*
1338 * Check if we are in user-context i.e. if we have an lwp
1339 */
1340 lwp = ttolwp(curthread);
1341 if (lwp == NULL) {
1342 CT_DEBUG((CE_NOTE, "contract_open: Not user-context"));
1343 return (0);
1344 }
1345
1346 tmpl = ctmpl_dup(lwp->lwp_ct_active[device_type->ct_type_index]);
1347 if (tmpl == NULL) {
1348 return (0);
1349 }
1350 dtmpl = tmpl->ctmpl_data;
1351
1352 /*
1353 * If the user set a minor path in the template before an open,
1354 * ignore it. We use the minor path of the actual minor opened.
1355 */
1356 mutex_enter(&tmpl->ctmpl_lock);
1357 if (dtmpl->ctd_minor != NULL) {
1358 CT_DEBUG((CE_NOTE, "contract_device_open(): Process %d: "
1359 "ignoring device minor path in active template: %s",
1360 curproc->p_pid, dtmpl->ctd_minor));
1361 /*
1362 * This is a copy of the actual activated template.
1363 * Safe to make changes such as freeing the minor
1364 * path in the template.
1365 */
1366 kmem_free(dtmpl->ctd_minor, strlen(dtmpl->ctd_minor) + 1);
1367 dtmpl->ctd_minor = NULL;
1368 }
1369 mutex_exit(&tmpl->ctmpl_lock);
1370
1371 path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1372
1373 if (ddi_dev_pathname(dev, spec_type, path) != DDI_SUCCESS) {
1374 CT_DEBUG((CE_NOTE, "contract_device_open(): Failed to derive "
1375 "minor path from dev_t,spec {%lu, %d} for process (%d)",
1376 dev, spec_type, curproc->p_pid));
1377 ctmpl_free(tmpl);
1378 kmem_free(path, MAXPATHLEN);
1379 return (1);
1380 }
1381
1382 mutex_enter(&tmpl->ctmpl_lock);
1383 ASSERT(dtmpl->ctd_minor == NULL);
1384 dtmpl->ctd_minor = path;
1385 mutex_exit(&tmpl->ctmpl_lock);
1386
1387 ctd = contract_device_create(dtmpl, dev, spec_type, curproc, &error);
1388
1389 mutex_enter(&tmpl->ctmpl_lock);
1390 ASSERT(dtmpl->ctd_minor);
1391 dtmpl->ctd_minor = NULL;
1392 mutex_exit(&tmpl->ctmpl_lock);
1393 ctmpl_free(tmpl);
1394 kmem_free(path, MAXPATHLEN);
1395
1396 if (ctd == NULL) {
1397 cmn_err(CE_NOTE, "contract_device_open(): Failed to "
1398 "create device contract for process (%d) holding "
1399 "device (devt = %lu, spec_type = %d)",
1400 curproc->p_pid, dev, spec_type);
1401 return (1);
1402 }
1403
1404 if (ctpp) {
1405 mutex_enter(&ctd->cond_contract.ct_lock);
1406 *ctpp = &ctd->cond_contract;
1407 mutex_exit(&ctd->cond_contract.ct_lock);
1408 }
1409 return (0);
1410 }
1411
1412 /*
1413 * Called during contract negotiation by the device contract framework to wait
1414 * for ACKs or NACKs from contract holders. If all responses are not received
1415 * before a specified timeout, this routine times out.
1416 */
1417 static uint_t
1418 wait_for_acks(dev_info_t *dip, dev_t dev, int spec_type, uint_t evtype)
1419 {
1420 cont_device_t *ctd;
1421 int timed_out = 0;
1422 int result = CT_NONE;
1423 int ack;
1424 char *f = "wait_for_acks";
1425
1426 ASSERT(MUTEX_HELD(&(DEVI(dip)->devi_ct_lock)));
1427 ASSERT(dip);
1428 ASSERT(evtype & CT_DEV_ALLEVENT);
1429 ASSERT(dev != NODEV && dev != DDI_DEV_T_NONE);
1430 ASSERT((dev == DDI_DEV_T_ANY && spec_type == 0) ||
1431 (spec_type == S_IFBLK || spec_type == S_IFCHR));
1432
1433 CT_DEBUG((CE_NOTE, "%s: entered: dip: %p", f, (void *)dip));
1434
1435 if (ct_barrier_wait_for_empty(dip, CT_DEV_ACKTIME) == -1) {
1436 /*
1437 * some contract owner(s) didn't respond in time
1438 */
1439 CT_DEBUG((CE_NOTE, "%s: timed out: %p", f, (void *)dip));
1440 timed_out = 1;
1441 }
1442
1443 ack = 0;
1444 for (ctd = list_head(&(DEVI(dip)->devi_ct)); ctd != NULL;
1445 ctd = list_next(&(DEVI(dip)->devi_ct), ctd)) {
1446
1447 mutex_enter(&ctd->cond_contract.ct_lock);
1448
1449 ASSERT(ctd->cond_dip == dip);
1450
1451 if (dev != DDI_DEV_T_ANY && dev != ctd->cond_devt) {
1452 mutex_exit(&ctd->cond_contract.ct_lock);
1453 continue;
1454 }
1455 if (dev != DDI_DEV_T_ANY && spec_type != ctd->cond_spec) {
1456 mutex_exit(&ctd->cond_contract.ct_lock);
1457 continue;
1458 }
1459
1460 /* skip if non-negotiable contract */
1461 if (ctd->cond_noneg) {
1462 mutex_exit(&ctd->cond_contract.ct_lock);
1463 continue;
1464 }
1465
1466 ASSERT(ctd->cond_currev_type == evtype);
1467 if (ctd->cond_currev_ack == CT_NACK) {
1468 CT_DEBUG((CE_NOTE, "%s: found a NACK,result = NACK: %p",
1469 f, (void *)dip));
1470 mutex_exit(&ctd->cond_contract.ct_lock);
1471 return (CT_NACK);
1472 } else if (ctd->cond_currev_ack == CT_ACK) {
1473 ack = 1;
1474 CT_DEBUG((CE_NOTE, "%s: found a ACK: %p",
1475 f, (void *)dip));
1476 }
1477 mutex_exit(&ctd->cond_contract.ct_lock);
1478 }
1479
1480 if (ack) {
1481 result = CT_ACK;
1482 CT_DEBUG((CE_NOTE, "%s: result = ACK, dip=%p", f, (void *)dip));
1483 } else if (timed_out) {
1484 result = CT_NONE;
1485 CT_DEBUG((CE_NOTE, "%s: result = NONE (timed-out), dip=%p",
1486 f, (void *)dip));
1487 } else {
1488 CT_DEBUG((CE_NOTE, "%s: result = NONE, dip=%p",
1489 f, (void *)dip));
1490 }
1491
1492
1493 return (result);
1494 }
1495
1496 /*
1497 * Determines the current state of a device (i.e a devinfo node
1498 */
1499 static int
1500 get_state(dev_info_t *dip)
1501 {
1502 if (DEVI_IS_DEVICE_OFFLINE(dip) || DEVI_IS_DEVICE_DOWN(dip))
1503 return (CT_DEV_EV_OFFLINE);
1504 else if (DEVI_IS_DEVICE_DEGRADED(dip))
1505 return (CT_DEV_EV_DEGRADED);
1506 else
1507 return (CT_DEV_EV_ONLINE);
1508 }
1509
1510 /*
1511 * Sets the current state of a device in a device contract
1512 */
1513 static void
1514 set_cond_state(dev_info_t *dip)
1515 {
1516 uint_t state = get_state(dip);
1517 cont_device_t *ctd;
1518
1519 /* verify that barrier is held */
1520 ASSERT(ct_barrier_held(dip));
1521
1522 for (ctd = list_head(&(DEVI(dip)->devi_ct)); ctd != NULL;
1523 ctd = list_next(&(DEVI(dip)->devi_ct), ctd)) {
1524 mutex_enter(&ctd->cond_contract.ct_lock);
1525 ASSERT(ctd->cond_dip == dip);
1526 ctd->cond_state = state;
1527 mutex_exit(&ctd->cond_contract.ct_lock);
1528 }
1529 }
1530
1531 /*
1532 * Core routine called by event-specific routines when an event occurs.
1533 * Determines if an event should be be published, and if it is to be
1534 * published, whether a negotiation should take place. Also implements
1535 * NEGEND events which publish the final disposition of an event after
1536 * negotiations are complete.
1537 *
1538 * When an event occurs on a minor node, this routine walks the list of
1539 * contracts hanging off a devinfo node and for each contract on the affected
1540 * dip, evaluates the following cases
1541 *
1542 * a. an event that is synchronous, breaks the contract and NONEG not set
1543 * - bumps up the outstanding negotiation counts on the dip
1544 * - marks the dip as undergoing negotiation (devi_ct_neg)
1545 * - event of type CTE_NEG is published
1546 * b. an event that is synchronous, breaks the contract and NONEG is set
1547 * - sets the final result to CT_NACK, event is blocked
1548 * - does not publish an event
1549 * c. event is asynchronous and breaks the contract
1550 * - publishes a critical event irrespect of whether the NONEG
1551 * flag is set, since the contract will be broken and contract
1552 * owner needs to be informed.
1553 * d. No contract breakage but the owner has subscribed to the event
1554 * - publishes the event irrespective of the NONEG event as the
1555 * owner has explicitly subscribed to the event.
1556 * e. NEGEND event
1557 * - publishes a critical event. Should only be doing this if
1558 * if NONEG is not set.
1559 * f. all other events
1560 * - Since a contract is not broken and this event has not been
1561 * subscribed to, this event does not need to be published for
1562 * for this contract.
1563 *
1564 * Once an event is published, what happens next depends on the type of
1565 * event:
1566 *
1567 * a. NEGEND event
1568 * - cleanup all state associated with the preceding negotiation
1569 * and return CT_ACK to the caller of contract_device_publish()
1570 * b. NACKed event
1571 * - One or more contracts had the NONEG term, so the event was
1572 * blocked. Return CT_NACK to the caller.
1573 * c. Negotiated event
1574 * - Call wait_for_acks() to wait for responses from contract
1575 * holders. The end result is either CT_ACK (event is permitted),
1576 * CT_NACK (event is blocked) or CT_NONE (no contract owner)
1577 * responded. This result is returned back to the caller.
1578 * d. All other events
1579 * - If the event was asynchronous (i.e. not negotiated) or
1580 * a contract was not broken return CT_ACK to the caller.
1581 */
1582 static uint_t
1583 contract_device_publish(dev_info_t *dip, dev_t dev, int spec_type,
1584 uint_t evtype, nvlist_t *tnvl)
1585 {
1586 cont_device_t *ctd;
1587 uint_t result = CT_NONE;
1588 uint64_t evid = 0;
1589 uint64_t nevid = 0;
1590 char *path = NULL;
1591 int negend;
1592 int match;
1593 int sync = 0;
1594 contract_t *ct;
1595 ct_kevent_t *event;
1596 nvlist_t *nvl;
1597 int broken = 0;
1598
1599 ASSERT(dip);
1600 ASSERT(dev != NODEV && dev != DDI_DEV_T_NONE);
1601 ASSERT((dev == DDI_DEV_T_ANY && spec_type == 0) ||
1602 (spec_type == S_IFBLK || spec_type == S_IFCHR));
1603 ASSERT(evtype == 0 || (evtype & CT_DEV_ALLEVENT));
1604
1605 /* Is this a synchronous state change ? */
1606 if (evtype != CT_EV_NEGEND) {
1607 sync = is_sync_neg(get_state(dip), evtype);
1608 /* NOP if unsupported transition */
1609 if (sync == -2 || sync == -1) {
1610 DEVI(dip)->devi_flags |= DEVI_CT_NOP;
1611 result = (sync == -2) ? CT_ACK : CT_NONE;
1612 goto out;
1613 }
1614 CT_DEBUG((CE_NOTE, "publish: is%s sync state change",
1615 sync ? "" : " not"));
1616 } else if (DEVI(dip)->devi_flags & DEVI_CT_NOP) {
1617 DEVI(dip)->devi_flags &= ~DEVI_CT_NOP;
1618 result = CT_ACK;
1619 goto out;
1620 }
1621
1622 path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1623 (void) ddi_pathname(dip, path);
1624
1625 mutex_enter(&(DEVI(dip)->devi_ct_lock));
1626
1627 /*
1628 * Negotiation end - set the state of the device in the contract
1629 */
1630 if (evtype == CT_EV_NEGEND) {
1631 CT_DEBUG((CE_NOTE, "publish: negend: setting cond state"));
1632 set_cond_state(dip);
1633 }
1634
1635 /*
1636 * If this device didn't go through negotiation, don't publish
1637 * a NEGEND event - simply release the barrier to allow other
1638 * device events in.
1639 */
1640 negend = 0;
1641 if (evtype == CT_EV_NEGEND && !DEVI(dip)->devi_ct_neg) {
1642 CT_DEBUG((CE_NOTE, "publish: no negend reqd. release barrier"));
1643 ct_barrier_release(dip);
1644 mutex_exit(&(DEVI(dip)->devi_ct_lock));
1645 result = CT_ACK;
1646 goto out;
1647 } else if (evtype == CT_EV_NEGEND) {
1648 /*
1649 * There are negotiated contract breakages that
1650 * need a NEGEND event
1651 */
1652 ASSERT(ct_barrier_held(dip));
1653 negend = 1;
1654 CT_DEBUG((CE_NOTE, "publish: setting negend flag"));
1655 } else {
1656 /*
1657 * This is a new event, not a NEGEND event. Wait for previous
1658 * contract events to complete.
1659 */
1660 ct_barrier_acquire(dip);
1661 }
1662
1663
1664 match = 0;
1665 for (ctd = list_head(&(DEVI(dip)->devi_ct)); ctd != NULL;
1666 ctd = list_next(&(DEVI(dip)->devi_ct), ctd)) {
1667
1668 ctid_t ctid;
1669 size_t len = strlen(path);
1670
1671 mutex_enter(&ctd->cond_contract.ct_lock);
1672
1673 ASSERT(ctd->cond_dip == dip);
1674 ASSERT(ctd->cond_minor);
1675 ASSERT(strncmp(ctd->cond_minor, path, len) == 0 &&
1676 ctd->cond_minor[len] == ':');
1677
1678 if (dev != DDI_DEV_T_ANY && dev != ctd->cond_devt) {
1679 mutex_exit(&ctd->cond_contract.ct_lock);
1680 continue;
1681 }
1682 if (dev != DDI_DEV_T_ANY && spec_type != ctd->cond_spec) {
1683 mutex_exit(&ctd->cond_contract.ct_lock);
1684 continue;
1685 }
1686
1687 /* We have a matching contract */
1688 match = 1;
1689 ctid = ctd->cond_contract.ct_id;
1690 CT_DEBUG((CE_NOTE, "publish: found matching contract: %d",
1691 ctid));
1692
1693 /*
1694 * There are 4 possible cases
1695 * 1. A contract is broken (dev not in acceptable state) and
1696 * the state change is synchronous - start negotiation
1697 * by sending a CTE_NEG critical event.
1698 * 2. A contract is broken and the state change is
1699 * asynchronous - just send a critical event and
1700 * break the contract.
1701 * 3. Contract is not broken, but consumer has subscribed
1702 * to the event as a critical or informative event
1703 * - just send the appropriate event
1704 * 4. contract waiting for negend event - just send the critical
1705 * NEGEND event.
1706 */
1707 broken = 0;
1708 if (!negend && !(evtype & ctd->cond_aset)) {
1709 broken = 1;
1710 CT_DEBUG((CE_NOTE, "publish: Contract broken: %d",
1711 ctid));
1712 }
1713
1714 /*
1715 * Don't send event if
1716 * - contract is not broken AND
1717 * - contract holder has not subscribed to this event AND
1718 * - contract not waiting for a NEGEND event
1719 */
1720 if (!broken && !EVSENDP(ctd, evtype) &&
1721 !ctd->cond_neg) {
1722 CT_DEBUG((CE_NOTE, "contract_device_publish(): "
1723 "contract (%d): no publish reqd: event %d",
1724 ctd->cond_contract.ct_id, evtype));
1725 mutex_exit(&ctd->cond_contract.ct_lock);
1726 continue;
1727 }
1728
1729 /*
1730 * Note: need to kmem_zalloc() the event so mutexes are
1731 * initialized automatically
1732 */
1733 ct = &ctd->cond_contract;
1734 event = kmem_zalloc(sizeof (ct_kevent_t), KM_SLEEP);
1735 event->cte_type = evtype;
1736
1737 if (broken && sync) {
1738 CT_DEBUG((CE_NOTE, "publish: broken + sync: "
1739 "ctid: %d", ctid));
1740 ASSERT(!negend);
1741 ASSERT(ctd->cond_currev_id == 0);
1742 ASSERT(ctd->cond_currev_type == 0);
1743 ASSERT(ctd->cond_currev_ack == 0);
1744 ASSERT(ctd->cond_neg == 0);
1745 if (ctd->cond_noneg) {
1746 /* Nothing to publish. Event has been blocked */
1747 CT_DEBUG((CE_NOTE, "publish: sync and noneg:"
1748 "not publishing blocked ev: ctid: %d",
1749 ctid));
1750 result = CT_NACK;
1751 kmem_free(event, sizeof (ct_kevent_t));
1752 mutex_exit(&ctd->cond_contract.ct_lock);
1753 continue;
1754 }
1755 event->cte_flags = CTE_NEG; /* critical neg. event */
1756 ctd->cond_currev_type = event->cte_type;
1757 ct_barrier_incr(dip);
1758 DEVI(dip)->devi_ct_neg = 1; /* waiting for negend */
1759 ctd->cond_neg = 1;
1760 } else if (broken && !sync) {
1761 CT_DEBUG((CE_NOTE, "publish: broken + async: ctid: %d",
1762 ctid));
1763 ASSERT(!negend);
1764 ASSERT(ctd->cond_currev_id == 0);
1765 ASSERT(ctd->cond_currev_type == 0);
1766 ASSERT(ctd->cond_currev_ack == 0);
1767 ASSERT(ctd->cond_neg == 0);
1768 event->cte_flags = 0; /* critical event */
1769 } else if (EVSENDP(ctd, event->cte_type)) {
1770 CT_DEBUG((CE_NOTE, "publish: event suscrib: ctid: %d",
1771 ctid));
1772 ASSERT(!negend);
1773 ASSERT(ctd->cond_currev_id == 0);
1774 ASSERT(ctd->cond_currev_type == 0);
1775 ASSERT(ctd->cond_currev_ack == 0);
1776 ASSERT(ctd->cond_neg == 0);
1777 event->cte_flags = EVINFOP(ctd, event->cte_type) ?
1778 CTE_INFO : 0;
1779 } else if (ctd->cond_neg) {
1780 CT_DEBUG((CE_NOTE, "publish: NEGEND: ctid: %d", ctid));
1781 ASSERT(negend);
1782 ASSERT(ctd->cond_noneg == 0);
1783 nevid = ctd->cond_contract.ct_nevent ?
1784 ctd->cond_contract.ct_nevent->cte_id : 0;
1785 ASSERT(ctd->cond_currev_id == nevid);
1786 event->cte_flags = 0; /* NEGEND is always critical */
1787 ctd->cond_currev_id = 0;
1788 ctd->cond_currev_type = 0;
1789 ctd->cond_currev_ack = 0;
1790 ctd->cond_neg = 0;
1791 } else {
1792 CT_DEBUG((CE_NOTE, "publish: not publishing event for "
1793 "ctid: %d, evtype: %d",
1794 ctd->cond_contract.ct_id, event->cte_type));
1795 ASSERT(!negend);
1796 ASSERT(ctd->cond_currev_id == 0);
1797 ASSERT(ctd->cond_currev_type == 0);
1798 ASSERT(ctd->cond_currev_ack == 0);
1799 ASSERT(ctd->cond_neg == 0);
1800 kmem_free(event, sizeof (ct_kevent_t));
1801 mutex_exit(&ctd->cond_contract.ct_lock);
1802 continue;
1803 }
1804
1805 nvl = NULL;
1806 if (tnvl) {
1807 VERIFY(nvlist_dup(tnvl, &nvl, 0) == 0);
1808 if (negend) {
1809 int32_t newct = 0;
1810 ASSERT(ctd->cond_noneg == 0);
1811 VERIFY(nvlist_add_uint64(nvl, CTS_NEVID, nevid)
1812 == 0);
1813 VERIFY(nvlist_lookup_int32(nvl, CTS_NEWCT,
1814 &newct) == 0);
1815 VERIFY(nvlist_add_int32(nvl, CTS_NEWCT,
1816 newct == 1 ? 0 :
1817 ctd->cond_contract.ct_id) == 0);
1818 CT_DEBUG((CE_NOTE, "publish: negend: ctid: %d "
1819 "CTS_NEVID: %llu, CTS_NEWCT: %s",
1820 ctid, (unsigned long long)nevid,
1821 newct ? "success" : "failure"));
1822
1823 }
1824 }
1825
1826 if (ctd->cond_neg) {
1827 ASSERT(ctd->cond_contract.ct_ntime.ctm_start == -1);
1828 ASSERT(ctd->cond_contract.ct_qtime.ctm_start == -1);
1829 ctd->cond_contract.ct_ntime.ctm_start = ddi_get_lbolt();
1830 ctd->cond_contract.ct_qtime.ctm_start =
1831 ctd->cond_contract.ct_ntime.ctm_start;
1832 }
1833
1834 /*
1835 * by holding the dip's devi_ct_lock we ensure that
1836 * all ACK/NACKs are held up until we have finished
1837 * publishing to all contracts.
1838 */
1839 mutex_exit(&ctd->cond_contract.ct_lock);
1840 evid = cte_publish_all(ct, event, nvl, NULL);
1841 mutex_enter(&ctd->cond_contract.ct_lock);
1842
1843 if (ctd->cond_neg) {
1844 ASSERT(!negend);
1845 ASSERT(broken);
1846 ASSERT(sync);
1847 ASSERT(!ctd->cond_noneg);
1848 CT_DEBUG((CE_NOTE, "publish: sync break, setting evid"
1849 ": %d", ctid));
1850 ctd->cond_currev_id = evid;
1851 } else if (negend) {
1852 ctd->cond_contract.ct_ntime.ctm_start = -1;
1853 ctd->cond_contract.ct_qtime.ctm_start = -1;
1854 }
1855 mutex_exit(&ctd->cond_contract.ct_lock);
1856 }
1857
1858 /*
1859 * If "negend" set counter back to initial state (-1) so that
1860 * other events can be published. Also clear the negotiation flag
1861 * on dip.
1862 *
1863 * 0 .. n are used for counting.
1864 * -1 indicates counter is available for use.
1865 */
1866 if (negend) {
1867 /*
1868 * devi_ct_count not necessarily 0. We may have
1869 * timed out in which case, count will be non-zero.
1870 */
1871 ct_barrier_release(dip);
1872 DEVI(dip)->devi_ct_neg = 0;
1873 CT_DEBUG((CE_NOTE, "publish: negend: reset dip state: dip=%p",
1874 (void *)dip));
1875 } else if (DEVI(dip)->devi_ct_neg) {
1876 ASSERT(match);
1877 ASSERT(!ct_barrier_empty(dip));
1878 CT_DEBUG((CE_NOTE, "publish: sync count=%d, dip=%p",
1879 DEVI(dip)->devi_ct_count, (void *)dip));
1880 } else {
1881 /*
1882 * for non-negotiated events or subscribed events or no
1883 * matching contracts
1884 */
1885 ASSERT(ct_barrier_empty(dip));
1886 ASSERT(DEVI(dip)->devi_ct_neg == 0);
1887 CT_DEBUG((CE_NOTE, "publish: async/non-nego/subscrib/no-match: "
1888 "dip=%p", (void *)dip));
1889
1890 /*
1891 * only this function when called from contract_device_negend()
1892 * can reset the counter to READY state i.e. -1. This function
1893 * is so called for every event whether a NEGEND event is needed
1894 * or not, but the negend event is only published if the event
1895 * whose end they signal is a negotiated event for the contract.
1896 */
1897 }
1898
1899 if (!match) {
1900 /* No matching contracts */
1901 CT_DEBUG((CE_NOTE, "publish: No matching contract"));
1902 result = CT_NONE;
1903 } else if (result == CT_NACK) {
1904 /* a non-negotiable contract exists and this is a neg. event */
1905 CT_DEBUG((CE_NOTE, "publish: found 1 or more NONEG contract"));
1906 (void) wait_for_acks(dip, dev, spec_type, evtype);
1907 } else if (DEVI(dip)->devi_ct_neg) {
1908 /* one or more contracts going through negotations */
1909 CT_DEBUG((CE_NOTE, "publish: sync contract: waiting"));
1910 result = wait_for_acks(dip, dev, spec_type, evtype);
1911 } else {
1912 /* no negotiated contracts or no broken contracts or NEGEND */
1913 CT_DEBUG((CE_NOTE, "publish: async/no-break/negend"));
1914 result = CT_ACK;
1915 }
1916
1917 /*
1918 * Release the lock only now so that the only point where we
1919 * drop the lock is in wait_for_acks(). This is so that we don't
1920 * miss cv_signal/cv_broadcast from contract holders
1921 */
1922 CT_DEBUG((CE_NOTE, "publish: dropping devi_ct_lock"));
1923 mutex_exit(&(DEVI(dip)->devi_ct_lock));
1924
1925 out:
1926 nvlist_free(tnvl);
1927 if (path)
1928 kmem_free(path, MAXPATHLEN);
1929
1930
1931 CT_DEBUG((CE_NOTE, "publish: result = %s", result_str(result)));
1932 return (result);
1933 }
1934
1935
1936 /*
1937 * contract_device_offline
1938 *
1939 * Event publishing routine called by I/O framework when a device is offlined.
1940 */
1941 ct_ack_t
1942 contract_device_offline(dev_info_t *dip, dev_t dev, int spec_type)
1943 {
1944 nvlist_t *nvl;
1945 uint_t result;
1946 uint_t evtype;
1947
1948 VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1949
1950 evtype = CT_DEV_EV_OFFLINE;
1951 result = contract_device_publish(dip, dev, spec_type, evtype, nvl);
1952
1953 /*
1954 * If a contract offline is NACKED, the framework expects us to call
1955 * NEGEND ourselves, since we know the final result
1956 */
1957 if (result == CT_NACK) {
1958 contract_device_negend(dip, dev, spec_type, CT_EV_FAILURE);
1959 }
1960
1961 return (result);
1962 }
1963
1964 /*
1965 * contract_device_degrade
1966 *
1967 * Event publishing routine called by I/O framework when a device
1968 * moves to degrade state.
1969 */
1970 /*ARGSUSED*/
1971 void
1972 contract_device_degrade(dev_info_t *dip, dev_t dev, int spec_type)
1973 {
1974 nvlist_t *nvl;
1975 uint_t evtype;
1976
1977 VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1978
1979 evtype = CT_DEV_EV_DEGRADED;
1980 (void) contract_device_publish(dip, dev, spec_type, evtype, nvl);
1981 }
1982
1983 /*
1984 * contract_device_undegrade
1985 *
1986 * Event publishing routine called by I/O framework when a device
1987 * moves from degraded state to online state.
1988 */
1989 /*ARGSUSED*/
1990 void
1991 contract_device_undegrade(dev_info_t *dip, dev_t dev, int spec_type)
1992 {
1993 nvlist_t *nvl;
1994 uint_t evtype;
1995
1996 VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1997
1998 evtype = CT_DEV_EV_ONLINE;
1999 (void) contract_device_publish(dip, dev, spec_type, evtype, nvl);
2000 }
2001
2002 /*
2003 * For all contracts which have undergone a negotiation (because the device
2004 * moved out of the acceptable state for that contract and the state
2005 * change is synchronous i.e. requires negotiation) this routine publishes
2006 * a CT_EV_NEGEND event with the final disposition of the event.
2007 *
2008 * This event is always a critical event.
2009 */
2010 void
2011 contract_device_negend(dev_info_t *dip, dev_t dev, int spec_type, int result)
2012 {
2013 nvlist_t *nvl;
2014 uint_t evtype;
2015
2016 ASSERT(result == CT_EV_SUCCESS || result == CT_EV_FAILURE);
2017
2018 CT_DEBUG((CE_NOTE, "contract_device_negend(): entered: result: %d, "
2019 "dip: %p", result, (void *)dip));
2020
2021 VERIFY(nvlist_alloc(&nvl, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2022 VERIFY(nvlist_add_int32(nvl, CTS_NEWCT,
2023 result == CT_EV_SUCCESS ? 1 : 0) == 0);
2024
2025 evtype = CT_EV_NEGEND;
2026 (void) contract_device_publish(dip, dev, spec_type, evtype, nvl);
2027
2028 CT_DEBUG((CE_NOTE, "contract_device_negend(): exit dip: %p",
2029 (void *)dip));
2030 }
2031
2032 /*
2033 * Wrapper routine called by other subsystems (such as LDI) to start
2034 * negotiations when a synchronous device state change occurs.
2035 * Returns CT_ACK or CT_NACK.
2036 */
2037 ct_ack_t
2038 contract_device_negotiate(dev_info_t *dip, dev_t dev, int spec_type,
2039 uint_t evtype)
2040 {
2041 int result;
2042
2043 ASSERT(dip);
2044 ASSERT(dev != NODEV);
2045 ASSERT(dev != DDI_DEV_T_ANY);
2046 ASSERT(dev != DDI_DEV_T_NONE);
2047 ASSERT(spec_type == S_IFBLK || spec_type == S_IFCHR);
2048
2049 switch (evtype) {
2050 case CT_DEV_EV_OFFLINE:
2051 result = contract_device_offline(dip, dev, spec_type);
2052 break;
2053 default:
2054 cmn_err(CE_PANIC, "contract_device_negotiate(): Negotiation "
2055 "not supported: event (%d) for dev_t (%lu) and spec (%d), "
2056 "dip (%p)", evtype, dev, spec_type, (void *)dip);
2057 break;
2058 }
2059
2060 return (result);
2061 }
2062
2063 /*
2064 * A wrapper routine called by other subsystems (such as the LDI) to
2065 * finalize event processing for a state change event. For synchronous
2066 * state changes, this publishes NEGEND events. For asynchronous i.e.
2067 * non-negotiable events this publishes the event.
2068 */
2069 void
2070 contract_device_finalize(dev_info_t *dip, dev_t dev, int spec_type,
2071 uint_t evtype, int ct_result)
2072 {
2073 ASSERT(dip);
2074 ASSERT(dev != NODEV);
2075 ASSERT(dev != DDI_DEV_T_ANY);
2076 ASSERT(dev != DDI_DEV_T_NONE);
2077 ASSERT(spec_type == S_IFBLK || spec_type == S_IFCHR);
2078
2079 switch (evtype) {
2080 case CT_DEV_EV_OFFLINE:
2081 contract_device_negend(dip, dev, spec_type, ct_result);
2082 break;
2083 case CT_DEV_EV_DEGRADED:
2084 contract_device_degrade(dip, dev, spec_type);
2085 contract_device_negend(dip, dev, spec_type, ct_result);
2086 break;
2087 case CT_DEV_EV_ONLINE:
2088 contract_device_undegrade(dip, dev, spec_type);
2089 contract_device_negend(dip, dev, spec_type, ct_result);
2090 break;
2091 default:
2092 cmn_err(CE_PANIC, "contract_device_finalize(): Unsupported "
2093 "event (%d) for dev_t (%lu) and spec (%d), dip (%p)",
2094 evtype, dev, spec_type, (void *)dip);
2095 break;
2096 }
2097 }
2098
2099 /*
2100 * Called by I/O framework when a devinfo node is freed to remove the
2101 * association between a devinfo node and its contracts.
2102 */
2103 void
2104 contract_device_remove_dip(dev_info_t *dip)
2105 {
2106 cont_device_t *ctd;
2107 cont_device_t *next;
2108 contract_t *ct;
2109
2110 mutex_enter(&(DEVI(dip)->devi_ct_lock));
2111 ct_barrier_wait_for_release(dip);
2112
2113 for (ctd = list_head(&(DEVI(dip)->devi_ct)); ctd != NULL; ctd = next) {
2114 next = list_next(&(DEVI(dip)->devi_ct), ctd);
2115 list_remove(&(DEVI(dip)->devi_ct), ctd);
2116 ct = &ctd->cond_contract;
2117 /*
2118 * Unlink the dip associated with this contract
2119 */
2120 mutex_enter(&ct->ct_lock);
2121 ASSERT(ctd->cond_dip == dip);
2122 ctd->cond_dip = NULL; /* no longer linked to dip */
2123 contract_rele(ct); /* remove hold for dip linkage */
2124 CT_DEBUG((CE_NOTE, "ct: remove_dip: removed dip from contract: "
2125 "ctid: %d", ct->ct_id));
2126 mutex_exit(&ct->ct_lock);
2127 }
2128 ASSERT(list_is_empty(&(DEVI(dip)->devi_ct)));
2129 mutex_exit(&(DEVI(dip)->devi_ct_lock));
2130 }
2131
2132 /*
2133 * Barrier related routines
2134 */
2135 static void
2136 ct_barrier_acquire(dev_info_t *dip)
2137 {
2138 ASSERT(MUTEX_HELD(&(DEVI(dip)->devi_ct_lock)));
2139 CT_DEBUG((CE_NOTE, "ct_barrier_acquire: waiting for barrier"));
2140 while (DEVI(dip)->devi_ct_count != -1)
2141 cv_wait(&(DEVI(dip)->devi_ct_cv), &(DEVI(dip)->devi_ct_lock));
2142 DEVI(dip)->devi_ct_count = 0;
2143 CT_DEBUG((CE_NOTE, "ct_barrier_acquire: thread owns barrier"));
2144 }
2145
2146 static void
2147 ct_barrier_release(dev_info_t *dip)
2148 {
2149 ASSERT(MUTEX_HELD(&(DEVI(dip)->devi_ct_lock)));
2150 ASSERT(DEVI(dip)->devi_ct_count != -1);
2151 DEVI(dip)->devi_ct_count = -1;
2152 cv_broadcast(&(DEVI(dip)->devi_ct_cv));
2153 CT_DEBUG((CE_NOTE, "ct_barrier_release: Released barrier"));
2154 }
2155
2156 static int
2157 ct_barrier_held(dev_info_t *dip)
2158 {
2159 ASSERT(MUTEX_HELD(&(DEVI(dip)->devi_ct_lock)));
2160 return (DEVI(dip)->devi_ct_count != -1);
2161 }
2162
2163 static int
2164 ct_barrier_empty(dev_info_t *dip)
2165 {
2166 ASSERT(MUTEX_HELD(&(DEVI(dip)->devi_ct_lock)));
2167 ASSERT(DEVI(dip)->devi_ct_count != -1);
2168 return (DEVI(dip)->devi_ct_count == 0);
2169 }
2170
2171 static void
2172 ct_barrier_wait_for_release(dev_info_t *dip)
2173 {
2174 ASSERT(MUTEX_HELD(&(DEVI(dip)->devi_ct_lock)));
2175 while (DEVI(dip)->devi_ct_count != -1)
2176 cv_wait(&(DEVI(dip)->devi_ct_cv), &(DEVI(dip)->devi_ct_lock));
2177 }
2178
2179 static void
2180 ct_barrier_decr(dev_info_t *dip)
2181 {
2182 CT_DEBUG((CE_NOTE, "barrier_decr: ct_count before decr: %d",
2183 DEVI(dip)->devi_ct_count));
2184
2185 ASSERT(MUTEX_HELD(&(DEVI(dip)->devi_ct_lock)));
2186 ASSERT(DEVI(dip)->devi_ct_count > 0);
2187
2188 DEVI(dip)->devi_ct_count--;
2189 if (DEVI(dip)->devi_ct_count == 0) {
2190 cv_broadcast(&DEVI(dip)->devi_ct_cv);
2191 CT_DEBUG((CE_NOTE, "barrier_decr: cv_broadcast"));
2192 }
2193 }
2194
2195 static void
2196 ct_barrier_incr(dev_info_t *dip)
2197 {
2198 ASSERT(ct_barrier_held(dip));
2199 DEVI(dip)->devi_ct_count++;
2200 }
2201
2202 static int
2203 ct_barrier_wait_for_empty(dev_info_t *dip, int secs)
2204 {
2205 clock_t abstime;
2206
2207 ASSERT(MUTEX_HELD(&(DEVI(dip)->devi_ct_lock)));
2208
2209 abstime = ddi_get_lbolt() + drv_usectohz(secs*1000000);
2210 while (DEVI(dip)->devi_ct_count) {
2211 if (cv_timedwait(&(DEVI(dip)->devi_ct_cv),
2212 &(DEVI(dip)->devi_ct_lock), abstime) == -1) {
2213 return (-1);
2214 }
2215 }
2216 return (0);
2217 }