svc/svcadm/svcadm.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 2011, Joyent, Inc. All rights reserved.
 */

/*
 * svcadm - request adminstrative actions for service instances
 */

#include <locale.h>
#include <libintl.h>
#include <libscf.h>
#include <libscf_priv.h>
#include <libcontract.h>
#include <libcontract_priv.h>
#include <sys/contract/process.h>
#include <libuutil.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <procfs.h>
#include <assert.h>
#include <errno.h>
#include <zone.h>

#ifndef TEXT_DOMAIN
#define	TEXT_DOMAIN	"SUNW_OST_OSCMD"
#endif /* TEXT_DOMAIN */

/* Must be a power of two */
#define	HT_BUCKETS	64

/*
 * Exit codes for enable and disable -s.
 */
#define	EXIT_SVC_FAILURE	3
#define	EXIT_DEP_FAILURE	4

/*
 * How long we will wait (in seconds) for a service to change state
 * before re-checking its dependencies.
 */
#define	WAIT_INTERVAL		3

#ifndef NDEBUG
#define	bad_error(func, err)	{					\
	uu_warn("%s:%d: %s() failed with unexpected error %d.\n",	\
	    __FILE__, __LINE__, (func), (err));				\
	abort();							\
}
#else
#define	bad_error(func, err)	abort()
#endif


struct ht_elt {
	struct ht_elt	*next;
	boolean_t	active;
	char		str[1];
};


scf_handle_t *h;
ssize_t max_scf_fmri_sz;
static const char *emsg_permission_denied;
static const char *emsg_nomem;
static const char *emsg_create_pg_perm_denied;
static const char *emsg_pg_perm_denied;
static const char *emsg_prop_perm_denied;
static const char *emsg_no_service;

static int exit_status = 0;
static int verbose = 0;
static char *scratch_fmri;

static struct ht_elt **visited;

void do_scfdie(int lineno) __NORETURN;
static void usage_milestone(void) __NORETURN;
static void set_astring_prop(const char *, const char *, const char *,
    uint32_t, const char *, const char *);

/*
 * Visitors from synch.c, needed for enable -s and disable -s.
 */
extern int is_enabled(scf_instance_t *);
extern int has_potential(scf_instance_t *, int);

void
do_scfdie(int lineno)
{
	scf_error_t err;

	switch (err = scf_error()) {
	case SCF_ERROR_CONNECTION_BROKEN:
		uu_die(gettext("Connection to repository server broken.  "
		    "Exiting.\n"));
		/* NOTREACHED */

	case SCF_ERROR_BACKEND_READONLY:
		uu_die(gettext("Repository is read-only.  Exiting.\n"));
		/* NOTREACHED */

	default:
#ifdef NDEBUG
		uu_die(gettext("Unexpected libscf error: %s.  Exiting.\n"),
		    scf_strerror(err));
#else
		uu_die("Unexpected libscf error on line %d: %s.\n", lineno,
		    scf_strerror(err));
#endif
	}
}

#define	scfdie()	do_scfdie(__LINE__)

static void
usage()
{
	(void) fprintf(stderr, gettext(
	"Usage: %1$s [-v] [-z zone] [cmd [args ... ]]\n\n"
	"\t%1$s enable [-rst] <service> ...\t- enable and online service(s)\n"
	"\t%1$s disable [-st] <service> ...\t- disable and offline service(s)\n"
	"\t%1$s restart <service> ...\t\t- restart specified service(s)\n"
	"\t%1$s refresh <service> ...\t\t- re-read service configuration\n"
	"\t%1$s mark [-It] <state> <service> ...\t- set maintenance state\n"
	"\t%1$s clear <service> ...\t\t- clear maintenance state\n"
	"\t%1$s milestone [-d] <milestone>\t- advance to a service milestone\n"
	"\n\t"
	"Services can be specified using an FMRI, abbreviation, or fnmatch(5)\n"
	"\tpattern, as shown in these examples for svc:/network/smtp:sendmail\n"
	"\n"
	"\t%1$s <cmd> svc:/network/smtp:sendmail\n"
	"\t%1$s <cmd> network/smtp:sendmail\n"
	"\t%1$s <cmd> network/*mail\n"
	"\t%1$s <cmd> network/smtp\n"
	"\t%1$s <cmd> smtp:sendmail\n"
	"\t%1$s <cmd> smtp\n"
	"\t%1$s <cmd> sendmail\n"), uu_getpname());

	exit(UU_EXIT_USAGE);
}


/*
 * FMRI hash table for recursive enable.
 */

static uint32_t
hash_fmri(const char *str)
{
	uint32_t h = 0, g;
	const char *p;

	/* Generic hash function from uts/common/os/modhash.c . */
	for (p = str; *p != '\0'; ++p) {
		h = (h << 4) + *p;
		if ((g = (h & 0xf0000000)) != 0) {
			h ^= (g >> 24);
			h ^= g;
		}
	}

	return (h);
}

/*
 * Return 1 if str has been visited, 0 if it has not, and -1 if memory could not
 * be allocated.
 */
static int
visited_find_or_add(const char *str, struct ht_elt **hep)
{
	uint32_t h;
	uint_t i;
	struct ht_elt *he;

	h = hash_fmri(str);
	i = h & (HT_BUCKETS - 1);

	for (he = visited[i]; he != NULL; he = he->next) {
		if (strcmp(he->str, str) == 0) {
			if (hep)
				*hep = he;
			return (1);
		}
	}

	he = malloc(offsetof(struct ht_elt, str) + strlen(str) + 1);
	if (he == NULL)
		return (-1);

	(void) strcpy(he->str, str);

	he->next = visited[i];
	visited[i] = he;

	if (hep)
		*hep = he;
	return (0);
}


/*
 * Returns 0, ECANCELED if pg is deleted, ENOENT if propname doesn't exist,
 * EINVAL if the property is not of boolean type or has no values, and E2BIG
 * if it has more than one value.  *bp is set if 0 or E2BIG is returned.
 */
int
get_bool_prop(scf_propertygroup_t *pg, const char *propname, uint8_t *bp)
{
	scf_property_t *prop;
	scf_value_t *val;
	int ret;

	if ((prop = scf_property_create(h)) == NULL ||
	    (val = scf_value_create(h)) == NULL)
		scfdie();

	if (scf_pg_get_property(pg, propname, prop) != 0) {
		switch (scf_error()) {
		case SCF_ERROR_DELETED:
			ret = ECANCELED;
			goto out;

		case SCF_ERROR_NOT_FOUND:
			ret = ENOENT;
			goto out;

		case SCF_ERROR_NOT_SET:
			assert(0);
			abort();
			/* NOTREACHED */

		default:
			scfdie();
		}
	}

	if (scf_property_get_value(prop, val) == 0) {
		ret = 0;
	} else {
		switch (scf_error()) {
		case SCF_ERROR_DELETED:
			ret = ENOENT;
			goto out;

		case SCF_ERROR_NOT_FOUND:
			ret = EINVAL;
			goto out;

		case SCF_ERROR_CONSTRAINT_VIOLATED:
			ret = E2BIG;
			break;

		case SCF_ERROR_NOT_SET:
			assert(0);
			abort();
			/* NOTREACHED */

		default:
			scfdie();
		}
	}

	if (scf_value_get_boolean(val, bp) != 0) {
		if (scf_error() != SCF_ERROR_TYPE_MISMATCH)
			scfdie();

		ret = EINVAL;
		goto out;
	}

out:
	scf_value_destroy(val);
	scf_property_destroy(prop);
	return (ret);
}

/*
 * Returns 0, EPERM, or EROFS.
 */
static int
set_bool_prop(scf_propertygroup_t *pg, const char *propname, boolean_t b)
{
	scf_value_t *v;
	scf_transaction_t *tx;
	scf_transaction_entry_t *ent;
	int ret = 0, r;

	if ((tx = scf_transaction_create(h)) == NULL ||
	    (ent = scf_entry_create(h)) == NULL ||
	    (v = scf_value_create(h)) == NULL)
		scfdie();

	scf_value_set_boolean(v, b);

	for (;;) {
		if (scf_transaction_start(tx, pg) == -1) {
			switch (scf_error()) {
			case SCF_ERROR_PERMISSION_DENIED:
				ret = EPERM;
				goto out;

			case SCF_ERROR_BACKEND_READONLY:
				ret = EROFS;
				goto out;

			default:
				scfdie();
			}
		}

		if (scf_transaction_property_change_type(tx, ent, propname,
		    SCF_TYPE_BOOLEAN) != 0) {
			if (scf_error() != SCF_ERROR_NOT_FOUND)
				scfdie();

			if (scf_transaction_property_new(tx, ent, propname,
			    SCF_TYPE_BOOLEAN) != 0)
				scfdie();
		}

		r = scf_entry_add_value(ent, v);
		assert(r == 0);

		r = scf_transaction_commit(tx);
		if (r == 1)
			break;

		scf_transaction_reset(tx);

		if (r != 0) {
			switch (scf_error()) {
			case SCF_ERROR_PERMISSION_DENIED:
				ret = EPERM;
				goto out;

			case SCF_ERROR_BACKEND_READONLY:
				ret = EROFS;
				goto out;

			default:
				scfdie();
			}
		}

		if (scf_pg_update(pg) == -1)
			scfdie();
	}

out:
	scf_transaction_destroy(tx);
	scf_entry_destroy(ent);
	scf_value_destroy(v);
	return (ret);
}

/*
 * Gets the single astring value of the propname property of pg.  prop & v are
 * scratch space.  Returns the length of the string on success or
 *   -ENOENT - pg has no property named propname
 *   -E2BIG - property has no values or multiple values
 *   -EINVAL - property type is not compatible with astring
 */
ssize_t
get_astring_prop(const scf_propertygroup_t *pg, const char *propname,
    scf_property_t *prop, scf_value_t *v, char *buf, size_t bufsz)
{
	ssize_t sz;

	if (scf_pg_get_property(pg, propname, prop) != 0) {
		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		return (-ENOENT);
	}

	if (scf_property_get_value(prop, v) != 0) {
		switch (scf_error()) {
		case SCF_ERROR_NOT_FOUND:
		case SCF_ERROR_CONSTRAINT_VIOLATED:
			return (-E2BIG);

		default:
			scfdie();
		}
	}

	sz = scf_value_get_astring(v, buf, bufsz);
	if (sz < 0) {
		if (scf_error() != SCF_ERROR_TYPE_MISMATCH)
			scfdie();

		return (-EINVAL);
	}

	return (sz);
}

/*
 * Returns 0 or EPERM.
 */
static int
pg_get_or_add(const scf_instance_t *inst, const char *pgname,
    const char *pgtype, uint32_t pgflags, scf_propertygroup_t *pg)
{
again:
	if (scf_instance_get_pg(inst, pgname, pg) == 0)
		return (0);

	if (scf_error() != SCF_ERROR_NOT_FOUND)
		scfdie();

	if (scf_instance_add_pg(inst, pgname, pgtype, pgflags, pg) == 0)
		return (0);

	switch (scf_error()) {
	case SCF_ERROR_EXISTS:
		goto again;

	case SCF_ERROR_PERMISSION_DENIED:
		return (EPERM);

	default:
		scfdie();
		/* NOTREACHED */
	}
}

static int
my_ct_name(char *out, size_t len)
{
	ct_stathdl_t st;
	char *ct_fmri;
	ctid_t ct;
	int fd, errno, ret;

	if ((ct = getctid()) == -1)
		uu_die(gettext("Could not get contract id for process"));

	fd = contract_open(ct, "process", "status", O_RDONLY);

	if ((errno = ct_status_read(fd, CTD_ALL, &st)) != 0)
		uu_warn(gettext("Could not read status of contract "
		    "%ld: %s.\n"), ct, strerror(errno));

	if ((errno = ct_pr_status_get_svc_fmri(st, &ct_fmri)) != 0)
		uu_warn(gettext("Could not get svc_fmri for contract "
		    "%ld: %s.\n"), ct, strerror(errno));

	ret = strlcpy(out, ct_fmri, len);

	ct_status_free(st);
	(void) close(fd);

	return (ret);
}

/*
 * Set auxiliary_tty and auxiliary_fmri properties in restarter_actions pg to
 * communicate whether the action is requested from a tty and the fmri of the
 * responsible process.
 *
 * Returns 0, EPERM, or EROFS
 */
static int
restarter_setup(const char *fmri, const scf_instance_t *inst)
{
	boolean_t b = B_FALSE;
	scf_propertygroup_t *pg = NULL;
	int ret = 0;

	if ((pg = scf_pg_create(h)) == NULL)
		scfdie();

	if (pg_get_or_add(inst, SCF_PG_RESTARTER_ACTIONS,
	    SCF_PG_RESTARTER_ACTIONS_TYPE, SCF_PG_RESTARTER_ACTIONS_FLAGS,
	    pg) == EPERM) {
		if (!verbose)
			uu_warn(emsg_permission_denied, fmri);
		else
			uu_warn(emsg_create_pg_perm_denied, fmri,
			    SCF_PG_RESTARTER_ACTIONS);

		ret = EPERM;
		goto out;
	}

	/* Set auxiliary_tty property */
	if (isatty(STDIN_FILENO))
		b = B_TRUE;

	/* Create and set state to disabled */
	switch (set_bool_prop(pg, SCF_PROPERTY_AUX_TTY, b) != 0) {
	case 0:
		break;

	case EPERM:
		if (!verbose)
			uu_warn(emsg_permission_denied, fmri);
		else
			uu_warn(emsg_prop_perm_denied, fmri,
			    SCF_PG_RESTARTER_ACTIONS, SCF_PROPERTY_AUX_TTY);

		ret = EPERM;
		goto out;
		/* NOTREACHED */

	case EROFS:
		/* Shouldn't happen, but it can. */
		if (!verbose)
			uu_warn(gettext("%s: Repository read-only.\n"), fmri);
		else
			uu_warn(gettext("%s: Could not set %s/%s "
			    "(repository read-only).\n"), fmri,
			    SCF_PG_RESTARTER_ACTIONS, SCF_PROPERTY_AUX_TTY);

		ret = EROFS;
		goto out;
		/* NOTREACHED */

	default:
		scfdie();
	}

	if (my_ct_name(scratch_fmri, max_scf_fmri_sz) > 0) {
		set_astring_prop(fmri, SCF_PG_RESTARTER_ACTIONS,
		    SCF_PG_RESTARTER_ACTIONS_TYPE,
		    SCF_PG_RESTARTER_ACTIONS_FLAGS,
		    SCF_PROPERTY_AUX_FMRI, scratch_fmri);
	} else {
		uu_warn(gettext("%s: Could not set %s/%s: "
		    "my_ct_name failed.\n"), fmri,
		    SCF_PG_RESTARTER_ACTIONS, SCF_PROPERTY_AUX_FMRI);
	}

out:
	scf_pg_destroy(pg);
	return (ret);
}

/*
 * Enable or disable inst, per enable.  If temp is true, set
 * general_ovr/enabled.  Otherwise set general/enabled and delete
 * general_ovr/enabled if it exists (order is important here: we don't want the
 * enabled status to glitch).
 */
static void
set_inst_enabled(const char *fmri, scf_instance_t *inst, boolean_t temp,
    boolean_t enable)
{
	scf_propertygroup_t *pg;
	uint8_t b;
	const char *pgname = NULL;	/* For emsg_pg_perm_denied */
	int r;

	pg = scf_pg_create(h);
	if (pg == NULL)
		scfdie();

	if (restarter_setup(fmri, inst))
		goto out;

	/*
	 * An instance's configuration is incomplete if general/enabled
	 * doesn't exist. Create both the property group and property
	 * here if they don't exist.
	 */
	pgname = SCF_PG_GENERAL;
	if (pg_get_or_add(inst, pgname, SCF_PG_GENERAL_TYPE,
	    SCF_PG_GENERAL_FLAGS, pg) != 0)
		goto eperm;

	if (get_bool_prop(pg, SCF_PROPERTY_ENABLED, &b) != 0) {
		/* Create and set state to disabled */
		switch (set_bool_prop(pg, SCF_PROPERTY_ENABLED, B_FALSE) != 0) {
		case 0:
			break;

		case EPERM:
			goto eperm;

		case EROFS:
			/* Shouldn't happen, but it can. */
			if (!verbose)
				uu_warn(gettext("%s: Repository read-only.\n"),
				    fmri);
			else
				uu_warn(gettext("%s: Could not set %s/%s "
				    "(repository read-only).\n"), fmri,
				    SCF_PG_GENERAL, SCF_PROPERTY_ENABLED);
			goto out;

		default:
			assert(0);
			abort();
		}
	}

	if (temp) {
		/* Set general_ovr/enabled */
		pgname = SCF_PG_GENERAL_OVR;
		if (pg_get_or_add(inst, pgname, SCF_PG_GENERAL_OVR_TYPE,
		    SCF_PG_GENERAL_OVR_FLAGS, pg) != 0)
			goto eperm;

		switch (set_bool_prop(pg, SCF_PROPERTY_ENABLED, enable) != 0) {
		case 0:
			break;

		case EPERM:
			goto eperm;

		case EROFS:
			/* Shouldn't happen, but it can. */
			if (!verbose)
				uu_warn(gettext("%s: Repository read-only.\n"),
				    fmri);
			else
				uu_warn(gettext("%s: Could not set %s/%s "
				    "(repository read-only).\n"), fmri,
				    SCF_PG_GENERAL_OVR, SCF_PROPERTY_ENABLED);
			goto out;

		default:
			assert(0);
			abort();
		}

		if (verbose)
			(void) printf(enable ?
			    gettext("%s temporarily enabled.\n") :
			    gettext("%s temporarily disabled.\n"), fmri);
	} else {
again:
		/*
		 * Both pg and property should exist since we created
		 * them earlier. However, there's still a chance that
		 * someone may have deleted the property out from under
		 * us.
		 */
		if (pg_get_or_add(inst, pgname, SCF_PG_GENERAL_TYPE,
		    SCF_PG_GENERAL_FLAGS, pg) != 0)
			goto eperm;

		switch (set_bool_prop(pg, SCF_PROPERTY_ENABLED, enable)) {
		case 0:
			break;

		case EPERM:
			goto eperm;

		case EROFS:
			/*
			 * If general/enabled is already set the way we want,
			 * proceed.
			 */
			switch (get_bool_prop(pg, SCF_PROPERTY_ENABLED, &b)) {
			case 0:
				if ((b != 0) == (enable != B_FALSE))
					break;
				/* FALLTHROUGH */

			case ENOENT:
			case EINVAL:
			case E2BIG:
				if (!verbose)
					uu_warn(gettext("%s: Repository "
					    "read-only.\n"), fmri);
				else
					uu_warn(gettext("%s: Could not set "
					    "%s/%s (repository read-only).\n"),
					    fmri, SCF_PG_GENERAL,
					    SCF_PROPERTY_ENABLED);
				goto out;

			case ECANCELED:
				goto again;

			default:
				assert(0);
				abort();
			}
			break;

		default:
			assert(0);
			abort();
		}

		pgname = SCF_PG_GENERAL_OVR;
		r = scf_instance_delete_prop(inst, pgname,
		    SCF_PROPERTY_ENABLED);
		switch (r) {
		case 0:
			break;

		case ECANCELED:
			uu_warn(emsg_no_service, fmri);
			goto out;

		case EPERM:
			goto eperm;

		case EACCES:
			uu_warn(gettext("Could not delete %s/%s "
			    "property of %s: backend access denied.\n"),
			    pgname, SCF_PROPERTY_ENABLED, fmri);
			goto out;

		case EROFS:
			uu_warn(gettext("Could not delete %s/%s "
			    "property of %s: backend is read-only.\n"),
			    pgname, SCF_PROPERTY_ENABLED, fmri);
			goto out;

		default:
			bad_error("scf_instance_delete_prop", r);
		}

		if (verbose)
			(void) printf(enable ?  gettext("%s enabled.\n") :
			    gettext("%s disabled.\n"), fmri);
	}

	scf_pg_destroy(pg);
	return;

eperm:
	assert(pgname != NULL);
	if (!verbose)
		uu_warn(emsg_permission_denied, fmri);
	else
		uu_warn(emsg_pg_perm_denied, fmri, pgname);

out:
	scf_pg_destroy(pg);
	exit_status = 1;
}

/*
 * Set inst to the instance which corresponds to fmri.  If fmri identifies
 * a service with a single instance, get that instance.
 *
 * Fails with
 *   ENOTSUP - fmri has an unsupported scheme
 *   EINVAL - fmri is invalid
 *   ENOTDIR - fmri does not identify a service or instance
 *   ENOENT - could not locate instance
 *   E2BIG - fmri is a service with multiple instances (warning not printed)
 */
static int
get_inst_mult(const char *fmri, scf_instance_t *inst)
{
	char *cfmri;
	const char *svc_name, *inst_name, *pg_name;
	scf_service_t *svc;
	scf_instance_t *inst2;
	scf_iter_t *iter;
	int ret;

	if (strncmp(fmri, "lrc:", sizeof ("lrc:") - 1) == 0) {
		uu_warn(gettext("FMRI \"%s\" is a legacy service.\n"), fmri);
		exit_status = 1;
		return (ENOTSUP);
	}

	cfmri = strdup(fmri);
	if (cfmri == NULL)
		uu_die(emsg_nomem);

	if (scf_parse_svc_fmri(cfmri, NULL, &svc_name, &inst_name, &pg_name,
	    NULL) != SCF_SUCCESS) {
		free(cfmri);
		uu_warn(gettext("FMRI \"%s\" is invalid.\n"), fmri);
		exit_status = 1;
		return (EINVAL);
	}

	free(cfmri);

	if (svc_name == NULL || pg_name != NULL) {
		uu_warn(gettext(
		    "FMRI \"%s\" does not designate a service or instance.\n"),
		    fmri);
		exit_status = 1;
		return (ENOTDIR);
	}

	if (inst_name != NULL) {
		if (scf_handle_decode_fmri(h, fmri, NULL, NULL, inst, NULL,
		    NULL, SCF_DECODE_FMRI_EXACT) == 0)
			return (0);

		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		uu_warn(gettext("No such instance \"%s\".\n"), fmri);
		exit_status = 1;

		return (ENOENT);
	}

	if ((svc = scf_service_create(h)) == NULL ||
	    (inst2 = scf_instance_create(h)) == NULL ||
	    (iter = scf_iter_create(h)) == NULL)
		scfdie();

	if (scf_handle_decode_fmri(h, fmri, NULL, svc, NULL, NULL, NULL,
	    SCF_DECODE_FMRI_EXACT) != SCF_SUCCESS) {
		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		uu_warn(emsg_no_service, fmri);
		exit_status = 1;

		ret = ENOENT;
		goto out;
	}

	/* If the service has only one child, use it. */
	if (scf_iter_service_instances(iter, svc) != SCF_SUCCESS)
		scfdie();

	ret = scf_iter_next_instance(iter, inst);
	if (ret < 0)
		scfdie();
	if (ret != 1) {
		uu_warn(gettext("Service \"%s\" has no instances.\n"),
		    fmri);
		exit_status = 1;
		ret = ENOENT;
		goto out;
	}

	ret = scf_iter_next_instance(iter, inst2);
	if (ret < 0)
		scfdie();

	if (ret != 0) {
		ret = E2BIG;
		goto out;
	}

	ret = 0;

out:
	scf_iter_destroy(iter);
	scf_instance_destroy(inst2);
	scf_service_destroy(svc);
	return (ret);
}

/*
 * Same as get_inst_mult(), but on E2BIG prints a warning and returns ENOENT.
 */
static int
get_inst(const char *fmri, scf_instance_t *inst)
{
	int r;

	r = get_inst_mult(fmri, inst);
	if (r != E2BIG)
		return (r);

	uu_warn(gettext("operation on service %s is ambiguous; "
	    "instance specification needed.\n"), fmri);
	return (ENOENT);
}

static char *
inst_get_fmri(const scf_instance_t *inst)
{
	ssize_t sz;

	sz = scf_instance_to_fmri(inst, scratch_fmri, max_scf_fmri_sz);
	if (sz < 0)
		scfdie();
	if (sz >= max_scf_fmri_sz)
		uu_die(gettext("scf_instance_to_fmri() returned unexpectedly "
		    "long value.\n"));

	return (scratch_fmri);
}

static ssize_t
dep_get_astring(const char *fmri, const char *pgname,
    const scf_propertygroup_t *pg, const char *propname, scf_property_t *prop,
    scf_value_t *v, char *buf, size_t bufsz)
{
	ssize_t sz;

	sz = get_astring_prop(pg, propname, prop, v, buf, bufsz);
	if (sz >= 0)
		return (sz);

	switch (-sz) {
	case ENOENT:
		uu_warn(gettext("\"%s\" is misconfigured (\"%s\" dependency "
		    "lacks \"%s\" property.)\n"), fmri, pgname, propname);
		return (-1);

	case E2BIG:
		uu_warn(gettext("\"%s\" is misconfigured (\"%s/%s\" property "
		    "is not single-valued.)\n"), fmri, pgname, propname);
		return (-1);

	case EINVAL:
		uu_warn(gettext("\"%s\" is misconfigured (\"%s/%s\" property "
		    "is not of astring type.)\n"), fmri, pgname, propname);
		return (-1);

	default:
		assert(0);
		abort();
		/* NOTREACHED */
	}
}

static boolean_t
multiple_instances(scf_iter_t *iter, scf_value_t *v, char *buf)
{
	int count = 0, r;
	boolean_t ret;
	scf_instance_t *inst;

	inst = scf_instance_create(h);
	if (inst == NULL)
		scfdie();

	for (;;) {
		r = scf_iter_next_value(iter, v);
		if (r == 0) {
			ret = B_FALSE;
			goto out;
		}
		if (r != 1)
			scfdie();

		if (scf_value_get_astring(v, buf, max_scf_fmri_sz) < 0)
			scfdie();

		switch (get_inst_mult(buf, inst)) {
		case 0:
			++count;
			if (count > 1) {
				ret = B_TRUE;
				goto out;
			}
			break;

		case ENOTSUP:
		case EINVAL:
		case ENOTDIR:
		case ENOENT:
			continue;

		case E2BIG:
			ret = B_TRUE;
			goto out;

		default:
			assert(0);
			abort();
		}
	}

out:
	scf_instance_destroy(inst);
	return (ret);
}

/*
 * Enable the service or instance identified by fmri and its dependencies,
 * recursively.  Specifically, call get_inst(fmri), enable the result, and
 * recurse on its restarter and the dependencies.  To avoid duplication of
 * effort or looping around a dependency cycle, each FMRI is entered into the
 * "visited" hash table.  While recursing, the hash table entry is marked
 * "active", so that if we come upon it again, we know we've hit a cycle.
 * exclude_all and optional_all dependencies are ignored.  require_any
 * dependencies are followed only if they comprise a single service; otherwise
 * the user is warned.
 *
 * fmri must point to a writable max_scf_fmri_sz buffer.  Returns EINVAL if fmri
 * is invalid, E2BIG if fmri identifies a service with multiple instances, ELOOP
 * on cycle detection, or 0 on success.
 */
static int
enable_fmri_rec(char *fmri, boolean_t temp)
{
	scf_instance_t *inst;
	scf_snapshot_t *snap;
	scf_propertygroup_t *pg;
	scf_property_t *prop;
	scf_value_t *v;
	scf_iter_t *pg_iter, *val_iter;
	scf_type_t ty;
	char *buf, *pgname;
	ssize_t name_sz, len, sz;
	int ret;
	struct ht_elt *he;

	len = scf_canonify_fmri(fmri, fmri, max_scf_fmri_sz);
	if (len < 0) {
		assert(scf_error() == SCF_ERROR_INVALID_ARGUMENT);
		return (EINVAL);
	}
	assert(len < max_scf_fmri_sz);

	switch (visited_find_or_add(fmri, &he)) {
	case 0:
		he->active = B_TRUE;
		break;

	case 1:
		return (he->active ? ELOOP : 0);

	case -1:
		uu_die(emsg_nomem);

	default:
		assert(0);
		abort();
	}

	inst = scf_instance_create(h);
	if (inst == NULL)
		scfdie();

	switch (get_inst_mult(fmri, inst)) {
	case 0:
		break;

	case E2BIG:
		he->active = B_FALSE;
		return (E2BIG);

	default:
		he->active = B_FALSE;
		return (0);
	}

	set_inst_enabled(fmri, inst, temp, B_TRUE);

	if ((snap = scf_snapshot_create(h)) == NULL ||
	    (pg = scf_pg_create(h)) == NULL ||
	    (prop = scf_property_create(h)) == NULL ||
	    (v = scf_value_create(h)) == NULL ||
	    (pg_iter = scf_iter_create(h)) == NULL ||
	    (val_iter = scf_iter_create(h)) == NULL)
		scfdie();

	buf = malloc(max_scf_fmri_sz);
	if (buf == NULL)
		uu_die(emsg_nomem);

	name_sz = scf_limit(SCF_LIMIT_MAX_NAME_LENGTH);
	if (name_sz < 0)
		scfdie();
	++name_sz;
	pgname = malloc(name_sz);
	if (pgname == NULL)
		uu_die(emsg_nomem);

	if (scf_instance_get_snapshot(inst, "running", snap) != 0) {
		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		scf_snapshot_destroy(snap);
		snap = NULL;
	}

	/* Enable restarter */
	if (scf_instance_get_pg_composed(inst, snap, SCF_PG_GENERAL, pg) != 0) {
		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		uu_warn(gettext("\"%s\" is misconfigured (lacks \"%s\" "
		    "property group).\n"), fmri, SCF_PG_GENERAL);
		ret = 0;
		goto out;
	}

	sz = get_astring_prop(pg, SCF_PROPERTY_RESTARTER, prop, v, buf,
	    max_scf_fmri_sz);
	if (sz > max_scf_fmri_sz) {
		uu_warn(gettext("\"%s\" is misconfigured (the value of "
		    "\"%s/%s\" is too long).\n"), fmri, SCF_PG_GENERAL,
		    SCF_PROPERTY_RESTARTER);
		ret = 0;
		goto out;
	} else if (sz >= 0) {
		switch (enable_fmri_rec(buf, temp)) {
		case 0:
			break;

		case EINVAL:
			uu_warn(gettext("Restarter FMRI for \"%s\" is "
			    "invalid.\n"), fmri);
			break;

		case E2BIG:
			uu_warn(gettext("Restarter FMRI for \"%s\" identifies "
			    "a service with multiple instances.\n"), fmri);
			break;

		case ELOOP:
			ret = ELOOP;
			goto out;

		default:
			assert(0);
			abort();
		}
	} else if (sz < 0) {
		switch (-sz) {
		case ENOENT:
			break;

		case E2BIG:
			uu_warn(gettext("\"%s\" is misconfigured (\"%s/%s\" "
			    "property is not single-valued).\n"), fmri,
			    SCF_PG_GENERAL, SCF_PROPERTY_RESTARTER);
			ret = 0;
			goto out;

		case EINVAL:
			uu_warn(gettext("\"%s\" is misconfigured (\"%s/%s\" "
			    "property is not of astring type).\n"), fmri,
			    SCF_PG_GENERAL, SCF_PROPERTY_RESTARTER);
			ret = 0;
			goto out;

		default:
			assert(0);
			abort();
		}
	}

	if (scf_iter_instance_pgs_typed_composed(pg_iter, inst, snap,
	    SCF_GROUP_DEPENDENCY) == -1)
		scfdie();

	while (scf_iter_next_pg(pg_iter, pg) > 0) {
		len = scf_pg_get_name(pg, pgname, name_sz);
		if (len < 0)
			scfdie();
		assert(len < name_sz);

		if (dep_get_astring(fmri, pgname, pg, SCF_PROPERTY_TYPE, prop,
		    v, buf, max_scf_fmri_sz) < 0)
			continue;

		if (strcmp(buf, "service") != 0)
			continue;

		if (dep_get_astring(fmri, pgname, pg, SCF_PROPERTY_GROUPING,
		    prop, v, buf, max_scf_fmri_sz) < 0)
			continue;

		if (strcmp(buf, SCF_DEP_EXCLUDE_ALL) == 0 ||
		    strcmp(buf, SCF_DEP_OPTIONAL_ALL) == 0)
			continue;

		if (strcmp(buf, SCF_DEP_REQUIRE_ALL) != 0 &&
		    strcmp(buf, SCF_DEP_REQUIRE_ANY) != 0) {
			uu_warn(gettext("Dependency \"%s\" of \"%s\" has "
			    "unknown type \"%s\".\n"), pgname, fmri, buf);
			continue;
		}

		if (scf_pg_get_property(pg, SCF_PROPERTY_ENTITIES, prop) ==
		    -1) {
			if (scf_error() != SCF_ERROR_NOT_FOUND)
				scfdie();

			uu_warn(gettext("\"%s\" is misconfigured (\"%s\" "
			    "dependency lacks \"%s\" property.)\n"), fmri,
			    pgname, SCF_PROPERTY_ENTITIES);
			continue;
		}

		if (scf_property_type(prop, &ty) != SCF_SUCCESS)
			scfdie();

		if (ty != SCF_TYPE_FMRI) {
			uu_warn(gettext("\"%s\" is misconfigured (property "
			    "\"%s/%s\" is not of fmri type).\n"), fmri, pgname,
			    SCF_PROPERTY_ENTITIES);
			continue;
		}

		if (scf_iter_property_values(val_iter, prop) == -1)
			scfdie();

		if (strcmp(buf, SCF_DEP_REQUIRE_ANY) == 0) {
			if (multiple_instances(val_iter, v, buf)) {
				(void) printf(gettext("%s requires one of:\n"),
				    fmri);

				if (scf_iter_property_values(val_iter, prop) !=
				    0)
					scfdie();

				for (;;) {
					int r;

					r = scf_iter_next_value(val_iter, v);
					if (r == 0)
						break;
					if (r != 1)
						scfdie();

					if (scf_value_get_astring(v, buf,
					    max_scf_fmri_sz) < 0)
						scfdie();

					(void) fputs("  ", stdout);
					(void) puts(buf);
				}

				continue;
			}

			/*
			 * Since there's only one instance, we can enable it.
			 * Reset val_iter and continue.
			 */
			if (scf_iter_property_values(val_iter, prop) != 0)
				scfdie();
		}

		for (;;) {
			ret = scf_iter_next_value(val_iter, v);
			if (ret == 0)
				break;
			if (ret != 1)
				scfdie();

			if (scf_value_get_astring(v, buf, max_scf_fmri_sz) ==
			    -1)
				scfdie();

			switch (enable_fmri_rec(buf, temp)) {
			case 0:
				break;

			case EINVAL:
				uu_warn(gettext("\"%s\" dependency of \"%s\" "
				    "has invalid FMRI \"%s\".\n"), pgname,
				    fmri, buf);
				break;

			case E2BIG:
				uu_warn(gettext("%s depends on %s, which has "
				    "multiple instances.\n"), fmri, buf);
				break;

			case ELOOP:
				ret = ELOOP;
				goto out;

			default:
				assert(0);
				abort();
			}
		}
	}

	ret = 0;

out:
	he->active = B_FALSE;

	free(buf);
	free(pgname);

	(void) scf_value_destroy(v);
	scf_property_destroy(prop);
	scf_pg_destroy(pg);
	scf_snapshot_destroy(snap);
	scf_iter_destroy(pg_iter);
	scf_iter_destroy(val_iter);

	return (ret);
}

/*
 * fmri here is only used for verbose messages.
 */
static void
set_inst_action(const char *fmri, const scf_instance_t *inst,
    const char *action)
{
	scf_transaction_t *tx;
	scf_transaction_entry_t *ent;
	scf_propertygroup_t *pg;
	scf_property_t *prop;
	scf_value_t *v;
	int ret;
	int64_t t;
	hrtime_t timestamp;

	const char * const scf_pg_restarter_actions = SCF_PG_RESTARTER_ACTIONS;

	if ((pg = scf_pg_create(h)) == NULL ||
	    (prop = scf_property_create(h)) == NULL ||
	    (v = scf_value_create(h)) == NULL ||
	    (tx = scf_transaction_create(h)) == NULL ||
	    (ent = scf_entry_create(h)) == NULL)
		scfdie();

	if (restarter_setup(fmri, inst)) {
		exit_status = 1;
		goto out;
	}

	if (scf_instance_get_pg(inst, scf_pg_restarter_actions, pg) == -1) {
		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		/* Try creating the restarter_actions property group. */
		if (scf_instance_add_pg(inst, scf_pg_restarter_actions,
		    SCF_PG_RESTARTER_ACTIONS_TYPE,
		    SCF_PG_RESTARTER_ACTIONS_FLAGS, pg) == -1) {
			switch (scf_error()) {
			case SCF_ERROR_EXISTS:
				/* Someone must have added it. */
				break;

			case SCF_ERROR_PERMISSION_DENIED:
				if (!verbose)
					uu_warn(emsg_permission_denied, fmri);
				else
					uu_warn(emsg_create_pg_perm_denied,
					    fmri, scf_pg_restarter_actions);
				goto out;

			default:
				scfdie();
			}
		}
	}

	/*
	 * If we lose the transaction race and need to retry, there are 2
	 * potential other winners:
	 *	- another process setting actions
	 *	- the restarter marking the action complete
	 * Therefore, re-read the property every time through the loop before
	 * making any decisions based on their values.
	 */
	do {
		timestamp = gethrtime();

		if (scf_transaction_start(tx, pg) == -1) {
			if (scf_error() != SCF_ERROR_PERMISSION_DENIED)
				scfdie();

			if (!verbose)
				uu_warn(emsg_permission_denied, fmri);
			else
				uu_warn(emsg_pg_perm_denied, fmri,
				    scf_pg_restarter_actions);
			goto out;
		}

		if (scf_pg_get_property(pg, action, prop) == -1) {
			if (scf_error() != SCF_ERROR_NOT_FOUND)
				scfdie();
			if (scf_transaction_property_new(tx, ent,
			    action, SCF_TYPE_INTEGER) == -1)
				scfdie();
			goto action_set;
		} else {
			if (scf_transaction_property_change_type(tx, ent,
			    action, SCF_TYPE_INTEGER) == -1)
				scfdie();
		}

		if (scf_property_get_value(prop, v) == -1) {
			switch (scf_error()) {
			case SCF_ERROR_CONSTRAINT_VIOLATED:
			case SCF_ERROR_NOT_FOUND:
				/* Misconfigured, so set anyway. */
				goto action_set;

			default:
				scfdie();
			}
		} else {
			if (scf_value_get_integer(v, &t) == -1) {
				assert(scf_error() == SCF_ERROR_TYPE_MISMATCH);
				goto action_set;
			}
			if (t > timestamp)
				break;
		}

action_set:
		scf_value_set_integer(v, timestamp);
		if (scf_entry_add_value(ent, v) == -1)
			scfdie();

		ret = scf_transaction_commit(tx);
		if (ret == -1) {
			if (scf_error() != SCF_ERROR_PERMISSION_DENIED)
				scfdie();

			if (!verbose)
				uu_warn(emsg_permission_denied, fmri);
			else
				uu_warn(emsg_prop_perm_denied, fmri,
				    scf_pg_restarter_actions, action);
			scf_transaction_reset(tx);
			goto out;
		}

		scf_transaction_reset(tx);

		if (ret == 0) {
			if (scf_pg_update(pg) == -1)
				scfdie();
		}
	} while (ret == 0);

	if (verbose)
		(void) printf(gettext("Action %s set for %s.\n"), action, fmri);

out:
	scf_value_destroy(v);
	scf_entry_destroy(ent);
	scf_transaction_destroy(tx);
	scf_property_destroy(prop);
	scf_pg_destroy(pg);
}

/*
 * Get the state of inst.  state should point to a buffer of
 * MAX_SCF_STATE_STRING_SZ bytes.  Returns 0 on success or -1 if
 *   no restarter property group
 *   no state property
 *   state property is misconfigured (wrong type, not single-valued)
 *   state value is too long
 * In these cases, fmri is used to print a warning.
 *
 * If pgp is non-NULL, a successful call to inst_get_state will store
 * the SCF_PG_RESTARTER property group in *pgp, and the caller will be
 * responsible for calling scf_pg_destroy on the property group.
 */
int
inst_get_state(scf_instance_t *inst, char *state, const char *fmri,
    scf_propertygroup_t **pgp)
{
	scf_propertygroup_t *pg;
	scf_property_t *prop;
	scf_value_t *val;
	int ret = -1;
	ssize_t szret;

	if ((pg = scf_pg_create(h)) == NULL ||
	    (prop = scf_property_create(h)) == NULL ||
	    (val = scf_value_create(h)) == NULL)
		scfdie();

	if (scf_instance_get_pg(inst, SCF_PG_RESTARTER, pg) != SCF_SUCCESS) {
		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		uu_warn(gettext("%s is misconfigured (lacks \"%s\" property "
		    "group).\n"), fmri ? fmri : inst_get_fmri(inst),
		    SCF_PG_RESTARTER);
		goto out;
	}

	szret = get_astring_prop(pg, SCF_PROPERTY_STATE, prop, val, state,
	    MAX_SCF_STATE_STRING_SZ);
	if (szret < 0) {
		switch (-szret) {
		case ENOENT:
			uu_warn(gettext("%s is misconfigured (\"%s\" property "
			    "group lacks \"%s\" property).\n"),
			    fmri ? fmri : inst_get_fmri(inst), SCF_PG_RESTARTER,
			    SCF_PROPERTY_STATE);
			goto out;

		case E2BIG:
			uu_warn(gettext("%s is misconfigured (\"%s/%s\" "
			    "property is not single-valued).\n"),
			    fmri ? fmri : inst_get_fmri(inst), SCF_PG_RESTARTER,
			    SCF_PROPERTY_STATE);
			goto out;

		case EINVAL:
			uu_warn(gettext("%s is misconfigured (\"%s/%s\" "
			    "property is not of type astring).\n"),
			    fmri ? fmri : inst_get_fmri(inst), SCF_PG_RESTARTER,
			    SCF_PROPERTY_STATE);
			goto out;

		default:
			assert(0);
			abort();
		}
	}
	if (szret >= MAX_SCF_STATE_STRING_SZ) {
		uu_warn(gettext("%s is misconfigured (\"%s/%s\" property value "
		    "is too long).\n"), fmri ? fmri : inst_get_fmri(inst),
		    SCF_PG_RESTARTER, SCF_PROPERTY_STATE);
		goto out;
	}

	ret = 0;
	if (pgp)
		*pgp = pg;

out:
	(void) scf_value_destroy(val);
	scf_property_destroy(prop);
	if (ret || pgp == NULL)
		scf_pg_destroy(pg);
	return (ret);
}

static void
set_astring_prop(const char *fmri, const char *pgname, const char *pgtype,
    uint32_t pgflags, const char *propname, const char *str)
{
	scf_instance_t *inst;
	scf_propertygroup_t *pg;
	scf_property_t *prop;
	scf_value_t *val;
	scf_transaction_t *tx;
	scf_transaction_entry_t *txent;
	int ret;

	inst = scf_instance_create(h);
	if (inst == NULL)
		scfdie();

	if (get_inst(fmri, inst) != 0)
		return;

	if ((pg = scf_pg_create(h)) == NULL ||
	    (prop = scf_property_create(h)) == NULL ||
	    (val = scf_value_create(h)) == NULL ||
	    (tx = scf_transaction_create(h)) == NULL ||
	    (txent = scf_entry_create(h)) == NULL)
		scfdie();

	if (scf_instance_get_pg(inst, pgname, pg) != SCF_SUCCESS) {
		if (scf_error() != SCF_ERROR_NOT_FOUND)
			scfdie();

		if (scf_instance_add_pg(inst, pgname, pgtype, pgflags, pg) !=
		    SCF_SUCCESS) {
			switch (scf_error()) {
			case SCF_ERROR_EXISTS:
				if (scf_instance_get_pg(inst, pgname, pg) !=
				    SCF_SUCCESS) {
					if (scf_error() != SCF_ERROR_NOT_FOUND)
						scfdie();

					uu_warn(gettext("Repository write "
					    "contention.\n"));
					goto out;
				}
				break;

			case SCF_ERROR_PERMISSION_DENIED:
				if (!verbose)
					uu_warn(emsg_permission_denied, fmri);
				else
					uu_warn(emsg_create_pg_perm_denied,
					    fmri, pgname);
				goto out;

			default:
				scfdie();
			}
		}
	}

	do {
		if (scf_transaction_start(tx, pg) != SCF_SUCCESS) {
			if (scf_error() != SCF_ERROR_PERMISSION_DENIED)
				scfdie();

			if (!verbose)
				uu_warn(emsg_permission_denied, fmri);
			else
				uu_warn(emsg_pg_perm_denied, fmri, pgname);
			goto out;
		}

		if (scf_transaction_property_change_type(tx, txent, propname,
		    SCF_TYPE_ASTRING) != 0) {
			if (scf_error() != SCF_ERROR_NOT_FOUND)
				scfdie();

			if (scf_transaction_property_new(tx, txent, propname,
			    SCF_TYPE_ASTRING) != 0)
				scfdie();
		}

		if (scf_value_set_astring(val, str) != SCF_SUCCESS)
			scfdie();

		if (scf_entry_add_value(txent, val) != SCF_SUCCESS)
			scfdie();

		ret = scf_transaction_commit(tx);
		if (ret == -1) {
			if (scf_error() != SCF_ERROR_PERMISSION_DENIED)
				scfdie();

			if (!verbose)
				uu_warn(emsg_permission_denied, fmri);
			else
				uu_warn(emsg_prop_perm_denied, fmri, pgname,
				    propname);
			goto out;
		}

		if (ret == 0) {
			scf_transaction_reset(tx);

			if (scf_pg_update(pg) == -1)
				scfdie();
		}
	} while (ret == 0);

out:
	scf_transaction_destroy(tx);
	scf_entry_destroy(txent);
	scf_value_destroy(val);
	scf_property_destroy(prop);
	scf_pg_destroy(pg);
	scf_instance_destroy(inst);
}


/*
 * Flags to control enable and disable actions.
 */
#define	SET_ENABLED	0x1
#define	SET_TEMPORARY	0x2
#define	SET_RECURSIVE	0x4

static int
set_fmri_enabled(void *data, scf_walkinfo_t *wip)
{
	int flags = (int)data;

	assert(wip->inst != NULL);
	assert(wip->pg == NULL);

	if (flags & SET_RECURSIVE) {
		char *fmri_buf = malloc(max_scf_fmri_sz);
		if (fmri_buf == NULL)
			uu_die(emsg_nomem);

		visited = calloc(HT_BUCKETS, sizeof (*visited));
		if (visited == NULL)
			uu_die(emsg_nomem);

		/* scf_walk_fmri() guarantees that fmri isn't too long */
		assert(strlen(wip->fmri) <= max_scf_fmri_sz);
		(void) strlcpy(fmri_buf, wip->fmri, max_scf_fmri_sz);

		switch (enable_fmri_rec(fmri_buf, (flags & SET_TEMPORARY))) {
		case E2BIG:
			uu_warn(gettext("operation on service %s is ambiguous; "
			    "instance specification needed.\n"), fmri_buf);
			break;

		case ELOOP:
			uu_warn(gettext("%s: Dependency cycle detected.\n"),
			    fmri_buf);
		}

		free(visited);
		free(fmri_buf);

	} else {
		set_inst_enabled(wip->fmri, wip->inst,
		    (flags & SET_TEMPORARY) != 0, (flags & SET_ENABLED) != 0);
	}

	return (0);
}

/* ARGSUSED */
static int
wait_fmri_enabled(void *data, scf_walkinfo_t *wip)
{
	scf_propertygroup_t *pg = NULL;
	char state[MAX_SCF_STATE_STRING_SZ];

	assert(wip->inst != NULL);
	assert(wip->pg == NULL);

	do {
		if (pg)
			scf_pg_destroy(pg);
		if (inst_get_state(wip->inst, state, wip->fmri, &pg) != 0) {
			exit_status = EXIT_SVC_FAILURE;
			return (0);
		}

		if (strcmp(state, SCF_STATE_STRING_ONLINE) == 0 ||
		    strcmp(state, SCF_STATE_STRING_DEGRADED) == 0) {
			/*
			 * We're done.
			 */
			goto out;
		}

		if (strcmp(state, SCF_STATE_STRING_MAINT) == 0) {
			/*
			 * The service is ill.
			 */
			uu_warn(gettext("Instance \"%s\" is in maintenance"
			    " state.\n"), wip->fmri);
			exit_status = EXIT_SVC_FAILURE;
			goto out;
		}

		if (!is_enabled(wip->inst)) {
			/*
			 * Someone stepped in and disabled the service.
			 */
			uu_warn(gettext("Instance \"%s\" has been disabled"
			    " by another entity.\n"), wip->fmri);
			exit_status = EXIT_SVC_FAILURE;
			goto out;
		}

		if (!has_potential(wip->inst, B_FALSE)) {
			/*
			 * Our dependencies aren't met.  We'll never
			 * amount to anything.
			 */
			uu_warn(gettext("Instance \"%s\" has unsatisfied"
			    " dependencies.\n"), wip->fmri);
			/*
			 * EXIT_SVC_FAILURE takes precedence over
			 * EXIT_DEP_FAILURE
			 */
			if (exit_status == 0)
				exit_status = EXIT_DEP_FAILURE;
			goto out;
		}
	} while (_scf_pg_wait(pg, WAIT_INTERVAL) >= 0);
	scfdie();
	/* NOTREACHED */

out:
	scf_pg_destroy(pg);
	return (0);
}

/* ARGSUSED */
static int
wait_fmri_disabled(void *data, scf_walkinfo_t *wip)
{
	scf_propertygroup_t *pg = NULL;
	char state[MAX_SCF_STATE_STRING_SZ];

	assert(wip->inst != NULL);
	assert(wip->pg == NULL);

	do {
		if (pg)
			scf_pg_destroy(pg);
		if (inst_get_state(wip->inst, state, wip->fmri, &pg) != 0) {
			exit_status = EXIT_SVC_FAILURE;
			return (0);
		}

		if (strcmp(state, SCF_STATE_STRING_DISABLED) == 0) {
			/*
			 * We're done.
			 */
			goto out;
		}

		if (is_enabled(wip->inst)) {
			/*
			 * Someone stepped in and enabled the service.
			 */
			uu_warn(gettext("Instance \"%s\" has been enabled"
			    " by another entity.\n"), wip->fmri);
			exit_status = EXIT_SVC_FAILURE;
			goto out;
		}

		if (!has_potential(wip->inst, B_TRUE)) {
			/*
			 * Our restarter is hopeless.
			 */
			uu_warn(gettext("Restarter for instance \"%s\" is"
			    " unavailable.\n"), wip->fmri);
			/*
			 * EXIT_SVC_FAILURE takes precedence over
			 * EXIT_DEP_FAILURE
			 */
			if (exit_status == 0)
				exit_status = EXIT_DEP_FAILURE;
			goto out;
		}

	} while (_scf_pg_wait(pg, WAIT_INTERVAL) >= 0);
	scfdie();
	/* NOTREACHED */

out:
	scf_pg_destroy(pg);
	return (0);
}

/* ARGSUSED */
static int
clear_instance(void *data, scf_walkinfo_t *wip)
{
	char state[MAX_SCF_STATE_STRING_SZ];

	assert(wip->inst != NULL);
	assert(wip->pg == NULL);

	if (inst_get_state(wip->inst, state, wip->fmri, NULL) != 0)
		return (0);

	if (strcmp(state, SCF_STATE_STRING_MAINT) == 0) {
		set_inst_action(wip->fmri, wip->inst, SCF_PROPERTY_MAINT_OFF);
	} else if (strcmp(state, SCF_STATE_STRING_DEGRADED) ==
	    0) {
		set_inst_action(wip->fmri, wip->inst, SCF_PROPERTY_RESTORE);
	} else {
		uu_warn(gettext("Instance \"%s\" is not in a "
		    "maintenance or degraded state.\n"), wip->fmri);

		exit_status = 1;
	}

	return (0);
}

static int
set_fmri_action(void *action, scf_walkinfo_t *wip)
{
	assert(wip->inst != NULL && wip->pg == NULL);

	set_inst_action(wip->fmri, wip->inst, action);

	return (0);
}

/*
 * Flags to control 'mark' action.
 */
#define	MARK_IMMEDIATE	0x1
#define	MARK_TEMPORARY	0x2

static int
force_degraded(void *data, scf_walkinfo_t *wip)
{
	int flags = (int)data;
	char state[MAX_SCF_STATE_STRING_SZ];

	if (inst_get_state(wip->inst, state, wip->fmri, NULL) != 0) {
		exit_status = 1;
		return (0);
	}

	if (strcmp(state, SCF_STATE_STRING_ONLINE) != 0) {
		uu_warn(gettext("Instance \"%s\" is not online.\n"), wip->fmri);
		exit_status = 1;
		return (0);
	}

	set_inst_action(wip->fmri, wip->inst, (flags & MARK_IMMEDIATE) ?
	    SCF_PROPERTY_DEGRADE_IMMEDIATE : SCF_PROPERTY_DEGRADED);

	return (0);
}

static int
force_maintenance(void *data, scf_walkinfo_t *wip)
{
	int flags = (int)data;
	const char *prop;

	if (flags & MARK_IMMEDIATE) {
		prop = (flags & MARK_TEMPORARY) ?
		    SCF_PROPERTY_MAINT_ON_IMMTEMP :
		    SCF_PROPERTY_MAINT_ON_IMMEDIATE;
	} else {
		prop = (flags & MARK_TEMPORARY) ?
		    SCF_PROPERTY_MAINT_ON_TEMPORARY :
		    SCF_PROPERTY_MAINT_ON;
	}

	set_inst_action(wip->fmri, wip->inst, prop);

	return (0);
}

static void
set_milestone(const char *fmri, boolean_t temporary)
{
	scf_instance_t *inst;
	scf_propertygroup_t *pg;
	int r;

	if (temporary) {
		set_astring_prop(SCF_SERVICE_STARTD, SCF_PG_OPTIONS_OVR,
		    SCF_PG_OPTIONS_OVR_TYPE, SCF_PG_OPTIONS_OVR_FLAGS,
		    SCF_PROPERTY_MILESTONE, fmri);
		return;
	}

	if ((inst = scf_instance_create(h)) == NULL ||
	    (pg = scf_pg_create(h)) == NULL)
		scfdie();

	if (get_inst(SCF_SERVICE_STARTD, inst) != 0) {
		scf_instance_destroy(inst);
		return;
	}

	/*
	 * Set the persistent milestone before deleting the override so we don't
	 * glitch.
	 */
	set_astring_prop(SCF_SERVICE_STARTD, SCF_PG_OPTIONS,
	    SCF_PG_OPTIONS_TYPE, SCF_PG_OPTIONS_FLAGS, SCF_PROPERTY_MILESTONE,
	    fmri);

	r = scf_instance_delete_prop(inst, SCF_PG_OPTIONS_OVR,
	    SCF_PROPERTY_MILESTONE);
	switch (r) {
	case 0:
		break;

	case ECANCELED:
		uu_warn(emsg_no_service, fmri);
		exit_status = 1;
		goto out;

	case EPERM:
		uu_warn(gettext("Could not delete %s/%s property of "
		    "%s: permission denied.\n"), SCF_PG_OPTIONS_OVR,
		    SCF_PROPERTY_MILESTONE, SCF_SERVICE_STARTD);
		exit_status = 1;
		goto out;

	case EACCES:
		uu_warn(gettext("Could not delete %s/%s property of "
		    "%s: access denied.\n"), SCF_PG_OPTIONS_OVR,
		    SCF_PROPERTY_MILESTONE, SCF_SERVICE_STARTD);
		exit_status = 1;
		goto out;

	case EROFS:
		uu_warn(gettext("Could not delete %s/%s property of "
		    "%s: backend read-only.\n"), SCF_PG_OPTIONS_OVR,
		    SCF_PROPERTY_MILESTONE, SCF_SERVICE_STARTD);
		exit_status = 1;
		goto out;

	default:
		bad_error("scf_instance_delete_prop", r);
	}

out:
	scf_pg_destroy(pg);
	scf_instance_destroy(inst);
}

static char const *milestones[] = {
	SCF_MILESTONE_SINGLE_USER,
	SCF_MILESTONE_MULTI_USER,
	SCF_MILESTONE_MULTI_USER_SERVER,
	NULL
};

static void
usage_milestone(void)
{
	const char **ms;

	(void) fprintf(stderr, gettext(
	"Usage: svcadm milestone [-d] <milestone>\n\n"
	"\t-d\tmake the specified milestone the default for system boot\n\n"
	"\tMilestones can be specified using an FMRI or abbreviation.\n"
	"\tThe major milestones are as follows:\n\n"
	"\tall\n"
	"\tnone\n"));

	for (ms = milestones; *ms != NULL; ms++)
		(void) fprintf(stderr, "\t%s\n", *ms);

	exit(UU_EXIT_USAGE);
}

static const char *
validate_milestone(const char *milestone)
{
	const char **ms;
	const char *tmp;
	size_t len;

	if (strcmp(milestone, "all") == 0)
		return (milestone);

	if (strcmp(milestone, "none") == 0)
		return (milestone);

	/*
	 * Determine if this is a full or partial milestone
	 */
	for (ms = milestones; *ms != NULL; ms++) {
		if ((tmp = strstr(*ms, milestone)) != NULL) {
			len = strlen(milestone);

			/*
			 * The beginning of the string must align with the start
			 * of a milestone fmri, or on the boundary between
			 * elements.  The end of the string must align with the
			 * end of the milestone, or at the instance boundary.
			 */
			if ((tmp == *ms || tmp[-1] == '/') &&
			    (tmp[len] == '\0' || tmp[len] == ':'))
				return (*ms);
		}
	}

	(void) fprintf(stderr,
	    gettext("\"%s\" is not a valid major milestone.\n"), milestone);

	usage_milestone();
	/* NOTREACHED */
}

/*ARGSUSED*/
static void
quiet(const char *fmt, ...)
{
	/* Do nothing */
}

int
main(int argc, char *argv[])
{
	int o;
	int err;
	int sw_back;

	(void) setlocale(LC_ALL, "");
	(void) textdomain(TEXT_DOMAIN);

	(void) uu_setpname(argv[0]);

	if (argc < 2)
		usage();

	max_scf_fmri_sz = scf_limit(SCF_LIMIT_MAX_FMRI_LENGTH);
	if (max_scf_fmri_sz < 0)
		scfdie();
	++max_scf_fmri_sz;

	scratch_fmri = malloc(max_scf_fmri_sz);
	if (scratch_fmri == NULL)
		uu_die(emsg_nomem);

	h = scf_handle_create(SCF_VERSION);
	if (h == NULL)
		scfdie();

	while ((o = getopt(argc, argv, "vz:")) != -1) {
		switch (o) {
		case 'v':
			verbose = 1;
			break;

		case 'z': {
			scf_value_t *zone;

			if (getzoneid() != GLOBAL_ZONEID)
				uu_die(gettext("svcadm -z may only be used "
				    "from the global zone\n"));

			if ((zone = scf_value_create(h)) == NULL)
				scfdie();

			if (scf_value_set_astring(zone, optarg) != SCF_SUCCESS)
				scfdie();

			if (scf_handle_decorate(h, "zone", zone) != SCF_SUCCESS)
				uu_die(gettext("invalid zone '%s'\n"), optarg);

			scf_value_destroy(zone);
			break;
		}

		default:
			usage();
		}
	}

	if (scf_handle_bind(h) == -1)
		uu_die(gettext("Couldn't bind to configuration repository: "
		    "%s.\n"), scf_strerror(scf_error()));

	if (optind >= argc)
		usage();

	emsg_permission_denied = gettext("%s: Permission denied.\n");
	emsg_nomem = gettext("Out of memory.\n");
	emsg_create_pg_perm_denied = gettext("%s: Couldn't create \"%s\" "
	    "property group (permission denied).\n");
	emsg_pg_perm_denied = gettext("%s: Couldn't modify \"%s\" property "
	    "group (permission denied).\n");
	emsg_prop_perm_denied = gettext("%s: Couldn't modify \"%s/%s\" "
	    "property (permission denied).\n");
	emsg_no_service = gettext("No such service \"%s\".\n");

	if (strcmp(argv[optind], "enable") == 0) {
		int flags = SET_ENABLED;
		int wait = 0;
		int error = 0;

		++optind;

		while ((o = getopt(argc, argv, "rst")) != -1) {
			if (o == 'r')
				flags |= SET_RECURSIVE;
			else if (o == 't')
				flags |= SET_TEMPORARY;
			else if (o == 's')
				wait = 1;
			else if (o == '?')
				usage();
			else {
				assert(0);
				abort();
			}
		}
		argc -= optind;
		argv += optind;

		if (argc <= 0)
			usage();

		/*
		 * We want to continue with -s processing if we had
		 * invalid options, but not if an enable failed.  We
		 * squelch output the second time we walk fmris; we saw
		 * the errors the first time.
		 */
		if ((err = scf_walk_fmri(h, argc, argv, 0, set_fmri_enabled,
		    (void *)flags, &error, uu_warn)) != 0) {

			uu_warn(gettext("failed to iterate over "
			    "instances: %s\n"), scf_strerror(err));
			exit_status = UU_EXIT_FATAL;

		} else if (wait && exit_status == 0 &&
		    (err = scf_walk_fmri(h, argc, argv, 0, wait_fmri_enabled,
		    (void *)flags, &error, quiet)) != 0) {

			uu_warn(gettext("failed to iterate over "
			    "instances: %s\n"), scf_strerror(err));
			exit_status = UU_EXIT_FATAL;
		}

		if (error > 0)
			exit_status = error;

	} else if (strcmp(argv[optind], "disable") == 0) {
		int flags = 0;
		int wait = 0;
		int error = 0;

		++optind;

		while ((o = getopt(argc, argv, "st")) != -1) {
			if (o == 't')
				flags |= SET_TEMPORARY;
			else if (o == 's')
				wait = 1;
			else if (o == '?')
				usage();
			else {
				assert(0);
				abort();
			}
		}
		argc -= optind;
		argv += optind;

		if (argc <= 0)
			usage();

		/*
		 * We want to continue with -s processing if we had
		 * invalid options, but not if a disable failed.  We
		 * squelch output the second time we walk fmris; we saw
		 * the errors the first time.
		 */
		if ((err = scf_walk_fmri(h, argc, argv, 0, set_fmri_enabled,
		    (void *)flags, &exit_status, uu_warn)) != 0) {

			uu_warn(gettext("failed to iterate over "
			    "instances: %s\n"), scf_strerror(err));
			exit_status = UU_EXIT_FATAL;

		} else if (wait && exit_status == 0 &&
		    (err = scf_walk_fmri(h, argc, argv, 0, wait_fmri_disabled,
		    (void *)flags, &error, quiet)) != 0) {

			uu_warn(gettext("failed to iterate over "
			    "instances: %s\n"), scf_strerror(err));
			exit_status = UU_EXIT_FATAL;
		}

		if (error > 0)
			exit_status = error;

	} else if (strcmp(argv[optind], "restart") == 0) {
		++optind;

		if (optind >= argc)
			usage();

		if ((err = scf_walk_fmri(h, argc - optind, argv + optind, 0,
		    set_fmri_action, (void *)SCF_PROPERTY_RESTART,
		    &exit_status, uu_warn)) != 0) {
			uu_warn(gettext("failed to iterate over "
			    "instances: %s\n"), scf_strerror(err));
			exit_status = UU_EXIT_FATAL;
		}

	} else if (strcmp(argv[optind], "refresh") == 0) {
		++optind;

		if (optind >= argc)
			usage();

		if ((err = scf_walk_fmri(h, argc - optind, argv + optind, 0,
		    set_fmri_action, (void *)SCF_PROPERTY_REFRESH,
		    &exit_status, uu_warn)) != 0) {
			uu_warn(gettext("failed to iterate over "
			    "instances: %s\n"), scf_strerror(scf_error()));
			exit_status = UU_EXIT_FATAL;
		}

	} else if (strcmp(argv[optind], "mark") == 0) {
		int flags = 0;
		scf_walk_callback callback;

		++optind;

		while ((o = getopt(argc, argv, "It")) != -1) {
			if (o == 'I')
				flags |= MARK_IMMEDIATE;
			else if (o == 't')
				flags |= MARK_TEMPORARY;
			else if (o == '?')
				usage();
			else {
				assert(0);
				abort();
			}
		}

		if (argc - optind < 2)
			usage();

		if (strcmp(argv[optind], "degraded") == 0) {
			if (flags & MARK_TEMPORARY)
				uu_xdie(UU_EXIT_USAGE, gettext("-t may not be "
				    "used with degraded.\n"));
			callback = force_degraded;

		} else if (strcmp(argv[optind], "maintenance") == 0) {
			callback = force_maintenance;
		} else {
			usage();
		}

		if ((err = scf_walk_fmri(h, argc - optind - 1,
		    argv + optind + 1, 0, callback, NULL, &exit_status,
		    uu_warn)) != 0) {
			uu_warn(gettext("failed to iterate over "
			    "instances: %s\n"),
			    scf_strerror(err));
			exit_status = UU_EXIT_FATAL;
		}

	} else if (strcmp(argv[optind], "clear") == 0) {
		++optind;

		if (optind >= argc)
			usage();

		if ((err = scf_walk_fmri(h, argc - optind, argv + optind, 0,
		    clear_instance, NULL, &exit_status, uu_warn)) != 0) {
			uu_warn(gettext("failed to iterate over "
			    "instances: %s\n"), scf_strerror(err));
			exit_status = UU_EXIT_FATAL;
		}

	} else if (strcmp(argv[optind], "milestone") == 0) {
		boolean_t temporary = B_TRUE;
		const char *milestone;

		++optind;

		while ((o = getopt(argc, argv, "d")) != -1) {
			if (o == 'd')
				temporary = B_FALSE;
			else if (o == '?')
				usage_milestone();
			else {
				assert(0);
				abort();
			}
		}

		if (optind >= argc)
			usage_milestone();

		milestone = validate_milestone(argv[optind]);

		set_milestone(milestone, temporary);
	} else if (strcmp(argv[optind], "_smf_backup") == 0) {
		const char *reason = NULL;

		++optind;

		if (optind != argc - 1)
			usage();

		if ((err = _scf_request_backup(h, argv[optind])) !=
		    SCF_SUCCESS) {
			switch (scf_error()) {
			case SCF_ERROR_NOT_BOUND:
			case SCF_ERROR_CONNECTION_BROKEN:
			case SCF_ERROR_BACKEND_READONLY:
				scfdie();
				break;

			case SCF_ERROR_PERMISSION_DENIED:
			case SCF_ERROR_INVALID_ARGUMENT:
				reason = scf_strerror(scf_error());
				break;

			case SCF_ERROR_INTERNAL:
				reason =
				    "unknown error (see console for details)";
				break;
			}

			uu_warn("failed to backup repository: %s\n", reason);
			exit_status = UU_EXIT_FATAL;
		}
	} else if (strcmp(argv[optind], "_smf_repository_switch") == 0) {
		const char *reason = NULL;

		++optind;

		/*
		 * Check argument and setup scf_switch structure
		 */
		if (optind != argc - 1)
			exit(1);

		if (strcmp(argv[optind], "fast") == 0) {
			sw_back = 0;
		} else if (strcmp(argv[optind], "perm") == 0) {
			sw_back = 1;
		} else {
			exit(UU_EXIT_USAGE);
		}

		/*
		 * Call into switch primitive
		 */
		if ((err = _scf_repository_switch(h, sw_back)) !=
		    SCF_SUCCESS) {
			/*
			 * Retrieve per thread SCF error code
			 */
			switch (scf_error()) {
			case SCF_ERROR_NOT_BOUND:
				abort();
				/* NOTREACHED */

			case SCF_ERROR_CONNECTION_BROKEN:
			case SCF_ERROR_BACKEND_READONLY:
				scfdie();
				/* NOTREACHED */

			case SCF_ERROR_PERMISSION_DENIED:
			case SCF_ERROR_INVALID_ARGUMENT:
				reason = scf_strerror(scf_error());
				break;

			case SCF_ERROR_INTERNAL:
				reason = "File operation error: (see console)";
				break;

			default:
				abort();
				/* NOTREACHED */
			}

			uu_warn("failed to switch repository: %s\n", reason);
			exit_status = UU_EXIT_FATAL;
		}
	} else {
		usage();
	}

	if (scf_handle_unbind(h) == -1)
		scfdie();
	scf_handle_destroy(h);

	return (exit_status);
}