xref: /titanic_51/usr/src/cmd/svc/startd/graph.c (revision a778b211500c8b2b47a35aa015cd89d5548a8ad8)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * graph.c - master restarter graph engine
30  *
31  *   The graph engine keeps a dependency graph of all service instances on the
32  *   system, as recorded in the repository.  It decides when services should
33  *   be brought up or down based on service states and dependencies and sends
34  *   commands to restarters to effect any changes.  It also executes
35  *   administrator commands sent by svcadm via the repository.
36  *
37  *   The graph is stored in uu_list_t *dgraph and its vertices are
38  *   graph_vertex_t's, each of which has a name and an integer id unique to
39  *   its name (see dict.c).  A vertex's type attribute designates the type
40  *   of object it represents: GVT_INST for service instances, GVT_SVC for
41  *   service objects (since service instances may depend on another service,
42  *   rather than service instance), GVT_FILE for files (which services may
43  *   depend on), and GVT_GROUP for dependencies on multiple objects.  GVT_GROUP
44  *   vertices are necessary because dependency lists may have particular
45  *   grouping types (require any, require all, optional, or exclude) and
46  *   event-propagation characteristics.
47  *
48  *   The initial graph is built by libscf_populate_graph() invoking
49  *   dgraph_add_instance() for each instance in the repository.  The function
50  *   adds a GVT_SVC vertex for the service if one does not already exist, adds
51  *   a GVT_INST vertex named by the FMRI of the instance, and sets up the edges.
52  *   The resulting web of vertices & edges associated with an instance's vertex
53  *   includes
54  *
55  *     - an edge from the GVT_SVC vertex for the instance's service
56  *
57  *     - an edge to the GVT_INST vertex of the instance's resarter, if its
58  *       restarter is not svc.startd
59  *
60  *     - edges from other GVT_INST vertices if the instance is a restarter
61  *
62  *     - for each dependency property group in the instance's "running"
63  *       snapshot, an edge to a GVT_GROUP vertex named by the FMRI of the
64  *       instance and the name of the property group
65  *
66  *     - for each value of the "entities" property in each dependency property
67  *       group, an edge from the corresponding GVT_GROUP vertex to a
68  *       GVT_INST, GVT_SVC, or GVT_FILE vertex
69  *
70  *     - edges from GVT_GROUP vertices for each dependent instance
71  *
72  *   After the edges are set up the vertex's GV_CONFIGURED flag is set.  If
73  *   there are problems, or if a service is mentioned in a dependency but does
74  *   not exist in the repository, the GV_CONFIGURED flag will be clear.
75  *
76  *   The graph and all of its vertices are protected by the dgraph_lock mutex.
77  *   See restarter.c for more information.
78  *
79  *   The properties of an instance fall into two classes: immediate and
80  *   snapshotted.  Immediate properties should have an immediate effect when
81  *   changed.  Snapshotted properties should be read from a snapshot, so they
82  *   only change when the snapshot changes.  The immediate properties used by
83  *   the graph engine are general/enabled, general/restarter, and the properties
84  *   in the restarter_actions property group.  Since they are immediate, they
85  *   are not read out of a snapshot.  The snapshotted properties used by the
86  *   graph engine are those in the property groups with type "dependency" and
87  *   are read out of the "running" snapshot.  The "running" snapshot is created
88  *   by the the graph engine as soon as possible, and it is updated, along with
89  *   in-core copies of the data (dependency information for the graph engine) on
90  *   receipt of the refresh command from svcadm.  In addition, the graph engine
91  *   updates the "start" snapshot from the "running" snapshot whenever a service
92  *   comes online.
93  */
94 
95 #include <sys/uadmin.h>
96 #include <sys/wait.h>
97 
98 #include <assert.h>
99 #include <errno.h>
100 #include <fcntl.h>
101 #include <libscf.h>
102 #include <libscf_priv.h>
103 #include <libuutil.h>
104 #include <locale.h>
105 #include <poll.h>
106 #include <pthread.h>
107 #include <signal.h>
108 #include <stddef.h>
109 #include <stdio.h>
110 #include <stdlib.h>
111 #include <string.h>
112 #include <strings.h>
113 #include <sys/statvfs.h>
114 #include <sys/uadmin.h>
115 #include <zone.h>
116 
117 #include "startd.h"
118 #include "protocol.h"
119 
120 
121 #define	MILESTONE_NONE	((graph_vertex_t *)1)
122 
123 #define	CONSOLE_LOGIN_FMRI	"svc:/system/console-login:default"
124 #define	FS_MINIMAL_FMRI		"svc:/system/filesystem/minimal:default"
125 
126 #define	VERTEX_REMOVED	0	/* vertex has been freed  */
127 #define	VERTEX_INUSE	1	/* vertex is still in use */
128 
129 /*
130  * Services in these states are not considered 'down' by the
131  * milestone/shutdown code.
132  */
133 #define	up_state(state)	((state) == RESTARTER_STATE_ONLINE || \
134 	(state) == RESTARTER_STATE_DEGRADED || \
135 	(state) == RESTARTER_STATE_OFFLINE)
136 
137 static uu_list_pool_t *graph_edge_pool, *graph_vertex_pool;
138 static uu_list_t *dgraph;
139 static pthread_mutex_t dgraph_lock;
140 
141 /*
142  * milestone indicates the current subgraph.  When NULL, it is the entire
143  * graph.  When MILESTONE_NONE, it is the empty graph.  Otherwise, it is all
144  * services on which the target vertex depends.
145  */
146 static graph_vertex_t *milestone = NULL;
147 static boolean_t initial_milestone_set = B_FALSE;
148 static pthread_cond_t initial_milestone_cv = PTHREAD_COND_INITIALIZER;
149 
150 /* protected by dgraph_lock */
151 static boolean_t sulogin_thread_running = B_FALSE;
152 static boolean_t sulogin_running = B_FALSE;
153 static boolean_t console_login_ready = B_FALSE;
154 
155 /* Number of services to come down to complete milestone transition. */
156 static uint_t non_subgraph_svcs;
157 
158 /*
159  * These variables indicate what should be done when we reach the milestone
160  * target milestone, i.e., when non_subgraph_svcs == 0.  They are acted upon in
161  * dgraph_set_instance_state().
162  */
163 static int halting = -1;
164 static boolean_t go_single_user_mode = B_FALSE;
165 static boolean_t go_to_level1 = B_FALSE;
166 
167 /*
168  * This tracks the legacy runlevel to ensure we signal init and manage
169  * utmpx entries correctly.
170  */
171 static char current_runlevel = '\0';
172 
173 /* Number of single user threads currently running */
174 static pthread_mutex_t single_user_thread_lock;
175 static int single_user_thread_count = 0;
176 
177 /* Statistics for dependency cycle-checking */
178 static u_longlong_t dep_inserts = 0;
179 static u_longlong_t dep_cycle_ns = 0;
180 static u_longlong_t dep_insert_ns = 0;
181 
182 
183 static const char * const emsg_invalid_restarter =
184 	"Transitioning %s to maintenance, restarter FMRI %s is invalid "
185 	"(see 'svcs -xv' for details).\n";
186 static const char * const console_login_fmri = CONSOLE_LOGIN_FMRI;
187 static const char * const single_user_fmri = SCF_MILESTONE_SINGLE_USER;
188 static const char * const multi_user_fmri = SCF_MILESTONE_MULTI_USER;
189 static const char * const multi_user_svr_fmri = SCF_MILESTONE_MULTI_USER_SERVER;
190 
191 
192 /*
193  * These services define the system being "up".  If none of them can come
194  * online, then we will run sulogin on the console.  Note that the install ones
195  * are for the miniroot and when installing CDs after the first.  can_come_up()
196  * does the decision making, and an sulogin_thread() runs sulogin, which can be
197  * started by dgraph_set_instance_state() or single_user_thread().
198  *
199  * NOTE: can_come_up() relies on SCF_MILESTONE_SINGLE_USER being the first
200  * entry, which is only used when booting_to_single_user (boot -s) is set.
201  * This is because when doing a "boot -s", sulogin is started from specials.c
202  * after milestone/single-user comes online, for backwards compatibility.
203  * In this case, SCF_MILESTONE_SINGLE_USER needs to be part of up_svcs
204  * to ensure sulogin will be spawned if milestone/single-user cannot be reached.
205  */
206 static const char * const up_svcs[] = {
207 	SCF_MILESTONE_SINGLE_USER,
208 	CONSOLE_LOGIN_FMRI,
209 	"svc:/system/install-setup:default",
210 	"svc:/system/install:default",
211 	NULL
212 };
213 
214 /* This array must have an element for each non-NULL element of up_svcs[]. */
215 static graph_vertex_t *up_svcs_p[] = { NULL, NULL, NULL, NULL };
216 
217 /* These are for seed repository magic.  See can_come_up(). */
218 static const char * const manifest_import =
219 	"svc:/system/manifest-import:default";
220 static graph_vertex_t *manifest_import_p = NULL;
221 
222 
223 static char target_milestone_as_runlevel(void);
224 static void graph_runlevel_changed(char rl, int online);
225 static int dgraph_set_milestone(const char *, scf_handle_t *, boolean_t);
226 static boolean_t should_be_in_subgraph(graph_vertex_t *v);
227 
228 /*
229  * graph_vertex_compare()
230  *	This function can compare either int *id or * graph_vertex_t *gv
231  *	values, as the vertex id is always the first element of a
232  *	graph_vertex structure.
233  */
234 /* ARGSUSED */
235 static int
236 graph_vertex_compare(const void *lc_arg, const void *rc_arg, void *private)
237 {
238 	int lc_id = ((const graph_vertex_t *)lc_arg)->gv_id;
239 	int rc_id = *(int *)rc_arg;
240 
241 	if (lc_id > rc_id)
242 		return (1);
243 	if (lc_id < rc_id)
244 		return (-1);
245 	return (0);
246 }
247 
248 void
249 graph_init()
250 {
251 	graph_edge_pool = startd_list_pool_create("graph_edges",
252 	    sizeof (graph_edge_t), offsetof(graph_edge_t, ge_link), NULL,
253 	    UU_LIST_POOL_DEBUG);
254 	assert(graph_edge_pool != NULL);
255 
256 	graph_vertex_pool = startd_list_pool_create("graph_vertices",
257 	    sizeof (graph_vertex_t), offsetof(graph_vertex_t, gv_link),
258 	    graph_vertex_compare, UU_LIST_POOL_DEBUG);
259 	assert(graph_vertex_pool != NULL);
260 
261 	(void) pthread_mutex_init(&dgraph_lock, &mutex_attrs);
262 	(void) pthread_mutex_init(&single_user_thread_lock, &mutex_attrs);
263 	dgraph = startd_list_create(graph_vertex_pool, NULL, UU_LIST_SORTED);
264 	assert(dgraph != NULL);
265 
266 	if (!st->st_initial)
267 		current_runlevel = utmpx_get_runlevel();
268 
269 	log_framework(LOG_DEBUG, "Initialized graph\n");
270 }
271 
272 static graph_vertex_t *
273 vertex_get_by_name(const char *name)
274 {
275 	int id;
276 
277 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
278 
279 	id = dict_lookup_byname(name);
280 	if (id == -1)
281 		return (NULL);
282 
283 	return (uu_list_find(dgraph, &id, NULL, NULL));
284 }
285 
286 static graph_vertex_t *
287 vertex_get_by_id(int id)
288 {
289 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
290 
291 	if (id == -1)
292 		return (NULL);
293 
294 	return (uu_list_find(dgraph, &id, NULL, NULL));
295 }
296 
297 /*
298  * Creates a new vertex with the given name, adds it to the graph, and returns
299  * a pointer to it.  The graph lock must be held by this thread on entry.
300  */
301 static graph_vertex_t *
302 graph_add_vertex(const char *name)
303 {
304 	int id;
305 	graph_vertex_t *v;
306 	void *p;
307 	uu_list_index_t idx;
308 
309 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
310 
311 	id = dict_insert(name);
312 
313 	v = startd_zalloc(sizeof (*v));
314 
315 	v->gv_id = id;
316 
317 	v->gv_name = startd_alloc(strlen(name) + 1);
318 	(void) strcpy(v->gv_name, name);
319 
320 	v->gv_dependencies = startd_list_create(graph_edge_pool, v, 0);
321 	v->gv_dependents = startd_list_create(graph_edge_pool, v, 0);
322 
323 	p = uu_list_find(dgraph, &id, NULL, &idx);
324 	assert(p == NULL);
325 
326 	uu_list_node_init(v, &v->gv_link, graph_vertex_pool);
327 	uu_list_insert(dgraph, v, idx);
328 
329 	return (v);
330 }
331 
332 /*
333  * Removes v from the graph and frees it.  The graph should be locked by this
334  * thread, and v should have no edges associated with it.
335  */
336 static void
337 graph_remove_vertex(graph_vertex_t *v)
338 {
339 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
340 
341 	assert(uu_list_numnodes(v->gv_dependencies) == 0);
342 	assert(uu_list_numnodes(v->gv_dependents) == 0);
343 	assert(v->gv_refs == 0);
344 
345 	startd_free(v->gv_name, strlen(v->gv_name) + 1);
346 	uu_list_destroy(v->gv_dependencies);
347 	uu_list_destroy(v->gv_dependents);
348 	uu_list_remove(dgraph, v);
349 
350 	startd_free(v, sizeof (graph_vertex_t));
351 }
352 
353 static void
354 graph_add_edge(graph_vertex_t *fv, graph_vertex_t *tv)
355 {
356 	graph_edge_t *e, *re;
357 	int r;
358 
359 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
360 
361 	e = startd_alloc(sizeof (graph_edge_t));
362 	re = startd_alloc(sizeof (graph_edge_t));
363 
364 	e->ge_parent = fv;
365 	e->ge_vertex = tv;
366 
367 	re->ge_parent = tv;
368 	re->ge_vertex = fv;
369 
370 	uu_list_node_init(e, &e->ge_link, graph_edge_pool);
371 	r = uu_list_insert_before(fv->gv_dependencies, NULL, e);
372 	assert(r == 0);
373 
374 	uu_list_node_init(re, &re->ge_link, graph_edge_pool);
375 	r = uu_list_insert_before(tv->gv_dependents, NULL, re);
376 	assert(r == 0);
377 }
378 
379 static void
380 graph_remove_edge(graph_vertex_t *v, graph_vertex_t *dv)
381 {
382 	graph_edge_t *e;
383 
384 	for (e = uu_list_first(v->gv_dependencies);
385 	    e != NULL;
386 	    e = uu_list_next(v->gv_dependencies, e)) {
387 		if (e->ge_vertex == dv) {
388 			uu_list_remove(v->gv_dependencies, e);
389 			startd_free(e, sizeof (graph_edge_t));
390 			break;
391 		}
392 	}
393 
394 	for (e = uu_list_first(dv->gv_dependents);
395 	    e != NULL;
396 	    e = uu_list_next(dv->gv_dependents, e)) {
397 		if (e->ge_vertex == v) {
398 			uu_list_remove(dv->gv_dependents, e);
399 			startd_free(e, sizeof (graph_edge_t));
400 			break;
401 		}
402 	}
403 }
404 
405 static void
406 remove_inst_vertex(graph_vertex_t *v)
407 {
408 	graph_edge_t *e;
409 	graph_vertex_t *sv;
410 	int i;
411 
412 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
413 	assert(uu_list_numnodes(v->gv_dependents) == 1);
414 	assert(uu_list_numnodes(v->gv_dependencies) == 0);
415 	assert(v->gv_refs == 0);
416 	assert((v->gv_flags & GV_CONFIGURED) == 0);
417 
418 	e = uu_list_first(v->gv_dependents);
419 	sv = e->ge_vertex;
420 	graph_remove_edge(sv, v);
421 
422 	for (i = 0; up_svcs[i] != NULL; ++i) {
423 		if (up_svcs_p[i] == v)
424 			up_svcs_p[i] = NULL;
425 	}
426 
427 	if (manifest_import_p == v)
428 		manifest_import_p = NULL;
429 
430 	graph_remove_vertex(v);
431 
432 	if (uu_list_numnodes(sv->gv_dependencies) == 0 &&
433 	    uu_list_numnodes(sv->gv_dependents) == 0 &&
434 	    sv->gv_refs == 0)
435 		graph_remove_vertex(sv);
436 }
437 
438 static void
439 graph_walk_dependents(graph_vertex_t *v, void (*func)(graph_vertex_t *, void *),
440     void *arg)
441 {
442 	graph_edge_t *e;
443 
444 	for (e = uu_list_first(v->gv_dependents);
445 	    e != NULL;
446 	    e = uu_list_next(v->gv_dependents, e))
447 		func(e->ge_vertex, arg);
448 }
449 
450 static void
451 graph_walk_dependencies(graph_vertex_t *v, void (*func)(graph_vertex_t *,
452 	void *), void *arg)
453 {
454 	graph_edge_t *e;
455 
456 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
457 
458 	for (e = uu_list_first(v->gv_dependencies);
459 	    e != NULL;
460 	    e = uu_list_next(v->gv_dependencies, e)) {
461 
462 		func(e->ge_vertex, arg);
463 	}
464 }
465 
466 /*
467  * Generic graph walking function.
468  *
469  * Given a vertex, this function will walk either dependencies
470  * (WALK_DEPENDENCIES) or dependents (WALK_DEPENDENTS) of a vertex recursively
471  * for the entire graph.  It will avoid cycles and never visit the same vertex
472  * twice.
473  *
474  * We avoid traversing exclusion dependencies, because they are allowed to
475  * create cycles in the graph.  When propagating satisfiability, there is no
476  * need to walk exclusion dependencies because exclude_all_satisfied() doesn't
477  * test for satisfiability.
478  *
479  * The walker takes two callbacks.  The first is called before examining the
480  * dependents of each vertex.  The second is called on each vertex after
481  * examining its dependents.  This allows is_path_to() to construct a path only
482  * after the target vertex has been found.
483  */
484 typedef enum {
485 	WALK_DEPENDENTS,
486 	WALK_DEPENDENCIES
487 } graph_walk_dir_t;
488 
489 typedef int (*graph_walk_cb_t)(graph_vertex_t *, void *);
490 
491 typedef struct graph_walk_info {
492 	graph_walk_dir_t 	gi_dir;
493 	uchar_t			*gi_visited;	/* vertex bitmap */
494 	int			(*gi_pre)(graph_vertex_t *, void *);
495 	void			(*gi_post)(graph_vertex_t *, void *);
496 	void			*gi_arg;	/* callback arg */
497 	int			gi_ret;		/* return value */
498 } graph_walk_info_t;
499 
500 static int
501 graph_walk_recurse(graph_edge_t *e, graph_walk_info_t *gip)
502 {
503 	uu_list_t *list;
504 	int r;
505 	graph_vertex_t *v = e->ge_vertex;
506 	int i;
507 	uint_t b;
508 
509 	i = v->gv_id / 8;
510 	b = 1 << (v->gv_id % 8);
511 
512 	/*
513 	 * Check to see if we've visited this vertex already.
514 	 */
515 	if (gip->gi_visited[i] & b)
516 		return (UU_WALK_NEXT);
517 
518 	gip->gi_visited[i] |= b;
519 
520 	/*
521 	 * Don't follow exclusions.
522 	 */
523 	if (v->gv_type == GVT_GROUP && v->gv_depgroup == DEPGRP_EXCLUDE_ALL)
524 		return (UU_WALK_NEXT);
525 
526 	/*
527 	 * Call pre-visit callback.  If this doesn't terminate the walk,
528 	 * continue search.
529 	 */
530 	if ((gip->gi_ret = gip->gi_pre(v, gip->gi_arg)) == UU_WALK_NEXT) {
531 		/*
532 		 * Recurse using appropriate list.
533 		 */
534 		if (gip->gi_dir == WALK_DEPENDENTS)
535 			list = v->gv_dependents;
536 		else
537 			list = v->gv_dependencies;
538 
539 		r = uu_list_walk(list, (uu_walk_fn_t *)graph_walk_recurse,
540 		    gip, 0);
541 		assert(r == 0);
542 	}
543 
544 	/*
545 	 * Callbacks must return either UU_WALK_NEXT or UU_WALK_DONE.
546 	 */
547 	assert(gip->gi_ret == UU_WALK_NEXT || gip->gi_ret == UU_WALK_DONE);
548 
549 	/*
550 	 * If given a post-callback, call the function for every vertex.
551 	 */
552 	if (gip->gi_post != NULL)
553 		(void) gip->gi_post(v, gip->gi_arg);
554 
555 	/*
556 	 * Preserve the callback's return value.  If the callback returns
557 	 * UU_WALK_DONE, then we propagate that to the caller in order to
558 	 * terminate the walk.
559 	 */
560 	return (gip->gi_ret);
561 }
562 
563 static void
564 graph_walk(graph_vertex_t *v, graph_walk_dir_t dir,
565     int (*pre)(graph_vertex_t *, void *),
566     void (*post)(graph_vertex_t *, void *), void *arg)
567 {
568 	graph_walk_info_t gi;
569 	graph_edge_t fake;
570 	size_t sz = dictionary->dict_new_id / 8 + 1;
571 
572 	gi.gi_visited = startd_zalloc(sz);
573 	gi.gi_pre = pre;
574 	gi.gi_post = post;
575 	gi.gi_arg = arg;
576 	gi.gi_dir = dir;
577 	gi.gi_ret = 0;
578 
579 	/*
580 	 * Fake up an edge for the first iteration
581 	 */
582 	fake.ge_vertex = v;
583 	(void) graph_walk_recurse(&fake, &gi);
584 
585 	startd_free(gi.gi_visited, sz);
586 }
587 
588 typedef struct child_search {
589 	int	id;		/* id of vertex to look for */
590 	uint_t	depth;		/* recursion depth */
591 	/*
592 	 * While the vertex is not found, path is NULL.  After the search, if
593 	 * the vertex was found then path should point to a -1-terminated
594 	 * array of vertex id's which constitute the path to the vertex.
595 	 */
596 	int	*path;
597 } child_search_t;
598 
599 static int
600 child_pre(graph_vertex_t *v, void *arg)
601 {
602 	child_search_t *cs = arg;
603 
604 	cs->depth++;
605 
606 	if (v->gv_id == cs->id) {
607 		cs->path = startd_alloc((cs->depth + 1) * sizeof (int));
608 		cs->path[cs->depth] = -1;
609 		return (UU_WALK_DONE);
610 	}
611 
612 	return (UU_WALK_NEXT);
613 }
614 
615 static void
616 child_post(graph_vertex_t *v, void *arg)
617 {
618 	child_search_t *cs = arg;
619 
620 	cs->depth--;
621 
622 	if (cs->path != NULL)
623 		cs->path[cs->depth] = v->gv_id;
624 }
625 
626 /*
627  * Look for a path from from to to.  If one exists, returns a pointer to
628  * a NULL-terminated array of pointers to the vertices along the path.  If
629  * there is no path, returns NULL.
630  */
631 static int *
632 is_path_to(graph_vertex_t *from, graph_vertex_t *to)
633 {
634 	child_search_t cs;
635 
636 	cs.id = to->gv_id;
637 	cs.depth = 0;
638 	cs.path = NULL;
639 
640 	graph_walk(from, WALK_DEPENDENCIES, child_pre, child_post, &cs);
641 
642 	return (cs.path);
643 }
644 
645 /*
646  * Given an array of int's as returned by is_path_to, allocates a string of
647  * their names joined by newlines.  Returns the size of the allocated buffer
648  * in *sz and frees path.
649  */
650 static void
651 path_to_str(int *path, char **cpp, size_t *sz)
652 {
653 	int i;
654 	graph_vertex_t *v;
655 	size_t allocd, new_allocd;
656 	char *new, *name;
657 
658 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
659 	assert(path[0] != -1);
660 
661 	allocd = 1;
662 	*cpp = startd_alloc(1);
663 	(*cpp)[0] = '\0';
664 
665 	for (i = 0; path[i] != -1; ++i) {
666 		name = NULL;
667 
668 		v = vertex_get_by_id(path[i]);
669 
670 		if (v == NULL)
671 			name = "<deleted>";
672 		else if (v->gv_type == GVT_INST || v->gv_type == GVT_SVC)
673 			name = v->gv_name;
674 
675 		if (name != NULL) {
676 			new_allocd = allocd + strlen(name) + 1;
677 			new = startd_alloc(new_allocd);
678 			(void) strcpy(new, *cpp);
679 			(void) strcat(new, name);
680 			(void) strcat(new, "\n");
681 
682 			startd_free(*cpp, allocd);
683 
684 			*cpp = new;
685 			allocd = new_allocd;
686 		}
687 	}
688 
689 	startd_free(path, sizeof (int) * (i + 1));
690 
691 	*sz = allocd;
692 }
693 
694 
695 /*
696  * This function along with run_sulogin() implements an exclusion relationship
697  * between system/console-login and sulogin.  run_sulogin() will fail if
698  * system/console-login is online, and the graph engine should call
699  * graph_clogin_start() to bring system/console-login online, which defers the
700  * start if sulogin is running.
701  */
702 static void
703 graph_clogin_start(graph_vertex_t *v)
704 {
705 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
706 
707 	if (sulogin_running)
708 		console_login_ready = B_TRUE;
709 	else
710 		vertex_send_event(v, RESTARTER_EVENT_TYPE_START);
711 }
712 
713 static void
714 graph_su_start(graph_vertex_t *v)
715 {
716 	/*
717 	 * /etc/inittab used to have the initial /sbin/rcS as a 'sysinit'
718 	 * entry with a runlevel of 'S', before jumping to the final
719 	 * target runlevel (as set in initdefault).  We mimic that legacy
720 	 * behavior here.
721 	 */
722 	utmpx_set_runlevel('S', '0', B_FALSE);
723 	vertex_send_event(v, RESTARTER_EVENT_TYPE_START);
724 }
725 
726 static void
727 graph_post_su_online(void)
728 {
729 	graph_runlevel_changed('S', 1);
730 }
731 
732 static void
733 graph_post_su_disable(void)
734 {
735 	graph_runlevel_changed('S', 0);
736 }
737 
738 static void
739 graph_post_mu_online(void)
740 {
741 	graph_runlevel_changed('2', 1);
742 }
743 
744 static void
745 graph_post_mu_disable(void)
746 {
747 	graph_runlevel_changed('2', 0);
748 }
749 
750 static void
751 graph_post_mus_online(void)
752 {
753 	graph_runlevel_changed('3', 1);
754 }
755 
756 static void
757 graph_post_mus_disable(void)
758 {
759 	graph_runlevel_changed('3', 0);
760 }
761 
762 static struct special_vertex_info {
763 	const char	*name;
764 	void		(*start_f)(graph_vertex_t *);
765 	void		(*post_online_f)(void);
766 	void		(*post_disable_f)(void);
767 } special_vertices[] = {
768 	{ CONSOLE_LOGIN_FMRI, graph_clogin_start, NULL, NULL },
769 	{ SCF_MILESTONE_SINGLE_USER, graph_su_start,
770 	    graph_post_su_online, graph_post_su_disable },
771 	{ SCF_MILESTONE_MULTI_USER, NULL,
772 	    graph_post_mu_online, graph_post_mu_disable },
773 	{ SCF_MILESTONE_MULTI_USER_SERVER, NULL,
774 	    graph_post_mus_online, graph_post_mus_disable },
775 	{ NULL },
776 };
777 
778 
779 void
780 vertex_send_event(graph_vertex_t *v, restarter_event_type_t e)
781 {
782 	switch (e) {
783 	case RESTARTER_EVENT_TYPE_ADD_INSTANCE:
784 		assert(v->gv_state == RESTARTER_STATE_UNINIT);
785 
786 		MUTEX_LOCK(&st->st_load_lock);
787 		st->st_load_instances++;
788 		MUTEX_UNLOCK(&st->st_load_lock);
789 		break;
790 
791 	case RESTARTER_EVENT_TYPE_ENABLE:
792 		log_framework(LOG_DEBUG, "Enabling %s.\n", v->gv_name);
793 		assert(v->gv_state == RESTARTER_STATE_UNINIT ||
794 		    v->gv_state == RESTARTER_STATE_DISABLED ||
795 		    v->gv_state == RESTARTER_STATE_MAINT);
796 		break;
797 
798 	case RESTARTER_EVENT_TYPE_DISABLE:
799 	case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
800 		log_framework(LOG_DEBUG, "Disabling %s.\n", v->gv_name);
801 		assert(v->gv_state != RESTARTER_STATE_DISABLED);
802 		break;
803 
804 	case RESTARTER_EVENT_TYPE_STOP:
805 		log_framework(LOG_DEBUG, "Stopping %s.\n", v->gv_name);
806 		assert(v->gv_state == RESTARTER_STATE_DEGRADED ||
807 		    v->gv_state == RESTARTER_STATE_ONLINE);
808 		break;
809 
810 	case RESTARTER_EVENT_TYPE_START:
811 		log_framework(LOG_DEBUG, "Starting %s.\n", v->gv_name);
812 		assert(v->gv_state == RESTARTER_STATE_OFFLINE);
813 		break;
814 
815 	case RESTARTER_EVENT_TYPE_REMOVE_INSTANCE:
816 	case RESTARTER_EVENT_TYPE_ADMIN_DEGRADED:
817 	case RESTARTER_EVENT_TYPE_ADMIN_REFRESH:
818 	case RESTARTER_EVENT_TYPE_ADMIN_RESTART:
819 	case RESTARTER_EVENT_TYPE_ADMIN_MAINT_OFF:
820 	case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
821 	case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON_IMMEDIATE:
822 	case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
823 	case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
824 		break;
825 
826 	default:
827 #ifndef NDEBUG
828 		uu_warn("%s:%d: Bad event %d.\n", __FILE__, __LINE__, e);
829 #endif
830 		abort();
831 	}
832 
833 	restarter_protocol_send_event(v->gv_name, v->gv_restarter_channel, e);
834 }
835 
836 static void
837 graph_unset_restarter(graph_vertex_t *v)
838 {
839 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
840 	assert(v->gv_flags & GV_CONFIGURED);
841 
842 	vertex_send_event(v, RESTARTER_EVENT_TYPE_REMOVE_INSTANCE);
843 
844 	if (v->gv_restarter_id != -1) {
845 		graph_vertex_t *rv;
846 
847 		rv = vertex_get_by_id(v->gv_restarter_id);
848 		graph_remove_edge(v, rv);
849 	}
850 
851 	v->gv_restarter_id = -1;
852 	v->gv_restarter_channel = NULL;
853 }
854 
855 /*
856  * Return VERTEX_REMOVED when the vertex passed in argument is deleted from the
857  * dgraph otherwise return VERTEX_INUSE.
858  */
859 static int
860 free_if_unrefed(graph_vertex_t *v)
861 {
862 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
863 
864 	if (v->gv_refs > 0)
865 		return (VERTEX_INUSE);
866 
867 	if (v->gv_type == GVT_SVC &&
868 	    uu_list_numnodes(v->gv_dependents) == 0 &&
869 	    uu_list_numnodes(v->gv_dependencies) == 0) {
870 		graph_remove_vertex(v);
871 		return (VERTEX_REMOVED);
872 	} else if (v->gv_type == GVT_INST &&
873 	    (v->gv_flags & GV_CONFIGURED) == 0 &&
874 	    uu_list_numnodes(v->gv_dependents) == 1 &&
875 	    uu_list_numnodes(v->gv_dependencies) == 0) {
876 		remove_inst_vertex(v);
877 		return (VERTEX_REMOVED);
878 	}
879 
880 	return (VERTEX_INUSE);
881 }
882 
883 static void
884 delete_depgroup(graph_vertex_t *v)
885 {
886 	graph_edge_t *e;
887 	graph_vertex_t *dv;
888 
889 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
890 	assert(v->gv_type == GVT_GROUP);
891 	assert(uu_list_numnodes(v->gv_dependents) == 0);
892 
893 	while ((e = uu_list_first(v->gv_dependencies)) != NULL) {
894 		dv = e->ge_vertex;
895 
896 		graph_remove_edge(v, dv);
897 
898 		switch (dv->gv_type) {
899 		case GVT_INST:		/* instance dependency */
900 		case GVT_SVC:		/* service dependency */
901 			(void) free_if_unrefed(dv);
902 			break;
903 
904 		case GVT_FILE:		/* file dependency */
905 			assert(uu_list_numnodes(dv->gv_dependencies) == 0);
906 			if (uu_list_numnodes(dv->gv_dependents) == 0)
907 				graph_remove_vertex(dv);
908 			break;
909 
910 		default:
911 #ifndef NDEBUG
912 			uu_warn("%s:%d: Unexpected node type %d", __FILE__,
913 			    __LINE__, dv->gv_type);
914 #endif
915 			abort();
916 		}
917 	}
918 
919 	graph_remove_vertex(v);
920 }
921 
922 static int
923 delete_instance_deps_cb(graph_edge_t *e, void **ptrs)
924 {
925 	graph_vertex_t *v = ptrs[0];
926 	boolean_t delete_restarter_dep = (boolean_t)ptrs[1];
927 	graph_vertex_t *dv;
928 
929 	dv = e->ge_vertex;
930 
931 	/*
932 	 * We have four possibilities here:
933 	 *   - GVT_INST: restarter
934 	 *   - GVT_GROUP - GVT_INST: instance dependency
935 	 *   - GVT_GROUP - GVT_SVC - GV_INST: service dependency
936 	 *   - GVT_GROUP - GVT_FILE: file dependency
937 	 */
938 	switch (dv->gv_type) {
939 	case GVT_INST:	/* restarter */
940 		assert(dv->gv_id == v->gv_restarter_id);
941 		if (delete_restarter_dep)
942 			graph_remove_edge(v, dv);
943 		break;
944 
945 	case GVT_GROUP:	/* pg dependency */
946 		graph_remove_edge(v, dv);
947 		delete_depgroup(dv);
948 		break;
949 
950 	case GVT_FILE:
951 		/* These are currently not direct dependencies */
952 
953 	default:
954 #ifndef NDEBUG
955 		uu_warn("%s:%d: Bad vertex type %d.\n", __FILE__, __LINE__,
956 		    dv->gv_type);
957 #endif
958 		abort();
959 	}
960 
961 	return (UU_WALK_NEXT);
962 }
963 
964 static void
965 delete_instance_dependencies(graph_vertex_t *v, boolean_t delete_restarter_dep)
966 {
967 	void *ptrs[2];
968 	int r;
969 
970 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
971 	assert(v->gv_type == GVT_INST);
972 
973 	ptrs[0] = v;
974 	ptrs[1] = (void *)delete_restarter_dep;
975 
976 	r = uu_list_walk(v->gv_dependencies,
977 	    (uu_walk_fn_t *)delete_instance_deps_cb, &ptrs, UU_WALK_ROBUST);
978 	assert(r == 0);
979 }
980 
981 /*
982  * int graph_insert_vertex_unconfigured()
983  *   Insert a vertex without sending any restarter events. If the vertex
984  *   already exists or creation is successful, return a pointer to it in *vp.
985  *
986  *   If type is not GVT_GROUP, dt can remain unset.
987  *
988  *   Returns 0, EEXIST, or EINVAL if the arguments are invalid (i.e., fmri
989  *   doesn't agree with type, or type doesn't agree with dt).
990  */
991 static int
992 graph_insert_vertex_unconfigured(const char *fmri, gv_type_t type,
993     depgroup_type_t dt, restarter_error_t rt, graph_vertex_t **vp)
994 {
995 	int r;
996 	int i;
997 
998 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
999 
1000 	switch (type) {
1001 	case GVT_SVC:
1002 	case GVT_INST:
1003 		if (strncmp(fmri, "svc:", sizeof ("svc:") - 1) != 0)
1004 			return (EINVAL);
1005 		break;
1006 
1007 	case GVT_FILE:
1008 		if (strncmp(fmri, "file:", sizeof ("file:") - 1) != 0)
1009 			return (EINVAL);
1010 		break;
1011 
1012 	case GVT_GROUP:
1013 		if (dt <= 0 || rt < 0)
1014 			return (EINVAL);
1015 		break;
1016 
1017 	default:
1018 #ifndef NDEBUG
1019 		uu_warn("%s:%d: Unknown type %d.\n", __FILE__, __LINE__, type);
1020 #endif
1021 		abort();
1022 	}
1023 
1024 	*vp = vertex_get_by_name(fmri);
1025 	if (*vp != NULL)
1026 		return (EEXIST);
1027 
1028 	*vp = graph_add_vertex(fmri);
1029 
1030 	(*vp)->gv_type = type;
1031 	(*vp)->gv_depgroup = dt;
1032 	(*vp)->gv_restart = rt;
1033 
1034 	(*vp)->gv_flags = 0;
1035 	(*vp)->gv_state = RESTARTER_STATE_NONE;
1036 
1037 	for (i = 0; special_vertices[i].name != NULL; ++i) {
1038 		if (strcmp(fmri, special_vertices[i].name) == 0) {
1039 			(*vp)->gv_start_f = special_vertices[i].start_f;
1040 			(*vp)->gv_post_online_f =
1041 			    special_vertices[i].post_online_f;
1042 			(*vp)->gv_post_disable_f =
1043 			    special_vertices[i].post_disable_f;
1044 			break;
1045 		}
1046 	}
1047 
1048 	(*vp)->gv_restarter_id = -1;
1049 	(*vp)->gv_restarter_channel = 0;
1050 
1051 	if (type == GVT_INST) {
1052 		char *sfmri;
1053 		graph_vertex_t *sv;
1054 
1055 		sfmri = inst_fmri_to_svc_fmri(fmri);
1056 		sv = vertex_get_by_name(sfmri);
1057 		if (sv == NULL) {
1058 			r = graph_insert_vertex_unconfigured(sfmri, GVT_SVC, 0,
1059 			    0, &sv);
1060 			assert(r == 0);
1061 		}
1062 		startd_free(sfmri, max_scf_fmri_size);
1063 
1064 		graph_add_edge(sv, *vp);
1065 	}
1066 
1067 	/*
1068 	 * If this vertex is in the subgraph, mark it as so, for both
1069 	 * GVT_INST and GVT_SERVICE verteces.
1070 	 * A GVT_SERVICE vertex can only be in the subgraph if another instance
1071 	 * depends on it, in which case it's already been added to the graph
1072 	 * and marked as in the subgraph (by refresh_vertex()).  If a
1073 	 * GVT_SERVICE vertex was freshly added (by the code above), it means
1074 	 * that it has no dependents, and cannot be in the subgraph.
1075 	 * Regardless of this, we still check that gv_flags includes
1076 	 * GV_INSUBGRAPH in the event that future behavior causes the above
1077 	 * code to add a GVT_SERVICE vertex which should be in the subgraph.
1078 	 */
1079 
1080 	(*vp)->gv_flags |= (should_be_in_subgraph(*vp)? GV_INSUBGRAPH : 0);
1081 
1082 	return (0);
1083 }
1084 
1085 /*
1086  * Returns 0 on success or ELOOP if the dependency would create a cycle.
1087  */
1088 static int
1089 graph_insert_dependency(graph_vertex_t *fv, graph_vertex_t *tv, int **pathp)
1090 {
1091 	hrtime_t now;
1092 
1093 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
1094 
1095 	/* cycle detection */
1096 	now = gethrtime();
1097 
1098 	/* Don't follow exclusions. */
1099 	if (!(fv->gv_type == GVT_GROUP &&
1100 	    fv->gv_depgroup == DEPGRP_EXCLUDE_ALL)) {
1101 		*pathp = is_path_to(tv, fv);
1102 		if (*pathp)
1103 			return (ELOOP);
1104 	}
1105 
1106 	dep_cycle_ns += gethrtime() - now;
1107 	++dep_inserts;
1108 	now = gethrtime();
1109 
1110 	graph_add_edge(fv, tv);
1111 
1112 	dep_insert_ns += gethrtime() - now;
1113 
1114 	/* Check if the dependency adds the "to" vertex to the subgraph */
1115 	tv->gv_flags |= (should_be_in_subgraph(tv) ? GV_INSUBGRAPH : 0);
1116 
1117 	return (0);
1118 }
1119 
1120 static int
1121 inst_running(graph_vertex_t *v)
1122 {
1123 	assert(v->gv_type == GVT_INST);
1124 
1125 	if (v->gv_state == RESTARTER_STATE_ONLINE ||
1126 	    v->gv_state == RESTARTER_STATE_DEGRADED)
1127 		return (1);
1128 
1129 	return (0);
1130 }
1131 
1132 /*
1133  * The dependency evaluation functions return
1134  *   1 - dependency satisfied
1135  *   0 - dependency unsatisfied
1136  *   -1 - dependency unsatisfiable (without administrator intervention)
1137  *
1138  * The functions also take a boolean satbility argument.  When true, the
1139  * functions may recurse in order to determine satisfiability.
1140  */
1141 static int require_any_satisfied(graph_vertex_t *, boolean_t);
1142 static int dependency_satisfied(graph_vertex_t *, boolean_t);
1143 
1144 /*
1145  * A require_all dependency is unsatisfied if any elements are unsatisfied.  It
1146  * is unsatisfiable if any elements are unsatisfiable.
1147  */
1148 static int
1149 require_all_satisfied(graph_vertex_t *groupv, boolean_t satbility)
1150 {
1151 	graph_edge_t *edge;
1152 	int i;
1153 	boolean_t any_unsatisfied;
1154 
1155 	if (uu_list_numnodes(groupv->gv_dependencies) == 0)
1156 		return (1);
1157 
1158 	any_unsatisfied = B_FALSE;
1159 
1160 	for (edge = uu_list_first(groupv->gv_dependencies);
1161 	    edge != NULL;
1162 	    edge = uu_list_next(groupv->gv_dependencies, edge)) {
1163 		i = dependency_satisfied(edge->ge_vertex, satbility);
1164 		if (i == 1)
1165 			continue;
1166 
1167 		log_framework2(LOG_DEBUG, DEBUG_DEPENDENCIES,
1168 		    "require_all(%s): %s is unsatisfi%s.\n", groupv->gv_name,
1169 		    edge->ge_vertex->gv_name, i == 0 ? "ed" : "able");
1170 
1171 		if (!satbility)
1172 			return (0);
1173 
1174 		if (i == -1)
1175 			return (-1);
1176 
1177 		any_unsatisfied = B_TRUE;
1178 	}
1179 
1180 	return (any_unsatisfied ? 0 : 1);
1181 }
1182 
1183 /*
1184  * A require_any dependency is satisfied if any element is satisfied.  It is
1185  * satisfiable if any element is satisfiable.
1186  */
1187 static int
1188 require_any_satisfied(graph_vertex_t *groupv, boolean_t satbility)
1189 {
1190 	graph_edge_t *edge;
1191 	int s;
1192 	boolean_t satisfiable;
1193 
1194 	if (uu_list_numnodes(groupv->gv_dependencies) == 0)
1195 		return (1);
1196 
1197 	satisfiable = B_FALSE;
1198 
1199 	for (edge = uu_list_first(groupv->gv_dependencies);
1200 	    edge != NULL;
1201 	    edge = uu_list_next(groupv->gv_dependencies, edge)) {
1202 		s = dependency_satisfied(edge->ge_vertex, satbility);
1203 
1204 		if (s == 1)
1205 			return (1);
1206 
1207 		log_framework2(LOG_DEBUG, DEBUG_DEPENDENCIES,
1208 		    "require_any(%s): %s is unsatisfi%s.\n",
1209 		    groupv->gv_name, edge->ge_vertex->gv_name,
1210 		    s == 0 ? "ed" : "able");
1211 
1212 		if (satbility && s == 0)
1213 			satisfiable = B_TRUE;
1214 	}
1215 
1216 	return (!satbility || satisfiable ? 0 : -1);
1217 }
1218 
1219 /*
1220  * An optional_all dependency only considers elements which are configured,
1221  * enabled, and not in maintenance.  If any are unsatisfied, then the dependency
1222  * is unsatisfied.
1223  *
1224  * Offline dependencies which are waiting for a dependency to come online are
1225  * unsatisfied.  Offline dependences which cannot possibly come online
1226  * (unsatisfiable) are always considered satisfied.
1227  */
1228 static int
1229 optional_all_satisfied(graph_vertex_t *groupv, boolean_t satbility)
1230 {
1231 	graph_edge_t *edge;
1232 	graph_vertex_t *v;
1233 	boolean_t any_qualified;
1234 	boolean_t any_unsatisfied;
1235 	int i;
1236 
1237 	any_qualified = B_FALSE;
1238 	any_unsatisfied = B_FALSE;
1239 
1240 	for (edge = uu_list_first(groupv->gv_dependencies);
1241 	    edge != NULL;
1242 	    edge = uu_list_next(groupv->gv_dependencies, edge)) {
1243 		v = edge->ge_vertex;
1244 
1245 		switch (v->gv_type) {
1246 		case GVT_INST:
1247 			/* Skip missing or disabled instances */
1248 			if ((v->gv_flags & (GV_CONFIGURED | GV_ENABLED)) !=
1249 			    (GV_CONFIGURED | GV_ENABLED))
1250 				continue;
1251 
1252 			if (v->gv_state == RESTARTER_STATE_MAINT)
1253 				continue;
1254 
1255 			any_qualified = B_TRUE;
1256 			if (v->gv_state == RESTARTER_STATE_OFFLINE) {
1257 				/*
1258 				 * For offline dependencies, treat unsatisfiable
1259 				 * as satisfied.
1260 				 */
1261 				i = dependency_satisfied(v, B_TRUE);
1262 				if (i == -1)
1263 					i = 1;
1264 			} else if (v->gv_state == RESTARTER_STATE_DISABLED) {
1265 				/*
1266 				 * The service is enabled, but hasn't
1267 				 * transitioned out of disabled yet.  Treat it
1268 				 * as unsatisfied (not unsatisfiable).
1269 				 */
1270 				i = 0;
1271 			} else {
1272 				i = dependency_satisfied(v, satbility);
1273 			}
1274 			break;
1275 
1276 		case GVT_FILE:
1277 			any_qualified = B_TRUE;
1278 			i = dependency_satisfied(v, satbility);
1279 
1280 			break;
1281 
1282 		case GVT_SVC: {
1283 			boolean_t svc_any_qualified;
1284 			boolean_t svc_satisfied;
1285 			boolean_t svc_satisfiable;
1286 			graph_vertex_t *v2;
1287 			graph_edge_t *e2;
1288 
1289 			svc_any_qualified = B_FALSE;
1290 			svc_satisfied = B_FALSE;
1291 			svc_satisfiable = B_FALSE;
1292 
1293 			for (e2 = uu_list_first(v->gv_dependencies);
1294 			    e2 != NULL;
1295 			    e2 = uu_list_next(v->gv_dependencies, e2)) {
1296 				v2 = e2->ge_vertex;
1297 				assert(v2->gv_type == GVT_INST);
1298 
1299 				if ((v2->gv_flags &
1300 				    (GV_CONFIGURED | GV_ENABLED)) !=
1301 				    (GV_CONFIGURED | GV_ENABLED))
1302 					continue;
1303 
1304 				if (v2->gv_state == RESTARTER_STATE_MAINT)
1305 					continue;
1306 
1307 				svc_any_qualified = B_TRUE;
1308 
1309 				if (v2->gv_state == RESTARTER_STATE_OFFLINE) {
1310 					/*
1311 					 * For offline dependencies, treat
1312 					 * unsatisfiable as satisfied.
1313 					 */
1314 					i = dependency_satisfied(v2, B_TRUE);
1315 					if (i == -1)
1316 						i = 1;
1317 				} else if (v2->gv_state ==
1318 				    RESTARTER_STATE_DISABLED) {
1319 					i = 0;
1320 				} else {
1321 					i = dependency_satisfied(v2, satbility);
1322 				}
1323 
1324 				if (i == 1) {
1325 					svc_satisfied = B_TRUE;
1326 					break;
1327 				}
1328 				if (i == 0)
1329 					svc_satisfiable = B_TRUE;
1330 			}
1331 
1332 			if (!svc_any_qualified)
1333 				continue;
1334 			any_qualified = B_TRUE;
1335 			if (svc_satisfied) {
1336 				i = 1;
1337 			} else if (svc_satisfiable) {
1338 				i = 0;
1339 			} else {
1340 				i = -1;
1341 			}
1342 			break;
1343 		}
1344 
1345 		case GVT_GROUP:
1346 		default:
1347 #ifndef NDEBUG
1348 			uu_warn("%s:%d: Unexpected vertex type %d.\n", __FILE__,
1349 			    __LINE__, v->gv_type);
1350 #endif
1351 			abort();
1352 		}
1353 
1354 		if (i == 1)
1355 			continue;
1356 
1357 		log_framework2(LOG_DEBUG, DEBUG_DEPENDENCIES,
1358 		    "optional_all(%s): %s is unsatisfi%s.\n", groupv->gv_name,
1359 		    v->gv_name, i == 0 ? "ed" : "able");
1360 
1361 		if (!satbility)
1362 			return (0);
1363 		if (i == -1)
1364 			return (-1);
1365 		any_unsatisfied = B_TRUE;
1366 	}
1367 
1368 	if (!any_qualified)
1369 		return (1);
1370 
1371 	return (any_unsatisfied ? 0 : 1);
1372 }
1373 
1374 /*
1375  * An exclude_all dependency is unsatisfied if any non-service element is
1376  * satisfied or any service instance which is configured, enabled, and not in
1377  * maintenance is satisfied.  Usually when unsatisfied, it is also
1378  * unsatisfiable.
1379  */
1380 #define	LOG_EXCLUDE(u, v)						\
1381 	log_framework2(LOG_DEBUG, DEBUG_DEPENDENCIES,			\
1382 	    "exclude_all(%s): %s is satisfied.\n",			\
1383 	    (u)->gv_name, (v)->gv_name)
1384 
1385 /* ARGSUSED */
1386 static int
1387 exclude_all_satisfied(graph_vertex_t *groupv, boolean_t satbility)
1388 {
1389 	graph_edge_t *edge, *e2;
1390 	graph_vertex_t *v, *v2;
1391 
1392 	for (edge = uu_list_first(groupv->gv_dependencies);
1393 	    edge != NULL;
1394 	    edge = uu_list_next(groupv->gv_dependencies, edge)) {
1395 		v = edge->ge_vertex;
1396 
1397 		switch (v->gv_type) {
1398 		case GVT_INST:
1399 			if ((v->gv_flags & GV_CONFIGURED) == 0)
1400 				continue;
1401 
1402 			switch (v->gv_state) {
1403 			case RESTARTER_STATE_ONLINE:
1404 			case RESTARTER_STATE_DEGRADED:
1405 				LOG_EXCLUDE(groupv, v);
1406 				return (v->gv_flags & GV_ENABLED ? -1 : 0);
1407 
1408 			case RESTARTER_STATE_OFFLINE:
1409 			case RESTARTER_STATE_UNINIT:
1410 				LOG_EXCLUDE(groupv, v);
1411 				return (0);
1412 
1413 			case RESTARTER_STATE_DISABLED:
1414 			case RESTARTER_STATE_MAINT:
1415 				continue;
1416 
1417 			default:
1418 #ifndef NDEBUG
1419 				uu_warn("%s:%d: Unexpected vertex state %d.\n",
1420 				    __FILE__, __LINE__, v->gv_state);
1421 #endif
1422 				abort();
1423 			}
1424 			/* NOTREACHED */
1425 
1426 		case GVT_SVC:
1427 			break;
1428 
1429 		case GVT_FILE:
1430 			if (!file_ready(v))
1431 				continue;
1432 			LOG_EXCLUDE(groupv, v);
1433 			return (-1);
1434 
1435 		case GVT_GROUP:
1436 		default:
1437 #ifndef NDEBUG
1438 			uu_warn("%s:%d: Unexpected vertex type %d.\n", __FILE__,
1439 			    __LINE__, v->gv_type);
1440 #endif
1441 			abort();
1442 		}
1443 
1444 		/* v represents a service */
1445 		if (uu_list_numnodes(v->gv_dependencies) == 0)
1446 			continue;
1447 
1448 		for (e2 = uu_list_first(v->gv_dependencies);
1449 		    e2 != NULL;
1450 		    e2 = uu_list_next(v->gv_dependencies, e2)) {
1451 			v2 = e2->ge_vertex;
1452 			assert(v2->gv_type == GVT_INST);
1453 
1454 			if ((v2->gv_flags & GV_CONFIGURED) == 0)
1455 				continue;
1456 
1457 			switch (v2->gv_state) {
1458 			case RESTARTER_STATE_ONLINE:
1459 			case RESTARTER_STATE_DEGRADED:
1460 				LOG_EXCLUDE(groupv, v2);
1461 				return (v2->gv_flags & GV_ENABLED ? -1 : 0);
1462 
1463 			case RESTARTER_STATE_OFFLINE:
1464 			case RESTARTER_STATE_UNINIT:
1465 				LOG_EXCLUDE(groupv, v2);
1466 				return (0);
1467 
1468 			case RESTARTER_STATE_DISABLED:
1469 			case RESTARTER_STATE_MAINT:
1470 				continue;
1471 
1472 			default:
1473 #ifndef NDEBUG
1474 				uu_warn("%s:%d: Unexpected vertex type %d.\n",
1475 				    __FILE__, __LINE__, v2->gv_type);
1476 #endif
1477 				abort();
1478 			}
1479 		}
1480 	}
1481 
1482 	return (1);
1483 }
1484 
1485 /*
1486  * int instance_satisfied()
1487  *   Determine if all the dependencies are satisfied for the supplied instance
1488  *   vertex. Return 1 if they are, 0 if they aren't, and -1 if they won't be
1489  *   without administrator intervention.
1490  */
1491 static int
1492 instance_satisfied(graph_vertex_t *v, boolean_t satbility)
1493 {
1494 	assert(v->gv_type == GVT_INST);
1495 	assert(!inst_running(v));
1496 
1497 	return (require_all_satisfied(v, satbility));
1498 }
1499 
1500 /*
1501  * Decide whether v can satisfy a dependency.  v can either be a child of
1502  * a group vertex, or of an instance vertex.
1503  */
1504 static int
1505 dependency_satisfied(graph_vertex_t *v, boolean_t satbility)
1506 {
1507 	switch (v->gv_type) {
1508 	case GVT_INST:
1509 		if ((v->gv_flags & GV_CONFIGURED) == 0)
1510 			return (-1);
1511 
1512 		switch (v->gv_state) {
1513 		case RESTARTER_STATE_ONLINE:
1514 		case RESTARTER_STATE_DEGRADED:
1515 			return (1);
1516 
1517 		case RESTARTER_STATE_OFFLINE:
1518 			if (!satbility)
1519 				return (0);
1520 			return (instance_satisfied(v, satbility) != -1 ?
1521 			    0 : -1);
1522 
1523 		case RESTARTER_STATE_DISABLED:
1524 		case RESTARTER_STATE_MAINT:
1525 			return (-1);
1526 
1527 		case RESTARTER_STATE_UNINIT:
1528 			return (0);
1529 
1530 		default:
1531 #ifndef NDEBUG
1532 			uu_warn("%s:%d: Unexpected vertex state %d.\n",
1533 			    __FILE__, __LINE__, v->gv_state);
1534 #endif
1535 			abort();
1536 			/* NOTREACHED */
1537 		}
1538 
1539 	case GVT_SVC:
1540 		if (uu_list_numnodes(v->gv_dependencies) == 0)
1541 			return (-1);
1542 		return (require_any_satisfied(v, satbility));
1543 
1544 	case GVT_FILE:
1545 		/* i.e., we assume files will not be automatically generated */
1546 		return (file_ready(v) ? 1 : -1);
1547 
1548 	case GVT_GROUP:
1549 		break;
1550 
1551 	default:
1552 #ifndef NDEBUG
1553 		uu_warn("%s:%d: Unexpected node type %d.\n", __FILE__, __LINE__,
1554 		    v->gv_type);
1555 #endif
1556 		abort();
1557 		/* NOTREACHED */
1558 	}
1559 
1560 	switch (v->gv_depgroup) {
1561 	case DEPGRP_REQUIRE_ANY:
1562 		return (require_any_satisfied(v, satbility));
1563 
1564 	case DEPGRP_REQUIRE_ALL:
1565 		return (require_all_satisfied(v, satbility));
1566 
1567 	case DEPGRP_OPTIONAL_ALL:
1568 		return (optional_all_satisfied(v, satbility));
1569 
1570 	case DEPGRP_EXCLUDE_ALL:
1571 		return (exclude_all_satisfied(v, satbility));
1572 
1573 	default:
1574 #ifndef NDEBUG
1575 		uu_warn("%s:%d: Unknown dependency grouping %d.\n", __FILE__,
1576 		    __LINE__, v->gv_depgroup);
1577 #endif
1578 		abort();
1579 	}
1580 }
1581 
1582 void
1583 graph_start_if_satisfied(graph_vertex_t *v)
1584 {
1585 	if (v->gv_state == RESTARTER_STATE_OFFLINE &&
1586 	    instance_satisfied(v, B_FALSE) == 1) {
1587 		if (v->gv_start_f == NULL)
1588 			vertex_send_event(v, RESTARTER_EVENT_TYPE_START);
1589 		else
1590 			v->gv_start_f(v);
1591 	}
1592 }
1593 
1594 /*
1595  * propagate_satbility()
1596  *
1597  * This function is used when the given vertex changes state in such a way that
1598  * one of its dependents may become unsatisfiable.  This happens when an
1599  * instance transitions between offline -> online, or from !running ->
1600  * maintenance, as well as when an instance is removed from the graph.
1601  *
1602  * We have to walk all the dependents, since optional_all dependencies several
1603  * levels up could become (un)satisfied, instead of unsatisfiable.  For example,
1604  *
1605  *	+-----+  optional_all  +-----+  require_all  +-----+
1606  *	|  A  |--------------->|  B  |-------------->|  C  |
1607  *	+-----+                +-----+               +-----+
1608  *
1609  *	                                        offline -> maintenance
1610  *
1611  * If C goes into maintenance, it's not enough simply to check B.  Because A has
1612  * an optional dependency, what was previously an unsatisfiable situation is now
1613  * satisfied (B will never come online, even though its state hasn't changed).
1614  *
1615  * Note that it's not necessary to continue examining dependents after reaching
1616  * an optional_all dependency.  It's not possible for an optional_all dependency
1617  * to change satisfiability without also coming online, in which case we get a
1618  * start event and propagation continues naturally.  However, it does no harm to
1619  * continue propagating satisfiability (as it is a relatively rare event), and
1620  * keeps the walker code simple and generic.
1621  */
1622 /*ARGSUSED*/
1623 static int
1624 satbility_cb(graph_vertex_t *v, void *arg)
1625 {
1626 	if (v->gv_type == GVT_INST)
1627 		graph_start_if_satisfied(v);
1628 
1629 	return (UU_WALK_NEXT);
1630 }
1631 
1632 static void
1633 propagate_satbility(graph_vertex_t *v)
1634 {
1635 	graph_walk(v, WALK_DEPENDENTS, satbility_cb, NULL, NULL);
1636 }
1637 
1638 static void propagate_stop(graph_vertex_t *, void *);
1639 
1640 /* ARGSUSED */
1641 static void
1642 propagate_start(graph_vertex_t *v, void *arg)
1643 {
1644 	switch (v->gv_type) {
1645 	case GVT_INST:
1646 		graph_start_if_satisfied(v);
1647 		break;
1648 
1649 	case GVT_GROUP:
1650 		if (v->gv_depgroup == DEPGRP_EXCLUDE_ALL) {
1651 			graph_walk_dependents(v, propagate_stop,
1652 			    (void *)RERR_RESTART);
1653 			break;
1654 		}
1655 		/* FALLTHROUGH */
1656 
1657 	case GVT_SVC:
1658 		graph_walk_dependents(v, propagate_start, NULL);
1659 		break;
1660 
1661 	case GVT_FILE:
1662 #ifndef NDEBUG
1663 		uu_warn("%s:%d: propagate_start() encountered GVT_FILE.\n",
1664 		    __FILE__, __LINE__);
1665 #endif
1666 		abort();
1667 		/* NOTREACHED */
1668 
1669 	default:
1670 #ifndef NDEBUG
1671 		uu_warn("%s:%d: Unknown vertex type %d.\n", __FILE__, __LINE__,
1672 		    v->gv_type);
1673 #endif
1674 		abort();
1675 	}
1676 }
1677 
1678 static void
1679 propagate_stop(graph_vertex_t *v, void *arg)
1680 {
1681 	graph_edge_t *e;
1682 	graph_vertex_t *svc;
1683 	restarter_error_t err = (restarter_error_t)arg;
1684 
1685 	switch (v->gv_type) {
1686 	case GVT_INST:
1687 		/* Restarter */
1688 		if (err > RERR_NONE && inst_running(v))
1689 			vertex_send_event(v, RESTARTER_EVENT_TYPE_STOP);
1690 		break;
1691 
1692 	case GVT_SVC:
1693 		graph_walk_dependents(v, propagate_stop, arg);
1694 		break;
1695 
1696 	case GVT_FILE:
1697 #ifndef NDEBUG
1698 		uu_warn("%s:%d: propagate_stop() encountered GVT_FILE.\n",
1699 		    __FILE__, __LINE__);
1700 #endif
1701 		abort();
1702 		/* NOTREACHED */
1703 
1704 	case GVT_GROUP:
1705 		if (v->gv_depgroup == DEPGRP_EXCLUDE_ALL) {
1706 			graph_walk_dependents(v, propagate_start, NULL);
1707 			break;
1708 		}
1709 
1710 		if (err == RERR_NONE || err > v->gv_restart)
1711 			break;
1712 
1713 		assert(uu_list_numnodes(v->gv_dependents) == 1);
1714 		e = uu_list_first(v->gv_dependents);
1715 		svc = e->ge_vertex;
1716 
1717 		if (inst_running(svc))
1718 			vertex_send_event(svc, RESTARTER_EVENT_TYPE_STOP);
1719 		break;
1720 
1721 	default:
1722 #ifndef NDEBUG
1723 		uu_warn("%s:%d: Unknown vertex type %d.\n", __FILE__, __LINE__,
1724 		    v->gv_type);
1725 #endif
1726 		abort();
1727 	}
1728 }
1729 
1730 /*
1731  * void graph_enable_by_vertex()
1732  *   If admin is non-zero, this is an administrative request for change
1733  *   of the enabled property.  Thus, send the ADMIN_DISABLE rather than
1734  *   a plain DISABLE restarter event.
1735  */
1736 void
1737 graph_enable_by_vertex(graph_vertex_t *vertex, int enable, int admin)
1738 {
1739 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
1740 	assert((vertex->gv_flags & GV_CONFIGURED));
1741 
1742 	vertex->gv_flags = (vertex->gv_flags & ~GV_ENABLED) |
1743 	    (enable ? GV_ENABLED : 0);
1744 
1745 	if (enable) {
1746 		if (vertex->gv_state != RESTARTER_STATE_OFFLINE &&
1747 		    vertex->gv_state != RESTARTER_STATE_DEGRADED &&
1748 		    vertex->gv_state != RESTARTER_STATE_ONLINE)
1749 			vertex_send_event(vertex, RESTARTER_EVENT_TYPE_ENABLE);
1750 	} else {
1751 		if (vertex->gv_state != RESTARTER_STATE_DISABLED) {
1752 			if (admin)
1753 				vertex_send_event(vertex,
1754 				    RESTARTER_EVENT_TYPE_ADMIN_DISABLE);
1755 			else
1756 				vertex_send_event(vertex,
1757 				    RESTARTER_EVENT_TYPE_DISABLE);
1758 		}
1759 	}
1760 
1761 	/*
1762 	 * Wait for state update from restarter before sending _START or
1763 	 * _STOP.
1764 	 */
1765 }
1766 
1767 static int configure_vertex(graph_vertex_t *, scf_instance_t *);
1768 
1769 /*
1770  * Set the restarter for v to fmri_arg.  That is, make sure a vertex for
1771  * fmri_arg exists, make v depend on it, and send _ADD_INSTANCE for v.  If
1772  * v is already configured and fmri_arg indicates the current restarter, do
1773  * nothing.  If v is configured and fmri_arg is a new restarter, delete v's
1774  * dependency on the restarter, send _REMOVE_INSTANCE for v, and set the new
1775  * restarter.  Returns 0 on success, EINVAL if the FMRI is invalid,
1776  * ECONNABORTED if the repository connection is broken, and ELOOP
1777  * if the dependency would create a cycle.  In the last case, *pathp will
1778  * point to a -1-terminated array of ids which compose the path from v to
1779  * restarter_fmri.
1780  */
1781 int
1782 graph_change_restarter(graph_vertex_t *v, const char *fmri_arg, scf_handle_t *h,
1783     int **pathp)
1784 {
1785 	char *restarter_fmri = NULL;
1786 	graph_vertex_t *rv;
1787 	int err;
1788 	int id;
1789 
1790 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
1791 
1792 	if (fmri_arg[0] != '\0') {
1793 		err = fmri_canonify(fmri_arg, &restarter_fmri, B_TRUE);
1794 		if (err != 0) {
1795 			assert(err == EINVAL);
1796 			return (err);
1797 		}
1798 	}
1799 
1800 	if (restarter_fmri == NULL ||
1801 	    strcmp(restarter_fmri, SCF_SERVICE_STARTD) == 0) {
1802 		if (v->gv_flags & GV_CONFIGURED) {
1803 			if (v->gv_restarter_id == -1) {
1804 				if (restarter_fmri != NULL)
1805 					startd_free(restarter_fmri,
1806 					    max_scf_fmri_size);
1807 				return (0);
1808 			}
1809 
1810 			graph_unset_restarter(v);
1811 		}
1812 
1813 		/* Master restarter, nothing to do. */
1814 		v->gv_restarter_id = -1;
1815 		v->gv_restarter_channel = NULL;
1816 		vertex_send_event(v, RESTARTER_EVENT_TYPE_ADD_INSTANCE);
1817 		return (0);
1818 	}
1819 
1820 	if (v->gv_flags & GV_CONFIGURED) {
1821 		id = dict_lookup_byname(restarter_fmri);
1822 		if (id != -1 && v->gv_restarter_id == id) {
1823 			startd_free(restarter_fmri, max_scf_fmri_size);
1824 			return (0);
1825 		}
1826 
1827 		graph_unset_restarter(v);
1828 	}
1829 
1830 	err = graph_insert_vertex_unconfigured(restarter_fmri, GVT_INST, 0,
1831 	    RERR_NONE, &rv);
1832 	startd_free(restarter_fmri, max_scf_fmri_size);
1833 	assert(err == 0 || err == EEXIST);
1834 
1835 	if (rv->gv_delegate_initialized == 0) {
1836 		rv->gv_delegate_channel = restarter_protocol_init_delegate(
1837 		    rv->gv_name);
1838 		rv->gv_delegate_initialized = 1;
1839 	}
1840 	v->gv_restarter_id = rv->gv_id;
1841 	v->gv_restarter_channel = rv->gv_delegate_channel;
1842 
1843 	err = graph_insert_dependency(v, rv, pathp);
1844 	if (err != 0) {
1845 		assert(err == ELOOP);
1846 		return (ELOOP);
1847 	}
1848 
1849 	vertex_send_event(v, RESTARTER_EVENT_TYPE_ADD_INSTANCE);
1850 
1851 	if (!(rv->gv_flags & GV_CONFIGURED)) {
1852 		scf_instance_t *inst;
1853 
1854 		err = libscf_fmri_get_instance(h, rv->gv_name, &inst);
1855 		switch (err) {
1856 		case 0:
1857 			err = configure_vertex(rv, inst);
1858 			scf_instance_destroy(inst);
1859 			switch (err) {
1860 			case 0:
1861 			case ECANCELED:
1862 				break;
1863 
1864 			case ECONNABORTED:
1865 				return (ECONNABORTED);
1866 
1867 			default:
1868 				bad_error("configure_vertex", err);
1869 			}
1870 			break;
1871 
1872 		case ECONNABORTED:
1873 			return (ECONNABORTED);
1874 
1875 		case ENOENT:
1876 			break;
1877 
1878 		case ENOTSUP:
1879 			/*
1880 			 * The fmri doesn't specify an instance - translate
1881 			 * to EINVAL.
1882 			 */
1883 			return (EINVAL);
1884 
1885 		case EINVAL:
1886 		default:
1887 			bad_error("libscf_fmri_get_instance", err);
1888 		}
1889 	}
1890 
1891 	return (0);
1892 }
1893 
1894 
1895 /*
1896  * Add all of the instances of the service named by fmri to the graph.
1897  * Returns
1898  *   0 - success
1899  *   ENOENT - service indicated by fmri does not exist
1900  *
1901  * In both cases *reboundp will be B_TRUE if the handle was rebound, or B_FALSE
1902  * otherwise.
1903  */
1904 static int
1905 add_service(const char *fmri, scf_handle_t *h, boolean_t *reboundp)
1906 {
1907 	scf_service_t *svc;
1908 	scf_instance_t *inst;
1909 	scf_iter_t *iter;
1910 	char *inst_fmri;
1911 	int ret, r;
1912 
1913 	*reboundp = B_FALSE;
1914 
1915 	svc = safe_scf_service_create(h);
1916 	inst = safe_scf_instance_create(h);
1917 	iter = safe_scf_iter_create(h);
1918 	inst_fmri = startd_alloc(max_scf_fmri_size);
1919 
1920 rebound:
1921 	if (scf_handle_decode_fmri(h, fmri, NULL, svc, NULL, NULL, NULL,
1922 	    SCF_DECODE_FMRI_EXACT) != 0) {
1923 		switch (scf_error()) {
1924 		case SCF_ERROR_CONNECTION_BROKEN:
1925 		default:
1926 			libscf_handle_rebind(h);
1927 			*reboundp = B_TRUE;
1928 			goto rebound;
1929 
1930 		case SCF_ERROR_NOT_FOUND:
1931 			ret = ENOENT;
1932 			goto out;
1933 
1934 		case SCF_ERROR_INVALID_ARGUMENT:
1935 		case SCF_ERROR_CONSTRAINT_VIOLATED:
1936 		case SCF_ERROR_NOT_BOUND:
1937 		case SCF_ERROR_HANDLE_MISMATCH:
1938 			bad_error("scf_handle_decode_fmri", scf_error());
1939 		}
1940 	}
1941 
1942 	if (scf_iter_service_instances(iter, svc) != 0) {
1943 		switch (scf_error()) {
1944 		case SCF_ERROR_CONNECTION_BROKEN:
1945 		default:
1946 			libscf_handle_rebind(h);
1947 			*reboundp = B_TRUE;
1948 			goto rebound;
1949 
1950 		case SCF_ERROR_DELETED:
1951 			ret = ENOENT;
1952 			goto out;
1953 
1954 		case SCF_ERROR_HANDLE_MISMATCH:
1955 		case SCF_ERROR_NOT_BOUND:
1956 		case SCF_ERROR_NOT_SET:
1957 			bad_error("scf_iter_service_instances", scf_error());
1958 		}
1959 	}
1960 
1961 	for (;;) {
1962 		r = scf_iter_next_instance(iter, inst);
1963 		if (r == 0)
1964 			break;
1965 		if (r != 1) {
1966 			switch (scf_error()) {
1967 			case SCF_ERROR_CONNECTION_BROKEN:
1968 			default:
1969 				libscf_handle_rebind(h);
1970 				*reboundp = B_TRUE;
1971 				goto rebound;
1972 
1973 			case SCF_ERROR_DELETED:
1974 				ret = ENOENT;
1975 				goto out;
1976 
1977 			case SCF_ERROR_HANDLE_MISMATCH:
1978 			case SCF_ERROR_NOT_BOUND:
1979 			case SCF_ERROR_NOT_SET:
1980 			case SCF_ERROR_INVALID_ARGUMENT:
1981 				bad_error("scf_iter_next_instance",
1982 				    scf_error());
1983 			}
1984 		}
1985 
1986 		if (scf_instance_to_fmri(inst, inst_fmri, max_scf_fmri_size) <
1987 		    0) {
1988 			switch (scf_error()) {
1989 			case SCF_ERROR_CONNECTION_BROKEN:
1990 				libscf_handle_rebind(h);
1991 				*reboundp = B_TRUE;
1992 				goto rebound;
1993 
1994 			case SCF_ERROR_DELETED:
1995 				continue;
1996 
1997 			case SCF_ERROR_NOT_BOUND:
1998 			case SCF_ERROR_NOT_SET:
1999 				bad_error("scf_instance_to_fmri", scf_error());
2000 			}
2001 		}
2002 
2003 		r = dgraph_add_instance(inst_fmri, inst, B_FALSE);
2004 		switch (r) {
2005 		case 0:
2006 		case ECANCELED:
2007 			break;
2008 
2009 		case EEXIST:
2010 			continue;
2011 
2012 		case ECONNABORTED:
2013 			libscf_handle_rebind(h);
2014 			*reboundp = B_TRUE;
2015 			goto rebound;
2016 
2017 		case EINVAL:
2018 		default:
2019 			bad_error("dgraph_add_instance", r);
2020 		}
2021 	}
2022 
2023 	ret = 0;
2024 
2025 out:
2026 	startd_free(inst_fmri, max_scf_fmri_size);
2027 	scf_iter_destroy(iter);
2028 	scf_instance_destroy(inst);
2029 	scf_service_destroy(svc);
2030 	return (ret);
2031 }
2032 
2033 struct depfmri_info {
2034 	graph_vertex_t	*v;		/* GVT_GROUP vertex */
2035 	gv_type_t	type;		/* type of dependency */
2036 	const char	*inst_fmri;	/* FMRI of parental GVT_INST vert. */
2037 	const char	*pg_name;	/* Name of dependency pg */
2038 	scf_handle_t	*h;
2039 	int		err;		/* return error code */
2040 	int		**pathp;	/* return circular dependency path */
2041 };
2042 
2043 /*
2044  * Find or create a vertex for fmri and make info->v depend on it.
2045  * Returns
2046  *   0 - success
2047  *   nonzero - failure
2048  *
2049  * On failure, sets info->err to
2050  *   EINVAL - fmri is invalid
2051  *	      fmri does not match info->type
2052  *   ELOOP - Adding the dependency creates a circular dependency.  *info->pathp
2053  *	     will point to an array of the ids of the members of the cycle.
2054  *   ECONNABORTED - repository connection was broken
2055  *   ECONNRESET - succeeded, but repository connection was reset
2056  */
2057 static int
2058 process_dependency_fmri(const char *fmri, struct depfmri_info *info)
2059 {
2060 	int err;
2061 	graph_vertex_t *depgroup_v, *v;
2062 	char *fmri_copy, *cfmri;
2063 	size_t fmri_copy_sz;
2064 	const char *scope, *service, *instance, *pg;
2065 	scf_instance_t *inst;
2066 	boolean_t rebound;
2067 
2068 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
2069 
2070 	/* Get or create vertex for FMRI */
2071 	depgroup_v = info->v;
2072 
2073 	if (strncmp(fmri, "file:", sizeof ("file:") - 1) == 0) {
2074 		if (info->type != GVT_FILE) {
2075 			log_framework(LOG_NOTICE,
2076 			    "FMRI \"%s\" is not allowed for the \"%s\" "
2077 			    "dependency's type of instance %s.\n", fmri,
2078 			    info->pg_name, info->inst_fmri);
2079 			return (info->err = EINVAL);
2080 		}
2081 
2082 		err = graph_insert_vertex_unconfigured(fmri, info->type, 0,
2083 		    RERR_NONE, &v);
2084 		switch (err) {
2085 		case 0:
2086 			break;
2087 
2088 		case EEXIST:
2089 			assert(v->gv_type == GVT_FILE);
2090 			break;
2091 
2092 		case EINVAL:		/* prevented above */
2093 		default:
2094 			bad_error("graph_insert_vertex_unconfigured", err);
2095 		}
2096 	} else {
2097 		if (info->type != GVT_INST) {
2098 			log_framework(LOG_NOTICE,
2099 			    "FMRI \"%s\" is not allowed for the \"%s\" "
2100 			    "dependency's type of instance %s.\n", fmri,
2101 			    info->pg_name, info->inst_fmri);
2102 			return (info->err = EINVAL);
2103 		}
2104 
2105 		/*
2106 		 * We must canonify fmri & add a vertex for it.
2107 		 */
2108 		fmri_copy_sz = strlen(fmri) + 1;
2109 		fmri_copy = startd_alloc(fmri_copy_sz);
2110 		(void) strcpy(fmri_copy, fmri);
2111 
2112 		/* Determine if the FMRI is a property group or instance */
2113 		if (scf_parse_svc_fmri(fmri_copy, &scope, &service,
2114 		    &instance, &pg, NULL) != 0) {
2115 			startd_free(fmri_copy, fmri_copy_sz);
2116 			log_framework(LOG_NOTICE,
2117 			    "Dependency \"%s\" of %s has invalid FMRI "
2118 			    "\"%s\".\n", info->pg_name, info->inst_fmri,
2119 			    fmri);
2120 			return (info->err = EINVAL);
2121 		}
2122 
2123 		if (service == NULL || pg != NULL) {
2124 			startd_free(fmri_copy, fmri_copy_sz);
2125 			log_framework(LOG_NOTICE,
2126 			    "Dependency \"%s\" of %s does not designate a "
2127 			    "service or instance.\n", info->pg_name,
2128 			    info->inst_fmri);
2129 			return (info->err = EINVAL);
2130 		}
2131 
2132 		if (scope == NULL || strcmp(scope, SCF_SCOPE_LOCAL) == 0) {
2133 			cfmri = uu_msprintf("svc:/%s%s%s",
2134 			    service, instance ? ":" : "", instance ? instance :
2135 			    "");
2136 		} else {
2137 			cfmri = uu_msprintf("svc://%s/%s%s%s",
2138 			    scope, service, instance ? ":" : "", instance ?
2139 			    instance : "");
2140 		}
2141 
2142 		startd_free(fmri_copy, fmri_copy_sz);
2143 
2144 		err = graph_insert_vertex_unconfigured(cfmri, instance ?
2145 		    GVT_INST : GVT_SVC, instance ? 0 : DEPGRP_REQUIRE_ANY,
2146 		    RERR_NONE, &v);
2147 		uu_free(cfmri);
2148 		switch (err) {
2149 		case 0:
2150 			break;
2151 
2152 		case EEXIST:
2153 			/* Verify v. */
2154 			if (instance != NULL)
2155 				assert(v->gv_type == GVT_INST);
2156 			else
2157 				assert(v->gv_type == GVT_SVC);
2158 			break;
2159 
2160 		default:
2161 			bad_error("graph_insert_vertex_unconfigured", err);
2162 		}
2163 	}
2164 
2165 	/* Add dependency from depgroup_v to new vertex */
2166 	info->err = graph_insert_dependency(depgroup_v, v, info->pathp);
2167 	switch (info->err) {
2168 	case 0:
2169 		break;
2170 
2171 	case ELOOP:
2172 		return (ELOOP);
2173 
2174 	default:
2175 		bad_error("graph_insert_dependency", info->err);
2176 	}
2177 
2178 	/* This must be after we insert the dependency, to avoid looping. */
2179 	switch (v->gv_type) {
2180 	case GVT_INST:
2181 		if ((v->gv_flags & GV_CONFIGURED) != 0)
2182 			break;
2183 
2184 		inst = safe_scf_instance_create(info->h);
2185 
2186 		rebound = B_FALSE;
2187 
2188 rebound:
2189 		err = libscf_lookup_instance(v->gv_name, inst);
2190 		switch (err) {
2191 		case 0:
2192 			err = configure_vertex(v, inst);
2193 			switch (err) {
2194 			case 0:
2195 			case ECANCELED:
2196 				break;
2197 
2198 			case ECONNABORTED:
2199 				libscf_handle_rebind(info->h);
2200 				rebound = B_TRUE;
2201 				goto rebound;
2202 
2203 			default:
2204 				bad_error("configure_vertex", err);
2205 			}
2206 			break;
2207 
2208 		case ENOENT:
2209 			break;
2210 
2211 		case ECONNABORTED:
2212 			libscf_handle_rebind(info->h);
2213 			rebound = B_TRUE;
2214 			goto rebound;
2215 
2216 		case EINVAL:
2217 		case ENOTSUP:
2218 		default:
2219 			bad_error("libscf_fmri_get_instance", err);
2220 		}
2221 
2222 		scf_instance_destroy(inst);
2223 
2224 		if (rebound)
2225 			return (info->err = ECONNRESET);
2226 		break;
2227 
2228 	case GVT_SVC:
2229 		(void) add_service(v->gv_name, info->h, &rebound);
2230 		if (rebound)
2231 			return (info->err = ECONNRESET);
2232 	}
2233 
2234 	return (0);
2235 }
2236 
2237 struct deppg_info {
2238 	graph_vertex_t	*v;		/* GVT_INST vertex */
2239 	int		err;		/* return error */
2240 	int		**pathp;	/* return circular dependency path */
2241 };
2242 
2243 /*
2244  * Make info->v depend on a new GVT_GROUP node for this property group,
2245  * and then call process_dependency_fmri() for the values of the entity
2246  * property.  Return 0 on success, or if something goes wrong return nonzero
2247  * and set info->err to ECONNABORTED, EINVAL, or the error code returned by
2248  * process_dependency_fmri().
2249  */
2250 static int
2251 process_dependency_pg(scf_propertygroup_t *pg, struct deppg_info *info)
2252 {
2253 	scf_handle_t *h;
2254 	depgroup_type_t deptype;
2255 	restarter_error_t rerr;
2256 	struct depfmri_info linfo;
2257 	char *fmri, *pg_name;
2258 	size_t fmri_sz;
2259 	graph_vertex_t *depgrp;
2260 	scf_property_t *prop;
2261 	int err;
2262 	int empty;
2263 	scf_error_t scferr;
2264 	ssize_t len;
2265 
2266 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
2267 
2268 	h = scf_pg_handle(pg);
2269 
2270 	pg_name = startd_alloc(max_scf_name_size);
2271 
2272 	len = scf_pg_get_name(pg, pg_name, max_scf_name_size);
2273 	if (len < 0) {
2274 		startd_free(pg_name, max_scf_name_size);
2275 		switch (scf_error()) {
2276 		case SCF_ERROR_CONNECTION_BROKEN:
2277 		default:
2278 			return (info->err = ECONNABORTED);
2279 
2280 		case SCF_ERROR_DELETED:
2281 			return (info->err = 0);
2282 
2283 		case SCF_ERROR_NOT_SET:
2284 			bad_error("scf_pg_get_name", scf_error());
2285 		}
2286 	}
2287 
2288 	/*
2289 	 * Skip over empty dependency groups.  Since dependency property
2290 	 * groups are updated atomically, they are either empty or
2291 	 * fully populated.
2292 	 */
2293 	empty = depgroup_empty(h, pg);
2294 	if (empty < 0) {
2295 		log_error(LOG_INFO,
2296 		    "Error reading dependency group \"%s\" of %s: %s\n",
2297 		    pg_name, info->v->gv_name, scf_strerror(scf_error()));
2298 		startd_free(pg_name, max_scf_name_size);
2299 		return (info->err = EINVAL);
2300 
2301 	} else if (empty == 1) {
2302 		log_framework(LOG_DEBUG,
2303 		    "Ignoring empty dependency group \"%s\" of %s\n",
2304 		    pg_name, info->v->gv_name);
2305 		startd_free(pg_name, max_scf_name_size);
2306 		return (info->err = 0);
2307 	}
2308 
2309 	fmri_sz = strlen(info->v->gv_name) + 1 + len + 1;
2310 	fmri = startd_alloc(fmri_sz);
2311 
2312 	(void) snprintf(fmri, max_scf_name_size, "%s>%s", info->v->gv_name,
2313 	    pg_name);
2314 
2315 	/* Validate the pg before modifying the graph */
2316 	deptype = depgroup_read_grouping(h, pg);
2317 	if (deptype == DEPGRP_UNSUPPORTED) {
2318 		log_error(LOG_INFO,
2319 		    "Dependency \"%s\" of %s has an unknown grouping value.\n",
2320 		    pg_name, info->v->gv_name);
2321 		startd_free(fmri, fmri_sz);
2322 		startd_free(pg_name, max_scf_name_size);
2323 		return (info->err = EINVAL);
2324 	}
2325 
2326 	rerr = depgroup_read_restart(h, pg);
2327 	if (rerr == RERR_UNSUPPORTED) {
2328 		log_error(LOG_INFO,
2329 		    "Dependency \"%s\" of %s has an unknown restart_on value."
2330 		    "\n", pg_name, info->v->gv_name);
2331 		startd_free(fmri, fmri_sz);
2332 		startd_free(pg_name, max_scf_name_size);
2333 		return (info->err = EINVAL);
2334 	}
2335 
2336 	prop = safe_scf_property_create(h);
2337 
2338 	if (scf_pg_get_property(pg, SCF_PROPERTY_ENTITIES, prop) != 0) {
2339 		scferr = scf_error();
2340 		scf_property_destroy(prop);
2341 		if (scferr == SCF_ERROR_DELETED) {
2342 			startd_free(fmri, fmri_sz);
2343 			startd_free(pg_name, max_scf_name_size);
2344 			return (info->err = 0);
2345 		} else if (scferr != SCF_ERROR_NOT_FOUND) {
2346 			startd_free(fmri, fmri_sz);
2347 			startd_free(pg_name, max_scf_name_size);
2348 			return (info->err = ECONNABORTED);
2349 		}
2350 
2351 		log_error(LOG_INFO,
2352 		    "Dependency \"%s\" of %s is missing a \"%s\" property.\n",
2353 		    pg_name, info->v->gv_name, SCF_PROPERTY_ENTITIES);
2354 
2355 		startd_free(fmri, fmri_sz);
2356 		startd_free(pg_name, max_scf_name_size);
2357 
2358 		return (info->err = EINVAL);
2359 	}
2360 
2361 	/* Create depgroup vertex for pg */
2362 	err = graph_insert_vertex_unconfigured(fmri, GVT_GROUP, deptype,
2363 	    rerr, &depgrp);
2364 	assert(err == 0);
2365 	startd_free(fmri, fmri_sz);
2366 
2367 	/* Add dependency from inst vertex to new vertex */
2368 	err = graph_insert_dependency(info->v, depgrp, info->pathp);
2369 	/* ELOOP can't happen because this should be a new vertex */
2370 	assert(err == 0);
2371 
2372 	linfo.v = depgrp;
2373 	linfo.type = depgroup_read_scheme(h, pg);
2374 	linfo.inst_fmri = info->v->gv_name;
2375 	linfo.pg_name = pg_name;
2376 	linfo.h = h;
2377 	linfo.err = 0;
2378 	linfo.pathp = info->pathp;
2379 	err = walk_property_astrings(prop, (callback_t)process_dependency_fmri,
2380 	    &linfo);
2381 
2382 	scf_property_destroy(prop);
2383 	startd_free(pg_name, max_scf_name_size);
2384 
2385 	switch (err) {
2386 	case 0:
2387 	case EINTR:
2388 		return (info->err = linfo.err);
2389 
2390 	case ECONNABORTED:
2391 	case EINVAL:
2392 		return (info->err = err);
2393 
2394 	case ECANCELED:
2395 		return (info->err = 0);
2396 
2397 	case ECONNRESET:
2398 		return (info->err = ECONNABORTED);
2399 
2400 	default:
2401 		bad_error("walk_property_astrings", err);
2402 		/* NOTREACHED */
2403 	}
2404 }
2405 
2406 /*
2407  * Build the dependency info for v from the repository.  Returns 0 on success,
2408  * ECONNABORTED on repository disconnection, EINVAL if the repository
2409  * configuration is invalid, and ELOOP if a dependency would cause a cycle.
2410  * In the last case, *pathp will point to a -1-terminated array of ids which
2411  * constitute the rest of the dependency cycle.
2412  */
2413 static int
2414 set_dependencies(graph_vertex_t *v, scf_instance_t *inst, int **pathp)
2415 {
2416 	struct deppg_info info;
2417 	int err;
2418 	uint_t old_configured;
2419 
2420 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
2421 
2422 	/*
2423 	 * Mark the vertex as configured during dependency insertion to avoid
2424 	 * dependency cycles (which can appear in the graph if one of the
2425 	 * vertices is an exclusion-group).
2426 	 */
2427 	old_configured = v->gv_flags & GV_CONFIGURED;
2428 	v->gv_flags |= GV_CONFIGURED;
2429 
2430 	info.err = 0;
2431 	info.v = v;
2432 	info.pathp = pathp;
2433 
2434 	err = walk_dependency_pgs(inst, (callback_t)process_dependency_pg,
2435 	    &info);
2436 
2437 	if (!old_configured)
2438 		v->gv_flags &= ~GV_CONFIGURED;
2439 
2440 	switch (err) {
2441 	case 0:
2442 	case EINTR:
2443 		return (info.err);
2444 
2445 	case ECONNABORTED:
2446 		return (ECONNABORTED);
2447 
2448 	case ECANCELED:
2449 		/* Should get delete event, so return 0. */
2450 		return (0);
2451 
2452 	default:
2453 		bad_error("walk_dependency_pgs", err);
2454 		/* NOTREACHED */
2455 	}
2456 }
2457 
2458 
2459 static void
2460 handle_cycle(const char *fmri, int *path)
2461 {
2462 	const char *cp;
2463 	size_t sz;
2464 
2465 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
2466 
2467 	path_to_str(path, (char **)&cp, &sz);
2468 
2469 	log_error(LOG_ERR, "Transitioning %s to maintenance "
2470 	    "because it completes a dependency cycle (see svcs -xv for "
2471 	    "details):\n%s", fmri ? fmri : "?", cp);
2472 
2473 	startd_free((void *)cp, sz);
2474 }
2475 
2476 /*
2477  * Increment the vertex's reference count to prevent the vertex removal
2478  * from the dgraph.
2479  */
2480 static void
2481 vertex_ref(graph_vertex_t *v)
2482 {
2483 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
2484 
2485 	v->gv_refs++;
2486 }
2487 
2488 /*
2489  * Decrement the vertex's reference count and remove the vertex from
2490  * the dgraph when possible.
2491  *
2492  * Return VERTEX_REMOVED when the vertex has been removed otherwise
2493  * return VERTEX_INUSE.
2494  */
2495 static int
2496 vertex_unref(graph_vertex_t *v)
2497 {
2498 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
2499 	assert(v->gv_refs > 0);
2500 
2501 	v->gv_refs--;
2502 
2503 	return (free_if_unrefed(v));
2504 }
2505 
2506 /*
2507  * When run on the dependencies of a vertex, populates list with
2508  * graph_edge_t's which point to the service vertices or the instance
2509  * vertices (no GVT_GROUP nodes) on which the vertex depends.
2510  *
2511  * Increment the vertex's reference count once the vertex is inserted
2512  * in the list. The vertex won't be able to be deleted from the dgraph
2513  * while it is referenced.
2514  */
2515 static int
2516 append_svcs_or_insts(graph_edge_t *e, uu_list_t *list)
2517 {
2518 	graph_vertex_t *v = e->ge_vertex;
2519 	graph_edge_t *new;
2520 	int r;
2521 
2522 	switch (v->gv_type) {
2523 	case GVT_INST:
2524 	case GVT_SVC:
2525 		break;
2526 
2527 	case GVT_GROUP:
2528 		r = uu_list_walk(v->gv_dependencies,
2529 		    (uu_walk_fn_t *)append_svcs_or_insts, list, 0);
2530 		assert(r == 0);
2531 		return (UU_WALK_NEXT);
2532 
2533 	case GVT_FILE:
2534 		return (UU_WALK_NEXT);
2535 
2536 	default:
2537 #ifndef NDEBUG
2538 		uu_warn("%s:%d: Unexpected vertex type %d.\n", __FILE__,
2539 		    __LINE__, v->gv_type);
2540 #endif
2541 		abort();
2542 	}
2543 
2544 	new = startd_alloc(sizeof (*new));
2545 	new->ge_vertex = v;
2546 	uu_list_node_init(new, &new->ge_link, graph_edge_pool);
2547 	r = uu_list_insert_before(list, NULL, new);
2548 	assert(r == 0);
2549 
2550 	/*
2551 	 * Because we are inserting the vertex in a list, we don't want
2552 	 * the vertex to be freed while the list is in use. In order to
2553 	 * achieve that, increment the vertex's reference count.
2554 	 */
2555 	vertex_ref(v);
2556 
2557 	return (UU_WALK_NEXT);
2558 }
2559 
2560 static boolean_t
2561 should_be_in_subgraph(graph_vertex_t *v)
2562 {
2563 	graph_edge_t *e;
2564 
2565 	if (v == milestone)
2566 		return (B_TRUE);
2567 
2568 	/*
2569 	 * v is in the subgraph if any of its dependents are in the subgraph.
2570 	 * Except for EXCLUDE_ALL dependents.  And OPTIONAL dependents only
2571 	 * count if we're enabled.
2572 	 */
2573 	for (e = uu_list_first(v->gv_dependents);
2574 	    e != NULL;
2575 	    e = uu_list_next(v->gv_dependents, e)) {
2576 		graph_vertex_t *dv = e->ge_vertex;
2577 
2578 		if (!(dv->gv_flags & GV_INSUBGRAPH))
2579 			continue;
2580 
2581 		/*
2582 		 * Don't include instances that are optional and disabled.
2583 		 */
2584 		if (v->gv_type == GVT_INST && dv->gv_type == GVT_SVC) {
2585 
2586 			int in = 0;
2587 			graph_edge_t *ee;
2588 
2589 			for (ee = uu_list_first(dv->gv_dependents);
2590 			    ee != NULL;
2591 			    ee = uu_list_next(dv->gv_dependents, ee)) {
2592 
2593 				graph_vertex_t *ddv = e->ge_vertex;
2594 
2595 				if (ddv->gv_type == GVT_GROUP &&
2596 				    ddv->gv_depgroup == DEPGRP_EXCLUDE_ALL)
2597 					continue;
2598 
2599 				if (ddv->gv_type == GVT_GROUP &&
2600 				    ddv->gv_depgroup == DEPGRP_OPTIONAL_ALL &&
2601 				    !(v->gv_flags & GV_ENBLD_NOOVR))
2602 					continue;
2603 
2604 				in = 1;
2605 			}
2606 			if (!in)
2607 				continue;
2608 		}
2609 		if (v->gv_type == GVT_INST &&
2610 		    dv->gv_type == GVT_GROUP &&
2611 		    dv->gv_depgroup == DEPGRP_OPTIONAL_ALL &&
2612 		    !(v->gv_flags & GV_ENBLD_NOOVR))
2613 			continue;
2614 
2615 		/* Don't include excluded services and instances */
2616 		if (dv->gv_type == GVT_GROUP &&
2617 		    dv->gv_depgroup == DEPGRP_EXCLUDE_ALL)
2618 			continue;
2619 
2620 		return (B_TRUE);
2621 	}
2622 
2623 	return (B_FALSE);
2624 }
2625 
2626 /*
2627  * Ensures that GV_INSUBGRAPH is set properly for v and its descendents.  If
2628  * any bits change, manipulate the repository appropriately.  Returns 0 or
2629  * ECONNABORTED.
2630  */
2631 static int
2632 eval_subgraph(graph_vertex_t *v, scf_handle_t *h)
2633 {
2634 	boolean_t old = (v->gv_flags & GV_INSUBGRAPH) != 0;
2635 	boolean_t new;
2636 	graph_edge_t *e;
2637 	scf_instance_t *inst;
2638 	int ret = 0, r;
2639 
2640 	assert(milestone != NULL && milestone != MILESTONE_NONE);
2641 
2642 	new = should_be_in_subgraph(v);
2643 
2644 	if (new == old)
2645 		return (0);
2646 
2647 	log_framework(LOG_DEBUG, new ? "Adding %s to the subgraph.\n" :
2648 	    "Removing %s from the subgraph.\n", v->gv_name);
2649 
2650 	v->gv_flags = (v->gv_flags & ~GV_INSUBGRAPH) |
2651 	    (new ? GV_INSUBGRAPH : 0);
2652 
2653 	if (v->gv_type == GVT_INST && (v->gv_flags & GV_CONFIGURED)) {
2654 		int err;
2655 
2656 get_inst:
2657 		err = libscf_fmri_get_instance(h, v->gv_name, &inst);
2658 		if (err != 0) {
2659 			switch (err) {
2660 			case ECONNABORTED:
2661 				libscf_handle_rebind(h);
2662 				ret = ECONNABORTED;
2663 				goto get_inst;
2664 
2665 			case ENOENT:
2666 				break;
2667 
2668 			case EINVAL:
2669 			case ENOTSUP:
2670 			default:
2671 				bad_error("libscf_fmri_get_instance", err);
2672 			}
2673 		} else {
2674 			const char *f;
2675 
2676 			if (new) {
2677 				err = libscf_delete_enable_ovr(inst);
2678 				f = "libscf_delete_enable_ovr";
2679 			} else {
2680 				err = libscf_set_enable_ovr(inst, 0);
2681 				f = "libscf_set_enable_ovr";
2682 			}
2683 			scf_instance_destroy(inst);
2684 			switch (err) {
2685 			case 0:
2686 			case ECANCELED:
2687 				break;
2688 
2689 			case ECONNABORTED:
2690 				libscf_handle_rebind(h);
2691 				/*
2692 				 * We must continue so the graph is updated,
2693 				 * but we must return ECONNABORTED so any
2694 				 * libscf state held by any callers is reset.
2695 				 */
2696 				ret = ECONNABORTED;
2697 				goto get_inst;
2698 
2699 			case EROFS:
2700 			case EPERM:
2701 				log_error(LOG_WARNING,
2702 				    "Could not set %s/%s for %s: %s.\n",
2703 				    SCF_PG_GENERAL_OVR, SCF_PROPERTY_ENABLED,
2704 				    v->gv_name, strerror(err));
2705 				break;
2706 
2707 			default:
2708 				bad_error(f, err);
2709 			}
2710 		}
2711 	}
2712 
2713 	for (e = uu_list_first(v->gv_dependencies);
2714 	    e != NULL;
2715 	    e = uu_list_next(v->gv_dependencies, e)) {
2716 		r = eval_subgraph(e->ge_vertex, h);
2717 		if (r != 0) {
2718 			assert(r == ECONNABORTED);
2719 			ret = ECONNABORTED;
2720 		}
2721 	}
2722 
2723 	return (ret);
2724 }
2725 
2726 /*
2727  * Delete the (property group) dependencies of v & create new ones based on
2728  * inst.  If doing so would create a cycle, log a message and put the instance
2729  * into maintenance.  Update GV_INSUBGRAPH flags as necessary.  Returns 0 or
2730  * ECONNABORTED.
2731  */
2732 int
2733 refresh_vertex(graph_vertex_t *v, scf_instance_t *inst)
2734 {
2735 	int err;
2736 	int *path;
2737 	char *fmri;
2738 	int r;
2739 	scf_handle_t *h = scf_instance_handle(inst);
2740 	uu_list_t *old_deps;
2741 	int ret = 0;
2742 	graph_edge_t *e;
2743 	graph_vertex_t *vv;
2744 
2745 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
2746 	assert(v->gv_type == GVT_INST);
2747 
2748 	log_framework(LOG_DEBUG, "Graph engine: Refreshing %s.\n", v->gv_name);
2749 
2750 	if (milestone > MILESTONE_NONE) {
2751 		/*
2752 		 * In case some of v's dependencies are being deleted we must
2753 		 * make a list of them now for GV_INSUBGRAPH-flag evaluation
2754 		 * after the new dependencies are in place.
2755 		 */
2756 		old_deps = startd_list_create(graph_edge_pool, NULL, 0);
2757 
2758 		err = uu_list_walk(v->gv_dependencies,
2759 		    (uu_walk_fn_t *)append_svcs_or_insts, old_deps, 0);
2760 		assert(err == 0);
2761 	}
2762 
2763 	delete_instance_dependencies(v, B_FALSE);
2764 
2765 	err = set_dependencies(v, inst, &path);
2766 	switch (err) {
2767 	case 0:
2768 		break;
2769 
2770 	case ECONNABORTED:
2771 		ret = err;
2772 		goto out;
2773 
2774 	case EINVAL:
2775 	case ELOOP:
2776 		r = libscf_instance_get_fmri(inst, &fmri);
2777 		switch (r) {
2778 		case 0:
2779 			break;
2780 
2781 		case ECONNABORTED:
2782 			ret = ECONNABORTED;
2783 			goto out;
2784 
2785 		case ECANCELED:
2786 			ret = 0;
2787 			goto out;
2788 
2789 		default:
2790 			bad_error("libscf_instance_get_fmri", r);
2791 		}
2792 
2793 		if (err == EINVAL) {
2794 			log_error(LOG_ERR, "Transitioning %s "
2795 			    "to maintenance due to misconfiguration.\n",
2796 			    fmri ? fmri : "?");
2797 			vertex_send_event(v,
2798 			    RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY);
2799 		} else {
2800 			handle_cycle(fmri, path);
2801 			vertex_send_event(v,
2802 			    RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE);
2803 		}
2804 		startd_free(fmri, max_scf_fmri_size);
2805 		ret = 0;
2806 		goto out;
2807 
2808 	default:
2809 		bad_error("set_dependencies", err);
2810 	}
2811 
2812 	if (milestone > MILESTONE_NONE) {
2813 		boolean_t aborted = B_FALSE;
2814 
2815 		for (e = uu_list_first(old_deps);
2816 		    e != NULL;
2817 		    e = uu_list_next(old_deps, e)) {
2818 			vv = e->ge_vertex;
2819 
2820 			if (vertex_unref(vv) == VERTEX_INUSE &&
2821 			    eval_subgraph(vv, h) == ECONNABORTED)
2822 				aborted = B_TRUE;
2823 		}
2824 
2825 		for (e = uu_list_first(v->gv_dependencies);
2826 		    e != NULL;
2827 		    e = uu_list_next(v->gv_dependencies, e)) {
2828 			if (eval_subgraph(e->ge_vertex, h) ==
2829 			    ECONNABORTED)
2830 				aborted = B_TRUE;
2831 		}
2832 
2833 		if (aborted) {
2834 			ret = ECONNABORTED;
2835 			goto out;
2836 		}
2837 	}
2838 
2839 	graph_start_if_satisfied(v);
2840 
2841 	ret = 0;
2842 
2843 out:
2844 	if (milestone > MILESTONE_NONE) {
2845 		void *cookie = NULL;
2846 
2847 		while ((e = uu_list_teardown(old_deps, &cookie)) != NULL)
2848 			startd_free(e, sizeof (*e));
2849 
2850 		uu_list_destroy(old_deps);
2851 	}
2852 
2853 	return (ret);
2854 }
2855 
2856 /*
2857  * Set up v according to inst.  That is, make sure it depends on its
2858  * restarter and set up its dependencies.  Send the ADD_INSTANCE command to
2859  * the restarter, and send ENABLE or DISABLE as appropriate.
2860  *
2861  * Returns 0 on success, ECONNABORTED on repository disconnection, or
2862  * ECANCELED if inst is deleted.
2863  */
2864 static int
2865 configure_vertex(graph_vertex_t *v, scf_instance_t *inst)
2866 {
2867 	scf_handle_t *h;
2868 	scf_propertygroup_t *pg;
2869 	scf_snapshot_t *snap;
2870 	char *restarter_fmri = startd_alloc(max_scf_value_size);
2871 	int enabled, enabled_ovr;
2872 	int err;
2873 	int *path;
2874 
2875 	restarter_fmri[0] = '\0';
2876 
2877 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
2878 	assert(v->gv_type == GVT_INST);
2879 	assert((v->gv_flags & GV_CONFIGURED) == 0);
2880 
2881 	/* GV_INSUBGRAPH should already be set properly. */
2882 	assert(should_be_in_subgraph(v) ==
2883 	    ((v->gv_flags & GV_INSUBGRAPH) != 0));
2884 
2885 	log_framework(LOG_DEBUG, "Graph adding %s.\n", v->gv_name);
2886 
2887 	h = scf_instance_handle(inst);
2888 
2889 	/*
2890 	 * If the instance does not have a restarter property group,
2891 	 * initialize its state to uninitialized/none, in case the restarter
2892 	 * is not enabled.
2893 	 */
2894 	pg = safe_scf_pg_create(h);
2895 
2896 	if (scf_instance_get_pg(inst, SCF_PG_RESTARTER, pg) != 0) {
2897 		instance_data_t idata;
2898 		uint_t count = 0, msecs = ALLOC_DELAY;
2899 
2900 		switch (scf_error()) {
2901 		case SCF_ERROR_NOT_FOUND:
2902 			break;
2903 
2904 		case SCF_ERROR_CONNECTION_BROKEN:
2905 		default:
2906 			scf_pg_destroy(pg);
2907 			return (ECONNABORTED);
2908 
2909 		case SCF_ERROR_DELETED:
2910 			scf_pg_destroy(pg);
2911 			return (ECANCELED);
2912 
2913 		case SCF_ERROR_NOT_SET:
2914 			bad_error("scf_instance_get_pg", scf_error());
2915 		}
2916 
2917 		switch (err = libscf_instance_get_fmri(inst,
2918 		    (char **)&idata.i_fmri)) {
2919 		case 0:
2920 			break;
2921 
2922 		case ECONNABORTED:
2923 		case ECANCELED:
2924 			scf_pg_destroy(pg);
2925 			return (err);
2926 
2927 		default:
2928 			bad_error("libscf_instance_get_fmri", err);
2929 		}
2930 
2931 		idata.i_state = RESTARTER_STATE_NONE;
2932 		idata.i_next_state = RESTARTER_STATE_NONE;
2933 
2934 init_state:
2935 		switch (err = _restarter_commit_states(h, &idata,
2936 		    RESTARTER_STATE_UNINIT, RESTARTER_STATE_NONE, NULL)) {
2937 		case 0:
2938 			break;
2939 
2940 		case ENOMEM:
2941 			++count;
2942 			if (count < ALLOC_RETRY) {
2943 				(void) poll(NULL, 0, msecs);
2944 				msecs *= ALLOC_DELAY_MULT;
2945 				goto init_state;
2946 			}
2947 
2948 			uu_die("Insufficient memory.\n");
2949 			/* NOTREACHED */
2950 
2951 		case ECONNABORTED:
2952 			startd_free((void *)idata.i_fmri, max_scf_fmri_size);
2953 			scf_pg_destroy(pg);
2954 			return (ECONNABORTED);
2955 
2956 		case ENOENT:
2957 			startd_free((void *)idata.i_fmri, max_scf_fmri_size);
2958 			scf_pg_destroy(pg);
2959 			return (ECANCELED);
2960 
2961 		case EPERM:
2962 		case EACCES:
2963 		case EROFS:
2964 			log_error(LOG_NOTICE, "Could not initialize state for "
2965 			    "%s: %s.\n", idata.i_fmri, strerror(err));
2966 			break;
2967 
2968 		case EINVAL:
2969 		default:
2970 			bad_error("_restarter_commit_states", err);
2971 		}
2972 
2973 		startd_free((void *)idata.i_fmri, max_scf_fmri_size);
2974 	}
2975 
2976 	scf_pg_destroy(pg);
2977 
2978 	if (milestone != NULL) {
2979 		/*
2980 		 * Make sure the enable-override is set properly before we
2981 		 * read whether we should be enabled.
2982 		 */
2983 		if (milestone == MILESTONE_NONE ||
2984 		    !(v->gv_flags & GV_INSUBGRAPH)) {
2985 			/*
2986 			 * This might seem unjustified after the milestone
2987 			 * transition has completed (non_subgraph_svcs == 0),
2988 			 * but it's important because when we boot to
2989 			 * a milestone, we set the milestone before populating
2990 			 * the graph, and all of the new non-subgraph services
2991 			 * need to be disabled here.
2992 			 */
2993 			switch (err = libscf_set_enable_ovr(inst, 0)) {
2994 			case 0:
2995 				break;
2996 
2997 			case ECONNABORTED:
2998 			case ECANCELED:
2999 				return (err);
3000 
3001 			case EROFS:
3002 				log_error(LOG_WARNING,
3003 				    "Could not set %s/%s for %s: %s.\n",
3004 				    SCF_PG_GENERAL_OVR, SCF_PROPERTY_ENABLED,
3005 				    v->gv_name, strerror(err));
3006 				break;
3007 
3008 			case EPERM:
3009 				uu_die("Permission denied.\n");
3010 				/* NOTREACHED */
3011 
3012 			default:
3013 				bad_error("libscf_set_enable_ovr", err);
3014 			}
3015 		} else {
3016 			assert(v->gv_flags & GV_INSUBGRAPH);
3017 			switch (err = libscf_delete_enable_ovr(inst)) {
3018 			case 0:
3019 				break;
3020 
3021 			case ECONNABORTED:
3022 			case ECANCELED:
3023 				return (err);
3024 
3025 			case EPERM:
3026 				uu_die("Permission denied.\n");
3027 				/* NOTREACHED */
3028 
3029 			default:
3030 				bad_error("libscf_delete_enable_ovr", err);
3031 			}
3032 		}
3033 	}
3034 
3035 	err = libscf_get_basic_instance_data(h, inst, v->gv_name, &enabled,
3036 	    &enabled_ovr, &restarter_fmri);
3037 	switch (err) {
3038 	case 0:
3039 		break;
3040 
3041 	case ECONNABORTED:
3042 	case ECANCELED:
3043 		startd_free(restarter_fmri, max_scf_value_size);
3044 		return (err);
3045 
3046 	case ENOENT:
3047 		log_framework(LOG_DEBUG,
3048 		    "Ignoring %s because it has no general property group.\n",
3049 		    v->gv_name);
3050 		startd_free(restarter_fmri, max_scf_value_size);
3051 		return (0);
3052 
3053 	default:
3054 		bad_error("libscf_get_basic_instance_data", err);
3055 	}
3056 
3057 	if (enabled == -1) {
3058 		startd_free(restarter_fmri, max_scf_value_size);
3059 		return (0);
3060 	}
3061 
3062 	v->gv_flags = (v->gv_flags & ~GV_ENBLD_NOOVR) |
3063 	    (enabled ? GV_ENBLD_NOOVR : 0);
3064 
3065 	if (enabled_ovr != -1)
3066 		enabled = enabled_ovr;
3067 
3068 	v->gv_state = RESTARTER_STATE_UNINIT;
3069 
3070 	snap = libscf_get_or_make_running_snapshot(inst, v->gv_name, B_TRUE);
3071 	scf_snapshot_destroy(snap);
3072 
3073 	/* Set up the restarter. (Sends _ADD_INSTANCE on success.) */
3074 	err = graph_change_restarter(v, restarter_fmri, h, &path);
3075 	if (err != 0) {
3076 		instance_data_t idata;
3077 		uint_t count = 0, msecs = ALLOC_DELAY;
3078 		const char *reason;
3079 
3080 		if (err == ECONNABORTED) {
3081 			startd_free(restarter_fmri, max_scf_value_size);
3082 			return (err);
3083 		}
3084 
3085 		assert(err == EINVAL || err == ELOOP);
3086 
3087 		if (err == EINVAL) {
3088 			log_framework(LOG_ERR, emsg_invalid_restarter,
3089 			    v->gv_name);
3090 			reason = "invalid_restarter";
3091 		} else {
3092 			handle_cycle(v->gv_name, path);
3093 			reason = "dependency_cycle";
3094 		}
3095 
3096 		startd_free(restarter_fmri, max_scf_value_size);
3097 
3098 		/*
3099 		 * We didn't register the instance with the restarter, so we
3100 		 * must set maintenance mode ourselves.
3101 		 */
3102 		err = libscf_instance_get_fmri(inst, (char **)&idata.i_fmri);
3103 		if (err != 0) {
3104 			assert(err == ECONNABORTED || err == ECANCELED);
3105 			return (err);
3106 		}
3107 
3108 		idata.i_state = RESTARTER_STATE_NONE;
3109 		idata.i_next_state = RESTARTER_STATE_NONE;
3110 
3111 set_maint:
3112 		switch (err = _restarter_commit_states(h, &idata,
3113 		    RESTARTER_STATE_MAINT, RESTARTER_STATE_NONE, reason)) {
3114 		case 0:
3115 			break;
3116 
3117 		case ENOMEM:
3118 			++count;
3119 			if (count < ALLOC_RETRY) {
3120 				(void) poll(NULL, 0, msecs);
3121 				msecs *= ALLOC_DELAY_MULT;
3122 				goto set_maint;
3123 			}
3124 
3125 			uu_die("Insufficient memory.\n");
3126 			/* NOTREACHED */
3127 
3128 		case ECONNABORTED:
3129 			startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3130 			return (ECONNABORTED);
3131 
3132 		case ENOENT:
3133 			startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3134 			return (ECANCELED);
3135 
3136 		case EPERM:
3137 		case EACCES:
3138 		case EROFS:
3139 			log_error(LOG_NOTICE, "Could not initialize state for "
3140 			    "%s: %s.\n", idata.i_fmri, strerror(err));
3141 			break;
3142 
3143 		case EINVAL:
3144 		default:
3145 			bad_error("_restarter_commit_states", err);
3146 		}
3147 
3148 		startd_free((void *)idata.i_fmri, max_scf_fmri_size);
3149 
3150 		v->gv_state = RESTARTER_STATE_MAINT;
3151 
3152 		goto out;
3153 	}
3154 	startd_free(restarter_fmri, max_scf_value_size);
3155 
3156 	/* Add all the other dependencies. */
3157 	err = refresh_vertex(v, inst);
3158 	if (err != 0) {
3159 		assert(err == ECONNABORTED);
3160 		return (err);
3161 	}
3162 
3163 out:
3164 	v->gv_flags |= GV_CONFIGURED;
3165 
3166 	graph_enable_by_vertex(v, enabled, 0);
3167 
3168 	return (0);
3169 }
3170 
3171 static void
3172 do_uadmin(void)
3173 {
3174 	int fd, left;
3175 	struct statvfs vfs;
3176 
3177 	const char * const resetting = "/etc/svc/volatile/resetting";
3178 
3179 	fd = creat(resetting, 0777);
3180 	if (fd >= 0)
3181 		startd_close(fd);
3182 	else
3183 		uu_warn("Could not create \"%s\"", resetting);
3184 
3185 	/* Kill dhcpagent if we're not using nfs for root */
3186 	if ((statvfs("/", &vfs) == 0) &&
3187 	    (strncmp(vfs.f_basetype, "nfs", sizeof ("nfs") - 1) != 0))
3188 		(void) system("/usr/bin/pkill -x -u 0 dhcpagent");
3189 
3190 	(void) system("/usr/sbin/killall");
3191 	left = 5;
3192 	while (left > 0)
3193 		left = sleep(left);
3194 
3195 	(void) system("/usr/sbin/killall 9");
3196 	left = 10;
3197 	while (left > 0)
3198 		left = sleep(left);
3199 
3200 	sync();
3201 	sync();
3202 	sync();
3203 
3204 	(void) system("/sbin/umountall");
3205 	(void) system("/sbin/umount /tmp >/dev/null 2>&1");
3206 	(void) system("/sbin/umount /var/adm >/dev/null 2>&1");
3207 	(void) system("/sbin/umount /var/run >/dev/null 2>&1");
3208 	(void) system("/sbin/umount /var >/dev/null 2>&1");
3209 	(void) system("/sbin/umount /usr >/dev/null 2>&1");
3210 
3211 	uu_warn("The system is down.\n");
3212 
3213 	(void) uadmin(A_SHUTDOWN, halting, NULL);
3214 	uu_warn("uadmin() failed");
3215 
3216 	if (remove(resetting) != 0 && errno != ENOENT)
3217 		uu_warn("Could not remove \"%s\"", resetting);
3218 }
3219 
3220 /*
3221  * If any of the up_svcs[] are online or satisfiable, return true.  If they are
3222  * all missing, disabled, in maintenance, or unsatisfiable, return false.
3223  */
3224 boolean_t
3225 can_come_up(void)
3226 {
3227 	int i;
3228 
3229 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
3230 
3231 	/*
3232 	 * If we are booting to single user (boot -s),
3233 	 * SCF_MILESTONE_SINGLE_USER is needed to come up because startd
3234 	 * spawns sulogin after single-user is online (see specials.c).
3235 	 */
3236 	i = (booting_to_single_user ? 0 : 1);
3237 
3238 	for (; up_svcs[i] != NULL; ++i) {
3239 		if (up_svcs_p[i] == NULL) {
3240 			up_svcs_p[i] = vertex_get_by_name(up_svcs[i]);
3241 
3242 			if (up_svcs_p[i] == NULL)
3243 				continue;
3244 		}
3245 
3246 		/*
3247 		 * Ignore unconfigured services (the ones that have been
3248 		 * mentioned in a dependency from other services, but do
3249 		 * not exist in the repository).  Services which exist
3250 		 * in the repository but don't have general/enabled
3251 		 * property will be also ignored.
3252 		 */
3253 		if (!(up_svcs_p[i]->gv_flags & GV_CONFIGURED))
3254 			continue;
3255 
3256 		switch (up_svcs_p[i]->gv_state) {
3257 		case RESTARTER_STATE_ONLINE:
3258 		case RESTARTER_STATE_DEGRADED:
3259 			/*
3260 			 * Deactivate verbose boot once a login service has been
3261 			 * reached.
3262 			 */
3263 			st->st_log_login_reached = 1;
3264 			/*FALLTHROUGH*/
3265 		case RESTARTER_STATE_UNINIT:
3266 			return (B_TRUE);
3267 
3268 		case RESTARTER_STATE_OFFLINE:
3269 			if (instance_satisfied(up_svcs_p[i], B_TRUE) != -1)
3270 				return (B_TRUE);
3271 			log_framework(LOG_DEBUG,
3272 			    "can_come_up(): %s is unsatisfiable.\n",
3273 			    up_svcs_p[i]->gv_name);
3274 			continue;
3275 
3276 		case RESTARTER_STATE_DISABLED:
3277 		case RESTARTER_STATE_MAINT:
3278 			log_framework(LOG_DEBUG,
3279 			    "can_come_up(): %s is in state %s.\n",
3280 			    up_svcs_p[i]->gv_name,
3281 			    instance_state_str[up_svcs_p[i]->gv_state]);
3282 			continue;
3283 
3284 		default:
3285 #ifndef NDEBUG
3286 			uu_warn("%s:%d: Unexpected vertex state %d.\n",
3287 			    __FILE__, __LINE__, up_svcs_p[i]->gv_state);
3288 #endif
3289 			abort();
3290 		}
3291 	}
3292 
3293 	/*
3294 	 * In the seed repository, console-login is unsatisfiable because
3295 	 * services are missing.  To behave correctly in that case we don't want
3296 	 * to return false until manifest-import is online.
3297 	 */
3298 
3299 	if (manifest_import_p == NULL) {
3300 		manifest_import_p = vertex_get_by_name(manifest_import);
3301 
3302 		if (manifest_import_p == NULL)
3303 			return (B_FALSE);
3304 	}
3305 
3306 	switch (manifest_import_p->gv_state) {
3307 	case RESTARTER_STATE_ONLINE:
3308 	case RESTARTER_STATE_DEGRADED:
3309 	case RESTARTER_STATE_DISABLED:
3310 	case RESTARTER_STATE_MAINT:
3311 		break;
3312 
3313 	case RESTARTER_STATE_OFFLINE:
3314 		if (instance_satisfied(manifest_import_p, B_TRUE) == -1)
3315 			break;
3316 		/* FALLTHROUGH */
3317 
3318 	case RESTARTER_STATE_UNINIT:
3319 		return (B_TRUE);
3320 	}
3321 
3322 	return (B_FALSE);
3323 }
3324 
3325 /*
3326  * Runs sulogin.  Returns
3327  *   0 - success
3328  *   EALREADY - sulogin is already running
3329  *   EBUSY - console-login is running
3330  */
3331 static int
3332 run_sulogin(const char *msg)
3333 {
3334 	graph_vertex_t *v;
3335 
3336 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
3337 
3338 	if (sulogin_running)
3339 		return (EALREADY);
3340 
3341 	v = vertex_get_by_name(console_login_fmri);
3342 	if (v != NULL && inst_running(v))
3343 		return (EBUSY);
3344 
3345 	sulogin_running = B_TRUE;
3346 
3347 	MUTEX_UNLOCK(&dgraph_lock);
3348 
3349 	fork_sulogin(B_FALSE, msg);
3350 
3351 	MUTEX_LOCK(&dgraph_lock);
3352 
3353 	sulogin_running = B_FALSE;
3354 
3355 	if (console_login_ready) {
3356 		v = vertex_get_by_name(console_login_fmri);
3357 
3358 		if (v != NULL && v->gv_state == RESTARTER_STATE_OFFLINE &&
3359 		    !inst_running(v)) {
3360 			if (v->gv_start_f == NULL)
3361 				vertex_send_event(v,
3362 				    RESTARTER_EVENT_TYPE_START);
3363 			else
3364 				v->gv_start_f(v);
3365 		}
3366 
3367 		console_login_ready = B_FALSE;
3368 	}
3369 
3370 	return (0);
3371 }
3372 
3373 /*
3374  * The sulogin thread runs sulogin while can_come_up() is false.  run_sulogin()
3375  * keeps sulogin from stepping on console-login's toes.
3376  */
3377 /* ARGSUSED */
3378 static void *
3379 sulogin_thread(void *unused)
3380 {
3381 	MUTEX_LOCK(&dgraph_lock);
3382 
3383 	assert(sulogin_thread_running);
3384 
3385 	do {
3386 		(void) run_sulogin("Console login service(s) cannot run\n");
3387 	} while (!can_come_up());
3388 
3389 	sulogin_thread_running = B_FALSE;
3390 	MUTEX_UNLOCK(&dgraph_lock);
3391 
3392 	return (NULL);
3393 }
3394 
3395 /* ARGSUSED */
3396 void *
3397 single_user_thread(void *unused)
3398 {
3399 	uint_t left;
3400 	scf_handle_t *h;
3401 	scf_instance_t *inst;
3402 	scf_property_t *prop;
3403 	scf_value_t *val;
3404 	const char *msg;
3405 	char *buf;
3406 	int r;
3407 
3408 	MUTEX_LOCK(&single_user_thread_lock);
3409 	single_user_thread_count++;
3410 
3411 	if (!booting_to_single_user) {
3412 		/*
3413 		 * From rcS.sh: Look for ttymon, in.telnetd, in.rlogind and
3414 		 * processes in their process groups so they can be terminated.
3415 		 */
3416 		(void) fputs("svc.startd: Killing user processes: ", stdout);
3417 		(void) system("/usr/sbin/killall");
3418 		(void) system("/usr/sbin/killall 9");
3419 		(void) system("/usr/bin/pkill -TERM -v -u 0,1");
3420 
3421 		left = 5;
3422 		while (left > 0)
3423 			left = sleep(left);
3424 
3425 		(void) system("/usr/bin/pkill -KILL -v -u 0,1");
3426 		(void) puts("done.");
3427 	}
3428 
3429 	if (go_single_user_mode || booting_to_single_user) {
3430 		msg = "SINGLE USER MODE\n";
3431 	} else {
3432 		assert(go_to_level1);
3433 
3434 		fork_rc_script('1', "start", B_TRUE);
3435 
3436 		uu_warn("The system is ready for administration.\n");
3437 
3438 		msg = "";
3439 	}
3440 
3441 	MUTEX_UNLOCK(&single_user_thread_lock);
3442 
3443 	for (;;) {
3444 		MUTEX_LOCK(&dgraph_lock);
3445 		r = run_sulogin(msg);
3446 		MUTEX_UNLOCK(&dgraph_lock);
3447 		if (r == 0)
3448 			break;
3449 
3450 		assert(r == EALREADY || r == EBUSY);
3451 
3452 		left = 3;
3453 		while (left > 0)
3454 			left = sleep(left);
3455 	}
3456 
3457 	MUTEX_LOCK(&single_user_thread_lock);
3458 
3459 	/*
3460 	 * If another single user thread has started, let it finish changing
3461 	 * the run level.
3462 	 */
3463 	if (single_user_thread_count > 1) {
3464 		single_user_thread_count--;
3465 		MUTEX_UNLOCK(&single_user_thread_lock);
3466 		return (NULL);
3467 	}
3468 
3469 	h = libscf_handle_create_bound_loop();
3470 	inst = scf_instance_create(h);
3471 	prop = safe_scf_property_create(h);
3472 	val = safe_scf_value_create(h);
3473 	buf = startd_alloc(max_scf_fmri_size);
3474 
3475 lookup:
3476 	if (scf_handle_decode_fmri(h, SCF_SERVICE_STARTD, NULL, NULL, inst,
3477 	    NULL, NULL, SCF_DECODE_FMRI_EXACT) != 0) {
3478 		switch (scf_error()) {
3479 		case SCF_ERROR_NOT_FOUND:
3480 			r = libscf_create_self(h);
3481 			if (r == 0)
3482 				goto lookup;
3483 			assert(r == ECONNABORTED);
3484 			/* FALLTHROUGH */
3485 
3486 		case SCF_ERROR_CONNECTION_BROKEN:
3487 			libscf_handle_rebind(h);
3488 			goto lookup;
3489 
3490 		case SCF_ERROR_INVALID_ARGUMENT:
3491 		case SCF_ERROR_CONSTRAINT_VIOLATED:
3492 		case SCF_ERROR_NOT_BOUND:
3493 		case SCF_ERROR_HANDLE_MISMATCH:
3494 		default:
3495 			bad_error("scf_handle_decode_fmri", scf_error());
3496 		}
3497 	}
3498 
3499 	MUTEX_LOCK(&dgraph_lock);
3500 
3501 	r = libscf_inst_delete_prop(inst, SCF_PG_OPTIONS_OVR,
3502 	    SCF_PROPERTY_MILESTONE);
3503 	switch (r) {
3504 	case 0:
3505 	case ECANCELED:
3506 		break;
3507 
3508 	case ECONNABORTED:
3509 		MUTEX_UNLOCK(&dgraph_lock);
3510 		libscf_handle_rebind(h);
3511 		goto lookup;
3512 
3513 	case EPERM:
3514 	case EACCES:
3515 	case EROFS:
3516 		log_error(LOG_WARNING, "Could not clear temporary milestone: "
3517 		    "%s.\n", strerror(r));
3518 		break;
3519 
3520 	default:
3521 		bad_error("libscf_inst_delete_prop", r);
3522 	}
3523 
3524 	MUTEX_UNLOCK(&dgraph_lock);
3525 
3526 	r = libscf_get_milestone(inst, prop, val, buf, max_scf_fmri_size);
3527 	switch (r) {
3528 	case ECANCELED:
3529 	case ENOENT:
3530 	case EINVAL:
3531 		(void) strcpy(buf, "all");
3532 		/* FALLTHROUGH */
3533 
3534 	case 0:
3535 		uu_warn("Returning to milestone %s.\n", buf);
3536 		break;
3537 
3538 	case ECONNABORTED:
3539 		libscf_handle_rebind(h);
3540 		goto lookup;
3541 
3542 	default:
3543 		bad_error("libscf_get_milestone", r);
3544 	}
3545 
3546 	r = dgraph_set_milestone(buf, h, B_FALSE);
3547 	switch (r) {
3548 	case 0:
3549 	case ECONNRESET:
3550 	case EALREADY:
3551 	case EINVAL:
3552 	case ENOENT:
3553 		break;
3554 
3555 	default:
3556 		bad_error("dgraph_set_milestone", r);
3557 	}
3558 
3559 	/*
3560 	 * See graph_runlevel_changed().
3561 	 */
3562 	MUTEX_LOCK(&dgraph_lock);
3563 	utmpx_set_runlevel(target_milestone_as_runlevel(), 'S', B_TRUE);
3564 	MUTEX_UNLOCK(&dgraph_lock);
3565 
3566 	startd_free(buf, max_scf_fmri_size);
3567 	scf_value_destroy(val);
3568 	scf_property_destroy(prop);
3569 	scf_instance_destroy(inst);
3570 	scf_handle_destroy(h);
3571 
3572 	/*
3573 	 * We'll give ourselves 3 seconds to respond to all of the enablings
3574 	 * that setting the milestone should have created before checking
3575 	 * whether to run sulogin.
3576 	 */
3577 	left = 3;
3578 	while (left > 0)
3579 		left = sleep(left);
3580 
3581 	MUTEX_LOCK(&dgraph_lock);
3582 	/*
3583 	 * Clearing these variables will allow the sulogin thread to run.  We
3584 	 * check here in case there aren't any more state updates anytime soon.
3585 	 */
3586 	go_to_level1 = go_single_user_mode = booting_to_single_user = B_FALSE;
3587 	if (!sulogin_thread_running && !can_come_up()) {
3588 		(void) startd_thread_create(sulogin_thread, NULL);
3589 		sulogin_thread_running = B_TRUE;
3590 	}
3591 	MUTEX_UNLOCK(&dgraph_lock);
3592 	single_user_thread_count--;
3593 	MUTEX_UNLOCK(&single_user_thread_lock);
3594 	return (NULL);
3595 }
3596 
3597 
3598 /*
3599  * Dependency graph operations API.  These are handle-independent thread-safe
3600  * graph manipulation functions which are the entry points for the event
3601  * threads below.
3602  */
3603 
3604 /*
3605  * If a configured vertex exists for inst_fmri, return EEXIST.  If no vertex
3606  * exists for inst_fmri, add one.  Then fetch the restarter from inst, make
3607  * this vertex dependent on it, and send _ADD_INSTANCE to the restarter.
3608  * Fetch whether the instance should be enabled from inst and send _ENABLE or
3609  * _DISABLE as appropriate.  Finally rummage through inst's dependency
3610  * property groups and add vertices and edges as appropriate.  If anything
3611  * goes wrong after sending _ADD_INSTANCE, send _ADMIN_MAINT_ON to put the
3612  * instance in maintenance.  Don't send _START or _STOP until we get a state
3613  * update in case we're being restarted and the service is already running.
3614  *
3615  * To support booting to a milestone, we must also make sure all dependencies
3616  * encountered are configured, if they exist in the repository.
3617  *
3618  * Returns 0 on success, ECONNABORTED on repository disconnection, EINVAL if
3619  * inst_fmri is an invalid (or not canonical) FMRI, ECANCELED if inst is
3620  * deleted, or EEXIST if a configured vertex for inst_fmri already exists.
3621  */
3622 int
3623 dgraph_add_instance(const char *inst_fmri, scf_instance_t *inst,
3624     boolean_t lock_graph)
3625 {
3626 	graph_vertex_t *v;
3627 	int err;
3628 
3629 	if (strcmp(inst_fmri, SCF_SERVICE_STARTD) == 0)
3630 		return (0);
3631 
3632 	/* Check for a vertex for inst_fmri. */
3633 	if (lock_graph) {
3634 		MUTEX_LOCK(&dgraph_lock);
3635 	} else {
3636 		assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
3637 	}
3638 
3639 	v = vertex_get_by_name(inst_fmri);
3640 
3641 	if (v != NULL) {
3642 		assert(v->gv_type == GVT_INST);
3643 
3644 		if (v->gv_flags & GV_CONFIGURED) {
3645 			if (lock_graph)
3646 				MUTEX_UNLOCK(&dgraph_lock);
3647 			return (EEXIST);
3648 		}
3649 	} else {
3650 		/* Add the vertex. */
3651 		err = graph_insert_vertex_unconfigured(inst_fmri, GVT_INST, 0,
3652 		    RERR_NONE, &v);
3653 		if (err != 0) {
3654 			assert(err == EINVAL);
3655 			if (lock_graph)
3656 				MUTEX_UNLOCK(&dgraph_lock);
3657 			return (EINVAL);
3658 		}
3659 	}
3660 
3661 	err = configure_vertex(v, inst);
3662 
3663 	if (lock_graph)
3664 		MUTEX_UNLOCK(&dgraph_lock);
3665 
3666 	return (err);
3667 }
3668 
3669 /*
3670  * Locate the vertex for this property group's instance.  If it doesn't exist
3671  * or is unconfigured, call dgraph_add_instance() & return.  Otherwise fetch
3672  * the restarter for the instance, and if it has changed, send
3673  * _REMOVE_INSTANCE to the old restarter, remove the dependency, make sure the
3674  * new restarter has a vertex, add a new dependency, and send _ADD_INSTANCE to
3675  * the new restarter.  Then fetch whether the instance should be enabled, and
3676  * if it is different from what we had, or if we changed the restarter, send
3677  * the appropriate _ENABLE or _DISABLE command.
3678  *
3679  * Returns 0 on success, ENOTSUP if the pg's parent is not an instance,
3680  * ECONNABORTED on repository disconnection, ECANCELED if the instance is
3681  * deleted, or -1 if the instance's general property group is deleted or if
3682  * its enabled property is misconfigured.
3683  */
3684 static int
3685 dgraph_update_general(scf_propertygroup_t *pg)
3686 {
3687 	scf_handle_t *h;
3688 	scf_instance_t *inst;
3689 	char *fmri;
3690 	char *restarter_fmri;
3691 	graph_vertex_t *v;
3692 	int err;
3693 	int enabled, enabled_ovr;
3694 	int oldflags;
3695 
3696 	/* Find the vertex for this service */
3697 	h = scf_pg_handle(pg);
3698 
3699 	inst = safe_scf_instance_create(h);
3700 
3701 	if (scf_pg_get_parent_instance(pg, inst) != 0) {
3702 		switch (scf_error()) {
3703 		case SCF_ERROR_CONSTRAINT_VIOLATED:
3704 			return (ENOTSUP);
3705 
3706 		case SCF_ERROR_CONNECTION_BROKEN:
3707 		default:
3708 			return (ECONNABORTED);
3709 
3710 		case SCF_ERROR_DELETED:
3711 			return (0);
3712 
3713 		case SCF_ERROR_NOT_SET:
3714 			bad_error("scf_pg_get_parent_instance", scf_error());
3715 		}
3716 	}
3717 
3718 	err = libscf_instance_get_fmri(inst, &fmri);
3719 	switch (err) {
3720 	case 0:
3721 		break;
3722 
3723 	case ECONNABORTED:
3724 		scf_instance_destroy(inst);
3725 		return (ECONNABORTED);
3726 
3727 	case ECANCELED:
3728 		scf_instance_destroy(inst);
3729 		return (0);
3730 
3731 	default:
3732 		bad_error("libscf_instance_get_fmri", err);
3733 	}
3734 
3735 	log_framework(LOG_DEBUG,
3736 	    "Graph engine: Reloading general properties for %s.\n", fmri);
3737 
3738 	MUTEX_LOCK(&dgraph_lock);
3739 
3740 	v = vertex_get_by_name(fmri);
3741 	if (v == NULL || !(v->gv_flags & GV_CONFIGURED)) {
3742 		/* Will get the up-to-date properties. */
3743 		MUTEX_UNLOCK(&dgraph_lock);
3744 		err = dgraph_add_instance(fmri, inst, B_TRUE);
3745 		startd_free(fmri, max_scf_fmri_size);
3746 		scf_instance_destroy(inst);
3747 		return (err == ECANCELED ? 0 : err);
3748 	}
3749 
3750 	/* Read enabled & restarter from repository. */
3751 	restarter_fmri = startd_alloc(max_scf_value_size);
3752 	err = libscf_get_basic_instance_data(h, inst, v->gv_name, &enabled,
3753 	    &enabled_ovr, &restarter_fmri);
3754 	if (err != 0 || enabled == -1) {
3755 		MUTEX_UNLOCK(&dgraph_lock);
3756 		scf_instance_destroy(inst);
3757 		startd_free(fmri, max_scf_fmri_size);
3758 
3759 		switch (err) {
3760 		case ENOENT:
3761 		case 0:
3762 			startd_free(restarter_fmri, max_scf_value_size);
3763 			return (-1);
3764 
3765 		case ECONNABORTED:
3766 		case ECANCELED:
3767 			startd_free(restarter_fmri, max_scf_value_size);
3768 			return (err);
3769 
3770 		default:
3771 			bad_error("libscf_get_basic_instance_data", err);
3772 		}
3773 	}
3774 
3775 	oldflags = v->gv_flags;
3776 	v->gv_flags = (v->gv_flags & ~GV_ENBLD_NOOVR) |
3777 	    (enabled ? GV_ENBLD_NOOVR : 0);
3778 
3779 	if (enabled_ovr != -1)
3780 		enabled = enabled_ovr;
3781 
3782 	/*
3783 	 * If GV_ENBLD_NOOVR has changed, then we need to re-evaluate the
3784 	 * subgraph.
3785 	 */
3786 	if (milestone > MILESTONE_NONE && v->gv_flags != oldflags)
3787 		(void) eval_subgraph(v, h);
3788 
3789 	scf_instance_destroy(inst);
3790 
3791 	/* Ignore restarter change for now. */
3792 
3793 	startd_free(restarter_fmri, max_scf_value_size);
3794 	startd_free(fmri, max_scf_fmri_size);
3795 
3796 	/*
3797 	 * Always send _ENABLE or _DISABLE.  We could avoid this if the
3798 	 * restarter didn't change and the enabled value didn't change, but
3799 	 * that's not easy to check and improbable anyway, so we'll just do
3800 	 * this.
3801 	 */
3802 	graph_enable_by_vertex(v, enabled, 1);
3803 
3804 	MUTEX_UNLOCK(&dgraph_lock);
3805 
3806 	return (0);
3807 }
3808 
3809 /*
3810  * Delete all of the property group dependencies of v, update inst's running
3811  * snapshot, and add the dependencies in the new snapshot.  If any of the new
3812  * dependencies would create a cycle, send _ADMIN_MAINT_ON.  Otherwise
3813  * reevaluate v's dependencies, send _START or _STOP as appropriate, and do
3814  * the same for v's dependents.
3815  *
3816  * Returns
3817  *   0 - success
3818  *   ECONNABORTED - repository connection broken
3819  *   ECANCELED - inst was deleted
3820  *   EINVAL - inst is invalid (e.g., missing general/enabled)
3821  *   -1 - libscf_snapshots_refresh() failed
3822  */
3823 static int
3824 dgraph_refresh_instance(graph_vertex_t *v, scf_instance_t *inst)
3825 {
3826 	int r;
3827 	int enabled;
3828 
3829 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
3830 	assert(v->gv_type == GVT_INST);
3831 
3832 	/* Only refresh services with valid general/enabled properties. */
3833 	r = libscf_get_basic_instance_data(scf_instance_handle(inst), inst,
3834 	    v->gv_name, &enabled, NULL, NULL);
3835 	switch (r) {
3836 	case 0:
3837 		break;
3838 
3839 	case ECONNABORTED:
3840 	case ECANCELED:
3841 		return (r);
3842 
3843 	case ENOENT:
3844 		log_framework(LOG_DEBUG,
3845 		    "Ignoring %s because it has no general property group.\n",
3846 		    v->gv_name);
3847 		return (EINVAL);
3848 
3849 	default:
3850 		bad_error("libscf_get_basic_instance_data", r);
3851 	}
3852 
3853 	if (enabled == -1)
3854 		return (EINVAL);
3855 
3856 	r = libscf_snapshots_refresh(inst, v->gv_name);
3857 	if (r != 0) {
3858 		if (r != -1)
3859 			bad_error("libscf_snapshots_refresh", r);
3860 
3861 		/* error logged */
3862 		return (r);
3863 	}
3864 
3865 	r = refresh_vertex(v, inst);
3866 	if (r != 0 && r != ECONNABORTED)
3867 		bad_error("refresh_vertex", r);
3868 	return (r);
3869 }
3870 
3871 /*
3872  * Returns true only if none of this service's dependents are 'up' -- online,
3873  * degraded, or offline.
3874  */
3875 static int
3876 is_nonsubgraph_leaf(graph_vertex_t *v)
3877 {
3878 	graph_vertex_t *vv;
3879 	graph_edge_t *e;
3880 
3881 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
3882 
3883 	for (e = uu_list_first(v->gv_dependents);
3884 	    e != NULL;
3885 	    e = uu_list_next(v->gv_dependents, e)) {
3886 
3887 		vv = e->ge_vertex;
3888 		if (vv->gv_type == GVT_INST) {
3889 			if ((vv->gv_flags & GV_CONFIGURED) == 0)
3890 				continue;
3891 
3892 			if (vv->gv_flags & GV_INSUBGRAPH)
3893 				continue;
3894 
3895 			if (up_state(vv->gv_state))
3896 				return (0);
3897 		} else {
3898 			/*
3899 			 * For dependency group or service vertices, keep
3900 			 * traversing to see if instances are running.
3901 			 */
3902 			if (!is_nonsubgraph_leaf(vv))
3903 				return (0);
3904 		}
3905 	}
3906 
3907 	return (1);
3908 }
3909 
3910 /*
3911  * Disable v temporarily.  Attempt to do this by setting its enabled override
3912  * property in the repository.  If that fails, send a _DISABLE command.
3913  * Returns 0 on success and ECONNABORTED if the repository connection is
3914  * broken.
3915  */
3916 static int
3917 disable_service_temporarily(graph_vertex_t *v, scf_handle_t *h)
3918 {
3919 	const char * const emsg = "Could not temporarily disable %s because "
3920 	    "%s.  Will stop service anyways.  Repository status for the "
3921 	    "service may be inaccurate.\n";
3922 	const char * const emsg_cbroken =
3923 	    "the repository connection was broken";
3924 
3925 	scf_instance_t *inst;
3926 	int r;
3927 
3928 	inst = scf_instance_create(h);
3929 	if (inst == NULL) {
3930 		char buf[100];
3931 
3932 		(void) snprintf(buf, sizeof (buf),
3933 		    "scf_instance_create() failed (%s)",
3934 		    scf_strerror(scf_error()));
3935 		log_error(LOG_WARNING, emsg, v->gv_name, buf);
3936 
3937 		graph_enable_by_vertex(v, 0, 0);
3938 		return (0);
3939 	}
3940 
3941 	r = scf_handle_decode_fmri(h, v->gv_name, NULL, NULL, inst,
3942 	    NULL, NULL, SCF_DECODE_FMRI_EXACT);
3943 	if (r != 0) {
3944 		switch (scf_error()) {
3945 		case SCF_ERROR_CONNECTION_BROKEN:
3946 			log_error(LOG_WARNING, emsg, v->gv_name, emsg_cbroken);
3947 			graph_enable_by_vertex(v, 0, 0);
3948 			return (ECONNABORTED);
3949 
3950 		case SCF_ERROR_NOT_FOUND:
3951 			return (0);
3952 
3953 		case SCF_ERROR_HANDLE_MISMATCH:
3954 		case SCF_ERROR_INVALID_ARGUMENT:
3955 		case SCF_ERROR_CONSTRAINT_VIOLATED:
3956 		case SCF_ERROR_NOT_BOUND:
3957 		default:
3958 			bad_error("scf_handle_decode_fmri",
3959 			    scf_error());
3960 		}
3961 	}
3962 
3963 	r = libscf_set_enable_ovr(inst, 0);
3964 	switch (r) {
3965 	case 0:
3966 		scf_instance_destroy(inst);
3967 		return (0);
3968 
3969 	case ECANCELED:
3970 		scf_instance_destroy(inst);
3971 		return (0);
3972 
3973 	case ECONNABORTED:
3974 		log_error(LOG_WARNING, emsg, v->gv_name, emsg_cbroken);
3975 		graph_enable_by_vertex(v, 0, 0);
3976 		return (ECONNABORTED);
3977 
3978 	case EPERM:
3979 		log_error(LOG_WARNING, emsg, v->gv_name,
3980 		    "the repository denied permission");
3981 		graph_enable_by_vertex(v, 0, 0);
3982 		return (0);
3983 
3984 	case EROFS:
3985 		log_error(LOG_WARNING, emsg, v->gv_name,
3986 		    "the repository is read-only");
3987 		graph_enable_by_vertex(v, 0, 0);
3988 		return (0);
3989 
3990 	default:
3991 		bad_error("libscf_set_enable_ovr", r);
3992 		/* NOTREACHED */
3993 	}
3994 }
3995 
3996 /*
3997  * Of the transitive instance dependencies of v, disable those which are not
3998  * in the subgraph and which are leaves (i.e., have no dependents which are
3999  * "up").
4000  */
4001 static void
4002 disable_nonsubgraph_leaves(graph_vertex_t *v, void *arg)
4003 {
4004 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
4005 
4006 	/*
4007 	 * We must skip exclusion dependencies because they are allowed to
4008 	 * complete dependency cycles.  This is correct because A's exclusion
4009 	 * dependency on B doesn't bear on the order in which they should be
4010 	 * stopped.  Indeed, the exclusion dependency should guarantee that
4011 	 * they are never online at the same time.
4012 	 */
4013 	if (v->gv_type == GVT_GROUP && v->gv_depgroup == DEPGRP_EXCLUDE_ALL)
4014 		return;
4015 
4016 	/* If v isn't an instance, recurse on its dependencies. */
4017 	if (v->gv_type != GVT_INST)
4018 		goto recurse;
4019 
4020 	if ((v->gv_flags & GV_CONFIGURED) == 0)
4021 		/*
4022 		 * Unconfigured instances should have no dependencies, but in
4023 		 * case they ever get them,
4024 		 */
4025 		goto recurse;
4026 
4027 	/*
4028 	 * If v is in the subgraph, so should all of its dependencies, so do
4029 	 * nothing.
4030 	 */
4031 	if (v->gv_flags & GV_INSUBGRAPH)
4032 		return;
4033 
4034 	/* If v isn't a leaf because it's already down, recurse. */
4035 	if (!up_state(v->gv_state))
4036 		goto recurse;
4037 
4038 	/* If v is disabled but not down yet, be patient. */
4039 	if ((v->gv_flags & GV_ENABLED) == 0)
4040 		return;
4041 
4042 	/* If v is a leaf, disable it. */
4043 	if (is_nonsubgraph_leaf(v))
4044 		(void) disable_service_temporarily(v, (scf_handle_t *)arg);
4045 
4046 	return;
4047 
4048 recurse:
4049 	graph_walk_dependencies(v, disable_nonsubgraph_leaves, arg);
4050 }
4051 
4052 /*
4053  * Find the vertex for inst_name.  If it doesn't exist, return ENOENT.
4054  * Otherwise set its state to state.  If the instance has entered a state
4055  * which requires automatic action, take it (Uninitialized: do
4056  * dgraph_refresh_instance() without the snapshot update.  Disabled: if the
4057  * instance should be enabled, send _ENABLE.  Offline: if the instance should
4058  * be disabled, send _DISABLE, and if its dependencies are satisfied, send
4059  * _START.  Online, Degraded: if the instance wasn't running, update its start
4060  * snapshot.  Maintenance: no action.)
4061  *
4062  * Also fails with ECONNABORTED, or EINVAL if state is invalid.
4063  */
4064 static int
4065 dgraph_set_instance_state(scf_handle_t *h, const char *inst_name,
4066     restarter_instance_state_t state, restarter_error_t serr)
4067 {
4068 	graph_vertex_t *v;
4069 	int err = 0;
4070 	restarter_instance_state_t old_state;
4071 
4072 	MUTEX_LOCK(&dgraph_lock);
4073 
4074 	v = vertex_get_by_name(inst_name);
4075 	if (v == NULL) {
4076 		MUTEX_UNLOCK(&dgraph_lock);
4077 		return (ENOENT);
4078 	}
4079 
4080 	assert(v->gv_type == GVT_INST);
4081 
4082 	switch (state) {
4083 	case RESTARTER_STATE_UNINIT:
4084 	case RESTARTER_STATE_DISABLED:
4085 	case RESTARTER_STATE_OFFLINE:
4086 	case RESTARTER_STATE_ONLINE:
4087 	case RESTARTER_STATE_DEGRADED:
4088 	case RESTARTER_STATE_MAINT:
4089 		break;
4090 
4091 	default:
4092 		MUTEX_UNLOCK(&dgraph_lock);
4093 		return (EINVAL);
4094 	}
4095 
4096 	log_framework(LOG_DEBUG, "Graph noting %s %s -> %s.\n", v->gv_name,
4097 	    instance_state_str[v->gv_state], instance_state_str[state]);
4098 
4099 	old_state = v->gv_state;
4100 	v->gv_state = state;
4101 
4102 	err = gt_transition(h, v, serr, old_state);
4103 
4104 	MUTEX_UNLOCK(&dgraph_lock);
4105 	return (err);
4106 }
4107 
4108 /*
4109  * Handle state changes during milestone shutdown.  See
4110  * dgraph_set_milestone().  If the repository connection is broken,
4111  * ECONNABORTED will be returned, though a _DISABLE command will be sent for
4112  * the vertex anyway.
4113  */
4114 int
4115 vertex_subgraph_dependencies_shutdown(scf_handle_t *h, graph_vertex_t *v,
4116     restarter_instance_state_t old_state)
4117 {
4118 	int was_up, now_up;
4119 	int ret = 0;
4120 
4121 	assert(v->gv_type == GVT_INST);
4122 
4123 	/* Don't care if we're not going to a milestone. */
4124 	if (milestone == NULL)
4125 		return (0);
4126 
4127 	/* Don't care if we already finished coming down. */
4128 	if (non_subgraph_svcs == 0)
4129 		return (0);
4130 
4131 	/* Don't care if the service is in the subgraph. */
4132 	if (v->gv_flags & GV_INSUBGRAPH)
4133 		return (0);
4134 
4135 	/*
4136 	 * Update non_subgraph_svcs.  It is the number of non-subgraph
4137 	 * services which are in online, degraded, or offline.
4138 	 */
4139 
4140 	was_up = up_state(old_state);
4141 	now_up = up_state(v->gv_state);
4142 
4143 	if (!was_up && now_up) {
4144 		++non_subgraph_svcs;
4145 	} else if (was_up && !now_up) {
4146 		--non_subgraph_svcs;
4147 
4148 		if (non_subgraph_svcs == 0) {
4149 			if (halting != -1) {
4150 				do_uadmin();
4151 			} else if (go_single_user_mode || go_to_level1) {
4152 				(void) startd_thread_create(single_user_thread,
4153 				    NULL);
4154 			}
4155 			return (0);
4156 		}
4157 	}
4158 
4159 	/* If this service is a leaf, it should be disabled. */
4160 	if ((v->gv_flags & GV_ENABLED) && is_nonsubgraph_leaf(v)) {
4161 		int r;
4162 
4163 		r = disable_service_temporarily(v, h);
4164 		switch (r) {
4165 		case 0:
4166 			break;
4167 
4168 		case ECONNABORTED:
4169 			ret = ECONNABORTED;
4170 			break;
4171 
4172 		default:
4173 			bad_error("disable_service_temporarily", r);
4174 		}
4175 	}
4176 
4177 	/*
4178 	 * If the service just came down, propagate the disable to the newly
4179 	 * exposed leaves.
4180 	 */
4181 	if (was_up && !now_up)
4182 		graph_walk_dependencies(v, disable_nonsubgraph_leaves,
4183 		    (void *)h);
4184 
4185 	return (ret);
4186 }
4187 
4188 /*
4189  * Decide whether to start up an sulogin thread after a service is
4190  * finished changing state.  Only need to do the full can_come_up()
4191  * evaluation if an instance is changing state, we're not halfway through
4192  * loading the thread, and we aren't shutting down or going to the single
4193  * user milestone.
4194  */
4195 void
4196 graph_transition_sulogin(restarter_instance_state_t state,
4197     restarter_instance_state_t old_state)
4198 {
4199 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
4200 
4201 	if (state != old_state && st->st_load_complete &&
4202 	    !go_single_user_mode && !go_to_level1 &&
4203 	    halting == -1) {
4204 		if (!sulogin_thread_running && !can_come_up()) {
4205 			(void) startd_thread_create(sulogin_thread, NULL);
4206 			sulogin_thread_running = B_TRUE;
4207 		}
4208 	}
4209 }
4210 
4211 /*
4212  * Propagate a start, stop event, or a satisfiability event.
4213  *
4214  * PROPAGATE_START and PROPAGATE_STOP simply propagate the transition event
4215  * to direct dependents.  PROPAGATE_SAT propagates a start then walks the
4216  * full dependent graph to check for newly satisfied nodes.  This is
4217  * necessary for cases when non-direct dependents may be effected but direct
4218  * dependents may not (e.g. for optional_all evaluations, see the
4219  * propagate_satbility() comments).
4220  *
4221  * PROPAGATE_SAT should be used whenever a non-running service moves into
4222  * a state which can satisfy optional dependencies, like disabled or
4223  * maintenance.
4224  */
4225 void
4226 graph_transition_propagate(graph_vertex_t *v, propagate_event_t type,
4227     restarter_error_t rerr)
4228 {
4229 	if (type == PROPAGATE_STOP) {
4230 		graph_walk_dependents(v, propagate_stop, (void *)rerr);
4231 	} else if (type == PROPAGATE_START || type == PROPAGATE_SAT) {
4232 		graph_walk_dependents(v, propagate_start, NULL);
4233 
4234 		if (type == PROPAGATE_SAT)
4235 			propagate_satbility(v);
4236 	} else {
4237 #ifndef NDEBUG
4238 		uu_warn("%s:%d: Unexpected type value %d.\n",  __FILE__,
4239 		    __LINE__, type);
4240 #endif
4241 		abort();
4242 	}
4243 }
4244 
4245 /*
4246  * If a vertex for fmri exists and it is enabled, send _DISABLE to the
4247  * restarter.  If it is running, send _STOP.  Send _REMOVE_INSTANCE.  Delete
4248  * all property group dependencies, and the dependency on the restarter,
4249  * disposing of vertices as appropriate.  If other vertices depend on this
4250  * one, mark it unconfigured and return.  Otherwise remove the vertex.  Always
4251  * returns 0.
4252  */
4253 static int
4254 dgraph_remove_instance(const char *fmri, scf_handle_t *h)
4255 {
4256 	graph_vertex_t *v;
4257 	graph_edge_t *e;
4258 	uu_list_t *old_deps;
4259 	int err;
4260 
4261 	log_framework(LOG_DEBUG, "Graph engine: Removing %s.\n", fmri);
4262 
4263 	MUTEX_LOCK(&dgraph_lock);
4264 
4265 	v = vertex_get_by_name(fmri);
4266 	if (v == NULL) {
4267 		MUTEX_UNLOCK(&dgraph_lock);
4268 		return (0);
4269 	}
4270 
4271 	/* Send restarter delete event. */
4272 	if (v->gv_flags & GV_CONFIGURED)
4273 		graph_unset_restarter(v);
4274 
4275 	if (milestone > MILESTONE_NONE) {
4276 		/*
4277 		 * Make a list of v's current dependencies so we can
4278 		 * reevaluate their GV_INSUBGRAPH flags after the dependencies
4279 		 * are removed.
4280 		 */
4281 		old_deps = startd_list_create(graph_edge_pool, NULL, 0);
4282 
4283 		err = uu_list_walk(v->gv_dependencies,
4284 		    (uu_walk_fn_t *)append_svcs_or_insts, old_deps, 0);
4285 		assert(err == 0);
4286 	}
4287 
4288 	delete_instance_dependencies(v, B_TRUE);
4289 
4290 	/*
4291 	 * Deleting an instance can both satisfy and unsatisfy dependencies,
4292 	 * depending on their type.  First propagate the stop as a RERR_RESTART
4293 	 * event -- deletion isn't a fault, just a normal stop.  This gives
4294 	 * dependent services the chance to do a clean shutdown.  Then, mark
4295 	 * the service as unconfigured and propagate the start event for the
4296 	 * optional_all dependencies that might have become satisfied.
4297 	 */
4298 	graph_walk_dependents(v, propagate_stop, (void *)RERR_RESTART);
4299 
4300 	v->gv_flags &= ~GV_CONFIGURED;
4301 
4302 	graph_walk_dependents(v, propagate_start, NULL);
4303 	propagate_satbility(v);
4304 
4305 	/*
4306 	 * If there are no (non-service) dependents, the vertex can be
4307 	 * completely removed.
4308 	 */
4309 	if (v != milestone && v->gv_refs == 0 &&
4310 	    uu_list_numnodes(v->gv_dependents) == 1)
4311 		remove_inst_vertex(v);
4312 
4313 	if (milestone > MILESTONE_NONE) {
4314 		void *cookie = NULL;
4315 
4316 		while ((e = uu_list_teardown(old_deps, &cookie)) != NULL) {
4317 			v = e->ge_vertex;
4318 
4319 			if (vertex_unref(v) == VERTEX_INUSE)
4320 				while (eval_subgraph(v, h) == ECONNABORTED)
4321 					libscf_handle_rebind(h);
4322 
4323 			startd_free(e, sizeof (*e));
4324 		}
4325 
4326 		uu_list_destroy(old_deps);
4327 	}
4328 
4329 	MUTEX_UNLOCK(&dgraph_lock);
4330 
4331 	return (0);
4332 }
4333 
4334 /*
4335  * Return the eventual (maybe current) milestone in the form of a
4336  * legacy runlevel.
4337  */
4338 static char
4339 target_milestone_as_runlevel()
4340 {
4341 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
4342 
4343 	if (milestone == NULL)
4344 		return ('3');
4345 	else if (milestone == MILESTONE_NONE)
4346 		return ('0');
4347 
4348 	if (strcmp(milestone->gv_name, multi_user_fmri) == 0)
4349 		return ('2');
4350 	else if (strcmp(milestone->gv_name, single_user_fmri) == 0)
4351 		return ('S');
4352 	else if (strcmp(milestone->gv_name, multi_user_svr_fmri) == 0)
4353 		return ('3');
4354 
4355 #ifndef NDEBUG
4356 	(void) fprintf(stderr, "%s:%d: Unknown milestone name \"%s\".\n",
4357 	    __FILE__, __LINE__, milestone->gv_name);
4358 #endif
4359 	abort();
4360 	/* NOTREACHED */
4361 }
4362 
4363 static struct {
4364 	char	rl;
4365 	int	sig;
4366 } init_sigs[] = {
4367 	{ 'S', SIGBUS },
4368 	{ '0', SIGINT },
4369 	{ '1', SIGQUIT },
4370 	{ '2', SIGILL },
4371 	{ '3', SIGTRAP },
4372 	{ '4', SIGIOT },
4373 	{ '5', SIGEMT },
4374 	{ '6', SIGFPE },
4375 	{ 0, 0 }
4376 };
4377 
4378 static void
4379 signal_init(char rl)
4380 {
4381 	pid_t init_pid;
4382 	int i;
4383 
4384 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
4385 
4386 	if (zone_getattr(getzoneid(), ZONE_ATTR_INITPID, &init_pid,
4387 	    sizeof (init_pid)) != sizeof (init_pid)) {
4388 		log_error(LOG_NOTICE, "Could not get pid to signal init.\n");
4389 		return;
4390 	}
4391 
4392 	for (i = 0; init_sigs[i].rl != 0; ++i)
4393 		if (init_sigs[i].rl == rl)
4394 			break;
4395 
4396 	if (init_sigs[i].rl != 0) {
4397 		if (kill(init_pid, init_sigs[i].sig) != 0) {
4398 			switch (errno) {
4399 			case EPERM:
4400 			case ESRCH:
4401 				log_error(LOG_NOTICE, "Could not signal init: "
4402 				    "%s.\n", strerror(errno));
4403 				break;
4404 
4405 			case EINVAL:
4406 			default:
4407 				bad_error("kill", errno);
4408 			}
4409 		}
4410 	}
4411 }
4412 
4413 /*
4414  * This is called when one of the major milestones changes state, or when
4415  * init is signalled and tells us it was told to change runlevel.  We wait
4416  * to reach the milestone because this allows /etc/inittab entries to retain
4417  * some boot ordering: historically, entries could place themselves before/after
4418  * the running of /sbin/rcX scripts but we can no longer make the
4419  * distinction because the /sbin/rcX scripts no longer exist as punctuation
4420  * marks in /etc/inittab.
4421  *
4422  * Also, we only trigger an update when we reach the eventual target
4423  * milestone: without this, an /etc/inittab entry marked only for
4424  * runlevel 2 would be executed for runlevel 3, which is not how
4425  * /etc/inittab entries work.
4426  *
4427  * If we're single user coming online, then we set utmpx to the target
4428  * runlevel so that legacy scripts can work as expected.
4429  */
4430 static void
4431 graph_runlevel_changed(char rl, int online)
4432 {
4433 	char trl;
4434 
4435 	assert(PTHREAD_MUTEX_HELD(&dgraph_lock));
4436 
4437 	trl = target_milestone_as_runlevel();
4438 
4439 	if (online) {
4440 		if (rl == trl) {
4441 			current_runlevel = trl;
4442 			signal_init(trl);
4443 		} else if (rl == 'S') {
4444 			/*
4445 			 * At boot, set the entry early for the benefit of the
4446 			 * legacy init scripts.
4447 			 */
4448 			utmpx_set_runlevel(trl, 'S', B_FALSE);
4449 		}
4450 	} else {
4451 		if (rl == '3' && trl == '2') {
4452 			current_runlevel = trl;
4453 			signal_init(trl);
4454 		} else if (rl == '2' && trl == 'S') {
4455 			current_runlevel = trl;
4456 			signal_init(trl);
4457 		}
4458 	}
4459 }
4460 
4461 /*
4462  * Move to a backwards-compatible runlevel by executing the appropriate
4463  * /etc/rc?.d/K* scripts and/or setting the milestone.
4464  *
4465  * Returns
4466  *   0 - success
4467  *   ECONNRESET - success, but handle was reset
4468  *   ECONNABORTED - repository connection broken
4469  *   ECANCELED - pg was deleted
4470  */
4471 static int
4472 dgraph_set_runlevel(scf_propertygroup_t *pg, scf_property_t *prop)
4473 {
4474 	char rl;
4475 	scf_handle_t *h;
4476 	int r;
4477 	const char *ms = NULL;	/* what to commit as options/milestone */
4478 	boolean_t rebound = B_FALSE;
4479 	int mark_rl = 0;
4480 
4481 	const char * const stop = "stop";
4482 
4483 	r = libscf_extract_runlevel(prop, &rl);
4484 	switch (r) {
4485 	case 0:
4486 		break;
4487 
4488 	case ECONNABORTED:
4489 	case ECANCELED:
4490 		return (r);
4491 
4492 	case EINVAL:
4493 	case ENOENT:
4494 		log_error(LOG_WARNING, "runlevel property is misconfigured; "
4495 		    "ignoring.\n");
4496 		/* delete the bad property */
4497 		goto nolock_out;
4498 
4499 	default:
4500 		bad_error("libscf_extract_runlevel", r);
4501 	}
4502 
4503 	switch (rl) {
4504 	case 's':
4505 		rl = 'S';
4506 		/* FALLTHROUGH */
4507 
4508 	case 'S':
4509 	case '2':
4510 	case '3':
4511 		/*
4512 		 * These cases cause a milestone change, so
4513 		 * graph_runlevel_changed() will eventually deal with
4514 		 * signalling init.
4515 		 */
4516 		break;
4517 
4518 	case '0':
4519 	case '1':
4520 	case '4':
4521 	case '5':
4522 	case '6':
4523 		mark_rl = 1;
4524 		break;
4525 
4526 	default:
4527 		log_framework(LOG_NOTICE, "Unknown runlevel '%c'.\n", rl);
4528 		ms = NULL;
4529 		goto nolock_out;
4530 	}
4531 
4532 	h = scf_pg_handle(pg);
4533 
4534 	MUTEX_LOCK(&dgraph_lock);
4535 
4536 	/*
4537 	 * Since this triggers no milestone changes, force it by hand.
4538 	 */
4539 	if (current_runlevel == '4' && rl == '3')
4540 		mark_rl = 1;
4541 
4542 	/*
4543 	 * 1. If we are here after an "init X":
4544 	 *
4545 	 * init X
4546 	 *	init/lscf_set_runlevel()
4547 	 *		process_pg_event()
4548 	 *		dgraph_set_runlevel()
4549 	 *
4550 	 * then we haven't passed through graph_runlevel_changed() yet,
4551 	 * therefore 'current_runlevel' has not changed for sure but 'rl' has.
4552 	 * In consequence, if 'rl' is lower than 'current_runlevel', we change
4553 	 * the system runlevel and execute the appropriate /etc/rc?.d/K* scripts
4554 	 * past this test.
4555 	 *
4556 	 * 2. On the other hand, if we are here after a "svcadm milestone":
4557 	 *
4558 	 * svcadm milestone X
4559 	 *	dgraph_set_milestone()
4560 	 *		handle_graph_update_event()
4561 	 *		dgraph_set_instance_state()
4562 	 *		graph_post_X_[online|offline]()
4563 	 *		graph_runlevel_changed()
4564 	 *		signal_init()
4565 	 *			init/lscf_set_runlevel()
4566 	 *				process_pg_event()
4567 	 *				dgraph_set_runlevel()
4568 	 *
4569 	 * then we already passed through graph_runlevel_changed() (by the way
4570 	 * of dgraph_set_milestone()) and 'current_runlevel' may have changed
4571 	 * and already be equal to 'rl' so we are going to return immediately
4572 	 * from dgraph_set_runlevel() without changing the system runlevel and
4573 	 * without executing the /etc/rc?.d/K* scripts.
4574 	 */
4575 	if (rl == current_runlevel) {
4576 		ms = NULL;
4577 		goto out;
4578 	}
4579 
4580 	log_framework(LOG_DEBUG, "Changing to runlevel '%c'.\n", rl);
4581 
4582 	/*
4583 	 * Make sure stop rc scripts see the new settings via who -r.
4584 	 */
4585 	utmpx_set_runlevel(rl, current_runlevel, B_TRUE);
4586 
4587 	/*
4588 	 * Some run levels don't have a direct correspondence to any
4589 	 * milestones, so we have to signal init directly.
4590 	 */
4591 	if (mark_rl) {
4592 		current_runlevel = rl;
4593 		signal_init(rl);
4594 	}
4595 
4596 	switch (rl) {
4597 	case 'S':
4598 		uu_warn("The system is coming down for administration.  "
4599 		    "Please wait.\n");
4600 		fork_rc_script(rl, stop, B_FALSE);
4601 		ms = single_user_fmri;
4602 		go_single_user_mode = B_TRUE;
4603 		break;
4604 
4605 	case '0':
4606 		fork_rc_script(rl, stop, B_TRUE);
4607 		halting = AD_HALT;
4608 		goto uadmin;
4609 
4610 	case '5':
4611 		fork_rc_script(rl, stop, B_TRUE);
4612 		halting = AD_POWEROFF;
4613 		goto uadmin;
4614 
4615 	case '6':
4616 		fork_rc_script(rl, stop, B_TRUE);
4617 		halting = AD_BOOT;
4618 		goto uadmin;
4619 
4620 uadmin:
4621 		uu_warn("The system is coming down.  Please wait.\n");
4622 		ms = "none";
4623 
4624 		/*
4625 		 * We can't wait until all services are offline since this
4626 		 * thread is responsible for taking them offline.  Instead we
4627 		 * set halting to the second argument for uadmin() and call
4628 		 * do_uadmin() from dgraph_set_instance_state() when
4629 		 * appropriate.
4630 		 */
4631 		break;
4632 
4633 	case '1':
4634 		if (current_runlevel != 'S') {
4635 			uu_warn("Changing to state 1.\n");
4636 			fork_rc_script(rl, stop, B_FALSE);
4637 		} else {
4638 			uu_warn("The system is coming up for administration.  "
4639 			    "Please wait.\n");
4640 		}
4641 		ms = single_user_fmri;
4642 		go_to_level1 = B_TRUE;
4643 		break;
4644 
4645 	case '2':
4646 		if (current_runlevel == '3' || current_runlevel == '4')
4647 			fork_rc_script(rl, stop, B_FALSE);
4648 		ms = multi_user_fmri;
4649 		break;
4650 
4651 	case '3':
4652 	case '4':
4653 		ms = "all";
4654 		break;
4655 
4656 	default:
4657 #ifndef NDEBUG
4658 		(void) fprintf(stderr, "%s:%d: Uncaught case %d ('%c').\n",
4659 		    __FILE__, __LINE__, rl, rl);
4660 #endif
4661 		abort();
4662 	}
4663 
4664 out:
4665 	MUTEX_UNLOCK(&dgraph_lock);
4666 
4667 nolock_out:
4668 	switch (r = libscf_clear_runlevel(pg, ms)) {
4669 	case 0:
4670 		break;
4671 
4672 	case ECONNABORTED:
4673 		libscf_handle_rebind(h);
4674 		rebound = B_TRUE;
4675 		goto nolock_out;
4676 
4677 	case ECANCELED:
4678 		break;
4679 
4680 	case EPERM:
4681 	case EACCES:
4682 	case EROFS:
4683 		log_error(LOG_NOTICE, "Could not delete \"%s/%s\" property: "
4684 		    "%s.\n", SCF_PG_OPTIONS, "runlevel", strerror(r));
4685 		break;
4686 
4687 	default:
4688 		bad_error("libscf_clear_runlevel", r);
4689 	}
4690 
4691 	return (rebound ? ECONNRESET : 0);
4692 }
4693 
4694 static int
4695 mark_subgraph(graph_edge_t *e, void *arg)
4696 {
4697 	graph_vertex_t *v;
4698 	int r;
4699 	int optional = (int)arg;
4700 
4701 	v = e->ge_vertex;
4702 
4703 	/* If it's already in the subgraph, skip. */
4704 	if (v->gv_flags & GV_INSUBGRAPH)
4705 		return (UU_WALK_NEXT);
4706 
4707 	/*
4708 	 * Keep track if walk has entered an optional dependency group
4709 	 */
4710 	if (v->gv_type == GVT_GROUP && v->gv_depgroup == DEPGRP_OPTIONAL_ALL) {
4711 		optional = 1;
4712 	}
4713 	/*
4714 	 * Quit if we are in an optional dependency group and the instance
4715 	 * is disabled
4716 	 */
4717 	if (optional && (v->gv_type == GVT_INST) &&
4718 	    (!(v->gv_flags & GV_ENBLD_NOOVR)))
4719 		return (UU_WALK_NEXT);
4720 
4721 	v->gv_flags |= GV_INSUBGRAPH;
4722 
4723 	/* Skip all excluded dependencies. */
4724 	if (v->gv_type == GVT_GROUP && v->gv_depgroup == DEPGRP_EXCLUDE_ALL)
4725 		return (UU_WALK_NEXT);
4726 
4727 	r = uu_list_walk(v->gv_dependencies, (uu_walk_fn_t *)mark_subgraph,
4728 	    (void *)optional, 0);
4729 	assert(r == 0);
4730 	return (UU_WALK_NEXT);
4731 }
4732 
4733 /*
4734  * Bring down all services which are not dependencies of fmri.  The
4735  * dependencies of fmri (direct & indirect) will constitute the "subgraph",
4736  * and will have the GV_INSUBGRAPH flag set.  The rest must be brought down,
4737  * which means the state is "disabled", "maintenance", or "uninitialized".  We
4738  * could consider "offline" to be down, and refrain from sending start
4739  * commands for such services, but that's not strictly necessary, so we'll
4740  * decline to intrude on the state machine.  It would probably confuse users
4741  * anyway.
4742  *
4743  * The services should be brought down in reverse-dependency order, so we
4744  * can't do it all at once here.  We initiate by override-disabling the leaves
4745  * of the dependency tree -- those services which are up but have no
4746  * dependents which are up.  When they come down,
4747  * vertex_subgraph_dependencies_shutdown() will override-disable the newly
4748  * exposed leaves.  Perseverance will ensure completion.
4749  *
4750  * Sometimes we need to take action when the transition is complete, like
4751  * start sulogin or halt the system.  To tell when we're done, we initialize
4752  * non_subgraph_svcs here to be the number of services which need to come
4753  * down.  As each does, we decrement the counter.  When it hits zero, we take
4754  * the appropriate action.  See vertex_subgraph_dependencies_shutdown().
4755  *
4756  * In case we're coming up, we also remove any enable-overrides for the
4757  * services which are dependencies of fmri.
4758  *
4759  * If norepository is true, the function will not change the repository.
4760  *
4761  * The decision to change the system run level in accordance with the milestone
4762  * is taken in dgraph_set_runlevel().
4763  *
4764  * Returns
4765  *   0 - success
4766  *   ECONNRESET - success, but handle was rebound
4767  *   EINVAL - fmri is invalid (error is logged)
4768  *   EALREADY - the milestone is already set to fmri
4769  *   ENOENT - a configured vertex does not exist for fmri (an error is logged)
4770  */
4771 static int
4772 dgraph_set_milestone(const char *fmri, scf_handle_t *h, boolean_t norepository)
4773 {
4774 	const char *cfmri, *fs;
4775 	graph_vertex_t *nm, *v;
4776 	int ret = 0, r;
4777 	scf_instance_t *inst;
4778 	boolean_t isall, isnone, rebound = B_FALSE;
4779 
4780 	/* Validate fmri */
4781 	isall = (strcmp(fmri, "all") == 0);
4782 	isnone = (strcmp(fmri, "none") == 0);
4783 
4784 	if (!isall && !isnone) {
4785 		if (fmri_canonify(fmri, (char **)&cfmri, B_FALSE) == EINVAL)
4786 			goto reject;
4787 
4788 		if (strcmp(cfmri, single_user_fmri) != 0 &&
4789 		    strcmp(cfmri, multi_user_fmri) != 0 &&
4790 		    strcmp(cfmri, multi_user_svr_fmri) != 0) {
4791 			startd_free((void *)cfmri, max_scf_fmri_size);
4792 reject:
4793 			log_framework(LOG_WARNING,
4794 			    "Rejecting request for invalid milestone \"%s\".\n",
4795 			    fmri);
4796 			return (EINVAL);
4797 		}
4798 	}
4799 
4800 	inst = safe_scf_instance_create(h);
4801 
4802 	MUTEX_LOCK(&dgraph_lock);
4803 
4804 	if (milestone == NULL) {
4805 		if (isall) {
4806 			log_framework(LOG_DEBUG,
4807 			    "Milestone already set to all.\n");
4808 			ret = EALREADY;
4809 			goto out;
4810 		}
4811 	} else if (milestone == MILESTONE_NONE) {
4812 		if (isnone) {
4813 			log_framework(LOG_DEBUG,
4814 			    "Milestone already set to none.\n");
4815 			ret = EALREADY;
4816 			goto out;
4817 		}
4818 	} else {
4819 		if (!isall && !isnone &&
4820 		    strcmp(cfmri, milestone->gv_name) == 0) {
4821 			log_framework(LOG_DEBUG,
4822 			    "Milestone already set to %s.\n", cfmri);
4823 			ret = EALREADY;
4824 			goto out;
4825 		}
4826 	}
4827 
4828 	if (!isall && !isnone) {
4829 		nm = vertex_get_by_name(cfmri);
4830 		if (nm == NULL || !(nm->gv_flags & GV_CONFIGURED)) {
4831 			log_framework(LOG_WARNING, "Cannot set milestone to %s "
4832 			    "because no such service exists.\n", cfmri);
4833 			ret = ENOENT;
4834 			goto out;
4835 		}
4836 	}
4837 
4838 	log_framework(LOG_DEBUG, "Changing milestone to %s.\n", fmri);
4839 
4840 	/*
4841 	 * Set milestone, removing the old one if this was the last reference.
4842 	 */
4843 	if (milestone > MILESTONE_NONE)
4844 		(void) vertex_unref(milestone);
4845 
4846 	if (isall)
4847 		milestone = NULL;
4848 	else if (isnone)
4849 		milestone = MILESTONE_NONE;
4850 	else {
4851 		milestone = nm;
4852 		/* milestone should count as a reference */
4853 		vertex_ref(milestone);
4854 	}
4855 
4856 	/* Clear all GV_INSUBGRAPH bits. */
4857 	for (v = uu_list_first(dgraph); v != NULL; v = uu_list_next(dgraph, v))
4858 		v->gv_flags &= ~GV_INSUBGRAPH;
4859 
4860 	if (!isall && !isnone) {
4861 		/* Set GV_INSUBGRAPH for milestone & descendents. */
4862 		milestone->gv_flags |= GV_INSUBGRAPH;
4863 
4864 		r = uu_list_walk(milestone->gv_dependencies,
4865 		    (uu_walk_fn_t *)mark_subgraph, NULL, 0);
4866 		assert(r == 0);
4867 	}
4868 
4869 	/* Un-override services in the subgraph & override-disable the rest. */
4870 	if (norepository)
4871 		goto out;
4872 
4873 	non_subgraph_svcs = 0;
4874 	for (v = uu_list_first(dgraph);
4875 	    v != NULL;
4876 	    v = uu_list_next(dgraph, v)) {
4877 		if (v->gv_type != GVT_INST ||
4878 		    (v->gv_flags & GV_CONFIGURED) == 0)
4879 			continue;
4880 
4881 again:
4882 		r = scf_handle_decode_fmri(h, v->gv_name, NULL, NULL, inst,
4883 		    NULL, NULL, SCF_DECODE_FMRI_EXACT);
4884 		if (r != 0) {
4885 			switch (scf_error()) {
4886 			case SCF_ERROR_CONNECTION_BROKEN:
4887 			default:
4888 				libscf_handle_rebind(h);
4889 				rebound = B_TRUE;
4890 				goto again;
4891 
4892 			case SCF_ERROR_NOT_FOUND:
4893 				continue;
4894 
4895 			case SCF_ERROR_HANDLE_MISMATCH:
4896 			case SCF_ERROR_INVALID_ARGUMENT:
4897 			case SCF_ERROR_CONSTRAINT_VIOLATED:
4898 			case SCF_ERROR_NOT_BOUND:
4899 				bad_error("scf_handle_decode_fmri",
4900 				    scf_error());
4901 			}
4902 		}
4903 
4904 		if (isall || (v->gv_flags & GV_INSUBGRAPH)) {
4905 			r = libscf_delete_enable_ovr(inst);
4906 			fs = "libscf_delete_enable_ovr";
4907 		} else {
4908 			assert(isnone || (v->gv_flags & GV_INSUBGRAPH) == 0);
4909 
4910 			/*
4911 			 * Services which are up need to come down before
4912 			 * we're done, but we can only disable the leaves
4913 			 * here.
4914 			 */
4915 
4916 			if (up_state(v->gv_state))
4917 				++non_subgraph_svcs;
4918 
4919 			/* If it's already disabled, don't bother. */
4920 			if ((v->gv_flags & GV_ENABLED) == 0)
4921 				continue;
4922 
4923 			if (!is_nonsubgraph_leaf(v))
4924 				continue;
4925 
4926 			r = libscf_set_enable_ovr(inst, 0);
4927 			fs = "libscf_set_enable_ovr";
4928 		}
4929 		switch (r) {
4930 		case 0:
4931 		case ECANCELED:
4932 			break;
4933 
4934 		case ECONNABORTED:
4935 			libscf_handle_rebind(h);
4936 			rebound = B_TRUE;
4937 			goto again;
4938 
4939 		case EPERM:
4940 		case EROFS:
4941 			log_error(LOG_WARNING,
4942 			    "Could not set %s/%s for %s: %s.\n",
4943 			    SCF_PG_GENERAL_OVR, SCF_PROPERTY_ENABLED,
4944 			    v->gv_name, strerror(r));
4945 			break;
4946 
4947 		default:
4948 			bad_error(fs, r);
4949 		}
4950 	}
4951 
4952 	if (halting != -1) {
4953 		if (non_subgraph_svcs > 1)
4954 			uu_warn("%d system services are now being stopped.\n",
4955 			    non_subgraph_svcs);
4956 		else if (non_subgraph_svcs == 1)
4957 			uu_warn("One system service is now being stopped.\n");
4958 		else if (non_subgraph_svcs == 0)
4959 			do_uadmin();
4960 	}
4961 
4962 	ret = rebound ? ECONNRESET : 0;
4963 
4964 out:
4965 	MUTEX_UNLOCK(&dgraph_lock);
4966 	if (!isall && !isnone)
4967 		startd_free((void *)cfmri, max_scf_fmri_size);
4968 	scf_instance_destroy(inst);
4969 	return (ret);
4970 }
4971 
4972 
4973 /*
4974  * Returns 0, ECONNABORTED, or EINVAL.
4975  */
4976 static int
4977 handle_graph_update_event(scf_handle_t *h, graph_protocol_event_t *e)
4978 {
4979 	int r;
4980 
4981 	switch (e->gpe_type) {
4982 	case GRAPH_UPDATE_RELOAD_GRAPH:
4983 		log_error(LOG_WARNING,
4984 		    "graph_event: reload graph unimplemented\n");
4985 		break;
4986 
4987 	case GRAPH_UPDATE_STATE_CHANGE: {
4988 		protocol_states_t *states = e->gpe_data;
4989 
4990 		switch (r = dgraph_set_instance_state(h, e->gpe_inst,
4991 		    states->ps_state, states->ps_err)) {
4992 		case 0:
4993 		case ENOENT:
4994 			break;
4995 
4996 		case ECONNABORTED:
4997 			return (ECONNABORTED);
4998 
4999 		case EINVAL:
5000 		default:
5001 #ifndef NDEBUG
5002 			(void) fprintf(stderr, "dgraph_set_instance_state() "
5003 			    "failed with unexpected error %d at %s:%d.\n", r,
5004 			    __FILE__, __LINE__);
5005 #endif
5006 			abort();
5007 		}
5008 
5009 		startd_free(states, sizeof (protocol_states_t));
5010 		break;
5011 	}
5012 
5013 	default:
5014 		log_error(LOG_WARNING,
5015 		    "graph_event_loop received an unknown event: %d\n",
5016 		    e->gpe_type);
5017 		break;
5018 	}
5019 
5020 	return (0);
5021 }
5022 
5023 /*
5024  * graph_event_thread()
5025  *    Wait for state changes from the restarters.
5026  */
5027 /*ARGSUSED*/
5028 void *
5029 graph_event_thread(void *unused)
5030 {
5031 	scf_handle_t *h;
5032 	int err;
5033 
5034 	h = libscf_handle_create_bound_loop();
5035 
5036 	/*CONSTCOND*/
5037 	while (1) {
5038 		graph_protocol_event_t *e;
5039 
5040 		MUTEX_LOCK(&gu->gu_lock);
5041 
5042 		while (gu->gu_wakeup == 0)
5043 			(void) pthread_cond_wait(&gu->gu_cv, &gu->gu_lock);
5044 
5045 		gu->gu_wakeup = 0;
5046 
5047 		while ((e = graph_event_dequeue()) != NULL) {
5048 			MUTEX_LOCK(&e->gpe_lock);
5049 			MUTEX_UNLOCK(&gu->gu_lock);
5050 
5051 			while ((err = handle_graph_update_event(h, e)) ==
5052 			    ECONNABORTED)
5053 				libscf_handle_rebind(h);
5054 
5055 			if (err == 0)
5056 				graph_event_release(e);
5057 			else
5058 				graph_event_requeue(e);
5059 
5060 			MUTEX_LOCK(&gu->gu_lock);
5061 		}
5062 
5063 		MUTEX_UNLOCK(&gu->gu_lock);
5064 	}
5065 
5066 	/*
5067 	 * Unreachable for now -- there's currently no graceful cleanup
5068 	 * called on exit().
5069 	 */
5070 	MUTEX_UNLOCK(&gu->gu_lock);
5071 	scf_handle_destroy(h);
5072 	return (NULL);
5073 }
5074 
5075 static void
5076 set_initial_milestone(scf_handle_t *h)
5077 {
5078 	scf_instance_t *inst;
5079 	char *fmri, *cfmri;
5080 	size_t sz;
5081 	int r;
5082 
5083 	inst = safe_scf_instance_create(h);
5084 	fmri = startd_alloc(max_scf_fmri_size);
5085 
5086 	/*
5087 	 * If -m milestone= was specified, we want to set options_ovr/milestone
5088 	 * to it.  Otherwise we want to read what the milestone should be set
5089 	 * to.  Either way we need our inst.
5090 	 */
5091 get_self:
5092 	if (scf_handle_decode_fmri(h, SCF_SERVICE_STARTD, NULL, NULL, inst,
5093 	    NULL, NULL, SCF_DECODE_FMRI_EXACT) != 0) {
5094 		switch (scf_error()) {
5095 		case SCF_ERROR_CONNECTION_BROKEN:
5096 			libscf_handle_rebind(h);
5097 			goto get_self;
5098 
5099 		case SCF_ERROR_NOT_FOUND:
5100 			if (st->st_subgraph != NULL &&
5101 			    st->st_subgraph[0] != '\0') {
5102 				sz = strlcpy(fmri, st->st_subgraph,
5103 				    max_scf_fmri_size);
5104 				assert(sz < max_scf_fmri_size);
5105 			} else {
5106 				fmri[0] = '\0';
5107 			}
5108 			break;
5109 
5110 		case SCF_ERROR_INVALID_ARGUMENT:
5111 		case SCF_ERROR_CONSTRAINT_VIOLATED:
5112 		case SCF_ERROR_HANDLE_MISMATCH:
5113 		default:
5114 			bad_error("scf_handle_decode_fmri", scf_error());
5115 		}
5116 	} else {
5117 		if (st->st_subgraph != NULL && st->st_subgraph[0] != '\0') {
5118 			scf_propertygroup_t *pg;
5119 
5120 			pg = safe_scf_pg_create(h);
5121 
5122 			sz = strlcpy(fmri, st->st_subgraph, max_scf_fmri_size);
5123 			assert(sz < max_scf_fmri_size);
5124 
5125 			r = libscf_inst_get_or_add_pg(inst, SCF_PG_OPTIONS_OVR,
5126 			    SCF_PG_OPTIONS_OVR_TYPE, SCF_PG_OPTIONS_OVR_FLAGS,
5127 			    pg);
5128 			switch (r) {
5129 			case 0:
5130 				break;
5131 
5132 			case ECONNABORTED:
5133 				libscf_handle_rebind(h);
5134 				goto get_self;
5135 
5136 			case EPERM:
5137 			case EACCES:
5138 			case EROFS:
5139 				log_error(LOG_WARNING, "Could not set %s/%s: "
5140 				    "%s.\n", SCF_PG_OPTIONS_OVR,
5141 				    SCF_PROPERTY_MILESTONE, strerror(r));
5142 				/* FALLTHROUGH */
5143 
5144 			case ECANCELED:
5145 				sz = strlcpy(fmri, st->st_subgraph,
5146 				    max_scf_fmri_size);
5147 				assert(sz < max_scf_fmri_size);
5148 				break;
5149 
5150 			default:
5151 				bad_error("libscf_inst_get_or_add_pg", r);
5152 			}
5153 
5154 			r = libscf_clear_runlevel(pg, fmri);
5155 			switch (r) {
5156 			case 0:
5157 				break;
5158 
5159 			case ECONNABORTED:
5160 				libscf_handle_rebind(h);
5161 				goto get_self;
5162 
5163 			case EPERM:
5164 			case EACCES:
5165 			case EROFS:
5166 				log_error(LOG_WARNING, "Could not set %s/%s: "
5167 				    "%s.\n", SCF_PG_OPTIONS_OVR,
5168 				    SCF_PROPERTY_MILESTONE, strerror(r));
5169 				/* FALLTHROUGH */
5170 
5171 			case ECANCELED:
5172 				sz = strlcpy(fmri, st->st_subgraph,
5173 				    max_scf_fmri_size);
5174 				assert(sz < max_scf_fmri_size);
5175 				break;
5176 
5177 			default:
5178 				bad_error("libscf_clear_runlevel", r);
5179 			}
5180 
5181 			scf_pg_destroy(pg);
5182 		} else {
5183 			scf_property_t *prop;
5184 			scf_value_t *val;
5185 
5186 			prop = safe_scf_property_create(h);
5187 			val = safe_scf_value_create(h);
5188 
5189 			r = libscf_get_milestone(inst, prop, val, fmri,
5190 			    max_scf_fmri_size);
5191 			switch (r) {
5192 			case 0:
5193 				break;
5194 
5195 			case ECONNABORTED:
5196 				libscf_handle_rebind(h);
5197 				goto get_self;
5198 
5199 			case EINVAL:
5200 				log_error(LOG_WARNING, "Milestone property is "
5201 				    "misconfigured.  Defaulting to \"all\".\n");
5202 				/* FALLTHROUGH */
5203 
5204 			case ECANCELED:
5205 			case ENOENT:
5206 				fmri[0] = '\0';
5207 				break;
5208 
5209 			default:
5210 				bad_error("libscf_get_milestone", r);
5211 			}
5212 
5213 			scf_value_destroy(val);
5214 			scf_property_destroy(prop);
5215 		}
5216 	}
5217 
5218 	if (fmri[0] == '\0' || strcmp(fmri, "all") == 0)
5219 		goto out;
5220 
5221 	if (strcmp(fmri, "none") != 0) {
5222 retry:
5223 		if (scf_handle_decode_fmri(h, fmri, NULL, NULL, inst, NULL,
5224 		    NULL, SCF_DECODE_FMRI_EXACT) != 0) {
5225 			switch (scf_error()) {
5226 			case SCF_ERROR_INVALID_ARGUMENT:
5227 				log_error(LOG_WARNING,
5228 				    "Requested milestone \"%s\" is invalid.  "
5229 				    "Reverting to \"all\".\n", fmri);
5230 				goto out;
5231 
5232 			case SCF_ERROR_CONSTRAINT_VIOLATED:
5233 				log_error(LOG_WARNING, "Requested milestone "
5234 				    "\"%s\" does not specify an instance.  "
5235 				    "Reverting to \"all\".\n", fmri);
5236 				goto out;
5237 
5238 			case SCF_ERROR_CONNECTION_BROKEN:
5239 				libscf_handle_rebind(h);
5240 				goto retry;
5241 
5242 			case SCF_ERROR_NOT_FOUND:
5243 				log_error(LOG_WARNING, "Requested milestone "
5244 				    "\"%s\" not in repository.  Reverting to "
5245 				    "\"all\".\n", fmri);
5246 				goto out;
5247 
5248 			case SCF_ERROR_HANDLE_MISMATCH:
5249 			default:
5250 				bad_error("scf_handle_decode_fmri",
5251 				    scf_error());
5252 			}
5253 		}
5254 
5255 		r = fmri_canonify(fmri, &cfmri, B_FALSE);
5256 		assert(r == 0);
5257 
5258 		r = dgraph_add_instance(cfmri, inst, B_TRUE);
5259 		startd_free(cfmri, max_scf_fmri_size);
5260 		switch (r) {
5261 		case 0:
5262 			break;
5263 
5264 		case ECONNABORTED:
5265 			goto retry;
5266 
5267 		case EINVAL:
5268 			log_error(LOG_WARNING,
5269 			    "Requested milestone \"%s\" is invalid.  "
5270 			    "Reverting to \"all\".\n", fmri);
5271 			goto out;
5272 
5273 		case ECANCELED:
5274 			log_error(LOG_WARNING,
5275 			    "Requested milestone \"%s\" not "
5276 			    "in repository.  Reverting to \"all\".\n",
5277 			    fmri);
5278 			goto out;
5279 
5280 		case EEXIST:
5281 		default:
5282 			bad_error("dgraph_add_instance", r);
5283 		}
5284 	}
5285 
5286 	log_console(LOG_INFO, "Booting to milestone \"%s\".\n", fmri);
5287 
5288 	r = dgraph_set_milestone(fmri, h, B_FALSE);
5289 	switch (r) {
5290 	case 0:
5291 	case ECONNRESET:
5292 	case EALREADY:
5293 		break;
5294 
5295 	case EINVAL:
5296 	case ENOENT:
5297 	default:
5298 		bad_error("dgraph_set_milestone", r);
5299 	}
5300 
5301 out:
5302 	startd_free(fmri, max_scf_fmri_size);
5303 	scf_instance_destroy(inst);
5304 }
5305 
5306 void
5307 set_restart_milestone(scf_handle_t *h)
5308 {
5309 	scf_instance_t *inst;
5310 	scf_property_t *prop;
5311 	scf_value_t *val;
5312 	char *fmri;
5313 	int r;
5314 
5315 	inst = safe_scf_instance_create(h);
5316 
5317 get_self:
5318 	if (scf_handle_decode_fmri(h, SCF_SERVICE_STARTD, NULL, NULL,
5319 	    inst, NULL, NULL, SCF_DECODE_FMRI_EXACT) != 0) {
5320 		switch (scf_error()) {
5321 		case SCF_ERROR_CONNECTION_BROKEN:
5322 			libscf_handle_rebind(h);
5323 			goto get_self;
5324 
5325 		case SCF_ERROR_NOT_FOUND:
5326 			break;
5327 
5328 		case SCF_ERROR_INVALID_ARGUMENT:
5329 		case SCF_ERROR_CONSTRAINT_VIOLATED:
5330 		case SCF_ERROR_HANDLE_MISMATCH:
5331 		default:
5332 			bad_error("scf_handle_decode_fmri", scf_error());
5333 		}
5334 
5335 		scf_instance_destroy(inst);
5336 		return;
5337 	}
5338 
5339 	prop = safe_scf_property_create(h);
5340 	val = safe_scf_value_create(h);
5341 	fmri = startd_alloc(max_scf_fmri_size);
5342 
5343 	r = libscf_get_milestone(inst, prop, val, fmri, max_scf_fmri_size);
5344 	switch (r) {
5345 	case 0:
5346 		break;
5347 
5348 	case ECONNABORTED:
5349 		libscf_handle_rebind(h);
5350 		goto get_self;
5351 
5352 	case ECANCELED:
5353 	case ENOENT:
5354 	case EINVAL:
5355 		goto out;
5356 
5357 	default:
5358 		bad_error("libscf_get_milestone", r);
5359 	}
5360 
5361 	r = dgraph_set_milestone(fmri, h, B_TRUE);
5362 	switch (r) {
5363 	case 0:
5364 	case ECONNRESET:
5365 	case EALREADY:
5366 	case EINVAL:
5367 	case ENOENT:
5368 		break;
5369 
5370 	default:
5371 		bad_error("dgraph_set_milestone", r);
5372 	}
5373 
5374 out:
5375 	startd_free(fmri, max_scf_fmri_size);
5376 	scf_value_destroy(val);
5377 	scf_property_destroy(prop);
5378 	scf_instance_destroy(inst);
5379 }
5380 
5381 /*
5382  * void *graph_thread(void *)
5383  *
5384  * Graph management thread.
5385  */
5386 /*ARGSUSED*/
5387 void *
5388 graph_thread(void *arg)
5389 {
5390 	scf_handle_t *h;
5391 	int err;
5392 
5393 	h = libscf_handle_create_bound_loop();
5394 
5395 	if (st->st_initial)
5396 		set_initial_milestone(h);
5397 
5398 	MUTEX_LOCK(&dgraph_lock);
5399 	initial_milestone_set = B_TRUE;
5400 	err = pthread_cond_broadcast(&initial_milestone_cv);
5401 	assert(err == 0);
5402 	MUTEX_UNLOCK(&dgraph_lock);
5403 
5404 	libscf_populate_graph(h);
5405 
5406 	if (!st->st_initial)
5407 		set_restart_milestone(h);
5408 
5409 	MUTEX_LOCK(&st->st_load_lock);
5410 	st->st_load_complete = 1;
5411 	(void) pthread_cond_broadcast(&st->st_load_cv);
5412 	MUTEX_UNLOCK(&st->st_load_lock);
5413 
5414 	MUTEX_LOCK(&dgraph_lock);
5415 	/*
5416 	 * Now that we've set st_load_complete we need to check can_come_up()
5417 	 * since if we booted to a milestone, then there won't be any more
5418 	 * state updates.
5419 	 */
5420 	if (!go_single_user_mode && !go_to_level1 &&
5421 	    halting == -1) {
5422 		if (!sulogin_thread_running && !can_come_up()) {
5423 			(void) startd_thread_create(sulogin_thread, NULL);
5424 			sulogin_thread_running = B_TRUE;
5425 		}
5426 	}
5427 	MUTEX_UNLOCK(&dgraph_lock);
5428 
5429 	(void) pthread_mutex_lock(&gu->gu_freeze_lock);
5430 
5431 	/*CONSTCOND*/
5432 	while (1) {
5433 		(void) pthread_cond_wait(&gu->gu_freeze_cv,
5434 		    &gu->gu_freeze_lock);
5435 	}
5436 
5437 	/*
5438 	 * Unreachable for now -- there's currently no graceful cleanup
5439 	 * called on exit().
5440 	 */
5441 	(void) pthread_mutex_unlock(&gu->gu_freeze_lock);
5442 	scf_handle_destroy(h);
5443 
5444 	return (NULL);
5445 }
5446 
5447 
5448 /*
5449  * int next_action()
5450  *   Given an array of timestamps 'a' with 'num' elements, find the
5451  *   lowest non-zero timestamp and return its index. If there are no
5452  *   non-zero elements, return -1.
5453  */
5454 static int
5455 next_action(hrtime_t *a, int num)
5456 {
5457 	hrtime_t t = 0;
5458 	int i = 0, smallest = -1;
5459 
5460 	for (i = 0; i < num; i++) {
5461 		if (t == 0) {
5462 			t = a[i];
5463 			smallest = i;
5464 		} else if (a[i] != 0 && a[i] < t) {
5465 			t = a[i];
5466 			smallest = i;
5467 		}
5468 	}
5469 
5470 	if (t == 0)
5471 		return (-1);
5472 	else
5473 		return (smallest);
5474 }
5475 
5476 /*
5477  * void process_actions()
5478  *   Process actions requested by the administrator. Possibilities include:
5479  *   refresh, restart, maintenance mode off, maintenance mode on,
5480  *   maintenance mode immediate, and degraded.
5481  *
5482  *   The set of pending actions is represented in the repository as a
5483  *   per-instance property group, with each action being a single property
5484  *   in that group.  This property group is converted to an array, with each
5485  *   action type having an array slot.  The actions in the array at the
5486  *   time process_actions() is called are acted on in the order of the
5487  *   timestamp (which is the value stored in the slot).  A value of zero
5488  *   indicates that there is no pending action of the type associated with
5489  *   a particular slot.
5490  *
5491  *   Sending an action event multiple times before the restarter has a
5492  *   chance to process that action will force it to be run at the last
5493  *   timestamp where it appears in the ordering.
5494  *
5495  *   Turning maintenance mode on trumps all other actions.
5496  *
5497  *   Returns 0 or ECONNABORTED.
5498  */
5499 static int
5500 process_actions(scf_handle_t *h, scf_propertygroup_t *pg, scf_instance_t *inst)
5501 {
5502 	scf_property_t *prop = NULL;
5503 	scf_value_t *val = NULL;
5504 	scf_type_t type;
5505 	graph_vertex_t *vertex;
5506 	admin_action_t a;
5507 	int i, ret = 0, r;
5508 	hrtime_t action_ts[NACTIONS];
5509 	char *inst_name;
5510 
5511 	r = libscf_instance_get_fmri(inst, &inst_name);
5512 	switch (r) {
5513 	case 0:
5514 		break;
5515 
5516 	case ECONNABORTED:
5517 		return (ECONNABORTED);
5518 
5519 	case ECANCELED:
5520 		return (0);
5521 
5522 	default:
5523 		bad_error("libscf_instance_get_fmri", r);
5524 	}
5525 
5526 	MUTEX_LOCK(&dgraph_lock);
5527 
5528 	vertex = vertex_get_by_name(inst_name);
5529 	if (vertex == NULL) {
5530 		MUTEX_UNLOCK(&dgraph_lock);
5531 		startd_free(inst_name, max_scf_fmri_size);
5532 		log_framework(LOG_DEBUG, "%s: Can't find graph vertex. "
5533 		    "The instance must have been removed.\n", inst_name);
5534 		return (0);
5535 	}
5536 
5537 	prop = safe_scf_property_create(h);
5538 	val = safe_scf_value_create(h);
5539 
5540 	for (i = 0; i < NACTIONS; i++) {
5541 		if (scf_pg_get_property(pg, admin_actions[i], prop) != 0) {
5542 			switch (scf_error()) {
5543 			case SCF_ERROR_CONNECTION_BROKEN:
5544 			default:
5545 				ret = ECONNABORTED;
5546 				goto out;
5547 
5548 			case SCF_ERROR_DELETED:
5549 				goto out;
5550 
5551 			case SCF_ERROR_NOT_FOUND:
5552 				action_ts[i] = 0;
5553 				continue;
5554 
5555 			case SCF_ERROR_HANDLE_MISMATCH:
5556 			case SCF_ERROR_INVALID_ARGUMENT:
5557 			case SCF_ERROR_NOT_SET:
5558 				bad_error("scf_pg_get_property", scf_error());
5559 			}
5560 		}
5561 
5562 		if (scf_property_type(prop, &type) != 0) {
5563 			switch (scf_error()) {
5564 			case SCF_ERROR_CONNECTION_BROKEN:
5565 			default:
5566 				ret = ECONNABORTED;
5567 				goto out;
5568 
5569 			case SCF_ERROR_DELETED:
5570 				action_ts[i] = 0;
5571 				continue;
5572 
5573 			case SCF_ERROR_NOT_SET:
5574 				bad_error("scf_property_type", scf_error());
5575 			}
5576 		}
5577 
5578 		if (type != SCF_TYPE_INTEGER) {
5579 			action_ts[i] = 0;
5580 			continue;
5581 		}
5582 
5583 		if (scf_property_get_value(prop, val) != 0) {
5584 			switch (scf_error()) {
5585 			case SCF_ERROR_CONNECTION_BROKEN:
5586 			default:
5587 				ret = ECONNABORTED;
5588 				goto out;
5589 
5590 			case SCF_ERROR_DELETED:
5591 				goto out;
5592 
5593 			case SCF_ERROR_NOT_FOUND:
5594 			case SCF_ERROR_CONSTRAINT_VIOLATED:
5595 				action_ts[i] = 0;
5596 				continue;
5597 
5598 			case SCF_ERROR_NOT_SET:
5599 			case SCF_ERROR_PERMISSION_DENIED:
5600 				bad_error("scf_property_get_value",
5601 				    scf_error());
5602 			}
5603 		}
5604 
5605 		r = scf_value_get_integer(val, &action_ts[i]);
5606 		assert(r == 0);
5607 	}
5608 
5609 	a = ADMIN_EVENT_MAINT_ON_IMMEDIATE;
5610 	if (action_ts[ADMIN_EVENT_MAINT_ON_IMMEDIATE] ||
5611 	    action_ts[ADMIN_EVENT_MAINT_ON]) {
5612 		a = action_ts[ADMIN_EVENT_MAINT_ON_IMMEDIATE] ?
5613 		    ADMIN_EVENT_MAINT_ON_IMMEDIATE : ADMIN_EVENT_MAINT_ON;
5614 
5615 		vertex_send_event(vertex, admin_events[a]);
5616 		r = libscf_unset_action(h, pg, a, action_ts[a]);
5617 		switch (r) {
5618 		case 0:
5619 		case EACCES:
5620 			break;
5621 
5622 		case ECONNABORTED:
5623 			ret = ECONNABORTED;
5624 			goto out;
5625 
5626 		case EPERM:
5627 			uu_die("Insufficient privilege.\n");
5628 			/* NOTREACHED */
5629 
5630 		default:
5631 			bad_error("libscf_unset_action", r);
5632 		}
5633 	}
5634 
5635 	while ((a = next_action(action_ts, NACTIONS)) != -1) {
5636 		log_framework(LOG_DEBUG,
5637 		    "Graph: processing %s action for %s.\n", admin_actions[a],
5638 		    inst_name);
5639 
5640 		if (a == ADMIN_EVENT_REFRESH) {
5641 			r = dgraph_refresh_instance(vertex, inst);
5642 			switch (r) {
5643 			case 0:
5644 			case ECANCELED:
5645 			case EINVAL:
5646 			case -1:
5647 				break;
5648 
5649 			case ECONNABORTED:
5650 				/* pg & inst are reset now, so just return. */
5651 				ret = ECONNABORTED;
5652 				goto out;
5653 
5654 			default:
5655 				bad_error("dgraph_refresh_instance", r);
5656 			}
5657 		}
5658 
5659 		vertex_send_event(vertex, admin_events[a]);
5660 
5661 		r = libscf_unset_action(h, pg, a, action_ts[a]);
5662 		switch (r) {
5663 		case 0:
5664 		case EACCES:
5665 			break;
5666 
5667 		case ECONNABORTED:
5668 			ret = ECONNABORTED;
5669 			goto out;
5670 
5671 		case EPERM:
5672 			uu_die("Insufficient privilege.\n");
5673 			/* NOTREACHED */
5674 
5675 		default:
5676 			bad_error("libscf_unset_action", r);
5677 		}
5678 
5679 		action_ts[a] = 0;
5680 	}
5681 
5682 out:
5683 	MUTEX_UNLOCK(&dgraph_lock);
5684 
5685 	scf_property_destroy(prop);
5686 	scf_value_destroy(val);
5687 	startd_free(inst_name, max_scf_fmri_size);
5688 	return (ret);
5689 }
5690 
5691 /*
5692  * inst and pg_name are scratch space, and are unset on entry.
5693  * Returns
5694  *   0 - success
5695  *   ECONNRESET - success, but repository handle rebound
5696  *   ECONNABORTED - repository connection broken
5697  */
5698 static int
5699 process_pg_event(scf_handle_t *h, scf_propertygroup_t *pg, scf_instance_t *inst,
5700     char *pg_name)
5701 {
5702 	int r;
5703 	scf_property_t *prop;
5704 	scf_value_t *val;
5705 	char *fmri;
5706 	boolean_t rebound = B_FALSE, rebind_inst = B_FALSE;
5707 
5708 	if (scf_pg_get_name(pg, pg_name, max_scf_value_size) < 0) {
5709 		switch (scf_error()) {
5710 		case SCF_ERROR_CONNECTION_BROKEN:
5711 		default:
5712 			return (ECONNABORTED);
5713 
5714 		case SCF_ERROR_DELETED:
5715 			return (0);
5716 
5717 		case SCF_ERROR_NOT_SET:
5718 			bad_error("scf_pg_get_name", scf_error());
5719 		}
5720 	}
5721 
5722 	if (strcmp(pg_name, SCF_PG_GENERAL) == 0 ||
5723 	    strcmp(pg_name, SCF_PG_GENERAL_OVR) == 0) {
5724 		r = dgraph_update_general(pg);
5725 		switch (r) {
5726 		case 0:
5727 		case ENOTSUP:
5728 		case ECANCELED:
5729 			return (0);
5730 
5731 		case ECONNABORTED:
5732 			return (ECONNABORTED);
5733 
5734 		case -1:
5735 			/* Error should have been logged. */
5736 			return (0);
5737 
5738 		default:
5739 			bad_error("dgraph_update_general", r);
5740 		}
5741 	} else if (strcmp(pg_name, SCF_PG_RESTARTER_ACTIONS) == 0) {
5742 		if (scf_pg_get_parent_instance(pg, inst) != 0) {
5743 			switch (scf_error()) {
5744 			case SCF_ERROR_CONNECTION_BROKEN:
5745 				return (ECONNABORTED);
5746 
5747 			case SCF_ERROR_DELETED:
5748 			case SCF_ERROR_CONSTRAINT_VIOLATED:
5749 				/* Ignore commands on services. */
5750 				return (0);
5751 
5752 			case SCF_ERROR_NOT_BOUND:
5753 			case SCF_ERROR_HANDLE_MISMATCH:
5754 			case SCF_ERROR_NOT_SET:
5755 			default:
5756 				bad_error("scf_pg_get_parent_instance",
5757 				    scf_error());
5758 			}
5759 		}
5760 
5761 		return (process_actions(h, pg, inst));
5762 	}
5763 
5764 	if (strcmp(pg_name, SCF_PG_OPTIONS) != 0 &&
5765 	    strcmp(pg_name, SCF_PG_OPTIONS_OVR) != 0)
5766 		return (0);
5767 
5768 	/*
5769 	 * We only care about the options[_ovr] property groups of our own
5770 	 * instance, so get the fmri and compare.  Plus, once we know it's
5771 	 * correct, if the repository connection is broken we know exactly what
5772 	 * property group we were operating on, and can look it up again.
5773 	 */
5774 	if (scf_pg_get_parent_instance(pg, inst) != 0) {
5775 		switch (scf_error()) {
5776 		case SCF_ERROR_CONNECTION_BROKEN:
5777 			return (ECONNABORTED);
5778 
5779 		case SCF_ERROR_DELETED:
5780 		case SCF_ERROR_CONSTRAINT_VIOLATED:
5781 			return (0);
5782 
5783 		case SCF_ERROR_HANDLE_MISMATCH:
5784 		case SCF_ERROR_NOT_BOUND:
5785 		case SCF_ERROR_NOT_SET:
5786 		default:
5787 			bad_error("scf_pg_get_parent_instance",
5788 			    scf_error());
5789 		}
5790 	}
5791 
5792 	switch (r = libscf_instance_get_fmri(inst, &fmri)) {
5793 	case 0:
5794 		break;
5795 
5796 	case ECONNABORTED:
5797 		return (ECONNABORTED);
5798 
5799 	case ECANCELED:
5800 		return (0);
5801 
5802 	default:
5803 		bad_error("libscf_instance_get_fmri", r);
5804 	}
5805 
5806 	if (strcmp(fmri, SCF_SERVICE_STARTD) != 0) {
5807 		startd_free(fmri, max_scf_fmri_size);
5808 		return (0);
5809 	}
5810 
5811 	prop = safe_scf_property_create(h);
5812 	val = safe_scf_value_create(h);
5813 
5814 	if (strcmp(pg_name, SCF_PG_OPTIONS_OVR) == 0) {
5815 		/* See if we need to set the runlevel. */
5816 		/* CONSTCOND */
5817 		if (0) {
5818 rebind_pg:
5819 			libscf_handle_rebind(h);
5820 			rebound = B_TRUE;
5821 
5822 			r = libscf_lookup_instance(SCF_SERVICE_STARTD, inst);
5823 			switch (r) {
5824 			case 0:
5825 				break;
5826 
5827 			case ECONNABORTED:
5828 				goto rebind_pg;
5829 
5830 			case ENOENT:
5831 				goto out;
5832 
5833 			case EINVAL:
5834 			case ENOTSUP:
5835 				bad_error("libscf_lookup_instance", r);
5836 			}
5837 
5838 			if (scf_instance_get_pg(inst, pg_name, pg) != 0) {
5839 				switch (scf_error()) {
5840 				case SCF_ERROR_DELETED:
5841 				case SCF_ERROR_NOT_FOUND:
5842 					goto out;
5843 
5844 				case SCF_ERROR_CONNECTION_BROKEN:
5845 					goto rebind_pg;
5846 
5847 				case SCF_ERROR_HANDLE_MISMATCH:
5848 				case SCF_ERROR_NOT_BOUND:
5849 				case SCF_ERROR_NOT_SET:
5850 				case SCF_ERROR_INVALID_ARGUMENT:
5851 				default:
5852 					bad_error("scf_instance_get_pg",
5853 					    scf_error());
5854 				}
5855 			}
5856 		}
5857 
5858 		if (scf_pg_get_property(pg, "runlevel", prop) == 0) {
5859 			r = dgraph_set_runlevel(pg, prop);
5860 			switch (r) {
5861 			case ECONNRESET:
5862 				rebound = B_TRUE;
5863 				rebind_inst = B_TRUE;
5864 				/* FALLTHROUGH */
5865 
5866 			case 0:
5867 				break;
5868 
5869 			case ECONNABORTED:
5870 				goto rebind_pg;
5871 
5872 			case ECANCELED:
5873 				goto out;
5874 
5875 			default:
5876 				bad_error("dgraph_set_runlevel", r);
5877 			}
5878 		} else {
5879 			switch (scf_error()) {
5880 			case SCF_ERROR_CONNECTION_BROKEN:
5881 			default:
5882 				goto rebind_pg;
5883 
5884 			case SCF_ERROR_DELETED:
5885 				goto out;
5886 
5887 			case SCF_ERROR_NOT_FOUND:
5888 				break;
5889 
5890 			case SCF_ERROR_INVALID_ARGUMENT:
5891 			case SCF_ERROR_HANDLE_MISMATCH:
5892 			case SCF_ERROR_NOT_BOUND:
5893 			case SCF_ERROR_NOT_SET:
5894 				bad_error("scf_pg_get_property", scf_error());
5895 			}
5896 		}
5897 	}
5898 
5899 	if (rebind_inst) {
5900 lookup_inst:
5901 		r = libscf_lookup_instance(SCF_SERVICE_STARTD, inst);
5902 		switch (r) {
5903 		case 0:
5904 			break;
5905 
5906 		case ECONNABORTED:
5907 			libscf_handle_rebind(h);
5908 			rebound = B_TRUE;
5909 			goto lookup_inst;
5910 
5911 		case ENOENT:
5912 			goto out;
5913 
5914 		case EINVAL:
5915 		case ENOTSUP:
5916 			bad_error("libscf_lookup_instance", r);
5917 		}
5918 	}
5919 
5920 	r = libscf_get_milestone(inst, prop, val, fmri, max_scf_fmri_size);
5921 	switch (r) {
5922 	case 0:
5923 		break;
5924 
5925 	case ECONNABORTED:
5926 		libscf_handle_rebind(h);
5927 		rebound = B_TRUE;
5928 		goto lookup_inst;
5929 
5930 	case EINVAL:
5931 		log_error(LOG_NOTICE,
5932 		    "%s/%s property of %s is misconfigured.\n", pg_name,
5933 		    SCF_PROPERTY_MILESTONE, SCF_SERVICE_STARTD);
5934 		/* FALLTHROUGH */
5935 
5936 	case ECANCELED:
5937 	case ENOENT:
5938 		(void) strcpy(fmri, "all");
5939 		break;
5940 
5941 	default:
5942 		bad_error("libscf_get_milestone", r);
5943 	}
5944 
5945 	r = dgraph_set_milestone(fmri, h, B_FALSE);
5946 	switch (r) {
5947 	case 0:
5948 	case ECONNRESET:
5949 	case EALREADY:
5950 		break;
5951 
5952 	case EINVAL:
5953 		log_error(LOG_WARNING, "Milestone %s is invalid.\n", fmri);
5954 		break;
5955 
5956 	case ENOENT:
5957 		log_error(LOG_WARNING, "Milestone %s does not exist.\n", fmri);
5958 		break;
5959 
5960 	default:
5961 		bad_error("dgraph_set_milestone", r);
5962 	}
5963 
5964 out:
5965 	startd_free(fmri, max_scf_fmri_size);
5966 	scf_value_destroy(val);
5967 	scf_property_destroy(prop);
5968 
5969 	return (rebound ? ECONNRESET : 0);
5970 }
5971 
5972 /*
5973  * process_delete() deletes an instance from the dgraph if 'fmri' is an
5974  * instance fmri or if 'fmri' matches the 'general' property group of an
5975  * instance (or the 'general/enabled' property).
5976  *
5977  * 'fmri' may be overwritten and cannot be trusted on return by the caller.
5978  */
5979 static void
5980 process_delete(char *fmri, scf_handle_t *h)
5981 {
5982 	char *lfmri, *end_inst_fmri;
5983 	const char *inst_name = NULL;
5984 	const char *pg_name = NULL;
5985 	const char *prop_name = NULL;
5986 
5987 	lfmri = safe_strdup(fmri);
5988 
5989 	/* Determine if the FMRI is a property group or instance */
5990 	if (scf_parse_svc_fmri(lfmri, NULL, NULL, &inst_name, &pg_name,
5991 	    &prop_name) != SCF_SUCCESS) {
5992 		log_error(LOG_WARNING,
5993 		    "Received invalid FMRI \"%s\" from repository server.\n",
5994 		    fmri);
5995 	} else if (inst_name != NULL && pg_name == NULL) {
5996 		(void) dgraph_remove_instance(fmri, h);
5997 	} else if (inst_name != NULL && pg_name != NULL) {
5998 		/*
5999 		 * If we're deleting the 'general' property group or
6000 		 * 'general/enabled' property then the whole instance
6001 		 * must be removed from the dgraph.
6002 		 */
6003 		if (strcmp(pg_name, SCF_PG_GENERAL) != 0) {
6004 			free(lfmri);
6005 			return;
6006 		}
6007 
6008 		if (prop_name != NULL &&
6009 		    strcmp(prop_name, SCF_PROPERTY_ENABLED) != 0) {
6010 			free(lfmri);
6011 			return;
6012 		}
6013 
6014 		/*
6015 		 * Because the instance has already been deleted from the
6016 		 * repository, we cannot use any scf_ functions to retrieve
6017 		 * the instance FMRI however we can easily reconstruct it
6018 		 * manually.
6019 		 */
6020 		end_inst_fmri = strstr(fmri, SCF_FMRI_PROPERTYGRP_PREFIX);
6021 		if (end_inst_fmri == NULL)
6022 			bad_error("process_delete", 0);
6023 
6024 		end_inst_fmri[0] = '\0';
6025 
6026 		(void) dgraph_remove_instance(fmri, h);
6027 	}
6028 
6029 	free(lfmri);
6030 }
6031 
6032 /*ARGSUSED*/
6033 void *
6034 repository_event_thread(void *unused)
6035 {
6036 	scf_handle_t *h;
6037 	scf_propertygroup_t *pg;
6038 	scf_instance_t *inst;
6039 	char *fmri = startd_alloc(max_scf_fmri_size);
6040 	char *pg_name = startd_alloc(max_scf_value_size);
6041 	int r;
6042 
6043 	h = libscf_handle_create_bound_loop();
6044 
6045 	pg = safe_scf_pg_create(h);
6046 	inst = safe_scf_instance_create(h);
6047 
6048 retry:
6049 	if (_scf_notify_add_pgtype(h, SCF_GROUP_FRAMEWORK) != SCF_SUCCESS) {
6050 		if (scf_error() == SCF_ERROR_CONNECTION_BROKEN) {
6051 			libscf_handle_rebind(h);
6052 		} else {
6053 			log_error(LOG_WARNING,
6054 			    "Couldn't set up repository notification "
6055 			    "for property group type %s: %s\n",
6056 			    SCF_GROUP_FRAMEWORK, scf_strerror(scf_error()));
6057 
6058 			(void) sleep(1);
6059 		}
6060 
6061 		goto retry;
6062 	}
6063 
6064 	/*CONSTCOND*/
6065 	while (1) {
6066 		ssize_t res;
6067 
6068 		/* Note: fmri is only set on delete events. */
6069 		res = _scf_notify_wait(pg, fmri, max_scf_fmri_size);
6070 		if (res < 0) {
6071 			libscf_handle_rebind(h);
6072 			goto retry;
6073 		} else if (res == 0) {
6074 			/*
6075 			 * property group modified.  inst and pg_name are
6076 			 * pre-allocated scratch space.
6077 			 */
6078 			if (scf_pg_update(pg) < 0) {
6079 				switch (scf_error()) {
6080 				case SCF_ERROR_DELETED:
6081 					continue;
6082 
6083 				case SCF_ERROR_CONNECTION_BROKEN:
6084 					log_error(LOG_WARNING,
6085 					    "Lost repository event due to "
6086 					    "disconnection.\n");
6087 					libscf_handle_rebind(h);
6088 					goto retry;
6089 
6090 				case SCF_ERROR_NOT_BOUND:
6091 				case SCF_ERROR_NOT_SET:
6092 				default:
6093 					bad_error("scf_pg_update", scf_error());
6094 				}
6095 			}
6096 
6097 			r = process_pg_event(h, pg, inst, pg_name);
6098 			switch (r) {
6099 			case 0:
6100 				break;
6101 
6102 			case ECONNABORTED:
6103 				log_error(LOG_WARNING, "Lost repository event "
6104 				    "due to disconnection.\n");
6105 				libscf_handle_rebind(h);
6106 				/* FALLTHROUGH */
6107 
6108 			case ECONNRESET:
6109 				goto retry;
6110 
6111 			default:
6112 				bad_error("process_pg_event", r);
6113 			}
6114 		} else {
6115 			/*
6116 			 * Service, instance, or pg deleted.
6117 			 * Don't trust fmri on return.
6118 			 */
6119 			process_delete(fmri, h);
6120 		}
6121 	}
6122 
6123 	/*NOTREACHED*/
6124 	return (NULL);
6125 }
6126 
6127 void
6128 graph_engine_start()
6129 {
6130 	int err;
6131 
6132 	(void) startd_thread_create(graph_thread, NULL);
6133 
6134 	MUTEX_LOCK(&dgraph_lock);
6135 	while (!initial_milestone_set) {
6136 		err = pthread_cond_wait(&initial_milestone_cv, &dgraph_lock);
6137 		assert(err == 0);
6138 	}
6139 	MUTEX_UNLOCK(&dgraph_lock);
6140 
6141 	(void) startd_thread_create(repository_event_thread, NULL);
6142 	(void) startd_thread_create(graph_event_thread, NULL);
6143 }
6144