etc/services - sync with NetBSD-8

[minix.git] / minix / servers / mib / remote.c

/* MIB service - remote.c - remote service management and communication */

#include "mib.h"

/*
 * TODO: the main feature that is missing here is a more active way to
 * determine that a particular service has died, so that its mount points can
 * be removed proactively.  Without this, there is a (small) risk that we end
 * up talking to a recycled endpoint with a service that ignores our request,
 * resulting in a deadlock of the MIB service.  Right now, the problem is that
 * there is no proper DS API to subscribe to generic service-down events.
 *
 * In the long term, communication to other services should be made
 * asynchronous, so that the MIB service does not block if there are problems
 * with the other service.  The protocol should already support this, and some
 * simplifications are the result of preparing for future asynchrony support
 * (such as not dynamically querying the remote root node for its properties,
 * which would be very hard to implement in a nonblocking way).  However,
 * actual support is missing.  For now we assume that the remote service either
 * answers the request, or crashes (causing the sendrec to abort), which is
 * mostly good enough.
 */

/* This is the maximum number of remote services that may register subtrees. */
#define MIB_ENDPTS      (1U << MIB_EID_BITS)

/* This is the maximum service label size, including '\0'. */
#define MIB_LABEL_MAX   16

/* Table of remote endpoints, indexed by mount point nodes' node_eid fields. */
static struct {
        endpoint_t endpt;               /* remote endpoint or NONE */
        struct mib_node *nodes;         /* head of list of mount point nodes */
        char label[MIB_LABEL_MAX];      /* label of the remote endpoint */
} endpts[MIB_ENDPTS];

/*
 * Initialize the table of remote endpoints.
 */
void
mib_remote_init(void)
{
        unsigned int i;

        for (i = 0; i < __arraycount(endpts); i++) {
                endpts[i].endpt = NONE;
                endpts[i].nodes = NULL;
        }
}

/*
 * The remote endpoint with the given table index has been determined to have
 * died.  Clean up all its mount points.
 */
static void
mib_down(unsigned int eid)
{
        struct mib_node *node, *next_node;

        assert(endpts[eid].endpt != NONE);
        assert(endpts[eid].nodes != NULL);

        /* Unmount each of the remote endpoint's mount points. */
        for (node = endpts[eid].nodes; node != NULL; node = next_node) {
                /* The unmount call may deallocate the node object. */
                next_node = node->node_next;

                mib_unmount(node);
        }

        /* Mark the entry itself as no longer in use. */
        endpts[eid].endpt = NONE;
        endpts[eid].nodes = NULL;
}

/*
 * Obtain the label for the given endpoint.  On success, return OK and store
 * the label in the given buffer.  If the label cannot be retrieved or does not
 * fit in the given buffer, return a negative error code.
 */
static int
mib_get_label(endpoint_t endpt, char * label, size_t labelsize)
{
        char key[DS_MAX_KEYLEN];
        int r;

        /* TODO: init has a label, so this is not a proper is-service test! */
        if ((r = ds_retrieve_label_name(key, endpt)) != OK) {
                printf("MIB: unable to obtain label for %d\n", endpt);

                return r;
        }

        key[sizeof(key) - 1] = 0;
        if (strlen(key) >= labelsize) {
                /* This should really never happen. */
                printf("MIB: service %d label '%s' is too long\n", endpt, key);

                return ENAMETOOLONG;
        }

        strlcpy(label, key, labelsize);
        return OK;
}

/*
 * Register a remote subtree, mounting it in the local tree as requested.
 */
static void
mib_do_register(endpoint_t endpt, const char * label, uint32_t rid,
        uint32_t flags, unsigned int csize, unsigned int clen, const int * mib,
        unsigned int miblen)
{
        struct mib_node *node;
        unsigned int eid;
        int r, free_eid;

        /*
         * See if we already have a remote endpoint for the service's label.
         * If so, we can safely assume that the old endpoint has died and we
         * have to unmount any previous entries.  Also find a free entry for
         * the remote endpoint if it is new.
         */
        free_eid = -1;
        for (eid = 0; eid < __arraycount(endpts); eid++) {
                if (endpts[eid].endpt == endpt)
                        break;
                else if (endpts[eid].endpt != NONE &&
                    !strcmp(endpts[eid].label, label)) {
                        mib_down(eid);

                        assert(endpts[eid].endpt == NONE);
                        assert(endpts[eid].nodes == NULL);

                        break;
                } else if (endpts[eid].endpt == NONE && free_eid < 0)
                        free_eid = eid;
        }

        if (eid == __arraycount(endpts)) {
                if (free_eid < 0) {
                        printf("MIB: remote endpoints table is full!\n");

                        return;
                }

                eid = free_eid;
        }

        /*
         * Make sure that the caller does not introduce two mount points with
         * the same ID.  Right now we refuse such requests; instead, we could
         * also choose to first deregister the old mount point with this ID.
         */
        for (node = endpts[eid].nodes; node != NULL; node = node->node_next) {
                if (node->node_rid == rid)
                        break;
        }

        if (node != NULL) {
                MIB_DEBUG_MOUNT(("MIB: service %d tried to reuse ID %"PRIu32
                    "\n", endpt, rid));

                return;
        }

        /*
         * If we did not already have an entry for this endpoint, add one now,
         * because the mib_mount() call will expect it to be there.  If the
         * mount call fails, we may have to invalidate the entry again.
         */
        if (endpts[eid].endpt == NONE) {
                endpts[eid].endpt = endpt;
                endpts[eid].nodes = NULL;
                strlcpy(endpts[eid].label, label, sizeof(endpts[eid].label));
        }

        /* Attempt to mount the remote subtree in the tree. */
        r = mib_mount(mib, miblen, eid, rid, flags, csize, clen, &node);

        if (r != OK) {
                /* If the entry has no other mount points, invalidate it. */
                if (endpts[eid].nodes == NULL)
                        endpts[eid].endpt = NONE;

                return;
        }

        /* Add the new node to the list of mount points of the endpoint. */
        node->node_next = endpts[eid].nodes;
        endpts[eid].nodes = node;
}

/*
 * Process a mount point registration request from another service.
 */
int
mib_register(const message * m_in, int ipc_status)
{
        char label[DS_MAX_KEYLEN];

        /*
         * Registration messages must be one-way, or they may cause a deadlock
         * if crossed by a request coming from us.  This case also effectively
         * eliminates the possibility for userland to register nodes.  The
         * return value of ENOSYS effectively tells userland that this call
         * number is not in use, which allows us to repurpose call numbers
         * later.
         */
        if (IPC_STATUS_CALL(ipc_status) == SENDREC)
                return ENOSYS;

        MIB_DEBUG_MOUNT(("MIB: got register request from %d\n",
            m_in->m_source));

        /* Double-check if the caller is a service by obtaining its label. */
        if (mib_get_label(m_in->m_source, label, sizeof(label)) != OK)
                return EDONTREPLY;

        /* Perform one message-level bounds check here. */
        if (m_in->m_lsys_mib_register.miblen >
            __arraycount(m_in->m_lsys_mib_register.mib))
                return EDONTREPLY;

        /* The rest of the work is handled by a message-agnostic function. */
        mib_do_register(m_in->m_source, label,
            m_in->m_lsys_mib_register.root_id, m_in->m_lsys_mib_register.flags,
            m_in->m_lsys_mib_register.csize, m_in->m_lsys_mib_register.clen,
            m_in->m_lsys_mib_register.mib, m_in->m_lsys_mib_register.miblen);

        /* Never reply to this message. */
        return EDONTREPLY;
}

/*
 * Deregister a previously registered remote subtree, unmounting it from the
 * local tree.
 */
static void
mib_do_deregister(endpoint_t endpt, uint32_t rid)
{
        struct mib_node *node, **nodep;
        unsigned int eid;

        for (eid = 0; eid < __arraycount(endpts); eid++) {
                if (endpts[eid].endpt == endpt)
                        break;
        }

        if (eid == __arraycount(endpts)) {
                MIB_DEBUG_MOUNT(("MIB: deregister request from unknown "
                    "endpoint %d\n", endpt));

                return;
        }

        for (nodep = &endpts[eid].nodes; *nodep != NULL;
            nodep = &node->node_next) {
                node = *nodep;

                if (node->node_rid == rid)
                        break;
        }

        if (*nodep == NULL) {
                MIB_DEBUG_MOUNT(("MIB: deregister request from %d for unknown "
                    "ID %"PRIu32"\n", endpt, rid));

                return;
        }

        /*
         * The unmount function may or may not deallocate the node object, so
         * remove it from the linked list first.  If this leaves an empty
         * linked list, also mark the remote endpoint entry itself as free.
         */
        *nodep = node->node_next;

        if (endpts[eid].nodes == NULL) {
                endpts[eid].endpt = NONE;
                endpts[eid].nodes = NULL;
        }

        /* Finally, unmount the remote subtree. */
        mib_unmount(node);
}

/*
 * Process a mount point deregistration request from another service.
 */
int
mib_deregister(const message * m_in, int ipc_status)
{

        /* Same as for registration messages. */
        if (IPC_STATUS_CALL(ipc_status) == SENDREC)
                return ENOSYS;

        MIB_DEBUG_MOUNT(("MIB: got deregister request from %d\n",
            m_in->m_source));

        /* The rest of the work is handled by a message-agnostic function. */
        mib_do_deregister(m_in->m_source, m_in->m_lsys_mib_register.root_id);

        /* Never reply to this message. */
        return EDONTREPLY;
}

/*
 * Retrieve information about the root of a remote subtree, specifically its
 * name and description.  This is done only when there was no corresponding
 * local node and one has to be created temporarily.  On success, return OK
 * with the name and description stored in the given buffers.  Otherwise,
 * return a negative error code.
 */
int
mib_remote_info(unsigned int eid, uint32_t rid, char * name, size_t namesize,
        char * desc, size_t descsize)
{
        endpoint_t endpt;
        cp_grant_id_t name_grant, desc_grant;
        message m;
        int r;

        if (eid >= __arraycount(endpts) || endpts[eid].endpt == NONE)
                return EINVAL;

        endpt = endpts[eid].endpt;

        if ((name_grant = cpf_grant_direct(endpt, (vir_bytes)name, namesize,
            CPF_WRITE)) == GRANT_INVALID)
                return EINVAL;

        if ((desc_grant = cpf_grant_direct(endpt, (vir_bytes)desc, descsize,
            CPF_WRITE)) == GRANT_INVALID) {
                cpf_revoke(name_grant);

                return EINVAL;
        }

        memset(&m, 0, sizeof(m));

        m.m_type = COMMON_MIB_INFO;
        m.m_mib_lsys_info.req_id = 0; /* reserved for future async support */
        m.m_mib_lsys_info.root_id = rid;
        m.m_mib_lsys_info.name_grant = name_grant;
        m.m_mib_lsys_info.name_size = namesize;
        m.m_mib_lsys_info.desc_grant = desc_grant;
        m.m_mib_lsys_info.desc_size = descsize;

        r = ipc_sendrec(endpt, &m);

        cpf_revoke(desc_grant);
        cpf_revoke(name_grant);

        if (r != OK)
                return r;

        if (m.m_type != COMMON_MIB_REPLY)
                return EINVAL;
        if (m.m_lsys_mib_reply.req_id != 0)
                return EINVAL;

        return m.m_lsys_mib_reply.status;
}

/*
 * Relay a sysctl(2) call from a user process to a remote service, because the
 * call reached a mount point into a remote subtree.  Return the result code
 * from the remote service.  Alternatively, return ERESTART if it has been
 * determined that the remote service is dead, in which case its mount points
 * will have been removed (possibly including the entire given node), and the
 * caller should continue the call on the underlying local subtree if there is
 * any.  Note that the remote service may also return ERESTART to indicate that
 * the remote subtree does not exist, either because it is being deregistered
 * or because the remote service was restarted with loss of state.
 */
ssize_t
mib_remote_call(struct mib_call * call, struct mib_node * node,
        struct mib_oldp * oldp, struct mib_newp * newp)
{
        cp_grant_id_t name_grant, oldp_grant, newp_grant;
        size_t oldp_len, newp_len;
        endpoint_t endpt;
        message m;
        int r;

        endpt = endpts[node->node_eid].endpt;
        assert(endpt != NONE);

        /*
         * Allocate grants.  Since ENOMEM has a special meaning for sysctl(2),
         * never return that code even if it is the most appropriate one.
         * The remainder of the name may be empty; the callee should check.
         */
        name_grant = cpf_grant_direct(endpt, (vir_bytes)call->call_name,
            call->call_namelen * sizeof(call->call_name[0]), CPF_READ);
        if (!GRANT_VALID(name_grant))
                return EINVAL;

        if ((r = mib_relay_oldp(endpt, oldp, &oldp_grant, &oldp_len)) != OK) {
                cpf_revoke(name_grant);

                return r;
        }

        if ((r = mib_relay_newp(endpt, newp, &newp_grant, &newp_len)) != OK) {
                if (GRANT_VALID(oldp_grant))
                        cpf_revoke(oldp_grant);
                cpf_revoke(name_grant);

                return r;
        }

        /*
         * Construct the request message.  We have not optimized this flow for
         * performance.  In particular, we never embed even short names in the
         * message, and we supply a flag indicating whether the caller is root
         * regardless of whether the callee is interested in this.  This is
         * more convenient for the callee, but also more costly.
         */
        memset(&m, 0, sizeof(m));

        m.m_type = COMMON_MIB_CALL;
        m.m_mib_lsys_call.req_id = 0; /* reserved for future async support */
        m.m_mib_lsys_call.root_id = node->node_rid;
        m.m_mib_lsys_call.name_grant = name_grant;
        m.m_mib_lsys_call.name_len = call->call_namelen;
        m.m_mib_lsys_call.oldp_grant = oldp_grant;
        m.m_mib_lsys_call.oldp_len = oldp_len;
        m.m_mib_lsys_call.newp_grant = newp_grant;
        m.m_mib_lsys_call.newp_len = newp_len;
        m.m_mib_lsys_call.user_endpt = call->call_endpt;
        m.m_mib_lsys_call.flags = !!mib_authed(call); /* TODO: define flags */
        m.m_mib_lsys_call.root_ver = node->node_ver;
        m.m_mib_lsys_call.tree_ver = mib_root.node_ver;

        /* Issue a synchronous call to the remove service. */
        r = ipc_sendrec(endpt, &m);

        /* Then first clean up. */
        if (GRANT_VALID(newp_grant))
                cpf_revoke(newp_grant);
        if (GRANT_VALID(oldp_grant))
                cpf_revoke(oldp_grant);
        cpf_revoke(name_grant);

        /*
         * Treat any IPC-level error as an indication that there is a problem
         * with the remote service.  Declare it dead, remove all its mount
         * points, and return ERESTART to indicate to the caller that it should
         * (carefully) try to continue the request on a local subtree instead.
         * Again: mib_down() may actually deallocate the given 'node' object.
         */
        if (r != OK) {
                mib_down(node->node_eid);

                return ERESTART;
        }

        if (m.m_type != COMMON_MIB_REPLY)
                return EINVAL;
        if (m.m_lsys_mib_reply.req_id != 0)
                return EINVAL;

        /*
         * If a deregister message from the service crosses our call, we'll get
         * the response before we get the deregister request.  In that case,
         * the remote service should return ERESTART to indicate that the mount
         * point does not exist as far as it is concerned, so that we can try
         * the local version of the tree instead.
         */
        if (m.m_lsys_mib_reply.status == ERESTART)
                mib_do_deregister(endpt, node->node_rid);

        return m.m_lsys_mib_reply.status;
}