xref: /illumos-gate/usr/src/uts/common/fs/zfs/zcp.c (revision dd328bf6)
1 /*
2  * CDDL HEADER START
3  *
4  * This file and its contents are supplied under the terms of the
5  * Common Development and Distribution License ("CDDL"), version 1.0.
6  * You may only use this file in accordance with the terms of version
7  * 1.0 of the CDDL.
8  *
9  * A full copy of the text of the CDDL should have accompanied this
10  * source.  A copy of the CDDL is also available via the Internet at
11  * http://www.illumos.org/license/CDDL.
12  *
13  * CDDL HEADER END
14  */
15 
16 /*
17  * Copyright (c) 2016, 2017 by Delphix. All rights reserved.
18  */
19 
20 /*
21  * ZFS Channel Programs (ZCP)
22  *
23  * The ZCP interface allows various ZFS commands and operations ZFS
24  * administrative operations (e.g. creating and destroying snapshots, typically
25  * performed via an ioctl to /dev/zfs by the zfs(1M) command and
26  * libzfs/libzfs_core) to be run * programmatically as a Lua script.  A ZCP
27  * script is run as a dsl_sync_task and fully executed during one transaction
28  * group sync.  This ensures that no other changes can be written concurrently
29  * with a running Lua script.  Combining multiple calls to the exposed ZFS
30  * functions into one script gives a number of benefits:
31  *
32  * 1. Atomicity.  For some compound or iterative operations, it's useful to be
33  * able to guarantee that the state of a pool has not changed between calls to
34  * ZFS.
35  *
36  * 2. Performance.  If a large number of changes need to be made (e.g. deleting
37  * many filesystems), there can be a significant performance penalty as a
38  * result of the need to wait for a transaction group sync to pass for every
39  * single operation.  When expressed as a single ZCP script, all these changes
40  * can be performed at once in one txg sync.
41  *
42  * A modified version of the Lua 5.2 interpreter is used to run channel program
43  * scripts. The Lua 5.2 manual can be found at:
44  *
45  *      http://www.lua.org/manual/5.2/
46  *
47  * If being run by a user (via an ioctl syscall), executing a ZCP script
48  * requires root privileges in the global zone.
49  *
50  * Scripts are passed to zcp_eval() as a string, then run in a synctask by
51  * zcp_eval_sync().  Arguments can be passed into the Lua script as an nvlist,
52  * which will be converted to a Lua table.  Similarly, values returned from
53  * a ZCP script will be converted to an nvlist.  See zcp_lua_to_nvlist_impl()
54  * for details on exact allowed types and conversion.
55  *
56  * ZFS functionality is exposed to a ZCP script as a library of function calls.
57  * These calls are sorted into submodules, such as zfs.list and zfs.sync, for
58  * iterators and synctasks, respectively.  Each of these submodules resides in
59  * its own source file, with a zcp_*_info structure describing each library
60  * call in the submodule.
61  *
62  * Error handling in ZCP scripts is handled by a number of different methods
63  * based on severity:
64  *
65  * 1. Memory and time limits are in place to prevent a channel program from
66  * consuming excessive system or running forever.  If one of these limits is
67  * hit, the channel program will be stopped immediately and return from
68  * zcp_eval() with an error code. No attempt will be made to roll back or undo
69  * any changes made by the channel program before the error occured.
70  * Consumers invoking zcp_eval() from elsewhere in the kernel may pass a time
71  * limit of 0, disabling the time limit.
72  *
73  * 2. Internal Lua errors can occur as a result of a syntax error, calling a
74  * library function with incorrect arguments, invoking the error() function,
75  * failing an assert(), or other runtime errors.  In these cases the channel
76  * program will stop executing and return from zcp_eval() with an error code.
77  * In place of a return value, an error message will also be returned in the
78  * 'result' nvlist containing information about the error. No attempt will be
79  * made to roll back or undo any changes made by the channel program before the
80  * error occured.
81  *
82  * 3. If an error occurs inside a ZFS library call which returns an error code,
83  * the error is returned to the Lua script to be handled as desired.
84  *
85  * In the first two cases, Lua's error-throwing mechanism is used, which
86  * longjumps out of the script execution with luaL_error() and returns with the
87  * error.
88  *
89  * See zfs-program(1M) for more information on high level usage.
90  */
91 
92 #include "lua.h"
93 #include "lualib.h"
94 #include "lauxlib.h"
95 
96 #include <sys/dsl_prop.h>
97 #include <sys/dsl_synctask.h>
98 #include <sys/dsl_dataset.h>
99 #include <sys/zcp.h>
100 #include <sys/zcp_iter.h>
101 #include <sys/zcp_prop.h>
102 #include <sys/zcp_global.h>
103 #include <util/sscanf.h>
104 
105 #define	ZCP_NVLIST_MAX_DEPTH 20
106 
107 uint64_t zfs_lua_check_instrlimit_interval = 100;
108 uint64_t zfs_lua_max_instrlimit = ZCP_MAX_INSTRLIMIT;
109 uint64_t zfs_lua_max_memlimit = ZCP_MAX_MEMLIMIT;
110 
111 /*
112  * Forward declarations for mutually recursive functions
113  */
114 static int zcp_nvpair_value_to_lua(lua_State *, nvpair_t *, char *, int);
115 static int zcp_lua_to_nvlist_impl(lua_State *, int, nvlist_t *, const char *,
116     int);
117 
118 /*
119  * The outer-most error callback handler for use with lua_pcall(). On
120  * error Lua will call this callback with a single argument that
121  * represents the error value. In most cases this will be a string
122  * containing an error message, but channel programs can use Lua's
123  * error() function to return arbitrary objects as errors. This callback
124  * returns (on the Lua stack) the original error object along with a traceback.
125  *
126  * Fatal Lua errors can occur while resources are held, so we also call any
127  * registered cleanup function here.
128  */
129 static int
zcp_error_handler(lua_State * state)130 zcp_error_handler(lua_State *state)
131 {
132 	const char *msg;
133 
134 	zcp_cleanup(state);
135 
136 	VERIFY3U(1, ==, lua_gettop(state));
137 	msg = lua_tostring(state, 1);
138 	luaL_traceback(state, state, msg, 1);
139 	return (1);
140 }
141 
142 int
zcp_argerror(lua_State * state,int narg,const char * msg,...)143 zcp_argerror(lua_State *state, int narg, const char *msg, ...)
144 {
145 	va_list alist;
146 
147 	va_start(alist, msg);
148 	const char *buf = lua_pushvfstring(state, msg, alist);
149 	va_end(alist);
150 
151 	return (luaL_argerror(state, narg, buf));
152 }
153 
154 /*
155  * Install a new cleanup function, which will be invoked with the given
156  * opaque argument if a fatal error causes the Lua interpreter to longjump out
157  * of a function call.
158  *
159  * If an error occurs, the cleanup function will be invoked exactly once and
160  * then unreigstered.
161  *
162  * Returns the registered cleanup handler so the caller can deregister it
163  * if no error occurs.
164  */
165 zcp_cleanup_handler_t *
zcp_register_cleanup(lua_State * state,zcp_cleanup_t cleanfunc,void * cleanarg)166 zcp_register_cleanup(lua_State *state, zcp_cleanup_t cleanfunc, void *cleanarg)
167 {
168 	zcp_run_info_t *ri = zcp_run_info(state);
169 
170 	zcp_cleanup_handler_t *zch = kmem_alloc(sizeof (*zch), KM_SLEEP);
171 	zch->zch_cleanup_func = cleanfunc;
172 	zch->zch_cleanup_arg = cleanarg;
173 	list_insert_head(&ri->zri_cleanup_handlers, zch);
174 
175 	return (zch);
176 }
177 
178 void
zcp_deregister_cleanup(lua_State * state,zcp_cleanup_handler_t * zch)179 zcp_deregister_cleanup(lua_State *state, zcp_cleanup_handler_t *zch)
180 {
181 	zcp_run_info_t *ri = zcp_run_info(state);
182 	list_remove(&ri->zri_cleanup_handlers, zch);
183 	kmem_free(zch, sizeof (*zch));
184 }
185 
186 /*
187  * Execute the currently registered cleanup handlers then free them and
188  * destroy the handler list.
189  */
190 void
zcp_cleanup(lua_State * state)191 zcp_cleanup(lua_State *state)
192 {
193 	zcp_run_info_t *ri = zcp_run_info(state);
194 
195 	for (zcp_cleanup_handler_t *zch =
196 	    list_remove_head(&ri->zri_cleanup_handlers); zch != NULL;
197 	    zch = list_remove_head(&ri->zri_cleanup_handlers)) {
198 		zch->zch_cleanup_func(zch->zch_cleanup_arg);
199 		kmem_free(zch, sizeof (*zch));
200 	}
201 }
202 
203 /*
204  * Convert the lua table at the given index on the Lua stack to an nvlist
205  * and return it.
206  *
207  * If the table can not be converted for any reason, NULL is returned and
208  * an error message is pushed onto the Lua stack.
209  */
210 static nvlist_t *
zcp_table_to_nvlist(lua_State * state,int index,int depth)211 zcp_table_to_nvlist(lua_State *state, int index, int depth)
212 {
213 	nvlist_t *nvl;
214 	/*
215 	 * Converting a Lua table to an nvlist with key uniqueness checking is
216 	 * O(n^2) in the number of keys in the nvlist, which can take a long
217 	 * time when we return a large table from a channel program.
218 	 * Furthermore, Lua's table interface *almost* guarantees unique keys
219 	 * on its own (details below). Therefore, we don't use fnvlist_alloc()
220 	 * here to avoid the built-in uniqueness checking.
221 	 *
222 	 * The *almost* is because it's possible to have key collisions between
223 	 * e.g. the string "1" and the number 1, or the string "true" and the
224 	 * boolean true, so we explicitly check that when we're looking at a
225 	 * key which is an integer / boolean or a string that can be parsed as
226 	 * one of those types. In the worst case this could still devolve into
227 	 * O(n^2), so we only start doing these checks on boolean/integer keys
228 	 * once we've seen a string key which fits this weird usage pattern.
229 	 *
230 	 * Ultimately, we still want callers to know that the keys in this
231 	 * nvlist are unique, so before we return this we set the nvlist's
232 	 * flags to reflect that.
233 	 */
234 	VERIFY0(nvlist_alloc(&nvl, 0, KM_SLEEP));
235 
236 	/*
237 	 * Push an empty stack slot where lua_next() will store each
238 	 * table key.
239 	 */
240 	lua_pushnil(state);
241 	boolean_t saw_str_could_collide = B_FALSE;
242 	while (lua_next(state, index) != 0) {
243 		/*
244 		 * The next key-value pair from the table at index is
245 		 * now on the stack, with the key at stack slot -2 and
246 		 * the value at slot -1.
247 		 */
248 		int err = 0;
249 		char buf[32];
250 		const char *key = NULL;
251 		boolean_t key_could_collide = B_FALSE;
252 
253 		switch (lua_type(state, -2)) {
254 		case LUA_TSTRING:
255 			key = lua_tostring(state, -2);
256 
257 			/* check if this could collide with a number or bool */
258 			long long tmp;
259 			int parselen;
260 			if ((sscanf(key, "%lld%n", &tmp, &parselen) > 0 &&
261 			    parselen == strlen(key)) ||
262 			    strcmp(key, "true") == 0 ||
263 			    strcmp(key, "false") == 0) {
264 				key_could_collide = B_TRUE;
265 				saw_str_could_collide = B_TRUE;
266 			}
267 			break;
268 		case LUA_TBOOLEAN:
269 			key = (lua_toboolean(state, -2) == B_TRUE ?
270 			    "true" : "false");
271 			if (saw_str_could_collide) {
272 				key_could_collide = B_TRUE;
273 			}
274 			break;
275 		case LUA_TNUMBER:
276 			VERIFY3U(sizeof (buf), >,
277 			    snprintf(buf, sizeof (buf), "%lld",
278 			    (longlong_t)lua_tonumber(state, -2)));
279 			key = buf;
280 			if (saw_str_could_collide) {
281 				key_could_collide = B_TRUE;
282 			}
283 			break;
284 		default:
285 			fnvlist_free(nvl);
286 			(void) lua_pushfstring(state, "Invalid key "
287 			    "type '%s' in table",
288 			    lua_typename(state, lua_type(state, -2)));
289 			return (NULL);
290 		}
291 		/*
292 		 * Check for type-mismatched key collisions, and throw an error.
293 		 */
294 		if (key_could_collide && nvlist_exists(nvl, key)) {
295 			fnvlist_free(nvl);
296 			(void) lua_pushfstring(state, "Collision of "
297 			    "key '%s' in table", key);
298 			return (NULL);
299 		}
300 		/*
301 		 * Recursively convert the table value and insert into
302 		 * the new nvlist with the parsed key.  To prevent
303 		 * stack overflow on circular or heavily nested tables,
304 		 * we track the current nvlist depth.
305 		 */
306 		if (depth >= ZCP_NVLIST_MAX_DEPTH) {
307 			fnvlist_free(nvl);
308 			(void) lua_pushfstring(state, "Maximum table "
309 			    "depth (%d) exceeded for table",
310 			    ZCP_NVLIST_MAX_DEPTH);
311 			return (NULL);
312 		}
313 		err = zcp_lua_to_nvlist_impl(state, -1, nvl, key,
314 		    depth + 1);
315 		if (err != 0) {
316 			fnvlist_free(nvl);
317 			/*
318 			 * Error message has been pushed to the lua
319 			 * stack by the recursive call.
320 			 */
321 			return (NULL);
322 		}
323 		/*
324 		 * Pop the value pushed by lua_next().
325 		 */
326 		lua_pop(state, 1);
327 	}
328 
329 	/*
330 	 * Mark the nvlist as having unique keys. This is a little ugly, but we
331 	 * ensured above that there are no duplicate keys in the nvlist.
332 	 */
333 	nvl->nvl_nvflag |= NV_UNIQUE_NAME;
334 
335 	return (nvl);
336 }
337 
338 /*
339  * Convert a value from the given index into the lua stack to an nvpair, adding
340  * it to an nvlist with the given key.
341  *
342  * Values are converted as follows:
343  *
344  *   string -> string
345  *   number -> int64
346  *   boolean -> boolean
347  *   nil -> boolean (no value)
348  *
349  * Lua tables are converted to nvlists and then inserted. The table's keys
350  * are converted to strings then used as keys in the nvlist to store each table
351  * element.  Keys are converted as follows:
352  *
353  *   string -> no change
354  *   number -> "%lld"
355  *   boolean -> "true" | "false"
356  *   nil -> error
357  *
358  * In the case of a key collision, an error is thrown.
359  *
360  * If an error is encountered, a nonzero error code is returned, and an error
361  * string will be pushed onto the Lua stack.
362  */
363 static int
zcp_lua_to_nvlist_impl(lua_State * state,int index,nvlist_t * nvl,const char * key,int depth)364 zcp_lua_to_nvlist_impl(lua_State *state, int index, nvlist_t *nvl,
365     const char *key, int depth)
366 {
367 	/*
368 	 * Verify that we have enough remaining space in the lua stack to parse
369 	 * a key-value pair and push an error.
370 	 */
371 	if (!lua_checkstack(state, 3)) {
372 		(void) lua_pushstring(state, "Lua stack overflow");
373 		return (1);
374 	}
375 
376 	index = lua_absindex(state, index);
377 
378 	switch (lua_type(state, index)) {
379 	case LUA_TNIL:
380 		fnvlist_add_boolean(nvl, key);
381 		break;
382 	case LUA_TBOOLEAN:
383 		fnvlist_add_boolean_value(nvl, key,
384 		    lua_toboolean(state, index));
385 		break;
386 	case LUA_TNUMBER:
387 		fnvlist_add_int64(nvl, key, lua_tonumber(state, index));
388 		break;
389 	case LUA_TSTRING:
390 		fnvlist_add_string(nvl, key, lua_tostring(state, index));
391 		break;
392 	case LUA_TTABLE: {
393 		nvlist_t *value_nvl = zcp_table_to_nvlist(state, index, depth);
394 		if (value_nvl == NULL)
395 			return (EINVAL);
396 
397 		fnvlist_add_nvlist(nvl, key, value_nvl);
398 		fnvlist_free(value_nvl);
399 		break;
400 	}
401 	default:
402 		(void) lua_pushfstring(state,
403 		    "Invalid value type '%s' for key '%s'",
404 		    lua_typename(state, lua_type(state, index)), key);
405 		return (EINVAL);
406 	}
407 
408 	return (0);
409 }
410 
411 /*
412  * Convert a lua value to an nvpair, adding it to an nvlist with the given key.
413  */
414 static void
zcp_lua_to_nvlist(lua_State * state,int index,nvlist_t * nvl,const char * key)415 zcp_lua_to_nvlist(lua_State *state, int index, nvlist_t *nvl, const char *key)
416 {
417 	/*
418 	 * On error, zcp_lua_to_nvlist_impl pushes an error string onto the Lua
419 	 * stack before returning with a nonzero error code. If an error is
420 	 * returned, throw a fatal lua error with the given string.
421 	 */
422 	if (zcp_lua_to_nvlist_impl(state, index, nvl, key, 0) != 0)
423 		(void) lua_error(state);
424 }
425 
426 static int
zcp_lua_to_nvlist_helper(lua_State * state)427 zcp_lua_to_nvlist_helper(lua_State *state)
428 {
429 	nvlist_t *nv = (nvlist_t *)lua_touserdata(state, 2);
430 	const char *key = (const char *)lua_touserdata(state, 1);
431 	zcp_lua_to_nvlist(state, 3, nv, key);
432 	return (0);
433 }
434 
435 static void
zcp_convert_return_values(lua_State * state,nvlist_t * nvl,const char * key,int * result)436 zcp_convert_return_values(lua_State *state, nvlist_t *nvl,
437     const char *key, int *result)
438 {
439 	int err;
440 	VERIFY3U(1, ==, lua_gettop(state));
441 	lua_pushcfunction(state, zcp_lua_to_nvlist_helper);
442 	lua_pushlightuserdata(state, (char *)key);
443 	lua_pushlightuserdata(state, nvl);
444 	lua_pushvalue(state, 1);
445 	lua_remove(state, 1);
446 	err = lua_pcall(state, 3, 0, 0); /* zcp_lua_to_nvlist_helper */
447 	if (err != 0) {
448 		zcp_lua_to_nvlist(state, 1, nvl, ZCP_RET_ERROR);
449 		*result = SET_ERROR(ECHRNG);
450 	}
451 }
452 
453 /*
454  * Push a Lua table representing nvl onto the stack.  If it can't be
455  * converted, return EINVAL, fill in errbuf, and push nothing. errbuf may
456  * be specified as NULL, in which case no error string will be output.
457  *
458  * Most nvlists are converted as simple key->value Lua tables, but we make
459  * an exception for the case where all nvlist entries are BOOLEANs (a string
460  * key without a value). In Lua, a table key pointing to a value of Nil
461  * (no value) is equivalent to the key not existing, so a BOOLEAN nvlist
462  * entry can't be directly converted to a Lua table entry. Nvlists of entirely
463  * BOOLEAN entries are frequently used to pass around lists of datasets, so for
464  * convenience we check for this case, and convert it to a simple Lua array of
465  * strings.
466  */
467 int
zcp_nvlist_to_lua(lua_State * state,nvlist_t * nvl,char * errbuf,int errbuf_len)468 zcp_nvlist_to_lua(lua_State *state, nvlist_t *nvl,
469     char *errbuf, int errbuf_len)
470 {
471 	nvpair_t *pair;
472 	lua_newtable(state);
473 	boolean_t has_values = B_FALSE;
474 	/*
475 	 * If the list doesn't have any values, just convert it to a string
476 	 * array.
477 	 */
478 	for (pair = nvlist_next_nvpair(nvl, NULL);
479 	    pair != NULL; pair = nvlist_next_nvpair(nvl, pair)) {
480 		if (nvpair_type(pair) != DATA_TYPE_BOOLEAN) {
481 			has_values = B_TRUE;
482 			break;
483 		}
484 	}
485 	if (!has_values) {
486 		int i = 1;
487 		for (pair = nvlist_next_nvpair(nvl, NULL);
488 		    pair != NULL; pair = nvlist_next_nvpair(nvl, pair)) {
489 			(void) lua_pushinteger(state, i);
490 			(void) lua_pushstring(state, nvpair_name(pair));
491 			(void) lua_settable(state, -3);
492 			i++;
493 		}
494 	} else {
495 		for (pair = nvlist_next_nvpair(nvl, NULL);
496 		    pair != NULL; pair = nvlist_next_nvpair(nvl, pair)) {
497 			int err = zcp_nvpair_value_to_lua(state, pair,
498 			    errbuf, errbuf_len);
499 			if (err != 0) {
500 				lua_pop(state, 1);
501 				return (err);
502 			}
503 			(void) lua_setfield(state, -2, nvpair_name(pair));
504 		}
505 	}
506 	return (0);
507 }
508 
509 /*
510  * Push a Lua object representing the value of "pair" onto the stack.
511  *
512  * Only understands boolean_value, string, int64, nvlist,
513  * string_array, and int64_array type values.  For other
514  * types, returns EINVAL, fills in errbuf, and pushes nothing.
515  */
516 static int
zcp_nvpair_value_to_lua(lua_State * state,nvpair_t * pair,char * errbuf,int errbuf_len)517 zcp_nvpair_value_to_lua(lua_State *state, nvpair_t *pair,
518     char *errbuf, int errbuf_len)
519 {
520 	int err = 0;
521 
522 	if (pair == NULL) {
523 		lua_pushnil(state);
524 		return (0);
525 	}
526 
527 	switch (nvpair_type(pair)) {
528 	case DATA_TYPE_BOOLEAN_VALUE:
529 		(void) lua_pushboolean(state,
530 		    fnvpair_value_boolean_value(pair));
531 		break;
532 	case DATA_TYPE_STRING:
533 		(void) lua_pushstring(state, fnvpair_value_string(pair));
534 		break;
535 	case DATA_TYPE_INT64:
536 		(void) lua_pushinteger(state, fnvpair_value_int64(pair));
537 		break;
538 	case DATA_TYPE_NVLIST:
539 		err = zcp_nvlist_to_lua(state,
540 		    fnvpair_value_nvlist(pair), errbuf, errbuf_len);
541 		break;
542 	case DATA_TYPE_STRING_ARRAY: {
543 		char **strarr;
544 		uint_t nelem;
545 		(void) nvpair_value_string_array(pair, &strarr, &nelem);
546 		lua_newtable(state);
547 		for (int i = 0; i < nelem; i++) {
548 			(void) lua_pushinteger(state, i + 1);
549 			(void) lua_pushstring(state, strarr[i]);
550 			(void) lua_settable(state, -3);
551 		}
552 		break;
553 	}
554 	case DATA_TYPE_UINT64_ARRAY: {
555 		uint64_t *intarr;
556 		uint_t nelem;
557 		(void) nvpair_value_uint64_array(pair, &intarr, &nelem);
558 		lua_newtable(state);
559 		for (int i = 0; i < nelem; i++) {
560 			(void) lua_pushinteger(state, i + 1);
561 			(void) lua_pushinteger(state, intarr[i]);
562 			(void) lua_settable(state, -3);
563 		}
564 		break;
565 	}
566 	case DATA_TYPE_INT64_ARRAY: {
567 		int64_t *intarr;
568 		uint_t nelem;
569 		(void) nvpair_value_int64_array(pair, &intarr, &nelem);
570 		lua_newtable(state);
571 		for (int i = 0; i < nelem; i++) {
572 			(void) lua_pushinteger(state, i + 1);
573 			(void) lua_pushinteger(state, intarr[i]);
574 			(void) lua_settable(state, -3);
575 		}
576 		break;
577 	}
578 	default: {
579 		if (errbuf != NULL) {
580 			(void) snprintf(errbuf, errbuf_len,
581 			    "Unhandled nvpair type %d for key '%s'",
582 			    nvpair_type(pair), nvpair_name(pair));
583 		}
584 		return (EINVAL);
585 	}
586 	}
587 	return (err);
588 }
589 
590 int
zcp_dataset_hold_error(lua_State * state,dsl_pool_t * dp,const char * dsname,int error)591 zcp_dataset_hold_error(lua_State *state, dsl_pool_t *dp, const char *dsname,
592     int error)
593 {
594 	if (error == ENOENT) {
595 		(void) zcp_argerror(state, 1, "no such dataset '%s'", dsname);
596 		return (0); /* not reached; zcp_argerror will longjmp */
597 	} else if (error == EXDEV) {
598 		(void) zcp_argerror(state, 1,
599 		    "dataset '%s' is not in the target pool '%s'",
600 		    dsname, spa_name(dp->dp_spa));
601 		return (0); /* not reached; zcp_argerror will longjmp */
602 	} else if (error == EIO) {
603 		(void) luaL_error(state,
604 		    "I/O error while accessing dataset '%s'", dsname);
605 		return (0); /* not reached; luaL_error will longjmp */
606 	} else if (error != 0) {
607 		(void) luaL_error(state,
608 		    "unexpected error %d while accessing dataset '%s'",
609 		    error, dsname);
610 		return (0); /* not reached; luaL_error will longjmp */
611 	}
612 	return (0);
613 }
614 
615 /*
616  * Note: will longjmp (via lua_error()) on error.
617  * Assumes that the dsname is argument #1 (for error reporting purposes).
618  */
619 dsl_dataset_t *
zcp_dataset_hold(lua_State * state,dsl_pool_t * dp,const char * dsname,void * tag)620 zcp_dataset_hold(lua_State *state, dsl_pool_t *dp, const char *dsname,
621     void *tag)
622 {
623 	dsl_dataset_t *ds;
624 	int error = dsl_dataset_hold(dp, dsname, tag, &ds);
625 	(void) zcp_dataset_hold_error(state, dp, dsname, error);
626 	return (ds);
627 }
628 
629 static int zcp_debug(lua_State *);
630 static zcp_lib_info_t zcp_debug_info = {
631 	.name = "debug",
632 	.func = zcp_debug,
633 	.pargs = {
634 	    { .za_name = "debug string", .za_lua_type = LUA_TSTRING},
635 	    {NULL, 0}
636 	},
637 	.kwargs = {
638 	    {NULL, 0}
639 	}
640 };
641 
642 static int
zcp_debug(lua_State * state)643 zcp_debug(lua_State *state)
644 {
645 	const char *dbgstring;
646 	zcp_run_info_t *ri = zcp_run_info(state);
647 	zcp_lib_info_t *libinfo = &zcp_debug_info;
648 
649 	zcp_parse_args(state, libinfo->name, libinfo->pargs, libinfo->kwargs);
650 
651 	dbgstring = lua_tostring(state, 1);
652 
653 	zfs_dbgmsg("txg %lld ZCP: %s", ri->zri_tx->tx_txg, dbgstring);
654 
655 	return (0);
656 }
657 
658 static int zcp_exists(lua_State *);
659 static zcp_lib_info_t zcp_exists_info = {
660 	.name = "exists",
661 	.func = zcp_exists,
662 	.pargs = {
663 	    { .za_name = "dataset", .za_lua_type = LUA_TSTRING},
664 	    {NULL, 0}
665 	},
666 	.kwargs = {
667 	    {NULL, 0}
668 	}
669 };
670 
671 static int
zcp_exists(lua_State * state)672 zcp_exists(lua_State *state)
673 {
674 	zcp_run_info_t *ri = zcp_run_info(state);
675 	dsl_pool_t *dp = ri->zri_pool;
676 	zcp_lib_info_t *libinfo = &zcp_exists_info;
677 
678 	zcp_parse_args(state, libinfo->name, libinfo->pargs, libinfo->kwargs);
679 
680 	const char *dsname = lua_tostring(state, 1);
681 
682 	dsl_dataset_t *ds;
683 	int error = dsl_dataset_hold(dp, dsname, FTAG, &ds);
684 	if (error == 0) {
685 		dsl_dataset_rele(ds, FTAG);
686 		lua_pushboolean(state, B_TRUE);
687 	} else if (error == ENOENT) {
688 		lua_pushboolean(state, B_FALSE);
689 	} else if (error == EXDEV) {
690 		return (luaL_error(state, "dataset '%s' is not in the "
691 		    "target pool", dsname));
692 	} else if (error == EIO) {
693 		return (luaL_error(state, "I/O error opening dataset '%s'",
694 		    dsname));
695 	} else if (error != 0) {
696 		return (luaL_error(state, "unexpected error %d", error));
697 	}
698 
699 	return (1);
700 }
701 
702 /*
703  * Allocate/realloc/free a buffer for the lua interpreter.
704  *
705  * When nsize is 0, behaves as free() and returns NULL.
706  *
707  * If ptr is NULL, behaves as malloc() and returns an allocated buffer of size
708  * at least nsize.
709  *
710  * Otherwise, behaves as realloc(), changing the allocation from osize to nsize.
711  * Shrinking the buffer size never fails.
712  *
713  * The original allocated buffer size is stored as a uint64 at the beginning of
714  * the buffer to avoid actually reallocating when shrinking a buffer, since lua
715  * requires that this operation never fail.
716  */
717 static void *
zcp_lua_alloc(void * ud,void * ptr,size_t osize,size_t nsize)718 zcp_lua_alloc(void *ud, void *ptr, size_t osize, size_t nsize)
719 {
720 	zcp_alloc_arg_t *allocargs = ud;
721 	int flags = (allocargs->aa_must_succeed) ?
722 	    KM_SLEEP : (KM_NOSLEEP | KM_NORMALPRI);
723 
724 	if (nsize == 0) {
725 		if (ptr != NULL) {
726 			int64_t *allocbuf = (int64_t *)ptr - 1;
727 			int64_t allocsize = *allocbuf;
728 			ASSERT3S(allocsize, >, 0);
729 			ASSERT3S(allocargs->aa_alloc_remaining + allocsize, <=,
730 			    allocargs->aa_alloc_limit);
731 			allocargs->aa_alloc_remaining += allocsize;
732 			kmem_free(allocbuf, allocsize);
733 		}
734 		return (NULL);
735 	} else if (ptr == NULL) {
736 		int64_t *allocbuf;
737 		int64_t allocsize = nsize + sizeof (int64_t);
738 
739 		if (!allocargs->aa_must_succeed &&
740 		    (allocsize <= 0 ||
741 		    allocsize > allocargs->aa_alloc_remaining)) {
742 			return (NULL);
743 		}
744 
745 		allocbuf = kmem_alloc(allocsize, flags);
746 		if (allocbuf == NULL) {
747 			return (NULL);
748 		}
749 		allocargs->aa_alloc_remaining -= allocsize;
750 
751 		*allocbuf = allocsize;
752 		return (allocbuf + 1);
753 	} else if (nsize <= osize) {
754 		/*
755 		 * If shrinking the buffer, lua requires that the reallocation
756 		 * never fail.
757 		 */
758 		return (ptr);
759 	} else {
760 		ASSERT3U(nsize, >, osize);
761 
762 		uint64_t *luabuf = zcp_lua_alloc(ud, NULL, 0, nsize);
763 		if (luabuf == NULL) {
764 			return (NULL);
765 		}
766 		(void) memcpy(luabuf, ptr, osize);
767 		VERIFY3P(zcp_lua_alloc(ud, ptr, osize, 0), ==, NULL);
768 		return (luabuf);
769 	}
770 }
771 
772 /* ARGSUSED */
773 static void
zcp_lua_counthook(lua_State * state,lua_Debug * ar)774 zcp_lua_counthook(lua_State *state, lua_Debug *ar)
775 {
776 	lua_getfield(state, LUA_REGISTRYINDEX, ZCP_RUN_INFO_KEY);
777 	zcp_run_info_t *ri = lua_touserdata(state, -1);
778 
779 	/*
780 	 * Check if we were canceled while waiting for the
781 	 * txg to sync or from our open context thread
782 	 */
783 	if (ri->zri_canceled ||
784 	    (!ri->zri_sync && issig(JUSTLOOKING) && issig(FORREAL))) {
785 		ri->zri_canceled = B_TRUE;
786 		(void) lua_pushstring(state, "Channel program was canceled.");
787 		(void) lua_error(state);
788 	}
789 
790 	/*
791 	 * Check how many instructions the channel program has
792 	 * executed so far, and compare against the limit.
793 	 */
794 	ri->zri_curinstrs += zfs_lua_check_instrlimit_interval;
795 	if (ri->zri_maxinstrs != 0 && ri->zri_curinstrs > ri->zri_maxinstrs) {
796 		ri->zri_timed_out = B_TRUE;
797 		(void) lua_pushstring(state,
798 		    "Channel program timed out.");
799 		(void) lua_error(state);
800 	}
801 }
802 
803 static int
zcp_panic_cb(lua_State * state)804 zcp_panic_cb(lua_State *state)
805 {
806 	panic("unprotected error in call to Lua API (%s)\n",
807 	    lua_tostring(state, -1));
808 	return (0);
809 }
810 
811 static void
zcp_eval_impl(dmu_tx_t * tx,zcp_run_info_t * ri)812 zcp_eval_impl(dmu_tx_t *tx, zcp_run_info_t *ri)
813 {
814 	int err;
815 	lua_State *state = ri->zri_state;
816 
817 	VERIFY3U(3, ==, lua_gettop(state));
818 
819 	/* finish initializing our runtime state */
820 	ri->zri_pool = dmu_tx_pool(tx);
821 	ri->zri_tx = tx;
822 	list_create(&ri->zri_cleanup_handlers, sizeof (zcp_cleanup_handler_t),
823 	    offsetof(zcp_cleanup_handler_t, zch_node));
824 
825 	/*
826 	 * Store the zcp_run_info_t struct for this run in the Lua registry.
827 	 * Registry entries are not directly accessible by the Lua scripts but
828 	 * can be accessed by our callbacks.
829 	 */
830 	lua_pushlightuserdata(state, ri);
831 	lua_setfield(state, LUA_REGISTRYINDEX, ZCP_RUN_INFO_KEY);
832 	VERIFY3U(3, ==, lua_gettop(state));
833 
834 	/*
835 	 * Tell the Lua interpreter to call our handler every count
836 	 * instructions. Channel programs that execute too many instructions
837 	 * should die with ETIME.
838 	 */
839 	(void) lua_sethook(state, zcp_lua_counthook, LUA_MASKCOUNT,
840 	    zfs_lua_check_instrlimit_interval);
841 
842 	/*
843 	 * Tell the Lua memory allocator to stop using KM_SLEEP before handing
844 	 * off control to the channel program. Channel programs that use too
845 	 * much memory should die with ENOSPC.
846 	 */
847 	ri->zri_allocargs->aa_must_succeed = B_FALSE;
848 
849 	/*
850 	 * Call the Lua function that open-context passed us. This pops the
851 	 * function and its input from the stack and pushes any return
852 	 * or error values.
853 	 */
854 	err = lua_pcall(state, 1, LUA_MULTRET, 1);
855 
856 	/*
857 	 * Let Lua use KM_SLEEP while we interpret the return values.
858 	 */
859 	ri->zri_allocargs->aa_must_succeed = B_TRUE;
860 
861 	/*
862 	 * Remove the error handler callback from the stack. At this point,
863 	 * there shouldn't be any cleanup handler registered in the handler
864 	 * list (zri_cleanup_handlers), regardless of whether it ran or not.
865 	 */
866 	list_destroy(&ri->zri_cleanup_handlers);
867 	lua_remove(state, 1);
868 
869 	switch (err) {
870 	case LUA_OK: {
871 		/*
872 		 * Lua supports returning multiple values in a single return
873 		 * statement.  Return values will have been pushed onto the
874 		 * stack:
875 		 * 1: Return value 1
876 		 * 2: Return value 2
877 		 * 3: etc...
878 		 * To simplify the process of retrieving a return value from a
879 		 * channel program, we disallow returning more than one value
880 		 * to ZFS from the Lua script, yielding a singleton return
881 		 * nvlist of the form { "return": Return value 1 }.
882 		 */
883 		int return_count = lua_gettop(state);
884 
885 		if (return_count == 1) {
886 			ri->zri_result = 0;
887 			zcp_convert_return_values(state, ri->zri_outnvl,
888 			    ZCP_RET_RETURN, &ri->zri_result);
889 		} else if (return_count > 1) {
890 			ri->zri_result = SET_ERROR(ECHRNG);
891 			lua_settop(state, 0);
892 			(void) lua_pushfstring(state, "Multiple return "
893 			    "values not supported");
894 			zcp_convert_return_values(state, ri->zri_outnvl,
895 			    ZCP_RET_ERROR, &ri->zri_result);
896 		}
897 		break;
898 	}
899 	case LUA_ERRRUN:
900 	case LUA_ERRGCMM: {
901 		/*
902 		 * The channel program encountered a fatal error within the
903 		 * script, such as failing an assertion, or calling a function
904 		 * with incompatible arguments. The error value and the
905 		 * traceback generated by zcp_error_handler() should be on the
906 		 * stack.
907 		 */
908 		VERIFY3U(1, ==, lua_gettop(state));
909 		if (ri->zri_timed_out) {
910 			ri->zri_result = SET_ERROR(ETIME);
911 		} else if (ri->zri_canceled) {
912 			ri->zri_result = SET_ERROR(EINTR);
913 		} else {
914 			ri->zri_result = SET_ERROR(ECHRNG);
915 		}
916 
917 		zcp_convert_return_values(state, ri->zri_outnvl,
918 		    ZCP_RET_ERROR, &ri->zri_result);
919 		break;
920 	}
921 	case LUA_ERRERR: {
922 		/*
923 		 * The channel program encountered a fatal error within the
924 		 * script, and we encountered another error while trying to
925 		 * compute the traceback in zcp_error_handler(). We can only
926 		 * return the error message.
927 		 */
928 		VERIFY3U(1, ==, lua_gettop(state));
929 		if (ri->zri_timed_out) {
930 			ri->zri_result = SET_ERROR(ETIME);
931 		} else if (ri->zri_canceled) {
932 			ri->zri_result = SET_ERROR(EINTR);
933 		} else {
934 			ri->zri_result = SET_ERROR(ECHRNG);
935 		}
936 
937 		zcp_convert_return_values(state, ri->zri_outnvl,
938 		    ZCP_RET_ERROR, &ri->zri_result);
939 		break;
940 	}
941 	case LUA_ERRMEM:
942 		/*
943 		 * Lua ran out of memory while running the channel program.
944 		 * There's not much we can do.
945 		 */
946 		ri->zri_result = SET_ERROR(ENOSPC);
947 		break;
948 	default:
949 		VERIFY0(err);
950 	}
951 }
952 
953 static void
zcp_pool_error(zcp_run_info_t * ri,const char * poolname)954 zcp_pool_error(zcp_run_info_t *ri, const char *poolname)
955 {
956 	ri->zri_result = SET_ERROR(ECHRNG);
957 	lua_settop(ri->zri_state, 0);
958 	(void) lua_pushfstring(ri->zri_state, "Could not open pool: %s",
959 	    poolname);
960 	zcp_convert_return_values(ri->zri_state, ri->zri_outnvl,
961 	    ZCP_RET_ERROR, &ri->zri_result);
962 
963 }
964 
965 /*
966  * This callback is called when txg_wait_synced_sig encountered a signal.
967  * The txg_wait_synced_sig will continue to wait for the txg to complete
968  * after calling this callback.
969  */
970 /* ARGSUSED */
971 static void
zcp_eval_sig(void * arg,dmu_tx_t * tx)972 zcp_eval_sig(void *arg, dmu_tx_t *tx)
973 {
974 	zcp_run_info_t *ri = arg;
975 
976 	ri->zri_canceled = B_TRUE;
977 }
978 
979 static void
zcp_eval_sync(void * arg,dmu_tx_t * tx)980 zcp_eval_sync(void *arg, dmu_tx_t *tx)
981 {
982 	zcp_run_info_t *ri = arg;
983 
984 	/*
985 	 * Open context should have setup the stack to contain:
986 	 * 1: Error handler callback
987 	 * 2: Script to run (converted to a Lua function)
988 	 * 3: nvlist input to function (converted to Lua table or nil)
989 	 */
990 	VERIFY3U(3, ==, lua_gettop(ri->zri_state));
991 
992 	zcp_eval_impl(tx, ri);
993 }
994 
995 static void
zcp_eval_open(zcp_run_info_t * ri,const char * poolname)996 zcp_eval_open(zcp_run_info_t *ri, const char *poolname)
997 {
998 	int error;
999 	dsl_pool_t *dp;
1000 	dmu_tx_t *tx;
1001 
1002 	/*
1003 	 * See comment from the same assertion in zcp_eval_sync().
1004 	 */
1005 	VERIFY3U(3, ==, lua_gettop(ri->zri_state));
1006 
1007 	error = dsl_pool_hold(poolname, FTAG, &dp);
1008 	if (error != 0) {
1009 		zcp_pool_error(ri, poolname);
1010 		return;
1011 	}
1012 
1013 	/*
1014 	 * As we are running in open-context, we have no transaction associated
1015 	 * with the channel program. At the same time, functions from the
1016 	 * zfs.check submodule need to be associated with a transaction as
1017 	 * they are basically dry-runs of their counterparts in the zfs.sync
1018 	 * submodule. These functions should be able to run in open-context.
1019 	 * Therefore we create a new transaction that we later abort once
1020 	 * the channel program has been evaluated.
1021 	 */
1022 	tx = dmu_tx_create_dd(dp->dp_mos_dir);
1023 
1024 	zcp_eval_impl(tx, ri);
1025 
1026 	dmu_tx_abort(tx);
1027 
1028 	dsl_pool_rele(dp, FTAG);
1029 }
1030 
1031 int
zcp_eval(const char * poolname,const char * program,boolean_t sync,uint64_t instrlimit,uint64_t memlimit,nvpair_t * nvarg,nvlist_t * outnvl)1032 zcp_eval(const char *poolname, const char *program, boolean_t sync,
1033     uint64_t instrlimit, uint64_t memlimit, nvpair_t *nvarg, nvlist_t *outnvl)
1034 {
1035 	int err;
1036 	lua_State *state;
1037 	zcp_run_info_t runinfo;
1038 
1039 	if (instrlimit > zfs_lua_max_instrlimit)
1040 		return (SET_ERROR(EINVAL));
1041 	if (memlimit == 0 || memlimit > zfs_lua_max_memlimit)
1042 		return (SET_ERROR(EINVAL));
1043 
1044 	zcp_alloc_arg_t allocargs = {
1045 		.aa_must_succeed = B_TRUE,
1046 		.aa_alloc_remaining = (int64_t)memlimit,
1047 		.aa_alloc_limit = (int64_t)memlimit,
1048 	};
1049 
1050 	/*
1051 	 * Creates a Lua state with a memory allocator that uses KM_SLEEP.
1052 	 * This should never fail.
1053 	 */
1054 	state = lua_newstate(zcp_lua_alloc, &allocargs);
1055 	VERIFY(state != NULL);
1056 	(void) lua_atpanic(state, zcp_panic_cb);
1057 
1058 	/*
1059 	 * Load core Lua libraries we want access to.
1060 	 */
1061 	VERIFY3U(1, ==, luaopen_base(state));
1062 	lua_pop(state, 1);
1063 	VERIFY3U(1, ==, luaopen_coroutine(state));
1064 	lua_setglobal(state, LUA_COLIBNAME);
1065 	VERIFY0(lua_gettop(state));
1066 	VERIFY3U(1, ==, luaopen_string(state));
1067 	lua_setglobal(state, LUA_STRLIBNAME);
1068 	VERIFY0(lua_gettop(state));
1069 	VERIFY3U(1, ==, luaopen_table(state));
1070 	lua_setglobal(state, LUA_TABLIBNAME);
1071 	VERIFY0(lua_gettop(state));
1072 
1073 	/*
1074 	 * Load globally visible variables such as errno aliases.
1075 	 */
1076 	zcp_load_globals(state);
1077 	VERIFY0(lua_gettop(state));
1078 
1079 	/*
1080 	 * Load ZFS-specific modules.
1081 	 */
1082 	lua_newtable(state);
1083 	VERIFY3U(1, ==, zcp_load_list_lib(state));
1084 	lua_setfield(state, -2, "list");
1085 	VERIFY3U(1, ==, zcp_load_synctask_lib(state, B_FALSE));
1086 	lua_setfield(state, -2, "check");
1087 	VERIFY3U(1, ==, zcp_load_synctask_lib(state, B_TRUE));
1088 	lua_setfield(state, -2, "sync");
1089 	VERIFY3U(1, ==, zcp_load_get_lib(state));
1090 	lua_pushcclosure(state, zcp_debug_info.func, 0);
1091 	lua_setfield(state, -2, zcp_debug_info.name);
1092 	lua_pushcclosure(state, zcp_exists_info.func, 0);
1093 	lua_setfield(state, -2, zcp_exists_info.name);
1094 	lua_setglobal(state, "zfs");
1095 	VERIFY0(lua_gettop(state));
1096 
1097 	/*
1098 	 * Push the error-callback that calculates Lua stack traces on
1099 	 * unexpected failures.
1100 	 */
1101 	lua_pushcfunction(state, zcp_error_handler);
1102 	VERIFY3U(1, ==, lua_gettop(state));
1103 
1104 	/*
1105 	 * Load the actual script as a function onto the stack as text ("t").
1106 	 * The only valid error condition is a syntax error in the script.
1107 	 * ERRMEM should not be possible because our allocator is using
1108 	 * KM_SLEEP.  ERRGCMM should not be possible because we have not added
1109 	 * any objects with __gc metamethods to the interpreter that could
1110 	 * fail.
1111 	 */
1112 	err = luaL_loadbufferx(state, program, strlen(program),
1113 	    "channel program", "t");
1114 	if (err == LUA_ERRSYNTAX) {
1115 		fnvlist_add_string(outnvl, ZCP_RET_ERROR,
1116 		    lua_tostring(state, -1));
1117 		lua_close(state);
1118 		return (SET_ERROR(EINVAL));
1119 	}
1120 	VERIFY0(err);
1121 	VERIFY3U(2, ==, lua_gettop(state));
1122 
1123 	/*
1124 	 * Convert the input nvlist to a Lua object and put it on top of the
1125 	 * stack.
1126 	 */
1127 	char errmsg[128];
1128 	err = zcp_nvpair_value_to_lua(state, nvarg,
1129 	    errmsg, sizeof (errmsg));
1130 	if (err != 0) {
1131 		fnvlist_add_string(outnvl, ZCP_RET_ERROR, errmsg);
1132 		lua_close(state);
1133 		return (SET_ERROR(EINVAL));
1134 	}
1135 	VERIFY3U(3, ==, lua_gettop(state));
1136 
1137 	runinfo.zri_state = state;
1138 	runinfo.zri_allocargs = &allocargs;
1139 	runinfo.zri_outnvl = outnvl;
1140 	runinfo.zri_result = 0;
1141 	runinfo.zri_cred = CRED();
1142 	runinfo.zri_timed_out = B_FALSE;
1143 	runinfo.zri_canceled = B_FALSE;
1144 	runinfo.zri_sync = sync;
1145 	runinfo.zri_space_used = 0;
1146 	runinfo.zri_curinstrs = 0;
1147 	runinfo.zri_maxinstrs = instrlimit;
1148 
1149 	if (sync) {
1150 		err = dsl_sync_task_sig(poolname, NULL, zcp_eval_sync,
1151 		    zcp_eval_sig, &runinfo, 0, ZFS_SPACE_CHECK_ZCP_EVAL);
1152 		if (err != 0)
1153 			zcp_pool_error(&runinfo, poolname);
1154 	} else {
1155 		zcp_eval_open(&runinfo, poolname);
1156 	}
1157 	lua_close(state);
1158 
1159 	return (runinfo.zri_result);
1160 }
1161 
1162 /*
1163  * Retrieve metadata about the currently running channel program.
1164  */
1165 zcp_run_info_t *
zcp_run_info(lua_State * state)1166 zcp_run_info(lua_State *state)
1167 {
1168 	zcp_run_info_t *ri;
1169 
1170 	lua_getfield(state, LUA_REGISTRYINDEX, ZCP_RUN_INFO_KEY);
1171 	ri = lua_touserdata(state, -1);
1172 	lua_pop(state, 1);
1173 	return (ri);
1174 }
1175 
1176 /*
1177  * Argument Parsing
1178  * ================
1179  *
1180  * The Lua language allows methods to be called with any number
1181  * of arguments of any type. When calling back into ZFS we need to sanitize
1182  * arguments from channel programs to make sure unexpected arguments or
1183  * arguments of the wrong type result in clear error messages. To do this
1184  * in a uniform way all callbacks from channel programs should use the
1185  * zcp_parse_args() function to interpret inputs.
1186  *
1187  * Positional vs Keyword Arguments
1188  * ===============================
1189  *
1190  * Every callback function takes a fixed set of required positional arguments
1191  * and optional keyword arguments. For example, the destroy function takes
1192  * a single positional string argument (the name of the dataset to destroy)
1193  * and an optional "defer" keyword boolean argument. When calling lua functions
1194  * with parentheses, only positional arguments can be used:
1195  *
1196  *     zfs.sync.snapshot("rpool@snap")
1197  *
1198  * To use keyword arguments functions should be called with a single argument
1199  * that is a lua table containing mappings of integer -> positional arguments
1200  * and string -> keyword arguments:
1201  *
1202  *     zfs.sync.snapshot({1="rpool@snap", defer=true})
1203  *
1204  * The lua language allows curly braces to be used in place of parenthesis as
1205  * syntactic sugar for this calling convention:
1206  *
1207  *     zfs.sync.snapshot{"rpool@snap", defer=true}
1208  */
1209 
1210 /*
1211  * Throw an error and print the given arguments.  If there are too many
1212  * arguments to fit in the output buffer, only the error format string is
1213  * output.
1214  */
1215 static void
zcp_args_error(lua_State * state,const char * fname,const zcp_arg_t * pargs,const zcp_arg_t * kwargs,const char * fmt,...)1216 zcp_args_error(lua_State *state, const char *fname, const zcp_arg_t *pargs,
1217     const zcp_arg_t *kwargs, const char *fmt, ...)
1218 {
1219 	int i;
1220 	char errmsg[512];
1221 	size_t len = sizeof (errmsg);
1222 	size_t msglen = 0;
1223 	va_list argp;
1224 
1225 	va_start(argp, fmt);
1226 	VERIFY3U(len, >, vsnprintf(errmsg, len, fmt, argp));
1227 	va_end(argp);
1228 
1229 	/*
1230 	 * Calculate the total length of the final string, including extra
1231 	 * formatting characters. If the argument dump would be too large,
1232 	 * only print the error string.
1233 	 */
1234 	msglen = strlen(errmsg);
1235 	msglen += strlen(fname) + 4; /* : + {} + null terminator */
1236 	for (i = 0; pargs[i].za_name != NULL; i++) {
1237 		msglen += strlen(pargs[i].za_name);
1238 		msglen += strlen(lua_typename(state, pargs[i].za_lua_type));
1239 		if (pargs[i + 1].za_name != NULL || kwargs[0].za_name != NULL)
1240 			msglen += 5; /* < + ( + )> + , */
1241 		else
1242 			msglen += 4; /* < + ( + )> */
1243 	}
1244 	for (i = 0; kwargs[i].za_name != NULL; i++) {
1245 		msglen += strlen(kwargs[i].za_name);
1246 		msglen += strlen(lua_typename(state, kwargs[i].za_lua_type));
1247 		if (kwargs[i + 1].za_name != NULL)
1248 			msglen += 4; /* =( + ) + , */
1249 		else
1250 			msglen += 3; /* =( + ) */
1251 	}
1252 
1253 	if (msglen >= len)
1254 		(void) luaL_error(state, errmsg);
1255 
1256 	VERIFY3U(len, >, strlcat(errmsg, ": ", len));
1257 	VERIFY3U(len, >, strlcat(errmsg, fname, len));
1258 	VERIFY3U(len, >, strlcat(errmsg, "{", len));
1259 	for (i = 0; pargs[i].za_name != NULL; i++) {
1260 		VERIFY3U(len, >, strlcat(errmsg, "<", len));
1261 		VERIFY3U(len, >, strlcat(errmsg, pargs[i].za_name, len));
1262 		VERIFY3U(len, >, strlcat(errmsg, "(", len));
1263 		VERIFY3U(len, >, strlcat(errmsg,
1264 		    lua_typename(state, pargs[i].za_lua_type), len));
1265 		VERIFY3U(len, >, strlcat(errmsg, ")>", len));
1266 		if (pargs[i + 1].za_name != NULL || kwargs[0].za_name != NULL) {
1267 			VERIFY3U(len, >, strlcat(errmsg, ", ", len));
1268 		}
1269 	}
1270 	for (i = 0; kwargs[i].za_name != NULL; i++) {
1271 		VERIFY3U(len, >, strlcat(errmsg, kwargs[i].za_name, len));
1272 		VERIFY3U(len, >, strlcat(errmsg, "=(", len));
1273 		VERIFY3U(len, >, strlcat(errmsg,
1274 		    lua_typename(state, kwargs[i].za_lua_type), len));
1275 		VERIFY3U(len, >, strlcat(errmsg, ")", len));
1276 		if (kwargs[i + 1].za_name != NULL) {
1277 			VERIFY3U(len, >, strlcat(errmsg, ", ", len));
1278 		}
1279 	}
1280 	VERIFY3U(len, >, strlcat(errmsg, "}", len));
1281 
1282 	(void) luaL_error(state, errmsg);
1283 	panic("unreachable code");
1284 }
1285 
1286 static void
zcp_parse_table_args(lua_State * state,const char * fname,const zcp_arg_t * pargs,const zcp_arg_t * kwargs)1287 zcp_parse_table_args(lua_State *state, const char *fname,
1288     const zcp_arg_t *pargs, const zcp_arg_t *kwargs)
1289 {
1290 	int i;
1291 	int type;
1292 
1293 	for (i = 0; pargs[i].za_name != NULL; i++) {
1294 		/*
1295 		 * Check the table for this positional argument, leaving it
1296 		 * on the top of the stack once we finish validating it.
1297 		 */
1298 		lua_pushinteger(state, i + 1);
1299 		lua_gettable(state, 1);
1300 
1301 		type = lua_type(state, -1);
1302 		if (type == LUA_TNIL) {
1303 			zcp_args_error(state, fname, pargs, kwargs,
1304 			    "too few arguments");
1305 			panic("unreachable code");
1306 		} else if (type != pargs[i].za_lua_type) {
1307 			zcp_args_error(state, fname, pargs, kwargs,
1308 			    "arg %d wrong type (is '%s', expected '%s')",
1309 			    i + 1, lua_typename(state, type),
1310 			    lua_typename(state, pargs[i].za_lua_type));
1311 			panic("unreachable code");
1312 		}
1313 
1314 		/*
1315 		 * Remove the positional argument from the table.
1316 		 */
1317 		lua_pushinteger(state, i + 1);
1318 		lua_pushnil(state);
1319 		lua_settable(state, 1);
1320 	}
1321 
1322 	for (i = 0; kwargs[i].za_name != NULL; i++) {
1323 		/*
1324 		 * Check the table for this keyword argument, which may be
1325 		 * nil if it was omitted. Leave the value on the top of
1326 		 * the stack after validating it.
1327 		 */
1328 		lua_getfield(state, 1, kwargs[i].za_name);
1329 
1330 		type = lua_type(state, -1);
1331 		if (type != LUA_TNIL && type != kwargs[i].za_lua_type) {
1332 			zcp_args_error(state, fname, pargs, kwargs,
1333 			    "kwarg '%s' wrong type (is '%s', expected '%s')",
1334 			    kwargs[i].za_name, lua_typename(state, type),
1335 			    lua_typename(state, kwargs[i].za_lua_type));
1336 			panic("unreachable code");
1337 		}
1338 
1339 		/*
1340 		 * Remove the keyword argument from the table.
1341 		 */
1342 		lua_pushnil(state);
1343 		lua_setfield(state, 1, kwargs[i].za_name);
1344 	}
1345 
1346 	/*
1347 	 * Any entries remaining in the table are invalid inputs, print
1348 	 * an error message based on what the entry is.
1349 	 */
1350 	lua_pushnil(state);
1351 	if (lua_next(state, 1)) {
1352 		if (lua_isnumber(state, -2) && lua_tointeger(state, -2) > 0) {
1353 			zcp_args_error(state, fname, pargs, kwargs,
1354 			    "too many positional arguments");
1355 		} else if (lua_isstring(state, -2)) {
1356 			zcp_args_error(state, fname, pargs, kwargs,
1357 			    "invalid kwarg '%s'", lua_tostring(state, -2));
1358 		} else {
1359 			zcp_args_error(state, fname, pargs, kwargs,
1360 			    "kwarg keys must be strings");
1361 		}
1362 		panic("unreachable code");
1363 	}
1364 
1365 	lua_remove(state, 1);
1366 }
1367 
1368 static void
zcp_parse_pos_args(lua_State * state,const char * fname,const zcp_arg_t * pargs,const zcp_arg_t * kwargs)1369 zcp_parse_pos_args(lua_State *state, const char *fname, const zcp_arg_t *pargs,
1370     const zcp_arg_t *kwargs)
1371 {
1372 	int i;
1373 	int type;
1374 
1375 	for (i = 0; pargs[i].za_name != NULL; i++) {
1376 		type = lua_type(state, i + 1);
1377 		if (type == LUA_TNONE) {
1378 			zcp_args_error(state, fname, pargs, kwargs,
1379 			    "too few arguments");
1380 			panic("unreachable code");
1381 		} else if (type != pargs[i].za_lua_type) {
1382 			zcp_args_error(state, fname, pargs, kwargs,
1383 			    "arg %d wrong type (is '%s', expected '%s')",
1384 			    i + 1, lua_typename(state, type),
1385 			    lua_typename(state, pargs[i].za_lua_type));
1386 			panic("unreachable code");
1387 		}
1388 	}
1389 	if (lua_gettop(state) != i) {
1390 		zcp_args_error(state, fname, pargs, kwargs,
1391 		    "too many positional arguments");
1392 		panic("unreachable code");
1393 	}
1394 
1395 	for (i = 0; kwargs[i].za_name != NULL; i++) {
1396 		lua_pushnil(state);
1397 	}
1398 }
1399 
1400 /*
1401  * Checks the current Lua stack against an expected set of positional and
1402  * keyword arguments. If the stack does not match the expected arguments
1403  * aborts the current channel program with a useful error message, otherwise
1404  * it re-arranges the stack so that it contains the positional arguments
1405  * followed by the keyword argument values in declaration order. Any missing
1406  * keyword argument will be represented by a nil value on the stack.
1407  *
1408  * If the stack contains exactly one argument of type LUA_TTABLE the curly
1409  * braces calling convention is assumed, otherwise the stack is parsed for
1410  * positional arguments only.
1411  *
1412  * This function should be used by every function callback. It should be called
1413  * before the callback manipulates the Lua stack as it assumes the stack
1414  * represents the function arguments.
1415  */
1416 void
zcp_parse_args(lua_State * state,const char * fname,const zcp_arg_t * pargs,const zcp_arg_t * kwargs)1417 zcp_parse_args(lua_State *state, const char *fname, const zcp_arg_t *pargs,
1418     const zcp_arg_t *kwargs)
1419 {
1420 	if (lua_gettop(state) == 1 && lua_istable(state, 1)) {
1421 		zcp_parse_table_args(state, fname, pargs, kwargs);
1422 	} else {
1423 		zcp_parse_pos_args(state, fname, pargs, kwargs);
1424 	}
1425 }
1426